From 4d8caf9851f63073145996fd4a535278014d01be Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Date: Mon, 23 Mar 2020 16:20:05 +0100
Subject: [PATCH 001/591] ZOOKEEPER-3756: Members slow to rejoin quorum using
 Kubernetes

Whenever we close the current master ZooKeeper server, a new leader election
is triggered. During the new election, a connection will be established between
all the servers, by calling the synchronized 'connectOne' method in
QuorumCnxManager. The method will open the socket and send a single small
initial message to the other server, usually very quickly. If the destination
host is unreachable, it should fail immediately.

However, when we use Kubernetes, then the destination host is always reachable
as it points to Kubernetes services. If the actual container / pod is not
available then the 'socket.connect' method will timeout (by default after 5 sec)
instead of failing immediately with NoRouteToHostException. As the 'connectOne'
method is synchronized, this timeout will block the creation of other
connections, so a single unreachable host can cause timeout in the leader
election protocol.

One workaround is to decrease the socket connection timeout with the
'-Dzookeeper.cnxTimeout' stystem property, but the proper fix would be to
make the connection initiation fully asynchronous, as using very low timeout can
have its own side effect. Fortunately most of the initial message sending
is already made async: the SASL authentication can take more time, so the
second (authentication + initial message sending) part of the initiation protocol
is already called in a separate thread, when Quorum SASL authentication is enabled.

In the following patch I made the whole connection initiation async, by
always using the async executor (not only when Quorum SASL is enabled) and
also moving the socket.connect call into the async thread.

I also created a unit test to verify my fix. I added a static socket factory that can be
changed by the tests using a packet private setter method. My test failed (and
produced the same error logs as we see in the original Jira ticket) before I applied
my changes and a time-outed as no leader election succeeded after 15 seconds.
After the changes the test runs very quickly, in 1-2 seconds.

Note: due to the multiAddress changes, we will need different PRs to the branch 3.5
and to the 3.6+ branches. I will submit the other PR once this got reviewed.

Author: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Author: Mate Szalay-Beko <mszalay@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1289 from symat/ZOOKEEPER-3756-master
---
 .../server/quorum/QuorumCnxManager.java       | 170 ++++++++----------
 ...CnxManagerSocketConnectionTimeoutTest.java | 112 ++++++++++++
 2 files changed, 188 insertions(+), 94 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 66f6883470a..08384920125 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -27,7 +27,6 @@
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
-import java.net.NoRouteToHostException;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.SocketException;
@@ -58,6 +57,7 @@
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import javax.net.ssl.SSLSocket;
 import org.apache.zookeeper.common.NetUtils;
@@ -186,6 +186,17 @@ public class QuorumCnxManager {
      */
     private final boolean tcpKeepAlive = Boolean.getBoolean("zookeeper.tcpKeepAlive");
 
+
+    /*
+     * Socket factory, allowing the injection of custom socket implementations for testing
+     */
+    static final Supplier<Socket> DEFAULT_SOCKET_FACTORY = () -> new Socket();
+    private static Supplier<Socket> SOCKET_FACTORY = DEFAULT_SOCKET_FACTORY;
+    static void setSocketFactory(Supplier<Socket> factory) {
+        SOCKET_FACTORY = factory;
+    }
+
+
     public static class Message {
 
         Message(ByteBuffer buffer, long sid) {
@@ -316,41 +327,30 @@ public QuorumCnxManager(QuorumPeer self, final long mySid, Map<Long, QuorumPeer.
         this.socketTimeout = socketTimeout;
         this.view = view;
         this.listenOnAllIPs = listenOnAllIPs;
+        this.authServer = authServer;
+        this.authLearner = authLearner;
+        this.quorumSaslAuthEnabled = quorumSaslAuthEnabled;
 
-        initializeAuth(mySid, authServer, authLearner, quorumCnxnThreadsSize, quorumSaslAuthEnabled);
+        initializeConnectionExecutor(mySid, quorumCnxnThreadsSize);
 
         // Starts listener thread that waits for connection requests
         listener = new Listener();
         listener.setName("QuorumPeerListener");
     }
 
-    private void initializeAuth(final long mySid, final QuorumAuthServer authServer,
-        final QuorumAuthLearner authLearner, final int quorumCnxnThreadsSize, final boolean quorumSaslAuthEnabled) {
-
-        this.authServer = authServer;
-        this.authLearner = authLearner;
-        this.quorumSaslAuthEnabled = quorumSaslAuthEnabled;
-        if (!this.quorumSaslAuthEnabled) {
-            LOG.debug("Not initializing connection executor as quorum sasl auth is disabled");
-            return;
-        }
-
-        // init connection executors
+    // we always use the Connection Executor during connection initiation (to handle connection
+    // timeouts), and optionally use it during receiving connections (as the Quorum SASL authentication
+    // can take extra time)
+    private void initializeConnectionExecutor(final long mySid, final int quorumCnxnThreadsSize) {
         final AtomicInteger threadIndex = new AtomicInteger(1);
         SecurityManager s = System.getSecurityManager();
         final ThreadGroup group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup();
-        ThreadFactory daemonThFactory = new ThreadFactory() {
 
-            @Override
-            public Thread newThread(Runnable r) {
-                Thread t = new Thread(
-                    group,
-                    r,
-                    "QuorumConnectionThread-[myid=" + mySid + "]-" + threadIndex.getAndIncrement());
-                return t;
-            }
-        };
-        this.connectionExecutor = new ThreadPoolExecutor(3, quorumCnxnThreadsSize, 60, TimeUnit.SECONDS, new SynchronousQueue<Runnable>(), daemonThFactory);
+        final ThreadFactory daemonThFactory = runnable -> new Thread(group, runnable,
+            String.format("QuorumConnectionThread-[myid=%d]-%d", mySid, threadIndex.getAndIncrement()));
+
+        this.connectionExecutor = new ThreadPoolExecutor(3, quorumCnxnThreadsSize, 60, TimeUnit.SECONDS,
+                                                         new SynchronousQueue<>(), daemonThFactory);
         this.connectionExecutor.allowCoreThreadTimeOut(true);
     }
 
@@ -359,20 +359,49 @@ public Thread newThread(Runnable r) {
      *
      * @param sid
      */
-    public void testInitiateConnection(long sid) throws Exception {
+    public void testInitiateConnection(long sid) {
         LOG.debug("Opening channel to server {}", sid);
-        Socket sock = new Socket();
-        setSockOpts(sock);
-        InetSocketAddress address = self.getVotingView().get(sid).electionAddr.getReachableOrOne();
-        sock.connect(address, cnxTO);
-        initiateConnection(sock, sid);
+        initiateConnection(self.getVotingView().get(sid).electionAddr, sid);
     }
 
     /**
+     * First we create the socket, perform SSL handshake and authentication if needed.
+     * Then we perform the initiation protocol.
      * If this server has initiated the connection, then it gives up on the
      * connection if it loses challenge. Otherwise, it keeps the connection.
      */
-    public void initiateConnection(final Socket sock, final Long sid) {
+    public void initiateConnection(final MultipleAddresses electionAddr, final Long sid) {
+        Socket sock = null;
+        try {
+            LOG.debug("Opening channel to server {}", sid);
+            if (self.isSslQuorum()) {
+                sock = self.getX509Util().createSSLSocket();
+            } else {
+                sock = SOCKET_FACTORY.get();
+            }
+            setSockOpts(sock);
+            sock.connect(electionAddr.getReachableOrOne(), cnxTO);
+            if (sock instanceof SSLSocket) {
+                SSLSocket sslSock = (SSLSocket) sock;
+                sslSock.startHandshake();
+                LOG.info("SSL handshake complete with {} - {} - {}",
+                         sslSock.getRemoteSocketAddress(),
+                         sslSock.getSession().getProtocol(),
+                         sslSock.getSession().getCipherSuite());
+            }
+
+            LOG.debug("Connected to server {} using election address: {}:{}",
+                      sid, sock.getInetAddress(), sock.getPort());
+        } catch (X509Exception e) {
+            LOG.warn("Cannot open secure channel to {} at election address {}", sid, electionAddr, e);
+            closeSocket(sock);
+            return;
+        } catch (UnresolvedAddressException | IOException e) {
+            LOG.warn("Cannot open channel to {} at election address {}", sid, electionAddr, e);
+            closeSocket(sock);
+            return;
+        }
+
         try {
             startConnection(sock, sid);
         } catch (IOException e) {
@@ -389,16 +418,15 @@ public void initiateConnection(final Socket sock, final Long sid) {
      * Server will initiate the connection request to its peer server
      * asynchronously via separate connection thread.
      */
-    public void initiateConnectionAsync(final Socket sock, final Long sid) {
+    public boolean initiateConnectionAsync(final MultipleAddresses electionAddr, final Long sid) {
         if (!inprogressConnections.add(sid)) {
             // simply return as there is a connection request to
             // server 'sid' already in progress.
             LOG.debug("Connection request to server id: {} is already in progress, so skipping this request", sid);
-            closeSocket(sock);
-            return;
+            return true;
         }
         try {
-            connectionExecutor.execute(new QuorumConnectionReqThread(sock, sid));
+            connectionExecutor.execute(new QuorumConnectionReqThread(electionAddr, sid));
             connectionThreadCnt.incrementAndGet();
         } catch (Throwable e) {
             // Imp: Safer side catching all type of exceptions and remove 'sid'
@@ -406,27 +434,27 @@ public void initiateConnectionAsync(final Socket sock, final Long sid) {
             // connection requests from this 'sid' in case of errors.
             inprogressConnections.remove(sid);
             LOG.error("Exception while submitting quorum connection request", e);
-            closeSocket(sock);
+            return false;
         }
+        return true;
     }
 
     /**
      * Thread to send connection request to peer server.
      */
     private class QuorumConnectionReqThread extends ZooKeeperThread {
-
-        final Socket sock;
+        final MultipleAddresses electionAddr;
         final Long sid;
-        QuorumConnectionReqThread(final Socket sock, final Long sid) {
+        QuorumConnectionReqThread(final MultipleAddresses electionAddr, final Long sid) {
             super("QuorumConnectionReqThread-" + sid);
-            this.sock = sock;
+            this.electionAddr = electionAddr;
             this.sid = sid;
         }
 
         @Override
         public void run() {
             try {
-                initiateConnection(sock, sid);
+                initiateConnection(electionAddr, sid);
             } finally {
                 inprogressConnections.remove(sid);
             }
@@ -679,6 +707,7 @@ public void toSend(Long sid, ByteBuffer b) {
 
     /**
      * Try to establish a connection to server with id sid using its electionAddr.
+     * The function will return quickly and the connection will be established asynchronously.
      *
      * VisibleForTesting.
      *
@@ -697,62 +726,15 @@ synchronized boolean connectOne(long sid, MultipleAddresses electionAddr) {
             return true;
         }
 
-        Socket sock = null;
-        try {
-            LOG.debug("Opening channel to server {}", sid);
-            if (self.isSslQuorum()) {
-                sock = self.getX509Util().createSSLSocket();
-            } else {
-                sock = new Socket();
-            }
-            setSockOpts(sock);
-            sock.connect(electionAddr.getReachableOrOne(), cnxTO);
-            if (sock instanceof SSLSocket) {
-                SSLSocket sslSock = (SSLSocket) sock;
-                sslSock.startHandshake();
-                LOG.info("SSL handshake complete with {} - {} - {}",
-                         sslSock.getRemoteSocketAddress(),
-                         sslSock.getSession().getProtocol(),
-                         sslSock.getSession().getCipherSuite());
-            }
-
-            LOG.debug("Connected to server {} using election address: {}:{}",
-                      sid, sock.getInetAddress(), sock.getPort());
-            // Sends connection request asynchronously if the quorum
-            // sasl authentication is enabled. This is required because
-            // sasl server authentication process may take few seconds to
-            // finish, this may delay next peer connection requests.
-            if (quorumSaslAuthEnabled) {
-                initiateConnectionAsync(sock, sid);
-            } else {
-                initiateConnection(sock, sid);
-            }
-            return true;
-        } catch (UnresolvedAddressException e) {
-            // Sun doesn't include the address that causes this
-            // exception to be thrown, also UAE cannot be wrapped cleanly
-            // so we log the exception in order to capture this critical
-            // detail.
-            LOG.warn("Cannot open channel to {} at election address {}", sid, electionAddr, e);
-            closeSocket(sock);
-            throw e;
-        } catch (X509Exception e) {
-            LOG.warn("Cannot open secure channel to {} at election address {}", sid, electionAddr, e);
-            closeSocket(sock);
-            return false;
-        } catch (NoRouteToHostException e) {
-            LOG.warn("None of the addresses ({}) are reachable for sid {}", electionAddr, sid, e);
-            closeSocket(sock);
-            return false;
-        } catch (IOException e) {
-            LOG.warn("Cannot open channel to {} at election address {}", sid, electionAddr, e);
-            closeSocket(sock);
-            return false;
-        }
+        // we are doing connection initiation always asynchronously, since it is possible that
+        // the socket connection timeouts or the SSL handshake takes too long and don't want
+        // to keep the rest of the connections to wait
+        return initiateConnectionAsync(electionAddr, sid);
     }
 
     /**
      * Try to establish a connection to server with id sid.
+     * The function will return quickly and the connection will be established asynchronously.
      *
      *  @param sid  server id
      */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
new file mode 100644
index 00000000000..ab1c077d9bd
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
@@ -0,0 +1,112 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.Assert.assertTrue;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.Socket;
+import java.net.SocketAddress;
+import java.net.SocketTimeoutException;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.QuorumUtil;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class QuorumCnxManagerSocketConnectionTimeoutTest extends ZKTestCase {
+
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumCnxManagerSocketConnectionTimeoutTest.class);
+    private QuorumUtil qu;
+
+    @Before
+    public void setUp() throws Exception {
+        // starting a 3 node ensemble without observers
+        qu = new QuorumUtil(1, 2);
+        qu.startAll();
+    }
+
+    /**
+     * Testing an error case reported in ZOOKEEPER-3756:
+     *
+     * When a new leader election happens after a ZooKeeper server restarted, in Kubernetes
+     * the rest of the servers can not initiate connection to the restarted one. But they
+     * get SocketTimeoutException instead of immediate IOException. The Leader Election was
+     * time-outing quicker than the socket.connect call, so we ended up with cycles of broken
+     * leader elections.
+     *
+     * The fix was to make the connection initiation asynchronous, so one 'broken' connection
+     * doesn't make the whole leader election to be blocked, even in case of SocketTimeoutException.
+     *
+     * @throws Exception
+     */
+    @Test
+    public void testSocketConnectionTimeoutDuringConnectingToElectionAddress() throws Exception {
+
+        int leaderId = qu.getLeaderServer();
+
+        // use a custom socket factory that will cause timeout instead of connecting to the
+        // leader election port of the current leader
+        final InetSocketAddress leaderElectionAddress =
+            qu.getLeaderQuorumPeer().getElectionAddress().getOne();
+        QuorumCnxManager.setSocketFactory(() -> new SocketStub(leaderElectionAddress));
+
+        qu.shutdown(leaderId);
+
+        assertTrue("Timeout during waiting for current leader to go down",
+                   ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort,
+                                                ClientBase.CONNECTION_TIMEOUT));
+
+        String errorMessage = "No new leader was elected";
+        waitFor(errorMessage, () -> qu.leaderExists() && qu.getLeaderServer() != leaderId, 15);
+    }
+
+    final class SocketStub extends Socket {
+
+        private final InetSocketAddress addressToTimeout;
+
+        SocketStub(InetSocketAddress addressToTimeout) {
+            this.addressToTimeout = addressToTimeout;
+        }
+
+        @Override
+        public void connect(SocketAddress endpoint, int timeout) throws IOException {
+            if (addressToTimeout.equals(endpoint)) {
+                try {
+                    Thread.sleep(timeout);
+                } catch (InterruptedException e) {
+                    LOG.warn("interrupted SocketStub.connect", e);
+                }
+                throw new SocketTimeoutException("timeout reached in SocketStub.connect()");
+            }
+
+            super.connect(endpoint, timeout);
+        }
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        qu.shutdownAll();
+        QuorumCnxManager.setSocketFactory(QuorumCnxManager.DEFAULT_SOCKET_FACTORY);
+    }
+
+}
\ No newline at end of file

From e87bad6774e7269ef21a156aff9dad089ef54794 Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Tue, 24 Mar 2020 19:38:46 -0700
Subject: [PATCH 002/591] =?UTF-8?q?ZOOKEEPER-3683:=20Discard=20requests=20?=
 =?UTF-8?q?that=20are=20delayed=20longer=20than=20a=20confi=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…gured threshold

Author: Jie Huang <jiehuang@fb.com>
Author: Ivailo Nedelchev <nedelchev@fb.com>

Reviewers: Michael Han <hanm@apache.org>, Allan Lyu <fangmin@apache.org>, Damien Diederen <dd@crosstwine.com>

Closes #1211 from jhuan31/ZOOKEEPER-3683
---
 .../zookeeper-client-c/include/zookeeper.h    |   3 +-
 .../zookeeper-client-c/src/zookeeper.c        |   2 +
 .../main/resources/markdown/zookeeperAdmin.md |   9 +
 .../org/apache/zookeeper/KeeperException.java |  18 +-
 .../server/FinalRequestProcessor.java         |  39 ++-
 .../server/PrepRequestProcessor.java          |  18 +-
 .../org/apache/zookeeper/server/Request.java  |  18 ++
 .../zookeeper/server/RequestThrottler.java    |  16 +-
 .../zookeeper/server/ServerMetrics.java       |   7 +
 .../server/SyncRequestProcessor.java          |   7 +-
 .../zookeeper/server/ZooKeeperServer.java     |  12 +
 .../zookeeper/server/ZooKeeperServerBean.java |  10 +
 .../server/ZooKeeperServerMXBean.java         |   3 +
 .../server/quorum/CommitProcessor.java        |  17 +-
 .../quorum/FollowerRequestProcessor.java      |   3 +
 .../zookeeper/server/quorum/Leader.java       |   6 +
 .../zookeeper/server/quorum/Learner.java      |   4 +
 .../quorum/ObserverRequestProcessor.java      |   4 +
 .../server/quorum/QuorumZooKeeperServer.java  |   4 +
 .../org/apache/zookeeper/test/QuorumBase.java |  60 +++++
 .../zookeeper/test/ThrottledOpHelper.java     | 224 ++++++++++++++++++
 .../test/ThrottledOpObserverTest.java         |  73 ++++++
 .../zookeeper/test/ThrottledOpQuorumTest.java |  98 ++++++++
 .../test/ThrottledOpStandaloneTest.java       |  64 +++++
 24 files changed, 695 insertions(+), 24 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 243fac28430..d33a44695a7 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -140,7 +140,8 @@ enum ZOO_ERRORS {
   ZEPHEMERALONLOCALSESSION = -120, /*!< Attempt to create ephemeral node on a local session */
   ZNOWATCHER = -121, /*!< The watcher couldn't be found */
   ZRECONFIGDISABLED = -123, /*!< Attempts to perform a reconfiguration operation when reconfiguration feature is disabled */
-  ZSESSIONCLOSEDREQUIRESASLAUTH = -124 /*!< The session has been closed by server because server requires client to do SASL authentication, but client is not configured with SASL authentication or configuted with SASL but failed (i.e. wrong credential used.). */
+  ZSESSIONCLOSEDREQUIRESASLAUTH = -124, /*!< The session has been closed by server because server requires client to do SASL authentication, but client is not configured with SASL authentication or configuted with SASL but failed (i.e. wrong credential used.). */
+  ZTHROTTLEDOP = -127 /*!< Operation was throttled and not executed at all. please, retry! */
 };
 
 #ifdef __cplusplus
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 0c143e7bbe2..2b8053e5a40 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -4902,6 +4902,8 @@ const char* zerror(int c)
       return "the watcher couldn't be found";
     case ZRECONFIGDISABLED:
       return "attempts to perform a reconfiguration operation when reconfiguration feature is disable";
+   case ZTHROTTLEDOP:
+     return "Operation was throttled due to high load";
     }
     if (c > 0) {
       return strerror(c);
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 8d460462b1d..ca1a3f71f57 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1133,6 +1133,15 @@ property, when available, is noted below.
     effect due to TLS handshake timeout when there are too many in-flight TLS 
     handshakes. Set it to something like 250 is good enough to avoid herd effect.
 
+* *throttledOpWaitTime*
+    (Java system property: **zookeeper.throttled_op_wait_time**)
+    The time in the RequestThrottler queue longer than which a request will be marked as throttled.
+    A throttled requests will not be processed other than being fed down the pipeline of the server it belongs to
+    to preserve the order of all requests.
+    The FinalProcessor will issue an error response (new error code: ZTHROTTLEDOP) for these undigested requests.
+    The intent is for the clients not to retry them immediately.
+    When set to 0, no requests will be throttled. The default is 0.
+
 <a name="sc_clusterOptions"></a>
 
 #### Cluster Options
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index 5cff6f3180c..c8b33b7fa7b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -148,6 +148,8 @@ public static KeeperException create(Code code) {
             return new SessionClosedRequireAuthException();
         case REQUESTTIMEOUT:
             return new RequestTimeoutException();
+        case THROTTLEDOP:
+            return new ThrottledOpException();
         case OK:
         default:
             throw new IllegalArgumentException("Invalid exception code");
@@ -404,7 +406,11 @@ public enum Code implements CodeDeprecated {
         /** The session has been closed by server because server requires client to do SASL authentication,
          *  but client is not configured with SASL authentication or configuted with SASL but failed
          *  (i.e. wrong credential used.). */
-        SESSIONCLOSEDREQUIRESASLAUTH(-124);
+        SESSIONCLOSEDREQUIRESASLAUTH(-124),
+        /** Operation was throttled and not executed at all. This error code indicates that zookeeper server
+         *  is under heavy load and can't process incoming requests at full speed; please retry with back off.
+         */
+        THROTTLEDOP (-127);
 
         private static final Map<Integer, Code> lookup = new HashMap<Integer, Code>();
 
@@ -495,6 +501,8 @@ static String getCodeMessage(Code code) {
             return "Reconfig is disabled";
         case SESSIONCLOSEDREQUIRESASLAUTH:
             return "Session closed because client failed to authenticate";
+        case THROTTLEDOP:
+            return "Op throttled due to high load";
         default:
             return "Unknown error " + code;
         }
@@ -940,4 +948,12 @@ public RequestTimeoutException() {
 
     }
 
+    /**
+     * @see Code#THROTTLEDOP
+     */
+    public static class ThrottledOpException extends KeeperException {
+        public ThrottledOpException() {
+            super(Code.THROTTLEDOP);
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 9ffde55c10c..6ad61feddf0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -106,18 +106,7 @@ public FinalRequestProcessor(ZooKeeperServer zks) {
         this.requestPathMetricsCollector = zks.getRequestPathMetricsCollector();
     }
 
-    public void processRequest(Request request) {
-        LOG.debug("Processing request:: {}", request);
-
-        // request.addRQRec(">final");
-        long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-        if (request.type == OpCode.ping) {
-            traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-        }
-        if (LOG.isTraceEnabled()) {
-            ZooTrace.logRequest(LOG, traceMask, 'E', request, "");
-        }
-
+    private ProcessTxnResult applyRequest(Request request) {
         ProcessTxnResult rc = zks.processTxn(request);
 
         // ZOOKEEPER-558:
@@ -131,7 +120,7 @@ public void processRequest(Request request) {
             // we are just playing diffs from the leader.
             if (closeSession(zks.serverCnxnFactory, request.sessionId)
                 || closeSession(zks.secureServerCnxnFactory, request.sessionId)) {
-                return;
+                return rc;
             }
         }
 
@@ -150,6 +139,24 @@ public void processRequest(Request request) {
             }
         }
 
+        return rc;
+    }
+
+    public void processRequest(Request request) {
+        LOG.debug("Processing request:: {}", request);
+
+        // request.addRQRec(">final");
+        long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+        if (request.type == OpCode.ping) {
+            traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+        }
+        if (LOG.isTraceEnabled()) {
+            ZooTrace.logRequest(LOG, traceMask, 'E', request, "");
+        }
+        ProcessTxnResult rc = null;
+        if (!request.isThrottled()) {
+          rc = applyRequest(request);
+        }
         if (request.cnxn == null) {
             return;
         }
@@ -195,7 +202,13 @@ public void processRequest(Request request) {
             if (request.isStale()) {
                 ServerMetrics.getMetrics().STALE_REPLIES.add(1);
             }
+
+            if (request.isThrottled()) {
+              throw KeeperException.create(Code.THROTTLEDOP);
+            }
+
             AuditHelper.addAuditLog(request, rc);
+
             switch (request.type) {
             case OpCode.ping: {
                 lastOp = "PING";
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 74720ed4a1b..00ed555c759 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -765,6 +765,21 @@ protected void pRequest(Request request) throws RequestProcessorException {
         request.setHdr(null);
         request.setTxn(null);
 
+        if (!request.isThrottled()) {
+          pRequestHelper(request);
+        }
+
+        request.zxid = zks.getZxid();
+        ServerMetrics.getMetrics().PREP_PROCESS_TIME.add(Time.currentElapsedTime() - request.prepStartTime);
+        nextProcessor.processRequest(request);
+    }
+
+    /**
+     * This method is a helper to pRequest method
+     *
+     * @param request
+     */
+    private void pRequestHelper(Request request) throws RequestProcessorException {
         try {
             switch (request.type) {
             case OpCode.createContainer:
@@ -939,9 +954,6 @@ protected void pRequest(Request request) throws RequestProcessorException {
                 request.setTxn(new ErrorTxn(Code.MARSHALLINGERROR.intValue()));
             }
         }
-        request.zxid = zks.getZxid();
-        ServerMetrics.getMetrics().PREP_PROCESS_TIME.add(Time.currentElapsedTime() - request.prepStartTime);
-        nextProcessor.processRequest(request);
     }
 
     private static List<ACL> removeDuplicates(final List<ACL> acls) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index d0fb7da4d2e..43a68ac7aa2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -100,6 +100,8 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
 
     public long syncQueueStartTime;
 
+    public long requestThrottleQueueTime;
+
     private Object owner;
 
     private KeeperException e;
@@ -108,6 +110,22 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
 
     private TxnDigest txnDigest;
 
+    private boolean isThrottledFlag = false;
+
+    public boolean isThrottled() {
+      return isThrottledFlag;
+    }
+
+    public void setIsThrottled(boolean val) {
+      isThrottledFlag = val;
+    }
+
+    public boolean isThrottlable() {
+        return this.type != OpCode.ping
+                && this.type != OpCode.closeSession
+                && this.type != OpCode.createSession;
+    }
+
     /**
      * If this is a create or close request for a local-only session.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index 16a1c6f1517..e9cdc5ec10b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -20,6 +20,7 @@
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.util.concurrent.LinkedBlockingQueue;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -97,6 +98,13 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
      */
     private static volatile boolean dropStaleRequests = Boolean.parseBoolean(System.getProperty("zookeeper.request_throttle_drop_stale", "true"));
 
+    protected boolean shouldThrottleOp(Request request, long elapsedTime) {
+        return request.isThrottlable()
+                && zks.getThrottledOpWaitTime() > 0
+                && elapsedTime > zks.getThrottledOpWaitTime();
+    }
+
+
     public RequestThrottler(ZooKeeperServer zks) {
         super("RequestThrottler", zks.getZooKeeperServerListener());
         this.zks = zks;
@@ -171,6 +179,12 @@ public void run() {
                     if (request.isStale()) {
                         ServerMetrics.getMetrics().STALE_REQUESTS.add(1);
                     }
+                    final long elapsedTime = Time.currentElapsedTime() - request.requestThrottleQueueTime;
+                    ServerMetrics.getMetrics().REQUEST_THROTTLE_QUEUE_TIME.add(elapsedTime);
+                    if (shouldThrottleOp(request, elapsedTime)) {
+                      request.setIsThrottled(true);
+                      ServerMetrics.getMetrics().THROTTLED_OPS.add(1);
+                    }
                     zks.submitRequestNow(request);
                 }
             }
@@ -230,6 +244,7 @@ public void submitRequest(Request request) {
             LOG.debug("Shutdown in progress. Request cannot be processed");
             dropRequest(request);
         } else {
+            request.requestThrottleQueueTime = Time.currentElapsedTime();
             submittedRequests.add(request);
         }
     }
@@ -238,7 +253,6 @@ public int getInflight() {
         return submittedRequests.size();
     }
 
-    @SuppressFBWarnings("DM_EXIT")
     public void shutdown() {
         // Try to shutdown gracefully
         LOG.info("Shutting down");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index cbdb2347d6f..95214209c01 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -154,6 +154,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         READS_ISSUED_IN_COMMIT_PROC = metricsContext.getSummary("read_commit_proc_issued", DetailLevel.BASIC);
         WRITES_ISSUED_IN_COMMIT_PROC = metricsContext.getSummary("write_commit_proc_issued", DetailLevel.BASIC);
 
+        THROTTLED_OPS = metricsContext.getCounter("throttled_ops");
+
         /**
          * Time spent by a read request in the commit processor.
          */
@@ -223,6 +225,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         STALE_REQUESTS = metricsContext.getCounter("stale_requests");
         STALE_REQUESTS_DROPPED = metricsContext.getCounter("stale_requests_dropped");
         STALE_REPLIES = metricsContext.getCounter("stale_replies");
+        REQUEST_THROTTLE_QUEUE_TIME = metricsContext.getSummary("request_throttle_queue_time_ms", DetailLevel.ADVANCED);
         REQUEST_THROTTLE_WAIT_COUNT = metricsContext.getCounter("request_throttle_wait_count");
         LARGE_REQUESTS_REJECTED = metricsContext.getCounter("large_requests_rejected");
 
@@ -381,6 +384,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Summary READS_ISSUED_IN_COMMIT_PROC;
     public final Summary WRITES_ISSUED_IN_COMMIT_PROC;
 
+    // Request op throttling related
+    public final Counter THROTTLED_OPS;
+
     /**
      * Time spent by a read request in the commit processor.
      */
@@ -435,6 +441,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter STALE_REQUESTS;
     public final Counter STALE_REQUESTS_DROPPED;
     public final Counter STALE_REPLIES;
+    public final Summary REQUEST_THROTTLE_QUEUE_TIME;
     public final Counter REQUEST_THROTTLE_WAIT_COUNT;
     public final Counter LARGE_REQUESTS_REJECTED;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
index 66e85b14a2d..4df319f86a4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
@@ -178,7 +178,7 @@ public void run() {
                 ServerMetrics.getMetrics().SYNC_PROCESSOR_QUEUE_TIME.add(startProcessTime - si.syncQueueStartTime);
 
                 // track the number of records written to the log
-                if (zks.getZKDatabase().append(si)) {
+                if (!si.isThrottled() && zks.getZKDatabase().append(si)) {
                     if (shouldSnapshot()) {
                         resetSnapshotStats();
                         // roll the log
@@ -202,9 +202,8 @@ public void run() {
                     }
                 } else if (toFlush.isEmpty()) {
                     // optimization for read heavy workloads
-                    // iff this is a read, and there are no pending
-                    // flushes (writes), then just pass this to the next
-                    // processor
+                    // iff this is a read or a throttled request(which doesn't need to be written to the disk),
+                    // and there are no pending flushes (writes), then just pass this to the next processor
                     if (nextProcessor != null) {
                         nextProcessor.processRequest(si);
                         if (nextProcessor instanceof Flushable) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 1a2d9a7e06a..8205f741499 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -155,6 +155,9 @@ public static void setCloseSessionTxnEnabled(boolean enabled) {
 
     public static final int DEFAULT_TICK_TIME = 3000;
     protected int tickTime = DEFAULT_TICK_TIME;
+    public static final int DEFAULT_THROTTLED_OP_WAIT_TIME = 0; // disabled
+    protected static volatile int throttledOpWaitTime =
+        Integer.getInteger("zookeeper.throttled_op_wait_time", DEFAULT_THROTTLED_OP_WAIT_TIME);
     /** value of -1 indicates unset, use default */
     protected int minSessionTimeout = -1;
     /** value of -1 indicates unset, use default */
@@ -1237,6 +1240,15 @@ public void setTickTime(int tickTime) {
         this.tickTime = tickTime;
     }
 
+    public static int getThrottledOpWaitTime() {
+        return throttledOpWaitTime;
+    }
+
+    public static void setThrottledOpWaitTime(int time) {
+        LOG.info("throttledOpWaitTime set to {}", time);
+        throttledOpWaitTime = time;
+    }
+
     public int getMinSessionTimeout() {
         return minSessionTimeout;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
index bd9b6432440..17dd48b7505 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
@@ -315,6 +315,16 @@ public void setFlushDelay(long delay) {
     // Request throttling settings
     ///////////////////////////////////////////////////////////////////////////
 
+    public int getThrottledOpWaitTime() {
+        return zks.getThrottledOpWaitTime();
+    }
+
+    public void setThrottledOpWaitTime(int val) {
+        zks.setThrottledOpWaitTime(val);
+    }
+
+    ///////////////////////////////////////////////////////////////////////////
+
     public int getRequestThrottleLimit() {
         return RequestThrottler.getMaxRequests();
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
index 71a9d987e04..851fc564a09 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
@@ -136,6 +136,9 @@ public interface ZooKeeperServerMXBean {
     boolean getRequestThrottleDropStale();
     void setRequestThrottleDropStale(boolean drop);
 
+    int getThrottledOpWaitTime();
+    void setThrottledOpWaitTime(int val);
+
     boolean getRequestStaleLatencyCheck();
     void setRequestStaleLatencyCheck(boolean check);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
index 01f9f0d2738..86dce2b7f85 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
@@ -29,12 +29,14 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.WorkerService;
 import org.apache.zookeeper.server.ZooKeeperCriticalThread;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
+import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -165,6 +167,9 @@ private boolean isProcessingRequest() {
     }
 
     protected boolean needCommit(Request request) {
+        if (request.isThrottled()) {
+          return false;
+        }
         switch (request.type) {
         case OpCode.create:
         case OpCode.create2:
@@ -306,6 +311,11 @@ public void run() {
                         // Process committed head
                         request = committedRequests.peek();
 
+                        if (request.isThrottled()) {
+                            LOG.error("Throttled request in committed pool: {}. Exiting.", request);
+                            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+                        }
+
                         /*
                          * Check if this is a local write request is pending,
                          * if so, update it with the committed info. If the commit matches
@@ -349,6 +359,10 @@ public void run() {
                                 topPending.zxid = request.zxid;
                                 topPending.commitRecvTime = request.commitRecvTime;
                                 request = topPending;
+                                if (request.isThrottled()) {
+                                    LOG.error("Throttled request in committed & pending pool: {}. Exiting.", request);
+                                    ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+                                }
                                 // Only decrement if we take a request off the queue.
                                 numWriteQueuedRequests.decrementAndGet();
                                 queuedWriteRequests.poll();
@@ -452,7 +466,8 @@ public void start() {
      */
     private void sendToNextProcessor(Request request) {
         numRequestsProcessing.incrementAndGet();
-        workerPool.schedule(new CommitWorkRequest(request), request.sessionId);
+        CommitWorkRequest workRequest = new CommitWorkRequest(request);
+        workerPool.schedule(workRequest, request.sessionId);
     }
 
     private void processWrite(Request request) throws RequestProcessorException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index 88144de3602..db51aee495d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -73,6 +73,9 @@ public void run() {
                 // the request to the leader so that we are ready to receive
                 // the response
                 nextProcessor.processRequest(request);
+                if (request.isThrottled()) {
+                    continue;
+                }
 
                 // We now ship the request to the leader. As with all
                 // other quorum operations, sync also follows this code
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 5371bea91d9..0eb3722a47c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -56,6 +56,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.jmx.MBeanRegistry;
+import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.FinalRequestProcessor;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
@@ -68,6 +69,7 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
+import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -1218,6 +1220,10 @@ public XidRolloverException(String message) {
      * @return the proposal that is queued to send to all the members
      */
     public Proposal propose(Request request) throws XidRolloverException {
+        if (request.isThrottled()) {
+            LOG.error("Throttled request send as proposal: {}. Exiting.", request);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
         /**
          * Address the rollover issue. All lower 32bits set indicate a new leader
          * election. Force a re-election instead. See ZOOKEEPER-1277
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 8a0cac17ad6..da5f1132ada 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -234,6 +234,10 @@ void readPacket(QuorumPacket pp) throws IOException {
      * @throws IOException
      */
     void request(Request request) throws IOException {
+        if (request.isThrottled()) {
+            LOG.error("Throttled request sent to leader: {}. Exiting", request);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         DataOutputStream oa = new DataOutputStream(baos);
         oa.writeLong(request.sessionId);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
index 46662032951..0075ce404a8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
@@ -82,6 +82,10 @@ public void run() {
                 // the response
                 nextProcessor.processRequest(request);
 
+                if (request.isThrottled()) {
+                    continue;
+                }
+
                 // We now ship the request to the leader. As with all
                 // other quorum operations, sync also follows this code
                 // path, but different from others, we need to keep track
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
index c6cd93b4d18..6fdea82751e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
@@ -60,6 +60,10 @@ protected void startSessionTracker() {
     }
 
     public Request checkUpgradeSession(Request request) throws IOException, KeeperException {
+        if (request.isThrottled()) {
+            return null;
+        }
+
         // If this is a request for a local session and it is to
         // create an ephemeral node, then upgrade the session and return
         // a new session request for the leader.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index b91aa19e915..638275a5415 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -247,6 +247,66 @@ public int getLeaderIndex() {
         return -1;
     }
 
+    public int getLeaderClientPort() {
+      if (s1.getPeerState() == ServerState.LEADING) {
+        return portClient1;
+      } else if (s2.getPeerState() == ServerState.LEADING) {
+        return portClient2;
+      } else if (s3.getPeerState() == ServerState.LEADING) {
+        return portClient3;
+      } else if (s4.getPeerState() == ServerState.LEADING) {
+        return portClient4;
+      } else if (s5.getPeerState() == ServerState.LEADING) {
+        return portClient5;
+      }
+      return -1;
+    }
+
+    public QuorumPeer getLeaderQuorumPeer() {
+      if (s1.getPeerState() == ServerState.LEADING) {
+        return s1;
+      } else if (s2.getPeerState() == ServerState.LEADING) {
+        return s2;
+      } else if (s3.getPeerState() == ServerState.LEADING) {
+        return s3;
+      } else if (s4.getPeerState() == ServerState.LEADING) {
+        return s4;
+      } else if (s5.getPeerState() == ServerState.LEADING) {
+        return s5;
+      }
+      return null;
+    }
+
+    public QuorumPeer getFirstObserver() {
+      if (s1.getLearnerType() == LearnerType.OBSERVER) {
+        return s1;
+      } else if (s2.getLearnerType() == LearnerType.OBSERVER) {
+        return s2;
+      } else if (s3.getLearnerType() == LearnerType.OBSERVER) {
+        return s3;
+      } else if (s4.getLearnerType() == LearnerType.OBSERVER) {
+        return s4;
+      } else if (s5.getLearnerType() == LearnerType.OBSERVER) {
+        return s5;
+      }
+      return null;
+    }
+
+    public int getFirstObserverClientPort() {
+      if (s1.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient1;
+      } else if (s2.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient2;
+      } else if (s3.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient3;
+      } else if (s4.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient4;
+      } else if (s5.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient5;
+      }
+      return -1;
+    }
+
     public String getPeersMatching(ServerState state) {
         StringBuilder hosts = new StringBuilder();
         for (QuorumPeer p : getPeerList()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
new file mode 100644
index 00000000000..1d9e502257b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
@@ -0,0 +1,224 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import mockit.Mock;
+import mockit.MockUp;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestThrottler;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.Assert;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ThrottledOpHelper {
+    protected static final Logger LOG = LoggerFactory.getLogger(ThrottledOpHelper.class);
+
+    public static final class RequestThrottleMock extends MockUp<RequestThrottler> {
+        public static void throttleEveryNthOp(int n) {
+            everyNthOp = n;
+            opCounter = 0;
+        }
+        private static int everyNthOp = 0;
+        private static int opCounter = 0;
+
+        @Mock
+        private boolean shouldThrottleOp(Request request, long elapsedTime) {
+            if (everyNthOp > 0 && request.isThrottlable() && (++opCounter % everyNthOp == 0)) {
+                opCounter %= everyNthOp;
+                return true;
+            }
+            return false;
+        }
+    }
+
+    public static void applyMockUps() {
+        new RequestThrottleMock();
+    }
+
+    public void testThrottledOp(ZooKeeper zk, ZooKeeperServer zs) throws IOException, InterruptedException, KeeperException {
+        final int N = 5; // must be greater than 3
+        final int COUNT = 100;
+        RequestThrottleMock.throttleEveryNthOp(N);
+        LOG.info("Before create /ivailo nodes");
+        int opCount = 0;
+        for (int i = 0; i < COUNT; i++) {
+            String nodeName = "/ivailo" + i;
+            if (opCount % N == N - 1) {
+                try {
+                    zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                        (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome
+                    Stat stat = zk.exists(nodeName, null);
+                    Assert.assertNull(stat);
+                    zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                        (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
+                } catch (KeeperException e) {
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                }
+                opCount += 3; // three ops issued
+            } else {
+                zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                    (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
+                opCount++; // one op issued
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    zk.setData(nodeName, nodeName.getBytes(), -1);
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    zk.setData(nodeName, nodeName.getBytes(), -1);
+                } catch (KeeperException e) {
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                }
+                opCount += 2; // two ops issued, one for retry
+            } else {
+                zk.setData(nodeName, nodeName.getBytes(), -1);
+                opCount++; // one op issued
+            }
+        }
+        LOG.info("Before delete /ivailo nodes");
+        for (int i = 0; i < COUNT; i++) {
+            String nodeName = "/ivailo" + i;
+            if (opCount % N == N - 1) {
+                try {
+                    zk.exists(nodeName, null);
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    Stat stat = zk.exists(nodeName, null);
+                    Assert.assertNotNull(stat);
+                    opCount += 2; // two ops issued, one is retry
+                } catch (KeeperException e) {
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                }
+            } else {
+                Stat stat = zk.exists(nodeName, null);
+                Assert.assertNotNull(stat);
+                opCount++;
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    zk.getData(nodeName, null, null);
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    byte[] data = zk.getData(nodeName, null, null);
+                    Assert.assertEquals(nodeName, new String(data));
+                    opCount += 2; // two ops issued, one is retry
+                } catch (KeeperException e) {
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                }
+            } else {
+                byte[] data = zk.getData(nodeName, null, null);
+                Assert.assertEquals(nodeName, new String(data));
+                opCount++;
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    // version 0 should not trigger BadVersion exception
+                    zk.delete(nodeName, 0);
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    zk.delete(nodeName, -1);
+                } catch (KeeperException e) {
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                }
+                opCount += 2; // two ops issues, one for retry
+            } else {
+                zk.delete(nodeName, -1);
+                opCount++; // one op only issued
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    zk.exists(nodeName, null);
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    Stat stat = zk.exists(nodeName, null);
+                    Assert.assertNull(stat);
+                    opCount += 2; // two ops issued, one is retry
+                } catch (KeeperException e) {
+                    Assert.fail("Should have gotten ThrottledOp exception");
+                }
+            } else {
+                Stat stat = zk.exists(nodeName, null);
+                Assert.assertNull(stat);
+                opCount++;
+            }
+        }
+        LOG.info("After delete /ivailo");
+        zk.close();
+    }
+
+    public void testThrottledAcl(ZooKeeper zk, ZooKeeperServer zs) throws Exception {
+        RequestThrottleMock.throttleEveryNthOp(0);
+
+        final ArrayList<ACL> ACL_PERMS =
+          new ArrayList<ACL>() { {
+            add(new ACL(ZooDefs.Perms.READ, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+            add(new ACL(ZooDefs.Perms.WRITE, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+            add(new ACL(ZooDefs.Perms.ALL, ZooDefs.Ids.AUTH_IDS));
+        }};
+        String path = "/path1";
+        zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.addAuthInfo("digest", "pat:test".getBytes());
+        List<ACL> defaultAcls = zk.getACL(path, null);
+        Assert.assertEquals(1, defaultAcls.size());
+
+        RequestThrottleMock.throttleEveryNthOp(2);
+
+        path = "/path2";
+        zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE,
+            CreateMode.PERSISTENT);
+        try {
+            zk.setACL(path, ACL_PERMS, -1);
+            Assert.fail("Should have gotten ThrottledOp exception");
+        } catch (KeeperException.ThrottledOpException e) {
+            // expected
+        } catch (KeeperException e) {
+            Assert.fail("Should have gotten ThrottledOp exception");
+        }
+        List<ACL> acls = zk.getACL(path, null);
+        Assert.assertEquals(1, acls.size());
+
+        RequestThrottleMock.throttleEveryNthOp(0);
+
+        path = "/path3";
+        zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE,
+            CreateMode.PERSISTENT);
+        zk.setACL(path, ACL_PERMS, -1);
+        acls = zk.getACL(path, null);
+        Assert.assertEquals(3, acls.size());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
new file mode 100644
index 00000000000..dfd19642f08
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
@@ -0,0 +1,73 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class ThrottledOpObserverTest extends QuorumBase {
+    @BeforeClass
+    public static void applyMockUps() {
+        ThrottledOpHelper.applyMockUps();
+    }
+
+    @Override
+    public void setUp() throws Exception {
+        super.setUp(true /* withObservers */);
+    }
+
+    @Override
+    public void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @Test
+    public void testThrottledOpObserver() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getFirstObserverClientPort());
+            ZooKeeperServer zs = getFirstObserver().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAclObserver() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getFirstObserverClientPort());
+            ZooKeeperServer zs = getFirstObserver().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
new file mode 100644
index 00000000000..27613657da4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
@@ -0,0 +1,98 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class ThrottledOpQuorumTest extends QuorumBase {
+    @BeforeClass
+    public static void applyMockUps() {
+        ThrottledOpHelper.applyMockUps();
+    }
+
+    @Test
+    public void testThrottledOpLeader() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getLeaderClientPort());
+            ZooKeeperServer zs = getLeaderQuorumPeer().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAclLeader() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getLeaderClientPort());
+            ZooKeeperServer zs = getLeaderQuorumPeer().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledOpFollower() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            int clientPort = (getLeaderClientPort() == portClient1) ? portClient2 : portClient1;
+            zk = createClient("localhost:" + clientPort);
+            QuorumPeer qp = (getLeaderClientPort() == portClient1) ? s2 : s1;
+            ZooKeeperServer zs = qp.getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAclFollower() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            int clientPort = (getLeaderClientPort() == portClient1) ? portClient2 : portClient1;
+            zk = createClient("localhost:" + clientPort);
+            QuorumPeer qp = (getLeaderClientPort() == portClient1) ? s2 : s1;
+            ZooKeeperServer zs = qp.getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
new file mode 100644
index 00000000000..27ac6a6939c
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
@@ -0,0 +1,64 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class ThrottledOpStandaloneTest extends ClientBase {
+
+    @BeforeClass
+    public static void applyMockUps() {
+        ThrottledOpHelper.applyMockUps();
+    }
+
+    @Test
+    public void testThrottledOp() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient(hostPort);
+            ZooKeeperServer zs = serverFactory.getZooKeeperServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAcl() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient(hostPort);
+            ZooKeeperServer zs = serverFactory.getZooKeeperServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+}

From 64863119bf92893f3c72350fd37005083b587327 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Wed, 25 Mar 2020 12:08:54 +0100
Subject: [PATCH 003/591] ZOOKEEPER-3654: Incorrect *_CFLAGS handling in
 Automake
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `Makefile.am` distributed with the C client defines some per-target `*_CFLAGS` and `*_CXXFLAGS` variables.  These however, do not reference `AM_CFLAGS` (resp. AM_CXXFLAGS`, which means that some options (notably `-Wall`) are missing when building subsets of the code.

Dixit the [Automake docs](https://www.gnu.org/software/automake/manual/html_node/Program-and-Library-Variables.html):

> In compilations with per-target flags, the ordinary ‘AM_’ form of
> the flags variable is _not_ automatically included in the
> compilation (however, the user form of the variable _is_ included).
> So for instance, if you want the hypothetical ‘maude’ compilations
> to also use the value of ‘AM_CFLAGS’, you would need to write:
>
>      maude_CFLAGS = ... your flags ... $(AM_CFLAGS)

Restoring the flags, however, causes compilation failures (in the library) and a slew of new warnings (in the tests) which had not been noticed because of the missing options.

This series of patches (all "tagged" ZOOKEEPER-3654) fix these warnings and errors before re-enabling `-Wall` and friends for all targets.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <andor@apache.org>

Closes #1186 from ztzg/ZOOKEEPER-3654-incorrect-automake-flags
---
 .../zookeeper-client-c/Makefile.am            | 10 ++--
 .../zookeeper-client-c/src/load_gen.c         |  2 -
 .../zookeeper-client-c/src/mt_adaptor.c       |  3 +-
 .../zookeeper-client-c/src/zookeeper.c        |  2 +
 .../zookeeper-client-c/tests/TestClient.cc    | 25 ++++----
 .../zookeeper-client-c/tests/TestMulti.cc     |  3 -
 .../tests/TestReconfigServer.cc               | 58 +++++++++----------
 7 files changed, 53 insertions(+), 50 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/Makefile.am b/zookeeper-client/zookeeper-client-c/Makefile.am
index 9c794a5ef09..e42a3539b8a 100644
--- a/zookeeper-client/zookeeper-client-c/Makefile.am
+++ b/zookeeper-client/zookeeper-client-c/Makefile.am
@@ -60,7 +60,7 @@ libzookeeper_st_la_LDFLAGS = $(LIB_LDFLAGS) -export-symbols-regex $(EXPORT_SYMBO
 if WANT_SYNCAPI
 noinst_LTLIBRARIES += libzkmt.la
 libzkmt_la_SOURCES =$(COMMON_SRC) src/mt_adaptor.c
-libzkmt_la_CFLAGS = -DTHREADED
+libzkmt_la_CFLAGS = $(AM_CFLAGS) -DTHREADED
 libzkmt_la_LIBADD = -lm $(CLOCK_GETTIME_LIBS)
 
 lib_LTLIBRARIES += libzookeeper_mt.la
@@ -80,11 +80,11 @@ bin_PROGRAMS += cli_mt load_gen
 
 cli_mt_SOURCES = src/cli.c
 cli_mt_LDADD = libzookeeper_mt.la $(SASL_LIB_LDFLAGS)
-cli_mt_CFLAGS = -DTHREADED
+cli_mt_CFLAGS = $(AM_CFLAGS) -DTHREADED
 
 load_gen_SOURCES = src/load_gen.c
 load_gen_LDADD = libzookeeper_mt.la
-load_gen_CFLAGS = -DTHREADED
+load_gen_CFLAGS = $(AM_CFLAGS) -DTHREADED
 
 endif
 
@@ -134,14 +134,14 @@ TESTS_ENVIRONMENT = ZKROOT=${srcdir}/../.. \
                     CLASSPATH=$$CLASSPATH:$$CLOVER_HOME/lib/clover*.jar
 nodist_zktest_st_SOURCES = $(TEST_SOURCES)
 zktest_st_LDADD = libzkst.la libhashtable.la $(CPPUNIT_LIBS) $(OPENSSL_LIB_LDFLAGS) $(SASL_LIB_LDFLAGS) -ldl
-zktest_st_CXXFLAGS = -DUSE_STATIC_LIB $(CPPUNIT_CFLAGS) $(USEIPV6) $(SOLARIS_CPPFLAGS)
+zktest_st_CXXFLAGS = $(AM_CXXFLAGS) -DUSE_STATIC_LIB $(CPPUNIT_CFLAGS) $(SOLARIS_CPPFLAGS)
 zktest_st_LDFLAGS = -shared $(SYMBOL_WRAPPERS) $(SOLARIS_LIB_LDFLAGS)
 
 if WANT_SYNCAPI
   check_PROGRAMS += zktest-mt
   nodist_zktest_mt_SOURCES = $(TEST_SOURCES) tests/PthreadMocks.cc
   zktest_mt_LDADD = libzkmt.la libhashtable.la -lpthread $(CPPUNIT_LIBS) $(OPENSSL_LIB_LDFLAGS) $(SASL_LIB_LDFLAGS) -ldl
-  zktest_mt_CXXFLAGS = -DUSE_STATIC_LIB -DTHREADED $(CPPUNIT_CFLAGS) $(USEIPV6)
+  zktest_mt_CXXFLAGS = $(AM_CXXFLAGS) -DUSE_STATIC_LIB -DTHREADED $(CPPUNIT_CFLAGS) $(USEIPV6)
 if SOLARIS
   SHELL_SYMBOL_WRAPPERS_MT = cat ${srcdir}/tests/wrappers-mt.opt
   SYMBOL_WRAPPERS_MT=$(SYMBOL_WRAPPERS) $(SHELL_SYMBOL_WRAPPERS_MT:sh)
diff --git a/zookeeper-client/zookeeper-client-c/src/load_gen.c b/zookeeper-client/zookeeper-client-c/src/load_gen.c
index 886fe1b3e3c..f25edcbe928 100644
--- a/zookeeper-client/zookeeper-client-c/src/load_gen.c
+++ b/zookeeper-client/zookeeper-client-c/src/load_gen.c
@@ -27,8 +27,6 @@
 
 static zhandle_t *zh;
 
-static int shutdownThisThing=0;
-
 // *****************************************************************************
 //
 static pthread_cond_t cond=PTHREAD_COND_INITIALIZER;
diff --git a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
index 38cced425ba..73b64c391ff 100644
--- a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
@@ -369,13 +369,14 @@ void *do_io(void *v)
     fds[0].fd=adaptor_threads->self_pipe[0];
     fds[0].events=POLLIN;
     while(!zh->close_requested) {
-        zh->io_count++;
         struct timeval tv;
         int fd;
         int interest;
         int timeout;
         int maxfd=1;
 
+        zh->io_count++;
+
         zookeeper_interest(zh, &fd, &interest, &tv);
         if (fd != -1) {
             fds[1].fd=fd;
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 2b8053e5a40..a273225ff69 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -342,6 +342,7 @@ static int is_sasl_auth_in_progress(zhandle_t* zh)
 #endif /* HAVE_CYRUS_SASL_H */
 }
 
+#ifndef THREADED
 /*
  * abort due to the use of a sync api in a singlethreaded environment
  */
@@ -350,6 +351,7 @@ static void abort_singlethreaded(zhandle_t *zh)
     LOG_ERROR(LOGCALLBACK(zh), "Sync completion used without threads");
     abort();
 }
+#endif  /* THREADED */
 
 static ssize_t zookeeper_send(zsock_t *fd, const void* buf, size_t len)
 {
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
index a7d055fbe47..2a6e9925470 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
@@ -325,9 +325,10 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     
     /** have a callback in the default watcher **/
     static void default_zoo_watcher(zhandle_t *zzh, int type, int state, const char *path, void *context){
-        int zrc = 0;
+        int zrc;
         struct String_vector str_vec = {0, NULL};
         zrc = zoo_wget_children(zzh, "/mytest", default_zoo_watcher, NULL, &str_vec);
+        CPPUNIT_ASSERT(zrc == ZOK || zrc == ZCLOSING);
     }
 
     /** ZOOKEEPER-1057 This checks that the client connects to the second server when the first is not reachable **/
@@ -353,24 +354,28 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
 
     /** this checks for a deadlock in calling zookeeper_close and calls from a default watcher that might get triggered just when zookeeper_close() is in progress **/
     void testHangingClient() {
-        int zrc = 0;
+        int zrc;
         char buff[10] = "testall";
         char path[512];
-        watchctx_t *ctx;
+        watchctx_t *ctx = NULL;
         struct String_vector str_vec = {0, NULL};
         zhandle_t *zh = zookeeper_init(hostPorts, NULL, 10000, 0, ctx, 0);
         sleep(1);
         zrc = zoo_create(zh, "/mytest", buff, 10, &ZOO_OPEN_ACL_UNSAFE, 0, path, 512);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_wget_children(zh, "/mytest", default_zoo_watcher, NULL, &str_vec);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_create(zh, "/mytest/test1", buff, 10, &ZOO_OPEN_ACL_UNSAFE, 0, path, 512);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_wget_children(zh, "/mytest", default_zoo_watcher, NULL, &str_vec);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_delete(zh, "/mytest/test1", -1);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zookeeper_close(zh);
     }
 
     void testBadDescriptor() {
-        int zrc = 0;
-        watchctx_t *ctx;
+        watchctx_t *ctx = NULL;
         zhandle_t *zh = zookeeper_init(hostPorts, NULL, 10000, 0, ctx, 0);
         sleep(1);
         zh->io_count = 0;
@@ -1039,8 +1044,8 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL(zoo_get_log_callback(zk), &logMessageHandler);
 
         // Log 10 messages and ensure all go to callback
-        int expected = 10;
-        for (int i = 0; i < expected; i++)
+        const std::size_t expected = 10;
+        for (std::size_t i = 0; i < expected; i++)
         {
             LOG_INFO(LOGCALLBACK(zk), "%s #%d", __FUNCTION__, i);
         }
@@ -1057,12 +1062,12 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
 
         // All the connection messages should have gone to the callback -- don't
         // want this to be a maintenance issue so we're not asserting exact count
-        int numBefore = logMessages.size();
+        std::size_t numBefore = logMessages.size();
         CPPUNIT_ASSERT(numBefore != 0);
 
         // Log 10 messages and ensure all go to callback
-        int expected = 10;
-        for (int i = 0; i < expected; i++)
+        const std::size_t expected = 10;
+        for (std::size_t i = 0; i < expected; i++)
         {
             LOG_INFO(LOGCALLBACK(zk), "%s #%d", __FUNCTION__, i);
         }
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc b/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc
index 226e4708202..6dfeb96e0c0 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc
@@ -486,8 +486,6 @@ class Zookeeper_multi : public CPPUNIT_NS::TestFixture
         watchctx_t ctx;
         zhandle_t *zk = createClient(&ctx);
         int sz = 512;
-        char buf[sz];
-        int blen;
         char p1[sz];
         p1[0] = '\0';
         struct Stat stat;
@@ -573,7 +571,6 @@ class Zookeeper_multi : public CPPUNIT_NS::TestFixture
         int sz = 512;
         char p1[sz];
         p1[0] = '\0';
-        struct Stat s1;
 
         rc = zoo_create(zk, "/multi0", "", 0, &ZOO_OPEN_ACL_UNSAFE, 0, p1, sz);
         CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc b/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc
index c15774e9e30..54810b60c29 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc
@@ -49,12 +49,12 @@ class TestReconfigServer : public CPPUNIT_NS::TestFixture {
     static const uint32_t NUM_SERVERS;
     FILE* logfile_;
     std::vector<ZooKeeperQuorumServer*> cluster_;
-    int32_t getLeader();
-    std::vector<int32_t> getFollowers();
+    std::size_t getLeader();
+    std::vector<std::size_t> getFollowers();
     void parseConfig(char* buf, int len, std::vector<std::string>& servers,
                      std::string& version);
     bool waitForConnected(zhandle_t* zh, uint32_t timeout_sec);
-    zhandle_t* connectFollowers(std::vector<int32_t> &followers);
+    zhandle_t* connectFollowers(std::vector<std::size_t> &followers);
 };
 
 const uint32_t TestReconfigServer::NUM_SERVERS = 3;
@@ -84,15 +84,15 @@ setUp() {
 
 void TestReconfigServer::
 tearDown() {
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         delete cluster_[i];
     }
     cluster_.clear();
 }
 
-int32_t TestReconfigServer::
+std::size_t TestReconfigServer::
 getLeader() {
-    for (int32_t i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (cluster_[i]->isLeader()) {
             return i;
         }
@@ -100,10 +100,10 @@ getLeader() {
     return -1;
 }
 
-std::vector<int32_t> TestReconfigServer::
+std::vector<std::size_t> TestReconfigServer::
 getFollowers() {
-    std::vector<int32_t> followers;
-    for (int32_t i = 0; i < cluster_.size(); i++) {
+    std::vector<std::size_t> followers;
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (cluster_[i]->isFollower()) {
             followers.push_back(i);
         }
@@ -154,7 +154,7 @@ testRemoveFollower() {
     char buf[len];
 
     // get config from leader.
-    int32_t leader = getLeader();
+    std::size_t leader = getLeader();
     CPPUNIT_ASSERT(leader >= 0);
     std::string host = cluster_[leader]->getHostPort();
     zhandle_t* zk = zookeeper_init(host.c_str(), NULL, 10000, NULL, NULL, 0);
@@ -167,13 +167,13 @@ testRemoveFollower() {
     // of the first NEWLEADER message, used as the initial version
     CPPUNIT_ASSERT_EQUAL(std::string("100000000"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
 
     // remove a follower.
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     len = 1024;
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1,
                          (uint32_t)(followers.size()));
@@ -185,7 +185,7 @@ testRemoveFollower() {
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(std::string("100000002"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -201,7 +201,7 @@ testRemoveFollower() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
@@ -222,7 +222,7 @@ testNonIncremental() {
     char buf[len];
 
     // get config from leader.
-    int32_t leader = getLeader();
+    std::size_t leader = getLeader();
     CPPUNIT_ASSERT(leader >= 0);
     std::string host = cluster_[leader]->getHostPort();
     zhandle_t* zk = zookeeper_init(host.c_str(), NULL, 10000, NULL, NULL, 0);
@@ -236,18 +236,18 @@ testNonIncremental() {
     // of the first NEWLEADER message, used as the initial version
     CPPUNIT_ASSERT_EQUAL(std::string("100000000"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
 
     // remove a follower.
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     len = 1024;
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1,
                          (uint32_t)(followers.size()));
     std::stringstream ss;
-    for (int i = 1; i < followers.size(); i++) {
+    for (std::size_t i = 1; i < followers.size(); i++) {
       ss << cluster_[followers[i]]->getServerString() << ",";
     }
     ss << cluster_[leader]->getServerString();
@@ -258,7 +258,7 @@ testNonIncremental() {
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(std::string("100000002"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -269,7 +269,7 @@ testNonIncremental() {
     // add the follower back.
     len = 1024;
     ss.str("");
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
       ss << cluster_[i]->getServerString() << ",";
     }
     rc = zoo_reconfig(zk, NULL, NULL, ss.str().c_str(), -1, buf, &len,
@@ -277,7 +277,7 @@ testNonIncremental() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
@@ -285,12 +285,12 @@ testNonIncremental() {
 }
 
 zhandle_t* TestReconfigServer::
-connectFollowers(std::vector<int32_t> &followers) {
+connectFollowers(std::vector<std::size_t> &followers) {
     std::stringstream ss;
-    int32_t leader = getLeader();
+    std::size_t leader = getLeader();
     CPPUNIT_ASSERT(leader >= 0);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(followers.size()));
-    for (int i = 0; i < followers.size(); i++) {
+    for (std::size_t i = 0; i < followers.size(); i++) {
         ss << cluster_[followers[i]]->getHostPort() << ",";
     }
     ss << cluster_[leader]->getHostPort();
@@ -321,7 +321,7 @@ testRemoveConnectedFollower() {
 
     // connect to a follower.
     std::stringstream ss;
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     zhandle_t* zk = connectFollowers(followers);
     CPPUNIT_ASSERT_EQUAL((int)ZOK, zoo_add_auth(zk, "digest", "super:test", 10, NULL,(void*)ZOK));
 
@@ -333,7 +333,7 @@ testRemoveConnectedFollower() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, zoo_getconfig(zk, 0, buf, &len, &stat));
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -356,7 +356,7 @@ testReconfigFailureWithoutAuth() {
 
     // connect to a follower.
     std::stringstream ss;
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     zhandle_t* zk = connectFollowers(followers);
 
     // remove the follower.
@@ -374,7 +374,7 @@ testReconfigFailureWithoutAuth() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, zoo_getconfig(zk, 0, buf, &len, &stat));
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -400,7 +400,7 @@ testReconfigFailureWithoutServerSuperuserPasswordConfigured() {
 
     // connect to a follower.
     std::stringstream ss;
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     zhandle_t* zk = connectFollowers(followers);
 
     // remove the follower.

From 2581f71dd97cfda2cf6768c3457b81c7a93b9ef7 Mon Sep 17 00:00:00 2001
From: lingjinjiang <lingjinjiang@gmail.com>
Date: Thu, 26 Mar 2020 18:41:57 +0100
Subject: [PATCH 004/591] ZOOKEEPER-3760: remove a useless throwing
 CliException

https://issues.apache.org/jira/browse/ZOOKEEPER-3760

When I upgrade zookeeper from 3.4.13 to 3.5.7 in my application, I find the function processCmd in ZooKeeperMain.java throws a CliException which has been caught in the function. So I think it can be removed

Author: lingjinjiang <lingjinjiang@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1286 from lingjinjiang/master
---
 .../src/main/java/org/apache/zookeeper/ZooKeeperMain.java | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index dad878cf87c..8d8a419401f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -289,7 +289,7 @@ protected void connectToZK(String newHost) throws InterruptedException, IOExcept
         zk = new ZooKeeperAdmin(host, Integer.parseInt(cl.getOption("timeout")), new MyWatcher(), readOnly);
     }
 
-    public static void main(String[] args) throws CliException, IOException, InterruptedException {
+    public static void main(String[] args) throws IOException, InterruptedException {
         ZooKeeperMain main = new ZooKeeperMain(args);
         main.run();
     }
@@ -304,7 +304,7 @@ public ZooKeeperMain(ZooKeeper zk) {
         this.zk = zk;
     }
 
-    void run() throws CliException, IOException, InterruptedException {
+    void run() throws IOException, InterruptedException {
         if (cl.getCommand() == null) {
             System.out.println("Welcome to ZooKeeper!");
 
@@ -353,7 +353,7 @@ void run() throws CliException, IOException, InterruptedException {
         ServiceUtils.requestSystemExit(exitCode);
     }
 
-    public void executeLine(String line) throws CliException, InterruptedException, IOException {
+    public void executeLine(String line) throws InterruptedException, IOException {
         if (!line.equals("")) {
             cl.parseCommand(line);
             addToHistory(commandCount, line);
@@ -362,7 +362,7 @@ public void executeLine(String line) throws CliException, InterruptedException,
         }
     }
 
-    protected boolean processCmd(MyCommandOptions co) throws CliException, IOException, InterruptedException {
+    protected boolean processCmd(MyCommandOptions co) throws IOException, InterruptedException {
         boolean watch = false;
         try {
             watch = processZKCmd(co);

From 6c7a273bc1c553be34dc7b9e658c6c16b8a023ef Mon Sep 17 00:00:00 2001
From: Brittany Barnes <60981978+blb93@users.noreply.github.com>
Date: Thu, 26 Mar 2020 22:12:18 +0100
Subject: [PATCH 005/591] =?UTF-8?q?ZOOKEEPER-3728:=20move=20traceMask=20ca?=
 =?UTF-8?q?lculation=20logic=20into=20the=20trace=20log=20i=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…n the FinalRequestProcessor#processRequest

Author: Brittany Barnes <60981978+blb93@users.noreply.github.com>
Author: Brittany Barnes <brittany.barnes@ibm.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Justin Ling Mao <maoling199210191@sina.com>, Luciano Resende <lresende@apache.org>

Closes #1271 from blb93/ZOOKEEPER-3728
---
 .../apache/zookeeper/server/FinalRequestProcessor.java   | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 6ad61feddf0..a487626dee6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -145,12 +145,11 @@ private ProcessTxnResult applyRequest(Request request) {
     public void processRequest(Request request) {
         LOG.debug("Processing request:: {}", request);
 
-        // request.addRQRec(">final");
-        long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-        if (request.type == OpCode.ping) {
-            traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-        }
         if (LOG.isTraceEnabled()) {
+            long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+            if (request.type == OpCode.ping) {
+                traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+            }
             ZooTrace.logRequest(LOG, traceMask, 'E', request, "");
         }
         ProcessTxnResult rc = null;

From 2bc0a932400e97c5cdb70b4eb1da4b2e0ad3375f Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Thu, 26 Mar 2020 22:16:27 +0100
Subject: [PATCH 006/591] ZOOKEEPER-3767: Fix several document invalid syntax

Straightforward.

The question might be at which level we'd like to maintain jute document. I'm not quite familiar with this section and suspect it is far more outdated.

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Christopher Tubbs

Closes #1291 from TisonKun/ZOOKEEPER-3767
---
 .../main/java/org/apache/jute/package.html    | 72 +++++++++----------
 .../zookeeper/server/SessionTrackerImpl.java  | 13 ++--
 2 files changed, 45 insertions(+), 40 deletions(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/package.html b/zookeeper-jute/src/main/java/org/apache/jute/package.html
index 64a030a6d7d..f769b74c111 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/package.html
+++ b/zookeeper-jute/src/main/java/org/apache/jute/package.html
@@ -16,7 +16,7 @@
    limitations under the License.
 -->
 
-<html>
+<html lang="en">
   <head>
     <title>Hadoop Record I/O</title>
   </head>
@@ -197,8 +197,8 @@ <h3>Hadoop DDL Syntax</h3>
 ptype := ("byte" / "boolean" / "int" |
           "long" / "float" / "double"
           "ustring" / "buffer")
-ctype := (("vector" "<" type ">") /
-          ("map" "<" type "," type ">" ) ) / name)
+ctype := (("vector" "&lt;" type "&gt;") /
+          ("map" "&lt;" type "," type "&gt;" ) ) / name)
 </code></pre>
 
 A DDL file describes one or more record types. It begins with zero or
@@ -248,7 +248,7 @@ <h3>Examples</h3>
 module outlinks {
     class OutLinks {
         ustring baseURL;
-        vector<links.Link> outLinks;
+        vector&lt;links.Link&gt; outLinks;
     };
 }
 </code></pre>
@@ -262,7 +262,7 @@ <h2>Code Generation</h2>
 optional language argument (the default is Java) --language or
 -l. Thus a typical invocation would look like:
 <pre><code>
-$ rcc -l C++ <filename> ...
+$ rcc -l C++ &lt;filename&gt; ...
 </code></pre>
 
 
@@ -299,7 +299,7 @@ <h3>C++</h3>
 
   class IOError : public runtime_error {
   public:
-    explicit IOError(const std::string& msg);
+    explicit IOError(const std::string&amp; msg);
   };
 
   class IArchive;
@@ -307,18 +307,18 @@ <h3>C++</h3>
 
   class RecordReader {
   public:
-    RecordReader(InStream& in, RecFormat fmt);
+    RecordReader(InStream&amp; in, RecFormat fmt);
     virtual ~RecordReader(void);
 
-    virtual void read(Record& rec);
+    virtual void read(Record&amp; rec);
   };
 
   class RecordWriter {
   public:
-    RecordWriter(OutStream& out, RecFormat fmt);
+    RecordWriter(OutStream&amp; out, RecFormat fmt);
     virtual ~RecordWriter(void);
 
-    virtual void write(Record& rec);
+    virtual void write(Record&amp; rec);
   };
 
 
@@ -330,10 +330,10 @@ <h3>C++</h3>
     virtual bool validate(void) const = 0;
 
     virtual void
-    serialize(OArchive& oa, const std::string& tag) const = 0;
+    serialize(OArchive&amp; oa, const std::string&amp; tag) const = 0;
 
     virtual void
-    deserialize(IArchive& ia, const std::string& tag) = 0;
+    deserialize(IArchive&amp; ia, const std::string&amp; tag) = 0;
   };
 }
 </code></pre>
@@ -408,7 +408,7 @@ <h3>C++</h3>
 either the member or a reference to the member. For members that are returned 
 by value, a setter method is also generated. This is true for primitive 
 data members of the types byte, int, long, boolean, float and 
-double. For example, for a int field called MyField the folowing
+double. For example, for a int field called MyField the following
 code is generated.
 
 <pre><code>
@@ -438,11 +438,11 @@ <h3>C++</h3>
   ...
 public:
 
-  std::string& getMyBuf() {
+  std::string&amp; getMyBuf() {
     return mMyBuf;
   };
 
-  const std::string& getMyBuf() const {
+  const std::string&amp; getMyBuf() const {
     return mMyBuf;
   };
   ...
@@ -467,7 +467,7 @@ <h4>Examples</h4>
 include "inclrec.jr"
 module testrec {
     class R {
-        vector<float> VF;
+        vector&lt;float&gt; VF;
         RI            Rec;
         buffer        Buf;
     };
@@ -504,8 +504,8 @@ <h4>Examples</h4>
     RI(void);
     virtual ~RI(void);
 
-    virtual bool operator==(const RI& peer) const;
-    virtual bool operator<(const RI& peer) const;
+    virtual bool operator==(const RI&amp; peer) const;
+    virtual bool operator&lt;(const RI&amp; peer) const;
 
     virtual int32_t getI32(void) const { return mI32; }
     virtual void setI32(int32_t v) { mI32 = v; }
@@ -513,16 +513,16 @@ <h4>Examples</h4>
     virtual double getD(void) const { return mD; }
     virtual void setD(double v) { mD = v; }
 
-    virtual std::string& getS(void) const { return mS; }
-    virtual const std::string& getS(void) const { return mS; }
+    virtual std::string&amp; getS(void) const { return mS; }
+    virtual const std::string&amp; getS(void) const { return mS; }
 
     virtual std::string type(void) const;
     virtual std::string signature(void) const;
 
   protected:
 
-    virtual void serialize(hadoop::OArchive& a) const;
-    virtual void deserialize(hadoop::IArchive& a);
+    virtual void serialize(hadoop::OArchive&amp; a) const;
+    virtual void deserialize(hadoop::IArchive&amp; a);
 
     virtual bool validate(void);
   };
@@ -547,7 +547,7 @@ <h4>Examples</h4>
 
   private:
 
-    std::vector<float> mVF;
+    std::vector&lt;float&gt; mVF;
     inclrec::RI        mRec;
     std::string        mBuf;
 
@@ -556,20 +556,20 @@ <h4>Examples</h4>
     R(void);
     virtual ~R(void);
 
-    virtual bool operator==(const R& peer) const;
-    virtual bool operator<(const R& peer) const;
+    virtual bool operator==(const R&amp; peer) const;
+    virtual bool operator&lt;(const R&amp; peer) const;
 
-    virtual std::vector<float>& getVF(void) const;
-    virtual const std::vector<float>& getVF(void) const;
+    virtual std::vector&lt;float&gt;&amp; getVF(void) const;
+    virtual const std::vector&lt;float&gt;&amp; getVF(void) const;
 
-    virtual std::string& getBuf(void) const ;
-    virtual const std::string& getBuf(void) const;
+    virtual std::string&amp; getBuf(void) const ;
+    virtual const std::string&amp; getBuf(void) const;
 
-    virtual inclrec::RI& getRec(void) const;
-    virtual const inclrec::RI& getRec(void) const;
+    virtual inclrec::RI&amp; getRec(void) const;
+    virtual const inclrec::RI&amp; getRec(void) const;
     
-    virtual bool serialize(hadoop::OutArchive& a) const;
-    virtual bool deserialize(hadoop::InArchive& a);
+    virtual bool serialize(hadoop::OutArchive&amp; a) const;
+    virtual bool deserialize(hadoop::InArchive&amp; a);
     
     virtual std::string type(void) const;
     virtual std::string signature(void) const;
@@ -614,8 +614,8 @@ <h2>Mapping Summary</h2>
 ustring         std::string         Text
 buffer          std::string         java.io.ByteArrayOutputStream
 class type      class type          class type
-vector<type>    std::vector<type>   java.util.ArrayList
-map<type,type>  std::map<type,type> java.util.TreeMap
+vector&lt;type&gt;    std::vector&lt;type&gt;   java.util.ArrayList
+map&lt;type,type&gt;  std::map&lt;type,type&gt; java.util.TreeMap
 </code></pre>
 
 <h2>Data encodings</h2>
@@ -646,7 +646,7 @@ <h3>Binary Serialization Format</h3>
 <li> byte: Represented by 1 byte, as is.
 <li> boolean: Represented by 1-byte (0 or 1)
 <li> int/long: Integers and longs are serialized zero compressed.
-Represented as 1-byte if -120 <= value < 128. Otherwise, serialized as a
+Represented as 1-byte if -120 &lt;= value &lt; 128. Otherwise, serialized as a
 sequence of 2-5 bytes for ints, 2-9 bytes for longs. The first byte represents
 the number of trailing bytes, N, as the negative number (-120-N). For example,
 the number 1024 (0x400) is represented by the byte sequence 'x86 x04 x00'.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
index 488fb662339..cedd0c0c76c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
@@ -83,11 +83,16 @@ public String toString() {
     }
 
     /**
-     * Generates an initial sessionId. High order 1 byte is serverId, next
-     * 5 bytes are from timestamp, and low order 2 bytes are 0s.
-     * Use ">>> 8", not ">> 8" to make sure that the high order 1 byte is entirely up to the server Id(@see ZOOKEEPER-1622).
+     * Generates an initial sessionId.
+     *
+     * <p>High order 1 byte is serverId, next 5 bytes are from timestamp, and low order 2 bytes are 0s.
+     * Use {@literal ">>> 8"}, not {@literal ">> 8"} to make sure that the high order 1 byte is entirely
+     * up to the server Id.
+     *
+     * <p>See also http://jira.apache.org/jira/browse/ZOOKEEPER-1622
+     *
      * @param id server Id
-     * @return the Session Id
+     * @return the session Id
      */
     public static long initializeNextSessionId(long id) {
         long nextSid;

From b4a3238d1d0cebe1c97ed23427bbcc69c8477c8a Mon Sep 17 00:00:00 2001
From: Sankalp <sankal@amazon.com>
Date: Thu, 26 Mar 2020 22:19:08 +0100
Subject: [PATCH 007/591] ZOOKEEPER-3689: zkCli/ZooKeeperMain relies on system
 properties for TLS config

The current zkCli uses system properties to set confidential information like keystore location, password etc. This is not secure as these properties need to be passed on the command line as "-D"  arguments.

Currently, there is no way to create a ZookeeperAdmin does not have a constructor which takes both canBeReadOnly and ZKClientConfig as parameters.  I am introducing a new constructor in ZookeeperAdmin which takes an additional ZKClientConfig parameter. This ZKClientConfig is created by an optional command line argument ``client-configuration``. If no argument is passed, a ZookeeperAdmin object with null client config is created, just like before.

Author: Sankalp <sankal@amazon.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Justin Ling Mao <maoling199210191@sina.com>

Closes #1285 from sankalpbhatia/ZOOKEEPER-3689
---
 .../main/resources/markdown/zookeeperCLI.md   |  2 +
 .../org/apache/zookeeper/ZooKeeperMain.java   | 19 +++++++-
 .../zookeeper/admin/ZooKeeperAdmin.java       | 48 +++++++++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 637e6b4596a..c9ebd2b06cd 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -24,6 +24,8 @@ Enter into the ZooKeeper-cli
 bin/zkCli.sh
 # connect to the remote host with timeout:3s
 bin/zkCli.sh -timeout 3000 -server remoteIP:2181
+# connect with a custom client configuration properties file
+bin/zkCli.sh -client-configuration /path/to/client.properties
 ```
 ## help
 Showing helps about ZooKeeper commands
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index 8d8a419401f..243aca33c39 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -65,6 +65,7 @@
 import org.apache.zookeeper.cli.VersionCommand;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -130,7 +131,7 @@ public boolean getPrintWatches() {
     }
 
     static void usage() {
-        System.err.println("ZooKeeper -server host:port cmd args");
+        System.err.println("ZooKeeper -server host:port -client-configuration properties-file cmd args");
         List<String> cmdList = new ArrayList<String>(commandMap.keySet());
         Collections.sort(cmdList);
         for (String cmd : cmdList) {
@@ -205,6 +206,8 @@ public boolean parseOptions(String[] args) {
                         options.put("timeout", it.next());
                     } else if (opt.equals("-r")) {
                         options.put("readonly", "true");
+                    } else if (opt.equals("-client-configuration")) {
+                        options.put("client-configuration", it.next());
                     }
                 } catch (NoSuchElementException e) {
                     System.err.println("Error: no argument found for option " + opt);
@@ -286,7 +289,19 @@ protected void connectToZK(String newHost) throws InterruptedException, IOExcept
             System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
             System.out.println("Secure connection is enabled");
         }
-        zk = new ZooKeeperAdmin(host, Integer.parseInt(cl.getOption("timeout")), new MyWatcher(), readOnly);
+
+        ZKClientConfig clientConfig = null;
+
+        if (cl.getOption("client-configuration") != null) {
+            try {
+                clientConfig = new ZKClientConfig(cl.getOption("client-configuration"));
+            } catch (QuorumPeerConfig.ConfigException e) {
+                e.printStackTrace();
+                ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
+            }
+        }
+
+        zk = new ZooKeeperAdmin(host, Integer.parseInt(cl.getOption("timeout")), new MyWatcher(), readOnly, clientConfig);
     }
 
     public static void main(String[] args) throws IOException, InterruptedException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
index 05c992899d7..8240526a513 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
@@ -124,6 +124,54 @@ public ZooKeeperAdmin(
         super(connectString, sessionTimeout, watcher, conf);
     }
 
+    /**
+     * Create a ZooKeeperAdmin object which is used to perform dynamic reconfiguration
+     * operations.
+     *
+     * @param connectString
+     *            comma separated host:port pairs, each corresponding to a zk
+     *            server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002" If
+     *            the optional chroot suffix is used the example would look
+     *            like: "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002/app/a"
+     *            where the client would be rooted at "/app/a" and all paths
+     *            would be relative to this root - ie getting/setting/etc...
+     *            "/foo/bar" would result in operations being run on
+     *            "/app/a/foo/bar" (from the server perspective).
+     * @param sessionTimeout
+     *            session timeout in milliseconds
+     * @param watcher
+     *            a watcher object which will be notified of state changes, may
+     *            also be notified for node events
+     * @param canBeReadOnly
+     *            whether the created client is allowed to go to
+     *            read-only mode in case of partitioning. Read-only mode
+     *            basically means that if the client can't find any majority
+     *            servers but there's partitioned server it could reach, it
+     *            connects to one in read-only mode, i.e. read requests are
+     *            allowed while write requests are not. It continues seeking for
+     *            majority in the background.
+     * @param conf
+     *            passing this conf object gives each client the flexibility of
+     *            configuring properties differently compared to other instances
+     *
+     * @throws IOException
+     *             in cases of network failure
+     * @throws IllegalArgumentException
+     *             if an invalid chroot path is specified
+     *
+     * @see ZooKeeper#ZooKeeper(String, int, Watcher, boolean, ZKClientConfig)
+     *
+     * @since 3.6.1
+     */
+    public ZooKeeperAdmin(
+        String connectString,
+        int sessionTimeout,
+        Watcher watcher,
+        boolean canBeReadOnly,
+        ZKClientConfig conf) throws IOException {
+        super(connectString, sessionTimeout, watcher, canBeReadOnly, conf);
+    }
+
     /**
      * Create a ZooKeeperAdmin object which is used to perform dynamic reconfiguration
      * operations.

From 1ff1b779b70dd794c9e45f35f8ca305229df10e0 Mon Sep 17 00:00:00 2001
From: Sushant Mane <sushant.mane@sjsu.edu>
Date: Thu, 26 Mar 2020 22:20:51 +0100
Subject: [PATCH 008/591] ZOOKEEPER-3755: Use maven to create fatjar

- replace ant build.xml with maven pom.xml for zookeeper-contrib-fatjar module
- create maven profile "fatjar" to build a fatjar file.
- update readme files

Author: Sushant Mane <sushant.mane@sjsu.edu>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Benjamin Reed <breed@apache.org>

Closes #1284 from sushantmane/master
---
 pom.xml                                       |   7 +
 zookeeper-contrib/pom.xml                     |   9 ++
 .../zookeeper-contrib-fatjar/README.md        |  21 +++
 .../zookeeper-contrib-fatjar/README.txt       |   2 -
 .../zookeeper-contrib-fatjar/build.xml        |  74 ---------
 .../zookeeper-contrib-fatjar/pom.xml          | 145 ++++++++++++++++++
 .../src/main/resources/mainClasses            |   2 -
 zookeeper-it/README.txt                       |   9 +-
 zookeeper-it/pom.xml                          |  77 ++++++++++
 .../zookeeper/server/watch/WatchBench.java    |   4 +-
 .../zookeeper/test/system/BaseSysTest.java    |  13 +-
 .../test/system/InstanceContainer.java        |   2 +-
 12 files changed, 274 insertions(+), 91 deletions(-)
 create mode 100644 zookeeper-contrib/zookeeper-contrib-fatjar/README.md
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-fatjar/README.txt
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-fatjar/build.xml
 create mode 100755 zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
 create mode 100755 zookeeper-it/pom.xml

diff --git a/pom.xml b/pom.xml
index 041b41571f8..6fad123737f 100755
--- a/pom.xml
+++ b/pom.xml
@@ -261,6 +261,13 @@
         <module>zookeeper-contrib</module>
       </modules>
     </profile>
+    <profile>
+      <id>fatjar</id>
+      <modules>
+        <module>zookeeper-it</module>
+        <module>zookeeper-contrib/zookeeper-contrib-fatjar</module>
+      </modules>
+    </profile>
     <profile>
       <id>java-build</id>
       <activation>
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index edc3cb351fd..228a520ed4b 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -40,6 +40,15 @@
     <module>zookeeper-contrib-zooinspector</module>
   </modules>
 
+  <profiles>
+    <profile>
+      <id>fatjar</id>
+      <modules>
+        <module>zookeeper-contrib-fatjar</module>
+      </modules>
+    </profile>
+  </profiles>
+
   <build>
     <pluginManagement>
       <plugins>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/README.md b/zookeeper-contrib/zookeeper-contrib-fatjar/README.md
new file mode 100644
index 00000000000..baf2f95f91f
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/README.md
@@ -0,0 +1,21 @@
+ZooKeeper Fatjar
+================
+
+This package contains build to create a fat zookeeper jar. Fatjar can be used to run:
+- zookeeper server
+- zookeeper client
+- distributed load generator for testing (generateLoad)
+- container that will instantiate classes as directed by an instance manager (ic)
+- system test (systest)
+- jmh micro benchmarks (jmh)
+
+
+Use following command to build fatjar
+```
+mvn clean install -P fatjar -DskipTests
+```
+
+To run the fatjar use:
+```
+java -jar zoookeeper-<version>-fatjar.jar
+```
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/README.txt b/zookeeper-contrib/zookeeper-contrib-fatjar/README.txt
deleted file mode 100644
index f8027ae8c9e..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/README.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-This package contains build to create a fat zookeeper jar. You need to run ant to create the fat jar.
-To run the fatjar you can use. java -jar zoookeeper-*fatjar.jar 
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/build.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/build.xml
deleted file mode 100644
index 3a1dd958e4e..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/build.xml
+++ /dev/null
@@ -1,74 +0,0 @@
-<?xml version="1.0"?>
-
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-<project name="fatjar" default="jar">
-  <import file="../build-contrib.xml"/>
-
-  <target name="setjarname">
-    <property name="jarname"
-              value="${build.dir}/zookeeper-${version}-${name}.jar"/>
-  </target>
-
-  <!-- Override jar target to specify main class -->
-  <target name="jar" depends="checkMainCompiled, setjarname, compile">
-    <echo message="contrib: ${name}"/>
-    <jar jarfile="${jarname}">
-      <manifest>
-        <attribute name="Main-Class" value="org.apache.zookeeper.util.FatJarMain" />
-        <attribute name="Built-By" value="${user.name}"/>
-        <attribute name="Built-At" value="${build.time}"/>
-        <attribute name="Built-On" value="${host.name}" />
-        <attribute name="Implementation-Title" value="org.apache.zookeeper"/>
-        <attribute name="Implementation-Version" value="${revision}"/>
-        <attribute name="Implementation-Vendor" value="The Apache Software Foundation"/>
-      </manifest>
-      <fileset file="${basedir}/src/main/resources/mainClasses" />
-      <fileset dir="${build.classes}"/>
-      <fileset dir="${build.test}"/>
-      <fileset file="${zk.root}/LICENSE.txt" />
-      <fileset file="${zk.root}/conf/log4j.properties" />
-      <fileset dir="${zk.root}/build/classes" excludes="**/.generated"/>
-      <fileset dir="${zk.root}/build/test/classes"/>
-      <zipgroupfileset dir="${zk.root}/build/lib" includes="*.jar" />
-      <zipgroupfileset dir="${zk.root}/build/test/lib" includes="*.jar" />
-      <zipgroupfileset dir="${zk.root}/zookeeper-server/src/main/resources/lib" includes="*.jar" />
-    </jar>
-  </target>
-
-  <target name="package" depends="jar, zookeeperbuildcontrib.package"
-          unless="skip.contrib">
-
-    <copy file="${basedir}/build.xml" todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}"/>
-
-    <mkdir dir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/conf"/>
-    <copy todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/conf">
-      <fileset dir="${basedir}/src/main/resources"/>
-    </copy>
-
-    <mkdir dir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src"/>
-    <copy todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src">
-      <fileset dir="${basedir}/src"/>
-    </copy>
-  </target>
-
-	<target name="test">
-		<echo message="No test target defined for this package" />
-	</target>
-</project>
-
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
new file mode 100755
index 00000000000..9a90dd7fc3c
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -0,0 +1,145 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <!--
+  /**
+   * Licensed to the Apache Software Foundation (ASF) under one
+   * or more contributor license agreements.  See the NOTICE file
+   * distributed with this work for additional information
+   * regarding copyright ownership.  The ASF licenses this file
+   * to you under the Apache License, Version 2.0 (the
+   * "License"); you may not use this file except in compliance
+   * with the License.  You may obtain a copy of the License at
+   *
+   *     http://www.apache.org/licenses/LICENSE-2.0
+   *
+   * Unless required by applicable law or agreed to in writing, software
+   * distributed under the License is distributed on an "AS IS" BASIS,
+   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   * See the License for the specific language governing permissions and
+   * limitations under the License.
+   */
+  -->
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.apache.zookeeper</groupId>
+    <artifactId>zookeeper-contrib</artifactId>
+    <version>3.7.0-SNAPSHOT</version>
+  </parent>
+
+  <groupId>org.apache.zookeeper</groupId>
+  <artifactId>zookeeper-contrib-fatjar</artifactId>
+  <packaging>jar</packaging>
+  <name>Apache ZooKeeper - Contrib - Fatjar</name>
+
+  <properties>
+    <maven.javadoc.skip>true</maven.javadoc.skip>
+    <maven.source.skip>true</maven.source.skip>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper-jute</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper</artifactId>
+      <version>${project.version}</version>
+      <type>test-jar</type>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper-it</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>commons-cli</groupId>
+      <artifactId>commons-cli</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-server</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-servlet</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>com.googlecode.json-simple</groupId>
+      <artifactId>json-simple</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>jline</groupId>
+      <artifactId>jline</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>io.dropwizard.metrics</groupId>
+      <artifactId>metrics-core</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.xerial.snappy</groupId>
+      <artifactId>snappy-java</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>log4j</groupId>
+      <artifactId>log4j</artifactId>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <resources>
+      <resource>
+        <directory>${project.basedir}/src/main/resources</directory>
+      </resource>
+      <resource>
+        <directory>${project.basedir}/../../conf</directory>
+        <includes>
+          <include>log4j.properties</include>
+        </includes>
+      </resource>
+    </resources>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-assembly-plugin</artifactId>
+        <configuration>
+          <descriptorRefs>
+            <descriptorRef>jar-with-dependencies</descriptorRef>
+          </descriptorRefs>
+          <archive>
+            <manifest>
+              <mainClass>org.apache.zookeeper.util.FatJarMain</mainClass>
+            </manifest>
+          </archive>
+          <finalName>zookeeper-${project.version}-fatjar</finalName>
+          <appendAssemblyId>false</appendAssemblyId>
+          <attach>false</attach>
+        </configuration>
+        <executions>
+          <execution>
+          <id>make-assembly</id>
+          <phase>package</phase>
+          <goals>
+            <goal>single</goal>
+          </goals>
+        </execution>
+      </executions>
+      </plugin>
+    </plugins>
+  </build>
+
+</project>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses b/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses
index ba29e891973..c7b27a1325b 100644
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses
@@ -4,8 +4,6 @@ client:org.apache.zookeeper.ZooKeeperMain:Client shell to ZooKeeper
 server:org.apache.zookeeper.server.quorum.QuorumPeerMain:Start ZooKeeper server
 ::Test Commands
 generateLoad:org.apache.zookeeper.test.system.GenerateLoad:A distributed load generator for testing
-quorumBench:org.apache.zookeeper.server.QuorumBenchmark:A benchmark of just the quorum protocol
-abBench:org.apache.zookeeper.server.quorum.AtomicBroadcastBenchmark:A benchmark of just the atomic broadcast
 ic:org.apache.zookeeper.test.system.InstanceContainer:A container that will instantiate classes as directed by an instance manager
 systest:org.apache.zookeeper.test.system.BaseSysTest:Start system test
 jmh:org.apache.zookeeper.BenchMain:Run jmh micro benchmarks
diff --git a/zookeeper-it/README.txt b/zookeeper-it/README.txt
index 8a2985c2eda..2c4b1cc4865 100644
--- a/zookeeper-it/README.txt
+++ b/zookeeper-it/README.txt
@@ -7,11 +7,12 @@ The easiest way to do all of this is to use the zookeeper fat jar.
 
 Steps to run system test
 ------------------------
-1) transfer the fatjar from the release directory to all systems
-   participating in the test. fatjar is in contrib/fatjar directory.
+1) build and transfer the fatjar from the `zookeeper-contrib/zookeeper-contrib-fatjar/target`
+   directory to all systems participating in the test
 
-   (developers can generate by running "ant jar compile-test"
-   targets in trunk, then compiling using "ant jar" in src/contrib/jarjar)
+   Command to build fatjar without executing the tests:
+
+   `mvn clean install -P fatjar -DskipTests`
 
 2) run a zookeeper standalone instance (cluster is ok too)
 
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
new file mode 100755
index 00000000000..163930fa3c5
--- /dev/null
+++ b/zookeeper-it/pom.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <!--
+  /**
+   * Licensed to the Apache Software Foundation (ASF) under one
+   * or more contributor license agreements.  See the NOTICE file
+   * distributed with this work for additional information
+   * regarding copyright ownership.  The ASF licenses this file
+   * to you under the Apache License, Version 2.0 (the
+   * "License"); you may not use this file except in compliance
+   * with the License.  You may obtain a copy of the License at
+   *
+   *     http://www.apache.org/licenses/LICENSE-2.0
+   *
+   * Unless required by applicable law or agreed to in writing, software
+   * distributed under the License is distributed on an "AS IS" BASIS,
+   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   * See the License for the specific language governing permissions and
+   * limitations under the License.
+   */
+  -->
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.apache.zookeeper</groupId>
+    <artifactId>parent</artifactId>
+    <version>3.7.0-SNAPSHOT</version>
+  </parent>
+
+  <artifactId>zookeeper-it</artifactId>
+  <packaging>jar</packaging>
+  <name>Apache ZooKeeper - Tests</name>
+  <description>
+    ZooKeeper system tests
+  </description>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper</artifactId>
+      <classifier>tests</classifier>
+      <type>test-jar</type>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.openjdk.jmh</groupId>
+      <artifactId>jmh-core</artifactId>
+      <version>1.23</version>
+    </dependency>
+    <dependency>
+      <groupId>org.openjdk.jmh</groupId>
+      <artifactId>jmh-generator-annprocess</artifactId>
+      <version>1.23</version>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <sourceDirectory>src</sourceDirectory>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-javadoc-plugin</artifactId>
+        <configuration>
+          <sourcepath>src</sourcepath>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>
diff --git a/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java b/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java
index 0510df76ca6..aee5b2f18ab 100644
--- a/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java
+++ b/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java
@@ -35,9 +35,9 @@ public class WatchBench {
     static final EventType event = EventType.NodeDataChanged;
 
     static IWatchManager createWatchManager(String className) throws Exception {
-        Class clazz = Class.forName(
+        Class<?> clazz = Class.forName(
                 "org.apache.zookeeper.server.watch." + className);
-        return (IWatchManager) clazz.newInstance();
+        return (IWatchManager) clazz.getConstructor().newInstance();
     }
 
     static void forceGC() {
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java b/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java
index 8856282e6dc..6816f2d80cf 100644
--- a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java
+++ b/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java
@@ -20,6 +20,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -223,15 +224,15 @@ private void distributedConfigureClients(int count, Class<? extends Instance> cl
 
     }
     private Instance fakeBaseClients[];
-    private void fakeConfigureClients(int count, Class<? extends Instance> clazz, String params) throws IOException, ClassNotFoundException {
+    private void fakeConfigureClients(int count, Class<? extends Instance> clazz, String params) {
         fakeBaseClients = new Instance[count];
         for(int i = 0; i < count; i++) {
             try {
-                fakeBaseClients[i] = clazz.newInstance();
-            } catch (InstantiationException e) {
-                e.printStackTrace();
-                return;
-            } catch (IllegalAccessException e) {
+                fakeBaseClients[i] = clazz.getConstructor().newInstance();
+            } catch (InstantiationException
+                    | IllegalAccessException
+                    | NoSuchMethodException
+                    | InvocationTargetException e) {
                 e.printStackTrace();
                 return;
             }
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java b/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java
index 1cb7bc02edb..44f6531b94f 100644
--- a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java
+++ b/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java
@@ -271,7 +271,7 @@ public void processResult(int rc, String path, Object ctx, List<String> children
                     }
                     try {
                         Class<?> c = Class.forName(clazz);
-                        i = (Instance)c.newInstance();
+                        i = (Instance) c.getConstructor().newInstance();
                         Reporter reporter = new MyReporter(child);
                         i.setReporter(reporter);
                         i.configure(conf);

From a4c97d255ad7bb86c61a35d01415de1caebd3dac Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Tue, 31 Mar 2020 13:39:49 +0200
Subject: [PATCH 009/591] ZOOKEEPER-3771: Update zk-merge-pr script to Python3

eolivelli generally I use `2to3` util and check the codepath that I can arrive, manually fix some lines.

But it seems we can verify this patch totally when merging this patch :)

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1295 from TisonKun/patch-1
---
 zk-merge-pr.py | 116 ++++++++++++++++++++++++-------------------------
 1 file changed, 58 insertions(+), 58 deletions(-)

diff --git a/zk-merge-pr.py b/zk-merge-pr.py
index 5768a94d74f..dc5549d9dfa 100644
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -32,7 +32,7 @@
 import re
 import subprocess
 import sys
-import urllib2
+import urllib.request, urllib.error, urllib.parse
 import getpass
 
 try:
@@ -75,48 +75,48 @@
 
 def get_json(url):
     try:
-        request = urllib2.Request(url)
+        request = urllib.request.Request(url)
         if GITHUB_OAUTH_KEY:
             request.add_header('Authorization', 'token %s' % GITHUB_OAUTH_KEY)
-        return json.load(urllib2.urlopen(request))
-    except urllib2.HTTPError as e:
+        return json.load(urllib.request.urlopen(request))
+    except urllib.error.HTTPError as e:
         if "X-RateLimit-Remaining" in e.headers and e.headers["X-RateLimit-Remaining"] == '0':
-            print "Exceeded the GitHub API rate limit; see the instructions in " + \
+            print("Exceeded the GitHub API rate limit; see the instructions in " + \
                   "zk-merge-pr.py to configure an OAuth token for making authenticated " + \
-                  "GitHub requests."
+                  "GitHub requests.")
         else:
-            print "Unable to fetch URL, exiting: %s" % url
+            print("Unable to fetch URL, exiting: %s" % url)
         sys.exit(-1)
 
 
 def fail(msg):
-    print msg
+    print(msg)
     clean_up()
     sys.exit(-1)
 
 
 def run_cmd(cmd):
-    print cmd
+    print(cmd)
     if isinstance(cmd, list):
-        return subprocess.check_output(cmd)
+        return subprocess.check_output(cmd, encoding='utf8')
     else:
-        return subprocess.check_output(cmd.split(" "))
+        return subprocess.check_output(cmd.split(" "), encoding='utf8')
 
 
 def continue_maybe(prompt):
-    result = raw_input("\n%s (y/n): " % prompt)
+    result = input("\n%s (y/n): " % prompt)
     if result.lower().strip() != "y":
         fail("Okay, exiting")
 
 def clean_up():
     if original_head != get_current_branch():
-        print "Restoring head pointer to %s" % original_head
+        print("Restoring head pointer to %s" % original_head)
         run_cmd("git checkout %s" % original_head)
 
     branches = run_cmd("git branch").replace(" ", "").split("\n")
 
-    for branch in filter(lambda x: x.startswith(TEMP_BRANCH_PREFIX), branches):
-        print "Deleting local branch %s" % branch
+    for branch in [x for x in branches if x.startswith(TEMP_BRANCH_PREFIX)]:
+        print("Deleting local branch %s" % branch)
         run_cmd("git branch -D %s" % branch)
 
 def get_current_branch():
@@ -144,20 +144,20 @@ def merge_pr(pr_num, target_ref, title, body, pr_repo_desc):
                              '--pretty=format:%an <%ae>']).split("\n")
     distinct_authors = sorted(set(commit_authors),
                               key=lambda x: commit_authors.count(x), reverse=True)
-    primary_author = raw_input(
+    primary_author = input(
         "Enter primary author in the format of \"name <email>\" [%s]: " %
         distinct_authors[0])
     if primary_author == "":
         primary_author = distinct_authors[0]
 
-    reviewers = raw_input(
+    reviewers = input(
         "Enter reviewers in the format of \"name1 <email1>, name2 <email2>\": ").strip()
 
     commits = run_cmd(['git', 'log', 'HEAD..%s' % pr_branch_name,
                       '--pretty=format:%h [%an] %s']).split("\n")
 
     if len(commits) > 1:
-        result = raw_input("List pull request commits in squashed commit message? (y/n): ")
+        result = input("List pull request commits in squashed commit message? (y/n): ")
         if result.lower().strip() == "y":
           should_list_commits = True
         else:
@@ -209,13 +209,13 @@ def merge_pr(pr_num, target_ref, title, body, pr_repo_desc):
 
     merge_hash = run_cmd("git rev-parse %s" % target_branch_name)[:8]
     clean_up()
-    print("Pull request #%s merged!" % pr_num)
-    print("Merge hash: %s" % merge_hash)
+    print(("Pull request #%s merged!" % pr_num))
+    print(("Merge hash: %s" % merge_hash))
     return merge_hash
 
 
 def cherry_pick(pr_num, merge_hash, default_branch):
-    pick_ref = raw_input("Enter a branch name [%s]: " % default_branch)
+    pick_ref = input("Enter a branch name [%s]: " % default_branch)
     if pick_ref == "":
         pick_ref = default_branch
 
@@ -244,21 +244,21 @@ def cherry_pick(pr_num, merge_hash, default_branch):
     pick_hash = run_cmd("git rev-parse %s" % pick_branch_name)[:8]
     clean_up()
 
-    print("Pull request #%s picked into %s!" % (pr_num, pick_ref))
-    print("Pick hash: %s" % pick_hash)
+    print(("Pull request #%s picked into %s!" % (pr_num, pick_ref)))
+    print(("Pick hash: %s" % pick_hash))
     return pick_ref
 
 
 def fix_version_from_branch(branch, versions):
     # Note: Assumes this is a sorted (newest->oldest) list of un-released versions
     if branch == DEV_BRANCH_NAME:
-        versions = filter(lambda x: x == DEFAULT_FIX_VERSION, versions)
+        versions = [x for x in versions if x == DEFAULT_FIX_VERSION]
         if len(versions) > 0:
             return versions[0]
         else:
             return None
     else:
-        versions = filter(lambda x: x.startswith(branch), versions)
+        versions = [x for x in versions if x.startswith(branch)]
         if len(versions) > 0:
             return versions[-1]
         else:
@@ -269,7 +269,7 @@ def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
     asf_jira = jira.client.JIRA({'server': JIRA_API_BASE},
                                 basic_auth=(JIRA_USERNAME, JIRA_PASSWORD))
 
-    jira_id = raw_input("Enter a JIRA id [%s]: " % default_jira_id)
+    jira_id = input("Enter a JIRA id [%s]: " % default_jira_id)
     if jira_id == "":
         jira_id = default_jira_id
 
@@ -288,20 +288,20 @@ def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
 
     if cur_status == "Resolved" or cur_status == "Closed":
         fail("JIRA issue %s already has status '%s'" % (jira_id, cur_status))
-    print ("=== JIRA %s ===" % jira_id)
-    print ("summary\t\t%s\nassignee\t%s\nstatus\t\t%s\nurl\t\t%s/%s\n" % (
-        cur_summary, cur_assignee, cur_status, JIRA_BASE, jira_id))
+    print(("=== JIRA %s ===" % jira_id))
+    print(("summary\t\t%s\nassignee\t%s\nstatus\t\t%s\nurl\t\t%s/%s\n" % (
+        cur_summary, cur_assignee, cur_status, JIRA_BASE, jira_id)))
 
     versions = asf_jira.project_versions(CAPITALIZED_PROJECT_NAME)
     versions = sorted(versions, key=lambda x: x.name, reverse=True)
-    versions = filter(lambda x: x.raw['released'] is False, versions)
+    versions = [x for x in versions if x.raw['released'] is False]
 
-    version_names = map(lambda x: x.name, versions)
-    default_fix_versions = map(lambda x: fix_version_from_branch(x, version_names), merge_branches)
-    default_fix_versions = filter(lambda x: x != None, default_fix_versions)
+    version_names = [x.name for x in versions]
+    default_fix_versions = [fix_version_from_branch(x, version_names) for x in merge_branches]
+    default_fix_versions = [x for x in default_fix_versions if x != None]
     default_fix_versions = ",".join(default_fix_versions)
 
-    fix_versions = raw_input("Enter comma-separated fix version(s) [%s]: " % default_fix_versions)
+    fix_versions = input("Enter comma-separated fix version(s) [%s]: " % default_fix_versions)
     if fix_versions == "":
         fix_versions = default_fix_versions
     fix_versions = fix_versions.replace(" ", "").split(",")
@@ -309,7 +309,7 @@ def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
     def get_version_json(version_str):
         return filter(lambda v: v.name == version_str, versions)[0].raw
 
-    jira_fix_versions = map(lambda v: get_version_json(v), fix_versions)
+    jira_fix_versions = [get_version_json(v) for v in fix_versions]
 
     resolve = filter(lambda a: a['name'] == "Resolve Issue", asf_jira.transitions(jira_id))[0]
     resolution = filter(lambda r: r.raw['name'] == "Fixed", asf_jira.resolutions())[0]
@@ -317,7 +317,7 @@ def get_version_json(version_str):
         jira_id, resolve["id"], fixVersions = jira_fix_versions,
         comment = comment, resolution = {'id': resolution.raw['id']})
 
-    print "Successfully resolved %s with fixVersions=%s!" % (jira_id, fix_versions)
+    print("Successfully resolved %s with fixVersions=%s!" % (jira_id, fix_versions))
 
 
 def resolve_jira_issues(title, merge_branches, comment):
@@ -401,7 +401,7 @@ def check_git_remote():
 
     # check if all remote endpoints' URLs point to project git repo
     name = PROJECT_NAME + ".git"
-    for url in repos.values():
+    for url in list(repos.values()):
         if not url.endswith(name):
             fail("Error: not a %s git repo or at least one remote is invalid" % PROJECT_NAME)
 
@@ -419,7 +419,7 @@ def check_jira_env():
     if JIRA_IMPORTED:
 
        if JIRA_USERNAME.strip() != "" and JIRA_PASSWORD.strip() == "":
-           inform_pwd = raw_input("JIRA_USERNAME set but JIRA_PASSWORD is not. Want to inform it? ")
+           inform_pwd = input("JIRA_USERNAME set but JIRA_PASSWORD is not. Want to inform it? ")
            if inform_pwd.strip() == "y":
                JIRA_PASSWORD = getpass.getpass('JIRA PASSWORD: ')
 
@@ -440,34 +440,34 @@ def main():
     check_git_remote()
 
     branches = get_json("%s/branches" % GITHUB_API_BASE)
-    branch_names = filter(lambda x: x.startswith(RELEASE_BRANCH_PREFIX), [x['name'] for x in branches])
+    branch_names = [x for x in [x['name'] for x in branches] if x.startswith(RELEASE_BRANCH_PREFIX)]
     # Assumes branch names can be sorted lexicographically
     latest_branch = sorted(branch_names, reverse=True)[0]
 
-    pr_num = raw_input("Which pull request would you like to merge? (e.g. 34): ")
+    pr_num = input("Which pull request would you like to merge? (e.g. 34): ")
     pr = get_json("%s/pulls/%s" % (GITHUB_API_BASE, pr_num))
     pr_events = get_json("%s/issues/%s/events" % (GITHUB_API_BASE, pr_num))
 
     url = pr["url"]
 
     pr_title = pr["title"]
-    commit_title = raw_input("Commit title [%s]: " % pr_title.encode("utf-8")).decode("utf-8")
+    commit_title = input("Commit title [%s]: " % pr_title)
     if commit_title == "":
         commit_title = pr_title
 
     # Decide whether to use the modified title or not
     modified_title = standardize_jira_ref(commit_title)
     if modified_title != commit_title:
-        print "I've re-written the title as follows to match the standard format:"
-        print "Original: %s" % commit_title
-        print "Modified: %s" % modified_title
-        result = raw_input("Would you like to use the modified title? (y/n): ")
+        print("I've re-written the title as follows to match the standard format:")
+        print("Original: %s" % commit_title)
+        print("Modified: %s" % modified_title)
+        result = input("Would you like to use the modified title? (y/n): ")
         if result.lower().strip() == "y":
             commit_title = modified_title
-            print "Using modified title:"
+            print("Using modified title:")
         else:
-            print "Using original title:"
-        print commit_title
+            print("Using original title:")
+        print(commit_title)
 
     body = pr["body"]
     target_ref = pr["base"]["ref"]
@@ -484,13 +484,13 @@ def main():
         merge_hash = merge_commits[0]["commit_id"]
         message = get_json("%s/commits/%s" % (GITHUB_API_BASE, merge_hash))["commit"]["message"]
 
-        print "Pull request %s has already been merged, assuming you want to backport" % pr_num
+        print("Pull request %s has already been merged, assuming you want to backport" % pr_num)
         commit_is_downloaded = run_cmd(['git', 'rev-parse', '--quiet', '--verify',
                                     "%s^{commit}" % merge_hash]).strip() != ""
         if not commit_is_downloaded:
             fail("Couldn't find any merge commit for #%s, you may need to update HEAD." % pr_num)
 
-        print "Found commit %s:\n%s" % (merge_hash, message)
+        print("Found commit %s:\n%s" % (merge_hash, message))
         cherry_pick(pr_num, merge_hash, latest_branch)
         sys.exit(0)
 
@@ -499,9 +499,9 @@ def main():
             "Continue? (experts only!)"
         continue_maybe(msg)
 
-    print ("\n=== Pull Request #%s ===" % pr_num)
-    print ("PR title\t%s\nCommit title\t%s\nSource\t\t%s\nTarget\t\t%s\nURL\t\t%s" % (
-        pr_title, commit_title, pr_repo_desc, target_ref, url))
+    print(("\n=== Pull Request #%s ===" % pr_num))
+    print(("PR title\t%s\nCommit title\t%s\nSource\t\t%s\nTarget\t\t%s\nURL\t\t%s" % (
+        pr_title, commit_title, pr_repo_desc, target_ref, url)))
     continue_maybe("Proceed with merging pull request #%s?" % pr_num)
 
     merged_refs = [target_ref]
@@ -509,7 +509,7 @@ def main():
     merge_hash = merge_pr(pr_num, target_ref, commit_title, body, pr_repo_desc)
 
     pick_prompt = "Would you like to pick %s into another branch?" % merge_hash
-    while raw_input("\n%s (y/n): " % pick_prompt).lower().strip() == "y":
+    while input("\n%s (y/n): " % pick_prompt).lower().strip() == "y":
         merged_refs = merged_refs + [cherry_pick(pr_num, merge_hash, latest_branch)]
 
     if JIRA_IMPORTED:
@@ -518,11 +518,11 @@ def main():
             jira_comment = "Issue resolved by pull request %s\n[%s/%s]" % (pr_num, GITHUB_BASE, pr_num)
             resolve_jira_issues(commit_title, merged_refs, jira_comment)
         else:
-            print "JIRA_USERNAME and JIRA_PASSWORD not set"
-            print "Exiting without trying to close the associated JIRA."
+            print("JIRA_USERNAME and JIRA_PASSWORD not set")
+            print("Exiting without trying to close the associated JIRA.")
     else:
-        print "Could not find jira-python library. Run 'sudo pip install jira' to install."
-        print "Exiting without trying to close the associated JIRA."
+        print("Could not find jira-python library. Run 'sudo pip install jira' to install.")
+        print("Exiting without trying to close the associated JIRA.")
 
 if __name__ == "__main__":
     import doctest

From 7e6386aa9b404dd236b6bdc3b5c714116f3986db Mon Sep 17 00:00:00 2001
From: Jono <jono.morris@xtra.co.nz>
Date: Wed, 1 Apr 2020 17:02:20 +0200
Subject: [PATCH 010/591] ZOOKEEPER-3581: Use factory design pattern to
 refactor ZooKeeperMain

Using a factory design pattern to refactor ZooKeeperMain, making the code more elegant.

Author: Jono <jono.morris@xtra.co.nz>

Reviewers: andor@apache.org

Closes #1255 from jono-morris/ZOOKEEPER-3581 and squashes the following commits:

556e1763e [Jono] Fix style errors with import statements.
e10dfb872 [Jono] Add licence text.
4957d89b5 [Jono] 1. Reinstate missing imports to ZooKeeperMain.
ed76f14da [Jono] Minor Javadoc updates.
cc8de4920 [Jono] Add Factory to create CliCommand classes.  Initial Commit.
---
 .../org/apache/zookeeper/ZooKeeperMain.java   | 62 +++-------------
 .../apache/zookeeper/cli/CommandFactory.java  | 74 +++++++++++++++++++
 .../zookeeper/cli/CommandFactoryTest.java     | 38 ++++++++++
 3 files changed, 123 insertions(+), 51 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index 243aca33c39..ff8ce623286 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -31,38 +31,17 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Map.Entry;
 import java.util.NoSuchElementException;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import java.util.stream.Stream;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
-import org.apache.zookeeper.cli.AddAuthCommand;
-import org.apache.zookeeper.cli.AddWatchCommand;
 import org.apache.zookeeper.cli.CliCommand;
 import org.apache.zookeeper.cli.CliException;
-import org.apache.zookeeper.cli.CloseCommand;
+import org.apache.zookeeper.cli.CommandFactory;
 import org.apache.zookeeper.cli.CommandNotFoundException;
-import org.apache.zookeeper.cli.CreateCommand;
-import org.apache.zookeeper.cli.DelQuotaCommand;
-import org.apache.zookeeper.cli.DeleteAllCommand;
-import org.apache.zookeeper.cli.DeleteCommand;
-import org.apache.zookeeper.cli.GetAclCommand;
-import org.apache.zookeeper.cli.GetAllChildrenNumberCommand;
-import org.apache.zookeeper.cli.GetCommand;
-import org.apache.zookeeper.cli.GetConfigCommand;
-import org.apache.zookeeper.cli.GetEphemeralsCommand;
-import org.apache.zookeeper.cli.ListQuotaCommand;
-import org.apache.zookeeper.cli.LsCommand;
 import org.apache.zookeeper.cli.MalformedCommandException;
-import org.apache.zookeeper.cli.ReconfigCommand;
-import org.apache.zookeeper.cli.RemoveWatchesCommand;
-import org.apache.zookeeper.cli.SetAclCommand;
-import org.apache.zookeeper.cli.SetCommand;
-import org.apache.zookeeper.cli.SetQuotaCommand;
-import org.apache.zookeeper.cli.StatCommand;
-import org.apache.zookeeper.cli.SyncCommand;
-import org.apache.zookeeper.cli.VersionCommand;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
@@ -100,34 +79,15 @@ public boolean getPrintWatches() {
         commandMap.put("redo", "cmdno");
         commandMap.put("printwatches", "on|off");
         commandMap.put("quit", "");
-
-        new CloseCommand().addToMap(commandMapCli);
-        new CreateCommand().addToMap(commandMapCli);
-        new DeleteCommand().addToMap(commandMapCli);
-        new DeleteAllCommand().addToMap(commandMapCli);
-        new SetCommand().addToMap(commandMapCli);
-        new GetCommand().addToMap(commandMapCli);
-        new LsCommand().addToMap(commandMapCli);
-        new GetAclCommand().addToMap(commandMapCli);
-        new SetAclCommand().addToMap(commandMapCli);
-        new StatCommand().addToMap(commandMapCli);
-        new SyncCommand().addToMap(commandMapCli);
-        new SetQuotaCommand().addToMap(commandMapCli);
-        new ListQuotaCommand().addToMap(commandMapCli);
-        new DelQuotaCommand().addToMap(commandMapCli);
-        new AddAuthCommand().addToMap(commandMapCli);
-        new ReconfigCommand().addToMap(commandMapCli);
-        new GetConfigCommand().addToMap(commandMapCli);
-        new RemoveWatchesCommand().addToMap(commandMapCli);
-        new GetEphemeralsCommand().addToMap(commandMapCli);
-        new GetAllChildrenNumberCommand().addToMap(commandMapCli);
-        new VersionCommand().addToMap(commandMapCli);
-        new AddWatchCommand().addToMap(commandMapCli);
-
-        // add all to commandMap
-        for (Entry<String, CliCommand> entry : commandMapCli.entrySet()) {
-            commandMap.put(entry.getKey(), entry.getValue().getOptionStr());
-        }
+        Stream.of(CommandFactory.Command.values())
+            .map(command -> CommandFactory.getInstance(command))
+            // add all commands to commandMapCli and commandMap
+            .forEach(cliCommand ->{
+                cliCommand.addToMap(commandMapCli);
+                commandMap.put(
+                        cliCommand.getCmdStr(),
+                        cliCommand.getOptionStr());
+            });
     }
 
     static void usage() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
new file mode 100644
index 00000000000..87f016398d7
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.util.function.Supplier;
+
+/**
+ * Factory class for creating instances of {@link CliCommand}.
+ */
+public class CommandFactory {
+
+    /**
+     * All Cli Commands.
+     */
+    public enum Command {
+        CLOSE(CloseCommand::new),
+        CREATE(CreateCommand::new),
+        DELETE(DeleteCommand::new),
+        DELETE_ALL(DeleteAllCommand::new),
+        SET(SetCommand::new),
+        GET(GetCommand::new),
+        LS(LsCommand::new),
+        GET_ACL(GetAclCommand::new),
+        SET_ACL(SetAclCommand::new),
+        STAT(StatCommand::new),
+        SYNC(SyncCommand::new),
+        SET_QUOTA(SetQuotaCommand::new),
+        LIST_QUOTA(ListQuotaCommand::new),
+        DEL_QUOTA(DelQuotaCommand::new),
+        ADD_AUTH(AddAuthCommand::new),
+        RECONFIG(ReconfigCommand::new),
+        GET_CONFIG(GetConfigCommand::new),
+        REMOVE_WATCHES(RemoveWatchesCommand::new),
+        GET_EPHEMERALS(GetEphemeralsCommand::new),
+        GET_ALL_CHILDREN_NUMBER(GetAllChildrenNumberCommand::new),
+        VERSION(VersionCommand::new),
+        ADD_WATCH(AddWatchCommand::new);
+
+        private Supplier<? extends CliCommand> instantiator;
+
+        private CliCommand getInstance() {
+            return instantiator.get();
+        }
+
+        Command(Supplier<? extends CliCommand> instantiator) {
+            this.instantiator = instantiator;
+        }
+    }
+
+    /**
+     * Creates a new {@link CliCommand} instance.
+     * @param command the {@link Command} to create a new instance of
+     * @return the new {@code CliCommand} instance
+     */
+    public static CliCommand getInstance (Command command) {
+        return command.getInstance();
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
new file mode 100644
index 00000000000..a118399d520
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import static org.junit.Assert.assertTrue;
+import org.junit.Test;
+
+/**
+ * Unit test for {@link CommandFactory}.
+ */
+public class CommandFactoryTest {
+
+    /**
+     * Verify that the {@code CommandFactory} can create a command instance.
+     */
+    @Test
+    public void testCommandCreation() {
+        CliCommand cliCommand =
+                CommandFactory.getInstance(CommandFactory.Command.CREATE);
+        assertTrue(cliCommand instanceof CreateCommand);
+    }
+}

From a548253408384d9e943b151c942d795017dca70c Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Date: Tue, 7 Apr 2020 09:07:50 +0200
Subject: [PATCH 011/591] ZOOKEEPER-3769: handling malformed Leader Election
 notification messages

Using ZooKeeper with JDK 12.0.2 on CentOS 7 when the current leader is killed, we saw a few times that some partial Leader Election notification (vote) messages were delivered to the other ZooKeeper servers. The malformed / partial messages are causing different exceptions in the WorkerReceiver thread of FastLeaderElection which were not handled before. This was leading to the death of the WorkerReceiver thread, which caused that the given ZooKeeper Server was unable to receive leader election messages anymore and was not able to re-join to any quorum until it got restarted.

In the proposed fix I created unit tests to simulate certain error cases with regards to partial leader election messages, and fixed the error handling in FastLeaderElection.

Author: Mate Szalay-Beko <szalay.beko.mate@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1300 from symat/ZOOKEEPER-3769-master
---
 .../server/quorum/FastLeaderElection.java     | 115 ++++----
 .../FLEMalformedNotificationMessageTest.java  | 249 ++++++++++++++++++
 2 files changed, 313 insertions(+), 51 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 3ab10073f4d..967adf05a19 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import java.io.IOException;
+import java.nio.BufferUnderflowException;
 import java.nio.ByteBuffer;
 import java.util.HashMap;
 import java.util.Map;
@@ -237,19 +238,21 @@ public void run() {
                             continue;
                         }
 
+                        final int capacity = response.buffer.capacity();
+
                         // The current protocol and two previous generations all send at least 28 bytes
-                        if (response.buffer.capacity() < 28) {
-                            LOG.error("Got a short response: {}", response.buffer.capacity());
+                        if (capacity < 28) {
+                            LOG.error("Got a short response from server {}: {}", response.sid, capacity);
                             continue;
                         }
 
                         // this is the backwardCompatibility mode in place before ZK-107
                         // It is for a version of the protocol in which we didn't send peer epoch
                         // With peer epoch and version the message became 40 bytes
-                        boolean backCompatibility28 = (response.buffer.capacity() == 28);
+                        boolean backCompatibility28 = (capacity == 28);
 
                         // this is the backwardCompatibility mode for no version information
-                        boolean backCompatibility40 = (response.buffer.capacity() == 40);
+                        boolean backCompatibility40 = (capacity == 40);
 
                         response.buffer.clear();
 
@@ -263,64 +266,74 @@ public void run() {
                         long rpeerepoch;
 
                         int version = 0x0;
-                        if (!backCompatibility28) {
-                            rpeerepoch = response.buffer.getLong();
-                            if (!backCompatibility40) {
-                                /*
-                                 * Version added in 3.4.6
-                                 */
+                        QuorumVerifier rqv = null;
 
-                                version = response.buffer.getInt();
+                        try {
+                            if (!backCompatibility28) {
+                                rpeerepoch = response.buffer.getLong();
+                                if (!backCompatibility40) {
+                                    /*
+                                     * Version added in 3.4.6
+                                     */
+
+                                    version = response.buffer.getInt();
+                                } else {
+                                    LOG.info("Backward compatibility mode (36 bits), server id: {}", response.sid);
+                                }
                             } else {
-                                LOG.info("Backward compatibility mode (36 bits), server id: {}", response.sid);
+                                LOG.info("Backward compatibility mode (28 bits), server id: {}", response.sid);
+                                rpeerepoch = ZxidUtils.getEpochFromZxid(rzxid);
                             }
-                        } else {
-                            LOG.info("Backward compatibility mode (28 bits), server id: {}", response.sid);
-                            rpeerepoch = ZxidUtils.getEpochFromZxid(rzxid);
-                        }
 
-                        QuorumVerifier rqv = null;
+                            // check if we have a version that includes config. If so extract config info from message.
+                            if (version > 0x1) {
+                                int configLength = response.buffer.getInt();
+
+                                // we want to avoid errors caused by the allocation of a byte array with negative length
+                                // (causing NegativeArraySizeException) or huge length (causing e.g. OutOfMemoryError)
+                                if (configLength < 0 || configLength > capacity) {
+                                    throw new IOException(String.format("Invalid configLength in notification message! sid=%d, capacity=%d, version=%d, configLength=%d",
+                                                                        response.sid, capacity, version, configLength));
+                                }
 
-                        // check if we have a version that includes config. If so extract config info from message.
-                        if (version > 0x1) {
-                            int configLength = response.buffer.getInt();
-                            byte[] b = new byte[configLength];
-
-                            response.buffer.get(b);
-
-                            synchronized (self) {
-                                try {
-                                    rqv = self.configFromString(new String(b));
-                                    QuorumVerifier curQV = self.getQuorumVerifier();
-                                    if (rqv.getVersion() > curQV.getVersion()) {
-                                        LOG.info("{} Received version: {} my version: {}",
-                                                 self.getId(),
-                                                 Long.toHexString(rqv.getVersion()),
-                                                 Long.toHexString(self.getQuorumVerifier().getVersion()));
-                                        if (self.getPeerState() == ServerState.LOOKING) {
-                                            LOG.debug("Invoking processReconfig(), state: {}", self.getServerState());
-                                            self.processReconfig(rqv, null, null, false);
-                                            if (!rqv.equals(curQV)) {
-                                                LOG.info("restarting leader election");
-                                                self.shuttingDownLE = true;
-                                                self.getElectionAlg().shutdown();
-
-                                                break;
+                                byte[] b = new byte[configLength];
+                                response.buffer.get(b);
+
+                                synchronized (self) {
+                                    try {
+                                        rqv = self.configFromString(new String(b));
+                                        QuorumVerifier curQV = self.getQuorumVerifier();
+                                        if (rqv.getVersion() > curQV.getVersion()) {
+                                            LOG.info("{} Received version: {} my version: {}",
+                                                     self.getId(),
+                                                     Long.toHexString(rqv.getVersion()),
+                                                     Long.toHexString(self.getQuorumVerifier().getVersion()));
+                                            if (self.getPeerState() == ServerState.LOOKING) {
+                                                LOG.debug("Invoking processReconfig(), state: {}", self.getServerState());
+                                                self.processReconfig(rqv, null, null, false);
+                                                if (!rqv.equals(curQV)) {
+                                                    LOG.info("restarting leader election");
+                                                    self.shuttingDownLE = true;
+                                                    self.getElectionAlg().shutdown();
+
+                                                    break;
+                                                }
+                                            } else {
+                                                LOG.debug("Skip processReconfig(), state: {}", self.getServerState());
                                             }
-                                        } else {
-                                            LOG.debug("Skip processReconfig(), state: {}", self.getServerState());
                                         }
+                                    } catch (IOException | ConfigException e) {
+                                        LOG.error("Something went wrong while processing config received from {}", response.sid);
                                     }
-                                } catch (IOException e) {
-                                    LOG.error("Something went wrong while processing config received from {}", response.sid);
-                                } catch (ConfigException e) {
-                                    LOG.error("Something went wrong while processing config received from {}", response.sid);
                                 }
+                            } else {
+                                LOG.info("Backward compatibility mode (before reconfig), server id: {}", response.sid);
                             }
-                        } else {
-                            LOG.info("Backward compatibility mode (before reconfig), server id: {}", response.sid);
+                        } catch (BufferUnderflowException | IOException e) {
+                            LOG.warn("Skipping the processing of a partial / malformed response message sent by sid={} (message length: {})",
+                                     response.sid, capacity, e);
+                            continue;
                         }
-
                         /*
                          * If it is from a non-voting server (such as an observer or
                          * a non-voting follower), respond right away.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
new file mode 100644
index 00000000000..8465c9ee55d
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
@@ -0,0 +1,249 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.nio.ByteBuffer;
+import java.util.HashMap;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class FLEMalformedNotificationMessageTest extends ZKTestCase {
+    private static final Logger LOG = LoggerFactory.getLogger(FLEMalformedNotificationMessageTest.class);
+    private static final byte[] CONFIG_BYTES = "my very invalid config string".getBytes();
+    private static final int CONFIG_BYTES_LENGTH = CONFIG_BYTES.length;
+
+    int count;
+    HashMap<Long, QuorumServer> peers;
+    File tmpdir[];
+    int port[];
+
+    QuorumCnxManager mockCnxManager;
+    FLETestUtils.LEThread leaderElectionThread;
+    QuorumPeer peerRunningLeaderElection;
+
+
+    @Before
+    public void setUp() throws Exception {
+        count = 3;
+
+        peers = new HashMap<>(count);
+        tmpdir = new File[count];
+        port = new int[count];
+
+        LOG.info("FLEMalformedNotificationMessageTest: {}, {}", getTestName(), count);
+        for (int i = 0; i < count; i++) {
+            int clientport = PortAssignment.unique();
+            peers.put((long) i,
+                      new QuorumServer(i,
+                                       new InetSocketAddress(clientport),
+                                       new InetSocketAddress(PortAssignment.unique())));
+            tmpdir[i] = ClientBase.createTmpDir();
+            port[i] = clientport;
+        }
+
+        /*
+         * Start server 0
+         */
+        peerRunningLeaderElection = new QuorumPeer(peers, tmpdir[0], tmpdir[0], port[0], 3, 0, 1000, 2, 2, 2);
+        peerRunningLeaderElection.startLeaderElection();
+        leaderElectionThread = new FLETestUtils.LEThread(peerRunningLeaderElection, 0);
+        leaderElectionThread.start();
+    }
+
+
+    @After
+    public void tearDown() throws Exception {
+        peerRunningLeaderElection.shutdown();
+        mockCnxManager.halt();
+    }
+
+
+    @Test
+    public void testTooShortPartialNotificationMessage() throws Exception {
+
+        /*
+         * Start mock server 1, send a message too short to be compatible with any protocol version
+         * This simulates the case when only some parts of the whole message is received.
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[12];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(0);                              // leader
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            Assert.fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithNegativeConfigLength() throws Exception {
+
+        /*
+         * Start mock server 1, send a message with negative configLength field
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[48];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(0);                              // leader
+        requestBuffer.putLong(0);                              // zxid
+        requestBuffer.putLong(0);                              // electionEpoch
+        requestBuffer.putLong(0);                              // epoch
+        requestBuffer.putInt(FastLeaderElection.Notification.CURRENTVERSION);   // version
+        requestBuffer.putInt(-123);                            // configData.length
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            Assert.fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithInvalidConfigLength() throws Exception {
+
+        /*
+         * Start mock server 1, send a message with an invalid configLength field
+         * (instead of sending CONFIG_BYTES_LENGTH, we send 10000)
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[48 + CONFIG_BYTES_LENGTH];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(0);                              // leader
+        requestBuffer.putLong(0);                              // zxid
+        requestBuffer.putLong(0);                              // electionEpoch
+        requestBuffer.putLong(0);                              // epoch
+        requestBuffer.putInt(FastLeaderElection.Notification.CURRENTVERSION);   // version
+        requestBuffer.putInt(10000);                           // configData.length
+        requestBuffer.put(CONFIG_BYTES);                       // configData
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            Assert.fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithInvalidConfig() throws Exception {
+
+        /*
+         * Start mock server 1, send a message with an invalid config field
+         * (the receiver should not be able to parse the config part of the message)
+         */
+        startMockServer(1);
+        ByteBuffer requestBuffer = FastLeaderElection.buildMsg(ServerState.LOOKING.ordinal(), 1, 0, 0, 0, CONFIG_BYTES);
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            Assert.fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithBadProtocol() throws Exception {
+
+        /*
+         * Start mock server 1, send an invalid 30 bytes long message
+         * (the receiver should not be able to parse the message and should skip it)
+         * This simulates the case when only some parts of the whole message is received.
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[30];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(1);                              // leader
+        requestBuffer.putLong(0);                              // zxid
+        requestBuffer.putLong(0);                              // electionEpoch
+        requestBuffer.putShort((short) 0);                      // this is the first two bytes of a proper
+                                                               // 8 bytes Long we should send here
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            Assert.fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    void startMockServer(int sid) throws IOException {
+        QuorumPeer peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 1000, 2, 2, 2);
+        mockCnxManager = peer.createCnxnManager();
+        mockCnxManager.listener.start();
+    }
+
+
+    void sendValidNotifications(int fromSid, int toSid) throws InterruptedException {
+        mockCnxManager.toSend((long) toSid, FLETestUtils.createMsg(ServerState.LOOKING.ordinal(), fromSid, 0, 0));
+        mockCnxManager.recvQueue.take();
+        mockCnxManager.toSend((long) toSid, FLETestUtils.createMsg(ServerState.FOLLOWING.ordinal(), toSid, 0, 0));
+    }
+
+}

From d142e5a86993971a56bb2081020c085ed9ca68d7 Mon Sep 17 00:00:00 2001
From: Norbert Kalmar <nkalmar@apache.org>
Date: Tue, 7 Apr 2020 15:40:39 +0200
Subject: [PATCH 012/591] ZOOKEEPER-3780: restore Version.getRevision() to be
 bacward compatible

Added a warning in https://cwiki.apache.org/confluence/display/ZOOKEEPER/Upgrade+FAQ

Author: Norbert Kalmar <nkalmar@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1304 from nkalmar/branch-3.6

(cherry picked from commit 5062c39cb028115a9b79f9b28d6837065e70bf40)
Signed-off-by: Enrico Olivelli <eolivelli@apache.org>
---
 .../src/main/java/org/apache/zookeeper/Version.java  | 12 ++++++++++++
 .../org/apache/zookeeper/version/util/VerGen.java    |  1 +
 2 files changed, 13 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java
index 4029c60ede3..4fc0507a2fc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java
@@ -24,6 +24,18 @@
 
 public class Version implements org.apache.zookeeper.version.Info {
 
+    /*
+     * Since the SVN to Git port this field doesn't return the revision anymore
+     * In version 3.5.6, 3.5.7 and 3.6.0 this function is removed by accident.
+     * From version 3.5.8+ and 3.6.1+ it is restored for backward compatibility, but will be removed later
+     * @deprecated deprecated in 3.5.5, use @see {@link #getRevisionHash()} instead
+     * @return the default value -1
+     */
+    @Deprecated
+    public static int getRevision() {
+        return REVISION;
+    }
+
     public static String getRevisionHash() {
         return REVISION_HASH;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java b/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
index 25bffd72866..9bb699f090d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
@@ -84,6 +84,7 @@ public static void generateFile(File outputDir, Version version, String rev, Str
             if (rev.equals("-1")) {
                 System.out.println("Unknown REVISION number, using " + rev);
             }
+            w.write("    int REVISION=-1; //@deprecated, please use REVISION_HASH\n");
             w.write("    String REVISION_HASH=\"" + rev + "\";\n");
             w.write("    String BUILD_DATE=\"" + buildDate + "\";\n");
             w.write("}\n");

From a8fb880218410ec3b31374d957e5a0bd6c8cdf28 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Tue, 7 Apr 2020 17:00:35 +0200
Subject: [PATCH 013/591] ZOOKEEPER-3785: Make sources buildable with JDK14

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <szalay.beko.mate@gmail.com>, TisunKun <wander4096@gmail.com>

Closes #1308 from eolivelli/fix/jdk14
---
 .../src/main/java/org/apache/jute/compiler/JRecord.java          | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index f53399add02..7c73dedf9c9 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -434,6 +434,7 @@ public void genJavaCode(File outputDirectory) throws IOException {
             jj.write("\n");
             jj.write("package " + getJavaPackage() + ";\n\n");
             jj.write("import org.apache.jute.*;\n");
+            jj.write("import org.apache.jute.Record; // JDK14 needs explicit import due to clash with java.lang.Record\n");
             jj.write("import org.apache.yetus.audience.InterfaceAudience;\n");
             jj.write("@InterfaceAudience.Public\n");
             jj.write("public class " + getName() + " implements Record {\n");

From 09cb43554fb41eb651ebfb948f9a4230c2c4dfa2 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Wed, 8 Apr 2020 14:04:51 +0200
Subject: [PATCH 014/591] ZOOKEEPER-3782: Replace filter() with list
 comprehension for returning list

After Py3, `filter` return a `filter object` instead of `list object`, which causes

```
Traceback (most recent call last):
  File "zk-merge-pr.py", line 533, in <module>
    main()
  File "zk-merge-pr.py", line 519, in main
    resolve_jira_issues(commit_title, merged_refs, jira_comment)
  File "zk-merge-pr.py", line 329, in resolve_jira_issues
    resolve_jira_issue(merge_branches, comment, jira_id)
  File "zk-merge-pr.py", line 312, in resolve_jira_issue
    jira_fix_versions = [get_version_json(v) for v in fix_versions]
  File "zk-merge-pr.py", line 312, in <listcomp>
    jira_fix_versions = [get_version_json(v) for v in fix_versions]
  File "zk-merge-pr.py", line 310, in get_version_json
    return filter(lambda v: v.name == version_str, versions)[0].raw
TypeError: 'filter' object is not subscriptable
```

We can replace filter with list comprehension to fix it.

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1303 from TisonKun/ZOOKEEPER-3782
---
 zk-merge-pr.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/zk-merge-pr.py b/zk-merge-pr.py
index dc5549d9dfa..0118cba2c64 100644
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -307,12 +307,12 @@ def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
     fix_versions = fix_versions.replace(" ", "").split(",")
 
     def get_version_json(version_str):
-        return filter(lambda v: v.name == version_str, versions)[0].raw
+        return [v for v in versions if v.name == version_str][0].raw
 
     jira_fix_versions = [get_version_json(v) for v in fix_versions]
 
-    resolve = filter(lambda a: a['name'] == "Resolve Issue", asf_jira.transitions(jira_id))[0]
-    resolution = filter(lambda r: r.raw['name'] == "Fixed", asf_jira.resolutions())[0]
+    resolve = [a for a in asf_jira.transitions(jira_id) if a['name'] == "Resolve Issue"][0]
+    resolution = [r for r in asf_jira.resolutions() if r.raw['name'] == "Fixed"][0]
     asf_jira.transition_issue(
         jira_id, resolve["id"], fixVersions = jira_fix_versions,
         comment = comment, resolution = {'id': resolution.raw['id']})

From f3c969718f9f8a590474388636510cf5c097b2aa Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Wed, 8 Apr 2020 19:18:32 +0200
Subject: [PATCH 015/591] ZOOKEEPER-3714: zkperl: Add (Cyrus) SASL
 authentication support to Perl client

This patch allows one to access the C client Cyrus SASL support (ZOOKEEPER-1112) from the Perl binding by passing a `--with-sasl2` flag (and, optionally, header and lib locations):

        perl Makefile.PL \
            --with-sasl2 \
            --sasl2-include=/path/to/sasl2/include \
            --sasl2-lib=/path/to/sasl2/lib

When enabled, `Net::ZooKeeper->new(...)` admits a new key, `sasl_options`, which can be used to automatically authenticate with the server during connections (including reconnects).

Some of the preparatory work for this contribution, which is available in the other commits, may also fix [ZOOKEEPER-3303](https://issues.apache.org/jira/browse/ZOOKEEPER-3303), which is about compilation issues.  The resulting patch builds with GCC 8.3.0 in a (moderately) "hardened" environment; it also passes all enabled tests.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Norbert Kalmar <nkalmar@apache.org>

Closes #1243 from ztzg/ZOOKEEPER-3714-zkperl-sasl-support
---
 .../zookeeper-contrib-zkperl/Makefile.PL      |  36 ++++--
 .../zookeeper-contrib-zkperl/README           |  21 ++++
 .../zookeeper-contrib-zkperl/ZooKeeper.pm     |  30 ++++-
 .../zookeeper-contrib-zkperl/ZooKeeper.xs     |  70 ++++++++++-
 .../zookeeper-contrib-zkperl/t/10_invalid.t   |   4 +-
 .../zookeeper-contrib-zkperl/t/30_connect.t   |   8 ++
 .../zookeeper-contrib-zkperl/t/35_log.t       |   7 +-
 .../zookeeper-contrib-zkperl/t/50_access.t    |  10 +-
 .../zookeeper-contrib-zkperl/t/70_sasl.t      | 110 ++++++++++++++++++
 9 files changed, 272 insertions(+), 24 deletions(-)
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t

diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL b/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL
index 9a0996dddcf..0c7486f9e29 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL
@@ -28,21 +28,25 @@ my $ZOO_REQUIRED_VERSION = qr{^$ZOO_MAJOR_VERSION\.\d+.\d+$}ismx;
 my @zk_inc_paths;
 my @zk_lib_paths;
 
+my $with_sasl2 = 0;
+my @sasl2_inc_paths;
+my @sasl2_lib_paths;
+
 GetOptions(
     'zookeeper-include=s' => \@zk_inc_paths,
-    'zookeeper-lib=s' => \@zk_lib_paths
+    'zookeeper-lib=s' => \@zk_lib_paths,
+    'with-sasl2!' => \$with_sasl2,
+    'sasl2-include=s' => \@sasl2_inc_paths,
+    'sasl2-lib=s' => \@sasl2_lib_paths
 );
 
-my $zk_inc_paths = join(' ', map("-I$_", @zk_inc_paths));
-my $zk_lib_paths = join(' ', map("-L$_", @zk_lib_paths));
-
-$zk_inc_paths .= ' ' unless ($zk_inc_paths eq '');
-$zk_lib_paths .= ' ' unless ($zk_lib_paths eq '');
+my $zk_inc = (join(' ', map("-I$_", @zk_inc_paths)) . ' -I.');
+my $zk_libs = (join(' ', map("-L$_", @zk_lib_paths)) . ' -lzookeeper_mt');
 
 my $cc = $Config{'cc'};
 my $check_file = 'build/check_zk_version';
 
-my $check_out = qx($cc $zk_inc_paths $zk_lib_paths -I. -o $check_file $check_file.c 2>&1);
+my $check_out = qx($cc $zk_inc -o $check_file $check_file.c $zk_libs 2>&1);
 
 if ($?) {
     if ($check_out =~ /zookeeper_version\.h/) {
@@ -63,11 +67,21 @@ elsif ($zk_ver !~ $ZOO_REQUIRED_VERSION) {
   warn "Net::ZooKeeper requires ZooKeeper 3.x, found $zk_ver!";
 }
 
+my @inc = ($zk_inc);
+my @libs = ($zk_libs);
+my %mmopt = ();
+
+if ($with_sasl2) {
+    push(@inc, join(' ', map("-I$_", @sasl2_inc_paths)));
+    push(@libs, join(' ', map("-L$_", @sasl2_lib_paths)) . ' -lsasl2');
+    $mmopt{DEFINE} = '-DHAVE_CYRUS_SASL_H';
+}
+
 WriteMakefile(
-    'INC'          => "$zk_inc_paths-I.",
-    'LIBS'         => [ "$zk_lib_paths-lzookeeper_mt" ],
+    'INC'          => join(' ', @inc),
+    'LIBS'         => \@libs,
     'NAME'         => 'Net::ZooKeeper',
     'VERSION_FROM' => 'ZooKeeper.pm',
-    'clean'        => { 'FILES' => 'build/check_zk_version.o' }
+    'clean'        => { 'FILES' => 'build/check_zk_version.o' },
+    %mmopt,
 );
-
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/README b/zookeeper-contrib/zookeeper-contrib-zkperl/README
index bbe2a0d8f3b..ac13481529c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/README
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/README
@@ -32,6 +32,15 @@ ZooKeeper C include files.
 The path supplied to the --zookeeper-lib option should identify
 the directory that contains the libzookeeper_mt library.
 
+If the C client supports Cyrus SASL (ZOOKEEPER-1112), it can also be
+enabled in the Perl binding by passing a --with-sasl2 flag (and,
+optionally, non-standard locations):
+
+    perl Makefile.PL \
+        --with-sasl2 \
+        --sasl2-include=/path/to/sasl2/include \
+        --sasl2-lib=/path/to/sasl2/lib
+
 When running "make test", if no ZK_TEST_HOSTS environment
 variable is set, many tests will be skipped because no connection
 to a ZooKeeper server is available.  To execute these tests,
@@ -44,6 +53,18 @@ The tests expect to have full read/write/create/delete/admin
 ZooKeeper permissions under this path.  If no ZK_TEST_PATH
 variable is defined, the root ZooKeeper path ("/") is used.
 
+The ZK_TEST_SASL_OPTIONS environment variable, if defined, provides a
+JSON-encoded map of SASL authentication options, enabling SASL tests.
+E.g.,
+
+    {
+       "host": "zk-sasl-md5",
+       "mechlist": "DIGEST-MD5",
+       "service": "zookeeper",
+       "user": "bob",
+       "password_file": "bob.secret"
+    }
+
 DEPENDENCIES
 
 Version 3.1.1 of ZooKeeper is required at a minimum.
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm
index 507f0298d16..b17c9704c17 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm
@@ -688,7 +688,8 @@ The following methods are defined for the Net::ZooKeeper class.
   $zkh = Net::ZooKeeper->new('host1:7000,host2:7000');
   $zkh = Net::ZooKeeper->new('host1:7000,host2:7000',
                              'session_timeout' => $session_timeout,
-                             'session_id' => $session_id);
+                             'session_id' => $session_id,
+                             'sasl_options' => $sasl_options);
 
 Creates a new Net::ZooKeeper handle object and attempts to
 connect to the one of the servers of the given ZooKeeper
@@ -725,6 +726,33 @@ initial connection request; again, the actual timeout period to
 which the server agrees will be available subsequently as the
 value of the C<session_timeout> attribute.
 
+If a C<'sasl_options'> option is provided, it is used to automatically
+SASL-authenticate with the server during connections (including
+reconnects).  Here is a brief description of the recognized keys;
+please refer to the C client documentation for details:
+
+=over 5
+
+=item service => VALUE
+
+=item host => VALUE
+
+=item mechlist => VALUE
+
+These map to the corresponding fields of C<zoo_sasl_params_t> from the
+library.
+
+=item user => VALUE
+
+=item realm => VALUE
+
+=item password_file => VALUE
+
+These map to the corresponding parameters of
+C<zoo_sasl_make_basic_callbacks> from the library.
+
+=back
+
 Upon successful connection (i.e., after the success of a method
 which requires communication with the server), the C<session_id>
 attribute will hold a short binary string which represents the
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs
index 4b6067b1024..1fd178aba60 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs
@@ -28,7 +28,9 @@
 #include <limits.h>                     /* CHAR_BIT */
 #include <sys/time.h>                   /* gettimeofday() */
 
+#define THREADED
 #include <zookeeper/zookeeper.h>
+#undef THREADED
 
 #include "build/check_zk_version.h"
 
@@ -758,6 +760,13 @@ zk_new(package, hosts, ...)
         char *hosts
     PREINIT:
         int recv_timeout = DEFAULT_RECV_TIMEOUT_MSEC;
+#ifdef HAVE_CYRUS_SASL_H
+        zoo_sasl_params_t sasl_params = { 0 };
+        const char *sasl_user = NULL;
+        const char *sasl_realm = NULL;
+        const char *sasl_password_file = NULL;
+        int use_sasl = 0;
+#endif /* HAVE_CYRUS_SASL_H */
         const clientid_t *client_id = NULL;
         zk_t *zk;
         zk_handle_t *handle;
@@ -792,12 +801,61 @@ zk_new(package, hosts, ...)
                     Perl_croak(aTHX_ "invalid session ID");
                 }
             }
+#ifdef HAVE_CYRUS_SASL_H
+            else if (strcaseEQ(key, "sasl_options")) {
+                SV *hash_sv = ST(i + 1);
+                HV *hash;
+                char *key;
+                I32 key_length;
+                SV *value;
+
+                if (!SvROK(hash_sv) || SvTYPE(SvRV(hash_sv)) != SVt_PVHV) {
+                    Perl_croak(aTHX_ "sasl_options requires a hash reference");
+                }
+
+                hash = (HV *)SvRV(hash_sv);
+                hv_iterinit(hash);
+                while ((value = hv_iternextsv(hash, &key, &key_length))) {
+                    if (strcaseEQ(key, "service")) {
+                        sasl_params.service = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "host")) {
+                        sasl_params.host = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "mechlist")) {
+                        sasl_params.mechlist = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "user")) {
+                        sasl_user = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "realm")) {
+                        sasl_realm = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "password_file")) {
+                        sasl_password_file = SvPV_nolen(value);
+                    }
+                }
+                use_sasl = 1;
+            }
+#endif /* HAVE_CYRUS_SASL_H */
         }
 
         Newxz(zk, 1, zk_t);
+#ifdef HAVE_CYRUS_SASL_H
+        if (use_sasl) {
+            /* KLUDGE: Leaks a reference count.  Authen::SASL::XS does
+               the same, though.  TODO(ddiederen): Fix. */
+            sasl_client_init(NULL);
+            sasl_params.callbacks = zoo_sasl_make_basic_callbacks(sasl_user,
+                sasl_realm, sasl_password_file);
+        }
 
+        zk->handle = zookeeper_init_sasl(hosts, NULL, recv_timeout,
+            client_id, NULL, 0, NULL, use_sasl ? &sasl_params : NULL);
+#else
         zk->handle = zookeeper_init(hosts, NULL, recv_timeout,
-                                    client_id, NULL, 0);
+            client_id, NULL, 0);
+#endif /* HAVE_CYRUS_SASL_H */
 
         if (!zk->handle) {
             Safefree(zk);
@@ -1203,7 +1261,7 @@ zk_add_auth(zkh, scheme, cert)
         zk->last_errno = 0;
 
         if (cert_len > PERL_INT_MAX) {
-            Perl_croak(aTHX_ "invalid certificate length: %u", cert_len);
+            Perl_croak(aTHX_ "invalid certificate length: %zu", cert_len);
         }
 
         watch = _zk_create_watch(aTHX);
@@ -1283,7 +1341,7 @@ zk_create(zkh, path, buf, ...)
         }
 
         if (buf_len > PERL_INT_MAX) {
-            Perl_croak(aTHX_ "invalid data length: %u", buf_len);
+            Perl_croak(aTHX_ "invalid data length: %zu", buf_len);
         }
 
         path_buf_len = zk->path_buf_len;
@@ -1318,7 +1376,7 @@ zk_create(zkh, path, buf, ...)
                 err = _zk_fill_acl(aTHX_ acl_arr, &acl);
 
                 if (err) {
-                    Perl_croak(aTHX_ err);
+                    Perl_croak(aTHX_ "%s", err);
                 }
             }
         }
@@ -1757,7 +1815,7 @@ zk_set(zkh, path, buf, ...)
         }
 
         if (buf_len > PERL_INT_MAX) {
-            Perl_croak(aTHX_ "invalid data length: %u", buf_len);
+            Perl_croak(aTHX_ "invalid data length: %zu", buf_len);
         }
 
         for (i = 3; i < items; i += 2) {
@@ -1920,7 +1978,7 @@ zk_set_acl(zkh, path, acl_arr, ...)
         err = _zk_fill_acl(aTHX_ acl_arr, &acl);
 
         if (err) {
-            Perl_croak(aTHX_ err);
+            Perl_croak(aTHX_ "%s", err);
         }
 
         for (i = 3; i < items; i += 2) {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t
index 5e080b64c7d..c1a118e008c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t
@@ -527,13 +527,13 @@ like($@, qr/Usage: Net::ZooKeeper::set_acl\(zkh, path, acl_arr, \.\.\.\)/,
 eval {
     $zkh->set_acl($node_path, 'foo');
 };
-like($@, qr/acl_arr is not an array reference/,
+like($@, qr/acl_arr is not an array reference/i,
      'set_acl(): invalid ACL array reference');
 
 eval {
     $zkh->set_acl($node_path, {});
 };
-like($@, qr/acl_arr is not an array reference/,
+like($@, qr/acl_arr is not an array reference/i,
      'set_acl(): invalid ACL array reference to hash');
 
 eval {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t
index c2b68bb4e5f..4745e427d14 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t
@@ -176,6 +176,13 @@ SKIP: {
     ## NOTE: to test re-connections with saved session IDs we create a second
     ## connection with the same ID while the first is still active;
     ## this is bad practice in normal usage
+    ##
+    ## Test disabled because it breaks with current ZooKeeper servers:
+    ## $zkh1's connection gets closed as soon as $zkh2 connects, which
+    ## causes it to reconnect, which kills $zkh2's connection, etc.
+    ## TODO: figure out a way to test this.
+    SKIP: {
+    skip 'does not work with current ZK servers', 4;
 
     my $zkh2 = Net::ZooKeeper->new($hosts,
                                   'session_id' => $session_id1,
@@ -198,5 +205,6 @@ SKIP: {
             and $session_id2 eq $session_id1),
            'FETCH(): reconnect with session ID');
     }
+    }
 }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t
index 92821afc1f3..cb7f7dbc538 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t
@@ -31,7 +31,7 @@ my($hosts, $root_path, $node_path) = zk_test_setup(0);
 
 my $zkh = Net::ZooKeeper->new($hosts);
 
-Net::ZooKeeper::set_log_level(ZOO_LOG_LEVEL_INFO);
+Net::ZooKeeper::set_log_level(ZOO_LOG_LEVEL_DEBUG);
 
 SKIP: {
     skip 'no valid handle', 2 unless (defined($zkh));
@@ -45,6 +45,7 @@ SKIP: {
 
                 my $old_select = select(STDERR);
                 $| = 1;
+                $/ = undef;     # slurp mode.
                 select($old_select);
             }
             else {
@@ -63,7 +64,7 @@ SKIP: {
             skip 'no seek on stderr', 1 unless (seek(STDERR, 0, 0));
 
             my $log = <STDERR>;
-            like($log, qr/ZOO_/,
+            like($log, qr/ZOO_.*exists/,
                  'exists(): generated log message');
         }
 
@@ -75,7 +76,7 @@ SKIP: {
             skip 'no seek on stderr', 1 unless (seek(STDERR, 0, 0));
 
             my $log = <STDERR>;
-            like($log, qr/ZOO_/,
+            like($log, qr/ZOO_.*close/,
                  'DESTROY(): generated log message');
         }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t
index ef61ed6688f..71eb17c883b 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t
@@ -18,6 +18,7 @@
 
 use File::Spec;
 use Test::More tests => 40;
+use Storable qw(dclone);
 
 BEGIN { use_ok('Net::ZooKeeper', qw(:all)) };
 
@@ -163,9 +164,16 @@ SKIP: {
         $! eq ''),
        'get_acl(): undef returned for non-extant node');
 
+    # The test is not running as ADMIN, which means that the server
+    # returns "redacted" ACLs (see ZOOKEEPER-1392 and OpCode.getACL in
+    # FinalRequestProcessor).  We must do the same for the comparison
+    # to succeed.
+    my $redacted_digest_acl = dclone($digest_acl);
+    $redacted_digest_acl->[1]->{id} =~ s/:.*/:x/;
+
     @acl = ('abc');
     @acl = $zkh->get_acl($acl_node_path);
-    is_deeply(\@acl, $digest_acl,
+    is_deeply(\@acl, $redacted_digest_acl,
               'get_acl(): retrieved digest ACL');
 
     my $stat = $zkh->stat();
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t
new file mode 100644
index 00000000000..9de379a7a4d
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t
@@ -0,0 +1,110 @@
+# Net::ZooKeeper - Perl extension for Apache ZooKeeper
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+use File::Spec;
+use Test::More tests => 7;
+use JSON::PP qw(decode_json);
+
+BEGIN { use_ok('Net::ZooKeeper', qw(:all)) };
+
+
+my $test_dir;
+(undef, $test_dir, undef) = File::Spec->splitpath($0);
+require File::Spec->catfile($test_dir, 'util.pl');
+
+my($hosts, $root_path, $node_path) = zk_test_setup(0);
+
+my $sasl_options = $ENV{'ZK_TEST_SASL_OPTIONS'};
+if (defined($sasl_options)) {
+    $sasl_options = decode_json($sasl_options);
+}
+
+SKIP: {
+    skip 'no sasl_options', 6 unless defined($sasl_options);
+
+    my $zkh = Net::ZooKeeper->new($hosts,
+        'sasl_options' => $sasl_options);
+
+    my $path = $zkh->create($node_path, 'foo',
+                            'acl' => ZOO_OPEN_ACL_UNSAFE) if (defined($zkh));
+
+    skip 'no connection to ZooKeeper', 36 unless
+        (defined($path) and $path eq $node_path);
+
+    ## _zk_acl_constant()
+
+    my $acl_node_path = "$node_path/a1";
+
+    my $sasl_acl = [
+        {
+            'perms'  => ZOO_PERM_READ,
+            'scheme' => 'world',
+            'id'     => 'anyone'
+        },
+        {
+            'perms'  => ZOO_PERM_ALL,
+            'scheme' => 'sasl',
+            'id'     => $sasl_options->{user}
+        }
+    ];
+
+    $path = $zkh->create($acl_node_path, 'foo', 'acl' => $sasl_acl);
+    is($path, $acl_node_path,
+       'create(): created node with SASL ACL');
+
+
+    ## get_acl()
+
+    @acl = ('abc');
+    @acl = $zkh->get_acl($acl_node_path);
+    is_deeply(\@acl, $sasl_acl,
+              'get_acl(): retrieved SASL ACL');
+
+    SKIP: {
+        my $zkh2 = Net::ZooKeeper->new($hosts);
+
+        my $ret = $zkh->exists($root_path) if (defined($zkh));
+
+        skip 'no connection to ZooKeeper', 1 unless
+            (defined($ret) and $ret);
+
+        my $node = $zkh2->get($acl_node_path);
+        is($node, 'foo',
+           'get(): retrieved node value with world ACL');
+
+        $ret = $zkh2->set($acl_node_path, 'bar');
+        ok((!$ret and $zkh2->get_error() == ZNOAUTH and $! eq ''),
+           'set(): node value unchanged if no auth');
+    }
+
+    my $ret = $zkh->set($acl_node_path, 'bar');
+    ok($ret,
+       'set(): set node with SASL ACL');
+
+    my $node = $zkh->get($acl_node_path);
+    is($node, 'bar',
+       'get(): retrieved new node value with SASL ACL');
+
+    $ret = $zkh->delete($acl_node_path);
+    diag(sprintf('unable to delete node %s: %d, %s',
+                 $acl_node_path, $zkh->get_error(), $!)) unless ($ret);
+
+    $ret = $zkh->delete($node_path);
+    diag(sprintf('unable to delete node %s: %d, %s',
+                 $node_path, $zkh->get_error(), $!)) unless ($ret);
+}

From f9a08032c5cdf6ca4dc4649992436207576fbe9e Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Thu, 9 Apr 2020 10:59:02 +0000
Subject: [PATCH 016/591] ZOOKEEPER-3786: Simplify version generation

Simplify generation of VersionInfoMain.java and Info.java by using
maven-resource-plugin's built-in resource filtering at build time.

This eliminates the need to use VerGen to generate java source files
during the build.

Also make other slight pom improvements:
1. Remove trailing tab character in Ted's name in pom.xml
2. Simplify spotbugs skipping in contrib pom.xml
3. Add m2e configuration for build plugin executions to be ignored by
   Eclipse, for developers (like me) using Eclipse IDE
4. Format build time in a more international-friendly and less ambiguous
   way (year first, then month, then day, using UTC instead of GMT)

Link to issue: https://issues.apache.org/jira/browse/ZOOKEEPER-3786

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1310 from ctubbsii/use-resource-filtering-for-version-info
---
 pom.xml                                       |   2 +-
 zookeeper-contrib/pom.xml                     |  13 +-
 zookeeper-server/pom.xml                      |  55 ++---
 .../org/apache/zookeeper/version/Info.java    |  29 +++
 .../zookeeper/version/VersionInfoMain.java    |  25 +++
 .../apache/zookeeper/version/util/VerGen.java | 202 ------------------
 .../java/org/apache/zookeeper/VerGenTest.java |  71 ------
 7 files changed, 79 insertions(+), 318 deletions(-)
 create mode 100644 zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java
 create mode 100644 zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java
 delete mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
 delete mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java

diff --git a/pom.xml b/pom.xml
index 6fad123737f..79e88df6ca9 100755
--- a/pom.xml
+++ b/pom.xml
@@ -117,7 +117,7 @@
   <developers>
     <developer>
       <id>tdunning</id>
-      <name>Ted Dunning	</name>
+      <name>Ted Dunning</name>
       <email>tdunning@apache.org</email>
       <timezone>-8</timezone>
     </developer>
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index 228a520ed4b..0e2959d3be0 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -49,18 +49,13 @@
     </profile>
   </profiles>
 
+  <properties>
+    <spotbugs.skip>true</spotbugs.skip>
+  </properties>
+
   <build>
     <pluginManagement>
       <plugins>
-        <plugin>
-          <groupId>com.github.spotbugs</groupId>
-          <artifactId>spotbugs-maven-plugin</artifactId>
-          <version>3.1.9</version>
-          <configuration>
-            <!-- No spotbugs for contrib modules -->
-            <skip>true</skip>
-          </configuration>
-        </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-compiler-plugin</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 21c30eae87f..117a77b8ec7 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -166,22 +166,29 @@
 
   <build>
     <plugins>
-      <plugin> <!-- ${maven.build.timestamp} does not support timezone :( -->
+      <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
         <executions>
           <execution>
+            <!-- ${maven.build.timestamp} does not support timezone :( -->
             <id>tbuild-time</id>
             <goals>
               <goal>timestamp-property</goal>
             </goals>
             <configuration>
               <name>build.time</name>
-              <pattern>MM/dd/yyyy HH:mm zz</pattern>
+              <pattern>yyyy-MM-dd HH:mm zz</pattern>
               <locale>en_US</locale>
-              <timeZone>GMT</timeZone>
+              <timeZone>UTC</timeZone>
             </configuration>
           </execution>
+          <execution>
+            <id>parse-version</id>
+            <goals>
+              <goal>parse-version</goal>
+            </goals>
+          </execution>
           <execution>
             <phase>generate-sources</phase>
             <goals>
@@ -197,44 +204,22 @@
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
+        <artifactId>maven-resources-plugin</artifactId>
         <executions>
           <execution>
-            <id>pre-compile-vergen</id>
-            <phase>generate-sources</phase>
-            <configuration>
-              <includes>
-                <include>org/apache/zookeeper/version/**/*.java</include>
-              </includes>
-            </configuration>
+            <id>prepare-filtered-java-source</id>
             <goals>
-              <goal>compile</goal>
+              <goal>copy-resources</goal>
             </goals>
-          </execution>
-        </executions>
-      </plugin>
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>exec-maven-plugin</artifactId>
-        <executions>
-          <execution>
-            <id>generate-version-info</id>
             <phase>generate-sources</phase>
-            <goals>
-              <goal>exec</goal>
-            </goals>
             <configuration>
-              <workingDirectory>${project.basedir}/src/main/java/</workingDirectory>
-              <executable>java</executable>
-              <arguments>
-                <argument>-classpath</argument>
-                <classpath />
-                <argument>org.apache.zookeeper.version.util.VerGen</argument>
-                <argument>${project.version}</argument>
-                <argument>${mvngit.commit.id}</argument>
-                <argument>${build.time}</argument>
-                <argument>${project.basedir}/target/generated-sources/java</argument>
-              </arguments>
+              <outputDirectory>${project.build.directory}/generated-sources/java</outputDirectory>
+              <resources>
+                <resource>
+                  <directory>src/main/java-filtered</directory>
+                  <filtering>true</filtering>
+                </resource>
+              </resources>
             </configuration>
           </execution>
         </executions>
diff --git a/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java
new file mode 100644
index 00000000000..5570eccf800
--- /dev/null
+++ b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.version;
+
+public interface Info {
+    int MAJOR=${parsedVersion.majorVersion};
+    int MINOR=${parsedVersion.minorVersion};
+    int MICRO=${parsedVersion.incrementalVersion};
+    String QUALIFIER="${parsedVersion.qualifier}".isEmpty() ? null : "${parsedVersion.qualifier}";
+    int REVISION=-1; //@deprecated, please use REVISION_HASH
+    String REVISION_HASH="${mvngit.commit.id}";
+    String BUILD_DATE="${build.time}";
+}
diff --git a/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java
new file mode 100644
index 00000000000..b7d0054bd72
--- /dev/null
+++ b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java
@@ -0,0 +1,25 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.version;
+
+public class VersionInfoMain implements org.apache.zookeeper.version.Info {
+    public static void main(String[] args) {
+        System.out.println("Apache ZooKeeper, version ${project.version} ${build.time}");
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java b/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
deleted file mode 100644
index 9bb699f090d..00000000000
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper.version.util;
-
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-import java.io.File;
-import java.io.FileWriter;
-import java.io.IOException;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import org.apache.zookeeper.server.ExitCode;
-
-@SuppressFBWarnings("DM_EXIT")
-public class VerGen {
-
-    private static final String PACKAGE_NAME = "org.apache.zookeeper.version";
-    private static final String VERSION_CLASS_NAME = "VersionInfoMain";
-    private static final String VERSION_INTERFACE_NAME = "Info";
-
-    static void printUsage() {
-        System.out.print("Usage:\tjava  -cp <classpath> org.apache.zookeeper."
-                         + "version.util.VerGen maj.min.micro[-qualifier] rev buildDate outputDirectory");
-        System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-    }
-
-    public static void generateFile(File outputDir, Version version, String rev, String buildDate) {
-        String path = PACKAGE_NAME.replaceAll("\\.", "/");
-        File pkgdir = new File(outputDir, path);
-        if (!pkgdir.exists()) {
-            // create the pkg directory
-            boolean ret = pkgdir.mkdirs();
-            if (!ret) {
-                System.out.println("Cannnot create directory: " + path);
-                System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-            }
-        } else if (!pkgdir.isDirectory()) {
-            // not a directory
-            System.out.println(path + " is not a directory.");
-            System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-        }
-
-        try (FileWriter w = new FileWriter(new File(pkgdir, VERSION_INTERFACE_NAME + ".java"))) {
-            w.write("// Do not edit!\n// File generated by org.apache.zookeeper" + ".version.util.VerGen.\n");
-            w.write("/**\n");
-            w.write("* Licensed to the Apache Software Foundation (ASF) under one\n");
-            w.write("* or more contributor license agreements.  See the NOTICE file\n");
-            w.write("* distributed with this work for additional information\n");
-            w.write("* regarding copyright ownership.  The ASF licenses this file\n");
-            w.write("* to you under the Apache License, Version 2.0 (the\n");
-            w.write("* \"License\"); you may not use this file except in compliance\n");
-            w.write("* with the License.  You may obtain a copy of the License at\n");
-            w.write("*\n");
-            w.write("*     http://www.apache.org/licenses/LICENSE-2.0\n");
-            w.write("*\n");
-            w.write("* Unless required by applicable law or agreed to in writing, software\n");
-            w.write("* distributed under the License is distributed on an \"AS IS\" BASIS,\n");
-            w.write("* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n");
-            w.write("* See the License for the specific language governing permissions and\n");
-            w.write("* limitations under the License.\n");
-            w.write("*/\n");
-            w.write("\n");
-            w.write("package " + PACKAGE_NAME + ";\n\n");
-            w.write("public interface " + VERSION_INTERFACE_NAME + " {\n");
-            w.write("    int MAJOR=" + version.maj + ";\n");
-            w.write("    int MINOR=" + version.min + ";\n");
-            w.write("    int MICRO=" + version.micro + ";\n");
-            w.write("    String QUALIFIER=" + (version.qualifier == null ? "\"\"" : "\"" + version.qualifier + "\"") + ";\n");
-            if (rev.equals("-1")) {
-                System.out.println("Unknown REVISION number, using " + rev);
-            }
-            w.write("    int REVISION=-1; //@deprecated, please use REVISION_HASH\n");
-            w.write("    String REVISION_HASH=\"" + rev + "\";\n");
-            w.write("    String BUILD_DATE=\"" + buildDate + "\";\n");
-            w.write("}\n");
-        } catch (IOException e) {
-            System.out.println("Unable to generate version.Info file: " + e.getMessage());
-            System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-        }
-
-        // Generate a main class to display version data
-        // that can be exec'd in zkServer.sh
-        try (FileWriter w = new FileWriter(new File(pkgdir, VERSION_CLASS_NAME + ".java"))) {
-            w.write("// Do not edit!\n// File generated by org.apache.zookeeper" + ".version.util.VerGen.\n");
-            w.write("/**\n");
-            w.write("* Licensed to the Apache Software Foundation (ASF) under one\n");
-            w.write("* or more contributor license agreements.  See the NOTICE file\n");
-            w.write("* distributed with this work for additional information\n");
-            w.write("* regarding copyright ownership.  The ASF licenses this file\n");
-            w.write("* to you under the Apache License, Version 2.0 (the\n");
-            w.write("* \"License\"); you may not use this file except in compliance\n");
-            w.write("* with the License.  You may obtain a copy of the License at\n");
-            w.write("*\n");
-            w.write("*     http://www.apache.org/licenses/LICENSE-2.0\n");
-            w.write("*\n");
-            w.write("* Unless required by applicable law or agreed to in writing, software\n");
-            w.write("* distributed under the License is distributed on an \"AS IS\" BASIS,\n");
-            w.write("* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n");
-            w.write("* See the License for the specific language governing permissions and\n");
-            w.write("* limitations under the License.\n");
-            w.write("*/\n");
-            w.write("\n");
-            w.write("package " + PACKAGE_NAME + ";\n\n");
-            w.write("public class " + VERSION_CLASS_NAME + " implements " + PACKAGE_NAME + ".Info {\n");
-            w.write("    public static void main(String[] args) {\n");
-            w.write("        final String VER_STRING = MAJOR + \".\" + MINOR + \".\" + MICRO +");
-            w.write("            (QUALIFIER == null ? \"\" : \"-\" + QUALIFIER)  + \" \" +");
-            w.write("            BUILD_DATE;" + "\n");
-            w.write("        System.out.println(\"Apache ZooKeeper, version \" + VER_STRING);\n");
-            w.write("    }\n");
-            w.write("}\n");
-        } catch (IOException e) {
-            System.out.println("Unable to generate version.VersionInfoMain file: " + e.getMessage());
-            System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-        }
-    }
-
-    public static class Version {
-
-        public int maj;
-        public int min;
-        public int micro;
-        public String qualifier;
-
-    }
-
-    public static Version parseVersionString(String input) {
-        Version result = new Version();
-
-        Pattern p = Pattern.compile("^(\\d+)\\.(\\d+)\\.(\\d+)((\\.\\d+)*)(-(.+))?$");
-        Matcher m = p.matcher(input);
-
-        if (!m.matches()) {
-            return null;
-        }
-        result.maj = Integer.parseInt(m.group(1));
-        result.min = Integer.parseInt(m.group(2));
-        result.micro = Integer.parseInt(m.group(3));
-        if (m.groupCount() == 7) {
-            result.qualifier = m.group(7);
-        } else {
-            result.qualifier = null;
-        }
-        return result;
-    }
-
-    /**
-     * Emits a org.apache.zookeeper.version.Info interface file with version and
-     * revision information constants set to the values passed in as command
-     * line parameters. The file is created in the current directory. <br>
-     * Usage: java org.apache.zookeeper.version.util.VerGen maj.min.micro[-qualifier]
-     * rev buildDate
-     *
-     * @param args
-     *            <ul>
-     *            <li>maj - major version number
-     *            <li>min - minor version number
-     *            <li>micro - minor minor version number
-     *            <li>qualifier - optional qualifier (dash followed by qualifier text)
-     *            <li>rev - current Git revision number
-     *            <li>buildDate - date the build
-     *            </ul>
-     */
-    public static void main(String[] args) {
-        if (args.length != 4) {
-            printUsage();
-        }
-        try {
-            Version version = parseVersionString(args[0]);
-            if (version == null) {
-                System.err.println("Invalid version number format, must be \"x.y.z(-.*)?\"");
-                System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-            }
-            String rev = args[1];
-            if (rev == null || rev.trim().isEmpty()) {
-                rev = "-1";
-            } else {
-                rev = rev.trim();
-            }
-            generateFile(new File(args[3]), version, rev, args[2]);
-        } catch (NumberFormatException e) {
-            System.err.println("All version-related parameters must be valid integers!");
-            throw e;
-        }
-    }
-
-}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java
deleted file mode 100644
index 1542df0caa5..00000000000
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper;
-
-import static org.junit.Assert.assertEquals;
-import java.io.File;
-import java.util.Arrays;
-import java.util.Collection;
-import org.apache.zookeeper.test.ClientBase;
-import org.apache.zookeeper.version.util.VerGen;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
-
-/**
- * Test VerGen, used during the build.
- *
- */
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
-public class VerGenTest extends ZKTestCase {
-
-    @Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(new Object[][]{{"1.2.3", new Object[]{1, 2, 3, null}}, {"1.2.3-dev", new Object[]{1, 2, 3, "dev"}}, {"1.2.3-SNAPSHOT", new Object[]{1, 2, 3, "SNAPSHOT"}}, {"1.2.3-SNAPSHOT", new Object[]{1, 2, 3, "SNAPSHOT"}}, {"1.2.3-foo-bar+123", new Object[]{1, 2, 3, "foo-bar+123"}}, {"1.2.3.4.5-SNAPSHOT", new Object[]{1, 2, 3, "SNAPSHOT"}}, {"1.2.3.4.5-foo-bar+123", new Object[]{1, 2, 3, "foo-bar+123"}}});
-    }
-
-    private String input;
-
-    private Object[] expected;
-
-    public VerGenTest(String input, Object[] expected) {
-        this.input = input;
-        this.expected = expected;
-    }
-
-    @Test
-    public void testParser() {
-        VerGen.Version v = VerGen.parseVersionString(input);
-        assertEquals(expected[0], v.maj);
-        assertEquals(expected[1], v.min);
-        assertEquals(expected[2], v.micro);
-        assertEquals(expected[3], v.qualifier);
-    }
-
-    @Test
-    public void testGenFile() throws Exception {
-        VerGen.Version v = VerGen.parseVersionString(input);
-        File outputDir = ClientBase.createTmpDir();
-        VerGen.generateFile(outputDir, v, "1", "Nov1");
-        ClientBase.recursiveDelete(outputDir);
-    }
-
-}

From 726f6843eba75bb3673284b52d8ca3801c5431d3 Mon Sep 17 00:00:00 2001
From: Vladislav Tyulbashev <vtyulb@vtyulb.ru>
Date: Sat, 11 Apr 2020 06:19:04 +0000
Subject: [PATCH 017/591] ZOOKEEPER-3726: invalid ipv6 address comparison in C
 client

Fix for https://issues.apache.org/jira/browse/ZOOKEEPER-3726

sockaddr_storage can contain ipv4 or ipv6 address. If address is ipv6, then we need to compare more bytes.

In this PR correct comparison of sockaddr_storage was added.

Author: Vladislav Tyulbashev <vtyulb@vtyulb.ru>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1252 from vtyulb/ZOOKEEPER-3726
---
 .../zookeeper-client-c/src/addrvec.c          | 22 ++++-
 .../zookeeper-client-c/tests/TestReconfig.cc  | 83 +++++++++++++++++++
 2 files changed, 103 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/addrvec.c b/zookeeper-client/zookeeper-client-c/src/addrvec.c
index fdfb68d34fd..b7f244e7afb 100644
--- a/zookeeper-client/zookeeper-client-c/src/addrvec.c
+++ b/zookeeper-client/zookeeper-client-c/src/addrvec.c
@@ -126,8 +126,26 @@ int addrvec_contains(const addrvec_t *avec, const struct sockaddr_storage *addr)
 
     for (i = 0; i < avec->count; i++)
     {
-        if(memcmp(&avec->data[i], addr, INET_ADDRSTRLEN) == 0)
-            return 1;
+        if (avec->data[i].ss_family != addr->ss_family)
+            continue;
+        switch (addr->ss_family) {
+        case AF_INET:
+            if (memcmp(&((struct sockaddr_in*)&avec->data[i])->sin_addr,
+                       &((struct sockaddr_in*)addr)->sin_addr,
+                       sizeof(struct in_addr)) == 0)
+                return 1;
+            break;
+#ifdef AF_INET6
+        case AF_INET6:
+            if (memcmp(&((struct sockaddr_in6*)&avec->data[i])->sin6_addr,
+                       &((struct sockaddr_in6*)addr)->sin6_addr,
+                       sizeof(struct in6_addr)) == 0)
+                return 1;
+            break;
+#endif
+        default:
+            break;
+        }
     }
 
     return 0;
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc b/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
index 317ffcddfed..22f87e94491 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
@@ -26,6 +26,10 @@
 #include <exception>
 #include <stdlib.h>
 
+extern "C" {
+#include <src/addrvec.h>
+}
+
 #include "Util.h"
 #include "LibCMocks.h"
 #include "ZKMocks.h"
@@ -218,6 +222,10 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
     CPPUNIT_TEST(testcycleNextServer);
     CPPUNIT_TEST(testMigrateOrNot);
     CPPUNIT_TEST(testMigrationCycle);
+    CPPUNIT_TEST(testAddrVecContainsIPv4);
+#ifdef AF_INET6
+    CPPUNIT_TEST(testAddrVecContainsIPv6);
+#endif
 
     // In threaded mode each 'create' is a thread -- it's not practical to create
     // 10,000 threads to test load balancing. The load balancing code can easily
@@ -609,6 +617,81 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
         numServers = 9;
         updateAllClientsAndServers(numServers);
     }
+
+    /**
+     * This tests that client can detect server's ipv4 address change.
+     *
+     * (1) We generate some address and put in addr, which saddr point to
+     * (2) Add all addresses that differ by one bit from the source
+     * (3) Add same address, but set ipv6 protocol
+     * (4) Ensure, that our address is not equal to any of generated,
+     *     and that it equals to itself
+     */
+    void testAddrVecContainsIPv4() {
+        addrvec_t vec;
+        addrvec_init(&vec);
+
+        sockaddr_storage addr;
+        sockaddr_in* saddr = (sockaddr_in*)&addr;
+        saddr->sin_family = AF_INET;
+        saddr->sin_port = htons((u_short)1234);
+        saddr->sin_addr.s_addr = INADDR_ANY;
+
+        CPPUNIT_ASSERT(sizeof(saddr->sin_addr.s_addr) == 4);
+
+        for (int i = 0; i < 32; i++) {
+            saddr->sin_addr.s_addr ^= (1 << i);
+            addrvec_append(&vec, &addr);
+            saddr->sin_addr.s_addr ^= (1 << i);
+        }
+
+        saddr->sin_family = AF_INET6;
+        addrvec_append(&vec, &addr);
+        saddr->sin_family = AF_INET;
+
+        CPPUNIT_ASSERT(!addrvec_contains(&vec, &addr));
+        addrvec_append(&vec, &addr);
+        CPPUNIT_ASSERT(addrvec_contains(&vec, &addr));
+        addrvec_free(&vec);
+    }
+
+    /**
+     * This tests that client can detect server's ipv6 address change.
+     *
+     * Same logic as in previous testAddrVecContainsIPv4 method,
+     * but we keep in mind, that ipv6 is 128-bit long.
+     */
+#ifdef AF_INET6
+    void testAddrVecContainsIPv6() {
+        addrvec_t vec;
+        addrvec_init(&vec);
+
+        sockaddr_storage addr;
+        sockaddr_in6* saddr = (sockaddr_in6*)&addr;
+        saddr->sin6_family = AF_INET6;
+        saddr->sin6_port = htons((u_short)1234);
+        saddr->sin6_addr = in6addr_any;
+
+        CPPUNIT_ASSERT(sizeof(saddr->sin6_addr.s6_addr) == 16);
+
+        for (int i = 0; i < 16; i++) {
+            for (int j = 0; j < 8; j++) {
+                saddr->sin6_addr.s6_addr[i] ^= (1 << j);
+                addrvec_append(&vec, &addr);
+                saddr->sin6_addr.s6_addr[i] ^= (1 << j);
+            }
+        }
+
+        saddr->sin6_family = AF_INET;
+        addrvec_append(&vec, &addr);
+        saddr->sin6_family = AF_INET6;
+
+        CPPUNIT_ASSERT(!addrvec_contains(&vec, &addr));
+        addrvec_append(&vec, &addr);
+        CPPUNIT_ASSERT(addrvec_contains(&vec, &addr));
+        addrvec_free(&vec);
+    }
+#endif
 };
 
 CPPUNIT_TEST_SUITE_REGISTRATION(Zookeeper_reconfig);

From 4d32f6cf39f76d606b436bd4c04a8d1bc9c60148 Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Sun, 12 Apr 2020 11:14:45 +0200
Subject: [PATCH 018/591] ZOOKEEPER-3793: Request throttling is broken when
 RequestThrottler is disabled or configured incorrectly..

When RequestThrottler is not enabled or is enabled but configured incorrectly, ZooKeeper server will stop throttling. This is a serious bug as without request throttling, it's fairly easy to overwhelm ZooKeeper which leads to all sorts of issues.

This is a regression introduced in ZOOKEEPER-3243, where the total number of queued requests in request processing pipeline is not taking into consideration when deciding whether to throttle or not, or only taken into consideration conditionally based on RequestThrottler's configurations. We should make sure always taking into account the number of queued requests in request processing pipeline before making throttling decisions.

Author: Michael Han <hanm@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1316 from hanm/ZOOKEEPER-3793
---
 .../zookeeper/server/ZooKeeperServer.java     |  3 +-
 .../server/RequestThrottlerTest.java          | 39 +++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 8205f741499..f37225edbf0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1431,7 +1431,8 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
     }
 
     public boolean shouldThrottle(long outStandingCount) {
-        if (getGlobalOutstandingLimit() < getInflight()) {
+        int globalOutstandingLimit = getGlobalOutstandingLimit();
+        if (globalOutstandingLimit < getInflight() || globalOutstandingLimit < getInProcess()) {
             return outStandingCount > 0;
         }
         return false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index 3afe81c6029..3e1de555f0b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -47,6 +47,7 @@ public class RequestThrottlerTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(RequestThrottlerTest.class);
 
     private static String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
+    private static String GLOBAL_OUTSTANDING_LIMIT = "1";
     private static final int TOTAL_REQUESTS = 5;
     private static final int STALL_TIME = 5000;
 
@@ -307,4 +308,42 @@ public void testLargeRequestThrottling() throws Exception {
         metrics = MetricsUtils.currentServerMetrics();
         Assert.assertEquals(2, (long) metrics.get("stale_replies"));
     }
+
+    @Test
+    public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled() throws Exception {
+        try {
+            System.setProperty(ZooKeeperServer.GLOBAL_OUTSTANDING_LIMIT, GLOBAL_OUTSTANDING_LIMIT);
+
+            ServerMetrics.getMetrics().resetAll();
+
+            // Here we disable RequestThrottler and let incoming requests queued at first request processor.
+            RequestThrottler.setMaxRequests(0);
+            resumeProcess = new CountDownLatch(1);
+            int totalRequests = 10;
+            submitted = new CountDownLatch(totalRequests);
+
+            for (int i = 0; i < totalRequests; i++) {
+                zk.create("/request_throttle_test- " + i, ("/request_throttle_test- "
+                        + i).getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, (rc, path, ctx, name) -> {
+                }, null);
+            }
+
+            submitted.await(5, TimeUnit.SECONDS);
+
+            resumeProcess.countDown();
+
+            // We should start throttling instead of queuing more requests.
+            //
+            // We always allow up to GLOBAL_OUTSTANDING_LIMIT + 1 number of requests coming in request processing pipeline
+            // before throttling. For the next request, we will throttle by disabling receiving future requests but we still
+            // allow this single request coming in. So the total number of queued requests in processing pipeline would
+            // be GLOBAL_OUTSTANDING_LIMIT + 2.
+            assertEquals(Integer.parseInt(GLOBAL_OUTSTANDING_LIMIT) + 2,
+                    (long) MetricsUtils.currentServerMetrics().get("prep_processor_request_queued"));
+        } catch (Exception e) {
+            throw e;
+        } finally {
+            System.clearProperty(ZooKeeperServer.GLOBAL_OUTSTANDING_LIMIT);
+        }
+    }
 }

From 8a1e0b3643d85ffa362207880095e08f1dbc47da Mon Sep 17 00:00:00 2001
From: Patrick Hunt <phunt@apache.org>
Date: Wed, 15 Apr 2020 11:44:17 +0200
Subject: [PATCH 019/591] ZOOKEEPER-3794: upgrade netty to address
 CVE-2020-11612

Latest owasp runs are flagging this. Simple upgrade to the current latest version of netty 4.1.x codeline.

Change-Id: I3defe8a731a2bf22abbd154e7d51054cb62aaa64

Author: Patrick Hunt <phunt@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1319 from phunt/ZOOKEEPER-3794
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.48.Final.LICENSE.txt} | 0
 ...5.Final.LICENSE.txt => netty-codec-4.1.49.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.48.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.48.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.48.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.48.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.48.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.45.Final.LICENSE.txt => netty-buffer-4.1.48.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.45.Final.LICENSE.txt => netty-codec-4.1.49.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.45.Final.LICENSE.txt => netty-common-4.1.48.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.45.Final.LICENSE.txt => netty-handler-4.1.48.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.45.Final.LICENSE.txt => netty-resolver-4.1.48.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.45.Final.LICENSE.txt => netty-transport-4.1.48.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.45.Final.LICENSE.txt => netty-transport-native-epoll-4.1.48.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.45.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 79e88df6ca9..e9e973facfe 100755
--- a/pom.xml
+++ b/pom.xml
@@ -353,7 +353,7 @@
     <mockito.version>2.27.0</mockito.version>
     <hamcrest.version>1.3</hamcrest.version>
     <commons-cli.version>1.2</commons-cli.version>
-    <netty.version>4.1.45.Final</netty.version>
+    <netty.version>4.1.48.Final</netty.version>
     <jetty.version>9.4.24.v20191120</jetty.version>
     <jackson.version>2.10.3</jackson.version>
     <json.version>1.1.1</json.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.48.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.49.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.49.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.48.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.48.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.48.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.48.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.48.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt

From 7812399f2c34033d56267d3cd2189abefbf35172 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Thu, 16 Apr 2020 10:50:00 +0000
Subject: [PATCH 020/591] ZOOKEEPER-3579: Handle null default watcher
 gracefully

See also https://issues.apache.org/jira/browse/ZOOKEEPER-3579

Prevent error logs noise like

>2019-10-14 18:41:49 ERROR ClientCnxn:537 - Error while calling watcher2019-10-14 18:41:49 ERROR ClientCnxn:537 - Error while calling watcherjava.lang.NullPointerException at org.apache.zookeeper.ClientCnxn$EventThread.processEvent(ClientCnxn.java:535) at org.apache.zookeeper.ClientCnxn$EventThread.run(ClientCnxn.java:510)2019-10-14 18:41:50 ERROR ClientCnxn:537 - Error while calling watcherjava.lang.NullPointerException at org.apache.zookeeper.ClientCnxn$EventThread.processEvent(ClientCnxn.java:535) at org.apache.zookeeper.ClientCnxn$EventThread.run(ClientCnxn.java:510)

Author: tison <wander4096@gmail.com>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Enrico Olivelli <eolivelli@apache.org>, maoling <maoling199210191@sina.com>, Mate Szalay-Beko <symat@apache.org>

Closes #1120 from TisonKun/ZOOKEEPER-3579
---
 .../java/org/apache/zookeeper/ClientCnxn.java |  2 +-
 .../java/org/apache/zookeeper/ZooKeeper.java  | 82 +++++++++++++------
 2 files changed, 60 insertions(+), 24 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index b3591461675..c87d3cba862 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -576,7 +576,7 @@ private void processEvent(Object event) {
                         try {
                             watcher.process(pair.event);
                         } catch (Throwable t) {
-                            LOG.error("Error while calling watcher ", t);
+                            LOG.error("Error while calling watcher.", t);
                         }
                     }
                 } else if (event instanceof LocalCallback) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index f6f165deaf4..0210493efc0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -525,12 +525,16 @@ protected boolean removeWatches(
         public Set<Watcher> materialize(
             Watcher.Event.KeeperState state,
             Watcher.Event.EventType type,
-            String clientPath) {
-            Set<Watcher> result = new HashSet<Watcher>();
+            String clientPath
+        ) {
+            final Set<Watcher> result = new HashSet<>();
 
             switch (type) {
             case None:
-                result.add(defaultWatcher);
+                if (defaultWatcher != null) {
+                    result.add(defaultWatcher);
+                }
+
                 boolean clear = disableAutoWatchReset && state != Watcher.Event.KeeperState.SyncConnected;
                 synchronized (dataWatches) {
                     for (Set<Watcher> ws : dataWatches.values()) {
@@ -2252,23 +2256,22 @@ public Stat exists(final String path, Watcher watcher) throws KeeperException, I
     /**
      * Return the stat of the node of the given path. Return null if no such a
      * node exists.
-     * <p>
-     * If the watch is true and the call is successful (no exception is thrown),
+     *
+     * <p>If the watch is true and the call is successful (no exception is thrown),
      * a watch will be left on the node with the given path. The watch will be
      * triggered by a successful operation that creates/delete the node or sets
      * the data on the node.
      *
-     * @param path
-     *                the node path
-     * @param watch
-     *                whether need to watch this node
+     * @param path the node path
+     * @param watch whether need to watch this node
      * @return the stat of the node of the given path; return null if no such a
      *         node exists.
      * @throws KeeperException If the server signals an error
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      */
     public Stat exists(String path, boolean watch) throws KeeperException, InterruptedException {
-        return exists(path, watch ? watchManager.defaultWatcher : null);
+        return exists(path, getDefaultWatcher(watch));
     }
 
     /**
@@ -2300,10 +2303,12 @@ public void exists(final String path, Watcher watcher, StatCallback cb, Object c
     /**
      * The asynchronous version of exists.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #exists(String, boolean)
      */
     public void exists(String path, boolean watch, StatCallback cb, Object ctx) {
-        exists(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        exists(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2369,10 +2374,11 @@ public byte[] getData(final String path, Watcher watcher, Stat stat) throws Keep
      * @param stat the stat of the node
      * @return the data of the node
      * @throws KeeperException If the server signals an error with a non-zero error code
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      */
     public byte[] getData(String path, boolean watch, Stat stat) throws KeeperException, InterruptedException {
-        return getData(path, watch ? watchManager.defaultWatcher : null, stat);
+        return getData(path, getDefaultWatcher(watch), stat);
     }
 
     /**
@@ -2404,10 +2410,12 @@ public void getData(final String path, Watcher watcher, DataCallback cb, Object
     /**
      * The asynchronous version of getData.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getData(String, boolean, Stat)
      */
     public void getData(String path, boolean watch, DataCallback cb, Object ctx) {
-        getData(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getData(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2490,19 +2498,22 @@ public void getConfig(Watcher watcher, DataCallback cb, Object ctx) {
      * @param stat the stat of the configuration node ZooDefs.CONFIG_NODE
      * @return configuration data stored in ZooDefs.CONFIG_NODE
      * @throws KeeperException If the server signals an error with a non-zero error code
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      */
     public byte[] getConfig(boolean watch, Stat stat) throws KeeperException, InterruptedException {
-        return getConfig(watch ? watchManager.defaultWatcher : null, stat);
+        return getConfig(getDefaultWatcher(watch), stat);
     }
 
     /**
      * The Asynchronous version of getConfig.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getData(String, boolean, Stat)
      */
     public void getConfig(boolean watch, DataCallback cb, Object ctx) {
-        getConfig(watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getConfig(getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2752,14 +2763,15 @@ public List<String> getChildren(final String path, Watcher watcher) throws Keepe
      * A KeeperException with error code KeeperException.NoNode will be thrown
      * if no node with the given path exists.
      *
-     * @param path
-     * @param watch
+     * @param path the node path
+     * @param watch whether need to watch this node
      * @return an unordered array of children of the node with the given path
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      * @throws KeeperException If the server signals an error with a non-zero error code.
      */
     public List<String> getChildren(String path, boolean watch) throws KeeperException, InterruptedException {
-        return getChildren(path, watch ? watchManager.defaultWatcher : null);
+        return getChildren(path, getDefaultWatcher(watch));
     }
 
     /**
@@ -2791,10 +2803,12 @@ public void getChildren(final String path, Watcher watcher, ChildrenCallback cb,
     /**
      * The asynchronous version of getChildren.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getChildren(String, boolean)
      */
     public void getChildren(String path, boolean watch, ChildrenCallback cb, Object ctx) {
-        getChildren(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getChildren(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2868,10 +2882,11 @@ public List<String> getChildren(
      *
      * @since 3.3.0
      *
-     * @param path
-     * @param watch
+     * @param path the node path
+     * @param watch whether need to watch this node
      * @param stat stat of the znode designated by path
      * @return an unordered array of children of the node with the given path
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      * @throws KeeperException If the server signals an error with a non-zero
      *  error code.
@@ -2880,7 +2895,7 @@ public List<String> getChildren(
         String path,
         boolean watch,
         Stat stat) throws KeeperException, InterruptedException {
-        return getChildren(path, watch ? watchManager.defaultWatcher : null, stat);
+        return getChildren(path, getDefaultWatcher(watch), stat);
     }
 
     /**
@@ -2916,10 +2931,12 @@ public void getChildren(final String path, Watcher watcher, Children2Callback cb
      *
      * @since 3.3.0
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getChildren(String, boolean, Stat)
      */
     public void getChildren(String path, boolean watch, Children2Callback cb, Object ctx) {
-        getChildren(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getChildren(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -3398,6 +3415,25 @@ private ClientCnxnSocket getClientCnxnSocket() throws IOException {
         }
     }
 
+    /**
+     * Return the default watcher of this instance if required.
+     *
+     * @param required if the default watcher required
+     * @return the default watcher if required, otherwise {@code null}.
+     * @throws IllegalStateException if a null default watcher is required
+     */
+    private Watcher getDefaultWatcher(boolean required) {
+        if (required) {
+            if (watchManager.defaultWatcher != null) {
+                return watchManager.defaultWatcher;
+            } else {
+                throw new IllegalStateException("Default watcher is required, but it is null.");
+            }
+        }
+
+        return null;
+    }
+
     /**
      * Validates the provided ACL list for null, empty or null value in it.
      *

From 5e592d303b596961c03bff9731cfe2e202cea5f2 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Thu, 16 Apr 2020 11:20:25 -0700
Subject: [PATCH 021/591] ZOOKEEPER-3788: Add m2e config for Eclipse devs

Add information to the pom.xml about plugin executions when importing
the project into Eclipse using M2E. This information is added to a
profile that is automatically activated when using Eclipse, but
otherwise ignored.

This change enables developers who use Eclipse to more easily develop
and contribute to ZooKeeper without the project generating a bunch of
errors when importing into the Eclipse IDE.

As plugins add their own m2e lifecycle metadata, the section added in
this commit can be removed.

For more, see:
https://www.eclipse.org/m2e/documentation/m2e-execution-not-covered.html

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: ben reed <breed@apache.org>

Closes #1313 from ctubbsii/eclipse-m2e-config
---
 pom.xml | 82 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/pom.xml b/pom.xml
index e9e973facfe..7361dbae7c7 100755
--- a/pom.xml
+++ b/pom.xml
@@ -324,6 +324,88 @@
       <properties>
         <maven.compiler.release>8</maven.compiler.release>
       </properties>
+      <build>
+        <pluginManagement>
+          <plugins>
+            <plugin>
+              <groupId>org.eclipse.m2e</groupId>
+              <artifactId>lifecycle-mapping</artifactId>
+              <version>1.0.0</version>
+              <configuration>
+                <lifecycleMappingMetadata>
+                  <pluginExecutions>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>exec</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>run</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>com.ruleoftech</groupId>
+                        <artifactId>markdown-page-generator-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>generate</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>javacc-maven-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>javacc</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>com.github.koraktor</groupId>
+                        <artifactId>mavanagaiata</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>commit</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                  </pluginExecutions>
+                </lifecycleMappingMetadata>
+              </configuration>
+            </plugin>
+          </plugins>
+        </pluginManagement>
+      </build>
     </profile>
     <profile>
       <id>jdk-release-flag</id>

From f44937ec6a23aa5cb98e3121b4de85d3d42093ed Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 27 Apr 2020 10:58:25 +0200
Subject: [PATCH 022/591] ZOOKEEPER-3790: zkpython compilation and testing
 issues

This series makes the zkpython "contrib" compile cleanly, and makes the tests runnable out of the box with Python 3:

  * Defined `THREADED`, as zkpython uses the sync API

    Without this, compilation produces a number of warnings about undefined functions (and misleading suggestions!) as it only sees the async API:

        src/c/zookeeper.c:1080:13: warning: implicit declaration of function 'zoo_delete'; did you mean 'zoo_adelete'? [-Wimplicit-function-declaration]
           int err = zoo_delete(zh, path, version);
                     ^~~~~~~~~~
                     zoo_adelete

  * Define `HAVE_OPENSSL_H`, as the extension calls zookeeper_init_ssl

    The flag is unconditionally defined for now, as the function is unconditionally called.

        src/c/zookeeper.c:646:10: warning: implicit declaration of function 'zookeeper_init_ssl'; did you mean 'zookeeper_init2'? [-Wimplicit-function-declaration]
             zh = zookeeper_init_ssl( host, cert_str, watcherfn != Py_None ? watcher_dispatch : NULL,

                  ^~~~~~~~~~~~~~~~~~
                  zookeeper_init2

  * Make SSL support optional (but on by default)

  * Raise `MemoryError` if module initialization fails

  * Allow for version/ABI information in shared object name

    In some versions of the Python framework, native extensions encode the interpreter version and some ABI information in the filename, giving e.g. `zookeeper.cpython-37m-x86_64-linux-gnu.so` instead of `zookeeper.so`.  Take this into account when setting up test runs.

  * Make sure test failures are detected

  * `async` is a keyword in Python 3.5+

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Mate Szalay-Beko <szalay.beko.mate@gmail.com>, Norbert Kalmar <nkalmar@apache.org>

Closes #1312 from ztzg/ZOOKEEPER-3790-zkpython-compilation-and-testing-issues

(cherry picked from commit 21221ac692405962bdda3e9ceb63186ef0f180ef)
Signed-off-by: Norbert Kalmar <nkalmar@apache.org>
---
 .../zookeeper-contrib-zkpython/README         | 10 +++++---
 .../src/c/zookeeper.c                         | 25 +++++++++++++++----
 .../src/python/setup.py                       |  9 +++++++
 .../src/test/async_test.py                    |  2 +-
 .../src/test/callback_test.py                 |  6 ++---
 .../src/test/connection_test.py               |  3 ++-
 .../src/test/run_tests.sh                     |  4 ++-
 7 files changed, 44 insertions(+), 15 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/README b/zookeeper-contrib/zookeeper-contrib-zkpython/README
index 56154618356..ffad255f06f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/README
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/README
@@ -5,13 +5,15 @@ Please do not rely on APIs staying constant in the short term. The handling of e
 DEPENDENCIES:
 -------------
 
-This has only been tested against SVN (i.e. 3.2.0 in development) but should work against 3.1.1. 
+This has only been tested against SVN/Git (i.e. 3.2.0 in development) but should work against 3.1.1.
 
 You will need the Python development headers installed to build the module - on many package-management systems, these can be found in python-devel. (On ubuntu 18.4, install python2.7 and python2.7-dev.)
 
-Python >= 2.6 is required. We have tested against 2.6. We have not tested against 3.x. 
+Python >= 2.6 is required. We have tested against 2.6 and 3.5+.
 
-E.g. setting up tpyhon and python devel on ubuntu 18.4:
+By default, the extension assumes that the C client library was compiled with OpenSSL enabled (--with-openssl).  You can disable OpenSSL support in the Python binding by setting the ZKPYTHON_NO_SSL environment variable to a non-empty string before executing Ant or setup.py.
+
+E.g. setting up python and python devel on ubuntu 18.4:
 sudo apt-get install python2.7 python2.7-dev
 sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1
 
@@ -22,7 +24,7 @@ To install, make sure that the C client has been built (use `mvn clean install -
 
 ant install
 
-from zookeeper/src/contrib/zkpython/.
+from zookeeper-contrib/zookeeper-contrib-zkpython/.
 
 To test, run ant test from the same directory. 
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
index e84c2b70700..ee8a75a03f7 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
@@ -600,7 +600,7 @@ void acl_completion_dispatch(int rc, struct ACL_vector *acl, struct Stat *stat,
 /* -------------------------------------------------------------------------- */
 
 
-static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, int ssl) {
+static PyObject *pyzookeeper_init_common(PyObject *self, PyObject *args, int ssl) {
   const char *host;
   const char *cert_str;
   PyObject *watcherfn = Py_None;
@@ -643,8 +643,13 @@ static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, i
   watchers[handle] = pyw;
 
   if (ssl) {
+#ifdef HAVE_OPENSSL_H
     zh = zookeeper_init_ssl( host, cert_str, watcherfn != Py_None ? watcher_dispatch : NULL,
                              recv_timeout, cid.client_id == -1 ? 0 : &cid, pyw, 0 );
+#else
+    fprintf(stderr, "SSL support not compiled in (called with ssl=%d).\n", ssl);
+    abort();
+#endif
   } else {
     zh = zookeeper_init( host, watcherfn != Py_None ? watcher_dispatch : NULL,
                          recv_timeout, cid.client_id == -1 ? 0 : &cid, pyw, 0 );
@@ -652,7 +657,7 @@ static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, i
 
   if (zh == NULL)
     {
-      PyErr_SetString( ZooKeeperException, "Could not internally obtain SSL zookeeper handle" );
+      PyErr_Format( ZooKeeperException, "Could not internally obtain%s zookeeper handle", ssl ? " SSL" : "" );
       return NULL;
     }
 
@@ -662,14 +667,16 @@ static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, i
 
 static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
 {
-  return pyzookeeper_init_optional_ssl(self, args, 0);
+  return pyzookeeper_init_common(self, args, /*ssl*/0);
 }
 
 
+#ifdef HAVE_OPENSSL_H
 static PyObject *pyzookeeper_init_ssl(PyObject *self, PyObject *args)
 {
-  return pyzookeeper_init_optional_ssl(self, args, 1);
+  return pyzookeeper_init_common(self, args, /*ssl*/1);
 }
+#endif
 
 
 /* -------------------------------------------------------------------------- */
@@ -1518,7 +1525,9 @@ PyObject *pyzoo_deterministic_conn_order(PyObject *self, PyObject *args)
 
 static PyMethodDef ZooKeeperMethods[] = {
   {"init", pyzookeeper_init, METH_VARARGS, pyzk_init_doc },
+#ifdef HAVE_OPENSSL_H
   {"init_ssl", pyzookeeper_init_ssl, METH_VARARGS, pyzk_init_ssl_doc },
+#endif
   {"create",pyzoo_create, METH_VARARGS, pyzk_create_doc },
   {"delete",pyzoo_delete, METH_VARARGS, pyzk_delete_doc },
   {"get_children", pyzoo_get_children, METH_VARARGS, pyzk_get_children_doc },
@@ -1589,8 +1598,14 @@ PyMODINIT_FUNC initzookeeper(void) {
 #else
   PyObject *module = Py_InitModule("zookeeper", ZooKeeperMethods);
 #endif
+
   if (init_zhandles(32) == 0) {
-    return; // TODO: Is there any way to raise an exception here?
+#if PY_MAJOR_VERSION >= 3
+    Py_DECREF(module);
+    return PyErr_NoMemory();
+#else
+    return;
+#endif
   }
 
   ZooKeeperException = PyErr_NewException("zookeeper.ZooKeeperException",
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
index 313c020569c..b225a317400 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
@@ -15,11 +15,20 @@
 # limitations under the License.
 
 from distutils.core import setup, Extension
+import os
 
 zookeeper_basedir = "../../"
 
+zookeeper_macros = [("THREADED", None)]
+
+# Assume the C extension includes OpenSSL support unless told
+# otherwise.
+if not os.environ.get("ZKPYTHON_NO_SSL"):
+    zookeeper_macros.append(("HAVE_OPENSSL_H", True))
+
 zookeepermodule = Extension("zookeeper",
                             sources=["src/c/zookeeper.c"],
+                            define_macros=zookeeper_macros,
                             include_dirs=[zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/include",
                                           zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/target/c",
                                           zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/generated"],
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py
index e81343570ea..61740ae433f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py
@@ -26,7 +26,7 @@ def setUp( self ):
 
     def test_async(self):
         self.assertEqual(self.connected, True)
-        ret = zookeeper.async(self.handle, "/")
+        ret = getattr(zookeeper, 'async')(self.handle, "/")
         self.assertEqual(ret, zookeeper.OK, "async failed")
         
 if __name__ == '__main__':
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py
index 55d7fe17866..95e20b4dea1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py
@@ -91,9 +91,9 @@ def dispatch_callback(*args, **kwargs):
                                                                self.create_callback( dispatch_callback )),
                                lambda: self.assertEqual(True, self.callback_flag, "Strings dispatch not fired"))
 
-        self.callback_harness( lambda: zookeeper.async(self.handle,
-                                                       "/",
-                                                       self.create_callback( dispatch_callback )),
+        self.callback_harness( lambda: getattr(zookeeper, 'async')(self.handle,
+                                                                   "/",
+                                                                   self.create_callback( dispatch_callback )),
                                lambda: self.assertEqual(True, self.callback_flag, "String dispatch not fired"))
 
         self.callback_harness( lambda: zookeeper.aget_acl(self.handle,
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
index 2661e6ecaf8..3fbbd4bf85b 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
@@ -58,7 +58,8 @@ def connection_watcher(handle, type, state, path):
                           self.handle,
                           "/")
 
-
+    @unittest.skipUnless(hasattr(zookeeper, 'init_ssl'),
+                         "SSL support not compiled in.")
     def testsslconnection(self):
         cv = threading.Condition()
         self.connected = False
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
index a3cf4d87969..232359b16e0 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
@@ -19,6 +19,8 @@
 # Usage: run_tests.sh testdir [logdir]
 # logdir is optional, defaults to cwd
 
+set -e
+
 # get the number of command-line arguments given
 ARGC=$#
 
@@ -30,7 +32,7 @@ else
 fi
 
 # Find the build directory containing zookeeper.so
-SO_PATH=`find ./target/ -name "zookeeper.so" | head -1`
+SO_PATH=`find ./target/ -name 'zookeeper*.so' | head -1`
 PYTHONPATH=`dirname $SO_PATH`
 LIB_PATH=../../zookeeper-client/zookeeper-client-c/target/c/.libs
 for test in `ls $1/*_test.py`; 

From 2e14a29cc6e58d9561e80b737a3168fbb1f752b4 Mon Sep 17 00:00:00 2001
From: xavier <xavierzw@foxmail.com>
Date: Thu, 30 Apr 2020 16:53:16 +0000
Subject: [PATCH 023/591] ZOOKEEPER-3811: cleaning up code,static field be
 directly referred by its class name

optimized code,A static field should be directly referred by its class name

Author: xavier <1217353758@qq.com>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Fangmin Lyu <fangmin@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1337 from XavierChengZW/master
---
 .../java/org/apache/zookeeper/server/RequestThrottler.java    | 4 ++--
 .../java/org/apache/zookeeper/server/ZooKeeperServerBean.java | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index e9cdc5ec10b..32863d92a61 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -100,8 +100,8 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
 
     protected boolean shouldThrottleOp(Request request, long elapsedTime) {
         return request.isThrottlable()
-                && zks.getThrottledOpWaitTime() > 0
-                && elapsedTime > zks.getThrottledOpWaitTime();
+                && ZooKeeperServer.getThrottledOpWaitTime() > 0
+                && elapsedTime > ZooKeeperServer.getThrottledOpWaitTime();
     }
 
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
index 17dd48b7505..5eac7edf8c5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
@@ -316,11 +316,11 @@ public void setFlushDelay(long delay) {
     ///////////////////////////////////////////////////////////////////////////
 
     public int getThrottledOpWaitTime() {
-        return zks.getThrottledOpWaitTime();
+        return ZooKeeperServer.getThrottledOpWaitTime();
     }
 
     public void setThrottledOpWaitTime(int val) {
-        zks.setThrottledOpWaitTime(val);
+        ZooKeeperServer.setThrottledOpWaitTime(val);
     }
 
     ///////////////////////////////////////////////////////////////////////////

From b4f6e82de10e6f87836f8221970110dad2b3825c Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Sun, 3 May 2020 19:43:27 +0200
Subject: [PATCH 024/591] ZOOKEEPER-3574: Close quorum socket asynchronously to
 avoid server shutdown stalled by long socket closing time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…utdown stalled by long socket closing time

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Enrico Olivelli <eolivelli@aoache.org>, Fangmin Lyu <fangmin@apache.org>

Closes #1115 from jhuan31/ZOOKEEPER-3574
---
 .../main/resources/markdown/zookeeperAdmin.md | 173 +++++++++---------
 .../zookeeper/server/ServerMetrics.java       |   5 +
 .../zookeeper/server/quorum/Learner.java      |  26 +++
 3 files changed, 120 insertions(+), 84 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index ca1a3f71f57..6c616d1af68 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -202,11 +202,11 @@ ensemble:
   though about a few here:
   Every machine that is part of the ZooKeeper ensemble should know
   about every other machine in the ensemble. You accomplish this with
-  the series of lines of the form **server.id=host:port:port**. 
-  (The parameters **host** and **port** are straightforward, for each server 
+  the series of lines of the form **server.id=host:port:port**.
+  (The parameters **host** and **port** are straightforward, for each server
   you need to specify first a Quorum port then a dedicated port for ZooKeeper leader
-  election). Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-  for each ZooKeeper server instance (this can increase availability when multiple physical 
+  election). Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+  for each ZooKeeper server instance (this can increase availability when multiple physical
   network interfaces can be used parallel in the cluster).
   You attribute the
   server id to each machine by creating a file named
@@ -233,7 +233,7 @@ ensemble:
   ensemble.
 
 7. If your configuration file is set up, you can start a
-  ZooKeeper server:  
+  ZooKeeper server:
 
         $ java -cp zookeeper.jar:lib/*:conf org.apache.zookeeper.server.quorum.QuorumPeerMain zoo.conf
 
@@ -1004,7 +1004,7 @@ property, when available, is noted below.
 * *zookeeper.request_throttler.shutdownTimeout* :
     (Java system property only)
     **New in 3.6.0:**
-    The time (in milliseconds) the RequestThrottler waits for the request queue to drain during shutdown before it shuts down forcefully. The default is 10000.  
+    The time (in milliseconds) the RequestThrottler waits for the request queue to drain during shutdown before it shuts down forcefully. The default is 10000.
 
 * *advancedFlowControlEnabled* :
     (Java system property: **zookeeper.netty.advancedFlowControl.enabled**)
@@ -1032,59 +1032,59 @@ property, when available, is noted below.
     **New in 3.6.0:**
     The digest feature is added to detect the data inconsistency inside
     ZooKeeper when loading database from disk, catching up and following
-    leader, its doing incrementally hash check for the DataTree based on 
+    leader, its doing incrementally hash check for the DataTree based on
     the adHash paper mentioned in
 
         https://cseweb.ucsd.edu/~daniele/papers/IncHash.pdf
 
-    The idea is simple, the hash value of DataTree will be updated incrementally 
-    based on the changes to the set of data. When the leader is preparing the txn, 
-    it will pre-calculate the hash of the tree based on the changes happened with 
+    The idea is simple, the hash value of DataTree will be updated incrementally
+    based on the changes to the set of data. When the leader is preparing the txn,
+    it will pre-calculate the hash of the tree based on the changes happened with
     formula:
 
         current_hash = current_hash + hash(new node data) - hash(old node data)
 
-    If it’s creating a new node, the hash(old node data) will be 0, and if it’s a 
+    If it’s creating a new node, the hash(old node data) will be 0, and if it’s a
     delete node op, the hash(new node data) will be 0.
 
-    This hash will be associated with each txn to represent the expected hash value 
-    after applying the txn to the data tree, it will be sent to followers with 
-    original proposals. Learner will compare the actual hash value with the one in 
-    the txn after applying the txn to the data tree, and report mismatch if it’s not 
+    This hash will be associated with each txn to represent the expected hash value
+    after applying the txn to the data tree, it will be sent to followers with
+    original proposals. Learner will compare the actual hash value with the one in
+    the txn after applying the txn to the data tree, and report mismatch if it’s not
     the same.
 
-    These digest value will also be persisted with each txn and snapshot on the disk, 
-    so when servers restarted and load data from disk, it will compare and see if 
+    These digest value will also be persisted with each txn and snapshot on the disk,
+    so when servers restarted and load data from disk, it will compare and see if
     there is hash mismatch, which will help detect data loss issue on disk.
 
-    For the actual hash function, we’re using CRC internally, it’s not a collisionless 
-    hash function, but it’s more efficient compared to collisionless hash, and the 
+    For the actual hash function, we’re using CRC internally, it’s not a collisionless
+    hash function, but it’s more efficient compared to collisionless hash, and the
     collision possibility is really really rare and can already meet our needs here.
 
-    This feature is backward and forward compatible, so it can safely rolling upgrade, 
-    downgrade, enabled and later disabled without any compatible issue. Here are the 
+    This feature is backward and forward compatible, so it can safely rolling upgrade,
+    downgrade, enabled and later disabled without any compatible issue. Here are the
     scenarios have been covered and tested:
 
-    1. When leader runs with new code while follower runs with old one, the digest will 
-       be append to the end of each txn, follower will only read header and txn data, 
-       digest value in the txn will be ignored. It won't affect the follower reads and 
+    1. When leader runs with new code while follower runs with old one, the digest will
+       be append to the end of each txn, follower will only read header and txn data,
+       digest value in the txn will be ignored. It won't affect the follower reads and
        processes the next txn.
     2. When leader runs with old code while follower runs with new one, the digest won't
-       be sent with txn, when follower tries to read the digest, it will throw EOF which 
+       be sent with txn, when follower tries to read the digest, it will throw EOF which
        is caught and handled gracefully with digest value set to null.
     3. When loading old snapshot with new code, it will throw IOException when trying to
        read the non-exist digest value, and the exception will be caught and digest will
-       be set to null, which means we won't compare digest when loading this snapshot, 
+       be set to null, which means we won't compare digest when loading this snapshot,
        which is expected to happen during rolling upgrade
-    4. When loading new snapshot with old code, it will finish successfully after deserialzing 
+    4. When loading new snapshot with old code, it will finish successfully after deserialzing
        the data tree, the digest value at the end of snapshot file will be ignored
-    5. The scenarios of rolling restart with flags change are similar to the 1st and 2nd 
+    5. The scenarios of rolling restart with flags change are similar to the 1st and 2nd
        scenarios discussed above, if the leader enabled but follower not, digest value will
        be ignored, and follower won't compare the digest during runtime; if leader disabled
        but follower enabled, follower will get EOF exception which is handled gracefully.
 
-    Note: the current digest calculation excluded nodes under /zookeeper 
-    due to the potential inconsistency in the /zookeeper/quota stat node, 
+    Note: the current digest calculation excluded nodes under /zookeeper
+    due to the potential inconsistency in the /zookeeper/quota stat node,
     we can include that after that issue is fixed.
 
     By default, this feautre is disabled, set "true" to enable it.
@@ -1107,7 +1107,7 @@ property, when available, is noted below.
     **New in 3.6.0:**
     By default audit logs are disabled. Set to "true" to enable it. Default value is "false".
     See the [ZooKeeper audit logs](zookeeperAuditLogs.html) for more information.
-    
+
 * *audit.impl.class* :
     (Java system property: **zookeeper.audit.impl.class**)
     **New in 3.6.0:**
@@ -1125,12 +1125,12 @@ property, when available, is noted below.
     **New in 3.6.0:**
     The size threshold after which a request is considered a large request. If it is -1, then all requests are considered small, effectively turning off large request throttling. The default is -1.
 
-* *outstandingHandshake.limit* 
+* *outstandingHandshake.limit*
     (Jave system property only: **zookeeper.netty.server.outstandingHandshake.limit**)
-    The maximum in-flight TLS handshake connections could have in ZooKeeper, 
-    the connections exceed this limit will be rejected before starting handshake. 
-    This setting doesn't limit the max TLS concurrency, but helps avoid herd 
-    effect due to TLS handshake timeout when there are too many in-flight TLS 
+    The maximum in-flight TLS handshake connections could have in ZooKeeper,
+    the connections exceed this limit will be rejected before starting handshake.
+    This setting doesn't limit the max TLS concurrency, but helps avoid herd
+    effect due to TLS handshake timeout when there are too many in-flight TLS
     handshakes. Set it to something like 250 is good enough to avoid herd effect.
 
 * *throttledOpWaitTime*
@@ -1142,6 +1142,11 @@ property, when available, is noted below.
     The intent is for the clients not to retry them immediately.
     When set to 0, no requests will be throttled. The default is 0.
 
+* *learner.closeSocketAsync*
+    (Jave system property only: **learner.closeSocketAsync**)
+    When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailabe. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. The default is false.
+
+
 <a name="sc_clusterOptions"></a>
 
 #### Cluster Options
@@ -1155,13 +1160,13 @@ of servers -- that is, when deploying clusters of servers.
     non-authenticated UDP-based version of fast leader election, "2"
     corresponds to the authenticated UDP-based version of fast
     leader election, and "3" corresponds to TCP-based version of
-    fast leader election. Algorithm 3 was made default in 3.2.0 and 
+    fast leader election. Algorithm 3 was made default in 3.2.0 and
     prior versions (3.0.0 and 3.1.0) were using algorithm 1 and 2 as well.
     ###### Note
-    >The implementations of leader election 1, and 2 were 
-    **deprecated** in 3.4.0. Since 3.6.0 only FastLeaderElection is available, 
-    in case of upgrade you have to shutdown all of your servers and 
-    restart them with electionAlg=3 (or by removing the line from the configuration file).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        >                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     
+    >The implementations of leader election 1, and 2 were
+    **deprecated** in 3.4.0. Since 3.6.0 only FastLeaderElection is available,
+    in case of upgrade you have to shutdown all of your servers and
+    restart them with electionAlg=3 (or by removing the line from the configuration file).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        >
 
 * *maxTimeToWaitForEpoch* :
   (Java system property: **zookeeper.leader.maxTimeToWaitForEpoch**)
@@ -1215,15 +1220,15 @@ of servers -- that is, when deploying clusters of servers.
     The first followers use to connect to the leader, and the second is for
     leader election. If you want to test multiple servers on a single machine, then
     different ports can be used for each server.
-    
+
 
     <a name="id_multi_address"></a>
     Since ZooKeeper 3.6.0 it is possible to specify **multiple addresses** for each
     ZooKeeper server (see [ZOOKEEPER-3188](https://issues.apache.org/jira/projects/ZOOKEEPER/issues/ZOOKEEPER-3188)).
     To enable this feature, you must set the *multiAddress.enabled* configuration property
-    to *true*. This helps to increase availability and adds network level 
-    resiliency to ZooKeeper. When multiple physical network interfaces are used 
-    for the servers, ZooKeeper is able to bind on all interfaces and runtime switching 
+    to *true*. This helps to increase availability and adds network level
+    resiliency to ZooKeeper. When multiple physical network interfaces are used
+    for the servers, ZooKeeper is able to bind on all interfaces and runtime switching
     to a working interface in case a network error. The different addresses can be specified
     in the config using a pipe ('|') character. A valid configuration using multiple addresses looks like:
 
@@ -1375,16 +1380,16 @@ As an example, this will enable all four letter word commands:
 
 * *electionPortBindRetry* :
     (Java system property only: **zookeeper.electionPortBindRetry**)
-    Property set max retry count when Zookeeper server fails to bind 
-    leader election port. Such errors can be temporary and recoverable, 
+    Property set max retry count when Zookeeper server fails to bind
+    leader election port. Such errors can be temporary and recoverable,
     such as DNS issue described in [ZOOKEEPER-3320](https://issues.apache.org/jira/projects/ZOOKEEPER/issues/ZOOKEEPER-3320),
-    or non-retryable, such as port already in use.  
-    In case of transient errors, this property can improve availability 
-    of Zookeeper server and help it to self recover. 
-    Default value 3. In container environment, especially in Kubernetes, 
-    this value should be increased or set to 0(infinite retry) to overcome issues 
+    or non-retryable, such as port already in use.
+    In case of transient errors, this property can improve availability
+    of Zookeeper server and help it to self recover.
+    Default value 3. In container environment, especially in Kubernetes,
+    this value should be increased or set to 0(infinite retry) to overcome issues
     related to DNS name resolving.
-    
+
 
 * *observer.reconnectDelayMs* :
     (Java system property: **zookeeper.observer.reconnectDelayMs**)
@@ -1414,9 +1419,9 @@ As an example, this will enable all four letter word commands:
 The options in this section allow control over
 encryption/authentication/authorization performed by the service.
 
-Beside this page, you can also find useful information about client side configuration in the 
-[Programmers Guide](zookeeperProgrammers.html#sc_java_client_configuration). 
-The ZooKeeper Wiki also has useful pages about [ZooKeeper SSL support](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide), 
+Beside this page, you can also find useful information about client side configuration in the
+[Programmers Guide](zookeeperProgrammers.html#sc_java_client_configuration).
+The ZooKeeper Wiki also has useful pages about [ZooKeeper SSL support](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide),
 and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+and+SASL).
 
 * *DigestAuthenticationProvider.superDigest* :
@@ -1509,8 +1514,8 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *ssl.keyStore.type* and *ssl.quorum.keyStore.type* :
     (Java system properties: **zookeeper.ssl.keyStore.type** and **zookeeper.ssl.quorum.keyStore.type**)
     **New in 3.5.5:**
-    Specifies the file format of client and quorum keystores. Values: JKS, PEM, PKCS12 or null (detect by filename).    
-    Default: null     
+    Specifies the file format of client and quorum keystores. Values: JKS, PEM, PKCS12 or null (detect by filename).
+    Default: null
 
 * *ssl.trustStore.location* and *ssl.trustStore.password* and *ssl.quorum.trustStore.location* and *ssl.quorum.trustStore.password* :
     (Java system properties: **zookeeper.ssl.trustStore.location** and **zookeeper.ssl.trustStore.password** and **zookeeper.ssl.quorum.trustStore.location** and **zookeeper.ssl.quorum.trustStore.password**)
@@ -1522,8 +1527,8 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *ssl.trustStore.type* and *ssl.quorum.trustStore.type* :
     (Java system properties: **zookeeper.ssl.trustStore.type** and **zookeeper.ssl.quorum.trustStore.type**)
     **New in 3.5.5:**
-    Specifies the file format of client and quorum trustStores. Values: JKS, PEM, PKCS12 or null (detect by filename).    
-    Default: null     
+    Specifies the file format of client and quorum trustStores. Values: JKS, PEM, PKCS12 or null (detect by filename).
+    Default: null
 
 * *ssl.protocol* and *ssl.quorum.protocol* :
     (Java system properties: **zookeeper.ssl.protocol** and **zookeeper.ssl.quorum.protocol**)
@@ -1541,7 +1546,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (Java system properties: **zookeeper.ssl.ciphersuites** and **zookeeper.ssl.quorum.ciphersuites**)
     **New in 3.5.5:**
     Specifies the enabled cipher suites to be used in client and quorum TLS negotiation.
-    Default: Enabled cipher suites depend on the Java runtime version being used.    
+    Default: Enabled cipher suites depend on the Java runtime version being used.
 
 * *ssl.context.supplier.class* and *ssl.quorum.context.supplier.class* :
     (Java system properties: **zookeeper.ssl.context.supplier.class** and **zookeeper.ssl.quorum.context.supplier.class**)
@@ -1586,19 +1591,19 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Specifies that the client port should accept SSL connections
     (using the same configuration as the secure client port).
     Default: false
-    
+
 * *authProvider*:
     (Java system property: **zookeeper.authProvider**)
     You can specify multiple authentication provider classes for ZooKeeper.
     Usually you use this parameter to specify the SASL authentication provider
     like: `authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider`
-    
+
 * *kerberos.removeHostFromPrincipal*
     (Java system property: **zookeeper.kerberos.removeHostFromPrincipal**)
     You can instruct ZooKeeper to remove the host from the client principal name during authentication.
     (e.g. the zk/myhost@EXAMPLE.COM client principal will be authenticated in ZooKeeper as zk@EXAMPLE.COM)
     Default: false
-    
+
 * *kerberos.removeRealmFromPrincipal*
     (Java system property: **zookeeper.kerberos.removeRealmFromPrincipal**)
     You can instruct ZooKeeper to remove the realm from the client principal name during authentication.
@@ -1608,9 +1613,9 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *multiAddress.enabled* :
     (Java system property: **zookeeper.multiAddress.enabled**)
     **New in 3.6.0:**
-    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-    for each ZooKeeper server instance (this can increase availability when multiple physical 
-    network interfaces can be used parallel in the cluster). Setting this parameter to 
+    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+    for each ZooKeeper server instance (this can increase availability when multiple physical
+    network interfaces can be used parallel in the cluster). Setting this parameter to
     **true** will enable this feature. Please note, that you can not enable this feature
     during a rolling upgrade if the version of the old ZooKeeper cluster is prior to 3.6.0.
     The default value is **false**.
@@ -1618,17 +1623,17 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *multiAddress.reachabilityCheckTimeoutMs* :
     (Java system property: **zookeeper.multiAddress.reachabilityCheckTimeoutMs**)
     **New in 3.6.0:**
-    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-    for each ZooKeeper server instance (this can increase availability when multiple physical 
+    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+    for each ZooKeeper server instance (this can increase availability when multiple physical
     network interfaces can be used parallel in the cluster). ZooKeeper will perform ICMP ECHO requests
-    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find 
+    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find
     the reachable addresses. This happens only if you provide multiple addresses in the configuration.
-    In this property you can set the timeout in millisecs for the reachability check. The check happens 
+    In this property you can set the timeout in millisecs for the reachability check. The check happens
     in parallel for the different addresses, so the timeout you set here is the maximum time will be taken
     by checking the reachability of all addresses.
     The default value is **1000**.
 
-    This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.    
+    This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.
 
 <a name="Experimental+Options%2FFeatures"></a>
 
@@ -1684,11 +1689,11 @@ the variable does.
 * *jute.maxbuffer.extrasize*:
     (Java system property: **zookeeper.jute.maxbuffer.extrasize**)
     **New in 3.5.7:**
-    While processing client requests ZooKeeper server adds some additional information into 
-    the requests before persisting it as a transaction. Earlier this additional information size 
+    While processing client requests ZooKeeper server adds some additional information into
+    the requests before persisting it as a transaction. Earlier this additional information size
     was fixed to 1024 bytes. For many scenarios, specially scenarios where jute.maxbuffer value
     is more than 1 MB and request type is multi, this fixed size was insufficient.
-    To handle all the scenarios additional information size is increased from 1024 byte 
+    To handle all the scenarios additional information size is increased from 1024 byte
     to same as jute.maxbuffer size and also it is made configurable through jute.maxbuffer.extrasize.
     Generally this property is not required to be configured as default value is the most optimal value.
 
@@ -1708,17 +1713,17 @@ the variable does.
 * *multiAddress.reachabilityCheckEnabled* :
     (Java system property: **zookeeper.multiAddress.reachabilityCheckEnabled**)
     **New in 3.6.0:**
-    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-    for each ZooKeeper server instance (this can increase availability when multiple physical 
+    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+    for each ZooKeeper server instance (this can increase availability when multiple physical
     network interfaces can be used parallel in the cluster). ZooKeeper will perform ICMP ECHO requests
-    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find 
+    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find
     the reachable addresses. This happens only if you provide multiple addresses in the configuration.
-    The reachable check can fail if you hit some ICMP rate-limitation, (e.g. on MacOS) when you try to 
-    start a large (e.g. 11+) ensemble members cluster on a single machine for testing. 
-    
-    Default value is **true**. By setting this parameter to 'false' you can disable the reachability checks. 
-    Please note, disabling the reachability check will cause the cluster not to be able to reconfigure 
-    itself properly during network problems, so the disabling is advised only during testing. 
+    The reachable check can fail if you hit some ICMP rate-limitation, (e.g. on MacOS) when you try to
+    start a large (e.g. 11+) ensemble members cluster on a single machine for testing.
+
+    Default value is **true**. By setting this parameter to 'false' you can disable the reachability checks.
+    Please note, disabling the reachability check will cause the cluster not to be able to reconfigure
+    itself properly during network problems, so the disabling is advised only during testing.
 
     This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 95214209c01..7ea701081e3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -232,9 +232,12 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         NETTY_QUEUED_BUFFER = metricsContext.getSummary("netty_queued_buffer_capacity", DetailLevel.BASIC);
 
         DIGEST_MISMATCHES_COUNT = metricsContext.getCounter("digest_mismatches_count");
+
         TLS_HANDSHAKE_EXCEEDED = metricsContext.getCounter("tls_handshake_exceeded");
 
         CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING = metricsContext.getCounter("cnxn_closed_without_zk_server_running");
+
+        SOCKET_CLOSING_TIME = metricsContext.getSummary("socket_closing_time", DetailLevel.BASIC);
     }
 
     /**
@@ -455,6 +458,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
     public final Counter CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING;
 
+    public final Summary SOCKET_CLOSING_TIME;
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index da5f1132ada..0b807ef799e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -38,6 +38,7 @@
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 import javax.net.ssl.SSLSocket;
 import org.apache.jute.BinaryInputArchive;
@@ -46,10 +47,12 @@
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.TxnLogEntry;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
@@ -86,6 +89,7 @@ static class PacketInFlight {
 
     protected Socket sock;
     protected MultipleAddresses leaderAddr;
+    protected AtomicBoolean sockBeingClosed = new AtomicBoolean(false);
 
     /**
      * Socket getter
@@ -116,10 +120,14 @@ public Socket getSocket() {
 
     public static final String LEARNER_ASYNC_SENDING = "learner.asyncSending";
     private static boolean asyncSending = Boolean.getBoolean(LEARNER_ASYNC_SENDING);
+    public static final String LEARNER_CLOSE_SOCKET_ASYNC = "learner.closeSocketAsync";
+    public static final boolean closeSocketAsync = Boolean.getBoolean(LEARNER_CLOSE_SOCKET_ASYNC);
+
     static {
         LOG.info("leaderConnectDelayDuringRetryMs: {}", leaderConnectDelayDuringRetryMs);
         LOG.info("TCP NoDelay set to: {}", nodelay);
         LOG.info("{} = {}", LEARNER_ASYNC_SENDING, asyncSending);
+        LOG.info("{} = {}", LEARNER_CLOSE_SOCKET_ASYNC, closeSocketAsync);
     }
 
     final ConcurrentHashMap<Long, ServerCnxn> pendingRevalidations = new ConcurrentHashMap<Long, ServerCnxn>();
@@ -337,6 +345,7 @@ protected void connectToLeader(MultipleAddresses multiAddr, String hostname) thr
             throw new IOException("Failed connect to " + multiAddr);
         } else {
             sock = socket.get();
+            sockBeingClosed.set(false);
         }
 
         self.authLearner.authenticate(sock, hostname);
@@ -847,10 +856,27 @@ boolean isRunning() {
     }
 
     void closeSocket() {
+        if (sock != null) {
+            if (sockBeingClosed.compareAndSet(false, true)) {
+                if (closeSocketAsync) {
+                    final Thread closingThread = new Thread(() -> closeSockSync(), "CloseSocketThread(sid:" + zk.getServerId());
+                    closingThread.setDaemon(true);
+                    closingThread.start();
+                } else {
+                    closeSockSync();
+                }
+            }
+        }
+    }
+
+    void closeSockSync() {
         try {
+            long startTime = Time.currentElapsedTime();
             if (sock != null) {
                 sock.close();
+                sock = null;
             }
+            ServerMetrics.getMetrics().SOCKET_CLOSING_TIME.add(Time.currentElapsedTime() - startTime);
         } catch (IOException e) {
             LOG.warn("Ignoring error closing connection to leader", e);
         }

From ac4da3ebed34c536c4ea873503b0a6c036fa3910 Mon Sep 17 00:00:00 2001
From: Patrick Hunt <phunt@apache.org>
Date: Mon, 4 May 2020 06:49:35 +0000
Subject: [PATCH 025/591] ZOOKEEPER-3794: upgrade netty to address
 CVE-2020-11612 - fixed file rename typo

I borked the rename of the netty-codec file on the original submit. This fixes by renaming the one file appropriately.

Change-Id: Ifff1e7bb49b3d0a5816ee97161a4043be7cdaaa6

Author: Patrick Hunt <phunt@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1333 from phunt/ZOOKEEPER-3794_rename
---
 ....49.Final.LICENSE.txt => netty-codec-4.1.48.Final.LICENSE.txt} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.49.Final.LICENSE.txt => netty-codec-4.1.48.Final.LICENSE.txt} (100%)

diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.49.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.48.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.49.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.48.Final.LICENSE.txt

From f6b54a6cd227ac37f28803f45d7287c7fd3a8142 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Mon, 4 May 2020 14:13:41 +0200
Subject: [PATCH 026/591] ZOOKEEPER-3817: suppress log4j SmtpAppender related
 CVE-2020-9488

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1346 from symat/ZOOKEEPER-3817
---
 owaspSuppressions.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index ae94db494b9..2565f0db148 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -46,4 +46,9 @@
            ZOOKEEPER-3677 -->
       <cve>CVE-2019-17571</cve>
    </suppress>
+   <suppress>
+      <!-- it only affects the log4j SmtpAppender users. As Log4J 1.2 is EOL now, we can't fix this unless we
+           upgrade to log4j 2. See ZOOKEEPER-3817 -->
+      <cve>CVE-2020-9488</cve>
+   </suppress>
 </suppressions>

From 391cb4aa6b54e19a028215e1340232a114c23ed3 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Mon, 4 May 2020 14:17:33 +0200
Subject: [PATCH 027/591] ZOOKEEPER-3813: FileChangeWatcherTest is broken on
 Mac

This patch will increase the FS wait timeout to give Mac OSX longer time to detect file modifications.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Christopher Tubbs, Mate Szalay-Beko

Closes #1345 from anmolnar/ZOOKEEPER-3813
---
 .../zookeeper/common/FileChangeWatcherTest.java    | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
index bbac072833f..619ab1d9767 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
@@ -45,6 +45,8 @@ public class FileChangeWatcherTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(FileChangeWatcherTest.class);
 
+    private static final long FS_TIMEOUT = 30000L;
+
     @BeforeClass
     public static void createTempFile() throws IOException {
         tempDir = ClientBase.createEmptyTestDir();
@@ -87,7 +89,7 @@ public void testCallbackWorksOnFileChanges() throws IOException, InterruptedExce
                 FileUtils.writeStringToFile(tempFile, "Hello world " + i + "\n", StandardCharsets.UTF_8, true);
                 synchronized (events) {
                     if (events.size() < i + 1) {
-                        events.wait(3000L);
+                        events.wait(FS_TIMEOUT);
                     }
                     assertEquals("Wrong number of events", i + 1, events.size());
                     WatchEvent<?> event = events.get(i);
@@ -128,7 +130,7 @@ public void testCallbackWorksOnFileTouched() throws IOException, InterruptedExce
             FileUtils.touch(tempFile);
             synchronized (events) {
                 if (events.isEmpty()) {
-                    events.wait(3000L);
+                    events.wait(FS_TIMEOUT);
                 }
                 assertFalse(events.isEmpty());
                 WatchEvent<?> event = events.get(0);
@@ -162,7 +164,7 @@ public void testCallbackWorksOnFileAdded() throws IOException, InterruptedExcept
             tempFile2.deleteOnExit();
             synchronized (events) {
                 if (events.isEmpty()) {
-                    events.wait(3000L);
+                    events.wait(FS_TIMEOUT);
                 }
                 assertFalse(events.isEmpty());
                 WatchEvent<?> event = events.get(0);
@@ -201,7 +203,7 @@ public void testCallbackWorksOnFileDeleted() throws IOException, InterruptedExce
             tempFile.delete();
             synchronized (events) {
                 if (events.isEmpty()) {
-                    events.wait(3000L);
+                    events.wait(FS_TIMEOUT);
                 }
                 assertFalse(events.isEmpty());
                 WatchEvent<?> event = events.get(0);
@@ -239,14 +241,14 @@ public void testCallbackErrorDoesNotCrashWatcherThread() throws IOException, Int
             FileUtils.writeStringToFile(tempFile, "Hello world\n", StandardCharsets.UTF_8, true);
             synchronized (callCount) {
                 while (callCount.get() == 0) {
-                    callCount.wait(3000L);
+                    callCount.wait(FS_TIMEOUT);
                 }
             }
             LOG.info("Modifying file again");
             FileUtils.writeStringToFile(tempFile, "Hello world again\n", StandardCharsets.UTF_8, true);
             synchronized (callCount) {
                 if (callCount.get() == 1) {
-                    callCount.wait(3000L);
+                    callCount.wait(FS_TIMEOUT);
                 }
             }
             // The value of callCount can exceed 1 only if the callback thread

From bbe30290c2dd70bea20d3b08a0d705b10564c3b1 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Mon, 4 May 2020 14:19:04 +0200
Subject: [PATCH 028/591] ZOOKEEPER-3801: Fix Jenkins link

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko

Closes #1324 from ctubbsii/zk3801-fix-jenkins-link
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 7361dbae7c7..39e04805e8b 100755
--- a/pom.xml
+++ b/pom.xml
@@ -78,7 +78,7 @@
   </issueManagement>
   <ciManagement>
     <system>jenkins</system>
-    <url>https://builds.apache.org/view/S-Z/view/ZooKeeper/</url>
+    <url>https://builds.apache.org/view/Z/view/ZooKeeper/</url>
   </ciManagement>
   <mailingLists>
     <mailingList>

From 92f23ecd8159fd8d9c2fb8f34dd94f680ee6f712 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Mon, 4 May 2020 14:20:27 +0200
Subject: [PATCH 029/591] ZOOKEEPER-3791: Miscellaneous Maven fixes

* Fix fatjar and full-build profile problems with redundant module
  activation
* Remove "activeByDefault" profiles that don't do anything useful
* Make javadoc a bit quieter
* Fix assembly plugin warning about `/`
* Fix antrun warnings about tasks config renamed to target
* Fix docs module packaging (doesn't need to be jar)
* Fix zookeeper-it module by moving classes into standarad Maven
  directory layout and configuring surefire plugin to find the tests

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1314 from ctubbsii/misc-maven-fixes
---
 .travis.yml                                   |  2 +-
 pom.xml                                       | 56 ++++++++++---------
 zookeeper-assembly/pom.xml                    |  2 +-
 .../src/main/assembly/lib-package.xml         |  2 +-
 zookeeper-client/pom.xml                      |  7 +--
 zookeeper-client/zookeeper-client-c/pom.xml   | 28 ++++------
 zookeeper-contrib/pom.xml                     | 21 ++++---
 zookeeper-docs/pom.xml                        |  9 +--
 zookeeper-it/pom.xml                          | 29 ++++++----
 .../java}/org/apache/zookeeper/BenchMain.java |  0
 .../zookeeper/server/watch/WatchBench.java    |  0
 .../zookeeper/test/system/BaseSysTest.java    |  0
 .../test/system/DuplicateNameException.java   |  0
 .../zookeeper/test/system/GenerateLoad.java   |  0
 .../zookeeper/test/system/Instance.java       |  0
 .../test/system/InstanceContainer.java        |  0
 .../test/system/InstanceManager.java          |  0
 .../test/system/NoAssignmentException.java    |  0
 .../test/system/NoAvailableContainers.java    |  0
 .../test/system/QuorumPeerInstance.java       |  0
 .../zookeeper/test/system/SimpleClient.java   |  0
 .../zookeeper/test/system/SimpleSysTest.java  |  0
 zookeeper-jute/pom.xml                        |  1 -
 zookeeper-metrics-providers/pom.xml           |  1 -
 .../zookeeper-prometheus-metrics/pom.xml      |  1 -
 zookeeper-server/pom.xml                      |  1 -
 26 files changed, 76 insertions(+), 84 deletions(-)
 rename zookeeper-it/src/{test/bench => main/java}/org/apache/zookeeper/BenchMain.java (100%)
 rename zookeeper-it/src/{test/bench => main/java}/org/apache/zookeeper/server/watch/WatchBench.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/BaseSysTest.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/DuplicateNameException.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/GenerateLoad.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/Instance.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/InstanceContainer.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/InstanceManager.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/NoAssignmentException.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/NoAvailableContainers.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/SimpleClient.java (100%)
 rename zookeeper-it/src/{test => main}/java/org/apache/zookeeper/test/system/SimpleSysTest.java (100%)

diff --git a/.travis.yml b/.travis.yml
index fe2e952a1d9..7f320b9e005 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -26,7 +26,7 @@ addons:
     packages:
     - libcppunit-dev
 
-script: mvn clean apache-rat:check install -DskipTests spotbugs:check checkstyle:check -Pfull-build
+script: mvn clean apache-rat:check verify -DskipTests spotbugs:check checkstyle:check -Pfull-build
 
 branches:
   only:
diff --git a/pom.xml b/pom.xml
index 39e04805e8b..a3cb59d32ee 100755
--- a/pom.xml
+++ b/pom.xml
@@ -259,21 +259,19 @@
       <id>full-build</id>
       <modules>
         <module>zookeeper-contrib</module>
+        <!-- zookeeper-it needed by fatjar contrib -->
+        <module>zookeeper-it</module>
       </modules>
     </profile>
     <profile>
+      <!-- fatjar only profile; zookeeper-contrib will activate the fatjar in its pom -->
       <id>fatjar</id>
       <modules>
+        <module>zookeeper-contrib</module>
+        <!-- zookeeper-it needed by fatjar contrib -->
         <module>zookeeper-it</module>
-        <module>zookeeper-contrib/zookeeper-contrib-fatjar</module>
       </modules>
     </profile>
-    <profile>
-      <id>java-build</id>
-      <activation>
-        <activeByDefault>true</activeByDefault>
-      </activation>
-    </profile>
     <profile>
         <id>apache-release</id>
         <build>
@@ -446,7 +444,7 @@
     <commons-collections.version>3.2.2</commons-collections.version>
     <commons-lang.version>2.6</commons-lang.version>
     <dropwizard.version>3.2.5</dropwizard.version>
-    <spotbugsannotations.version>3.1.9</spotbugsannotations.version>
+    <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
     <checkstyle.version>8.17</checkstyle.version>
 
     <!-- parameters to pass to C client build -->
@@ -672,8 +670,9 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-javadoc-plugin</artifactId>
-          <version>3.0.1</version>
+          <version>3.1.1</version>
           <configuration>
+            <quiet>true</quiet>
             <doclint>none</doclint>
           </configuration>
         </plugin>
@@ -685,7 +684,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-release-plugin</artifactId>
-          <version>2.5.3</version>
+          <version>3.0.0-M1</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -738,7 +737,7 @@
         <plugin>
           <groupId>com.github.spotbugs</groupId>
           <artifactId>spotbugs-maven-plugin</artifactId>
-          <version>3.1.9</version>
+          <version>4.0.0</version>
           <configuration>
             <excludeFilterFile>excludeFindBugsFilter.xml</excludeFilterFile>
           </configuration>
@@ -958,23 +957,22 @@
             <exclude>src/main/resources/markdown/html/*</exclude>
             <exclude>src/main/resources/markdown/images/*</exclude>
             <!-- contrib -->
-            <exclude>zookeeper-contrib-monitoring/JMX-RESOURCES</exclude>
-            <exclude>zookeeper-contrib-fatjar/src/main/resources/mainClasses</exclude>
-            <exclude>zookeeper-contrib-zkperl/Changes</exclude>
-            <exclude>zookeeper-contrib-zkperl/MANIFEST</exclude>
-            <exclude>zookeeper-contrib-zkpython/src/test/zoo.cfg</exclude>
-            <exclude>zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
-            <exclude>src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
-            <exclude>src/main/java/com/nitido/utils/toaster/Toaster.java</exclude>
-            <exclude>TODO</exclude>
+            <exclude>**/JMX-RESOURCES</exclude>
+            <exclude>**/src/main/resources/mainClasses</exclude>
+            <exclude>**/Changes</exclude>
+            <exclude>**/MANIFEST</exclude>
+            <exclude>**/src/test/zoo.cfg</exclude>
+            <exclude>**/src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
+            <exclude>**/src/main/java/com/nitido/utils/toaster/Toaster.java</exclude>
+            <exclude>**/TODO</exclude>
             <!-- c client -->
             <exclude>**/acinclude.m4</exclude>
             <exclude>**/aminclude.am</exclude>
-            <exclude>src/hashtable/*</exclude>
-            <exclude>include/winconfig.h</exclude>
-            <exclude>tests/wrappers.opt</exclude>
-            <exclude>tests/zoo.cfg</exclude>
-            <exclude>tests/wrappers-mt.opt</exclude>
+            <exclude>**/src/hashtable/*</exclude>
+            <exclude>**/include/winconfig.h</exclude>
+            <exclude>**/tests/wrappers.opt</exclude>
+            <exclude>**/tests/zoo.cfg</exclude>
+            <exclude>**/tests/wrappers-mt.opt</exclude>
             <exclude>**/c-doc.Doxyfile</exclude>
           </excludes>
           <consoleOutput>true</consoleOutput>
@@ -986,8 +984,12 @@
           <inherited>false</inherited>
           <configuration>
             <!-- update the version inside the C sources -->
-            <preparationGoals>clean install -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</preparationGoals>
-            <completionGoals>clean install -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</completionGoals>
+            <preparationGoals>clean verify -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</preparationGoals>
+            <completionGoals>clean verify -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</completionGoals>
+            <pushChanges>false</pushChanges>
+            <localCheckout>true</localCheckout>
+            <autoVersionSubmodules>true</autoVersionSubmodules>
+            <tagNameFormat>release-@{project.version}</tagNameFormat>
           </configuration>
         </plugin>
         <plugin>
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index c2b97c0e6a3..8a2967fe616 100755
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -24,7 +24,6 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-assembly</artifactId>
@@ -53,6 +52,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-docs</artifactId>
       <version>${project.version}</version>
+      <type>pom</type>
     </dependency>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
diff --git a/zookeeper-assembly/src/main/assembly/lib-package.xml b/zookeeper-assembly/src/main/assembly/lib-package.xml
index 81194f9e64d..40336cee8fd 100644
--- a/zookeeper-assembly/src/main/assembly/lib-package.xml
+++ b/zookeeper-assembly/src/main/assembly/lib-package.xml
@@ -54,7 +54,7 @@
       <includes>
         <include>LICENSE</include>
       </includes>
-      <outputDirectory>/</outputDirectory>
+      <outputDirectory>.</outputDirectory>
       <fileMode>${rw.file.permission}</fileMode>
       <directoryMode>${rwx.file.permission}</directoryMode>
     </fileSet>
diff --git a/zookeeper-client/pom.xml b/zookeeper-client/pom.xml
index 307d60583fe..d42256c6155 100755
--- a/zookeeper-client/pom.xml
+++ b/zookeeper-client/pom.xml
@@ -24,7 +24,6 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-client</artifactId>
@@ -39,10 +38,6 @@
         <module>zookeeper-client-c</module>
       </modules>
     </profile>
-    <profile>
-      <id>java-build</id>
-      <modules />
-    </profile>
   </profiles>
   <build>
     <plugins>
@@ -55,4 +50,4 @@
       </plugin>
     </plugins>
   </build>
-</project>
\ No newline at end of file
+</project>
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
index e8ea1aa7a97..b66712dcd74 100755
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -24,14 +24,17 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-client</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-client-c</artifactId>
-  <packaging>jar</packaging>
+  <packaging>pom</packaging>
   <name>Apache ZooKeeper - Client - C</name>
   <description>ZooKeeper c client</description>
 
+  <properties>
+    <c-test-coverage-arg> </c-test-coverage-arg>
+  </properties>
+
   <profiles>
     <profile>
       <id>c-test-coverage</id>
@@ -39,15 +42,6 @@
         <c-test-coverage-arg>--enable-gcov</c-test-coverage-arg>
       </properties>
     </profile>
-    <profile>
-      <id>no-c-test-coverage</id>
-      <activation>
-        <activeByDefault>true</activeByDefault>
-      </activation>
-      <properties>
-        <c-test-coverage-arg> </c-test-coverage-arg>
-      </properties>
-    </profile>
   </profiles>
 
   <build>
@@ -104,9 +98,9 @@
             <id>generate-sources</id>
             <phase>generate-sources</phase>
             <configuration>
-              <tasks>
+              <target>
                 <mkdir dir="target/c" />
-              </tasks>
+              </target>
             </configuration>
             <goals>
               <goal>run</goal>
@@ -116,7 +110,7 @@
             <id>build-c-client</id>
             <phase>compile</phase>
             <configuration>
-              <tasks>
+              <target>
                 <exec dir="${basedir}/target/c" executable="make" failonerror="true">
                   <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
                   <env key="PATH" path="${env.PATH};${basedir};" />
@@ -125,7 +119,7 @@
                   <env key="base_dir" value="${basedir}/../.." />
                   <arg line="clean install" />
                 </exec>
-              </tasks>
+              </target>
             </configuration>
             <goals>
               <goal>run</goal>
@@ -137,7 +131,7 @@
             <configuration>
               <!-- do not run cpp tests if tests are globally skipped -->
               <skip>${skipTests}</skip>
-              <tasks>
+              <target>
                 <exec dir="${basedir}/target/c" executable="make" failonerror="true">
                   <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
                   <env key="PATH" path="${env.PATH};${basedir};" />
@@ -146,7 +140,7 @@
                   <env key="base_dir" value="${basedir}/../.." />
                   <arg line="check" />
                 </exec>
-              </tasks>
+              </target>
             </configuration>
             <goals>
               <goal>run</goal>
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index 0e2959d3be0..1d4cf74eca9 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -34,13 +34,20 @@
     Contrib projects to Apache ZooKeeper
   </description>
 
-  <modules>
-    <module>zookeeper-contrib-loggraph</module>
-    <module>zookeeper-contrib-rest</module>
-    <module>zookeeper-contrib-zooinspector</module>
-  </modules>
+  <properties>
+    <spotbugs.skip>true</spotbugs.skip>
+  </properties>
 
   <profiles>
+    <profile>
+      <id>full-build</id>
+      <modules>
+        <module>zookeeper-contrib-fatjar</module>
+        <module>zookeeper-contrib-loggraph</module>
+        <module>zookeeper-contrib-rest</module>
+        <module>zookeeper-contrib-zooinspector</module>
+      </modules>
+    </profile>
     <profile>
       <id>fatjar</id>
       <modules>
@@ -49,10 +56,6 @@
     </profile>
   </profiles>
 
-  <properties>
-    <spotbugs.skip>true</spotbugs.skip>
-  </properties>
-
   <build>
     <pluginManagement>
       <plugins>
diff --git a/zookeeper-docs/pom.xml b/zookeeper-docs/pom.xml
index a46b880dbc6..75fd65a3f94 100644
--- a/zookeeper-docs/pom.xml
+++ b/zookeeper-docs/pom.xml
@@ -24,12 +24,12 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-docs</artifactId>
   <name>Apache ZooKeeper - Documentation</name>
   <description>Documentation</description>
+  <packaging>pom</packaging>
 
   <build>
     <plugins>
@@ -58,13 +58,6 @@
           <skip>true</skip>
         </configuration>
       </plugin>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-javadoc-plugin</artifactId>
-        <configuration>
-          <skip>true</skip>
-        </configuration>
-      </plugin>
     </plugins>
   </build>
 </project>
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
index 163930fa3c5..10f8b9d14b0 100755
--- a/zookeeper-it/pom.xml
+++ b/zookeeper-it/pom.xml
@@ -33,6 +33,13 @@
     ZooKeeper system tests
   </description>
 
+  <!-- (temporarily) disable quality checks in this module for known failures to be fixed later -->
+  <properties>
+    <skipTests>true</skipTests>
+    <spotbugs.skip>true</spotbugs.skip>
+    <checkstyle.skip>true</checkstyle.skip>
+  </properties>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
@@ -63,15 +70,17 @@
   </dependencies>
 
   <build>
-    <sourceDirectory>src</sourceDirectory>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-javadoc-plugin</artifactId>
-        <configuration>
-          <sourcepath>src</sourcepath>
-        </configuration>
-      </plugin>
-    </plugins>
+    <pluginManagement>
+      <plugins>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-surefire-plugin</artifactId>
+          <configuration>
+            <testSourceDirectory>${project.basedir}/src/main/java/</testSourceDirectory>
+            <testClassesDirectory>${project.build.directory}/classes/</testClassesDirectory>
+          </configuration>
+        </plugin>
+      </plugins>
+    </pluginManagement>
   </build>
 </project>
diff --git a/zookeeper-it/src/test/bench/org/apache/zookeeper/BenchMain.java b/zookeeper-it/src/main/java/org/apache/zookeeper/BenchMain.java
similarity index 100%
rename from zookeeper-it/src/test/bench/org/apache/zookeeper/BenchMain.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/BenchMain.java
diff --git a/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
similarity index 100%
rename from zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/BaseSysTest.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/BaseSysTest.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/DuplicateNameException.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/DuplicateNameException.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/DuplicateNameException.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/DuplicateNameException.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/GenerateLoad.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/GenerateLoad.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/Instance.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/Instance.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/Instance.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/Instance.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceContainer.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceContainer.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceManager.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceManager.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceManager.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceManager.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAssignmentException.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAssignmentException.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAssignmentException.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAssignmentException.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAvailableContainers.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAvailableContainers.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAvailableContainers.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAvailableContainers.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleClient.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleClient.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleClient.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleClient.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleSysTest.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleSysTest.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleSysTest.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleSysTest.java
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index 13fe7c80681..129ba12ce08 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -24,7 +24,6 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-jute</artifactId>
diff --git a/zookeeper-metrics-providers/pom.xml b/zookeeper-metrics-providers/pom.xml
index f07551bd50b..a9b18d98999 100755
--- a/zookeeper-metrics-providers/pom.xml
+++ b/zookeeper-metrics-providers/pom.xml
@@ -24,7 +24,6 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-metrics-providers</artifactId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index c6b5f133a34..68e7eb62cbd 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -24,7 +24,6 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-metrics-providers</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper-prometheus-metrics</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 117a77b8ec7..90f6151584e 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -24,7 +24,6 @@
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
     <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
   </parent>
 
   <artifactId>zookeeper</artifactId>

From 44de549657a539dcedba58d56e67b8c906c89580 Mon Sep 17 00:00:00 2001
From: lingjinjiang <lingjinjiang@gmail.com>
Date: Tue, 5 May 2020 09:18:18 +0200
Subject: [PATCH 030/591] ZOOKEEPER-3772: JettyAdminServer should not allow
 Http TRACE method

A nessus scan pinged the cluster after I upgrade my zookeeper cluster, because the 8080 port of JettyAdminServer allows Http TRACE method.

Author: lingjinjiang <lingjinjiang@gmail.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Andor Molnar <andor@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1296 from lingjinjiang/master
---
 .../server/admin/JettyAdminServer.java        | 22 +++++++++++++++++++
 .../server/admin/JettyAdminServerTest.java    | 20 +++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 27242436cff..6845f233e24 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -34,6 +34,8 @@
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.eclipse.jetty.http.HttpVersion;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
 import org.eclipse.jetty.server.HttpConfiguration;
 import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.SecureRequestCustomizer;
@@ -41,6 +43,7 @@
 import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.security.Constraint;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -153,6 +156,7 @@ public JettyAdminServer(
 
         ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
         context.setContextPath("/*");
+        constrainTraceMethod(context);
         server.setHandler(context);
 
         context.addServlet(new ServletHolder(new CommandServlet()), commandUrl + "/*");
@@ -266,4 +270,22 @@ private List<String> commandLinks() {
         return links;
     }
 
+    /**
+     * Add constraint to a given context to disallow TRACE method
+     * @param ctxHandler the context to modify
+     */
+    private void constrainTraceMethod(ServletContextHandler ctxHandler) {
+        Constraint c = new Constraint();
+        c.setAuthenticate(true);
+
+        ConstraintMapping cmt = new ConstraintMapping();
+        cmt.setConstraint(c);
+        cmt.setMethod("TRACE");
+        cmt.setPathSpec("/*");
+
+        ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
+        securityHandler.setConstraintMappings(new ConstraintMapping[] {cmt});
+
+        ctxHandler.setSecurityHandler(securityHandler);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 525c1c971f9..4e77a6bb9c7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -18,11 +18,13 @@
 
 package org.apache.zookeeper.server.admin;
 
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
 import java.net.URL;
 import java.security.GeneralSecurityException;
 import java.security.Security;
@@ -152,6 +154,7 @@ public void testJettyAdminServer() throws AdminServerException, IOException, SSL
         try {
             server.start();
             queryAdminServer(jettyAdminPort);
+            traceAdminServer(jettyAdminPort);
         } finally {
             server.shutdown();
         }
@@ -262,4 +265,21 @@ private void queryAdminServer(String urlStr, boolean encrypted) throws IOExcepti
         assertTrue(line.length() > 0);
     }
 
+    /**
+     * Using TRACE method to visit admin server
+     */
+    private void traceAdminServer(int port) throws IOException {
+      traceAdminServer(String.format(URL_FORMAT, port));
+      traceAdminServer(String.format(HTTPS_URL_FORMAT, port));
+    }
+
+    /**
+     * Using TRACE method to visit admin server, the response should be 403 forbidden
+     */
+    private void traceAdminServer(String urlStr) throws IOException {
+        HttpURLConnection conn = (HttpURLConnection) new URL(urlStr).openConnection();
+        conn.setRequestMethod("TRACE");
+        conn.connect();
+        assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+    }
 }

From 05cd214a0cc9c870de373b54cfeb47a2a75efd28 Mon Sep 17 00:00:00 2001
From: Mayank Tuteja <mayank99@fb.com>
Date: Tue, 5 May 2020 19:20:35 +0000
Subject: [PATCH 031/591] ZOOKEEPER-3796: Skip Learner Request made to
 ObserverMaster from going

... to next processor

Author: mayank99 <mayank99@devvm2541.prn3.facebook.com>
Author: mayank99fb <63824268+mayank99fb@users.noreply.github.com>

Reviewers: Andor Molnar <andor@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1322 from mayank99fb/ZOOKEEPER-3796
---
 .../main/resources/markdown/zookeeperAdmin.md |   9 +
 .../org/apache/zookeeper/server/Request.java  |   5 +
 .../zookeeper/server/ServerMetrics.java       |   6 +
 .../quorum/FollowerRequestProcessor.java      |  19 +-
 .../server/FollowerRequestProcessorTest.java  |  89 ++++++++
 .../zookeeper/test/ObserverMasterTest.java    | 196 +-----------------
 .../test/ObserverMasterTestBase.java          | 120 +++++++++++
 7 files changed, 249 insertions(+), 195 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 6c616d1af68..2a9d7d3c731 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1653,6 +1653,15 @@ New features that are currently considered experimental.
     values and see changes from other clients. See
     ZOOKEEPER-784 for more details.
 
+* *zookeeper.follower.skipLearnerRequestToNextProcessor* :
+    (Java system property: **zookeeper.follower.skipLearnerRequestToNextProcessor**)
+    When our cluster has observers which are connected with ObserverMaster, then turning on this flag might help
+    you reduce some memory pressure on the Observer Master. If your cluster doesn't have any observers or
+    they are not connected with ObserverMaster or your Observer's don't make much writes, then using this flag
+    won't help you.
+    Currently the change here is guarded behind the flag to help us get more confidence around the memory gains.
+    In Long run, we might want to remove this flag and set its behavior as the default codepath.
+
 <a name="Unsafe+Options"></a>
 
 #### Unsafe Options
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 43a68ac7aa2..42964712bb0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -27,6 +27,7 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.txn.TxnDigest;
@@ -490,4 +491,8 @@ public TxnDigest getTxnDigest() {
     public void setTxnDigest(TxnDigest txnDigest) {
         this.txnDigest = txnDigest;
     }
+
+    public boolean isFromLearner() {
+        return owner instanceof LearnerHandler;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 7ea701081e3..36a65df801f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -237,7 +237,10 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING = metricsContext.getCounter("cnxn_closed_without_zk_server_running");
 
+        SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT = metricsContext.getCounter("skip_learner_request_to_next_processor_count");
+
         SOCKET_CLOSING_TIME = metricsContext.getSummary("socket_closing_time", DetailLevel.BASIC);
+
     }
 
     /**
@@ -458,8 +461,11 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
     public final Counter CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING;
 
+    public final Counter SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT;
+
     public final Summary SOCKET_CLOSING_TIME;
 
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index db51aee495d..90c4d490344 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -24,6 +24,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperCriticalThread;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.txn.ErrorTxn;
@@ -38,6 +39,10 @@ public class FollowerRequestProcessor extends ZooKeeperCriticalThread implements
 
     private static final Logger LOG = LoggerFactory.getLogger(FollowerRequestProcessor.class);
 
+    public static final String SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR = "zookeeper.follower.skipLearnerRequestToNextProcessor";
+
+    private final boolean skipLearnerRequestToNextProcessor;
+
     FollowerZooKeeperServer zks;
 
     RequestProcessor nextProcessor;
@@ -50,6 +55,9 @@ public FollowerRequestProcessor(FollowerZooKeeperServer zks, RequestProcessor ne
         super("FollowerRequestProcessor:" + zks.getServerId(), zks.getZooKeeperServerListener());
         this.zks = zks;
         this.nextProcessor = nextProcessor;
+        this.skipLearnerRequestToNextProcessor = Boolean.getBoolean(SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR);
+        LOG.info("Initialized FollowerRequestProcessor with {} as {}", SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR,
+                skipLearnerRequestToNextProcessor);
     }
 
     @Override
@@ -72,7 +80,8 @@ public void run() {
                 // We want to queue the request to be processed before we submit
                 // the request to the leader so that we are ready to receive
                 // the response
-                nextProcessor.processRequest(request);
+                maybeSendRequestToNextProcessor(request);
+
                 if (request.isThrottled()) {
                     continue;
                 }
@@ -115,6 +124,14 @@ public void run() {
         LOG.info("FollowerRequestProcessor exited loop!");
     }
 
+    private void maybeSendRequestToNextProcessor(Request request) throws RequestProcessorException {
+        if (skipLearnerRequestToNextProcessor && request.isFromLearner()) {
+            ServerMetrics.getMetrics().SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT.add(1);
+        } else {
+            nextProcessor.processRequest(request);
+        }
+    }
+
     public void processRequest(Request request) {
         processRequest(request, true);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
new file mode 100644
index 00000000000..dd81c77eec5
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.ZooKeeper.States;
+import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.util.PortForwarder;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ObserverMasterTestBase;
+import org.junit.After;
+import org.junit.Test;
+
+public class FollowerRequestProcessorTest extends ObserverMasterTestBase {
+
+    private PortForwarder forwarder;
+
+    @Test
+    public void testFollowerRequestProcessorSkipsLearnerRequestToNextProcessor() throws Exception {
+        setupTestObserverServer("true");
+
+        zk.create("/testFollowerSkipNextAProcessor", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        assertEquals("test", new String(zk.getData("/testFollowerSkipNextAProcessor", null, null)));
+        assertEquals(1L, ServerMetrics.getMetrics().SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT.get());
+    }
+
+    @Test
+    public void testFollowerRequestProcessorSendsLearnerRequestToNextProcessor() throws Exception {
+        setupTestObserverServer("false");
+
+        zk.create("/testFollowerSkipNextAProcessor", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        assertEquals("test", new String(zk.getData("/testFollowerSkipNextAProcessor", null, null)));
+        assertEquals(0L, ServerMetrics.getMetrics().SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT.get());
+    }
+
+    private void setupTestObserverServer(String skipLearnerRequestToNextProcessor) throws Exception {
+        System.setProperty(FollowerRequestProcessor.SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR, skipLearnerRequestToNextProcessor);
+
+        // Setup Ensemble with observer master port so that observer connects with Observer master and not the leader
+        final int OM_PROXY_PORT = PortAssignment.unique();
+        forwarder = setUp(OM_PROXY_PORT, true);
+
+        q3.start();
+        assertTrue(
+            "waiting for server 3 being up",
+            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+
+        // Connect with observer zookeeper
+        zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
+        waitForOne(zk, States.CONNECTED);
+
+        // Clear all service metrics collected so far
+        ServerMetrics.getMetrics().resetAll();
+    }
+
+    @After
+    public void cleanup() throws Exception {
+        System.setProperty(FollowerRequestProcessor.SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR, "false");
+
+        shutdown();
+        if (forwarder != null) {
+            forwarder.shutdown();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index 620953a2db5..cfac042b7ac 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -50,8 +50,6 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.ConnectionLossException;
 import org.apache.zookeeper.PortAssignment;
-import org.apache.zookeeper.WatchedEvent;
-import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
@@ -60,10 +58,7 @@
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
 import org.apache.zookeeper.server.admin.Commands;
-import org.apache.zookeeper.server.quorum.DelayRequestProcessor;
-import org.apache.zookeeper.server.quorum.FollowerZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.server.util.PortForwarder;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -72,7 +67,7 @@
 import org.slf4j.LoggerFactory;
 
 @RunWith(Parameterized.class)
-public class ObserverMasterTest extends QuorumPeerTestBase implements Watcher {
+public class ObserverMasterTest extends ObserverMasterTestBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(ObserverMasterTest.class);
 
@@ -87,184 +82,8 @@ public static List<Object[]> data() {
 
     private Boolean testObserverMaster;
 
-    private CountDownLatch latch;
-    ZooKeeper zk;
-    private WatchedEvent lastEvent = null;
-
-    private int CLIENT_PORT_QP1;
-    private int CLIENT_PORT_QP2;
-    private int CLIENT_PORT_OBS;
-    private int OM_PORT;
-    private MainThread q1;
-    private MainThread q2;
-    private MainThread q3;
-
     private PortForwarder setUp(final int omProxyPort) throws IOException {
-        ClientBase.setupTestEnv();
-
-        final int PORT_QP1 = PortAssignment.unique();
-        final int PORT_QP2 = PortAssignment.unique();
-        final int PORT_OBS = PortAssignment.unique();
-        final int PORT_QP_LE1 = PortAssignment.unique();
-        final int PORT_QP_LE2 = PortAssignment.unique();
-        final int PORT_OBS_LE = PortAssignment.unique();
-
-        CLIENT_PORT_QP1 = PortAssignment.unique();
-        CLIENT_PORT_QP2 = PortAssignment.unique();
-        CLIENT_PORT_OBS = PortAssignment.unique();
-
-        OM_PORT = PortAssignment.unique();
-
-        String quorumCfgSection = "server.1=127.0.0.1:" + (PORT_QP1) + ":" + (PORT_QP_LE1) + ";" + CLIENT_PORT_QP1
-                                  + "\nserver.2=127.0.0.1:" + (PORT_QP2) + ":" + (PORT_QP_LE2) + ";" + CLIENT_PORT_QP2
-                                  + "\nserver.3=127.0.0.1:" + (PORT_OBS) + ":" + (PORT_OBS_LE) + ":observer" + ";" + CLIENT_PORT_OBS;
-        String extraCfgs = testObserverMaster
-                ? String.format("observerMasterPort=%d%n", OM_PORT)
-                : "";
-        String extraCfgsObs = testObserverMaster
-            ? String.format("observerMasterPort=%d%n", omProxyPort <= 0 ? OM_PORT : omProxyPort)
-            : "";
-
-        PortForwarder forwarder = null;
-        if (testObserverMaster && omProxyPort >= 0) {
-            forwarder = new PortForwarder(omProxyPort, OM_PORT);
-        }
-
-        q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSection, extraCfgs);
-        q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSection, extraCfgs);
-        q3 = new MainThread(3, CLIENT_PORT_OBS, quorumCfgSection, extraCfgsObs);
-        q1.start();
-        q2.start();
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
-        return forwarder;
-    }
-
-    private void shutdown() throws InterruptedException {
-        LOG.info("Shutting down all servers");
-        zk.close();
-
-        q1.shutdown();
-        q2.shutdown();
-        q3.shutdown();
-
-        assertTrue(
-            "Waiting for server 1 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "Waiting for server 2 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "Waiting for server 3 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT));
-    }
-
-    @Test
-    public void testLaggingObserverMaster() throws Exception {
-        final int OM_PROXY_PORT = PortAssignment.unique();
-        PortForwarder forwarder = setUp(OM_PROXY_PORT);
-
-        // find the leader and observer master
-        int leaderPort;
-        MainThread leader;
-        MainThread follower;
-        if (q1.getQuorumPeer().leader != null) {
-            leaderPort = CLIENT_PORT_QP1;
-            leader = q1;
-            follower = q2;
-        } else if (q2.getQuorumPeer().leader != null) {
-            leaderPort = CLIENT_PORT_QP2;
-            leader = q2;
-            follower = q1;
-        } else {
-            throw new RuntimeException("No leader");
-        }
-
-        // ensure the observer master has commits in the queue before observer sync
-        zk = new ZooKeeper("127.0.0.1:" + leaderPort, ClientBase.CONNECTION_TIMEOUT, this);
-        for (int i = 0; i < 10; i++) {
-            zk.create("/bulk" + i, ("initial data of some size").getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        }
-        zk.close();
-
-        q3.start();
-        assertTrue(
-            "waiting for server 3 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
-
-        latch = new CountDownLatch(1);
-        zk = new ZooKeeper("127.0.0.1:" + leaderPort, ClientBase.CONNECTION_TIMEOUT, this);
-        latch.await();
-        assertEquals(zk.getState(), States.CONNECTED);
-
-        zk.create("/init", "first".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final long lastLoggedZxid = leader.getQuorumPeer().getLastLoggedZxid();
-
-        // wait for change to propagate
-        waitFor("Timeout waiting for observer sync", new WaitForCondition() {
-            public boolean evaluate() {
-                return lastLoggedZxid == q3.getQuorumPeer().getLastLoggedZxid();
-            }
-        }, 30);
-
-        // simulate network fault
-        if (forwarder != null) {
-            forwarder.shutdown();
-        }
-
-        for (int i = 0; i < 10; i++) {
-            zk.create("/basic" + i, "second".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        }
-
-        DelayRequestProcessor delayRequestProcessor = null;
-        if (testObserverMaster) {
-            FollowerZooKeeperServer followerZooKeeperServer = (FollowerZooKeeperServer) follower.getQuorumPeer().getActiveServer();
-            delayRequestProcessor = DelayRequestProcessor.injectDelayRequestProcessor(followerZooKeeperServer);
-        }
-
-        zk.create("/target1", "third".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/target2", "third".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-
-        LOG.info(
-            "observer zxid {}{} leader zxid {}",
-            Long.toHexString(q3.getQuorumPeer().getLastLoggedZxid()),
-            (testObserverMaster ? "" : " observer master zxid " + Long.toHexString(follower.getQuorumPeer().getLastLoggedZxid())),
-            Long.toHexString(leader.getQuorumPeer().getLastLoggedZxid()));
-
-        // restore network
-        forwarder = testObserverMaster ? new PortForwarder(OM_PROXY_PORT, OM_PORT) : null;
-
-        assertTrue(
-            "waiting for server 3 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
-        assertNotNull("Leader switched", leader.getQuorumPeer().leader);
-
-        if (delayRequestProcessor != null) {
-            delayRequestProcessor.unblockQueue();
-        }
-
-        latch = new CountDownLatch(1);
-        ZooKeeper obsZk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
-        latch.await();
-        zk.create("/finalop", "fourth".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-
-        assertEquals("first", new String(obsZk.getData("/init", null, null)));
-        assertEquals("third", new String(obsZk.getData("/target1", null, null)));
-
-        obsZk.close();
-        shutdown();
-
-        try {
-            if (forwarder != null) {
-                forwarder.shutdown();
-            }
-        } catch (Exception e) {
-            // ignore
-        }
+        return setUp(omProxyPort, testObserverMaster);
     }
 
     /**
@@ -678,17 +497,6 @@ public void testDynamicReconfig() throws InterruptedException, IOException, Keep
         s1.shutdown();
     }
 
-    /**
-     * Implementation of watcher interface.
-     */
-    public void process(WatchedEvent event) {
-        lastEvent = event;
-        if (latch != null) {
-            latch.countDown();
-        }
-        LOG.info("Latch got event :: {}", event);
-    }
-
     class AsyncWriter implements Runnable {
 
         private final ZooKeeper client;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
new file mode 100644
index 00000000000..505378a5f1e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
@@ -0,0 +1,120 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.Assert.assertTrue;
+import java.io.IOException;
+import java.util.concurrent.CountDownLatch;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.server.util.PortForwarder;
+
+public class ObserverMasterTestBase extends QuorumPeerTestBase implements Watcher {
+
+    protected CountDownLatch latch;
+    protected ZooKeeper zk;
+    protected int CLIENT_PORT_QP1;
+    protected int CLIENT_PORT_QP2;
+    protected int CLIENT_PORT_OBS;
+    protected int OM_PORT;
+    protected MainThread q1;
+    protected MainThread q2;
+    protected MainThread q3;
+    protected WatchedEvent lastEvent = null;
+
+    protected PortForwarder setUp(final int omProxyPort, final Boolean testObserverMaster) throws IOException {
+        ClientBase.setupTestEnv();
+        final int PORT_QP1 = PortAssignment.unique();
+        final int PORT_QP2 = PortAssignment.unique();
+        final int PORT_OBS = PortAssignment.unique();
+        final int PORT_QP_LE1 = PortAssignment.unique();
+        final int PORT_QP_LE2 = PortAssignment.unique();
+        final int PORT_OBS_LE = PortAssignment.unique();
+
+        CLIENT_PORT_QP1 = PortAssignment.unique();
+        CLIENT_PORT_QP2 = PortAssignment.unique();
+        CLIENT_PORT_OBS = PortAssignment.unique();
+
+        OM_PORT = PortAssignment.unique();
+
+        String quorumCfgSection =
+                "server.1=127.0.0.1:" + (PORT_QP1)
+                        + ":" + (PORT_QP_LE1) + ";" +  CLIENT_PORT_QP1
+                        + "\nserver.2=127.0.0.1:" + (PORT_QP2)
+                        + ":" + (PORT_QP_LE2) + ";" + CLIENT_PORT_QP2
+                        + "\nserver.3=127.0.0.1:" + (PORT_OBS)
+                        + ":" + (PORT_OBS_LE) + ":observer" + ";" + CLIENT_PORT_OBS;
+
+        String extraCfgs = testObserverMaster ? String.format("observerMasterPort=%d%n", OM_PORT) : "";
+        String extraCfgsObs = testObserverMaster ? String.format("observerMasterPort=%d%n", omProxyPort <= 0 ? OM_PORT : omProxyPort) : "";
+
+        PortForwarder forwarder = null;
+        if (testObserverMaster && omProxyPort >= 0) {
+            forwarder = new PortForwarder(omProxyPort, OM_PORT);
+        }
+
+        q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSection, extraCfgs);
+        q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSection, extraCfgs);
+        q3 = new MainThread(3, CLIENT_PORT_OBS, quorumCfgSection, extraCfgsObs);
+        q1.start();
+        q2.start();
+        assertTrue(
+            "waiting for server 1 being up",
+            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
+        assertTrue(
+            "waiting for server 2 being up",
+            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        return forwarder;
+    }
+
+    protected void shutdown() throws InterruptedException {
+        LOG.info("Shutting down all servers");
+
+        zk.close();
+
+        q1.shutdown();
+        q2.shutdown();
+        q3.shutdown();
+
+        assertTrue(
+            "Waiting for server 1 to shut down",
+            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(
+            "Waiting for server 2 to shut down",
+            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(
+            "Waiting for server 3 to shut down",
+            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT));
+    }
+
+    /**
+     * Implementation of watcher interface.
+     */
+    public void process(WatchedEvent event) {
+        lastEvent = event;
+        if (latch != null) {
+            latch.countDown();
+        }
+        LOG.info("Latch got event :: {}", event);
+    }
+}

From ae7f72d31e4dc9c6e307b1c14271e74950b022dc Mon Sep 17 00:00:00 2001
From: javhu <13621135641@163.com>
Date: Thu, 7 May 2020 14:54:59 -0700
Subject: [PATCH 032/591] ZOOKEEPER-3805: NIOServerCnxnFactory static block has
 no used code

the jvm bug: JDK-6427854 : (se) NullPointerException in Selector.open()
has been fixed in JDK7 b08

Author: javhu <13621135641@163.com>

Reviewers: ctubbsii@apache.org, symat@apache.org, eolivelli@apache.org, fangmin@apache.org

Closes #1338 from Javhu/ZOOKEEPER-3805
---
 .../apache/zookeeper/server/NIOServerCnxnFactory.java  | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index de29fa2424d..558b93be59b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -87,16 +87,6 @@ public void uncaughtException(Thread t, Throwable e) {
                 LOG.error("Thread {} died", t, e);
             }
         });
-        /**
-         * this is to avoid the jvm bug:
-         * NullPointerException in Selector.open()
-         * http://bugs.sun.com/view_bug.do?bug_id=6427854
-         */
-        try {
-            Selector.open().close();
-        } catch (IOException ie) {
-            LOG.error("Selector failed to open", ie);
-        }
 
         /**
          * Value of 0 disables use of direct buffers and instead uses

From c56506162bfde339e801743396361862cc8c5b41 Mon Sep 17 00:00:00 2001
From: asutosh936 <asutosh.pandya@hotmail.com>
Date: Tue, 12 May 2020 09:39:58 +0000
Subject: [PATCH 033/591] ZOOKEEPER-3761: Upgrade JLine version to 2.14.6

Author: asutosh936 <asutosh.pandya@hotmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1292 from asutosh936/ZOOKEEPER-3761
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a3cb59d32ee..c0dbbee7a97 100755
--- a/pom.xml
+++ b/pom.xml
@@ -437,7 +437,7 @@
     <jetty.version>9.4.24.v20191120</jetty.version>
     <jackson.version>2.10.3</jackson.version>
     <json.version>1.1.1</json.version>
-    <jline.version>2.11</jline.version>
+    <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.60</bouncycastle.version>

From 236e3d9183606512f0e03a1f828ad0d392eb6091 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Tue, 12 May 2020 09:53:40 +0000
Subject: [PATCH 034/591] ZOOKEEPER-3818: client SSL support for zkServer.sh
 status command

When the ZooKeeper cluster is started in client SSL-only mode (omitting the clientPort
from the zoo.cfg), then the current `zkServer.sh status` command fails to connect to
the server.

**This patch contains:**

- a fix for the zkServer.sh to fall-back to SSL connetion if no unsecure port is defined
- documenting the necessary system properties one needs to define in this case
- some formatting fixes in the `zookeeperTools.md` file to get proper code blocks generated

**Hints for testing:**

you can generate SSL certificate files e.g. by:
```
mkdir -p /tmp/ssl
mkdir -p /tmp/zkdata
cp ./zookeeper-client/zookeeper-client-c/ssl/gencerts.sh /tmp/ssl/
cd /tmp/ssl/
./gencerts.sh localhost
```

then you can change your zoo.cfg:
```
tickTime=3000
initLimit=10
syncLimit=5
dataDir=/tmp/zkdata

secureClientPort=22281
# clientPort=2181
serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
ssl.keyStore.location=/tmp/ssl/server.jks
ssl.keyStore.password=password
ssl.trustStore.location=/tmp/ssl/servertrust.jks
ssl.trustStore.password=password
```

then start ZooKeeper: `./bin/zkServer.sh start-foreground`

then you can run `zkServer.sh status` like:
```
CLIENT_JVMFLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty -Dzookeeper.ssl.trustStore.location=/tmp/ssl/clienttrust.jks -Dzookeeper.ssl.trustStore.password=password -Dzookeeper.ssl.keyStore.location=/tmp/ssl/client.jks -Dzookeeper.ssl.keyStore.password=password -Dzookeeper.client.secure=true " ./bin/zkServer.sh status
```

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Aishwarya Soni <aishwarya.vsoni@gmail.com>, Norbert Kalmar <nkalmar@apache.org>

Closes #1348 from symat/ZOOKEEPER-3818
---
 bin/zkServer.sh                               | 83 ++++++++++++-------
 .../main/resources/markdown/zookeeperAdmin.md |  8 +-
 .../main/resources/markdown/zookeeperTools.md |  8 ++
 3 files changed, 64 insertions(+), 35 deletions(-)

diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index 10ead606b2d..f5113a9a3a0 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -235,51 +235,70 @@ restart)
     ;;
 status)
     # -q is necessary on some versions of linux where nc returns too quickly, and no stat result is output
+    isSSL="false"
     clientPortAddress=`$GREP "^[[:space:]]*clientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
     if ! [ $clientPortAddress ]
     then
-	clientPortAddress="localhost"
+	      clientPortAddress="localhost"
     fi
     clientPort=`$GREP "^[[:space:]]*clientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
     if ! [[ "$clientPort"  =~ ^[0-9]+$ ]]
     then
-       dataDir=`$GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//'`
-       myid=`cat "$dataDir/myid"`
-       if ! [[ "$myid" =~ ^[0-9]+$ ]] ; then
-         echo "clientPort not found and myid could not be determined. Terminating."
-         exit 1
-       fi
-       clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$ZOOCFG" | sed -e 's/.*=//' | sed -e 's/.*;//'`
-       if [ ! "$clientPortAndAddress" ] ; then
-           echo "Client port not found in static config file. Looking in dynamic config file."
-           dynamicConfigFile=`$GREP "^[[:space:]]*dynamicConfigFile" "$ZOOCFG" | sed -e 's/.*=//'`
-           clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$dynamicConfigFile" | sed -e 's/.*=//' | sed -e 's/.*;//'`
-       fi
-       if [ ! "$clientPortAndAddress" ] ; then
-          echo "Client port not found. Terminating."
-          exit 1
-       fi
-       if [[ "$clientPortAndAddress" =~ ^.*:[0-9]+ ]] ; then
-          clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's/:.*//'`
-       fi
-       clientPort=`echo "$clientPortAndAddress" | sed -e 's/.*://'`
-       if [ ! "$clientPort" ] ; then
-          echo "Client port not found. Terminating."
-          exit 1
-       fi
+      dataDir=`$GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//'`
+      myid=`cat "$dataDir/myid" 2> /dev/null`
+      if ! [[ "$myid" =~ ^[0-9]+$ ]] ; then
+        echo "myid could not be determined, will not able to locate clientPort in the server configs."
+      else
+        clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$ZOOCFG" | sed -e 's/.*=//' | sed -e 's/.*;//'`
+        if [ ! "$clientPortAndAddress" ] ; then
+          echo "Client port not found in static config file. Looking in dynamic config file."
+          dynamicConfigFile=`$GREP "^[[:space:]]*dynamicConfigFile" "$ZOOCFG" | sed -e 's/.*=//'`
+          clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$dynamicConfigFile" | sed -e 's/.*=//' | sed -e 's/.*;//'`
+        fi
+        if [ ! "$clientPortAndAddress" ] ; then
+          echo "Client port not found in the server configs"
+        else
+          if [[ "$clientPortAndAddress" =~ ^.*:[0-9]+ ]] ; then
+            clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's/:.*//'`
+          fi
+          clientPort=`echo "$clientPortAndAddress" | sed -e 's/.*://'`
+        fi
+      fi
     fi
-    echo "Client port found: $clientPort. Client address: $clientPortAddress."
+    if [ ! "$clientPort" ] ; then
+      echo "Client port not found. Looking for secureClientPort in the static config."
+      secureClientPort=`$GREP "^[[:space:]]*secureClientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
+      if [ "$secureClientPort" ] ; then
+        isSSL="true"
+        clientPort=$secureClientPort
+      else
+        echo "Unable to find either secure or unsecure client port in any configs. Terminating."
+        exit 1
+      fi
+    fi
+    echo "Client port found: $clientPort. Client address: $clientPortAddress. Client SSL: $isSSL."
     STAT=`"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-             -cp "$CLASSPATH" $JVMFLAGS org.apache.zookeeper.client.FourLetterWordMain \
-             $clientPortAddress $clientPort srvr 2> /dev/null    \
+          -cp "$CLASSPATH" $CLIENT_JVMFLAGS $JVMFLAGS org.apache.zookeeper.client.FourLetterWordMain \
+          $clientPortAddress $clientPort srvr $isSSL 2> /dev/null    \
           | $GREP Mode`
     if [ "x$STAT" = "x" ]
     then
-        echo "Error contacting service. It is probably not running."
-        exit 1
+      if [ "$isSSL" = "true" ] ; then
+        echo " "
+        echo "Note: We used secureClientPort ($secureClientPort) to establish connection, but we failed. The 'status'"
+        echo "  command establishes a client connection to the server to execute diagnostic commands. Please make sure you"
+        echo "  provided all the Client SSL connection related parameters in the CLIENT_JVMFLAGS environment variable! E.g.:"
+        echo "  CLIENT_JVMFLAGS=\"-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty"
+        echo "  -Dzookeeper.ssl.trustStore.location=/tmp/clienttrust.jks -Dzookeeper.ssl.trustStore.password=password"
+        echo "  -Dzookeeper.ssl.keyStore.location=/tmp/client.jks -Dzookeeper.ssl.keyStore.password=password"
+        echo "  -Dzookeeper.client.secure=true\" ./zkServer.sh status"
+        echo " "
+      fi
+      echo "Error contacting service. It is probably not running."
+      exit 1
     else
-        echo $STAT
-        exit 0
+      echo $STAT
+      exit 0
     fi
     ;;
 *)
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 2a9d7d3c731..8d5f11b5516 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -480,9 +480,11 @@ these options.
 
 ### Monitoring
 
-The ZooKeeper service can be monitored in one of two
-primary ways; 1) the command port through the use of [4 letter words](#sc_zkCommands) and 2) [JMX](zookeeperJMX.html). See the appropriate section for
-your environment/requirements.
+The ZooKeeper service can be monitored in one of three primary ways:
+
+* the command port through the use of [4 letter words](#sc_zkCommands)
+* with [JMX](zookeeperJMX.html)
+* using the [`zkServer.sh status` command](zookeeperTools.html#zkServer)
 
 <a name="sc_logging"></a>
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index 09865f99d2a..46b3ca5c878 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -69,6 +69,14 @@ Apache ZooKeeper, version 3.6.0-SNAPSHOT 06/11/2019 05:39 GMT
 
 ```
 
+The `status` command establishes a client connection to the server to execute diagnostic commands. 
+When the ZooKeeper cluster is started in client SSL only mode (by omitting the clientPort
+from the zoo.cfg), then additional SSL related configuration has to be provided before using 
+the `./zkServer.sh status` command to find out if the ZooKeeper server is running. An example:
+
+    CLIENT_JVMFLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty -Dzookeeper.ssl.trustStore.location=/tmp/clienttrust.jks -Dzookeeper.ssl.trustStore.password=password -Dzookeeper.ssl.keyStore.location=/tmp/client.jks -Dzookeeper.ssl.keyStore.password=password -Dzookeeper.client.secure=true" ./zkServer.sh status
+
+
 <a name="zkCli"></a>
 
 ### zkCli.sh

From 45bc3ece8964a24feb808926f18f6e53319aa683 Mon Sep 17 00:00:00 2001
From: ctest-team <ctest.team@gmail.com>
Date: Thu, 14 May 2020 18:18:28 +0200
Subject: [PATCH 035/591] ZOOKEEPER-3721: Making the boolean configuration
 parameters consistent

Author: ctest-team <ctest.team@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Justin Ling Mao <maoling199210191@sina.com>

Closes #1266 from ctest-team/ZOOKEEPER-3721
---
 .../server/quorum/QuorumPeerConfig.java       | 59 +++++++++----------
 .../server/quorum/QuorumPeerConfigTest.java   | 33 +++++++++++
 2 files changed, 61 insertions(+), 31 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index ae73ef35e0c..dbebef3734e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -292,9 +292,9 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             } else if (key.equals("clientPort")) {
                 clientPort = Integer.parseInt(value);
             } else if (key.equals("localSessionsEnabled")) {
-                localSessionsEnabled = Boolean.parseBoolean(value);
+                localSessionsEnabled = parseBoolean(key, value);
             } else if (key.equals("localSessionsUpgradingEnabled")) {
-                localSessionsUpgradingEnabled = Boolean.parseBoolean(value);
+                localSessionsUpgradingEnabled = parseBoolean(key, value);
             } else if (key.equals("clientPortAddress")) {
                 clientPortAddress = value.trim();
             } else if (key.equals("secureClientPort")) {
@@ -325,7 +325,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
                     throw new ConfigException("Invalid electionAlg value. Only 3 is supported.");
                 }
             } else if (key.equals("quorumListenOnAllIPs")) {
-                quorumListenOnAllIPs = Boolean.parseBoolean(value);
+                quorumListenOnAllIPs = parseBoolean(key, value);
             } else if (key.equals("peerType")) {
                 if (value.toLowerCase().equals("observer")) {
                     peerType = LearnerType.OBSERVER;
@@ -335,7 +335,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
                     throw new ConfigException("Unrecognised peertype: " + value);
                 }
             } else if (key.equals("syncEnabled")) {
-                syncEnabled = Boolean.parseBoolean(value);
+                syncEnabled = parseBoolean(key, value);
             } else if (key.equals("dynamicConfigFile")) {
                 dynamicConfigFileStr = value;
             } else if (key.equals("autopurge.snapRetainCount")) {
@@ -343,40 +343,24 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             } else if (key.equals("autopurge.purgeInterval")) {
                 purgeInterval = Integer.parseInt(value);
             } else if (key.equals("standaloneEnabled")) {
-                if (value.toLowerCase().equals("true")) {
-                    setStandaloneEnabled(true);
-                } else if (value.toLowerCase().equals("false")) {
-                    setStandaloneEnabled(false);
-                } else {
-                    throw new ConfigException("Invalid option "
-                                              + value
-                                              + " for standalone mode. Choose 'true' or 'false.'");
-                }
+                setStandaloneEnabled(parseBoolean(key, value));
             } else if (key.equals("reconfigEnabled")) {
-                if (value.toLowerCase().equals("true")) {
-                    setReconfigEnabled(true);
-                } else if (value.toLowerCase().equals("false")) {
-                    setReconfigEnabled(false);
-                } else {
-                    throw new ConfigException("Invalid option "
-                                              + value
-                                              + " for reconfigEnabled flag. Choose 'true' or 'false.'");
-                }
+                setReconfigEnabled(parseBoolean(key, value));
             } else if (key.equals("sslQuorum")) {
-                sslQuorum = Boolean.parseBoolean(value);
+                sslQuorum = parseBoolean(key, value);
             } else if (key.equals("portUnification")) {
-                shouldUsePortUnification = Boolean.parseBoolean(value);
+                shouldUsePortUnification = parseBoolean(key, value);
             } else if (key.equals("sslQuorumReloadCertFiles")) {
-                sslQuorumReloadCertFiles = Boolean.parseBoolean(value);
+                sslQuorumReloadCertFiles = parseBoolean(key, value);
             } else if ((key.startsWith("server.") || key.startsWith("group") || key.startsWith("weight"))
                        && zkProp.containsKey("dynamicConfigFile")) {
                 throw new ConfigException("parameter: " + key + " must be in a separate dynamic config file");
             } else if (key.equals(QuorumAuth.QUORUM_SASL_AUTH_ENABLED)) {
-                quorumEnableSasl = Boolean.parseBoolean(value);
+                quorumEnableSasl = parseBoolean(key, value);
             } else if (key.equals(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED)) {
-                quorumServerRequireSasl = Boolean.parseBoolean(value);
+                quorumServerRequireSasl = parseBoolean(key, value);
             } else if (key.equals(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED)) {
-                quorumLearnerRequireSasl = Boolean.parseBoolean(value);
+                quorumLearnerRequireSasl = parseBoolean(key, value);
             } else if (key.equals(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT)) {
                 quorumLearnerLoginContext = value;
             } else if (key.equals(QuorumAuth.QUORUM_SERVER_SASL_LOGIN_CONTEXT)) {
@@ -392,18 +376,18 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             } else if (key.equals(JvmPauseMonitor.SLEEP_TIME_MS_KEY)) {
                 jvmPauseSleepTimeMs = Long.parseLong(value);
             } else if (key.equals(JvmPauseMonitor.JVM_PAUSE_MONITOR_FEATURE_SWITCH_KEY)) {
-                jvmPauseMonitorToRun = Boolean.parseBoolean(value);
+                jvmPauseMonitorToRun = parseBoolean(key, value);
             } else if (key.equals("metricsProvider.className")) {
                 metricsProviderClassName = value;
             } else if (key.startsWith("metricsProvider.")) {
                 String keyForMetricsProvider = key.substring(16);
                 metricsProviderConfiguration.put(keyForMetricsProvider, value);
             } else if (key.equals("multiAddress.enabled")) {
-                multiAddressEnabled = Boolean.parseBoolean(value);
+                multiAddressEnabled = parseBoolean(key, value);
             } else if (key.equals("multiAddress.reachabilityCheckTimeoutMs")) {
                 multiAddressReachabilityCheckTimeoutMs = Integer.parseInt(value);
             } else if (key.equals("multiAddress.reachabilityCheckEnabled")) {
-                multiAddressReachabilityCheckEnabled = Boolean.parseBoolean(value);
+                multiAddressReachabilityCheckEnabled = parseBoolean(key, value);
             } else {
                 System.setProperty("zookeeper." + key, value);
             }
@@ -969,4 +953,17 @@ public static void setReconfigEnabled(boolean enabled) {
         reconfigEnabled = enabled;
     }
 
+    private boolean parseBoolean(String key, String value) throws ConfigException {
+        if (value.equalsIgnoreCase("true")) {
+            return true;
+        } else if (value.equalsIgnoreCase("false")) {
+            return false;
+        } else {
+            throw new ConfigException("Invalid option "
+                                      + value
+                                      + " for "
+                                      + key
+                                      + ". Choose 'true' or 'false.'");
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
index 0d7e7cce015..da4bedf7c1d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
@@ -164,6 +164,39 @@ public void testJvmPauseMonitorConfigured() throws IOException, ConfigException
         assertTrue(quorumPeerConfig.isJvmPauseMonitorToRun());
     }
 
+    /**
+     * Test case for https://issues.apache.org/jira/browse/ZOOKEEPER-3721
+     */
+    @Test
+    public void testParseBoolean() throws IOException, ConfigException {
+        QuorumPeerConfig quorumPeerConfig = new QuorumPeerConfig();
+        Properties zkProp = getDefaultZKProperties();
+
+        zkProp.setProperty("localSessionsEnabled", "true");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(true, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "false");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(false, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "True");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(true, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "False");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(false, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "yes");
+        try {
+            quorumPeerConfig.parseProperties(zkProp);
+            fail("Must throw exception as 'yes' is not accpetable for parseBoolean!");
+        } catch (ConfigException e) {
+            // expected
+        }
+    }
+
     private Properties getDefaultZKProperties() {
         Properties zkProp = new Properties();
         zkProp.setProperty("dataDir", new File("myDataDir").getAbsolutePath());

From a14bd54f7112df96622c04fe6951bb25d6eddcf0 Mon Sep 17 00:00:00 2001
From: Fangmin Lyu <fangmin@apache.org>
Date: Fri, 15 May 2020 09:10:25 +0200
Subject: [PATCH 036/591] [ZOOKEEPER-3690] Improving leader efficiency via not
 processing learner forwarded requests in commit processor

Author: Fangmin Lyu <fangmin@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>

Closes #1223 from lvfangmin/ZOOKEEPER-3690
---
 .../main/resources/markdown/zookeeperAdmin.md |  8 +++++
 .../zookeeper/server/ServerMetrics.java       |  3 ++
 .../quorum/ProposalRequestProcessor.java      | 26 +++++++++++++-
 .../server/quorum/QuorumPeerMainTest.java     | 35 +++++++++++++++++++
 4 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 8d5f11b5516..6dbfa277cc7 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1148,6 +1148,14 @@ property, when available, is noted below.
     (Jave system property only: **learner.closeSocketAsync**)
     When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailabe. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. The default is false.
 
+* *forward_learner_requests_to_commit_processor_disabled*
+    (Jave system property: **zookeeper.forward_learner_requests_to_commit_processor_disabled**)
+    When this property is set, the requests from learners won't be enqueued to
+    CommitProcessor queue, which will help save the resources and GC time on 
+    leader.
+
+    The default value is false.
+
 
 <a name="sc_clusterOptions"></a>
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 36a65df801f..3962bb974f1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -241,6 +241,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         SOCKET_CLOSING_TIME = metricsContext.getSummary("socket_closing_time", DetailLevel.BASIC);
 
+        REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR = metricsContext.getCounter(
+                "requests_not_forwarded_to_commit_processor");
     }
 
     /**
@@ -465,6 +467,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
     public final Summary SOCKET_CLOSING_TIME;
 
+    public final Counter REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR;
 
     private final MetricsProvider metricsProvider;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
index c4b5a6e30b3..a3f1b29bdb6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
@@ -20,6 +20,7 @@
 
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.quorum.Leader.XidRolloverException;
 import org.slf4j.Logger;
@@ -39,11 +40,22 @@ public class ProposalRequestProcessor implements RequestProcessor {
 
     SyncRequestProcessor syncProcessor;
 
+    // If this property is set, requests from Learners won't be forwarded
+    // to the CommitProcessor in order to save resources
+    public static final String FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED =
+          "zookeeper.forward_learner_requests_to_commit_processor_disabled";
+    private final boolean forwardLearnerRequestsToCommitProcessorDisabled;
+
     public ProposalRequestProcessor(LeaderZooKeeperServer zks, RequestProcessor nextProcessor) {
         this.zks = zks;
         this.nextProcessor = nextProcessor;
         AckRequestProcessor ackProcessor = new AckRequestProcessor(zks.getLeader());
         syncProcessor = new SyncRequestProcessor(zks, ackProcessor);
+
+        forwardLearnerRequestsToCommitProcessorDisabled = Boolean.getBoolean(
+                FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED);
+        LOG.info("{} = {}", FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED,
+                forwardLearnerRequestsToCommitProcessorDisabled);
     }
 
     /**
@@ -70,7 +82,9 @@ public void processRequest(Request request) throws RequestProcessorException {
         if (request instanceof LearnerSyncRequest) {
             zks.getLeader().processSync((LearnerSyncRequest) request);
         } else {
-            nextProcessor.processRequest(request);
+            if (shouldForwardToNextProcessor(request)) {
+                nextProcessor.processRequest(request);
+            }
             if (request.getHdr() != null) {
                 // We need to sync and get consensus on any transactions
                 try {
@@ -89,4 +103,14 @@ public void shutdown() {
         syncProcessor.shutdown();
     }
 
+    private boolean shouldForwardToNextProcessor(Request request) {
+        if (!forwardLearnerRequestsToCommitProcessorDisabled) {
+            return true;
+        }
+        if (request.getOwner() instanceof LearnerHandler) {
+            ServerMetrics.getMetrics().REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR.add(1);
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index beb3bb9c069..487507bfc53 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -62,6 +62,7 @@
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider;
 import org.apache.zookeeper.metrics.impl.NullMetricsProvider;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.test.ClientBase;
@@ -1620,6 +1621,40 @@ public void testFaultyMetricsProviderOnConfigure() throws Exception {
         assertTrue("complains about metrics provider MetricsProviderLifeCycleException", found);
     }
 
+    /**
+     * Test the behavior to skip processing the learner forwarded requests in
+     * Leader's CommitProcessor.
+     */
+    @Test
+    public void testLearnerRequestForwardBehavior() throws Exception {
+        System.setProperty(ProposalRequestProcessor.FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED, "true");
+
+        try {
+            // 1. set up an ensemble with 3 servers
+            final int numServers = 3;
+            servers = LaunchServers(numServers);
+            int leaderId =  servers.findLeader();
+
+            int followerA = (leaderId + 1) % numServers;
+            waitForOne(servers.zk[followerA], States.CONNECTED);
+
+            // 2. reset all metrics
+            ServerMetrics.getMetrics().resetAll();
+
+            // 3. issue a request
+            final String node = "/testLearnerRequestForwardBehavior";
+            servers.zk[followerA].create(node, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            assertNotNull("node " + node + " should exist",
+                    servers.zk[followerA].exists("/testLearnerRequestForwardBehavior", false));
+
+            assertEquals(1L, ServerMetrics.getMetrics().REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR.get());
+        } finally {
+            //clean up
+            System.setProperty(ProposalRequestProcessor.FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED, "false");
+        }
+    }
+
     static class Context {
 
         boolean quitFollowing = false;

From d99c9e8b701ebdbd3f0098d4d81696df97432262 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Sun, 17 May 2020 15:13:37 +0200
Subject: [PATCH 037/591] ZOOKEEPER-837: Eliminate cycle dependency between
 ClientCnxn and ZooKeeper

1. Extract ZKWatchManager to single file
2. Move ZKWatchManager instance to ClientCnxn in order to eliminate cycle dependency
3. let `ZooKeeper` syncs a copy of default watcher, in order to reduce dependencies to `getWatchManager()`

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <andor@apache.org>

Closes #1095 from TisonKun/ZOOKEEPER-837
---
 .../java/org/apache/zookeeper/ClientCnxn.java | 110 ++--
 .../apache/zookeeper/WatchDeregistration.java |   1 -
 .../org/apache/zookeeper/ZKWatchManager.java  | 455 ++++++++++++++++
 .../java/org/apache/zookeeper/ZooKeeper.java  | 504 ++----------------
 .../ClientCnxnSocketFragilityTest.java        |  35 +-
 .../apache/zookeeper/ClientReconnectTest.java |  10 +-
 .../zookeeper/ClientRequestTimeoutTest.java   |  37 +-
 .../apache/zookeeper/RemoveWatchesTest.java   |  70 +--
 .../apache/zookeeper/TestableZooKeeper.java   |  70 +--
 9 files changed, 651 insertions(+), 641 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index c87d3cba862..87094b8b1b9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -165,13 +165,11 @@ static class AuthData {
 
     private final int sessionTimeout;
 
-    private final ZooKeeper zooKeeper;
-
-    private final ClientWatchManager watcher;
+    private final ZKWatchManager watchManager;
 
     private long sessionId;
 
-    private byte[] sessionPasswd = new byte[16];
+    private byte[] sessionPasswd;
 
     /**
      * If true, the connection is allowed to go to r-o mode. This field's value
@@ -224,6 +222,10 @@ static class AuthData {
      */
     private long requestTimeout;
 
+    ZKWatchManager getWatcherManager() {
+        return watchManager;
+    }
+
     public long getSessionId() {
         return sessionId;
     }
@@ -362,35 +364,29 @@ public String toString() {
      * established until needed. The start() instance method must be called
      * subsequent to construction.
      *
-     * @param chrootPath - the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
-     * @param hostProvider
-     *                the list of ZooKeeper servers to connect to
-     * @param sessionTimeout
-     *                the timeout for connections.
-     * @param zooKeeper
-     *                the zookeeper object that this connection is related to.
-     * @param watcher watcher for this connection
-     * @param clientCnxnSocket
-     *                the socket implementation used (e.g. NIO/Netty)
-     * @param canBeReadOnly
-     *                whether the connection is allowed to go to read-only
-     *                mode in case of partitioning
-     * @throws IOException
+     * @param chrootPath the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
+     * @param hostProvider the list of ZooKeeper servers to connect to
+     * @param sessionTimeout the timeout for connections.
+     * @param clientConfig the client configuration.
+     * @param defaultWatcher default watcher for this connection
+     * @param clientCnxnSocket the socket implementation used (e.g. NIO/Netty)
+     * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
      */
     public ClientCnxn(
         String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
+        ZKClientConfig clientConfig,
+        Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
-        boolean canBeReadOnly) throws IOException {
+        boolean canBeReadOnly
+    ) throws IOException {
         this(
             chrootPath,
             hostProvider,
             sessionTimeout,
-            zooKeeper,
-            watcher,
+            clientConfig,
+            defaultWatcher,
             clientCnxnSocket,
             0,
             new byte[16],
@@ -402,48 +398,45 @@ public ClientCnxn(
      * established until needed. The start() instance method must be called
      * subsequent to construction.
      *
-     * @param chrootPath - the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
-     * @param hostProvider
-     *                the list of ZooKeeper servers to connect to
-     * @param sessionTimeout
-     *                the timeout for connections.
-     * @param zooKeeper
-     *                the zookeeper object that this connection is related to.
-     * @param watcher watcher for this connection
-     * @param clientCnxnSocket
-     *                the socket implementation used (e.g. NIO/Netty)
+     * @param chrootPath the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
+     * @param hostProvider the list of ZooKeeper servers to connect to
+     * @param sessionTimeout the timeout for connections.
+     * @param clientConfig the client configuration.
+     * @param defaultWatcher default watcher for this connection
+     * @param clientCnxnSocket the socket implementation used (e.g. NIO/Netty)
      * @param sessionId session id if re-establishing session
      * @param sessionPasswd session passwd if re-establishing session
-     * @param canBeReadOnly
-     *                whether the connection is allowed to go to read-only
-     *                mode in case of partitioning
+     * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
      * @throws IOException in cases of broken network
      */
     public ClientCnxn(
         String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
+        ZKClientConfig clientConfig,
+        Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
         long sessionId,
         byte[] sessionPasswd,
-        boolean canBeReadOnly) throws IOException {
-        this.zooKeeper = zooKeeper;
-        this.watcher = watcher;
+        boolean canBeReadOnly
+    ) throws IOException {
+        this.chrootPath = chrootPath;
+        this.hostProvider = hostProvider;
+        this.sessionTimeout = sessionTimeout;
+        this.clientConfig = clientConfig;
         this.sessionId = sessionId;
         this.sessionPasswd = sessionPasswd;
-        this.sessionTimeout = sessionTimeout;
-        this.hostProvider = hostProvider;
-        this.chrootPath = chrootPath;
+        this.readOnly = canBeReadOnly;
+
+        this.watchManager = new ZKWatchManager(
+                clientConfig.getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET),
+                defaultWatcher);
 
-        connectTimeout = sessionTimeout / hostProvider.size();
-        readTimeout = sessionTimeout * 2 / 3;
-        readOnly = canBeReadOnly;
+        this.connectTimeout = sessionTimeout / hostProvider.size();
+        this.readTimeout = sessionTimeout * 2 / 3;
 
-        sendThread = new SendThread(clientCnxnSocket);
-        eventThread = new EventThread();
-        this.clientConfig = zooKeeper.getClientConfig();
+        this.sendThread = new SendThread(clientCnxnSocket);
+        this.eventThread = new EventThread();
         initRequestTimeout();
     }
 
@@ -506,10 +499,9 @@ private void queueEvent(WatchedEvent event, Set<Watcher> materializedWatchers) {
             final Set<Watcher> watchers;
             if (materializedWatchers == null) {
                 // materialize the watchers based on the event
-                watchers = watcher.materialize(event.getState(), event.getType(), event.getPath());
+                watchers = watchManager.materialize(event.getState(), event.getType(), event.getPath());
             } else {
-                watchers = new HashSet<Watcher>();
-                watchers.addAll(materializedWatchers);
+                watchers = new HashSet<>(materializedWatchers);
             }
             WatcherSetEventPair pair = new WatcherSetEventPair(watchers, event);
             // queue the pair (watch set & event) for later processing
@@ -1007,14 +999,12 @@ void primeConnection() throws IOException {
             ConnectRequest conReq = new ConnectRequest(0, lastZxid, sessionTimeout, sessId, sessionPasswd);
             // We add backwards since we are pushing into the front
             // Only send if there's a pending watch
-            // TODO: here we have the only remaining use of zooKeeper in
-            // this class. It's to be eliminated!
             if (!clientConfig.getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET)) {
-                List<String> dataWatches = zooKeeper.getDataWatches();
-                List<String> existWatches = zooKeeper.getExistWatches();
-                List<String> childWatches = zooKeeper.getChildWatches();
-                List<String> persistentWatches = zooKeeper.getPersistentWatches();
-                List<String> persistentRecursiveWatches = zooKeeper.getPersistentRecursiveWatches();
+                List<String> dataWatches = watchManager.getDataWatchList();
+                List<String> existWatches = watchManager.getExistWatchList();
+                List<String> childWatches = watchManager.getChildWatchList();
+                List<String> persistentWatches = watchManager.getPersistentWatchList();
+                List<String> persistentRecursiveWatches = watchManager.getPersistentRecursiveWatchList();
                 if (!dataWatches.isEmpty() || !existWatches.isEmpty() || !childWatches.isEmpty()
                         || !persistentWatches.isEmpty() || !persistentRecursiveWatches.isEmpty()) {
                     Iterator<String> dataWatchesIter = prependChroot(dataWatches).iterator();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
index 16c7f843473..710f47b34c3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
@@ -22,7 +22,6 @@
 import java.util.Set;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
-import org.apache.zookeeper.ZooKeeper.ZKWatchManager;
 
 /**
  * Handles the special case of removing watches which has registered for a
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
new file mode 100644
index 00000000000..95a07f0e7be
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
@@ -0,0 +1,455 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.apache.zookeeper.server.watch.PathParentIterator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Manage watchers and handle events generated by the {@link ClientCnxn} object.
+ *
+ * This class is intended to be packaged-private so that it doesn't serve
+ * as part of ZooKeeper client API.
+ */
+class ZKWatchManager implements ClientWatchManager {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ZKWatchManager.class);
+
+    private final Map<String, Set<Watcher>> dataWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> existWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> childWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> persistentWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> persistentRecursiveWatches = new HashMap<>();
+    private final boolean disableAutoWatchReset;
+
+    private volatile Watcher defaultWatcher;
+
+    ZKWatchManager(boolean disableAutoWatchReset, Watcher defaultWatcher) {
+        this.disableAutoWatchReset = disableAutoWatchReset;
+        this.defaultWatcher = defaultWatcher;
+    }
+
+    void setDefaultWatcher(Watcher defaultWatcher) {
+        this.defaultWatcher = defaultWatcher;
+    }
+
+    Watcher getDefaultWatcher() {
+        return defaultWatcher;
+    }
+
+    List<String> getDataWatchList() {
+        synchronized (dataWatches) {
+            return new ArrayList<>(dataWatches.keySet());
+        }
+    }
+
+    List<String> getChildWatchList() {
+        synchronized (childWatches) {
+            return new ArrayList<>(childWatches.keySet());
+        }
+    }
+
+    List<String> getExistWatchList() {
+        synchronized (existWatches) {
+            return new ArrayList<>(existWatches.keySet());
+        }
+    }
+
+    List<String> getPersistentWatchList() {
+        synchronized (persistentWatches) {
+            return new ArrayList<>(persistentWatches.keySet());
+        }
+    }
+
+    List<String> getPersistentRecursiveWatchList() {
+        synchronized (persistentRecursiveWatches) {
+            return new ArrayList<>(persistentRecursiveWatches.keySet());
+        }
+    }
+
+    Map<String, Set<Watcher>> getDataWatches() {
+        return dataWatches;
+    }
+
+    Map<String, Set<Watcher>> getExistWatches() {
+        return existWatches;
+    }
+
+    Map<String, Set<Watcher>> getChildWatches() {
+        return childWatches;
+    }
+
+    Map<String, Set<Watcher>> getPersistentWatches() {
+        return persistentWatches;
+    }
+
+    Map<String, Set<Watcher>> getPersistentRecursiveWatches() {
+        return persistentRecursiveWatches;
+    }
+
+    private void addTo(Set<Watcher> from, Set<Watcher> to) {
+        if (from != null) {
+            to.addAll(from);
+        }
+    }
+
+    public Map<Watcher.Event.EventType, Set<Watcher>> removeWatcher(
+        String clientPath,
+        Watcher watcher,
+        Watcher.WatcherType watcherType,
+        boolean local,
+        int rc
+    ) throws KeeperException {
+        // Validate the provided znode path contains the given watcher of
+        // watcherType
+        containsWatcher(clientPath, watcher, watcherType);
+
+        Map<Watcher.Event.EventType, Set<Watcher>> removedWatchers = new HashMap<>();
+        HashSet<Watcher> childWatchersToRem = new HashSet<>();
+        removedWatchers.put(Watcher.Event.EventType.ChildWatchRemoved, childWatchersToRem);
+        HashSet<Watcher> dataWatchersToRem = new HashSet<>();
+        removedWatchers.put(Watcher.Event.EventType.DataWatchRemoved, dataWatchersToRem);
+        HashSet<Watcher> persistentWatchersToRem = new HashSet<>();
+        removedWatchers.put(Watcher.Event.EventType.PersistentWatchRemoved, persistentWatchersToRem);
+        boolean removedWatcher = false;
+        switch (watcherType) {
+        case Children: {
+            synchronized (childWatches) {
+                removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
+            }
+            break;
+        }
+        case Data: {
+            synchronized (dataWatches) {
+                removedWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+            }
+
+            synchronized (existWatches) {
+                boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+                removedWatcher |= removedDataWatcher;
+            }
+            break;
+        }
+        case Any: {
+            synchronized (childWatches) {
+                removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
+            }
+
+            synchronized (dataWatches) {
+                boolean removedDataWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+                removedWatcher |= removedDataWatcher;
+            }
+
+            synchronized (existWatches) {
+                boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+                removedWatcher |= removedDataWatcher;
+            }
+
+            synchronized (persistentWatches) {
+                boolean removedPersistentWatcher = removeWatches(persistentWatches,
+                        watcher, clientPath, local, rc, persistentWatchersToRem);
+                removedWatcher |= removedPersistentWatcher;
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                boolean removedPersistentRecursiveWatcher = removeWatches(persistentRecursiveWatches,
+                        watcher, clientPath, local, rc, persistentWatchersToRem);
+                removedWatcher |= removedPersistentRecursiveWatcher;
+            }
+        }
+        }
+        // Watcher function doesn't exists for the specified params
+        if (!removedWatcher) {
+            throw new KeeperException.NoWatcherException(clientPath);
+        }
+        return removedWatchers;
+    }
+
+    private boolean contains(String path, Watcher watcherObj, Map<String, Set<Watcher>> pathVsWatchers) {
+        boolean watcherExists = true;
+        if (pathVsWatchers == null || pathVsWatchers.size() == 0) {
+            watcherExists = false;
+        } else {
+            Set<Watcher> watchers = pathVsWatchers.get(path);
+            if (watchers == null) {
+                watcherExists = false;
+            } else if (watcherObj == null) {
+                watcherExists = watchers.size() > 0;
+            } else {
+                watcherExists = watchers.contains(watcherObj);
+            }
+        }
+        return watcherExists;
+    }
+
+    /**
+     * Validate the provided znode path contains the given watcher and
+     * watcherType
+     *
+     * @param path
+     *            - client path
+     * @param watcher
+     *            - watcher object reference
+     * @param watcherType
+     *            - type of the watcher
+     * @throws KeeperException.NoWatcherException
+     */
+    void containsWatcher(String path, Watcher watcher, Watcher.WatcherType watcherType) throws
+            KeeperException.NoWatcherException {
+        boolean containsWatcher = false;
+        switch (watcherType) {
+        case Children: {
+            synchronized (childWatches) {
+                containsWatcher = contains(path, watcher, childWatches);
+            }
+
+            synchronized (persistentWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentRecursiveWatches);
+                containsWatcher |= contains_temp;
+            }
+            break;
+        }
+        case Data: {
+            synchronized (dataWatches) {
+                containsWatcher = contains(path, watcher, dataWatches);
+            }
+
+            synchronized (existWatches) {
+                boolean contains_temp = contains(path, watcher, existWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentRecursiveWatches);
+                containsWatcher |= contains_temp;
+            }
+            break;
+        }
+        case Any: {
+            synchronized (childWatches) {
+                containsWatcher = contains(path, watcher, childWatches);
+            }
+
+            synchronized (dataWatches) {
+                boolean contains_temp = contains(path, watcher, dataWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (existWatches) {
+                boolean contains_temp = contains(path, watcher, existWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentRecursiveWatches);
+                containsWatcher |= contains_temp;
+            }
+        }
+        }
+        // Watcher function doesn't exists for the specified params
+        if (!containsWatcher) {
+            throw new KeeperException.NoWatcherException(path);
+        }
+    }
+
+    protected boolean removeWatches(
+        Map<String, Set<Watcher>> pathVsWatcher,
+        Watcher watcher,
+        String path,
+        boolean local,
+        int rc,
+        Set<Watcher> removedWatchers) throws KeeperException {
+        if (!local && rc != KeeperException.Code.OK.intValue()) {
+            throw KeeperException.create(KeeperException.Code.get(rc), path);
+        }
+        boolean success = false;
+        // When local flag is true, remove watchers for the given path
+        // irrespective of rc. Otherwise shouldn't remove watchers locally
+        // when sees failure from server.
+        if (rc == KeeperException.Code.OK.intValue() || (local && rc != KeeperException.Code.OK.intValue())) {
+            // Remove all the watchers for the given path
+            if (watcher == null) {
+                Set<Watcher> pathWatchers = pathVsWatcher.remove(path);
+                if (pathWatchers != null) {
+                    // found path watchers
+                    removedWatchers.addAll(pathWatchers);
+                    success = true;
+                }
+            } else {
+                Set<Watcher> watchers = pathVsWatcher.get(path);
+                if (watchers != null) {
+                    if (watchers.remove(watcher)) {
+                        // found path watcher
+                        removedWatchers.add(watcher);
+                        // cleanup <path vs watchlist>
+                        if (watchers.size() <= 0) {
+                            pathVsWatcher.remove(path);
+                        }
+                        success = true;
+                    }
+                }
+            }
+        }
+        return success;
+    }
+
+    /* (non-Javadoc)
+     * @see org.apache.zookeeper.ClientWatchManager#materialize(Event.KeeperState,
+     *                                                        Event.EventType, java.lang.String)
+     */
+    @Override
+    public Set<Watcher> materialize(
+        Watcher.Event.KeeperState state,
+        Watcher.Event.EventType type,
+        String clientPath
+    ) {
+        final Set<Watcher> result = new HashSet<>();
+
+        switch (type) {
+        case None:
+            if (defaultWatcher != null) {
+                result.add(defaultWatcher);
+            }
+
+            boolean clear = disableAutoWatchReset && state != Watcher.Event.KeeperState.SyncConnected;
+            synchronized (dataWatches) {
+                for (Set<Watcher> ws : dataWatches.values()) {
+                    result.addAll(ws);
+                }
+                if (clear) {
+                    dataWatches.clear();
+                }
+            }
+
+            synchronized (existWatches) {
+                for (Set<Watcher> ws : existWatches.values()) {
+                    result.addAll(ws);
+                }
+                if (clear) {
+                    existWatches.clear();
+                }
+            }
+
+            synchronized (childWatches) {
+                for (Set<Watcher> ws : childWatches.values()) {
+                    result.addAll(ws);
+                }
+                if (clear) {
+                    childWatches.clear();
+                }
+            }
+
+            synchronized (persistentWatches) {
+                for (Set<Watcher> ws: persistentWatches.values()) {
+                    result.addAll(ws);
+                }
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                for (Set<Watcher> ws: persistentRecursiveWatches.values()) {
+                    result.addAll(ws);
+                }
+            }
+
+            return result;
+        case NodeDataChanged:
+        case NodeCreated:
+            synchronized (dataWatches) {
+                addTo(dataWatches.remove(clientPath), result);
+            }
+            synchronized (existWatches) {
+                addTo(existWatches.remove(clientPath), result);
+            }
+            addPersistentWatches(clientPath, result);
+            break;
+        case NodeChildrenChanged:
+            synchronized (childWatches) {
+                addTo(childWatches.remove(clientPath), result);
+            }
+            addPersistentWatches(clientPath, result);
+            break;
+        case NodeDeleted:
+            synchronized (dataWatches) {
+                addTo(dataWatches.remove(clientPath), result);
+            }
+            // TODO This shouldn't be needed, but just in case
+            synchronized (existWatches) {
+                Set<Watcher> list = existWatches.remove(clientPath);
+                if (list != null) {
+                    addTo(list, result);
+                    LOG.warn("We are triggering an exists watch for delete! Shouldn't happen!");
+                }
+            }
+            synchronized (childWatches) {
+                addTo(childWatches.remove(clientPath), result);
+            }
+            addPersistentWatches(clientPath, result);
+            break;
+        default:
+            String errorMsg = String.format(
+                "Unhandled watch event type %s with state %s on path %s",
+                type,
+                state,
+                clientPath);
+            LOG.error(errorMsg);
+            throw new RuntimeException(errorMsg);
+        }
+
+        return result;
+    }
+
+    private void addPersistentWatches(String clientPath, Set<Watcher> result) {
+        synchronized (persistentWatches) {
+            addTo(persistentWatches.get(clientPath), result);
+        }
+        synchronized (persistentRecursiveWatches) {
+            for (String path : PathParentIterator.forAll(clientPath).asIterable()) {
+                addTo(persistentRecursiveWatches.get(path), result);
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 0210493efc0..201cf20f203 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -24,7 +24,6 @@
 import java.net.SocketAddress;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -40,10 +39,7 @@
 import org.apache.zookeeper.AsyncCallback.StatCallback;
 import org.apache.zookeeper.AsyncCallback.StringCallback;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
-import org.apache.zookeeper.KeeperException.Code;
-import org.apache.zookeeper.KeeperException.NoWatcherException;
 import org.apache.zookeeper.OpResult.ErrorResult;
-import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.apache.zookeeper.client.HostProvider;
@@ -85,7 +81,6 @@
 import org.apache.zookeeper.proto.SyncResponse;
 import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.EphemeralType;
-import org.apache.zookeeper.server.watch.PathParentIterator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -231,8 +226,6 @@ public ZooKeeperSaslClient getSaslClient() {
         return cnxn.zooKeeperSaslClient;
     }
 
-    protected final ZKWatchManager watchManager;
-
     private final ZKClientConfig clientConfig;
 
     public ZKClientConfig getClientConfig() {
@@ -240,407 +233,37 @@ public ZKClientConfig getClientConfig() {
     }
 
     protected List<String> getDataWatches() {
-        synchronized (watchManager.dataWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.dataWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getDataWatchList();
     }
+
     protected List<String> getExistWatches() {
-        synchronized (watchManager.existWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.existWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getExistWatchList();
     }
+
     protected List<String> getChildWatches() {
-        synchronized (watchManager.childWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.childWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getChildWatchList();
     }
+
     protected List<String> getPersistentWatches() {
-        synchronized (watchManager.persistentWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.persistentWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getPersistentWatchList();
     }
+
     protected List<String> getPersistentRecursiveWatches() {
-        synchronized (watchManager.persistentRecursiveWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.persistentRecursiveWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getPersistentRecursiveWatchList();
     }
 
-    /**
-     * Manage watchers and handle events generated by the ClientCnxn object.
-     *
-     * We are implementing this as a nested class of ZooKeeper so that
-     * the public methods will not be exposed as part of the ZooKeeper client
-     * API.
-     */
-    static class ZKWatchManager implements ClientWatchManager {
-
-        private final Map<String, Set<Watcher>> dataWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> existWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> childWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> persistentWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> persistentRecursiveWatches = new HashMap<String, Set<Watcher>>();
-        private boolean disableAutoWatchReset;
-
-        ZKWatchManager(boolean disableAutoWatchReset) {
-            this.disableAutoWatchReset = disableAutoWatchReset;
-        }
-
-        protected volatile Watcher defaultWatcher;
-
-        private void addTo(Set<Watcher> from, Set<Watcher> to) {
-            if (from != null) {
-                to.addAll(from);
-            }
-        }
-
-        public Map<EventType, Set<Watcher>> removeWatcher(
-            String clientPath,
-            Watcher watcher,
-            WatcherType watcherType,
-            boolean local,
-            int rc) throws KeeperException {
-            // Validate the provided znode path contains the given watcher of
-            // watcherType
-            containsWatcher(clientPath, watcher, watcherType);
-
-            Map<EventType, Set<Watcher>> removedWatchers = new HashMap<>();
-            HashSet<Watcher> childWatchersToRem = new HashSet<>();
-            removedWatchers.put(EventType.ChildWatchRemoved, childWatchersToRem);
-            HashSet<Watcher> dataWatchersToRem = new HashSet<>();
-            removedWatchers.put(EventType.DataWatchRemoved, dataWatchersToRem);
-            HashSet<Watcher> persistentWatchersToRem = new HashSet<>();
-            removedWatchers.put(EventType.PersistentWatchRemoved, persistentWatchersToRem);
-            boolean removedWatcher = false;
-            switch (watcherType) {
-            case Children: {
-                synchronized (childWatches) {
-                    removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
-                }
-                break;
-            }
-            case Data: {
-                synchronized (dataWatches) {
-                    removedWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                }
-
-                synchronized (existWatches) {
-                    boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                    removedWatcher |= removedDataWatcher;
-                }
-                break;
-            }
-            case Any: {
-                synchronized (childWatches) {
-                    removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
-                }
-
-                synchronized (dataWatches) {
-                    boolean removedDataWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                    removedWatcher |= removedDataWatcher;
-                }
-
-                synchronized (existWatches) {
-                    boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                    removedWatcher |= removedDataWatcher;
-                }
-
-                synchronized (persistentWatches) {
-                    boolean removedPersistentWatcher = removeWatches(persistentWatches,
-                            watcher, clientPath, local, rc, persistentWatchersToRem);
-                    removedWatcher |= removedPersistentWatcher;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean removedPersistentRecursiveWatcher = removeWatches(persistentRecursiveWatches,
-                            watcher, clientPath, local, rc, persistentWatchersToRem);
-                    removedWatcher |= removedPersistentRecursiveWatcher;
-                }
-            }
-            }
-            // Watcher function doesn't exists for the specified params
-            if (!removedWatcher) {
-                throw new KeeperException.NoWatcherException(clientPath);
-            }
-            return removedWatchers;
-        }
-
-        private boolean contains(String path, Watcher watcherObj, Map<String, Set<Watcher>> pathVsWatchers) {
-            boolean watcherExists = true;
-            if (pathVsWatchers == null || pathVsWatchers.size() == 0) {
-                watcherExists = false;
-            } else {
-                Set<Watcher> watchers = pathVsWatchers.get(path);
-                if (watchers == null) {
-                    watcherExists = false;
-                } else if (watcherObj == null) {
-                    watcherExists = watchers.size() > 0;
-                } else {
-                    watcherExists = watchers.contains(watcherObj);
-                }
-            }
-            return watcherExists;
-        }
-
-        /**
-         * Validate the provided znode path contains the given watcher and
-         * watcherType
-         *
-         * @param path
-         *            - client path
-         * @param watcher
-         *            - watcher object reference
-         * @param watcherType
-         *            - type of the watcher
-         * @throws NoWatcherException
-         */
-        void containsWatcher(String path, Watcher watcher, WatcherType watcherType) throws NoWatcherException {
-            boolean containsWatcher = false;
-            switch (watcherType) {
-            case Children: {
-                synchronized (childWatches) {
-                    containsWatcher = contains(path, watcher, childWatches);
-                }
-
-                synchronized (persistentWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentRecursiveWatches);
-                    containsWatcher |= contains_temp;
-                }
-                break;
-            }
-            case Data: {
-                synchronized (dataWatches) {
-                    containsWatcher = contains(path, watcher, dataWatches);
-                }
-
-                synchronized (existWatches) {
-                    boolean contains_temp = contains(path, watcher, existWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentRecursiveWatches);
-                    containsWatcher |= contains_temp;
-                }
-                break;
-            }
-            case Any: {
-                synchronized (childWatches) {
-                    containsWatcher = contains(path, watcher, childWatches);
-                }
-
-                synchronized (dataWatches) {
-                    boolean contains_temp = contains(path, watcher, dataWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (existWatches) {
-                    boolean contains_temp = contains(path, watcher, existWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentRecursiveWatches);
-                    containsWatcher |= contains_temp;
-                }
-            }
-            }
-            // Watcher function doesn't exists for the specified params
-            if (!containsWatcher) {
-                throw new KeeperException.NoWatcherException(path);
-            }
-        }
-
-        protected boolean removeWatches(
-            Map<String, Set<Watcher>> pathVsWatcher,
-            Watcher watcher,
-            String path,
-            boolean local,
-            int rc,
-            Set<Watcher> removedWatchers) throws KeeperException {
-            if (!local && rc != Code.OK.intValue()) {
-                throw KeeperException.create(KeeperException.Code.get(rc), path);
-            }
-            boolean success = false;
-            // When local flag is true, remove watchers for the given path
-            // irrespective of rc. Otherwise shouldn't remove watchers locally
-            // when sees failure from server.
-            if (rc == Code.OK.intValue() || (local && rc != Code.OK.intValue())) {
-                // Remove all the watchers for the given path
-                if (watcher == null) {
-                    Set<Watcher> pathWatchers = pathVsWatcher.remove(path);
-                    if (pathWatchers != null) {
-                        // found path watchers
-                        removedWatchers.addAll(pathWatchers);
-                        success = true;
-                    }
-                } else {
-                    Set<Watcher> watchers = pathVsWatcher.get(path);
-                    if (watchers != null) {
-                        if (watchers.remove(watcher)) {
-                            // found path watcher
-                            removedWatchers.add(watcher);
-                            // cleanup <path vs watchlist>
-                            if (watchers.size() <= 0) {
-                                pathVsWatcher.remove(path);
-                            }
-                            success = true;
-                        }
-                    }
-                }
-            }
-            return success;
-        }
-
-        /* (non-Javadoc)
-         * @see org.apache.zookeeper.ClientWatchManager#materialize(Event.KeeperState,
-         *                                                        Event.EventType, java.lang.String)
-         */
-        @Override
-        public Set<Watcher> materialize(
-            Watcher.Event.KeeperState state,
-            Watcher.Event.EventType type,
-            String clientPath
-        ) {
-            final Set<Watcher> result = new HashSet<>();
-
-            switch (type) {
-            case None:
-                if (defaultWatcher != null) {
-                    result.add(defaultWatcher);
-                }
-
-                boolean clear = disableAutoWatchReset && state != Watcher.Event.KeeperState.SyncConnected;
-                synchronized (dataWatches) {
-                    for (Set<Watcher> ws : dataWatches.values()) {
-                        result.addAll(ws);
-                    }
-                    if (clear) {
-                        dataWatches.clear();
-                    }
-                }
-
-                synchronized (existWatches) {
-                    for (Set<Watcher> ws : existWatches.values()) {
-                        result.addAll(ws);
-                    }
-                    if (clear) {
-                        existWatches.clear();
-                    }
-                }
-
-                synchronized (childWatches) {
-                    for (Set<Watcher> ws : childWatches.values()) {
-                        result.addAll(ws);
-                    }
-                    if (clear) {
-                        childWatches.clear();
-                    }
-                }
-
-                synchronized (persistentWatches) {
-                    for (Set<Watcher> ws: persistentWatches.values()) {
-                        result.addAll(ws);
-                    }
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    for (Set<Watcher> ws: persistentRecursiveWatches.values()) {
-                        result.addAll(ws);
-                    }
-                }
-
-                return result;
-            case NodeDataChanged:
-            case NodeCreated:
-                synchronized (dataWatches) {
-                    addTo(dataWatches.remove(clientPath), result);
-                }
-                synchronized (existWatches) {
-                    addTo(existWatches.remove(clientPath), result);
-                }
-                addPersistentWatches(clientPath, result);
-                break;
-            case NodeChildrenChanged:
-                synchronized (childWatches) {
-                    addTo(childWatches.remove(clientPath), result);
-                }
-                addPersistentWatches(clientPath, result);
-                break;
-            case NodeDeleted:
-                synchronized (dataWatches) {
-                    addTo(dataWatches.remove(clientPath), result);
-                }
-                // TODO This shouldn't be needed, but just in case
-                synchronized (existWatches) {
-                    Set<Watcher> list = existWatches.remove(clientPath);
-                    if (list != null) {
-                        addTo(list, result);
-                        LOG.warn("We are triggering an exists watch for delete! Shouldn't happen!");
-                    }
-                }
-                synchronized (childWatches) {
-                    addTo(childWatches.remove(clientPath), result);
-                }
-                addPersistentWatches(clientPath, result);
-                break;
-            default:
-                String errorMsg = String.format(
-                    "Unhandled watch event type %s with state %s on path %s",
-                    type,
-                    state,
-                    clientPath);
-                LOG.error(errorMsg);
-                throw new RuntimeException(errorMsg);
-            }
-
-            return result;
-        }
-
-        private void addPersistentWatches(String clientPath, Set<Watcher> result) {
-            synchronized (persistentWatches) {
-                addTo(persistentWatches.get(clientPath), result);
-            }
-            synchronized (persistentRecursiveWatches) {
-                for (String path : PathParentIterator.forAll(clientPath).asIterable()) {
-                    addTo(persistentRecursiveWatches.get(path), result);
-                }
-            }
-        }
+    ZKWatchManager getWatchManager() {
+        return cnxn.getWatcherManager();
     }
 
     /**
      * Register a watcher for a particular path.
      */
-    public abstract class WatchRegistration {
+    public abstract static class WatchRegistration {
 
         private Watcher watcher;
         private String clientPath;
+
         public WatchRegistration(Watcher watcher, String clientPath) {
             this.watcher = watcher;
             this.clientPath = clientPath;
@@ -689,7 +312,7 @@ public ExistsWatchRegistration(Watcher watcher, String clientPath) {
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return rc == 0 ? watchManager.dataWatches : watchManager.existWatches;
+            return rc == 0 ? getWatchManager().getDataWatches() : getWatchManager().getExistWatches();
         }
 
         @Override
@@ -707,7 +330,7 @@ public DataWatchRegistration(Watcher watcher, String clientPath) {
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return watchManager.dataWatches;
+            return getWatchManager().getDataWatches();
         }
 
     }
@@ -720,7 +343,7 @@ public ChildWatchRegistration(Watcher watcher, String clientPath) {
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return watchManager.childWatches;
+            return getWatchManager().getChildWatches();
         }
 
     }
@@ -737,9 +360,9 @@ public AddWatchRegistration(Watcher watcher, String clientPath, AddWatchMode mod
         protected Map<String, Set<Watcher>> getWatches(int rc) {
             switch (mode) {
                 case PERSISTENT:
-                    return watchManager.persistentWatches;
+                    return getWatchManager().getPersistentWatches();
                 case PERSISTENT_RECURSIVE:
-                    return watchManager.persistentRecursiveWatches;
+                    return getWatchManager().getPersistentRecursiveWatches();
             }
             throw new IllegalArgumentException("Mode not supported: " + mode);
         }
@@ -989,7 +612,7 @@ public ZooKeeper(
      *            connects to one in read-only mode, i.e. read requests are
      *            allowed while write requests are not. It continues seeking for
      *            majority in the background.
-     * @param aHostProvider
+     * @param hostProvider
      *            use this as HostProvider to enable custom behaviour.
      * @param clientConfig
      *            (added in 3.5.2) passing this conf object gives each client the flexibility of
@@ -1004,49 +627,45 @@ public ZooKeeper(
         int sessionTimeout,
         Watcher watcher,
         boolean canBeReadOnly,
-        HostProvider aHostProvider,
-        ZKClientConfig clientConfig) throws IOException {
+        HostProvider hostProvider,
+        ZKClientConfig clientConfig
+    ) throws IOException {
         LOG.info(
             "Initiating client connection, connectString={} sessionTimeout={} watcher={}",
             connectString,
             sessionTimeout,
             watcher);
 
-        if (clientConfig == null) {
-            clientConfig = new ZKClientConfig();
-        }
-        this.clientConfig = clientConfig;
-        watchManager = defaultWatchManager();
-        watchManager.defaultWatcher = watcher;
+        this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
+        this.hostProvider = hostProvider;
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
-        hostProvider = aHostProvider;
 
         cnxn = createConnection(
             connectStringParser.getChrootPath(),
             hostProvider,
             sessionTimeout,
-            this,
-            watchManager,
+            this.clientConfig,
+            watcher,
             getClientCnxnSocket(),
             canBeReadOnly);
         cnxn.start();
     }
 
-    // @VisibleForTesting
-    protected ClientCnxn createConnection(
+    ClientCnxn createConnection(
         String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
+        ZKClientConfig clientConfig,
+        Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
-        boolean canBeReadOnly) throws IOException {
+        boolean canBeReadOnly
+    ) throws IOException {
         return new ClientCnxn(
             chrootPath,
             hostProvider,
             sessionTimeout,
-            this,
-            watchManager,
+            clientConfig,
+            defaultWatcher,
             clientCnxnSocket,
             canBeReadOnly);
     }
@@ -1383,7 +1002,7 @@ public ZooKeeper(
      *            connects to one in read-only mode, i.e. read requests are
      *            allowed while write requests are not. It continues seeking for
      *            majority in the background.
-     * @param aHostProvider
+     * @param hostProvider
      *            use this as HostProvider to enable custom behaviour.
      * @param clientConfig
      *            (added in 3.5.2) passing this conf object gives each client the flexibility of
@@ -1400,7 +1019,7 @@ public ZooKeeper(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly,
-        HostProvider aHostProvider,
+        HostProvider hostProvider,
         ZKClientConfig clientConfig) throws IOException {
         LOG.info(
             "Initiating client connection, connectString={} "
@@ -1411,22 +1030,16 @@ public ZooKeeper(
             Long.toHexString(sessionId),
             (sessionPasswd == null ? "<null>" : "<hidden>"));
 
-        if (clientConfig == null) {
-            clientConfig = new ZKClientConfig();
-        }
-        this.clientConfig = clientConfig;
-        watchManager = defaultWatchManager();
-        watchManager.defaultWatcher = watcher;
-
+        this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
-        hostProvider = aHostProvider;
+        this.hostProvider = hostProvider;
 
         cnxn = new ClientCnxn(
             connectStringParser.getChrootPath(),
             hostProvider,
             sessionTimeout,
-            this,
-            watchManager,
+            this.clientConfig,
+            watcher,
             getClientCnxnSocket(),
             sessionId,
             sessionPasswd,
@@ -1523,11 +1136,6 @@ public Testable getTestable() {
         return new ZooKeeperTestable(cnxn);
     }
 
-    /* Useful for testing watch handling behavior */
-    protected ZKWatchManager defaultWatchManager() {
-        return new ZKWatchManager(getClientConfig().getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET));
-    }
-
     /**
      * The session id for this ZooKeeper client instance. The value returned is
      * not valid until the client connects to a server and may change after a
@@ -1582,11 +1190,9 @@ public void addAuthInfo(String scheme, byte[] auth) {
     /**
      * Specify the default watcher for the connection (overrides the one
      * specified during construction).
-     *
-     * @param watcher
      */
     public synchronized void register(Watcher watcher) {
-        watchManager.defaultWatcher = watcher;
+        getWatchManager().setDefaultWatcher(watcher);
     }
 
     /**
@@ -3213,9 +2819,11 @@ public void addWatch(String basePath, Watcher watcher, AddWatchMode mode)
      *  error code.
      * @since 3.6.0
      */
-    public void addWatch(String basePath, AddWatchMode mode)
-            throws KeeperException, InterruptedException {
-        addWatch(basePath, watchManager.defaultWatcher, mode);
+    public void addWatch(
+            String basePath,
+            AddWatchMode mode
+    ) throws KeeperException, InterruptedException {
+        addWatch(basePath, getWatchManager().getDefaultWatcher(), mode);
     }
 
     /**
@@ -3229,8 +2837,12 @@ public void addWatch(String basePath, AddWatchMode mode)
      * @throws IllegalArgumentException if an invalid path is specified
      * @since 3.6.0
      */
-    public void addWatch(String basePath, Watcher watcher, AddWatchMode mode,
-                         VoidCallback cb, Object ctx) {
+    public void addWatch(
+            String basePath,
+            Watcher watcher, AddWatchMode mode,
+            VoidCallback cb,
+            Object ctx
+    ) {
         PathUtils.validatePath(basePath);
         String serverPath = prependChroot(basePath);
 
@@ -3251,9 +2863,8 @@ public void addWatch(String basePath, Watcher watcher, AddWatchMode mode,
      * @throws IllegalArgumentException if an invalid path is specified
      * @since 3.6.0
      */
-    public void addWatch(String basePath, AddWatchMode mode,
-                         VoidCallback cb, Object ctx) {
-        addWatch(basePath, watchManager.defaultWatcher, mode, cb, ctx);
+    public void addWatch(String basePath, AddWatchMode mode, VoidCallback cb, Object ctx) {
+        addWatch(basePath, getWatchManager().getDefaultWatcher(), mode, cb, ctx);
     }
 
     private void validateWatcher(Watcher watcher) {
@@ -3271,7 +2882,7 @@ private void removeWatches(
         PathUtils.validatePath(path);
         final String clientPath = path;
         final String serverPath = prependChroot(clientPath);
-        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, watchManager);
+        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, getWatchManager());
 
         RequestHeader h = new RequestHeader();
         h.setType(opCode);
@@ -3294,7 +2905,7 @@ private void removeWatches(
         PathUtils.validatePath(path);
         final String clientPath = path;
         final String serverPath = prependChroot(clientPath);
-        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, watchManager);
+        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, getWatchManager());
 
         RequestHeader h = new RequestHeader();
         h.setType(opCode);
@@ -3424,8 +3035,9 @@ private ClientCnxnSocket getClientCnxnSocket() throws IOException {
      */
     private Watcher getDefaultWatcher(boolean required) {
         if (required) {
-            if (watchManager.defaultWatcher != null) {
-                return watchManager.defaultWatcher;
+            final Watcher defaultWatcher = getWatchManager().getDefaultWatcher();
+            if (defaultWatcher != null) {
+                return defaultWatcher;
             } else {
                 throw new IllegalStateException("Default watcher is required, but it is null.");
             }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 2c7f6bd0547..5ed43fca72e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -281,11 +281,19 @@ public CustomClientCnxn(
             String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            ZKClientConfig zkClientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            super(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            boolean canBeReadOnly
+        ) throws IOException {
+            super(
+                chrootPath,
+                hostProvider,
+                sessionTimeout,
+                zkClientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                canBeReadOnly);
         }
 
         void attemptClose() {
@@ -344,18 +352,25 @@ public boolean isAlive() {
             return cnxn.getState().isAlive();
         }
 
-        @Override
-        protected ClientCnxn createConnection(
+        ClientCnxn createConnection(
             String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
+            boolean canBeReadOnly
+        ) throws IOException {
             Assert.assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
             socket = (FragileClientCnxnSocketNIO) clientCnxnSocket;
-            ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(
+                chrootPath,
+                hostProvider,
+                sessionTimeout,
+                clientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                canBeReadOnly);
             return ClientCnxnSocketFragilityTest.this.cnxn;
         }
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
index e77283c84e5..41f52ea697d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
@@ -66,8 +66,14 @@ public void testClientReconnect() throws IOException, InterruptedException {
         sc = SocketChannel.open();
 
         ClientCnxnSocketNIO nioCnxn = new MockCnxn();
-        ClientWatchManager watcher = mock(ClientWatchManager.class);
-        ClientCnxn clientCnxn = new ClientCnxn("tmp", hostProvider, 5000, zk, watcher, nioCnxn, false);
+        ClientCnxn clientCnxn = new ClientCnxn(
+            "tmp",
+            hostProvider,
+            5000,
+            zk.getClientConfig(),
+            DummyWatcher.INSTANCE,
+            nioCnxn,
+            false);
         clientCnxn.start();
         countDownLatch.await(5000, TimeUnit.MILLISECONDS);
         assertTrue(countDownLatch.getCount() == 0);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index 7c3bf5198f4..d4f95aeb50d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -25,6 +25,7 @@
 import java.io.IOException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.HostProvider;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
@@ -110,15 +111,23 @@ private String getCxnString(int[] clientPorts) {
 
     class CustomClientCnxn extends ClientCnxn {
 
-        public CustomClientCnxn(
+        CustomClientCnxn(
             String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            super(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            boolean canBeReadOnly
+        ) throws IOException {
+            super(
+                chrootPath,
+                hostProvider,
+                sessionTimeout,
+                clientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                canBeReadOnly);
         }
 
         @Override
@@ -140,15 +149,23 @@ public CustomZooKeeper(String connectString, int sessionTimeout, Watcher watcher
         }
 
         @Override
-        protected ClientCnxn createConnection(
+        ClientCnxn createConnection(
             String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            return new CustomClientCnxn(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            boolean canBeReadOnly
+        ) throws IOException {
+            return new CustomClientCnxn(
+                chrootPath,
+                hostProvider,
+                sessionTimeout,
+                clientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                canBeReadOnly);
         }
 
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index 30f1558fd01..8bb91e338bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -18,12 +18,16 @@
 
 package org.apache.zookeeper;
 
+import static org.hamcrest.CoreMatchers.is;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -37,11 +41,9 @@
 import java.util.concurrent.TimeoutException;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.zookeeper.KeeperException.Code;
-import org.apache.zookeeper.KeeperException.NoWatcherException;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
 import org.apache.zookeeper.ZooDefs.Ids;
-import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.Test;
@@ -657,7 +659,9 @@ public void testChRootRemoveWatcher() throws Exception {
     @Test(timeout = 90000)
     public void testNoWatcherServerException() throws InterruptedException, IOException, TimeoutException {
         CountdownWatcher watcher = new CountdownWatcher();
-        MyZooKeeper zk = new MyZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
+        ZooKeeper zk = spy(new ZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher));
+        MyWatchManager watchManager = new MyWatchManager(false, watcher);
+        doReturn(watchManager).when(zk).getWatchManager();
         boolean nw = false;
 
         watcher.waitForConnected(CONNECTION_TIMEOUT);
@@ -670,8 +674,8 @@ public void testNoWatcherServerException() throws InterruptedException, IOExcept
             }
         }
 
-        assertTrue("Server didn't return NOWATCHER", zk.getRemoveWatchesRC() == Code.NOWATCHER.intValue());
-        assertTrue("NoWatcherException didn't happen", nw);
+        assertThat("Server didn't return NOWATCHER", watchManager.lastReturnCode, is(Code.NOWATCHER.intValue()));
+        assertThat("NoWatcherException didn't happen", nw, is(true));
     }
 
     /**
@@ -920,54 +924,32 @@ public void testRemoveAllWatchesOnAPath() throws Exception {
         assertEquals("Received watch notification after removal!", 2, watchCount.getCount());
     }
 
-    /* a mocked ZK class that doesn't do client-side verification
-     * before/after calling removeWatches */
-    private class MyZooKeeper extends ZooKeeper {
+    private static class MyWatchManager extends ZKWatchManager {
 
-        class MyWatchManager extends ZKWatchManager {
+        int lastReturnCode;
 
-            public MyWatchManager(boolean disableAutoWatchReset) {
-                super(disableAutoWatchReset);
-            }
-
-            public int lastrc;
-
-            /* Pretend that any watcher exists */
-            void containsWatcher(String path, Watcher watcher, WatcherType watcherType) throws NoWatcherException {
-            }
-
-            /* save the return error code by the server */
-            protected boolean removeWatches(
-                Map<String, Set<Watcher>> pathVsWatcher,
-                Watcher watcher,
-                String path,
-                boolean local,
-                int rc,
-                Set<Watcher> removedWatchers) throws KeeperException {
-                lastrc = rc;
-                return false;
-            }
-
-        }
-
-        public MyZooKeeper(String hp, int timeout, Watcher watcher) throws IOException {
-            super(hp, timeout, watcher, false);
+        MyWatchManager(boolean disableAutoWatchReset, Watcher defaultWatcher) {
+            super(disableAutoWatchReset, defaultWatcher);
         }
 
-        private MyWatchManager myWatchManager;
-
-        protected ZKWatchManager defaultWatchManager() {
-            myWatchManager = new MyWatchManager(getClientConfig().getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET));
-            return myWatchManager;
+        void containsWatcher(String path, Watcher watcher, WatcherType watcherType) {
+            // prevent contains watcher
         }
 
-        public int getRemoveWatchesRC() {
-            return myWatchManager.lastrc;
+        @Override
+        protected boolean removeWatches(
+            Map<String, Set<Watcher>> pathVsWatcher,
+            Watcher watcher,
+            String path,
+            boolean local,
+            int rc,
+            Set<Watcher> removedWatchers) {
+            lastReturnCode = rc;
+            return false;
         }
-
     }
 
-    private class MyWatcher implements Watcher {
+    private static class MyWatcher implements Watcher {
 
         private final String path;
         private String eventPath;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java b/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java
index a02127aae07..7f9e41e3380 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java
@@ -20,12 +20,10 @@
 
 import java.io.IOException;
 import java.net.SocketAddress;
-import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.jute.Record;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
-import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
 
@@ -35,76 +33,12 @@ public TestableZooKeeper(String host, int sessionTimeout, Watcher watcher) throw
         super(host, sessionTimeout, watcher);
     }
 
-    class TestableClientCnxn extends ClientCnxn {
-
-        TestableClientCnxn(
-            String chrootPath,
-            HostProvider hostProvider,
-            int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
-            ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            super(chrootPath,
-                  hostProvider,
-                  sessionTimeout,
-                  zooKeeper,
-                  watcher,
-                  clientCnxnSocket,
-                  0,
-                  new byte[16],
-                  canBeReadOnly);
-        }
-
-        void setXid(int newXid) {
-            xid = newXid;
-        }
-
-        int checkXid() {
-            return xid;
-        }
-
-    }
-
-    protected ClientCnxn createConnection(
-        String chrootPath,
-        HostProvider hostProvider,
-        int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
-        ClientCnxnSocket clientCnxnSocket,
-        boolean canBeReadOnly) throws IOException {
-        return new TestableClientCnxn(
-            chrootPath,
-            hostProvider,
-            sessionTimeout,
-            this,
-            watcher,
-            clientCnxnSocket,
-            canBeReadOnly);
-    }
-
     public void setXid(int xid) {
-        ((TestableClientCnxn) cnxn).setXid(xid);
+        cnxn.xid = xid;
     }
 
     public int checkXid() {
-        return ((TestableClientCnxn) cnxn).checkXid();
-    }
-
-    @Override
-    public List<String> getChildWatches() {
-        return super.getChildWatches();
-    }
-
-    @Override
-    public List<String> getDataWatches() {
-        return super.getDataWatches();
-    }
-
-    @Override
-    public List<String> getExistWatches() {
-        return super.getExistWatches();
+        return cnxn.xid;
     }
 
     /**

From a908001be9641d78040b1954acb0cd3a8e9e42c2 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Sun, 17 May 2020 15:15:54 +0200
Subject: [PATCH 038/591] ZOOKEEPER-1998: Allow C client to throttle host name
 resolutions

Some environments experience high DNS load because of the name resolutions introduced by [ZOOKEEPER-1355](https://issues.apache.org/jira/browse/ZOOKEEPER-1355).

This patch allows clients to set a minimum delay to observe between "routine" resolutions using a `zoo_set_servers_resolution_delay` API function.

An application can influence the rate of polling via its `delay_ms` parameter: when set to a value greater than zero, the client skips most "routine" resolutions which would have happened in a window of that many milliseconds since the last successful one.

Setting `delay_ms` to `0` disables the new logic, reverting to the default behavior.  Setting it to `-1` disables network resolutions during normal operation (but not, e.g., on connection loss).

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Suhas Dantkale

Closes #1068 from ztzg/ZOOKEEPER-1998-throttle-dns-resolutions
---
 .../zookeeper-client-c/include/zookeeper.h    | 26 ++++++
 .../zookeeper-client-c/src/zk_adaptor.h       |  3 +
 .../zookeeper-client-c/src/zookeeper.c        | 84 +++++++++++++++----
 .../zookeeper-client-c/tests/TestClient.cc    | 74 +++++++++++++++-
 4 files changed, 171 insertions(+), 16 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index d33a44695a7..95959af56fe 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -699,6 +699,32 @@ ZOOAPI sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
  */
 ZOOAPI int zoo_set_servers(zhandle_t *zh, const char *hosts);
 
+/**
+ * \brief sets a minimum delay to observe between "routine" host name
+ * resolutions.
+ *
+ * The client performs regular resolutions of the list of servers
+ * passed to \ref zookeeper_init or set with \ref zoo_set_servers in
+ * order to detect changes at the DNS level.
+ *
+ * By default, it does so every time it checks for socket readiness.
+ * This results in low latency in the detection of changes, but can
+ * lead to heavy DNS traffic when the local cache is not effective.
+ *
+ * This method allows an application to influence the rate of polling.
+ * When delay_ms is set to a value greater than zero, the client skips
+ * most "routine" resolutions which would have happened in a window of
+ * that many milliseconds since the last succesful one.
+ *
+ * Setting delay_ms to 0 disables this logic, reverting to the default
+ * behavior.  Setting it to -1 disables network resolutions during
+ * normal operation (but not, e.g., on connection loss).
+ *
+ * \param delay_ms 0, -1, or the window size in milliseconds
+ * \return ZOK on success or ZBADARGUMENTS for invalid input parameters
+ */
+ZOOAPI int zoo_set_servers_resolution_delay(zhandle_t *zh, int delay_ms);
+
 /**
  * \brief cycle to the next server on the next connection attempt.
  *
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h b/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
index 57696d4b203..46a7e7ed6e3 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
+++ b/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
@@ -200,6 +200,9 @@ struct _zhandle {
     addrvec_t addrs_old;                // old list of addresses that we are no longer connected to
     addrvec_t addrs_new;                // new list of addresses to connect to if we're reconfiguring
 
+    struct timeval last_resolve;        // time of last hostname resolution
+    int resolve_delay_ms;               // see zoo_set_servers_resolution_delay
+
     int reconfig;                       // Are we in the process of reconfiguring cluster's ensemble
     double pOld, pNew;                  // Probability for selecting between 'addrs_old' and 'addrs_new'
     int delay;
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index a273225ff69..8df4b29dcc5 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -244,6 +244,8 @@ typedef struct _completion_list {
 } completion_list_t;
 
 const char*err2string(int err);
+static inline int calculate_interval(const struct timeval *start,
+        const struct timeval *end);
 static int queue_session_event(zhandle_t *zh, int state);
 static const char* format_endpoint_info(const struct sockaddr_storage* ep);
 
@@ -984,10 +986,14 @@ static int resolve_hosts(const zhandle_t *zh, const char *hosts_in, addrvec_t *a
  *
  * See zoo_cycle_next_server for the selection logic.
  *
+ * \param ref_time an optional "reference time," used to determine if
+ * resolution can be skipped in accordance to the delay set by \ref
+ * zoo_set_servers_resolution_delay.  Passing NULL prevents skipping.
+ *
  * See {@link https://issues.apache.org/jira/browse/ZOOKEEPER-1355} for the
  * protocol and its evaluation,
  */
-int update_addrs(zhandle_t *zh)
+int update_addrs(zhandle_t *zh, const struct timeval *ref_time)
 {
     int rc = ZOK;
     char *hosts = NULL;
@@ -1008,26 +1014,54 @@ int update_addrs(zhandle_t *zh)
         return ZSYSTEMERROR;
     }
 
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     lock_reconfig(zh);
 
+    // Check if we are due for a host name resolution.  (See
+    // zoo_set_servers_resolution_delay.  The answer is always "yes"
+    // if no reference is provided or the file descriptor is invalid.)
+    if (ref_time && zh->fd->sock != -1) {
+        int do_resolve;
+
+        if (zh->resolve_delay_ms <= 0) {
+            // -1 disables, 0 means unconditional.  Fail safe.
+            do_resolve = zh->resolve_delay_ms != -1;
+        } else {
+            int elapsed_ms = calculate_interval(&zh->last_resolve, ref_time);
+            // Include < 0 in case of overflow, or if we are not
+            // backed by a monotonic clock.
+            do_resolve = elapsed_ms > zh->resolve_delay_ms || elapsed_ms < 0;
+        }
+
+        if (!do_resolve) {
+            goto finish;
+        }
+    }
+
     // Copy zh->hostname for local use
     hosts = strdup(zh->hostname);
     if (hosts == NULL) {
         rc = ZSYSTEMERROR;
-        goto fail;
+        goto finish;
     }
 
     rc = resolve_hosts(zh, hosts, &resolved);
     if (rc != ZOK)
     {
-        goto fail;
+        goto finish;
+    }
+
+    // Unconditionally note last resolution time.
+    if (ref_time) {
+        zh->last_resolve = *ref_time;
+    } else {
+        get_system_time(&zh->last_resolve);
     }
 
     // If the addrvec list is identical to last time we ran don't do anything
     if (addrvec_eq(&zh->addrs, &resolved))
     {
-        goto fail;
+        goto finish;
     }
 
     // Is the server we're connected to in the new resolved list?
@@ -1047,14 +1081,14 @@ int update_addrs(zhandle_t *zh)
             rc = addrvec_append(&zh->addrs_old, resolved_address);
             if (rc != ZOK)
             {
-                goto fail;
+                goto finish;
             }
         }
         else {
             rc = addrvec_append(&zh->addrs_new, resolved_address);
             if (rc != ZOK)
             {
-                goto fail;
+                goto finish;
             }
         }
     }
@@ -1107,13 +1141,13 @@ int update_addrs(zhandle_t *zh)
         zh->state = ZOO_NOTCONNECTED_STATE;
     }
 
-fail:
+finish:
 
     unlock_reconfig(zh);
 
     // If we short-circuited out and never assigned resolved to zh->addrs then we
     // need to free resolved to avoid a memleak.
-    if (zh->addrs.data != resolved.data)
+    if (resolved.data && zh->addrs.data != resolved.data)
     {
         addrvec_free(&resolved);
     }
@@ -1310,7 +1344,7 @@ static zhandle_t *zookeeper_init_internal(const char *host, watcher_fn watcher,
     if (zh->hostname == 0) {
         goto abort;
     }
-    if(update_addrs(zh) != 0) {
+    if(update_addrs(zh, NULL) != 0) {
         goto abort;
     }
 
@@ -1404,7 +1438,7 @@ int zoo_set_servers(zhandle_t *zh, const char *hosts)
         return ZBADARGUMENTS;
     }
 
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     lock_reconfig(zh);
 
     // Reset hostname to new set of hosts to connect to
@@ -1416,7 +1450,27 @@ int zoo_set_servers(zhandle_t *zh, const char *hosts)
 
     unlock_reconfig(zh);
 
-    return update_addrs(zh);
+    return update_addrs(zh, NULL);
+}
+
+/*
+ * Sets a minimum delay to observe between "routine" host name
+ * resolutions.  See prototype for full documentation.
+ */
+int zoo_set_servers_resolution_delay(zhandle_t *zh, int delay_ms) {
+    if (delay_ms < -1) {
+        LOG_ERROR(LOGCALLBACK(zh), "Resolution delay cannot be %d", delay_ms);
+        return ZBADARGUMENTS;
+    }
+
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
+    lock_reconfig(zh);
+
+    zh->resolve_delay_ms = delay_ms;
+
+    unlock_reconfig(zh);
+
+    return ZOK;
 }
 
 /**
@@ -1481,7 +1535,7 @@ static int get_next_server_in_reconfig(zhandle_t *zh)
  */
 void zoo_cycle_next_server(zhandle_t *zh)
 {
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     lock_reconfig(zh);
 
     memset(&zh->addr_cur, 0, sizeof(zh->addr_cur));
@@ -1513,7 +1567,7 @@ const char* zoo_get_current_server(zhandle_t* zh)
 {
     const char *endpoint_info = NULL;
 
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     // Need the lock here as it is changed in update_addrs()
     lock_reconfig(zh);
 
@@ -2415,7 +2469,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
     }
     api_prolog(zh);
 
-    rc = update_addrs(zh);
+    rc = update_addrs(zh, &now);
     if (rc != ZOK) {
         return api_epilog(zh, rc);
     }
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
index 2a6e9925470..80e4c928a51 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
@@ -227,6 +227,7 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     CPPUNIT_TEST(testWatcherAutoResetWithLocal);
     CPPUNIT_TEST(testGetChildren2);
     CPPUNIT_TEST(testLastZxid);
+    CPPUNIT_TEST(testServersResolutionDelay);
     CPPUNIT_TEST(testRemoveWatchers);
 #endif
     CPPUNIT_TEST_SUITE_END();
@@ -386,7 +387,78 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT(zh->io_count < 2);
         zookeeper_close(zh);
     }
-    
+
+    /* Checks the zoo_set_servers_resolution_delay default and operation */
+    void testServersResolutionDelay() {
+        watchctx_t ctx;
+        zhandle_t *zk = createClient(&ctx);
+        int rc;
+        struct timeval tv;
+        struct Stat stat;
+
+        CPPUNIT_ASSERT(zk);
+        CPPUNIT_ASSERT(zk->resolve_delay_ms == 0);
+
+        // a) Default/0 case: resolve at each request.
+
+        tv = zk->last_resolve;
+        usleep(10000); // 10ms
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must have changed because of the request.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec != tv.tv_sec ||
+                       zk->last_resolve.tv_usec != tv.tv_usec);
+
+        // b) Disabled/-1 case: never perform "routine" resolutions.
+
+        rc = zoo_set_servers_resolution_delay(zk, -1); // Disabled
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        tv = zk->last_resolve;
+        usleep(10000); // 10ms
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must not have changed as auto-resolution is disabled.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec == tv.tv_sec &&
+                       zk->last_resolve.tv_usec == tv.tv_usec);
+
+        // c) Invalid delay is rejected.
+
+        rc = zoo_set_servers_resolution_delay(zk, -1000); // Bad
+        CPPUNIT_ASSERT_EQUAL((int)ZBADARGUMENTS, rc);
+
+        // d) Valid delay, no resolution within window.
+
+        rc = zoo_set_servers_resolution_delay(zk, 500); // 0.5s
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        tv = zk->last_resolve;
+        usleep(10000); // 10ms
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must not have changed because the request (hopefully!)
+        // executed in less than 0.5s.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec == tv.tv_sec &&
+                       zk->last_resolve.tv_usec == tv.tv_usec);
+
+        // e) Valid delay, at least one resolution after delay.
+
+        usleep(500 * 1000); // 0.5s
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must have changed because we waited 0.5s between the
+        // capture and the last request.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec != tv.tv_sec ||
+                       zk->last_resolve.tv_usec != tv.tv_usec);
+    }
 
     void testPing()
     {

From 5e88b541dcc2fd30e60bb437efa7704bbec8f6e6 Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Wed, 20 May 2020 19:56:26 +0200
Subject: [PATCH 039/591] ZOOKEEPER-3834: Do Not Set Explicit Test Includes in
 POM

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1355 from belugabehr/ZOOKEEPER-3834
---
 zookeeper-recipes/zookeeper-recipes-election/pom.xml | 3 ---
 zookeeper-recipes/zookeeper-recipes-lock/pom.xml     | 3 ---
 zookeeper-recipes/zookeeper-recipes-queue/pom.xml    | 3 ---
 3 files changed, 9 deletions(-)

diff --git a/zookeeper-recipes/zookeeper-recipes-election/pom.xml b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
index a4deb42eb2e..cc9728c0fb1 100755
--- a/zookeeper-recipes/zookeeper-recipes-election/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
@@ -39,9 +39,6 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
           <forkCount>${surefire-forkcount}</forkCount>
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m</argLine>
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
index 4a5b134cb0f..68dbec53485 100755
--- a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
@@ -39,9 +39,6 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
           <forkCount>${surefire-forkcount}</forkCount>
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m</argLine>
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
index 3fa024694df..918fb647132 100755
--- a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
@@ -44,9 +44,6 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
           <forkCount>${surefire-forkcount}</forkCount>
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m</argLine>

From 9e50853da2da5aa982a4b0da790f2da51575b6f1 Mon Sep 17 00:00:00 2001
From: Norbert Kalmar <nkalmar@apache.org>
Date: Thu, 21 May 2020 11:19:39 +0200
Subject: [PATCH 040/591] ZOOKEEPER-3792: fix apidocs path

Fix path that leads to the apidocs. I will manually correct the already generated paths in asf-site after this has been merged.
This PR needs to land on master, 3.6 and 3.5

Author: Norbert Kalmar <nkalmar@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1362 from nkalmar/master
---
 zookeeper-docs/src/main/resources/markdown/html/header.html     | 2 +-
 zookeeper-docs/src/main/resources/markdown/index.md             | 2 +-
 zookeeper-docs/src/main/resources/markdown/releasenotes.md      | 2 +-
 zookeeper-docs/src/main/resources/markdown/skin/init.js         | 2 +-
 .../src/main/resources/markdown/zookeeperProgrammers.md         | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/html/header.html b/zookeeper-docs/src/main/resources/markdown/html/header.html
index ef07e99b325..c529f880747 100644
--- a/zookeeper-docs/src/main/resources/markdown/html/header.html
+++ b/zookeeper-docs/src/main/resources/markdown/html/header.html
@@ -70,7 +70,7 @@
         <div onclick="SwitchMenu('menu_2', 'skin/')" id="menu_2Title" class="menutitle">Developer</div>
         <div id="menu_2" class="menuitemgroup">
             <div class="menuitem">
-                <a href="api/index.html">API Docs</a>
+                <a href="apidocs/zookeeper-server/index.html">API Docs</a>
             </div>
             <div class="menuitem">
                 <a href="zookeeperProgrammers.html">Programmer's Guide</a>
diff --git a/zookeeper-docs/src/main/resources/markdown/index.md b/zookeeper-docs/src/main/resources/markdown/index.md
index 41dc260aed2..443ba3ab833 100644
--- a/zookeeper-docs/src/main/resources/markdown/index.md
+++ b/zookeeper-docs/src/main/resources/markdown/index.md
@@ -36,7 +36,7 @@ archives.
     + [Release Notes](releasenotes.html) - new developer and user facing features, improvements, and incompatibilities
 + **Developers**
     Documents for Developers using the ZooKeeper Client API
-    + [API Docs](api/index.html) - the technical reference to ZooKeeper Client APIs
+    + [API Docs](apidocs/zookeeper-server/index.html) - the technical reference to ZooKeeper Client APIs
     + [Programmer's Guide](zookeeperProgrammers.html) - a client application developer's guide to ZooKeeper
     + [ZooKeeper Use Cases](zookeeperUseCases.html) - a series of use cases using the ZooKeeper.
     + [ZooKeeper Java Example](javaExample.html) - a simple Zookeeper client application, written in Java
diff --git a/zookeeper-docs/src/main/resources/markdown/releasenotes.md b/zookeeper-docs/src/main/resources/markdown/releasenotes.md
index 67dd47ab1a6..e32614df065 100644
--- a/zookeeper-docs/src/main/resources/markdown/releasenotes.md
+++ b/zookeeper-docs/src/main/resources/markdown/releasenotes.md
@@ -75,7 +75,7 @@ Call specific watch functions receive all session events for as long as they are
 1. A number of constants used in the client ZooKeeper API were re-specified using enums (rather than ints). See [ZOOKEEPER-7](https://issues.apache.org/jira/browse/ZOOKEEPER-7), [ZOOKEEPER-132](https://issues.apache.org/jira/browse/ZOOKEEPER-132) and [ZOOKEEPER-139](https://issues.apache.org/jira/browse/ZOOKEEPER-139) for full details
 1. [ZOOKEEPER-18](https://issues.apache.org/jira/browse/ZOOKEEPER-18) removed KeeperStateChanged, use KeeperStateDisconnected instead
 
-Also see [the current Java API](http://zookeeper.apache.org/docs/current/api/index.html)
+Also see [the current Java API](http://zookeeper.apache.org/docs/current/apidocs/zookeeper-server/index.html)
 
 <a name="C+API"></a>
 #### C API
diff --git a/zookeeper-docs/src/main/resources/markdown/skin/init.js b/zookeeper-docs/src/main/resources/markdown/skin/init.js
index f94eda1a630..fa40beb7545 100644
--- a/zookeeper-docs/src/main/resources/markdown/skin/init.js
+++ b/zookeeper-docs/src/main/resources/markdown/skin/init.js
@@ -43,7 +43,7 @@ function init(){
                     var linkItem = menuItem[j].firstElementChild;
                     if('a' === linkItem.localName){
                         var linkFile = getFileName(linkItem.href);
-                        if(fileName === linkFile && linkItem.href.lastIndexOf("api/index.html")<0){
+                        if(fileName === linkFile && linkItem.href.lastIndexOf("apidocs/zookeeper-server/index.html")<0){
                             linkItem.className = "selected";
                             linkItem.parentNode.parentNode.className = "selectedmenuitemgroup";
                             var title = document.getElementById(linkItem.parentNode.parentNode.id+"Title");
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 5d071590d8f..68662f34db4 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1600,7 +1600,7 @@ ZooKeeper users fall into:
 Outside the formal documentation, there're several other sources of
 information for ZooKeeper developers.
 
-* *[API Reference](https://zookeeper.apache.org/doc/current/api/index.html)* :
+* *[API Reference](https://zookeeper.apache.org/doc/current/apidocs/zookeeper-server/index.html)* :
     The complete reference to the ZooKeeper API
 
 * *[ZooKeeper Talk at the Hadoop Summit 2008](https://www.youtube.com/watch?v=rXI9xiesUV8)* :

From 5820d10d9dc58c8e12d2e25386fdf92acb360359 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Thu, 21 May 2020 14:13:32 +0200
Subject: [PATCH 041/591] ZOOKEEPER-3832: ZKHostnameVerifier rejects valid
 certificates with subjectAltNames

This issue has been reported by a user who wanted to use a cert that contains SAN entries that are not of type DNS or IP.
I've come across the following ticket in http client project which seems to be related:
https://issues.apache.org/jira/browse/HTTPCLIENT-1906

This is the backport of the fix.

Original patch: https://github.com/apache/httpcomponents-client/commit/56cc24525e5ba2a5ef8fa0de2385687e83589a71

Target versions: 3.5, 3.6, 3.7

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1353 from anmolnar/ZOOKEEPER-3832
---
 checkstyleSuppressions.xml                    |   2 +
 .../zookeeper/common/ZKHostnameVerifier.java  |  10 +-
 .../common/CertificatesToPlayWith.java        | 569 ++++++++++++++++++
 .../common/ZKHostnameVerifierTest.java        | 161 +++++
 4 files changed, 740 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java

diff --git a/checkstyleSuppressions.xml b/checkstyleSuppressions.xml
index 53d92eb5bda..0a270041419 100644
--- a/checkstyleSuppressions.xml
+++ b/checkstyleSuppressions.xml
@@ -32,4 +32,6 @@
 
     <!-- TODO ZOOKEEPER-3469 -->
     <suppress checks="Javadoc.+" files=".+[\\/]zookeeper-server[\\/].+\.java"/>
+
+    <suppress checks="OperatorWrap|ModifierOrder" files="zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith\.java" />
 </suppressions>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
index 6415989ddb9..db5af19c54a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
@@ -324,8 +324,14 @@ private static List<SubjectName> getSubjectAltNames(final X509Certificate cert)
             for (List<?> entry : entries) {
                 final Integer type = entry.size() >= 2 ? (Integer) entry.get(0) : null;
                 if (type != null) {
-                    final String s = (String) entry.get(1);
-                    result.add(new SubjectName(s, type));
+                    if (type == SubjectName.DNS || type == SubjectName.IP) {
+                        final Object o = entry.get(1);
+                        if (o instanceof String) {
+                            result.add(new SubjectName((String) o, type));
+                        } else if (o instanceof byte[]) {
+                            // TODO ASN.1 DER encoded form
+                        }
+                    }
                 }
             }
             return result;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
new file mode 100644
index 00000000000..1101c737172
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
@@ -0,0 +1,569 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+/**
+ * Some X509 certificates to test against.
+ * <p>
+ * Note:  some of these certificates have Japanese Kanji in the "subjectAlt"
+ * field (UTF8).  Not sure how realistic that is since international characters
+ * in DNS names usually get translated into ASCII using "xn--" style DNS
+ * entries.  "xn--i8s592g.co.jp" is what FireFox actually uses when trying to
+ * find &#x82b1;&#x5b50;.co.jp.  So would the CN in the certificate contain
+ * "xn--i8s592g.co.jp" in ASCII, or "&#x82b1;&#x5b50;.co.jp" in UTF8?  (Both?)
+ * </p>
+ *
+ * @since 11-Dec-2006
+ */
+public class CertificatesToPlayWith {
+
+    /**
+     * CN=foo.com
+     */
+    public final static byte[] X509_FOO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aQMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzE0MVoXDTI4MTEwNTE1MzE0MVowgaQx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n" +
+                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
+                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
+                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
+                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
+                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
+                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
+                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n" +
+                    "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n" +
+                    "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n" +
+                    "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQC3jRmEya6sQCkmieULcvx8zz1euCk9\n" +
+                    "fSez7BEtki8+dmfMXe3K7sH0lI8f4jJR0rbSCjpmCQLYmzC3NxBKeJOW0RcjNBpO\n" +
+                    "c2JlGO9auXv2GDP4IYiXElLJ6VSqc8WvDikv0JmCCWm0Zga+bZbR/EWN5DeEtFdF\n" +
+                    "815CLpJZNcYwiYwGy/CVQ7w2TnXlG+mraZOz+owr+cL6J/ZesbdEWfjoS1+cUEhE\n" +
+                    "HwlNrAu8jlZ2UqSgskSWlhYdMTAP9CPHiUv9N7FcT58Itv/I4fKREINQYjDpvQcx\n" +
+                    "SaTYb9dr5sB4WLNglk7zxDtM80H518VvihTcP7FHL+Gn6g4j5fkI98+S\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=&#x82b1;&#x5b50;.co.jp
+     */
+    public final static byte[] X509_HANAKO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIESzCCAzOgAwIBAgIJAIz+EYMBU6aTMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1NDIxNVoXDTI4MTEwNTE1NDIxNVowgakx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczEVMBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkB\n" +
+                    "FhZqdWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n" +
+                    "MIIBCgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjU\n" +
+                    "g4pNjYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQc\n" +
+                    "wHf0ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t\n" +
+                    "7iu1JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAn\n" +
+                    "AxK6q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArD\n" +
+                    "qUYxqJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwG\n" +
+                    "CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV\n" +
+                    "HQ4EFgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLS\n" +
+                    "rNuzA1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBALJ27i3okV/KvlDp6KMID3gd\n" +
+                    "ITl68PyItzzx+SquF8gahMh016NX73z/oVZoVUNdftla8wPUB1GwIkAnGkhQ9LHK\n" +
+                    "spBdbRiCj0gMmLCsX8SrjFvr7cYb2cK6J/fJe92l1tg/7Y4o7V/s4JBe/cy9U9w8\n" +
+                    "a0ctuDmEBCgC784JMDtT67klRfr/2LlqWhlOEq7pUFxRLbhpquaAHSOjmIcWnVpw\n" +
+                    "9BsO7qe46hidgn39hKh1WjKK2VcL/3YRsC4wUi0PBtFW6ScMCuMhgIRXSPU55Rae\n" +
+                    "UIlOdPjjr1SUNWGId1rD7W16Scpwnknn310FNxFMHVI0GTGFkNdkilNCFJcIoRA=\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=foo.com, subjectAlt=bar.com
+     */
+    public final static byte[] X509_FOO_BAR = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIEXDCCA0SgAwIBAgIJAIz+EYMBU6aRMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzYyOVoXDTI4MTEwNTE1MzYyOVowgaQx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n" +
+                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
+                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
+                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
+                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
+                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
+                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
+                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCG\n" +
+                    "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n" +
+                    "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n" +
+                    "A1LKh6YNPg0wEgYDVR0RBAswCYIHYmFyLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEA\n" +
+                    "dQyprNZBmVnvuVWjV42sey/PTfkYShJwy1j0/jcFZR/ypZUovpiHGDO1DgL3Y3IP\n" +
+                    "zVQ26uhUsSw6G0gGRiaBDe/0LUclXZoJzXX1qpS55OadxW73brziS0sxRgGrZE/d\n" +
+                    "3g5kkio6IED47OP6wYnlmZ7EKP9cqjWwlnvHnnUcZ2SscoLNYs9rN9ccp8tuq2by\n" +
+                    "88OyhKwGjJfhOudqfTNZcDzRHx4Fzm7UsVaycVw4uDmhEHJrAsmMPpj/+XRK9/42\n" +
+                    "2xq+8bc6HojdtbCyug/fvBZvZqQXSmU8m8IVcMmWMz0ZQO8ee3QkBHMZfCy7P/kr\n" +
+                    "VbWx/uETImUu+NZg22ewEw==\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=foo.com, subjectAlt=bar.com, subjectAlt=&#x82b1;&#x5b50;.co.jp
+     * (hanako.co.jp in kanji)
+     */
+    public final static byte[] X509_FOO_BAR_HANAKO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIEajCCA1KgAwIBAgIJAIz+EYMBU6aSMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzgxM1oXDTI4MTEwNTE1MzgxM1owgaQx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n" +
+                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
+                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
+                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
+                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
+                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
+                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
+                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBnjCBmzAJBgNVHRMEAjAAMCwGCWCG\n" +
+                    "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n" +
+                    "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n" +
+                    "A1LKh6YNPg0wIAYDVR0RBBkwF4IHYmFyLmNvbYIM6Iqx5a2QLmNvLmpwMA0GCSqG\n" +
+                    "SIb3DQEBBQUAA4IBAQBeZs7ZIYyKtdnVxVvdLgwySEPOE4pBSXii7XYv0Q9QUvG/\n" +
+                    "++gFGQh89HhABzA1mVUjH5dJTQqSLFvRfqTHqLpxSxSWqMHnvRM4cPBkIRp/XlMK\n" +
+                    "PlXadYtJLPTgpbgvulA1ickC9EwlNYWnowZ4uxnfsMghW4HskBqaV+PnQ8Zvy3L0\n" +
+                    "12c7Cg4mKKS5pb1HdRuiD2opZ+Hc77gRQLvtWNS8jQvd/iTbh6fuvTKfAOFoXw22\n" +
+                    "sWIKHYrmhCIRshUNohGXv50m2o+1w9oWmQ6Dkq7lCjfXfUB4wIbggJjpyEtbNqBt\n" +
+                    "j4MC2x5rfsLKKqToKmNE7pFEgqwe8//Aar1b+Qj+\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=*.foo.com
+     */
+    public final static byte[] X509_WILD_FOO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIESDCCAzCgAwIBAgIJAIz+EYMBU6aUMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTU1NVoXDTI4MTEwNTE2MTU1NVowgaYx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n" +
+                    "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n" +
+                    "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n" +
+                    "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n" +
+                    "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n" +
+                    "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n" +
+                    "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n" +
+                    "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG\n" +
+                    "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n" +
+                    "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n" +
+                    "A1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBAH0ipG6J561UKUfgkeW7GvYwW98B\n" +
+                    "N1ZooWX+JEEZK7+Pf/96d3Ij0rw9ACfN4bpfnCq0VUNZVSYB+GthQ2zYuz7tf/UY\n" +
+                    "A6nxVgR/IjG69BmsBl92uFO7JTNtHztuiPqBn59pt+vNx4yPvno7zmxsfI7jv0ww\n" +
+                    "yfs+0FNm7FwdsC1k47GBSOaGw38kuIVWqXSAbL4EX9GkryGGOKGNh0qvAENCdRSB\n" +
+                    "G9Z6tyMbmfRY+dLSh3a9JwoEcBUso6EWYBakLbq4nG/nvYdYvG9ehrnLVwZFL82e\n" +
+                    "l3Q/RK95bnA6cuRClGusLad0e6bjkBzx/VQ3VarDEpAkTLUGVAa0CLXtnyc=\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=*.co.jp
+     */
+    public final static byte[] X509_WILD_CO_JP = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aVMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTYzMFoXDTI4MTEwNTE2MTYzMFowgaQx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczEQMA4GA1UEAxQHKi5jby5qcDElMCMGCSqGSIb3DQEJARYWanVs\n" +
+                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
+                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
+                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
+                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
+                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
+                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
+                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n" +
+                    "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n" +
+                    "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n" +
+                    "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQA0sWglVlMx2zNGvUqFC73XtREwii53\n" +
+                    "CfMM6mtf2+f3k/d8KXhLNySrg8RRlN11zgmpPaLtbdTLrmG4UdAHHYr8O4y2BBmE\n" +
+                    "1cxNfGxxechgF8HX10QV4dkyzp6Z1cfwvCeMrT5G/V1pejago0ayXx+GPLbWlNeZ\n" +
+                    "S+Kl0m3p+QplXujtwG5fYcIpaGpiYraBLx3Tadih39QN65CnAh/zRDhLCUzKyt9l\n" +
+                    "UGPLEUDzRHMPHLnSqT1n5UU5UDRytbjJPXzF+l/+WZIsanefWLsxnkgAuZe/oMMF\n" +
+                    "EJMryEzOjg4Tfuc5qM0EXoPcQ/JlheaxZ40p2IyHqbsWV4MRYuFH4bkM\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=*.foo.com, subjectAlt=*.bar.com, subjectAlt=*.&#x82b1;&#x5b50;.co.jp
+     * (*.hanako.co.jp in kanji)
+     */
+    public final static byte[] X509_WILD_FOO_BAR_HANAKO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIEcDCCA1igAwIBAgIJAIz+EYMBU6aWMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTczMVoXDTI4MTEwNTE2MTczMVowgaYx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n" +
+                    "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n" +
+                    "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n" +
+                    "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n" +
+                    "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n" +
+                    "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n" +
+                    "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n" +
+                    "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo4GiMIGfMAkGA1UdEwQCMAAwLAYJ\n" +
+                    "YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud\n" +
+                    "DgQWBBSfFHe/Pzq2yjiCQkgWLNrQy16H2DAfBgNVHSMEGDAWgBR7mtqPkJlOUtKs\n" +
+                    "27MDUsqHpg0+DTAkBgNVHREEHTAbggkqLmJhci5jb22CDiou6Iqx5a2QLmNvLmpw\n" +
+                    "MA0GCSqGSIb3DQEBBQUAA4IBAQBobWC+D5/lx6YhX64CwZ26XLjxaE0S415ajbBq\n" +
+                    "DK7lz+Rg7zOE3GsTAMi+ldUYnhyz0wDiXB8UwKXl0SDToB2Z4GOgqQjAqoMmrP0u\n" +
+                    "WB6Y6dpkfd1qDRUzI120zPYgSdsXjHW9q2H77iV238hqIU7qCvEz+lfqqWEY504z\n" +
+                    "hYNlknbUnR525ItosEVwXFBJTkZ3Yw8gg02c19yi8TAh5Li3Ad8XQmmSJMWBV4XK\n" +
+                    "qFr0AIZKBlg6NZZFf/0dP9zcKhzSriW27bY0XfzA6GSiRDXrDjgXq6baRT6YwgIg\n" +
+                    "pgJsDbJtZfHnV1nd3M6zOtQPm1TIQpNmMMMd/DPrGcUQerD3\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=foo.com, CN=bar.com, CN=&#x82b1;&#x5b50;.co.jp
+     */
+    public final static byte[] X509_THREE_CNS_FOO_BAR_HANAKO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIEbzCCA1egAwIBAgIJAIz+EYMBU6aXMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTk0NVoXDTI4MTEwNTE2MTk0NVowgc0x\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczEQMA4GA1UEAwwHZm9vLmNvbTEQMA4GA1UEAwwHYmFyLmNvbTEV\n" +
+                    "MBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyGOv\n" +
+                    "loI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pNjYGViGjg7zhf\n" +
+                    "bjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0ZHLN6sD9m2uV\n" +
+                    "Sp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1JVjTuE0pcBva\n" +
+                    "h2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6q/wGqcZ3zvFB\n" +
+                    "TcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYxqJUlPGlMqrKb\n" +
+                    "3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf\n" +
+                    "Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86\n" +
+                    "tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0w\n" +
+                    "DQYJKoZIhvcNAQEFBQADggEBAGuZb8ai1NO2j4v3y9TLZvd5s0vh5/TE7n7RX+8U\n" +
+                    "y37OL5k7x9nt0mM1TyAKxlCcY+9h6frue8MemZIILSIvMrtzccqNz0V1WKgA+Orf\n" +
+                    "uUrabmn+CxHF5gpy6g1Qs2IjVYWA5f7FROn/J+Ad8gJYc1azOWCLQqSyfpNRLSvY\n" +
+                    "EriQFEV63XvkJ8JrG62b+2OT2lqT4OO07gSPetppdlSa8NBSKP6Aro9RIX1ZjUZQ\n" +
+                    "SpQFCfo02NO0uNRDPUdJx2huycdNb+AXHaO7eXevDLJ+QnqImIzxWiY6zLOdzjjI\n" +
+                    "VBMkLHmnP7SjGSQ3XA4ByrQOxfOUTyLyE7NuemhHppuQPxE=\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * subjectAlt=foo.com
+     */
+    public final static byte[] X509_NO_CNS_FOO = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIESjCCAzKgAwIBAgIJAIz+EYMBU6aYMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
+                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
+                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
+                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MjYxMFoXDTI4MTEwNTE2MjYxMFowgZIx\n" +
+                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n" +
+                    "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n" +
+                    "cnRpZmljYXRlczElMCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNv\n" +
+                    "bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhjr5aCPoyp0R1iroWA\n" +
+                    "fnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2BlYho4O84X244QrZTRl8kQbYt\n" +
+                    "xnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRyzerA/ZtrlUqf+lKo0uWcocxe\n" +
+                    "Rc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY07hNKXAb2odnVqgzcYiDkLV8\n" +
+                    "ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8BqnGd87xQU3FVZI4tbtkB+Kz\n" +
+                    "jD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiVJTxpTKqym93whYk93l3ocEe5\n" +
+                    "5c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM\n" +
+                    "IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86tso4gkJIFiza\n" +
+                    "0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0wEgYDVR0RBAsw\n" +
+                    "CYIHZm9vLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEAjl78oMjzFdsMy6F1sGg/IkO8\n" +
+                    "tF5yUgPgFYrs41yzAca7IQu6G9qtFDJz/7ehh/9HoG+oqCCIHPuIOmS7Sd0wnkyJ\n" +
+                    "Y7Y04jVXIb3a6f6AgBkEFP1nOT0z6kjT7vkA5LJ2y3MiDcXuRNMSta5PYVnrX8aZ\n" +
+                    "yiqVUNi40peuZ2R8mAUSBvWgD7z2qWhF8YgDb7wWaFjg53I36vWKn90ZEti3wNCw\n" +
+                    "qAVqixM+J0qJmQStgAc53i2aTMvAQu3A3snvH/PHTBo+5UL72n9S1kZyNCsVf1Qo\n" +
+                    "n8jKTiRriEM+fMFlcgQP284EBFzYHyCXFb9O/hMjK2+6mY9euMB1U1aFFzM/Bg==\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * Intermediate CA for all of these.
+     */
+    public final static byte[] X509_INTERMEDIATE_CA = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIEnDCCA4SgAwIBAgIJAJTNwZ6yNa5cMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n" +
+                    "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n" +
+                    "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjE0OTMx\n" +
+                    "WhcNMDcxMTA1MjE0OTMxWjCBojELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRIw\n" +
+                    "EAYDVQQHEwlWYW5jb3V2ZXIxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDASBgNV\n" +
+                    "BAsUC2NvbW1vbnNfc3NsMR0wGwYDVQQDFBRkZW1vX2ludGVybWVkaWF0ZV9jYTEl\n" +
+                    "MCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZI\n" +
+                    "hvcNAQEBBQADggEPADCCAQoCggEBAL0S4y3vUO0EM6lwqOEfK8fvrUprIbsikXaG\n" +
+                    "XzejcZ+T3l2Dc7t8WtBfRf78i4JypMqJQSijrUicj3H6mOMIReKaXm6ls4hA5d8w\n" +
+                    "Lhmgiqsz/kW+gA8SeWGWRN683BD/RbQmzOls6ynBvap9jZlthXWBrSIlPCQoBLXY\n" +
+                    "KVaxGzbL4ezaq+XFMKMQSm2uKwVmHHQNbfmZlPsuendBVomb/ked53Ab9IH6dwwN\n" +
+                    "qJH9WIrvIzIVEXWlpvQ5MCqozM7u1akU+G8cazr8theGPCaYkzoXnigWua4OjdpV\n" +
+                    "9z5ZDknhfBzG1AjapdG07FIirwWWgIyZXqZSD96ikmLtwT29qnsCAwEAAaOB7jCB\n" +
+                    "6zAdBgNVHQ4EFgQUe5raj5CZTlLSrNuzA1LKh6YNPg0wgbsGA1UdIwSBszCBsIAU\n" +
+                    "rN8eFIvMiRFXXgDqKumS0/W2AhOhgYykgYkwgYYxCzAJBgNVBAYTAkNBMQswCQYD\n" +
+                    "VQQIEwJCQzEWMBQGA1UEChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9u\n" +
+                    "c19zc2wxFTATBgNVBAMUDGRlbW9fcm9vdF9jYTElMCMGCSqGSIb3DQEJARYWanVs\n" +
+                    "aXVzZGF2aWVzQGdtYWlsLmNvbYIJAJTNwZ6yNa5bMAwGA1UdEwQFMAMBAf8wDQYJ\n" +
+                    "KoZIhvcNAQEFBQADggEBAIB4KMZvHD20pdKajFtMBpL7X4W4soq6EeTtjml3NYa9\n" +
+                    "Qc52bsQEGNccKY9afYSBIndaQvFdtmz6HdoN+B8TjYShw2KhyjtKimGLpWYoi1YF\n" +
+                    "e4aHdmA/Gp5xk8pZzR18FmooxC9RqBux+NAM2iTFSLgDtGIIj4sg2rbn6Bb6ZlQT\n" +
+                    "1rg6VucXCA1629lNfMeNcu7CBNmUKIdaxHR/YJQallE0KfGRiOIWPrPj/VNk0YA6\n" +
+                    "XFg0ocjqXJ2/N0N9rWVshMUaXgOh7m4D/5zga5/nuxDU+PoToA6mQ4bV6eCYqZbh\n" +
+                    "aa1kQYtR9B4ZiG6pB82qVc2dCqStOH2FAEWos2gAVkQ=\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * Root CA for all of these.
+     */
+    public final static byte[] X509_ROOT_CA = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIEgDCCA2igAwIBAgIJAJTNwZ6yNa5bMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n" +
+                    "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n" +
+                    "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n" +
+                    "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjEzNjQz\n" +
+                    "WhcNMjYxMTA1MjEzNjQzWjCBhjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYw\n" +
+                    "FAYDVQQKEw13d3cuY3VjYmMuY29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMG\n" +
+                    "A1UEAxQMZGVtb19yb290X2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNA\n" +
+                    "Z21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv+OnocmJ\n" +
+                    "79UeO2hlCwK+Cle5uZWnU6uwJl+08z5cvebb5tT64WL9+psDbfgUH/Gm9JsuxKTg\n" +
+                    "w1tZO/4duIgnaLNSx4HoqaTjwigd/hR3TsoGEPXTCkz1ikgTCOEDvl+iMid6aOrd\n" +
+                    "mViE8HhscxKZ+h5FE7oHZyuT6gFoiaIXhFq+xK2w4ZwDz9L+paiwqywyUJJMnh9U\n" +
+                    "jKorY+nua81N0oxpIhHPspCanDU4neMzCzYOZyLR/LqV5xORvHcFY84GWMz5hI25\n" +
+                    "JbgaWJsYKuCAvNsnQwVoqKPGa7x1fn7x6oGsXJaCVt8weUwIj2xwg1lxMhrNaisH\n" +
+                    "EvKpEAEnGGwWKQIDAQABo4HuMIHrMB0GA1UdDgQWBBSs3x4Ui8yJEVdeAOoq6ZLT\n" +
+                    "9bYCEzCBuwYDVR0jBIGzMIGwgBSs3x4Ui8yJEVdeAOoq6ZLT9bYCE6GBjKSBiTCB\n" +
+                    "hjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYwFAYDVQQKEw13d3cuY3VjYmMu\n" +
+                    "Y29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMGA1UEAxQMZGVtb19yb290X2Nh\n" +
+                    "MSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNAZ21haWwuY29tggkAlM3BnrI1\n" +
+                    "rlswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAlPl3/8h1LttR1svC\n" +
+                    "S8RXbHpAWIT2BEDhGHUNjSmgDQNkE/itf/FCEXh0tlU4bYdtBSOHzflbnzOyIPId\n" +
+                    "VZeSWs33V38xDFy6KoVg1gT8JxkLmE5S1vWkpsHIlpw/U6r7KD0Kx9FYx5AiXjw0\n" +
+                    "lzz/zlVNuO2U09KIDwDPVG1mBzQiMiSWj1U1pM4KxINkWQwDy/fvu/I983s8lW5z\n" +
+                    "hf2WuFNzQN3fcMK5dpBE9NVIu27oYuGYh2sak34v+7T700W2ooBB71qFXtm9P5rl\n" +
+                    "Yp9RCEsg3KEEPNTtCBs8fROeXvLDrP0cmBIqwGYDuRNCxFDTOdjv6YGdA8nLOjaH\n" +
+                    "2dDk0g==\n" +
+                    "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * Below is the private key for all the server certificates above (but
+     * not the intermediate CA or the root CA).  All of those server certs
+     * came from the same private key.
+     */
+    public final static String RSA_PUBLIC_MODULUS =
+            "00c863af96823e8ca9d11d62ae85807e713204c1985a80a2747f7ac863c5" +
+                    "8d82e8c1ecf9698298d4838a4d8d81958868e0ef385f6e3842b653465f24" +
+                    "41b62dc671a1e204820fe67c82367f80cbcb52586a39bf965cf0141cc077" +
+                    "f46472cdeac0fd9b6b954a9ffa52a8d2e59ca1cc5e45cefbd4a37c70f1f7" +
+                    "9c7674ad5d07c78640672e94e31c4e6dee2bb52558d3b84d29701bda8767" +
+                    "56a83371888390b57c8a5bc49a8356316ae9f1406a913729121621098a77" +
+                    "713920270312baabfc06a9c677cef1414dc5559238b5bb6407e2b38c3f73" +
+                    "cfc4020c901f0e3647474dca350e66c4e817c31c0ac3a94631a895253c69" +
+                    "4caab29bddf085893dde5de87047b9e5cd";
+
+    public final static String RSA_PUBLIC_EXPONENT = "65537";
+
+    public final static String RSA_PRIVATE_EXPONENT =
+            "577abd3295553d0efd4d38c13b62a6d03fa7b7e40cce4f1d5071877d96c6" +
+                    "7a39a63f0f7ab21a89db8acae45587b3ef251309a70f74dc1ac02bde68f3" +
+                    "8ed658e54e685ed370a18c054449512ea66a2252ed36e82b565b5159ec83" +
+                    "f23df40ae189550a183865b25fd77789e960f0d8cedcd72f32d7a66edb4b" +
+                    "a0a2baf3fbeb6c7d75f56ef0af9a7cff1c8c7f297d72eae7982164e50a89" +
+                    "d450698cf598d39343201094241d2d180a95882a7111e58f4a5bdbc5c125" +
+                    "a967dd6ed9ec614c5853e88e4c71e8b682a7cf89cb1d82b6fe78cc865084" +
+                    "c8c5dfbb50c939df2b839c977b0245bfa3615e0592b527b1013d5b675ecb" +
+                    "44e6b355c1df581f50997175166eef39";
+
+    public final static String RSA_PRIME1 =
+            "00fe759c4f0ce8b763880215e82767e7a937297668f4e4b1e119c6b22a3c" +
+                    "a2c7b06c547d88d0aa45f645d7d3aeadaf7f8bc594deae0978529592977c" +
+                    "b1ff890f05033a9e9e15551cad9fbf9c41d12139ccd99c1c3ac7b2197eff" +
+                    "350d236bb900c1440953b64956e0a058ef824a2e16894af175177c77dbe1" +
+                    "fef7d8b532608d2513";
+
+    public final static String RSA_PRIME2 =
+            "00c99a45878737a4cf73f9896680b75487f1b669b7686a6ba07103856f31" +
+                    "db668c2c440c44cdd116f708f631c37a9adf119f5b5cb58ffe3dc62e20af" +
+                    "af72693d936dc6bb3c5194996468389c1f094079b81522e94572b4ad7d39" +
+                    "529178e9b8ebaeb1f0fdd83b8731c5223f1dea125341d1d64917f6b1a6ae" +
+                    "c18d320510d79f859f";
+
+    public final static String RSA_EXPONENT1 =
+            "029febf0d4cd41b7011c2465b4a259bd6118486464c247236f44a169d61e" +
+                    "47b9062508f674508d5031003ceabc57e714e600d71b2c75d5443db2da52" +
+                    "6bb45a374f0537c5a1aab3150764ce93cf386c84346a6bd01f6732e42075" +
+                    "c7a0e9e78a9e73b934e7d871d0f75673820089e129a1604438edcbbeb4e2" +
+                    "106467da112ce389";
+
+    public final static String RSA_EXPONENT2 =
+            "00827e76650c946afcd170038d32e1f8386ab00d6be78d830efe382e45d4" +
+                    "7ad4bd04e6231ee22e66740efbf52838134932c9f8c460cdccdec58a1424" +
+                    "4427859192fd6ab6c58b74e97941b0eaf577f2a11713af5e5952af3ae124" +
+                    "9a9a892e98410dfa2628d9af668a43b5302fb7d496c9b2fec69f595292b6" +
+                    "e997f079b0f6314eb7";
+
+    public final static String RSA_COEFFICIENT =
+            "00e6b62add350f1a2a8968903ff76c31cf703b0d7326c4a620aef01225b7" +
+                    "1640b3f2ec375208c5f7299863f6005b7799b6e529bb1133c8435bf5fdb5" +
+                    "a786f6cd8a19ee7094a384e6557c600a38845a0960ddbfd1df18d0af5740" +
+                    "001853788f1b5ccbf9affb4c52c9d2efdb8aab0183d86735b32737fb4e79" +
+                    "2b8a9c7d91c7d175ae";
+
+    /**
+     * subjectAlt=IP Address:127.0.0.1, email:oleg@ural.ru, DNS:localhost.localdomain
+     */
+    public final static byte[] X509_MULTIPLE_SUBJECT_ALT = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIDcTCCAtqgAwIBAgIBATANBgkqhkiG9w0BAQUFADBAMQswCQYDVQQGEwJDSDEL\n" +
+                    "MAkGA1UECBMCWkgxDzANBgNVBAcTBlp1cmljaDETMBEGA1UEAxMKTXkgVGVzdCBD\n" +
+                    "QTAeFw0wODEwMzExMTU3NDVaFw0wOTEwMzExMTU3NDVaMGkxCzAJBgNVBAYTAkNI\n" +
+                    "MRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdV\n" +
+                    "bmtub3duMRAwDgYDVQQLEwdVbmtub3duMRIwEAYDVQQDEwlsb2NhbGhvc3QwggG4\n" +
+                    "MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/\n" +
+                    "gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQ\n" +
+                    "IsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZ\n" +
+                    "ndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5\n" +
+                    "eZSvu/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbh\n" +
+                    "PBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8G\n" +
+                    "kotmXoB7VSVkAUw7/s9JKgOBhQACgYEA6ogAb/YLM1Rz9AoXKW4LA70VtFf7Mqqp\n" +
+                    "divdu9f72WQc1vMKo1YMf3dQadkMfBYRvAAa1IXDnoiFCHhXnVRkWkoUBJyNebLB\n" +
+                    "N92CZc0RVFZiMFgQMEh8UldnvAIi4cBk0/YuN3BGl4MzmquVIGrFovdWGqeaveOu\n" +
+                    "Xcu4lKGJNiqjODA2MDQGA1UdEQQtMCuHBH8AAAGBDG9sZWdAdXJhbC5ydYIVbG9j\n" +
+                    "YWxob3N0LmxvY2FsZG9tYWluMA0GCSqGSIb3DQEBBQUAA4GBAIgEwIoCSRkU3O7K\n" +
+                    "USYaOYyfJB9hsvs6YpClvYXiQ/5kPGARP60pM62v4wC7wI9shEizokIAxY2+O3cC\n" +
+                    "vwuJhNYaa2FJMELIwRN3XES8X8R6JHWbPaRjaAAPhczuEd8SZYy8yiVLmJTgw0gH\n" +
+                    "BSW775NHlkjsscFVgXkNf0PobqJ9\n" +
+                    "-----END CERTIFICATE-----").getBytes();
+
+    /**
+     * subject CN=repository.infonotary.com (Multiple AVA in RDN).
+     */
+    public final static byte[] X509_MULTIPLE_VALUE_AVA = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIFxzCCBK+gAwIBAgIIRO/2+/XA7z4wDQYJKoZIhvcNAQEFBQAwgZwxgZkwCQYD\n" +
+                    "VQQGDAJCRzAVBgNVBAoMDkluZm9Ob3RhcnkgUExDMBcGCgmSJomT8ixkARkWCWRv\n" +
+                    "bWFpbi1jYTAtBgNVBAMMJmktTm90YXJ5IFRydXN0UGF0aCBWYWxpZGF0ZWQgRG9t\n" +
+                    "YWluIENBMC0GA1UECwwmaS1Ob3RhcnkgVHJ1c3RQYXRoIFZhbGlkYXRlZCBEb21h\n" +
+                    "aW4gQ0EwHhcNMTIwNjE4MDg1MzIyWhcNMTMwNjE4MDg1MzIyWjCBxjGBwzAJBgNV\n" +
+                    "BAYTAkJHMBUGA1UEChMOSW5mb05vdGFyeSBQTEMwFwYDVQQLExBGaWxlcyBSZXBv\n" +
+                    "c2l0b3J5MBcGCgmSJomT8ixkARkWCWRvbWFpbi1jYTAgBgNVBAMTGXJlcG9zaXRv\n" +
+                    "cnkuaW5mb25vdGFyeS5jb20wIwYJKoZIhvcNAQkBFhZzdXBwb3J0QGluZm9ub3Rh\n" +
+                    "cnkuY29tMCYGCSqGSIb3DQEJAhMZcmVwb3NpdG9yeS5pbmZvbm90YXJ5LmNvbTCC\n" +
+                    "ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKWjGpgsuz103xVEW/GSg5I\n" +
+                    "tBoLbXPxockabOTHnOh0VO2sImycyhBH78nMj+VMexn4y+kdCOuJqAA5LApxyhTA\n" +
+                    "KgKlRN7TfoC90IYHjB1dqLMIseg4YM7Oe0e4Z2nL50bHoqXg7OUHaILUQn7ufpYp\n" +
+                    "+VCWxyI43KvaR4+HnST3x47wqeArg/rULGV1a16X+46cxq2eoMAcDfostXHaemvz\n" +
+                    "vg/Wd5xcWfPbF/oY1/sBXH+AK+peVBMen82+3GtAWtNWbyPE3bT4RG+WgKUyfLZ1\n" +
+                    "7A67rX9DkUEVMPQpa50MpLnrRveiM9w6R3mrMHMHbNnwID0Tqfds5zzOi/7cLD0C\n" +
+                    "AwEAAaOCAd8wggHbMA4GA1UdDwEB/wQEAwIDuDATBgNVHSUEDDAKBggrBgEFBQcD\n" +
+                    "ATBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLmluZm9u\n" +
+                    "b3RhcnkuY29tL3Jlc3BvbmRlci5jZ2kwgZAGA1UdIASBiDCBhTCBggYMKwYBBAGB\n" +
+                    "rQABAgMBMHIwOAYIKwYBBQUHAgEWLGh0dHA6Ly9yZXBvc2l0b3J5LmluZm9ub3Rh\n" +
+                    "cnkuY29tL2RvbWFpbi5odG1sMDYGCCsGAQUFBwICMCoaKGktTm90YXJ5IFZhbGlk\n" +
+                    "YXRlZCBEb21haW4gQ2VydGlmaWNhdGUgQ1AwgYkGA1UdHwSBgTB/MDWgL6Athito\n" +
+                    "dHRwOi8vY3JsLmluZm9ub3RhcnkuY29tL2NybC9kb21haW4tY2EuY3JsgQIBVjBG\n" +
+                    "oECgPoY8bGRhcDovL2xkYXAuaW5mb25vdGFyeS5jb20vZGM9ZG9tYWluLWNhLGRj\n" +
+                    "PWluZm9ub3RhcnksZGM9Y29tgQIBVjAPBgNVHRMBAf8EBTADAQEAMB0GA1UdDgQW\n" +
+                    "BBTImKJZrgV/8n7mHrA0U5EeGsBvbzAfBgNVHSMEGDAWgBTbkorEK+bPdVPpvyVI\n" +
+                    "PTxGFnuOoDANBgkqhkiG9w0BAQUFAAOCAQEAhsMbqsqvkbfVaKZ+wDY9rX3EtuDS\n" +
+                    "isdAo4AjmWgTtj/aBGiEiXcIGP312x+0JF+mEEQ75ZOKN+WsM8eLB0F4aqylklk7\n" +
+                    "6yRYauRXp8dfbXrT3ozxekt0cpSMqbzze456krI12nL+C00V2Iwq96k5J/yZboNW\n" +
+                    "Q+ibCaEAHNiL4tGVHSHm6znkWvIuUTbDgDEsm5RdafO27suz5H6zMnV+VE6onN1J\n" +
+                    "I1mQmUs44cg2HZAqnFBpDyJQhNYy8M7yGVaRkbfuVaMqiPa+xDPR5v7NFB3kxRq2\n" +
+                    "Za2Snopi52eUxDEhJ0MNqFi3Jfj/ZSmJ+XHra5lU4R8lijCAq8SVLZCmIQ==\n" +
+                    "-----END CERTIFICATE-----").getBytes();
+
+    public final static byte[] S_GOOGLE_COM = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIICpzCCAY+gAwIBAgIBATANBgkqhkiG9w0BAQUFADAXMRUwEwYDVQQDDAwqLmdv\n" +
+                    "b2dsZS5jb20wHhcNMTcwMTEzMjI0OTAzWhcNMTgwMTEzMjI0OTAzWjAXMRUwEwYD\n" +
+                    "VQQDDAwqLmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\n" +
+                    "AQDHuzznuHdJ5PH344xCyGYnUnIRhyLGBKN3WDLLrXWtr/5Sf3Q1qkiMiJ4BINsh\n" +
+                    "3Xy0z7VvHmMFlntgHXtkofBUPvTihxsVIypRkCZb5hpsWLotR10AW2JpVl/oxLP2\n" +
+                    "227/36X1zKh33fjImLJl9KzGWHLsbCBleQQJOn7YRsNR/QBZO0XGGkN/R2rRfLF3\n" +
+                    "rseRfI5gJjZkO0WDxocnf/iieOe0XNR0NAZaY1aozzPmZ/pRrOKYB8OFH7F73WOC\n" +
+                    "lPIUGai/byJ9SpbXdLUcMlGhml/4XzcnV/WVRD2P/mlY+xEFG3UEy3ufhNnKFJul\n" +
+                    "yjZrOaKbagamqtOyktzkjnerAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADaMcwVs\n" +
+                    "w5kbnoDJzMBJ01H16T4u8k78i/ybwz7u7krgkU0tABXCRj7S/4Dt3jqQ/rV6evj4\n" +
+                    "gIJ/2kZUp/PHKkV7CxWI48XBTAQUu9LEpxj0Hut3AtNMD9y/J6cFn2978tWsHFHI\n" +
+                    "mYgvclKUDE4WFMvuxfQVuX3RcGQ5i8khEMczY/KVhZYDcLU1PU0GTTJqqrQm59Z4\n" +
+                    "T4UyI3OPBR7Nb/kaU1fcgQ083uxRXcNYRMMZnU6c2oFnR+c6pO6aGoXo0C6rgC4R\n" +
+                    "pOj4hPvHCfZO2xg6HAdQ7UPALLX8pu5KGot7GRc8yiJ/Q1nBEuiPKKu0MIwQoFgP\n" +
+                    "WUux/APTsgLR7Vc=\n" +
+                    "-----END CERTIFICATE-----"
+    ).getBytes();
+
+    public final static byte[] IP_1_1_1_1 = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIICwjCCAaqgAwIBAgIBATANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9kdW1t\n" +
+                    "eS12YWx1ZS5jb20wHhcNMTcwMTEzMjI1MTQ2WhcNMTgwMTEzMjI1MTQ2WjAaMRgw\n" +
+                    "FgYDVQQDEw9kdW1teS12YWx1ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n" +
+                    "ggEKAoIBAQDfrapp3jHLp1RlElzpR/4sF9AcTYwMF1N+adkHRoVtmTlJV2lTIAjn\n" +
+                    "QLauy0Kkzv8uxmbID3uROgrFNDQ5RxTTCe+kW/vE6Pyzr5Z5ayjSTKeycTE7mAC4\n" +
+                    "6ntoCeEWiD593zlfqVo5PuRSp9Kusd+kexNVjC/BETDPa3yXctcH1ouW9GyGItgQ\n" +
+                    "u4GhCE8cipKMuTltgfK+Gh/5e9lFG9/F2fD+wHUVBULLR3JOQoqwgk2zAwKDwLuS\n" +
+                    "sEd1CBi35+W3apCKN0SEdTKIAxc/R+O/1j2hpOl9yXCCYyveGwJdFXVZtDcx+9/H\n" +
+                    "7NXhOdmw/mTXC5fOQGKciEo2SXt8Wp89AgMBAAGjEzARMA8GA1UdEQQIMAaHBAEB\n" +
+                    "AQEwDQYJKoZIhvcNAQEFBQADggEBAEAO6CE8twpcfdjk9oMjI5nX9GdC5Wt6+ujd\n" +
+                    "tLj0SbXvMKzCLLkveT0xTEzXfyEo8KW2qYYvPP1h83BIxsbR/J3Swt35UQVofv+4\n" +
+                    "JgO0FIdgB+iLEcjUh5+60xslylqWE+9bSWm4f06OXuv78tq5NYPZKku/3i4tqLRp\n" +
+                    "gH2rTtjX7Q4olSS7GdAgfiA2AnDZAbMtxtsnTt/QFpYQqhlkqHVDwgkGP7C8aMBD\n" +
+                    "RH0UIQCPxUkhwhtNmVyHO42r6oHXselZoVU6XRHuhogrGxPf/pzDUvrKBiJhsZQQ\n" +
+                    "oEu+pZCwkFLiNwUoq1G2oDpkkdBWB0JcBXB2Txa536ezFFWZYc0=\n" +
+                    "-----END CERTIFICATE-----"
+    ).getBytes();
+
+    public final static byte[] EMAIL_ALT_SUBJECT_NAME = (
+            "-----BEGIN CERTIFICATE-----\n" +
+                    "MIIDpTCCAo2gAwIBAgIJANqkMEtlkelbMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNV\n" +
+                    "BAYTAlVTMQswCQYDVQQIDAJWQTERMA8GA1UEBwwIU29tZUNpdHkxEjAQBgNVBAoM\n" +
+                    "CU15Q29tcGFueTETMBEGA1UECwwKTXlEaXZpc2lvbjEYMBYGA1UEAwwPd3d3LmNv\n" +
+                    "bXBhbnkuY29tMB4XDTE4MDIxNTA3MjkzMFoXDTIwMDIxNTA3MjkzMFowcDELMAkG\n" +
+                    "A1UEBhMCVVMxCzAJBgNVBAgMAlZBMREwDwYDVQQHDAhTb21lQ2l0eTESMBAGA1UE\n" +
+                    "CgwJTXlDb21wYW55MRMwEQYDVQQLDApNeURpdmlzaW9uMRgwFgYDVQQDDA93d3cu\n" +
+                    "Y29tcGFueS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4v6Oq\n" +
+                    "Ua0goRVn1cmT7MOpJhXFm3A70bTpvJIRpEjtGIz99hb34/9r5AYyf1VhKyWmBq24\n" +
+                    "XNcOJ59XOlyjjbm2Tl811ufTOdcNbPadoVBmMt4039OSUFpVb4wAw2XPWLTCG2h1\n" +
+                    "HNj9GuFHmwcDsg5EiIRrhDGQm2LLLAGoe5PdReoMZCeeWzNWvKTCV14pyRzwQhJL\n" +
+                    "F1OmzLYzovbPfB8LZVhQgDbLsh034FScivf2oKDB+NEzAEagNpnrFR0MFLWGYsu1\n" +
+                    "nWD5RiZi78HFGiibmhH7QrEPfGlo2eofuUga6naoBUROqkmMCIL8n1HZ/Ur0oGny\n" +
+                    "vQCj1AyrfOhuVC53AgMBAAGjQjBAMAsGA1UdDwQEAwIEMDATBgNVHSUEDDAKBggr\n" +
+                    "BgEFBQcDATAcBgNVHREEFTATgRFlbWFpbEBleGFtcGxlLmNvbTANBgkqhkiG9w0B\n" +
+                    "AQsFAAOCAQEAZ0IsqRrsEmJ6Fa9Yo6PQtrKJrejN2TTDddVgyLQdokzWh/25JFad\n" +
+                    "NCMYPH5KjTUyKf96hJDlDayjbKk1PMMhSZMU5OG9NOuGMH/dQttruG1ojse7KIKg\n" +
+                    "yHDQrfq5Exxgfa7CMHRKAoTCY7JZhSLyVbTMVhmGfuUDad/RA86ZisXycp0ZmS97\n" +
+                    "qDkAmzFL0sL0ZUWNNUh4ZUWvCUZwiuN08z70NjGqXMTDCf68p3SYxbII0xTfScgf\n" +
+                    "aQ/A/hD7IbGGTexeoTwpEj01DNvefbQV6//neo32/R5XD0D5jn3TCgZcMThA6H3a\n" +
+                    "VkEghVg+s7uMfL/UEebOBQWXQJ/uVoknMA==\n" +
+                    "-----END CERTIFICATE-----"
+    ).getBytes();
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
new file mode 100644
index 00000000000..13f7c764238
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
@@ -0,0 +1,161 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.SSLException;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Note: These test cases (and resources) have been taken from the Apache HttpComponents project.
+ */
+public class ZKHostnameVerifierTest {
+
+    private ZKHostnameVerifier impl;
+
+    @Before
+    public void setup() {
+        impl = new ZKHostnameVerifier();
+    }
+
+    @Test
+    public void testVerify() throws Exception {
+        final CertificateFactory cf = CertificateFactory.getInstance("X.509");
+        InputStream in;
+        X509Certificate x509;
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+
+        impl.verify("foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        exceptionPlease(impl, "bar.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("\u82b1\u5b50.co.jp", x509);
+        exceptionPlease(impl, "a.\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_FOO_BAR);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        impl.verify("bar.com", x509);
+        exceptionPlease(impl, "a.bar.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_FOO_BAR_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        impl.verify("bar.com", x509);
+        exceptionPlease(impl, "a.bar.com", x509);
+
+        /*
+           Java isn't extracting international subjectAlts properly.  (Or
+           OpenSSL isn't storing them properly).
+        */
+        // DEFAULT.verify("\u82b1\u5b50.co.jp", x509 );
+        // impl.verify("\u82b1\u5b50.co.jp", x509 );
+        exceptionPlease(impl, "a.\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_NO_CNS_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_NO_CNS_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_THREE_CNS_FOO_BAR_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        exceptionPlease(impl, "bar.com", x509);
+        exceptionPlease(impl, "a.bar.com", x509);
+        impl.verify("\u82b1\u5b50.co.jp", x509);
+        exceptionPlease(impl, "a.\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_WILD_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        impl.verify("www.foo.com", x509);
+        impl.verify("\u82b1\u5b50.foo.com", x509);
+        exceptionPlease(impl, "a.b.foo.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_WILD_CO_JP);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        // Silly test because no-one would ever be able to lookup an IP address
+        // using "*.co.jp".
+        impl.verify("*.co.jp", x509);
+        impl.verify("foo.co.jp", x509);
+        impl.verify("\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_WILD_FOO_BAR_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        // try the foo.com variations
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "www.foo.com", x509);
+        exceptionPlease(impl, "\u82b1\u5b50.foo.com", x509);
+        exceptionPlease(impl, "a.b.foo.com", x509);
+        // try the bar.com variations
+        exceptionPlease(impl, "bar.com", x509);
+        impl.verify("www.bar.com", x509);
+        impl.verify("\u82b1\u5b50.bar.com", x509);
+        exceptionPlease(impl, "a.b.bar.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_MULTIPLE_VALUE_AVA);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("repository.infonotary.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.S_GOOGLE_COM);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("*.google.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.S_GOOGLE_COM);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("*.Google.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.IP_1_1_1_1);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("1.1.1.1", x509);
+
+        exceptionPlease(impl, "1.1.1.2", x509);
+        exceptionPlease(impl, "dummy-value.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.EMAIL_ALT_SUBJECT_NAME);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("www.company.com", x509);
+    }
+
+    private void exceptionPlease(final ZKHostnameVerifier hv, final String host,
+                                 final X509Certificate x509) {
+        try {
+            hv.verify(host, x509);
+            Assert.fail("HostnameVerifier shouldn't allow [" + host + "]");
+        } catch (final SSLException e) {
+            // whew!  we're okay!
+        }
+    }
+}

From b1e67ca2807f836592ec0106c0c38e3ce997ee8e Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Wed, 27 May 2020 20:43:25 -0700
Subject: [PATCH 042/591] ZOOKEEPER-3847: Add a couple metrics to help track
 Netty memory usage

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Michael Han <hanm@apache.org>

Closes #1367 from jhuan31/ZOOKEEPER-3847
---
 .../org/apache/zookeeper/server/DumbWatcher.java    |  3 ++-
 .../zookeeper/server/FinalRequestProcessor.java     | 13 ++++++++-----
 .../org/apache/zookeeper/server/NIOServerCnxn.java  | 12 +++++++++---
 .../apache/zookeeper/server/NettyServerCnxn.java    | 13 +++++++++----
 .../org/apache/zookeeper/server/ServerCnxn.java     |  6 +++---
 .../org/apache/zookeeper/server/ServerMetrics.java  |  9 +++++++++
 .../org/apache/zookeeper/server/MockServerCnxn.java |  3 ++-
 7 files changed, 42 insertions(+), 17 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
index 9b9672a850b..c7bf830b4ef 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
@@ -61,8 +61,9 @@ public void close(DisconnectReason reason) {
     }
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag,
+    public int sendResponse(ReplyHeader h, Record r, String tag,
                              String cacheKey, Stat stat, int opCode) throws IOException {
+        return 0;
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index a487626dee6..a23e90371e3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -171,6 +171,7 @@ public void processRequest(Request request) {
         Code err = Code.OK;
         Record rsp = null;
         String path = null;
+        int responseSize = 0;
         try {
             if (request.getHdr() != null && request.getHdr().getType() == OpCode.error) {
                 AuditHelper.addAuditLog(request, rc, true);
@@ -213,7 +214,7 @@ public void processRequest(Request request) {
                 lastOp = "PING";
                 updateStats(request, lastOp, lastZxid);
 
-                cnxn.sendResponse(new ReplyHeader(ClientCnxn.PING_XID, lastZxid, 0), null, "response");
+                responseSize = cnxn.sendResponse(new ReplyHeader(ClientCnxn.PING_XID, lastZxid, 0), null, "response");
                 return;
             }
             case OpCode.createSession: {
@@ -599,7 +600,7 @@ public void processRequest(Request request) {
 
         try {
             if (path == null || rsp == null) {
-                cnxn.sendResponse(hdr, rsp, "response");
+                responseSize = cnxn.sendResponse(hdr, rsp, "response");
             } else {
                 int opCode = request.type;
                 Stat stat = null;
@@ -610,17 +611,17 @@ public void processRequest(Request request) {
                     case OpCode.getData : {
                         GetDataResponse getDataResponse = (GetDataResponse) rsp;
                         stat = getDataResponse.getStat();
-                        cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
+                        responseSize = cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
                         break;
                     }
                     case OpCode.getChildren2 : {
                         GetChildren2Response getChildren2Response = (GetChildren2Response) rsp;
                         stat = getChildren2Response.getStat();
-                        cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
+                        responseSize = cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
                         break;
                     }
                     default:
-                        cnxn.sendResponse(hdr, rsp, "response");
+                        responseSize = cnxn.sendResponse(hdr, rsp, "response");
                 }
             }
 
@@ -629,6 +630,8 @@ public void processRequest(Request request) {
             }
         } catch (IOException e) {
             LOG.error("FIXMSG", e);
+        } finally {
+            ServerMetrics.getMetrics().RESPONSE_BYTES.add(responseSize);
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 86fe85de4d0..f967fffe974 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -665,13 +665,18 @@ public static void closeSock(SocketChannel sock) {
     private static final ByteBuffer packetSentinel = ByteBuffer.allocate(0);
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, Stat stat, int opCode) {
+    public int sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, Stat stat, int opCode) {
+        int responseSize = 0;
         try {
-            sendBuffer(serialize(h, r, tag, cacheKey, stat, opCode));
+            ByteBuffer[] bb = serialize(h, r, tag, cacheKey, stat, opCode);
+            responseSize = bb[0].getInt();
+            bb[0].rewind();
+            sendBuffer(bb);
             decrOutstandingAndCheckThrottle(h);
         } catch (Exception e) {
             LOG.warn("Unexpected exception. Destruction averted.", e);
         }
+        return responseSize;
     }
 
     /*
@@ -695,7 +700,8 @@ public void process(WatchedEvent event) {
         // The last parameter OpCode here is used to select the response cache.
         // Passing OpCode.error (with a value of -1) means we don't care, as we don't need
         // response cache on delivering watcher events.
-        sendResponse(h, e, "notification", null, null, ZooDefs.OpCode.error);
+        int responseSize = sendResponse(h, e, "notification", null, null, ZooDefs.OpCode.error);
+        ServerMetrics.getMetrics().WATCH_BYTES.add(responseSize);
     }
 
     /*
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 442f39d173a..cf9aa457f8b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -168,7 +168,8 @@ public void process(WatchedEvent event) {
         WatcherEvent e = event.getWrapper();
 
         try {
-            sendResponse(h, e, "notification");
+            int responseSize = sendResponse(h, e, "notification");
+            ServerMetrics.getMetrics().WATCH_BYTES.add(responseSize);
         } catch (IOException e1) {
             LOG.debug("Problem sending to {}", getRemoteSocketAddress(), e1);
             close();
@@ -176,15 +177,19 @@ public void process(WatchedEvent event) {
     }
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag,
+    public int sendResponse(ReplyHeader h, Record r, String tag,
                              String cacheKey, Stat stat, int opCode) throws IOException {
         // cacheKey and stat are used in caching, which is not
         // implemented here. Implementation example can be found in NIOServerCnxn.
         if (closingChannel || !channel.isOpen()) {
-            return;
+            return 0;
         }
-        sendBuffer(serialize(h, r, tag, cacheKey, stat, opCode));
+        ByteBuffer[] bb = serialize(h, r, tag, cacheKey, stat, opCode);
+        int responseSize = bb[0].getInt();
+        bb[0].rewind();
+        sendBuffer(bb);
         decrOutstandingAndCheckThrottle(h);
+        return responseSize;
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index d70551ac009..78dc8fadccc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -186,11 +186,11 @@ public void decrOutstandingAndCheckThrottle(ReplyHeader h) {
      *               used to decide which cache (e.g. read response cache,
      *               list of children response cache, ...) object to look up to when applicable.
      */
-    public abstract void sendResponse(ReplyHeader h, Record r, String tag,
+    public abstract int sendResponse(ReplyHeader h, Record r, String tag,
                                       String cacheKey, Stat stat, int opCode) throws IOException;
 
-    public void sendResponse(ReplyHeader h, Record r, String tag) throws IOException {
-        sendResponse(h, r, tag, null, null, -1);
+    public int sendResponse(ReplyHeader h, Record r, String tag) throws IOException {
+        return sendResponse(h, r, tag, null, null, -1);
     }
 
     protected byte[] serializeRecord(Record record) throws IOException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 3962bb974f1..4d71e514672 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -243,6 +243,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR = metricsContext.getCounter(
                 "requests_not_forwarded_to_commit_processor");
+
+        RESPONSE_BYTES = metricsContext.getCounter("response_bytes");
+        WATCH_BYTES = metricsContext.getCounter("watch_bytes");
     }
 
     /**
@@ -469,6 +472,12 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
     public final Counter REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR;
 
+    /**
+     *  Number of response/watch bytes written to clients.
+     */
+    public final Counter RESPONSE_BYTES;
+    public final Counter WATCH_BYTES;
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
index a82eab3764d..4dfcebd84ec 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
@@ -46,8 +46,9 @@ public void close(DisconnectReason reason) {
     }
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag,
+    public int sendResponse(ReplyHeader h, Record r, String tag,
                              String cacheKey, Stat stat, int opCode) throws IOException {
+        return 0;
     }
 
     @Override

From 0f182ab88dac2fda7f5821b7003092428b859164 Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Wed, 27 May 2020 20:47:09 -0700
Subject: [PATCH 043/591] ZOOKEEPER-3846: Add a couple TLS related metrics

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Michael Han <hanm@apache.org>

Closes #1366 from jhuan31/ZOOKEEPER-3846
---
 .../apache/zookeeper/server/NettyServerCnxnFactory.java  | 1 +
 .../java/org/apache/zookeeper/server/ServerMetrics.java  | 9 +++++++++
 .../zookeeper/server/admin/UnifiedConnectionFactory.java | 2 ++
 3 files changed, 12 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 5d236ee8b81..55743ffb90a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -441,6 +441,7 @@ public void operationComplete(Future<Channel> future) {
                 addCnxn(cnxn);
             } else {
                 LOG.error("Unsuccessful handshake with session 0x{}", Long.toHexString(cnxn.getSessionId()));
+                ServerMetrics.getMetrics().UNSUCCESSFUL_HANDSHAKE.add(1);
                 cnxn.close(ServerCnxn.DisconnectReason.FAILED_HANDSHAKE);
             }
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 4d71e514672..7566cd255ae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -233,6 +233,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         DIGEST_MISMATCHES_COUNT = metricsContext.getCounter("digest_mismatches_count");
 
+        UNSUCCESSFUL_HANDSHAKE = metricsContext.getCounter("unsuccessful_handshake");
+        INSECURE_ADMIN = metricsContext.getCounter("insecure_admin_count");
         TLS_HANDSHAKE_EXCEEDED = metricsContext.getCounter("tls_handshake_exceeded");
 
         CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING = metricsContext.getCounter("cnxn_closed_without_zk_server_running");
@@ -462,6 +464,13 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     // txns to data tree.
     public final Counter DIGEST_MISMATCHES_COUNT;
 
+    public final Counter UNSUCCESSFUL_HANDSHAKE;
+
+    /*
+     * Number of insecure connections to admin port
+     */
+    public final Counter INSECURE_ADMIN;
+
     public final Counter TLS_HANDSHAKE_EXCEEDED;
 
     public final Counter CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java
index 71622dfc10d..2176c103310 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java
@@ -20,6 +20,7 @@
 
 import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLSession;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.eclipse.jetty.io.Connection;
 import org.eclipse.jetty.io.EndPoint;
 import org.eclipse.jetty.io.ssl.SslConnection;
@@ -94,6 +95,7 @@ public Connection newConnection(Connector connector, EndPoint realEndPoint) {
         } else {
             sslConnection = null;
             plainEndpoint = aheadEndpoint;
+            ServerMetrics.getMetrics().INSECURE_ADMIN.add(1);
         }
 
         ConnectionFactory next = connector.getConnectionFactory(nextProtocol);

From e91455c1e3c50405666cd8afad71d99dceb7b340 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Fri, 29 May 2020 14:59:47 +0200
Subject: [PATCH 044/591] ZOOKEEPER-3829: fix rolling restart when dynamic
 reconfig is disabled

In four different Jira tickets (ZOOKEEPER-3829, ZOOKEEPER-3830, ZOOKEEPER-3814, ZOOKEEPER-3842) we saw different errors when dynamic reconfig was disabled and we used rolling restart to change the quorum membership configuration. These rolling restart sequences was working fine on 3.4 but caused errors in 3.5 or 3.6.

In worst case the rolling restart leads to the scenario that we had an elected leader which was up but unable to commit any changes. This happens, when the quorum is extended with a new member in the following sequence:
* start server.1, server.2, server.3 (with config: 1,2,3)
* start server.4 (with config 1,2,3,4)
* stop server.1, then restart it with config 1,2,3,4
* stop server.2, then restart it with config 1,2,3,4
* stop server.3, then restart it with config 1,2,3,4
* at this point leader is server.4, but it can not commit any transaction

An other error we saw was when we changed a host name of an existing member (removing server.5 and add a new host as server.6). In this case we found in the logs of the new server (server.6) that it is still tried to connect to the old invalid server (server.5), although it was missing from it's config. The same problem remained even after making a full rolling-restart on all the nodes.

In this patch I try to fix these issues without breaking anything. The patch contains the following changes:
* We are making sure that neither the committed, nor the last seen config gets updated if dynamic reconfig is disabled.
* It is not possible now to start the leader without the ability of committing transaction, when dynamic reconfig is disabled (this is only needed to avoid a reconfig edge-case).
* I added a testcase simulating the enablement of dynamic reconfig using rolling restart
* I added a few more unit tests to cover rolling restart scenarios. (the tests are failing without the patch but succeeding after applying it).
* The enablement / disablement of reconfig is getting initialized now in the QuorumPeer and gets propagated to the other classes. This was needed for the rolling restart tests to be able to enable/disable reconfig only for the newly created servers without affecting the servers running already in the same JVM.

I also tested the changes with docker, using: https://github.com/symat/zookeeper-docker-test

target branches: 3.5, 3.6, master

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1356 from symat/ZOOKEEPER-3829
---
 .../server/PrepRequestProcessor.java          |   3 +-
 .../zookeeper/server/ZooKeeperServer.java     |  17 ++-
 .../zookeeper/server/quorum/Leader.java       |  32 ++--
 .../zookeeper/server/quorum/Learner.java      |   2 +-
 .../server/quorum/QuorumCnxManager.java       |   4 +
 .../zookeeper/server/quorum/QuorumPeer.java   |  14 +-
 .../server/quorum/QuorumPeerMain.java         |   2 +-
 .../server/quorum/QuorumZooKeeperServer.java  |   3 +-
 .../quorum/ReadOnlyZooKeeperServer.java       |   3 +-
 .../server/PrepRequestProcessorTest.java      |  35 +++--
 ...configRollingRestartCompatibilityTest.java | 140 +++++++++++++++++-
 .../zookeeper/test/ReconfigExceptionTest.java |  10 ++
 .../apache/zookeeper/test/ReconfigTest.java   |  76 ++++++++--
 13 files changed, 287 insertions(+), 54 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 00ed555c759..debf1c4f6fe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -133,6 +133,7 @@ public static void setFailCreate(boolean b) {
     }
     @Override
     public void run() {
+        LOG.info(String.format("PrepRequestProcessor (sid:%d) started, reconfigEnabled=%s", zks.getServerId(), zks.reconfigEnabled));
         try {
             while (true) {
                 ServerMetrics.getMetrics().PREP_PROCESSOR_QUEUE_SIZE.add(submittedRequests.size());
@@ -405,7 +406,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             addChangeRecord(nodeRecord);
             break;
         case OpCode.reconfig:
-            if (!QuorumPeerConfig.isReconfigEnabled()) {
+            if (!zks.isReconfigEnabled()) {
                 LOG.error("Reconfig operation requested but reconfig feature is disabled.");
                 throw new KeeperException.ReconfigDisabledException();
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index f37225edbf0..c391425a309 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -74,6 +74,7 @@
 import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.auth.ServerAuthenticationProvider;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.quorum.ReadOnlyZooKeeperServer;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.server.util.OSMXBean;
@@ -177,6 +178,7 @@ public static void setCloseSessionTxnEnabled(boolean enabled) {
     private boolean isResponseCachingEnabled = true;
     /* contains the configuration file content read at startup */
     protected String initialConfig;
+    protected boolean reconfigEnabled;
     private final RequestPathMetricsCollector requestPathMetricsCollector;
 
     private boolean localSessionEnabled = false;
@@ -303,7 +305,7 @@ public ZooKeeperServer() {
      * actually start listening for clients until run() is invoked.
      *
      */
-    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig) {
+    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig, boolean reconfigEnabled) {
         serverStats = new ServerStats(this);
         this.txnLogFactory = txnLogFactory;
         this.txnLogFactory.setServerStats(this.serverStats);
@@ -312,6 +314,7 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
         setMinSessionTimeout(minSessionTimeout);
         setMaxSessionTimeout(maxSessionTimeout);
         this.listenBacklog = clientPortListenBacklog;
+        this.reconfigEnabled = reconfigEnabled;
 
         listener = new ZooKeeperServerListenerImpl(this);
 
@@ -355,7 +358,7 @@ public String getInitialConfig() {
      *
      */
     public ZooKeeperServer(JvmPauseMonitor jvmPauseMonitor, FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig) {
-        this(txnLogFactory, tickTime, minSessionTimeout, maxSessionTimeout, clientPortListenBacklog, zkDb, initialConfig);
+        this(txnLogFactory, tickTime, minSessionTimeout, maxSessionTimeout, clientPortListenBacklog, zkDb, initialConfig, QuorumPeerConfig.isReconfigEnabled());
         this.jvmPauseMonitor = jvmPauseMonitor;
         if (jvmPauseMonitor != null) {
             LOG.info("Added JvmPauseMonitor to server");
@@ -368,8 +371,8 @@ public ZooKeeperServer(JvmPauseMonitor jvmPauseMonitor, FileTxnSnapLog txnLogFac
      * @param tickTime the ticktime for the server
      * @throws IOException
      */
-    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, String initialConfig) throws IOException {
-        this(txnLogFactory, tickTime, -1, -1, -1, new ZKDatabase(txnLogFactory), initialConfig);
+    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, String initialConfig) {
+        this(txnLogFactory, tickTime, -1, -1, -1, new ZKDatabase(txnLogFactory), initialConfig, QuorumPeerConfig.isReconfigEnabled());
     }
 
     public ServerStats serverStats() {
@@ -440,7 +443,7 @@ public ZooKeeperServer(File snapDir, File logDir, int tickTime) throws IOExcepti
      * @throws IOException
      */
     public ZooKeeperServer(FileTxnSnapLog txnLogFactory) throws IOException {
-        this(txnLogFactory, DEFAULT_TICK_TIME, -1, -1, -1, new ZKDatabase(txnLogFactory), "");
+        this(txnLogFactory, DEFAULT_TICK_TIME, -1, -1, -1, new ZKDatabase(txnLogFactory), "", QuorumPeerConfig.isReconfigEnabled());
     }
 
     /**
@@ -2114,4 +2117,8 @@ public int getOutstandingHandshakeNum() {
             return 0;
         }
     }
+
+    public boolean isReconfigEnabled() {
+        return this.reconfigEnabled;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 0eb3722a47c..8d2a95f6d7b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -635,6 +635,7 @@ void lead() throws IOException, InterruptedException {
                 // hence before they construct the NEWLEADER message containing
                 // the last-seen-quorumverifier of the leader, which we change below
                 try {
+                    LOG.debug(String.format("set lastSeenQuorumVerifier to currentQuorumVerifier (%s)", curQV.toString()));
                     QuorumVerifier newQV = self.configFromString(curQV.toString());
                     newQV.setVersion(zk.getZxid());
                     self.setLastSeenQuorumVerifier(newQV, true);
@@ -943,6 +944,8 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
             self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
 
             if (designatedLeader != self.getId()) {
+                LOG.info(String.format("Committing a reconfiguration (reconfigEnabled=%s); this leader is not the designated "
+                        + "leader anymore, setting allowedToCommit=false", self.isReconfigEnabled()));
                 allowedToCommit = false;
             }
 
@@ -1508,20 +1511,25 @@ private synchronized void startZkServer() {
                  newLeaderProposal.ackSetsToString(),
                  Long.toHexString(zk.getZxid()));
 
-        /*
-         * ZOOKEEPER-1324. the leader sends the new config it must complete
-         *  to others inside a NEWLEADER message (see LearnerHandler where
-         *  the NEWLEADER message is constructed), and once it has enough
-         *  acks we must execute the following code so that it applies the
-         *  config to itself.
-         */
-        QuorumVerifier newQV = self.getLastSeenQuorumVerifier();
+        if (self.isReconfigEnabled()) {
+            /*
+             * ZOOKEEPER-1324. the leader sends the new config it must complete
+             *  to others inside a NEWLEADER message (see LearnerHandler where
+             *  the NEWLEADER message is constructed), and once it has enough
+             *  acks we must execute the following code so that it applies the
+             *  config to itself.
+             */
+            QuorumVerifier newQV = self.getLastSeenQuorumVerifier();
 
-        Long designatedLeader = getDesignatedLeader(newLeaderProposal, zk.getZxid());
+            Long designatedLeader = getDesignatedLeader(newLeaderProposal, zk.getZxid());
 
-        self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
-        if (designatedLeader != self.getId()) {
-            allowedToCommit = false;
+            self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
+            if (designatedLeader != self.getId()) {
+                LOG.warn("This leader is not the designated leader, it will be initialized with allowedToCommit = false");
+                allowedToCommit = false;
+            }
+        } else {
+            LOG.info("Dynamic reconfig feature is disabled, skip designatedLeader calculation and reconfig processing.");
         }
 
         leaderStartTime = Time.currentElapsedTime();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 0b807ef799e..8b02ac53df7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -571,7 +571,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                 // ZOOKEEPER-2819: overwrite config node content extracted
                 // from leader snapshot with local config, to avoid potential
                 // inconsistency of config node content during rolling restart.
-                if (!QuorumPeerConfig.isReconfigEnabled()) {
+                if (!self.isReconfigEnabled()) {
                     LOG.debug("Reset config node content from local config after deserialization of snapshot.");
                     zk.getZKDatabase().initConfigInZKDatabase(self.getQuorumVerifier());
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 08384920125..7efa0de4bd9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -1476,4 +1476,8 @@ public boolean connectedToPeer(long peerSid) {
         return senderWorkerMap.get(peerSid) != null;
     }
 
+    public boolean isReconfigEnabled() {
+        return self.isReconfigEnabled();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 32f597e61a4..c0a3dece0c1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1003,6 +1003,8 @@ private void setAddrs(MultipleAddresses quorumAddr, MultipleAddresses electionAd
 
     AdminServer adminServer;
 
+    private final boolean reconfigEnabled;
+
     public static QuorumPeer testingQuorumPeer() throws SaslException {
         return new QuorumPeer();
     }
@@ -1014,6 +1016,7 @@ public QuorumPeer() throws SaslException {
         adminServer = AdminServerFactory.createAdminServer();
         x509Util = createX509Util();
         initialize();
+        reconfigEnabled = QuorumPeerConfig.isReconfigEnabled();
     }
 
     // VisibleForTesting
@@ -1804,6 +1807,11 @@ private void connectNewPeers(QuorumCnxManager qcm) {
     }
 
     public void setLastSeenQuorumVerifier(QuorumVerifier qv, boolean writeToDisk) {
+        if (!isReconfigEnabled()) {
+            LOG.info("Dynamic reconfig is disabled, we don't store the last seen config.");
+            return;
+        }
+
         // If qcm is non-null, we may call qcm.connectOne(), which will take the lock on qcm
         // and then take QV_LOCK.  Take the locks in the same order to ensure that we don't
         // deadlock against other callers of connectOne().  If qcmRef gets set in another
@@ -2153,7 +2161,7 @@ public void setAcceptedEpoch(long e) throws IOException {
     }
 
     public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long zxid, boolean restartLE) {
-        if (!QuorumPeerConfig.isReconfigEnabled()) {
+        if (!isReconfigEnabled()) {
             LOG.debug("Reconfig feature is disabled, skip reconfig processing.");
             return false;
         }
@@ -2519,6 +2527,10 @@ boolean isLeader(long id) {
         return vote != null && id == vote.getId();
     }
 
+    public boolean isReconfigEnabled() {
+        return reconfigEnabled;
+    }
+
     @InterfaceAudience.Private
     /**
      * This is a metric that depends on the status of the peer.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index a6f94ec3bd1..81140b60982 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -148,7 +148,7 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
             LOG.warn("Unable to register log4j JMX control", e);
         }
 
-        LOG.info("Starting quorum peer");
+        LOG.info("Starting quorum peer, myid=" + config.getServerId());
         MetricsProvider metricsProvider;
         try {
             metricsProvider = MetricsProviderBootstrap.startMetricsProvider(
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
index 6fdea82751e..350aa1323f0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
@@ -49,7 +49,8 @@ public abstract class QuorumZooKeeperServer extends ZooKeeperServer {
 
     protected QuorumZooKeeperServer(FileTxnSnapLog logFactory, int tickTime, int minSessionTimeout,
                                     int maxSessionTimeout, int listenBacklog, ZKDatabase zkDb, QuorumPeer self) {
-        super(logFactory, tickTime, minSessionTimeout, maxSessionTimeout, listenBacklog, zkDb, self.getInitialConfig());
+        super(logFactory, tickTime, minSessionTimeout, maxSessionTimeout, listenBacklog, zkDb, self.getInitialConfig(),
+              self.isReconfigEnabled());
         this.self = self;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
index b1a72c4e972..f8517eb9b02 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
@@ -52,7 +52,8 @@ public class ReadOnlyZooKeeperServer extends ZooKeeperServer {
             self.maxSessionTimeout,
             self.clientPortListenBacklog,
             zkDb,
-            self.getInitialConfig());
+            self.getInitialConfig(),
+            self.isReconfigEnabled());
         this.self = self;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index 48e58905f84..409e59058e6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -81,6 +81,9 @@ public class PrepRequestProcessorTest extends ClientBase {
     private PrepRequestProcessor processor;
     private Request outcome;
 
+    private boolean isReconfigEnabledPreviously;
+    private boolean isStandaloneEnabledPreviously;
+
     @Before
     public void setup() throws Exception {
         File tmpDir = ClientBase.createTmpDir();
@@ -93,6 +96,9 @@ public void setup() throws Exception {
         servcnxnf.startup(zks);
         assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
         zks.sessionTracker = new MySessionTracker();
+
+        isReconfigEnabledPreviously = QuorumPeerConfig.isReconfigEnabled();
+        isStandaloneEnabledPreviously = QuorumPeerConfig.isStandaloneEnabled();
     }
 
     @After
@@ -103,6 +109,10 @@ public void teardown() throws Exception {
         if (zks != null) {
             zks.shutdown();
         }
+
+        // reset the reconfig option
+        QuorumPeerConfig.setReconfigEnabled(isReconfigEnabledPreviously);
+        QuorumPeerConfig.setStandaloneEnabled(isStandaloneEnabledPreviously);
     }
 
     @Test
@@ -179,6 +189,9 @@ public void testMultiOutstandingChange() throws Exception {
 
     @Test
     public void testReconfigWithAnotherOutstandingChange() throws Exception {
+        QuorumPeerConfig.setReconfigEnabled(true);
+        QuorumPeerConfig.setStandaloneEnabled(false);
+
         QuorumPeer qp = new QuorumPeer();
         QuorumVerifier quorumVerifierMock = mock(QuorumVerifier.class);
         when(quorumVerifierMock.getAllMembers()).thenReturn(LeaderBeanTest.getMockedPeerViews(qp.getId()));
@@ -196,22 +209,12 @@ public void testReconfigWithAnotherOutstandingChange() throws Exception {
         processor.pRequest(createRequest(record, OpCode.create, false));
         assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
 
-        boolean isReconfigEnabledPreviously = QuorumPeerConfig.isReconfigEnabled();
-        boolean isStandaloneEnabledPreviously = QuorumPeerConfig.isStandaloneEnabled();
-        QuorumPeerConfig.setReconfigEnabled(true);
-        QuorumPeerConfig.setStandaloneEnabled(false);
-        try {
-            String newMember = "server.0=localhost:" + PortAssignment.unique()  + ":" + PortAssignment.unique() + ":participant";
-            record = new ReconfigRequest(null, null, newMember, 0);
-            pLatch = new CountDownLatch(1);
-            processor.pRequest(createRequest(record, OpCode.reconfig, true));
-            assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
-            assertEquals(outcome.getHdr().getType(), OpCode.reconfig);   // Verifies that there was no error.
-        } finally {
-            // reset the reconfig option
-            QuorumPeerConfig.setReconfigEnabled(isReconfigEnabledPreviously);
-            QuorumPeerConfig.setStandaloneEnabled(isStandaloneEnabledPreviously);
-        }
+        String newMember = "server.0=localhost:" + PortAssignment.unique()  + ":" + PortAssignment.unique() + ":participant";
+        record = new ReconfigRequest(null, null, newMember, 0);
+        pLatch = new CountDownLatch(1);
+        processor.pRequest(createRequest(record, OpCode.reconfig, true));
+        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertEquals(outcome.getHdr().getType(), OpCode.reconfig);   // Verifies that there was no error.
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
index c4d2bd7eaa7..9522da7e534 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
@@ -148,11 +148,11 @@ public void testRollingRestartWithoutMembershipChange() throws Exception {
     }
 
     @Test(timeout = 90000)
-    // This test simulate the use case of change of membership through rolling
-    // restart. For a 3 node ensemble we expand it to a 5 node ensemble, verify
+    // This test simulate the use case of change of membership by starting new servers
+    // without dynamic reconfig. For a 3 node ensemble we expand it to a 5 node ensemble, verify
     // during the process each node has the expected configuration setting pushed
     // via updating local zoo.cfg file.
-    public void testRollingRestartWithMembershipChange() throws Exception {
+    public void testExtendingQuorumWithNewMembers() throws Exception {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
         QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[serverCount];
@@ -174,7 +174,7 @@ public void testRollingRestartWithMembershipChange() throws Exception {
 
         Map<Integer, String> oldServerAddress = new HashMap<>(serverAddress);
         List<String> newServers = new ArrayList<>(joiningServers);
-        config = updateExistingQuorumConfig(Arrays.asList(3, 4), new ArrayList<Integer>());
+        config = updateExistingQuorumConfig(Arrays.asList(3, 4), new ArrayList<>());
         newServers.add(serverAddress.get(3));
         newServers.add(serverAddress.get(4));
         serverCount = serverAddress.size();
@@ -209,6 +209,138 @@ public void testRollingRestartWithMembershipChange() throws Exception {
         }
     }
 
+    @Test
+    public void testRollingRestartWithExtendedMembershipConfig() throws Exception {
+        // in this test we are performing rolling restart with extended quorum config, see ZOOKEEPER-3829
+
+        // Start a quorum with 3 members
+        int serverCount = 3;
+        String config = generateNewQuorumConfig(serverCount);
+        QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[serverCount];
+        List<String> joiningServers = new ArrayList<>();
+        for (int i = 0; i < serverCount; i++) {
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            joiningServers.add(serverAddress.get(i));
+        }
+        for (int i = 0; i < serverCount; i++) {
+            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+        }
+        for (int i = 0; i < serverCount; i++) {
+            verifyQuorumConfig(i, joiningServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // Create updated config with 4 members
+        List<String> newServers = new ArrayList<>(joiningServers);
+        config = updateExistingQuorumConfig(Arrays.asList(3), new ArrayList<>());
+        newServers.add(serverAddress.get(3));
+        serverCount = serverAddress.size();
+        assertEquals("Server count should be 4 after config update.", serverCount, 4);
+
+        // We are adding one new server to the ensemble. The new server should be started with the new config
+        mt = Arrays.copyOf(mt, mt.length + 1);
+        mt[3] = new QuorumPeerTestBase.MainThread(3, clientPorts.get(3), config, false);
+        mt[3].start();
+        assertTrue("waiting for server 3 being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT));
+        verifyQuorumConfig(3, newServers, null);
+        verifyQuorumMembers(mt[3]);
+
+        // Now we restart the first 3 servers, one-by-one with the new config
+        for (int i = 0; i < 3; i++) {
+            mt[i].shutdown();
+
+            assertTrue(String.format("Timeout during waiting for server %d to go down", i),
+                       ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT));
+
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            verifyQuorumConfig(i, newServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // now verify that all nodes can handle traffic
+        for (int i = 0; i < 4; ++i) {
+            ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts.get(i));
+            ReconfigTest.testNormalOperation(zk, zk, false);
+        }
+
+        for (int i = 0; i < 4; ++i) {
+            mt[i].shutdown();
+        }
+    }
+
+    @Test
+    public void testRollingRestartWithHostAddedAndRemoved() throws Exception {
+        // in this test we are performing rolling restart with a new quorum config,
+        // contains a deleted node and a new node
+
+        // Start a quorum with 3 members
+        int serverCount = 3;
+        String config = generateNewQuorumConfig(serverCount);
+        QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[serverCount];
+        List<String> originalServers = new ArrayList<>();
+        for (int i = 0; i < serverCount; i++) {
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            originalServers.add(serverAddress.get(i));
+        }
+        for (int i = 0; i < serverCount; i++) {
+            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+        }
+        for (int i = 0; i < serverCount; i++) {
+            verifyQuorumConfig(i, originalServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // we are stopping the third server (myid=2)
+        mt[2].shutdown();
+        assertTrue(String.format("Timeout during waiting for server %d to go down", 2),
+                   ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(2), ClientBase.CONNECTION_TIMEOUT));
+        String leavingServer = originalServers.get(2);
+
+        // Create updated config with the first 2 existing members, but we remove 3rd and add one with different myid
+        config = updateExistingQuorumConfig(Arrays.asList(3), Arrays.asList(2));
+        List<String> newServers = new ArrayList<>(serverAddress.values());
+        serverCount = serverAddress.size();
+        assertEquals("Server count should be 3 after config update.", serverCount, 3);
+
+
+        // We are adding one new server to the ensemble. The new server should be started with the new config
+        mt = Arrays.copyOf(mt, mt.length + 1);
+        mt[3] = new QuorumPeerTestBase.MainThread(3, clientPorts.get(3), config, false);
+        mt[3].start();
+        assertTrue("waiting for server 3 being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT));
+        verifyQuorumConfig(3, newServers, Arrays.asList(leavingServer));
+        verifyQuorumMembers(mt[3]);
+
+        // Now we restart the first 2 servers, one-by-one with the new config
+        for (int i = 0; i < 2; i++) {
+            mt[i].shutdown();
+
+            assertTrue(String.format("Timeout during waiting for server %d to go down", i),
+                       ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT));
+
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            verifyQuorumConfig(i, newServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // now verify that all three nodes can handle traffic
+        for (int i : serverAddress.keySet()) {
+            ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts.get(i));
+            ReconfigTest.testNormalOperation(zk, zk, false);
+        }
+
+        for (int i : serverAddress.keySet()) {
+            mt[i].shutdown();
+        }
+    }
+
+
     // Verify each quorum peer has expected config in its config zNode.
     private void verifyQuorumConfig(int sid, List<String> joiningServers, List<String> leavingServers) throws Exception {
         ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts.get(sid));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
index e2cc2a5447d..daa471f0a3b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
@@ -90,6 +90,16 @@ public void tearDown() throws Exception {
     @Test(timeout = 10000)
     public void testReconfigDisabled() throws InterruptedException {
         QuorumPeerConfig.setReconfigEnabled(false);
+
+        // for this test we need to restart the quorum peers to get the config change,
+        // as in the setup() we started the quorum with reconfigEnabled=true
+        qu.shutdownAll();
+        try {
+            qu.startAll();
+        } catch (IOException e) {
+            fail("Fail to start quorum servers.");
+        }
+
         try {
             reconfigPort();
             fail("Reconfig should be disabled.");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index 8642b368d9c..810cc2a2386 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -179,22 +179,18 @@ public static String testServerHasConfig(
         return configStr;
     }
 
-    public static void testNormalOperation(
-        ZooKeeper writer,
-        ZooKeeper reader) throws KeeperException, InterruptedException {
-        boolean testReaderNodeExists = false;
-        boolean testWriterNodeExists = false;
+    public static void testNormalOperation(ZooKeeper writer, ZooKeeper reader) throws KeeperException, InterruptedException {
+        testNormalOperation(writer, reader, true);
+    }
 
+    public static void testNormalOperation(ZooKeeper writer, ZooKeeper reader, boolean initTestNodes) throws KeeperException, InterruptedException {
+        boolean createNodes = initTestNodes;
         for (int j = 0; j < 30; j++) {
             try {
-                if (!testWriterNodeExists) {
+                if (createNodes) {
                     createZNode(writer, "/test", "test");
-                    testWriterNodeExists = true;
-                }
-
-                if (!testReaderNodeExists) {
                     createZNode(reader, "/dummy", "dummy");
-                    testReaderNodeExists = true;
+                    createNodes = false;
                 }
 
                 String data = "test" + j;
@@ -1106,6 +1102,64 @@ public void testJMXBeanAfterRoleChange() throws Exception {
         assertRemotePeerMXBeanAttributes(changingQS3, remotePeerBean3);
     }
 
+
+    @Test
+    public void testReconfigEnablemntWithRollingRestart() throws Exception {
+
+        // make sure dynamic reconfig is disabled
+        QuorumPeerConfig.setReconfigEnabled(false);
+
+        // start a 3 node cluster
+        qu = new QuorumUtil(1);
+        qu.disableJMXTest = true;
+        qu.startAll();
+        zkArr = createHandles(qu);
+        testNormalOperation(zkArr[1], zkArr[1], true);
+
+
+        // enable dynamic reconfig (new servers created after this time will be initialized with reconfigEnabled=true)
+        QuorumPeerConfig.setReconfigEnabled(true);
+
+        // restart the three servers, one-by-one, now with reconfig enabled
+        // test if we can write / read in the cluster after each rolling restart step
+        for (int i = 1; i < 4; i++) {
+            assertFalse("dynamic reconfig was not disabled before stopping server " + i, qu.getPeer(i).peer.isReconfigEnabled());
+            qu.shutdown(i);
+            qu.restart(i);
+            assertTrue("dynamic reconfig is not enabled for the restarted server " + i, qu.getPeer(i).peer.isReconfigEnabled());
+            testNormalOperation(zkArr[i], zkArr[(i % 3) + 1], false);
+        }
+
+        // now we will test dynamic reconfig by remove server 2, then add it back later
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
+        leavingServers.add("2");
+
+        // remember this server so we can add it back later
+        joiningServers.add(String.format("server.2=localhost:%d:%d:participant;localhost:%d",
+                qu.getPeer(2).peer.getQuorumAddress().getAllPorts().get(0),
+                qu.getPeer(2).peer.getElectionAddress().getAllPorts().get(0),
+                qu.getPeer(2).peer.getClientPort()));
+
+        // here we remove server 2
+        zkAdminArr = createAdminHandles(qu);
+        String configStr = reconfig(zkAdminArr[1], null, leavingServers, null, -1);
+        testServerHasConfig(zkArr[3], null, leavingServers);
+        testNormalOperation(zkArr[1], zkArr[3], false);
+
+
+        // here we add back server 2
+        QuorumVerifier qv = qu.getPeer(1).peer.configFromString(configStr);
+        long version = qv.getVersion();
+        reconfig(zkAdminArr[3], joiningServers, null, null, version);
+
+        testServerHasConfig(zkArr[1], joiningServers, null);
+        testServerHasConfig(zkArr[2], joiningServers, null);
+        testServerHasConfig(zkArr[3], joiningServers, null);
+        testNormalOperation(zkArr[3], zkArr[1], false);
+    }
+
+
     private void assertLocalPeerMXBeanAttributes(
         QuorumPeer qp,
         String beanName,

From db99959ef338783102f8755b4d10c1443f709425 Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Mon, 8 Jun 2020 12:33:03 +0000
Subject: [PATCH 045/591] ZOOKEEPER-3845: Add metric JVM_PAUSE_TIME

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Michael Han <hanm@apache.org>, Andor Molnar <andor@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1365 from jhuan31/ZOOKEEPER-3845
---
 .../main/java/org/apache/zookeeper/server/ServerMetrics.java | 4 ++++
 .../org/apache/zookeeper/server/util/JvmPauseMonitor.java    | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 7566cd255ae..f7a9f3d1896 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -248,6 +248,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         RESPONSE_BYTES = metricsContext.getCounter("response_bytes");
         WATCH_BYTES = metricsContext.getCounter("watch_bytes");
+
+        JVM_PAUSE_TIME = metricsContext.getSummary("jvm_pause_time_ms", DetailLevel.ADVANCED);
     }
 
     /**
@@ -487,6 +489,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter RESPONSE_BYTES;
     public final Counter WATCH_BYTES;
 
+    public final Summary JVM_PAUSE_TIME;
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java
index 0a50c1668be..cdefb5d297c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java
@@ -28,6 +28,7 @@
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -191,8 +192,10 @@ public void run() {
                 }
                 long endTime = Instant.now().toEpochMilli();
                 long extraSleepTime = (endTime - startTime) - sleepTimeMs;
+                if (extraSleepTime >= 0) {
+                    ServerMetrics.getMetrics().JVM_PAUSE_TIME.add(extraSleepTime);
+                }
                 Map<String, GcTimes> gcTimesAfterSleep = getGcTimes();
-
                 if (extraSleepTime > warnThresholdMs) {
                     ++numGcWarnThresholdExceeded;
                     LOG.warn(formatMessage(extraSleepTime, gcTimesAfterSleep, gcTimesBeforeSleep));

From 501125588052827d92a90f8a56d07cbbbdad2fa7 Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Mon, 8 Jun 2020 12:44:38 +0000
Subject: [PATCH 046/591] ZOOKEEPER-3856: Add a couple metrics to track
 inflight diff syncs and snap syncs

There are useful metrics in a cluster with a large number of observes:
INFLIGHT_SNAP_COUNT
INFLIGHT_DIFF_COUNT

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1374 from jhuan31/ZOOKEEPER-3856
---
 .../java/org/apache/zookeeper/server/ServerMetrics.java    | 6 ++++++
 .../org/apache/zookeeper/server/quorum/LearnerHandler.java | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index f7a9f3d1896..c4ed3ba3db6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -84,6 +84,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         CONNECTION_TOKEN_DEFICIT = metricsContext.getSummary("connection_token_deficit", DetailLevel.BASIC);
         CONNECTION_REJECTED = metricsContext.getCounter("connection_rejected");
 
+        INFLIGHT_SNAP_COUNT = metricsContext.getSummary("inflight_snap_count", DetailLevel.BASIC);
+        INFLIGHT_DIFF_COUNT = metricsContext.getSummary("inflight_diff_count", DetailLevel.BASIC);
+
         WRITE_PER_NAMESPACE = metricsContext.getSummarySet("write_per_namespace", DetailLevel.BASIC);
         READ_PER_NAMESPACE = metricsContext.getSummarySet("read_per_namespace", DetailLevel.BASIC);
 
@@ -308,6 +311,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Summary CONNECTION_TOKEN_DEFICIT;
     public final Counter CONNECTION_REJECTED;
 
+    public final Summary INFLIGHT_SNAP_COUNT;
+    public final Summary INFLIGHT_DIFF_COUNT;
+
     public final Counter UNRECOVERABLE_ERROR_COUNT;
     public final SummarySet WRITE_PER_NAMESPACE;
     public final SummarySet READ_PER_NAMESPACE;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 3bab398b41e..4a7def87086 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -556,6 +556,7 @@ public void run() {
             if (needSnap) {
                 syncThrottler = learnerMaster.getLearnerSnapSyncThrottler();
                 syncThrottler.beginSync(exemptFromThrottle);
+                ServerMetrics.getMetrics().INFLIGHT_SNAP_COUNT.add(syncThrottler.getSyncInProgress());
                 try {
                     long zxidToSend = learnerMaster.getZKDatabase().getDataTreeLastProcessedZxid();
                     oa.writeRecord(new QuorumPacket(Leader.SNAP, zxidToSend, null, null), "packet");
@@ -581,6 +582,7 @@ public void run() {
             } else {
                 syncThrottler = learnerMaster.getLearnerDiffSyncThrottler();
                 syncThrottler.beginSync(exemptFromThrottle);
+                ServerMetrics.getMetrics().INFLIGHT_DIFF_COUNT.add(syncThrottler.getSyncInProgress());
                 ServerMetrics.getMetrics().DIFF_COUNT.add(1);
             }
 
@@ -621,6 +623,11 @@ public void run() {
             syncLimitCheck.start();
             // sync ends when NEWLEADER-ACK is received
             syncThrottler.endSync();
+            if (needSnap) {
+                ServerMetrics.getMetrics().INFLIGHT_SNAP_COUNT.add(syncThrottler.getSyncInProgress());
+            } else {
+                ServerMetrics.getMetrics().INFLIGHT_DIFF_COUNT.add(syncThrottler.getSyncInProgress());
+            }
             syncThrottler = null;
 
             // now that the ack has been processed expect the syncLimit

From 79a99ac97cea942967a2a08e7873a0cea9a2e046 Mon Sep 17 00:00:00 2001
From: Jordan Zimmerman <jordan@jordanzimmerman.com>
Date: Mon, 8 Jun 2020 13:07:12 +0000
Subject: [PATCH 047/591] ZOOKEEPER-3831: add a compatibility test module

ZooKeeper has many external libraries that are dependent on staying compatible. For example, Apache Curator. This new module will be used to add compatibility tests for any third party library, tool, etc. that we want to ensure maintains compatibility. The module is configured with Maven not to install/deploy so it's only for testing purposes. An initial test using Apache Curator is added.

Author: Jordan Zimmerman <jordan@jordanzimmerman.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1369 from Randgalt/ZOOKEEPER-3831-add-compatibility-test-module
---
 pom.xml                                       |  1 +
 zookeeper-compatibility-tests/pom.xml         | 60 +++++++++++++++
 .../pom.xml                                   | 60 +++++++++++++++
 .../TestApacheCuratorCompatibility.java       | 77 +++++++++++++++++++
 4 files changed, 198 insertions(+)
 create mode 100644 zookeeper-compatibility-tests/pom.xml
 create mode 100644 zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
 create mode 100644 zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java

diff --git a/pom.xml b/pom.xml
index c0dbbee7a97..055d474a50a 100755
--- a/pom.xml
+++ b/pom.xml
@@ -64,6 +64,7 @@
     <module>zookeeper-client</module>
     <module>zookeeper-recipes</module>
     <module>zookeeper-assembly</module>
+    <module>zookeeper-compatibility-tests</module>
   </modules>
 
   <scm>
diff --git a/zookeeper-compatibility-tests/pom.xml b/zookeeper-compatibility-tests/pom.xml
new file mode 100644
index 00000000000..f861196c622
--- /dev/null
+++ b/zookeeper-compatibility-tests/pom.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.apache.zookeeper</groupId>
+        <artifactId>parent</artifactId>
+        <version>3.7.0-SNAPSHOT</version>
+    </parent>
+    <packaging>pom</packaging>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>zookeeper-compatibility-tests</artifactId>
+
+    <modules>
+        <module>zookeeper-compatibility-tests-curator</module>
+    </modules>
+
+    <name>Apache ZooKeeper - Compatibility Tests</name>
+    <description>Module for various compatibility tests</description>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-install-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
new file mode 100644
index 00000000000..c917e105ffb
--- /dev/null
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.apache.zookeeper</groupId>
+        <artifactId>zookeeper-compatibility-tests</artifactId>
+        <version>3.7.0-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>zookeeper-compatibility-tests-curator</artifactId>
+
+    <name>Apache ZooKeeper - Compatibility Tests - Curator</name>
+    <description>Module for Apache Curator compatibility tests</description>
+
+    <properties>
+        <apache-curator-version>5.0.0</apache-curator-version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.zookeeper</groupId>
+            <artifactId>zookeeper</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.curator</groupId>
+            <artifactId>curator-recipes</artifactId>
+            <version>${apache-curator-version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.zookeeper</groupId>
+                    <artifactId>zookeeper</artifactId>
+                </exclusion>
+            </exclusions>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.curator</groupId>
+            <artifactId>curator-test</artifactId>
+            <version>${apache-curator-version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.zookeeper</groupId>
+                    <artifactId>zookeeper</artifactId>
+                </exclusion>
+            </exclusions>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+</project>
\ No newline at end of file
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
new file mode 100644
index 00000000000..b60a0042244
--- /dev/null
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
@@ -0,0 +1,77 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.compatibility;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import org.apache.curator.framework.CuratorFramework;
+import org.apache.curator.framework.CuratorFrameworkFactory;
+import org.apache.curator.framework.recipes.cache.CuratorCache;
+import org.apache.curator.retry.RetryOneTime;
+import org.apache.curator.test.TestingServer;
+import org.junit.Test;
+
+/**
+ * Make sure minimal Apache Curator APIs work correctly. As it's a widely used ZooKeeper
+ * client library we should not break it.
+ */
+public class TestApacheCuratorCompatibility {
+    private static final int TIMEOUT_MS = 5000;
+
+    @Test
+    public void testBasicUsageOfApisAndRecipes() throws Exception {
+        try (TestingServer server = new TestingServer()) {
+            RetryOneTime retryPolicy = new RetryOneTime(1);
+            try (CuratorFramework client = CuratorFrameworkFactory.newClient(server.getConnectString(), retryPolicy)) {
+                try (CuratorCache cache = CuratorCache.build(client, "/base/path")) {
+                    client.start();
+                    cache.start();
+
+                    BlockingQueue<String> paths = new LinkedBlockingQueue<>();
+                    cache.listenable().addListener((dummy1, dummy2, data) -> paths.add(data.getPath()));
+
+                    client.create().creatingParentsIfNeeded().forPath("/base/path/1");
+                    client.create().creatingParentsIfNeeded().forPath("/base/path/2");
+                    client.create().creatingParentsIfNeeded().forPath("/base/path/1/a");
+                    client.create().creatingParentsIfNeeded().forPath("/base/path/2/a");
+
+                    assertEquals("/base/path", poll(paths));
+                    assertEquals("/base/path/1", poll(paths));
+                    assertEquals("/base/path/2", poll(paths));
+                    assertEquals("/base/path/1/a", poll(paths));
+                    assertEquals("/base/path/2/a", poll(paths));
+                }
+            }
+        }
+    }
+
+    private static String poll(BlockingQueue<String> queue) {
+        try {
+            String value = queue.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS);
+            assertNotNull("Event poll timed out", value);
+            return value;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException(e);
+        }
+    }
+}

From 8c9590caeaaa9079d958eb79da77321586c76236 Mon Sep 17 00:00:00 2001
From: Norbert Kalmar <nkalmar@apache.org>
Date: Wed, 10 Jun 2020 15:21:39 +0200
Subject: [PATCH 048/591] ZOOKEEPER-3831: [ADDENDUM] fix apache-rat error, add
 missing apache license

I think we will need to push this to both master and branch-3.6.

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Norbert Kalmar <nkalmar@apache.org>

Closes #1376 from symat/rat-fix
---
 .../pom.xml                                   | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index c917e105ffb..e95b2bcb73d 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -1,4 +1,23 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
 <project xmlns="http://maven.apache.org/POM/4.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

From 8da9c723ac1a889c989ecefada722ed858049537 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Tue, 16 Jun 2020 11:28:10 +0200
Subject: [PATCH 049/591] ZOOKEEPER-3850: Update jUnit to 5.6 in pom.xml files

First sub-task of ZOOKEEPER-3732 Update jUnit to 5.6. Updating jUnit to 5.6.2 without code changes.
Since many jUnit resources got deprecated I had to switch off the check for deprecation which has to be enabled again in a later step.

Change-Id: Ib152ab085c3f3ed8fec7f317d33a68f43d14735f

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1372 from tamaashu/ZOOKEEPER-3850
---
 pom.xml                                              | 12 ++++++++----
 .../zookeeper-compatibility-tests-curator/pom.xml    |  4 ++--
 zookeeper-contrib/zookeeper-contrib-rest/pom.xml     |  4 ++--
 .../zookeeper-contrib-zooinspector/pom.xml           |  4 ++--
 zookeeper-it/pom.xml                                 |  4 ++--
 zookeeper-jute/pom.xml                               |  4 ++--
 .../zookeeper-prometheus-metrics/pom.xml             |  4 ++--
 zookeeper-recipes/pom.xml                            |  4 ++--
 zookeeper-server/pom.xml                             |  4 ++--
 9 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/pom.xml b/pom.xml
index 055d474a50a..722efb82b9a 100755
--- a/pom.xml
+++ b/pom.xml
@@ -429,7 +429,7 @@
     <slf4j.version>1.7.25</slf4j.version>
     <audience-annotations.version>0.5.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
-    <junit.version>4.12</junit.version>
+    <junit.version>5.6.2</junit.version>
     <log4j.version>1.2.17</log4j.version>
     <mockito.version>2.27.0</mockito.version>
     <hamcrest.version>1.3</hamcrest.version>
@@ -555,8 +555,13 @@
         <version>${jmockit.version}</version>
       </dependency>
       <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
+        <groupId>org.junit.jupiter</groupId>
+        <artifactId>junit-jupiter-engine</artifactId>
+        <version>${junit.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.junit.vintage</groupId>
+        <artifactId>junit-vintage-engine</artifactId>
         <version>${junit.version}</version>
       </dependency>
       <dependency>
@@ -642,7 +647,6 @@
              <showWarnings>true</showWarnings>
              <compilerArgs>
                <compilerArg>-Werror</compilerArg>
-               <compilerArg>-Xlint:deprecation</compilerArg>
                <compilerArg>-Xlint:unchecked</compilerArg>
                <compilerArg>-Xlint:-options</compilerArg>
                <compilerArg>-Xdoclint:-missing</compilerArg>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index e95b2bcb73d..074a4554725 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -71,8 +71,8 @@
         </dependency>
 
         <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
+            <groupId>org.junit.vintage</groupId>
+            <artifactId>junit-vintage-engine</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
index 99e4f9f6121..c75f012f5b1 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
@@ -115,8 +115,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index 6d474608c4b..c9f3b1e2ce2 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -70,8 +70,8 @@
       </exclusions>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
index 10f8b9d14b0..2c381a6254e 100755
--- a/zookeeper-it/pom.xml
+++ b/zookeeper-it/pom.xml
@@ -54,8 +54,8 @@
       <version>${project.version}</version>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
     </dependency>
     <dependency>
       <groupId>org.openjdk.jmh</groupId>
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index 129ba12ce08..770282e802f 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -37,8 +37,8 @@
       <artifactId>audience-annotations</artifactId>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index 68e7eb62cbd..4f70e98643f 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -75,8 +75,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
index 051f6452265..39a898ccda4 100755
--- a/zookeeper-recipes/pom.xml
+++ b/zookeeper-recipes/pom.xml
@@ -80,8 +80,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 90f6151584e..fade079d34c 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -152,8 +152,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>

From f6c9bac7d39e790171762e522fedb7b3af66d3c7 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Fri, 19 Jun 2020 09:55:12 +0200
Subject: [PATCH 050/591] ZOOKEEPER-3865: fix backward-compatibility for
 ZooKeeperServer constructor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the fix of ZOOKEEPER-3829 I accidentally changed a public constructor of ZooKeeper server. I didn’t realize Curator is using it for testing (and maybe other Apache projects are doing so as well).

In this PR I restore the original constructor for master and branch-3.6.

For branch-3.5 I will submit an other PR, that will make it compatible with e.g. Curator 4.3.

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1382 from symat/ZOOKEEPER-3865
---
 .../org/apache/zookeeper/server/ZooKeeperServer.java     | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index c391425a309..9d09024b386 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -301,7 +301,14 @@ public ZooKeeperServer() {
     }
 
     /**
-     * Creates a ZooKeeperServer instance. It sets everything up, but doesn't
+     * Keeping this constructor for backward compatibility
+     */
+    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig) {
+        this(txnLogFactory, tickTime, minSessionTimeout, maxSessionTimeout, clientPortListenBacklog, zkDb, initialConfig, QuorumPeerConfig.isReconfigEnabled());
+    }
+
+    /**
+     *  * Creates a ZooKeeperServer instance. It sets everything up, but doesn't
      * actually start listening for clients until run() is invoked.
      *
      */

From ac8534494c0f731e15d5a23ad099effc2d3119aa Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Wed, 24 Jun 2020 09:05:45 +0200
Subject: [PATCH 051/591] ZOOKEEPER-3859: Add a couple request processor
 metrics

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>

Closes #1379 from jhuan31/ZOOKEEPER-3859
---
 .../org/apache/zookeeper/server/PrepRequestProcessor.java   | 4 +++-
 .../java/org/apache/zookeeper/server/ServerMetrics.java     | 6 ++++++
 .../zookeeper/server/quorum/FollowerRequestProcessor.java   | 4 ++++
 .../zookeeper/server/quorum/ObserverRequestProcessor.java   | 5 +++++
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index debf1c4f6fe..010faf51a2d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -771,8 +771,10 @@ protected void pRequest(Request request) throws RequestProcessorException {
         }
 
         request.zxid = zks.getZxid();
-        ServerMetrics.getMetrics().PREP_PROCESS_TIME.add(Time.currentElapsedTime() - request.prepStartTime);
+        long timeFinishedPrepare = Time.currentElapsedTime();
+        ServerMetrics.getMetrics().PREP_PROCESS_TIME.add(timeFinishedPrepare - request.prepStartTime);
         nextProcessor.processRequest(request);
+        ServerMetrics.getMetrics().PROPOSAL_PROCESS_TIME.add(Time.currentElapsedTime() - timeFinishedPrepare);
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index c4ed3ba3db6..e95949a4e4c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -123,6 +123,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         OUTSTANDING_CHANGES_QUEUED = metricsContext.getCounter("outstanding_changes_queued");
         OUTSTANDING_CHANGES_REMOVED = metricsContext.getCounter("outstanding_changes_removed");
         PREP_PROCESS_TIME = metricsContext.getSummary("prep_process_time", DetailLevel.BASIC);
+        PROPOSAL_PROCESS_TIME = metricsContext.getSummary("proposal_process_time", DetailLevel.BASIC);
         CLOSE_SESSION_PREP_TIME = metricsContext.getSummary("close_session_prep_time", DetailLevel.ADVANCED);
 
         REVALIDATE_COUNT = metricsContext.getCounter("revalidate_count");
@@ -236,6 +237,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         DIGEST_MISMATCHES_COUNT = metricsContext.getCounter("digest_mismatches_count");
 
+        LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE = metricsContext.getSummary("learner_request_processor_queue_size", DetailLevel.BASIC);
+
         UNSUCCESSFUL_HANDSHAKE = metricsContext.getCounter("unsuccessful_handshake");
         INSECURE_ADMIN = metricsContext.getCounter("insecure_admin_count");
         TLS_HANDSHAKE_EXCEEDED = metricsContext.getCounter("tls_handshake_exceeded");
@@ -325,6 +328,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter OUTSTANDING_CHANGES_QUEUED;
     public final Counter OUTSTANDING_CHANGES_REMOVED;
     public final Summary PREP_PROCESS_TIME;
+    public final Summary PROPOSAL_PROCESS_TIME;
     public final Summary CLOSE_SESSION_PREP_TIME;
 
     public final Summary PROPOSAL_LATENCY;
@@ -472,6 +476,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     // txns to data tree.
     public final Counter DIGEST_MISMATCHES_COUNT;
 
+    public final Summary LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE;
+
     public final Counter UNSUCCESSFUL_HANDSHAKE;
 
     /*
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index 90c4d490344..58ca9905dfe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -64,6 +64,8 @@ public FollowerRequestProcessor(FollowerZooKeeperServer zks, RequestProcessor ne
     public void run() {
         try {
             while (!finished) {
+                ServerMetrics.getMetrics().LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE.add(queuedRequests.size());
+
                 Request request = queuedRequests.take();
                 if (LOG.isTraceEnabled()) {
                     ZooTrace.logRequest(LOG, ZooTrace.CLIENT_REQUEST_TRACE_MASK, 'F', request, "");
@@ -118,6 +120,8 @@ public void run() {
                     break;
                 }
             }
+        } catch (RuntimeException e) { // spotbugs require explicit catch of RuntimeException
+            handleException(this.getName(), e);
         } catch (Exception e) {
             handleException(this.getName(), e);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
index 0075ce404a8..0e7071b91b7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
@@ -24,6 +24,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperCriticalThread;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.txn.ErrorTxn;
@@ -64,6 +65,8 @@ public ObserverRequestProcessor(ObserverZooKeeperServer zks, RequestProcessor ne
     public void run() {
         try {
             while (!finished) {
+                ServerMetrics.getMetrics().LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE.add(queuedRequests.size());
+
                 Request request = queuedRequests.take();
                 if (LOG.isTraceEnabled()) {
                     ZooTrace.logRequest(LOG, ZooTrace.CLIENT_REQUEST_TRACE_MASK, 'F', request, "");
@@ -118,6 +121,8 @@ public void run() {
                     break;
                 }
             }
+        } catch (RuntimeException e) { // spotbugs require explicit catch of RuntimeException
+            handleException(this.getName(), e);
         } catch (Exception e) {
             handleException(this.getName(), e);
         }

From 6ab1822ec431bb3309021c1ddc613a5eaa28d83b Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Tue, 30 Jun 2020 15:01:07 +0000
Subject: [PATCH 052/591] ZOOKEEPER-3852: Upgrade jUnit in ZooKeeper-Jute

Sub-task of ZOOKEEPER-3732, updating jUnit to 5.6.2 in zookeeper-it sub-component.

Change-Id: I495a1516c07bc597558719030a0d585bc7d4f7eb

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1386 from tamaashu/ZOOKEEPER-3852
---
 zookeeper-jute/pom.xml                        |  4 ++--
 .../apache/jute/BinaryInputArchiveTest.java   | 20 +++++++++----------
 .../apache/jute/TestCheckWriterReader.java    |  2 +-
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index 770282e802f..74eedb8448f 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -37,8 +37,8 @@
       <artifactId>audience-annotations</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.junit.vintage</groupId>
-      <artifactId>junit-vintage-engine</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
index fe9124c7292..9a1c70eeb5a 100644
--- a/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
+++ b/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.jute;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 // TODO: introduce JuteTestCase as in ZKTestCase
 
@@ -47,8 +47,8 @@ public void testReadStringCheckLength() {
             ia.readString("");
             fail("Should have thrown an IOException");
         } catch (IOException e) {
-            assertTrue("Not 'Unreasonable length' exception: " + e,
-                    e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH));
+            assertTrue(e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH),
+                    () -> "Not 'Unreasonable length' exception: " + e);
         }
     }
 
@@ -155,8 +155,8 @@ public void testReadStringForRecordsHavingLengthMoreThanMaxAllowedSize() {
       ia.readString("");
       fail("Should have thrown an IOException");
     } catch (IOException e) {
-      assertTrue("Not 'Unreasonable length' exception: " + e,
-          e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH));
+      assertTrue(e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH),
+              () -> "Not 'Unreasonable length' exception: " + e);
     }
   }
 
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java b/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java
index 81067ce8e4d..9ae70fc023b 100644
--- a/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java
+++ b/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java
@@ -18,7 +18,7 @@
 
 package org.apache.jute;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;

From f362313860401024b7141489e66ee76af442eb76 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad 72626 <mohammad.arshad@huawei.com>
Date: Mon, 13 Jul 2020 12:10:05 +0200
Subject: [PATCH 053/591] ZOOKEEPER-3878: Client connection fails if IPV6 is
 not enclosed in square brackets

Author: Mohammad Arshad 72626 <mohammad.arshad@huawei.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1398 from arshadmohammad/ZOOKEEPER-3878-master
---
 .../zookeeper/client/ConnectStringParser.java | 19 +++++---
 .../org/apache/zookeeper/common/NetUtils.java | 44 ++++++++++++++++++
 .../apache/zookeeper/common/NetUtilsTest.java | 45 +++++++++++++++++++
 .../test/ConnectStringParserTest.java         | 22 +++++++++
 4 files changed, 123 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
index 2cea78bc20b..d677b69d269 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
@@ -22,9 +22,8 @@
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
 import java.util.List;
+import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.common.PathUtils;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.apache.zookeeper.server.util.ConfigUtils;
 
 /**
  * A parser for ZooKeeper Client connect strings.
@@ -70,16 +69,22 @@ public ConnectStringParser(String connectString) {
         List<String> hostsList = split(connectString, ",");
         for (String host : hostsList) {
             int port = DEFAULT_PORT;
-            try {
-                String[] hostAndPort = ConfigUtils.getHostAndPort(host);
+            String[] hostAndPort = NetUtils.getIPV6HostAndPort(host);
+            if (hostAndPort.length != 0) {
                 host = hostAndPort[0];
                 if (hostAndPort.length == 2) {
                     port = Integer.parseInt(hostAndPort[1]);
                 }
-            } catch (ConfigException e) {
-                e.printStackTrace();
+            } else {
+                int pidx = host.lastIndexOf(':');
+                if (pidx >= 0) {
+                    // otherwise : is at the end of the string, ignore
+                    if (pidx < host.length() - 1) {
+                        port = Integer.parseInt(host.substring(pidx + 1));
+                    }
+                    host = host.substring(0, pidx);
+                }
             }
-
             serverAddresses.add(InetSocketAddress.createUnresolved(host, port));
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
index cea12cce1bb..be8cb9a6389 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
@@ -41,4 +41,48 @@ public static String formatInetAddr(InetSocketAddress addr) {
         }
     }
 
+    /**
+     * Separates host and port from given host port string if host port string is enclosed
+     * within square bracket.
+     *
+     * @param hostPort host port string
+     * @return String[]{host, port} if host port string is host:port
+     * or String[] {host, port:port} if host port string is host:port:port
+     * or String[] {host} if host port string is host
+     * or String[]{} if not a ipv6 host port string.
+     */
+    public static String[] getIPV6HostAndPort(String hostPort) {
+        if (hostPort.startsWith("[")) {
+            int i = hostPort.lastIndexOf(']');
+            if (i < 0) {
+                throw new IllegalArgumentException(
+                    hostPort + " starts with '[' but has no matching ']'");
+            }
+            String host = hostPort.substring(1, i);
+            if (host.isEmpty()) {
+                throw new IllegalArgumentException(host + " is empty.");
+            }
+            if (hostPort.length() > i + 1) {
+                return getHostPort(hostPort, i, host);
+            }
+            return new String[] { host };
+        } else {
+            //Not an IPV6 host port string
+            return new String[] {};
+        }
+    }
+
+    private static String[] getHostPort(String hostPort, int indexOfClosingBracket, String host) {
+        // [127::1]:2181 , check separator : exits
+        if (hostPort.charAt(indexOfClosingBracket + 1) != ':') {
+            throw new IllegalArgumentException(hostPort + " does not have : after ]");
+        }
+        // [127::1]: scenario
+        if (indexOfClosingBracket + 2 == hostPort.length()) {
+            throw new IllegalArgumentException(hostPort + " doesn't have a port after colon.");
+        }
+        //do not include
+        String port = hostPort.substring(indexOfClosingBracket + 2);
+        return new String[] { host, port };
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
index c61eeba4e39..e06b7d1854a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
@@ -69,4 +69,49 @@ public void testFormatAddrUnresolved() {
         assertEquals("doesnt.exist.com:1234", NetUtils.formatInetAddr(isa));
     }
 
+    @Test(expected = IllegalArgumentException.class)
+    public void tetGetIPV6HostAndPort_WhenHostDoesNotEndWithBracket() {
+        NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334:443");
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void tetGetIPV6HostAndPort_WhenNoPortAfterColon() {
+        NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:");
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void tetGetIPV6HostAndPort_WhenPortIsNotSeparatedProperly() {
+        NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]2181");
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void tetGetIPV6HostAndPort_WhenHostIsEmpty() {
+        NetUtils.getIPV6HostAndPort("[]:2181");
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_EmptyStringArrayIfDoesNotStartWithBracket() {
+        String[] ipv6HostAndPort =
+            NetUtils.getIPV6HostAndPort("2001:0db8:85a3:0000:0000:8a2e:0370:7334]");
+        assertEquals(0, ipv6HostAndPort.length);
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_ReturnHostPort() {
+        String[] ipv6HostAndPort =
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:2181");
+        assertEquals(2, ipv6HostAndPort.length);
+        assertEquals("2001:0db8:85a3:0000:0000:8a2e:0370:7334", ipv6HostAndPort[0]);
+        assertEquals("2181", ipv6HostAndPort[1]);
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_ReturnHostPortPort() {
+        String[] ipv6HostAndPort =
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:2181:3181");
+        assertEquals(2, ipv6HostAndPort.length);
+        assertEquals("2001:0db8:85a3:0000:0000:8a2e:0370:7334", ipv6HostAndPort[0]);
+        assertEquals("2181:3181", ipv6HostAndPort[1]);
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
index 066e0f35849..e1048f28388 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
@@ -21,6 +21,7 @@
 import static org.junit.Assert.assertEquals;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.ConnectStringParser;
+import org.junit.Assert;
 import org.junit.Test;
 
 public class ConnectStringParserTest extends ZKTestCase {
@@ -85,4 +86,25 @@ private void assertChrootPath(String expected, ConnectStringParser parser) {
         assertEquals(expected, parser.getChrootPath());
     }
 
+    @Test
+    public void testParseIPV6ConnectionString() {
+        String servers = "[127::1],127.0.10.2";
+        ConnectStringParser parser = new ConnectStringParser(servers);
+
+        Assert.assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
+        Assert.assertEquals("127.0.10.2", parser.getServerAddresses().get(1).getHostString());
+        Assert.assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+        Assert.assertEquals(2181, parser.getServerAddresses().get(1).getPort());
+
+        servers = "[127::1]:2181,[127::2]:2182,[127::3]:2183";
+        parser = new ConnectStringParser(servers);
+
+        Assert.assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
+        Assert.assertEquals("127::2", parser.getServerAddresses().get(1).getHostString());
+        Assert.assertEquals("127::3", parser.getServerAddresses().get(2).getHostString());
+        Assert.assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+        Assert.assertEquals(2182, parser.getServerAddresses().get(1).getPort());
+        Assert.assertEquals(2183, parser.getServerAddresses().get(2).getPort());
+    }
+
 }

From 5b58e19c85ca1dfb8b2a0eec1411b34e6ca2e47b Mon Sep 17 00:00:00 2001
From: "Kent R. Spillner" <kspillner@acm.org>
Date: Fri, 17 Jul 2020 17:31:32 +0200
Subject: [PATCH 054/591] ZOOKEEPER-3101: add reminder to ZOO_ERRORS

Add comment at bottom of ZOO_ERRORS reminding developers to also
update zerror(int) when adding or changing values.  Suggested by
phunt in https://github.com/apache/zookeeper/pull/575#issuecomment-406356144.

Signed-off-by: Kent R. Spillner <kspillneracm.org>

Author: Kent R. Spillner <kspillner@acm.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Benjamin Reed <breed@apache.org>

Closes #581 from sl4mmy/zookeeper-3101
---
 zookeeper-client/zookeeper-client-c/include/zookeeper.h | 2 ++
 zookeeper-client/zookeeper-client-c/src/zookeeper.c     | 6 ++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 95959af56fe..8bd1d95db12 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -142,6 +142,8 @@ enum ZOO_ERRORS {
   ZRECONFIGDISABLED = -123, /*!< Attempts to perform a reconfiguration operation when reconfiguration feature is disabled */
   ZSESSIONCLOSEDREQUIRESASLAUTH = -124, /*!< The session has been closed by server because server requires client to do SASL authentication, but client is not configured with SASL authentication or configuted with SASL but failed (i.e. wrong credential used.). */
   ZTHROTTLEDOP = -127 /*!< Operation was throttled and not executed at all. please, retry! */
+
+  /* when adding/changing values here also update zerror(int) to return correct error message */
 };
 
 #ifdef __cplusplus
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 8df4b29dcc5..d33b50c8127 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -4958,8 +4958,10 @@ const char* zerror(int c)
       return "the watcher couldn't be found";
     case ZRECONFIGDISABLED:
       return "attempts to perform a reconfiguration operation when reconfiguration feature is disable";
-   case ZTHROTTLEDOP:
-     return "Operation was throttled due to high load";
+    case ZSESSIONCLOSEDREQUIRESASLAUTH:
+      return "session closed by server because client is required to do SASL authentication";
+    case ZTHROTTLEDOP:
+      return "Operation was throttled due to high load";
     }
     if (c > 0) {
       return strerror(c);

From d1c40dd130a232f8b8b68940db607f14d3667f6e Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Fri, 24 Jul 2020 08:46:43 +0200
Subject: [PATCH 055/591] ZOOKEEPER-3896: Migrate Jenkins jobs to Jenkinsfile
 based Pipeline

As part of the new CI instance migration we wanted to take advantage of Jenkinsfile based pipelines. From now on we're able to script and source control our main Jenkins settings.

This patch only adding the Jenkinsfile itself to all major branches: master, branch-3.6 and branch-3.5. Once it's in I'll create the Jenkins job which will use it.

Currently I have a testing job based on my ZK fork: https://ci-hadoop.apache.org/view/ZooKeeper/job/zookeeper-master-maven-multipipeline/

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1409 from anmolnar/ZOOKEEPER-3896
---
 Jenkinsfile | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 Jenkinsfile

diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 00000000000..4fdc0e1bd0e
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+   agent none
+
+    options {
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+    }
+
+    triggers {
+        pollSCM 'H/10 * * * *'
+        cron('@daily')
+    }
+
+    stages {
+        stage('Prepare') {
+            matrix {
+                agent any
+                axes {
+                    axis {
+                        name 'JAVA_VERSION'
+                        values 'JDK 1.8 (latest)', 'JDK 11 (latest)'
+                    }
+                }
+
+                tools {
+                    // Install the Maven version configured as "M3" and add it to the path.
+                    maven "Maven (latest)"
+                    jdk "${JAVA_VERSION}"
+                }
+
+                stages {
+                    stage('BuildAndTest') {
+                        steps {
+                            // Get some code from a GitHub repository
+                            git 'https://github.com/apache/zookeeper'
+
+                            // Run Maven on a Unix agent.
+                            sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
+                        }
+                        post {
+                            // If Maven was able to run the tests, even if some of the test
+                            // failed, record the test results and archive the jar file.
+                            always {
+                               junit '**/target/surefire-reports/TEST-*.xml'
+                               archiveArtifacts '**/target/*.jar'
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+

From 281a7c30c4485c34ea11e7051e55ebf6a859b993 Mon Sep 17 00:00:00 2001
From: Shyam Sundar J <shyamsundarcoolz@gmail.com>
Date: Fri, 24 Jul 2020 11:27:47 +0200
Subject: [PATCH 056/591] ZOOKEEPER-3415: convert internal logic to use java8
 streams

I have refactored few for loops that perform just some filtering and collections

Author: Shyam Sundar J <shyamsundarcoolz@gmail.com>

Reviewers: eolivelli@apache.org, andor@apache.org

Closes #1311 from severussundar/ZOOKEEPER-3415 and squashes the following commits:

f07461cd7 [Shyam Sundar J] Merge branch 'master' into ZOOKEEPER-3415
78ed4c8ec [Shyam Sundar J] removing extra whitespaces and newlines
6fd7751de [Shyam Sundar J] removing unused imports and tabs
cb133fd33 [Shyam Sundar J] Merge branch 'master' of https://github.com/apache/zookeeper into ZOOKEEPER-3415
3f9a39a62 [Shyam Sundar J] ZOOKEEPER-3415 :convert internal logic to use java8 streams
---
 .../zookeeper/server/ZooKeeperServer.java     | 21 ++++---------------
 .../server/admin/JettyAdminServer.java        | 12 ++---------
 2 files changed, 6 insertions(+), 27 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 9d09024b386..65438429106 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -498,17 +498,9 @@ public void loadData() throws IOException, InterruptedException {
         }
 
         // Clean up dead sessions
-        List<Long> deadSessions = new ArrayList<>();
-        for (Long session : zkDb.getSessions()) {
-            if (zkDb.getSessionWithTimeOuts().get(session) == null) {
-                deadSessions.add(session);
-            }
-        }
-
-        for (long session : deadSessions) {
-            // TODO: Is lastProcessedZxid really the best thing to use?
-            killSession(session, zkDb.getDataTreeLastProcessedZxid());
-        }
+        zkDb.getSessions().stream()
+                        .filter(session -> zkDb.getSessionWithTimeOuts().get(session) == null)
+                        .forEach(session -> killSession(session, zkDb.getDataTreeLastProcessedZxid()));
 
         // Make a clean snapshot
         takeSnapshot();
@@ -1648,12 +1640,7 @@ private static boolean shouldRequireClientSaslAuth() {
     }
 
     private boolean hasCnxSASLAuthenticated(ServerCnxn cnxn) {
-        for (Id id : cnxn.getAuthInfo()) {
-            if (id.getScheme().equals(SASL_AUTH_SCHEME)) {
-                return true;
-            }
-        }
-        return false;
+        return cnxn.getAuthInfo().stream().anyMatch(id -> id.getScheme().equals(SASL_AUTH_SCHEME));
     }
 
     private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHeader requestHeader) throws IOException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 6845f233e24..aa18cfb5994 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -21,11 +21,10 @@
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -260,14 +259,7 @@ protected void doGet(
      * Returns a list of URLs to each registered Command.
      */
     private List<String> commandLinks() {
-        List<String> links = new ArrayList<String>();
-        List<String> commands = new ArrayList<String>(Commands.getPrimaryNames());
-        Collections.sort(commands);
-        for (String command : commands) {
-            String url = commandUrl + "/" + command;
-            links.add(String.format("<a href=\"%s\">%s</a>", url, command));
-        }
-        return links;
+        return Commands.getPrimaryNames().stream().sorted().map(command -> String.format("<a href=\"%s\">%s</a>", commandUrl + "/" + command , command)).collect(Collectors.toList());
     }
 
     /**

From 5de840cdfd0396341e390470c3e03c370196ce64 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Fri, 24 Jul 2020 13:27:39 +0200
Subject: [PATCH 057/591] ZOOKEEPER-3896: PollSCM hourly only to let previous
 builds to finish

Looks like that PollSCM trigger will trigger another build on the same ref if other builds haven't completed rather than haven't started.

I change the polling interval to hourly to let other builds finish in time.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1413 from anmolnar/ZOOKEEPER-3896_2
---
 Jenkinsfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 4fdc0e1bd0e..9c3e4f6d459 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -21,10 +21,11 @@ pipeline {
 
     options {
         buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 59, unit: 'MINUTES')
     }
 
     triggers {
-        pollSCM 'H/10 * * * *'
+        pollSCM('@hourly')
         cron('@daily')
     }
 
@@ -68,4 +69,3 @@ pipeline {
         }
     }
 }
-

From 1c41e127537f66842515ccb21fb48f1670003454 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Mon, 27 Jul 2020 15:47:20 +0200
Subject: [PATCH 058/591] ZOOKEEPER-3896: Remove badly behaving PollSCM trigger

PollSCM trigger triggers a build every time it scans the ZooKeeper repo regardless the branch pointer has been changed or not. Instead, I try to use the built-in 'Scan Multibranch Pipeline' instead which should be good for the same purpose.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1415 from anmolnar/ZOOKEEPER-3896
---
 Jenkinsfile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 9c3e4f6d459..ff76a9f2cd1 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -25,7 +25,6 @@ pipeline {
     }
 
     triggers {
-        pollSCM('@hourly')
         cron('@daily')
     }
 

From 6a8728d98307f7d52cf6dbadb78149e01b1d0bf5 Mon Sep 17 00:00:00 2001
From: "Alexey.Saltanov" <Alexey.Saltanov@billing.ru>
Date: Tue, 28 Jul 2020 08:29:28 +0000
Subject: [PATCH 059/591] ZOOKEEPER-3112: fix fd leak due to
 UnresolvedAddressException on connect

SocketChannel.connect() can throw different kind of exceptions but ClientCnxnSocketNIO.connect() handles only IOException. This could lead to FD leak when socked is opened but is not connected. We should handle some additional exception classes and close the socket.

Author: Alexey.Saltanov <Alexey.Saltanov@billing.ru>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1410 from saltos/ZOOKEEPER-3112
---
 .../main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
index 1fe53a363fa..6cb125dc763 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
@@ -26,6 +26,8 @@
 import java.nio.channels.SelectionKey;
 import java.nio.channels.Selector;
 import java.nio.channels.SocketChannel;
+import java.nio.channels.UnresolvedAddressException;
+import java.nio.channels.UnsupportedAddressTypeException;
 import java.util.Iterator;
 import java.util.Queue;
 import java.util.Set;
@@ -266,7 +268,7 @@ void connect(InetSocketAddress addr) throws IOException {
         SocketChannel sock = createSock();
         try {
             registerAndConnect(sock, addr);
-        } catch (IOException e) {
+        } catch (UnresolvedAddressException | UnsupportedAddressTypeException | SecurityException | IOException e) {
             LOG.error("Unable to open socket to {}", addr);
             sock.close();
             throw e;

From 2898ffddb05df4e826be34ad13478e78ad6fb321 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Wed, 29 Jul 2020 11:37:21 +0200
Subject: [PATCH 060/591] ZOOKEEPER-3896: Added separate Jenkinsfile for
 PreCommit jobs + disable concurrent builds

Further improvements to our Jenkinsfiles.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1416 from anmolnar/ZOOKEEPER-3896
---
 Jenkinsfile           | 14 +++++-----
 Jenkinsfile-PreCommit | 62 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 8 deletions(-)
 create mode 100644 Jenkinsfile-PreCommit

diff --git a/Jenkinsfile b/Jenkinsfile
index ff76a9f2cd1..436c18a17f3 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -17,11 +17,15 @@
  */
 
 pipeline {
-   agent none
+    agent {
+        label 'Hadoop'
+    }
 
     options {
+        disableConcurrentBuilds()
         buildDiscarder(logRotator(daysToKeepStr: '14'))
-        timeout(time: 59, unit: 'MINUTES')
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
     }
 
     triggers {
@@ -40,7 +44,6 @@ pipeline {
                 }
 
                 tools {
-                    // Install the Maven version configured as "M3" and add it to the path.
                     maven "Maven (latest)"
                     jdk "${JAVA_VERSION}"
                 }
@@ -48,15 +51,10 @@ pipeline {
                 stages {
                     stage('BuildAndTest') {
                         steps {
-                            // Get some code from a GitHub repository
                             git 'https://github.com/apache/zookeeper'
-
-                            // Run Maven on a Unix agent.
                             sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
                         }
                         post {
-                            // If Maven was able to run the tests, even if some of the test
-                            // failed, record the test results and archive the jar file.
                             always {
                                junit '**/target/surefire-reports/TEST-*.xml'
                                archiveArtifacts '**/target/*.jar'
diff --git a/Jenkinsfile-PreCommit b/Jenkinsfile-PreCommit
new file mode 100644
index 00000000000..d2a666b7b26
--- /dev/null
+++ b/Jenkinsfile-PreCommit
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 'Hadoop'
+    }
+
+    options {
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    tools {
+        maven "Maven (latest)"
+        jdk "JDK 1.8 (latest)"
+    }
+
+    stages {
+        stage('BuildAndTest') {
+            steps {
+                git 'https://github.com/apache/zookeeper'
+                sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
+            }
+            post {
+                always {
+                   junit '**/target/surefire-reports/TEST-*.xml'
+                }
+            }
+        }
+    }
+
+    post {
+        // Jenkins pipeline jobs fill slaves on PRs without this :(
+        cleanup() {
+            script {
+                sh label: 'Cleanup workspace', script: '''
+                    # See HADOOP-13951
+                    chmod -R u+rxw "${WORKSPACE}"
+                    '''
+                deleteDir()
+            }
+        }
+    }
+}

From 8a72a6e6c30db7dd66203dc2def1ede54882856b Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Wed, 29 Jul 2020 12:00:37 +0200
Subject: [PATCH 061/591] =?UTF-8?q?ZOOKEEPER-3891:=20ZKCli=20commands=20gi?=
 =?UTF-8?q?ve=20wrong=20error=20message=20"Authenticati=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…on is not valid" for insufficient permissions

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1404 from arshadmohammad/ZOOKEEPER-3891-master
---
 .../main/resources/markdown/zookeeperCLI.md   |  4 ++--
 .../zookeeper/cli/CliWrapperException.java    |  2 +-
 .../org/apache/zookeeper/ZooKeeperTest.java   | 19 +++++++++++++++++--
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index c9ebd2b06cd..94cfff9d832 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -68,7 +68,7 @@ Add a authorized user for ACL
 
 ```bash
 [zkshell: 9] getAcl /acl_digest_test
-    Authentication is not valid : /acl_digest_test
+    Insufficient permission : /acl_digest_test
 [zkshell: 10] addauth digest user1:12345
 [zkshell: 11] getAcl /acl_digest_test
     'digest,'user1:+owfoSBn/am19roBPzR1/MfCblE=
@@ -354,7 +354,7 @@ Pre-requisites:
 
 1. set reconfigEnabled=true in the zoo.cfg
 
-2. add a super user or skipAcl,otherwise will get “Authentication is not valid�. e.g. addauth digest zookeeper:admin
+2. add a super user or skipAcl,otherwise will get “Insufficient permission�. e.g. addauth digest zookeeper:admin
 
 ```bash
 # Change follower 2 to an observer and change its port from 2182 to 12182
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
index b2d00bfec3d..fcf46d91eb7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
@@ -43,7 +43,7 @@ private static String getMessage(Throwable cause) {
             } else if (keeperException instanceof KeeperException.InvalidACLException) {
                 return "Acl is not valid : " + keeperException.getPath();
             } else if (keeperException instanceof KeeperException.NoAuthException) {
-                return "Authentication is not valid : " + keeperException.getPath();
+                return "Insufficient permission : " + keeperException.getPath();
             } else if (keeperException instanceof KeeperException.BadArgumentsException) {
                 return "Arguments are not valid : " + keeperException.getPath();
             } else if (keeperException instanceof KeeperException.BadVersionException) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 4467a1ac471..f0f6be55287 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -498,15 +498,20 @@ public void testRedoWithNegativeCmdNumber() throws Exception {
         final ZooKeeper zk = createClient();
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmd1 = "redo -1";
+        String result = executeLine(zkMain, cmd1);
+        assertEquals("Command index out of range", result);
+    }
 
+    private String executeLine(ZooKeeperMain zkMain, String cmd)
+        throws InterruptedException, IOException {
         // setup redirect out/err streams to get System.in/err, use this
         // judiciously!
         final PrintStream systemErr = System.err; // get current err
         final ByteArrayOutputStream errContent = new ByteArrayOutputStream();
         System.setErr(new PrintStream(errContent));
         try {
-            zkMain.executeLine(cmd1);
-            assertEquals("Command index out of range", errContent.toString().trim());
+            zkMain.executeLine(cmd);
+            return errContent.toString().trim();
         } finally {
             // revert redirect of out/err streams - important step!
             System.setErr(systemErr);
@@ -685,4 +690,14 @@ public void testSyncCommand() throws Exception {
         runCommandExpect(cmd, expected);
     }
 
+    @Test
+    public void testInsufficientPermission() throws Exception {
+        final ZooKeeper zk = createClient();
+        zk.create("/permZNode", "".getBytes(), Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
+        ZooKeeperMain zkMain = new ZooKeeperMain(zk);
+        String zNodeToBeCreated = "/permZNode/child1";
+        String errorMessage = executeLine(zkMain, "create " + zNodeToBeCreated);
+        assertEquals("Insufficient permission : " + zNodeToBeCreated, errorMessage);
+    }
+
 }

From c9f15213663fc9b86809adcbc27a4dbe1232c31a Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Wed, 29 Jul 2020 12:31:40 +0200
Subject: [PATCH 062/591] ZOOKEEPER-3876: zkServer.sh status command fails when
 IPV6 is configured

Modified host and IP parsing logic for IPV6

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1395 from arshadmohammad/ZOOKEEPER-3876
---
 bin/zkServer.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index f5113a9a3a0..a4aa9f38645 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -259,7 +259,12 @@ status)
           echo "Client port not found in the server configs"
         else
           if [[ "$clientPortAndAddress" =~ ^.*:[0-9]+ ]] ; then
-            clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's/:.*//'`
+            if [[ "$clientPortAndAddress" =~ \[.*\]:[0-9]+ ]] ; then
+              # Extracts address from address:port for example extracts 127::1 from "[127::1]:2181"
+              clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's|\[||' | sed -e 's|\]:.*||'`
+            else
+              clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's/:.*//'`
+            fi
           fi
           clientPort=`echo "$clientPortAndAddress" | sed -e 's/.*://'`
         fi

From ce523e01938e26ad92d613bd28b59501e9a853df Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 29 Jul 2020 16:55:45 +0000
Subject: [PATCH 063/591] ZOOKEEPER-3895: Client side NullPointerException in
 case of empty Multi operation

https://issues.apache.org/jira/browse/ZOOKEEPER-3895

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: tison <wander4096@gmail.com>, Mate Szalay-Beko <symat@apache.org>

Closes #1407 from eolivelli/fix/ZOOKEEPER-3895
---
 .../main/java/org/apache/zookeeper/ClientCnxn.java  | 13 +++++++++++++
 .../main/java/org/apache/zookeeper/ZooKeeper.java   | 10 ++++++++++
 .../apache/zookeeper/test/MultiOperationTest.java   |  9 +++++++++
 3 files changed, 32 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 87094b8b1b9..4dc6fdeaf2e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -30,6 +30,7 @@
 import java.nio.ByteBuffer;
 import java.util.ArrayDeque;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
@@ -469,6 +470,16 @@ private static String makeThreadName(String suffix) {
         return name + suffix;
     }
 
+    /**
+     * Tests that current thread is the main event loop.
+     * This method is useful only for tests inside ZooKeeper project
+     * it is not a public API intended for use by external applications.
+     * @return true if Thread.currentThread() is an EventThread.
+     */
+    public static boolean isInEventThread() {
+        return Thread.currentThread() instanceof EventThread;
+    }
+
     class EventThread extends ZooKeeperThread {
 
         private final LinkedBlockingQueue<Object> waitingEvents = new LinkedBlockingQueue<Object>();
@@ -589,6 +600,8 @@ private void processEvent(Object event) {
                         ((AsyncCallback.EphemeralsCallback) lcb.cb).processResult(lcb.rc, lcb.ctx, null);
                     } else if (lcb.cb instanceof AsyncCallback.AllChildrenNumberCallback) {
                         ((AsyncCallback.AllChildrenNumberCallback) lcb.cb).processResult(lcb.rc, lcb.path, lcb.ctx, -1);
+                    } else if (lcb.cb instanceof AsyncCallback.MultiCallback) {
+                        ((AsyncCallback.MultiCallback) lcb.cb).processResult(lcb.rc, lcb.path, lcb.ctx, Collections.emptyList());
                     } else {
                         ((VoidCallback) lcb.cb).processResult(lcb.rc, lcb.path, lcb.ctx);
                     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 201cf20f203..6b723af0ac0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -24,6 +24,7 @@
 import java.net.SocketAddress;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -1711,6 +1712,11 @@ protected void multiInternal(
         MultiOperationRecord request,
         MultiCallback cb,
         Object ctx) throws IllegalArgumentException {
+        if (request.size() == 0) {
+            // nothing to do, early exit
+            cnxn.queueCallback(cb, KeeperException.Code.OK.intValue(), null, ctx);
+            return;
+        }
         RequestHeader h = new RequestHeader();
         switch (request.getOpKind()) {
         case TRANSACTION:
@@ -1729,6 +1735,10 @@ protected void multiInternal(
     protected List<OpResult> multiInternal(
         MultiOperationRecord request) throws InterruptedException, KeeperException, IllegalArgumentException {
         RequestHeader h = new RequestHeader();
+        if (request.size() == 0) {
+            // nothing to do, early exit
+            return Collections.emptyList();
+        }
         switch (request.getOpKind()) {
         case TRANSACTION:
             h.setType(ZooDefs.OpCode.multi);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index 6e23bd62572..5dfd73e22ab 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -39,6 +39,7 @@
 import java.util.stream.Collectors;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.AsyncCallback.MultiCallback;
+import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Op;
@@ -107,6 +108,9 @@ private List<OpResult> multi(ZooKeeper zk, Iterable<Op> ops) throws KeeperExcept
             zk.multi(ops, new MultiCallback() {
                 @Override
                 public void processResult(int rc, String path, Object ctx, List<OpResult> opResults) {
+                    if (!ClientCnxn.isInEventThread()) {
+                        throw new RuntimeException("not in event thread");
+                    }
                     synchronized (res) {
                         res.rc = rc;
                         res.results = opResults;
@@ -442,6 +446,11 @@ public void testCreate() throws Exception {
         zk.getData("/multi2", false, null);
     }
 
+    @Test
+    public void testEmpty() throws Exception {
+        multi(zk, Arrays.asList());
+    }
+
     @Test
     public void testCreateDelete() throws Exception {
 

From b776b2360ac282fc4eef1e86fcf185d7a6c3eae5 Mon Sep 17 00:00:00 2001
From: Tudor Bosman <tudor@rockset.com>
Date: Fri, 31 Jul 2020 13:42:18 +0000
Subject: [PATCH 064/591] ZOOKEEPER-3885: add locking for watchers hashtables

See the comments in the JIRA issue.

Author: Tudor Bosman <tudor@rockset.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Damien Diederen <dd@crosstwine.com>, Enrico Olivelli <eolivelli@apache.org>

Closes #1403 from tudor/htlocking1
---
 .../zookeeper-client-c/src/mt_adaptor.c       | 24 +++++++++++++++++--
 .../zookeeper-client-c/src/st_adaptor.c       | 10 ++++++++
 .../zookeeper-client-c/src/zk_adaptor.h       |  5 ++++
 .../zookeeper-client-c/src/zookeeper.c        | 12 ++++++++++
 4 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
index 73b64c391ff..7292843c326 100644
--- a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
@@ -256,12 +256,13 @@ int adaptor_init(zhandle_t *zh)
     pthread_mutex_init(&zh->to_process.lock,0);
     pthread_mutex_init(&adaptor_threads->zh_lock,0);
     pthread_mutex_init(&adaptor_threads->reconfig_lock,0);
-    // to_send must be recursive mutex    
+    pthread_mutex_init(&adaptor_threads->watchers_lock,0);
+    // to_send must be recursive mutex
     pthread_mutexattr_init(&recursive_mx_attr);
     pthread_mutexattr_settype(&recursive_mx_attr, PTHREAD_MUTEX_RECURSIVE);
     pthread_mutex_init(&zh->to_send.lock,&recursive_mx_attr);
     pthread_mutexattr_destroy(&recursive_mx_attr);
-    
+
     pthread_mutex_init(&zh->sent_requests.lock,0);
     pthread_cond_init(&zh->sent_requests.cond,0);
     pthread_mutex_init(&zh->completions_to_process.lock,0);
@@ -531,6 +532,25 @@ int unlock_reconfig(struct _zhandle *zh)
     }
 }
 
+int lock_watchers(struct _zhandle *zh)
+{
+    struct adaptor_threads *adaptor = zh->adaptor_priv;
+    if (adaptor) {
+        return pthread_mutex_lock(&adaptor->watchers_lock);
+    } else {
+        return 0;
+    }
+}
+int unlock_watchers(struct _zhandle *zh)
+{
+    struct adaptor_threads *adaptor = zh->adaptor_priv;
+    if (adaptor) {
+        return pthread_mutex_unlock(&adaptor->watchers_lock);
+    } else {
+        return 0;
+    }
+}
+
 int enter_critical(zhandle_t* zh)
 {
     struct adaptor_threads *adaptor = zh->adaptor_priv;
diff --git a/zookeeper-client/zookeeper-client-c/src/st_adaptor.c b/zookeeper-client/zookeeper-client-c/src/st_adaptor.c
index ddc2582db34..07540b76ac1 100644
--- a/zookeeper-client/zookeeper-client-c/src/st_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/st_adaptor.c
@@ -94,6 +94,16 @@ int unlock_reconfig(struct _zhandle *zh)
     return 0;
 }
 
+int lock_watchers(struct _zhandle *zh)
+{
+    return 0;
+}
+
+int unlock_watchers(struct _zhandle *zh)
+{
+    return 0;
+}
+
 int enter_critical(zhandle_t* zh)
 {
     return 0;
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h b/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
index 46a7e7ed6e3..77d70f3bb6d 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
+++ b/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
@@ -167,6 +167,7 @@ struct adaptor_threads {
      pthread_mutex_t lock;          // ... and a lock
      pthread_mutex_t zh_lock;       // critical section lock
      pthread_mutex_t reconfig_lock; // lock for reconfiguring cluster's ensemble
+     pthread_mutex_t watchers_lock; // lock for watcher operations
 #ifdef WIN32
      SOCKET self_pipe[2];
 #else
@@ -300,6 +301,10 @@ int zoo_unlock_auth(zhandle_t *zh);
 int lock_reconfig(struct _zhandle *zh);
 int unlock_reconfig(struct _zhandle *zh);
 
+// watchers hashtable lock
+int lock_watchers(struct _zhandle *zh);
+int unlock_watchers(struct _zhandle *zh);
+
 // critical section guards
 int enter_critical(zhandle_t* zh);
 int leave_critical(zhandle_t* zh);
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index d33b50c8127..84970553e0c 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -2099,9 +2099,11 @@ static int send_set_watches(zhandle_t *zh)
     int rc;
 
     req.relativeZxid = zh->last_zxid;
+    lock_watchers(zh);
     req.dataWatches.data = collect_keys(zh->active_node_watchers, (int*)&req.dataWatches.count);
     req.existWatches.data = collect_keys(zh->active_exist_watchers, (int*)&req.existWatches.count);
     req.childWatches.data = collect_keys(zh->active_child_watchers, (int*)&req.childWatches.count);
+    unlock_watchers(zh);
 
     // return if there are no pending watches
     if (!req.dataWatches.count && !req.existWatches.count &&
@@ -3055,7 +3057,9 @@ static int queue_session_event(zhandle_t *zh, int state)
     }
     /* We queued the buffer, so don't free it */
     close_buffer_oarchive(&oa, 0);
+    lock_watchers(zh);
     cptr->c.watcher_result = collectWatchers(zh, ZOO_SESSION_EVENT, "");
+    unlock_watchers(zh);
     queue_completion(&zh->completions_to_process, cptr, 0);
     if (process_async(zh->outstanding_sync)) {
         process_completions(zh);
@@ -3361,7 +3365,9 @@ int zookeeper_process(zhandle_t *zh, int events)
             /* We are doing a notification, so there is no pending request */
             c = create_completion_entry(zh, WATCHER_EVENT_XID,-1,0,0,0,0);
             c->buffer = bptr;
+            lock_watchers(zh);
             c->c.watcher_result = collectWatchers(zh, type, path);
+            unlock_watchers(zh);
 
             // We cannot free until now, otherwise path will become invalid
             deallocate_WatcherEvent(&evt);
@@ -3416,8 +3422,10 @@ int zookeeper_process(zhandle_t *zh, int events)
                 // Update last_zxid only when it is a request response
                 zh->last_zxid = hdr.zxid;
             }
+            lock_watchers(zh);
             activateWatcher(zh, cptr->watcher, rc);
             deactivateWatcher(zh, cptr->watcher_deregistration, rc);
+            unlock_watchers(zh);
 
             if (cptr->c.void_result != SYNCHRONOUS_MARKER) {
                 LOG_DEBUG(LOGCALLBACK(zh), "Queueing asynchronous response");
@@ -4708,19 +4716,23 @@ static int aremove_watches(
         goto done;
     }
 
+    lock_watchers(zh);
     if (!pathHasWatcher(zh, server_path, wtype, watcher, watcherCtx)) {
         rc = ZNOWATCHER;
+        unlock_watchers(zh);
         goto done;
     }
 
     if (local) {
         removeWatchers(zh, server_path, wtype, watcher, watcherCtx);
+        unlock_watchers(zh);
 #ifdef THREADED
         notify_sync_completion((struct sync_completion *)data);
 #endif
         rc = ZOK;
         goto done;
     }
+    unlock_watchers(zh);
 
     oa = create_buffer_oarchive();
     rc = serialize_RequestHeader(oa, "header", &h);

From c42c8c94085ed1d94a22158fbdfe2945118a82bc Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Tue, 4 Aug 2020 15:01:52 +0200
Subject: [PATCH 065/591] ZOOKEEPER-3872: Upgrade jUnit in ZooKeeper-server

Sub-task of ZOOKEEPER-3732, updating jUnit to 5.6.2 in zookeeper-server sub-component.

Change-Id: I1fc2a7f860eae0f1d285cb278f6eca7a3b947695

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1417 from tamaashu/ZOOKEEPER-3872
---
 pom.xml                                       |  18 +
 zookeeper-server/pom.xml                      |  20 +
 .../zookeeper/ClientCanonicalizeTest.java     |  10 +-
 .../ClientCnxnSocketFragilityTest.java        |  28 +-
 .../zookeeper/ClientCnxnSocketTest.java       |  14 +-
 .../apache/zookeeper/ClientReconnectTest.java |   4 +-
 .../zookeeper/ClientRequestTimeoutTest.java   |  17 +-
 .../zookeeper/CustomHostProviderTest.java     |   4 +-
 .../zookeeper/GetAllChildrenNumberTest.java   |  10 +-
 .../apache/zookeeper/GetEphemeralsTest.java   |  20 +-
 .../zookeeper/MultiOperationRecordTest.java   |   4 +-
 .../apache/zookeeper/MultiResponseTest.java   |   4 +-
 .../apache/zookeeper/PortAssignmentTest.java  |  68 +-
 .../zookeeper/RemoveWatchesCmdTest.java       |  74 ++-
 .../apache/zookeeper/RemoveWatchesTest.java   | 456 +++++++------
 .../org/apache/zookeeper/SaslAuthTest.java    |  22 +-
 .../apache/zookeeper/ServerConfigTest.java    |  29 +-
 .../org/apache/zookeeper/ZKParameterized.java |  62 --
 .../java/org/apache/zookeeper/ZKTestCase.java |  77 +--
 .../java/org/apache/zookeeper/ZKUtilTest.java |  12 +-
 .../org/apache/zookeeper/ZooKeeperTest.java   |  86 ++-
 .../zookeeper/audit/AuditEventTest.java       |   4 +-
 .../zookeeper/audit/Log4jAuditLoggerTest.java |  33 +-
 .../audit/StandaloneServerAuditTest.java      |  14 +-
 .../zookeeper/cli/CommandFactoryTest.java     |   4 +-
 .../zookeeper/client/ZKClientConfigTest.java  |  27 +-
 .../common/AtomicFileWritingIdiomTest.java    |  86 +--
 .../common/BaseX509ParameterizedTestCase.java |  48 +-
 .../common/FileChangeWatcherTest.java         |  18 +-
 ...FileKeyStoreLoaderBuilderProviderTest.java |  11 +-
 .../zookeeper/common/JKSFileLoaderTest.java   | 158 +++--
 .../common/KeyStoreFileTypeTest.java          |  31 +-
 .../apache/zookeeper/common/NetUtilsTest.java |  31 +-
 .../zookeeper/common/PEMFileLoaderTest.java   | 185 +++---
 .../common/PKCS12FileLoaderTest.java          | 223 ++++---
 .../apache/zookeeper/common/PathTrieTest.java |  43 +-
 .../zookeeper/common/PathUtilsTest.java       |  93 ++-
 .../org/apache/zookeeper/common/TimeTest.java |   4 +-
 .../apache/zookeeper/common/X509UtilTest.java | 619 ++++++++++++------
 .../apache/zookeeper/common/ZKConfigTest.java |  23 +-
 .../common/ZKHostnameVerifierTest.java        |  10 +-
 .../zookeeper/common/ZKTrustManagerTest.java  |  14 +-
 .../zookeeper/server/BlueThrottleTest.java    |  51 +-
 .../server/ByteBufferInputStreamTest.java     |  21 +-
 .../org/apache/zookeeper/server/CRCTest.java  |  10 +-
 .../server/ConnectionMetricsTest.java         |   4 +-
 .../zookeeper/server/CreateContainerTest.java |  90 +--
 .../zookeeper/server/CreateTTLTest.java       |  79 ++-
 .../apache/zookeeper/server/DataNodeTest.java |   8 +-
 .../apache/zookeeper/server/DataTreeTest.java |  91 +--
 .../server/DatadirCleanupManagerTest.java     |  30 +-
 .../server/DeserializationPerfTest.java       |   4 +-
 .../zookeeper/server/Emulate353TTLTest.java   |  22 +-
 .../zookeeper/server/EphemeralTypeTest.java   |  27 +-
 .../server/FinalRequestProcessorTest.java     |  14 +-
 .../server/FollowerRequestProcessorTest.java  |  15 +-
 .../server/InvalidSnapCountTest.java          |  11 +-
 .../zookeeper/server/InvalidSnapshotTest.java |   6 +-
 .../server/MultiOpSessionUpgradeTest.java     |  30 +-
 .../server/NIOServerCnxnFactoryTest.java      |  25 +-
 .../zookeeper/server/NIOServerCnxnTest.java   |  20 +-
 .../server/NettyServerCnxnFactoryTest.java    |  24 +-
 .../zookeeper/server/NettyServerCnxnTest.java |  49 +-
 .../zookeeper/server/NodeHashMapImplTest.java |  14 +-
 .../PrepRequestProcessorMetricsTest.java      |  14 +-
 .../server/PrepRequestProcessorTest.java      |  38 +-
 .../apache/zookeeper/server/PurgeTxnTest.java |  66 +-
 .../server/ReferenceCountedACLCacheTest.java  |   8 +-
 .../server/RequestThrottlerTest.java          |  25 +-
 .../server/SerializationPerfTest.java         |   2 +-
 .../apache/zookeeper/server/ServerIdTest.java |  70 +-
 .../zookeeper/server/ServerMetricsTest.java   |   4 +-
 .../zookeeper/server/ServerStatsTest.java     |   8 +-
 .../zookeeper/server/SessionTrackerTest.java  |  33 +-
 .../zookeeper/server/SnapshotDigestTest.java  |  14 +-
 .../apache/zookeeper/server/ToStringTest.java |   4 +-
 .../zookeeper/server/TxnLogDigestTest.java    |  31 +-
 .../ZooKeeperCriticalThreadMetricsTest.java   |   4 +-
 .../server/ZooKeeperServerBeanTest.java       |  16 +-
 .../server/ZooKeeperServerConfTest.java       |   8 +-
 .../server/ZooKeeperServerCreationTest.java   |   2 +-
 .../server/ZooKeeperServerMainTest.java       | 124 ++--
 .../server/ZooKeeperServerMaxCnxnsTest.java   |  23 +-
 .../server/ZooKeeperServerStartupTest.java    |  42 +-
 .../zookeeper/server/ZooKeeperServerTest.java |  12 +-
 .../zookeeper/server/ZooKeeperThreadTest.java |  12 +-
 .../zookeeper/server/ZxidRolloverTest.java    |  30 +-
 .../server/admin/CommandResponseTest.java     |   8 +-
 .../zookeeper/server/admin/CommandsTest.java  |  34 +-
 .../server/admin/JettyAdminServerTest.java    |  46 +-
 .../metric/AvgMinMaxCounterSetTest.java       |  54 +-
 .../AvgMinMaxPercentileCounterSetTest.java    |  88 +--
 .../AvgMinMaxPercentileCounterTest.java       |  48 +-
 .../server/persistence/EmptySnapshotTest.java |  10 +-
 .../server/persistence/FileTxnLogTest.java    |  60 +-
 .../FileTxnSnapLogMetricsTest.java            |   6 +-
 .../persistence/FileTxnSnapLogTest.java       |  97 +--
 .../server/persistence/SnapStreamTest.java    |  20 +-
 .../server/persistence/TxnLogToolkitTest.java |  43 +-
 .../server/quorum/BufferStatsTest.java        |   4 +-
 .../server/quorum/CloseSessionTxnTest.java    |   9 +-
 .../server/quorum/CnxManagerTest.java         |  24 +-
 .../CommitProcessorConcurrencyTest.java       | 156 ++---
 .../quorum/CommitProcessorMetricsTest.java    |  24 +-
 .../server/quorum/CommitProcessorTest.java    |  30 +-
 .../server/quorum/EagerACLFilterTest.java     | 150 +++--
 .../quorum/EphemeralNodeDeletionTest.java     |  55 +-
 .../server/quorum/EpochWriteFailureTest.java  |  28 +-
 .../quorum/FLEBackwardElectionRoundTest.java  |  12 +-
 .../server/quorum/FLELostMessageTest.java     |  12 +-
 .../FLEMalformedNotificationMessageTest.java  |  23 +-
 .../server/quorum/FLEOutOfElectionTest.java   |  14 +-
 .../zookeeper/server/quorum/FLETestUtils.java |   6 +-
 .../quorum/FuzzySnapshotRelatedTest.java      |  18 +-
 .../server/quorum/LeaderBeanTest.java         |  16 +-
 .../server/quorum/LeaderMetricsTest.java      |  14 +-
 .../server/quorum/LeaderWithObserverTest.java |  48 +-
 .../quorum/LearnerHandlerMetricsTest.java     |  10 +-
 .../server/quorum/LearnerHandlerTest.java     |  19 +-
 .../server/quorum/LearnerMetricsTest.java     |  44 +-
 .../quorum/LearnerSyncThrottlerTest.java      |  86 ++-
 .../zookeeper/server/quorum/LearnerTest.java  |  39 +-
 .../server/quorum/LocalPeerBeanTest.java      |  10 +-
 .../server/quorum/MultipleAddressesTest.java  |  68 +-
 .../server/quorum/QuorumBeanTest.java         |   2 +-
 ...CnxManagerSocketConnectionTimeoutTest.java |  17 +-
 .../server/quorum/QuorumDigestTest.java       |  37 +-
 .../server/quorum/QuorumPeerConfigTest.java   |  25 +-
 .../QuorumPeerMainMultiAddressTest.java       |  14 +-
 .../server/quorum/QuorumPeerMainTest.java     | 284 ++++----
 .../server/quorum/QuorumPeerTest.java         |   8 +-
 .../server/quorum/QuorumPeerTestBase.java     |   4 +-
 .../quorum/QuorumRequestPipelineTest.java     | 116 ++--
 .../server/quorum/QuorumSSLTest.java          |  37 +-
 .../server/quorum/QuorumServerTest.java       |  73 ++-
 .../server/quorum/RaceConditionTest.java      |  34 +-
 .../server/quorum/ReconfigBackupTest.java     |  38 +-
 .../quorum/ReconfigDuringLeaderSyncTest.java  |  59 +-
 .../quorum/ReconfigFailureCasesTest.java      |  19 +-
 .../server/quorum/ReconfigLegacyTest.java     |  40 +-
 .../server/quorum/ReconfigRecoveryTest.java   |  73 +--
 ...configRollingRestartCompatibilityTest.java |  67 +-
 .../server/quorum/RemotePeerBeanTest.java     |  10 +-
 .../quorum/SessionUpgradeQuorumTest.java      |  33 +-
 .../server/quorum/StandaloneDisabledTest.java |  38 +-
 .../server/quorum/StatCommandTest.java        |   8 +-
 .../server/quorum/StatResetCommandTest.java   |   8 +-
 .../SyncRequestProcessorMetricTest.java       |  10 +-
 .../UnifiedServerSocketModeDetectionTest.java | 235 ++++---
 .../quorum/UnifiedServerSocketTest.java       | 127 ++--
 .../server/quorum/WatchLeakTest.java          |  37 +-
 .../zookeeper/server/quorum/Zab1_0Test.java   |  24 +-
 .../quorum/auth/KerberosSecurityTestcase.java |  12 +-
 .../server/quorum/auth/MiniKdcTest.java       |  19 +-
 .../quorum/auth/QuorumAuthTestBase.java       |  10 +-
 .../quorum/auth/QuorumAuthUpgradeTest.java    |  50 +-
 .../quorum/auth/QuorumDigestAuthTest.java     |  35 +-
 .../quorum/auth/QuorumKerberosAuthTest.java   |  21 +-
 .../auth/QuorumKerberosHostBasedAuthTest.java |  26 +-
 .../zookeeper/server/util/AdHashTest.java     |  14 +-
 .../zookeeper/server/util/AuthUtilTest.java   |  14 +-
 .../zookeeper/server/util/BitHashSetTest.java |  10 +-
 .../zookeeper/server/util/BitMapTest.java     |  10 +-
 .../server/util/CircularBufferTest.java       | 172 ++---
 .../server/util/ConfigUtilsTest.java          |  21 +-
 .../server/util/JvmPauseMonitorTest.java      |  16 +-
 .../server/util/MessageTrackerTest.java       |  45 +-
 .../util/RequestPathMetricsCollectorTest.java |  18 +-
 .../server/util/SerializeUtilsTest.java       |   8 +-
 .../server/util/VerifyingFileFactoryTest.java |  17 +-
 .../server/watch/PathParentIteratorTest.java  |  68 +-
 .../server/watch/RecursiveWatchQtyTest.java   |  10 +-
 .../server/watch/WatchManagerTest.java        |  67 +-
 .../server/watch/WatcherCleanerTest.java      |  14 +-
 .../server/watch/WatcherOrBitSetTest.java     |   8 +-
 .../server/watch/WatchesPathReportTest.java   |  14 +-
 .../server/watch/WatchesReportTest.java       |  14 +-
 .../server/watch/WatchesSummaryTest.java      |   8 +-
 .../apache/zookeeper/test/ACLCountTest.java   |   8 +-
 .../apache/zookeeper/test/ACLRootTest.java    |   4 +-
 .../org/apache/zookeeper/test/ACLTest.java    |  46 +-
 .../zookeeper/test/AsyncHammerTest.java       |   8 +-
 .../org/apache/zookeeper/test/AsyncOps.java   |  12 +-
 .../apache/zookeeper/test/AsyncOpsTest.java   |  10 +-
 .../org/apache/zookeeper/test/AsyncTest.java  |  14 +-
 .../test/AtomicFileOutputStreamTest.java      |  24 +-
 .../org/apache/zookeeper/test/AuthTest.java   |   4 +-
 .../apache/zookeeper/test/BufferSizeTest.java |  12 +-
 .../zookeeper/test/ChrootAsyncTest.java       |   2 +
 .../zookeeper/test/ChrootClientTest.java      |   4 +-
 .../org/apache/zookeeper/test/ChrootTest.java |  12 +-
 .../org/apache/zookeeper/test/ClientBase.java |  30 +-
 .../zookeeper/test/ClientHammerTest.java      |   4 +-
 .../zookeeper/test/ClientPortBindTest.java    |   8 +-
 .../zookeeper/test/ClientRetryTest.java       |   6 +-
 .../apache/zookeeper/test/ClientSSLTest.java  |  17 +-
 .../zookeeper/test/ClientSkipACLTest.java     |   8 +-
 .../org/apache/zookeeper/test/ClientTest.java |  30 +-
 .../test/ConnectStringParserTest.java         |  25 +-
 .../apache/zookeeper/test/CreateModeTest.java |  10 +-
 .../org/apache/zookeeper/test/CreateTest.java |  22 +-
 .../test/DisconnectedWatcherTest.java         |  22 +-
 .../DuplicateLocalSessionUpgradeTest.java     |  18 +-
 .../test/EmptiedSnapshotRecoveryTest.java     |  18 +-
 .../zookeeper/test/EnsembleAuthTest.java      |  31 +-
 .../apache/zookeeper/test/EventTypeTest.java  |   6 +-
 .../zookeeper/test/FLENewEpochTest.java       |  12 +-
 .../zookeeper/test/FLEPredicateTest.java      |   8 +-
 .../apache/zookeeper/test/FLERestartTest.java |  12 +-
 .../org/apache/zookeeper/test/FLETest.java    |  28 +-
 .../zookeeper/test/FLEZeroWeightTest.java     |  12 +-
 .../test/FollowerResyncConcurrencyTest.java   |  86 ++-
 .../test/FourLetterWordsQuorumTest.java       |   4 +-
 .../zookeeper/test/FourLetterWordsTest.java   |  23 +-
 .../test/FourLetterWordsWhiteListTest.java    |  31 +-
 .../zookeeper/test/GetChildren2Test.java      |   8 +-
 .../test/GetProposalFromTxnTest.java          |  16 +-
 .../test/HierarchicalQuorumTest.java          |  14 +-
 .../zookeeper/test/InvalidSnapshotTest.java   |   8 +-
 .../org/apache/zookeeper/test/JMXEnv.java     |   8 +-
 .../zookeeper/test/KeeperStateTest.java       |   8 +-
 .../zookeeper/test/KeyAuthClientTest.java     |   4 +-
 .../test/LeaderSessionTrackerTest.java        |  18 +-
 .../test/LoadFromLogNoServerTest.java         |  22 +-
 .../zookeeper/test/LoadFromLogTest.java       |  41 +-
 .../test/LocalSessionRequestTest.java         |  23 +-
 .../zookeeper/test/LocalSessionsOnlyTest.java |  24 +-
 .../apache/zookeeper/test/LogChopperTest.java |   8 +-
 .../apache/zookeeper/test/MaxCnxnsTest.java   |   6 +-
 .../test/MultiAsyncTransactionTest.java       |  10 +-
 .../zookeeper/test/MultiOperationTest.java    | 354 +++++-----
 .../test/NIOConnectionFactoryFdLeakTest.java  |   6 +-
 .../zookeeper/test/NettyNettySuiteBase.java   |  16 +-
 .../zookeeper/test/NettyNettySuiteTest.java   |   7 +-
 .../zookeeper/test/NioNettySuiteBase.java     |  16 +-
 .../test/NonRecoverableErrorTest.java         |  32 +-
 .../apache/zookeeper/test/NullDataTest.java   |   8 +-
 .../org/apache/zookeeper/test/OOMTest.java    |  15 +-
 .../apache/zookeeper/test/OSMXBeanTest.java   |  16 +-
 .../test/ObserverHierarchicalQuorumTest.java  |   2 +-
 .../apache/zookeeper/test/ObserverLETest.java |  26 +-
 .../zookeeper/test/ObserverMasterTest.java    | 145 ++--
 .../test/ObserverMasterTestBase.java          |  27 +-
 .../test/ObserverQuorumHammerTest.java        |   6 +-
 .../apache/zookeeper/test/ObserverTest.java   |   4 +-
 .../test/PersistentRecursiveWatcherTest.java  |  18 +-
 .../zookeeper/test/PersistentWatcherTest.java |  20 +-
 .../org/apache/zookeeper/test/QuorumBase.java |  20 +-
 .../zookeeper/test/QuorumHammerTest.java      |  10 +-
 .../zookeeper/test/QuorumMajorityTest.java    |   8 +-
 .../zookeeper/test/QuorumQuotaTest.java       |  12 +-
 .../zookeeper/test/QuorumRestartTest.java     |  24 +-
 .../org/apache/zookeeper/test/QuorumTest.java |  24 +-
 .../org/apache/zookeeper/test/QuorumUtil.java |  24 +-
 .../apache/zookeeper/test/QuorumUtilTest.java |   8 +-
 .../zookeeper/test/QuorumZxidSyncTest.java    |  20 +-
 .../zookeeper/test/ReadOnlyModeTest.java      |  68 +-
 .../zookeeper/test/ReconfigExceptionTest.java |  33 +-
 .../zookeeper/test/ReconfigMisconfigTest.java |  18 +-
 .../apache/zookeeper/test/ReconfigTest.java   |  93 ++-
 .../apache/zookeeper/test/RecoveryTest.java   |  24 +-
 .../zookeeper/test/RepeatStartupTest.java     |  12 +-
 .../zookeeper/test/ResponseCacheTest.java     |  18 +-
 .../test/RestoreCommittedLogTest.java         |  14 +-
 .../apache/zookeeper/test/SSLAuthTest.java    |  16 +-
 .../test/SaslAuthDesignatedClientTest.java    |  14 +-
 .../test/SaslAuthDesignatedServerTest.java    |   6 +-
 .../SaslAuthFailDesignatedClientTest.java     |   4 +-
 .../zookeeper/test/SaslAuthFailTest.java      |   4 +-
 .../test/SaslAuthMissingClientConfigTest.java |   4 +-
 .../test/SaslAuthRequiredFailNoSASLTest.java  |  14 +-
 .../SaslAuthRequiredFailWrongSASLTest.java    |  14 +-
 .../zookeeper/test/SaslAuthRequiredTest.java  |  12 +-
 .../apache/zookeeper/test/SaslClientTest.java |  20 +-
 .../test/SaslDigestAuthOverSSLTest.java       |  12 +-
 .../test/SaslKerberosAuthOverSSLTest.java     |  20 +-
 .../zookeeper/test/SaslSuperUserTest.java     |  12 +-
 .../apache/zookeeper/test/SaslTestUtil.java   |  27 +-
 .../apache/zookeeper/test/ServerCnxnTest.java |  16 +-
 .../test/SessionInvalidationTest.java         |   4 +-
 .../apache/zookeeper/test/SessionTest.java    |  22 +-
 .../zookeeper/test/SessionTimeoutTest.java    |  26 +-
 .../test/SessionTrackerCheckTest.java         |  12 +-
 .../zookeeper/test/SessionUpgradeTest.java    |  22 +-
 .../apache/zookeeper/test/StandaloneTest.java |  23 +-
 .../org/apache/zookeeper/test/StatTest.java   |  10 +-
 .../test/StaticHostProviderTest.java          |  43 +-
 .../apache/zookeeper/test/StringUtilTest.java |   4 +-
 .../apache/zookeeper/test/SyncCallTest.java   |   6 +-
 .../org/apache/zookeeper/test/TestUtils.java  |   2 +-
 .../zookeeper/test/ThrottledOpHelper.java     |  53 +-
 .../test/ThrottledOpObserverTest.java         |  13 +-
 .../zookeeper/test/ThrottledOpQuorumTest.java |   6 +-
 .../test/ThrottledOpStandaloneTest.java       |   6 +-
 .../apache/zookeeper/test/TruncateTest.java   |  20 +-
 .../test/UnsupportedAddWatcherTest.java       |  26 +-
 .../test/WatchEventWhenAutoResetTest.java     |  18 +-
 .../zookeeper/test/WatchedEventTest.java      |   6 +-
 .../zookeeper/test/WatcherFuncTest.java       |  18 +-
 .../apache/zookeeper/test/WatcherTest.java    |  30 +-
 .../apache/zookeeper/test/X509AuthTest.java   |   8 +-
 .../test/ZkDatabaseCorruptionTest.java        |  20 +-
 .../zookeeper/test/ZooKeeperQuotaTest.java    |  19 +-
 .../zookeeper/test/ZooKeeperTestClient.java   |   6 +-
 .../apache/zookeeper/util/PemReaderTest.java  | 135 ++--
 .../util/TestCircularBlockingQueue.java       |  22 +-
 306 files changed, 5410 insertions(+), 4946 deletions(-)
 delete mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java

diff --git a/pom.xml b/pom.xml
index 722efb82b9a..6edfe40b356 100755
--- a/pom.xml
+++ b/pom.xml
@@ -430,6 +430,7 @@
     <audience-annotations.version>0.5.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
+    <junit-platform.version>1.6.2</junit-platform.version>
     <log4j.version>1.2.17</log4j.version>
     <mockito.version>2.27.0</mockito.version>
     <hamcrest.version>1.3</hamcrest.version>
@@ -554,11 +555,28 @@
         <artifactId>jmockit</artifactId>
         <version>${jmockit.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.junit.jupiter</groupId>
+        <artifactId>junit-jupiter-api</artifactId>
+        <version>${junit.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter-engine</artifactId>
         <version>${junit.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.junit.jupiter</groupId>
+        <artifactId>junit-jupiter-params</artifactId>
+        <version>${junit.version}</version>
+        <scope>test</scope>
+      </dependency>
+      <dependency>
+        <groupId>org.junit.platform</groupId>
+        <artifactId>junit-platform-runner</artifactId>
+        <version>${junit-platform.version}</version>
+        <scope>test</scope>
+      </dependency>
       <dependency>
         <groupId>org.junit.vintage</groupId>
         <artifactId>junit-vintage-engine</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index fade079d34c..7440ddeb99c 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -156,6 +156,26 @@
       <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-params</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.platform</groupId>
+      <artifactId>junit-platform-runner</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.xerial.snappy</groupId>
       <artifactId>snappy-java</artifactId>
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
index 796cb6b998c..cca6647b1cb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ClientCanonicalizeTest extends ZKTestCase {
 
@@ -40,7 +40,7 @@ public void testClientCanonicalization() throws IOException, InterruptedExceptio
 
         ZKClientConfig conf = new ZKClientConfig();
         String principal = SaslServerPrincipal.getServerPrincipal(addr, conf);
-        assertEquals("The computed principal does not appear to have been canonicalized", "zookeeper/zk1.apache.org", principal);
+        assertEquals("zookeeper/zk1.apache.org", principal, "The computed principal does not appear to have been canonicalized");
     }
 
     @Test
@@ -56,7 +56,7 @@ public void testClientNoCanonicalization() throws IOException, InterruptedExcept
         ZKClientConfig conf = new ZKClientConfig();
         conf.setProperty(ZKClientConfig.ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME, "false");
         String principal = SaslServerPrincipal.getServerPrincipal(addr, conf);
-        assertEquals("The computed principal does appears to have been canonicalized incorrectly", "zookeeper/zookeeper.apache.org", principal);
+        assertEquals("zookeeper/zookeeper.apache.org", principal, "The computed principal does appears to have been canonicalized incorrectly");
     }
 
     @Test
@@ -71,7 +71,7 @@ public void testClientCanonicalizationToIp() throws IOException, InterruptedExce
 
         ZKClientConfig conf = new ZKClientConfig();
         String principal = SaslServerPrincipal.getServerPrincipal(addr, conf);
-        assertEquals("The computed principal does appear to have falled back to the original host name", "zookeeper/zookeeper.apache.org", principal);
+        assertEquals("zookeeper/zookeeper.apache.org", principal, "The computed principal does appear to have falled back to the original host name");
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 5ed43fca72e..b5bb0cd9446 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.util.Queue;
@@ -32,8 +35,7 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ClientCnxnSocketFragilityTest extends QuorumPeerTestBase {
 
@@ -98,8 +100,8 @@ public void testClientCnxnSocketFragility() throws Exception {
 
         // Ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
         String path = "/testClientCnxnSocketFragility";
         String data = "balabala";
@@ -109,8 +111,8 @@ public void testClientCnxnSocketFragility() throws Exception {
 
         // Let's see some successful operations
         zk.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        Assert.assertEquals(new String(zk.getData(path, false, new Stat())), data);
-        Assert.assertTrue(!watcher.isSessionExpired());
+        assertEquals(new String(zk.getData(path, false, new Stat())), data);
+        assertTrue(!watcher.isSessionExpired());
 
         // Let's make a broken operation
         socket.mute();
@@ -119,11 +121,11 @@ public void testClientCnxnSocketFragility() throws Exception {
             zk.getData(path, false, new Stat());
         } catch (KeeperException e) {
             catchKeeperException = true;
-            Assert.assertFalse(e instanceof KeeperException.SessionExpiredException);
+            assertFalse(e instanceof KeeperException.SessionExpiredException);
         }
         socket.unmute();
-        Assert.assertTrue(catchKeeperException);
-        Assert.assertTrue(!watcher.isSessionExpired());
+        assertTrue(catchKeeperException);
+        assertTrue(!watcher.isSessionExpired());
 
         GetDataRetryForeverBackgroundTask retryForeverGetData =
                 new GetDataRetryForeverBackgroundTask(zk, path);
@@ -143,8 +145,8 @@ public void testClientCnxnSocketFragility() throws Exception {
         TimeUnit.MILLISECONDS.sleep(3000);
 
         // Since we already close zookeeper, we expect that the zk should not be alive.
-        Assert.assertTrue(!zk.isAlive());
-        Assert.assertTrue(!watcher.isSessionExpired());
+        assertTrue(!zk.isAlive());
+        assertTrue(!watcher.isSessionExpired());
 
         retryForeverGetData.syncCloseTask();
         for (int i = 0; i < SERVER_COUNT; i++) {
@@ -324,7 +326,7 @@ protected void onConnecting(InetSocketAddress addr) {
 
         @Override
         public void disconnect() {
-            Assert.assertTrue(closing);
+            assertTrue(closing);
             LOG.info("Attempt to disconnecting client for session: 0x{} {} {}", Long.toHexString(getSessionId()), closing, state);
             sendThread.close();
             ///////// Unsafe Region ////////
@@ -361,7 +363,7 @@ ClientCnxn createConnection(
             ClientCnxnSocket clientCnxnSocket,
             boolean canBeReadOnly
         ) throws IOException {
-            Assert.assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
+            assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
             socket = (FragileClientCnxnSocketNIO) clientCnxnSocket;
             ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(
                 chrootPath,
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
index 310d34fce5c..a24b13fdffb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
@@ -18,24 +18,24 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.test.TestByteBufAllocator;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ClientCnxnSocketTest {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         ClientCnxnSocketNetty.setTestAllocator(TestByteBufAllocator.getInstance());
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         ClientCnxnSocketNetty.clearTestAllocator();
         TestByteBufAllocator.checkForLeaks();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
index 41f52ea697d..6d1db27a276 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -29,7 +29,7 @@
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ClientReconnectTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index d4f95aeb50d..ecf39273e65 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.HostProvider;
@@ -29,7 +29,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ClientRequestTimeoutTest extends QuorumPeerTestBase {
 
@@ -37,7 +38,8 @@ public class ClientRequestTimeoutTest extends QuorumPeerTestBase {
     private boolean dropPacket = false;
     private int dropPacketType = ZooDefs.OpCode.create;
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testClientRequestTimeout() throws Exception {
         int requestTimeOut = 15000;
         System.setProperty("zookeeper.request.timeout", Integer.toString(requestTimeOut));
@@ -61,9 +63,8 @@ public void testClientRequestTimeout() throws Exception {
 
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watch1 = new CountdownWatcher();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java
index 29ce9ef0c24..9a78b3428e5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.util.Collection;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CustomHostProviderTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
index db692520d21..f84ded0b5e8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
@@ -18,14 +18,16 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class GetAllChildrenNumberTest extends ClientBase {
 
@@ -36,6 +38,7 @@ public class GetAllChildrenNumberTest extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -44,6 +47,7 @@ public void setUp() throws Exception {
         generatePaths(PERSISTENT_CNT, EPHEMERAL_CNT);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
index efc66ffd850..7dcd9e815c1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -28,7 +28,9 @@
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class GetEphemeralsTest extends ClientBase {
 
@@ -39,6 +41,7 @@ public class GetEphemeralsTest extends ClientBase {
     private String[] expected;
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -47,6 +50,7 @@ public void setUp() throws Exception {
         expected = generatePaths(PERSISTENT_CNT, EPHEMERAL_CNT);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -57,10 +61,10 @@ public void tearDown() throws Exception {
     @Test
     public void testGetEphemeralsSync() throws KeeperException, InterruptedException {
         List<String> actual = zk.getEphemerals();
-        assertEquals("Expected ephemeral count for allPaths", actual.size(), expected.length);
+        assertEquals(actual.size(), expected.length, "Expected ephemeral count for allPaths");
         for (int i = 0; i < expected.length; i++) {
             String path = expected[i];
-            assertTrue(String.format("Path=%s exists in get All Ephemerals list ", path), actual.contains(path));
+            assertTrue(actual.contains(path), String.format("Path=%s exists in get All Ephemerals list ", path));
         }
     }
 
@@ -68,10 +72,10 @@ public void testGetEphemeralsSync() throws KeeperException, InterruptedException
     public void testGetEphemeralsSyncByPath() throws KeeperException, InterruptedException {
         final String prefixPath = BASE + 0;
         List<String> actual = zk.getEphemerals(prefixPath);
-        assertEquals("Expected ephemeral count for allPaths", actual.size(), EPHEMERAL_CNT);
+        assertEquals(actual.size(), EPHEMERAL_CNT, "Expected ephemeral count for allPaths");
         for (int i = 0; i < EPHEMERAL_CNT; i++) {
             String path = expected[i];
-            assertTrue(String.format("Path=%s exists in getEphemerals(%s) list ", path, prefixPath), actual.contains(path));
+            assertTrue(actual.contains(path), String.format("Path=%s exists in getEphemerals(%s) list ", path, prefixPath));
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
index 75da5df3160..54bf12f4e9c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.server.ByteBufferInputStream;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class MultiOperationRecordTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java
index 7993d04c338..cab1d5d1ec7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -25,7 +25,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ByteBufferInputStream;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class MultiResponseTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java
index 234adb1b715..20b9362beb2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java
@@ -18,56 +18,40 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import java.util.Arrays;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.util.stream.Stream;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class PortAssignmentTest {
 
-    private final String strProcessCount;
-    private final String cmdLine;
-    private final int expectedMinimumPort;
-    private final int expectedMaximumPort;
-
-    @Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(
-            new Object[]{"8", "threadid=1", 11221, 13913},
-            new Object[]{"8", "threadid=2", 13914, 16606},
-            new Object[]{"8", "threadid=3", 16607, 19299},
-            new Object[]{"8", "threadid=4", 19300, 21992},
-            new Object[]{"8", "threadid=5", 21993, 24685},
-            new Object[]{"8", "threadid=6", 24686, 27378},
-            new Object[]{"8", "threadid=7", 27379, 30071},
-            new Object[]{"8", "threadid=8", 30072, 32764},
-            new Object[]{"1", "threadid=1", 11221, 32767},
-            new Object[]{"2", "threadid=1", 11221, 21993},
-            new Object[]{"2", "threadid=2", 21994, 32766},
-            new Object[]{null, null, 11221, 32767},
-            new Object[]{"", "", 11221, 32767});
-    }
-
-    public PortAssignmentTest(String strProcessCount, String cmdLine, int expectedMinimumPort, int expectedMaximumPort) {
-        this.strProcessCount = strProcessCount;
-        this.cmdLine = cmdLine;
-        this.expectedMinimumPort = expectedMinimumPort;
-        this.expectedMaximumPort = expectedMaximumPort;
+    public static Stream<Arguments> data() throws Exception {
+        return Stream.of(
+                Arguments.of("8", "threadid=1", 11221, 13913),
+                Arguments.of("8", "threadid=2", 13914, 16606),
+                Arguments.of("8", "threadid=3", 16607, 19299),
+                Arguments.of("8", "threadid=4", 19300, 21992),
+                Arguments.of("8", "threadid=5", 21993, 24685),
+                Arguments.of("8", "threadid=6", 24686, 27378),
+                Arguments.of("8", "threadid=7", 27379, 30071),
+                Arguments.of("8", "threadid=8", 30072, 32764),
+                Arguments.of("1", "threadid=1", 11221, 32767),
+                Arguments.of("2", "threadid=1", 11221, 21993),
+                Arguments.of("2", "threadid=2", 21994, 32766),
+                Arguments.of(null, null, 11221, 32767),
+                Arguments.of("", "", 11221, 32767));
     }
 
-    @Test
-    public void testSetupPortRange() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetupPortRange(String strProcessCount, String cmdLine, int expectedMinimumPort, int expectedMaximumPort) {
         PortAssignment.PortRange portRange = PortAssignment.setupPortRange(strProcessCount, cmdLine);
-        assertEquals(buildAssertionMessage("minimum"), expectedMinimumPort, portRange.getMinimum());
-        assertEquals(buildAssertionMessage("maximum"), expectedMaximumPort, portRange.getMaximum());
+        assertEquals(expectedMinimumPort, portRange.getMinimum(), buildAssertionMessage("minimum", strProcessCount, cmdLine));
+        assertEquals(expectedMaximumPort, portRange.getMaximum(), buildAssertionMessage("maximum", strProcessCount, cmdLine));
     }
 
-    private String buildAssertionMessage(String checkType) {
+    private String buildAssertionMessage(String checkType, String strProcessCount, String cmdLine) {
         return String.format("strProcessCount = %s, cmdLine = %s, checking %s", strProcessCount, cmdLine, checkType);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java
index c92f72a27bc..5f859d2823e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -29,7 +29,10 @@
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,6 +45,7 @@ public class RemoveWatchesCmdTest extends ClientBase {
     private ZooKeeper zk;
     private ZooKeeperMain zkMain;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -49,6 +53,7 @@ public void setUp() throws Exception {
         zkMain = new ZooKeeperMain(zk);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         if (zk != null) {
@@ -62,7 +67,8 @@ public void tearDown() throws Exception {
      * removewatches command will use default options - WatcherType.ANY and
      * local=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveWatchesWithNoPassedOptions() throws Exception {
         List<EventType> expectedEvents = new ArrayList<>();
         expectedEvents.add(EventType.ChildWatchRemoved);
@@ -83,19 +89,20 @@ public void testRemoveWatchesWithNoPassedOptions() throws Exception {
         String cmdstring = "removewatches /testnode1";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child watches");
         LOG.info("Waiting for the DataWatchRemoved event");
         myWatcher.matches();
 
         // verifying that other path child watches are not affected
-        assertTrue("Failed to find child watches for the path testnode2", zk.getChildWatches().contains("/testnode2"));
-        assertTrue("Failed to find data watches for the path testnode2", zk.getDataWatches().contains("/testnode2"));
+        assertTrue(zk.getChildWatches().contains("/testnode2"), "Failed to find child watches for the path testnode2");
+        assertTrue(zk.getDataWatches().contains("/testnode2"), "Failed to find data watches for the path testnode2");
     }
 
     /**
      * Test verifies deletion of NodeDataChanged watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeDataChangedWatches() throws Exception {
         LOG.info("Adding data watcher using getData()");
         List<EventType> expectedEvents = new ArrayList<>();
@@ -108,19 +115,20 @@ public void testRemoveNodeDataChangedWatches() throws Exception {
         String cmdstring = "removewatches /testnode1 -d";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove data watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove data watches");
 
         LOG.info("Waiting for the DataWatchRemoved event");
         myWatcher.matches();
 
         // verifying that other path data watches are removed
-        assertEquals("Data watches are not removed : " + zk.getDataWatches(), 0, zk.getDataWatches().size());
+        assertEquals(0, zk.getDataWatches().size(), "Data watches are not removed : " + zk.getDataWatches());
     }
 
     /**
      * Test verifies deletion of NodeCreated data watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeCreatedWatches() throws Exception {
         List<EventType> expectedEvents = new ArrayList<>();
         expectedEvents.add(EventType.DataWatchRemoved);
@@ -134,27 +142,25 @@ public void testRemoveNodeCreatedWatches() throws Exception {
         String cmdstring1 = "removewatches /testnode1 -d";
         LOG.info("Remove watchers using shell command : {}", cmdstring1);
         zkMain.cl.parseCommand(cmdstring1);
-        assertTrue("Removewatches cmd fails to remove pre-create watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove pre-create watches");
         myWatcher1.matches();
-        assertEquals("Failed to remove pre-create watches :"
-                                    + zk.getExistWatches(), 1, zk.getExistWatches().size());
-        assertTrue("Failed to remove pre-create watches :"
-                                  + zk.getExistWatches(), zk.getExistWatches().contains("/testnode1/testnode2"));
+        assertEquals(1, zk.getExistWatches().size(), "Failed to remove pre-create watches :" + zk.getExistWatches());
+        assertTrue(zk.getExistWatches().contains("/testnode1/testnode2"), "Failed to remove pre-create watches :" + zk.getExistWatches());
 
         String cmdstring2 = "removewatches /testnode1/testnode2 -d";
         LOG.info("Remove watchers using shell command : {}", cmdstring2);
         zkMain.cl.parseCommand(cmdstring2);
-        assertTrue("Removewatches cmd fails to remove data watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove data watches");
 
         myWatcher2.matches();
-        assertEquals("Failed to remove pre-create watches : "
-                                    + zk.getExistWatches(), 0, zk.getExistWatches().size());
+        assertEquals(0, zk.getExistWatches().size(), "Failed to remove pre-create watches : " + zk.getExistWatches());
     }
 
     /**
      * Test verifies deletion of NodeChildrenChanged watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeChildrenChangedWatches() throws Exception {
         List<EventType> expectedEvents = new ArrayList<>();
         expectedEvents.add(EventType.ChildWatchRemoved);
@@ -167,15 +173,16 @@ public void testRemoveNodeChildrenChangedWatches() throws Exception {
         String cmdstring = "removewatches /testnode1 -c";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child watches");
         myWatcher.matches();
-        assertEquals("Failed to remove child watches : " + zk.getChildWatches(), 0, zk.getChildWatches().size());
+        assertEquals(0, zk.getChildWatches().size(), "Failed to remove child watches : " + zk.getChildWatches());
     }
 
     /**
      * Test verifies deletion of NodeDeleted watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeDeletedWatches() throws Exception {
         LOG.info("Adding NodeDeleted watcher");
         List<EventType> expectedEvents = new ArrayList<>();
@@ -191,13 +198,12 @@ public void testRemoveNodeDeletedWatches() throws Exception {
         String cmdstring = "removewatches /testnode1 -c";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child watches");
         LOG.info("Waiting for the ChildWatchRemoved event");
         myWatcher.matches();
-        assertEquals("Failed to remove child watches : " + zk.getChildWatches(), 1, zk.getChildWatches().size());
+        assertEquals(1, zk.getChildWatches().size(), "Failed to remove child watches : " + zk.getChildWatches());
 
-        assertTrue("Failed to remove child watches :"
-                                  + zk.getChildWatches(), zk.getChildWatches().contains("/testnode1/testnode2"));
+        assertTrue(zk.getChildWatches().contains("/testnode1/testnode2"), "Failed to remove child watches :" + zk.getChildWatches());
 
         // verify node delete watcher
         zk.delete("/testnode1/testnode2", -1);
@@ -207,7 +213,8 @@ public void testRemoveNodeDeletedWatches() throws Exception {
     /**
      * Test verifies deletion of any watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveAnyWatches() throws Exception {
         verifyRemoveAnyWatches(false);
     }
@@ -216,7 +223,8 @@ public void testRemoveAnyWatches() throws Exception {
      * Test verifies deletion of watches locally when there is no server
      * connection
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveWatchesLocallyWhenNoServerConnection() throws Exception {
         verifyRemoveAnyWatches(true);
     }
@@ -259,12 +267,12 @@ private void addWatchNotifications(Map<String, List<EventType>> pathVsEvent, Wat
 
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child/data watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child/data watches");
         LOG.info("Waiting for the WatchRemoved events");
         watcherLatch.await(10, TimeUnit.SECONDS);
-        assertEquals("Didn't receives WatchRemoved events!", 1, pathVsEvent.size());
-        assertTrue("Didn't receives DataWatchRemoved!", pathVsEvent.get("/testnode1").contains(EventType.DataWatchRemoved));
-        assertTrue("Didn't receives ChildWatchRemoved!", pathVsEvent.get("/testnode1").contains(EventType.ChildWatchRemoved));
+        assertEquals(1, pathVsEvent.size(), "Didn't receives WatchRemoved events!");
+        assertTrue(pathVsEvent.get("/testnode1").contains(EventType.DataWatchRemoved), "Didn't receives DataWatchRemoved!");
+        assertTrue(pathVsEvent.get("/testnode1").contains(EventType.ChildWatchRemoved), "Didn't receives ChildWatchRemoved!");
     }
 
     private static class MyWatcher implements Watcher {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index 8bb91e338bd..b445e861cf8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -19,19 +19,17 @@
 package org.apache.zookeeper;
 
 import static org.hamcrest.CoreMatchers.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.spy;
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -46,24 +44,24 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  * Verifies removing watches using ZooKeeper client apis
  */
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class RemoveWatchesTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(RemoveWatchesTest.class);
     private ZooKeeper zk1 = null;
     private ZooKeeper zk2 = null;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -71,6 +69,7 @@ public void setUp() throws Exception {
         zk2 = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         if (zk1 != null) {
@@ -82,29 +81,19 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    private final boolean useAsync;
-
-    public RemoveWatchesTest(boolean useAsync) {
-        this.useAsync = useAsync;
-    }
-
-    @Parameters
-    public static Collection<Object[]> configs() {
-        return Arrays.asList(new Object[][]{{false}, {true}});
-    }
-
     private void removeWatches(
         ZooKeeper zk,
         String path,
         Watcher watcher,
         WatcherType watcherType,
         boolean local,
-        KeeperException.Code rc) throws InterruptedException, KeeperException {
+        KeeperException.Code rc,
+        boolean useAsync) throws InterruptedException, KeeperException {
         LOG.info("Sending removeWatches req using zk {} path: {} type: {} watcher: {} ", zk, path, watcherType, watcher);
         if (useAsync) {
             MyCallback c1 = new MyCallback(rc.intValue(), path);
             zk.removeWatches(path, watcher, watcherType, local, c1, null);
-            assertTrue("Didn't succeeds removeWatch operation", c1.matches());
+            assertTrue(c1.matches(), "Didn't succeeds removeWatch operation");
             if (KeeperException.Code.OK.intValue() != c1.rc) {
                 KeeperException ke = KeeperException.create(KeeperException.Code.get(c1.rc));
                 throw ke;
@@ -119,12 +108,13 @@ private void removeAllWatches(
         String path,
         WatcherType watcherType,
         boolean local,
-        KeeperException.Code rc) throws InterruptedException, KeeperException {
+        KeeperException.Code rc,
+        boolean useAsync) throws InterruptedException, KeeperException {
         LOG.info("Sending removeWatches req using zk {} path: {} type: {} ", zk, path, watcherType);
         if (useAsync) {
             MyCallback c1 = new MyCallback(rc.intValue(), path);
             zk.removeAllWatches(path, watcherType, local, c1, null);
-            assertTrue("Didn't succeeds removeWatch operation", c1.matches());
+            assertTrue(c1.matches(), "Didn't succeeds removeWatch operation");
             if (KeeperException.Code.OK.intValue() != c1.rc) {
                 KeeperException ke = KeeperException.create(KeeperException.Code.get(c1.rc));
                 throw ke;
@@ -137,21 +127,23 @@ private void removeAllWatches(
     /**
      * Test verifies removal of single watcher when there is server connection
      */
-    @Test(timeout = 90000)
-    public void testRemoveSingleWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveSingleWatcher(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         zk1.create("/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         MyWatcher w2 = new MyWatcher("/node2", 1);
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node2", w2));
-        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK);
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        assertEquals("Didn't find data watcher", "/node2", zk2.getDataWatches().get(0));
-        removeWatches(zk2, "/node2", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", w2.matches());
+        assertNotNull(zk2.exists("/node2", w2), "Didn't set data watches");
+        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK, useAsync);
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        assertEquals("/node2", zk2.getDataWatches().get(0), "Didn't find data watcher");
+        removeWatches(zk2, "/node2", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove data watcher");
         // closing session should remove ephemeral nodes and trigger data
         // watches if any
         if (zk1 != null) {
@@ -160,28 +152,30 @@ public void testRemoveSingleWatcher() throws Exception {
         }
 
         List<EventType> events = w1.getEventsAfterWatchRemoval();
-        assertFalse("Shouldn't get NodeDeletedEvent after watch removal", events.contains(EventType.NodeDeleted));
-        assertEquals("Shouldn't get NodeDeletedEvent after watch removal", 0, events.size());
+        assertFalse(events.contains(EventType.NodeDeleted), "Shouldn't get NodeDeletedEvent after watch removal");
+        assertEquals(0, events.size(), "Shouldn't get NodeDeletedEvent after watch removal");
     }
 
     /**
      * Test verifies removal of multiple data watchers when there is server
      * connection
      */
-    @Test(timeout = 90000)
-    public void testMultipleDataWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testMultipleDataWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
-        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK);
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        assertEquals("Didn't find data watcher", "/node1", zk2.getDataWatches().get(0));
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", w2.matches());
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
+        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK, useAsync);
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        assertEquals("/node1", zk2.getDataWatches().get(0), "Didn't find data watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove data watcher");
         // closing session should remove ephemeral nodes and trigger data
         // watches if any
         if (zk1 != null) {
@@ -190,15 +184,17 @@ public void testMultipleDataWatchers() throws IOException, InterruptedException,
         }
 
         List<EventType> events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Shouldn't get NodeDeletedEvent after watch removal", 0, events.size());
+        assertEquals(0, events.size(), "Shouldn't get NodeDeletedEvent after watch removal");
     }
 
     /**
      * Test verifies removal of multiple child watchers when there is server
      * connection
      */
-    @Test(timeout = 90000)
-    public void testMultipleChildWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testMultipleChildWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
@@ -206,11 +202,11 @@ public void testMultipleChildWatchers() throws IOException, InterruptedException
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w1.matches());
+        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove child watcher");
         // create child to see NodeChildren notification
         zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         // waiting for child watchers to be notified
@@ -224,55 +220,59 @@ public void testMultipleChildWatchers() throws IOException, InterruptedException
         }
         // watcher2
         List<EventType> events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Shouldn't get NodeChildrenChanged event", 0, events.size());
+        assertEquals(0, events.size(), "Shouldn't get NodeChildrenChanged event");
     }
 
     /**
      * Test verifies null watcher with WatcherType.Any - remove all the watchers
      * data, child, exists
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 2);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
         zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertTrue("Didn't remove data watcher", w1.matches());
-        assertTrue("Didn't remove child watcher", w2.matches());
+        assertTrue(w1.matches(), "Didn't remove data watcher");
+        assertTrue(w2.matches(), "Didn't remove child watcher");
     }
 
     /**
      * Test verifies null watcher with WatcherType.Data - remove all data
      * watchers. Child watchers shouldn't be removed
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllDataWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllDataWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK);
-        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK);
+        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK, useAsync);
         zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertTrue("Didn't remove data watcher", w1.matches());
-        assertTrue("Didn't remove data watcher", w2.matches());
+        assertTrue(w1.matches(), "Didn't remove data watcher");
+        assertTrue(w2.matches(), "Didn't remove data watcher");
         // waiting for child watchers to be notified
         int count = 10;
         while (count > 0) {
@@ -284,36 +284,38 @@ public void testRemoveAllDataWatchers() throws IOException, InterruptedException
         }
         // watcher1
         List<EventType> events = w1.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeChildrenChanged event", 1, events.size());
-        assertTrue("Didn't get NodeChildrenChanged event", events.contains(EventType.NodeChildrenChanged));
+        assertEquals(1, events.size(), "Didn't get NodeChildrenChanged event");
+        assertTrue(events.contains(EventType.NodeChildrenChanged), "Didn't get NodeChildrenChanged event");
         // watcher2
         events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeChildrenChanged event", 1, events.size());
-        assertTrue("Didn't get NodeChildrenChanged event", events.contains(EventType.NodeChildrenChanged));
+        assertEquals(1, events.size(), "Didn't get NodeChildrenChanged event");
+        assertTrue(events.contains(EventType.NodeChildrenChanged), "Didn't get NodeChildrenChanged event");
     }
 
     /**
      * Test verifies null watcher with WatcherType.Children - remove all child
      * watchers. Data watchers shouldn't be removed
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllChildWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllChildWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK);
-        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK);
+        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK, useAsync);
         zk1.setData("/node1", "test".getBytes(), -1);
-        assertTrue("Didn't remove child watcher", w1.matches());
-        assertTrue("Didn't remove child watcher", w2.matches());
+        assertTrue(w1.matches(), "Didn't remove child watcher");
+        assertTrue(w2.matches(), "Didn't remove child watcher");
         // waiting for child watchers to be notified
         int count = 10;
         while (count > 0) {
@@ -325,26 +327,28 @@ public void testRemoveAllChildWatchers() throws IOException, InterruptedExceptio
         }
         // watcher1
         List<EventType> events = w1.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeDataChanged event", 1, events.size());
-        assertTrue("Didn't get NodeDataChanged event", events.contains(EventType.NodeDataChanged));
+        assertEquals(1, events.size(), "Didn't get NodeDataChanged event");
+        assertTrue(events.contains(EventType.NodeDataChanged), "Didn't get NodeDataChanged event");
         // watcher2
         events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeDataChanged event", 1, events.size());
-        assertTrue("Didn't get NodeDataChanged event", events.contains(EventType.NodeDataChanged));
+        assertEquals(1, events.size(), "Didn't get NodeDataChanged event");
+        assertTrue(events.contains(EventType.NodeDataChanged), "Didn't get NodeDataChanged event");
     }
 
     /**
      * Test verifies given watcher doesn't exists!
      */
-    @Test(timeout = 90000)
-    public void testNoWatcherException() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testNoWatcherException(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 2);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNull("Didn't set data watches", zk2.exists("/node2", w2));
+        assertNull(zk2.exists("/node2", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
@@ -354,25 +358,25 @@ public void testNoWatcherException() throws IOException, InterruptedException, K
         MyWatcher w3 = new MyWatcher("/node1", 2);
 
         try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Any, false, Code.NOWATCHER);
+            removeWatches(zk2, "/node1", w3, WatcherType.Any, false, Code.NOWATCHER, useAsync);
             fail("Should throw exception as given watcher doesn't exists");
         } catch (KeeperException.NoWatcherException nwe) {
             // expected
         }
         try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Children, false, Code.NOWATCHER);
+            removeWatches(zk2, "/node1", w3, WatcherType.Children, false, Code.NOWATCHER, useAsync);
             fail("Should throw exception as given watcher doesn't exists");
         } catch (KeeperException.NoWatcherException nwe) {
             // expected
         }
         try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Data, false, Code.NOWATCHER);
+            removeWatches(zk2, "/node1", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
             fail("Should throw exception as given watcher doesn't exists");
         } catch (KeeperException.NoWatcherException nwe) {
             // expected
         }
         try {
-            removeWatches(zk2, "/nonexists", w3, WatcherType.Data, false, Code.NOWATCHER);
+            removeWatches(zk2, "/nonexists", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
             fail("Should throw exception as given watcher doesn't exists");
         } catch (KeeperException.NoWatcherException nwe) {
             // expected
@@ -383,91 +387,99 @@ public void testNoWatcherException() throws IOException, InterruptedException, K
      * Test verifies WatcherType.Any - removes only the configured data watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAnyDataWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAnyDataWatcher(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         MyWatcher w2 = new MyWatcher("/node1", 2);
         // Add multiple data watches
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         // Add child watch
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", w1.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove data watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
     }
 
     /**
      * Test verifies WatcherType.Any - removes only the configured child watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAnyChildWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAnyChildWatcher(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w2);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w1);
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove watchers", w1.matches());
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove watchers");
     }
 
     /**
      * Test verifies when there is no server connection. Remove watches when
      * local=true, otw should retain it
      */
-    @Test(timeout = 90000)
-    public void testRemoveWatcherWhenNoConnection() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWatcherWhenNoConnection(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w2);
         stopServer();
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, true, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
-        assertFalse("Shouldn't remove data watcher", w1.matches());
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, true, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
+        assertFalse(w1.matches(), "Shouldn't remove data watcher");
         try {
-            removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.CONNECTIONLOSS);
+            removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.CONNECTIONLOSS, useAsync);
             fail("Should throw exception as last watch removal requires server connection");
         } catch (KeeperException.ConnectionLossException nwe) {
             // expected
         }
-        assertFalse("Shouldn't remove data watcher", w1.matches());
+        assertFalse(w1.matches(), "Shouldn't remove data watcher");
 
         // when local=true, here if connection not available, simply removes
         // from local session
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, true, Code.OK);
-        assertTrue("Didn't remove data watcher", w1.matches());
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, true, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove data watcher");
     }
 
     /**
      * Test verifies many pre-node watchers. Also, verifies internal
      * datastructure 'watchManager.existWatches'
      */
-    @Test(timeout = 90000)
-    public void testManyPreNodeWatchers() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyPreNodeWatchers(boolean useAsync) throws Exception {
         int count = 50;
         List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
         MyWatcher w;
@@ -480,21 +492,23 @@ public void testManyPreNodeWatchers() throws Exception {
             LOG.info("Adding pre node watcher {} on path {}", w, nodePath);
             zk1.exists(nodePath, w);
         }
-        assertEquals("Failed to add watchers!", count, zk1.getExistWatches().size());
+        assertEquals(count, zk1.getExistWatches().size(), "Failed to add watchers!");
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK);
-            assertTrue("Didn't remove data watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove data watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getExistWatches().size());
+        assertEquals(0, zk1.getExistWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies many child watchers. Also, verifies internal datastructure
      * 'watchManager.childWatches'
      */
-    @Test(timeout = 90000)
-    public void testManyChildWatchers() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyChildWatchers(boolean useAsync) throws Exception {
         int count = 50;
         List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
         MyWatcher w;
@@ -514,21 +528,23 @@ public void testManyChildWatchers() throws Exception {
             zk1.getChildren(nodePath, w);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getChildWatches().size());
+        assertEquals(count, zk1.getChildWatches().size(), "Failed to add watchers!");
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Children, false, Code.OK);
-            assertTrue("Didn't remove child watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Children, false, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove child watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getChildWatches().size());
+        assertEquals(0, zk1.getChildWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies many data watchers. Also, verifies internal datastructure
      * 'watchManager.dataWatches'
      */
-    @Test(timeout = 90000)
-    public void testManyDataWatchers() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyDataWatchers(boolean useAsync) throws Exception {
         int count = 50;
         List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
         MyWatcher w;
@@ -544,21 +560,23 @@ public void testManyDataWatchers() throws Exception {
             zk1.getData(nodePath, w, null);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getDataWatches().size());
+        assertEquals(count, zk1.getDataWatches().size(), "Failed to add watchers!");
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK);
-            assertTrue("Didn't remove data watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove data watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getDataWatches().size());
+        assertEquals(0, zk1.getDataWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies removal of many watchers locally when no connection and
      * WatcherType#Any. Also, verifies internal watchManager datastructures
      */
-    @Test(timeout = 90000)
-    public void testManyWatchersWhenNoConnection() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyWatchersWhenNoConnection(boolean useAsync) throws Exception {
         int count = 3;
         List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
         MyWatcher w;
@@ -578,7 +596,7 @@ public void testManyWatchersWhenNoConnection() throws Exception {
             zk1.getChildren(nodePath, w);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getChildWatches().size());
+        assertEquals(count, zk1.getChildWatches().size(), "Failed to add watchers!");
 
         // Data watcher
         for (int i = 0; i < count; i++) {
@@ -588,22 +606,24 @@ public void testManyWatchersWhenNoConnection() throws Exception {
             zk1.getData(nodePath, w, null);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getDataWatches().size());
+        assertEquals(count, zk1.getDataWatches().size(), "Failed to add watchers!");
         stopServer();
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Any, true, Code.OK);
-            assertTrue("Didn't remove watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Any, true, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getChildWatches().size());
-        assertEquals("Didn't remove watch references!", 0, zk1.getDataWatches().size());
+        assertEquals(0, zk1.getChildWatches().size(), "Didn't remove watch references!");
+        assertEquals(0, zk1.getDataWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies removing watcher having namespace
      */
-    @Test(timeout = 90000)
-    public void testChRootRemoveWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testChRootRemoveWatcher(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
         String chRoot = "/appsX";
         zk1.create("/appsX", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -622,17 +642,17 @@ public void testChRootRemoveWatcher() throws Exception {
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w2);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w1);
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w1.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove child watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
     }
 
     /**
@@ -656,8 +676,10 @@ public void testChRootRemoveWatcher() throws Exception {
      * we would just return ZOK even if no watch was removed.
      *
      */
-    @Test(timeout = 90000)
-    public void testNoWatcherServerException() throws InterruptedException, IOException, TimeoutException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testNoWatcherServerException(boolean useAsync) throws InterruptedException, IOException, TimeoutException {
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = spy(new ZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher));
         MyWatchManager watchManager = new MyWatchManager(false, watcher);
@@ -681,11 +703,13 @@ public void testNoWatcherServerException() throws InterruptedException, IOExcept
     /**
      * Test verifies given watcher doesn't exists!
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllNoWatcherException() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllNoWatcherException(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         try {
-            removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.NOWATCHER);
+            removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.NOWATCHER, useAsync);
             fail("Should throw exception as given watcher doesn't exists");
         } catch (KeeperException.NoWatcherException nwe) {
             // expected
@@ -695,8 +719,10 @@ public void testRemoveAllNoWatcherException() throws IOException, InterruptedExc
     /**
      * Test verifies null watcher
      */
-    @Test(timeout = 30000)
-    public void testNullWatcherReference() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 30)
+    public void testNullWatcherReference(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         try {
             if (useAsync) {
@@ -714,8 +740,10 @@ public void testNullWatcherReference() throws Exception {
      * Test verifies WatcherType.Data - removes only the configured data watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveWhenMultipleDataWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultipleDataWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch dataWatchCount = new CountDownLatch(1);
         final CountDownLatch rmWatchCount = new CountDownLatch(1);
@@ -731,24 +759,26 @@ public void testRemoveWhenMultipleDataWatchesOnAPath() throws Exception {
         };
         // Add multiple data watches
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
 
-        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK);
-        assertTrue("Didn't remove data watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
 
         zk1.setData("/node1", "test".getBytes(), -1);
         LOG.info("Waiting for data watchers to be notified");
-        assertTrue("Didn't get data watch notification!", dataWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(dataWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't get data watch notification!");
     }
 
     /**
      * Test verifies WatcherType.Children - removes only the configured child
      * watcher function
      */
-    @Test(timeout = 90000)
-    public void testRemoveWhenMultipleChildWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultipleChildWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch childWatchCount = new CountDownLatch(1);
         final CountDownLatch rmWatchCount = new CountDownLatch(1);
@@ -764,24 +794,26 @@ public void testRemoveWhenMultipleChildWatchesOnAPath() throws Exception {
         };
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w1).size());
+        assertEquals(0, zk2.getChildren("/node1", w1).size(), "Didn't set child watches");
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w2).size());
+        assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
 
-        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK);
-        assertTrue("Didn't remove child watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove child watcher");
 
         zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         LOG.info("Waiting for child watchers to be notified");
-        assertTrue("Didn't get child watch notification!", childWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(childWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't get child watch notification!");
     }
 
     /**
      * Test verifies WatcherType.Data - removes only the configured data watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllDataWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllDataWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch dWatchCount = new CountDownLatch(2);
         final CountDownLatch rmWatchCount = new CountDownLatch(2);
@@ -811,23 +843,25 @@ public void testRemoveAllDataWatchesOnAPath() throws Exception {
         };
         // Add multiple data watches
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
 
-        assertTrue("Server session is not a watcher", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
-        removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.OK);
-        assertTrue("Didn't remove data watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is not a watcher");
+        removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
 
-        assertFalse("Server session is still a watcher after removal", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
+        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is still a watcher after removal");
     }
 
     /**
      * Test verifies WatcherType.Children - removes only the configured child
      * watcher function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllChildWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllChildWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch cWatchCount = new CountDownLatch(2);
         final CountDownLatch rmWatchCount = new CountDownLatch(2);
@@ -857,23 +891,25 @@ public void testRemoveAllChildWatchesOnAPath() throws Exception {
         };
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w1).size());
+        assertEquals(0, zk2.getChildren("/node1", w1).size(), "Didn't set child watches");
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w2).size());
+        assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
 
-        assertTrue("Server session is not a watcher", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children));
-        removeAllWatches(zk2, "/node1", WatcherType.Children, false, Code.OK);
-        assertTrue("Didn't remove child watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is not a watcher");
+        removeAllWatches(zk2, "/node1", WatcherType.Children, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove child watcher");
 
-        assertFalse("Server session is still a watcher after removal", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children));
+        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is still a watcher after removal");
     }
 
     /**
      * Test verifies WatcherType.Any - removes all the configured child,data
      * watcher functions
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch watchCount = new CountDownLatch(2);
         final CountDownLatch rmWatchCount = new CountDownLatch(4);
@@ -907,21 +943,21 @@ public void testRemoveAllWatchesOnAPath() throws Exception {
         };
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w1).size());
+        assertEquals(0, zk2.getChildren("/node1", w1).size(), "Didn't set child watches");
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w2).size());
+        assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
 
         // Add multiple data watches
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
 
-        assertTrue("Server session is not a watcher", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
-        removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
-        assertFalse("Server session is still a watcher after removal", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
-        assertEquals("Received watch notification after removal!", 2, watchCount.getCount());
+        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is not a watcher");
+        removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
+        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is still a watcher after removal");
+        assertEquals(2, watchCount.getCount(), "Received watch notification after removal!");
     }
 
     private static class MyWatchManager extends ZKWatchManager {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
index a63ab10145a..1d0bffaafb7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -36,13 +36,13 @@
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthTest extends ClientBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void init() {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
         try {
@@ -83,7 +83,7 @@ private static String getJaasFileContent() {
         return jaasContent.toString();
     }
 
-    @AfterClass
+    @AfterAll
     public static void clean() {
         System.clearProperty("zookeeper.authProvider.1");
         System.clearProperty("java.security.auth.login.config");
@@ -187,7 +187,7 @@ public void testZKOperationsAfterClientSaslAuthFailure() throws Exception {
                     // do nothing
                 }
             }
-            assertTrue("ZNode creation is failing continuously after Sasl auth failure.", success);
+            assertTrue(success, "ZNode creation is failing continuously after Sasl auth failure.");
 
         } finally {
             zk.close();
@@ -234,8 +234,8 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             EventThread eventThread = (EventThread) eventThreadField.get(clientCnxn);
             sendThread.join(CONNECTION_TIMEOUT);
             eventThread.join(CONNECTION_TIMEOUT);
-            assertFalse("SendThread did not shutdown after authFail", sendThread.isAlive());
-            assertFalse("EventThread did not shutdown after authFail", eventThread.isAlive());
+            assertFalse(sendThread.isAlive(), "SendThread did not shutdown after authFail");
+            assertFalse(eventThread.isAlive(), "EventThread did not shutdown after authFail");
         } finally {
             if (zk != null) {
                 zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java
index a2b4371843c..4989bd1b369 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java
@@ -18,30 +18,33 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.File;
 import org.apache.zookeeper.server.ServerConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ServerConfigTest {
 
     private ServerConfig serverConfig;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         serverConfig = new ServerConfig();
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFewArguments() {
-        String[] args = {"2181"};
-        serverConfig.parse(args);
+        assertThrows(IllegalArgumentException.class, () -> {
+            String[] args = {"2181"};
+            serverConfig.parse(args);
+        });
     }
 
     @Test
@@ -55,10 +58,12 @@ public void testValidArguments() {
         assertEquals(10000, serverConfig.getMaxClientCnxns());
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testTooManyArguments() {
-        String[] args = {"2181", "/data/dir", "60000", "10000", "9999"};
-        serverConfig.parse(args);
+        assertThrows(IllegalArgumentException.class, () -> {
+            String[] args = {"2181", "/data/dir", "60000", "10000", "9999"};
+            serverConfig.parse(args);
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java
deleted file mode 100644
index 6b5359096b0..00000000000
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper;
-
-import java.util.List;
-import org.junit.runners.model.FrameworkMethod;
-import org.junit.runners.model.InitializationError;
-import org.junit.runners.model.Statement;
-import org.junit.runners.parameterized.BlockJUnit4ClassRunnerWithParameters;
-import org.junit.runners.parameterized.BlockJUnit4ClassRunnerWithParametersFactory;
-import org.junit.runners.parameterized.TestWithParameters;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class ZKParameterized {
-
-    private static final Logger LOG = LoggerFactory.getLogger(ZKParameterized.class);
-
-    public static class RunnerFactory extends BlockJUnit4ClassRunnerWithParametersFactory {
-
-        @Override
-        public org.junit.runner.Runner createRunnerForTestWithParameters(TestWithParameters test) throws InitializationError {
-            return new ZKParameterized.Runner(test);
-        }
-
-    }
-
-    public static class Runner extends BlockJUnit4ClassRunnerWithParameters {
-
-        public Runner(TestWithParameters test) throws InitializationError {
-            super(test);
-        }
-
-        @Override
-        protected List<FrameworkMethod> computeTestMethods() {
-            return JUnit4ZKTestRunner.computeTestMethodsForClass(getTestClass().getJavaClass(), super.computeTestMethods());
-        }
-
-        @Override
-        protected Statement methodInvoker(FrameworkMethod method, Object test) {
-            return new JUnit4ZKTestRunner.LoggedInvokeMethod(method, test);
-        }
-
-    }
-
-}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index 78e3cd79e82..21343c161ca 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -18,16 +18,15 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.time.LocalDateTime;
 import org.apache.zookeeper.util.ServiceUtils;
-import org.junit.BeforeClass;
-import org.junit.Rule;
-import org.junit.rules.TestWatcher;
-import org.junit.runner.Description;
-import org.junit.runner.RunWith;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.TestInfo;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -37,7 +36,6 @@
  * Basic utilities shared by all tests. Also logging of various events during
  * the test execution (start/stop/success/failure/etc...)
  */
-@RunWith(JUnit4ZKTestRunner.class)
 public class ZKTestCase {
 
     protected static final File testBaseDir = new File(System.getProperty("build.test.dir", "build"));
@@ -54,54 +52,35 @@ protected String getTestName() {
         return testName;
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void before() {
         if (!testBaseDir.exists()) {
-            assertTrue(
-                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath(),
-                testBaseDir.mkdirs());
+            assertTrue(testBaseDir.mkdirs(),
+                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath());
         } else if (!testBaseDir.isDirectory()) {
-            assertTrue(
-                "Cannot properly delete file with duplicate name of test base directory " + testBaseDir.getAbsolutePath(),
-                testBaseDir.delete());
-            assertTrue(
-                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath(),
-                testBaseDir.mkdirs());
+            assertTrue(testBaseDir.delete(),
+                "Cannot properly delete file with duplicate name of test base directory " + testBaseDir.getAbsolutePath());
+            assertTrue(testBaseDir.mkdirs(),
+                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath());
         }
     }
 
-    @Rule
-    public TestWatcher watchman = new TestWatcher() {
-
-        @Override
-        public void starting(Description method) {
-            // By default, disable starting a JettyAdminServer in tests to avoid
-            // accidentally attempting to start multiple admin servers on the
-            // same port.
-            System.setProperty("zookeeper.admin.enableServer", "false");
-            // ZOOKEEPER-2693 disables all 4lw by default.
-            // Here we enable the 4lw which ZooKeeper tests depends.
-            System.setProperty("zookeeper.4lw.commands.whitelist", "*");
-            testName = method.getMethodName();
-            LOG.info("STARTING {}", testName);
-        }
-
-        @Override
-        public void finished(Description method) {
-            LOG.info("FINISHED {}", testName);
-        }
-
-        @Override
-        public void succeeded(Description method) {
-            LOG.info("SUCCEEDED {}", testName);
-        }
-
-        @Override
-        public void failed(Throwable e, Description method) {
-            LOG.error("FAILED {}", testName, e);
-        }
+    @BeforeEach
+    public void starting(TestInfo testInfo) {
+        // By default, disable starting a JettyAdminServer in tests to avoid
+        // accidentally attempting to start multiple admin servers on the
+        // same port.
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        // ZOOKEEPER-2693 disables all 4lw by default.
+        // Here we enable the 4lw which ZooKeeper tests depends.
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        LOG.info("STARTING {}", testInfo.getTestMethod());
+    }
 
-    };
+    @AfterEach
+    public void finished(TestInfo testInfo) {
+        LOG.info("FINISHED {}", testInfo.getTestMethod());
+    }
 
     public interface WaitForCondition {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
index 43e986978d0..190465386b6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
@@ -18,21 +18,21 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
 import static org.junit.Assume.assumeTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.File;
 import java.io.IOException;
 import java.util.UUID;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class ZKUtilTest {
 
     private static final File testData = new File(System.getProperty("test.data.dir", "build/test/data"));
 
-    @BeforeClass
+    @BeforeAll
     public static void init() {
         testData.mkdirs();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index f0f6be55287..7074896bcff 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
@@ -48,7 +48,7 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  *
@@ -66,7 +66,7 @@ public void testDeleteRecursive() throws IOException, InterruptedException, Keep
 
         assertTrue(ZKUtil.deleteRecursive(zk, "/a/c", 1000));
         List<String> children = zk.getChildren("/a", false);
-        assertEquals("1 children - c should be deleted ", 1, children.size());
+        assertEquals(1, children.size(), "1 children - c should be deleted ");
         assertTrue(children.contains("b"));
 
         assertTrue(ZKUtil.deleteRecursive(zk, "/a", 1000));
@@ -89,12 +89,12 @@ public void testDeleteRecursiveFail() throws IOException, InterruptedException,
 
         assertFalse(ZKUtil.deleteRecursive(zk, "/a/c", 1000));
         List<String> children = zk.getChildren("/a", false);
-        assertEquals("2 children - c should fail to be deleted ", 2, children.size());
+        assertEquals(2, children.size(), "2 children - c should fail to be deleted ");
         assertTrue(children.contains("b"));
 
         assertTrue(ZKUtil.deleteRecursive(zk, "/a/b", 1000));
         children = zk.getChildren("/a", false);
-        assertEquals("1 children - b should be deleted ", 1, children.size());
+        assertEquals(1, children.size(), "1 children - b should be deleted ");
 
         // acquire immunity to poison
         zk.addAuthInfo(deleteProtection.getId().getScheme(), "user:test".getBytes());
@@ -125,7 +125,7 @@ private void setupDataTree(ZooKeeper zk) throws KeeperException, InterruptedExce
         }
         List<String> children = zk.getChildren("/a", false);
 
-        assertEquals("2 children - b & c should be present ", 2, children.size());
+        assertEquals(2, children.size(), "2 children - b & c should be present ");
         assertTrue(children.contains("b"));
         assertTrue(children.contains("c"));
     }
@@ -149,7 +149,7 @@ public void testDeleteRecursiveCli() throws IOException, InterruptedException, C
 
         List<String> children = zk.getChildren("/a", false);
 
-        assertEquals("2 children - b & c should be present ", children.size(), 2);
+        assertEquals(children.size(), 2, "2 children - b & c should be present ");
         assertTrue(children.contains("b"));
         assertTrue(children.contains("c"));
 
@@ -182,7 +182,7 @@ public void testDeleteRecursiveAsync() throws IOException, InterruptedException,
         }
         List<String> children = zk.getChildren("/a", false);
 
-        assertEquals("2 children - b & c should be present ", children.size(), 2);
+        assertEquals(children.size(), 2, "2 children - b & c should be present ");
         assertTrue(children.contains("b"));
         assertTrue(children.contains("c"));
 
@@ -225,9 +225,9 @@ public void testParseWithExtraSpaces() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "      ls       /  ";
         zkMain.cl.parseCommand(cmdstring);
-        assertEquals("Spaces also considered as characters", zkMain.cl.getNumArguments(), 2);
-        assertEquals("ls is not taken as first argument", zkMain.cl.getCmdArgument(0), "ls");
-        assertEquals("/ is not taken as second argument", zkMain.cl.getCmdArgument(1), "/");
+        assertEquals(zkMain.cl.getNumArguments(), 2, "Spaces also considered as characters");
+        assertEquals(zkMain.cl.getCmdArgument(0), "ls", "ls is not taken as first argument");
+        assertEquals(zkMain.cl.getCmdArgument(1), "/", "/ is not taken as second argument");
     }
 
     @Test
@@ -237,10 +237,10 @@ public void testParseWithQuotes() throws Exception {
         for (String quoteChar : new String[]{"'", "\""}) {
             String cmdstring = String.format("create /node %1$squoted data%1$s", quoteChar);
             zkMain.cl.parseCommand(cmdstring);
-            assertEquals("quotes combine arguments", zkMain.cl.getNumArguments(), 3);
-            assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-            assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-            assertEquals("quoted data is not taken as third argument", zkMain.cl.getCmdArgument(2), "quoted data");
+            assertEquals(zkMain.cl.getNumArguments(), 3, "quotes combine arguments");
+            assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+            assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+            assertEquals(zkMain.cl.getCmdArgument(2), "quoted data", "quoted data is not taken as third argument");
         }
     }
 
@@ -253,13 +253,11 @@ public void testParseWithMixedQuotes() throws Exception {
             String innerQuotes = quoteChars[1];
             String cmdstring = String.format("create /node %1$s%2$squoted data%2$s%1$s", outerQuotes, innerQuotes);
             zkMain.cl.parseCommand(cmdstring);
-            assertEquals("quotes combine arguments", zkMain.cl.getNumArguments(), 3);
-            assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-            assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-            assertEquals(
-                "quoted data is not taken as third argument",
-                zkMain.cl.getCmdArgument(2),
-                innerQuotes + "quoted data" + innerQuotes);
+            assertEquals(zkMain.cl.getNumArguments(), 3, "quotes combine arguments");
+            assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+            assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+            assertEquals(zkMain.cl.getCmdArgument(2), innerQuotes + "quoted data" + innerQuotes,
+                    "quoted data is not taken as third argument");
         }
     }
 
@@ -269,10 +267,10 @@ public void testParseWithEmptyQuotes() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "create /node ''";
         zkMain.cl.parseCommand(cmdstring);
-        assertEquals("empty quotes should produce arguments", zkMain.cl.getNumArguments(), 3);
-        assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-        assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-        assertEquals("empty string is not taken as third argument", zkMain.cl.getCmdArgument(2), "");
+        assertEquals(zkMain.cl.getNumArguments(), 3, "empty quotes should produce arguments");
+        assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+        assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+        assertEquals(zkMain.cl.getCmdArgument(2), "", "empty string is not taken as third argument");
     }
 
     @Test
@@ -281,11 +279,11 @@ public void testParseWithMultipleQuotes() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "create /node '' ''";
         zkMain.cl.parseCommand(cmdstring);
-        assertEquals("expected 5 arguments", zkMain.cl.getNumArguments(), 4);
-        assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-        assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-        assertEquals("empty string is not taken as third argument", zkMain.cl.getCmdArgument(2), "");
-        assertEquals("empty string is not taken as fourth argument", zkMain.cl.getCmdArgument(3), "");
+        assertEquals(zkMain.cl.getNumArguments(), 4, "expected 5 arguments");
+        assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+        assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+        assertEquals(zkMain.cl.getCmdArgument(2), "", "empty string is not taken as third argument");
+        assertEquals(zkMain.cl.getCmdArgument(3), "", "empty string is not taken as fourth argument");
     }
 
     @Test
@@ -339,20 +337,20 @@ public void testCreateNodeWithoutData() throws Exception {
         // create persistent sequential node
         String cmdstring = "create -s /node ";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Doesn't create node without data", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Doesn't create node without data");
         // create ephemeral node
         cmdstring = "create  -e /node ";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Doesn't create node without data", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Doesn't create node without data");
         // create ephemeral sequential node
         cmdstring = "create -s -e /node ";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Doesn't create node without data", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Doesn't create node without data");
         // creating ephemeral with wrong option.
         cmdstring = "create -s y /node";
         zkMain.cl.parseCommand(cmdstring);
         try {
-            assertTrue("Created node with wrong option", zkMain.processZKCmd(zkMain.cl));
+            assertTrue(zkMain.processZKCmd(zkMain.cl), "Created node with wrong option");
             fail("Created the node with wrong option should " + "throw Exception.");
         } catch (MalformedPathException e) {
             assertEquals("Path must start with / character", e.getMessage());
@@ -366,7 +364,7 @@ public void testACLWithExtraAgruments() throws Exception {
         // create persistent sequential node
         String cmdstring = "create -s /l data ip:10.18.52.144:cdrwa f g h";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Not considering the extra arguments after the acls.", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Not considering the extra arguments after the acls.");
     }
 
     @Test
@@ -375,7 +373,7 @@ public void testCreatePersistentNode() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "create /node2";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Not creating Persistent node.", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Not creating Persistent node.");
     }
 
     @Test
@@ -390,7 +388,7 @@ public void testDelete() throws Exception {
         zkMain.cl.parseCommand(cmdstring2);
         assertFalse(zkMain.processZKCmd(zkMain.cl));
         zkMain.cl.parseCommand(cmdstring3);
-        assertFalse("", zkMain.processCmd(zkMain.cl));
+        assertFalse(zkMain.processCmd(zkMain.cl), "");
     }
 
     @Test
@@ -526,7 +524,7 @@ private static void runCommandExpect(CliCommand command, List<String> expectedRe
         command.exec();
 
         String result = byteStream.toString();
-        assertTrue(result, result.contains(StringUtils.joinStrings(expectedResults, LINE_SEPARATOR)));
+        assertTrue(result.contains(StringUtils.joinStrings(expectedResults, LINE_SEPARATOR)), result);
     }
 
     @Test
@@ -671,7 +669,7 @@ public void testClientReconnectWithZKClientConfig() throws Exception {
                 aHostProvider,
                 clientConfig);
             watcher.waitForConnected(CONNECTION_TIMEOUT);
-            assertEquals("Old client session id and new clinet session id must be same", zk.getSessionId(), newZKClient.getSessionId());
+            assertEquals(zk.getSessionId(), newZKClient.getSessionId(), "Old client session id and new clinet session id must be same");
         } finally {
             zk.close();
             newZKClient.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java
index 02d9ac0bb85..faa872ae6f0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java
@@ -17,9 +17,9 @@
  */
 package org.apache.zookeeper.audit;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import org.apache.zookeeper.audit.AuditEvent.Result;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class AuditEventTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
index 0c408110a17..8a5f781a83a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
@@ -18,7 +18,7 @@
 package org.apache.zookeeper.audit;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.LineNumberReader;
@@ -48,11 +48,11 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.AfterClass;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 
 public class Log4jAuditLoggerTest extends QuorumPeerTestBase {
@@ -64,7 +64,7 @@ public class Log4jAuditLoggerTest extends QuorumPeerTestBase {
     private static WriterAppender appender;
     private static ByteArrayOutputStream os;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBeforeClass() throws Exception {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
         // setup the logger to capture all logs
@@ -83,7 +83,7 @@ public static void setUpBeforeClass() throws Exception {
         verifyLogs(expectedAuditLog, logs);
     }
 
-    @Before
+    @BeforeEach
     public void setUp() {
         os.reset();
     }
@@ -357,10 +357,9 @@ private static List<String> readAuditLog(ByteArrayOutputStream os,
             logs.add(line);
         }
         os.reset();
-        assertEquals(
+        assertEquals(numberOfLogEntry, logs.size(),
                 "Expected number of log entries are not generated. Logs are "
-                        + logs,
-                numberOfLogEntry, logs.size());
+                        + logs);
         return logs;
 
     }
@@ -393,9 +392,8 @@ private static MainThread[] startQuorum() throws IOException {
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i],
-                            CONNECTION_TIMEOUT));
+            Assertions.assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i],
+                    CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
         return mt;
     }
@@ -410,16 +408,15 @@ private void waitForDeletion(ZooKeeper zooKeeper, String path)
             try {
                 Thread.sleep(waitInterval);
             } catch (InterruptedException e) {
-                Assert.fail("CurrentEpoch update failed");
+                Assertions.fail("CurrentEpoch update failed");
             }
             elapsedTime = elapsedTime + waitInterval;
             exists = zooKeeper.exists(path, false);
         }
-        Assert.assertNull("Node " + path + " not deleted in " + timeout + " ms",
-                exists);
+        Assertions.assertNull(exists, "Node " + path + " not deleted in " + timeout + " ms");
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() {
         System.clearProperty(ZKAuditProvider.AUDIT_ENABLE);
         for (int i = 0; i < SERVER_COUNT; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
index 7aed4c6ff42..0815b9f42d4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.audit;
 
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.LineNumberReader;
@@ -37,16 +37,16 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 
 
 public class StandaloneServerAuditTest extends ClientBase {
     private static ByteArrayOutputStream os;
 
-    @BeforeClass
+    @BeforeAll
     public static void setup() {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
         // setup the logger to capture all the logs
@@ -59,7 +59,7 @@ public static void setup() {
         zLogger.addAppender(appender);
     }
 
-    @AfterClass
+    @AfterAll
     public static void teardown() {
         System.clearProperty(ZKAuditProvider.AUDIT_ENABLE);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
index a118399d520..2173514d368 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.cli;
 
-import static org.junit.Assert.assertTrue;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.Test;
 
 /**
  * Unit test for {@link CommandFactory}.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
index 9a9b6223e00..d98ecba255a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
@@ -25,10 +25,10 @@
 import static org.apache.zookeeper.client.ZKClientConfig.ZK_SASL_CLIENT_USERNAME;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_SERVER_REALM;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
@@ -36,21 +36,17 @@
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
-import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.BeforeClass;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ZKClientConfigTest {
 
     private static final File testData = new File(System.getProperty("test.data.dir", "src/test/resources/data"));
-    @Rule
-    public Timeout timeout = new Timeout(10, TimeUnit.SECONDS);
 
-    @BeforeClass
+    @BeforeAll
     public static void init() {
         if (!testData.exists()) {
             testData.mkdirs();
@@ -58,6 +54,7 @@ public static void init() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testDefaultConfiguration() {
         Map<String, String> properties = new HashMap<>();
         properties.put(ZK_SASL_CLIENT_USERNAME, "zookeeper1");
@@ -96,6 +93,7 @@ public void testDefaultConfiguration() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testSystemPropertyValue() {
         String clientName = "zookeeper1";
         System.setProperty(ZK_SASL_CLIENT_USERNAME, clientName);
@@ -110,6 +108,7 @@ public void testSystemPropertyValue() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testReadConfigurationFile() throws IOException, ConfigException {
         File file = File.createTempFile("clientConfig", ".conf", testData);
         file.deleteOnExit();
@@ -137,10 +136,10 @@ public void testReadConfigurationFile() throws IOException, ConfigException {
         // try to delete it now as we have done with the created file, why to
         // wait for deleteOnExit() deletion
         file.delete();
-
     }
 
     @Test
+    @Timeout(value = 10)
     public void testSetConfiguration() {
         ZKClientConfig conf = new ZKClientConfig();
         String defaultValue = conf.getProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, ZKClientConfig.ENABLE_CLIENT_SASL_DEFAULT);
@@ -153,6 +152,7 @@ public void testSetConfiguration() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testIntegerRetrievalFromProperty() {
         ZKClientConfig conf = new ZKClientConfig();
         String prop = "UnSetProperty" + System.currentTimeMillis();
@@ -186,6 +186,7 @@ public void testIntegerRetrievalFromProperty() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testIntegerRetrievalFromHexadecimalProperty() {
         int hexaValue = 0x3000000;
         String wrongValue = "0xwel";
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
index d128ecc84b9..923fc0855c1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
@@ -31,14 +31,14 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.OutputStreamStatement;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class AtomicFileWritingIdiomTest extends ZKTestCase {
 
     private static File tmpdir;
 
-    @BeforeClass
+    @BeforeAll
     public static void createTmpDir() {
         tmpdir = new File("build/test/tmp");
         tmpdir.mkdirs();
@@ -54,10 +54,10 @@ public void testOutputStreamSuccess() throws IOException {
             @Override
             public void write(OutputStream os) throws IOException {
                 os.write("after".getBytes(StandardCharsets.US_ASCII));
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
-        assertFalse("tmp file should have been deleted", tmp.exists());
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
         target.delete();
@@ -73,10 +73,10 @@ public void testWriterSuccess() throws IOException {
             @Override
             public void write(Writer os) throws IOException {
                 os.write("after");
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
-        assertFalse("tmp file should have been deleted", tmp.exists());
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
         target.delete();
@@ -95,15 +95,15 @@ public void testOutputStreamFailure() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
         target.delete();
@@ -122,15 +122,15 @@ public void testWriterFailure() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
         target.delete();
@@ -149,15 +149,15 @@ public void testOutputStreamFailureIOException() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new IOException();
                 }
             });
         } catch (IOException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
         target.delete();
@@ -176,15 +176,15 @@ public void testWriterFailureIOException() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new IOException();
                 }
             });
         } catch (IOException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
         target.delete();
@@ -203,15 +203,15 @@ public void testOutputStreamFailureError() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new Error();
                 }
             });
         } catch (Error ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
         target.delete();
@@ -230,15 +230,15 @@ public void testWriterFailureError() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new Error();
                 }
             });
         } catch (Error ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
         target.delete();
@@ -251,12 +251,12 @@ public void testOutputStreamSuccessNE() throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         new AtomicFileWritingIdiom(target, new OutputStreamStatement() {
             @Override
             public void write(OutputStream os) throws IOException {
                 os.write("after".getBytes(StandardCharsets.US_ASCII));
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
         // content changed
@@ -269,15 +269,15 @@ public void testWriterSuccessNE() throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         new AtomicFileWritingIdiom(target, new WriterStatement() {
             @Override
             public void write(Writer os) throws IOException {
                 os.write("after");
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
-        assertFalse("tmp file should have been deleted", tmp.exists());
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
         target.delete();
@@ -288,7 +288,7 @@ public void testOutputStreamFailureNE() throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         boolean exception = false;
         try {
             new AtomicFileWritingIdiom(target, new OutputStreamStatement() {
@@ -296,17 +296,17 @@ public void testOutputStreamFailureNE() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // file should not exist
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
     }
 
     @Test
@@ -314,7 +314,7 @@ public void testWriterFailureNE() throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         boolean exception = false;
         try {
             new AtomicFileWritingIdiom(target, new WriterStatement() {
@@ -322,17 +322,17 @@ public void testWriterFailureNE() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // file should not exist
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
     }
 
     private String getContent(File file, String encoding) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
index b4790cfd9fc..8c3731b81e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
@@ -22,15 +22,16 @@
 import java.io.IOException;
 import java.security.Security;
 import java.util.ArrayList;
-import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.stream.Stream;
 import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.params.provider.Arguments;
 
 /**
  * Base class for parameterized unit tests that use X509TestContext for testing
@@ -45,19 +46,20 @@ public abstract class BaseX509ParameterizedTestCase extends ZKTestCase {
     /**
      * Default parameters suitable for most subclasses. See example usage
      * in {@link X509UtilTest}.
-     * @return an array of parameter combinations to test with.
+     * @return a stream of parameter combinations to test with.
      */
-    public static Collection<Object[]> defaultParams() {
-        ArrayList<Object[]> result = new ArrayList<>();
+    public static Stream<Arguments> data() {
+        ArrayList<Arguments> result = new ArrayList<>();
         int paramIndex = 0;
         for (X509KeyType caKeyType : X509KeyType.values()) {
             for (X509KeyType certKeyType : X509KeyType.values()) {
                 for (String keyPassword : new String[]{"", "pa$$w0rd"}) {
-                    result.add(new Object[]{caKeyType, certKeyType, keyPassword, paramIndex++});
+                    result.add(Arguments.of(caKeyType, certKeyType, keyPassword, paramIndex++));
                 }
             }
         }
-        return result;
+
+        return result.stream();
     }
 
     /**
@@ -70,16 +72,16 @@ public static Collection<Object[]> defaultParams() {
 
     protected X509TestContext x509TestContext;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBaseClass() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
         cachedTestContexts = new HashMap<>();
         tempDir = ClientBase.createEmptyTestDir();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanUpBaseClass() {
-        Security.removeProvider("BC");
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
         cachedTestContexts.clear();
         cachedTestContexts = null;
         try {
@@ -90,13 +92,13 @@ public static void cleanUpBaseClass() {
     }
 
     /**
-     * Constructor. See example usage in {@link X509UtilTest}.
+     * Init method. See example usage in {@link X509UtilTest}.
      *
      * @param paramIndex the index under which the X509TestContext should be cached.
      * @param contextSupplier a function that creates and returns the X509TestContext
      *                        for the current index if one is not already cached.
      */
-    protected BaseX509ParameterizedTestCase(
+    protected void init(
             Integer paramIndex, java.util.function.Supplier<X509TestContext> contextSupplier) {
         if (cachedTestContexts.containsKey(paramIndex)) {
             x509TestContext = cachedTestContexts.get(paramIndex);
@@ -106,4 +108,24 @@ protected BaseX509ParameterizedTestCase(
         }
     }
 
+    protected void init(
+            final X509KeyType caKeyType,
+            final X509KeyType certKeyType,
+            final String keyPassword,
+            final Integer paramIndex)
+            throws Exception {
+        init(paramIndex, () -> {
+            try {
+                return X509TestContext.newBuilder()
+                        .setTempDir(tempDir)
+                        .setKeyStorePassword(keyPassword)
+                        .setKeyStoreKeyType(certKeyType)
+                        .setTrustStorePassword(keyPassword)
+                        .setTrustStoreKeyType(caKeyType)
+                        .build();
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
index 619ab1d9767..4ae5ab68f93 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
@@ -32,9 +32,9 @@
 import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,14 +47,14 @@ public class FileChangeWatcherTest extends ZKTestCase {
 
     private static final long FS_TIMEOUT = 30000L;
 
-    @BeforeClass
+    @BeforeAll
     public static void createTempFile() throws IOException {
         tempDir = ClientBase.createEmptyTestDir();
         tempFile = File.createTempFile("zk_test_", "", tempDir);
         tempFile.deleteOnExit();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanupTempDir() {
         try {
             FileUtils.deleteDirectory(tempDir);
@@ -91,7 +91,7 @@ public void testCallbackWorksOnFileChanges() throws IOException, InterruptedExce
                     if (events.size() < i + 1) {
                         events.wait(FS_TIMEOUT);
                     }
-                    assertEquals("Wrong number of events", i + 1, events.size());
+                    assertEquals(i + 1, events.size(), "Wrong number of events");
                     WatchEvent<?> event = events.get(i);
                     assertEquals(StandardWatchEventKinds.ENTRY_MODIFY, event.kind());
                     assertEquals(tempFile.getName(), event.context().toString());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java
index 52640e50509..6c5f38aa24b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java
@@ -18,9 +18,10 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class FileKeyStoreLoaderBuilderProviderTest extends ZKTestCase {
 
@@ -42,9 +43,11 @@ public void testGetBuilderForPKCS12FileType() {
         assertTrue(builder instanceof PKCS12FileLoader.Builder);
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void testGetBuilderForNullFileType() {
-        FileKeyStoreLoaderBuilderProvider.getBuilderForKeyStoreFileType(null);
+        assertThrows(NullPointerException.class, () -> {
+            FileKeyStoreLoaderBuilderProvider.getBuilderForKeyStoreFileType(null);
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java
index 7a349bcde6a..f9247b89c5e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java
@@ -18,95 +18,133 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.KeyStore;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class JKSFileLoaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public JKSFileLoaderTest(
-            final X509KeyType caKeyType, final X509KeyType certKeyType, final String keyPassword, final Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder().setTempDir(tempDir).setKeyStorePassword(keyPassword).setKeyStoreKeyType(certKeyType).setTrustStorePassword(keyPassword).setTrustStoreKeyType(caKeyType).build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
         KeyStore ks = new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
         assertEquals(1, ks.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadKeyStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword("wrong password").build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword("wrong password").build().loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setKeyStorePath(path
-                                                            + ".does_not_exist").setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setKeyStorePath(path
+                    + ".does_not_exist").setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadKeyStoreWithNullFilePath() throws Exception {
-        new JKSFileLoader.Builder().setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new JKSFileLoader.Builder().setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with JKS loader should fail
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with JKS loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
         KeyStore ts = new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
         assertEquals(1, ts.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadTrustStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword("wrong password").build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword("wrong password").build().loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setTrustStorePath(path
-                                                              + ".does_not_exist").setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setTrustStorePath(path
+                    + ".does_not_exist").setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadTrustStoreWithNullFilePath() throws Exception {
-        new JKSFileLoader.Builder().setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new JKSFileLoader.Builder().setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with JKS loader should fail
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with JKS loader should fail
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
index feeed810345..9f5dd7ac481 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class KeyStoreFileTypeTest extends ZKTestCase {
 
@@ -50,9 +51,11 @@ public void testFromPropertyValueIgnoresCase() {
         assertNull(KeyStoreFileType.fromPropertyValue(null));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromPropertyValueThrowsOnBadPropertyValue() {
-        KeyStoreFileType.fromPropertyValue("foobar");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromPropertyValue("foobar");
+        });
     }
 
     @Test
@@ -65,9 +68,11 @@ public void testFromFilename() {
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.p12"));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromFilenameThrowsOnBadFileExtension() {
-        KeyStoreFileType.fromFilename("prod.key");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromFilename("prod.key");
+        });
     }
 
     @Test
@@ -80,14 +85,18 @@ public void testFromPropertyValueOrFileName() {
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValueOrFileName("", "prod.jks"));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromPropertyValueOrFileNameThrowsOnBadPropertyValue() {
-        KeyStoreFileType.fromPropertyValueOrFileName("foobar", "prod.jks");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromPropertyValueOrFileName("foobar", "prod.jks");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromPropertyValueOrFileNameThrowsOnBadFileExtension() {
-        KeyStoreFileType.fromPropertyValueOrFileName("", "prod.key");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromPropertyValueOrFileName("", "prod.key");
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
index e06b7d1854a..a7006bf7053 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
@@ -20,11 +20,12 @@
 
 import static org.hamcrest.CoreMatchers.anyOf;
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class NetUtilsTest extends ZKTestCase {
 
@@ -69,24 +70,32 @@ public void testFormatAddrUnresolved() {
         assertEquals("doesnt.exist.com:1234", NetUtils.formatInetAddr(isa));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void tetGetIPV6HostAndPort_WhenHostDoesNotEndWithBracket() {
-        NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334:443");
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334:443");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void tetGetIPV6HostAndPort_WhenNoPortAfterColon() {
-        NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:");
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void tetGetIPV6HostAndPort_WhenPortIsNotSeparatedProperly() {
-        NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]2181");
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]2181");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void tetGetIPV6HostAndPort_WhenHostIsEmpty() {
-        NetUtils.getIPV6HostAndPort("[]:2181");
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[]:2181");
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
index 05ef12e767c..ee9a68eb7ad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
@@ -18,45 +18,22 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class PEMFileLoaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public PEMFileLoaderTest(
-        final X509KeyType caKeyType,
-        final X509KeyType certKeyType,
-        final String keyPassword,
-        final Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                                      .setTempDir(tempDir)
-                                      .setKeyStorePassword(keyPassword)
-                                      .setKeyStoreKeyType(certKeyType)
-                                      .setTrustStorePassword(keyPassword)
-                                      .setTrustStoreKeyType(caKeyType)
-                                      .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
         KeyStore ks = new PEMFileLoader.Builder()
             .setKeyStorePath(path)
@@ -66,47 +43,75 @@ public void testLoadKeyStore() throws Exception {
         assertEquals(1, ks.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadKeyStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword("wrong password")
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword("wrong password")
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setKeyStorePath(path + ".does_not_exist")
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setKeyStorePath(path + ".does_not_exist")
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadKeyStoreWithNullFilePath() throws Exception {
-        new PEMFileLoader.Builder()
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PEMFileLoader.Builder()
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = KeyStoreException.class)
-    public void testLoadKeyStoreWithWrongFileType() throws Exception {
-        // Trying to load a JKS file with PEM loader should fail
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(KeyStoreException.class, () -> {
+            // Trying to load a JKS file with PEM loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
         KeyStore ts = new PEMFileLoader.Builder()
             .setTrustStorePath(path)
@@ -116,26 +121,42 @@ public void testLoadTrustStore() throws Exception {
         assertEquals(1, ts.size());
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setTrustStorePath(path + ".does_not_exist")
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setTrustStorePath(path + ".does_not_exist")
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadTrustStoreWithNullFilePath() throws Exception {
-        new PEMFileLoader.Builder()
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PEMFileLoader.Builder()
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStoreWithWrongFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Trying to load a JKS file with PEM loader should fail
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
         KeyStore ts = new PEMFileLoader.Builder()
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java
index 63d668315e2..93211f644db 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java
@@ -18,44 +18,21 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.KeyStore;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class PKCS12FileLoaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public PKCS12FileLoaderTest(
-        final X509KeyType caKeyType,
-        final X509KeyType certKeyType,
-        final String keyPassword,
-        final Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                                      .setTempDir(tempDir)
-                                      .setKeyStorePassword(keyPassword)
-                                      .setKeyStoreKeyType(certKeyType)
-                                      .setTrustStorePassword(keyPassword)
-                                      .setTrustStoreKeyType(caKeyType)
-                                      .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
         KeyStore ks = new PKCS12FileLoader.Builder()
             .setKeyStorePath(path)
@@ -65,47 +42,75 @@ public void testLoadKeyStore() throws Exception {
         assertEquals(1, ks.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadKeyStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword("wrong password")
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword("wrong password")
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePath(path + ".does_not_exist")
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePath(path + ".does_not_exist")
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadKeyStoreWithNullFilePath() throws Exception {
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with PKCS12 loader should fail
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with PKCS12 loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
         KeyStore ts = new PKCS12FileLoader.Builder()
             .setTrustStorePath(path)
@@ -115,43 +120,67 @@ public void testLoadTrustStore() throws Exception {
         assertEquals(1, ts.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadTrustStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePath(path)
-            .setTrustStorePassword("wrong password")
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePath(path)
+                    .setTrustStorePassword("wrong password")
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePath(path + ".does_not_exist")
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePath(path + ".does_not_exist")
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadTrustStoreWithNullFilePath() throws Exception {
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with PKCS12 loader should fail
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePath(path)
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with PKCS12 loader should fail
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePath(path)
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java
index c7661647d91..1fac57f3365 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java
@@ -18,29 +18,34 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class PathTrieTest {
 
     private PathTrie pathTrie;
 
-    @Before
+    @BeforeEach
     public void before() {
         this.pathTrie = new PathTrie();
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void addNullPath() {
-        this.pathTrie.addPath(null);
+        assertThrows(NullPointerException.class, () -> {
+            this.pathTrie.addPath(null);
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void addIllegalPath() {
-        this.pathTrie.addPath("");
+        assertThrows(IllegalArgumentException.class, () -> {
+            this.pathTrie.addPath("");
+        });
     }
 
     @Test
@@ -59,14 +64,18 @@ public void addPathToRootLeaves() {
         assertTrue(this.pathTrie.existsNode("/node1/node3"));
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void deleteNullPath() {
-        this.pathTrie.deletePath(null);
+        assertThrows(NullPointerException.class, () -> {
+            this.pathTrie.deletePath(null);
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void deleteIllegalPath() {
-        this.pathTrie.deletePath("");
+        assertThrows(IllegalArgumentException.class, () -> {
+            this.pathTrie.deletePath("");
+        });
     }
 
     @Test
@@ -122,9 +131,11 @@ public void deleteRootPath() {
         assertTrue(this.pathTrie.existsNode("/node1/node3"));
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void findMaxPrefixNullPath() {
-        this.pathTrie.findMaxPrefix(null);
+        assertThrows(NullPointerException.class, () -> {
+            this.pathTrie.findMaxPrefix(null);
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
index 0d08286648c..25bb55df2be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
@@ -18,8 +18,9 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class PathUtilsTest extends ZKTestCase {
 
@@ -28,44 +29,60 @@ public void testValidatePath_ValidPath() {
         PathUtils.validatePath("/this is / a valid/path");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_Null() {
-        PathUtils.validatePath(null);
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath(null);
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_EmptyString() {
-        PathUtils.validatePath("");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_NotAbsolutePath() {
-        PathUtils.validatePath("not/valid");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("not/valid");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_EndsWithSlash() {
-        PathUtils.validatePath("/ends/with/slash/");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/ends/with/slash/");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_ContainsNullCharacter() {
-        PathUtils.validatePath("/test\u0000");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u0000");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_DoubleSlash() {
-        PathUtils.validatePath("/double//slash");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/double//slash");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_SinglePeriod() {
-        PathUtils.validatePath("/single/./period");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/single/./period");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_DoublePeriod() {
-        PathUtils.validatePath("/double/../period");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/double/../period");
+        });
     }
 
     @Test
@@ -74,14 +91,18 @@ public void testValidatePath_NameContainingPeriod() {
         PathUtils.validatePath("/name/with.period.");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x01() {
-        PathUtils.validatePath("/test\u0001");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u0001");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x1F() {
-        PathUtils.validatePath("/test\u001F");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u001F");
+        });
     }
 
     @Test // The first allowable character
@@ -95,24 +116,32 @@ public void testValidatePath_0x7e() {
         PathUtils.validatePath("/test\u007e");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x7f() {
-        PathUtils.validatePath("/test\u007f");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u007f");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x9f() {
-        PathUtils.validatePath("/test\u009f");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u009f");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_ud800() {
-        PathUtils.validatePath("/test\ud800");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\ud800");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_uf8ff() {
-        PathUtils.validatePath("/test\uf8ff");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\uf8ff");
+        });
     }
 
     @Test
@@ -120,9 +149,11 @@ public void testValidatePath_HighestAllowableChar() {
         PathUtils.validatePath("/test\uffef");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_SupplementaryChar() {
-        PathUtils.validatePath("/test\ufff0");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\ufff0");
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
index 85077be1f95..bd8ace79be9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -27,7 +27,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Command line program for demonstrating robustness to clock
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index 05d216b2b3b..ad5eef86f9a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
@@ -29,7 +30,6 @@
 import java.net.Socket;
 import java.security.NoSuchAlgorithmException;
 import java.security.Security;
-import java.util.Collection;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
@@ -50,13 +50,11 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class X509UtilTest extends BaseX509ParameterizedTestCase {
 
     private X509Util x509Util;
@@ -65,30 +63,10 @@ public class X509UtilTest extends BaseX509ParameterizedTestCase {
         "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"
     };
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public X509UtilTest(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                                      .setTempDir(tempDir)
-                                      .setKeyStorePassword(keyPassword)
-                                      .setKeyStoreKeyType(certKeyType)
-                                      .setTrustStorePassword(keyPassword)
-                                      .setTrustStoreKeyType(caKeyType)
-                                      .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Before
-    public void setUp() throws Exception {
+    public void init(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        super.init(caKeyType, certKeyType, keyPassword, paramIndex);
         try (X509Util x509util = new ClientX509Util()) {
             x509TestContext.setSystemProperties(x509util, KeyStoreFileType.JKS, KeyStoreFileType.JKS);
         }
@@ -97,7 +75,7 @@ public void setUp() throws Exception {
         x509Util = new ClientX509Util();
     }
 
-    @After
+    @AfterEach
     public void cleanUp() {
         x509TestContext.clearSystemProperties(x509Util);
         System.clearProperty(x509Util.getSslOcspEnabledProperty());
@@ -114,37 +92,64 @@ public void cleanUp() {
         x509Util.close();
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithoutCustomProtocol() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithoutCustomProtocol(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         SSLContext sslContext = x509Util.getDefaultSSLContext();
         assertEquals(X509Util.DEFAULT_PROTOCOL, sslContext.getProtocol());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithCustomProtocol() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithCustomProtocol(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
         final String protocol = "TLSv1.1";
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.setProperty(x509Util.getSslProtocolProperty(), protocol);
         SSLContext sslContext = x509Util.getDefaultSSLContext();
         assertEquals(protocol, sslContext.getProtocol());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithoutKeyStoreLocation() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithoutKeyStoreLocation(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.clearProperty(x509Util.getSslKeystoreLocationProperty());
         x509Util.getDefaultSSLContext();
     }
 
-    @Test(timeout = 5000, expected = X509Exception.SSLContextException.class)
-    public void testCreateSSLContextWithoutKeyStorePassword() throws Exception {
-        if (!x509TestContext.isKeyStoreEncrypted()) {
-            throw new X509Exception.SSLContextException("");
-        }
-        System.clearProperty(x509Util.getSslKeystorePasswdProperty());
-        x509Util.getDefaultSSLContext();
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithoutKeyStorePassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.SSLContextException.class, () -> {
+            if (!x509TestContext.isKeyStoreEncrypted()) {
+                throw new X509Exception.SSLContextException("");
+            }
+            System.clearProperty(x509Util.getSslKeystorePasswdProperty());
+            x509Util.getDefaultSSLContext();
+        });
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithCustomCipherSuites() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithCustomCipherSuites(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         SSLSocket sslSocket = x509Util.createSSLSocket();
         assertArrayEquals(customCipherSuites, sslSocket.getEnabledCipherSuites());
@@ -152,8 +157,13 @@ public void testCreateSSLContextWithCustomCipherSuites() throws Exception {
 
     // It would be great to test the value of PKIXBuilderParameters#setRevocationEnabled but it does not appear to be
     // possible
-    @Test(timeout = 5000)
-    public void testCRLEnabled() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCRLEnabled(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.setProperty(x509Util.getSslCrlEnabledProperty(), "true");
         x509Util.getDefaultSSLContext();
         assertTrue(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
@@ -161,16 +171,26 @@ public void testCRLEnabled() throws Exception {
         assertFalse(Boolean.valueOf(Security.getProperty("ocsp.enable")));
     }
 
-    @Test(timeout = 5000)
-    public void testCRLDisabled() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCRLDisabled(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         x509Util.getDefaultSSLContext();
         assertFalse(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
         assertFalse(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
         assertFalse(Boolean.valueOf(Security.getProperty("ocsp.enable")));
     }
 
-    @Test(timeout = 5000)
-    public void testOCSPEnabled() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testOCSPEnabled(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.setProperty(x509Util.getSslOcspEnabledProperty(), "true");
         x509Util.getDefaultSSLContext();
         assertTrue(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
@@ -178,23 +198,38 @@ public void testOCSPEnabled() throws Exception {
         assertTrue(Boolean.valueOf(Security.getProperty("ocsp.enable")));
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLSocket() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLSocket(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         SSLSocket sslSocket = x509Util.createSSLSocket();
         assertArrayEquals(customCipherSuites, sslSocket.getEnabledCipherSuites());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLServerSocketWithoutPort() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLServerSocketWithoutPort(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         SSLServerSocket sslServerSocket = x509Util.createSSLServerSocket();
         assertArrayEquals(customCipherSuites, sslServerSocket.getEnabledCipherSuites());
         assertTrue(sslServerSocket.getNeedClientAuth());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLServerSocketWithPort() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLServerSocketWithPort(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         int port = PortAssignment.unique();
         SSLServerSocket sslServerSocket = x509Util.createSSLServerSocket(port);
@@ -203,8 +238,12 @@ public void testCreateSSLServerSocketWithPort() throws Exception {
         assertTrue(sslServerSocket.getNeedClientAuth());
     }
 
-    @Test
-    public void testLoadPEMKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PEM file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -212,8 +251,12 @@ public void testLoadPEMKeyStore() throws Exception {
             KeyStoreFileType.PEM.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPEMKeyStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getKeyStorePassword().isEmpty()) {
             return;
         }
@@ -224,8 +267,12 @@ public void testLoadPEMKeyStoreNullPassword() throws Exception {
             KeyStoreFileType.PEM.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPEMKeyStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PEM file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -233,17 +280,27 @@ public void testLoadPEMKeyStoreAutodetectStoreFileType() throws Exception {
             null /* null StoreFileType means 'autodetect from file extension' */);
     }
 
-    @Test(expected = X509Exception.KeyManagerException.class)
-    public void testLoadPEMKeyStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509KeyManager km = X509Util.createKeyManager(
-            x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
-            "wrong password", // intentionally use the wrong password
-            KeyStoreFileType.PEM.getPropertyValue());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.KeyManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509KeyManager km = X509Util.createKeyManager(
+                    x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
+                    "wrong password", // intentionally use the wrong password
+                    KeyStoreFileType.PEM.getPropertyValue());
+        });
     }
 
-    @Test
-    public void testLoadPEMTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PEM file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -254,8 +311,12 @@ public void testLoadPEMTrustStore() throws Exception {
             true);
     }
 
-    @Test
-    public void testLoadPEMTrustStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMTrustStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getTrustStorePassword().isEmpty()) {
             return;
         }
@@ -271,8 +332,12 @@ public void testLoadPEMTrustStoreNullPassword() throws Exception {
 
     }
 
-    @Test
-    public void testLoadPEMTrustStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMTrustStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PEM file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -284,8 +349,12 @@ public void testLoadPEMTrustStoreAutodetectStoreFileType() throws Exception {
             true);
     }
 
-    @Test
-    public void testLoadJKSKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the JKS file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -293,8 +362,12 @@ public void testLoadJKSKeyStore() throws Exception {
             KeyStoreFileType.JKS.getPropertyValue());
     }
 
-    @Test
-    public void testLoadJKSKeyStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getKeyStorePassword().isEmpty()) {
             return;
         }
@@ -305,8 +378,12 @@ public void testLoadJKSKeyStoreNullPassword() throws Exception {
             KeyStoreFileType.JKS.getPropertyValue());
     }
 
-    @Test
-    public void testLoadJKSKeyStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the JKS file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -314,17 +391,27 @@ public void testLoadJKSKeyStoreAutodetectStoreFileType() throws Exception {
             null /* null StoreFileType means 'autodetect from file extension' */);
     }
 
-    @Test(expected = X509Exception.KeyManagerException.class)
-    public void testLoadJKSKeyStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509KeyManager km = X509Util.createKeyManager(
-            x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.JKS.getPropertyValue());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.KeyManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509KeyManager km = X509Util.createKeyManager(
+                    x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.JKS.getPropertyValue());
+        });
     }
 
-    @Test
-    public void testLoadJKSTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the JKS file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -336,8 +423,12 @@ public void testLoadJKSTrustStore() throws Exception {
             true);
     }
 
-    @Test
-    public void testLoadJKSTrustStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getTrustStorePassword().isEmpty()) {
             return;
         }
@@ -352,8 +443,12 @@ public void testLoadJKSTrustStoreNullPassword() throws Exception {
             true);
     }
 
-    @Test
-    public void testLoadJKSTrustStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the JKS file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -365,21 +460,31 @@ public void testLoadJKSTrustStoreAutodetectStoreFileType() throws Exception {
             true);
     }
 
-    @Test(expected = X509Exception.TrustManagerException.class)
-    public void testLoadJKSTrustStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509TrustManager tm = X509Util.createTrustManager(
-            x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.JKS.getPropertyValue(),
-            true,
-            true,
-            true,
-            true);
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.TrustManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509TrustManager tm = X509Util.createTrustManager(
+                    x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.JKS.getPropertyValue(),
+                    true,
+                    true,
+                    true,
+                    true);
+        });
     }
 
-    @Test
-    public void testLoadPKCS12KeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PKCS12 file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -387,8 +492,12 @@ public void testLoadPKCS12KeyStore() throws Exception {
             KeyStoreFileType.PKCS12.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPKCS12KeyStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getKeyStorePassword().isEmpty()) {
             return;
         }
@@ -399,8 +508,12 @@ public void testLoadPKCS12KeyStoreNullPassword() throws Exception {
             KeyStoreFileType.PKCS12.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPKCS12KeyStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PKCS12 file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -408,17 +521,27 @@ public void testLoadPKCS12KeyStoreAutodetectStoreFileType() throws Exception {
             null /* null StoreFileType means 'autodetect from file extension' */);
     }
 
-    @Test(expected = X509Exception.KeyManagerException.class)
-    public void testLoadPKCS12KeyStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509KeyManager km = X509Util.createKeyManager(
-            x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.PKCS12.getPropertyValue());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.KeyManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509KeyManager km = X509Util.createKeyManager(
+                    x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.PKCS12.getPropertyValue());
+        });
     }
 
-    @Test
-    public void testLoadPKCS12TrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PKCS12 file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -429,8 +552,12 @@ public void testLoadPKCS12TrustStore() throws Exception {
             true);
     }
 
-    @Test
-    public void testLoadPKCS12TrustStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getTrustStorePassword().isEmpty()) {
             return;
         }
@@ -445,8 +572,12 @@ public void testLoadPKCS12TrustStoreNullPassword() throws Exception {
             true);
     }
 
-    @Test
-    public void testLoadPKCS12TrustStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PKCS12 file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -458,21 +589,31 @@ public void testLoadPKCS12TrustStoreAutodetectStoreFileType() throws Exception {
             true);
     }
 
-    @Test(expected = X509Exception.TrustManagerException.class)
-    public void testLoadPKCS12TrustStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509TrustManager tm = X509Util.createTrustManager(
-            x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.PKCS12.getPropertyValue(),
-            true,
-            true,
-            true,
-            true);
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.TrustManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509TrustManager tm = X509Util.createTrustManager(
+                    x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.PKCS12.getPropertyValue(),
+                    true,
+                    true,
+                    true,
+                    true);
+        });
     }
 
-    @Test
-    public void testGetSslHandshakeDetectionTimeoutMillisProperty() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetSslHandshakeDetectionTimeoutMillisProperty(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         assertEquals(X509Util.DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS, x509Util.getSslHandshakeTimeoutMillis());
         // Note: need to create a new ClientX509Util each time to pick up modified property value
         String newPropertyString = Integer.toString(X509Util.DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS + 1);
@@ -493,16 +634,26 @@ public void testGetSslHandshakeDetectionTimeoutMillisProperty() {
         }
     }
 
-    @Test(expected = X509Exception.SSLContextException.class)
-    public void testCreateSSLContext_invalidCustomSSLContextClass() throws Exception {
-        ZKConfig zkConfig = new ZKConfig();
-        ClientX509Util clientX509Util = new ClientX509Util();
-        zkConfig.setProperty(clientX509Util.getSslContextSupplierClassProperty(), String.class.getCanonicalName());
-        clientX509Util.createSSLContext(zkConfig);
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_invalidCustomSSLContextClass(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.SSLContextException.class, () -> {
+            ZKConfig zkConfig = new ZKConfig();
+            ClientX509Util clientX509Util = new ClientX509Util();
+            zkConfig.setProperty(clientX509Util.getSslContextSupplierClassProperty(), String.class.getCanonicalName());
+            clientX509Util.createSSLContext(zkConfig);
+        });
     }
 
-    @Test
-    public void testCreateSSLContext_validCustomSSLContextClass() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_validCustomSSLContextClass(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         ZKConfig zkConfig = new ZKConfig();
         ClientX509Util clientX509Util = new ClientX509Util();
         zkConfig.setProperty(clientX509Util.getSslContextSupplierClassProperty(), SslContextSupplier.class.getName());
@@ -532,103 +683,135 @@ private static void forceClose(ServerSocket s) {
 
     // This test makes sure that client-initiated TLS renegotiation does not
     // succeed. We explicitly disable it at the top of X509Util.java.
-    @Test(expected = SSLHandshakeException.class)
-    public void testClientRenegotiationFails() throws Throwable {
-        int port = PortAssignment.unique();
-        ExecutorService workerPool = Executors.newCachedThreadPool();
-        final SSLServerSocket listeningSocket = x509Util.createSSLServerSocket();
-        SSLSocket clientSocket = null;
-        SSLSocket serverSocket = null;
-        final AtomicInteger handshakesCompleted = new AtomicInteger(0);
-        final CountDownLatch handshakeCompleted = new CountDownLatch(1);
-        try {
-            InetSocketAddress localServerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), port);
-            listeningSocket.bind(localServerAddress);
-            Future<SSLSocket> acceptFuture;
-            acceptFuture = workerPool.submit(new Callable<SSLSocket>() {
-                @Override
-                public SSLSocket call() throws Exception {
-                    SSLSocket sslSocket = (SSLSocket) listeningSocket.accept();
-                    sslSocket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
-                        @Override
-                        public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent) {
-                            handshakesCompleted.getAndIncrement();
-                            handshakeCompleted.countDown();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testClientRenegotiationFails(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Throwable {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(SSLHandshakeException.class, () -> {
+            int port = PortAssignment.unique();
+            ExecutorService workerPool = Executors.newCachedThreadPool();
+            final SSLServerSocket listeningSocket = x509Util.createSSLServerSocket();
+            SSLSocket clientSocket = null;
+            SSLSocket serverSocket = null;
+            final AtomicInteger handshakesCompleted = new AtomicInteger(0);
+            final CountDownLatch handshakeCompleted = new CountDownLatch(1);
+            try {
+                InetSocketAddress localServerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), port);
+                listeningSocket.bind(localServerAddress);
+                Future<SSLSocket> acceptFuture;
+                acceptFuture = workerPool.submit(new Callable<SSLSocket>() {
+                    @Override
+                    public SSLSocket call() throws Exception {
+                        SSLSocket sslSocket = (SSLSocket) listeningSocket.accept();
+                        sslSocket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
+                            @Override
+                            public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent) {
+                                handshakesCompleted.getAndIncrement();
+                                handshakeCompleted.countDown();
+                            }
+                        });
+                        assertEquals(1, sslSocket.getInputStream().read());
+                        try {
+                            // 2nd read is after the renegotiation attempt and will fail
+                            sslSocket.getInputStream().read();
+                            return sslSocket;
+                        } catch (Exception e) {
+                            forceClose(sslSocket);
+                            throw e;
                         }
-                    });
-                    assertEquals(1, sslSocket.getInputStream().read());
-                    try {
-                        // 2nd read is after the renegotiation attempt and will fail
-                        sslSocket.getInputStream().read();
-                        return sslSocket;
-                    } catch (Exception e) {
-                        forceClose(sslSocket);
-                        throw e;
                     }
+                });
+                clientSocket = x509Util.createSSLSocket();
+                clientSocket.connect(localServerAddress);
+                clientSocket.getOutputStream().write(1);
+                // Attempt to renegotiate after establishing the connection
+                clientSocket.startHandshake();
+                clientSocket.getOutputStream().write(1);
+                // The exception is thrown on the server side, we need to unwrap it
+                try {
+                    serverSocket = acceptFuture.get();
+                } catch (ExecutionException e) {
+                    throw e.getCause();
                 }
-            });
-            clientSocket = x509Util.createSSLSocket();
-            clientSocket.connect(localServerAddress);
-            clientSocket.getOutputStream().write(1);
-            // Attempt to renegotiate after establishing the connection
-            clientSocket.startHandshake();
-            clientSocket.getOutputStream().write(1);
-            // The exception is thrown on the server side, we need to unwrap it
-            try {
-                serverSocket = acceptFuture.get();
-            } catch (ExecutionException e) {
-                throw e.getCause();
+            } finally {
+                forceClose(serverSocket);
+                forceClose(clientSocket);
+                forceClose(listeningSocket);
+                workerPool.shutdown();
+                // Make sure the first handshake completed and only the second
+                // one failed.
+                handshakeCompleted.await(5, TimeUnit.SECONDS);
+                assertEquals(1, handshakesCompleted.get());
             }
-        } finally {
-            forceClose(serverSocket);
-            forceClose(clientSocket);
-            forceClose(listeningSocket);
-            workerPool.shutdown();
-            // Make sure the first handshake completed and only the second
-            // one failed.
-            handshakeCompleted.await(5, TimeUnit.SECONDS);
-            assertEquals(1, handshakesCompleted.get());
-        }
+        });
     }
 
-    @Test
-    public void testGetDefaultCipherSuitesJava8() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetDefaultCipherSuitesJava8(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("1.8");
         // Java 8 default should have the CBC suites first
         assertTrue(cipherSuites[0].contains("CBC"));
     }
 
-    @Test
-    public void testGetDefaultCipherSuitesJava9() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetDefaultCipherSuitesJava9(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("9");
         // Java 9+ default should have the GCM suites first
         assertTrue(cipherSuites[0].contains("GCM"));
     }
 
-    @Test
-    public void testGetDefaultCipherSuitesJava10() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetDefaultCipherSuitesJava10(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("10");
         // Java 9+ default should have the GCM suites first
         assertTrue(cipherSuites[0].contains("GCM"));
     }
 
-    @Test
-    public void testGetDefaultCipherSuitesJava11() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetDefaultCipherSuitesJava11(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("11");
         // Java 9+ default should have the GCM suites first
         assertTrue(cipherSuites[0].contains("GCM"));
     }
 
-    @Test
-    public void testGetDefaultCipherSuitesUnknownVersion() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetDefaultCipherSuitesUnknownVersion(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("notaversion");
         // If version can't be parsed, use the more conservative Java 8 default
         assertTrue(cipherSuites[0].contains("CBC"));
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testGetDefaultCipherSuitesNullVersion() {
-        X509Util.getDefaultCipherSuitesForJavaVersion(null);
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetDefaultCipherSuitesNullVersion(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            X509Util.getDefaultCipherSuitesForJavaVersion(null);
+        });
     }
 
     // Warning: this will reset the x509Util
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
index eff1bfb3d29..c64d5e694e2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
@@ -18,30 +18,23 @@
 
 package org.apache.zookeeper.common;
 
-
-import static org.junit.Assert.assertEquals;
-import java.util.concurrent.TimeUnit;
-import org.junit.After;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
-
-
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ZKConfigTest {
 
     X509Util x509Util = new ClientX509Util();
 
-    @Rule
-    public Timeout timeout = new Timeout(10, TimeUnit.SECONDS);
-
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(x509Util.getSslProtocolProperty());
     }
 
     // property is not set we should get the default value
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyDefault() {
         ZKConfig conf = new ZKConfig();
         String prop = "UnSetProperty" + System.currentTimeMillis();
@@ -52,6 +45,7 @@ public void testBooleanRetrievalFromPropertyDefault() {
 
     // property is set to an valid boolean, we should get the set value
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromProperty() {
         boolean value = true;
         boolean defaultValue = false;
@@ -63,6 +57,7 @@ public void testBooleanRetrievalFromProperty() {
 
     // property is set but with white spaces in the beginning
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyWithWhitespacesInBeginning() {
         boolean value = true;
         boolean defaultValue = false;
@@ -74,6 +69,7 @@ public void testBooleanRetrievalFromPropertyWithWhitespacesInBeginning() {
 
     // property is set but with white spaces at the end
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyWithWhitespacesAtEnd() {
         boolean value = true;
         boolean defaultValue = false;
@@ -85,6 +81,7 @@ public void testBooleanRetrievalFromPropertyWithWhitespacesAtEnd() {
 
     // property is set but with white spaces at the beginning and the end
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyWithWhitespacesAtBeginningAndEnd() {
         boolean value = true;
         boolean defaultValue = false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
index 13f7c764238..37f29c1e8ec 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import javax.net.ssl.SSLException;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Note: These test cases (and resources) have been taken from the Apache HttpComponents project.
@@ -34,7 +34,7 @@ public class ZKHostnameVerifierTest {
 
     private ZKHostnameVerifier impl;
 
-    @Before
+    @BeforeEach
     public void setup() {
         impl = new ZKHostnameVerifier();
     }
@@ -153,7 +153,7 @@ private void exceptionPlease(final ZKHostnameVerifier hv, final String host,
                                  final X509Certificate x509) {
         try {
             hv.verify(host, x509);
-            Assert.fail("HostnameVerifier shouldn't allow [" + host + "]");
+            fail("HostnameVerifier shouldn't allow [" + host + "]");
         } catch (final SSLException e) {
             // whew!  we're okay!
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
index 66fabed7f10..c549a9ce9d6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
@@ -49,10 +49,10 @@
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
@@ -68,7 +68,7 @@ public class ZKTrustManagerTest extends ZKTestCase {
     private InetAddress mockInetAddress;
     private Socket mockSocket;
 
-    @BeforeClass
+    @BeforeAll
     public static void createKeyPair() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
         KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", BouncyCastleProvider.PROVIDER_NAME);
@@ -76,12 +76,12 @@ public static void createKeyPair() throws Exception {
         keyPair = keyPairGenerator.genKeyPair();
     }
 
-    @AfterClass
+    @AfterAll
     public static void removeBouncyCastleProvider() throws Exception {
         Security.removeProvider("BC");
     }
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         mockX509ExtendedTrustManager = mock(X509ExtendedTrustManager.class);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java
index 8b64c2b2e79..26586677bba 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java
@@ -18,17 +18,16 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Random;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -67,7 +66,7 @@ public BlueThrottleWithMockRandom(MockRandom random) {
     @Test
     public void testThrottleDisabled() {
         BlueThrottle throttler = new BlueThrottle();
-        assertTrue("Throttle should be disabled by default", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "Throttle should be disabled by default");
     }
 
     @Test
@@ -75,8 +74,8 @@ public void testThrottleWithoutRefill() {
         BlueThrottle throttler = new BlueThrottle();
         throttler.setMaxTokens(1);
         throttler.setFillTime(2000);
-        assertTrue("First request should be allowed", throttler.checkLimit(1));
-        assertFalse("Second request should be denied", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "First request should be allowed");
+        assertFalse(throttler.checkLimit(1), "Second request should be denied");
     }
 
     @Test
@@ -84,12 +83,12 @@ public void testThrottleWithRefill() throws InterruptedException {
         BlueThrottle throttler = new BlueThrottle();
         throttler.setMaxTokens(1);
         throttler.setFillTime(500);
-        assertTrue("First request should be allowed", throttler.checkLimit(1));
-        assertFalse("Second request should be denied", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "First request should be allowed");
+        assertFalse(throttler.checkLimit(1), "Second request should be denied");
 
         //wait for the bucket to be refilled
         Thread.sleep(750);
-        assertTrue("Third request should be allowed since we've got a new token", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "Third request should be allowed since we've got a new token");
     }
 
     @Test
@@ -103,21 +102,21 @@ public void testThrottleWithoutRandomDropping() throws InterruptedException {
         for (int i = 0; i < maxTokens; i++) {
             throttler.checkLimit(1);
         }
-        assertEquals("All tokens should be used up by now", throttler.getMaxTokens(), throttler.getDeficit());
+        assertEquals(throttler.getMaxTokens(), throttler.getDeficit(), "All tokens should be used up by now");
 
         Thread.sleep(110);
         throttler.checkLimit(1);
-        assertFalse("Dropping probability should still be zero", throttler.getDropChance() > 0);
+        assertFalse(throttler.getDropChance() > 0, "Dropping probability should still be zero");
 
         //allow bucket to be refilled
         Thread.sleep(1500);
 
         for (int i = 0; i < maxTokens; i++) {
-            assertTrue("The first " + maxTokens + " requests should be allowed", throttler.checkLimit(1));
+            assertTrue(throttler.checkLimit(1), "The first " + maxTokens + " requests should be allowed");
         }
 
         for (int i = 0; i < maxTokens; i++) {
-            assertFalse("The latter " + maxTokens + " requests should be denied", throttler.checkLimit(1));
+            assertFalse(throttler.checkLimit(1), "The latter " + maxTokens + " requests should be denied");
         }
     }
 
@@ -134,12 +133,12 @@ public void testThrottleWithRandomDropping() throws InterruptedException {
         for (int i = 0; i < maxTokens; i++) {
             throttler.checkLimit(1);
         }
-        assertEquals("All tokens should be used up by now", throttler.getMaxTokens(), throttler.getDeficit());
+        assertEquals(throttler.getMaxTokens(), throttler.getDeficit(), "All tokens should be used up by now");
 
         Thread.sleep(120);
         //this will trigger dropping probability being increased
         throttler.checkLimit(1);
-        assertTrue("Dropping probability should be increased", throttler.getDropChance() > 0);
+        assertTrue(throttler.getDropChance() > 0, "Dropping probability should be increased");
         LOG.info("Dropping probability is {}", throttler.getDropChance());
 
         //allow bucket to be refilled
@@ -154,7 +153,7 @@ public void testThrottleWithRandomDropping() throws InterruptedException {
         }
 
         LOG.info("Send {} requests, {} are accepted", maxTokens, accepted);
-        assertTrue("The dropping should be distributed", accepted < maxTokens);
+        assertTrue(accepted < maxTokens, "The dropping should be distributed");
 
         accepted = 0;
 
@@ -165,7 +164,7 @@ public void testThrottleWithRandomDropping() throws InterruptedException {
         }
 
         LOG.info("Send another {} requests, {} are accepted", maxTokens, accepted);
-        assertTrue("Later requests should have a chance", accepted > 0);
+        assertTrue(accepted > 0, "Later requests should have a chance");
     }
 
     private QuorumUtil quorumUtil = new QuorumUtil(1);
@@ -212,7 +211,7 @@ public void testNoThrottling() throws Exception {
 
         int connected = connect(10);
 
-        Assert.assertEquals(10, connected);
+        assertEquals(10, connected);
         shutdownQuorum();
     }
 
@@ -227,7 +226,7 @@ public void testThrottling() throws Exception {
 
 
         int connected = connect(3);
-        Assert.assertEquals(2, connected);
+        assertEquals(2, connected);
         shutdownQuorum();
 
         quorumUtil.enableLocalSession(false);
@@ -239,7 +238,7 @@ public void testThrottling() throws Exception {
 
 
         connected = connect(3);
-        Assert.assertEquals(2, connected);
+        assertEquals(2, connected);
         shutdownQuorum();
     }
 
@@ -256,7 +255,7 @@ public void testWeighedThrottling() throws Exception {
 
         //try to create 11 local sessions, 10 created, because we have only 10 tokens
         int connected = connect(11);
-        Assert.assertEquals(10, connected);
+        assertEquals(10, connected);
         shutdownQuorum();
 
         quorumUtil.enableLocalSession(false);
@@ -265,14 +264,14 @@ public void testWeighedThrottling() throws Exception {
         quorumUtil.getPeer(1).peer.getActiveServer().connThrottle().setFillCount(0);
         //tyr to create 11 global sessions, 3 created, because we have 10 tokens and each connection needs 3
         connected = connect(11);
-        Assert.assertEquals(3, connected);
+        assertEquals(3, connected);
         shutdownQuorum();
 
         quorumUtil.startAll();
         quorumUtil.getPeer(1).peer.getActiveServer().connThrottle().setMaxTokens(10);
         quorumUtil.getPeer(1).peer.getActiveServer().connThrottle().setFillCount(0);
         connected = connect(2);
-        Assert.assertEquals(2, connected);
+        assertEquals(2, connected);
 
         quorumUtil.shutdown(1);
         watchers[0].waitForDisconnected(RAPID_TIMEOUT);
@@ -293,7 +292,7 @@ public void testWeighedThrottling() throws Exception {
         }
         //each reconnect takes two tokens, we have 3, so only one reconnects
         LOG.info("reconnected {}", reconnected);
-        Assert.assertEquals(1, reconnected);
+        assertEquals(1, reconnected);
         shutdownQuorum();
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java
index 7e8c3870e14..126a49458ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java
@@ -18,22 +18,23 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ByteBufferInputStreamTest extends ZKTestCase {
 
     private static final byte[] DATA_BYTES_0 = "Apache ZooKeeper".getBytes(StandardCharsets.UTF_8);
 
     private static byte[] DATA_BYTES;
-    @BeforeClass
+    @BeforeAll
     public static void setUpClass() {
         int len = DATA_BYTES_0.length + 2;
         DATA_BYTES = new byte[len];
@@ -45,7 +46,7 @@ public static void setUpClass() {
     private ByteBuffer bb;
     private ByteBufferInputStream in;
     private byte[] bs;
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         bb = ByteBuffer.wrap(DATA_BYTES);
         in = new ByteBufferInputStream(bb);
@@ -66,9 +67,11 @@ public void testReadArrayOffsetLength() throws Exception {
         byte[] expected = new byte[]{(byte) 1, (byte) 2, DATA_BYTES[0], (byte) 4};
         assertArrayEquals(expected, bs);
     }
-    @Test(expected = IndexOutOfBoundsException.class)
+    @Test
     public void testReadArrayOffsetLength_LengthTooLarge() throws Exception {
-        in.read(bs, 2, 3);
+        assertThrows(IndexOutOfBoundsException.class, () -> {
+            in.read(bs, 2, 3);
+        });
     }
     @Test
     public void testReadArrayOffsetLength_HitEndOfStream() throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
index c57a65f7912..bcfdfcc6931 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedInputStream;
 import java.io.File;
 import java.io.FileInputStream;
@@ -43,7 +43,7 @@
 import org.apache.zookeeper.server.persistence.FileTxnLog;
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -111,7 +111,7 @@ public void testChecksums() throws Exception {
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
         LOG.info("starting up the zookeeper server .. waiting");
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             for (int i = 0; i < 2000; i++) {
@@ -122,7 +122,7 @@ public void testChecksums() throws Exception {
         }
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
 
         File versionDir = new File(tmpDir, "version-2");
         File[] list = versionDir.listFiles();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
index 2b10f9be137..45d5c67ecf9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.server.NIOServerCnxnFactory.ZOOKEEPER_NIO_SESSIONLESS_CNXN_TIMEOUT;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -41,7 +41,7 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
index b1aa70932cd..6722473f2a5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
@@ -43,13 +43,17 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class CreateContainerTest extends ClientBase {
 
     private ZooKeeper zk;
     private Semaphore completedContainerDeletions;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -68,19 +72,22 @@ public void addCommittedProposal(Request request) {
         serverFactory.zkServer.setZKDatabase(testDatabase);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
         zk.close();
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCreate() throws KeeperException, InterruptedException {
         createNoStatVerifyResult("/foo");
         createNoStatVerifyResult("/foo/child");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCreateWithStat() throws KeeperException, InterruptedException {
         Stat stat = createWithStatVerifyResult("/foo");
         Stat childStat = createWithStatVerifyResult("/foo/child");
@@ -89,7 +96,8 @@ public void testCreateWithStat() throws KeeperException, InterruptedException {
     }
 
     @SuppressWarnings("ConstantConditions")
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCreateWithNullStat() throws KeeperException, InterruptedException {
         final String name = "/foo";
         assertNull(zk.exists(name, false));
@@ -102,7 +110,8 @@ public void testCreateWithNullStat() throws KeeperException, InterruptedExceptio
         assertNotNull(zk.exists(name, false));
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSimpleDeletion() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -112,10 +121,11 @@ public void testSimpleDeletion() throws KeeperException, InterruptedException {
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMultiWithContainerSimple() throws KeeperException, InterruptedException {
         Op createContainer = Op.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.multi(Collections.singletonList(createContainer));
@@ -124,7 +134,8 @@ public void testMultiWithContainerSimple() throws KeeperException, InterruptedEx
         assertEquals(dataTree.getContainers().size(), 1);
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMultiWithContainer() throws KeeperException, InterruptedException {
         Op createContainer = Op.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         Op createChild = Op.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -139,7 +150,7 @@ public void testMultiWithContainer() throws KeeperException, InterruptedExceptio
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
 
         createContainer = Op.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         createChild = Op.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -149,10 +160,11 @@ public void testMultiWithContainer() throws KeeperException, InterruptedExceptio
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSimpleDeletionAsync() throws KeeperException, InterruptedException {
         final CountDownLatch latch = new CountDownLatch(1);
         AsyncCallback.Create2Callback cb = (rc, path, ctx, name, stat) -> {
@@ -168,10 +180,11 @@ public void testSimpleDeletionAsync() throws KeeperException, InterruptedExcepti
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCascadingDeletion() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
@@ -184,28 +197,29 @@ public void testCascadingDeletion() throws KeeperException, InterruptedException
         containerManager.checkContainers();
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
 
-        assertNull("Container should have been deleted", zk.exists("/foo/bar", false));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo/bar", false), "Container should have been deleted");
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFalseEmpty() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         ContainerManager containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor, 1, 100) {
-            @Override
-            protected Collection<String> getCandidates() {
+            @Override protected Collection<String> getCandidates() {
                 return Collections.singletonList("/foo");
             }
         };
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNotNull("Container should have not been deleted", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Container should have not been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMaxPerMinute() throws InterruptedException {
         final BlockingQueue<String> queue = new LinkedBlockingQueue<String>();
         RequestProcessor processor = new RequestProcessor() {
@@ -246,7 +260,8 @@ public Void call() throws Exception {
         assertEquals(queue.poll(5, TimeUnit.SECONDS), "/four");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMaxNeverUsedInterval() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         AtomicLong elapsed = new AtomicLong(0);
@@ -265,49 +280,48 @@ protected long getElapsed(DataNode node) {
         };
         containerManager.checkContainers(); // elapsed time will appear to be 0 - container will not get deleted
         assertEquals(deletesQty.get(), 0);
-        assertNotNull("Container should not have been deleted", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Container should not have been deleted");
 
         elapsed.set(10000);
         containerManager.checkContainers(); // elapsed time will appear to be 10000 - container should get deleted
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testZeroMaxNeverUsedInterval() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         AtomicInteger deletesQty = new AtomicInteger(0);
         ContainerManager containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor, 1, 100, 0) {
-            @Override
-            protected void postDeleteRequest(Request request) throws RequestProcessor.RequestProcessorException {
+            @Override protected void postDeleteRequest(Request request) throws RequestProcessor.RequestProcessorException {
                 deletesQty.incrementAndGet();
                 super.postDeleteRequest(request);
             }
 
-            @Override
-            protected long getElapsed(DataNode node) {
+            @Override protected long getElapsed(DataNode node) {
                 return 10000;   // some number greater than 0
             }
         };
         containerManager.checkContainers(); // elapsed time will appear to be 0 - container will not get deleted
         assertEquals(deletesQty.get(), 0);
-        assertNotNull("Container should not have been deleted", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Container should not have been deleted");
     }
 
     private void createNoStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         zk.create(newName, newName.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
-        assertNotNull("Node was not created as expected", zk.exists(newName, false));
+        assertNotNull(zk.exists(newName, false), "Node was not created as expected");
     }
 
     private Stat createWithStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         Stat stat = new Stat();
         zk.create(newName, newName.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER, stat);
         validateCreateStat(stat, newName);
 
         Stat referenceStat = zk.exists(newName, false);
-        assertNotNull("Node was not created as expected", referenceStat);
+        assertNotNull(referenceStat, "Node was not created as expected");
         assertEquals(referenceStat, stat);
 
         return stat;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
index d48f7132242..2cf5db4a592 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
@@ -41,7 +42,10 @@
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInfo;
 
 public class CreateTTLTest extends ClientBase {
 
@@ -51,13 +55,20 @@ public class CreateTTLTest extends ClientBase {
 
     @Override
     public void setUp() throws Exception {
+        // to be able to get the test method name a testInfo object is needed
+        // to override the parent's setUp method we need this empty method
+    }
+
+    @BeforeEach
+    public void setUp(TestInfo testInfo) throws Exception {
         System.setProperty(
             EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY,
-            disabledTests.contains(getTestName()) ? "false" : "true");
+            disabledTests.contains(testInfo.getTestMethod().get().getName()) ? "false" : "true");
         super.setUpWithServerId(254);
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         System.clearProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY);
@@ -74,11 +85,11 @@ public void testCreate() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -89,16 +100,16 @@ public void testBadTTLs() throws InterruptedException, KeeperException {
         CreateTTLRequest request = new CreateTTLRequest(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL.toFlag(), -100);
         CreateResponse response = new CreateResponse();
         ReplyHeader r = zk.submitRequest(h, request, response, null);
-        assertEquals("An invalid CreateTTLRequest should throw BadArguments", r.getErr(), Code.BADARGUMENTS.intValue());
-        assertNull("An invalid CreateTTLRequest should not result in znode creation", zk.exists(path, false));
+        assertEquals(r.getErr(), Code.BADARGUMENTS.intValue(), "An invalid CreateTTLRequest should throw BadArguments");
+        assertNull(zk.exists(path, false), "An invalid CreateTTLRequest should not result in znode creation");
 
         request = new CreateTTLRequest(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL.toFlag(),
                                        EphemeralType.TTL.maxValue()
                                                + 1);
         response = new CreateResponse();
         r = zk.submitRequest(h, request, response, null);
-        assertEquals("An invalid CreateTTLRequest should throw BadArguments", r.getErr(), Code.BADARGUMENTS.intValue());
-        assertNull("An invalid CreateTTLRequest should not result in znode creation", zk.exists(path, false));
+        assertEquals(r.getErr(), Code.BADARGUMENTS.intValue(), "An invalid CreateTTLRequest should throw BadArguments");
+        assertNull(zk.exists(path, false), "An invalid CreateTTLRequest should not result in znode creation");
     }
 
     @Test
@@ -109,8 +120,8 @@ public void testMaxTTLs() throws InterruptedException, KeeperException {
         CreateTTLRequest request = new CreateTTLRequest(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL.toFlag(), EphemeralType.TTL.maxValue());
         CreateResponse response = new CreateResponse();
         ReplyHeader r = zk.submitRequest(h, request, response, null);
-        assertEquals("EphemeralType.getMaxTTL() should succeed", r.getErr(), Code.OK.intValue());
-        assertNotNull("Node should exist", zk.exists(path, false));
+        assertEquals(r.getErr(), Code.OK.intValue(), "EphemeralType.getMaxTTL() should succeed");
+        assertNotNull(zk.exists(path, false), "Node should exist");
     }
 
     @Test
@@ -122,11 +133,11 @@ public void testCreateSequential() throws KeeperException, InterruptedException
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists(path, false));
+        assertNotNull(zk.exists(path, false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists(path, false));
+        assertNull(zk.exists(path, false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -139,11 +150,11 @@ public void testCreateAsync() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -155,18 +166,18 @@ public void testModifying() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         for (int i = 0; i < 10; ++i) {
             fakeElapsed.set(50);
             zk.setData("/foo", new byte[i + 1], -1);
             containerManager.checkContainers();
-            assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+            assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
         }
 
         fakeElapsed.set(200);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -180,21 +191,21 @@ public void testMulti() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("node should not have been deleted yet", zk.exists("/a", false));
-        assertNotNull("node should not have been deleted yet", zk.exists(sequentialPath, false));
-        assertNotNull("node should never be deleted", zk.exists("/c", false));
+        assertNotNull(zk.exists("/a", false), "node should not have been deleted yet");
+        assertNotNull(zk.exists(sequentialPath, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists("/c", false), "node should never be deleted");
 
         fakeElapsed.set(110);
         containerManager.checkContainers();
-        assertNull("node should have been deleted", zk.exists("/a", false));
-        assertNotNull("node should not have been deleted yet", zk.exists(sequentialPath, false));
-        assertNotNull("node should never be deleted", zk.exists("/c", false));
+        assertNull(zk.exists("/a", false), "node should have been deleted");
+        assertNotNull(zk.exists(sequentialPath, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists("/c", false), "node should never be deleted");
 
         fakeElapsed.set(210);
         containerManager.checkContainers();
-        assertNull("node should have been deleted", zk.exists("/a", false));
-        assertNull("node should have been deleted", zk.exists(sequentialPath, false));
-        assertNotNull("node should never be deleted", zk.exists("/c", false));
+        assertNull(zk.exists("/a", false), "node should have been deleted");
+        assertNull(zk.exists(sequentialPath, false), "node should have been deleted");
+        assertNotNull(zk.exists("/c", false), "node should never be deleted");
     }
 
     @Test
@@ -236,10 +247,12 @@ public void testBadUsage() throws KeeperException, InterruptedException {
         }
     }
 
-    @Test(expected = KeeperException.UnimplementedException.class)
+    @Test
     public void testDisabled() throws KeeperException, InterruptedException {
-        // note, setUp() enables this test based on the test name
-        zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, new Stat(), 100);
+        assertThrows(KeeperException.UnimplementedException.class, () -> {
+            // note, setUp() enables this test based on the test name
+            zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, new Stat(), 100);
+        });
     }
 
     private ContainerManager newContainerManager(final AtomicLong fakeElapsed) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
index 0fb6f686479..c123f69f007 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.Set;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class DataNodeTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
index da9a12a3c52..fe83b76d884 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.DataInputStream;
@@ -51,7 +51,8 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,7 +64,8 @@ public class DataTreeTest extends ZKTestCase {
      * For ZOOKEEPER-1755 - Test race condition when taking dumpEphemerals and
      * removing the session related ephemerals from DataTree structure
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testDumpEphemerals() throws Exception {
         int count = 1000;
         long session = 1000;
@@ -91,7 +93,7 @@ public void run() {
         killZkClientSession(session, zxid, dataTree, count);
         running.set(false);
         thread.join();
-        assertFalse("Should have got exception while dumpEphemerals!", exceptionDuringDumpEphemerals.get());
+        assertFalse(exceptionDuringDumpEphemerals.get(), "Should have got exception while dumpEphemerals!");
     }
 
     private void killZkClientSession(long session, long zxid, final DataTree dataTree, int count) {
@@ -107,7 +109,8 @@ private void createEphemeralNode(long session, final DataTree dataTree, int coun
         }
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testRootWatchTriggered() throws Exception {
         DataTree dt = new DataTree();
 
@@ -122,13 +125,14 @@ public void testRootWatchTriggered() throws Exception {
         // add a new node, should trigger a watch
         dt.createNode("/xyz", new byte[0], null, 0, dt.getNode("/").stat.getCversion() + 1, 1, 1);
 
-        assertTrue("Root node watch not triggered", fire.isDone());
+        assertTrue(fire.isDone(), "Root node watch not triggered");
     }
 
     /**
      * For ZOOKEEPER-1046 test if cversion is getting incremented correctly.
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testIncrementCversion() throws Exception {
         try {
             // digestCalculator gets initialized for the new DataTree constructor based on the system property
@@ -142,15 +146,9 @@ public void testIncrementCversion() throws Exception {
             dt.setCversionPzxid("/test/", prevCversion + 1, prevPzxid + 1);
             int newCversion = zk.stat.getCversion();
             long newPzxid = zk.stat.getPzxid();
-            assertTrue("<cversion, pzxid> verification failed. Expected: <"
-                                      + (prevCversion + 1)
-                                      + ", "
-                                      + (prevPzxid + 1)
-                                      + ">, found: <"
-                                      + newCversion
-                                      + ", "
-                                      + newPzxid
-                                      + ">", (newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1));
+            assertTrue((newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1),
+                "<cversion, pzxid> verification failed. Expected: <" + (prevCversion + 1) + ", "
+                    + (prevPzxid + 1) + ">, found: <" + newCversion + ", " + newPzxid + ">");
             assertNotEquals(digestBefore, dt.getTreeDigest());
         } finally {
             ZooKeeperServer.setDigestEnabled(false);
@@ -168,7 +166,8 @@ public void testNoCversionRevert() throws Exception {
         parent = dt.getNode("/");
         int newCversion = parent.stat.getCversion();
         long newPzxid = parent.stat.getPzxid();
-        assertTrue("<cversion, pzxid> verification failed. Expected: <"
+        assertTrue((newCversion >= currentCversion && newPzxid >= currentPzxid),
+            "<cversion, pzxid> verification failed. Expected: <"
                                   + currentCversion
                                   + ", "
                                   + currentPzxid
@@ -176,7 +175,7 @@ public void testNoCversionRevert() throws Exception {
                                   + newCversion
                                   + ", "
                                   + newPzxid
-                                  + ">", (newCversion >= currentCversion && newPzxid >= currentPzxid));
+                                  + ">");
     }
 
     @Test
@@ -226,7 +225,8 @@ public void testDigestUpdatedWhenReplayCreateTxnForExistNode() {
         }
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testPathTrieClearOnDeserialize() throws Exception {
 
         //Create a DataTree with quota nodes so PathTrie get updated
@@ -254,7 +254,7 @@ public void testPathTrieClearOnDeserialize() throws Exception {
         PathTrie pTrie = (PathTrie) pfield.get(dserTree);
 
         //Check that the node path is removed from pTrie
-        assertEquals("/bug is still in pTrie", "/", pTrie.findMaxPrefix("/bug"));
+        assertEquals("/", pTrie.findMaxPrefix("/bug"), "/bug is still in pTrie");
     }
 
 
@@ -264,10 +264,11 @@ public void testPathTrieClearOnDeserialize() throws Exception {
      * This can cause the system experiences hanging issues similar to ZooKeeper-2201.
      * This test verifies the fix that we should not hold ACL cache during dumping aclcache to snapshots
     */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testSerializeDoesntLockACLCacheWhileWriting() throws Exception {
         DataTree tree = new DataTree();
-        tree.createNode("/marker", new byte[]{42}, null, -1, 1, 1, 1);
+        tree.createNode("/marker", new byte[] { 42 }, null, -1, 1, 1, 1);
         final AtomicBoolean ranTestCase = new AtomicBoolean();
         DataOutputStream out = new DataOutputStream(new ByteArrayOutputStream());
         BinaryOutputArchive oa = new BinaryOutputArchive(out) {
@@ -290,7 +291,7 @@ public void run() {
                     boolean acquired = semaphore.tryAcquire(30, TimeUnit.SECONDS);
                     //This is the real assertion - could another thread lock
                     //the ACLCache
-                    assertTrue("Couldn't acquire a lock on the ACLCache while we were calling tree.serialize", acquired);
+                    assertTrue(acquired, "Couldn't acquire a lock on the ACLCache while we were calling tree.serialize");
                 } catch (InterruptedException e1) {
                     throw new RuntimeException(e1);
                 }
@@ -303,15 +304,16 @@ public void run() {
         tree.serialize(oa, "test");
 
         //Let's make sure that we hit the code that ran the real assertion above
-        assertTrue("Didn't find the expected node", ranTestCase.get());
+        assertTrue(ranTestCase.get(), "Didn't find the expected node");
     }
 
     /* ZOOKEEPER-3531 - similarly for aclCache.deserialize, we should not hold lock either
     */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testDeserializeDoesntLockACLCacheWhileReading() throws Exception {
         DataTree tree = new DataTree();
-        tree.createNode("/marker", new byte[]{42}, null, -1, 1, 1, 1);
+        tree.createNode("/marker", new byte[] { 42 }, null, -1, 1, 1, 1);
         final AtomicBoolean ranTestCase = new AtomicBoolean();
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         DataOutputStream out = new DataOutputStream(baos);
@@ -341,7 +343,7 @@ public void run() {
                     boolean acquired = semaphore.tryAcquire(30, TimeUnit.SECONDS);
                     //This is the real assertion - could another thread lock
                     //the ACLCache
-                    assertTrue("Couldn't acquire a lock on the ACLCache while we were calling tree.deserialize", acquired);
+                    assertTrue(acquired, "Couldn't acquire a lock on the ACLCache while we were calling tree.deserialize");
                 } catch (InterruptedException e1) {
                     throw new RuntimeException(e1);
                 }
@@ -354,7 +356,7 @@ public void run() {
         tree2.deserialize(ia, "test");
 
         //Let's make sure that we hit the code that ran the real assertion above
-        assertTrue("Didn't find the expected node", ranTestCase.get());
+        assertTrue(ranTestCase.get(), "Didn't find the expected node");
     }
 
     /*
@@ -365,10 +367,11 @@ public void run() {
      * currently being written, i.e. that DataTree.serializeNode does not hold
      * the DataNode lock while calling OutputArchive.writeRecord.
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testSerializeDoesntLockDataNodeWhileWriting() throws Exception {
         DataTree tree = new DataTree();
-        tree.createNode("/marker", new byte[]{42}, null, -1, 1, 1, 1);
+        tree.createNode("/marker", new byte[] { 42 }, null, -1, 1, 1, 1);
         final DataNode markerNode = tree.getNode("/marker");
         final AtomicBoolean ranTestCase = new AtomicBoolean();
         DataOutputStream out = new DataOutputStream(new ByteArrayOutputStream());
@@ -395,7 +398,7 @@ public void run() {
                             boolean acquired = semaphore.tryAcquire(30, TimeUnit.SECONDS);
                             //This is the real assertion - could another thread lock
                             //the DataNode we're currently writing
-                            assertTrue("Couldn't acquire a lock on the DataNode while we were calling tree.serialize", acquired);
+                            assertTrue(acquired, "Couldn't acquire a lock on the DataNode while we were calling tree.serialize");
                         } catch (InterruptedException e1) {
                             throw new RuntimeException(e1);
                         }
@@ -410,19 +413,19 @@ public void run() {
         tree.serialize(oa, "test");
 
         //Let's make sure that we hit the code that ran the real assertion above
-        assertTrue("Didn't find the expected node", ranTestCase.get());
+        assertTrue(ranTestCase.get(), "Didn't find the expected node");
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testReconfigACLClearOnDeserialize() throws Exception {
-
         DataTree tree = new DataTree();
         // simulate the upgrading scenario, where the reconfig znode
         // doesn't exist and the acl cache is empty
         tree.deleteNode(ZooDefs.CONFIG_NODE, 1);
         tree.getReferenceCountedAclCache().aclIndex = 0;
 
-        assertEquals("expected to have 1 acl in acl cache map", 0, tree.aclCacheSize());
+        assertEquals(0, tree.aclCacheSize(), "expected to have 1 acl in acl cache map");
 
         // serialize the data with one znode with acl
         tree.createNode("/bug", new byte[20], ZooDefs.Ids.OPEN_ACL_UNSAFE, -1, 1, 1, 1);
@@ -436,15 +439,15 @@ public void testReconfigACLClearOnDeserialize() throws Exception {
         BinaryInputArchive ia = BinaryInputArchive.getArchive(bais);
         tree.deserialize(ia, "test");
 
-        assertEquals("expected to have 1 acl in acl cache map", 1, tree.aclCacheSize());
-        assertEquals("expected to have the same acl", ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()));
+        assertEquals(1, tree.aclCacheSize(), "expected to have 1 acl in acl cache map");
+        assertEquals(ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()), "expected to have the same acl");
 
         // simulate the upgrading case where the config node will be created
         // again after leader election
         tree.addConfigNode();
 
-        assertEquals("expected to have 2 acl in acl cache map", 2, tree.aclCacheSize());
-        assertEquals("expected to have the same acl", ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()));
+        assertEquals(2, tree.aclCacheSize(), "expected to have 2 acl in acl cache map");
+        assertEquals(ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()), "expected to have the same acl");
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
index d8b21850ece..0e85cf97834 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
@@ -21,13 +21,13 @@
 import static org.apache.zookeeper.server.DatadirCleanupManager.PurgeTaskStatus.COMPLETED;
 import static org.apache.zookeeper.server.DatadirCleanupManager.PurgeTaskStatus.NOT_STARTED;
 import static org.apache.zookeeper.server.DatadirCleanupManager.PurgeTaskStatus.STARTED;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.File;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class DatadirCleanupManagerTest extends ZKTestCase {
 
@@ -35,7 +35,7 @@ public class DatadirCleanupManagerTest extends ZKTestCase {
     private File snapDir;
     private File dataLogDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         File dataDir = ClientBase.createTmpDir();
         snapDir = dataDir;
@@ -46,33 +46,33 @@ public void setUp() throws Exception {
     public void testPurgeTask() throws Exception {
         purgeMgr = new DatadirCleanupManager(snapDir, dataLogDir, 3, 1);
         purgeMgr.start();
-        assertEquals("Data log directory is not set as configured", dataLogDir, purgeMgr.getDataLogDir());
-        assertEquals("Snapshot directory is not set as configured", snapDir, purgeMgr.getSnapDir());
-        assertEquals("Snapshot retain count is not set as configured", 3, purgeMgr.getSnapRetainCount());
-        assertEquals("Purge task is not started", STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(dataLogDir, purgeMgr.getDataLogDir(), "Data log directory is not set as configured");
+        assertEquals(snapDir, purgeMgr.getSnapDir(), "Snapshot directory is not set as configured");
+        assertEquals(3, purgeMgr.getSnapRetainCount(), "Snapshot retain count is not set as configured");
+        assertEquals(STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is not started");
         purgeMgr.shutdown();
-        assertEquals("Purge task is still running after shutdown", COMPLETED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(COMPLETED, purgeMgr.getPurgeTaskStatus(), "Purge task is still running after shutdown");
     }
 
     @Test
     public void testWithZeroPurgeInterval() throws Exception {
         purgeMgr = new DatadirCleanupManager(snapDir, dataLogDir, 3, 0);
         purgeMgr.start();
-        assertEquals("Purge task is scheduled with zero purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with zero purge interval");
         purgeMgr.shutdown();
-        assertEquals("Purge task is scheduled with zero purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with zero purge interval");
     }
 
     @Test
     public void testWithNegativePurgeInterval() throws Exception {
         purgeMgr = new DatadirCleanupManager(snapDir, dataLogDir, 3, -1);
         purgeMgr.start();
-        assertEquals("Purge task is scheduled with negative purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with negative purge interval");
         purgeMgr.shutdown();
-        assertEquals("Purge task is scheduled with negative purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with negative purge interval");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (purgeMgr != null) {
             purgeMgr.shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java
index 064b53e0898..b45a883e33e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -26,7 +26,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java
index 7967beb2c22..8bb67774d4d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.server;
 
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -30,12 +30,15 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class Emulate353TTLTest extends ClientBase {
 
     private TestableZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         System.setProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY, "true");
@@ -44,6 +47,7 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         System.clearProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY);
@@ -61,11 +65,11 @@ public void testCreate() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -78,11 +82,11 @@ public void test353TTL() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java
index 5021f0f7cd7..77b53f485ff 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java
@@ -19,22 +19,23 @@
 package org.apache.zookeeper.server;
 
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class EphemeralTypeTest {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY, "true");
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY);
     }
@@ -92,11 +93,13 @@ public void testEphemeralOwner_extendedFeature_TTL() {
         assertThat(EphemeralType.get(0xff00000000000000L), equalTo(EphemeralType.TTL));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testEphemeralOwner_extendedFeature_extendedTypeUnsupported() {
-        // 0xff = Extended feature is ON
-        // 0x0001 = Unsupported extended type id (1)
-        EphemeralType.get(0xff00010000000000L);
+        assertThrows(IllegalArgumentException.class, () -> {
+            // 0xff = Extended feature is ON
+            // 0x0001 = Unsupported extended type id (1)
+            EphemeralType.get(0xff00010000000000L);
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
index 1d4309f04df..0181d2ebeae 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -43,8 +43,8 @@
 import org.apache.zookeeper.proto.GetACLRequest;
 import org.apache.zookeeper.proto.GetACLResponse;
 import org.apache.zookeeper.proto.ReplyHeader;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
@@ -58,7 +58,7 @@ public class FinalRequestProcessorTest {
     private ByteBuffer bb;
     private FinalRequestProcessor processor;
 
-    @Before
+    @BeforeEach
     public void setUp() throws KeeperException.NoNodeException, IOException {
         testACLs.clear();
         testACLs.addAll(Arrays.asList(new ACL(ZooDefs.Perms.ALL, new Id("digest", "user:secrethash")), new ACL(ZooDefs.Perms.ADMIN, new Id("digest", "adminuser:adminsecret")), new ACL(ZooDefs.Perms.READ, new Id("world", "anyone"))));
@@ -171,7 +171,7 @@ public void testACLDigestHashHiding_OnlyAdmin() {
         processor.processRequest(r);
 
         // Assert
-        assertTrue("Not a GetACL response. Auth failed?", responseRecord[0] instanceof GetACLResponse);
+        assertTrue(responseRecord[0] instanceof GetACLResponse, "Not a GetACL response. Auth failed?");
         GetACLResponse rsp = (GetACLResponse) responseRecord[0];
         assertThat("Number of ACLs in the response are different", rsp.getAcl().size(), equalTo(2));
 
@@ -181,7 +181,7 @@ public void testACLDigestHashHiding_OnlyAdmin() {
     }
 
     private void assertMasked(boolean masked) {
-        assertTrue("Not a GetACL response. Auth failed?", responseRecord[0] instanceof GetACLResponse);
+        assertTrue(responseRecord[0] instanceof GetACLResponse, "Not a GetACL response. Auth failed?");
         GetACLResponse rsp = (GetACLResponse) responseRecord[0];
         assertThat("Number of ACLs in the response are different", rsp.getAcl().size(), equalTo(3));
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
index dd81c77eec5..1d46debccda 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs.Ids;
@@ -30,8 +30,8 @@
 import org.apache.zookeeper.server.util.PortForwarder;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ObserverMasterTestBase;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 public class FollowerRequestProcessorTest extends ObserverMasterTestBase {
 
@@ -65,9 +65,8 @@ private void setupTestObserverServer(String skipLearnerRequestToNextProcessor) t
         forwarder = setUp(OM_PROXY_PORT, true);
 
         q3.start();
-        assertTrue(
-            "waiting for server 3 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
 
         // Connect with observer zookeeper
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
@@ -77,7 +76,7 @@ private void setupTestObserverServer(String skipLearnerRequestToNextProcessor) t
         ServerMetrics.getMetrics().resetAll();
     }
 
-    @After
+    @AfterEach
     public void cleanup() throws Exception {
         System.setProperty(FollowerRequestProcessor.SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR, "false");
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java
index a7a4aeabe17..0be30d04cae 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -29,7 +29,7 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -109,9 +109,8 @@ public void testInvalidSnapCount() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         assertEquals(SyncRequestProcessor.getSnapCount(), 2);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java
index f048c9217c5..88f5a88548b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.RandomAccessFile;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -72,7 +72,7 @@ public void testInvalidSnapshot() throws Exception {
         // verify that the expected data exists and wasn't lost
         zk = createClient();
         try {
-            assertTrue("the node should exist", (zk.exists("/invalidsnap-1999", false) != null));
+            assertTrue((zk.exists("/invalidsnap-1999", false) != null), "the node should exist");
         } finally {
             zk.close();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
index 6e35d2c5785..001e2363548 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -44,7 +44,8 @@
 import org.apache.zookeeper.server.quorum.QuorumZooKeeperServer;
 import org.apache.zookeeper.server.quorum.UpgradeableSessionTracker;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -52,6 +53,7 @@ public class MultiOpSessionUpgradeTest extends QuorumBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(MultiOpSessionUpgradeTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         localSessionsEnabled = true;
@@ -68,9 +70,9 @@ public void ephemeralCreateMultiOpTest() throws KeeperException, InterruptedExce
         zk.create(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         QuorumZooKeeperServer server = getConnectedServer(zk.getSessionId());
-        assertNotNull("unable to find server interlocutor", server);
+        assertNotNull(server, "unable to find server interlocutor");
         UpgradeableSessionTracker sessionTracker = (UpgradeableSessionTracker) server.getSessionTracker();
-        assertFalse("session already global", sessionTracker.isGlobalSession(zk.getSessionId()));
+        assertFalse(sessionTracker.isGlobalSession(zk.getSessionId()), "session already global");
 
         List<OpResult> multi = null;
         try {
@@ -89,7 +91,7 @@ public void ephemeralCreateMultiOpTest() throws KeeperException, InterruptedExce
         assertEquals(data, new String(zk.getData(path + "/e", false, null)));
         assertEquals(data, new String(zk.getData(path + "/p", false, null)));
         assertEquals(data, new String(zk.getData(path + "/q", false, null)));
-        assertTrue("session not promoted", sessionTracker.isGlobalSession(zk.getSessionId()));
+        assertTrue(sessionTracker.isGlobalSession(zk.getSessionId()), "session not promoted");
     }
 
     @Test
@@ -100,13 +102,13 @@ public void directCheckUpgradeSessionTest() throws IOException, InterruptedExcep
         zk.create(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         QuorumZooKeeperServer server = getConnectedServer(zk.getSessionId());
-        assertNotNull("unable to find server interlocutor", server);
+        assertNotNull(server, "unable to find server interlocutor");
 
         Request readRequest = makeGetDataRequest(path, zk.getSessionId());
         Request createRequest = makeCreateRequest(path + "/e", zk.getSessionId());
-        assertNull("tried to upgrade on a read", server.checkUpgradeSession(readRequest));
-        assertNotNull("failed to upgrade on a create", server.checkUpgradeSession(createRequest));
-        assertNull("tried to upgrade after successful promotion", server.checkUpgradeSession(createRequest));
+        assertNull(server.checkUpgradeSession(readRequest), "tried to upgrade on a read");
+        assertNotNull(server.checkUpgradeSession(createRequest), "failed to upgrade on a create");
+        assertNull(server.checkUpgradeSession(createRequest), "tried to upgrade after successful promotion");
     }
 
     private Request makeGetDataRequest(String path, long sessionId) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java
index 715c15a839b..237842b13cb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java
@@ -18,43 +18,48 @@
 
 package org.apache.zookeeper.server;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.net.SocketException;
 import org.apache.zookeeper.PortAssignment;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class NIOServerCnxnFactoryTest {
 
     private InetSocketAddress listenAddress;
     private NIOServerCnxnFactory factory;
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         listenAddress = new InetSocketAddress(PortAssignment.unique());
         factory = new NIOServerCnxnFactory();
         factory.configure(listenAddress, 100);
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         if (factory != null) {
             factory.shutdown();
         }
     }
 
-    @Test(expected = SocketException.class)
+    @Test
     public void testStartupWithoutStart_SocketAlreadyBound() throws IOException {
-        ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        assertThrows(SocketException.class, () -> {
+            ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        });
     }
 
-    @Test(expected = SocketException.class)
+    @Test
     public void testStartupWithStart_SocketAlreadyBound() throws IOException {
-        factory.start();
-        ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        assertThrows(SocketException.class, () -> {
+            factory.start();
+            ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java
index fc917e09bbc..f6ee6094c32 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.greaterThan;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -31,7 +31,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.quorum.BufferStats;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,7 +43,8 @@ public class NIOServerCnxnTest extends ClientBase {
     /**
      * Test operations on ServerCnxn after socket closure.
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testOperationsAfterCnxnClose() throws IOException, InterruptedException, KeeperException {
         final ZooKeeper zk = createClient();
 
@@ -50,10 +52,11 @@ public void testOperationsAfterCnxnClose() throws IOException, InterruptedExcept
         try {
             // make sure zkclient works
             zk.create(path, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertNotNull("Didn't create znode:" + path, zk.exists(path, false));
+            assertNotNull(zk.exists(path, false), "Didn't create znode:" + path);
             // Defaults ServerCnxnFactory would be instantiated with
             // NIOServerCnxnFactory
-            assertTrue("Didn't instantiate ServerCnxnFactory with NIOServerCnxnFactory!", serverFactory instanceof NIOServerCnxnFactory);
+            assertTrue(serverFactory instanceof NIOServerCnxnFactory,
+                "Didn't instantiate ServerCnxnFactory with NIOServerCnxnFactory!");
             Iterable<ServerCnxn> connections = serverFactory.getConnections();
             for (ServerCnxn serverCnxn : connections) {
                 serverCnxn.close(ServerCnxn.DisconnectReason.CHANNEL_CLOSED_EXCEPTION);
@@ -67,7 +70,6 @@ public void testOperationsAfterCnxnClose() throws IOException, InterruptedExcept
         } finally {
             zk.close();
         }
-
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java
index 76136c4ee4f..41808be706c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java
@@ -18,6 +18,10 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.net.InetSocketAddress;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -32,12 +36,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.SSLAuthTest;
 import org.hamcrest.Matchers;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-
 public class NettyServerCnxnFactoryTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory
@@ -78,14 +80,14 @@ public void testRebind() throws Exception {
         NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
         factory.configure(addr, 100, -1, false);
         factory.start();
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
 
         factory.reconfigure(addr);
 
         // wait the state change
         Thread.sleep(100);
 
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
     }
 
     @Test
@@ -95,14 +97,14 @@ public void testRebindIPv4IPv6() throws Exception {
         NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
         factory.configure(addr, 100, -1, false);
         factory.start();
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
 
         factory.reconfigure(new InetSocketAddress("[0:0:0:0:0:0:0:0]", randomPort));
 
         // wait the state change
         Thread.sleep(100);
 
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
     }
 
     /*
@@ -124,7 +126,7 @@ public void testOutstandingHandshakeLimit() throws Exception {
         // initializing the statistics
         SimpleCounter tlsHandshakeExceeded = (SimpleCounter) ServerMetrics.getMetrics().TLS_HANDSHAKE_EXCEEDED;
         tlsHandshakeExceeded.reset();
-        Assert.assertEquals(tlsHandshakeExceeded.get(), 0);
+        assertEquals(tlsHandshakeExceeded.get(), 0);
 
         // setting the HandshakeLimit to 3, so only 3 SSL handshakes can happen in parallel
         NettyServerCnxnFactory factory = (NettyServerCnxnFactory) serverFactory;
@@ -150,20 +152,20 @@ public void testOutstandingHandshakeLimit() throws Exception {
         int actualConnections = cnxnCreated.get();
         LOG.info("created {} connections", actualConnections);
         if (!allConnectionsCreatedInTime) {
-          Assert.fail(String.format("Only %d out of %d connections created!", actualConnections, cnxnLimit));
+            fail(String.format("Only %d out of %d connections created!", actualConnections, cnxnLimit));
         }
 
         // Assert the server refused some of the connections because the handshake limit was reached
         // (throttling should be greater than 0)
         long handshakeThrottledNum = tlsHandshakeExceeded.get();
         LOG.info("TLS_HANDSHAKE_EXCEEDED: {}", handshakeThrottledNum);
-        Assert.assertThat("The number of handshake throttled should be "
+        assertThat("The number of handshake throttled should be "
                 + "greater than 0", handshakeThrottledNum, Matchers.greaterThan(0L));
 
         // Assert there is no outstanding handshake anymore, all the clients connected in the end
         int outstandingHandshakeNum = factory.getOutstandingHandshakeNum();
         LOG.info("outstanding handshake is {}", outstandingHandshakeNum);
-        Assert.assertThat("The outstanding handshake number should be 0 "
+        assertThat("The outstanding handshake number should be 0 "
                 + "after all cnxns established", outstandingHandshakeNum, Matchers.is(0));
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index 646d2051f03..cd7842fa309 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -18,14 +18,15 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.greaterThan;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.net.ProtocolException;
 import java.nio.charset.StandardCharsets;
@@ -45,7 +46,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.SSLAuthTest;
 import org.apache.zookeeper.test.TestByteBufAllocator;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,6 +61,7 @@ public class NettyServerCnxnTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(NettyServerCnxnTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
@@ -66,6 +71,7 @@ public void setUp() throws Exception {
         super.setUp();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -81,9 +87,10 @@ public void tearDown() throws Exception {
      *
      * @see <a href="https://issues.jboss.org/browse/NETTY-412">NETTY-412</a>
      */
-    @Test(timeout = 40000)
+    @Test
+    @Timeout(value = 40)
     public void testSendCloseSession() throws Exception {
-        assertTrue("Didn't instantiate ServerCnxnFactory with NettyServerCnxnFactory!", serverFactory instanceof NettyServerCnxnFactory);
+        assertTrue(serverFactory instanceof NettyServerCnxnFactory, "Didn't instantiate ServerCnxnFactory with NettyServerCnxnFactory!");
 
         final ZooKeeper zk = createClient();
         final ZooKeeperServer zkServer = serverFactory.getZooKeeperServer();
@@ -92,10 +99,10 @@ public void testSendCloseSession() throws Exception {
             // make sure zkclient works
             zk.create(path, "test".getBytes(StandardCharsets.UTF_8), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             // set on watch
-            assertNotNull("Didn't create znode:" + path, zk.exists(path, true));
+            assertNotNull(zk.exists(path, true), "Didn't create znode:" + path);
             assertEquals(1, zkServer.getZKDatabase().getDataTree().getWatchCount());
             Iterable<ServerCnxn> connections = serverFactory.getConnections();
-            assertEquals("Mismatch in number of live connections!", 1, serverFactory.getNumAliveConnections());
+            assertEquals(1, serverFactory.getNumAliveConnections(), "Mismatch in number of live connections!");
             for (ServerCnxn serverCnxn : connections) {
                 serverCnxn.sendCloseSession();
             }
@@ -120,12 +127,14 @@ public void testSendCloseSession() throws Exception {
      * is set to 1. This tests that if more than one connection is attempted, the
      * connection fails.
      */
-    @Test(timeout = 40000, expected = ProtocolException.class)
-    public void testMaxConnectionPerIpSurpased() throws Exception {
-        assertTrue("Did not instantiate ServerCnxnFactory with NettyServerCnxnFactory!", serverFactory instanceof NettyServerCnxnFactory);
-
-        try (final ZooKeeper zk1 = createClient(); final ZooKeeper zk2 = createClient()) {
-        }
+    @Test
+    @Timeout(value = 40)
+    public void testMaxConnectionPerIpSurpased() {
+        assertTrue(serverFactory instanceof NettyServerCnxnFactory, "Did not instantiate ServerCnxnFactory with NettyServerCnxnFactory!");
+        assertThrows(ProtocolException.class, () -> {
+            try (final ZooKeeper zk1 = createClient(); final ZooKeeper zk2 = createClient()) {
+            }
+        });
     }
 
     @Test
@@ -139,7 +148,7 @@ public void testClientResponseStatsUpdate() throws IOException, InterruptedExcep
             assertThat("Last client response size should be greater than 0 after client request was performed", clientResponseStats.getLastBufferSize(), greaterThan(0));
 
             byte[] contents = zk.getData("/a", null, null);
-            assertArrayEquals("unexpected data", "test".getBytes(StandardCharsets.UTF_8), contents);
+            assertArrayEquals("test".getBytes(StandardCharsets.UTF_8), contents, "unexpected data");
         }
     }
 
@@ -175,7 +184,7 @@ public void run() {
             }
 
             byte[] contents = zk.getData("/a", null, null);
-            assertArrayEquals("unexpected data", "test".getBytes(StandardCharsets.UTF_8), contents);
+            assertArrayEquals("test".getBytes(StandardCharsets.UTF_8), contents, "unexpected data");
 
             // As above, but don't do the throttled read. Make the request bytes wait in the socket
             // input buffer until after throttling is turned off. Need to make sure both modes work.
@@ -193,7 +202,7 @@ public void run() {
             }
 
             contents = zk.getData("/a", null, null);
-            assertArrayEquals("unexpected data", "test".getBytes(StandardCharsets.UTF_8), contents);
+            assertArrayEquals("test".getBytes(StandardCharsets.UTF_8), contents, "unexpected data");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java
index b34dc90cf02..f59b0d11e14 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java
@@ -18,24 +18,24 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.data.StatPersisted;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class NodeHashMapImplTest extends ZKTestCase {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         ZooKeeperServer.setDigestEnabled(true);
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         ZooKeeperServer.setDigestEnabled(false);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
index 77dc6c78a54..062cae1f9db 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -51,9 +51,9 @@
 import org.apache.zookeeper.proto.SetDataRequest;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -64,7 +64,7 @@ public class PrepRequestProcessorMetricsTest extends ZKTestCase {
     ZooKeeperServer zks;
     RequestProcessor nextProcessor;
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(ZooKeeperServer.SKIP_ACL, "true");
         zks = spy(new ZooKeeperServer());
@@ -88,7 +88,7 @@ public void setup() {
         ServerMetrics.getMetrics().resetAll();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(ZooKeeperServer.SKIP_ACL);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index 409e59058e6..0bf248a04c5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.ByteArrayOutputStream;
@@ -62,9 +62,9 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.ErrorTxn;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -84,7 +84,7 @@ public class PrepRequestProcessorTest extends ClientBase {
     private boolean isReconfigEnabledPreviously;
     private boolean isStandaloneEnabledPreviously;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         File tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
@@ -94,14 +94,14 @@ public void setup() throws Exception {
 
         servcnxnf = ServerCnxnFactory.createFactory(PORT, -1);
         servcnxnf.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         zks.sessionTracker = new MySessionTracker();
 
         isReconfigEnabledPreviously = QuorumPeerConfig.isReconfigEnabled();
         isStandaloneEnabledPreviously = QuorumPeerConfig.isStandaloneEnabled();
     }
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         if (servcnxnf != null) {
             servcnxnf.shutdown();
@@ -122,8 +122,8 @@ public void testPRequest() throws Exception {
         Request foo = new Request(null, 1L, 1, OpCode.create, ByteBuffer.allocate(3), null);
         processor.pRequest(foo);
 
-        assertEquals("Request should have marshalling error", new ErrorTxn(KeeperException.Code.MARSHALLINGERROR.intValue()), outcome.getTxn());
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertEquals(new ErrorTxn(KeeperException.Code.MARSHALLINGERROR.intValue()), outcome.getTxn(), "Request should have marshalling error");
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
     }
 
     private Request createRequest(Record record, int opCode) throws IOException {
@@ -157,7 +157,7 @@ private void process(List<Op> ops) throws Exception {
         Request req = createRequest(record, OpCode.multi, false);
 
         processor.pRequest(req);
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
     }
 
     /**
@@ -173,18 +173,18 @@ public void testMultiOutstandingChange() throws Exception {
         process(Arrays.asList(Op.setData("/foo", new byte[0], -1)));
 
         ChangeRecord cr = zks.outstandingChangesForPath.get("/foo");
-        assertNotNull("Change record wasn't set", cr);
-        assertEquals("Record zxid wasn't set correctly", 1, cr.zxid);
+        assertNotNull(cr, "Change record wasn't set");
+        assertEquals(1, cr.zxid, "Record zxid wasn't set correctly");
 
         process(Arrays.asList(Op.delete("/foo", -1)));
         cr = zks.outstandingChangesForPath.get("/foo");
-        assertEquals("Record zxid wasn't set correctly", 2, cr.zxid);
+        assertEquals(2, cr.zxid, "Record zxid wasn't set correctly");
 
         // It should fail and shouldn't change outstanding record.
         process(Arrays.asList(Op.delete("/foo", -1)));
         cr = zks.outstandingChangesForPath.get("/foo");
         // zxid should still be previous result because record's not changed.
-        assertEquals("Record zxid wasn't set correctly", 2, cr.zxid);
+        assertEquals(2, cr.zxid, "Record zxid wasn't set correctly");
     }
 
     @Test
@@ -207,13 +207,13 @@ public void testReconfigWithAnotherOutstandingChange() throws Exception {
         Record record = new CreateRequest("/foo", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT.toFlag());
         pLatch = new CountDownLatch(1);
         processor.pRequest(createRequest(record, OpCode.create, false));
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
 
         String newMember = "server.0=localhost:" + PortAssignment.unique()  + ":" + PortAssignment.unique() + ":participant";
         record = new ReconfigRequest(null, null, newMember, 0);
         pLatch = new CountDownLatch(1);
         processor.pRequest(createRequest(record, OpCode.reconfig, true));
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
         assertEquals(outcome.getHdr().getType(), OpCode.reconfig);   // Verifies that there was no error.
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
index 804e23726ee..3a45a8d9610 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.io.OutputStream;
@@ -49,9 +49,9 @@
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,12 +63,12 @@ public class PurgeTxnTest extends ZKTestCase {
     private static final long OP_TIMEOUT_IN_MILLIS = 120000;
     private File tmpDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         tmpDir = ClientBase.createTmpDir();
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         if (null != tmpDir) {
             ClientBase.recursiveDelete(tmpDir);
@@ -87,7 +87,7 @@ public void testPurge() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             for (int i = 0; i < 2000; i++) {
@@ -98,7 +98,7 @@ public void testPurge() throws Exception {
         }
         f.shutdown();
         zks.getTxnLogFactory().close();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
         // now corrupt the snapshot
         PurgeTxnLog.purge(tmpDir, tmpDir, 3);
         FileTxnSnapLog snaplog = new FileTxnSnapLog(tmpDir, tmpDir);
@@ -109,7 +109,7 @@ public void testPurge() throws Exception {
                 numSnaps++;
             }
         }
-        assertTrue("exactly 3 snapshots ", (numSnaps == 3));
+        assertTrue((numSnaps == 3), "exactly 3 snapshots ");
         snaplog.close();
         zks.shutdown();
     }
@@ -130,7 +130,7 @@ public void testPurgeWhenLogRollingInProgress() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         final ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         final CountDownLatch doPurge = new CountDownLatch(1);
         final CountDownLatch purgeFinished = new CountDownLatch(1);
@@ -153,8 +153,8 @@ public void run() {
         }.start();
         final int thCount = 3;
         List<String> znodes = manyClientOps(zk, doPurge, thCount, "/invalidsnap");
-        assertTrue("Purging is not finished!", purgeFinished.await(OP_TIMEOUT_IN_MILLIS, TimeUnit.MILLISECONDS));
-        assertFalse("Purging failed!", opFailed.get());
+        assertTrue(purgeFinished.await(OP_TIMEOUT_IN_MILLIS, TimeUnit.MILLISECONDS), "Purging is not finished!");
+        assertFalse(opFailed.get(), "Purging failed!");
         for (String znode : znodes) {
             try {
                 zk.getData(znode, false, null);
@@ -179,7 +179,7 @@ public void testFindNValidSnapshots() throws Exception {
         int offset = 0;
 
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
 
         // Test that with no snaps, findNValidSnapshots returns empty list
         FileTxnSnapLog txnLog = new FileTxnSnapLog(tmpDir, tmpDir);
@@ -191,10 +191,10 @@ public void testFindNValidSnapshots() throws Exception {
         for (int i = 0; i < nRecentCount; i++) {
             // simulate log file
             File logFile = new File(version2 + "/log." + Long.toHexString(--counter));
-            assertTrue("Failed to create log File:" + logFile.toString(), logFile.createNewFile());
+            assertTrue(logFile.createNewFile(), "Failed to create log File:" + logFile.toString());
             // simulate snapshot file
             File snapFile = new File(version2 + "/snapshot." + Long.toHexString(--counter));
-            assertTrue("Failed to create snap File:" + snapFile.toString(), snapFile.createNewFile());
+            assertTrue(snapFile.createNewFile(), "Failed to create snap File:" + snapFile.toString());
             makeValidSnapshot(snapFile);
             // add the n recent snap files for assertion
             if (i < nRecentSnap) {
@@ -205,17 +205,17 @@ public void testFindNValidSnapshots() throws Exception {
         // Test that when we ask for recent snaps we get the number we asked for and
         // the files we expected
         List<File> nRecentValidSnapFiles = txnLog.findNValidSnapshots(nRecentSnap);
-        assertEquals("exactly 4 snapshots ", 4, nRecentValidSnapFiles.size());
+        assertEquals(4, nRecentValidSnapFiles.size(), "exactly 4 snapshots ");
         expectedNRecentSnapFiles.removeAll(nRecentValidSnapFiles);
-        assertEquals("Didn't get the recent snap files", 0, expectedNRecentSnapFiles.size());
+        assertEquals(0, expectedNRecentSnapFiles.size(), "Didn't get the recent snap files");
 
         // Test that when asking for more snaps than we created, we still only get snaps
         // not logs or anything else (per ZOOKEEPER-2420)
         nRecentValidSnapFiles = txnLog.findNValidSnapshots(nRecentCount + 5);
         assertEquals(nRecentCount, nRecentValidSnapFiles.size());
         for (File f : nRecentValidSnapFiles) {
-            assertTrue("findNValidSnapshots() returned a non-snapshot: "
-                                      + f.getPath(), (Util.getZxidFromName(f.getName(), "snapshot") != -1));
+            assertTrue((Util.getZxidFromName(f.getName(), "snapshot") != -1),
+                    "findNValidSnapshots() returned a non-snapshot: " + f.getPath());
         }
 
         txnLog.close();
@@ -233,7 +233,7 @@ public void testSnapFilesGreaterThanToRetain() throws Exception {
         int fileToPurgeCount = 2;
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
         List<File> snapsToPurge = new ArrayList<File>();
         List<File> logsToPurge = new ArrayList<File>();
         List<File> snaps = new ArrayList<File>();
@@ -284,7 +284,7 @@ public void internalTestSnapFilesEqualsToRetain(boolean testWithPrecedingLogFile
         int nRecentCount = 3;
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
         List<File> snaps = new ArrayList<File>();
         List<File> logs = new ArrayList<File>();
         createDataDirFiles(offset, nRecentCount, testWithPrecedingLogFile, version2, snaps, logs);
@@ -306,7 +306,7 @@ public void testSnapFilesLessThanToRetain() throws Exception {
         int fileToPurgeCount = 2;
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
         List<File> snapsToPurge = new ArrayList<File>();
         List<File> logsToPurge = new ArrayList<File>();
         List<File> snaps = new ArrayList<File>();
@@ -433,7 +433,7 @@ public void testPurgeDoesNotDeleteOverlappingLogFile() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
 
         // Unique identifier for each znode that we create.
@@ -461,7 +461,7 @@ public void testPurgeDoesNotDeleteOverlappingLogFile() throws Exception {
         f.shutdown();
         zks.getTxnLogFactory().close();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
         // Purge snapshot and log files.
         PurgeTxnLog.purge(tmpDir, tmpDir, SNAP_RETAIN_COUNT);
@@ -480,7 +480,7 @@ public void testPurgeDoesNotDeleteOverlappingLogFile() throws Exception {
          */
         final String lastZnode = "/snap-" + (unique - 1);
         final Stat stat = zk.exists(lastZnode, false);
-        assertNotNull("Last znode does not exist: " + lastZnode, stat);
+        assertNotNull(stat, "Last znode does not exist: " + lastZnode);
 
         // Shutdown for the last time.
         f.shutdown();
@@ -529,7 +529,7 @@ public void testPurgeTxnLogWhenRecentSnapshotsAreAllInvalid() throws Exception {
 
     private File createDataDirLogFile(File version_2, int Zxid) throws IOException {
         File logFile = new File(version_2 + "/log." + Long.toHexString(Zxid));
-        assertTrue("Failed to create log File:" + logFile.toString(), logFile.createNewFile());
+        assertTrue(logFile.createNewFile(), "Failed to create log File:" + logFile.toString());
         return logFile;
     }
 
@@ -544,7 +544,7 @@ private void createDataDirFiles(AtomicInteger offset, int limit, boolean createP
             logs.add(createDataDirLogFile(version_2, --counter));
             // simulate snapshot file
             File snapFile = new File(version_2 + "/snapshot." + Long.toHexString(--counter));
-            assertTrue("Failed to create snap File:" + snapFile.toString(), snapFile.createNewFile());
+            assertTrue(snapFile.createNewFile(), "Failed to create snap File:" + snapFile.toString());
             snaps.add(snapFile);
         }
         if (createPrecedingLogFile) {
@@ -554,7 +554,7 @@ private void createDataDirFiles(AtomicInteger offset, int limit, boolean createP
 
     private void verifyFilesAfterPurge(List<File> logs, boolean exists) {
         for (File file : logs) {
-            assertEquals("After purging, file " + file, exists, file.exists());
+            assertEquals(exists, file.exists(), "After purging, file " + file);
         }
     }
 
@@ -593,7 +593,7 @@ private List<String> manyClientOps(final ZooKeeper zk, final CountDownLatch doPu
                 LOG.error("unexpected exception during running ZkClient ops:", exception.get());
                 fail("unexpected exception during running ZkClient ops, see in the logs above");
             }
-            assertTrue("ZkClient ops not finished in time!", operationsFinishedSuccessfully);
+            assertTrue(operationsFinishedSuccessfully, "ZkClient ops not finished in time!");
         } catch (InterruptedException ie) {
             LOG.error("Unexpected exception", ie);
             fail("Unexpected exception occurred!");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
index 6bb5d954c36..9eab2e8cd2b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -32,7 +32,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ReferenceCountedACLCacheTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index 3e1de555f0b..58e138a22ed 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
@@ -35,10 +35,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -74,7 +73,7 @@ public class RequestThrottlerTest extends ZKTestCase {
     int connectionLossCount = 0;
 
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         // start a server and create a client
         File tmpDir = ClientBase.createTmpDir();
@@ -84,7 +83,7 @@ public void setup() throws Exception {
         f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
         LOG.info("starting up the zookeeper server .. waiting");
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
 
         resumeProcess = null;
         submitted = null;
@@ -92,7 +91,7 @@ public void setup() throws Exception {
         zk = ClientBase.createZKClient(HOSTPORT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         // shut down the server and the client
         if (null != zk) {
@@ -295,9 +294,9 @@ public void testLargeRequestThrottling() throws Exception {
 
         // but only two requests can get into the pipeline because they are large requests
         // the connection will be closed
-        Assert.assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
-        Assert.assertEquals(1L, (long) metrics.get("large_requests_rejected"));
-        Assert.assertEquals(5, connectionLossCount);
+        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
+        assertEquals(1L, (long) metrics.get("large_requests_rejected"));
+        assertEquals(5, connectionLossCount);
 
         finished = new CountDownLatch(2);
         // let the requests go through the pipeline
@@ -306,7 +305,7 @@ public void testLargeRequestThrottling() throws Exception {
 
         // when the two requests finish, they are stale because the connection is closed already
         metrics = MetricsUtils.currentServerMetrics();
-        Assert.assertEquals(2, (long) metrics.get("stale_replies"));
+        assertEquals(2, (long) metrics.get("stale_replies"));
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java
index 1ff0a76f6d4..49c454bcb4c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java
@@ -23,7 +23,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java
index 3f3f4964aa3..5505f58b61a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java
@@ -18,80 +18,66 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class ServerIdTest extends ClientBase {
 
-    private final TestType testType;
-
-    private static class TestType {
-
-        final boolean ttlsEnabled;
-        final int serverId;
-
-        TestType(boolean ttlsEnabled, int serverId) {
-            this.ttlsEnabled = ttlsEnabled;
-            this.serverId = serverId;
-        }
-
-    }
-
-    @Parameterized.Parameters
-    public static List<TestType> data() {
-        List<TestType> testTypes = new ArrayList<>();
+    public static Stream<Arguments> data() throws Exception {
+        List<Arguments> testTypes = new ArrayList<>();
         for (boolean ttlsEnabled : new boolean[]{true, false}) {
             for (int serverId = 0; serverId <= 255; ++serverId) {
-                testTypes.add(new TestType(ttlsEnabled, serverId));
+                testTypes.add(Arguments.of(ttlsEnabled, serverId));
             }
         }
-        return testTypes;
+        return testTypes.stream();
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
         System.clearProperty("zookeeper.extendedTypesEnabled");
     }
 
-    public ServerIdTest(TestType testType) {
-        this.testType = testType;
-    }
-
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
-        System.setProperty("zookeeper.extendedTypesEnabled", Boolean.toString(testType.ttlsEnabled));
-        LOG.info("ttlsEnabled: {} - ServerId: {}", testType.ttlsEnabled, testType.serverId);
+        //since parameterized test methods need a parameterized setUp method
+        //the inherited method has to be overridden with an empty function body
+    }
+
+    public void setUp(boolean ttlsEnabled, int serverId) throws Exception {
+        System.setProperty("zookeeper.extendedTypesEnabled", Boolean.toString(ttlsEnabled));
+        LOG.info("ttlsEnabled: {} - ServerId: {}", ttlsEnabled, serverId);
         try {
-            super.setUpWithServerId(testType.serverId);
+            super.setUpWithServerId(serverId);
         } catch (RuntimeException e) {
-            if (testType.ttlsEnabled && (testType.serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
+            if (ttlsEnabled && (serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
                 return; // expected
             }
             throw e;
         }
     }
 
-    @Test
-    public void doTest() throws Exception {
-        if (testType.ttlsEnabled && (testType.serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void doTest(boolean ttlsEnabled, int serverId) throws Exception {
+        setUp(ttlsEnabled, serverId);
+        if (ttlsEnabled && (serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
             return;
         }
 
@@ -102,7 +88,7 @@ public void doTest() throws Exception {
             zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             zk.delete("/foo", -1);
 
-            if (testType.ttlsEnabled) {
+            if (ttlsEnabled) {
                 zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, new Stat(), 1000);  // should work
             } else {
                 try {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java
index 29a9fd96b7b..72ee3c41967 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Arrays;
 import java.util.Map;
 import java.util.concurrent.ThreadLocalRandom;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.metric.AvgMinMaxCounter;
 import org.apache.zookeeper.server.metric.SimpleCounter;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ServerMetricsTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java
index 05a35058e92..fcd55bf1260 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java
@@ -21,17 +21,17 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ServerStatsTest extends ZKTestCase {
 
     private ServerStats.Provider providerMock;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         providerMock = mock(ServerStats.Provider.class);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java
index c0085507758..3b230407441 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
@@ -33,7 +33,8 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.SessionTrackerImpl.SessionImpl;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * Testing zk client session logic in sessiontracker
@@ -49,7 +50,8 @@ public class SessionTrackerTest extends ZKTestCase {
      * Verify the create session call in the Leader.FinalRequestProcessor after
      * the session expiration.
      */
-    @Test(timeout = 20000)
+    @Test
+    @Timeout(value = 20)
     public void testAddSessionAfterSessionExpiry() throws Exception {
         RequestThrottler.setMaxRequests(0);
         ZooKeeperServer zks = setupSessionTracker();
@@ -58,7 +60,7 @@ public void testAddSessionAfterSessionExpiry() throws Exception {
         zks.sessionTracker.trackSession(sessionId, sessionTimeout);
         SessionTrackerImpl sessionTrackerImpl = (SessionTrackerImpl) zks.sessionTracker;
         SessionImpl sessionImpl = sessionTrackerImpl.sessionsById.get(sessionId);
-        assertNotNull("Sessionid:" + sessionId + " doesn't exists in sessiontracker", sessionImpl);
+        assertNotNull(sessionImpl, "Sessionid:" + sessionId + " doesn't exists in sessiontracker");
 
         // verify the session existence
         Object sessionOwner = new Object();
@@ -77,16 +79,17 @@ public void testAddSessionAfterSessionExpiry() throws Exception {
         } catch (KeeperException.SessionExpiredException e) {
             // expected behaviour
         }
-        assertTrue("Session didn't expired", sessionImpl.isClosing());
-        assertFalse("Session didn't expired", sessionTrackerImpl.touchSession(sessionId, sessionTimeout));
-        assertEquals("Duplicate session expiry request has been generated", 1, firstProcessor.getCountOfCloseSessionReq());
+        assertTrue(sessionImpl.isClosing(), "Session didn't expired");
+        assertFalse(sessionTrackerImpl.touchSession(sessionId, sessionTimeout), "Session didn't expired");
+        assertEquals(1, firstProcessor.getCountOfCloseSessionReq(), "Duplicate session expiry request has been generated");
     }
 
     /**
      * Verify the session closure request has reached PrepRequestProcessor soon
      * after session expiration by the session tracker
      */
-    @Test(timeout = 20000)
+    @Test
+    @Timeout(value = 20)
     public void testCloseSessionRequestAfterSessionExpiry() throws Exception {
         ZooKeeperServer zks = setupSessionTracker();
 
@@ -94,7 +97,7 @@ public void testCloseSessionRequestAfterSessionExpiry() throws Exception {
         zks.sessionTracker.trackSession(sessionId, sessionTimeout);
         SessionTrackerImpl sessionTrackerImpl = (SessionTrackerImpl) zks.sessionTracker;
         SessionImpl sessionImpl = sessionTrackerImpl.sessionsById.get(sessionId);
-        assertNotNull("Sessionid:" + sessionId + " doesn't exists in sessiontracker", sessionImpl);
+        assertNotNull(sessionImpl, "Sessionid:" + sessionId + " doesn't exists in sessiontracker");
 
         // verify the session existence
         Object sessionOwner = new Object();
@@ -107,7 +110,7 @@ public void testCloseSessionRequestAfterSessionExpiry() throws Exception {
         // while OpCode.closeSession
         sessionTrackerImpl.removeSession(sessionId);
         SessionImpl actualSession = sessionTrackerImpl.sessionsById.get(sessionId);
-        assertNull("Session:" + sessionId + " still exists after removal", actualSession);
+        assertNull(actualSession, "Session:" + sessionId + " still exists after removal");
     }
 
     private ZooKeeperServer setupSessionTracker() throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
index d40debfa7ad..89dac35a326 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.ConcurrentHashMap;
@@ -32,9 +32,9 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeerMainTest;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.Mockito;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -46,14 +46,14 @@ public class SnapshotDigestTest extends ClientBase {
     private ZooKeeper zk;
     private ZooKeeperServer server;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         server = serverFactory.getZooKeeperServer();
         zk = createClient();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         // server will be closed in super.tearDown
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
index e1349a3cd9d..365600fba93 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.proto.SetDataRequest;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * A misc place to verify toString methods - mainly to make sure they don't
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
index ae914af5b5d..6f6a2909980 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
@@ -18,8 +18,10 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.greaterThan;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.io.File;
 import java.io.IOException;
 import java.util.ArrayList;
@@ -42,11 +44,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,14 +59,14 @@ public class TxnLogDigestTest extends ClientBase {
     private ZooKeeper zk;
     private ZooKeeperServer server;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         server = serverFactory.getZooKeeperServer();
         zk = createClient();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         // server will be closed in super.tearDown
         super.tearDown();
@@ -86,7 +87,7 @@ public void cleanUpCustomizedEnv() {
         ZooKeeperServer.setDigestEnabled(false);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         new MockedFileTxnLog();
     }
@@ -105,12 +106,12 @@ public void digestFromTxnLogsMatchesTree() throws Exception {
         performOperations(createClient(), "/digestFromTxnLogsMatchesTree");
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0, digestMistachesCount.get());
+        assertEquals(0, digestMistachesCount.get());
 
         // verify that the digest is wrote to disk with txn
         TxnDigest lastDigest = getLastTxnLogDigest();
-        Assert.assertNotNull(lastDigest);
-        Assert.assertEquals(server.getZKDatabase().getDataTree().getTreeDigest(),
+        assertNotNull(lastDigest);
+        assertEquals(server.getZKDatabase().getDataTree().getTreeDigest(),
                 lastDigest.getTreeDigest());
     }
 
@@ -144,7 +145,7 @@ public void checkTxnCompatibleWithAndWithoutDigest() throws Exception {
         Map<String, String> expectedNodes1 = performOperations(createClient(), "/p2");
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0, digestMistachesCount.get());
+        assertEquals(0, digestMistachesCount.get());
 
         // 3. disable the digest again and make sure everything is fine
         restartServerWithDigestFlag(false);
@@ -179,7 +180,7 @@ public void testTxnMissing() throws Exception {
         restartServerWithDigestFlag(false);
 
         // check that no digest mismatch is reported
-        Assert.assertEquals(0, digestMistachesCount.get());
+        assertEquals(0, digestMistachesCount.get());
     }
 
     private void restartServerWithDigestFlag(boolean digestEnabled)
@@ -249,7 +250,7 @@ private void checkNodes(Map<String, String> expectedNodes) throws Exception {
         ZooKeeper client = createClient();
         try {
             for (Map.Entry<String, String> entry: expectedNodes.entrySet()) {
-                Assert.assertEquals(entry.getValue(),
+                assertEquals(entry.getValue(),
                         new String(client.getData(entry.getKey(), false, null)));
             }
         } finally {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
index 243e1778206..16c7a7dd1c8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.nio.ByteBuffer;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.metrics.MetricsUtils;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperCriticalThreadMetricsTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
index a8db9e286b7..90220371629 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -30,18 +30,18 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperServerBeanTest {
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
     }
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java
index 2f1c9e3bc00..b11f127840d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java
@@ -17,16 +17,16 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperServerConfTest extends ZKTestCase {
 
     private ZooKeeperServerConf c;
-    @Before
+    @BeforeEach
     public void setUp() {
         c = new ZooKeeperServerConf(1, "a", "b", 2, 3, 4, 5, 6L, 7);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
index 670feaa4832..03f6113de87 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
@@ -25,7 +25,7 @@
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperServerCreationTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
index b7df9323f87..da821296ea1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -48,7 +48,8 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -162,7 +163,8 @@ public void shutdown() {
      * Test to verify that even after non recoverable error (error while
      * writing transaction log), ZooKeeper is still available.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testNonRecoverableError() throws Exception {
         ClientBase.setupTestEnv();
 
@@ -171,9 +173,8 @@ public void testNonRecoverableError() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
 
@@ -200,9 +201,8 @@ public void commit() throws IOException {
             // do nothing
         }
         zk.close();
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
         fileTxnSnapLogWithError.close();
         main.shutdown();
         main.deleteDirs();
@@ -214,7 +214,8 @@ public void commit() throws IOException {
      *
      * This test will fail if it is executed as root user.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testReadOnlySnapshotDir() throws Exception {
         ClientBase.setupTestEnv();
         final int CLIENT_PORT = PortAssignment.unique();
@@ -224,9 +225,8 @@ public void testReadOnlySnapshotDir() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         File tmpDir = main.tmpDir;
         main.start();
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
         main.shutdown();
 
         // Make the snapshot directory read only
@@ -237,9 +237,8 @@ public void testReadOnlySnapshotDir() throws Exception {
         main = new MainThread(CLIENT_PORT, false, tmpDir, null);
         main.start();
 
-        assertFalse(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
 
         main.shutdown();
 
@@ -254,7 +253,8 @@ public void testReadOnlySnapshotDir() throws Exception {
      *
      * This test will fail if it is executed as root user.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testReadOnlyTxnLogDir() throws Exception {
         ClientBase.setupTestEnv();
         final int CLIENT_PORT = PortAssignment.unique();
@@ -264,9 +264,8 @@ public void testReadOnlyTxnLogDir() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         File tmpDir = main.tmpDir;
         main.start();
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
         main.shutdown();
 
         // Make the transaction log directory read only
@@ -277,9 +276,8 @@ public void testReadOnlyTxnLogDir() throws Exception {
         main = new MainThread(CLIENT_PORT, false, tmpDir, null);
         main.start();
 
-        assertFalse(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
 
         main.shutdown();
 
@@ -300,13 +298,12 @@ public void testStandalone() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -316,9 +313,8 @@ public void testStandalone() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
     }
 
     /**
@@ -425,13 +421,12 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, configs);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -441,9 +436,8 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
         assertTrue(MetricsProviderWithErrorInStop.stopCalled.get());
     }
 
@@ -463,13 +457,12 @@ public void testMetricsProviderConfiguration() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, configs);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -479,9 +472,8 @@ public void testMetricsProviderConfiguration() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
         assertEquals(1234, MetricsProviderWithConfiguration.httpPort.get());
     }
 
@@ -501,13 +493,12 @@ public void testMetricsProviderLifecycle() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, configs);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -517,11 +508,11 @@ public void testMetricsProviderLifecycle() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue("waiting for server down", ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get());
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get(), "metrics provider lifecycle error");
     }
 
     /**
@@ -541,7 +532,7 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         main.start();
 
         String HOSTPORT = "127.0.0.1:" + CLIENT_PORT;
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         // create session with min value
         verifySessionTimeOut(minSessionTimeout, minSessionTimeout, HOSTPORT);
         verifySessionTimeOut(minSessionTimeout - 2000, minSessionTimeout, HOSTPORT);
@@ -549,7 +540,7 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         verifySessionTimeOut(maxSessionTimeout, maxSessionTimeout, HOSTPORT);
         verifySessionTimeOut(maxSessionTimeout + 2000, maxSessionTimeout, HOSTPORT);
         main.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
     }
 
     /**
@@ -574,7 +565,7 @@ public void testMinMaxSessionTimeOut() throws Exception {
         main.start();
 
         String HOSTPORT = "127.0.0.1:" + CLIENT_PORT;
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         // create session with min value
         verifySessionTimeOut(minSessionTimeout, minSessionTimeout, HOSTPORT);
         verifySessionTimeOut(minSessionTimeout - 2000, minSessionTimeout, HOSTPORT);
@@ -583,14 +574,14 @@ public void testMinMaxSessionTimeOut() throws Exception {
         verifySessionTimeOut(maxSessionTimeout + 2000, maxSessionTimeout, HOSTPORT);
         main.shutdown();
 
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
     }
 
     private void verifySessionTimeOut(int sessionTimeout, int expectedSessionTimeout, String HOSTPORT) throws IOException, KeeperException, InterruptedException {
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper(HOSTPORT, sessionTimeout, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(sessionTimeout, TimeUnit.MILLISECONDS));
-        assertEquals("Not able to configure the sessionTimeout values", expectedSessionTimeout, zk.getSessionTimeout());
+        assertTrue(clientConnected.await(sessionTimeout, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
+        assertEquals(expectedSessionTimeout, zk.getSessionTimeout(), "Not able to configure the sessionTimeout values");
         zk.close();
     }
 
@@ -655,10 +646,9 @@ private ServerCnxnFactory startServer(File tmpDir) throws IOException, Interrupt
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(CLIENT_PORT, -1);
         f.startup(zks);
-        assertNotNull("JMX initialization failed!", zks.jmxServerBean);
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertNotNull(zks.jmxServerBean, "JMX initialization failed!");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
         return f;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
index 48f5b998387..fdb0b381f15 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
@@ -17,8 +17,9 @@
  */
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.CreateMode;
@@ -30,9 +31,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,13 +51,15 @@ public class ZooKeeperServerMaxCnxnsTest extends QuorumPeerTestBase {
      * </pre>
      */
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testMaxZooKeeperClientsWithNIOServerCnxnFactory() throws Exception {
         String serverCnxnFactory = "org.apache.zookeeper.server.NIOServerCnxnFactory";
         testMaxZooKeeperClients(serverCnxnFactory);
     }
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testMaxZooKeeperClientsWithNettyServerCnxnFactory() throws Exception {
         String serverCnxnFactory = "org.apache.zookeeper.server.NettyServerCnxnFactory";
         testMaxZooKeeperClients(serverCnxnFactory);
@@ -87,8 +90,8 @@ private void testMaxZooKeeperClients(String serverCnxnFactory) throws Exception
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up", ClientBase
-                    .waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         int maxAllowedConnection = maxCnxns * SERVER_COUNT;
@@ -151,7 +154,7 @@ private String getCxnString(int[] clientPorts) {
         return builder.toString();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all clients
         if (clients != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
index b9c21e47f53..91e5e903ce2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
@@ -20,9 +20,9 @@
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
 import static org.apache.zookeeper.server.command.AbstractFourLetterCommand.ZK_NOT_SERVING;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
@@ -33,8 +33,9 @@
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,7 +54,7 @@ public class ZooKeeperServerStartupTest extends ZKTestCase {
     private File tmpDir;
     private CountDownLatch startupDelayLatch = new CountDownLatch(1);
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         // count down to avoid infinite blocking call due to this latch, if
         // any.
@@ -75,26 +76,29 @@ public void teardown() throws Exception {
      * Test case for
      * https://issues.apache.org/jira/browse/ZOOKEEPER-2383
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testClientConnectionRequestDuringStartupWithNIOServerCnxn() throws Exception {
         tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
 
         startSimpleZKServer(startupDelayLatch);
         SimpleZooKeeperServer simplezks = (SimpleZooKeeperServer) zks;
-        assertTrue("Failed to invoke zks#startup() method during server startup", simplezks.waitForStartupInvocation(10));
+        assertTrue(simplezks.waitForStartupInvocation(10), "Failed to invoke zks#startup() method during server startup");
 
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zkClient = new ZooKeeper(HOSTPORT, ClientBase.CONNECTION_TIMEOUT, watcher);
 
-        assertFalse("Since server is not fully started, zks#createSession() shouldn't be invoked", simplezks.waitForSessionCreation(5));
+        assertFalse(simplezks.waitForSessionCreation(5),
+            "Since server is not fully started, zks#createSession() shouldn't be invoked");
 
         LOG.info("Decrements the count of the latch, so that server will proceed with startup");
         startupDelayLatch.countDown();
 
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server being up ");
 
-        assertTrue("Failed to invoke zks#createSession() method during client session creation", simplezks.waitForSessionCreation(5));
+        assertTrue(simplezks.waitForSessionCreation(5),
+            "Failed to invoke zks#createSession() method during client session creation");
         watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         zkClient.close();
     }
@@ -103,7 +107,8 @@ public void testClientConnectionRequestDuringStartupWithNIOServerCnxn() throws E
      * Test case for
      * https://issues.apache.org/jira/browse/ZOOKEEPER-2383
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testClientConnectionRequestDuringStartupWithNettyServerCnxn() throws Exception {
         tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
@@ -113,19 +118,19 @@ public void testClientConnectionRequestDuringStartupWithNettyServerCnxn() throws
             System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, NettyServerCnxnFactory.class.getName());
             startSimpleZKServer(startupDelayLatch);
             SimpleZooKeeperServer simplezks = (SimpleZooKeeperServer) zks;
-            assertTrue("Failed to invoke zks#startup() method during server startup", simplezks.waitForStartupInvocation(10));
+            assertTrue(simplezks.waitForStartupInvocation(10), "Failed to invoke zks#startup() method during server startup");
 
             CountdownWatcher watcher = new CountdownWatcher();
             ZooKeeper zkClient = new ZooKeeper(HOSTPORT, ClientBase.CONNECTION_TIMEOUT, watcher);
 
-            assertFalse("Since server is not fully started, zks#createSession() shouldn't be invoked", simplezks.waitForSessionCreation(5));
+            assertFalse(simplezks.waitForSessionCreation(5), "Since server is not fully started, zks#createSession() shouldn't be invoked");
 
             LOG.info("Decrements the count of the latch, so that server will proceed with startup");
             startupDelayLatch.countDown();
 
-            assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server being up ");
 
-            assertTrue("Failed to invoke zks#createSession() method during client session creation", simplezks.waitForSessionCreation(5));
+            assertTrue(simplezks.waitForSessionCreation(5), "Failed to invoke zks#createSession() method during client session creation");
             watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
             zkClient.close();
         } finally {
@@ -142,7 +147,8 @@ public void testClientConnectionRequestDuringStartupWithNettyServerCnxn() throws
      * Test case for
      * https://issues.apache.org/jira/browse/ZOOKEEPER-2383
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWords() throws Exception {
         startSimpleZKServer(startupDelayLatch);
         verify("conf", ZK_NOT_SERVING);
@@ -162,7 +168,7 @@ public void testFourLetterWords() throws Exception {
     private void verify(String cmd, String expected) throws IOException, SSLContextException {
         String resp = sendRequest(cmd);
         LOG.info("cmd {} expected {} got {}", cmd, expected, resp);
-        assertTrue("Unexpected response", resp.contains(expected));
+        assertTrue(resp.contains(expected), "Unexpected response");
     }
 
     private String sendRequest(String cmd) throws IOException, SSLContextException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index 81469a8f858..374ed5b1e57 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.List;
@@ -29,7 +29,7 @@
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperServerTest extends ZKTestCase {
 
@@ -125,8 +125,8 @@ public void testInvalidSnapshot() {
             if (!f.exists()) {
                 f.createNewFile();
             }
-            assertFalse("Snapshot file size is greater than 9 bytes", SnapStream.isValidSnapshot(f));
-            assertTrue("Can't delete file", f.delete());
+            assertFalse(SnapStream.isValidSnapshot(f), "Snapshot file size is greater than 9 bytes");
+            assertTrue(f.delete(), "Can't delete file");
         } catch (IOException e) {
         } finally {
             if (null != tmpFileDir) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
index fe53f4d1244..6cf1e2147b9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
@@ -18,11 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ZooKeeperThreadTest extends ZKTestCase {
 
@@ -71,16 +72,17 @@ protected void handleException(String thName, Throwable e) {
     /**
      * Test verifies uncaught exception handling of ZooKeeperThread
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testUncaughtException() throws Exception {
         MyThread t1 = new MyThread("Test-Thread");
         t1.start();
-        assertTrue("Uncaught exception is not properly handled.", runningLatch.await(10000, TimeUnit.MILLISECONDS));
+        assertTrue(runningLatch.await(10000, TimeUnit.MILLISECONDS), "Uncaught exception is not properly handled.");
 
         runningLatch = new CountDownLatch(1);
         MyCriticalThread t2 = new MyCriticalThread("Test-Critical-Thread");
         t2.start();
-        assertTrue("Uncaught exception is not properly handled.", runningLatch.await(10000, TimeUnit.MILLISECONDS));
+        assertTrue(runningLatch.await(10000, TimeUnit.MILLISECONDS), "Uncaught exception is not properly handled.");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
index 42e366ec5c8..031ccc2f7da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.ConnectionLossException;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.test.ClientTest;
 import org.apache.zookeeper.test.QuorumUtil;
 import org.apache.zookeeper.test.QuorumUtil.PeerStruct;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,7 +57,7 @@ private ZooKeeper getClient(int idx) {
         return zkClients[idx - 1];
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("zookeeper.admin.enableServer", "false");
 
@@ -117,9 +117,8 @@ private void checkClientConnected(int idx) throws Exception {
             // in the try, this catches that case and waits for the server
             // to come back
             PeerStruct peer = qu.getPeer(idx);
-            assertTrue(
-                    "Waiting for server down",
-                    ClientBase.waitForServerUp("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    "Waiting for server down");
 
             assertNull(zk.exists("/foofoofoo-connected", false));
         }
@@ -161,7 +160,7 @@ private void startAll() throws Exception {
     private void start(int idx) throws Exception {
         qu.start(idx);
         for (String hp : qu.getConnString().split(",")) {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, ClientTest.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, ClientTest.CONNECTION_TIMEOUT), "waiting for server up");
         }
 
         checkLeader();
@@ -190,9 +189,8 @@ private void shutdown(int idx) throws Exception {
 
         // leader will shutdown, remaining followers will elect a new leader
         PeerStruct peer = qu.getPeer(idx);
-        assertTrue(
-                "Waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server down");
 
         // if idx is the the leader then everyone will get disconnected,
         // otherwise if idx is a follower then just that client will get
@@ -215,7 +213,7 @@ private void adjustEpochNearEnd() {
         zksLeader.setZxid((zksLeader.getZxid() & 0xffffffff00000000L) | 0xfffffffcL);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
         for (int i = 0; i < zkClients.length; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
index 20dc4079294..cfa130690f5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
@@ -17,18 +17,18 @@
 
 package org.apache.zookeeper.server.admin;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class CommandResponseTest extends ZKTestCase {
 
     private CommandResponse r;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         r = new CommandResponse("makemeasandwich", "makeityourself");
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index 5f6879e7a20..3cd6d60376c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server.admin;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.IOException;
@@ -37,7 +37,7 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.BufferStats;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CommandsTest extends ClientBase {
 
@@ -63,30 +63,20 @@ public void testCommand(String cmdName, Map<String, String> kwargs, Field... fie
         // This is only true because we're setting cmdName to the primary name
         assertEquals(cmdName, result.remove("command"));
         assertTrue(result.containsKey("error"));
-        assertNull("error: " + result.get("error"), result.remove("error"));
+        assertNull(result.remove("error"), "error: " + result.get("error"));
 
         for (Field field : fields) {
             String k = field.key;
-            assertTrue("Result from command "
-                               + cmdName
-                               + " missing field \""
-                               + k
-                               + "\""
-                               + "\n"
-                               + result, result.containsKey(k));
+            assertTrue(result.containsKey(k),
+                    "Result from command " + cmdName + " missing field \"" + k + "\"" + "\n" + result);
             Class<?> t = field.type;
             Object v = result.remove(k);
-            assertTrue("\""
-                               + k
-                               + "\" field from command "
-                               + cmdName
-                               + " should be of type "
-                               + t
-                               + ", is actually of type "
-                               + v.getClass(), t.isAssignableFrom(v.getClass()));
+            assertTrue(t.isAssignableFrom(v.getClass()),
+                    "\"" + k + "\" field from command " + cmdName
+                            + " should be of type " + t + ", is actually of type " + v.getClass());
         }
 
-        assertTrue("Result from command " + cmdName + " contains extra fields: " + result, result.isEmpty());
+        assertTrue(result.isEmpty(), "Result from command " + cmdName + " contains extra fields: " + result);
     }
 
     public void testCommand(String cmdName, Field... fields) throws IOException, InterruptedException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 4e77a6bb9c7..7e7f04951d3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.admin;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
@@ -46,9 +46,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -60,14 +60,14 @@ public class JettyAdminServerTest extends ZKTestCase {
     private static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
     private static final int jettyAdminPort = PortAssignment.unique();
 
-    @Before
+    @BeforeEach
     public void enableServer() {
         // Override setting in ZKTestCase
         System.setProperty("zookeeper.admin.enableServer", "true");
         System.setProperty("zookeeper.admin.serverPort", "" + jettyAdminPort);
     }
 
-    @Before
+    @BeforeEach
     public void setupEncryption() {
         Security.addProvider(new BouncyCastleProvider());
         File tmpDir = null;
@@ -129,7 +129,7 @@ public boolean verify(String hostname, SSLSession session) {
         HttpsURLConnection.setDefaultHostnameVerifier(allValid);
     }
 
-    @After
+    @AfterEach
     public void cleanUp() {
         Security.removeProvider("BC");
 
@@ -172,17 +172,15 @@ public void testStandalone() throws Exception {
         ZooKeeperServerMainTest.MainThread main = new ZooKeeperServerMainTest.MainThread(CLIENT_PORT, false, null);
         main.start();
 
-        assertTrue(
-            "waiting for server being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         queryAdminServer(jettyAdminPort);
 
         main.shutdown();
 
-        assertTrue(
-            "waiting for server down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
     }
 
     /**
@@ -219,12 +217,10 @@ public void testQuorum() throws Exception {
 
         Thread.sleep(500);
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         queryAdminServer(ADMIN_SERVER_PORT1);
         queryAdminServer(ADMIN_SERVER_PORT2);
@@ -232,12 +228,10 @@ public void testQuorum() throws Exception {
         q1.shutdown();
         q2.shutdown();
 
-        assertTrue(
-            "waiting for server 1 down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java
index 50e3788ccb9..7201ca9c20d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.metric;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AvgMinMaxCounterSetTest extends ZKTestCase {
 
     private AvgMinMaxCounterSet testCounterSet;
 
-    @Before
+    @BeforeEach
     public void initCounter() {
         testCounterSet = new AvgMinMaxCounterSet("test");
     }
@@ -49,19 +49,19 @@ public void testReset() {
 
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("There should be 10 values in the set", 10, values.size());
+        assertEquals(10, values.size(), "There should be 10 values in the set");
 
-        assertEquals("avg_key1_test should =0", 0D, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =0", 0L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =0", 0L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =0", 0L, values.get("sum_key1_test"));
+        assertEquals(0D, values.get("avg_key1_test"), "avg_key1_test should =0");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(0L, values.get("max_key1_test"), "max_key1_test should =0");
+        assertEquals(0L, values.get("cnt_key1_test"), "cnt_key1_test should =0");
+        assertEquals(0L, values.get("sum_key1_test"), "sum_key1_test should =0");
 
-        assertEquals("avg_key2_test should =0", 0D, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =0", 0L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =0", 0L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =0", 0L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =0", 0L, values.get("sum_key2_test"));
+        assertEquals(0D, values.get("avg_key2_test"), "avg_key2_test should =0");
+        assertEquals(0L, values.get("min_key2_test"), "min_key2_test should =0");
+        assertEquals(0L, values.get("max_key2_test"), "max_key2_test should =0");
+        assertEquals(0L, values.get("cnt_key2_test"), "cnt_key2_test should =0");
+        assertEquals(0L, values.get("sum_key2_test"), "sum_key2_test should =0");
 
     }
 
@@ -70,18 +70,18 @@ public void testValues() {
         addDataPoints();
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("There should be 10 values in the set", 10, values.size());
-        assertEquals("avg_key1_test should =0.5", 0.5D, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =1", 1L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =2", 2L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =1", 1L, values.get("sum_key1_test"));
-
-        assertEquals("avg_key2_test should =3.5", 3.5, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =2", 2L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =5", 5L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =4", 4L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =14", 14L, values.get("sum_key2_test"));
+        assertEquals(10, values.size(), "There should be 10 values in the set");
+        assertEquals(0.5D, values.get("avg_key1_test"), "avg_key1_test should =0.5");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(1L, values.get("max_key1_test"), "max_key1_test should =1");
+        assertEquals(2L, values.get("cnt_key1_test"), "cnt_key1_test should =2");
+        assertEquals(1L, values.get("sum_key1_test"), "sum_key1_test should =1");
+
+        assertEquals(3.5, values.get("avg_key2_test"), "avg_key2_test should =3.5");
+        assertEquals(2L, values.get("min_key2_test"), "min_key2_test should =2");
+        assertEquals(5L, values.get("max_key2_test"), "max_key2_test should =5");
+        assertEquals(4L, values.get("cnt_key2_test"), "cnt_key2_test should =4");
+        assertEquals(14L, values.get("sum_key2_test"), "sum_key2_test should =14");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java
index e120ac51ab5..dafa085e636 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.metric;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AvgMinMaxPercentileCounterSetTest extends ZKTestCase {
 
     private AvgMinMaxPercentileCounterSet testCounterSet;
 
-    @Before
+    @BeforeEach
     public void initCounter() {
         testCounterSet = new AvgMinMaxPercentileCounterSet("test");
     }
@@ -50,25 +50,25 @@ public void testReset() {
 
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("avg_key1_test should =0", 0D, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =0", 0L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =0", 0L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =0", 0L, values.get("sum_key1_test"));
-        assertEquals("p50_key1_test should have p50=0", 0L, values.get("p50_key1_test"));
-        assertEquals("p95_key1_test should have p95=0", 0L, values.get("p95_key1_test"));
-        assertEquals("p99_key1_test should have p99=0", 0L, values.get("p99_key1_test"));
-        assertEquals("p999_key1_test should have p999=0", 0L, values.get("p999_key1_test"));
-
-        assertEquals("avg_key2_test should =0", 0D, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =0", 0L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =0", 0L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =0", 0L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =0", 0L, values.get("sum_key2_test"));
-        assertEquals("p50_key2_test should have p50=0", 0L, values.get("p50_key2_test"));
-        assertEquals("p95_key2_test should have p95=0", 0L, values.get("p95_key2_test"));
-        assertEquals("p99_key2_test should have p99=0", 0L, values.get("p99_key2_test"));
-        assertEquals("p999_key2_test should have p999=0", 0L, values.get("p999_key2_test"));
+        assertEquals(0D, values.get("avg_key1_test"), "avg_key1_test should =0");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(0L, values.get("max_key1_test"), "max_key1_test should =0");
+        assertEquals(0L, values.get("cnt_key1_test"), "cnt_key1_test should =0");
+        assertEquals(0L, values.get("sum_key1_test"), "sum_key1_test should =0");
+        assertEquals(0L, values.get("p50_key1_test"), "p50_key1_test should have p50=0");
+        assertEquals(0L, values.get("p95_key1_test"), "p95_key1_test should have p95=0");
+        assertEquals(0L, values.get("p99_key1_test"), "p99_key1_test should have p99=0");
+        assertEquals(0L, values.get("p999_key1_test"), "p999_key1_test should have p999=0");
+
+        assertEquals(0D, values.get("avg_key2_test"), "avg_key2_test should =0");
+        assertEquals(0L, values.get("min_key2_test"), "min_key2_test should =0");
+        assertEquals(0L, values.get("max_key2_test"), "max_key2_test should =0");
+        assertEquals(0L, values.get("cnt_key2_test"), "cnt_key2_test should =0");
+        assertEquals(0L, values.get("sum_key2_test"), "sum_key2_test should =0");
+        assertEquals(0L, values.get("p50_key2_test"), "p50_key2_test should have p50=0");
+        assertEquals(0L, values.get("p95_key2_test"), "p95_key2_test should have p95=0");
+        assertEquals(0L, values.get("p99_key2_test"), "p99_key2_test should have p99=0");
+        assertEquals(0L, values.get("p999_key2_test"), "p999_key2_test should have p999=0");
     }
 
     @Test
@@ -76,27 +76,27 @@ public void testValues() {
         addDataPoints();
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("There should be 18 values in the set", 18, values.size());
-
-        assertEquals("avg_key1_test should =499.5", 999D / 2, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =999", 999L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =1000", 1000L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =999*500", 999 * 500L, values.get("sum_key1_test"));
-        assertEquals("p50_key1_test should have p50=500", 500L, values.get("p50_key1_test"));
-        assertEquals("p95_key1_test should have p95=950", 950L, values.get("p95_key1_test"));
-        assertEquals("p99_key1_test should have p99=990", 990L, values.get("p99_key1_test"));
-        assertEquals("p999_key1_test should have p999=999", 999L, values.get("p999_key1_test"));
-
-        assertEquals("avg_key2_test should =3.5", 1000 + 999D / 2, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =2", 1000L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =5", 1999L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =4", 1000L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =14", 2999 * 500L, values.get("sum_key2_test"));
-        assertEquals("p50_key2_test should have p50=1500", 1500L, values.get("p50_key2_test"));
-        assertEquals("p95_key2_test should have p95=1950", 1950L, values.get("p95_key2_test"));
-        assertEquals("p99_key2_test should have p99=1990", 1990L, values.get("p99_key2_test"));
-        assertEquals("p999_key2_test should have p999=1999", 1999L, values.get("p999_key2_test"));
+        assertEquals(18, values.size(), "There should be 18 values in the set");
+
+        assertEquals(999D / 2, values.get("avg_key1_test"), "avg_key1_test should =499.5");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(999L, values.get("max_key1_test"), "max_key1_test should =999");
+        assertEquals(1000L, values.get("cnt_key1_test"), "cnt_key1_test should =1000");
+        assertEquals(999 * 500L, values.get("sum_key1_test"), "sum_key1_test should =999*500");
+        assertEquals(500L, values.get("p50_key1_test"), "p50_key1_test should have p50=500");
+        assertEquals(950L, values.get("p95_key1_test"), "p95_key1_test should have p95=950");
+        assertEquals(990L, values.get("p99_key1_test"), "p99_key1_test should have p99=990");
+        assertEquals(999L, values.get("p999_key1_test"), "p999_key1_test should have p999=999");
+
+        assertEquals(1000 + 999D / 2, values.get("avg_key2_test"), "avg_key2_test should =3.5");
+        assertEquals(1000L, values.get("min_key2_test"), "min_key2_test should =2");
+        assertEquals(1999L, values.get("max_key2_test"), "max_key2_test should =5");
+        assertEquals(1000L, values.get("cnt_key2_test"), "cnt_key2_test should =4");
+        assertEquals(2999 * 500L, values.get("sum_key2_test"), "sum_key2_test should =14");
+        assertEquals(1500L, values.get("p50_key2_test"), "p50_key2_test should have p50=1500");
+        assertEquals(1950L, values.get("p95_key2_test"), "p95_key2_test should have p95=1950");
+        assertEquals(1990L, values.get("p99_key2_test"), "p99_key2_test should have p99=1990");
+        assertEquals(1999L, values.get("p999_key2_test"), "p999_key2_test should have p999=1999");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java
index ecfdbbcfb5b..4b482c97ac7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.metric;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AvgMinMaxPercentileCounterTest extends ZKTestCase {
 
     private AvgMinMaxPercentileCounter testCounter;
 
-    @Before
+    @BeforeEach
     public void initCounter() {
         testCounter = new AvgMinMaxPercentileCounter("test");
     }
@@ -46,17 +46,17 @@ public void testReset() {
 
         Map<String, Object> values = testCounter.values();
 
-        assertEquals("There should be 9 values in the set", 9, values.size());
+        assertEquals(9, values.size(), "There should be 9 values in the set");
 
-        assertEquals("should avg=0", 0D, values.get("avg_test"));
-        assertEquals("should have min=0", 0L, values.get("min_test"));
-        assertEquals("should have max=0", 0L, values.get("max_test"));
-        assertEquals("should have cnt=0", 0L, values.get("cnt_test"));
-        assertEquals("should have sum=0", 0L, values.get("sum_test"));
-        assertEquals("should have p50=0", 0L, values.get("p50_test"));
-        assertEquals("should have p95=0", 0L, values.get("p95_test"));
-        assertEquals("should have p99=0", 0L, values.get("p99_test"));
-        assertEquals("should have p999=0", 0L, values.get("p999_test"));
+        assertEquals(0D, values.get("avg_test"), "should avg=0");
+        assertEquals(0L, values.get("min_test"), "should have min=0");
+        assertEquals(0L, values.get("max_test"), "should have max=0");
+        assertEquals(0L, values.get("cnt_test"), "should have cnt=0");
+        assertEquals(0L, values.get("sum_test"), "should have sum=0");
+        assertEquals(0L, values.get("p50_test"), "should have p50=0");
+        assertEquals(0L, values.get("p95_test"), "should have p95=0");
+        assertEquals(0L, values.get("p99_test"), "should have p99=0");
+        assertEquals(0L, values.get("p999_test"), "should have p999=0");
     }
 
     @Test
@@ -64,17 +64,17 @@ public void testValues() {
         addDataPoints();
         Map<String, Object> values = testCounter.values();
 
-        assertEquals("There should be 9 values in the set", 9, values.size());
+        assertEquals(9, values.size(), "There should be 9 values in the set");
 
-        assertEquals("should avg=499.5", 999D / 2, values.get("avg_test"));
-        assertEquals("should have min=0", 0L, values.get("min_test"));
-        assertEquals("should have max=999", 999L, values.get("max_test"));
-        assertEquals("should have cnt=1000", 1000L, values.get("cnt_test"));
-        assertEquals("should have sum=999*500", 999 * 500L, values.get("sum_test"));
-        assertEquals("should have p50=500", 500L, values.get("p50_test"));
-        assertEquals("should have p95=950", 950L, values.get("p95_test"));
-        assertEquals("should have p99=990", 990L, values.get("p99_test"));
-        assertEquals("should have p999=999", 999L, values.get("p999_test"));
+        assertEquals(999D / 2, values.get("avg_test"), "should avg=499.5");
+        assertEquals(0L, values.get("min_test"), "should have min=0");
+        assertEquals(999L, values.get("max_test"), "should have max=999");
+        assertEquals(1000L, values.get("cnt_test"), "should have cnt=1000");
+        assertEquals(999 * 500L, values.get("sum_test"), "should have sum=999*500");
+        assertEquals(500L, values.get("p50_test"), "should have p50=500");
+        assertEquals(950L, values.get("p95_test"), "should have p95=950");
+        assertEquals(990L, values.get("p99_test"), "should have p99=990");
+        assertEquals(999L, values.get("p999_test"), "should have p999=999");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
index 7eb6f6003ff..e636b23dd3f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
@@ -18,16 +18,16 @@
 
 package org.apache.zookeeper.server.persistence;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import org.apache.zookeeper.server.DataTree;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * This test checks that the server does not create empty snapshot files if the
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index 52a734f42a2..adcc5f9fd7a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server.persistence;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
 import static org.hamcrest.core.IsEqual.equalTo;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import java.io.File;
 import java.io.IOException;
@@ -45,7 +45,7 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,38 +57,28 @@ public class FileTxnLogTest extends ZKTestCase {
 
     @Test
     public void testInvalidPreallocSize() {
-        assertEquals(
-            "file should not be padded",
-            10 * KB,
-            FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 0));
-        assertEquals(
-            "file should not be padded",
-            10 * KB,
-            FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, -1));
+        assertEquals(10 * KB, FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 0),
+                "file should not be padded");
+        assertEquals(10 * KB, FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, -1),
+                "file should not be padded");
     }
 
     @Test
     public void testCalculateFileSizeWithPaddingWhenNotToCurrentSize() {
-        assertEquals(
-            "file should not be padded",
-            10 * KB,
-            FilePadding.calculateFileSizeWithPadding(5 * KB, 10 * KB, 10 * KB));
+        assertEquals(10 * KB, FilePadding.calculateFileSizeWithPadding(5 * KB, 10 * KB, 10 * KB),
+                "file should not be padded");
     }
 
     @Test
     public void testCalculateFileSizeWithPaddingWhenCloseToCurrentSize() {
-        assertEquals(
-            "file should be padded an additional 10 KB",
-            20 * KB,
-            FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 10 * KB));
+        assertEquals(20 * KB, FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 10 * KB),
+                "file should be padded an additional 10 KB");
     }
 
     @Test
     public void testFileSizeGreaterThanPosition() {
-        assertEquals(
-            "file should be padded to 40 KB",
-            40 * KB,
-            FilePadding.calculateFileSizeWithPadding(31 * KB, 10 * KB, 10 * KB));
+        assertEquals(40 * KB, FilePadding.calculateFileSizeWithPadding(31 * KB, 10 * KB, 10 * KB),
+                "file should be padded to 40 KB");
     }
 
     @Test
@@ -217,7 +207,7 @@ public void testLogSizeLimit() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, DummyWatcher.INSTANCE);
 
         // Generate transactions
@@ -245,25 +235,19 @@ public void testLogSizeLimit() throws Exception {
 
         // shutdown
         f.shutdown();
-        assertTrue(
-            "waiting for server to shutdown",
-            ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
         File logDir = new File(tmpDir, FileTxnSnapLog.version + FileTxnSnapLog.VERSION);
         File[] txnLogs = FileTxnLog.getLogFiles(logDir.listFiles(), 0);
 
-        assertEquals("Unexpected number of logs", 3, txnLogs.length);
+        assertEquals(3, txnLogs.length, "Unexpected number of logs");
 
         // Log size should not exceed limit by more than one node size;
         long threshold = LOG_SIZE_LIMIT + NODE_SIZE;
         LOG.info(txnLogs[0].getAbsolutePath());
-        assertTrue(
-            "Exceed log size limit: " + txnLogs[0].length(),
-            threshold > txnLogs[0].length());
+        assertTrue(threshold > txnLogs[0].length(), "Exceed log size limit: " + txnLogs[0].length());
         LOG.info(txnLogs[1].getAbsolutePath());
-        assertTrue(
-            "Exceed log size limit " + txnLogs[1].length(),
-            threshold > txnLogs[1].length());
+        assertTrue(threshold > txnLogs[1].length(), "Exceed log size limit " + txnLogs[1].length());
 
         // Start database only
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -274,8 +258,8 @@ public void testLogSizeLimit() throws Exception {
         for (long i = 0; i < txnCount; i++) {
             Stat stat = new Stat();
             byte[] data = db.getData("/node-" + i, stat, null);
-            assertArrayEquals("Missmatch data", bytes, data);
-            assertTrue("Unknown zxid ", zxids.contains(stat.getMzxid()));
+            assertArrayEquals(bytes, data, "Missmatch data");
+            assertTrue(zxids.contains(stat.getMzxid()), "Unknown zxid ");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
index fe075fb4981..a93dcc80b05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.persistence;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
@@ -35,7 +35,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
index 34d57f415dd..44a00993443 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
@@ -18,13 +18,14 @@
 
 package org.apache.zookeeper.server.persistence;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
@@ -47,9 +48,9 @@
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class FileTxnSnapLogTest {
 
@@ -63,14 +64,14 @@ public class FileTxnSnapLogTest {
 
     private File snapVersionDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         tmpDir = ClientBase.createEmptyTestDir();
         logDir = new File(tmpDir, "logdir");
         snapDir = new File(tmpDir, "snapdir");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (tmpDir != null) {
             TestUtils.deleteFileRecursively(tmpDir);
@@ -169,8 +170,8 @@ private FileTxnSnapLog createFileTxnSnapLogWithAutoCreateDB(
      */
     @Test
     public void testWithAutoCreateDataDir() throws IOException {
-        assertFalse("log directory already exists", logDir.exists());
-        assertFalse("snapshot directory already exists", snapDir.exists());
+        assertFalse(logDir.exists(), "log directory already exists");
+        assertFalse(snapDir.exists(), "snapshot directory already exists");
 
         FileTxnSnapLog fileTxnSnapLog = createFileTxnSnapLogWithAutoCreateDataDir(logDir, snapDir, "true");
 
@@ -184,20 +185,22 @@ public void testWithAutoCreateDataDir() throws IOException {
      * Test verifies server should fail when log dir or snap dir doesn't exist.
      * Sets "zookeeper.datadir.autocreate" to false.
      */
-    @Test(expected = FileTxnSnapLog.DatadirException.class)
+    @Test
     public void testWithoutAutoCreateDataDir() throws Exception {
-        assertFalse("log directory already exists", logDir.exists());
-        assertFalse("snapshot directory already exists", snapDir.exists());
-
-        try {
-            createFileTxnSnapLogWithAutoCreateDataDir(logDir, snapDir, "false");
-        } catch (FileTxnSnapLog.DatadirException e) {
-            assertFalse(logDir.exists());
-            assertFalse(snapDir.exists());
-            // rethrow exception
-            throw e;
-        }
-        fail("Expected exception from FileTxnSnapLog");
+        assertThrows(FileTxnSnapLog.DatadirException.class, () -> {
+            assertFalse(logDir.exists(), "log directory already exists");
+            assertFalse(snapDir.exists(), "snapshot directory already exists");
+
+            try {
+                createFileTxnSnapLogWithAutoCreateDataDir(logDir, snapDir, "false");
+            } catch (FileTxnSnapLog.DatadirException e) {
+                assertFalse(logDir.exists());
+                assertFalse(snapDir.exists());
+                // rethrow exception
+                throw e;
+            }
+            fail("Expected exception from FileTxnSnapLog");
+        });
     }
 
     private void attemptAutoCreateDB(
@@ -216,22 +219,22 @@ public void onTxnLoaded(TxnHeader hdr, Record rec, TxnDigest digest) {
                 // empty by default
             }
         });
-        assertEquals("unexpected zxid", expectedValue, zxid);
+        assertEquals(expectedValue, zxid, "unexpected zxid");
     }
 
     @Test
     public void testAutoCreateDB() throws IOException {
-        assertTrue("cannot create log directory", logDir.mkdir());
-        assertTrue("cannot create snapshot directory", snapDir.mkdir());
+        assertTrue(logDir.mkdir(), "cannot create log directory");
+        assertTrue(snapDir.mkdir(), "cannot create snapshot directory");
         File initFile = new File(logDir, "initialize");
-        assertFalse("initialize file already exists", initFile.exists());
+        assertFalse(initFile.exists(), "initialize file already exists");
 
         Map<Long, Integer> sessions = new ConcurrentHashMap<>();
 
         attemptAutoCreateDB(logDir, snapDir, sessions, "false", -1L);
         attemptAutoCreateDB(logDir, snapDir, sessions, "true", 0L);
 
-        assertTrue("cannot create initialize file", initFile.createNewFile());
+        assertTrue(initFile.createNewFile(), "cannot create initialize file");
         attemptAutoCreateDB(logDir, snapDir, sessions, "false", 0L);
     }
 
@@ -247,7 +250,7 @@ public void testGetTxnLogSyncElapsedTime() throws IOException {
             fileTxnSnapLog.append(req);
             fileTxnSnapLog.commit();
             long syncElapsedTime = fileTxnSnapLog.getTxnLogElapsedSyncTime();
-            assertNotEquals("Did not update syncElapsedTime!", -1L, syncElapsedTime);
+            assertNotEquals(-1L, syncElapsedTime, "Did not update syncElapsedTime!");
         } finally {
             fileTxnSnapLog.close();
         }
@@ -275,26 +278,30 @@ public void testDirCheckWithSingleDirSetup() throws IOException {
         }
     }
 
-    @Test(expected = FileTxnSnapLog.LogDirContentCheckException.class)
+    @Test
     public void testDirCheckWithSnapFilesInLogDir() throws IOException {
-        twoDirSetupWithCorrectFiles();
+        assertThrows(FileTxnSnapLog.LogDirContentCheckException.class, () -> {
+            twoDirSetupWithCorrectFiles();
 
-        // add snapshot files to the log version dir
-        createSnapshotFile(logVersionDir, 3);
-        createSnapshotFile(logVersionDir, 4);
+            // add snapshot files to the log version dir
+            createSnapshotFile(logVersionDir, 3);
+            createSnapshotFile(logVersionDir, 4);
 
-        createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+            createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+        });
     }
 
-    @Test(expected = FileTxnSnapLog.SnapDirContentCheckException.class)
+    @Test
     public void testDirCheckWithLogFilesInSnapDir() throws IOException {
-        twoDirSetupWithCorrectFiles();
+        assertThrows(FileTxnSnapLog.SnapDirContentCheckException.class, () -> {
+            twoDirSetupWithCorrectFiles();
 
-        // add transaction log files to the snap version dir
-        createLogFile(snapVersionDir, 3);
-        createLogFile(snapVersionDir, 4);
+            // add transaction log files to the snap version dir
+            createLogFile(snapVersionDir, 3);
+            createLogFile(snapVersionDir, 4);
 
-        createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+            createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+        });
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
index 65457803679..9292c38b3b4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.persistence;
 
 import static org.apache.zookeeper.test.ClientBase.createTmpDir;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.io.OutputStream;
@@ -32,12 +32,12 @@
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.zookeeper.server.persistence.SnapStream.StreamMode;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 public class SnapStreamTest {
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty(SnapStream.ZOOKEEPER_SHAPSHOT_STREAM_MODE);
         SnapStream.setStreamMode(StreamMode.DEFAULT_MODE);
@@ -58,9 +58,9 @@ public void testStreamMode() {
 
     @Test
     public void testGetStreamMode() {
-        assertEquals("expected to return un-compressed stream", StreamMode.CHECKED, SnapStream.getStreamMode("snapshot.180000e3a2"));
-        assertEquals("expected to return snappy stream", StreamMode.SNAPPY, SnapStream.getStreamMode("snapshot.180000e3a2.snappy"));
-        assertEquals("expected to return gzip stream", StreamMode.GZIP, SnapStream.getStreamMode("snapshot.180000e3a2.gz"));
+        assertEquals(StreamMode.CHECKED, SnapStream.getStreamMode("snapshot.180000e3a2"), "expected to return un-compressed stream");
+        assertEquals(StreamMode.SNAPPY, SnapStream.getStreamMode("snapshot.180000e3a2.snappy"), "expected to return snappy stream");
+        assertEquals(StreamMode.GZIP, SnapStream.getStreamMode("snapshot.180000e3a2.gz"), "expected to return gzip stream");
     }
 
     @Test
@@ -104,7 +104,7 @@ private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolea
         InputArchive ia = BinaryInputArchive.getArchive(is);
         FileHeader restoredHeader = new FileHeader();
         restoredHeader.deserialize(ia, "fileheader");
-        assertEquals("magic not the same", restoredHeader, header);
+        assertEquals(restoredHeader, header, "magic not the same");
         SnapStream.checkSealIntegrity(is, ia);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
index 20d6fe8a96b..c65113469f9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
@@ -19,9 +19,10 @@
 package org.apache.zookeeper.server.persistence;
 
 import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.IsNot.not;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -32,9 +33,9 @@
 import java.util.regex.Pattern;
 import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class TxnLogToolkitTest {
 
@@ -44,7 +45,7 @@ public class TxnLogToolkitTest {
     private final ByteArrayOutputStream errContent = new ByteArrayOutputStream();
     private File mySnapDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         System.setOut(new PrintStream(outContent));
         System.setErr(new PrintStream(errContent));
@@ -53,7 +54,7 @@ public void setUp() throws IOException {
         FileUtils.copyDirectory(snapDir, mySnapDir);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws IOException {
         System.setOut(System.out);
         System.setErr(System.err);
@@ -74,20 +75,24 @@ public void testDumpMode() throws Exception {
         // no exception thrown
     }
 
-    @Test(expected = TxnLogToolkit.TxnLogToolkitException.class)
+    @Test
     public void testInitMissingFile() throws FileNotFoundException, TxnLogToolkit.TxnLogToolkitException {
-        // Arrange & Act
-        File logfile = new File("this_file_should_not_exists");
-        TxnLogToolkit lt = new TxnLogToolkit(false, false, logfile.toString(), true);
+        assertThrows(TxnLogToolkit.TxnLogToolkitException.class, () -> {
+            // Arrange & Act
+            File logfile = new File("this_file_should_not_exists");
+            TxnLogToolkit lt = new TxnLogToolkit(false, false, logfile.toString(), true);
+        });
     }
 
-    @Test(expected = TxnLogToolkit.TxnLogToolkitException.class)
-    public void testInitWithRecoveryFileExists() throws IOException, TxnLogToolkit.TxnLogToolkitException {
-        // Arrange & Act
-        File logfile = new File(new File(mySnapDir, "version-2"), "log.274");
-        File recoveryFile = new File(new File(mySnapDir, "version-2"), "log.274.fixed");
-        recoveryFile.createNewFile();
-        TxnLogToolkit lt = new TxnLogToolkit(true, false, logfile.toString(), true);
+    @Test
+    public void testInitWithRecoveryFileExists() {
+        assertThrows(TxnLogToolkit.TxnLogToolkitException.class, () -> {
+            // Arrange & Act
+            File logfile = new File(new File(mySnapDir, "version-2"), "log.274");
+            File recoveryFile = new File(new File(mySnapDir, "version-2"), "log.274.fixed");
+            recoveryFile.createNewFile();
+            TxnLogToolkit lt = new TxnLogToolkit(true, false, logfile.toString(), true);
+        });
     }
 
     @Test
@@ -103,7 +108,7 @@ public void testDumpWithCrcError() throws Exception {
         String output = outContent.toString();
         Pattern p = Pattern.compile("^CRC ERROR.*session 0x8061fac5ddeb0000 cxid 0x0 zxid 0x8800000002 createSession 30000$", Pattern.MULTILINE);
         Matcher m = p.matcher(output);
-        assertTrue("Output doesn't indicate CRC error for the broken session id: " + output, m.find());
+        assertTrue(m.find(), "Output doesn't indicate CRC error for the broken session id: " + output);
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java
index 9fb9cfb2bdb..abe9764dfc6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import org.junit.jupiter.api.Test;
 
 public class BufferStatsTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java
index 6727d0053a9..646668abdb8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java
@@ -18,14 +18,15 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CloseSessionTxnTest extends QuorumPeerTestBase {
 
@@ -89,8 +90,8 @@ private void testCloseSessionWithDifferentConfig(
         for (int i = 0; i < numServers; i++) {
             final CountDownLatch syncedLatch = new CountDownLatch(1);
             servers.zk[i].sync(path, (rc, path1, ctx) -> syncedLatch.countDown(), null);
-            Assert.assertTrue(syncedLatch.await(3, TimeUnit.SECONDS));
-            Assert.assertNull(servers.zk[i].exists(path, false));
+            assertTrue(syncedLatch.await(3, TimeUnit.SECONDS));
+            assertNull(servers.zk[i].exists(path, false));
         }
     }
  }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
index a99e33678f0..e8b19dced0e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.DataInputStream;
@@ -58,8 +58,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.FLENewEpochTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -74,7 +74,7 @@ public class CnxManagerTest extends ZKTestCase {
     File[] peerTmpdir;
     int[] peerQuorumPort;
     int[] peerClientPort;
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
 
         this.count = 3;
@@ -183,7 +183,7 @@ public void testCnxManager() throws Exception {
             }
         }
 
-        assertTrue("Exceeded number of retries", numRetries <= THRESHOLD);
+        assertTrue(numRetries <= THRESHOLD, "Exceeded number of retries");
 
         thread.join(5000);
         if (thread.isAlive()) {
@@ -317,9 +317,7 @@ public void testCnxManagerListenerThreadConfigurableRetry() throws Exception {
         listener.join(15000); // set wait time, if listener contains bug and thread not stops.
         assertFalse(listener.isAlive());
         assertTrue(errorHappend.get());
-        assertFalse(QuorumPeer.class.getSimpleName()
-                                   + " not stopped after "
-                                   + "listener thread death", listener.isAlive());
+        assertFalse(listener.isAlive(), QuorumPeer.class.getSimpleName() + " not stopped after " + "listener thread death");
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
index 9cd49859cb0..1050a474bc0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -45,9 +45,10 @@
 import org.apache.zookeeper.server.RequestProcessor;
 import org.apache.zookeeper.server.WorkerService;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -59,7 +60,7 @@ public class CommitProcessorConcurrencyTest extends ZKTestCase {
     MockCommitProcessor processor;
     int defaultSizeOfThreadPool = 16;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         processedRequests = new LinkedBlockingQueue<Request>();
         processor = new MockCommitProcessor();
@@ -67,7 +68,7 @@ public void setUp() throws Exception {
         CommitProcessor.setMaxCommitBatchSize(1);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         processor.shutdown();
     }
@@ -153,12 +154,12 @@ public void committedAndUncommittedOfTheSameSessionRaceTest() throws Exception {
         processor.run();
 
         assertTrue(
-            "Request was not processed " + readReq + " instead " + processedRequests.peek(),
-            processedRequests.peek() != null && processedRequests.peek().equals(readReq));
+            processedRequests.peek() != null && processedRequests.peek().equals(readReq),
+            "Request was not processed " + readReq + " instead " + processedRequests.peek());
         processedRequests.poll();
         assertTrue(
-            "Request was not processed " + writeReq + " instead " + processedRequests.peek(),
-            processedRequests.peek() != null && processedRequests.peek().equals(writeReq));
+            processedRequests.peek() != null && processedRequests.peek().equals(writeReq),
+            "Request was not processed " + writeReq + " instead " + processedRequests.peek());
     }
 
     /**
@@ -209,8 +210,8 @@ public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
         for (Request r : shouldBeProcessed) {
             LOG.error("Did not process {}", r);
         }
-        assertTrue("Not all requests were processed", shouldBeProcessed.isEmpty());
-        assertFalse("Processed a wrong request", shouldNotBeProcessed.removeAll(processedRequests));
+        assertTrue(shouldBeProcessed.isEmpty(), "Not all requests were processed");
+        assertFalse(shouldNotBeProcessed.removeAll(processedRequests), "Processed a wrong request");
     }
 
     /**
@@ -245,15 +246,15 @@ public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exceptio
 
         processor.stoppedMainLoop = true;
         processor.run();
-        assertTrue("Processed without waiting for commit", processedRequests.isEmpty());
-        assertTrue("Did not handled all of queuedRequests' requests", processor.queuedRequests.isEmpty());
-        assertTrue("Removed from blockedQueuedRequests before commit", !processor.queuedWriteRequests.isEmpty());
+        assertTrue(processedRequests.isEmpty(), "Processed without waiting for commit");
+        assertTrue(processor.queuedRequests.isEmpty(), "Did not handled all of queuedRequests' requests");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(), "Removed from blockedQueuedRequests before commit");
 
         shouldBeInPending.removeAll(processor.pendingRequests.get(writeReq.sessionId));
         for (Request r : shouldBeInPending) {
             LOG.error("Should be in pending {}", r);
         }
-        assertTrue("Not all requests moved to pending from queuedRequests", shouldBeInPending.isEmpty());
+        assertTrue(shouldBeInPending.isEmpty(), "Not all requests moved to pending from queuedRequests");
 
         processor.committedRequests.add(writeReq);
         processor.stoppedMainLoop = true;
@@ -261,11 +262,11 @@ public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exceptio
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Did not process committed request", processor.committedRequests.isEmpty());
-        assertTrue("Did not process committed request", processor.pendingRequests.isEmpty());
-        assertTrue("Did not remove from blockedQueuedRequests", processor.queuedWriteRequests.isEmpty());
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(processor.committedRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.pendingRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.queuedWriteRequests.isEmpty(), "Did not remove from blockedQueuedRequests");
     }
 
     /**
@@ -337,11 +338,11 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.stoppedMainLoop = true;
         CommitProcessor.setMaxCommitBatchSize(2);
         processor.run();
-        assertTrue("Processed without waiting for commit", processedRequests.isEmpty());
-        assertTrue("Did not handled all of queuedRequests' requests", processor.queuedRequests.isEmpty());
-        assertTrue("Removed from blockedQueuedRequests before commit", !processor.queuedWriteRequests.isEmpty());
-        assertTrue("Missing session 1 in pending queue", processor.pendingRequests.containsKey(writeReq.sessionId));
-        assertTrue("Missing session 2 in pending queue", processor.pendingRequests.containsKey(writeReq2.sessionId));
+        assertTrue(processedRequests.isEmpty(), "Processed without waiting for commit");
+        assertTrue(processor.queuedRequests.isEmpty(), "Did not handled all of queuedRequests' requests");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(), "Removed from blockedQueuedRequests before commit");
+        assertTrue(processor.pendingRequests.containsKey(writeReq.sessionId), "Missing session 1 in pending queue");
+        assertTrue(processor.pendingRequests.containsKey(writeReq2.sessionId), "Missing session 2 in pending queue");
 
         processor.committedRequests.add(writeReq);
         processor.committedRequests.add(writeReq2);
@@ -352,21 +353,18 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Processed committed request", !processor.committedRequests.isEmpty());
-        assertTrue("Removed commit for write req 3", processor.committedRequests.peek() == writeReq3);
-        assertTrue("Processed committed request", !processor.pendingRequests.isEmpty());
-        assertTrue("Missing session 2 in pending queue", processor.pendingRequests.containsKey(writeReq3.sessionId));
-        assertTrue(
-            "Missing write 3 in pending queue",
-            processor.pendingRequests.get(writeReq3.sessionId).peek() == writeReq3);
-        assertTrue(
-            "Removed from blockedQueuedRequests",
-            !processor.queuedWriteRequests.isEmpty());
-        assertTrue(
-            "Removed write req 3 from blockedQueuedRequests",
-            processor.queuedWriteRequests.peek() == writeReq3);
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(!processor.committedRequests.isEmpty(), "Processed committed request");
+        assertTrue(processor.committedRequests.peek() == writeReq3, "Removed commit for write req 3");
+        assertTrue(!processor.pendingRequests.isEmpty(), "Processed committed request");
+        assertTrue(processor.pendingRequests.containsKey(writeReq3.sessionId), "Missing session 2 in pending queue");
+        assertTrue(processor.pendingRequests.get(writeReq3.sessionId).peek() == writeReq3,
+            "Missing write 3 in pending queue");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(),
+            "Removed from blockedQueuedRequests");
+        assertTrue(processor.queuedWriteRequests.peek() == writeReq3,
+            "Removed write req 3 from blockedQueuedRequests");
 
         Request readReq3 = newRequest(new GetDataRequest(path, false), OpCode.getData, 0x1, 7);
         processor.queuedRequests.add(readReq3);
@@ -391,14 +389,13 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Processed unexpected committed request", !processor.committedRequests.isEmpty());
-        assertTrue("Unexpected pending request", processor.pendingRequests.isEmpty());
-        assertTrue("Removed from blockedQueuedRequests", !processor.queuedWriteRequests.isEmpty());
-        assertTrue(
-            "Removed write req 4 from blockedQueuedRequests",
-            processor.queuedWriteRequests.peek() == writeReq4);
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(!processor.committedRequests.isEmpty(), "Processed unexpected committed request");
+        assertTrue(processor.pendingRequests.isEmpty(), "Unexpected pending request");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(), "Removed from blockedQueuedRequests");
+        assertTrue(processor.queuedWriteRequests.peek() == writeReq4,
+            "Removed write req 4 from blockedQueuedRequests");
 
         processor.stoppedMainLoop = true;
         CommitProcessor.setMaxCommitBatchSize(3);
@@ -406,11 +403,11 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Did not process committed request", processor.committedRequests.isEmpty());
-        assertTrue("Did not process committed request", processor.pendingRequests.isEmpty());
-        assertTrue("Did not remove from blockedQueuedRequests", processor.queuedWriteRequests.isEmpty());
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(processor.committedRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.pendingRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.queuedWriteRequests.isEmpty(), "Did not remove from blockedQueuedRequests");
 
     }
 
@@ -420,7 +417,8 @@ public void processAllWritesMaxBatchSize() throws Exception {
      * and use infinite queuedRequests. We verify that the committed request was
      * processed.
      */
-    @Test(timeout = 1000)
+    @Test
+    @Timeout(value = 1)
     public void noStarvationOfNonLocalCommittedRequestsTest() throws Exception {
         final String path = "/noStarvationOfCommittedRequests";
         processor.queuedRequests = new MockRequestsQueue();
@@ -428,9 +426,7 @@ public void noStarvationOfNonLocalCommittedRequestsTest() throws Exception {
         for (int i = 0; i < 10; i++) {
             Request nonLocalCommitReq = newRequest(
                 new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-                OpCode.create,
-                51,
-                i + 1);
+                OpCode.create, 51, i + 1);
             processor.committedRequests.add(nonLocalCommitReq);
             nonLocalCommits.add(nonLocalCommitReq);
         }
@@ -439,7 +435,7 @@ public void noStarvationOfNonLocalCommittedRequestsTest() throws Exception {
             processor.stoppedMainLoop = true;
             processor.run();
         }
-        assertTrue("commit request was not processed", processedRequests.containsAll(nonLocalCommits));
+        assertTrue(processedRequests.containsAll(nonLocalCommits), "commit request was not processed");
     }
 
     /**
@@ -506,15 +502,15 @@ public void noStarvationOfReadRequestsTest() throws Exception {
 
         processor.stoppedMainLoop = true;
         processor.run();
-        assertTrue("Did not process the first write request", processedRequests.contains(firstCommittedReq));
+        assertTrue(processedRequests.contains(firstCommittedReq), "Did not process the first write request");
         for (Request r : allReads) {
-            assertTrue("Processed read request", !processedRequests.contains(r));
+            assertTrue(!processedRequests.contains(r), "Processed read request");
         }
         processor.run();
-        assertTrue("did not processed all reads", processedRequests.containsAll(allReads));
-        assertTrue("Did not process the second write request", processedRequests.contains(secondCommittedReq));
+        assertTrue(processedRequests.containsAll(allReads), "did not processed all reads");
+        assertTrue(processedRequests.contains(secondCommittedReq), "Did not process the second write request");
         for (Request r : waitingCommittedRequests) {
-            assertTrue("Processed additional committed request", !processedRequests.contains(r));
+            assertTrue(!processedRequests.contains(r), "Processed additional committed request");
         }
     }
 
@@ -524,7 +520,8 @@ public void noStarvationOfReadRequestsTest() throws Exception {
      * when a session is just established and there is request waiting to be committed in the
      * session queue but it sees a commit for a request that belongs to the previous connection.
      */
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         final String path = "/noCrash/OnCommittedRequests/OfUnseenRequestTest";
         final int numberofReads = 10;
@@ -536,9 +533,7 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         // queue the blocking write request to queuedRequests
         Request firstCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            readReqId++);
+            OpCode.create, sessionid, readReqId++);
         processor.queuedRequests.add(firstCommittedReq);
         processor.queuedWriteRequests.add(firstCommittedReq);
         localRequests.add(firstCommittedReq);
@@ -563,9 +558,7 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         // i.e., commit of an update from previous connection of this session.
         Request preSessionCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            firstCXid - 2);
+            OpCode.create, sessionid, firstCXid - 2);
         processor.committedRequests.add(preSessionCommittedReq);
         processor.committedRequests.add(firstCommittedReq);
         processor.run();
@@ -589,7 +582,8 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
      * the leader out of order. Hence, the commits can also arrive "out of order" w.r.t. cxid.
      * We should commit the requests according to the order we receive from the leader, i.e., wait for the relevant commit.
      */
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         final String path = "/noCrash/OnCommittedRequests/OfUnSeenRequestTest";
         final int sessionid = 0x123456;
@@ -602,9 +596,7 @@ public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         // queue the blocking write request to queuedRequests
         Request orphanCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            lastCXid);
+            OpCode.create, sessionid, lastCXid);
         processor.queuedRequests.add(orphanCommittedReq);
         processor.queuedWriteRequests.add(orphanCommittedReq);
         localRequests.add(orphanCommittedReq);
@@ -627,14 +619,8 @@ public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         // We add a commit that belongs to the same session but with larger cxid,
         // i.e., commit of an update from the next connection of this session.
         Request otherSessionCommittedReq = newRequest(
-            new CreateRequest(
-                path,
-                new byte[0],
-                Ids.OPEN_ACL_UNSAFE,
-                CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            lastCXid + 10);
+            new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
+            OpCode.create, sessionid, lastCXid + 10);
         processor.committedRequests.add(otherSessionCommittedReq);
         processor.committedRequests.add(orphanCommittedReq);
         processor.run();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
index 29fe94b81d0..4b67f5b50bb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.nio.ByteBuffer;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.server.RequestProcessor;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.WorkerService;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,7 +50,7 @@ public class CommitProcessorMetricsTest extends ZKTestCase {
     CountDownLatch commitSeen = null;
     CountDownLatch poolEmpytied = null;
 
-    @Before
+    @BeforeEach
     public void setup() {
         LOG.info("setup");
         ServerMetrics.getMetrics().resetAll();
@@ -66,7 +66,7 @@ public void setupProcessors(int commitWorkers, int finalProcTime) {
         commitProcessor.start();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
 
@@ -179,11 +179,11 @@ public void shutdown() {
     private void checkMetrics(String metricName, long min, long max, double avg, long cnt, long sum) {
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
 
-        assertEquals("expected min is " + min, min, values.get("min_" + metricName));
-        assertEquals("expected max is: " + max, max, values.get("max_" + metricName));
-        assertEquals("expected avg is: " + avg, avg, (Double) values.get("avg_" + metricName), 0.001);
-        assertEquals("expected cnt is: " + cnt, cnt, values.get("cnt_" + metricName));
-        assertEquals("expected sum is: " + sum, sum, values.get("sum_" + metricName));
+        assertEquals(min, values.get("min_" + metricName), "expected min is " + min);
+        assertEquals(max, values.get("max_" + metricName), "expected max is: " + max);
+        assertEquals(avg, (Double) values.get("avg_" + metricName), 0.001, "expected avg is: " + avg);
+        assertEquals(cnt, values.get("cnt_" + metricName), "expected cnt is: " + cnt);
+        assertEquals(sum, values.get("sum_" + metricName), "expected sum is: " + sum);
     }
 
     private void checkTimeMetric(long actual, long lBoundrary, long hBoundrary) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
index d939dc0eb86..46958d1949c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
@@ -44,8 +44,8 @@
 import org.apache.zookeeper.server.RequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -120,7 +120,7 @@ public void setUp(
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
         stopped = true;
@@ -131,7 +131,7 @@ public void tearDown() throws Exception {
             client.join();
         }
         if (tmpDir != null) {
-            assertTrue("delete " + tmpDir.toString(), ClientBase.recursiveDelete(tmpDir));
+            assertTrue(ClientBase.recursiveDelete(tmpDir), "delete " + tmpDir.toString());
         }
         processedReadRequests.set(0);
         processedWriteRequests.set(0);
@@ -206,9 +206,9 @@ public void testNoCommitWorkersReadOnlyWorkload() throws Exception {
             wait(TEST_RUN_TIME_IN_MS);
         }
         assertFalse(fail);
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
         // processedWriteRequests.get() == numClients since each client performs one write at the beginning (creates a znode)
-        assertTrue("Write requests processed", processedWriteRequests.get() == numClients);
+        assertTrue(processedWriteRequests.get() == numClients, "Write requests processed");
     }
 
     @Test
@@ -232,9 +232,9 @@ public void testOneCommitWorkerReadOnlyWorkload() throws Exception {
             wait(TEST_RUN_TIME_IN_MS);
         }
         assertFalse(fail);
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
         // processedWriteRequests.get() == numClients since each client performs one write at the beginning (creates a znode)
-        assertTrue("Write requests processed", processedWriteRequests.get() == numClients);
+        assertTrue(processedWriteRequests.get() == numClients, "Write requests processed");
     }
 
     @Test
@@ -257,9 +257,9 @@ public void testManyCommitWorkersReadOnly() throws Exception {
             wait(TEST_RUN_TIME_IN_MS);
         }
         assertFalse(fail);
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
         // processedWriteRequests.get() == numClients since each client performs one write at the beginning (creates a znode)
-        assertTrue("Write requests processed", processedWriteRequests.get() == numClients);
+        assertTrue(processedWriteRequests.get() == numClients, "Write requests processed");
     }
 
     @Test
@@ -274,8 +274,8 @@ public void testManyCommitWorkersMixedWorkload() throws Exception {
     }
 
     private void checkProcessedRequest() {
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
-        assertTrue("No write requests processed", processedWriteRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
+        assertTrue(processedWriteRequests.get() > 0, "No write requests processed");
     }
 
     volatile boolean fail = false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
index fa18bf0e213..d37516bd3bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
@@ -18,12 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.fail;
-import java.util.Arrays;
-import java.util.Collection;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.CountDownLatch;
+import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
@@ -31,17 +30,14 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class EagerACLFilterTest extends QuorumBase {
 
-    protected boolean checkEnabled;
-    protected ServerState serverState;
     protected final CountDownLatch callComplete = new CountDownLatch(1);
     protected boolean complete = false;
     protected static final String PARENT_PATH = "/foo";
@@ -55,18 +51,24 @@ public class EagerACLFilterTest extends QuorumBase {
     protected QuorumPeer zkLeader;
     protected ZooKeeperServer connectedServer;
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(new Object[][]{{ServerState.LEADING, true}, {ServerState.LEADING, false}, {ServerState.FOLLOWING, true}, {ServerState.FOLLOWING, false}, {ServerState.OBSERVING, true}, {ServerState.OBSERVING, false}});
+    public static Stream<Arguments> data() {
+        return Stream.of(
+                Arguments.of(ServerState.LEADING, true),
+                Arguments.of(ServerState.LEADING, false),
+                Arguments.of(ServerState.FOLLOWING, true),
+                Arguments.of(ServerState.FOLLOWING, false),
+                Arguments.of(ServerState.OBSERVING, true),
+                Arguments.of(ServerState.OBSERVING, false));
     }
 
-    public EagerACLFilterTest(ServerState state, boolean checkEnabled) {
-        this.serverState = state;
-        this.checkEnabled = checkEnabled;
+    @BeforeEach
+    @Override
+    public void setUp() {
+        //since parameterized test methods need a parameterized setUp method
+        //the inherited method has to be overridden with an empty function body
     }
 
-    @Before
-    public void setUp() throws Exception {
+    public void setUp(ServerState serverState, boolean checkEnabled) throws Exception {
         ensureCheck(checkEnabled);
         CountdownWatcher clientWatch = new CountdownWatcher();
         CountdownWatcher clientWatchB = new CountdownWatcher();
@@ -86,7 +88,7 @@ public void setUp() throws Exception {
         clientWatchB.waitForConnected(CONNECTION_TIMEOUT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (zkClient != null) {
             zkClient.close();
@@ -107,34 +109,40 @@ private void ensureCheck(boolean enabled) {
         }
     }
 
-    private void assertTransactionState(String condition, long lastxid) {
+    private void assertTransactionState(String condition, long lastxid, ServerState serverState, boolean checkEnabled) {
         String assertion = String.format("Server State: %s Check Enabled: %s %s", serverState, checkEnabled, condition);
         if (checkEnabled) {
-            assertEquals(assertion, lastxid, zkLeader.getLastLoggedZxid());
+            assertEquals(lastxid, zkLeader.getLastLoggedZxid(), assertion);
         } else {
-            assertNotSame(assertion, lastxid, zkLeader.getLastLoggedZxid());
+            assertNotSame(lastxid, zkLeader.getLastLoggedZxid(), assertion);
         }
     }
 
-    @Test
-    public void testCreateOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         ensureCheck(true);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testCreate2OK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate2OK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
         zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testCreateFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
         long lastxid = zkLeader.getLastLoggedZxid();
         try {
@@ -142,13 +150,15 @@ public void testCreateFail() throws Exception {
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed create", lastxid);
+        assertTransactionState("Transaction state on Leader after failed create", lastxid, serverState, checkEnabled);
     }
 
-    @Test
-    public void testCreate2Fail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate2Fail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         long lastxid = zkLeader.getLastLoggedZxid();
         try {
@@ -156,21 +166,25 @@ public void testCreate2Fail() throws Exception {
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed create2", lastxid);
+        assertTransactionState("Transaction state on Leader after failed create2", lastxid, serverState, checkEnabled);
     }
 
-    @Test
-    public void testDeleteOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testDeleteOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zkClientB.delete(PARENT_PATH, -1);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testDeleteFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testDeleteFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         zkClient.create(CHILD_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         long lastxid = zkLeader.getLastLoggedZxid();
@@ -179,19 +193,23 @@ public void testDeleteFail() throws Exception {
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed delete", lastxid);
+        assertTransactionState("Transaction state on Leader after failed delete", lastxid, serverState, checkEnabled);
     }
 
-    @Test
-    public void testSetDataOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetDataOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
         zkClientB.setData(PARENT_PATH, DATA, -1);
     }
 
-    @Test
-    public void testSetDataFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetDataFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         long lastxid = zkLeader.getLastLoggedZxid();
         try {
@@ -199,21 +217,25 @@ public void testSetDataFail() throws Exception {
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed setData", lastxid);
+        assertTransactionState("Transaction state on Leader after failed setData", lastxid, serverState, checkEnabled);
     }
 
-    @Test
-    public void testSetACLOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetACLOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
         zkClientB.setACL(PARENT_PATH, Ids.READ_ACL_UNSAFE, -1);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testSetACLFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetACLFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         long lastxid = zkLeader.getLastLoggedZxid();
         try {
@@ -221,13 +243,15 @@ public void testSetACLFail() throws Exception {
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed setACL", lastxid);
+        assertTransactionState("Transaction state on Leader after failed setACL", lastxid, serverState, checkEnabled);
     }
 
-    @Test
-    public void testBadACL() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testBadACL(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         CountdownWatcher cw = new CountdownWatcher();
         TestableZooKeeper zk = createClient(cw, getPeersMatching(serverState));
         long lastxid;
@@ -242,9 +266,9 @@ public void testBadACL() throws Exception {
         } catch (KeeperException.InvalidACLException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("zxid after invalid ACL", lastxid);
+        assertTransactionState("zxid after invalid ACL", lastxid, serverState, checkEnabled);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java
index 749eb804733..15e6b768468 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.SocketTimeoutException;
 import java.util.concurrent.CountDownLatch;
@@ -38,8 +38,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class EphemeralNodeDeletionTest extends QuorumPeerTestBase {
 
@@ -52,7 +53,8 @@ public class EphemeralNodeDeletionTest extends QuorumPeerTestBase {
      * the proposal packet.
      */
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testEphemeralNodeDeletion() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
@@ -61,7 +63,7 @@ public void testEphemeralNodeDeletion() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                     + ":participant;127.0.0.1:" + clientPorts[i];
+                    + ":participant;127.0.0.1:" + clientPorts[i];
             sb.append(server + "\n");
         }
         String currentQuorumCfgSection = sb.toString();
@@ -78,9 +80,8 @@ public TestQPMain getTestQPMain() {
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watch = new CountdownWatcher();
@@ -96,10 +97,8 @@ public TestQPMain getTestQPMain() {
         // 1: create ephemeral node
         String nodePath = "/e1";
         zk.create(nodePath, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL, firstEphemeralNode);
-        assertEquals(
-            "Current session and ephemeral owner should be same",
-            zk.getSessionId(),
-            firstEphemeralNode.getEphemeralOwner());
+        assertEquals(zk.getSessionId(), firstEphemeralNode.getEphemeralOwner(),
+                "Current session and ephemeral owner should be same");
 
         // 2: inject network problem in one of the follower
         CustomQuorumPeer follower = (CustomQuorumPeer) getByServerState(mt, ServerState.FOLLOWING);
@@ -111,33 +110,31 @@ public TestQPMain getTestQPMain() {
         // remove the error
         follower.setInjectError(false);
 
-        assertTrue(
-                "Faulted Follower should have joined quorum by now",
-                ClientBase.waitForServerUp("127.0.0.1:" + follower.getClientPort(), CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + follower.getClientPort(), CONNECTION_TIMEOUT),
+                "Faulted Follower should have joined quorum by now");
 
         QuorumPeer leader = getByServerState(mt, ServerState.LEADING);
-        assertNotNull("Leader should not be null", leader);
-        assertTrue(
-            "Leader must be running",
-            ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT));
+        assertNotNull(leader, "Leader should not be null");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT),
+                "Leader must be running");
 
         watch = new CountdownWatcher();
         zk = new ZooKeeper("127.0.0.1:" + leader.getClientPort(), ClientBase.CONNECTION_TIMEOUT, watch);
         watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
 
         Stat exists = zk.exists(nodePath, false);
-        assertNull("Node must have been deleted from leader", exists);
+        assertNull(exists, "Node must have been deleted from leader");
 
         CountdownWatcher followerWatch = new CountdownWatcher();
         ZooKeeper followerZK = new ZooKeeper(
-            "127.0.0.1:" + follower.getClientPort(),
-            ClientBase.CONNECTION_TIMEOUT,
-            followerWatch);
+                "127.0.0.1:" + follower.getClientPort(),
+                ClientBase.CONNECTION_TIMEOUT,
+                followerWatch);
         followerWatch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         Stat nodeAtFollower = followerZK.exists(nodePath, false);
 
         // Problem 1: Follower had one extra ephemeral node /e1
-        assertNull("ephemeral node must not exist", nodeAtFollower);
+        assertNull(nodeAtFollower, "ephemeral node must not exist");
 
         // Create the node with another session
         Stat currentEphemeralNode = new Stat();
@@ -155,11 +152,11 @@ public TestQPMain getTestQPMain() {
         // Problem 2: Before fix, after session close the ephemeral node
         // was not getting deleted. But now after the fix after session close
         // ephemeral node is getting deleted.
-        assertNull("After session close ephemeral node must be deleted", nodeAtFollower);
+        assertNull(nodeAtFollower, "After session close ephemeral node must be deleted");
         followerZK.close();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all severs
         for (int i = 0; i < mt.length; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java
index 526dc0be2ca..cea96bff0f3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java
@@ -18,6 +18,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
@@ -27,9 +30,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.AfterClass;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class EpochWriteFailureTest extends QuorumPeerTestBase {
     private static int SERVER_COUNT = 3;
@@ -43,7 +46,8 @@ public class EpochWriteFailureTest extends QuorumPeerTestBase {
      * fails, it should not complete leader election, also it should not update
      * run time values of acceptedEpoch,
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testAcceptedEpochWriteFailure() throws Exception {
         StringBuilder sb = new StringBuilder();
         sb.append("admin.enableServer=false");
@@ -64,8 +68,8 @@ public void testAcceptedEpochWriteFailure() throws Exception {
 
         // ensure two servers started
         for (int i = 0; i < SERVER_COUNT - 1; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watch1 = new CountdownWatcher();
@@ -93,15 +97,13 @@ public TestQPMain getTestQPMain() {
          * failure is injected and it keeps on trying to join the quorum
          */
 
-        Assert.assertFalse("verify server 2 not started",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT / 2));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT / 2),
+                "verify server 2 not started");
 
         QuorumPeer quorumPeer = mt[2].getQuorumPeer();
 
-        Assert.assertEquals("acceptedEpoch must not have changed", 0,
-                quorumPeer.getAcceptedEpoch());
-        Assert.assertEquals("currentEpoch must not have changed", 0,
-                quorumPeer.getCurrentEpoch());
+        assertEquals(0, quorumPeer.getAcceptedEpoch(), "acceptedEpoch must not have changed");
+        assertEquals(0, quorumPeer.getCurrentEpoch(), "currentEpoch must not have changed");
     }
 
     static class CustomQuorumPeer extends QuorumPeer {
@@ -138,7 +140,7 @@ public void runFromConfig(QuorumPeerConfig config)
         }
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() throws InterruptedException {
         for (int i = 0; i < SERVER_COUNT; i++) {
             if (mt[i] != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
index 84e20311f04..e4d32456a53 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
@@ -28,9 +28,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,7 +45,7 @@ public class FLEBackwardElectionRoundTest extends ZKTestCase {
 
     QuorumCnxManager[] cnxManagers;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
@@ -55,7 +55,7 @@ public void setUp() throws Exception {
         cnxManagers = new QuorumCnxManager[count - 1];
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < (count - 1); i++) {
             if (cnxManagers[i] != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
index 5c6ffb5b7b9..84b233d7221 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -28,9 +28,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,7 +45,7 @@ public class FLELostMessageTest extends ZKTestCase {
 
     QuorumCnxManager cnxManager;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
@@ -54,7 +54,7 @@ public void setUp() throws Exception {
         port = new int[count];
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         cnxManager.halt();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
index 8465c9ee55d..30187644a87 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -28,14 +29,12 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-
 public class FLEMalformedNotificationMessageTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(FLEMalformedNotificationMessageTest.class);
     private static final byte[] CONFIG_BYTES = "my very invalid config string".getBytes();
@@ -51,7 +50,7 @@ public class FLEMalformedNotificationMessageTest extends ZKTestCase {
     QuorumPeer peerRunningLeaderElection;
 
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
@@ -80,7 +79,7 @@ public void setUp() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         peerRunningLeaderElection.shutdown();
         mockCnxManager.halt();
@@ -109,7 +108,7 @@ public void testTooShortPartialNotificationMessage() throws Exception {
         sendValidNotifications(1, 0);
         leaderElectionThread.join(5000);
         if (leaderElectionThread.isAlive()) {
-            Assert.fail("Leader election thread didn't join, something went wrong.");
+            fail("Leader election thread didn't join, something went wrong.");
         }
     }
 
@@ -140,7 +139,7 @@ public void testNotificationMessageWithNegativeConfigLength() throws Exception {
         sendValidNotifications(1, 0);
         leaderElectionThread.join(5000);
         if (leaderElectionThread.isAlive()) {
-            Assert.fail("Leader election thread didn't join, something went wrong.");
+            fail("Leader election thread didn't join, something went wrong.");
         }
     }
 
@@ -173,7 +172,7 @@ public void testNotificationMessageWithInvalidConfigLength() throws Exception {
         sendValidNotifications(1, 0);
         leaderElectionThread.join(5000);
         if (leaderElectionThread.isAlive()) {
-            Assert.fail("Leader election thread didn't join, something went wrong.");
+            fail("Leader election thread didn't join, something went wrong.");
         }
     }
 
@@ -196,7 +195,7 @@ public void testNotificationMessageWithInvalidConfig() throws Exception {
         sendValidNotifications(1, 0);
         leaderElectionThread.join(5000);
         if (leaderElectionThread.isAlive()) {
-            Assert.fail("Leader election thread didn't join, something went wrong.");
+            fail("Leader election thread didn't join, something went wrong.");
         }
     }
 
@@ -228,7 +227,7 @@ public void testNotificationMessageWithBadProtocol() throws Exception {
         sendValidNotifications(1, 0);
         leaderElectionThread.join(5000);
         if (leaderElectionThread.isAlive()) {
-            Assert.fail("Leader election thread didn't join, something went wrong.");
+            fail("Leader election thread didn't join, something went wrong.");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
index b1b66627868..d1afdaa80cf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.HashMap;
@@ -30,8 +30,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test FastLeaderElection with out of election servers.
@@ -40,7 +40,7 @@ public class FLEOutOfElectionTest {
 
     private FastLeaderElection fle;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         File tmpdir = ClientBase.createTmpDir();
         Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
@@ -117,9 +117,9 @@ public void testOutofElection() {
         // Set the logical clock to 1 on fle instance of server 3.
         fle.logicalclock.set(0x1);
 
-        assertTrue("Quorum check failed", fle.getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state)).hasAllQuorums());
+        assertTrue(fle.getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state)).hasAllQuorums(), "Quorum check failed");
 
-        assertTrue("Leader check failed", fle.checkLeader(outofelection, n.leader, n.electionEpoch));
+        assertTrue(fle.checkLeader(outofelection, n.leader, n.electionEpoch), "Leader check failed");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java
index 45ce2baea5a..b27580c3e34 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.nio.ByteBuffer;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
@@ -64,7 +64,7 @@ public void run() {
 
                 LOG.info("Finished election: {}, {}", i, v.getId());
 
-                assertTrue("State is not leading.", peer.getPeerState() == ServerState.LEADING);
+                assertTrue(peer.getPeerState() == ServerState.LEADING, "State is not leading.");
             } catch (Exception e) {
                 e.printStackTrace();
             }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
index fd3374ded3b..3dcaf5de1da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -51,9 +51,9 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -70,7 +70,7 @@ public class FuzzySnapshotRelatedTest extends QuorumPeerTestBase {
     int leaderId;
     int followerA;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         ZooKeeperServer.setDigestEnabled(true);
 
@@ -115,7 +115,7 @@ public TestQPMain getTestQPMain() {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         ZooKeeperServer.setDigestEnabled(false);
 
@@ -317,7 +317,7 @@ public void process() {
     private void checkNoMismatchReported() {
         long mismatch = (long) MetricsUtils.currentServerMetrics().get("digest_mismatches_count");
 
-        assertFalse("The mismatch count should be zero but is: " + mismatch, mismatch > 0);
+        assertFalse(mismatch > 0, "The mismatch count should be zero but is: " + mismatch);
     }
 
     private void addSerializeListener(int sid, String parent, String child) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 0c6938be401..618ffa04f69 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
@@ -45,9 +45,9 @@
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
@@ -72,7 +72,7 @@ public static Map<Long, QuorumServer> getMockedPeerViews(long myId) {
         return peersView;
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException, X509Exception {
         qp = new QuorumPeer();
         quorumVerifierMock = mock(QuorumVerifier.class);
@@ -88,7 +88,7 @@ public void setUp() throws IOException, X509Exception {
         leaderBean = new LeaderBean(leader, zks);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws IOException {
         fileTxnSnapLog.close();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java
index 40ddfe6f365..db2a066d50b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
@@ -34,9 +34,9 @@
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class LeaderMetricsTest extends ZKTestCase {
 
@@ -52,12 +52,12 @@ public void process(WatchedEvent e) {
 
     }
 
-    @Before
+    @BeforeEach
     public void setup() {
         oldLoggingFeq = Leader.getAckLoggingFrequency();
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         Leader.setAckLoggingFrequency(oldLoggingFeq);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
index 91292de7726..f5df549c51b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
@@ -20,19 +20,19 @@
 
 import static org.apache.zookeeper.server.quorum.ZabUtils.createLeader;
 import static org.apache.zookeeper.server.quorum.ZabUtils.createQuorumPeer;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class LeaderWithObserverTest {
 
@@ -42,7 +42,7 @@ public class LeaderWithObserverTest {
     long participantId;
     long observerId;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         tmpDir = ClientBase.createTmpDir();
         peer = createQuorumPeer(tmpDir);
@@ -57,7 +57,7 @@ public void setUp() throws Exception {
         peer.tickTime = 1;
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         leader.shutdown("end of test");
         tmpDir.delete();
@@ -68,7 +68,7 @@ public void testGetEpochToPropose() throws Exception {
         long lastAcceptedEpoch = 5;
         peer.setAcceptedEpoch(5);
 
-        assertEquals("Unexpected vote in connectingFollowers", 0, leader.connectingFollowers.size());
+        assertEquals(0, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
         assertTrue(leader.waitingForNewEpoch);
         try {
             // Leader asks for epoch (mocking Leader.lead behavior)
@@ -78,8 +78,8 @@ public void testGetEpochToPropose() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in connectingFollowers", 1, leader.connectingFollowers.size());
-        assertEquals("Leader shouldn't set new epoch until quorum of participants is in connectingFollowers", lastAcceptedEpoch, peer.getAcceptedEpoch());
+        assertEquals(1, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
+        assertEquals(lastAcceptedEpoch, peer.getAcceptedEpoch(), "Leader shouldn't set new epoch until quorum of participants is in connectingFollowers");
         assertTrue(leader.waitingForNewEpoch);
         try {
             // Observer asks for epoch (mocking LearnerHandler behavior)
@@ -88,8 +88,8 @@ public void testGetEpochToPropose() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in connectingFollowers", 1, leader.connectingFollowers.size());
-        assertEquals("Leader shouldn't set new epoch after observer asks for epoch", lastAcceptedEpoch, peer.getAcceptedEpoch());
+        assertEquals(1, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
+        assertEquals(lastAcceptedEpoch, peer.getAcceptedEpoch(), "Leader shouldn't set new epoch after observer asks for epoch");
         assertTrue(leader.waitingForNewEpoch);
         try {
             // Now participant asks for epoch (mocking LearnerHandler behavior). Second add to connectingFollowers.
@@ -99,8 +99,8 @@ public void testGetEpochToPropose() throws Exception {
             fail("Timed out in getEpochToPropose");
         }
 
-        assertEquals("Unexpected vote in connectingFollowers", 2, leader.connectingFollowers.size());
-        assertEquals("Leader should record next epoch", lastAcceptedEpoch + 1, peer.getAcceptedEpoch());
+        assertEquals(2, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
+        assertEquals(lastAcceptedEpoch + 1, peer.getAcceptedEpoch(), "Leader should record next epoch");
         assertFalse(leader.waitingForNewEpoch);
     }
 
@@ -109,7 +109,7 @@ public void testWaitForEpochAck() throws Exception {
         // things needed for waitForEpochAck to run (usually in leader.lead(), but we're not running leader here)
         leader.leaderStateSummary = new StateSummary(leader.self.getCurrentEpoch(), leader.zk.getLastProcessedZxid());
 
-        assertEquals("Unexpected vote in electingFollowers", 0, leader.electingFollowers.size());
+        assertEquals(0, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
         assertFalse(leader.electionFinished);
         try {
             // leader calls waitForEpochAck, first add to electingFollowers
@@ -118,7 +118,7 @@ public void testWaitForEpochAck() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in electingFollowers", 1, leader.electingFollowers.size());
+        assertEquals(1, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
         assertFalse(leader.electionFinished);
         try {
             // observer calls waitForEpochAck, should fail verifier.containsQuorum
@@ -127,12 +127,12 @@ public void testWaitForEpochAck() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in electingFollowers", 1, leader.electingFollowers.size());
+        assertEquals(1, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
         assertFalse(leader.electionFinished);
         try {
             // second add to electingFollowers, verifier.containsQuorum=true, waitForEpochAck returns without exceptions
             leader.waitForEpochAck(participantId, new StateSummary(0, 0));
-            assertEquals("Unexpected vote in electingFollowers", 2, leader.electingFollowers.size());
+            assertEquals(2, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
             assertTrue(leader.electionFinished);
         } catch (Exception e) {
             fail("Timed out in waitForEpochAck");
@@ -148,7 +148,7 @@ public void testWaitForNewLeaderAck() throws Exception {
         leader.newLeaderProposal.addQuorumVerifier(peer.getQuorumVerifier());
 
         Set<Long> ackSet = leader.newLeaderProposal.qvAcksetPairs.get(0).getAckset();
-        assertEquals("Unexpected vote in ackSet", 0, ackSet.size());
+        assertEquals(0, ackSet.size(), "Unexpected vote in ackSet");
         assertFalse(leader.quorumFormed);
         try {
             // leader calls waitForNewLeaderAck, first add to ackSet
@@ -157,7 +157,7 @@ public void testWaitForNewLeaderAck() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in ackSet", 1, ackSet.size());
+        assertEquals(1, ackSet.size(), "Unexpected vote in ackSet");
         assertFalse(leader.quorumFormed);
         try {
             // observer calls waitForNewLeaderAck, should fail verifier.containsQuorum
@@ -166,12 +166,12 @@ public void testWaitForNewLeaderAck() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in ackSet", 1, ackSet.size());
+        assertEquals(1, ackSet.size(), "Unexpected vote in ackSet");
         assertFalse(leader.quorumFormed);
         try {
             // second add to ackSet, verifier.containsQuorum=true, waitForNewLeaderAck returns without exceptions
             leader.waitForNewLeaderAck(participantId, zxid);
-            assertEquals("Unexpected vote in ackSet", 2, ackSet.size());
+            assertEquals(2, ackSet.size(), "Unexpected vote in ackSet");
             assertTrue(leader.quorumFormed);
         } catch (Exception e) {
             fail("Timed out in waitForEpochAck");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java
index b6699d806fb..3b15e0cca35 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
@@ -36,8 +36,8 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class LearnerHandlerMetricsTest {
 
@@ -53,7 +53,7 @@ class MockLearnerHandler extends LearnerHandler {
 
     }
 
-    @Before
+    @BeforeEach
     public void setup() throws IOException {
         Leader leader = mock(Leader.class);
         when(leader.getQuorumAuthServer()).thenReturn(null);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
index 79b454a66e8..2d63f24e58f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.BufferedInputStream;
@@ -38,8 +38,8 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.util.ZxidUtils;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentMatchers;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
@@ -131,7 +131,7 @@ public long calculateTxnLogSizeLimit() {
     // Member variables for mocking ZkDatabase
     private MockZKDatabase db;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         db = new MockZKDatabase(null);
         sock = mock(Socket.class);
@@ -194,10 +194,7 @@ public void assertOpType(int type, long zxid, long currentZxid) {
     }
 
     void assertZxidEquals(long expected, long value) {
-        assertEquals("Expected 0x"
-                             + Long.toHexString(expected)
-                             + " but was 0x"
-                             + Long.toHexString(value), expected, value);
+        assertEquals(expected, value, "Expected 0x" + Long.toHexString(expected) + " but was 0x" + Long.toHexString(value));
     }
 
     /**
@@ -344,7 +341,7 @@ public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
 
         // Peer zxid
         peerZxid = 4;
-        assertTrue("Couldn't identify snapshot transfer!", learnerHandler.syncFollower(peerZxid, leader));
+        assertTrue(learnerHandler.syncFollower(peerZxid, leader), "Couldn't identify snapshot transfer!");
         reset();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
index 659ba31f8a2..5df14600a15 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
@@ -20,8 +20,6 @@
 
 import static org.hamcrest.core.Is.is;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.zookeeper.CreateMode;
@@ -32,50 +30,34 @@
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.test.ClientBase;
 import org.hamcrest.Matcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-@RunWith(Parameterized.class)
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
 public class LearnerMetricsTest extends QuorumPeerTestBase {
 
     private static final int TIMEOUT_SECONDS = 30;
     private static final int SERVER_COUNT = 4; // 1 observer, 3 participants
     private final QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[SERVER_COUNT];
     private ZooKeeper zk_client;
-    private boolean asyncSending;
     private static boolean bakAsyncSending;
 
-    public LearnerMetricsTest(boolean asyncSending) {
-        this.asyncSending = asyncSending;
-    }
-
-    @Parameterized.Parameters
-    public static Collection sendingModes() {
-        return Arrays.asList(new Object[][]{{true}, {false}});
-    }
-
-    @Before
-    public void setAsyncSendingFlag() {
-        Learner.setAsyncSending(asyncSending);
-    }
-
-    @BeforeClass
+    @BeforeAll
     public static void saveAsyncSendingFlag() {
         bakAsyncSending = Learner.getAsyncSending();
     }
 
-    @AfterClass
+    @AfterAll
     public static void resetAsyncSendingFlag() {
         Learner.setAsyncSending(bakAsyncSending);
     }
 
-    @Test
-    public void testLearnerMetricsTest() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testLearnerMetricsTest(boolean asyncSending) throws Exception {
+        Learner.setAsyncSending(asyncSending);
         ServerMetrics.getMetrics().resetAll();
         ClientBase.setupTestEnv();
 
@@ -143,7 +125,7 @@ private void waitForMetric(final String metricKey, final Matcher<Long> matcher)
         }, TIMEOUT_SECONDS);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         zk_client.close();
         for (int i = 0; i < SERVER_COUNT; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
index 9c6385e4184..fbd33d2a02f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
@@ -18,12 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.List;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
@@ -31,50 +30,46 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class LearnerSyncThrottlerTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(LearnerSyncThrottlerTest.class);
 
-    private LearnerSyncThrottler.SyncType syncType;
-    public LearnerSyncThrottlerTest(LearnerSyncThrottler.SyncType syncType) {
-        this.syncType = syncType;
-    }
-
-    @Parameterized.Parameters
-    public static Collection syncTypes() {
-        return Arrays.asList(new Object[][]{{LearnerSyncThrottler.SyncType.DIFF}, {LearnerSyncThrottler.SyncType.SNAP}});
-    }
-    @Test(expected = SyncThrottleException.class)
-    public void testTooManySyncsNonessential() throws Exception {
-        LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
-        for (int i = 0; i < 6; i++) {
-            throttler.beginSync(false);
-        }
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTooManySyncsNonessential(LearnerSyncThrottler.SyncType syncType) {
+        assertThrows(SyncThrottleException.class, () -> {
+            LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
+            for (int i = 0; i < 6; i++) {
+                throttler.beginSync(false);
+            }
+        });
     }
 
-    @Test(expected = SyncThrottleException.class)
-    public void testTooManySyncsEssential() throws Exception {
-        LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
-        try {
-            for (int i = 0; i < 6; i++) {
-                throttler.beginSync(true);
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTooManySyncsEssential(LearnerSyncThrottler.SyncType syncType) {
+        assertThrows(SyncThrottleException.class, () -> {
+            LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
+            try {
+                for (int i = 0; i < 6; i++) {
+                    throttler.beginSync(true);
+                }
+            } catch (SyncThrottleException ex) {
+                fail("essential syncs should not be throttled");
             }
-        } catch (SyncThrottleException ex) {
-            fail("essential syncs should not be throttled");
-        }
-        throttler.endSync();
-        throttler.beginSync(false);
+            throttler.endSync();
+            throttler.beginSync(false);
+        });
     }
 
-    @Test
-    public void testNoThrottle() throws Exception {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testNoThrottle(LearnerSyncThrottler.SyncType syncType) throws Exception {
         LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
         try {
             for (int i = 0; i < 6; i++) {
@@ -88,11 +83,12 @@ public void testNoThrottle() throws Exception {
             throttler.endSync();
             throttler.beginSync(false);
         }
-        assertTrue("should get here without exception", true);
+        assertTrue(true, "should get here without exception");
     }
 
-    @Test
-    public void testTryWithResourceNoThrottle() throws Exception {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTryWithResourceNoThrottle(LearnerSyncThrottler.SyncType syncType) throws Exception {
         LearnerSyncThrottler throttler = new LearnerSyncThrottler(1, syncType);
         for (int i = 0; i < 3; i++) {
             throttler.beginSync(false);
@@ -104,8 +100,9 @@ public void testTryWithResourceNoThrottle() throws Exception {
         }
     }
 
-    @Test
-    public void testTryWithResourceThrottle() throws Exception {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTryWithResourceThrottle(LearnerSyncThrottler.SyncType syncType) throws Exception {
         LearnerSyncThrottler throttler = new LearnerSyncThrottler(1, syncType);
         try {
             throttler.beginSync(true);
@@ -120,8 +117,9 @@ public void testTryWithResourceThrottle() throws Exception {
         }
     }
 
-    @Test
-    public void testParallelNoThrottle() {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testParallelNoThrottle(LearnerSyncThrottler.SyncType syncType) {
         final int numThreads = 50;
 
         final LearnerSyncThrottler throttler = new LearnerSyncThrottler(numThreads, syncType);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
index 97ab5a26f97..d876c167f94 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
@@ -22,10 +22,11 @@
 import static java.util.Collections.emptySet;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.BufferedOutputStream;
@@ -53,8 +54,8 @@
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.apache.zookeeper.util.ServiceUtils;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 public class LearnerTest extends ZKTestCase {
 
@@ -135,24 +136,26 @@ protected Socket createSocket() throws X509Exception, IOException {
         }
     }
 
-    @After
+    @AfterEach
     public void cleanup() {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
     }
 
-    @Test(expected = IOException.class)
+    @Test
     public void connectionRetryTimeoutTest() throws Exception {
-        Learner learner = new TestLearner();
-        learner.self = new QuorumPeer();
-        learner.self.setTickTime(2000);
-        learner.self.setInitLimit(5);
-        learner.self.setSyncLimit(2);
+        assertThrows(IOException.class, () -> {
+            Learner learner = new TestLearner();
+            learner.self = new QuorumPeer();
+            learner.self.setTickTime(2000);
+            learner.self.setInitLimit(5);
+            learner.self.setSyncLimit(2);
 
-        // this addr won't even be used since we fake the Socket.connect
-        InetSocketAddress addr = new InetSocketAddress(1111);
+            // this addr won't even be used since we fake the Socket.connect
+            InetSocketAddress addr = new InetSocketAddress(1111);
 
-        // we expect this to throw an IOException since we're faking socket connect errors every time
-        learner.connectToLeader(new MultipleAddresses(addr), "");
+            // we expect this to throw an IOException since we're faking socket connect errors every time
+            learner.connectToLeader(new MultipleAddresses(addr), "");
+        });
     }
 
     @Test
@@ -240,7 +243,7 @@ public void multipleAddressesSomeAreFailing() throws Exception {
         // we expect this to not throw an IOException since there is a single working address
         learner.connectToLeader(new MultipleAddresses(asList(addrBadA, addrBadB, addrBadC, addrWorking)), "");
 
-        assertEquals("Learner connected to the wrong address", learner.getSocket(), mockSocket);
+        assertEquals(learner.getSocket(), mockSocket, "Learner connected to the wrong address");
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
index c15fd5b9ec5..6ff491a6aa9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -29,7 +29,7 @@
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class LocalPeerBeanTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
index 0e1615df9f5..bf86ce0f430 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
@@ -18,6 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.NoRouteToHostException;
@@ -32,8 +37,7 @@
 import java.util.stream.IntStream;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.zookeeper.PortAssignment;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class MultipleAddressesTest {
 
@@ -42,10 +46,10 @@ public class MultipleAddressesTest {
     @Test
     public void testIsEmpty() {
         MultipleAddresses multipleAddresses = new MultipleAddresses();
-        Assert.assertTrue(multipleAddresses.isEmpty());
+        assertTrue(multipleAddresses.isEmpty());
 
         multipleAddresses.addAddress(new InetSocketAddress(22));
-        Assert.assertFalse(multipleAddresses.isEmpty());
+        assertFalse(multipleAddresses.isEmpty());
     }
 
     @Test
@@ -53,10 +57,10 @@ public void testGetAllAddresses() {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
 
         multipleAddresses.addAddress(addresses.get(1));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
     }
 
     @Test
@@ -65,10 +69,10 @@ public void testGetAllHostStrings() {
         List<String> hostStrings = getHostStrings(addresses);
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
+        assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
 
         multipleAddresses.addAddress(addresses.get(addresses.size() - 1));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
+        assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
     }
 
     @Test
@@ -76,10 +80,10 @@ public void testGetAllPorts() {
         List<Integer> ports = getPortList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(getAddressList(ports));
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
+        assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
 
         multipleAddresses.addAddress(new InetSocketAddress("localhost", ports.get(ports.size() - 1)));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
+        assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
     }
 
     @Test
@@ -89,10 +93,10 @@ public void testGetWildcardAddresses() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
         List<InetSocketAddress> allAddresses = ports.stream().map(InetSocketAddress::new).collect(Collectors.toList());
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
 
         multipleAddresses.addAddress(new InetSocketAddress("localhost", ports.get(ports.size() - 1)));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
     }
 
     @Test
@@ -100,13 +104,15 @@ public void testGetValidAddress() throws NoRouteToHostException {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertTrue(addresses.contains(multipleAddresses.getReachableAddress()));
+        assertTrue(addresses.contains(multipleAddresses.getReachableAddress()));
     }
 
-    @Test(expected = NoRouteToHostException.class)
-    public void testGetValidAddressWithNotValid() throws NoRouteToHostException {
-        MultipleAddresses multipleAddresses = new MultipleAddresses(new InetSocketAddress("10.0.0.1", 22));
-        multipleAddresses.getReachableAddress();
+    @Test
+    public void testGetValidAddressWithNotValid() {
+        assertThrows(NoRouteToHostException.class, () -> {
+            MultipleAddresses multipleAddresses = new MultipleAddresses(new InetSocketAddress("10.0.0.1", 22));
+            multipleAddresses.getReachableAddress();
+        });
     }
 
     @Test
@@ -116,7 +122,7 @@ public void testGetReachableOrOneWithSingleReachableAddress() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(Collections.singletonList(reachableAddress));
         InetSocketAddress actualReturnedAddress = multipleAddresses.getReachableOrOne();
 
-        Assert.assertEquals(reachableAddress, actualReturnedAddress);
+        assertEquals(reachableAddress, actualReturnedAddress);
     }
 
     @Test
@@ -126,7 +132,7 @@ public void testGetReachableOrOneWithSingleUnreachableAddress() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(Collections.singletonList(unreachableAddress));
         InetSocketAddress actualReturnedAddress = multipleAddresses.getReachableOrOne();
 
-        Assert.assertEquals(unreachableAddress, actualReturnedAddress);
+        assertEquals(unreachableAddress, actualReturnedAddress);
     }
 
     @Test
@@ -137,14 +143,14 @@ public void testRecreateSocketAddresses() throws UnknownHostException {
         MultipleAddresses multipleAddresses = new MultipleAddresses(searchedAddresses.get(searchedAddresses.size() - 1));
         List<InetSocketAddress> addresses = new ArrayList<>(multipleAddresses.getAllAddresses());
 
-        Assert.assertEquals(1, addresses.size());
-        Assert.assertEquals(searchedAddresses.get(searchedAddresses.size() - 1), addresses.get(0));
+        assertEquals(1, addresses.size());
+        assertEquals(searchedAddresses.get(searchedAddresses.size() - 1), addresses.get(0));
 
         multipleAddresses.recreateSocketAddresses();
 
         addresses = new ArrayList<>(multipleAddresses.getAllAddresses());
-        Assert.assertEquals(1, addresses.size());
-        Assert.assertEquals(searchedAddresses.get(0), addresses.get(0));
+        assertEquals(1, addresses.size());
+        assertEquals(searchedAddresses.get(0), addresses.get(0));
     }
 
     @Test
@@ -153,7 +159,7 @@ public void testRecreateSocketAddressesWithWrongAddresses() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(address);
         multipleAddresses.recreateSocketAddresses();
 
-        Assert.assertEquals(address, multipleAddresses.getOne());
+        assertEquals(address, multipleAddresses.getOne());
     }
 
     @Test
@@ -169,7 +175,7 @@ public void testAlwaysGetReachableAddress() throws Exception{
         // we call the getReachableAddress() function multiple times, to make sure we
         // always got back a reachable address and not just a random one
         for (int i = 0; i < 10; i++) {
-            Assert.assertEquals(reachableHost, multipleAddresses.getReachableAddress());
+            assertEquals(reachableHost, multipleAddresses.getReachableAddress());
         }
     }
 
@@ -184,7 +190,7 @@ public void testGetAllReachableAddresses() throws Exception {
           Arrays.asList(unreachableHost1, unreachableHost2, reachableHost1, reachableHost2));
 
         Set<InetSocketAddress> reachableHosts = new HashSet<>(Arrays.asList(reachableHost1, reachableHost2));
-        Assert.assertEquals(reachableHosts, multipleAddresses.getAllReachableAddresses());
+        assertEquals(reachableHosts, multipleAddresses.getAllReachableAddresses());
     }
 
     @Test
@@ -198,7 +204,7 @@ public void testGetAllReachableAddressesOrAllWhenSomeReachable() throws Exceptio
           Arrays.asList(unreachableHost1, unreachableHost2, reachableHost1, reachableHost2));
 
         Set<InetSocketAddress> reachableHosts = new HashSet<>(Arrays.asList(reachableHost1, reachableHost2));
-        Assert.assertEquals(reachableHosts, multipleAddresses.getAllReachableAddressesOrAll());
+        assertEquals(reachableHosts, multipleAddresses.getAllReachableAddressesOrAll());
     }
 
     @Test
@@ -210,7 +216,7 @@ public void testGetAllReachableAddressesOrAllWhenNoneReachable() throws Exceptio
 
         MultipleAddresses multipleAddresses = new MultipleAddresses(allUnreachableAddresses);
 
-        Assert.assertEquals(new HashSet<>(allUnreachableAddresses), multipleAddresses.getAllReachableAddressesOrAll());
+        assertEquals(new HashSet<>(allUnreachableAddresses), multipleAddresses.getAllReachableAddressesOrAll());
     }
 
     @Test
@@ -220,11 +226,11 @@ public void testEquals() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
         MultipleAddresses multipleAddressesEquals = new MultipleAddresses(addresses);
 
-        Assert.assertEquals(multipleAddresses, multipleAddressesEquals);
+        assertEquals(multipleAddresses, multipleAddressesEquals);
 
         MultipleAddresses multipleAddressesNotEquals = new MultipleAddresses(getAddressList());
 
-        Assert.assertNotEquals(multipleAddresses, multipleAddressesNotEquals);
+        assertNotEquals(multipleAddresses, multipleAddressesNotEquals);
     }
 
     @Test
@@ -232,7 +238,7 @@ public void testSize() {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertEquals(PORTS_AMOUNT, multipleAddresses.size());
+        assertEquals(PORTS_AMOUNT, multipleAddresses.size());
     }
 
     public List<Integer> getPortList() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
index 0f9a8accb1b..67bb673f113 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
@@ -22,7 +22,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumBeanTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
index ab1c077d9bd..b907bbe1036 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.Socket;
@@ -27,9 +27,9 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,7 +38,7 @@ public class QuorumCnxManagerSocketConnectionTimeoutTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(QuorumCnxManagerSocketConnectionTimeoutTest.class);
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         // starting a 3 node ensemble without observers
         qu = new QuorumUtil(1, 2);
@@ -72,9 +72,8 @@ public void testSocketConnectionTimeoutDuringConnectingToElectionAddress() throw
 
         qu.shutdown(leaderId);
 
-        assertTrue("Timeout during waiting for current leader to go down",
-                   ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort,
-                                                ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Timeout during waiting for current leader to go down");
 
         String errorMessage = "No new leader was elected";
         waitFor(errorMessage, () -> qu.leaderExists() && qu.getLeaderServer() != leaderId, 15);
@@ -103,7 +102,7 @@ public void connect(SocketAddress endpoint, int timeout) throws IOException {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qu.shutdownAll();
         QuorumCnxManager.setSocketFactory(QuorumCnxManager.DEFAULT_SOCKET_FACTORY);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
index 691b45513a7..af2fed8cf88 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -40,11 +42,10 @@
 import org.apache.zookeeper.server.metric.SimpleCounter;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -56,12 +57,12 @@ public class QuorumDigestTest extends QuorumPeerTestBase {
     private Servers servers;
     private String forceSnapSyncValue;
 
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         new DataTreeMock();
     }
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         forceSnapSyncValue = System.getProperty(LearnerHandler.FORCE_SNAP_SYNC);
         ZooKeeperServer.setDigestEnabled(true);
@@ -69,7 +70,7 @@ public void setup() throws Exception {
         servers = LaunchServers(3, 1, null);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (servers != null) {
             servers.shutDownAllServers();
@@ -98,7 +99,7 @@ public void testDigestMatchesDuringSnapSync() throws Exception {
         int leader = servers.findLeader();
         TxnLogDigestTest.performOperations(servers.zk[leader],
                 "/testDigestMatchesDuringSnapSync");
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
     }
 
     @Test
@@ -142,7 +143,7 @@ public void processResult(int rc, String path,
         startServers(targets);
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         // stop the leader
         targets = Arrays.asList(leader);
@@ -150,7 +151,7 @@ public void processResult(int rc, String path,
         startServers(targets);
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         stopped.set(true);
     }
@@ -161,7 +162,7 @@ public void processResult(int rc, String path,
     @Test
     public void testDigestMismatchesWhenTxnLost() throws Exception {
         // make sure there is no mismatch after all servers start up
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         // shutdown a follower and observer
         List<Integer> targets = Arrays.asList(
@@ -171,7 +172,7 @@ public void testDigestMismatchesWhenTxnLost() throws Exception {
         int leader = servers.findLeader();
         triggerOps(leader, "/p1");
 
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         DataTreeMock.skipTxnZxid = "100000006";
 
@@ -179,10 +180,10 @@ public void testDigestMismatchesWhenTxnLost() throws Exception {
         startServers(targets);
 
         long misMatchCount = getMismatchDigestCount();
-        Assert.assertNotEquals(0L, misMatchCount);
+        assertNotEquals(0L, misMatchCount);
 
         triggerOps(leader, "/p2");
-        Assert.assertNotEquals(misMatchCount, getMismatchDigestCount());
+        assertNotEquals(misMatchCount, getMismatchDigestCount());
     }
 
     private void stopServers(List<Integer> sids) throws InterruptedException {
@@ -213,12 +214,12 @@ private void triggerSync(boolean snapSync) throws Exception {
         }
 
         // make sure there is no mismatch after all servers start up
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         int leader = servers.findLeader();
         triggerOps(leader, "/p1");
 
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         // shutdown a follower and observer
         List<Integer> targets = Arrays.asList(
@@ -231,7 +232,7 @@ private void triggerSync(boolean snapSync) throws Exception {
         // start the follower and observer to have a diff sync
         startServers(targets);
 
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
     }
 
     public static long getMismatchDigestCount() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
index da4bedf7c1d..b2c350e3edd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -29,7 +30,7 @@
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumPeerConfigTest {
 
@@ -105,12 +106,14 @@ public void testCustomSSLAuth() throws IOException {
     /**
      * Test case for https://issues.apache.org/jira/browse/ZOOKEEPER-2873
      */
-    @Test(expected = ConfigException.class)
-    public void testSamePortConfiguredForClientAndElection() throws IOException, ConfigException {
-        QuorumPeerConfig quorumPeerConfig = new QuorumPeerConfig();
-        Properties zkProp = getDefaultZKProperties();
-        zkProp.setProperty("server.1", "localhost:2888:2888");
-        quorumPeerConfig.parseProperties(zkProp);
+    @Test
+    public void testSamePortConfiguredForClientAndElection() {
+        assertThrows(ConfigException.class, () -> {
+            QuorumPeerConfig quorumPeerConfig = new QuorumPeerConfig();
+            Properties zkProp = getDefaultZKProperties();
+            zkProp.setProperty("server.1", "localhost:2888:2888");
+            quorumPeerConfig.parseProperties(zkProp);
+        });
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java
index 9c2906c122f..e9b0edfb535 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 
 public class QuorumPeerMainMultiAddressTest extends QuorumPeerTestBase {
@@ -51,7 +51,7 @@ public class QuorumPeerMainMultiAddressTest extends QuorumPeerTestBase {
 
   private int zNodeId = 0;
 
-  @Before
+  @BeforeEach
   public void setUp() throws Exception {
     System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
     ClientBase.setupTestEnv();
@@ -62,7 +62,7 @@ public void setUp() throws Exception {
     System.setProperty("zookeeper.jmx.log4j.disable", "true");
   }
 
-  @After
+  @AfterEach
   public void tearDown() throws Exception {
     super.tearDown();
     System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index 487507bfc53..793a3058011 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -20,13 +20,13 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.apache.zookeeper.test.ClientBase.createEmptyTestDir;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doCallRealMethod;
 import static org.mockito.Mockito.mock;
@@ -66,7 +66,7 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test stand-alone server.
@@ -93,23 +93,17 @@ public void testQuorumInternal(String addr) throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
         QuorumPeer quorumPeer = q1.main.quorumPeer;
 
         int tickTime = quorumPeer.getTickTime();
-        assertEquals(
-            "Default value of minimumSessionTimeOut is not considered",
-            tickTime * 2,
-            quorumPeer.getMinSessionTimeout());
-        assertEquals(
-            "Default value of maximumSessionTimeOut is not considered",
-            tickTime * 20,
-            quorumPeer.getMaxSessionTimeout());
+        assertEquals(tickTime * 2, quorumPeer.getMinSessionTimeout(),
+                "Default value of minimumSessionTimeOut is not considered");
+        assertEquals(tickTime * 20, quorumPeer.getMaxSessionTimeout(),
+                "Default value of maximumSessionTimeOut is not considered");
 
         ZooKeeper zk = new ZooKeeper(addr + ":" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, this);
         waitForOne(zk, States.CONNECTED);
@@ -126,12 +120,10 @@ public void testQuorumInternal(String addr) throws Exception {
         q1.shutdown();
         q2.shutdown();
 
-        assertTrue(
-            "waiting for server 1 down",
-            ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 down",
-            ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
+        assertTrue(ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
     }
 
     /**
@@ -238,13 +230,11 @@ public void testEarlyLeaderAbandonment() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             for (int j = 0; j < SERVER_COUNT; j++) {
                 if (i == leader) {
-                    assertTrue((j == leader ? ("Leader (" + leader + ")") : ("Follower " + j))
-                                              + " should not have /zk"
-                                              + i, zk[j].exists("/zk" + i, false) == null);
+                    assertTrue(zk[j].exists("/zk" + i, false) == null,
+                            (j == leader ? ("Leader (" + leader + ")") : ("Follower " + j)) + " should not have /zk" + i);
                 } else {
-                    assertTrue((j == leader ? ("Leader (" + leader + ")") : ("Follower " + j))
-                                              + " does not have /zk"
-                                              + i, zk[j].exists("/zk" + i, false) != null);
+                    assertTrue(zk[j].exists("/zk" + i, false) != null,
+                            (j == leader ? ("Leader (" + leader + ")") : ("Follower " + j)) + " does not have /zk" + i);
                 }
             }
         }
@@ -269,7 +259,7 @@ public void testHighestZxidJoinLate() throws Exception {
         int leader = servers.findLeader();
 
         // make sure there is a leader
-        assertTrue("There should be a leader", leader >= 0);
+        assertTrue(leader >= 0, "There should be a leader");
 
         int nonleader = (leader + 1) % numServers;
 
@@ -320,7 +310,7 @@ public void testHighestZxidJoinLate() throws Exception {
         // validate that the old value is there and not the new one
         output = servers.zk[nonleader].getData(path + leader, false, null);
 
-        assertEquals("Expecting old value 1 since 2 isn't committed yet", output[0], 1);
+        assertEquals(output[0], 1, "Expecting old value 1 since 2 isn't committed yet");
 
         // Do some other update, so we bump the maxCommttedZxid
         // by setting the value to 2
@@ -334,11 +324,11 @@ public void testHighestZxidJoinLate() throws Exception {
 
         // make sure it doesn't have the new value that it alone had logged
         output = servers.zk[leader].getData(path + leader, false, null);
-        assertEquals("Validating that the deposed leader has rolled back that change it had written", output[0], 1);
+        assertEquals(output[0], 1, "Validating that the deposed leader has rolled back that change it had written");
 
         // make sure the leader has the subsequent changes that were made while it was offline
         output = servers.zk[leader].getData(path + nonleader, false, null);
-        assertEquals("Validating that the deposed leader caught up on changes it missed", output[0], 2);
+        assertEquals(output[0], 2, "Validating that the deposed leader caught up on changes it missed");
     }
 
     /**
@@ -369,12 +359,11 @@ public void testElectionFraud() throws IOException, InterruptedException {
 
             // find the leader
             int trueLeader = servers.findLeader();
-            assertTrue("There should be a leader", trueLeader >= 0);
+            assertTrue(trueLeader >= 0, "There should be a leader");
 
             // find a follower
             int falseLeader = (trueLeader + 1) % numServers;
-            assertTrue("All servers should join the quorum", servers.mt[falseLeader].main.quorumPeer.follower
-                                                                            != null);
+            assertTrue(servers.mt[falseLeader].main.quorumPeer.follower != null, "All servers should join the quorum");
 
             // to keep the quorum peer running and force it to go into the looking state, we kill leader election
             servers.mt[falseLeader].main.quorumPeer.electionAlg.shutdown();
@@ -426,9 +415,9 @@ public void testElectionFraud() throws IOException, InterruptedException {
             qlogger.removeAppender(appender);
         }
 
-        assertTrue("falseLeader never attempts to become leader", foundLeading);
-        assertTrue("falseLeader never gives up on leadership", foundLooking);
-        assertTrue("falseLeader never rejoins the quorum", foundFollowing);
+        assertTrue(foundLeading, "falseLeader never attempts to become leader");
+        assertTrue(foundLooking, "falseLeader never gives up on leadership");
+        assertTrue(foundFollowing, "falseLeader never rejoins the quorum");
     }
 
     /**
@@ -456,13 +445,12 @@ public void testBadPeerAddressInQuorum() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
         } finally {
             qlogger.removeAppender(appender);
@@ -478,7 +466,7 @@ public void testBadPeerAddressInQuorum() throws Exception {
                 break;
             }
         }
-        assertTrue("complains about host", found);
+        assertTrue(found, "complains about host");
     }
 
     /**
@@ -512,29 +500,23 @@ public void testInconsistentPeerType() throws Exception {
             q2.start();
             q3.start();
 
-            assertTrue(
-                "waiting for server 1 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP3, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                    "waiting for server 1 being up");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                    "waiting for server 2 being up");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP3, CONNECTION_TIMEOUT),
+                    "waiting for server 3 being up");
 
             q1.shutdown();
             q2.shutdown();
             q3.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 3 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP3, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP3, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 3 down");
 
         } finally {
             qlogger.removeAppender(appender);
@@ -557,7 +539,7 @@ public void testInconsistentPeerType() throws Exception {
                 break;
             }
         }
-        assertTrue("Should warn about inconsistent peer type", warningPresent && defaultedToObserver);
+        assertTrue(warningPresent && defaultedToObserver, "Should warn about inconsistent peer type");
     }
 
     /**
@@ -580,12 +562,10 @@ public void testBadPackets() throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         byte[] b = new byte[4];
         int length = 1024 * 1024 * 1024;
@@ -636,22 +616,18 @@ public void testQuorumDefaults() throws Exception {
             q1.start();
             q2.start();
 
-            assertTrue(
-                "waiting for server 1 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                    "waiting for server 1 being up");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                    "waiting for server 2 being up");
 
             q1.shutdown();
             q2.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
 
         } finally {
             zlogger.removeAppender(appender);
@@ -667,7 +643,7 @@ public void testQuorumDefaults() throws Exception {
                 break;
             }
         }
-        assertTrue("fastleaderelection used", found);
+        assertTrue(found, "fastleaderelection used");
     }
 
     /**
@@ -715,17 +691,15 @@ public void testMinMaxSessionTimeOut() throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         QuorumPeer quorumPeer = q1.main.quorumPeer;
 
-        assertEquals("minimumSessionTimeOut is not considered", minSessionTimeOut, quorumPeer.getMinSessionTimeout());
-        assertEquals("maximumSessionTimeOut is not considered", maxSessionTimeOut, quorumPeer.getMaxSessionTimeout());
+        assertEquals(minSessionTimeOut, quorumPeer.getMinSessionTimeout(), "minimumSessionTimeOut is not considered");
+        assertEquals(maxSessionTimeOut, quorumPeer.getMaxSessionTimeout(), "maximumSessionTimeOut is not considered");
     }
 
     /**
@@ -750,18 +724,16 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         QuorumPeer quorumPeer = q1.main.quorumPeer;
         final int maxSessionTimeOut = quorumPeer.tickTime * 20;
 
-        assertEquals("minimumSessionTimeOut is not considered", minSessionTimeOut, quorumPeer.getMinSessionTimeout());
-        assertEquals("maximumSessionTimeOut is wrong", maxSessionTimeOut, quorumPeer.getMaxSessionTimeout());
+        assertEquals(minSessionTimeOut, quorumPeer.getMinSessionTimeout(), "minimumSessionTimeOut is not considered");
+        assertEquals(maxSessionTimeOut, quorumPeer.getMaxSessionTimeout(), "maximumSessionTimeOut is wrong");
     }
 
     @Test
@@ -827,7 +799,7 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
         assertTrue(outstanding.size() > 0);
         Proposal p = findProposalOfType(outstanding, OpCode.create);
         LOG.info("Old leader id: {}. All proposals: {}", leader, outstanding);
-        assertNotNull("Old leader doesn't have 'create' proposal", p);
+        assertNotNull(p, "Old leader doesn't have 'create' proposal");
 
         // make sure it has a chance to write it to disk
         int sleepTime = 0;
@@ -868,9 +840,8 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
         // 8. check the node exist in previous leader but not others
         //    make sure everything is consistent
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertNull(
-                "server " + i + " should not have /zk" + leader,
-                servers.zk[i].exists("/zk" + leader, false));
+            assertNull(servers.zk[i].exists("/zk" + leader, false),
+                    "server " + i + " should not have /zk" + leader);
         }
     }
 
@@ -928,9 +899,8 @@ public void testLeaderOutOfView() throws Exception {
 
             // Nodes 2 and 3 now form quorum and fully start. 1 attempts to vote for 3, fails, returns to LOOKING state
             for (int i = 1; i < numServers; i++) {
-                assertTrue(
-                    "waiting for server to start",
-                    ClientBase.waitForServerUp("127.0.0.1:" + svrs.clientPorts[i], CONNECTION_TIMEOUT));
+                assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + svrs.clientPorts[i], CONNECTION_TIMEOUT),
+                        "waiting for server to start");
             }
 
             assertTrue(svrs.mt[0].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.LOOKING);
@@ -955,8 +925,8 @@ public void testLeaderOutOfView() throws Exception {
             qlogger.removeAppender(appender);
         }
 
-        assertFalse("Corrupt peer should never become leader", foundLeading);
-        assertFalse("Corrupt peer should not attempt connection to out of view leader", foundFollowing);
+        assertFalse(foundLeading, "Corrupt peer should never become leader");
+        assertFalse(foundFollowing, "Corrupt peer should not attempt connection to out of view leader");
     }
 
     @Test
@@ -1288,9 +1258,8 @@ public TestQPMain getTestQPMain() {
         // make sure the quorum can be formed within initLimit * tickTime
         // the default setting is 10 * 4000 = 40000 ms
         for (int i = 0; i < SERVERS_TO_START; i++) {
-            assertTrue(
-                "Server " + i + " should have joined quorum by now",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], maxTimeWaitForServerUp));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], maxTimeWaitForServerUp),
+                    "Server " + i + " should have joined quorum by now");
         }
     }
 
@@ -1326,27 +1295,25 @@ public void testMetricsProviderLifecycle() throws Exception {
 
             boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
             boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue("Server 1 never came up", isup1);
-            assertTrue("Server 2 never came up", isup2);
+            assertTrue(isup1, "Server 1 never came up");
+            assertTrue(isup2, "Server 2 never came up");
 
             q1.shutdown();
             q2.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
         } finally {
             qlogger.removeAppender(appender);
         }
 
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get());
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get(), "metrics provider lifecycle error");
     }
 
     /**
@@ -1383,19 +1350,17 @@ public void testMetricsProviderConfiguration() throws Exception {
 
             boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
             boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue("Server 1 never came up", isup1);
-            assertTrue("Server 2 never came up", isup2);
+            assertTrue(isup1, "Server 1 never came up");
+            assertTrue(isup2, "Server 2 never came up");
 
             q1.shutdown();
             q2.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
         } finally {
             qlogger.removeAppender(appender);
         }
@@ -1437,24 +1402,22 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
 
             boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
             boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue("Server 1 never came up", isup1);
-            assertTrue("Server 2 never came up", isup2);
+            assertTrue(isup1, "Server 1 never came up");
+            assertTrue(isup2, "Server 2 never came up");
 
             q1.shutdown();
             q2.shutdown();
 
-            assertTrue(
-                    "waiting for server 1 down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-            assertTrue(
-                    "waiting for server 2 down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
         } finally {
             qlogger.removeAppender(appender);
         }
 
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderWithErrorInStop.stopCalled.get());
+        assertTrue(BaseTestMetricsProvider.MetricsProviderWithErrorInStop.stopCalled.get(), "metrics provider lifecycle error");
 
         LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
         String line;
@@ -1466,7 +1429,7 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
                 break;
             }
         }
-        assertTrue("complains about metrics provider", found);
+        assertTrue(found, "complains about metrics provider");
     }
 
     /**
@@ -1494,13 +1457,12 @@ public void testInvalidMetricsProvider() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 5000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
         } finally {
             qlogger.removeAppender(appender);
@@ -1516,7 +1478,7 @@ public void testInvalidMetricsProvider() throws Exception {
                 break;
             }
         }
-        assertTrue("complains about metrics provider", found);
+        assertTrue(found, "complains about metrics provider");
     }
 
     /**
@@ -1545,13 +1507,12 @@ public void testFaultyMetricsProviderOnStart() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 5000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
         } finally {
             qlogger.removeAppender(appender);
@@ -1567,7 +1528,7 @@ public void testFaultyMetricsProviderOnStart() throws Exception {
                 break;
             }
         }
-        assertTrue("complains about metrics provider MetricsProviderLifeCycleException", found);
+        assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
     }
 
     /**
@@ -1596,13 +1557,12 @@ public void testFaultyMetricsProviderOnConfigure() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 5000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
         } finally {
             qlogger.removeAppender(appender);
@@ -1618,7 +1578,7 @@ public void testFaultyMetricsProviderOnConfigure() throws Exception {
                 break;
             }
         }
-        assertTrue("complains about metrics provider MetricsProviderLifeCycleException", found);
+        assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
     }
 
     /**
@@ -1645,8 +1605,8 @@ public void testLearnerRequestForwardBehavior() throws Exception {
             final String node = "/testLearnerRequestForwardBehavior";
             servers.zk[followerA].create(node, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-            assertNotNull("node " + node + " should exist",
-                    servers.zk[followerA].exists("/testLearnerRequestForwardBehavior", false));
+            assertNotNull(servers.zk[followerA].exists("/testLearnerRequestForwardBehavior", false),
+                    "node " + node + " should exist");
 
             assertEquals(1L, ServerMetrics.getMetrics().REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR.get());
         } finally {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
index 03cb6f06a83..194144b14af 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -31,7 +31,7 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumPeerTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index aa75218b03b..953f4ab066c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -41,7 +41,7 @@
 import org.apache.zookeeper.server.admin.JettyAdminServer;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.After;
+import org.junit.jupiter.api.AfterEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,7 +58,7 @@ public class QuorumPeerTestBase extends ZKTestCase implements Watcher {
     protected Servers servers;
     protected int numServers = 0;
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (servers == null || servers.mt == null) {
             LOG.info("No servers to shutdown!");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
index 3565c562a60..8a463c07b18 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
@@ -18,35 +18,30 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Stream;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.TestableZooKeeper;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
 public class QuorumRequestPipelineTest extends QuorumBase {
 
-    protected ServerState serverState;
     protected final CountDownLatch callComplete = new CountDownLatch(1);
     protected boolean complete = false;
     protected static final String PARENT_PATH = "/foo";
@@ -57,17 +52,14 @@ public class QuorumRequestPipelineTest extends QuorumBase {
 
     protected TestableZooKeeper zkClient;
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(new Object[][]{{ServerState.LEADING}, {ServerState.FOLLOWING}, {ServerState.OBSERVING}});
-    }
-
-    public QuorumRequestPipelineTest(ServerState state) {
-        this.serverState = state;
+    public static Stream<Arguments> data() throws Exception {
+        return Stream.of(
+                Arguments.of(ServerState.LEADING),
+                Arguments.of(ServerState.FOLLOWING),
+                Arguments.of(ServerState.OBSERVING));
     }
 
-    @Before
-    public void setUp() throws Exception {
+    public void setUp(ServerState serverState) throws Exception {
         CountdownWatcher clientWatch = new CountdownWatcher();
         super.setUp(true);
         zkClient = createClient(clientWatch, getPeersMatching(serverState));
@@ -75,7 +67,7 @@ public void setUp() throws Exception {
         clientWatch.waitForConnected(CONNECTION_TIMEOUT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         zkClient.close();
         super.tearDown();
@@ -87,66 +79,84 @@ private Stat create2EmptyNode(TestableZooKeeper zkClient, String path) throws Ex
         return stat;
     }
 
-    @Test
-    public void testCreate() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate(ServerState serverState) throws Exception {
+        setUp(serverState);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        assertArrayEquals(String.format("%s Node created (create) with expected value", serverState), DATA, zkClient.getData(PARENT_PATH, false, null));
+        assertArrayEquals(DATA, zkClient.getData(PARENT_PATH, false, null), String.format("%s Node created (create) with expected value", serverState));
     }
 
-    @Test
-    public void testCreate2() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate2(ServerState serverState) throws Exception {
+        setUp(serverState);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
-        assertArrayEquals(String.format("%s Node created (create2) with expected value", serverState), DATA, zkClient.getData(PARENT_PATH, false, null));
+        assertArrayEquals(DATA, zkClient.getData(PARENT_PATH, false, null), String.format("%s Node created (create2) with expected value", serverState));
     }
 
-    @Test
-    public void testDelete() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testDelete(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         zkClient.delete(PARENT_PATH, -1);
-        assertNull(String.format("%s Node no longer exists", serverState), zkClient.exists(PARENT_PATH, false));
+        assertNull(zkClient.exists(PARENT_PATH, false), String.format("%s Node no longer exists", serverState));
     }
 
-    @Test
-    public void testExists() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testExists(ServerState serverState) throws Exception {
+        setUp(serverState);
         Stat stat = create2EmptyNode(zkClient, PARENT_PATH);
-        assertEquals(String.format("%s Exists returns correct node stat", serverState), stat, zkClient.exists(PARENT_PATH, false));
+        assertEquals(stat, zkClient.exists(PARENT_PATH, false), String.format("%s Exists returns correct node stat", serverState));
     }
 
-    @Test
-    public void testSetAndGetData() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetData(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         zkClient.setData(PARENT_PATH, DATA, -1);
-        assertArrayEquals(String.format("%s Node updated with expected value", serverState), DATA, zkClient.getData(PARENT_PATH, false, null));
+        assertArrayEquals(DATA, zkClient.getData(PARENT_PATH, false, null), String.format("%s Node updated with expected value", serverState));
     }
 
-    @Test
-    public void testSetAndGetACL() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetACL(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
-        assertEquals(String.format("%s Node has open ACL", serverState), Ids.OPEN_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()));
+        assertEquals(Ids.OPEN_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()), String.format("%s Node has open ACL", serverState));
         zkClient.setACL(PARENT_PATH, Ids.READ_ACL_UNSAFE, -1);
-        assertEquals(String.format("%s Node has world read-only ACL", serverState), Ids.READ_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()));
+        assertEquals(Ids.READ_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()), String.format("%s Node has world read-only ACL", serverState));
     }
 
-    @Test
-    public void testSetAndGetChildren() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetChildren(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         for (String child : CHILDREN) {
             create2EmptyNode(zkClient, PARENT_PATH + "/" + child);
         }
-        assertEquals(String.format("%s Parent has expected children", serverState), CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false)));
+        assertEquals(CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false)), String.format("%s Parent has expected children", serverState));
     }
 
-    @Test
-    public void testSetAndGetChildren2() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetChildren2(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         for (String child : CHILDREN) {
             create2EmptyNode(zkClient, PARENT_PATH + "/" + child);
         }
-        assertEquals(String.format("%s Parent has expected children", serverState), CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false, null)));
+        assertEquals(CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false, null)), String.format("%s Parent has expected children", serverState));
     }
 
-    @Test
-    public void testSync() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSync(ServerState serverState) throws Exception {
+        setUp(serverState);
         complete = false;
         create2EmptyNode(zkClient, PARENT_PATH);
         VoidCallback onSync = new VoidCallback() {
@@ -158,7 +168,7 @@ public void processResult(int rc, String path, Object ctx) {
         };
         zkClient.sync(PARENT_PATH, onSync, null);
         callComplete.await(30, TimeUnit.SECONDS);
-        assertTrue(String.format("%s Sync completed", serverState), complete);
+        assertTrue(complete, String.format("%s Sync completed", serverState));
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index 593edbd9245..ee7555aadb8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -20,10 +20,10 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.apache.zookeeper.test.ClientBase.createTmpDir;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import com.sun.net.httpserver.Headers;
 import com.sun.net.httpserver.HttpHandler;
 import com.sun.net.httpserver.HttpServer;
@@ -109,11 +109,10 @@
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.util.io.pem.PemWriter;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class QuorumSSLTest extends QuorumPeerTestBase {
 
@@ -150,10 +149,7 @@ public class QuorumSSLTest extends QuorumPeerTestBase {
     private Date certStartTime;
     private Date certEndTime;
 
-    @Rule
-    public Timeout timeout = Timeout.builder().withTimeout(5, TimeUnit.MINUTES).withLookingForStuckThread(true).build();
-
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         quorumX509Util = new QuorumX509Util();
         ClientBase.setupTestEnv();
@@ -428,7 +424,7 @@ public void setSSLSystemProperties() {
         System.setProperty(quorumX509Util.getSslTruststorePasswdProperty(), "testpass");
     }
 
-    @After
+    @AfterEach
     public void cleanUp() throws Exception {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
         clearSSLSystemProperties();
@@ -459,6 +455,7 @@ private void clearSSLSystemProperties() {
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testQuorumSSL() throws Exception {
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
@@ -480,6 +477,7 @@ public void testQuorumSSL() throws Exception {
 
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testQuorumSSLWithMultipleAddresses() throws Exception {
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         quorumConfiguration = generateMultiAddressQuorumConfiguration();
@@ -504,6 +502,7 @@ public void testQuorumSSLWithMultipleAddresses() throws Exception {
 
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testRollingUpgrade() throws Exception {
         // Form a quorum without ssl
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration);
@@ -551,6 +550,7 @@ private void stopAppendConfigRestartAll(Map<Integer, MainThread> members, String
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationWithInvalidHostname() throws Exception {
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
@@ -567,6 +567,7 @@ public void testHostnameVerificationWithInvalidHostname() throws Exception {
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationWithInvalidIPAddress() throws Exception {
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
@@ -583,6 +584,7 @@ public void testHostnameVerificationWithInvalidIPAddress() throws Exception {
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname() throws Exception {
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
@@ -599,6 +601,7 @@ public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname() thr
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationForInvalidMultiAddressServerConfig() throws Exception {
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         quorumConfiguration = generateMultiAddressQuorumConfiguration();
@@ -618,6 +621,7 @@ public void testHostnameVerificationForInvalidMultiAddressServerConfig() throws
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationWithInvalidIpAddressAndValidHostname() throws Exception {
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
@@ -634,6 +638,7 @@ public void testHostnameVerificationWithInvalidIpAddressAndValidHostname() throw
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationWithValidIpAddressAndInvalidHostname() throws Exception {
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
@@ -700,6 +705,7 @@ private void testHostnameVerification(String keystorePath, boolean expectSuccess
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testCertificateRevocationList() throws Exception {
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
@@ -765,6 +771,7 @@ public void testCertificateRevocationList() throws Exception {
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testOCSP() throws Exception {
         Integer ocspPort = PortAssignment.unique();
 
@@ -838,6 +845,7 @@ public void testOCSP() throws Exception {
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testCipherSuites() throws Exception {
         // Get default cipher suites from JDK
         SSLServerSocketFactory ssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
@@ -878,6 +886,7 @@ public void testCipherSuites() throws Exception {
     }
 
     @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testProtocolVersion() throws Exception {
         System.setProperty(quorumX509Util.getSslProtocolProperty(), "TLSv1.2");
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
index 6f5155bf022..71630913b7c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
@@ -17,14 +17,15 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 public class QuorumServerTest extends ZKTestCase {
 
@@ -32,7 +33,7 @@ public class QuorumServerTest extends ZKTestCase {
     private String ipv6n2 = "[2600:0:0:0:0:0:1:0]";
     private String ipv4config = "127.0.0.1:1234:1236";
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
     }
@@ -42,32 +43,32 @@ public void testToString() throws ConfigException {
         String provided = ipv4config + ":participant;0.0.0.0:1237";
         String expected = ipv4config + ":participant;0.0.0.0:1237";
         QuorumServer qs = new QuorumServer(0, provided);
-        assertEquals("Use IP address", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Use IP address");
 
         provided = ipv4config + ";0.0.0.0:1237";
         expected = ipv4config + ":participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Type unspecified", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Type unspecified");
 
         provided = ipv4config + ":observer;0.0.0.0:1237";
         expected = ipv4config + ":observer;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Observer type", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Observer type");
 
         provided = ipv4config + ":participant;1237";
         expected = ipv4config + ":participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Client address unspecified", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Client address unspecified");
 
         provided = ipv4config + ":participant;1.2.3.4:1237";
         expected = ipv4config + ":participant;1.2.3.4:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Client address specified", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Client address specified");
 
         provided = "example.com:1234:1236:participant;1237";
         expected = "example.com:1234:1236:participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Use hostname", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Use hostname");
     }
 
     @Test
@@ -84,27 +85,33 @@ public void constructionUnderstandsIpv6LiteralsInClientConfig() throws ConfigExc
         assertEquals(ipv4config + ":participant;[0:0:0:0:0:0:0:1]:1237", qs.toString());
     }
 
-    @Test(expected = ConfigException.class)
-    public void unbalancedIpv6LiteralsInServerConfigFailToBeParsed() throws ConfigException {
-        new QuorumServer(0, "[::1:1234:1236:participant");
+    @Test
+    public void unbalancedIpv6LiteralsInServerConfigFailToBeParsed()  {
+        assertThrows(ConfigException.class, () -> {
+            new QuorumServer(0, "[::1:1234:1236:participant");
+        });
     }
 
-    @Test(expected = ConfigException.class)
-    public void unbalancedIpv6LiteralsInClientConfigFailToBeParsed() throws ConfigException {
-        new QuorumServer(0, ipv4config + ":participant;[::1:1237");
+    @Test
+    public void unbalancedIpv6LiteralsInClientConfigFailToBeParsed() {
+        assertThrows(ConfigException.class, () -> {
+            new QuorumServer(0, ipv4config + ":participant;[::1:1237");
+        });
     }
 
-    @Test(expected = ConfigException.class)
-    public void shouldNotAllowMultipleAddressesWhenMultiAddressFeatureIsDisabled() throws ConfigException {
-        System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "false");
-        new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
+    @Test
+    public void shouldNotAllowMultipleAddressesWhenMultiAddressFeatureIsDisabled() {
+        assertThrows(ConfigException.class, () -> {
+            System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "false");
+            new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
+        });
     }
 
     @Test
     public void shouldAllowMultipleAddressesWhenMultiAddressFeatureIsEnabled() throws ConfigException {
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         QuorumServer qs = new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
-        assertEquals("MultiAddress parse error", "127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant", qs.toString());
+        assertEquals("127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant", qs.toString(), "MultiAddress parse error");
     }
 
     @Test
@@ -125,17 +132,19 @@ public void testWildcard() throws KeeperException.BadArgumentsException {
         }
     }
 
-    @Test(expected = KeeperException.BadArgumentsException.class)
-    public void testDuplicate() throws KeeperException.BadArgumentsException {
-        QuorumPeer.QuorumServer server1 = new QuorumPeer.QuorumServer(1, new InetSocketAddress(ipv6n1, 1234), // peer
-                                                                      new InetSocketAddress(ipv6n1, 1236), // election
-                                                                      new InetSocketAddress(ipv6n1, 1237)  // client
-        );
-        QuorumPeer.QuorumServer server2 = new QuorumPeer.QuorumServer(2, new InetSocketAddress(ipv6n2, 1234), // peer
-                                                                      new InetSocketAddress(ipv6n2, 1236), // election
-                                                                      new InetSocketAddress(ipv6n1, 1237)  // client
-        );
-        server1.checkAddressDuplicate(server2);
+    @Test
+    public void testDuplicate() {
+        assertThrows(KeeperException.BadArgumentsException.class, () -> {
+            QuorumPeer.QuorumServer server1 = new QuorumPeer.QuorumServer(1, new InetSocketAddress(ipv6n1, 1234), // peer
+                    new InetSocketAddress(ipv6n1, 1236), // election
+                    new InetSocketAddress(ipv6n1, 1237)  // client
+            );
+            QuorumPeer.QuorumServer server2 = new QuorumPeer.QuorumServer(2, new InetSocketAddress(ipv6n2, 1234), // peer
+                    new InetSocketAddress(ipv6n2, 1236), // election
+                    new InetSocketAddress(ipv6n1, 1237)  // client
+            );
+            server1.checkAddressDuplicate(server2);
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
index 38739a1f2eb..ef1f1219452 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.SocketException;
 import java.nio.ByteBuffer;
@@ -37,8 +37,9 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,13 +58,14 @@ public class RaceConditionTest extends QuorumPeerTestBase {
      * Deadlock while shutting down the ZooKeeper
      */
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRaceConditionBetweenLeaderAndAckRequestProcessor() throws Exception {
         mt = startQuorum();
         // get leader
         QuorumPeer leader = getLeader(mt);
         long oldLeaderCurrentEpoch = leader.getCurrentEpoch();
-        assertNotNull("Leader should not be null", leader);
+        assertNotNull(leader, "Leader should not be null");
         // shutdown 2 followers so that leader does not have majority and goes
         // into looking state or following/leading state.
         shutdownFollowers(mt);
@@ -75,18 +77,16 @@ public void testRaceConditionBetweenLeaderAndAckRequestProcessor() throws Except
          * after the leader election, not the old LEADING state.
          * </pre>
          */
-        boolean leaderStateChanged = ClientBase.waitForServerState(leader, 15000, QuorumStats.Provider.LOOKING_STATE, QuorumStats.Provider.FOLLOWING_STATE);
+        boolean leaderStateChanged = ClientBase
+            .waitForServerState(leader, 15000, QuorumStats.Provider.LOOKING_STATE, QuorumStats.Provider.FOLLOWING_STATE);
         // Wait for the old leader to start completely
-        assertTrue(
-                "Failed to bring up the old leader server",
-                ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT));
-        assertTrue(
-                "Leader failed to transition to new state. Current state is " + leader.getServerState(),
-                leaderStateChanged
-                        || (leader.getCurrentEpoch() > oldLeaderCurrentEpoch));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT),
+            "Failed to bring up the old leader server");
+        assertTrue(leaderStateChanged || (leader.getCurrentEpoch() > oldLeaderCurrentEpoch),
+            "Leader failed to transition to new state. Current state is " + leader.getServerState());
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all severs
         if (null != mt) {
@@ -130,8 +130,8 @@ public TestQPMain getTestQPMain() {
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
         return mt;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
index 8efb9d7cce9..0a3e580ba33 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
@@ -39,8 +39,8 @@
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ReconfigBackupTest extends QuorumPeerTestBase {
 
@@ -60,7 +60,7 @@ public static String getFileContent(File file) throws FileNotFoundException {
         return sb.toString();
     }
 
-    @Before
+    @BeforeEach
     public void setup() {
         ClientBase.setupTestEnv();
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
@@ -92,17 +92,16 @@ public void testBackupStatic() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false);
             // check that a dynamic configuration file doesn't exist
-            assertNull("static file backup shouldn't exist before bootup", mt[i].getFileByName("zoo.cfg.bak"));
+            assertNull(mt[i].getFileByName("zoo.cfg.bak"), "static file backup shouldn't exist before bootup");
             staticFileContent[i] = getFileContent(mt[i].confFile);
             mt[i].start();
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             File backupFile = mt[i].getFileByName("zoo.cfg.bak");
-            assertNotNull("static file backup should exist", backupFile);
+            assertNotNull(backupFile, "static file backup should exist");
             staticBackupContent[i] = getFileContent(backupFile);
             assertEquals(staticFileContent[i], staticBackupContent[i]);
         }
@@ -162,9 +161,8 @@ public void testReconfigCreateNewVersionFile() throws Exception {
 
         // test old cluster
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             zkAdmin[i] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
             zkAdmin[i].addAuthInfo("digest", "super:test".getBytes());
@@ -199,9 +197,8 @@ public void testReconfigCreateNewVersionFile() throws Exception {
 
         // wait for new servers to be up running
         for (int i = SERVER_COUNT; i < NEW_SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
         }
 
@@ -297,9 +294,8 @@ public void testVersionOfDynamicFilename() throws Exception {
         String dynamicFileContent = null;
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
 
             // we should see that now all servers have the same config of 5 servers
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java
index ee51baf955e..15695c3b3bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java
@@ -19,14 +19,12 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.Map;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
@@ -39,17 +37,14 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class ReconfigDuringLeaderSyncTest extends QuorumPeerTestBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(ReconfigDuringLeaderSyncTest.class);
@@ -57,30 +52,18 @@ public class ReconfigDuringLeaderSyncTest extends QuorumPeerTestBase {
     private MainThread[] mt;
     private static boolean bakAsyncSending;
 
-    private boolean asyncSending;
-
-    public ReconfigDuringLeaderSyncTest(boolean asyncSending) {
-        this.asyncSending = asyncSending;
-    }
-
-    @Parameterized.Parameters
-    public static Collection sendingModes() {
-        return Arrays.asList(new Object[][]{{true}, {false}});
-    }
-
-    @Before
-    public void setup() {
+    public void setup(boolean asyncSending) {
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
         Learner.setAsyncSending(asyncSending);
         QuorumPeerConfig.setReconfigEnabled(true);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void saveAsyncSendingFlag() {
         bakAsyncSending = Learner.getAsyncSending();
     }
 
-    @AfterClass
+    @AfterAll
     public static void resetAsyncSendingFlag() {
         Learner.setAsyncSending(bakAsyncSending);
     }
@@ -97,8 +80,10 @@ public static void resetAsyncSendingFlag() {
      * deleted.
      */
 
-    @Test
-    public void testDuringLeaderSync() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testDuringLeaderSync(boolean asyncSending) throws Exception {
+        setup(asyncSending);
         final int[] clientPorts = new int[SERVER_COUNT + 1];
         StringBuilder sb = new StringBuilder();
         String[] serverConfig = new String[SERVER_COUNT + 1];
@@ -120,9 +105,8 @@ public void testDuringLeaderSync() throws Exception {
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
         CountdownWatcher watch = new CountdownWatcher();
         ZooKeeperAdmin preReconfigClient = new ZooKeeperAdmin(
@@ -196,13 +180,12 @@ public TestQPMain getTestQPMain() {
         watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         // do one successful operation on the newly added node
         postReconfigClient.create("/reconfigIssue", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        assertFalse("zoo.cfg.dynamic.next is not deleted.", nextDynaFile.exists());
+        assertFalse(nextDynaFile.exists(), "zoo.cfg.dynamic.next is not deleted.");
 
         // verify that joiner has up-to-date config, including all four servers.
         for (long j = 0; j <= SERVER_COUNT; j++) {
-            assertNotNull(
-                "server " + j + " is not present in the new quorum",
-                qp.getQuorumVerifier().getVotingMembers().get(j));
+            assertNotNull(qp.getQuorumVerifier().getVotingMembers().get(j),
+                    "server " + j + " is not present in the new quorum");
         }
 
         // close clients
@@ -225,7 +208,7 @@ private static CustomQuorumPeer getCustomQuorumPeer(MainThread mt) {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all severs
         if (null != mt) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
index a10e9c7abfa..4fba09f848d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -34,21 +34,21 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ReconfigFailureCasesTest extends QuorumPeerTestBase {
 
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setup() {
         QuorumPeerConfig.setReconfigEnabled(true);
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (qu != null) {
             qu.tearDown();
@@ -203,9 +203,8 @@ public void testObserverToParticipantConversionFails() throws Exception {
         }
 
         for (int i = 1; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         try {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
index d6eba89a391..498b4b6c4ec 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -34,14 +34,15 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ReconfigLegacyTest extends QuorumPeerTestBase {
 
     private static final int SERVER_COUNT = 3;
 
-    @Before
+    @BeforeEach
     public void setup() {
         ClientBase.setupTestEnv();
         QuorumPeerConfig.setReconfigEnabled(true);
@@ -85,8 +86,8 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         // Check that the static config was split into static and dynamic files correctly.
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             File[] dynamicFiles = mt[i].getDynamicFiles();
 
@@ -123,8 +124,8 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         }
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             ReconfigTest.testServerHasConfig(zk[i], allServers, null);
         }
@@ -187,8 +188,8 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
         // port in static config file.
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             zkAdmin[i] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
             zkAdmin[i].addAuthInfo("digest", "super:test".getBytes());
@@ -244,7 +245,8 @@ public static Properties readPropertiesFromFile(File file) throws IOException {
      *
      * @throws Exception
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testRestartZooKeeperServer() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
@@ -253,7 +255,7 @@ public void testRestartZooKeeperServer() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                     + ":participant;127.0.0.1:" + clientPorts[i];
+                    + ":participant;127.0.0.1:" + clientPorts[i];
             sb.append(server + "\n");
         }
         String currentQuorumCfgSection = sb.toString();
@@ -266,9 +268,8 @@ public void testRestartZooKeeperServer() throws Exception {
 
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
 
         ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts[0]);
@@ -287,9 +288,8 @@ public void testRestartZooKeeperServer() throws Exception {
         mt[1].start();
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
         zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts[0]);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
index ee0fb4a03ab..746da1d85af 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.Set;
@@ -29,12 +29,12 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ReconfigRecoveryTest extends QuorumPeerTestBase {
 
-    @Before
+    @BeforeEach
     public void setup() {
         QuorumPeerConfig.setReconfigEnabled(true);
     }
@@ -84,11 +84,10 @@ public void testNextConfigCompletion() throws Exception {
             zk[i] = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
         }
 
-        assertTrue(
-            "waiting for server 0 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 1 being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[1], CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT),
+                "waiting for server 0 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[1], CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
 
         int leader = mt[0].main.quorumPeer.leader == null ? 1 : 0;
 
@@ -103,9 +102,8 @@ public void testNextConfigCompletion() throws Exception {
         mt[2].start();
         zk[2] = new ZooKeeper("127.0.0.1:" + clientPorts[2], ClientBase.CONNECTION_TIMEOUT, this);
 
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         ReconfigTest.testServerHasConfig(zk[0], allServers, null);
         ReconfigTest.testServerHasConfig(zk[1], allServers, null);
@@ -176,10 +174,8 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
         }
 
         for (int i = 0; i < 2; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + oldClientPorts[i], CONNECTION_TIMEOUT
-                                                                                                                                       * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + oldClientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         ReconfigTest.testNormalOperation(zk[0], zk[1]);
@@ -191,10 +187,8 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
         }
 
         for (int i = 0; i < 2; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerDown(
-                    "127.0.0.1:"
-                            + oldClientPorts[i], CONNECTION_TIMEOUT
-                                                         * 2));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + oldClientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         for (int i = 0; i < 2; i++) {
@@ -211,9 +205,8 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
             ReconfigTest.testServerHasConfig(zk[i], allServersNext, null);
         }
 
@@ -275,9 +268,8 @@ public void testNextConfigUnreachable() throws Exception {
         // make sure servers 0, 1 don't come online - this should be the case
         // since they can't complete the reconfig
         for (int i = 0; i < 2; i++) {
-            assertFalse(
-                "server " + i + " is up but shouldn't be",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT / 10));
+            assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT / 10),
+                    "server " + i + " is up but shouldn't be");
         }
 
         for (int i = 0; i < 2; i++) {
@@ -324,9 +316,8 @@ public void testNextConfigAlreadyActive() throws Exception {
             zk[i] = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
         }
         for (int i = 2; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         ReconfigTest.testNormalOperation(zk[2], zk[3]);
@@ -346,9 +337,8 @@ public void testNextConfigAlreadyActive() throws Exception {
         // servers 0 and 1 should connect to all servers, including the one in
         // their .next file during startup, and will find the next config and join it
         for (int i = 0; i < 2; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         // make sure they joined the new config without any change to it
@@ -415,9 +405,8 @@ public void testObserverConvertedToParticipantDuringFLE() throws Exception {
         zk[3] = new ZooKeeper("127.0.0.1:" + ports[3][2], ClientBase.CONNECTION_TIMEOUT, this);
 
         for (int i = 2; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
             ReconfigTest.testServerHasConfig(zk[i], allServersNext, null);
         }
 
@@ -475,9 +464,8 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         ReconfigTest.testNormalOperation(zk[0], zk[2]);
 
         for (int i = 0; i <= 2; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         // shut servers 0..2 down
@@ -511,9 +499,8 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         zk[3] = new ZooKeeper("127.0.0.1:" + ports[3][2], ClientBase.CONNECTION_TIMEOUT, this);
 
         for (int i = 2; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 3));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 3),
+                    "waiting for server " + i + " being up");
             ReconfigTest.testServerHasConfig(zk[i], allServersNext, null);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
index 9522da7e534..62db39b413f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
@@ -36,7 +36,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * ReconfigRollingRestartCompatibilityTest - we want to make sure that users
@@ -88,9 +89,11 @@ private String updateExistingQuorumConfig(List<Integer> sidsToAdd, List<Integer>
         return sb.toString();
     }
 
-    @Test(timeout = 60000)
+
     // Verify no zoo.cfg.dynamic and zoo.cfg.bak files existing locally
     // when reconfig feature flag is off by default.
+    @Test
+    @Timeout(value = 60)
     public void testNoLocalDynamicConfigAndBackupFiles() throws InterruptedException, IOException {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
@@ -103,11 +106,11 @@ public void testNoLocalDynamicConfigAndBackupFiles() throws InterruptedException
         }
 
         for (int i = 0; i < serverCount; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
-            assertNull("static file backup (zoo.cfg.bak) shouldn't exist!", mt[i].getFileByName(ZOO_CFG_BAK_FILE));
-            assertNull("dynamic configuration file (zoo.cfg.dynamic.*) shouldn't exist!", mt[i].getFileByName(mt[i].getQuorumPeer().getNextDynamicConfigFilename()));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
+            assertNull(mt[i].getFileByName(ZOO_CFG_BAK_FILE), "static file backup (zoo.cfg.bak) shouldn't exist!");
+            assertNull(mt[i].getFileByName(mt[i].getQuorumPeer().getNextDynamicConfigFilename()), "dynamic configuration file (zoo.cfg.dynamic.*) shouldn't exist!");
             staticFileContent[i] = Files.readAllLines(mt[i].confFile.toPath(), StandardCharsets.UTF_8).toString();
-            assertTrue("static config file should contain server entry " + serverAddress.get(i), staticFileContent[i].contains(serverAddress.get(i)));
+            assertTrue(staticFileContent[i].contains(serverAddress.get(i)), "static config file should contain server entry " + serverAddress.get(i));
         }
 
         for (int i = 0; i < serverCount; i++) {
@@ -115,11 +118,12 @@ public void testNoLocalDynamicConfigAndBackupFiles() throws InterruptedException
         }
     }
 
-    @Test(timeout = 60000)
     // This test simulate the usual rolling restart with no membership change:
     // 1. A node is shutdown first (e.g. to upgrade software, or hardware, or cleanup local data.).
     // 2. After upgrade, start the node.
     // 3. Do this for every node, one at a time.
+    @Test
+    @Timeout(value = 60)
     public void testRollingRestartWithoutMembershipChange() throws Exception {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
@@ -132,7 +136,7 @@ public void testRollingRestartWithoutMembershipChange() throws Exception {
         }
 
         for (int i = 0; i < serverCount; ++i) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
 
         for (int i = 0; i < serverCount; ++i) {
@@ -147,11 +151,12 @@ public void testRollingRestartWithoutMembershipChange() throws Exception {
         }
     }
 
-    @Test(timeout = 90000)
     // This test simulate the use case of change of membership by starting new servers
     // without dynamic reconfig. For a 3 node ensemble we expand it to a 5 node ensemble, verify
     // during the process each node has the expected configuration setting pushed
     // via updating local zoo.cfg file.
+    @Test
+    @Timeout(value = 90)
     public void testExtendingQuorumWithNewMembers() throws Exception {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
@@ -164,7 +169,7 @@ public void testExtendingQuorumWithNewMembers() throws Exception {
         }
 
         for (int i = 0; i < serverCount; ++i) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
 
         for (int i = 0; i < serverCount; ++i) {
@@ -178,7 +183,7 @@ public void testExtendingQuorumWithNewMembers() throws Exception {
         newServers.add(serverAddress.get(3));
         newServers.add(serverAddress.get(4));
         serverCount = serverAddress.size();
-        assertEquals("Server count should be 5 after config update.", serverCount, 5);
+        assertEquals(serverCount, 5, "Server count should be 5 after config update.");
 
         // We are adding two new servers to the ensemble. These two servers should have the config which includes
         // all five servers (the old three servers, plus the two servers added). The old three servers should only
@@ -188,7 +193,7 @@ public void testExtendingQuorumWithNewMembers() throws Exception {
         for (int i = 3; i < 5; ++i) {
             mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
             mt[i].start();
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
             verifyQuorumConfig(i, newServers, null);
             verifyQuorumMembers(mt[i]);
         }
@@ -224,7 +229,7 @@ public void testRollingRestartWithExtendedMembershipConfig() throws Exception {
             joiningServers.add(serverAddress.get(i));
         }
         for (int i = 0; i < serverCount; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
         for (int i = 0; i < serverCount; i++) {
             verifyQuorumConfig(i, joiningServers, null);
@@ -236,13 +241,13 @@ public void testRollingRestartWithExtendedMembershipConfig() throws Exception {
         config = updateExistingQuorumConfig(Arrays.asList(3), new ArrayList<>());
         newServers.add(serverAddress.get(3));
         serverCount = serverAddress.size();
-        assertEquals("Server count should be 4 after config update.", serverCount, 4);
+        assertEquals(serverCount, 4, "Server count should be 4 after config update.");
 
         // We are adding one new server to the ensemble. The new server should be started with the new config
         mt = Arrays.copyOf(mt, mt.length + 1);
         mt[3] = new QuorumPeerTestBase.MainThread(3, clientPorts.get(3), config, false);
         mt[3].start();
-        assertTrue("waiting for server 3 being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT), "waiting for server 3 being up");
         verifyQuorumConfig(3, newServers, null);
         verifyQuorumMembers(mt[3]);
 
@@ -250,12 +255,12 @@ public void testRollingRestartWithExtendedMembershipConfig() throws Exception {
         for (int i = 0; i < 3; i++) {
             mt[i].shutdown();
 
-            assertTrue(String.format("Timeout during waiting for server %d to go down", i),
-                       ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", i));
 
             mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
             mt[i].start();
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
             verifyQuorumConfig(i, newServers, null);
             verifyQuorumMembers(mt[i]);
         }
@@ -287,7 +292,7 @@ public void testRollingRestartWithHostAddedAndRemoved() throws Exception {
             originalServers.add(serverAddress.get(i));
         }
         for (int i = 0; i < serverCount; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
         for (int i = 0; i < serverCount; i++) {
             verifyQuorumConfig(i, originalServers, null);
@@ -296,22 +301,22 @@ public void testRollingRestartWithHostAddedAndRemoved() throws Exception {
 
         // we are stopping the third server (myid=2)
         mt[2].shutdown();
-        assertTrue(String.format("Timeout during waiting for server %d to go down", 2),
-                   ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(2), ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(2), ClientBase.CONNECTION_TIMEOUT),
+                String.format("Timeout during waiting for server %d to go down", 2));
         String leavingServer = originalServers.get(2);
 
         // Create updated config with the first 2 existing members, but we remove 3rd and add one with different myid
         config = updateExistingQuorumConfig(Arrays.asList(3), Arrays.asList(2));
         List<String> newServers = new ArrayList<>(serverAddress.values());
         serverCount = serverAddress.size();
-        assertEquals("Server count should be 3 after config update.", serverCount, 3);
+        assertEquals(serverCount, 3, "Server count should be 3 after config update.");
 
 
         // We are adding one new server to the ensemble. The new server should be started with the new config
         mt = Arrays.copyOf(mt, mt.length + 1);
         mt[3] = new QuorumPeerTestBase.MainThread(3, clientPorts.get(3), config, false);
         mt[3].start();
-        assertTrue("waiting for server 3 being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT), "waiting for server 3 being up");
         verifyQuorumConfig(3, newServers, Arrays.asList(leavingServer));
         verifyQuorumMembers(mt[3]);
 
@@ -319,12 +324,12 @@ public void testRollingRestartWithHostAddedAndRemoved() throws Exception {
         for (int i = 0; i < 2; i++) {
             mt[i].shutdown();
 
-            assertTrue(String.format("Timeout during waiting for server %d to go down", i),
-                       ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", i));
 
             mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
             mt[i].start();
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
             verifyQuorumConfig(i, newServers, null);
             verifyQuorumMembers(mt[i]);
         }
@@ -361,11 +366,11 @@ private void verifyQuorumMembers(QuorumPeerTestBase.MainThread mt) {
     private void verifyQuorumMembers(QuorumPeerTestBase.MainThread mt, Set<String> expectedConfigs) {
         Map<Long, QuorumPeer.QuorumServer> members = mt.getQuorumPeer().getQuorumVerifier().getAllMembers();
 
-        assertTrue("Quorum member should not change.", members.size() == expectedConfigs.size());
+        assertTrue(members.size() == expectedConfigs.size(), "Quorum member should not change.");
 
         for (QuorumPeer.QuorumServer qs : members.values()) {
             String actualConfig = qs.toString();
-            assertTrue("Unexpected config " + actualConfig + " found!", expectedConfigs.contains(actualConfig));
+            assertTrue(expectedConfigs.contains(actualConfig), "Unexpected config " + actualConfig + " found!");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
index 97aa763efdc..de145ea4f53 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
@@ -18,16 +18,16 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class RemotePeerBeanTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
index e89d5aee0c7..2131158d811 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -43,9 +43,9 @@
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -59,7 +59,7 @@ public class SessionUpgradeQuorumTest extends QuorumPeerTestBase {
     private int[] clientPorts;
     private TestQPMainDropSessionUpgrading[] qpMain;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         // setup the env with RetainDB and local session upgrading
@@ -91,11 +91,11 @@ public TestQPMain getTestQPMain() {
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         for (int i = 0; i < SERVER_COUNT; i++) {
@@ -161,15 +161,14 @@ public void testLocalSessionUpgradeSnapshot() throws IOException, InterruptedExc
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
 
         // check global session not exist on follower A
         for (int i = 0; i < SERVER_COUNT; i++) {
             ConcurrentHashMap<Long, Integer> sessions = mt[i].main.quorumPeer.getZkDb().getSessionWithTimeOuts();
-            assertFalse(
-                "server " + i + " should not have global " + "session " + sessionId,
-                sessions.containsKey(sessionId));
+            assertFalse(sessions.containsKey(sessionId),
+                    "server " + i + " should not have global " + "session " + sessionId);
         }
 
         zk.close();
@@ -189,8 +188,8 @@ public void testOnlyUpgradeSessionOnce() throws IOException, InterruptedExceptio
         Request create1 = createEphemeralRequest("/data-1", sessionId);
         Request create2 = createEphemeralRequest("/data-2", sessionId);
 
-        assertNotNull("failed to upgrade on a ephemeral create", server.checkUpgradeSession(create1));
-        assertNull("tried to upgrade again", server.checkUpgradeSession(create2));
+        assertNotNull(server.checkUpgradeSession(create1), "failed to upgrade on a ephemeral create");
+        assertNull(server.checkUpgradeSession(create2), "tried to upgrade again");
 
         // clean al the setups and close the zk
         zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
index 70fcab7bcd8..2cfec4d52dc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.KeeperException;
@@ -32,7 +32,8 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class StandaloneDisabledTest extends QuorumPeerTestBase {
 
@@ -53,23 +54,20 @@ public class StandaloneDisabledTest extends QuorumPeerTestBase {
      * Test normal quorum operations work cleanly
      * with just a single server.
      */
-    @Test(timeout = 600000)
+    @Test
+    @Timeout(value = 10, unit = TimeUnit.MINUTES)
     public void startSingleServerTest() throws Exception {
         setUpData();
 
         //start one server
         startServer(leaderId, serverStrings.get(leaderId) + "\n");
         ReconfigTest.testServerHasConfig(zkHandles[leaderId], null, null);
-        LOG.info(
-            "Initial Configuration:\n{}",
-            new String(zkHandles[leaderId].getConfig(this, new Stat())));
+        LOG.info("Initial Configuration:\n{}", new String(zkHandles[leaderId].getConfig(this, new Stat())));
 
         //start and add 2 followers
         startFollowers();
         testReconfig(leaderId, true, reconfigServers);
-        LOG.info(
-            "Configuration after adding 2 followers:\n{}",
-            new String(zkHandles[leaderId].getConfig(this, new Stat())));
+        LOG.info("Configuration after adding 2 followers:\n{}", new String(zkHandles[leaderId].getConfig(this, new Stat())));
 
         //shutdown leader- quorum should still exist
         shutDownServer(leaderId);
@@ -91,9 +89,7 @@ public void startSingleServerTest() throws Exception {
         reconfigServers.add(Integer.toString(leaderId));
         reconfigServers.add(Integer.toString(follower1));
         testReconfig(follower2, false, reconfigServers);
-        LOG.info(
-            "Configuration after removing leader and follower 1:\n{}",
-            new String(zkHandles[follower2].getConfig(this, new Stat())));
+        LOG.info("Configuration after removing leader and follower 1:\n{}", new String(zkHandles[follower2].getConfig(this, new Stat())));
 
         // Kill server 1 to avoid it interferences with FLE of the quorum {2, 3, 4}.
         shutDownServer(follower1);
@@ -116,9 +112,7 @@ public void startSingleServerTest() throws Exception {
         startObservers(observerStrings);
         testReconfig(follower2, true, reconfigServers); //add partcipants
         testReconfig(follower2, true, observerStrings); //change to observers
-        LOG.info(
-            "Configuration after adding two observers:\n{}",
-            new String(zkHandles[follower2].getConfig(this, new Stat())));
+        LOG.info("Configuration after adding two observers:\n{}", new String(zkHandles[follower2].getConfig(this, new Stat())));
 
         shutDownData();
     }
@@ -177,9 +171,9 @@ private void startServer(int id, String config) throws Exception {
         peers[id] = new MainThread(id, clientPorts[id], config);
         peers[id].start();
         assertTrue(
-            "Server " + id + " is not up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[id], CONNECTION_TIMEOUT));
-        assertTrue("Error- Server started in Standalone Mode!", peers[id].isQuorumPeerRunning());
+            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[id], CONNECTION_TIMEOUT),
+            "Server " + id + " is not up");
+        assertTrue(peers[id].isQuorumPeerRunning(), "Error- Server started in Standalone Mode!");
         zkHandles[id] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[id]);
         zkAdminHandles[id] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[id], CONNECTION_TIMEOUT, this);
         zkAdminHandles[id].addAuthInfo("digest", "super:test".getBytes());
@@ -264,8 +258,8 @@ public void startObserver() throws Exception {
         MainThread observer = new MainThread(observer1, clientPort, config);
         observer.start();
         assertFalse(
-            "Observer was able to start by itself!",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT));
+            ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+            "Observer was able to start by itself!");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java
index 7a46bac05e7..f5eb931f6dd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.hamcrest.CoreMatchers.containsString;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.PrintWriter;
@@ -32,8 +32,8 @@
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.command.FourLetterCommands;
 import org.apache.zookeeper.server.command.StatCommand;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class StatCommandTest {
 
@@ -41,7 +41,7 @@ public class StatCommandTest {
     private StatCommand statCommand;
     private ServerStats.Provider providerMock;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         outputWriter = new StringWriter();
         ServerCnxn serverCnxnMock = mock(ServerCnxn.class);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java
index 850c4d81f1a..48642e008bc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.server.command.AbstractFourLetterCommand.ZK_NOT_SERVING;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -30,8 +30,8 @@
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.command.StatResetCommand;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class StatResetCommandTest {
 
@@ -40,7 +40,7 @@ public class StatResetCommandTest {
     private ZooKeeperServer zks;
     private ServerStats serverStats;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         outputWriter = new StringWriter();
         ServerCnxn serverCnxnMock = mock(ServerCnxn.class);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
index c00362219ba..72bceafa371 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.mock;
@@ -37,8 +37,8 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SyncRequestProcessorMetricTest {
 
@@ -46,7 +46,7 @@ public class SyncRequestProcessorMetricTest {
     RequestProcessor nextProcessor;
     CountDownLatch allRequestsFlushed;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         ZKDatabase db = mock(ZKDatabase.class);
         when(db.append(any(Request.class))).thenReturn(true);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
index 94b0e01d0eb..3400a288301 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -29,8 +29,6 @@
 import java.net.Socket;
 import java.net.SocketOptions;
 import java.security.Security;
-import java.util.ArrayList;
-import java.util.Collection;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -46,13 +44,11 @@
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -61,23 +57,13 @@
  * trigger blocking mode detection. This is necessary to ensure that the
  * Leader's accept() thread doesn't get blocked.
  */
-@RunWith(Parameterized.class)
 public class UnifiedServerSocketModeDetectionTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(UnifiedServerSocketModeDetectionTest.class);
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        ArrayList<Object[]> result = new ArrayList<>();
-        result.add(new Object[]{true});
-        result.add(new Object[]{false});
-        return result;
-    }
-
     private static File tempDir;
     private static X509TestContext x509TestContext;
 
-    private boolean useSecureClient;
     private X509Util x509Util;
     private UnifiedServerSocket listeningSocket;
     private UnifiedServerSocket.UnifiedSocket serverSideSocket;
@@ -86,14 +72,14 @@ public static Collection<Object[]> params() {
     private int port;
     private InetSocketAddress localServerAddress;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpClass() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
         tempDir = ClientBase.createEmptyTestDir();
         x509TestContext = X509TestContext.newBuilder().setTempDir(tempDir).setKeyStoreKeyType(X509KeyType.EC).setTrustStoreKeyType(X509KeyType.EC).build();
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownClass() {
         try {
             FileUtils.deleteDirectory(tempDir);
@@ -123,12 +109,7 @@ private static void forceClose(ServerSocket s) {
         }
     }
 
-    public UnifiedServerSocketModeDetectionTest(Boolean useSecureClient) {
-        this.useSecureClient = useSecureClient;
-    }
-
-    @Before
-    public void setUp() throws Exception {
+    public void init(boolean useSecureClient) throws Exception {
         x509Util = new ClientX509Util();
         x509TestContext.setSystemProperties(x509Util, KeyStoreFileType.JKS, KeyStoreFileType.JKS);
         System.setProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty(), "100");
@@ -160,7 +141,7 @@ public UnifiedServerSocket.UnifiedSocket call() throws Exception {
         serverSideSocket = acceptFuture.get();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         x509TestContext.clearSystemProperties(x509Util);
         System.clearProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty());
@@ -172,62 +153,82 @@ public void tearDown() throws Exception {
         x509Util.close();
     }
 
-    @Test
-    public void testGetInetAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetInetAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getInetAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetLocalAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetLocalAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getLocalAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetPort() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetPort(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getPort();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetLocalPort() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetLocalPort(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getLocalPort();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetRemoteSocketAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetRemoteSocketAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getRemoteSocketAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetLocalSocketAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetLocalSocketAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getLocalSocketAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetInputStream() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetInputStream(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getInputStream();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetOutputStream() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetOutputStream(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getOutputStream();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetTcpNoDelay() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetTcpNoDelay(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getTcpNoDelay();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetTcpNoDelay() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetTcpNoDelay(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         boolean tcpNoDelay = serverSideSocket.getTcpNoDelay();
         tcpNoDelay = !tcpNoDelay;
         serverSideSocket.setTcpNoDelay(tcpNoDelay);
@@ -235,14 +236,18 @@ public void testSetTcpNoDelay() throws IOException {
         assertEquals(tcpNoDelay, serverSideSocket.getTcpNoDelay());
     }
 
-    @Test
-    public void testGetSoLinger() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetSoLinger(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getSoLinger();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetSoLinger() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetSoLinger(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         int soLinger = serverSideSocket.getSoLinger();
         if (soLinger == -1) {
             // enable it if disabled
@@ -257,14 +262,18 @@ public void testSetSoLinger() throws IOException {
         }
     }
 
-    @Test
-    public void testGetSoTimeout() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetSoTimeout(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getSoTimeout();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetSoTimeout() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetSoTimeout(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         int timeout = serverSideSocket.getSoTimeout();
         timeout = timeout + 10;
         serverSideSocket.setSoTimeout(timeout);
@@ -272,14 +281,18 @@ public void testSetSoTimeout() throws IOException {
         assertEquals(timeout, serverSideSocket.getSoTimeout());
     }
 
-    @Test
-    public void testGetSendBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetSendBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getSendBufferSize();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetSendBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetSendBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.setSendBufferSize(serverSideSocket.getSendBufferSize() + 1024);
         assertFalse(serverSideSocket.isModeKnown());
         // Note: the new buffer size is a hint and socket implementation
@@ -288,14 +301,18 @@ public void testSetSendBufferSize() throws IOException {
 
     }
 
-    @Test
-    public void testGetReceiveBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetReceiveBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getReceiveBufferSize();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetReceiveBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetReceiveBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.setReceiveBufferSize(serverSideSocket.getReceiveBufferSize() + 1024);
         assertFalse(serverSideSocket.isModeKnown());
         // Note: the new buffer size is a hint and socket implementation
@@ -304,14 +321,18 @@ public void testSetReceiveBufferSize() throws IOException {
 
     }
 
-    @Test
-    public void testGetKeepAlive() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetKeepAlive(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getKeepAlive();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetKeepAlive() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetKeepAlive(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         boolean keepAlive = serverSideSocket.getKeepAlive();
         keepAlive = !keepAlive;
         serverSideSocket.setKeepAlive(keepAlive);
@@ -319,14 +340,18 @@ public void testSetKeepAlive() throws IOException {
         assertEquals(keepAlive, serverSideSocket.getKeepAlive());
     }
 
-    @Test
-    public void testGetTrafficClass() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetTrafficClass(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getTrafficClass();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetTrafficClass() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetTrafficClass(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.setTrafficClass(SocketOptions.IP_TOS);
         assertFalse(serverSideSocket.isModeKnown());
         // Note: according to the Socket javadocs, setTrafficClass() may be
@@ -334,14 +359,18 @@ public void testSetTrafficClass() throws IOException {
         // we set is returned.
     }
 
-    @Test
-    public void testGetReuseAddress() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetReuseAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getReuseAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetReuseAddress() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetReuseAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         boolean reuseAddress = serverSideSocket.getReuseAddress();
         reuseAddress = !reuseAddress;
         serverSideSocket.setReuseAddress(reuseAddress);
@@ -349,52 +378,68 @@ public void testSetReuseAddress() throws IOException {
         assertEquals(reuseAddress, serverSideSocket.getReuseAddress());
     }
 
-    @Test
-    public void testClose() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testClose(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.close();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testShutdownInput() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testShutdownInput(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.shutdownInput();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testShutdownOutput() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testShutdownOutput(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.shutdownOutput();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsConnected() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsConnected(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isConnected();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsBound() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsBound(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isBound();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsClosed() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsClosed(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isClosed();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsInputShutdown() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsInputShutdown(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isInputShutdown();
         assertFalse(serverSideSocket.isModeKnown());
         serverSideSocket.shutdownInput();
         assertTrue(serverSideSocket.isInputShutdown());
     }
 
-    @Test
-    public void testIsOutputShutdown() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsOutputShutdown(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isOutputShutdown();
         assertFalse(serverSideSocket.isModeKnown());
         serverSideSocket.shutdownOutput();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java
index 7e4fa69ad2c..fa710f4658f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.net.ConnectException;
@@ -33,12 +33,12 @@
 import java.net.Socket;
 import java.net.SocketException;
 import java.util.ArrayList;
-import java.util.Collection;
 import java.util.List;
 import java.util.Random;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Stream;
 import javax.net.ssl.HandshakeCompletedEvent;
 import javax.net.ssl.HandshakeCompletedListener;
 import javax.net.ssl.SSLSocket;
@@ -50,27 +50,24 @@
 import org.apache.zookeeper.common.X509KeyType;
 import org.apache.zookeeper.common.X509TestContext;
 import org.apache.zookeeper.common.X509Util;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class UnifiedServerSocketTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        ArrayList<Object[]> result = new ArrayList<>();
+    public static Stream<Arguments> data() {
+        ArrayList<Arguments> result = new ArrayList<>();
         int paramIndex = 0;
         for (X509KeyType caKeyType : X509KeyType.values()) {
             for (X509KeyType certKeyType : X509KeyType.values()) {
                 for (Boolean hostnameVerification : new Boolean[]{true, false}) {
-                    result.add(new Object[]{caKeyType, certKeyType, hostnameVerification, paramIndex++});
+                    result.add(Arguments.of(caKeyType, certKeyType, hostnameVerification, paramIndex++));
                 }
             }
         }
-        return result;
+        return result.stream();
     }
 
     private static final int MAX_RETRIES = 5;
@@ -84,9 +81,9 @@ public static Collection<Object[]> params() {
     // access only inside synchronized(handshakeCompletedLock) { ... } blocks
     private boolean handshakeCompleted = false;
 
-    public UnifiedServerSocketTest(
+    public void init(
             final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex) {
-        super(paramIndex, () -> {
+        super.init(paramIndex, () -> {
             try {
                 return X509TestContext.newBuilder().setTempDir(tempDir).setKeyStoreKeyType(certKeyType).setTrustStoreKeyType(caKeyType).setHostnameVerification(hostnameVerification).build();
             } catch (Exception e) {
@@ -95,14 +92,13 @@ public UnifiedServerSocketTest(
         });
     }
 
-    @Before
     public void setUp() throws Exception {
         localServerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), PortAssignment.unique());
         x509Util = new ClientX509Util();
         x509TestContext.setSystemProperties(x509Util, KeyStoreFileType.JKS, KeyStoreFileType.JKS);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         x509TestContext.clearSystemProperties(x509Util);
         x509Util.close();
@@ -235,7 +231,7 @@ public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent)
             retries++;
         }
 
-        assertNotNull("Failed to connect to server with SSL", sslSocket);
+        assertNotNull(sslSocket, "Failed to connect to server with SSL");
         return sslSocket;
     }
 
@@ -256,7 +252,7 @@ private Socket connectWithoutSSL() throws IOException, InterruptedException {
             }
             retries++;
         }
-        assertNotNull("Failed to connect to server without SSL", socket);
+        assertNotNull(socket, "Failed to connect to server without SSL");
         return socket;
     }
 
@@ -268,8 +264,13 @@ private Socket connectWithoutSSL() throws IOException, InterruptedException {
     /**
      * Attempting to connect to a SSL-or-plaintext server with SSL should work.
      */
-    @Test
-    public void testConnectWithSSLToNonStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithSSLToNonStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -298,8 +299,13 @@ public void testConnectWithSSLToNonStrictServer() throws Exception {
     /**
      * Attempting to connect to a SSL-only server with SSL should work.
      */
-    @Test
-    public void testConnectWithSSLToStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithSSLToStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -329,8 +335,13 @@ public void testConnectWithSSLToStrictServer() throws Exception {
     /**
      * Attempting to connect to a SSL-or-plaintext server without SSL should work.
      */
-    @Test
-    public void testConnectWithoutSSLToNonStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithoutSSLToNonStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -355,8 +366,13 @@ public void testConnectWithoutSSLToNonStrictServer() throws Exception {
      * less than 5 bytes does not break the logic in the server's initial 5
      * byte read.
      */
-    @Test
-    public void testConnectWithoutSSLToNonStrictServerPartialWrite() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithoutSSLToNonStrictServerPartialWrite(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -384,8 +400,13 @@ public void testConnectWithoutSSLToNonStrictServerPartialWrite() throws Exceptio
     /**
      * Attempting to connect to a SSL-only server without SSL should fail.
      */
-    @Test
-    public void testConnectWithoutSSLToStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithoutSSLToStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -409,7 +430,7 @@ public void testConnectWithoutSSLToStrictServer() throws Exception {
 
             // independently of the client socket implementation details, we always make sure the
             // server didn't receive any data during the test
-            assertFalse("The strict server accepted connection without SSL.", serverThread.receivedAnyDataFromClient());
+            assertFalse(serverThread.receivedAnyDataFromClient(), "The strict server accepted connection without SSL.");
         }
         fail("Expected server to hang up the connection. Read from server succeeded unexpectedly.");
     }
@@ -425,8 +446,13 @@ public void testConnectWithoutSSLToStrictServer() throws Exception {
      * This version of the test uses a non-strict server socket (i.e. it
      * accepts both TLS and plaintext connections).
      */
-    @Test
-    public void testTLSDetectionNonBlockingNonStrictServerIdleClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingNonStrictServerIdleClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket badClientSocket = null;
         Socket clientSocket = null;
         Socket secureClientSocket = null;
@@ -476,8 +502,13 @@ public void testTLSDetectionNonBlockingNonStrictServerIdleClient() throws Except
      * Like the above test, but with a strict server socket (closes non-TLS
      * connections after seeing that there is no handshake).
      */
-    @Test
-    public void testTLSDetectionNonBlockingStrictServerIdleClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingStrictServerIdleClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket badClientSocket = null;
         Socket secureClientSocket = null;
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
@@ -512,8 +543,13 @@ public void testTLSDetectionNonBlockingStrictServerIdleClient() throws Exception
      * Similar to the tests above, but the bad client disconnects immediately
      * without sending any data.
      */
-    @Test
-    public void testTLSDetectionNonBlockingNonStrictServerDisconnectedClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingNonStrictServerDisconnectedClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket clientSocket = null;
         Socket secureClientSocket = null;
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
@@ -562,8 +598,13 @@ public void testTLSDetectionNonBlockingNonStrictServerDisconnectedClient() throw
      * Like the above test, but with a strict server socket (closes non-TLS
      * connections after seeing that there is no handshake).
      */
-    @Test
-    public void testTLSDetectionNonBlockingStrictServerDisconnectedClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingStrictServerDisconnectedClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket secureClientSocket = null;
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
         serverThread.start();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index 2455738e4b8..70f1844eac6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -36,8 +36,6 @@
 import java.nio.channels.Selector;
 import java.nio.channels.SocketChannel;
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.Random;
@@ -45,7 +43,6 @@
 import org.apache.jute.OutputArchive;
 import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.MockPacket;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
@@ -57,11 +54,9 @@
 import org.apache.zookeeper.server.NIOServerCnxnFactory;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 import org.slf4j.Logger;
@@ -70,36 +65,24 @@
 /**
  * Demonstrate ZOOKEEPER-1382 : Watches leak on expired session
  */
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class WatchLeakTest {
 
     protected static final Logger LOG = LoggerFactory.getLogger(WatchLeakTest.class);
 
     final long SESSION_ID = 0xBABEL;
 
-    private final boolean sessionTimedout;
-
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
 
-    public WatchLeakTest(boolean sessionTimedout) {
-        this.sessionTimedout = sessionTimedout;
-    }
-
-    @Parameters
-    public static Collection<Object[]> configs() {
-        return Arrays.asList(new Object[][]{{false}, {true}});
-    }
-
     /**
      * Check that if session has expired then no watch can be set
      */
 
-    @Test
-    public void testWatchesLeak() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testWatchesLeak(boolean sessionTimedout) throws Exception {
 
         NIOServerCnxnFactory serverCnxnFactory = mock(NIOServerCnxnFactory.class);
         final SelectionKey sk = new FakeSK();
@@ -153,11 +136,11 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
             if (sessionTimedout) {
                 // Session has not been re-validated !
                 LOG.info("session is not valid, watches = {}", watchCount);
-                assertEquals("Session is not valid so there should be no watches", 0, watchCount);
+                assertEquals(0, watchCount, "Session is not valid so there should be no watches");
             } else {
                 // Session has been re-validated
                 LOG.info("session is valid, watches = {}", watchCount);
-                assertEquals("Session is valid so the watch should be there", 1, watchCount);
+                assertEquals(1, watchCount, "Session is valid so the watch should be there");
             }
         } finally {
             if (fzks != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index b8630ae1319..3bdbcd908dc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -22,10 +22,10 @@
 import static org.apache.zookeeper.server.quorum.ZabUtils.createLeader;
 import static org.apache.zookeeper.server.quorum.ZabUtils.createMockLeader;
 import static org.apache.zookeeper.server.quorum.ZabUtils.createQuorumPeer;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
@@ -67,8 +67,8 @@
 import org.apache.zookeeper.txn.ErrorTxn;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -78,7 +78,7 @@ public class Zab1_0Test extends ZKTestCase {
 
     private static final File testData = new File(System.getProperty("test.data.dir", "src/test/resources/data"));
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
@@ -163,7 +163,7 @@ public void testLeaderInConnectingFollowers() throws Exception {
             // accepted epoch = 5 it should now have 6
             try {
                 long epoch = leader.getEpochToPropose(leader.self.getId(), leader.self.getAcceptedEpoch());
-                assertEquals("leader got wrong epoch from getEpochToPropose", 6, epoch);
+                assertEquals(6, epoch, "leader got wrong epoch from getEpochToPropose");
             } catch (Exception e) {
                 fail("leader timed out in getEpochToPropose");
             }
@@ -210,7 +210,7 @@ public void testLastAcceptedEpoch() throws Exception {
 
             try {
                 long epoch = leader.getEpochToPropose(1, 6);
-                assertEquals("New proposed epoch is wrong", 7, epoch);
+                assertEquals(7, epoch, "New proposed epoch is wrong");
             } catch (Exception e) {
                 fail("Timed out in getEpochToPropose");
             }
@@ -253,8 +253,8 @@ public void testLeaderInElectingFollowers() throws Exception {
             f2.join(leader.self.getInitLimit() * leader.self.getTickTime() + 5000);
 
             // make sure that they timed out and didn't return normally
-            assertTrue(f1.msg + " without waiting for leader", f1.msg == null);
-            assertTrue(f2.msg + " without waiting for leader", f2.msg == null);
+            assertTrue(f1.msg == null, f1.msg + " without waiting for leader");
+            assertTrue(f2.msg == null, f2.msg + " without waiting for leader");
         } finally {
             if (leader != null) {
                 leader.shutdown("end of test");
@@ -1229,6 +1229,6 @@ private void assertCurrentEpochGotUpdated(int expected, QuorumPeer self, long ti
             }
             elapsedTime = elapsedTime + waitInterval;
         }
-        assertEquals("CurrentEpoch update failed", expected, self.getCurrentEpoch());
+        assertEquals(expected, self.getCurrentEpoch(), "CurrentEpoch update failed");
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
index cc6af7be5fe..aa1b43400ce 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.Properties;
 import org.apache.commons.io.FileUtils;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 
 /*
  * This code is originally from HDFS, see the similarly named file there
@@ -51,12 +51,12 @@ public class KerberosSecurityTestcase extends QuorumAuthTestBase {
     private static File workDir;
     private static Properties conf;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpSasl() throws Exception {
         startMiniKdc();
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownSasl() throws Exception {
         stopMiniKdc();
         FileUtils.deleteQuietly(workDir);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
index 659551558dc..4ba6edcefaa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
 import java.io.File;
 import java.security.Principal;
 import java.util.Arrays;
@@ -35,7 +35,8 @@
 import javax.security.auth.login.LoginContext;
 import org.apache.kerby.kerberos.kerb.keytab.Keytab;
 import org.apache.kerby.kerberos.kerb.type.base.PrincipalName;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /*
  * This code is originally from HDFS, see the file name TestMiniKdc there
@@ -48,13 +49,15 @@ public class MiniKdcTest extends KerberosSecurityTestcase {
 
     private static final boolean IBM_JAVA = System.getProperty("java.vendor").contains("IBM");
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testMiniKdcStart() {
         MiniKdc kdc = getKdc();
         assertNotSame(0, kdc.getPort());
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testKeytabGen() throws Exception {
         MiniKdc kdc = getKdc();
         File workDir = getWorkDir();
@@ -67,8 +70,7 @@ public void testKeytabGen() throws Exception {
             principals.add(principalName.getName());
         }
 
-        assertEquals(
-            new HashSet<>(Arrays.asList("foo/bar@" + kdc.getRealm(), "bar/foo@" + kdc.getRealm())),
+        assertEquals(new HashSet<>(Arrays.asList("foo/bar@" + kdc.getRealm(), "bar/foo@" + kdc.getRealm())),
             principals);
     }
 
@@ -126,7 +128,8 @@ public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
 
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testKerberosLogin() throws Exception {
         MiniKdc kdc = getKdc();
         File workDir = getWorkDir();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
index d365c9a97d5..67c5d70dc6a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -32,7 +32,7 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
+import org.junit.jupiter.api.AfterEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -71,7 +71,7 @@ public static void cleanupJaasConfig() {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
     }
@@ -96,8 +96,8 @@ protected String startQuorum(
         final int[] clientPorts = startQuorum(serverCount, connectStr, authConfigs, authServerCount, multiAddress);
         for (int i = 0; i < serverCount; i++) {
             assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
         return connectStr.toString();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
index ecdfaeb469a..46d65c9a4f4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
@@ -32,9 +32,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
 import org.apache.zookeeper.test.ClientTest;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * Rolling upgrade should do in three steps:
@@ -66,14 +67,14 @@ public class QuorumAuthUpgradeTest extends QuorumAuthTestBase {
         setupJaasConfig(jaasEntries);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         shutdownAll();
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         cleanupJaasConfig();
     }
@@ -83,7 +84,8 @@ public static void cleanup() {
      * peer0 -&gt; quorum.auth.enableSasl=false
      * peer1 -&gt; quorum.auth.enableSasl=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testNullAuthLearnerServer() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
@@ -101,7 +103,8 @@ public void testNullAuthLearnerServer() throws Exception {
      * peer0 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      * peer1 -&gt; quorum.auth.enableSasl=false, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testAuthLearnerAgainstNullAuthServer() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
@@ -119,7 +122,8 @@ public void testAuthLearnerAgainstNullAuthServer() throws Exception {
      * peer0 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      * peer1 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testAuthLearnerAgainstNoAuthRequiredServer() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
@@ -137,7 +141,8 @@ public void testAuthLearnerAgainstNoAuthRequiredServer() throws Exception {
      * peer0 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true, quorum.auth.serverRequireSasl=true
      * peer1 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true, quorum.auth.serverRequireSasl=true
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testAuthLearnerServer() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
@@ -167,7 +172,8 @@ public void testAuthLearnerServer() throws Exception {
      * quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true and quorum.auth.serverRequireSasl=true
      * Now, all the servers are fully upgraded and running in secured mode.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testRollingUpgrade() throws Exception {
         // Start peer0,1,2 servers with quorum.auth.enableSasl=false and
         // quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
@@ -214,9 +220,8 @@ public void testRollingUpgrade() throws Exception {
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
         MainThread m = shutdown(2);
         startServer(m, authConfigs);
-        assertFalse(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), 5000));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), 5000),
+            "waiting for server 2 being up");
     }
 
     private void restartServer(
@@ -224,14 +229,13 @@ private void restartServer(
         int index,
         ZooKeeper zk,
         CountdownWatcher watcher) throws IOException, KeeperException, InterruptedException, TimeoutException {
-        LOG.info("Restarting server myid={}", index);
-        MainThread m = shutdown(index);
-        startServer(m, authConfigs);
-        assertTrue(
-            "waiting for server" + index + "being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), ClientBase.CONNECTION_TIMEOUT));
-        watcher.waitForConnected(ClientTest.CONNECTION_TIMEOUT);
-        zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
+            LOG.info("Restarting server myid={}", index);
+            MainThread m = shutdown(index);
+            startServer(m, authConfigs);
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server" + index + "being up");
+            watcher.waitForConnected(ClientTest.CONNECTION_TIMEOUT);
+            zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
index cb28389efab..b1b1dedf65e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
@@ -34,9 +34,10 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class QuorumDigestAuthTest extends QuorumAuthTestBase {
 
@@ -59,7 +60,7 @@ public class QuorumDigestAuthTest extends QuorumAuthTestBase {
         setupJaasConfig(jaasEntries);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         for (MainThread mainThread : mt) {
@@ -69,7 +70,7 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         cleanupJaasConfig();
     }
@@ -77,7 +78,8 @@ public static void cleanup() {
     /**
      * Test to verify that server is able to start with valid credentials
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testValidCredentials() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
@@ -98,7 +100,8 @@ public void testValidCredentials() throws Exception {
      * Test to verify that server is able to start with valid credentials
      * when using multiple Quorum / Election addresses
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
@@ -120,7 +123,8 @@ public void testValidCredentialsWithMultiAddresses() throws Exception {
      * the configuration is set to quorum.auth.serverRequireSasl=false.
      * Quorum will talk each other even if the authentication is not succeeded
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSaslNotRequiredWithInvalidCredentials() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerInvalid");
@@ -141,7 +145,8 @@ public void testSaslNotRequiredWithInvalidCredentials() throws Exception {
      * if the configuration is set to quorum.auth.serverRequireSasl=true,
      * quorum.auth.learnerRequireSasl=true
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSaslRequiredInvalidCredentials() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerInvalid");
@@ -152,7 +157,7 @@ public void testSaslRequiredInvalidCredentials() throws Exception {
         final int[] clientPorts = startQuorum(serverCount, new StringBuilder(), authConfigs, serverCount, false);
         for (int i = 0; i < serverCount; i++) {
             boolean waitForServerUp = ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], QuorumPeerTestBase.TIMEOUT);
-            assertFalse("Shouldn't start server with invalid credentials", waitForServerUp);
+            assertFalse(waitForServerUp, "Shouldn't start server with invalid credentials");
         }
     }
 
@@ -161,7 +166,8 @@ public void testSaslRequiredInvalidCredentials() throws Exception {
      * quorum. So this test is ensuring that the quorumpeer learner is also auth
      * enabled while enabling quorum server require sasl.
      */
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testEnableQuorumServerRequireSaslWithoutQuorumLearnerRequireSasl() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearner");
@@ -189,7 +195,8 @@ protected void initializeAndRun(String[] args) throws ConfigException, IOExcepti
      * quorum. So this test is ensuring that the quorumpeer learner is also auth
      * enabled while enabling quorum server require sasl.
      */
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testEnableQuorumAuthenticationConfigurations() throws Exception {
         Map<String, String> authConfigs = new HashMap<String, String>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearner");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
index 28b93c7b487..d9a32a7559b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
@@ -29,10 +29,11 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
 
@@ -76,7 +77,7 @@ public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
         setupJaasConfig(jaasEntries);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() throws Exception {
         // create keytab
         keytabFile = new File(KerberosTestUtils.getKeytabFile());
@@ -87,7 +88,7 @@ public static void setUp() throws Exception {
         getKdc().createPrincipal(keytabFile, learnerPrincipal, serverPrincipal);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         for (MainThread mainThread : mt) {
@@ -97,7 +98,7 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         if (keytabFile != null) {
             FileUtils.deleteQuietly(keytabFile);
@@ -108,7 +109,8 @@ public static void cleanup() {
     /**
      * Test to verify that server is able to start with valid credentials
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentials() throws Exception {
         String serverPrincipal = KerberosTestUtils.getServerPrincipal();
         serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
@@ -131,7 +133,8 @@ public void testValidCredentials() throws Exception {
      * Test to verify that server is able to start with valid credentials
      * when using multiple Quorum / Election addresses
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         String serverPrincipal = KerberosTestUtils.getServerPrincipal();
         serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
index c9b93c57bde..f02da0b205b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.HashMap;
 import java.util.Map;
@@ -32,10 +32,11 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class QuorumKerberosHostBasedAuthTest extends KerberosSecurityTestcase {
 
@@ -96,7 +97,7 @@ private static void setupJaasConfigEntries(
         setupJaasConfig(jaasEntries);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() throws Exception {
         // create keytab
         keytabFile = new File(KerberosTestUtils.getKeytabFile());
@@ -112,7 +113,7 @@ public static void setUp() throws Exception {
         getKdc().createPrincipal(keytabFile, learnerPrincipal, learnerPrincipal2, serverPrincipal);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         for (MainThread mainThread : mt) {
@@ -122,7 +123,7 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         if (keytabFile != null) {
             FileUtils.deleteQuietly(keytabFile);
@@ -133,7 +134,8 @@ public static void cleanup() {
     /**
      * Test to verify that server is able to start with valid credentials
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentials() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
         Map<String, String> authConfigs = new HashMap<String, String>();
@@ -155,7 +157,8 @@ public void testValidCredentials() throws Exception {
      * Test to verify that server is able to start with valid credentials
      * when using multiple Quorum / Election addresses
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
         Map<String, String> authConfigs = new HashMap<String, String>();
@@ -176,7 +179,8 @@ public void testValidCredentialsWithMultiAddresses() throws Exception {
     /**
      * Test to verify that the bad server connection to the quorum should be rejected.
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testConnectBadServer() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
         Map<String, String> authConfigs = new HashMap<String, String>();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
index 671d484647b..9a1a0cad515 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Random;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class AdHashTest extends ZKTestCase {
 
@@ -78,16 +78,16 @@ public void testAdHash() throws Exception {
         addListOfDigests(hashall, bucket3);
         addListOfDigests(hashall, bucket4);
         addListOfDigests(hashall, bucket5);
-        assertFalse("digest of different set not different", hashall.equals(hash21));
+        assertFalse(hashall.equals(hash21), "digest of different set not different");
         removeListOfDigests(hashall, bucket4);
         removeListOfDigests(hashall, bucket5);
         addListOfDigests(hash21, bucket3);
-        assertEquals("hashall with 4 & 5 removed should match hash21 with 3 added", hashall, hash21);
+        assertEquals(hashall, hash21, "hashall with 4 & 5 removed should match hash21 with 3 added");
 
         removeListOfDigests(hashall, bucket3);
         removeListOfDigests(hashall, bucket2);
         removeListOfDigests(hashall, bucket1);
-        assertEquals("empty hashall's digest should be 0", hashall.toString(), "0");
+        assertEquals(hashall.toString(), "0", "empty hashall's digest should be 0");
 
         AdHash hash45 = new AdHash();
         addListOfDigests(hash45, bucket4);
@@ -95,7 +95,7 @@ public void testAdHash() throws Exception {
 
         addListOfDigests(hashall, bucket4);
         addListOfDigests(hashall, bucket5);
-        assertEquals("empty hashall + 4&5 should equal hash45", hashall, hash45);
+        assertEquals(hashall, hash45, "empty hashall + 4&5 should equal hash45");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java
index 801a76944ec..8dcacf58883 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java
@@ -17,17 +17,17 @@
  */
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class AuthUtilTest {
 
-    @BeforeClass
+    @BeforeAll
     public static void beforeClassSetUp() {
         ProviderRegistry.reset();
         System.setProperty("zookeeper.authProvider.sasl",
@@ -36,7 +36,7 @@ public static void beforeClassSetUp() {
                 "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
     }
 
-    @AfterClass
+    @AfterAll
     public static void afterClassTearDown() {
         System.clearProperty("zookeeper.authProvider.sasl");
         System.clearProperty("zookeeper.authProvider.x509");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
index ff67c4e6639..5a2a5b79b58 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
@@ -17,14 +17,14 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class BitHashSetTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
index 799a7866248..8c1922f353f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
@@ -17,12 +17,12 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class BitMapTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java
index ff3c83c4239..bf33dc74bfc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java
@@ -18,8 +18,12 @@
 
 package org.apache.zookeeper.server.util;
 
-import org.junit.Assert;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import org.junit.jupiter.api.Test;
 
 public class CircularBufferTest {
 
@@ -28,109 +32,109 @@ public void testCircularBuffer() {
         final int capacity = 3;
         CircularBuffer<String> buffer = new CircularBuffer<>(String.class, capacity);
 
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("A");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("B");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("C");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer is full.
         // Read from buffer
-        Assert.assertEquals("A", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("A", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("B", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("B", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("C", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("C", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("1");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("2");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("3");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("4"); // 4 overwrites 1
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer if full
         // Read from buffer
-        Assert.assertEquals("2", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("2", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("3", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("3", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("4", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("4", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("a");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("b");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("c");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("d"); // d overwrites a
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("e"); // e overwrites b
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("f"); // f overwrites c
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("g"); // g overwrites d
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer is full.
         // Read from buffer
-        Assert.assertEquals("e", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("e", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("f", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("f", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("g", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("g", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
     }
 
     @Test
@@ -138,23 +142,23 @@ public void testCircularBufferWithCapacity1() {
         final int capacity = 1;
         CircularBuffer<String> buffer = new CircularBuffer<>(String.class, capacity);
 
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("A");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("B"); // B overwrite A
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer is full.
         // Read from buffer
-        Assert.assertEquals("B", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("B", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
     }
 
     @Test
@@ -162,37 +166,37 @@ public void testCircularBufferReset() {
         final int capacity = 3;
         CircularBuffer<String> buffer = new CircularBuffer<>(String.class, capacity);
 
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("A");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
-        Assert.assertEquals(1, buffer.size());
-        Assert.assertEquals("A", buffer.peek());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
+        assertEquals(1, buffer.size());
+        assertEquals("A", buffer.peek());
 
         buffer.write("B");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
-        Assert.assertEquals(2, buffer.size());
-        Assert.assertEquals("A", buffer.peek());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
+        assertEquals(2, buffer.size());
+        assertEquals("A", buffer.peek());
 
         // reset
         buffer.reset();
-        Assert.assertNull(buffer.peek());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
-        Assert.assertEquals(0, buffer.size());
+        assertNull(buffer.peek());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
+        assertEquals(0, buffer.size());
     }
 
     @Test
     public void testCircularBufferIllegalCapacity() {
         try {
             CircularBuffer<String> buffer = new CircularBuffer<>(String.class, 0);
-            Assert.fail();
+            fail();
         } catch (IllegalArgumentException e) {
-            Assert.assertEquals("CircularBuffer capacity should be greater than 0", e.getMessage());
+            assertEquals("CircularBuffer capacity should be greater than 0", e.getMessage());
         }
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
index ba68b229ec0..4b293a09aef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
@@ -18,9 +18,10 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ConfigUtilsTest {
 
@@ -48,14 +49,18 @@ public void testGetHostAndPortWithIPv4() throws ConfigException {
         assertEquals(nsa[2], "3888");
     }
 
-    @Test(expected = ConfigException.class)
-    public void testGetHostAndPortWithoutBracket() throws ConfigException {
-        String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:85a3:8d3:1319:8a2e:370:7348");
+    @Test
+    public void testGetHostAndPortWithoutBracket() {
+        assertThrows(ConfigException.class, () -> {
+            String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:85a3:8d3:1319:8a2e:370:7348");
+        });
     }
 
-    @Test(expected = ConfigException.class)
-    public void testGetHostAndPortWithoutPortAfterColon() throws ConfigException {
-        String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:1::242:ac11:2]:");
+    @Test
+    public void testGetHostAndPortWithoutPortAfterColon() {
+        assertThrows(ConfigException.class, () -> {
+            String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:1::242:ac11:2]:");
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java
index 58b1902a2b2..ab6666387af 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java
@@ -18,12 +18,13 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class JvmPauseMonitorTest {
 
@@ -32,7 +33,8 @@ public class JvmPauseMonitorTest {
     private final Long warnTH = -1L;
     private JvmPauseMonitor pauseMonitor;
 
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void testJvmPauseMonitorExceedInfoThreshold() throws InterruptedException {
         QuorumPeerConfig qpConfig = mock(QuorumPeerConfig.class);
         when(qpConfig.getJvmPauseSleepTimeMs()).thenReturn(sleepTime);
@@ -49,7 +51,8 @@ public void testJvmPauseMonitorExceedInfoThreshold() throws InterruptedException
         }
     }
 
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void testJvmPauseMonitorExceedWarnThreshold() throws InterruptedException {
         QuorumPeerConfig qpConfig = mock(QuorumPeerConfig.class);
         when(qpConfig.getJvmPauseSleepTimeMs()).thenReturn(sleepTime);
@@ -64,10 +67,9 @@ public void testJvmPauseMonitorExceedWarnThreshold() throws InterruptedException
         while (pauseMonitor.getNumGcWarnThresholdExceeded() == 0) {
             Thread.sleep(200);
         }
-
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         pauseMonitor.serviceStop();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java
index f1cef10b4f0..d400cf993c9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.server.util;
 
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -29,12 +30,12 @@ public class MessageTrackerTest {
     private static final int BUFFERED_MESSAGE_SIZE = 5;
     private static final Logger LOG = LoggerFactory.getLogger(MessageTrackerTest.class);
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(MessageTracker.MESSAGE_TRACKER_ENABLED, "true");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(MessageTracker.MESSAGE_TRACKER_ENABLED);
     }
@@ -46,14 +47,14 @@ public void testTrackSend() throws InterruptedException {
 
         // First timestamp is added
         messageTracker.trackSent(timestamp1);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
 
         Thread.sleep(2);
 
         // Second timestamp is added
         long timestamp2 = System.currentTimeMillis();
         messageTracker.trackSent(timestamp2);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
     }
 
     @Test
@@ -63,14 +64,14 @@ public void testTrackReceived() throws InterruptedException {
 
         // First timestamp is added
         messageTracker.trackReceived(timestamp1);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
 
         Thread.sleep(2);
 
         // Second timestamp is added
         long timestamp2 = System.currentTimeMillis();
         messageTracker.trackReceived(timestamp2);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
     }
 
     @Test
@@ -94,8 +95,8 @@ public void testMessageTrackerFull() throws InterruptedException {
             Thread.sleep(1);
         }
 
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestampSent);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestampReceived);
+        assertEquals(messageTracker.peekSentTimestamp(), timestampSent);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestampReceived);
     }
 
     @Test
@@ -106,24 +107,24 @@ public void testDumpToLog() {
 
         // MessageTracker is empty
         messageTracker.dumpToLog(sid);
-        Assert.assertNull(messageTracker.peekSent());
-        Assert.assertNull(messageTracker.peekReceived());
+        assertNull(messageTracker.peekSent());
+        assertNull(messageTracker.peekReceived());
 
         // There is 1 sent and 0 received
         messageTracker.trackSent(timestamp1);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
-        Assert.assertNull(messageTracker.peekReceived());
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertNull(messageTracker.peekReceived());
         messageTracker.dumpToLog(sid);
-        Assert.assertNull(messageTracker.peekSent());
-        Assert.assertNull(messageTracker.peekReceived());
+        assertNull(messageTracker.peekSent());
+        assertNull(messageTracker.peekReceived());
 
         // There is 1 sent and 1 received
         messageTracker.trackSent(timestamp1);
         messageTracker.trackReceived(timestamp1);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
         messageTracker.dumpToLog(sid);
-        Assert.assertNull(messageTracker.peekSent());
-        Assert.assertNull(messageTracker.peekReceived());
+        assertNull(messageTracker.peekSent());
+        assertNull(messageTracker.peekReceived());
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
index ecfc92c000c..f31b13e7470 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
@@ -26,21 +26,21 @@
 import static org.apache.zookeeper.ZooDefs.OpCode.getChildren2;
 import static org.apache.zookeeper.ZooDefs.OpCode.getData;
 import static org.apache.zookeeper.ZooDefs.OpCode.setData;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Map;
 import java.util.Random;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Ignore;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
 
 public class RequestPathMetricsCollectorTest {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.pathStats.enabled", "true");
         System.setProperty("zookeeper.pathStats.slotCapacity", "60");
@@ -49,7 +49,7 @@ public void setUp() {
         System.setProperty("zookeeper.pathStats.sampleRate", "1.0");
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty("zookeeper.pathStats.enabled");
         System.clearProperty("zookeeper.pathStats.slotCapacity");
@@ -160,7 +160,7 @@ public void testCollectEmptyStats() throws InterruptedException {
     }
 
     @Test
-    @Ignore
+    @Disabled
     public void testCollectStats() throws InterruptedException {
         RequestPathMetricsCollector requestPathMetricsCollector = new RequestPathMetricsCollector(true);
         RequestPathMetricsCollector.PathStatsQueue pathStatsQueue = requestPathMetricsCollector.new PathStatsQueue(getChildren);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
index 5caa7180058..2df30cadb93 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -35,7 +35,7 @@
 import org.apache.jute.Record;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.mockito.InOrder;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java
index 925b01feaea..4561fc2853f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java
@@ -18,11 +18,12 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.File;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -30,7 +31,7 @@ public class VerifyingFileFactoryTest extends ZKTestCase {
 
     private Logger log;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         log = LoggerFactory.getLogger("TODO: Mock Logging");
     }
@@ -49,10 +50,12 @@ public void testForNoWarningOnIntendedRelativePath() {
         // assertFalse(log.hasWarned);
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testForFailForNonExistingPath() {
-        VerifyingFileFactory vff = new VerifyingFileFactory.Builder(log).failForNonExistingPath().build();
-        vff.create("/I/H0p3/this/path/d035/n0t/ex15t");
+        assertThrows(IllegalArgumentException.class, () -> {
+            VerifyingFileFactory vff = new VerifyingFileFactory.Builder(log).failForNonExistingPath().build();
+            vff.create("/I/H0p3/this/path/d035/n0t/ex15t");
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java
index 59bb17adaa3..23ba5bb51f0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java
@@ -18,67 +18,69 @@
 
 package org.apache.zookeeper.server.watch;
 
-import org.junit.Assert;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.Test;
 
 public class PathParentIteratorTest {
     @Test
     public void testRoot() {
         PathParentIterator pathParentIterator = PathParentIterator.forAll("/");
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertFalse(pathParentIterator.atParentPath());
-        Assert.assertEquals(pathParentIterator.next(), "/");
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertTrue(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.atParentPath());
+        assertEquals(pathParentIterator.next(), "/");
+        assertFalse(pathParentIterator.hasNext());
     }
 
     @Test
     public void test1Level() {
         PathParentIterator pathParentIterator = PathParentIterator.forAll("/a");
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertFalse(pathParentIterator.atParentPath());
-        Assert.assertEquals(pathParentIterator.next(), "/a");
+        assertTrue(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.atParentPath());
+        assertEquals(pathParentIterator.next(), "/a");
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.hasNext());
     }
 
     @Test
     public void testLong() {
         PathParentIterator pathParentIterator = PathParentIterator.forAll("/a/b/c/d");
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b/c/d");
-        Assert.assertFalse(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b/c/d");
+        assertFalse(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b/c");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b/c");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.hasNext());
     }
 
     @Test
     public void testForPathOnly() {
         PathParentIterator pathParentIterator = PathParentIterator.forPathOnly("/a/b/c/d");
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b/c/d");
-        Assert.assertFalse(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b/c/d");
+        assertFalse(pathParentIterator.atParentPath());
 
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.hasNext());
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
index 067cb2af94a..78b13bb3348 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
@@ -30,8 +30,8 @@
 import java.util.stream.IntStream;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class RecursiveWatchQtyTest {
     private WatchManager watchManager;
@@ -46,7 +46,7 @@ public void process(WatchedEvent event) {
         }
     }
 
-    @Before
+    @BeforeEach
     public void setup() {
         watchManager = new WatchManager();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
index e29dab90649..bd613a44488 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
@@ -17,12 +17,11 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -30,6 +29,7 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.Stream;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZKTestCase;
@@ -37,14 +37,14 @@
 import org.apache.zookeeper.server.DumbWatcher;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class WatchManagerTest extends ZKTestCase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(WatchManagerTest.class);
@@ -53,25 +53,21 @@ public class WatchManagerTest extends ZKTestCase {
 
     private ConcurrentHashMap<Integer, DumbWatcher> watchers;
     private Random r;
-    private String className;
 
-    public WatchManagerTest(String className) {
-        this.className = className;
+    public static Stream<Arguments> data() {
+        return Stream.of(
+            Arguments.of(WatchManager.class.getName()),
+            Arguments.of(WatchManagerOptimized.class.getName()));
     }
 
-    @Parameterized.Parameters
-    public static List<Object[]> data() {
-        return Arrays.asList(new Object[][]{{WatchManager.class.getName()}, {WatchManagerOptimized.class.getName()}});
-    }
-
-    @Before
+    @BeforeEach
     public void setUp() {
         ServerMetrics.getMetrics().resetAll();
-        watchers = new ConcurrentHashMap<Integer, DumbWatcher>();
+        watchers = new ConcurrentHashMap<>();
         r = new Random(System.nanoTime());
     }
 
-    public IWatchManager getWatchManager() throws IOException {
+    public IWatchManager getWatchManager(String className) throws IOException {
         System.setProperty(WatchManagerFactory.ZOOKEEPER_WATCH_MANAGER_NAME, className);
         return WatchManagerFactory.createWatchManager();
     }
@@ -229,9 +225,11 @@ public void shutdown() {
      * Concurrently add and trigger watch, make sure the watches triggered
      * are the same as the number added.
      */
-    @Test(timeout = 90000)
-    public void testAddAndTriggerWatcher() throws IOException {
-        IWatchManager manager = getWatchManager();
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 90)
+    public void testAddAndTriggerWatcher(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
         int paths = 1;
         int watchers = 10000;
 
@@ -288,9 +286,11 @@ public void testAddAndTriggerWatcher() throws IOException {
      * Concurrently add and remove watch, make sure the watches left +
      * the watches removed are equal to the total added watches.
      */
-    @Test(timeout = 90000)
-    public void testRemoveWatcherOnPath() throws IOException {
-        IWatchManager manager = getWatchManager();
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 90)
+    public void testRemoveWatcherOnPath(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
         int paths = 10;
         int watchers = 10000;
 
@@ -346,12 +346,14 @@ public void testRemoveWatcherOnPath() throws IOException {
      * Concurrently add watch while close the watcher to simulate the
      * client connections closed on prod.
      */
-    @Test(timeout = 90000)
-    public void testDeadWatchers() throws IOException {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 90)
+    public void testDeadWatchers(String className) throws IOException {
         System.setProperty("zookeeper.watcherCleanThreshold", "10");
         System.setProperty("zookeeper.watcherCleanIntervalInSeconds", "1");
 
-        IWatchManager manager = getWatchManager();
+        IWatchManager manager = getWatchManager(className);
         int paths = 1;
         int watchers = 100000;
 
@@ -414,9 +416,10 @@ private void checkMetrics(String metricName, long min, long max, double avg, lon
         assertEquals(sum, values.get("sum_" + metricName));
     }
 
-    @Test
-    public void testWatcherMetrics() throws IOException {
-        IWatchManager manager = getWatchManager();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testWatcherMetrics(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
         ServerMetrics.getMetrics().resetAll();
 
         DumbWatcher watcher1 = new DumbWatcher(1);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
index 5152b5eb27a..ec05f14dbde 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
@@ -17,11 +17,11 @@
 
 package org.apache.zookeeper.server.watch;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
@@ -31,7 +31,7 @@
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -157,8 +157,8 @@ public void testDeadWatcherMetrics() {
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
         assertThat("Adding dead watcher should be stalled twice", (Long) values.get("add_dead_watcher_stall_time"), greaterThan(0L));
-        assertEquals("Total dead watchers added to the queue should be 3", 3L, values.get("dead_watchers_queued"));
-        assertEquals("Total dead watchers cleared should be 3", 3L, values.get("dead_watchers_cleared"));
+        assertEquals(3L, values.get("dead_watchers_queued"), "Total dead watchers added to the queue should be 3");
+        assertEquals(3L, values.get("dead_watchers_cleared"), "Total dead watchers cleared should be 3");
 
         assertEquals(3L, values.get("cnt_dead_watchers_cleaner_latency"));
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
index ee105dfa650..fb25d2104d0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
@@ -17,16 +17,16 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashSet;
 import java.util.Set;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.DumbWatcher;
 import org.apache.zookeeper.server.util.BitHashSet;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class WatcherOrBitSetTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
index 123b49bd595..4e1c3168233 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
@@ -17,23 +17,23 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatchesPathReportTest extends ZKTestCase {
 
     private Map<String, Set<Long>> m;
     private WatchesPathReport r;
-    @Before
+    @BeforeEach
     public void setUp() {
         m = new HashMap<String, Set<Long>>();
         Set<Long> s = new HashSet<Long>();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
index 05c0547d93b..0ae952f6cf3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
@@ -17,23 +17,23 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatchesReportTest extends ZKTestCase {
 
     private Map<Long, Set<String>> m;
     private WatchesReport r;
-    @Before
+    @BeforeEach
     public void setUp() {
         m = new HashMap<Long, Set<String>>();
         Set<String> s = new HashSet<String>();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java
index 9d53281ed3b..e1ac736148b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java
@@ -17,16 +17,16 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatchesSummaryTest extends ZKTestCase {
 
     private WatchesSummary s;
-    @Before
+    @BeforeEach
     public void setUp() {
         s = new WatchesSummary(1, 2, 3);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
index 6b8f9ff3885..2b9cc9c7b36 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.List;
@@ -35,7 +35,7 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -79,7 +79,7 @@ public void testAclCount() throws Exception {
 
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             zk = ClientBase.createZKClient(HOSTPORT);
 
             zk.addAuthInfo("digest", "pat:test".getBytes());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java
index 3f4b9d40a32..256dd1b82d3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ACLRootTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
index df94e3a18a2..d1b5a1065e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.List;
@@ -42,7 +42,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -55,11 +55,11 @@ public class ACLTest extends ZKTestCase implements Watcher {
     @Test
     public void testIPAuthenticationIsValidCIDR() throws Exception {
         IPAuthenticationProvider prov = new IPAuthenticationProvider();
-        assertTrue("testing no netmask", prov.isValid("127.0.0.1"));
-        assertTrue("testing single ip netmask", prov.isValid("127.0.0.1/32"));
-        assertTrue("testing lowest netmask possible", prov.isValid("127.0.0.1/0"));
-        assertFalse("testing netmask too high", prov.isValid("127.0.0.1/33"));
-        assertFalse("testing netmask too low", prov.isValid("10.0.0.1/-1"));
+        assertTrue(prov.isValid("127.0.0.1"), "testing no netmask");
+        assertTrue(prov.isValid("127.0.0.1/32"), "testing single ip netmask");
+        assertTrue(prov.isValid("127.0.0.1/0"), "testing lowest netmask possible");
+        assertFalse(prov.isValid("127.0.0.1/33"), "testing netmask too high");
+        assertFalse(prov.isValid("10.0.0.1/-1"), "testing netmask too low");
     }
 
     @Test
@@ -75,7 +75,7 @@ public void testNettyIpAuthDefault() throws Exception {
         f.startup(zks);
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             ClientBase.createZKClient(HOSTPORT);
             for (ServerCnxn cnxn : f.getConnections()) {
                 boolean foundID = false;
@@ -90,7 +90,7 @@ public void testNettyIpAuthDefault() throws Exception {
         } finally {
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
             System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         }
     }
@@ -106,7 +106,7 @@ public void testDisconnectedAddAuth() throws Exception {
         f.startup(zks);
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
             try {
                 zk.addAuthInfo("digest", "pat:test".getBytes());
@@ -117,7 +117,7 @@ public void testDisconnectedAddAuth() throws Exception {
         } finally {
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
@@ -139,7 +139,7 @@ public void testAcls() throws Exception {
         String path;
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             zk = ClientBase.createZKClient(HOSTPORT);
             LOG.info("starting creating acls");
             for (int i = 0; i < 100; i++) {
@@ -147,7 +147,7 @@ public void testAcls() throws Exception {
                 zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             }
             int size = zks.getZKDatabase().getAclSize();
-            assertTrue("size of the acl map ", (2 == zks.getZKDatabase().getAclSize()));
+            assertTrue((2 == zks.getZKDatabase().getAclSize()), "size of the acl map ");
             for (int j = 100; j < 200; j++) {
                 path = "/" + j;
                 ACL acl = new ACL();
@@ -160,12 +160,12 @@ public void testAcls() throws Exception {
                 list.add(acl);
                 zk.create(path, path.getBytes(), list, CreateMode.PERSISTENT);
             }
-            assertTrue("size of the acl map ", (102 == zks.getZKDatabase().getAclSize()));
+            assertTrue((102 == zks.getZKDatabase().getAclSize()), "size of the acl map ");
         } finally {
             // now shutdown the server and restart it
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
         }
 
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -173,9 +173,9 @@ public void testAcls() throws Exception {
 
         f.startup(zks);
         try {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
             zk = ClientBase.createZKClient(HOSTPORT);
-            assertTrue("acl map ", (102 == zks.getZKDatabase().getAclSize()));
+            assertTrue((102 == zks.getZKDatabase().getAclSize()), "acl map ");
             for (int j = 200; j < 205; j++) {
                 path = "/" + j;
                 ACL acl = new ACL();
@@ -188,13 +188,13 @@ public void testAcls() throws Exception {
                 list.add(acl);
                 zk.create(path, path.getBytes(), list, CreateMode.PERSISTENT);
             }
-            assertTrue("acl map ", (107 == zks.getZKDatabase().getAclSize()));
+            assertTrue((107 == zks.getZKDatabase().getAclSize()), "acl map ");
 
             zk.close();
         } finally {
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
 
     }
@@ -253,7 +253,7 @@ public void testNullACL() throws Exception {
             zk.close();
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
@@ -298,7 +298,7 @@ public void testNullValueACL() throws Exception {
             zk.close();
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
index 0112ba2567b..2276354d15e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
@@ -20,8 +20,8 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.apache.zookeeper.test.ClientBase.verifyThreadTerminated;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.LinkedList;
 import org.apache.zookeeper.AsyncCallback.DataCallback;
 import org.apache.zookeeper.AsyncCallback.StringCallback;
@@ -34,7 +34,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -120,7 +120,7 @@ private synchronized void incOutstanding() throws InterruptedException {
 
         private synchronized void decOutstanding() {
             outstanding--;
-            assertTrue("outstanding >= 0", outstanding >= 0);
+            assertTrue(outstanding >= 0, "outstanding >= 0");
             notifyAll();
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
index d5f2310c331..ea02aa82a6b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java
index 9a9fe35ffc8..174df3fac05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java
@@ -29,9 +29,9 @@
 import org.apache.zookeeper.test.AsyncOps.StatCB;
 import org.apache.zookeeper.test.AsyncOps.StringCB;
 import org.apache.zookeeper.test.AsyncOps.VoidCB;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -41,7 +41,7 @@ public class AsyncOpsTest extends ClientBase {
 
     private ZooKeeper zk;
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -52,7 +52,7 @@ public void setUp() throws Exception {
         zk.addAuthInfo("digest", "ben:passwd".getBytes());
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
index 26db2702d96..c315270034c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.LinkedList;
 import java.util.List;
 import org.apache.zookeeper.AsyncCallback.DataCallback;
@@ -32,9 +32,9 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,12 +44,12 @@ public class AsyncTest extends ZKTestCase implements StringCallback, VoidCallbac
 
     private QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("Test clients shutting down");
         qb.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
index a91bf355998..2d931754939 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
@@ -29,9 +29,9 @@
 import java.io.OutputStream;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileOutputStream;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AtomicFileOutputStreamTest extends ZKTestCase {
 
@@ -41,12 +41,12 @@ public class AtomicFileOutputStreamTest extends ZKTestCase {
     private File testDir;
     private File dstFile;
 
-    @Before
+    @BeforeEach
     public void setupTestDir() throws IOException {
         testDir = ClientBase.createEmptyTestDir();
         dstFile = new File(testDir, "test.txt");
     }
-    @After
+    @AfterEach
     public void cleanupTestDir() throws IOException {
         ClientBase.recursiveDelete(testDir);
     }
@@ -73,11 +73,11 @@ public void testWriteNewFile() throws IOException {
      */
     @Test
     public void testOverwriteFile() throws IOException {
-        assertTrue("Creating empty dst file", dstFile.createNewFile());
+        assertTrue(dstFile.createNewFile(), "Creating empty dst file");
 
         OutputStream fos = new AtomicFileOutputStream(dstFile);
 
-        assertTrue("Empty file still exists", dstFile.exists());
+        assertTrue(dstFile.exists(), "Empty file still exists");
         fos.write(TEST_STRING.getBytes());
         fos.flush();
 
@@ -114,7 +114,7 @@ public void testFailToFlush() throws IOException {
         // Should not have touched original file
         assertEquals(TEST_STRING_2, ClientBase.readFile(dstFile));
 
-        assertEquals("Temporary file should have been cleaned up", dstFile.getName(), ClientBase.join(",", testDir.list()));
+        assertEquals(dstFile.getName(), ClientBase.join(",", testDir.list()), "Temporary file should have been cleaned up");
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
index c78f6202b3d..211dfaedb50 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -29,7 +29,7 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class AuthTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java
index 8a4dd54a5d0..410b51033fe 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import org.apache.jute.BinaryInputArchive;
@@ -27,8 +27,8 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class BufferSizeTest extends ClientBase {
 
@@ -37,10 +37,10 @@ public class BufferSizeTest extends ClientBase {
 
     private ZooKeeper zk;
 
-    @Before
+    @BeforeEach
     public void setMaxBuffer() throws IOException, InterruptedException {
         System.setProperty("jute.maxbuffer", "" + TEST_MAXBUFFER);
-        assertEquals("Can't set jute.maxbuffer!", TEST_MAXBUFFER, BinaryInputArchive.maxBuffer);
+        assertEquals(TEST_MAXBUFFER, BinaryInputArchive.maxBuffer, "Can't set jute.maxbuffer!");
         zk = createClient();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java
index bb421b328b3..62e2cc1111b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java
@@ -21,6 +21,7 @@
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.junit.jupiter.api.BeforeEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -28,6 +29,7 @@ public class ChrootAsyncTest extends AsyncOpsTest {
 
     private static final Logger LOG = LoggerFactory.getLogger(ChrootAsyncTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         String hp = hostPort;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java
index 70cd2c684c9..5845ec95180 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java
@@ -21,7 +21,8 @@
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -29,6 +30,7 @@ public class ChrootClientTest extends ClientTest {
 
     private static final Logger LOG = LoggerFactory.getLogger(ChrootClientTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         String hp = hostPort;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
index ddf206324d4..0b156156d0d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.concurrent.CountDownLatch;
@@ -33,7 +33,7 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ChrootTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index 4235b6b6349..532a075c407 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
@@ -60,8 +60,8 @@
 import org.apache.zookeeper.server.persistence.FilePadding;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.After;
-import org.junit.Before;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -338,7 +338,7 @@ static void verifyThreadTerminated(Thread thread, long millis) throws Interrupte
         thread.join(millis);
         if (thread.isAlive()) {
             LOG.error("Thread {} : {}", thread.getName(), Arrays.toString(thread.getStackTrace()));
-            assertFalse("thread " + thread.getName() + " still alive after join", true);
+            assertFalse(true, "thread " + thread.getName() + " still alive after join");
         }
     }
 
@@ -397,8 +397,8 @@ public static void startServerInstance(
         zks.setCreateSessionTrackerServerId(serverId);
         factory.startup(zks);
         assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + port, CONNECTION_TIMEOUT, factory.isSecure()));
+                ClientBase.waitForServerUp("127.0.0.1:" + port, CONNECTION_TIMEOUT, factory.isSecure()),
+                "waiting for server up");
     }
 
     /**
@@ -447,8 +447,8 @@ static void shutdownServerInstance(ServerCnxnFactory factory, String hostPort) {
             final int PORT = getPort(hostPort);
 
             assertTrue(
-                    "waiting for server down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT, factory.isSecure()));
+                    ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT, factory.isSecure()),
+                    "waiting for server down");
         }
     }
 
@@ -469,7 +469,7 @@ protected void setUpAll() throws Exception {
         allClientsSetup = true;
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         setUpWithServerId(1);
     }
@@ -539,7 +539,7 @@ private void verifyUnexpectedBeans(Set<ObjectName> children) {
         for (ObjectName bean : children) {
             LOG.info("unexpected:{}", bean.toString());
         }
-        assertEquals("Unexpected bean exists!", 0, children.size());
+        assertEquals(0, children.size(), "Unexpected bean exists!");
     }
 
     /**
@@ -578,7 +578,7 @@ protected void tearDownAll() throws Exception {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
 
@@ -587,7 +587,7 @@ public void tearDown() throws Exception {
         stopServer();
 
         if (tmpDir != null) {
-            assertTrue("delete " + tmpDir.toString(), recursiveDelete(tmpDir));
+            assertTrue(recursiveDelete(tmpDir), "delete " + tmpDir.toString());
         }
 
         // This has to be set to null when the same instance of this class is reused between test cases
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java
index 14e6ba5fbe4..1a85862d907 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.IOException;
 import java.util.Date;
 import java.util.List;
@@ -27,7 +27,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.common.Time;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
index 2daf6f3f9b6..767a24481ce 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.net.Inet6Address;
 import java.net.InetAddress;
@@ -32,7 +32,7 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -87,7 +87,7 @@ public void testBindByAddress() throws Exception {
         f.startup(zks);
         LOG.info("starting up the the server, waiting");
 
-        assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             zk.close();
@@ -95,7 +95,7 @@ public void testBindByAddress() throws Exception {
             f.shutdown();
             zks.shutdown();
 
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java
index 48c01822100..50540c83cda 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java
@@ -18,15 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import java.io.IOException;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.ZooKeeper.States;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ClientRetryTest extends ClientBase {
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         maxCnxns = 1;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index 1d3233fe6b9..807b7777fcd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -22,7 +22,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
@@ -32,15 +32,15 @@
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ClientSSLTest extends QuorumPeerTestBase {
 
     private ClientX509Util clientX509Util;
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
         clientX509Util = new ClientX509Util();
@@ -54,7 +54,7 @@ public void setup() {
         System.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         System.clearProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY);
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
@@ -122,9 +122,8 @@ public void testClientServerSSL(boolean useSecurePort) throws Exception {
 
         // Servers have been set up. Now go test if secure connection is successful.
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], TIMEOUT),
+                    "waiting for server " + i + " being up");
             final int port = useSecurePort ? secureClientPorts[i] : clientPorts[i];
             ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + port, TIMEOUT);
             // Do a simple operation to make sure the connection is fine.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java
index d9b8cdddd7e..b6971858636 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 
 public class ClientSkipACLTest extends ClientTest {
 
-    @BeforeClass
+    @BeforeAll
     public static void setup() {
         System.setProperty("zookeeper.skipACL", "yes");
     }
 
-    @AfterClass
+    @AfterAll
     public static void teardown() {
         System.clearProperty("zookeeper.skipACL");
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
index 6bd483b49f3..5ee50f19a34 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -53,7 +53,7 @@
 import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.server.PrepRequestProcessor;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -445,7 +445,7 @@ private void performClientTest(boolean withWatcherObj) throws IOException, Inter
             assertEquals(10, children.size());
             for (int i = 0; i < 10; i++) {
                 final String name = children.get(i);
-                assertTrue("starts with -", name.startsWith(i + "-"));
+                assertTrue(name.startsWith(i + "-"), "starts with -");
                 byte[] b;
                 if (withWatcherObj) {
                     b = zk.getData("/pat/ben/" + name, watcher, stat);
@@ -512,12 +512,12 @@ public void testSequentialNodeNames() throws IOException, InterruptedException,
             zk.create(filepath, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
             children = zk.getChildren(path, false);
             assertEquals(2, children.size());
-            assertTrue("contains child 1", children.contains(file + "0000000001"));
+            assertTrue(children.contains(file + "0000000001"), "contains child 1");
 
             zk.create(filepath, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
             children = zk.getChildren(path, false);
             assertEquals(3, children.size());
-            assertTrue("contains child 2", children.contains(file + "0000000002"));
+            assertTrue(children.contains(file + "0000000002"), "contains child 2");
 
             // The pattern is holding so far.  Let's run the counter a bit
             // to be sure it continues to spit out the correct answer
@@ -526,7 +526,7 @@ public void testSequentialNodeNames() throws IOException, InterruptedException,
             }
 
             children = zk.getChildren(path, false);
-            assertTrue("contains child 104", children.contains(file + "0000000104"));
+            assertTrue(children.contains(file + "0000000104"), "contains child 104");
 
         } finally {
             if (zk != null) {
@@ -805,7 +805,7 @@ public synchronized void process(WatchedEvent event) {
         assertEquals(r.getErr(), Code.UNIMPLEMENTED.intValue());
 
         // Sending a nonexisting opcode should cause the server to disconnect
-        assertTrue("failed to disconnect", clientDisconnected.await(5000, TimeUnit.MILLISECONDS));
+        assertTrue(clientDisconnected.await(5000, TimeUnit.MILLISECONDS), "failed to disconnect");
         zk.close();
     }
 
@@ -835,11 +835,11 @@ public void testCXidRollover() throws Exception {
                     rc.set(retcode);
                     latch.countDown();
                 }, null);
-                assertTrue("setData should complete within 5s", latch.await(zk.getSessionTimeout(), TimeUnit.MILLISECONDS));
-                assertEquals("setData should have succeeded", Code.OK.intValue(), rc.get());
+                assertTrue(latch.await(zk.getSessionTimeout(), TimeUnit.MILLISECONDS), "setData should complete within 5s");
+                assertEquals(Code.OK.intValue(), rc.get(), "setData should have succeeded");
             }
             zk.delete("/testnode", -1);
-            assertTrue("xid should be positive", zk.checkXid() > 0);
+            assertTrue(zk.checkXid() > 0, "xid should be positive");
         } finally {
             if (zk != null) {
                 zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
index e1048f28388..fc30e69920f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
@@ -18,11 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.ConnectStringParser;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ConnectStringParserTest extends ZKTestCase {
 
@@ -91,20 +90,20 @@ public void testParseIPV6ConnectionString() {
         String servers = "[127::1],127.0.10.2";
         ConnectStringParser parser = new ConnectStringParser(servers);
 
-        Assert.assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
-        Assert.assertEquals("127.0.10.2", parser.getServerAddresses().get(1).getHostString());
-        Assert.assertEquals(2181, parser.getServerAddresses().get(0).getPort());
-        Assert.assertEquals(2181, parser.getServerAddresses().get(1).getPort());
+        assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
+        assertEquals("127.0.10.2", parser.getServerAddresses().get(1).getHostString());
+        assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+        assertEquals(2181, parser.getServerAddresses().get(1).getPort());
 
         servers = "[127::1]:2181,[127::2]:2182,[127::3]:2183";
         parser = new ConnectStringParser(servers);
 
-        Assert.assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
-        Assert.assertEquals("127::2", parser.getServerAddresses().get(1).getHostString());
-        Assert.assertEquals("127::3", parser.getServerAddresses().get(2).getHostString());
-        Assert.assertEquals(2181, parser.getServerAddresses().get(0).getPort());
-        Assert.assertEquals(2182, parser.getServerAddresses().get(1).getPort());
-        Assert.assertEquals(2183, parser.getServerAddresses().get(2).getPort());
+        assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
+        assertEquals("127::2", parser.getServerAddresses().get(1).getHostString());
+        assertEquals("127::3", parser.getServerAddresses().get(2).getHostString());
+        assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+        assertEquals(2182, parser.getServerAddresses().get(1).getPort());
+        assertEquals(2183, parser.getServerAddresses().get(2).getPort());
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java
index d2e908b58b3..ee2e4f4f75e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java
@@ -18,16 +18,16 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CreateModeTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
index a3d5ccf8cf2..eddcd1de09b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
@@ -18,17 +18,19 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test suite for validating the Create API.
@@ -37,12 +39,14 @@ public class CreateTest extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -78,21 +82,21 @@ public void testCreateWithNullStat() throws IOException, KeeperException, Interr
     }
 
     private void createNoStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         String path = zk.create(newName, newName.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(path, newName);
-        assertNotNull("Node was not created as expected", zk.exists(newName, false));
+        assertNotNull(zk.exists(newName, false), "Node was not created as expected");
     }
 
     private Stat createWithStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         Stat stat = new Stat();
         String path = zk.create(newName, newName.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
         assertEquals(path, newName);
         validateCreateStat(stat, newName);
 
         Stat referenceStat = zk.exists(newName, false);
-        assertNotNull("Node was not created as expected", referenceStat);
+        assertNotNull(referenceStat, "Node was not created as expected");
         assertEquals(referenceStat, stat);
 
         return stat;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
index dcff76cca86..c8a4fffe702 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -29,9 +29,10 @@
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -62,7 +63,7 @@ public void process(WatchedEvent event) {
     private MyWatcher watcher2;
     private ZooKeeper zk2;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         watcher1 = new CountdownWatcher();
@@ -70,7 +71,7 @@ public void setUp() throws Exception {
         watcher2 = new MyWatcher();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (zk2 != null) {
             zk2.close();
@@ -186,13 +187,14 @@ public void testDeepChildWatcherAutoResetWithChroot() throws Exception {
 
     // @see jira issue ZOOKEEPER-706. Test auto reset of a large number of
     // watches which require multiple SetWatches calls.
-    @Test(timeout = 840000)
+    @Test
+    @Timeout(value = 14, unit = TimeUnit.MINUTES)
     public void testManyChildWatchersAutoReset() throws Exception {
         zk2 = createClient(watcher2);
 
         // 110 character base path
         String pathBase = "/long-path-000000000-111111111-222222222-333333333-444444444-"
-                                  + "555555555-666666666-777777777-888888888-999999999";
+                + "555555555-666666666-777777777-888888888-999999999";
 
         zk1.create(pathBase, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
@@ -245,7 +247,7 @@ public void testManyChildWatchersAutoReset() throws Exception {
                 assertEquals(EventType.NodeCreated, e.getType());
                 assertEquals(path + "/foo", e.getPath());
             } else if (i % 3 == 2) {
-                zk1.setData(path, new byte[]{1, 2, 3}, -1);
+                zk1.setData(path, new byte[] { 1, 2, 3 }, -1);
 
                 WatchedEvent e = childWatcher.events.poll(TIMEOUT, TimeUnit.MILLISECONDS);
                 assertNotNull(e);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java
index 8e2b53053da..0723f3fcb92 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java
@@ -18,18 +18,18 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,7 +47,7 @@ public class DuplicateLocalSessionUpgradeTest extends ZKTestCase {
 
     private static final int CONNECTION_TIMEOUT = ClientBase.CONNECTION_TIMEOUT;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -56,7 +56,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -75,7 +75,7 @@ public void testLocalSessionUpgradeOnLeader() throws Exception {
     private void testLocalSessionUpgrade(boolean testLeader) throws Exception {
 
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
         String[] hostPorts = qb.hostPort.split(",");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
index da50a9c17e7..316d7bf2221 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -36,7 +36,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -61,7 +61,7 @@ public void runTest(boolean leaveEmptyFile, boolean trustEmptySnap) throws Excep
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, this);
         try {
             for (int i = 0; i < N_TRANSACTIONS; i++) {
@@ -72,20 +72,20 @@ public void runTest(boolean leaveEmptyFile, boolean trustEmptySnap) throws Excep
         }
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
         // start server again with intact database
         zks = new ZooKeeperServer(tmpSnapDir, tmpLogDir, 3000);
         zks.startdata();
         long zxid = zks.getZKDatabase().getDataTreeLastProcessedZxid();
         LOG.info("After clean restart, zxid = {}", zxid);
-        assertTrue("zxid > 0", zxid > 0);
+        assertTrue(zxid > 0, "zxid > 0");
         zks.shutdown();
 
         // Make all snapshots empty
         FileTxnSnapLog txnLogFactory = zks.getTxnLogFactory();
         List<File> snapshots = txnLogFactory.findNRecentSnapshots(10);
-        assertTrue("We have a snapshot to corrupt", snapshots.size() > 0);
+        assertTrue(snapshots.size() > 0, "We have a snapshot to corrupt");
         for (File file : snapshots) {
             if (leaveEmptyFile) {
                 new PrintWriter(file).close();
@@ -105,7 +105,7 @@ public void runTest(boolean leaveEmptyFile, boolean trustEmptySnap) throws Excep
             if (!trustEmptySnap) {
                 fail("Should have gotten exception for corrupted database");
             }
-            assertEquals("zxid mismatch after restoring database", currentZxid, zxid);
+            assertEquals(currentZxid, zxid, "zxid mismatch after restoring database");
         } catch (IOException e) {
             // expected behavior
             if (trustEmptySnap) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java
index dcd7ee6f1e5..8fbe79011be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java
@@ -18,24 +18,25 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.auth.EnsembleAuthenticationProvider;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class EnsembleAuthTest extends ClientBase {
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.EnsembleAuthenticationProvider");
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         super.tearDown();
         System.clearProperty("zookeeper.authProvider.1");
@@ -76,16 +77,20 @@ public void passAuthCSV() throws Exception {
         connectToEnsemble("baz");
     }
 
-    @Test(expected = KeeperException.ConnectionLossException.class)
-    public void failAuth() throws Exception {
-        resetEnsembleAuth("woo", true);
-        connectToEnsemble("goo");
+    @Test
+    public void failAuth() {
+        assertThrows(KeeperException.ConnectionLossException.class, () -> {
+            resetEnsembleAuth("woo", true);
+            connectToEnsemble("goo");
+        });
     }
 
-    @Test(expected = KeeperException.AuthFailedException.class)
-    public void removeEnsembleAuthProvider() throws Exception {
-        resetEnsembleAuth(null, false);
-        connectToEnsemble("goo");
+    @Test
+    public void removeEnsembleAuthProvider() {
+        assertThrows(KeeperException.AuthFailedException.class, () -> {
+            resetEnsembleAuth(null, false);
+            connectToEnsemble("goo");
+        });
     }
 
     private void connectToEnsemble(final String auth) throws IOException, InterruptedException, KeeperException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java
index cf9807dd354..b7ff295d933 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class EventTypeTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
index 64af39737be..2ad1fe1b8e0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -30,9 +30,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,7 +50,7 @@ public class FLENewEpochTest extends ZKTestCase {
     Semaphore start0;
     Semaphore finish3, finish0;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
@@ -69,7 +69,7 @@ public void setUp() throws Exception {
         finish3 = new Semaphore(0);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < threads.size(); i++) {
             threads.get(i).peer.getElectionAlg().shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
index 3fcb83bed03..b9e3749538f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -30,7 +30,7 @@
 import org.apache.zookeeper.server.quorum.FastLeaderElection;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
index 3563019ea9b..52cd1851a87 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -71,7 +71,7 @@ int countVotes(HashSet<TestVote> hs, long id) {
         return counter;
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
         peers = new HashMap<Long, QuorumServer>(count);
@@ -81,7 +81,7 @@ public void setUp() throws Exception {
         finish = new Semaphore(0);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < restartThreads.size(); i++) {
             restartThreads.get(i).peer.getElectionAlg().shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
index 8583f64d8bf..15713e423cc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -38,9 +38,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -86,7 +86,7 @@ int countVotes(HashSet<TestVote> hs, long id) {
     Random rand = new Random();
     Set<Long> joinedThreads;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 7;
 
@@ -100,7 +100,7 @@ public void setUp() throws Exception {
         joinedThreads = new HashSet<Long>();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < threads.size(); i++) {
             leThread = threads.get(i);
@@ -205,12 +205,10 @@ public void run() {
                                  * Assert that the state of the thread is the one expected.
                                  */
                                 if (v.getId() == i) {
-                                    assertTrue("Wrong state" + peer.getPeerState(), peer.getPeerState()
-                                                                                                   == ServerState.LEADING);
+                                    assertTrue(peer.getPeerState() == ServerState.LEADING, "Wrong state" + peer.getPeerState());
                                     leader = i;
                                 } else {
-                                    assertTrue("Wrong state" + peer.getPeerState(), peer.getPeerState()
-                                                                                                   == ServerState.FOLLOWING);
+                                    assertTrue(peer.getPeerState() == ServerState.FOLLOWING, "Wrong state" + peer.getPeerState());
                                 }
 
                                 /*
@@ -420,7 +418,7 @@ public void testJoin() throws Exception {
         VerifyState v1 = new VerifyState(peerList.get(0));
         v1.start();
         v1.join(waitTime);
-        assertFalse("Unable to form cluster in " + waitTime + " ms", !v1.isSuccess());
+        assertFalse(!v1.isSuccess(), "Unable to form cluster in " + waitTime + " ms");
         // Start 3rd peer and check if it goes in LEADING state
         peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
         LOG.info("Starting peer {}", peer.getId());
@@ -469,7 +467,7 @@ public void testJoinInconsistentEnsemble() throws Exception {
         VerifyState v1 = new VerifyState(peerList.get(0));
         v1.start();
         v1.join(waitTime);
-        assertFalse("Unable to form cluster in " + waitTime + " ms", !v1.isSuccess());
+        assertFalse(!v1.isSuccess(), "Unable to form cluster in " + waitTime + " ms");
         // Change the election round for one of the members of the ensemble
         long leaderSid = peer.getCurrentVote().getId();
         long zxid = peer.getCurrentVote().getZxid();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
index 29f93a62c0e..0fdac4556a3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.net.InetSocketAddress;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,7 +53,7 @@ public class FLEZeroWeightTest extends ZKTestCase {
 
     volatile Vote[] votes;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 9;
 
@@ -81,7 +81,7 @@ public void setUp() throws Exception {
         qp.load(is);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < threads.size(); i++) {
             LEThread leThread = threads.get(i);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
index 47a274dc0f8..aafd36ac756 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Collection;
 import java.util.Set;
@@ -44,9 +44,9 @@
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,14 +63,14 @@ public class FollowerResyncConcurrencyTest extends ZKTestCase {
      */
     private AtomicInteger pending = new AtomicInteger(0);
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         pending.set(0);
         errors.set(0);
         counter.set(0);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("Error count {}", errors.get());
     }
@@ -97,12 +97,10 @@ public void testLaggingFollowerResyncsUnderNewEpoch() throws Exception {
 
         qu.start(1);
         qu.start(2);
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
 
         ZooKeeper zk1 = createClient(qu.getPeer(1).peer.getClientPort(), watcher1);
         LOG.info("zk1 has session id 0x{}", Long.toHexString(zk1.getSessionId()));
@@ -113,41 +111,36 @@ public void testLaggingFollowerResyncsUnderNewEpoch() throws Exception {
 
         qu.shutdown(1);
         qu.shutdown(2);
-        assertTrue(
-                "Waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-                "Waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server down");
 
         qu.start(1);
         qu.start(2);
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
 
         qu.start(3);
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(3).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(3).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
 
         zk1 = createClient(qu.getPeer(1).peer.getClientPort(), watcher1);
         LOG.info("zk1 has session id 0x{}", Long.toHexString(zk1.getSessionId()));
 
-        assertNotNull("zk1 has data", zk1.exists(resyncPath, false));
+        assertNotNull(zk1.exists(resyncPath, false), "zk1 has data");
 
         final ZooKeeper zk2 = createClient(qu.getPeer(2).peer.getClientPort(), watcher2);
         LOG.info("zk2 has session id 0x{}", Long.toHexString(zk2.getSessionId()));
 
-        assertNotNull("zk2 has data", zk2.exists(resyncPath, false));
+        assertNotNull(zk2.exists(resyncPath, false), "zk2 has data");
 
         final ZooKeeper zk3 = createClient(qu.getPeer(3).peer.getClientPort(), watcher3);
         LOG.info("zk3 has session id 0x{}", Long.toHexString(zk3.getSessionId()));
 
-        assertNotNull("zk3 has data", zk3.exists(resyncPath, false));
+        assertNotNull(zk3.exists(resyncPath, false), "zk3 has data");
 
         zk1.close();
         zk2.close();
@@ -568,29 +561,26 @@ private static TestableZooKeeper createTestableClient(
 
     private void verifyState(QuorumUtil qu, int index, Leader leader) {
         LOG.info("Verifying state");
-        assertTrue("Not following", qu.getPeer(index).peer.follower != null);
+        assertTrue(qu.getPeer(index).peer.follower != null, "Not following");
         long epochF = (qu.getPeer(index).peer.getActiveServer().getZxid() >> 32L);
         long epochL = (leader.getEpoch() >> 32L);
-        assertTrue("Zxid: "
-                           + qu.getPeer(index).peer.getActiveServer().getZKDatabase().getDataTreeLastProcessedZxid()
-                           + "Current epoch: "
-                           + epochF, epochF == epochL);
+        assertTrue(epochF == epochL,
+                "Zxid: " + qu.getPeer(index).peer.getActiveServer().getZKDatabase().getDataTreeLastProcessedZxid()
+                + "Current epoch: " + epochF);
         int leaderIndex = (index == 1) ? 2 : 1;
         Collection<Long> sessionsRestarted = qu.getPeer(index).peer.getActiveServer().getZKDatabase().getSessions();
         Collection<Long> sessionsNotRestarted = qu.getPeer(leaderIndex).peer.getActiveServer().getZKDatabase().getSessions();
 
         for (Long l : sessionsRestarted) {
-            assertTrue("Should have same set of sessions in both servers, did not expect: "
-                               + l, sessionsNotRestarted.contains(l));
+            assertTrue(sessionsNotRestarted.contains(l), "Should have same set of sessions in both servers, did not expect: " + l);
         }
-        assertEquals("Should have same number of sessions", sessionsNotRestarted.size(), sessionsRestarted.size());
+        assertEquals(sessionsNotRestarted.size(), sessionsRestarted.size(), "Should have same number of sessions");
         ZKDatabase restarted = qu.getPeer(index).peer.getActiveServer().getZKDatabase();
         ZKDatabase clean = qu.getPeer(3).peer.getActiveServer().getZKDatabase();
         ZKDatabase lead = qu.getPeer(leaderIndex).peer.getActiveServer().getZKDatabase();
         for (Long l : sessionsRestarted) {
             LOG.info("Validating ephemeral for session id 0x{}", Long.toHexString(l));
-            assertTrue("Should have same set of sessions in both servers, did not expect: "
-                               + l, sessionsNotRestarted.contains(l));
+            assertTrue(sessionsNotRestarted.contains(l), "Should have same set of sessions in both servers, did not expect: " + l);
             Set<String> ephemerals = restarted.getEphemerals(l);
             Set<String> cleanEphemerals = clean.getEphemerals(l);
             for (String o : cleanEphemerals) {
@@ -614,8 +604,8 @@ private void verifyState(QuorumUtil qu, int index, Leader leader) {
                     LOG.info("Leader doesn't contain ephemeral from follower {} zxid 0x{}", o, Long.toHexString(clean.getDataTree().getNode(o).stat.getMzxid()));
                 }
             }
-            assertEquals("Should have same number of ephemerals in both followers", ephemerals.size(), cleanEphemerals.size());
-            assertEquals("Leader should equal follower", lead.getEphemerals(l).size(), cleanEphemerals.size());
+            assertEquals(ephemerals.size(), cleanEphemerals.size(), "Should have same number of ephemerals in both followers");
+            assertEquals(lead.getEphemerals(l).size(), cleanEphemerals.size(), "Leader should equal follower");
         }
     }
 
@@ -638,7 +628,7 @@ public void testFollowerSendsLastZxid() throws Exception {
         assertEquals(0L, zk.testableLastZxid());
         zk.exists("/", false);
         long lzxid = zk.testableLastZxid();
-        assertTrue("lzxid:" + lzxid + " > 0", lzxid > 0);
+        assertTrue(lzxid > 0, "lzxid:" + lzxid + " > 0");
         zk.close();
         qu.shutdownAll();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java
index 747cb1c6a02..2136f4592ec 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java
index a48f4bcf572..a65cfb410ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.DataOutputStream;
@@ -32,9 +32,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.common.IOUtils;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,11 +41,9 @@ public class FourLetterWordsTest extends ClientBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(FourLetterWordsTest.class);
 
-    @Rule
-    public Timeout timeout = Timeout.millis(30000);
-
     /** Test the various four letter words */
     @Test
+    @Timeout(value = 30)
     public void testFourLetterWords() throws Exception {
         verify("ruok", "imok");
         verify("envi", "java.version");
@@ -130,6 +127,7 @@ private void verify(String cmd, String expected) throws IOException, SSLContextE
     }
 
     @Test
+    @Timeout(value = 30)
     public void testValidateStatOutput() throws Exception {
         ZooKeeper zk1 = createClient();
         ZooKeeper zk2 = createClient();
@@ -173,6 +171,7 @@ public void testValidateStatOutput() throws Exception {
     }
 
     @Test
+    @Timeout(value = 30)
     public void testValidateConsOutput() throws Exception {
         ZooKeeper zk1 = createClient();
         ZooKeeper zk2 = createClient();
@@ -184,7 +183,7 @@ public void testValidateConsOutput() throws Exception {
         int count = 0;
         while ((line = in.readLine()) != null && line.length() > 0) {
             count++;
-            assertTrue(line, Pattern.matches("^ /.*:\\d+\\[\\d+\\]\\(queued=\\d+,recved=\\d+,sent=\\d+.*\\)$", line));
+            assertTrue(Pattern.matches("^ /.*:\\d+\\[\\d+\\]\\(queued=\\d+,recved=\\d+,sent=\\d+.*\\)$", line), line);
         }
         // ensure at least the two clients we created are accounted for
         assertTrue(count >= 2);
@@ -193,7 +192,8 @@ public void testValidateConsOutput() throws Exception {
         zk2.close();
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testValidateSocketTimeout() throws Exception {
         /**
          * testing positive scenario that even with timeout parameter the
@@ -204,6 +204,7 @@ public void testValidateSocketTimeout() throws Exception {
     }
 
     @Test
+    @Timeout(value = 30)
     public void testSetTraceMask() throws Exception {
         String gtmkResp = sendRequest("gtmk");
         assertNotNull(gtmkResp);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java
index 8fb0a72d83a..06ca325579d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java
@@ -19,12 +19,13 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.server.command.FourLetterCommands;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,7 +39,8 @@ public class FourLetterWordsWhiteListTest extends ClientBase {
      * the case (except 'stat' command which is enabled in ClientBase
      * which other tests depend on.).
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsAllDisabledByDefault() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -62,7 +64,8 @@ public void testFourLetterWordsAllDisabledByDefault() throws Exception {
         verifyAllCommandsFail();
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsEnableSomeCommands() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -89,7 +92,8 @@ public void testFourLetterWordsEnableSomeCommands() throws Exception {
         verifyExactMatch("mntr", generateExpectedMessage("mntr"));
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testISROEnabledWhenReadOnlyModeEnabled() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -100,13 +104,14 @@ public void testISROEnabledWhenReadOnlyModeEnabled() throws Exception {
         System.clearProperty("readonlymode.enabled");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsInvalidConfiguration() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
         System.setProperty("zookeeper.4lw.commands.whitelist", "foo bar"
-                                                                       + " foo,,, "
-                                                                       + "bar :.,@#$%^&*() , , , , bar, bar, stat,        ");
+                + " foo,,, "
+                + "bar :.,@#$%^&*() , , , , bar, bar, stat,        ");
         startServer();
 
         // Just make sure we are good when admin made some mistakes in config file.
@@ -115,7 +120,8 @@ public void testFourLetterWordsInvalidConfiguration() throws Exception {
         verifyFuzzyMatch("stat", "Outstanding");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsEnableAllCommandsThroughAsterisk() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -124,13 +130,14 @@ public void testFourLetterWordsEnableAllCommandsThroughAsterisk() throws Excepti
         verifyAllCommandsSuccess();
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsEnableAllCommandsThroughExplicitList() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
         System.setProperty("zookeeper.4lw.commands.whitelist", "ruok, envi, conf, stat, srvr, cons, dump,"
-                                                                       + "wchs, wchp, wchc, srst, crst, "
-                                                                       + "dirs, mntr, gtmk, isro, stmk");
+                + "wchs, wchp, wchc, srst, crst, "
+                + "dirs, mntr, gtmk, isro, stmk");
         startServer();
         verifyAllCommandsSuccess();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
index 1d8c0fd3df3..6776fdf4e70 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -28,12 +28,15 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class GetChildren2Test extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -41,6 +44,7 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
index 207caf5b53c..ed6a30d487d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -40,7 +40,7 @@
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test loading committed proposal from txnlog. Learner uses these proposals to
@@ -68,7 +68,7 @@ public void testGetProposalFromTxn() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
 
         // Generate transaction so we will have some txnlog
@@ -90,7 +90,7 @@ public void testGetProposalFromTxn() throws Exception {
         // shutdown and start zookeeper again
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         zks.startdata();
 
@@ -117,10 +117,10 @@ public void testGetProposalFromTxn() throws Exception {
         }
 
         // All zxid should match what we created
-        assertTrue("Zxids missmatches", Arrays.equals(zxids, retrievedZxids.toArray(new Long[0])));
+        assertTrue(Arrays.equals(zxids, retrievedZxids.toArray(new Long[0])), "Zxids missmatches");
 
         // There should be 2000 create requests
-        assertTrue("create proposal count == " + MSG_COUNT, (createCount == MSG_COUNT));
+        assertTrue((createCount == MSG_COUNT), "create proposal count == " + MSG_COUNT);
 
         // We are requesting half the number of transaction from the snapshot
         // this should exceed threshold (ZKDatabase.snapshotSizeFactor)
@@ -128,7 +128,7 @@ public void testGetProposalFromTxn() throws Exception {
         long sizeLimit = db.calculateTxnLogSizeLimit();
 
         itr = db.getProposalsFromTxnLog(zxids[MSG_COUNT / 2], sizeLimit);
-        assertFalse("Expect empty proposal", (itr.hasNext()));
+        assertFalse((itr.hasNext()), "Expect empty proposal");
         f.shutdown();
         zks.shutdown();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
index 26a963fb6ef..35992513d61 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
@@ -33,7 +33,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 public class HierarchicalQuorumTest extends ClientBase {
@@ -63,6 +65,7 @@ public class HierarchicalQuorumTest extends ClientBase {
     Properties qp;
     protected final ClientHammerTest cht = new ClientHammerTest();
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         setupTestEnv();
@@ -204,7 +207,7 @@ void startServers(boolean withObservers) throws Exception {
 
         LOG.info("Closing ports {}", hostPort);
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
             LOG.info("{} is accepting client connections", hp);
         }
         final int numberOfPeers = 5;
@@ -254,6 +257,7 @@ void startServers(boolean withObservers) throws Exception {
         }
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         LOG.info("TearDown started");
@@ -271,7 +275,7 @@ public void tearDown() throws Exception {
         shutdown(s5);
 
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
             LOG.info("{} is no longer accepting client connections", hp);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
index 9003bb63c6c..80267054a26 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
@@ -28,7 +28,7 @@
 import org.apache.zookeeper.server.SnapshotFormatter;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -74,7 +74,7 @@ public void testSnapshot() throws Exception {
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
         LOG.info("starting up the zookeeper server .. waiting");
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             // we know this from the data files
@@ -86,7 +86,7 @@ public void testSnapshot() throws Exception {
         }
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
 
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
index 76845edd163..5b80574e6ed 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -124,7 +124,7 @@ public static Set<ObjectName> ensureAll(String... expectedNames) throws IOExcept
                 beans.removeAll(found);
             }
         } while ((expectedNames.length != found.size()) && (nTry < 600));
-        assertEquals("expected " + Arrays.toString(expectedNames), expectedNames.length, found.size());
+        assertEquals(expectedNames.length, found.size(), "expected " + Arrays.toString(expectedNames));
         return beans;
     }
 
@@ -244,7 +244,7 @@ public static Set<ObjectName> ensureParent(String... expectedNames) throws IOExc
                 beans.removeAll(found);
             }
         } while (expectedNames.length != found.size() && nTry < 120);
-        assertEquals("expected " + Arrays.toString(expectedNames), expectedNames.length, found.size());
+        assertEquals(expectedNames.length, found.size(), "expected " + Arrays.toString(expectedNames));
         return beans;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java
index 15b945566f3..9d0833205c9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class KeeperStateTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java
index ffa90e1c9ea..009415c3d9a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.List;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.ACL;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
index dd6e4cdd739..99cd171c01f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.nio.ByteBuffer;
 import java.util.ArrayList;
@@ -34,9 +34,9 @@
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -51,12 +51,12 @@ public class LeaderSessionTrackerTest extends ZKTestCase {
 
     QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qu = new QuorumUtil(1);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qu.shutdownAll();
     }
@@ -109,7 +109,7 @@ public void testCreateEphemeral(boolean localSessionEnabled) throws Exception {
         zk.create("/ok", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         Stat stat = zk.exists("/impossible", null);
-        assertEquals("Node from fake session get created", null, stat);
+        assertEquals(null, stat, "Node from fake session get created");
 
     }
 
@@ -147,7 +147,7 @@ public void testCreatePersistent() throws Exception {
         zk.create("/ok", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         Stat stat = zk.exists("/success", null);
-        assertTrue("Request from local sesson failed", stat != null);
+        assertTrue(stat != null, "Request from local sesson failed");
 
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
index a48ce0819bc..30c2772079a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
@@ -43,7 +43,7 @@
 import org.apache.zookeeper.txn.MultiTxn;
 import org.apache.zookeeper.txn.Txn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -151,17 +151,9 @@ private void doOp(FileTxnSnapLog logFile, int type, String path, DataTree dt, Da
         }
         LOG.info("Children: {} for {}", childStr, parentName);
         LOG.info("(cverions, pzxid): {}, {}", newCversion, newPzxid);
-        assertTrue(type
-                                  + " <cversion, pzxid> verification failed. Expected: <"
-                                  + (prevCversion + 1)
-                                  + ", "
-                                  + (prevPzxid
-                                             + 1)
-                                  + ">, found: <"
-                                  + newCversion
-                                  + ", "
-                                  + newPzxid
-                                  + ">", (newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1));
+        assertTrue((newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1),
+                type + " <cversion, pzxid> verification failed. Expected: <" + (prevCversion + 1) + ", "
+                        + (prevPzxid + 1) + ">, found: <" + newCversion + ", " + newPzxid + ">");
     }
 
     /**
@@ -180,7 +172,7 @@ public void testPad() throws Exception {
         FileHeader header = new FileHeader();
         header.deserialize(ia, "fileheader");
         LOG.info("Received magic : {} Expected : {}", header.getMagic(), FileTxnLog.TXNLOG_MAGIC);
-        assertTrue("Missing magic number ", header.getMagic() == FileTxnLog.TXNLOG_MAGIC);
+        assertTrue(header.getMagic() == FileTxnLog.TXNLOG_MAGIC, "Missing magic number ");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java
index 949cb0f961e..af597735353 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
@@ -36,8 +36,8 @@
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,7 +50,7 @@ public class LoadFromLogTest extends ClientBase {
     private static final int TRANSACTION_OVERHEAD = 2;
     private static final int TOTAL_TRANSACTIONS = NUM_MESSAGES + TRANSACTION_OVERHEAD;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         SyncRequestProcessor.setSnapCount(50);
         super.setUp();
@@ -82,7 +82,7 @@ public void testLoad() throws Exception {
         FileTxnIterator fileItr = (FileTxnIterator) itr;
         long storageSize = fileItr.getStorageSize();
         LOG.info("Txnlog size: {} bytes", storageSize);
-        assertTrue("Storage size is greater than zero ", (storageSize > 0));
+        assertTrue((storageSize > 0), "Storage size is greater than zero ");
 
         long expectedZxid = 0;
         long lastZxid = 0;
@@ -90,16 +90,12 @@ public void testLoad() throws Exception {
         do {
             hdr = itr.getHeader();
             expectedZxid++;
-            assertTrue("not the same transaction. lastZxid=" + lastZxid + ", zxid=" + hdr.getZxid(), lastZxid
-                                                                                                                    != hdr.getZxid());
-            assertTrue("excepting next transaction. expected=" + expectedZxid + ", retrieved=" + hdr.getZxid(), (
-                    hdr.getZxid()
-                            == expectedZxid));
+            assertTrue(lastZxid != hdr.getZxid(), "not the same transaction. lastZxid=" + lastZxid + ", zxid=" + hdr.getZxid());
+            assertTrue((hdr.getZxid() == expectedZxid), "excepting next transaction. expected=" + expectedZxid + ", retrieved=" + hdr.getZxid());
             lastZxid = hdr.getZxid();
         } while (itr.next());
 
-        assertTrue("processed all transactions. " + expectedZxid + " == " + TOTAL_TRANSACTIONS, (expectedZxid
-                                                                                                                == TOTAL_TRANSACTIONS));
+        assertTrue((expectedZxid == TOTAL_TRANSACTIONS), "processed all transactions. " + expectedZxid + " == " + TOTAL_TRANSACTIONS);
     }
 
     /**
@@ -125,7 +121,7 @@ public void testLoadFailure() throws Exception {
         // Verify that we have at least NUM_MESSAGES / SNAPCOUNT txnlog
         assertTrue(logFiles.length > NUM_MESSAGES / 100);
         // Delete the first log file, so we will fail to read it back from disk
-        assertTrue("delete the first log file", logFiles[0].delete());
+        assertTrue(logFiles[0].delete(), "delete the first log file");
 
         // Find zxid for the second log
         long secondStartZxid = Util.getZxidFromName(logFiles[1].getName(), "log");
@@ -194,7 +190,7 @@ public void testRestore() throws Exception {
         long fZxid = zks.getZKDatabase().getDataTreeLastProcessedZxid();
 
         // Verify lastProcessedZxid is set correctly
-        assertTrue("Restore failed expected zxid=" + eZxid + " found=" + fZxid, fZxid == eZxid);
+        assertTrue(fZxid == eZxid, "Restore failed expected zxid=" + eZxid + " found=" + fZxid);
         zk = createZKClient(hostPort);
 
         // Verify correctness of data and whether sequential znode creation
@@ -208,15 +204,10 @@ public void testRestore() throws Exception {
             zk.close();
         }
         LOG.info("Expected {} found {}", expectedPath, path);
-        assertTrue("Error in sequential znode creation expected "
-                                  + expectedPath
-                                  + " found "
-                                  + path, path.equals(expectedPath));
-        assertTrue("Unexpected number of children "
-                                  + children.length
-                                  + " expected "
-                                  + NUM_MESSAGES, (children.length
-                                                           == NUM_MESSAGES));
+        assertTrue(path.equals(expectedPath),
+                "Error in sequential znode creation expected " + expectedPath + " found " + path);
+        assertTrue((children.length == NUM_MESSAGES),
+                "Unexpected number of children " + children.length + " expected " + NUM_MESSAGES);
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
index d24faa64484..1c1c72e1a82 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.Request;
@@ -26,9 +26,9 @@
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,7 +45,7 @@ public class LocalSessionRequestTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -54,7 +54,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -82,12 +82,9 @@ private void validateRequestLog(long sessionId, int peerId) {
         QuorumPeer peer = qb.getPeerList().get(peerId);
         ZKDatabase db = peer.getActiveServer().getZKDatabase();
         for (Proposal p : db.getCommittedLog()) {
-            assertFalse("Should not see "
-                                       + Request.op2String(p.request.type)
-                                       + " request from local session 0x"
-                                       + session
-                                       + " on the "
-                                       + peerType, p.request.sessionId == sessionId);
+            assertFalse(p.request.sessionId == sessionId,
+                    "Should not see " + Request.op2String(p.request.type)
+                            + " request from local session 0x" + session + " on the " + peerType);
         }
     }
 
@@ -98,7 +95,7 @@ private void validateRequestLog(long sessionId, int peerId) {
      */
     public void testOpenCloseSession(boolean onLeader) throws Exception {
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int testPeerIdx = onLeader ? leaderIdx : followerIdx;
         int verifyPeerIdx = onLeader ? followerIdx : leaderIdx;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
index 2bd00d836de..98fafdfde52 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Map.Entry;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,7 +50,7 @@ public class LocalSessionsOnlyTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -59,7 +59,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -78,7 +78,7 @@ public void testLocalSessionsOnLeader() throws Exception {
     private void testLocalSessions(boolean testLeader) throws Exception {
         String nodePrefix = "/testLocalSessions-" + (testLeader ? "leaderTest-" : "followerTest-");
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
         String[] hostPorts = qb.hostPort.split(",");
@@ -120,11 +120,11 @@ private void testLocalSessions(boolean testLeader) throws Exception {
             assertFalse(newSessionId == localSessionId);
 
             for (int i = 0; i < 5; i++) {
-                assertNotNull("Data not exists in " + entry.getKey(), zk.exists(nodePrefix + i, null));
+                assertNotNull(zk.exists(nodePrefix + i, null), "Data not exists in " + entry.getKey());
             }
 
             // We may get the correct exception but the txn may go through
-            assertNull("Data exists in " + entry.getKey(), zk.exists(nodePrefix + "ephemeral", null));
+            assertNull(zk.exists(nodePrefix + "ephemeral", null), "Data exists in " + entry.getKey());
 
             zk.close();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
index c836e8314b4..e31eba26159 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
@@ -36,7 +36,7 @@
 import org.apache.zookeeper.server.util.LogChopper;
 import org.apache.zookeeper.txn.DeleteTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 class Pair<V1, V2> {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
index a927e3ef977..f7c7a9534d7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -27,7 +27,8 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.proto.ConnectRequest;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class MaxCnxnsTest extends ClientBase {
 
@@ -36,6 +37,7 @@ public class MaxCnxnsTest extends ClientBase {
     String host;
     int port;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         maxCnxns = numCnxns;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
index 5a94649de0d..0ee0825e9c3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -32,15 +32,15 @@
 import org.apache.zookeeper.OpResult.ErrorResult;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class MultiAsyncTransactionTest extends ClientBase {
 
     private ZooKeeper zk;
     private final AtomicInteger pendingOps = new AtomicInteger(0);
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         zk = createClient();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index 5dfd73e22ab..4ff593222fe 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -18,17 +18,16 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -52,7 +51,6 @@
 import org.apache.zookeeper.Transaction;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
@@ -60,34 +58,20 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.SyncRequestProcessor;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class MultiOperationTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(MultiOperationTest.class);
     private ZooKeeper zk;
     private ZooKeeper zk_chroot;
 
-    private final boolean useAsync;
-
-    public MultiOperationTest(boolean useAsync) {
-        this.useAsync = useAsync;
-    }
-
-    @Parameters
-    public static Collection<Object[]> configs() {
-        return Arrays.asList(new Object[][]{{false}, {true}});
-    }
-
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         SyncRequestProcessor.setSnapCount(150);
         super.setUp();
@@ -102,7 +86,7 @@ static class MultiResult {
 
     }
 
-    private List<OpResult> multi(ZooKeeper zk, Iterable<Op> ops) throws KeeperException, InterruptedException {
+    private List<OpResult> multi(ZooKeeper zk, Iterable<Op> ops, boolean useAsync) throws KeeperException, InterruptedException {
         if (useAsync) {
             final MultiResult res = new MultiResult();
             zk.multi(ops, new MultiCallback() {
@@ -135,7 +119,7 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
         }
     }
 
-    private void multiHavingErrors(ZooKeeper zk, Iterable<Op> ops, List<Integer> expectedResultCodes, String expectedErr) throws KeeperException, InterruptedException {
+    private void multiHavingErrors(ZooKeeper zk, Iterable<Op> ops, List<Integer> expectedResultCodes, String expectedErr, boolean useAsync) throws KeeperException, InterruptedException {
         if (useAsync) {
             final MultiResult res = new MultiResult();
             zk.multi(ops, new MultiCallback() {
@@ -156,23 +140,23 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
             }
             for (int i = 0; i < res.results.size(); i++) {
                 OpResult opResult = res.results.get(i);
-                assertTrue("Did't receive proper error response", opResult instanceof ErrorResult);
+                assertTrue(opResult instanceof ErrorResult, "Did't receive proper error response");
                 ErrorResult errRes = (ErrorResult) opResult;
-                assertEquals("Did't receive proper error code", expectedResultCodes.get(i).intValue(), errRes.getErr());
+                assertEquals(expectedResultCodes.get(i).intValue(), errRes.getErr(), "Did't receive proper error code");
             }
         } else {
             try {
                 zk.multi(ops);
                 fail("Shouldn't have validated in ZooKeeper client!");
             } catch (KeeperException e) {
-                assertEquals("Wrong exception", expectedErr, e.code().name());
+                assertEquals(expectedErr, e.code().name(), "Wrong exception");
             } catch (IllegalArgumentException e) {
-                assertEquals("Wrong exception", expectedErr, e.getMessage());
+                assertEquals(expectedErr, e.getMessage(), "Wrong exception");
             }
         }
     }
 
-    private List<OpResult> commit(Transaction txn) throws KeeperException, InterruptedException {
+    private List<OpResult> commit(Transaction txn, boolean useAsync) throws KeeperException, InterruptedException {
         if (useAsync) {
             final MultiResult res = new MultiResult();
             txn.commit(new MultiCallback() {
@@ -204,8 +188,10 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
     /**
      * Test verifies the multi calls with invalid znode path
      */
-    @Test(timeout = 90000)
-    public void testInvalidPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testInvalidPath(boolean useAsync) throws Exception {
         List<Integer> expectedResultCodes = new ArrayList<Integer>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
@@ -216,7 +202,7 @@ public void testInvalidPath() throws Exception {
                 Op.create("/multi1/", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
         String expectedErr = "Path must not end with / character";
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // create with valid sequential flag
         opList = Arrays.asList(
@@ -224,21 +210,21 @@ public void testInvalidPath() throws Exception {
                 Op.create("multi1/", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL.toFlag()),
                 Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
         expectedErr = "Path must start with / character";
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // check
         opList = Arrays.asList(
                 Op.check("/multi0", -1), Op.check("/multi1/", 100),
                 Op.check("/multi2", 5));
         expectedErr = "Path must not end with / character";
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // delete
         opList = Arrays.asList(
                 Op.delete("/multi0", -1),
                 Op.delete("/multi1/", 100),
                 Op.delete("/multi2", 5));
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // Multiple bad arguments
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
@@ -249,7 +235,7 @@ public void testInvalidPath() throws Exception {
                 Op.setData("/multi1/", new byte[0], -1),
                 Op.setData("/multi2", new byte[0], -1),
                 Op.setData("multi3", new byte[0], -1));
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
     }
 
     /**
@@ -260,8 +246,9 @@ public void testInvalidPath() throws Exception {
      * 2. ephemeral nodes under that directory are deleted
      * 3. multi delete should succeed.
      */
-    @Test
-    public void testMultiRollback() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiRollback(boolean useAsync) throws Exception {
         zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         ZooKeeper epheZk = createClient();
@@ -304,8 +291,10 @@ public void testMultiRollback() throws Exception {
     /**
      * Test verifies the multi calls with blank znode path
      */
-    @Test(timeout = 90000)
-    public void testBlankPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testBlankPath(boolean useAsync) throws Exception {
         List<Integer> expectedResultCodes = new ArrayList<Integer>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
@@ -319,14 +308,16 @@ public void testBlankPath() throws Exception {
                 Op.delete(null, 100),
                 Op.delete("/multi2", 5),
                 Op.delete("", -1));
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
     }
 
     /**
      * Test verifies the multi.create with invalid createModeFlag
      */
-    @Test(timeout = 90000)
-    public void testInvalidCreateModeFlag() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testInvalidCreateModeFlag(boolean useAsync) throws Exception {
         List<Integer> expectedResultCodes = new ArrayList<Integer>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
@@ -338,33 +329,35 @@ public void testInvalidCreateModeFlag() throws Exception {
                 Op.create("/multi1", new byte[0], Ids.OPEN_ACL_UNSAFE, createModeFlag),
                 Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
         String expectedErr = KeeperException.Code.BADARGUMENTS.name();
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
     }
 
-    @Test
-    public void testChRootCreateDelete() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootCreateDelete(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // Creating child using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         Op createChild = Op.create("/myid", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        multi(zk_chroot, Arrays.asList(createChild));
+        multi(zk_chroot, Arrays.asList(createChild), useAsync);
 
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk.exists(chRoot + "/myid", false));
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk_chroot.exists("/myid", false));
-        assertNull("zNode is created directly under '/', ignored configured chroot", zk.exists("/myid", false));
+        assertNotNull(zk.exists(chRoot + "/myid", false), "zNode is not created under chroot:" + chRoot);
+        assertNotNull(zk_chroot.exists("/myid", false), "zNode is not created under chroot:" + chRoot);
+        assertNull(zk.exists("/myid", false), "zNode is created directly under '/', ignored configured chroot");
 
         // Deleting child using chRoot client.
         Op deleteChild = Op.delete("/myid", 0);
-        multi(zk_chroot, Arrays.asList(deleteChild));
-        assertNull("zNode exists under chroot:" + chRoot, zk.exists(chRoot + "/myid", false));
-        assertNull("zNode exists under chroot:" + chRoot, zk_chroot.exists("/myid", false));
+        multi(zk_chroot, Arrays.asList(deleteChild), useAsync);
+        assertNull(zk.exists(chRoot + "/myid", false), "zNode exists under chroot:" + chRoot);
+        assertNull(zk_chroot.exists("/myid", false), "zNode exists under chroot:" + chRoot);
     }
 
-    @Test
-    public void testChRootSetData() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootSetData(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // setData using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String[] names = {"/multi0", "/multi1", "/multi2"};
@@ -375,17 +368,18 @@ public void testChRootSetData() throws Exception {
             ops.add(Op.setData(names[i], names[i].getBytes(), 0));
         }
 
-        multi(zk_chroot, ops);
+        multi(zk_chroot, ops, useAsync);
 
         for (int i = 0; i < names.length; i++) {
-            assertArrayEquals("zNode data not matching", names[i].getBytes(), zk_chroot.getData(names[i], false, null));
+            assertArrayEquals(names[i].getBytes(), zk_chroot.getData(names[i], false, null), "zNode data not matching");
         }
     }
 
-    @Test
-    public void testChRootCheck() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootCheck(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // checking the child version using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String[] names = {"/multi0", "/multi1", "/multi2"};
@@ -397,13 +391,14 @@ public void testChRootCheck() throws Exception {
         for (int i = 0; i < names.length; i++) {
             ops.add(Op.check(names[i], 0));
         }
-        multi(zk_chroot, ops);
+        multi(zk_chroot, ops, useAsync);
     }
 
-    @Test
-    public void testChRootTransaction() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootTransaction(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // checking the child version using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String childPath = "/myid";
@@ -411,79 +406,87 @@ public void testChRootTransaction() throws Exception {
         transaction.create(childPath, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         transaction.check(childPath, 0);
         transaction.setData(childPath, childPath.getBytes(), 0);
-        commit(transaction);
+        commit(transaction, useAsync);
 
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk.exists(chRoot + childPath, false));
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk_chroot.exists(childPath, false));
-        assertNull("zNode is created directly under '/', ignored configured chroot", zk.exists(childPath, false));
-        assertArrayEquals("zNode data not matching", childPath.getBytes(), zk_chroot.getData(childPath, false, null));
+        assertNotNull(zk.exists(chRoot + childPath, false), "zNode is not created under chroot:" + chRoot);
+        assertNotNull(zk_chroot.exists(childPath, false), "zNode is not created under chroot:" + chRoot);
+        assertNull(zk.exists(childPath, false), "zNode is created directly under '/', ignored configured chroot");
+        assertArrayEquals(childPath.getBytes(), zk_chroot.getData(childPath, false, null), "zNode data not matching");
 
         transaction = zk_chroot.transaction();
         // Deleting child using chRoot client.
         transaction.delete(childPath, 1);
-        commit(transaction);
+        commit(transaction, useAsync);
 
-        assertNull("chroot:" + chRoot + " exists after delete", zk.exists(chRoot + "/myid", false));
-        assertNull("chroot:" + chRoot + " exists after delete", zk_chroot.exists("/myid", false));
+        assertNull(zk.exists(chRoot + "/myid", false), "chroot:" + chRoot + " exists after delete");
+        assertNull(zk_chroot.exists("/myid", false), "chroot:" + chRoot + " exists after delete");
     }
 
-    private String createNameSpace() throws InterruptedException, KeeperException {
+    private String createNameSpace(boolean useAsync) throws InterruptedException, KeeperException {
         // creating the subtree for chRoot clients.
         String chRoot = "/appsX";
         Op createChRoot = Op.create(chRoot, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        multi(zk, Arrays.asList(createChRoot));
+        multi(zk, Arrays.asList(createChRoot), useAsync);
         return chRoot;
     }
 
-    @Test
-    public void testCreate() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testCreate(boolean useAsync) throws Exception {
         multi(zk, Arrays.asList(
                 Op.create("/multi0", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.create("/multi1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)));
+                Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)),
+                useAsync);
         zk.getData("/multi0", false, null);
         zk.getData("/multi1", false, null);
         zk.getData("/multi2", false, null);
     }
 
-    @Test
-    public void testEmpty() throws Exception {
-        multi(zk, Arrays.asList());
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testEmpty(boolean useAsync) throws Exception {
+        multi(zk, Arrays.asList(), useAsync);
     }
 
-    @Test
-    public void testCreateDelete() throws Exception {
-
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testCreateDelete(boolean useAsync) throws Exception {
         multi(zk, Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                Op.delete("/multi", 0)));
+                Op.delete("/multi", 0)),
+                useAsync);
 
         // '/multi' should have been deleted
         assertNull(zk.exists("/multi", null));
     }
 
-    @Test
-    public void testInvalidVersion() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testInvalidVersion(boolean useAsync) throws Exception {
 
         try {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                    Op.delete("/multi", 1)));
+                    Op.delete("/multi", 1)),
+                    useAsync);
             fail("delete /multi should have failed");
         } catch (KeeperException e) {
             /* PASS */
         }
     }
 
-    @Test
-    public void testNestedCreate() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testNestedCreate(boolean useAsync) throws Exception {
 
         multi(zk, Arrays.asList(
                 /* Create */
-                Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT), Op.create("/multi/a", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT), Op.create("/multi/a/1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-
+                Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+                Op.create("/multi/a", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+                Op.create("/multi/a/1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 /* Delete */
-                Op.delete("/multi/a/1", 0), Op.delete("/multi/a", 0), Op.delete("/multi", 0)));
+                Op.delete("/multi/a/1", 0), Op.delete("/multi/a", 0), Op.delete("/multi", 0)), useAsync);
 
         //Verify tree deleted
         assertNull(zk.exists("/multi/a/1", null));
@@ -491,8 +494,9 @@ public void testNestedCreate() throws Exception {
         assertNull(zk.exists("/multi", null));
     }
 
-    @Test
-    public void testSetData() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetData(boolean useAsync) throws Exception {
 
         String[] names = {"/multi0", "/multi1", "/multi2"};
         List<Op> ops = new ArrayList<Op>();
@@ -502,15 +506,16 @@ public void testSetData() throws Exception {
             ops.add(Op.setData(names[i], names[i].getBytes(), 0));
         }
 
-        multi(zk, ops);
+        multi(zk, ops, useAsync);
 
         for (int i = 0; i < names.length; i++) {
             assertArrayEquals(names[i].getBytes(), zk.getData(names[i], false, null));
         }
     }
 
-    @Test
-    public void testUpdateConflict() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testUpdateConflict(boolean useAsync) throws Exception {
 
         assertNull(zk.exists("/multi", null));
 
@@ -518,7 +523,8 @@ public void testUpdateConflict() throws Exception {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                     Op.setData("/multi", "X".getBytes(), 0),
-                    Op.setData("/multi", "Y".getBytes(), 0)));
+                    Op.setData("/multi", "Y".getBytes(), 0)),
+                    useAsync);
             fail("Should have thrown a KeeperException for invalid version");
         } catch (KeeperException e) {
             //PASS
@@ -531,20 +537,23 @@ public void testUpdateConflict() throws Exception {
         multi(zk, Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.setData("/multi", "X".getBytes(), 0),
-                Op.setData("/multi", "Y".getBytes(), 1)));
+                Op.setData("/multi", "Y".getBytes(), 1)),
+                useAsync);
 
         assertArrayEquals(zk.getData("/multi", false, null), "Y".getBytes());
     }
 
-    @Test
-    public void testDeleteUpdateConflict() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testDeleteUpdateConflict(boolean useAsync) throws Exception {
 
         /* Delete of a node folowed by an update of the (now) deleted node */
         try {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                     Op.delete("/multi", 0),
-                    Op.setData("/multi", "Y".getBytes(), 0)));
+                    Op.setData("/multi", "Y".getBytes(), 0)),
+                    useAsync);
             fail("/multi should have been deleted so setData should have failed");
         } catch (KeeperException e) {
             /* PASS */
@@ -554,8 +563,9 @@ public void testDeleteUpdateConflict() throws Exception {
         assertNull(zk.exists("/multi", null));
     }
 
-    @Test
-    public void testGetResults() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetResults(boolean useAsync) throws Exception {
         /* Delete of a node folowed by an update of the (now) deleted node */
         Iterable<Op> ops = Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
@@ -581,8 +591,8 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
                     res.wait();
                 }
             }
-            assertFalse("/multi should have been deleted so setData should have failed", KeeperException.Code.OK.intValue()
-                                                                                                        == res.rc);
+            assertFalse(KeeperException.Code.OK.intValue() == res.rc,
+                    "/multi should have been deleted so setData should have failed");
             assertNull(zk.exists("/multi", null));
             results = res.results;
         } else {
@@ -609,8 +619,9 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
     /**
      * Exercise the equals methods of OpResult classes.
      */
-    @Test
-    public void testOpResultEquals() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testOpResultEquals(boolean useAsync) {
         opEquals(new CreateResult("/foo"), new CreateResult("/foo"), new CreateResult("nope"));
 
         opEquals(new CreateResult("/foo"), new CreateResult("/foo"), new CreateResult("/foo", new Stat(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11)));
@@ -638,24 +649,28 @@ private void opEquals(OpResult expected, OpResult value, OpResult near) {
         assertTrue(value.equals(expected));
     }
 
-    @Test
-    public void testWatchesTriggered() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testWatchesTriggered(boolean useAsync) throws KeeperException, InterruptedException {
         HasTriggeredWatcher watcher = new HasTriggeredWatcher();
         zk.getChildren("/", watcher);
         multi(zk, Arrays.asList(
                 Op.create("/t", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                Op.delete("/t", -1)));
+                Op.delete("/t", -1)),
+                useAsync);
         assertTrue(watcher.triggered.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
     }
 
-    @Test
-    public void testNoWatchesTriggeredForFailedMultiRequest() throws InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testNoWatchesTriggeredForFailedMultiRequest(boolean useAsync) throws InterruptedException, KeeperException {
         HasTriggeredWatcher watcher = new HasTriggeredWatcher();
         zk.getChildren("/", watcher);
         try {
             multi(zk, Arrays.asList(
                     Op.create("/t", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                    Op.delete("/nonexisting", -1)));
+                    Op.delete("/nonexisting", -1)),
+                    useAsync);
             fail("expected previous multi op to fail!");
         } catch (KeeperException.NoNodeException e) {
             // expected
@@ -668,9 +683,14 @@ public void testNoWatchesTriggeredForFailedMultiRequest() throws InterruptedExce
         assertEquals(1, watcher.triggered.getCount());
     }
 
-    @Test
-    public void testTransactionBuilder() throws Exception {
-        List<OpResult> results = commit(zk.transaction().create("/t1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT).create("/t1/child", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT).create("/t2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL));
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testTransactionBuilder(boolean useAsync) throws Exception {
+        List<OpResult> results = commit(
+                zk.transaction()
+                        .create("/t1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)
+                        .create("/t1/child", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)
+                        .create("/t2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL), useAsync);
         assertEquals(3, results.size());
         for (OpResult r : results) {
             CreateResult c = (CreateResult) r;
@@ -681,7 +701,7 @@ public void testTransactionBuilder() throws Exception {
         assertNotNull(zk.exists("/t1/child", false));
         assertNotNull(zk.exists("/t2", false));
 
-        results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 0));
+        results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 0), useAsync);
         assertEquals(3, results.size());
         for (OpResult r : results) {
             CheckResult c = (CheckResult) r;
@@ -689,29 +709,29 @@ public void testTransactionBuilder() throws Exception {
         }
 
         try {
-            results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 1));
+            results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 1), useAsync);
             fail();
         } catch (KeeperException.BadVersionException e) {
             // expected
         }
 
-        results = commit(zk.transaction().check("/t1", 0).setData("/t1", new byte[0], 0));
+        results = commit(zk.transaction().check("/t1", 0).setData("/t1", new byte[0], 0), useAsync);
         assertEquals(2, results.size());
         for (OpResult r : results) {
             assertNotNull(r.toString());
         }
 
         try {
-            results = commit(zk.transaction().check("/t1", 1).setData("/t1", new byte[0], 2));
+            results = commit(zk.transaction().check("/t1", 1).setData("/t1", new byte[0], 2), useAsync);
             fail();
         } catch (KeeperException.BadVersionException e) {
             // expected
         }
 
-        results = commit(zk.transaction().check("/t1", 1).check("/t1/child", 0).check("/t2", 0));
+        results = commit(zk.transaction().check("/t1", 1).check("/t1/child", 0).check("/t2", 0), useAsync);
         assertEquals(3, results.size());
 
-        results = commit(zk.transaction().delete("/t2", -1).delete("/t1/child", -1));
+        results = commit(zk.transaction().delete("/t2", -1).delete("/t1/child", -1), useAsync);
         assertEquals(2, results.size());
         for (OpResult r : results) {
             DeleteResult d = (DeleteResult) r;
@@ -722,8 +742,9 @@ public void testTransactionBuilder() throws Exception {
         assertNull(zk.exists("/t2", false));
     }
 
-    @Test
-    public void testMultiGetChildren() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildren(boolean useAsync) throws Exception {
         List<String> topLevelNodes = new ArrayList<String>();
         Map<String, List<String>> childrenNodes = new HashMap<String, List<String>>();
         // Creating a database where '/fooX' nodes has 'barXY' named children.
@@ -740,7 +761,7 @@ public void testMultiGetChildren() throws Exception {
             }
         }
         // Create a multi operation, which queries the children of the nodes in topLevelNodes.
-        List<OpResult> multiChildrenList = multi(zk, topLevelNodes.stream().map(Op::getChildren).collect(Collectors.toList()));
+        List<OpResult> multiChildrenList = multi(zk, topLevelNodes.stream().map(Op::getChildren).collect(Collectors.toList()), useAsync);
         for (int i = 0; i < topLevelNodes.size(); i++) {
             String nodeName = topLevelNodes.get(i);
             assertTrue(multiChildrenList.get(i) instanceof OpResult.GetChildrenResult);
@@ -753,8 +774,9 @@ public void testMultiGetChildren() throws Exception {
         }
     }
 
-    @Test
-    public void testMultiGetChildrenSameNode() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenSameNode(boolean useAsync) throws Exception {
         List<String> childrenNodes = new ArrayList<String>();
         // Creating a database where '/foo' node has 'barX' named children.
         String topLevelNode = "/foo";
@@ -769,7 +791,8 @@ public void testMultiGetChildrenSameNode() throws Exception {
         // Check for getting the children of the same node twice.
         List<OpResult> sameChildrenList = multi(zk, Arrays.asList(
                 Op.getChildren(topLevelNode),
-                Op.getChildren(topLevelNode)));
+                Op.getChildren(topLevelNode)),
+                useAsync);
         // The response should contain two elements which are the same.
         assertEquals(sameChildrenList.size(), 2);
         assertEquals(sameChildrenList.get(0), sameChildrenList.get(1));
@@ -780,15 +803,16 @@ public void testMultiGetChildrenSameNode() throws Exception {
         assertEquals(new TreeSet<String>(gcr.getChildren()), new TreeSet<String>(childrenNodes));
     }
 
-    @Test
-    public void testMultiGetChildrenAuthentication() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenAuthentication(boolean useAsync) throws KeeperException, InterruptedException {
         List<ACL> writeOnly = Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("world", "anyone")));
         zk.create("/foo_auth", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_auth/bar", null, Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_no_auth", null, writeOnly, CreateMode.PERSISTENT);
 
         // Check for normal behaviour.
-        List<OpResult> multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth")));
+        List<OpResult> multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth")), useAsync);
         assertEquals(multiChildrenList.size(), 1);
         assertTrue(multiChildrenList.get(0) instanceof OpResult.GetChildrenResult);
         List<String> childrenList = ((OpResult.GetChildrenResult) multiChildrenList.get(0)).getChildren();
@@ -796,16 +820,18 @@ public void testMultiGetChildrenAuthentication() throws KeeperException, Interru
         assertEquals(childrenList.get(0), "bar");
 
         // Check for authentication violation.
-        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth")));
+        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth")), useAsync);
 
         assertEquals(multiChildrenList.size(), 1);
         assertTrue(multiChildrenList.get(0) instanceof OpResult.ErrorResult);
-        assertEquals("Expected NoAuthException for getting the children of a write only node", ((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue());
+        assertEquals(((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue(),
+                "Expected NoAuthException for getting the children of a write only node");
 
     }
 
-    @Test
-    public void testMultiGetChildrenMixedAuthenticationErrorFirst() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenMixedAuthenticationErrorFirst(boolean useAsync) throws KeeperException, InterruptedException {
         List<ACL> writeOnly = Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("world", "anyone")));
         zk.create("/foo_auth", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_auth/bar", null, Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -813,11 +839,12 @@ public void testMultiGetChildrenMixedAuthenticationErrorFirst() throws KeeperExc
         List<OpResult> multiChildrenList;
 
         // Mixed nodes, the operation after the error should return RuntimeInconsistency error.
-        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth"), Op.getChildren("/foo_auth")));
+        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth"), Op.getChildren("/foo_auth")), useAsync);
 
         assertEquals(multiChildrenList.size(), 2);
         assertTrue(multiChildrenList.get(0) instanceof OpResult.ErrorResult);
-        assertEquals("Expected NoAuthException for getting the children of a write only node", ((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue());
+        assertEquals(((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue(),
+                "Expected NoAuthException for getting the children of a write only node");
 
         assertTrue(multiChildrenList.get(1) instanceof OpResult.GetChildrenResult);
         List<String> childrenList = ((OpResult.GetChildrenResult) multiChildrenList.get(1)).getChildren();
@@ -825,8 +852,9 @@ public void testMultiGetChildrenMixedAuthenticationErrorFirst() throws KeeperExc
         assertEquals(childrenList.get(0), "bar");
     }
 
-    @Test
-    public void testMultiGetChildrenMixedAuthenticationCorrectFirst() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenMixedAuthenticationCorrectFirst(boolean useAsync) throws KeeperException, InterruptedException {
         List<ACL> writeOnly = Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("world", "anyone")));
         zk.create("/foo_auth", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_auth/bar", null, Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -835,7 +863,7 @@ public void testMultiGetChildrenMixedAuthenticationCorrectFirst() throws KeeperE
         // Check for getting the children of the nodes with mixed authentication.
         // The getChildren operation returns GetChildrenResult if it happened before the error.
         List<OpResult> multiChildrenList;
-        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth"), Op.getChildren("/foo_no_auth")));
+        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth"), Op.getChildren("/foo_no_auth")), useAsync);
         assertSame(multiChildrenList.size(), 2);
 
         assertTrue(multiChildrenList.get(0) instanceof OpResult.GetChildrenResult);
@@ -844,22 +872,25 @@ public void testMultiGetChildrenMixedAuthenticationCorrectFirst() throws KeeperE
         assertEquals(childrenList.get(0), "bar");
 
         assertTrue(multiChildrenList.get(1) instanceof OpResult.ErrorResult);
-        assertEquals("Expected NoAuthException for getting the children of a write only node", ((OpResult.ErrorResult) multiChildrenList.get(1)).getErr(), KeeperException.Code.NOAUTH.intValue());
+        assertEquals(((OpResult.ErrorResult) multiChildrenList.get(1)).getErr(), KeeperException.Code.NOAUTH.intValue(),
+                "Expected NoAuthException for getting the children of a write only node");
     }
 
-    @Test
-    public void testMultiGetData() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetData(boolean useAsync) throws Exception {
         zk.create("/node1", "data1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/node2", "data2".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        List<OpResult> multiData = multi(zk, Arrays.asList(Op.getData("/node1"), Op.getData("/node2")));
+        List<OpResult> multiData = multi(zk, Arrays.asList(Op.getData("/node1"), Op.getData("/node2")), useAsync);
         assertEquals(multiData.size(), 2);
         assertArrayEquals(((OpResult.GetDataResult) multiData.get(0)).getData(), "data1".getBytes());
         assertArrayEquals(((OpResult.GetDataResult) multiData.get(1)).getData(), "data2".getBytes());
     }
 
-    @Test
-    public void testMultiRead() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiRead(boolean useAsync) throws Exception {
         zk.create("/node1", "data1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/node2", "data2".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         zk.create("/node1/node1", "data11".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -869,7 +900,8 @@ public void testMultiRead() throws Exception {
                 Op.getChildren("/node1"),
                 Op.getData("/node1"),
                 Op.getChildren("/node2"),
-                Op.getData("/node2")));
+                Op.getData("/node2")),
+                useAsync);
         assertEquals(multiRead.size(), 4);
         assertTrue(multiRead.get(0) instanceof OpResult.GetChildrenResult);
         List<String> childrenList = ((OpResult.GetChildrenResult) multiRead.get(0)).getChildren();
@@ -904,13 +936,15 @@ public void testMultiRead() throws Exception {
         assertEquals(0, stat.getNumChildren());
     }
 
-    @Test
-    public void testMixedReadAndTransaction() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMixedReadAndTransaction(boolean useAsync) throws Exception {
         zk.create("/node", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         try {
             List<OpResult> multiRead = multi(zk, Arrays.asList(
                     Op.setData("/node1", "data1".getBytes(), -1),
-                    Op.getData("/node1")));
+                    Op.getData("/node1")),
+                    useAsync);
             fail("Mixed kind of operations are not allowed");
         } catch (IllegalArgumentException e) {
             // expected
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java
index 7ea295a5579..3feadfdafe0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.NIOServerCnxnFactory;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -60,7 +60,7 @@ public void testFileDescriptorLeak() throws Exception {
         LOG.info("End fdcount is: {}", endFdCount);
 
         // On my box, if selector.close() is not called fd diff is > 700.
-        assertTrue("Possible fd leakage", ((endFdCount - startFdCount) < 50));
+        assertTrue(((endFdCount - startFdCount) < 50), "Possible fd leakage");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java
index ffc2b76134d..2964926fb75 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java
@@ -22,10 +22,10 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 
@@ -35,25 +35,25 @@
 @RunWith(Suite.class)
 public class NettyNettySuiteBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, NettyServerCnxnFactory.class.getName());
         System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, ClientCnxnSocketNetty.class.getName());
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDown() {
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
     }
 
-    @Before
+    @BeforeEach
     public void setUpTest() throws Exception {
         TestByteBufAllocatorTestHelper.setTestAllocator(TestByteBufAllocator.getInstance());
     }
 
-    @After
+    @AfterEach
     public void tearDownTest() throws Exception {
         TestByteBufAllocatorTestHelper.clearTestAllocator();
         TestByteBufAllocator.checkForLeaks();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
index 074d5868b5a..375fafe4a56 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
@@ -18,12 +18,15 @@
 
 package org.apache.zookeeper.test;
 
-import org.junit.runners.Suite;
+import org.junit.platform.runner.JUnitPlatform;
+import org.junit.platform.suite.api.SelectClasses;
+import org.junit.runner.RunWith;
 
 /**
  * Run tests with: Netty Client against Netty server
  */
-@Suite.SuiteClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, ReconfigTest.class, SessionTest.class, WatcherTest.class})
+@RunWith(JUnitPlatform.class)
+@SelectClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, ReconfigTest.class, SessionTest.class, WatcherTest.class})
 public class NettyNettySuiteTest extends NettyNettySuiteBase {
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java
index 1d6b821831a..d3d6b9bca3f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java
@@ -20,10 +20,10 @@
 
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 
@@ -33,23 +33,23 @@
 @RunWith(Suite.class)
 public class NioNettySuiteBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, NettyServerCnxnFactory.class.getName());
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDown() {
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
     }
 
-    @Before
+    @BeforeEach
     public void setUpTest() throws Exception {
         TestByteBufAllocatorTestHelper.setTestAllocator(TestByteBufAllocator.getInstance());
     }
 
-    @After
+    @AfterEach
     public void tearDownTest() throws Exception {
         TestByteBufAllocatorTestHelper.clearTestAllocator();
         TestByteBufAllocator.checkForLeaks();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
index f729920e443..3eaa1d3ffcf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.UUID;
 import org.apache.zookeeper.CreateMode;
@@ -36,7 +36,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * This class tests the non-recoverable error behavior of quorum server.
@@ -50,7 +51,8 @@ public class NonRecoverableErrorTest extends QuorumPeerTestBase {
      * Test to verify that even after non recoverable error (error while
      * writing transaction log), ZooKeeper is still available.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testZooKeeperServiceAvailableOnLeader() throws Exception {
         int SERVER_COUNT = 3;
         final int[] clientPorts = new int[SERVER_COUNT];
@@ -74,8 +76,8 @@ public void testZooKeeperServiceAvailableOnLeader() throws Exception {
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watcher = new CountdownWatcher();
@@ -87,7 +89,7 @@ public void testZooKeeperServiceAvailableOnLeader() throws Exception {
 
         // get information of current leader
         QuorumPeer leader = getLeaderQuorumPeer(mt);
-        assertNotNull("Leader must have been elected by now", leader);
+        assertNotNull(leader, "Leader must have been elected by now");
 
         // inject problem in leader
         FileTxnSnapLog snapLog = leader.getActiveServer().getTxnLogFactory();
@@ -121,8 +123,8 @@ public void commit() throws IOException {
         // takes place
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         // revert back the error
@@ -130,14 +132,14 @@ public void commit() throws IOException {
 
         // verify that now ZooKeeper service is up and running
         leader = getLeaderQuorumPeer(mt);
-        assertNotNull("New leader must have been elected by now", leader);
+        assertNotNull(leader, "New leader must have been elected by now");
 
         String uniqueNode = uniqueZnode();
         watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         String createNode = zk.create(uniqueNode, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         // if node is created successfully then it means that ZooKeeper service
         // is available
-        assertEquals("Failed to create znode", uniqueNode, createNode);
+        assertEquals(uniqueNode, createNode, "Failed to create znode");
         zk.close();
         // stop all severs
         for (int i = 0; i < SERVER_COUNT; i++) {
@@ -154,7 +156,7 @@ private void waitForNewLeaderElection(QuorumPeer peer, long leaderCurrentEpoch)
             }
             count--;
         }
-        assertNotEquals("New LE cycle must have triggered", leaderCurrentEpoch, peer.getCurrentEpoch());
+        assertNotEquals(leaderCurrentEpoch, peer.getCurrentEpoch(), "New LE cycle must have triggered");
     }
 
     private QuorumPeer getLeaderQuorumPeer(MainThread[] mt) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java
index 9356ee47dea..39cde4fd26e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -28,13 +28,16 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class NullDataTest extends ClientBase implements StatCallback {
 
     String snapCount;
     CountDownLatch cn = new CountDownLatch(1);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         // Change the snapcount to happen more often
@@ -43,6 +46,7 @@ public void setUp() throws Exception {
         super.setUp();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         System.setProperty("zookeeper.snapCount", snapCount);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java
index 05d02ae0d4d..4585a0558ee 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.ArrayList;
@@ -34,15 +34,15 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Ignore;
-import org.junit.Test;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
 
 public class OOMTest extends ZKTestCase {
 
     private static final Watcher TEST_WATCHER = event -> System.err.println("Got event: " + event);
 
     @Test
-    @Ignore
+    @Disabled
     public void testOOM() throws IOException, InterruptedException, KeeperException {
         File tmpDir = ClientBase.createTmpDir();
         // Grab some memory so that it is easier to cause an
@@ -62,7 +62,7 @@ public void testOOM() throws IOException, InterruptedException, KeeperException
         final int PORT = PortAssignment.unique();
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server up", ClientBase.waitForServerUp("127.0.0.1:" + PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + PORT, CONNECTION_TIMEOUT), "waiting for server up");
 
         System.err.println("OOM Stage 0");
         utestPrep(PORT);
@@ -97,9 +97,8 @@ public void testOOM() throws IOException, InterruptedException, KeeperException
 
         f.shutdown();
         zks.shutdown();
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT),
+                "waiting for server down");
     }
 
     private void utestExists(int port) throws IOException, InterruptedException, KeeperException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java
index edc90fe0eee..7222d4f1a6f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -34,10 +34,10 @@ public class OSMXBeanTest extends ZKTestCase {
     private Long mfdc = 0L;
     protected static final Logger LOG = LoggerFactory.getLogger(OSMXBeanTest.class);
 
-    @Before
+    @BeforeEach
     public void initialize() {
         this.osMbean = new OSMXBean();
-        assertNotNull("Could not initialize OSMXBean object!", osMbean);
+        assertNotNull(osMbean, "Could not initialize OSMXBean object!");
     }
 
     @Test
@@ -56,7 +56,7 @@ public final void testGetOpenFileDescriptorCount() {
             ofdc = osMbean.getOpenFileDescriptorCount();
             LOG.info("open fdcount is: {}", ofdc);
         }
-        assertFalse("The number of open file descriptor is negative", (ofdc < 0));
+        assertFalse((ofdc < 0), "The number of open file descriptor is negative");
     }
 
     @Test
@@ -65,7 +65,7 @@ public final void testGetMaxFileDescriptorCount() {
             mfdc = osMbean.getMaxFileDescriptorCount();
             LOG.info("max fdcount is: {}", mfdc);
         }
-        assertFalse("The max file descriptor number is negative", (mfdc < 0));
+        assertFalse((mfdc < 0), "The max file descriptor number is negative");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java
index fd1609118e7..ea5f863395b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java
@@ -18,7 +18,7 @@
 package org.apache.zookeeper.test;
 
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ObserverHierarchicalQuorumTest extends HierarchicalQuorumTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
index 273b05e5384..014ccb4df0c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
@@ -18,22 +18,22 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumStats;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ObserverLETest extends ZKTestCase {
 
     final QuorumBase qb = new QuorumBase();
     final ClientTest ct = new ClientTest();
 
-    @Before
+    @BeforeEach
     public void establishThreeParticipantOneObserverEnsemble() throws Exception {
         qb.setUp(true);
         ct.hostPort = qb.hostPort;
@@ -41,7 +41,7 @@ public void establishThreeParticipantOneObserverEnsemble() throws Exception {
         qb.s5.shutdown();
     }
 
-    @After
+    @AfterEach
     public void shutdownQuorum() throws Exception {
         ct.tearDownAll();
         qb.tearDown();
@@ -59,17 +59,15 @@ public void testLEWithObserver() throws Exception {
         for (QuorumPeer server : Arrays.asList(qb.s1, qb.s2, qb.s3)) {
             if (server.getServerState().equals(QuorumStats.Provider.FOLLOWING_STATE)) {
                 server.shutdown();
-                assertTrue(
-                        "Waiting for server down",
-                        ClientBase.waitForServerDown("127.0.0.1:" + server.getClientPort(), ClientBase.CONNECTION_TIMEOUT));
+                assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + server.getClientPort(), ClientBase.CONNECTION_TIMEOUT),
+                        "Waiting for server down");
             } else {
-                assertNull("More than one leader found", leader);
+                assertNull(leader, "More than one leader found");
                 leader = server;
             }
         }
-        assertTrue(
-                "Leader is not in Looking state",
-                ClientBase.waitForServerState(leader, ClientBase.CONNECTION_TIMEOUT, QuorumStats.Provider.LOOKING_STATE));
+        assertTrue(ClientBase.waitForServerState(leader, ClientBase.CONNECTION_TIMEOUT, QuorumStats.Provider.LOOKING_STATE),
+                "Leader is not in Looking state");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index cfac042b7ac..2d2bea7686d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -19,18 +19,16 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
@@ -60,32 +58,16 @@
 import org.apache.zookeeper.server.admin.Commands;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.util.PortForwarder;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class ObserverMasterTest extends ObserverMasterTestBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(ObserverMasterTest.class);
 
-    public ObserverMasterTest(Boolean testObserverMaster) {
-        this.testObserverMaster = testObserverMaster;
-    }
-
-    @Parameterized.Parameters
-    public static List<Object[]> data() {
-        return Arrays.asList(new Object[][]{{Boolean.TRUE}, {Boolean.FALSE}});
-    }
-
-    private Boolean testObserverMaster;
-
-    private PortForwarder setUp(final int omProxyPort) throws IOException {
-        return setUp(omProxyPort, testObserverMaster);
-    }
-
     /**
      * This test ensures two things:
      * 1. That Observers can successfully proxy requests to the ensemble.
@@ -93,20 +75,20 @@ private PortForwarder setUp(final int omProxyPort) throws IOException {
      * The second is tested by constructing an ensemble where a leader would
      * be elected if and only if an Observer voted.
      */
-    @Test
-    public void testObserver() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testObserver(boolean testObserverMaster) throws Exception {
         // We expect two notifications before we want to continue
         latch = new CountDownLatch(2);
-        setUp(-1);
+        setUp(-1, testObserverMaster);
         q3.start();
-        assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
 
         if (testObserverMaster) {
             int masterPort = q3.getQuorumPeer().observer.getSocket().getPort();
             LOG.info("port {} {}", masterPort, OM_PORT);
-            assertEquals("observer failed to connect to observer master", masterPort, OM_PORT);
+            assertEquals(masterPort, OM_PORT, "observer failed to connect to observer master");
         }
 
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
@@ -126,15 +108,14 @@ public void testObserver() throws Exception {
         // Now kill one of the other real servers
         q2.shutdown();
 
-        assertTrue(
-                "Waiting for server 2 to shut down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 2 to shut down");
 
         LOG.info("Server 2 down");
 
         // Now the resulting ensemble shouldn't be quorate
         latch.await();
-        assertNotSame("Client is still connected to non-quorate cluster", KeeperState.SyncConnected, lastEvent.getState());
+        assertNotSame(KeeperState.SyncConnected, lastEvent.getState(), "Client is still connected to non-quorate cluster");
 
         LOG.info("Latch returned");
 
@@ -153,19 +134,16 @@ public void testObserver() throws Exception {
         q2.start();
 
         LOG.info("Waiting for server 2 to come up");
-        assertTrue(
-                "waiting for server 2 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         LOG.info("Server 2 started, waiting for latch");
 
         latch.await();
         // It's possible our session expired - but this is ok, shows we
         // were able to talk to the ensemble
-        assertTrue("Client didn't reconnect to quorate ensemble (state was"
-                                  + lastEvent.getState()
-                                  + ")", (KeeperState.SyncConnected == lastEvent.getState()
-                                                  || KeeperState.Expired == lastEvent.getState()));
+        assertTrue((KeeperState.SyncConnected == lastEvent.getState() || KeeperState.Expired == lastEvent.getState()),
+                "Client didn't reconnect to quorate ensemble (state was" + lastEvent.getState() + ")");
 
         LOG.info("perform a revalidation test");
         int leaderProxyPort = PortAssignment.unique();
@@ -177,7 +155,7 @@ public void testObserver() throws Exception {
         ZooKeeper client = new ZooKeeper(String.format("127.0.0.1:%d,127.0.0.1:%d", leaderProxyPort, obsProxyPort), ClientBase.CONNECTION_TIMEOUT, this);
         latch.await();
         client.create("/revalidtest", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Read-after write failed", client.exists("/revalidtest", null));
+        assertNotNull(client.exists("/revalidtest", null), "Read-after write failed");
 
         latch = new CountDownLatch(2);
         PortForwarder obsPF = new PortForwarder(obsProxyPort, CLIENT_PORT_OBS);
@@ -194,13 +172,13 @@ public void testObserver() throws Exception {
         shutdown();
     }
 
-    @Test
-    public void testRevalidation() throws Exception {
-        setUp(-1);
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testRevalidation(boolean testObserverMaster) throws Exception {
+        setUp(-1, testObserverMaster);
         q3.start();
-        assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
         final int leaderProxyPort = PortAssignment.unique();
         final int obsProxyPort = PortAssignment.unique();
 
@@ -211,7 +189,7 @@ public void testRevalidation() throws Exception {
         zk = new ZooKeeper(String.format("127.0.0.1:%d,127.0.0.1:%d", leaderProxyPort, obsProxyPort), ClientBase.CONNECTION_TIMEOUT, this);
         latch.await();
         zk.create("/revalidtest", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Read-after write failed", zk.exists("/revalidtest", null));
+        assertNotNull(zk.exists("/revalidtest", null), "Read-after write failed");
 
         latch = new CountDownLatch(2);
         PortForwarder obsPF = new PortForwarder(obsProxyPort, CLIENT_PORT_OBS);
@@ -227,9 +205,10 @@ public void testRevalidation() throws Exception {
         shutdown();
     }
 
-    @Test
-    public void testInOrderCommits() throws Exception {
-        setUp(-1);
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testInOrderCommits(boolean testObserverMaster) throws Exception {
+        setUp(-1, testObserverMaster);
 
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, null);
         for (int i = 0; i < 10; i++) {
@@ -239,9 +218,8 @@ public void testInOrderCommits() throws Exception {
         zk.close();
 
         q3.start();
-        assertTrue(
-                "waiting for observer to be up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for observer to be up");
 
         latch = new CountDownLatch(1);
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, this);
@@ -291,19 +269,19 @@ public boolean evaluate() {
         shutdown();
     }
 
-    @Test
-    public void testAdminCommands() throws IOException, MBeanException, InstanceNotFoundException, ReflectionException, InterruptedException, MalformedObjectNameException, AttributeNotFoundException, InvalidAttributeValueException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testAdminCommands(boolean testObserverMaster) throws IOException, MBeanException, InstanceNotFoundException, ReflectionException, InterruptedException, MalformedObjectNameException, AttributeNotFoundException, InvalidAttributeValueException, KeeperException {
         // flush all beans, then start
         for (ZKMBeanInfo beanInfo : MBeanRegistry.getInstance().getRegisteredBeans()) {
             MBeanRegistry.getInstance().unregister(beanInfo);
         }
 
         JMXEnv.setUp();
-        setUp(-1);
+        setUp(-1, testObserverMaster);
         q3.start();
-        assertTrue(
-                "waiting for observer to be up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for observer to be up");
 
         // Assert that commands are getting forwarded correctly
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
@@ -313,7 +291,7 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
         // test stats collection
         final Map<String, String> emptyMap = Collections.emptyMap();
         Map<String, Object> stats = Commands.runCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap).toMap();
-        assertTrue("observer not emitting observer_master_id", stats.containsKey("observer_master_id"));
+        assertTrue(stats.containsKey("observer_master_id"), "observer not emitting observer_master_id");
 
         // check the stats for the first peer
         if (testObserverMaster) {
@@ -354,19 +332,18 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
                 break;
             }
         }
-        assertNotNull("could not find connection bean", connBean);
+        assertNotNull(connBean, "could not find connection bean");
 
         latch = new CountDownLatch(1);
         JMXEnv.conn().invoke(connBean, "terminateConnection", new Object[0], null);
-        assertTrue("server failed to disconnect on terminate", latch.await(CONNECTION_TIMEOUT
-                                                                                          / 2, TimeUnit.MILLISECONDS));
-        assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(latch.await(CONNECTION_TIMEOUT / 2, TimeUnit.MILLISECONDS),
+                "server failed to disconnect on terminate");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
 
         final String obsBeanName = String.format("org.apache.ZooKeeperService:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Observer", q3.getQuorumPeer().getId(), q3.getQuorumPeer().getId());
         Set<ObjectName> names = JMXEnv.conn().queryNames(new ObjectName(obsBeanName), null);
-        assertEquals("expecting singular observer bean", 1, names.size());
+        assertEquals(1, names.size(), "expecting singular observer bean");
         ObjectName obsBean = names.iterator().next();
 
         if (testObserverMaster) {
@@ -374,10 +351,9 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
             long observerMasterId = q3.getQuorumPeer().observer.getLearnerMasterId();
             latch = new CountDownLatch(1);
             JMXEnv.conn().setAttribute(obsBean, new Attribute("LearnerMaster", Long.toString(3 - observerMasterId)));
-            assertTrue("server failed to disconnect on terminate", latch.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
-            assertTrue(
-                    "waiting for server 3 being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+            assertTrue(latch.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "server failed to disconnect on terminate");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                    "waiting for server 3 being up");
         } else {
             // show we get an error
             final long leaderId = q1.getQuorumPeer().leader == null ? 2 : 1;
@@ -385,7 +361,7 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
                 JMXEnv.conn().setAttribute(obsBean, new Attribute("LearnerMaster", Long.toString(3 - leaderId)));
                 fail("should have seen an exception on previous command");
             } catch (RuntimeMBeanException e) {
-                assertEquals("mbean failed for the wrong reason", IllegalArgumentException.class, e.getCause().getClass());
+                assertEquals(IllegalArgumentException.class, e.getCause().getClass(), "mbean failed for the wrong reason");
             }
         }
 
@@ -398,9 +374,8 @@ private String createServerString(String type, long serverId, int clientPort) {
     }
 
     private void waitServerUp(int clientPort) {
-        assertTrue(
-            "waiting for server being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                "waiting for server being up");
     }
 
     private ZooKeeperAdmin createAdmin(int clientPort) throws IOException {
@@ -416,8 +391,10 @@ private ZooKeeperAdmin createAdmin(int clientPort) throws IOException {
 
     // This test is known to be flaky and fail due to "reconfig already in progress".
     // TODO: Investigate intermittent testDynamicReconfig failures.
-    // @Test
-    public void testDynamicReconfig() throws InterruptedException, IOException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Disabled
+    public void testDynamicReconfig(boolean testObserverMaster) throws InterruptedException, IOException, KeeperException {
         if (!testObserverMaster) {
             return;
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
index 505378a5f1e..ad1d88f9143 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.PortAssignment;
@@ -78,12 +78,10 @@ protected PortForwarder setUp(final int omProxyPort, final Boolean testObserverM
         q3 = new MainThread(3, CLIENT_PORT_OBS, quorumCfgSection, extraCfgsObs);
         q1.start();
         q2.start();
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
         return forwarder;
     }
 
@@ -96,15 +94,12 @@ protected void shutdown() throws InterruptedException {
         q2.shutdown();
         q3.shutdown();
 
-        assertTrue(
-            "Waiting for server 1 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "Waiting for server 2 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "Waiting for server 3 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 1 to shut down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 2 to shut down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 3 to shut down");
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
index 7f81e48ec2e..00953f792f3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ObserverQuorumHammerTest extends QuorumHammerTest {
 
     public static final long CONNECTION_TIMEOUT = ClientTest.CONNECTION_TIMEOUT;
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         qb.setUp(true);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
index a083c0d2d70..deaad43b6ee 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index 67f19dc0549..bc696439b04 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -19,6 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT_RECURSIVE;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
@@ -31,9 +34,8 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +45,7 @@ public class PersistentRecursiveWatcherTest extends ClientBase {
     private Watcher persistentWatcher;
 
     @Override
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
 
@@ -71,7 +73,7 @@ public void testBasicAsync()
                 }
             };
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE, cb, null);
-            Assert.assertTrue(latch.await(5, TimeUnit.SECONDS));
+            assertTrue(latch.await(5, TimeUnit.SECONDS));
             internalTestBasic(zk);
         }
     }
@@ -167,8 +169,8 @@ public void testRootWatcher()
     private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
             throws InterruptedException {
         WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
-        Assert.assertNotNull(event);
-        Assert.assertEquals(eventType, event.getType());
-        Assert.assertEquals(path, event.getPath());
+        assertNotNull(event);
+        assertEquals(eventType, event.getType());
+        assertEquals(path, event.getPath());
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
index bffa8e0a2db..4e6a0ff1154 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
@@ -19,6 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
@@ -31,9 +34,8 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +45,7 @@ public class PersistentWatcherTest extends ClientBase {
     private Watcher persistentWatcher;
 
     @Override
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
 
@@ -95,7 +97,7 @@ public synchronized void process(WatchedEvent event) {
                 }
             };
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT, cb, null);
-            Assert.assertTrue(latch.await(5, TimeUnit.SECONDS));
+            assertTrue(latch.await(5, TimeUnit.SECONDS));
             events.clear(); // clear any events added during client connection
             internalTestBasic(zk);
         }
@@ -112,7 +114,7 @@ public void testAsyncDefaultWatcher()
                 }
             };
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT, cb, null);
-            Assert.assertTrue(latch.await(5, TimeUnit.SECONDS));
+            assertTrue(latch.await(5, TimeUnit.SECONDS));
             internalTestBasic(zk);
         }
     }
@@ -204,8 +206,8 @@ public void testRootWatcher()
     private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
             throws InterruptedException {
         WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
-        Assert.assertNotNull(event);
-        Assert.assertEquals(eventType, event.getType());
-        Assert.assertEquals(path, event.getPath());
+        assertNotNull(event);
+        assertEquals(eventType, event.getType());
+        assertEquals(path, event.getPath());
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index 638275a5415..02e5e0a034c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -37,7 +37,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -70,11 +71,7 @@ public class QuorumBase extends ClientBase {
     protected boolean localSessionsEnabled = false;
     protected boolean localSessionsUpgradingEnabled = false;
 
-    @Test
-    // This just avoids complaints by junit
-    public void testNull() {
-    }
-
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         setUp(false);
@@ -207,7 +204,7 @@ void startServers(boolean withObservers) throws Exception {
 
         LOG.info("Checking ports {}", hostPort);
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
             LOG.info("{} is accepting client connections", hp);
         }
 
@@ -390,6 +387,7 @@ public void setupServer(int i) throws IOException {
         }
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         LOG.info("TearDown started");
@@ -402,7 +400,7 @@ public void tearDown() throws Exception {
         shutdownServers();
 
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
             LOG.info("{} is no longer accepting client connections", hp);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java
index 57446ee3767..ff022f3f279 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -33,14 +33,14 @@ public class QuorumHammerTest extends ZKTestCase {
     protected final QuorumBase qb = new QuorumBase();
     protected final ClientHammerTest cht = new ClientHammerTest();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
         cht.hostPort = qb.hostPort;
         cht.setUpAll();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         cht.tearDownAll();
         qb.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
index 9516d0165c4..deaeb68d8ad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,7 +53,7 @@ public void testMajQuorums() throws Throwable {
                 bean = String.format("%s:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Leader", MBeanRegistry.DOMAIN, i, i);
             }
             electionTimeTaken = (Long) JMXEnv.ensureBeanAttribute(bean, "ElectionTimeTaken");
-            assertTrue("Wrong electionTimeTaken value!", electionTimeTaken >= 0);
+            assertTrue(electionTimeTaken >= 0, "Wrong electionTimeTaken value!");
         }
 
         //setup servers 1-5 to be followers
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
index 6025a158a3c..2eed9d3bf5a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
@@ -26,7 +26,7 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.cli.SetQuotaCommand;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumQuotaTest extends QuorumBase {
 
@@ -43,15 +43,15 @@ public void testQuotaWithQuorum() throws Exception {
         String statPath = Quotas.quotaZookeeper + "/a" + "/" + Quotas.statNode;
         byte[] data = zk.getData(statPath, false, new Stat());
         StatsTrack st = new StatsTrack(new String(data));
-        assertTrue("bytes are set", st.getBytes() == 1204L);
-        assertTrue("num count is set", st.getCount() == 301);
+        assertTrue(st.getBytes() == 1204L, "bytes are set");
+        assertTrue(st.getCount() == 301, "num count is set");
         for (i = 300; i < 600; i++) {
             zk.create("/a/" + i, "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
         data = zk.getData(statPath, false, new Stat());
         st = new StatsTrack(new String(data));
-        assertTrue("bytes are set", st.getBytes() == 2404L);
-        assertTrue("num count is set", st.getCount() == 601);
+        assertTrue(st.getBytes() == 2404L, "bytes are set");
+        assertTrue(st.getCount() == 601, "num count is set");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java
index afdafb790c5..9a3ef6996ab 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java
@@ -19,12 +19,12 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -33,7 +33,7 @@ public class QuorumRestartTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(QuorumRestartTest.class);
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
@@ -56,8 +56,8 @@ public void testRollingRestart() throws Exception {
             LOG.info("***** restarting: " + serverToRestart);
             qu.shutdown(serverToRestart);
 
-            assertTrue(String.format("Timeout during waiting for server %d to go down", serverToRestart),
-                    ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", serverToRestart));
 
             qu.restart(serverToRestart);
 
@@ -79,8 +79,8 @@ public void testRollingRestartBackwards() throws Exception {
             LOG.info("***** restarting: " + serverToRestart);
             qu.shutdown(serverToRestart);
 
-            assertTrue(String.format("Timeout during waiting for server %d to go down", serverToRestart),
-                    ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", serverToRestart));
 
             qu.restart(serverToRestart);
 
@@ -104,8 +104,8 @@ public void testRestartingLeaderMultipleTimes() throws Exception {
             LOG.info("***** new leader: " + leaderId);
             qu.shutdown(leaderId);
 
-            assertTrue("Timeout during waiting for current leader to go down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    "Timeout during waiting for current leader to go down");
 
             String errorMessage = "No new leader was elected";
             waitFor(errorMessage, () -> qu.leaderExists() && qu.getLeaderServer() != leaderId, 30);
@@ -120,7 +120,7 @@ public void testRestartingLeaderMultipleTimes() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qu.shutdownAll();
         System.clearProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
index c609c5c3fcd..760d9a4d7c1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -41,10 +41,10 @@
 import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Ignore;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,14 +57,14 @@ public class QuorumTest extends ZKTestCase {
     private final ClientTest ct = new ClientTest();
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
         ct.hostPort = qb.hostPort;
         ct.setUpAll();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         ct.tearDownAll();
         qb.tearDown();
@@ -289,7 +289,7 @@ public void testSessionMovedWithMultiOp() throws Exception {
      * make sure we cannot do any changes.
      */
     @Test
-    @Ignore
+    @Disabled
     public void testSessionMove() throws Exception {
         String[] hps = qb.hostPort.split(",");
         DiscoWatcher oldWatcher = new DiscoWatcher();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
index f7935851900..98153b9acac 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -152,7 +152,7 @@ public void startAll() throws IOException {
 
         LOG.info("Checking ports {}", hostPort);
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server " + hp + " up", ClientBase.waitForServerUp(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server " + hp + " up");
             LOG.info("{} is accepting client connections", hp);
         }
 
@@ -198,8 +198,8 @@ public void startQuorum() throws IOException {
         }
         for (int i = 1; i <= N + 1; ++i) {
             assertTrue(
-                    "Waiting for server up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + getPeer(i).clientPort, ClientBase.CONNECTION_TIMEOUT));
+                    ClientBase.waitForServerUp("127.0.0.1:" + getPeer(i).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    "Waiting for server up");
         }
     }
 
@@ -218,8 +218,8 @@ public void start(int id) throws IOException {
     public void restart(int id) throws IOException {
         start(id);
         assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
     }
 
     public void startThenShutdown(int id) throws IOException {
@@ -233,8 +233,8 @@ public void startThenShutdown(int id) throws IOException {
 
         ps.peer.start();
         assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
         shutdown(id);
     }
 
@@ -243,7 +243,7 @@ public void shutdownAll() {
             shutdown(i);
         }
         for (String hp : hostPort.split(",")) {
-            assertTrue("Waiting for server down", ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "Waiting for server down");
             LOG.info("{} is no longer accepting client connections", hp);
         }
     }
@@ -326,7 +326,7 @@ public int getLeaderServer() {
             }
         }
 
-        assertTrue("Leader server not found.", index > 0);
+        assertTrue(index > 0, "Leader server not found.");
         return index;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
index d02fbd69354..76513dc44c9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
@@ -18,15 +18,15 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -88,7 +88,7 @@ public void validateAllMXBeanAreUnregistered() throws IOException {
 
         qU.shutdownAll();
         Set<ZKMBeanInfo> pending = MBeanRegistry.getInstance().getRegisteredBeans();
-        assertTrue("The following beans should have been unregistered: " + pending, pending.isEmpty());
+        assertTrue(pending.isEmpty(), "The following beans should have been unregistered: " + pending);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java
index 80d2b9c64bb..c4c0bdee747 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
@@ -27,15 +27,15 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class QuorumZxidSyncTest extends ZKTestCase {
 
     QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
     }
@@ -79,10 +79,10 @@ public void testBehindLeader() throws Exception {
         qb.s2.start();
         qb.s3.start();
         qb.s4.start();
-        assertTrue("Servers didn't come up", ClientBase.waitForServerUp(qb.hostPort, 10000));
+        assertTrue(ClientBase.waitForServerUp(qb.hostPort, 10000), "Servers didn't come up");
         qb.s5.start();
         String hostPort = "127.0.0.1:" + qb.s5.getClientPort();
-        assertFalse("Servers came up, but shouldn't have since it's ahead of leader", ClientBase.waitForServerUp(hostPort, 10000));
+        assertFalse(ClientBase.waitForServerUp(hostPort, 10000), "Servers came up, but shouldn't have since it's ahead of leader");
     }
 
     private void cleanAndInitializeDataDir(File f) throws IOException {
@@ -139,7 +139,7 @@ public void testLateLogs() throws Exception {
             }
         }
         zk.close();
-        assertTrue("Didn't see /2 (went back in time)", saw2);
+        assertTrue(saw2, "Didn't see /2 (went back in time)");
     }
 
     private void deleteLogs(File f) {
@@ -151,7 +151,7 @@ private void deleteLogs(File f) {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qb.tearDown();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 0bef4c14aad..06c37347f11 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.LineNumberReader;
 import java.io.StringReader;
@@ -42,9 +42,10 @@
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.LoggerFactory;
 
 public class ReadOnlyModeTest extends ZKTestCase {
@@ -53,13 +54,13 @@ public class ReadOnlyModeTest extends ZKTestCase {
     private static int CONNECTION_TIMEOUT = QuorumBase.CONNECTION_TIMEOUT;
     private QuorumUtil qu = new QuorumUtil(1);
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("readonlymode.enabled", "true");
         qu.startQuorum();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.setProperty("readonlymode.enabled", "false");
         qu.tearDown();
@@ -68,7 +69,8 @@ public void tearDown() throws Exception {
     /**
      * Test write operations using multi request.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testMultiTransaction() throws Exception {
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
@@ -82,11 +84,11 @@ public void testMultiTransaction() throws Exception {
         watcher.reset();
         qu.shutdown(2);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
-        assertEquals("Should be in r-o mode", States.CONNECTEDREADONLY, zk.getState());
+        assertEquals(States.CONNECTEDREADONLY, zk.getState(), "Should be in r-o mode");
 
         // read operation during r/o mode
         String remoteData = new String(zk.getData(node1, false, null));
-        assertEquals("Failed to read data in r-o mode", data, remoteData);
+        assertEquals(data, remoteData, "Failed to read data in r-o mode");
 
         try {
             Transaction transaction = zk.transaction();
@@ -98,14 +100,15 @@ public void testMultiTransaction() throws Exception {
             // ok
         }
 
-        assertNull("Should have created the znode:" + node2, zk.exists(node2, false));
+        assertNull(zk.exists(node2, false), "Should have created the znode:" + node2);
     }
 
     /**
      * Basic test of read-only client functionality. Tries to read and write
      * during read-only mode, then regains a quorum and tries to write again.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testReadOnlyClient() throws Exception {
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
@@ -137,9 +140,8 @@ public void testReadOnlyClient() throws Exception {
 
         watcher.reset();
         qu.start(2);
-        assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT),
+            "waiting for server up");
         zk.close();
         watcher.reset();
 
@@ -156,7 +158,8 @@ public void testReadOnlyClient() throws Exception {
      * Ensures that upon connection to a read-only server client receives
      * ConnectedReadOnly state notification.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testConnectionEvents() throws Exception {
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
@@ -170,8 +173,8 @@ public void testConnectionEvents() throws Exception {
                 Thread.sleep(1000);
             }
         }
-        assertTrue("Did not succeed in connecting in 30s", success);
-        assertFalse("The connection should not be read-only yet", watcher.readOnlyConnected);
+        assertTrue(success, "Did not succeed in connecting in 30s");
+        assertFalse(watcher.readOnlyConnected, "The connection should not be read-only yet");
 
         // kill peer and wait no more than 5 seconds for read-only server
         // to be started (which should take one tickTime (2 seconds))
@@ -184,7 +187,7 @@ public void testConnectionEvents() throws Exception {
         while (!(zk.getState() == States.CONNECTEDREADONLY)) {
             Thread.sleep(200);
             // TODO this was originally 5 seconds, but realistically, on random/slow/virt hosts, there is no way to guarantee this
-            assertTrue("Can't connect to the server", Time.currentElapsedTime() - start < 30000);
+            assertTrue(Time.currentElapsedTime() - start < 30000, "Can't connect to the server");
         }
 
         watcher.waitForReadOnlyConnected(5000);
@@ -196,22 +199,22 @@ public void testConnectionEvents() throws Exception {
      * then connects to a majority server. Transition should be transparent for
      * the user.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testSessionEstablishment() throws Exception {
         qu.shutdown(2);
 
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
-        assertSame("should be in r/o mode", States.CONNECTEDREADONLY, zk.getState());
+        assertSame(States.CONNECTEDREADONLY, zk.getState(), "should be in r/o mode");
         long fakeId = zk.getSessionId();
         LOG.info("Connected as r/o mode with state {} and session id {}", zk.getState(), fakeId);
 
         watcher.reset();
         qu.start(2);
-        assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT),
+            "waiting for server up");
         LOG.info("Server 127.0.0.1:{} is up", qu.getPeer(2).clientPort);
         // ZOOKEEPER-2722: wait until we can connect to a read-write server after the quorum
         // is formed. Otherwise, it is possible that client first connects to a read-only server,
@@ -220,10 +223,10 @@ public void testSessionEstablishment() throws Exception {
         // server. If we happen to execute the zk.create after the read-only server is shutdown and
         // before the quorum is formed, we will get a ConnectLossException.
         watcher.waitForSyncConnected(CONNECTION_TIMEOUT);
-        assertEquals("Should be in read-write mode", States.CONNECTED, zk.getState());
+        assertEquals(States.CONNECTED, zk.getState(), "Should be in read-write mode");
         LOG.info("Connected as rw mode with state {} and session id {}", zk.getState(), zk.getSessionId());
         zk.create("/test", "test".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        assertFalse("fake session and real session have same id", zk.getSessionId() == fakeId);
+        assertFalse(zk.getSessionId() == fakeId, "fake session and real session have same id");
         zk.close();
     }
 
@@ -232,7 +235,8 @@ public void testSessionEstablishment() throws Exception {
      * server.
      */
     @SuppressWarnings("deprecation")
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testSeekForRwServer() throws Exception {
         // setup the logger to capture all logs
         Layout layout = Logger.getRootLogger().getAppender("CONSOLE").getLayout();
@@ -278,7 +282,7 @@ public void testSeekForRwServer() throws Exception {
                 break;
             }
         }
-        assertTrue("Majority server wasn't found while connected to r/o server", found);
+        assertTrue(found, "Majority server wasn't found while connected to r/o server");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
index daa471f0a3b..aae69aded87 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -34,9 +34,10 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -54,7 +55,7 @@ public class ReconfigExceptionTest extends ZKTestCase {
     private QuorumUtil qu;
     private ZooKeeperAdmin zkAdmin;
 
-    @Before
+    @BeforeEach
     public void setup() throws InterruptedException {
         System.setProperty(authProvider, superDigest);
         QuorumPeerConfig.setReconfigEnabled(true);
@@ -72,7 +73,7 @@ public void setup() throws InterruptedException {
         resetZKAdmin();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(authProvider);
         try {
@@ -87,7 +88,8 @@ public void tearDown() throws Exception {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigDisabled() throws InterruptedException {
         QuorumPeerConfig.setReconfigEnabled(false);
 
@@ -108,7 +110,8 @@ public void testReconfigDisabled() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigFailWithoutAuth() throws InterruptedException {
         try {
             reconfigPort();
@@ -119,7 +122,8 @@ public void testReconfigFailWithoutAuth() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigEnabledWithSuperUser() throws InterruptedException {
         try {
             zkAdmin.addAuthInfo("digest", "super:test".getBytes());
@@ -129,7 +133,8 @@ public void testReconfigEnabledWithSuperUser() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigFailWithAuthWithNoACL() throws InterruptedException {
         resetZKAdmin();
 
@@ -143,7 +148,8 @@ public void testReconfigFailWithAuthWithNoACL() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigEnabledWithAuthAndWrongACL() throws InterruptedException {
         resetZKAdmin();
 
@@ -161,7 +167,8 @@ public void testReconfigEnabledWithAuthAndWrongACL() throws InterruptedException
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigEnabledWithAuthAndACL() throws InterruptedException {
         resetZKAdmin();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
index 7fb675a4cfe..9e1b83802fc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -30,9 +30,10 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +45,7 @@ public class ReconfigMisconfigTest extends ZKTestCase {
     private static String errorMsg = "Reconfig should fail without configuring the super "
                                      + "user's password on server side first.";
 
-    @Before
+    @BeforeEach
     public void setup() throws InterruptedException {
         QuorumPeerConfig.setReconfigEnabled(true);
         // Get a three server quorum.
@@ -59,7 +60,7 @@ public void setup() throws InterruptedException {
         instantiateZKAdmin();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         try {
             if (qu != null) {
@@ -73,7 +74,8 @@ public void tearDown() throws Exception {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigFailWithoutSuperuserPasswordConfiguredOnServer() throws InterruptedException {
         // This tests the case where ZK ensemble does not have the super user's password configured.
         // Reconfig should fail as the super user has to be explicitly configured via
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index 810cc2a2386..65026a6b9ba 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -22,10 +22,10 @@
 import static java.lang.String.format;
 import static java.net.InetAddress.getLoopbackAddress;
 import static java.util.stream.Collectors.toList;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
@@ -58,9 +58,9 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -72,13 +72,13 @@ public class ReconfigTest extends ZKTestCase implements DataCallback {
     private ZooKeeper[] zkArr;
     private ZooKeeperAdmin[] zkAdminArr;
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
         QuorumPeerConfig.setReconfigEnabled(true);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         closeAllHandles(zkArr, zkAdminArr);
         if (qu != null) {
@@ -123,13 +123,13 @@ public static String reconfig(
                 ServerConfigLine joinerServerConfigLine = new ServerConfigLine(joiner);
 
                 String errorMessage = format("expected joiner config \"%s\" not found in current config:\n%s", joiner, configStr);
-                assertTrue(errorMessage, currentServerConfigs.stream().anyMatch(c -> c.equals(joinerServerConfigLine)));
+                assertTrue(currentServerConfigs.stream().anyMatch(c -> c.equals(joinerServerConfigLine)), errorMessage);
             }
         }
         if (leavingServers != null) {
             for (String leaving : leavingServers) {
                 String errorMessage = format("leaving server \"%s\" not removed from config: \n%s", leaving, configStr);
-                assertFalse(errorMessage, configStr.contains(format("server.%s=", leaving)));
+                assertFalse(configStr.contains(format("server.%s=", leaving)), errorMessage);
             }
         }
 
@@ -167,12 +167,12 @@ public static String testServerHasConfig(
         String configStr = new String(config);
         if (joiningServers != null) {
             for (String joiner : joiningServers) {
-                assertTrue("Config:<" + configStr + ">\n" + joiner, configStr.contains(joiner));
+                assertTrue(configStr.contains(joiner), "Config:<" + configStr + ">\n" + joiner);
             }
         }
         if (leavingServers != null) {
             for (String leaving : leavingServers) {
-                assertFalse("Config:<" + configStr + ">\n" + leaving, configStr.contains("server.".concat(leaving)));
+                assertFalse(configStr.contains("server.".concat(leaving)), "Config:<" + configStr + ">\n" + leaving);
             }
         }
 
@@ -1123,10 +1123,10 @@ public void testReconfigEnablemntWithRollingRestart() throws Exception {
         // restart the three servers, one-by-one, now with reconfig enabled
         // test if we can write / read in the cluster after each rolling restart step
         for (int i = 1; i < 4; i++) {
-            assertFalse("dynamic reconfig was not disabled before stopping server " + i, qu.getPeer(i).peer.isReconfigEnabled());
+            assertFalse(qu.getPeer(i).peer.isReconfigEnabled(), "dynamic reconfig was not disabled before stopping server " + i);
             qu.shutdown(i);
             qu.restart(i);
-            assertTrue("dynamic reconfig is not enabled for the restarted server " + i, qu.getPeer(i).peer.isReconfigEnabled());
+            assertTrue(qu.getPeer(i).peer.isReconfigEnabled(), "dynamic reconfig is not enabled for the restarted server " + i);
             testNormalOperation(zkArr[i], zkArr[(i % 3) + 1], false);
         }
 
@@ -1164,30 +1164,18 @@ private void assertLocalPeerMXBeanAttributes(
         QuorumPeer qp,
         String beanName,
         Boolean isPartOfEnsemble) throws Exception {
-        assertEquals(
-            "Mismatches LearnerType!",
-            qp.getLearnerType().name(),
-            JMXEnv.ensureBeanAttribute(beanName, "LearnerType"));
-        assertEquals(
-            "Mismatches ClientAddress!",
-            qp.getClientAddress().getHostString() + ":" + qp.getClientAddress().getPort(),
-            JMXEnv.ensureBeanAttribute(beanName, "ClientAddress"));
-        assertEquals(
-            "Mismatches LearnerType!",
-            qp.getElectionAddress().getOne().getHostString() + ":" + qp.getElectionAddress().getOne().getPort(),
-            JMXEnv.ensureBeanAttribute(beanName, "ElectionAddress"));
-        assertEquals(
-            "Mismatches PartOfEnsemble!",
-            isPartOfEnsemble,
-            JMXEnv.ensureBeanAttribute(beanName, "PartOfEnsemble"));
-        assertEquals(
-            "Mismatches ConfigVersion!",
-            qp.getQuorumVerifier().getVersion(),
-            JMXEnv.ensureBeanAttribute(beanName, "ConfigVersion"));
-        assertEquals(
-            "Mismatches QuorumSystemInfo!",
-            qp.getQuorumVerifier().toString(),
-            JMXEnv.ensureBeanAttribute(beanName, "QuorumSystemInfo"));
+        assertEquals(qp.getLearnerType().name(), JMXEnv.ensureBeanAttribute(beanName, "LearnerType"),
+                "Mismatches LearnerType!");
+        assertEquals(qp.getClientAddress().getHostString() + ":" + qp.getClientAddress().getPort(), JMXEnv.ensureBeanAttribute(beanName, "ClientAddress"),
+                "Mismatches ClientAddress!");
+        assertEquals(qp.getElectionAddress().getOne().getHostString() + ":" + qp.getElectionAddress().getOne().getPort(), JMXEnv.ensureBeanAttribute(beanName, "ElectionAddress"),
+                "Mismatches LearnerType!");
+        assertEquals(isPartOfEnsemble, JMXEnv.ensureBeanAttribute(beanName, "PartOfEnsemble"),
+                "Mismatches PartOfEnsemble!");
+        assertEquals(qp.getQuorumVerifier().getVersion(), JMXEnv.ensureBeanAttribute(beanName, "ConfigVersion"),
+                "Mismatches ConfigVersion!");
+        assertEquals(qp.getQuorumVerifier().toString(), JMXEnv.ensureBeanAttribute(beanName, "QuorumSystemInfo"),
+                "Mismatches QuorumSystemInfo!");
     }
 
     String getAddrPortFromBean(String beanName, String attribute) throws Exception {
@@ -1208,22 +1196,17 @@ String getNumericalAddrPort(String name) throws UnknownHostException {
     }
 
     private void assertRemotePeerMXBeanAttributes(QuorumServer qs, String beanName) throws Exception {
-        assertEquals(
-            "Mismatches LearnerType!",
-            qs.type.name(),
-            JMXEnv.ensureBeanAttribute(beanName, "LearnerType"));
-        assertEquals(
-            "Mismatches ClientAddress!",
-            getNumericalAddrPort(qs.clientAddr.getHostString() + ":" + qs.clientAddr.getPort()),
-            getAddrPortFromBean(beanName, "ClientAddress"));
-        assertEquals(
-            "Mismatches ElectionAddress!",
-            getNumericalAddrPort(qs.electionAddr.getOne().getHostString() + ":" + qs.electionAddr.getOne().getPort()),
-            getAddrPortFromBean(beanName, "ElectionAddress"));
-        assertEquals(
-            "Mismatches QuorumAddress!",
-            getNumericalAddrPort(qs.addr.getOne().getHostString() + ":" + qs.addr.getOne().getPort()),
-            getAddrPortFromBean(beanName, "QuorumAddress"));
+        assertEquals(qs.type.name(), JMXEnv.ensureBeanAttribute(beanName, "LearnerType"),
+                "Mismatches LearnerType!");
+        assertEquals(getNumericalAddrPort(qs.clientAddr.getHostString() + ":" + qs.clientAddr.getPort()),
+                getAddrPortFromBean(beanName, "ClientAddress"),
+                "Mismatches ClientAddress!");
+        assertEquals(getNumericalAddrPort(qs.electionAddr.getOne().getHostString() + ":" + qs.electionAddr.getOne().getPort()),
+                getAddrPortFromBean(beanName, "ElectionAddress"),
+                "Mismatches ElectionAddress!");
+        assertEquals(getNumericalAddrPort(qs.addr.getOne().getHostString() + ":" + qs.addr.getOne().getPort()),
+                getAddrPortFromBean(beanName, "QuorumAddress"),
+                "Mismatches QuorumAddress!");
     }
 
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
index 4f4d12d5871..2f9c1e58d18 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -36,7 +36,7 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -75,12 +75,12 @@ public void testRecovery() throws Exception {
             f.startup(zks);
             LOG.info("starting up the the server, waiting");
 
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 
             startSignal = new CountDownLatch(1);
             ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, this);
             startSignal.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS);
-            assertTrue("count == 0", startSignal.getCount() == 0);
+            assertTrue(startSignal.getCount() == 0, "count == 0");
             String path;
             LOG.info("starting creating nodes");
             for (int i = 0; i < 10; i++) {
@@ -99,7 +99,7 @@ public void testRecovery() throws Exception {
 
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
 
             zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
             f = ServerCnxnFactory.createFactory(PORT, -1);
@@ -108,10 +108,10 @@ public void testRecovery() throws Exception {
 
             f.startup(zks);
 
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 
             startSignal.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS);
-            assertTrue("count == 0", startSignal.getCount() == 0);
+            assertTrue(startSignal.getCount() == 0, "count == 0");
 
             Stat stat = new Stat();
             for (int i = 0; i < 10; i++) {
@@ -130,7 +130,7 @@ public void testRecovery() throws Exception {
             f.shutdown();
             zks.shutdown();
 
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
 
             zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
             f = ServerCnxnFactory.createFactory(PORT, -1);
@@ -139,10 +139,10 @@ public void testRecovery() throws Exception {
 
             f.startup(zks);
 
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 
             startSignal.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS);
-            assertTrue("count == 0", startSignal.getCount() == 0);
+            assertTrue(startSignal.getCount() == 0, "count == 0");
 
             stat = new Stat();
             LOG.info("Check 2");
@@ -163,7 +163,7 @@ public void testRecovery() throws Exception {
             f.shutdown();
             zks.shutdown();
 
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
         } finally {
             SyncRequestProcessor.setSnapCount(oldSnapCount);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
index 27fa4a9daa7..4dff8e27621 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class RepeatStartupTest extends ZKTestCase {
 
@@ -56,13 +56,13 @@ public void testFail() throws Exception {
         factory.startup(zks);
         System.out.println("Comment: starting factory");
         assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT),
+                "waiting for server up");
         factory.shutdown();
         zks.shutdown();
         assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerDown("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT),
+                "waiting for server down");
         System.out.println("Comment: shutting down standalone");
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
index 0b27ff59c10..4b16394057f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.List;
 import java.util.Map;
 import org.apache.zookeeper.CreateMode;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -41,14 +41,14 @@ public class ResponseCacheTest extends ClientBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(ResponseCacheTest.class);
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         System.setProperty(ZooKeeperServer.GET_DATA_RESPONSE_CACHE_SIZE, "32");
         System.setProperty(ZooKeeperServer.GET_CHILDREN_RESPONSE_CACHE_SIZE, "64");
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(ZooKeeperServer.GET_DATA_RESPONSE_CACHE_SIZE);
         System.clearProperty(ZooKeeperServer.GET_CHILDREN_RESPONSE_CACHE_SIZE);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java
index 188396f1fc2..2e8837b0f03 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.Collection;
 import org.apache.zookeeper.CreateMode;
@@ -30,7 +30,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -98,7 +98,7 @@ private void testRestoreCommittedLog(int totalTransactions, byte[] data, int min
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             for (int i = 0; i < totalTransactions; i++) {
@@ -112,10 +112,10 @@ private void testRestoreCommittedLog(int totalTransactions, byte[] data, int min
 
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
-        assertTrue("too few snapshot files", numSnaps > minExpectedSnapshots);
-        assertTrue("too many snapshot files", numSnaps <= minExpectedSnapshots * 2);
+        assertTrue(numSnaps > minExpectedSnapshots, "too few snapshot files");
+        assertTrue(numSnaps <= minExpectedSnapshots * 2, "too many snapshot files");
 
         // start server again
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -123,7 +123,7 @@ private void testRestoreCommittedLog(int totalTransactions, byte[] data, int min
         Collection<Proposal> committedLog = zks.getZKDatabase().getCommittedLog();
         int logsize = committedLog.size();
         LOG.info("committedLog size = {}", logsize);
-        assertTrue("log size != 0", (logsize != 0));
+        assertTrue((logsize != 0), "log size != 0");
         zks.shutdown();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java
index ddfa48dd38a..447e50ac90d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import java.net.InetSocketAddress;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.PortAssignment;
@@ -26,9 +26,9 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SSLAuthTest extends ClientBase {
 
@@ -64,7 +64,7 @@ public static void clearSecureSetting(ClientX509Util clientX509Util) {
         clientX509Util.close();
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         clientX509Util = setUpSecure();
 
@@ -78,7 +78,7 @@ public void setUp() throws Exception {
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         clearSecureSetting(clientX509Util);
     }
@@ -96,7 +96,7 @@ public void testRejection() throws Exception {
 
         // Handshake will take place, and then X509AuthenticationProvider should reject the untrusted cert
         new TestableZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
-        assertFalse("Untrusted certificate should not result in successful connection", watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS));
+        assertFalse(watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS), "Untrusted certificate should not result in successful connection");
     }
 
     @Test
@@ -109,7 +109,7 @@ public void testMisconfiguration() throws Exception {
 
         CountdownWatcher watcher = new CountdownWatcher();
         new TestableZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
-        assertFalse("Missing SSL configuration should not result in successful connection", watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS));
+        assertFalse(watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS), "Missing SSL configuration should not result in successful connection");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
index 95db1508645..27156865d25 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -38,7 +38,7 @@
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthDesignatedClientTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
index bbe12c927c7..c534b6ff660 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -31,7 +31,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperSaslServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthDesignatedServerTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
index f0a85c2002d..84579a90968 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -28,7 +28,7 @@
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthFailDesignatedClientTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
index e5df31ef341..93204b4ebe9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -28,7 +28,7 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthFailTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
index 51a6d03f024..aa944525340 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -27,7 +27,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthMissingClientConfigTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
index e60fcc452a9..51dbbb53e16 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
@@ -18,24 +18,24 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthRequiredFailNoSASLTest extends ClientBase {
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
index 1fed4d93c25..4d119a01359 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
@@ -18,26 +18,26 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthRequiredFailWrongSASLTest extends ClientBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBeforeClass() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
         System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
         System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas_wrong.conf", "test1"));
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
         System.clearProperty(SaslTestUtil.authProviderProperty);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
index 173a3cbf385..8333eb05b51 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
@@ -18,25 +18,25 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class SaslAuthRequiredTest extends ClientBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBeforeClass() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
         System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
         System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas.conf", "test"));
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
         System.clearProperty(SaslTestUtil.authProviderProperty);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java
index adc69027509..4684bb3b306 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java
@@ -18,25 +18,25 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SaslClientTest extends ZKTestCase {
 
     private String existingPropertyValue = null;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         existingPropertyValue = System.getProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY);
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // Restore the System property if it was set previously
         if (existingPropertyValue != null) {
@@ -47,16 +47,16 @@ public void tearDown() {
     @Test
     public void testSaslClientDisabled() {
         System.clearProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY);
-        assertTrue("SASL client disabled", new ZKClientConfig().isSaslClientEnabled());
+        assertTrue(new ZKClientConfig().isSaslClientEnabled(), "SASL client disabled");
 
         for (String value : Arrays.asList("true", "TRUE")) {
             System.setProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, value);
-            assertTrue("SASL client disabled", new ZKClientConfig().isSaslClientEnabled());
+            assertTrue(new ZKClientConfig().isSaslClientEnabled(), "SASL client disabled");
         }
 
         for (String value : Arrays.asList("false", "FALSE")) {
             System.setProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, value);
-            assertFalse("SASL client disabled", new ZKClientConfig().isSaslClientEnabled());
+            assertFalse(new ZKClientConfig().isSaslClientEnabled(), "SASL client disabled");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
index 09d92978ca1..a21e4a5a1f7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.ZKClientConfig.LOGIN_CONTEXT_NAME_KEY;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -36,9 +36,9 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 
 public class SaslDigestAuthOverSSLTest extends ClientBase {
@@ -46,7 +46,7 @@ public class SaslDigestAuthOverSSLTest extends ClientBase {
     private ClientX509Util clientX509Util;
     private File saslConfFile;
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         initSaslConfig();
@@ -63,7 +63,7 @@ public void setUp() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java
index d466c8b8d39..0315867086b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java
@@ -23,7 +23,7 @@
 import static org.apache.zookeeper.client.ZKClientConfig.ZK_SASL_CLIENT_USERNAME;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_SERVER_PRINCIPAL;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_SERVER_REALM;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -43,11 +43,11 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.quorum.auth.KerberosTestUtils;
 import org.apache.zookeeper.server.quorum.auth.MiniKdc;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SaslKerberosAuthOverSSLTest extends ClientBase {
 
@@ -61,12 +61,12 @@ public class SaslKerberosAuthOverSSLTest extends ClientBase {
 
 
 
-    @BeforeClass
+    @BeforeAll
     public static void setupKdc() {
         startMiniKdc();
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownKdc() {
         stopMiniKdc();
         FileUtils.deleteQuietly(kdcWorkDir);
@@ -74,7 +74,7 @@ public static void tearDownKdc() {
 
 
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         initSaslConfig();
@@ -91,7 +91,7 @@ public void setUp() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
index 426eeb16fb7..39bf62f11d7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class SaslSuperUserTest extends ClientBase {
 
@@ -45,7 +45,7 @@ public class SaslSuperUserTest extends ClientBase {
     private static String oldLoginConfig;
     private static String oldSuperUser;
 
-    @BeforeClass
+    @BeforeAll
     public static void setupStatic() throws Exception {
         oldAuthProvider = System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
 
@@ -70,7 +70,7 @@ public static void setupStatic() throws Exception {
         otherDigestUser = new Id("digest", DigestAuthenticationProvider.generateDigest("jack:jack"));
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanupStatic() {
         if (oldAuthProvider != null) {
             System.setProperty("zookeeper.authProvider.1", oldAuthProvider);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
index f787fb20c1c..54d17f59790 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -41,22 +41,15 @@ static String createJAASConfigFile(String fileName, String password) {
             File jaasFile = new File(tmpDir, fileName);
             FileWriter fwriter = new FileWriter(jaasFile);
             fwriter.write(""
-                                  + "Server {\n"
-                                  + "          "
-                                  + digestLoginModule
-                                  + " required\n"
-                                  + "          user_super=\"test\";\n"
-                                  + "};\n"
-                                  + "Client {\n"
-                                  + "       "
-                                  + digestLoginModule
-                                  + " required\n"
-                                  + "       username=\"super\"\n"
-                                  + "       password=\""
-                                  + password
-                                  + "\";\n"
-                                  + "};"
-                                  + "\n");
+                    + "Server {\n"
+                    + "          " + digestLoginModule + " required\n"
+                    + "          user_super=\"test\";\n"
+                    + "};\n"
+                    + "Client {\n"
+                    + "       " + digestLoginModule + " required\n"
+                    + "       username=\"super\"\n"
+                    + "       password=\"" + password + "\";\n"
+                    + "};" + "\n");
             fwriter.close();
             ret = jaasFile.getAbsolutePath();
         } catch (IOException e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
index 35db43d2df9..5fb772d58a2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.OutputStream;
 import java.net.Socket;
 import org.apache.zookeeper.server.NIOServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,13 +38,13 @@ public class ServerCnxnTest extends ClientBase {
 
     private static int cnxnTimeout = 1000;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty(NIOServerCnxnFactory.ZOOKEEPER_NIO_SESSIONLESS_CNXN_TIMEOUT, Integer.toString(cnxnTimeout));
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         super.tearDown();
         System.clearProperty(NIOServerCnxnFactory.ZOOKEEPER_NIO_SESSIONLESS_CNXN_TIMEOUT);
@@ -58,7 +58,7 @@ public void testServerCnxnExpiry() throws Exception {
         // Range is (now + cnxnTimeout) to (now + 2*cnxnTimeout)
         // Add 1s buffer to be safe.
         String resp = sendRequest("ruok", 2 * cnxnTimeout + 1000);
-        assertEquals("Connection should have closed", "", resp);
+        assertEquals("", resp, "Connection should have closed");
     }
 
     private void verify(String cmd, String expected) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
index 0177e8660d7..a9229d2b16b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -31,7 +31,7 @@
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.proto.RequestHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SessionInvalidationTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
index d2ab579062c..9d859eeaa42 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.LinkedList;
@@ -43,9 +43,9 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -64,7 +64,7 @@ public class SessionTest extends ZKTestCase {
 
     private final int TICK_TIME = 3000;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         if (tmpDir == null) {
             tmpDir = ClientBase.createTmpDir();
@@ -77,14 +77,14 @@ public void setUp() throws Exception {
         serverFactory = ServerCnxnFactory.createFactory(PORT, -1);
         serverFactory.startup(zs);
 
-        assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         serverFactory.shutdown();
         zs.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
     }
 
     private static class CountdownWatcher implements Watcher {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
index 9bf23cab84e..0585ce6fadf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -31,8 +31,8 @@
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,7 +42,7 @@ public class SessionTimeoutTest extends ClientBase {
 
     private TestableZooKeeper zk;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         zk = createClient();
@@ -95,12 +95,12 @@ public void testQueueEvent() throws InterruptedException, KeeperException {
     @Test
     public void testSessionDisconnect() throws KeeperException, InterruptedException, IOException {
         zk.create("/sdisconnect", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Ephemeral node has not been created", zk.exists("/sdisconnect", null));
+        assertNotNull(zk.exists("/sdisconnect", null), "Ephemeral node has not been created");
 
         zk.close();
 
         zk = createClient();
-        assertNull("Ephemeral node shouldn't exist after client disconnect", zk.exists("/sdisconnect", null));
+        assertNull(zk.exists("/sdisconnect", null), "Ephemeral node shouldn't exist after client disconnect");
     }
 
     /**
@@ -109,13 +109,13 @@ public void testSessionDisconnect() throws KeeperException, InterruptedException
     @Test
     public void testSessionRestore() throws KeeperException, InterruptedException, IOException {
         zk.create("/srestore", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Ephemeral node has not been created", zk.exists("/srestore", null));
+        assertNotNull(zk.exists("/srestore", null), "Ephemeral node has not been created");
 
         zk.disconnect();
         zk.close();
 
         zk = createClient();
-        assertNotNull("Ephemeral node should be present when session is restored", zk.exists("/srestore", null));
+        assertNotNull(zk.exists("/srestore", null), "Ephemeral node should be present when session is restored");
     }
 
     /**
@@ -124,14 +124,14 @@ public void testSessionRestore() throws KeeperException, InterruptedException, I
     @Test
     public void testSessionSurviveServerRestart() throws Exception {
         zk.create("/sdeath", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Ephemeral node has not been created", zk.exists("/sdeath", null));
+        assertNotNull(zk.exists("/sdeath", null), "Ephemeral node has not been created");
 
         zk.disconnect();
         stopServer();
         startServer();
         zk = createClient();
 
-        assertNotNull("Ephemeral node should be present when server restarted", zk.exists("/sdeath", null));
+        assertNotNull(zk.exists("/sdeath", null), "Ephemeral node should be present when server restarted");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
index a0d5c915ef3..250dc887b11 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.ConcurrentHashMap;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
 import org.apache.zookeeper.ZKTestCase;
@@ -27,9 +27,9 @@
 import org.apache.zookeeper.server.ZooKeeperServerListener;
 import org.apache.zookeeper.server.quorum.LeaderSessionTracker;
 import org.apache.zookeeper.server.quorum.LearnerSessionTracker;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -62,12 +62,12 @@ public long getServerId() {
 
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         sessionsWithTimeouts.clear();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
index f10f6c8d8b4..114667f01dd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
@@ -18,18 +18,18 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,7 +48,7 @@ public class SessionUpgradeTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -57,7 +57,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -76,7 +76,7 @@ public void testLocalSessionsWithoutEphemeralOnLeader() throws Exception {
     private void testLocalSessionsWithoutEphemeral(boolean testLeader) throws Exception {
         String nodePrefix = "/testLocalSessions-" + (testLeader ? "leaderTest-" : "followerTest-");
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int otherFollowerIdx = (leaderIdx + 2) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
@@ -156,7 +156,7 @@ public void testUpgradeWithEphemeralOnLeader() throws Exception {
     private void testUpgradeWithEphemeral(boolean testLeader) throws Exception {
         String nodePrefix = "/testUpgrade-" + (testLeader ? "leaderTest-" : "followerTest-");
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int otherFollowerIdx = (leaderIdx + 2) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
index 8541d7abdfc..c7efeb17790 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.List;
@@ -36,8 +36,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,7 +48,7 @@ public class StandaloneTest extends QuorumPeerTestBase implements Watcher {
 
     protected static final Logger LOG = LoggerFactory.getLogger(StandaloneTest.class);
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
         QuorumPeerConfig.setReconfigEnabled(true);
@@ -106,11 +106,10 @@ public void testClientPortInStaticFile() throws Exception {
     void verifyStandalone(MainThread mt, int clientPort) throws InterruptedException {
         mt.start();
         try {
-            assertTrue(
-                    "waiting for server 1 being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                    "waiting for server 1 being up");
         } finally {
-            assertFalse("Error- MainThread started in Quorum Mode!", mt.isQuorumPeerRunning());
+            assertFalse(mt.isQuorumPeerRunning(), "Error- MainThread started in Quorum Mode!");
             mt.shutdown();
         }
     }
@@ -131,7 +130,7 @@ public void testStandaloneReconfigFails() throws Exception {
 
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(CLIENT_PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
 
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, watcher);
@@ -152,7 +151,7 @@ public void testStandaloneReconfigFails() throws Exception {
 
         zks.shutdown();
         f.shutdown();
-        assertTrue("waiting for server being down ", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being down ");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java
index cf575139b2f..640710b585a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java
@@ -18,20 +18,23 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class StatTest extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -39,6 +42,7 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
index 7095c14f092..905b6cd78c3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
@@ -22,13 +22,14 @@
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.hasItems;
 import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
@@ -47,7 +48,7 @@
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.common.Time;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class StaticHostProviderTest extends ZKTestCase {
 
@@ -90,9 +91,11 @@ public void testNextDoesNotSleepForZero() {
         assertTrue(5 > stop - start);
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testEmptyServerAddressesList() {
-        HostProvider hp = new StaticHostProvider(new ArrayList<>());
+        assertThrows(IllegalArgumentException.class, () -> {
+            HostProvider hp = new StaticHostProvider(new ArrayList<>());
+        });
     }
 
     @Test
@@ -111,8 +114,8 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
 
         // Act & Assert
         InetSocketAddress n1 = sp.next(0);
-        assertTrue("Provider should return unresolved address is host is unresolvable", n1.isUnresolved());
-        assertSame("Provider should return original address is host is unresolvable", unresolved, n1);
+        assertTrue(n1.isUnresolved(), "Provider should return unresolved address is host is unresolvable");
+        assertSame(unresolved, n1, "Provider should return original address is host is unresolvable");
     }
 
     @Test
@@ -796,20 +799,20 @@ public InetAddress[] getAllByName(String name) {
 
         // Act & Assert
         InetSocketAddress resolvedFirst = hostProvider.next(0);
-        assertFalse("HostProvider should return resolved addresses", resolvedFirst.isUnresolved());
+        assertFalse(resolvedFirst.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedFirst.getAddress().getHostAddress()));
 
         hostProvider.onConnected(); // first address worked
 
         InetSocketAddress resolvedSecond = hostProvider.next(0);
-        assertFalse("HostProvider should return resolved addresses", resolvedSecond.isUnresolved());
+        assertFalse(resolvedSecond.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedSecond.getAddress().getHostAddress()));
 
         // Second address doesn't work, so we don't call onConnected() this time
         // StaticHostProvider should try to re-resolve the address in this case
 
         InetSocketAddress resolvedThird = hostProvider.next(0);
-        assertFalse("HostProvider should return resolved addresses", resolvedThird.isUnresolved());
+        assertFalse(resolvedThird.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedThird.getAddress().getHostAddress()));
 
         verify(spyResolver, times(3)).getAllByName("www.apache.org");  // resolution occured every time
@@ -848,9 +851,9 @@ public InetAddress[] getAllByName(String name) {
             InetSocketAddress resolved = hostProvider.next(0);
             hostProvider.onConnected();
             if (resolved.getHostName().equals("www.google.com")) {
-                assertTrue("HostProvider should return unresolved address if host is unresolvable", resolved.isUnresolved());
+                assertTrue(resolved.isUnresolved(), "HostProvider should return unresolved address if host is unresolvable");
             } else {
-                assertFalse("HostProvider should return resolved addresses", resolved.isUnresolved());
+                assertFalse(resolved.isUnresolved(), "HostProvider should return resolved addresses");
                 assertEquals("192.168.1.1", resolved.getAddress().getHostAddress());
             }
         }
@@ -871,11 +874,9 @@ public void testReResolvingLocalhost() {
         int sizeBefore = hostProvider.size();
         InetSocketAddress next = hostProvider.next(0);
         next = hostProvider.next(0);
-        assertTrue("Different number of addresses in the list: "
-                           + hostProvider.size()
-                           + " (after), "
-                           + sizeBefore
-                           + " (before)", hostProvider.size() == sizeBefore);
+        assertTrue(hostProvider.size() == sizeBefore,
+                "Different number of addresses in the list: "
+                        + hostProvider.size() + " (after), " + sizeBefore + " (before)");
     }
 
     private StaticHostProvider getHostProviderUnresolved(byte size) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
index caa3db6318a..48c1bc908a9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.StringUtils;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class StringUtilTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java
index d743da077ab..684045ee723 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Date;
 import java.util.LinkedList;
@@ -36,7 +36,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SyncCallTest extends ClientBase implements ChildrenCallback, Children2Callback, StringCallback, VoidCallback, Create2Callback {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
index a38d49e4866..00c6c070a04 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 
 /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
index 1d9e502257b..87fedb35172 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
@@ -18,6 +18,10 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -33,7 +37,6 @@
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestThrottler;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Assert;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -74,15 +77,15 @@ public void testThrottledOp(ZooKeeper zk, ZooKeeperServer zs) throws IOException
                 try {
                     zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
                         (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 } catch (KeeperException.ThrottledOpException e) {
                     // anticipated outcome
                     Stat stat = zk.exists(nodeName, null);
-                    Assert.assertNull(stat);
+                    assertNull(stat);
                     zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
                         (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
                 } catch (KeeperException e) {
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 }
                 opCount += 3; // three ops issued
             } else {
@@ -93,12 +96,12 @@ public void testThrottledOp(ZooKeeper zk, ZooKeeperServer zs) throws IOException
             if (opCount % N == N - 1) {
                 try {
                     zk.setData(nodeName, nodeName.getBytes(), -1);
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 } catch (KeeperException.ThrottledOpException e) {
                     // anticipated outcome & retry
                     zk.setData(nodeName, nodeName.getBytes(), -1);
                 } catch (KeeperException e) {
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 }
                 opCount += 2; // two ops issued, one for retry
             } else {
@@ -112,47 +115,47 @@ public void testThrottledOp(ZooKeeper zk, ZooKeeperServer zs) throws IOException
             if (opCount % N == N - 1) {
                 try {
                     zk.exists(nodeName, null);
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 } catch (KeeperException.ThrottledOpException e) {
                     // anticipated outcome & retry
                     Stat stat = zk.exists(nodeName, null);
-                    Assert.assertNotNull(stat);
+                    assertNotNull(stat);
                     opCount += 2; // two ops issued, one is retry
                 } catch (KeeperException e) {
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 }
             } else {
                 Stat stat = zk.exists(nodeName, null);
-                Assert.assertNotNull(stat);
+                assertNotNull(stat);
                 opCount++;
             }
             if (opCount % N == N - 1) {
                 try {
                     zk.getData(nodeName, null, null);
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 } catch (KeeperException.ThrottledOpException e) {
                     // anticipated outcome & retry
                     byte[] data = zk.getData(nodeName, null, null);
-                    Assert.assertEquals(nodeName, new String(data));
+                    assertEquals(nodeName, new String(data));
                     opCount += 2; // two ops issued, one is retry
                 } catch (KeeperException e) {
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 }
             } else {
                 byte[] data = zk.getData(nodeName, null, null);
-                Assert.assertEquals(nodeName, new String(data));
+                assertEquals(nodeName, new String(data));
                 opCount++;
             }
             if (opCount % N == N - 1) {
                 try {
                     // version 0 should not trigger BadVersion exception
                     zk.delete(nodeName, 0);
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 } catch (KeeperException.ThrottledOpException e) {
                     // anticipated outcome & retry
                     zk.delete(nodeName, -1);
                 } catch (KeeperException e) {
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 }
                 opCount += 2; // two ops issues, one for retry
             } else {
@@ -162,18 +165,18 @@ public void testThrottledOp(ZooKeeper zk, ZooKeeperServer zs) throws IOException
             if (opCount % N == N - 1) {
                 try {
                     zk.exists(nodeName, null);
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 } catch (KeeperException.ThrottledOpException e) {
                     // anticipated outcome & retry
                     Stat stat = zk.exists(nodeName, null);
-                    Assert.assertNull(stat);
+                    assertNull(stat);
                     opCount += 2; // two ops issued, one is retry
                 } catch (KeeperException e) {
-                    Assert.fail("Should have gotten ThrottledOp exception");
+                    fail("Should have gotten ThrottledOp exception");
                 }
             } else {
                 Stat stat = zk.exists(nodeName, null);
-                Assert.assertNull(stat);
+                assertNull(stat);
                 opCount++;
             }
         }
@@ -194,7 +197,7 @@ public void testThrottledAcl(ZooKeeper zk, ZooKeeperServer zs) throws Exception
         zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.addAuthInfo("digest", "pat:test".getBytes());
         List<ACL> defaultAcls = zk.getACL(path, null);
-        Assert.assertEquals(1, defaultAcls.size());
+        assertEquals(1, defaultAcls.size());
 
         RequestThrottleMock.throttleEveryNthOp(2);
 
@@ -203,14 +206,14 @@ public void testThrottledAcl(ZooKeeper zk, ZooKeeperServer zs) throws Exception
             CreateMode.PERSISTENT);
         try {
             zk.setACL(path, ACL_PERMS, -1);
-            Assert.fail("Should have gotten ThrottledOp exception");
+            fail("Should have gotten ThrottledOp exception");
         } catch (KeeperException.ThrottledOpException e) {
             // expected
         } catch (KeeperException e) {
-            Assert.fail("Should have gotten ThrottledOp exception");
+            fail("Should have gotten ThrottledOp exception");
         }
         List<ACL> acls = zk.getACL(path, null);
-        Assert.assertEquals(1, acls.size());
+        assertEquals(1, acls.size());
 
         RequestThrottleMock.throttleEveryNthOp(0);
 
@@ -219,6 +222,6 @@ public void testThrottledAcl(ZooKeeper zk, ZooKeeperServer zs) throws Exception
             CreateMode.PERSISTENT);
         zk.setACL(path, ACL_PERMS, -1);
         acls = zk.getACL(path, null);
-        Assert.assertEquals(3, acls.size());
+        assertEquals(3, acls.size());
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
index dfd19642f08..b3e1d47ee7d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
@@ -22,25 +22,22 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ThrottledOpObserverTest extends QuorumBase {
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         ThrottledOpHelper.applyMockUps();
     }
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp(true /* withObservers */);
     }
 
-    @Override
-    public void tearDown() throws Exception {
-        super.tearDown();
-    }
-
     @Test
     public void testThrottledOpObserver() throws IOException, InterruptedException, KeeperException {
         ZooKeeper zk = null;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
index 27613657da4..473b998141e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
@@ -23,11 +23,11 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class ThrottledOpQuorumTest extends QuorumBase {
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         ThrottledOpHelper.applyMockUps();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
index 27ac6a6939c..88f6cf681d3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
@@ -22,12 +22,12 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class ThrottledOpStandaloneTest extends ClientBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         ThrottledOpHelper.applyMockUps();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
index 089a7644aab..622dadfa77a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.test;
 
 import static org.hamcrest.CoreMatchers.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -47,9 +47,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,14 +58,14 @@ public class TruncateTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(TruncateTest.class);
     File dataDir1, dataDir2, dataDir3;
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         dataDir1 = ClientBase.createTmpDir();
         dataDir2 = ClientBase.createTmpDir();
         dataDir3 = ClientBase.createTmpDir();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         ClientBase.recursiveDelete(dataDir1);
         ClientBase.recursiveDelete(dataDir2);
@@ -124,7 +124,7 @@ public void testTruncationNullLog() throws Exception {
         File[] logs = snaplog.getDataDir().listFiles();
         for (int i = 0; i < logs.length; i++) {
             LOG.debug("Deleting: {}", logs[i].getName());
-            assertTrue("Failed to delete log file: " + logs[i].getName(), logs[i].delete());
+            assertTrue(logs[i].delete(), "Failed to delete log file: " + logs[i].getName());
         }
         try {
             assertThat("truncateLog() should return false if truncation fails instead of throwing exception", zkdb.truncateLog(1), is(false));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
index 95b5569bb08..a3d6eef7bdc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
@@ -17,6 +17,7 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.Collections;
@@ -30,9 +31,9 @@
 import org.apache.zookeeper.server.watch.WatchesPathReport;
 import org.apache.zookeeper.server.watch.WatchesReport;
 import org.apache.zookeeper.server.watch.WatchesSummary;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class UnsupportedAddWatcherTest extends ClientBase {
 
@@ -98,13 +99,13 @@ public void dumpWatches(PrintWriter pwriter, boolean byPath) {
         }
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty(WatchManagerFactory.ZOOKEEPER_WATCH_MANAGER_NAME, StubbedWatchManager.class.getName());
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         try {
             super.tearDown();
@@ -113,12 +114,15 @@ public void tearDown() throws Exception {
         }
     }
 
-    @Test(expected = KeeperException.MarshallingErrorException.class)
+    @Test
     public void testBehavior() throws IOException, InterruptedException, KeeperException {
-        try (ZooKeeper zk = createClient(hostPort)) {
-            // the server will generate an exception as our custom watch manager doesn't implement
-            // the new version of addWatch()
-            zk.addWatch("/foo", event -> {}, AddWatchMode.PERSISTENT_RECURSIVE);
-        }
+        assertThrows(KeeperException.MarshallingErrorException.class, () -> {
+            try (ZooKeeper zk = createClient(hostPort)) {
+                // the server will generate an exception as our custom watch manager doesn't implement
+                // the new version of addWatch()
+                zk.addWatch("/foo", event -> {
+                }, AddWatchMode.PERSISTENT_RECURSIVE);
+            }
+        });
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
index 005b525f554..f519c95d197 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -68,7 +68,7 @@ public void process(WatchedEvent event) {
         public void assertEvent(long timeout, EventType eventType) {
             try {
                 WatchedEvent event = dataEvents.poll(timeout, TimeUnit.MILLISECONDS);
-                assertNotNull("do not receive a " + eventType, event);
+                assertNotNull(event, "do not receive a " + eventType);
                 assertEquals(eventType, event.getType());
             } catch (InterruptedException e) {
                 LOG.warn("ignoring interrupt during EventsWatcher assertEvent");
@@ -94,7 +94,7 @@ private ZooKeeper createClient(QuorumUtil qu, int id) throws IOException {
         return createClient(qu, id, new EventsWatcher());
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         System.setProperty("zookeeper.admin.enableServer", "false");
 
@@ -106,7 +106,7 @@ public void setUp() throws IOException {
         zk2 = createClient(qu, 2);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws InterruptedException {
         if (zk1 != null) {
             zk1.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
index 17d3510329e..f4a0298f233 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
@@ -18,15 +18,15 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.proto.WatcherEvent;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class WatchedEventTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
index 5a274b53b0e..0987c4cf7e9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -37,7 +37,9 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatcherFuncTest extends ClientBase {
 
@@ -63,7 +65,7 @@ public void process(WatchedEvent event) {
             try {
                 events.put(event);
             } catch (InterruptedException e) {
-                assertTrue("interruption unexpected", false);
+                assertTrue(false, "interruption unexpected");
             }
         }
         public void verify(List<EventType> expected) throws InterruptedException {
@@ -88,6 +90,7 @@ public void verify(List<EventType> expected) throws InterruptedException {
 
     private List<EventType> expected;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -103,6 +106,7 @@ public void setUp() throws Exception {
         expected = new ArrayList<EventType>();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         client.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
index 6f419ed0e5b..4260c3c15de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -40,8 +40,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -79,7 +79,7 @@ public void process(WatchedEvent event) {
 
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         // Reset to default value since some test cases set this to true.
@@ -177,9 +177,9 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
 
             WatchedEvent event = queue.poll(10, TimeUnit.SECONDS);
 
-            assertNotNull("No watch event was received after closing the Zookeeper client. A 'Closed' event should have occurred", event);
-            assertEquals("Closed events are not generated by the server, and so should have a type of 'None'", Event.EventType.None, event.getType());
-            assertEquals("A 'Closed' event was expected as the Zookeeper client was closed without altering the node it was watching", Event.KeeperState.Closed, event.getState());
+            assertNotNull(event, "No watch event was received after closing the Zookeeper client. A 'Closed' event should have occurred");
+            assertEquals(Event.EventType.None, event.getType(), "Closed events are not generated by the server, and so should have a type of 'None'");
+            assertEquals(Event.KeeperState.Closed, event.getState(), "A 'Closed' event was expected as the Zookeeper client was closed without altering the node it was watching");
         } finally {
             if (zk != null) {
                 zk.close();
@@ -241,7 +241,7 @@ public void testWatchAutoResetWithPending() throws Exception {
             zk.exists("/test", watches[i], cbs[i], count);
         }
         zk.exists("/test", false);
-        assertTrue("Failed to pause the connection!", zk.pauseCnxn(3000));
+        assertTrue(zk.pauseCnxn(3000), "Failed to pause the connection!");
         zk2.close();
         stopServer();
         watches[0].waitForDisconnected(60000);
@@ -255,13 +255,13 @@ public void testWatchAutoResetWithPending() throws Exception {
         assertEquals(null, zk.exists("/test", false));
         waitForAllWatchers();
         for (int i = 0; i < COUNT / 2; i++) {
-            assertEquals("For " + i, 1, watches[i].events.size());
+            assertEquals(1, watches[i].events.size(), "For " + i);
         }
         for (int i = COUNT / 2; i < COUNT; i++) {
             if (cbs[i].rc == 0) {
-                assertEquals("For " + i, 1, watches[i].events.size());
+                assertEquals(1, watches[i].events.size(), "For " + i);
             } else {
-                assertEquals("For " + i, 0, watches[i].events.size());
+                assertEquals(0, watches[i].events.size(), "For " + i);
             }
         }
         assertEquals(COUNT, count[0]);
@@ -349,7 +349,7 @@ private void testWatcherAutoReset(ZooKeeper zk, MyWatcher globalWatcher, MyWatch
         WatchedEvent e;
         if (!disableAutoWatchReset) {
             e = localWatcher.events.poll(TIMEOUT, TimeUnit.MILLISECONDS);
-            assertEquals(e.getPath(), EventType.NodeDataChanged, e.getType());
+            assertEquals(EventType.NodeDataChanged, e.getType(), e.getPath());
             assertEquals("/watchtest/child", e.getPath());
         } else {
             // we'll catch this later if it does happen after timeout, so
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
index 62dabccf037..bb04a9fdd66 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.math.BigInteger;
 import java.net.Socket;
 import java.security.InvalidKeyException;
@@ -43,8 +43,8 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.MockServerCnxn;
 import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class X509AuthTest extends ZKTestCase {
 
@@ -52,7 +52,7 @@ public class X509AuthTest extends ZKTestCase {
     private static TestCertificate superCert;
     private static TestCertificate unknownCert;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.X509AuthenticationProvider.superUser", "CN=SUPER");
         System.setProperty("zookeeper.ssl.keyManager", "org.apache.zookeeper.test.X509AuthTest.TestKeyManager");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java
index 133ed39927e..d1da7faab80 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.io.RandomAccessFile;
@@ -35,9 +35,9 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,13 +48,13 @@ public class ZkDatabaseCorruptionTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
     }
@@ -105,7 +105,7 @@ public void testCorruption() throws Exception {
             ++leaderSid;
         }
 
-        assertNotNull("Cannot find the leader.", leader);
+        assertNotNull(leader, "Cannot find the leader.");
         leader.shutdown();
 
         // now corrupt the leader's database
@@ -153,7 +153,7 @@ public void testCorruption() throws Exception {
         for (int i = 0; i < 5; i++) {
             if (leaderSid != (i + 1)) {
                 String hp = list[i];
-                assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT));
+                assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
                 LOG.info("{} is accepting client connections", hp);
             } else {
                 LOG.info("Skipping the leader");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
index 2eb2c6caabe..99a595f42a1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -32,7 +32,7 @@
 import org.apache.zookeeper.cli.SetQuotaCommand;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperQuotaTest extends ClientBase {
 
@@ -55,14 +55,14 @@ public void testQuota() throws Exception {
         String absolutePath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
         byte[] data = zk.getData(absolutePath, false, new Stat());
         StatsTrack st = new StatsTrack(new String(data));
-        assertTrue("bytes are set", st.getBytes() == 5L);
-        assertTrue("num count is set", st.getCount() == 10);
+        assertTrue(st.getBytes() == 5L, "bytes are set");
+        assertTrue(st.getCount() == 10, "num count is set");
 
         String statPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
         byte[] qdata = zk.getData(statPath, false, new Stat());
         StatsTrack qst = new StatsTrack(new String(qdata));
-        assertTrue("bytes are set", qst.getBytes() == 8L);
-        assertTrue("count is set", qst.getCount() == 2);
+        assertTrue(qst.getBytes() == 8L, "bytes are set");
+        assertTrue(qst.getCount() == 2, "count is set");
 
         //force server to restart and load from snapshot, not txn log
         stopServer();
@@ -70,8 +70,7 @@ public void testQuota() throws Exception {
         stopServer();
         startServer();
         ZooKeeperServer server = serverFactory.getZooKeeperServer();
-        assertNotNull("Quota is still set", server.getZKDatabase().getDataTree().getMaxPrefixWithQuota(path)
-                                                           != null);
+        assertNotNull(server.getZKDatabase().getDataTree().getMaxPrefixWithQuota(path) != null, "Quota is still set");
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
index 42f0ebee751..c4ef9e23dad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.List;
 import java.util.concurrent.LinkedBlockingQueue;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
index 423b38bb435..d584c28da9d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
@@ -18,50 +18,29 @@
 
 package org.apache.zookeeper.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStoreException;
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
-import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
 import org.apache.zookeeper.common.BaseX509ParameterizedTestCase;
 import org.apache.zookeeper.common.KeyStoreFileType;
 import org.apache.zookeeper.common.X509KeyType;
-import org.apache.zookeeper.common.X509TestContext;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class PemReaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public PemReaderTest(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                        .setTempDir(tempDir)
-                        .setKeyStorePassword(keyPassword)
-                        .setKeyStoreKeyType(certKeyType)
-                        .setTrustStorePassword(keyPassword)
-                        .setTrustStoreKeyType(caKeyType)
-                        .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadPrivateKeyFromKeyStore() throws IOException, GeneralSecurityException {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPrivateKeyFromKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         Optional<String> optPassword = x509TestContext.getKeyStorePassword().length() > 0
                                                ? Optional.of(x509TestContext.getKeyStorePassword())
                                                : Optional.empty();
@@ -70,53 +49,91 @@ public void testLoadPrivateKeyFromKeyStore() throws IOException, GeneralSecurity
     }
 
     // Try to load a password-protected private key without providing a password
-    @Test(expected = GeneralSecurityException.class)
-    public void testLoadEncryptedPrivateKeyFromKeyStoreWithoutPassword() throws GeneralSecurityException, IOException {
-        if (!x509TestContext.isKeyStoreEncrypted()) {
-            throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
-        }
-        PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.empty());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadEncryptedPrivateKeyFromKeyStoreWithoutPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(GeneralSecurityException.class, () -> {
+            if (!x509TestContext.isKeyStoreEncrypted()) {
+                throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
+            }
+            PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.empty());
+        });
     }
 
     // Try to load a password-protected private key with the wrong password
-    @Test(expected = GeneralSecurityException.class)
-    public void testLoadEncryptedPrivateKeyFromKeyStoreWithWrongPassword() throws GeneralSecurityException, IOException {
-        if (!x509TestContext.isKeyStoreEncrypted()) {
-            throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
-        }
-        PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadEncryptedPrivateKeyFromKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(GeneralSecurityException.class, () -> {
+            if (!x509TestContext.isKeyStoreEncrypted()) {
+                throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
+            }
+            PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+        });
     }
 
     // Try to load a non-protected private key while providing a password
-    @Test(expected = IOException.class)
-    public void testLoadUnencryptedPrivateKeyFromKeyStoreWithWrongPassword() throws GeneralSecurityException, IOException {
-        if (x509TestContext.isKeyStoreEncrypted()) {
-            throw new IOException();
-        }
-        PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadUnencryptedPrivateKeyFromKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            if (x509TestContext.isKeyStoreEncrypted()) {
+                throw new IOException();
+            }
+            PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+        });
     }
 
     // Expect this to fail, the trust store does not contain a private key
-    @Test(expected = KeyStoreException.class)
-    public void testLoadPrivateKeyFromTrustStore() throws IOException, GeneralSecurityException {
-        PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.empty());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPrivateKeyFromTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(KeyStoreException.class, () -> {
+            PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.empty());
+        });
     }
 
     // Expect this to fail, the trust store does not contain a private key
-    @Test(expected = KeyStoreException.class)
-    public void testLoadPrivateKeyFromTrustStoreWithPassword() throws IOException, GeneralSecurityException {
-        PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.of("foobar"));
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPrivateKeyFromTrustStoreWithPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(KeyStoreException.class, () -> {
+            PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.of("foobar"));
+        });
     }
 
-    @Test
-    public void testLoadCertificateFromKeyStore() throws IOException, GeneralSecurityException {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadCertificateFromKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         List<X509Certificate> certs = PemReader.readCertificateChain(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM));
         assertEquals(1, certs.size());
         assertEquals(x509TestContext.getKeyStoreCertificate(), certs.get(0));
     }
 
-    @Test
-    public void testLoadCertificateFromTrustStore() throws IOException, GeneralSecurityException {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadCertificateFromTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         List<X509Certificate> certs = PemReader.readCertificateChain(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM));
         assertEquals(1, certs.size());
         assertEquals(x509TestContext.getTrustStoreCertificate(), certs.get(0));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java b/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java
index ac24d2e5b4d..c68397f0db2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java
@@ -18,12 +18,13 @@
 
 package org.apache.zookeeper.util;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class TestCircularBlockingQueue {
 
@@ -36,17 +37,18 @@ public void testCircularBlockingQueue() throws InterruptedException {
     testQueue.offer(2);
     testQueue.offer(3);
 
-    Assert.assertEquals(2, testQueue.size());
+    assertEquals(2, testQueue.size());
 
-    Assert.assertEquals(2, testQueue.take().intValue());
-    Assert.assertEquals(3, testQueue.take().intValue());
+    assertEquals(2, testQueue.take().intValue());
+    assertEquals(3, testQueue.take().intValue());
 
-    Assert.assertEquals(1L, testQueue.getDroppedCount());
-    Assert.assertEquals(0, testQueue.size());
-    Assert.assertEquals(true, testQueue.isEmpty());
+    assertEquals(1L, testQueue.getDroppedCount());
+    assertEquals(0, testQueue.size());
+    assertEquals(true, testQueue.isEmpty());
   }
 
-  @Test(timeout = 10000L)
+  @Test
+  @Timeout(value = 10)
   public void testCircularBlockingQueueTakeBlock()
       throws InterruptedException, ExecutionException {
 
@@ -67,7 +69,7 @@ public void testCircularBlockingQueueTakeBlock()
       testQueue.offer(10);
 
       Integer result = testTake.get();
-      Assert.assertEquals(10, result.intValue());
+      assertEquals(10, result.intValue());
     } finally {
       executor.shutdown();
     }

From 531aae3edcf88819f90a324de3171276ecfaba25 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Thu, 6 Aug 2020 16:53:00 +0200
Subject: [PATCH 066/591] ZOOKEEPER-3855: Upgrade jUnit in
 ZooKeeper-Metrics-providers

Change-Id: I511cb610e269b502e946f52d152db7dcf6d2f2d4

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1421 from tamaashu/ZOOKEEPER-3855
---
 .../zookeeper-prometheus-metrics/pom.xml      | 10 +++++++---
 .../metrics/prometheus/ExportJvmInfoTest.java |  4 ++--
 .../PrometheusMetricsProviderTest.java        | 20 +++++++++----------
 3 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index 4f70e98643f..d21d3535b40 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -75,10 +75,14 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>org.junit.vintage</groupId>
-      <artifactId>junit-vintage-engine</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.platform</groupId>
+      <artifactId>junit-platform-runner</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
-
 </project>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
index fb5353d83dc..82dc5aa1614 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import io.prometheus.client.CollectorRegistry;
 import java.util.Properties;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Tests about Prometheus Metrics Provider. Please note that we are not testing
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 2d691db4f86..720cec45bc0 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.metrics.prometheus;
 
 import static org.hamcrest.CoreMatchers.containsString;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import io.prometheus.client.CollectorRegistry;
@@ -39,9 +39,9 @@
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.Summary;
 import org.hamcrest.CoreMatchers;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Tests about Prometheus Metrics Provider. Please note that we are not testing
@@ -51,7 +51,7 @@ public class PrometheusMetricsProviderTest {
 
     private PrometheusMetricsProvider provider;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         CollectorRegistry.defaultRegistry.clear();
         provider = new PrometheusMetricsProvider();
@@ -62,7 +62,7 @@ public void setup() throws Exception {
         provider.start();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         if (provider != null) {
             provider.stop();

From 4df268b970f525d128219ec81007355d77f6417c Mon Sep 17 00:00:00 2001
From: ZWShuai91 <17610028856@163.com>
Date: Thu, 6 Aug 2020 18:46:52 +0200
Subject: [PATCH 067/591] ZOOKEEPER-3883: new UncaughtExceptionHandler object
 with lambda

Author: ZWShuai91 <17610028856@163.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1396 from ZWShuai91/ZOOKEEPER-3883
---
 .../org/apache/zookeeper/server/NIOServerCnxnFactory.java | 6 +-----
 .../java/org/apache/zookeeper/server/ZooKeeperThread.java | 8 +-------
 2 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index 558b93be59b..17fa3622d50 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -82,11 +82,7 @@ public class NIOServerCnxnFactory extends ServerCnxnFactory {
     public static final String ZOOKEEPER_NIO_SHUTDOWN_TIMEOUT = "zookeeper.nio.shutdownTimeout";
 
     static {
-        Thread.setDefaultUncaughtExceptionHandler(new Thread.UncaughtExceptionHandler() {
-            public void uncaughtException(Thread t, Throwable e) {
-                LOG.error("Thread {} died", t, e);
-            }
-        });
+        Thread.setDefaultUncaughtExceptionHandler((t, e) -> LOG.error("Thread {} died", t, e));
 
         /**
          * Value of 0 disables use of direct buffers and instead uses
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java
index ab5c5f069b1..137b718db38 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java
@@ -29,13 +29,7 @@ public class ZooKeeperThread extends Thread {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperThread.class);
 
-    private UncaughtExceptionHandler uncaughtExceptionalHandler = new UncaughtExceptionHandler() {
-
-        @Override
-        public void uncaughtException(Thread t, Throwable e) {
-            handleException(t.getName(), e);
-        }
-    };
+    private UncaughtExceptionHandler uncaughtExceptionalHandler = (t, e) -> handleException(t.getName(), e);
 
     public ZooKeeperThread(String threadName) {
         super(threadName);

From 08ae49dee4d698fb8c926f3842acdcb0f5b3c58e Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Fri, 7 Aug 2020 10:46:19 +0000
Subject: [PATCH 068/591] ZOOKEEPER-3854: Upgrade jUnit in ZooKeeper-Recipes

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1423 from tamaashu/ZOOKEEPER-3854
---
 zookeeper-recipes/pom.xml                     |   4 +-
 .../leader/LeaderElectionSupportTest.java     |  27 ++--
 .../zookeeper/recipes/lock/WriteLockTest.java |  17 +--
 .../zookeeper/recipes/lock/ZNodeNameTest.java | 120 +++++++++---------
 .../recipes/queue/DistributedQueueTest.java   |  32 ++---
 5 files changed, 104 insertions(+), 96 deletions(-)

diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
index 39a898ccda4..2ab9d8eb629 100755
--- a/zookeeper-recipes/pom.xml
+++ b/zookeeper-recipes/pom.xml
@@ -80,8 +80,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>org.junit.vintage</groupId>
-      <artifactId>junit-vintage-engine</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java b/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java
index 2ea721e519c..65df57d46bd 100644
--- a/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java
@@ -17,6 +17,8 @@
 
 package org.apache.zookeeper.recipes.leader;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
@@ -27,10 +29,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.recipes.leader.LeaderElectionSupport.EventType;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +45,7 @@ public class LeaderElectionSupportTest extends ClientBase {
 
     private ZooKeeper zooKeeper;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
 
@@ -57,7 +58,7 @@ public void setUp() throws Exception {
             CreateMode.PERSISTENT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (zooKeeper != null) {
             zooKeeper.delete(TEST_ROOT_NODE + Thread.currentThread().getId(), -1);
@@ -85,7 +86,7 @@ public void testNodes3() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(10, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -102,7 +103,7 @@ public void testNodes9() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(10, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -119,7 +120,7 @@ public void testNodes20() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(10, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -136,7 +137,7 @@ public void testNodes100() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(20, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -170,8 +171,8 @@ public void testGetLeaderHostName() throws Exception {
 
         String leaderHostName = electionSupport.getLeaderHostName();
 
-        Assert.assertNotNull(leaderHostName);
-        Assert.assertEquals("foohost", leaderHostName);
+        assertNotNull(leaderHostName);
+        assertEquals("foohost", leaderHostName);
 
         electionSupport.stop();
     }
@@ -220,7 +221,7 @@ public void onElectionEvent(EventType eventType) {
         expectedevents.add(EventType.ELECTED_START);
         expectedevents.add(EventType.ELECTED_COMPLETE);
 
-        Assert.assertEquals("Events has failed to executed in the order", expectedevents, events);
+        assertEquals(expectedevents, events, "Events has failed to executed in the order");
 
         electionSupport2.stop();
     }
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java
index 6809fadf521..e9082239af4 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java
@@ -18,13 +18,14 @@
 
 package org.apache.zookeeper.recipes.lock;
 
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * test for writelock.
@@ -74,11 +75,11 @@ protected void runTest(int count) throws Exception {
         dumpNodes(count);
 
         // lets assert that the first election is the leader
-        Assert.assertTrue("The first znode should be the leader " + first.getId(), first.isOwner());
+        assertTrue(first.isOwner(), "The first znode should be the leader " + first.getId());
 
         for (int i = 1; i < count; i++) {
             WriteLock node = nodes[i];
-            Assert.assertFalse("Node should not be the leader " + node.getId(), node.isOwner());
+            assertFalse(node.isOwner(), "Node should not be the leader " + node.getId());
         }
 
         if (count > 1) {
@@ -92,11 +93,11 @@ protected void runTest(int count) throws Exception {
                 WriteLock second = nodes[1];
                 dumpNodes(count);
                 // lets assert that the first election is the leader
-                Assert.assertTrue("The second znode should be the leader " + second.getId(), second.isOwner());
+                assertTrue(second.isOwner(), "The second znode should be the leader " + second.getId());
 
                 for (int i = 2; i < count; i++) {
                     WriteLock node = nodes[i];
-                    Assert.assertFalse("Node should not be the leader " + node.getId(), node.isOwner());
+                    assertFalse(node.isOwner(), "Node should not be the leader " + node.getId());
                 }
             }
 
@@ -130,7 +131,7 @@ protected void dumpNodes(int count) {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (nodes != null) {
             for (int i = 0; i < nodes.length; i++) {
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
index 03dc2c29b06..aac76cc6205 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
@@ -18,12 +18,14 @@
 
 package org.apache.zookeeper.recipes.lock;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Iterator;
 import java.util.stream.Collectors;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test for znodenames.
@@ -41,24 +43,24 @@ public void testOrderWithSamePrefix() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("x-1", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("x-1", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-3", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("x-3", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-5", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(5), zname.getSequence().get());
+        assertEquals("x-5", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(5), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-11", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(11), zname.getSequence().get());
+        assertEquals("x-11", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(11), zname.getSequence().get());
     }
 
     @Test
@@ -72,29 +74,29 @@ public void testOrderWithDifferentPrefixes() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("r-1", zname.getName());
-        Assert.assertEquals("r", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("r-1", zname.getName());
+        assertEquals("r", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("w-1", zname.getName());
-        Assert.assertEquals("w", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("w-1", zname.getName());
+        assertEquals("w", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-2", zname.getName());
-        Assert.assertEquals("r", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("r-2", zname.getName());
+        assertEquals("r", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("w-2", zname.getName());
-        Assert.assertEquals("w", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("w-2", zname.getName());
+        assertEquals("w", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-3", zname.getName());
-        Assert.assertEquals("r", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("r-3", zname.getName());
+        assertEquals("r", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
     }
 
     @Test
@@ -112,19 +114,19 @@ public void testOrderWithDifferentPrefixIncludingSessionId() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("x-98566387950223723-0000000001", zname.getName());
-        Assert.assertEquals("x-98566387950223723", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("x-98566387950223723-0000000001", zname.getName());
+        assertEquals("x-98566387950223723", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-242681582799028564-0000000002", zname.getName());
-        Assert.assertEquals("x-242681582799028564", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("x-242681582799028564-0000000002", zname.getName());
+        assertEquals("x-242681582799028564", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-170623981976748329-0000000003", zname.getName());
-        Assert.assertEquals("x-170623981976748329", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("x-170623981976748329-0000000003", zname.getName());
+        assertEquals("x-170623981976748329", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
     }
 
     @Test
@@ -138,19 +140,19 @@ public void testOrderWithExtraPrefixes() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("r-2-2-1", zname.getName());
-        Assert.assertEquals("r-2-2", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("r-2-2-1", zname.getName());
+        assertEquals("r-2-2", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-1-3-2", zname.getName());
-        Assert.assertEquals("r-1-3", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("r-1-3-2", zname.getName());
+        assertEquals("r-1-3", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-3-1-3", zname.getName());
-        Assert.assertEquals("r-3-1", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("r-3-1-3", zname.getName());
+        assertEquals("r-3-1", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
     }
 
     @Test
@@ -164,24 +166,26 @@ public void testMissingSequenceNumber() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("b-1", zname.getName());
-        Assert.assertEquals("b", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("b-1", zname.getName());
+        assertEquals("b", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("a", zname.getName());
-        Assert.assertEquals("a", zname.getPrefix());
-        Assert.assertFalse(zname.getSequence().isPresent());
+        assertEquals("a", zname.getName());
+        assertEquals("a", zname.getPrefix());
+        assertFalse(zname.getSequence().isPresent());
 
         zname = it.next();
-        Assert.assertEquals("c", zname.getName());
-        Assert.assertEquals("c", zname.getPrefix());
-        Assert.assertFalse(zname.getSequence().isPresent());
+        assertEquals("c", zname.getName());
+        assertEquals("c", zname.getPrefix());
+        assertFalse(zname.getSequence().isPresent());
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void testNullName() {
-        new ZNodeName(null);
+        assertThrows(NullPointerException.class, () -> {
+            new ZNodeName(null);
+        });
     }
 
 }
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java b/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
index 73829204a5b..0493d879235 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
@@ -18,20 +18,22 @@
 
 package org.apache.zookeeper.recipes.queue;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.NoSuchElementException;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Tests for {@link DistributedQueue}.
  */
 public class DistributedQueueTest extends ClientBase {
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         super.tearDown();
     }
@@ -51,7 +53,7 @@ public void testOffer1() throws Exception {
         queueHandles[0].offer(testString.getBytes());
 
         byte[] dequeuedBytes = queueHandles[0].remove();
-        Assert.assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes), testString);
     }
 
     @Test
@@ -69,7 +71,7 @@ public void testOffer2() throws Exception {
         queueHandles[0].offer(testString.getBytes());
 
         byte[] dequeuedBytes = queueHandles[1].remove();
-        Assert.assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes), testString);
     }
 
     @Test
@@ -87,7 +89,7 @@ public void testTake1() throws Exception {
         queueHandles[0].offer(testString.getBytes());
 
         byte[] dequeuedBytes = queueHandles[0].take();
-        Assert.assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes), testString);
     }
 
     @Test
@@ -107,7 +109,7 @@ public void testRemove1() throws Exception {
             return;
         }
 
-        Assert.fail();
+        fail();
     }
 
     public void createNremoveMtest(String dir, int n, int m) throws Exception {
@@ -130,8 +132,8 @@ public void createNremoveMtest(String dir, int n, int m) throws Exception {
             data = queueHandles[1].remove();
         }
 
-        Assert.assertNotNull(data);
-        Assert.assertEquals(new String(data), testString + (m - 1));
+        assertNotNull(data);
+        assertEquals(new String(data), testString + (m - 1));
     }
 
     @Test
@@ -161,7 +163,7 @@ public void createNremoveMelementTest(String dir, int n, int m) throws Exception
         for (int i = 0; i < m; i++) {
             queueHandles[1].remove();
         }
-        Assert.assertEquals(new String(queueHandles[1].element()), testString + m);
+        assertEquals(new String(queueHandles[1].element()), testString + m);
     }
 
     @Test
@@ -219,8 +221,8 @@ public void testTakeWait1() throws Exception {
 
         takeThread.join();
 
-        Assert.assertNotNull(takeResult[0]);
-        Assert.assertEquals(new String(takeResult[0]), testString);
+        assertNotNull(takeResult[0]);
+        assertEquals(new String(takeResult[0]), testString);
     }
 
     @Test
@@ -260,8 +262,8 @@ public void testTakeWait2() throws Exception {
 
             takeThread.join();
 
-            Assert.assertNotNull(takeResult[0]);
-            Assert.assertEquals(new String(takeResult[0]), threadTestString);
+            assertNotNull(takeResult[0]);
+            assertEquals(new String(takeResult[0]), threadTestString);
         }
     }
 

From b86899ec9ced35c895f9c0a8a54f2396e94a76c0 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Sat, 8 Aug 2020 11:51:43 +0200
Subject: [PATCH 069/591] ZOOKEEPER-3905: Race condition causes sessions to be
 created for clients even though their certificate authentication has failed

Netty channel doesn't get closed if authentication fails after a successful SSL handshake. We need a custom authentication provider in order to trigger this, because the default implementation does the same check as for the SSL handshake. Hence it never fails.

Unit test added to make sure client is not able to connect.

Target branches: master, 3.6, 3.5 (will create separate PR for 3.5)

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1422 from anmolnar/ZOOKEEPER-3905
---
 .../zookeeper/server/NettyServerCnxn.java     |  3 ++
 .../server/auth/ProviderRegistry.java         |  6 ++-
 .../server/quorum/QuorumPeerConfig.java       |  8 +--
 .../AuthFailX509AuthenticationProvider.java   | 51 +++++++++++++++++++
 .../org/apache/zookeeper/test/ClientBase.java |  6 ++-
 .../apache/zookeeper/test/ClientSSLTest.java  | 27 ++++++++++
 6 files changed, 95 insertions(+), 6 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index cf9aa457f8b..e3acdcdca80 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -115,6 +115,9 @@ public void close() {
         // if this is not in cnxns then it's already closed
         if (!factory.cnxns.remove(this)) {
             LOG.debug("cnxns size:{}", factory.cnxns.size());
+            if (channel.isOpen()) {
+                channel.close();
+            }
             return;
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
index 29997a2c919..856cf78687d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
@@ -29,8 +29,10 @@ public class ProviderRegistry {
 
     private static final Logger LOG = LoggerFactory.getLogger(ProviderRegistry.class);
 
+    public static final String AUTHPROVIDER_PROPERTY_PREFIX = "zookeeper.authProvider.";
+
     private static boolean initialized = false;
-    private static Map<String, AuthenticationProvider> authenticationProviders = new HashMap<>();
+    private static final Map<String, AuthenticationProvider> authenticationProviders = new HashMap<>();
 
     //VisibleForTesting
     public static void reset() {
@@ -49,7 +51,7 @@ public static void initialize() {
             Enumeration<Object> en = System.getProperties().keys();
             while (en.hasMoreElements()) {
                 String k = (String) en.nextElement();
-                if (k.startsWith("zookeeper.authProvider.")) {
+                if (k.startsWith(AUTHPROVIDER_PROPERTY_PREFIX)) {
                     String className = System.getProperty(k);
                     try {
                         Class<?> c = ZooKeeperServer.class.getClassLoader().loadClass(className);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index dbebef3734e..f3f456ebc0d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -46,6 +46,7 @@
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuth;
@@ -505,11 +506,12 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
      */
     public static void configureSSLAuth() throws ConfigException {
         try (ClientX509Util clientX509Util = new ClientX509Util()) {
-            String sslAuthProp = "zookeeper.authProvider."
+            String sslAuthProp = ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX
                                  + System.getProperty(clientX509Util.getSslAuthProviderProperty(), "x509");
             if (System.getProperty(sslAuthProp) == null) {
-                if ("zookeeper.authProvider.x509".equals(sslAuthProp)) {
-                    System.setProperty("zookeeper.authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+                if ((ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "x509").equals(sslAuthProp)) {
+                    System.setProperty(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "x509",
+                        "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
                 } else {
                     throw new ConfigException("No auth provider configured for the SSL authentication scheme '"
                                               + System.getProperty(clientX509Util.getSslAuthProviderProperty())
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java
new file mode 100644
index 00000000000..32121e6ef7a
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import javax.net.ssl.X509KeyManager;
+import javax.net.ssl.X509TrustManager;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.common.X509Exception;
+import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class AuthFailX509AuthenticationProvider extends X509AuthenticationProvider {
+  private static final Logger LOG = LoggerFactory.getLogger(AuthFailX509AuthenticationProvider.class);
+
+  public AuthFailX509AuthenticationProvider() throws X509Exception {
+    super();
+  }
+
+  public AuthFailX509AuthenticationProvider(X509TrustManager trustManager, X509KeyManager keyManager) {
+    super(trustManager, keyManager);
+  }
+
+  @Override
+  public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
+    LOG.info("Authentication failed");
+    return KeeperException.Code.AUTHFAILED;
+  }
+
+  @Override
+  public String getScheme() {
+    return "authfail";
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index 532a075c407..5904a376791 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -735,10 +735,14 @@ public static ZooKeeper createZKClient(String cxnString) throws Exception {
      *             in cases of network failure
      */
     public static ZooKeeper createZKClient(String cxnString, int sessionTimeout) throws IOException {
+        return createZKClient(cxnString, sessionTimeout, CONNECTION_TIMEOUT);
+    }
+
+    public static ZooKeeper createZKClient(String cxnString, int sessionTimeout, long connectionTimeout) throws IOException {
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(cxnString, sessionTimeout, watcher);
         try {
-            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            watcher.waitForConnected(connectionTimeout);
         } catch (InterruptedException | TimeoutException e) {
             fail("ZooKeeper client can not connect to " + cxnString);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index 807b7777fcd..db1c81fb25e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -22,7 +22,11 @@
 
 package org.apache.zookeeper.test;
 
+import static org.hamcrest.CoreMatchers.startsWith;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
@@ -31,6 +35,7 @@
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -156,4 +161,26 @@ public void testSecureStandaloneServer() throws Exception {
         mt.shutdown();
     }
 
+    @Test
+    public void testSecureStandaloneServerAuthFail() throws IOException {
+        try {
+            System.setProperty(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "authfail",
+                AuthFailX509AuthenticationProvider.class.getName());
+            System.setProperty(clientX509Util.getSslAuthProviderProperty(), "authfail");
+
+            Integer secureClientPort = PortAssignment.unique();
+            MainThread mt = new MainThread(MainThread.UNSET_MYID, "", secureClientPort, false);
+            mt.start();
+
+            AssertionError ex = assertThrows("Client should not able to connect when authentication fails", AssertionError.class,
+                () -> {
+                    ClientBase.createZKClient("localhost:" + secureClientPort, TIMEOUT, 3000);
+                });
+            assertThat("Exception message does not match (different exception caught?)",
+                ex.getMessage(), startsWith("ZooKeeper client can not connect to"));
+        } finally {
+            System.clearProperty(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "authfail");
+            System.clearProperty(clientX509Util.getSslAuthProviderProperty());
+        }
+    }
 }

From 0b386e4579645761e341510b185899d060e51c82 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Wed, 12 Aug 2020 11:46:50 +0200
Subject: [PATCH 070/591] =?UTF-8?q?ZOOKEEPER-3862:=20Re-enable=20deprecati?=
 =?UTF-8?q?on=20check=20after=20finishing=20jUnit=20upg=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…rade

Last changes on sub-components which need to be build every time and re-enable deprecation check for the builds.

Change-Id: Iebf83d7727d9d7535b367613d262800ad6331fa7

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: eolivelli@apache.org, andor@apache.org

Closes #1424 from tamaashu/ZOOKEEPER-3862
---
 pom.xml                                                   | 1 +
 .../zookeeper-compatibility-tests-curator/pom.xml         | 4 ++--
 .../compatibility/TestApacheCuratorCompatibility.java     | 8 ++++----
 .../java/org/apache/zookeeper/JUnit4ZKTestRunner.java     | 0
 zookeeper-server/pom.xml                                  | 5 -----
 5 files changed, 7 insertions(+), 11 deletions(-)
 rename {zookeeper-server => zookeeper-contrib/zookeeper-contrib-rest}/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java (100%)

diff --git a/pom.xml b/pom.xml
index 6edfe40b356..26c32d1c176 100755
--- a/pom.xml
+++ b/pom.xml
@@ -665,6 +665,7 @@
              <showWarnings>true</showWarnings>
              <compilerArgs>
                <compilerArg>-Werror</compilerArg>
+               <compilerArg>-Xlint:deprecation</compilerArg>
                <compilerArg>-Xlint:unchecked</compilerArg>
                <compilerArg>-Xlint:-options</compilerArg>
                <compilerArg>-Xdoclint:-missing</compilerArg>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index 074a4554725..e25463055ee 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -71,8 +71,8 @@
         </dependency>
 
         <dependency>
-            <groupId>org.junit.vintage</groupId>
-            <artifactId>junit-vintage-engine</artifactId>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-engine</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
index b60a0042244..d793d6e4c49 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.compatibility;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
@@ -28,7 +28,7 @@
 import org.apache.curator.framework.recipes.cache.CuratorCache;
 import org.apache.curator.retry.RetryOneTime;
 import org.apache.curator.test.TestingServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Make sure minimal Apache Curator APIs work correctly. As it's a widely used ZooKeeper
@@ -67,7 +67,7 @@ public void testBasicUsageOfApisAndRecipes() throws Exception {
     private static String poll(BlockingQueue<String> queue) {
         try {
             String value = queue.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS);
-            assertNotNull("Event poll timed out", value);
+            assertNotNull(value, "Event poll timed out");
             return value;
         } catch (InterruptedException e) {
             Thread.currentThread().interrupt();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java b/zookeeper-contrib/zookeeper-contrib-rest/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java
similarity index 100%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java
rename to zookeeper-contrib/zookeeper-contrib-rest/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 7440ddeb99c..059f2fff0fb 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -151,11 +151,6 @@
       <artifactId>jmockit</artifactId>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>org.junit.vintage</groupId>
-      <artifactId>junit-vintage-engine</artifactId>
-      <scope>test</scope>
-    </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter-api</artifactId>

From e6c089b0721aa99803d792d64a4949e057395cda Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Fri, 14 Aug 2020 16:44:01 +0200
Subject: [PATCH 071/591] ZOOKEEPER-3896: Added cleanup bits to all ZK builds

Recently I noticed some weird null pointer exception issues during compile in out new builds. I usually resolve this by a full "git clean" locally, so I added it to the Jenkinsfiles too.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1431 from anmolnar/ZOOKEEPER-3896
---
 Jenkinsfile           | 11 +++++++++++
 Jenkinsfile-PreCommit |  1 +
 2 files changed, 12 insertions(+)

diff --git a/Jenkinsfile b/Jenkinsfile
index 436c18a17f3..ab7baed630c 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -52,6 +52,7 @@ pipeline {
                     stage('BuildAndTest') {
                         steps {
                             git 'https://github.com/apache/zookeeper'
+                            sh "git clean -fxd"
                             sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
                         }
                         post {
@@ -59,6 +60,16 @@ pipeline {
                                junit '**/target/surefire-reports/TEST-*.xml'
                                archiveArtifacts '**/target/*.jar'
                             }
+                            // Jenkins pipeline jobs fill slaves on PRs without this :(
+                            cleanup() {
+                                script {
+                                    sh label: 'Cleanup workspace', script: '''
+                                        # See HADOOP-13951
+                                        chmod -R u+rxw "${WORKSPACE}"
+                                        '''
+                                    deleteDir()
+                                }
+                            }
                         }
                     }
                 }
diff --git a/Jenkinsfile-PreCommit b/Jenkinsfile-PreCommit
index d2a666b7b26..90b3f99ae17 100644
--- a/Jenkinsfile-PreCommit
+++ b/Jenkinsfile-PreCommit
@@ -37,6 +37,7 @@ pipeline {
         stage('BuildAndTest') {
             steps {
                 git 'https://github.com/apache/zookeeper'
+                sh "git clean -fxd"
                 sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
             }
             post {

From e16361d8769eea9e834fd587c3914463b1fb62ed Mon Sep 17 00:00:00 2001
From: odidev <odidev@puresoftware.com>
Date: Fri, 21 Aug 2020 17:54:46 +0200
Subject: [PATCH 072/591] ZOOKEEPER-3913: Upgrade to Netty 4.1.50.Final

- Upgrade Netty to its latest version 4.1.50.Final which includes both security fixes and AArch64 performance improvements
Refer release notes for detail: https://netty.io/news/2020/05/13/4-1-50-Final.html
- Upgraded surefire to 3.0.0-M5 due to compatibility

Author: odidev <odidev@puresoftware.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1428 from odidev/netty_upgrade
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 26c32d1c176..d41dd5596da 100755
--- a/pom.xml
+++ b/pom.xml
@@ -435,7 +435,7 @@
     <mockito.version>2.27.0</mockito.version>
     <hamcrest.version>1.3</hamcrest.version>
     <commons-cli.version>1.2</commons-cli.version>
-    <netty.version>4.1.48.Final</netty.version>
+    <netty.version>4.1.50.Final</netty.version>
     <jetty.version>9.4.24.v20191120</jetty.version>
     <jackson.version>2.10.3</jackson.version>
     <json.version>1.1.1</json.version>

From fa846cbb70c031bdc126977d453dae1812b0012a Mon Sep 17 00:00:00 2001
From: Sankalp Bhatia <sankalpbhatia92@gmail.com>
Date: Mon, 24 Aug 2020 07:47:38 +0000
Subject: [PATCH 073/591] ZOOKEEPER-3893: Enhance documentation for property
 ssl.clientAuth

Currently, the documentation for this property just mentions TBD (check https://zookeeper.apache.org/doc/r3.5.7/zookeeperAdmin.html). I believe this was ignored until versions 3.5.7 (https://issues.apache.org/jira/browse/ZOOKEEPER-3674) and a fix was made. It will be good to add some documentation around it.

Author: Sankalp Bhatia <sankalpbhatia92@gmail.com>
Author: Sankalp <sankal@amazon.com>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1405 from sankalpbhatia/master
---
 .../src/main/resources/markdown/zookeeperAdmin.md      | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 6dbfa277cc7..c579a71c438 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1588,8 +1588,14 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 
 * *ssl.clientAuth* and *ssl.quorum.clientAuth* :
     (Java system properties: **zookeeper.ssl.clientAuth** and **zookeeper.ssl.quorum.clientAuth**)
-    **New in 3.5.5:**
-    TBD
+    **Added in 3.5.5, but broken until 3.5.7:**
+    Specifies options to authenticate ssl connections from clients. Valid values are
+ 
+     * "none": server will not request client authentication 
+     * "want": server will "request" client authentication 
+     * "need": server will "require" client authentication
+
+     Default: "need"
 
 * *ssl.handshakeDetectionTimeoutMillis* and *ssl.quorum.handshakeDetectionTimeoutMillis* :
     (Java system properties: **zookeeper.ssl.handshakeDetectionTimeoutMillis** and **zookeeper.ssl.quorum.handshakeDetectionTimeoutMillis**)

From 9c3281f17be8ad899a03327ccdde612ee6ef9be1 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Thu, 27 Aug 2020 16:57:38 +0000
Subject: [PATCH 074/591] ZOOKEEPER-3801: update CI link to
 https://ci-hadoop.apache.org/view/ZooKeeper/

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1440 from eolivelli/fix/ZOOKEEPER-3801-2
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index d41dd5596da..b44967b126c 100755
--- a/pom.xml
+++ b/pom.xml
@@ -79,7 +79,7 @@
   </issueManagement>
   <ciManagement>
     <system>jenkins</system>
-    <url>https://builds.apache.org/view/Z/view/ZooKeeper/</url>
+    <url>https://ci-hadoop.apache.org/view/ZooKeeper/</url>
   </ciManagement>
   <mailingLists>
     <mailingList>

From d33193a968d4f1ffc5047c40b7a293af04f35a47 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Thu, 3 Sep 2020 11:38:47 +0200
Subject: [PATCH 075/591] ZOOKEEPER-3924: Netty and JLine Licenses are
 inconsistent with jars in the binary tarball in 3.6.2 rc0

- Fix license file names
- Remove legacy pom.template file (for Ant based build ?)

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: andor@apache.org

Closes #1449 from eolivelli/fix/ZOOKEEPER-3924-netty-lic
---
 ...1.LICENSE.txt => jline-2.14.6.LICENSE.txt} |  0
 ... => netty-buffer-4.1.50.Final.LICENSE.txt} |  0
 ...t => netty-codec-4.1.50.Final.LICENSE.txt} |  0
 ... => netty-common-4.1.50.Final.LICENSE.txt} |  0
 ...=> netty-handler-4.1.50.Final.LICENSE.txt} |  0
 ...> netty-resolver-4.1.50.Final.LICENSE.txt} |  0
 ... netty-transport-4.1.50.Final.LICENSE.txt} |  0
 ...ort-native-epoll-4.1.50.Final.LICENSE.txt} |  0
 ...tive-unix-common-4.1.50.Final.LICENSE.txt} |  0
 .../src/main/resources/pom.template           | 41 -------------------
 10 files changed, 41 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{jline-2.11.LICENSE.txt => jline-2.14.6.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.48.Final.LICENSE.txt => netty-buffer-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.48.Final.LICENSE.txt => netty-codec-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.48.Final.LICENSE.txt => netty-common-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.48.Final.LICENSE.txt => netty-handler-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.48.Final.LICENSE.txt => netty-resolver-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.48.Final.LICENSE.txt => netty-transport-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.48.Final.LICENSE.txt => netty-transport-native-epoll-4.1.50.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.50.Final.LICENSE.txt} (100%)
 delete mode 100644 zookeeper-server/src/main/resources/pom.template

diff --git a/zookeeper-server/src/main/resources/lib/jline-2.11.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jline-2.14.6.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jline-2.11.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jline-2.14.6.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.50.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.48.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.50.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/pom.template b/zookeeper-server/src/main/resources/pom.template
deleted file mode 100644
index a02c0b3d235..00000000000
--- a/zookeeper-server/src/main/resources/pom.template
+++ /dev/null
@@ -1,41 +0,0 @@
-SKIP_LINE  ***************************************************************
-SKIP_LINE  * Licensed to the Apache Software Foundation (ASF) under one
-SKIP_LINE  * or more contributor license agreements.  See the NOTICE file
-SKIP_LINE  * distributed with this work for additional information
-SKIP_LINE  * regarding copyright ownership.  The ASF licenses this file
-SKIP_LINE  * to you under the Apache License, Version 2.0 (the
-SKIP_LINE  * "License"); you may not use this file except in compliance
-SKIP_LINE  * with the License.  You may obtain a copy of the License at
-SKIP_LINE  * 
-SKIP_LINE  *   http://www.apache.org/licenses/LICENSE-2.0
-SKIP_LINE  * 
-SKIP_LINE  * Unless required by applicable law or agreed to in writing,
-SKIP_LINE  * software distributed under the License is distributed on an
-SKIP_LINE  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-SKIP_LINE  * KIND, either express or implied.  See the License for the
-SKIP_LINE  * specific language governing permissions and limitations
-SKIP_LINE  * under the License.
-SKIP_LINE  ***************************************************************
-<?xml version="1.0" encoding="UTF-8"?>
-${ivy.pom.license}
-${ivy.pom.header}
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-
-  <modelVersion>4.0.0</modelVersion>
-  <groupId>${ivy.pom.groupId}</groupId>
-  <artifactId>${ivy.pom.artifactId}</artifactId>
-  <packaging>${ivy.pom.packaging}</packaging>
-  <version>${ivy.pom.version}</version>
-  <name>${ivy.pom.name}</name>
-  <description>${ivy.pom.description}</description>
-  <url>${ivy.pom.url}</url>
-
-  <licenses>
-    <license>
-      <name>The Apache Software License, Version 2.0</name>
-      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
-      <distribution>repo</distribution>
-   </license>
-  </licenses>
-</project>

From efe83baeaa6715c32383a383f33f70522c1b7614 Mon Sep 17 00:00:00 2001
From: "Petter A. Urkedal" <paurkedal@gmail.com>
Date: Mon, 14 Sep 2020 07:09:01 +0000
Subject: [PATCH 076/591] ZOOKEEPER-3935: Handle float metrics in
 check_zookeeper

After upgrading to Zookeeper 3.6, Nagios tests for zk_avg_latency started failing due to floating point metrics being compared as strings.

Author: Petter A. Urkedal <paurkedal@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1452 from paurkedal/check_zookeeper-float
---
 .../zookeeper-contrib-monitoring/check_zookeeper.py    | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py b/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
index cff6a1f2618..0a08e84a7cc 100755
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
@@ -311,10 +311,12 @@ def _parse_line(self, line):
         if not key:
             raise ValueError('The key is mandatory and should not be empty')
 
-        try:
-            value = int(value)
-        except (TypeError, ValueError):
-            pass
+        for typ in [int, float]:
+            try:
+                value = typ(value)
+                break
+            except (TypeError, ValueError):
+                pass
 
         return key, value
 

From c47ef905e077184bc5b7f555a3e2dfeb6dc046e1 Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Thu, 17 Sep 2020 07:35:11 +0200
Subject: [PATCH 077/591] ZOOKEEPER-3863: Do not track global sessions in
 ReadOnlyZooKeeperServer

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>

Closes #1380 from jhuan31/ZOOKEEPER-3863
---
 .../apache/zookeeper/server/ServerCnxn.java   |  3 +-
 .../zookeeper/server/ZooKeeperServer.java     | 25 +++++---
 .../quorum/ReadOnlyRequestProcessor.java      | 28 ++++++---
 .../quorum/ReadOnlyZooKeeperServer.java       | 47 +++++++++++++++
 .../zookeeper/test/ReadOnlyModeTest.java      | 57 ++++++++++++++++++-
 5 files changed, 142 insertions(+), 18 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index 78dc8fadccc..0d17ce2bc6a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -101,6 +101,7 @@ public enum DisconnectReason {
         CLOSE_CONNECTION_COMMAND("close_connection_command"),
         CLEAN_UP("clean_up"),
         CONNECTION_MODE_CHANGED("connection_mode_changed"),
+        RENEW_GLOBAL_SESSION_IN_RO_MODE("renew a global session in readonly mode"),
         // Below reasons are NettyServerCnxnFactory only
         CHANNEL_DISCONNECTED("channel disconnected"),
         CHANNEL_CLOSED_EXCEPTION("channel_closed_exception"),
@@ -298,7 +299,7 @@ void disableRecv() {
 
     protected ZooKeeperSaslServer zooKeeperSaslServer = null;
 
-    protected static class CloseRequestException extends IOException {
+    public static class CloseRequestException extends IOException {
 
         private static final long serialVersionUID = -7854505709816442681L;
         private DisconnectReason reason;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 65438429106..b016724a3e1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1412,13 +1412,13 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
                 connReq.getTimeOut(),
                 cnxn.getRemoteSocketAddress());
         } else {
-            long clientSessionId = connReq.getSessionId();
-                LOG.debug(
-                    "Client attempting to renew session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
-                    Long.toHexString(clientSessionId),
-                    Long.toHexString(connReq.getLastZxidSeen()),
-                    connReq.getTimeOut(),
-                    cnxn.getRemoteSocketAddress());
+            validateSession(cnxn, sessionId);
+            LOG.debug(
+                "Client attempting to renew session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
+                Long.toHexString(sessionId),
+                Long.toHexString(connReq.getLastZxidSeen()),
+                connReq.getTimeOut(),
+                cnxn.getRemoteSocketAddress());
             if (serverCnxnFactory != null) {
                 serverCnxnFactory.closeSession(sessionId, ServerCnxn.DisconnectReason.CLIENT_RECONNECT);
             }
@@ -1432,6 +1432,17 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
         }
     }
 
+    /**
+     * Validate if a particular session can be reestablished.
+     *
+     * @param cnxn
+     * @param sessionId
+     */
+    protected void validateSession(ServerCnxn cnxn, long sessionId)
+            throws IOException {
+        // do nothing
+    }
+
     public boolean shouldThrottle(long outStandingCount) {
         int globalOutstandingLimit = getGlobalOutstandingLimit();
         if (globalOutstandingLimit < getInflight() || globalOutstandingLimit < getInProcess()) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index c50dd539f4e..3aec97f72e2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -86,16 +86,14 @@ public void run() {
                 case OpCode.setACL:
                 case OpCode.multi:
                 case OpCode.check:
-                    ReplyHeader hdr = new ReplyHeader(
-                        request.cxid,
-                        zks.getZKDatabase().getDataTreeLastProcessedZxid(),
-                        Code.NOTREADONLY.intValue());
-                    try {
-                        request.cnxn.sendResponse(hdr, null, null);
-                    } catch (IOException e) {
-                        LOG.error("IO exception while sending response", e);
-                    }
+                    sendErrorResponse(request);
                     continue;
+                case OpCode.closeSession:
+                case OpCode.createSession:
+                    if (!request.isLocalSession()) {
+                        sendErrorResponse(request);
+                        continue;
+                    }
                 }
 
                 // proceed to the next processor
@@ -109,6 +107,18 @@ public void run() {
         LOG.info("ReadOnlyRequestProcessor exited loop!");
     }
 
+    private void sendErrorResponse(Request request) {
+        ReplyHeader hdr = new ReplyHeader(
+                request.cxid,
+                zks.getZKDatabase().getDataTreeLastProcessedZxid(),
+                Code.NOTREADONLY.intValue());
+        try {
+            request.cnxn.sendResponse(hdr, null, null);
+        } catch (IOException e) {
+            LOG.error("IO exception while sending response", e);
+        }
+    }
+
     @Override
     public void processRequest(Request request) {
         if (!finished) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
index f8517eb9b02..d2f6b39b69a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
@@ -18,14 +18,18 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.Objects;
 import java.util.stream.Collectors;
+import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.server.DataTreeBean;
 import org.apache.zookeeper.server.FinalRequestProcessor;
 import org.apache.zookeeper.server.PrepRequestProcessor;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooKeeperServerBean;
@@ -80,6 +84,49 @@ public synchronized void startup() {
         LOG.info("Read-only server started");
     }
 
+    @Override
+    public void createSessionTracker() {
+        sessionTracker = new LearnerSessionTracker(
+                this, getZKDatabase().getSessionWithTimeOuts(),
+                this.tickTime, self.getId(), self.areLocalSessionsEnabled(),
+                getZooKeeperServerListener());
+    }
+
+    @Override
+    protected void startSessionTracker() {
+        ((LearnerSessionTracker) sessionTracker).start();
+    }
+
+    @Override
+    protected void setLocalSessionFlag(Request si) {
+        switch (si.type) {
+            case OpCode.createSession:
+                if (self.areLocalSessionsEnabled()) {
+                    si.setLocalSession(true);
+                }
+                break;
+            case OpCode.closeSession:
+                if (((UpgradeableSessionTracker) sessionTracker).isLocalSession(si.sessionId)) {
+                    si.setLocalSession(true);
+                } else {
+                    LOG.warn("Submitting global closeSession request for session 0x{} in ReadOnly mode",
+                            Long.toHexString(si.sessionId));
+                }
+                break;
+            default:
+                break;
+        }
+    }
+
+    @Override
+    protected void validateSession(ServerCnxn cnxn, long sessionId) throws IOException {
+        if (((LearnerSessionTracker) sessionTracker).isGlobalSession(sessionId)) {
+            String msg = "Refusing global session reconnection in RO mode " + cnxn.getRemoteSocketAddress();
+            LOG.info(msg);
+            throw new ServerCnxn.CloseRequestException(msg, ServerCnxn.DisconnectReason.RENEW_GLOBAL_SESSION_IN_RO_MODE);
+        }
+    }
+
     @Override
     protected void registerJMX() {
         // register with JMX
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 06c37347f11..4becd4af9aa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -27,6 +27,7 @@
 import java.io.ByteArrayOutputStream;
 import java.io.LineNumberReader;
 import java.io.StringReader;
+import java.util.concurrent.TimeoutException;
 import java.util.regex.Pattern;
 import org.apache.log4j.Layout;
 import org.apache.log4j.Level;
@@ -57,7 +58,6 @@ public class ReadOnlyModeTest extends ZKTestCase {
     @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("readonlymode.enabled", "true");
-        qu.startQuorum();
     }
 
     @AfterEach
@@ -72,6 +72,9 @@ public void tearDown() throws Exception {
     @Test
     @Timeout(value = 90)
     public void testMultiTransaction() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT); // ensure zk got connected
@@ -80,9 +83,12 @@ public void testMultiTransaction() throws Exception {
         final String node1 = "/tnode1";
         final String node2 = "/tnode2";
         zk.create(node1, data.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.close();
+        watcher.waitForDisconnected(CONNECTION_TIMEOUT);
 
         watcher.reset();
         qu.shutdown(2);
+        zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
         assertEquals(States.CONNECTEDREADONLY, zk.getState(), "Should be in r-o mode");
 
@@ -110,6 +116,9 @@ public void testMultiTransaction() throws Exception {
     @Test
     @Timeout(value = 90)
     public void testReadOnlyClient() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT); // ensure zk got connected
@@ -161,6 +170,9 @@ public void testReadOnlyClient() throws Exception {
     @Test
     @Timeout(value = 90)
     public void testConnectionEvents() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         boolean success = false;
@@ -202,6 +214,9 @@ public void testConnectionEvents() throws Exception {
     @Test
     @Timeout(value = 90)
     public void testSessionEstablishment() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         qu.shutdown(2);
 
         CountdownWatcher watcher = new CountdownWatcher();
@@ -230,6 +245,43 @@ public void testSessionEstablishment() throws Exception {
         zk.close();
     }
 
+    @Test(timeout = 90000)
+    public void testGlobalSessionInRO() throws Exception {
+        qu.startQuorum();
+
+        CountdownWatcher watcher = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
+        watcher.waitForConnected(CONNECTION_TIMEOUT);
+        LOG.info("global session created 0x{}", Long.toHexString(zk.getSessionId()));
+
+        watcher.reset();
+        qu.shutdown(2);
+        try {
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            fail("Should not be able to renew a global session");
+        } catch (TimeoutException e) {
+        }
+        zk.close();
+
+        watcher.reset();
+        zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
+        try {
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            fail("Should not be able to create a global session");
+        } catch (TimeoutException e) {
+        }
+        zk.close();
+
+        qu.getPeer(1).peer.enableLocalSessions(true);
+        zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
+        try {
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+        } catch (TimeoutException e) {
+            fail("Should be able to create a local session");
+        }
+        zk.close();
+    }
+
     /**
      * Ensures that client seeks for r/w servers while it's connected to r/o
      * server.
@@ -238,6 +290,9 @@ public void testSessionEstablishment() throws Exception {
     @Test
     @Timeout(value = 90)
     public void testSeekForRwServer() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         // setup the logger to capture all logs
         Layout layout = Logger.getRootLogger().getAppender("CONSOLE").getLayout();
         ByteArrayOutputStream os = new ByteArrayOutputStream();

From 63f744b2f4aef1806adfd22823984c561156e243 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Thu, 17 Sep 2020 13:42:25 +0200
Subject: [PATCH 078/591] ZOOKEEPER-3863: correct junit test timeout

LiYvbo eolivelli

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1459 from TisonKun/patch-2
---
 .../test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 4becd4af9aa..43bfb2ded38 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -245,7 +245,8 @@ public void testSessionEstablishment() throws Exception {
         zk.close();
     }
 
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testGlobalSessionInRO() throws Exception {
         qu.startQuorum();
 

From 500372dc7d076617cbe2509ed8e073470f3807a8 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Thu, 17 Sep 2020 19:46:50 +0200
Subject: [PATCH 079/591] Fix Precommit Job

It looks like the precommit job is performing an additional "git clone" that overwrites the PR

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: andor@apache.prg

Closes #1460 from eolivelli/fix/pr-job-fix
---
 Jenkinsfile-PreCommit | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Jenkinsfile-PreCommit b/Jenkinsfile-PreCommit
index 90b3f99ae17..c7ba439b1d6 100644
--- a/Jenkinsfile-PreCommit
+++ b/Jenkinsfile-PreCommit
@@ -36,7 +36,6 @@ pipeline {
     stages {
         stage('BuildAndTest') {
             steps {
-                git 'https://github.com/apache/zookeeper'
                 sh "git clean -fxd"
                 sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
             }

From 4a2d58219b7435c3b8cdf8f7ab04b158c1900223 Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Sun, 20 Sep 2020 08:53:16 -0700
Subject: [PATCH 080/591] ZOOKEEPER-3863: Fix c client unit test (local session
 must be enabled for read only observers to work).

Problem

ZOOKEEPER-3863 requires local session to be enabled for read only server to work. When merge ZOOKEEPER-3863 (in c47ef905e077184bc5b7f555a3e2dfeb6dc046e1), we only updated Java tests, and missed C tests. As a result, Jenkins build is broken.

Solution

Enable local session for C client tests.

Notes
This was not caught by Jenkins when we merge ZOOKEEPER-3863 because previous Jenkins was testing master branch (as discussed in https://github.com/apache/zookeeper/pull/1460).

Author: Michael Han <lhan@twitter.com>

Reviewers: Enrico Olivelli <eolivelli@gmail.com>

Closes #1462 from hanm/fixme
---
 zookeeper-client/zookeeper-client-c/tests/zoo.cfg | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-client/zookeeper-client-c/tests/zoo.cfg b/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
index b8e0b2a661f..d7444238e73 100644
--- a/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
+++ b/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
@@ -3,6 +3,7 @@ initLimit=10
 syncLimit=5
 dataDir=TMPDIR/zkdata
 maxClientCnxns=MAXCLIENTCONNECTIONS
+localSessionsEnabled=true
 
 clientPort=CLIENTPORT
 secureClientPort=22281

From 492fd79b0c7845f1b7f3717632471d79660d1363 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Wed, 23 Sep 2020 12:13:34 +0000
Subject: [PATCH 081/591] ZOOKEEPER-3941: Upgrade commons-cli to 1.4

commons-cli 1.2 was released in 2009, time to upgrade it to the newest version (1.4).
To avoid deprecation messages we have to upgrade the Java code too.

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1463 from tamaashu/zookeeper-3941
---
 pom.xml                                       |  2 +-
 .../apache/zookeeper/cli/AddAuthCommand.java  |  5 +-
 .../apache/zookeeper/cli/AddWatchCommand.java |  5 +-
 .../apache/zookeeper/cli/CreateCommand.java   |  5 +-
 .../apache/zookeeper/cli/DelQuotaCommand.java |  5 +-
 .../zookeeper/cli/DeleteAllCommand.java       |  5 +-
 .../apache/zookeeper/cli/DeleteCommand.java   |  7 +--
 .../apache/zookeeper/cli/GetAclCommand.java   |  5 +-
 .../cli/GetAllChildrenNumberCommand.java      |  5 +-
 .../org/apache/zookeeper/cli/GetCommand.java  |  7 +--
 .../zookeeper/cli/GetConfigCommand.java       |  5 +-
 .../zookeeper/cli/GetEphemeralsCommand.java   |  5 +-
 .../zookeeper/cli/ListQuotaCommand.java       |  5 +-
 .../org/apache/zookeeper/cli/LsCommand.java   |  7 +--
 .../apache/zookeeper/cli/ReconfigCommand.java |  5 +-
 .../zookeeper/cli/RemoveWatchesCommand.java   |  5 +-
 .../apache/zookeeper/cli/SetAclCommand.java   |  5 +-
 .../org/apache/zookeeper/cli/SetCommand.java  |  5 +-
 .../apache/zookeeper/cli/SetQuotaCommand.java |  5 +-
 .../org/apache/zookeeper/cli/StatCommand.java |  7 +--
 .../org/apache/zookeeper/cli/SyncCommand.java |  5 +-
 .../apache/zookeeper/cli/VersionCommand.java  |  5 +-
 .../zookeeper/server/SnapshotComparer.java    | 62 +++++++++----------
 .../server/persistence/TxnLogToolkit.java     |  4 +-
 24 files changed, 80 insertions(+), 101 deletions(-)

diff --git a/pom.xml b/pom.xml
index b44967b126c..db2261fe2bd 100755
--- a/pom.xml
+++ b/pom.xml
@@ -434,7 +434,7 @@
     <log4j.version>1.2.17</log4j.version>
     <mockito.version>2.27.0</mockito.version>
     <hamcrest.version>1.3</hamcrest.version>
-    <commons-cli.version>1.2</commons-cli.version>
+    <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>
     <jetty.version>9.4.24.v20191120</jetty.version>
     <jackson.version>2.10.3</jackson.version>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
index de466f6e938..b59a90d1cee 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 
 /**
  * addAuth command for cli
@@ -38,7 +37,7 @@ public AddAuthCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java
index 1e34b10159c..591de8bb0b5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java
@@ -20,10 +20,9 @@
 
 import java.util.Arrays;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.AddWatchMode;
 import org.apache.zookeeper.KeeperException;
 
@@ -50,7 +49,7 @@ public AddWatchCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
index d906238382c..181a04e4635 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
@@ -20,11 +20,10 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs;
@@ -54,7 +53,7 @@ public CreateCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
index 56e630b6ae9..6d9f8705060 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
@@ -21,12 +21,11 @@
 import java.io.IOException;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.OptionGroup;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
@@ -53,7 +52,7 @@ public DelQuotaCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java
index cbeceb0e08e..537a9b05ba6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java
@@ -19,11 +19,10 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 
@@ -50,7 +49,7 @@ public DeleteAllCommand(String cmdStr) {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java
index 228eba45da5..91d98512007 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 
 /**
@@ -44,7 +43,7 @@ public DeleteCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -64,7 +63,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
         if (args.length > 2) {
             err.println("'delete path [version]' has been deprecated. "
                         + "Please use 'delete [-v version] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java
index 553395093f0..0ecdc9ec6bc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java
@@ -19,10 +19,9 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 import org.apache.zookeeper.data.ACL;
@@ -47,7 +46,7 @@ public GetAclCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java
index dda48d1abcd..342a460248e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java
@@ -18,10 +18,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 
 /**
@@ -38,7 +37,7 @@ public GetAllChildrenNumberCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
index 57821edde63..96bf0fda20c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 
@@ -47,7 +46,7 @@ public GetCommand() {
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
 
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -69,7 +68,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
             // rewrite to option
             cmdArgs[2] = "-w";
             err.println("'get path [watch]' has been deprecated. " + "Please use 'get [-s] [-w] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
index 4fc681f42b4..ef583aa2e49 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.util.ConfigUtils;
@@ -49,7 +48,7 @@ public GetConfigCommand() {
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
 
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java
index 8d39a59eb2c..de667e8afe0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java
@@ -19,10 +19,9 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 
 /**
@@ -39,7 +38,7 @@ public GetEphemeralsCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
index b6d9f51be3a..748afd2394a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
@@ -42,7 +41,7 @@ public ListQuotaCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java
index b12a12acd46..813396b590c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java
@@ -20,11 +20,10 @@
 import java.util.Collections;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.HelpFormatter;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 import org.apache.zookeeper.data.Stat;
@@ -56,7 +55,7 @@ private void printHelp() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -79,7 +78,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
             // rewrite to option
             cmdArgs[2] = "-w";
             err.println("'ls path [watch]' has been deprecated. " + "Please use 'ls [-w] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
index d48d16e2c7c..f0d9aa63cc1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
@@ -21,10 +21,9 @@
 import java.io.FileInputStream;
 import java.util.Properties;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.data.Stat;
@@ -83,7 +82,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
         joining = null;
         leaving = null;
         members = null;
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
index 1603cd43b85..ddaf15fba5c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Watcher.WatcherType;
 
@@ -48,7 +47,7 @@ public RemoveWatchesCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java
index 25aa3dda0a0..856041bec10 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java
@@ -20,10 +20,9 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 import org.apache.zookeeper.data.ACL;
@@ -53,7 +52,7 @@ public SetAclCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
index e8a0634ea26..190ca04daff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 
@@ -46,7 +45,7 @@ public SetCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
index d9717ecfe9d..68c48fa1659 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
@@ -21,12 +21,11 @@
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.OptionGroup;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
@@ -60,7 +59,7 @@ public SetQuotaCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java
index 7fd962c2987..c8068ad66fe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 
@@ -45,7 +44,7 @@ public StatCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -67,7 +66,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
             // rewrite to option
             cmdArgs[2] = "-w";
             err.println("'stat path [watch]' has been deprecated. " + "Please use 'stat [-w] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java
index f37e6420b11..26ef5367035 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java
@@ -22,10 +22,9 @@
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 
 /**
  * sync command for cli
@@ -42,7 +41,7 @@ public SyncCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java
index 6af21bd6ca7..b2290306e9d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java
@@ -18,10 +18,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.Version;
 
 /**
@@ -38,7 +37,7 @@ public VersionCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
index d77261d1f28..84d265c81d7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
@@ -28,10 +28,10 @@
 import java.util.Map;
 import java.util.Scanner;
 import java.util.zip.CheckedInputStream;
-import org.apache.commons.cli.BasicParser;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.HelpFormatter;
-import org.apache.commons.cli.OptionBuilder;
+import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
 import org.apache.jute.BinaryInputArchive;
@@ -59,41 +59,41 @@ public class SnapshotComparer {
   private SnapshotComparer() {
     options = new Options();
     options.addOption(
-        OptionBuilder
+        Option.builder("l")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(leftOption)
-            .withDescription("(Required) The left snapshot file.")
-            .withArgName("LEFT")
-            .withType(File.class)
-            .create("l"));
+            .required(true)
+            .longOpt(leftOption)
+            .desc("(Required) The left snapshot file.")
+            .argName("LEFT")
+            .type(File.class)
+            .build());
     options.addOption(
-        OptionBuilder
+        Option.builder("r")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(rightOption)
-            .withDescription("(Required) The right snapshot file.")
-            .withArgName("RIGHT")
-            .withType(File.class)
-            .create("r"));
+            .required(true)
+            .longOpt(rightOption)
+            .desc("(Required) The right snapshot file.")
+            .argName("RIGHT")
+            .type(File.class)
+            .build());
     options.addOption(
-        OptionBuilder
+        Option.builder("b")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(byteThresholdOption)
-            .withDescription("(Required) The node data delta size threshold, in bytes, for printing the node.")
-            .withArgName("BYTETHRESHOLD")
-            .withType(String.class)
-            .create("b"));
+            .required(true)
+            .longOpt(byteThresholdOption)
+            .desc("(Required) The node data delta size threshold, in bytes, for printing the node.")
+            .argName("BYTETHRESHOLD")
+            .type(String.class)
+            .build());
     options.addOption(
-        OptionBuilder
+        Option.builder("n")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(nodeThresholdOption)
-            .withDescription("(Required) The descendant node delta size threshold, in nodes, for printing the node.")
-            .withArgName("NODETHRESHOLD")
-            .withType(String.class)
-            .create("n"));
+            .required(true)
+            .longOpt(nodeThresholdOption)
+            .desc("(Required) The descendant node delta size threshold, in nodes, for printing the node.")
+            .argName("NODETHRESHOLD")
+            .type(String.class)
+            .build());
     options.addOption("d", debugOption, false, "Use debug output.");
     options.addOption("i", interactiveOption, false, "Enter interactive mode.");
   }
@@ -117,7 +117,7 @@ public static void main(String[] args) throws Exception {
   private void compareSnapshots(String[] args) throws Exception {
     CommandLine parsedOptions;
     try {
-      parsedOptions = new BasicParser().parse(options, args);
+      parsedOptions = new DefaultParser().parse(options, args);
     } catch (ParseException e) {
       System.err.println(e.getMessage());
       usage();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
index 389caea6470..8e5b24bbcb2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
@@ -39,11 +39,11 @@
 import java.util.zip.Checksum;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.CommandLineParser;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.HelpFormatter;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.PosixParser;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
@@ -383,7 +383,7 @@ private void closeRecoveryFile() throws IOException {
     }
 
     private static TxnLogToolkit parseCommandLine(String[] args) throws TxnLogToolkitException, FileNotFoundException {
-        CommandLineParser parser = new PosixParser();
+        CommandLineParser parser = new DefaultParser();
         Options options = new Options();
 
         Option helpOpt = new Option("h", "help", false, "Print help message");

From 56dfde5da4e441b139e85930291729d6b77a18ac Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 28 Sep 2020 07:22:15 +0000
Subject: [PATCH 082/591] ZOOKEEPER-3937: C client: avoid out-of-order packets
 during SASL negotiation

This patch prevents SASL-enabled C clients from sending request packets for as long as the SASL negociation is not complete.

"Ideally," applications should wait for `ZOO_CONNECTED_STATE` or `ZOO_READONLY_STATE` events before issuing requests, but this is not what happens in the wild.

Without this patch, it was easy to cause a desynchronization by creating a handle and blasting requests right away.  (The added test simply avoids doing a `ctx.waitForConnected()`.)

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1457 from ztzg/ZOOKEEPER-3937-c-client-out-of-order-packets
---
 .../zookeeper-client-c/src/zookeeper.c        | 59 ++++++++++++++++++-
 .../zookeeper-client-c/tests/TestSASLAuth.cc  | 33 +++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 84970553e0c..ec42e787a15 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -344,6 +344,38 @@ static int is_sasl_auth_in_progress(zhandle_t* zh)
 #endif /* HAVE_CYRUS_SASL_H */
 }
 
+/*
+ * Extract the type field (ZOO_*_OP) of a serialized RequestHeader.
+ *
+ * (This is not the most efficient way of fetching 4 bytes, but it is
+ * currently only used during SASL negotiation.)
+ *
+ * \param buffer the buffer to extract the request type from.  Must
+ *   start with a serialized RequestHeader;
+ * \param len the buffer length.  Must be positive.
+ * \param out_type out parameter; pointer to the location where the
+ *   extracted type is to be stored.  Cannot be NULL.
+ * \return ZOK on success, or < 0 if something went wrong
+ */
+static int extract_request_type(char *buffer, int len, int32_t *out_type)
+{
+    struct iarchive *ia;
+    struct RequestHeader h;
+    int rc;
+
+    ia = create_buffer_iarchive(buffer, len);
+    rc = ia ? ZOK : ZSYSTEMERROR;
+    rc = rc < 0 ? rc : deserialize_RequestHeader(ia, "header", &h);
+    deallocate_RequestHeader(&h);
+    if (ia) {
+        close_buffer_iarchive(&ia);
+    }
+
+    *out_type = h.type;
+
+    return rc;
+}
+
 #ifndef THREADED
 /*
  * abort due to the use of a sync api in a singlethreaded environment
@@ -2812,6 +2844,11 @@ static void finalize_session_establishment(zhandle_t *zh) {
     LOG_DEBUG(LOGCALLBACK(zh), "Calling a watcher for a ZOO_SESSION_EVENT and the state=ZOO_CONNECTED_STATE");
     zh->input_buffer = 0; // just in case the watcher calls zookeeper_process() again
     PROCESS_SESSION_EVENT(zh, zh->state);
+
+    if (zh->sasl_client) {
+        /* some packets might have been delayed during SASL negotiaton. */
+        adaptor_send_queue(zh, 0);
+    }
 }
 
 #ifdef HAVE_CYRUS_SASL_H
@@ -4855,6 +4892,20 @@ int flush_send_queue(zhandle_t*zh, int timeout)
     // successful
     lock_buffer_list(&zh->to_send);
     while (zh->to_send.head != 0 && (is_connected(zh) || is_sasl_auth_in_progress(zh))) {
+        if (is_sasl_auth_in_progress(zh)) {
+            // We don't let non-SASL packets escape as long as
+            // negotiation is not complete.  (SASL packets are always
+            // pushed to the front of the queue.)
+            buffer_list_t *buff = zh->to_send.head;
+            int32_t type;
+
+            rc = extract_request_type(buff->buffer, buff->len, &type);
+
+            if (rc < 0 || type != ZOO_SASL_OP) {
+                break;
+            }
+        }
+
         if(timeout!=0){
 #ifndef _WIN32
             struct pollfd fds;
@@ -5020,8 +5071,14 @@ int zoo_add_auth(zhandle_t *zh,const char* scheme,const char* cert,
     add_last_auth(&zh->auth_h, authinfo);
     zoo_unlock_auth(zh);
 
-    if (is_connected(zh) || zh->state == ZOO_ASSOCIATING_STATE)
+    if (is_connected(zh) ||
+        // When associating, only send info packets if no SASL
+        // negotiation is planned.  (Such packets would be queued in
+        // front of SASL packets, which is forbidden, and SASL
+        // completion is followed by a 'send_auth_info' anyway.)
+        (zh->state == ZOO_ASSOCIATING_STATE && !zh->sasl_client)) {
         return send_last_auth_info(zh);
+    }
 
     return ZOK;
 }
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
index 080649d97f3..e6aa4cb3d50 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
@@ -38,6 +38,7 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
     CPPUNIT_TEST(testClientSASLOverIPv6);
 #endif/* ZOO_IPV6_ENABLED */
     CPPUNIT_TEST(testClientSASLReadOnly);
+    CPPUNIT_TEST(testClientSASLPacketOrder);
 #endif /* HAVE_CYRUS_SASL_H */
     CPPUNIT_TEST_SUITE_END();
     FILE *logfile;
@@ -227,6 +228,38 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         stopServer();
     }
 
+    void testClientSASLPacketOrder() {
+        startServer();
+
+        // Initialize Cyrus SASL.
+        CPPUNIT_ASSERT_EQUAL(sasl_client_init(NULL), SASL_OK);
+
+        // Initialize SASL parameters.
+        zoo_sasl_params_t sasl_params = { 0 };
+
+        sasl_params.service = "zookeeper";
+        sasl_params.host = "zk-sasl-md5";
+        sasl_params.mechlist = "DIGEST-MD5";
+        sasl_params.callbacks = zoo_sasl_make_basic_callbacks(
+            "myuser", NULL, "Zookeeper_SASLAuth.password");
+
+        // Connect.
+        watchctx_t ctx;
+        int rc = 0;
+        zhandle_t *zk = zookeeper_init_sasl(hostPorts, watcher, 10000, NULL,
+            &ctx, /*flags*/0, /*log_callback*/NULL, &sasl_params);
+        ctx.zh = zk;
+        CPPUNIT_ASSERT(zk);
+
+        // No wait: try and queue a packet before SASL auth is complete.
+        char buf[1024];
+        int len = sizeof(buf);
+        rc = zoo_get(zk, "/", 0, buf, &len, 0);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        stopServer();
+    }
+
 #endif /* HAVE_CYRUS_SASL_H */
 };
 

From 38f8e1bff2502d57dd4541ddd5d7e8b4ac10bc02 Mon Sep 17 00:00:00 2001
From: Xiaotian <523950475@qq.com>
Date: Mon, 28 Sep 2020 07:26:25 +0000
Subject: [PATCH 083/591] ZOOKEEPER-3944: Fix sasl memory leak

Within ```zoo_sasl_client_destroy```, it carefully free all members of the sasl client, while here it doesn't free the struct itself before set it to NULL. This error is detected by leak sanitizer.

Author: Xiaotian <523950475@qq.com>

Reviewers: Damien Diederen <dd@crosstwine.com>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1466 from xiaotian-qi/ZOOKEEPER-3944
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index ec42e787a15..1728c0ed7fd 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -694,6 +694,7 @@ static void destroy(zhandle_t *zh)
 #ifdef HAVE_CYRUS_SASL_H
     if (zh->sasl_client) {
         zoo_sasl_client_destroy(zh->sasl_client);
+        free(zh->sasl_client);
         zh->sasl_client = NULL;
     }
 #endif /* HAVE_CYRUS_SASL_H */

From 8260e876f26b4a8953b8a60a11515aab69ad1fb6 Mon Sep 17 00:00:00 2001
From: dengliming <liming.d.pro@gmail.com>
Date: Wed, 30 Sep 2020 21:23:24 -0700
Subject: [PATCH 084/591] ZOOKEEPER-3841: Remove useless codes in the
 Leader.java

Author: dengliming <liming.d.pro@gmail.com>

Reviewers: maoling, hanm

Closes #1394 from dengliming/ZOOKEEPER-3841
---
 .../java/org/apache/zookeeper/server/quorum/Leader.java  | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 8d2a95f6d7b..0ddc4bef7a5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -711,13 +711,6 @@ void lead() throws IOException, InterruptedException {
             self.setZabState(QuorumPeer.ZabState.BROADCAST);
             self.adminServer.setZooKeeperServer(zk);
 
-            // Everything is a go, simply start counting the ticks
-            // WARNING: I couldn't find any wait statement on a synchronized
-            // block that would be notified by this notifyAll() call, so
-            // I commented it out
-            //synchronized (this) {
-            //    notifyAll();
-            //}
             // We ping twice a tick, so we only update the tick every other
             // iteration
             boolean tickSkip = true;
@@ -937,7 +930,6 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
             //otherwise an up-to-date follower will be designated as leader. This saves
             //leader election time, unless the designated leader fails
             Long designatedLeader = getDesignatedLeader(p, zxid);
-            //LOG.warn("designated leader is: " + designatedLeader);
 
             QuorumVerifier newQV = p.qvAcksetPairs.get(p.qvAcksetPairs.size() - 1).getQuorumVerifier();
 
@@ -954,7 +946,6 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
             // receive the commit message.
             commitAndActivate(zxid, designatedLeader);
             informAndActivate(p, designatedLeader);
-            //turnOffFollowers();
         } else {
             p.request.logLatency(ServerMetrics.getMetrics().QUORUM_ACK_LATENCY);
             commit(zxid);

From dd01a8b2882dbd9110d9a6879afa80b01cb3f4cd Mon Sep 17 00:00:00 2001
From: Ivan Kudibal <8028110+ivankudibal@users.noreply.github.com>
Date: Wed, 30 Sep 2020 21:25:30 -0700
Subject: [PATCH 085/591] add InfluxDB monitoring solution to
 zookeeperMonitor.md

describe InfluxDB monitoring solution

Author: Ivan Kudibal <8028110+ivankudibal@users.noreply.github.com>

Reviewers: maoling, hanm

Closes #1453 from ivankudibal/patch-1
---
 .../main/resources/markdown/zookeeperMonitor.md  | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index 43a999e74e8..2427032f938 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -20,6 +20,7 @@ limitations under the License.
     * [Metrics](#Metrics)
     * [Prometheus](#Prometheus)
     * [Grafana](#Grafana)
+    * [InfluxDB](#influxdb)
 
 * [JMX](#JMX)
 
@@ -86,6 +87,21 @@ All the metrics are included in the `ServerMetrics.java`.
 - Then download and import the default ZooKeeper dashboard [template](https://grafana.com/dashboards/10465) and customize.
 - Users can ask for Grafana dashboard account if having any good improvements by writing a email to **dev@zookeeper.apache.org**.
 
+<a name="influxdb"></a>
+
+### InfluxDB
+
+InfluxDB is an open source time series data that is often used to store metrics
+from Zookeeper. You can [download](https://portal.influxdata.com/downloads/) the
+open source version or create a [free](https://cloud2.influxdata.com/signup)
+account on InfluxDB Cloud. In either case, configure the [Apache Zookeeper
+Telegraf plugin](https://www.influxdata.com/integration/apache-zookeeper/) to
+start collecting and storing metrics from your Zookeeper clusters into your
+InfluxDB instance. There is also an [Apache Zookeeper InfluxDB
+template](https://www.influxdata.com/influxdb-templates/zookeeper-monitor/) that
+includes the Telegraf configurations and a dashboard to get you set up right
+away.
+
 <a name="JMX"></a>
 ## JMX
 More details can be found in [here](http://zookeeper.apache.org/doc/current/zookeeperJMX.html)

From bd06861b98319e5567b9a215492b397129fa47b4 Mon Sep 17 00:00:00 2001
From: Byungwoo <bulee@whatap.io>
Date: Wed, 30 Sep 2020 21:27:18 -0700
Subject: [PATCH 086/591] fix typo

Author: Byungwoo <bulee@whatap.io>

Reviewers: maoling, hanm

Closes #1430 from comelf/master
---
 .../apache/zookeeper/server/quorum/FastLeaderElection.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 967adf05a19..5f492200a5f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -568,7 +568,7 @@ void halt() {
     long proposedEpoch;
 
     /**
-     * Returns the current vlue of the logical clock counter
+     * Returns the current value of the logical clock counter
      */
     public long getLogicalClock() {
         return logicalclock.get();
@@ -1088,7 +1088,7 @@ public Vote lookForLeader() throws InterruptedException {
                         }
                         break;
                     default:
-                        LOG.warn("Notification state unrecoginized: {} (n.state), {}(n.sid)", n.state, n.sid);
+                        LOG.warn("Notification state unrecognized: {} (n.state), {}(n.sid)", n.state, n.sid);
                         break;
                     }
                 } else {

From e4c175fba845d7b765afc0d36db2f5b7145dec5e Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Wed, 30 Sep 2020 21:35:30 -0700
Subject: [PATCH 087/591] ZOOKEEPER-3858: Add metrics to track server
 unavailable time

Author: Jie Huang <jiehuang@fb.com>

Reviewers: Michael Han <hanm@apache.org>

Closes #1378 from jhuan31/ZOOKEEPER-3858
---
 .../org/apache/zookeeper/server/ServerMetrics.java |  6 ++++++
 .../apache/zookeeper/server/quorum/QuorumPeer.java | 14 ++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index e95949a4e4c..99e9206987b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -134,6 +134,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         SESSIONLESS_CONNECTIONS_EXPIRED = metricsContext.getCounter("sessionless_connections_expired");
         STALE_SESSIONS_EXPIRED = metricsContext.getCounter("stale_sessions_expired");
 
+        UNAVAILABLE_TIME = metricsContext.getSummary("unavailable_time", DetailLevel.BASIC);
+        LEADER_UNAVAILABLE_TIME = metricsContext.getSummary("leader_unavailable_time", DetailLevel.BASIC);
+
         /*
          * Number of requests that are in the session queue.
          */
@@ -310,6 +313,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter SESSIONLESS_CONNECTIONS_EXPIRED;
     public final Counter STALE_SESSIONS_EXPIRED;
 
+    public final Summary UNAVAILABLE_TIME;
+    public final Summary LEADER_UNAVAILABLE_TIME;
+
     // Connection throttling related
     public final Summary CONNECTION_TOKEN_DEFICIT;
     public final Counter CONNECTION_REJECTED;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index c0a3dece0c1..e56c03ddf80 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -54,6 +54,7 @@
 import org.apache.zookeeper.common.AtomicFileWritingIdiom;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
 import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
@@ -530,6 +531,7 @@ public enum LearnerType {
      */
     public long start_fle, end_fle; // fle = fast leader election
     public static final String FLE_TIME_UNIT = "MS";
+    private long unavailableStartTime;
 
     /*
      * Default value of peer is participant
@@ -859,6 +861,14 @@ public synchronized void setPeerState(ServerState newState) {
     }
 
     public void setZabState(ZabState zabState) {
+        if ((zabState == ZabState.BROADCAST) && (unavailableStartTime != 0)) {
+            long unavailableTime = Time.currentElapsedTime() - unavailableStartTime;
+            ServerMetrics.getMetrics().UNAVAILABLE_TIME.add(unavailableTime);
+            if (getPeerState() == ServerState.LEADING) {
+                ServerMetrics.getMetrics().LEADER_UNAVAILABLE_TIME.add(unavailableTime);
+            }
+            unavailableStartTime = 0;
+        }
         this.zabState.set(zabState);
         LOG.info("Peer state changed: {}", getDetailedPeerState());
     }
@@ -1369,6 +1379,10 @@ public void run() {
              * Main loop
              */
             while (running) {
+                if (unavailableStartTime == 0) {
+                    unavailableStartTime = Time.currentElapsedTime();
+                }
+
                 switch (getPeerState()) {
                 case LOOKING:
                     LOG.info("LOOKING");

From 495906063078a477e26f4e99e14dfe8f89007625 Mon Sep 17 00:00:00 2001
From: Nishanth Entoor <entoor.nishanth@gmail.com>
Date: Wed, 30 Sep 2020 21:39:51 -0700
Subject: [PATCH 088/591] ZOOKEEPER-3798: remove the useless code in the
 ProposalRequestProcessor#processRequest

As per [ZOOKEEPER-3798](https://issues.apache.org/jira/browse/ZOOKEEPER-3798), I removed the unwanted commented code.

Author: Nishanth Entoor <entoor.nishanth@gmail.com>

Reviewers: hanm, maoling, TisonKun, ravowlga123

Closes #1335 from nishanth-entoor/ZOOKEEPER-3798
---
 .../zookeeper/server/quorum/ProposalRequestProcessor.java   | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
index a3f1b29bdb6..c1e2fe16e43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
@@ -66,11 +66,6 @@ public void initialize() {
     }
 
     public void processRequest(Request request) throws RequestProcessorException {
-        // LOG.warn("Ack>>> cxid = " + request.cxid + " type = " +
-        // request.type + " id = " + request.sessionId);
-        // request.addRQRec(">prop");
-
-
         /* In the following IF-THEN-ELSE block, we process syncs on the leader.
          * If the sync is coming from a follower, then the follower
          * handler adds it to syncHandler. Otherwise, if it is a client of
@@ -78,7 +73,6 @@ public void processRequest(Request request) throws RequestProcessorException {
          * contain the handler. In this case, we add it to syncHandler, and
          * call processRequest on the next processor.
          */
-
         if (request instanceof LearnerSyncRequest) {
             zks.getLeader().processSync((LearnerSyncRequest) request);
         } else {

From b51b1ee6291ecfb578dcf7ec6bbbc83e900ffd15 Mon Sep 17 00:00:00 2001
From: Jordan Zimmerman <jordan@jordanzimmerman.com>
Date: Fri, 2 Oct 2020 18:05:38 +0200
Subject: [PATCH 089/591] ZOOKEEPER-3831: Added
 testBasicUsageOfApisAndRecipesInCluster()

We should test Curator's `TestingCluster` too

Author: Jordan Zimmerman <jordan@jordanzimmerman.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Micheal Han <hanm@apache.org>

Closes #1375 from Randgalt/ZOOKEEPER-3831-add-compatibility-test-module-pt2
---
 .../TestApacheCuratorCompatibility.java       | 47 ++++++++++++-------
 1 file changed, 30 insertions(+), 17 deletions(-)

diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
index d793d6e4c49..fbb387601bd 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
@@ -27,6 +27,7 @@
 import org.apache.curator.framework.CuratorFrameworkFactory;
 import org.apache.curator.framework.recipes.cache.CuratorCache;
 import org.apache.curator.retry.RetryOneTime;
+import org.apache.curator.test.TestingCluster;
 import org.apache.curator.test.TestingServer;
 import org.junit.jupiter.api.Test;
 
@@ -40,26 +41,38 @@ public class TestApacheCuratorCompatibility {
     @Test
     public void testBasicUsageOfApisAndRecipes() throws Exception {
         try (TestingServer server = new TestingServer()) {
-            RetryOneTime retryPolicy = new RetryOneTime(1);
-            try (CuratorFramework client = CuratorFrameworkFactory.newClient(server.getConnectString(), retryPolicy)) {
-                try (CuratorCache cache = CuratorCache.build(client, "/base/path")) {
-                    client.start();
-                    cache.start();
+            doTest(server.getConnectString());
+        }
+    }
+
+    @Test
+    public void testBasicUsageOfApisAndRecipesInCluster() throws Exception {
+        try (TestingCluster cluster = new TestingCluster(3)) {
+            cluster.start();
+            doTest(cluster.getConnectString());
+        }
+    }
+
+    private void doTest(String connectionString) throws Exception {
+        RetryOneTime retryPolicy = new RetryOneTime(1);
+        try (CuratorFramework client = CuratorFrameworkFactory.newClient(connectionString, retryPolicy)) {
+            try (CuratorCache cache = CuratorCache.build(client, "/base/path")) {
+                client.start();
+                cache.start();
 
-                    BlockingQueue<String> paths = new LinkedBlockingQueue<>();
-                    cache.listenable().addListener((dummy1, dummy2, data) -> paths.add(data.getPath()));
+                BlockingQueue<String> paths = new LinkedBlockingQueue<>();
+                cache.listenable().addListener((dummy1, dummy2, data) -> paths.add(data.getPath()));
 
-                    client.create().creatingParentsIfNeeded().forPath("/base/path/1");
-                    client.create().creatingParentsIfNeeded().forPath("/base/path/2");
-                    client.create().creatingParentsIfNeeded().forPath("/base/path/1/a");
-                    client.create().creatingParentsIfNeeded().forPath("/base/path/2/a");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/1");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/2");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/1/a");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/2/a");
 
-                    assertEquals("/base/path", poll(paths));
-                    assertEquals("/base/path/1", poll(paths));
-                    assertEquals("/base/path/2", poll(paths));
-                    assertEquals("/base/path/1/a", poll(paths));
-                    assertEquals("/base/path/2/a", poll(paths));
-                }
+                assertEquals("/base/path", poll(paths));
+                assertEquals("/base/path/1", poll(paths));
+                assertEquals("/base/path/2", poll(paths));
+                assertEquals("/base/path/1/a", poll(paths));
+                assertEquals("/base/path/2/a", poll(paths));
             }
         }
     }

From 908c4480ee6036bc4024309b7b16318671ae416c Mon Sep 17 00:00:00 2001
From: Jie Huang <jiehuang@fb.com>
Date: Fri, 2 Oct 2020 19:12:55 -0700
Subject: [PATCH 090/591] =?UTF-8?q?ZOOKEEPER-3774:=20Close=20quorum=20sock?=
 =?UTF-8?q?et=20asynchronously=20on=20the=20leader=20to=20a=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…void ping being blocked by long socket closing time

Author: Jie Huang <jiehuang@fb.com>

Reviewers: ztzg, hanm, eolivelli, symat

Closes #1301 from jhuan31/ZOOKEEPER-3774
---
 .../main/resources/markdown/zookeeperAdmin.md |  9 +-
 .../server/quorum/LearnerHandler.java         | 85 ++++++++++++-------
 2 files changed, 60 insertions(+), 34 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index c579a71c438..76305a55113 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1146,8 +1146,14 @@ property, when available, is noted below.
 
 * *learner.closeSocketAsync*
     (Jave system property only: **learner.closeSocketAsync**)
+    **New in 3.6.2:**
     When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailabe. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. The default is false.
 
+* *leader.closeSocketAsync*
+   (Java system property only: **leader.closeSocketAsync**)
+   **New in 3.6.2:**
+   When enabled, the leader will close a quorum socket asynchoronously. This is useful for TLS connections where closing a socket might take a long time. If disconnecting a follower is initiated in ping() because of a failed SyncLimitCheck then the long socket closing time will block the sending of pings to other followers. Without receiving pings, the other followers will not send session information to the leader, which causes sessions to expire. Setting this flag to true ensures that pings will be sent regularly. The default is false.
+
 * *forward_learner_requests_to_commit_processor_disabled*
     (Jave system property: **zookeeper.forward_learner_requests_to_commit_processor_disabled**)
     When this property is set, the requests from learners won't be enqueued to
@@ -1512,7 +1518,8 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *sslQuorum* :
     (Java system property: **zookeeper.sslQuorum**)
     **New in 3.5.5:**
-    Enables encrypted quorum communication. Default is `false`.
+    Enables encrypted quorum communication. Default is `false`. When enabling this feature, please also consider enabling *leader.closeSocketAsync*
+    and *learner.closeSocketAsync* to avoid issues associated with the potentially long socket closing time when shutting down an SSL connection.
 
 * *ssl.keyStore.location and ssl.keyStore.password* and *ssl.quorum.keyStore.location* and *ssl.quorum.keyStore.password* :
     (Java system properties: **zookeeper.ssl.keyStore.location** and **zookeeper.ssl.keyStore.password** and **zookeeper.ssl.quorum.keyStore.location** and **zookeeper.ssl.quorum.keyStore.password**)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 4a7def87086..38cbaa69ff1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -32,6 +32,7 @@
 import java.util.Objects;
 import java.util.Queue;
 import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.concurrent.locks.ReentrantReadWriteLock;
@@ -40,6 +41,7 @@
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.TxnLogProposalIterator;
@@ -63,12 +65,21 @@ public class LearnerHandler extends ZooKeeperThread {
 
     private static final Logger LOG = LoggerFactory.getLogger(LearnerHandler.class);
 
+    public static final String LEADER_CLOSE_SOCKET_ASYNC = "leader.closeSocketAsync";
+    public static final boolean closeSocketAsync = Boolean.parseBoolean(System.getProperty(LEADER_CLOSE_SOCKET_ASYNC, "false"));
+
+    static {
+        LOG.info("{} = {}", LEADER_CLOSE_SOCKET_ASYNC, closeSocketAsync);
+    }
+
     protected final Socket sock;
 
     public Socket getSocket() {
         return sock;
     }
 
+    AtomicBoolean sockBeingClosed = new AtomicBoolean(false);
+
     final LearnerMaster learnerMaster;
 
     /** Deadline for receiving the next ack. If we are bootstrapping then
@@ -277,11 +288,8 @@ protected void setBufferedOutput(BufferedOutputStream bufferedOutput) {
             }
         } catch (IOException e) {
             LOG.error("Server failed to authenticate quorum learner, addr: {}, closing connection", sock.getRemoteSocketAddress(), e);
-            try {
-                sock.close();
-            } catch (IOException ie) {
-                LOG.error("Exception while closing socket", ie);
-            }
+            closeSocket();
+
             throw new SaslException("Authentication failure: " + e.getMessage());
         }
 
@@ -357,17 +365,11 @@ private void sendPackets() throws InterruptedException {
                 packetsSent.incrementAndGet();
                 messageTracker.trackSent(p.getType());
             } catch (IOException e) {
-                if (!sock.isClosed()) {
-                    LOG.warn("Unexpected exception at {}", this, e);
-                    try {
-                        // this will cause everything to shutdown on
-                        // this learner handler and will help notify
-                        // the learner/observer instantaneously
-                        sock.close();
-                    } catch (IOException ie) {
-                        LOG.warn("Error closing socket for handler {}", this, ie);
-                    }
-                }
+                LOG.error("Exception while sending packets in LearnerHandler", e);
+                // this will cause everything to shutdown on
+                // this learner handler and will help notify
+                // the learner/observer instantaneously
+                closeSocket();
                 break;
             }
         }
@@ -710,16 +712,8 @@ public void run() {
                 }
             }
         } catch (IOException e) {
-            if (sock != null && !sock.isClosed()) {
-                LOG.error("Unexpected exception causing shutdown while sock still open", e);
-                //close the socket to make sure the
-                //other side can see it being close
-                try {
-                    sock.close();
-                } catch (IOException ie) {
-                    // do nothing
-                }
-            }
+            LOG.error("Unexpected exception in LearnerHandler: ", e);
+            closeSocket();
         } catch (InterruptedException e) {
             LOG.error("Unexpected exception in LearnerHandler.", e);
         } catch (SyncThrottleException e) {
@@ -1050,13 +1044,9 @@ public void shutdown() {
         } catch (InterruptedException e) {
             LOG.warn("Ignoring unexpected exception", e);
         }
-        try {
-            if (sock != null && !sock.isClosed()) {
-                sock.close();
-            }
-        } catch (IOException e) {
-            LOG.warn("Ignoring unexpected exception during socket close", e);
-        }
+
+        closeSocket();
+
         this.interrupt();
         learnerMaster.removeLearnerHandler(this);
         learnerMaster.unregisterLearnerHandlerBean(this);
@@ -1157,4 +1147,33 @@ public void setFirstPacket(boolean value) {
         needOpPacket = value;
     }
 
+    void closeSocket() {
+        if (sock != null && !sock.isClosed() && sockBeingClosed.compareAndSet(false, true)) {
+            if (closeSocketAsync) {
+                LOG.info("Asynchronously closing socket to learner {}.", getSid());
+                closeSockAsync();
+            } else {
+                LOG.info("Synchronously closing socket to learner {}.", getSid());
+                closeSockSync();
+            }
+        }
+    }
+
+    void closeSockAsync() {
+        final Thread closingThread = new Thread(() -> closeSockSync(), "CloseSocketThread(sid:" + this.sid);
+        closingThread.setDaemon(true);
+        closingThread.start();
+    }
+
+    void closeSockSync() {
+        try {
+            if (sock != null) {
+                long startTime = Time.currentElapsedTime();
+                sock.close();
+                ServerMetrics.getMetrics().SOCKET_CLOSING_TIME.add(Time.currentElapsedTime() - startTime);
+            }
+        } catch (IOException e) {
+            LOG.warn("Ignoring error closing connection to learner {}", getSid(), e);
+        }
+    }
 }

From 663081d249626d20d6a2cfa75396b2a3d4454085 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Mon, 5 Oct 2020 17:01:34 +0200
Subject: [PATCH 091/591] ZOOKEEPER-3953: Update hamcrest-library to version
 2.2

We use a really old version of hamcrest-library where we could use a newer one (version 2.2 instead of 1.3).
Time to update it.

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1479 from tamaashu/ZOOKEEPER-3953
---
 pom.xml                  | 4 ++--
 zookeeper-server/pom.xml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index db2261fe2bd..b994523d839 100755
--- a/pom.xml
+++ b/pom.xml
@@ -433,7 +433,7 @@
     <junit-platform.version>1.6.2</junit-platform.version>
     <log4j.version>1.2.17</log4j.version>
     <mockito.version>2.27.0</mockito.version>
-    <hamcrest.version>1.3</hamcrest.version>
+    <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>
     <jetty.version>9.4.24.v20191120</jetty.version>
@@ -459,7 +459,7 @@
     <dependencies>
       <dependency>
         <groupId>org.hamcrest</groupId>
-        <artifactId>hamcrest-all</artifactId>
+        <artifactId>hamcrest-library</artifactId>
         <version>${hamcrest.version}</version>
       </dependency>
       <dependency>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 059f2fff0fb..5cdb8b384bf 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -40,7 +40,7 @@
     </dependency>
     <dependency>
       <groupId>org.hamcrest</groupId>
-      <artifactId>hamcrest-all</artifactId>
+      <artifactId>hamcrest-library</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>

From ec1503bb00945471baa248f392eed51064bb48ab Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Tue, 6 Oct 2020 09:29:46 +0000
Subject: [PATCH 092/591] ZOOKEEPER-3950: Add support for BCFKS key/trust store
 format

The BCFKS key store format is widely used in the industry, as it provides an open source alternative if someone has to use FIPS compliant key stores due to some regulatory constraints.

Currently in the ZooKeeper java client, only PEM, JKS and PEM12 is supported. I extend the list of supported key store formats with BCFKS.

I also tested this patch on a real FIPS compliant cluster, having the appropriate java security configs, security providers and also running a RedHat-based Linux distro (Centos 7.8) with FIPS mode enabled.

I tested both the client and the quorum SSL too. If someone wants to test this patch, and the keystore/truststore file names are not ending with ".bckfs", then (beside the usual SSL configs) make sure to also set the following parameters in the zoo.cfg:
```
ssl.keyStore.type=bcfks
ssl.trustStore.type=bcfks
ssl.quorum.keyStore.type=bcfks
ssl.quorum.trustStore.type=bcfks
```

and also provide the following parameters for the command line java client:
```
 -Dzookeeper.ssl.keyStore.type=bcfks -Dzookeeper.ssl.trustStore.type=bcfks
```

This patch doesn't contain any modification for the c-client (that can be handled with a separate Jira, but I don't plan to work on that part right now).

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Andor Molnar <andor@apache.org>

Closes #1480 from symat/zookeeper-3950
---
 .../main/resources/markdown/zookeeperAdmin.md |   8 +-
 .../zookeeper/common/BCFKSFileLoader.java     |  39 ++++
 .../FileKeyStoreLoaderBuilderProvider.java    |   2 +
 .../zookeeper/common/JKSFileLoader.java       |   9 +-
 .../zookeeper/common/KeyStoreFileType.java    |  12 +-
 .../zookeeper/common/PKCS12FileLoader.java    |   9 +-
 .../StandardTypeFileKeyStoreLoader.java       |  19 +-
 .../org/apache/zookeeper/common/X509Util.java |  12 +-
 .../zookeeper/common/BCFKSFileLoaderTest.java | 188 ++++++++++++++++++
 .../common/KeyStoreFileTypeTest.java          |   6 +
 .../zookeeper/common/X509TestContext.java     |  51 ++++-
 .../zookeeper/common/X509TestHelpers.java     |  45 ++++-
 12 files changed, 356 insertions(+), 44 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 76305a55113..afb6bc47aa9 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1532,7 +1532,9 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (Java system properties: **zookeeper.ssl.keyStore.type** and **zookeeper.ssl.quorum.keyStore.type**)
     **New in 3.5.5:**
     Specifies the file format of client and quorum keystores. Values: JKS, PEM, PKCS12 or null (detect by filename).
-    Default: null
+    Default: null.
+    **New in 3.6.3, 3.7.0:**
+    The format BCFKS was added.
 
 * *ssl.trustStore.location* and *ssl.trustStore.password* and *ssl.quorum.trustStore.location* and *ssl.quorum.trustStore.password* :
     (Java system properties: **zookeeper.ssl.trustStore.location** and **zookeeper.ssl.trustStore.password** and **zookeeper.ssl.quorum.trustStore.location** and **zookeeper.ssl.quorum.trustStore.password**)
@@ -1545,7 +1547,9 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (Java system properties: **zookeeper.ssl.trustStore.type** and **zookeeper.ssl.quorum.trustStore.type**)
     **New in 3.5.5:**
     Specifies the file format of client and quorum trustStores. Values: JKS, PEM, PKCS12 or null (detect by filename).
-    Default: null
+    Default: null.
+    **New in 3.6.3, 3.7.0:**
+    The format BCFKS was added.
 
 * *ssl.protocol* and *ssl.quorum.protocol* :
     (Java system properties: **zookeeper.ssl.protocol** and **zookeeper.ssl.quorum.protocol**)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java
new file mode 100644
index 00000000000..d59f40a2056
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java
@@ -0,0 +1,39 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+
+/**
+ * Implementation of {@link FileKeyStoreLoader} that loads from BCKFS files.
+ */
+class BCFKSFileLoader extends StandardTypeFileKeyStoreLoader {
+    private BCFKSFileLoader(String keyStorePath,
+                            String trustStorePath,
+                            String keyStorePassword,
+                            String trustStorePassword) {
+        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword, SupportedStandardKeyFormat.BCFKS);
+    }
+
+    static class Builder extends FileKeyStoreLoader.Builder<BCFKSFileLoader> {
+        @Override
+        BCFKSFileLoader build() {
+            return new BCFKSFileLoader(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java
index 169fb9e5639..f4798af64ae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java
@@ -38,6 +38,8 @@ static FileKeyStoreLoader.Builder<? extends FileKeyStoreLoader> getBuilderForKey
             return new PEMFileLoader.Builder();
         case PKCS12:
             return new PKCS12FileLoader.Builder();
+        case BCFKS:
+            return new BCFKSFileLoader.Builder();
         default:
             throw new AssertionError("Unexpected StoreFileType: " + type.name());
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java
index 8be7c376917..d8709d7bde0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java
@@ -18,8 +18,6 @@
 
 package org.apache.zookeeper.common;
 
-import java.security.KeyStore;
-import java.security.KeyStoreException;
 
 /**
  * Implementation of {@link FileKeyStoreLoader} that loads from JKS files.
@@ -31,12 +29,7 @@ private JKSFileLoader(
         String trustStorePath,
         String keyStorePassword,
         String trustStorePassword) {
-        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
-    }
-
-    @Override
-    protected KeyStore keyStoreInstance() throws KeyStoreException {
-        return KeyStore.getInstance("JKS");
+        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword, SupportedStandardKeyFormat.JKS);
     }
 
     static class Builder extends FileKeyStoreLoader.Builder<JKSFileLoader> {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java
index ecc1e5f4c12..69283f31f9d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java
@@ -20,12 +20,13 @@
 
 /**
  * This enum represents the file type of a KeyStore or TrustStore.
- * Currently, JKS (Java keystore), PEM, and PKCS12 types are supported.
+ * Currently, JKS (Java keystore), PEM, PKCS12, and BCFKS types are supported.
  */
 public enum KeyStoreFileType {
     JKS(".jks"),
     PEM(".pem"),
-    PKCS12(".p12");
+    PKCS12(".p12"),
+    BCFKS(".bcfks");
 
     private final String defaultFileExtension;
 
@@ -55,7 +56,7 @@ public String getDefaultFileExtension() {
      * @return the KeyStoreFileType, or <code>null</code> if
      *         <code>propertyValue</code> is <code>null</code> or empty.
      * @throws IllegalArgumentException if <code>propertyValue</code> is not
-     *         one of "JKS", "PEM", "PKCS12", or empty/null.
+     *         one of "JKS", "PEM", "BCFKS", "PKCS12", or empty/null.
      */
     public static KeyStoreFileType fromPropertyValue(String propertyValue) {
         if (propertyValue == null || propertyValue.length() == 0) {
@@ -69,11 +70,12 @@ public static KeyStoreFileType fromPropertyValue(String propertyValue) {
      * If the file name ends with ".jks", returns <code>StoreFileType.JKS</code>.
      * If the file name ends with ".pem", returns <code>StoreFileType.PEM</code>.
      * If the file name ends with ".p12", returns <code>StoreFileType.PKCS12</code>.
+     * If the file name ends with ".bckfs", returns <code>StoreFileType.BCKFS</code>.
      * Otherwise, throws an IllegalArgumentException.
      * @param filename the filename of the key store or trust store file.
      * @return a KeyStoreFileType.
      * @throws IllegalArgumentException if the filename does not end with
-     *         ".jks", ".pem", or "p12".
+     *         ".jks", ".pem", "p12" or "bcfks".
      */
     public static KeyStoreFileType fromFilename(String filename) {
         int i = filename.lastIndexOf('.');
@@ -100,7 +102,7 @@ public static KeyStoreFileType fromFilename(String filename) {
      *                 <code>propertyValue</code> is null or empty.
      * @return a KeyStoreFileType.
      * @throws IllegalArgumentException if <code>propertyValue</code> is not
-     *         one of "JKS", "PEM", "PKCS12", or empty/null.
+     *         one of "JKS", "PEM", "PKCS12", "BCFKS", or empty/null.
      * @throws IllegalArgumentException if <code>propertyValue</code>is empty
      *         or null and the type could not be determined from the file name.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java
index 35e89a18935..8903f288e95 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java
@@ -18,8 +18,6 @@
 
 package org.apache.zookeeper.common;
 
-import java.security.KeyStore;
-import java.security.KeyStoreException;
 
 /**
  * Implementation of {@link FileKeyStoreLoader} that loads from PKCS12 files.
@@ -31,12 +29,7 @@ private PKCS12FileLoader(
         String trustStorePath,
         String keyStorePassword,
         String trustStorePassword) {
-        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
-    }
-
-    @Override
-    protected KeyStore keyStoreInstance() throws KeyStoreException {
-        return KeyStore.getInstance("PKCS12");
+        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword, SupportedStandardKeyFormat.PKCS12);
     }
 
     static class Builder extends FileKeyStoreLoader.Builder<PKCS12FileLoader> {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java
index b32ee073038..8f068f7befc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java
@@ -35,12 +35,17 @@ abstract class StandardTypeFileKeyStoreLoader extends FileKeyStoreLoader {
 
     private static final char[] EMPTY_CHAR_ARRAY = new char[0];
 
-    StandardTypeFileKeyStoreLoader(
-        String keyStorePath,
-        String trustStorePath,
-        String keyStorePassword,
-        String trustStorePassword) {
+    protected final SupportedStandardKeyFormat format;
+
+    protected enum SupportedStandardKeyFormat {
+        JKS, PKCS12, BCFKS
+    }
+
+
+    StandardTypeFileKeyStoreLoader(String keyStorePath, String trustStorePath, String keyStorePassword,
+        String trustStorePassword, SupportedStandardKeyFormat format) {
         super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
+        this.format = format;
     }
 
     @Override
@@ -61,7 +66,9 @@ public KeyStore loadTrustStore() throws IOException, GeneralSecurityException {
         }
     }
 
-    protected abstract KeyStore keyStoreInstance() throws KeyStoreException;
+    private KeyStore keyStoreInstance() throws KeyStoreException {
+        return KeyStore.getInstance(format.name());
+    }
 
     private static char[] passwordStringToCharArray(String password) {
         return password == null ? EMPTY_CHAR_ARRAY : password.toCharArray();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 24c7f351bdd..52cb5fe6f0c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -419,9 +419,9 @@ public static KeyStore loadTrustStore(
      * @param keyStoreLocation the location of the key store file.
      * @param keyStorePassword optional password to decrypt the key store. If
      *                         empty, assumes the key store is not encrypted.
-     * @param keyStoreTypeProp must be JKS, PEM, or null. If null, attempts to
-     *                         autodetect the key store type from the file
-     *                         extension (.jks / .pem).
+     * @param keyStoreTypeProp must be JKS, PEM, PKCS12, BCFKS or null. If null,
+     *                         attempts to autodetect the key store type from
+     *                         the file extension (e.g. .jks / .pem).
      * @return the key manager.
      * @throws KeyManagerException if something goes wrong.
      */
@@ -455,9 +455,9 @@ public static X509KeyManager createKeyManager(
      * @param trustStorePassword optional password to decrypt the trust store
      *                           (only applies to JKS trust stores). If empty,
      *                           assumes the trust store is not encrypted.
-     * @param trustStoreTypeProp must be JKS, PEM, or null. If null, attempts
-     *                           to autodetect the trust store type from the
-     *                           file extension (.jks / .pem).
+     * @param trustStoreTypeProp must be JKS, PEM, PKCS12, BCFKS or null. If
+     *                           null, attempts to autodetect the trust store
+     *                           type from the file extension (e.g. .jks / .pem).
      * @param crlEnabled enable CRL (certificate revocation list) checks.
      * @param ocspEnabled enable OCSP (online certificate status protocol)
      *                    checks.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
new file mode 100644
index 00000000000..1850b653bc1
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
@@ -0,0 +1,188 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.IOException;
+import java.security.KeyStore;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+
+
+public class BCFKSFileLoaderTest extends BaseX509ParameterizedTestCase {
+
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+        KeyStore ks = new BCFKSFileLoader.Builder()
+          .setKeyStorePath(path)
+          .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+          .build()
+          .loadKeyStore();
+        assertEquals(1, ks.size());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePath(path)
+              .setKeyStorePassword("wrong password")
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePath(path + ".does_not_exist")
+              .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with BCFKS loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePath(path)
+              .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+        KeyStore ts = new BCFKSFileLoader.Builder()
+          .setTrustStorePath(path)
+          .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+          .build()
+          .loadTrustStore();
+        assertEquals(1, ts.size());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongPassword(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePath(path)
+              .setTrustStorePassword("wrong password")
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePath(path + ".does_not_exist")
+              .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with BCFKS loader should fail
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePath(path)
+              .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
index 9f5dd7ac481..3f7faaabcc5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
@@ -31,6 +31,7 @@ public void testGetPropertyValue() {
         assertEquals("PEM", KeyStoreFileType.PEM.getPropertyValue());
         assertEquals("JKS", KeyStoreFileType.JKS.getPropertyValue());
         assertEquals("PKCS12", KeyStoreFileType.PKCS12.getPropertyValue());
+        assertEquals("BCFKS", KeyStoreFileType.BCFKS.getPropertyValue());
     }
 
     @Test
@@ -38,6 +39,7 @@ public void testFromPropertyValue() {
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromPropertyValue("PEM"));
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValue("JKS"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromPropertyValue("PKCS12"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromPropertyValue("BCFKS"));
         assertNull(KeyStoreFileType.fromPropertyValue(""));
         assertNull(KeyStoreFileType.fromPropertyValue(null));
     }
@@ -47,6 +49,7 @@ public void testFromPropertyValueIgnoresCase() {
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromPropertyValue("pem"));
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValue("jks"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromPropertyValue("pkcs12"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromPropertyValue("bcfks"));
         assertNull(KeyStoreFileType.fromPropertyValue(""));
         assertNull(KeyStoreFileType.fromPropertyValue(null));
     }
@@ -66,6 +69,8 @@ public void testFromFilename() {
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.pem"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromFilename("mykey.p12"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.p12"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromFilename("mykey.bcfks"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.bcfks"));
     }
 
     @Test
@@ -81,6 +86,7 @@ public void testFromPropertyValueOrFileName() {
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValueOrFileName("JKS", "prod.key"));
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromPropertyValueOrFileName("PEM", "prod.key"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromPropertyValueOrFileName("PKCS12", "prod.key"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromPropertyValueOrFileName("BCFKS", "prod.key"));
         // Falls back to filename detection if no property value
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValueOrFileName("", "prod.jks"));
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
index 71fde1e6c8c..32380268c17 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
@@ -53,6 +53,7 @@ public class X509TestContext {
     private File trustStoreJksFile;
     private File trustStorePemFile;
     private File trustStorePkcs12File;
+    private File trustStoreBcfksFile;
 
     private final X509KeyType keyStoreKeyType;
     private final KeyPair keyStoreKeyPair;
@@ -62,6 +63,7 @@ public class X509TestContext {
     private File keyStoreJksFile;
     private File keyStorePemFile;
     private File keyStorePkcs12File;
+    private File keyStoreBcfksFile;
 
     private final Boolean hostnameVerification;
 
@@ -160,7 +162,9 @@ public File getTrustStoreFile(KeyStoreFileType storeFileType) throws IOException
             return getTrustStorePemFile();
         case PKCS12:
             return getTrustStorePkcs12File();
-        default:
+        case BCFKS:
+            return getTrustStoreBcfksFile();
+            default:
             throw new IllegalArgumentException("Invalid trust store type: "
                                                        + storeFileType
                                                        + ", must be one of: "
@@ -210,6 +214,23 @@ private File getTrustStorePkcs12File() throws IOException {
         return trustStorePkcs12File;
     }
 
+    private File getTrustStoreBcfksFile() throws IOException {
+        if (trustStoreBcfksFile == null) {
+            File trustStoreBcfksFile = File.createTempFile(
+                TRUST_STORE_PREFIX, KeyStoreFileType.BCFKS.getDefaultFileExtension(), tempDir);
+            trustStoreBcfksFile.deleteOnExit();
+            try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStoreBcfksFile)) {
+                byte[] bytes = X509TestHelpers.certToBCFKSTrustStoreBytes(trustStoreCertificate, trustStorePassword);
+                trustStoreOutputStream.write(bytes);
+                trustStoreOutputStream.flush();
+            } catch (GeneralSecurityException e) {
+                throw new IOException(e);
+            }
+            this.trustStoreBcfksFile = trustStoreBcfksFile;
+        }
+        return trustStoreBcfksFile;
+    }
+
     public X509KeyType getKeyStoreKeyType() {
         return keyStoreKeyType;
     }
@@ -235,9 +256,9 @@ public boolean isKeyStoreEncrypted() {
     }
 
     /**
-     * Returns the path to the key store file in the given format (JKS or PEM). Note that the file is created lazily,
+     * Returns the path to the key store file in the given format (JKS, PEM, ...). Note that the file is created lazily,
      * the first time this method is called. The key store file is temporary and will be deleted on exit.
-     * @param storeFileType the store file type (JKS or PEM).
+     * @param storeFileType the store file type (JKS, PEM, ...).
      * @return the path to the key store file.
      * @throws IOException if there is an error creating the key store file.
      */
@@ -249,6 +270,8 @@ public File getKeyStoreFile(KeyStoreFileType storeFileType) throws IOException {
             return getKeyStorePemFile();
         case PKCS12:
             return getKeyStorePkcs12File();
+        case BCFKS:
+            return getKeyStoreBcfksFile();
         default:
             throw new IllegalArgumentException("Invalid key store type: "
                                                        + storeFileType
@@ -303,6 +326,24 @@ private File getKeyStorePkcs12File() throws IOException {
         return keyStorePkcs12File;
     }
 
+    private File getKeyStoreBcfksFile() throws IOException {
+        if (keyStoreBcfksFile == null) {
+            File keyStoreBcfksFile = File.createTempFile(
+              KEY_STORE_PREFIX, KeyStoreFileType.BCFKS.getDefaultFileExtension(), tempDir);
+            keyStoreBcfksFile.deleteOnExit();
+            try (final FileOutputStream keyStoreOutputStream = new FileOutputStream(keyStoreBcfksFile)) {
+                byte[] bytes = X509TestHelpers.certAndPrivateKeyToBCFKSBytes(
+                  keyStoreCertificate, keyStoreKeyPair.getPrivate(), keyStorePassword);
+                keyStoreOutputStream.write(bytes);
+                keyStoreOutputStream.flush();
+            } catch (GeneralSecurityException e) {
+                throw new IOException(e);
+            }
+            this.keyStoreBcfksFile = keyStoreBcfksFile;
+        }
+        return keyStoreBcfksFile;
+    }
+
     /**
      * Sets the SSL system properties such that the given X509Util object can be used to create SSL Contexts that
      * will use the trust store and key store files created by this test context. Example usage:
@@ -314,8 +355,8 @@ private File getKeyStorePkcs12File() throws IOException {
      *     SSLContext ctx = x509Util.getDefaultSSLContext();
      * </pre>
      * @param x509Util the X509Util.
-     * @param keyStoreFileType the store file type to use for the key store (JKS or PEM).
-     * @param trustStoreFileType the store file type to use for the trust store (JKS or PEM).
+     * @param keyStoreFileType the store file type to use for the key store (JKS, PEM, ...).
+     * @param trustStoreFileType the store file type to use for the trust store (JKS, PEM, ...).
      * @throws IOException if there is an error creating the key store file or trust store file.
      */
     public void setSystemProperties(X509Util x509Util, KeyStoreFileType keyStoreFileType, KeyStoreFileType trustStoreFileType) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
index 4f169689743..fb1371a3da7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
@@ -72,7 +72,7 @@
 
 /**
  * This class contains helper methods for creating X509 certificates and key pairs, and for serializing them
- * to JKS or PEM files.
+ * to JKS, PEM or other keystore type files.
  */
 public class X509TestHelpers {
 
@@ -325,6 +325,24 @@ public static byte[] certToPKCS12TrustStoreBytes(
         return certToTrustStoreBytes(cert, keyPassword, trustStore);
     }
 
+    /**
+     * Encodes the given X509Certificate as a BCFKS TrustStore, optionally protecting the cert with a password (though
+     * it's unclear why one would do this since certificates only contain public information and do not need to be
+     * kept secret). Returns the byte array encoding of the trust store, which may be written to a file and loaded to
+     * instantiate the trust store at a later point or in another process.
+     * @param cert the certificate to serialize.
+     * @param keyPassword an optional password to encrypt the trust store. If empty or null, the cert will not be encrypted.
+     * @return the serialized bytes of the BCFKS trust store.
+     * @throws IOException
+     * @throws GeneralSecurityException
+     */
+    public static byte[] certToBCFKSTrustStoreBytes(
+      X509Certificate cert,
+      String keyPassword) throws IOException, GeneralSecurityException {
+        KeyStore trustStore = KeyStore.getInstance("BCFKS");
+        return certToTrustStoreBytes(cert, keyPassword, trustStore);
+    }
+
     private static byte[] certToTrustStoreBytes(X509Certificate cert, String keyPassword, KeyStore trustStore) throws IOException, GeneralSecurityException {
         char[] keyPasswordChars = keyPassword == null ? new char[0] : keyPassword.toCharArray();
         trustStore.load(null, keyPasswordChars);
@@ -351,7 +369,7 @@ private static byte[] certToTrustStoreBytes(X509Certificate cert, String keyPass
     public static byte[] certAndPrivateKeyToJavaKeyStoreBytes(
             X509Certificate cert, PrivateKey privateKey, String keyPassword) throws IOException, GeneralSecurityException {
         KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-        return certAndPrivateKeyToPKCS12Bytes(cert, privateKey, keyPassword, keyStore);
+        return certAndPrivateKeyToBytes(cert, privateKey, keyPassword, keyStore);
     }
 
     /**
@@ -368,10 +386,29 @@ public static byte[] certAndPrivateKeyToJavaKeyStoreBytes(
     public static byte[] certAndPrivateKeyToPKCS12Bytes(
             X509Certificate cert, PrivateKey privateKey, String keyPassword) throws IOException, GeneralSecurityException {
         KeyStore keyStore = KeyStore.getInstance("PKCS12");
-        return certAndPrivateKeyToPKCS12Bytes(cert, privateKey, keyPassword, keyStore);
+        return certAndPrivateKeyToBytes(cert, privateKey, keyPassword, keyStore);
+    }
+
+    /**
+     * Encodes the given X509Certificate and private key as a BCFKS KeyStore, optionally protecting the private key
+     * (and possibly the cert?) with a password. Returns the byte array encoding of the key store, which may be written
+     * to a file and loaded to instantiate the key store at a later point or in another process.
+     * @param cert the X509 certificate to serialize.
+     * @param privateKey the private key to serialize.
+     * @param keyPassword an optional key password. If empty or null, the private key will not be encrypted.
+     * @return the serialized bytes of the BCFKS key store.
+     * @throws IOException
+     * @throws GeneralSecurityException
+     */
+    public static byte[] certAndPrivateKeyToBCFKSBytes(
+      X509Certificate cert,
+      PrivateKey privateKey,
+      String keyPassword) throws IOException, GeneralSecurityException {
+        KeyStore keyStore = KeyStore.getInstance("BCFKS");
+        return certAndPrivateKeyToBytes(cert, privateKey, keyPassword, keyStore);
     }
 
-    private static byte[] certAndPrivateKeyToPKCS12Bytes(
+    private static byte[] certAndPrivateKeyToBytes(
             X509Certificate cert, PrivateKey privateKey, String keyPassword, KeyStore keyStore) throws IOException, GeneralSecurityException {
         char[] keyPasswordChars = keyPassword == null ? new char[0] : keyPassword.toCharArray();
         keyStore.load(null, keyPasswordChars);

From d3282c62ddb30a8ce265dcebca0e106c51f07ca3 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Tue, 6 Oct 2020 10:39:37 +0000
Subject: [PATCH 093/591] ZOOKEEPER-3952: Remove commons-lang from ZooKeeper

Removed commons-lang from main project, replaced functionality with standard Java code.

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, tison <wander4096@gmail.com>

Closes #1478 from tamaashu/ZOOKEEPER-3952
---
 pom.xml                                       | 48 ++++++++++++++++---
 .../zookeeper-contrib-zooinspector/ivy.xml    |  8 +---
 .../zookeeper-contrib-zooinspector/pom.xml    |  6 ---
 zookeeper-server/pom.xml                      |  4 --
 .../org/apache/zookeeper/common/PathTrie.java | 23 +++++----
 .../server/FinalRequestProcessor.java         |  3 +-
 6 files changed, 60 insertions(+), 32 deletions(-)

diff --git a/pom.xml b/pom.xml
index b994523d839..5c951833989 100755
--- a/pom.xml
+++ b/pom.xml
@@ -444,10 +444,10 @@
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.60</bouncycastle.version>
     <commons-collections.version>3.2.2</commons-collections.version>
-    <commons-lang.version>2.6</commons-lang.version>
     <dropwizard.version>3.2.5</dropwizard.version>
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
     <checkstyle.version>8.17</checkstyle.version>
+    <enforcer.version>3.0.0-M3</enforcer.version>
 
     <!-- parameters to pass to C client build -->
     <c-client-openssl>yes</c-client-openssl>
@@ -467,11 +467,6 @@
         <artifactId>commons-collections</artifactId>
         <version>${commons-collections.version}</version>
       </dependency>
-      <dependency>
-        <groupId>commons-lang</groupId>
-        <artifactId>commons-lang</artifactId>
-        <version>${commons-lang.version}</version>
-      </dependency>
       <dependency>
         <groupId>org.apache.yetus</groupId>
         <artifactId>audience-annotations</artifactId>
@@ -1046,6 +1041,47 @@
             </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <version>${enforcer.version}</version>
+        <executions>
+          <execution>
+            <id>banned-commons-lang</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>commons-lang:commons-lang</exclude>
+                  </excludes>
+                  <searchTransitive>false</searchTransitive>
+                  <message>We don't use commons-lang any more, so do not depend on it directly.</message>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
+          <execution>
+            <id>banned-commons-lang3</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>org.apache.commons:commons-lang3</exclude>
+                  </excludes>
+                  <searchTransitive>false</searchTransitive>
+                  <message>We don't use commons-lang3, so do not depend on it directly.</message>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
     <resources>
       <resource>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
index d841d18b2ce..96acdde0fed 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
@@ -39,12 +39,8 @@
             
     <dependency org="log4j" name="log4j" rev="1.2.17" transitive="false"/>
     <dependency org="junit" name="junit" rev="4.12" conf="test->default"/>
-    <dependency org="org.apache.rat" name="apache-rat-tasks" 
-                rev="0.6" conf="releaseaudit->default"/>
-    <dependency org="commons-lang" name="commons-lang" 
-                rev="2.4" conf="releaseaudit->default"/>
-    <dependency org="commons-collections" name="commons-collections" 
-                rev="3.2.2" conf="releaseaudit->default"/>
+    <dependency org="org.apache.rat" name="apache-rat-tasks" rev="0.6" conf="releaseaudit->default"/>
+    <dependency org="commons-collections" name="commons-collections" rev="3.2.2" conf="releaseaudit->default"/>
   </dependencies>
 
 </ivy-module>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index c9f3b1e2ce2..b5174413296 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -35,7 +35,6 @@
 
   <properties>
     <rat.version>0.6</rat.version>
-    <commons-lang.version>2.4</commons-lang.version>
     <guava.version>18.0</guava.version>
   </properties>
 
@@ -84,11 +83,6 @@
       <artifactId>apache-rat-tasks</artifactId>
       <version>${rat.version}</version>
     </dependency>
-    <dependency>
-      <groupId>commons-lang</groupId>
-      <artifactId>commons-lang</artifactId>
-      <version>${commons-lang.version}</version>
-    </dependency>
     <dependency>
       <groupId>commons-collections</groupId>
       <artifactId>commons-collections</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 5cdb8b384bf..5dbc028d3d8 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -48,10 +48,6 @@
       <artifactId>commons-collections</artifactId>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>commons-lang</groupId>
-      <artifactId>commons-lang</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-jute</artifactId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java
index 95258b2a4ae..86acdd9f9a5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java
@@ -27,7 +27,7 @@
  import java.util.concurrent.locks.Lock;
  import java.util.concurrent.locks.ReadWriteLock;
  import java.util.concurrent.locks.ReentrantReadWriteLock;
- import org.apache.commons.lang.StringUtils;
+ import java.util.stream.Stream;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
 
@@ -203,10 +203,10 @@ public PathTrie() {
      public void addPath(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
-         if (pathComponents.length == 0) {
+         if (path.length() == 0) {
              throw new IllegalArgumentException("Invalid path: " + path);
          }
+         final String[] pathComponents = split(path);
 
          writeLock.lock();
          try {
@@ -233,10 +233,11 @@ public void addPath(final String path) {
      public void deletePath(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
-         if (pathComponents.length == 0) {
+         if (path.length() == 0) {
              throw new IllegalArgumentException("Invalid path: " + path);
          }
+         final String[] pathComponents = split(path);
+
 
          writeLock.lock();
          try {
@@ -267,10 +268,10 @@ public void deletePath(final String path) {
      public boolean existsNode(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
-         if (pathComponents.length == 0) {
+         if (path.length() == 0) {
              throw new IllegalArgumentException("Invalid path: " + path);
          }
+         final String[] pathComponents = split(path);
 
          readLock.lock();
          try {
@@ -299,7 +300,7 @@ public boolean existsNode(final String path) {
      public String findMaxPrefix(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
+         final String[] pathComponents = split(path);
 
          readLock.lock();
          try {
@@ -344,4 +345,10 @@ public void clear() {
          }
      }
 
+     private static String[] split(final String path){
+         return Stream.of(path.split("/"))
+                 .filter(t -> !t.trim().isEmpty())
+                 .toArray(String[]::new);
+     }
+
  }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index a23e90371e3..26d5bafa822 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -25,7 +25,6 @@
 import java.util.List;
 import java.util.Locale;
 import java.util.Set;
-import org.apache.commons.lang.StringUtils;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.KeeperException;
@@ -554,7 +553,7 @@ public void processRequest(Request request) {
                 String prefixPath = getEphemerals.getPrefixPath();
                 Set<String> allEphems = zks.getZKDatabase().getDataTree().getEphemerals(request.sessionId);
                 List<String> ephemerals = new ArrayList<>();
-                if (StringUtils.isBlank(prefixPath) || "/".equals(prefixPath.trim())) {
+                if (prefixPath == null || prefixPath.trim().isEmpty() || "/".equals(prefixPath.trim())) {
                     ephemerals.addAll(allEphems);
                 } else {
                     for (String p : allEphems) {

From 391bb7e636300fba24da185b8d0c4e0b854dc8b6 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 6 Oct 2020 17:51:15 +0200
Subject: [PATCH 094/591] ZOOKEEPER-3957: Created initial version of
 owasp-check Jenkinsfile

Running the dependency check and collecting dependency-check-* files as artifacts.
Build that is validating the patch:
https://ci-hadoop.apache.org/view/ZooKeeper/job/zookeeper-multi-branch-owasp/job/ZOOKEEPER-3957/

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1483 from anmolnar/ZOOKEEPER-3957
---
 Jenkinsfile-owasp | 61 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 Jenkinsfile-owasp

diff --git a/Jenkinsfile-owasp b/Jenkinsfile-owasp
new file mode 100644
index 00000000000..76416357c4a
--- /dev/null
+++ b/Jenkinsfile-owasp
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 'Hadoop'
+    }
+
+    options {
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    tools {
+        maven "Maven (latest)"
+        jdk "JDK 1.8 (latest)"
+    }
+
+    stages {
+        stage('BuildAndTest') {
+            steps {
+                sh "git clean -fxd"
+                sh "mvn clean package -DskipTests dependency-check:check"
+            }
+            post {
+                always {
+                   archiveArtifacts '**/target/dependency-check-*'
+                }
+            }
+        }
+    }
+
+    post {
+        // Jenkins pipeline jobs fill slaves on PRs without this :(
+        cleanup() {
+            script {
+                sh label: 'Cleanup workspace', script: '''
+                    # See HADOOP-13951
+                    chmod -R u+rxw "${WORKSPACE}"
+                    '''
+                deleteDir()
+            }
+        }
+    }
+}

From 83d79d16d683dbf07a8a1b52ed97558530f92f89 Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Thu, 8 Oct 2020 20:03:51 +0200
Subject: [PATCH 095/591] ZOOKEEPER-3956: Remove json-simple from ZooKeeper

JSON-Simple was only used in SnapshotFormatter in one place and also in Contrib's LogGraph component.
It's development has discontinued since 2012, so it's time to remove it.
I have replaced it with Jackson2, which we use in ZooKeeper anyway.
Added some unit tests to LogGraph as it didn't have any.

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1484 from tamaashu/ZOOKEEPER-3956
---
 pom.xml                                       |  29 +-
 zookeeper-assembly/pom.xml                    |   4 -
 .../zookeeper-contrib-fatjar/pom.xml          |   4 -
 .../{README.txt => README.md}                 |  46 ++-
 .../zookeeper-contrib-loggraph/build.xml      |  70 ----
 .../zookeeper-contrib-loggraph/ivy.xml        |  44 ---
 .../zookeeper-contrib-loggraph/pom.xml        |  48 ++-
 .../apache/zookeeper/graph/JsonGenerator.java | 325 +++++++++---------
 .../zookeeper/graph/MergedLogSource.java      | 280 +++++++--------
 .../zookeeper/graph/servlets/FileLoader.java  |  48 +--
 .../apache/zookeeper/graph/servlets/Fs.java   |  80 +++--
 .../zookeeper/graph/servlets/GraphData.java   |  16 -
 .../zookeeper/graph/servlets/JsonServlet.java |  97 +++---
 .../zookeeper/graph/servlets/NumEvents.java   |  87 +++--
 .../zookeeper/graph/servlets/Throughput.java  | 173 +++++-----
 .../src/main/resources/loggraph-dev.sh        |   9 +-
 .../src/main/resources/loggraph.sh            |   9 +-
 .../graph/servlets/FileLoaderTest.java        | 120 +++++++
 .../zookeeper/graph/servlets/FsTest.java      |  46 +++
 .../graph/servlets/ThroughputTest.java        |  88 +++++
 zookeeper-server/pom.xml                      |   5 -
 .../zookeeper/server/SnapshotFormatter.java   |  12 +-
 .../src/main/resources/LICENSE.txt            |   4 -
 .../lib/json-simple-1.1.1.LICENSE.txt         | 202 -----------
 24 files changed, 884 insertions(+), 962 deletions(-)
 rename zookeeper-contrib/zookeeper-contrib-loggraph/{README.txt => README.md} (72%)
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/build.xml
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml
 create mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java
 create mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java
 create mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java
 delete mode 100644 zookeeper-server/src/main/resources/lib/json-simple-1.1.1.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index 5c951833989..066b88656f1 100755
--- a/pom.xml
+++ b/pom.xml
@@ -438,7 +438,6 @@
     <netty.version>4.1.50.Final</netty.version>
     <jetty.version>9.4.24.v20191120</jetty.version>
     <jackson.version>2.10.3</jackson.version>
-    <json.version>1.1.1</json.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>
@@ -618,17 +617,6 @@
         <artifactId>jackson-databind</artifactId>
         <version>${jackson.version}</version>
       </dependency>
-      <dependency>
-        <groupId>com.googlecode.json-simple</groupId>
-        <artifactId>json-simple</artifactId>
-        <version>${json.version}</version>
-        <exclusions>
-          <exclusion>
-              <groupId>junit</groupId>
-              <artifactId>junit</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
       <dependency>
         <groupId>jline</groupId>
         <artifactId>jline</artifactId>
@@ -1080,6 +1068,23 @@
               </rules>
             </configuration>
           </execution>
+          <execution>
+            <id>banned-json-simple</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>com.googlecode.json-simple:json-simple</exclude>
+                  </excludes>
+                  <searchTransitive>false</searchTransitive>
+                  <message>We don't use json-simple any more, so do not depend on it directly.</message>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
         </executions>
       </plugin>
     </plugins>
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index 8a2967fe616..1a3998d4bdd 100755
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -99,10 +99,6 @@
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
     </dependency>
-    <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
-    </dependency>
     <dependency>
       <groupId>jline</groupId>
       <artifactId>jline</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
index 9a90dd7fc3c..2772b94d63a 100755
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -78,10 +78,6 @@
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
     </dependency>
-    <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
-    </dependency>
     <dependency>
       <groupId>jline</groupId>
       <artifactId>jline</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/README.txt b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
similarity index 72%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/README.txt
rename to zookeeper-contrib/zookeeper-contrib-loggraph/README.md
index 8ccaa1ca5b0..a15ea0fca2a 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
@@ -1,25 +1,27 @@
-LogGraph README
+# LogGraph README
 
-1 - About
+## 1 - About
 LogGraph is an application for viewing and filtering zookeeper logs. It can handle transaction logs and message logs. 
 
-2 - Compiling
+## 2 - Compiling
 
-Run "ant jar" in src/contrib/loggraph/. This will download all dependencies and compile all the loggraph code.
+Run `mvn clean install dependency:copy-dependencies` in zookeeper-contrib/zookeeper-contrib-loggraph/.
+This will download all dependencies and compile all the loggraph code.
 
-Once compilation has finished, you can run it the the loggraph.sh script in zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources.
+Once compilation has finished, you can run it the the `loggraph.sh` script in zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources.
 This will start and embedded web server on your machine.
-Navigate to http://localhost:8182/graph/main.html
+Navigate to `http://localhost:8182/graph/main.html`
 
-3 - Usage
+## 3 - Usage
 LogGraph presents the user with 4 views, 
  
   a) Simple log view
      This view simply displays the log text. This isn't very useful without filters (see "Filtering the logs").
 
   b) Server view
-     The server view shows the interactions between the different servers in an ensemble. The X axis represents time. 
-        * Exceptions show up as red dots. Hovering your mouse over them will give you more details of the exception
+     The server view shows the interactions between the different servers in an ensemble. The X axis represents time.
+      
+    * Exceptions show up as red dots. Hovering your mouse over them will give you more details of the exception
 	* The colour of the line represents the election state of the server. 
 	   - orange means LOOKING for leader
 	   - dark green means the server is the leader
@@ -34,37 +36,45 @@ LogGraph presents the user with 4 views,
   d) Stats view
      There is currently only one statistics view, Transactions/minute. Suggestions for other statistic views are very welcome.
 
-4 - Filtering the logs
+## 4 - Filtering the logs
 The logs can be filtered in 2 ways, by time and by content. 
 
 To filter by time simply move the slider to the desired start time. The time window specifies how many milliseconds after and including the start time will be displayed.
 
 Content filtering uses a adhoc filtering language, using prefix notation. The language looks somewhat similar to lisp. A statement in the language takes the form (op arg arg ....). A statement resolves to a boolean value. Statements can be nested. 
 
-4.1 - Filter arguments
+### 4.1 - Filter arguments
 An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpretted as hexidecimal. Otherwise it is interpretted as decimal. If the argument begins with a double-quote, (") it is interpretted as a string. Anything else is interpretted as a symbol.
 
-4.2 - Filter symbols
+### 4.2 - Filter symbols
 The possible filter symbols are: 
 
 client-id : number, the session id of the client who initiated a transaction.
+
 cxid : number, the cxid of a transaction
+
 zxid : number, the zxid of a transaction
+
 operation : string, the operation being performed, for example "setData", "createSession", "closeSession", "error", "create"
 
-4.3 - Filter operations
+### 4.3 - Filter operations
 The possible filter operations are:
 
 or : logical or, takes 1 or more arguments which must be other statements.
+
 and : logical and, takes 1 or more arguments which must be other statements.
+
 not : logical not, takes 1 argument which must be another statement.
+
 xor : exclusive or, takes 1 or more arguments which must be other statements.
-= : equals, takes 1 or more arguments, which must all be equal to each other to return true.
-> : greater than, takes 1 or more arguments, to return true the 1st argument must be greater than the 2nd argument which must be greater than the 3rd argument and so on... 
-< : less than, takes 1 or more arguments, to return true the 1st argument must be less than the 2nd argument which must be less than the 3rd argument and so on... 
 
-4.3 - Filter examples
+ = : equals, takes 1 or more arguments, which must all be equal to each other to return true.
+
+&gt; : greater than, takes 1 or more arguments, to return true the 1st argument must be greater than the 2nd argument which must be greater than the 3rd argument and so on... 
+
+&lt; : less than, takes 1 or more arguments, to return true the 1st argument must be less than the 2nd argument which must be less than the 3rd argument and so on... 
+
+### 4.4 - Filter examples
 Give me all the setData operations with session id 0xdeadbeef or 0xcafeb33r but not with zxid 0x12341234 ->
 
 (and (= operation "setData") (or (= client-id 0xdeadbeef) (= client-id 0xcafeb33r)) (not (= zxid 0x12341234)))
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/build.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/build.xml
deleted file mode 100644
index 07809ff7e93..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/build.xml
+++ /dev/null
@@ -1,70 +0,0 @@
-<?xml version="1.0"?>
-
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-<project name="loggraph" default="jar">
-
-  <import file="../build-contrib.xml"/>
-  
-  <target name="init" depends="check-contrib,zookeeperbuildcontrib.init" unless="skip.contrib">
-    <echo message="contrib: ${name}"/>
-    <mkdir dir="${build.dir}"/>
-    <antcall target="init-contrib"/>
-  </target>
-
-  <target name="compile" depends="init,ivy-retrieve,zookeeperbuildcontrib.compile" unless="skip.contrib">
-  </target>
-
-  <target name="setjarname">
-    <property name="jarname" value="${build.dir}/zookeeper-${version}-${name}.jar"/>
-  </target>
-
-  <target name="jar" depends="setjarname,compile"  >
-    <jar destfile="${jarname}">
-      <fileset file="${zk.root}/LICENSE.txt" />
-      <fileset dir="${build.classes}" />
-      <fileset dir="src/main/resources/webapp"/>
-      <manifest>
-        <attribute name="Built-By" value="${user.name}"/>
-        <attribute name="Built-At" value="${build.time}"/>
-        <attribute name="Built-On" value="${host.name}" />
-        <attribute name="Implementation-Title" value="org.apache.zookeeper.graph"/>
-        <attribute name="Implementation-Version" value="${revision}"/>
-        <attribute name="Implementation-Vendor" value="The Apache Software Foundation"/>
-      </manifest>
-    </jar>
-  </target>
-  
-  <target name="test">
-    <echo message="No test target defined for this package" />
-  </target>
-  
-
-  <target name="package" depends="compile, zookeeperbuildcontrib.package" unless="skip.contrib">
-    <echo message="contrib: ${name}"/>
-    
-    <copy file="${basedir}/build.xml" todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}"/>
-
-    <mkdir dir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src"/>
-    <copy todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src">
-      <fileset dir="${basedir}/src/main"/>
-    </copy>
-
-  </target>
-
-</project>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml
deleted file mode 100644
index e3a1b486b7a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml
+++ /dev/null
@@ -1,44 +0,0 @@
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-<ivy-module version="2.0"
-            xmlns:e="http://ant.apache.org/ivy/extra">
-
-  <info organisation="org.apache.zookeeper"
-        module="${name}" revision="${version}">
-    <license name="Apache 2.0"/>
-    <ivyauthor name="Apache ZooKeeper" url="http://zookeeper.apache.org"/>
-    <description>ZooKeeper Graphing</description>
-  </info>
-
-  <configurations defaultconfmapping="default">
-    <conf name="default"/>
-    <conf name="test"/>
-  </configurations>
-
-  <dependencies>
-    <dependency org="org.slf4j" name="slf4j-api" rev="1.7.5"/>
-    <dependency org="org.slf4j" name="slf4j-log4j12" rev="1.7.5" transitive="false"/>
-  
-    <!-- transitive false turns off dependency checking, log4j deps seem borked -->
-    <dependency org="log4j" name="log4j" rev="1.2.17" transitive="false"/>
-    <dependency org="org.eclipse.jetty" name="jetty-server" rev="9.2.18.v20160721" />
-    <dependency org="org.eclipse.jetty" name="jetty-servlet" rev="9.2.18.v20160721" />
-    <dependency org="com.googlecode.json-simple" name="json-simple" rev="1.1" />
-  </dependencies>
-
-</ivy-module>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
index bf6e6730f7d..81e12c8264b 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
@@ -44,6 +44,10 @@
       <artifactId>zookeeper</artifactId>
       <version>${project.version}</version>
     </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
@@ -77,8 +81,19 @@
       <artifactId>jetty-servlet</artifactId>
     </dependency>
     <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <scope>test</scope>
     </dependency>
   </dependencies>
 
@@ -88,6 +103,35 @@
         <directory>${project.basedir}/src/main/resources/webapp</directory>
       </resource>
     </resources>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <configuration>
+          <outputDirectory>
+            ${project.basedir}/lib
+          </outputDirectory>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <configuration>
+          <includes>
+            <include>**/*Test.java</include>
+          </includes>
+          <forkCount>${surefire-forkcount}</forkCount>
+          <reuseForks>false</reuseForks>
+          <argLine>-Xmx512m -Dtest.junit.threads=${surefire-forkcount} -Dzookeeper.junit.threadid=${surefire.forkNumber}</argLine>
+          <basedir>${project.basedir}</basedir>
+          <redirectTestOutputToFile>true</redirectTestOutputToFile>
+          <systemPropertyVariables>
+            <build.test.dir>${project.build.directory}/surefire</build.test.dir>
+            <zookeeper.DigestAuthenticationProvider.superDigest>super:D/InIHSb7yEEbrWz8b9l71RjZJU=</zookeeper.DigestAuthenticationProvider.superDigest>
+          </systemPropertyVariables>
+        </configuration>
+      </plugin>
+    </plugins>
   </build>
 
 </project>
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
index 8215833f298..19f919e5afe 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
@@ -17,25 +17,22 @@
  */
 package org.apache.zookeeper.graph;
 
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import java.io.Writer;
-import java.io.OutputStreamWriter;
-import java.io.IOException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import java.util.regex.Pattern;
 import java.util.regex.Matcher;
 import java.util.HashSet;
 import java.util.Iterator;
-import java.util.LinkedList;
-import java.util.ListIterator;
 import java.util.Set;
 
 public class JsonGenerator {
-    private JSONObject root;
-    private Set<Integer> servers;
+	private final ObjectMapper mapper = new ObjectMapper();
+	private final JsonNode root;
+    private final Set<Integer> servers;
 
     private class Message {
 	private int from;
@@ -55,170 +52,178 @@ public boolean equals(Message m) {
 	}
     };
 
-    public JSONObject txnEntry(TransactionEntry e) {
-	JSONObject event = new JSONObject();
+    public JsonNode txnEntry(TransactionEntry e) {
+		JsonNode event = mapper.createObjectNode();
 
-	event.put("time", Long.toString(e.getTimestamp()));
-	event.put("client", Long.toHexString(e.getClientId()));
-	event.put("cxid", Long.toHexString(e.getCxid()));
-	event.put("zxid", Long.toHexString(e.getZxid()));
-	event.put("op", e.getOp());
-	event.put("extra", e.getExtra());
-	event.put("type", "transaction");
+		((ObjectNode) event).put("time", Long.toString(e.getTimestamp()));
+		((ObjectNode) event).put("client", Long.toHexString(e.getClientId()));
+		((ObjectNode) event).put("cxid", Long.toHexString(e.getCxid()));
+		((ObjectNode) event).put("zxid", Long.toHexString(e.getZxid()));
+		((ObjectNode) event).put("op", e.getOp());
+		((ObjectNode) event).put("extra", e.getExtra());
+		((ObjectNode) event).put("type", "transaction");
 
-	return event;
+		return event;
     }
 
     /**
        Assumes entries are sorted by timestamp.
      */
     public JsonGenerator(LogIterator iter) {
-	servers = new HashSet<Integer>();
+		servers = new HashSet<Integer>();
 
-	Pattern stateChangeP = Pattern.compile("- (LOOKING|FOLLOWING|LEADING)");
-	Pattern newElectionP = Pattern.compile("New election. My id =  (\\d+), Proposed zxid = (\\d+)");
-	Pattern receivedProposalP = Pattern.compile("Notification: (\\d+) \\(n.leader\\), (\\d+) \\(n.zxid\\), (\\d+) \\(n.round\\), .+ \\(n.state\\), (\\d+) \\(n.sid\\), .+ \\(my state\\)");
-	Pattern exceptionP = Pattern.compile("xception");
-	
-	root = new JSONObject();
-	Matcher m = null;
-	JSONArray events = new JSONArray();
-	root.put("events", events);
-	
-	long starttime = Long.MAX_VALUE;
-	long endtime = 0;
-
-	int leader = 0;
-	long curEpoch = 0;
-	boolean newEpoch = false;
-
-	while (iter.hasNext()) {
-	    LogEntry ent = iter.next();
-	    
-	    if (ent.getTimestamp() < starttime) {
-		starttime = ent.getTimestamp();
-	    }
-	    if (ent.getTimestamp() > endtime) {
-		endtime = ent.getTimestamp();
-	    }
-	    
-	    if (ent.getType() == LogEntry.Type.TXN) {
-		events.add(txnEntry((TransactionEntry)ent));
-	    } else {
-		Log4JEntry e = (Log4JEntry)ent;
-		servers.add(e.getNode());
-		
-		if ((m = stateChangeP.matcher(e.getEntry())).find()) {
-		    JSONObject stateChange = new JSONObject();
-		    stateChange.put("type", "stateChange");
-		    stateChange.put("time", e.getTimestamp());
-		    stateChange.put("server", e.getNode());
-		    stateChange.put("state", m.group(1));
-		    events.add(stateChange);
-		    
-		    if (m.group(1).equals("LEADING")) {
-			leader = e.getNode();
-		    }
-		} else if ((m = newElectionP.matcher(e.getEntry())).find()) {
-		    Iterator<Integer> iterator = servers.iterator();
-		    long zxid = Long.valueOf(m.group(2));
-		    int count = (int)zxid;// & 0xFFFFFFFFL;
-		    int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
-		    
-		    if (leader != 0 && epoch > curEpoch) {
-			JSONObject stateChange = new JSONObject();
-			stateChange.put("type", "stateChange");
-			stateChange.put("time", e.getTimestamp());
-			stateChange.put("server", leader);
-			stateChange.put("state", "INIT");
-			events.add(stateChange);
-			leader = 0;
-		    }
-		    
-		    while (iterator.hasNext()) {
-			int dst = iterator.next();
-			if (dst != e.getNode()) {
-			    JSONObject msg = new JSONObject();
-			    msg.put("type", "postmessage");
-			    msg.put("src", e.getNode());
-			    msg.put("dst", dst);
-			    msg.put("time", e.getTimestamp());
-			    msg.put("zxid", m.group(2));
-			    msg.put("count", count);
-			    msg.put("epoch", epoch);
-			    
-			    events.add(msg);
+		Pattern stateChangeP = Pattern.compile("- (LOOKING|FOLLOWING|LEADING)");
+		Pattern newElectionP = Pattern.compile("New election. My id =  (\\d+), Proposed zxid = (\\d+)");
+		Pattern receivedProposalP = Pattern.compile("Notification: (\\d+) \\(n.leader\\), (\\d+) \\(n.zxid\\), (\\d+) \\(n.round\\), .+ \\(n.state\\), (\\d+) \\(n.sid\\), .+ \\(my state\\)");
+		Pattern exceptionP = Pattern.compile("xception");
+
+		root = mapper.createObjectNode();
+		Matcher m = null;
+		ArrayNode events = mapper.createArrayNode();
+		((ObjectNode)root).set("events", events);
+
+		long starttime = Long.MAX_VALUE;
+		long endtime = 0;
+
+		int leader = 0;
+		long curEpoch = 0;
+
+		while (iter.hasNext()) {
+			LogEntry ent = iter.next();
+
+			if (ent.getTimestamp() < starttime) {
+				starttime = ent.getTimestamp();
+			}
+			if (ent.getTimestamp() > endtime) {
+				endtime = ent.getTimestamp();
 			}
-		    }
-		} else if ((m = receivedProposalP.matcher(e.getEntry())).find()) {
-		    // Pattern.compile("Notification: \\d+, (\\d+), (\\d+), \\d+, [^,]*, [^,]*, (\\d+)");//, LOOKING, LOOKING, 2
-		    int src = Integer.valueOf(m.group(4));
-		    long zxid = Long.valueOf(m.group(2));
-		    int dst = e.getNode();
-		    long epoch2 = Long.valueOf(m.group(3));
-		    
-		    int count = (int)zxid;// & 0xFFFFFFFFL;
-		    int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
-		    
-		    if (leader != 0 && epoch > curEpoch) {
-			JSONObject stateChange = new JSONObject();
-			stateChange.put("type", "stateChange");
-			stateChange.put("time", e.getTimestamp());
-			stateChange.put("server", leader);
-			stateChange.put("state", "INIT");
-			events.add(stateChange);
-			leader = 0;
-		    }
-		    
-		    if (src != dst) {
-			JSONObject msg = new JSONObject();
-			msg.put("type", "delivermessage");
-			msg.put("src", src);
-			msg.put("dst", dst);
-			msg.put("time", e.getTimestamp());
-			msg.put("zxid", zxid);
-			msg.put("epoch", epoch);
-			msg.put("count", count);
-			msg.put("epoch2", epoch2);
-			
-			events.add(msg);
-		    }
-		} else if ((m = exceptionP.matcher(e.getEntry())).find()) {
-		    JSONObject ex = new JSONObject();
-		    ex.put("type", "exception");
-		    ex.put("server", e.getNode());
-		    ex.put("time", e.getTimestamp());
-		    ex.put("text", e.getEntry());
-		    events.add(ex);
-		} 
-	    }
-	    JSONObject ex = new JSONObject();
-	    ex.put("type", "text");
-	    ex.put("time", ent.getTimestamp());
-	    String txt = ent.toString();
-	    ex.put("text", txt);
-	    events.add(ex);
-	}
-	//	System.out.println("pending messages: "+pendingMessages.size());
-	root.put("starttime", starttime);
-	root.put("endtime", endtime);
 
-	JSONArray serversarray = new JSONArray();
-	root.put("servers", serversarray);
-	
-	Iterator<Integer> iterator = servers.iterator();
-	while (iterator.hasNext()) {
-	    serversarray.add(iterator.next());
-	}
+			if (ent.getType() == LogEntry.Type.TXN) {
+				events.add(txnEntry((TransactionEntry)ent));
+			}
+			else {
+				Log4JEntry e = (Log4JEntry)ent;
+				servers.add(e.getNode());
+
+				if ((m = stateChangeP.matcher(e.getEntry())).find()) {
+					JsonNode stateChange = add("stateChange", e.getTimestamp(), e.getNode(), m.group(1));
+					events.add(stateChange);
+
+					if (m.group(1).equals("LEADING")) {
+					leader = e.getNode();
+					}
+				}
+				else if ((m = newElectionP.matcher(e.getEntry())).find()) {
+					Iterator<Integer> iterator = servers.iterator();
+					long zxid = Long.valueOf(m.group(2));
+					int count = (int)zxid;// & 0xFFFFFFFFL;
+					int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
+
+					if (leader != 0 && epoch > curEpoch) {
+						JsonNode stateChange = add("stateChange", e.getTimestamp(), leader, "INIT");
+						events.add(stateChange);
+
+						leader = 0;
+					}
+
+					while (iterator.hasNext()) {
+						int dst = iterator.next();
+						if (dst != e.getNode()) {
+							JsonNode msg = mapper.createObjectNode();
+							((ObjectNode)msg).put("type", "postmessage");
+							((ObjectNode)msg).put("src", e.getNode());
+							((ObjectNode)msg).put("dst", dst);
+							((ObjectNode)msg).put("time", e.getTimestamp());
+							((ObjectNode)msg).put("zxid", m.group(2));
+							((ObjectNode)msg).put("count", count);
+							((ObjectNode)msg).put("epoch", epoch);
+
+							events.add(msg);
+						}
+					}
+				}
+				else if ((m = receivedProposalP.matcher(e.getEntry())).find()) {
+					// Pattern.compile("Notification: \\d+, (\\d+), (\\d+), \\d+, [^,]*, [^,]*, (\\d+)");//, LOOKING, LOOKING, 2
+					int src = Integer.valueOf(m.group(4));
+					long zxid = Long.valueOf(m.group(2));
+					int dst = e.getNode();
+					long epoch2 = Long.valueOf(m.group(3));
+
+					int count = (int)zxid;// & 0xFFFFFFFFL;
+					int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
+
+					if (leader != 0 && epoch > curEpoch) {
+						JsonNode stateChange = add("stateChange", e.getTimestamp(), leader, "INIT");
+						events.add(stateChange);
+
+						leader = 0;
+					}
+
+					if (src != dst) {
+						JsonNode msg = mapper.createObjectNode();
+						((ObjectNode)msg).put("type", "delivermessage");
+						((ObjectNode)msg).put("src", src);
+						((ObjectNode)msg).put("dst", dst);
+						((ObjectNode)msg).put("time", e.getTimestamp());
+						((ObjectNode)msg).put("zxid", zxid);
+						((ObjectNode)msg).put("count", count);
+						((ObjectNode)msg).put("epoch", epoch);
+						((ObjectNode)msg).put("epoch2", epoch2);
+
+					events.add(msg);
+					}
+				}
+				else if ((m = exceptionP.matcher(e.getEntry())).find()) {
+					JsonNode ex = mapper.createObjectNode();
+					((ObjectNode)ex).put("type", "exception");
+					((ObjectNode)ex).put("time", e.getTimestamp());
+					((ObjectNode)ex).put("server", e.getNode());
+					((ObjectNode)ex).put("text", e.getEntry());
+					events.add(ex);
+				}
+			}
+			JsonNode ex = mapper.createObjectNode();
+			((ObjectNode)ex).put("type", "text");
+			((ObjectNode)ex).put("time", ent.getTimestamp());
+			String txt = ent.toString();
+			((ObjectNode)ex).put("text", txt);
+			events.add(ex);
+		}
+		//	System.out.println("pending messages: "+pendingMessages.size());
+		((ObjectNode)root).put("starttime", starttime);
+		((ObjectNode)root).put("endtime", endtime);
+
+		ArrayNode serversarray = mapper.createArrayNode();
+		((ObjectNode)root).set("servers", serversarray);
+
+		Iterator<Integer> iterator = servers.iterator();
+		while (iterator.hasNext()) {
+			serversarray.add(iterator.next());
+		}
     }
 
+    private JsonNode add(String type, long timestamp, int node, String entry){
+		JsonNode stateChange = mapper.createObjectNode();
+		((ObjectNode)stateChange).put("type", type);
+		((ObjectNode)stateChange).put("time", timestamp);
+		((ObjectNode)stateChange).put("server", node);
+		((ObjectNode)stateChange).put("state", entry);
+		return stateChange;
+	}
+
     public String toString() {
-	return JSONValue.toJSONString(root);
+		String jsonString = null;
+		try {
+			jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(root);
+		} catch (JsonProcessingException e) {
+			jsonString = "{\"ERR\", " + e.getMessage() + "}";
+		}
+		return jsonString;
     }
 
     public static void main(String[] args) throws Exception {
-	MergedLogSource src = new MergedLogSource(args);
-	LogIterator iter = src.iterator();
-	System.out.println(new JsonGenerator(iter));
+		MergedLogSource src = new MergedLogSource(args);
+		LogIterator iter = src.iterator();
+		System.out.println(new JsonGenerator(iter));
     }
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
index bb789d39596..ba405ae86ce 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
@@ -17,48 +17,16 @@
  */
 package org.apache.zookeeper.graph;
 
-import java.io.ByteArrayInputStream;
-import java.io.EOFException;
-import java.io.FileInputStream;
 import java.io.IOException;
-import java.text.DateFormat;
-import java.util.Date;
-import java.util.zip.Adler32;
-import java.util.zip.Checksum;
-import java.util.HashMap;
-
-import org.apache.jute.BinaryInputArchive;
-import org.apache.jute.InputArchive;
-import org.apache.jute.Record;
-import org.apache.zookeeper.server.TraceFormatter;
-import org.apache.zookeeper.server.persistence.FileHeader;
-import org.apache.zookeeper.server.persistence.FileTxnLog;
-import org.apache.zookeeper.server.util.SerializeUtils;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import org.apache.zookeeper.ZooDefs.OpCode;
-
-import org.apache.zookeeper.txn.CreateSessionTxn;
-import org.apache.zookeeper.txn.CreateTxn;
-import org.apache.zookeeper.txn.DeleteTxn;
-import org.apache.zookeeper.txn.ErrorTxn;
-import org.apache.zookeeper.txn.SetACLTxn;
-import org.apache.zookeeper.txn.SetDataTxn;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import java.io.Closeable;
-import java.io.FileNotFoundException;
-import java.util.Vector;
-import java.util.Iterator;
-import java.util.Collections;
-import java.util.NoSuchElementException;
+import java.util.ArrayList;
+import java.util.List;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 public class MergedLogSource implements LogSource {
     private static final Logger LOG = LoggerFactory.getLogger(MergedLogSource.class);
-    private Vector<LogSource> sources = null;
+    protected List<LogSource> sources = new ArrayList<>();
     private long starttime = 0;
     private long endtime = 0;
     private long size = 0;
@@ -72,148 +40,150 @@ public boolean overlapsRange(long starttime, long endtime) {
     public long getEndTime() { return endtime; }
 
     private class MergedLogSourceIterator implements LogIterator {
-	private LogEntry next = null;
-	private long start = 0;
-	private long end = 0;
-	private MergedLogSource src = null;
-	private LogIterator[] sources = null;
-	private LogEntry[] nexts = null;
-	private FilterOp filter = null;
-	
-	public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	    Vector<LogIterator> iters = new Vector<LogIterator>();
-	    for (LogSource s : src.sources) {
-		if (s.overlapsRange(starttime, endtime)) {
-		    iters.add(s.iterator(starttime, endtime, filter));
+		private LogEntry next = null;
+		private long start = 0;
+		private long end = 0;
+		private MergedLogSource src = null;
+		private LogIterator[] sources = null;
+		private LogEntry[] nexts = null;
+		private FilterOp filter = null;
+
+		public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
+			List<LogIterator> iters = new ArrayList<>();
+			for (LogSource s : src.sources) {
+			if (s.overlapsRange(starttime, endtime)) {
+				iters.add(s.iterator(starttime, endtime, filter));
+			}
+			}
+
+			sources = new LogIterator[iters.size()];
+			sources = iters.toArray(sources);
+			nexts = new LogEntry[iters.size()];
+			for (int i = 0; i < sources.length; i++) {
+			if (sources[i].hasNext())
+				nexts[i] = sources[i].next();
+			}
+			this.filter = filter;
 		}
-	    }
-	    
-	    sources = new LogIterator[iters.size()];
-	    sources = iters.toArray(sources);
-	    nexts = new LogEntry[iters.size()];
-	    for (int i = 0; i < sources.length; i++) {
-		if (sources[i].hasNext()) 
-		    nexts[i] = sources[i].next();
-	    }
-	    this.filter = filter;
-	}
-		    
-	public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-	    this(src, starttime, endtime, null);
-	}
-	
-	public long size() throws IOException {
-	    long size = 0;
-	    for (LogIterator i : sources) {
-		size += i.size();
-	    }
-	    return size;
-	}
 
-	public boolean hasNext() {
-	    for (LogEntry n : nexts) {
-		if (n != null) return true;
-	    }
-	    return false;
-	}
-	
-	public LogEntry next() {
-	    int min = -1;
-	    for (int i = 0; i < nexts.length; i++) {
-		if (nexts[i] != null) {
-		    if (min == -1) {
-			min = i;
-		    } else if (nexts[i].getTimestamp() < nexts[min].getTimestamp()) {
-			min = i;
-		    }
+		public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
+			this(src, starttime, endtime, null);
 		}
-	    }
-	    if (min == -1) {
-		return null;
-	    } else {
-		LogEntry e =  nexts[min];
-		nexts[min] = sources[min].next();
-		return e;
-	    }
-	}
 
-	public void remove() throws UnsupportedOperationException {
-	    throw new UnsupportedOperationException("remove not supported for Merged logs");
-	}
-	
-	public void close() throws IOException {
-	    for (LogIterator i : sources) {
-		i.close();
-	    }
-	}
+		public long size() throws IOException {
+			long size = 0;
+			for (LogIterator i : sources) {
+			size += i.size();
+			}
+			return size;
+		}
+
+		public boolean hasNext() {
+			for (LogEntry n : nexts) {
+			if (n != null) return true;
+			}
+			return false;
+		}
+
+		public LogEntry next() {
+			int min = -1;
+			for (int i = 0; i < nexts.length; i++) {
+			if (nexts[i] != null) {
+				if (min == -1) {
+				min = i;
+				} else if (nexts[i].getTimestamp() < nexts[min].getTimestamp()) {
+				min = i;
+				}
+			}
+			}
+			if (min == -1) {
+			return null;
+			} else {
+			LogEntry e =  nexts[min];
+			nexts[min] = sources[min].next();
+			return e;
+			}
+		}
+
+		public void remove() throws UnsupportedOperationException {
+			throw new UnsupportedOperationException("remove not supported for Merged logs");
+		}
+
+		public void close() throws IOException {
+			for (LogIterator i : sources) {
+			i.close();
+			}
+		}
     }
 
     public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-	try {
-	    return iterator(starttime, endtime, null);
-	} catch (FilterException fe) {
-	    assert(false); // shouldn't happen without filter
-	    return null;
-	}
+		try {
+	    	return iterator(starttime, endtime, null);
+		}
+		catch (FilterException fe) {
+	    	assert(false); // shouldn't happen without filter
+	    	return null;
+		}
     }
 
     public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	// sanitise start and end times
-	if (endtime < starttime) {
-	    throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-	}
+		// sanitise start and end times
+		if (endtime < starttime) {
+			throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
+		}
 
-	return new MergedLogSourceIterator(this, starttime, endtime, filter);
-    }
+		return new MergedLogSourceIterator(this, starttime, endtime, filter);
+	}
 
-    public LogIterator iterator() throws IllegalArgumentException {
-	return iterator(starttime, endtime+1);
-    }
-    
-    public MergedLogSource(String[] files) throws IOException {
-	sources = new Vector<LogSource>();
-	for (String f : files) {
-	    addSource(f);
+	public LogIterator iterator() throws IllegalArgumentException {
+		return iterator(starttime, endtime+1);
 	}
+
+	public MergedLogSource(String[] files) throws IOException {
+		sources.clear();
+		for (String f : files) {
+			addSource(f);
+		}
     }
     
     public void addSource(String f) throws IOException {
-	LogSource s = null;
-	if (TxnLogSource.isTransactionFile(f)) {
-	    s = new TxnLogSource(f);
-	} else {
-	    s = new Log4JSource(f);
-	}
+		LogSource s = null;
+		if (TxnLogSource.isTransactionFile(f)) {
+			s = new TxnLogSource(f);
+		}
+		else {
+			s = new Log4JSource(f);
+		}
 
-	size += s.size();
-	endtime = s.getEndTime() > endtime ? s.getEndTime() : endtime;
-	starttime = s.getStartTime() < starttime || starttime == 0 ? s.getStartTime() : starttime;
-	sources.add(s);
+		size += s.size();
+		endtime = s.getEndTime() > endtime ? s.getEndTime() : endtime;
+		starttime = s.getStartTime() < starttime || starttime == 0 ? s.getStartTime() : starttime;
+		sources.add(s);
     }
 
     public String toString() {
-	String s = "MergedLogSource(size=" + size + ", start=" + starttime + ", end=" + endtime +")";
-	for (LogSource src : sources) {
-	    s += "\n\t- " +src;
-	}
-	return s;
+		String s = "MergedLogSource(size=" + size + ", start=" + starttime + ", end=" + endtime +")";
+		for (LogSource src : sources) {
+			s += "\n\t- " +src;
+		}
+		return s;
     }
 
     public static void main(String[] args) throws IOException {
-	System.out.println("Time: " + System.currentTimeMillis());
-	MergedLogSource s = new MergedLogSource(args);
-	System.out.println(s);
-
-	LogIterator iter;
-
-	iter = s.iterator();
-	System.out.println("Time: " + System.currentTimeMillis());
-	System.out.println("Iterator Size: " + iter.size());
-	System.out.println("Time: " + System.currentTimeMillis());
-	/*	while (iter.hasNext()) {
-	    System.out.println(iter.next());
-	    }*/
-	iter.close();
-	System.out.println("Time: " + System.currentTimeMillis());
+		System.out.println("Time: " + System.currentTimeMillis());
+		MergedLogSource s = new MergedLogSource(args);
+		System.out.println(s);
+
+		LogIterator iter;
+
+		iter = s.iterator();
+		System.out.println("Time: " + System.currentTimeMillis());
+		System.out.println("Iterator Size: " + iter.size());
+		System.out.println("Time: " + System.currentTimeMillis());
+		/*	while (iter.hasNext()) {
+			System.out.println(iter.next());
+			}*/
+		iter.close();
+		System.out.println("Time: " + System.currentTimeMillis());
     }
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
index 67e89454ab5..8717239011d 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
@@ -17,18 +17,10 @@
  */
 package org.apache.zookeeper.graph.servlets;
 
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
+import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 
 import org.apache.zookeeper.graph.*;
 
@@ -37,24 +29,22 @@ public class FileLoader extends JsonServlet
     private MergedLogSource source = null;
     
     public FileLoader(MergedLogSource src) throws Exception {
-	source = src;
+		source = src;
     }
 
-    String handleRequest(JsonRequest request) throws Exception
-    {
-	String output = "";
-		
-	String file = request.getString("path", "/");
-	JSONObject o = new JSONObject();
-	try {
-	    this.source.addSource(file);
-	    o.put("status", "OK");
-	
-	} catch (Exception e) {
-	    o.put("status", "ERR");
-	    o.put("error",  e.toString());
-	}
-	
-	return JSONValue.toJSONString(o);
+    String handleRequest(JsonRequest request) throws Exception {
+		String file = request.getString("path", "/");
+		ObjectMapper mapper = new ObjectMapper();
+		JsonNode rootNode = mapper.createObjectNode();
+		try {
+	    	this.source.addSource(file);
+			((ObjectNode) rootNode).put("status", "OK");
+		}
+		catch (Exception e) {
+			((ObjectNode) rootNode).put("status", "ERR");
+			((ObjectNode) rootNode).put("error", e.toString());
+		}
+		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(rootNode);
+		return jsonString;
     }
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
index e5b1a01339d..1e0139e2ba5 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
@@ -18,52 +18,56 @@
 package org.apache.zookeeper.graph.servlets;
 
 import java.io.File;
-import java.io.IOException;
 import java.io.FileNotFoundException;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
+import java.io.IOException;
 import java.util.Arrays;
 import java.util.Comparator;
 
 public class Fs extends JsonServlet
 {
-    String handleRequest(JsonRequest request) throws Exception
-    {
-	String output = "";
-	JSONArray filelist = new JSONArray();
-
-	File base = new File(request.getString("path", "/"));
-	if (!base.exists() || !base.isDirectory()) {
-	    throw new FileNotFoundException("Couldn't find [" + request + "]");
-	}
-	File[] files = base.listFiles();
-	Arrays.sort(files, new Comparator<File>() { 
-		public int compare(File o1, File o2) {
-		    if (o1.isDirectory() != o2.isDirectory()) {
-			if (o1.isDirectory()) {
-			    return -1;
-			} else {
-			    return 1;
+    String handleRequest(JsonRequest request) throws Exception {
+		File base = new File(request.getString("path", "/"));
+		if (!base.exists() || !base.isDirectory()) {
+			throw new FileNotFoundException("Couldn't find [" + request + "]");
+		}
+		File[] files = base.listFiles();
+		Arrays.sort(files, new Comparator<File>() {
+			public int compare(File o1, File o2) {
+				if (o1.isDirectory() != o2.isDirectory()) {
+				if (o1.isDirectory()) {
+					return -1;
+				} else {
+					return 1;
+				}
+				}
+				return o1.getName().compareToIgnoreCase(o2.getName());
 			}
-		    }
-		    return o1.getName().compareToIgnoreCase(o2.getName());
-		} 
-	    });
-	
-	for (File f : files) {
-	    JSONObject o = new JSONObject();
-	    o.put("file", f.getName());
-	    o.put("type", f.isDirectory() ? "D" : "F");
-	    o.put("path", f.getCanonicalPath());
-	    filelist.add(o);
-	}
-	return JSONValue.toJSONString(filelist);
+			});
+
+		String jsonString = generateJSON(files);
+		return jsonString;
     }
+
+    protected static String generateJSON(File[] files) throws IOException {
+		ObjectMapper mapper = new ObjectMapper();
+		ArrayNode fileList = mapper.createArrayNode();
+
+		for (File f : files) {
+			JsonNode node = mapper.createObjectNode().objectNode();
+			((ObjectNode) node).put("file", f.getName());
+			((ObjectNode) node).put("type", f.isDirectory() ? "D" : "F");
+			((ObjectNode) node).put("path", f.getCanonicalPath());
+			fileList.add(node);
+		}
+
+		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(fileList);
+		return jsonString;
+	}
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
index fc10eb1a3d6..7fb313561d5 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
@@ -17,22 +17,6 @@
  */
 package org.apache.zookeeper.graph.servlets;
 
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
 import org.apache.zookeeper.graph.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
index 910d44f4ede..4b3d63ce864 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
@@ -17,69 +17,78 @@
  */
 package org.apache.zookeeper.graph.servlets;
 
+import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import java.io.IOException;
-
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
 import java.util.Map;
 
 abstract public class JsonServlet extends HttpServlet {
     abstract String handleRequest(JsonRequest request) throws Exception;
 
     protected class JsonRequest {
-	private Map map;
+		private Map map;
+
+		public JsonRequest(ServletRequest request) {
+			map = request.getParameterMap();
+		}
+
+		public long getNumber(String name, long defaultnum) {
+			String[] vals = (String[])map.get(name);
+			if (vals == null || vals.length == 0) {
+			return defaultnum;
+			}
 
-	public JsonRequest(ServletRequest request) {
-	    map = request.getParameterMap();
-	}
-	
-	public long getNumber(String name, long defaultnum) {
-	    String[] vals = (String[])map.get(name);
-	    if (vals == null || vals.length == 0) {
-		return defaultnum;
-	    }
+			try {
+				return Long.valueOf(vals[0]);
+			}
+			catch (NumberFormatException e) {
+				return defaultnum;
+			}
+		}
 
-	    try {
-		return Long.valueOf(vals[0]);
-	    } catch (NumberFormatException e) {
-		return defaultnum;
-	    }
-	}
-	
-	public String getString(String name, String defaultstr) {
-	    String[] vals = (String[])map.get(name);
-	    if (vals == null || vals.length == 0) {
-		return defaultstr;
-	    } else {
-		return vals[0];
-	    }
-	}
+		public String getString(String name, String defaultstr) {
+			String[] vals = (String[])map.get(name);
+			if (vals == null || vals.length == 0) {
+			return defaultstr;
+			}
+			else {
+				return vals[0];
+			}
+		}
     }
 
-    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
-    {
+    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setContentType("text/plain;charset=utf-8");
         response.setStatus(HttpServletResponse.SC_OK);
-	
-	try {
-	    String req = request.getRequestURI().substring(request.getServletPath().length());
 
-	    response.getWriter().println(handleRequest(new JsonRequest(request)));
-	} catch (Exception e) {
-	    JSONObject o = new JSONObject();
-	    o.put("error", e.toString());
-	    response.getWriter().println(JSONValue.toJSONString(o));
-	} catch (java.lang.OutOfMemoryError oom) {
-	    JSONObject o = new JSONObject();
-	    o.put("error", "Out of memory. Perhaps you've requested too many logs. Try narrowing you're filter criteria.");
-	    response.getWriter().println(JSONValue.toJSONString(o));
-	}
+		try {
+			String req = request.getRequestURI().substring(request.getServletPath().length());
+
+			response.getWriter().println(handleRequest(new JsonRequest(request)));
+		}
+		catch (Exception e) {
+			ObjectMapper mapper = new ObjectMapper();
+			JsonNode rootNode = mapper.createObjectNode();
+			((ObjectNode) rootNode).put("error", e.toString());
+			String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(rootNode);
+
+			response.getWriter().println(jsonString);
+		}
+		catch (java.lang.OutOfMemoryError oom) {
+			ObjectMapper mapper = new ObjectMapper();
+			JsonNode rootNode = mapper.createObjectNode();
+			((ObjectNode) rootNode).put("error", "Out of memory. Perhaps you've requested too many logs. Try narrowing you're filter criteria.");
+			String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(rootNode);
+
+			response.getWriter().println(jsonString);
+		}
     }
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
index 5961a125832..564f11a18be 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
@@ -17,27 +17,14 @@
  */
 package org.apache.zookeeper.graph.servlets;
 
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-
+import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import org.apache.zookeeper.graph.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-
 public class NumEvents extends JsonServlet
 {
     private static final Logger LOG = LoggerFactory.getLogger(NumEvents.class);
@@ -46,43 +33,47 @@ public class NumEvents extends JsonServlet
     private LogSource source = null;
 
     public NumEvents(LogSource src) throws Exception {
-	this.source = src;
+		this.source = src;
     }
 
     String handleRequest(JsonRequest request) throws Exception {
-	String output = "";
+		String output = "";
+
+		long starttime = 0;
+		long endtime = 0;
+		long period = 0;
+
+		starttime = request.getNumber("start", 0);
+		endtime = request.getNumber("end", 0);
+		period = request.getNumber("period", 0);
+
+		if (starttime == 0) { starttime = source.getStartTime(); }
+		if (endtime == 0) {
+	 	   if (period > 0) {
+				endtime = starttime + period;
+	 	   }
+	 	   else {
+				endtime = source.getEndTime();
+	 	   }
+		}
+
+		long size = 0;
+		LogIterator iter = source.iterator(starttime, endtime);
+		size = iter.size();
 
-	long starttime = 0;
-	long endtime = 0;
-	long period = 0;
+		ObjectMapper mapper = new ObjectMapper();
+		JsonNode data = mapper.createObjectNode();
+		((ObjectNode) data).put("startTime", starttime);
+		((ObjectNode) data).put("endTime", endtime);
+		((ObjectNode) data).put("numEntries",  iter.size());
 
-	starttime = request.getNumber("start", 0);
-	endtime = request.getNumber("end", 0);
-	period = request.getNumber("period", 0);
+		if (LOG.isDebugEnabled()) {
+		    LOG.debug("handle(start= " + starttime + ", end=" + endtime + ", numEntries=" + size +")");
+		}
+		iter.close();
 
-	if (starttime == 0) { starttime = source.getStartTime(); }
-	if (endtime == 0) { 
-	    if (period > 0) {
-		endtime = starttime + period;
-	    } else {
-		endtime = source.getEndTime(); 
-	    }
-	}
-	
-	LogIterator iter = source.iterator(starttime, endtime);
-	JSONObject data = new JSONObject();
-	data.put("startTime", starttime);
-	data.put("endTime", endtime);
-	long size = 0;
-	
-	size = iter.size();
-	
-	data.put("numEntries",  size);
-	if (LOG.isDebugEnabled()) {
-	    LOG.debug("handle(start= " + starttime + ", end=" + endtime + ", numEntries=" + size +")");
-	}
-	iter.close();
-	return JSONValue.toJSONString(data);
+		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(data);
+		return jsonString;
     }
 }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
index 80ed1dc2fd1..022c68e0432 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
@@ -18,23 +18,14 @@
 package org.apache.zookeeper.graph.servlets;
 
 import java.io.IOException;
-import java.io.BufferedOutputStream;
-import java.io.FileOutputStream;
-import java.io.DataOutputStream;
-import java.io.PrintStream;
-
 import java.util.HashSet;
-import java.util.LinkedHashMap;
 import java.util.Set;
-
+import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import org.apache.zookeeper.graph.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
 
 public class Throughput extends JsonServlet
 {
@@ -45,82 +36,88 @@ public class Throughput extends JsonServlet
     private LogSource source = null;
 
     public Throughput(LogSource src) throws Exception {
-	this.source = src; 
+		this.source = src;
     }
 
     public String handleRequest(JsonRequest request) throws Exception {
-	long starttime = 0;
-	long endtime = 0;
-	long period = 0;
-	long scale = 0;
-	
-	starttime = request.getNumber("start", 0);
-	endtime = request.getNumber("end", 0);
-	period = request.getNumber("period", 0);
-	
-
-	if (starttime == 0) { starttime = source.getStartTime(); }
-	if (endtime == 0) { 
-	    if (period > 0) {
-		endtime = starttime + period;
-	    } else {
-		endtime = source.getEndTime(); 
-	    }
+		long startTime = 0;
+		long endTime = 0;
+		long period = 0;
+		long scale = 0;
+
+		startTime = request.getNumber("start", 0);
+		endTime = request.getNumber("end", 0);
+		period = request.getNumber("period", 0);
+
+
+		if (startTime == 0) { startTime = source.getStartTime(); }
+		if (endTime == 0) {
+			if (period > 0) {
+			endTime = startTime + period;
+			} else {
+			endTime = source.getEndTime();
+			}
+		}
+
+		String scalestr = request.getString("scale", "minutes");
+		if (scalestr.equals("seconds")) {
+			scale = MS_PER_SEC;
+		} else if (scalestr.equals("hours")) {
+			scale = MS_PER_HOUR;
+		} else {
+			scale = MS_PER_MIN;
+		}
+
+		LogIterator iter = source.iterator(startTime, endTime);
+		String jsonString = getJSON(iter, scale);
+		iter.close();
+		return jsonString;
 	}
-	
-	String scalestr = request.getString("scale", "minutes");
-	if (scalestr.equals("seconds")) {
-	    scale = MS_PER_SEC;
-	} else if (scalestr.equals("hours")) {
-	    scale = MS_PER_HOUR;
-	} else {
-	    scale = MS_PER_MIN;
-	} 	
-	
-	LogIterator iter = source.iterator(starttime, endtime);
-	
-	long current = 0;
-	long currentms = 0;
-	Set<Long> zxids_ms = new HashSet<Long>();
-	long zxidcount = 0;
-
-	JSONArray events = new JSONArray();
-	while (iter.hasNext()) {
-	    LogEntry e = iter.next();
-	    if (e.getType() != LogEntry.Type.TXN) {
-		continue;
-	    }
-
-	    TransactionEntry cxn = (TransactionEntry)e;
-	    
-	    long ms = cxn.getTimestamp();
-	    long inscale = ms/scale;
-
-	    if (currentms != ms && currentms != 0) {
-		zxidcount += zxids_ms.size();
-		zxids_ms.clear();
-	    }
-
-	    if (inscale != current && current != 0) {
-		JSONObject o = new JSONObject();
-		o.put("time", current*scale);
-		o.put("count", zxidcount);
-		events.add(o);
-		zxidcount = 0;
-	    }
-	    current = inscale;
-	    currentms = ms;
-
-	    zxids_ms.add(cxn.getZxid());
-	}
-	JSONObject o = new JSONObject();
-	o.put("time", current*scale);
-	o.put("count", zxidcount);
-	events.add(o);
-
-	iter.close();
-	
-	return JSONValue.toJSONString(events);
-    }
 
-};
+	protected String getJSON(final LogIterator iter, final long scale) throws IOException {
+		long current = 0;
+		long currentms = 0;
+		Set<Long> zxids_ms = new HashSet<Long>();
+		long zxidCount = 0;
+
+		ObjectMapper mapper = new ObjectMapper();
+		ArrayNode events = mapper.createArrayNode();
+
+		while (iter.hasNext()) {
+			LogEntry e = iter.next();
+			if (e.getType() != LogEntry.Type.TXN) {
+			continue;
+			}
+
+			TransactionEntry cxn = (TransactionEntry)e;
+
+			long ms = cxn.getTimestamp();
+			long inscale = ms/ scale;
+
+			if (currentms != ms && currentms != 0) {
+				zxidCount += zxids_ms.size();
+				zxids_ms.clear();
+			}
+
+			if (inscale != current && current != 0) {
+				JsonNode node = mapper.createObjectNode();
+				((ObjectNode) node).put("time", current * scale);
+				((ObjectNode) node).put("count", zxidCount);
+				events.add(node);
+				zxidCount = 0;
+			}
+			current = inscale;
+			currentms = ms;
+
+			zxids_ms.add(cxn.getZxid());
+		}
+
+		JsonNode node = mapper.createObjectNode();
+		((ObjectNode) node).put("time", current * scale);
+		((ObjectNode) node).put("count", zxidCount);
+		events.add(node);
+
+		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(events);
+		return jsonString;
+	}
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
index e04434ec53c..616ac66693c 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
@@ -20,10 +20,9 @@ make_canonical () {
 }
 
 SCRIPTDIR=`dirname $0`
-BUILDDIR=`make_canonical $SCRIPTDIR/../../../../../build/contrib/loggraph`
-LIBDIR=`make_canonical $BUILDDIR/lib`
+BUILDDIR=`make_canonical $SCRIPTDIR/../../../target/`
+LIBDIR=`make_canonical $BUILDDIR/../lib`
 WEBDIR=`make_canonical $SCRIPTDIR/../web`
-ZKDIR=`make_canonical $SCRIPTDIR/../../../../../build/`
 
 if [ ! -x $BUILDDIR ]; then
     echo "\n\n*** You need to build loggraph before running it ***\n\n";
@@ -34,10 +33,6 @@ for i in `ls $LIBDIR`; do
     CLASSPATH=$LIBDIR/$i:$CLASSPATH
 done
 
-for i in $ZKDIR/zookeeper-*.jar; do
-    CLASSPATH="$i:$CLASSPATH"
-done
-
 CLASSPATH=$BUILDDIR/classes:$WEBDIR:$CLASSPATH
 echo $CLASSPATH
 java -Dlog4j.configuration=org/apache/zookeeper/graph/log4j.properties -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
index 0259dc690d6..9b327432bd1 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
@@ -20,9 +20,8 @@ make_canonical () {
 }
 
 SCRIPTDIR=`dirname $0`
-BUILDDIR=`make_canonical $SCRIPTDIR/../../../../../build/contrib/loggraph`
-LIBDIR=`make_canonical $BUILDDIR/lib`
-ZKDIR=`make_canonical $SCRIPTDIR/../../../../../build/`
+BUILDDIR=`make_canonical $SCRIPTDIR/../../../target/`
+LIBDIR=`make_canonical $BUILDDIR/../lib`
 
 if [ ! -x $BUILDDIR ]; then
     echo "\n\n*** You need to build loggraph before running it ***\n\n";
@@ -37,10 +36,6 @@ for i in `ls $BUILDDIR/*.jar`; do
     CLASSPATH=$i:$CLASSPATH
 done
 
-for i in $ZKDIR/zookeeper-*.jar; do
-    CLASSPATH="$i:$CLASSPATH"
-done
-
 java -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
 
 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java
new file mode 100644
index 00000000000..0eb688c11dd
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java
@@ -0,0 +1,120 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.graph.servlets;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import org.apache.zookeeper.graph.FilterException;
+import org.apache.zookeeper.graph.FilterOp;
+import org.apache.zookeeper.graph.LogIterator;
+import org.apache.zookeeper.graph.LogSource;
+import org.apache.zookeeper.graph.MergedLogSource;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Assertions;
+import java.io.IOException;
+import java.util.List;
+
+public class FileLoaderTest {
+
+    @Test
+    public void testHandleRequestOK() throws Exception {
+        String[] files = {""};
+        MyMergedLogSource mls = new MyMergedLogSource(files);
+        final JsonServlet.JsonRequest jsonRequest = mock(JsonServlet.JsonRequest.class);
+        when(jsonRequest.getString("path", "/")).thenReturn("/tmp");
+        FileLoader fl = new FileLoader(mls);
+        String s = fl.handleRequest(jsonRequest);
+        Assertions.assertEquals("{\"status\":\"OK\"}", s);
+        Assertions.assertTrue(mls.getSources().contains(new MySource("/tmp")));
+        Assertions.assertFalse(mls.getSources().contains(new MySource("/tmp2")));
+    }
+
+    @Test
+    public void testHandleRequestERR() throws Exception {
+        String[] files = {""};
+        MyMergedLogSource mls = new MyMergedLogSource(files);
+        final JsonServlet.JsonRequest jsonRequest = mock(JsonServlet.JsonRequest.class);
+        when(jsonRequest.getString("path", "/")).thenReturn("/tmp3");
+        FileLoader fl = new FileLoader(mls);
+        String s = fl.handleRequest(jsonRequest);
+        Assertions.assertEquals("{\"status\":\"ERR\",\"error\":\"java.io.IOException: Message\"}", s);
+        Assertions.assertFalse(mls.getSources().contains(new MySource("/tmp")));
+        Assertions.assertFalse(mls.getSources().contains(new MySource("/tmp2")));
+    }
+
+    private class MyMergedLogSource extends MergedLogSource {
+        public MyMergedLogSource(String[] files) throws IOException {
+            super(files);
+        }
+        public void addSource(String f) throws IOException {
+            if ("/tmp3".equals(f)) throw new IOException("Message");
+            sources.add(new MySource(f));
+        }
+        public List<LogSource> getSources(){
+            return sources;
+        }
+    }
+
+    private class MySource implements LogSource{
+        private String file = null;
+        public MySource(String file) throws IOException {
+            this.file=file;
+        }
+
+        public boolean equals(Object o){
+            if(!(o instanceof MySource)) return false;
+            if(((MySource)o).file == null) return this.file==null;
+            return ((MySource)o).file.equals(this.file);
+        }
+
+        @Override
+        public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
+            return null;
+        }
+
+        @Override
+        public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
+            return null;
+        }
+
+        @Override
+        public LogIterator iterator() throws IllegalArgumentException {
+            return null;
+        }
+
+        @Override
+        public boolean overlapsRange(long starttime, long endtime) {
+            return false;
+        }
+
+        @Override
+        public long size() {
+            return 0;
+        }
+
+        @Override
+        public long getStartTime() {
+            return 0;
+        }
+
+        @Override
+        public long getEndTime() {
+            return 0;
+        }
+    }
+}
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java
new file mode 100644
index 00000000000..007c2915fbb
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java
@@ -0,0 +1,46 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.graph.servlets;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import java.io.File;
+import java.io.IOException;
+
+public class FsTest {
+    @Test
+    public void testGenerateJSON() throws IOException {
+        File[] files = new File[2];
+        final File file1 = mock(File.class);
+        when(file1.getName()).thenReturn("testDir");
+        when(file1.isDirectory()).thenReturn(true);
+        when(file1.getCanonicalPath()).thenReturn("/tmp/testDir");
+        final File file2 = mock(File.class);
+        when(file2.getName()).thenReturn("test");
+        when(file2.isDirectory()).thenReturn(false);
+        when(file2.getCanonicalPath()).thenReturn("/tmp/test");
+        files[0]=file1;
+        files[1]=file2;
+        String output = Fs.generateJSON(files);
+        String expectedOutput = "[{\"file\":\"testDir\",\"type\":\"D\",\"path\":\"/tmp/testDir\"}," +
+                "{\"file\":\"test\",\"type\":\"F\",\"path\":\"/tmp/test\"}]";
+        Assertions.assertEquals(expectedOutput, output);
+    }
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java
new file mode 100644
index 00000000000..f496868f730
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java
@@ -0,0 +1,88 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.graph.servlets;
+
+import static org.mockito.Mockito.mock;
+import org.apache.zookeeper.graph.FilterException;
+import org.apache.zookeeper.graph.Log4JEntry;
+import org.apache.zookeeper.graph.Log4JSource;
+import org.apache.zookeeper.graph.LogEntry;
+import org.apache.zookeeper.graph.LogIterator;
+import org.apache.zookeeper.graph.TransactionEntry;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.NoSuchElementException;
+
+public class ThroughputTest {
+
+    @Test
+    public void testGetJSON() throws Exception {
+        long scale = 1;
+        Log4JSource source = mock(Log4JSource.class);
+        Throughput tp = new Throughput(source);
+        LogIterator iter = new MyIterator();
+        String jsonString = tp.getJSON(iter, scale);
+        String expected = "[{\"time\":3,\"count\":1},{\"time\":4,\"count\":1},{\"time\":5,\"count\":0}]";
+        Assertions.assertEquals(expected, jsonString);
+    }
+
+    private class MyIterator implements LogIterator {
+        int index = 0;
+        List<LogEntry> list = new ArrayList<>();
+
+        public MyIterator() throws IllegalArgumentException, FilterException {
+            for(int i=1; i<3; i++){
+                long timestamp = i;
+                int node = i;
+                String entry = Integer.toString(i);
+                Log4JEntry le = new Log4JEntry(timestamp, node, entry);
+                list.add(le);
+            }
+            for(int i=3; i<7; i++){
+                long timestamp = i;
+                long clientId = i;
+                long Cxid = i;
+                long Zxid = i;
+                String op = Integer.toString(i);
+                TransactionEntry te = new TransactionEntry(timestamp, clientId, Cxid, Zxid, op);
+                list.add(te);
+            }
+        }
+
+        synchronized public long size() throws IOException {
+            return list.size();
+        }
+
+        public boolean hasNext() {
+            return index<list.size()-1;
+        }
+
+        public LogEntry next() throws NoSuchElementException {
+            return list.get(index++);
+        }
+
+        public void remove() throws UnsupportedOperationException {
+            throw new UnsupportedOperationException("remove not supported for L4J logs");
+        }
+
+        public void close(){}
+    }
+}
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 5dbc028d3d8..296083f26a1 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -93,11 +93,6 @@
       <artifactId>jackson-databind</artifactId>
       <scope>provided</scope>
     </dependency>
-    <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
-      <scope>provided</scope>
-    </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcprov-jdk15on</artifactId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
index 5fce206b53f..0e5ec868f35 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
+import com.fasterxml.jackson.core.io.JsonStringEncoder;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
@@ -36,7 +37,6 @@
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.util.ServiceUtils;
-import org.json.simple.JSONValue;
 
 /**
  * Dump a snapshot file to stdout.
@@ -181,14 +181,16 @@ private void printHex(String prefix, long value) {
     }
 
     private void printSnapshotJson(final DataTree dataTree) {
+        JsonStringEncoder encoder = JsonStringEncoder.getInstance();
         System.out.printf(
             "[1,0,{\"progname\":\"SnapshotFormatter.java\",\"progver\":\"0.01\",\"timestamp\":%d}",
             System.currentTimeMillis());
-        printZnodeJson(dataTree, "/");
+        printZnodeJson(dataTree, "/", encoder);
         System.out.print("]");
     }
 
-    private void printZnodeJson(final DataTree dataTree, final String fullPath) {
+    private void printZnodeJson(final DataTree dataTree, final String fullPath, JsonStringEncoder encoder) {
+
 
         final DataNode n = dataTree.getNode(fullPath);
 
@@ -209,7 +211,7 @@ private void printZnodeJson(final DataTree dataTree, final String fullPath) {
         }
         StringBuilder nodeSB = new StringBuilder();
         nodeSB.append("{");
-        nodeSB.append("\"name\":\"").append(JSONValue.escape(name)).append("\"").append(",");
+        nodeSB.append("\"name\":\"").append(encoder.quoteAsString(name)).append("\"").append(",");
         nodeSB.append("\"asize\":").append(dataLen).append(",");
         nodeSB.append("\"dsize\":").append(dataLen).append(",");
         nodeSB.append("\"dev\":").append(0).append(",");
@@ -223,7 +225,7 @@ private void printZnodeJson(final DataTree dataTree, final String fullPath) {
         if (children != null && children.size() > 0) {
             System.out.print("[" + nodeSB);
             for (String child : children) {
-                printZnodeJson(dataTree, fullPath + (fullPath.equals("/") ? "" : "/") + child);
+                printZnodeJson(dataTree, fullPath + (fullPath.equals("/") ? "" : "/") + child, encoder);
             }
             System.out.print("]");
         } else {
diff --git a/zookeeper-server/src/main/resources/LICENSE.txt b/zookeeper-server/src/main/resources/LICENSE.txt
index b1264c0ec4d..efa786f6378 100644
--- a/zookeeper-server/src/main/resources/LICENSE.txt
+++ b/zookeeper-server/src/main/resources/LICENSE.txt
@@ -214,10 +214,6 @@ This distribution bundles SLF4J 1.7.5, which is available under the MIT
 License. For details, see a copy of the license in
 lib/slf4j-1.7.5.LICENSE.txt
 
-This distribution bundles json-simple v1.1.1, which is available under the
-Apache Software License, Version 2.0. For details, see a copy of the license in
-lib/json-simple-1.1.1.LICENSE.txt
-
 This distribution bundles a modified version of 'JZLib' as part of
 Netty-3.7.0, which is available under the 3-clause BSD licence. For
 details, see a copy of the licence in META-INF/license/LICENSE-jzlib.txt
diff --git a/zookeeper-server/src/main/resources/lib/json-simple-1.1.1.LICENSE.txt b/zookeeper-server/src/main/resources/lib/json-simple-1.1.1.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/json-simple-1.1.1.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

From c4169b6f64b8a8668f2037adcf71148752d3066d Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Fri, 9 Oct 2020 13:07:15 +0000
Subject: [PATCH 096/591] ZOOKEEPER-3960: Update Programmers Guide about key
 file format parameters

The Programmer's guide doesn't contain the parameters needed to be changed in order to specify keystore and truststore file formats for the Java Clients.
see: https://zookeeper.apache.org/doc/r3.6.2/zookeeperProgrammers.html#sc_java_client_configuration

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1488 from symat/zookeeper-3960
---
 .../main/resources/markdown/zookeeperProgrammers.md    | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 68662f34db4..7c0d4ec1f40 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1320,6 +1320,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     this behavior by setting zookeeper.disableAutoWatchReset to **true**.
 
 * *zookeeper.client.secure* :
+    **New in 3.5.5:**
     If you want to connect to the server secure client port, you need to set this property to
     **true**
     on the client. This will connect to server using SSL with specified credentials. Note that
@@ -1337,13 +1338,22 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     on client.
 
 * *zookeeper.ssl.keyStore.location and zookeeper.ssl.keyStore.password* :
+    **New in 3.5.5:**
     Specifies the file path to a JKS containing the local credentials to be used for SSL connections,
     and the password to unlock the file.
 
 * *zookeeper.ssl.trustStore.location and zookeeper.ssl.trustStore.password* :
+    **New in 3.5.5:**
     Specifies the file path to a JKS containing the remote credentials to be used for SSL connections,
     and the password to unlock the file.
 
+* *zookeeper.ssl.keyStore.type* and *zookeeper.ssl.trustStore.type*:
+    **New in 3.5.5:**
+    Specifies the file format of keys/trust store files used to establish TLS connection to the ZooKeeper server. 
+    Values: JKS, PEM, PKCS12 or null (detect by filename). Default: null.
+    **New in 3.6.3, 3.7.0:**
+    The format BCFKS was added.
+
 * *jute.maxbuffer* :
     In the client side, it specifies the maximum size of the incoming data from the server. The default is 0xfffff(1048575) bytes,
     or just under 1M. This is really a sanity check. The ZooKeeper server is designed to store and send

From 3ca408d05c4cc2e038dced1065df844174ac69cf Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Fri, 9 Oct 2020 13:27:41 +0000
Subject: [PATCH 097/591] ZOOKEEPER-3962: Add an .asf.yaml file

Create an .asf.yaml file to specify certain github repository settings,
such as description, topic, URL, etc. and to configure notification
settings and JIRA integration.

This file can also be later used to add automation for building the
project's website, in whole or in part.

See https://cwiki.apache.org/confluence/display/INFRA/git+-+.asf.yaml+features
for more information on available features.

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1489 from ctubbsii/ZOOKEEPER-3962-add-asf-yaml
---
 .asf.yaml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .asf.yaml

diff --git a/.asf.yaml b/.asf.yaml
new file mode 100644
index 00000000000..48746033d66
--- /dev/null
+++ b/.asf.yaml
@@ -0,0 +1,39 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# https://cwiki.apache.org/confluence/display/INFRA/git+-+.asf.yaml+features
+
+github:
+  description: "Apache ZooKeeper"
+  homepage: https://zookeeper.apache.org
+  labels:
+    - zookeeper
+    - database
+    - hacktoberfest
+  features:
+    wiki: false
+    issues: false
+    projects: false
+
+notifications:
+  jira_options: link label worklog
+  commits: commits@zookeeper.apache.org
+  issues: issues@zookeeper.apache.org
+  pullrequests: notifications@zookeeper.apache.org
+

From 6b222fbca9da8795bbf71c7533e5da220831fe92 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 12 Oct 2020 06:40:18 +0000
Subject: [PATCH 098/591] ZOOKEEPER-3954: C client: GCC 10 compilation fixes

The in this PR avoids a confusing and scary compilation issue [encountered by Michael Hudson-Doyle](https://issues.apache.org/jira/browse/ZOOKEEPER-3954) when building the C client with GCC 10 and "aggressive" optimization settings:

> `free_auth_completions` is being inlined into `free_completions`, and this lets gcc see that members of `a_list` are being accessed without initialization

This is (fortunately!) a red herring: what GCC doesn't see is that, in practice, `zoo_lock_auth` always returns zero, and that `a_list` is always initialized in the conditional block which follows it.

That issue is easily "fixed" by removing the `if`.  The rest of the client code doesn't check `zoo_lock_auth`'s return value--and we have bigger issues if unconditional locks start failing anyway.

See also https://github.com/apache/zookeeper/pull/1481 and https://github.com/apache/zookeeper/pull/1486.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1487 from ztzg/ZOOKEEPER-3954-gcc10-compilation-fixes-master
---
 .../zookeeper-client-c/src/zookeeper.c        | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 1728c0ed7fd..1327816103c 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -1927,23 +1927,23 @@ void free_completions(zhandle_t *zh,int callCompletion,int reason)
             }
         }
     }
-    if (zoo_lock_auth(zh) == 0) {
-        a_list.completion = NULL;
-        a_list.next = NULL;
 
-        get_auth_completions(&zh->auth_h, &a_list);
-        zoo_unlock_auth(zh);
+    zoo_lock_auth(zh);
+    a_list.completion = NULL;
+    a_list.next = NULL;
+    get_auth_completions(&zh->auth_h, &a_list);
+    zoo_unlock_auth(zh);
 
-        a_tmp = &a_list;
-        // chain call user's completion function
-        while (a_tmp->completion != NULL) {
-            auth_completion = a_tmp->completion;
-            auth_completion(reason, a_tmp->auth_data);
-            a_tmp = a_tmp->next;
-            if (a_tmp == NULL)
-                break;
-        }
+    a_tmp = &a_list;
+    // chain call user's completion function
+    while (a_tmp->completion != NULL) {
+        auth_completion = a_tmp->completion;
+        auth_completion(reason, a_tmp->auth_data);
+        a_tmp = a_tmp->next;
+        if (a_tmp == NULL)
+            break;
     }
+
     free_auth_completion(&a_list);
 }
 

From 064d8f91ae95b05b65a0a897238d77d2ade941d2 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 12 Oct 2020 06:42:46 +0000
Subject: [PATCH 099/591] ZOOKEEPER-3951: C Client: Fix compilation with SASL
 disabled

The `sasl_client` field doesn't exist when configured without SASL.  Use an accessor outside of the blocks already guarded by `HAVE_CYRUS_SASL_H`.

(Reported by [Parag](https://issues.apache.org/jira/browse/ZOOKEEPER-3951).)

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1477 from ztzg/ZOOKEEPER-3951-no-sasl-compilation
---
 .../zookeeper-client-c/src/zookeeper.c           | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 1327816103c..2b881cb9fdd 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -332,6 +332,18 @@ static void zookeeper_set_sock_noblock(zhandle_t *, socket_t);
 static void zookeeper_set_sock_timeout(zhandle_t *, socket_t, int);
 static socket_t zookeeper_connect(zhandle_t *, struct sockaddr_storage *, socket_t);
 
+/*
+ * return 1 if zh has a SASL client configured, 0 otherwise.
+ */
+static int has_sasl_client(zhandle_t* zh)
+{
+#ifdef HAVE_CYRUS_SASL_H
+    return zh->sasl_client != NULL;
+#else /* !HAVE_CYRUS_SASL_H */
+    return 0;
+#endif /* HAVE_CYRUS_SASL_H */
+}
+
 /*
  * return 1 if zh has a SASL client performing authentication, 0 otherwise.
  */
@@ -2846,7 +2858,7 @@ static void finalize_session_establishment(zhandle_t *zh) {
     zh->input_buffer = 0; // just in case the watcher calls zookeeper_process() again
     PROCESS_SESSION_EVENT(zh, zh->state);
 
-    if (zh->sasl_client) {
+    if (has_sasl_client(zh)) {
         /* some packets might have been delayed during SASL negotiaton. */
         adaptor_send_queue(zh, 0);
     }
@@ -5077,7 +5089,7 @@ int zoo_add_auth(zhandle_t *zh,const char* scheme,const char* cert,
         // negotiation is planned.  (Such packets would be queued in
         // front of SASL packets, which is forbidden, and SASL
         // completion is followed by a 'send_auth_info' anyway.)
-        (zh->state == ZOO_ASSOCIATING_STATE && !zh->sasl_client)) {
+        (zh->state == ZOO_ASSOCIATING_STATE && !has_sasl_client(zh))) {
         return send_last_auth_info(zh);
     }
 

From 06405a8e67b2e86347f3b68b72cb9bfba0cd2b2a Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Mon, 12 Oct 2020 07:27:25 +0000
Subject: [PATCH 100/591] ZOOKEEPER-3808: fix the documentation about
 digest.enabled

The digest.enabled is true by default, not false (as the admin guide suggested before)

The digest feature was added to detect the data inconsistency inside ZooKeeper when
loading database from disk, catching up and following leader.

This fix is needed on master and branch-3.6. (the feature was not available in 3.5)

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1496 from symat/ZOOKEEPER-3808
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index afb6bc47aa9..2150c5ac2e4 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1089,7 +1089,7 @@ property, when available, is noted below.
     due to the potential inconsistency in the /zookeeper/quota stat node,
     we can include that after that issue is fixed.
 
-    By default, this feautre is disabled, set "true" to enable it.
+    By default, this feature is enabled, set "false" to disable it.
 
 * *snapshot.trust.empty* :
     (Java system property: **zookeeper.snapshot.trust.empty**)

From fae62f521a5cf36e2d35f5646aa34d2ed3ae3415 Mon Sep 17 00:00:00 2001
From: championquizzer <joydeep09@gmail.com>
Date: Mon, 12 Oct 2020 12:59:11 +0200
Subject: [PATCH 101/591] ZOOKEEPER-3955: added a shebang or a 'shell'
 directive to lastRevision.sh

1. Added the shebang
2. Added $(...) notation instead of legacy backticked `...`
3. Added double quote to prevent globbing and word splitting

Author: championquizzer <joydeep09@gmail.com>

Reviewers: eolivelli@apache.org, andor@apache.org

Closes #1472 from championquizzer/newbranch
---
 zookeeper-server/src/main/resources/lastRevision.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/resources/lastRevision.sh b/zookeeper-server/src/main/resources/lastRevision.sh
index 0690c7da916..ec1678498f5 100755
--- a/zookeeper-server/src/main/resources/lastRevision.sh
+++ b/zookeeper-server/src/main/resources/lastRevision.sh
@@ -1,3 +1,4 @@
+#!/bin/sh
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -16,6 +17,6 @@
 
 # Find the current revision, store it in a file
 FILE=$1
-LASTREV=`git rev-parse HEAD`
+LASTREV=$(git rev-parse HEAD)
 
-echo "lastRevision=${LASTREV}" > $FILE
+echo "lastRevision=${LASTREV}" > "$FILE"

From 697ec978104c5b6811923f544392f27df2806723 Mon Sep 17 00:00:00 2001
From: dengliming <liming.d.pro@gmail.com>
Date: Mon, 12 Oct 2020 15:04:12 +0200
Subject: [PATCH 102/591] Remove deprecated sudo setting on Travis

[Travis are now recommending removing the sudo tag.](https://blog.travis-ci.com/2018-11-19-required-linux-infrastructure-migration)

_"If you currently specify sudo: false in your .travis.yml, we recommend removing that configuration"_

Author: dengliming <liming.d.pro@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <anmolnar@apache.org>

Closes #1351 from dengliming/patch-1
---
 .travis.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 7f320b9e005..8fbd9314369 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,5 +1,4 @@
 language: java
-sudo: false
 
 matrix:
   include:

From 4432f5b44359f56007f1ea5be5de2a9829c97e5c Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Tue, 13 Oct 2020 14:43:12 +0200
Subject: [PATCH 103/591] ZOOKEEPER-3948: Introduce a deterministic runtime
 behavior injection framework for ZooKeeperServer testing.

We'd like to understand how applications built on top of ZooKeeper behave under various faulty conditions, which is important to build resilient end to end solutions and avoid ZooKeeper being single point of failure. We'd also like to achieve this in both unit tests (in process) and integration tests (in and out of process). Traditional methods of using external fault injection mechanisms are non deterministic and requires non trivial set up and hard to integrate with unit tests, so here we introduce the ZooKeeperController service which solves both.

The basic idea here is to create a controllable ZooKeeperServer which accepts various control commands (such as - delay request, drop request, eat request, expire session, shutdown, trigger leader election, and so on), and reacting based on incoming commands. The controllable server and production server share the same underlying machineries (quorum peers, ZooKeeper server, etc) but code paths are separate, thus this feature has no production impact.

This controller system is currently composed of following pieces:

CommandClient: a convenient HTTP client to send control commands to controller service.
CommandListener: an embed HTTP server listening incoming commands and dispatch to controller service.
Controller Service: the service that's responsible to create controllable ZK server and the controller.
ZooKeeperServerController: the controller that changes the behavior of ZK server runtime.
Controllable Cnx / Factory: controllable connection that accept behavior change requests.
In future more control commands and controllable components can be added on top of this framework.

This can be used in either unit tests / integration tests as an in process embedded controllable ZooKeeper server, or as an out of process stand alone controllable ZooKeeper process.

Author: Michael Han <hanm@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1467 from hanm/ZOOKEEPER-3948
---
 pom.xml                                       |   5 +
 zookeeper-server/pom.xml                      |   5 +
 .../zookeeper/server/NIOServerCnxn.java       |   4 +-
 .../server/NIOServerCnxnFactory.java          |   2 +-
 .../server/controller/CommandClient.java      | 131 ++++++
 .../server/controller/CommandListener.java    |  96 +++++
 .../server/controller/ControlCommand.java     | 122 ++++++
 .../controller/ControllableConnection.java    |  81 ++++
 .../ControllableConnectionFactory.java        | 125 ++++++
 .../controller/ControllerServerConfig.java    | 156 +++++++
 .../server/controller/ControllerService.java  | 167 ++++++++
 .../controller/ZooKeeperServerController.java | 168 ++++++++
 .../zookeeper/server/quorum/QuorumPeer.java   |  62 +++
 .../server/controller/ControlCommandTest.java |  85 ++++
 .../ControllerClientServerTest.java           | 109 +++++
 .../controller/ControllerConfigTest.java      | 150 +++++++
 .../server/controller/ControllerTestBase.java |  78 ++++
 ...ZooKeeperServerControllerEndToEndTest.java | 384 ++++++++++++++++++
 18 files changed, 1927 insertions(+), 3 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java

diff --git a/pom.xml b/pom.xml
index 066b88656f1..031e67f0a4b 100755
--- a/pom.xml
+++ b/pom.xml
@@ -601,6 +601,11 @@
         <artifactId>jetty-servlet</artifactId>
         <version>${jetty.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-client</artifactId>
+        <version>${jetty.version}</version>
+      </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-core</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 296083f26a1..68155fde083 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -88,6 +88,11 @@
       <artifactId>jetty-servlet</artifactId>
       <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-client</artifactId>
+      <scope>provided</scope>
+    </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index f967fffe974..fd29aef59da 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -69,7 +69,7 @@ public class NIOServerCnxn extends ServerCnxn {
 
     private final ByteBuffer lenBuffer = ByteBuffer.allocate(4);
 
-    private ByteBuffer incomingBuffer = lenBuffer;
+    protected ByteBuffer incomingBuffer = lenBuffer;
 
     private final Queue<ByteBuffer> outgoingBuffers = new LinkedBlockingQueue<ByteBuffer>();
 
@@ -381,7 +381,7 @@ void doIO(SelectionKey k) throws InterruptedException {
         }
     }
 
-    private void readRequest() throws IOException {
+    protected void readRequest() throws IOException {
         zkServer.processPacket(this, incomingBuffer);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index 17fa3622d50..57495c10aa4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -315,7 +315,7 @@ private boolean doAccept() {
      * If there is no worker thread pool, the SelectorThread performs the I/O
      * directly.
      */
-    class SelectorThread extends AbstractSelectThread {
+    public class SelectorThread extends AbstractSelectThread {
 
         private final int id;
         private final Queue<SocketChannel> acceptedQueue;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java
new file mode 100644
index 00000000000..632ece8e987
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java
@@ -0,0 +1,131 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.TimeUnit;
+import org.eclipse.jetty.client.HttpClient;
+import org.eclipse.jetty.client.api.ContentResponse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A convenient helper to send controller command to ControllerService.
+ */
+public class CommandClient {
+    private final int requestTimeoutInMs;
+    private static final int DEFAULT_TIMEOUT = 10000;
+    private static final Logger LOG = LoggerFactory.getLogger(CommandClient.class);
+    private final int hostPort;
+    private final String hostName;
+    private HttpClient client;
+    private boolean started = false;
+
+    /**
+     * Instantiate a client configured to send requests to localhost.
+     * @param localHostPort Port that the localhost CommandListener is listening on.
+     * @param requestTimeoutInMs Timeout in ms for synchronous requests to timeout.
+     */
+    public CommandClient(int localHostPort, int requestTimeoutInMs) {
+        this.client = new HttpClient();
+        this.requestTimeoutInMs = requestTimeoutInMs;
+        this.hostName = "localhost";
+        this.hostPort = localHostPort;
+    }
+
+    /**
+     * Instantiate a client configured to send requests to the specified host address.
+     * @param  hostAddress The host address of the listening server.
+     * @param  requestTimeoutInMs Timeout in ms for synchronous requests to timeout.
+     */
+    public CommandClient(InetSocketAddress hostAddress, int requestTimeoutInMs) {
+        this.client = new HttpClient();
+        this.requestTimeoutInMs = requestTimeoutInMs;
+        this.hostName = hostAddress.getHostName();
+        this.hostPort = hostAddress.getPort();
+    }
+
+    public CommandClient(int localhostPort) {
+        this(localhostPort, DEFAULT_TIMEOUT);
+    }
+
+    public synchronized void close() {
+        try {
+            if (client != null) {
+                client.stop();
+                client = null;
+            }
+        } catch (Exception ex) {
+            LOG.warn("Exception during shutdown", ex);
+        }
+    }
+
+    /**
+     * Send a command with no parameters to the server and wait for a response.
+     * Returns true if we received a good (200) response and false otherwise.
+     */
+    public boolean trySendCommand(ControlCommand.Action action) {
+        return trySendCommand(action, null);
+    }
+
+    /**
+     * Send a command with an optional command parameter to the server and wait for a response.
+     * @param action The command Action to send.
+     * @param commandParameter The command parameter, in the form of command/action/parameter.
+     * @return true if we received a good (200) response and false otherwise.
+     */
+    public boolean trySendCommand(ControlCommand.Action action, String commandParameter)  {
+        try {
+            if (!started) {
+                client.start();
+                started = true;
+            }
+            ContentResponse response = sendCommand(action, commandParameter);
+            LOG.info("Received {} response from the server", response);
+            return (response.getStatus() == 200);
+        } catch (InterruptedException | IOException ex) {
+            LOG.warn("Failed to get response from server", ex);
+        } catch (Exception ex) {
+            LOG.error("Unknown exception when sending command", ex);
+        }
+
+        return false;
+    }
+
+    /**
+     * Send a command and optional command parameter to the server and block until receiving
+     * a response.
+     *
+     * @param action The command Action to send.
+     * @param commandParameter The command parameter, in the form of command/action/parameter.
+     * @return The full response body from the CommandListener server.
+     */
+    public ContentResponse sendCommand(ControlCommand.Action action,
+                                       String commandParameter) throws Exception {
+        String command = String.format("%s%s:%s/%s", "http://",
+            this.hostName, this.hostPort, ControlCommand.createCommandUri(action, commandParameter));
+        ContentResponse response = this.client.newRequest(command).timeout(this.requestTimeoutInMs,
+            TimeUnit.MILLISECONDS).send();
+        LOG.info("Sent command {}", command);
+        LOG.info("Response body {}", new String(response.getContent(), StandardCharsets.UTF_8));
+        return response;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java
new file mode 100644
index 00000000000..3f5bb62ffe8
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java
@@ -0,0 +1,96 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.eclipse.jetty.server.Request;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.handler.AbstractHandler;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * An HTTP server listening to incoming controller commands sent from CommandClient (or any of your favorite REST client
+ * ) and dispatching the command to the ZooKeeperServerController for execution.
+ */
+public class CommandListener {
+    private static final Logger LOG = LoggerFactory.getLogger(CommandListener.class);
+
+    private ZooKeeperServerController controller;
+    private Server server;
+
+    public CommandListener(ZooKeeperServerController controller, ControllerServerConfig config) {
+        try {
+            this.controller = controller;
+
+            String host = config.getControllerAddress().getHostName();
+            int port = config.getControllerAddress().getPort();
+
+            server = new Server(port);
+            LOG.info("CommandListener server host: {} with port: {}", host, port);
+            server.setHandler(new CommandHandler());
+            server.start();
+        } catch (Exception ex) {
+            LOG.error("Failed to instantiate CommandListener.", ex);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
+    }
+
+    public void close() {
+        try {
+            if (server != null) {
+                server.stop();
+                server = null;
+            }
+        } catch (Exception ex) {
+            LOG.warn("Exception during shutdown CommandListener server", ex);
+        }
+    }
+
+    private class CommandHandler extends AbstractHandler {
+        @Override
+        public void handle(String target, Request baseRequest, HttpServletRequest request, HttpServletResponse response)
+                throws IOException {
+            // Extract command string from request path. Remove leading '/'.
+            String commandStr = request.getPathInfo().substring(1);
+            int responseCode;
+            response.setContentType("text/html;charset=utf-8");
+
+            try {
+                ControlCommand command = ControlCommand.parseUri(commandStr);
+                controller.processCommand(command);
+                baseRequest.setHandled(true);
+                responseCode = HttpServletResponse.SC_OK;
+            } catch (IllegalArgumentException ex) {
+                LOG.error("Bad argument or command", ex);
+                responseCode = HttpServletResponse.SC_BAD_REQUEST;
+            } catch (Exception ex) {
+                LOG.error("Failed processing the request", ex);
+                throw ex;
+            }
+            response.setStatus(responseCode);
+            response.getWriter().println(commandStr);
+            LOG.info("CommandListener processed command {} with response code {}", commandStr, responseCode);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java
new file mode 100644
index 00000000000..8454daa37bc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java
@@ -0,0 +1,122 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+/**
+ * Set of commands that this controller can execute. Commands are comprised
+ * of an action and an optional parameter specific to that action.
+ */
+public class ControlCommand {
+    /**
+     * Actions available to the controller
+      */
+    public enum Action {
+        // Simple "are you there" ping to confirm the controller is up and running.
+        PING,
+        // Shutdown everything, including CommandListener, ControllerService, Controller and the ZooKeeperServer.
+        SHUTDOWN,
+        // Close a connection triggering a client disconnect (and then reconnect attempt).
+        // No parameter indicates close all connections. Optional parameter indicates a specific session id (as long).
+        CLOSECONNECTION,
+        // More actions go here in the future (force drop sessions, etc).
+        EXPIRESESSION,
+        // Reject all future connections. No parameter required.
+        REJECTCONNECTIONS,
+        // Add latency to server replies.
+        // Optional parameter indicates time in milliseconds to delay
+        // (default = 1 second).
+        ADDDELAY,
+        // Fail requests.
+        // Optional parameter indicates how many requests to fail.
+        // (default = all requests until RESET).
+        FAILREQUESTS,
+        // Process requests but do not send a response.
+        // Optional parameter indicates how many requests to fail.
+        // (default = all requests until RESET).
+        NORESPONSE,
+        // No parameter indicates fail all requests.
+        // Optional parameter indicates undo all the chaotic action commands
+        // (reject connections, add delay, fail requests, eat requests and so on...).
+        RESET,
+        // Force the quorum to elect a new leader.
+        ELECTNEWLEADER,
+        // More actions go here in the future...
+    }
+
+    public static final String ENDPOINT = "command";
+    public static final String ENDPOINT_PREFIX = ENDPOINT + "/";
+
+    private Action action;
+    public Action getAction() {
+        return action;
+    }
+
+    private String parameter;
+    protected String getParameter() {
+        return parameter;
+    }
+
+    public ControlCommand(Action action) {
+        this(action, null);
+    }
+
+    public ControlCommand(Action action, String param) {
+        this.action = action;
+        this.parameter = param;
+    }
+
+    /**
+     * Create a REST command uri.
+     * @param action The 'verb' of the command.
+     * @param parameter The optional parameter.
+     * @return A string to send to the server as the end of the Uri.
+     */
+    public static String createCommandUri(Action action, String parameter) {
+        return ENDPOINT_PREFIX + action.toString() + (parameter != null && !parameter.isEmpty() ? "/" + parameter : "");
+    }
+
+    /**
+     * Parse a Uri into the required Command action and parameter.
+     * @param commandUri the properly formatted Uri.
+     */
+    public static ControlCommand parseUri(String commandUri) {
+        if (commandUri == null) {
+            throw new IllegalArgumentException("commandUri can't be null.");
+        }
+
+        if (!commandUri.startsWith(ENDPOINT_PREFIX)) {
+            throw new IllegalArgumentException("Missing required prefix: " + ENDPOINT_PREFIX);
+        }
+
+        String uri = commandUri.substring(ENDPOINT_PREFIX.length());
+        String name;
+        String param;
+
+        int separatorIndex = uri.indexOf('/');
+        if (separatorIndex < 0) {
+            name = uri;
+            param = null;
+        } else {
+            name = uri.substring(0, separatorIndex);
+            param = uri.substring(separatorIndex + 1);
+        }
+
+        return new ControlCommand(Action.valueOf(name.toUpperCase()), param);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java
new file mode 100644
index 00000000000..2238f35bf11
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java
@@ -0,0 +1,81 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.channels.SelectionKey;
+import java.nio.channels.SocketChannel;
+import org.apache.jute.BinaryInputArchive;
+import org.apache.jute.Record;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
+import org.apache.zookeeper.server.ByteBufferInputStream;
+import org.apache.zookeeper.server.NIOServerCnxn;
+import org.apache.zookeeper.server.NIOServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Extension of NIOServerCnxn which can inject changes per controller commands.
+ * Similar extensions can implement on top of NettyServerCnxn as well.
+ */
+@SuppressFBWarnings(value = "BC_UNCONFIRMED_CAST", justification = "factory is ControllableConnectionFactory type.")
+public class ControllableConnection extends NIOServerCnxn {
+    private static final Logger LOG = LoggerFactory.getLogger(ControllableConnection.class);
+    private final ControllableConnectionFactory controller;
+
+    public ControllableConnection(ZooKeeperServer zk, SocketChannel sock, SelectionKey sk, NIOServerCnxnFactory factory,
+                                  NIOServerCnxnFactory.SelectorThread selectorThread) throws IOException {
+        super(zk, sock, sk, factory, selectorThread);
+        controller = (ControllableConnectionFactory) factory;
+    }
+
+    @Override
+    public int sendResponse(ReplyHeader header, Record record, String tag) {
+        if (controller.shouldSendResponse()) {
+            try {
+                return super.sendResponse(header, record, tag);
+            } catch (IOException ex) {
+                LOG.warn("IO Exception occurred", ex);
+            }
+        } else {
+            LOG.warn("Controller is configured to NOT sending response back to client.");
+        }
+        return -1;
+    }
+
+    @Override
+    protected void readRequest() throws IOException {
+        if (controller.shouldFailNextRequest()) {
+            ByteBuffer buffer = incomingBuffer.slice();
+            BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(buffer));
+            RequestHeader h = new RequestHeader();
+            h.deserialize(bia, "header");
+            super.sendResponse(new ReplyHeader(h.getXid(), 0, KeeperException.Code.APIERROR.intValue()),
+                    null, null);
+        } else {
+            controller.delayRequestIfNeeded();
+            super.readRequest();
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java
new file mode 100644
index 00000000000..15d9d610768
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java
@@ -0,0 +1,125 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import java.nio.channels.SelectionKey;
+import java.nio.channels.SocketChannel;
+import org.apache.zookeeper.server.NIOServerCnxn;
+import org.apache.zookeeper.server.NIOServerCnxnFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Extension of NIOServerCnxnFactory which can inject changes per controller commands.
+ * Similar extensions can implement on top of NettyServerCnxnFactory as well.
+ */
+@SuppressFBWarnings(value = "SWL_SLEEP_WITH_LOCK_HELD", justification = "no dead lock")
+public class ControllableConnectionFactory extends NIOServerCnxnFactory {
+    private static final Logger LOG = LoggerFactory.getLogger(ControllableConnectionFactory.class);
+    private long responseDelayInMs = 0;
+    private long remainingRequestsToFail = 0;
+    private long remainingResponsesToHold = 0;
+
+    public ControllableConnectionFactory() {
+    }
+
+    @Override
+    protected NIOServerCnxn createConnection(SocketChannel sock, SelectionKey sk, SelectorThread selectorThread)
+            throws IOException {
+        return new ControllableConnection(zkServer, sock, sk, this, selectorThread);
+    }
+
+    /**
+     * Called by the connection to delay processing requests from the client.
+    */
+    public synchronized void delayRequestIfNeeded() {
+        try {
+            if (responseDelayInMs > 0) {
+                Thread.sleep(responseDelayInMs);
+            }
+        } catch (InterruptedException ex) {
+            LOG.warn("Interrupted while delaying requests", ex);
+        }
+    }
+
+    /**
+     * Check if we should fail the next incoming request.
+     * If so, decrement the remaining requests to fail.
+    */
+    public synchronized boolean shouldFailNextRequest() {
+        if (remainingRequestsToFail == 0) {
+            return false;
+        }
+
+        // Value < 0 indicates fail all requests.
+        if (remainingRequestsToFail > 0) {
+            remainingRequestsToFail--;
+        }
+
+        return true;
+    }
+
+    /**
+     * Check if we should send a response to the latest processed request (true),
+     * or eat the response to mess with the client (false).
+     * If so, decrement the remaining requests to eat.
+    */
+    public synchronized boolean shouldSendResponse() {
+        if (remainingResponsesToHold == 0) {
+            return true;
+        }
+
+        // Value < 0 indicates hold all the responses.
+        if (remainingResponsesToHold > 0) {
+            remainingResponsesToHold--;
+        }
+        return false;
+    }
+
+    public synchronized void delayResponses(long delayInMs) {
+        if (delayInMs < 0) {
+            throw new IllegalArgumentException("delay must be non-negative");
+        }
+        responseDelayInMs = delayInMs;
+    }
+
+    public synchronized void resetBadBehavior() {
+        responseDelayInMs = 0;
+        remainingRequestsToFail = 0;
+        remainingResponsesToHold = 0;
+    }
+
+    public synchronized void failAllFutureRequests() {
+        this.remainingRequestsToFail = -1;
+    }
+
+    public synchronized void failFutureRequests(long requestsToFail) {
+        this.remainingRequestsToFail = requestsToFail;
+    }
+
+    public synchronized void holdAllFutureResponses() {
+        this.remainingResponsesToHold = -1;
+    }
+
+    public synchronized void holdFutureResponses(long requestsToHold) {
+        this.remainingResponsesToHold = requestsToHold;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
new file mode 100644
index 00000000000..bbdc14f9ac0
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
@@ -0,0 +1,156 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.ServerSocket;
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+
+/**
+ * Config for the ControllerService. Responsible for providing the minimum set of configurations
+ * that's required to spin up a single member ensemble.
+ */
+public class ControllerServerConfig extends QuorumPeerConfig {
+    public static final String CONTROLLER_PORT_KEY = "zookeeper.controllerPort";
+    public static final String CLIENT_PORT_KEY = "zookeeper.clientPortAddress";
+    private InetSocketAddress controllerAddress;
+    public InetSocketAddress getControllerAddress() {
+        return controllerAddress;
+    }
+
+    /**
+     * Instantiate a new config via a zk config file.
+     * @param configFile path to the configuration file
+     * @throws ConfigException
+     */
+    public ControllerServerConfig(String configFile) throws ConfigException {
+        parse(configFile);
+    }
+
+    /**
+     * Instantiate a config object with required parameters.
+     * @param hostAddress The address to bind to (likely loopback or localhost)
+     * @param controllerPort Port the controller will listen for incoming control command sent from CommandClient.
+     * @param zkServerPort Port the ZooKeeper server will listen on.
+     * @param dataDirPath Path to the data directory that ZooKeeperServer uses.
+     */
+    public ControllerServerConfig(InetAddress hostAddress, int controllerPort, int zkServerPort, String dataDirPath) {
+        controllerAddress = new InetSocketAddress(hostAddress, controllerPort);
+        clientPortAddress = new InetSocketAddress(hostAddress, zkServerPort);
+        dataDir = new File(dataDirPath);
+        dataLogDir = dataDir;
+        serverId = 0;
+    }
+
+    /**
+     * Instantiate a config object with required parameters.
+     * @param controllerPort Port the controller will listen for incoming control command sent from CommandClient.
+     * @param zkServerPort Port the ZooKeeper server will listen on.
+     * @param dataDirPath Path to the data directory that ZooKeeperServer uses.
+     */
+    public ControllerServerConfig(int controllerPort, int zkServerPort, String dataDirPath) {
+        this(InetAddress.getLoopbackAddress(), controllerPort, zkServerPort, dataDirPath);
+    }
+
+    public ServerConfig getZooKeeperServerConfig() {
+        ServerConfig serverConfig = new ServerConfig();
+        serverConfig.readFrom(this);
+        return serverConfig;
+    }
+
+    @Override
+    public void parse(String configFile) throws ConfigException {
+        super.parse(configFile);
+        for (String key : System.getProperties().stringPropertyNames()) {
+            if (CONTROLLER_PORT_KEY.equalsIgnoreCase(key)) {
+                setControllerAddress(System.getProperty(key));
+            }
+            if (CLIENT_PORT_KEY.equals(key)) {
+                setClientAddress(System.getProperty(key));
+            }
+        }
+
+        if (controllerAddress == null) {
+            throw new ConfigException("Missing required parameter " + CONTROLLER_PORT_KEY);
+        }
+
+        if (clientPortAddress == null) {
+            throw new ConfigException("Missing required parameter " + CLIENT_PORT_KEY);
+        }
+    }
+
+    private void setControllerAddress(String port) {
+        try {
+            controllerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), Integer.parseInt(port));
+        } catch (NumberFormatException ex) {
+            throw new IllegalArgumentException("Invalid port", ex);
+        }
+    }
+
+    private void setClientAddress(String port) {
+        try {
+            clientPortAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), Integer.parseInt(port));
+        } catch (NumberFormatException ex) {
+            throw new IllegalArgumentException("Invalid port", ex);
+        }
+    }
+
+    /**
+     * Ensure config is acceptable by filling in default values for any missing quorum configuration
+     * (specifically in the case of a single machine ensemble)
+     *
+     * @throws IOException
+     */
+    public void ensureComplete() throws IOException {
+        if (this.quorumVerifier != null && this.quorumVerifier.getAllMembers().size() > 0) {
+            return;
+        }
+
+        // QuorumPeer requires a QuorumVerifier.
+        // We will use majority strategy with only this host in the quorum.
+        // We need to provide 2 more ports: one for elections and one for quorum communications.
+        // We will also mark this host as the leader.
+        ServerSocket randomSocket1 = new ServerSocket(0);
+        int quorumPort = randomSocket1.getLocalPort();
+
+        ServerSocket randomSocket2 = new ServerSocket(0);
+        int electionPort = randomSocket2.getLocalPort();
+
+        randomSocket1.close();
+        randomSocket2.close();
+
+        QuorumPeer.QuorumServer selfAsPeer = new QuorumPeer.QuorumServer(
+                0,
+                new InetSocketAddress(quorumPort),
+                new InetSocketAddress(electionPort),
+                this.clientPortAddress
+        );
+        Map<Long, QuorumPeer.QuorumServer> peers = new HashMap<>();
+        peers.put(selfAsPeer.id, selfAsPeer);
+        this.quorumVerifier = new QuorumMaj(peers);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
new file mode 100644
index 00000000000..8d71984f5b0
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
@@ -0,0 +1,167 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Main class which starts a ZooKeeperServer, a ZooKeeperServerController and the ControllerService.
+ * Tests should either invoke this class as the main target of a new JVM process OR explicitly
+ * start and stop a singleton of this class in their test process.
+ */
+public class ControllerService {
+    private static final Logger LOG = LoggerFactory.getLogger(ControllerService.class);
+
+    private ZooKeeperServerController controller;
+    private CommandListener listener;
+
+    protected QuorumPeerConfig config;
+    private ServerCnxnFactory serverCnxnFactory = null;
+    protected QuorumPeer quorumPeer = null;
+
+    /**
+     * Starts the ControllerService as a stand alone app. Useful for out of process testing
+     * - such as during integration testing.
+     */
+    public static void main(String[] args) {
+        ControllerServerConfig config;
+        try {
+            if (args.length != 1) {
+                throw new IllegalArgumentException("Require config file as cmd line argument");
+            } else {
+                config = new ControllerServerConfig(args[0]);
+            }
+            new ControllerService().start(config);
+        } catch (Exception ex) {
+            System.err.println(ex.getMessage());
+            System.err.println("Usage: TestControllerMain controller-port configfile");
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
+    }
+
+    /**
+     * Starts a new thread to run the controller (useful when this service is hosted in process
+     * - such as during unit testing).
+     */
+    public Thread start(ControllerServerConfig controllerConfig) {
+        this.config = controllerConfig;
+        final ControllerService svc = this;
+
+        Thread runner = new Thread(() -> {
+            try {
+                svc.run();
+            } catch (Exception e) {
+            }
+        });
+        runner.setDaemon(true);
+        runner.start();
+        return runner;
+    }
+
+    public synchronized void shutdown() {
+        if (listener != null) {
+            listener.close();
+            listener = null;
+        }
+
+        if (controller != null) {
+            controller.shutdown();
+            controller = null;
+        }
+    }
+
+    /**
+     * Initializes an instance of the ZooKeeperServer, the ZooKeeperServerController, and a new
+     * Http listener (CommandListener) for the controller.
+     */
+    protected void initService() throws IOException {
+        ControllerServerConfig controllerConfig = (ControllerServerConfig) config;
+        controllerConfig.ensureComplete();
+        this.controller = new ZooKeeperServerController(controllerConfig);
+        this.listener = new CommandListener(controller, controllerConfig);
+        this.serverCnxnFactory = controller.getCnxnFactory();
+    }
+
+    protected void runServices() {
+        this.controller.run();
+    }
+
+    protected void cleanup() {
+        if (listener != null) {
+            listener.close();
+            listener = null;
+        }
+    }
+
+    /**
+     * Runs the main loop for this application but does not exit the process.
+     */
+    public void initializeAndRun(String[] args) throws QuorumPeerConfig.ConfigException {
+        initConfig(args);
+        run();
+    }
+
+    /**
+     * Derived classes may override to do custom initialization of command line args.
+     */
+    protected void initConfig(String[] args) throws QuorumPeerConfig.ConfigException {
+        if (args.length == 1) {
+            config.parse(args[0]);
+        }
+    }
+
+    /**
+     * Run the app given a QuorumPeerConfig.
+     *
+     * @param config The quorum peer config.
+     */
+    public void runFromConfig(QuorumPeerConfig config) {
+        LOG.info("Starting quorum peer from peer config");
+        this.config = config;
+        run();
+    }
+
+    protected void run() {
+        try {
+            initService();
+        } catch (Exception ex) {
+            LOG.error("Failed to start ControllerService.", ex);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+
+        }
+        runServices();
+        cleanup();
+    }
+
+    /**
+     * Is the service up with all necessary initialization and port opening complete?
+     *
+     * @return true if the controller service is ready to use; false otherwise.
+     */
+    public boolean isReady() {
+        return controller != null && controller.isReady();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
new file mode 100644
index 00000000000..615db8755f8
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
@@ -0,0 +1,168 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Class which accepts commands to modify ZooKeeperServer state or Connection state at runtime for the purpose of
+ * single machine integration testing. Not meant to be used in production. It is recommended to use this in conjunction
+ * with the CommandListener HttpServer and CommandClient.
+ *
+ */
+@SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification = "quorum peer is internally synchronized.")
+public class ZooKeeperServerController {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperServerController.class);
+    private static final long DEFAULT_DELAY_MS = 1000;
+
+    private QuorumPeer quorumPeer;
+    private ControllableConnectionFactory cnxnFactory;
+
+    public ZooKeeperServerController(QuorumPeerConfig config) throws IOException {
+        if (config == null) {
+            throw new IllegalArgumentException("ZooKeeperServerController requires a valid config!");
+        }
+
+        cnxnFactory = new ControllableConnectionFactory();
+        cnxnFactory.configure(config.getClientPortAddress(), config.getMaxClientCnxns(), config.getClientPortListenBacklog());
+        quorumPeer = QuorumPeer.createFromConfig(config);
+        quorumPeer.setCnxnFactory(cnxnFactory);
+    }
+
+    public void run() {
+        try {
+            quorumPeer.start();
+            quorumPeer.join();
+        } catch (Exception ex) {
+            LOG.error("Fatal error starting quorum peer", ex);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
+    }
+
+    protected ServerCnxnFactory getCnxnFactory() {
+        return cnxnFactory;
+    }
+
+    public synchronized void shutdown() {
+        if (this.cnxnFactory != null) {
+            this.cnxnFactory.shutdown();
+            this.cnxnFactory = null;
+        }
+
+        if (this.quorumPeer != null && this.quorumPeer.isRunning()) {
+            this.quorumPeer.shutdown();
+            this.quorumPeer = null;
+        }
+    }
+
+    public synchronized boolean isReady() {
+        return this.cnxnFactory != null
+                && this.quorumPeer != null
+                && this.quorumPeer.isRunning()
+                && this.quorumPeer.getActiveServer() != null;
+    }
+
+    /**
+     * Process the command. An exception indicates errors. No exception indicates success.
+     */
+    public void processCommand(ControlCommand command) {
+        if (command == null) {
+            throw new IllegalArgumentException("Invalid command parameter!");
+        }
+
+        LOG.info("processing command {}{}", command.getAction(),
+                command.getParameter() == null ? "" : "[" + command.getParameter() + "]");
+
+        // Don't process command if we are shutting down or still initializing.
+        if (!isReady()) {
+            throw new IllegalStateException("Service is not ready. It has already been shutdown or is still initializing.");
+        }
+
+        switch (command.getAction()) {
+            case PING:
+                // NO-OP
+                break;
+            case SHUTDOWN:
+                shutdown();
+                break;
+            case CLOSECONNECTION:
+                if (command.getParameter() == null) {
+                    cnxnFactory.closeAll(ServerCnxn.DisconnectReason.CLOSE_ALL_CONNECTIONS_FORCED);
+                } else {
+                    // A single parameter should be a session id as long.
+                    // Parse failure exceptions will be sent to the caller.
+                    cnxnFactory.closeSession(Long.decode(command.getParameter()),
+                            ServerCnxn.DisconnectReason.CONNECTION_CLOSE_FORCED);
+                }
+                break;
+            case EXPIRESESSION:
+                // TODO: (hanm) implement once dependent feature is ready.
+                if (command.getParameter() == null) {
+                    // expireAllSessions();
+                } else {
+                    // A single parameter should be a session id as long.
+                    // Parse failure exceptions will be sent to the caller
+                    // expireSession(Long.decode(command.getParameter()));
+                }
+                break;
+            case REJECTCONNECTIONS:
+                // TODO: (hanm) implement once dependent feature is ready.
+                //cnxnFactory.rejectNewConnections();
+                break;
+            case ADDDELAY:
+                cnxnFactory.delayResponses(command.getParameter() == null
+                        ? DEFAULT_DELAY_MS : Long.decode(command.getParameter()));
+                break;
+            case NORESPONSE:
+                if (command.getParameter() == null) {
+                    cnxnFactory.holdAllFutureResponses();
+                } else {
+                    cnxnFactory.holdFutureResponses(Long.decode(command.getParameter()));
+                }
+                break;
+            case FAILREQUESTS:
+                if (command.getParameter() == null) {
+                    cnxnFactory.failAllFutureRequests();
+                } else {
+                    cnxnFactory.failFutureRequests(Long.decode(command.getParameter()));
+                }
+                break;
+            case RESET:
+                cnxnFactory.resetBadBehavior();
+                break;
+            case ELECTNEWLEADER:
+                quorumPeer.startLeaderElection();
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown command: " + command);
+        }
+    }
+
+}
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index e56c03ddf80..ad5c8c34e0e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -2558,4 +2558,66 @@ public boolean isReconfigEnabled() {
         }
     }
 
+    /**
+     * Create a new QuorumPeer and apply all the values per the already-parsed config.
+     *
+     * @param config The appertained quorum peer config.
+     * @return A QuorumPeer instantiated with specified peer config. Note this peer
+     *         is not fully initialized; caller should finish initialization through
+     *         additional configurations (connection factory settings, etc).
+     *
+     * @throws IOException
+     */
+    public static QuorumPeer createFromConfig(QuorumPeerConfig config) throws IOException {
+        QuorumPeer quorumPeer = new QuorumPeer();
+        quorumPeer.setTxnFactory(new FileTxnSnapLog(config.getDataLogDir(), config.getDataDir()));
+        quorumPeer.enableLocalSessions(config.areLocalSessionsEnabled());
+        quorumPeer.enableLocalSessionsUpgrading(config.isLocalSessionsUpgradingEnabled());
+        quorumPeer.setElectionType(config.getElectionAlg());
+        quorumPeer.setMyid(config.getServerId());
+        quorumPeer.setTickTime(config.getTickTime());
+        quorumPeer.setMinSessionTimeout(config.getMinSessionTimeout());
+        quorumPeer.setMaxSessionTimeout(config.getMaxSessionTimeout());
+        quorumPeer.setInitLimit(config.getInitLimit());
+        quorumPeer.setSyncLimit(config.getSyncLimit());
+        quorumPeer.setConnectToLearnerMasterLimit(config.getConnectToLearnerMasterLimit());
+        quorumPeer.setObserverMasterPort(config.getObserverMasterPort());
+        quorumPeer.setConfigFileName(config.getConfigFilename());
+        quorumPeer.setClientPortListenBacklog(config.getClientPortListenBacklog());
+        quorumPeer.setZKDatabase(new ZKDatabase(quorumPeer.getTxnFactory()));
+        quorumPeer.setQuorumVerifier(config.getQuorumVerifier(), false);
+        if (config.getLastSeenQuorumVerifier() != null) {
+            quorumPeer.setLastSeenQuorumVerifier(config.getLastSeenQuorumVerifier(), false);
+        }
+        quorumPeer.initConfigInZKDatabase();
+        quorumPeer.setSslQuorum(config.isSslQuorum());
+        quorumPeer.setUsePortUnification(config.shouldUsePortUnification());
+        quorumPeer.setLearnerType(config.getPeerType());
+        quorumPeer.setSyncEnabled(config.getSyncEnabled());
+        quorumPeer.setQuorumListenOnAllIPs(config.getQuorumListenOnAllIPs());
+        if (config.sslQuorumReloadCertFiles) {
+            quorumPeer.getX509Util().enableCertFileReloading();
+        }
+        quorumPeer.setMultiAddressEnabled(config.isMultiAddressEnabled());
+        quorumPeer.setMultiAddressReachabilityCheckEnabled(config.isMultiAddressReachabilityCheckEnabled());
+        quorumPeer.setMultiAddressReachabilityCheckTimeoutMs(config.getMultiAddressReachabilityCheckTimeoutMs());
+
+        // sets quorum sasl authentication configurations
+        quorumPeer.setQuorumSaslEnabled(config.quorumEnableSasl);
+        if (quorumPeer.isQuorumSaslAuthEnabled()) {
+            quorumPeer.setQuorumServerSaslRequired(config.quorumServerRequireSasl);
+            quorumPeer.setQuorumLearnerSaslRequired(config.quorumLearnerRequireSasl);
+            quorumPeer.setQuorumServicePrincipal(config.quorumServicePrincipal);
+            quorumPeer.setQuorumServerLoginContext(config.quorumServerLoginContext);
+            quorumPeer.setQuorumLearnerLoginContext(config.quorumLearnerLoginContext);
+        }
+        quorumPeer.setQuorumCnxnThreadsSize(config.quorumCnxnThreadsSize);
+
+        if (config.jvmPauseMonitorToRun) {
+            quorumPeer.setJvmPauseMonitor(new JvmPauseMonitor(config));
+        }
+
+        return quorumPeer;
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java
new file mode 100644
index 00000000000..050bcef124e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java
@@ -0,0 +1,85 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class ControlCommandTest {
+
+  @Test
+  public void verifyGeneratedUri() {
+    Assert.assertEquals("command/ping",
+        ControlCommand.createCommandUri(ControlCommand.Action.PING, null).toLowerCase());
+    Assert.assertEquals("command/ping",
+        ControlCommand.createCommandUri(ControlCommand.Action.PING, "").toLowerCase());
+    Assert.assertEquals("command/closeconnection/1234",
+        ControlCommand.createCommandUri(ControlCommand.Action.CLOSECONNECTION,
+            "1234").toLowerCase());
+  }
+
+  @Test
+  public void verifyParseChecksForNull() {
+    try {
+      ControlCommand.parseUri(null);
+      Assert.fail("Should have thrown for null.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+
+  @Test
+  public void verifyParseChecksForPrefix() {
+    try {
+      ControlCommand.parseUri("ping");
+      Assert.fail("Should have thrown for missing command/ prefix.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+
+  @Test
+  public void verifyParseCorrectlyFindsCommandWithNoParameter() {
+    Assert.assertEquals(ControlCommand.Action.PING,
+        ControlCommand.parseUri("command/ping").getAction());
+  }
+
+  @Test
+  public void verifyParseCorrectlyFindsCommandWithParameter() {
+    ControlCommand command = ControlCommand.parseUri("command/closeconnection/1234");
+    Assert.assertEquals(ControlCommand.Action.CLOSECONNECTION, command.getAction());
+    Assert.assertEquals("1234", command.getParameter());
+  }
+
+  @Test
+  public void verifyParseIllegalCommandWithNoParameter() {
+    try {
+      ControlCommand.parseUri("pings");
+      Assert.fail("Should have thrown for non existing command.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+
+  @Test
+  public void verifyParseIllegalCommandWithParameter() {
+    try {
+      ControlCommand.parseUri("command/close_connection/1234");
+      Assert.fail("Should have thrown for non existing command.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
new file mode 100644
index 00000000000..3b9b92a4b1a
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
@@ -0,0 +1,109 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+
+public class ControllerClientServerTest extends ControllerTestBase {
+    @Test
+    public void verifyPingCommand() {
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.PING));
+    }
+
+    @Test
+    public void verifyCloseConnectionCommand() {
+        // Valid long session ids should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION, "0x1234"));
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION, "1234"));
+
+        // Invalid session id format should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION));
+    }
+
+    // TODO (hanm): this depends on the expiration session feature which
+    // is not part of this patch. This test will be enabled once that
+    // feature is upstreamed.
+    @Ignore
+    public void verifyExpireSessionCommand() {
+        // Valid long session ids should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION, "0x1234"));
+
+        // Invalid session id format should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION));
+    }
+
+    @Test
+    public void verifyAddResetDelayCommands() {
+        // Valid longs should be parsed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY, "0x1234"));
+
+        // Invalid longs should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY));
+
+        // Reset delay should work.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+    }
+
+    @Test
+    public void verifyBadResponseCommands() {
+        // Valid longs should be parsed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS, "0x1234"));
+
+        // Invalid longs should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS));
+
+        // Reset should work.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+    }
+
+    @Test
+    public void verifyEatResponseCommands() {
+        // Valid longs should be parsed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE, "0x1234"));
+
+        // Invalid longs should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE));
+
+        // Reset should work.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+    }
+
+    @Test
+    public void verifyLeaderElectionCommand() {
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ELECTNEWLEADER));
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
new file mode 100644
index 00000000000..2a8ec822d48
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
@@ -0,0 +1,150 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.net.ServerSocket;
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+public class ControllerConfigTest {
+    File configFile;
+
+    private static final int AnyTickTime = 1234;
+    private static final int AnyPort = 1234;
+    private static final String AnyDataDir = "temp";
+
+    public static File createTempFile() throws IOException {
+        return File.createTempFile("temp", "cfg", new File(System.getProperty("user.dir")));
+    }
+
+    public static List<Integer> findNAvailablePorts(int n) throws IOException {
+        List<ServerSocket> openedSockets = new ArrayList<>();
+        List<Integer> ports = new ArrayList<>();
+
+        for (int i = 0; i < n; i++) {
+            ServerSocket randomSocket = new ServerSocket(0);
+            openedSockets.add(randomSocket);
+            ports.add(randomSocket.getLocalPort());
+        }
+
+        for (ServerSocket s : openedSockets) {
+            s.close();
+        }
+
+        return ports;
+    }
+
+    public static void writeRequiredControllerConfig(File file, int controllerPort, int zkServerPort, int adminServerPort) throws IOException {
+        PrintWriter writer = new PrintWriter(file);
+        writer.write("dataDir=anywhere\n");
+        writer.write("controllerPort=" + controllerPort + "\n");
+        writer.write("clientPort=" + zkServerPort + "\n");
+        writer.write("adminPort=" + adminServerPort + "\n");
+        writer.close();
+    }
+
+    @Before
+    public void init() throws IOException {
+        configFile = createTempFile();
+    }
+
+    private void writeFile(int portNumber) throws IOException {
+        FileWriter writer = new FileWriter(configFile);
+        writer.write("dataDir=somewhere\n");
+        writer.write("ignore=me\n");
+        writer.write("tickTime=" + AnyTickTime + "\n");
+        writer.write("controllerPort=" + portNumber + "\n");
+        writer.write("clientPort=" + portNumber + "\n");
+        writer.flush();
+        writer.close();
+    }
+
+    @After
+    public void cleanup() {
+        if (configFile != null) {
+            configFile.delete();
+        }
+    }
+
+    @Test
+    public void parseFileSucceeds() throws Exception {
+        writeFile(AnyPort);
+        ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
+        Assert.assertEquals(AnyPort, config.getControllerAddress().getPort());
+        Assert.assertEquals(AnyPort, config.getClientPortAddress().getPort());
+        Assert.assertEquals(AnyTickTime, config.getTickTime());
+    }
+
+    @Test
+    public void parseFileFailsWithMissingPort() throws Exception {
+        FileWriter writer = new FileWriter(configFile);
+        writer.write("dataDir=somewhere\n");
+        writer.flush();
+        writer.close();
+        try {
+            ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
+            Assert.fail("Should have thrown with missing server config");
+        } catch (QuorumPeerConfig.ConfigException ex) {
+        }
+    }
+
+    @Test public void parseMissingFileThrows() {
+        try {
+            ControllerServerConfig config = new ControllerServerConfig("DontLookHere.missing");
+            Assert.fail("should have thrown");
+        } catch (QuorumPeerConfig.ConfigException ex) {
+        }
+    }
+
+    @Test
+    public void parseInvalidPortThrows()throws QuorumPeerConfig.ConfigException {
+        try {
+            ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
+            Assert.fail("should have thrown");
+        } catch (QuorumPeerConfig.ConfigException ex) {
+        }
+    }
+
+    @Test
+    public void validCtor() {
+        ControllerServerConfig config = new ControllerServerConfig(AnyPort, AnyPort, AnyDataDir);
+        Assert.assertEquals(AnyPort, config.getControllerAddress().getPort());
+        Assert.assertEquals(AnyPort, config.getClientPortAddress().getPort());
+        Assert.assertEquals(AnyDataDir, config.getDataDir().getName());
+    }
+
+    @Test
+    public void invalidCtor() {
+        try {
+            ControllerServerConfig config = new ControllerServerConfig(-10, -10, "no where");
+            Assert.fail("should have thrown");
+        } catch (IllegalArgumentException ex) {
+        }
+
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
new file mode 100644
index 00000000000..70067c77a7f
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
@@ -0,0 +1,78 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.util.List;
+import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.ZKTestCase;
+import org.junit.After;
+import org.junit.Before;
+
+public class ControllerTestBase extends ZKTestCase {
+
+    protected ControllerService controllerService;
+    protected CommandClient commandClient;
+    private File tempDirectory;
+    protected ControllerServerConfig config;
+
+    @Before
+    public void init() throws Exception {
+        List<Integer> openPorts = ControllerConfigTest.findNAvailablePorts(2);
+        File tmpFile = File.createTempFile("test", ".junit", testBaseDir);
+        tempDirectory = new File(tmpFile + ".dir");
+        assertFalse(tempDirectory.exists());
+        assertTrue(tempDirectory.mkdirs());
+
+        config = new ControllerServerConfig(openPorts.get(0), openPorts.get(1), tempDirectory.getAbsolutePath());
+        controllerService = new ControllerService();
+        controllerService.start(config);
+
+        int retries = 50;
+        // The controller needs to hold an election before it is ready to process requests.
+        // Busy-wait until its ready...
+        while (!controllerService.isReady()) {
+            Thread.sleep(100);
+            retries--;
+            if (retries < 0) {
+                throw new TimeoutException("Service didn't start up and finish elections.");
+            }
+        }
+
+        // Create a client which sends requests to localhost on the configured port.
+        commandClient = new CommandClient(config.getControllerAddress().getPort());
+    }
+
+    @After
+    public void cleanup() throws InterruptedException {
+        if (controllerService != null) {
+            controllerService.shutdown();
+        }
+
+        if (commandClient != null) {
+            commandClient.close();
+        }
+
+        if (tempDirectory != null) {
+            tempDirectory.delete();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
new file mode 100644
index 00000000000..2895afd6fa7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
@@ -0,0 +1,384 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import java.util.LinkedList;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.AsyncCallback;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ZooKeeperServerControllerEndToEndTest extends ControllerTestBase {
+    private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperServerControllerEndToEndTest.class);
+    private ZooKeeper zkClient;
+    private static final String AnyPath = "/Any";
+    private static final byte[] AnyData = new byte[] {0x0, 0x1};
+
+    @After
+    @Override
+    public void cleanup() throws InterruptedException {
+        if (zkClient != null) {
+            zkClient.close();
+        }
+        super.cleanup();
+    }
+
+    private void initClient(Watcher watcher) throws IOException {
+        zkClient = new ZooKeeper("localhost:" + config.getClientPortAddress().getPort(), 10000, watcher);
+    }
+
+    @Test
+    public void verifyClientConnects() throws Exception {
+        // Basic validation: we can connect and get events.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        this.initClient(watcher);
+        watcher.waitForEvent();
+    }
+
+    @Test
+    public void verifyClientDisconnectsAndReconnects() throws Exception {
+        // Setup: First connect to the server and wait for connected.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        watcher.waitForEvent();
+
+        // Force a disconnection through the controller and ensure we get the events in order:
+        // 1: Disconnected
+        // 2: SyncConnected
+        watcher.reset(
+                new Watcher.Event.KeeperState[] {
+                        Watcher.Event.KeeperState.Disconnected,
+                        Watcher.Event.KeeperState.SyncConnected
+                });
+        Assert.assertTrue(commandClient
+                .trySendCommand(ControlCommand.Action.CLOSECONNECTION, String.valueOf(zkClient.getSessionId())));
+        watcher.waitForEvent();
+    }
+
+    @Ignore
+    public void verifySessionExpiration() throws Exception {
+        // Setup: First connect to the server and wait for connected.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        watcher.waitForEvent();
+
+        // Force an expiration.
+        // 1: Disconnected
+        // 2: Expired
+        watcher.reset(
+                new Watcher.Event.KeeperState[] {
+                        Watcher.Event.KeeperState.Disconnected,
+                        Watcher.Event.KeeperState.Expired
+                });
+        Assert.assertTrue(commandClient
+                .trySendCommand(ControlCommand.Action.EXPIRESESSION, String.valueOf(zkClient.getSessionId())));
+        watcher.waitForEvent();
+    }
+
+    @Ignore
+    public void verifyGlobalSessionExpiration() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(stateWatcher);
+        stateWatcher.waitForEvent();
+
+        // Step 2: Add an ephemeral node (upgrades session to global).
+        BlockingPathWatcher pathWatcher = new BlockingPathWatcher(AnyPath, Watcher.Event.EventType.NodeCreated);
+
+        zkClient.exists(AnyPath, pathWatcher);
+        Assert.assertEquals(AnyPath,
+                zkClient.create(AnyPath, AnyData, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL));
+        pathWatcher.waitForEvent();
+
+        // Force expire all sessions.
+        stateWatcher.reset(Watcher.Event.KeeperState.Expired);
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION));
+        stateWatcher.waitForEvent();
+    }
+
+    @Ignore
+    public void verifyRejectAcceptSessions() throws Exception {
+        // Tell the server to reject new requests.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.REJECTCONNECTIONS));
+        EventWaiter watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        try {
+            watcher.waitForEvent(100);
+            Assert.fail("should have failed connecting");
+        } catch (TimeoutException ex) {
+        }
+        // Now accept requests. We should get a connection quickly.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+        watcher.waitForEvent();
+    }
+
+    private long timedTransaction() throws Exception {
+        long startTime = System.currentTimeMillis();
+        zkClient.exists(AnyPath, false);
+        return System.currentTimeMillis() - startTime;
+    }
+
+    @Test
+    public void verifyAddDelay() throws Exception {
+        EventWaiter watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+
+        initClient(watcher);
+        watcher.waitForEvent();
+        timedTransaction();
+
+        // Add 200 ms of delay to each response.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY, String.valueOf(200)));
+        long delayedDuration = timedTransaction();
+
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+        long resetDuration = timedTransaction();
+
+        Assert.assertTrue(delayedDuration - resetDuration > 200);
+    }
+
+    @Test
+    public void verifyFailAllRequests() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(stateWatcher);
+        stateWatcher.waitForEvent();
+
+        // Step 2: Tell the server to fail requests.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS));
+
+        try {
+            zkClient.exists(AnyPath, null);
+            Assert.fail("should have failed");
+        } catch (KeeperException ex) {
+        }
+
+        // 2nd should fail: we haven't reset.
+        try {
+            zkClient.exists(AnyPath, null);
+            Assert.fail("should still fail");
+        } catch (KeeperException ex) {
+        }
+
+        // Reset; future requests should succeed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+
+        zkClient.exists(AnyPath, null);
+    }
+
+    @Test
+    public void verifyFailRequestCount() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(stateWatcher);
+        stateWatcher.waitForEvent();
+
+        // Step 2: Tell the server to fail 1 request.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS, "1"));
+
+        try {
+            zkClient.exists(AnyPath, null);
+            Assert.fail("should have failed");
+        } catch (KeeperException ex) {
+        }
+
+        // Have not reset; should succeed.
+        zkClient.exists(AnyPath, null);
+    }
+
+    @Test
+    public void verifyServerEatsAllResponses() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        watcher.waitForEvent();
+
+        // No data yet.
+        Assert.assertNull(zkClient.exists(AnyPath, null));
+
+        // Step 2: Tell the server to eat responses...nom...nom...nom....
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE));
+
+        try {
+            BlockingPathWatcher pathWatcher = new BlockingPathWatcher(AnyPath, Watcher.Event.EventType.NodeCreated);
+            // This async call should succeed in setting the data, but never send a response.
+            zkClient.create(AnyPath, AnyData, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL, pathWatcher, null);
+            pathWatcher.waitForEvent(500);
+            Assert.fail("should time out since the event should never come");
+        } catch (TimeoutException ex) {
+        }
+
+        // Re-enable responses.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+        watcher.reset(Watcher.Event.KeeperState.SyncConnected);
+
+        try {
+            // Even though we get a good response, the client doesn't know about
+            // the transaction id (xid). This should terminate the connection and
+            // throw a KeeperException.
+            zkClient.exists(AnyPath, false);
+            Assert.fail("should have failed with bad xid");
+        } catch (KeeperException ex) {
+            // The client believes it has fallen behind so deems this a connection loss.
+            Assert.assertTrue(ex instanceof KeeperException.ConnectionLossException);
+        }
+
+        // The client should reconnect and be healthy after this.
+        watcher.waitForEvent();
+        Assert.assertNotNull(zkClient.exists(AnyPath, false));
+    }
+
+    /**
+     * Our watcher interface is called back on a potentially separate thread.
+     * Tests should be logically consolidated into a single method in the following format:
+     * for each action in my test
+     *     Setup test action
+     *     Kick off async action
+     *     await state change
+     *     verify state
+     *
+     * To enable this logical pattern, the watcher has an ordered set of states to wait on.
+     * When all the states have arrived (in order), the notifier is unblocked.
+     */
+    private abstract class EventWaiter implements Watcher, AsyncCallback.StringCallback {
+        private final int DEFAULT_WAIT_DURATION = 10000;
+        private CountDownLatch eventNotification;
+
+        public EventWaiter() {
+            reset();
+        }
+
+        protected void reset() {
+            eventNotification = new CountDownLatch(1);
+        }
+
+        @Override
+        public void process(WatchedEvent event) {
+            // NO-OP. Derived classes should override if required.
+            LOG.info("WatchedEvent: {}", event);
+        }
+
+        @Override
+        public void processResult(int rc, String path, Object ctx, String name) {
+            // NO-OP. Derived classes to implement if required.
+            LOG.info("StringCallback: {}, {}, {}, {}", rc, path, ctx, name);
+        }
+
+        public void notifyListener() {
+            eventNotification.countDown();
+        }
+
+        public void waitForEvent() throws InterruptedException, TimeoutException {
+            waitForEvent(DEFAULT_WAIT_DURATION);
+        }
+
+        public void waitForEvent(int waitDurationInMs) throws InterruptedException, TimeoutException {
+            // Wait ten seconds and throw if we time out.
+            if (!eventNotification.await(waitDurationInMs, TimeUnit.MILLISECONDS)) {
+                throw new TimeoutException("Timed out waiting for event");
+            }
+        }
+    }
+
+    private class BlockingStateWatcher extends EventWaiter {
+        private Object lockMe = new Object();
+        private LinkedList<Event.KeeperState> statesToWaitFor;
+
+        public BlockingStateWatcher(Event.KeeperState stateToNotifyOn) {
+            reset(stateToNotifyOn);
+        }
+
+        @Override
+        public void process(WatchedEvent event) {
+            LOG.info("State transition: {}", event.getState());
+
+            boolean shouldNotify = false;
+            synchronized (lockMe) {
+                if (!statesToWaitFor.isEmpty() && statesToWaitFor.getFirst() == event.getState()) {
+                    statesToWaitFor.removeFirst();
+                    shouldNotify = statesToWaitFor.isEmpty();
+                }
+            }
+
+            if (shouldNotify) {
+                notifyListener();
+            }
+        }
+
+        public void reset(Event.KeeperState stateToNotifyOn) {
+            reset(new Event.KeeperState[] {stateToNotifyOn});
+        }
+
+        public void reset(Event.KeeperState[] orderedStatesToWaitOn) {
+            if (orderedStatesToWaitOn == null) {
+                throw new IllegalArgumentException("orderedStatesToWaitOn can't be null.");
+            }
+
+            if (orderedStatesToWaitOn.length <= 0) {
+                throw new IllegalArgumentException("orderedStatesToWaitOn length must be positive.");
+            }
+
+            synchronized (lockMe) {
+                super.reset();
+                statesToWaitFor = new LinkedList<>();
+
+                for (Event.KeeperState state : orderedStatesToWaitOn) {
+                    statesToWaitFor.add(state);
+                }
+            }
+        }
+    }
+
+    private class BlockingPathWatcher extends EventWaiter {
+        private String pathToNotifyOn;
+        private Event.EventType requiredEventType;
+
+        public BlockingPathWatcher(String pathToNotifyOn, Event.EventType requiredEventType) {
+            reset(pathToNotifyOn, requiredEventType);
+        }
+
+        public void reset(String pathToNotifyOn, Event.EventType requiredEventType) {
+            super.reset();
+            this.pathToNotifyOn = pathToNotifyOn;
+            this.requiredEventType = requiredEventType;
+        }
+
+        @Override
+        public void process(WatchedEvent event) {
+            LOG.info("WatchEvent {} for path {}", event.getType(), event.getPath());
+            if (pathToNotifyOn != null && event.getType() == requiredEventType
+                    && pathToNotifyOn.equalsIgnoreCase(event.getPath())) {
+                notifyListener();
+            }
+        }
+    }
+
+}

From eeb1ceb6f82b67b8b46d5ff9481908f7ec943f19 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Tue, 20 Oct 2020 16:21:30 +0200
Subject: [PATCH 104/591] ZOOKEEPER-3980: Fix Jenkinsfiles with new tool names

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: andor@apache.org

Closes #1510 from eolivelli/fix/ZOOKEEPER-3980 and squashes the following commits:

15beb5713 [Enrico Olivelli] fix java
5d8418f5c [Enrico Olivelli] ZOOKEEPER-3980 Fix Jenkinsfiles with new tool names
---
 Jenkinsfile           | 4 ++--
 Jenkinsfile-PreCommit | 4 ++--
 Jenkinsfile-owasp     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index ab7baed630c..ed074c95617 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -39,12 +39,12 @@ pipeline {
                 axes {
                     axis {
                         name 'JAVA_VERSION'
-                        values 'JDK 1.8 (latest)', 'JDK 11 (latest)'
+                        values 'jdk_1.8_latest', 'jdk_11_latest'
                     }
                 }
 
                 tools {
-                    maven "Maven (latest)"
+                    maven "maven_latest"
                     jdk "${JAVA_VERSION}"
                 }
 
diff --git a/Jenkinsfile-PreCommit b/Jenkinsfile-PreCommit
index c7ba439b1d6..8390e05b929 100644
--- a/Jenkinsfile-PreCommit
+++ b/Jenkinsfile-PreCommit
@@ -29,8 +29,8 @@ pipeline {
     }
 
     tools {
-        maven "Maven (latest)"
-        jdk "JDK 1.8 (latest)"
+        maven "maven_latest"
+        jdk "jdk_1.8_latest"
     }
 
     stages {
diff --git a/Jenkinsfile-owasp b/Jenkinsfile-owasp
index 76416357c4a..03ba497ac6d 100644
--- a/Jenkinsfile-owasp
+++ b/Jenkinsfile-owasp
@@ -28,8 +28,8 @@ pipeline {
     }
 
     tools {
-        maven "Maven (latest)"
-        jdk "JDK 1.8 (latest)"
+        maven "maven_latest"
+        jdk "jdk_1.8_latest"
     }
 
     stages {

From 1af3dcc633d4829864da74ca6b030428448fcc16 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Tue, 20 Oct 2020 19:41:38 -0700
Subject: [PATCH 105/591] ZOOKEEPER-3561: Generalize target authentication
 scheme for ZooKeeper authentication enforcement.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added enforce.auth.enabled and enforce.auth.scheme to enforce any authentication scheme.

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Michael Han <hanm@apache.org>, Damien Diederen <dd@crosstwine.com>, Enrico Olivelli <eolivelli@gmail.com>, Andor MolnĂ¡r <andor@apache.org>

Closes #1500 from arshadmohammad/ZOOKEEPER-3561-master
---
 .../zookeeper-client-c/include/zookeeper.h    |   2 +-
 .../zookeeper-client-c/tests/zkServer.sh      |   2 +-
 .../main/resources/markdown/zookeeperAdmin.md |  34 ++-
 .../org/apache/zookeeper/KeeperException.java |   5 +-
 .../server/AuthenticationHelper.java          | 141 ++++++++++
 .../zookeeper/server/ZooKeeperServer.java     |  29 +-
 .../zookeeper/EnforceAuthenticationTest.java  | 266 ++++++++++++++++++
 .../server/quorum/QuorumPeerTestBase.java     |  24 +-
 .../org/apache/zookeeper/test/ClientBase.java |  14 +-
 .../test/SaslAuthRequiredFailNoSASLTest.java  |  16 +-
 10 files changed, 493 insertions(+), 40 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 8bd1d95db12..467a857eaa1 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -140,7 +140,7 @@ enum ZOO_ERRORS {
   ZEPHEMERALONLOCALSESSION = -120, /*!< Attempt to create ephemeral node on a local session */
   ZNOWATCHER = -121, /*!< The watcher couldn't be found */
   ZRECONFIGDISABLED = -123, /*!< Attempts to perform a reconfiguration operation when reconfiguration feature is disabled */
-  ZSESSIONCLOSEDREQUIRESASLAUTH = -124, /*!< The session has been closed by server because server requires client to do SASL authentication, but client is not configured with SASL authentication or configuted with SASL but failed (i.e. wrong credential used.). */
+  ZSESSIONCLOSEDREQUIRESASLAUTH = -124, /*!< The session has been closed by server because server requires client to do authentication via configured authentication scheme at server, but client is not configured with required authentication scheme or configured but failed (i.e. wrong credential used.). */
   ZTHROTTLEDOP = -127 /*!< Operation was throttled and not executed at all. please, retry! */
 
   /* when adding/changing values here also update zerror(int) to return correct error message */
diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index 99b716a2111..f98b4058c97 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -128,9 +128,9 @@ PROPERTIES="$EXTRA_JVM_ARGS -Dzookeeper.extendedTypesEnabled=true -Dznode.contai
 if [ "x$1" == "xstartRequireSASLAuth" ]
 then
     PROPERTIES="-Dzookeeper.sessionRequireClientSASLAuth=true $PROPERTIES"
+    PROPERTIES="$PROPERTIES -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
     if [ "x$2" != "x" ]
     then
-        PROPERTIES="$PROPERTIES -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
         PROPERTIES="$PROPERTIES -Djava.security.auth.login.config=$2"
     fi
     if [ "x$3" != "x" ]
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 2150c5ac2e4..a3a1c6c7dce 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1498,8 +1498,8 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     If the credential is not in the list, the connection request will be refused.
     This prevents a client accidentally connecting to a wrong ensemble.
 
-* *zookeeper.sessionRequireClientSASLAuth* :
-    (Java system property only: **zookeeper.sessionRequireClientSASLAuth**)
+* *sessionRequireClientSASLAuth* :
+    (Java system property: **zookeeper.sessionRequireClientSASLAuth**)
     **New in 3.6.0:**
     When set to **true**, ZooKeeper server will only accept connections and requests from clients
     that have authenticated with server via SASL. Clients that are not configured with SASL
@@ -1508,13 +1508,41 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     in such case, both Java and C client will close the session with server thereafter,
     without further attempts on retrying to reconnect.
 
+    This configuration is short hand for **enforce.auth.enabled=true** and **enforce.auth.scheme=sasl**
+
     By default, this feature is disabled. Users who would like to opt-in can enable the feature
-    by setting **zookeeper.sessionRequireClientSASLAuth** to **true**.
+    by setting **sessionRequireClientSASLAuth** to **true**.
 
     This feature overrules the <emphasis role="bold">zookeeper.allowSaslFailedClients</emphasis> option, so even if server is
     configured to allow clients that fail SASL authentication to login, client will not be able to
     establish a session with server if this feature is enabled.
 
+* *enforce.auth.enabled* :
+    (Java system property : **zookeeper.enforce.auth.enabled**)
+    **New in 3.7.0:**
+    When set to **true**, ZooKeeper server will only accept connections and requests from clients
+    that have authenticated with server via configured auth scheme. Authentication schemes
+    can be configured using property enforce.auth.schemes. Clients that are not
+    configured with the any of the auth scheme configured at server or configured but failed authentication (i.e. with invalid credential)
+    will not be able to establish a session with server. A typed error code (-124) will be delivered
+    in such case, both Java and C client will close the session with server thereafter,
+    without further attempts on retrying to reconnect.
+
+    By default, this feature is disabled. Users who would like to opt-in can enable the feature
+    by setting **enforce.auth.enabled** to **true**.
+
+    When **enforce.auth.enabled=true** and **enforce.auth.schemes=sasl** then 
+    <emphasis role="bold">zookeeper.allowSaslFailedClients</emphasis> configuration is overruled. So even if server is
+    configured to allow clients that fail SASL authentication to login, client will not be able to
+    establish a session with server if this feature is enabled with sasl as authentication scheme.
+
+* *enforce.auth.schemes* :
+    (Java system property : **zookeeper.enforce.auth.schemes**)
+    **New in 3.7.0:**
+    Comma separated list of authentication schemes. Clients must be authenticated with at least one
+    authentication scheme before doing any zookeeper operations. 
+    This property is used only when **enforce.auth.enabled** is to **true**.
+
 * *sslQuorum* :
     (Java system property: **zookeeper.sslQuorum**)
     **New in 3.5.5:**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index c8b33b7fa7b..9469d644c85 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -403,8 +403,9 @@ public enum Code implements CodeDeprecated {
         REQUESTTIMEOUT(-122),
         /** Attempts to perform a reconfiguration operation when reconfiguration feature is disabled. */
         RECONFIGDISABLED(-123),
-        /** The session has been closed by server because server requires client to do SASL authentication,
-         *  but client is not configured with SASL authentication or configuted with SASL but failed
+        /** The session has been closed by server because server requires client to do authentication
+         *  with configured authentication scheme at the server, but client is not configured with
+         *  required  authentication scheme or configured but authentication failed
          *  (i.e. wrong credential used.). */
         SESSIONCLOSEDREQUIRESASLAUTH(-124),
         /** Operation was throttled and not executed at all. This error code indicates that zookeeper server
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java
new file mode 100644
index 00000000000..61aebb343be
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Contains helper methods to enforce authentication
+ */
+public class AuthenticationHelper {
+    private static final Logger LOG = LoggerFactory.getLogger(AuthenticationHelper.class);
+
+    public static final String ENFORCE_AUTH_ENABLED = "zookeeper.enforce.auth.enabled";
+    public static final String ENFORCE_AUTH_SCHEMES = "zookeeper.enforce.auth.schemes";
+    public static final String SESSION_REQUIRE_CLIENT_SASL_AUTH =
+        "zookeeper.sessionRequireClientSASLAuth";
+    public static final String SASL_AUTH_SCHEME = "sasl";
+
+    private boolean enforceAuthEnabled;
+    private List<String> enforceAuthSchemes = new ArrayList<>();
+    private boolean saslAuthRequired;
+
+    public AuthenticationHelper() {
+        initConfigurations();
+    }
+
+    private void initConfigurations() {
+        if (Boolean.parseBoolean(System.getProperty(SESSION_REQUIRE_CLIENT_SASL_AUTH, "false"))) {
+            enforceAuthEnabled = true;
+            enforceAuthSchemes.add(SASL_AUTH_SCHEME);
+        } else {
+            enforceAuthEnabled =
+                Boolean.parseBoolean(System.getProperty(ENFORCE_AUTH_ENABLED, "false"));
+            String enforceAuthSchemesProp = System.getProperty(ENFORCE_AUTH_SCHEMES);
+            if (enforceAuthSchemesProp != null) {
+                Arrays.stream(enforceAuthSchemesProp.split(",")).forEach(s -> {
+                    enforceAuthSchemes.add(s.trim());
+                });
+            }
+        }
+        LOG.info("{} = {}", ENFORCE_AUTH_ENABLED, enforceAuthEnabled);
+        LOG.info("{} = {}", ENFORCE_AUTH_SCHEMES, enforceAuthSchemes);
+        validateConfiguredProperties();
+        saslAuthRequired = enforceAuthEnabled && enforceAuthSchemes.contains(SASL_AUTH_SCHEME);
+    }
+
+    private void validateConfiguredProperties() {
+        if (enforceAuthEnabled) {
+            if (enforceAuthSchemes.isEmpty()) {
+                String msg =
+                    ENFORCE_AUTH_ENABLED + " is true " + ENFORCE_AUTH_SCHEMES + " must be  "
+                        + "configured.";
+                LOG.error(msg);
+                throw new IllegalArgumentException(msg);
+            }
+            enforceAuthSchemes.forEach(scheme -> {
+                if (ProviderRegistry.getProvider(scheme) == null) {
+                    String msg = "Authentication scheme " + scheme + " is not available.";
+                    LOG.error(msg);
+                    throw new IllegalArgumentException(msg);
+                }
+            });
+        }
+    }
+
+    /**
+     * Checks if connection is authenticated or not.
+     *
+     * @param cnxn server connection
+     * @return boolean
+     */
+    private boolean isCnxnAuthenticated(ServerCnxn cnxn) {
+        for (Id id : cnxn.getAuthInfo()) {
+            if (enforceAuthSchemes.contains(id.getScheme())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public boolean isEnforceAuthEnabled() {
+        return enforceAuthEnabled;
+    }
+
+    /**
+     * Returns true when authentication enforcement was success otherwise returns false
+     * also closes the connection
+     *
+     * @param connection server connection
+     * @param xid        current operation xid
+     * @return true when authentication enforcement is success otherwise false
+     */
+    public boolean enforceAuthentication(ServerCnxn connection, int xid) throws IOException {
+        if (isEnforceAuthEnabled() && !isCnxnAuthenticated(connection)) {
+            //Un authenticated connection, lets inform user with response and then close the session
+            LOG.error("Client authentication scheme(s) {} does not match with any of the expected "
+                    + "authentication scheme {}, closing session.", getAuthSchemes(connection),
+                enforceAuthSchemes);
+            ReplyHeader replyHeader = new ReplyHeader(xid, 0,
+                KeeperException.Code.SESSIONCLOSEDREQUIRESASLAUTH.intValue());
+            connection.sendResponse(replyHeader, null, "response");
+            connection.sendCloseSession();
+            connection.disableRecv();
+            return false;
+        }
+        return true;
+    }
+
+    private List<String> getAuthSchemes(ServerCnxn connection) {
+        return connection.getAuthInfo().stream().map(Id::getScheme).collect(Collectors.toList());
+    }
+
+    public boolean isSaslAuthRequired() {
+        return saslAuthRequired;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index b016724a3e1..00550be2aec 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -107,9 +107,6 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
     static final boolean skipACL;
 
     public static final String ALLOW_SASL_FAILED_CLIENTS = "zookeeper.allowSaslFailedClients";
-    public static final String SESSION_REQUIRE_CLIENT_SASL_AUTH = "zookeeper.sessionRequireClientSASLAuth";
-    public static final String SASL_AUTH_SCHEME = "sasl";
-
     public static final String ZOOKEEPER_DIGEST_ENABLED = "zookeeper.digest.enabled";
     private static boolean digestEnabled;
 
@@ -284,6 +281,8 @@ protected enum State {
 
     private final AtomicInteger currentLargeRequestBytes = new AtomicInteger(0);
 
+    private AuthenticationHelper authHelper;
+
     void removeCnxn(ServerCnxn cnxn) {
         zkDb.removeCnxn(cnxn);
     }
@@ -298,6 +297,7 @@ public ZooKeeperServer() {
         listener = new ZooKeeperServerListenerImpl(this);
         serverStats = new ServerStats(this);
         this.requestPathMetricsCollector = new RequestPathMetricsCollector();
+        this.authHelper = new AuthenticationHelper();
     }
 
     /**
@@ -339,6 +339,8 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
 
         this.initLargeRequestThrottlingSettings();
 
+        this.authHelper = new AuthenticationHelper();
+
         LOG.info(
             "Created server with"
                 + " tickTime {}"
@@ -1623,11 +1625,10 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
         } else if (h.getType() == OpCode.sasl) {
             processSasl(incomingBuffer, cnxn, h);
         } else {
-            if (shouldRequireClientSaslAuth() && !hasCnxSASLAuthenticated(cnxn)) {
-                ReplyHeader replyHeader = new ReplyHeader(h.getXid(), 0, Code.SESSIONCLOSEDREQUIRESASLAUTH.intValue());
-                cnxn.sendResponse(replyHeader, null, "response");
-                cnxn.sendCloseSession();
-                cnxn.disableRecv();
+            if (!authHelper.enforceAuthentication(cnxn, h.getXid())) {
+                // Authentication enforcement is failed
+                // Already sent response to user about failure and closed the session, lets return
+                return;
             } else {
                 Request si = new Request(cnxn, cnxn.getSessionId(), h.getXid(), h.getType(), incomingBuffer, cnxn.getAuthInfo());
                 int length = incomingBuffer.limit();
@@ -1646,14 +1647,6 @@ private static boolean shouldAllowSaslFailedClientsConnect() {
         return Boolean.getBoolean(ALLOW_SASL_FAILED_CLIENTS);
     }
 
-    private static boolean shouldRequireClientSaslAuth() {
-        return Boolean.getBoolean(SESSION_REQUIRE_CLIENT_SASL_AUTH);
-    }
-
-    private boolean hasCnxSASLAuthenticated(ServerCnxn cnxn) {
-        return cnxn.getAuthInfo().stream().anyMatch(id -> id.getScheme().equals(SASL_AUTH_SCHEME));
-    }
-
     private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHeader requestHeader) throws IOException {
         LOG.debug("Responding to client SASL token.");
         GetSASLRequest clientTokenRecord = new GetSASLRequest();
@@ -1679,11 +1672,11 @@ private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHead
                 }
             } catch (SaslException e) {
                 LOG.warn("Client {} failed to SASL authenticate: {}", cnxn.getRemoteSocketAddress(), e);
-                if (shouldAllowSaslFailedClientsConnect() && !shouldRequireClientSaslAuth()) {
+                if (shouldAllowSaslFailedClientsConnect() && !authHelper.isSaslAuthRequired()) {
                     LOG.warn("Maintaining client connection despite SASL authentication failure.");
                 } else {
                     int error;
-                    if (shouldRequireClientSaslAuth()) {
+                    if (authHelper.isSaslAuthRequired()) {
                         LOG.warn(
                             "Closing client connection due to server requires client SASL authenticaiton,"
                                 + "but client SASL authentication has failed, or client is not configured with SASL "
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java
new file mode 100644
index 00000000000..ef665621ac7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java
@@ -0,0 +1,266 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+import java.io.File;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.server.AuthenticationHelper;
+import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.ZooKeeperServerMain;
+import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class EnforceAuthenticationTest extends QuorumPeerTestBase {
+    protected static final Logger LOG = LoggerFactory.getLogger(EnforceAuthenticationTest.class);
+    private Servers servers;
+    private int clientPort;
+
+    @Before
+    public void setUp() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_ENABLED);
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_SCHEMES);
+    }
+
+    @After
+    public void tearDown() throws InterruptedException {
+        if (servers != null) {
+            servers.shutDownAllServers();
+        }
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_ENABLED);
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_SCHEMES);
+    }
+
+    /**
+     * When AuthenticationHelper.ENFORCE_AUTH_ENABLED is not set or set to false, behaviour should
+     * be same as the old ie. clients without authentication are allowed to do operations
+     */
+    @Test
+    public void testEnforceAuthenticationOldBehaviour() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        startServer(prop);
+        testEnforceAuthOldBehaviour(false);
+    }
+
+    @Test
+    public void testEnforceAuthenticationOldBehaviourWithNetty() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        //setting property false should give the same behaviour as when property is not set
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "false");
+        prop.put("serverCnxnFactory", "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        startServer(prop);
+        testEnforceAuthOldBehaviour(true);
+    }
+
+    private void testEnforceAuthOldBehaviour(boolean netty) throws Exception {
+        ZKClientConfig config = new ZKClientConfig();
+        if (netty) {
+            config.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET,
+                "org.apache.zookeeper.ClientCnxnSocketNetty");
+        }
+        ZooKeeper client = ClientBase
+            .createZKClient("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, CONNECTION_TIMEOUT,
+                config);
+        String path = "/defaultAuth" + System.currentTimeMillis();
+        String data = "someData";
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    /**
+     * Server start should fail when ZooKeeperServer.ENFORCE_AUTH_ENABLED is set to true  but
+     * AuthenticationHelper.ENFORCE_AUTH_SCHEME is not configured
+     */
+    @Test
+    public void testServerStartShouldFailWhenEnforceAuthSchemeIsNotConfigured() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        testServerCannotStart(prop);
+    }
+
+    /**
+     * Server start should fail when AuthenticationHelper.ENFORCE_AUTH_ENABLED is set to true,
+     * AuthenticationHelper.ENFORCE_AUTH_SCHEME is configured but authentication provider is not
+     * configured.
+     */
+    @Test
+    public void testServerStartShouldFailWhenAuthProviderIsNotConfigured() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "sasl");
+        testServerCannotStart(prop);
+    }
+
+    private void testServerCannotStart(Map<String, String> prop)
+        throws Exception {
+        File confFile = getConfFile(prop);
+        ServerConfig config = new ServerConfig();
+        config.parse(confFile.toString());
+        ZooKeeperServerMain serverMain = new ZooKeeperServerMain();
+        try {
+            serverMain.runFromConfig(config);
+            fail("IllegalArgumentException is expected.");
+        } catch (IllegalArgumentException e) {
+            //do nothing
+        }
+    }
+
+    @Test
+    public void testEnforceAuthenticationNewBehaviour() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "digest");
+        //digest auth provider is started by default, so no need to
+        //prop.put("authProvider.1", DigestAuthenticationProvider.class.getName());
+        startServer(prop);
+        testEnforceAuthNewBehaviour(false);
+    }
+
+    @Test
+    public void testEnforceAuthenticationNewBehaviourWithNetty() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "digest");
+        prop.put("serverCnxnFactory", "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        startServer(prop);
+        testEnforceAuthNewBehaviour(true);
+    }
+
+    /**
+     * Client operations are allowed only after the authentication is done
+     */
+    private void testEnforceAuthNewBehaviour(boolean netty) throws Exception {
+        ZKClientConfig config = new ZKClientConfig();
+        if (netty) {
+            config.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET,
+                "org.apache.zookeeper.ClientCnxnSocketNetty");
+        }
+        CountDownLatch countDownLatch = new CountDownLatch(1);
+        ZooKeeper client =
+            new ZooKeeper("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, getWatcher(countDownLatch),
+                config);
+        countDownLatch.await();
+        String path = "/newAuth" + System.currentTimeMillis();
+        String data = "someData";
+
+        //try without authentication
+        try {
+            client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("SessionClosedRequireAuthException is expected.");
+        } catch (KeeperException.SessionClosedRequireAuthException e) {
+            //do nothing
+        }
+        client.close();
+        countDownLatch = new CountDownLatch(1);
+        client =
+            new ZooKeeper("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, getWatcher(countDownLatch),
+                config);
+        countDownLatch.await();
+
+        // try operations after authentication
+        String idPassword = "user1:pass1";
+        client.addAuthInfo("digest", idPassword.getBytes());
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    @Test
+    public void testEnforceAuthenticationWithMultipleAuthSchemes() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "digest,ip");
+        startServer(prop);
+        ZKClientConfig config = new ZKClientConfig();
+        CountDownLatch countDownLatch = new CountDownLatch(1);
+        ZooKeeper client =
+            new ZooKeeper("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, getWatcher(countDownLatch),
+                config);
+        countDownLatch.await();
+        // try operation without adding auth info, it should be success as ip auth info is
+        // added automatically by server
+        String path = "/newAuth" + System.currentTimeMillis();
+        String data = "someData";
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    private String removeZooKeeper(String prop) {
+        return prop.replace("zookeeper.", "");
+    }
+
+    private File getConfFile(Map<String, String> additionalProp) throws IOException {
+        clientPort = PortAssignment.unique();
+        StringBuilder sb = new StringBuilder();
+        sb.append("standaloneEnabled=true" + "\n");
+        if (null != additionalProp) {
+            for (Map.Entry<String, String> entry : additionalProp.entrySet()) {
+                sb.append(entry.getKey());
+                sb.append("=");
+                sb.append(entry.getValue());
+                sb.append("\n");
+            }
+        }
+        String currentQuorumCfgSection = sb.toString();
+        return new MainThread(1, clientPort, currentQuorumCfgSection, false).getConfFile();
+    }
+
+    private void startServer(Map<String, String> additionalProp) throws Exception {
+        additionalProp.put("standaloneEnabled", "true");
+        servers = LaunchServers(1, additionalProp);
+        clientPort = servers.clientPorts[0];
+    }
+
+    private Watcher getWatcher(CountDownLatch countDownLatch) {
+        return event -> {
+            Event.EventType type = event.getType();
+            if (type == Event.EventType.None) {
+                Event.KeeperState state = event.getState();
+                if (state == Event.KeeperState.SyncConnected) {
+                    LOG.info("Event.KeeperState.SyncConnected");
+                    countDownLatch.countDown();
+                } else if (state == Event.KeeperState.Expired) {
+                    LOG.info("Event.KeeperState.Expired");
+                } else if (state == Event.KeeperState.Disconnected) {
+                    LOG.info("Event.KeeperState.Disconnected");
+                } else if (state == Event.KeeperState.AuthFailed) {
+                    LOG.info("Event.KeeperState.AuthFailed");
+                }
+            }
+        };
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index 953f4ab066c..2a116dce076 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -406,7 +406,7 @@ protected static class Servers {
 
         MainThread[] mt;
         ZooKeeper[] zk;
-        int[] clientPorts;
+        public int[] clientPorts;
 
         public void shutDownAllServers() throws InterruptedException {
             for (MainThread t : mt) {
@@ -470,23 +470,35 @@ public int findAnyObserver() {
     }
 
     protected Servers LaunchServers(int numServers) throws IOException, InterruptedException {
-        return LaunchServers(numServers, null);
+        return LaunchServers(numServers, (Integer) null);
+    }
+
+    protected Servers LaunchServers(int numServers, Map<String, String> otherConfigs)
+        throws IOException, InterruptedException {
+        return LaunchServers(numServers, 0, null, otherConfigs);
     }
 
     protected Servers LaunchServers(int numServers, Integer tickTime) throws IOException, InterruptedException {
         return LaunchServers(numServers, 0, tickTime);
     }
 
+    protected Servers LaunchServers(int numServers, int numObservers, Integer tickTime)
+        throws IOException, InterruptedException {
+        return LaunchServers(numServers, numObservers, tickTime, new HashMap<>());
+    }
+
     /** * This is a helper function for launching a set of servers
      *
      * @param numServers the number of participant servers
-     * @param numObserver the number of observer servers
+     * @param numObservers the number of observer servers
      * @param tickTime A ticktime to pass to MainThread
+     * @param otherConfigs any zoo.cfg configuration
      * @return
      * @throws IOException
      * @throws InterruptedException
      */
-    protected Servers LaunchServers(int numServers, int numObservers, Integer tickTime) throws IOException, InterruptedException {
+    protected Servers LaunchServers(int numServers, int numObservers, Integer tickTime,
+        Map<String, String> otherConfigs) throws IOException, InterruptedException {
         int SERVER_COUNT = numServers + numObservers;
         QuorumPeerMainTest.Servers svrs = new QuorumPeerMainTest.Servers();
         svrs.clientPorts = new int[SERVER_COUNT];
@@ -504,9 +516,9 @@ protected Servers LaunchServers(int numServers, int numObservers, Integer tickTi
         svrs.zk = new ZooKeeper[SERVER_COUNT];
         for (int i = 0; i < SERVER_COUNT; i++) {
             if (tickTime != null) {
-                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, new HashMap<String, String>(), tickTime);
+                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, otherConfigs, tickTime);
             } else {
-                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection);
+                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, otherConfigs);
             }
             svrs.mt[i].start();
             svrs.restartClient(i, this);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index 5904a376791..c628e4f51e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -51,6 +51,7 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.IOUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
@@ -351,6 +352,9 @@ public static File createTmpDir() throws IOException {
     }
 
     static File createTmpDir(File parentDir, boolean createInitFile) throws IOException {
+        if (!parentDir.exists()) {
+            parentDir.mkdir();
+        }
         File tmpFile = File.createTempFile("test", ".junit", parentDir);
         // don't delete tmpFile - this ensures we don't attempt to create
         // a tmpDir with a duplicate name
@@ -738,9 +742,15 @@ public static ZooKeeper createZKClient(String cxnString, int sessionTimeout) thr
         return createZKClient(cxnString, sessionTimeout, CONNECTION_TIMEOUT);
     }
 
-    public static ZooKeeper createZKClient(String cxnString, int sessionTimeout, long connectionTimeout) throws IOException {
+    public static ZooKeeper createZKClient(String cxnString, int sessionTimeout,
+        long connectionTimeout) throws IOException {
+        return createZKClient(cxnString, sessionTimeout, connectionTimeout, new ZKClientConfig());
+    }
+
+    public static ZooKeeper createZKClient(String cxnString, int sessionTimeout,
+        long connectionTimeout, ZKClientConfig config) throws IOException {
         CountdownWatcher watcher = new CountdownWatcher();
-        ZooKeeper zk = new ZooKeeper(cxnString, sessionTimeout, watcher);
+        ZooKeeper zk = new ZooKeeper(cxnString, sessionTimeout, watcher, config);
         try {
             watcher.waitForConnected(connectionTimeout);
         } catch (InterruptedException | TimeoutException e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
index 51dbbb53e16..f5b99b90d49 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
@@ -24,20 +24,22 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
 public class SaslAuthRequiredFailNoSASLTest extends ClientBase {
 
-    @BeforeEach
-    public void setup() {
+    @BeforeAll
+    public static void setup() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
+        System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
     }
 
-    @AfterEach
-    public void tearDown() throws Exception {
+    @AfterAll
+    public static void clearSetup() {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
+        System.clearProperty(SaslTestUtil.authProviderProperty);
     }
 
     @Test
@@ -46,7 +48,7 @@ public void testClientOpWithoutSASLConfigured() throws Exception {
         CountdownWatcher watcher = new CountdownWatcher();
         try {
             zk = createClient(watcher);
-            zk.create("/foo", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            zk.create("/foo", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             fail("Client is not configured with SASL authentication, so zk.create operation should fail.");
         } catch (KeeperException e) {
             assertTrue(e.code() == KeeperException.Code.SESSIONCLOSEDREQUIRESASLAUTH);

From e4534976898520b5c334a55761672dc03dff5727 Mon Sep 17 00:00:00 2001
From: Nishanth Entoor <entoor.nishanth@gmail.com>
Date: Tue, 20 Oct 2020 20:13:42 -0700
Subject: [PATCH 106/591] ZOOKEEPER-3722: make logs of ResponseCache more
 readable

As per [ZOOKEEPER-3722](https://issues.apache.org/jira/browse/ZOOKEEPER-3722), we need to make ResponseCache logs more readable by adding the request type to the logs. For this I made the following changes:
- Added a parameter named requestType to ResponseCache constructor.
- Passed requestType as getData and getChild when the constructor is called to initialize readResponseCache and getChildrenResponseCache respectively.

Please let me know if additional changes are required.

Author: Nishanth Entoor <entoor.nishanth@gmail.com>

Reviewers: hanm, HorizonNet, maoling

Closes #1253 from nishanth-entoor/ZOOKEEPER-3722
---
 .../main/java/org/apache/zookeeper/server/ResponseCache.java  | 4 ++--
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
index 4a76a0f89e4..5c74caa122b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
@@ -39,10 +39,10 @@ private static class Entry {
 
     private final Map<String, Entry> cache;
 
-    public ResponseCache(int cacheSize) {
+    public ResponseCache(int cacheSize, String requestType) {
         this.cacheSize = cacheSize;
         cache = Collections.synchronizedMap(new LRUCache<>(cacheSize));
-        LOG.info("Response cache size is initialized with value {}.", cacheSize);
+        LOG.info("{} response cache size is initialized with value {}.", requestType, cacheSize);
     }
 
     public int getCacheSize() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 00550be2aec..d277851be33 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -327,11 +327,11 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
 
         readResponseCache = new ResponseCache(Integer.getInteger(
             GET_DATA_RESPONSE_CACHE_SIZE,
-            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE));
+            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE), "getData");
 
         getChildrenResponseCache = new ResponseCache(Integer.getInteger(
             GET_CHILDREN_RESPONSE_CACHE_SIZE,
-            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE));
+            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE), "getChildren");
 
         this.initialConfig = initialConfig;
 

From f06db8c91becf812c539747a406ba84635b2c1ac Mon Sep 17 00:00:00 2001
From: kamaci <furkankamaci@gmail.com>
Date: Tue, 20 Oct 2020 20:17:34 -0700
Subject: [PATCH 107/591] ZOOKEEPER-3971: Auto close resources with try catch
 block

Author: kamaci <furkankamaci@gmail.com>

Reviewers: Michael Han <hanm@apache.org>, Enrico Olivelli <eolivelli@gmail.com>, Christopher Tubbs

Closes #1507 from kamaci/ZOOKEEPER-3971
---
 .../server/persistence/FileTxnLog.java        | 23 ++-----------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index 62969bac8a6..366d5023fcc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -354,10 +354,7 @@ public long getLastLoggedZxid() {
         // if a log file is more recent we must scan it to find
         // the highest zxid
         long zxid = maxLog;
-        TxnIterator itr = null;
-        try {
-            FileTxnLog txn = new FileTxnLog(logDir);
-            itr = txn.read(maxLog);
+        try (FileTxnLog txn = new FileTxnLog(logDir); TxnIterator itr = txn.read(maxLog)) {
             while (true) {
                 if (!itr.next()) {
                     break;
@@ -367,22 +364,10 @@ public long getLastLoggedZxid() {
             }
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
-        } finally {
-            close(itr);
         }
         return zxid;
     }
 
-    private void close(TxnIterator itr) {
-        if (itr != null) {
-            try {
-                itr.close();
-            } catch (IOException ioe) {
-                LOG.warn("Error closing file iterator", ioe);
-            }
-        }
-    }
-
     /**
      * commit the logs. make sure that everything hits the
      * disk
@@ -468,9 +453,7 @@ public TxnIterator read(long zxid, boolean fastForward) throws IOException {
      * @return true if successful false if not
      */
     public boolean truncate(long zxid) throws IOException {
-        FileTxnIterator itr = null;
-        try {
-            itr = new FileTxnIterator(this.logDir, zxid);
+        try (FileTxnIterator itr = new FileTxnIterator(this.logDir, zxid)) {
             PositionInputStream input = itr.inputStream;
             if (input == null) {
                 throw new IOException("No log files found to truncate! This could "
@@ -487,8 +470,6 @@ public boolean truncate(long zxid) throws IOException {
                     LOG.warn("Unable to truncate {}", itr.logFile);
                 }
             }
-        } finally {
-            close(itr);
         }
         return true;
     }

From ffcea5b291c5a26fd8dff66a9752b80f559394e1 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Thu, 22 Oct 2020 07:50:53 +0000
Subject: [PATCH 108/591] ZOOKEEPER-3983: Avoid mocking unix domain sockets

This fixes issues with the C client tests, causing them to hang if
certain nameservices are in use (such as SSS), which use UNIX domain
sockets for getting the `getlogin()` and `getpwuid_r()`

This change makes the mocking of sockets less aggressive, since the
tests do not need to mock `AF_UNIX` socket types.

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Damien Diederen <dd@crosstwine.com>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1514 from ctubbsii/ZOOKEEPER-3983-no-mock-unix-sockets
---
 zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc b/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc
index 870a554ca3b..8a46ee54dcc 100644
--- a/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc
@@ -259,7 +259,12 @@ int setsockopt(int s,int level,int optname,const void *optval,socklen_t optlen){
     return Mock_socket::mock_->callSet(s,level,optname,optval,optlen);      
 }
 int connect(int s,const struct sockaddr *addr,socklen_t len){
+#ifdef AF_UNIX
+    /* don't mock UNIX domain sockets */
+    if (!Mock_socket::mock_ || addr->sa_family == AF_UNIX)
+#else
     if (!Mock_socket::mock_)
+#endif
         return LIBC_SYMBOLS.connect(s,addr,len);
     return Mock_socket::mock_->callConnect(s,addr,len);
 }

From 3ff30a6427fdc2f13e60ff530800eca55ff02c9a Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Sat, 24 Oct 2020 13:18:10 +0000
Subject: [PATCH 109/591] ZOOKEEPER-3981: Flaky test
 MultipleAddressTest::testGetValidAddressWithNotValid

Problem:

Test MultipleAddressTest::testGetValidAddressWithNotValid might fail deterministically when the address it's using, 10.0.0.1, is reachable, as per https://tools.ietf.org/html/rfc5735 10.0.0.1 might be allocatable to private network usage. In fact, the router address of my ISP is assigned this IP, leading to this test always failing for me.

Solution:

Replace the address with 240.0.0.0, which is reserved for future use and less likely to be reachable.

Author: Michael Han <michael@lianghan.org>
Author: Michael Han <hanm@apache.org>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1511 from hanm/fixut
---
 .../zookeeper/server/quorum/MultipleAddressesTest.java       | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
index bf86ce0f430..498f5f07cb0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
@@ -110,7 +110,8 @@ public void testGetValidAddress() throws NoRouteToHostException {
     @Test
     public void testGetValidAddressWithNotValid() {
         assertThrows(NoRouteToHostException.class, () -> {
-            MultipleAddresses multipleAddresses = new MultipleAddresses(new InetSocketAddress("10.0.0.1", 22));
+            // IP chosen because it is reserved for documentation/examples and should be unreachable (RFC 5737)
+            MultipleAddresses multipleAddresses = new MultipleAddresses(new InetSocketAddress("203.0.113.1", 22));
             multipleAddresses.getReachableAddress();
         });
     }
@@ -259,4 +260,4 @@ private List<String> getHostStrings(List<InetSocketAddress> addresses) {
                 .mapToObj(i -> "127.0.0." + i).collect(Collectors.toList());
     }
 
-}
\ No newline at end of file
+}

From a6ca5f307e20df1e62ce5415d84235ec00f57286 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sun, 25 Oct 2020 15:02:24 +0000
Subject: [PATCH 110/591] ZOOKEEPER-3969: Add whoami API and Cli command

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <dd@crosstwine.com>, Mate Szalay-Beko <symat@apache.org>

Closes #1504 from arshadmohammad/whoami-master
---
 .../src/main/resources/zookeeper.jute         | 10 +++
 .../java/org/apache/zookeeper/ZooDefs.java    |  2 +
 .../java/org/apache/zookeeper/ZooKeeper.java  | 16 ++++
 .../apache/zookeeper/cli/CommandFactory.java  |  3 +-
 .../apache/zookeeper/cli/WhoAmICommand.java   | 55 +++++++++++++
 .../server/FinalRequestProcessor.java         |  7 ++
 .../server/PrepRequestProcessor.java          |  1 +
 .../org/apache/zookeeper/server/Request.java  |  4 +
 .../zookeeper/server/util/AuthUtil.java       | 18 +++++
 .../org/apache/zookeeper/ZooKeeperTest.java   | 80 ++++++++++++++++++-
 10 files changed, 193 insertions(+), 3 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java

diff --git a/zookeeper-jute/src/main/resources/zookeeper.jute b/zookeeper-jute/src/main/resources/zookeeper.jute
index 898838f62f6..796ea396755 100644
--- a/zookeeper-jute/src/main/resources/zookeeper.jute
+++ b/zookeeper-jute/src/main/resources/zookeeper.jute
@@ -51,6 +51,11 @@ module org.apache.zookeeper.data {
         long ephemeralOwner; // owner id if ephemeral, 0 otw
         long pzxid;      // last modified children
     }
+
+    class ClientInfo {
+        ustring authScheme; // Authentication scheme
+        ustring user;       // user name or any other id(for example ip)
+    }
 }
 
 module org.apache.zookeeper.proto {
@@ -248,6 +253,11 @@ module org.apache.zookeeper.proto {
     class GetEphemeralsResponse {
         vector<ustring> ephemerals;
     }
+
+    class WhoAmIResponse {
+        vector<org.apache.zookeeper.data.ClientInfo> clientInfo;
+    }
+
 }
 
 module org.apache.zookeeper.server.quorum {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
index a12e5803c27..9cf70787668 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
@@ -93,6 +93,8 @@ public interface OpCode {
 
         int addWatch = 106;
 
+        int whoAmI = 107;
+
         int createSession = -10;
 
         int closeSession = -11;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 6b723af0ac0..593086708cd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -49,6 +49,7 @@
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.AddWatchRequest;
 import org.apache.zookeeper.proto.CheckWatchesRequest;
@@ -80,6 +81,7 @@
 import org.apache.zookeeper.proto.SetDataResponse;
 import org.apache.zookeeper.proto.SyncRequest;
 import org.apache.zookeeper.proto.SyncResponse;
+import org.apache.zookeeper.proto.WhoAmIResponse;
 import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.EphemeralType;
 import org.slf4j.Logger;
@@ -3070,4 +3072,18 @@ private void validateACL(List<ACL> acl) throws KeeperException.InvalidACLExcepti
         }
     }
 
+    /**
+     * Gives all authentication information added into the current session.
+     *
+     * @return list of authentication info
+     * @throws InterruptedException when interrupted
+     */
+    public synchronized List<ClientInfo> whoAmI() throws InterruptedException {
+        RequestHeader h = new RequestHeader();
+        h.setType(ZooDefs.OpCode.whoAmI);
+        WhoAmIResponse response = new WhoAmIResponse();
+        cnxn.submitRequest(h, null, response, null);
+        return response.getClientInfo();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
index 87f016398d7..681eabad512 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
@@ -50,7 +50,8 @@ public enum Command {
         GET_EPHEMERALS(GetEphemeralsCommand::new),
         GET_ALL_CHILDREN_NUMBER(GetAllChildrenNumberCommand::new),
         VERSION(VersionCommand::new),
-        ADD_WATCH(AddWatchCommand::new);
+        ADD_WATCH(AddWatchCommand::new),
+        WHO_AM_I(WhoAmICommand::new);
 
         private Supplier<? extends CliCommand> instantiator;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java
new file mode 100644
index 00000000000..62b7099acb0
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.util.List;
+import org.apache.zookeeper.data.ClientInfo;
+
+/**
+ * WhoAmI command for cli
+ */
+public class WhoAmICommand extends CliCommand {
+
+    public WhoAmICommand() {
+        super("whoami", "");
+    }
+
+    @Override
+    public CliCommand parse(String[] cmdArgs) throws CliParseException {
+        return this;
+    }
+
+    @Override
+    public boolean exec() throws CliException {
+        try {
+            List<ClientInfo> clientInfos = zk.whoAmI();
+            out.println("Auth scheme: User");
+            if (clientInfos != null) {
+                // clientInfos will never be null, added null check to pass static checks
+                clientInfos.forEach(clientInfo -> {
+                    out.println(clientInfo.getAuthScheme() + ": " + clientInfo.getUser());
+                });
+            }
+        } catch (Exception ex) {
+            throw new CliWrapperException(ex);
+        }
+        return false;
+    }
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 26d5bafa822..889e7ede4c1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -76,8 +76,10 @@
 import org.apache.zookeeper.proto.SetWatches2;
 import org.apache.zookeeper.proto.SyncRequest;
 import org.apache.zookeeper.proto.SyncResponse;
+import org.apache.zookeeper.proto.WhoAmIResponse;
 import org.apache.zookeeper.server.DataTree.ProcessTxnResult;
 import org.apache.zookeeper.server.quorum.QuorumZooKeeperServer;
+import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.server.util.RequestPathMetricsCollector;
 import org.apache.zookeeper.txn.ErrorTxn;
 import org.slf4j.Logger;
@@ -546,6 +548,11 @@ public void processRequest(Request request) {
                 requestPathMetricsCollector.registerRequest(request.type, removeWatches.getPath());
                 break;
             }
+            case OpCode.whoAmI: {
+                lastOp = "HOMI";
+                rsp = new WhoAmIResponse(AuthUtil.getClientInfos(request.authInfo));
+                break;
+             }
             case OpCode.getEphemerals: {
                 lastOp = "GETE";
                 GetEphemeralsRequest getEphemerals = new GetEphemeralsRequest();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 010faf51a2d..9a5c1251283 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -915,6 +915,7 @@ private void pRequestHelper(Request request) throws RequestProcessorException {
             case OpCode.getEphemerals:
             case OpCode.multiRead:
             case OpCode.addWatch:
+            case OpCode.whoAmI:
                 zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
                 break;
             default:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 42964712bb0..c2c4da54d27 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -271,6 +271,7 @@ static boolean isValid(int type) {
         case OpCode.checkWatches:
         case OpCode.removeWatches:
         case OpCode.addWatch:
+        case OpCode.whoAmI:
             return true;
         default:
             return false;
@@ -287,6 +288,7 @@ public boolean isQuorum() {
         case OpCode.getData:
         case OpCode.getEphemerals:
         case OpCode.multiRead:
+        case OpCode.whoAmI:
             return false;
         case OpCode.create:
         case OpCode.create2:
@@ -373,6 +375,8 @@ public static String op2String(int op) {
                 return "closeSession";
             case OpCode.error:
                 return "error";
+            case OpCode.whoAmI:
+                return "whoAmI";
             default:
                 return "unknown " + op;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
index 3b0b7e43d7e..7e5ca4f7267 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
@@ -17,6 +17,9 @@
  */
 package org.apache.zookeeper.server.util;
 
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.AuthenticationProvider;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
@@ -36,4 +39,19 @@ public static String getUser(Id id) {
         AuthenticationProvider provider = ProviderRegistry.getProvider(id.getScheme());
         return provider == null ? null : provider.getUserName(id.getId());
     }
+
+    /**
+     * Gets user from id to prepare ClientInfo.
+     *
+     * @param authInfo List of id objects. id contains scheme and authentication info
+     * @return list of client authentication info
+     */
+    public static List<ClientInfo> getClientInfos(List<Id> authInfo) {
+        List<ClientInfo> clientAuthInfo = new ArrayList<>(authInfo.size());
+        authInfo.forEach(id -> {
+            String user = AuthUtil.getUser(id);
+            clientAuthInfo.add(new ClientInfo(id.getScheme(), user == null ? "" : user));
+        });
+        return clientAuthInfo;
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 7074896bcff..b726c47da06 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -39,12 +39,14 @@
 import org.apache.zookeeper.cli.MalformedCommandException;
 import org.apache.zookeeper.cli.MalformedPathException;
 import org.apache.zookeeper.cli.SyncCommand;
+import org.apache.zookeeper.cli.WhoAmICommand;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
@@ -517,14 +519,18 @@ private String executeLine(ZooKeeperMain zkMain, String cmd)
     }
 
     private static void runCommandExpect(CliCommand command, List<String> expectedResults) throws Exception {
+        String result = runCommandExpect(command);
+        assertTrue(result.contains(StringUtils.joinStrings(expectedResults, LINE_SEPARATOR)), result);
+    }
+
+    private static String runCommandExpect(CliCommand command) throws CliException {
         // call command and put result in byteStream
         ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
         PrintStream out = new PrintStream(byteStream);
         command.setOut(out);
         command.exec();
 
-        String result = byteStream.toString();
-        assertTrue(result.contains(StringUtils.joinStrings(expectedResults, LINE_SEPARATOR)), result);
+        return byteStream.toString();
     }
 
     @Test
@@ -698,4 +704,74 @@ public void testInsufficientPermission() throws Exception {
         assertEquals("Insufficient permission : " + zNodeToBeCreated, errorMessage);
     }
 
+    @Test
+    public void testWhoAmIAPI() throws Exception {
+        final ZooKeeper zk = createClient();
+
+        // Check who ami without authentication/without any user into the session
+        List<ClientInfo> clientInfos = zk.whoAmI();
+        // By default server adds ip as the authentication info
+        assertEquals(1, clientInfos.size());
+        assertEquals("ip", clientInfos.get(0).getAuthScheme());
+
+        // Add one user into the session
+        zk.addAuthInfo("digest", "user1:abcXYZ".getBytes());
+        clientInfos = zk.whoAmI();
+        assertEquals(2, clientInfos.size());
+        ClientInfo user1 = getClientInfos(clientInfos, "user1");
+        assertEquals("digest", user1.getAuthScheme());
+
+        // Add one more user into the session
+        zk.addAuthInfo("digest", "user2:xyzABC".getBytes());
+        clientInfos = zk.whoAmI();
+        assertEquals(3, clientInfos.size());
+        user1 = getClientInfos(clientInfos, "user1");
+        assertEquals("digest", user1.getAuthScheme());
+        ClientInfo user2 = getClientInfos(clientInfos, "user2");
+        assertEquals("digest", user2.getAuthScheme());
+    }
+
+    private ClientInfo getClientInfos(List<ClientInfo> clientInfos, String user) {
+        for (ClientInfo clientInfo : clientInfos) {
+            if (clientInfo.getUser().equals(user)) {
+                return clientInfo;
+            }
+        }
+        throw new AssertionError("User +" + user + " not found");
+    }
+
+    @Test
+    public void testWhoAmICLICommand() throws Exception {
+        final ZooKeeper zk = createClient();
+        WhoAmICommand cmd = new WhoAmICommand();
+        cmd.setZk(zk);
+        List<String> expectedResults = new ArrayList<>();
+        expectedResults.add("Auth scheme: User");
+        expectedResults.add("ip: 127.0.0.1");
+
+        // Check who ami without authentication/without any user into the session
+        cmd.parse(new String[] { "whoami" });
+        String actualResult = runCommandExpect(cmd);
+        assertClientAuthInfo(expectedResults, actualResult);
+
+        // Add one user into the session
+        zk.addAuthInfo("digest", "user1:abcXYZ".getBytes());
+        expectedResults.add("digest: user1");
+        actualResult = runCommandExpect(cmd);
+        assertClientAuthInfo(expectedResults, actualResult);
+
+        // Add one more user into the session
+        zk.addAuthInfo("digest", "user2:xyzABC".getBytes());
+        expectedResults.add("digest: user2");
+        actualResult = runCommandExpect(cmd);
+        assertClientAuthInfo(expectedResults, actualResult);
+    }
+
+    private void assertClientAuthInfo(List<String> expected, String actual) {
+        expected.forEach(s -> {
+            assertTrue(actual.contains(s),
+                "Expected result part '" + s + "' not present in actual result '" + actual + "' ");
+        });
+    }
+
 }

From b59bf6b40d9948e4a9034b6342b7f98a71d8d616 Mon Sep 17 00:00:00 2001
From: Anup Ghatage <ghatage@apache.org>
Date: Wed, 28 Oct 2020 10:18:26 +0000
Subject: [PATCH 111/591] =?UTF-8?q?ZOOKEEPER-3926:=20Remove=20hardcoded=20?=
 =?UTF-8?q?comparisons=20to=20more=20maintainable=20an=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…d readable comparisons.

There are many more such instances in some tests etc but didn't change them here as the coding guidelines suggested to only make changes related to what is asked in the jira. Can take those up in a new Jira if this is accepted by the maintainers as worthwhile.

Author: Ghatage <ghatageanup@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1497 from Ghatage/ZOOKEEPER-3926
---
 .../java/org/apache/zookeeper/ClientCnxn.java | 20 +++++++++----------
 .../java/org/apache/zookeeper/ZooKeeper.java  |  9 +++++----
 .../zookeeper/server/NettyServerCnxnTest.java |  2 +-
 .../apache/zookeeper/test/IntegrityCheck.java |  4 ++--
 .../test/PersistentRecursiveWatcherTest.java  |  2 +-
 .../zookeeper/test/PersistentWatcherTest.java |  4 ++--
 .../apache/zookeeper/test/WatcherTest.java    |  2 +-
 7 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 4dc6fdeaf2e..ecd2a0a9d09 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -618,7 +618,7 @@ private void processEvent(Object event) {
                                || p.response instanceof SetDataResponse
                                || p.response instanceof SetACLResponse) {
                         StatCallback cb = (StatCallback) p.cb;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             if (p.response instanceof ExistsResponse) {
                                 cb.processResult(rc, clientPath, p.ctx, ((ExistsResponse) p.response).getStat());
                             } else if (p.response instanceof SetDataResponse) {
@@ -632,7 +632,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetDataResponse) {
                         DataCallback cb = (DataCallback) p.cb;
                         GetDataResponse rsp = (GetDataResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getData(), rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -640,7 +640,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetACLResponse) {
                         ACLCallback cb = (ACLCallback) p.cb;
                         GetACLResponse rsp = (GetACLResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getAcl(), rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -648,7 +648,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetChildrenResponse) {
                         ChildrenCallback cb = (ChildrenCallback) p.cb;
                         GetChildrenResponse rsp = (GetChildrenResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getChildren());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null);
@@ -656,7 +656,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetAllChildrenNumberResponse) {
                         AllChildrenNumberCallback cb = (AllChildrenNumberCallback) p.cb;
                         GetAllChildrenNumberResponse rsp = (GetAllChildrenNumberResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getTotalNumber());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, -1);
@@ -664,7 +664,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetChildren2Response) {
                         Children2Callback cb = (Children2Callback) p.cb;
                         GetChildren2Response rsp = (GetChildren2Response) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getChildren(), rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -672,7 +672,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof CreateResponse) {
                         StringCallback cb = (StringCallback) p.cb;
                         CreateResponse rsp = (CreateResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(
                                 rc,
                                 clientPath,
@@ -686,7 +686,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof Create2Response) {
                         Create2Callback cb = (Create2Callback) p.cb;
                         Create2Response rsp = (Create2Response) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(
                                     rc,
                                     clientPath,
@@ -701,7 +701,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof MultiResponse) {
                         MultiCallback cb = (MultiCallback) p.cb;
                         MultiResponse rsp = (MultiResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             List<OpResult> results = rsp.getResultList();
                             int newRc = rc;
                             for (OpResult result : results) {
@@ -718,7 +718,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetEphemeralsResponse) {
                         EphemeralsCallback cb = (EphemeralsCallback) p.cb;
                         GetEphemeralsResponse rsp = (GetEphemeralsResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, p.ctx, rsp.getEphemerals());
                         } else {
                             cb.processResult(rc, p.ctx, null);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 593086708cd..622ccd53365 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -299,7 +299,7 @@ public void register(int rc) {
          * @return true if the watch should be added, otw false
          */
         protected boolean shouldAddWatch(int rc) {
-            return rc == 0;
+            return rc == KeeperException.Code.OK.intValue();
         }
 
     }
@@ -315,12 +315,13 @@ public ExistsWatchRegistration(Watcher watcher, String clientPath) {
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return rc == 0 ? getWatchManager().getDataWatches() : getWatchManager().getExistWatches();
+            return rc == KeeperException.Code.OK.intValue()
+                    ? getWatchManager().getDataWatches() : getWatchManager().getExistWatches();
         }
 
         @Override
         protected boolean shouldAddWatch(int rc) {
-            return rc == 0 || rc == KeeperException.Code.NONODE.intValue();
+            return rc == KeeperException.Code.OK.intValue() || rc == KeeperException.Code.NONODE.intValue();
         }
 
     }
@@ -372,7 +373,7 @@ protected Map<String, Set<Watcher>> getWatches(int rc) {
 
         @Override
         protected boolean shouldAddWatch(int rc) {
-            return rc == 0 || rc == KeeperException.Code.NONODE.intValue();
+            return rc == KeeperException.Code.OK.intValue() || rc == KeeperException.Code.NONODE.intValue();
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index cd7842fa309..67a4cc5aba2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -302,7 +302,7 @@ public void run() {
                             zk.getData(path, null, new DataCallback() {
                                 @Override
                                 public void processResult(int rc, String path, Object ctx, byte[] data, Stat stat) {
-                                    if (rc == 0) {
+                                    if (rc == KeeperException.Code.OK.intValue()) {
                                         successResponse.addAndGet(1);
                                     } else {
                                         LOG.info("failed response is {}", rc);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
index 1a238dfe7dc..4aba36da244 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
@@ -194,7 +194,7 @@ public void run() {
     }
 
     public void processResult(int rc, String path, Object ctx, Stat stat) {
-        if (rc == 0) {
+        if (rc == KeeperException.Code.OK.intValue()) {
             lastValue.put(path, (byte[]) ctx);
         }
         decOutstanding();
@@ -202,7 +202,7 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
 
     public void processResult(
             int rc, String path, Object ctx, byte[] data, Stat stat) {
-        if (rc == 0) {
+        if (rc == KeeperException.Code.OK.intValue()) {
             String string = new String(data);
             String lastString = null;
             byte[] v = lastValue.get(path);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index bc696439b04..80d8c400cd2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -68,7 +68,7 @@ public void testBasicAsync()
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             final CountDownLatch latch = new CountDownLatch(1);
             AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {
-                if (rc == 0) {
+                if (rc == KeeperException.Code.OK.intValue()) {
                     latch.countDown();
                 }
             };
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
index 4e6a0ff1154..754ba76ae84 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
@@ -92,7 +92,7 @@ public synchronized void process(WatchedEvent event) {
         try (ZooKeeper zk = createClient(watcher, hostPort)) {
             final CountDownLatch latch = new CountDownLatch(1);
             AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {
-                if (rc == 0) {
+                if (rc == KeeperException.Code.OK.intValue()) {
                     latch.countDown();
                 }
             };
@@ -109,7 +109,7 @@ public void testAsyncDefaultWatcher()
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             final CountDownLatch latch = new CountDownLatch(1);
             AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {
-                if (rc == 0) {
+                if (rc == KeeperException.Code.OK.intValue()) {
                     latch.countDown();
                 }
             };
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
index 4260c3c15de..8a17885b18b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
@@ -258,7 +258,7 @@ public void testWatchAutoResetWithPending() throws Exception {
             assertEquals(1, watches[i].events.size(), "For " + i);
         }
         for (int i = COUNT / 2; i < COUNT; i++) {
-            if (cbs[i].rc == 0) {
+            if (cbs[i].rc == KeeperException.Code.OK.intValue()) {
                 assertEquals(1, watches[i].events.size(), "For " + i);
             } else {
                 assertEquals(0, watches[i].events.size(), "For " + i);

From 8853b33fa6abd132ab7d446296eca5f4445f9c2c Mon Sep 17 00:00:00 2001
From: Anup Ghatage <ghatage@apache.org>
Date: Wed, 28 Oct 2020 15:27:44 +0000
Subject: [PATCH 112/591] ZOOKEEPER-2649: Add more session and authentication
 information to SASL success and failure logs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…ASL success and failure logs.

Another one from the backlogs - created in 2016, no activity since 6 months.

JIRA: https://issues.apache.org/jira/browse/ZOOKEEPER-2649

cc eolivelli

Author: Ghatage <ghatageanup@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1498 from Ghatage/ZOOKEEPER-2649
---
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index d277851be33..ab556f59954 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1601,8 +1601,9 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
                 }
             }
             if (authReturn == KeeperException.Code.OK) {
-                LOG.debug("Authentication succeeded for scheme: {}", scheme);
-                LOG.info("auth success {}", cnxn.getRemoteSocketAddress());
+                LOG.info("Session 0x{}: auth success for scheme {} and address {}",
+                        Long.toHexString(cnxn.getSessionId()), scheme,
+                        cnxn.getRemoteSocketAddress());
                 ReplyHeader rh = new ReplyHeader(h.getXid(), 0, KeeperException.Code.OK.intValue());
                 cnxn.sendResponse(rh, null, null);
             } else {
@@ -1663,7 +1664,8 @@ private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHead
                 responseToken = saslServer.evaluateResponse(clientToken);
                 if (saslServer.isComplete()) {
                     String authorizationID = saslServer.getAuthorizationID();
-                    LOG.info("adding SASL authorization for authorizationID: {}", authorizationID);
+                    LOG.info("Session 0x{}: adding SASL authorization for authorizationID: {}",
+                            Long.toHexString(cnxn.getSessionId()), authorizationID);
                     cnxn.addAuthInfo(new Id("sasl", authorizationID));
                     if (System.getProperty("zookeeper.superUser") != null
                         && authorizationID.equals(System.getProperty("zookeeper.superUser"))) {

From 8654e7ed37717df79eb06f75de43eafe4f47b175 Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Fri, 30 Oct 2020 12:03:41 +0100
Subject: [PATCH 113/591] ZOOKEEPER-3342: Use StandardCharsets

> Encodes this String into a sequence of bytes using the platform's default charset, storing the result into a new byte array.  The behavior of this method when this string cannot be encoded in the default charset is unspecified.

https://docs.oracle.com/javase/8/docs/api/java/lang/String.html#getBytes--

1.  Since this is a distributed system, it is always possible that different nodes have different default charsets defined.  I think it's most safe to specify it explicitly across all nodes for safety sake.  You could for example see a situation where an upgrade JVM uses a different default and during a rolling upgrade of the JVM, different nodes now have a different default.
2.  The default charset is usually "ISO-8859-1".  UTF-8 covers more of our international friends.
3. Explicitly specifying the CharSet yields slight performance gains
4. Explicitly specifying the CharSet removes the need for try/catch blocks of UnsupportedEncodingException

https://blog.codecentric.de/en/2014/04/faster-cleaner-code-since-java-7/

Author: David Mollitor <dmollitor@apache.org>
Author: Beluga Behr <dam6923@gmail.com>
Author: David Mollitor <dam6923@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <anmolnar@apache.org>

Closes #882 from belugabehr/ZOOKEEPER-3342
---
 .../recipes/queue/DistributedQueueTest.java   | 29 ++++++++++---------
 .../apache/zookeeper/ServerAdminClient.java   |  9 +++---
 .../apache/zookeeper/cli/AddAuthCommand.java  |  3 +-
 .../apache/zookeeper/cli/CreateCommand.java   |  3 +-
 .../apache/zookeeper/cli/DelQuotaCommand.java |  7 +++--
 .../org/apache/zookeeper/cli/GetCommand.java  |  3 +-
 .../zookeeper/cli/GetConfigCommand.java       |  7 +++--
 .../zookeeper/cli/ListQuotaCommand.java       |  7 +++--
 .../apache/zookeeper/cli/ReconfigCommand.java |  3 +-
 .../org/apache/zookeeper/cli/SetCommand.java  |  3 +-
 .../apache/zookeeper/cli/SetQuotaCommand.java |  9 +++---
 .../zookeeper/client/FourLetterWordMain.java  |  3 +-
 .../zookeeper/server/ContainerManager.java    |  3 +-
 .../org/apache/zookeeper/server/DataTree.java |  9 +++---
 .../server/FinalRequestProcessor.java         |  3 +-
 .../zookeeper/server/NIOServerCnxn.java       |  3 +-
 .../zookeeper/server/NettyServerCnxn.java     |  3 +-
 .../server/PrepRequestProcessor.java          |  3 +-
 .../org/apache/zookeeper/server/Request.java  |  3 +-
 .../apache/zookeeper/server/ZKDatabase.java   |  3 +-
 .../auth/DigestAuthenticationProvider.java    |  3 +-
 .../auth/EnsembleAuthenticationProvider.java  |  3 +-
 .../auth/KeyAuthenticationProvider.java       | 21 ++++----------
 .../server/quorum/FastLeaderElection.java     |  7 +++--
 .../zookeeper/server/quorum/Follower.java     |  5 ++--
 .../zookeeper/server/quorum/Leader.java       |  3 +-
 .../zookeeper/server/quorum/Learner.java      |  9 +++---
 .../zookeeper/server/quorum/Observer.java     |  3 +-
 .../server/quorum/ObserverMaster.java         |  3 +-
 .../server/quorum/QuorumCnxManager.java       |  3 +-
 .../server/quorum/QuorumZooKeeperServer.java  |  2 +-
 .../common/AtomicFileWritingIdiomTest.java    |  5 ++--
 32 files changed, 101 insertions(+), 82 deletions(-)

diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java b/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
index 0493d879235..f5ec02f9d83 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.recipes.queue;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.fail;
@@ -50,10 +51,10 @@ public void testOffer1() throws Exception {
             queueHandles[i] = new DistributedQueue(clients[i], dir, null);
         }
 
-        queueHandles[0].offer(testString.getBytes());
+        queueHandles[0].offer(testString.getBytes(UTF_8));
 
         byte[] dequeuedBytes = queueHandles[0].remove();
-        assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes, UTF_8), testString);
     }
 
     @Test
@@ -68,10 +69,10 @@ public void testOffer2() throws Exception {
             queueHandles[i] = new DistributedQueue(clients[i], dir, null);
         }
 
-        queueHandles[0].offer(testString.getBytes());
+        queueHandles[0].offer(testString.getBytes(UTF_8));
 
         byte[] dequeuedBytes = queueHandles[1].remove();
-        assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes, UTF_8), testString);
     }
 
     @Test
@@ -86,10 +87,10 @@ public void testTake1() throws Exception {
             queueHandles[i] = new DistributedQueue(clients[i], dir, null);
         }
 
-        queueHandles[0].offer(testString.getBytes());
+        queueHandles[0].offer(testString.getBytes(UTF_8));
 
         byte[] dequeuedBytes = queueHandles[0].take();
-        assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes, UTF_8), testString);
     }
 
     @Test
@@ -124,7 +125,7 @@ public void createNremoveMtest(String dir, int n, int m) throws Exception {
 
         for (int i = 0; i < n; i++) {
             String offerString = testString + i;
-            queueHandles[0].offer(offerString.getBytes());
+            queueHandles[0].offer(offerString.getBytes(UTF_8));
         }
 
         byte[] data = null;
@@ -133,7 +134,7 @@ public void createNremoveMtest(String dir, int n, int m) throws Exception {
         }
 
         assertNotNull(data);
-        assertEquals(new String(data), testString + (m - 1));
+        assertEquals(new String(data, UTF_8), testString + (m - 1));
     }
 
     @Test
@@ -157,13 +158,13 @@ public void createNremoveMelementTest(String dir, int n, int m) throws Exception
 
         for (int i = 0; i < n; i++) {
             String offerString = testString + i;
-            queueHandles[0].offer(offerString.getBytes());
+            queueHandles[0].offer(offerString.getBytes(UTF_8));
         }
 
         for (int i = 0; i < m; i++) {
             queueHandles[1].remove();
         }
-        assertEquals(new String(queueHandles[1].element()), testString + m);
+        assertEquals(new String(queueHandles[1].element(), UTF_8), testString + m);
     }
 
     @Test
@@ -211,7 +212,7 @@ public void testTakeWait1() throws Exception {
         Thread.sleep(1000);
         Thread offerThread = new Thread(() -> {
             try {
-                queueHandles[0].offer(testString.getBytes());
+                queueHandles[0].offer(testString.getBytes(UTF_8));
             } catch (KeeperException | InterruptedException ignore) {
                 // no op
             }
@@ -222,7 +223,7 @@ public void testTakeWait1() throws Exception {
         takeThread.join();
 
         assertNotNull(takeResult[0]);
-        assertEquals(new String(takeResult[0]), testString);
+        assertEquals(new String(takeResult[0], UTF_8), testString);
     }
 
     @Test
@@ -252,7 +253,7 @@ public void testTakeWait2() throws Exception {
             Thread.sleep(1000);
             Thread offerThread = new Thread(() -> {
                 try {
-                    queueHandles[0].offer(threadTestString.getBytes());
+                    queueHandles[0].offer(threadTestString.getBytes(UTF_8));
                 } catch (KeeperException | InterruptedException ignore) {
                     // no op
                 }
@@ -263,7 +264,7 @@ public void testTakeWait2() throws Exception {
             takeThread.join();
 
             assertNotNull(takeResult[0]);
-            assertEquals(new String(takeResult[0]), threadTestString);
+            assertEquals(new String(takeResult[0], UTF_8), threadTestString);
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java
index ab7b08a28d9..a08810f28f6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -52,7 +53,7 @@ public static void ruok(String host, int port) {
             byte[] resBytes = new byte[4];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
@@ -86,7 +87,7 @@ public static void dump(String host, int port) {
             byte[] resBytes = new byte[1024];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
@@ -120,7 +121,7 @@ public static void stat(String host, int port) {
             byte[] resBytes = new byte[1024];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
@@ -153,7 +154,7 @@ public static void kill(String host, int port) {
             byte[] resBytes = new byte[4];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
index b59a90d1cee..4c4aff0cefa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -57,7 +58,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     public boolean exec() throws CliException {
         byte[] b = null;
         if (args.length >= 3) {
-            b = args[2].getBytes();
+            b = args[2].getBytes(UTF_8);
         }
 
         zk.addAuthInfo(args[1], b);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
index 181a04e4635..395ffa5a8ba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
@@ -112,7 +113,7 @@ public boolean exec() throws CliException {
         String path = args[1];
         byte[] data = null;
         if (args.length > 2) {
-            data = args[2].getBytes();
+            data = args[2].getBytes(UTF_8);
         }
         List<ACL> acl = ZooDefs.Ids.OPEN_ACL_UNSAFE;
         if (args.length > 3) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
index 6d9f8705060..70c0be31ced 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
@@ -119,13 +120,13 @@ public static boolean delQuota(
             System.err.println("quota does not exist for " + path);
             return true;
         }
-        StatsTrack strack = new StatsTrack(new String(data));
+        StatsTrack strack = new StatsTrack(new String(data, UTF_8));
         if (bytes && !numNodes) {
             strack.setBytes(-1L);
-            zk.setData(quotaPath, strack.toString().getBytes(), -1);
+            zk.setData(quotaPath, strack.toString().getBytes(UTF_8), -1);
         } else if (!bytes && numNodes) {
             strack.setCount(-1);
-            zk.setData(quotaPath, strack.toString().getBytes(), -1);
+            zk.setData(quotaPath, strack.toString().getBytes(UTF_8), -1);
         } else if (bytes && numNodes) {
             // delete till you can find a node with more than
             // one child
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
index 96bf0fda20c..4cdb48d7baf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -92,7 +93,7 @@ public boolean exec() throws CliException {
             throw new CliException(ex);
         }
         data = (data == null) ? "null".getBytes() : data;
-        out.println(new String(data));
+        out.println(new String(data, UTF_8));
         if (cl.hasOption("s")) {
             new StatPrinter(out).print(stat);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
index ef583aa2e49..5da9c4f8350 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -72,11 +73,11 @@ public boolean exec() throws CliException {
         } catch (KeeperException | InterruptedException ex) {
             throw new CliWrapperException(ex);
         }
-        data = (data == null) ? "null".getBytes() : data;
+        data = (data == null) ? "null".getBytes(UTF_8) : data;
         if (cl.hasOption("c")) {
-            out.println(ConfigUtils.getClientConfigStr(new String(data)));
+            out.println(ConfigUtils.getClientConfigStr(new String(data, UTF_8)));
         } else {
-            out.println(new String(data));
+            out.println(new String(data, UTF_8));
         }
 
         if (cl.hasOption("s")) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
index 748afd2394a..4ae1d226f22 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -64,11 +65,11 @@ public boolean exec() throws CliException {
             err.println("absolute path is " + absolutePath);
             Stat stat = new Stat();
             byte[] data = zk.getData(absolutePath, false, stat);
-            StatsTrack st = new StatsTrack(new String(data));
-            out.println("Output quota for " + path + " " + st.toString());
+            StatsTrack st = new StatsTrack(new String(data, UTF_8));
+            out.println("Output quota for " + path + " " + st);
 
             data = zk.getData(Quotas.quotaZookeeper + path + "/" + Quotas.statNode, false, stat);
-            out.println("Output stat for " + path + " " + new StatsTrack(new String(data)).toString());
+            out.println("Output stat for " + path + " " + new StatsTrack(new String(data, UTF_8)));
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException.NoNodeException ne) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
index f0d9aa63cc1..8afc14bb517 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.FileInputStream;
 import java.util.Properties;
 import org.apache.commons.cli.CommandLine;
@@ -151,7 +152,7 @@ public boolean exec() throws CliException {
             }
 
             byte[] curConfig = ((ZooKeeperAdmin) zk).reconfigure(joining, leaving, members, version, stat);
-            out.println("Committed new configuration:\n" + new String(curConfig));
+            out.println("Committed new configuration:\n" + new String(curConfig, UTF_8));
 
             if (cl.hasOption("s")) {
                 new StatPrinter(out).print(stat);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
index 190ca04daff..035d82aadf8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -62,7 +63,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     @Override
     public boolean exec() throws CliException {
         String path = args[1];
-        byte[] data = args[2].getBytes();
+        byte[] data = args[2].getBytes(UTF_8);
         int version;
         if (cl.hasOption("v")) {
             version = Integer.parseInt(cl.getOptionValue("v"));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
index 68c48fa1659..f9c17f5ac32 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
@@ -169,21 +170,21 @@ public static boolean createQuota(
         strack.setBytes(bytes);
         strack.setCount(numNodes);
         try {
-            zk.create(quotaPath, strack.toString().getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create(quotaPath, strack.toString().getBytes(UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             StatsTrack stats = new StatsTrack(null);
             stats.setBytes(0L);
             stats.setCount(0);
-            zk.create(statPath, stats.toString().getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create(statPath, stats.toString().getBytes(UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         } catch (KeeperException.NodeExistsException ne) {
             byte[] data = zk.getData(quotaPath, false, new Stat());
-            StatsTrack strackC = new StatsTrack(new String(data));
+            StatsTrack strackC = new StatsTrack(new String(data, UTF_8));
             if (bytes != -1L) {
                 strackC.setBytes(bytes);
             }
             if (numNodes != -1) {
                 strackC.setCount(numNodes);
             }
-            zk.setData(quotaPath, strackC.toString().getBytes(), -1);
+            zk.setData(quotaPath, strackC.toString().getBytes(UTF_8), -1);
         }
         return true;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
index 9fa042a72c2..42a4e284e4d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.client;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -113,7 +114,7 @@ public static String send4LetterWord(
         BufferedReader reader = null;
         try {
             OutputStream outstream = sock.getOutputStream();
-            outstream.write(cmd.getBytes());
+            outstream.write(cmd.getBytes(UTF_8));
             outstream.flush();
 
             // this replicates NC - close the output stream before reading
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 63f750d3da0..9ecb8c6469f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.nio.ByteBuffer;
 import java.util.Collection;
 import java.util.HashSet;
@@ -128,7 +129,7 @@ public void checkContainers() throws InterruptedException {
         for (String containerPath : getCandidates()) {
             long startMs = Time.currentElapsedTime();
 
-            ByteBuffer path = ByteBuffer.wrap(containerPath.getBytes());
+            ByteBuffer path = ByteBuffer.wrap(containerPath.getBytes(UTF_8));
             Request request = new Request(null, 0, 0, ZooDefs.OpCode.deleteContainer, path, null);
             try {
                 LOG.info("Attempting to delete candidate container: {}", containerPath);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index d3529cf94e6..afb549fce27 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.EOFException;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -391,10 +392,10 @@ public void updateCountBytes(String lastPrefix, long bytesDiff, int countDiff) {
             return;
         }
         synchronized (node) {
-            updatedStat = new StatsTrack(new String(node.data));
+            updatedStat = new StatsTrack(new String(node.data, UTF_8));
             updatedStat.setCount(updatedStat.getCount() + countDiff);
             updatedStat.setBytes(updatedStat.getBytes() + bytesDiff);
-            node.data = updatedStat.toString().getBytes();
+            node.data = updatedStat.toString().getBytes(UTF_8);
         }
         // now check if the counts match the quota
         String quotaNode = Quotas.quotaPath(lastPrefix);
@@ -406,7 +407,7 @@ public void updateCountBytes(String lastPrefix, long bytesDiff, int countDiff) {
             return;
         }
         synchronized (node) {
-            thisStats = new StatsTrack(new String(node.data));
+            thisStats = new StatsTrack(new String(node.data, UTF_8));
         }
         if (thisStats.getCount() > -1 && (thisStats.getCount() < updatedStat.getCount())) {
             LOG.warn(
@@ -1260,7 +1261,7 @@ private void updateQuotaForPath(String path) {
         }
         synchronized (node) {
             nodes.preChange(statPath, node);
-            node.data = strack.toString().getBytes();
+            node.data = strack.toString().getBytes(UTF_8);
             nodes.postChange(statPath, node);
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 889e7ede4c1..6db245e060d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.ArrayList;
@@ -329,7 +330,7 @@ public void processRequest(Request request) {
             case OpCode.reconfig: {
                 lastOp = "RECO";
                 rsp = new GetDataResponse(
-                    ((QuorumZooKeeperServer) zks).self.getQuorumVerifier().toString().getBytes(),
+                    ((QuorumZooKeeperServer) zks).self.getQuorumVerifier().toString().getBytes(UTF_8),
                     rc.stat);
                 err = Code.get(rc.err);
                 break;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index fd29aef59da..2e65da84044 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedWriter;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -442,7 +443,7 @@ private class SendBufferWriter extends Writer {
          */
         private void checkFlush(boolean force) {
             if ((force && sb.length() > 0) || sb.length() > 2048) {
-                sendBufferSync(ByteBuffer.wrap(sb.toString().getBytes()));
+                sendBufferSync(ByteBuffer.wrap(sb.toString().getBytes(UTF_8)));
                 // clear our internal buffer
                 sb.setLength(0);
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index e3acdcdca80..110807a4cf5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.ByteBufUtil;
 import io.netty.buffer.CompositeByteBuf;
@@ -233,7 +234,7 @@ private class SendBufferWriter extends Writer {
          */
         private void checkFlush(boolean force) {
             if ((force && sb.length() > 0) || sb.length() > 2048) {
-                sendBuffer(ByteBuffer.wrap(sb.toString().getBytes()));
+                sendBuffer(ByteBuffer.wrap(sb.toString().getBytes(UTF_8)));
                 // clear our internal buffer
                 sb.setLength(0);
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 9a5c1251283..6eb7b96ec53 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.StringReader;
@@ -331,7 +332,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             break;
         }
         case OpCode.deleteContainer: {
-            String path = new String(request.request.array());
+            String path = new String(request.request.array(), UTF_8);
             String parentPath = getParentPathAndValidate(path);
             ChangeRecord nodeRecord = getRecordForPath(path);
             if (nodeRecord.childCount > 0) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index c2c4da54d27..0a8bde6f618 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.nio.ByteBuffer;
 import java.util.List;
 import org.apache.jute.Record;
@@ -408,7 +409,7 @@ public String toString() {
                 if (pathLen >= 0 && pathLen < 4096 && rbuf.remaining() >= pathLen) {
                     byte[] b = new byte[pathLen];
                     rbuf.get(b);
-                    path = new String(b);
+                    path = new String(b, UTF_8);
                 }
             } catch (Exception e) {
                 // ignore - can't find the path, will output "n/a" instead
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index f758f5de5ae..9d40c5ae8bf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -677,7 +678,7 @@ public synchronized void initConfigInZKDatabase(QuorumVerifier qv) {
             }
             this.dataTree.setData(
                 ZooDefs.CONFIG_NODE,
-                qv.toString().getBytes(),
+                qv.toString().getBytes(UTF_8),
                 -1,
                 qv.getVersion(),
                 Time.currentWallTime());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
index 2330000a6f3..573cba386ba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.auth;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import org.apache.zookeeper.KeeperException;
@@ -88,7 +89,7 @@ private static char encode(int i) {
 
     public static String generateDigest(String idPassword) throws NoSuchAlgorithmException {
         String[] parts = idPassword.split(":", 2);
-        byte[] digest = MessageDigest.getInstance("SHA1").digest(idPassword.getBytes());
+        byte[] digest = MessageDigest.getInstance("SHA1").digest(idPassword.getBytes(UTF_8));
         return parts[0] + ":" + base64Encode(digest);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
index 5fb4de2c975..d5649c8d35c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.nio.charset.StandardCharsets;
 import java.util.HashSet;
 import java.util.Set;
 import org.apache.zookeeper.KeeperException;
@@ -76,7 +77,7 @@ public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authDat
             return KeeperException.Code.OK;
         }
 
-        String receivedEnsembleName = new String(authData);
+        String receivedEnsembleName = new String(authData, StandardCharsets.UTF_8);
 
         if (ensembleNames == null) {
             ServerMetrics.getMetrics().ENSEMBLE_AUTH_SKIP.add(1);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
index 03c15a1a559..92bb380fb46 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.auth;
 
-import java.nio.charset.StandardCharsets;
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.NoNodeException;
 import org.apache.zookeeper.data.Id;
@@ -75,8 +75,8 @@ private byte[] getKey(ZooKeeperServer zks) {
     private boolean validate(byte[] key, byte[] auth) {
         // perform arbitrary function (auth is a multiple of key)
         try {
-            String keyStr = new String(key, StandardCharsets.UTF_8);
-            String authStr = new String(auth, StandardCharsets.UTF_8);
+            String keyStr = new String(key, UTF_8);
+            String authStr = new String(auth, UTF_8);
             int keyVal = Integer.parseInt(keyStr);
             int authVal = Integer.parseInt(authStr);
             if (keyVal != 0 && ((authVal % keyVal) != 0)) {
@@ -92,22 +92,11 @@ private boolean validate(byte[] key, byte[] auth) {
     @Override
     public KeeperException.Code handleAuthentication(ServerObjs serverObjs, byte[] authData) {
         byte[] key = getKey(serverObjs.getZks());
-        String authStr = "";
+        String authStr = new String(authData, UTF_8);
         String keyStr = "";
-        try {
-            authStr = new String(authData, StandardCharsets.UTF_8);
-        } catch (Exception e) {
-            LOG.error("UTF-8", e);
-        }
         if (key != null) {
             if (!validate(key, authData)) {
-                try {
-                    keyStr = new String(key, StandardCharsets.UTF_8);
-                } catch (Exception e) {
-                    LOG.error("UTF-8", e);
-                    // empty key
-                    keyStr = authStr;
-                }
+                keyStr = new String(key, UTF_8);
                 LOG.debug("KeyAuthenticationProvider handleAuthentication ({}, {}) -> FAIL.\n", keyStr, authStr);
                 return KeeperException.Code.AUTHFAILED;
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 5f492200a5f..f141e854e8c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.nio.BufferUnderflowException;
 import java.nio.ByteBuffer;
@@ -301,7 +302,7 @@ public void run() {
 
                                 synchronized (self) {
                                     try {
-                                        rqv = self.configFromString(new String(b));
+                                        rqv = self.configFromString(new String(b, UTF_8));
                                         QuorumVerifier curQV = self.getQuorumVerifier();
                                         if (rqv.getVersion() > curQV.getVersion()) {
                                             LOG.info("{} Received version: {} my version: {}",
@@ -349,7 +350,7 @@ public void run() {
                                 self.getPeerState(),
                                 response.sid,
                                 current.getPeerEpoch(),
-                                qv.toString().getBytes());
+                                qv.toString().getBytes(UTF_8));
 
                             sendqueue.offer(notmsg);
                         } else {
@@ -697,7 +698,7 @@ private void sendNotifications() {
                 QuorumPeer.ServerState.LOOKING,
                 sid,
                 proposedEpoch,
-                qv.toString().getBytes());
+                qv.toString().getBytes(UTF_8));
 
             LOG.debug(
                 "Sending Notification: {} (n.leader), 0x{} (n.zxid), 0x{} (n.round), {} (recipient),"
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
index eb6742f5c6d..9420fc3bf96 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.Collections;
@@ -176,7 +177,7 @@ protected void processPacket(QuorumPacket qp) throws Exception {
 
             if (hdr.getType() == OpCode.reconfig) {
                 SetDataTxn setDataTxn = (SetDataTxn) txn;
-                QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData()));
+                QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData(), UTF_8));
                 self.setLastSeenQuorumVerifier(qv, true);
             }
 
@@ -213,7 +214,7 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             // get the new configuration from the request
             Request request = fzk.pendingTxns.element();
             SetDataTxn setDataTxn = (SetDataTxn) request.getTxn();
-            QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData()));
+            QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData(), UTF_8));
 
             // get new designated leader from (current) leader's message
             ByteBuffer buffer = ByteBuffer.wrap(qp.getData());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 0ddc4bef7a5..777aad07111 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedInputStream;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -1693,7 +1694,7 @@ public String getPeerInfo(long sid) {
 
     @Override
     public byte[] getQuorumVerifierBytes() {
-        return self.getLastSeenQuorumVerifier().toString().getBytes();
+        return self.getLastSeenQuorumVerifier().toString().getBytes(UTF_8);
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 8b02ac53df7..360f7b7f262 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
 import java.io.ByteArrayInputStream;
@@ -634,7 +635,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
 
                     if (pif.hdr.getType() == OpCode.reconfig) {
                         SetDataTxn setDataTxn = (SetDataTxn) pif.rec;
-                        QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData()));
+                        QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData(), UTF_8));
                         self.setLastSeenQuorumVerifier(qv, true);
                     }
 
@@ -644,7 +645,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                 case Leader.COMMITANDACTIVATE:
                     pif = packetsNotCommitted.peekFirst();
                     if (pif.hdr.getZxid() == qp.getZxid() && qp.getType() == Leader.COMMITANDACTIVATE) {
-                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) pif.rec).getData()));
+                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) pif.rec).getData(), UTF_8));
                         boolean majorChange = self.processReconfig(
                             qv,
                             ByteBuffer.wrap(qp.getData()).getLong(), qp.getZxid(),
@@ -680,7 +681,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         packet.hdr = logEntry.getHeader();
                         packet.rec = logEntry.getTxn();
                         packet.digest = logEntry.getDigest();
-                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) packet.rec).getData()));
+                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) packet.rec).getData(), UTF_8));
                         boolean majorChange = self.processReconfig(qv, suggestedLeaderId, qp.getZxid(), true);
                         if (majorChange) {
                             throw new Exception("changes proposed in reconfig");
@@ -728,7 +729,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     LOG.info("Learner received NEWLEADER message");
                     if (qp.getData() != null && qp.getData().length > 1) {
                         try {
-                            QuorumVerifier qv = self.configFromString(new String(qp.getData()));
+                            QuorumVerifier qv = self.configFromString(new String(qp.getData(), UTF_8));
                             self.setLastSeenQuorumVerifier(qv, true);
                             newLeaderQV = qv;
                         } catch (Exception e) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
index 47c58b938cd..fbf1d55449c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.nio.ByteBuffer;
 import java.util.concurrent.atomic.AtomicReference;
 import org.apache.jute.Record;
@@ -216,7 +217,7 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             hdr = logEntry.getHeader();
             txn = logEntry.getTxn();
             digest = logEntry.getDigest();
-            QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) txn).getData()));
+            QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) txn).getData(), UTF_8));
 
             request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, 0);
             request.setTxnDigest(digest);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
index 54a22c2ecbd..98c0d0c08bf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedInputStream;
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
@@ -343,7 +344,7 @@ public String getPeerInfo(long sid) {
 
     @Override
     public byte[] getQuorumVerifierBytes() {
-        return self.getLastSeenQuorumVerifier().toString().getBytes();
+        return self.getLastSeenQuorumVerifier().toString().getBytes(UTF_8);
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 7efa0de4bd9..98283fbf078 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.zookeeper.common.NetUtils.formatInetAddr;
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
@@ -255,7 +256,7 @@ public static InitialMessage parse(Long protocolVersion, DataInputStream din) th
 
             // in PROTOCOL_VERSION_V1 we expect to get a single address here represented as a 'host:port' string
             // in PROTOCOL_VERSION_V2 we expect to get multiple addresses like: 'host1:port1|host2:port2|...'
-            String[] addressStrings = new String(b).split("\\|");
+            String[] addressStrings = new String(b, UTF_8).split("\\|");
             List<InetSocketAddress> addresses = new ArrayList<>(addressStrings.length);
             for (String addr : addressStrings) {
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
index 350aa1323f0..f27ce827421 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
@@ -186,7 +186,7 @@ public void dumpConf(PrintWriter pwriter) {
         pwriter.print("peerType=");
         pwriter.println(self.getLearnerType().ordinal());
         pwriter.println("membership: ");
-        pwriter.print(new String(self.getQuorumVerifier().toString().getBytes()));
+        pwriter.print(self.getQuorumVerifier().toString());
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
index 923fc0855c1..d3e833b33e0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.Writer;
+import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.OutputStreamStatement;
@@ -335,7 +336,7 @@ public void write(Writer os) throws IOException {
         assertFalse(target.exists(), "file should not exist");
     }
 
-    private String getContent(File file, String encoding) throws IOException {
+    private String getContent(File file, Charset encoding) throws IOException {
         StringBuilder result = new StringBuilder();
         FileInputStream fis = new FileInputStream(file);
         byte[] b = new byte[20];
@@ -348,7 +349,7 @@ private String getContent(File file, String encoding) throws IOException {
     }
 
     private String getContent(File file) throws IOException {
-        return getContent(file, "ASCII");
+        return getContent(file, StandardCharsets.US_ASCII);
     }
 
     private void createFile(File file, String content) throws IOException {

From 13fe0d0ffb9fd2c379b9b430aaaf9ee75acfceba Mon Sep 17 00:00:00 2001
From: Tamas Penzes <tamaas@cloudera.com>
Date: Fri, 30 Oct 2020 13:16:09 +0100
Subject: [PATCH 114/591] =?UTF-8?q?ZOOKEEPER-3958:=20Update=20dependency?=
 =?UTF-8?q?=20versions=20and=20eliminate=20java=20docs=20wa=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…rnings

We have quite many outdated dependency which can be updated and also a few warnings during the build of JavaDocs.

Author: Tamas Penzes <tamaas@cloudera.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <anmolnar@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1485 from tamaashu/ZOOKEEPER-3958
---
 pom.xml                                       | 20 +++----
 .../zookeeper-contrib-zooinspector/ivy.xml    |  1 -
 .../zookeeper-contrib-zooinspector/pom.xml    |  5 --
 .../resources/markdown/zookeeperMonitor.md    |  6 +--
 .../zookeeper-prometheus-metrics/pom.xml      | 26 +++++++++-
 zookeeper-server/pom.xml                      |  4 +-
 .../org/apache/zookeeper/AsyncCallback.java   | 52 +++++++++----------
 .../java/org/apache/zookeeper/ZKUtil.java     |  2 +-
 .../org/apache/zookeeper/cli/AclParser.java   |  2 +-
 .../org/apache/zookeeper/cli/CliCommand.java  |  5 +-
 .../org/apache/zookeeper/jmx/ManagedUtil.java |  2 +-
 .../apache/zookeeper/server/ZKDatabase.java   |  1 -
 .../server/persistence/FileTxnLog.java        |  2 +-
 .../server/persistence/FileTxnSnapLog.java    |  2 +-
 .../server/persistence/SnapStream.java        |  2 +-
 .../zookeeper/server/persistence/Util.java    |  2 -
 .../zookeeper/server/quorum/Leader.java       |  8 ++-
 .../zookeeper/server/quorum/Learner.java      |  1 -
 .../server/quorum/LearnerHandler.java         |  1 -
 .../server/quorum/LearnerMaster.java          |  2 +-
 .../zookeeper/server/quorum/QuorumPeer.java   |  2 -
 .../zookeeper/server/util/CircularBuffer.java |  4 +-
 .../src/main/resources/LICENSE.txt            | 13 ++---
 ... => metrics-core-4.1.12.1.jar_LICENSE.txt} |  0
 ...NSE.txt => simpleclient-0.9.0.LICENSE.txt} |  0
 ... => simpleclient_common-0.9.0_LICENSE.txt} |  0
 ...=> simpleclient_hotspot-0.9.0_LICENSE.txt} |  0
 ...=> simpleclient_servlet-0.9.0_LICENSE.txt} |  0
 ...5.LICENSE.txt => slf4j-1.7.30.LICENSE.txt} |  0
 ...xt => snappy-java-1.1.7.7.jar_LICENSE.txt} |  0
 .../apache/zookeeper/RemoveWatchesTest.java   |  2 +-
 .../server/quorum/MultipleAddressesTest.java  |  3 +-
 32 files changed, 85 insertions(+), 85 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{metrics-core-3.2.5.jar_LICENSE.txt => metrics-core-4.1.12.1.jar_LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{simpleclient-0.6.0.LICENSE.txt => simpleclient-0.9.0.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{simpleclient_common-0.6.0_LICENSE.txt => simpleclient_common-0.9.0_LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{simpleclient_hotspot-0.6.0_LICENSE.txt => simpleclient_hotspot-0.9.0_LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{simpleclient_servlet-0.6.0_LICENSE.txt => simpleclient_servlet-0.9.0_LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{slf4j-1.7.25.LICENSE.txt => slf4j-1.7.30.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{snappy-java-1.1.7.jar_LICENSE.txt => snappy-java-1.1.7.7.jar_LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 031e67f0a4b..5bbf4c8576c 100755
--- a/pom.xml
+++ b/pom.xml
@@ -426,24 +426,24 @@
     <surefire-forkcount>8</surefire-forkcount>
 
     <!-- dependency versions -->
-    <slf4j.version>1.7.25</slf4j.version>
-    <audience-annotations.version>0.5.0</audience-annotations.version>
+    <slf4j.version>1.7.30</slf4j.version>
+    <audience-annotations.version>0.12.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
     <junit-platform.version>1.6.2</junit-platform.version>
     <log4j.version>1.2.17</log4j.version>
-    <mockito.version>2.27.0</mockito.version>
+    <mockito.version>2.28.2</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>
-    <jetty.version>9.4.24.v20191120</jetty.version>
-    <jackson.version>2.10.3</jackson.version>
+    <jetty.version>9.4.32.v20200930</jetty.version>
+    <jackson.version>2.10.5</jackson.version>
     <jline.version>2.14.6</jline.version>
-    <snappy.version>1.1.7</snappy.version>
+    <snappy.version>1.1.7.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.60</bouncycastle.version>
-    <commons-collections.version>3.2.2</commons-collections.version>
-    <dropwizard.version>3.2.5</dropwizard.version>
+    <commons-collections.version>4.4</commons-collections.version>
+    <dropwizard.version>4.1.12.1</dropwizard.version>
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
     <checkstyle.version>8.17</checkstyle.version>
     <enforcer.version>3.0.0-M3</enforcer.version>
@@ -462,8 +462,8 @@
         <version>${hamcrest.version}</version>
       </dependency>
       <dependency>
-        <groupId>commons-collections</groupId>
-        <artifactId>commons-collections</artifactId>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-collections4</artifactId>
         <version>${commons-collections.version}</version>
       </dependency>
       <dependency>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
index 96acdde0fed..dfa57dc84b1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
@@ -40,7 +40,6 @@
     <dependency org="log4j" name="log4j" rev="1.2.17" transitive="false"/>
     <dependency org="junit" name="junit" rev="4.12" conf="test->default"/>
     <dependency org="org.apache.rat" name="apache-rat-tasks" rev="0.6" conf="releaseaudit->default"/>
-    <dependency org="commons-collections" name="commons-collections" rev="3.2.2" conf="releaseaudit->default"/>
   </dependencies>
 
 </ivy-module>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index b5174413296..04162cc073d 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -83,10 +83,5 @@
       <artifactId>apache-rat-tasks</artifactId>
       <version>${rat.version}</version>
     </dependency>
-    <dependency>
-      <groupId>commons-collections</groupId>
-      <artifactId>commons-collections</artifactId>
-    </dependency>
   </dependencies>
-
 </project>
\ No newline at end of file
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index 2427032f938..108cfd535c1 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -66,9 +66,9 @@ All the metrics are included in the `ServerMetrics.java`.
 
     ```bash
     nohup /tmp/prometheus \
-        -config.file /tmp/test-zk.yaml \
-        -web.listen-address ":9090" \
-        -storage.local.path "test-zk.data" >> /tmp/test-zk.log  2>&1 &
+        --config.file /tmp/test-zk.yaml \
+        --web.listen-address ":9090" \
+        --storage.tsdb.path "/tmp/test-zk.data" >> /tmp/test-zk.log  2>&1 &
     ```
 
 - Now Prometheus will scrape zk metrics every 10 seconds.
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index d21d3535b40..857e3e502b7 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -32,7 +32,7 @@
   <description>ZooKeeper Prometheus.io Metrics Provider implementation</description>
 
   <properties>
-      <prometheus.version>0.6.0</prometheus.version>
+      <prometheus.version>0.9.0</prometheus.version>
   </properties>
   <dependencies>
     <dependency>
@@ -85,4 +85,28 @@
       <scope>test</scope>
     </dependency>
   </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>copy-dependencies</id>
+            <phase>package</phase>
+            <goals>
+              <goal>copy-dependencies</goal>
+            </goals>
+            <configuration>
+              <outputDirectory>${project.build.directory}/lib</outputDirectory>
+              <overWriteReleases>false</overWriteReleases>
+              <overWriteSnapshots>true</overWriteSnapshots>
+              <excludeTransitive>false</excludeTransitive>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
 </project>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 68155fde083..8e1865c5d96 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -44,8 +44,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>commons-collections</groupId>
-      <artifactId>commons-collections</artifactId>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-collections4</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java b/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java
index 918d1180ae0..513238cfb59 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java
@@ -62,10 +62,10 @@ interface StatCallback extends AsyncCallback {
          * @param ctx  Whatever context object that we passed to asynchronous calls.
          * @param stat {@link Stat} object of the node on given path.
          *
-         * @see ZooKeeper#exists(String, boolean, StatCallback, Object)
-         * @see ZooKeeper#exists(String, Watcher, StatCallback, Object)
-         * @see ZooKeeper#setData(String, byte[], int, StatCallback, Object)
-         * @see ZooKeeper#setACL(String, List, int, StatCallback, Object)
+         * @see ZooKeeper#exists(String, boolean, AsyncCallback.StatCallback, Object)
+         * @see ZooKeeper#exists(String, Watcher, AsyncCallback.StatCallback, Object)
+         * @see ZooKeeper#setData(String, byte[], int, AsyncCallback.StatCallback, Object)
+         * @see ZooKeeper#setACL(String, List, int, AsyncCallback.StatCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, Stat stat);
 
@@ -84,7 +84,7 @@ interface AllChildrenNumberCallback extends AsyncCallback {
          * @param ctx     Whatever context object that we passed to asynchronous calls.
          * @param number  The number of children nodes under a specific path.
          *
-         * @see ZooKeeper#getAllChildrenNumber(String, AllChildrenNumberCallback, Object)
+         * @see ZooKeeper#getAllChildrenNumber(String, AsyncCallback.AllChildrenNumberCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, int number);
 
@@ -113,10 +113,10 @@ interface DataCallback extends AsyncCallback {
          * @param data The data of the node.
          * @param stat {@link Stat} object of the node on given path.
          *
-         * @see ZooKeeper#getData(String, boolean, DataCallback, Object)
-         * @see ZooKeeper#getData(String, Watcher, DataCallback, Object)
-         * @see ZooKeeper#getConfig(boolean, DataCallback, Object)
-         * @see ZooKeeper#getConfig(Watcher, DataCallback, Object)
+         * @see ZooKeeper#getData(String, boolean, AsyncCallback.DataCallback, Object)
+         * @see ZooKeeper#getData(String, Watcher, AsyncCallback.DataCallback, Object)
+         * @see ZooKeeper#getConfig(boolean, AsyncCallback.DataCallback, Object)
+         * @see ZooKeeper#getConfig(Watcher, AsyncCallback.DataCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, byte[] data, Stat stat);
 
@@ -145,7 +145,7 @@ interface ACLCallback extends AsyncCallback {
          * @param acl  ACL Id in {@link ZooDefs.Ids}.
          * @param stat {@link Stat} object of the node on given path.
          *
-         * @see ZooKeeper#getACL(String, Stat, ACLCallback, Object)
+         * @see ZooKeeper#getACL(String, Stat, AsyncCallback.ACLCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<ACL> acl, Stat stat);
 
@@ -173,8 +173,8 @@ interface ChildrenCallback extends AsyncCallback {
          * @param ctx      Whatever context object that we passed to asynchronous calls.
          * @param children An unordered array of children of the node on given path.
          *
-         * @see ZooKeeper#getChildren(String, boolean, ChildrenCallback, Object)
-         * @see ZooKeeper#getChildren(String, Watcher, ChildrenCallback, Object)
+         * @see ZooKeeper#getChildren(String, boolean, AsyncCallback.ChildrenCallback, Object)
+         * @see ZooKeeper#getChildren(String, Watcher, AsyncCallback.ChildrenCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<String> children);
 
@@ -196,8 +196,8 @@ interface Children2Callback extends AsyncCallback {
          * @param stat     {@link Stat} object of the node on given path.
          *
          * @see ChildrenCallback
-         * @see ZooKeeper#getChildren(String, boolean, Children2Callback, Object)
-         * @see ZooKeeper#getChildren(String, Watcher, Children2Callback, Object)
+         * @see ZooKeeper#getChildren(String, boolean, AsyncCallback.Children2Callback, Object)
+         * @see ZooKeeper#getChildren(String, Watcher, AsyncCallback.Children2Callback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<String> children, Stat stat);
 
@@ -221,8 +221,8 @@ interface Create2Callback extends AsyncCallback {
          * @param stat {@link Stat} object of the node on given path.
          *
          * @see StringCallback
-         * @see ZooKeeper#create(String, byte[], List, CreateMode, Create2Callback, Object)
-         * @see ZooKeeper#create(String, byte[], List, CreateMode, Create2Callback, Object, long)
+         * @see ZooKeeper#create(String, byte[], List, CreateMode, AsyncCallback.Create2Callback, Object)
+         * @see ZooKeeper#create(String, byte[], List, CreateMode, AsyncCallback.Create2Callback, Object, long)
          */
         void processResult(int rc, String path, Object ctx, String name, Stat stat);
 
@@ -257,7 +257,7 @@ interface StringCallback extends AsyncCallback {
          *             and <i>path</i> are usually equal, unless a sequential node has
          *             been created.
          *
-         * @see ZooKeeper#create(String, byte[], List, CreateMode, StringCallback, Object)
+         * @see ZooKeeper#create(String, byte[], List, CreateMode, AsyncCallback.StringCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, String name);
 
@@ -265,7 +265,7 @@ interface StringCallback extends AsyncCallback {
 
     /**
      * This callback doesn't retrieve anything from the node. It is useful for some APIs
-     * that doesn't want anything sent back, e.g. {@link ZooKeeper#sync(String, VoidCallback, Object)}.
+     * that doesn't want anything sent back, e.g. {@link ZooKeeper#sync(String, AsyncCallback.VoidCallback, Object)}.
      */
     @InterfaceAudience.Public
     interface VoidCallback extends AsyncCallback {
@@ -283,17 +283,17 @@ interface VoidCallback extends AsyncCallback {
          *             - The given version doesn't match the node's version for some API calls.</li>
          *  <li>{@link KeeperException.Code#NOTEMPTY}
          *             - the node has children and some API calls cannot succeed, e.g.
-         *             {@link ZooKeeper#delete(String, int, VoidCallback, Object)}.</li>
+         *             {@link ZooKeeper#delete(String, int, AsyncCallback.VoidCallback, Object)}.</li>
          * </ul>
          *
          * @param rc   The return code or the result of the call.
          * @param path The path that we passed to asynchronous calls.
          * @param ctx  Whatever context object that we passed to asynchronous calls.
          *
-         * @see ZooKeeper#delete(String, int, VoidCallback, Object)
-         * @see ZooKeeper#removeAllWatches(String, Watcher.WatcherType, boolean, VoidCallback, Object)
-         * @see ZooKeeper#removeWatches(String, Watcher, Watcher.WatcherType, boolean, VoidCallback, Object)
-         * @see ZooKeeper#sync(String, VoidCallback, Object)
+         * @see ZooKeeper#delete(String, int, AsyncCallback.VoidCallback, Object)
+         * @see ZooKeeper#removeAllWatches(String, Watcher.WatcherType, boolean, AsyncCallback.VoidCallback, Object)
+         * @see ZooKeeper#removeWatches(String, Watcher, Watcher.WatcherType, boolean, AsyncCallback.VoidCallback, Object)
+         * @see ZooKeeper#sync(String, AsyncCallback.VoidCallback, Object)
          *
          */
         void processResult(int rc, String path, Object ctx);
@@ -323,7 +323,7 @@ interface MultiCallback extends AsyncCallback {
          * @param opResults The list of results. One result for each operation, and the order
          *                  matches that of input.
          *
-         * @see ZooKeeper#multi(Iterable, MultiCallback, Object)
+         * @see ZooKeeper#multi(Iterable, AsyncCallback.MultiCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<OpResult> opResults);
 
@@ -332,8 +332,8 @@ interface MultiCallback extends AsyncCallback {
     /**
      * This callback is used to process the getEphemerals results from a single getEphemerals call.
      *
-     * @see ZooKeeper#getEphemerals(EphemeralsCallback, Object)
-     * @see ZooKeeper#getEphemerals(String, EphemeralsCallback, Object)
+     * @see ZooKeeper#getEphemerals(AsyncCallback.EphemeralsCallback, Object)
+     * @see ZooKeeper#getEphemerals(String, AsyncCallback.EphemeralsCallback, Object)
      *
      * @since 3.6.0
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index 98a26566579..2e29cc75c47 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -65,7 +65,7 @@ public static boolean deleteRecursive(
     }
 
     /**
-     * Same as {@link #deleteRecursive(org.apache.zookeeper.ZooKeeper, java.lang.String, int)
+     * Same as {@link #deleteRecursive(org.apache.zookeeper.ZooKeeper, java.lang.String, int)}
      * kept here for compatibility with 3.5 clients.
      *
      * @since 3.6.1
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
index 81111580491..f3cb9a7c7b0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
@@ -32,7 +32,7 @@ public class AclParser {
     /**
      * parse string into list of ACL
      * @param aclString
-     * @return
+     * @return list of ACL
      */
     public static List<ACL> parse(String aclString) {
         List<ACL> acl;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
index 83e03a84175..6386bb9b47e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
@@ -72,7 +72,6 @@ public void setZk(ZooKeeper zk) {
 
     /**
      * get the string used to call this command
-     * @return
      */
     public String getCmdStr() {
         return cmdStr;
@@ -80,7 +79,6 @@ public String getCmdStr() {
 
     /**
      * get the option string
-     * @return
      */
     public String getOptionStr() {
         return optionStr;
@@ -88,7 +86,6 @@ public String getOptionStr() {
 
     /**
      * get a usage string, contains the command and the options
-     * @return
      */
     public String getUsageStr() {
         return cmdStr + " " + optionStr;
@@ -112,7 +109,7 @@ public void addToMap(Map<String, CliCommand> cmdMap) {
 
     /**
      *
-     * @return
+     * @return true if command has watch option, false otherwise
      * @throws CliException
      */
     public abstract boolean exec() throws CliException;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java
index 633cb17c2e1..9591f6c2f42 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java
@@ -53,7 +53,7 @@ private static boolean isLog4jJmxEnabled() {
     /**
      * Register the log4j JMX mbeans. Set system property
      * "zookeeper.jmx.log4j.disable" to true to disable registration.
-     * @see http://logging.apache.org/log4j/1.2/apidocs/index.html?org/apache/log4j/jmx/package-summary.html
+     * @see <a href="http://logging.apache.org/log4j/1.2/apidocs/index.html?org/apache/log4j/jmx/package-summary.html">Log4J 1.2 API docs</a>
      * @throws JMException if registration fails
      */
     @SuppressWarnings("rawtypes")
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index 9d40c5ae8bf..34c18384f5e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -508,7 +508,6 @@ public DataNode getNode(String path) {
      * @param path the path being queried
      * @param stat the stat for this path
      * @param watcher the watcher function
-     * @return
      * @throws KeeperException.NoNodeException
      */
     public byte[] getData(String path, Stat stat, Watcher watcher) throws KeeperException.NoNodeException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index 366d5023fcc..f25dde0d9e6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -313,7 +313,7 @@ public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest)
      * ascending order.
      * @param logDirList array of files
      * @param snapshotZxid return files at, or before this zxid
-     * @return
+     * @return log files that starts at, or just before, the snapshot and subsequent ones
      */
     public static File[] getLogFiles(File[] logDirList, long snapshotZxid) {
         List<File> files = Util.sortDataDir(logDirList, LOG_FILE_PREFIX, true);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index eddeae8d93e..30ed2c08005 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -566,7 +566,7 @@ public List<File> findNValidSnapshots(int n) throws IOException {
      * file may contain transactions beyond given zxid.
      * @param zxid the zxid that contains logs greater than
      * zxid
-     * @return
+     * @return the snapshot logs which may contain transactions newer than the given zxid
      */
     public File[] getSnapshotLogs(long zxid) {
         return FileTxnLog.getLogFiles(dataDir.listFiles(), zxid);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
index b812aa1f9ef..e73df4351d4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
@@ -210,7 +210,7 @@ public static StreamMode getStreamMode() {
      * Detect the stream mode from file name extension
      *
      * @param fileName
-     * @return
+     * @return the stream mode detected
      */
     public static StreamMode getStreamMode(String fileName) {
         String[] splitSnapName = fileName.split("\\.");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
index a4d834453d8..6949c43697b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
@@ -259,7 +259,6 @@ public static List<File> sortDataDir(File[] files, String prefix, boolean ascend
      * Returns true if fileName is a log file name.
      *
      * @param fileName
-     * @return
      */
     public static boolean isLogFileName(String fileName) {
         return fileName.startsWith(FileTxnLog.LOG_FILE_PREFIX + ".");
@@ -269,7 +268,6 @@ public static boolean isLogFileName(String fileName) {
      * Returns true if fileName is a snapshot file name.
      *
      * @param fileName
-     * @return
      */
     public static boolean isSnapshotFileName(String fileName) {
         return fileName.startsWith(FileSnap.SNAPSHOT_FILE_PREFIX + ".");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 777aad07111..692ce1ed0cb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -263,7 +263,7 @@ boolean isLearnerSynced(LearnerHandler peer) {
      * Returns true if a quorum in qv is connected and synced with the leader
      * and false otherwise
      *
-     * @param qv, a QuorumVerifier
+     * @param qv is a QuorumVerifier
      */
     public boolean isQuorumSynced(QuorumVerifier qv) {
         HashSet<Long> ids = new HashSet<Long>();
@@ -966,8 +966,8 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
      * Keep a count of acks that are received by the leader for a particular
      * proposal
      *
-     * @param zxid, the zxid of the proposal sent out
-     * @param sid, the id of the server that sent the ack
+     * @param sid is the id of the server that sent the ack
+     * @param zxid is the zxid of the proposal sent out
      * @param followerAddr
      */
     @Override
@@ -1192,8 +1192,6 @@ public synchronized long getLastProposed() {
 
     /**
      * Returns the current epoch of the leader.
-     *
-     * @return
      */
     public long getEpoch() {
         return ZxidUtils.getEpochFromZxid(lastProposed);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 360f7b7f262..9ab62069a85 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -94,7 +94,6 @@ static class PacketInFlight {
 
     /**
      * Socket getter
-     * @return
      */
     public Socket getSocket() {
         return sock;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 38cbaa69ff1..b91319e0ca0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -1134,7 +1134,6 @@ public synchronized void resetObserverConnectionStats() {
 
     /**
      * For testing, return packet queue
-     * @return
      */
     public Queue<QuorumPacket> getQueuedPackets() {
         return queuedPackets;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java
index 64333b1b4f7..9bf6032af68 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java
@@ -124,7 +124,7 @@ public LearnerSyncThrottler getLearnerDiffSyncThrottler() {
      * get the first zxid of the next epoch
      * @param sid learner id
      * @param lastAcceptedEpoch
-     * @return
+     * @return the first zxid of the next epoch
      * @throws InterruptedException
      * @throws IOException
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index ad5c8c34e0e..15cb172e5f3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1965,8 +1965,6 @@ public void setConnectToLearnerMasterLimit(int connectToLearnerMasterLimit) {
 
     /**
      * Return syncEnabled.
-     *
-     * @return
      */
     public boolean getSyncEnabled() {
         if (System.getProperty(SYNC_ENABLED) != null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java
index d338120048e..b851d640db3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java
@@ -63,9 +63,9 @@ public synchronized void write(T element) {
 
     /**
      * Reads from the buffer in a FIFO manner.
-     * Returns the oldest element in the buffer if the buffer ie not empty
+     * Returns the oldest element in the buffer if the buffer is not empty
      * Returns null if the buffer is empty
-     * @return
+     * @return the oldest element in the buffer
      */
     public synchronized T take() {
         int newSize = numberOfElements.decrementAndGet();
diff --git a/zookeeper-server/src/main/resources/LICENSE.txt b/zookeeper-server/src/main/resources/LICENSE.txt
index efa786f6378..384713a645f 100644
--- a/zookeeper-server/src/main/resources/LICENSE.txt
+++ b/zookeeper-server/src/main/resources/LICENSE.txt
@@ -206,15 +206,10 @@ This distribution bundles javacc, which is available under the
 3-clause BSD License. For details, see a copy of the license in
 lib/javacc.LICENSE.txt
 
-This distribution bundles jline 2.11, which is available under the
+This distribution bundles jline 2.14.6, which is available under the
 2-clause BSD License. For details, see a copy of the license in
-lib/jline-2.11.LICENSE.txt
+lib/jline-2.14.6.LICENSE.txt
 
-This distribution bundles SLF4J 1.7.5, which is available under the MIT
+This distribution bundles SLF4J 1.7.30, which is available under the MIT
 License. For details, see a copy of the license in
-lib/slf4j-1.7.5.LICENSE.txt
-
-This distribution bundles a modified version of 'JZLib' as part of
-Netty-3.7.0, which is available under the 3-clause BSD licence. For
-details, see a copy of the licence in META-INF/license/LICENSE-jzlib.txt
-as part of the Netty jar in lib/netty-3.7.0.Final.jar.
+lib/slf4j-1.7.30.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/metrics-core-3.2.5.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/metrics-core-4.1.12.1.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/metrics-core-3.2.5.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/metrics-core-4.1.12.1.jar_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient-0.6.0.LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient-0.9.0.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/simpleclient-0.6.0.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient-0.9.0.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient_common-0.6.0_LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_common-0.9.0_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/simpleclient_common-0.6.0_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient_common-0.9.0_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.6.0_LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.9.0_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.6.0_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.9.0_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.6.0_LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.9.0_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.6.0_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.9.0_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/slf4j-1.7.25.LICENSE.txt b/zookeeper-server/src/main/resources/lib/slf4j-1.7.30.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/slf4j-1.7.25.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/slf4j-1.7.30.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.7.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.7.jar_LICENSE.txt
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index b445e861cf8..93ab353abb8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -37,7 +37,7 @@
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
-import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
index 498f5f07cb0..61c753f7789 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
@@ -35,7 +35,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
-import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.zookeeper.PortAssignment;
 import org.junit.jupiter.api.Test;
 
@@ -56,7 +56,6 @@ public void testIsEmpty() {
     public void testGetAllAddresses() {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
-
         assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
 
         multipleAddresses.addAddress(addresses.get(1));

From 392846c534c51a57aa678691d411ad7d8d68e29a Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Mon, 2 Nov 2020 16:58:08 +0000
Subject: [PATCH 115/591] ZOOKEEPER-3696: Support alternative algorithms for
 ACL digest

- [SHA1](https://shattered.io/) can be cracked now and it's not safe enough to use it, `SHA2` shares the the same algorithm idea with `SHA1`, its broken would be only a matter of time, so they created `SHA3` which's safe up to now.

- The default value is: `SHA1` which will be deprecated in the future for security issues. Set this property the same value in all the servers.

- How to support other more algorithms?

    - modify the `java.security` configuration file under `$JAVA_HOME/jre/lib/security/java.security` by specifying:
             `security.provider.<n>=<provider class name>`.

             ```
             For example:
             set zookeeper.DigestAuthenticationProvider.digestAlg=RipeMD160
             security.provider.3=org.bouncycastle.jce.provider.BouncyCastleProvider
             ```

    - copy the jar file to `$JAVA_HOME/jre/lib/ext/`.

             ```
             For example:
             copy bcprov-jdk15on-1.60.jar to $JAVA_HOME/jre/lib/ext/
             ```

- For the same digest algorithm and input, the output of digest is the constant. You can use some online tools to play with it. Some UTs had covered it.

- The unit cases have tested three algorithms: `SHA1`, `SHA-256`, `SHA3-256`(other algorithms share the same principle, so ignore them), and I also do a manual test to `RipeMD160`

- For the invalid algorithm parameter
```
 Caused by: java.lang.RuntimeException: don't support this ACL digest algorithm: SHA3-996 in the current environment
	at org.apache.zookeeper.server.auth.DigestAuthenticationProvider.<clinit>(DigestAuthenticationProvider.java:52)
	... 6 more
```

- How to migrate from one digest algorithm to another? For example: migrate from SHA1 to SHA3
```
# Before I have SHA1 for digest
superDigest=super:D/InIHSb7yEEbrWz8b9l71RjZJU=" //super:test

[zk: 127.0.0.1:2180(CONNECTED) 0] addauth digest username1:password1
[zk: 127.0.0.1:2180(CONNECTED) 2] setAcl /myapp-1 auth:username1:password1:crwad

# After I transfer to SHA3, you will get Auth Exception when getData of a
znode which already had a digest auth of old algorithm.

Step ONE:  Regenerate `superDigest` when migrating to new algorithm which is always a good practice for users to survive from any uncomfortable auth issue.
reset my superDigest to super:cRy/KPYuDpW/dtsepniTMpuiuupnWgdU9txltIfv3hA=
[zk: 127.0.0.1:2180(CONNECTED) 0] addauth digest super:test
[zk: 127.0.0.1:2180(CONNECTED) 1] get /myapp-1
null

Step TWO: re-setACl for that znode.
[zk: 127.0.0.1:2180(CONNECTED) 0] addauth digest super:test
[zk: 127.0.0.1:2180(CONNECTED) 1] addauth digest username1:password1
# sometime use setAcl -R to setAcl recursively or you can also set ACL to 'world,'anyone
(open to anyone)
[zk: 127.0.0.1:2180(CONNECTED) 2] setAcl /myapp-1 auth:username1:password1:crwad
```

- [TODO]: `ZOOKEEPER-3976: write a script to encapsulate DigestAuthenticationProvider#main as a tool to generate the digest with the algorithm users appoint`

- more details in the [ZOOKEEPER-3696](https://issues.apache.org/jira/browse/ZOOKEEPER-3696)

Author: maoling <maoling199210191@sina.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <andor@apache.org>, Mate Szalay-Beko <symat@apache.org>

This patch had conflicts when merged, resolved by
Committer: Mate Szalay-Beko <symat@apache.org>

Closes #1318 from maoling/ZOOKEEPER-3696
---
 .../main/resources/markdown/zookeeperAdmin.md |  27 +++++
 .../zookeeper/server/ZooKeeperServerMain.java |   2 +
 .../auth/DigestAuthenticationProvider.java    |  23 +++-
 .../server/quorum/QuorumPeerMain.java         |   2 +
 .../apache/zookeeper/test/AuthSHA2Test.java   |  89 ++++++++++++++
 .../apache/zookeeper/test/AuthSHA3Test.java   |  89 ++++++++++++++
 .../org/apache/zookeeper/test/AuthTest.java   | 113 +++++++++++++++++-
 7 files changed, 343 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index a3a1c6c7dce..d6087e68d15 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1461,6 +1461,33 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     localhost (not over the network) or over an encrypted
     connection.
 
+* *DigestAuthenticationProvider.digestAlg* :
+    (Java system property: **zookeeper.DigestAuthenticationProvider.digestAlg**)
+     **New in 3.7.0:**
+    Set ACL digest algorithm. The default value is: `SHA1` which will be deprecated in the future for security issues.
+    Set this property the same value in all the servers.
+
+    - How to support other more algorithms?
+        - modify the `java.security` configuration file under `$JAVA_HOME/jre/lib/security/java.security` by specifying:
+             `security.provider.<n>=<provider class name>`.
+
+             ```
+             For example:
+             set zookeeper.DigestAuthenticationProvider.digestAlg=RipeMD160
+             security.provider.3=org.bouncycastle.jce.provider.BouncyCastleProvider
+             ```
+
+        - copy the jar file to `$JAVA_HOME/jre/lib/ext/`.
+
+             ```
+             For example:
+             copy bcprov-jdk15on-1.60.jar to $JAVA_HOME/jre/lib/ext/
+             ```
+
+    - How to migrate from one digest algorithm to another?
+        - 1. Regenerate `superDigest` when migrating to new algorithm.
+        - 2. `SetAcl` for a znode which already had a digest auth of old algorithm.
+
 * *X509AuthenticationProvider.superUser* :
     (Java system property: **zookeeper.X509AuthenticationProvider.superUser**)
     The SSL-backed way to enable a ZooKeeper ensemble
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index 7ddb1deb9e6..abb4d0d49ea 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -31,6 +31,7 @@
 import org.apache.zookeeper.server.admin.AdminServer;
 import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
 import org.apache.zookeeper.server.admin.AdminServerFactory;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.DatadirException;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
@@ -130,6 +131,7 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
                 throw new IOException("Cannot boot MetricsProvider " + config.getMetricsProviderClassName(), error);
             }
             ServerMetrics.metricsProviderInitialized(metricsProvider);
+            ProviderRegistry.initialize();
             // Note that this thread isn't going to be doing anything else,
             // so rather than spawning another thread, we will just call
             // run() in this thread.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
index 573cba386ba..8b64154cd06 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
@@ -31,6 +31,22 @@ public class DigestAuthenticationProvider implements AuthenticationProvider {
 
     private static final Logger LOG = LoggerFactory.getLogger(DigestAuthenticationProvider.class);
 
+    private static final String DEFAULT_DIGEST_ALGORITHM = "SHA1";
+
+    public static final String DIGEST_ALGORITHM_KEY = "zookeeper.DigestAuthenticationProvider.digestAlg";
+
+    private static final String DIGEST_ALGORITHM = System.getProperty(DIGEST_ALGORITHM_KEY, DEFAULT_DIGEST_ALGORITHM);
+
+    static {
+        try {
+            //sanity check, pre-check the availability of the algorithm to avoid some unexpected exceptions in the runtime
+            generateDigest(DIGEST_ALGORITHM);
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("don't support this ACL digest algorithm: " + DIGEST_ALGORITHM + " in the current environment");
+        }
+        LOG.info("ACL digest algorithm is: {}", DIGEST_ALGORITHM);
+    }
+
     /** specify a command line property with key of
      * "zookeeper.DigestAuthenticationProvider.superDigest"
      * and value of "super:&lt;base64encoded(SHA1(password))&gt;" to enable
@@ -89,10 +105,15 @@ private static char encode(int i) {
 
     public static String generateDigest(String idPassword) throws NoSuchAlgorithmException {
         String[] parts = idPassword.split(":", 2);
-        byte[] digest = MessageDigest.getInstance("SHA1").digest(idPassword.getBytes(UTF_8));
+        byte[] digest = digest(idPassword);
         return parts[0] + ":" + base64Encode(digest);
     }
 
+    // @VisibleForTesting
+    public static byte[] digest(String idPassword) throws NoSuchAlgorithmException {
+        return MessageDigest.getInstance(DIGEST_ALGORITHM).digest(idPassword.getBytes(UTF_8));
+    }
+
     public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
         String id = new String(authData);
         try {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 81140b60982..76df5e46d8b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -34,6 +34,7 @@
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServerMain;
 import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.DatadirException;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
@@ -159,6 +160,7 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
         }
         try {
             ServerMetrics.metricsProviderInitialized(metricsProvider);
+            ProviderRegistry.initialize();
             ServerCnxnFactory cnxnFactory = null;
             ServerCnxnFactory secureCnxnFactory = null;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java
new file mode 100644
index 00000000000..298e4fb5a20
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.security.NoSuchAlgorithmException;
+import java.security.Security;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class AuthSHA2Test extends AuthTest {
+
+    @BeforeAll
+    public static void setup() {
+        // use the BouncyCastle's Provider for testing
+        Security.addProvider(new BouncyCastleProvider());
+        // password is test
+        System.setProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY, DigestAlgEnum.SHA_256.getName());
+        System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:wjySwxg860UATFtciuZ1lpzrCHrPeov6SPu/ZD56uig=");
+        System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.test.InvalidAuthProvider");
+    }
+
+    @AfterAll
+    public static void teardown() {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.superDigest");
+        System.clearProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY);
+    }
+
+    @Test
+    public void testBadAuthNotifiesWatch() throws Exception {
+        super.testBadAuthNotifiesWatch();
+    }
+
+    @Test
+    public void testBadAuthThenSendOtherCommands() throws Exception {
+        super.testBadAuthThenSendOtherCommands();
+    }
+
+    @Test
+    public void testSuper() throws Exception {
+        super.testSuper();
+    }
+
+    @Test
+    public void testSuperACL() throws Exception {
+        super.testSuperACL();
+    }
+
+    @Test
+    public void testOrdinaryACL() throws Exception {
+        super.testOrdinaryACL();
+    }
+
+    @Test
+    public void testGenerateDigest() throws NoSuchAlgorithmException {
+        assertEquals("super:wjySwxg860UATFtciuZ1lpzrCHrPeov6SPu/ZD56uig=", DigestAuthenticationProvider.generateDigest("super:test"));
+        assertEquals("super:Ie58Fw6KA4ucTEDj23imIltKrXNDxQg8Rwtu0biQFcU=", DigestAuthenticationProvider.generateDigest("super:zookeeper"));
+        assertEquals("super:rVOiTPnqEqlpIRXqSoE6+7h6SzbHUrfAe34i8n/gmRU=", DigestAuthenticationProvider.generateDigest(("super:foo")));
+        assertEquals("super:vs70GBagNcqIhGR4R6rXP8E3lvJPYhzMpAMx8ghbTUk=", DigestAuthenticationProvider.generateDigest(("super:bar")));
+    }
+
+    @Test
+    public void testDigest() throws NoSuchAlgorithmException {
+        assertEquals("9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", getGeneratedDigestStr(DigestAuthenticationProvider.digest("test")));
+        assertEquals("456831beef3fc1500939995d7369695f48642664a02d5eab9d807592a08b2384", getGeneratedDigestStr(DigestAuthenticationProvider.digest("zookeeper")));
+        assertEquals("2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("foo"))));
+        assertEquals("fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("bar"))));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java
new file mode 100644
index 00000000000..38b070f6eaa
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.security.NoSuchAlgorithmException;
+import java.security.Security;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class AuthSHA3Test extends AuthTest {
+
+    @BeforeAll
+    public static void setup() {
+        // use the BouncyCastle's Provider for testing
+        Security.addProvider(new BouncyCastleProvider());
+        // password is test
+        System.setProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY, DigestAlgEnum.SHA3_256.getName());
+        System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:cRy/KPYuDpW/dtsepniTMpuiuupnWgdU9txltIfv3hA=");
+        System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.test.InvalidAuthProvider");
+    }
+
+    @AfterAll
+    public static void teardown() {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.superDigest");
+        System.clearProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY);
+    }
+
+    @Test
+    public void testBadAuthNotifiesWatch() throws Exception {
+        super.testBadAuthNotifiesWatch();
+    }
+
+    @Test
+    public void testBadAuthThenSendOtherCommands() throws Exception {
+        super.testBadAuthThenSendOtherCommands();
+    }
+
+    @Test
+    public void testSuper() throws Exception {
+        super.testSuper();
+    }
+
+    @Test
+    public void testSuperACL() throws Exception {
+        super.testSuperACL();
+    }
+
+    @Test
+    public void testOrdinaryACL() throws Exception {
+        super.testOrdinaryACL();
+    }
+
+    @Test
+    public void testGenerateDigest() throws NoSuchAlgorithmException {
+        assertEquals("super:cRy/KPYuDpW/dtsepniTMpuiuupnWgdU9txltIfv3hA=", DigestAuthenticationProvider.generateDigest("super:test"));
+        assertEquals("super:gM3M1QcrKC6b+h4oZ5Ixc4GTVaAsggI+AqkUaF6E1Is=", DigestAuthenticationProvider.generateDigest("super:zookeeper"));
+        assertEquals("super:2Ww7VUqTohd3lX/Vf4Nvw+GxbmOsX1p337L7Bnks4L8=", DigestAuthenticationProvider.generateDigest(("super:foo")));
+        assertEquals("super:Ft5s2Rtxr8zyz16feKiFR/8yqa6JoNEJ0In73aXojE8=", DigestAuthenticationProvider.generateDigest(("super:bar")));
+    }
+
+    @Test
+    public void testDigest() throws NoSuchAlgorithmException {
+        assertEquals("36f028580bb02cc8272a9a020f4200e346e276ae664e45ee80745574e2f5ab80", getGeneratedDigestStr(DigestAuthenticationProvider.digest("test")));
+        assertEquals("af4c1abc2deaa6edffc7ce34edeb8c03ee9a1488b64fd318ddb93b4b7f1c0746", getGeneratedDigestStr(DigestAuthenticationProvider.digest("zookeeper")));
+        assertEquals("76d3bc41c9f588f7fcd0d5bf4718f8f84b1c41b20882703100b9eb9413807c01", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("foo"))));
+        assertEquals("cceefd7e0545bcf8b6d19f3b5750c8a3ee8350418877bc6fb12e32de28137355", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("bar"))));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
index 211dfaedb50..a1c95d83b66 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
@@ -18,8 +18,12 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
@@ -27,18 +31,32 @@
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
 public class AuthTest extends ClientBase {
 
-    static {
+    @BeforeAll
+    public static void setup() {
         // password is test
+        // the default digestAlg is: SHA1
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU=");
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.test.InvalidAuthProvider");
     }
 
+    @AfterAll
+    public static void teardown() {
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.superDigest");
+        System.clearProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY);
+    }
+
     private final CountDownLatch authFailed = new CountDownLatch(1);
 
     @Override
@@ -160,4 +178,97 @@ public void testSuperACL() throws Exception {
         }
     }
 
+    @Test
+    public void testOrdinaryACL() throws Exception {
+        ZooKeeper zk = createClient();
+        try {
+            String path = "/path1";
+            zk.create(path, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.addAuthInfo("digest", "username1:password1".getBytes());
+            List<ACL> list = new ArrayList<>();
+            int perm = ZooDefs.Perms.ALL;
+            String userPassword = "username1:password1";
+            Id id = new Id("auth", userPassword);
+            list.add(new ACL(perm, id));
+            zk.setACL(path, list, -1);
+            zk.close();
+
+            zk = createClient();
+            zk.addAuthInfo("digest", "super:test".getBytes());
+            zk.getData(path, false, null);
+            zk.close();
+
+            zk = createClient();
+            try {
+                zk.getData(path, false, null);
+                fail("should have NoAuthException");
+            } catch (KeeperException.NoAuthException e) {
+                // expected
+            }
+            zk.addAuthInfo("digest", "username1:password1".getBytes());
+            zk.getData(path, false, null);
+        } finally {
+            zk.close();
+        }
+    }
+
+    @Test
+    public void testGenerateDigest() throws NoSuchAlgorithmException {
+        assertEquals("super:D/InIHSb7yEEbrWz8b9l71RjZJU=", DigestAuthenticationProvider.generateDigest("super:test"));
+        assertEquals("super:yyuhPKumRtNj4r8GnSbbwuq1vhE=", DigestAuthenticationProvider.generateDigest("super:zookeeper"));
+        assertEquals("super:t6lQTvqID/Gl5Or0n4FYE6kKP8w=", DigestAuthenticationProvider.generateDigest(("super:foo")));
+        assertEquals("super:hTdNN4QH4isoRvCrQ1Jf7REREQ4=", DigestAuthenticationProvider.generateDigest(("super:bar")));
+    }
+
+    // This test is used to check the correctness of the algorithm
+    // For the same digest algorithm and input, the output of digest hash is the constant.
+    @Test
+    public void testDigest() throws NoSuchAlgorithmException {
+        assertEquals("a94a8fe5ccb19ba61c4c0873d391e987982fbbd3", getGeneratedDigestStr(DigestAuthenticationProvider.digest("test")));
+        assertEquals("8a0444ded963cf1118dd34aa1acaafec268c654d", getGeneratedDigestStr(DigestAuthenticationProvider.digest("zookeeper")));
+        assertEquals("0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("foo"))));
+        assertEquals("62cdb7020ff920e5aa642c3d4066950dd1f01f4d", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("bar"))));
+    }
+
+    // this method is used to generate the digest String to help us to compare the result generated by some online tool easily
+    protected static String getGeneratedDigestStr(byte[] bytes) {
+        StringBuilder stringBuilder = new StringBuilder("");
+        if (bytes == null || bytes.length <= 0) {
+            return null;
+        }
+        for (int i = 0; i < bytes.length; i++) {
+            int v = bytes[i] & 0xFF;
+            String hv = Integer.toHexString(v);
+            if (hv.length() < 2) {
+                stringBuilder.append(0);
+            }
+            stringBuilder.append(hv);
+        }
+        return stringBuilder.toString();
+    }
+
+    public enum DigestAlgEnum {
+        SHA_1("SHA1"),
+        SHA_256("SHA-256"),
+        SHA3_256("SHA3-256");
+
+        private String name;
+
+        DigestAlgEnum(String name) {
+            this.name = name;
+        }
+
+        public String getName() {
+            return this.name;
+        }
+
+        public static List<String> getValues() {
+            List<String> digestList = new ArrayList<>();
+            for (DigestAlgEnum digest : values()) {
+                digestList.add(digest.getName());
+            }
+            return digestList;
+        }
+    }
+
 }

From 5b034a4362e41a62da43979ad0fb6c97477c1624 Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Tue, 3 Nov 2020 17:01:59 +0100
Subject: [PATCH 116/591] ZOOKEEPER-3662: Remove NPE Possibility in Follower
 Class

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Allan Lyu <fangmin@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1192 from belugabehr/ZOOKEEPER-3662
---
 .../apache/zookeeper/server/quorum/Follower.java | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
index 9420fc3bf96..971710c91ab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
@@ -23,6 +23,7 @@
 import java.nio.ByteBuffer;
 import java.util.Collections;
 import java.util.Map;
+import java.util.Objects;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
@@ -48,10 +49,10 @@ public class Follower extends Learner {
 
     ObserverMaster om;
 
-    Follower(QuorumPeer self, FollowerZooKeeperServer zk) {
-        this.self = self;
+    Follower(final QuorumPeer self, final FollowerZooKeeperServer zk) {
+        this.self = Objects.requireNonNull(self);
+        this.fzk = Objects.requireNonNull(zk);
         this.zk = zk;
-        this.fzk = zk;
     }
 
     @Override
@@ -253,14 +254,9 @@ protected void processPacket(QuorumPacket qp) throws Exception {
      * @return zxid
      */
     public long getZxid() {
-        try {
-            synchronized (fzk) {
-                return fzk.getZxid();
-            }
-        } catch (NullPointerException e) {
-            LOG.warn("error getting zxid", e);
+        synchronized (fzk) {
+            return fzk.getZxid();
         }
-        return -1;
     }
 
     /**

From 7d47a1792170099276c28456eea523d4d1067a6c Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Wed, 4 Nov 2020 07:43:20 +0000
Subject: [PATCH 117/591] ZOOKEEPER-3688: Use StandardCharsets UTF-8 in Jute
 toString

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, Enrico Olivelli <eolivelli@apache.org>, maoling <maoling199210191@sina.com>, Damien Diederen <ddiederen@apache.org>

Closes #1216 from belugabehr/ZOOKEEPER-3688
---
 .../src/main/java/org/apache/jute/compiler/JRecord.java         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index 7c73dedf9c9..13cb1ed29c5 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -498,7 +498,7 @@ public void genJavaCode(File outputDirectory) throws IOException {
                 jj.write(jf.genJavaWriteMethodName());
             }
             jj.write("      a_.endRecord(this,\"\");\n");
-            jj.write("      return new String(s.toByteArray(), \"UTF-8\");\n");
+            jj.write("      return new String(s.toByteArray(), java.nio.charset.StandardCharsets.UTF_8);\n");
             jj.write("    } catch (Throwable ex) {\n");
             jj.write("      ex.printStackTrace();\n");
             jj.write("    }\n");

From 3df3563173e1790d64eae3bc5509f02683d71298 Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Thu, 5 Nov 2020 09:57:20 +0000
Subject: [PATCH 118/591] ZOOKEEPER-3687: Jute Use JDK hashCode Methods for
 Native Types

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Andor Molnar <anmolnar@apache.org>, Christopher Tubbs <ctubbsii@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1215 from belugabehr/ZOOKEEPER-3687
---
 .../src/main/java/org/apache/jute/compiler/JBoolean.java       | 2 +-
 .../src/main/java/org/apache/jute/compiler/JDouble.java        | 3 +--
 .../src/main/java/org/apache/jute/compiler/JFloat.java         | 2 +-
 .../src/main/java/org/apache/jute/compiler/JLong.java          | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java
index 2d10ec4a611..508501f9abc 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java
@@ -39,7 +39,7 @@ public String genJavaCompareTo(String fname) {
     }
 
     public String genJavaHashCode(String fname) {
-        return "     ret = (" + fname + ")?0:1;\n";
+        return "     ret = java.lang.Boolean.hashCode(" + fname + ");\n";
     }
 
     String genCsharpHashCode(String fname) {
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java
index 4e22ff3d368..b84270bfc8e 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java
@@ -35,8 +35,7 @@ public String getSignature() {
     }
 
     public String genJavaHashCode(String fname) {
-        String tmp = "Double.doubleToLongBits(" + fname + ")";
-        return "    ret = (int)(" + tmp + "^(" + tmp + ">>>32));\n";
+        return "    ret = java.lang.Double.hashCode(" + fname + ");\n";
     }
 
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java
index c4452f1fcc9..a90f1431d08 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java
@@ -35,7 +35,7 @@ public String getSignature() {
     }
 
     public String genJavaHashCode(String fname) {
-        return "    ret = Float.floatToIntBits(" + fname + ");\n";
+        return "    ret = java.lang.Float.hashCode(" + fname + ");\n";
     }
 
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java
index 45637892fb7..89c0684b6ad 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java
@@ -35,6 +35,6 @@ public String getSignature() {
     }
 
     public String genJavaHashCode(String fname) {
-        return "    ret = (int) (" + fname + "^(" + fname + ">>>32));\n";
+        return "    ret = java.lang.Long.hashCode(" + fname + ");\n";
     }
 }

From 744f03938eeda4e579369773735508e61a1825ad Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Thu, 5 Nov 2020 12:19:54 +0000
Subject: [PATCH 119/591] ZOOKEEPER-3833: Do Not Override Plugin Versions from
 Apache Parent POM

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Christopher Tubbs <ctubbsii@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1354 from belugabehr/ZOOKEEPER-3833
---
 pom.xml | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pom.xml b/pom.xml
index 5bbf4c8576c..a030550fa6b 100755
--- a/pom.xml
+++ b/pom.xml
@@ -422,6 +422,7 @@
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
     <dependency.locations.enabled>false</dependency.locations.enabled>
+    <surefire.version>2.22.1</surefire.version>
 
     <surefire-forkcount>8</surefire-forkcount>
 
@@ -648,7 +649,6 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-compiler-plugin</artifactId>
-          <version>3.8.1</version>
           <configuration>
              <showWarnings>true</showWarnings>
              <compilerArgs>
@@ -665,7 +665,6 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-jar-plugin</artifactId>
-          <version>3.1.0</version>
           <configuration>
             <archive>
               <manifestEntries>
@@ -677,7 +676,6 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-source-plugin</artifactId>
-          <version>3.0.1</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -691,12 +689,10 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-assembly-plugin</artifactId>
-          <version>3.1.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-release-plugin</artifactId>
-          <version>3.0.0-M1</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -706,17 +702,14 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-surefire-plugin</artifactId>
-          <version>2.22.1</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-antrun-plugin</artifactId>
-          <version>1.8</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-dependency-plugin</artifactId>
-          <version>3.1.1</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>

From 375a81391428533dac5594565c700c65b1ba2690 Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Fri, 6 Nov 2020 08:52:13 +0100
Subject: [PATCH 120/591] ZOOKEEPER-3967: Jetty License Update.

Add license for Jetty which is used in both Admin server and ZooKeeperServerController.

Author: Michael Han <hanm@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1512 from hanm/fixlicense
---
 .../jetty-client-9.4.32.v20200930.LICENSE.txt | 202 ++++++++++++++++++
 .../jetty-http-9.4.32.v20200930.LICENSE.txt   | 202 ++++++++++++++++++
 .../lib/jetty-io-9.4.32.v20200930.LICENSE.txt | 202 ++++++++++++++++++
 ...etty-security-9.4.32.v20200930.LICENSE.txt | 202 ++++++++++++++++++
 .../jetty-server-9.4.32.v20200930.LICENSE.txt | 202 ++++++++++++++++++
 ...jetty-servlet-9.4.32.v20200930.LICENSE.txt | 202 ++++++++++++++++++
 .../jetty-util-9.4.32.v20200930.LICENSE.txt   | 202 ++++++++++++++++++
 7 files changed, 1414 insertions(+)
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt

diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

From c9a1b595f9afd07ce6359810a5ca8e4f4088c5a2 Mon Sep 17 00:00:00 2001
From: Matteo Minardi <matteo.minardi@diennea.com>
Date: Mon, 9 Nov 2020 11:20:11 +0000
Subject: [PATCH 121/591] ZOOKEEPER-3992: addWatch api should check the null
 watch

```
public void addWatch(String basePath, Watcher watcher, AddWatchMode mode)
        throws KeeperException, InterruptedException {
    PathUtils.validatePath(basePath);
    String serverPath = prependChroot(basePath);

    RequestHeader h = new RequestHeader();
    h.setType(ZooDefs.OpCode.addWatch);
    AddWatchRequest request = new AddWatchRequest(serverPath, mode.getMode());
    ReplyHeader r = cnxn.submitRequest(h, request, new ErrorResponse(),
```
we need to validateWatcher(watcher) to avoid the case:
```
zk.addWatch("/a/b", null, PERSISTENT_RECURSIVE);
```

Author: Matteo Minardi <matteo.minardi@diennea.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1529 from mino181295/fix/ZOOKEEPER-3992/addwatch-check-null
---
 .../main/java/org/apache/zookeeper/ZooKeeper.java |  2 ++
 .../zookeeper/test/PersistentWatcherTest.java     | 15 +++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 622ccd53365..9fba7a5ebd4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -2806,6 +2806,7 @@ public void removeAllWatches(String path, WatcherType watcherType, boolean local
     public void addWatch(String basePath, Watcher watcher, AddWatchMode mode)
             throws KeeperException, InterruptedException {
         PathUtils.validatePath(basePath);
+        validateWatcher(watcher);
         String serverPath = prependChroot(basePath);
 
         RequestHeader h = new RequestHeader();
@@ -2857,6 +2858,7 @@ public void addWatch(
             Object ctx
     ) {
         PathUtils.validatePath(basePath);
+        validateWatcher(watcher);
         String serverPath = prependChroot(basePath);
 
         RequestHeader h = new RequestHeader();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
index 754ba76ae84..cad260c1230 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
@@ -21,6 +21,7 @@
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
@@ -62,6 +63,20 @@ public void testBasic()
         }
     }
 
+    @Test
+    public void testNullWatch()
+            throws IOException, InterruptedException, KeeperException {
+        try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
+            assertThrows(IllegalArgumentException.class, () -> {
+                zk.addWatch("/a/b", null, PERSISTENT);
+            });
+            assertThrows(IllegalArgumentException.class, () -> {
+                AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {};
+                zk.addWatch("/a/b", null, PERSISTENT, cb, null);
+            });
+        }
+    }
+
     @Test
     public void testDefaultWatcher()
             throws IOException, InterruptedException, KeeperException {

From 3bbf08da066c7a904ef5d3aaddd64da1a8b031da Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 9 Nov 2020 13:53:27 +0100
Subject: [PATCH 122/591] ZOOKEEPER-3959: Add support for multiple
 SASL-authenticated super users

This implements a simple variant of the "multiple SASL-authenticated super users" functionality discussed on ticket ZOOKEEPER-3959.

With this patch, properties matching `zookeeper.superUser.*` are considered, in addition to `zookeeper.superUser`, to determine whether an authenticated ID should be given `super` privileges.

As before, `super` privileges remain a sharp tool and should be avoided where possible--but where necessary, allowing multiple IDs makes audit logs more useful.

(Many thanks to eolivelli and symat for their comments and suggestions.)

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1503 from ztzg/ZOOKEEPER-3959-multiple-superusers
---
 .../main/resources/markdown/zookeeperAdmin.md |  3 +
 .../zookeeper/server/ZooKeeperServer.java     | 33 ++++++++-
 .../zookeeper/test/SaslSuperUserTest.java     | 71 +++++++++++++------
 3 files changed, 82 insertions(+), 25 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index d6087e68d15..a14559e8519 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1501,6 +1501,9 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Similar to **zookeeper.X509AuthenticationProvider.superUser**
     but is generic for SASL based logins. It stores the name of
     a user that can access the znode hierarchy as a "super" user.
+    You can specify multiple SASL super users using the
+    **zookeeper.superUser.[suffix]** notation, e.g.:
+    `zookeeper.superUser.1=...`.
 
 * *ssl.authProvider* :
     (Java system property: **zookeeper.ssl.authProvider**)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index ab556f59954..8492dd56de7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -32,6 +32,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Properties;
 import java.util.Random;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -106,6 +107,8 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
 
     static final boolean skipACL;
 
+    public static final String SASL_SUPER_USER = "zookeeper.superUser";
+
     public static final String ALLOW_SASL_FAILED_CLIENTS = "zookeeper.allowSaslFailedClients";
     public static final String ZOOKEEPER_DIGEST_ENABLED = "zookeeper.digest.enabled";
     private static boolean digestEnabled;
@@ -1644,6 +1647,28 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
         }
     }
 
+    private static boolean isSaslSuperUser(String id) {
+        if (id == null || id.isEmpty()) {
+            return false;
+        }
+
+        Properties properties = System.getProperties();
+        int prefixLen = SASL_SUPER_USER.length();
+
+        for (String k : properties.stringPropertyNames()) {
+            if (k.startsWith(SASL_SUPER_USER)
+                && (k.length() == prefixLen || k.charAt(prefixLen) == '.')) {
+                String value = properties.getProperty(k);
+
+                if (value != null && value.equals(id)) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
     private static boolean shouldAllowSaslFailedClientsConnect() {
         return Boolean.getBoolean(ALLOW_SASL_FAILED_CLIENTS);
     }
@@ -1667,9 +1692,13 @@ private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHead
                     LOG.info("Session 0x{}: adding SASL authorization for authorizationID: {}",
                             Long.toHexString(cnxn.getSessionId()), authorizationID);
                     cnxn.addAuthInfo(new Id("sasl", authorizationID));
-                    if (System.getProperty("zookeeper.superUser") != null
-                        && authorizationID.equals(System.getProperty("zookeeper.superUser"))) {
+
+                    if (isSaslSuperUser(authorizationID)) {
                         cnxn.addAuthInfo(new Id("super", ""));
+                        LOG.info(
+                            "Session 0x{}: Authenticated Id '{}' as super user",
+                            Long.toHexString(cnxn.getSessionId()),
+                            authorizationID);
                     }
                 }
             } catch (SaslException e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
index 39bf62f11d7..8676fbe1456 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
@@ -30,8 +30,10 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Perms;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
@@ -42,12 +44,14 @@ public class SaslSuperUserTest extends ClientBase {
     private static Id otherSaslUser = new Id("sasl", "joe");
     private static Id otherDigestUser;
     private static String oldAuthProvider;
+    private static String oldClientConfigSection;
     private static String oldLoginConfig;
     private static String oldSuperUser;
 
     @BeforeAll
     public static void setupStatic() throws Exception {
         oldAuthProvider = System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
+        oldClientConfigSection = System.getProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY);
 
         File tmpDir = createTmpDir();
         File saslConfFile = new File(tmpDir, "jaas.conf");
@@ -56,42 +60,40 @@ public static void setupStatic() throws Exception {
         fwriter.write(""
                               + "Server {\n"
                               + "          org.apache.zookeeper.server.auth.DigestLoginModule required\n"
-                              + "          user_super_duper=\"test\";\n"
+                              + "          user_super_duper=\"test\"\n"
+                              + "          user_other_super=\"test\";\n"
                               + "};\n"
                               + "Client {\n"
                               + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
                               + "       username=\"super_duper\"\n"
                               + "       password=\"test\";\n"
                               + "};"
+                              + "OtherClient {\n"
+                              + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
+                              + "       username=\"other_super\"\n"
+                              + "       password=\"test\";\n"
+                              + "};"
                               + "\n");
         fwriter.close();
         oldLoginConfig = System.setProperty("java.security.auth.login.config", saslConfFile.getAbsolutePath());
-        oldSuperUser = System.setProperty("zookeeper.superUser", "super_duper");
+        oldSuperUser = System.setProperty(ZooKeeperServer.SASL_SUPER_USER, "super_duper");
         otherDigestUser = new Id("digest", DigestAuthenticationProvider.generateDigest("jack:jack"));
     }
 
     @AfterAll
     public static void cleanupStatic() {
-        if (oldAuthProvider != null) {
-            System.setProperty("zookeeper.authProvider.1", oldAuthProvider);
-        } else {
-            System.clearProperty("zookeeper.authProvider.1");
-        }
-        oldAuthProvider = null;
-
-        if (oldLoginConfig != null) {
-            System.setProperty("java.security.auth.login.config", oldLoginConfig);
-        } else {
-            System.clearProperty("java.security.auth.login.config");
-        }
-        oldLoginConfig = null;
+        restoreProperty("zookeeper.authProvider.1", oldAuthProvider);
+        restoreProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY, oldClientConfigSection);
+        restoreProperty("java.security.auth.login.config", oldLoginConfig);
+        restoreProperty(ZooKeeperServer.SASL_SUPER_USER, oldSuperUser);
+    }
 
-        if (oldSuperUser != null) {
-            System.setProperty("zookeeper.superUser", oldSuperUser);
+    private static void restoreProperty(String property, String oldValue) {
+        if (oldValue != null) {
+            System.setProperty(property, oldValue);
         } else {
-            System.clearProperty("zookeeper.superUser");
+            System.clearProperty(property);
         }
-        oldSuperUser = null;
     }
 
     private AtomicInteger authFailed = new AtomicInteger(0);
@@ -115,8 +117,7 @@ public synchronized void process(WatchedEvent event) {
 
     }
 
-    @Test
-    public void testSuperIsSuper() throws Exception {
+    private void connectAndPerformSuperOps() throws Exception {
         ZooKeeper zk = createClient();
         try {
             zk.create("/digest_read", null, Arrays.asList(new ACL(Perms.READ, otherDigestUser)), CreateMode.PERSISTENT);
@@ -127,11 +128,35 @@ public void testSuperIsSuper() throws Exception {
             zk.delete("/digest_read", -1);
             zk.delete("/sasl_read/sub", -1);
             zk.delete("/sasl_read", -1);
-            //If the test failes it will most likely fail with a NoAuth exception before it ever gets to this assertion
-            assertEquals(authFailed.get(), 0);
         } finally {
             zk.close();
         }
     }
 
+    @Test
+    public void testSuperIsSuper() throws Exception {
+        connectAndPerformSuperOps();
+        //If the test fails it will most likely fail with a NoAuth exception before it ever gets to this assertion
+        assertEquals(authFailed.get(), 0);
+    }
+
+    @Test
+    public void testOtherSuperIsSuper() throws Exception {
+        String prevSection = System.setProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY, "OtherClient");
+
+        // KLUDGE: We do this quite late, as the server has been
+        // started at this point--but the implementation currently
+        // looks at the properties each time a SASL negotiation completes.
+        String superUser1Prop = ZooKeeperServer.SASL_SUPER_USER + ".1";
+        String prevSuperUser1 = System.setProperty(superUser1Prop, "other_super");
+
+        try {
+            connectAndPerformSuperOps();
+            //If the test fails it will most likely fail with a NoAuth exception before it ever gets to this assertion
+            assertEquals(authFailed.get(), 0);
+        } finally {
+            restoreProperty(superUser1Prop, prevSuperUser1);
+            restoreProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY, prevSection);
+        }
+    }
 }

From 7f66c7680f7b79eb1ba1cf253b4534de88ad3404 Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Mon, 9 Nov 2020 15:33:15 +0100
Subject: [PATCH 123/591] ZOOKEEPER-3836: Use Commons and JDK Functions in
 ClientBase

Related to #1357

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1358 from belugabehr/ZOOKEEPER-3836
---
 .../test/AtomicFileOutputStreamTest.java      | 16 ++++++-----
 .../org/apache/zookeeper/test/ClientBase.java | 28 -------------------
 2 files changed, 9 insertions(+), 35 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
index 2d931754939..a3d7096c6bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.test;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -27,6 +28,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileOutputStream;
 import org.junit.jupiter.api.AfterEach;
@@ -64,7 +66,7 @@ public void testWriteNewFile() throws IOException {
         fos.close();
         assertTrue(dstFile.exists());
 
-        String readBackData = ClientBase.readFile(dstFile);
+        String readBackData = new String(Files.readAllBytes(dstFile.toPath()), UTF_8);
         assertEquals(TEST_STRING, readBackData);
     }
 
@@ -82,12 +84,12 @@ public void testOverwriteFile() throws IOException {
         fos.flush();
 
         // Original contents still in place
-        assertEquals("", ClientBase.readFile(dstFile));
+        assertEquals("", new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
 
         fos.close();
 
         // New contents replace original file
-        String readBackData = ClientBase.readFile(dstFile);
+        String readBackData = new String(Files.readAllBytes(dstFile.toPath()), UTF_8);
         assertEquals(TEST_STRING, readBackData);
     }
 
@@ -112,9 +114,9 @@ public void testFailToFlush() throws IOException {
         }
 
         // Should not have touched original file
-        assertEquals(TEST_STRING_2, ClientBase.readFile(dstFile));
+        assertEquals(TEST_STRING_2, new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
 
-        assertEquals(dstFile.getName(), ClientBase.join(",", testDir.list()), "Temporary file should have been cleaned up");
+        assertEquals(dstFile.getName(), String.join(",", testDir.list()), "Temporary file should have been cleaned up");
     }
 
     /**
@@ -172,7 +174,7 @@ public void testAbortExistingFile() throws IOException {
         fos2.abort();
 
         // Should not have touched original file
-        assertEquals(TEST_STRING, ClientBase.readFile(dstFile));
+        assertEquals(TEST_STRING, new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
         assertEquals(1, testDir.list().length);
     }
 
@@ -193,7 +195,7 @@ public void testAbortExistingFileAfterFlush() throws IOException {
         fos2.abort();
 
         // Should not have touched original file
-        assertEquals(TEST_STRING, ClientBase.readFile(dstFile));
+        assertEquals(TEST_STRING, new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
         assertEquals(1, testDir.list().length);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index c628e4f51e7..43c2fad07b7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -23,10 +23,7 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
-import java.io.BufferedInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.net.ConnectException;
 import java.net.ProtocolException;
@@ -52,7 +49,6 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.apache.zookeeper.common.IOUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.server.ServerCnxnFactory;
@@ -700,30 +696,6 @@ void verifyRootOfAllServersMatch(String hostPort) throws InterruptedException, K
         }
     }
 
-    public static String readFile(File file) throws IOException {
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        BufferedInputStream is = new BufferedInputStream(new FileInputStream(file));
-        try {
-            IOUtils.copyBytes(is, os, 1024, true);
-        } finally {
-            is.close();
-        }
-        return os.toString();
-    }
-
-    public static String join(String separator, Object[] parts) {
-        StringBuilder sb = new StringBuilder();
-        boolean first = true;
-        for (Object part : parts) {
-            if (!first) {
-                sb.append(separator);
-                first = false;
-            }
-            sb.append(part);
-        }
-        return sb.toString();
-    }
-
     public static ZooKeeper createZKClient(String cxnString) throws Exception {
         return createZKClient(cxnString, CONNECTION_TIMEOUT);
     }

From 33bf36457318c1eed640bb990f2cbe6da96673b4 Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Thu, 12 Nov 2020 13:31:55 +0000
Subject: [PATCH 124/591] ZOOKEEPER-3839: ReconfigBackupTest Remove
 getFileContent

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Christopher Tubbs <ctubbsii@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1360 from belugabehr/ZOOKEEPER-3839
---
 .../server/quorum/ReconfigBackupTest.java     | 27 +++++++------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
index 0a3e580ba33..b465865b3f5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
@@ -18,21 +18,21 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
-import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.StringReader;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.Properties;
-import java.util.Scanner;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
@@ -50,16 +50,6 @@ public static String getVersionFromConfigStr(String config) throws IOException {
         return props.getProperty("version", "");
     }
 
-    // upgrade this once we have Google-Guava or Java 7+
-    public static String getFileContent(File file) throws FileNotFoundException {
-        Scanner sc = new Scanner(file);
-        StringBuilder sb = new StringBuilder();
-        while (sc.hasNextLine()) {
-            sb.append(sc.nextLine() + "\n");
-        }
-        return sb.toString();
-    }
-
     @BeforeEach
     public void setup() {
         ClientBase.setupTestEnv();
@@ -93,7 +83,7 @@ public void testBackupStatic() throws Exception {
             mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false);
             // check that a dynamic configuration file doesn't exist
             assertNull(mt[i].getFileByName("zoo.cfg.bak"), "static file backup shouldn't exist before bootup");
-            staticFileContent[i] = getFileContent(mt[i].confFile);
+            staticFileContent[i] = new String(Files.readAllBytes(mt[i].confFile.toPath()), UTF_8);
             mt[i].start();
         }
 
@@ -102,7 +92,7 @@ public void testBackupStatic() throws Exception {
                     "waiting for server " + i + " being up");
             File backupFile = mt[i].getFileByName("zoo.cfg.bak");
             assertNotNull(backupFile, "static file backup should exist");
-            staticBackupContent[i] = getFileContent(backupFile);
+            staticBackupContent[i] = new String(Files.readAllBytes(backupFile.toPath()), UTF_8);
             assertEquals(staticFileContent[i], staticBackupContent[i]);
         }
 
@@ -313,11 +303,12 @@ public void testVersionOfDynamicFilename() throws Exception {
             // All dynamic files created with the same version should have
             // same configs, and they should be equal to the config we get from QuorumPeer.
             if (i == 0) {
-                dynamicFileContent = getFileContent(dynamicConfigFile);
-                assertEquals(sortedConfigStr, dynamicFileContent + "version=200000000");
+                dynamicFileContent = new String(Files.readAllBytes(dynamicConfigFile.toPath()), UTF_8);
+                // last line in file should be version number
+                assertEquals(sortedConfigStr, dynamicFileContent + "\n" + "version=200000000");
             } else {
-                String otherDynamicFileContent = getFileContent(dynamicConfigFile);
-                assertEquals(dynamicFileContent, otherDynamicFileContent);
+                String otherDynamicFileContent = new String(Files.readAllBytes(dynamicConfigFile.toPath()), UTF_8);
+                assertEquals(dynamicFileContent + "\n", otherDynamicFileContent);
             }
 
             zk.close();

From b978dfb949e4ac4d703e956c6ef811415c831bcd Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Thu, 12 Nov 2020 16:03:25 +0100
Subject: [PATCH 125/591] ZOOKEEPER-3911: Data inconsistency caused by DIFF
 sync uncommitted log

Problem:

During DIFF sync, followers will persist the proposals from leader only after receiving the UPTODATE message. Leader will start serve client requests once receive a quorum of NEWLEADER ACK from followers, and NEWLEADER ACKs are sent from followers before receiving UPTODATE. So it's possible that when leader starting serving, followers might not persistent all of the DIFF sync proposals from leader. If at a certain point in time (e.g. once receiving UPTODATE from leader) all quorum servers crash, then these proposals, where leader they are quorum committed, will lost if the old leader can't come back and the followers form a new quorum. The end result is inconsistent view of the data from client before / after quorum recovers.

Solution:

Make sure follower to persist all DIFF proposals before they ACK NEWLEADER. When leader receives a quorum of NEWLEADER ACK, it's guaranteed that all DIFF sync proposals are quorum persistent and can survive after the recovery.

Author: Michael Han <hanm@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1445 from hanm/ZOOKEEPER-3911
---
 .../zookeeper/server/ZooKeeperServer.java     |  16 +-
 .../zookeeper/server/quorum/Learner.java      |  20 +-
 .../quorum/DIFFSyncConsistencyTest.java       | 294 ++++++++++++++++++
 3 files changed, 325 insertions(+), 5 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 8492dd56de7..f7f99f71571 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -667,6 +667,19 @@ public void startdata() throws IOException, InterruptedException {
     }
 
     public synchronized void startup() {
+        startupWithServerState(State.RUNNING);
+    }
+
+    public synchronized void startupWithoutServing() {
+        startupWithServerState(State.INITIAL);
+    }
+
+    public synchronized void startServing() {
+        setState(State.RUNNING);
+        notifyAll();
+    }
+
+    private void startupWithServerState(State state) {
         if (sessionTracker == null) {
             createSessionTracker();
         }
@@ -681,11 +694,12 @@ public synchronized void startup() {
 
         registerMetrics();
 
-        setState(State.RUNNING);
+        setState(state);
 
         requestPathMetricsCollector.start();
 
         localSessionEnabled = sessionTracker.isLocalSessionsEnabled();
+
         notifyAll();
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 9ab62069a85..1b6c25043a2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -741,8 +741,22 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     }
 
                     self.setCurrentEpoch(newEpoch);
-                    writeToTxnLog = true; //Anything after this needs to go to the transaction log, not applied directly in memory
+                    writeToTxnLog = true;
+                    //Anything after this needs to go to the transaction log, not applied directly in memory
                     isPreZAB1_0 = false;
+
+                    // ZOOKEEPER-3911: make sure sync the uncommitted logs before commit them (ACK NEWLEADER).
+                    sock.setSoTimeout(self.tickTime * self.syncLimit);
+                    self.setSyncMode(QuorumPeer.SyncMode.NONE);
+                    zk.startupWithoutServing();
+                    if (zk instanceof FollowerZooKeeperServer) {
+                        FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
+                        for (PacketInFlight p : packetsNotCommitted) {
+                            fzk.logRequest(p.hdr, p.rec, p.digest);
+                        }
+                        packetsNotCommitted.clear();
+                    }
+
                     writePacket(new QuorumPacket(Leader.ACK, newLeaderZxid, null, null), true);
                     break;
                 }
@@ -750,9 +764,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         }
         ack.setZxid(ZxidUtils.makeZxid(newEpoch, 0));
         writePacket(ack, true);
-        sock.setSoTimeout(self.tickTime * self.syncLimit);
-        self.setSyncMode(QuorumPeer.SyncMode.NONE);
-        zk.startup();
+        zk.startServing();
         /*
          * Update the election vote here to ensure that all members of the
          * ensemble report the same vote to new servers that start up and
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java
new file mode 100644
index 00000000000..9b9ea55f3f6
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java
@@ -0,0 +1,294 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.net.SocketTimeoutException;
+import java.util.Map;
+import javax.security.sasl.SaslException;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.ZooKeeper.States;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.Leader.Proposal;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+
+public class DIFFSyncConsistencyTest extends QuorumPeerTestBase {
+
+    private static int SERVER_COUNT = 3;
+    private MainThread[] mt = new MainThread[SERVER_COUNT];
+
+    @Test
+    @Timeout(value = 120)
+    public void testInconsistentDueToUncommittedLog() throws Exception {
+        final int LEADER_TIMEOUT_MS = 10_000;
+        final int[] clientPorts = new int[SERVER_COUNT];
+
+        StringBuilder sb = new StringBuilder();
+        String server;
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            clientPorts[i] = PortAssignment.unique();
+            server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
+                    + ":participant;127.0.0.1:" + clientPorts[i];
+            sb.append(server + "\n");
+        }
+        String currentQuorumCfgSection = sb.toString();
+
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false) {
+                @Override
+                public TestQPMain getTestQPMain() {
+                    return new MockTestQPMain();
+                }
+            };
+            mt[i].start();
+        }
+
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
+        }
+
+        int leader = findLeader(mt);
+        CountdownWatcher watch = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper("127.0.0.1:" + clientPorts[leader], ClientBase.CONNECTION_TIMEOUT, watch);
+        watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+        Map<Long, Proposal> outstanding = mt[leader].main.quorumPeer.leader.outstandingProposals;
+        // Increase the tick time to delay the leader going to looking to allow us proposal a transaction while other
+        // followers are offline.
+        int previousTick = mt[leader].main.quorumPeer.tickTime;
+        mt[leader].main.quorumPeer.tickTime = LEADER_TIMEOUT_MS;
+        // Let the previous tick on the leader exhaust itself so the new tick time takes effect
+        Thread.sleep(previousTick);
+
+        LOG.info("LEADER ELECTED {}", leader);
+
+        // Shutdown followers to make sure we don't accidentally send the proposal we are going to make to follower.
+        // In other words, we want to make sure the followers get the proposal later through DIFF sync.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != leader) {
+                mt[i].shutdown();
+            }
+        }
+
+        // Send a create request to old leader and make sure it's synced to disk.
+        try {
+            zk.create("/zk" + leader, "zk".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("create /zk" + leader + " should have failed");
+        } catch (KeeperException e) {
+        }
+
+        // Make sure that we actually did get it in process at the leader; there can be extra sessionClose proposals.
+        assertTrue(outstanding.size() > 0);
+        Proposal p = findProposalOfType(outstanding, OpCode.create);
+        LOG.info("Old leader id: {}. All proposals: {}", leader, outstanding);
+        assertNotNull(p, "Old leader doesn't have 'create' proposal");
+
+        // Make sure leader sync the proposal to disk.
+        int sleepTime = 0;
+        Long longLeader = (long) leader;
+        while (!p.qvAcksetPairs.get(0).getAckset().contains(longLeader)) {
+            if (sleepTime > 2000) {
+                fail("Transaction not synced to disk within 1 second " + p.qvAcksetPairs.get(0).getAckset() + " expected " + leader);
+            }
+            Thread.sleep(100);
+            sleepTime += 100;
+        }
+
+        // Start controlled followers where we deliberately make the follower fail once follower receive the UPTODATE
+        // message from leader. Because followers only persist proposals from DIFF sync after UPTODATE, this can
+        // deterministically simulate the situation where followers ACK NEWLEADER (which makes leader think she has the
+        // quorum support, but actually not afterwards) but immediately fail afterwards without persisting the proposals
+        // from DIFF sync.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i == leader) {
+                continue;
+            }
+
+            mt[i].start();
+            int sleepCount = 0;
+            while (mt[i].getQuorumPeer() == null) {
+                ++sleepCount;
+                if (sleepCount > 100) {
+                    fail("Can't start follower " + i + " !");
+                }
+                Thread.sleep(100);
+            }
+
+            ((CustomQuorumPeer) mt[i].getQuorumPeer()).setInjectError(true);
+            LOG.info("Follower {} started.", i);
+        }
+
+        // Verify leader can see it. The fact that leader can see it implies that
+        // leader should, at this point in time, get a quorum of ACK of NEWLEADER
+        // from two followers so leader can start serving requests; this also implies
+        // that DIFF sync from leader to followers are finished at this point in time.
+        // We then verify later that followers should have the same view after we shutdown
+        // this leader, otherwise it's a violation of ZAB / sequential consistency.
+        int c = 0;
+        while (c < 100) {
+            ++c;
+            try {
+                Stat stat = zk.exists("/zk" + leader, false);
+                assertNotNull(stat, "server " + leader + " should have /zk");
+                break;
+            } catch (KeeperException.ConnectionLossException e) {
+
+            }
+            Thread.sleep(100);
+        }
+
+        // Shutdown all servers
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            mt[i].shutdown();
+        }
+        waitForOne(zk, States.CONNECTING);
+
+        // Now restart all servers except the old leader. Only old leader has the transaction sync to disk.
+        // The old followers only had in memory view of the transaction, and they didn't have a chance
+        // to sync to disk because we made them fail at UPTODATE.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i == leader) {
+                continue;
+            }
+            mt[i].start();
+            int sleepCount = 0;
+            while (mt[i].getQuorumPeer() == null) {
+                ++sleepCount;
+                if (sleepCount > 100) {
+                    fail("Can't start follower " + i + " !");
+                }
+                Thread.sleep(100);
+            }
+
+            ((CustomQuorumPeer) mt[i].getQuorumPeer()).setInjectError(false);
+            LOG.info("Follower {} started again.", i);
+        }
+
+        int newLeader = findLeader(mt);
+        assertNotEquals(newLeader, leader, "new leader is still the old leader " + leader + " !!");
+
+        // This simulates the case where clients connected to the old leader had a view of the data
+        // "/zkX", but clients connect to the new leader does not have the same view of data (missing "/zkX").
+        // This inconsistent view of the quorum exposed from leaders is a violation of ZAB.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != newLeader) {
+                continue;
+            }
+            zk.close();
+            zk = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, watch);
+            watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+            Stat val = zk.exists("/zk" + leader, false);
+            assertNotNull(val, "Data inconsistency detected! "
+                    + "Server " + i + " should have a view of /zk" + leader + "!");
+        }
+
+        zk.close();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        for (int i = 0; i < mt.length; i++) {
+            try {
+                mt[i].shutdown();
+            } catch (InterruptedException e) {
+                LOG.warn("Quorum Peer interrupted while shutting it down", e);
+            }
+        }
+    }
+
+    static class CustomQuorumPeer extends QuorumPeer {
+
+        private volatile boolean injectError = false;
+
+        public CustomQuorumPeer() throws SaslException {
+
+        }
+
+        @Override
+        protected Follower makeFollower(FileTxnSnapLog logFactory) throws IOException {
+            return new Follower(this, new FollowerZooKeeperServer(logFactory, this, this.getZkDb())) {
+
+                @Override
+                void readPacket(QuorumPacket pp) throws IOException {
+                    /**
+                     * In real scenario got SocketTimeoutException while reading
+                     * the packet from leader because of network problem, but
+                     * here throwing SocketTimeoutException based on whether
+                     * error is injected or not
+                     */
+                    super.readPacket(pp);
+                    if (injectError && pp.getType() == Leader.UPTODATE) {
+                        String type = LearnerHandler.packetToString(pp);
+                        throw new SocketTimeoutException("Socket timeout while reading the packet for operation "
+                                + type);
+                    }
+                }
+
+            };
+        }
+
+        public void setInjectError(boolean injectError) {
+            this.injectError = injectError;
+        }
+
+    }
+
+    static class MockTestQPMain extends TestQPMain {
+
+        @Override
+        protected QuorumPeer getQuorumPeer() throws SaslException {
+            return new CustomQuorumPeer();
+        }
+
+    }
+
+    private Proposal findProposalOfType(Map<Long, Proposal> proposals, int type) {
+        for (Proposal proposal : proposals.values()) {
+            if (proposal.request.getHdr().getType() == type) {
+                return proposal;
+            }
+        }
+        return null;
+    }
+
+    private int findLeader(MainThread[] mt) {
+        for (int i = 0; i < mt.length; i++) {
+            if (mt[i].main.quorumPeer.leader != null) {
+                return i;
+            }
+        }
+        return -1;
+    }
+}

From 58e0a7741533ec3598c619c526208f8a90f5756c Mon Sep 17 00:00:00 2001
From: Lander Visterin <lander.visterin@klarrio.com>
Date: Mon, 16 Nov 2020 07:41:58 +0000
Subject: [PATCH 126/591] ZOOKEEPER-3991: Refresh InetSocketAddress before
 binding quorum server socket

Setting `electionPortBindRetry` to 0 (as recommended by the documentation for the setup we are using) results in this code being called in a loop.

The desired behaviour is that in case of a bad DNS reply the server socket creation will fail and keep retrying until the hostname resolves. The current behaviour is that it keeps throwing unresolved address errors even though the DNS entry became correct.

For more details and reproduction steps see the Jira issue at https://issues.apache.org/jira/browse/ZOOKEEPER-3991

Please note that the contents of this PR are different from the patch I initially attached to the issue.

Author: Lander Visterin <lander.visterin@klarrio.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1524 from lvisterin/ZOOKEEPER-3991
---
 .../org/apache/zookeeper/server/quorum/QuorumCnxManager.java     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 98283fbf078..0987ad30518 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -1132,6 +1132,7 @@ private ServerSocket createNewServerSocket() throws IOException {
                 }
 
                 socket.setReuseAddress(true);
+                address = new InetSocketAddress(address.getHostString(), address.getPort());
                 socket.bind(address);
 
                 return socket;

From d8561f620fa8611e9a6819d9879b0f18e5a404a9 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 16 Nov 2020 08:03:48 +0000
Subject: [PATCH 127/591] ZOOKEEPER-3979: Clean up/robustify audit logs

This is a minimally disruptive mitigation for the issue reported in ZOOKEEPER-3979, "Clients can corrupt the audit log."

A new property allows disabling the "legacy" `digest` authentication mechanism, which could be used by "an attacker" to inject unsanitized data into audit logs.

In general, ZooKeeper administrators should disable unused authentication providers, and ensure that the ones which remain enabled to not produce user IDs susceptible to confuse audit log parsers.

The rest of the patch is made of assorted small cleanups which should not have any impact on operation or security.

(Note that the patch *series* attached to https://github.com/apache/zookeeper/pull/1519 contains additional measures, such as filtering audit user IDs by authentication scheme, but those seem to be overkill for typical deployment scenarios.  That code could still be fished out and polished if the circumstances evolved.)

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1533 from ztzg/ZOOKEEPER-3979-robustify-audit-logs
---
 .../main/resources/markdown/zookeeperAdmin.md | 10 +++
 .../apache/zookeeper/audit/AuditHelper.java   |  2 +-
 .../org/apache/zookeeper/server/Request.java  | 36 +++-----
 .../auth/DigestAuthenticationProvider.java    |  8 ++
 .../server/auth/ProviderRegistry.java         |  8 +-
 .../zookeeper/server/util/AuthUtil.java       | 29 ++++++-
 .../zookeeper/audit/Log4jAuditLoggerTest.java |  2 +-
 .../test/DigestAuthDisabledTest.java          | 82 +++++++++++++++++++
 8 files changed, 149 insertions(+), 28 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index a14559e8519..7dc9063e8bb 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1440,6 +1440,16 @@ Beside this page, you can also find useful information about client side configu
 The ZooKeeper Wiki also has useful pages about [ZooKeeper SSL support](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide),
 and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+and+SASL).
 
+* *DigestAuthenticationProvider.enabled* :
+    (Java system property: **zookeeper.DigestAuthenticationProvider.enabled**)
+    **New in 3.7:**
+    Determines whether the `digest` authentication provider is
+    enabled.  The default value is **true** for backwards
+    compatibility, but it may be a good idea to disable this provider
+    if not used, as it can result in misleading entries appearing in
+    audit logs
+    (see [ZOOKEEPER-3979](https://issues.apache.org/jira/browse/ZOOKEEPER-3979))
+
 * *DigestAuthenticationProvider.superDigest* :
     (Java system property: **zookeeper.DigestAuthenticationProvider.superDigest**)
     By default this feature is **disabled**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
index ce0d58a87ba..ec4ca136c2f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
@@ -179,7 +179,7 @@ private static void logMultiOperation(Request request, ProcessTxnResult rc) thro
     }
 
     private static void log(Request request, String path, String op, String acls, String createMode, Result result) {
-        log(request.getUsers(), op, path, acls, createMode,
+        log(request.getUsersForAudit(), op, path, acls, createMode,
                 request.cnxn.getSessionIdHex(), request.cnxn.getHostAddress(), result);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 0a8bde6f618..a68203b207c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -463,30 +463,20 @@ public void logLatency(SummarySet metric, String key) {
     }
 
     /**
-     * Returns comma separated list of users authenticated in the current
-     * session
+     * Returns a formatted, comma-separated list of the user IDs
+     * associated with this {@code Request}, or {@code null} if no
+     * user IDs were found.
+     *
+     * The return value is used for audit logging.  While it may be
+     * easy on the eyes, it is underspecified: it does not mention the
+     * corresponding {@code scheme}, nor are its components escaped.
+     * This is not a security feature.
+     *
+     * @return a comma-separated list of user IDs, or {@code null} if
+     * no user IDs were found.
      */
-    public String getUsers() {
-        if (authInfo == null) {
-            return (String) null;
-        }
-        if (authInfo.size() == 1) {
-            return AuthUtil.getUser(authInfo.get(0));
-        }
-        StringBuilder users = new StringBuilder();
-        boolean first = true;
-        for (Id id : authInfo) {
-            String user = AuthUtil.getUser(id);
-            if (user != null) {
-                if (first) {
-                    first = false;
-                } else {
-                    users.append(",");
-                }
-                users.append(user);
-            }
-        }
-        return users.toString();
+    public String getUsersForAudit() {
+        return AuthUtil.getUsers(authInfo);
     }
 
     public TxnDigest getTxnDigest() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
index 8b64154cd06..6e2687521d2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
@@ -47,6 +47,8 @@ public class DigestAuthenticationProvider implements AuthenticationProvider {
         LOG.info("ACL digest algorithm is: {}", DIGEST_ALGORITHM);
     }
 
+    private static final String DIGEST_AUTH_ENABLED = "zookeeper.DigestAuthenticationProvider.enabled";
+
     /** specify a command line property with key of
      * "zookeeper.DigestAuthenticationProvider.superDigest"
      * and value of "super:&lt;base64encoded(SHA1(password))&gt;" to enable
@@ -54,6 +56,12 @@ public class DigestAuthenticationProvider implements AuthenticationProvider {
      */
     private static final String superDigest = System.getProperty("zookeeper.DigestAuthenticationProvider.superDigest");
 
+    public static boolean isEnabled() {
+        boolean enabled = Boolean.parseBoolean(System.getProperty(DIGEST_AUTH_ENABLED, "true"));
+        LOG.info("{} = {}", DIGEST_AUTH_ENABLED, enabled);
+        return enabled;
+    }
+
     public String getScheme() {
         return "digest";
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
index 856cf78687d..3315e44edf3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
@@ -45,9 +45,13 @@ public static void reset() {
     public static void initialize() {
         synchronized (ProviderRegistry.class) {
             IPAuthenticationProvider ipp = new IPAuthenticationProvider();
-            DigestAuthenticationProvider digp = new DigestAuthenticationProvider();
             authenticationProviders.put(ipp.getScheme(), ipp);
-            authenticationProviders.put(digp.getScheme(), digp);
+
+            if (DigestAuthenticationProvider.isEnabled()) {
+                DigestAuthenticationProvider digp = new DigestAuthenticationProvider();
+                authenticationProviders.put(digp.getScheme(), digp);
+            }
+
             Enumeration<Object> en = System.getProperties().keys();
             while (en.hasMoreElements()) {
                 String k = (String) en.nextElement();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
index 7e5ca4f7267..f404e2516f9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
@@ -19,6 +19,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.stream.Collectors;
 import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.AuthenticationProvider;
@@ -40,6 +41,32 @@ public static String getUser(Id id) {
         return provider == null ? null : provider.getUserName(id.getId());
     }
 
+    /**
+     * Returns a formatted, comma-separated list of the user IDs held
+     * in {@code authInfo}, or {@code null} if no user IDs were found.
+     *
+     * Note that while the result may be easy on the eyes, it is
+     * underspecified: it does not mention the corresponding {@code
+     * scheme}, nor are its components escaped.  It is intended for
+     * for logging, and is not a security feature.
+     *
+     * @param authInfo A list of {@code Id} objects, or {@code null}.
+     * @return a comma-separated list of user IDs, or {@code null} if
+     * no user IDs were found.
+     */
+    public static String getUsers(List<Id> authInfo) {
+        if (authInfo == null) {
+            return null;
+        }
+
+        String formatted = authInfo.stream()
+            .map(AuthUtil::getUser)
+            .filter(name -> name != null && !name.trim().isEmpty())
+            .collect(Collectors.joining(","));
+
+        return formatted.isEmpty() ? null : formatted;
+    }
+
     /**
      * Gets user from id to prepare ClientInfo.
      *
@@ -49,7 +76,7 @@ public static String getUser(Id id) {
     public static List<ClientInfo> getClientInfos(List<Id> authInfo) {
         List<ClientInfo> clientAuthInfo = new ArrayList<>(authInfo.size());
         authInfo.forEach(id -> {
-            String user = AuthUtil.getUser(id);
+            String user = getUser(id);
             clientAuthInfo.add(new ClientInfo(id.getScheme(), user == null ? "" : user));
         });
         return clientAuthInfo;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
index 8a5f781a83a..0080b01c718 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
@@ -301,7 +301,7 @@ private String getUser() {
         ServerCnxn next = getServerCnxn();
         Request request = new Request(next, -1, -1, -1, null,
                 next.getAuthInfo());
-        return request.getUsers();
+        return request.getUsersForAudit();
     }
 
     private String getIp() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java
new file mode 100644
index 00000000000..bbbc63f964b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.TestableZooKeeper;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.ZooKeeper;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class DigestAuthDisabledTest extends ClientBase {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.DigestAuthenticationProvider.enabled", "false");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() {
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.enabled");
+    }
+
+    private final CountDownLatch authFailed = new CountDownLatch(1);
+
+    @Override
+    protected TestableZooKeeper createClient(String hp) throws IOException, InterruptedException {
+        MyWatcher watcher = new MyWatcher();
+        return createClient(watcher, hp);
+    }
+
+    private class MyWatcher extends CountdownWatcher {
+
+        @Override
+        public synchronized void process(WatchedEvent event) {
+            if (event.getState() == KeeperState.AuthFailed) {
+                authFailed.countDown();
+            } else {
+                super.process(event);
+            }
+        }
+
+    }
+
+    @Test
+    public void testDigestAuthDisabledTriggersAuthFailed() throws Exception {
+        ZooKeeper zk = createClient();
+        try {
+            zk.addAuthInfo("digest", "roger:muscadet".getBytes());
+            zk.getData("/path1", false, null);
+            fail("Should get auth state error");
+        } catch (KeeperException.AuthFailedException e) {
+            if (!authFailed.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS)) {
+                fail("Should have called my watcher");
+            }
+        } finally {
+            zk.close();
+        }
+    }
+}

From b842cd4b463a7c3674963f6f66fc392293c1334c Mon Sep 17 00:00:00 2001
From: Pooja Malik <pmalik@salesforce.com>
Date: Mon, 16 Nov 2020 10:00:18 +0000
Subject: [PATCH 128/591] ZOOKEEPER-3978: Adding additional security metrics to
 zookeeper

This is same as https://github.com/apache/zookeeper/pull/1513 for master branch with additional changes using junit5 jupiter lib.

The changes include adding 3 metrics for security for zookeeper for better monitoring

Monitoring all authN and AuthZ errors
Monitoring all local non mtls local connections counts
Monitoring all remote non mtls connection counts.

Author: Pooja Malik <pmalik@salesforce.com>

Reviewers: Michael Han <hanm@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1523 from p-malik/zk_sec_master
---
 .../server/NettyServerCnxnFactory.java        | 16 +++-
 .../apache/zookeeper/server/ServerStats.java  | 42 +++++++++
 .../zookeeper/server/ZooKeeperServer.java     |  8 ++
 .../zookeeper/server/ZooKeeperServerBean.java | 24 +++++
 .../server/ZooKeeperServerMXBean.java         | 20 ++++
 .../zookeeper/server/ZooKeeperServerMain.java |  5 +
 .../zookeeper/server/admin/Commands.java      |  3 +
 .../zookeeper/common/BCFKSFileLoaderTest.java |  1 -
 .../zookeeper/server/NettyServerCnxnTest.java | 59 ++++++++++++
 .../zookeeper/server/X509AuthFailureTest.java | 94 +++++++++++++++++++
 .../server/ZooKeeperServerMainTest.java       | 22 ++++-
 .../zookeeper/server/admin/CommandsTest.java  |  3 +
 12 files changed, 291 insertions(+), 6 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 55743ffb90a..9995f48e43c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -47,6 +47,7 @@
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.net.SocketAddress;
 import java.security.KeyManagementException;
 import java.security.NoSuchAlgorithmException;
 import java.util.HashSet;
@@ -258,6 +259,16 @@ public void channelActive(ChannelHandlerContext ctx) throws Exception {
                 allChannels.add(ctx.channel());
                 addCnxn(cnxn);
             }
+            if (ctx.channel().pipeline().get(SslHandler.class) == null) {
+                SocketAddress remoteAddress = cnxn.getChannel().remoteAddress();
+                if (remoteAddress != null
+                        && !((InetSocketAddress) remoteAddress).getAddress().isLoopbackAddress()) {
+                    LOG.trace("NettyChannelHandler channelActive: remote={} local={}", remoteAddress, cnxn.getChannel().localAddress());
+                    zkServer.serverStats().incrementNonMTLSRemoteConnCount();
+                } else {
+                    zkServer.serverStats().incrementNonMTLSLocalConnCount();
+                }
+            }
         }
 
         @Override
@@ -429,7 +440,9 @@ public void operationComplete(Future<Channel> future) {
                         return;
                     }
 
-                    if (KeeperException.Code.OK != authProvider.handleAuthentication(cnxn, null)) {
+                    KeeperException.Code code = authProvider.handleAuthentication(cnxn, null);
+                    if (KeeperException.Code.OK != code) {
+                        zkServer.serverStats().incrementAuthFailedCount();
                         LOG.error("Authentication failed for session 0x{}", Long.toHexString(cnxn.getSessionId()));
                         cnxn.close(ServerCnxn.DisconnectReason.SASL_AUTH_FAILURE);
                         return;
@@ -440,6 +453,7 @@ public void operationComplete(Future<Channel> future) {
                 allChannels.add(Objects.requireNonNull(futureChannel));
                 addCnxn(cnxn);
             } else {
+                zkServer.serverStats().incrementAuthFailedCount();
                 LOG.error("Unsuccessful handshake with session 0x{}", Long.toHexString(cnxn.getSessionId()));
                 ServerMetrics.getMetrics().UNSUCCESSFUL_HANDSHAKE.add(1);
                 cnxn.close(ServerCnxn.DisconnectReason.FAILED_HANDSHAKE);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java
index 327c5c29720..5c1a4e7f664 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java
@@ -41,6 +41,12 @@ public class ServerStats {
 
     private final BufferStats clientResponseStats = new BufferStats();
 
+    private AtomicLong nonMTLSRemoteConnCntr = new AtomicLong(0);
+
+    private AtomicLong nonMTLSLocalConnCntr = new AtomicLong(0);
+
+    private AtomicLong authFailedCntr = new AtomicLong(0);
+
     private final Provider provider;
     private final long startTime = Time.currentElapsedTime();
 
@@ -181,6 +187,42 @@ public void resetFsyncThresholdExceedCount() {
         fsyncThresholdExceedCount.set(0);
     }
 
+    public long getNonMTLSLocalConnCount() {
+        return nonMTLSLocalConnCntr.get();
+    }
+
+    public void incrementNonMTLSLocalConnCount() {
+        nonMTLSLocalConnCntr.incrementAndGet();
+    }
+
+    public void resetNonMTLSLocalConnCount() {
+        nonMTLSLocalConnCntr.set(0);
+    }
+
+    public long getNonMTLSRemoteConnCount() {
+        return nonMTLSRemoteConnCntr.get();
+    }
+
+    public void incrementNonMTLSRemoteConnCount() {
+        nonMTLSRemoteConnCntr.incrementAndGet();
+    }
+
+    public void resetNonMTLSRemoteConnCount() {
+        nonMTLSRemoteConnCntr.set(0);
+    }
+
+    public long getAuthFailedCount() {
+        return authFailedCntr.get();
+    }
+
+    public void incrementAuthFailedCount() {
+        authFailedCntr.incrementAndGet();
+    }
+
+    public void resetAuthFailedCount() {
+        authFailedCntr.set(0);
+    }
+
     public void reset() {
         resetLatency();
         resetRequestCounters();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index f7f99f71571..00d6ed8f00c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1894,6 +1894,9 @@ protected void registerMetrics() {
         rootContext.registerGauge("min_client_response_size", stats.getClientResponseStats()::getMinBufferSize);
 
         rootContext.registerGauge("outstanding_tls_handshake", this::getOutstandingHandshakeNum);
+        rootContext.registerGauge("auth_failed_count", stats::getAuthFailedCount);
+        rootContext.registerGauge("non_mtls_remote_conn_count", stats::getNonMTLSRemoteConnCount);
+        rootContext.registerGauge("non_mtls_local_conn_count", stats::getNonMTLSLocalConnCount);
     }
 
     protected void unregisterMetrics() {
@@ -1929,6 +1932,11 @@ protected void unregisterMetrics() {
         rootContext.unregisterGauge("max_client_response_size");
         rootContext.unregisterGauge("min_client_response_size");
 
+        rootContext.unregisterGauge("auth_failed_count");
+        rootContext.unregisterGauge("non_mtls_remote_conn_count");
+        rootContext.unregisterGauge("non_mtls_local_conn_count");
+
+
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
index 5eac7edf8c5..e85d167a6aa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
@@ -133,6 +133,18 @@ public long getFsyncThresholdExceedCount() {
         return zks.serverStats().getFsyncThresholdExceedCount();
     }
 
+    public long getAuthFailedCount() {
+        return zks.serverStats().getAuthFailedCount();
+    }
+
+    public long getNonMTLSRemoteConnCount() {
+        return zks.serverStats().getNonMTLSRemoteConnCount();
+    }
+
+    public long getNonMTLSLocalConnCount() {
+        return zks.serverStats().getNonMTLSLocalConnCount();
+    }
+
     public void resetLatency() {
         zks.serverStats().resetLatency();
     }
@@ -145,11 +157,23 @@ public void resetFsyncThresholdExceedCount() {
         zks.serverStats().resetFsyncThresholdExceedCount();
     }
 
+    public void resetAuthFailedCount() {
+        zks.serverStats().resetAuthFailedCount();
+    }
+
+    public void resetNonMTLSConnCount() {
+        zks.serverStats().resetNonMTLSRemoteConnCount();
+        zks.serverStats().resetNonMTLSLocalConnCount();
+    }
+
     public void resetStatistics() {
         ServerStats serverStats = zks.serverStats();
         serverStats.resetRequestCounters();
         serverStats.resetLatency();
         serverStats.resetFsyncThresholdExceedCount();
+        serverStats.resetAuthFailedCount();
+        serverStats.resetNonMTLSRemoteConnCount();
+        serverStats.resetNonMTLSLocalConnCount();
     }
 
     public long getNumAliveConnections() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
index 851fc564a09..eed66cca22c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
@@ -59,6 +59,18 @@ public interface ZooKeeperServerMXBean {
      * @return number of fsync threshold exceeds so far
      */
     long getFsyncThresholdExceedCount();
+    /**
+     * @return number of AuthFailedCount so far
+     */
+    long getAuthFailedCount();
+    /**
+     * @return number of NonMTLSLocalConnCount so far
+     */
+    long getNonMTLSLocalConnCount();
+    /**
+     * @return number of NonMTLSRemoteConnCount so far
+     */
+    long getNonMTLSRemoteConnCount();
     /**
      * @return number of outstanding requests.
      */
@@ -167,6 +179,14 @@ public interface ZooKeeperServerMXBean {
      * Reset Fsync Threshold Exceed Count statistics only.
      */
     void resetFsyncThresholdExceedCount();
+    /**
+     * Reset NonMTLS(Local+Remote)ConnCount statistics only.
+     */
+    void resetNonMTLSConnCount();
+    /**
+     * Reset AuthFailedCount statistics only.
+     */
+    void resetAuthFailedCount();
     /**
      * @return number of alive client connections
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index abb4d0d49ea..3daf96d6001 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -237,4 +237,9 @@ ServerCnxnFactory getCnxnFactory() {
         return cnxnFactory;
     }
 
+    // VisibleForTesting
+    ServerCnxnFactory getSecureCnxnFactory() {
+        return secureCnxnFactory;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 7bb7c42410a..705c6cc3645 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -432,6 +432,9 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "open_file_descriptor_count": Long (unix only)
      *   - "max_file_descriptor_count": Long (unix only)
      *   - "fsync_threshold_exceed_count": Long
+     *   - "non_mtls_conn_count": Long
+     *   - "non_mtls_remote_conn_count": Long
+     *   - "non_mtls_local_conn_count": Long
      *   - "followers": Integer (leader only)
      *   - "synced_followers": Integer (leader only)
      *   - "pending_syncs": Integer (leader only)
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
index 1850b653bc1..b3d9e34f32e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
@@ -25,7 +25,6 @@
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
-
 public class BCFKSFileLoaderTest extends BaseX509ParameterizedTestCase {
 
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index 67a4cc5aba2..576b0185163 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -27,7 +27,17 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelFuture;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelId;
+import io.netty.channel.ChannelPipeline;
+import io.netty.util.Attribute;
 import java.io.IOException;
+import java.net.InetSocketAddress;
 import java.net.ProtocolException;
 import java.nio.charset.StandardCharsets;
 import java.util.Random;
@@ -43,6 +53,7 @@
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.BufferStats;
+import org.apache.zookeeper.server.quorum.LeaderZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.SSLAuthTest;
 import org.apache.zookeeper.test.TestByteBufAllocator;
@@ -50,6 +61,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import org.mockito.Mockito;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -152,6 +164,53 @@ public void testClientResponseStatsUpdate() throws IOException, InterruptedExcep
         }
     }
 
+    @Test
+    public void testNonMTLSLocalConn() throws IOException, InterruptedException, KeeperException {
+        try (ZooKeeper zk = createClient()) {
+            ServerStats serverStats = serverFactory.getZooKeeperServer().serverStats();
+            //2 for local stat connection and this client
+            assertEquals(2, serverStats.getNonMTLSLocalConnCount());
+            assertEquals(0, serverStats.getNonMTLSRemoteConnCount());
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testNonMTLSRemoteConn() throws Exception {
+        Channel channel = mock(Channel.class);
+        ChannelId id = mock(ChannelId.class);
+        ChannelFuture success = mock(ChannelFuture.class);
+        ChannelHandlerContext context = mock(ChannelHandlerContext.class);
+        ChannelPipeline channelPipeline = mock(ChannelPipeline.class);
+
+        when(context.channel()).thenReturn(channel);
+        when(channel.pipeline()).thenReturn(channelPipeline);
+        when(success.channel()).thenReturn(channel);
+        when(channel.closeFuture()).thenReturn(success);
+
+        InetSocketAddress address = new InetSocketAddress(0);
+        when(channel.remoteAddress()).thenReturn(address);
+        when(channel.id()).thenReturn(id);
+        NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
+        LeaderZooKeeperServer zks = mock(LeaderZooKeeperServer.class);
+        factory.setZooKeeperServer(zks);
+        Attribute atr = mock(Attribute.class);
+        Mockito.doReturn(atr).when(channel).attr(
+                Mockito.any()
+        );
+        doNothing().when(atr).set(Mockito.any());
+
+        when(zks.isRunning()).thenReturn(true);
+
+        ServerStats.Provider providerMock = mock(ServerStats.Provider.class);
+        when(zks.serverStats()).thenReturn(new ServerStats(providerMock));
+
+        factory.channelHandler.channelActive(context);
+
+        assertEquals(0, zks.serverStats().getNonMTLSLocalConnCount());
+        assertEquals(1, zks.serverStats().getNonMTLSRemoteConnCount());
+    }
+
     @Test
     public void testServerSideThrottling() throws IOException, InterruptedException, KeeperException {
         try (ZooKeeper zk = createClient()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
new file mode 100644
index 00000000000..189a40f28ab
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
@@ -0,0 +1,94 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p/>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p/>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class X509AuthFailureTest {
+    protected static final Logger LOG = LoggerFactory.getLogger(X509AuthFailureTest.class);
+
+    private static ClientX509Util clientX509Util;
+    public static final int TIMEOUT = 5000;
+    public static int CONNECTION_TIMEOUT = 30000;
+
+    @BeforeEach
+    public void setup() throws Exception{
+        clientX509Util = new ClientX509Util();
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
+        System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
+        System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+    }
+
+    @AfterEach
+    public void teardown() throws Exception {
+        System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
+        System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        System.clearProperty(ZKClientConfig.SECURE_CLIENT);
+        System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        clientX509Util.close();
+    }
+
+    /**
+     * Developers might use standalone mode (which is the default for one server).
+     * This test checks metrics for authz failure in standalone server
+     */
+    @Test
+    public void testSecureStandaloneServerAuthNFailure() throws Exception {
+        final Integer CLIENT_PORT = PortAssignment.unique();
+        final Integer SECURE_CLIENT_PORT = PortAssignment.unique();
+
+        ZooKeeperServerMainTest.MainThread mt = new ZooKeeperServerMainTest.MainThread(CLIENT_PORT, SECURE_CLIENT_PORT, true, null);
+        mt.start();
+
+        try {
+            ZooKeeper zk = createZKClnt("127.0.0.1:" + SECURE_CLIENT_PORT);
+            fail("should not be reached");
+        } catch (Exception e){
+            //Expected
+        }
+        ServerStats serverStats = mt.getSecureCnxnFactory().getZooKeeperServer().serverStats();
+        assertTrue(serverStats.getAuthFailedCount() >= 1);
+        mt.shutdown();
+
+    }
+
+    private ZooKeeper createZKClnt(String cxnString) throws Exception {
+        ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(cxnString, TIMEOUT, watcher);
+        watcher.waitForConnected(CONNECTION_TIMEOUT);
+        return zk;
+    }
+
+}
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
index da821296ea1..920fdf406bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
@@ -72,10 +72,16 @@ public static class MainThread extends Thread {
         final File logDir;
 
         public MainThread(int clientPort, boolean preCreateDirs, String configs) throws IOException {
-            this(clientPort, preCreateDirs, ClientBase.createTmpDir(), configs);
+            this(clientPort, null, preCreateDirs, ClientBase.createTmpDir(), configs);
         }
 
-        public MainThread(int clientPort, boolean preCreateDirs, File tmpDir, String configs) throws IOException {
+        public MainThread(int clientPort, Integer secureClientPort, boolean preCreateDirs, String configs)
+                throws  IOException {
+            this(clientPort, secureClientPort,
+                    preCreateDirs, ClientBase.createTmpDir(), configs);
+        }
+
+        public MainThread(int clientPort, Integer secureClientPort, boolean preCreateDirs, File tmpDir, String configs) throws IOException {
             super("Standalone server with clientPort:" + clientPort);
             this.tmpDir = tmpDir;
             confFile = new File(tmpDir, "zoo.cfg");
@@ -105,6 +111,10 @@ public MainThread(int clientPort, boolean preCreateDirs, File tmpDir, String con
             fwriter.write("dataDir=" + normalizedDataDir + "\n");
             fwriter.write("dataLogDir=" + normalizedLogDir + "\n");
             fwriter.write("clientPort=" + clientPort + "\n");
+
+            if (secureClientPort != null) {
+                fwriter.write("secureClientPort=" + secureClientPort + "\n");
+            }
             fwriter.flush();
             fwriter.close();
 
@@ -148,6 +158,10 @@ ServerCnxnFactory getCnxnFactory() {
             return main.getCnxnFactory();
         }
 
+        public ServerCnxnFactory getSecureCnxnFactory(){
+            return main.getSecureCnxnFactory();
+        }
+
     }
 
     public static class TestZKSMain extends ZooKeeperServerMain {
@@ -234,7 +248,7 @@ public void testReadOnlySnapshotDir() throws Exception {
         snapDir.setWritable(false);
 
         // Restart ZK and observe a failure
-        main = new MainThread(CLIENT_PORT, false, tmpDir, null);
+        main = new MainThread(CLIENT_PORT, null, false, tmpDir, null);
         main.start();
 
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
@@ -273,7 +287,7 @@ public void testReadOnlyTxnLogDir() throws Exception {
         logDir.setWritable(false);
 
         // Restart ZK and observe a failure
-        main = new MainThread(CLIENT_PORT, false, tmpDir, null);
+        main = new MainThread(CLIENT_PORT, null, false, tmpDir, null);
         main.start();
 
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index 3cd6d60376c..ff8dc203302 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -165,6 +165,9 @@ public void testMonitor() throws IOException, InterruptedException {
                 new Field("last_client_response_size", Integer.class),
                 new Field("max_client_response_size", Integer.class),
                 new Field("min_client_response_size", Integer.class),
+                new Field("auth_failed_count", Long.class),
+                new Field("non_mtls_remote_conn_count", Long.class),
+                new Field("non_mtls_local_conn_count", Long.class),
                 new Field("uptime", Long.class),
                 new Field("global_sessions", Long.class),
                 new Field("local_sessions", Long.class),

From b2b06dca8ecffcfaa35ba5797d3c8d82045cbe08 Mon Sep 17 00:00:00 2001
From: huangwenbo04 <huangwenbo04@meituan.com>
Date: Mon, 16 Nov 2020 16:37:16 +0100
Subject: [PATCH 129/591] ZOOKEEPER-3994: Disconnect reason is wrong for
 NOT_READ_ONLY_CLIENT and CLIENT_ZXID_AHEAD

Author: huangwenbo04 <huangwenbo04@meituan.com>

Reviewers: eolivelli@apache.org, andor@apache.org

Closes #1525 from nsnhuang/ZOOKEEPER-3994 and squashes the following commits:

578c4d730 [huangwenbo04] checkstyle
aaa5430b9 [huangwenbo04] use assertThrows() method instead of try-catch
0c35eb487 [huangwenbo04] make ServerCnxn.CloseRequestException public
fb4a18eeb [huangwenbo04] add approved licenses And fix checkstyle errors
dfe0c576f [huangwenbo04] DisconnectReason.CLIENT_ZXID_AHEAD test case
406af2279 [huangwenbo04] add comments
2f4efae70 [huangwenbo04] add test case
61a815af6 [huangwenbo04] disconnect reason wrong
---
 .../zookeeper/server/ZooKeeperServer.java     |  4 +-
 .../zookeeper/server/ZooKeeperServerTest.java | 29 +++++++++
 .../quorum/ReadOnlyZooKeeperServerTest.java   | 65 +++++++++++++++++++
 3 files changed, 96 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 00d6ed8f00c..f13f04b14d7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1394,7 +1394,7 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
         if (!readOnly && this instanceof ReadOnlyZooKeeperServer) {
             String msg = "Refusing session request for not-read-only client " + cnxn.getRemoteSocketAddress();
             LOG.info(msg);
-            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
+            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
         }
         if (connReq.getLastZxidSeen() > zkDb.dataTree.lastProcessedZxid) {
             String msg = "Refusing session request for client "
@@ -1406,7 +1406,7 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
                          + " client must try another server";
 
             LOG.info(msg);
-            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
+            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
         }
         int sessionTimeout = connReq.getTimeOut();
         byte[] passwd = connReq.getPasswd();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index 374ed5b1e57..143938bd849 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -20,12 +20,16 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
 import java.io.File;
 import java.io.IOException;
+import java.nio.ByteBuffer;
 import java.util.List;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.test.ClientBase;
@@ -135,4 +139,29 @@ public void testInvalidSnapshot() {
         }
     }
 
+    @Test
+    public void testClientZxidAhead() {
+        ZooKeeperServer zooKeeperServer = new ZooKeeperServer();
+        final ZKDatabase zkDatabase = new ZKDatabase(mock(FileTxnSnapLog.class));
+        zooKeeperServer.setZKDatabase(zkDatabase);
+
+        final ByteBuffer output = ByteBuffer.allocate(30);
+        // serialize a connReq
+        output.putInt(1);
+        // lastZxid
+        output.putLong(99L);
+        output.putInt(500);
+        output.putLong(123L);
+        output.putInt(1);
+        output.put((byte) 1);
+        output.put((byte) 1);
+        output.flip();
+
+        ServerCnxn.CloseRequestException e = assertThrows(ServerCnxn.CloseRequestException.class, () -> {
+            final NIOServerCnxn nioServerCnxn = mock(NIOServerCnxn.class);
+            zooKeeperServer.processConnectRequest(nioServerCnxn, output);
+        });
+        assertEquals(e.getReason(), ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
new file mode 100644
index 00000000000..165dbdca1d7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import java.nio.ByteBuffer;
+import org.apache.zookeeper.server.NIOServerCnxn;
+import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.ZKDatabase;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.junit.jupiter.api.Test;
+
+/**
+ * test ReadOnlyZooKeeperServer
+ */
+public class ReadOnlyZooKeeperServerTest {
+
+    /**
+     * test method {@link ZooKeeperServer#processConnectRequest(org.apache.zookeeper.server.ServerCnxn, java.nio.ByteBuffer)}
+     */
+    @Test
+    public void testReadOnlyZookeeperServer() {
+        ReadOnlyZooKeeperServer readOnlyZooKeeperServer = new ReadOnlyZooKeeperServer(
+                mock(FileTxnSnapLog.class), mock(QuorumPeer.class), mock(ZKDatabase.class));
+
+        final ByteBuffer output = ByteBuffer.allocate(30);
+        // serialize a connReq
+        output.putInt(1);
+        output.putLong(1L);
+        output.putInt(500);
+        output.putLong(123L);
+        output.putInt(1);
+        output.put((byte) 1);
+        // set readOnly false
+        output.put((byte) 0);
+        output.flip();
+
+        ServerCnxn.CloseRequestException e = assertThrows(ServerCnxn.CloseRequestException.class, () -> {
+            final NIOServerCnxn nioServerCnxn = mock(NIOServerCnxn.class);
+            readOnlyZooKeeperServer.processConnectRequest(nioServerCnxn, output);
+        });
+        assertEquals(e.getReason(), ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
+    }
+
+
+}

From 6dfdf14a637d853bd77236dfbdd347912808074f Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Tue, 17 Nov 2020 17:24:51 +0000
Subject: [PATCH 130/591] ZOOKEEPER-3691: Use JDK String Join Method in ZK
 StringUtils

Author: David Mollitor <dmollitor@apache.org>
Author: belugabehr <12578579+belugabehr@users.noreply.github.com>

Reviewers: maoling <maoling199210191@sina.com>, Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1217 from belugabehr/ZOOKEEPER-3691
---
 .../apache/zookeeper/common/StringUtils.java  | 29 +++++++------
 .../apache/zookeeper/test/StringUtilTest.java | 41 +++++++++++++++----
 2 files changed, 50 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
index 36ee2d75019..391aff11d1a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
@@ -20,6 +20,7 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.Objects;
 
 public class StringUtils {
 
@@ -44,22 +45,24 @@ public static List<String> split(String value, String separator) {
     }
 
     /**
-     * This method takes a List&lt;String&gt; and a delimiter and joins the strings
-     * into a single string, where the original strings are separated using
-     * the given delimiter.
+     * This method takes a List&lt;String&gt; and a delimiter and joins the
+     * strings into a single string, where the original strings are separated
+     * using the given delimiter. This method is a null-safe version of
+     * {@link String#join(CharSequence, Iterable)}
      *
+     * <p>
+     * Note that if an individual element is null, then "null" is added.
+     * </p>
+     * @param list a {@code List} that will have its elements joined together
+     * @param delim a sequence of characters that is used to separate each of the
+     *          elements in the resulting String
+     * @return a new String that is composed from the elements argument or
+     *         {@code null} if list is {@code null}
+     * @throws NullPointerException if delim is {@code null}
      */
     public static String joinStrings(List<String> list, String delim) {
-        if (list == null) {
-            return null;
-        }
-
-        StringBuilder builder = new StringBuilder(list.get(0));
-        for (String s : list.subList(1, list.size())) {
-            builder.append(delim).append(s);
-        }
-
-        return builder.toString();
+        Objects.requireNonNull(delim);
+        return list == null ? null : String.join(delim, list);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
index 48c1bc908a9..22d804ec21b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
@@ -19,24 +19,51 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import java.util.Arrays;
+import java.util.Collections;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.StringUtils;
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 
 public class StringUtilTest extends ZKTestCase {
 
     @Test
-    public void testStrings() {
+    public void testStringSplit() {
+        final String s1 = "   a  ,   b  , ";
+        assertEquals(Arrays.asList("a", "b"), StringUtils.split(s1, ","));
 
-        String s1 = "   a  ,   b  , ";
-        assertEquals("[a, b]", StringUtils.split(s1, ",").toString());
+        assertEquals(Collections.emptyList(), StringUtils.split("", ","));
 
-        String s2 = "";
-        assertEquals(0, StringUtils.split(s2, ",").size());
+        final String s3 = "1, , 2";
+        assertEquals(Arrays.asList("1", "2"), StringUtils.split(s3, ","));
+    }
+
+    @Test
+    public void testStringJoinNullDelim() {
+        Assertions.assertThrows(NullPointerException.class, () -> {
+            StringUtils.joinStrings(Collections.emptyList(), null);
+        });
+    }
+
+    @Test
+    public void testStringJoinNullListNullDelim() {
+        Assertions.assertThrows(NullPointerException.class, () -> {
+            StringUtils.joinStrings(null, null);
+        });
+    }
 
-        String s3 = "1, , 2";
-        assertEquals("[1, 2]", StringUtils.split(s3, ",").toString());
+    @Test
+    public void testStringJoinNullList() {
+        assertNull(StringUtils.joinStrings(null, ","));
+    }
 
+    @Test
+    public void testStringJoin() {
+        final String expected = "a,B,null,d";
+        assertEquals(expected,
+            StringUtils.joinStrings(Arrays.asList("a", "B", null, "d"), ","));
     }
 
 }

From 300d7e9575496d10c92e7f0edca2bbc3746cb08d Mon Sep 17 00:00:00 2001
From: Matteo Minardi <matteo.minardi@diennea.com>
Date: Tue, 17 Nov 2020 17:37:31 +0000
Subject: [PATCH 131/591] ZOOKEEPER-4000: use the computeIfAbsent to simplify
 the Leader#processSync method

```
public synchronized void processSync(LearnerSyncRequest r) {
    if (outstandingProposals.isEmpty()) {
        sendSync(r);
    } else {
        List<LearnerSyncRequest> l = pendingSyncs.get(lastProposed);
        if (l == null) {
            l = new ArrayList<LearnerSyncRequest>();
        }
        l.add(r);
        pendingSyncs.put(lastProposed, l);
    }
}
```
we can use the computeIfAbsent to make the code more clean and elegant

Author: Matteo Minardi <matteo.minardi@diennea.com>

Reviewers: maoling <maoling199210191@sina.com>, Christopher Tubbs <ctubbsii@apache.org>, Andor Molnar <anmolnar@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1538 from mino181295/fix/ZOOKEEPER-4000/process-sync-code
---
 .../java/org/apache/zookeeper/server/quorum/Leader.java    | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 692ce1ed0cb..2de2ceeb8b0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -1266,12 +1266,7 @@ public synchronized void processSync(LearnerSyncRequest r) {
         if (outstandingProposals.isEmpty()) {
             sendSync(r);
         } else {
-            List<LearnerSyncRequest> l = pendingSyncs.get(lastProposed);
-            if (l == null) {
-                l = new ArrayList<LearnerSyncRequest>();
-            }
-            l.add(r);
-            pendingSyncs.put(lastProposed, l);
+            pendingSyncs.computeIfAbsent(lastProposed, k -> new ArrayList<>()).add(r);
         }
     }
 

From 12b4e6821997534e1ff58e2e29b9df0beab817d3 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 18 Nov 2020 18:18:12 +0000
Subject: [PATCH 132/591] ZOOKEEPER-3874: Official API to start ZooKeeper
 server from Java

Create an Official API to start a ZooKeeper server node from Java code.
The idea is not to run ZooKeeper server inside the same process of an application, but only to have a standard Launcher that can be used from Java and not a bash script.

See more context here
https://issues.apache.org/jira/browse/ZOOKEEPER-3874

This is how a Java launcher will look like for tests:
```
        int clientPort = PortAssignment.unique();
        final Properties configZookeeper = new Properties();
        configZookeeper.put("clientPort", clientPort + "");
        configZookeeper.put("host", "localhost");
        configZookeeper.put("..........................");
        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
                .builder()
                .baseDir(baseDir)
                .configuration(configZookeeper)
                .exitHandler(ExitHandler.LOG_ONLY)
                .build()) {
            zkServer.start();
            //// wait.....
      }
```

This feature does not overlap with Curator TestingServer, this feature is meant to be used a fundation for projects like TestingServer but also to run ZooKeeper server nodes in production.

This code is running in production at https://www.mag-news.com and https://emailsuccess.com, in such products we are using a Java based process manager

Author: Enrico Olivelli <eolivelli@apache.org>
Author: Enrico Olivelli <eolivelli@gmail.com>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1526 from eolivelli/fix/ZOOKEEPER-3874-embedded-api
---
 .gitignore                                    |   1 -
 pom.xml                                       |   6 +
 zookeeper-server/pom.xml                      |   1 -
 .../apache/zookeeper/common/StringUtils.java  |   9 +
 .../server/NettyServerCnxnFactory.java        |   1 +
 .../zookeeper/server/ZooKeeperServer.java     |   5 +
 .../zookeeper/server/ZooKeeperServerMain.java |  22 ++
 .../ZooKeeperServerShutdownHandler.java       |   6 +-
 .../server/embedded/ExitHandler.java          |  35 ++
 .../embedded/ZooKeeperServerEmbedded.java     | 118 +++++++
 .../embedded/ZooKeeperServerEmbeddedImpl.java | 162 ++++++++++
 .../server/persistence/FileTxnSnapLog.java    |  14 +-
 .../server/quorum/QuorumPeerMain.java         |  19 ++
 .../apache/zookeeper/util/ServiceUtils.java   |   2 +-
 .../server/embedded/ZookeeperServeInfo.java   | 300 ++++++++++++++++++
 .../ZookeeperServerClusterMutualAuthTest.java | 141 ++++++++
 .../embedded/ZookeeperServerClusterTest.java  | 123 +++++++
 .../embedded/ZookeeperServerEmbeddedTest.java |  76 +++++
 .../ZookeeperServerSslEmbeddedTest.java       | 121 +++++++
 .../test/resources/embedded/testKeyStore.jks  | Bin 0 -> 2250 bytes
 .../resources/embedded/testTrustStore.jks     | Bin 0 -> 960 bytes
 .../embedded/test_jaas_server_auth.conf       |  18 ++
 22 files changed, 1168 insertions(+), 12 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
 create mode 100644 zookeeper-server/src/test/resources/embedded/testKeyStore.jks
 create mode 100644 zookeeper-server/src/test/resources/embedded/testTrustStore.jks
 create mode 100644 zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf

diff --git a/.gitignore b/.gitignore
index 55937cec57e..e9119332f36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,7 +71,6 @@ zookeeper-server/src/main/resources/lib/ant-eclipse-*
 zookeeper-server/src/main/resources/lib/ivy-*
 zookeeper-server/src/main/java/org/apache/zookeeper/version/Info.java
 zookeeper-server/src/main/java/org/apache/zookeeper/version/VersionInfoMain.java
-zookeeper-server/src/test/resources/
 zookeeper-client/zookeeper-client-c/Makefile.in
 zookeeper-client/zookeeper-client-c/aclocal.m4
 zookeeper-client/zookeeper-client-c/autom4te.cache/
diff --git a/pom.xml b/pom.xml
index a030550fa6b..162e7da7031 100755
--- a/pom.xml
+++ b/pom.xml
@@ -425,6 +425,7 @@
     <surefire.version>2.22.1</surefire.version>
 
     <surefire-forkcount>8</surefire-forkcount>
+    <redirectTestOutputToFile>true</redirectTestOutputToFile>
 
     <!-- dependency versions -->
     <slf4j.version>1.7.30</slf4j.version>
@@ -702,6 +703,10 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-surefire-plugin</artifactId>
+          <configuration>
+              <trimStackTrace>false</trimStackTrace>
+              <redirectTestOutputToFile>${redirectTestOutputToFile}</redirectTestOutputToFile>
+          </configuration>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -961,6 +966,7 @@
             <exclude>src/main/resources/markdown/skin/*</exclude>
             <exclude>src/main/resources/markdown/html/*</exclude>
             <exclude>src/main/resources/markdown/images/*</exclude>
+            <exclude>**/src/test/resources/embedded/*.conf</exclude>
             <!-- contrib -->
             <exclude>**/JMX-RESOURCES</exclude>
             <exclude>**/src/main/resources/mainClasses</exclude>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 8e1865c5d96..6e11b4d8164 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -265,7 +265,6 @@
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m -Dtest.junit.threads=${surefire-forkcount} -Dzookeeper.junit.threadid=${surefire.forkNumber} -javaagent:${org.jmockit:jmockit:jar}</argLine>
           <basedir>${project.basedir}</basedir>
-          <redirectTestOutputToFile>true</redirectTestOutputToFile>
           <systemPropertyVariables>
             <build.test.dir>${project.build.directory}/surefire</build.test.dir>
             <zookeeper.DigestAuthenticationProvider.superDigest>super:D/InIHSb7yEEbrWz8b9l71RjZJU=</zookeeper.DigestAuthenticationProvider.superDigest>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
index 391aff11d1a..8e89abe1b0b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
@@ -65,4 +65,13 @@ public static String joinStrings(List<String> list, String delim) {
         return list == null ? null : String.join(delim, list);
     }
 
+    /**
+     * Returns true if the string is null or it does not contain any non space characters.
+     * @param s the string
+     * @return true if the string is null or it does not contain any non space characters.
+     */
+    public static boolean isBlank(String s) {
+        return s == null || s.trim().isEmpty();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 9995f48e43c..0891021f35d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -603,6 +603,7 @@ public void configure(InetSocketAddress addr, int maxClientCnxns, int backlog, b
         this.maxClientCnxns = maxClientCnxns;
         this.secure = secure;
         this.listenBacklog = backlog;
+        LOG.info("configure {} secure: {} on addr {}", this, secure, addr);
     }
 
     /** {@inheritDoc} */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index f13f04b14d7..77b055ec139 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -2172,4 +2172,9 @@ public int getOutstandingHandshakeNum() {
     public boolean isReconfigEnabled() {
         return this.reconfigEnabled;
     }
+
+    public ZooKeeperServerShutdownHandler getZkShutdownHandler() {
+        return zkShutdownHandler;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index 3daf96d6001..c438f1878b4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -242,4 +242,26 @@ ServerCnxnFactory getSecureCnxnFactory() {
         return secureCnxnFactory;
     }
 
+    /**
+     * Shutdowns properly the service, this method is not a public API.
+     */
+    public void close() {
+        ServerCnxnFactory primaryCnxnFactory = this.cnxnFactory;
+        if (primaryCnxnFactory == null) {
+            // in case of pure TLS we can hook into secureCnxnFactory
+            primaryCnxnFactory = secureCnxnFactory;
+        }
+        if (primaryCnxnFactory == null || primaryCnxnFactory.getZooKeeperServer() == null) {
+            return;
+        }
+        ZooKeeperServerShutdownHandler zkShutdownHandler = primaryCnxnFactory.getZooKeeperServer().getZkShutdownHandler();
+        zkShutdownHandler.handle(ZooKeeperServer.State.SHUTDOWN);
+        try {
+            // ServerCnxnFactory will call the shutdown
+            primaryCnxnFactory.join();
+        } catch (InterruptedException ex) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java
index 28cbcc98cf6..42e4642f7c3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java
@@ -26,9 +26,9 @@
  * SHUTDOWN server state transitions, which in turn releases the associated
  * shutdown latch.
  */
-class ZooKeeperServerShutdownHandler {
+public final class ZooKeeperServerShutdownHandler {
 
-    private final CountDownLatch shutdownLatch;
+        private final CountDownLatch shutdownLatch;
 
     ZooKeeperServerShutdownHandler(CountDownLatch shutdownLatch) {
         this.shutdownLatch = shutdownLatch;
@@ -39,7 +39,7 @@ class ZooKeeperServerShutdownHandler {
      *
      * @param state new server state
      */
-    void handle(State state) {
+    public void handle(State state) {
         if (state == State.ERROR || state == State.SHUTDOWN) {
             shutdownLatch.countDown();
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
new file mode 100644
index 00000000000..e7f7ee37a2d
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
@@ -0,0 +1,35 @@
+package org.apache.zookeeper.server.embedded;
+
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Behaviour of the server in case of internal error.
+ * When you are running tests you will use {@link #LOG_ONLY},
+ * but please take care of using {@link #EXIT} when runnning in production.
+ */
+public enum ExitHandler {
+    /**
+     * Exit the Java process.
+     */
+    EXIT,
+    /**
+     * Only log the error. This option is meant to be used only in tests.
+     */
+    LOG_ONLY;
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
new file mode 100644
index 00000000000..b9d0a309341
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
@@ -0,0 +1,118 @@
+package org.apache.zookeeper.server.embedded;
+
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import java.nio.file.Path;
+import java.util.Objects;
+import java.util.Properties;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.yetus.audience.InterfaceStability;
+
+/**
+ * This API allows you to start a ZooKeeper server node from Java code <p>
+ * The server will run inside the same process.<p>
+ * Typical usecases are:
+ * <ul>
+ * <li>Running automated tests</li>
+ * <li>Launch ZooKeeper server with a Java based service management system</li>
+ * </ul>
+ * <p>
+ * Please take into consideration that in production usually it is better to not run the client
+ * together with the server in order to avoid race conditions, especially around how ephemeral nodes work.
+ */
+@InterfaceAudience.Public
+@InterfaceStability.Evolving
+public interface ZooKeeperServerEmbedded extends AutoCloseable {
+    /**
+     * Builder for ZooKeeperServerEmbedded.
+     */
+    class ZookKeeperServerEmbeddedBuilder {
+
+        private Path baseDir;
+        private Properties configuration;
+        private ExitHandler exitHandler = ExitHandler.EXIT;
+
+        /**
+         * Base directory of the server.
+         * The system will create a temporary configuration file inside this directory.
+         * Please remember that dynamic configuration files wil be saved into this directory by default.
+         * <p>
+         * If you do not set a 'dataDir' configuration entry the system will use a subdirectory of baseDir.
+         * @param baseDir
+         * @return the builder
+         */
+        public ZookKeeperServerEmbeddedBuilder baseDir(Path baseDir) {
+            this.baseDir = Objects.requireNonNull(baseDir);
+            return this;
+        }
+
+        /**
+         * Set the contents of the main configuration as it would be in zk_server.conf file.
+         * @param configuration the configuration
+         * @return the builder
+         */
+        public ZookKeeperServerEmbeddedBuilder configuration(Properties configuration) {
+            this.configuration = Objects.requireNonNull(configuration);
+            return this;
+        }
+
+        /**
+         * Set the behaviour in case of hard system errors, see {@link ExitHandler}.
+         * @param exitHandler the handler
+         * @return the builder
+         */
+        public ZookKeeperServerEmbeddedBuilder exitHandler(ExitHandler exitHandler) {
+            this.exitHandler = Objects.requireNonNull(exitHandler);
+            return this;
+        }
+
+        /**
+         * Validate the configuration and create the server, without starting it.
+         * @return the new server
+         * @throws Exception
+         * @see #start()
+         */
+        public ZooKeeperServerEmbedded build() throws Exception {
+            if (baseDir == null) {
+                throw new IllegalStateException("baseDir is null");
+            }
+            if (configuration == null) {
+                throw new IllegalStateException("configuration is null");
+            }
+            return new ZooKeeperServerEmbeddedImpl(configuration, baseDir, exitHandler);
+        }
+    }
+
+    static ZookKeeperServerEmbeddedBuilder builder() {
+        return new ZookKeeperServerEmbeddedBuilder();
+    }
+
+    /**
+     * Start the server.
+     * @throws Exception
+     */
+    void start() throws Exception;
+
+    /**
+     * Shutdown gracefully the server and wait for resources to be released.
+     */
+    @Override
+    void close();
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
new file mode 100644
index 00000000000..cfd3abf0606
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -0,0 +1,162 @@
+package org.apache.zookeeper.server.embedded;
+
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.Properties;
+import org.apache.zookeeper.server.DatadirCleanupManager;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.ZooKeeperServerMain;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.server.quorum.QuorumPeerMain;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright
+ * ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the
+ * License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the License for the specific language governing permissions and limitations under the License.
+ */
+/**
+ * Implementation of ZooKeeperServerEmbedded.
+ */
+class ZooKeeperServerEmbeddedImpl implements ZooKeeperServerEmbedded {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperServerEmbeddedImpl.class);
+
+    private final QuorumPeerConfig config;
+    private QuorumPeerMain maincluster;
+    private ZooKeeperServerMain mainsingle;
+    private Thread thread;
+    private DatadirCleanupManager purgeMgr;
+    private final ExitHandler exitHandler;
+    private volatile boolean stopping;
+
+    ZooKeeperServerEmbeddedImpl(Properties p, Path baseDir, ExitHandler exitHandler) throws Exception {
+        if (!p.containsKey("dataDir")) {
+            p.put("dataDir", baseDir.resolve("data").toAbsolutePath().toString());
+        }
+        Path configFile = Files.createTempFile(baseDir, "zookeeper.configuration", ".properties");
+        try (OutputStream oo = Files.newOutputStream(configFile)) {
+            p.store(oo, "Automatically generated at every-boot");
+        }
+        this.exitHandler = exitHandler;
+        LOG.info("Current configuration is at {}", configFile.toAbsolutePath());
+        config = new QuorumPeerConfig();
+        config.parse(configFile.toAbsolutePath().toString());
+        LOG.info("ServerID:" + config.getServerId());
+        LOG.info("DataDir:" + config.getDataDir());
+        LOG.info("Servers:" + config.getServers());
+        LOG.info("ElectionPort:" + config.getElectionPort());
+        LOG.info("SyncLimit:" + config.getSyncLimit());
+        LOG.info("PeerType:" + config.getPeerType());
+        LOG.info("Distributed:" + config.isDistributed());
+        LOG.info("SyncEnabled:" + config.getSyncEnabled());
+        LOG.info("MetricsProviderClassName:" + config.getMetricsProviderClassName());
+
+        for (Map.Entry<Long, QuorumPeer.QuorumServer> server : config.getServers().entrySet()) {
+            LOG.info("Server: " + server.getKey() + " -> addr " + server.getValue().addr + " elect "
+                    + server.getValue().electionAddr + " id=" + server.getValue().id + " type "
+                    + server.getValue().type);
+        }
+    }
+
+    @Override
+    public void start() throws Exception {
+        switch (exitHandler) {
+            case EXIT:
+                ServiceUtils.setSystemExitProcedure(ServiceUtils.SYSTEM_EXIT);
+                break;
+            case LOG_ONLY:
+                ServiceUtils.setSystemExitProcedure(ServiceUtils.LOG_ONLY);
+                break;
+            default:
+                ServiceUtils.setSystemExitProcedure(ServiceUtils.SYSTEM_EXIT);
+                break;
+        }
+
+
+        if (config.getServers().size() > 1 || config.isDistributed()) {
+            LOG.info("Running ZK Server in single Quorum MODE");
+
+            maincluster = new QuorumPeerMain();
+
+            // Start and schedule the the purge task
+            purgeMgr = new DatadirCleanupManager(config
+                    .getDataDir(), config.getDataLogDir(), config
+                    .getSnapRetainCount(), config.getPurgeInterval());
+            purgeMgr.start();
+
+            thread = new Thread("zkservermainrunner") {
+                @Override
+                public void run() {
+                    try {
+                        maincluster.runFromConfig(config);
+                        maincluster.close();
+                        LOG.info("ZK server died. Requsting stop on JVM");
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.EXECUTION_FINISHED.getValue());
+                        }
+                    } catch (Throwable t) {
+                        LOG.error("error during server lifecycle", t);
+                        maincluster.close();
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
+                        }
+                    }
+                }
+            };
+            thread.start();
+        } else {
+            LOG.info("Running ZK Server in single STANDALONE MODE");
+            mainsingle = new ZooKeeperServerMain();
+            purgeMgr = new DatadirCleanupManager(config
+                    .getDataDir(), config.getDataLogDir(), config
+                    .getSnapRetainCount(), config.getPurgeInterval());
+            purgeMgr.start();
+            thread = new Thread("zkservermainrunner") {
+                @Override
+                public void run() {
+                    try {
+                        ServerConfig cc = new ServerConfig();
+                        cc.readFrom(config);
+                        LOG.info("ZK server starting");
+                        mainsingle.runFromConfig(cc);
+                        LOG.info("ZK server died. Requesting stop on JVM");
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.EXECUTION_FINISHED.getValue());
+                        }
+                    } catch (Throwable t) {
+                        LOG.error("error during server lifecycle", t);
+                        mainsingle.close();
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
+                        }
+                    }
+                }
+            };
+            thread.start();
+        }
+    }
+
+    @Override
+    public void close() {
+        LOG.info("Stopping ZK Server");
+        stopping = true;
+        if (mainsingle != null) {
+            mainsingle.close();
+        }
+        if (maincluster != null) {
+            maincluster.close();
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index 30ed2c08005..f054bc85d16 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -611,14 +611,16 @@ public void rollLog() throws IOException {
      * @throws IOException
      */
     public void close() throws IOException {
-        if (txnLog != null) {
-            txnLog.close();
-            txnLog = null;
+        TxnLog txnLogToClose = txnLog;
+        if (txnLogToClose != null) {
+            txnLogToClose.close();
         }
-        if (snapLog != null) {
-            snapLog.close();
-            snapLog = null;
+        txnLog = null;
+        SnapShot snapSlogToClose = snapLog;
+        if (snapSlogToClose != null) {
+            snapSlogToClose.close();
         }
+        snapLog = null;
     }
 
     @SuppressWarnings("serial")
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 76df5e46d8b..6e8f7b9fadc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -248,4 +248,23 @@ protected QuorumPeer getQuorumPeer() throws SaslException {
         return new QuorumPeer();
     }
 
+    /**
+     * Shutdowns properly the service, this method is not a public API.
+     */
+    public void close() {
+        if (quorumPeer != null) {
+            try {
+                quorumPeer.shutdown();
+            } finally {
+                quorumPeer = null;
+            }
+        }
+    }
+
+    @Override
+    public String toString() {
+        QuorumPeer peer = quorumPeer;
+        return peer == null ? "" : peer.toString();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
index 68a25ebb487..544e13d7f47 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
@@ -51,7 +51,7 @@ private ServiceUtils() {
                 + "Actually System.exit is disabled", code);
     };
 
-    private static Consumer<Integer> systemExitProcedure = SYSTEM_EXIT;
+    private static volatile Consumer<Integer> systemExitProcedure = SYSTEM_EXIT;
 
     /**
      * Override system callback. Useful for preventing the JVM to exit in tests
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java
new file mode 100644
index 00000000000..f51b8c17b6d
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java
@@ -0,0 +1,300 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import java.lang.management.ManagementFactory;
+import java.lang.reflect.UndeclaredThrowableException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+import javax.management.InstanceNotFoundException;
+import javax.management.MBeanServer;
+import javax.management.MBeanServerInvocationHandler;
+import javax.management.ObjectInstance;
+import javax.management.ObjectName;
+import org.apache.zookeeper.common.StringUtils;
+import org.apache.zookeeper.server.ConnectionMXBean;
+import org.apache.zookeeper.server.ZooKeeperServerBean;
+import org.apache.zookeeper.server.quorum.LocalPeerMXBean;
+import org.apache.zookeeper.server.quorum.QuorumBean;
+import org.apache.zookeeper.server.quorum.QuorumMXBean;
+import org.apache.zookeeper.server.quorum.RemotePeerMXBean;
+
+public final class ZookeeperServeInfo {
+
+    private static final MBeanServer localServer = ManagementFactory.getPlatformMBeanServer();
+
+    private ZookeeperServeInfo() {
+    }
+
+    public static class PeerInfo {
+
+        private final String name;
+        private final String quorumAddress;
+        private final String state;
+        private final boolean leader;
+
+        public PeerInfo(String name, String quorumAddress, String state, boolean leader) {
+            this.name = name;
+            this.quorumAddress = quorumAddress;
+            this.state = state;
+            this.leader = leader;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        public String getQuorumAddress() {
+            return quorumAddress;
+        }
+
+        public String getState() {
+            return state;
+        }
+
+        public boolean isLeader() {
+            return leader;
+        }
+
+        @Override
+        public String toString() {
+            return "PeerInfo{" + "name=" + name + ", leader=" + leader + ", quorumAddress=" + quorumAddress
+                    + ", state=" + state + '}';
+        }
+    }
+
+    public static class ConnectionInfo {
+
+        private final String sourceip;
+        private final String sessionid;
+        private final String lastoperation;
+        private final String lastResponseTime;
+        private final String avgLatency;
+        private final String lastLatency;
+        private final String nodes;
+
+        public ConnectionInfo(String sourceip, String sessionid, String lastoperation, String lastResponseTime,
+                              String avgLatency, String lastLatency, String nodes) {
+            this.sourceip = sourceip;
+            this.sessionid = sessionid;
+            this.lastoperation = lastoperation;
+            this.lastResponseTime = lastResponseTime;
+            this.avgLatency = avgLatency;
+            this.lastLatency = lastLatency;
+            this.nodes = nodes;
+        }
+
+        public String getLastLatency() {
+            return lastLatency;
+        }
+
+        public String getSourceip() {
+            return sourceip;
+        }
+
+        public String getSessionid() {
+            return sessionid;
+        }
+
+        public String getLastoperation() {
+            return lastoperation;
+        }
+
+        public String getLastResponseTime() {
+            return lastResponseTime;
+        }
+
+        public String getAvgLatency() {
+            return avgLatency;
+        }
+
+        public String getNodes() {
+            return nodes;
+        }
+
+        @Override
+        public String toString() {
+            return "ConnectionInfo{" + "sourceip=" + sourceip + ", sessionid=" + sessionid + ", lastoperation="
+                    + lastoperation + ", lastResponseTime=" + lastResponseTime + ", avgLatency=" + avgLatency
+                    + ", nodes=" + nodes + '}';
+        }
+    }
+
+    public static class ServerInfo {
+
+        private final List<ConnectionInfo> connections = new ArrayList<>();
+        private boolean leader;
+        private boolean standaloneMode;
+        public List<PeerInfo> peers = new ArrayList<>();
+
+        public boolean isStandaloneMode() {
+            return standaloneMode;
+        }
+
+        public List<ConnectionInfo> getConnections() {
+            return connections;
+        }
+
+        public boolean isLeader() {
+            return leader;
+        }
+
+        public List<PeerInfo> getPeers() {
+            return Collections.unmodifiableList(peers);
+        }
+
+        public void addPeer(PeerInfo peer) {
+            peers.add(peer);
+        }
+
+        @Override
+        public String toString() {
+            return "ServerInfo{" + "connections=" + connections + ", leader=" + leader + ", standaloneMode="
+                    + standaloneMode + ", peers=" + peers + '}';
+        }
+
+    }
+
+    public static ServerInfo getStatus() throws Exception {
+        return getStatus("*");
+    }
+
+    public static ServerInfo getStatus(String beanName) throws Exception {
+
+        ServerInfo info = new ServerInfo();
+        boolean standalonemode = false;
+        // org.apache.ZooKeeperService:name0=ReplicatedServer_id1,name1=replica.1,name2=Follower,name3=Connections,
+        // name4=10.168.10.119,name5=0x13e83353764005a
+        // org.apache.ZooKeeperService:name0=ReplicatedServer_id2,name1=replica.2,name2=Leader
+        if (StringUtils.isBlank(beanName)) {
+            beanName = "*";
+        }
+        ObjectName objectName = new ObjectName("org.apache.ZooKeeperService:name0=" + beanName);
+        Set<ObjectInstance> first_level_beans = localServer.queryMBeans(objectName, null);
+        if (first_level_beans.isEmpty()) {
+            throw new IllegalStateException("No ZooKeeper server found in this JVM with name " + objectName);
+        }
+        String myName = "";
+        for (ObjectInstance o : first_level_beans) {
+            if (o.getClassName().equalsIgnoreCase(ZooKeeperServerBean.class.getName())) {
+                standalonemode = true;
+                info.leader = true;
+                info.addPeer(new PeerInfo("local", "local", "STANDALONE", true));
+            } else if (o.getClassName().equalsIgnoreCase(QuorumBean.class.getName())) {
+                standalonemode = false;
+                try {
+                    QuorumMXBean quorum = MBeanServerInvocationHandler.newProxyInstance(localServer, o.getObjectName(),
+                            QuorumMXBean.class, false);
+                    myName = quorum.getName();
+                } catch (UndeclaredThrowableException err) {
+                    if (err.getCause() instanceof javax.management.InstanceNotFoundException) {
+                        // maybe server not yet started or already stopped ?
+                    } else {
+                        throw err;
+                    }
+                }
+            }
+        }
+        info.standaloneMode = standalonemode;
+        if (standalonemode) {
+            Set<ObjectInstance> connectionsbeans = localServer.queryMBeans(new ObjectName(
+                    "org.apache.ZooKeeperService:name0=*,name1=Connections,name2=*,name3=*"), null);
+            for (ObjectInstance conbean : connectionsbeans) {
+                ConnectionMXBean cc = MBeanServerInvocationHandler.
+                        newProxyInstance(localServer, conbean.getObjectName(), ConnectionMXBean.class, false);
+                try {
+                    String nodes = "";
+                    if (cc.getEphemeralNodes() != null) {
+                        nodes = Arrays.asList(cc.getEphemeralNodes()) + "";
+                    }
+                    info.connections.add(new ConnectionInfo(cc.getSourceIP(), cc.getSessionId(), cc.getLastOperation(),
+                            cc.getLastResponseTime(), cc.getAvgLatency() + "", cc.getLastLatency() + "", nodes));
+                } catch (Exception ex) {
+                    if (ex instanceof InstanceNotFoundException && ex.getCause() instanceof InstanceNotFoundException) {
+                        // SKIP
+                    } else {
+                        throw ex;
+                    }
+                }
+            }
+        } else {
+            if (myName.isEmpty()) {
+                throw new IllegalStateException(
+                        "Cannot find local JMX name for current node, in quorum mode, scanned " + first_level_beans);
+            }
+            boolean leader = false;
+            Set<ObjectInstance> replicas = localServer.queryMBeans(new ObjectName(
+                    "org.apache.ZooKeeperService:name0=" + myName + ",name1=*"), null);
+            for (ObjectInstance o : replicas) {
+                if (o.getClassName().toLowerCase().contains("local")) {
+                    LocalPeerMXBean local = MBeanServerInvocationHandler.
+                            newProxyInstance(localServer, o.getObjectName(), LocalPeerMXBean.class, false);
+                    info.addPeer(new PeerInfo(local.getName(), local.getQuorumAddress(), local.getState() + "",
+                            local.isLeader()));
+
+                    ObjectName asfollowername = new ObjectName(o.getObjectName() + ",name2=Follower");
+                    ObjectName asleadername = new ObjectName(o.getObjectName() + ",name2=Leader");
+                    boolean isleader = localServer.isRegistered(asleadername);
+                    Set<ObjectInstance> connectionsbeans = null;
+                    if (isleader) {
+                        leader = true;
+                        ObjectName asleaderconnections = new ObjectName(
+                                asleadername + ",name3=Connections,name4=*,name5=*");
+                        connectionsbeans = localServer.queryMBeans(asleaderconnections, null);
+                    } else {
+                        leader = false;
+                        ObjectName asfollowernameconnections = new ObjectName(
+                                asfollowername + ",name3=Connections,name4=*,name5=*");
+                        connectionsbeans = localServer.queryMBeans(asfollowernameconnections, null);
+                    }
+
+                    for (ObjectInstance conbean : connectionsbeans) {
+                        ConnectionMXBean cc = MBeanServerInvocationHandler.newProxyInstance(localServer,
+                                conbean.getObjectName(), ConnectionMXBean.class, false);
+                        try {
+                            String nodes = "";
+                            if (cc.getEphemeralNodes() != null) {
+                                nodes = Arrays.asList(cc.getEphemeralNodes()) + "";
+                            }
+                            info.connections.add(new ConnectionInfo(cc.getSourceIP(), cc.getSessionId(), cc.
+                                    getLastOperation(), cc.getLastResponseTime(), cc.getAvgLatency() + "", cc.
+                                    getLastLatency() + "", nodes));
+                        } catch (Exception ex) {
+                            if (ex instanceof InstanceNotFoundException && ex.getCause() instanceof InstanceNotFoundException) {
+                                // SKIP
+                            } else {
+                                throw ex;
+                            }
+                        }
+                    }
+                } else {
+                    RemotePeerMXBean remote = MBeanServerInvocationHandler.newProxyInstance(localServer, o.
+                            getObjectName(), RemotePeerMXBean.class, false);
+                    info.addPeer(new PeerInfo(remote.getName(), remote.getQuorumAddress(),
+                            "REMOTE", remote.isLeader()));
+                }
+
+            }
+            info.leader = leader;
+        }
+        return info;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
new file mode 100644
index 00000000000..923d88802bf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
@@ -0,0 +1,141 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Properties;
+import javax.security.auth.login.Configuration;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/**
+ * Test Quorum Mutual Auth with ZooKeeperEmbedded.
+ */
+public class ZookeeperServerClusterMutualAuthTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("java.security.auth.login.config", new File("src/test/resources/embedded/test_jaas_server_auth.conf")
+                .getAbsolutePath());
+        Configuration.getConfiguration().refresh();
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("java.security.auth.login.config");
+        Configuration.getConfiguration().refresh();
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+        Path baseDir1 = baseDir.resolve("server1");
+        Path baseDir2 = baseDir.resolve("server2");
+        Path baseDir3 = baseDir.resolve("server3");
+
+        int clientport1 = PortAssignment.unique();
+        int clientport2 = PortAssignment.unique();
+        int clientport3 = PortAssignment.unique();
+
+        int port4 = PortAssignment.unique();
+        int port5 = PortAssignment.unique();
+        int port6 = PortAssignment.unique();
+
+        int port7 = PortAssignment.unique();
+        int port8 = PortAssignment.unique();
+        int port9 = PortAssignment.unique();
+
+        Properties config = new Properties();
+        config.put("host", "localhost");
+        config.put("ticktime", "10");
+        config.put("initLimit", "4000");
+        config.put("syncLimit", "5");
+
+        config.put("server.1", "localhost:" + port4 + ":" + port7);
+        config.put("server.2", "localhost:" + port5 + ":" + port8);
+        config.put("server.3", "localhost:" + port6 + ":" + port9);
+
+        config.put("quorum.auth.enableSasl", "true");
+        config.put("quorum.auth.learnerRequireSasl", "true");
+        config.put("quorum.auth.serverRequireSasl", "true");
+        config.put("quorum.auth.learner.loginContext", "QuorumLearner");
+        config.put("quorum.auth.server.loginContext", "QuorumServer");
+        config.put("quorum.auth.kerberos.servicePrincipal", "servicename/_HOST");
+        config.put("quorum.cnxn.threads.size", "20");
+
+        final Properties configZookeeper1 = new Properties();
+        configZookeeper1.putAll(config);
+        configZookeeper1.put("clientPort", clientport1 + "");
+
+        final Properties configZookeeper2 = new Properties();
+        configZookeeper2.putAll(config);
+        configZookeeper2.put("clientPort", clientport2 + "");
+
+        final Properties configZookeeper3 = new Properties();
+        configZookeeper3.putAll(config);
+        configZookeeper3.put("clientPort", clientport3 + "");
+
+        Files.createDirectories(baseDir1.resolve("data"));
+        Files.write(baseDir1.resolve("data").resolve("myid"), "1".getBytes("ASCII"));
+        Files.createDirectories(baseDir2.resolve("data"));
+        Files.write(baseDir2.resolve("data").resolve("myid"), "2".getBytes("ASCII"));
+        Files.createDirectories(baseDir3.resolve("data"));
+        Files.write(baseDir3.resolve("data").resolve("myid"), "3".getBytes("ASCII"));
+
+        try (ZooKeeperServerEmbedded zkServer1 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper1).baseDir(baseDir1).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer2 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper2).baseDir(baseDir2).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer3 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper3).baseDir(baseDir3).exitHandler(ExitHandler.LOG_ONLY).build();) {
+            zkServer1.start();
+            zkServer2.start();
+            zkServer3.start();
+
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport1, 60000));
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport2, 60000));
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport3, 60000));
+
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+                System.out.println("status:" + status);
+                if (status.isLeader() && !status.isStandaloneMode() && status.getPeers().size() == 3) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+            assertTrue(status.isLeader());
+            assertTrue(!status.isStandaloneMode());
+            assertEquals(3, status.getPeers().size());
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
new file mode 100644
index 00000000000..090c9fce049
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
@@ -0,0 +1,123 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Properties;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerClusterTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+        Path baseDir1 = baseDir.resolve("server1");
+        Path baseDir2 = baseDir.resolve("server2");
+        Path baseDir3 = baseDir.resolve("server3");
+
+        int clientport1 = PortAssignment.unique();
+        int clientport2 = PortAssignment.unique();
+        int clientport3 = PortAssignment.unique();
+
+        int port4 = PortAssignment.unique();
+        int port5 = PortAssignment.unique();
+        int port6 = PortAssignment.unique();
+
+        int port7 = PortAssignment.unique();
+        int port8 = PortAssignment.unique();
+        int port9 = PortAssignment.unique();
+
+        Properties config = new Properties();
+        config.put("host", "localhost");
+        config.put("ticktime", "10");
+        config.put("initLimit", "4000");
+        config.put("syncLimit", "5");
+        config.put("server.1", "localhost:" + port4 + ":" + port7);
+        config.put("server.2", "localhost:" + port5 + ":" + port8);
+        config.put("server.3", "localhost:" + port6 + ":" + port9);
+
+
+        final Properties configZookeeper1 = new Properties();
+        configZookeeper1.putAll(config);
+        configZookeeper1.put("clientPort", clientport1 + "");
+
+        final Properties configZookeeper2 = new Properties();
+        configZookeeper2.putAll(config);
+        configZookeeper2.put("clientPort", clientport2 + "");
+
+        final Properties configZookeeper3 =  new Properties();
+        configZookeeper3.putAll(config);
+        configZookeeper3.put("clientPort", clientport3 + "");
+
+        Files.createDirectories(baseDir1.resolve("data"));
+        Files.write(baseDir1.resolve("data").resolve("myid"), "1".getBytes("ASCII"));
+        Files.createDirectories(baseDir2.resolve("data"));
+        Files.write(baseDir2.resolve("data").resolve("myid"), "2".getBytes("ASCII"));
+        Files.createDirectories(baseDir3.resolve("data"));
+        Files.write(baseDir3.resolve("data").resolve("myid"), "3".getBytes("ASCII"));
+
+        try (ZooKeeperServerEmbedded zkServer1 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper1).baseDir(baseDir1).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer2 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper2).baseDir(baseDir2).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer3 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper3).baseDir(baseDir3).exitHandler(ExitHandler.LOG_ONLY).build();) {
+            zkServer1.start();
+            zkServer2.start();
+            zkServer3.start();
+
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport1, 60000));
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport2, 60000));
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport3, 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+                System.out.println("status:" + status);
+                if (status.isLeader() && !status.isStandaloneMode() && status.getPeers().size() == 3) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+            assertTrue(status.isLeader());
+            assertTrue(!status.isStandaloneMode());
+            assertEquals(3, status.getPeers().size());
+
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
new file mode 100644
index 00000000000..277a6a4c8f1
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
@@ -0,0 +1,76 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertTrue;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Properties;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerEmbeddedTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+        int clientPort = PortAssignment.unique();
+        final Properties configZookeeper = new Properties();
+        configZookeeper.put("clientPort", clientPort + "");
+        configZookeeper.put("host", "localhost");
+        configZookeeper.put("ticktime", "4000");
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(baseDir)
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientPort, 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
new file mode 100644
index 00000000000..e7a46269f51
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
@@ -0,0 +1,121 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Properties;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerSslEmbeddedTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("zookeeper.ssl.trustStore.location");
+        System.clearProperty("zookeeper.ssl.trustStore.password");
+        System.clearProperty("zookeeper.ssl.trustStore.type");
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+
+        int clientPort = PortAssignment.unique();
+        int clientSecurePort = PortAssignment.unique();
+
+        final Properties configZookeeper = new Properties();
+        configZookeeper.put("clientPort", clientPort + "");
+        configZookeeper.put("secureClientPort", clientSecurePort + "");
+        configZookeeper.put("host", "localhost");
+        configZookeeper.put("ticktime", "4000");
+        // Netty is required for TLS
+        configZookeeper.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+
+        File testKeyStore = new File("src/test/resources/embedded/testKeyStore.jks");
+        File testTrustStore = new File("src/test/resources/embedded/testTrustStore.jks");
+        assertTrue(testKeyStore.isFile());
+        assertTrue(testTrustStore.isFile());
+        configZookeeper.put("ssl.keyStore.location", testKeyStore.getAbsolutePath());
+        configZookeeper.put("ssl.keyStore.password", "testpass");
+        configZookeeper.put("ssl.keyStore.type", "JKS");
+
+        System.setProperty("zookeeper.ssl.trustStore.location", testTrustStore.getAbsolutePath());
+        System.setProperty("zookeeper.ssl.trustStore.password", "testpass");
+        System.setProperty("zookeeper.ssl.trustStore.type", "JKS");
+
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(baseDir)
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp("localhost:" + clientPort, 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+
+            CountDownLatch l = new CountDownLatch(1);
+            ZKClientConfig zKClientConfig = new ZKClientConfig();
+            zKClientConfig.setProperty("zookeeper.client.secure", "true");
+            // only netty supports TLS
+            zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+            try (ZooKeeper zk = new ZooKeeper("localhost:" + clientSecurePort, 60000, (WatchedEvent event) -> {
+                switch (event.getState()) {
+                    case SyncConnected:
+                        l.countDown();
+                        break;
+                }
+            }, zKClientConfig)) {
+                assertTrue(zk.getClientConfig().getBoolean(ZKClientConfig.SECURE_CLIENT));
+                assertTrue(l.await(10, TimeUnit.SECONDS));
+            }
+
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/resources/embedded/testKeyStore.jks b/zookeeper-server/src/test/resources/embedded/testKeyStore.jks
new file mode 100644
index 0000000000000000000000000000000000000000..40a7d0b7eae24b40c42e0f0e5410ef5caed30e4e
GIT binary patch
literal 2250
zcmchYcTm%58pqRtPy*6LN+?PVzfeUf1`w&zq=SGG0|%QR1acJR2%%VLt02-@P-)=+
ziHe~kO?qDu#6=(yiXcsnw%pF`+|Jzp_s28yyq}rpnP<LFd5>0)RzV;T<ix;#7>tY$
zC7(R3^tB$=fk1EwK!qIvd<dip0t^EyLj=HJI0#0CvB6l`29lo<I`6FAV61*iaNj+x
zs6OlmRcGbtd<1ATC4}S`uR3x|^9&@|rahn`Dtpq3&}1&UCggLtFo{n^H!S@6w-4J^
zg5R^S{I_)+H}G@%@hk6}IpnU~!N(0qK-!!Lt;4d7Nk{2C&zR-5>uCX*<@{y3*qGpy
z<c5Q<WBgpvk6VjP;RA{eNzsQlJw;OGf!BrggLC<--&#&xYc!asbu<o8FzgC^BKd-5
z<(3-0_RGb5<A}T)AvcDl2|)qkXl0G=n|q2!M&mfseOjKEcpA~iN8Y8#%!O-WY5x8N
zf>+uDRgnXo3<I)5O4z|2!#1MmL@}L?xvXl@he-;4I}DBWqWN2*vd+%-diy_DUkK^J
zyJjF>7NS(pr>m6s_Eg(Yj~&O}VTK4!bre_A;*pH(*AdNOpVYk3J!AF0vS^djK%a&^
z%{uNVzh~-polN7rjT0If5mM4y!{ez#xVQ#a*PlRRguuHl>*hPEE;~}pxvW{z<M3jh
zYqAPfE~$dY;C*66e8K$awrE)WS^njt>TI+OdGowlft>sY)L3AagmpddJW*WvdMm{d
zAqA>dba^K>_gk(UL!=faEHc1`U#vI}>AqDJNi=^DrJ%=A-_@D&wA!he??v+0>E!s#
z-pTMPO27YS7P5hz(Bw0;ZB%Mm^7nEQd{lBH1W`RR%tf@zTXDFRs05x*dO}m8yhHs<
zJ@*|`dWppZ!kwFJS&v84JB?2(jYGYDA|+69*OJ#bn8-DQdr}3cvEr@%=hhrwdItyB
zYIof4F|wPln|me_Hlvtc@*WXI$V$3Yg6K0egX~z7y)(-R^PX|A)c4saS!Lxs#yv>d
zSx5xjom7T$mMsxMg%7n<0~RknDs_e`((S~8K5LnTW^lI`fI2)>Y^Gn?E3aNKok%b;
z$#d^y+vdF*PAq@awa5yWDSG-`ZTv#O=EBQ-9tzv$TaqxZo7q%g)1F!MU~`P^w+C$R
z5d7Wm|CArbIACh!TEEu_d|fZKWc?5=u0buS+l~&s?RzCExKp8#(Py?C@l<T6;d^6!
zai3Uh!Ze07rMqpx$||pDr)$r40+ppUT)S)}Qno_*W6+r$i3{CA4{hRq3|e&`<;F#q
za9X+<`tHa1b#3Gj$Su+;l&pw|sov*GUDc`^SbRqJYYQfx@+J(KK~(6eVkAN)V96i$
z!>*VB%RE<Sda^1cGhn>c_r2a*`tz6FdUBfMRIkV9%TC+Mpd$Ry3tzTbzqq-2zD%=D
zW<Fw7Xr)GNwEleywQjBQQyuL!cU`NNd>!<wm|o7YpY@_%+Lv`oDJ^Ntmumdh&w_1!
zpM;-mVL-BioD(+oY}};nsss+_(j$nP#M?Y}6$RM}LYS0U@{z8_9L+G+)=`GYAZxTC
z?bu0|Ai6LW+`R>}lz|4zGI*vlZTCS*W>b|H%SigL^s@srrohr}z>72<TGg=~2?^14
zWD0~?gtZ(CXl`q3&P3nfJe8;ryS{n6yMUNkJ%78rc}set<Wp7KC3dO$eAFf-Y=`lt
zae?k$=Ctf--(d|;y-vZB(>89nj-;N8P3IBm+>|mgFZu9ml5G7`xoVZ%%A!6@Z>XfM
zr$M_+dfVblCB0+0@tN9LJ-=reI0movzD@N(pOJh@-6JF?$*$m!y9js1Xajm65Ht>;
zLSq0bgir{DfFTfAs1^eO@FKXB6U-BKdBI?AI0ztN`A<$J)Cq<V<ZvPe5=j)|pM>*&
z2*-a3>Lk%g6jBg@3--O~kH?+@`2P*K1-aZwBr7~V7$5Q{g9>s5k#711`IAD)fQ%?F
zRvW--0@(A~x|)Ey80y5;1~dTO|A7C0NmQ`xUu8M@HK0^53ItHWNC*`S2K|EOye@DF
zNazWQBGfP4)zzy%h%vtKkyzM~;4tyXfBtGM_GGU_?a5Q#$<7R7oM8jhOQKshCEEok
zTUkcv_6w62wni%3C#VObD1Bf`wWD-B4r*!r>{FyLVq6O8Gm@8^T?*Lqox$@tdlZWL
zAjZDypqO1(?xfA%1h1#J3bUSW#tgvMYLoHS!3H2z$K1Pt-q$Ye8=ESzOjry3{pP}#
zQTJ-pF^q!P*{Yv=_>8<{o-~_54Y!1Ksx_ML)5n@B2^*5zwWPJBQH8rP$KK9HXOwH0
zhpfbC9UUMz=QouJxq|VBhN|N^RNQ))W0#TaPss4qjDLXe_?kx$C>R7TMg!7-<VlMq
z`CuY2A^c?B=W~}ML9Xibac(~~O44rm_FqLjnXMBM!61q5K%F>AMO{znJ3F1U!shoa
zR|Y$@f+Gh5*;=$F&d97qgH_2n65^v=1&%&GEBW(Q9{ezRt;sU+&BoD|N5nLJ*VKT(
z8F?{%(mld7bFzsK*X{Quv0YK1Vp?ary0TGSM3PwKpy0kjqRZTNm$)^?``qGnn8`aD
zw^e1MNVuyCNBrD|sjw7bSYI&IU2OuvT{Oyd_gm6lJ6{R^6*k_he_fBQ?skT=VXx1l
zhp8?j9{YrWX8M%qaR%X(?Q7ak7eD;5N*G#OaR4jNOO4cNg-+kqk}tbTp&!1a@U}&^
z;CK22^2E#C1l#lI-oA@%V(SY<7C6SY{B$1eT#j?{I80l6Zu&;Il)TbXnKM_Z-|rT;
B+9Ln}

literal 0
HcmV?d00001

diff --git a/zookeeper-server/src/test/resources/embedded/testTrustStore.jks b/zookeeper-server/src/test/resources/embedded/testTrustStore.jks
new file mode 100644
index 0000000000000000000000000000000000000000..33f09c11dfaa303e3054be774923b8fe8c87bdf6
GIT binary patch
literal 960
zcmezO_TO6u1_mY|W(3nLC8@<FK#sSK>Fjt0)(AaQ14{-5=4OK?=6ZuBrt}5OOpHuS
zEX5{U*$jBuIJMe5+P?ELGIFyr7~~rY81S(%hqAB<vxnwo=jE5@!9+MPMA#7`{6K?%
zy10bd919YYGg1wO3<N*|+`^nu`T5?dsRgM;FfnFf&Yb+@#GH)$;t~S|ab81H14Cm2
zLkm-LV}mFOejwA-z{tQHDnNfHH8Cn72MZ%B19KB2KZ8LNBNtN>BO}8iMUFT@2ZOeg
zIo0VqU)Gsh?)+2lWOX}l!O^y$Ym+mc_-!)0u<ML?V9Blc-mtBC&31d3W2H}+_st47
zSo!8PoB3JMlBZuTtvP(H>Ca_;8-rUqM^}7kX7=(~dap{9?W!DC!lk)$X00#?<daF|
z3yWSLp1^kHlNtZ+<L<Q+o+LAVn0Qe1`OMGt=UCru>P_`2uw~E*o>P|{AL8)a$wl+I
z^Yf=?&w7Zu@^^03*V{V3@&39=C;9AS6{hcZW48MuYPP{>f7jY8`_`m?l>NFX|J}>W
zs&)1M<HPJ_v^MVk`@Frz%*>!*_CxJ!%JZ-G*y&uI-Q@V8H2Ao^QZ857+o=r<si_+$
zGchwVFfLX!kT;M8MzJg(ix`VY>h&!T)Lp9>BJ|f@<xbHp@A$szD{>$L(-trg85yKc
zWSce1YM95!*M2+JvS9zI1McUKniN!>&wgdnvX7%`#xvWuvXAoFZY!^LTzmDt?4&Pq
zS^w6&+vnB3<Kw?C(Uo`Bes{4==cuxtcs;7pW!m+9e2ynl9=9LX5L|u7?CXX#d-cU+
z^A-lFM!m^jt56svopyzHndkOW=OZoL-fQ-Xl|^W?w?6vlA}W`D(MGs9O7|KY_rlAZ
zb?-ZV9_Cvj;QlH#_Us4CSNf4M9D9DAi9WeoUqP~Q`c}o=2}>+FavZe+Hy)N+-1FmY
z`h|CIf*7@)$X(iEQhcY*L}jI4`P#pm%Xtq~9Z3ClMsTj=sz~9(bJxZvK074w;psw8
i$F1+@P2@41^Um9F1>-ph;maAXGcx@a=o~s4V+sJO#ADR}

literal 0
HcmV?d00001

diff --git a/zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf b/zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf
new file mode 100644
index 00000000000..5f8323e00e7
--- /dev/null
+++ b/zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf
@@ -0,0 +1,18 @@
+Server {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       user_foo="bar";
+};
+Client {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       username="foo"
+       password="bar";
+};
+QuorumServer {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       user_test="test";
+};
+QuorumLearner {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       username="test"
+       password="test";
+};
\ No newline at end of file

From ea3042d5c4d17b7e645d07a73d0cb9e832d0e9f0 Mon Sep 17 00:00:00 2001
From: Matteo Minardi <matteo.minardi@diennea.com>
Date: Mon, 23 Nov 2020 11:39:38 +0000
Subject: [PATCH 133/591] =?UTF-8?q?ZOOKEEPER-3989:=20GenerateLoad=20needs?=
 =?UTF-8?q?=20to=20use=20log=20for=20protecting=20sensitive=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sensitive data about args[0], zkHostPort, and cmdNumber are directly printed and may leak.
For security, log should be used to record these data, as well as log in other classes such as org.apache.zookeeper.server.ZooKeeperServer:
LOG = LoggerFactory.getLogger(GenerateLoad.class);
```
LOG.error("Could not connect to " + args[0]);
......
LOG.info("Connecting exclusively to " + zkHostPort.toString());
......
LOG.error("Not a valid number: " + e.getMessage());
```

Author: Matteo Minardi <matteo.minardi@diennea.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Benjamin Reed <breed@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1530 from mino181295/fix/ZOOKEEPER-3989/generate-load-uselog
---
 .../zookeeper/test/system/GenerateLoad.java   | 46 +++++++++----------
 1 file changed, 22 insertions(+), 24 deletions(-)

diff --git a/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
index afcffc81622..18e9ea0cd40 100644
--- a/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
@@ -86,7 +86,7 @@ public class GenerateLoad {
     synchronized static void add(long time, int count, Socket s) {
         long interval = time / INTERVAL;
         if (currentInterval == 0 || currentInterval > interval) {
-            System.out.println(
+            LOG.info(
                 "Dropping " + count + " for " + new Date(time)
                     + " " + currentInterval + ">" + interval);
             return;
@@ -117,14 +117,14 @@ static class SlaveThread extends Thread {
 
         public void run() {
             try {
-                System.out.println("Connected to " + s);
+                LOG.info("Connected to " + s);
                 BufferedReader is = new BufferedReader(new InputStreamReader(s
                         .getInputStream()));
                 String result;
                 while ((result = is.readLine()) != null) {
                     String timePercentCount[] = result.split(" ");
                     if (timePercentCount.length != 5) {
-                        System.err.println("Got " + result + " from " + s
+                        LOG.error("Got " + result + " from " + s
                                 + " exitng.");
                         throw new IOException(result);
                     }
@@ -133,7 +133,7 @@ public void run() {
                     int count = Integer.parseInt(timePercentCount[2]);
                     int errs = Integer.parseInt(timePercentCount[3]);
                     if (errs > 0) {
-                        System.out.println(s + " Got an error! " + errs);
+                        LOG.error(s + " Got an error! " + errs);
                     }
                     add(time, count, s);
                 }
@@ -154,7 +154,7 @@ void send(int percentage) {
 
         void close() {
             try {
-                System.err.println("Closing " + s);
+                LOG.info("Closing " + s);
                 slaves.remove(this);
                 s.close();
             } catch (IOException e) {
@@ -173,7 +173,7 @@ public void run() {
             try {
                 while (true) {
                     Socket s = ss.accept();
-                    System.err.println("Accepted connection from " + s);
+                    LOG.info("Accepted connection from " + s);
                     slaves.add(new SlaveThread(s));
                 }
             } catch (IOException e) {
@@ -234,7 +234,7 @@ public void run() {
                                 + percentage + "% " + count + " " + min + " "
                                 + ((double) total / (double) number) + " "
                                 + max;
-                        System.err.println(report);
+                        LOG.info(report);
                         if (sf != null) {
                             sf.println(report);
                         }
@@ -262,7 +262,7 @@ synchronized static void sendChange(int percentage) {
         now = Time.currentElapsedTime();
         long delay = now - start;
         if (delay > 1000) {
-            System.out.println("Delay of " + delay + " to send new percentage");
+            LOG.info("Delay of " + delay + " to send new percentage");
         }
         lastChange = now;
     }
@@ -344,7 +344,7 @@ public void run() {
                         }
                     }
                     if (path == null) {
-                        System.err.println("Couldn't create a node in /!");
+                        LOG.error("Couldn't create a node in /!");
                         return;
                     }
                     while (alive) {
@@ -370,7 +370,7 @@ public void run() {
             }
 
             public void process(WatchedEvent event) {
-                System.err.println(event);
+                LOG.info(event.toString());
                 synchronized (this) {
                     if (event.getType() == EventType.None) {
                         connected = (event.getState() == KeeperState.SyncConnected);
@@ -387,7 +387,7 @@ public void processResult(int rc, String path, Object ctx, byte[] data,
                         return;
                     }
                     if (rc != 0) {
-                        System.err.println("Got rc = " + rc);
+                        LOG.info("Got rc = " + rc);
                         errors++;
                     } else {
                         finished++;
@@ -401,7 +401,7 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
                 decOutstanding();
                 synchronized (statSync) {
                     if (rc != 0) {
-                        System.err.println("Got rc = " + rc);
+                        LOG.info("Got rc = " + rc);
                         errors++;
                     } else {
                         finished++;
@@ -446,7 +446,6 @@ public void run() {
                             wlatency = 0;
                         }
                         os.write(report.getBytes());
-                        //System.out.println("Reporting " + report + "+" + subreport);
                     }
                 } catch (Exception e) {
                     e.printStackTrace();
@@ -461,7 +460,7 @@ public void run() {
         Reporter r;
 
         public void configure(final String params) {
-            System.err.println("Got " + params);
+            LOG.info("Got " + params);
             new Thread() {
                 public void run() {
                     try {
@@ -471,8 +470,8 @@ public void run() {
                         if (parts.length == 3) {
                             try {
                                 bytesSize = Integer.parseInt(parts[2]);
-                            } catch(Exception e) {
-                                System.err.println("Not an integer: " + parts[2]);
+                            } catch (Exception e) {
+                                LOG.error("Not an integer: " + parts[2]);
                             }
                         }
                         bytes = new byte[bytesSize];
@@ -591,7 +590,7 @@ public static void main(String[] args) throws InterruptedException,
                 StatusWatcher statusWatcher = new StatusWatcher();
                 ZooKeeper zk = new ZooKeeper(args[0], 15000, statusWatcher);
                 if (!statusWatcher.waitConnected(5000)) {
-                    System.err.println("Could not connect to " + args[0]);
+                    LOG.error("Could not connect to " + args[0]);
                     return;
                 }
                 InstanceManager im = new InstanceManager(zk, args[1]);
@@ -627,7 +626,7 @@ public static void main(String[] args) throws InterruptedException,
                                     String mode = getMode(parts[i]);
                                     if (mode.equals("leader")) {
                                         zkHostPort = new StringBuilder(parts[i]);
-                                        System.out.println("Connecting exclusively to " + zkHostPort.toString());
+                                        LOG.info("Connecting exclusively to " + zkHostPort.toString());
                                         break outer;
                                     }
                                 } catch(IOException e) {
@@ -671,14 +670,13 @@ public static void main(String[] args) throws InterruptedException,
                                 && cmdNumber.length > 1) {
                             sf = new PrintStream(cmdNumber[1]);
                         } else {
-                            System.err.println("Commands must be:");
-                            System.err
-                                    .println("\tpercentage new_write_percentage");
-                            System.err.println("\tsleep seconds_to_sleep");
-                            System.err.println("\tsave file_to_save_output");
+                            LOG.error("Commands must be:");
+                            LOG.error("\tpercentage new_write_percentage");
+                            LOG.error("\tsleep seconds_to_sleep");
+                            LOG.error("\tsave file_to_save_output");
                         }
                     } catch (NumberFormatException e) {
-                        System.out.println("Not a valid number: "
+                        LOG.error("Not a valid number: "
                                 + e.getMessage());
                     }
                 }

From efbd660e1c4b90a8f538f2cccb5dcb7094cf9a22 Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Mon, 23 Nov 2020 12:53:14 +0100
Subject: [PATCH 134/591] ZOOKEEPER-3642: Fix potential data inconsistency due
 to DIFF sync after partial SNAP sync.

Based on https://github.com/apache/zookeeper/pull/1224 ; fixed unit test build issue.

Author: Fangmin Lyu <fangmin@apache.org>
Author: Michael Han <hanm@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Originally developed by Fangmin Lyu <fangmin@apache.org>

Closes #1515 from hanm/ZOOKEEPER-3642
---
 .../zookeeper/server/ZooKeeperServer.java     |   3 +
 .../zookeeper/server/quorum/Learner.java      |   4 +-
 .../server/quorum/QuorumPeerMainTest.java     | 140 ++++++++++++++++++
 3 files changed, 146 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 77b055ec139..7ef687ed740 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -802,6 +802,9 @@ public void shutdown() {
      */
     public synchronized void shutdown(boolean fullyShutDown) {
         if (!canShutdown()) {
+            if (fullyShutDown && zkDb != null) {
+                zkDb.clear();
+            }
             LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
             return;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 1b6c25043a2..ef36b2f9000 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -859,7 +859,9 @@ public void shutdown() {
         closeSocket();
         // shutdown previous zookeeper
         if (zk != null) {
-            zk.shutdown();
+            // If we haven't finished SNAP sync, force fully shutdown
+            // to avoid potential inconsistency
+            zk.shutdown(self.getSyncMode().equals(QuorumPeer.SyncMode.SNAP));
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index 793a3058011..bc00d213308 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -1615,11 +1615,139 @@ public void testLearnerRequestForwardBehavior() throws Exception {
         }
     }
 
+    /**
+     * If learner failed to do SNAP sync with leader before it's writing
+     * the snapshot to disk, it's possible that it might have DIFF sync
+     * with new leader or itself being elected as a leader.
+     *
+     * This test is trying to guarantee there is no data inconsistency for
+     * this case.
+     */
+    @Test
+    public void testDiffSyncAfterSnap() throws Exception {
+        final int ENSEMBLE_SERVERS = 3;
+        MainThread[] mt = new MainThread[ENSEMBLE_SERVERS];
+        ZooKeeper[] zk = new ZooKeeper[ENSEMBLE_SERVERS];
+
+        try {
+            // 1. start a quorum
+            final int[] clientPorts = new int[ENSEMBLE_SERVERS];
+            StringBuilder sb = new StringBuilder();
+            String server;
+
+            for (int i = 0; i < ENSEMBLE_SERVERS; i++) {
+                clientPorts[i] = PortAssignment.unique();
+                server = "server." + i + "=127.0.0.1:" + PortAssignment.unique()
+                         + ":" + PortAssignment.unique()
+                         + ":participant;127.0.0.1:" + clientPorts[i];
+                sb.append(server + "\n");
+            }
+            String currentQuorumCfgSection = sb.toString();
+
+            // start servers
+            Context[] contexts = new Context[ENSEMBLE_SERVERS];
+            for (int i = 0; i < ENSEMBLE_SERVERS; i++) {
+                final Context context = new Context();
+                contexts[i] = context;
+                mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false) {
+                    @Override
+                    public TestQPMain getTestQPMain() {
+                        return new CustomizedQPMain(context);
+                    }
+                };
+                mt[i].start();
+                zk[i] = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
+            }
+            waitForAll(zk, States.CONNECTED);
+            LOG.info("all servers started");
+
+            final String nodePath = "/testDiffSyncAfterSnap";
+
+            // 2. find leader and a follower
+            int leaderId = -1;
+            int followerA = -1;
+            for (int i = ENSEMBLE_SERVERS - 1; i >= 0; i--) {
+                if (mt[i].main.quorumPeer.leader != null) {
+                    leaderId = i;
+                } else if (followerA == -1) {
+                    followerA = i;
+                }
+            }
+
+            // 3. stop follower A
+            LOG.info("shutdown follower {}", followerA);
+            mt[followerA].shutdown();
+            waitForOne(zk[followerA], States.CONNECTING);
+
+            // 4. issue some traffic
+            int index = 0;
+            int numOfRequests = 10;
+            for (int i = 0; i < numOfRequests; i++) {
+                zk[leaderId].create(nodePath + index++,
+                   new byte[1], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            CustomQuorumPeer leaderQuorumPeer = (CustomQuorumPeer) mt[leaderId].main.quorumPeer;
+
+            // 5. inject fault to cause the follower exit when received NEWLEADER
+            contexts[followerA].newLeaderReceivedCallback = new NewLeaderReceivedCallback() {
+                boolean processed = false;
+                @Override
+                public void process() throws IOException {
+                    if (processed) {
+                        return;
+                    }
+                    processed = true;
+                    System.setProperty(LearnerHandler.FORCE_SNAP_SYNC, "false");
+                    throw new IOException("read timedout");
+                }
+            };
+
+            // 6. force snap sync once
+            LOG.info("force snapshot sync");
+            System.setProperty(LearnerHandler.FORCE_SNAP_SYNC, "true");
+
+            // 7. start follower A
+            mt[followerA].start();
+            waitForOne(zk[followerA], States.CONNECTED);
+            LOG.info("verify the nodes are exist in memory");
+            for (int i = 0; i < index; i++) {
+                assertNotNull(zk[followerA].exists(nodePath + i, false));
+            }
+
+            // 8. issue another request which will be persisted on disk
+            zk[leaderId].create(nodePath + index++,
+               new byte[1], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // wait some time to let this get written to disk
+            Thread.sleep(500);
+
+            // 9. reload data from disk and make sure it's still consistent
+            LOG.info("restarting follower {}", followerA);
+            mt[followerA].shutdown();
+            waitForOne(zk[followerA], States.CONNECTING);
+            mt[followerA].start();
+            waitForOne(zk[followerA], States.CONNECTED);
+
+            for (int i = 0; i < index; i++) {
+                assertNotNull(zk[followerA].exists(nodePath + i, false), "node " + i + " should exist");
+            }
+
+        } finally {
+            System.clearProperty(LearnerHandler.FORCE_SNAP_SYNC);
+            for (int i = 0; i < ENSEMBLE_SERVERS; i++) {
+                mt[i].shutdown();
+                zk[i].close();
+            }
+        }
+    }
+
     static class Context {
 
         boolean quitFollowing = false;
         boolean exitWhenAckNewLeader = false;
         NewLeaderAckCallback newLeaderAckCallback = null;
+        NewLeaderReceivedCallback newLeaderReceivedCallback = null;
 
     }
 
@@ -1629,6 +1757,10 @@ interface NewLeaderAckCallback {
 
     }
 
+    interface NewLeaderReceivedCallback {
+        void process() throws IOException;
+    }
+
     interface StartForwardingListener {
 
         void start();
@@ -1702,6 +1834,14 @@ void writePacket(QuorumPacket pp, boolean flush) throws IOException {
                     }
                     super.writePacket(pp, flush);
                 }
+
+                @Override
+                void readPacket(QuorumPacket qp) throws IOException {
+                    super.readPacket(qp);
+                    if (qp.getType() == Leader.NEWLEADER && context.newLeaderReceivedCallback != null) {
+                        context.newLeaderReceivedCallback.process();
+                    }
+                }
             };
         }
 

From ef1f12fbe8865aaa675adf8f844487e71e1b6a77 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 24 Nov 2020 15:37:33 +0100
Subject: [PATCH 135/591] ZOOKEEPER-4017: Owasp check failing - Jetty 9.4.32 -
 CVE-2020-27216

Author: Andor Molnar <andor@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1549 from anmolnar/ZOOKEEPER-4017
---
 pom.xml                                       |   2 +-
 .../jetty-client-9.4.32.v20200930.LICENSE.txt | 202 ---------
 .../jetty-client-9.4.34.v20201102.LICENSE.txt | 415 ++++++++++++++++++
 .../jetty-http-9.4.32.v20200930.LICENSE.txt   | 202 ---------
 .../jetty-http-9.4.34.v20201102.LICENSE.txt   | 415 ++++++++++++++++++
 .../lib/jetty-io-9.4.32.v20200930.LICENSE.txt | 202 ---------
 .../lib/jetty-io-9.4.34.v20201102.LICENSE.txt | 415 ++++++++++++++++++
 ...etty-security-9.4.32.v20200930.LICENSE.txt | 202 ---------
 ...etty-security-9.4.34.v20201102.LICENSE.txt | 415 ++++++++++++++++++
 .../jetty-server-9.4.32.v20200930.LICENSE.txt | 202 ---------
 .../jetty-server-9.4.34.v20201102.LICENSE.txt | 415 ++++++++++++++++++
 ...jetty-servlet-9.4.32.v20200930.LICENSE.txt | 202 ---------
 ...jetty-servlet-9.4.34.v20201102.LICENSE.txt | 415 ++++++++++++++++++
 .../jetty-util-9.4.32.v20200930.LICENSE.txt   | 202 ---------
 .../jetty-util-9.4.34.v20201102.LICENSE.txt   | 415 ++++++++++++++++++
 15 files changed, 2906 insertions(+), 1415 deletions(-)
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index 162e7da7031..7e077475925 100755
--- a/pom.xml
+++ b/pom.xml
@@ -438,7 +438,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>
-    <jetty.version>9.4.32.v20200930</jetty.version>
+    <jetty.version>9.4.34.v20201102</jetty.version>
     <jackson.version>2.10.5</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.32.v20200930.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt
new file mode 100644
index 00000000000..6acfaf43962
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt
@@ -0,0 +1,415 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 1.0 which is available at
+https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
+or the Apache Software License 2.0 which is available at
+https://www.apache.org/licenses/LICENSE-2.0
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

From 59c87413ddc6774a22b98ba8aabb5855e049efe9 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Thu, 24 Dec 2020 14:36:56 +0000
Subject: [PATCH 136/591] ZOOKEEPER-4023: dependency-check:check failing -
 Jetty 9.4.34.v20201102 - CVE-2020-27218

Bump jetty.version to 9.4.35.v20201120.

The [release notes](https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.35.v20201120)
mention [issue 5605](https://github.com/eclipse/jetty.project/issues/5605):

> java.io.IOException: unconsumed input during http request parsing

which seems to match the description of
[CVE-2020-27218](http://cve.circl.lu/cve/CVE-2020-27218)

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Andor Molnar <anmolnar@apache.org>, Patrick D. Hunt <phunt@apache.org>

Closes #1552 from ztzg/jetty-upgrade-CVE-2020-27218
---
 pom.xml                                       |   2 +-
 ...jetty-client-9.4.35.v20201120.LICENSE.txt} |   7 +-
 ...> jetty-http-9.4.35.v20201120.LICENSE.txt} |   7 +-
 ... => jetty-io-9.4.35.v20201120.LICENSE.txt} |   7 +-
 ...tty-security-9.4.35.v20201120.LICENSE.txt} |   7 +-
 .../jetty-server-9.4.34.v20201102.LICENSE.txt | 415 ------------------
 .../jetty-server-9.4.35.v20201120.LICENSE.txt | 414 +++++++++++++++++
 ...jetty-servlet-9.4.34.v20201102.LICENSE.txt | 415 ------------------
 ...jetty-servlet-9.4.35.v20201120.LICENSE.txt | 414 +++++++++++++++++
 .../jetty-util-9.4.34.v20201102.LICENSE.txt   | 415 ------------------
 .../jetty-util-9.4.35.v20201120.LICENSE.txt   | 414 +++++++++++++++++
 ...tty-util-ajax-9.4.35.v20201120.LICENSE.txt | 414 +++++++++++++++++
 12 files changed, 1669 insertions(+), 1262 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-client-9.4.34.v20201102.LICENSE.txt => jetty-client-9.4.35.v20201120.LICENSE.txt} (99%)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.34.v20201102.LICENSE.txt => jetty-http-9.4.35.v20201120.LICENSE.txt} (99%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.34.v20201102.LICENSE.txt => jetty-io-9.4.35.v20201120.LICENSE.txt} (99%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.34.v20201102.LICENSE.txt => jetty-security-9.4.35.v20201120.LICENSE.txt} (99%)
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index 7e077475925..837dceff969 100755
--- a/pom.xml
+++ b/pom.xml
@@ -438,7 +438,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>
-    <jetty.version>9.4.34.v20201102</jetty.version>
+    <jetty.version>9.4.35.v20201120</jetty.version>
     <jackson.version>2.10.5</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.35.v20201120.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-client-9.4.35.v20201120.LICENSE.txt
index 6acfaf43962..46f4f252464 100644
--- a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.35.v20201120.LICENSE.txt
@@ -1,8 +1,7 @@
 This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
 
 
 
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt
index 6acfaf43962..46f4f252464 100644
--- a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt
@@ -1,8 +1,7 @@
 This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
 
 
 
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt
index 6acfaf43962..46f4f252464 100644
--- a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt
@@ -1,8 +1,7 @@
 This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
 
 
 
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt
index 6acfaf43962..46f4f252464 100644
--- a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt
@@ -1,8 +1,7 @@
 This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
 
 
 
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt
deleted file mode 100644
index 6acfaf43962..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt
+++ /dev/null
@@ -1,415 +0,0 @@
-This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
-
-
-
-Eclipse Public License - v 1.0
-
-THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
-LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
-CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
-
-1. DEFINITIONS
-
-"Contribution" means:
-
-a) in the case of the initial Contributor, the initial code and documentation
-   distributed under this Agreement, and
-b) in the case of each subsequent Contributor:
-    i) changes to the Program, and
-   ii) additions to the Program;
-
-   where such changes and/or additions to the Program originate from and are
-   distributed by that particular Contributor. A Contribution 'originates'
-   from a Contributor if it was added to the Program by such Contributor
-   itself or anyone acting on such Contributor's behalf. Contributions do not
-   include additions to the Program which: (i) are separate modules of
-   software distributed in conjunction with the Program under their own
-   license agreement, and (ii) are not derivative works of the Program.
-
-"Contributor" means any person or entity that distributes the Program.
-
-"Licensed Patents" mean patent claims licensable by a Contributor which are
-necessarily infringed by the use or sale of its Contribution alone or when
-combined with the Program.
-
-"Program" means the Contributions distributed in accordance with this
-Agreement.
-
-"Recipient" means anyone who receives the Program under this Agreement,
-including all Contributors.
-
-2. GRANT OF RIGHTS
-  a) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free copyright license to
-     reproduce, prepare derivative works of, publicly display, publicly
-     perform, distribute and sublicense the Contribution of such Contributor,
-     if any, and such derivative works, in source code and object code form.
-  b) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free patent license under
-     Licensed Patents to make, use, sell, offer to sell, import and otherwise
-     transfer the Contribution of such Contributor, if any, in source code and
-     object code form. This patent license shall apply to the combination of
-     the Contribution and the Program if, at the time the Contribution is
-     added by the Contributor, such addition of the Contribution causes such
-     combination to be covered by the Licensed Patents. The patent license
-     shall not apply to any other combinations which include the Contribution.
-     No hardware per se is licensed hereunder.
-  c) Recipient understands that although each Contributor grants the licenses
-     to its Contributions set forth herein, no assurances are provided by any
-     Contributor that the Program does not infringe the patent or other
-     intellectual property rights of any other entity. Each Contributor
-     disclaims any liability to Recipient for claims brought by any other
-     entity based on infringement of intellectual property rights or
-     otherwise. As a condition to exercising the rights and licenses granted
-     hereunder, each Recipient hereby assumes sole responsibility to secure
-     any other intellectual property rights needed, if any. For example, if a
-     third party patent license is required to allow Recipient to distribute
-     the Program, it is Recipient's responsibility to acquire that license
-     before distributing the Program.
-  d) Each Contributor represents that to its knowledge it has sufficient
-     copyright rights in its Contribution, if any, to grant the copyright
-     license set forth in this Agreement.
-
-3. REQUIREMENTS
-
-A Contributor may choose to distribute the Program in object code form under
-its own license agreement, provided that:
-
-  a) it complies with the terms and conditions of this Agreement; and
-  b) its license agreement:
-      i) effectively disclaims on behalf of all Contributors all warranties
-         and conditions, express and implied, including warranties or
-         conditions of title and non-infringement, and implied warranties or
-         conditions of merchantability and fitness for a particular purpose;
-     ii) effectively excludes on behalf of all Contributors all liability for
-         damages, including direct, indirect, special, incidental and
-         consequential damages, such as lost profits;
-    iii) states that any provisions which differ from this Agreement are
-         offered by that Contributor alone and not by any other party; and
-     iv) states that source code for the Program is available from such
-         Contributor, and informs licensees how to obtain it in a reasonable
-         manner on or through a medium customarily used for software exchange.
-
-When the Program is made available in source code form:
-
-  a) it must be made available under this Agreement; and
-  b) a copy of this Agreement must be included with each copy of the Program.
-     Contributors may not remove or alter any copyright notices contained
-     within the Program.
-
-Each Contributor must identify itself as the originator of its Contribution,
-if
-any, in a manner that reasonably allows subsequent Recipients to identify the
-originator of the Contribution.
-
-4. COMMERCIAL DISTRIBUTION
-
-Commercial distributors of software may accept certain responsibilities with
-respect to end users, business partners and the like. While this license is
-intended to facilitate the commercial use of the Program, the Contributor who
-includes the Program in a commercial product offering should do so in a manner
-which does not create potential liability for other Contributors. Therefore,
-if a Contributor includes the Program in a commercial product offering, such
-Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
-every other Contributor ("Indemnified Contributor") against any losses,
-damages and costs (collectively "Losses") arising from claims, lawsuits and
-other legal actions brought by a third party against the Indemnified
-Contributor to the extent caused by the acts or omissions of such Commercial
-Contributor in connection with its distribution of the Program in a commercial
-product offering. The obligations in this section do not apply to any claims
-or Losses relating to any actual or alleged intellectual property
-infringement. In order to qualify, an Indemnified Contributor must:
-a) promptly notify the Commercial Contributor in writing of such claim, and
-b) allow the Commercial Contributor to control, and cooperate with the
-Commercial Contributor in, the defense and any related settlement
-negotiations. The Indemnified Contributor may participate in any such claim at
-its own expense.
-
-For example, a Contributor might include the Program in a commercial product
-offering, Product X. That Contributor is then a Commercial Contributor. If
-that Commercial Contributor then makes performance claims, or offers
-warranties related to Product X, those performance claims and warranties are
-such Commercial Contributor's responsibility alone. Under this section, the
-Commercial Contributor would have to defend claims against the other
-Contributors related to those performance claims and warranties, and if a
-court requires any other Contributor to pay any damages as a result, the
-Commercial Contributor must pay those damages.
-
-5. NO WARRANTY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
-IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
-Recipient is solely responsible for determining the appropriateness of using
-and distributing the Program and assumes all risks associated with its
-exercise of rights under this Agreement , including but not limited to the
-risks and costs of program errors, compliance with applicable laws, damage to
-or loss of data, programs or equipment, and unavailability or interruption of
-operations.
-
-6. DISCLAIMER OF LIABILITY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
-CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
-LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
-EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
-OF SUCH DAMAGES.
-
-7. GENERAL
-
-If any provision of this Agreement is invalid or unenforceable under
-applicable law, it shall not affect the validity or enforceability of the
-remainder of the terms of this Agreement, and without further action by the
-parties hereto, such provision shall be reformed to the minimum extent
-necessary to make such provision valid and enforceable.
-
-If Recipient institutes patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Program itself
-(excluding combinations of the Program with other software or hardware)
-infringes such Recipient's patent(s), then such Recipient's rights granted
-under Section 2(b) shall terminate as of the date such litigation is filed.
-
-All Recipient's rights under this Agreement shall terminate if it fails to
-comply with any of the material terms or conditions of this Agreement and does
-not cure such failure in a reasonable period of time after becoming aware of
-such noncompliance. If all Recipient's rights under this Agreement terminate,
-Recipient agrees to cease use and distribution of the Program as soon as
-reasonably practicable. However, Recipient's obligations under this Agreement
-and any licenses granted by Recipient relating to the Program shall continue
-and survive.
-
-Everyone is permitted to copy and distribute copies of this Agreement, but in
-order to avoid inconsistency the Agreement is copyrighted and may only be
-modified in the following manner. The Agreement Steward reserves the right to
-publish new versions (including revisions) of this Agreement from time to
-time. No one other than the Agreement Steward has the right to modify this
-Agreement. The Eclipse Foundation is the initial Agreement Steward. The
-Eclipse Foundation may assign the responsibility to serve as the Agreement
-Steward to a suitable separate entity. Each new version of the Agreement will
-be given a distinguishing version number. The Program (including
-Contributions) may always be distributed subject to the version of the
-Agreement under which it was received. In addition, after a new version of the
-Agreement is published, Contributor may elect to distribute the Program
-(including its Contributions) under the new version. Except as expressly
-stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
-licenses to the intellectual property of any Contributor under this Agreement,
-whether expressly, by implication, estoppel or otherwise. All rights in the
-Program not expressly granted under this Agreement are reserved.
-
-This Agreement is governed by the laws of the State of New York and the
-intellectual property laws of the United States of America. No party to this
-Agreement will bring a legal action under this Agreement more than one year
-after the cause of action arose. Each party waives its rights to a jury trial in
-any resulting litigation.
-
-
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt
deleted file mode 100644
index 6acfaf43962..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt
+++ /dev/null
@@ -1,415 +0,0 @@
-This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
-
-
-
-Eclipse Public License - v 1.0
-
-THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
-LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
-CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
-
-1. DEFINITIONS
-
-"Contribution" means:
-
-a) in the case of the initial Contributor, the initial code and documentation
-   distributed under this Agreement, and
-b) in the case of each subsequent Contributor:
-    i) changes to the Program, and
-   ii) additions to the Program;
-
-   where such changes and/or additions to the Program originate from and are
-   distributed by that particular Contributor. A Contribution 'originates'
-   from a Contributor if it was added to the Program by such Contributor
-   itself or anyone acting on such Contributor's behalf. Contributions do not
-   include additions to the Program which: (i) are separate modules of
-   software distributed in conjunction with the Program under their own
-   license agreement, and (ii) are not derivative works of the Program.
-
-"Contributor" means any person or entity that distributes the Program.
-
-"Licensed Patents" mean patent claims licensable by a Contributor which are
-necessarily infringed by the use or sale of its Contribution alone or when
-combined with the Program.
-
-"Program" means the Contributions distributed in accordance with this
-Agreement.
-
-"Recipient" means anyone who receives the Program under this Agreement,
-including all Contributors.
-
-2. GRANT OF RIGHTS
-  a) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free copyright license to
-     reproduce, prepare derivative works of, publicly display, publicly
-     perform, distribute and sublicense the Contribution of such Contributor,
-     if any, and such derivative works, in source code and object code form.
-  b) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free patent license under
-     Licensed Patents to make, use, sell, offer to sell, import and otherwise
-     transfer the Contribution of such Contributor, if any, in source code and
-     object code form. This patent license shall apply to the combination of
-     the Contribution and the Program if, at the time the Contribution is
-     added by the Contributor, such addition of the Contribution causes such
-     combination to be covered by the Licensed Patents. The patent license
-     shall not apply to any other combinations which include the Contribution.
-     No hardware per se is licensed hereunder.
-  c) Recipient understands that although each Contributor grants the licenses
-     to its Contributions set forth herein, no assurances are provided by any
-     Contributor that the Program does not infringe the patent or other
-     intellectual property rights of any other entity. Each Contributor
-     disclaims any liability to Recipient for claims brought by any other
-     entity based on infringement of intellectual property rights or
-     otherwise. As a condition to exercising the rights and licenses granted
-     hereunder, each Recipient hereby assumes sole responsibility to secure
-     any other intellectual property rights needed, if any. For example, if a
-     third party patent license is required to allow Recipient to distribute
-     the Program, it is Recipient's responsibility to acquire that license
-     before distributing the Program.
-  d) Each Contributor represents that to its knowledge it has sufficient
-     copyright rights in its Contribution, if any, to grant the copyright
-     license set forth in this Agreement.
-
-3. REQUIREMENTS
-
-A Contributor may choose to distribute the Program in object code form under
-its own license agreement, provided that:
-
-  a) it complies with the terms and conditions of this Agreement; and
-  b) its license agreement:
-      i) effectively disclaims on behalf of all Contributors all warranties
-         and conditions, express and implied, including warranties or
-         conditions of title and non-infringement, and implied warranties or
-         conditions of merchantability and fitness for a particular purpose;
-     ii) effectively excludes on behalf of all Contributors all liability for
-         damages, including direct, indirect, special, incidental and
-         consequential damages, such as lost profits;
-    iii) states that any provisions which differ from this Agreement are
-         offered by that Contributor alone and not by any other party; and
-     iv) states that source code for the Program is available from such
-         Contributor, and informs licensees how to obtain it in a reasonable
-         manner on or through a medium customarily used for software exchange.
-
-When the Program is made available in source code form:
-
-  a) it must be made available under this Agreement; and
-  b) a copy of this Agreement must be included with each copy of the Program.
-     Contributors may not remove or alter any copyright notices contained
-     within the Program.
-
-Each Contributor must identify itself as the originator of its Contribution,
-if
-any, in a manner that reasonably allows subsequent Recipients to identify the
-originator of the Contribution.
-
-4. COMMERCIAL DISTRIBUTION
-
-Commercial distributors of software may accept certain responsibilities with
-respect to end users, business partners and the like. While this license is
-intended to facilitate the commercial use of the Program, the Contributor who
-includes the Program in a commercial product offering should do so in a manner
-which does not create potential liability for other Contributors. Therefore,
-if a Contributor includes the Program in a commercial product offering, such
-Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
-every other Contributor ("Indemnified Contributor") against any losses,
-damages and costs (collectively "Losses") arising from claims, lawsuits and
-other legal actions brought by a third party against the Indemnified
-Contributor to the extent caused by the acts or omissions of such Commercial
-Contributor in connection with its distribution of the Program in a commercial
-product offering. The obligations in this section do not apply to any claims
-or Losses relating to any actual or alleged intellectual property
-infringement. In order to qualify, an Indemnified Contributor must:
-a) promptly notify the Commercial Contributor in writing of such claim, and
-b) allow the Commercial Contributor to control, and cooperate with the
-Commercial Contributor in, the defense and any related settlement
-negotiations. The Indemnified Contributor may participate in any such claim at
-its own expense.
-
-For example, a Contributor might include the Program in a commercial product
-offering, Product X. That Contributor is then a Commercial Contributor. If
-that Commercial Contributor then makes performance claims, or offers
-warranties related to Product X, those performance claims and warranties are
-such Commercial Contributor's responsibility alone. Under this section, the
-Commercial Contributor would have to defend claims against the other
-Contributors related to those performance claims and warranties, and if a
-court requires any other Contributor to pay any damages as a result, the
-Commercial Contributor must pay those damages.
-
-5. NO WARRANTY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
-IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
-Recipient is solely responsible for determining the appropriateness of using
-and distributing the Program and assumes all risks associated with its
-exercise of rights under this Agreement , including but not limited to the
-risks and costs of program errors, compliance with applicable laws, damage to
-or loss of data, programs or equipment, and unavailability or interruption of
-operations.
-
-6. DISCLAIMER OF LIABILITY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
-CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
-LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
-EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
-OF SUCH DAMAGES.
-
-7. GENERAL
-
-If any provision of this Agreement is invalid or unenforceable under
-applicable law, it shall not affect the validity or enforceability of the
-remainder of the terms of this Agreement, and without further action by the
-parties hereto, such provision shall be reformed to the minimum extent
-necessary to make such provision valid and enforceable.
-
-If Recipient institutes patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Program itself
-(excluding combinations of the Program with other software or hardware)
-infringes such Recipient's patent(s), then such Recipient's rights granted
-under Section 2(b) shall terminate as of the date such litigation is filed.
-
-All Recipient's rights under this Agreement shall terminate if it fails to
-comply with any of the material terms or conditions of this Agreement and does
-not cure such failure in a reasonable period of time after becoming aware of
-such noncompliance. If all Recipient's rights under this Agreement terminate,
-Recipient agrees to cease use and distribution of the Program as soon as
-reasonably practicable. However, Recipient's obligations under this Agreement
-and any licenses granted by Recipient relating to the Program shall continue
-and survive.
-
-Everyone is permitted to copy and distribute copies of this Agreement, but in
-order to avoid inconsistency the Agreement is copyrighted and may only be
-modified in the following manner. The Agreement Steward reserves the right to
-publish new versions (including revisions) of this Agreement from time to
-time. No one other than the Agreement Steward has the right to modify this
-Agreement. The Eclipse Foundation is the initial Agreement Steward. The
-Eclipse Foundation may assign the responsibility to serve as the Agreement
-Steward to a suitable separate entity. Each new version of the Agreement will
-be given a distinguishing version number. The Program (including
-Contributions) may always be distributed subject to the version of the
-Agreement under which it was received. In addition, after a new version of the
-Agreement is published, Contributor may elect to distribute the Program
-(including its Contributions) under the new version. Except as expressly
-stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
-licenses to the intellectual property of any Contributor under this Agreement,
-whether expressly, by implication, estoppel or otherwise. All rights in the
-Program not expressly granted under this Agreement are reserved.
-
-This Agreement is governed by the laws of the State of New York and the
-intellectual property laws of the United States of America. No party to this
-Agreement will bring a legal action under this Agreement more than one year
-after the cause of action arose. Each party waives its rights to a jury trial in
-any resulting litigation.
-
-
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt
deleted file mode 100644
index 6acfaf43962..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt
+++ /dev/null
@@ -1,415 +0,0 @@
-This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 1.0 which is available at
-https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt
-or the Apache Software License 2.0 which is available at
-https://www.apache.org/licenses/LICENSE-2.0
-
-
-
-Eclipse Public License - v 1.0
-
-THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
-LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
-CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
-
-1. DEFINITIONS
-
-"Contribution" means:
-
-a) in the case of the initial Contributor, the initial code and documentation
-   distributed under this Agreement, and
-b) in the case of each subsequent Contributor:
-    i) changes to the Program, and
-   ii) additions to the Program;
-
-   where such changes and/or additions to the Program originate from and are
-   distributed by that particular Contributor. A Contribution 'originates'
-   from a Contributor if it was added to the Program by such Contributor
-   itself or anyone acting on such Contributor's behalf. Contributions do not
-   include additions to the Program which: (i) are separate modules of
-   software distributed in conjunction with the Program under their own
-   license agreement, and (ii) are not derivative works of the Program.
-
-"Contributor" means any person or entity that distributes the Program.
-
-"Licensed Patents" mean patent claims licensable by a Contributor which are
-necessarily infringed by the use or sale of its Contribution alone or when
-combined with the Program.
-
-"Program" means the Contributions distributed in accordance with this
-Agreement.
-
-"Recipient" means anyone who receives the Program under this Agreement,
-including all Contributors.
-
-2. GRANT OF RIGHTS
-  a) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free copyright license to
-     reproduce, prepare derivative works of, publicly display, publicly
-     perform, distribute and sublicense the Contribution of such Contributor,
-     if any, and such derivative works, in source code and object code form.
-  b) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free patent license under
-     Licensed Patents to make, use, sell, offer to sell, import and otherwise
-     transfer the Contribution of such Contributor, if any, in source code and
-     object code form. This patent license shall apply to the combination of
-     the Contribution and the Program if, at the time the Contribution is
-     added by the Contributor, such addition of the Contribution causes such
-     combination to be covered by the Licensed Patents. The patent license
-     shall not apply to any other combinations which include the Contribution.
-     No hardware per se is licensed hereunder.
-  c) Recipient understands that although each Contributor grants the licenses
-     to its Contributions set forth herein, no assurances are provided by any
-     Contributor that the Program does not infringe the patent or other
-     intellectual property rights of any other entity. Each Contributor
-     disclaims any liability to Recipient for claims brought by any other
-     entity based on infringement of intellectual property rights or
-     otherwise. As a condition to exercising the rights and licenses granted
-     hereunder, each Recipient hereby assumes sole responsibility to secure
-     any other intellectual property rights needed, if any. For example, if a
-     third party patent license is required to allow Recipient to distribute
-     the Program, it is Recipient's responsibility to acquire that license
-     before distributing the Program.
-  d) Each Contributor represents that to its knowledge it has sufficient
-     copyright rights in its Contribution, if any, to grant the copyright
-     license set forth in this Agreement.
-
-3. REQUIREMENTS
-
-A Contributor may choose to distribute the Program in object code form under
-its own license agreement, provided that:
-
-  a) it complies with the terms and conditions of this Agreement; and
-  b) its license agreement:
-      i) effectively disclaims on behalf of all Contributors all warranties
-         and conditions, express and implied, including warranties or
-         conditions of title and non-infringement, and implied warranties or
-         conditions of merchantability and fitness for a particular purpose;
-     ii) effectively excludes on behalf of all Contributors all liability for
-         damages, including direct, indirect, special, incidental and
-         consequential damages, such as lost profits;
-    iii) states that any provisions which differ from this Agreement are
-         offered by that Contributor alone and not by any other party; and
-     iv) states that source code for the Program is available from such
-         Contributor, and informs licensees how to obtain it in a reasonable
-         manner on or through a medium customarily used for software exchange.
-
-When the Program is made available in source code form:
-
-  a) it must be made available under this Agreement; and
-  b) a copy of this Agreement must be included with each copy of the Program.
-     Contributors may not remove or alter any copyright notices contained
-     within the Program.
-
-Each Contributor must identify itself as the originator of its Contribution,
-if
-any, in a manner that reasonably allows subsequent Recipients to identify the
-originator of the Contribution.
-
-4. COMMERCIAL DISTRIBUTION
-
-Commercial distributors of software may accept certain responsibilities with
-respect to end users, business partners and the like. While this license is
-intended to facilitate the commercial use of the Program, the Contributor who
-includes the Program in a commercial product offering should do so in a manner
-which does not create potential liability for other Contributors. Therefore,
-if a Contributor includes the Program in a commercial product offering, such
-Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
-every other Contributor ("Indemnified Contributor") against any losses,
-damages and costs (collectively "Losses") arising from claims, lawsuits and
-other legal actions brought by a third party against the Indemnified
-Contributor to the extent caused by the acts or omissions of such Commercial
-Contributor in connection with its distribution of the Program in a commercial
-product offering. The obligations in this section do not apply to any claims
-or Losses relating to any actual or alleged intellectual property
-infringement. In order to qualify, an Indemnified Contributor must:
-a) promptly notify the Commercial Contributor in writing of such claim, and
-b) allow the Commercial Contributor to control, and cooperate with the
-Commercial Contributor in, the defense and any related settlement
-negotiations. The Indemnified Contributor may participate in any such claim at
-its own expense.
-
-For example, a Contributor might include the Program in a commercial product
-offering, Product X. That Contributor is then a Commercial Contributor. If
-that Commercial Contributor then makes performance claims, or offers
-warranties related to Product X, those performance claims and warranties are
-such Commercial Contributor's responsibility alone. Under this section, the
-Commercial Contributor would have to defend claims against the other
-Contributors related to those performance claims and warranties, and if a
-court requires any other Contributor to pay any damages as a result, the
-Commercial Contributor must pay those damages.
-
-5. NO WARRANTY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
-IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
-Recipient is solely responsible for determining the appropriateness of using
-and distributing the Program and assumes all risks associated with its
-exercise of rights under this Agreement , including but not limited to the
-risks and costs of program errors, compliance with applicable laws, damage to
-or loss of data, programs or equipment, and unavailability or interruption of
-operations.
-
-6. DISCLAIMER OF LIABILITY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
-CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
-LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
-EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
-OF SUCH DAMAGES.
-
-7. GENERAL
-
-If any provision of this Agreement is invalid or unenforceable under
-applicable law, it shall not affect the validity or enforceability of the
-remainder of the terms of this Agreement, and without further action by the
-parties hereto, such provision shall be reformed to the minimum extent
-necessary to make such provision valid and enforceable.
-
-If Recipient institutes patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Program itself
-(excluding combinations of the Program with other software or hardware)
-infringes such Recipient's patent(s), then such Recipient's rights granted
-under Section 2(b) shall terminate as of the date such litigation is filed.
-
-All Recipient's rights under this Agreement shall terminate if it fails to
-comply with any of the material terms or conditions of this Agreement and does
-not cure such failure in a reasonable period of time after becoming aware of
-such noncompliance. If all Recipient's rights under this Agreement terminate,
-Recipient agrees to cease use and distribution of the Program as soon as
-reasonably practicable. However, Recipient's obligations under this Agreement
-and any licenses granted by Recipient relating to the Program shall continue
-and survive.
-
-Everyone is permitted to copy and distribute copies of this Agreement, but in
-order to avoid inconsistency the Agreement is copyrighted and may only be
-modified in the following manner. The Agreement Steward reserves the right to
-publish new versions (including revisions) of this Agreement from time to
-time. No one other than the Agreement Steward has the right to modify this
-Agreement. The Eclipse Foundation is the initial Agreement Steward. The
-Eclipse Foundation may assign the responsibility to serve as the Agreement
-Steward to a suitable separate entity. Each new version of the Agreement will
-be given a distinguishing version number. The Program (including
-Contributions) may always be distributed subject to the version of the
-Agreement under which it was received. In addition, after a new version of the
-Agreement is published, Contributor may elect to distribute the Program
-(including its Contributions) under the new version. Except as expressly
-stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
-licenses to the intellectual property of any Contributor under this Agreement,
-whether expressly, by implication, estoppel or otherwise. All rights in the
-Program not expressly granted under this Agreement are reserved.
-
-This Agreement is governed by the laws of the State of New York and the
-intellectual property laws of the United States of America. No party to this
-Agreement will bring a legal action under this Agreement more than one year
-after the cause of action arose. Each party waives its rights to a jury trial in
-any resulting litigation.
-
-
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

From a67272a0ad8b1138c61306a02563fc39a0c79101 Mon Sep 17 00:00:00 2001
From: lan <1728209643@qq.com>
Date: Thu, 24 Dec 2020 17:12:37 +0000
Subject: [PATCH 137/591] ZOOKEEPER-4033: Remove unnecessary judgment of null

Author: lan <1728209643@qq.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1562 from lanicc/ZOOKEEPER-4033
---
 .../zookeeper/server/quorum/QuorumPeerMain.java      | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 6e8f7b9fadc..5ed2d42863a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -150,7 +150,7 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
         }
 
         LOG.info("Starting quorum peer, myid=" + config.getServerId());
-        MetricsProvider metricsProvider;
+        final MetricsProvider metricsProvider;
         try {
             metricsProvider = MetricsProviderBootstrap.startMetricsProvider(
                 config.getMetricsProviderClassName(),
@@ -233,12 +233,10 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
             // warn, but generally this is ok
             LOG.warn("Quorum Peer interrupted", e);
         } finally {
-            if (metricsProvider != null) {
-                try {
-                    metricsProvider.stop();
-                } catch (Throwable error) {
-                    LOG.warn("Error while stopping metrics", error);
-                }
+            try {
+                metricsProvider.stop();
+            } catch (Throwable error) {
+                LOG.warn("Error while stopping metrics", error);
             }
         }
     }

From 701e134dfba721356deac1a20aa80e94ec80484a Mon Sep 17 00:00:00 2001
From: odidev <odidev@puresoftware.com>
Date: Thu, 31 Dec 2020 09:46:09 +0100
Subject: [PATCH 138/591] ZOOKEEPER-3919: Added ARM64 support to Travis-CI

1. Added ARM64 support with jdk 11
2. Installed maven if architecture is ARM64

Signed-off-by: odidev <odidevpuresoftware.com>

Author: odidev <odidev@puresoftware.com>

Reviewers: Enrico Olivelli<eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>, Christopher Tubbs, Martin Grigorov

Closes #1433 from odidev/zookeeper_ARM64
---
 .travis.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 8fbd9314369..4401b555ed0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,6 +6,9 @@ matrix:
       jdk: openjdk8
     - os: linux
       jdk: openjdk11
+    - os: linux
+      arch: arm64
+      jdk: openjdk11
     - os: linux
       arch: s390x
       jdk: openjdk11
@@ -25,6 +28,11 @@ addons:
     packages:
     - libcppunit-dev
 
+install:
+  - if [ "${TRAVIS_CPU_ARCH}" == "arm64" ]; then
+     sudo apt-get install maven;
+    fi
+
 script: mvn clean apache-rat:check verify -DskipTests spotbugs:check checkstyle:check -Pfull-build
 
 branches:

From b35f43627d45c9c70679b104ea24b1f8e3451789 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Tue, 5 Jan 2021 14:22:10 +0100
Subject: [PATCH 139/591] ZOOKEEPER-4030: Optionally canonicalize host names in
 quorum SASL authentication

Without the option provided by this changeset, it is not convenient to use `CNAME`s to reference servers in `server.x` configuration lines while using quorum Kerberos authentication, as "incorrect" principals are generated by default.

Setting `kerberos.canonicalizeHostNames=true` causes the quorum server to substitute the canonical host name for the one specified in the configuration.  This has an effect on principal generation, and on the filtering of authorization IDs from incoming connections.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1564 from ztzg/ZOOKEEPER-4030-quorum-sasl-auth-with-cnames
---
 .../main/resources/markdown/zookeeperAdmin.md |   8 ++
 .../zookeeper/server/quorum/QuorumPeer.java   |  96 ++++++++++++-----
 .../server/quorum/QuorumCanonicalizeTest.java | 102 ++++++++++++++++++
 3 files changed, 179 insertions(+), 27 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 7dc9063e8bb..129cf19beac 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1705,6 +1705,14 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (e.g. the zk/myhost@EXAMPLE.COM client principal will be authenticated in ZooKeeper as zk/myhost)
     Default: false
 
+* *kerberos.canonicalizeHostNames*
+    (Java system property: **zookeeper.kerberos.canonicalizeHostNames**)
+    **New in 3.7.0:**
+    Instructs ZooKeeper to canonicalize server host names extracted from *server.x* lines.
+    This allows using e.g. `CNAME` records to reference servers in configuration files, while still enabling SASL Kerberos authentication between quorum members.
+    It is essentially the quorum equivalent of the *zookeeper.sasl.client.canonicalize.hostname* property for clients.
+    The default value is **false** for backwards compatibility.
+
 * *multiAddress.enabled* :
     (Java system property: **zookeeper.multiAddress.enabled**)
     **New in 3.6.0:**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 15cb172e5f3..44c83a6c842 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -46,6 +46,7 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 import javax.security.sasl.SaslException;
@@ -115,6 +116,9 @@ public class QuorumPeer extends ZooKeeperThread implements QuorumStats.Provider
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumPeer.class);
 
+    public static final String CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES = "zookeeper.kerberos.canonicalizeHostNames";
+    public static final String CONFIG_DEFAULT_KERBEROS_CANONICALIZE_HOST_NAMES = "false";
+
     private QuorumBean jmxQuorumBean;
     LocalPeerBean jmxLocalPeerBean;
     private Map<Long, RemotePeerBean> jmxRemotePeerBean;
@@ -265,13 +269,39 @@ private LearnerType getType(String s) throws ConfigException {
             }
         }
 
+        public QuorumServer(long sid, String addressStr) throws ConfigException {
+            this(sid, addressStr, QuorumServer::getInetAddress);
+        }
+
+        QuorumServer(long sid, String addressStr, Function<InetSocketAddress, InetAddress> getInetAddress) throws ConfigException {
+            this.id = sid;
+            initializeWithAddressString(addressStr, getInetAddress);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, LearnerType type) {
+            this(id, addr, electionAddr, null, type);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr, LearnerType type) {
+            this.id = id;
+            if (addr != null) {
+                this.addr.addAddress(addr);
+            }
+            if (electionAddr != null) {
+                this.electionAddr.addAddress(electionAddr);
+            }
+            this.type = type;
+            this.clientAddr = clientAddr;
+
+            setMyAddrs();
+        }
+
         private static final String wrongFormat =
             " does not have the form server_config or server_config;client_config"
             + " where server_config is the pipe separated list of host:port:port or host:port:port:type"
             + " and client_config is port or host:port";
 
-        public QuorumServer(long sid, String addressStr) throws ConfigException {
-            this.id = sid;
+        private void initializeWithAddressString(String addressStr, Function<InetSocketAddress, InetAddress> getInetAddress) throws ConfigException {
             LearnerType newType = null;
             String[] serverClientParts = addressStr.split(";");
             String[] serverAddresses = serverClientParts[0].split("\\|");
@@ -283,9 +313,9 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
                 }
 
                 // is client_config a host:port or just a port
-                hostname = (clientParts.length == 2) ? clientParts[0] : "0.0.0.0";
+                String clientHostName = (clientParts.length == 2) ? clientParts[0] : "0.0.0.0";
                 try {
-                    clientAddr = new InetSocketAddress(hostname, Integer.parseInt(clientParts[clientParts.length - 1]));
+                    clientAddr = new InetSocketAddress(clientHostName, Integer.parseInt(clientParts[clientParts.length - 1]));
                 } catch (NumberFormatException e) {
                     throw new ConfigException("Address unresolved: " + hostname + ":" + clientParts[clientParts.length - 1]);
                 }
@@ -294,9 +324,14 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
             boolean multiAddressEnabled = Boolean.parseBoolean(
                 System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, QuorumPeer.CONFIG_DEFAULT_MULTI_ADDRESS_ENABLED));
             if (!multiAddressEnabled && serverAddresses.length > 1) {
-                throw new ConfigException("Multiple address feature is disabled, but multiple addresses were specified for sid " + sid);
+                throw new ConfigException("Multiple address feature is disabled, but multiple addresses were specified for sid " + this.id);
             }
 
+            boolean canonicalize = Boolean.parseBoolean(
+                System.getProperty(
+                    CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES,
+                    CONFIG_DEFAULT_KERBEROS_CANONICALIZE_HOST_NAMES));
+
             for (String serverAddress : serverAddresses) {
                 String serverParts[] = ConfigUtils.getHostAndPort(serverAddress);
                 if ((serverClientParts.length > 2) || (serverParts.length < 3)
@@ -304,25 +339,46 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
                     throw new ConfigException(addressStr + wrongFormat);
                 }
 
+                String serverHostName = serverParts[0];
+
                 // server_config should be either host:port:port or host:port:port:type
                 InetSocketAddress tempAddress;
                 InetSocketAddress tempElectionAddress;
                 try {
-                    tempAddress = new InetSocketAddress(serverParts[0], Integer.parseInt(serverParts[1]));
+                    tempAddress = new InetSocketAddress(serverHostName, Integer.parseInt(serverParts[1]));
                     addr.addAddress(tempAddress);
                 } catch (NumberFormatException e) {
-                    throw new ConfigException("Address unresolved: " + serverParts[0] + ":" + serverParts[1]);
+                    throw new ConfigException("Address unresolved: " + serverHostName + ":" + serverParts[1]);
                 }
                 try {
-                    tempElectionAddress = new InetSocketAddress(serverParts[0], Integer.parseInt(serverParts[2]));
+                    tempElectionAddress = new InetSocketAddress(serverHostName, Integer.parseInt(serverParts[2]));
                     electionAddr.addAddress(tempElectionAddress);
                 } catch (NumberFormatException e) {
-                    throw new ConfigException("Address unresolved: " + serverParts[0] + ":" + serverParts[2]);
+                    throw new ConfigException("Address unresolved: " + serverHostName + ":" + serverParts[2]);
                 }
 
                 if (tempAddress.getPort() == tempElectionAddress.getPort()) {
                     throw new ConfigException("Client and election port must be different! Please update the "
-                            + "configuration file on server." + sid);
+                            + "configuration file on server." + this.id);
+                }
+
+                if (canonicalize) {
+                    InetAddress ia = getInetAddress.apply(tempAddress);
+                    if (ia == null) {
+                        throw new ConfigException("Unable to canonicalize address " + serverHostName + " because it's not resolvable");
+                    }
+
+                    String canonicalHostName = ia.getCanonicalHostName();
+
+                    if (!canonicalHostName.equals(serverHostName)
+                        // Avoid using literal IP address when
+                        // security check fails
+                        && !canonicalHostName.equals(ia.getHostAddress())) {
+                        LOG.info("Host name for quorum server {} "
+                            + "canonicalized from {} to {}",
+                            this.id, serverHostName, canonicalHostName);
+                        serverHostName = canonicalHostName;
+                    }
                 }
 
                 if (serverParts.length == 4) {
@@ -336,7 +392,7 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
                     }
                 }
 
-                this.hostname = serverParts[0];
+                this.hostname = serverHostName;
             }
 
             if (newType != null) {
@@ -346,22 +402,8 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
             setMyAddrs();
         }
 
-        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, LearnerType type) {
-            this(id, addr, electionAddr, null, type);
-        }
-
-        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr, LearnerType type) {
-            this.id = id;
-            if (addr != null) {
-                this.addr.addAddress(addr);
-            }
-            if (electionAddr != null) {
-                this.electionAddr.addAddress(electionAddr);
-            }
-            this.type = type;
-            this.clientAddr = clientAddr;
-
-            setMyAddrs();
+        private static InetAddress getInetAddress(InetSocketAddress addr) {
+            return addr.getAddress();
         }
 
         private void setMyAddrs() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
new file mode 100644
index 00000000000..07445f3253f
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
@@ -0,0 +1,102 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+public class QuorumCanonicalizeTest extends ZKTestCase {
+
+    private static final InetSocketAddress SA_DONT_CARE = InetSocketAddress.createUnresolved("dont.care.invalid", 80);
+
+    private static final String ZK1_ALIAS = "zookeeper.invalid";
+    private static final String ZK1_FQDN = "zk1.invalid";
+    private static final String ZK1_IP = "169.254.0.42";
+    private static final InetAddress IA_MOCK_ZK1;
+
+    static {
+        InetAddress ia = mock(InetAddress.class);
+
+        when(ia.getCanonicalHostName()).thenReturn(ZK1_FQDN);
+
+        IA_MOCK_ZK1 = ia;
+    }
+
+    private static InetAddress getInetAddress(InetSocketAddress addr) {
+        if (addr.getHostName().equals(ZK1_ALIAS) || addr.getHostName().equals(ZK1_IP)) {
+            return IA_MOCK_ZK1;
+        }
+
+        return addr.getAddress();
+    };
+
+    @AfterEach
+    public void cleanUpEnvironment() {
+        System.clearProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES);
+    }
+
+    private QuorumPeer.QuorumServer createQuorumServer(String hostName) throws ConfigException {
+        return new QuorumPeer.QuorumServer(0, hostName + ":1234:5678", QuorumCanonicalizeTest::getInetAddress);
+    }
+
+    @Test
+    public void testQuorumDefaultCanonicalization() throws ConfigException {
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_ALIAS);
+
+        assertEquals(ZK1_ALIAS, qps.hostname,
+           "The host name has been \"changed\" (canonicalized?) despite default settings");
+    }
+
+    @Test
+    public void testQuorumNoCanonicalization() throws ConfigException {
+        System.setProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES, Boolean.FALSE.toString());
+
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_ALIAS);
+
+        assertEquals(ZK1_ALIAS, qps.hostname,
+           "The host name has been \"changed\" (canonicalized?) despite default settings");
+    }
+
+    @Test
+    public void testQuorumCanonicalization() throws ConfigException {
+        System.setProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES, Boolean.TRUE.toString());
+
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_ALIAS);
+
+        assertEquals(ZK1_FQDN, qps.hostname,
+            "The host name hasn't been correctly canonicalized");
+    }
+
+    @Test
+    public void testQuorumCanonicalizationFromIp() throws ConfigException {
+        System.setProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES, Boolean.TRUE.toString());
+
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_IP);
+
+        assertEquals(ZK1_FQDN, qps.hostname,
+            "The host name hasn't been correctly canonicalized");
+    }
+}

From 0a6b055356128483ad4166ca8cd5eff26f66fefb Mon Sep 17 00:00:00 2001
From: David Mollitor <dmollitor@apache.org>
Date: Tue, 5 Jan 2021 16:27:46 +0100
Subject: [PATCH 140/591] =?UTF-8?q?ZOOKEEPER-3671:=20Use=20ThreadLocalConc?=
 =?UTF-8?q?urrent=20to=20Replace=20Random=20and=20Math.=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…random

Author: David Mollitor <dmollitor@apache.org>

Reviewers: Andor Molnar <andor@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1199 from belugabehr/ZOOKEEPER-3671
---
 .../src/main/java/org/apache/zookeeper/ClientCnxn.java   | 5 ++---
 .../src/main/java/org/apache/zookeeper/Login.java        | 9 ++++-----
 .../org/apache/zookeeper/server/quorum/Observer.java     | 3 ++-
 .../server/util/RequestPathMetricsCollector.java         | 8 +++-----
 .../apache/zookeeper/server/watch/WatcherCleaner.java    | 5 ++---
 5 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index ecd2a0a9d09..1ff4512156b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -37,11 +37,11 @@
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Queue;
-import java.util.Random;
 import java.util.Set;
 import java.util.concurrent.CopyOnWriteArraySet;
 import java.util.concurrent.LinkedBlockingDeque;
 import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.ThreadLocalRandom;
 import javax.security.auth.login.LoginException;
 import javax.security.sasl.SaslException;
 import org.apache.jute.BinaryInputArchive;
@@ -869,7 +869,6 @@ class SendThread extends ZooKeeperThread {
 
         private long lastPingSentNs;
         private final ClientCnxnSocket clientCnxnSocket;
-        private Random r = new Random();
         private boolean isFirstConnect = true;
 
         void readResponse(ByteBuffer incomingBuffer) throws IOException {
@@ -1134,7 +1133,7 @@ private void startConnect(InetSocketAddress addr) throws IOException {
             saslLoginFailed = false;
             if (!isFirstConnect) {
                 try {
-                    Thread.sleep(r.nextInt(1000));
+                    Thread.sleep(ThreadLocalRandom.current().nextLong(1000));
                 } catch (InterruptedException e) {
                     LOG.warn("Unexpected exception", e);
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
index 83af16256a3..e74cddb05bd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
@@ -26,8 +26,8 @@
  */
 
 import java.util.Date;
-import java.util.Random;
 import java.util.Set;
+import java.util.concurrent.ThreadLocalRandom;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.kerberos.KerberosPrincipal;
@@ -70,9 +70,6 @@ public class Login {
     private boolean isKrbTicket = false;
     private boolean isUsingTicketCache = false;
 
-    /** Random number generator */
-    private static Random rng = new Random();
-
     private LoginContext login = null;
     private String loginContextName = null;
     private String principal = null;
@@ -341,7 +338,9 @@ private long getRefreshTime(KerberosTicket tgt) {
         long expires = tgt.getEndTime().getTime();
         LOG.info("TGT valid starting at:        {}", tgt.getStartTime().toString());
         LOG.info("TGT expires:                  {}", tgt.getEndTime().toString());
-        long proposedRefresh = start + (long) ((expires - start) * (TICKET_RENEW_WINDOW + (TICKET_RENEW_JITTER * rng.nextDouble())));
+        long proposedRefresh = start + (long) ((expires - start)
+            * (TICKET_RENEW_WINDOW + (TICKET_RENEW_JITTER
+                * ThreadLocalRandom.current().nextDouble())));
         if (proposedRefresh > expires) {
             // proposedRefresh is too far in the future: it's after ticket expires: simply return now.
             return Time.currentWallTime();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
index fbf1d55449c..55e273b0713 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
@@ -20,6 +20,7 @@
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import java.nio.ByteBuffer;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.atomic.AtomicReference;
 import org.apache.jute.Record;
 import org.apache.zookeeper.server.ObserverBean;
@@ -255,7 +256,7 @@ static void waitForObserverElectionDelay() {
 
     private static void waitForReconnectDelayHelper(long delayValueMs) {
         if (delayValueMs > 0) {
-            long randomDelay = (long) (delayValueMs * Math.random());
+            long randomDelay = ThreadLocalRandom.current().nextLong(delayValueMs);
             LOG.info("Waiting for {} ms before reconnecting with the leader", randomDelay);
             try {
                 Thread.sleep(randomDelay);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
index f3ec1fcea92..db6f8c56645 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
@@ -40,13 +40,13 @@
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.Map;
-import java.util.Random;
 import java.util.StringTokenizer;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.concurrent.Executors;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Consumer;
@@ -86,7 +86,6 @@ public class RequestPathMetricsCollector {
     private static final String PATH_SEPERATOR = "/";
 
     private final Map<String, PathStatsQueue> immutableRequestsMap;
-    private final Random sampler;
     private final ScheduledThreadPoolExecutor scheduledExecutor;
     private final boolean accurateMode;
 
@@ -96,7 +95,6 @@ public RequestPathMetricsCollector() {
 
     public RequestPathMetricsCollector(boolean accurateMode) {
         final Map<String, PathStatsQueue> requestsMap = new HashMap<>();
-        this.sampler = new Random(System.currentTimeMillis());
         this.accurateMode = accurateMode;
 
         REQUEST_PREPROCESS_TOPPATH_MAX = Integer.getInteger(PATH_STATS_TOP_PATH_MAX, 20);
@@ -204,7 +202,7 @@ public void registerRequest(int type, String path) {
         if (!enabled) {
             return;
         }
-        if (sampler.nextFloat() <= REQUEST_PREPROCESS_SAMPLE_RATE) {
+        if (ThreadLocalRandom.current().nextFloat() <= REQUEST_PREPROCESS_SAMPLE_RATE) {
             PathStatsQueue pathStatsQueue = immutableRequestsMap.get(Request.op2String(type));
             if (pathStatsQueue != null) {
                 pathStatsQueue.registerRequest(path);
@@ -357,7 +355,7 @@ public void start() {
                 return;
             }
             // Staggered start and then run every 15 seconds no matter what
-            int delay = sampler.nextInt(REQUEST_STATS_SLOT_DURATION);
+            int delay = ThreadLocalRandom.current().nextInt(REQUEST_STATS_SLOT_DURATION);
             // We need to use fixed Delay as the fixed rate will start the next one right
             // after the previous one finishes if it runs overtime instead of overlapping it.
             scheduledExecutor.scheduleWithFixedDelay(() -> {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
index 1f809cf4919..be98f988218 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server.watch;
 
 import java.util.HashSet;
-import java.util.Random;
 import java.util.Set;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.RateLogger;
@@ -50,7 +50,6 @@ public class WatcherCleaner extends Thread {
     private volatile boolean stopped = false;
     private final Object cleanEvent = new Object();
     private final Object processingCompletedEvent = new Object();
-    private final Random r = new Random(System.nanoTime());
     private final WorkerService cleaners;
 
     private final Set<Integer> deadWatchers;
@@ -133,7 +132,7 @@ public void run() {
                     // same time in the quorum
                     if (!stopped && deadWatchers.size() < watcherCleanThreshold) {
                         int maxWaitMs = (watcherCleanIntervalInSeconds
-                                         + r.nextInt(watcherCleanIntervalInSeconds / 2 + 1)) * 1000;
+                                         + ThreadLocalRandom.current().nextInt(watcherCleanIntervalInSeconds / 2 + 1)) * 1000;
                         cleanEvent.wait(maxWaitMs);
                     }
                 } catch (InterruptedException e) {

From 676d10b2fad97c69e4083619cb1db223ed1896a4 Mon Sep 17 00:00:00 2001
From: Edwin Hobor <edwin.hobor@microfocus.com>
Date: Wed, 6 Jan 2021 19:50:08 +0100
Subject: [PATCH 141/591] ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson
 databind to 2.10.5.1

Jackson reported a vulnerability under CVE-2020-25649. Upgrading to 2.10.5.1 will resolve the problem. See https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10#micro-patches for more details.

Author: Edwin Hobor <edwin.hobor@microfocus.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1572 from edwin092/ZOOKEEPER-4045
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 837dceff969..1c485d96f69 100755
--- a/pom.xml
+++ b/pom.xml
@@ -439,7 +439,7 @@
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>
     <jetty.version>9.4.35.v20201120</jetty.version>
-    <jackson.version>2.10.5</jackson.version>
+    <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>

From 4e82a8be889d91dde46a11b38c8a20e82f3220f2 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Thu, 7 Jan 2021 08:09:55 +0000
Subject: [PATCH 142/591] ZOOKEEPER-3264: [YCSB-binding] Add a benchmark tool
 for zookeeper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

### 1. Brief Introduction
At first, I want to implement this benchmark tool based on the JMH. However, its has the following drawbacks:

-  For this situation�I want to simulate 1000000 requests with 100 concurrency client threads,What the parameters/options of JMH(mode,fork,threads,measurementIterations,measurementBatchSize) should I set?

-  Based on JMH, it also needs or use great effort to write a satisfactory script/CLI.

Then, I want to implement the tool from scratch. Have to admit that: it's difficult to implement a tool as powerful as YCSB did.

Finally, the YCSB is our choice. Here are its introductions:
- [Home Page](https://github.com/brianfrankcooper/YCSB/blob/master/README.md)
- [YCSB Paper](https://www2.cs.duke.edu/courses/fall13/cps296.4/838-CloudPapers/ycsb.pdf) is one of the best materials(A Great Reading)

YCSB has the following pros:

  - It supports requests number and concurrency threads number that user appoints
  - It supports various workloads for different read/write/insert/scan request ratio
  - It supports different request distributions(uniform, zipfian, latest)
  - It can output the benchmark results to different report formats(e.g.: `hdrhistogram`)
  - It has abundant metrics: throughout, avg/min/max/percentile latency, etc.
  - It has a detailed benchmark usage documentation

### 2. Benchmark Report
Here is a [WIP Benchmark Report](https://docs.google.com/document/d/1_kGwnx5y7SYLSLtEPbkGJkrWbnsSftwNTvi8RCC9L7Y/edit?usp=sharing)
which tested on the standard cloud machines with release-3.6.1(still a very messy draft and lots of works to do in the future). Two conspicuous performance issues:

#### 2.1. Tail latency
The tail latency is sometimes up to 200 ms. we can observer long-fat tail. Look at [figure-1](https://issues.apache.org/jira/secure/attachment/13017005/bm-read-histogram.png) and [figure-2](https://issues.apache.org/jira/secure/attachment/13017004/bm-update-histogram.png). We demand a smoother latency curve. The potential causes:

- Java GC
- The commit algorithm which schedules read/write requests in the `CommitProcessor`. (Most likely place where significantly improves the performance)

#### 2.2. Connection numbers
When connection numbers >= 1000, the throughput and latency extremely degrade. Look at [figure-3](https://issues.apache.org/jira/secure/attachment/13017006/bm-clients.png).
Using the TCP connection can guarantee the message/packet order, but TCP connections
that one Linux VM could support/hold is limited. Perhaps based/focused on Netty, we can improve this issue further.

### 3. Related Works
3.1 [YCSB-PR-1327](https://github.com/brianfrankcooper/YCSB/pull/1327)

3.2 [ZooKeeper Watch Benchmark Tool](https://github.com/apache/zookeeper/pull/1406)

Author: maoling <maoling199210191@sina.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1558 from maoling/ZOOKEEPER-3264
---
 .../main/resources/markdown/zookeeperTools.md | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index 46b3ca5c878..ac0706d81fd 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -24,6 +24,10 @@ limitations under the License.
     * [zkTxnLogToolkit.sh](#zkTxnLogToolkit)
     * [zkSnapShotToolkit.sh](#zkSnapShotToolkit)
     * [zkSnapshotComparer.sh](#zkSnapshotComparer)
+
+* [Benchmark](#Benchmark)
+    * [YCSB](#YCSB)
+    * [zk-smoketest](#zk-smoketest)
     
 * [Testing](#Testing)
     * [Jepsen Test](#jepsen-test)
@@ -425,6 +429,99 @@ All layers compared.
 
 Or use `^c` to exit interactive mode anytime.
 
+
+<a name="Benchmark"></a>
+
+## Benchmark
+
+<a name="YCSB"></a>
+
+### YCSB
+
+#### Quick Start
+
+This section describes how to run YCSB on ZooKeeper.
+
+#### 1. Start ZooKeeper Server(s)
+
+#### 2. Install Java and Maven
+
+#### 3. Set Up YCSB
+
+Git clone YCSB and compile:
+
+    git clone http://github.com/brianfrankcooper/YCSB.git
+    # more details in the landing page for instructions on downloading YCSB(https://github.com/brianfrankcooper/YCSB#getting-started).
+    cd YCSB
+    mvn -pl site.ycsb:zookeeper-binding -am clean package -DskipTests
+
+#### 4. Provide ZooKeeper Connection Parameters
+
+Set connectString, sessionTimeout, watchFlag in the workload you plan to run.
+
+- `zookeeper.connectString`
+- `zookeeper.sessionTimeout`
+- `zookeeper.watchFlag`
+  * A parameter for enabling ZooKeeper's watch, optional values:true or false.the default value is false.
+  * This parameter cannot test the watch performance, but for testing what effect will take on the read/write requests when enabling the watch.
+
+      ```bash
+      ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p zookeeper.watchFlag=true
+      ```
+
+Or, you can set configs with the shell command, EG:
+
+    # create a /benchmark namespace for sake of cleaning up the workspace after test.
+    # e.g the CLI:create /benchmark
+    ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p zookeeper.sessionTimeout=30000
+
+#### 5. Load data and run tests
+
+Load the data:
+
+    # -p recordcount,the count of records/paths you want to insert
+    ./bin/ycsb load zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p recordcount=10000 > outputLoad.txt
+
+Run the workload test:
+
+    # YCSB workloadb is the most suitable workload for read-heavy workload for the ZooKeeper in the real world.
+
+    # -p fieldlength, test the length of value/data-content took effect on performance
+    ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p fieldlength=1000
+
+    # -p fieldcount
+    ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p fieldcount=20
+
+    # -p hdrhistogram.percentiles,show the hdrhistogram benchmark result
+    ./bin/ycsb run zookeeper -threads 1 -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p hdrhistogram.percentiles=10,25,50,75,90,95,99,99.9 -p histogram.buckets=500
+
+    # -threads: multi-clients test, increase the **maxClientCnxns** in the zoo.cfg to handle more connections.
+    ./bin/ycsb run zookeeper -threads 10 -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark
+
+    # show the timeseries benchmark result
+    ./bin/ycsb run zookeeper -threads 1 -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p measurementtype=timeseries -p timeseries.granularity=50
+
+    # cluster test
+    ./bin/ycsb run zookeeper -P workloads/workloadb -p zookeeper.connectString=192.168.10.43:2181,192.168.10.45:2181,192.168.10.27:2181/benchmark
+
+    # test leader's read/write performance by setting zookeeper.connectString to leader's(192.168.10.43:2181)
+    ./bin/ycsb run zookeeper -P workloads/workloadb -p zookeeper.connectString=192.168.10.43:2181/benchmark
+
+    # test for large znode(by default: jute.maxbuffer is 1048575 bytes/1 MB ). Notice:jute.maxbuffer should also be set the same value in all the zk servers.
+    ./bin/ycsb run zookeeper -jvm-args="-Djute.maxbuffer=4194304" -s -P workloads/workloadc -p zookeeper.connectString=127.0.0.1:2181/benchmark
+
+    # Cleaning up the workspace after finishing the benchmark.
+    # e.g the CLI:deleteall /benchmark
+
+
+<a name="zk-smoketest"></a>
+
+### zk-smoketest
+
+**zk-smoketest** provides a simple smoketest client for a ZooKeeper ensemble. Useful for verifying new, updated,
+existing installations. More details are [here](https://github.com/phunt/zk-smoketest).
+
+
 <a name="Testing"></a>
 
 ## Testing

From eeb053767c9e931ae72a2d8c59c0940da3da9679 Mon Sep 17 00:00:00 2001
From: okumin <git@okumin.com>
Date: Sun, 10 Jan 2021 18:50:44 +0000
Subject: [PATCH 143/591] ZOOKEEPER-4055: Dockerfile can't build Zookeeper C
 client library

https://issues.apache.org/jira/browse/ZOOKEEPER-4055

This PR would fix the build by installing `pkg-config` and enabling `PKG_CHECK_MODULES`.
https://github.com/apache/zookeeper/blob/4e82a8be889d91dde46a11b38c8a20e82f3220f2/zookeeper-client/zookeeper-client-c/acinclude.m4#L314-L327

Another approach is to use a maven image with old Debian but it's less reasonable for me.

Author: okumin <git@okumin.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1575 from okumin/ZOOKEEPER-4055
---
 dev/docker/Dockerfile | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/dev/docker/Dockerfile b/dev/docker/Dockerfile
index 8d148ee0bef..bd2977f7402 100644
--- a/dev/docker/Dockerfile
+++ b/dev/docker/Dockerfile
@@ -20,4 +20,15 @@
 FROM maven:3.6.3-jdk-8
 
 RUN apt-get update
-RUN apt-get install -y g++ cmake autoconf libcppunit-dev libtool openssl libssl-dev libsasl2-modules-gssapi-mit libsasl2-modules libsasl2-dev
+RUN apt-get install -y \
+  g++ \
+  cmake \
+  autoconf \
+  pkg-config \
+  libcppunit-dev \
+  libtool \
+  openssl \
+  libssl-dev \
+  libsasl2-modules-gssapi-mit \
+  libsasl2-modules \
+  libsasl2-dev

From b995c559e6a567deaeb5b87c136aaa97d574d8de Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 11 Jan 2021 12:02:19 +0100
Subject: [PATCH 144/591] ZOOKEEPER-4056: Update copyright notices from 2020 to
 2021

See ZOOKEEPER-3745 for previous iteration.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1577 from ztzg/ZOOKEEPER-4056-copyright-2021
---
 NOTICE.txt                                                      | 2 +-
 zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md      | 2 +-
 zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md  | 2 +-
 zookeeper-docs/src/main/resources/markdown/zookeeperTools.md    | 2 +-
 zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md | 2 +-
 zookeeper-server/src/main/resources/NOTICE.txt                  | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/NOTICE.txt b/NOTICE.txt
index 4c4f8b220fe..afff440c251 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2020 The Apache Software Foundation
+Copyright 2009-2021 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 94cfff9d832..205c3ba5f70 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index 108cfd535c1..83dfb6be0d9 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index ac0706d81fd..7e67db65f23 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
index 0b841c34c71..bd29ee6e15a 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/zookeeper-server/src/main/resources/NOTICE.txt b/zookeeper-server/src/main/resources/NOTICE.txt
index 4900830b30f..1b0fb951ccb 100644
--- a/zookeeper-server/src/main/resources/NOTICE.txt
+++ b/zookeeper-server/src/main/resources/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2020 The Apache Software Foundation
+Copyright 2009-2021 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

From 183e38308d985981a94af16663860d7649621702 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 13 Jan 2021 08:12:25 +0000
Subject: [PATCH 145/591] ZOOKEEPER-4048: Upgrade Mockito to 3.6.28 - allow
 builds on JDK16

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1573 from eolivelli/fix/ZOOKEEPER-4048
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 1c485d96f69..0dd3a60de33 100755
--- a/pom.xml
+++ b/pom.xml
@@ -434,7 +434,7 @@
     <junit.version>5.6.2</junit.version>
     <junit-platform.version>1.6.2</junit-platform.version>
     <log4j.version>1.2.17</log4j.version>
-    <mockito.version>2.28.2</mockito.version>
+    <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.50.Final</netty.version>

From 7fad7ea33365304f8c268279689a6cbeed6698bc Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Wed, 13 Jan 2021 08:25:51 +0000
Subject: [PATCH 146/591] ZOOKEEPER-3426: C client: Consider encoded length
 before completing handshake

Suhas Dantkale noticed that the C client, which uses non-blocking sockets, could end up reading only the first 40 bytes of a 41-byte connection response and concluding that its handshake was complete, leaving one byte in the pipe.

Similarly (though even less likely), the library could be left hanging waiting for a 41th byte after having received a fragmented 40-byte response from an old server.

This patch makes the logic resistant to fragmentation by considering the server-provided length encoded in the response packet.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Enrico Olivelli <eolivelli@apache.org>

Closes #1576 from ztzg/ZOOKEEPER-3426-c-client-short-handshake
---
 .../zookeeper-client-c/src/zookeeper.c        |  19 ++-
 .../tests/TestOperations.cc                   | 124 ++++++++++++++++++
 .../zookeeper-client-c/tests/ZKMocks.cc       |   6 +-
 .../zookeeper-client-c/tests/ZKMocks.h        |   3 +-
 4 files changed, 148 insertions(+), 4 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 2b881cb9fdd..b5d690f3515 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -1866,7 +1866,24 @@ static int recv_buffer(zhandle_t *zh, buffer_list_t *buff)
         /* dirty hack to make new client work against old server
          * old server sends 40 bytes to finish connection handshake,
          * while we're expecting 41 (1 byte for read-only mode data) */
-        if (buff == &zh->primer_buffer && rc == buff->len - 1) ++rc;
+        if (rc > 0 && buff == &zh->primer_buffer) {
+            /* primer_buffer's curr_offset starts at 4 (see prime_connection) */
+            int avail = buff->curr_offset - sizeof(buff->len) + rc;
+
+            /* exactly 40 bytes (out of 41 expected) collected? */
+            if (avail == buff->len - 1) {
+                int32_t reply_len;
+
+                /* extract length of ConnectResponse (+ 1-byte flag?) */
+                memcpy(&reply_len, buff->buffer, sizeof(reply_len));
+                reply_len = ntohl(reply_len);
+
+                /* if 1-byte flag was not sent, fake it (value 0) */
+                if ((int)(reply_len + sizeof(reply_len)) == buff->len - 1) {
+                    ++rc;
+                }
+            }
+        }
 
         switch(rc) {
         case 0:
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
index ed8e9f460ac..ddb9533e8ac 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
@@ -36,6 +36,10 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
     CPPUNIT_TEST(testCloseWhileInProgressFromCompletion);
     CPPUNIT_TEST(testCloseWhileMultiInProgressFromMain);
     CPPUNIT_TEST(testCloseWhileMultiInProgressFromCompletion);
+    CPPUNIT_TEST(testConnectResponseFull);
+    CPPUNIT_TEST(testConnectResponseNoReadOnlyFlag);
+    CPPUNIT_TEST(testConnectResponseSplitAtReadOnlyFlag);
+    CPPUNIT_TEST(testConnectResponseNoReadOnlyFlagSplit);
 #else    
     CPPUNIT_TEST(testAsyncWatcher1);
     CPPUNIT_TEST(testAsyncGetOperation);
@@ -710,6 +714,126 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL((int)ZCLOSING,res2.rc_);
     }
 
+    void testConnectResponseFull()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(41));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData;
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
+    void testConnectResponseNoReadOnlyFlag()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+
+        hsResponse.omitReadOnly = true;
+
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(40));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData;
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
+    void testConnectResponseSplitAtReadOnlyFlag()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(41));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(0, 40);
+        rc = zookeeper_process(zh, interest);
+        // Response not complete.
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZNOTHING), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_ASSOCIATING_STATE, static_cast<int>(zh->state));
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(40);
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
+    void testConnectResponseNoReadOnlyFlagSplit()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+
+        hsResponse.omitReadOnly = true;
+
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(40));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(0, 20);
+        rc = zookeeper_process(zh, interest);
+        // Response not complete.
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZNOTHING), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_ASSOCIATING_STATE, static_cast<int>(zh->state));
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(20);
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
 #else   
     class TestGetDataJob: public TestJob{
     public:
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
index d26c295f24d..54c0819d9cf 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
@@ -344,9 +344,11 @@ string HandshakeResponse::toString() const {
     tmp=htonl(passwd_len);
     buf.append((char*)&tmp,sizeof(tmp));
     buf.append(passwd,sizeof(passwd));
-    buf.append(&readOnly,sizeof(readOnly));
+    if (!omitReadOnly) {
+        buf.append(&readOnly,sizeof(readOnly));
+    }
     // finally set the buffer length
-    tmp=htonl(buf.size()+sizeof(tmp));
+    tmp=htonl(buf.size());
     buf.insert(0,(char*)&tmp, sizeof(tmp));
     return buf;
 }
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
index 2717ded3087..48eddabbc75 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
@@ -305,7 +305,7 @@ class HandshakeResponse: public Response
 public:
     HandshakeResponse(int64_t sessId=1):
         protocolVersion(1),timeOut(10000),sessionId(sessId),
-        passwd_len(sizeof(passwd)),readOnly(0)
+        passwd_len(sizeof(passwd)),readOnly(0),omitReadOnly(false)
     {
         memcpy(passwd,"1234567890123456",sizeof(passwd));
     }
@@ -315,6 +315,7 @@ class HandshakeResponse: public Response
     int32_t passwd_len;
     char passwd[16];
     char readOnly;
+    bool omitReadOnly;
     virtual std::string toString() const ;
 };
 

From d7ed7f305661c08927eb954700f7141cd18d4ff9 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Wed, 13 Jan 2021 16:00:03 +0000
Subject: [PATCH 147/591] ZOOKEEPER-3973: Add GitHub Actions for CI

* Add GitHub Actions workflows
  * Add a CI workflow for PRs and branches
  * Add a manual workflow for custom builds
* Remove redundant builds from Travis config (leave only s390x)
* Update build status badges on README
  * Move inline links to bottom of the Markdown page for readability
  * Other: normalize URLs by using https and removing trailing slashes
    and unnecessary trailing .html, and fix syntax for section header
* Remove extraneous unactivated configuration from pom.xml files
  (and update an XML comment to remove an extra confusing backslash)
* Add ability to disable cppunit tests independently of surefire tests
* Build only selected tests in CI workflow for now

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1508 from ctubbsii/ZOOKEEPER-3973-github-actions
---
 .github/workflows/ci.yaml                   | 88 +++++++++++++++++++++
 .github/workflows/manual.yaml               | 85 ++++++++++++++++++++
 .travis.yml                                 |  7 +-
 README.md                                   | 17 ++--
 pom.xml                                     | 12 +--
 zookeeper-client/zookeeper-client-c/pom.xml | 79 +++++++++++-------
 zookeeper-contrib/pom.xml                   | 24 ------
 7 files changed, 238 insertions(+), 74 deletions(-)
 create mode 100644 .github/workflows/ci.yaml
 create mode 100644 .github/workflows/manual.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 00000000000..0b578f981d3
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,88 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# This workflow will build a Java project with Maven
+# See also:
+#   https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
+
+name: CI
+
+on:
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ '*' ]
+
+jobs:
+  mvn:
+    strategy:
+      matrix:
+        profile:
+          - name: 'full-build-jdk8'
+            jdk: 8
+            args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
+          - name: 'full-build-jdk11'
+            jdk: 11
+            args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
+          - name: 'full-build-java-tests'
+            jdk: 11
+            args: '-Pfull-build verify -Dsurefire-forkcount=1C -DskipCppUnit -Dsurefire.rerunFailingTestsCount=5'
+          - name: 'full-build-cppunit-tests'
+            jdk: 11
+            args: '-Pfull-build verify -Dtest=_ -DfailIfNoTests=false'
+      fail-fast: false
+    timeout-minutes: 360
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up JDK ${{ matrix.profile.jdk }}
+      uses: actions/setup-java@v1
+      with:
+        java-version: ${{ matrix.profile.jdk }}
+    - name: Cache local maven repository
+      uses: actions/cache@v2
+      with:
+        path: |
+          ~/.m2/repository/
+          !~/.m2/repository/org/apache/zookeeper
+        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+        restore-keys: ${{ runner.os }}-m2
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install C Dependencies
+      run: sudo apt-get install libcppunit-dev libsasl2-dev
+    - name: Build with Maven (${{ matrix.profile.name }})
+      run: mvn -B -V -e -ntp "-Dstyle.color=always" ${{ matrix.profile.args }}
+      env:
+        MAVEN_OPTS: -Djansi.force=true
+    - name: Upload unit test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v2
+      with:
+        name: surefire-reports-${{ matrix.profile.name }}
+        path: ./**/target/surefire-reports/
+        if-no-files-found: ignore
+    - name: Upload integration test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v2
+      with:
+        name: failsafe-reports-${{ matrix.profile.name }}
+        path: ./**/target/failsafe-reports/
+        if-no-files-found: ignore
+
diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml
new file mode 100644
index 00000000000..191a8b0cdd4
--- /dev/null
+++ b/.github/workflows/manual.yaml
@@ -0,0 +1,85 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# This workflow will build a Java project with Maven
+# See also:
+#   https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
+#   https://docs.github.com/en/actions/reference/events-that-trigger-workflows#manual-events
+
+name: Manual Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      buildRef:
+        description: Ref to build (commit, branch, or refs/pull/1234/head or refs/pull/1234/merge)
+        required: true
+        default: refs/pull/1234/merge
+      mvnOpts:
+        description: Maven options
+        required: true
+        default: --fail-at-end
+      goals:
+        description: Maven goals
+        required: true
+        default: -Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check javadoc:jar
+jobs:
+  mvn:
+    name: mvn (triggered by ${{ github.event.sender.login }})
+    timeout-minutes: 360
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        ref: ${{ github.event.inputs.buildRef }}
+    - name: Set up JDK 11
+      uses: actions/setup-java@v1
+      with:
+        java-version: 11
+    - name: Cache local maven repository
+      uses: actions/cache@v2
+      with:
+        path: |
+          ~/.m2/repository/
+          !~/.m2/repository/org/apache/zookeeper
+        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+        restore-keys: ${{ runner.os }}-m2
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install C Dependencies
+      run: sudo apt-get install libcppunit-dev libsasl2-dev
+    - name: Build with Maven
+      run: mvn -B -V -e -ntp "-Dstyle.color=always" ${{ github.event.inputs.mvnOpts }} ${{ github.event.inputs.goals }}
+      env:
+        MAVEN_OPTS: -Djansi.force=true
+    - name: Upload unit test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v2
+      with:
+        name: surefire-reports
+        path: ./**/target/surefire-reports/
+        if-no-files-found: ignore
+    - name: Upload integration test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v2
+      with:
+        name: failsafe-reports
+        path: ./**/target/failsafe-reports/
+        if-no-files-found: ignore
+
diff --git a/.travis.yml b/.travis.yml
index 4401b555ed0..81471d9ed04 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,10 +2,6 @@ language: java
 
 matrix:
   include:
-    - os: linux
-      jdk: openjdk8
-    - os: linux
-      jdk: openjdk11
     - os: linux
       arch: arm64
       jdk: openjdk11
@@ -38,5 +34,6 @@ script: mvn clean apache-rat:check verify -DskipTests spotbugs:check checkstyle:
 branches:
   only:
   - master
+  - branch-3.7
+  - branch-3.6
   - branch-3.5
-  - branch-3.4
diff --git a/README.md b/README.md
index 0f9c4b2af13..a616babfdff 100644
--- a/README.md
+++ b/README.md
@@ -1,16 +1,15 @@
-# Apache ZooKeeper [![Build Status](https://travis-ci.org/apache/zookeeper.svg?branch=master)](https://travis-ci.org/apache/zookeeper) [![Maven Central](https://img.shields.io/maven-central/v/org.apache.zookeeper/zookeeper)](https://zookeeper.apache.org/releases.html) [![License](https://img.shields.io/github/license/apache/zookeeper)](https://github.com/apache/zookeeper/blob/master/LICENSE.txt)
+# Apache ZooKeeper [![GitHub Actions CI][ciBadge]][ciLink] [![Travis CI][trBadge]][trLink] [![Maven Central][mcBadge]][mcLink] [![License][liBadge]][liLink]
 ![alt text](https://zookeeper.apache.org/images/zookeeper_small.gif "ZooKeeper")
 
 For the latest information about Apache ZooKeeper, please visit our website at:
 
-   http://zookeeper.apache.org/
+   https://zookeeper.apache.org
 
 and our wiki, at:
 
    https://cwiki.apache.org/confluence/display/ZOOKEEPER
 
----------------------------
-Packaging/release artifacts
+## Packaging/release artifacts
 
 Either downloaded from https://zookeeper.apache.org/releases.html or
 found in zookeeper-assembly/target directory after building the project with maven.
@@ -33,7 +32,7 @@ As of version 3.5.5, the parent, zookeeper and zookeeper-jute artifacts
 are deployed to the central repository after the release
 is voted on and approved by the Apache ZooKeeper PMC:
 
-  https://repo1.maven.org/maven2/org/apache/zookeeper/zookeeper/
+  https://repo1.maven.org/maven2/org/apache/zookeeper/zookeeper
 
 ## Java 8
 
@@ -44,3 +43,11 @@ recent release at u211 or above.
 We always welcome new contributors to the project! See [How to Contribute](https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute) for details on how to submit patch through pull request and our contribution workflow.
 
 
+[ciBadge]: https://github.com/apache/zookeeper/workflows/CI/badge.svg
+[ciLink]: https://github.com/apache/zookeeper/actions
+[liBadge]: https://img.shields.io/github/license/apache/zookeeper?color=282661
+[liLink]: https://github.com/apache/zookeeper/blob/master/LICENSE.txt
+[mcBadge]: https://img.shields.io/maven-central/v/org.apache.zookeeper/zookeeper
+[mcLink]: https://zookeeper.apache.org/releases
+[trBadge]: https://travis-ci.org/apache/zookeeper.svg?branch=master
+[trLink]: https://travis-ci.org/apache/zookeeper
diff --git a/pom.xml b/pom.xml
index 0dd3a60de33..14116db39f8 100755
--- a/pom.xml
+++ b/pom.xml
@@ -30,7 +30,7 @@
   <groupId>org.apache.zookeeper</groupId>
   <artifactId>parent</artifactId>
   <packaging>pom</packaging>
-  <!-- to change version: mvn -\-batch-mode release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
+  <!-- to change version: mvn -B release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
   <version>3.7.0-SNAPSHOT</version>
   <name>Apache ZooKeeper</name>
   <description>
@@ -778,15 +778,6 @@
             <includeTestResources>false</includeTestResources>
             <includeTestSourceDirectory>true</includeTestSourceDirectory>
           </configuration>
-          <executions>
-            <execution>
-              <id>checkstyle</id>
-              <phase>validate</phase>
-              <goals>
-                <goal>check</goal>
-              </goals>
-            </execution>
-          </executions>
         </plugin>
         <!-- we don't need this plugin-->
         <plugin>
@@ -843,6 +834,7 @@
         <artifactId>maven-antrun-plugin</artifactId>
         <executions>
           <execution>
+            <id>set-hostname-property</id>
             <phase>validate</phase>
             <goals>
               <goal>run</goal>
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
index b66712dcd74..dd9c23f4d1b 100755
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -35,15 +35,6 @@
     <c-test-coverage-arg> </c-test-coverage-arg>
   </properties>
 
-  <profiles>
-    <profile>
-      <id>c-test-coverage</id>
-      <properties>
-        <c-test-coverage-arg>--enable-gcov</c-test-coverage-arg>
-      </properties>
-    </profile>
-  </profiles>
-
   <build>
     <plugins>
         <plugin>
@@ -125,27 +116,6 @@
               <goal>run</goal>
             </goals>
           </execution>
-          <execution>
-            <id>test-cppunit</id>
-            <phase>test</phase>
-            <configuration>
-              <!-- do not run cpp tests if tests are globally skipped -->
-              <skip>${skipTests}</skip>
-              <target>
-                <exec dir="${basedir}/target/c" executable="make" failonerror="true">
-                  <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
-                  <env key="PATH" path="${env.PATH};${basedir};" />
-                  <env key="CALLER" value="ANT" />
-                  <env key="CLOVER_HOME" value="${basedir}/../../zookeeper-server/target" />
-                  <env key="base_dir" value="${basedir}/../.." />
-                  <arg line="check" />
-                </exec>
-              </target>
-            </configuration>
-            <goals>
-              <goal>run</goal>
-            </goals>
-          </execution>
           <execution>
             <id>replace-cclient-files-during-release</id>
             <phase>none</phase>
@@ -173,5 +143,54 @@
       </plugin>
     </plugins>
   </build>
+  <profiles>
+    <profile>
+      <id>c-test-coverage</id>
+      <properties>
+        <c-test-coverage-arg>--enable-gcov</c-test-coverage-arg>
+      </properties>
+    </profile>
+    <profile>
+      <!-- can be skipped by deactivating the profile with -P!cppunit (may need to escape or quote exclamation on command-line) -->
+      <id>cppunit</id>
+      <activation>
+        <property>
+          <!-- can also be skipped by -DskipCppUnit or with -DskipTests (see below) -->
+          <name>!skipCppUnit</name>
+        </property>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-antrun-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>test-cppunit</id>
+                <phase>test</phase>
+                <configuration>
+                  <!-- do not run cpp tests if tests are globally skipped -->
+                  <skip>${skipTests}</skip>
+                  <target>
+                    <exec dir="${basedir}/target/c" executable="make" failonerror="true">
+                      <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
+                      <env key="PATH" path="${env.PATH};${basedir};" />
+                      <env key="CALLER" value="ANT" />
+                      <env key="CLOVER_HOME" value="${basedir}/../../zookeeper-server/target" />
+                      <env key="base_dir" value="${basedir}/../.." />
+                      <arg line="check" />
+                    </exec>
+                  </target>
+                </configuration>
+                <goals>
+                  <goal>run</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
 
 </project>
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index 1d4cf74eca9..bffc113afc4 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -73,33 +73,9 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
-          <version>3.1.0</version>
-          <dependencies>
-            <dependency>
-              <groupId>com.puppycrawl.tools</groupId>
-              <artifactId>checkstyle</artifactId>
-              <version>${checkstyle.version}</version>
-            </dependency>
-          </dependencies>
           <configuration>
             <configLocation>checkstyle-simple.xml</configLocation>
-            <suppressionsLocation>checkstyleSuppressions.xml</suppressionsLocation>
-            <encoding>UTF-8</encoding>
-            <consoleOutput>true</consoleOutput>
-            <failOnViolation>true</failOnViolation>
-            <includeResources>false</includeResources>
-            <includeTestSourceDirectory>true</includeTestSourceDirectory>
-            <includeTestResources>false</includeTestResources>
           </configuration>
-          <executions>
-            <execution>
-              <id>checkstyle</id>
-              <phase>validate</phase>
-              <goals>
-                <goal>check</goal>
-              </goals>
-            </execution>
-          </executions>
         </plugin>
       </plugins>
     </pluginManagement>

From 9a9cb66d433126598afe23bc70c7146682541071 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Thu, 14 Jan 2021 18:26:44 +0000
Subject: [PATCH 148/591] [maven-release-plugin] prepare branch branch-3.7

---
 pom.xml                                                       | 2 +-
 zookeeper-compatibility-tests/pom.xml                         | 4 +---
 .../zookeeper-compatibility-tests-curator/pom.xml             | 4 +---
 3 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 14116db39f8..85fcd5dc49f 100755
--- a/pom.xml
+++ b/pom.xml
@@ -71,7 +71,7 @@
     <connection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf/zookeeper.git</url>
-    <tag>HEAD</tag>
+    <tag>branch-3.7</tag>
   </scm>
   <issueManagement>
     <system>JIRA</system>
diff --git a/zookeeper-compatibility-tests/pom.xml b/zookeeper-compatibility-tests/pom.xml
index f861196c622..69924b620ab 100644
--- a/zookeeper-compatibility-tests/pom.xml
+++ b/zookeeper-compatibility-tests/pom.xml
@@ -18,9 +18,7 @@
  * limitations under the License.
  */
 -->
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>parent</artifactId>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index e25463055ee..77c9e5b46cf 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -18,9 +18,7 @@
  * limitations under the License.
  */
 -->
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>zookeeper-compatibility-tests</artifactId>

From fe86ef3b1ebba33488b3426e04b3c4c5b75e2c53 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Thu, 14 Jan 2021 18:26:44 +0000
Subject: [PATCH 149/591] [maven-release-plugin] prepare for next development
 iteration

---
 pom.xml                                                       | 4 ++--
 zookeeper-assembly/pom.xml                                    | 2 +-
 zookeeper-client/pom.xml                                      | 2 +-
 zookeeper-client/zookeeper-client-c/pom.xml                   | 2 +-
 zookeeper-compatibility-tests/pom.xml                         | 2 +-
 .../zookeeper-compatibility-tests-curator/pom.xml             | 2 +-
 zookeeper-contrib/pom.xml                                     | 2 +-
 zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml            | 2 +-
 zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml          | 2 +-
 zookeeper-contrib/zookeeper-contrib-rest/pom.xml              | 2 +-
 zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml      | 2 +-
 zookeeper-docs/pom.xml                                        | 2 +-
 zookeeper-it/pom.xml                                          | 2 +-
 zookeeper-jute/pom.xml                                        | 2 +-
 zookeeper-metrics-providers/pom.xml                           | 2 +-
 .../zookeeper-prometheus-metrics/pom.xml                      | 2 +-
 zookeeper-recipes/pom.xml                                     | 2 +-
 zookeeper-recipes/zookeeper-recipes-election/pom.xml          | 2 +-
 zookeeper-recipes/zookeeper-recipes-lock/pom.xml              | 2 +-
 zookeeper-recipes/zookeeper-recipes-queue/pom.xml             | 2 +-
 zookeeper-server/pom.xml                                      | 2 +-
 21 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/pom.xml b/pom.xml
index 85fcd5dc49f..5d5080b7315 100755
--- a/pom.xml
+++ b/pom.xml
@@ -31,7 +31,7 @@
   <artifactId>parent</artifactId>
   <packaging>pom</packaging>
   <!-- to change version: mvn -B release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
-  <version>3.7.0-SNAPSHOT</version>
+  <version>3.8.0-SNAPSHOT</version>
   <name>Apache ZooKeeper</name>
   <description>
     ZooKeeper is a centralized service for maintaining configuration information, naming,
@@ -71,7 +71,7 @@
     <connection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf/zookeeper.git</url>
-    <tag>branch-3.7</tag>
+    <tag>HEAD</tag>
   </scm>
   <issueManagement>
     <system>JIRA</system>
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index 1a3998d4bdd..a2fb72a36be 100755
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-assembly</artifactId>
diff --git a/zookeeper-client/pom.xml b/zookeeper-client/pom.xml
index d42256c6155..302fcff29e1 100755
--- a/zookeeper-client/pom.xml
+++ b/zookeeper-client/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client</artifactId>
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
index dd9c23f4d1b..b19c47fd8e1 100755
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-client</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client-c</artifactId>
diff --git a/zookeeper-compatibility-tests/pom.xml b/zookeeper-compatibility-tests/pom.xml
index 69924b620ab..8ccddbb2d5e 100644
--- a/zookeeper-compatibility-tests/pom.xml
+++ b/zookeeper-compatibility-tests/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>parent</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.8.0-SNAPSHOT</version>
     </parent>
     <packaging>pom</packaging>
     <modelVersion>4.0.0</modelVersion>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index 77c9e5b46cf..18ede17ed32 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>zookeeper-compatibility-tests</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.8.0-SNAPSHOT</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index bffc113afc4..ca6047b7b46 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
index 2772b94d63a..b8d04f9c584 100755
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <groupId>org.apache.zookeeper</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
index 81e12c8264b..3c902f9f059 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-loggraph</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
index c75f012f5b1..3eae81106a0 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-rest</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index 04162cc073d..a7c4e40d77d 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-zooinspector</artifactId>
diff --git a/zookeeper-docs/pom.xml b/zookeeper-docs/pom.xml
index 75fd65a3f94..9a23faf2929 100644
--- a/zookeeper-docs/pom.xml
+++ b/zookeeper-docs/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-docs</artifactId>
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
index 2c381a6254e..64d7fca3cd9 100755
--- a/zookeeper-it/pom.xml
+++ b/zookeeper-it/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-it</artifactId>
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index 74eedb8448f..e6d4e6abeeb 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-jute</artifactId>
diff --git a/zookeeper-metrics-providers/pom.xml b/zookeeper-metrics-providers/pom.xml
index a9b18d98999..71661c63f59 100755
--- a/zookeeper-metrics-providers/pom.xml
+++ b/zookeeper-metrics-providers/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-metrics-providers</artifactId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index 857e3e502b7..df2c2147289 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-metrics-providers</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-prometheus-metrics</artifactId>
diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
index 2ab9d8eb629..fc5cd6872b6 100755
--- a/zookeeper-recipes/pom.xml
+++ b/zookeeper-recipes/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-election/pom.xml b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
index cc9728c0fb1..0b2b466e22c 100755
--- a/zookeeper-recipes/zookeeper-recipes-election/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-election</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
index 68dbec53485..fe625c6abfb 100755
--- a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-lock</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
index 918fb647132..5fe3eb961a4 100755
--- a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-queue</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 6e11b4d8164..90ee82760ee 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.8.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper</artifactId>

From 86fcb5a00fbe2756100d78fe8bb7bb5f0a730bc9 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Thu, 14 Jan 2021 18:32:08 +0000
Subject: [PATCH 150/591] Change version to 3.8.0 in C client

---
 zookeeper-client/zookeeper-client-c/CMakeLists.txt              | 2 +-
 zookeeper-client/zookeeper-client-c/configure.ac                | 2 +-
 zookeeper-client/zookeeper-client-c/include/zookeeper_version.h | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/CMakeLists.txt b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
index 8400c1094c7..ccfd7576caa 100644
--- a/zookeeper-client/zookeeper-client-c/CMakeLists.txt
+++ b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
@@ -16,7 +16,7 @@
 
 cmake_minimum_required(VERSION 3.5)
 
-project(zookeeper VERSION 3.7.0)
+project(zookeeper VERSION 3.8.0)
 set(email user@zookeeper.apache.org)
 set(description "zookeeper C client")
 
diff --git a/zookeeper-client/zookeeper-client-c/configure.ac b/zookeeper-client/zookeeper-client-c/configure.ac
index 8e24d651c1b..fe10af9f36a 100644
--- a/zookeeper-client/zookeeper-client-c/configure.ac
+++ b/zookeeper-client/zookeeper-client-c/configure.ac
@@ -3,7 +3,7 @@
 
 AC_PREREQ(2.59)
 
-AC_INIT([zookeeper C client],3.7.0,[user@zookeeper.apache.org],[zookeeper])
+AC_INIT([zookeeper C client],3.8.0,[user@zookeeper.apache.org],[zookeeper])
 AC_CONFIG_SRCDIR([src/zookeeper.c])
 
 # Save initial CFLAGS and CXXFLAGS values before AC_PROG_CC and AC_PROG_CXX
diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h b/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
index 9fa2bae3d2f..03d5928b388 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
@@ -22,7 +22,7 @@
 extern "C" {
 #endif
 
-#define ZOO_VERSION "3.7.0"
+#define ZOO_VERSION "3.8.0"
 
 #ifdef __cplusplus
 }

From e8dc2b3210b001094b6179e0deacdb2cebded31f Mon Sep 17 00:00:00 2001
From: lan <1728209643@qq.com>
Date: Sun, 17 Jan 2021 20:20:43 +0000
Subject: [PATCH 151/591] ZOOKEEPER-4058: Update checkstyle to the latest
 version 8.39
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1.update checkstyle to latest version 8.39
See [https://checkstyle.sourceforge.io/config_javadoc.html](https://checkstyle.sourceforge.io/config_javadoc.html)

- JavadocMethod: remove properties `allowMissingJavadoc,allowMissingThrowsTags,allowThrowsTagsForSubclasses,allowUndeclaredRTE`

- LineLength: change it's parent to Checker

2.update XML dtd: `checkstyle-strict.xml, checkstyle-simple.xml, checkstyleSuppressions.xml`

3.fix code style:
- `QuorumPeer.java, PemReader.java`.  Operators like + and ? appear at newlines rather than at the end of the previous line.
- license of `TestApacheCuratorCompatibility.java`. Checkstyle JavadocParagraph:`<p>` tag should be placed immediately before the first word.

Author: lan <1728209643@qq.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1579 from lanicc/ZOOKEEPER-4058
---
 checkstyle-simple.xml                         |  4 +-
 checkstyle-strict.xml                         | 56 +++++++++----------
 checkstyleSuppressions.xml                    |  5 +-
 pom.xml                                       |  4 +-
 .../TestApacheCuratorCompatibility.java       |  8 +--
 .../zookeeper/server/quorum/QuorumPeer.java   |  4 +-
 .../org/apache/zookeeper/util/PemReader.java  | 18 +++---
 7 files changed, 47 insertions(+), 52 deletions(-)

diff --git a/checkstyle-simple.xml b/checkstyle-simple.xml
index 204937026a8..004cd68e417 100644
--- a/checkstyle-simple.xml
+++ b/checkstyle-simple.xml
@@ -16,8 +16,8 @@
     limitations under the License.
 -->
 <!DOCTYPE module PUBLIC
-        "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
-        "http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
+        "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
+        "https://checkstyle.org/dtds/configuration_1_3.dtd">
 
 <!-- This is a checkstyle configuration file. For descriptions of
 what the following rules do, please see the checkstyle configuration
diff --git a/checkstyle-strict.xml b/checkstyle-strict.xml
index f4fa57ea8d9..4f2d55b103f 100644
--- a/checkstyle-strict.xml
+++ b/checkstyle-strict.xml
@@ -16,12 +16,12 @@
     limitations under the License.
 -->
 <!DOCTYPE module PUBLIC
-        "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
-        "http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
+        "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
+        "https://checkstyle.org/dtds/configuration_1_3.dtd">
 
 <!-- This is a checkstyle configuration file. For descriptions of
 what the following rules do, please see the checkstyle configuration
-page at http://checkstyle.sourceforge.net/config.html -->
+page at https://checkstyle.sourceforge.io/config.html -->
 
 <module name="Checker">
 
@@ -140,16 +140,12 @@ page at http://checkstyle.sourceforge.net/config.html -->
         -->
 
         <!-- Checks for Javadoc comments.                     -->
-        <!-- See http://checkstyle.sf.net/config_javadoc.html -->
+        <!-- See https://checkstyle.sourceforge.io/config_javadoc.html -->
         <module name="JavadocMethod">
             <property name="scope" value="protected"/>
             <property name="severity" value="error"/>
-            <property name="allowMissingJavadoc" value="true"/>
             <property name="allowMissingParamTags" value="true"/>
             <property name="allowMissingReturnTag" value="true"/>
-            <property name="allowMissingThrowsTags" value="true"/>
-            <property name="allowThrowsTagsForSubclasses" value="true"/>
-            <property name="allowUndeclaredRTE" value="true"/>
         </module>
 
         <!-- Check that paragraph tags are used correctly in Javadoc. -->
@@ -271,27 +267,6 @@ page at http://checkstyle.sourceforge.net/config.html -->
             <property name="severity" value="error"/>
         </module>
 
-        <!--
-
-        LENGTH and CODING CHECKS
-
-        -->
-
-        <module name="LineLength">
-            <!-- Checks if a line is too long. -->
-            <property name="max" value="120"/>
-            <property name="severity" value="error"/>
-
-            <!--
-              The default ignore pattern exempts the following elements:
-                - import statements
-                - long URLs inside comments
-            -->
-
-            <property name="ignorePattern"
-                      value="^(package .*;\s*)|(import .*;\s*)|( *\* .*https?://.*)$"/>
-        </module>
-
         <module name="LeftCurly">
             <!-- Checks for placement of the left curly brace ('{'). -->
             <property name="severity" value="error"/>
@@ -433,4 +408,25 @@ page at http://checkstyle.sourceforge.net/config.html -->
         </module>
 
     </module>
-</module>
\ No newline at end of file
+
+    <!--
+
+    LENGTH and CODING CHECKS
+
+    -->
+
+    <module name="LineLength">
+        <!-- Checks if a line is too long. -->
+        <property name="max" value="120"/>
+        <property name="severity" value="error"/>
+
+        <!--
+          The default ignore pattern exempts the following elements:
+            - import statements
+            - long URLs inside comments
+        -->
+
+        <property name="ignorePattern"
+                  value="^(package .*;\s*)|(import .*;\s*)|( *\* .*https?://.*)$"/>
+    </module>
+</module>
diff --git a/checkstyleSuppressions.xml b/checkstyleSuppressions.xml
index 0a270041419..eb23d475f86 100644
--- a/checkstyleSuppressions.xml
+++ b/checkstyleSuppressions.xml
@@ -13,9 +13,8 @@
   limitations under the License. See accompanying LICENSE file.
 -->
 <!DOCTYPE suppressions PUBLIC
-        "-//Puppy Crawl//DTD Suppressions 1.1//EN"
-        "http://www.puppycrawl.com/dtds/suppressions_1_1.dtd">
-
+        "-//Checkstyle//DTD SuppressionFilter Configuration 1.0//EN"
+        "https://checkstyle.org/dtds/suppressions_1_0.dtd">
 <suppressions>
     <!-- suppress all checks in the generated directories -->
     <suppress checks=".*" files=".+[\\/]classes[\\/].+\.java" />
diff --git a/pom.xml b/pom.xml
index 5d5080b7315..758852b8206 100755
--- a/pom.xml
+++ b/pom.xml
@@ -447,7 +447,7 @@
     <commons-collections.version>4.4</commons-collections.version>
     <dropwizard.version>4.1.12.1</dropwizard.version>
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
-    <checkstyle.version>8.17</checkstyle.version>
+    <checkstyle.version>8.39</checkstyle.version>
     <enforcer.version>3.0.0-M3</enforcer.version>
 
     <!-- parameters to pass to C client build -->
@@ -760,7 +760,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
-          <version>3.1.0</version>
+          <version>3.1.1</version>
           <dependencies>
             <dependency>
               <groupId>com.puppycrawl.tools</groupId>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
index fbb387601bd..d8111281b8f 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -6,9 +6,9 @@
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
- * <p>
- * http://www.apache.org/licenses/LICENSE-2.0
- * <p>
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 44c83a6c842..3102c6379ed 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -507,8 +507,8 @@ private List<InetSocketAddress> excludedSpecialAddresses(List<InetSocketAddress>
                 }
                 InetAddress inetaddr = addr.getAddress();
 
-                if (inetaddr == null || inetaddr.isAnyLocalAddress() || // wildCard addresses (0.0.0.0 or [::])
-                    inetaddr.isLoopbackAddress()) { // loopback address(localhost/127.0.0.1)
+                if (inetaddr == null || inetaddr.isAnyLocalAddress() // wildCard addresses (0.0.0.0 or [::])
+                    || inetaddr.isLoopbackAddress()) { // loopback address(localhost/127.0.0.1)
                     continue;
                 }
                 included.add(addr);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
index 9ab2241864b..dd5a1576401 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
@@ -67,21 +67,21 @@
 public final class PemReader {
 
     private static final Pattern CERT_PATTERN = Pattern.compile(
-        "-+BEGIN\\s+.*CERTIFICATE[^-]*-+(?:\\s|\\r|\\n)+" + // Header
-        "([a-z0-9+/=\\r\\n]+)" +                    // Base64 text
-        "-+END\\s+.*CERTIFICATE[^-]*-+",            // Footer
+        "-+BEGIN\\s+.*CERTIFICATE[^-]*-+(?:\\s|\\r|\\n)+" // Header
+        + "([a-z0-9+/=\\r\\n]+)"                     // Base64 text
+        + "-+END\\s+.*CERTIFICATE[^-]*-+",           // Footer
         CASE_INSENSITIVE);
 
     private static final Pattern PRIVATE_KEY_PATTERN = Pattern.compile(
-        "-+BEGIN\\s+.*PRIVATE\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" + // Header
-        "([a-z0-9+/=\\r\\n]+)" +                       // Base64 text
-        "-+END\\s+.*PRIVATE\\s+KEY[^-]*-+",            // Footer
+        "-+BEGIN\\s+.*PRIVATE\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" // Header
+        + "([a-z0-9+/=\\r\\n]+)"                       // Base64 text
+        + "-+END\\s+.*PRIVATE\\s+KEY[^-]*-+",            // Footer
         CASE_INSENSITIVE);
 
     private static final Pattern PUBLIC_KEY_PATTERN = Pattern.compile(
-        "-+BEGIN\\s+.*PUBLIC\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" + // Header
-        "([a-z0-9+/=\\r\\n]+)" +                      // Base64 text
-        "-+END\\s+.*PUBLIC\\s+KEY[^-]*-+",            // Footer
+        "-+BEGIN\\s+.*PUBLIC\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" // Header
+        + "([a-z0-9+/=\\r\\n]+)"                      // Base64 text
+        + "-+END\\s+.*PUBLIC\\s+KEY[^-]*-+",            // Footer
         CASE_INSENSITIVE);
 
     private PemReader() {

From 190a227aa9d4655ebfe6ba9f5c2da426da8c5d98 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Tue, 19 Jan 2021 08:05:37 +0000
Subject: [PATCH 152/591] ZOOKEEPER-3301: Enforce the quota limit

- Thanks for the original work from ZOOKEEPER-1383, ZOOKEEPER-2593, ZOOKEEPER-451, especially the work from ZOOKEEPER-1383 contributed by [Thawan Kooburat](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=thawan)(I also sign off his name in the commit message) which also implemented the very valuable throughput quota.In the further, we will also do this.
- `zookeeper.enforeQuota`. When enabled and the client exceeds the total bytes or children count hard quota under a znode, the server will reject the request and reply the client a `QuotaExceededException` by force. The default value is: false.
- the checkQuota involves the `create()` and `setData()` api, not including the `delete()`.
- When users set the quota which's less than the existing stats, we give a thoughtful warning info.
- the following code in the StatsTrack has a bad augmentability:

  >             if (split.length != 2) {
  >                 throw new IllegalArgumentException("invalid string " + stats);
  >             }

   we do a trick to solve it for the expansibility, but we will get a little strange quota info(`Output quota for /c2 count=-1,bytes=-1=;byteHardLimit=-1;countHardLimit=5`) when using `listquota`. some UTs has covered it.
- the logic about `checkQuota` should be put in the `PrepRequestProcessor`, other than `DataTree`.
  we will get the following two negative effects if putting `checkQuota` in the `DataTree`:
  - 1. When the write request has exceeded the quota, the corresponding transaction log will load into disk successfully.It's not good, although it has any data inconsistency issue, because when the server restart, so long as the transaction logs are applied in the same order, the exceeded nodes will not be applied into the state machine.
  - 2. the client will be blocking and waiting for the response, because when throwing `QuotaExceededException` in the the `DataTree`, the` rc.stat` will be `null` and `BinaryOutputArchive#writeRecord` will throw `NPE`.
  - 3. Overall, the pre-check about the write request should be done in the `PrepRequestProcessor`(at least before `SyncRequestProcessor`)(Look at an example from `checkACL()`)
- more detail in the [ZOOKEEPER-3301](https://issues.apache.org/jira/browse/ZOOKEEPER-3301).
- [Added in 2020-02-25] use `RateLogger` to replace `LOG` to avoid quota exceed logs flooding the disk
- A `TODO` improvement is: only users have admin permission can write to `/zookeeper/quota`(just like `/zookeeper/config`) to avoid some users' misoperation

Author: maoling <maoling199210191@sina.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Damien Diederen <ddiederen@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>

Closes #934 from maoling/ZOOKEEPER-3301
---
 .../main/resources/markdown/zookeeperAdmin.md |   6 +
 .../main/resources/markdown/zookeeperCLI.md   |  37 +-
 .../resources/markdown/zookeeperQuotas.md     |   3 +
 .../org/apache/zookeeper/KeeperException.java |  19 +
 .../java/org/apache/zookeeper/Quotas.java     |  21 +-
 .../java/org/apache/zookeeper/StatsTrack.java | 171 ++++++--
 .../zookeeper/cli/CliWrapperException.java    |   2 +
 .../apache/zookeeper/cli/DelQuotaCommand.java | 100 +++--
 .../zookeeper/cli/ListQuotaCommand.java       |  37 +-
 .../apache/zookeeper/cli/SetQuotaCommand.java | 210 ++++++---
 .../apache/zookeeper/common/StringUtils.java  |  18 +
 .../org/apache/zookeeper/server/DataTree.java |  80 ++--
 .../server/PrepRequestProcessor.java          |   2 +
 .../zookeeper/server/ZooKeeperServer.java     | 131 ++++++
 .../apache/zookeeper/server/DataTreeTest.java |   4 +-
 .../zookeeper/test/EnforceQuotaTest.java      |  87 ++++
 .../zookeeper/test/QuorumQuotaTest.java       |  12 +-
 .../org/apache/zookeeper/test/QuotasTest.java |  50 +++
 .../apache/zookeeper/test/StatsTrackTest.java | 135 ++++++
 .../zookeeper/test/ZooKeeperQuotaTest.java    | 406 +++++++++++++++++-
 20 files changed, 1313 insertions(+), 218 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 129cf19beac..82bcd65664d 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -978,6 +978,12 @@ property, when available, is noted below.
     Does not affect the limit defined by *flushDelay*.
     Default is 1000.
 
+* *enforceQuota* :
+    (Java system property: **zookeeper.enforceQuota**)
+    **New in 3.7.0:**
+    Enforce the quota check. When enabled and the client exceeds the total bytes or children count hard quota under a znode, the server will reject the request and reply the client a `QuotaExceededException` by force.
+    The default value is: false. Exploring [quota feature](http://zookeeper.apache.org/doc/current/zookeeperQuotas.html) for more details.
+
 * *requestThrottleLimit* :
     (Java system property: **zookeeper.request_throttle_max_requests**)
     **New in 3.6.0:**
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 205c3ba5f70..8113e6c376a 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -42,7 +42,7 @@ ZooKeeper -server host:port cmd args
 	create [-s] [-e] [-c] [-t ttl] path [data] [acl]
 	delete [-v version] path
 	deleteall path
-	delquota [-n|-b] path
+	delquota [-n|-b|-N|-B] path
 	get [-s] [-w] path
 	getAcl [-s] path
 	getAllChildrenNumber path
@@ -57,7 +57,7 @@ ZooKeeper -server host:port cmd args
 	removewatches path [-c|-d|-a] [-l]
 	set [-s] [-v version] path data
 	setAcl [-s] [-v version] [-R] path acl
-	setquota -n|-b val path
+	setquota -n|-b|-N|-B val path
 	stat [-w] path
 	sync path
 	version
@@ -187,6 +187,11 @@ Delete the quota under a path
 [zkshell: 2] listquota /quota_test
 	absolute path is /zookeeper/quota/quota_test/zookeeper_limits
 	quota for /quota_test does not exist.
+[zkshell: 3] delquota -n /c1
+[zkshell: 4] delquota -N /c2
+[zkshell: 5] delquota -b /c3
+[zkshell: 6] delquota -B /c4
+
 ```
 ## get
 Get the data of the specific path
@@ -281,10 +286,10 @@ Showing the history about the recent 11 commands that you have executed
 Listing the quota of one path
 
 ```bash
-[zkshell: 1] listquota /quota_test
-	absolute path is /zookeeper/quota/quota_test/zookeeper_limits
-	Output quota for /quota_test count=2,bytes=-1
-	Output stat for /quota_test count=4,bytes=0
+[zkshell: 1] listquota /c1
+             absolute path is /zookeeper/quota/c1/zookeeper_limits
+             Output quota for /c1 count=-1,bytes=-1=;byteHardLimit=-1;countHardLimit=2
+             Output stat for /c1 count=4,bytes=0
 ```
 
 ## ls
@@ -497,6 +502,26 @@ Set the quota in one path.
 [zkshell: 23] set /brokers "I_love_zookeeper"
 # Notice:don't have a hard constraint,just log the warning info
 	WARN  [CommitProcWorkThread-7:DataTree@379] - Quota exceeded: /brokers bytes=4206 limit=5
+
+# -N count Hard quota
+[zkshell: 3] create /c1
+Created /c1
+[zkshell: 4] setquota -N 2 /c1
+[zkshell: 5] listquota /c1
+absolute path is /zookeeper/quota/c1/zookeeper_limits
+Output quota for /c1 count=-1,bytes=-1=;byteHardLimit=-1;countHardLimit=2
+Output stat for /c1 count=2,bytes=0
+[zkshell: 6] create /c1/ch-3
+Count Quota has exceeded : /c1/ch-3
+
+# -B byte Hard quota
+[zkshell: 3] create /c2
+[zkshell: 4] setquota -B 4 /c2
+[zkshell: 5] set /c2 "foo"
+[zkshell: 6] set /c2 "foo-bar"
+Bytes Quota has exceeded : /c2
+[zkshell: 7] get /c2
+foo
 ```
 
 ## stat
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md b/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md
index 11226c3be33..72864c37e4f 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md
@@ -67,6 +67,9 @@ according to specific circumstances.
 
 - Users cannot set the quota on the path under **/zookeeper/quota**
 
+- The quota supports the soft and hard quota. The soft quota just logs the warning info when exceeding the quota, but the hard quota
+also throws a `QuotaExceededException`. When setting soft and hard quota on the same path, the hard quota has the priority.
+
 <a name="Listing+Quotas"></a>
 
 ### Listing Quotas
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index 9469d644c85..4590e0fd9a0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -148,6 +148,8 @@ public static KeeperException create(Code code) {
             return new SessionClosedRequireAuthException();
         case REQUESTTIMEOUT:
             return new RequestTimeoutException();
+        case QUOTAEXCEEDED:
+            return new QuotaExceededException();
         case THROTTLEDOP:
             return new ThrottledOpException();
         case OK:
@@ -408,6 +410,8 @@ public enum Code implements CodeDeprecated {
          *  required  authentication scheme or configured but authentication failed
          *  (i.e. wrong credential used.). */
         SESSIONCLOSEDREQUIRESASLAUTH(-124),
+        /** Exceeded the quota that was set on the path.*/
+        QUOTAEXCEEDED(-125),
         /** Operation was throttled and not executed at all. This error code indicates that zookeeper server
          *  is under heavy load and can't process incoming requests at full speed; please retry with back off.
          */
@@ -502,6 +506,8 @@ static String getCodeMessage(Code code) {
             return "Reconfig is disabled";
         case SESSIONCLOSEDREQUIRESASLAUTH:
             return "Session closed because client failed to authenticate";
+        case QUOTAEXCEEDED:
+            return "Quota has exceeded";
         case THROTTLEDOP:
             return "Op throttled due to high load";
         default:
@@ -949,6 +955,19 @@ public RequestTimeoutException() {
 
     }
 
+    /**
+     * @see Code#QUOTAEXCEEDED
+     */
+    @InterfaceAudience.Public
+    public static class QuotaExceededException extends KeeperException {
+        public QuotaExceededException() {
+            super(Code.QUOTAEXCEEDED);
+        }
+        public QuotaExceededException(String path) {
+            super(Code.QUOTAEXCEEDED, path);
+        }
+    }
+
     /**
      * @see Code#THROTTLEDOP
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java
index 031ff367ad6..eb83cfea547 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java
@@ -48,9 +48,19 @@ public class Quotas {
      * return the quota path associated with this
      * prefix
      * @param path the actual path in zookeeper.
-     * @return the limit quota path
+     * @return the quota path
      */
     public static String quotaPath(String path) {
+        return quotaZookeeper + path;
+    }
+
+    /**
+     * return the limit quota path associated with this
+     * prefix
+     * @param path the actual path in zookeeper.
+     * @return the limit quota path
+     */
+    public static String limitPath(String path) {
         return quotaZookeeper + path + "/" + limitNode;
     }
 
@@ -64,4 +74,13 @@ public static String statPath(String path) {
         return quotaZookeeper + path + "/" + statNode;
     }
 
+    /**
+     * return the real path associated with this
+     * quotaPath.
+     * @param quotaPath the quotaPath which's started with /zookeeper/quota
+     * @return the real path associated with this quotaPath.
+     */
+    public static String trimQuotaPath(String quotaPath) {
+        return quotaPath.substring(quotaZookeeper.length());
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java b/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
index 4bd88e337cc..aaea1d97a2c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
@@ -18,48 +18,70 @@
 
 package org.apache.zookeeper;
 
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Pattern;
+import org.apache.zookeeper.common.StringUtils;
+
 /**
  * a class that represents the stats associated with quotas
  */
 public class StatsTrack {
 
-    private int count;
-    private long bytes;
-    private String countStr = "count";
-    private String byteStr = "bytes";
+    private static final String countStr = "count";
+    private static final String countHardLimitStr = "countHardLimit";
+
+    private static final String byteStr = "bytes";
+    private static final String byteHardLimitStr = "byteHardLimit";
+
+    private final Map<String, Long> stats = new HashMap<>();
+    private static final Pattern PAIRS_SEPARATOR = Pattern.compile("[,;]+");
 
     /**
      * a default constructor for
      * stats
      */
     public StatsTrack() {
-        this(null);
+        this("");
     }
+
     /**
-     * the stat string should be of the form count=int,bytes=long
-     * if stats is called with null the count and bytes are initialized
-     * to -1.
-     * @param stats the stat string to be intialized with
+     *
+     * @param stat the byte[] stat to be initialized with
      */
-    public StatsTrack(String stats) {
-        if (stats == null) {
-            stats = "count=-1,bytes=-1";
+    public StatsTrack(byte[] stat) {
+        this(new String(stat, StandardCharsets.UTF_8));
+    }
+
+    /**
+     * the stat string should be of the form key1str=long,key2str=long,..
+     * where either , or ; are valid separators
+     * uninitialized values are returned as -1
+     * @param stat the stat string to be initialized with
+     */
+    public StatsTrack(String stat) {
+        this.stats.clear();
+        if (stat == null || stat.length() == 0) {
+            return;
         }
-        String[] split = stats.split(",");
-        if (split.length != 2) {
-            throw new IllegalArgumentException("invalid string " + stats);
+        String[] keyValuePairs = PAIRS_SEPARATOR.split(stat);
+        for (String keyValuePair : keyValuePairs) {
+            String[] kv = keyValuePair.split("=");
+            this.stats.put(kv[0], Long.parseLong(StringUtils.isEmpty(kv[1]) ? "-1" : kv[1]));
         }
-        count = Integer.parseInt(split[0].split("=")[1]);
-        bytes = Long.parseLong(split[1].split("=")[1]);
     }
 
+
     /**
      * get the count of nodes allowed as part of quota
      *
      * @return the count as part of this string
      */
-    public int getCount() {
-        return this.count;
+    public long getCount() {
+        return getValue(countStr);
     }
 
     /**
@@ -68,8 +90,26 @@ public int getCount() {
      * @param count
      *            the count to set with
      */
-    public void setCount(int count) {
-        this.count = count;
+    public void setCount(long count) {
+        setValue(countStr, count);
+    }
+
+    /**
+     * get the count of nodes allowed as part of quota (hard limit)
+     *
+     * @return the count as part of this string
+     */
+    public long getCountHardLimit() {
+        return getValue(countHardLimitStr);
+    }
+
+    /**
+     * set the count hard limit
+     *
+     * @param count the count limit to set
+     */
+    public void setCountHardLimit(long count) {
+        setValue(countHardLimitStr, count);
     }
 
     /**
@@ -78,24 +118,101 @@ public void setCount(int count) {
      * @return the bytes as part of this string
      */
     public long getBytes() {
-        return this.bytes;
+        return getValue(byteStr);
     }
 
     /**
-     * set teh bytes for this stat tracker.
+     * set the bytes for this stat tracker.
      *
      * @param bytes
      *            the bytes to set with
      */
     public void setBytes(long bytes) {
-        this.bytes = bytes;
+        setValue(byteStr, bytes);
+    }
+
+    /**
+     * get the count of bytes allowed as part of quota (hard limit)
+     *
+     * @return the bytes as part of this string
+     */
+    public long getByteHardLimit() {
+        return getValue(byteHardLimitStr);
+    }
+
+    /**
+     * set the byte hard limit
+     *
+     * @param bytes the byte limit to set
+     */
+    public void setByteHardLimit(long bytes) {
+        setValue(byteHardLimitStr, bytes);
+    }
+
+    /**
+     * get helper to lookup a given key
+     *
+     * @param key the key to lookup
+     * @return key's value or -1 if it doesn't exist
+     */
+    private long getValue(String key) {
+        Long val = this.stats.get(key);
+        return val == null ? -1 : val.longValue();
+    }
+
+    /**
+     * set helper to set the value for the specified key
+     *
+     * @param key   the key to set
+     * @param value the value to set
+     */
+    private void setValue(String key, long value) {
+        this.stats.put(key, value);
     }
 
-    @Override
     /*
      * returns the string that maps to this stat tracking.
-     */ public String toString() {
-        return countStr + "=" + count + "," + byteStr + "=" + bytes;
+     *
+     * Builds a string of the form
+     * "count=4,bytes=5=;countHardLimit=10;byteHardLimit=10"
+     *
+     * This string is slightly hacky to preserve compatibility with 3.4.3 and
+     * older parser. In particular, count must be first, bytes must be second,
+     * all new fields must use a separator that is not a "," (so, ";"), and the
+     * seemingly spurious "=" after the bytes field is essential to allowing
+     * it to be parseable by the old parsing code.
+     */
+    @Override
+    public String toString() {
+        StringBuilder buf = new StringBuilder();
+        ArrayList<String> keys = new ArrayList<>(stats.keySet());
+
+        // Special handling for count=,byte= to enforce them coming first
+        // for backwards compatibility
+        keys.remove(countStr);
+        keys.remove(byteStr);
+        buf.append(countStr);
+        buf.append("=");
+        buf.append(getCount());
+        buf.append(",");
+        buf.append(byteStr);
+        buf.append("=");
+        buf.append(getBytes());
+        if (!keys.isEmpty()) {
+            // Add extra = to trick old parsing code so it will ignore new flags
+            buf.append("=");
+            Collections.sort(keys);
+            for (String key : keys) {
+                buf.append(";");
+                buf.append(key);
+                buf.append("=");
+                buf.append(stats.get(key));
+            }
+        }
+        return buf.toString();
     }
 
+    public byte[] getStatsBytes() {
+        return toString().getBytes(StandardCharsets.UTF_8);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
index fcf46d91eb7..8095a40c2e0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
@@ -54,6 +54,8 @@ private static String getMessage(Throwable cause) {
                 return "No quorum of new config is connected and "
                        + "up-to-date with the leader of last commmitted config - try invoking reconfiguration after "
                        + "new servers are connected and synced";
+            } else if (keeperException instanceof KeeperException.QuotaExceededException) {
+                return "Quota has exceeded : " + keeperException.getPath();
             }
         }
         return cause.getMessage();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
index 70c0be31ced..d84c83028a1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
@@ -18,8 +18,6 @@
 
 package org.apache.zookeeper.cli;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
-import java.io.IOException;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
@@ -43,11 +41,14 @@ public class DelQuotaCommand extends CliCommand {
     private CommandLine cl;
 
     public DelQuotaCommand() {
-        super("delquota", "[-n|-b] path");
+        super("delquota", "[-n|-b|-N|-B] path");
 
         OptionGroup og1 = new OptionGroup();
-        og1.addOption(new Option("b", false, "bytes quota"));
-        og1.addOption(new Option("n", false, "num quota"));
+        og1.addOption(new Option("n", false, "num soft quota"));
+        og1.addOption(new Option("b", false, "bytes soft quota"));
+        og1.addOption(new Option("N", false, "num hard quota"));
+        og1.addOption(new Option("B", false, "bytes hard quota"));
+
         options.addOptionGroup(og1);
     }
 
@@ -69,22 +70,35 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
 
     @Override
     public boolean exec() throws CliException {
-        //if neither option -n or -b is specified, we delete
-        // the quota node for this node.
         String path = args[1];
+        // Use a StatsTrack object to pass in to delQuota which quotas
+        // to delete by setting them to 1 as a flag.
+        StatsTrack quota = new StatsTrack();
+        if (cl.hasOption("n")) {
+            quota.setCount(1);
+        }
+        if (cl.hasOption("b")) {
+            quota.setBytes(1);
+        }
+        if (cl.hasOption("N")) {
+            quota.setCountHardLimit(1);
+        }
+        if (cl.hasOption("B")) {
+            quota.setByteHardLimit(1);
+        }
+
+        boolean flagSet = (cl.hasOption("n") || cl.hasOption("N")
+                || cl.hasOption("b") || cl.hasOption("B"));
         try {
-            if (cl.hasOption("b")) {
-                delQuota(zk, path, true, false);
-            } else if (cl.hasOption("n")) {
-                delQuota(zk, path, false, true);
-            } else if (args.length == 2) {
-                // we don't have an option specified.
-                // just delete whole quota node
-                delQuota(zk, path, true, true);
-            }
-        } catch (KeeperException | InterruptedException | IOException ex) {
+            delQuota(zk, path, flagSet ? quota : null);
+        } catch (IllegalArgumentException ex) {
+            throw new MalformedPathException(ex.getMessage());
+        } catch (KeeperException.NoNodeException ne) {
+            err.println("quota for " + path + " does not exist.");
+        } catch (KeeperException | InterruptedException ex) {
             throw new CliWrapperException(ex);
         }
+
         return false;
     }
 
@@ -93,20 +107,16 @@ public boolean exec() throws CliException {
      *
      * @param zk the zookeeper client
      * @param path the path to delete quota for
-     * @param bytes true if number of bytes needs to be unset
-     * @param numNodes true if number of nodes needs to be unset
+     * @param quota the quotas to delete (set to 1), null to delete all
      * @return true if quota deletion is successful
      * @throws KeeperException
-     * @throws IOException
+     * @throws MalformedPathException
      * @throws InterruptedException
      */
-    public static boolean delQuota(
-        ZooKeeper zk,
-        String path,
-        boolean bytes,
-        boolean numNodes) throws KeeperException, IOException, InterruptedException, MalformedPathException {
-        String parentPath = Quotas.quotaZookeeper + path;
-        String quotaPath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+    public static boolean delQuota(ZooKeeper zk, String path, StatsTrack quota)
+            throws KeeperException, InterruptedException, MalformedPathException {
+        String parentPath = Quotas.quotaPath(path);
+        String quotaPath = Quotas.limitPath(path);
         if (zk.exists(quotaPath, false) == null) {
             System.out.println("Quota does not exist for " + path);
             return true;
@@ -117,17 +127,11 @@ public static boolean delQuota(
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException.NoNodeException ne) {
-            System.err.println("quota does not exist for " + path);
-            return true;
+            throw new KeeperException.NoNodeException(ne.getMessage());
         }
-        StatsTrack strack = new StatsTrack(new String(data, UTF_8));
-        if (bytes && !numNodes) {
-            strack.setBytes(-1L);
-            zk.setData(quotaPath, strack.toString().getBytes(UTF_8), -1);
-        } else if (!bytes && numNodes) {
-            strack.setCount(-1);
-            zk.setData(quotaPath, strack.toString().getBytes(UTF_8), -1);
-        } else if (bytes && numNodes) {
+        StatsTrack strack = new StatsTrack(data);
+
+        if (quota == null) {
             // delete till you can find a node with more than
             // one child
             List<String> children = zk.getChildren(parentPath, false);
@@ -137,7 +141,23 @@ public static boolean delQuota(
             }
             // cut the tree till their is more than one child
             trimProcQuotas(zk, parentPath);
+        } else {
+            if (quota.getCount() > 0) {
+                strack.setCount(-1);
+            }
+            if (quota.getBytes() > 0) {
+                strack.setBytes(-1L);
+            }
+            if (quota.getCountHardLimit() > 0) {
+                strack.setCountHardLimit(-1);
+            }
+            if (quota.getByteHardLimit() > 0) {
+                strack.setByteHardLimit(-1L);
+            }
+
+            zk.setData(quotaPath, strack.getStatsBytes(), -1);
         }
+
         return true;
     }
 
@@ -149,12 +169,10 @@ public static boolean delQuota(
      * unwanted parent in the path.
      * @return true if successful
      * @throws KeeperException
-     * @throws IOException
      * @throws InterruptedException
      */
-    private static boolean trimProcQuotas(
-        ZooKeeper zk,
-        String path) throws KeeperException, IOException, InterruptedException {
+    private static boolean trimProcQuotas(ZooKeeper zk, String path)
+            throws KeeperException, InterruptedException {
         if (Quotas.quotaZookeeper.equals(path)) {
             return true;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
index 4ae1d226f22..fe5fe6b88dd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
@@ -18,7 +18,8 @@
 
 package org.apache.zookeeper.cli;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
+import java.util.ArrayList;
+import java.util.List;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -26,6 +27,7 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 
 /**
@@ -60,16 +62,18 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     @Override
     public boolean exec() throws CliException {
         String path = args[1];
-        String absolutePath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+        String absolutePath = Quotas.limitPath(path);
         try {
             err.println("absolute path is " + absolutePath);
-            Stat stat = new Stat();
-            byte[] data = zk.getData(absolutePath, false, stat);
-            StatsTrack st = new StatsTrack(new String(data, UTF_8));
-            out.println("Output quota for " + path + " " + st);
-
-            data = zk.getData(Quotas.quotaZookeeper + path + "/" + Quotas.statNode, false, stat);
-            out.println("Output stat for " + path + " " + new StatsTrack(new String(data, UTF_8)));
+            List<StatsTrack> statsTracks = listQuota(zk, path);
+            for (int i = 0; i < statsTracks.size(); i++) {
+                StatsTrack st = statsTracks.get(i);
+                if (i == 0) {
+                    out.println("Output quota for " + path + " " + st.toString());
+                } else {
+                    out.println("Output stat for " + path + " " + st.toString());
+                }
+            }
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException.NoNodeException ne) {
@@ -81,4 +85,19 @@ public boolean exec() throws CliException {
         return false;
     }
 
+    // @VisibleForTesting
+    public static List<StatsTrack> listQuota(ZooKeeper zk, String path) throws KeeperException, InterruptedException {
+        List<StatsTrack> statsTracks = new ArrayList<>();
+        Stat stat = new Stat();
+        byte[] data = zk.getData(Quotas.limitPath(path), false, stat);
+        StatsTrack st = new StatsTrack(data);
+        statsTracks.add(st);
+
+        data = zk.getData(Quotas.statPath(path), false, stat);
+        st = new StatsTrack(data);
+        statsTracks.add(st);
+
+        return statsTracks;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
index f9c17f5ac32..f564398eb70 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.cli;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
@@ -49,11 +48,14 @@ public class SetQuotaCommand extends CliCommand {
     private CommandLine cl;
 
     public SetQuotaCommand() {
-        super("setquota", "-n|-b val path");
+        super("setquota", "-n|-b|-N|-B val path");
 
         OptionGroup og1 = new OptionGroup();
-        og1.addOption(new Option("b", true, "bytes quota"));
-        og1.addOption(new Option("n", true, "num quota"));
+        og1.addOption(new Option("n", true, "num soft quota"));
+        og1.addOption(new Option("b", true, "bytes soft quota"));
+        og1.addOption(new Option("N", true, "num hard quota"));
+        og1.addOption(new Option("B", true, "bytes hard quota"));
+
         og1.setRequired(true);
         options.addOptionGroup(og1);
     }
@@ -83,36 +85,95 @@ public boolean exec() throws CliException {
             return false;
         }
 
-        if (cl.hasOption("b")) {
-            // we are setting the bytes quota
-            long bytes = Long.parseLong(cl.getOptionValue("b"));
-            try {
-                createQuota(zk, path, bytes, -1);
-            } catch (KeeperException | InterruptedException | IllegalArgumentException ex) {
-                throw new CliWrapperException(ex);
-            }
-        } else if (cl.hasOption("n")) {
-            // we are setting the num quota
-            int numNodes = Integer.parseInt(cl.getOptionValue("n"));
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(-1);
+        quota.setBytes(-1L);
+        quota.setCountHardLimit(-1);
+        quota.setByteHardLimit(-1L);
+
+        if (!checkOptionValue(quota)) {
+            return false;
+        }
+
+        boolean flagSet = (cl.hasOption("n") || cl.hasOption("N")
+                || cl.hasOption("b") || cl.hasOption("B"));
+        if (flagSet) {
             try {
-                createQuota(zk, path, -1L, numNodes);
-            } catch (KeeperException | InterruptedException | IllegalArgumentException ex) {
+                createQuota(zk, path, quota);
+            } catch (IllegalArgumentException ex) {
+                throw new MalformedPathException(ex.getMessage());
+            } catch (KeeperException | InterruptedException ex) {
                 throw new CliWrapperException(ex);
             }
         } else {
-            throw new MalformedCommandException(getUsageStr());
+            err.println(getUsageStr());
         }
 
         return false;
     }
 
-    public static boolean createQuota(
-        ZooKeeper zk,
-        String path,
-        long bytes,
-        int numNodes) throws KeeperException, InterruptedException, IllegalArgumentException, MalformedPathException {
+    private boolean checkOptionValue(StatsTrack quota) {
+
+        try {
+            if (cl.hasOption("n")) {
+                // we are setting the num quota
+                int count = Integer.parseInt(cl.getOptionValue("n"));
+                if (count > 0) {
+                    quota.setCount(count);
+                } else {
+                    err.println("the num quota must be greater than zero");
+                    return false;
+                }
+            }
+            if (cl.hasOption("b")) {
+                // we are setting the bytes quota
+                long bytes = Long.parseLong(cl.getOptionValue("b"));
+                if (bytes >= 0) {
+                    quota.setBytes(bytes);
+                } else {
+                    err.println("the bytes quota must be greater than or equal to zero");
+                    return false;
+                }
+            }
+            if (cl.hasOption("N")) {
+                // we are setting the num hard quota
+                int count = Integer.parseInt(cl.getOptionValue("N"));
+                if (count > 0) {
+                    quota.setCountHardLimit(count);
+                } else {
+                    err.println("the num quota must be greater than zero");
+                    return false;
+                }
+            }
+            if (cl.hasOption("B")) {
+                // we are setting the byte hard quota
+                long bytes = Long.parseLong(cl.getOptionValue("B"));
+                if (bytes >= 0) {
+                    quota.setByteHardLimit(bytes);
+                } else {
+                    err.println("the bytes quota must be greater than or equal to zero");
+                    return false;
+                }
+            }
+        } catch (NumberFormatException e) {
+            err.println("NumberFormatException happens when parsing the option value");
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * this method creates a quota node for the path
+     * @param zk the ZooKeeper client
+     * @param path the path for which quota needs to be created
+     * @param quota the quotas
+     * @return true if its successful and false if not.
+     */
+    public static boolean createQuota(ZooKeeper zk, String path, StatsTrack quota)
+            throws KeeperException, InterruptedException, MalformedPathException {
         // check if the path exists. We cannot create
-        // quota for a path that already exists in zookeeper
+        // quota for a path that doesn't exist in zookeeper
         // for now.
         Stat initStat;
         try {
@@ -158,39 +219,77 @@ public static boolean createQuota(
         for (int i = 1; i < splits.length; i++) {
             sb.append("/").append(splits[i]);
             quotaPath = sb.toString();
-            try {
-                zk.create(quotaPath, null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            } catch (KeeperException.NodeExistsException ne) {
-                //do nothing
+            if (zk.exists(quotaPath, false) == null) {
+                try {
+                    zk.create(quotaPath, null, ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                            CreateMode.PERSISTENT);
+                } catch (KeeperException.NodeExistsException ne) {
+                    //do nothing
+                }
             }
         }
         String statPath = quotaPath + "/" + Quotas.statNode;
         quotaPath = quotaPath + "/" + Quotas.limitNode;
-        StatsTrack strack = new StatsTrack(null);
-        strack.setBytes(bytes);
-        strack.setCount(numNodes);
-        try {
-            zk.create(quotaPath, strack.toString().getBytes(UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            StatsTrack stats = new StatsTrack(null);
-            stats.setBytes(0L);
+        byte[] data;
+
+        if (zk.exists(quotaPath, false) == null) {
+            zk.create(quotaPath, quota.getStatsBytes(),
+                    ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            StatsTrack stats = new StatsTrack();
             stats.setCount(0);
-            zk.create(statPath, stats.toString().getBytes(UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        } catch (KeeperException.NodeExistsException ne) {
-            byte[] data = zk.getData(quotaPath, false, new Stat());
-            StatsTrack strackC = new StatsTrack(new String(data, UTF_8));
-            if (bytes != -1L) {
-                strackC.setBytes(bytes);
+            stats.setBytes(0L);
+
+            zk.create(statPath, stats.getStatsBytes(),
+                    ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            data = zk.getData(quotaPath, false, new Stat());
+            StatsTrack quotaStrack = new StatsTrack(data);
+
+            data = zk.getData(statPath, false, new Stat());
+            StatsTrack statStrack = new StatsTrack(data);
+            checkQuota(quotaStrack, statStrack);
+
+        } else {
+            data = zk.getData(quotaPath, false, new Stat());
+            StatsTrack quotaStrack = new StatsTrack(data);
+
+            if (quota.getCount() > -1) {
+                quotaStrack.setCount(quota.getCount());
+            }
+            if (quota.getBytes() > -1L) {
+                quotaStrack.setBytes(quota.getBytes());
+            }
+            if (quota.getCountHardLimit() > -1) {
+                quotaStrack.setCountHardLimit(quota.getCountHardLimit());
             }
-            if (numNodes != -1) {
-                strackC.setCount(numNodes);
+            if (quota.getByteHardLimit() > -1L) {
+                quotaStrack.setByteHardLimit(quota.getByteHardLimit());
             }
-            zk.setData(quotaPath, strackC.toString().getBytes(UTF_8), -1);
+
+            data = zk.getData(statPath, false, new Stat());
+            StatsTrack statStrack = new StatsTrack(data);
+            checkQuota(quotaStrack, statStrack);
+
+            zk.setData(quotaPath, quotaStrack.getStatsBytes(), -1);
         }
+
         return true;
     }
 
+    private static void checkQuota(StatsTrack quotaStrack, StatsTrack statStrack) {
+        if ((quotaStrack.getCount() > -1 && quotaStrack.getCount() < statStrack.getCount()) || (quotaStrack.getCountHardLimit() > -1
+                && quotaStrack.getCountHardLimit() < statStrack.getCount())) {
+            System.out.println("[Warning]: the count quota you create is less than the existing count:" + statStrack.getCount());
+        }
+        if ((quotaStrack.getBytes() > -1 && quotaStrack.getBytes() < statStrack.getBytes()) || (quotaStrack.getByteHardLimit() > -1
+                && quotaStrack.getByteHardLimit() < statStrack.getBytes())) {
+            System.out.println("[Warning]: the bytes quota you create is less than the existing bytes:" + statStrack.getBytes());
+        }
+    }
+
     private static void checkIfChildQuota(ZooKeeper zk, String path) throws KeeperException, InterruptedException {
-        String realPath = Quotas.quotaZookeeper + path;
+        String realPath = Quotas.quotaPath(path);
 
         try {
             ZKUtil.visitSubTreeDFS(zk, realPath, false, (rc, quotaPath, ctx, name) -> {
@@ -209,7 +308,7 @@ private static void checkIfChildQuota(ZooKeeper zk, String path) throws KeeperEx
                 }
                 for (String child : children) {
                     if (!quotaPath.equals(Quotas.quotaZookeeper + path) && Quotas.limitNode.equals(child)) {
-                        throw new IllegalArgumentException(path + " has a child " + quotaPath.substring(Quotas.quotaZookeeper.length()) + " which has a quota");
+                        throw new IllegalArgumentException(path + " has a child " + Quotas.trimQuotaPath(quotaPath) + " which has a quota");
                     }
                 }
             });
@@ -221,13 +320,13 @@ private static void checkIfChildQuota(ZooKeeper zk, String path) throws KeeperEx
     private static void checkIfParentQuota(ZooKeeper zk, String path) throws InterruptedException, KeeperException {
         final String[] splits = path.split("/");
         String quotaPath = Quotas.quotaZookeeper;
-        for (String str : splits) {
-            if (str.length() == 0) {
-                // this should only be for the beginning of the path
-                // i.e. "/..." - split(path)[0] is empty string before first '/'
-                continue;
-            }
-            quotaPath += "/" + str;
+
+        StringBuilder sb = new StringBuilder();
+        sb.append(quotaPath);
+        for (int i = 1; i < splits.length - 1; i++) {
+            sb.append("/");
+            sb.append(splits[i]);
+            quotaPath = sb.toString();
             List<String> children = null;
             try {
                 children = zk.getChildren(quotaPath, false);
@@ -239,11 +338,10 @@ private static void checkIfParentQuota(ZooKeeper zk, String path) throws Interru
                 return;
             }
             for (String child : children) {
-                if (!quotaPath.equals(Quotas.quotaZookeeper + path) && Quotas.limitNode.equals(child)) {
-                    throw new IllegalArgumentException(path + " has a parent " + quotaPath.substring(Quotas.quotaZookeeper.length()) + " which has a quota");
+                if (!quotaPath.equals(Quotas.quotaPath(path)) && Quotas.limitNode.equals(child)) {
+                    throw new IllegalArgumentException(path + " has a parent " + Quotas.trimQuotaPath(quotaPath) + " which has a quota");
                 }
             }
         }
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
index 8e89abe1b0b..77237433e49 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
@@ -74,4 +74,22 @@ public static boolean isBlank(String s) {
         return s == null || s.trim().isEmpty();
     }
 
+    /**
+     * <p>Checks if a String is empty ("") or null.</p>
+     *
+     * <pre>
+     * StringUtils.isEmpty(null)      = true
+     * StringUtils.isEmpty("")        = true
+     * StringUtils.isEmpty(" ")       = false
+     * StringUtils.isEmpty("bob")     = false
+     * StringUtils.isEmpty("  bob  ") = false
+     * </pre>
+     *
+     * @param str  the String to check, may be null
+     * @return <code>true</code> if the String is empty or null
+     */
+    public static boolean isEmpty(String str) {
+        return str == null || str.length() == 0;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index afb549fce27..7e2e843f520 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.EOFException;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -372,56 +371,32 @@ public static void copyStat(Stat from, Stat to) {
     }
 
     /**
-     * update the count/count of bytes of this stat datanode
+     * update the count/bytes of this stat data node
      *
      * @param lastPrefix
-     *            the path of the node that is quotaed.
+     *            the path of the node that has a quota.
      * @param bytesDiff
      *            the diff to be added to number of bytes
      * @param countDiff
      *            the diff to be added to the count
      */
-    public void updateCountBytes(String lastPrefix, long bytesDiff, int countDiff) {
-        String statNode = Quotas.statPath(lastPrefix);
-        DataNode node = nodes.get(statNode);
+    public void updateQuotaStat(String lastPrefix, long bytesDiff, int countDiff) {
 
-        StatsTrack updatedStat = null;
-        if (node == null) {
+        String statNodePath = Quotas.statPath(lastPrefix);
+        DataNode statNode = nodes.get(statNodePath);
+
+        StatsTrack updatedStat;
+        if (statNode == null) {
             // should not happen
-            LOG.error("Missing count node for stat {}", statNode);
+            LOG.error("Missing node for stat {}", statNodePath);
             return;
         }
-        synchronized (node) {
-            updatedStat = new StatsTrack(new String(node.data, UTF_8));
+        synchronized (statNode) {
+            updatedStat = new StatsTrack(statNode.data);
             updatedStat.setCount(updatedStat.getCount() + countDiff);
             updatedStat.setBytes(updatedStat.getBytes() + bytesDiff);
-            node.data = updatedStat.toString().getBytes(UTF_8);
-        }
-        // now check if the counts match the quota
-        String quotaNode = Quotas.quotaPath(lastPrefix);
-        node = nodes.get(quotaNode);
-        StatsTrack thisStats = null;
-        if (node == null) {
-            // should not happen
-            LOG.error("Missing count node for quota {}", quotaNode);
-            return;
-        }
-        synchronized (node) {
-            thisStats = new StatsTrack(new String(node.data, UTF_8));
-        }
-        if (thisStats.getCount() > -1 && (thisStats.getCount() < updatedStat.getCount())) {
-            LOG.warn(
-                "Quota exceeded: {} count={} limit={}",
-                lastPrefix,
-                updatedStat.getCount(),
-                thisStats.getCount());
-        }
-        if (thisStats.getBytes() > -1 && (thisStats.getBytes() < updatedStat.getBytes())) {
-            LOG.warn(
-                "Quota exceeded: {} bytes={} limit={}",
-                lastPrefix,
-                updatedStat.getBytes(),
-                thisStats.getBytes());
+
+            statNode.data = updatedStat.getStatsBytes();
         }
     }
 
@@ -537,18 +512,18 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
             if (Quotas.limitNode.equals(childName)) {
                 // this is the limit node
                 // get the parent and add it to the trie
-                pTrie.addPath(parentName.substring(quotaZookeeper.length()));
+                pTrie.addPath(Quotas.trimQuotaPath(parentName));
             }
             if (Quotas.statNode.equals(childName)) {
-                updateQuotaForPath(parentName.substring(quotaZookeeper.length()));
+                updateQuotaForPath(Quotas.trimQuotaPath(parentName));
             }
         }
-        // also check to update the quotas for this node
+
         String lastPrefix = getMaxPrefixWithQuota(path);
         long bytes = data == null ? 0 : data.length;
-        if (lastPrefix != null) {
-            // ok we have some match and need to update
-            updateCountBytes(lastPrefix, bytes, 1);
+        // also check to update the quotas for this node
+        if (lastPrefix != null) {    // ok we have some match and need to update
+            updateQuotaStat(lastPrefix, bytes, 1);
         }
         updateWriteStat(path, bytes);
         dataWatches.triggerWatch(path, Event.EventType.NodeCreated);
@@ -621,18 +596,18 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         if (parentName.startsWith(procZookeeper) && Quotas.limitNode.equals(childName)) {
             // delete the node in the trie.
             // we need to update the trie as well
-            pTrie.deletePath(parentName.substring(quotaZookeeper.length()));
+            pTrie.deletePath(Quotas.trimQuotaPath(parentName));
         }
 
         // also check to update the quotas for this node
         String lastPrefix = getMaxPrefixWithQuota(path);
         if (lastPrefix != null) {
             // ok we have some match and need to update
-            int bytes = 0;
+            long bytes = 0;
             synchronized (node) {
                 bytes = (node.data == null ? 0 : -(node.data.length));
             }
-            updateCountBytes(lastPrefix, bytes, -1);
+            updateQuotaStat(lastPrefix, bytes, -1);
         }
 
         updateWriteStat(path, 0L);
@@ -670,11 +645,14 @@ public Stat setData(String path, byte[] data, int version, long zxid, long time)
             n.copyStat(s);
             nodes.postChange(path, n);
         }
-        // now update if the path is in a quota subtree.
+
+        // first do a quota check if the path is in a quota subtree.
         String lastPrefix = getMaxPrefixWithQuota(path);
+        long bytesDiff = (data == null ? 0 : data.length) - (lastdata == null ? 0 : lastdata.length);
+        // now update if the path is in a quota subtree.
         long dataBytes = data == null ? 0 : data.length;
         if (lastPrefix != null) {
-            this.updateCountBytes(lastPrefix, dataBytes - (lastdata == null ? 0 : lastdata.length), 0);
+            updateQuotaStat(lastPrefix, bytesDiff, 0);
         }
         nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastdata));
 
@@ -1252,7 +1230,7 @@ private void updateQuotaForPath(String path) {
         StatsTrack strack = new StatsTrack();
         strack.setBytes(c.bytes);
         strack.setCount(c.count);
-        String statPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        String statPath = Quotas.statPath(path);
         DataNode node = getNode(statPath);
         // it should exist
         if (node == null) {
@@ -1261,7 +1239,7 @@ private void updateQuotaForPath(String path) {
         }
         synchronized (node) {
             nodes.preChange(statPath, node);
-            node.data = strack.toString().getBytes(UTF_8);
+            node.data = strack.getStatsBytes();
             nodes.postChange(statPath, node);
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 6eb7b96ec53..3e6d4794411 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -394,6 +394,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             validatePath(path, request.sessionId);
             nodeRecord = getRecordForPath(path);
             zks.checkACL(request.cnxn, nodeRecord.acl, ZooDefs.Perms.WRITE, request.authInfo, path, null);
+            zks.checkQuota(path, setDataRequest.getData(), OpCode.setData);
             int newVersion = checkAndIncVersion(nodeRecord.stat.getVersion(), setDataRequest.getVersion(), path);
             request.setTxn(new SetDataTxn(path, setDataRequest.getData(), newVersion));
             nodeRecord = nodeRecord.duplicate(request.getHdr().getZxid());
@@ -697,6 +698,7 @@ private void pRequest2TxnCreate(int type, Request request, Record record, boolea
             throw new KeeperException.NoChildrenForEphemeralsException(path);
         }
         int newCversion = parentRecord.stat.getCversion() + 1;
+        zks.checkQuota(path, data, OpCode.create);
         if (type == OpCode.createContainer) {
             request.setTxn(new CreateContainerTxn(path, data, listACL, newCversion));
         } else if (type == OpCode.createTTL) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 7ef687ed740..5c3f5f43d37 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -46,10 +46,13 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
+import org.apache.zookeeper.Quotas;
+import org.apache.zookeeper.StatsTrack;
 import org.apache.zookeeper.Version;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.ZookeeperBanner;
+import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
@@ -95,11 +98,13 @@
 public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
 
     protected static final Logger LOG;
+    private static final RateLogger RATE_LOGGER;
 
     public static final String GLOBAL_OUTSTANDING_LIMIT = "zookeeper.globalOutstandingLimit";
 
     public static final String ENABLE_EAGER_ACL_CHECK = "zookeeper.enableEagerACLCheck";
     public static final String SKIP_ACL = "zookeeper.skipACL";
+    public static final String ENFORCE_QUOTA = "zookeeper.enforceQuota";
 
     // When enabled, will check ACL constraints appertained to the requests first,
     // before sending the requests to the quorum.
@@ -107,6 +112,8 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
 
     static final boolean skipACL;
 
+    public static final boolean enforceQuota;
+
     public static final String SASL_SUPER_USER = "zookeeper.superUser";
 
     public static final String ALLOW_SASL_FAILED_CLIENTS = "zookeeper.allowSaslFailedClients";
@@ -121,6 +128,8 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
     static {
         LOG = LoggerFactory.getLogger(ZooKeeperServer.class);
 
+        RATE_LOGGER = new RateLogger(LOG);
+
         ZookeeperBanner.printBanner(LOG);
 
         Environment.logEnv("Server environment:", LOG);
@@ -133,6 +142,11 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
             LOG.info("{}==\"yes\", ACL checks will be skipped", SKIP_ACL);
         }
 
+        enforceQuota = Boolean.parseBoolean(System.getProperty(ENFORCE_QUOTA, "false"));
+        if (enforceQuota) {
+            LOG.info("{} = {}, Quota Enforce enables", ENFORCE_QUOTA, enforceQuota);
+        }
+
         digestEnabled = Boolean.parseBoolean(System.getProperty(ZOOKEEPER_DIGEST_ENABLED, "true"));
         LOG.info("{} = {}", ZOOKEEPER_DIGEST_ENABLED, digestEnabled);
 
@@ -2002,6 +2016,123 @@ public void checkACL(ServerCnxn cnxn, List<ACL> acl, int perm, List<Id> ids, Str
         throw new KeeperException.NoAuthException();
     }
 
+    /**
+     * check a path whether exceeded the quota.
+     *
+     * @param path
+     *            the path of the node
+     * @param data
+     *            the data of the path
+     * @param type
+     *            currently, create and setData need to check quota
+     */
+
+    public void checkQuota(String path, byte[] data, int type) throws KeeperException.QuotaExceededException {
+        if (!enforceQuota) {
+            return;
+        }
+        long dataBytes = (data == null) ? 0 : data.length;
+        ZKDatabase zkDatabase = getZKDatabase();
+        String lastPrefix = zkDatabase.getDataTree().getMaxPrefixWithQuota(path);
+        if (StringUtils.isEmpty(lastPrefix)) {
+            return;
+        }
+
+        switch (type) {
+            case OpCode.create:
+                checkQuota(lastPrefix, dataBytes, 1);
+                break;
+            case OpCode.setData:
+                DataNode node = zkDatabase.getDataTree().getNode(path);
+                byte[] lastData;
+                synchronized (node) {
+                    lastData = node.getData();
+                }
+                checkQuota(lastPrefix, dataBytes - (lastData == null ? 0 : lastData.length), 0);
+                break;
+             default:
+                 throw new IllegalArgumentException("Unsupported OpCode for checkQuota: " + type);
+        }
+    }
+
+    /**
+     * check a path whether exceeded the quota.
+     *
+     * @param lastPrefix
+                  the path of the node which has a quota.
+     * @param bytesDiff
+     *            the diff to be added to number of bytes
+     * @param countDiff
+     *            the diff to be added to the count
+     */
+    private void checkQuota(String lastPrefix, long bytesDiff, long countDiff)
+            throws KeeperException.QuotaExceededException {
+        LOG.debug("checkQuota: lastPrefix={}, bytesDiff={}, countDiff={}", lastPrefix, bytesDiff, countDiff);
+
+        // now check the quota we set
+        String limitNode = Quotas.limitPath(lastPrefix);
+        DataNode node = getZKDatabase().getNode(limitNode);
+        StatsTrack limitStats;
+        if (node == null) {
+            // should not happen
+            LOG.error("Missing limit node for quota {}", limitNode);
+            return;
+        }
+        synchronized (node) {
+            limitStats = new StatsTrack(node.data);
+        }
+        //check the quota
+        boolean checkCountQuota = countDiff != 0 && (limitStats.getCount() > -1 || limitStats.getCountHardLimit() > -1);
+        boolean checkByteQuota = bytesDiff != 0 && (limitStats.getBytes() > -1 || limitStats.getByteHardLimit() > -1);
+
+        if (!checkCountQuota && !checkByteQuota) {
+            return;
+        }
+
+        //check the statPath quota
+        String statNode = Quotas.statPath(lastPrefix);
+        node = getZKDatabase().getNode(statNode);
+
+        StatsTrack currentStats;
+        if (node == null) {
+            // should not happen
+            LOG.error("Missing node for stat {}", statNode);
+            return;
+        }
+        synchronized (node) {
+            currentStats = new StatsTrack(node.data);
+        }
+
+        //check the Count Quota
+        if (checkCountQuota) {
+            long newCount = currentStats.getCount() + countDiff;
+            boolean isCountHardLimit = limitStats.getCountHardLimit() > -1 ? true : false;
+            long countLimit = isCountHardLimit ? limitStats.getCountHardLimit() : limitStats.getCount();
+
+            if (newCount > countLimit) {
+                String msg = "Quota exceeded: " + lastPrefix + " [current count=" + newCount + ", " + (isCountHardLimit ? "hard" : "soft") + "CountLimit=" + countLimit + "]";
+                RATE_LOGGER.rateLimitLog(msg);
+                if (isCountHardLimit) {
+                    throw new KeeperException.QuotaExceededException(lastPrefix);
+                }
+            }
+        }
+
+        //check the Byte Quota
+        if (checkByteQuota) {
+            long newBytes = currentStats.getBytes() + bytesDiff;
+            boolean isByteHardLimit = limitStats.getByteHardLimit() > -1 ? true : false;
+            long byteLimit = isByteHardLimit ? limitStats.getByteHardLimit() : limitStats.getBytes();
+            if (newBytes > byteLimit) {
+                String msg = "Quota exceeded: " + lastPrefix + " [current bytes=" + newBytes + ", " + (isByteHardLimit ? "hard" : "soft") + "ByteLimit=" + byteLimit + "]";
+                RATE_LOGGER.rateLimitLog(msg);
+                if (isByteHardLimit) {
+                    throw new KeeperException.QuotaExceededException(lastPrefix);
+                }
+            }
+        }
+    }
+
     public static boolean isDigestEnabled() {
         return digestEnabled;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
index fe83b76d884..151e87343d0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
@@ -233,8 +233,8 @@ public void testPathTrieClearOnDeserialize() throws Exception {
         DataTree dserTree = new DataTree();
 
         dserTree.createNode("/bug", new byte[20], null, -1, 1, 1, 1);
-        dserTree.createNode(Quotas.quotaZookeeper + "/bug", null, null, -1, 1, 1, 1);
-        dserTree.createNode(Quotas.quotaPath("/bug"), new byte[20], null, -1, 1, 1, 1);
+        dserTree.createNode(Quotas.quotaPath("/bug"), null, null, -1, 1, 1, 1);
+        dserTree.createNode(Quotas.limitPath("/bug"), new byte[20], null, -1, 1, 1, 1);
         dserTree.createNode(Quotas.statPath("/bug"), new byte[20], null, -1, 1, 1, 1);
 
         //deserialize a DataTree; this should clear the old /bug nodes and pathTrie
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
new file mode 100644
index 00000000000..470ce39d97e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.Assert.fail;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.cli.SetQuotaCommand;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * An unit case when Enforce Quota disables by default
+ */
+public class EnforceQuotaTest extends ClientBase {
+
+    private ZooKeeper zk;
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        zk = createClient();
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        System.clearProperty(ZooKeeperServer.ENFORCE_QUOTA);
+        super.tearDown();
+        zk.close();
+    }
+
+    @Test
+    public void testSetQuotaDisableWhenExceedBytesHardQuota() throws Exception {
+        final String path = "/c1";
+        zk.create(path, "12345".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+        } catch (KeeperException.QuotaExceededException e) {
+            fail("should not throw Byte Quota Exceeded Exception when enforce quota disables");
+        }
+    }
+
+    @Test
+    public void testSetQuotaDisableWhenExceedCountHardQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        } catch (KeeperException.QuotaExceededException e) {
+            fail("should not throw Count Quota Exceeded Exception when enforce quota disables");
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
index 2eed9d3bf5a..ac6319be1bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
@@ -39,17 +39,21 @@ public void testQuotaWithQuorum() throws Exception {
         for (i = 0; i < 300; i++) {
             zk.create("/a/" + i, "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
-        SetQuotaCommand.createQuota(zk, "/a", 1000L, 5000);
-        String statPath = Quotas.quotaZookeeper + "/a" + "/" + Quotas.statNode;
+
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(1000);
+        quota.setBytes(5000);
+        SetQuotaCommand.createQuota(zk, "/a", quota);
+        String statPath = Quotas.statPath("/a");
         byte[] data = zk.getData(statPath, false, new Stat());
-        StatsTrack st = new StatsTrack(new String(data));
+        StatsTrack st = new StatsTrack(data);
         assertTrue(st.getBytes() == 1204L, "bytes are set");
         assertTrue(st.getCount() == 301, "num count is set");
         for (i = 300; i < 600; i++) {
             zk.create("/a/" + i, "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
         data = zk.getData(statPath, false, new Stat());
-        st = new StatsTrack(new String(data));
+        st = new StatsTrack(data);
         assertTrue(st.getBytes() == 2404L, "bytes are set");
         assertTrue(st.getCount() == 601, "num count is set");
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java
new file mode 100644
index 00000000000..b887e28fbaf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java
@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.Assert.assertEquals;
+import org.apache.zookeeper.Quotas;
+import org.junit.Test;
+
+public class QuotasTest {
+
+    @Test
+    public void testStatPath() {
+        assertEquals("/zookeeper/quota/foo/zookeeper_stats", Quotas.statPath("/foo"));
+        assertEquals("/zookeeper/quota/bar/zookeeper_stats", Quotas.statPath("/bar"));
+    }
+
+    @Test
+    public void testLimitPath() {
+        assertEquals("/zookeeper/quota/foo/zookeeper_limits", Quotas.limitPath("/foo"));
+        assertEquals("/zookeeper/quota/bar/zookeeper_limits", Quotas.limitPath("/bar"));
+    }
+
+    @Test
+    public void testQuotaPathPath() {
+        assertEquals("/zookeeper/quota/bar", Quotas.quotaPath("/bar"));
+        assertEquals("/zookeeper/quota/foo", Quotas.quotaPath("/foo"));
+    }
+
+    @Test
+    public void testTrimQuotaPath() {
+        assertEquals("/foo", Quotas.trimQuotaPath("/zookeeper/quota/foo"));
+        assertEquals("/bar", Quotas.trimQuotaPath("/zookeeper/quota/bar"));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
new file mode 100644
index 00000000000..978e629dae2
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
@@ -0,0 +1,135 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import org.apache.zookeeper.StatsTrack;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class StatsTrackTest {
+
+    public static class OldStatsTrack {
+        private int count;
+        private long bytes;
+        private String countStr = "count";
+        private String byteStr = "bytes";
+
+        /**
+         * a default constructor for
+         * stats
+         */
+        public OldStatsTrack() {
+            this(null);
+        }
+        /**
+         * the stat string should be of the form count=int,bytes=long
+         * if stats is called with null the count and bytes are initialized
+         * to -1.
+         * @param stats the stat string to be intialized with
+         */
+        public OldStatsTrack(String stats) {
+            if (stats == null) {
+                stats = "count=-1,bytes=-1";
+            }
+            String[] split = stats.split(",");
+            if (split.length != 2) {
+                throw new IllegalArgumentException("invalid string " + stats);
+            }
+            count = Integer.parseInt(split[0].split("=")[1]);
+            bytes = Long.parseLong(split[1].split("=")[1]);
+        }
+
+
+        /**
+         * get the count of nodes allowed as part of quota
+         *
+         * @return the count as part of this string
+         */
+        public int getCount() {
+            return this.count;
+        }
+
+        /**
+         * set the count for this stat tracker.
+         *
+         * @param count
+         *            the count to set with
+         */
+        public void setCount(int count) {
+            this.count = count;
+        }
+
+        /**
+         * get the count of bytes allowed as part of quota
+         *
+         * @return the bytes as part of this string
+         */
+        public long getBytes() {
+            return this.bytes;
+        }
+
+        /**
+         * set teh bytes for this stat tracker.
+         *
+         * @param bytes
+         *            the bytes to set with
+         */
+        public void setBytes(long bytes) {
+            this.bytes = bytes;
+        }
+
+        @Override
+        /*
+         * returns the string that maps to this stat tracking.
+         */
+        public String toString() {
+            return countStr + "=" + count + "," + byteStr + "=" + bytes;
+        }
+    }
+
+    @Test
+    public void testBackwardCompatibility() {
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(4);
+        quota.setCountHardLimit(4);
+        quota.setBytes(9L);
+        quota.setByteHardLimit(15L);
+        Assert.assertEquals("count=4,bytes=9=;byteHardLimit=15;countHardLimit=4", quota.toString());
+
+        OldStatsTrack ost = new OldStatsTrack(quota.toString());
+        Assert.assertTrue("bytes are set", ost.getBytes() == 9L);
+        Assert.assertTrue("num count is set", ost.getCount() == 4);
+        Assert.assertEquals("count=4,bytes=9", ost.toString());
+    }
+
+    @Test
+    public void testUpwardCompatibility() {
+        OldStatsTrack ost = new OldStatsTrack(null);
+        ost.setCount(2);
+        ost.setBytes(5);
+        Assert.assertEquals("count=2,bytes=5", ost.toString());
+
+        StatsTrack st = new StatsTrack(ost.toString());
+        Assert.assertEquals("count=2,bytes=5", st.toString());
+        Assert.assertEquals(5, st.getBytes());
+        Assert.assertEquals(2, st.getCount());
+        Assert.assertEquals(-1, st.getByteHardLimit());
+        Assert.assertEquals(-1, st.getCountHardLimit());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
index 99a595f42a1..67b524accef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
@@ -21,24 +21,49 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.util.List;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.KeeperException.QuotaExceededException;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.cli.DelQuotaCommand;
+import org.apache.zookeeper.cli.ListQuotaCommand;
 import org.apache.zookeeper.cli.MalformedPathException;
 import org.apache.zookeeper.cli.SetQuotaCommand;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.test.StatsTrackTest.OldStatsTrack;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 public class ZooKeeperQuotaTest extends ClientBase {
+    private ZooKeeper zk = null;
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        System.setProperty(ZooKeeperServer.ENFORCE_QUOTA, "true");
+        super.setUp();
+        zk = createClient();
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        System.clearProperty(ZooKeeperServer.ENFORCE_QUOTA);
+        super.tearDown();
+        zk.close();
+    }
 
     @Test
     public void testQuota() throws Exception {
-        final ZooKeeper zk = createClient();
+
         final String path = "/a/b/v";
         // making sure setdata works on /
         zk.setData("/", "some".getBytes(), -1);
@@ -49,18 +74,31 @@ public void testQuota() throws Exception {
         zk.create("/a/b/v", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         zk.create("/a/b/v/d", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        SetQuotaCommand.createQuota(zk, path, 5L, 10);
+
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(4);
+        quota.setCountHardLimit(4);
+        quota.setBytes(9L);
+        quota.setByteHardLimit(15L);
+        SetQuotaCommand.createQuota(zk, path, quota);
 
         // see if its set
-        String absolutePath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+        String absolutePath = Quotas.limitPath(path);
         byte[] data = zk.getData(absolutePath, false, new Stat());
-        StatsTrack st = new StatsTrack(new String(data));
-        assertTrue(st.getBytes() == 5L, "bytes are set");
-        assertTrue(st.getCount() == 10, "num count is set");
+        StatsTrack st = new StatsTrack(data);
+        assertTrue(st.getBytes() == 9L, "bytes are set");
+        assertTrue(st.getByteHardLimit() == 15L, "byte hard limit is set");
+        assertTrue(st.getCount() == 4, "num count is set");
+        assertTrue(st.getCountHardLimit() == 4, "count hard limit is set");
+
+        // check quota node readable by old servers
+        OldStatsTrack ost = new OldStatsTrack(new String(data));
+        assertTrue(ost.getBytes() == 9L, "bytes are set");
+        assertTrue(ost.getCount() == 4, "num count is set");
 
-        String statPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        String statPath = Quotas.statPath(path);
         byte[] qdata = zk.getData(statPath, false, new Stat());
-        StatsTrack qst = new StatsTrack(new String(qdata));
+        StatsTrack qst = new StatsTrack(qdata);
         assertTrue(qst.getBytes() == 8L, "bytes are set");
         assertTrue(qst.getCount() == 2, "count is set");
 
@@ -75,7 +113,6 @@ public void testQuota() throws Exception {
 
     @Test
     public void testSetQuota() throws IOException, InterruptedException, KeeperException, MalformedPathException {
-        final ZooKeeper zk = createClient();
 
         String path = "/c1";
         String nodeData = "foo";
@@ -83,18 +120,21 @@ public void testSetQuota() throws IOException, InterruptedException, KeeperExcep
 
         int count = 10;
         long bytes = 5L;
-        SetQuotaCommand.createQuota(zk, path, bytes, count);
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(count);
+        quota.setBytes(bytes);
+        SetQuotaCommand.createQuota(zk, path, quota);
 
         //check the limit
-        String absoluteLimitPath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+        String absoluteLimitPath = Quotas.limitPath(path);
         byte[] data = zk.getData(absoluteLimitPath, false, null);
-        StatsTrack st = new StatsTrack(new String(data));
+        StatsTrack st = new StatsTrack(data);
         assertEquals(bytes, st.getBytes());
         assertEquals(count, st.getCount());
         //check the stats
-        String absoluteStatPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        String absoluteStatPath = Quotas.statPath(path);
         data = zk.getData(absoluteStatPath, false, null);
-        st = new StatsTrack(new String(data));
+        st = new StatsTrack(data);
         assertEquals(nodeData.length(), st.getBytes());
         assertEquals(1, st.getCount());
 
@@ -103,9 +143,9 @@ public void testSetQuota() throws IOException, InterruptedException, KeeperExcep
         String nodeData2 = "bar";
         zk.create(path2, nodeData2.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        absoluteStatPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        absoluteStatPath = Quotas.statPath(path);
         data = zk.getData(absoluteStatPath, false, null);
-        st = new StatsTrack(new String(data));
+        st = new StatsTrack(data);
         //check the stats
         assertEquals(nodeData.length() + nodeData2.length(), st.getBytes());
         assertEquals(2, st.getCount());
@@ -113,7 +153,6 @@ public void testSetQuota() throws IOException, InterruptedException, KeeperExcep
 
     @Test
     public void testSetQuotaWhenSetQuotaOnParentOrChildPath() throws IOException, InterruptedException, KeeperException, MalformedPathException {
-        final ZooKeeper zk = createClient();
 
         zk.create("/c1", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/c1/c2", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -122,19 +161,344 @@ public void testSetQuotaWhenSetQuotaOnParentOrChildPath() throws IOException, In
         zk.create("/c1/c2/c3/c4/c5", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         //set the quota on the path:/c1/c2/c3
-        SetQuotaCommand.createQuota(zk, "/c1/c2/c3", 5L, 10);
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(5);
+        quota.setBytes(10);
+        SetQuotaCommand.createQuota(zk, "/c1/c2/c3", quota);
 
         try {
-            SetQuotaCommand.createQuota(zk, "/c1", 5L, 10);
+            SetQuotaCommand.createQuota(zk, "/c1", quota);
+            fail("should not set quota when child has a quota");
         } catch (IllegalArgumentException e) {
             assertEquals("/c1 has a child /c1/c2/c3 which has a quota", e.getMessage());
         }
 
         try {
-            SetQuotaCommand.createQuota(zk, "/c1/c2/c3/c4/c5", 5L, 10);
+            SetQuotaCommand.createQuota(zk, "/c1/c2/c3/c4/c5", quota);
+            fail("should not set quota when parent has a quota");
         } catch (IllegalArgumentException e) {
             assertEquals("/c1/c2/c3/c4/c5 has a parent /c1/c2/c3 which has a quota", e.getMessage());
         }
     }
 
-}
+    @Test
+    public void testSetQuotaWhenExceedBytesSoftQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setBytes(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        zk.setData(path, "12345".getBytes(), -1);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+        } catch (Exception e) {
+            fail("should set data which exceeds the soft byte quota");
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedBytesHardQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            fail("should not set data which exceeds the hard byte quota");
+        } catch (QuotaExceededException e) {
+           //expected
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedBytesHardQuotaExtend() throws Exception {
+
+        String path = "/c0";
+        zk.create(path, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int bytes = 100;
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(bytes);
+        SetQuotaCommand.createQuota(zk, path, st);
+        StringBuilder sb = new StringBuilder(path);
+        for (int i = 1; i <= bytes; i++) {
+            sb.append("/c" + i);
+            if (i == bytes) {
+                try {
+                    zk.create(sb.toString(), "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                    fail("should not set quota when exceeds hard bytes quota");
+                } catch (QuotaExceededException e) {
+                    //expected
+                }
+            } else {
+                zk.create(sb.toString(), "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenSetQuotaLessThanExistBytes() throws Exception {
+
+        String path = "/c0";
+        zk.create(path, "123456789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int bytes = 5;
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(bytes);
+        SetQuotaCommand.createQuota(zk, path, st);
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            fail("should not set quota when exceeds hard bytes quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenSetChildDataExceedBytesQuota() throws Exception {
+
+        final String path = "/test/quota";
+        zk.create("/test", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/test/quota", "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/test/quota/data", "56789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        StatsTrack quota = new StatsTrack();
+        quota.setByteHardLimit(10);
+        SetQuotaCommand.createQuota(zk, path, quota);
+        try {
+            zk.setData("/test/quota/data", "567891".getBytes(), -1);
+            fail("should not set data when exceed hard byte quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenCreateNodeExceedBytesQuota() throws Exception {
+
+        final String path = "/test/quota";
+        zk.create("/test", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/test/quota", "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        StatsTrack quota = new StatsTrack();
+        quota.setByteHardLimit(10);
+        SetQuotaCommand.createQuota(zk, path, quota);
+        try {
+            zk.create("/test/quota/data", "567891".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set data when exceed hard byte quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedCountSoftQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCount(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        } catch (QuotaExceededException e) {
+            fail("should set quota when exceeds soft count quota");
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedCountHardQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set quota when exceeds hard count quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedCountHardQuotaExtend() throws Exception {
+
+        String path = "/c0";
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 100;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        StringBuilder sb = new StringBuilder(path);
+        for (int i = 1; i <= count; i++) {
+            sb.append("/c" + i);
+            if (i == count) {
+                try {
+                    zk.create(sb.toString() , "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                    fail("should not set quota when exceeds hard count quota");
+                } catch (QuotaExceededException e) {
+                    //expected
+                }
+            } else {
+                zk.create(sb.toString(), "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenSetQuotaLessThanExistCount() throws Exception {
+
+        String path = "/c0";
+        zk.create(path, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path + "/c1", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path + "/c2", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        try {
+            zk.create(path + "/c3", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set quota when exceeds hard count quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedBothBytesAndCountHardQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        st.setCountHardLimit(1);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.create(path + "/c2", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should give priority to CountQuotaExceededException when both meets the count and bytes quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+    }
+
+    @Test
+    public void testDeleteBytesQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            fail("should not set data which exceeds the hard byte quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+
+        //delete the Byte Hard Quota
+        st = new StatsTrack();
+        st.setByteHardLimit(1);
+        DelQuotaCommand.delQuota(zk, path, st);
+
+        zk.setData(path, "123456".getBytes(), -1);
+    }
+
+    @Test
+    public void testDeleteCountQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set quota when exceeds hard count quota");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+
+        //delete the Count Hard Quota
+        st = new StatsTrack();
+        st.setCountHardLimit(1);
+        DelQuotaCommand.delQuota(zk, path, st);
+
+        zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+    }
+
+    @Test
+    public void testListQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        long bytes = 5L;
+        int count = 10;
+        long byteHardLimit = 6L;
+        int countHardLimit = 12;
+        st.setBytes(bytes);
+        st.setCount(count);
+        st.setByteHardLimit(byteHardLimit);
+        st.setCountHardLimit(countHardLimit);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        List<StatsTrack> statsTracks = ListQuotaCommand.listQuota(zk, path);
+        for (int i = 0; i < statsTracks.size(); i++) {
+            st = statsTracks.get(i);
+            if (i == 0) {
+                assertEquals(count, st.getCount());
+                assertEquals(countHardLimit, st.getCountHardLimit());
+                assertEquals(bytes, st.getBytes());
+                assertEquals(byteHardLimit, st.getByteHardLimit());
+            } else {
+                assertEquals(1, st.getCount());
+                assertEquals(-1, st.getCountHardLimit());
+                assertEquals(5, st.getBytes());
+                assertEquals(-1, st.getByteHardLimit());
+            }
+        }
+        //delete the Byte Hard Quota
+        st = new StatsTrack();
+        st.setByteHardLimit(1);
+        st.setBytes(1);
+        st.setCountHardLimit(1);
+        st.setCount(1);
+        DelQuotaCommand.delQuota(zk, path, st);
+
+        statsTracks = ListQuotaCommand.listQuota(zk, path);
+        for (int i = 0; i < statsTracks.size(); i++) {
+            st = statsTracks.get(i);
+            if (i == 0) {
+                assertEquals(-1, st.getCount());
+                assertEquals(-1, st.getCountHardLimit());
+                assertEquals(-1, st.getBytes());
+                assertEquals(-1, st.getByteHardLimit());
+            } else {
+                assertEquals(1, st.getCount());
+                assertEquals(-1, st.getCountHardLimit());
+                assertEquals(5, st.getBytes());
+                assertEquals(-1, st.getByteHardLimit());
+            }
+        }
+    }
+}
\ No newline at end of file

From 4f4a7fc27996744edb79ba69a56cdd0a8d066bce Mon Sep 17 00:00:00 2001
From: KangZhiDong <worldkzd@gmail.com>
Date: Fri, 22 Jan 2021 01:43:42 +0800
Subject: [PATCH 153/591] ZOOKEEPER-4046: Fix typo

Fix typo

Author: KangZhiDong <worldkzd@gmail.com>

Reviewers: maoling maoling1992191@sina.com

Closes #1570 from KangZhiDong/ZOOKEEPER-4046
---
 .../src/main/resources/markdown/zookeeperUseCases.md        | 6 +++---
 .../org/apache/zookeeper/server/quorum/LearnerHandler.java  | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
index bd29ee6e15a..24f991c3a4e 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
@@ -121,9 +121,9 @@ limitations under the License.
   - ZooKeeper maintains ephemeral cluster membership information. The Drillbits use ZooKeeper to find other Drillbits in the cluster,
     and the client uses ZooKeeper to find Drillbits to submit a query [28].
 
-### [Apache Druid(Incubating)](https://druid.apache.org/)
-  - Apache Druid (incubating) is a high performance real-time analytics database.
-  - Apache Druid (incubating) uses Apache ZooKeeper (ZK) for management of current cluster state. The operations that happen over ZK are [27]:
+### [Apache Druid](https://druid.apache.org/)
+  - Apache Druid is a high performance real-time analytics database.
+  - Apache Druid uses Apache ZooKeeper (ZK) for management of current cluster state. The operations that happen over ZK are [27]:
     - Coordinator leader election
     - Segment "publishing" protocol from Historical and Realtime
     - Segment load/drop protocol between Coordinator and Historical
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index b91319e0ca0..f71a4bffbb0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -551,7 +551,7 @@ public void run() {
             boolean needSnap = syncFollower(peerLastZxid, learnerMaster);
 
             // syncs between followers and the leader are exempt from throttling because it
-            // is importatnt to keep the state of quorum servers up-to-date. The exempted syncs
+            // is important to keep the state of quorum servers up-to-date. The exempted syncs
             // are counted as concurrent syncs though
             boolean exemptFromThrottle = getLearnerType() != LearnerType.OBSERVER;
             /* if we are not truncating or sending a diff just send a snapshot */

From 9aeaae5bb422c5a4262de84cf8704b02883e5006 Mon Sep 17 00:00:00 2001
From: coder-chenzhi <zilingqishi@gmail.com>
Date: Sun, 24 Jan 2021 01:41:25 +0800
Subject: [PATCH 154/591] ZOOKEEPER-3942: move traceMask calculation logic into
 the trace log guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Similar to ZOOKEEPER-3708 and ZOOKEEPER-3728 in `Learner`,  I found four cases where `traceMask` calculation logic are out of trace log guard in `LearnerHandler`, `PrepRequestProcessor`, and `ReadOnlyRequestProcessor`. The `traceMask` only matters if trace is enabled, so move the associated code into the logging guard.

Author: coder-chenzhi <zilingqishi@gmail.com>

Reviewers: maoling <maoling199210191@sina.com>

Closes #1464 from coder-chenzhi/master
---
 .../zookeeper/server/PrepRequestProcessor.java  |  8 ++++----
 .../zookeeper/server/quorum/LearnerHandler.java | 17 +++++++++--------
 .../server/quorum/ReadOnlyRequestProcessor.java |  8 ++++----
 3 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 3e6d4794411..55b070a8463 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -141,11 +141,11 @@ public void run() {
                 Request request = submittedRequests.take();
                 ServerMetrics.getMetrics().PREP_PROCESSOR_QUEUE_TIME
                     .add(Time.currentElapsedTime() - request.prepQueueStartTime);
-                long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-                if (request.type == OpCode.ping) {
-                    traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
-                }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+                    if (request.type == OpCode.ping) {
+                        traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
+                    }
                     ZooTrace.logRequest(LOG, traceMask, 'P', request, "");
                 }
                 if (Request.requestOfDeath == request) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index f71a4bffbb0..f7f12dcde47 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -323,7 +323,6 @@ public LearnerType getLearnerType() {
      * @throws InterruptedException
      */
     private void sendPackets() throws InterruptedException {
-        long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
         while (true) {
             try {
                 QuorumPacket p;
@@ -347,13 +346,15 @@ private void sendPackets() throws InterruptedException {
                     // Packet of death!
                     break;
                 }
-                if (p.getType() == Leader.PING) {
-                    traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-                }
+
                 if (p.getType() == Leader.PROPOSAL) {
                     syncLimitCheck.updateProposal(p.getZxid(), System.nanoTime());
                 }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
+                    if (p.getType() == Leader.PING) {
+                        traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+                    }
                     ZooTrace.logQuorumPacket(LOG, traceMask, 'o', p);
                 }
 
@@ -652,11 +653,11 @@ public void run() {
                 ia.readRecord(qp, "packet");
                 messageTracker.trackReceived(qp.getType());
 
-                long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
-                if (qp.getType() == Leader.PING) {
-                    traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-                }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
+                    if (qp.getType() == Leader.PING) {
+                        traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+                    }
                     ZooTrace.logQuorumPacket(LOG, traceMask, 'i', qp);
                 }
                 tickOfNextAckDeadline = learnerMaster.getTickOfNextAckDeadline();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index 3aec97f72e2..e9728e92b9f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -61,11 +61,11 @@ public void run() {
                 Request request = queuedRequests.take();
 
                 // log request
-                long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-                if (request.type == OpCode.ping) {
-                    traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
-                }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+                    if (request.type == OpCode.ping) {
+                        traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
+                    }
                     ZooTrace.logRequest(LOG, traceMask, 'R', request, "");
                 }
                 if (Request.requestOfDeath == request) {

From 3b6fefc43221fb3626740618a68562ff1ba707c0 Mon Sep 17 00:00:00 2001
From: "dk.technoboy" <guo.jiwei@immomo.com>
Date: Sun, 24 Jan 2021 01:58:11 +0800
Subject: [PATCH 155/591] ZOOKEEPER-3898: Fix typos

Author: dk.technoboy <guo.jiwei@immomo.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling199210191@sina.com>

Closes #1414 from Technoboy-/typos
---
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java   | 6 +++---
 .../apache/zookeeper/server/quorum/QuorumPeerConfig.java    | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 5c3f5f43d37..d48a7bfd760 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1224,7 +1224,7 @@ public void setSecureServerCnxnFactory(ServerCnxnFactory factory) {
     }
 
     /**
-     * return the last proceesed id from the
+     * return the last processed id from the
      * datatree
      */
     public long getLastProcessedZxid() {
@@ -1233,7 +1233,7 @@ public long getLastProcessedZxid() {
 
     /**
      * return the outstanding requests
-     * in the queue, which havent been
+     * in the queue, which haven't been
      * processed yet
      */
     public long getOutstandingRequests() {
@@ -1259,7 +1259,7 @@ public int getNumAliveConnections() {
     }
 
     /**
-     * trunccate the log to get in sync with others
+     * truncate the log to get in sync with others
      * if in a quorum
      * @param zxid the zxid that it needs to get in sync
      * with others
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index f3f456ebc0d..7a7318065e0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -712,7 +712,7 @@ public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, in
                 if (numParticipators <= 2) {
                     LOG.warn("No server failure will be tolerated. You need at least 3 servers.");
                 } else if (numParticipators % 2 == 0) {
-                    LOG.warn("Non-optimial configuration, consider an odd number of servers.");
+                    LOG.warn("Non-optimal configuration, consider an odd number of servers.");
                 }
             }
 

From 006d9f0da6d46183995cf98c43348364bbdeed9c Mon Sep 17 00:00:00 2001
From: tritrimax <tritri24@gmail.com>
Date: Sun, 24 Jan 2021 02:14:31 +0800
Subject: [PATCH 156/591] ZOOKEEPER-4190: Allow log file name to be changed

At the moment the name of the log file is hardcoded and cannot be changed.
With this update, if the variable ZOO_LOG_FILE is present in zookeeper-env.sh, the name of the file can be changed.

Author: tritrimax <tritri24@gmail.com>

Reviewers: Michael Han <hanm@apache.org>, Enrico Olivelli <eolivelli@apache.org>, tison <wander4096@gmail.com>, maoling <maoling199210191@sina.com>

Closes #1439 from tritrimax/patch-1
---
 bin/zkServer.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index a4aa9f38645..c91216b364c 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -149,7 +149,7 @@ if [ ! -w "$ZOO_LOG_DIR" ] ; then
 mkdir -p "$ZOO_LOG_DIR"
 fi
 
-ZOO_LOG_FILE=zookeeper-$USER-server-$HOSTNAME.log
+ZOO_LOG_FILE=${ZOO_LOG_FILE:-zookeeper-$USER-server-$HOSTNAME.log}
 _ZOO_DAEMON_OUT="$ZOO_LOG_DIR/zookeeper-$USER-server-$HOSTNAME.out"
 
 case $1 in

From 7af6428fa825ae5bd3938f3a8fd21a92abd4aadb Mon Sep 17 00:00:00 2001
From: Technoboy- <technoboy@yeah.net>
Date: Sun, 24 Jan 2021 17:26:29 +0800
Subject: [PATCH 157/591] ZOOKEEPER-3904: Remove duplicate check in
 ContainerManager#getCandidates method

Author: Technoboy- <technoboy@yeah.net>

Reviewers: Reviewers: maoling <maoling199210191@sina.com>

Closes #1419 from Technoboy-/dev2
---
 .../java/org/apache/zookeeper/server/ContainerManager.java     | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 9ecb8c6469f..7abac587aa9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -181,9 +181,6 @@ protected Collection<String> getCandidates() {
                     }
                 }
             }
-            if ((node != null) && (node.stat.getCversion() > 0) && (node.getChildren().isEmpty())) {
-                candidates.add(containerPath);
-            }
         }
         for (String ttlPath : zkDb.getDataTree().getTtls()) {
             DataNode node = zkDb.getDataTree().getNode(ttlPath);

From e7d67da8d49ab0bb19ff1c2a5e5ce02f23596402 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Sun, 24 Jan 2021 18:11:25 +0000
Subject: [PATCH 158/591] ZOOKEEPER-4191: Work around missing executable bits
 in source release tarball

symat noticed that the source tarball for 3.7.0rc0 is missing executable bits.

ztzg noticed that this can be worked around by reinstating the "old" version of the maven-assembly-plugin, which had been aligned in ZOOKEEPER-3833.

This patch implements the work around, and also applies cleanly on top of `branch-3.7.0` and `branch-3.7`.

Also discussed on dev:

  https://mail-archives.apache.org/mod_mbox/zookeeper-dev/202101.mbox/%3C875z3n9w75.fsf%40crosstwine.com%3E

Original report:

  https://mail-archives.apache.org/mod_mbox/zookeeper-dev/202101.mbox/%3cCAAMoRKLMf7tLosgqyiwYfFxXq-Zmiz=0oTGDijX5M=MHDF_JCgmail.gmail.com%3e

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1586 from ztzg/ZOOKEEPER-4191-missing-x-bits-source-tarball
---
 pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pom.xml b/pom.xml
index 758852b8206..805e85a79d1 100755
--- a/pom.xml
+++ b/pom.xml
@@ -690,6 +690,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-assembly-plugin</artifactId>
+          <version>3.1.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From 62e29cc5abe1cd5b668160ae0b3287a927fc429b Mon Sep 17 00:00:00 2001
From: brentwritescode <brentwritescode@gmail.com>
Date: Sun, 24 Jan 2021 18:17:12 +0000
Subject: [PATCH 159/591] ZOOKEEPER-3943: Zookeeper Inspector throwing
 NullPointerExceptions and not displaying properly

ISSUE
---
See https://issues.apache.org/jira/browse/ZOOKEEPER-3943 for details on the issue.

There are two main things being addressed in this PR:

1. The Maven build for ZooInspector seems to generate an invalid JAR file that is missing graphical resources that cause the application to be non-functional (UI does not render properly, NullPointerExceptions occur constantly, etc.).

2. The current Maven build instructions and run scripts for ZooInspector involve building, moving JAR files around, using relative entries on the CLASSPATH and running the scripts from the correct directory in order to use the `zooInspector.sh`/`zooInspector.cmd` launch scripts.

FIXES
---
For number 1, the fix is to add the `src/main/resources/*` directories to the JAR artifact built by Maven.

For number 2, I've proposed changing the Maven build to use the [Maven Assembly Plugin](http://maven.apache.org/plugins/maven-assembly-plugin/) to build a single "fat jar" for ZooInspector that contains all of its dependencies.  The result is that building and running the tool is easier and more straightforward (in my opinion):

```
git clone https://github.com/apache/zookeeper.git
cd zookeeper
mvn install -DskipTests
cd zookeeper-contrib/zookeeper-contrib-zooinspector
mvn install
./zooInspector.sh
```

And based on the "fat jar" style of build and updates to the run scripts, the `zooInspector.sh` and `zooInspector.cmd` commands now successfully execute from any directory (once the project is built) as opposed to requiring you to be in the same directory as the scripts.

My hope is that these changes allow people like myself who are mainly interested in using ZooInspector to easily clone the repository, build and run the tool without any issues.  I spent a chunk of time getting this all working for myself and I hope I can save others some trouble.

TESTING
---
I've tested cloning, building and running ZooInspector on Windows 10, Mac OS X Mojave (10.14.6) and Ubuntu Linux 18.04 using the steps above (on Java 8).

I ran `mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4` in the root directory (per https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute#HowToContribute-FinalChecksonPullRequest) and got these results:

```
[INFO]
[ERROR] Tests run: 2881, Failures: 4, Errors: 4, Skipped: 4
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache ZooKeeper 3.7.0-SNAPSHOT:
[INFO]
[INFO] Apache ZooKeeper ................................... SUCCESS [  7.731 s]
[INFO] Apache ZooKeeper - Documentation ................... SUCCESS [  3.223 s]
[INFO] Apache ZooKeeper - Jute ............................ SUCCESS [ 32.705 s]
[INFO] Apache ZooKeeper - Server .......................... FAILURE [30:28 min]
[INFO] Apache ZooKeeper - Metrics Providers ............... SKIPPED
[INFO] Apache ZooKeeper - Prometheus.io Metrics Provider .. SKIPPED
[INFO] Apache ZooKeeper - Client .......................... SKIPPED
[INFO] Apache ZooKeeper - Client - C ...................... SKIPPED
[INFO] Apache ZooKeeper - Recipes ......................... SKIPPED
[INFO] Apache ZooKeeper - Recipes - Election .............. SKIPPED
[INFO] Apache ZooKeeper - Recipes - Lock .................. SKIPPED
[INFO] Apache ZooKeeper - Recipes - Queue ................. SKIPPED
[INFO] Apache ZooKeeper - Assembly ........................ SKIPPED
[INFO] Apache ZooKeeper - Compatibility Tests ............. SKIPPED
[INFO] Apache ZooKeeper - Compatibility Tests - Curator ... SKIPPED
[INFO] Apache ZooKeeper - Tests ........................... SKIPPED
[INFO] Apache ZooKeeper - Contrib ......................... SKIPPED
[INFO] Apache ZooKeeper - Contrib - Fatjar ................ SKIPPED
[INFO] Apache ZooKeeper - Contrib - Loggraph .............. SKIPPED
[INFO] Apache ZooKeeper - Contrib - Rest .................. SKIPPED
[INFO] Apache ZooKeeper - Contrib - ZooInspector .......... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  31:12 min
[INFO] Finished at: 2020-12-05T01:08:27Z
[INFO] ------------------------------------------------------------------------
```
Since all of my proposed changes are in the `zookeeper-contrib` subtree, I'm assuming this doesn't have anything to do with my changes.  Running the same command in the `zookeeper-contrib` directory seems to pass for those tests:

```
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache ZooKeeper - Contrib 3.7.0-SNAPSHOT:
[INFO]
[INFO] Apache ZooKeeper - Contrib ......................... SUCCESS [  8.590 s]
[INFO] Apache ZooKeeper - Contrib - Fatjar ................ SUCCESS [ 13.636 s]
[INFO] Apache ZooKeeper - Contrib - Loggraph .............. SUCCESS [ 20.515 s]
[INFO] Apache ZooKeeper - Contrib - Rest .................. SUCCESS [ 13.394 s]
[INFO] Apache ZooKeeper - Contrib - ZooInspector .......... SUCCESS [ 17.056 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:14 min
[INFO] Finished at: 2020-12-05T01:13:22Z
[INFO] ------------------------------------------------------------------------
```

Author: brentwritescode <brentwritescode@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1551 from brentwritescode/master
---
 .../zookeeper-contrib-zooinspector/README.txt | 78 ++++++++++---------
 .../zookeeper-contrib-zooinspector/pom.xml    | 41 ++++++++++
 .../zooInspector.cmd                          | 13 +++-
 .../zooInspector.sh                           |  9 ++-
 4 files changed, 101 insertions(+), 40 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt b/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt
index 3c2a58f42e4..937579fb4f5 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt
@@ -18,20 +18,28 @@ Features
 --------
 	Below is a list of features in the current release of ZooInspector.
 	- Load connection settings from a zookeeper properties file
-	- Plugable DataEncryptionManagers to specify how data should be encrypted and decrypted in the Zookeeper instance
-	- Browseable tree view of the ZooKeeper instance
+	- Pluggable DataEncryptionManagers to specify how data should be encrypted and decrypted in the Zookeeper instance
+	- Browsable tree view of the ZooKeeper instance
 	- View the data in a node
-	- View the ACL's currently applied to a node
-	- View the metadata for a node (Version, Number of Children, Last modified Tiem, etc.)
-	- Plugable NodeViewers interface
+	- View the ACLs currently applied to a node
+	- View the metadata for a node (Version, Number of Children, Last modified Time, etc.)
+	- Pluggable NodeViewers interface
 	- Ability to save/load and set default Node Viewers
-	
-Pre-requisites
---------------
-	- The main zookeeper build script must have been run before building this module
-	
-Build Instructions
-------------------
+
+Maven Build Instructions
+-------------------------
+  0. Pre-requisites
+     - Run "mvn install" in the root directory of the Zookeeper project
+  1. Open a command line
+  2. cd into this directory
+  3. mvn install
+  4. To run ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux) (these scripts will
+     find the built JAR automatically in the "target" directory as long as you don't move it)
+
+Ant Build Instructions
+-----------------------
+  0. Pre-requisites
+	   - The main zookeeper build script must have been run before building this module
 	1. Open a command line.
 	2. cd into this directory
 	3. Run command: ant
@@ -40,55 +48,55 @@ Build Instructions
        copied to this directory during the build
 	6. By default the zookeeper.cmd and zookeeper.sh files expect zookeeper-3.3.0.jar.  If you are using another version
 	   you will need to change these files to point to the zookeeper-3.x.x.jar you copied to the lib directory
-	7. To run ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using 
+	7. To run ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using
 	   zookeeper-3.3.0.jar and do not require any classpath changes you can run the zookeeper-dev-ZooInspector.jar
 	   directly
 
 Using ZooInspector
 ------------------
-	To start ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using 
+	To start ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using
 	zookeeper-3.3.0.jar and do not require any classpath changes you can run the zookeeper-dev-ZooInspector.jar
 	directly.
-	
-	Click the play button on the toolbar to bring up the connection dialog.  From here you can enter connection 
-	information for your zookeeper instance.  You can also load the connection properties from a file.  This file can 
+
+	Click the play button on the toolbar to bring up the connection dialog.  From here you can enter connection
+	information for your zookeeper instance.  You can also load the connection properties from a file.  This file can
 	have the format as a normal zookeeper properties file (i.e. hosts and timeout key-value pairs) and van optional have
-	an encryptionManager key-value pair to specify the DataEncryptionManager to use for this connection 
+	an encryptionManager key-value pair to specify the DataEncryptionManager to use for this connection
 	(DataEncryptionManagers are explained in further detail in the 'Creating and Using Plugins' section below).  You can
-	also set the entered information as the defaults so that when you first start ZooInspector these settings are 
+	also set the entered information as the defaults so that when you first start ZooInspector these settings are
 	automatically loaded into this dialog.  Pressing the OK button with connect to your ZooKeeper instance and show the
 	current node tree on the left of the main panel.
-	
-	Clicking a node in the node tree will load the data for that node into the node viewers.  Three node viewers are 
+
+	Clicking a node in the node tree will load the data for that node into the node viewers.  Three node viewers are
 	currently distributed with ZooInspector:
-		1. Node Data - This enables you to see the data current stored on that node.  This data can be modified and 
-		   saved.  The data is decrypted and encrypted using the DataEncryptionManager specified on the connection 
+		1. Node Data - This enables you to see the data current stored on that node.  This data can be modified and
+		   saved.  The data is decrypted and encrypted using the DataEncryptionManager specified on the connection
 		   dialog.
-		2. Node Metadata - This enables you to see the metadata associiated with this node.  This is Essentially the data
+		2. Node Metadata - This enables you to see the metadata associated with this node.  This is essentially the data
 		   obtained from the Stat object for this node.
 		3. Node ACLs - This allows you to see the ACLs currently applied to this node.  Currently there is no ability
 		   to change the ACLs on a node, but it is a feature I would like to add.
 	Other custom Node Viewers can be added, this is explained in the 'Creating and Using Plugins' section below.
-	
+
 
 Creating and Using Plugins
 --------------------------
 	There are two types of plugin which can be used with ZooInspector:
-		1. DataEncryptionManager - This specifies how data should be encrypted and decrypted when working with a 
+		1. DataEncryptionManager - This specifies how data should be encrypted and decrypted when working with a
 		   zookeeper instance.
 		2. ZooInspectorNodeViewer - This is a GUI panel which provides a view of visualisation on a node.
 	More information on these interfaces can be found in the javadocs for this module.
-	
-	To use a plugin in ZooInspector, build the plugin to a jar and copy the jar to the lib sub-directory.  Edit the 
+
+	To use a plugin in ZooInspector, build the plugin to a jar and copy the jar to the lib sub-directory.  Edit the
 	zooInspector.cmd and/or zooInspector.sh files to include your new jar on the classpath and run ZooInspector.
-	
-	For DataEncryptionManagers, click the play button to open the connection dialog and enter the full class name of 
-	your DataEncryptionManager in the 'Data Encryption Manager' field.  You can make this Data Encryption Manager the 
+
+	For DataEncryptionManagers, click the play button to open the connection dialog and enter the full class name of
+	your DataEncryptionManager in the 'Data Encryption Manager' field.  You can make this Data Encryption Manager the
 	default by clicking 'Set As Default'.  Click the 'OK' button to instantiate and use your plugin.
-	
+
 	For ZooInspectorNodeViewers, Click the 'Change Node Viewers' button on the toolbar (looks like a tree with a pencil)
-	and enter the full classname for your Node Viewer in the field left of the 'Add' button, then click the 'Add' 
-	button.  The Node Viewer will be instantiated and should appear in the list.  You can change the order of the Node 
-	viewers by clicking the up and dpwn buttons and delete a Node Viewer by clicking the delete button.  You can save 
+	and enter the full classname for your Node Viewer in the field left of the 'Add' button, then click the 'Add'
+	button.  The Node Viewer will be instantiated and should appear in the list.  You can change the order of the Node
+	viewers by clicking the up and down buttons and delete a Node Viewer by clicking the delete button.  You can save
 	to configuration to a file or set it as the default if necessary. Then click the 'OK' button and your Node Viewer 
 	should appear in the tabs on the right of the main panel.
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index a7c4e40d77d..1e1e3a61227 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -38,6 +38,47 @@
     <guava.version>18.0</guava.version>
   </properties>
 
+  <build>
+    <!-- Ensure "icons" directory is available in built JAR -->
+    <resources>
+      <resource>
+        <directory>src/main/resources</directory>
+        <includes>
+          <include>**/*</include>
+        </includes>
+      </resource>
+    </resources>
+    <!-- Allow building of standalone single "fat" jar with all dependencies that allows
+     ZooInspector to build and run standalone. -->
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-assembly-plugin</artifactId>
+        <version>3.1.1</version>
+        <configuration>
+          <descriptorRefs>
+            <descriptorRef>jar-with-dependencies</descriptorRef>
+          </descriptorRefs>
+          <!-- Make the JAR executable via java -jar -->
+          <archive>
+            <manifest>
+              <mainClass>org.apache.zookeeper.inspector.ZooInspector</mainClass>
+            </manifest>
+          </archive>
+        </configuration>
+        <executions>
+          <execution>
+            <id>make-assembly</id>
+            <phase>package</phase>
+            <goals>
+              <goal>single</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd
index 0b9dcf85098..579a27e865f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd
@@ -14,8 +14,13 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 
-set CLASSPATH=lib\*;lib
-for /F %%f in ('dir /b "%~dp0%\*.jar" 2^>nul') do (
-   set CLASSPATH=%%f;%CLASSPATH%
+@rem Get the path to the directory containing this script
+SET SCRIPT_DIR=%~dp0
+
+@rem Get the path to the uber jar for this tool
+@rem (Requires "mvn install" or "mvn package" be run first)
+set JAVA_LIB=
+for /F %%f in ('dir /b "%SCRIPT_DIR%\target\zookeeper-contrib-zooinspector-*-jar-with-dependencies.jar" 2^>nul') do (
+   set JAVA_LIB=%SCRIPT_DIR%target\%%f
 )
-java -cp "%CLASSPATH%" org.apache.zookeeper.inspector.ZooInspector
+java -jar %JAVA_LIB%
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
index 5e3ebb67d4d..07ff697e7f8 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
@@ -15,4 +15,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-java -cp "zookeeper-dev-ZooInspector.jar:lib/*:lib" org.apache.zookeeper.inspector.ZooInspector
+# Get the path to the directory containing this script
+SCRIPT_DIR=$(dirname "$0")
+
+# Get the path to the uber jar for this tool
+# (Requires "mvn install" or "mvn package" be run first)
+JAVA_LIB=`ls ${SCRIPT_DIR}/target/zookeeper-contrib-zooinspector-*-jar-with-dependencies.jar`
+
+java -jar "${JAVA_LIB}"

From a4d7586f397290b7265b4f52ec64af5ee6fe0778 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Sun, 24 Jan 2021 18:24:03 +0000
Subject: [PATCH 160/591] ZOOKEEPER-4188: add a doc about whoami CLI

Author: maoling <maoling199210191@sina.com>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1585 from maoling/ZOOKEEPER-4188
---
 .../src/main/resources/markdown/zookeeperCLI.md      | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 8113e6c376a..668e64e8ba8 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -557,3 +557,15 @@ Show the version of the ZooKeeper client/CLI
 [zkshell: 1] version
 ZooKeeper CLI version: 3.6.0-SNAPSHOT-29f9b2c1c0e832081f94d59a6b88709c5f1bb3ca, built on 05/30/2019 09:26 GMT
 ```
+
+## whoami
+Gives all authentication information added into the current session.
+
+    [zkshell: 1] whoami
+    Auth scheme: User
+    ip: 127.0.0.1
+    [zkshell: 2] addauth digest user1:12345
+    [zkshell: 3] whoami
+    Auth scheme: User
+    ip: 127.0.0.1
+    digest: user1
\ No newline at end of file

From fc28f4ec48a674ec1e074645109e2aae87739fe5 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Mon, 25 Jan 2021 16:26:49 +0800
Subject: [PATCH 161/591] ZOOKEEPER-4186: update the developer list

Author: maoling <maoling199210191@sina.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1584 from maoling/ZOOKEEPER-4186 and squashes the following commits:

ad770f25b [maoling] correct the time-zone of Damien Diederen
080a848b3 [maoling] ZOOKEEPER-4186: update the developer list
---
 pom.xml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/pom.xml b/pom.xml
index 805e85a79d1..b0f22e8ca73 100755
--- a/pom.xml
+++ b/pom.xml
@@ -253,6 +253,36 @@
         <email>eolivelli@apache.org</email>
         <timezone>+1</timezone>
     </developer>
+    <developer>
+      <id>nkalmar</id>
+      <name>Norbert Kalmar</name>
+      <email>nkalmar@apache.org</email>
+      <timezone>+1</timezone>
+    </developer>
+    <developer>
+      <id>enixon</id>
+      <name>Brian Nixon</name>
+      <email>enixon@apache.org</email>
+      <timezone>-8</timezone>
+    </developer>
+    <developer>
+      <id>symat</id>
+      <name>Mate Szalay-Beko</name>
+      <email>symat@apache.org</email>
+      <timezone>+1</timezone>
+    </developer>
+    <developer>
+      <id>ddiederen</id>
+      <name>Damien Diederen</name>
+      <email>ddiederen@apache.org</email>
+      <timezone>Europe/Berlin</timezone>
+    </developer>
+    <developer>
+      <id>maoling</id>
+      <name>Ling Mao</name>
+      <email>maoling@apache.org</email>
+      <timezone>+8</timezone>
+    </developer>
   </developers>
 
   <profiles>

From a30acd2b9168042d52f593c985cbbda8622d83d7 Mon Sep 17 00:00:00 2001
From: lan <1728209643@qq.com>
Date: Tue, 26 Jan 2021 22:35:44 +0800
Subject: [PATCH 162/591] ZOOKEEPER-4037: Closing autoCloseable resource with
 try-with-resources block

Author: lan <1728209643@qq.com>

Reviewers: maoling <maoling199210191@sina.com>, Matteo Minardi <matteo.minardi@diennea.com>

Closes #1565 from lanicc/ZOOKEEPER-4037
---
 .../server/quorum/QuorumPeerConfig.java       | 28 ++++---------------
 1 file changed, 5 insertions(+), 23 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index 7a7318065e0..c56204f1f76 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -180,12 +180,9 @@ public void parse(String path) throws ConfigException {
                 .build()).create(path);
 
             Properties cfg = new Properties();
-            FileInputStream in = new FileInputStream(configFile);
-            try {
+            try (FileInputStream in = new FileInputStream(configFile)) {
                 cfg.load(in);
                 configFileStr = path;
-            } finally {
-                in.close();
             }
 
             /* Read entire config file as initial configuration */
@@ -201,8 +198,7 @@ public void parse(String path) throws ConfigException {
         if (dynamicConfigFileStr != null) {
             try {
                 Properties dynamicCfg = new Properties();
-                FileInputStream inConfig = new FileInputStream(dynamicConfigFileStr);
-                try {
+                try (FileInputStream inConfig = new FileInputStream(dynamicConfigFileStr)) {
                     dynamicCfg.load(inConfig);
                     if (dynamicCfg.getProperty("version") != null) {
                         throw new ConfigException("dynamic file shouldn't have version inside");
@@ -214,8 +210,6 @@ public void parse(String path) throws ConfigException {
                     if (version != null) {
                         dynamicCfg.setProperty("version", version);
                     }
-                } finally {
-                    inConfig.close();
                 }
                 setupQuorumPeerConfig(dynamicCfg, false);
 
@@ -228,11 +222,8 @@ public void parse(String path) throws ConfigException {
             if (nextDynamicConfigFile.exists()) {
                 try {
                     Properties dynamicConfigNextCfg = new Properties();
-                    FileInputStream inConfigNext = new FileInputStream(nextDynamicConfigFile);
-                    try {
+                    try (FileInputStream inConfigNext = new FileInputStream(nextDynamicConfigFile)) {
                         dynamicConfigNextCfg.load(inConfigNext);
-                    } finally {
-                        inConfigNext.close();
                     }
                     boolean isHierarchical = false;
                     for (Entry<Object, Object> entry : dynamicConfigNextCfg.entrySet()) {
@@ -529,18 +520,12 @@ private void backupOldConfig() throws IOException {
         new AtomicFileWritingIdiom(new File(configFileStr + ".bak"), new OutputStreamStatement() {
             @Override
             public void write(OutputStream output) throws IOException {
-                InputStream input = null;
-                try {
-                    input = new FileInputStream(new File(configFileStr));
+                try (InputStream input = new FileInputStream(new File(configFileStr))) {
                     byte[] buf = new byte[1024];
                     int bytesRead;
                     while ((bytesRead = input.read(buf)) > 0) {
                         output.write(buf, 0, bytesRead);
                     }
-                } finally {
-                    if (input != null) {
-                        input.close();
-                    }
                 }
             }
         });
@@ -597,11 +582,8 @@ public static void editStaticConfig(final String configFileStr, final String dyn
             .build()).create(dynamicFileStr);
 
         final Properties cfg = new Properties();
-        FileInputStream in = new FileInputStream(configFile);
-        try {
+        try (FileInputStream in = new FileInputStream(configFile)) {
             cfg.load(in);
-        } finally {
-            in.close();
         }
 
         new AtomicFileWritingIdiom(new File(configFileStr), new WriterStatement() {

From 2480c4ae232a60c8601d286831d9e88b7f3d053f Mon Sep 17 00:00:00 2001
From: asutosh936 <asutosh.pandya@hotmail.com>
Date: Thu, 28 Jan 2021 14:40:17 +0800
Subject: [PATCH 163/591] ZOOKEEPER-3730: fix a typo about watchManagerName in
 the zookeeperAdmin.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…

Author: asutosh936 <asutosh.pandya@hotmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, HorizonNet, maoling <maoling199210191@sina.com>

Closes #1263 from asutosh936/ZOOKEEPER-3730
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 82bcd65664d..bd350cfd750 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -788,7 +788,7 @@ property, when available, is noted below.
    must be 127 or less. Additionally, the maximum support TTL value is `1099511627775` which is smaller
    than what was allowed in 3.5.3 (`1152921504606846975`)
 
-* *watchManaggerName* :
+* *watchManagerName* :
   (Java system property only: **zookeeper.watchManagerName**)
   **New in 3.6.0:** Added in [ZOOKEEPER-1179](https://issues.apache.org/jira/browse/ZOOKEEPER-1179)
    New watcher manager WatchManagerOptimized is added to optimize the memory overhead in heavy watch use cases. This

From c481d3ced22ac69dc8549a4244f7dc10c2623155 Mon Sep 17 00:00:00 2001
From: ZWShuai91 <17610028856@163.com>
Date: Sat, 30 Jan 2021 16:13:26 +0800
Subject: [PATCH 164/591] ZOOKEEPER-3849: improve the all logs with a necessary
 time unit at the start up of server

 improve the all logs with a necessary time unit at the start up of server , add ms in log

Author: ZWShuai91 <17610028856@163.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, HorizonNet, maoling <maoling199210191@sina.com>

Closes #1371 from ZWShuai91/ZOOKEEPER-3849
---
 .../zookeeper/server/RequestThrottler.java     |  2 +-
 .../zookeeper/server/ZooKeeperServer.java      | 18 +++++++++---------
 .../server/quorum/FastLeaderElection.java      |  6 +++---
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index 32863d92a61..86923635ec7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -72,7 +72,7 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
 
     static {
         shutdownTimeout = Integer.getInteger(SHUTDOWN_TIMEOUT, 10000);
-        LOG.info("{} = {}", SHUTDOWN_TIMEOUT, shutdownTimeout);
+        LOG.info("{} = {} ms", SHUTDOWN_TIMEOUT, shutdownTimeout);
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index d48a7bfd760..3ffbb4b994d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -360,9 +360,9 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
 
         LOG.info(
             "Created server with"
-                + " tickTime {}"
-                + " minSessionTimeout {}"
-                + " maxSessionTimeout {}"
+                + " tickTime {} ms"
+                + " minSessionTimeout {} ms"
+                + " maxSessionTimeout {} ms"
                 + " clientPortListenBacklog {}"
                 + " datadir {}"
                 + " snapdir {}",
@@ -1274,7 +1274,7 @@ public int getTickTime() {
     }
 
     public void setTickTime(int tickTime) {
-        LOG.info("tickTime set to {}", tickTime);
+        LOG.info("tickTime set to {} ms", tickTime);
         this.tickTime = tickTime;
     }
 
@@ -1283,7 +1283,7 @@ public static int getThrottledOpWaitTime() {
     }
 
     public static void setThrottledOpWaitTime(int time) {
-        LOG.info("throttledOpWaitTime set to {}", time);
+        LOG.info("throttledOpWaitTime set to {} ms", time);
         throttledOpWaitTime = time;
     }
 
@@ -1293,7 +1293,7 @@ public int getMinSessionTimeout() {
 
     public void setMinSessionTimeout(int min) {
         this.minSessionTimeout = min == -1 ? tickTime * 2 : min;
-        LOG.info("minSessionTimeout set to {}", this.minSessionTimeout);
+        LOG.info("minSessionTimeout set to {} ms", this.minSessionTimeout);
     }
 
     public int getMaxSessionTimeout() {
@@ -1302,7 +1302,7 @@ public int getMaxSessionTimeout() {
 
     public void setMaxSessionTimeout(int max) {
         this.maxSessionTimeout = max == -1 ? tickTime * 20 : max;
-        LOG.info("maxSessionTimeout set to {}", this.maxSessionTimeout);
+        LOG.info("maxSessionTimeout set to {} ms", this.maxSessionTimeout);
     }
 
     public int getClientPortListenBacklog() {
@@ -1492,7 +1492,7 @@ long getFlushDelay() {
     }
 
     static void setFlushDelay(long delay) {
-        LOG.info("{}={}", FLUSH_DELAY, delay);
+        LOG.info("{} = {} ms", FLUSH_DELAY, delay);
         flushDelay = delay;
     }
 
@@ -1501,7 +1501,7 @@ long getMaxWriteQueuePollTime() {
     }
 
     static void setMaxWriteQueuePollTime(long maxTime) {
-        LOG.info("{}={}", MAX_WRITE_QUEUE_POLL_SIZE, maxTime);
+        LOG.info("{} = {} ms", MAX_WRITE_QUEUE_POLL_SIZE, maxTime);
         maxWriteQueuePollTime = maxTime;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index f141e854e8c..0950c6d4c2e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -86,9 +86,9 @@ public class FastLeaderElection implements Election {
 
     static {
         minNotificationInterval = Integer.getInteger(MIN_NOTIFICATION_INTERVAL, minNotificationInterval);
-        LOG.info("{}={}", MIN_NOTIFICATION_INTERVAL, minNotificationInterval);
+        LOG.info("{} = {} ms", MIN_NOTIFICATION_INTERVAL, minNotificationInterval);
         maxNotificationInterval = Integer.getInteger(MAX_NOTIFICATION_INTERVAL, maxNotificationInterval);
-        LOG.info("{}={}", MAX_NOTIFICATION_INTERVAL, maxNotificationInterval);
+        LOG.info("{} = {} ms", MAX_NOTIFICATION_INTERVAL, maxNotificationInterval);
     }
 
     /**
@@ -977,7 +977,7 @@ public Vote lookForLeader() throws InterruptedException {
                      */
                     int tmpTimeOut = notTimeout * 2;
                     notTimeout = Math.min(tmpTimeOut, maxNotificationInterval);
-                    LOG.info("Notification time out: {}", notTimeout);
+                    LOG.info("Notification time out: {} ms", notTimeout);
                 } else if (validVoter(n.sid) && validVoter(n.leader)) {
                     /*
                      * Only proceed if the vote comes from a replica in the current or next

From ae5443e2c5ba67fcfe3decac084f6dff9ab8a383 Mon Sep 17 00:00:00 2001
From: zengchao1212 <zengchao1212@gmail.com>
Date: Tue, 2 Feb 2021 15:11:39 +0800
Subject: [PATCH 165/591] ZOOKEEPER-4001: Make AuditHelper.addAuditLog(...)
 more readable

Author: zengchao1212 <zengchao1212@gmail.com>

Reviewers: maoling <maoling@apache.org>

Closes #1537 from zengchao1212/ZOOKEEPER-4001
---
 .../apache/zookeeper/audit/AuditHelper.java   | 29 ++++---------------
 1 file changed, 6 insertions(+), 23 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
index ec4ca136c2f..b98c42d2588 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
@@ -70,14 +70,11 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
                 case ZooDefs.OpCode.create2:
                 case ZooDefs.OpCode.createContainer:
                     op = AuditConstants.OP_CREATE;
+                    CreateRequest createRequest = new CreateRequest();
+                    deserialize(request, createRequest);
+                    createMode = getCreateMode(createRequest);
                     if (failedTxn) {
-                        CreateRequest createRequest = new CreateRequest();
-                        deserialize(request, createRequest);
                         path = createRequest.getPath();
-                        createMode =
-                                getCreateMode(createRequest);
-                    } else {
-                        createMode = getCreateMode(request);
                     }
                     break;
                 case ZooDefs.OpCode.delete:
@@ -99,13 +96,11 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
                     break;
                 case ZooDefs.OpCode.setACL:
                     op = AuditConstants.OP_SETACL;
+                    SetACLRequest setACLRequest = new SetACLRequest();
+                    deserialize(request, setACLRequest);
+                    acls = ZKUtil.aclToString(setACLRequest.getAcl());
                     if (failedTxn) {
-                        SetACLRequest setACLRequest = new SetACLRequest();
-                        deserialize(request, setACLRequest);
                         path = setACLRequest.getPath();
-                        acls = ZKUtil.aclToString(setACLRequest.getAcl());
-                    } else {
-                        acls = getACLs(request);
                     }
                     break;
                 case ZooDefs.OpCode.multi:
@@ -188,18 +183,6 @@ private static void log(String user, String operation, String znode, String acl,
         ZKAuditProvider.log(user, operation, znode, acl, createMode, session, ip, result);
     }
 
-    private static String getACLs(Request request) throws IOException {
-        SetACLRequest setACLRequest = new SetACLRequest();
-        deserialize(request, setACLRequest);
-        return ZKUtil.aclToString(setACLRequest.getAcl());
-    }
-
-    private static String getCreateMode(Request request) throws IOException, KeeperException {
-        CreateRequest createRequest = new CreateRequest();
-        deserialize(request, createRequest);
-        return getCreateMode(createRequest);
-    }
-
     private static String getCreateMode(CreateRequest createRequest) throws KeeperException {
         return CreateMode.fromFlag(createRequest.getFlags()).toString().toLowerCase();
     }

From 245ff759b0e9fe0a1815e03433306ac805bf5e95 Mon Sep 17 00:00:00 2001
From: brentwritescode <brentwritescode@gmail.com>
Date: Thu, 4 Feb 2021 08:15:37 +0000
Subject: [PATCH 166/591] ZOOKEEPER-4050: Zookeeper Inspector reports "List of
 default node viewers is empty" when not specifically run from the
 zookeeper-contrib/zookeeper-contrib-zooinspector directory

ISSUE
---
See https://issues.apache.org/jira/browse/ZOOKEEPER-4050 for details on the issue.

This is a follow-on PR to issues identified in https://github.com/apache/zookeeper/pull/1551.  While that PR fixed some launch issues, currently ZooInspector still needs to be run from the root ZooInspector directory because it expects the `defaultConnectionSettings.cfg` and `defaultNodeViewers.cfg` to exist on the filesystem in a specific location.  The previous PR ensured that these files are now bundled into the fat jar built by Maven, so this new PR makes the checks for these files fall back to checking the classpath (i.e. checking inside the jar) for these files if they can't be found on the filesystem first.  This means that the `zooInspector.sh` and `zooInspector.cmd` scripts can now be run from anywhere once the project is built.

TESTING
---
I've tested cloning, building and running ZooInspector on Mac OS Catalina (10.15.7) on Java 8 with these fixes and invoking `zooInspector.sh` from different directories to ensure it runs properly and doesn't display the aforementioned error.

I ran `mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4` in the `zookeeper-contrib/zookeeper-contrib-zooinspector` directory (per https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute#HowToContribute-FinalChecksonPullRequest) and got these results:

```
[INFO] You have 0 Checkstyle violations.
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  15.037 s
[INFO] Finished at: 2021-02-01T20:30:04-08:00
[INFO] ------------------------------------------------------------------------
```

Since all of my proposed changes are in the `zookeeper-contrib` subtree (and specifically only in `zookeeper-contrib-zooinspector`, I did not run the wider unit tests for the Zookeeper project as a whole.

Author: brentwritescode <brentwritescode@gmail.com>
Author: Brent Nash <brent.nash@crowdstrike.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1589 from brentwritescode/ZOOKEEPER-4050
---
 .../manager/ZooInspectorManagerImpl.java      | 97 ++++++++++++-------
 1 file changed, 60 insertions(+), 37 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
index 2c5790746ad..aa9ff6e322e 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
@@ -20,9 +20,12 @@
 import java.io.BufferedReader;
 import java.io.BufferedWriter;
 import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.FileReader;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -91,6 +94,12 @@ public class ZooInspectorManagerImpl implements ZooInspectorManager {
      */
     public static final String AUTH_DATA_KEY = "authData";
 
+    private static final String DEFAULT_ENCRYPTION_MANAGER =
+        BasicDataEncryptionManager.class.getName();
+    private static final int DEFAULT_TIMEOUT = 5000;
+    private static final String DEFAULT_HOSTS = "localhost:2181";
+    private static final String DEFAULT_AUTH_SCHEME = "";
+    private static final String DEFAULT_AUTH_VALUE = "";
 
     private static final File defaultNodeViewersFile = new File(
             "./src/main/resources/defaultNodeViewers.cfg");
@@ -713,55 +722,47 @@ public void stop() {
     public List<String> loadNodeViewersFile(File selectedFile)
             throws IOException {
         List<String> result = new ArrayList<String>();
-        if (defaultNodeViewersFile.exists()) {
-            FileReader reader = new FileReader(selectedFile);
-            try {
-                BufferedReader buff = new BufferedReader(reader);
-                try {
-                    while (buff.ready()) {
-                        String line = buff.readLine();
-                        if (line != null && line.length() > 0 && !line.startsWith("#")) {
-                            result.add(line);
-                        }
+
+        try(BufferedReader reader = getReaderForFile(selectedFile)) {
+            if(reader == null) {
+                return result;
+            }
+
+            String line = "";
+            while (line != null) {
+                line = reader.readLine();
+                if(line != null) {
+                    line = line.trim();
+                    if (!line.isEmpty() && !line.startsWith("#")) {
+                        result.add(line);
                     }
-                } finally {
-                    buff.close();
                 }
-            } finally {
-                reader.close();
             }
         }
+
         return result;
     }
 
     private void loadDefaultConnectionFile() throws IOException {
-        if (defaultConnectionFile.exists()) {
-            Properties props = new Properties();
+        Properties props = new Properties();
 
-            FileReader reader = new FileReader(defaultConnectionFile);
-            try {
+        try(BufferedReader reader = getReaderForFile(defaultConnectionFile)) {
+            //If reader is null, it's OK.  Default values will get set below.
+            if(reader != null) {
                 props.load(reader);
-            } finally {
-                reader.close();
             }
-            defaultEncryptionManager = props
-                    .getProperty(DATA_ENCRYPTION_MANAGER) == null ? "org.apache.zookeeper.inspector.encryption.BasicDataEncryptionManager"
-                    : props.getProperty(DATA_ENCRYPTION_MANAGER);
-            defaultTimeout = props.getProperty(SESSION_TIMEOUT) == null ? "5000"
-                    : props.getProperty(SESSION_TIMEOUT);
-            defaultHosts = props.getProperty(CONNECT_STRING) == null ? "localhost:2181"
-                    : props.getProperty(CONNECT_STRING);
-            defaultAuthScheme = props.getProperty(AUTH_SCHEME_KEY) == null ? ""
-                    : props.getProperty(AUTH_SCHEME_KEY);
-            defaultAuthValue = props.getProperty(AUTH_DATA_KEY) == null ? ""
-                    : props.getProperty(AUTH_DATA_KEY);
-        } else {
-            defaultEncryptionManager = "org.apache.zookeeper.inspector.encryption.BasicDataEncryptionManager";
-            defaultTimeout = "5000";
-            defaultHosts = "localhost:2181";
-            defaultAuthScheme = "";
-            defaultAuthValue = "";
         }
+
+        defaultEncryptionManager = props.getProperty(DATA_ENCRYPTION_MANAGER) == null ?
+            DEFAULT_ENCRYPTION_MANAGER : props.getProperty(DATA_ENCRYPTION_MANAGER);
+        defaultTimeout = props.getProperty(SESSION_TIMEOUT) == null ?
+            Integer.toString(DEFAULT_TIMEOUT) : props.getProperty(SESSION_TIMEOUT);
+        defaultHosts = props.getProperty(CONNECT_STRING) == null ?
+            DEFAULT_HOSTS : props.getProperty(CONNECT_STRING);
+        defaultAuthScheme = props.getProperty(AUTH_SCHEME_KEY) == null ?
+            DEFAULT_AUTH_SCHEME : props.getProperty(AUTH_SCHEME_KEY);
+        defaultAuthValue = props.getProperty(AUTH_DATA_KEY) == null ?
+            DEFAULT_AUTH_VALUE : props.getProperty(AUTH_DATA_KEY);
     }
 
     /*
@@ -872,4 +873,26 @@ public Properties getLastConnectionProps() {
     public void setLastConnectionProps(Properties connectionProps) {
         this.lastConnectionProps = connectionProps;
     }
+
+    private static BufferedReader getReaderForFile(File file) {
+        //check the filesystem first
+        if (file.exists()) {
+            try {
+                return new BufferedReader(new FileReader(file));
+            } catch (FileNotFoundException e) {
+                return null;
+            }
+        }
+
+        //fall back to checking the CLASSPATH with only the filename
+        //(for cases where the file exists in src/main/resources)
+        InputStream classpathStream = ZooInspectorManagerImpl.class.getClassLoader()
+            .getResourceAsStream(file.getName());
+        if (classpathStream != null) {
+            return new BufferedReader(new InputStreamReader(classpathStream));
+        }
+
+        //couldn't find the file anywhere
+        return null;
+    }
 }

From 4faf507771889c7f6280d41ac4a615467680553f Mon Sep 17 00:00:00 2001
From: luoman <271731985@qq.com>
Date: Mon, 8 Feb 2021 20:08:14 +0800
Subject: [PATCH 167/591] ZOOKEEPER-4007: A typo in the
 ZKUtil#validateFileInput method

Author: luoman <271731985@qq.com>

Reviewers: maoling <maoling@apache.org>

Closes #1597 from LuoManGit/ZOOKEEPER-4007
---
 zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index 2e29cc75c47..fd35ae39a5d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -163,7 +163,7 @@ public static String validateFileInput(String filePath) {
             return "Read permission is denied on the file '" + file.getAbsolutePath() + "'";
         }
         if (file.isDirectory()) {
-            return "'" + file.getAbsolutePath() + "' is a direcory. it must be a file.";
+            return "'" + file.getAbsolutePath() + "' is a directory. it must be a file.";
         }
         return null;
     }

From 1c92a1f950d5efd2956fe85c6b9c843648b7a6e8 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 9 Feb 2021 12:00:07 +0100
Subject: [PATCH 168/591] Revert "ZOOKEEPER-4007: A typo in the
 ZKUtil#validateFileInput method"

This reverts commit 4faf507771889c7f6280d41ac4a615467680553f.
---
 zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index fd35ae39a5d..2e29cc75c47 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -163,7 +163,7 @@ public static String validateFileInput(String filePath) {
             return "Read permission is denied on the file '" + file.getAbsolutePath() + "'";
         }
         if (file.isDirectory()) {
-            return "'" + file.getAbsolutePath() + "' is a directory. it must be a file.";
+            return "'" + file.getAbsolutePath() + "' is a direcory. it must be a file.";
         }
         return null;
     }

From 8c68933226595b839ba3694dacd39cd2b2a21878 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 9 Feb 2021 16:30:54 +0100
Subject: [PATCH 169/591] ZOOKEEPER-4207: Remove extra checkout from
 Jenkinsfile

I believe we don't need to add the git checkout to the "Steps" section. I cannot see it neither in owasp nor the PR jenkinsfiles. Also I see that master branch gets also checked out during our normal builds, so I hope this will fix it.

Target branches: master, branch-3.7, branch-3.6, branch-3.5

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1600 from anmolnar/ZOOKEEPER-4207
---
 Jenkinsfile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index ed074c95617..40fcdd5bbad 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -51,7 +51,6 @@ pipeline {
                 stages {
                     stage('BuildAndTest') {
                         steps {
-                            git 'https://github.com/apache/zookeeper'
                             sh "git clean -fxd"
                             sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
                         }

From c26f96c089f20902a39cb0088e68a5b58e35c024 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Wed, 17 Feb 2021 17:12:11 +0000
Subject: [PATCH 170/591] ZOOKEEPER-3987: Reduce fork count for tests to 1

Increase test stability by avoiding test failures due to port
collisions by preventing tests from running concurrently in
the GitHub Actions CI builds.

Author: Christopher Tubbs <ctubbsii@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1606 from ctubbsii/reduce-forkCount
---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0b578f981d3..16171d26ca2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -42,7 +42,7 @@ jobs:
             args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
           - name: 'full-build-java-tests'
             jdk: 11
-            args: '-Pfull-build verify -Dsurefire-forkcount=1C -DskipCppUnit -Dsurefire.rerunFailingTestsCount=5'
+            args: '-Pfull-build verify -Dsurefire-forkcount=1 -DskipCppUnit -Dsurefire.rerunFailingTestsCount=5'
           - name: 'full-build-cppunit-tests'
             jdk: 11
             args: '-Pfull-build verify -Dtest=_ -DfailIfNoTests=false'

From 884fc38db166617e03d03f793ef917febcc131be Mon Sep 17 00:00:00 2001
From: Frederiko Costa <frederiko@gmail.com>
Date: Wed, 17 Feb 2021 17:22:40 +0000
Subject: [PATCH 171/591] ZOOKEEPER-4209: Update Netty to 4.1.59.Final

Update Netty to 4.1.59.Final on to address the vulnerability described at https://snyk.io/vuln/SNYK-JAVA-IONETTY-1020439

Author: Frederiko Costa <frederiko@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1605 from frederiko/netty-4.1.59-update
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.59.Final.LICENSE.txt} | 0
 ...0.Final.LICENSE.txt => netty-codec-4.1.59.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.59.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.59.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.59.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.59.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.59.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.50.Final.LICENSE.txt => netty-buffer-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.50.Final.LICENSE.txt => netty-codec-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.50.Final.LICENSE.txt => netty-common-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.50.Final.LICENSE.txt => netty-handler-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.50.Final.LICENSE.txt => netty-resolver-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.50.Final.LICENSE.txt => netty-transport-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.50.Final.LICENSE.txt => netty-transport-native-epoll-4.1.59.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.50.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index b0f22e8ca73..bb5e50bdc54 100755
--- a/pom.xml
+++ b/pom.xml
@@ -467,7 +467,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.50.Final</netty.version>
+    <netty.version>4.1.59.Final</netty.version>
     <jetty.version>9.4.35.v20201120</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.59.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.50.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.50.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt

From d8ff555339b054fbcf6ea6767357e8bf8c7af2c5 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Wed, 17 Feb 2021 20:18:55 +0100
Subject: [PATCH 172/591] ZOOKEEPER-4200: Widen latency window in
 WatcherCleanerTest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`WatcherCleanerTest` performs latency checks which fail when outside of a 20+Xms window.  Before this patch, X was 5ms—whereas 30+ms is frequently seen on an i5 Mac Mini running macOS Catalina.

This "dumb" patch just widens the window to 20ms, which makes it "work on my machine," but could obviously still fail in a loaded environment or VM.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1592 from ztzg/ZOOKEEPER-4200-widen-latency-window
---
 .../zookeeper/server/watch/WatcherCleanerTest.java | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
index ec05f14dbde..9ed145aa38d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
@@ -162,13 +162,13 @@ public void testDeadWatcherMetrics() {
 
         assertEquals(3L, values.get("cnt_dead_watchers_cleaner_latency"));
 
-        //Each latency should be a little over 20 ms, allow 5 ms deviation
-        assertEquals(20D, (Double) values.get("avg_dead_watchers_cleaner_latency"), 5);
-        assertEquals(20D, ((Long) values.get("min_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("max_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("p50_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("p95_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("p99_dead_watchers_cleaner_latency")).doubleValue(), 5);
+        //Each latency should be a little over 20 ms, allow 20 ms deviation
+        assertEquals(20D, (Double) values.get("avg_dead_watchers_cleaner_latency"), 20);
+        assertEquals(20D, ((Long) values.get("min_dead_watchers_cleaner_latency")).doubleValue(), 20);
+        assertEquals(20D, ((Long) values.get("max_dead_watchers_cleaner_latency")).doubleValue(), 20);
+        assertEquals(20D, ((Long) values.get("p50_dead_watchers_cleaner_latency")).doubleValue(), 20);
+        assertEquals(20D, ((Long) values.get("p95_dead_watchers_cleaner_latency")).doubleValue(), 20);
+        assertEquals(20D, ((Long) values.get("p99_dead_watchers_cleaner_latency")).doubleValue(), 20);
     }
 
 }

From 58b4c10be5e6b992caac3b99a506e1d61bdec24d Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Wed, 17 Feb 2021 20:20:38 +0100
Subject: [PATCH 173/591] ZOOKEEPER-4201: C client: Disable SASL deprecation
 warnings on macOS

This patch works around the numerous deprecation notices added to the CyrusSASL library on macOS.  It is a direct "port" of the solution to MESOS-3030, which hit exactly the same problem:

https://issues.apache.org/jira/browse/MESOS-3030

https://reviews.apache.org/r/39230/diff/3/

The PR also includes a fix for the the `clockid_t` compilation issue mentioned in the ticket description, but the test suite as a whole remains broken on macOS as its linker does not support the `--wrap` option.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1593 from ztzg/ZOOKEEPER-4201-catalina-c-client-fixes
---
 zookeeper-client/zookeeper-client-c/src/cli.c    | 16 ++++++++++++++++
 .../zookeeper-client-c/src/zk_sasl.c             | 15 +++++++++++++++
 .../zookeeper-client-c/tests/LibCSymTable.h      |  1 +
 .../zookeeper-client-c/tests/TestSASLAuth.cc     | 14 ++++++++++++++
 4 files changed, 46 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/src/cli.c b/zookeeper-client/zookeeper-client-c/src/cli.c
index 1864e564571..823ed72a5a0 100644
--- a/zookeeper-client/zookeeper-client-c/src/cli.c
+++ b/zookeeper-client/zookeeper-client-c/src/cli.c
@@ -948,6 +948,17 @@ int main(int argc, char **argv) {
     zoo_deterministic_conn_order(1); // enable deterministic order
 
 #ifdef HAVE_CYRUS_SASL_H
+    /*
+     * We need to disable the deprecation warnings as Apple has
+     * decided to deprecate all of CyrusSASL's functions with OS 10.11
+     * (see MESOS-3030, ZOOKEEPER-4201). We are using GCC pragmas also
+     * for covering clang.
+     */
+#ifdef __APPLE__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
     if (mechlist) {
         zoo_sasl_params_t sasl_params = { 0 };
         int sr;
@@ -977,6 +988,11 @@ int main(int argc, char **argv) {
             return errno;
         }
     }
+
+#ifdef __APPLE__
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_CYRUS_SASL_H */
 
     if (!zh) {
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
index e0ccfb31004..6ae7e123733 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
+++ b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
@@ -47,6 +47,17 @@
 #include "zk_adaptor.h"
 #include "zookeeper_log.h"
 
+/*
+ * We need to disable the deprecation warnings as Apple has decided to
+ * deprecate all of CyrusSASL's functions with OS 10.11 (see
+ * MESOS-3030, ZOOKEEPER-4201). We are using GCC pragmas also for
+ * covering clang.
+ */
+#ifdef __APPLE__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
 /*
  * Store a duplicate of src, or NULL, into *target.  Returns
  * ZSYSTEMERROR if no memory could be allocated, ZOK otherwise.
@@ -539,3 +550,7 @@ sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
         return xcallbacks;
     }
 }
+
+#ifdef __APPLE__
+#pragma GCC diagnostic pop
+#endif
diff --git a/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h b/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h
index 1b6f9db996d..08028abca8c 100644
--- a/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h
+++ b/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h
@@ -26,6 +26,7 @@
 #include <dlfcn.h>
 #include <cassert>
 #include <poll.h>
+#include <time.h>
 #include <unistd.h> // needed for _POSIX_MONOTONIC_CLOCK
 
 #ifdef THREADED
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
index e6aa4cb3d50..c98d4bffc81 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
@@ -130,6 +130,16 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
     }
 
 #ifdef HAVE_CYRUS_SASL_H
+
+    // We need to disable the deprecation warnings as Apple has
+    // decided to deprecate all of CyrusSASL's functions with OS 10.11
+    // (see MESOS-3030, ZOOKEEPER-4201). We are using GCC pragmas also
+    // for covering clang.
+#ifdef __APPLE__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
     void testClientSASLHelper(const char *hostPorts, const char *path) {
         startServer();
 
@@ -260,6 +270,10 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         stopServer();
     }
 
+#ifdef __APPLE__
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_CYRUS_SASL_H */
 };
 

From 37eae03080b93d63a6ba9f624b37c764511ad2dc Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Thu, 18 Feb 2021 08:40:55 +0000
Subject: [PATCH 174/591] ZOOKEEPER-4199: Avoid thread leak in
 QuorumRequestPipelineTest

`QuorumRequestPipelineTest` hosts parameterized tests which explicitly call `QuorumBase.setUp(boolean)`.

This patch overrides the argument-less `QuorumBase.setUp()` with an empty body, as the former is annotated `BeforeEach`-otherwise causing the runtime to start a fresh 5-ensemble before each test.

Without the override, one such extraneous ensemble is created and immediately leaked for each combination of test method + parameters.

The test consequently requires 4000+ simultaneous threads to complete, and while Linux happily handles that load, macOS Catalina's per-process limit of 2048 threads effectively causes the JVM to "crash" or lock up.

The solution is copied verbatim from another parameterized subclass of `QuorumBase`, `EagerACLFilterTest`.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1591 from ztzg/ZOOKEEPER-4199-thread-leak-qrp-test
---
 .../server/quorum/QuorumRequestPipelineTest.java          | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
index 8a463c07b18..0888d6fb505 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
@@ -36,6 +36,7 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
@@ -59,6 +60,13 @@ public static Stream<Arguments> data() throws Exception {
                 Arguments.of(ServerState.OBSERVING));
     }
 
+    @BeforeEach
+    @Override
+    public void setUp() {
+        //since parameterized test methods need a parameterized setUp method
+        //the inherited method has to be overridden with an empty function body
+    }
+
     public void setUp(ServerState serverState) throws Exception {
         CountdownWatcher clientWatch = new CountdownWatcher();
         super.setUp(true);

From 94d0c4d8558e1b201665bb9dffd33dacbc7ca945 Mon Sep 17 00:00:00 2001
From: Mathieu Marie <mmarie@salesforce.com>
Date: Fri, 26 Feb 2021 09:35:02 +0000
Subject: [PATCH 175/591] ZOOKEEPER-4221: Improve the error message when
 message goes above jute.maxbufer size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Author: Mathieu Marie <mmarie@salesforce.com>

Reviewers: Damien Diederen <dd@crosstwine.com>, Mate Szalay-Beko <symat@apache.org>

Closes #1614 from mariemat/ZOOKEEPER-4221
---
 .../main/java/org/apache/zookeeper/server/NIOServerCnxn.java | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 2e65da84044..02cde23a917 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -545,7 +545,10 @@ private boolean readLength(SelectionKey k) throws IOException {
             return false;
         }
         if (len < 0 || len > BinaryInputArchive.maxBuffer) {
-            throw new IOException("Len error " + len);
+            throw new IOException("Len error. "
+                    + "A message from " +  this.getRemoteSocketAddress() + " with advertised length of " + len
+                    + " is either a malformed message or too large to process"
+                    + " (length is greater than jute.maxbuffer=" + BinaryInputArchive.maxBuffer + ")");
         }
         if (!isZKServerRunning()) {
             throw new IOException("ZooKeeperServer not running");

From eb1569e4fbb55d12fa6211fbd997aa592fcb01af Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Mon, 1 Mar 2021 08:36:33 +0100
Subject: [PATCH 176/591] ZOOKEEPER-4219: Quota checks break setData in multi
 transactions

Without this patch, a multi() transaction such as the one implemented
in ZooKeeperQuotaTest.testMultiCreateThenSetDataShouldWork fails with
MarshallingError when 'enforceQuota' is enabled.

This happens whenever the node has an associated quota, whether it was
exceeded or not.

This is due to the server encountering null while trying to access a
database node by path--whereas that node only exists as a ChangeRecord
in the server's 'outstandingChanges' list:

    java.lang.NullPointerException
        at org.apache.zookeeper.server.ZooKeeperServer.checkQuota(ZooKeeperServer.java:2048)
        at org.apache.zookeeper.server.PrepRequestProcessor.pRequest2Txn(PrepRequestProcessor.java:397)

The patch adds an additional 'lastData' parameter to the quota
checking function, and passes the data from the ChangeRecord during
'setData' operations.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1611 from ztzg/ZOOKEEPER-4219-quota-multi-setdata
---
 .../server/PrepRequestProcessor.java          |  4 +-
 .../zookeeper/server/ZooKeeperServer.java     | 14 ++---
 .../zookeeper/test/ZooKeeperQuotaTest.java    | 53 ++++++++++++++++++-
 3 files changed, 59 insertions(+), 12 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 55b070a8463..e71828d262b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -394,7 +394,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             validatePath(path, request.sessionId);
             nodeRecord = getRecordForPath(path);
             zks.checkACL(request.cnxn, nodeRecord.acl, ZooDefs.Perms.WRITE, request.authInfo, path, null);
-            zks.checkQuota(path, setDataRequest.getData(), OpCode.setData);
+            zks.checkQuota(path, nodeRecord.data, setDataRequest.getData(), OpCode.setData);
             int newVersion = checkAndIncVersion(nodeRecord.stat.getVersion(), setDataRequest.getVersion(), path);
             request.setTxn(new SetDataTxn(path, setDataRequest.getData(), newVersion));
             nodeRecord = nodeRecord.duplicate(request.getHdr().getZxid());
@@ -698,7 +698,7 @@ private void pRequest2TxnCreate(int type, Request request, Record record, boolea
             throw new KeeperException.NoChildrenForEphemeralsException(path);
         }
         int newCversion = parentRecord.stat.getCversion() + 1;
-        zks.checkQuota(path, data, OpCode.create);
+        zks.checkQuota(path, null, data, OpCode.create);
         if (type == OpCode.createContainer) {
             request.setTxn(new CreateContainerTxn(path, data, listACL, newCversion));
         } else if (type == OpCode.createTTL) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 3ffbb4b994d..8b3e4924b60 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -2020,14 +2020,15 @@ public void checkACL(ServerCnxn cnxn, List<ACL> acl, int perm, List<Id> ids, Str
      * check a path whether exceeded the quota.
      *
      * @param path
-     *            the path of the node
+     *            the path of the node, used for the quota prefix check
+     * @param lastData
+     *            the current node data, {@code null} for none
      * @param data
-     *            the data of the path
+     *            the data to be set, or {@code null} for none
      * @param type
      *            currently, create and setData need to check quota
      */
-
-    public void checkQuota(String path, byte[] data, int type) throws KeeperException.QuotaExceededException {
+    public void checkQuota(String path, byte[] lastData, byte[] data, int type) throws KeeperException.QuotaExceededException {
         if (!enforceQuota) {
             return;
         }
@@ -2043,11 +2044,6 @@ public void checkQuota(String path, byte[] data, int type) throws KeeperExceptio
                 checkQuota(lastPrefix, dataBytes, 1);
                 break;
             case OpCode.setData:
-                DataNode node = zkDatabase.getDataTree().getNode(path);
-                byte[] lastData;
-                synchronized (node) {
-                    lastData = node.getData();
-                }
                 checkQuota(lastPrefix, dataBytes - (lastData == null ? 0 : lastData.length), 0);
                 break;
              default:
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
index 67b524accef..aacd59e6719 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
@@ -20,13 +20,17 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
 import java.util.List;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.QuotaExceededException;
+import org.apache.zookeeper.Op;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
 import org.apache.zookeeper.ZooDefs.Ids;
@@ -396,6 +400,53 @@ public void testSetQuotaWhenExceedBothBytesAndCountHardQuota() throws Exception
         }
     }
 
+    @Test
+    public void testMultiCreateThenSetDataShouldWork() throws Exception {
+        final String path = "/a";
+        final String subPath = "/a/b";
+
+        zk.create(path, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        final byte[] data13b = "Hello, World!".getBytes(StandardCharsets.UTF_8);
+
+        final StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(data13b.length);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        final List<Op> ops = Arrays.asList(
+            Op.create(subPath, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+            Op.setData(subPath, data13b, -1));
+
+        zk.multi(ops);
+    }
+
+    @Test
+    public void testMultiCreateThenSetDataShouldFail() throws Exception {
+        final String path = "/a";
+        final String subPath = "/a/b";
+
+        zk.create(path, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        final byte[] data13b = "Hello, World!".getBytes(StandardCharsets.UTF_8);
+
+        final StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(data13b.length - 1);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        final List<Op> ops = Arrays.asList(
+            Op.create(subPath, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+            Op.setData(subPath, data13b, -1));
+
+        try {
+            zk.multi(ops);
+            fail("should fail transaction when hard quota is exceeded");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+
+        assertNull(zk.exists(subPath, null));
+    }
+
     @Test
     public void testDeleteBytesQuota() throws Exception {
 
@@ -501,4 +552,4 @@ public void testListQuota() throws Exception {
             }
         }
     }
-}
\ No newline at end of file
+}

From b4f9aab099880ba8ef08eaff697debe6cdeae057 Mon Sep 17 00:00:00 2001
From: Ching-Chan Lee <leechingchankyo@gmail.com>
Date: Mon, 1 Mar 2021 20:51:05 -0800
Subject: [PATCH 177/591] ZOOKEEPER-3922: The introduction of the oracle, a
 failure detector.

The introduction of the oracle makes ZooKeeper fault-tolerant in two-node systems.

The major changes are:
1. QuorumPeerConfig.java
- The changes allow users to enable the oracle and provide essential information.
- Create QuorumOracleMaj if configured.
2. FastLeaderElection.java
- A re-check mechanism checks the current received votes once the timeout expires.
- Add another case when receiving a LEADING notification for a node to locate the existed leader in two-node systems.
3. Leader.java
- Add a re-validation of outstanding proposals mechanism after the only follower goes away
- Add another handling case when the quorum is not maintainable. It queries the Oracle for maintaining the quorum along.
4. QuorumVerifier.java
- Add methods for QuorumOracleMaj.java
5. QuorumOracleMaj.java (This is a new file.)
- A sub-class of QuorumMaj
- It default reads a file that contains a binary value to behave as an Oracle.

Author: Ching-Chan Lee <leechingchankyo@gmail.com>

Reviewers: Benjamin Reed <breed@apache.org>, Michael Han <hanm@apache.org>

Closes #1444 from chingchan1996/ZOOKEEPER-3922
---
 .../markdown/zookeeperOracleQuorums.md        | 202 ++++++++++
 zookeeper-server/pom.xml                      |   6 +
 .../apache/zookeeper/cli/ReconfigCommand.java |   2 +-
 .../server/PrepRequestProcessor.java          |  13 +-
 .../server/quorum/FastLeaderElection.java     | 162 ++++++--
 .../zookeeper/server/quorum/Leader.java       |  30 +-
 .../zookeeper/server/quorum/QuorumPeer.java   |  19 +-
 .../server/quorum/QuorumPeerConfig.java       |  20 +-
 .../quorum/flexible/QuorumHierarchical.java   |   1 +
 .../server/quorum/flexible/QuorumMaj.java     |   6 +-
 .../quorum/flexible/QuorumOracleMaj.java      | 204 ++++++++++
 .../quorum/flexible/QuorumVerifier.java       |  36 ++
 .../server/quorum/EagerACLFilterTest.java     |   2 +-
 .../server/quorum/QuorumPeerConfigTest.java   |   1 +
 .../quorum/QuorumRequestPipelineTest.java     |   2 +-
 .../zookeeper/test/AsyncHammerTest.java       |   2 +-
 .../apache/zookeeper/test/ObserverLETest.java |   2 +-
 .../test/ObserverQuorumHammerTest.java        |   2 +-
 .../org/apache/zookeeper/test/QuorumBase.java | 124 +++++--
 .../test/QuorumBaseOracle_2Nodes.java         | 350 ++++++++++++++++++
 .../zookeeper/test/QuorumMajorityTest.java    |   4 +-
 .../zookeeper/test/QuorumOracleMajTest.java   | 121 ++++++
 .../test/ThrottledOpObserverTest.java         |   2 +-
 .../data/invalidsnap/version-2/snapshot.83f   | Bin 4824 -> 189686 bytes
 24 files changed, 1228 insertions(+), 85 deletions(-)
 create mode 100644 zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md b/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
new file mode 100644
index 00000000000..adc547778bb
--- /dev/null
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
@@ -0,0 +1,202 @@
+<!--
+Copyright 2002-2004 The Apache Software Foundation
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# Introduction to Oracle Quorum
+The introduction to Oracle Quorum increases the availability of a cluster of 2 ZooKeeper instances with a failure detector as known as the Oracle.
+ The Oracle is designed to grant the permission to the instance which is the only remaining instance
+in a 2-instance configuration when the other instance is identified as faulty by the fail detector, the Oracle.
+
+## The implementation of the Oracle
+Every instance shall access to a file which contains either 0 or 1 to indicate whether this instance is authorized by the Oracle.
+However, this design can be changed since the fail detector algorithms vary from each other. Therefore, ones can override the method of _askOracle()_ in _QuorumOracleMaj_ to adapt the preferred way of deciphering the message from the Oracle.
+
+## The deployment cotexts
+The Oracle is designed to increase the availability of a cluster of 2 ZooKeeper instances; thus, the size of the voting member is **2**.
+In other words, the Oracle solves the consensus problem of a possibility of faulty instance in a two-instance ensemble.
+
+In the case that the size of the voting members exceeds 2, the expected way to make the Oracle work correctly is to reconfigure the size of the cluster when a faulty machine is identified.
+For example, with a configuration of 5 instances, when a faulty machine breaks the connection with the Leader, it is expected to have a _reconfig_ client request to the cluster, which makes the cluster to re-form as the configuration of 4 instances.
+Therefore, once the size of the voting member equals to 2, the configuration falls into the problem domain which the Oracle is designed to address.
+
+## How to deploy the Oracle in _zoo.cfg_
+Regardless of the size of the cluster, the _oraclePath_ must be configured at the time of the initialization, which is like other static parameters.
+The below shows the correct way to specify and enable the Oracle.
+
+    oraclePath=/to/some/file
+    
+#### An example of zoo.cfg:
+
+    dataDir=/data
+    dataLogDir=/datalog
+    tickTime=2000
+    initLimit=5
+    syncLimit=2
+    autopurge.snapRetainCount=3
+    autopurge.purgeInterval=0
+    maxClientCnxns=60
+    standaloneEnabled=true
+    admin.enableServer=true
+    oraclePath=/chassis/mastership
+    server.1=0.0.0.0:2888:3888;2181
+    server.2=hw1:2888:3888;2181
+    
+The QuorumOracleMaj is designed to read the result of a failure detector, which is written on a text file, the oracle file.  
+The configuration in the zoo.cfg like the following:
+    
+    oraclePath=/to/some/file
+    
+Suppose you have the result of the failure detector written on /some/path/result.txt, and then the correct configuration is the following:
+
+    oraclePath=/some/path/result.txt
+    
+So, what is the correct content of the provided file? An example file can be created with the following command from the terminal:
+
+    $echo 1 > /some/path/result.txt
+    
+Any equivalent files are suitable for the current implementation of QuorumOracleMaj.
+The number of oracle files should be equal to the number of ZooKeeper instances configured to enable the Oracle.
+In other words, each ZooKeeper instance should have its oracle file, and the files shall not be shared; otherwise, the issues in the next section will arise.
+
+## What differs after the deployment of the Oracle enabled
+The _QuorumPeerConfig_ will create an instance of _QuorumOracleMaj_ instead of the default QuorumVerifier, _QuorumMaj_ when it reads the _zoo.cfg_ contains _oraclePath_.
+QuorumOracleMaj inheritances from QuorumMaj, and differs from its superclass by overriding the method of _containsQuorum()_.
+QuorumOracleMaj is designed to execute its version of _containsQuorum_ when the Leader loses all of its followers, and fails to maintain the quorum.
+In other cases, _QuorumOracleMaj_ shall execute as _QuorumMaj_.
+
+## What we should pay attention to the Oracle
+We consider an asynchronous distributed system which consists of **2** ZooKeeper instances and an Oracle.
+
+### Liveness Issue:
+When we consider the oracle satisfies the following property introduced by [CT]:
+
+    Strong Completeness: There is a time after which every process that crashes is permanently suspected by every correct processes
+
+The liveness of the system is ensured by the Oracle.
+However, when the introduced oracle fails to maintain this property, the lost of the liveness is expected as the following example,
+
+Suppose we have a Leader and a Follower, which are running in the broadcasting state,
+The system will lose its liveness when:
+
+    1. The Leader fails, but the Oracle does not detect the faulty Leader, which means the Oracle will not authorize the Follower to become a new Leader.
+    2. When a Follower fails, but the Oracle does not detect the faulty follower, which means the Oracle will authorize the Leader to move system forward.
+
+### Safety Issue:
+#### Lost of Progress
+The progress can lost when multiple failures occurs in the system at different time as the following example,
+
+Suppose we have a Leader(Ben) and a Follower(John) in the broadcasting state,
+
+    At T1 with zxid(0x1_1): L-Ben fails, and the F-John takes over the system under the authorization from the Oracle.
+    At T2 with zxid(0x2_1): The F-John becomes a new Leader, L-John, and starts a new epoch.
+    At T3 with zxid(0x2_A): L-John fails
+    At T4 with zxid(0x2_A): Ben recovers up and starts its leader election.
+    At T5 with zxid(0x3_1): Ben becomes the new leader, L-Ben, under the authorization from the Oracle.
+
+In this case, the system loses its progress after the L-Ben failed.
+
+
+However, the lost of progress can be prevented by making the Oracle is capable of referring the latest zxid. 
+When the Oracle could refer to the latest zxid,
+
+    At T5 with zxid(0x2_A): Ben will not end his leader election because the Oracle would not authorize although John is down.
+
+Nevertheless, we exchange the liveness for the safety.
+#### Split Brain Issue
+We consider the Oracle satisfies the following desired property introduced by [CT],
+
+    Accuracy: There is a time after which some correct processes is never suspected by any processes
+    
+Nevertheless, the decisions which the Oracle gives out should be mutual exclusive. 
+
+In other words,
+
+Suppose we have a Leader(Ben) and a Follower(John) in the broadcasting state,
+
+    - At any time, the Oracle will not authorize both Ben and John even though the failure detectors think each other is faulty.
+    Or
+    - At any time, for any two values in any two Oracle files respectively, the values are not both equal to 1.     
+
+The split brain is expected when the Oracle fails to maintain this property during the leader election phase of 
+
+    1. Start of the system 
+    2. A failed instance recovers from failures.
+    
+## Examples of Concepts for Implementation of a Failure Detector
+One should consider that the failure detector's outcome is to authorize the querying ZooKeeper instance whether it has the right to move the system forward without waiting for the faulty instance, which is identified by the failure detector.
+
+### An Implementation of Hardware
+Suppose two dedicated pieces of hardware, hw1 and hw2, can host ZooKeeper instances, zk1 and zk2, respectively, and form a cluster.
+A hardware device is attached to both of the hardware, and it is capable of determining whether the hardware is power on or not.
+So, when hw1 is not power on, the zk1 is undoubtedly faulty. 
+Therefore, the hardware device updates the oracle file on hw2 to 1, which indicates that zk1 is faulty and authorizes zk2 to move the system forwards.
+
+### An Implementation of Software
+Suppose two dedicated pieces of hardware, hw1 and hw2, can host ZooKeeper instances, zk1 and zk2, respectively, and form a cluster.
+One can have two more services, o1 and o2, on hw1 and hw2, respectively. The job of o1 and o2 are detecting the other hardware is alive or not.
+For example, o1 can constantly ping hw2 to determine if hw2 is power on or not.
+When o1 cannot ping hw2, o1 identifies that hw2 is faulty and then update the oracle file of zk1 to 1, which indicates that zk2 is faulty and authorizes zk1 to move the system forwards.
+  
+### Use USB devices as Oracle to Maintain Progress
+In macOS,10.15.7 (19H2), the external storage devices are mounted under `/Volumes`. 
+Thus, we can insert a USB device which contains the required information as the oracle.
+When the device is connected, the oracle authorizes the leader to move system forward, which also means the other instance fails.
+There are **SIX** steps to reproduce this stimulation.
+
+* Firstly, insert a USB device named `Oracle`, and then we can expect that  `/Volumes/Oracle` is accessible.
+* Secondly, we create a file contains `1` under `/Volumes/Oracle` named `mastership`.
+Now we can access `/Volumes/Oracle/mastership`, and so does the zookeeper instances to see whether it has the right to move the system forward.
+The file can easily be generated by the following command:
+
+
+    $echo 1 > mastership
+
+* Thirdly, you shall have a `zoo.cfg` like the example below:
+
+
+    dataDir=/data
+    dataLogDir=/datalog
+    tickTime=2000
+    initLimit=5
+    syncLimit=2
+    autopurge.snapRetainCount=3
+    autopurge.purgeInterval=0
+    maxClientCnxns=60
+    standaloneEnabled=true
+    admin.enableServer=true
+    oraclePath=/Volumes/Oracle/mastership
+    server.1=0.0.0.0:2888:3888;2181
+    server.2=hw1:2888:3888;2181
+    
+_(NOTE) The split brain issues will not occur because there is only a SINGLE USB device in this stimulation._
+_Additionally, `mastership` should not be shared by multiple instances._
+_Thus, only one ZooKeeper instance is configured with Oracle._
+_For more, please refer to Section Safety Issue._
+
+* Fourthly, start the cluster, and it is expected it forms a quorum normally.
+* Fifthly, terminate the instance either without attaching to a USB device or `mastership` contains 0.
+There are two scenarios to expect:
+  1. A leader failure occurs, and the remained instance finishes the leader election on its own due to the oracle.
+  2. The quorum is still maintained due to the oracle.
+  
+* Lastly, when the USB device is removed, `/Volumes/Oracle/mastership` becomes unavailable.
+Therefore, according to the current implementation, whenever the Leader queries the oracle, the oracle throws an exception and return `FALSE`.
+Repeat the fifth step, and then it is expected that either the system cannot recover from a leader failure ,or the leader loses the quorum.
+In either case, the service is interrupted.
+
+With these steps, we can show and practice how the oracle works with two-instance systems with ease.
+
+##REFERENCE
+[CT] Tushar Deepak Chandra and Sam Toueg. 1991. Unreliable failure detectors for asynchronous systems (preliminary version). In <i>Proceedings of the tenth annual ACM symposium on Principles of distributed computing</i> (<i>PODC '91</i>). Association for Computing Machinery, New York, NY, USA, 325–340. DOI:https://doi.org/10.1145/112600.112627
\ No newline at end of file
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 90ee82760ee..2636f5cd969 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -172,6 +172,12 @@
       <artifactId>snappy-java</artifactId>
       <scope>provided</scope>
     </dependency>
+      <dependency>
+          <groupId>commons-io</groupId>
+          <artifactId>commons-io</artifactId>
+          <version>2.6</version>
+          <scope>compile</scope>
+      </dependency>
   </dependencies>
 
   <build>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
index 8afc14bb517..ce490ad8039 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
@@ -130,7 +130,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
                 //check that membership makes sense; leader will make these checks again
                 //don't check for leader election ports since
                 //client doesn't know what leader election alg is used
-                members = QuorumPeerConfig.parseDynamicConfig(dynamicCfg, 0, true, false).toString();
+                members = QuorumPeerConfig.parseDynamicConfig(dynamicCfg, 0, true, false, null).toString();
             } catch (Exception e) {
                 throw new CliParseException("Error processing " + cl.getOptionValue("file") + e.getMessage());
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index e71828d262b..11b5ccbc8d3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -65,6 +65,7 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.txn.CheckVersionTxn;
 import org.apache.zookeeper.txn.CloseSessionTxn;
@@ -452,7 +453,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                 try {
                     Properties props = new Properties();
                     props.load(new StringReader(newMembers));
-                    request.qv = QuorumPeerConfig.parseDynamicConfig(props, lzks.self.getElectionType(), true, false);
+                    request.qv = QuorumPeerConfig.parseDynamicConfig(props, lzks.self.getElectionType(), true, false, lastSeenQV.getOraclePath());
                     request.qv.setVersion(request.getHdr().getZxid());
                 } catch (IOException | ConfigException e) {
                     throw new KeeperException.BadArgumentsException(e.getMessage());
@@ -472,7 +473,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                     leavingServers = StringUtils.split(leavingServersString, ",");
                 }
 
-                if (!(lastSeenQV instanceof QuorumMaj)) {
+                if (!(lastSeenQV instanceof QuorumMaj) && !(lastSeenQV instanceof QuorumOracleMaj)) {
                     String msg = "Incremental reconfiguration requested but last configuration seen has a non-majority quorum system";
                     LOG.warn(msg);
                     throw new KeeperException.BadArgumentsException(msg);
@@ -514,7 +515,13 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                 } catch (ConfigException e) {
                     throw new KeeperException.BadArgumentsException("Reconfiguration failed");
                 }
-                request.qv = new QuorumMaj(nextServers);
+
+                if (lastSeenQV instanceof QuorumMaj) {
+                    request.qv = new QuorumMaj(nextServers);
+                } else {
+                    request.qv = new QuorumOracleMaj(nextServers, lastSeenQV.getOraclePath());
+                }
+
                 request.qv.setVersion(request.getHdr().getZxid());
             }
             if (QuorumPeerConfig.isStandaloneEnabled() && request.qv.getVotingMembers().size() < 2) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 0950c6d4c2e..9fc9d148c39 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -34,6 +34,7 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.slf4j.Logger;
@@ -948,7 +949,7 @@ public Vote lookForLeader() throws InterruptedException {
                 Long.toHexString(proposedZxid));
             sendNotifications();
 
-            SyncedLearnerTracker voteSet;
+            SyncedLearnerTracker voteSet = null;
 
             /*
              * Loop in which we exchange notifications until we find a leader
@@ -977,7 +978,24 @@ public Vote lookForLeader() throws InterruptedException {
                      */
                     int tmpTimeOut = notTimeout * 2;
                     notTimeout = Math.min(tmpTimeOut, maxNotificationInterval);
+
+                    /*
+                     * When a leader failure happens on a master, the backup will be supposed to receive the honour from
+                     * Oracle and become a leader, but the honour is likely to be delay. We do a re-check once timeout happens
+                     *
+                     * The leader election algorithm does not provide the ability of electing a leader from a single instance
+                     * which is in a configuration of 2 instances.
+                     * */
+                    self.getQuorumVerifier().revalidateVoteset(voteSet, notTimeout != minNotificationInterval);
+                    if (self.getQuorumVerifier() instanceof QuorumOracleMaj && voteSet != null && voteSet.hasAllQuorums() && notTimeout != minNotificationInterval) {
+                        setPeerState(proposedLeader, voteSet);
+                        Vote endVote = new Vote(proposedLeader, proposedZxid, logicalclock.get(), proposedEpoch);
+                        leaveInstance(endVote);
+                        return endVote;
+                    }
+
                     LOG.info("Notification time out: {} ms", notTimeout);
+
                 } else if (validVoter(n.sid) && validVoter(n.leader)) {
                     /*
                      * Only proceed if the vote comes from a replica in the current or next
@@ -1051,43 +1069,53 @@ public Vote lookForLeader() throws InterruptedException {
                     case OBSERVING:
                         LOG.debug("Notification from observer: {}", n.sid);
                         break;
+
+                        /*
+                        * In ZOOKEEPER-3922, we separate the behaviors of FOLLOWING and LEADING.
+                        * To avoid the duplication of codes, we create a method called followingBehavior which was used to
+                        * shared by FOLLOWING and LEADING. This method returns a Vote. When the returned Vote is null, it follows
+                        * the original idea to break swtich statement; otherwise, a valid returned Vote indicates, a leader
+                        * is generated.
+                        *
+                        * The reason why we need to separate these behaviors is to make the algorithm runnable for 2-node
+                        * setting. An extra condition for generating leader is needed. Due to the majority rule, only when
+                        * there is a majority in the voteset, a leader will be generated. However, in a configuration of 2 nodes,
+                        * the number to achieve the majority remains 2, which means a recovered node cannot generate a leader which is
+                        * the existed leader. Therefore, we need the Oracle to kick in this situation. In a two-node configuration, the Oracle
+                        * only grants the permission to maintain the progress to one node. The oracle either grants the permission to the
+                        * remained node and makes it a new leader when there is a faulty machine, which is the case to maintain the progress.
+                        * Otherwise, the oracle does not grant the permission to the remained node, which further causes a service down.
+                        *
+                        * In the former case, when a failed server recovers and participate in the leader election, it would not locate a
+                        * new leader because there does not exist a majority in the voteset. It fails on the containAllQuorum() infinitely due to
+                        * two facts. First one is the fact that it does do not have a majority in the voteset. The other fact is the fact that
+                        * the oracle would not give the permission since the oracle already gave the permission to the existed leader, the healthy machine.
+                        * Logically, when the oracle replies with negative, it implies the existed leader which is LEADING notification comes from is a valid leader.
+                        * To threat this negative replies as a permission to generate the leader is the purpose to separate these two behaviors.
+                        *
+                        *
+                        * */
                     case FOLLOWING:
-                    case LEADING:
                         /*
-                         * Consider all notifications from the same epoch
-                         * together.
-                         */
-                        if (n.electionEpoch == logicalclock.get()) {
-                            recvset.put(n.sid, new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-                            voteSet = getVoteTracker(recvset, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-                            if (voteSet.hasAllQuorums() && checkLeader(recvset, n.leader, n.electionEpoch)) {
-                                setPeerState(n.leader, voteSet);
-                                Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
-                                leaveInstance(endVote);
-                                return endVote;
-                            }
+                        * To avoid duplicate codes
+                        * */
+                        Vote resultFN = receivedFollowingNotification(recvset, outofelection, voteSet, n);
+                        if (resultFN == null) {
+                            break;
+                        } else {
+                            return resultFN;
                         }
-
+                    case LEADING:
                         /*
-                         * Before joining an established ensemble, verify that
-                         * a majority are following the same leader.
-                         *
-                         * Note that the outofelection map also stores votes from the current leader election.
-                         * See ZOOKEEPER-1732 for more information.
-                         */
-                        outofelection.put(n.sid, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-                        voteSet = getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-
-                        if (voteSet.hasAllQuorums() && checkLeader(outofelection, n.leader, n.electionEpoch)) {
-                            synchronized (this) {
-                                logicalclock.set(n.electionEpoch);
-                                setPeerState(n.leader, voteSet);
-                            }
-                            Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
-                            leaveInstance(endVote);
-                            return endVote;
+                        * In leadingBehavior(), it performs followingBehvior() first. When followingBehavior() returns
+                        * a null pointer, ask Oracle whether to follow this leader.
+                        * */
+                        Vote resultLN = receivedLeadingNotification(recvset, outofelection, voteSet, n);
+                        if (resultLN == null) {
+                            break;
+                        } else {
+                            return resultLN;
                         }
-                        break;
                     default:
                         LOG.warn("Notification state unrecognized: {} (n.state), {}(n.sid)", n.state, n.sid);
                         break;
@@ -1115,6 +1143,74 @@ public Vote lookForLeader() throws InterruptedException {
         }
     }
 
+    private Vote receivedFollowingNotification(Map<Long, Vote> recvset, Map<Long, Vote> outofelection, SyncedLearnerTracker voteSet, Notification n) {
+        /*
+         * Consider all notifications from the same epoch
+         * together.
+         */
+        if (n.electionEpoch == logicalclock.get()) {
+            recvset.put(n.sid, new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+            voteSet = getVoteTracker(recvset, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+            if (voteSet.hasAllQuorums() && checkLeader(recvset, n.leader, n.electionEpoch)) {
+                setPeerState(n.leader, voteSet);
+                Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
+                leaveInstance(endVote);
+                return endVote;
+            }
+        }
+
+        /*
+         * Before joining an established ensemble, verify that
+         * a majority are following the same leader.
+         *
+         * Note that the outofelection map also stores votes from the current leader election.
+         * See ZOOKEEPER-1732 for more information.
+         */
+        outofelection.put(n.sid, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+        voteSet = getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+
+        if (voteSet.hasAllQuorums() && checkLeader(outofelection, n.leader, n.electionEpoch)) {
+            synchronized (this) {
+                logicalclock.set(n.electionEpoch);
+                setPeerState(n.leader, voteSet);
+            }
+            Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
+            leaveInstance(endVote);
+            return endVote;
+        }
+
+        return null;
+    }
+
+    private Vote receivedLeadingNotification(Map<Long, Vote> recvset, Map<Long, Vote> outofelection, SyncedLearnerTracker voteSet, Notification n) {
+        /*
+        *
+        * In a two-node configuration, a recovery nodes cannot locate a leader because of the lack of the majority in the voteset.
+        * Therefore, it is the time for Oracle to take place as a tight breaker.
+        *
+        * */
+        Vote result = receivedFollowingNotification(recvset, outofelection, voteSet, n);
+        if (result == null) {
+            /*
+            * Ask Oracle to see if it is okay to follow this leader.
+            *
+            * We don't need the CheckLeader() because itself cannot be a leader candidate
+            * */
+            if (self.getQuorumVerifier().getNeedOracle() && !self.getQuorumVerifier().askOracle()) {
+                LOG.info("Oracle indicates to follow");
+                setPeerState(n.leader, voteSet);
+                Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
+                leaveInstance(endVote);
+                return endVote;
+            } else {
+                LOG.info("Oracle indicates not to follow");
+                return null;
+            }
+        } else {
+            return result;
+        }
+    }
+
     /**
      * Check if a given sid is represented in either the current or
      * the next voting view
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 2de2ceeb8b0..ce8f7999c45 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -174,6 +174,10 @@ public List<LearnerHandler> getNonVotingFollowers() {
     void addForwardingFollower(LearnerHandler lh) {
         synchronized (forwardingFollowers) {
             forwardingFollowers.add(lh);
+            /*
+            * Any changes on forwardiongFollowers could possible affect the need of Oracle.
+            * */
+            self.getQuorumVerifier().updateNeedOracle(new ArrayList<>(forwardingFollowers));
         }
     }
 
@@ -757,7 +761,27 @@ void lead() throws IOException, InterruptedException {
                         break;
                     }
 
-                    if (!tickSkip && !syncedAckSet.hasAllQuorums()) {
+                    /*
+                     *
+                     * We will need to re-validate the outstandingProposal to maintain the progress of ZooKeeper.
+                     * It is likely a proposal is waiting for enough ACKs to be committed. The proposals are sent out, but the
+                     * only follower goes away which makes the proposals will not be committed until the follower recovers back.
+                     * An earlier proposal which is not committed will block any further proposals. So, We need to re-validate those
+                     * outstanding proposal with the help from Oracle. A key point in the process of re-validation is that the proposals
+                     * need to be processed in order.
+                     *
+                     * We make the whole method blocking to avoid any possible race condition on outstandingProposal and lastCommitted
+                     * as well as to avoid nested synchronization.
+                     *
+                     * As a more generic approach, we pass the object of forwardingFollowers to QuorumOracleMaj to determine if we need
+                     * the help from Oracle.
+                     *
+                     *
+                     * the size of outstandingProposals can be 1. The only one outstanding proposal is the one waiting for the ACK from
+                     * the leader itself.
+                     * */
+                    if (!tickSkip && !syncedAckSet.hasAllQuorums()
+                        && !(self.getQuorumVerifier().overrideQuorumDecision(getForwardingFollowers()) && self.getQuorumVerifier().revalidateOutstandingProp(this, new ArrayList<>(outstandingProposals.values()), lastCommitted))) {
                         // Lost quorum of last committed and/or last proposed
                         // config, set shutdown flag
                         shutdownMessage = "Not sufficient followers synced, only synced with sids: [ "
@@ -909,10 +933,10 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
         // commit proposals in order
         if (zxid != lastCommitted + 1) {
             LOG.warn(
-                "Commiting zxid 0x{} from {} noy first!",
+                "Commiting zxid 0x{} from {} not first!",
                 Long.toHexString(zxid),
                 followerAddr);
-            LOG.warn("First is {}", (lastCommitted + 1));
+            LOG.warn("First is 0x{}", Long.toHexString(lastCommitted + 1));
         }
 
         outstandingProposals.remove(zxid);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 3102c6379ed..19aae086027 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -78,6 +78,7 @@
 import org.apache.zookeeper.server.quorum.auth.SaslQuorumAuthLearner;
 import org.apache.zookeeper.server.quorum.auth.SaslQuorumAuthServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.ConfigUtils;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
@@ -1254,6 +1255,22 @@ public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File snapDir, File logDir
             new QuorumMaj(quorumPeers));
     }
 
+    public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File snapDir, File logDir, int clientPort, int electionAlg, long myid, int tickTime, int initLimit, int syncLimit, int connectToLearnerMasterLimit, String oraclePath) throws IOException {
+        this(
+                quorumPeers,
+                snapDir,
+                logDir,
+                electionAlg,
+                myid,
+                tickTime,
+                initLimit,
+                syncLimit,
+                connectToLearnerMasterLimit,
+                false,
+                ServerCnxnFactory.createFactory(getClientAddress(quorumPeers, myid, clientPort), -1),
+                new QuorumOracleMaj(quorumPeers, oraclePath));
+    }
+
     /**
      * This constructor is only used by the existing unit test code.
      * It defaults to FileLogProvider persistence provider.
@@ -1808,7 +1825,7 @@ public int getTick() {
     public QuorumVerifier configFromString(String s) throws IOException, ConfigException {
         Properties props = new Properties();
         props.load(new StringReader(s));
-        return QuorumPeerConfig.parseDynamicConfig(props, electionType, false, false);
+        return QuorumPeerConfig.parseDynamicConfig(props, electionType, false, false, getQuorumVerifier().getOraclePath());
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index c56204f1f76..1b37f291f51 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -52,6 +52,7 @@
 import org.apache.zookeeper.server.quorum.auth.QuorumAuth;
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
@@ -130,6 +131,8 @@ public class QuorumPeerConfig {
         Integer.parseInt(System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_REACHABILITY_CHECK_TIMEOUT_MS,
                                             String.valueOf(MultipleAddresses.DEFAULT_TIMEOUT.toMillis())));
 
+    protected String oraclePath;
+
     /**
      * Minimum snapshot retain count.
      * @see org.apache.zookeeper.server.PurgeTxnLog#purge(File, File, int)
@@ -380,6 +383,8 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
                 multiAddressReachabilityCheckTimeoutMs = Integer.parseInt(value);
             } else if (key.equals("multiAddress.reachabilityCheckEnabled")) {
                 multiAddressReachabilityCheckEnabled = parseBoolean(key, value);
+            } else if (key.equals("oraclePath")) {
+                oraclePath = value;
             } else {
                 System.setProperty("zookeeper." + key, value);
             }
@@ -629,6 +634,15 @@ public static void deleteFile(String filename) {
         }
     }
 
+
+    private static QuorumVerifier createQuorumVerifier(Properties dynamicConfigProp, boolean isHierarchical, String oraclePath) throws ConfigException {
+        if (oraclePath == null) {
+            return createQuorumVerifier(dynamicConfigProp, isHierarchical);
+        } else {
+            return new QuorumOracleMaj(dynamicConfigProp, oraclePath);
+        }
+    }
+
     private static QuorumVerifier createQuorumVerifier(Properties dynamicConfigProp, boolean isHierarchical) throws ConfigException {
         if (isHierarchical) {
             return new QuorumHierarchical(dynamicConfigProp);
@@ -642,7 +656,7 @@ private static QuorumVerifier createQuorumVerifier(Properties dynamicConfigProp,
     }
 
     void setupQuorumPeerConfig(Properties prop, boolean configBackwardCompatibilityMode) throws IOException, ConfigException {
-        quorumVerifier = parseDynamicConfig(prop, electionAlg, true, configBackwardCompatibilityMode);
+        quorumVerifier = parseDynamicConfig(prop, electionAlg, true, configBackwardCompatibilityMode, oraclePath);
         setupMyId();
         setupClientPort();
         setupPeerType();
@@ -656,7 +670,7 @@ void setupQuorumPeerConfig(Properties prop, boolean configBackwardCompatibilityM
      * @throws IOException
      * @throws ConfigException
      */
-    public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, int eAlg, boolean warnings, boolean configBackwardCompatibilityMode) throws IOException, ConfigException {
+    public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, int eAlg, boolean warnings, boolean configBackwardCompatibilityMode, String oraclePath) throws IOException, ConfigException {
         boolean isHierarchical = false;
         for (Entry<Object, Object> entry : dynamicConfigProp.entrySet()) {
             String key = entry.getKey().toString().trim();
@@ -668,7 +682,7 @@ public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, in
             }
         }
 
-        QuorumVerifier qv = createQuorumVerifier(dynamicConfigProp, isHierarchical);
+        QuorumVerifier qv = createQuorumVerifier(dynamicConfigProp, isHierarchical, oraclePath);
 
         int numParticipators = qv.getVotingMembers().size();
         int numObservers = qv.getObservingMembers().size();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
index ced966f58c2..5376ae6c520 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
@@ -120,6 +120,7 @@ public boolean equals(Object o) {
         }
         return true;
     }
+
     /**
      * This constructor requires the quorum configuration
      * to be declared in a separate file, and it takes the
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
index 6e6f1c2887d..ed38533ec42 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
@@ -26,6 +26,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * This class implements a validator for majority quorums. The implementation is
@@ -34,11 +36,13 @@
  */
 public class QuorumMaj implements QuorumVerifier {
 
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumMaj.class);
+
     private Map<Long, QuorumServer> allMembers = new HashMap<Long, QuorumServer>();
     private Map<Long, QuorumServer> votingMembers = new HashMap<Long, QuorumServer>();
     private Map<Long, QuorumServer> observingMembers = new HashMap<Long, QuorumServer>();
     private long version = 0;
-    private int half;
+    protected int half;
 
     public int hashCode() {
         assert false : "hashCode not designed";
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
new file mode 100644
index 00000000000..0845b802979
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
@@ -0,0 +1,204 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum.flexible;
+
+import java.io.FileReader;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import org.apache.commons.io.FilenameUtils;
+import org.apache.zookeeper.server.quorum.Leader;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.server.quorum.SyncedLearnerTracker;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/*
+ *
+ * QuorumOracleMaj is a subclass of QuorumMaj.
+ *
+ * QuorumOracleMaj is designed to be functional in a 2-nodes configuration. The only method that this class overrides super
+ * class' method is containsQuorum(). Besides the check of oracle, it also checks the number of voting member. Whenever the
+ * number of voting members is greater than 2. QuorumOracleMaj shall function as hook to its super class.
+ * */
+public class QuorumOracleMaj extends QuorumMaj {
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumOracleMaj.class);
+
+    private String oracle = null;
+
+    private final AtomicBoolean needOracle = new AtomicBoolean(true);
+
+    public QuorumOracleMaj(Map<Long, QuorumPeer.QuorumServer> allMembers, String oraclePath) {
+        super(allMembers);
+        setOracle(oraclePath);
+    }
+
+    public QuorumOracleMaj(Properties props, String oraclePath) throws QuorumPeerConfig.ConfigException {
+        super(props);
+        setOracle(oraclePath);
+    }
+
+    private void setOracle(String path) {
+        if (oracle == null) {
+            oracle = path;
+            LOG.info("Oracle is set to {}", path);
+        } else {
+            LOG.warn("Oracle is already set. Ignore:{}", path);
+        }
+    }
+
+    @Override
+    public boolean updateNeedOracle(List<LearnerHandler> forwardingFollowers) {
+        // Do we have the quorum
+        needOracle.set(forwardingFollowers.isEmpty() && super.getVotingMembers().size() == 2);
+        return needOracle.get();
+    }
+
+    @Override
+    public boolean askOracle() {
+        FileReader fr = null;
+        try {
+            int read;
+            fr = new FileReader(FilenameUtils.getFullPath(oracle) + FilenameUtils.getName(oracle));
+            read = fr.read();
+            LOG.debug("Oracle says:{}", (char) read);
+            fr.close();
+            return (char) read == '1';
+        } catch (Exception e) {
+            e.printStackTrace();
+            if (oracle == null) {
+                LOG.error("Oracle is not set, return false");
+            }
+            return false;
+        } finally {
+            if (fr != null) {
+                try {
+                    fr.close();
+                } catch (IOException e) {
+                    e.printStackTrace();
+                }
+            }
+        }
+    }
+
+    @Override
+    public boolean getNeedOracle() {
+        return needOracle.get();
+    }
+
+    @Override
+    public String getOraclePath() {
+        return oracle;
+    }
+
+    @Override
+    public boolean overrideQuorumDecision(List<LearnerHandler> forwardingFollowers) {
+        if (updateNeedOracle(forwardingFollowers) && askOracle()) {
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public boolean revalidateOutstandingProp(Leader self, ArrayList<Leader.Proposal> outstandingProposal, long lastCommitted) {
+        LOG.debug("Start Revalidation outstandingProposals");
+        try {
+            while (outstandingProposal.size() >= 1) {
+                outstandingProposal.sort((o1, o2) -> (int) (o1.packet.getZxid() - o2.packet.getZxid()));
+
+                Leader.Proposal p;
+                int i = 0;
+                while (i < outstandingProposal.size()) {
+                    p = outstandingProposal.get(i);
+                    if (p.request.zxid > lastCommitted) {
+                        LOG.debug("Re-validate outstanding proposal: 0x{} size:{} lastCommitted:{}", Long.toHexString(p.request.zxid), outstandingProposal.size(), Long.toHexString(lastCommitted));
+                        if (!self.tryToCommit(p, p.request.zxid, null)) {
+                            break;
+                        } else {
+                            lastCommitted = p.request.zxid;
+                            outstandingProposal.remove(p);
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+            return false;
+        }
+
+        LOG.debug("Finish Revalidation outstandingProposals");
+        return true;
+    }
+
+    @Override
+    public boolean revalidateVoteset(SyncedLearnerTracker voteSet, boolean timeout) {
+        return voteSet != null && voteSet.hasAllQuorums() && timeout;
+    }
+
+    @Override
+    public boolean containsQuorum(Set<Long> ackSet) {
+        if (oracle == null || getVotingMembers().size() > 2) {
+            return super.containsQuorum(ackSet);
+        } else if (!super.containsQuorum(ackSet)) {
+            if (getNeedOracle()) {
+                LOG.debug("We lose the quorum, but we do not have any valid followers Oracle:{}", askOracle());
+                return askOracle();
+            } else {
+                return false;
+            }
+        } else {
+            return true;
+        }
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        QuorumOracleMaj qm = (QuorumOracleMaj) o;
+        if (qm.getVersion() == super.getVersion()) {
+            return true;
+        }
+        if (super.getAllMembers().size() != qm.getAllMembers().size()) {
+            return false;
+        }
+        for (QuorumPeer.QuorumServer qs : super.getAllMembers().values()) {
+            QuorumPeer.QuorumServer qso = qm.getAllMembers().get(qs.id);
+            if (qso == null || !qs.equals(qso)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        assert false : "hashCode not designed";
+        return 43; // any arbitrary constant will do
+    }
+}
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java
index 12d84890f06..7362313552c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java
@@ -18,9 +18,14 @@
 
 package org.apache.zookeeper.server.quorum.flexible;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import org.apache.zookeeper.server.quorum.Leader;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.SyncedLearnerTracker;
 
 /**
  * All quorum validators have to implement a method called
@@ -39,6 +44,37 @@ public interface QuorumVerifier {
     Map<Long, QuorumServer> getVotingMembers();
     Map<Long, QuorumServer> getObservingMembers();
     boolean equals(Object o);
+    /*
+    * Only QuorumOracleMaj will implement these methods. Other class will raise warning if the methods are called and
+    * return false always.
+    * */
+    default boolean updateNeedOracle(List<LearnerHandler> forwardingFollowers) {
+        return false;
+    }
+    default boolean getNeedOracle() {
+        return false;
+    }
+
+    default boolean askOracle() {
+        return false;
+    }
+
+    default boolean overrideQuorumDecision(List<LearnerHandler> forwardingFollowers) {
+        return false;
+    }
+
+    default boolean revalidateOutstandingProp(Leader self, ArrayList<Leader.Proposal> outstandingProposal, long lastCommitted) {
+        return false;
+    }
+
+    default boolean revalidateVoteset(SyncedLearnerTracker voteSet, boolean timeout) {
+        return false;
+    }
+
+    default String getOraclePath() {
+        return null;
+    };
+
     String toString();
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
index d37516bd3bf..a27d5cf9f0f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
@@ -72,7 +72,7 @@ public void setUp(ServerState serverState, boolean checkEnabled) throws Exceptio
         ensureCheck(checkEnabled);
         CountdownWatcher clientWatch = new CountdownWatcher();
         CountdownWatcher clientWatchB = new CountdownWatcher();
-        super.setUp(true);
+        super.setUp(true, true);
 
         String hostPort = getPeersMatching(serverState).split(",")[0];
         int clientPort = Integer.parseInt(hostPort.split(":")[1]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
index b2c350e3edd..407a9d1a58b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
@@ -203,6 +203,7 @@ public void testParseBoolean() throws IOException, ConfigException {
     private Properties getDefaultZKProperties() {
         Properties zkProp = new Properties();
         zkProp.setProperty("dataDir", new File("myDataDir").getAbsolutePath());
+        zkProp.setProperty("oraclePath", new File("mastership").getAbsolutePath());
         return zkProp;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
index 0888d6fb505..c395a62e6be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
@@ -69,7 +69,7 @@ public void setUp() {
 
     public void setUp(ServerState serverState) throws Exception {
         CountdownWatcher clientWatch = new CountdownWatcher();
-        super.setUp(true);
+        super.setUp(true, true);
         zkClient = createClient(clientWatch, getPeersMatching(serverState));
         zkClient.addAuthInfo(AUTH_PROVIDER, AUTH);
         clientWatch.waitForConnected(CONNECTION_TIMEOUT);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
index 2276354d15e..108b21c0f09 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
@@ -47,7 +47,7 @@ public class AsyncHammerTest extends ZKTestCase implements StringCallback, VoidC
     private volatile boolean bang;
 
     public void setUp(boolean withObservers) throws Exception {
-        qb.setUp(withObservers);
+        qb.setUp(withObservers, false);
     }
 
     protected void restart() throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
index 014ccb4df0c..67aa5959263 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
@@ -35,7 +35,7 @@ public class ObserverLETest extends ZKTestCase {
 
     @BeforeEach
     public void establishThreeParticipantOneObserverEnsemble() throws Exception {
-        qb.setUp(true);
+        qb.setUp(true, false);
         ct.hostPort = qb.hostPort;
         ct.setUpAll();
         qb.s5.shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
index 00953f792f3..45e37f2da04 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
@@ -28,7 +28,7 @@ public class ObserverQuorumHammerTest extends QuorumHammerTest {
     @BeforeEach
     @Override
     public void setUp() throws Exception {
-        qb.setUp(true);
+        qb.setUp(true, false);
         cht.hostPort = qb.hostPort;
         cht.setUpAll();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index 02e5e0a034c..c2396a6403d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -22,6 +22,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.io.FileWriter;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -48,6 +49,13 @@ public class QuorumBase extends ClientBase {
 
     private static final String LOCALADDR = "127.0.0.1";
 
+    private static final String oraclePath_0 = "./tmp/oraclePath/0/mastership/";
+    private static final String oraclePath_1 = "./tmp/oraclePath/1/mastership/";
+    private static final String oraclePath_2 = "./tmp/oraclePath/0/mastership/";
+    private static final String oraclePath_3 = "./tmp/oraclePath/1/mastership/";
+    private static final String oraclePath_4 = "./tmp/oraclePath/0/mastership/";
+    private static final String mastership = "value";
+
     File s1dir, s2dir, s3dir, s4dir, s5dir;
     QuorumPeer s1, s2, s3, s4, s5;
     protected int port1;
@@ -71,13 +79,14 @@ public class QuorumBase extends ClientBase {
     protected boolean localSessionsEnabled = false;
     protected boolean localSessionsUpgradingEnabled = false;
 
+
     @BeforeEach
     @Override
     public void setUp() throws Exception {
-        setUp(false);
+        setUp(false, true);
     }
 
-    protected void setUp(boolean withObservers) throws Exception {
+    protected void setUp(boolean withObservers, boolean withOracle) throws Exception {
         LOG.info("QuorumBase.setup {}", getTestName());
         setupTestEnv();
 
@@ -121,21 +130,54 @@ protected void setUp(boolean withObservers) throws Exception {
         s4dir = ClientBase.createTmpDir();
         s5dir = ClientBase.createTmpDir();
 
-        startServers(withObservers);
+        startServers(withObservers, withOracle);
 
         OSMXBean osMbean = new OSMXBean();
         if (osMbean.getUnix()) {
             LOG.info("Initial fdcount is: {}", osMbean.getOpenFileDescriptorCount());
         }
 
+        if (withOracle) {
+            File directory = new File(oraclePath_0);
+            directory.mkdirs();
+            FileWriter fw = new FileWriter(oraclePath_0 + mastership);
+            fw.write("1");
+            fw.close();
+
+            directory = new File(oraclePath_1);
+            directory.mkdirs();
+            fw = new FileWriter(oraclePath_1 + mastership);
+            fw.write("0");
+            fw.close();
+
+            directory = new File(oraclePath_2);
+            directory.mkdirs();
+            fw = new FileWriter(oraclePath_2 + mastership);
+            fw.write("0");
+            fw.close();
+
+            directory = new File(oraclePath_3);
+            directory.mkdirs();
+            fw = new FileWriter(oraclePath_3 + mastership);
+            fw.write("1");
+            fw.close();
+
+            directory = new File(oraclePath_4);
+            directory.mkdirs();
+            fw = new FileWriter(oraclePath_4 + mastership);
+            fw.write("0");
+            fw.close();
+        }
+
+
         LOG.info("Setup finished");
     }
 
     void startServers() throws Exception {
-        startServers(false);
+        startServers(false, true);
     }
 
-    void startServers(boolean withObservers) throws Exception {
+    void startServers(boolean withObservers, boolean withOracle) throws Exception {
         int tickTime = 2000;
         int initLimit = 3;
         int syncLimit = 3;
@@ -152,21 +194,39 @@ void startServers(boolean withObservers) throws Exception {
             peers.get(Long.valueOf(5)).type = LearnerType.OBSERVER;
         }
 
-        LOG.info("creating QuorumPeer 1 port {}", portClient1);
-        s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient1, s1.getClientPort());
-        LOG.info("creating QuorumPeer 2 port {}", portClient2);
-        s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient2, s2.getClientPort());
-        LOG.info("creating QuorumPeer 3 port {}", portClient3);
-        s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient3, s3.getClientPort());
-        LOG.info("creating QuorumPeer 4 port {}", portClient4);
-        s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient4, s4.getClientPort());
-        LOG.info("creating QuorumPeer 5 port {}", portClient5);
-        s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient5, s5.getClientPort());
+        if (!withOracle) {
+            LOG.info("creating QuorumPeer 1 port {}", portClient1);
+            s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient1, s1.getClientPort());
+            LOG.info("creating QuorumPeer 2 port {}", portClient2);
+            s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient2, s2.getClientPort());
+            LOG.info("creating QuorumPeer 3 port {}", portClient3);
+            s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient3, s3.getClientPort());
+            LOG.info("creating QuorumPeer 4 port {}", portClient4);
+            s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient4, s4.getClientPort());
+            LOG.info("creating QuorumPeer 5 port {}", portClient5);
+            s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient5, s5.getClientPort());
+        } else {
+            LOG.info("creating QuorumPeer 1 port {}", portClient1);
+            s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_0 + mastership);
+            assertEquals(portClient1, s1.getClientPort());
+            LOG.info("creating QuorumPeer 2 port {}", portClient2);
+            s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_1 + mastership);
+            assertEquals(portClient2, s2.getClientPort());
+            LOG.info("creating QuorumPeer 3 port {}", portClient3);
+            s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_2 + mastership);
+            assertEquals(portClient3, s3.getClientPort());
+            LOG.info("creating QuorumPeer 4 port {}", portClient4);
+            s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_3 + mastership);
+            assertEquals(portClient4, s4.getClientPort());
+            LOG.info("creating QuorumPeer 5 port {}", portClient5);
+            s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_4 + mastership);
+            assertEquals(portClient5, s5.getClientPort());
+        }
 
         if (withObservers) {
             s4.setLearnerType(LearnerType.OBSERVER);
@@ -230,18 +290,18 @@ void startServers(boolean withObservers) throws Exception {
     }
 
     public int getLeaderIndex() {
-        if (s1.getPeerState() == ServerState.LEADING) {
-            return 0;
-        } else if (s2.getPeerState() == ServerState.LEADING) {
-            return 1;
-        } else if (s3.getPeerState() == ServerState.LEADING) {
-            return 2;
-        } else if (s4.getPeerState() == ServerState.LEADING) {
-            return 3;
-        } else if (s5.getPeerState() == ServerState.LEADING) {
-            return 4;
-        }
-        return -1;
+      if (s1.getPeerState() == ServerState.LEADING) {
+        return 0;
+      } else if (s2.getPeerState() == ServerState.LEADING) {
+        return 1;
+      } else if (s3.getPeerState() == ServerState.LEADING) {
+        return 2;
+      } else if (s4.getPeerState() == ServerState.LEADING) {
+        return 3;
+      } else if (s5.getPeerState() == ServerState.LEADING) {
+        return 4;
+      }
+      return -1;
     }
 
     public int getLeaderClientPort() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
new file mode 100644
index 00000000000..482027d1a9a
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
@@ -0,0 +1,350 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashSet;
+import java.util.Map;
+import java.util.Set;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.TestableZooKeeper;
+import org.apache.zookeeper.server.quorum.Election;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.util.OSMXBean;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class QuorumBaseOracle_2Nodes extends ClientBase{
+
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumBase.class);
+
+    private static final String LOCALADDR = "127.0.0.1";
+
+    private static final String oraclePath_0 = "./tmp/oraclePath/0/mastership/";
+    private static final String oraclePath_1 = "./tmp/oraclePath/1/mastership/";
+
+    private static final String mastership = "value";
+
+    File s1dir, s2dir;
+    QuorumPeer s1, s2;
+    protected int port1;
+    protected int port2;
+
+    protected int portLE1;
+    protected int portLE2;
+
+    protected int portClient1;
+    protected int portClient2;
+
+    protected boolean localSessionsEnabled = false;
+    protected boolean localSessionsUpgradingEnabled = false;
+
+
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        LOG.info("QuorumBase.setup {}", getTestName());
+        setupTestEnv();
+
+        JMXEnv.setUp();
+
+        setUpAll();
+
+        port1 = PortAssignment.unique();
+        port2 = PortAssignment.unique();
+
+        portLE1 = PortAssignment.unique();
+        portLE2 = PortAssignment.unique();
+
+        portClient1 = PortAssignment.unique();
+        portClient2 = PortAssignment.unique();
+
+        hostPort = "127.0.0.1:"
+                + portClient1
+                + ",127.0.0.1:"
+                + portClient2;
+        LOG.info("Ports are: {}", hostPort);
+
+        s1dir = ClientBase.createTmpDir();
+        s2dir = ClientBase.createTmpDir();
+
+        startServers();
+
+        OSMXBean osMbean = new OSMXBean();
+        if (osMbean.getUnix()) {
+            LOG.info("Initial fdcount is: {}", osMbean.getOpenFileDescriptorCount());
+        }
+
+        File directory = new File(oraclePath_0);
+        directory.mkdirs();
+        FileWriter fw = new FileWriter(oraclePath_0 + mastership);
+        fw.write("0");
+        fw.close();
+
+        directory = new File(oraclePath_1);
+        directory.mkdirs();
+        fw = new FileWriter(oraclePath_1 + mastership);
+        fw.write("1");
+        fw.close();
+
+
+        LOG.info("Setup finished");
+    }
+
+    void startServers() throws Exception {
+        int tickTime = 2000;
+        int initLimit = 3;
+        int syncLimit = 3;
+        int connectToLearnerMasterLimit = 3;
+        Map<Long, QuorumPeer.QuorumServer> peers = new HashMap<Long, QuorumPeer.QuorumServer>();
+        peers.put(Long.valueOf(1), new QuorumPeer.QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), QuorumPeer.LearnerType.PARTICIPANT));
+        peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
+
+        LOG.info("creating QuorumPeer 1 port {}", portClient1);
+        s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_0 + mastership);
+        assertEquals(portClient1, s1.getClientPort());
+        LOG.info("creating QuorumPeer 2 port {}", portClient2);
+        s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_1 + mastership);
+        assertEquals(portClient2, s2.getClientPort());
+
+
+        LOG.info("QuorumPeer 1 voting view: {}", s1.getVotingView());
+        LOG.info("QuorumPeer 2 voting view: {}", s2.getVotingView());
+
+        s1.enableLocalSessions(localSessionsEnabled);
+        s2.enableLocalSessions(localSessionsEnabled);
+        s1.enableLocalSessionsUpgrading(localSessionsUpgradingEnabled);
+        s2.enableLocalSessionsUpgrading(localSessionsUpgradingEnabled);
+
+        LOG.info("start QuorumPeer 1");
+        s1.start();
+        LOG.info("start QuorumPeer 2");
+        s2.start();
+
+        LOG.info("Checking ports {}", hostPort);
+        for (String hp : hostPort.split(",")) {
+            assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
+            LOG.info("{} is accepting client connections", hp);
+        }
+
+        // interesting to see what's there...
+        JMXEnv.dump();
+        // make sure we have these 5 servers listed
+        Set<String> ensureNames = new LinkedHashSet<String>();
+        for (int i = 1; i <= 2; i++) {
+            ensureNames.add("InMemoryDataTree");
+        }
+        for (int i = 1; i <= 2; i++) {
+            ensureNames.add("name0=ReplicatedServer_id" + i + ",name1=replica." + i + ",name2=");
+        }
+        for (int i = 1; i <= 2; i++) {
+            for (int j = 1; j <= 2; j++) {
+                ensureNames.add("name0=ReplicatedServer_id" + i + ",name1=replica." + j);
+            }
+        }
+        for (int i = 1; i <= 2; i++) {
+            ensureNames.add("name0=ReplicatedServer_id" + i);
+        }
+        JMXEnv.ensureAll(ensureNames.toArray(new String[ensureNames.size()]));
+    }
+
+    public int getLeaderIndex() {
+        if (s1.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return 0;
+        } else if (s2.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return 1;
+        }
+        return -1;
+    }
+
+    public int getLeaderClientPort() {
+        if (s1.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return portClient1;
+        } else if (s2.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return portClient2;
+        }
+        return -1;
+    }
+
+    public QuorumPeer getLeaderQuorumPeer() {
+        if (s1.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return s1;
+        } else if (s2.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return s2;
+        }
+        return null;
+    }
+
+    public QuorumPeer getFirstObserver() {
+        if (s1.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return s1;
+        } else if (s2.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return s2;
+        }
+        return null;
+    }
+
+    public int getFirstObserverClientPort() {
+        if (s1.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return portClient1;
+        } else if (s2.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return portClient2;
+        }
+        return -1;
+    }
+
+    public String getPeersMatching(QuorumPeer.ServerState state) {
+        StringBuilder hosts = new StringBuilder();
+        for (QuorumPeer p : getPeerList()) {
+            if (p.getPeerState() == state) {
+                hosts.append(String.format("%s:%d,", LOCALADDR, p.getClientAddress().getPort()));
+            }
+        }
+        LOG.info("getPeersMatching ports are {}", hosts);
+        return hosts.toString();
+    }
+
+    public ArrayList<QuorumPeer> getPeerList() {
+        ArrayList<QuorumPeer> peers = new ArrayList<QuorumPeer>();
+        peers.add(s1);
+        peers.add(s2);
+        return peers;
+    }
+
+    public QuorumPeer getPeerByClientPort(int clientPort) {
+        for (QuorumPeer p : getPeerList()) {
+            if (p.getClientAddress().getPort() == clientPort) {
+                return p;
+            }
+        }
+        return null;
+    }
+
+    public void setupServers() throws IOException {
+        setupServer(1);
+        setupServer(2);
+    }
+
+    Map<Long, QuorumPeer.QuorumServer> peers = null;
+
+    public void setupServer(int i) throws IOException {
+        int tickTime = 2000;
+        int initLimit = 3;
+        int syncLimit = 3;
+        int connectToLearnerMasterLimit = 3;
+
+        if (peers == null) {
+            peers = new HashMap<Long, QuorumPeer.QuorumServer>();
+
+            peers.put(Long.valueOf(1), new QuorumPeer.QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), QuorumPeer.LearnerType.PARTICIPANT));
+            peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
+        }
+
+        switch (i) {
+            case 1:
+                LOG.info("creating QuorumPeer 1 port {}", portClient1);
+                s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+                assertEquals(portClient1, s1.getClientPort());
+                break;
+            case 2:
+                LOG.info("creating QuorumPeer 2 port {}", portClient2);
+                s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+                assertEquals(portClient2, s2.getClientPort());
+                break;
+        }
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        LOG.info("TearDown started");
+
+        OSMXBean osMbean = new OSMXBean();
+        if (osMbean.getUnix()) {
+            LOG.info("fdcount after test is: {}", osMbean.getOpenFileDescriptorCount());
+        }
+
+        shutdownServers();
+
+        for (String hp : hostPort.split(",")) {
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+            LOG.info("{} is no longer accepting client connections", hp);
+        }
+
+        JMXEnv.tearDown();
+    }
+    public void shutdownServers() {
+        shutdown(s1);
+        shutdown(s2);
+    }
+
+    public static void shutdown(QuorumPeer qp) {
+        if (qp == null) {
+            return;
+        }
+        try {
+            LOG.info("Shutting down quorum peer {}", qp.getName());
+            qp.shutdown();
+            Election e = qp.getElectionAlg();
+            if (e != null) {
+                LOG.info("Shutting down leader election {}", qp.getName());
+                e.shutdown();
+            } else {
+                LOG.info("No election available to shutdown {}", qp.getName());
+            }
+            LOG.info("Waiting for {} to exit thread", qp.getName());
+            long readTimeout = qp.getTickTime() * qp.getInitLimit();
+            long connectTimeout = qp.getTickTime() * qp.getSyncLimit();
+            long maxTimeout = Math.max(readTimeout, connectTimeout);
+            maxTimeout = Math.max(maxTimeout, ClientBase.CONNECTION_TIMEOUT);
+            qp.join(maxTimeout * 2);
+            if (qp.isAlive()) {
+                fail("QP failed to shutdown in " + (maxTimeout * 2) + " seconds: " + qp.getName());
+            }
+        } catch (InterruptedException e) {
+            LOG.debug("QP interrupted: {}", qp.getName(), e);
+        }
+    }
+
+    protected TestableZooKeeper createClient() throws IOException, InterruptedException {
+        return createClient(hostPort);
+    }
+
+    protected TestableZooKeeper createClient(String hp) throws IOException, InterruptedException {
+        ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
+        return createClient(watcher, hp);
+    }
+
+    protected TestableZooKeeper createClient(ClientBase.CountdownWatcher watcher, QuorumPeer.ServerState state) throws IOException, InterruptedException {
+        return createClient(watcher, getPeersMatching(state));
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
index deaeb68d8ad..4761596736c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
@@ -57,7 +57,7 @@ public void testMajQuorums() throws Throwable {
         }
 
         //setup servers 1-5 to be followers
-        setUp(false);
+        setUp(false, true);
 
         Proposal p = new Proposal();
 
@@ -77,7 +77,7 @@ public void testMajQuorums() throws Throwable {
         assertEquals(true, p.hasAllQuorums());
 
         //setup servers 1-3 to be followers and 4 and 5 to be observers
-        setUp(true);
+        setUp(true, true);
 
         p = new Proposal();
         p.addQuorumVerifier(s1.getQuorumVerifier());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
new file mode 100644
index 00000000000..1b1fb3125ba
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.ArrayList;
+import org.apache.zookeeper.jmx.MBeanRegistry;
+import org.apache.zookeeper.server.quorum.Leader;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class QuorumOracleMajTest extends QuorumBaseOracle_2Nodes {
+
+    protected static final Logger LOG = LoggerFactory.getLogger(QuorumMajorityTest.class);
+    public static final long CONNECTION_TIMEOUT = ClientTest.CONNECTION_TIMEOUT;
+
+    /***************************************************************/
+    /* Test that the majority quorum verifier only counts votes from */
+    /* followers in its view                                    */
+    /***************************************************************/
+    @Test
+    public void testMajQuorums() throws Throwable {
+        LOG.info("Verify QuorumPeer#electionTimeTaken jmx bean attribute");
+
+        ArrayList<QuorumPeer> peers = getPeerList();
+        for (int i = 1; i <= peers.size(); i++) {
+            QuorumPeer qp = peers.get(i - 1);
+            Long electionTimeTaken = -1L;
+            String bean = "";
+            if (qp.getPeerState() == QuorumPeer.ServerState.FOLLOWING) {
+                bean = String.format("%s:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Follower", MBeanRegistry.DOMAIN, i, i);
+            } else if (qp.getPeerState() == QuorumPeer.ServerState.LEADING) {
+                bean = String.format("%s:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Leader", MBeanRegistry.DOMAIN, i, i);
+            }
+            electionTimeTaken = (Long) JMXEnv.ensureBeanAttribute(bean, "ElectionTimeTaken");
+            assertTrue(electionTimeTaken >= 0, "Wrong electionTimeTaken value!");
+        }
+
+        //setup servers 1-2 to be followers
+        // id=1, oracle is false; id=2, oracle is true
+        setUp();
+
+        QuorumPeer s;
+        int leader;
+        if ((leader = getLeaderIndex()) == 1) {
+            s = s1;
+        } else {
+            s = s2;
+        }
+
+        noDropConectionTest(s);
+
+        dropConnectionTest(s, leader);
+
+    }
+
+    private void noDropConectionTest(QuorumPeer s) {
+        Leader.Proposal p = new Leader.Proposal();
+
+
+        p.addQuorumVerifier(s.getQuorumVerifier());
+
+        // 1 followers out of 2 is not a majority
+        p.addAck(Long.valueOf(1));
+        assertEquals(false, p.hasAllQuorums());
+
+        // 6 is not in the view - its vote shouldn't count
+        p.addAck(Long.valueOf(6));
+        assertEquals(false, p.hasAllQuorums());
+
+        // 2 followers out of 2 is good
+        p.addAck(Long.valueOf(2));
+        assertEquals(true, p.hasAllQuorums());
+
+    }
+
+
+    private void dropConnectionTest(QuorumPeer s, int leader) {
+        Leader.Proposal p = new Leader.Proposal();
+        p.addQuorumVerifier(s.getQuorumVerifier());
+
+        ArrayList<LearnerHandler> fake = new ArrayList<>();
+
+        LearnerHandler f = null;
+        fake.add(f);
+
+        s.getQuorumVerifier().updateNeedOracle(fake);
+        // still have valid followers, the oracle should not take place
+        assertEquals(false, s.getQuorumVerifier().getNeedOracle());
+
+        fake.remove(0);
+        s.getQuorumVerifier().updateNeedOracle(fake);
+        // lose all of followers, the oracle should take place
+        assertEquals(true, s.getQuorumVerifier().getNeedOracle());
+
+
+        // when leader is 1, we expect false.
+        // when leader is 2, we expect true.
+        assertEquals(leader != 1, p.hasAllQuorums());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
index b3e1d47ee7d..52d2bd80f5b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
@@ -35,7 +35,7 @@ public static void applyMockUps() {
     @BeforeEach
     @Override
     public void setUp() throws Exception {
-        super.setUp(true /* withObservers */);
+        super.setUp(true /* withObservers */, false);
     }
 
     @Test
diff --git a/zookeeper-server/src/test/resources/data/invalidsnap/version-2/snapshot.83f b/zookeeper-server/src/test/resources/data/invalidsnap/version-2/snapshot.83f
index 26dc5f665218dbe5519a55cbcca2bd983a6f0e17..1b563b6ed6dcf472f83f2716efbeb9f3130869f2 100644
GIT binary patch
literal 189686
zcmb@vcf2lHQT=^83^S6$B?}BFNsyU)=iUkAsFHJ*sDP5=3_}=lmYj1G$w*d|D2gCK
zK~OS?fPzX!K#|{CRjY2D+pGKioIl>}$G!SIRrNjl^s`r2_cJpOx4QO?ueWE<p7EC&
zI39+h@A1tCyaz{nu6Hzl<`D*!|9=+z{}HF$>%MpYeH@(b4);9uUiZ8cj$-V<)Jy+g
zdU_8Yc@Mlc9&;?_>6l|Ltb|&_sGp%+<;kyajmQdc&-)RXk2yAwM^Km0DN6DC1bb&|
zMD{AaQ_hVajwI}uefw~Dln$3@o+}P$toL)R@%q}t8lm^&Q0V<j^jTF44fN+*6>(vW
z(8u9W=;M~?v#Amq=r6P?;=&rC58zPf155PTRS6CBms%BZVU5rSaVYe`CHfqyga-O6
zt%|s?M(E>lDD?45bnO6Wpug7YOufPyp-;e}&?hX>=Ttg0&|hy=#Dz6NpNK=DPh6tU
zrAla^ztO6Q3u}Zv35P<Tv_y0Jb3g<At=4#bZDP&o!Y4F${u1-ztV(Er-`lE)3u_Wg
zD{A%26(6BGXn^0}s)!3~5=<i|*nD_8)j<RN!B$0FSd(DdFu~@+BUJ|t@P}FzabZn@
zX~G1X2ai%6G{7HjRm6og38n=TY!3Vt)j<RN(N;xVSd(BHFu~@(x~xM3{IOOi>J`=`
znD$Gsx$g{0h6eZ(t%|s?Cc!jcg3WtpR2?+Hf8VNz3u_Wg>m}HncP7<A1N^C0MO;{u
zxP7#qOl{sfvnrv1{!FVPF05g5rSsTa_bq*Q9@Rht`kmH@)TLEvA(zI?_3rED%EKl4
z*Hr^0`V?K~sGEZ|LetYc6+oM*FDd{u(7Mi@!fV*pV2#jpwa{kki>V$O=<~KJ;=&rC
z>1(0Q*cVqNG|<1=s)!3~gr>8FHfvu(mC!(6pj8nU)(A~+3vK4Uq$;6-zEG<oF02un
z?iSkY{Tr%;1{yo4R1p`}2wlw;JH!lrDOExPd68CUc5b1oxdLq#=l17-2D&z3ZORBP
zCf4xUu`h0ObNyy;Y_%BLawq>he*txKuqMIPT(RV(6VIn|C|7*)FIqRjtVwV+*L}yB
z56`c1Xq*cCSgME%YZ6?|b>A`OLRce4Sw#2#r_{56!iNcK5?sx7-!bMv7$Zg*<Or=8
zx;a>r;A*b>jxh&bQ034#1xL1Sf?1Q`YOec^G5^7DG0Jynobd~wn}an8uI9S$7<1pz
zDu)K}jID~eAXngOuKSKL@74AzJL~D{lzQ57?4CWW$raOjX%KTBOdO-kjE9<7IdpTd
zM%RmKu5gHX@7Dx?1`<ymrHZ()hRu}*VRJQm{HAK40jmo?FX|j?&GjmHo$KA-&6S6B
zPKPMmvxjGi0~+Y7w#MsgQ=M7xs=4xTiN36Ap@F`7>l!s)V~ti_%@t^~_2mSB2Ku*J
z6>(vW(A8XlHe+92mC!){cB?Zxx6svGfi`PjLFv#yU$b=+%^Iz`nk&#|?kfra4fM5I
zH_@ySx|%D{X74Kr01fnYTQ||H5xSZy&}Q%}3jhuD^;;EjL2jYB4|z)fv{{_np931`
z8@9&lYZGgD?bv^)x#DQKt1qKUXn^Z>hPNtPgEa}R=87dR!N;f?8sNI)s5_7~IBODI
z&2_(DJ$Sj|fCji$UVljh7ZYm|T+MaAH&^~K9MAyQFQ{J_!NtUy1Xpw2@6DBe3<os8
zJ2YNjn^=?JYOedex$=+UfCd<;rF?mHuqMIPT=#o(<sZWV4Im6v%9mFMYZ6?|b-y=P
z{xKZ2(z@c+6)>ZR&#XysHP`*#T=~avKx3tK<)|x31Q!!)65K7ooX0<gqfWt<^$Vbz
zqffx0Cs#PcyvIL>0~%{CbJMt6gEeffd>h$Zt(TzV#i-7AW5J;@_DXlk&F}-SZ^w0W
z<>AuO*HaBN)_Zd6PTFC|tPz@9n%6g=t-0b-83P*VQ(F~rVU5r{8$#O&xq&L7fqrnS
zA}*{En%i1vYpyp`B{a|vZB@jDH9~V^3vJEyMyiAc`m|O>Tv#JCx3<vMTx%!P&Um=c
z(9OXbp}Dz*w&r>h0idz!N46^B!WyBuxrMgodQ(+G1O2F0MO;`TbTwCOKC?KtKL<3>
zk7<q9*Cy8R+Hu^W=8B`GVXmf1Xn=3gy2gyxSd(D(7Oj2>#=U2Zx(B_rz|hUXngr8`
z2{s>IL*>v|@oicaabZn@X~P7Y3vo*uqi$_)D=>6(uqMGYVS>$rxS@?vH@0^c7`i!F
zlVDmf!REl<Q8_eD#UHdP;=-B)(|`#!|KUD4M%^#}p}^41!I}hDZ#mAJEAEnG)ZOx3
z1%_@8)+Ctb%N3jVuB~!toQiw2D&oSL1XpuC?ih34byNop@V#1{*tuHgq2>xxoA+>E
zAEWN??;|vHbFhZZmD`QY)i&GBRSJ#uKCU$)dlla)cf$`nuLruh@^ESC-%|}V&@XFM
z#Dz6N)6=|k0&S-LeN{pO{i;?)Tv#JCT`jcP`cA5Z2Ku$Finy>wXr5@H?Od0E%h0bE
z8oD`HBQ%{Yv|0Nu0zhNcZ)jD-g*8Ic+d`YUag~TsSBp0a4c#295xSZy-bQP#b$x)w
zs^8qYiDr$^)m(u#gVz<Jt{86-8oD`HBXl)apv~gk{v6O)_1jzH^|gsLymlNo)Le12
zGz^+)jB2V+5*WHUSd-v=IMV8u;9II38Y}*zRz+M`li+Hu2mHzPR;q&r_$jSU>|BAX
zxgPL){%ZSm8}KxNp__v>xni0yPlb8#cU2CJ6+fd@5f|1ZxSHz$e{#irMU1+?c$UD>
z&B2-kS93k!Pp)-8QTG?m5g58TSd-vtt_Qri-cIGvI2F%r-2}5H!8Bi<WAonaRSpgC
z^IH{hL9W0j;V8l8ygR548sHbSD&oQ#+2U9n>MCd6yQ3<hfqr4DA}*|9bLFmJbG57T
z-Bkk(=(}1YvRCn)@^JjX^&afz%EP6lAE+8=pg+;7hzo0kuI37~HP=&B2@Ui=wmP$O
z3ti0>Xlt$yQaUuypKaYlvqq~vfJ454K%222EC4jnpKDdbg*8G~a|PPo#)qg98t5;!
zI<s>NO>b+})?6Q|bZDTz)T)RJYqaWWu2{7-*V9x94fI!9o!PmCroXjnGx)=l4h{6z
zS`~3&jaE&E3vCvExGJH6{(7q-F362*$H7C*6-P_M+(UKH0KdCc5f|3*YKPN{BdvZ3
zzNhM-0e(-bA}*{+a5dM1-dyqM5ThO;-YYP4bFe1C)m#sHbG^69p|RrkwQho0lVF-K
zPlb8#J}QR>_yetqxUeR{)m#tyh4j9vg9i9RtxoJ*foZ^8vH9<QN`?mb!>x+AuqIbr
z&Gn!+*ZZpu8sLw#I<a#FrulNk=Di0f85-b^wkqPnnp`ohmtb?=$*O|}_+zb#xUeR1
zhn`&F74zOHs)Ppm<E_r@+-R<R^VnSNt$TzLp#lA7Yee=czEhr!AGqG*ySegkY3V1c
z21@h;k80gXJM5S>LRWJI+M4TAR0Iw5>01xO?fii?Letf}bOLS7^{J|X2Ko%Giny>w
zX!=@cGxpO|2@Uj_S`~3&jnD^iD6}=#r>hbg=(Dsc;=&rCxjlro9r6rSLIZu)Rz+M`
zBXl)aoNH^Y&r~He&}VCPX6F{Vnk&#|@MkF<8t8MjZlYPERabKb+APlP&jAhexm)A)
zwTU&nb{v1Gx#DPP7<?)o14{5I-)>dJg*6G@ha;_i34WC7paK4mRz+M`lVBP#!REt9
zs}36A@3$)A!kPrrh6y$oK1OxW0RN~}5f|1Z_yCR)Y#w~9>YxGsd8;BWtV!@e93|Ks
z_&C);1N@6tMO;{uU>Y#N=D)|Q4odI?hgL;gSd(DdFTv)%C#Vh@;IUN^7uF=Wn(OiY
z&s?9VI%t6BRws6@z|~xj_m73^BOHCC^S~nnhHehl<Ow*`Tw!YS-X947jWwUHbra1R
zKDqK7v$@(CevV3^0X=VPMD{AaQ(lK3xZV@Gx$<yn=~t)*8tBWk?xY=d%o?HTX<qPw
zHdDV+MbJPW+p35QYlN=m3bfh!RjPyr8p|kE#Dz6N)7M(H8T*e_2@NEyTB?W(YlNn=
zg*I!yT9wd1!mOo=xUfcOdRu5S_n)W|8c4XRR1p`}2wlw;=h`;kYg7phBz#q>hzo0k
zuI37~HP_dw5*o<MwK}tN3ti0>Xlt(A{v6OiU!gT#Uz=FNi_!^)nk$Z$hIy_kp#eT$
z>l!m&V@-mqxnjvn@bgp-4e$k86>(urf~&cn;7_j4R~<CK7i@K6=L%fS^#p%%eSwmp
z0Y17_5f|3vimSPv;Qtuxg{p%F_#&-N>|BAXxt`!pt}jwDG{C>!x(Q}Yu9ybQU2Xn*
zvC5$VzG$l=F04r~?U!J4-%C^n4e-TV6>(urf@!`4oA+L-I%t3|*{X;OYZ6TBCD@$z
zGSxu?e5qDNT#zf=q2>yQnD<_;N@$>evsDon*08zqRIs_)iFmzgpaH#7Yed$X>-!Ml
zpMPRER~{}c{Vt)QfxdaGA}*{Ex|%D{)?EKgmC!)ns@0jDTj*-8KwESDbEQKAecRSe
zG;6f#YOX+AbA7h}&_Lh5RS_4~2wlw;Xlt&2p-O0=@7(Il&MkB`SD?+@f2nk6pzqSU
ziDr#feF6^Iw}Cc$zefOQpzqqMhzo0k=B5_f_Vs&J2@Uk!TNQC(jnH(s&}MONe-3D%
z@6j5suT8Aswd2G?%@s#W!@NP2&;Vb#RS_4~B)FO@PV^G|M%6(BeAQMbcCNtHTu=1o
z`X(hq1AO(?O)zV6#noI-^yd0zl|uu3&DKpYYZ6?|^+a#3f2wk5fUn)U31&@#tGS-&
z&GjuRhX(jMt(#!hB)FREiT>H*TU8DX@O4`^!K_Iz?U#Gn-1jz>Lj!z+Rz+M`lVF-J
z!REcUs}36A8@DRr!kPrrdI>h?y+d`-0N<ol5f|3T)W_mbrZ(@rQ<cy_->g*;7uK-3
za>Z<}w%+%v1{%<Nwnk*H;ydLZ@dMX;Qa4u~E-n2r)j$J{51L99abb<n^fXTe(AHc(
zu1aViAJeLc3u}Zv4u?WpbNz%Wp@DvEt0FF}5&8fQg|_DUNmW7v{iIe!Tv#JCoh`IA
z*S}XKG|*3ORm6ogLLZMqp{=?8gDRncerl^CF02u{nk(K$v-hV|2@UkqTb<dtg|6lb
zv>E)<N{0se8LgXW)@aq$T!A*raQkyW1O3d_cztbR4X+(19cr#PS{mj9s)PpkzO8G_
zc#Sm)-iITtehL1d%Ao<if2$%ctV!^G93|L%_*bff2KWK3iny>Q!N=h!!REpbsSX<8
zQ(6^qVNHS$;3&c7!M|1=G{C2}D&oSL1k-{EHV6KV>YxFBP^%&?tVu8pm|*kYhgAm+
z@Pk_wabZn@tGS-!A6ovc>YxFBNUIY&SKw-{C;0>0N0bZ=@M*1^VAkY{tGS-!&FZ5n
zhX(jzt(#!h<e5G6<O)-p_x?@*XrLe2x`}4Z82_%r<TtdRQ5iIV&uWdx=@s801Fj_K
z*7@JUA3<Fj`LoJ~2K3pj5!tKwPWd)|IFhjH)_J%@|BGs%fqrA_PTFC|tPz?QiKFtj
z*j3`|DuM?3O|6Q!utsQJCWN-@#J{Q%8t6B-D&oQ#p?RSY+O8DeP$e|bZ)sJ;g*8I+
zQX#ZmE54~pXrSNPs)!3~gwAdqZ=+o;zNJcNpx@Ez%+4)zcI!Y}xBfS!Lj(QJ)=e~P
zwCe2Efwpe_?*c#r{b#M4Xx0dw-8#_Lt-1X<pn<MWHu$N<)?m%)Vl(r8Jb#IK@t;%;
z4e)bX6>(urg0ox4l9x{WXVpOi{M=S2cCNtLtqC?Ceoo2I0KcGh6U>@iadvBh&4r&=
zIW)ld;Ivc`7uF;=yEVb)!7r!|8o-yfI<a#FrUmoOGY5WA$<P45qE!(W*5rz5zyzEB
zzN9*6fM3<Bhzn~Hd;*RVZ0`HA>YxFBb*myStVuA<mtgbWS5yZL@M~KYabZn@X}tuS
z^S-J&Xn<eWs)!46g;Tc<hnV-irb=j_-_WXv3v1Y1={z=9dtUvHYM=rA%hrgjHP>Gv
z!apDXM=me;JX~7(zXPym4>Zu9ZB@jDH9}W&1=>vgQ&mC(T~`h0=3tG`)m(u#TmMV|
zXrOEB)mB{NvqtD@u0Wfyf38|+plkDSV{HxA2wlw;XtVbJs2&>V+9Q1bw+3s3rnmJr
znz{d1_0T}q4NcwPD14Z(MrgWQXtVb(R0Iul-F4Jmh{A^nYlJ=#heDgd|4&8GK-XOd
z?<lqgYlNo5g*J<G`*T18UAG2xs}RA(#2Q{Z;A|Y_FENAvhl-#9es8NHF04s#HCOzS
zr4#>Cb<hC6uhog2D{wW}m9KpIFC{|*{K3{uFl%zf)m&G;^69%OhX(ksS~tP0NpLmS
zm9KpIp30#C{_ECFFl!QA&2{A~pT4hh=&r%6NpLmSm9KpIfxyrJ*CR0>cee&>5={H$
zb~E?=P}R@?f1*_p7uF=0=1Z`7??<YG2KbY$iny>Q!L(k2&3Qjo9W=oI(5i?FYZ7;;
zxxyjly`QKO8t6~AI<s@5xzZqPuFEzxD32P@+H|!E_bOqB41A62#aCzS!yzw1JX~0M
zIAhjOi9Yqn){OWZH9~XALffj(l%)eS&_}g8v~z3K$KfTRm(6uJv(lk~{*~5@_#8D_
z^#O#1UN+a^ELlno^yyn2+PSrAI$P*va~;mAbZDT@(3%mSqeiQ)=8Cs**<6RS2@MT&
zy`6e{9gIBI2wlw;=%u}fvkMIkbiJK=dsoq{5xSZy&`X04=MWki=z2T#_O7B?BXl)a
zpqCbp?T<`qpzFlwM6IG}8D2Z;E1%+MX&9MtfD-(`AGEGP`5JQt-iITtehD6#iezYj
z>*B-<&&FV`!25BOVDsUW)dMuZxHm4%h|kOwm^MtXxp2<H0UAKu8JA|nXXXk_6DHU^
zctjQs&;ZuW7jLXK26F|b1ruxzJY7}~&;Zx17jLUJ26F|j=IUShG~lwyK_&Q99!qh!
zI-(}GTQyhz%BKMrO%7@Rwe3#jmf9Fmli+Hu{*_MyE}0zE0Bd)gs@)R7#S}FOuI9Sm
zK4%_q!Q`L@Si9p??Uo2Grl`rc>`-%ssh7=lzy*_o8fd+Zr|NBu;9`mzKDlxqv$@(X
zK4(@8(16x;j@K{_UKJK&xFlZSdigz1IOGMNhf7QA=K&h%UvFIy5B<p8LetYio2f67
z6$3QT7j4am&&(|}&xX);LVhhv2WX%#)|wHYnOkW3T4*yiP5{SHC*tBlL$?NV3r%MW
zZPvyK;27#eTtaB*)?jX-tGVKBwC0Kvz%kT`z`GwOhPz;6Ft^avT!FUcsy}?F6LBe_
zp<9Ewg|6lbv^7`#;X|E>OA8I%8q6(pHCLdmx#|z64dO%`+q#Kn4X+*bl}~ZBG|aiO
ze1HZR&Av1vJ~LO~YOYxF5`69~9H0S&sY^5BGjj#5=6ampnx7{N2WS9m<@!q;i#*ok
zsi@|9oL`pCD=;*`wQ~I>t6<h7xSH#6_ObAAK7pYDu9fRASp~Bu!PQ)kvwuTsIKRNq
z0PoN>C|`@31Rswd^O9=*`_(KTpaH%>Yesx#u2y^kjuLF{1BhcN-~|PSZVl!Nd?Jn#
zY~B-KDBy(zhHee!3QX%I*qkT8P{5-FhHee!3U{cv!XegNk50e<jk8=$tE`ma!{*^=
z{K)3Y?Z)P67yREq0Aqj#6c#Pz>#NQ6ig=xWKE4m9nkx@$9YYlE8Mt9EsDZp@YXnxN
zs1drFE6~<lxn(d0XrQmv8iAFGxwYzQu0UIJ<)*<Hpn<+_YXnv%<`%k|E6{eXxot28
zXrQmx8iAFGxrMIg3bZxX%VzBW4fOR}SE%t4a|_M4ihUbsGxy~ZFhB!+!`6)W%-llr
zv<q$azI>Jr&_Lg)H6uPVx6nN8LYu*_kfj4O(6?;Oh|kO|G*7$GW^rzRi~$<x-))V+
z%Ea8bcGOos@l>0^bx$$WJqEUE`~q&*jlo=jtGVJmTsl#A6hqx%)ZXR^+!)LixSFef
z<<sz+Sxt?V*7nnOTw_NKI|{z&3Gp<$x$rUqLjzo!Pn&TS%$fvOb3NeKyJG}~2DtWz
z_RA`mH3_cf>R<UZ;1-L68sOR;+AR@WOi`2IYOem3PXpgq3~GR{(i(x4DQXhjS3Pqd
z-&c$Q8sMw8Mqp)Pu1-Z?^UQnNuS4zMYX}V88q5{AuXyG>zONVqG*<lEtr1w6m|Ldi
zTO?DP_xR3Y4A4OTPHO~KCgw(SrLwu&RryL;H9!M;+t!He&G^oFxG{dBDe%=9eCN4d
z9xg3??JOFgfxc&JMto*&q4_=vZO!#MSvo)ieXrJx_{`iw^PLphY>j5hF;r8%x6sh7
z!Q4Xgy%gG->-7>aKx5VSY0Zew%q=wEL!s?$yndDr&_Lh6H6uPVx6svG@itm>y+M`^
z&_JKu>d?+DbTwC?&E7XuIyBIyv~HqVqs>>%6=*Z~jf92<`hl&RXx0c_%@t^~IJZ9r
zZ4l^FTO+VCg=KiPtFL^DqorZ4oRtGKz_)A7h|kQ8ixL)!BdvZ3#`TzEfCl)Etr1w6
zm@6=im|*iEuE!ihU6+4PVCdFhuE4Zmg3X0j%klvlEB^h~jQGr4f$M^L(3|Vkvv7b0
z_)e{k>|B9q!CbL9P@Q9_PI6~~p<9Ew0#|cAX#Z``@LO3<jTPUebrZ~*+-}ue{VSga
zv?dN}fbZHGft4w05?syop#AH|0~!+tHNbakjljwjH3_cfdeA=>#^V{sP>*SM7Z|!V
zm|M0u7KgfkT64wY8OKnMY4;Esx;2;^&6RH+o2y+qZ<3`0G)}~WS|hSI<2&c!5AYMW
z7`{4#j^=uKxU}@`vuJ<@`UR~S@tL`Wrl*BAQ{N#=2WX&Q*qRZanOo>;u2{9%`i@yT
zKm+}vR)=<Oq3LU_+M25_IRiA%FK*pLvqtB-nk!aq*2cw$W2lSJONEAR4dxcQnk&$@
zLvZ=w7@)E0m$yb>WnyljtGNPg%~cnk0UGF6w60L&CFT~onk&%OTyY8F80u2=DxslU
zgSmyS<_femS8jg{+8|c_>edLXOko*bJL)T+;^@N498!mywg&j&0z<b()Fil?E0(+j
z-z>`qXn-Hlx(Q}Yf~&b6?;i`_TwrK`AKAJIW=(>txgPHy3*SOuXn-Hpx(Q}Yf@#7u
zjd}2vSw27m{Fv5^_{>~^tGOQUPbs&`!T}oKr?fh<a|NaWbH(PrTPqnF;HR}_#OHxE
zc`9hX1e^Qti3`V2pS(O<VCdFhuD~>3g3Wuk$?^djD}GLEMto+jz_eb1&3Sn8;~44*
z@VNp*w+3^CJM^(I9AeECH?kZ<-OxT?Xz12pZZub(V>VYi!+)5i12j&=pR`6~t+_rF
z5&rr3>WpfxJX~7(0YXCq{qEL`_&l&i=xVM&TXQ`*O9yD6-`ncY&MkB`SD>xAo}zSU
zpg-8UiDr#fUCk9}Gxh_8h6ehht($1p2z?NT?At(Fb3HWy12oVdYt4wy%q=v%Ewq{Y
zL0LLL1O3U?jQGslLUZQ{ZJY1GSvo)i{pr?>_{`iw)89gy!5@;P12oW|Y0Zew%q{du
zI276}&h3veKm+~x)(EUj%#CYDedQD1MKkzavvPn2__eJo%y@~p0#|dz_E<U*j}9C|
zJwm)rVCdFhuE5n?{VSgaJu*;Z#jkJO1ha-0etgjrj&g6C3-!P-)C0sD1cq)6<_cWR
z)xYv-xM!AAW5sW3-2}5HS4<1$ip_!d%JKmk;5WBs#AoITOams^{CDpx9H0SyYimY)
zX0E`rUxLkj_sPNm8sN9JX2fUa3QY4Q*t~b&EF7Q#etT<1d}gk|v|fVEdH2i00UF?U
zwr0d<<_dSHxxyjlz58eB01foJS{>TC(Oh{d*j(*IoTfx*K)=`;k-Zt;IS<dkPyF-o
z<uY_MFG4(ATKb7uG(ZFW-PVlw%-lln$Dz>HT%VMs12oXzYt4wy%q{eBI277!{YP0k
zKm+~#){OYf+(I9~q0rV`pPZ!wG|)e6&4|y;Ep#<koNKf8Q?hh`2Kpzh4(;4RS91m0
z%>7iQLj(Qat($1pXopmD1={TWG@+q^{%Pwbnl(aKa|PP=_0xrh2Kr~Mn`qVuUCk9}
zvpBau25k`NpSMO}WeUsi`dnZ66h}+LJS-~*Xn?=my26Z?m>U-*EEGpt{Sy4}$lWtQ
z1N_z2jQGr4foa49n-3q6g#$Fe|I(TfpP4H#ZJ1zlAs&G_hI$m<4VX1~j%mUKn+Nd-
z%rVrX@Yl6s=+<Daz|~y+E1!l(XE`-a#lN<0f?1O*uIB1r`843!nu8kPZ?r~WWr~^v
zS93klpQ|35l>;=u-)voB#!JlAimSPv=so3eSw27m{O#6^_{>~^tGS-&9}7P|3kPU`
zztif-&MjLUi<fk5w&wZ-r9%V#U#%JOd0-9yg(j|;&DE|H&&(oz+eASBr!^vL%@t3#
zv0i+21|7}y@^ESCmj+<Z044fCr*F-O&&(}!HCLd`)Gy1@0UGEtv}VL-<`$Z+)~e0c
zFVE5e8t5~&X2fUa7P^`%R&B<9MV1cGK%cqQp`BakYOX+AbA6@Kp}R)2hL<4ls=4xT
z`8K{vXlS6%(wY&U2i6E(%@t^Cu78}R12oWQYjtSn7P^`%(AHdEt#oLh&(XSxW{p-|
z%@t^~47WeV01fmxTO+VCF*mLq^_5RN>t^t0W#s@R_|&Br*TAgdWfTj=kygKa3!j~p
z12n+DXw8Vv%oVtr>q-8x@N=?ofCl*gS{>QB0@H@MVsqhhl?)B=FIzL>^T3)s6*OUj
z&4bU&!U0M!KVm7(h|kOw_#loFYz};W77ow=4y_sSnYjX2b3Mub!QBh8aDWDQYIS7i
z3QYUuip_m5R5CQcb8AL?9$1s-nC45cdGAG8I6wn@L~BNTX0E`rUV_beFV4aN8sO8l
zX2fUa3U}zq6<#s#y(CKqXrPa3b!g|}E1zhO$*u7kB|!stuGWa48!pFqXS_1&Ki4~g
zx->FA%i<WI0X=tX1op;!*fhKcKORX~b?ZD_qTi8K12oWAYCVj%;|JyzI=gkCty{k{
zYX)ebuiTmupP5_e?AC#{>%_aVbbto>Dy<If+(Pq0aa5igyHfm_(xHLAT5Cpp9$2Gu
z%}a&QcCGmHEFGYMzD8?Cd}eN;kH?|V)~(;2r2{n3*J{m(&&(|}FBd}F_2MtGbbto>
zdaW7pnYo4L1w&}NV*F*64$wf~yfq^}Gq=#ZWC(573~ql6+91%kY>mLm6qY$%Yzy9x
z=NoEXd|g%!&;Xyib%hx(F&9_4*vdH4PFXtf^;teZ1ALy=jQGr4fwNolSC|jqkc9&@
zz~^msWakQ;-I`!?;Tx3<4e<F}H^HpQQ<2@8VDsRc1cnCqLam!%)+Cq~%yVoGd~=o$
z&;TFZnh~FwD=-b1VDsOfX5j!0Fy7qKjQGr4foZ=4oBQ69g#$Ez7irCi&&(B==1Z`7
z@2y!lKm&Z)){OYfT!Cr51e^2TmW2Z}z?W~$h|kOwPTe}ZV%~dumJZNBU$NDpog2-S
z_sMLo_PqLDB|-ywtJa9@&G^oF_!NHPpO3H3AeR>*9xg5Y(JUIEf&PQmjQGslLhr|+
z&}Qnt%hCZF=s#@Dh|kO|G+iyU+4^HyIzR(`_tuQ~%-llL*Fu}IKc1xnG|=~K&4|y;
zEp#<koNKf8C$e;a2Kqj&4(;4RS91m0%>7BFLj!%^)=e~Pv_q=70&VvGd!eC$zF+Gm
znl(aKa|PNA{trS!1AYJ2O*CtSuI37~S)AJ+gEk2C16m`nGKFP$eXg&3ile1r-j|gF
zG{CoRU17#c%#Di@7K$USehGem<n9@u0lrOZMto+jz%*il&4(Yz!T}oK+qP!JXXXk_
z8z$IX_`xh3paH&JYesx#uD~>5g3W_}m4yQ|z_)MBh|kOwxSA{e?eXO~{!kVU&;Z}D
z)sdYma5Y!_n{!L>Un?0J;NNTA1hXc$TQyhwL-Qs0Zv=)0_)e{xVAdqKnk)W^$rAiw
zfuRA$6JBXXd>&Yn;A*b;cxMUz+bkTQ0lZ7ABRjWjaV%cawb`2MN0biTHJUYia-~7o
zT+JSz78DxLlUpOQ)?B}Z2=^|o5Og%x%fscV_(}lw4A4M7p*15uGq=!Ove35buV(20
z4fGRRGvYII3r$xGZMObemJZNBKdCh%J~Ow_)m(8x%-H{ur2{n3Pi}Q+=N7t}E6`@`
zuPYrI=%=)9qFJN2v6?H;X6}C#8XD-Qwr-+XBXl)apv~Uj5E>fjr?qaPStE2cSD?+{
z-xL}e=%=@CqFEz!HCLd`;@tii19aDD*6`Ya+h!c)FENAvBSIJhG{C2{Mqp)PuE5n?
zvE-!_Ka-UMG{C2}t}x>z<_cWRb>-^u*(@KR0e(<xMto+jz|~y$`;+TGW#Iq~@IzW1
z*|`GKgn5q5ga52#Xn-Hunh~D|*5sQ<3nthc__-_`paFhZYesx#uD~>4g3W)Q&%yy3
z;D@(n#AoITO#3C+-1mhn9H0SyWNSuzX0E_AUxLkhU(CV*8sJB@X2fUa3Vafd5^T=<
zQWg%-06(TRBR(@%xI<5_aEN*D%UL==1O50`hjwl>SMFmrSL-GJrbK8!pV=Cby&2y*
z5C4mw_~+xRGpf1raB1luWzhf)^ru>P;&vW0x6svGfwt!Q<18AWfv&Tyv%eEr$ILBs
zHCLeRg#086256w`>a44E;dUx>3w;2G?At(_vHv@Z256w`>a44EMh~BvTWC64XtVZD
zvuuC{y53H`y%{}xW^SSBZK2KFKg+TK8t8AgX2fUa7MkuB+U))FEFGYM{!VK~d}eN;
z>2IOU;Qy1Q12oXzZOw?!%q=t>F0@&k+aH5A2=w<`Bd{`sWq5tAuY8K5rD6U(D+g$R
zpVPX+jF*@j7bWaB9LbeSFy1nbq29XZ3k=;F%oVtr>&jO?;SJ*$>WzDWz|gJ1T!E{(
zu6*Uwe`NUpjZ^W$)=e;L@*LBIc`D3<|C!|jG{7%u&4|y;6_^%GusQI*vT%R~_!X@g
z@tL^-(|`#!|6%8H47Gz_CopttFjrvOFTv)%?`8P_jTOJXH6uPVS74ei!R9>}f@3IS
zyg^{-)?lu{v|fVEc|XYV0U9fQb8AL?X0C9Dnk&3w&Gm;_IzR*cj#h_uZZubJH#S$>
zY`;(<G@!L^{T*vx`81vlHT?7O<udzl$cqpU7nUA>CDBx(AAF|PjQAWiLhnad=w)*q
zPoJgKK%b@6p`BZ+uI7qWFPrOl2Bkv-eb&}ZG;6f#YOX*p&-Hjlp`n4sc`VI{&ru_E
zHCLdQ)*f+gIjDg=dus$%rl=9Rnk&#tbB|}vT56!r(Yiv7m!d}KYOX*p?LFdc<Dl*u
z%^IPrxdOd3_=vZSgBs|)tr1w6qDJUyu0Ss>9^0Sjdi%~PG<0i34KMull}~ZBFwF3O
zSx)7eAM~TvEpXH%m{!#4m*8It3=Qy)TQ|Y1NidC=VDq7>M`(a?zgDV{33COe4HIlG
z9I|eN2C#0wcx$yWm@6<%m|*i@{Cd23&;ZxX7jLXK26F|b1ruxzoU(d^2DmP$y1-`i
z@R_*+S9A5Rd>ZF0q6WC$M7^npBRf~%YOV+DW8v`#B|`~*u+BAgYeY@%ifXP0>|^2a
zbXiUfuujQ?b&A&DQIp_mt_SR6;qgd;p#iRy>n~XavnJoNL(LVYUN+b9D50T&-l1z)
zz7{q7SeUzl&DHh<uEHE+U5(EzI5Y+>O3N``46ks#_?nq&t~|W367}Yc7tEijvEJWk
zRi;VQ2u)A3xdLsbzED<<&_G|h)tGvLxwYzQu0WfukIwuN8tBWkX2fUa7Mi}+s?FFs
zK_fKK$F`zsbuhQkd=G`TxA7ubJwgMGlUJG%pP5_eYOXjT)?9xrOGjuRaq>zt;xls#
zUCk9}Yp%bZr6V+uIC-TR@tL`WuI37~HP?$~=?D!ZmQk7!pP5_eYOX+AbLIBOpbY|v
z+)}>2Ho`KzcGOos#gX>Io*_#{+_rE~19;xn2&_y|li+HuSn?7q6OYgUpRaX=880z6
zuFnVKA1S3L&4=gA@(~)~3$$j$XXXk_8z$IXc&;oQp#iRIh^{FaJ$z=az}QCun+J7W
z8=(QND~PTrha>YR<_b&;=8DaM=TR~=z~w|aGoy#kBWv=_qX83a{=+Wd7;86_S!AA!
z9zHWyVC;K=&3)Jf9AoW<+RxhG89jVvuD~>3uGqYH{wx}yaVmBLW=)=olMaE+dA}+!
zG{6^c&4|w<YjT~3nkyV)%@sSBW2_x~Nui-zgSqkK$~TYA)!sU+k7KNLUQSSG4Ea(&
zg^Y}Gz4+>kYOXw7TAJR$7@=`0Zqgcom5I59uI37~nVRmw7@>i_MQa3BCgv8JzlCiI
zXtOo_gE2w_eaqGetW3-;G=GcGW^BF*7$Y>$w`z^R%Ea74^S20X)~1IrMrfdK-5P<F
ziMfU5ZxPyd2wj9RLIZu9)(EUj%q=v3i_m6o`Uqo$2Ku(G5m=d+TWJ0kq0Qiz&Ds$f
z=sUD##AoIfn!iP8v$(858wC1}tq#ps!ZN&e)K@;m(b6!NP%<>YS7_Y?vnIjST(PN_
zU|k``x?)^OVCdFhuD~>6+TDDJ`(=)??whY7Fm!7$SKv0gx$sh1K0@PET&;Bz%$htE
zZFTb?Zo@gox*fl|z|gJ1T!Gu@=D^>~@(~&<zDDaNm^HcLwz>HaclR7)-R1wbz|gJ1
zT!Gu<=DuUHe1yh|f2Va5%$i(rTim>dhX#(Z9v-eQFm!7$SKv0dIgeW$V}!<vZ`c}v
zm5I4!YW@zH+L|jjImTE|B{votx;2;^&6Vev&DGBE<+F5z#(ICRH6nX6zH=ULfS>3#
ze02tw&h_$eX=%J!9Amv{_Z1qtHJDpyE?sCd^)(YPLSxnUYt4wy%q=usEwtJCT3I?m
z1AYJ2jQGslLRWLe2{B_|J4;7spdZlc(9SJ%HCLd`+SgG!G|(rvZlYPEx3QWl&}Q!I
z3JnePDXp7m)(BnA6=>Uh*Ap7LYcy+wuI37~8C*sl%h;#tS3tK0a|>O~6=<_Kw?77L
z5UYMrYXnxNunaFs^_5R?v@{HwDaTk%_4fsaZVl$fMF|VVkxtAKe8nsup|RpSwPwU;
z<_b(BCfIza?mSkvzKg)nt-)M@X~P7Y3$L8zBQ#e02dx?LdAu@S%X3`K)xYv-RNJQp
z_^z!eUma1C;A*ZX_(y<O&Ds$f;JdZ1Qt={lwc={7C-~zJ?khOPy1&>Bm^HcLYOW{v
zrC;|GBQ#cgk5>M|wZUA0tGS-w9}DBYf@7@vi+c(T-5SglxSHz;{;}|HW%&q=72m6M
z6U-XfqM9qbV$D^zDkC(|_i5ckvxXlF^Hi|8+C}JwSvo=k`ry`xtTk77GuDf*nW3ZE
zrg*rt^lbvLXM_g&39T9NnYo3o<_ff#8jm;}BQ(%YY>mLm#N0wxa|POLeY>n3p@IIR
z))i{J#N0wxa|PO(>+KUTLIeHe){OYf+(K7#1=^bH9kO(U2KuS38S$C9g|6lbv^7^e
zm~o8IU87mU9SvSJR~}xNAdDep#GM=mHPBCQjljwjH9}W&1={wt8qx?2^fOvlsPPhW
zYt_|Ufwtz#?T;}+1O3d_2&_!ZjcZ4J<r7bh8T>|BIYI;c(AE`Zyu@6AX+@ow<$1nw
zmXFW?pVpcYpP4K0ejFv(e0Y;A9H9YzSZhXnX0E`;;V8l8!kcE{2o3PVTQlM_a|Nae
z6Ko#5Sr(4a06(HNBR(@%U|KN2=D?e0;Rp@zBU>}#Gjj!|0TXQgyG0g`&;UQGH6uPV
zS76#N!REeOX5k18@MBst;xlsvruh<V-n&&6j?e%<wlyO@Ggn|*FTv(Kd>+R!LIeD`
z)(EUj%oXm?$HFkRdGB|#c7z7{@vSS=c!{~uT)AR4S6lC$vy|U95zuG1Mr3cscg`bj
z)nmQ*>WpfxJX~7(zF9Ov1O1BDow%LH%q=uM&Att^nfiWNG(rRYs@9D7%-llL)k2%C
z@1Lb3G|+$Enh~FwTj&Eg6xxjafGi!MfqqYGMto*&p%3CvXtVaoSvo=k{l3<W_{`iw
z)7wIuxlhT`5gO<Zv}VL-<`$an7TWCnz$_i1f&O4?Mto*&q3Lg-&EThI=?D$<hgvh@
zGjj`l5)Oqn%W(T+&<272>(&UYOko*5O4L_A#nI9*cge~T8sO)&t}x>z=Eg+{F2NBm
zN;q1A@!ZET*7M(U1%_@7<_b(BCfI!Vhgm*CW5v&J&4|y;6__?mu(=QqlpJF{SiV4D
z=+<Daz%*fk&4YOE;~4AtZ#Q7p<eNteCfFQ!cVYpC#;JH=YXnv%<_b&$CfNLk2TG2y
z9xPuhFm!7$S76#N!R9_aNRIVj`4WMlTZ6d*(|idw@8N-xW2^_umkJEs8q5`#)=RKC
z@7`HHLgO62tTiJ(Ggr7n%@q!@=6atj9if4Kd8<P^7hn0rT|C);hBH1`NzefPO>0C>
zpYfgZ#6Nx3e^GD*b!p^>WcmnQh3?&nQ|{BCM-o=uIuDm<+)Z$d&_I8xH3BOWa|@l_
zI?#5Nz*9BH2o3b7TO+VCF}Kj!tpjb>i6>_52o3Z<x2{m*CFT}7yLF)LO7WxwjL<-T
zzBMC0Gq=#$tpjb>3OulLjL<-Tp)~?46LSll-8#^AwZH>A#|RDd7h5B+GBLN%*{uU@
z*NdlQ?FbF@ms(e-@e*?jo!vUncE!MF0URSV&|hwiz{<qjLT9%Qv|Tf}{V_&ppuf@@
zft885xEPUlERNDV=Ea9*<p>S%hg&n^Gjj#bZXHWrIuVb)93wQqf7=>?m5I3mXSXKU
zeE6`e9H9aJNb3qSUSh7m*{umS7d|}8M`(aQ+L{rcnJaL1Yl6*#kI2Fi8sNWc&4|y;
z6*#*!!RA0b`f`l*2>daDp<9Ew0%x}-*!+h_UyiXJfj=%VbZanI;Oy1}oBJM}<s&ps
z#V1-f!K}%BoZXsW^B$h5ImUXn{-nUrt-)M@vs)8v&U<W@kI-20-?wgpS)*n}>m8MS
z%e?ov1dPx?|3hm=d}eMmS2~Z))$Wp?o<$=xpkHf^$Xav#V??-Ke9a8GTrUqV90jOP
z9beoU=>HNLx;3Ik=xVM&o2g$SG&IoPZQVq(M(Ap;K%1>!Dl|0E-)r4OvqtD@u0Wfy
zUzUIo8t5OiX2fUa7P^`%&}QwIXXywH^bcDz;xls#UCk9}Gxsa9bc6=_$E^<S+(K7#
z1={TWN~J>s{nOS>G;4IOtGNPg27i^%&_MsJbra1Rp{uz9Z5HSD#~7i3{&{NzRwm}g
zwWGfBiH<RYKO-wgXn_Bvb%hx(F;`$(QLDeO(udUXnXLi-y1>w_5jDJw?$f`197jv=
zvjm3j8qAsmS99Ix&Gp#=Lj(M;tr_uoWKDu;!aNn`!RKV*2o3NzS~KD^a|J$#qXe4+
zpPPjvG{E0#&4|y;6_^H0u=($KSvW!i{BNxp@tL^-(|!py_dP!gM`(b*-I@`fnJX~O
zmtgarKCc+-V}{*;S(9%bt(RbP9zI^+7@@J^@3cl>Wn!*ydK8XkW!`&H){f9X|7Yt8
zHC|$FG}rx5Hdkv?ug=mD8qi;~Mr3csch2Lx@e}`ie04@OR~{~%_tq>Lp+rCAjIBFy
zJCB)LXfBz38)#eg+p=hc2Kr2`8S$C9g{G^8w&wcwEFGbNK67hEd}eN;58zN}Gxj^O
zbc6=_EUg*wnYo3gvxPQmzcWimXrRy5nh~FwTWES)XfyY_vUG$7`s}S4@tL`Wrn`kU
zd;eLMj?i7BS)<KIe+z8}|8t?Cfj&oTMtmMwBQzZ@v{{_nAA>ds^xoD8tW04UUOVb5
zpW<j~m_NzN5lZlb|F3n0880z6E=q6-j<otE_%&HRLIeEE){OYfT!CrC1e*_En}s7Z
zP6d7}&4|y;6__?mu(|McSvW!iIJ9QOXXXk_6DHU^`1&jyp}PjNCf__-Fu~@)HwX+3
z@YtFWpGVdtm<CL+`R|QcI6?zFwPwU;<_b*vCD`2erYszx0iIhk;xlsvruh<V-g|Qv
zj?e%f)tV8XnJX}@mtb?=pJw3*4e%LSGvYIIg*((-;T3DHZ^_aTx@$CR_^~keF`KLH
z;=d3S8qjmLMg&)m<rqJSSNP}S9)OPKMTmz>OMf^EM`)lg-I@`fnOo>;u0Wfq|29iU
zXrM3C>d?+DbTwC??S$ZyEshZy=wn(Vure{X(A8XlHe-J@Ye#6Haq>zt;xls#UCk9}
zv-aO*=?D!Z{=(9X_{`iwS91m0%>A(}9if55Us#$EpP5_eYOX+=y+59%BQ%is3rjQN
zGjj`F%@t@f_$RV-ga#6SVQEHuW^SRYxdLq#=k~{-4GLKrft4vN!^<c>?Ls)sV+Q}r
ztQ?^MJXh-qGhSkDT$Hd-9LbeSC%z}kM`(c0-I@`fnJaKLSKJUR!SBt&5gOq0v^uhL
z1+M10a#?zxlA!@UU+X5AHF=J!xgO^q3%@_hM`(c0-<lDhnJaKL*W>(S;SXft2o3NB
zS~KD^a|N#EdYpeO{J|_7p#i>7t0OyC;A*bN`NzV4rDSM;FV?yVW=)>sYOcrm$HE^H
z7#iS<w{C)2li+Hu$N9&?e=RUHz?W#<1hYoAp!L+O%zJ;6fDsz#OSNXiXXZw8<#uCp
zwF~~=XVC}^D9%}FMD}KU=RE!^e&TxZ)fv@XdAM}m7qe)D2J%|1J8?UYnOo>;u0Wfq
zzm!EIG|<;>-HF?I%-lj(a|PO(>zA`=ga-P0tvhi$kC|I&o@l;-K-;<gN*0aKKwrN#
zBR(^?(A8Xlw&wcPEFGbNzCmk7d}eN;tGNPg&Gl<pIzj_|!`6)W%-lj(a|PO(D?az+
z7@>i_QELQNCgv8pnk&%OT)&>RBQ(%AZe5|qOUx~FHCLdmxpMns&<26NX=?;lrmzgJ
z9rcw@akMndKV;<y4e(`KSD5h<bK|0fh2luAT!KH9<s&q}mut<4&&(BgKaLV?KKyhR
zj?e&KzBMC0Ggsi_aFk$k;Xh{K2o3NRTQlM_a|Nae6Ko#*OcsvN0AIB=BR(@%;Db0y
zusQIvSvW!ieD&6h_{>~^X}|=V|NbcpM`(br(V7vTnJX~umtb?>KWE_x4e)QZX2fUa
z3QY4Q*u3|-EF7T${_WO`_{>~^X}tuS^FE)2BQ(Ij)0z>VnJe6(Cs%mIn(G&`bc6=_
znyn7)+-R=c6>P4yC%&OXXh3h)8j-yj-#L#z!%zJ4@zoi0G<yjTmzMs17LCwAKd3b$
zJ~Ow_^t8}s>K|n32o3bZS~KD^a|=yZ3vIUkVU~{2KtG~2BR(^?(Db#?X6zqj=?D$<
zBU>}#Gjj{g_fTki8-JXoBQ(&DYR!nx%q=v%Ewq{YCs{f|1O4dMjQGslLet$so4x-#
zOGjv+AJdu<pP5@|`der-_)oKRga-O?tr_u|xrL^~g*J<G`(w}sfqp`31XiZ744Z3x
z<x?Cj4fD;c9H9ZeMe7PPUSe)slwd#{$(2j+x3YYM2KZL38S$C90@H{IHXr_57LL#W
z-?}v;J~LNf+AzW9!hg@g5gOpzv}VL-<_b&`CfGdq?JOLj0lq_PMto+jz_eh3&4J&^
z!VwzaJGW-UXXXk_118w~_a9j}LIZr4){OYfT!Cr71e^Q*GYdy(fbZFw5uceW@QFA|
zuzBylvT%e3_<pS!@tL^-(|QRu=Y2N|M`(agZq10#%oXlXb6xw&r|)Iy2o3b9tq$$n
zXs&$o*j(+c`?(UK0exa?MD}KU=RBPmKk?7!_dMZ{7a<-lEIpkri>QHqd22>|jvArq
zX`z><o{r2?>aNkO5t^<RdTHzFD50T&er0P$e2yBS>1&~v#-4s9OR0f=RjWfgw^mJO
z3%#`Vbb6&j1O4jOjQAWiS~a(a(90b%ogqu9fqqS^Lp!%tO?L~uwD)vIr9%V#`qqs2
z95q@s{Vnv;;M1A1lp5$av^unNYt?kP&`XQQ_D7f+=r^_|$mghGbFHs@ilc>L#{bDe
zYJi{I>d4NGixLcoS9D^Q;Qv)JG{8@7&4|w<YjVZaT#xsUg@2KSBQ(IzXmw=g3S7<g
zc>kwW|EFYVfS=vE31&^MxSH$n{z=_01%?LrIjx&u)+D%^>+$xKGO3!nTX57Qm<G%@
z&-^zed4dM``K=l8nYmhVHP_?qW8rDcLTZ3t(CWy}6}Xz~@%FLsq;o+H@QYeE!K}$s
zQO)&u`&f9IwF+o}U);J0W{qrdEDmMr<&*1lL;|RReran)e2yCaGgqEtHdnj8oh6GV
zXh7fG8j-c;`fG@Az4+>kYOXw7Sb93Y(9l4CxHTg_M~%?cT!FUc`l~`i1O2zH4(;4p
zbv0L@t+`%6>Ciy`UF#;AHClBwSD>xAUQlRgpg-2SiDr$^)m(wL=6WHap@IH*>n55t
zLRWJI+RS})0w!pnKhc^IpP5_eYOX-r=F^Uupn?9!R)^**%q?^^SD>xAUPS58K!2t+
zBR)^8(Fv*M3bZv>Zhwpkx@$CRc<rdKe2Sx`Va`e{z|a7{r8NR86LSTw=87dR!Dq|L
z2^!$Hx2`bbCFTlT&GiIpuG87GoEqSFv}VNTsL4}N&GiIpuG2XLh6ebZt&Z$mt(Ydv
zH_|+~SIN)-zpFJPK2NO46<2fhuY8)$nT6B<zq{3uohxuPSO3bV>0C;N2KYU#n_$-D
zimSQ$S3XVW78n}f_qJ|=S(D&uuKtxz(|H7j2KWQ5n_$)?xSFef<<oRtfuRBZVCyEB
zH8OQIS2)C)>-mI+2Kqy-n`qXsx$;!7x!OhO*Rynj2K2M75z%JMEaei$_2R2D=xE*y
z@Nj8q{w)|2G|=@C4?n)y7|bnnHCLdmx$@UyOwd5%gPT&mzBZU!=xVM&TXW^F#h9Rh
z{EyZMtW3-;^Z^{|gqX4UYcVEhp#QTq0xJ`93r%MWZOxUx7Gr`28lSS1^7XaB+(I9Z
zL!qs?^4DTa&_I5-H3BOWa|=y(3vJDnzZPSH2Ksxg5m=d+TWIb>p>1FD*J4c2K!3kA
z0xJ`93r&X$ZOxUx7Gr`2`UkBMSecj`*N*ziCpyLqe$lL)paK3|>k2boVy?hD_V?0>
z7t8Vq8sN{jX2fUa3f#Nfe0cFJoS*^zLaQS?SK!{;=E6%T85-a(wr+x1!|U^j$MnuN
z4_;DWXn?=ex(Q}Yf_q<^1AjwcXn?=mx(Q}Yf_qn+|1KpkG{9eJ-2}5H!M&%=eU}y(
z8sM+CX2j=-H3{a9&L&{q`^_wzpaK47Yesx#uE4Zjg3WoC$-)U5;BU2N#AoJ~so7j)
zYV+PPSvo-j{co)q@tL{NT)AR4S6eRw82q-0fG)2Tdn0_<G+h@z^3TUtXVB4HFAtZN
zzD8C}P@*4-2lUd6_{`iw)6+tmseda=Cuks#Xw8Vv%q=usEwtJCx3hGD2KscZ8S$C9
zg{H5CHe>%zmQK(>AJv)>pP5@|I$LP7_BFF~f(H6mS~KD^a|=yx3vK4UR+diCK%c%f
zBR(^?&~&%ZX76if=>!e*8Co;qGjj_~e+z8}zfP7;&_JK1H6uPVx6rhO&}JEKe+=3n
z&}VIpz{(Vs;YF#w@+pp%hPiB3PEdj$^262@X1v7QxG2GZIFc)u;LBzC1P$<yS~KD^
za|N#EdXhi6UOo#aXn=px>d4L&xSH!p{^WWEB|`)J->sWq*5o;^=6aHSEIeINU}%7U
z+PVp5O@gbrp5z}3UrAtSfPdDy31&@#tGS+J|KM)Aa+XsA{6DQ3@i}S|T+Q_)|IqR(
zSvWxh{J*V^>|Cw5n(Imaz;;z7Lj(Ma)=e;La>cY>?qhS_)v|no68up7Seg-^nOnA~
z=DPBgPt(=2lp4sf)uElc=k&)s=wA1_+nw%o?>pU>ul`bFt7ez4pS7vS+~)!Jy8j*i
ze`Jqw?>V_Ou9u6Opm7S$)*2C9_?KfoBVL*HuW24Zy|7Y-)am-I0X@5*&=_m?7r%$d
zk%ZO#MIJ8Ew@$(Y4fKUtGvYII3(d>gQTbc!{^EDDbb<!@=+=z*%-llf{Y9+W?k{eW
zr4w}5Xx8Y2<o!jU?f&AnLPG<6k=Bg(Jh4XTyuS#v-Cx`;ODE{A(X0_V?=J#v_ZPPp
z8XD+dYt4wy)9vw^(0P9mXuH1%+n`fJ1FcVx9tzzW%q?`@Uj*9jFYcIt2^#2&wr-+X
zqgChqMWF2}$L)_XK?8lU)(EUj%*ExCJYMATmzWoCkd+fO!0=vaMto+jz<GZWOI|wh
zhFLg419;9>M|Q5jG-9sUe0U=zLw5~kO`eLpzu=0^g*O%$8sKxcX2j=-H3`o93xdsq
zH_5^Y8sPJ^I<j*G&if03&4D*nGBm*FZQTU3CRd#I7X+LCZYD4^z~^h-1hXc=d4EB$
zx$ouzLj!#N)=e;L5}fxJ1e^D6Aux2;VAdo!?=J{8=iO3ZXn=pUH6uPxtdXf{J#`fG
z-mS89f(H76tr_u|xzSwdJT_N*!v6g%nxFx_WNSoV@a32uh*!8?e1i|UTrUromcDlu
zPS8N(td(ZOXXX}~o)+3neV;6ypn<$>Yesx#ZlURFq0QF!&C&@P=qt2l#AoIfn!Xm=
zjD5c>ouGlfQfo$hW^SSBY@yBC_s`M^x@$CR^fuDlLYuiCAT%`4S82_N&l78ern`kU
zd!L-86Ex6QYt4wy%q{eZI276peoB^3&_LHGNc?nYV=%YS*sFy$i*x&9&<2674@~%B
z$i@iE@Y+#dQWZx_!`vyWCuo3wqjiJ3hq-Z4f&p=)bG`)MIm;(#fG^dW5uceWFpZdC
z^Wj~xaDoQ-(ybZsnYjYfh6y$o{y`Q_&;a9u)6$Ii%v^zK!UUTK|1b+DXaI4+EzO9}
z%oUgxOt3ldu30!i1BkbyG$TGUS6~`2!REiaW#I%3Al{DBjQGr4foZ=4oBQsbg%dP@
z_~S}5;xlsvruh<V-n&N@PS612k1NfH&&(B=)=RKC@19vWK?8_Ct~4V)GgmnM3)9i8
zthwGRODAX`@#mFh#AoJ4bEQGpT+JS*X3+!<*tJ?CvNz*9=jqA#iGM!7nF@!zzVUEr
z>BnTz1P%1fS~KD^a|_KS3vH`@Y?e;YK;OJIBR(^?&~&xXX6wgg=>*+1nl(Bh^tI4t
z?8gfY4fHKqGvf2a8lmZIq0QP)$kGWK=(+*p&DF+WZlURIq0QV+%=!r$==vanA2MtV
z<`$an7TWCnq^zHyfvyiC_#wl_U~Zx5Z=ucLf0XqTG|=@y1V3ch7|bnnHCOCwvpBau
z25k`N`XGWIGHi^n44Z3xNmU#z4fCL^o}dA~cIyUr4|C(9goWZrJ7o!eaF$Qd0AHsy
zBR(@%;A*b>{p#_MES#VLzHX}{J6GUpuKWGT^`T0J?i$RRJjc~s_xqFUX#zt7Tpt5M
zx5mVp1Xpw2?@z7|%kl{t;2XAXf?1Q`YOeU-PF}uw56|)m8sHnXX2fUa3S7+<|GSY(
z@FTKtg6<m3np|-;SN~tHn;t1JG{84*&4|xYli+Hu_@DJyuJ};`Lj!!1R!4Sj*#b9G
zb-l3W`e>y?1AWuhjQBjUh93)aAG5hyFL_E9P0)bi3Q-!7wdVQ?L}+7tF-|pC9xhMC
z3j(lbf(G)gtr_u|xrMIg3bZxX7iQ@M4fNew9oo5tuI37~osbtP9UADnw{D_YqZ3li
z6=-X&FBTda=zFwoqFEz!HCLdmxxPebXrS-ex`}3u(A8XlHgmsJXlS78-cI*=Yxs#Z
zLRWJI+U)(ZES{i&uFp95`NhUyZlSBW0&UIp<yk*L1AU*?jQGslLRWJI+APlPk1;_5
zec#pytW3;}i&A|_70qJ?e`;1v&;Z}Ab%hx(F<0Pfu2}NYiBHS&2^!$rw`Rm=<_cWR
z)xV@_dU_U81AK>8M|Q5j)m;5cs-|Zs85-a_wr+x1!|OA?qXb8}{mg^U%<>5u;QGW4
zx;2<9a5Y!_m)gs7{H!dWpaI553Z)tGnYjX2bH#t9wgf*r3nyp+OC8y{0#|cg`EO;O
zqhx3R@7%fxW=)>sYOeTq=$0#fuE5X$-=%dE%$fvObH%@zu>?O)U}%8xSw(3^e4bdN
zOVP17<jpu7V%~dxmQK(>;?s)KjQGslXs+CDY_7K1UYSJ`G+_5{jmX}N@0_Q1;U}&a
z57=}x*UQ7@sd#f1P0&Es6D*%jHwJSHO-~DL&Gk>Seu4%XPo<?9@tL`WrmKav=K7W_
zouGllQ)y{Nd}eN;d7_23bN$vVouGlNCs;n6ZVcuYx|%D_wORXZSwBGoT~DxlI^7t|
zEi}EYRhzlrp7j$n(Dek%r_+tW+(Ms#L!qs?z9Z`=XrSv^5V|#(TWI=QXfyab6EHyo
zT{n-qnat?nGjj_~hYM{M=k~{-4FZk+R?64cMp%Z|4*a7e#M3-x@K<H&1P$N=Ti2j`
zjk$4A!luBHT)A}OA2Sun&;Xy>8iAFGxdPLO2{s?TIx8n=fbkq%nh~FwD==-CU~}Q0
zWZ?u2U_Ep5d3s|oS74ej!REo&Wc36Ma6NNFw+3?srUesh4t#BvPtaY1S(Ceh228N|
z?{xx01N`vTjQBjUCc(5{g3W!e&%y~B;77D(#AoITO!Fn!y!VDIoS*@IWNSuzX0E`r
zUV_beZ_L688sK_@g>DVz3U}yZVR*&7_of6)&_F-Bbra1RKDlyNu({fv__HjXpaFea
zYee>DeCIrU3_tPDKlCM4dAPLnhq7pb2D%<Ip<9Ewg{G%@eZy}tQ~z}WCTO7RF_Vvw
z8-uxprmKZETmMbgPtZWuW2PQEGkW;U+(OgWLYuKaoMjU<(Dj(9$Igr%J~Ow_d=G`T
zxAAYYY=Q>*<*ga<nYo3gw}m!ye<VvMXrSwXjSpiRgSmyS=8Ct`?ETTKpP+%RJ3Q#t
zU~Zx5Z>`!4{&xwOpn-l>Yesx#ZlSBWV%27GZhs8gAkb(-rF?yDgk^ZOt1qdFqorZ~
zJWD5N0H5Bv2IXtajf)Z%iX*vl34S+Ikqiy+Gg>3CGBH=+YOV+UW8uHZ$_X0aXSS{|
z<0a+_T+Q{Mf1vi4Sw2B`4Q5TA<7%!4{bAxg0z(7*?ADC<Jh3Lh)m#tyh4j5yI6-#}
zW=(>txgPW<*Y^nw4e)bXGvf2angmyKJ?I|`zds8nXn>#Fnh~FwD{wW}gZ||Dfh?S$
z0e*gKMto+jz$f7-_pv$egIPF11N?&4jQGslvIXyJb-l3W`d3*xL3fR24Vx?9JT_Om
zbbee=Xh4@&inZqYHPrCWKlCM4d3fPO)&J_=^f{rSfqr|dGEJgJ=xVO`E!JE=FEljJ
z?`SoqUYJ-TbTwC?t+{?7^CxJa-`OgX33Cfw%@t^Cu3yZ`3A$@EYqaWWu0UIJ{gTko
zK)<UsBR)^85t`eB+YV^kAz#kY2^#3S4TEkC<`%k|E6~<lzmk9n8t6Z7-9)oStFGn>
zv^CeSCSZaF`rWM=@tL`Wro(kY%;Mbs7!x$m=oY1XeQhu|t{wFyRXo*Z@K0pv1Pve_
zY)UiYGjj#5=8ChibmAwoaDo=F)RCPla5Y!|lB((Nl?)9ao|sBA;&asS!jG?}LNwn>
zbKyT^;RFpJo|sBA;xlu#;%ct`B~{a>vXB};JTaAK#OJ8V6<2dz`I4$nXW;}5U_D*&
z$!TLSS1YCg^HiAs{xPd3Xn^s&RGJZ=nJaKL*Of1+`b-v1&;a67!_tiS%v^!1xvqRk
z)n~JCf)=pUk)10rt(T|5ocB*kh6eC0tr_uoVvVjB)m-5a^WHya=>!e*+gcskxzSvC
zj@ex8`t~nMga&kZrP!PCo%8e){KWO*%RctukQX5yE-n3ESu{ZdT@I8ZGkW;U+(K7#
z1=^bHce8AQ2D+>w>l_a4+(I9Rm$YiL_4kwx4Ro1>M%Wk=Yji>m;8195uHVo42^#3K
z3$3s*m|JK%TWD*pKgjwC8t5_%&9E_;TWES)XfyW@vwni^8qFG=5bivoZS(y|XlS6z
zjnJ(zu}0`>uGk^gTz{N^2^#3~BfYjUm|N&-u0Wf`x&1L{gFu%b<<AH%rmzgJ&-Eo$
zakMnd*RyJZ1{jZGr3>DnADJ5$B`g$2Ix$P|zh?df4IrMFN;Bd!a|PayqXe4|zmbI#
zG=O+wD$R(`%oX@J93|LX_{}Vwpam?=h|kOw_yCR)Y##hp7EaIrzP~jiJ~LO~gE&gC
zIq=`IaDoQ7p04=hv@w_~@bNfGu=(%bvwDIC7|%<k8S$C90@Hp8Hurry3nyp*Khl~J
zpP4H#&6i;F-gmNag6<m3nlwl?*Of1+`VWDj0scg5Mtq)Flj}V6u`s-1&GkRCbb<!D
z?n9wlgSpXMc`Ddk?L_={mQK)sey%kldo#Xsp3i`vxZXowQk91bOV3jlQ3GB3S^Ik@
zvW}xhXnLAg<&`g~n&&K_2D)~%c6i}-YSai#R|~zg^?XDYQ3G9jn)`KQM2*n&wa`mr
z&!@|JYM^UZYnQLlqef^tTj-^==OcxN2D<h&_w2@q8lmZJp_k^KkIH&#plfGqr?1hY
zMrgWQ=%u~qUlAG_=-S!Z>8ohg2+d6`^m1R%r_W;QuF<R!x|%CC-?F*J_D3c)&~@|3
z8^eteHN1AzmsG{k!Z6cMvzi*<r59J=QIp_mu2}LC{4;@}0j^JF_=(HLm{^nGYOW{x
z$HG6)>IoX)`gDVzTx<;H3S7<gME_X$f3kXl2Dm=k;O7<_gSi4%bH&$HEl<V&X7vOO
z@K;+i;xlsvuI758e=PiqES#VL{#vUeJ6GUpt|$6ui~px&Xn^Z62)Z>U*5sR4&Gkfo
zuKHz`PtXA4KCLt(J~LNfnlH^_-cubf(gDPMTB$-NaY4@&pM+q7&3QxC&CmeWJst1Y
zHU@Lc)W_mb*NbIyoyV-F2D<L*c*nLeqJ|#}bH!|~w%#*lCBJPVp!HP6Cnk=y=6W<<
z=bwM*ORDnl!pz60Q*fUAafSxEww<<NMh~BvTj*-8_$|vj=J~u?M%^`<HClBwSD>xA
zo=<3KpleTSk7xAod1j5!)m(vI8hbu}mQe#;yIQ;aaA@Zix|%D{)?9y8=}@9i!;hsI
z@p)#AR$a{%Xlt$)$kG`aNbT&?^fo&feTOwdS91m0n(GCHh6Y+Y`!wzJRWxgaroU+x
zpv~YH%HkOsXx)aL7B0@%a%OI!=@+5RGDm0O3=Ony!%l;44d%v0slKF&i#CIwDa&Ul
z!4F+}F~f(=%oVtrE6&E!iD%B585-apv>ry=@dI-OuIB1rQZ=6?E2shfVe1aoVTVz}
z%P78@3W0np&4p*pni(44AGaPx+wlW)wc={7{v}oO*|LHf;GeYaU>$ZCHM!zyuKp!e
z^VtQ42DqM9pj#tq5?syIzocqDN0w6q{L|J=Fl!QA&DFo8YSyKl8sML`Zh~2pV45%A
zJoDZ;vwVgI7`IcU8S$C90@Hd4Hs_ry3ukBm>(-06RU3o3W$J3KaEN*D+*v<E1C1N1
z(v0}b+&yFb>r9i~Y|Zi@m7vq~L`99EyMO%@GJgd!>)*>bg1R*FMKXPc22{^dr|H>h
zwOi-b0<1n~&ch}8GD1TGjZR#e5uaz)9LaT}MdR=&9WK$wWa$hIBsy_vMto*&p?R4Q
z+O89POEG3>Al0=`V@KW?%q=u86hd3K=Jga~h6Y+)`!wj*U~Zv#sSw(_HBT1C3=MR3
zZFc01!Q4Xg9TnQTHBT1C3=MR3ZFTVoE+*y{nwJZqty}YCVa(87qgkUJlHEEsi(N5z
zvM^?7pzDS}HwY12Ow28GcI!afHG?M$V}=I0ZV1@yHwJTYF(R+`ih1$ZvU-LFSf3D_
zrcVsk*vu7p$4*(=<<|v<23VgDoVIess9!R(CRg11#O|6eDljy_y5~Pl&j1D6sWWR5
z+`GhFc(E**p#jzn%xSuz*$J#;<_g?<#5{QMOrN0v#!X3SMto+jz`aAvftSd_85+Q|
zw>q+O1?K+9U2Xomq>`ZlK1XXte4bg8=a}|Ou(|IyvT%k5cyDV)d}gk|*{!*w&3l*1
z!WkOibGACNa|O<BO|Uud(n^Nz8q6A9FK9hoip+bzDKs?D=W5M}&ogV-T<JVESG!B*
z$;X(X0X@2vudg=OYvXmU_s~~9<>AuOR|~+N85-zXxBiZd9zHX-(DXD<1%8W}`s!IW
zLjzs?o4t8sFt^Zjwa{kkYh?Wl4RrNy_4AA#J~Ow_^tI4t?BB|=8M<pUYjm#ZY@yBC
zzb!O0(AB^BzHf|~HA2(dLYujNC+lZupz*$xX2fUa7P^`%-bS<cHM4Yv1`_W}X-0fz
zZlSBW0&NDrR+i4tLY6wTa|>O~6=<_Kw?D=V4J6+3Qog=6m>buQ`pPG6Ycn|i9*h|p
zz`Ehp4R8b(6LSTw=87dRoyfliV}=G89l4aRuMOr3T+MZ#ea<{zHcP1iL`N>oh|f{O
z3;#Yn3dhlM#h1&%85%%z<Wfg=u2x*lb)S9CJYQbP&;X(%muAH0sL2&qbKU2UK3B-X
z85%%z<Wfg=u2x*lb)S9CJYP}C&;VBVhHj0h$rV>~-DjUO&sWNFYJky^OE<x+Nia8F
zUOmivSI+VoTENnb_{>~^x$zQg&bvw$&d>nXZ2?>U#$axlx|%B-V&1!I*3ZyDU#fM3
zyob5bTxk$CS8G$($<i4bP;8&lh~Rc+Ip*8r75@2$zVay#mj<~-7S7N>R+D7|-5AU*
zbTwD}7F+c#vwnu|8qFH5x|%D{)?9BTG&IoFzuB8N#>^U_tGNPg&Gpt<KSKju{hPgc
zV=%YS)m(wL=K8x?KSKkJo?My{pP5_eYOX+AbG=QL&d@@ZI<#{OUCk9}Yp%CdIy8`V
zYrwX@F=p22T+`pYB>>tCe!Hxnp@FVj1GfE*!Q4XA;X<3mZ=dzFL7?l_fNg(cgk^Y9
zs;_*CqorZ4o7FQkz<5_mH@JJ48y6*<103nZEWy{y@);Vyx|8O6voV+}a5Y!|%BT7I
zSxwzFm^FDSXv18wx$p)8Ljzph8@e@S)+D%^tAFLwe8ViK?i$RR1XpwQuY8(sBrr6<
zbz1=48c~zrYOem3PxFnloEqS|Er4!~s7Y`&SO3bV`6gLT4RGBSK(|KJB$(#QH_yCx
z(=4B%0j}Eu=+<Da&M~c*U~}HhvV4XH_{yyr@tL`0i)ya$iZ$1pXXy+LG<tGrMto*&
zG*|9pHdoulcgUg{8nC+4hsM||-68V>@B{yRe02sL&5IBZmzKUq*38gAS0`kb+ZfC(
zbTwC?t-0Pa>t|@7s}r)zZ4BlXnrB0+wi9x%te>HQu6D&%v@w`lX!=@cYp(as`WYJN
zYFE&$!Q4V0#G%mET<?>B85-znS8PQagSmyKw}rOmdf%*{p@FV;rS_H4!)N9en(h|b
zn(O_tY=#E<_N^K5nYo3o=87F+2ETun&d@;LvDKlSTj*-8K%2$6{V`~RU87mUi&A~%
zQyeV~gEex@wbptx=40>1V6MQlqFlKI|6W$l&{%QZN$bu!qleGT6_`d$u=()!vuK6}
z7_GiEBR(@%VA?Rj=E6H=;S3ERT779od}gk|G+~0xgLlrt8Ct;7jQGr4foZ`6n*;BX
zg)=mOH)+j?&&(B=228N|?+>zYh6ebitr_u|xdPLE2{!lrVHVEN09VUmJK7k`6}XzK
zf92DB*Q}=Q8qAtBNHtgg%BT5m0z(5_oseB_V?<4!0R8L7(X6bw-aYGQXrOn~tXRX3
zg}L3>Ty3+REGRUf<v;mx^<&{DqK50`_dMZ{mrfooE&WKLp@FV;rS_H4!{?bbLetYi
zo2eg_WivF;)vnaOGJ5#T+(OgULYu80on<pL(ABQkiZ%vw3(XTPw4Lk6Wc>^cbhRtC
zqK(1aLetqoo3$UC^)ock)vnlzHU@JGeLN0@Hgi8N>t|@7@86mcpP5_eYOdHJX79&m
z=?o2YZ9;8I2V*m{MmwaME6~<lpCB}J*J#!VUCk9}Yp&e>7&A1`r?f_3WnykzJL)T+
z=om9NKpb-c(T3s|K(_{S1+M0bB`=-$z$~Ak0Yn=r&4|y;6}Xx!zF>I?J~azxXaLcM
zN;Bd!a|N#Eif_1Ef*+KHGc<r`L!}w<nYjYfg!x9A2Ope;Gc<tc7Nr^SnYjX2bH$g6
zELZ%HES#YMylbl?J6B*DFjs8;d#IA30j|!XPLt8Y=b1HZRrpWHaFk$k-)UJiLjzoW
zMSUithtJFvnC45cdGBFaG(!ViPgi_$+8E3gnAS_MIq%_FJwta5My_y&nkyV)-g^Yn
zFlK0=>#>cGWE+FI(OkJJ*j#N-JSi(@Xh6$<^cKh7l%4bZQvAd}AOEzZnkx^N+wHko
zG(!VjO;$~JC$f&2Tj*-8K%1$bmjyF4(A8wsbPKmrnOo>;u0WfupPxlDG|<&#*+4f2
za|>O~6=*Z|3$lKO2D&;SyWGZLZlSBW0&Q>O3$uQP2D&;SyWGZLZlSBW0&V7gQP$7U
zU87l}9YS}rZv$=iezDNdKv$Dh)6MAN^UNBdPsE|nX7HC}*$fSIbwYNzjltYP)8Rs!
z#ku`4XoFp&S;MOx{yhyG<@(Lwe}oXm3=Qz9tr1w6m@9BKSDfgj6Q7)wGj!Kr*5rz-
zx#FYjCHN@<Lj#QdR+<r?XVxURnk$|qmf)vm;S3ER`dev6d}gk|)m+hCmf)vl;S3F6
z^+M>@V6MQ`TvslnPtWoh8esId(v0}bT!E{(`d2>9&&Wb*0MXw{Gvag9<T<AOa=V%P
zo|%O+w1B0K>|Cvw=1Z`7?^#NQ2Jm668S!~$O|F>MORzcb*;zP41N?~AjQGr4;SM!d
zIK;g7oGhK8f!<BCVhx{M`R1{?+NJYl2w==F6SSJFn(k_IeLD*H=i{q0=xAPqc(~lh
zZ$J!VhQ@m9!q1EP#$axttGNPgrha4A&(K|?S))}~a|POL{U)KIfvyWbFX|g(W{uDX
zaHtbv#(s0w&(J{E)tOh`jltYP)7e5>bN$n-pP{=(vqr1t_7K{3$XkSl2Kr^K8S!~$
zjnLIxajwnYZ_Uyf8t9j|I<#{OUCk9}Gx*z-4h{4xTQ||H(W<Mt0&N!O_Q#l^fqqqM
z1Xd>I#<ioq@`;WygX7QVnCmp4amFuzZVl!NOe<>j7gqX^I=`YdfM}eh$~1`@UhVKj
zPY5R1e2BBkG1u8e;|wr#YcN+UrVSHpF2p(InCsl4aRwN=HJB?fO_*Tw;2&rC3=QDZ
zTQlM_a|Naa6KoEAbr#Oh06(iWBR(@%U>Y#N=D$D5!WkN1T+&N3;xlsvuIB1r`82;K
z3#kEoZmT0ZSKw-{{*_PjYn2QQ@bg+X!K}&cR?YQz|F?x-ConX?&u`rXvnJ2%q2>xx
zoA+KXG&Iol0K|uzjWM%^&6Vev&DE}N@5ss-8qnHw+Jvjk^&_a^dhyj6bTqHZJX~7(
z142UsjVo?xMtq)GBXl)apv}}D%+eVe$hta1w+3?yO;>BxX6wI7zzhv^U7dO5-5AU*
zG<_|!8T&(7KSKkJD{g5<d}eN;tGVKY{J+M|1KOIbDBCm4>Fxs}@dG3?B*|gsn?%kz
zNd}cHDh33}Dog+oBRPo*<{bDXDIz8?faEA5K@6zmD5C!xs&3ue)xB2lwcKytQ&rE|
z)2H8Er_T&+v-V%PbO#kOKhF4gI~bP*YvNpIa|ODY`%Qs{Zbq{v(AivpZWrI10}U1W
zHKmU9dB>VSXLAL*HP^p(=?*INYfC${auc1+73kJndHG}PphCZ{RDp$wx!ODOkxz6?
zGx)1rxq}Lfy*Jg7J~KDK*<7*Yxf5|-Id*w|vG)oLT^q~|a5mR7`kgDzD#tF*Ztm02
zwZYr~XLCKH-?`$Pa_sWl{zj}Ax;B^_;B2mE^gGu-a`_IbQ?Lch8gBe&=zk>Xi?2EG
zj{^)9I2%AT1V@j~JJuLX0~*}?_j(uYpaSRiAML==qcd{@d<KpTZtnXN7ww<|=S>iA
za8?F$1AHcq3~t_ggR6H?f%86v_aG~SxdA>4M+P_N{i&;W(9K}h7<bTI;gIINHwGFi
zbl#=JU5lef=N)p@TzM+kT-%BGTNmu0g62gR7vW-a{V-~{-h)Rz`EYLO_XZj&^xH}u
z>GO^?fzIZ-^vI|8xpW5=`W>YmTDghN<_dIcuJ4a@sL<~$T}87dR-Mfi=+<065NPOT
zG;0E#%@yco?GFYTD)hTb9qIFqHG!tL`IP|ZX6}D*=?*INdrBSYGjkJ7cL%!J`$I0>
zL50pMg;&AKU~Zy$Q3twR*Z=7H9aQMNQsT;S^ytjoMAPAcZWia|kFkRaomUF4f|bEs
z?H&2ZC!XqN@V|5Q4k|GA-c(2W%-jHHbH!&kcj8-IxPuCay*Jg7J~KDK*<AZ0pLTC`
zAyq)^y{V4$SvBk^c+eA~z5tsG|K5c=sDN)M?a0cF6=!qpk9^u;6XKu>ocna_+X~Jm
z)p*6UpjX@+_;y$ApaSQY^Z2qpW9m=l#)@e`gPZ@bw{h%pkIV1R@qOCSqcd{@O#2z!
z+=rcwW0yNzwt#2}jvk$v8(^Bx;O0GSJ{-H;gz|ch>)X+zGjjt>>lxgf_ih*MpgPBS
z*~Mk(=+T+Efjelfa7gnWb~TP&?rwSE#f9kT(V4kwu3RyjYg_L>xqwfb(0Z|%rz&#H
z@x$}(^Z1MZ_;_>%9nDRMhjUB+hl_SlA^)Y+kv=mw(e!kn+nwuwx^xE>`d>>O=`(W^
zeJTzE-E93|F5N+e{`XQx`pn!!AID*!TXX%COLtJAKUwNXpP8FzIy=zK+Mjmm4k~n>
z^Y{!LJvuWt(b-(_F*b95#$`LG(0R_|GdK#Z+(c({1-jY$vyl!JI?s8028(Fc#Ko7*
z73gO0&jlK~8O@qNXLAL*S%#NC25lg8ew^{~Dma^D8Sc;d$R{1m4f7FK?VtkZH>LRI
z<ml0vx!RPlP#neT=iraJXa^NIzbElK(8^$LfN4a7n-4$c>K$}5m^D5Xw4uSxg&z+v
zRN(xM#P2^VW5*hUX+ndW2mjgCJLqOGYYe6Z4Q>wnM1Y|J=edq^@95Ea#~OpPxh_2N
z3EL*eF1OD-*KzJ0JvuWtz}Z|E9{Ge#lVg{gXP)ag_l_Q&nH%72u4nZdwtsWc4ysd;
z=Q_^)QDo%?IGgKPy;)%|=Gf()oaZ{uy`x8G=Eg^M&|Kk_)?Bd{bL?_Y&a)k7-_fHp
zbMeS0esm}Gf8Y8AC-0y-3Ar=JPJO}!96vk{uf$(F{tF}Mu=FpEzUcHFRM6a$V~<|C
z6&}uynu)ON);>JhsC+=<aH9XF3jKejk=aBwf#xQ$_q)t@iQ#;%q!RtKcnj*<P)(rS
zt+nd;J~5nR09ELGi+IZ=ylMjNZY}hDrx<pDh6<f;5pTJOW=){ot%aWN6~ho{sL=Tq
z@s^8d)&$z!TIhMV9>zdJg+8Q9SiYv3K)YKDJ@3}TWB^s@eW@dTR!yMYt%aU<>j5YZ
zs?ZlIRbXLKO`zSag`Rh7UH(MF20~x7bb+duR5R*grW5@pZO8bM%Xd(MpPFA{_yuKU
zFc-U=7K)=-{mGFXcG!K{e^Uj{?-|gwp&EnTt@##nAMU>5a;m_&^7toNf~&@0cWZ*@
zF5G=Jz|hTL))?$=P4L`<yZ;U_RNy=%af%#0I;+NDcWZ*@4%~e$z)*qnl*B1IimcpN
z@#%QQAKu)5yZ?z~sK9wj;uJZ0bXJX5d<G&0&)v8Cx{Ig+=NrTu9z|AetoTg4V({F1
zyZ?=3sKEIK@rI5bomJx%pM{9QbLZ{QK{%)a=NrTuDma@|V_bA=etNB2$NqT&Rp@++
zc*_}8f2xMfmEV)uT<7<zLv&;+p-;P5sR+k3ADM<L;7_g>kIo>M9gv4JOAnWH6;)`I
zr8?4Q)dV`5E6{UO50`Q&Rmdxrc4+11s<XKQJ-7AnO_2`WjAl)&I-4udb7K#e4m4Eg
zE0sFZXVnBcn=8<BYY&%kDOG5E7O5Rtxw&e3J3hv_xrfU}I#kFjmpamC)x@gl?m*A&
zJzUPE)Xiwt1e*R1^xWXX<pT{B`YNT4^jS55ro#h0x415UgsDPbwX{S1ifXub<RhPS
zG&jsQL^4$1i<ho~Sz|D*7^|OyFX-|CDlkl)>PVlN8{llN{gF?@H@c82;3Y~svT_5Q
z%@q%Sny(n&g*b-%PLz8{>?w{OotYcpY_9#0Ps4>>MAeG7fLY^noXxdA@@cq8fT05C
z))ZTnqeo}e7)%5D!)yM#sEY=uz_~GT(^(nJjTO^=1~>O%tLGSU%g=2owkb!C&dd!k
z&1Z1)9<E!CA+O&pVAl9l(0T?p=S4Fb^7_p!DYhuS>3lFZa0ks58|eIt?SLzngQ~Nf
z`$p^|3eG0gu({G8Y_6?Mp)GL?*`BTzaHvN7^Tc10Ax(itXVB5ygm^eN$hBQGK(*fE
zrH=HOxjGf#amj&htG<p)2dL1v=u;i(GjkKoe}F(YTVL0u160TxmpamC<|Z2dkcn>1
z^?EKHphDlQ)R8_jH_>!<thzPV>$`M-3VriZNBYd%MAO@WZsz8#7RCS-`WB^peQ7W^
z(b-(_i8g!l>cJSGLf^7ffrW{=iO%K<bTc@w9*hAh^sP!2SeTfbXgWMjNV7Pv9t_$*
z=v$X6urSFo+&l7-Pdb_#=1Q&{paNgL)R8_jSDO;f0gkvS;b;zyzXzzm-&~5K#lhSF
z*J)`!#1}1&A-`~K0kg)ZqV|#ILVOqE81g&OHDkrlwZYr~(}X@1&4c(R#4+SIqTE4Z
zM{)G%%-jIef(ADS#)diM2Acav>?cQ&{)@Q*&gR-5`841v;GpWm%iSY(69s3JYJ85f
zx%Njs4fwD)r~>ES5qpV(vq?1uXLCKJ{mwjG!&Ov)(}TQ_R)%T}&gObb`<;1+PoFAq
zIxrl$#8yq%g1b_fx;58pxp;tXMze;^m2c1H+OA?=hm2+Co9`6I96vk{cfem<FQ4;-
zL#~&Hb4%aCMFUjpy?d!6eP(W=`B4PAnfjJ49iT#gOQ|D$W^ST+HUiyF2zFtP0V?!8
zOBGm{n44&x&p<b0<J@u#d5*WBSrg|vn=8(Bv-WL7K4E}r)%PlOq|eMvbT(I@TXVgw
zO9!aX_b%<w%1v}OSD;&Sy<Mb3g}zVeDw;KMLbAC6-J0v|0}b7bW=){8xdPpqD=&Wx
z+Cb?0mnyI@$uitK@{vzEnj3~6Fvb8CI6utza21?Q%+>ykh2khyKL_*U#TcLh=lPEF
zui$KAZh&b-gPRZe;bIKX&0yB}RM3V7Hy84w#TcLh=f@ZytAewMxdEmL4Q?Lf2a7R4
z1<nsKK2!x~6LSO1vu$v5;Eh~0Kn1>IsUv-6Zh(2V4Q~F!w|kBuzvbU4z|gh9+yL`z
z8{FJ?6PFKAt@zHRj`W$i0p{5@xOwlUE*zkn!L0FB!Lw~}a~|$SIEK6{xof-ubZsy<
za0hp;@Jeg0xEtXZ@~-4=frhRP=Bl~!a$|FC7aOhtjv=pw2Lu$VaV+$Z4Bw7F_>YfA
zXJm8b;oQ>qam@hLIeuj6A=;5c<|aCuE6~l<_jT0(-Hc{UtU8-3(9PEO3p7;d?<{qs
z&jV`$%@fV$3UoWy_jl<475ckM9qBW36HR9ax>-9ut|33Z?+!F{Z7?^{^md?|xgTi2
z0M)7=Rq9BenVV?3JJ8ME-|Er<D)jf1I?`w6CYt^ZbTjz3xpaUE{k^4*^qIMdJ`0C|
zZWia|k3ky<{e7hhEKITt_l|tzlaA(wiS2U8?K97Kd;$yH6PT+_3D+Br;v$@bv2Ah;
zxqasOj`Q#6(V4jc&gR-5`83?cMO2-NJlk>hk0L8Kz}Z~;BcF!YE~%TrtnoR{=6byE
zcd=Oxxq0S?7$555idkbYE$DOH9Ee*7jv;R$9uzBwt_|h}m<BYs`R^VsAD}uF4=#12
z&&&-l?PqXvAMQvv2IyumYkVqbK7*V0aMQpsKm~qisR9cVa|2B48Qh$QTLz8+x*5zG
z;|`iDywaNMy$J>yD)e`hDzGpySIw1I1)FQTCgQUn@>=-*fI>Bng&vaOvG{}Q#iKLm
zXl_D0oLd^ZFvkGZdVi=?frW{=i9Q8~fo{zeyD-N975axu6<C;<n`pW^(5<;*7v>mp
zH~x`8L)Qj#6MY<qfo{zeyD-N9)vC9kSrg|vn=8(B`xxWn8uH_NTD%2xZ7?^{*<68c
z=6<vR15~R%r*sv~npkx<SD>4{e<09Mq0cQ{MYAT**<68c27gSTp_|dH33N7Bpqs^c
z`D4%qLZ4Tvz``WUa8t@hKIv#~7;KvyLvEjW#^V!k^yti7ZAw@uj$-w5@IzcQK(*pL
z-*NsOJvuWtz%-)4&4&+l(Et@V&o<BG%3yAQX+wjX3m@j{0lFE?8lPjD(BS65hX)uc
z@Z(Dz>GQxEgR{BzM?MXYa3NLTCzN(%<pwyLE1m)}|M0NQa}2rNKQX}2wZYr~XLH5>
z>~{{v%?`(qH$7XxtnsPH=8FH3)*Ouc5so46OP(AnhOQ0f1~{85{tNv%7<VHaL*A7<
zCBV?N!Q8aP4R9EHb8D_~7c%5s$rdzg__HuSJT}+%(fuF-j6roxJiSzbrRMrfM0oAu
zzsjJaxn3U5Pep9(161f|mkPZwF*niKT!C(;KHIeeROsiHI?`w6COVrd(9PE8xO9LD
z{k&2~`pn!!XLAL*85_NWV}J_%f>H$*CgvtOn=8<*xnhIo7@$JGuvCGCiMfg9<q;oa
zyFze9a1426yeQDnwZYs()7^n?_I`!|15~Ttf@V!zeA!%aLYl#UG|*6?UtH=)p9j_i
zI-4ud&EmZLF$Sp6FD+GIVPdZK4*aKzIP#k`gFnud161HVEpeJ0JvuWtz}Z}}<dY-m
zMC*VK!a>~(W(~Jd{7YOMdBx3#Pe2G`fC`*vJI=m>vx&I@rVR~lE_|Y^2B^S!uH)Q0
zdUR%PfN4U5n+Kodq5&%KkCi&oXXXZ&7BsjyFgnKo75G`D9qCt?8(<pH;O4*R97AsR
zKOSJ{+F)*g&%lwv&3(Ap;TZC!=O+RTT^q~|@R>L=xOoq^IvhjZ^88eQp=*P=0jBi~
zZqADvoFVT@wt!h<+`*kI9MZh^RIhA+>f`(AQb+pCTs2poV>Z`zhH-Im40)0LY(SwJ
z$3hRu@G|_t_2SVP*<5)zxAgN}GeEW8Un@OCJ95a}L}zmax|#X~t{R|1|3>K%-l0F3
zo9Jw=KsQ^z&@}^8=-(_oL_2cG+(aM8A$tkX&Dbw;)c_Uxw@Mx9GjkJ7X9v1j`^7FD
zphEv%sUv-6ZldY!KsR&0#H9mN=vS6H(r4x-npa+++r@{r#4$jHepRUg3lnn_O@9Zv
z89c7vA+P5xXx7AaO@{}%S)7+Y25q2Kzq(X`g-MoStI9_{>1b{k?8h8K?#uZG@rI5b
zotdjm3D+BrV)b)y?88Iu%Re70hOQ0f1~{8*f8^5;`!H3fVhflxJ{8$q`y-!*pY*z@
z0{=p(BYjql!8D;yMe|^6@I&s)uLv-7Z7?@hObZ&^9EjbRW5`|k7Xu7k8_W$b4QO!l
z-_N*wfa+BIQmG?-W^RCKKZBe5aI?cP<W0{n2N=3Gm>Xc4&*0|0=eT@;YQ?`&>PVlN
z8(><`;O4yNx^RGQ2D8SvgXRjawC0L?D2@Rt^skmGurM)K&6THu&9$9~pL5j!74$Ww
ziX3zN@I3qh{^EM^=!_fUked(>=axpt;~1bqzok@xg^9U|rl$klnkzaU#{d=jZKVn<
zOw3I*T^;DwT+#732IyuqYvP1tbHxd1#{O-BfrbkGj#32{CgvtOn=8=G+P~x40V?!6
zOBbkmiMff+<_dH(_wO1oK!tvHsUv-6Zlbff0^RKWdoCTIo6)R^bDhl<=yqNIexRX3
zzo*oZJ`b!3bT(I@o5gwgW6%adzqeF@g-Mp-#-ERT($U;7(d&k6QLha!bZszKn-Ug^
zqgeeMjMl_4WQ%%TfT3%HxdEmT4Q@VsxyuKrPQ@RUI@0Ii<#^4ff;Kd`xiEU&02TO;
zOHs5qm>b}1uKkfuL-abTz;7sBq~b-@c*WUV&+Pwx4Ly%z$lmv-0fw#(=EjP%xt`g7
zTZ~>eWbga407KUXa|4{s^~`=>g`USTWbb=(fT3%HxdEp6{NXk4p)qj`*`WR=z|gh9
z+yG~DJ+uETjN3DgA#c<EHo(xe!Q8aP4R9FServA3ZomN5b@6wlj`W$iYOY){n`_%C
zUg;t}Z9>rZl`68-T;GHU&nq6CK}U1FJUm$isJ9NdZaJtz|7)oN3zKRBO-~29nL4i6
zA+O+n3p8|XFgI77%@wO|wtk}l15~U2_fkjt%-lq0a|OCJ*RaC?75bB<9qLz@o9Jw=
zK)2@l=aCK-`aen?>GQyvIM>-+fo{$9FI+l6h5pad4z1ioXLAL*HP^q4bg0n(Rl161
zO{_YbE6~m0e-&t`(4Q(@MYAT*^h;cP%`&|FF$Sp6pDtBkVPdZKj(p@39n%c{|6Dmh
z1%7|&0#h$BH^A9kaW+nl^b@VaAC?OIfdE6-hHBVR&N}#67)NvPs{#z&3}%hNw4u*;
zbK$E43>El;rH=G@V2#1qT+izNLDOqoI6wvdhtiI$+yK*pUU73^d;=Pw0)MD<70ep1
zm<BYs`R{cuAD{yNW2qy3W^RCKKZBe5@J)zg$Ztd+2{3eRFgL(w;>h6UJ$w`581fs@
z#{&#q8_W&xSvWGdIq&r@AD}uFpD1;t&&&<n!JR7{(!BR4E*+pk|4V6yRxTd-#4~(S
z|LXGQNP-IZnNmeA;P~Nrd<Op7#jjffb?&#ncKQGn^s}XkEOl#Kh&Ta&Ww-X>9R2P<
zLy10nDs`mK18V~9ZY^}%CEnxG0V?!`N;|Z26U}X6?|*={PrNtMp+aA{)R8_9tcg`0
z$6=sbw|<{X2dK~&DRrdJ%uO`6ia@u$;{7fiph91?)R8_jH__ZI0^N3t54d!I3Vq2^
zNBYd%MDt<}blWem2XhQip)Xykz{14bM03LkblWko3v&!mp)Xgez{14bM4yGjK({@E
zmp{e;75WOL3M@>_#b(5dncv5Ktu!yjt-_GE4xcmlY0$O7+yJ{<%P(^$#;w8t<%*y7
z#nM$UYrJ9_(JO8~#0>+-kT(unz^pOY-I^<IE_{o)Ck#-n_)DdZ^qIK<rU|{`=E1kR
zaDWQ@-=&W9nYjU`1r2Tv{CgJ;P=UW*>PVlN8(<pH;O4)#xp06IeD;Z@j`W$i0jB*7
zZti=#3kRsc=PPxj&&&-l&1Z1)-aA}4Km|Uj)R8_jH^8)>!OeN^bm0IMcqnzG&&&;6
zbZa@JdGB2=9iT#wr5#$iYOZu1n``@)j4xIk15{A>GL^3{K2Pzpc%A?FcytE2+=O^I
zw=`}dIR>bZ@KP#YUmDC!G(8>YX6jG6cz_Cti$2wnJ~KDbbakMct#K2{F+hdHMU=|d
zmj-haoy`>|q!}AGksJe5NL)s#e0^y!H_>!<th!knH<26zG?A$aEKJNzbT(J4x|#b^
zt{tF4-l%kes+X9X=xnY)H+z5DfB`D>jY}QrGjkK2%@yco@Xxq(fC_z+(hjZML}zma
zx>=l;KgIwR`lh7{EKJPR-jR=dqGOuDKkUi@D)5y{7npj9xdEmX!<BO<{*%iGsK8e#
zb)?VC4KR&paP#3uTsS~CgIUAoiU&R6$l&I}k0OLIKn1>fsR9cVa|4{sb>WduA9LjZ
z75EyZ3rxMl+yG~DU3lbE+~*BYfv;7%3TBN@MK;$P_TQQR+2sRN;A@wzf>~p5HrE^W
zn>E}>atv`pdG>Vz3|$+{4RAKs8}@&9iQ7nyA#NwnzJ7qAYlFD~&gOc<{<|%HOywA$
zIu$o4RbXLaZrTFrxq&wC#gC{1RA^lEsi;~U%vE!xLD*cIJwE5U0V>$dN)<Wg_~CgR
z@fS^jhs)5>-0*ogxAgzIXn+cR*HTCN%-lqC$$@UG{y&!v(9LMp#HzEoV%2k7^Pi1_
zD)ik-`TEjOO`x;60zGf8<B2Y&3VpBAB`jZ4O`x;60zGf8<M|Ar3VrWVNBXRqKxcCW
zdfr^elL8GD`aY!{TDf_yv$+C2Z?5Am(xF1%w{#WFnpkx<SD@$3b;Ori4(et!YXY6k
z73g_$)#Xn#K6at+SBjSxhibUn<s+YTG&juWT{}PpzIo{)6)!SZn-Ug^qgeeM`~{Z}
zP=Rkz>PVlN8(<pI;O4_Gx^RFBe5+DN`pnz_pNb=c=Pn$+<U*>zw<&d`&#Lh`K8~ot
za}N$*b|F>Z+m&`?<;IFn!z%{Q9XNa?lA)WytnrFzK!fN08@?J~sKB=`b)?U#F_`u<
zc<#OdH|-o$f$vbNz`~>&gK0j4=iVE>=1Qu-cPd?A>Lt|}oXvINkx%~<V5q=%E?ot)
z#_K$|bA?x0bHxu090OG7yOb)hFfmunmDe$w>-;JnCs$Dgy??19#~eRAkC(+?TrVD-
zk<FEdGfR&bcM(<SN0uJO9X?h~ptHFGJva3jtD*}1U8RR{hmTbgXr2xBZJ^r;xrB>G
zsL+opJ&Zei%-lR7^mU-;#vU)}BC62eQ|d^cRTHbGvjaW1_IN3mQa7Vn6KHxn&~tN-
z-xO%5(BE6?NS{>`Xu3Plb9;}Mb}3cpN0)YJ<>spC??BHDK3*o$p_|dHiB;3#fo{!}
zmp=w=AoOEO6<C;L8SWkV$R{1m4YPOU2o-ql#U(In49@0?i+T<|e}JI^KcIAhsh399
z7@W=Z)b`bUynxH80za_Skv^-&VA{~<ySeZiTsT4n{<hMNtlU^JO=xiQ-~}TYD)6_L
zI@0HnHC{0-XmE4jH@a|y3jCl_NBYd%0B3VOwcWXn7jhw0;0Kp>WaS2!_VbFH`z{>G
zP=Oy(>PVkQ*7#J=d<Hk~UBrbWRN#k|I?`w62AI|}xH<2lE*zl(Kcdu;J~KCP2h9}@
znK#$*VlJf${T-zpTDfYjyxiDa+r@UdNQ4Ud*iuE%zUE`(?KS`L@#qXXnwt<0=a#;P
z3rDEX&n$JM&&*9UJss%QT(9ZU5i0bLl{(UA<|aCuD^}fXeJz)cP@$hy+M$)3=xnY)
zw{v~%NQVmjlclR@*2KBa<_dJP_H_ac75b-2SJA8qbT(I@TXVf`prJzlbm=OZHG$6N
z3Ussg^#TnQ`e#a4(X0t{HdmmV!LJ`^sL;<YT}87d(AivpZWia|k3ky<{hU$-7A9GS
zn^HdVNk?<TT;7!<RN%*zE->{HbG0d9p*V`w&%sx4`3M#GiKUM8nYjU`5e;rWyrK(7
zsK8Gtb)?VC4RAKs{>Z2CN-m@d{6nRV^jS4N$26f=+&mbkW`qj-!=)YRSC|_s&gOc&
z{pZKyl_MD{@Q;)_(r49p#o1hs_vU()07C_SYH3GSZmc+)>+$xp@Oafoh6;Rc=_;5t
zUU4?p<LzhR@oE8v3VdGaDws6}XLCK?eik0D9$=`zPcK~svnFgo<3>km&GnlN7@<Nx
zqtuZ;Ggr-(R|T7E+m&faj1em6b4wLiYOc3MgzLp)W?0Vk@^EhHn+kBk2o?HGrH=HO
zxrxr^3Uo8|&0IP{h5nn;4z1ioXLAL*HP@R*I#lSlmad{%6DK5_E6~l@w=iIY3jOv{
zNBYd%L}zmax_ykdbm<5c`kkeY^qIMd&gKeqYp%C)=?E42-K8B`xrxr^3Uq6(w~lnE
z(C;l>MYAT(bv9R^TXVflprJy)uXGj7nm}iB1-dm?Uj7&(ROt7YDzGpyS9?c3@`;XV
z2Im#eJgC6WFI8Y+Vs3!5xnjw4C-Qn{9#r5LmMX9?F*m?`3!j$eLtgC|BUIoQl`60>
zF*m?`3xk^rd97oNP=Q}us=&g;+yL_}3~nCem5wn&1%64X0t*v!1I)KDxH*v5ImQST
z_@$)^EKJM|FyF%9=09HL7$a2Rmz658Fflj4d<%n{`*@9Gj8K7pu2g}AiMavhTNvED
zcOzGhP=SBG)R8_jH^6)ggPZei?7|T$@asz*=`(W!cW~zlhcxfq#HAxt=)WxO(8^VF
z<%h@S+CIA5MIuzt50)x&%<;qX_(1%{e|$VTBbzG^=a#;wi$*BX=Kz)JNS~RTXnLA`
z8|Y^0d%1Lk3VDfANBYd%MAOxQZnnO+OGl{Cmn?Op&&*BqaU2G^8T&pi9ic*By3~<A
zGdIzv;V{t6+V^$o2o?G=rH=HOxrsg<hk<Ta$o*V8LWRC;sUv-6ZldY#KsS5e-=!mT
zGnzGV@zLLbZU%oqprJxvzSNOEkE{vwSvU-Ivp6q*4B9|w+=`|0^`#-p@QZmq@<~T?
z!`$AbBb30iKUBH|<!j8<rUaMZC{{lQ-+`&fg9`l7QUw+!<_4HXG`RWjj;<V`0)MR3
zkv=mwz_g*k&4qVz;RqG@<E4)DnYjU`2@P%@yt4~OD8c8PSn5chnHykQ(BS64ySQ+K
z3Vc$jBYkFWfN4O3oB!_W!VxO)`AZ$?Gjjt>`x)HacQ+S~P=PO4>PVlN8(^Bx;O4!%
zyKsaGe4$cD`pnz_(|QIs=iS4FBUIpvmO9dB<_7Mdxxy>0xqgdFN2t&jEA7zARdeMz
zW^-+4_*)|pD(IC;6*=bk;dy*C{^CDA{)<04nwt<0=a&9X7mZM%an@2D=`(W^oy`^K
zX6o;9=?E3_Mx`BExrxr^3UssecSkx@XngZYb)?TDYvP1ta|OB?`%x|(p+d&Dq;uk1
zQwQUEV@;s5xdPp+{XKz(Zbq{v(AivpZsz{pKtqL&A0p1-j|?kgWKE#6xdPoTzVCDW
z2o*Yhh&U&Hm{_7SH__Q#fo=x>{y;;8jvpe<;g1X}V`NRNI-4ud&EmZLF=zv!Z&AwE
zmxe6E=8FFv0OEd=X7F!w=?E40%B4$CzQ$Z_N?0h4V)b(;emhf<2Nn1#r3x%e%nfih
zSNum<bMS*)IYI@#YUu(~FEKa3*<A52py%KRyL^Oh2D8TJIGZbee4m3K5@4vnS1Wa-
z&m(dJoXvINC%}igaD)ncjZ#PY%-jHHbH$gg`HCOr!VxO)HA_3Pas!;rbz$p&cqBsw
zzE<ffm^D7f*<8=)KMOx1z)*p&Te=EnjltPm&*(o3e@B3!0$;y$70jBj1+5p&s(J5`
z28__nXx8w5=gL#T=Gr!)9|$N^&|8)&veaCkjtJL_$IN7N<>CCQ_~Af9g}zIvBYhrO
z6X<NNKsQtWh)YMP(048E(8^78HdmmVt)Cj{P@(Tux{78^tU8-3(9PIS3p7;dyO*w_
zSrh1Nu0XfudbR;0ROow@I?`w6COVrd(9PWExO9XHo!{-CYlFFo&gKeqYp&-SFhYgC
zXXz@MHE}|+xdPp;>+=E)75ZMKt7z5)I-4udt-12@#~7hP-@8<Sg^9V^JMxiFG*2`5
zV_Z2x1-@130#h$BH^4W<QLKLM#K*dPgbIA?Qb+pC+yI|~BZHd{f6#>^RN&i`I?`w6
z2KZDQ8Qfg>I2Vpkfp1&tNS~P-;Nv(lxOwpLE*zl($1is0K-UIy1567V+#L7>myb|^
z@smQTBYkFWfN4O3oBy8Z!VxMUeo{zvq|eL^Fzsh>bKjF(I6?)yW2qy3W^RCKK7*V0
zp6tRAx*5zGHdj38=>XiE_mlub1-?_MBYhrO<8>a~xx&=Vdq3pT5h^r(tw?pG&&*YG
z<%-!{+j^hjB0g<Gu=|!Oa?J6=^Y{|{#r5LR8FVzi4DfJn>F2m;gbJN^u)I568O%*I
zJss#~>gT$CgbJPag1paL8O%*IT^;CV>*u+CgbJPag1paL8O%*IeI4j#?B~0Fgl<N&
zCeAgT9q4B57X%tAblzt27II~btO+!|9q4B67rK6g3Z1u^yoFpD%uO`i9q4B77rB0f
z3Z1u^yoFpD%uO`?9q4B87rTCh3Z1u^(6zzbMAI*UZkFNYk3k!3Mze-{M?UgNM{~pc
zD6z<c3Vh#E1r{de2AEcik8=)wrYlFN!1pV4q|eL^FpX$%^Wl%VaD)nc|58W#%-jIe
zh6XnmKFft8RNx1cI?`w62AC!^xOwo$T{uEFgIVJbj}|nzIq)X}3>6qR=&6qMd1Q^j
zr{l=r=D(kG;RqEFH|VL3^qIK<J_APvH~0ON3rDDc4=r`1&&&<*nK&}IdGDuPI6?(}
zc&Q_OW^RDb!jZwvc|YUA5i0N_N*(Dla|3tKTo)esG(Ov<RH1Rho9alPRdYVwx1QAR
zT3_md5h~DQN)@?42TrgLy0yQ64@+Oaf7V4KRM5wkDss&6!}Iui_-i68yR{GJd&IA~
zXoL!#x5ROad>EO>%uO^miM`*Y?GnH4f)Ofo-na6ebY(C%(cC5i-S&y!aQz4sI`3O~
zPr5Rgn`mwnfo?m+Z@PYj3Vn8|BYkFWqPbNBy6qLe<<b!<blw5-?rvo;H__ZI0^N3t
z-*){76*}(#d3U!mn44&B7lCg3#qYR&gbJNs8RILYqeo}vCYl>Ypxch|yDl4{o6)R^
z>zZ3epxd6o%O8U_5E^|gm9H-iS!UG5d;`S&ChhC^%Un7_1$<oT5|pno7rUGch@)8j
z+=)NOROCSgetf9{3lnn#>~77sXg>UTSB}ulVAgoW?$!i17yd$kp#ndl)R8`qtTEW#
zn&9Tam%DI;3jD-UNBYd%0J~cg+#L7{7mm=)VAgoW?$!i1|NUZsp#ndt)R8`qtTEW#
zn&9TXUvl9H75K@e9a*^ncDE+DdGD7a8M+zF8n4*hn&9TVUkNZ&;Jk0;J?Y9ASrfLP
z^}^K6d%x=X5h^sARH`F=X0DnmzbCV~w)@rJchLwH3|~}J6<KPoe~Ad!i|65x%k}bb
zZt2$xaKZ=`@&%=i^qIMd&gKeqGxeXibc721lF|;X+(c({1-jY#4UrDrjAl)okZi6%
zH)H>4prJzNx1{*i<ml0PWKE#6xdPp+{YICKP@(g?5_D~hZ$u=}*<68c=KeDSMySv)
zD|MvL%uRGQSD>4{|J<b`ROsCNxv{Sd<|aCuE6~m0f8qKODm1qAR7d*E+(c({1-e<B
zmp{e`O=PM93lnp-cjP0V=$K~kKXBy;6%hA!sgCrSxdEmX<Kvt=@s%zdp$SZNq|eL^
zFpX$%^Wpz<;RqG*$4edQGjjt>8yehP_=heWp#tNkG1ZYiGdI9Ap~20AuX5oC6%hA!
zsgCrSxdEmH4Q>v6wF^h6fVj6yb)?VC4KNL8aP!}5TsT4n#JydrBYkFWfN4L2oBLkt
z!VxOqvr8T6Gjjt>^BLT{_c|AjP=TLY>PVlN8(><`;O4wPa^VQw3}%gSaVxB5)x7t|
zfrbkGyi!N{JhFy&t~3anYqQ5+xoCt6im!jEiX3zN@H~D1e{sEdbOs&G=E}plrQhMA
z5h~=rmO9dB<|dj;4s=`fJ6$?LH=|h-tEQ_1-E94?KtqN8w^B#?JhCRx^mU+{vES{|
z5i0b*mpamC<|dlX4s^5jdt5p~H=|h-tERUD-OT;oKtqN8WT_*49$6D;x;xO#-tTki
z2;GckO`z%TKsSTGKhRL2|D)8AK98&kG#wu3W^rEr7_`A=G;8?9JRkX_qq$+;L@e^4
z0>8YJuP+Ve2AEci)z86icIgNe_!Xs&^qIK<rV$NpKKyGJj!=Pd$CT<wpP3tA+R)(U
z!oP9h2o*5zuApm!xdEmL4Q?L%TbGYef&ZY?kv=mwz_g&j&4GXC!VxO)$4VXPGjjt>
z0~*}?_ZAn9P=Wus)R8_jH^8)?!OeYdb>Rrz3}%h5W17$4=DoiUFjU}AlseMqku?U>
zdImS=z0HLqRN#Lpb)?VC4ctL<U3lcv_;#04H=|j@=F01s&9z;{9}Fl|(Eln`<e1}!
z=kZhci~sm|bOs&GO^AncOXDA%W6V?V#Xv*X26GclPY1f08hx5$glg4aDpg=%Vs4^&
zHUiyF2%0I!2o?IPr3x%e%uO_X9q49kG*gZdD)fJsDzGpyH_>!<pqsVP@i<24W;AQ!
zW2CnO-OP=)#4$pJ{#vO53lnn_O?L;n+510TJ3=?3Sre<KzXRP2j_a6X%<K8<@fOgv
z!Q4dC;el=z=jD$<8)(&A(5&I!k&k@R(cCcqKrHg00_PjV8!9-Pm>b}1t_zQR`jD$e
zsKB2to$(I-WNv`7xh_2N=^vdxLIwUz=>chWz}x_5b3L_hOCNUC2o?CVr8C~apUe$#
zHrG@8&%*!Y{1Lht%o=}q*<4TUKMQ{(z)*odSL#TgN8|=Lo9n_OpFZls5xN=78m~B;
z>#6-`VYGjaF~0_UKHdPjHkcdWY_6yFpM^i}@)4>PZvnH$E6(P6YX4an-zzxA{C@F;
zcmwF#U~ZcF1~?2;w>wvS0pJ+(i@=s<#TqtOUT$ozZNrDpIL7qb|HgWu8plEp$#fF_
z;Qofk%w%)r;mMJ6qIJYB%t7TjK6ffrU|~{CptHFG-J0wFxORkYMzbc+bT!X1(5<;*
ztK=A=LhnlzSeTfbXrAamw{sombc}O+?iMs_V%6DPvFg@b|If=Bp<4C%OC9Mma}%A-
z73g_$#iyo0-HKLCtU8-3(DUXx#g#%8`U0hT&xJ`ffzIX%^t`!F=W{Jp=x-=ppz0;n
z1Uj25(DUZ1%O3^Q&1hPNdq+O<Nk?<Tpfz!f*`ngZJSRR}M~}|T4RAJBEO`z_YvLHQ
zMQs7I#w*U|dc6Pcg$}|oMkhHJ$2ui^ab++!z_g*ycXMHE@MG-D=jIgxT^q~|FimK1
z^WYa;K0>w9EnwF8RAh5qc;pjyV~#O)<#Y4Giwn`wqcd{@oXvINkxyT8(FoOw^RnY5
zwKA9+;B2l7k9_*Ft4HW&Fl&4&vbioi^64u9h6=nZb)?TDYYfijy70)SuexxA3Otl{
zWaZ{Am(3LpY0VWkIviu%@SHma8oD-^tLDn9g3WclD^K_b=b&o6-&m@^G0jJ&>6`E;
zuU$MkgN|k|;o;2E(?wiG75ciRj`UeIfu^SeJ#VhlMO{i2`g)}uTDiGux;oHvTTd5@
zbg0nRFLk8Ps)<z}M>x=PV^0@%DOG5E*r|^6Sv7&?XBg=AF~-L<L4~|mX@~k1=H>~Z
zw*%dp>m?!`D)hZe9qIGLnpid69q86vFX_?=x*5%yK%ZIY)?6<YXsFQlDRrdJ6KevU
z%@x;mYp%TfnF-yDW)1g_eB_gk=7zyu!7=5YaiMqv=-OazfN8~8{Tv)S#FRV6g#!#-
z8_W$bjc9Q5VSMwNpgI*>z^w79pbZUfF2wgvjw!!?<{lDzilawo<_7pUOLexJ2l1_w
zW6E!z-yAE4t_|h}_%s|D+#HB6h8$CVLA*wQp=*P=0j2>BZvMm9LXIiF9$quR(6zzb
z0MmX3H}_r8<r7pN-nB{{=`(W!O!FDsyoVmbF=a2gc7UO4gSi3D=6YJYbDhEnRIPXm
zm^EJK!Oy}Ak9?ZK3RI!5QwqT1Pz~=~`Qfp-wvX=8uA88O-nUc{?!dD#p-XDLe9jXN
zxpnezZt1JJZh{K^;8I8W%-lq0a|ODY`syy7ph7>S)R8_jH_>!;th(7cTsEca9vW!q
z+F)*?>FYo@V~5YC^xYOTYj|zoEYR73Zq^Q`P3gRc#j2regSm<3<q_z1g}`$hQ+n^=
zfrhRP<|dl%4s^43xNS<4JTlPGwZYs()8Bz^28TH~rZmZS1{%6Hn49Qqt~l+jx$^R7
zCR7*S7Bp+vQSy;bI+`2iGQ<K575ILo3M@>_4RAJBEO`#TtScv|!1pg*VCp621~{AR
z>Fv&Sx}3|Yo58H{smSJfdiz;;x_p440zaVCkv^-&;B2m^w_oa}D+CxS@B>RbvT|d^
z*<4TWcPUqlWT?R3TDl5mjaQt__4K|&U&-YYRN!wbb)?VC4RAKs)7#I&Q(Ps~&0yAe
z#o1g>Z$Ar9S4I*BRp4(gRbXLKjlr~@cf97jtGIH4ZU(a^Hc;Hm<bE-~bDgdlXsFN+
zDs`mKs$p~GIc9Th``h(gG(iRZu2Myon(M6);d=3ynQX2+oLl-vfrbkGm{LdjJh3Lw
z*<68c&Gp7EouHf1tO;~BSD;&Sy-A><LO-_Dkv>nX33N7Bpj&gjsY@s5W;AO8oy`^K
z)?9BEXsFOXSn5chC)NZyn=8<*x!&BR6IAHOmv(67COVrd(Cy;8MWjQ8enP1ueV&k;
z=xnY)x8{0Fmrl^lXx79D$>s`lvp6q*W<rI2VyOZP6LYmG<s+YHo@VgtyK;gG{N1Gs
zOufY10B3W>lIKq3u7WW^H-lNj-3||WVyTbjV7@1#P=Oy+s=&g;+yG~D?T>t#_?{Tl
z&0yAe#o1i@BcCR|Ck9pE?<rMaVN#93*<AZ0pC-O1236qiD^*}&QjNjcT>B%RCcY;I
zRp9S0RbXLKjltPm`y-zwz9$A%;76A#urR5{;B2n_Nk<dk6N9=L%o>BUx#E9YKEK@f
zo){BU;2$VeU}0iznwpn1zl_5n&3k-Tj0w6K%^EgWz6G0W+k|e70LBCr^hu=(9MgPc
zn(l``={EdF&2$Ra%ftDpxVx(+sL<z?I?`w6CYoLebZf5naOniyjAl)&nhpzeYp&lC
zXsFOnFLk8P6KeuZj|I9l*L%8jf(reNQb+pC+(gr5fo{$9UM`)WLjP!~BYkFWqUp0h
zx8{0pmrl^lXx79Dp=$!&n(KW64Hf#CrH=G@VojiVQ3twR*Y|bl1l^2gO`z$UKsSr?
z^2eYJgnm}30t=HY!@UFl^F5aOXl|I>xN?FD{N&OFre0#MHYFGkN3r@j__i*epaMUo
z)R8_jH^4Na!Oe%abKwLP_=idz=`(W!OdA^9TzGpIPSDL@*7zLLga$Vc-XXwHfuCCH
zNS`Ox7)%Qq+#GmE7fw)tpH}KfpP3tA8qnb8zdN~bf(m?gsUv-6Zh&b&gPZ&A?7|7U
z8O$1=ifmd7J>@O|h6;R6sUv-!SYt4)=M^{S-PMH?bTgPW#vS}D46n52dbdDBg+8~`
zkv>nXVRPk**<9Ot@9!c$Z9>o=FID82<A>+zd+`_7d+^97AI>fP2p3IIp`TlN7<c%X
zxrwHyxxe9EnyJ6TMH5u$=ao9rXXYlFt`2mw^&?$6L4|&PsUv-6ZldYyKsRH5r%Na3
zW;AQ!T+`WsZq~*R4jdCy=ogeKurM(<(e!qpo4LQ+wG&k67nVBGXXYk4n=3xXX75M2
zbb<=~qS6kn+(c({1-dm?+>vlhP@!L3s=&g;+(c({1-e;=mp?P1LcgR`frUwy;ogyt
zeA3a}Fb{C$1QmGh#U(In49@0?CC|YR3@}vSpD0~m>ZOS_24{0UtN$$gtuCLS0{>*G
zBYkFWfU~)t)qfVoZ=W0!RN$W~RbXLaZh*77p4ERA#!r+S6Ld3}H9i&DT+ix13qOch
zfT05abg2Rh6LSNc&GoGQv+#pmIY9;fnbHNOUSe*5v$>wtf3$pv%O~h&Fl&4&Xg+UD
z&3g|;h*7A(&n{J9VPbB8&%%+x&3O-V<pdS@Ii-&DnYn3dey@#Pt~J+(yL5tXMziL8
zYON>r#`=8$gbMi5QbjJ{_~ChfZTz*1Jz}8Fjr{#ipP-A-rEZO{2{-|O<*l#}=jf*d
z8Y=WJmpanti8X<Cw-&l}YkcMAn4p`{tO>Ncwa~3w|1iPGgbMvDr3x%e%uTerwa~3w
z|A=cR=w>u)V%6@}Lbq;>Z}c1!ROnwTRbXLaZlc|-g>Ky%-|0CfsL;P&s=&g;+(f%u
z3*EZ)*{+?SLjOjoBYkFWqTQ{9Zac;~E}fv8(X5Gc%`Ic^OT6tFy!<gHsL;Pzs=&g;
zTx>>Ms&9pLG&jtnT{%Go{@Kz6re0!hfZeTiHs;_TaQOrk_+_Pz^qIK<cDE+D`S39=
zoS*{#d}&8kZh+mb32rWYY$QWBgIVKq>~2kP^WYB#7%K2DlseMqi8ThhTNB(I_&66%
zP=Q}w>PVlN8(?>9f}8&y@4^Wx@GD9?vT_6LZcT7=-xDGkx*5zGp9*(tf}8iA7+|Qt
zzgX%>pC{HB>~2kPbKa9&I6*gqSrewF^}^Jx4?a22P@#XR)R8_<tYLGd^VnS5x8(C&
zG(iQO?-a)zKRiz_!e3l3o`*v&*UQ7XrSYAOV}c6($E6A^Ow3I*Jss#~>Sw!lf^J5$
zCRR;X2fEq%Ie~@>{rXZz`aH2F(8qBY=w|Hax^#jH{U@c4^qIMd&gP19-K_mQmrhWj
z-%#42m78dKJ67Gy{rpIWZbq{vPRJRBZuWjbprJzlS*as^o>&uT`a4$L4E{owPEeu$
zyws6CGdIz6c%YlbdHG||215TusR9d=EW^DcANi!CxnZ8}$_Xm)Z<Q`E^%8TnDdD2P
zQJk1L_!%yrpaTC+sUv-6Zh&b-gPRY3)P)mN;6E&Nq|eL^Fl}gXbKx^xI6(z|RjDI=
zW^RCw<H+FV!5?$s1QqzzrH=HOxdA>6M+P?sKFfs@bTgPWzA8>X05|{P2N8}5D)4Jc
z6<C;<8(`YcD{k(?4<Z~>{xI^|07KUXa|2BC8Qi>wA4E8&{9$AZm^D5Xw4TAudH6wu
zV}j~byslJ%g^9U=i{F{mtXgx$FBcqB{(|vGfrhRP=Bl~UAZ)J99xrz31l4-yJH;`_
z56{zY<1hZ>A3XBOhjUBgPL*SV3jLN+1r{deCYnp;{)TsHtH$jl#{?Dnt)&VqOw3Jm
zHdmmVt$)?E6IAHGFI}MOCFUlYzK&HlW8-#`V}fo*vnI|pogL_AZQM?BOi-cUR;s|l
z#N0&F+ktN8#_c4>1Qq)2r3x%e%uO`i9q49ne3RptphCZ+RDp$wxrwH~1KkXc#>6o}
zH=|h-=Q^7!u8?MNUjEF43jNMf1r{b*hI>ao@<~T?!@R_m6I9^8EL~vgCFW{V!a{Kr
ztDl2k>hcLH@L!cW(r4xdIGgJ!efPk<HOG|q*l!9jbZsy<z}Z|+>36QUx8|7g9(xOz
zH9p7LTu<qDu0JR42@_PO;?1Rw^qIK<&gObbzjMV+JI9na?|&U&=-OazfU~)t((hbx
zZ_P2~J@ytbYkVrQxt`MRTwhKsz%P%L{!OU@3lnn#O!N72Yu<Z>D<`PV@!ys@(r4xd
znAS76IS;qM920aim^ERG8{jbZi`HC!2{DWbD)ir#DzGpySIw2zF`H}aCBNgU2`cEj
zN)=gZu78FI*L(2DCm)_{)CnhAr`MGV{h>fZ*M@2Woy`^R(wb|0pO~PV(X0t{HdmnA
z3Bmm}#{?Dn!=(x=Ow3JmHdmlqbA7#QC+KE0Yhu;eT!C)Q6*s{g6IAGbDpg=%Vs4_d
zxdPpq>l<7<L52QEsUv-6Zlbff0^OSHpSpB{Zbq{vPDnOapqs(p7-*=_A1igF&l7SJ
zO^4HmKsSr?^2eB<o6)S{ZkLaI($UGpV4P@~ez#QMxfdNiGONbmY_3@H9Q=C$h6?=d
z(j&A(e@v_~IGbyK<kR%~uAmD1p3+0CBZsOnm^SoB*<APsu9=_$zqj-V?a&|0jTL8e
z?T>t#Ug-+zW-x2K;%u({kx$eA3oumR_mw)*XVn;-&9y)BY5KzeLj`_+X-8IWtT>x%
zf8^8jsz`<k{DIO{Fl)TxY_9#0Pt&Ud4BZT7jltPm`y-#G*8~_U@CQpB>9cBLzsTka
zhqUJU+CW2v{)f^Itz0!%UT$ozZNvZbNQ4Ud@lr*OIevJa-iyDuUOYO3j^-xB!?~q#
z&&M(4z2D~p4P6_|O*B0n=+<0uW5zK-wdyTs*2Jn$#bKbEt>2Cq#sn4m3#AGyOw3I*
zPjsN$xqgRhC#cY0EOn&M%uV!ZI1F@auJ3f|1l^2gO`MR^3*DOQy8;ar`pcz`^m$@U
zpy}>db!)EgcIgD&jAl)s>F+?d=K7vMLxuiIsUv-!SQF@MuDGsSbLHjFOsLRbEmdG)
zl4ZDe<RhPSG&js&xN?FDJon-fm^B8|in01R7`MP2Q{D>ybG!j`Z7?^$G@`-Hhqwji
znDSQmKLQM08_W$bZD??FVchyodB^&n0fw#(<_4H1G`M*Xcd8sy-m!ivz|gh9+yK*p
z1~&)B9qN=fmRrEA@rOqP8r=Mc8%mBTZ!A9@D~7HO<_4JdGq|}AH<TPx-dJt{v&Ji?
z`3!E}!(AW8ly`rhi4{ZF26F?P&9y)BX?lyxsWQmtN>{<G@j4HF7G8Md(}dqXIjEb_
ztl__N<yFDv+OCQBA%HPK7k7$d3Llv!T8HaBc;u50=a$Caz%j)hao+j-7Sy%D+(gsU
z+&b|t&D60gOtDLxcT%9CYlFFormF+pZ2buXCMZwHCNyi}gwWT4ZpQwXKtqMzl{(Vr
zi8X=dXBg=AG5)JdC#cXvsUv-6Zlbff;#@a#|C>uEsL*3+hgNQ)v$+D@?EUYN4i$PT
zT}87dPDnOapqs%z8EEKcG;0E#%@yd@TzUC36Dst+RDp#_mf@z9k9^Y6+%WHV<pd@8
z-2X0JVCp62YE!~OaTKecgFoQ%2`cc{N*(Dla|4{s^|b!8Fm4?<ro4sN0%na*MK;&d
z`VVTjap0Kp2I7BW#n83E+yG~DJ+0qNe8}Y!RHx$WrK@1pc*WUVPwN}$KL!{o@c)*s
zf>~p5HrLbo&%z%LFmyARH3nyMJ+1#Nj9<4nCaA#wSE|6m#M}VWe7@Y8_depv2}<yJ
z_%juUi(~o-UiOM<J%gL`K8g^dPytUYRbXLaZrb7oIE)Rn-MN0uwG(tRnl)^${P5UZ
z+twLh1t+MW=PyOc2`4NxS8OI;FCH#KM{~VAJejX!;2)V|`bw$L7Y#IYZK#H47QAe(
zJe;Gy8fd7{7b{&wvnJ5lT!C)Q6+0To1l^2gO`x;60^OP`wjPcND)hxm6<C;<o9Jw=
zK)2=^o6ZCk8XsHg0#z?DH__Q#fo@j_wjYiOD&!?f6<C;<o9Jw=K)2?K4TxicZbq{v
z&NclV7hf|tb_$Luc8v2b8E*ky8_Z2K9Ukbp#dY~JjQ`WBFI9?{7KduMcjP0VbTq%J
z|I4)#RNxDgE>iI#bG0eq^zu(zXAX|rvMKJS&ijS{L)Qj#1Dwru;gL^q_cX;#&v_RN
zFm!D&H^A9k7asW(H#t+>^lSpN#^*Sj>%t?SKI?T&P@Us%EOn&M%nfih*M&zuea?jw
zbTgPWUNH^m53l*}^8tnme4$cD`aH45;B2l7k9_)q3n%DiFl!9X=DP66r!NK=D)5C%
z9qIGL8iQ#)pNhHjrZ2gWD)2>09qF@b!WK6`I85D|>z7?RL503(X@^#>nk&ySo9ldk
z+eas)3VNwhA&wbzc-~(Ee{sEdbjA&F$o2AYX6ZeyTMnww*DY0GVNy+?>FGevo9iAI
z7zb78>y;|7FsUZcbakNT&2^6}frGjk&6+?TXRS}jyt(diEpSkUzJ93!3zKRBeHv?x
zo;TM$t_2S2W;AO8O>YN!ZtnfX5MvlBG%nFpzP>b66KGy}fo>Py#a+CI3W<+A)sa3k
zH&>m_6&K&Ux$fh-r6w}9L;Z?sV%6DPfu37jmp>|~LgH#lHK@<3;ogyteA3a}F!7Vl
z9xC8Bm3E|GVXihMEEGqv`Z+j$(Ann?JeLkIbZsy<z%-)4&4>8yg=3$;!CWc8(6zzb
z0OQ03xVaF&ym0LE7a05#>6GL@nW9H0<_4H1^opAY@w*GhK7W6?a)6<0gSi2w1r2Tv
z#IG(K`~3A~3z#*&DzdruM?UT2%N$jw;3}nj!=<4bgK0mnxVaDaQ5^fcpSnhXp=*P=
zvEpp5{gF?5d@1ChYQ@(sRbXLKjaQt_wLkJ{A72Kko58H{2{`y!7+#q-*L{2)qzZkV
z(uL*fCDriGm8XKuwQWL|bm<-{=zOP$P0Cr3do3u}d+^97ALfOBVx-0Oy3fn(X7Lu#
zwZYs()6?9Q@h;8OxWG8}d7<4r(9pHP+(gsWfo`_GssVebPRJHCYvP2^*MV-vzFMH6
zLf@j)kv{KP6X<NNI3dm2S9j?iD)cQ&JG62Woy`^K)?B|i(xF1%s&p02npkx<SD>4{
z!^Zox^%gX10-enj=yqLS(`(y9wdz}!I?`w6COVrd(5<=h^2gXig}zOx0t*v!wJGHz
zpLkg}gX4=W#~vy$KJZk&zBHH{;B2l~^4y8&(j0rJfcUsm`TEjeZh*77;{U1b930(w
z4^3d|5|pnoH^A9k@&C|o4!(@b_fP?G6{R}TXXXYtn=AgG8O_0$b>SW=Ag-ZQNBYd%
z0B3W>|09Pv_;N1XLj}YYl<G*InHyjl&{uWy-{oDnhbA!9kv=mwz&LRMZtlB+3-?d~
zZ&d0?pP3tAoVWlt?_JS_d+25`YuH@zxRwKObKaE@!q{Iaz&9>cU}0iznmX@X;gIIN
z_&E1at@);<3sk+tT-~{H#cZx^z4%ta!KY0KdfQS3mYOU2jn<3*#Sk6MUc$rq<;KsI
z;WWlw0}Wjp%uRGQSD>4z`N?AJ(;9aRG<0n+H__Q#fo`_unZnqoIkuqldH^q*D-Y)<
z1Xr)nc@^J1Rt;Snd)Cl(;AL~=;T(<2jANgd+dTpeT^r0zbT(I@o4Iddz#ghA<XcKt
z(X5G8^An9Lq}dx+FvmWx<Sl5{1e%{{pqs(t8{8hMRo}A|Rf~hUiRLF7=w=yS{tQDm
zqglhf1OMB29C`iC;P|%8vCnVKb1yo4WM*!Fv$^6koL?RI&4^>4za8B!Rt{Yo%nfih
zSNzY1=3x9{#Ic9!RNTH)frW{=0nX-%|8#l|#*aE2`}}cd3z#)N$Jt!*pN-AIJpCAZ
zs8)Q3QUw+!<_0*MEB=-F9L&>?v4;wL$5I6rCguh>n=Afx!5qxfkFket2D8SeqBhj#
zKAwJzJyhU3l`60>F*m@qoi^|B^keLy0^hk*frW{=0j|xoIgh6wV-MX7u8-{C&J_-6
z-s1;=v4;wMmr?~5Cgz@SqOR1hz3rS^9Q*+a?S4LV-Yb6X!zX_N$0vOKR?no_PQ3pA
E2kf+of&c&j

delta 196
zcmex%lKY10gc*|y?*+3OGcYi)PM(-5Jo)n%hsoSOLMHot-#dB!w{4SOe%&_N`0M(~
zSwG_^i~o$AyzfWw<eR^vC&&MYpM2$4<m74~Rs!OaK)JTx!IRa0M^3JK8#8&`hmgtV
z-?C5s@qXK6Cm`;5w{7yZx9cbKeu|&G>tp2P#E-#~YraHJX8IUEx%_kFWH}%{`YCd9
v4iIa837&ik$d`Q<Gdb{O$mA(6_D+8KeA{GwAg+8C!o^_a^xGBaVn%%c+xcz<


From 425ee189dcf952fd7a2a38df375ec245dcdfbfc6 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Tue, 2 Mar 2021 11:37:47 +0530
Subject: [PATCH 178/591] ZOOKEEPER-3877: JMX Bean RemotePeerBean should
 enclose IPV6 host in square bracket same as LocalPeerBean
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…quare bracket same as LocalPeerBean

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1493 from arshadmohammad/ZOOKEEPER-3877-master
---
 .../zookeeper/server/quorum/RemotePeerBean.java  | 14 +++++++-------
 .../server/quorum/RemotePeerBeanTest.java        | 16 ++++++++++++++++
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java
index 2d9d7d3dd65..522ba3ad345 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java
@@ -18,7 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.apache.zookeeper.common.NetUtils.formatInetAddr;
 import java.util.stream.Collectors;
+import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
 
 /**
@@ -47,22 +49,20 @@ public boolean isHidden() {
     }
 
     public String getQuorumAddress() {
-        return peer.addr.getAllAddresses().stream()
-                .map(address -> String.format("%s:%d", address.getHostString(), address.getPort()))
-                .collect(Collectors.joining("|"));
+        return peer.addr.getAllAddresses().stream().map(NetUtils::formatInetAddr)
+            .collect(Collectors.joining("|"));
     }
 
     public String getElectionAddress() {
-        return peer.electionAddr.getAllAddresses().stream()
-                .map(address -> String.format("%s:%d", address.getHostString(), address.getPort()))
-                .collect(Collectors.joining("|"));
+        return peer.electionAddr.getAllAddresses().stream().map(NetUtils::formatInetAddr)
+            .collect(Collectors.joining("|"));
     }
 
     public String getClientAddress() {
         if (null == peer.clientAddr) {
             return "";
         }
-        return peer.clientAddr.getHostString() + ":" + peer.clientAddr.getPort();
+        return formatInetAddr(peer.clientAddr);
     }
 
     public String getLearnerType() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
index de145ea4f53..cc2321c10f2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
@@ -59,4 +59,20 @@ public void testIsLeader() {
         assertFalse(remotePeerBean.isLeader());
     }
 
+    @Test
+    public void testHostPortReturnedWhenIPIsIPV6() {
+        QuorumPeer.QuorumServer quorumServerMock = mock(QuorumPeer.QuorumServer.class);
+        InetSocketAddress address = new InetSocketAddress("127::1", 2181);
+        MultipleAddresses multipleAddresses = new MultipleAddresses(address);
+        quorumServerMock.clientAddr = address;
+        quorumServerMock.electionAddr = multipleAddresses;
+        quorumServerMock.addr = multipleAddresses;
+        QuorumPeer peerMock = mock(QuorumPeer.class);
+        RemotePeerBean remotePeerBean = new RemotePeerBean(peerMock, quorumServerMock);
+        String expectedHostPort = "[127:0:0:0:0:0:0:1]:2181";
+        assertEquals(expectedHostPort, remotePeerBean.getClientAddress());
+        assertEquals(expectedHostPort, remotePeerBean.getElectionAddress());
+        assertEquals(expectedHostPort, remotePeerBean.getQuorumAddress());
+    }
+
 }

From 1214d3bf611d153ae8c3987523da01d3d6c82686 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stig=20Rohde=20D=C3=B8ssing?= <stig@humio.com>
Date: Sat, 6 Mar 2021 19:38:43 +0000
Subject: [PATCH 179/591] ZOOKEEPER-3781: Create snapshots on followers when
 snapshot.trust.empty is true
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

snapshot.trust.empty is an escape hatch for users upgrading from 3.4.x to later Zookeeper
versions, allowing nodes to start with a non-empty transaction log but no snapshot.

The intent is for this setting to be enabled for a short while during the upgrade,
and then disabled again, as the check it disables is a safety feature.

Prior to this PR, a node would only write a snapshot locally if it became leader,
or if it had fallen so far behind the leader that the leader sent a SNAP message instead
of a DIFF. This made the upgrade process inconvenient, as not all nodes would create
a snapshot when snapshot.trust.empty was true, meaning that the safety check could
not be flipped back on.

This PR makes follower nodes write a local snapshot when they receive NEWLEADER,
if they have no local snapshot and snapshot.trust.empty is true.

Author: Stig Rohde Døssing <stig@humio.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1581 from srdo/zookeeper-3781
---
 .../zookeeper/server/ZooKeeperServer.java     |  4 ++
 .../server/persistence/FileTxnSnapLog.java    |  9 ++++
 .../zookeeper/server/quorum/Learner.java      |  8 ++-
 .../test/EmptiedSnapshotRecoveryTest.java     | 50 +++++++++++++++++++
 .../org/apache/zookeeper/test/QuorumUtil.java | 12 ++---
 5 files changed, 76 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 8b3e4924b60..f0e3c822653 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -544,6 +544,10 @@ public void takeSnapshot(boolean syncSnap) {
         ServerMetrics.getMetrics().SNAPSHOT_TIME.add(elapsed);
     }
 
+    public boolean shouldForceWriteInitialSnapshotAfterLeaderElection() {
+        return txnLogFactory.shouldForceWriteInitialSnapshotAfterLeaderElection();
+    }
+
     @Override
     public long getDataDirSize() {
         if (zkDb == null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index f054bc85d16..a4670ec0253 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -229,6 +229,15 @@ public SnapshotInfo getLastSnapshotInfo() {
         return this.snapLog.getLastSnapshotInfo();
     }
 
+    /**
+     * whether to force the write of an initial snapshot after a leader election,
+     * to address ZOOKEEPER-3781 after upgrading from Zookeeper 3.4.x.
+     * @return true if an initial snapshot should be written even if not otherwise required, false otherwise.
+     */
+    public boolean shouldForceWriteInitialSnapshotAfterLeaderElection() {
+        return trustEmptySnapshot && getLastSnapshotInfo() == null;
+    }
+
     /**
      * this function restores the server
      * database after reading from the
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index ef36b2f9000..8f3d00c77ea 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -561,7 +561,13 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
             if (qp.getType() == Leader.DIFF) {
                 LOG.info("Getting a diff from the leader 0x{}", Long.toHexString(qp.getZxid()));
                 self.setSyncMode(QuorumPeer.SyncMode.DIFF);
-                snapshotNeeded = false;
+                if (zk.shouldForceWriteInitialSnapshotAfterLeaderElection()) {
+                    LOG.info("Forcing a snapshot write as part of upgrading from an older Zookeeper. This should only happen while upgrading.");
+                    snapshotNeeded = true;
+                    syncSnapshot = true;
+                } else {
+                    snapshotNeeded = false;
+                }
             } else if (qp.getType() == Leader.SNAP) {
                 self.setSyncMode(QuorumPeer.SyncMode.SNAP);
                 LOG.info("Getting a snapshot from leader 0x{}", Long.toHexString(qp.getZxid()));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
index 316d7bf2221..b9020cc9adf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
@@ -19,11 +19,13 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.nio.file.Files;
 import java.util.List;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
@@ -143,6 +145,54 @@ public void testRestoreWithTrustedEmptySnapFiles() throws Exception {
         runTest(false, true);
     }
 
+    @Test
+    public void testRestoreWithTrustedEmptySnapFilesWhenFollowing() throws Exception {
+        QuorumUtil qu = new QuorumUtil(1);
+        try {
+            qu.startAll();
+            String connString = qu.getConnectionStringForServer(1);
+            try (ZooKeeper zk = new ZooKeeper(connString, CONNECTION_TIMEOUT, this)) {
+                for (int i = 0; i < N_TRANSACTIONS; i++) {
+                    zk.create("/node-" + i, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                }
+            }
+            int leaderIndex = qu.getLeaderServer();
+            //Shut down the cluster and delete the snapshots from the followers
+            for (int i = 1; i <= qu.ALL; i++) {
+                qu.shutdown(i);
+                if (i != leaderIndex) {
+                    FileTxnSnapLog txnLogFactory = qu.getPeer(i).peer.getTxnFactory();
+                    List<File> snapshots = txnLogFactory.findNRecentSnapshots(10);
+                    assertTrue(snapshots.size() > 0, "We have a snapshot to corrupt");
+                    for (File file : snapshots) {
+                        Files.delete(file.toPath());
+                    }
+                    assertEquals(txnLogFactory.findNRecentSnapshots(10).size(), 0);
+                }
+            }
+            //Start while trusting empty snapshots, verify that the followers save snapshots
+            System.setProperty(FileTxnSnapLog.ZOOKEEPER_SNAPSHOT_TRUST_EMPTY, "true");
+            qu.start(leaderIndex);
+            for (int i = 1; i <= qu.ALL; i++) {
+                if (i != leaderIndex) {
+                    qu.restart(i);
+                    FileTxnSnapLog txnLogFactory = qu.getPeer(i).peer.getTxnFactory();
+                    List<File> snapshots = txnLogFactory.findNRecentSnapshots(10);
+                    assertTrue(snapshots.size() > 0, "A snapshot should have been created on follower " + i);
+                }
+            }
+            //Check that the created nodes are still there
+            try (ZooKeeper zk = new ZooKeeper(connString, CONNECTION_TIMEOUT, this)) {
+                for (int i = 0; i < N_TRANSACTIONS; i++) {
+                    assertNotNull(zk.exists("/node-" + i, false));
+                }
+            }
+        } finally {
+            System.clearProperty(FileTxnSnapLog.ZOOKEEPER_SNAPSHOT_TRUST_EMPTY);
+            qu.tearDown();
+        }
+    }
+
     public void process(WatchedEvent event) {
         // do nothing
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
index 98153b9acac..ce1cd1b3c5f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
@@ -251,22 +251,22 @@ public void shutdownAll() {
     public void shutdown(int id) {
         QuorumPeer qp = getPeer(id).peer;
         try {
-            LOG.info("Shutting down quorum peer {}", qp.getName());
+            LOG.info("Shutting down quorum peer {} with id {}", qp.getName(), id);
             qp.shutdown();
             Election e = qp.getElectionAlg();
             if (e != null) {
-                LOG.info("Shutting down leader election {}", qp.getName());
+                LOG.info("Shutting down leader election {} with id {}", qp.getName(), id);
                 e.shutdown();
             } else {
-                LOG.info("No election available to shutdown {}", qp.getName());
+                LOG.info("No election available to shutdown {} with id {}", qp.getName(), id);
             }
-            LOG.info("Waiting for {} to exit thread", qp.getName());
+            LOG.info("Waiting for {} with id {} to exit thread", qp.getName(), id);
             qp.join(30000);
             if (qp.isAlive()) {
-                fail("QP failed to shutdown in 30 seconds: " + qp.getName());
+                fail("QP failed to shutdown in 30 seconds: " + qp.getName() + " " + id);
             }
         } catch (InterruptedException e) {
-            LOG.debug("QP interrupted: {}", qp.getName(), e);
+            LOG.debug("QP interrupted: {} {}", qp.getName(), id, e);
         }
     }
 

From 6022e03177b21606575152ac323205af3fbbe9d8 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Sat, 6 Mar 2021 20:52:24 +0000
Subject: [PATCH 180/591] ZOOKEEPER-4220: Potential redundant connection
 attempts during leader election

We have a logic in the server code, that would try to connect to an other quorum member, based
on its server ID. We identify the address assigned to this ID first based on the last committed
quorum configuration. If the connection attempt fails (or the server is not known in the
committed configuration) then we try to find the address based on the last proposed quorum
configuration. But we should do the second connection attempt, only if the address in the
last proposed configuration differs from the address in the last committed configuration.
Otherwise we would just retry to connect to the same address that failed just right before.

In the current code we have a bug, because we compare the address object references (use "!=")
instead of comparing the objects themselves (using "not equals"). In certain edge cases (e.g.
when the last proposed and last committed addresses are the same, but the address is unreachable)
this bug can lead to unnecessary retry of connection attempts. The normal behaviour would be to
mark this connection attempt to be failed and wait for e.g. the next election round or wait for
the other server to come online and initiate a connection to us.

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Andor Molnar <anmolnar@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1615 from symat/ZOOKEEPER-4220
---
 .../org/apache/zookeeper/server/quorum/QuorumCnxManager.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 0987ad30518..2f240e9bf95 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -768,7 +768,7 @@ synchronized void connectOne(long sid) {
             if (lastSeenQV != null
                 && lastProposedView.containsKey(sid)
                 && (!knownId
-                    || (lastProposedView.get(sid).electionAddr != lastCommittedView.get(sid).electionAddr))) {
+                    || !lastProposedView.get(sid).electionAddr.equals(lastCommittedView.get(sid).electionAddr))) {
                 knownId = true;
                 LOG.debug("Server {} knows {} already, it is in the lastProposedView", self.getId(), sid);
 

From f39caf6fd717acced2e8eb2bbdf98e92395858c5 Mon Sep 17 00:00:00 2001
From: Federico Leva <federico.leva@relexsolutions.com>
Date: Sat, 6 Mar 2021 21:29:07 +0000
Subject: [PATCH 181/591] ZOOKEEPER-2693: Correct the documentation about
 response to "ruok" 4lw

Since 5fe68506f, it's no longer true that the server will either respond
or not; now it can also respond that it won't obey, with the message that
the command "is not executed because it is not in the whitelist", unlike
what one gets if the command does not exist at all.

Author: Federico Leva <federico.leva@relexsolutions.com>

Reviewers: maoling <maoling@apache.org>, Enrico Olivelli <eolivelli@apache.org>

Closes #1608 from nemobis/ZOOKEEPER-2693
---
 .../src/main/resources/markdown/zookeeperAdmin.md   | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index bd350cfd750..cc34ddb40cf 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1355,7 +1355,8 @@ of servers -- that is, when deploying clusters of servers.
     not enable the command.
     By default the whitelist only contains "srvr" command
     which zkServer.sh uses. The rest of four letter word commands are disabled
-    by default.
+    by default: attempting to use them will gain a response
+    ".... is not executed because it is not in the whitelist."
     Here's an example of the configuration that enables stat, ruok, conf, and isro
     command while disabling the rest of Four Letter Words command:
 
@@ -2242,7 +2243,7 @@ connections respectively.
 
 **New in 3.5.3:**
 Four Letter Words need to be explicitly white listed before using.
-Please refer **4lw.commands.whitelist**
+Please refer to **4lw.commands.whitelist**
 described in [cluster configuration section](#sc_clusterOptions) for details.
 Moving forward, Four Letter Words will be deprecated, please use
 [AdminServer](#sc_adminserver) instead.
@@ -2269,9 +2270,11 @@ Moving forward, Four Letter Words will be deprecated, please use
     Print details about serving environment
 
 * *ruok* :
-    Tests if server is running in a non-error state. The server
-    will respond with imok if it is running. Otherwise it will not
-    respond at all.
+    Tests if the server is running in a non-error state.
+    When the whitelist enables ruok, the server will respond with `imok`
+    if it is running, otherwise it will not respond at all.
+    When ruok is disabled, the server responds with:
+    "ruok is not executed because it is not in the whitelist."
     A response of "imok" does not necessarily indicate that the
     server has joined the quorum, just that the server process is active
     and bound to the specified client port. Use "stat" for details on

From eafb93ac3edd28ff23b5b08b05e6ead7e44d85c6 Mon Sep 17 00:00:00 2001
From: Sam Mikes <smikes@apple.com>
Date: Sun, 7 Mar 2021 09:49:58 +0000
Subject: [PATCH 182/591] ZOOKEEPER-4217: add new arg 'func' to
 handle_socket_error_msg()

Add argument `const char *func` typically initialized with __func__ to include current function name in log message.

Author: Sam Mikes <smikes@apple.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1609 from smikes/handle-msg-report-func
---
 .../zookeeper-client-c/src/zookeeper.c        | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index b5d690f3515..72a05a96991 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -279,7 +279,7 @@ static void queue_completion_nolock(completion_head_t *list, completion_list_t *
         int add_to_front);
 static void queue_completion(completion_head_t *list, completion_list_t *c,
         int add_to_front);
-static int handle_socket_error_msg(zhandle_t *zh, int line, int rc,
+static int handle_socket_error_msg(zhandle_t *zh, int line, const char *func, int rc,
     const char* format,...);
 static void cleanup_bufs(zhandle_t *zh,int callCompletion,int rc);
 
@@ -2029,7 +2029,7 @@ static void handle_error(zhandle_t *zh,int rc)
     addrvec_next(&zh->addrs, &zh->addr_cur);
 }
 
-static int handle_socket_error_msg(zhandle_t *zh, int line, int rc,
+static int handle_socket_error_msg(zhandle_t *zh, int line, const char *func, int rc,
         const char* format, ...)
 {
     if(logLevel>=ZOO_LOG_LEVEL_ERROR){
@@ -2037,7 +2037,7 @@ static int handle_socket_error_msg(zhandle_t *zh, int line, int rc,
         char buf[1024];
         va_start(va,format);
         vsnprintf(buf, sizeof(buf)-1,format,va);
-        log_message(LOGCALLBACK(zh), ZOO_LOG_LEVEL_ERROR,line,__func__,
+        log_message(LOGCALLBACK(zh), ZOO_LOG_LEVEL_ERROR, line, func,
             "Socket %s zk retcode=%d, errno=%d(%s): %s",
             zoo_get_current_server(zh),rc,errno,strerror(errno),buf);
         va_end(va);
@@ -2283,7 +2283,7 @@ static int prime_connection(zhandle_t *zh)
     serialize_prime_connect(&req, buffer_req);
     rc=rc<0 ? rc : zookeeper_send(zh->fd, buffer_req, len);
     if (rc<0) {
-        return handle_socket_error_msg(zh, __LINE__, ZCONNECTIONLOSS,
+        return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "failed to send a handshake packet: %s", strerror(errno));
     }
     zh->state = ZOO_ASSOCIATING_STATE;
@@ -2572,6 +2572,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
             if (zh->fd->sock < 0) {
               rc = handle_socket_error_msg(zh,
                                            __LINE__,
+                                           __func__,
                                            ZSYSTEMERROR,
                                            "socket() call failed");
               return api_epilog(zh, rc);
@@ -2595,6 +2596,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
                 } else {
                     rc = handle_socket_error_msg(zh,
                                                  __LINE__,
+                                                 __func__,
                                                  ZCONNECTIONLOSS,
                                                  "connect() call failed");
                     return api_epilog(zh, rc);
@@ -2643,7 +2645,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
             *interest=0;
             *tv = get_timeval(0);
             return api_epilog(zh,handle_socket_error_msg(zh,
-                    __LINE__,ZOPERATIONTIMEOUT,
+                    __LINE__, __func__, ZOPERATIONTIMEOUT,
                     "connection to %s timed out (exceeded timeout by %dms)",
                     format_endpoint_info(&zh->addr_cur),
                     -recv_to));
@@ -2799,7 +2801,7 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
         fd->ssl_sock = SSL_new(*ctx);
         if (fd->ssl_sock == NULL) {
             if (fail_on_error) {
-                return handle_socket_error_msg(zh,__LINE__,ZSSLCONNECTIONERROR, "error creating ssl context");
+                return handle_socket_error_msg(zh, __LINE__, __func__, ZSSLCONNECTIONERROR, "error creating ssl context");
             } else {
                 LOG_ERROR(LOGCALLBACK(zh), "error creating ssl context");
                 return ZSSLCONNECTIONERROR;
@@ -2830,7 +2832,7 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
                 FD_CLR(sock, &s_rfds);
             } else {
                 if (fail_on_error) {
-                    return handle_socket_error_msg(zh,__LINE__,ZSSLCONNECTIONERROR, "error in ssl connect");
+                    return handle_socket_error_msg(zh, __LINE__, __func__, ZSSLCONNECTIONERROR, "error in ssl connect");
                 } else {
                     LOG_ERROR(LOGCALLBACK(zh), "error in ssl connect");
                     return ZSSLCONNECTIONERROR;
@@ -2839,7 +2841,7 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
             rc = select(sock + 1, &s_rfds, &s_wfds, NULL, &tv);
             if (rc == -1) {
                 if (fail_on_error) {
-                    return handle_socket_error_msg(zh,__LINE__,ZSSLCONNECTIONERROR, "error in ssl connect (after select)");
+                    return handle_socket_error_msg(zh, __LINE__, __func__, ZSSLCONNECTIONERROR, "error in ssl connect (after select)");
                 } else {
                     LOG_ERROR(LOGCALLBACK(zh), "error in ssl connect (after select)");
                     return ZSSLCONNECTIONERROR;
@@ -2958,7 +2960,7 @@ static int check_events(zhandle_t *zh, int events)
         if (rc < 0 || error) {
             if (rc == 0)
                 errno = error;
-            return handle_socket_error_msg(zh, __LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "server refused to accept the client");
         }
         // We do SSL_connect() here
@@ -2978,7 +2980,7 @@ static int check_events(zhandle_t *zh, int events)
         if (rc < 0 || error) {
             if (rc == 0)
                 errno = error;
-            return handle_socket_error_msg(zh, __LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "server refused to accept the client");
         }
 
@@ -2993,7 +2995,7 @@ static int check_events(zhandle_t *zh, int events)
         /* make the flush call non-blocking by specifying a 0 timeout */
         int rc=flush_send_queue(zh,0);
         if (rc < 0)
-            return handle_socket_error_msg(zh,__LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "failed while flushing send queue");
     }
     if (events&ZOOKEEPER_READ) {
@@ -3004,7 +3006,7 @@ static int check_events(zhandle_t *zh, int events)
 
         rc = recv_buffer(zh, zh->input_buffer);
         if (rc < 0) {
-            return handle_socket_error_msg(zh, __LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "failed while receiving a server response");
         }
         if (rc > 0) {
@@ -3040,7 +3042,7 @@ static int check_events(zhandle_t *zh, int events)
                 if (oldid != 0 && oldid != newid) {
                     zh->state = ZOO_EXPIRED_SESSION_STATE;
                     errno = ESTALE;
-                    return handle_socket_error_msg(zh,__LINE__,ZSESSIONEXPIRED,
+                    return handle_socket_error_msg(zh, __LINE__, __func__, ZSESSIONEXPIRED,
                             "sessionId=%#llx has expired.",oldid);
                 } else {
                     zh->recv_timeout = zh->primer_storage.timeOut;
@@ -3480,7 +3482,7 @@ int zookeeper_process(zhandle_t *zh, int events)
                 // signaled and deallocated) and disconnect from the server
                 queue_completion(&zh->sent_requests,cptr,1);
                 return api_epilog(zh,
-                                  handle_socket_error_msg(zh, __LINE__,ZRUNTIMEINCONSISTENCY,
+                                  handle_socket_error_msg(zh, __LINE__, __func__, ZRUNTIMEINCONSISTENCY,
                                   "unexpected server response: expected %#x, but received %#x",
                                   hdr.xid,cptr->xid));
             }

From 0ab7766a8a968e03c7b3bb7c1b9d42af9eea152e Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Tue, 9 Mar 2021 19:55:27 +0530
Subject: [PATCH 183/591] ZOOKEEPER-4232: InvalidSnapshotTest corrupts its own
 test data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`InvalidSnapshotTest.testSnapshot` starts an instance of
`ZooKeeperServer` on the version-controlled `resources/data/invalidsnap`
directory, which, as a side-effect, \"fixes\" the following
snapshot—which was broken on purpose (see ZOOKEEPER-367):

`zookeeper-server/src/test/resources/data/invalidsnap/version-2/snapshot.83f`

This status quo creates a number of problems:

1.  It makes the test ineffective after the first run;
2.  The file shows as modified in version control tools, which can be
    annoying;
3.  The \"fixed\" snapshot can end up being committed by mistake,
    invalidating the test.

(\#3 is not theoretical; that \"fixed\" snapshot frequently shows up in
pull requests, and was recently merged into master.).

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Mohammad Arshad <arshad@apache.org>

Closes #1622 from ztzg/ZOOKEEPER-4232-invalid-snapshot-is-invalid and squashes the following commits:

8b48eea98 [Damien Diederen] ZOOKEEPER-4232: Ensure that ZOOKEEPER-367 test data fails to parse
92507563d [Damien Diederen] ZOOKEEPER-4232: Run InvalidSnapshotTest on a copy of test data
dcf5604b9 [Damien Diederen] ZOOKEEPER-4232: Restore test data for ZOOKEEPER-367
---
 .../zookeeper/test/InvalidSnapshotTest.java   |  28 +++++++++++++++++-
 .../data/invalidsnap/version-2/snapshot.83f   | Bin 189686 -> 4824 bytes
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
index 80267054a26..c47a60f357c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
@@ -20,7 +20,10 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.io.IOException;
+import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
@@ -61,13 +64,36 @@ public void testSnapshotFormatterWithNull() throws Exception {
         SnapshotFormatter.main(args);
     }
 
+    /**
+     * Verify the SnapshotFormatter fails as expected on corrupted snapshot.
+     */
+    @Test
+    public void testSnapshotFormatterWithInvalidSnap() throws Exception {
+        File snapDir = new File(testData, "invalidsnap");
+        // Broken snapshot introduced by ZOOKEEPER-367, and used to
+        // demonstrate recovery in testSnapshot below.
+        File snapfile = new File(new File(snapDir, "version-2"), "snapshot.83f");
+        String[] args = {snapfile.getCanonicalFile().toString()};
+        try {
+            SnapshotFormatter.main(args);
+            fail("Snapshot '" + snapfile + "' unexpectedly parsed without error.");
+        } catch (IOException e) {
+            assertTrue(e.getMessage().contains("Unreasonable length = 977468229"));
+        }
+    }
+
     /**
      * test the snapshot
      * @throws Exception an exception could be expected
      */
     @Test
     public void testSnapshot() throws Exception {
-        File snapDir = new File(testData, "invalidsnap");
+        File origSnapDir = new File(testData, "invalidsnap");
+
+        // This test otherwise updates the resources directory.
+        File snapDir = ClientBase.createTmpDir();
+        FileUtils.copyDirectory(origSnapDir, snapDir);
+
         ZooKeeperServer zks = new ZooKeeperServer(snapDir, snapDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
diff --git a/zookeeper-server/src/test/resources/data/invalidsnap/version-2/snapshot.83f b/zookeeper-server/src/test/resources/data/invalidsnap/version-2/snapshot.83f
index 1b563b6ed6dcf472f83f2716efbeb9f3130869f2..26dc5f665218dbe5519a55cbcca2bd983a6f0e17 100644
GIT binary patch
delta 196
zcmex%lKY10gc*|y?*+3OGcYi)PM(-5Jo)n%hsoSOLMHot-#dB!w{4SOe%&_N`0M(~
zSwG_^i~o$AyzfWw<eR^vC&&MYpM2$4<m74~Rs!OaK)JTx!IRa0M^3JK8#8&`hmgtV
z-?C5s@qXK6Cm`;5w{7yZx9cbKeu|&G>tp2P#E-#~YraHJX8IUEx%_kFWH}%{`YCd9
v4iIa837&ik$d`Q<Gdb{O$mA(6_D+8KeA{GwAg+8C!o^_a^xGBaVn%%c+xcz<

literal 189686
zcmb@vcf2lHQT=^83^S6$B?}BFNsyU)=iUkAsFHJ*sDP5=3_}=lmYj1G$w*d|D2gCK
zK~OS?fPzX!K#|{CRjY2D+pGKioIl>}$G!SIRrNjl^s`r2_cJpOx4QO?ueWE<p7EC&
zI39+h@A1tCyaz{nu6Hzl<`D*!|9=+z{}HF$>%MpYeH@(b4);9uUiZ8cj$-V<)Jy+g
zdU_8Yc@Mlc9&;?_>6l|Ltb|&_sGp%+<;kyajmQdc&-)RXk2yAwM^Km0DN6DC1bb&|
zMD{AaQ_hVajwI}uefw~Dln$3@o+}P$toL)R@%q}t8lm^&Q0V<j^jTF44fN+*6>(vW
z(8u9W=;M~?v#Amq=r6P?;=&rC58zPf155PTRS6CBms%BZVU5rSaVYe`CHfqyga-O6
zt%|s?M(E>lDD?45bnO6Wpug7YOufPyp-;e}&?hX>=Ttg0&|hy=#Dz6NpNK=DPh6tU
zrAla^ztO6Q3u}Zv35P<Tv_y0Jb3g<At=4#bZDP&o!Y4F${u1-ztV(Er-`lE)3u_Wg
zD{A%26(6BGXn^0}s)!3~5=<i|*nD_8)j<RN!B$0FSd(DdFu~@+BUJ|t@P}FzabZn@
zX~G1X2ai%6G{7HjRm6og38n=TY!3Vt)j<RN(N;xVSd(BHFu~@(x~xM3{IOOi>J`=`
znD$Gsx$g{0h6eZ(t%|s?Cc!jcg3WtpR2?+Hf8VNz3u_Wg>m}HncP7<A1N^C0MO;{u
zxP7#qOl{sfvnrv1{!FVPF05g5rSsTa_bq*Q9@Rht`kmH@)TLEvA(zI?_3rED%EKl4
z*Hr^0`V?K~sGEZ|LetYc6+oM*FDd{u(7Mi@!fV*pV2#jpwa{kki>V$O=<~KJ;=&rC
z>1(0Q*cVqNG|<1=s)!3~gr>8FHfvu(mC!(6pj8nU)(A~+3vK4Uq$;6-zEG<oF02un
z?iSkY{Tr%;1{yo4R1p`}2wlw;JH!lrDOExPd68CUc5b1oxdLq#=l17-2D&z3ZORBP
zCf4xUu`h0ObNyy;Y_%BLawq>he*txKuqMIPT(RV(6VIn|C|7*)FIqRjtVwV+*L}yB
z56`c1Xq*cCSgME%YZ6?|b>A`OLRce4Sw#2#r_{56!iNcK5?sx7-!bMv7$Zg*<Or=8
zx;a>r;A*b>jxh&bQ034#1xL1Sf?1Q`YOec^G5^7DG0Jynobd~wn}an8uI9S$7<1pz
zDu)K}jID~eAXngOuKSKL@74AzJL~D{lzQ57?4CWW$raOjX%KTBOdO-kjE9<7IdpTd
zM%RmKu5gHX@7Dx?1`<ymrHZ()hRu}*VRJQm{HAK40jmo?FX|j?&GjmHo$KA-&6S6B
zPKPMmvxjGi0~+Y7w#MsgQ=M7xs=4xTiN36Ap@F`7>l!s)V~ti_%@t^~_2mSB2Ku*J
z6>(vW(A8XlHe+92mC!){cB?Zxx6svGfi`PjLFv#yU$b=+%^Iz`nk&#|?kfra4fM5I
zH_@ySx|%D{X74Kr01fnYTQ||H5xSZy&}Q%}3jhuD^;;EjL2jYB4|z)fv{{_np931`
z8@9&lYZGgD?bv^)x#DQKt1qKUXn^Z>hPNtPgEa}R=87dR!N;f?8sNI)s5_7~IBODI
z&2_(DJ$Sj|fCji$UVljh7ZYm|T+MaAH&^~K9MAyQFQ{J_!NtUy1Xpw2@6DBe3<os8
zJ2YNjn^=?JYOedex$=+UfCd<;rF?mHuqMIPT=#o(<sZWV4Im6v%9mFMYZ6?|b-y=P
z{xKZ2(z@c+6)>ZR&#XysHP`*#T=~avKx3tK<)|x31Q!!)65K7ooX0<gqfWt<^$Vbz
zqffx0Cs#PcyvIL>0~%{CbJMt6gEeffd>h$Zt(TzV#i-7AW5J;@_DXlk&F}-SZ^w0W
z<>AuO*HaBN)_Zd6PTFC|tPz@9n%6g=t-0b-83P*VQ(F~rVU5r{8$#O&xq&L7fqrnS
zA}*{En%i1vYpyp`B{a|vZB@jDH9~V^3vJEyMyiAc`m|O>Tv#JCx3<vMTx%!P&Um=c
z(9OXbp}Dz*w&r>h0idz!N46^B!WyBuxrMgodQ(+G1O2F0MO;`TbTwCOKC?KtKL<3>
zk7<q9*Cy8R+Hu^W=8B`GVXmf1Xn=3gy2gyxSd(D(7Oj2>#=U2Zx(B_rz|hUXngr8`
z2{s>IL*>v|@oicaabZn@X~P7Y3vo*uqi$_)D=>6(uqMGYVS>$rxS@?vH@0^c7`i!F
zlVDmf!REl<Q8_eD#UHdP;=-B)(|`#!|KUD4M%^#}p}^41!I}hDZ#mAJEAEnG)ZOx3
z1%_@8)+Ctb%N3jVuB~!toQiw2D&oSL1XpuC?ih34byNop@V#1{*tuHgq2>xxoA+>E
zAEWN??;|vHbFhZZmD`QY)i&GBRSJ#uKCU$)dlla)cf$`nuLruh@^ESC-%|}V&@XFM
z#Dz6N)6=|k0&S-LeN{pO{i;?)Tv#JCT`jcP`cA5Z2Ku$Finy>wXr5@H?Od0E%h0bE
z8oD`HBQ%{Yv|0Nu0zhNcZ)jD-g*8Ic+d`YUag~TsSBp0a4c#295xSZy-bQP#b$x)w
zs^8qYiDr$^)m(u#gVz<Jt{86-8oD`HBXl)apv~gk{v6O)_1jzH^|gsLymlNo)Le12
zGz^+)jB2V+5*WHUSd-v=IMV8u;9II38Y}*zRz+M`li+Hu2mHzPR;q&r_$jSU>|BAX
zxgPL){%ZSm8}KxNp__v>xni0yPlb8#cU2CJ6+fd@5f|1ZxSHz$e{#irMU1+?c$UD>
z&B2-kS93k!Pp)-8QTG?m5g58TSd-vtt_Qri-cIGvI2F%r-2}5H!8Bi<WAonaRSpgC
z^IH{hL9W0j;V8l8ygR548sHbSD&oQ#+2U9n>MCd6yQ3<hfqr4DA}*|9bLFmJbG57T
z-Bkk(=(}1YvRCn)@^JjX^&afz%EP6lAE+8=pg+;7hzo0kuI37~HP=&B2@Ui=wmP$O
z3ti0>Xlt$yQaUuypKaYlvqq~vfJ454K%222EC4jnpKDdbg*8G~a|PPo#)qg98t5;!
zI<s>NO>b+})?6Q|bZDTz)T)RJYqaWWu2{7-*V9x94fI!9o!PmCroXjnGx)=l4h{6z
zS`~3&jaE&E3vCvExGJH6{(7q-F362*$H7C*6-P_M+(UKH0KdCc5f|3*YKPN{BdvZ3
zzNhM-0e(-bA}*{+a5dM1-dyqM5ThO;-YYP4bFe1C)m#sHbG^69p|RrkwQho0lVF-K
zPlb8#J}QR>_yetqxUeR{)m#tyh4j9vg9i9RtxoJ*foZ^8vH9<QN`?mb!>x+AuqIbr
z&Gn!+*ZZpu8sLw#I<a#FrulNk=Di0f85-b^wkqPnnp`ohmtb?=$*O|}_+zb#xUeR1
zhn`&F74zOHs)Ppm<E_r@+-R<R^VnSNt$TzLp#lA7Yee=czEhr!AGqG*ySegkY3V1c
z21@h;k80gXJM5S>LRWJI+M4TAR0Iw5>01xO?fii?Letf}bOLS7^{J|X2Ko%Giny>w
zX!=@cGxpO|2@Uj_S`~3&jnD^iD6}=#r>hbg=(Dsc;=&rCxjlro9r6rSLIZu)Rz+M`
zBXl)aoNH^Y&r~He&}VCPX6F{Vnk&#|@MkF<8t8MjZlYPERabKb+APlP&jAhexm)A)
zwTU&nb{v1Gx#DPP7<?)o14{5I-)>dJg*6G@ha;_i34WC7paK4mRz+M`lVBP#!REt9
zs}36A@3$)A!kPrrh6y$oK1OxW0RN~}5f|1Z_yCR)Y#w~9>YxGsd8;BWtV!@e93|Ks
z_&C);1N@6tMO;{uU>Y#N=D)|Q4odI?hgL;gSd(DdFTv)%C#Vh@;IUN^7uF=Wn(OiY
z&s?9VI%t6BRws6@z|~xj_m73^BOHCC^S~nnhHehl<Ow*`Tw!YS-X947jWwUHbra1R
zKDqK7v$@(CevV3^0X=VPMD{AaQ(lK3xZV@Gx$<yn=~t)*8tBWk?xY=d%o?HTX<qPw
zHdDV+MbJPW+p35QYlN=m3bfh!RjPyr8p|kE#Dz6N)7M(H8T*e_2@NEyTB?W(YlNn=
zg*I!yT9wd1!mOo=xUfcOdRu5S_n)W|8c4XRR1p`}2wlw;=h`;kYg7phBz#q>hzo0k
zuI37~HP_dw5*o<MwK}tN3ti0>Xlt(A{v6OiU!gT#Uz=FNi_!^)nk$Z$hIy_kp#eT$
z>l!m&V@-mqxnjvn@bgp-4e$k86>(urf~&cn;7_j4R~<CK7i@K6=L%fS^#p%%eSwmp
z0Y17_5f|3vimSPv;Qtuxg{p%F_#&-N>|BAXxt`!pt}jwDG{C>!x(Q}Yu9ybQU2Xn*
zvC5$VzG$l=F04r~?U!J4-%C^n4e-TV6>(urf@!`4oA+L-I%t3|*{X;OYZ6TBCD@$z
zGSxu?e5qDNT#zf=q2>yQnD<_;N@$>evsDon*08zqRIs_)iFmzgpaH#7Yed$X>-!Ml
zpMPRER~{}c{Vt)QfxdaGA}*{Ex|%D{)?EKgmC!)ns@0jDTj*-8KwESDbEQKAecRSe
zG;6f#YOX+AbA7h}&_Lh5RS_4~2wlw;Xlt&2p-O0=@7(Il&MkB`SD?+@f2nk6pzqSU
ziDr#feF6^Iw}Cc$zefOQpzqqMhzo0k=B5_f_Vs&J2@Uk!TNQC(jnH(s&}MONe-3D%
z@6j5suT8Aswd2G?%@s#W!@NP2&;Vb#RS_4~B)FO@PV^G|M%6(BeAQMbcCNtHTu=1o
z`X(hq1AO(?O)zV6#noI-^yd0zl|uu3&DKpYYZ6?|^+a#3f2wk5fUn)U31&@#tGS-&
z&GjuRhX(jMt(#!hB)FREiT>H*TU8DX@O4`^!K_Iz?U#Gn-1jz>Lj!z+Rz+M`lVF-J
z!REcUs}36A8@DRr!kPrrdI>h?y+d`-0N<ol5f|3T)W_mbrZ(@rQ<cy_->g*;7uK-3
za>Z<}w%+%v1{%<Nwnk*H;ydLZ@dMX;Qa4u~E-n2r)j$J{51L99abb<n^fXTe(AHc(
zu1aViAJeLc3u}Zv4u?WpbNz%Wp@DvEt0FF}5&8fQg|_DUNmW7v{iIe!Tv#JCoh`IA
z*S}XKG|*3ORm6ogLLZMqp{=?8gDRncerl^CF02u{nk(K$v-hV|2@UkqTb<dtg|6lb
zv>E)<N{0se8LgXW)@aq$T!A*raQkyW1O3d_cztbR4X+(19cr#PS{mj9s)PpkzO8G_
zc#Sm)-iITtehL1d%Ao<if2$%ctV!^G93|L%_*bff2KWK3iny>Q!N=h!!REpbsSX<8
zQ(6^qVNHS$;3&c7!M|1=G{C2}D&oSL1k-{EHV6KV>YxFBP^%&?tVu8pm|*kYhgAm+
z@Pk_wabZn@tGS-!A6ovc>YxFBNUIY&SKw-{C;0>0N0bZ=@M*1^VAkY{tGS-!&FZ5n
zhX(jzt(#!h<e5G6<O)-p_x?@*XrLe2x`}4Z82_%r<TtdRQ5iIV&uWdx=@s801Fj_K
z*7@JUA3<Fj`LoJ~2K3pj5!tKwPWd)|IFhjH)_J%@|BGs%fqrA_PTFC|tPz?QiKFtj
z*j3`|DuM?3O|6Q!utsQJCWN-@#J{Q%8t6B-D&oQ#p?RSY+O8DeP$e|bZ)sJ;g*8I+
zQX#ZmE54~pXrSNPs)!3~gwAdqZ=+o;zNJcNpx@Ez%+4)zcI!Y}xBfS!Lj(QJ)=e~P
zwCe2Efwpe_?*c#r{b#M4Xx0dw-8#_Lt-1X<pn<MWHu$N<)?m%)Vl(r8Jb#IK@t;%;
z4e)bX6>(urg0ox4l9x{WXVpOi{M=S2cCNtLtqC?Ceoo2I0KcGh6U>@iadvBh&4r&=
zIW)ld;Ivc`7uF;=yEVb)!7r!|8o-yfI<a#FrUmoOGY5WA$<P45qE!(W*5rz5zyzEB
zzN9*6fM3<Bhzn~Hd;*RVZ0`HA>YxFBb*myStVuA<mtgbWS5yZL@M~KYabZn@X}tuS
z^S-J&Xn<eWs)!46g;Tc<hnV-irb=j_-_WXv3v1Y1={z=9dtUvHYM=rA%hrgjHP>Gv
z!apDXM=me;JX~7(zXPym4>Zu9ZB@jDH9}W&1=>vgQ&mC(T~`h0=3tG`)m(u#TmMV|
zXrOEB)mB{NvqtD@u0Wfyf38|+plkDSV{HxA2wlw;XtVbJs2&>V+9Q1bw+3s3rnmJr
znz{d1_0T}q4NcwPD14Z(MrgWQXtVb(R0Iul-F4Jmh{A^nYlJ=#heDgd|4&8GK-XOd
z?<lqgYlNo5g*J<G`*T18UAG2xs}RA(#2Q{Z;A|Y_FENAvhl-#9es8NHF04s#HCOzS
zr4#>Cb<hC6uhog2D{wW}m9KpIFC{|*{K3{uFl%zf)m&G;^69%OhX(ksS~tP0NpLmS
zm9KpIp30#C{_ECFFl!QA&2{A~pT4hh=&r%6NpLmSm9KpIfxyrJ*CR0>cee&>5={H$
zb~E?=P}R@?f1*_p7uF=0=1Z`7??<YG2KbY$iny>Q!L(k2&3Qjo9W=oI(5i?FYZ7;;
zxxyjly`QKO8t6~AI<s@5xzZqPuFEzxD32P@+H|!E_bOqB41A62#aCzS!yzw1JX~0M
zIAhjOi9Yqn){OWZH9~XALffj(l%)eS&_}g8v~z3K$KfTRm(6uJv(lk~{*~5@_#8D_
z^#O#1UN+a^ELlno^yyn2+PSrAI$P*va~;mAbZDT@(3%mSqeiQ)=8Cs**<6RS2@MT&
zy`6e{9gIBI2wlw;=%u}fvkMIkbiJK=dsoq{5xSZy&`X04=MWki=z2T#_O7B?BXl)a
zpqCbp?T<`qpzFlwM6IG}8D2Z;E1%+MX&9MtfD-(`AGEGP`5JQt-iITtehD6#iezYj
z>*B-<&&FV`!25BOVDsUW)dMuZxHm4%h|kOwm^MtXxp2<H0UAKu8JA|nXXXk_6DHU^
zctjQs&;ZuW7jLXK26F|b1ruxzJY7}~&;Zx17jLUJ26F|j=IUShG~lwyK_&Q99!qh!
zI-(}GTQyhz%BKMrO%7@Rwe3#jmf9Fmli+Hu{*_MyE}0zE0Bd)gs@)R7#S}FOuI9Sm
zK4%_q!Q`L@Si9p??Uo2Grl`rc>`-%ssh7=lzy*_o8fd+Zr|NBu;9`mzKDlxqv$@(X
zK4(@8(16x;j@K{_UKJK&xFlZSdigz1IOGMNhf7QA=K&h%UvFIy5B<p8LetYio2f67
z6$3QT7j4am&&(|}&xX);LVhhv2WX%#)|wHYnOkW3T4*yiP5{SHC*tBlL$?NV3r%MW
zZPvyK;27#eTtaB*)?jX-tGVKBwC0Kvz%kT`z`GwOhPz;6Ft^avT!FUcsy}?F6LBe_
zp<9Ewg|6lbv^7`#;X|E>OA8I%8q6(pHCLdmx#|z64dO%`+q#Kn4X+*bl}~ZBG|aiO
ze1HZR&Av1vJ~LO~YOYxF5`69~9H0S&sY^5BGjj#5=6ampnx7{N2WS9m<@!q;i#*ok
zsi@|9oL`pCD=;*`wQ~I>t6<h7xSH#6_ObAAK7pYDu9fRASp~Bu!PQ)kvwuTsIKRNq
z0PoN>C|`@31Rswd^O9=*`_(KTpaH%>Yesx#u2y^kjuLF{1BhcN-~|PSZVl!Nd?Jn#
zY~B-KDBy(zhHee!3QX%I*qkT8P{5-FhHee!3U{cv!XegNk50e<jk8=$tE`ma!{*^=
z{K)3Y?Z)P67yREq0Aqj#6c#Pz>#NQ6ig=xWKE4m9nkx@$9YYlE8Mt9EsDZp@YXnxN
zs1drFE6~<lxn(d0XrQmv8iAFGxwYzQu0UIJ<)*<Hpn<+_YXnv%<`%k|E6{eXxot28
zXrQmx8iAFGxrMIg3bZxX%VzBW4fOR}SE%t4a|_M4ihUbsGxy~ZFhB!+!`6)W%-llr
zv<q$azI>Jr&_Lg)H6uPVx6nN8LYu*_kfj4O(6?;Oh|kO|G*7$GW^rzRi~$<x-))V+
z%Ea8bcGOos@l>0^bx$$WJqEUE`~q&*jlo=jtGVJmTsl#A6hqx%)ZXR^+!)LixSFef
z<<sz+Sxt?V*7nnOTw_NKI|{z&3Gp<$x$rUqLjzo!Pn&TS%$fvOb3NeKyJG}~2DtWz
z_RA`mH3_cf>R<UZ;1-L68sOR;+AR@WOi`2IYOem3PXpgq3~GR{(i(x4DQXhjS3Pqd
z-&c$Q8sMw8Mqp)Pu1-Z?^UQnNuS4zMYX}V88q5{AuXyG>zONVqG*<lEtr1w6m|Ldi
zTO?DP_xR3Y4A4OTPHO~KCgw(SrLwu&RryL;H9!M;+t!He&G^oFxG{dBDe%=9eCN4d
z9xg3??JOFgfxc&JMto*&q4_=vZO!#MSvo)ieXrJx_{`iw^PLphY>j5hF;r8%x6sh7
z!Q4Xgy%gG->-7>aKx5VSY0Zew%q=wEL!s?$yndDr&_Lh6H6uPVx6svG@itm>y+M`^
z&_JKu>d?+DbTwC?&E7XuIyBIyv~HqVqs>>%6=*Z~jf92<`hl&RXx0c_%@t^~IJZ9r
zZ4l^FTO+VCg=KiPtFL^DqorZ4oRtGKz_)A7h|kQ8ixL)!BdvZ3#`TzEfCl)Etr1w6
zm@6=im|*iEuE!ihU6+4PVCdFhuE4Zmg3X0j%klvlEB^h~jQGr4f$M^L(3|Vkvv7b0
z_)e{k>|B9q!CbL9P@Q9_PI6~~p<9Ew0#|cAX#Z``@LO3<jTPUebrZ~*+-}ue{VSga
zv?dN}fbZHGft4w05?syop#AH|0~!+tHNbakjljwjH3_cfdeA=>#^V{sP>*SM7Z|!V
zm|M0u7KgfkT64wY8OKnMY4;Esx;2;^&6RH+o2y+qZ<3`0G)}~WS|hSI<2&c!5AYMW
z7`{4#j^=uKxU}@`vuJ<@`UR~S@tL`Wrl*BAQ{N#=2WX&Q*qRZanOo>;u2{9%`i@yT
zKm+}vR)=<Oq3LU_+M25_IRiA%FK*pLvqtB-nk!aq*2cw$W2lSJONEAR4dxcQnk&$@
zLvZ=w7@)E0m$yb>WnyljtGNPg%~cnk0UGF6w60L&CFT~onk&%OTyY8F80u2=DxslU
zgSmyS<_femS8jg{+8|c_>edLXOko*bJL)T+;^@N498!mywg&j&0z<b()Fil?E0(+j
z-z>`qXn-Hlx(Q}Yf~&b6?;i`_TwrK`AKAJIW=(>txgPHy3*SOuXn-Hpx(Q}Yf@#7u
zjd}2vSw27m{Fv5^_{>~^tGOQUPbs&`!T}oKr?fh<a|NaWbH(PrTPqnF;HR}_#OHxE
zc`9hX1e^Qti3`V2pS(O<VCdFhuD~>3g3Wuk$?^djD}GLEMto+jz_eb1&3Sn8;~44*
z@VNp*w+3^CJM^(I9AeECH?kZ<-OxT?Xz12pZZub(V>VYi!+)5i12j&=pR`6~t+_rF
z5&rr3>WpfxJX~7(0YXCq{qEL`_&l&i=xVM&TXQ`*O9yD6-`ncY&MkB`SD>xAo}zSU
zpg-8UiDr#fUCk9}Gxh_8h6ehht($1p2z?NT?At(Fb3HWy12oVdYt4wy%q=v%Ewq{Y
zL0LLL1O3U?jQGslLUZQ{ZJY1GSvo)i{pr?>_{`iw)89gy!5@;P12oW|Y0Zew%q{du
zI276}&h3veKm+~x)(EUj%#CYDedQD1MKkzavvPn2__eJo%y@~p0#|dz_E<U*j}9C|
zJwm)rVCdFhuE5n?{VSgaJu*;Z#jkJO1ha-0etgjrj&g6C3-!P-)C0sD1cq)6<_cWR
z)xYv-xM!AAW5sW3-2}5HS4<1$ip_!d%JKmk;5WBs#AoITOams^{CDpx9H0SyYimY)
zX0E`rUxLkj_sPNm8sN9JX2fUa3QY4Q*t~b&EF7Q#etT<1d}gk|v|fVEdH2i00UF?U
zwr0d<<_dSHxxyjlz58eB01foJS{>TC(Oh{d*j(*IoTfx*K)=`;k-Zt;IS<dkPyF-o
z<uY_MFG4(ATKb7uG(ZFW-PVlw%-lln$Dz>HT%VMs12oXzYt4wy%q{eBI277!{YP0k
zKm+~#){OYf+(I9~q0rV`pPZ!wG|)e6&4|y;Ep#<koNKf8Q?hh`2Kpzh4(;4RS91m0
z%>7iQLj(Qat($1pXopmD1={TWG@+q^{%Pwbnl(aKa|PP=_0xrh2Kr~Mn`qVuUCk9}
zvpBau25k`NpSMO}WeUsi`dnZ66h}+LJS-~*Xn?=my26Z?m>U-*EEGpt{Sy4}$lWtQ
z1N_z2jQGr4foa49n-3q6g#$Fe|I(TfpP4H#ZJ1zlAs&G_hI$m<4VX1~j%mUKn+Nd-
z%rVrX@Yl6s=+<Daz|~y+E1!l(XE`-a#lN<0f?1O*uIB1r`843!nu8kPZ?r~WWr~^v
zS93klpQ|35l>;=u-)voB#!JlAimSPv=so3eSw27m{O#6^_{>~^tGS-&9}7P|3kPU`
zztif-&MjLUi<fk5w&wZ-r9%V#U#%JOd0-9yg(j|;&DE|H&&(oz+eASBr!^vL%@t3#
zv0i+21|7}y@^ESCmj+<Z044fCr*F-O&&(}!HCLd`)Gy1@0UGEtv}VL-<`$Z+)~e0c
zFVE5e8t5~&X2fUa7P^`%R&B<9MV1cGK%cqQp`BakYOX+AbA6@Kp}R)2hL<4ls=4xT
z`8K{vXlS6%(wY&U2i6E(%@t^Cu78}R12oWQYjtSn7P^`%(AHdEt#oLh&(XSxW{p-|
z%@t^~47WeV01fmxTO+VCF*mLq^_5RN>t^t0W#s@R_|&Br*TAgdWfTj=kygKa3!j~p
z12n+DXw8Vv%oVtr>q-8x@N=?ofCl*gS{>QB0@H@MVsqhhl?)B=FIzL>^T3)s6*OUj
z&4bU&!U0M!KVm7(h|kOw_#loFYz};W77ow=4y_sSnYjX2b3Mub!QBh8aDWDQYIS7i
z3QYUuip_m5R5CQcb8AL?9$1s-nC45cdGAG8I6wn@L~BNTX0E`rUV_beFV4aN8sO8l
zX2fUa3U}zq6<#s#y(CKqXrPa3b!g|}E1zhO$*u7kB|!stuGWa48!pFqXS_1&Ki4~g
zx->FA%i<WI0X=tX1op;!*fhKcKORX~b?ZD_qTi8K12oWAYCVj%;|JyzI=gkCty{k{
zYX)ebuiTmupP5_e?AC#{>%_aVbbto>Dy<If+(Pq0aa5igyHfm_(xHLAT5Cpp9$2Gu
z%}a&QcCGmHEFGYMzD8?Cd}eN;kH?|V)~(;2r2{n3*J{m(&&(|}FBd}F_2MtGbbto>
zdaW7pnYo4L1w&}NV*F*64$wf~yfq^}Gq=#ZWC(573~ql6+91%kY>mLm6qY$%Yzy9x
z=NoEXd|g%!&;Xyib%hx(F&9_4*vdH4PFXtf^;teZ1ALy=jQGr4fwNolSC|jqkc9&@
zz~^msWakQ;-I`!?;Tx3<4e<F}H^HpQQ<2@8VDsRc1cnCqLam!%)+Cq~%yVoGd~=o$
z&;TFZnh~FwD=-b1VDsOfX5j!0Fy7qKjQGr4foZ=4oBQ69g#$Ez7irCi&&(B==1Z`7
z@2y!lKm&Z)){OYfT!Cr51e^2TmW2Z}z?W~$h|kOwPTe}ZV%~dumJZNBU$NDpog2-S
z_sMLo_PqLDB|-ywtJa9@&G^oF_!NHPpO3H3AeR>*9xg5Y(JUIEf&PQmjQGslLhr|+
z&}Qnt%hCZF=s#@Dh|kO|G+iyU+4^HyIzR(`_tuQ~%-llL*Fu}IKc1xnG|=~K&4|y;
zEp#<koNKf8C$e;a2Kqj&4(;4RS91m0%>7BFLj!%^)=e~Pv_q=70&VvGd!eC$zF+Gm
znl(aKa|PNA{trS!1AYJ2O*CtSuI37~S)AJ+gEk2C16m`nGKFP$eXg&3ile1r-j|gF
zG{CoRU17#c%#Di@7K$USehGem<n9@u0lrOZMto+jz%*il&4(Yz!T}oK+qP!JXXXk_
z8z$IX_`xh3paH&JYesx#uD~>5g3W_}m4yQ|z_)MBh|kOwxSA{e?eXO~{!kVU&;Z}D
z)sdYma5Y!_n{!L>Un?0J;NNTA1hXc$TQyhwL-Qs0Zv=)0_)e{xVAdqKnk)W^$rAiw
zfuRA$6JBXXd>&Yn;A*b;cxMUz+bkTQ0lZ7ABRjWjaV%cawb`2MN0biTHJUYia-~7o
zT+JSz78DxLlUpOQ)?B}Z2=^|o5Og%x%fscV_(}lw4A4M7p*15uGq=!Ove35buV(20
z4fGRRGvYII3r$xGZMObemJZNBKdCh%J~Ow_)m(8x%-H{ur2{n3Pi}Q+=N7t}E6`@`
zuPYrI=%=)9qFJN2v6?H;X6}C#8XD-Qwr-+XBXl)apv~Uj5E>fjr?qaPStE2cSD?+{
z-xL}e=%=@CqFEz!HCLd`;@tii19aDD*6`Ya+h!c)FENAvBSIJhG{C2{Mqp)PuE5n?
zvE-!_Ka-UMG{C2}t}x>z<_cWRb>-^u*(@KR0e(<xMto+jz|~y$`;+TGW#Iq~@IzW1
z*|`GKgn5q5ga52#Xn-Hunh~D|*5sQ<3nthc__-_`paFhZYesx#uD~>4g3W)Q&%yy3
z;D@(n#AoITO#3C+-1mhn9H0SyWNSuzX0E_AUxLkhU(CV*8sJB@X2fUa3Vafd5^T=<
zQWg%-06(TRBR(@%xI<5_aEN*D%UL==1O50`hjwl>SMFmrSL-GJrbK8!pV=Cby&2y*
z5C4mw_~+xRGpf1raB1luWzhf)^ru>P;&vW0x6svGfwt!Q<18AWfv&Tyv%eEr$ILBs
zHCLeRg#086256w`>a44E;dUx>3w;2G?At(_vHv@Z256w`>a44EMh~BvTWC64XtVZD
zvuuC{y53H`y%{}xW^SSBZK2KFKg+TK8t8AgX2fUa7MkuB+U))FEFGYM{!VK~d}eN;
z>2IOU;Qy1Q12oXzZOw?!%q=t>F0@&k+aH5A2=w<`Bd{`sWq5tAuY8K5rD6U(D+g$R
zpVPX+jF*@j7bWaB9LbeSFy1nbq29XZ3k=;F%oVtr>&jO?;SJ*$>WzDWz|gJ1T!E{(
zu6*Uwe`NUpjZ^W$)=e;L@*LBIc`D3<|C!|jG{7%u&4|y;6_^%GusQI*vT%R~_!X@g
z@tL^-(|`#!|6%8H47Gz_CopttFjrvOFTv)%?`8P_jTOJXH6uPVS74ei!R9>}f@3IS
zyg^{-)?lu{v|fVEc|XYV0U9fQb8AL?X0C9Dnk&3w&Gm;_IzR*cj#h_uZZubJH#S$>
zY`;(<G@!L^{T*vx`81vlHT?7O<udzl$cqpU7nUA>CDBx(AAF|PjQAWiLhnad=w)*q
zPoJgKK%b@6p`BZ+uI7qWFPrOl2Bkv-eb&}ZG;6f#YOX*p&-Hjlp`n4sc`VI{&ru_E
zHCLdQ)*f+gIjDg=dus$%rl=9Rnk&#tbB|}vT56!r(Yiv7m!d}KYOX*p?LFdc<Dl*u
z%^IPrxdOd3_=vZSgBs|)tr1w6qDJUyu0Ss>9^0Sjdi%~PG<0i34KMull}~ZBFwF3O
zSx)7eAM~TvEpXH%m{!#4m*8It3=Qy)TQ|Y1NidC=VDq7>M`(a?zgDV{33COe4HIlG
z9I|eN2C#0wcx$yWm@6<%m|*i@{Cd23&;ZxX7jLXK26F|b1ruxzoU(d^2DmP$y1-`i
z@R_*+S9A5Rd>ZF0q6WC$M7^npBRf~%YOV+DW8v`#B|`~*u+BAgYeY@%ifXP0>|^2a
zbXiUfuujQ?b&A&DQIp_mt_SR6;qgd;p#iRy>n~XavnJoNL(LVYUN+b9D50T&-l1z)
zz7{q7SeUzl&DHh<uEHE+U5(EzI5Y+>O3N``46ks#_?nq&t~|W367}Yc7tEijvEJWk
zRi;VQ2u)A3xdLsbzED<<&_G|h)tGvLxwYzQu0WfukIwuN8tBWkX2fUa7Mi}+s?FFs
zK_fKK$F`zsbuhQkd=G`TxA7ubJwgMGlUJG%pP5_eYOXjT)?9xrOGjuRaq>zt;xls#
zUCk9}Yp%bZr6V+uIC-TR@tL`WuI37~HP?$~=?D!ZmQk7!pP5_eYOX+AbLIBOpbY|v
z+)}>2Ho`KzcGOos#gX>Io*_#{+_rE~19;xn2&_y|li+HuSn?7q6OYgUpRaX=880z6
zuFnVKA1S3L&4=gA@(~)~3$$j$XXXk_8z$IXc&;oQp#iRIh^{FaJ$z=az}QCun+J7W
z8=(QND~PTrha>YR<_b&;=8DaM=TR~=z~w|aGoy#kBWv=_qX83a{=+Wd7;86_S!AA!
z9zHWyVC;K=&3)Jf9AoW<+RxhG89jVvuD~>3uGqYH{wx}yaVmBLW=)=olMaE+dA}+!
zG{6^c&4|w<YjT~3nkyV)%@sSBW2_x~Nui-zgSqkK$~TYA)!sU+k7KNLUQSSG4Ea(&
zg^Y}Gz4+>kYOXw7TAJR$7@=`0Zqgcom5I59uI37~nVRmw7@>i_MQa3BCgv8JzlCiI
zXtOo_gE2w_eaqGetW3-;G=GcGW^BF*7$Y>$w`z^R%Ea74^S20X)~1IrMrfdK-5P<F
ziMfU5ZxPyd2wj9RLIZu9)(EUj%q=v3i_m6o`Uqo$2Ku(G5m=d+TWJ0kq0Qiz&Ds$f
z=sUD##AoIfn!iP8v$(858wC1}tq#ps!ZN&e)K@;m(b6!NP%<>YS7_Y?vnIjST(PN_
zU|k``x?)^OVCdFhuD~>6+TDDJ`(=)??whY7Fm!7$SKv0gx$sh1K0@PET&;Bz%$htE
zZFTb?Zo@gox*fl|z|gJ1T!Gu@=D^>~@(~&<zDDaNm^HcLwz>HaclR7)-R1wbz|gJ1
zT!Gu<=DuUHe1yh|f2Va5%$i(rTim>dhX#(Z9v-eQFm!7$SKv0dIgeW$V}!<vZ`c}v
zm5I4!YW@zH+L|jjImTE|B{votx;2;^&6Vev&DGBE<+F5z#(ICRH6nX6zH=ULfS>3#
ze02tw&h_$eX=%J!9Amv{_Z1qtHJDpyE?sCd^)(YPLSxnUYt4wy%q=usEwtJCT3I?m
z1AYJ2jQGslLRWLe2{B_|J4;7spdZlc(9SJ%HCLd`+SgG!G|(rvZlYPEx3QWl&}Q!I
z3JnePDXp7m)(BnA6=>Uh*Ap7LYcy+wuI37~8C*sl%h;#tS3tK0a|>O~6=<_Kw?77L
z5UYMrYXnxNunaFs^_5R?v@{HwDaTk%_4fsaZVl$fMF|VVkxtAKe8nsup|RpSwPwU;
z<_b(BCfIza?mSkvzKg)nt-)M@X~P7Y3$L8zBQ#e02dx?LdAu@S%X3`K)xYv-RNJQp
z_^z!eUma1C;A*ZX_(y<O&Ds$f;JdZ1Qt={lwc={7C-~zJ?khOPy1&>Bm^HcLYOW{v
zrC;|GBQ#cgk5>M|wZUA0tGS-w9}DBYf@7@vi+c(T-5SglxSHz;{;}|HW%&q=72m6M
z6U-XfqM9qbV$D^zDkC(|_i5ckvxXlF^Hi|8+C}JwSvo=k`ry`xtTk77GuDf*nW3ZE
zrg*rt^lbvLXM_g&39T9NnYo3o<_ff#8jm;}BQ(%YY>mLm#N0wxa|POLeY>n3p@IIR
z))i{J#N0wxa|PO(>+KUTLIeHe){OYf+(K7#1=^bH9kO(U2KuS38S$C9g|6lbv^7^e
zm~o8IU87mU9SvSJR~}xNAdDep#GM=mHPBCQjljwjH9}W&1={wt8qx?2^fOvlsPPhW
zYt_|Ufwtz#?T;}+1O3d_2&_!ZjcZ4J<r7bh8T>|BIYI;c(AE`Zyu@6AX+@ow<$1nw
zmXFW?pVpcYpP4K0ejFv(e0Y;A9H9YzSZhXnX0E`;;V8l8!kcE{2o3PVTQlM_a|Nae
z6Ko#5Sr(4a06(HNBR(@%U|KN2=D?e0;Rp@zBU>}#Gjj!|0TXQgyG0g`&;UQGH6uPV
zS76#N!REeOX5k18@MBst;xlsvruh<V-n&&6j?e%<wlyO@Ggn|*FTv(Kd>+R!LIeD`
z)(EUj%oXm?$HFkRdGB|#c7z7{@vSS=c!{~uT)AR4S6lC$vy|U95zuG1Mr3cscg`bj
z)nmQ*>WpfxJX~7(zF9Ov1O1BDow%LH%q=uM&Att^nfiWNG(rRYs@9D7%-llL)k2%C
z@1Lb3G|+$Enh~FwTj&Eg6xxjafGi!MfqqYGMto*&p%3CvXtVaoSvo=k{l3<W_{`iw
z)7wIuxlhT`5gO<Zv}VL-<`$an7TWCnz$_i1f&O4?Mto*&q3Lg-&EThI=?D$<hgvh@
zGjj`l5)Oqn%W(T+&<272>(&UYOko*5O4L_A#nI9*cge~T8sO)&t}x>z=Eg+{F2NBm
zN;q1A@!ZET*7M(U1%_@7<_b(BCfI!Vhgm*CW5v&J&4|y;6__?mu(=QqlpJF{SiV4D
z=+<Daz%*fk&4YOE;~4AtZ#Q7p<eNteCfFQ!cVYpC#;JH=YXnv%<_b&$CfNLk2TG2y
z9xPuhFm!7$S76#N!R9_aNRIVj`4WMlTZ6d*(|idw@8N-xW2^_umkJEs8q5`#)=RKC
z@7`HHLgO62tTiJ(Ggr7n%@q!@=6atj9if4Kd8<P^7hn0rT|C);hBH1`NzefPO>0C>
zpYfgZ#6Nx3e^GD*b!p^>WcmnQh3?&nQ|{BCM-o=uIuDm<+)Z$d&_I8xH3BOWa|@l_
zI?#5Nz*9BH2o3b7TO+VCF}Kj!tpjb>i6>_52o3Z<x2{m*CFT}7yLF)LO7WxwjL<-T
zzBMC0Gq=#$tpjb>3OulLjL<-Tp)~?46LSll-8#^AwZH>A#|RDd7h5B+GBLN%*{uU@
z*NdlQ?FbF@ms(e-@e*?jo!vUncE!MF0URSV&|hwiz{<qjLT9%Qv|Tf}{V_&ppuf@@
zft885xEPUlERNDV=Ea9*<p>S%hg&n^Gjj#bZXHWrIuVb)93wQqf7=>?m5I3mXSXKU
zeE6`e9H9aJNb3qSUSh7m*{umS7d|}8M`(aQ+L{rcnJaL1Yl6*#kI2Fi8sNWc&4|y;
z6*#*!!RA0b`f`l*2>daDp<9Ew0%x}-*!+h_UyiXJfj=%VbZanI;Oy1}oBJM}<s&ps
z#V1-f!K}%BoZXsW^B$h5ImUXn{-nUrt-)M@vs)8v&U<W@kI-20-?wgpS)*n}>m8MS
z%e?ov1dPx?|3hm=d}eMmS2~Z))$Wp?o<$=xpkHf^$Xav#V??-Ke9a8GTrUqV90jOP
z9beoU=>HNLx;3Ik=xVM&o2g$SG&IoPZQVq(M(Ap;K%1>!Dl|0E-)r4OvqtD@u0Wfy
zUzUIo8t5OiX2fUa7P^`%&}QwIXXywH^bcDz;xls#UCk9}Gxsa9bc6=_$E^<S+(K7#
z1={TWN~J>s{nOS>G;4IOtGNPg27i^%&_MsJbra1Rp{uz9Z5HSD#~7i3{&{NzRwm}g
zwWGfBiH<RYKO-wgXn_Bvb%hx(F;`$(QLDeO(udUXnXLi-y1>w_5jDJw?$f`197jv=
zvjm3j8qAsmS99Ix&Gp#=Lj(M;tr_uoWKDu;!aNn`!RKV*2o3NzS~KD^a|J$#qXe4+
zpPPjvG{E0#&4|y;6_^H0u=($KSvW!i{BNxp@tL^-(|!py_dP!gM`(b*-I@`fnJX~O
zmtgarKCc+-V}{*;S(9%bt(RbP9zI^+7@@J^@3cl>Wn!*ydK8XkW!`&H){f9X|7Yt8
zHC|$FG}rx5Hdkv?ug=mD8qi;~Mr3csch2Lx@e}`ie04@OR~{~%_tq>Lp+rCAjIBFy
zJCB)LXfBz38)#eg+p=hc2Kr2`8S$C9g{G^8w&wcwEFGbNK67hEd}eN;58zN}Gxj^O
zbc6=_EUg*wnYo3gvxPQmzcWimXrRy5nh~FwTWES)XfyY_vUG$7`s}S4@tL`Wrn`kU
zd;eLMj?i7BS)<KIe+z8}|8t?Cfj&oTMtmMwBQzZ@v{{_nAA>ds^xoD8tW04UUOVb5
zpW<j~m_NzN5lZlb|F3n0880z6E=q6-j<otE_%&HRLIeEE){OYfT!CrC1e*_En}s7Z
zP6d7}&4|y;6__?mu(|McSvW!iIJ9QOXXXk_6DHU^`1&jyp}PjNCf__-Fu~@)HwX+3
z@YtFWpGVdtm<CL+`R|QcI6?zFwPwU;<_b*vCD`2erYszx0iIhk;xlsvruh<V-g|Qv
zj?e%f)tV8XnJX}@mtb?=pJw3*4e%LSGvYIIg*((-;T3DHZ^_aTx@$CR_^~keF`KLH
z;=d3S8qjmLMg&)m<rqJSSNP}S9)OPKMTmz>OMf^EM`)lg-I@`fnOo>;u0Wfq|29iU
zXrM3C>d?+DbTwC??S$ZyEshZy=wn(Vure{X(A8XlHe-J@Ye#6Haq>zt;xls#UCk9}
zv-aO*=?D!Z{=(9X_{`iwS91m0%>A(}9if55Us#$EpP5_eYOX+=y+59%BQ%is3rjQN
zGjj`F%@t@f_$RV-ga#6SVQEHuW^SRYxdLq#=k~{-4GLKrft4vN!^<c>?Ls)sV+Q}r
ztQ?^MJXh-qGhSkDT$Hd-9LbeSC%z}kM`(c0-I@`fnJaKLSKJUR!SBt&5gOq0v^uhL
z1+M10a#?zxlA!@UU+X5AHF=J!xgO^q3%@_hM`(c0-<lDhnJaKL*W>(S;SXft2o3NB
zS~KD^a|N#EdYpeO{J|_7p#i>7t0OyC;A*bN`NzV4rDSM;FV?yVW=)>sYOcrm$HE^H
z7#iS<w{C)2li+Hu$N9&?e=RUHz?W#<1hYoAp!L+O%zJ;6fDsz#OSNXiXXZw8<#uCp
zwF~~=XVC}^D9%}FMD}KU=RE!^e&TxZ)fv@XdAM}m7qe)D2J%|1J8?UYnOo>;u0Wfq
zzm!EIG|<;>-HF?I%-lj(a|PO(>zA`=ga-P0tvhi$kC|I&o@l;-K-;<gN*0aKKwrN#
zBR(^?(A8Xlw&wcPEFGbNzCmk7d}eN;tGNPg&Gl<pIzj_|!`6)W%-lj(a|PO(D?az+
z7@>i_QELQNCgv8pnk&%OT)&>RBQ(%AZe5|qOUx~FHCLdmxpMns&<26NX=?;lrmzgJ
z9rcw@akMndKV;<y4e(`KSD5h<bK|0fh2luAT!KH9<s&q}mut<4&&(BgKaLV?KKyhR
zj?e&KzBMC0Ggsi_aFk$k;Xh{K2o3NRTQlM_a|Nae6Ko#*OcsvN0AIB=BR(@%;Db0y
zusQIvSvW!ieD&6h_{>~^X}|=V|NbcpM`(br(V7vTnJX~umtb?>KWE_x4e)QZX2fUa
z3QY4Q*u3|-EF7T${_WO`_{>~^X}tuS^FE)2BQ(Ij)0z>VnJe6(Cs%mIn(G&`bc6=_
znyn7)+-R=c6>P4yC%&OXXh3h)8j-yj-#L#z!%zJ4@zoi0G<yjTmzMs17LCwAKd3b$
zJ~Ow_^t8}s>K|n32o3bZS~KD^a|=yZ3vIUkVU~{2KtG~2BR(^?(Db#?X6zqj=?D$<
zBU>}#Gjj{g_fTki8-JXoBQ(&DYR!nx%q=v%Ewq{YCs{f|1O4dMjQGslLet$so4x-#
zOGjv+AJdu<pP5@|`der-_)oKRga-O?tr_u|xrL^~g*J<G`(w}sfqp`31XiZ744Z3x
z<x?Cj4fD;c9H9ZeMe7PPUSe)slwd#{$(2j+x3YYM2KZL38S$C90@H{IHXr_57LL#W
z-?}v;J~LNf+AzW9!hg@g5gOpzv}VL-<_b&`CfGdq?JOLj0lq_PMto+jz_eh3&4J&^
z!VwzaJGW-UXXXk_118w~_a9j}LIZr4){OYfT!Cr71e^Q*GYdy(fbZFw5uceW@QFA|
zuzBylvT%e3_<pS!@tL^-(|QRu=Y2N|M`(agZq10#%oXlXb6xw&r|)Iy2o3b9tq$$n
zXs&$o*j(+c`?(UK0exa?MD}KU=RBPmKk?7!_dMZ{7a<-lEIpkri>QHqd22>|jvArq
zX`z><o{r2?>aNkO5t^<RdTHzFD50T&er0P$e2yBS>1&~v#-4s9OR0f=RjWfgw^mJO
z3%#`Vbb6&j1O4jOjQAWiS~a(a(90b%ogqu9fqqS^Lp!%tO?L~uwD)vIr9%V#`qqs2
z95q@s{Vnv;;M1A1lp5$av^unNYt?kP&`XQQ_D7f+=r^_|$mghGbFHs@ilc>L#{bDe
zYJi{I>d4NGixLcoS9D^Q;Qv)JG{8@7&4|w<YjVZaT#xsUg@2KSBQ(IzXmw=g3S7<g
zc>kwW|EFYVfS=vE31&^MxSH$n{z=_01%?LrIjx&u)+D%^>+$xKGO3!nTX57Qm<G%@
z&-^zed4dM``K=l8nYmhVHP_?qW8rDcLTZ3t(CWy}6}Xz~@%FLsq;o+H@QYeE!K}$s
zQO)&u`&f9IwF+o}U);J0W{qrdEDmMr<&*1lL;|RReran)e2yCaGgqEtHdnj8oh6GV
zXh7fG8j-c;`fG@Az4+>kYOXw7Sb93Y(9l4CxHTg_M~%?cT!FUc`l~`i1O2zH4(;4p
zbv0L@t+`%6>Ciy`UF#;AHClBwSD>xAUQlRgpg-2SiDr$^)m(wL=6WHap@IH*>n55t
zLRWJI+RS})0w!pnKhc^IpP5_eYOX-r=F^Uupn?9!R)^**%q?^^SD>xAUPS58K!2t+
zBR)^8(Fv*M3bZv>Zhwpkx@$CRc<rdKe2Sx`Va`e{z|a7{r8NR86LSTw=87dR!Dq|L
z2^!$Hx2`bbCFTlT&GiIpuG87GoEqSFv}VNTsL4}N&GiIpuG2XLh6ebZt&Z$mt(Ydv
zH_|+~SIN)-zpFJPK2NO46<2fhuY8)$nT6B<zq{3uohxuPSO3bV>0C;N2KYU#n_$-D
zimSQ$S3XVW78n}f_qJ|=S(D&uuKtxz(|H7j2KWQ5n_$)?xSFef<<oRtfuRBZVCyEB
zH8OQIS2)C)>-mI+2Kqy-n`qXsx$;!7x!OhO*Rynj2K2M75z%JMEaei$_2R2D=xE*y
z@Nj8q{w)|2G|=@C4?n)y7|bnnHCLdmx$@UyOwd5%gPT&mzBZU!=xVM&TXW^F#h9Rh
z{EyZMtW3-;^Z^{|gqX4UYcVEhp#QTq0xJ`93r%MWZOxUx7Gr`28lSS1^7XaB+(I9Z
zL!qs?^4DTa&_I5-H3BOWa|=y(3vJDnzZPSH2Ksxg5m=d+TWIb>p>1FD*J4c2K!3kA
z0xJ`93r&X$ZOxUx7Gr`2`UkBMSecj`*N*ziCpyLqe$lL)paK3|>k2boVy?hD_V?0>
z7t8Vq8sN{jX2fUa3f#Nfe0cFJoS*^zLaQS?SK!{;=E6%T85-a(wr+x1!|U^j$MnuN
z4_;DWXn?=ex(Q}Yf_q<^1AjwcXn?=mx(Q}Yf_qn+|1KpkG{9eJ-2}5H!M&%=eU}y(
z8sM+CX2j=-H3{a9&L&{q`^_wzpaK47Yesx#uE4Zjg3WoC$-)U5;BU2N#AoJ~so7j)
zYV+PPSvo-j{co)q@tL{NT)AR4S6eRw82q-0fG)2Tdn0_<G+h@z^3TUtXVB4HFAtZN
zzD8C}P@*4-2lUd6_{`iw)6+tmseda=Cuks#Xw8Vv%q=usEwtJCx3hGD2KscZ8S$C9
zg{H5CHe>%zmQK(>AJv)>pP5@|I$LP7_BFF~f(H6mS~KD^a|=yx3vK4UR+diCK%c%f
zBR(^?&~&%ZX76if=>!e*8Co;qGjj_~e+z8}zfP7;&_JK1H6uPVx6rhO&}JEKe+=3n
z&}VIpz{(Vs;YF#w@+pp%hPiB3PEdj$^262@X1v7QxG2GZIFc)u;LBzC1P$<yS~KD^
za|N#EdXhi6UOo#aXn=px>d4L&xSH!p{^WWEB|`)J->sWq*5o;^=6aHSEIeINU}%7U
z+PVp5O@gbrp5z}3UrAtSfPdDy31&@#tGS+J|KM)Aa+XsA{6DQ3@i}S|T+Q_)|IqR(
zSvWxh{J*V^>|Cw5n(Imaz;;z7Lj(Ma)=e;La>cY>?qhS_)v|no68up7Seg-^nOnA~
z=DPBgPt(=2lp4sf)uElc=k&)s=wA1_+nw%o?>pU>ul`bFt7ez4pS7vS+~)!Jy8j*i
ze`Jqw?>V_Ou9u6Opm7S$)*2C9_?KfoBVL*HuW24Zy|7Y-)am-I0X@5*&=_m?7r%$d
zk%ZO#MIJ8Ew@$(Y4fKUtGvYII3(d>gQTbc!{^EDDbb<!@=+=z*%-llf{Y9+W?k{eW
zr4w}5Xx8Y2<o!jU?f&AnLPG<6k=Bg(Jh4XTyuS#v-Cx`;ODE{A(X0_V?=J#v_ZPPp
z8XD+dYt4wy)9vw^(0P9mXuH1%+n`fJ1FcVx9tzzW%q?`@Uj*9jFYcIt2^#2&wr-+X
zqgChqMWF2}$L)_XK?8lU)(EUj%*ExCJYMATmzWoCkd+fO!0=vaMto+jz<GZWOI|wh
zhFLg419;9>M|Q5jG-9sUe0U=zLw5~kO`eLpzu=0^g*O%$8sKxcX2j=-H3`o93xdsq
zH_5^Y8sPJ^I<j*G&if03&4D*nGBm*FZQTU3CRd#I7X+LCZYD4^z~^h-1hXc=d4EB$
zx$ouzLj!#N)=e;L5}fxJ1e^D6Aux2;VAdo!?=J{8=iO3ZXn=pUH6uPxtdXf{J#`fG
z-mS89f(H76tr_u|xzSwdJT_N*!v6g%nxFx_WNSoV@a32uh*!8?e1i|UTrUromcDlu
zPS8N(td(ZOXXX}~o)+3neV;6ypn<$>Yesx#ZlURFq0QF!&C&@P=qt2l#AoIfn!Xm=
zjD5c>ouGlfQfo$hW^SSBY@yBC_s`M^x@$CR^fuDlLYuiCAT%`4S82_N&l78ern`kU
zd!L-86Ex6QYt4wy%q{eZI276peoB^3&_LHGNc?nYV=%YS*sFy$i*x&9&<2674@~%B
z$i@iE@Y+#dQWZx_!`vyWCuo3wqjiJ3hq-Z4f&p=)bG`)MIm;(#fG^dW5uceWFpZdC
z^Wj~xaDoQ-(ybZsnYjYfh6y$o{y`Q_&;a9u)6$Ii%v^zK!UUTK|1b+DXaI4+EzO9}
z%oUgxOt3ldu30!i1BkbyG$TGUS6~`2!REiaW#I%3Al{DBjQGr4foZ=4oBQsbg%dP@
z_~S}5;xlsvruh<V-n&N@PS612k1NfH&&(B=)=RKC@19vWK?8_Ct~4V)GgmnM3)9i8
zthwGRODAX`@#mFh#AoJ4bEQGpT+JS*X3+!<*tJ?CvNz*9=jqA#iGM!7nF@!zzVUEr
z>BnTz1P%1fS~KD^a|_KS3vH`@Y?e;YK;OJIBR(^?&~&xXX6wgg=>*+1nl(Bh^tI4t
z?8gfY4fHKqGvf2a8lmZIq0QP)$kGWK=(+*p&DF+WZlURIq0QV+%=!r$==vanA2MtV
z<`$an7TWCnq^zHyfvyiC_#wl_U~Zx5Z=ucLf0XqTG|=@y1V3ch7|bnnHCOCwvpBau
z25k`N`XGWIGHi^n44Z3xNmU#z4fCL^o}dA~cIyUr4|C(9goWZrJ7o!eaF$Qd0AHsy
zBR(@%;A*b>{p#_MES#VLzHX}{J6GUpuKWGT^`T0J?i$RRJjc~s_xqFUX#zt7Tpt5M
zx5mVp1Xpw2?@z7|%kl{t;2XAXf?1Q`YOeU-PF}uw56|)m8sHnXX2fUa3S7+<|GSY(
z@FTKtg6<m3np|-;SN~tHn;t1JG{84*&4|xYli+Hu_@DJyuJ};`Lj!!1R!4Sj*#b9G
zb-l3W`e>y?1AWuhjQBjUh93)aAG5hyFL_E9P0)bi3Q-!7wdVQ?L}+7tF-|pC9xhMC
z3j(lbf(G)gtr_u|xrMIg3bZxX7iQ@M4fNew9oo5tuI37~osbtP9UADnw{D_YqZ3li
z6=-X&FBTda=zFwoqFEz!HCLdmxxPebXrS-ex`}3u(A8XlHgmsJXlS78-cI*=Yxs#Z
zLRWJI+U)(ZES{i&uFp95`NhUyZlSBW0&UIp<yk*L1AU*?jQGslLRWJI+APlPk1;_5
zec#pytW3;}i&A|_70qJ?e`;1v&;Z}Ab%hx(F<0Pfu2}NYiBHS&2^!$rw`Rm=<_cWR
z)xV@_dU_U81AK>8M|Q5j)m;5cs-|Zs85-a_wr+x1!|OA?qXb8}{mg^U%<>5u;QGW4
zx;2<9a5Y!_m)gs7{H!dWpaI553Z)tGnYjX2bH#t9wgf*r3nyp+OC8y{0#|cg`EO;O
zqhx3R@7%fxW=)>sYOeTq=$0#fuE5X$-=%dE%$fvObH%@zu>?O)U}%8xSw(3^e4bdN
zOVP17<jpu7V%~dxmQK(>;?s)KjQGslXs+CDY_7K1UYSJ`G+_5{jmX}N@0_Q1;U}&a
z57=}x*UQ7@sd#f1P0&Es6D*%jHwJSHO-~DL&Gk>Seu4%XPo<?9@tL`WrmKav=K7W_
zouGllQ)y{Nd}eN;d7_23bN$vVouGlNCs;n6ZVcuYx|%D_wORXZSwBGoT~DxlI^7t|
zEi}EYRhzlrp7j$n(Dek%r_+tW+(Ms#L!qs?z9Z`=XrSv^5V|#(TWI=QXfyab6EHyo
zT{n-qnat?nGjj_~hYM{M=k~{-4FZk+R?64cMp%Z|4*a7e#M3-x@K<H&1P$N=Ti2j`
zjk$4A!luBHT)A}OA2Sun&;Xy>8iAFGxdPLO2{s?TIx8n=fbkq%nh~FwD==-CU~}Q0
zWZ?u2U_Ep5d3s|oS74ej!REo&Wc36Ma6NNFw+3?srUesh4t#BvPtaY1S(Ceh228N|
z?{xx01N`vTjQBjUCc(5{g3W!e&%y~B;77D(#AoITO!Fn!y!VDIoS*@IWNSuzX0E`r
zUV_beZ_L688sK_@g>DVz3U}yZVR*&7_of6)&_F-Bbra1RKDlyNu({fv__HjXpaFea
zYee>DeCIrU3_tPDKlCM4dAPLnhq7pb2D%<Ip<9Ewg{G%@eZy}tQ~z}WCTO7RF_Vvw
z8-uxprmKZETmMbgPtZWuW2PQEGkW;U+(OgWLYuKaoMjU<(Dj(9$Igr%J~Ow_d=G`T
zxAAYYY=Q>*<*ga<nYo3gw}m!ye<VvMXrSwXjSpiRgSmyS=8Ct`?ETTKpP+%RJ3Q#t
zU~Zx5Z>`!4{&xwOpn-l>Yesx#ZlSBWV%27GZhs8gAkb(-rF?yDgk^ZOt1qdFqorZ~
zJWD5N0H5Bv2IXtajf)Z%iX*vl34S+Ikqiy+Gg>3CGBH=+YOV+UW8uHZ$_X0aXSS{|
z<0a+_T+Q{Mf1vi4Sw2B`4Q5TA<7%!4{bAxg0z(7*?ADC<Jh3Lh)m#tyh4j5yI6-#}
zW=(>txgPW<*Y^nw4e)bXGvf2angmyKJ?I|`zds8nXn>#Fnh~FwD{wW}gZ||Dfh?S$
z0e*gKMto+jz$f7-_pv$egIPF11N?&4jQGslvIXyJb-l3W`d3*xL3fR24Vx?9JT_Om
zbbee=Xh4@&inZqYHPrCWKlCM4d3fPO)&J_=^f{rSfqr|dGEJgJ=xVO`E!JE=FEljJ
z?`SoqUYJ-TbTwC?t+{?7^CxJa-`OgX33Cfw%@t^Cu3yZ`3A$@EYqaWWu0UIJ{gTko
zK)<UsBR)^85t`eB+YV^kAz#kY2^#3S4TEkC<`%k|E6~<lzmk9n8t6Z7-9)oStFGn>
zv^CeSCSZaF`rWM=@tL`Wro(kY%;Mbs7!x$m=oY1XeQhu|t{wFyRXo*Z@K0pv1Pve_
zY)UiYGjj#5=8ChibmAwoaDo=F)RCPla5Y!|lB((Nl?)9ao|sBA;&asS!jG?}LNwn>
zbKyT^;RFpJo|sBA;xlu#;%ct`B~{a>vXB};JTaAK#OJ8V6<2dz`I4$nXW;}5U_D*&
z$!TLSS1YCg^HiAs{xPd3Xn^s&RGJZ=nJaKL*Of1+`b-v1&;a67!_tiS%v^!1xvqRk
z)n~JCf)=pUk)10rt(T|5ocB*kh6eC0tr_uoVvVjB)m-5a^WHya=>!e*+gcskxzSvC
zj@ex8`t~nMga&kZrP!PCo%8e){KWO*%RctukQX5yE-n3ESu{ZdT@I8ZGkW;U+(K7#
z1=^bHce8AQ2D+>w>l_a4+(I9Rm$YiL_4kwx4Ro1>M%Wk=Yji>m;8195uHVo42^#3K
z3$3s*m|JK%TWD*pKgjwC8t5_%&9E_;TWES)XfyW@vwni^8qFG=5bivoZS(y|XlS6z
zjnJ(zu}0`>uGk^gTz{N^2^#3~BfYjUm|N&-u0Wf`x&1L{gFu%b<<AH%rmzgJ&-Eo$
zakMnd*RyJZ1{jZGr3>DnADJ5$B`g$2Ix$P|zh?df4IrMFN;Bd!a|PayqXe4|zmbI#
zG=O+wD$R(`%oX@J93|LX_{}Vwpam?=h|kOw_yCR)Y##hp7EaIrzP~jiJ~LO~gE&gC
zIq=`IaDoQ7p04=hv@w_~@bNfGu=(%bvwDIC7|%<k8S$C90@Hp8Hurry3nyp*Khl~J
zpP4H#&6i;F-gmNag6<m3nlwl?*Of1+`VWDj0scg5Mtq)Flj}V6u`s-1&GkRCbb<!D
z?n9wlgSpXMc`Ddk?L_={mQK)sey%kldo#Xsp3i`vxZXowQk91bOV3jlQ3GB3S^Ik@
zvW}xhXnLAg<&`g~n&&K_2D)~%c6i}-YSai#R|~zg^?XDYQ3G9jn)`KQM2*n&wa`mr
z&!@|JYM^UZYnQLlqef^tTj-^==OcxN2D<h&_w2@q8lmZJp_k^KkIH&#plfGqr?1hY
zMrgWQ=%u~qUlAG_=-S!Z>8ohg2+d6`^m1R%r_W;QuF<R!x|%CC-?F*J_D3c)&~@|3
z8^eteHN1AzmsG{k!Z6cMvzi*<r59J=QIp_mu2}LC{4;@}0j^JF_=(HLm{^nGYOW{x
z$HG6)>IoX)`gDVzTx<;H3S7<gME_X$f3kXl2Dm=k;O7<_gSi4%bH&$HEl<V&X7vOO
z@K;+i;xlsvuI758e=PiqES#VL{#vUeJ6GUpt|$6ui~px&Xn^Z62)Z>U*5sR4&Gkfo
zuKHz`PtXA4KCLt(J~LNfnlH^_-cubf(gDPMTB$-NaY4@&pM+q7&3QxC&CmeWJst1Y
zHU@Lc)W_mb*NbIyoyV-F2D<L*c*nLeqJ|#}bH!|~w%#*lCBJPVp!HP6Cnk=y=6W<<
z=bwM*ORDnl!pz60Q*fUAafSxEww<<NMh~BvTj*-8_$|vj=J~u?M%^`<HClBwSD>xA
zo=<3KpleTSk7xAod1j5!)m(vI8hbu}mQe#;yIQ;aaA@Zix|%D{)?9y8=}@9i!;hsI
z@p)#AR$a{%Xlt$)$kG`aNbT&?^fo&feTOwdS91m0n(GCHh6Y+Y`!wzJRWxgaroU+x
zpv~YH%HkOsXx)aL7B0@%a%OI!=@+5RGDm0O3=Ony!%l;44d%v0slKF&i#CIwDa&Ul
z!4F+}F~f(=%oVtrE6&E!iD%B585-apv>ry=@dI-OuIB1rQZ=6?E2shfVe1aoVTVz}
z%P78@3W0np&4p*pni(44AGaPx+wlW)wc={7{v}oO*|LHf;GeYaU>$ZCHM!zyuKp!e
z^VtQ42DqM9pj#tq5?syIzocqDN0w6q{L|J=Fl!QA&DFo8YSyKl8sML`Zh~2pV45%A
zJoDZ;vwVgI7`IcU8S$C90@Hd4Hs_ry3ukBm>(-06RU3o3W$J3KaEN*D+*v<E1C1N1
z(v0}b+&yFb>r9i~Y|Zi@m7vq~L`99EyMO%@GJgd!>)*>bg1R*FMKXPc22{^dr|H>h
zwOi-b0<1n~&ch}8GD1TGjZR#e5uaz)9LaT}MdR=&9WK$wWa$hIBsy_vMto*&p?R4Q
z+O89POEG3>Al0=`V@KW?%q=u86hd3K=Jga~h6Y+)`!wj*U~Zv#sSw(_HBT1C3=MR3
zZFc01!Q4Xg9TnQTHBT1C3=MR3ZFTVoE+*y{nwJZqty}YCVa(87qgkUJlHEEsi(N5z
zvM^?7pzDS}HwY12Ow28GcI!afHG?M$V}=I0ZV1@yHwJTYF(R+`ih1$ZvU-LFSf3D_
zrcVsk*vu7p$4*(=<<|v<23VgDoVIess9!R(CRg11#O|6eDljy_y5~Pl&j1D6sWWR5
z+`GhFc(E**p#jzn%xSuz*$J#;<_g?<#5{QMOrN0v#!X3SMto+jz`aAvftSd_85+Q|
zw>q+O1?K+9U2Xomq>`ZlK1XXte4bg8=a}|Ou(|IyvT%k5cyDV)d}gk|*{!*w&3l*1
z!WkOibGACNa|O<BO|Uud(n^Nz8q6A9FK9hoip+bzDKs?D=W5M}&ogV-T<JVESG!B*
z$;X(X0X@2vudg=OYvXmU_s~~9<>AuOR|~+N85-zXxBiZd9zHX-(DXD<1%8W}`s!IW
zLjzs?o4t8sFt^Zjwa{kkYh?Wl4RrNy_4AA#J~Ow_^tI4t?BB|=8M<pUYjm#ZY@yBC
zzb!O0(AB^BzHf|~HA2(dLYujNC+lZupz*$xX2fUa7P^`%-bS<cHM4Yv1`_W}X-0fz
zZlSBW0&NDrR+i4tLY6wTa|>O~6=<_Kw?D=V4J6+3Qog=6m>buQ`pPG6Ycn|i9*h|p
zz`Ehp4R8b(6LSTw=87dRoyfliV}=G89l4aRuMOr3T+MZ#ea<{zHcP1iL`N>oh|f{O
z3;#Yn3dhlM#h1&%85%%z<Wfg=u2x*lb)S9CJYQbP&;X(%muAH0sL2&qbKU2UK3B-X
z85%%z<Wfg=u2x*lb)S9CJYP}C&;VBVhHj0h$rV>~-DjUO&sWNFYJky^OE<x+Nia8F
zUOmivSI+VoTENnb_{>~^x$zQg&bvw$&d>nXZ2?>U#$axlx|%B-V&1!I*3ZyDU#fM3
zyob5bTxk$CS8G$($<i4bP;8&lh~Rc+Ip*8r75@2$zVay#mj<~-7S7N>R+D7|-5AU*
zbTwD}7F+c#vwnu|8qFH5x|%D{)?9BTG&IoFzuB8N#>^U_tGNPg&Gpt<KSKju{hPgc
zV=%YS)m(wL=K8x?KSKkJo?My{pP5_eYOX+AbG=QL&d@@ZI<#{OUCk9}Yp%CdIy8`V
zYrwX@F=p22T+`pYB>>tCe!Hxnp@FVj1GfE*!Q4XA;X<3mZ=dzFL7?l_fNg(cgk^Y9
zs;_*CqorZ4o7FQkz<5_mH@JJ48y6*<103nZEWy{y@);Vyx|8O6voV+}a5Y!|%BT7I
zSxwzFm^FDSXv18wx$p)8Ljzph8@e@S)+D%^tAFLwe8ViK?i$RR1XpwQuY8(sBrr6<
zbz1=48c~zrYOem3PxFnloEqS|Er4!~s7Y`&SO3bV`6gLT4RGBSK(|KJB$(#QH_yCx
z(=4B%0j}Eu=+<Da&M~c*U~}HhvV4XH_{yyr@tL`0i)ya$iZ$1pXXy+LG<tGrMto*&
zG*|9pHdoulcgUg{8nC+4hsM||-68V>@B{yRe02sL&5IBZmzKUq*38gAS0`kb+ZfC(
zbTwC?t-0Pa>t|@7s}r)zZ4BlXnrB0+wi9x%te>HQu6D&%v@w`lX!=@cYp(as`WYJN
zYFE&$!Q4V0#G%mET<?>B85-znS8PQagSmyKw}rOmdf%*{p@FV;rS_H4!)N9en(h|b
zn(O_tY=#E<_N^K5nYo3o=87F+2ETun&d@;LvDKlSTj*-8K%2$6{V`~RU87mUi&A~%
zQyeV~gEex@wbptx=40>1V6MQlqFlKI|6W$l&{%QZN$bu!qleGT6_`d$u=()!vuK6}
z7_GiEBR(@%VA?Rj=E6H=;S3ERT779od}gk|G+~0xgLlrt8Ct;7jQGr4foZ`6n*;BX
zg)=mOH)+j?&&(B=228N|?+>zYh6ebitr_u|xdPLE2{!lrVHVEN09VUmJK7k`6}XzK
zf92DB*Q}=Q8qAtBNHtgg%BT5m0z(5_oseB_V?<4!0R8L7(X6bw-aYGQXrOn~tXRX3
zg}L3>Ty3+REGRUf<v;mx^<&{DqK50`_dMZ{mrfooE&WKLp@FV;rS_H4!{?bbLetYi
zo2eg_WivF;)vnaOGJ5#T+(OgULYu80on<pL(ABQkiZ%vw3(XTPw4Lk6Wc>^cbhRtC
zqK(1aLetqoo3$UC^)ock)vnlzHU@JGeLN0@Hgi8N>t|@7@86mcpP5_eYOdHJX79&m
z=?o2YZ9;8I2V*m{MmwaME6~<lpCB}J*J#!VUCk9}Yp&e>7&A1`r?f_3WnykzJL)T+
z=om9NKpb-c(T3s|K(_{S1+M0bB`=-$z$~Ak0Yn=r&4|y;6}Xx!zF>I?J~azxXaLcM
zN;Bd!a|N#Eif_1Ef*+KHGc<r`L!}w<nYjYfg!x9A2Ope;Gc<tc7Nr^SnYjX2bH$g6
zELZ%HES#YMylbl?J6B*DFjs8;d#IA30j|!XPLt8Y=b1HZRrpWHaFk$k-)UJiLjzoW
zMSUithtJFvnC45cdGBFaG(!ViPgi_$+8E3gnAS_MIq%_FJwta5My_y&nkyV)-g^Yn
zFlK0=>#>cGWE+FI(OkJJ*j#N-JSi(@Xh6$<^cKh7l%4bZQvAd}AOEzZnkx^N+wHko
zG(!VjO;$~JC$f&2Tj*-8K%1$bmjyF4(A8wsbPKmrnOo>;u0WfupPxlDG|<&#*+4f2
za|>O~6=*Z|3$lKO2D&;SyWGZLZlSBW0&Q>O3$uQP2D&;SyWGZLZlSBW0&V7gQP$7U
zU87l}9YS}rZv$=iezDNdKv$Dh)6MAN^UNBdPsE|nX7HC}*$fSIbwYNzjltYP)8Rs!
z#ku`4XoFp&S;MOx{yhyG<@(Lwe}oXm3=Qz9tr1w6m@9BKSDfgj6Q7)wGj!Kr*5rz-
zx#FYjCHN@<Lj#QdR+<r?XVxURnk$|qmf)vm;S3ER`dev6d}gk|)m+hCmf)vl;S3F6
z^+M>@V6MQ`TvslnPtWoh8esId(v0}bT!E{(`d2>9&&Wb*0MXw{Gvag9<T<AOa=V%P
zo|%O+w1B0K>|Cvw=1Z`7?^#NQ2Jm668S!~$O|F>MORzcb*;zP41N?~AjQGr4;SM!d
zIK;g7oGhK8f!<BCVhx{M`R1{?+NJYl2w==F6SSJFn(k_IeLD*H=i{q0=xAPqc(~lh
zZ$J!VhQ@m9!q1EP#$axttGNPgrha4A&(K|?S))}~a|POL{U)KIfvyWbFX|g(W{uDX
zaHtbv#(s0w&(J{E)tOh`jltYP)7e5>bN$n-pP{=(vqr1t_7K{3$XkSl2Kr^K8S!~$
zjnLIxajwnYZ_Uyf8t9j|I<#{OUCk9}Gx*z-4h{4xTQ||H(W<Mt0&N!O_Q#l^fqqqM
z1Xd>I#<ioq@`;WygX7QVnCmp4amFuzZVl!NOe<>j7gqX^I=`YdfM}eh$~1`@UhVKj
zPY5R1e2BBkG1u8e;|wr#YcN+UrVSHpF2p(InCsl4aRwN=HJB?fO_*Tw;2&rC3=QDZ
zTQlM_a|Naa6KoEAbr#Oh06(iWBR(@%U>Y#N=D$D5!WkN1T+&N3;xlsvuIB1r`82;K
z3#kEoZmT0ZSKw-{{*_PjYn2QQ@bg+X!K}&cR?YQz|F?x-ConX?&u`rXvnJ2%q2>xx
zoA+KXG&Iol0K|uzjWM%^&6Vev&DE}N@5ss-8qnHw+Jvjk^&_a^dhyj6bTqHZJX~7(
z142UsjVo?xMtq)GBXl)apv}}D%+eVe$hta1w+3?yO;>BxX6wI7zzhv^U7dO5-5AU*
zG<_|!8T&(7KSKkJD{g5<d}eN;tGVKY{J+M|1KOIbDBCm4>Fxs}@dG3?B*|gsn?%kz
zNd}cHDh33}Dog+oBRPo*<{bDXDIz8?faEA5K@6zmD5C!xs&3ue)xB2lwcKytQ&rE|
z)2H8Er_T&+v-V%PbO#kOKhF4gI~bP*YvNpIa|ODY`%Qs{Zbq{v(AivpZWrI10}U1W
zHKmU9dB>VSXLAL*HP^p(=?*INYfC${auc1+73kJndHG}PphCZ{RDp$wx!ODOkxz6?
zGx)1rxq}Lfy*Jg7J~KDK*<7*Yxf5|-Id*w|vG)oLT^q~|a5mR7`kgDzD#tF*Ztm02
zwZYr~XLCKH-?`$Pa_sWl{zj}Ax;B^_;B2mE^gGu-a`_IbQ?Lch8gBe&=zk>Xi?2EG
zj{^)9I2%AT1V@j~JJuLX0~*}?_j(uYpaSRiAML==qcd{@d<KpTZtnXN7ww<|=S>iA
za8?F$1AHcq3~t_ggR6H?f%86v_aG~SxdA>4M+P_N{i&;W(9K}h7<bTI;gIINHwGFi
zbl#=JU5lef=N)p@TzM+kT-%BGTNmu0g62gR7vW-a{V-~{-h)Rz`EYLO_XZj&^xH}u
z>GO^?fzIZ-^vI|8xpW5=`W>YmTDghN<_dIcuJ4a@sL<~$T}87dR-Mfi=+<065NPOT
zG;0E#%@yco?GFYTD)hTb9qIFqHG!tL`IP|ZX6}D*=?*INdrBSYGjkJ7cL%!J`$I0>
zL50pMg;&AKU~Zy$Q3twR*Z=7H9aQMNQsT;S^ytjoMAPAcZWia|kFkRaomUF4f|bEs
z?H&2ZC!XqN@V|5Q4k|GA-c(2W%-jHHbH!&kcj8-IxPuCay*Jg7J~KDK*<AZ0pLTC`
zAyq)^y{V4$SvBk^c+eA~z5tsG|K5c=sDN)M?a0cF6=!qpk9^u;6XKu>ocna_+X~Jm
z)p*6UpjX@+_;y$ApaSQY^Z2qpW9m=l#)@e`gPZ@bw{h%pkIV1R@qOCSqcd{@O#2z!
z+=rcwW0yNzwt#2}jvk$v8(^Bx;O0GSJ{-H;gz|ch>)X+zGjjt>>lxgf_ih*MpgPBS
z*~Mk(=+T+Efjelfa7gnWb~TP&?rwSE#f9kT(V4kwu3RyjYg_L>xqwfb(0Z|%rz&#H
z@x$}(^Z1MZ_;_>%9nDRMhjUB+hl_SlA^)Y+kv=mw(e!kn+nwuwx^xE>`d>>O=`(W^
zeJTzE-E93|F5N+e{`XQx`pn!!AID*!TXX%COLtJAKUwNXpP8FzIy=zK+Mjmm4k~n>
z^Y{!LJvuWt(b-(_F*b95#$`LG(0R_|GdK#Z+(c({1-jY$vyl!JI?s8028(Fc#Ko7*
z73gO0&jlK~8O@qNXLAL*S%#NC25lg8ew^{~Dma^D8Sc;d$R{1m4f7FK?VtkZH>LRI
z<ml0vx!RPlP#neT=iraJXa^NIzbElK(8^$LfN4a7n-4$c>K$}5m^D5Xw4uSxg&z+v
zRN(xM#P2^VW5*hUX+ndW2mjgCJLqOGYYe6Z4Q>wnM1Y|J=edq^@95Ea#~OpPxh_2N
z3EL*eF1OD-*KzJ0JvuWtz}Z|E9{Ge#lVg{gXP)ag_l_Q&nH%72u4nZdwtsWc4ysd;
z=Q_^)QDo%?IGgKPy;)%|=Gf()oaZ{uy`x8G=Eg^M&|Kk_)?Bd{bL?_Y&a)k7-_fHp
zbMeS0esm}Gf8Y8AC-0y-3Ar=JPJO}!96vk{uf$(F{tF}Mu=FpEzUcHFRM6a$V~<|C
z6&}uynu)ON);>JhsC+=<aH9XF3jKejk=aBwf#xQ$_q)t@iQ#;%q!RtKcnj*<P)(rS
zt+nd;J~5nR09ELGi+IZ=ylMjNZY}hDrx<pDh6<f;5pTJOW=){ot%aWN6~ho{sL=Tq
z@s^8d)&$z!TIhMV9>zdJg+8Q9SiYv3K)YKDJ@3}TWB^s@eW@dTR!yMYt%aU<>j5YZ
zs?ZlIRbXLKO`zSag`Rh7UH(MF20~x7bb+duR5R*grW5@pZO8bM%Xd(MpPFA{_yuKU
zFc-U=7K)=-{mGFXcG!K{e^Uj{?-|gwp&EnTt@##nAMU>5a;m_&^7toNf~&@0cWZ*@
zF5G=Jz|hTL))?$=P4L`<yZ;U_RNy=%af%#0I;+NDcWZ*@4%~e$z)*qnl*B1IimcpN
z@#%QQAKu)5yZ?z~sK9wj;uJZ0bXJX5d<G&0&)v8Cx{Ig+=NrTu9z|AetoTg4V({F1
zyZ?=3sKEIK@rI5bomJx%pM{9QbLZ{QK{%)a=NrTuDma@|V_bA=etNB2$NqT&Rp@++
zc*_}8f2xMfmEV)uT<7<zLv&;+p-;P5sR+k3ADM<L;7_g>kIo>M9gv4JOAnWH6;)`I
zr8?4Q)dV`5E6{UO50`Q&Rmdxrc4+11s<XKQJ-7AnO_2`WjAl)&I-4udb7K#e4m4Eg
zE0sFZXVnBcn=8<BYY&%kDOG5E7O5Rtxw&e3J3hv_xrfU}I#kFjmpamC)x@gl?m*A&
zJzUPE)Xiwt1e*R1^xWXX<pT{B`YNT4^jS55ro#h0x415UgsDPbwX{S1ifXub<RhPS
zG&jsQL^4$1i<ho~Sz|D*7^|OyFX-|CDlkl)>PVlN8{llN{gF?@H@c82;3Y~svT_5Q
z%@q%Sny(n&g*b-%PLz8{>?w{OotYcpY_9#0Ps4>>MAeG7fLY^noXxdA@@cq8fT05C
z))ZTnqeo}e7)%5D!)yM#sEY=uz_~GT(^(nJjTO^=1~>O%tLGSU%g=2owkb!C&dd!k
z&1Z1)9<E!CA+O&pVAl9l(0T?p=S4Fb^7_p!DYhuS>3lFZa0ks58|eIt?SLzngQ~Nf
z`$p^|3eG0gu({G8Y_6?Mp)GL?*`BTzaHvN7^Tc10Ax(itXVB5ygm^eN$hBQGK(*fE
zrH=HOxjGf#amj&htG<p)2dL1v=u;i(GjkKoe}F(YTVL0u160TxmpamC<|Z2dkcn>1
z^?EKHphDlQ)R8_jH_>!<thzPV>$`M-3VriZNBYd%MAO@WZsz8#7RCS-`WB^peQ7W^
z(b-(_i8g!l>cJSGLf^7ffrW{=iO%K<bTc@w9*hAh^sP!2SeTfbXgWMjNV7Pv9t_$*
z=v$X6urSFo+&l7-Pdb_#=1Q&{paNgL)R8_jSDO;f0gkvS;b;zyzXzzm-&~5K#lhSF
z*J)`!#1}1&A-`~K0kg)ZqV|#ILVOqE81g&OHDkrlwZYr~(}X@1&4c(R#4+SIqTE4Z
zM{)G%%-jIef(ADS#)diM2Acav>?cQ&{)@Q*&gR-5`841v;GpWm%iSY(69s3JYJ85f
zx%Njs4fwD)r~>ES5qpV(vq?1uXLCKJ{mwjG!&Ov)(}TQ_R)%T}&gObb`<;1+PoFAq
zIxrl$#8yq%g1b_fx;58pxp;tXMze;^m2c1H+OA?=hm2+Co9`6I96vk{cfem<FQ4;-
zL#~&Hb4%aCMFUjpy?d!6eP(W=`B4PAnfjJ49iT#gOQ|D$W^ST+HUiyF2zFtP0V?!8
zOBGm{n44&x&p<b0<J@u#d5*WBSrg|vn=8(Bv-WL7K4E}r)%PlOq|eMvbT(I@TXVgw
zO9!aX_b%<w%1v}OSD;&Sy<Mb3g}zVeDw;KMLbAC6-J0v|0}b7bW=){8xdPpqD=&Wx
z+Cb?0mnyI@$uitK@{vzEnj3~6Fvb8CI6utza21?Q%+>ykh2khyKL_*U#TcLh=lPEF
zui$KAZh&b-gPRZe;bIKX&0yB}RM3V7Hy84w#TcLh=f@ZytAewMxdEmL4Q?Lf2a7R4
z1<nsKK2!x~6LSO1vu$v5;Eh~0Kn1>IsUv-6Zh(2V4Q~F!w|kBuzvbU4z|gh9+yL`z
z8{FJ?6PFKAt@zHRj`W$i0p{5@xOwlUE*zkn!L0FB!Lw~}a~|$SIEK6{xof-ubZsy<
za0hp;@Jeg0xEtXZ@~-4=frhRP=Bl~!a$|FC7aOhtjv=pw2Lu$VaV+$Z4Bw7F_>YfA
zXJm8b;oQ>qam@hLIeuj6A=;5c<|aCuE6~l<_jT0(-Hc{UtU8-3(9PEO3p7;d?<{qs
z&jV`$%@fV$3UoWy_jl<475ckM9qBW36HR9ax>-9ut|33Z?+!F{Z7?^{^md?|xgTi2
z0M)7=Rq9BenVV?3JJ8ME-|Er<D)jf1I?`w6CYt^ZbTjz3xpaUE{k^4*^qIMdJ`0C|
zZWia|k3ky<{e7hhEKITt_l|tzlaA(wiS2U8?K97Kd;$yH6PT+_3D+Br;v$@bv2Ah;
zxqasOj`Q#6(V4jc&gR-5`83?cMO2-NJlk>hk0L8Kz}Z~;BcF!YE~%TrtnoR{=6byE
zcd=Oxxq0S?7$555idkbYE$DOH9Ee*7jv;R$9uzBwt_|h}m<BYs`R^VsAD}uF4=#12
z&&&-l?PqXvAMQvv2IyumYkVqbK7*V0aMQpsKm~qisR9cVa|2B48Qh$QTLz8+x*5zG
z;|`iDywaNMy$J>yD)e`hDzGpySIw1I1)FQTCgQUn@>=-*fI>Bng&vaOvG{}Q#iKLm
zXl_D0oLd^ZFvkGZdVi=?frW{=i9Q8~fo{zeyD-N975axu6<C;<n`pW^(5<;*7v>mp
zH~x`8L)Qj#6MY<qfo{zeyD-N9)vC9kSrg|vn=8(B`xxWn8uH_NTD%2xZ7?^{*<68c
z=6<vR15~R%r*sv~npkx<SD>4{e<09Mq0cQ{MYAT**<68c27gSTp_|dH33N7Bpqs^c
z`D4%qLZ4Tvz``WUa8t@hKIv#~7;KvyLvEjW#^V!k^yti7ZAw@uj$-w5@IzcQK(*pL
z-*NsOJvuWtz%-)4&4&+l(Et@V&o<BG%3yAQX+wjX3m@j{0lFE?8lPjD(BS65hX)uc
z@Z(Dz>GQxEgR{BzM?MXYa3NLTCzN(%<pwyLE1m)}|M0NQa}2rNKQX}2wZYr~XLH5>
z>~{{v%?`(qH$7XxtnsPH=8FH3)*Ouc5so46OP(AnhOQ0f1~{85{tNv%7<VHaL*A7<
zCBV?N!Q8aP4R9EHb8D_~7c%5s$rdzg__HuSJT}+%(fuF-j6roxJiSzbrRMrfM0oAu
zzsjJaxn3U5Pep9(161f|mkPZwF*niKT!C(;KHIeeROsiHI?`w6COVrd(9PE8xO9LD
z{k&2~`pn!!XLAL*85_NWV}J_%f>H$*CgvtOn=8<*xnhIo7@$JGuvCGCiMfg9<q;oa
zyFze9a1426yeQDnwZYs()7^n?_I`!|15~Ttf@V!zeA!%aLYl#UG|*6?UtH=)p9j_i
zI-4ud&EmZLF$Sp6FD+GIVPdZK4*aKzIP#k`gFnud161HVEpeJ0JvuWtz}Z}}<dY-m
zMC*VK!a>~(W(~Jd{7YOMdBx3#Pe2G`fC`*vJI=m>vx&I@rVR~lE_|Y^2B^S!uH)Q0
zdUR%PfN4U5n+Kodq5&%KkCi&oXXXZ&7BsjyFgnKo75G`D9qCt?8(<pH;O4*R97AsR
zKOSJ{+F)*g&%lwv&3(Ap;TZC!=O+RTT^q~|@R>L=xOoq^IvhjZ^88eQp=*P=0jBi~
zZqADvoFVT@wt!h<+`*kI9MZh^RIhA+>f`(AQb+pCTs2poV>Z`zhH-Im40)0LY(SwJ
z$3hRu@G|_t_2SVP*<5)zxAgN}GeEW8Un@OCJ95a}L}zmax|#X~t{R|1|3>K%-l0F3
zo9Jw=KsQ^z&@}^8=-(_oL_2cG+(aM8A$tkX&Dbw;)c_Uxw@Mx9GjkJ7X9v1j`^7FD
zphEv%sUv-6ZldY!KsR&0#H9mN=vS6H(r4x-npa+++r@{r#4$jHepRUg3lnn_O@9Zv
z89c7vA+P5xXx7AaO@{}%S)7+Y25q2Kzq(X`g-MoStI9_{>1b{k?8h8K?#uZG@rI5b
zotdjm3D+BrV)b)y?88Iu%Re70hOQ0f1~{8*f8^5;`!H3fVhflxJ{8$q`y-!*pY*z@
z0{=p(BYjql!8D;yMe|^6@I&s)uLv-7Z7?@hObZ&^9EjbRW5`|k7Xu7k8_W$b4QO!l
z-_N*wfa+BIQmG?-W^RCKKZBe5aI?cP<W0{n2N=3Gm>Xc4&*0|0=eT@;YQ?`&>PVlN
z8(><`;O4yNx^RGQ2D8SvgXRjawC0L?D2@Rt^skmGurM)K&6THu&9$9~pL5j!74$Ww
ziX3zN@I3qh{^EM^=!_fUked(>=axpt;~1bqzok@xg^9U|rl$klnkzaU#{d=jZKVn<
zOw3I*T^;DwT+#732IyuqYvP1tbHxd1#{O-BfrbkGj#32{CgvtOn=8=G+P~x40V?!6
zOBbkmiMff+<_dH(_wO1oK!tvHsUv-6Zlbff0^RKWdoCTIo6)R^bDhl<=yqNIexRX3
zzo*oZJ`b!3bT(I@o5gwgW6%adzqeF@g-Mp-#-ERT($U;7(d&k6QLha!bZszKn-Ug^
zqgeeMjMl_4WQ%%TfT3%HxdEmT4Q@VsxyuKrPQ@RUI@0Ii<#^4ff;Kd`xiEU&02TO;
zOHs5qm>b}1uKkfuL-abTz;7sBq~b-@c*WUV&+Pwx4Ly%z$lmv-0fw#(=EjP%xt`g7
zTZ~>eWbga407KUXa|4{s^~`=>g`USTWbb=(fT3%HxdEp6{NXk4p)qj`*`WR=z|gh9
z+yG~DJ+uETjN3DgA#c<EHo(xe!Q8aP4R9FServA3ZomN5b@6wlj`W$iYOY){n`_%C
zUg;t}Z9>rZl`68-T;GHU&nq6CK}U1FJUm$isJ9NdZaJtz|7)oN3zKRBO-~29nL4i6
zA+O+n3p8|XFgI77%@wO|wtk}l15~U2_fkjt%-lq0a|OCJ*RaC?75bB<9qLz@o9Jw=
zK)2@l=aCK-`aen?>GQyvIM>-+fo{$9FI+l6h5pad4z1ioXLAL*HP^q4bg0n(Rl161
zO{_YbE6~m0e-&t`(4Q(@MYAT*^h;cP%`&|FF$Sp6pDtBkVPdZKj(p@39n%c{|6Dmh
z1%7|&0#h$BH^A9kaW+nl^b@VaAC?OIfdE6-hHBVR&N}#67)NvPs{#z&3}%hNw4u*;
zbK$E43>El;rH=G@V2#1qT+izNLDOqoI6wvdhtiI$+yK*pUU73^d;=Pw0)MD<70ep1
zm<BYs`R{cuAD{yNW2qy3W^RCKKZBe5@J)zg$Ztd+2{3eRFgL(w;>h6UJ$w`581fs@
z#{&#q8_W&xSvWGdIq&r@AD}uFpD1;t&&&<n!JR7{(!BR4E*+pk|4V6yRxTd-#4~(S
z|LXGQNP-IZnNmeA;P~Nrd<Op7#jjffb?&#ncKQGn^s}XkEOl#Kh&Ta&Ww-X>9R2P<
zLy10nDs`mK18V~9ZY^}%CEnxG0V?!`N;|Z26U}X6?|*={PrNtMp+aA{)R8_9tcg`0
z$6=sbw|<{X2dK~&DRrdJ%uO`6ia@u$;{7fiph91?)R8_jH__ZI0^N3t54d!I3Vq2^
zNBYd%MDt<}blWem2XhQip)Xykz{14bM03LkblWko3v&!mp)Xgez{14bM4yGjK({@E
zmp{e;75WOL3M@>_#b(5dncv5Ktu!yjt-_GE4xcmlY0$O7+yJ{<%P(^$#;w8t<%*y7
z#nM$UYrJ9_(JO8~#0>+-kT(unz^pOY-I^<IE_{o)Ck#-n_)DdZ^qIK<rU|{`=E1kR
zaDWQ@-=&W9nYjU`1r2Tv{CgJ;P=UW*>PVlN8(<pH;O4)#xp06IeD;Z@j`W$i0jB*7
zZti=#3kRsc=PPxj&&&-l&1Z1)-aA}4Km|Uj)R8_jH^8)>!OeN^bm0IMcqnzG&&&;6
zbZa@JdGB2=9iT#wr5#$iYOZu1n``@)j4xIk15{A>GL^3{K2Pzpc%A?FcytE2+=O^I
zw=`}dIR>bZ@KP#YUmDC!G(8>YX6jG6cz_Cti$2wnJ~KDbbakMct#K2{F+hdHMU=|d
zmj-haoy`>|q!}AGksJe5NL)s#e0^y!H_>!<th!knH<26zG?A$aEKJNzbT(J4x|#b^
zt{tF4-l%kes+X9X=xnY)H+z5DfB`D>jY}QrGjkK2%@yco@Xxq(fC_z+(hjZML}zma
zx>=l;KgIwR`lh7{EKJPR-jR=dqGOuDKkUi@D)5y{7npj9xdEmX!<BO<{*%iGsK8e#
zb)?VC4KR&paP#3uTsS~CgIUAoiU&R6$l&I}k0OLIKn1>fsR9cVa|4{sb>WduA9LjZ
z75EyZ3rxMl+yG~DU3lbE+~*BYfv;7%3TBN@MK;$P_TQQR+2sRN;A@wzf>~p5HrE^W
zn>E}>atv`pdG>Vz3|$+{4RAKs8}@&9iQ7nyA#NwnzJ7qAYlFD~&gOc<{<|%HOywA$
zIu$o4RbXLaZrTFrxq&wC#gC{1RA^lEsi;~U%vE!xLD*cIJwE5U0V>$dN)<Wg_~CgR
z@fS^jhs)5>-0*ogxAgzIXn+cR*HTCN%-lqC$$@UG{y&!v(9LMp#HzEoV%2k7^Pi1_
zD)ik-`TEjOO`x;60zGf8<B2Y&3VpBAB`jZ4O`x;60zGf8<M|Ar3VrWVNBXRqKxcCW
zdfr^elL8GD`aY!{TDf_yv$+C2Z?5Am(xF1%w{#WFnpkx<SD@$3b;Ori4(et!YXY6k
z73g_$)#Xn#K6at+SBjSxhibUn<s+YTG&juWT{}PpzIo{)6)!SZn-Ug^qgeeM`~{Z}
zP=Rkz>PVlN8(<pI;O4_Gx^RFBe5+DN`pnz_pNb=c=Pn$+<U*>zw<&d`&#Lh`K8~ot
za}N$*b|F>Z+m&`?<;IFn!z%{Q9XNa?lA)WytnrFzK!fN08@?J~sKB=`b)?U#F_`u<
zc<#OdH|-o$f$vbNz`~>&gK0j4=iVE>=1Qu-cPd?A>Lt|}oXvINkx%~<V5q=%E?ot)
z#_K$|bA?x0bHxu090OG7yOb)hFfmunmDe$w>-;JnCs$Dgy??19#~eRAkC(+?TrVD-
zk<FEdGfR&bcM(<SN0uJO9X?h~ptHFGJva3jtD*}1U8RR{hmTbgXr2xBZJ^r;xrB>G
zsL+opJ&Zei%-lR7^mU-;#vU)}BC62eQ|d^cRTHbGvjaW1_IN3mQa7Vn6KHxn&~tN-
z-xO%5(BE6?NS{>`Xu3Plb9;}Mb}3cpN0)YJ<>spC??BHDK3*o$p_|dHiB;3#fo{!}
zmp=w=AoOEO6<C;L8SWkV$R{1m4YPOU2o-ql#U(In49@0?i+T<|e}JI^KcIAhsh399
z7@W=Z)b`bUynxH80za_Skv^-&VA{~<ySeZiTsT4n{<hMNtlU^JO=xiQ-~}TYD)6_L
zI@0HnHC{0-XmE4jH@a|y3jCl_NBYd%0B3VOwcWXn7jhw0;0Kp>WaS2!_VbFH`z{>G
zP=Oy(>PVkQ*7#J=d<Hk~UBrbWRN#k|I?`w62AI|}xH<2lE*zl(Kcdu;J~KCP2h9}@
znK#$*VlJf${T-zpTDfYjyxiDa+r@UdNQ4Ud*iuE%zUE`(?KS`L@#qXXnwt<0=a#;P
z3rDEX&n$JM&&*9UJss%QT(9ZU5i0bLl{(UA<|aCuD^}fXeJz)cP@$hy+M$)3=xnY)
zw{v~%NQVmjlclR@*2KBa<_dJP_H_ac75b-2SJA8qbT(I@TXVf`prJzlbm=OZHG$6N
z3Ussg^#TnQ`e#a4(X0t{HdmmV!LJ`^sL;<YT}87d(AivpZWia|k3ky<{hU$-7A9GS
zn^HdVNk?<TT;7!<RN%*zE->{HbG0d9p*V`w&%sx4`3M#GiKUM8nYjU`5e;rWyrK(7
zsK8Gtb)?VC4RAKs{>Z2CN-m@d{6nRV^jS4N$26f=+&mbkW`qj-!=)YRSC|_s&gOc&
z{pZKyl_MD{@Q;)_(r49p#o1hs_vU()07C_SYH3GSZmc+)>+$xp@Oafoh6;Rc=_;5t
zUU4?p<LzhR@oE8v3VdGaDws6}XLCK?eik0D9$=`zPcK~svnFgo<3>km&GnlN7@<Nx
zqtuZ;Ggr-(R|T7E+m&faj1em6b4wLiYOc3MgzLp)W?0Vk@^EhHn+kBk2o?HGrH=HO
zxrxr^3Uo8|&0IP{h5nn;4z1ioXLAL*HP@R*I#lSlmad{%6DK5_E6~l@w=iIY3jOv{
zNBYd%L}zmax_ykdbm<5c`kkeY^qIMd&gKeqYp%C)=?E42-K8B`xrxr^3Uq6(w~lnE
z(C;l>MYAT(bv9R^TXVflprJy)uXGj7nm}iB1-dm?Uj7&(ROt7YDzGpyS9?c3@`;XV
z2Im#eJgC6WFI8Y+Vs3!5xnjw4C-Qn{9#r5LmMX9?F*m?`3!j$eLtgC|BUIoQl`60>
zF*m?`3xk^rd97oNP=Q}us=&g;+yL_}3~nCem5wn&1%64X0t*v!1I)KDxH*v5ImQST
z_@$)^EKJM|FyF%9=09HL7$a2Rmz658Fflj4d<%n{`*@9Gj8K7pu2g}AiMavhTNvED
zcOzGhP=SBG)R8_jH^6)ggPZei?7|T$@asz*=`(W!cW~zlhcxfq#HAxt=)WxO(8^VF
z<%h@S+CIA5MIuzt50)x&%<;qX_(1%{e|$VTBbzG^=a#;wi$*BX=Kz)JNS~RTXnLA`
z8|Y^0d%1Lk3VDfANBYd%MAOxQZnnO+OGl{Cmn?Op&&*BqaU2G^8T&pi9ic*By3~<A
zGdIzv;V{t6+V^$o2o?G=rH=HOxrsg<hk<Ta$o*V8LWRC;sUv-6ZldY#KsS5e-=!mT
zGnzGV@zLLbZU%oqprJxvzSNOEkE{vwSvU-Ivp6q*4B9|w+=`|0^`#-p@QZmq@<~T?
z!`$AbBb30iKUBH|<!j8<rUaMZC{{lQ-+`&fg9`l7QUw+!<_4HXG`RWjj;<V`0)MR3
zkv=mwz_g*k&4qVz;RqG@<E4)DnYjU`2@P%@yt4~OD8c8PSn5chnHykQ(BS64ySQ+K
z3Vc$jBYkFWfN4O3oB!_W!VxO)`AZ$?Gjjt>`x)HacQ+S~P=PO4>PVlN8(^Bx;O4!%
zyKsaGe4$cD`pnz_(|QIs=iS4FBUIpvmO9dB<_7Mdxxy>0xqgdFN2t&jEA7zARdeMz
zW^-+4_*)|pD(IC;6*=bk;dy*C{^CDA{)<04nwt<0=a&9X7mZM%an@2D=`(W^oy`^K
zX6o;9=?E3_Mx`BExrxr^3UssecSkx@XngZYb)?TDYvP1ta|OB?`%x|(p+d&Dq;uk1
zQwQUEV@;s5xdPp+{XKz(Zbq{v(AivpZsz{pKtqL&A0p1-j|?kgWKE#6xdPoTzVCDW
z2o*Yhh&U&Hm{_7SH__Q#fo=x>{y;;8jvpe<;g1X}V`NRNI-4ud&EmZLF=zv!Z&AwE
zmxe6E=8FFv0OEd=X7F!w=?E40%B4$CzQ$Z_N?0h4V)b(;emhf<2Nn1#r3x%e%nfih
zSNum<bMS*)IYI@#YUu(~FEKa3*<A52py%KRyL^Oh2D8TJIGZbee4m3K5@4vnS1Wa-
z&m(dJoXvINC%}igaD)ncjZ#PY%-jHHbH$gg`HCOr!VxO)HA_3Pas!;rbz$p&cqBsw
zzE<ffm^D7f*<8=)KMOx1z)*p&Te=EnjltPm&*(o3e@B3!0$;y$70jBj1+5p&s(J5`
z28__nXx8w5=gL#T=Gr!)9|$N^&|8)&veaCkjtJL_$IN7N<>CCQ_~Af9g}zIvBYhrO
z6X<NNKsQtWh)YMP(048E(8^78HdmmVt)Cj{P@(Tux{78^tU8-3(9PIS3p7;dyO*w_
zSrh1Nu0XfudbR;0ROow@I?`w6COVrd(9PWExO9XHo!{-CYlFFo&gKeqYp&-SFhYgC
zXXz@MHE}|+xdPp;>+=E)75ZMKt7z5)I-4udt-12@#~7hP-@8<Sg^9V^JMxiFG*2`5
zV_Z2x1-@130#h$BH^4W<QLKLM#K*dPgbIA?Qb+pC+yI|~BZHd{f6#>^RN&i`I?`w6
z2KZDQ8Qfg>I2Vpkfp1&tNS~P-;Nv(lxOwpLE*zl($1is0K-UIy1567V+#L7>myb|^
z@smQTBYkFWfN4O3oBy8Z!VxMUeo{zvq|eL^Fzsh>bKjF(I6?)yW2qy3W^RCKK7*V0
zp6tRAx*5zGHdj38=>XiE_mlub1-?_MBYhrO<8>a~xx&=Vdq3pT5h^r(tw?pG&&*YG
z<%-!{+j^hjB0g<Gu=|!Oa?J6=^Y{|{#r5LR8FVzi4DfJn>F2m;gbJN^u)I568O%*I
zJss#~>gT$CgbJPag1paL8O%*IT^;CV>*u+CgbJPag1paL8O%*IeI4j#?B~0Fgl<N&
zCeAgT9q4B57X%tAblzt27II~btO+!|9q4B67rK6g3Z1u^yoFpD%uO`i9q4B77rB0f
z3Z1u^yoFpD%uO`?9q4B87rTCh3Z1u^(6zzbMAI*UZkFNYk3k!3Mze-{M?UgNM{~pc
zD6z<c3Vh#E1r{de2AEcik8=)wrYlFN!1pV4q|eL^FpX$%^Wl%VaD)nc|58W#%-jIe
zh6XnmKFft8RNx1cI?`w62AC!^xOwo$T{uEFgIVJbj}|nzIq)X}3>6qR=&6qMd1Q^j
zr{l=r=D(kG;RqEFH|VL3^qIK<J_APvH~0ON3rDDc4=r`1&&&<*nK&}IdGDuPI6?(}
zc&Q_OW^RDb!jZwvc|YUA5i0N_N*(Dla|3tKTo)esG(Ov<RH1Rho9alPRdYVwx1QAR
zT3_md5h~DQN)@?42TrgLy0yQ64@+Oaf7V4KRM5wkDss&6!}Iui_-i68yR{GJd&IA~
zXoL!#x5ROad>EO>%uO^miM`*Y?GnH4f)Ofo-na6ebY(C%(cC5i-S&y!aQz4sI`3O~
zPr5Rgn`mwnfo?m+Z@PYj3Vn8|BYkFWqPbNBy6qLe<<b!<blw5-?rvo;H__ZI0^N3t
z-*){76*}(#d3U!mn44&B7lCg3#qYR&gbJNs8RILYqeo}vCYl>Ypxch|yDl4{o6)R^
z>zZ3epxd6o%O8U_5E^|gm9H-iS!UG5d;`S&ChhC^%Un7_1$<oT5|pno7rUGch@)8j
z+=)NOROCSgetf9{3lnn#>~77sXg>UTSB}ulVAgoW?$!i17yd$kp#ndl)R8`qtTEW#
zn&9Tam%DI;3jD-UNBYd%0J~cg+#L7{7mm=)VAgoW?$!i1|NUZsp#ndt)R8`qtTEW#
zn&9TXUvl9H75K@e9a*^ncDE+DdGD7a8M+zF8n4*hn&9TVUkNZ&;Jk0;J?Y9ASrfLP
z^}^K6d%x=X5h^sARH`F=X0DnmzbCV~w)@rJchLwH3|~}J6<KPoe~Ad!i|65x%k}bb
zZt2$xaKZ=`@&%=i^qIMd&gKeqGxeXibc721lF|;X+(c({1-jY#4UrDrjAl)okZi6%
zH)H>4prJzNx1{*i<ml0PWKE#6xdPp+{YICKP@(g?5_D~hZ$u=}*<68c=KeDSMySv)
zD|MvL%uRGQSD>4{|J<b`ROsCNxv{Sd<|aCuE6~m0f8qKODm1qAR7d*E+(c({1-e<B
zmp{e`O=PM93lnp-cjP0V=$K~kKXBy;6%hA!sgCrSxdEmX<Kvt=@s%zdp$SZNq|eL^
zFpX$%^Wpz<;RqG*$4edQGjjt>8yehP_=heWp#tNkG1ZYiGdI9Ap~20AuX5oC6%hA!
zsgCrSxdEmH4Q>v6wF^h6fVj6yb)?VC4KNL8aP!}5TsT4n#JydrBYkFWfN4L2oBLkt
z!VxOqvr8T6Gjjt>^BLT{_c|AjP=TLY>PVlN8(><`;O4wPa^VQw3}%gSaVxB5)x7t|
zfrbkGyi!N{JhFy&t~3anYqQ5+xoCt6im!jEiX3zN@H~D1e{sEdbOs&G=E}plrQhMA
z5h~=rmO9dB<|dj;4s=`fJ6$?LH=|h-tEQ_1-E94?KtqN8w^B#?JhCRx^mU+{vES{|
z5i0b*mpamC<|dlX4s^5jdt5p~H=|h-tERUD-OT;oKtqN8WT_*49$6D;x;xO#-tTki
z2;GckO`z%TKsSTGKhRL2|D)8AK98&kG#wu3W^rEr7_`A=G;8?9JRkX_qq$+;L@e^4
z0>8YJuP+Ve2AEci)z86icIgNe_!Xs&^qIK<rV$NpKKyGJj!=Pd$CT<wpP3tA+R)(U
z!oP9h2o*5zuApm!xdEmL4Q?L%TbGYef&ZY?kv=mwz_g&j&4GXC!VxO)$4VXPGjjt>
z0~*}?_ZAn9P=Wus)R8_jH^8)?!OeYdb>Rrz3}%h5W17$4=DoiUFjU}AlseMqku?U>
zdImS=z0HLqRN#Lpb)?VC4ctL<U3lcv_;#04H=|j@=F01s&9z;{9}Fl|(Eln`<e1}!
z=kZhci~sm|bOs&GO^AncOXDA%W6V?V#Xv*X26GclPY1f08hx5$glg4aDpg=%Vs4^&
zHUiyF2%0I!2o?IPr3x%e%uO_X9q49kG*gZdD)fJsDzGpyH_>!<pqsVP@i<24W;AQ!
zW2CnO-OP=)#4$pJ{#vO53lnn_O?L;n+510TJ3=?3Sre<KzXRP2j_a6X%<K8<@fOgv
z!Q4dC;el=z=jD$<8)(&A(5&I!k&k@R(cCcqKrHg00_PjV8!9-Pm>b}1t_zQR`jD$e
zsKB2to$(I-WNv`7xh_2N=^vdxLIwUz=>chWz}x_5b3L_hOCNUC2o?CVr8C~apUe$#
zHrG@8&%*!Y{1Lht%o=}q*<4TUKMQ{(z)*odSL#TgN8|=Lo9n_OpFZls5xN=78m~B;
z>#6-`VYGjaF~0_UKHdPjHkcdWY_6yFpM^i}@)4>PZvnH$E6(P6YX4an-zzxA{C@F;
zcmwF#U~ZcF1~?2;w>wvS0pJ+(i@=s<#TqtOUT$ozZNrDpIL7qb|HgWu8plEp$#fF_
z;Qofk%w%)r;mMJ6qIJYB%t7TjK6ffrU|~{CptHFG-J0wFxORkYMzbc+bT!X1(5<;*
ztK=A=LhnlzSeTfbXrAamw{sombc}O+?iMs_V%6DPvFg@b|If=Bp<4C%OC9Mma}%A-
z73g_$#iyo0-HKLCtU8-3(DUXx#g#%8`U0hT&xJ`ffzIX%^t`!F=W{Jp=x-=ppz0;n
z1Uj25(DUZ1%O3^Q&1hPNdq+O<Nk?<Tpfz!f*`ngZJSRR}M~}|T4RAJBEO`z_YvLHQ
zMQs7I#w*U|dc6Pcg$}|oMkhHJ$2ui^ab++!z_g*ycXMHE@MG-D=jIgxT^q~|FimK1
z^WYa;K0>w9EnwF8RAh5qc;pjyV~#O)<#Y4Giwn`wqcd{@oXvINkxyT8(FoOw^RnY5
zwKA9+;B2l7k9_*Ft4HW&Fl&4&vbioi^64u9h6=nZb)?TDYYfijy70)SuexxA3Otl{
zWaZ{Am(3LpY0VWkIviu%@SHma8oD-^tLDn9g3WclD^K_b=b&o6-&m@^G0jJ&>6`E;
zuU$MkgN|k|;o;2E(?wiG75ciRj`UeIfu^SeJ#VhlMO{i2`g)}uTDiGux;oHvTTd5@
zbg0nRFLk8Ps)<z}M>x=PV^0@%DOG5E*r|^6Sv7&?XBg=AF~-L<L4~|mX@~k1=H>~Z
zw*%dp>m?!`D)hZe9qIGLnpid69q86vFX_?=x*5%yK%ZIY)?6<YXsFQlDRrdJ6KevU
z%@x;mYp%TfnF-yDW)1g_eB_gk=7zyu!7=5YaiMqv=-OazfN8~8{Tv)S#FRV6g#!#-
z8_W$bjc9Q5VSMwNpgI*>z^w79pbZUfF2wgvjw!!?<{lDzilawo<_7pUOLexJ2l1_w
zW6E!z-yAE4t_|h}_%s|D+#HB6h8$CVLA*wQp=*P=0j2>BZvMm9LXIiF9$quR(6zzb
z0MmX3H}_r8<r7pN-nB{{=`(W!O!FDsyoVmbF=a2gc7UO4gSi3D=6YJYbDhEnRIPXm
zm^EJK!Oy}Ak9?ZK3RI!5QwqT1Pz~=~`Qfp-wvX=8uA88O-nUc{?!dD#p-XDLe9jXN
zxpnezZt1JJZh{K^;8I8W%-lq0a|ODY`syy7ph7>S)R8_jH_>!;th(7cTsEca9vW!q
z+F)*?>FYo@V~5YC^xYOTYj|zoEYR73Zq^Q`P3gRc#j2regSm<3<q_z1g}`$hQ+n^=
zfrhRP<|dl%4s^43xNS<4JTlPGwZYs()8Bz^28TH~rZmZS1{%6Hn49Qqt~l+jx$^R7
zCR7*S7Bp+vQSy;bI+`2iGQ<K575ILo3M@>_4RAJBEO`#TtScv|!1pg*VCp621~{AR
z>Fv&Sx}3|Yo58H{smSJfdiz;;x_p440zaVCkv^-&;B2m^w_oa}D+CxS@B>RbvT|d^
z*<4TWcPUqlWT?R3TDl5mjaQt__4K|&U&-YYRN!wbb)?VC4RAKs)7#I&Q(Ps~&0yAe
z#o1g>Z$Ar9S4I*BRp4(gRbXLKjlr~@cf97jtGIH4ZU(a^Hc;Hm<bE-~bDgdlXsFN+
zDs`mKs$p~GIc9Th``h(gG(iRZu2Myon(M6);d=3ynQX2+oLl-vfrbkGm{LdjJh3Lw
z*<68c&Gp7EouHf1tO;~BSD;&Sy-A><LO-_Dkv>nX33N7Bpj&gjsY@s5W;AO8oy`^K
z)?9BEXsFOXSn5chC)NZyn=8<*x!&BR6IAHOmv(67COVrd(Cy;8MWjQ8enP1ueV&k;
z=xnY)x8{0Fmrl^lXx79D$>s`lvp6q*W<rI2VyOZP6LYmG<s+YHo@VgtyK;gG{N1Gs
zOufY10B3W>lIKq3u7WW^H-lNj-3||WVyTbjV7@1#P=Oy+s=&g;+yG~D?T>t#_?{Tl
z&0yAe#o1i@BcCR|Ck9pE?<rMaVN#93*<AZ0pC-O1236qiD^*}&QjNjcT>B%RCcY;I
zRp9S0RbXLKjltPm`y-zwz9$A%;76A#urR5{;B2n_Nk<dk6N9=L%o>BUx#E9YKEK@f
zo){BU;2$VeU}0iznwpn1zl_5n&3k-Tj0w6K%^EgWz6G0W+k|e70LBCr^hu=(9MgPc
zn(l``={EdF&2$Ra%ftDpxVx(+sL<z?I?`w6CYoLebZf5naOniyjAl)&nhpzeYp&lC
zXsFOnFLk8P6KeuZj|I9l*L%8jf(reNQb+pC+(gr5fo{$9UM`)WLjP!~BYkFWqUp0h
zx8{0pmrl^lXx79Dp=$!&n(KW64Hf#CrH=G@VojiVQ3twR*Y|bl1l^2gO`z$UKsSr?
z^2eYJgnm}30t=HY!@UFl^F5aOXl|I>xN?FD{N&OFre0#MHYFGkN3r@j__i*epaMUo
z)R8_jH^4Na!Oe%abKwLP_=idz=`(W!OdA^9TzGpIPSDL@*7zLLga$Vc-XXwHfuCCH
zNS`Ox7)%Qq+#GmE7fw)tpH}KfpP3tA8qnb8zdN~bf(m?gsUv-6Zh&b&gPZ&A?7|7U
z8O$1=ifmd7J>@O|h6;R6sUv-!SYt4)=M^{S-PMH?bTgPW#vS}D46n52dbdDBg+8~`
zkv>nXVRPk**<9Ot@9!c$Z9>o=FID82<A>+zd+`_7d+^97AI>fP2p3IIp`TlN7<c%X
zxrwHyxxe9EnyJ6TMH5u$=ao9rXXYlFt`2mw^&?$6L4|&PsUv-6ZldYyKsRH5r%Na3
zW;AQ!T+`WsZq~*R4jdCy=ogeKurM(<(e!qpo4LQ+wG&k67nVBGXXYk4n=3xXX75M2
zbb<=~qS6kn+(c({1-dm?+>vlhP@!L3s=&g;+(c({1-e;=mp?P1LcgR`frUwy;ogyt
zeA3a}Fb{C$1QmGh#U(In49@0?CC|YR3@}vSpD0~m>ZOS_24{0UtN$$gtuCLS0{>*G
zBYkFWfU~)t)qfVoZ=W0!RN$W~RbXLaZh*77p4ERA#!r+S6Ld3}H9i&DT+ix13qOch
zfT05abg2Rh6LSNc&GoGQv+#pmIY9;fnbHNOUSe*5v$>wtf3$pv%O~h&Fl&4&Xg+UD
z&3g|;h*7A(&n{J9VPbB8&%%+x&3O-V<pdS@Ii-&DnYn3dey@#Pt~J+(yL5tXMziL8
zYON>r#`=8$gbMi5QbjJ{_~ChfZTz*1Jz}8Fjr{#ipP-A-rEZO{2{-|O<*l#}=jf*d
z8Y=WJmpanti8X<Cw-&l}YkcMAn4p`{tO>Ncwa~3w|1iPGgbMvDr3x%e%uTerwa~3w
z|A=cR=w>u)V%6@}Lbq;>Z}c1!ROnwTRbXLaZlc|-g>Ky%-|0CfsL;P&s=&g;+(f%u
z3*EZ)*{+?SLjOjoBYkFWqTQ{9Zac;~E}fv8(X5Gc%`Ic^OT6tFy!<gHsL;Pzs=&g;
zTx>>Ms&9pLG&jtnT{%Go{@Kz6re0!hfZeTiHs;_TaQOrk_+_Pz^qIK<cDE+D`S39=
zoS*{#d}&8kZh+mb32rWYY$QWBgIVKq>~2kP^WYB#7%K2DlseMqi8ThhTNB(I_&66%
zP=Q}w>PVlN8(?>9f}8&y@4^Wx@GD9?vT_6LZcT7=-xDGkx*5zGp9*(tf}8iA7+|Qt
zzgX%>pC{HB>~2kPbKa9&I6*gqSrewF^}^Jx4?a22P@#XR)R8_<tYLGd^VnS5x8(C&
zG(iQO?-a)zKRiz_!e3l3o`*v&*UQ7XrSYAOV}c6($E6A^Ow3I*Jss#~>Sw!lf^J5$
zCRR;X2fEq%Ie~@>{rXZz`aH2F(8qBY=w|Hax^#jH{U@c4^qIMd&gP19-K_mQmrhWj
z-%#42m78dKJ67Gy{rpIWZbq{vPRJRBZuWjbprJzlS*as^o>&uT`a4$L4E{owPEeu$
zyws6CGdIz6c%YlbdHG||215TusR9d=EW^DcANi!CxnZ8}$_Xm)Z<Q`E^%8TnDdD2P
zQJk1L_!%yrpaTC+sUv-6Zh&b-gPRY3)P)mN;6E&Nq|eL^Fl}gXbKx^xI6(z|RjDI=
zW^RCw<H+FV!5?$s1QqzzrH=HOxdA>6M+P?sKFfs@bTgPWzA8>X05|{P2N8}5D)4Jc
z6<C;<8(`YcD{k(?4<Z~>{xI^|07KUXa|2BC8Qi>wA4E8&{9$AZm^D5Xw4TAudH6wu
zV}j~byslJ%g^9U=i{F{mtXgx$FBcqB{(|vGfrhRP=Bl~UAZ)J99xrz31l4-yJH;`_
z56{zY<1hZ>A3XBOhjUBgPL*SV3jLN+1r{deCYnp;{)TsHtH$jl#{?Dnt)&VqOw3Jm
zHdmmVt$)?E6IAHGFI}MOCFUlYzK&HlW8-#`V}fo*vnI|pogL_AZQM?BOi-cUR;s|l
z#N0&F+ktN8#_c4>1Qq)2r3x%e%uO`i9q49ne3RptphCZ+RDp$wxrwH~1KkXc#>6o}
zH=|h-=Q^7!u8?MNUjEF43jNMf1r{b*hI>ao@<~T?!@R_m6I9^8EL~vgCFW{V!a{Kr
ztDl2k>hcLH@L!cW(r4xdIGgJ!efPk<HOG|q*l!9jbZsy<z}Z|+>36QUx8|7g9(xOz
zH9p7LTu<qDu0JR42@_PO;?1Rw^qIK<&gObbzjMV+JI9na?|&U&=-OazfU~)t((hbx
zZ_P2~J@ytbYkVrQxt`MRTwhKsz%P%L{!OU@3lnn#O!N72Yu<Z>D<`PV@!ys@(r4xd
znAS76IS;qM920aim^ERG8{jbZi`HC!2{DWbD)ir#DzGpySIw2zF`H}aCBNgU2`cEj
zN)=gZu78FI*L(2DCm)_{)CnhAr`MGV{h>fZ*M@2Woy`^R(wb|0pO~PV(X0t{HdmnA
z3Bmm}#{?Dn!=(x=Ow3JmHdmlqbA7#QC+KE0Yhu;eT!C)Q6*s{g6IAGbDpg=%Vs4_d
zxdPpq>l<7<L52QEsUv-6Zlbff0^OSHpSpB{Zbq{vPDnOapqs(p7-*=_A1igF&l7SJ
zO^4HmKsSr?^2eB<o6)S{ZkLaI($UGpV4P@~ez#QMxfdNiGONbmY_3@H9Q=C$h6?=d
z(j&A(e@v_~IGbyK<kR%~uAmD1p3+0CBZsOnm^SoB*<APsu9=_$zqj-V?a&|0jTL8e
z?T>t#Ug-+zW-x2K;%u({kx$eA3oumR_mw)*XVn;-&9y)BY5KzeLj`_+X-8IWtT>x%
zf8^8jsz`<k{DIO{Fl)TxY_9#0Pt&Ud4BZT7jltPm`y-#G*8~_U@CQpB>9cBLzsTka
zhqUJU+CW2v{)f^Itz0!%UT$ozZNvZbNQ4Ud@lr*OIevJa-iyDuUOYO3j^-xB!?~q#
z&&M(4z2D~p4P6_|O*B0n=+<0uW5zK-wdyTs*2Jn$#bKbEt>2Cq#sn4m3#AGyOw3I*
zPjsN$xqgRhC#cY0EOn&M%uV!ZI1F@auJ3f|1l^2gO`MR^3*DOQy8;ar`pcz`^m$@U
zpy}>db!)EgcIgD&jAl)s>F+?d=K7vMLxuiIsUv-!SQF@MuDGsSbLHjFOsLRbEmdG)
zl4ZDe<RhPSG&js&xN?FDJon-fm^B8|in01R7`MP2Q{D>ybG!j`Z7?^$G@`-Hhqwji
znDSQmKLQM08_W$bZD??FVchyodB^&n0fw#(<_4H1G`M*Xcd8sy-m!ivz|gh9+yK*p
z1~&)B9qN=fmRrEA@rOqP8r=Mc8%mBTZ!A9@D~7HO<_4JdGq|}AH<TPx-dJt{v&Ji?
z`3!E}!(AW8ly`rhi4{ZF26F?P&9y)BX?lyxsWQmtN>{<G@j4HF7G8Md(}dqXIjEb_
ztl__N<yFDv+OCQBA%HPK7k7$d3Llv!T8HaBc;u50=a$Caz%j)hao+j-7Sy%D+(gsU
z+&b|t&D60gOtDLxcT%9CYlFFormF+pZ2buXCMZwHCNyi}gwWT4ZpQwXKtqMzl{(Vr
zi8X=dXBg=AG5)JdC#cXvsUv-6Zlbff;#@a#|C>uEsL*3+hgNQ)v$+D@?EUYN4i$PT
zT}87dPDnOapqs%z8EEKcG;0E#%@yd@TzUC36Dst+RDp#_mf@z9k9^Y6+%WHV<pd@8
z-2X0JVCp62YE!~OaTKecgFoQ%2`cc{N*(Dla|4{s^|b!8Fm4?<ro4sN0%na*MK;&d
z`VVTjap0Kp2I7BW#n83E+yG~DJ+0qNe8}Y!RHx$WrK@1pc*WUVPwN}$KL!{o@c)*s
zf>~p5HrLbo&%z%LFmyARH3nyMJ+1#Nj9<4nCaA#wSE|6m#M}VWe7@Y8_depv2}<yJ
z_%juUi(~o-UiOM<J%gL`K8g^dPytUYRbXLaZrb7oIE)Rn-MN0uwG(tRnl)^${P5UZ
z+twLh1t+MW=PyOc2`4NxS8OI;FCH#KM{~VAJejX!;2)V|`bw$L7Y#IYZK#H47QAe(
zJe;Gy8fd7{7b{&wvnJ5lT!C)Q6+0To1l^2gO`x;60^OP`wjPcND)hxm6<C;<o9Jw=
zK)2=^o6ZCk8XsHg0#z?DH__Q#fo@j_wjYiOD&!?f6<C;<o9Jw=K)2?K4TxicZbq{v
z&NclV7hf|tb_$Luc8v2b8E*ky8_Z2K9Ukbp#dY~JjQ`WBFI9?{7KduMcjP0VbTq%J
z|I4)#RNxDgE>iI#bG0eq^zu(zXAX|rvMKJS&ijS{L)Qj#1Dwru;gL^q_cX;#&v_RN
zFm!D&H^A9k7asW(H#t+>^lSpN#^*Sj>%t?SKI?T&P@Us%EOn&M%nfih*M&zuea?jw
zbTgPWUNH^m53l*}^8tnme4$cD`aH45;B2l7k9_)q3n%DiFl!9X=DP66r!NK=D)5C%
z9qIGL8iQ#)pNhHjrZ2gWD)2>09qF@b!WK6`I85D|>z7?RL503(X@^#>nk&ySo9ldk
z+eas)3VNwhA&wbzc-~(Ee{sEdbjA&F$o2AYX6ZeyTMnww*DY0GVNy+?>FGevo9iAI
z7zb78>y;|7FsUZcbakNT&2^6}frGjk&6+?TXRS}jyt(diEpSkUzJ93!3zKRBeHv?x
zo;TM$t_2S2W;AO8O>YN!ZtnfX5MvlBG%nFpzP>b66KGy}fo>Py#a+CI3W<+A)sa3k
zH&>m_6&K&Ux$fh-r6w}9L;Z?sV%6DPfu37jmp>|~LgH#lHK@<3;ogyteA3a}F!7Vl
z9xC8Bm3E|GVXihMEEGqv`Z+j$(Ann?JeLkIbZsy<z%-)4&4>8yg=3$;!CWc8(6zzb
z0OQ03xVaF&ym0LE7a05#>6GL@nW9H0<_4H1^opAY@w*GhK7W6?a)6<0gSi2w1r2Tv
z#IG(K`~3A~3z#*&DzdruM?UT2%N$jw;3}nj!=<4bgK0mnxVaDaQ5^fcpSnhXp=*P=
zvEpp5{gF?5d@1ChYQ@(sRbXLKjaQt_wLkJ{A72Kko58H{2{`y!7+#q-*L{2)qzZkV
z(uL*fCDriGm8XKuwQWL|bm<-{=zOP$P0Cr3do3u}d+^97ALfOBVx-0Oy3fn(X7Lu#
zwZYs()6?9Q@h;8OxWG8}d7<4r(9pHP+(gsWfo`_GssVebPRJHCYvP2^*MV-vzFMH6
zLf@j)kv{KP6X<NNI3dm2S9j?iD)cQ&JG62Woy`^K)?B|i(xF1%s&p02npkx<SD>4{
z!^Zox^%gX10-enj=yqLS(`(y9wdz}!I?`w6COVrd(5<=h^2gXig}zOx0t*v!wJGHz
zpLkg}gX4=W#~vy$KJZk&zBHH{;B2l~^4y8&(j0rJfcUsm`TEjeZh*77;{U1b930(w
z4^3d|5|pnoH^A9k@&C|o4!(@b_fP?G6{R}TXXXYtn=AgG8O_0$b>SW=Ag-ZQNBYd%
z0B3W>|09Pv_;N1XLj}YYl<G*InHyjl&{uWy-{oDnhbA!9kv=mwz&LRMZtlB+3-?d~
zZ&d0?pP3tAoVWlt?_JS_d+25`YuH@zxRwKObKaE@!q{Iaz&9>cU}0iznmX@X;gIIN
z_&E1at@);<3sk+tT-~{H#cZx^z4%ta!KY0KdfQS3mYOU2jn<3*#Sk6MUc$rq<;KsI
z;WWlw0}Wjp%uRGQSD>4z`N?AJ(;9aRG<0n+H__Q#fo`_unZnqoIkuqldH^q*D-Y)<
z1Xr)nc@^J1Rt;Snd)Cl(;AL~=;T(<2jANgd+dTpeT^r0zbT(I@o4Iddz#ghA<XcKt
z(X5G8^An9Lq}dx+FvmWx<Sl5{1e%{{pqs(t8{8hMRo}A|Rf~hUiRLF7=w=yS{tQDm
zqglhf1OMB29C`iC;P|%8vCnVKb1yo4WM*!Fv$^6koL?RI&4^>4za8B!Rt{Yo%nfih
zSNzY1=3x9{#Ic9!RNTH)frW{=0nX-%|8#l|#*aE2`}}cd3z#)N$Jt!*pN-AIJpCAZ
zs8)Q3QUw+!<_0*MEB=-F9L&>?v4;wL$5I6rCguh>n=Afx!5qxfkFket2D8SeqBhj#
zKAwJzJyhU3l`60>F*m@qoi^|B^keLy0^hk*frW{=0j|xoIgh6wV-MX7u8-{C&J_-6
z-s1;=v4;wMmr?~5Cgz@SqOR1hz3rS^9Q*+a?S4LV-Yb6X!zX_N$0vOKR?no_PQ3pA
E2kf+of&c&j


From 1944f77aab458c79de0aee91c766b3c04c0d6417 Mon Sep 17 00:00:00 2001
From: Sam Mikes <smikes@apple.com>
Date: Tue, 9 Mar 2021 20:29:08 +0000
Subject: [PATCH 184/591] ZOOKEEPER-4210: Preserve return code from nonblocking
 send

Async API calls attempt to flush the send buffer, which
calls flush_send_queue(); and can report
  ZOPERATIONTIMEOUT
  ZSYSTEMERROR
  ZCONNECTIONLOSS

Specifically: send_buffer() calls send(2) with MSG_NOSIGNAL,
which can return EPIPE; then send_buffer return -1, causing
ZCONNECTIONLOSS from flush_send_queue().

Current async API calls drop the return value from flush_send_queue(),
as below:

    adaptor_send_queue(zh, 0);
    return (rc < 0)?ZMARSHALLINGERROR:ZOK;

The async API then returns ZOK instead of ZCONNECTIONLOSS.

Author: Sam Mikes <smikes@apple.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1602 from smikes/asyncsend-returncode-3.6
---
 .../zookeeper-client-c/src/zookeeper.c        | 84 +++++++++----------
 1 file changed, 40 insertions(+), 44 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 72a05a96991..0504a746fc7 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -3963,6 +3963,19 @@ static int Request_path_watch_init(zhandle_t *zh, int mode,
 /*---------------------------------------------------------------------------*
  * ASYNC API
  *---------------------------------------------------------------------------*/
+
+/* make an attempt to send queued requests immediately without blocking */
+static int nonblocking_send(zhandle_t *zh, int rc)
+{
+    if (adaptor_send_queue(zh, 0) < 0) {
+        if (zh->fd->sock != -1) {
+            close_zsock(zh->fd);
+            zh->state = ZOO_NOTCONNECTED_STATE;
+        }
+    }
+    return (rc < 0) ? ZMARSHALLINGERROR : ZOK;
+}
+
 int zoo_aget(zhandle_t *zh, const char *path, int watch, data_completion_t dc,
         const void *data)
 {
@@ -4002,9 +4015,8 @@ int zoo_awget(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_agetconfig(zhandle_t *zh, int watch, data_completion_t dc,
@@ -4046,9 +4058,8 @@ int zoo_awgetconfig(zhandle_t *zh, watcher_fn watcher, void* watcherCtx,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
                zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_areconfig(zhandle_t *zh, const char *joining, const char *leaving,
@@ -4082,10 +4093,8 @@ int zoo_areconfig(zhandle_t *zh, const char *joining, const char *leaving,
     close_buffer_oarchive(&oa, 0);
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending Reconfig request xid=%#x to %s",h.xid, zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
 
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+    return nonblocking_send(zh, rc);
 }
 
 static int SetDataRequest_init(zhandle_t *zh, struct SetDataRequest *req,
@@ -4128,9 +4137,8 @@ int zoo_aset(zhandle_t *zh, const char *path, const char *buffer, int buflen,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 static int CreateRequest_init(zhandle_t *zh, struct CreateRequest *req,
@@ -4255,9 +4263,8 @@ int zoo_acreate_ttl(zhandle_t *zh, const char *path, const char *value,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_acreate2(zhandle_t *zh, const char *path, const char *value,
@@ -4322,9 +4329,8 @@ int zoo_acreate2_ttl(zhandle_t *zh, const char *path, const char *value,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int DeleteRequest_init(zhandle_t *zh, struct DeleteRequest *req,
@@ -4362,9 +4368,8 @@ int zoo_adelete(zhandle_t *zh, const char *path, int version,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aexists(zhandle_t *zh, const char *path, int watch,
@@ -4401,9 +4406,8 @@ int zoo_awexists(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 static int zoo_awget_children_(zhandle_t *zh, const char *path,
@@ -4434,9 +4438,8 @@ static int zoo_awget_children_(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aget_children(zhandle_t *zh, const char *path, int watch,
@@ -4482,9 +4485,8 @@ static int zoo_awget_children2_(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aget_children2(zhandle_t *zh, const char *path, int watch,
@@ -4525,9 +4527,8 @@ int zoo_async(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 
@@ -4555,9 +4556,8 @@ int zoo_aget_acl(zhandle_t *zh, const char *path, acl_completion_t completion,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aset_acl(zhandle_t *zh, const char *path, int version,
@@ -4586,9 +4586,8 @@ int zoo_aset_acl(zhandle_t *zh, const char *path, int version,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 /* Completions for multi-op results */
@@ -4747,10 +4746,8 @@ int zoo_amulti(zhandle_t *zh, int count, const zoo_op_t *ops,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending multi request xid=%#x with %d subrequests to %s",
             h.xid, index, zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
 
-    return (rc < 0) ? ZMARSHALLINGERROR : ZOK;
+    return nonblocking_send(zh, rc);
 }
 
 typedef union WatchesRequest WatchesRequest;
@@ -4833,7 +4830,6 @@ static int aremove_watches(
         zh, h.xid, COMPLETION_VOID, completion, data, 0, wdo, 0);
     rc = rc < 0 ? rc : queue_buffer_bytes(&zh->to_send, get_buffer(oa),
             get_buffer_len(oa));
-    rc = rc < 0 ? ZMARSHALLINGERROR : ZOK;
     leave_critical(zh);
 
     /* We queued the buffer, so don't free it */
@@ -4842,7 +4838,7 @@ static int aremove_watches(
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",
               h.xid, path, zoo_get_current_server(zh));
 
-    adaptor_send_queue(zh, 0);
+    rc = nonblocking_send(zh, rc);
 
 done:
     free_duplicate_path(server_path, path);

From 2f98b8feb297ca0b44f6686870078f2ce8d3d303 Mon Sep 17 00:00:00 2001
From: Damien Diederen <dd@crosstwine.com>
Date: Wed, 10 Mar 2021 10:51:38 +0530
Subject: [PATCH 185/591] ZOOKEEPER-4233: dependency-check:check failing -
 Jetty 9.4.35.v20201120 - CVE-2020-27223

The OWASP checker reports that the version of Jetty currently
referenced by this branch is vulnerable to a CVE:

    [ERROR] Failed to execute goal org.owasp:dependency-check-maven:5.3.0:check (default-cli) on project zookeeper:
    [ERROR]
    [ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '0.0':
    [ERROR]
    [ERROR] jetty-server-9.4.35.v20201120.jar: CVE-2020-27223
    [ERROR] jetty-http-9.4.35.v20201120.jar: CVE-2020-27223

https://nvd.nist.gov/vuln/detail/CVE-2020-27223 describes it as:

> In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive),
> 10.0.0, and 11.0.0 when Jetty handles a request containing multiple
> Accept headers with a large number of "quality" (i.e. q) parameters,
> the server may enter a denial of service (DoS) state due to high CPU
> usage processing those quality values, resulting in minutes of CPU
> time exhausted processing those quality values.

This changeset bumps Jetty to 9.4.38.v20210224, which is the latest
as of the commit date.

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1623 from ztzg/ZOOKEEPER-4023-jetty-CVE-2020-27223 and squashes the following commits:

7cb65fbf1 [Damien Diederen] zookeeper-server: Distribution tarball does not include jetty-client
59cffa16d [Damien Diederen] ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
---
 pom.xml                                       |   2 +-
 ...> jetty-http-9.4.38.v20210224.LICENSE.txt} |   0
 ... => jetty-io-9.4.38.v20210224.LICENSE.txt} |   0
 ...tty-security-9.4.38.v20210224.LICENSE.txt} |   0
 ...jetty-server-9.4.38.v20210224.LICENSE.txt} |   0
 ...etty-servlet-9.4.38.v20210224.LICENSE.txt} |   0
 ...> jetty-util-9.4.38.v20210224.LICENSE.txt} |   0
 ...tty-util-ajax-9.4.35.v20201120.LICENSE.txt | 414 ------------------
 ...ty-util-ajax-9.4.38.v20210224.LICENSE.txt} |   0
 9 files changed, 1 insertion(+), 415 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-client-9.4.35.v20201120.LICENSE.txt => jetty-http-9.4.38.v20210224.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.35.v20201120.LICENSE.txt => jetty-io-9.4.38.v20210224.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.35.v20201120.LICENSE.txt => jetty-security-9.4.38.v20210224.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.35.v20201120.LICENSE.txt => jetty-server-9.4.38.v20210224.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.35.v20201120.LICENSE.txt => jetty-servlet-9.4.38.v20210224.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.35.v20201120.LICENSE.txt => jetty-util-9.4.38.v20210224.LICENSE.txt} (100%)
 delete mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.35.v20201120.LICENSE.txt => jetty-util-ajax-9.4.38.v20210224.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index bb5e50bdc54..8782ad77322 100755
--- a/pom.xml
+++ b/pom.xml
@@ -468,7 +468,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.59.Final</netty.version>
-    <jetty.version>9.4.35.v20201120</jetty.version>
+    <jetty.version>9.4.38.v20210224</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-client-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.38.v20210224.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.38.v20210224.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.38.v20210224.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.38.v20210224.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.38.v20210224.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.38.v20210224.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt
deleted file mode 100644
index 46f4f252464..00000000000
--- a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt
+++ /dev/null
@@ -1,414 +0,0 @@
-This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 2.0 which is available at
-http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
-2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
-
-
-
-Eclipse Public License - v 1.0
-
-THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
-LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
-CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
-
-1. DEFINITIONS
-
-"Contribution" means:
-
-a) in the case of the initial Contributor, the initial code and documentation
-   distributed under this Agreement, and
-b) in the case of each subsequent Contributor:
-    i) changes to the Program, and
-   ii) additions to the Program;
-
-   where such changes and/or additions to the Program originate from and are
-   distributed by that particular Contributor. A Contribution 'originates'
-   from a Contributor if it was added to the Program by such Contributor
-   itself or anyone acting on such Contributor's behalf. Contributions do not
-   include additions to the Program which: (i) are separate modules of
-   software distributed in conjunction with the Program under their own
-   license agreement, and (ii) are not derivative works of the Program.
-
-"Contributor" means any person or entity that distributes the Program.
-
-"Licensed Patents" mean patent claims licensable by a Contributor which are
-necessarily infringed by the use or sale of its Contribution alone or when
-combined with the Program.
-
-"Program" means the Contributions distributed in accordance with this
-Agreement.
-
-"Recipient" means anyone who receives the Program under this Agreement,
-including all Contributors.
-
-2. GRANT OF RIGHTS
-  a) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free copyright license to
-     reproduce, prepare derivative works of, publicly display, publicly
-     perform, distribute and sublicense the Contribution of such Contributor,
-     if any, and such derivative works, in source code and object code form.
-  b) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free patent license under
-     Licensed Patents to make, use, sell, offer to sell, import and otherwise
-     transfer the Contribution of such Contributor, if any, in source code and
-     object code form. This patent license shall apply to the combination of
-     the Contribution and the Program if, at the time the Contribution is
-     added by the Contributor, such addition of the Contribution causes such
-     combination to be covered by the Licensed Patents. The patent license
-     shall not apply to any other combinations which include the Contribution.
-     No hardware per se is licensed hereunder.
-  c) Recipient understands that although each Contributor grants the licenses
-     to its Contributions set forth herein, no assurances are provided by any
-     Contributor that the Program does not infringe the patent or other
-     intellectual property rights of any other entity. Each Contributor
-     disclaims any liability to Recipient for claims brought by any other
-     entity based on infringement of intellectual property rights or
-     otherwise. As a condition to exercising the rights and licenses granted
-     hereunder, each Recipient hereby assumes sole responsibility to secure
-     any other intellectual property rights needed, if any. For example, if a
-     third party patent license is required to allow Recipient to distribute
-     the Program, it is Recipient's responsibility to acquire that license
-     before distributing the Program.
-  d) Each Contributor represents that to its knowledge it has sufficient
-     copyright rights in its Contribution, if any, to grant the copyright
-     license set forth in this Agreement.
-
-3. REQUIREMENTS
-
-A Contributor may choose to distribute the Program in object code form under
-its own license agreement, provided that:
-
-  a) it complies with the terms and conditions of this Agreement; and
-  b) its license agreement:
-      i) effectively disclaims on behalf of all Contributors all warranties
-         and conditions, express and implied, including warranties or
-         conditions of title and non-infringement, and implied warranties or
-         conditions of merchantability and fitness for a particular purpose;
-     ii) effectively excludes on behalf of all Contributors all liability for
-         damages, including direct, indirect, special, incidental and
-         consequential damages, such as lost profits;
-    iii) states that any provisions which differ from this Agreement are
-         offered by that Contributor alone and not by any other party; and
-     iv) states that source code for the Program is available from such
-         Contributor, and informs licensees how to obtain it in a reasonable
-         manner on or through a medium customarily used for software exchange.
-
-When the Program is made available in source code form:
-
-  a) it must be made available under this Agreement; and
-  b) a copy of this Agreement must be included with each copy of the Program.
-     Contributors may not remove or alter any copyright notices contained
-     within the Program.
-
-Each Contributor must identify itself as the originator of its Contribution,
-if
-any, in a manner that reasonably allows subsequent Recipients to identify the
-originator of the Contribution.
-
-4. COMMERCIAL DISTRIBUTION
-
-Commercial distributors of software may accept certain responsibilities with
-respect to end users, business partners and the like. While this license is
-intended to facilitate the commercial use of the Program, the Contributor who
-includes the Program in a commercial product offering should do so in a manner
-which does not create potential liability for other Contributors. Therefore,
-if a Contributor includes the Program in a commercial product offering, such
-Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
-every other Contributor ("Indemnified Contributor") against any losses,
-damages and costs (collectively "Losses") arising from claims, lawsuits and
-other legal actions brought by a third party against the Indemnified
-Contributor to the extent caused by the acts or omissions of such Commercial
-Contributor in connection with its distribution of the Program in a commercial
-product offering. The obligations in this section do not apply to any claims
-or Losses relating to any actual or alleged intellectual property
-infringement. In order to qualify, an Indemnified Contributor must:
-a) promptly notify the Commercial Contributor in writing of such claim, and
-b) allow the Commercial Contributor to control, and cooperate with the
-Commercial Contributor in, the defense and any related settlement
-negotiations. The Indemnified Contributor may participate in any such claim at
-its own expense.
-
-For example, a Contributor might include the Program in a commercial product
-offering, Product X. That Contributor is then a Commercial Contributor. If
-that Commercial Contributor then makes performance claims, or offers
-warranties related to Product X, those performance claims and warranties are
-such Commercial Contributor's responsibility alone. Under this section, the
-Commercial Contributor would have to defend claims against the other
-Contributors related to those performance claims and warranties, and if a
-court requires any other Contributor to pay any damages as a result, the
-Commercial Contributor must pay those damages.
-
-5. NO WARRANTY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
-IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
-Recipient is solely responsible for determining the appropriateness of using
-and distributing the Program and assumes all risks associated with its
-exercise of rights under this Agreement , including but not limited to the
-risks and costs of program errors, compliance with applicable laws, damage to
-or loss of data, programs or equipment, and unavailability or interruption of
-operations.
-
-6. DISCLAIMER OF LIABILITY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
-CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
-LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
-EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
-OF SUCH DAMAGES.
-
-7. GENERAL
-
-If any provision of this Agreement is invalid or unenforceable under
-applicable law, it shall not affect the validity or enforceability of the
-remainder of the terms of this Agreement, and without further action by the
-parties hereto, such provision shall be reformed to the minimum extent
-necessary to make such provision valid and enforceable.
-
-If Recipient institutes patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Program itself
-(excluding combinations of the Program with other software or hardware)
-infringes such Recipient's patent(s), then such Recipient's rights granted
-under Section 2(b) shall terminate as of the date such litigation is filed.
-
-All Recipient's rights under this Agreement shall terminate if it fails to
-comply with any of the material terms or conditions of this Agreement and does
-not cure such failure in a reasonable period of time after becoming aware of
-such noncompliance. If all Recipient's rights under this Agreement terminate,
-Recipient agrees to cease use and distribution of the Program as soon as
-reasonably practicable. However, Recipient's obligations under this Agreement
-and any licenses granted by Recipient relating to the Program shall continue
-and survive.
-
-Everyone is permitted to copy and distribute copies of this Agreement, but in
-order to avoid inconsistency the Agreement is copyrighted and may only be
-modified in the following manner. The Agreement Steward reserves the right to
-publish new versions (including revisions) of this Agreement from time to
-time. No one other than the Agreement Steward has the right to modify this
-Agreement. The Eclipse Foundation is the initial Agreement Steward. The
-Eclipse Foundation may assign the responsibility to serve as the Agreement
-Steward to a suitable separate entity. Each new version of the Agreement will
-be given a distinguishing version number. The Program (including
-Contributions) may always be distributed subject to the version of the
-Agreement under which it was received. In addition, after a new version of the
-Agreement is published, Contributor may elect to distribute the Program
-(including its Contributions) under the new version. Except as expressly
-stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
-licenses to the intellectual property of any Contributor under this Agreement,
-whether expressly, by implication, estoppel or otherwise. All rights in the
-Program not expressly granted under this Agreement are reserved.
-
-This Agreement is governed by the laws of the State of New York and the
-intellectual property laws of the United States of America. No party to this
-Agreement will bring a legal action under this Agreement more than one year
-after the cause of action arose. Each party waives its rights to a jury trial in
-any resulting litigation.
-
-
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.38.v20210224.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.38.v20210224.LICENSE.txt

From f52918abd066d85a423d38917e58fc950d4e9d09 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Wed, 10 Mar 2021 12:52:24 +0100
Subject: [PATCH 186/591] ZOOKEEPER-4227: X509AuthFailureTest is failing
 consistently

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1616 from arshadmohammad/ZOOKEEPER-4227
---
 .../org/apache/zookeeper/server/X509AuthFailureTest.java     | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
index 189a40f28ab..dc3394d1754 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
@@ -20,6 +20,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
@@ -30,7 +31,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-public class X509AuthFailureTest {
+public class X509AuthFailureTest extends ZKTestCase {
     protected static final Logger LOG = LoggerFactory.getLogger(X509AuthFailureTest.class);
 
     private static ClientX509Util clientX509Util;
@@ -71,6 +72,8 @@ public void testSecureStandaloneServerAuthNFailure() throws Exception {
 
         ZooKeeperServerMainTest.MainThread mt = new ZooKeeperServerMainTest.MainThread(CLIENT_PORT, SECURE_CLIENT_PORT, true, null);
         mt.start();
+        assertTrue(
+            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
 
         try {
             ZooKeeper zk = createZKClnt("127.0.0.1:" + SECURE_CLIENT_PORT);

From 04471b2e117a0cbe08c42b0482f0adca93494e7c Mon Sep 17 00:00:00 2001
From: Mukti Krishnan <muktikrishnan94@gmail.com>
Date: Thu, 11 Mar 2021 10:36:48 +0530
Subject: [PATCH 187/591] ZOOKEEPER-4230: Use dynamic temp folder instead of
 static temp folder in RestMain

Author: Mukti <muktikrishnan94@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1633 from MuktiKrishnan/ZOOKEEPER-4230-master
---
 .../java/org/apache/zookeeper/server/jersey/RestMain.java     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java
index 954ad045b1c..209207f6b14 100644
--- a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java
+++ b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java
@@ -22,6 +22,7 @@
 import java.io.IOException;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.nio.file.Files;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -53,7 +54,8 @@ public void start() throws IOException {
        System.out.println("Starting grizzly ...");
 
        boolean useSSL = cfg.useSSL();
-       gws = new GrizzlyWebServer(cfg.getPort(), "/tmp/23cxv45345/2131xc2/", useSSL);
+       String zkRestResourcesTempPath = Files.createTempDirectory("zkRestResourcesTempPath").toFile().getCanonicalPath();
+       gws = new GrizzlyWebServer(cfg.getPort(), zkRestResourcesTempPath, useSSL);
        // BUG: Grizzly needs a doc root if you are going to register multiple adapters
 
        for (Endpoint e : cfg.getEndpoints()) {

From 2e400114fdee9a870170749f6573d4499e1a850f Mon Sep 17 00:00:00 2001
From: Mukti Krishnan <muktikrishnan94@gmail.com>
Date: Fri, 12 Mar 2021 00:05:07 +0530
Subject: [PATCH 188/591] ZOOKEEPER-1871: Add an option to zkCli to wait for
 connection before executing commands

-waitforconnection option will make zk client wait for -timeout time to connect to zk server.  timeout time is 30ms by default but can be specified explicitly for a session using -timeout option in command line.

Author: Mukti <muktikrishnan94@gmail.com>

Reviewers: maoling <maoling@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1626 from MuktiKrishnan/ZOOKEEPER-1871-master and squashes the following commits:

2947514b2 [Mukti] ZOOKEEPER-1871: Removed statement which was re-creating zookeeper admin in ZooKeeperMain.java and added documentation for waitforconnection in zookeeperCLI.md and
c475d46ff [Mukti] ZOOKEEPER-1871: Add an option to zkCli to wailt for connection before executing commands
---
 .../main/resources/markdown/zookeeperCLI.md   |  2 ++
 .../org/apache/zookeeper/ZooKeeperMain.java   | 26 ++++++++++++++++++-
 .../org/apache/zookeeper/ZooKeeperTest.java   | 21 +++++++++++++++
 3 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 668e64e8ba8..7096aa0cc89 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -24,6 +24,8 @@ Enter into the ZooKeeper-cli
 bin/zkCli.sh
 # connect to the remote host with timeout:3s
 bin/zkCli.sh -timeout 3000 -server remoteIP:2181
+# connect to the remote host with -waitforconnection option to wait for connection success before executing commands
+bin/zkCli.sh -waitforconnection -timeout 3000 -server remoteIP:2181
 # connect with a custom client configuration properties file
 bin/zkCli.sh -client-configuration /path/to/client.properties
 ```
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index ff8ce623286..4ee378fac05 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -32,6 +32,8 @@
 import java.util.List;
 import java.util.Map;
 import java.util.NoSuchElementException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Stream;
@@ -68,6 +70,7 @@ public class ZooKeeperMain {
 
     protected ZooKeeper zk;
     protected String host = "";
+    private CountDownLatch connectLatch = null;
 
     public boolean getPrintWatches() {
         return printWatches;
@@ -106,6 +109,13 @@ public void process(WatchedEvent event) {
                 ZooKeeperMain.printMessage("WATCHER::");
                 ZooKeeperMain.printMessage(event.toString());
             }
+            if (connectLatch != null) {
+                // connection success
+                if (event.getType() == Event.EventType.None
+                    && event.getState() == Event.KeeperState.SyncConnected) {
+                    connectLatch.countDown();
+                }
+            }
         }
 
     }
@@ -168,6 +178,8 @@ public boolean parseOptions(String[] args) {
                         options.put("readonly", "true");
                     } else if (opt.equals("-client-configuration")) {
                         options.put("client-configuration", it.next());
+                    } else if (opt.equals("-waitforconnection")) {
+                        options.put("waitforconnection", "true");
                     }
                 } catch (NoSuchElementException e) {
                     System.err.println("Error: no argument found for option " + opt);
@@ -261,7 +273,19 @@ protected void connectToZK(String newHost) throws InterruptedException, IOExcept
             }
         }
 
-        zk = new ZooKeeperAdmin(host, Integer.parseInt(cl.getOption("timeout")), new MyWatcher(), readOnly, clientConfig);
+        if (cl.getOption("waitforconnection") != null) {
+            connectLatch = new CountDownLatch(1);
+        }
+
+        int timeout = Integer.parseInt(cl.getOption("timeout"));
+        zk = new ZooKeeperAdmin(host, timeout, new MyWatcher(), readOnly, clientConfig);
+        if (connectLatch != null) {
+            if (!connectLatch.await(timeout, TimeUnit.MILLISECONDS)) {
+                zk.close();
+                throw new IOException(KeeperException.create(KeeperException.Code.CONNECTIONLOSS));
+            }
+        }
+
     }
 
     public static void main(String[] args) throws IOException, InterruptedException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index b726c47da06..f69e0c683fb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -774,4 +774,25 @@ private void assertClientAuthInfo(List<String> expected, String actual) {
         });
     }
 
+    @Test
+    public void testWaitForConnection() throws Exception {
+        // get a wrong port number
+        int invalidPort = PortAssignment.unique();
+        long timeout = 3000L; // millisecond
+        String[] args1 = {"-server", "localhost:" + invalidPort, "-timeout",
+                Long.toString(timeout), "-waitforconnection", "ls", "/"};
+        long startTime = System.currentTimeMillis();
+        // try to connect to a non-existing server so as to wait until wait_timeout
+        try {
+            ZooKeeperMain zkMain = new ZooKeeperMain(args1);
+            fail("IOException was expected");
+        } catch (IOException e) {
+            // do nothing
+        }
+        long endTime = System.currentTimeMillis();
+        assertTrue(endTime - startTime >= timeout,
+                "ZooKeeeperMain does not wait until the specified timeout");
+
+    }
+
 }

From c74658d398cdc1d207aa296cb6e20de00faec03e Mon Sep 17 00:00:00 2001
From: Amichai Rothman <amichai@apache.org>
Date: Wed, 17 Mar 2021 14:02:13 +0530
Subject: [PATCH 189/591] ZOOKEEPER-4205: Change X509AuthFailureTest to use
 dynamically assigned free port
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…d free port

Author: Amichai Rothman <amichai@apache.org>

Reviewers: Damien Diederen <dd@crosstwine.com>,Andor Molnar <andor@apache.org>,Christopher Tubbs <ctubbsii@apache.org>,Mohammad Arshad <arshad@apache.org>

Closes #1599 from amichair/ZOOKEEPER-4205
---
 .../java/org/apache/zookeeper/server/X509AuthFailureTest.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
index dc3394d1754..5af4f1095dc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
@@ -47,6 +47,7 @@ public void setup() throws Exception{
         System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
         System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
         System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty("zookeeper.admin.serverPort", "" + PortAssignment.unique());
     }
 
     @AfterEach
@@ -58,6 +59,7 @@ public void teardown() throws Exception {
         System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
         System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
         System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty("zookeeper.admin.serverPort");
         clientX509Util.close();
     }
 
@@ -94,4 +96,4 @@ private ZooKeeper createZKClnt(String cxnString) throws Exception {
         return zk;
     }
 
-}
\ No newline at end of file
+}

From 0b6862e3aadbb8980a09a673c08c438ae5da2e81 Mon Sep 17 00:00:00 2001
From: Norbert Kalmar <nkalmar@apache.org>
Date: Thu, 25 Mar 2021 09:48:24 +0000
Subject: [PATCH 190/591] ZOOKEEPER-4259: Allow AdminServer to force https

Initial commit to allow adminServer to only serve HTTPS requests
Questions:
-Is this fine that I stayed with portunification, or should we have a seperate secure port?

Author: Norbert Kalmar <nkalmar@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Enrico Olivelli <eolivelli@apache.org>

Closes #1652 from nkalmar/ZOOKEEPER-2512
---
 .../main/resources/markdown/zookeeperAdmin.md |  9 +++++
 .../server/admin/JettyAdminServer.java        | 23 +++++++++----
 .../server/admin/JettyAdminServerTest.java    | 33 +++++++++++++++++++
 3 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index cc34ddb40cf..af659ea75b0 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2025,6 +2025,15 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
 
 #### AdminServer configuration
 
+**New in 3.7.1:** The following
+options are used to configure the [AdminServer](#sc_adminserver).
+
+* *admin.forceHttps* :
+  (Java system property: **zookeeper.admin.forceHttps**)
+  Force AdminServer to use SSL, thus allowing only HTTPS traffic.
+  Defaults to disabled.
+  Overwrites **admin.portUnification** settings.
+
 **New in 3.6.0:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index aa18cfb5994..d2c72178687 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -40,6 +40,7 @@
 import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.server.SslConnectionFactory;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
 import org.eclipse.jetty.util.security.Constraint;
@@ -85,7 +86,8 @@ public JettyAdminServer() throws AdminServerException, IOException, GeneralSecur
             Integer.getInteger("zookeeper.admin.idleTimeout", DEFAULT_IDLE_TIMEOUT),
             System.getProperty("zookeeper.admin.commandURL", DEFAULT_COMMAND_URL),
             Integer.getInteger("zookeeper.admin.httpVersion", DEFAULT_HTTP_VERSION),
-            Boolean.getBoolean("zookeeper.admin.portUnification"));
+            Boolean.getBoolean("zookeeper.admin.portUnification"),
+            Boolean.getBoolean("zookeeper.admin.forceHttps"));
     }
 
     public JettyAdminServer(
@@ -94,7 +96,8 @@ public JettyAdminServer(
         int timeout,
         String commandUrl,
         int httpVersion,
-        boolean portUnification) throws IOException, GeneralSecurityException {
+        boolean portUnification,
+        boolean forceHttps) throws IOException, GeneralSecurityException {
 
         this.port = port;
         this.idleTimeout = timeout;
@@ -104,7 +107,7 @@ public JettyAdminServer(
         server = new Server();
         ServerConnector connector = null;
 
-        if (!portUnification) {
+        if (!portUnification && !forceHttps) {
             connector = new ServerConnector(server);
         } else {
             SecureRequestCustomizer customizer = new SecureRequestCustomizer();
@@ -140,10 +143,16 @@ public JettyAdminServer(
                 sslContextFactory.setTrustStore(trustStore);
                 sslContextFactory.setTrustStorePassword(certAuthPassword);
 
-                connector = new ServerConnector(
-                    server,
-                    new UnifiedConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
-                    new HttpConnectionFactory(config));
+                if (forceHttps) {
+                    connector = new ServerConnector(server,
+                            new SslConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
+                            new HttpConnectionFactory(config));
+                } else {
+                    connector = new ServerConnector(
+                            server,
+                            new UnifiedConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
+                            new HttpConnectionFactory(config));
+                }
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 7e7f04951d3..9cafebbc7e9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -20,11 +20,13 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.net.HttpURLConnection;
+import java.net.SocketException;
 import java.net.URL;
 import java.security.GeneralSecurityException;
 import java.security.Security;
@@ -143,6 +145,7 @@ public void cleanUp() {
         System.clearProperty("zookeeper.ssl.quorum.trustStore.password");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.type");
         System.clearProperty("zookeeper.admin.portUnification");
+        System.clearProperty("zookeeper.admin.forceHttps");
     }
 
     /**
@@ -234,6 +237,36 @@ public void testQuorum() throws Exception {
                 "waiting for server 2 down");
     }
 
+    @Test
+    public void testForceHttpsPortUnificationEnabled() throws Exception {
+        testForceHttps(true);
+    }
+
+    @Test
+    public void testForceHttpsPortUnificationDisabled() throws Exception {
+        testForceHttps(false);
+    }
+
+    private void testForceHttps(boolean portUnification) throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.admin.portUnification", String.valueOf(portUnification));
+        boolean httpsPassed = false;
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+            queryAdminServer(String.format(HTTPS_URL_FORMAT, jettyAdminPort), true);
+            httpsPassed = true;
+            queryAdminServer(String.format(URL_FORMAT, jettyAdminPort), false);
+            fail("http call should have failed since forceHttps=true");
+        } catch (SocketException se) {
+            //good
+        } finally {
+            server.shutdown();
+        }
+        assertTrue(httpsPassed);
+    }
+
     /**
      * Check that we can load the commands page of an AdminServer running at
      * localhost:port. (Note that this should work even if no zk server is set.)

From 461aada6b015078b9a14f787dd1f526488490df9 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Thu, 25 Mar 2021 10:21:31 +0000
Subject: [PATCH 191/591] ZOOKEEPER-4251: Flaky test:
 org.apache.zookeeper.test.WatcherTest

Moved ReconfigTest in test suites in the last to avoid the ReconfigTest test impacts on other test classes

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1649 from arshadmohammad/ZOOKEEPER-4251-master
---
 .../java/org/apache/zookeeper/test/NettyNettySuiteTest.java     | 2 +-
 .../test/java/org/apache/zookeeper/test/NioNettySuiteTest.java  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
index 375fafe4a56..411aae24a47 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
@@ -26,7 +26,7 @@
  * Run tests with: Netty Client against Netty server
  */
 @RunWith(JUnitPlatform.class)
-@SelectClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, ReconfigTest.class, SessionTest.class, WatcherTest.class})
+@SelectClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, SessionTest.class, WatcherTest.class, ReconfigTest.class})
 public class NettyNettySuiteTest extends NettyNettySuiteBase {
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java
index 397eb487066..24fc60a2d36 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java
@@ -23,7 +23,7 @@
 /**
  * Run tests with: Nio Client against Netty server
  */
-@Suite.SuiteClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, ReconfigTest.class, SessionTest.class, WatcherTest.class})
+@Suite.SuiteClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, SessionTest.class, WatcherTest.class, ReconfigTest.class})
 public class NioNettySuiteTest extends NioNettySuiteBase {
 
 }

From 51be692523b65afc21cfb0edaa4a5e60ab996aa2 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sat, 27 Mar 2021 22:41:02 +0530
Subject: [PATCH 192/591] ZOOKEEPER-3887: In SSL-only server zkServer.sh status
 command should use secureClientPortAddress instead of clientPortAddress

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1654 from arshadmohammad/ZOOKEEPER-3887-master
---
 bin/zkServer.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index c91216b364c..1a3cd359c27 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -276,6 +276,11 @@ status)
       if [ "$secureClientPort" ] ; then
         isSSL="true"
         clientPort=$secureClientPort
+        clientPortAddress=`$GREP "^[[:space:]]*secureClientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
+        if ! [ $clientPortAddress ]
+        then
+            clientPortAddress="localhost"
+        fi
       else
         echo "Unable to find either secure or unsecure client port in any configs. Terminating."
         exit 1

From de726d0a824582e482d4a725210fcd6051cb3bd0 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sat, 27 Mar 2021 22:53:02 +0530
Subject: [PATCH 193/591] ZOOKEEPER-3128: Get CLI Command displays
 Authentication error for Authorization error

Handled the scenario missed in ZOOKEEPER-3891

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Damien Diederen <dd@crosstwine.com>

Closes #1634 from arshadmohammad/ZOOKEEPER-3128-master
---
 .../src/main/java/org/apache/zookeeper/cli/GetCommand.java | 2 +-
 .../src/test/java/org/apache/zookeeper/ZooKeeperTest.java  | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
index 4cdb48d7baf..a10272e6b3a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
@@ -90,7 +90,7 @@ public boolean exec() throws CliException {
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException | InterruptedException ex) {
-            throw new CliException(ex);
+            throw new CliWrapperException(ex);
         }
         data = (data == null) ? "null".getBytes() : data;
         out.println(new String(data, UTF_8));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index f69e0c683fb..47ab6c44eb3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -702,6 +702,13 @@ public void testInsufficientPermission() throws Exception {
         String zNodeToBeCreated = "/permZNode/child1";
         String errorMessage = executeLine(zkMain, "create " + zNodeToBeCreated);
         assertEquals("Insufficient permission : " + zNodeToBeCreated, errorMessage);
+
+        // Test Get command error message when there is not read access
+        List<ACL> writeAcl = Arrays.asList(new ACL(ZooDefs.Perms.WRITE, Ids.ANYONE_ID_UNSAFE));
+        String noReadPermZNodePath = "/noReadPermZNode";
+        zk.create(noReadPermZNodePath, "newData".getBytes(), writeAcl, CreateMode.PERSISTENT);
+        errorMessage = executeLine(zkMain, "get " + noReadPermZNodePath);
+        assertEquals("Insufficient permission : " + noReadPermZNodePath, errorMessage);
     }
 
     @Test

From 4edbbea5566925390b32702a97c17f7a76e32de5 Mon Sep 17 00:00:00 2001
From: brentwritescode <brentwritescode@gmail.com>
Date: Sat, 27 Mar 2021 23:30:11 +0530
Subject: [PATCH 194/591] ZOOKEEPER-4194: ZooInspector throws
 NullPointerExceptions to console when node data is null This is a very minor
 fix to a NullPointerException present in the ZooInspector utility which
 prevents a NullPointerException getting thrown when ZooInspector inspects an
 empty node.

Author: brentwritescode <brentwritescode@gmail.com>

Reviewers: Damien Diederen <dd@crosstwine.com>, Mohammad Arshad <arshad@apache.org>

Closes #1601 from brentwritescode/ZOOKEEPER-4194
---
 .../inspector/encryption/BasicDataEncryptionManager.java       | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java
index a9e5ac477cf..c8662db62d1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java
@@ -30,6 +30,9 @@ public class BasicDataEncryptionManager implements DataEncryptionManager {
      * (byte[])
      */
     public String decryptData(byte[] encrypted) throws Exception {
+        if(encrypted == null) {
+            return "";
+        }
         return new String(encrypted);
     }
 

From 670da71f121ec532b262de39496042cefccf2120 Mon Sep 17 00:00:00 2001
From: Abhilash Kishore <abkishore@linkedin.com>
Date: Sun, 28 Mar 2021 10:01:11 +0800
Subject: [PATCH 195/591] ZOOKEEPER-4231: Add documentation about snapshot
 compression.

This PR adds documentation about ZooKeeper's snapshot compression feature (see [ZOOKEEPER-3179](https://issues.apache.org/jira/browse/ZOOKEEPER-3179)).

Author: Abhilash Kishore <abkishore@linkedin.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>, maoling <maoling@apache.org>

Closes #1640 from abhilash1in/ZOOKEEPER-4231
---
 .../src/main/resources/markdown/zookeeperAdmin.md     | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index af659ea75b0..487e3027e1d 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1097,6 +1097,16 @@ property, when available, is noted below.
 
     By default, this feature is enabled, set "false" to disable it.
 
+* *snapshot.compression.method* :
+    (Java system property: **zookeeper.snapshot.compression.method**)
+    **New in 3.6.0:**
+    This property controls whether or not ZooKeeper should compress snapshots
+    before storing them on disk (see [ZOOKEEPER-3179](https://issues.apache.org/jira/browse/ZOOKEEPER-3179)).
+    Possible values are:
+    - "": Disabled (no snapshot compression). This is the default behavior.
+    - "gz": See [gzip compression](https://en.wikipedia.org/wiki/Gzip).
+    - "snappy": See [Snappy compression](https://en.wikipedia.org/wiki/Snappy_(compression)).
+
 * *snapshot.trust.empty* :
     (Java system property: **zookeeper.snapshot.trust.empty**)
     **New in 3.5.6:**
@@ -1110,6 +1120,7 @@ property, when available, is noted below.
     and restart ZooKeeper process so ZooKeeper can continue normal data
     consistency check during recovery process.
     Default value is false.
+
 * *audit.enable* :
     (Java system property: **zookeeper.audit.enable**)
     **New in 3.6.0:**

From acbfb2d78996cbaa29b9dc764d4cb3463193dc45 Mon Sep 17 00:00:00 2001
From: Ayush Mantri <aayushmantri@gmail.com>
Date: Sun, 28 Mar 2021 10:05:40 +0530
Subject: [PATCH 196/591] ZOOKEEPER-4257: learner.asyncSending,
 learner.closeSocketAsync and leader.closeSocketAsync should be configurable
 in zoo.cfg

Properties learner.asyncSending , learner.closeSocketAsync  and leader.closeSocketAsync  made configurable in zoo.cfg

Author: Ayush Mantri <aayushmantri@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1645 from ayushmantri/ZK-4257 and squashes the following commits:

8ff5523c3 [Ayush Mantri] ZOOKEEPER-4257: learner.asyncSending and learner.closeSocketAsync should be configurable in zoo.cfg                 property name change done in backward compatible way
592931232 [Ayush Mantri] ZOOKEEPER-4257: learner.asyncSending and learner.closeSocketAsync should be configurable in zoo.cfg
---
 .../main/resources/markdown/zookeeperAdmin.md | 23 +++++++---
 .../zookeeper/server/quorum/Learner.java      | 11 +++--
 .../server/quorum/LearnerHandler.java         |  7 +++-
 .../zookeeper/server/util/ConfigUtils.java    | 25 +++++++++++
 .../server/util/ConfigUtilsTest.java          | 42 +++++++++++++++++++
 5 files changed, 96 insertions(+), 12 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 487e3027e1d..9fefadf358e 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1162,14 +1162,25 @@ property, when available, is noted below.
     When set to 0, no requests will be throttled. The default is 0.
 
 * *learner.closeSocketAsync*
-    (Jave system property only: **learner.closeSocketAsync**)
-    **New in 3.6.2:**
-    When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailabe. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. The default is false.
+  (Java system property: **zookeeper.learner.closeSocketAsync**)
+  (Java system property: **learner.closeSocketAsync**)(Added for backward compatibility)
+    **New in 3.7.0:**
+    When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailabe. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. 
+    The default is false.
 
 * *leader.closeSocketAsync*
-   (Java system property only: **leader.closeSocketAsync**)
-   **New in 3.6.2:**
-   When enabled, the leader will close a quorum socket asynchoronously. This is useful for TLS connections where closing a socket might take a long time. If disconnecting a follower is initiated in ping() because of a failed SyncLimitCheck then the long socket closing time will block the sending of pings to other followers. Without receiving pings, the other followers will not send session information to the leader, which causes sessions to expire. Setting this flag to true ensures that pings will be sent regularly. The default is false.
+  (Java system property: **zookeeper.leader.closeSocketAsync**)
+  (Java system property: **leader.closeSocketAsync**)(Added for backward compatibility)
+   **New in 3.7.0:**
+   When enabled, the leader will close a quorum socket asynchoronously. This is useful for TLS connections where closing a socket might take a long time. If disconnecting a follower is initiated in ping() because of a failed SyncLimitCheck then the long socket closing time will block the sending of pings to other followers. Without receiving pings, the other followers will not send session information to the leader, which causes sessions to expire. Setting this flag to true ensures that pings will be sent regularly.
+   The default is false.
+
+* *learner.asyncSending*
+  (Java system property: **zookeeper.learner.asyncSending**)
+  (Java system property: **learner.asyncSending**)(Added for backward compatibility)
+  **New in 3.7.0:**
+  The sending and receiving packets in Learner were done synchronously in a critical section. An untimely network issue could cause the followers to hang (see [ZOOKEEPER-3575](https://issues.apache.org/jira/browse/ZOOKEEPER-3575) and [ZOOKEEPER-4074](https://issues.apache.org/jira/browse/ZOOKEEPER-4074)). The new design moves sending packets in Learner to a separate thread and sends the packets asynchronously. The new design is enabled with this parameter (learner.asyncSending).
+  The default is false.
 
 * *forward_learner_requests_to_commit_processor_disabled*
     (Jave system property: **zookeeper.forward_learner_requests_to_commit_processor_disabled**)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 8f3d00c77ea..594c87fb90d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -58,6 +58,7 @@
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
+import org.apache.zookeeper.server.util.ConfigUtils;
 import org.apache.zookeeper.server.util.MessageTracker;
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
@@ -118,10 +119,12 @@ public Socket getSocket() {
 
     private static final boolean nodelay = System.getProperty("follower.nodelay", "true").equals("true");
 
-    public static final String LEARNER_ASYNC_SENDING = "learner.asyncSending";
-    private static boolean asyncSending = Boolean.getBoolean(LEARNER_ASYNC_SENDING);
-    public static final String LEARNER_CLOSE_SOCKET_ASYNC = "learner.closeSocketAsync";
-    public static final boolean closeSocketAsync = Boolean.getBoolean(LEARNER_CLOSE_SOCKET_ASYNC);
+    public static final String LEARNER_ASYNC_SENDING = "zookeeper.learner.asyncSending";
+    private static boolean asyncSending =
+        Boolean.parseBoolean(ConfigUtils.getPropertyBackwardCompatibleWay(LEARNER_ASYNC_SENDING));
+    public static final String LEARNER_CLOSE_SOCKET_ASYNC = "zookeeper.learner.closeSocketAsync";
+    public static final boolean closeSocketAsync = Boolean
+        .parseBoolean(ConfigUtils.getPropertyBackwardCompatibleWay(LEARNER_CLOSE_SOCKET_ASYNC));
 
     static {
         LOG.info("leaderConnectDelayDuringRetryMs: {}", leaderConnectDelayDuringRetryMs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index f7f12dcde47..259d9fff915 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -51,6 +51,7 @@
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthServer;
+import org.apache.zookeeper.server.util.ConfigUtils;
 import org.apache.zookeeper.server.util.MessageTracker;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.slf4j.Logger;
@@ -65,8 +66,10 @@ public class LearnerHandler extends ZooKeeperThread {
 
     private static final Logger LOG = LoggerFactory.getLogger(LearnerHandler.class);
 
-    public static final String LEADER_CLOSE_SOCKET_ASYNC = "leader.closeSocketAsync";
-    public static final boolean closeSocketAsync = Boolean.parseBoolean(System.getProperty(LEADER_CLOSE_SOCKET_ASYNC, "false"));
+    public static final String LEADER_CLOSE_SOCKET_ASYNC = "zookeeper.leader.closeSocketAsync";
+
+    public static final boolean closeSocketAsync = Boolean
+        .parseBoolean(ConfigUtils.getPropertyBackwardCompatibleWay(LEADER_CLOSE_SOCKET_ASYNC));
 
     static {
         LOG.info("{} = {}", LEADER_CLOSE_SOCKET_ASYNC, closeSocketAsync);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
index 508dc112565..d6f75729798 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
@@ -95,4 +95,29 @@ public static String[] getHostAndPort(String s) throws ConfigException {
         }
     }
 
+    /**
+     * Some old configuration properties are not configurable in zookeeper configuration file
+     * zoo.cfg. To make these properties configurable in zoo.cfg old properties are prepended
+     * with zookeeper. For example prop.x.y.z changed to zookeeper.prop.x.y.z. But for backward
+     * compatibility both prop.x.y.z and zookeeper.prop.x.y.z should be supported.
+     * This method first gets value from new property, if first property is not configured
+     * then gets value from old property
+     *
+     * @param newPropertyKey new property key which starts with zookeeper.
+     * @return either new or old system property value. Null if none of the properties are set.
+     */
+    public static String getPropertyBackwardCompatibleWay(String newPropertyKey) {
+        String newKeyValue = System.getProperty(newPropertyKey);
+        if (newKeyValue != null) {
+            return newKeyValue.trim();
+        }
+        String oldPropertyKey = newPropertyKey.replace("zookeeper.", "");
+        String oldKeyValue = System.getProperty(oldPropertyKey);
+
+        if (oldKeyValue != null) {
+            return oldKeyValue.trim();
+        }
+        return null;
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
index 4b293a09aef..e70c45ce40e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.util;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.junit.jupiter.api.Test;
@@ -74,4 +75,45 @@ public void testGetHostAndPortWithoutPort() throws ConfigException {
         assertEquals(nsa.length, 1);
     }
 
+    @Test
+    public void testGetPropertyBackwardCompatibleWay() throws ConfigException {
+        String newProp = "zookeeper.prop.x.y.z";
+        String oldProp = "prop.x.y.z";
+
+        // Null as both properties are not set
+        String result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertNull(result);
+
+        // Return old property value when only old property is set
+        String oldPropValue = "oldPropertyValue";
+        System.setProperty(oldProp, oldPropValue);
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(oldPropValue, result);
+
+        // Return new property value when both properties are set
+        String newPropValue = "newPropertyValue";
+        System.setProperty(newProp, newPropValue);
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(newPropValue, result);
+
+        // cleanUp
+        clearProp(newProp, oldProp);
+
+        // Return trimmed value
+        System.setProperty(oldProp, oldPropValue + "  ");
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(oldPropValue, result);
+
+        System.setProperty(newProp, "  " + newPropValue);
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(newPropValue, result);
+
+        // cleanUp
+        clearProp(newProp, oldProp);
+    }
+
+    private void clearProp(String newProp, String oldProp) {
+        System.clearProperty(newProp);
+        System.clearProperty(oldProp);
+    }
 }

From 3961bcc7d6eabfe0723c9dab653d9bb83da7f8f8 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Tue, 30 Mar 2021 16:56:40 +0530
Subject: [PATCH 197/591] ZOOKEEPER-4270: Flaky test:
 QuorumPeerMainTest#testLeaderOutOfView

The test case is expecting node3 to be leader but node2 sometimes becomes leader. This happens because leader election completes between node1 and node2 which is valid.
Changed the expectations when node2 is leader otherwise kept the same expectations

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1666 from arshadmohammad/ZOOKEEPER-4270-master
---
 .../server/quorum/QuorumPeerMainTest.java     | 34 +++++++++++++++----
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index bc00d213308..724356e01d0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -903,11 +903,26 @@ public void testLeaderOutOfView() throws Exception {
                         "waiting for server to start");
             }
 
-            assertTrue(svrs.mt[0].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.LOOKING);
-            assertTrue(svrs.mt[highestServerIndex].getQuorumPeer().getPeerState()
-                                      == QuorumPeer.ServerState.LEADING);
+            // Expecting that only 3 node will be leader is wrong, even 2 node can be leader, when cluster is formed with 1 node
+            boolean firstAndSecondNodeFormedCluster = false;
+            if (QuorumPeer.ServerState.LEADING == svrs.mt[1].getQuorumPeer().getPeerState()) {
+                assertEquals(QuorumPeer.ServerState.FOLLOWING,
+                    svrs.mt[0].getQuorumPeer().getPeerState());
+                assertEquals(QuorumPeer.ServerState.FOLLOWING,
+                    svrs.mt[highestServerIndex].getQuorumPeer().getPeerState());
+                firstAndSecondNodeFormedCluster = true;
+            } else {
+                // Verify leader out of view scenario
+                assertEquals(QuorumPeer.ServerState.LOOKING,
+                    svrs.mt[0].getQuorumPeer().getPeerState());
+                assertEquals(QuorumPeer.ServerState.LEADING,
+                    svrs.mt[highestServerIndex].getQuorumPeer().getPeerState());
+            }
             for (int i = 1; i < highestServerIndex; i++) {
-                assertTrue(svrs.mt[i].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.FOLLOWING);
+                assertTrue(
+                    svrs.mt[i].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.FOLLOWING
+                        || svrs.mt[i].getQuorumPeer().getPeerState()
+                        == QuorumPeer.ServerState.LEADING);
             }
 
             // Look through the logs for output that indicates Node 1 is LEADING or FOLLOWING
@@ -920,13 +935,18 @@ public void testLeaderOutOfView() throws Exception {
                 foundLeading = leading.matcher(line).matches();
                 foundFollowing = following.matcher(line).matches();
             }
+            if (firstAndSecondNodeFormedCluster) {
+                assertTrue(foundFollowing,
+                    "Corrupt peer should join quorum with servers having same server configuration");
+            } else {
+                assertFalse(foundLeading, "Corrupt peer should never become leader");
+                assertFalse(foundFollowing,
+                    "Corrupt peer should not attempt connection to out of view leader");
+            }
 
         } finally {
             qlogger.removeAppender(appender);
         }
-
-        assertFalse(foundLeading, "Corrupt peer should never become leader");
-        assertFalse(foundFollowing, "Corrupt peer should not attempt connection to out of view leader");
     }
 
     @Test

From 9213f7353b1e6ce4d0fdbc1dca963ace1fd32cec Mon Sep 17 00:00:00 2001
From: Ayush Mantri <aayushmantri@gmail.com>
Date: Wed, 31 Mar 2021 19:04:23 +0530
Subject: [PATCH 198/591] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due
 to security vulnerability CVE-2021-21295

Upgraded Netty library to 4.1.60

Author: Ayush Mantri <aayushmantri@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1669 from ayushmantri/ZOOKEEPER-4272
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.60.Final.LICENSE.txt} | 0
 ...9.Final.LICENSE.txt => netty-codec-4.1.60.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.60.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.60.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.60.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.60.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.60.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.59.Final.LICENSE.txt => netty-buffer-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.59.Final.LICENSE.txt => netty-codec-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.59.Final.LICENSE.txt => netty-common-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.59.Final.LICENSE.txt => netty-handler-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.59.Final.LICENSE.txt => netty-resolver-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.59.Final.LICENSE.txt => netty-transport-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.59.Final.LICENSE.txt => netty-transport-native-epoll-4.1.60.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 8782ad77322..47c20dadd8f 100755
--- a/pom.xml
+++ b/pom.xml
@@ -467,7 +467,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.59.Final</netty.version>
+    <netty.version>4.1.60.Final</netty.version>
     <jetty.version>9.4.38.v20210224</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.60.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.59.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt

From cdddda4c55acf29d4e0b2bc8f3de7b5c676e8ffc Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Thu, 1 Apr 2021 02:52:49 +0530
Subject: [PATCH 199/591] ZOOKEEPER-4269: acceptedEpoch.tmp rename failure will
 cause server startup error

Using accepted epoch from acceptedEpoch.tmp if it is available

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>,Damien Diederen <dd@crosstwine.com>

Closes #1664 from arshadmohammad/ZOOKEEPER-4269-master and squashes the following commits:

d8ae084c1 [Mohammad Arshad] Handled review comments
a2cc9a5b6 [Mohammad Arshad] Added test cases
b56837e55 [Mohammad Arshad] ZOOKEEPER-4269: acceptedEpoch.tmp rename failure will cause server startup error Using accepted epoch from acceptedEpoch.tmp if it is available
---
 .../common/AtomicFileOutputStream.java        |   2 +-
 .../zookeeper/server/quorum/QuorumPeer.java   |  17 ++-
 .../quorum/CurrentEpochWriteFailureTest.java  | 118 ++++++++++++++++++
 3 files changed, 132 insertions(+), 5 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java
index 1574815f41a..d6b7cf6a419 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java
@@ -45,7 +45,7 @@
  */
 public class AtomicFileOutputStream extends FilterOutputStream {
 
-    private static final String TMP_EXTENSION = ".tmp";
+    public static final String TMP_EXTENSION = ".tmp";
 
     private static final Logger LOG = LoggerFactory.getLogger(AtomicFileOutputStream.class);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 19aae086027..5dea2016b88 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -52,6 +52,7 @@
 import javax.security.sasl.SaslException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.KeeperException.BadArgumentsException;
+import org.apache.zookeeper.common.AtomicFileOutputStream;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
 import org.apache.zookeeper.common.QuorumX509Util;
@@ -1163,10 +1164,18 @@ private void loadDataBase() {
                 writeLongToFile(CURRENT_EPOCH_FILENAME, currentEpoch);
             }
             if (epochOfZxid > currentEpoch) {
-                throw new IOException("The current epoch, "
-                                      + ZxidUtils.zxidToString(currentEpoch)
-                                      + ", is older than the last zxid, "
-                                      + lastProcessedZxid);
+                // acceptedEpoch.tmp file in snapshot directory
+                File currentTmp = new File(getTxnFactory().getSnapDir(),
+                    CURRENT_EPOCH_FILENAME + AtomicFileOutputStream.TMP_EXTENSION);
+                if (currentTmp.exists()) {
+                    long epochOfTmp = readLongFromFile(currentTmp.getName());
+                    LOG.info("{} found. Setting current epoch to {}.", currentTmp, epochOfTmp);
+                    setCurrentEpoch(epochOfTmp);
+                } else {
+                    throw new IOException(
+                        "The current epoch, " + ZxidUtils.zxidToString(currentEpoch)
+                            + ", is older than the last zxid, " + lastProcessedZxid);
+                }
             }
             try {
                 acceptedEpoch = readLongFromFile(ACCEPTED_EPOCH_FILENAME);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java
new file mode 100644
index 00000000000..ccd4d4961fb
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java
@@ -0,0 +1,118 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import org.apache.commons.io.FileUtils;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.AtomicFileOutputStream;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class CurrentEpochWriteFailureTest extends QuorumPeerTestBase {
+    protected static final Logger LOG = LoggerFactory.getLogger(CurrentEpochWriteFailureTest.class);
+    private Servers servers;
+    private int clientPort;
+
+    @AfterEach
+    public void tearDown() throws InterruptedException {
+        if (servers != null) {
+            servers.shutDownAllServers();
+        }
+    }
+
+    /*
+     * ZOOKEEPER-4269:
+     * accepted epoch is first written to temporary file acceptedEpoch.tmp then this file is
+     * renamed to acceptedEpoch.
+     * Failure, either because of exception or power-off, in renaming the acceptedEpoch.tmp file
+     * will cause server startup error with message "The current epoch, x, is older than the last
+     * zxid y"
+     * To handle this scenario we should read accepted epoch from this temp file as well.
+     */
+    @Test
+    public void testReadCurrentEpochFromAcceptedEpochTmpFile() throws Exception {
+        startServers();
+        writeSomeData();
+
+        restartServers();
+        writeSomeData();
+
+        MainThread firstServer = servers.mt[0];
+
+        // As started servers two times, current epoch must be two
+        long currentEpoch = firstServer.getQuorumPeer().getCurrentEpoch();
+        assertEquals(2, currentEpoch);
+
+        // Initialize files for later use
+        File snapDir = firstServer.getQuorumPeer().getTxnFactory().getSnapDir();
+        File currentEpochFile = new File(snapDir, QuorumPeer.CURRENT_EPOCH_FILENAME);
+        File currentEpochTempFile = new File(snapDir,
+            QuorumPeer.CURRENT_EPOCH_FILENAME + AtomicFileOutputStream.TMP_EXTENSION);
+
+        // Shutdown servers
+        servers.shutDownAllServers();
+        waitForAll(servers, ZooKeeper.States.CONNECTING);
+
+        // Create scenario of file currentEpoch.tmp rename to currentEpoch failure.
+        // In this case currentEpoch file will have old epoch and currentEpoch.tmp will have the latest epoch
+        FileUtils.write(currentEpochFile, Long.toString(currentEpoch - 1), "UTF-8");
+        FileUtils.write(currentEpochTempFile, Long.toString(currentEpoch), "UTF-8");
+
+        // Restart the serves, all serves should restart successfully.
+        servers.restartAllServersAndClients(this);
+
+        // Check the first server where problem was injected.
+        assertTrue(ClientBase
+                .waitForServerUp("127.0.0.1:" + firstServer.getClientPort(), CONNECTION_TIMEOUT),
+            "server " + firstServer.getMyid()
+                + " is not up as file currentEpoch.tmp rename to currentEpoch file was failed"
+                + " which lead current epoch inconsistent state.");
+    }
+
+    private void restartServers() throws InterruptedException, IOException {
+        servers.shutDownAllServers();
+        waitForAll(servers, ZooKeeper.States.CONNECTING);
+        servers.restartAllServersAndClients(this);
+        waitForAll(servers, ZooKeeper.States.CONNECTED);
+    }
+
+    private void writeSomeData() throws Exception {
+        ZooKeeper client = ClientBase.createZKClient("127.0.0.1:" + clientPort);
+        String path = "/somePath" + System.currentTimeMillis();
+        String data = "someData";
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    private void startServers() throws Exception {
+        servers = LaunchServers(3);
+        clientPort = servers.clientPorts[0];
+    }
+}

From ad5513b8dd15637c6c95585603a4e055dabad56d Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sat, 3 Apr 2021 11:42:31 +0000
Subject: [PATCH 200/591] ZOOKEEPER-4266: Correct ZooKeeper version in
 documentation header

Changed version from 3.6 to 3.8

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: maoling <maoling@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1659 from arshadmohammad/ZOOKEEPER-4266-master
---
 zookeeper-docs/src/main/resources/markdown/html/header.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/html/header.html b/zookeeper-docs/src/main/resources/markdown/html/header.html
index c529f880747..d0f291ace75 100644
--- a/zookeeper-docs/src/main/resources/markdown/html/header.html
+++ b/zookeeper-docs/src/main/resources/markdown/html/header.html
@@ -36,7 +36,7 @@
                 <a class="unselected" href="https://cwiki.apache.org/confluence/display/ZOOKEEPER/">Wiki</a>
             </li>
             <li class="current">
-                <a class="selected" href="index.html">ZooKeeper 3.6 Documentation</a>
+                <a class="selected" href="index.html">ZooKeeper 3.8 Documentation</a>
             </li>
         </ul>
     </div>

From 061438e83e61692fc9e06e057a739db5327d42b9 Mon Sep 17 00:00:00 2001
From: Ghatage <ghatageanup@gmail.com>
Date: Sun, 4 Apr 2021 14:39:26 +0800
Subject: [PATCH 201/591] ZOOKEEPER-3961: Improve error message for
 zookeeper.intBufferStartingSizeBytes config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

… verification.

Author: Ghatage <ghatageanup@gmail.com>

Reviewers: Damien Diederen <ddiederen@apache.org>, Andor Molnar <andor@apache.org>,Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, maoling <maoling@apache.org>

Closes #1495 from Ghatage/ZOOKEEPER-3961
---
 .../main/java/org/apache/zookeeper/server/ZooKeeperServer.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index f0e3c822653..72e55779cfe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -251,7 +251,7 @@ protected enum State {
         intBufferStartingSizeBytes = Integer.getInteger(INT_BUFFER_STARTING_SIZE_BYTES, DEFAULT_STARTING_BUFFER_SIZE);
 
         if (intBufferStartingSizeBytes < 32) {
-            String msg = "Buffer starting size must be greater than 0."
+            String msg = "Buffer starting size must be greater than or equal to 32."
                          + "Configure with \"-Dzookeeper.intBufferStartingSizeBytes=<size>\" ";
             LOG.error(msg);
             throw new IllegalArgumentException(msg);

From a10c6b4a78fa28b785d18cc973026da971bb4fe3 Mon Sep 17 00:00:00 2001
From: lan <1728209643@qq.com>
Date: Sun, 4 Apr 2021 14:55:50 +0800
Subject: [PATCH 202/591] ZOOKEEPER-4044: Remove unused method and variable

Author: lan <1728209643@qq.com>

Reviewers: maoling <maoling@apache.org>

Closes #1569 from lanicc/ZOOKEEPER-4044 and squashes the following commits:

987680396 [lan] ZOOKEEPER-4044: Remove unused variable in method `PrepRequestProcessor.pRequest2Txn`
646715bbe [lan] ZOOKEEPER-4044: Remove unused method in `FileSnap`
---
 .../zookeeper/server/PrepRequestProcessor.java   |  1 -
 .../zookeeper/server/persistence/FileSnap.java   | 16 ----------------
 2 files changed, 17 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 11b5ccbc8d3..513e0348224 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -323,7 +323,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                     Time.currentWallTime(), type));
         }
 
-        PrecalculatedDigest precalculatedDigest;
         switch (type) {
         case OpCode.create:
         case OpCode.create2:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index 4c092323857..00f9b02b894 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -265,22 +265,6 @@ public synchronized void serialize(
         }
     }
 
-    private void writeChecksum(CheckedOutputStream crcOut, OutputArchive oa) throws IOException {
-        long val = crcOut.getChecksum().getValue();
-        oa.writeLong(val, "val");
-        oa.writeString("/", "path");
-    }
-
-    private void checkChecksum(CheckedInputStream crcIn, InputArchive ia) throws IOException {
-        long checkSum = crcIn.getChecksum().getValue();
-        long val = ia.readLong("val");
-        // read and ignore "/" written by writeChecksum
-        ia.readString("path");
-        if (val != checkSum) {
-            throw new IOException("CRC corruption");
-        }
-    }
-
     /**
      * synchronized close just so that if serialize is in place
      * the close operation will block and will wait till serialize

From b08b6bb2ea7259face0df881dcbc9f5061a35d1e Mon Sep 17 00:00:00 2001
From: Norbert Kalmar <nkalmar@apache.org>
Date: Wed, 7 Apr 2021 23:10:01 +0530
Subject: [PATCH 203/591] ZOOKEEPER-4277: update jetty to 9.4.39 due to
 CVE-2021-28165

Author: Norbert Kalmar <nkalmar@apache.org>

Reviewers: Mohammad Arshad <arshad@apache.org>

Closes #1675 from nkalmar/master
---
 pom.xml                                                         | 2 +-
 ...0224.LICENSE.txt => jetty-http-9.4.39.v20210325.LICENSE.txt} | 0
 ...210224.LICENSE.txt => jetty-io-9.4.39.v20210325.LICENSE.txt} | 0
 ....LICENSE.txt => jetty-security-9.4.39.v20210325.LICENSE.txt} | 0
 ...24.LICENSE.txt => jetty-server-9.4.39.v20210325.LICENSE.txt} | 0
 ...4.LICENSE.txt => jetty-servlet-9.4.39.v20210325.LICENSE.txt} | 0
 ...0224.LICENSE.txt => jetty-util-9.4.39.v20210325.LICENSE.txt} | 0
 ...LICENSE.txt => jetty-util-ajax-9.4.39.v20210325.LICENSE.txt} | 0
 8 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.38.v20210224.LICENSE.txt => jetty-http-9.4.39.v20210325.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.38.v20210224.LICENSE.txt => jetty-io-9.4.39.v20210325.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.38.v20210224.LICENSE.txt => jetty-security-9.4.39.v20210325.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.38.v20210224.LICENSE.txt => jetty-server-9.4.39.v20210325.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.38.v20210224.LICENSE.txt => jetty-servlet-9.4.39.v20210325.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.38.v20210224.LICENSE.txt => jetty-util-9.4.39.v20210325.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.38.v20210224.LICENSE.txt => jetty-util-ajax-9.4.39.v20210325.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 47c20dadd8f..c2336bcd917 100755
--- a/pom.xml
+++ b/pom.xml
@@ -468,7 +468,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.60.Final</netty.version>
-    <jetty.version>9.4.38.v20210224</jetty.version>
+    <jetty.version>9.4.39.v20210325</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.39.v20210325.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.39.v20210325.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.39.v20210325.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.39.v20210325.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.39.v20210325.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.39.v20210325.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.38.v20210224.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.39.v20210325.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.38.v20210224.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.39.v20210325.LICENSE.txt

From 925b5b28a0aa9e7749da9672de92eab5b95578f0 Mon Sep 17 00:00:00 2001
From: Ayush Mantri <aayushmantri@gmail.com>
Date: Thu, 8 Apr 2021 19:49:08 +0530
Subject: [PATCH 204/591] ZOOKEEPER-4278: dependency-check:check failing -
 netty-transport-4.1.60.Final CVE-2021-21409

Upgraded Netty library to 4.1.63.Final

Author: Ayush Mantri <aayushmantri@gmail.com>

Reviewers: Mohammad Arshad <arshad@apache.org>

Closes #1678 from ayushmantri/ZOOKEEPER-4278
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.63.Final.LICENSE.txt} | 0
 ...0.Final.LICENSE.txt => netty-codec-4.1.63.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.63.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.63.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.63.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.63.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.63.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.60.Final.LICENSE.txt => netty-buffer-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.60.Final.LICENSE.txt => netty-codec-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.60.Final.LICENSE.txt => netty-common-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.60.Final.LICENSE.txt => netty-handler-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.60.Final.LICENSE.txt => netty-resolver-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.60.Final.LICENSE.txt => netty-transport-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.60.Final.LICENSE.txt => netty-transport-native-epoll-4.1.63.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index c2336bcd917..89cbfaf1566 100755
--- a/pom.xml
+++ b/pom.xml
@@ -467,7 +467,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.60.Final</netty.version>
+    <netty.version>4.1.63.Final</netty.version>
     <jetty.version>9.4.39.v20210325</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.63.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.60.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt

From 7fdadf7273f34dd0552db25a3771cf55b65e9208 Mon Sep 17 00:00:00 2001
From: Winbobob <zhu6@ncsu.edu>
Date: Sat, 10 Apr 2021 13:41:38 +0800
Subject: [PATCH 205/591] ZOOKEEPER-3764: Add High Availability Guarantee Into
 Docs

Include the formula for calculating the maximum number of server failures in the ZK doc.
> https://issues.apache.org/jira/browse/ZOOKEEPER-3764

Author: Winbobob <zhu6@ncsu.edu>

Reviewers: maoling <maoling@apache.org>

Closes #1661 from Winbobob/ZOOKEEPER-3764 and squashes the following commits:

40d7815e2 [Winbobob] Fix a typo
b9eda4dc1 [Winbobob] ZOOKEEPER-3764: Add High Availability Guarantee Into Docs
---
 .../main/resources/markdown/zookeeperAdmin.md | 29 ++++++++++++++-----
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 9fefadf358e..e6383fddb20 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -321,14 +321,27 @@ machine in your deployment.
 
 For the ZooKeeper service to be active, there must be a
 majority of non-failing machines that can communicate with
-each other. To create a deployment that can tolerate the
-failure of F machines, you should count on deploying 2xF+1
-machines.  Thus, a deployment that consists of three machines
-can handle one failure, and a deployment of five machines can
-handle two failures. Note that a deployment of six machines
-can only handle two failures since three machines is not a
-majority.  For this reason, ZooKeeper deployments are usually
-made up of an odd number of machines.
+each other. For a ZooKeeper ensemble with N servers,
+if N is odd, the ensemble is able to tolerate up to N/2
+server failures without losing any znode data;
+if N is even, the ensemble is able to tolerate up to N/2-1
+server failures.
+
+For example, if we have a ZooKeeper ensemble with 3 servers,
+the ensemble is able to tolerate up to 1 (3/2) server failures.
+If we have a ZooKeeper ensemble with 5 servers,
+the ensemble is able to tolerate up to 2 (5/2) server failures.
+If the ZooKeeper ensemble with 6 servers, the ensemble
+is also able to tolerate up to 2 (6/2-1) server failures
+without losing data and prevent the "brain split" issue.
+
+ZooKeeper ensemble is usually has odd number of servers.
+This is because with the even number of servers,
+the capacity of failure tolerance is the same as
+the ensemble with one less server
+(2 failures for both 5-node ensemble and 6-node ensemble),
+but the ensemble has to maintain extra connections and
+data transfers for one more server.
 
 To achieve the highest probability of tolerating a failure
 you should try to make machine failures independent. For

From ea75e1f63572fc72fb8520ba8c793523047acb49 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Wed, 14 Apr 2021 22:22:09 +0530
Subject: [PATCH 206/591] ZOOKEEPER-4247: NPE while processing message from
 restarted quorum member

When a ZooKeeper server realizes that an other quorum peer was shut down (e.g. during a rolling upgrade or
rolling restart), the ServerCnxn.zkServer variable is set to null by QuorumPear.close(). This is why in the code
we usually check the zkServer variable before using it. But this check was missing in one place thus causing
NPE in NettyServerCnx.receiveMessage:

```
2021-02-08T12:42:08.229+0000 [myid:] - ERROR
[nioEventLoopGroup-4-1:NettyServerCnxnFactory$CnxnChannelHandler329]- Unexpected exception in receive
 java.lang.NullPointerException: null ~[zookeeper-3.6.2.jar:3.6.2]
 at org.apache.zookeeper.server.NettyServerCnxn.receiveMessage(NettyServerCnxn.java:518)
 at org.apache.zookeeper.server.NettyServerCnxn.processMessage(NettyServerCnxn.java:368)
 at org.apache.zookeeper.server.NettyServerCnxnFactory
        $CnxnChannelHandler.channelRead(NettyServerCnxnFactory.java:326)
...
```

In this commit we add the necessary check and (after throwing an IOException) we will basically ignore the
processing of the received message when the remote ZooKeeper server is already down.

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1681 from symat/ZOOKEEPER-4247 and squashes the following commits:

7b140177d [Mate Szalay-Beko] ZOOKEEPER-4247: address PR comments
b99ee986b [Mate Szalay-Beko] ZOOKEEPER-4247: address PR comments
3c8478a40 [Mate Szalay-Beko] ZOOKEEPER-4247: fix NPE happens while processing messages during quorum member restart
---
 .../java/org/apache/zookeeper/server/NettyServerCnxn.java   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 110807a4cf5..269fcd942cc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -520,8 +520,12 @@ private void receiveMessage(ByteBuf message) {
                         if (len < 0 || len > BinaryInputArchive.maxBuffer) {
                             throw new IOException("Len error " + len);
                         }
+                        ZooKeeperServer zks = this.zkServer;
+                        if (zks == null || !zks.isRunning()) {
+                            throw new IOException("ZK down");
+                        }
                         // checkRequestSize will throw IOException if request is rejected
-                        zkServer.checkRequestSizeWhenReceivingMessage(len);
+                        zks.checkRequestSizeWhenReceivingMessage(len);
                         bb = ByteBuffer.allocate(len);
                     }
                 }

From c583a6e79654359b5daad5093d1730e370d3b75b Mon Sep 17 00:00:00 2001
From: Ravi Kishore Valeti <v.ravikishore@gmail.com>
Date: Mon, 19 Apr 2021 06:46:15 +0000
Subject: [PATCH 207/591] ZOOKEEPER-4275: Prevent unnecessary client connection
 retry caused by slow SASL login

Slowness in sasl login or subject.doAs() causes zk client to falsely assume that the server did not respond, closes connection and goes to unnecessary retries.

Raising the PR for master - approved for 3.5 branch already.

Author: Ravi Kishore Valeti <v.ravikishore@gmail.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1685 from rvaleti/ZOOKEEPER-4275_master
---
 .../src/main/java/org/apache/zookeeper/ClientCnxn.java          | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 1ff4512156b..a516d84ad04 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1198,6 +1198,8 @@ public void run() {
                         }
                         onConnecting(serverAddress);
                         startConnect(serverAddress);
+                        // Update now to start the connection timer right after we make a connection attempt
+                        clientCnxnSocket.updateNow();
                         clientCnxnSocket.updateLastSendAndHeard();
                     }
 

From 1590a424cb7a8768b0ae01f2957856b1834dd68d Mon Sep 17 00:00:00 2001
From: Huizhi Lu <5187721+pkuwm@users.noreply.github.com>
Date: Wed, 21 Apr 2021 10:07:24 +0200
Subject: [PATCH 208/591] ZOOKEEPER-4281: Allow packet of max packet length to
 be deserialized

### Problem
Resolves https://issues.apache.org/jira/browse/ZOOKEEPER-4281

There are sanity checks for packet size when deserializing a packet. One place has the inclusion: len >= packetLen.  It rejects to deserialize the bytes that are exactly sized jute.maxbuffer. It's confusing. This check should use ">" so the maxbuffer length packet can still be deserialized, like the other checks.
```
if (len < 0 || len >= packetLen) {
    throw new IOException("Packet len " + len + " is out of range!");
}
```

### Solution
Change: `len >= packetLen`   ->  `len > packetLen`
```
if (len < 0 || len > packetLen) {
```

Author: Huizhi Lu <5187721+pkuwm@users.noreply.github.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>, Michael Han <hanm@apache.org>

Closes #1683 from pkuwm/maxPacketLength
---
 .../apache/zookeeper/ClientCnxnSocket.java    |  2 +-
 .../zookeeper/ClientCnxnSocketTest.java       | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
index 315d81feb8b..9b53107e3d7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
@@ -117,7 +117,7 @@ void updateLastSendAndHeard() {
 
     void readLength() throws IOException {
         int len = incomingBuffer.getInt();
-        if (len < 0 || len >= packetLen) {
+        if (len < 0 || len > packetLen) {
             throw new IOException("Packet len " + len + " is out of range!");
         }
         incomingBuffer = ByteBuffer.allocate(len);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
index a24b13fdffb..e707cb332d8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
@@ -63,4 +64,30 @@ public void testWhenInvalidJuteMaxBufferIsConfiguredIOExceptionIsThrown() {
 
     }
 
+    /*
+     * Tests readLength():
+     * 1. successfully read packet if length == jute.maxbuffer;
+     * 2. IOException is thrown if packet length is greater than jute.maxbuffer.
+     */
+    @Test
+    public void testIOExceptionIsThrownWhenPacketLenExceedsJuteMaxBuffer() throws IOException {
+        ClientCnxnSocket clientCnxnSocket = new ClientCnxnSocketNIO(new ZKClientConfig());
+
+        // Should successfully read packet length == jute.maxbuffer
+        int length = ZKClientConfig.CLIENT_MAX_PACKET_LENGTH_DEFAULT;
+        clientCnxnSocket.incomingBuffer.putInt(length);
+        clientCnxnSocket.incomingBuffer.rewind();
+        clientCnxnSocket.readLength();
+
+        // Failed to read packet length > jute.maxbuffer
+        length = ZKClientConfig.CLIENT_MAX_PACKET_LENGTH_DEFAULT + 1;
+        clientCnxnSocket.incomingBuffer.putInt(length);
+        clientCnxnSocket.incomingBuffer.rewind();
+        try {
+            clientCnxnSocket.readLength();
+            fail("IOException is expected.");
+        } catch (IOException e) {
+            assertEquals("Packet len " + length + " is out of range!", e.getMessage());
+        }
+    }
 }

From f8ebf1a25281b2c7f48e08011918c72643313209 Mon Sep 17 00:00:00 2001
From: "dk.technoboy" <guo.jiwei@immomo.com>
Date: Sun, 25 Apr 2021 13:12:20 +0800
Subject: [PATCH 209/591] ZOOKEEPER-3889: Add volatile for variable finished in
 ReadOnlyRequestProcessor

Author: dk.technoboy <guo.jiwei@immomo.com>

Reviewers: Michael Han <hanm@apache.org>, Christopher Tubbs <ctubbsii@apache.org>, maoling <maoling@apache.org>

Closes #1402 from Technoboy-/dev
---
 .../zookeeper/server/quorum/ReadOnlyRequestProcessor.java       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index e9728e92b9f..0e29ccfdf6f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -43,7 +43,7 @@ public class ReadOnlyRequestProcessor extends ZooKeeperCriticalThread implements
 
     private final LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
 
-    private boolean finished = false;
+    private volatile boolean finished = false;
 
     private final RequestProcessor nextProcessor;
 

From 96d87e2809f92460f182c66311d83d59f2ab96c3 Mon Sep 17 00:00:00 2001
From: fangxiao <fangxiao@kuaishou.com>
Date: Mon, 26 Apr 2021 20:20:36 +0800
Subject: [PATCH 210/591] ZOOKEEPER-4280: fix the log format in the
 DataTree#deserializeZxidDigest method

Author: fangxiao <fangxiao@kuaishou.com>

Reviewers: maoling <maoling@apache.org>

Closes #1686 from benecdict-fang/ZOOKEEPER-4280
---
 .../src/main/java/org/apache/zookeeper/server/DataTree.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 7e2e843f520..fc556a5f4ff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -1707,7 +1707,7 @@ public boolean deserializeZxidDigest(InputArchive ia, long startZxidOfSnapshot)
             if (zxidDigest.zxid > 0) {
                 digestFromLoadedSnapshot = zxidDigest;
                 LOG.info("The digest in the snapshot has digest version of {}, "
-                        + ", with zxid as 0x{}, and digest value as {}",
+                        + "with zxid as 0x{}, and digest value as {}",
                         digestFromLoadedSnapshot.digestVersion,
                         Long.toHexString(digestFromLoadedSnapshot.zxid),
                         digestFromLoadedSnapshot.digest);

From f5c29aab9adb49d9d3580074d4d1a805579fa20d Mon Sep 17 00:00:00 2001
From: fangxiao <benec.fx@gmail.com>
Date: Mon, 10 May 2021 19:24:24 +0800
Subject: [PATCH 211/591] ZOOKEEPER-4007: A typo in the
 ZKUtil#validateFileInput method

Author: fangxiao <benec.fx@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>,  maoling <maoling@apache.org>

Closes #1687 from benecdict-fang/ZOOKEEPER-4007
---
 zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java | 2 +-
 .../src/test/java/org/apache/zookeeper/ZKUtilTest.java          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index 2e29cc75c47..fd35ae39a5d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -163,7 +163,7 @@ public static String validateFileInput(String filePath) {
             return "Read permission is denied on the file '" + file.getAbsolutePath() + "'";
         }
         if (file.isDirectory()) {
-            return "'" + file.getAbsolutePath() + "' is a direcory. it must be a file.";
+            return "'" + file.getAbsolutePath() + "' is a directory. it must be a file.";
         }
         return null;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
index 190465386b6..1111c2a237a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
@@ -67,7 +67,7 @@ public void testValidateFileInputDirectory() throws Exception {
         String absolutePath = file.getAbsolutePath();
         String error = ZKUtil.validateFileInput(absolutePath);
         assertNotNull(error);
-        String expectedMessage = "'" + absolutePath + "' is a direcory. it must be a file.";
+        String expectedMessage = "'" + absolutePath + "' is a directory. it must be a file.";
         assertEquals(expectedMessage, error);
     }
 

From 766e173e9d51b6354920ebc136b246d221b87ec1 Mon Sep 17 00:00:00 2001
From: Martin Kellogg <kelloggm@cs.washington.edu>
Date: Sat, 15 May 2021 23:50:02 +0800
Subject: [PATCH 212/591] ZOOKEEPER-4246: Resource leaks in
 org.apache.zookeeper.server.persistence.SnapStream#getInputStream and
 #getOutputStream

Bug report is here: https://issues.apache.org/jira/browse/ZOOKEEPER-4246

This fix is simple: it just closes the possibly-leaked streams and re-throws the exception. We can't use a try-with-resources or a `finally` block here because in the happy case the resulting streams need to be returned open. I checked each of the other constructor calls in these methods, and none of the others can throw an exception as far as I can tell.

Author: Martin Kellogg <kelloggm@cs.washington.edu>

Reviewers: Andor Molnar <anmolnar@apache.org>, Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1638 from kelloggm/ZOOKEEPER-4246 and squashes the following commits:

fa1c0f08f [Martin Kellogg] surround whole switch with one try block instead of two inside the switch
f023851ba [Martin Kellogg] remove all the tabs for real
04c4b2fa6 [Martin Kellogg] fix accidental tab
e896efa6a [Martin Kellogg] ZOOKEEPER-4246: Resource leaks in org.apache.zookeeper.server.persistence.SnapStream#getInputStream and #getOutputStream
---
 .../server/persistence/SnapStream.java        | 36 ++++++++++++-------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
index e73df4351d4..9bc8ee5198b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
@@ -102,18 +102,23 @@ public static StreamMode fromString(String name) {
     public static CheckedInputStream getInputStream(File file) throws IOException {
         FileInputStream fis = new FileInputStream(file);
         InputStream is;
-        switch (getStreamMode(file.getName())) {
-        case GZIP:
-            is = new GZIPInputStream(fis);
-            break;
-        case SNAPPY:
-            is = new SnappyInputStream(fis);
-            break;
-        case CHECKED:
-        default:
-            is = new BufferedInputStream(fis);
+        try {
+            switch (getStreamMode(file.getName())) {
+                case GZIP:
+                    is = new GZIPInputStream(fis);
+                    break;
+                case SNAPPY:
+                    is = new SnappyInputStream(fis);
+                    break;
+                case CHECKED:
+                default:
+                    is = new BufferedInputStream(fis);
+            }
+            return new CheckedInputStream(is, new Adler32());
+        } catch (IOException e) {
+            fis.close();
+            throw e;
         }
-        return new CheckedInputStream(is, new Adler32());
     }
 
     /**
@@ -129,9 +134,16 @@ public static CheckedOutputStream getOutputStream(File file, boolean fsync) thro
         OutputStream os;
         switch (streamMode) {
         case GZIP:
-            os = new GZIPOutputStream(fos);
+            try {
+                os = new GZIPOutputStream(fos);
+            } catch (IOException e) {
+                fos.close();
+                throw e;
+            }
             break;
         case SNAPPY:
+            // Unlike SnappyInputStream, the SnappyOutputStream
+            // constructor cannot throw an IOException.
             os = new SnappyOutputStream(fos);
             break;
         case CHECKED:

From fdbba27088335c79fac4cc1751c06dcada1b8751 Mon Sep 17 00:00:00 2001
From: chenghuaqing <chenghuaqing123@126.com>
Date: Sun, 16 May 2021 12:58:38 +0800
Subject: [PATCH 213/591] ZOOKEEPER-4029: improve the log of FileTxnLog#append
 method

Author: chenghuaqing <chenghuaqing123@126.com>

Reviewers: maoling <maoling@apache.org>

Closes #1694 from seuCHENGHQ/ZOOKEEPER-4029
---
 .../org/apache/zookeeper/server/persistence/FileTxnLog.java    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index f25dde0d9e6..7d4366065df 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -43,6 +43,7 @@
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.server.TxnLogEntry;
@@ -276,7 +277,7 @@ public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest)
                 "Current zxid {} is <= {} for {}",
                 hdr.getZxid(),
                 lastZxidSeen,
-                hdr.getType());
+                Request.op2String(hdr.getType()));
         } else {
             lastZxidSeen = hdr.getZxid();
         }

From b79abb2014db9684c00afd7d98c0a7cb69ce6c8b Mon Sep 17 00:00:00 2001
From: shoothzj <shooothzj@gmail.com>
Date: Mon, 17 May 2021 23:10:41 +0800
Subject: [PATCH 214/591] ZOOKEEPER-4054: Make prometheus listen host can
 configure

Make prometheus listen host can configure listen IP, helpful to security. default is 0.0.0.0

Author: shoothzj <shooothzj@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1574 from Shoothzj/ZOOKEEPER-4054
---
 conf/zoo_sample.cfg                           |  1 +
 .../main/resources/markdown/zookeeperAdmin.md |  3 +
 .../prometheus/PrometheusMetricsProvider.java |  8 ++-
 .../PrometheusMetricsProviderConfigTest.java  | 66 +++++++++++++++++++
 .../PrometheusMetricsProviderTest.java        |  1 +
 5 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java

diff --git a/conf/zoo_sample.cfg b/conf/zoo_sample.cfg
index 24a97d720c8..f221675ee10 100644
--- a/conf/zoo_sample.cfg
+++ b/conf/zoo_sample.cfg
@@ -31,6 +31,7 @@ clientPort=2181
 #
 # https://prometheus.io Metrics Exporter
 #metricsProvider.className=org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider
+#metricsProvider.httpHost=0.0.0.0
 #metricsProvider.httpPort=7000
 #metricsProvider.exportJvmInfo=true
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index e6383fddb20..3ec44a20a7b 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2119,6 +2119,9 @@ options are used to configure the [AdminServer](#sc_adminserver).
     Set to "org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider" to
     enable Prometheus.io exporter.
 
+* *metricsProvider.httpHost* :
+    **New in 3.8.0:** Prometheus.io exporter will start a Jetty server and listen this address, default is "0.0.0.0"
+  
 * *metricsProvider.httpPort* :
     Prometheus.io exporter will start a Jetty server and bind to this port, it default to 7000.
     Prometheus end point will be http://hostname:httPort/metrics.
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index d3628a7c140..a3d5d7a392f 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -23,6 +23,7 @@
 import io.prometheus.client.exporter.MetricsServlet;
 import io.prometheus.client.hotspot.DefaultExports;
 import java.io.IOException;
+import java.net.InetSocketAddress;
 import java.util.Enumeration;
 import java.util.Objects;
 import java.util.Properties;
@@ -63,6 +64,7 @@ public class PrometheusMetricsProvider implements MetricsProvider {
      * </p>
      */
     private final CollectorRegistry collectorRegistry = CollectorRegistry.defaultRegistry;
+    private String host = "0.0.0.0";
     private int port = 7000;
     private boolean exportJvmInfo = true;
     private Server server;
@@ -72,6 +74,7 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     @Override
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
         LOG.info("Initializing metrics, configuration: {}", configuration);
+        this.host = configuration.getProperty("httpHost", "0.0.0.0");
         this.port = Integer.parseInt(configuration.getProperty("httpPort", "7000"));
         this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
     }
@@ -79,11 +82,12 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
     @Override
     public void start() throws MetricsProviderLifeCycleException {
         try {
-            LOG.info("Starting /metrics HTTP endpoint at port {} exportJvmInfo: {}", port, exportJvmInfo);
+            LOG.info("Starting /metrics HTTP endpoint at host: {}, port: {}, exportJvmInfo: {}",
+                    host, port, exportJvmInfo);
             if (exportJvmInfo) {
                 DefaultExports.initialize();
             }
-            server = new Server(port);
+            server = new Server(new InetSocketAddress(host, port));
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
             server.setHandler(context);
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
new file mode 100644
index 00000000000..54c320d69c7
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import io.prometheus.client.CollectorRegistry;
+import java.util.Properties;
+import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
+import org.junit.Assert;
+import org.junit.Test;
+
+
+public class PrometheusMetricsProviderConfigTest {
+
+    @Test
+    public void testInvalidPort() {
+        Assert.assertThrows(MetricsProviderLifeCycleException.class, () -> {
+            CollectorRegistry.defaultRegistry.clear();
+            PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+            Properties configuration = new Properties();
+            configuration.setProperty("httpPort", "65536");
+            configuration.setProperty("exportJvmInfo", "false");
+            provider.configure(configuration);
+            provider.start();
+        });
+    }
+
+    @Test
+    public void testInvalidAddr() {
+        Assert.assertThrows(MetricsProviderLifeCycleException.class, () -> {
+            CollectorRegistry.defaultRegistry.clear();
+            PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+            Properties configuration = new Properties();
+            configuration.setProperty("httpHost", "master");
+            provider.configure(configuration);
+            provider.start();
+        });
+    }
+
+    @Test
+    public void testValidConfig() throws MetricsProviderLifeCycleException {
+        CollectorRegistry.defaultRegistry.clear();
+        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty("httpHost", "0.0.0.0");
+        configuration.setProperty("httpPort", "0");
+        provider.configure(configuration);
+        provider.start();
+    }
+
+}
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 720cec45bc0..8331b056865 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -56,6 +56,7 @@ public void setup() throws Exception {
         CollectorRegistry.defaultRegistry.clear();
         provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
+        configuration.setProperty("httpHost", "127.0.0.1"); // local host for test
         configuration.setProperty("httpPort", "0"); // ephemeral port
         configuration.setProperty("exportJvmInfo", "false");
         provider.configure(configuration);

From e41dc7dbb0541745afdc768bf757e29c938a9ab8 Mon Sep 17 00:00:00 2001
From: Michael Han <hanm@apache.org>
Date: Thu, 20 May 2021 09:27:40 +0000
Subject: [PATCH 215/591] ZOOKEEPER-3970: Enable ZooKeeperServerController to
 expire session.

This is a follow up of ZOOKEEPER-3948. Here we enable ZooKeeperServerController to be able to expire a global or local session. This is very useful in our experience in integration testing when we want a controlled session expiration mechanism. This is done by having session tracker exposing both global and local session stats, so a zookeeper server can expire the sessions in the controller.

Author: Michael Han <hanm@apache.org>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1505 from hanm/ZOOKEEPER-3970
---
 .../zookeeper/server/SessionTracker.java      | 10 ++++++++
 .../zookeeper/server/SessionTrackerImpl.java  | 11 ++++++++-
 .../zookeeper/server/ZooKeeperServer.java     |  6 +++++
 .../controller/ZooKeeperServerController.java | 24 ++++++++++++++++---
 .../server/quorum/LeaderSessionTracker.java   |  3 +++
 .../server/quorum/LearnerSessionTracker.java  |  3 +++
 .../server/quorum/LocalSessionTracker.java    |  5 +++-
 .../quorum/UpgradeableSessionTracker.java     |  9 ++++++-
 .../server/PrepRequestProcessorTest.java      | 10 +++++++-
 .../ControllerClientServerTest.java           |  6 +----
 ...ZooKeeperServerControllerEndToEndTest.java |  4 ++--
 11 files changed, 77 insertions(+), 14 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java
index 9cf4774c11d..0d7ce810217 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java
@@ -138,4 +138,14 @@ interface SessionExpirer {
     long getLocalSessionCount();
 
     boolean isLocalSessionsEnabled();
+
+    /**
+     * Get a set of global session IDs
+     */
+    Set<Long> globalSessions();
+
+    /**
+     * Get a set of local session IDs
+     */
+    Set<Long> localSessions();
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
index cedd0c0c76c..e8711988125 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
@@ -21,6 +21,7 @@
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.text.MessageFormat;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
@@ -49,7 +50,7 @@ public class SessionTrackerImpl extends ZooKeeperCriticalThread implements Sessi
 
     private final ExpiryQueue<SessionImpl> sessionExpiryQueue;
 
-    private final ConcurrentMap<Long, Integer> sessionsWithTimeout;
+    protected final ConcurrentMap<Long, Integer> sessionsWithTimeout;
     private final AtomicLong nextSessionId = new AtomicLong();
 
     public static class SessionImpl implements Session {
@@ -347,4 +348,12 @@ public long getLocalSessionCount() {
     public boolean isLocalSessionsEnabled() {
         return false;
     }
+
+    public Set<Long> globalSessions() {
+        return sessionsById.keySet();
+    }
+
+    public Set<Long> localSessions() {
+        return Collections.emptySet();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 72e55779cfe..eed74a7a007 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -632,6 +632,12 @@ public void expire(Session session) {
         close(sessionId);
     }
 
+    public void expire(long sessionId) {
+        LOG.info("forcibly expiring session 0x{}", Long.toHexString(sessionId));
+
+        close(sessionId);
+    }
+
     public static class MissingSessionException extends IOException {
 
         private static final long serialVersionUID = 7467414635467261007L;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
index 615db8755f8..3f85ef8134a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
@@ -23,6 +23,7 @@
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.util.ServiceUtils;
@@ -122,13 +123,12 @@ public void processCommand(ControlCommand command) {
                 }
                 break;
             case EXPIRESESSION:
-                // TODO: (hanm) implement once dependent feature is ready.
                 if (command.getParameter() == null) {
-                    // expireAllSessions();
+                    expireAllSessions();
                 } else {
                     // A single parameter should be a session id as long.
                     // Parse failure exceptions will be sent to the caller
-                    // expireSession(Long.decode(command.getParameter()));
+                    expireSession(Long.decode(command.getParameter()));
                 }
                 break;
             case REJECTCONNECTIONS:
@@ -164,5 +164,23 @@ public void processCommand(ControlCommand command) {
         }
     }
 
+    private ZooKeeperServer getServer() {
+        return quorumPeer.getActiveServer();
+    }
+
+    private void expireSession(long sessionId) {
+        getServer().expire(sessionId);
+    }
+
+    private void expireAllSessions() {
+        for (Long sessionId : getServer().getSessionTracker().localSessions()) {
+            expireSession(sessionId);
+        }
+
+        for (Long sessionId : getServer().getSessionTracker().globalSessions()) {
+            expireSession(sessionId);
+        }
+    }
+
 }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java
index e750b4dd881..3f9789f5d00 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java
@@ -223,4 +223,7 @@ public Map<Long, Set<Long>> getSessionExpiryMap() {
         return sessionExpiryMap;
     }
 
+    public Set<Long> globalSessions() {
+        return globalSessionTracker.globalSessions();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
index b12a62c0644..78c927a7d7c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
@@ -225,4 +225,7 @@ public Map<Long, Set<Long>> getSessionExpiryMap() {
         return new HashMap<Long, Set<Long>>();
     }
 
+    public Set<Long> globalSessions() {
+        return globalSessionsWithTimeouts.keySet();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java
index 009fe03b6c2..b3231221139 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import java.util.Set;
 import java.util.concurrent.ConcurrentMap;
 import org.apache.zookeeper.server.SessionTrackerImpl;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
@@ -26,7 +27,6 @@
  * Local session tracker.
  */
 public class LocalSessionTracker extends SessionTrackerImpl {
-
     public LocalSessionTracker(SessionExpirer expirer, ConcurrentMap<Long, Integer> sessionsWithTimeouts, int tickTime, long id, ZooKeeperServerListener listener) {
         super(expirer, sessionsWithTimeouts, tickTime, id, listener);
     }
@@ -45,4 +45,7 @@ public long createSession(int sessionTimeout) {
         return sessionId;
     }
 
+    public Set<Long> localSessions() {
+        return sessionsWithTimeout.keySet();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
index 69dfd47a0e5..fb5dbcc3671 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import java.util.Collections;
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import org.apache.zookeeper.KeeperException;
@@ -111,7 +113,8 @@ protected void removeLocalSession(long sessionId) {
         localSessionTracker.removeSession(sessionId);
     }
 
-    public void checkGlobalSession(long sessionId, Object owner) throws KeeperException.SessionExpiredException, KeeperException.SessionMovedException {
+    public void checkGlobalSession(long sessionId, Object owner)
+        throws KeeperException.SessionExpiredException, KeeperException.SessionMovedException {
         throw new UnsupportedOperationException();
     }
 
@@ -122,4 +125,8 @@ public long getLocalSessionCount() {
         return localSessionsWithTimeouts.size();
     }
 
+    public Set<Long> localSessions() {
+        return (localSessionTracker == null) ? Collections.<Long>emptySet()
+            : localSessionTracker.localSessions();
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index 0bf248a04c5..9e71205697d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -30,6 +30,7 @@
 import java.io.PrintWriter;
 import java.nio.ByteBuffer;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -394,6 +395,13 @@ public long getLocalSessionCount() {
         public boolean isLocalSessionsEnabled() {
             return false;
         }
-    }
 
+        public Set<Long> globalSessions() {
+            return Collections.emptySet();
+        }
+
+        public Set<Long> localSessions() {
+            return Collections.emptySet();
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
index 3b9b92a4b1a..d6fd986fdcf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
@@ -19,7 +19,6 @@
 package org.apache.zookeeper.server.controller;
 
 import org.junit.Assert;
-import org.junit.Ignore;
 import org.junit.Test;
 
 public class ControllerClientServerTest extends ControllerTestBase {
@@ -41,10 +40,7 @@ public void verifyCloseConnectionCommand() {
         Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION));
     }
 
-    // TODO (hanm): this depends on the expiration session feature which
-    // is not part of this patch. This test will be enabled once that
-    // feature is upstreamed.
-    @Ignore
+    @Test
     public void verifyExpireSessionCommand() {
         // Valid long session ids should be accepted.
         Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION, "0x1234"));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
index 2895afd6fa7..06b362638e0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
@@ -84,7 +84,7 @@ public void verifyClientDisconnectsAndReconnects() throws Exception {
         watcher.waitForEvent();
     }
 
-    @Ignore
+    @Test
     public void verifySessionExpiration() throws Exception {
         // Setup: First connect to the server and wait for connected.
         BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
@@ -104,7 +104,7 @@ public void verifySessionExpiration() throws Exception {
         watcher.waitForEvent();
     }
 
-    @Ignore
+    @Test
     public void verifyGlobalSessionExpiration() throws Exception {
         // Step 1: Connect.
         BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);

From c499202a2c470e2e365ef109c8e49784cb043367 Mon Sep 17 00:00:00 2001
From: lan <liaonan@souche.com>
Date: Mon, 24 May 2021 22:21:42 +0800
Subject: [PATCH 216/591] ZOOKEEPER-4298: Update http to https in
 zoo_sample.cfg

Author: lan <liaonan@souche.com>

Reviewers: maoling <maoling@apache.org>

Closes #1699 from lanicc/ZOOKEEPER-4298
---
 conf/zoo_sample.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/zoo_sample.cfg b/conf/zoo_sample.cfg
index f221675ee10..d0db6e99a1d 100644
--- a/conf/zoo_sample.cfg
+++ b/conf/zoo_sample.cfg
@@ -19,7 +19,7 @@ clientPort=2181
 # Be sure to read the maintenance section of the 
 # administrator guide before turning on autopurge.
 #
-# http://zookeeper.apache.org/doc/current/zookeeperAdmin.html#sc_maintenance
+# https://zookeeper.apache.org/doc/current/zookeeperAdmin.html#sc_maintenance
 #
 # The number of snapshots to retain in dataDir
 #autopurge.snapRetainCount=3

From 016ffd9a3ec2cb669071e881d677441314aa8bfd Mon Sep 17 00:00:00 2001
From: lan <liaonan@souche.com>
Date: Fri, 28 May 2021 15:55:03 +0800
Subject: [PATCH 217/591] ZOOKEEPER-4300: Simplify assignment statements of
 boolean

Author: lan <liaonan@souche.com>

Reviewers: maoling <maoling@apache.org>

Closes #1700 from lanicc/ZOOKEEPER-4300
---
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index eed74a7a007..6a424178f03 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -2112,7 +2112,7 @@ private void checkQuota(String lastPrefix, long bytesDiff, long countDiff)
         //check the Count Quota
         if (checkCountQuota) {
             long newCount = currentStats.getCount() + countDiff;
-            boolean isCountHardLimit = limitStats.getCountHardLimit() > -1 ? true : false;
+            boolean isCountHardLimit = limitStats.getCountHardLimit() > -1;
             long countLimit = isCountHardLimit ? limitStats.getCountHardLimit() : limitStats.getCount();
 
             if (newCount > countLimit) {
@@ -2127,7 +2127,7 @@ private void checkQuota(String lastPrefix, long bytesDiff, long countDiff)
         //check the Byte Quota
         if (checkByteQuota) {
             long newBytes = currentStats.getBytes() + bytesDiff;
-            boolean isByteHardLimit = limitStats.getByteHardLimit() > -1 ? true : false;
+            boolean isByteHardLimit = limitStats.getByteHardLimit() > -1;
             long byteLimit = isByteHardLimit ? limitStats.getByteHardLimit() : limitStats.getBytes();
             if (newBytes > byteLimit) {
                 String msg = "Quota exceeded: " + lastPrefix + " [current bytes=" + newBytes + ", " + (isByteHardLimit ? "hard" : "soft") + "ByteLimit=" + byteLimit + "]";

From 5c102298f8a160ea996be7b6d6f95189d4ff2f41 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Sat, 29 May 2021 20:53:04 +0800
Subject: [PATCH 218/591] ZOOKEEPER-3601: introduce the fault injection
 framework: Byteman for ZooKeeper

- **Byteman** is a powerful tool to inject faults during runtime, especially for distributed system
- In the future, we can also introduce it into our unit test infra, just as hadoop, cassandra did. [PR-123](https://github.com/apache/zookeeper/pull/123) is a good starting.
- more details in the [ZOOKEEPER-3601](https://issues.apache.org/jira/browse/ZOOKEEPER-3601)

Author: maoling <maoling199210191@sina.com>

Reviewers: Andor Molnar <anmolnar@apache.org>

Closes #1135 from maoling/ZOOKEEPER-3601
---
 .../main/resources/markdown/zookeeperTools.md | 83 +++++++++++++++++++
 1 file changed, 83 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index 7e67db65f23..cd8b4412e11 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -30,6 +30,8 @@ limitations under the License.
     * [zk-smoketest](#zk-smoketest)
     
 * [Testing](#Testing)
+    * [Fault Injection Framework](#fault-injection)
+        * [Byteman](#Byteman)
     * [Jepsen Test](#jepsen-test)
     
 <a name="Scripts"></a>
@@ -526,6 +528,87 @@ existing installations. More details are [here](https://github.com/phunt/zk-smok
 
 ## Testing
 
+<a name="fault-injection"></a>
+
+### Fault Injection Framework
+
+<a name="Byteman"></a>
+
+#### Byteman
+
+- **Byteman** is a tool which makes it easy to trace, monitor and test the behaviour of Java application and JDK runtime code.
+It injects Java code into your application methods or into Java runtime methods without the need for you to recompile, repackage or even redeploy your application.
+Injection can be performed at JVM startup or after startup while the application is still running.
+- Visit the official [website](https://byteman.jboss.org/) to download the latest release
+- A brief tutorial can be found [here](https://developer.jboss.org/wiki/ABytemanTutorial)
+
+    ```bash
+    Preparations:
+    # attach the byteman to 3 zk servers during runtime
+    # 55001,55002,55003 is byteman binding port; 714,740,758 is the zk server pid
+    ./bminstall.sh -b -Dorg.jboss.byteman.transform.all -Dorg.jboss.byteman.verbose -p 55001 714
+    ./bminstall.sh -b -Dorg.jboss.byteman.transform.all -Dorg.jboss.byteman.verbose -p 55002 740
+    ./bminstall.sh -b -Dorg.jboss.byteman.transform.all -Dorg.jboss.byteman.verbose -p 55003 758
+
+    # load the fault injection script
+    ./bmsubmit.sh -p 55002 -l my_zk_fault_injection.btm
+    # unload the fault injection script
+    ./bmsubmit.sh -p 55002 -u my_zk_fault_injectionr.btm
+    ```
+
+Look at the below examples to customize your byteman fault injection script
+
+Example 1: This script makes leader's zxid roll over, to force re-election.
+
+```bash
+cat zk_leader_zxid_roll_over.btm
+
+RULE trace zk_leader_zxid_roll_over
+CLASS org.apache.zookeeper.server.quorum.Leader
+METHOD propose
+IF true
+DO
+  traceln("*** Leader zxid has rolled over, forcing re-election ***");
+  $1.zxid = 4294967295L
+ENDRULE
+```
+
+Example 2: This script makes the leader drop the ping packet to a specific follower.
+The leader will close the **LearnerHandler** with that follower, and the follower will enter the state:LOOKING
+then re-enter the quorum with the state:FOLLOWING
+
+```bash
+cat zk_leader_drop_ping_packet.btm
+
+RULE trace zk_leader_drop_ping_packet
+CLASS org.apache.zookeeper.server.quorum.LearnerHandler
+METHOD ping
+AT ENTRY
+IF $0.sid == 2
+DO
+  traceln("*** Leader drops ping packet to sid: 2 ***");
+  return;
+ENDRULE
+```
+
+Example 3: This script makes one follower drop ACK packet which has no big effect in the broadcast phrase, since after receiving
+the majority of ACKs from the followers, the leader can commit that proposal
+
+```bash
+cat zk_leader_drop_ping_packet.btm
+
+RULE trace zk.follower_drop_ack_packet
+CLASS org.apache.zookeeper.server.quorum.SendAckRequestProcessor
+METHOD processRequest
+AT ENTRY
+IF true
+DO
+  traceln("*** Follower drops ACK packet ***");
+  return;
+ENDRULE
+```
+
+
 <a name="jepsen-test"></a>
 
 ### Jepsen Test

From 5e787c5990091b2d1fc560eba88d3c25b04690a2 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Sat, 5 Jun 2021 18:01:10 +0800
Subject: [PATCH 219/591] ZOOKEEPER-3907: add a documentation about alerting on
 metrics

- more details in the [ZOOKEEPER-3907](https://issues.apache.org/jira/browse/ZOOKEEPER-3907)

Author: maoling <maoling199210191@sina.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1425 from maoling/ZOOKEEPER-3907 and squashes the following commits:

27f640f2e [maoling] change title to: Alerting with Prometheus
95a1269bd [maoling] ZOOKEEPER-3907: add a documentation about alerting on metrics
---
 .../resources/markdown/zookeeperMonitor.md    | 120 ++++++++++++++++++
 1 file changed, 120 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index 83dfb6be0d9..eb50a04f342 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -19,6 +19,7 @@ limitations under the License.
 * [New Metrics System](#Metrics-System)
     * [Metrics](#Metrics)
     * [Prometheus](#Prometheus)
+    * [Alerting with Prometheus](#Alerting)
     * [Grafana](#Grafana)
     * [InfluxDB](#influxdb)
 
@@ -73,6 +74,125 @@ All the metrics are included in the `ServerMetrics.java`.
 
 - Now Prometheus will scrape zk metrics every 10 seconds.
 
+<a name="Alerting"></a>
+
+### Alerting with Prometheus
+- We recommend that you read [Prometheus Official Alerting Page](https://prometheus.io/docs/practices/alerting/) to explore
+  some principles of alerting
+
+- We recommend that you use [Prometheus Alertmanager](https://www.prometheus.io/docs/alerting/latest/alertmanager/) which can
+  help users to receive alerting email or instant message(by webhook) in a more convenient way
+
+- We provide an alerting example where these metrics should be taken a special attention. Note: this is for your reference only,
+  and you need to adjust them according to your actual situation and resource environment
+
+
+        use ./promtool check rules rules/zk.yml to check the correctness of the config file
+        cat rules/zk.yml
+
+        groups:
+        - name: zk-alert-example
+          rules:
+          - alert: ZooKeeper server is down
+            expr:  up == 0
+            for: 1m
+            labels:
+              severity: critical
+            annotations:
+              summary: "Instance {{ $labels.instance }} ZooKeeper server is down"
+              description: "{{ $labels.instance }} of job {{$labels.job}} ZooKeeper server is down: [{{ $value }}]."
+
+          - alert: create too many znodes
+            expr: znode_count > 1000000
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} create too many znodes"
+              description: "{{ $labels.instance }} of job {{$labels.job}} create too many znodes: [{{ $value }}]."
+
+          - alert: create too many connections
+            expr: num_alive_connections > 50 # suppose we use the default maxClientCnxns: 60
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} create too many connections"
+              description: "{{ $labels.instance }} of job {{$labels.job}} create too many connections: [{{ $value }}]."
+
+          - alert: znode total occupied memory is too big
+            expr: approximate_data_size /1024 /1024 > 1 * 1024 # more than 1024 MB(1 GB)
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} znode total occupied memory is too big"
+              description: "{{ $labels.instance }} of job {{$labels.job}} znode total occupied memory is too big: [{{ $value }}] MB."
+
+          - alert: set too many watch
+            expr: watch_count > 10000
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} set too many watch"
+              description: "{{ $labels.instance }} of job {{$labels.job}} set too many watch: [{{ $value }}]."
+
+          - alert: a leader election happens
+            expr: increase(election_time_count[5m]) > 0
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} a leader election happens"
+              description: "{{ $labels.instance }} of job {{$labels.job}} a leader election happens: [{{ $value }}]."
+
+          - alert: open too many files
+            expr: open_file_descriptor_count > 300
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} open too many files"
+              description: "{{ $labels.instance }} of job {{$labels.job}} open too many files: [{{ $value }}]."
+
+          - alert: fsync time is too long
+            expr: rate(fsynctime_sum[1m]) > 100
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} fsync time is too long"
+              description: "{{ $labels.instance }} of job {{$labels.job}} fsync time is too long: [{{ $value }}]."
+
+          - alert: take snapshot time is too long
+            expr: rate(snapshottime_sum[5m]) > 100
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} take snapshot time is too long"
+              description: "{{ $labels.instance }} of job {{$labels.job}} take snapshot time is too long: [{{ $value }}]."
+
+          - alert: avg latency is too high
+            expr: avg_latency > 100
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} avg latency is too high"
+              description: "{{ $labels.instance }} of job {{$labels.job}} avg latency is too high: [{{ $value }}]."
+
+          - alert: JvmMemoryFillingUp
+            expr: jvm_memory_bytes_used / jvm_memory_bytes_max{area="heap"} > 0.8
+            for: 5m
+            labels:
+              severity: warning
+            annotations:
+              summary: "JVM memory filling up (instance {{ $labels.instance }})"
+              description: "JVM memory is filling up (> 80%)\n labels: {{ $labels }}  value = {{ $value }}\n"
+
+
 <a name="Grafana"></a>
 
 ### Grafana

From 32e40e8cee36ddba1973875ab6637912719271fa Mon Sep 17 00:00:00 2001
From: dengliming <liming.d.pro@gmail.com>
Date: Sun, 13 Jun 2021 15:30:41 +0800
Subject: [PATCH 220/591] ZOOKEEPER-3821: Improve getSnapCount and
 getGlobalOutstandingLimit

Author: dengliming <liming.d.pro@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <anmolnar@apache.org>, maoling <maoling@apache.org>

Closes #1352 from dengliming/ZOOKEEPER-3821
---
 .../zookeeper/server/ZooKeeperServer.java     | 29 ++++++-------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 6a424178f03..aeeebb9ecd5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -194,6 +194,8 @@ public static void setCloseSessionTxnEnabled(boolean enabled) {
     protected String initialConfig;
     protected boolean reconfigEnabled;
     private final RequestPathMetricsCollector requestPathMetricsCollector;
+    private static final int DEFAULT_SNAP_COUNT = 100000;
+    private static final int DEFAULT_GLOBAL_OUTSTANDING_LIMIT = 1000;
 
     private boolean localSessionEnabled = false;
     protected enum State {
@@ -1183,30 +1185,17 @@ public void submitRequestNow(Request si) {
     }
 
     public static int getSnapCount() {
-        String sc = System.getProperty(SNAP_COUNT);
-        try {
-            int snapCount = Integer.parseInt(sc);
-
-            // snapCount must be 2 or more. See org.apache.zookeeper.server.SyncRequestProcessor
-            if (snapCount < 2) {
-                LOG.warn("SnapCount should be 2 or more. Now, snapCount is reset to 2");
-                snapCount = 2;
-            }
-            return snapCount;
-        } catch (Exception e) {
-            return 100000;
+        int snapCount = Integer.getInteger(SNAP_COUNT, DEFAULT_SNAP_COUNT);
+        // snapCount must be 2 or more. See org.apache.zookeeper.server.SyncRequestProcessor
+        if (snapCount < 2) {
+            LOG.warn("SnapCount should be 2 or more. Now, snapCount is reset to 2");
+            snapCount = 2;
         }
+        return snapCount;
     }
 
     public int getGlobalOutstandingLimit() {
-        String sc = System.getProperty(GLOBAL_OUTSTANDING_LIMIT);
-        int limit;
-        try {
-            limit = Integer.parseInt(sc);
-        } catch (Exception e) {
-            limit = 1000;
-        }
-        return limit;
+        return Integer.getInteger(GLOBAL_OUTSTANDING_LIMIT, DEFAULT_GLOBAL_OUTSTANDING_LIMIT);
     }
 
     public static long getSnapSizeInBytes() {

From 5e6e15ac40cfd2cadac3e718e494a3c13b934b8d Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Sun, 13 Jun 2021 18:53:47 +0000
Subject: [PATCH 221/591] ZOOKEEPER-4312: ZooKeeperServerEmbedded: enhance
 server start/stop for testability

see https://issues.apache.org/jira/browse/ZOOKEEPER-4312

ZooKeeperServerEmbedded works well for running ZooKeeper but it lacks support for a few little features in order to use it for tests.

I saw these problems while working on the port of Curator Testing Server to ZooKeeperServerEmbedded.

There is no wait to wait for the server to be up-and-running
When you "close()" the server, it does not wait for the ports to be closed
There is no wait to have the ConnectString for the server

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1710 from eolivelli/impl/embedded-2
---
 .../zookeeper/server/ZooKeeperServerMain.java | 42 +++++++++----
 .../embedded/ZooKeeperServerEmbedded.java     | 16 +++++
 .../embedded/ZooKeeperServerEmbeddedImpl.java | 60 ++++++++++++++++++-
 .../zookeeper/server/quorum/QuorumPeer.java   |  1 -
 .../ZookeeperServerClusterMutualAuthTest.java |  6 +-
 .../embedded/ZookeeperServerClusterTest.java  |  6 +-
 .../embedded/ZookeeperServerEmbeddedTest.java | 24 +++++++-
 .../ZookeeperServerSslEmbeddedTest.java       |  4 +-
 8 files changed, 133 insertions(+), 26 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index c438f1878b4..7bd30baa6e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -178,6 +178,8 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
             containerManager.start();
             ZKAuditProvider.addZKStartStopAuditLog();
 
+            serverStarted();
+
             // Watch status of ZooKeeper server. It will do a graceful shutdown
             // if the server is not running or hits an internal error.
             shutdownLatch.await();
@@ -247,21 +249,35 @@ ServerCnxnFactory getSecureCnxnFactory() {
      */
     public void close() {
         ServerCnxnFactory primaryCnxnFactory = this.cnxnFactory;
-        if (primaryCnxnFactory == null) {
-            // in case of pure TLS we can hook into secureCnxnFactory
-            primaryCnxnFactory = secureCnxnFactory;
-        }
-        if (primaryCnxnFactory == null || primaryCnxnFactory.getZooKeeperServer() == null) {
-            return;
-        }
-        ZooKeeperServerShutdownHandler zkShutdownHandler = primaryCnxnFactory.getZooKeeperServer().getZkShutdownHandler();
-        zkShutdownHandler.handle(ZooKeeperServer.State.SHUTDOWN);
+        ServerCnxnFactory secondaryCnxnFactory = this.secureCnxnFactory;
         try {
-            // ServerCnxnFactory will call the shutdown
-            primaryCnxnFactory.join();
-        } catch (InterruptedException ex) {
-            Thread.currentThread().interrupt();
+            if (primaryCnxnFactory == null) {
+                // in case of pure TLS we can hook into secureCnxnFactory
+                primaryCnxnFactory = secondaryCnxnFactory;
+            }
+            if (primaryCnxnFactory == null || primaryCnxnFactory.getZooKeeperServer() == null) {
+                LOG.info("Connection factory did not start");
+                return;
+            }
+            ZooKeeperServerShutdownHandler zkShutdownHandler = primaryCnxnFactory.getZooKeeperServer().getZkShutdownHandler();
+            zkShutdownHandler.handle(ZooKeeperServer.State.SHUTDOWN);
+            try {
+                // ServerCnxnFactory will call the shutdown
+                primaryCnxnFactory.join();
+            } catch (InterruptedException ex) {
+                Thread.currentThread().interrupt();
+            }
+        } finally {
+            // ensure that we are closing the sockets
+            if (primaryCnxnFactory != null) {
+                primaryCnxnFactory.shutdown();
+            }
+            if (secondaryCnxnFactory != null) {
+                secondaryCnxnFactory.shutdown();
+            }
         }
     }
 
+    protected void serverStarted() {
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
index b9d0a309341..a99bdb4e7ae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
@@ -109,6 +109,22 @@ static ZookKeeperServerEmbeddedBuilder builder() {
      */
     void start() throws Exception;
 
+    /**
+     * Start the server
+     * @param startupTimeout time to wait in millis for the server to start
+     * @throws Exception
+     */
+    void start(long startupTimeout) throws Exception;
+
+    /**
+     * Get a connection string useful for the client.
+     * @return the connection string
+     * @throws Exception in case the connection string is not available
+     */
+    String getConnectionString() throws Exception;
+
+    String getSecureConnectionString() throws Exception;
+
     /**
      * Shutdown gracefully the server and wait for resources to be released.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
index cfd3abf0606..ec6ae637a0c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -5,6 +5,10 @@
 import java.nio.file.Path;
 import java.util.Map;
 import java.util.Properties;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import javax.security.sasl.SaslException;
 import org.apache.zookeeper.server.DatadirCleanupManager;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ServerConfig;
@@ -72,6 +76,11 @@ class ZooKeeperServerEmbeddedImpl implements ZooKeeperServerEmbedded {
 
     @Override
     public void start() throws Exception {
+        start(Integer.MAX_VALUE);
+    }
+
+    @Override
+    public void start(long startupTimeout) throws Exception {
         switch (exitHandler) {
             case EXIT:
                 ServiceUtils.setSystemExitProcedure(ServiceUtils.SYSTEM_EXIT);
@@ -83,12 +92,23 @@ public void start() throws Exception {
                 ServiceUtils.setSystemExitProcedure(ServiceUtils.SYSTEM_EXIT);
                 break;
         }
-
+        final CompletableFuture<String> started = new CompletableFuture<>();
 
         if (config.getServers().size() > 1 || config.isDistributed()) {
             LOG.info("Running ZK Server in single Quorum MODE");
 
-            maincluster = new QuorumPeerMain();
+            maincluster = new QuorumPeerMain() {
+                protected QuorumPeer getQuorumPeer() throws SaslException {
+                    return new QuorumPeer() {
+                        @Override
+                        public void start() {
+                            super.start();
+                            LOG.info("ZK Server {} started", this);
+                            started.complete(null);
+                        }
+                    };
+                }
+            };
 
             // Start and schedule the the purge task
             purgeMgr = new DatadirCleanupManager(config
@@ -118,7 +138,13 @@ public void run() {
             thread.start();
         } else {
             LOG.info("Running ZK Server in single STANDALONE MODE");
-            mainsingle = new ZooKeeperServerMain();
+            mainsingle = new ZooKeeperServerMain() {
+                @Override
+                public void serverStarted() {
+                    LOG.info("ZK Server started");
+                    started.complete(null);
+                }
+            };
             purgeMgr = new DatadirCleanupManager(config
                     .getDataDir(), config.getDataLogDir(), config
                     .getSnapRetainCount(), config.getPurgeInterval());
@@ -146,6 +172,34 @@ public void run() {
             };
             thread.start();
         }
+
+        try {
+            started.get(startupTimeout, TimeUnit.MILLISECONDS);
+        } catch (TimeoutException err) {
+            LOG.info("Startup timed out, trying to close");
+            close();
+            throw err;
+        }
+    }
+
+    @Override
+    public String getConnectionString() {
+        if (config.getClientPortAddress() != null) {
+            String raw = config.getClientPortAddress().getHostString() + ":" + config.getClientPortAddress().getPort();
+            return raw.replace("0.0.0.0", "localhost");
+        } else {
+            throw new IllegalStateException("No client address is configured");
+        }
+    }
+
+    @Override
+    public String getSecureConnectionString() {
+        if (config.getSecureClientPortAddress() != null) {
+            String raw = config.getSecureClientPortAddress().getHostString() + ":" + config.getSecureClientPortAddress().getPort();
+            return raw.replace("0.0.0.0", "localhost");
+        } else {
+            throw new IllegalStateException("No client address is configured");
+        }
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 5dea2016b88..18e97bb2f0c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1135,7 +1135,6 @@ public synchronized void start() {
             adminServer.start();
         } catch (AdminServerException e) {
             LOG.warn("Problem starting AdminServer", e);
-            System.out.println(e);
         }
         startLeaderElection();
         startJvmPauseMonitor();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
index 923d88802bf..1022c25c127 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
@@ -119,9 +119,9 @@ public void testStart() throws Exception {
             zkServer2.start();
             zkServer3.start();
 
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport1, 60000));
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport2, 60000));
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport3, 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer1.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer2.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer3.getConnectionString(), 60000));
 
             for (int i = 0; i < 100; i++) {
                 ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
index 090c9fce049..dfbdfc3611f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
@@ -101,9 +101,9 @@ public void testStart() throws Exception {
             zkServer2.start();
             zkServer3.start();
 
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport1, 60000));
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport2, 60000));
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientport3, 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer1.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer2.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer3.getConnectionString(), 60000));
             for (int i = 0; i < 100; i++) {
                 ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
                 System.out.println("status:" + status);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
index 277a6a4c8f1..d9868b235df 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
@@ -59,7 +59,7 @@ public void testStart() throws Exception {
                 .exitHandler(ExitHandler.LOG_ONLY)
                 .build()) {
             zkServer.start();
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientPort, 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
             for (int i = 0; i < 100; i++) {
                 ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
                 if (status.isLeader() && status.isStandaloneMode()) {
@@ -71,6 +71,28 @@ public void testStart() throws Exception {
             assertTrue(status.isLeader());
             assertTrue(status.isStandaloneMode());
         }
+
+        // restart (all ports should be closed and the restart should always work)
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(baseDir)
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+        }
+
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
index e7a46269f51..4611e4ceee3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
@@ -87,7 +87,7 @@ public void testStart() throws Exception {
                 .exitHandler(ExitHandler.LOG_ONLY)
                 .build()) {
             zkServer.start();
-            assertTrue(ClientBase.waitForServerUp("localhost:" + clientPort, 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
             for (int i = 0; i < 100; i++) {
                 ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
                 if (status.isLeader() && status.isStandaloneMode()) {
@@ -104,7 +104,7 @@ public void testStart() throws Exception {
             zKClientConfig.setProperty("zookeeper.client.secure", "true");
             // only netty supports TLS
             zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
-            try (ZooKeeper zk = new ZooKeeper("localhost:" + clientSecurePort, 60000, (WatchedEvent event) -> {
+            try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
                 switch (event.getState()) {
                     case SyncConnected:
                         l.countDown();

From 78550453204e89a13aee87d86b6d94c458c9dd63 Mon Sep 17 00:00:00 2001
From: franz1981 <nigro.fra@gmail.com>
Date: Mon, 14 Jun 2021 11:45:58 +0200
Subject: [PATCH 222/591] ZOOKEEPER-4309: QuorumCnxManager's ListenerHandler
 thread leak

https://issues.apache.org/jira/browse/ZOOKEEPER-4309

Author: franz1981 <nigro.fra@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1705 from franz1981/ZOOKEEPER-4309
---
 .../apache/zookeeper/server/quorum/QuorumCnxManager.java | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 2f240e9bf95..6bb611fea0a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -957,8 +957,13 @@ public void run() {
                                 new ListenerHandler(address, self.shouldUsePortUnification(), self.isSslQuorum(), latch))
                         .collect(Collectors.toList());
 
-                ExecutorService executor = Executors.newFixedThreadPool(addresses.size());
-                listenerHandlers.forEach(executor::submit);
+                final ExecutorService executor = Executors.newFixedThreadPool(addresses.size());
+                try {
+                    listenerHandlers.forEach(executor::submit);
+                } finally {
+                    // prevent executor's threads to leak after ListenerHandler tasks complete
+                    executor.shutdown();
+                }
 
                 try {
                     latch.await();

From 525a28bd1cb864a5783593c64908cfe0ddcba65f Mon Sep 17 00:00:00 2001
From: maoling <maoling@apache.org>
Date: Mon, 14 Jun 2021 18:30:46 +0800
Subject: [PATCH 223/591] ZOOKEEPER-4208: Adding more labels to asf.yaml file
 to position more to the ZooKeeper Project

- more details in the [ZOOKEEPER-4208](https://issues.apache.org/jira/browse/ZOOKEEPER-4208)

Author: maoling <maoling@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1711 from maoling/ZOOKEEPER-4208
---
 .asf.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.asf.yaml b/.asf.yaml
index 48746033d66..a050c4d88b6 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -23,8 +23,19 @@ github:
   description: "Apache ZooKeeper"
   homepage: https://zookeeper.apache.org
   labels:
+    - java
+    - apache
     - zookeeper
+    - consensus
+    - coordination
+    - zab
     - database
+    - key-value
+    - distributed-database
+    - distributed-systems
+    - service-discovery
+    - configuration-management
+    - distributed-configuration
     - hacktoberfest
   features:
     wiki: false

From 65dba9d9ab35cdef751473345af52089abc0da6e Mon Sep 17 00:00:00 2001
From: Dmitrii Kovalkov <dimas.kovas@gmail.com>
Date: Mon, 21 Jun 2021 19:14:37 +0800
Subject: [PATCH 224/591] ZOOKEEPER-4311: Close AtomicFileOutputStream properly

Author: Dmitrii Kovalkov <dimas.kovas@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <anmolnar@apache.org>, maoling <maoling@apache.org>

Closes #1706 from DimasKovas/close_atomic_file_output_stream and squashes the following commits:

1623c84da [Dmitrii Kovalkov] remove trailing whitespace
75e525617 [Dmitrii Kovalkov] cosmetics
449ba8a61 [Dmitrii Kovalkov] Fix
---
 .../zookeeper/common/AtomicFileWritingIdiom.java   | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java
index 6e20b780546..903f8e493a3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java
@@ -59,7 +59,7 @@ private AtomicFileWritingIdiom(
         OutputStreamStatement osStmt,
         WriterStatement wStmt) throws IOException {
         AtomicFileOutputStream out = null;
-        boolean error = true;
+        boolean triedToClose = false;
         try {
             out = new AtomicFileOutputStream(targetFile);
             if (wStmt == null) {
@@ -71,20 +71,18 @@ private AtomicFileWritingIdiom(
                 wStmt.write(bw);
                 bw.flush();
             }
-            out.flush();
+            triedToClose = true;
+            // close() will do the best to clean up file/resources in case of errors
+            // worst case the tmp file may still exist
+            out.close();
             // everything went ok
-            error = false;
         } finally {
             // nothing interesting to do if out == null
             if (out != null) {
-                if (error) {
+                if (!triedToClose) {
                     // worst case here the tmp file/resources(fd) are not cleaned up
                     // and the caller will be notified (IOException)
                     out.abort();
-                } else {
-                    // if the close operation (rename) fails we'll get notified.
-                    // worst case the tmp file may still exist
-                    IOUtils.closeStream(out);
                 }
             }
         }

From 2f00dea17bd94bf43b2f6647f6b08b00ff8b7ece Mon Sep 17 00:00:00 2001
From: liuxw <1433484140@qq.com>
Date: Sun, 27 Jun 2021 14:12:52 +0800
Subject: [PATCH 225/591] ZOOKEEPER-4326: fix typo in the recipes.md

Author: liuxw <1433484140@qq.com>

Reviewers: maoling <maoling@apache.org>

Closes #1718 from liuxw888/ZOOKEEPER-4326
---
 .../src/main/resources/markdown/recipes.md           | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/recipes.md b/zookeeper-docs/src/main/resources/markdown/recipes.md
index ceb2e7133dc..2fd6c957887 100644
--- a/zookeeper-docs/src/main/resources/markdown/recipes.md
+++ b/zookeeper-docs/src/main/resources/markdown/recipes.md
@@ -171,14 +171,14 @@ the queue node. The distributed clients put something into the queue by
 calling create() with a pathname ending in "queue-", with the
 _sequence_ and _ephemeral_ flags in
 the create() call set to true. Because the _sequence_
-flag is set, the new pathnames will have the form
+flag is set, the new pathname will have the form
 _path-to-queue-node_/queue-X, where X is a monotonic increasing number. A
 client that wants to be removed from the queue calls ZooKeeper's **getChildren( )** function, with
 _watch_ set to true on the queue node, and begins
 processing nodes with the lowest number. The client does not need to issue
 another **getChildren( )** until it exhausts
 the list obtained from the first **getChildren(
-)** call. If there are are no children in the queue node, the
+)** call. If there are no children in the queue node, the
 reader waits for a watch notification to check the queue again.
 
 ###### Note
@@ -205,7 +205,7 @@ notification triggers for the queue node.
 
 Fully distributed locks that are globally synchronous, meaning at
 any snapshot in time no two clients think they hold the same lock. These
-can be implemented using ZooKeeeper. As with priority queues, first define
+can be implemented using ZooKeeper. As with priority queues, first define
 a lock node.
 
 ###### Note
@@ -347,7 +347,7 @@ the site create the node.
 To solve the first problem, you can have only the coordinator
 notified of changes to the transaction nodes, and then notify the sites
 once coordinator reaches a decision. Note that this approach is scalable,
-but it's is slower too, as it requires all communication to go through the
+but it is slower too, as it requires all communication to go through the
 coordinator.
 
 To address the second problem, you can have the coordinator
@@ -363,7 +363,7 @@ A simple way of doing leader election with ZooKeeper is to use the
 znodes that represent "proposals" of clients. The idea is to have a znode,
 say "/election", such that each znode creates a child znode "/election/guid-n_"
 with both flags SEQUENCE|EPHEMERAL. With the sequence flag, ZooKeeper
-automatically appends a sequence number that is greater than any one
+automatically appends a sequence number that is greater than anyone
 previously appended to a child of "/election". The process that created
 the znode with the smallest appended sequence number is the leader.
 
@@ -391,7 +391,7 @@ be a leader:
 
 1. Create znode z with path "ELECTION/guid-n_" with both SEQUENCE and
   EPHEMERAL flags;
-1. Let C be the children of "ELECTION", and i be the sequence
+1. Let C be the children of "ELECTION", and I am the sequence
   number of z;
 1. Watch for changes on "ELECTION/guid-n_j", where j is the largest
   sequence number such that j < i and n_j is a znode in C;

From 9442ce23bade5286459ff78ade1af173f7b69c30 Mon Sep 17 00:00:00 2001
From: "zhongxiong.zeng" <zhongxiong.zeng@za.group>
Date: Sun, 27 Jun 2021 15:21:26 +0800
Subject: [PATCH 226/591] ZOOKEEPER-4312: remove unnecessary code

The result of this line of code is not used, this code is uncessary

Author: zhongxiong.zeng <zhongxiong.zeng@za.group>

Reviewers: Ching-Chan Lee <leechingchankyo@gmail.com>, maoling <maoling@apache.org>

Closes #1709 from zhongxiongzeng/remove_unnecessary_code and squashes the following commits:

2b49e106c [zhongxiong.zeng] Revert "remove redundant code"
081c2a03b [zhongxiong.zeng] remove redundant code
0e8a1ddb2 [zhongxiong.zeng] remove unnecessary code
---
 .../apache/zookeeper/server/quorum/FastLeaderElection.java | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 9fc9d148c39..654ed1cef09 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -976,8 +976,7 @@ public Vote lookForLeader() throws InterruptedException {
                     /*
                      * Exponential backoff
                      */
-                    int tmpTimeOut = notTimeout * 2;
-                    notTimeout = Math.min(tmpTimeOut, maxNotificationInterval);
+                    notTimeout = Math.min(notTimeout << 1, maxNotificationInterval);
 
                     /*
                      * When a leader failure happens on a master, the backup will be supposed to receive the honour from
@@ -986,8 +985,8 @@ public Vote lookForLeader() throws InterruptedException {
                      * The leader election algorithm does not provide the ability of electing a leader from a single instance
                      * which is in a configuration of 2 instances.
                      * */
-                    self.getQuorumVerifier().revalidateVoteset(voteSet, notTimeout != minNotificationInterval);
-                    if (self.getQuorumVerifier() instanceof QuorumOracleMaj && voteSet != null && voteSet.hasAllQuorums() && notTimeout != minNotificationInterval) {
+                    if (self.getQuorumVerifier() instanceof QuorumOracleMaj
+                            && self.getQuorumVerifier().revalidateVoteset(voteSet, notTimeout != minNotificationInterval)) {
                         setPeerState(proposedLeader, voteSet);
                         Vote endVote = new Vote(proposedLeader, proposedZxid, logicalclock.get(), proposedEpoch);
                         leaveInstance(endVote);

From 16187c48a1d9b339866b81e69c522021b031c4c3 Mon Sep 17 00:00:00 2001
From: Elvys Soares <eas5@cin.ufpe.br>
Date: Sun, 27 Jun 2021 15:44:14 +0800
Subject: [PATCH 227/591] ZOOKEEPER-4319: Refactored AtomicFileWritingIdiomTest
 to use TempDir annotation

This is a test refactoring. No original assertion was changed nor the original code presented any failing steps.

**Problem:**
Tests that manipulate external file resources need to guarantee resource integrity and availability. Test suite design and maintainability may suffer from the addition of assurance steps to guarantee parallel execution scenarios and resource leakage from failed previous executions.

**Solution:**
The use of tempdir annotation assures a temporary directory being created and cleaned up for every test method execution, thus simplifying test maintenance steps.

Author: Elvys Soares <eas5@cin.ufpe.br>

Reviewers: maoling <maoling@apache.org>

Closes #1702 from eas5/test_improvement
---
 .../common/AtomicFileWritingIdiomTest.java    | 44 ++++++-------------
 1 file changed, 13 insertions(+), 31 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
index d3e833b33e0..3126f005111 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
@@ -32,21 +32,13 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.OutputStreamStatement;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
-import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class AtomicFileWritingIdiomTest extends ZKTestCase {
 
-    private static File tmpdir;
-
-    @BeforeAll
-    public static void createTmpDir() {
-        tmpdir = new File("build/test/tmp");
-        tmpdir.mkdirs();
-    }
-
     @Test
-    public void testOutputStreamSuccess() throws IOException {
+    public void testOutputStreamSuccess(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -61,11 +53,10 @@ public void write(OutputStream os) throws IOException {
         assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterSuccess() throws IOException {
+    public void testWriterSuccess(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -80,11 +71,10 @@ public void write(Writer os) throws IOException {
         assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailure() throws IOException {
+    public void testOutputStreamFailure(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -107,11 +97,10 @@ public void write(OutputStream os) throws IOException {
         assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterFailure() throws IOException {
+    public void testWriterFailure(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -134,11 +123,10 @@ public void write(Writer os) throws IOException {
         assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailureIOException() throws IOException {
+    public void testOutputStreamFailureIOException(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -161,11 +149,10 @@ public void write(OutputStream os) throws IOException {
         assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterFailureIOException() throws IOException {
+    public void testWriterFailureIOException(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -188,11 +175,10 @@ public void write(Writer os) throws IOException {
         assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailureError() throws IOException {
+    public void testOutputStreamFailureError(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -215,11 +201,10 @@ public void write(OutputStream os) throws IOException {
         assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterFailureError() throws IOException {
+    public void testWriterFailureError(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -242,13 +227,12 @@ public void write(Writer os) throws IOException {
         assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     // ************** target file does not exist
 
     @Test
-    public void testOutputStreamSuccessNE() throws IOException {
+    public void testOutputStreamSuccessNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
@@ -262,11 +246,10 @@ public void write(OutputStream os) throws IOException {
         });
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterSuccessNE() throws IOException {
+    public void testWriterSuccessNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
@@ -281,11 +264,10 @@ public void write(Writer os) throws IOException {
         assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailureNE() throws IOException {
+    public void testOutputStreamFailureNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
@@ -311,7 +293,7 @@ public void write(OutputStream os) throws IOException {
     }
 
     @Test
-    public void testWriterFailureNE() throws IOException {
+    public void testWriterFailureNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();

From 2d3065606a444c0b711c1809ce296db2ba56cb0c Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Wed, 30 Jun 2021 06:53:49 +0000
Subject: [PATCH 228/591] ZOOKEEPER-4284: Add metrics for observer sync time

Motivation

- With enabling the feature of followers hosting observers, we would need a metric to measure the observer sync time just like what we have for the follower sync time.

Changes

- Added the "observer_sync_time" metrics
- Added unit test on the metrics

Author: liwang <liwang@apple.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1691 from li4wang/ZOOKEEPER-4284
---
 .../org/apache/zookeeper/server/ServerMetrics.java |  2 ++
 .../apache/zookeeper/server/quorum/Observer.java   |  4 ++++
 .../apache/zookeeper/test/ObserverMasterTest.java  | 14 ++++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 99e9206987b..8ef5235ef62 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -75,6 +75,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         UPDATE_LATENCY = metricsContext.getSummary("updatelatency", DetailLevel.ADVANCED);
         PROPAGATION_LATENCY = metricsContext.getSummary("propagation_latency", DetailLevel.ADVANCED);
         FOLLOWER_SYNC_TIME = metricsContext.getSummary("follower_sync_time", DetailLevel.BASIC);
+        OBSERVER_SYNC_TIME = metricsContext.getSummary("observer_sync_time", DetailLevel.BASIC);
         ELECTION_TIME = metricsContext.getSummary("election_time", DetailLevel.BASIC);
         LOOKING_COUNT = metricsContext.getCounter("looking_count");
         DIFF_COUNT = metricsContext.getCounter("diff_count");
@@ -296,6 +297,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Summary PROPAGATION_LATENCY;
 
     public final Summary FOLLOWER_SYNC_TIME;
+    public final Summary OBSERVER_SYNC_TIME;
 
     public final Summary ELECTION_TIME;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
index 55e273b0713..d3aa41b5fc7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
@@ -23,6 +23,7 @@
 import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.atomic.AtomicReference;
 import org.apache.jute.Record;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.ObserverBean;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerMetrics;
@@ -114,11 +115,14 @@ void observeLeader() throws Exception {
                     throw new Exception("learned about role change");
                 }
 
+                final long startTime = Time.currentElapsedTime();
                 self.setLeaderAddressAndId(master.addr, master.getId());
                 self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
                 syncWithLeader(newLeaderZxid);
                 self.setZabState(QuorumPeer.ZabState.BROADCAST);
                 completedSync = true;
+                final long syncTime = Time.currentElapsedTime() - startTime;
+                ServerMetrics.getMetrics().OBSERVER_SYNC_TIME.add(syncTime);
                 QuorumPacket qp = new QuorumPacket();
                 while (this.isRunning() && nextLearnerMaster.get() == null) {
                     readPacket(qp);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index 2d2bea7686d..4ba33c7a854 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -55,6 +55,7 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.admin.Commands;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.util.PortForwarder;
@@ -85,6 +86,8 @@ public void testObserver(boolean testObserverMaster) throws Exception {
         assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
                 "waiting for server 3 being up");
 
+        validateObserverSyncTimeMetrics();
+
         if (testObserverMaster) {
             int masterPort = q3.getQuorumPeer().observer.getSocket().getPort();
             LOG.info("port {} {}", masterPort, OM_PORT);
@@ -522,4 +525,15 @@ public void run() {
 
     }
 
+    private void validateObserverSyncTimeMetrics() {
+        final String name = "observer_sync_time";
+        final Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        assertEquals(5, metrics.keySet().stream().filter(key -> key.contains(name)).count());
+        assertNotNull(metrics.get(String.format("avg_%s", name)));
+        assertNotNull(metrics.get(String.format("min_%s", name)));
+        assertNotNull(metrics.get(String.format("max_%s", name)));
+        assertNotNull(metrics.get(String.format("cnt_%s", name)));
+        assertNotNull(metrics.get(String.format("sum_%s", name)));
+    }
 }

From 70f70d821c2c5225edeb54a8af0bd1911a51fc89 Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Wed, 30 Jun 2021 06:59:22 +0000
Subject: [PATCH 229/591] ZOOKEEPER-4318: Only report the follower sync time
 metrics if sync is completed

Motivation

- Currently we report the follower sync time regardless whether sync is completed.  This will give us some noisy data such as 0 sync time in cases where sync immediately failed.

Change

- Only report the sync time if the sync is completed.

Author: liwang <liwang@apple.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Michael Han <hanm@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1712 from li4wang/ZOOKEEPER-4318
---
 .../zookeeper/server/quorum/Follower.java       | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
index 971710c91ab..0eff9d24837 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
@@ -103,16 +103,13 @@ void followLeader() throws InterruptedException {
                     throw new IOException("Error: Epoch of leader is lower");
                 }
                 long startTime = Time.currentElapsedTime();
-                try {
-                    self.setLeaderAddressAndId(leaderServer.addr, leaderServer.getId());
-                    self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
-                    syncWithLeader(newEpochZxid);
-                    self.setZabState(QuorumPeer.ZabState.BROADCAST);
-                    completedSync = true;
-                } finally {
-                    long syncTime = Time.currentElapsedTime() - startTime;
-                    ServerMetrics.getMetrics().FOLLOWER_SYNC_TIME.add(syncTime);
-                }
+                self.setLeaderAddressAndId(leaderServer.addr, leaderServer.getId());
+                self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
+                syncWithLeader(newEpochZxid);
+                self.setZabState(QuorumPeer.ZabState.BROADCAST);
+                completedSync = true;
+                long syncTime = Time.currentElapsedTime() - startTime;
+                ServerMetrics.getMetrics().FOLLOWER_SYNC_TIME.add(syncTime);
                 if (self.getObserverMasterPort() > 0) {
                     LOG.info("Starting ObserverMaster");
 

From e642a325b91ab829aefa47708c7b4b45811d2d23 Mon Sep 17 00:00:00 2001
From: Renan Tomazoni Pinzon <rpinzon@gmail.com>
Date: Sun, 11 Jul 2021 20:01:09 +0800
Subject: [PATCH 230/591] =?UTF-8?q?ZOOKEEPER-3961:=20Improve=20error=20mes?=
 =?UTF-8?q?sage=20for=20zookeeper.intBufferStarting=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…SizeBytes config

Author: Renan Tomazoni Pinzon <rpinzon@gmail.com>

Reviewers: Beluga Behr <dam6923@gmail.com>, maoling <maoling@apache.org>

Closes #1714 from rpinzon/master and squashes the following commits:

1b2c47469 [Renan Tomazoni Pinzon] ZOOKEEPER-3961: Improve error message for zookeeper.intBufferStartingSizeBytes config
f3c5a746b [Renan Tomazoni Pinzon] ZOOKEEPER-3961: Improve error message for zookeeper.intBufferStartingSizeBytes config
---
 .../main/java/org/apache/zookeeper/server/ZooKeeperServer.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index aeeebb9ecd5..51d5db6ea8e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -253,7 +253,7 @@ protected enum State {
         intBufferStartingSizeBytes = Integer.getInteger(INT_BUFFER_STARTING_SIZE_BYTES, DEFAULT_STARTING_BUFFER_SIZE);
 
         if (intBufferStartingSizeBytes < 32) {
-            String msg = "Buffer starting size must be greater than or equal to 32."
+            String msg = "Buffer starting size (" + intBufferStartingSizeBytes + ") must be greater than or equal to 32. "
                          + "Configure with \"-Dzookeeper.intBufferStartingSizeBytes=<size>\" ";
             LOG.error(msg);
             throw new IllegalArgumentException(msg);

From 2aa17ffe428b9ac8477cedfed293b18f12c2376e Mon Sep 17 00:00:00 2001
From: autumind <shen.zhibing@mobcb.com>
Date: Sun, 18 Jul 2021 15:17:50 +0800
Subject: [PATCH 231/591] ZOOKEEPER-4325: Fix bug when list "/" with
 ZkUtil::listSubTreeBFS

Fix bug [ZOOKEEPER-4325](https://issues.apache.org/jira/browse/ZOOKEEPER-4325), re-create PR from [#1719](https://github.com/apache/zookeeper/pull/1719)

Author: autumind <shen.zhibing@mobcb.com>

Reviewers: maoling <maoling@apache.org>

Closes #1729 from autumind/master
---
 .../java/org/apache/zookeeper/ZKUtil.java     |  3 +-
 .../java/org/apache/zookeeper/ZKUtilTest.java | 36 ++++++++++++++++++-
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index fd35ae39a5d..d2063414470 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -193,7 +193,8 @@ public static List<String> listSubTreeBFS(
             String node = queue.poll();
             List<String> children = zk.getChildren(node, false);
             for (final String child : children) {
-                final String childPath = node + "/" + child;
+                // Fix IllegalArgumentException when list "/".
+                final String childPath = (node.equals("/") ? "" : node) + "/" + child;
                 queue.add(childPath);
                 tree.add(childPath);
             }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
index 1111c2a237a..51df907023a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
@@ -20,15 +20,20 @@
 
 import static org.junit.Assume.assumeTrue;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertIterableEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.File;
 import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
 import java.util.UUID;
+import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class ZKUtilTest {
+public class ZKUtilTest extends ClientBase {
 
     private static final File testData = new File(System.getProperty("test.data.dir", "build/test/data"));
 
@@ -85,4 +90,33 @@ public void testUnreadableFileInput() throws Exception {
         assertEquals(expectedMessage, error);
     }
 
+    @Test
+    public void testListRootPathSuccess() throws IOException, InterruptedException, KeeperException {
+        TestableZooKeeper zk = createClient();
+        zk.setData("/", "some".getBytes(), -1);
+        zk.create("/a", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/a/b", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        List<String> list = ZKUtil.listSubTreeBFS(zk, "/");
+        list.remove(Quotas.procZookeeper);
+        list.remove(Quotas.quotaZookeeper);
+        list.remove(ZooDefs.CONFIG_NODE);
+        assertEquals(3, list.size());
+        assertIterableEquals(Arrays.asList("/", "/a", "/a/b"), list);
+    }
+
+    @Test
+    public void testListNoneRootPathSuccess() throws IOException, InterruptedException, KeeperException {
+        TestableZooKeeper zk = createClient();
+        zk.setData("/", "some".getBytes(), -1);
+        zk.create("/a", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/a/b", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        List<String> aList = ZKUtil.listSubTreeBFS(zk, "/a");
+        assertEquals(2, aList.size());
+        assertIterableEquals(Arrays.asList("/a", "/a/b"), aList);
+
+        List<String> bList = ZKUtil.listSubTreeBFS(zk, "/a/b");
+        assertEquals(1, bList.size());
+        assertIterableEquals(Collections.singletonList("/a/b"), bList);
+    }
 }

From a692cbab92e9bae53c9313241d9668d9de97ed8b Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Wed, 28 Jul 2021 11:24:15 +0200
Subject: [PATCH 232/591] ZOOKEEPER-4289: Reduce the performance impact of
 Prometheus metrics

Enabling Prometheus provider has significant impact on the performance of both read and write operations. This is to reduce the impact by making the Prometheus summary reporting as an async operation.

Load test results showed that the avg read latency and throughput after the fix is on par with the performance when Prometheus is disabled. For writes, the avg latency was reduced 25% and the avg throughput was increased 20% after the fix.

Author: liwang <liwang@apple.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <anmolnar@apache.org>

Closes #1698 from li4wang/ZOOKEEPER-4289
---
 .../main/resources/markdown/zookeeperAdmin.md |  18 ++-
 .../prometheus/PrometheusMetricsProvider.java | 121 +++++++++++++++++-
 .../PrometheusMetricsProviderTest.java        |  71 +++++++++-
 3 files changed, 198 insertions(+), 12 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 3ec44a20a7b..a8650f138f5 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2129,7 +2129,23 @@ options are used to configure the [AdminServer](#sc_adminserver).
 * *metricsProvider.exportJvmInfo* :
     If this property is set to **true** Prometheus.io will export useful metrics about the JVM.
     The default is true.
-
+    
+* *metricsProvider.numWorkerThreads* :
+   **New in 3.7.1:**
+   Number of worker threads for reporting Prometheus summary metrics. 
+   Default value is 1. 
+   If the number is less than 1, the main thread will be used.
+    
+* *metricsProvider.maxQueueSize* :
+   **New in 3.7.1:**
+   The max queue size for Prometheus summary metrics reporting task.
+   Default value is 1000000.
+   
+* *metricsProvider.workerShutdownTimeoutMs* :
+   **New in 3.7.1:**
+   The timeout in ms for Prometheus worker threads shutdown.
+   Default value is 1000ms.
+   
 <a name="Communication+using+the+Netty+framework"></a>
 
 ### Communication using the Netty framework
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index a3d5d7a392f..bcafdd93e9b 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -26,9 +26,18 @@
 import java.net.InetSocketAddress;
 import java.util.Enumeration;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Properties;
+import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.RejectedExecutionException;
+import java.util.concurrent.ThreadFactory;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.BiConsumer;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -40,6 +49,7 @@
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.RateLogger;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
@@ -56,6 +66,26 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     private static final Logger LOG = LoggerFactory.getLogger(PrometheusMetricsProvider.class);
     private static final String LABEL = "key";
     private static final String[] LABELS = {LABEL};
+
+    /**
+     * Number of worker threads for reporting Prometheus summary metrics.
+     * Default value is 1.
+     * If the number is less than 1, the main thread will be used.
+     */
+    static final String NUM_WORKER_THREADS = "numWorkerThreads";
+
+    /**
+     * The max queue size for Prometheus summary metrics reporting task.
+     * Default value is 1000000.
+     */
+    static final String MAX_QUEUE_SIZE = "maxQueueSize";
+
+    /**
+     * The timeout in ms for Prometheus worker threads shutdown.
+     * Default value is 1000ms.
+     */
+    static final String WORKER_SHUTDOWN_TIMEOUT_MS = "workerShutdownTimeoutMs";
+
     /**
      * We are using the 'defaultRegistry'.
      * <p>
@@ -64,12 +94,17 @@ public class PrometheusMetricsProvider implements MetricsProvider {
      * </p>
      */
     private final CollectorRegistry collectorRegistry = CollectorRegistry.defaultRegistry;
+    private final RateLogger rateLogger = new RateLogger(LOG, 60 * 1000);
     private String host = "0.0.0.0";
     private int port = 7000;
     private boolean exportJvmInfo = true;
     private Server server;
     private final MetricsServletImpl servlet = new MetricsServletImpl();
     private final Context rootContext = new Context();
+    private int numWorkerThreads = 1;
+    private int maxQueueSize = 1000000;
+    private long workerShutdownTimeoutMs = 1000;
+    private Optional<ExecutorService> executorOptional = Optional.empty();
 
     @Override
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
@@ -77,10 +112,17 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
         this.host = configuration.getProperty("httpHost", "0.0.0.0");
         this.port = Integer.parseInt(configuration.getProperty("httpPort", "7000"));
         this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
+        this.numWorkerThreads = Integer.parseInt(
+                configuration.getProperty(NUM_WORKER_THREADS, "1"));
+        this.maxQueueSize = Integer.parseInt(
+                configuration.getProperty(MAX_QUEUE_SIZE, "1000000"));
+        this.workerShutdownTimeoutMs = Long.parseLong(
+                configuration.getProperty(WORKER_SHUTDOWN_TIMEOUT_MS, "1000"));
     }
 
     @Override
     public void start() throws MetricsProviderLifeCycleException {
+        this.executorOptional = createExecutor();
         try {
             LOG.info("Starting /metrics HTTP endpoint at host: {}, port: {}, exportJvmInfo: {}",
                     host, port, exportJvmInfo);
@@ -120,6 +162,7 @@ public MetricsContext getRootContext() {
 
     @Override
     public void stop() {
+        shutdownExecutor();
         if (server != null) {
             try {
                 server.stop();
@@ -331,7 +374,7 @@ private void unregister() {
 
     }
 
-    private class PrometheusSummary implements Summary {
+    class PrometheusSummary implements Summary {
 
         private final io.prometheus.client.Summary inner;
         private final String name;
@@ -355,16 +398,19 @@ public PrometheusSummary(String name, MetricsContext.DetailLevel level) {
 
         @Override
         public void add(long delta) {
+            reportMetrics(() -> observe(delta));
+        }
+
+        void observe(final long delta) {
             try {
                 inner.observe(delta);
-            } catch (IllegalArgumentException err) {
+            } catch (final IllegalArgumentException err) {
                 LOG.error("invalid delta {} for metric {}", delta, name, err);
             }
         }
-
     }
 
-    private class PrometheusLabelledSummary implements SummarySet {
+    class PrometheusLabelledSummary implements SummarySet {
 
         private final io.prometheus.client.Summary inner;
         private final String name;
@@ -390,9 +436,13 @@ public PrometheusLabelledSummary(String name, MetricsContext.DetailLevel level)
 
         @Override
         public void add(String key, long value) {
+            reportMetrics(() -> observe(key, value));
+        }
+
+        void observe(final String key, final long value) {
             try {
                 inner.labels(key).observe(value);
-            } catch (IllegalArgumentException err) {
+            } catch (final IllegalArgumentException err) {
                 LOG.error("invalid value {} for metric {} with key {}", value, name, key, err);
             }
         }
@@ -410,4 +460,65 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Se
             super.doGet(req, resp);
         }
     }
+
+    private Optional<ExecutorService> createExecutor() {
+        if (numWorkerThreads < 1) {
+            LOG.info("Executor service was not created as numWorkerThreads {} is less than 1", numWorkerThreads);
+            return Optional.empty();
+        }
+
+        final BlockingQueue<Runnable> queue = new LinkedBlockingQueue<>(maxQueueSize);
+        final ThreadPoolExecutor executor = new ThreadPoolExecutor(numWorkerThreads,
+                numWorkerThreads,
+                0L,
+                TimeUnit.MILLISECONDS,
+                queue, new PrometheusWorkerThreadFactory());
+        LOG.info("Executor service was created with numWorkerThreads {} and maxQueueSize {}",
+                numWorkerThreads,
+                maxQueueSize);
+        return Optional.of(executor);
+    }
+
+    private void shutdownExecutor() {
+        if (executorOptional.isPresent()) {
+            LOG.info("Shutdown executor service with timeout {}", workerShutdownTimeoutMs);
+            final ExecutorService executor = executorOptional.get();
+            executor.shutdown();
+            try {
+                if (!executor.awaitTermination(workerShutdownTimeoutMs, TimeUnit.MILLISECONDS)) {
+                    LOG.error("Not all the Prometheus worker threads terminated properly after {} timeout",
+                            workerShutdownTimeoutMs);
+                    executor.shutdownNow();
+                }
+            } catch (final Exception e) {
+                LOG.error("Error occurred while terminating Prometheus worker threads", e);
+                executor.shutdownNow();
+            }
+        }
+    }
+
+    private static class PrometheusWorkerThreadFactory implements ThreadFactory {
+        private static final AtomicInteger workerCounter = new AtomicInteger(1);
+
+        @Override
+        public Thread newThread(final Runnable runnable) {
+            final String threadName = "PrometheusMetricsProviderWorker-" + workerCounter.getAndIncrement();
+            final Thread thread = new Thread(runnable, threadName);
+            thread.setDaemon(true);
+            return thread;
+        }
+    }
+
+    private void reportMetrics(final Runnable task) {
+        if (executorOptional.isPresent()) {
+            try {
+                executorOptional.get().submit(task);
+            } catch (final RejectedExecutionException e) {
+                rateLogger.rateLimitLog("Prometheus metrics reporting task queue size exceeded the max",
+                        String.valueOf(maxQueueSize));
+            }
+        } else {
+            task.run();
+        }
+    }
 }
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 8331b056865..94f1592abe0 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -30,6 +30,8 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Properties;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -178,10 +180,11 @@ public void testGauge() throws Exception {
 
     @Test
     public void testBasicSummary() throws Exception {
-        Summary summary = provider.getRootContext()
+        final PrometheusMetricsProvider.PrometheusSummary summary =
+                (PrometheusMetricsProvider.PrometheusSummary) provider.getRootContext()
                 .getSummary("cc", MetricsContext.DetailLevel.BASIC);
-        summary.add(10);
-        summary.add(10);
+        summary.observe(10);
+        summary.observe(10);
         int[] count = {0};
         provider.dump((k, v) -> {
             count[0]++;
@@ -227,10 +230,11 @@ public void testBasicSummary() throws Exception {
 
     @Test
     public void testAdvancedSummary() throws Exception {
-        Summary summary = provider.getRootContext()
+        final PrometheusMetricsProvider.PrometheusSummary summary =
+                (PrometheusMetricsProvider.PrometheusSummary) provider.getRootContext()
                 .getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
-        summary.add(10);
-        summary.add(10);
+        summary.observe(10);
+        summary.observe(10);
         int[] count = {0};
         provider.dump((k, v) -> {
             count[0]++;
@@ -282,6 +286,61 @@ public void testAdvancedSummary() throws Exception {
         assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\",} 10.0"));
     }
 
+    @Test
+    public void testSummary_sync() throws Exception {
+        final Properties config = new Properties();
+        config.setProperty("numWorkerThreads", "0");
+        config.setProperty("httpPort", "0"); // ephemeral port
+        config.setProperty("exportJvmInfo", "false");
+
+        PrometheusMetricsProvider metricsProvider = null;
+        try {
+            metricsProvider = new PrometheusMetricsProvider();
+            metricsProvider.configure(config);
+            metricsProvider.start();
+
+            final Summary summary =
+                    metricsProvider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC);
+            summary.add(10);
+            summary.add(20);
+
+            final Map<String, Object> res = new HashMap<>();
+            metricsProvider.dump(res::put);
+            assertEquals(3, res.keySet().stream().filter(key -> key.startsWith("cc")).count());
+        } finally {
+            if (metricsProvider != null) {
+                metricsProvider.stop();
+            }
+        }
+    }
+
+    @Test
+    public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
+        final Properties config = new Properties();
+        config.setProperty("numWorkerThreads", "1");
+        config.setProperty("maxQueueSize", "1");
+        config.setProperty("httpPort", "0"); // ephemeral port
+        config.setProperty("exportJvmInfo", "false");
+
+        PrometheusMetricsProvider metricsProvider = null;
+        try {
+            metricsProvider = new PrometheusMetricsProvider();
+            metricsProvider.configure(config);
+            metricsProvider.start();
+            final Summary summary =
+                    metricsProvider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
+
+            // make sure no error is thrown
+            for (int i = 0; i < 10; i++) {
+                summary.add(10);
+            }
+        } finally {
+            if (metricsProvider != null) {
+               metricsProvider.stop();
+            }
+        }
+    }
+
     private String callServlet() throws ServletException, IOException {
         // we are not performing an HTTP request
         // but we are calling directly the servlet

From e7de1cf04925b7e1d06f9add83d90760e5a7a241 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 28 Jul 2021 13:15:22 +0000
Subject: [PATCH 233/591] ZOOKEEPER-4333: QuorumSSLTest - testOCSP fails on
 JDK17

https://issues.apache.org/jira/browse/ZOOKEEPER-4333

in JDK17 the OCSP request is sent in the URI and not inside the POST BODY

Author: Enrico Olivelli <eolivelli@apache.org>
Author: Enrico Olivelli <eolivelli@gmail.com>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1724 from eolivelli/fix/jdk17
---
 .../server/quorum/QuorumSSLTest.java          | 26 ++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index ee7555aadb8..ec8465c7cf6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -34,6 +34,7 @@
 import java.io.OutputStream;
 import java.math.BigInteger;
 import java.net.InetSocketAddress;
+import java.net.URLDecoder;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.KeyStore;
@@ -45,6 +46,8 @@
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.HashMap;
@@ -224,12 +227,24 @@ public OCSPHandler(X509Certificate revokedCert) {
         public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOException {
             byte[] responseBytes;
             try {
+                String uri = httpExchange.getRequestURI().toString();
+                LOG.info("OCSP request: {} {}", httpExchange.getRequestMethod(), uri);
+                httpExchange.getRequestHeaders().entrySet().forEach((e) -> {
+                    LOG.info("OCSP request header: {} {}", e.getKey(), e.getValue());
+                });
                 InputStream request = httpExchange.getRequestBody();
                 byte[] requestBytes = new byte[10000];
-                request.read(requestBytes);
+                int len = request.read(requestBytes);
+                LOG.info("OCSP request size {}", len);
 
+                if (len < 0) {
+                    String removedUriEncoding = URLDecoder.decode(uri.substring(1), "utf-8");
+                    LOG.info("OCSP request from URI no encoding {}", removedUriEncoding);
+                    requestBytes = Base64.getDecoder().decode(removedUriEncoding);
+                }
                 OCSPReq ocspRequest = new OCSPReq(requestBytes);
                 Req[] requestList = ocspRequest.getRequestList();
+                LOG.info("requestList {}", Arrays.toString(requestList));
 
                 DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
 
@@ -243,16 +258,21 @@ public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOEx
                     } else {
                         certificateStatus = CertificateStatus.GOOD;
                     }
-
+                    LOG.info("addResponse {} {}", certId, certificateStatus);
                     responseBuilder.addResponse(certId, certificateStatus, null);
                 }
 
                 X509CertificateHolder[] chain = new X509CertificateHolder[]{new JcaX509CertificateHolder(rootCertificate)};
                 ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(rootKeyPair.getPrivate());
                 BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
-
+                LOG.info("response {}", ocspResponse);
                 responseBytes = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, ocspResponse).getEncoded();
+                LOG.error("OCSP server response OK");
             } catch (OperatorException | CertificateEncodingException | OCSPException exception) {
+                LOG.error("Internal OCSP server error", exception);
+                responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
+            } catch (Throwable exception) {
+                LOG.error("Internal OCSP server error", exception);
                 responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
             }
 

From 7a368b4b196af02190e6e57f18f56598ee32a626 Mon Sep 17 00:00:00 2001
From: Amichai Rothman <amichai@apache.org>
Date: Wed, 28 Jul 2021 13:30:39 +0000
Subject: [PATCH 234/591] =?UTF-8?q?ZOOKEEPER-4204:=20Remove=20unnecessary?=
 =?UTF-8?q?=20creation=20of=20thousands=20of=20thread=20in=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…stances to prevent RequestPathMetricsCollectorTest.testMultiThreadPerf occasional failures

Author: Amichai Rothman <amichai@apache.org>

Reviewers: Michael Han <hanm@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1598 from amichair/ZOOKEEPER-4204
---
 .../util/RequestPathMetricsCollectorTest.java    | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
index f31b13e7470..1c8c882c5dc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
@@ -421,23 +421,23 @@ public void testMultiThreadPerf() throws InterruptedException {
         ThreadPoolExecutor executor = (ThreadPoolExecutor) Executors.newCachedThreadPool();
         //call 100k get Data
         for (int i = 0; i < 100000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(getData, "/path1/path2/path"
-                                                                                                          + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(getData, "/path1/path2/path" + rand.nextInt(10)));
         }
         //5K create
         for (int i = 0; i < 5000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(create2, "/path1/path2/path"
-                                                                                                          + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(create2, "/path1/path2/path" + rand.nextInt(10)));
         }
         //5K delete
         for (int i = 0; i < 5000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(delete, "/path1/path2/path"
-                                                                                                         + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(delete, "/path1/path2/path" + rand.nextInt(10)));
         }
         //40K getChildren
         for (int i = 0; i < 40000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(getChildren, "/path1/path2/path"
-                                                                                                              + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(getChildren, "/path1/path2/path" + rand.nextInt(10)));
         }
         executor.shutdown();
         //wait for at most 10 mill seconds

From b05ea1a8454d806394e1ecdfca550e8c709d4c21 Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Thu, 29 Jul 2021 09:35:47 +0000
Subject: [PATCH 235/591] ZOOKEEPER-4211: Expose Per Namespace Quota Metrics to
 Prometheus

Motivation

In 3.7, Quota limit can be enforced and the quota related stats are captured.  From the "listquota" CLI command, we can the quota limit and usage info. This is an addition to that so we can collect the quota metrics per top namespace and expose them to the Prometheus for monitor and alert purpose.

Summary of Changes

- added 5 quota metrics
- added GaugeSet metric type to group gauge metrics by key
- changed PrometheusMetricsProvider to to support the GaugeSet
- changed ZookeeperServer and DataTree to collect/publish quota metrics

Author: liwang <liwang@apple.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1644 from li4wang/ZOOKEEPER-4211
---
 .../prometheus/PrometheusMetricsProvider.java |  94 ++++-
 .../PrometheusMetricsProviderTest.java        | 395 ++++++++++++++++--
 .../java/org/apache/zookeeper/StatsTrack.java |  18 +
 .../apache/zookeeper/common/PathUtils.java    |  14 +
 .../apache/zookeeper/metrics/CounterSet.java  |  47 +++
 .../apache/zookeeper/metrics/GaugeSet.java    |  37 ++
 .../zookeeper/metrics/MetricsContext.java     |  30 ++
 .../metrics/impl/DefaultMetricsProvider.java  |  40 ++
 .../metrics/impl/NullMetricsProvider.java     |  24 ++
 .../org/apache/zookeeper/server/DataTree.java |  10 +-
 .../zookeeper/server/ServerMetrics.java       |   6 +
 .../zookeeper/server/ZooKeeperServer.java     |  34 +-
 .../server/metric/SimpleCounterSet.java       |  55 +++
 .../server/util/QuotaMetricsUtils.java        | 167 ++++++++
 .../zookeeper/common/PathUtilsTest.java       |   9 +
 .../zookeeper/server/ZooKeeperServerTest.java |  26 ++
 .../server/metric/SimpleCounterSetTest.java   |  61 +++
 .../server/util/QuotaMetricsUtilsTest.java    | 326 +++++++++++++++
 .../zookeeper/test/EnforceQuotaTest.java      |   9 +-
 .../zookeeper/test/ZooKeeperQuotaTest.java    |  88 +++-
 20 files changed, 1417 insertions(+), 73 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index bcafdd93e9b..e17b097859f 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -43,7 +43,9 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -223,6 +225,9 @@ private static String buildKeyForDump(Collector.MetricFamilySamples.Sample sampl
     private void sampleGauges() {
         rootContext.gauges.values()
                 .forEach(PrometheusGaugeWrapper::sample);
+
+        rootContext.gaugeSets.values()
+                .forEach(PrometheusLabelledGaugeWrapper::sample);
     }
 
     @Override
@@ -233,7 +238,9 @@ public void resetAllValues() {
     private class Context implements MetricsContext {
 
         private final ConcurrentMap<String, PrometheusGaugeWrapper> gauges = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledGaugeWrapper> gaugeSets = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, PrometheusCounter> counters = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledCounter> counterSets = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, PrometheusSummary> basicSummaries = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, PrometheusSummary> summaries = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, PrometheusLabelledSummary> basicSummarySets = new ConcurrentHashMap<>();
@@ -250,6 +257,12 @@ public Counter getCounter(String name) {
             return counters.computeIfAbsent(name, PrometheusCounter::new);
         }
 
+        @Override
+        public CounterSet getCounterSet(final String name) {
+            Objects.requireNonNull(name, "Cannot register a CounterSet with null name");
+            return counterSets.computeIfAbsent(name, PrometheusLabelledCounter::new);
+        }
+
         /**
          * Gauges may go up and down, in ZooKeeper they are a way to export
          * internal values with a callback.
@@ -272,6 +285,25 @@ public void unregisterGauge(String name) {
             }
         }
 
+        @Override
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+            Objects.requireNonNull(name, "Cannot register a GaugeSet with null name");
+            Objects.requireNonNull(gaugeSet, "Cannot register a null GaugeSet for " + name);
+
+            gaugeSets.compute(name, (id, prev) ->
+                new PrometheusLabelledGaugeWrapper(name, gaugeSet, prev != null ? prev.inner : null));
+        }
+
+        @Override
+        public void unregisterGaugeSet(final String name) {
+            Objects.requireNonNull(name, "Cannot unregister GaugeSet with null name");
+
+            final PrometheusLabelledGaugeWrapper existing = gaugeSets.remove(name);
+            if (existing != null) {
+                existing.unregister();
+            }
+        }
+
         @Override
         public Summary getSummary(String name, DetailLevel detailLevel) {
             if (detailLevel == DetailLevel.BASIC) {
@@ -344,6 +376,28 @@ public long get() {
 
     }
 
+    private class PrometheusLabelledCounter implements CounterSet {
+        private final String name;
+        private final io.prometheus.client.Counter inner;
+
+        public PrometheusLabelledCounter(final String name) {
+            this.name = name;
+            this.inner = io.prometheus.client.Counter
+                    .build(name, name)
+                    .labelNames(LABELS)
+                    .register(collectorRegistry);
+        }
+
+        @Override
+        public void add(final String key, final long delta) {
+            try {
+                inner.labels(key).inc(delta);
+            } catch (final IllegalArgumentException e) {
+                LOG.error("invalid delta {} for metric {} with key {}", delta, name, key, e);
+            }
+        }
+    }
+
     private class PrometheusGaugeWrapper {
 
         private final io.prometheus.client.Gauge inner;
@@ -371,10 +425,42 @@ private void sample() {
         private void unregister() {
             collectorRegistry.unregister(inner);
         }
+    }
+
+    /**
+     * Prometheus implementation of GaugeSet interface. It wraps the GaugeSet object and
+     * uses the callback API to update the Prometheus Gauge.
+     */
+    private class PrometheusLabelledGaugeWrapper {
+        private final GaugeSet gaugeSet;
+        private final io.prometheus.client.Gauge inner;
+
+        private PrometheusLabelledGaugeWrapper(final String name,
+                                               final GaugeSet gaugeSet,
+                                               final io.prometheus.client.Gauge prev) {
+            this.gaugeSet = gaugeSet;
+            this.inner = prev != null ? prev :
+                    io.prometheus.client.Gauge
+                            .build(name, name)
+                            .labelNames(LABELS)
+                            .register(collectorRegistry);
+        }
 
+        /**
+         * Call the callback provided by the GaugeSet and update Prometheus Gauge.
+         * This method is called when the server is polling for a value.
+         */
+        private void sample() {
+            gaugeSet.values().forEach((key, value) ->
+                this.inner.labels(key).set(value != null ? value.doubleValue() : 0));
+        }
+
+        private void unregister() {
+            collectorRegistry.unregister(inner);
+        }
     }
 
-    class PrometheusSummary implements Summary {
+    private class PrometheusSummary implements Summary {
 
         private final io.prometheus.client.Summary inner;
         private final String name;
@@ -401,7 +487,7 @@ public void add(long delta) {
             reportMetrics(() -> observe(delta));
         }
 
-        void observe(final long delta) {
+        private void observe(final long delta) {
             try {
                 inner.observe(delta);
             } catch (final IllegalArgumentException err) {
@@ -410,7 +496,7 @@ void observe(final long delta) {
         }
     }
 
-    class PrometheusLabelledSummary implements SummarySet {
+    private class PrometheusLabelledSummary implements SummarySet {
 
         private final io.prometheus.client.Summary inner;
         private final String name;
@@ -439,7 +525,7 @@ public void add(String key, long value) {
             reportMetrics(() -> observe(key, value));
         }
 
-        void observe(final String key, final long value) {
+        private void observe(final String key, final long value) {
             try {
                 inner.labels(key).observe(value);
             } catch (final IllegalArgumentException err) {
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 94f1592abe0..9284f52bba9 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -22,6 +22,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
@@ -30,16 +31,25 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Properties;
+import java.util.concurrent.atomic.AtomicInteger;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.Summary;
+import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.hamcrest.CoreMatchers;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -58,6 +68,7 @@ public void setup() throws Exception {
         CollectorRegistry.defaultRegistry.clear();
         provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
+        configuration.setProperty("numWorkerThreads", "0"); // sync behavior for test
         configuration.setProperty("httpHost", "127.0.0.1"); // local host for test
         configuration.setProperty("httpPort", "0"); // ephemeral port
         configuration.setProperty("exportJvmInfo", "false");
@@ -106,6 +117,106 @@ public void testCounters() throws Exception {
         assertThat(res, CoreMatchers.containsString("cc 10.0"));
     }
 
+    @Test
+    public void testCounterSet_single() throws Exception {
+        // create and register a CounterSet
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
+        final String[] keys = {"ns1", "ns2"};
+        final int count = 3;
+
+        // update the CounterSet multiple times
+        for (int i = 0; i < count; i++) {
+            Arrays.asList(keys).forEach(key -> counterSet.inc(key));
+            Arrays.asList(keys).forEach(key -> counterSet.add(key, 2));
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (final String key : keys) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", name, key), count * 3.0);
+        }
+        validateWithDump(expectedMetricsMap);
+
+        // validate with servlet call
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s count", name));
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (final String key : keys) {
+            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", name, key, count * 3.0));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+
+        // validate registering with same name, no overwriting
+        assertSame(counterSet, provider.getRootContext().getCounterSet(name));
+    }
+
+    @Test
+    public void testCounterSet_multiple() throws Exception {
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+
+        final String[] names = new String[]{name + "_1", name + "_2"};
+        final String[] keys = new String[]{"ns21", "ns22"};
+        final int[] counts = new int[] {3, 5};
+
+        final int length = names.length;
+        final CounterSet[] counterSets = new CounterSet[length];
+
+        // create and register the CounterSets
+        for (int i = 0; i < length; i++) {
+            counterSets[i] = provider.getRootContext().getCounterSet(names[i]);
+        }
+
+        // update each CounterSet multiple times
+        for (int i = 0; i < length; i++) {
+            for (int j = 0; j < counts[i]; j++) {
+                counterSets[i].inc(keys[i]);
+            }
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (int i = 0; i < length; i++) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", names[i], keys[i]), counts[i] * 1.0);
+        }
+        validateWithDump(expectedMetricsMap);
+
+        // validate with servlet call
+        final List<String> expectedNames = new ArrayList<>();
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (int i = 0; i < length; i++) {
+            expectedNames.add(String.format("# TYPE %s count", names[i]));
+            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", names[i], keys[i], counts[i]  * 1.0));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+    }
+
+    @Test
+    public void testCounterSet_registerWithNullName() {
+        assertThrows(NullPointerException.class,
+                () -> provider.getRootContext().getCounterSet(null));
+    }
+
+    @Test
+    public void testCounterSet_negativeValue() {
+        // create and register a CounterSet
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
+
+        // add negative value and make sure no exception is thrown
+        counterSet.add("ns1", -1);
+    }
+
+    @Test
+    public void testCounterSet_nullKey() {
+        // create and register a CounterSet
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
+
+        // increment the count with null key and make sure no exception is thrown
+        counterSet.inc(null);
+        counterSet.add(null, 2);
+    }
+
     @Test
     public void testGauge() throws Exception {
         int[] values = {78, -89};
@@ -180,11 +291,10 @@ public void testGauge() throws Exception {
 
     @Test
     public void testBasicSummary() throws Exception {
-        final PrometheusMetricsProvider.PrometheusSummary summary =
-                (PrometheusMetricsProvider.PrometheusSummary) provider.getRootContext()
+        Summary summary = provider.getRootContext()
                 .getSummary("cc", MetricsContext.DetailLevel.BASIC);
-        summary.observe(10);
-        summary.observe(10);
+        summary.add(10);
+        summary.add(10);
         int[] count = {0};
         provider.dump((k, v) -> {
             count[0]++;
@@ -230,11 +340,10 @@ public void testBasicSummary() throws Exception {
 
     @Test
     public void testAdvancedSummary() throws Exception {
-        final PrometheusMetricsProvider.PrometheusSummary summary =
-                (PrometheusMetricsProvider.PrometheusSummary) provider.getRootContext()
+        Summary summary = provider.getRootContext()
                 .getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
-        summary.observe(10);
-        summary.observe(10);
+        summary.add(10);
+        summary.add(10);
         int[] count = {0};
         provider.dump((k, v) -> {
             count[0]++;
@@ -286,34 +395,6 @@ public void testAdvancedSummary() throws Exception {
         assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\",} 10.0"));
     }
 
-    @Test
-    public void testSummary_sync() throws Exception {
-        final Properties config = new Properties();
-        config.setProperty("numWorkerThreads", "0");
-        config.setProperty("httpPort", "0"); // ephemeral port
-        config.setProperty("exportJvmInfo", "false");
-
-        PrometheusMetricsProvider metricsProvider = null;
-        try {
-            metricsProvider = new PrometheusMetricsProvider();
-            metricsProvider.configure(config);
-            metricsProvider.start();
-
-            final Summary summary =
-                    metricsProvider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC);
-            summary.add(10);
-            summary.add(20);
-
-            final Map<String, Object> res = new HashMap<>();
-            metricsProvider.dump(res::put);
-            assertEquals(3, res.keySet().stream().filter(key -> key.startsWith("cc")).count());
-        } finally {
-            if (metricsProvider != null) {
-                metricsProvider.stop();
-            }
-        }
-    }
-
     @Test
     public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
         final Properties config = new Properties();
@@ -341,6 +422,54 @@ public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
         }
     }
 
+    @Test
+    public void testSummarySet() throws Exception {
+        final String name = "ss";
+        final String[] keys = {"ns1", "ns2"};
+        final double count = 3.0;
+
+        // create and register a SummarySet
+        final SummarySet summarySet = provider.getRootContext()
+                .getSummarySet(name, MetricsContext.DetailLevel.BASIC);
+
+        // update the SummarySet multiple times
+        for (int i = 0; i < count; i++) {
+            Arrays.asList(keys).forEach(key -> summarySet.add(key, 1));
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (final String key : keys) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\",quantile=\"0.5\"}", name, key), 1.0);
+            expectedMetricsMap.put(String.format("%s_count{key=\"%s\"}", name, key), count);
+            expectedMetricsMap.put(String.format("%s_sum{key=\"%s\"}", name, key), count);
+        }
+        validateWithDump(expectedMetricsMap);
+
+        // validate with servlet call
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s summary", name));
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (final String key : keys) {
+            expectedMetrics.add(String.format("%s{key=\"%s\",quantile=\"0.5\",} %s", name, key, 1.0));
+            expectedMetrics.add(String.format("%s_count{key=\"%s\",} %s", name, key, count));
+            expectedMetrics.add(String.format("%s_sum{key=\"%s\",} %s", name, key, count));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+
+        // validate registering with same name, no overwriting
+        assertSame(summarySet, provider.getRootContext()
+                .getSummarySet(name, MetricsContext.DetailLevel.BASIC));
+
+        // validate registering with different DetailLevel, not allowed
+        try {
+            provider.getRootContext()
+                    .getSummarySet(name, MetricsContext.DetailLevel.ADVANCED);
+            fail("Can't get the same summarySet with a different DetailLevel");
+        } catch (final IllegalArgumentException e) {
+            assertThat(e.getMessage(), containsString("Already registered"));
+        }
+    }
+
     private String callServlet() throws ServletException, IOException {
         // we are not performing an HTTP request
         // but we are calling directly the servlet
@@ -353,4 +482,198 @@ private String callServlet() throws ServletException, IOException {
         return res;
     }
 
+    @Test
+    public void testGaugeSet_singleGaugeSet() throws Exception {
+        final String name = QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE;
+        final Number[] values = {10.0, 100.0};
+        final String[] keys = {"ns11", "ns12"};
+        final Map<String, Number> metricsMap = new HashMap<>();
+        for (int i = 0; i < values.length; i++) {
+            metricsMap.put(keys[i], values[i]);
+        }
+        final AtomicInteger callCount = new AtomicInteger(0);
+
+        // create and register GaugeSet
+        createAndRegisterGaugeSet(name, metricsMap, callCount);
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (int i = 0; i < values.length; i++) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", name, keys[i]), values[i]);
+        }
+        validateWithDump(expectedMetricsMap);
+        assertEquals(1, callCount.get());
+
+        // validate with servlet call
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s gauge", name));
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (int i = 0; i < values.length; i++) {
+            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", name, keys[i], values[i]));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+        assertEquals(2, callCount.get());
+
+        // unregister the GaugeSet
+        callCount.set(0);
+        provider.getRootContext().unregisterGaugeSet(name);
+
+        // validate with dump call
+        validateWithDump(Collections.emptyMap());
+        assertEquals(0, callCount.get());
+
+        // validate with servlet call
+        validateWithServletCall(new ArrayList<>(), new ArrayList<>());
+        assertEquals(0, callCount.get());
+    }
+
+    @Test
+    public void testGaugeSet_multipleGaugeSets() throws Exception {
+        final String[] names = new String[] {
+                QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE
+        };
+
+        final Number[] values = new Number[] {20.0, 200.0};
+        final String[] keys = new String[]{"ns21", "ns22"};
+        final int count = names.length;
+        final AtomicInteger[] callCounts = new AtomicInteger[count];
+
+        // create and register the GaugeSets
+        for (int i = 0; i < count; i++) {
+            final Map<String, Number> metricsMap = new HashMap<>();
+            metricsMap.put(keys[i], values[i]);
+            callCounts[i] = new AtomicInteger(0);
+            createAndRegisterGaugeSet(names[i], metricsMap, callCounts[i]);
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (int i = 0; i < count; i++) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", names[i], keys[i]), values[i]);
+        }
+        validateWithDump(expectedMetricsMap);
+        for (int i = 0; i < count; i++) {
+            assertEquals(1, callCounts[i].get());
+        }
+
+        // validate with servlet call
+        final List<String> expectedNames = new ArrayList<>();
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (int i = 0; i < count; i++) {
+            expectedNames.add(String.format("# TYPE %s gauge", names[i]));
+            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", names[i], keys[i], values[i]));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+        for (int i = 0; i < count; i++) {
+            assertEquals(2, callCounts[i].get());
+        }
+
+        // unregister the GaugeSets
+        for (int i = 0; i < count; i++) {
+            callCounts[i].set(0);
+            provider.getRootContext().unregisterGaugeSet(names[i]);
+        }
+
+        // validate with dump call
+        validateWithDump(Collections.emptyMap());
+        for (int i = 0; i < count; i++) {
+            assertEquals(0, callCounts[i].get());
+        }
+
+        // validate with servlet call
+        validateWithServletCall(new ArrayList<>(), new ArrayList<>());
+        for (int i = 0; i < count; i++) {
+            assertEquals(0, callCounts[i].get());
+        }
+    }
+
+    @Test
+    public void testGaugeSet_overwriteRegister() {
+        final String[] names = new String[] {
+                QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE
+        };
+
+        final int count = names.length;
+        final Number[] values = new Number[]{30.0, 300.0};
+        final String[] keys = new String[] {"ns31", "ns32"};
+        final AtomicInteger[] callCounts = new AtomicInteger[count];
+
+        // create and register the GaugeSets
+        for (int i = 0; i < count; i++) {
+            final Map<String, Number> metricsMap = new HashMap<>();
+            metricsMap.put(keys[i], values[i]);
+            callCounts[i] = new AtomicInteger(0);
+            // use the same name so the first GaugeSet got overwrite
+            createAndRegisterGaugeSet(names[0], metricsMap, callCounts[i]);
+        }
+
+        // validate with dump call to make sure the second GaugeSet overwrites the first
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        expectedMetricsMap.put(String.format("%s{key=\"%s\"}", names[0], keys[1]), values[1]);
+        validateWithDump(expectedMetricsMap);
+        assertEquals(0, callCounts[0].get());
+        assertEquals(1, callCounts[1].get());
+    }
+
+    @Test
+    public void testGaugeSet_nullKey() {
+        final String name = QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE;
+        final Map<String, Number> metricsMap = new HashMap<>();
+        metricsMap.put(null, 10.0);
+
+        final AtomicInteger callCount = new AtomicInteger(0);
+
+        // create and register GaugeSet
+        createAndRegisterGaugeSet(name, metricsMap, callCount);
+
+        // validate with dump call
+        assertThrows(IllegalArgumentException.class, () -> provider.dump(new HashMap<>()::put));
+
+        // validate with servlet call
+        assertThrows(IllegalArgumentException.class, this::callServlet);
+    }
+
+    @Test
+    public void testGaugeSet_registerWithNullGaugeSet() {
+        assertThrows(NullPointerException.class,
+                () -> provider.getRootContext().registerGaugeSet("name", null));
+
+        assertThrows(NullPointerException.class,
+                () -> provider.getRootContext().registerGaugeSet(null, HashMap::new));
+    }
+
+    @Test
+    public void testGaugeSet_unregisterNull() {
+        assertThrows(NullPointerException.class,
+                () -> provider.getRootContext().unregisterGaugeSet(null));
+    }
+
+    private void createAndRegisterGaugeSet(final String name,
+                                           final Map<String, Number> metricsMap,
+                                           final AtomicInteger callCount) {
+        final GaugeSet gaugeSet = () -> {
+            callCount.addAndGet(1);
+            return metricsMap;
+        };
+        provider.getRootContext().registerGaugeSet(name, gaugeSet);
+    }
+
+    private void validateWithDump(final Map<String, Number> expectedMetrics) {
+        final Map<String, Object> returnedMetrics = new HashMap<>();
+        provider.dump(returnedMetrics::put);
+        assertEquals(expectedMetrics.size(), returnedMetrics.size());
+        expectedMetrics.forEach((key, value) -> assertEquals(value, returnedMetrics.get(key)));
+    }
+
+    private void validateWithServletCall(final List<String> expectedNames,
+                                         final List<String> expectedMetrics) throws Exception {
+        final String response = callServlet();
+        if (expectedNames.isEmpty() && expectedMetrics.isEmpty()) {
+            assertTrue(response.isEmpty());
+        } else {
+            expectedNames.forEach(name -> assertThat(response, CoreMatchers.containsString(name)));
+            expectedMetrics.forEach(metric -> assertThat(response, CoreMatchers.containsString(metric)));
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java b/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
index aaea1d97a2c..02fffb753fc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
@@ -23,6 +23,7 @@
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Objects;
 import java.util.regex.Pattern;
 import org.apache.zookeeper.common.StringUtils;
 
@@ -215,4 +216,21 @@ public String toString() {
     public byte[] getStatsBytes() {
         return toString().getBytes(StandardCharsets.UTF_8);
     }
+
+    @Override
+    public boolean equals(final Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        final StatsTrack that = (StatsTrack) o;
+        return Objects.equals(stats, that.stats);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(stats);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java
index 114df6e6e94..7ddc5576db6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java
@@ -109,4 +109,18 @@ public static String normalizeFileSystemPath(String path) {
          return path;
      }
 
+     /**
+      * return the top namespace of a znode path
+      *
+      * @param path znode path string
+      *
+      * @return the top namespace. If not exist, return null
+      */
+     public static String getTopNamespace(final String path) {
+         if (path == null) {
+             return null;
+         }
+         final String[] parts = path.split("/");
+         return parts.length > 1 ? parts[1] : null;
+     }
  }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java
new file mode 100644
index 00000000000..c9c7c13c489
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics;
+
+/**
+ * A counter refers to a value which can only increase.
+ * Usually the value is reset when the process starts.
+ *
+ *  A CounterSet is a set of {@link Counter} grouped by keys.
+ */
+
+public interface CounterSet {
+    /**
+     * Increment the value by one for the given key
+     * <p>This method is thread safe, The MetricsProvider will take care of synchronization.</p>
+     *
+     * @param key the key to increment the count
+     */
+    default void inc(String key) {
+        add(key, 1L);
+    }
+
+    /**
+     * Increment the value by a given amount for the given key
+     * <p>This method is thread safe, The MetricsProvider will take care of synchronization.</p>
+     *
+     * @param key the key to increment the count for the given key
+     * @param delta amount to increment, this cannot be a negative number.
+     */
+    void add(String key, long delta);
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java
new file mode 100644
index 00000000000..15fd93f3c39
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics;
+
+import java.util.Map;
+
+/**
+ * A Gauge is an application provided object which will be called by the metrics framework to sample a numeric value.
+ *
+ * A GaugeSet is a set of {@link Gauge} grouped by keys.
+ */
+public interface GaugeSet {
+    /**
+     * Returns all values and the associated keys of the GaugeSet.
+     * The MetricsProvider will call this callback without taking care of synchronization, it is up to the application
+     * to handle thread safety.
+     *
+     * @return all the values and keys
+     */
+    Map<String, Number> values();
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java
index 3ea8f8c058a..18ff1180cf7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java
@@ -50,6 +50,15 @@ public interface MetricsContext {
      */
     Counter getCounter(String name);
 
+    /**
+     * Returns the CounterSet identified by the given name
+     * Null name is not allowed
+     *
+     * @param name
+     * @return CounterSet identified by the name in this context.
+     */
+    CounterSet getCounterSet(String name);
+
     /**
      * Registers an user provided {@link Gauge} which will be called by the
      * MetricsProvider in order to sample an integer value.
@@ -71,6 +80,27 @@ public interface MetricsContext {
      */
     void unregisterGauge(String name);
 
+    /**
+     * Registers a user provided {@link GaugeSet} which will be called by the
+     * MetricsProvider in order to sample number values.
+     * If another GaugeSet was already registered, the new one will take its place.
+     * Registering with a null name or null callback is not allowed.
+     *
+     * @param name unique name of the GaugeSet in this context
+     * @param gaugeSet the implementation of the GaugeSet
+     *
+     */
+    void registerGaugeSet(String name, GaugeSet gaugeSet);
+
+    /**
+     * Unregisters the user provided {@link GaugeSet} bound to the given name.
+     *
+     * Unregistering with a null name is not allowed.
+     * @param name unique name of the GaugeSet in this context
+     *
+     */
+    void unregisterGaugeSet(String name);
+
     enum DetailLevel {
         /**
          * The returned Summary is expected to track only simple aggregated
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java
index 85f86db97d0..634ec25d30f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java
@@ -24,7 +24,9 @@
 import java.util.concurrent.ConcurrentMap;
 import java.util.function.BiConsumer;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -35,6 +37,7 @@
 import org.apache.zookeeper.server.metric.AvgMinMaxPercentileCounter;
 import org.apache.zookeeper.server.metric.AvgMinMaxPercentileCounterSet;
 import org.apache.zookeeper.server.metric.SimpleCounter;
+import org.apache.zookeeper.server.metric.SimpleCounterSet;
 
 /**
  * Default implementation of {@link MetricsProvider}.<br>
@@ -64,6 +67,7 @@ public MetricsContext getRootContext() {
     public void stop() {
         // release all references to external objects
         rootMetricsContext.gauges.clear();
+        rootMetricsContext.gaugeSets.clear();
     }
 
     @Override
@@ -79,7 +83,9 @@ public void resetAllValues() {
     private static final class DefaultMetricsContext implements MetricsContext {
 
         private final ConcurrentMap<String, Gauge> gauges = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, GaugeSet> gaugeSets = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, SimpleCounter> counters = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, SimpleCounterSet> counterSets = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, AvgMinMaxCounter> basicSummaries = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, AvgMinMaxPercentileCounter> summaries = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, AvgMinMaxCounterSet> basicSummarySets = new ConcurrentHashMap<>();
@@ -98,6 +104,12 @@ public Counter getCounter(String name) {
             });
         }
 
+        @Override
+        public CounterSet getCounterSet(final String name) {
+            Objects.requireNonNull(name, "Cannot register a CounterSet with null name");
+            return counterSets.computeIfAbsent(name, SimpleCounterSet::new);
+        }
+
         @Override
         public void registerGauge(String name, Gauge gauge) {
             Objects.requireNonNull(gauge, "Cannot register a null Gauge for " + name);
@@ -109,6 +121,19 @@ public void unregisterGauge(String name) {
             gauges.remove(name);
         }
 
+        @Override
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+            Objects.requireNonNull(name, "Cannot register a GaugeSet with null name");
+            Objects.requireNonNull(gaugeSet, "Cannot register a null GaugeSet for " + name);
+            gaugeSets.put(name, gaugeSet);
+        }
+
+        @Override
+        public void unregisterGaugeSet(final String name) {
+            Objects.requireNonNull(name, "Cannot unregister GaugeSet with null name");
+            gaugeSets.remove(name);
+        }
+
         @Override
         public Summary getSummary(String name, DetailLevel detailLevel) {
             if (detailLevel == DetailLevel.BASIC) {
@@ -154,9 +179,21 @@ void dump(BiConsumer<String, Object> sink) {
                     sink.accept(name, value);
                 }
             });
+
+            gaugeSets.forEach((name, gaugeSet) ->
+                gaugeSet.values().forEach((key, value) -> {
+                    if (key != null) {
+                        sink.accept(key + "_" + name, value != null ? value : 0);
+                    }
+                })
+            );
+
             counters.values().forEach(metric -> {
                 metric.values().forEach(sink);
             });
+            counterSets.values().forEach(metric -> {
+                metric.values().forEach(sink);
+            });
             basicSummaries.values().forEach(metric -> {
                 metric.values().forEach(sink);
             });
@@ -175,6 +212,9 @@ void reset() {
             counters.values().forEach(metric -> {
                 metric.reset();
             });
+            counterSets.values().forEach(metric -> {
+                metric.reset();
+            });
             basicSummaries.values().forEach(metric -> {
                 metric.reset();
             });
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java
index 30a10795fa8..8d07e91865d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java
@@ -21,7 +21,9 @@
 import java.util.Properties;
 import java.util.function.BiConsumer;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -77,6 +79,11 @@ public Counter getCounter(String name) {
             return NullCounter.INSTANCE;
         }
 
+        @Override
+        public CounterSet getCounterSet(final String name) {
+            return NullCounterSet.INSTANCE;
+        }
+
         @Override
         public void registerGauge(String name, Gauge gauge) {
         }
@@ -85,6 +92,14 @@ public void registerGauge(String name, Gauge gauge) {
         public void unregisterGauge(String name) {
         }
 
+        @Override
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+        }
+
+        @Override
+        public void unregisterGaugeSet(final String name) {
+        }
+
         @Override
         public Summary getSummary(String name, DetailLevel detailLevel) {
             return NullSummary.INSTANCE;
@@ -112,6 +127,15 @@ public long get() {
 
     }
 
+    private static final class NullCounterSet implements CounterSet {
+
+        private static final NullCounterSet INSTANCE = new NullCounterSet();
+
+        @Override
+        public void add(final String key, final long delta) {
+        }
+    }
+
     private static final class NullSummary implements Summary {
 
         private static final NullSummary INSTANCE = new NullSummary();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index fc556a5f4ff..2818e15aa9e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -56,6 +56,7 @@
 import org.apache.zookeeper.audit.AuditEvent.Result;
 import org.apache.zookeeper.audit.ZKAuditProvider;
 import org.apache.zookeeper.common.PathTrie;
+import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.data.StatPersisted;
@@ -1628,13 +1629,8 @@ public ReferenceCountedACLCache getReferenceCountedAclCache() {
         return aclCache;
     }
 
-    private String getTopNamespace(String path) {
-        String[] parts = path.split("/");
-        return parts.length > 1 ? parts[1] : null;
-    }
-
     private void updateReadStat(String path, long bytes) {
-        String namespace = getTopNamespace(path);
+        final String namespace = PathUtils.getTopNamespace(path);
         if (namespace == null) {
             return;
         }
@@ -1643,7 +1639,7 @@ private void updateReadStat(String path, long bytes) {
     }
 
     private void updateWriteStat(String path, long bytes) {
-        String namespace = getTopNamespace(path);
+        final String namespace = PathUtils.getTopNamespace(path);
         if (namespace == null) {
             return;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 8ef5235ef62..af156542f03 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsContext.DetailLevel;
 import org.apache.zookeeper.metrics.MetricsProvider;
@@ -26,6 +27,7 @@
 import org.apache.zookeeper.metrics.SummarySet;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.metrics.impl.NullMetricsProvider;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -260,6 +262,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         WATCH_BYTES = metricsContext.getCounter("watch_bytes");
 
         JVM_PAUSE_TIME = metricsContext.getSummary("jvm_pause_time_ms", DetailLevel.ADVANCED);
+
+        QUOTA_EXCEEDED_ERROR_PER_NAMESPACE = metricsContext.getCounterSet(QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE);
     }
 
     /**
@@ -511,6 +515,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
     public final Summary JVM_PAUSE_TIME;
 
+    public final CounterSet QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 51d5db6ea8e..86c13aea386 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -52,6 +52,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.ZookeeperBanner;
+import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.data.ACL;
@@ -82,6 +83,7 @@
 import org.apache.zookeeper.server.quorum.ReadOnlyZooKeeperServer;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.server.util.OSMXBean;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.apache.zookeeper.server.util.RequestPathMetricsCollector;
 import org.apache.zookeeper.txn.CreateSessionTxn;
 import org.apache.zookeeper.txn.TxnDigest;
@@ -1913,6 +1915,15 @@ protected void registerMetrics() {
         rootContext.registerGauge("auth_failed_count", stats::getAuthFailedCount);
         rootContext.registerGauge("non_mtls_remote_conn_count", stats::getNonMTLSRemoteConnCount);
         rootContext.registerGauge("non_mtls_local_conn_count", stats::getNonMTLSLocalConnCount);
+
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaCountLimit(zkDb.getDataTree()));
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaBytesLimit(zkDb.getDataTree()));
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaCountUsage(zkDb.getDataTree()));
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaBytesUsage(zkDb.getDataTree()));
     }
 
     protected void unregisterMetrics() {
@@ -1952,7 +1963,10 @@ protected void unregisterMetrics() {
         rootContext.unregisterGauge("non_mtls_remote_conn_count");
         rootContext.unregisterGauge("non_mtls_local_conn_count");
 
-
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE);
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE);
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE);
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE);
     }
 
     /**
@@ -2038,12 +2052,13 @@ public void checkQuota(String path, byte[] lastData, byte[] data, int type) thro
             return;
         }
 
+        final String namespace = PathUtils.getTopNamespace(path);
         switch (type) {
             case OpCode.create:
-                checkQuota(lastPrefix, dataBytes, 1);
+                checkQuota(lastPrefix, dataBytes, 1, namespace);
                 break;
             case OpCode.setData:
-                checkQuota(lastPrefix, dataBytes - (lastData == null ? 0 : lastData.length), 0);
+                checkQuota(lastPrefix, dataBytes - (lastData == null ? 0 : lastData.length), 0, namespace);
                 break;
              default:
                  throw new IllegalArgumentException("Unsupported OpCode for checkQuota: " + type);
@@ -2059,8 +2074,10 @@ public void checkQuota(String path, byte[] lastData, byte[] data, int type) thro
      *            the diff to be added to number of bytes
      * @param countDiff
      *            the diff to be added to the count
+     * @param namespace
+      *           the namespace for collecting quota exceeded errors
      */
-    private void checkQuota(String lastPrefix, long bytesDiff, long countDiff)
+    private void checkQuota(String lastPrefix, long bytesDiff, long countDiff, String namespace)
             throws KeeperException.QuotaExceededException {
         LOG.debug("checkQuota: lastPrefix={}, bytesDiff={}, countDiff={}", lastPrefix, bytesDiff, countDiff);
 
@@ -2108,6 +2125,7 @@ private void checkQuota(String lastPrefix, long bytesDiff, long countDiff)
                 String msg = "Quota exceeded: " + lastPrefix + " [current count=" + newCount + ", " + (isCountHardLimit ? "hard" : "soft") + "CountLimit=" + countLimit + "]";
                 RATE_LOGGER.rateLimitLog(msg);
                 if (isCountHardLimit) {
+                    updateQuotaExceededMetrics(namespace);
                     throw new KeeperException.QuotaExceededException(lastPrefix);
                 }
             }
@@ -2122,6 +2140,7 @@ private void checkQuota(String lastPrefix, long bytesDiff, long countDiff)
                 String msg = "Quota exceeded: " + lastPrefix + " [current bytes=" + newBytes + ", " + (isByteHardLimit ? "hard" : "soft") + "ByteLimit=" + byteLimit + "]";
                 RATE_LOGGER.rateLimitLog(msg);
                 if (isByteHardLimit) {
+                    updateQuotaExceededMetrics(namespace);
                     throw new KeeperException.QuotaExceededException(lastPrefix);
                 }
             }
@@ -2306,4 +2325,11 @@ public ZooKeeperServerShutdownHandler getZkShutdownHandler() {
         return zkShutdownHandler;
     }
 
+    static void updateQuotaExceededMetrics(final String namespace) {
+        if (namespace == null) {
+            return;
+        }
+        ServerMetrics.getMetrics().QUOTA_EXCEEDED_ERROR_PER_NAMESPACE.add(namespace, 1);
+    }
 }
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java
new file mode 100644
index 00000000000..63166de3f20
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.metric;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import org.apache.zookeeper.metrics.CounterSet;
+
+/**
+ * Represent a set of counters identified by different keys.
+ * The counter is thread-safe
+ */
+public class SimpleCounterSet extends Metric implements CounterSet {
+    private final String name;
+    private final ConcurrentHashMap<String, SimpleCounter> counters = new ConcurrentHashMap<>();
+
+    public SimpleCounterSet(final String name) {
+        this.name = name;
+    }
+
+    @Override
+    public void add(final String key, final long delta) {
+        final SimpleCounter counter = counters.computeIfAbsent(key, (k) -> new SimpleCounter(k + "_" + name));
+        counter.add(delta);
+    }
+
+    @Override
+    public void reset() {
+        counters.values().forEach(SimpleCounter::reset);
+    }
+
+    @Override
+    public Map<String, Object> values() {
+        final Map<String, Object> m = new LinkedHashMap<>();
+        counters.values().forEach(counter -> m.putAll(counter.values()));
+        return m;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java
new file mode 100644
index 00000000000..f989b342364
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java
@@ -0,0 +1,167 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import org.apache.zookeeper.Quotas;
+import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.server.DataNode;
+import org.apache.zookeeper.server.DataTree;
+
+public final class QuotaMetricsUtils {
+    public static final String QUOTA_COUNT_LIMIT_PER_NAMESPACE = "quota_count_limit_per_namespace";
+    public static final String QUOTA_BYTES_LIMIT_PER_NAMESPACE = "quota_bytes_limit_per_namespace";
+    public static final String QUOTA_COUNT_USAGE_PER_NAMESPACE = "quota_count_usage_per_namespace";
+    public static final String QUOTA_BYTES_USAGE_PER_NAMESPACE = "quota_bytes_usage_per_namespace";
+    public static final String QUOTA_EXCEEDED_ERROR_PER_NAMESPACE = "quota_exceeded_error_per_namespace";
+
+    enum QUOTA_LIMIT_USAGE_METRIC_TYPE {QUOTA_COUNT_LIMIT, QUOTA_BYTES_LIMIT, QUOTA_COUNT_USAGE, QUOTA_BYTES_USAGE}
+    static final String LIMIT_END_STRING = "/" + Quotas.limitNode;
+    static final String STATS_END_STRING = "/" + Quotas.statNode;
+
+    private QuotaMetricsUtils() {
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota count limit
+     *
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return a map with top namespace as the key and quota count limit as the value
+     *
+     */
+    public static Map<String, Number> getQuotaCountLimit(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT);
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota bytes limit
+     *`
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return a map with top namespace as the key and quota bytes limit as the value
+     *
+     */
+    public static Map<String, Number> getQuotaBytesLimit(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT);
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota count usage
+     *
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return a map with top namespace as the key and quota count usage as the value
+     *
+     */
+    public static Map<String, Number> getQuotaCountUsage(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE);
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota bytes usage
+     *
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return  a map with top namespace as the key and quota bytes usage as the value
+     *
+     */
+    public static Map<String, Number> getQuotaBytesUsage(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE);
+    }
+
+    // traverse the quota subtree and read the quota limit or usage data
+    private static Map<String, Number> getQuotaLimitOrUsage(final DataTree dataTree,
+                                                            final QUOTA_LIMIT_USAGE_METRIC_TYPE type) {
+        final Map<String, Number> metricsMap = new ConcurrentHashMap<>();
+        if (dataTree != null) {
+            getQuotaLimitOrUsage(Quotas.quotaZookeeper, metricsMap, type, dataTree);
+        }
+        return metricsMap;
+    }
+
+    private static void getQuotaLimitOrUsage(final String path,
+                                     final Map<String, Number> metricsMap,
+                                     final QUOTA_LIMIT_USAGE_METRIC_TYPE type,
+                                     final DataTree dataTree) {
+        final DataNode node = dataTree.getNode(path);
+        if (node == null) {
+            return;
+        }
+        final String[] children;
+        synchronized (node) {
+            children = node.getChildren().toArray(new String[0]);
+        }
+        if (children.length == 0) {
+            if (shouldCollect(path, type)) {
+                collectQuotaLimitOrUsage(path, node, metricsMap, type);
+            }
+            return;
+        }
+        for (final String child : children) {
+            getQuotaLimitOrUsage(path + "/" + child, metricsMap, type, dataTree);
+        }
+    }
+
+    static boolean shouldCollect(final String path, final QUOTA_LIMIT_USAGE_METRIC_TYPE type) {
+        return path.endsWith(LIMIT_END_STRING)
+                && (QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT == type || QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT == type)
+                || path.endsWith(STATS_END_STRING)
+                && (QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE == type || QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE == type);
+    }
+
+    static void collectQuotaLimitOrUsage(final String path,
+                                         final DataNode node,
+                                         final Map<String, Number> metricsMap,
+                                         final QUOTA_LIMIT_USAGE_METRIC_TYPE type) {
+        final String namespace = PathUtils.getTopNamespace(Quotas.trimQuotaPath(path));
+        if (namespace == null) {
+            return;
+        }
+        final byte[] data = node.getData();
+        if (data == null) {
+            return;
+        }
+        final StatsTrack statsTrack = new StatsTrack(data);
+        switch (type) {
+            case QUOTA_COUNT_LIMIT:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, getQuotaLimit(statsTrack.getCountHardLimit(), statsTrack.getCount()));
+                break;
+            case QUOTA_BYTES_LIMIT:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, getQuotaLimit(statsTrack.getByteHardLimit(), statsTrack.getBytes()));
+                break;
+            case QUOTA_COUNT_USAGE:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, statsTrack.getCount());
+                break;
+            case QUOTA_BYTES_USAGE:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, statsTrack.getBytes());
+                break;
+            default:
+        }
+    }
+
+    // hard limit takes precedence if specified
+    static long getQuotaLimit(final long hardLimit, final long limit) {
+        return hardLimit > -1 ? hardLimit : limit;
+    }
+
+    private static void aggregateQuotaLimitOrUsage(final String namespace,
+                                           final Map<String, Number> metricsMap,
+                                           final long limitOrUsage) {
+        metricsMap.put(namespace, metricsMap.getOrDefault(namespace, 0).longValue() + limitOrUsage);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
index 25bb55df2be..fb4f4bd73bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.ZKTestCase;
 import org.junit.jupiter.api.Test;
@@ -156,4 +158,11 @@ public void testValidatePath_SupplementaryChar() {
         });
     }
 
+    @Test
+    public void testGetTopNamespace() {
+        assertEquals("n0", PathUtils.getTopNamespace("/n0/n1/n2/n3"));
+        assertNull(PathUtils.getTopNamespace("/"));
+        assertNull(PathUtils.getTopNamespace(""));
+        assertNull(PathUtils.getTopNamespace(null));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index 143938bd849..bd141206905 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -27,11 +28,15 @@
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.List;
+import java.util.Map;
+import java.util.UUID;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.Test;
 
@@ -164,4 +169,25 @@ public void testClientZxidAhead() {
         assertEquals(e.getReason(), ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
     }
 
+    @Test
+    public void testUpdateQuotaExceededMetrics() {
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final String namespace = UUID.randomUUID().toString();
+        final long count = 3L;
+
+        for (int i = 0; i < count; i++) {
+            ZooKeeperServer.updateQuotaExceededMetrics(namespace);
+        }
+
+        final Map<String, Object> values = MetricsUtils.currentServerMetrics();
+        assertEquals(1, values.keySet().stream().filter(
+                key -> key.contains(String.format("%s_%s", namespace, name))).count());
+
+        assertEquals(count, values.get(String.format("%s_%s", namespace, name)));
+    }
+
+    @Test
+    public void testUpdateQuotaExceededMetrics_nullNamespace() {
+        assertDoesNotThrow(() -> ZooKeeperServer.updateQuotaExceededMetrics(null));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java
new file mode 100644
index 00000000000..3260475459c
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java
@@ -0,0 +1,61 @@
+ /*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.metric;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.util.Map;
+import org.apache.zookeeper.ZKTestCase;
+import org.junit.jupiter.api.Test;
+
+
+public class SimpleCounterSetTest extends ZKTestCase {
+    @Test
+    public void testValues() {
+        final SimpleCounterSet simpleCounterSet = createSimpleCounterSetAddData("test1");
+        final Map<String, Object> values = simpleCounterSet.values();
+
+        assertEquals(2, values.size());
+        assertEquals(30L , values.get("key1_test1"));
+        assertEquals(70L , values.get("key2_test1"));
+    }
+
+    @Test
+    public void testReset() {
+        final SimpleCounterSet simpleCounterSet = createSimpleCounterSetAddData("test2");
+        simpleCounterSet.reset();
+
+        final Map<String, Object> values = simpleCounterSet.values();
+
+        assertEquals(2, values.size());
+        assertEquals(0L , values.get("key1_test2"));
+        assertEquals(0L , values.get("key2_test2"));
+    }
+
+    private SimpleCounterSet createSimpleCounterSetAddData(final String name) {
+        final SimpleCounterSet simpleCounterSet = new SimpleCounterSet(name);
+
+        simpleCounterSet.add("key1", 10);
+        simpleCounterSet.add("key1", 20);
+
+        simpleCounterSet.add("key2", 30);
+        simpleCounterSet.add("key2", 40);
+
+        return simpleCounterSet;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java
new file mode 100644
index 00000000000..5e5f979feee
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java
@@ -0,0 +1,326 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.UUID;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.Quotas;
+import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.metrics.MetricsContext;
+import org.apache.zookeeper.metrics.MetricsProvider;
+import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.server.DataNode;
+import org.apache.zookeeper.server.DataTree;
+import org.apache.zookeeper.server.ServerMetrics;
+import org.junit.jupiter.api.Test;
+
+public class QuotaMetricsUtilsTest extends ZKTestCase {
+    @Test
+    public void testQuotaMetrics_singleQuotaSubtree() throws Exception {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        final DataTree dt = new DataTree();
+        registerQuotaMetrics(nameSuffix, dt);
+
+        // build the data tree
+        final String ns = UUID.randomUUID().toString();
+
+        final long countLimit = 10;
+        final long bytesLimit = 100;
+        final long countHardLimit = 5;
+        final long bytesHardLimit = 50;
+
+        final long countUsage = 5;
+        final long bytesUsage = 40;
+
+        final StatsTrack limitTrack = buildLimitStatsTrack(countLimit, bytesLimit, countHardLimit, bytesHardLimit);
+        final StatsTrack usageTrack = buildUsageStatsTrack(countUsage, bytesUsage);
+        buildDataTree("/" + ns, limitTrack, usageTrack, dt);
+
+        // validate the quota metrics
+        validateQuotaMetrics(ns, countHardLimit, bytesHardLimit, countUsage, bytesUsage, nameSuffix);
+    }
+
+
+    @Test
+    public void testQuotaMetrics_multipleQuotaSubtrees() throws Exception {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        final DataTree dt = new DataTree();
+        registerQuotaMetrics(nameSuffix, dt);
+
+        // build the data tree
+        final String ns = UUID.randomUUID().toString();
+
+        final long countLimit1 = 10;
+        final long bytesLimit1 = 100;
+        final long countHardLimit1 = 5;
+        final long bytesHardLimit1 = 50;
+
+        final long countUsage1 = 5;
+        final long bytesUsage1 = 40;
+
+        final StatsTrack limitTrack1 = buildLimitStatsTrack(countLimit1, bytesLimit1, countHardLimit1, bytesHardLimit1);
+        final StatsTrack usageTrack1 = buildUsageStatsTrack(countUsage1, bytesUsage1);
+
+        buildDataTree("/" + ns + "/a/b", limitTrack1, usageTrack1, dt);
+
+        // validate the quota metrics
+        validateQuotaMetrics(ns, countHardLimit1, bytesHardLimit1, countUsage1, bytesUsage1, nameSuffix);
+
+        // update the data tree with another quota subtree
+        final long countLimit2 = 20;
+        final long bytesLimit2 = 200;
+        final long countHardLimit2 = 10;
+        final long bytesHardLimit2 = 100;
+
+        final long countUsage2 = 9;
+        final long bytesUsage2 = 80;
+
+        final StatsTrack limitTrack2 = buildLimitStatsTrack(countLimit2, bytesLimit2, countHardLimit2, bytesHardLimit2);
+        final StatsTrack usageTrack2 = buildUsageStatsTrack(countUsage2, bytesUsage2);
+
+        buildDataTree("/" + ns + "/a/c/d", limitTrack2, usageTrack2, dt);
+
+        // validate the quota metrics
+        validateQuotaMetrics(ns, countHardLimit1 + countHardLimit2, bytesHardLimit1 + bytesHardLimit2,
+                countUsage1 + countUsage2, bytesUsage1 + bytesUsage2, nameSuffix);
+    }
+
+    @Test
+    public void testQuotaMetrics_noUsage() throws Exception {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        final DataTree dt = new DataTree();
+        registerQuotaMetrics(nameSuffix, dt);
+
+        // build the data tree
+        final String ns = UUID.randomUUID().toString();
+
+        final long countLimit = 20;
+        final long bytesLimit = 200;
+        final long countHardLimit = -1;
+        final long bytesHardLimit = -1;
+
+        final long countUsage = 1;  // the node itself is always counted
+        final long bytesUsage = 0;
+
+        final StatsTrack limitTrack = buildLimitStatsTrack(countLimit, bytesLimit, countHardLimit, bytesHardLimit);
+        final StatsTrack usageTrack = buildUsageStatsTrack(countUsage, bytesUsage);
+        buildDataTree("/" + ns, limitTrack, usageTrack, dt);
+
+        // validate the quota
+        validateQuotaMetrics(ns, countLimit, bytesLimit, countUsage, bytesUsage, nameSuffix);
+    }
+
+    @Test
+    public void testQuotaMetrics_nullDataTree() {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        registerQuotaMetrics(nameSuffix, null);
+
+        // validate the quota
+        validateQuotaMetrics(UUID.randomUUID().toString(), null, null, null, null, nameSuffix);
+    }
+
+    @Test
+    public void testQuotaMetrics_emptyDataTree() {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        registerQuotaMetrics(nameSuffix, new DataTree());
+
+        // validate the quota
+        validateQuotaMetrics(UUID.randomUUID().toString(), null, null, null, null, nameSuffix);
+    }
+
+    @Test
+    public void testShouldCollect_limitPath() {
+        final String limitPath = Quotas.quotaPath("/ns1") + QuotaMetricsUtils.LIMIT_END_STRING;
+
+        assertTrue(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT));
+        assertTrue(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT));
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE));
+        assertFalse(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE));
+    }
+
+    @Test
+    public void testShouldCollect_usagePath() {
+        final String usagePath = Quotas.quotaPath("/ns1") + QuotaMetricsUtils.STATS_END_STRING;
+
+        assertTrue(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE));
+        assertTrue(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE));
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT));
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT));
+    }
+
+    @Test
+    public void testShouldCollect_notLimitOrUsagePath() {
+        final String usagePath = Quotas.quotaPath("/ns1") + "/notLimitOrUsage";
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE));
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE));
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT));
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT));
+    }
+
+    @Test
+    public void testGetQuotaLimit() {
+        assertEquals(0L, QuotaMetricsUtils.getQuotaLimit(0L, -1L));
+        assertEquals(1L, QuotaMetricsUtils.getQuotaLimit(-1L, 1L));
+        assertEquals(0L, QuotaMetricsUtils.getQuotaLimit(-2L, 0L));
+    }
+
+    @Test
+    public void testCollectQuotaMetrics_noData() {
+        final Map<String, Number> metricsMap = new HashMap<>();
+
+        QuotaMetricsUtils.collectQuotaLimitOrUsage(Quotas.quotaPath("/ns1") + QuotaMetricsUtils.LIMIT_END_STRING,
+                                        new DataNode(new byte[0], null, null),
+                                        metricsMap,
+                                        QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT);
+
+        assertEquals(1, metricsMap.size());
+        final Map.Entry<String, Number> entry = metricsMap.entrySet().iterator().next();
+        assertEquals("ns1", entry.getKey());
+        assertEquals(-1L,  entry.getValue().longValue());
+    }
+
+    @Test
+    public void testCollectQuotaMetrics_nullData() {
+        final Map<String, Number> metricsMap = new HashMap<>();
+
+        QuotaMetricsUtils.collectQuotaLimitOrUsage(Quotas.quotaPath("/ns1") + QuotaMetricsUtils.LIMIT_END_STRING,
+                new DataNode(null, null, null),
+                metricsMap,
+                QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT);
+
+        assertEquals(0, metricsMap.size());
+    }
+
+    @Test
+    public void testCollectQuotaMetrics_noNamespace() {
+        final Map<String, Number> metricsMap = new HashMap<>();
+
+        QuotaMetricsUtils.collectQuotaLimitOrUsage("/zookeeper/quota",
+                new DataNode(null, null, null),
+                metricsMap,
+                QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE);
+
+        assertEquals(0, metricsMap.size());
+    }
+
+    private void registerQuotaMetrics(final String nameSuffix, final DataTree dt) {
+        final MetricsProvider metricProvider = ServerMetrics.getMetrics().getMetricsProvider();
+        final MetricsContext rootContext = metricProvider.getRootContext();
+
+        // added random UUID as NAME_SUFFIX to avoid GaugeSet being overwritten when registering with same name
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaCountLimit(dt));
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaBytesLimit(dt));
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaCountUsage(dt));
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaBytesUsage(dt));
+    }
+
+    private StatsTrack buildLimitStatsTrack(final long countLimit,
+                                            final long bytesLimit,
+                                            final long countHardLimit,
+                                            final long bytesHardLimit) {
+        final StatsTrack limitTrack = new StatsTrack();
+        limitTrack.setCount(countLimit);
+        limitTrack.setBytes(bytesLimit);
+        limitTrack.setCountHardLimit(countHardLimit);
+        limitTrack.setByteHardLimit(bytesHardLimit);
+        return limitTrack;
+    }
+
+    private StatsTrack buildUsageStatsTrack(final long countUsage,
+                                            final long bytesUsage) {
+        final StatsTrack usageTrack = new StatsTrack();
+        usageTrack.setCount(countUsage);
+        usageTrack.setBytes(bytesUsage);
+
+        return usageTrack;
+    }
+
+    private void buildDataTree(final String path,
+                               final StatsTrack limitTrack,
+                               final StatsTrack usageTrack,
+                               final DataTree dataTree) throws Exception {
+
+        // create the ancestor and child data nodes
+        buildAncestors(path, dataTree);
+        int childCount = (int) usageTrack.getCount() - 1; // the node count always includes the top namespace itself
+        if (childCount > 0) {
+            int dataBytes = (int) usageTrack.getBytes() / childCount;
+            for (int i = 0; i < childCount; i++) {
+                dataTree.createNode(path + "/n_" + i, new byte[dataBytes], null, -1, 1, 1, 1);
+            }
+        }
+
+        // create the quota tree
+        buildAncestors(Quotas.quotaPath(path), dataTree);
+
+        final String limitPath = Quotas.limitPath(path);
+        dataTree.createNode(limitPath, limitTrack.getStatsBytes(), null, -1, 1, 1, 1);
+        assertEquals(limitTrack, new StatsTrack(dataTree.getNode(limitPath).getData()));
+
+        final String usagePath = Quotas.statPath(path);
+        dataTree.createNode(usagePath, usageTrack.getStatsBytes(), null, -1, 1, 1, 1);
+        assertEquals(usageTrack, new StatsTrack(dataTree.getNode(usagePath).getData()));
+    }
+
+    private void buildAncestors(final String path, final DataTree dataTree) throws Exception {
+        final String[] parts = path.split("/");
+        String nodePath = "";
+
+        for (int i = 1; i < parts.length; i++) {
+            nodePath = nodePath + "/" + parts[i];
+            try {
+                dataTree.createNode(nodePath, null, null, -1, 1, 1, 1);
+            } catch (final KeeperException.NodeExistsException e) {
+                // ignored
+            }
+        }
+    }
+
+    private void validateQuotaMetrics(final String namespace,
+                                      final Long countLimit,
+                                      final Long bytesLimit,
+                                      final Long countUsage,
+                                      final Long bytesUsage,
+                                      final String nameSuffix) {
+        final Map<String, Object> values = MetricsUtils.currentServerMetrics();
+        assertEquals(countLimit, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE + nameSuffix));
+        assertEquals(bytesLimit, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE + nameSuffix));
+        assertEquals(countUsage, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE + nameSuffix));
+        assertEquals(bytesUsage, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE + nameSuffix));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
index 470ce39d97e..c489618bf57 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.Assert.fail;
+import java.util.UUID;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.StatsTrack;
@@ -54,7 +55,8 @@ public void tearDown() throws Exception {
 
     @Test
     public void testSetQuotaDisableWhenExceedBytesHardQuota() throws Exception {
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "12345".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         StatsTrack st = new StatsTrack();
         st.setByteHardLimit(5L);
@@ -62,6 +64,7 @@ public void testSetQuotaDisableWhenExceedBytesHardQuota() throws Exception {
 
         try {
             zk.setData(path, "123456".getBytes(), -1);
+            ZooKeeperQuotaTest.validateNoQuotaExceededMetrics(namespace);
         } catch (KeeperException.QuotaExceededException e) {
             fail("should not throw Byte Quota Exceeded Exception when enforce quota disables");
         }
@@ -70,7 +73,8 @@ public void testSetQuotaDisableWhenExceedBytesHardQuota() throws Exception {
     @Test
     public void testSetQuotaDisableWhenExceedCountHardQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int count = 2;
         StatsTrack st = new StatsTrack();
@@ -80,6 +84,7 @@ public void testSetQuotaDisableWhenExceedCountHardQuota() throws Exception {
 
         try {
             zk.create(path + "/c2" + "/c3", "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            ZooKeeperQuotaTest.validateNoQuotaExceededMetrics(namespace);
         } catch (KeeperException.QuotaExceededException e) {
             fail("should not throw Count Quota Exceeded Exception when enforce quota disables");
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
index aacd59e6719..bbc81c758d6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
@@ -27,6 +27,8 @@
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
+import java.util.UUID;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.QuotaExceededException;
@@ -40,7 +42,9 @@
 import org.apache.zookeeper.cli.MalformedPathException;
 import org.apache.zookeeper.cli.SetQuotaCommand;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.apache.zookeeper.test.StatsTrackTest.OldStatsTrack;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -188,7 +192,8 @@ public void testSetQuotaWhenSetQuotaOnParentOrChildPath() throws IOException, In
     @Test
     public void testSetQuotaWhenExceedBytesSoftQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE,
                 CreateMode.PERSISTENT);
         StatsTrack st = new StatsTrack();
@@ -199,6 +204,7 @@ public void testSetQuotaWhenExceedBytesSoftQuota() throws Exception {
 
         try {
             zk.setData(path, "123456".getBytes(), -1);
+            validateNoQuotaExceededMetrics(namespace);
         } catch (Exception e) {
             fail("should set data which exceeds the soft byte quota");
         }
@@ -207,7 +213,8 @@ public void testSetQuotaWhenExceedBytesSoftQuota() throws Exception {
     @Test
     public void testSetQuotaWhenExceedBytesHardQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE,
                 CreateMode.PERSISTENT);
         StatsTrack st = new StatsTrack();
@@ -219,13 +226,15 @@ public void testSetQuotaWhenExceedBytesHardQuota() throws Exception {
             fail("should not set data which exceeds the hard byte quota");
         } catch (QuotaExceededException e) {
            //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
     @Test
     public void testSetQuotaWhenExceedBytesHardQuotaExtend() throws Exception {
 
-        String path = "/c0";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int bytes = 100;
         StatsTrack st = new StatsTrack();
@@ -240,6 +249,7 @@ public void testSetQuotaWhenExceedBytesHardQuotaExtend() throws Exception {
                     fail("should not set quota when exceeds hard bytes quota");
                 } catch (QuotaExceededException e) {
                     //expected
+                    validateQuotaExceededMetrics(namespace);
                 }
             } else {
                 zk.create(sb.toString(), "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -250,7 +260,8 @@ public void testSetQuotaWhenExceedBytesHardQuotaExtend() throws Exception {
     @Test
     public void testSetQuotaWhenSetQuotaLessThanExistBytes() throws Exception {
 
-        String path = "/c0";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "123456789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int bytes = 5;
         StatsTrack st = new StatsTrack();
@@ -261,50 +272,56 @@ public void testSetQuotaWhenSetQuotaLessThanExistBytes() throws Exception {
             fail("should not set quota when exceeds hard bytes quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
     @Test
     public void testSetQuotaWhenSetChildDataExceedBytesQuota() throws Exception {
 
-        final String path = "/test/quota";
-        zk.create("/test", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/test/quota", "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/test/quota/data", "56789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace + "/quota";
+        zk.create("/" + namespace, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path, "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path + "/data", "56789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         StatsTrack quota = new StatsTrack();
         quota.setByteHardLimit(10);
         SetQuotaCommand.createQuota(zk, path, quota);
         try {
-            zk.setData("/test/quota/data", "567891".getBytes(), -1);
+            zk.setData(path + "/data", "567891".getBytes(), -1);
             fail("should not set data when exceed hard byte quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
     @Test
     public void testSetQuotaWhenCreateNodeExceedBytesQuota() throws Exception {
 
-        final String path = "/test/quota";
-        zk.create("/test", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/test/quota", "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace + "/quota";
+        zk.create("/" + namespace, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path, "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         StatsTrack quota = new StatsTrack();
         quota.setByteHardLimit(10);
         SetQuotaCommand.createQuota(zk, path, quota);
         try {
-            zk.create("/test/quota/data", "567891".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create(path + "/data", "567891".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             fail("should not set data when exceed hard byte quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
     @Test
     public void testSetQuotaWhenExceedCountSoftQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int count = 2;
         StatsTrack st = new StatsTrack();
@@ -314,6 +331,7 @@ public void testSetQuotaWhenExceedCountSoftQuota() throws Exception {
 
         try {
             zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            validateNoQuotaExceededMetrics(namespace);
         } catch (QuotaExceededException e) {
             fail("should set quota when exceeds soft count quota");
         }
@@ -322,7 +340,8 @@ public void testSetQuotaWhenExceedCountSoftQuota() throws Exception {
     @Test
     public void testSetQuotaWhenExceedCountHardQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int count = 2;
         StatsTrack st = new StatsTrack();
@@ -335,13 +354,15 @@ public void testSetQuotaWhenExceedCountHardQuota() throws Exception {
             fail("should not set quota when exceeds hard count quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
     @Test
     public void testSetQuotaWhenExceedCountHardQuotaExtend() throws Exception {
 
-        String path = "/c0";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int count = 100;
         StatsTrack st = new StatsTrack();
@@ -356,6 +377,7 @@ public void testSetQuotaWhenExceedCountHardQuotaExtend() throws Exception {
                     fail("should not set quota when exceeds hard count quota");
                 } catch (QuotaExceededException e) {
                     //expected
+                    validateQuotaExceededMetrics(namespace);
                 }
             } else {
                 zk.create(sb.toString(), "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -366,7 +388,8 @@ public void testSetQuotaWhenExceedCountHardQuotaExtend() throws Exception {
     @Test
     public void testSetQuotaWhenSetQuotaLessThanExistCount() throws Exception {
 
-        String path = "/c0";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create(path + "/c1", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create(path + "/c2", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -379,13 +402,15 @@ public void testSetQuotaWhenSetQuotaLessThanExistCount() throws Exception {
             fail("should not set quota when exceeds hard count quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
     @Test
     public void testSetQuotaWhenExceedBothBytesAndCountHardQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         StatsTrack st = new StatsTrack();
         st.setByteHardLimit(5L);
@@ -397,6 +422,7 @@ public void testSetQuotaWhenExceedBothBytesAndCountHardQuota() throws Exception
             fail("should give priority to CountQuotaExceededException when both meets the count and bytes quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
     }
 
@@ -450,7 +476,8 @@ public void testMultiCreateThenSetDataShouldFail() throws Exception {
     @Test
     public void testDeleteBytesQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         StatsTrack st = new StatsTrack();
         st.setByteHardLimit(5L);
@@ -461,6 +488,7 @@ public void testDeleteBytesQuota() throws Exception {
             fail("should not set data which exceeds the hard byte quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
 
         //delete the Byte Hard Quota
@@ -469,12 +497,14 @@ public void testDeleteBytesQuota() throws Exception {
         DelQuotaCommand.delQuota(zk, path, st);
 
         zk.setData(path, "123456".getBytes(), -1);
+        validateQuotaExceededMetrics(namespace);
     }
 
     @Test
     public void testDeleteCountQuota() throws Exception {
 
-        final String path = "/c1";
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
         zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         int count = 2;
         StatsTrack st = new StatsTrack();
@@ -487,6 +517,7 @@ public void testDeleteCountQuota() throws Exception {
             fail("should not set quota when exceeds hard count quota");
         } catch (QuotaExceededException e) {
             //expected
+            validateQuotaExceededMetrics(namespace);
         }
 
         //delete the Count Hard Quota
@@ -495,6 +526,7 @@ public void testDeleteCountQuota() throws Exception {
         DelQuotaCommand.delQuota(zk, path, st);
 
         zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        validateQuotaExceededMetrics(namespace);
     }
 
     @Test
@@ -552,4 +584,20 @@ public void testListQuota() throws Exception {
             }
         }
     }
+
+    private void validateQuotaExceededMetrics(final String namespace) {
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        assertEquals(1, metrics.keySet().stream().filter(
+                key -> key.contains(String.format("%s_%s", namespace, name))).count());
+
+        assertEquals(1L, metrics.get(String.format("%s_%s", namespace, name)));
+    }
+
+    static void validateNoQuotaExceededMetrics(final String namespace) {
+        final Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertEquals(0, metrics.keySet().stream().filter(
+                key -> key.contains(String.format("%s_%s", namespace, QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE))).count());
+    }
 }

From 9a5da5f9a023e53bf339748b5b7b17278ae36475 Mon Sep 17 00:00:00 2001
From: "Wu, Xiaokai (Marvin)" <marvinwu@ea.com>
Date: Tue, 3 Aug 2021 11:37:43 +0200
Subject: [PATCH 236/591] ZOOKEEPER-4331: add headers back in osgi artifact

Following up https://github.com/apache/zookeeper/pull/1722, I'm applying the change on master instead of 3.5.x as advised.

As an alternative to https://github.com/apache/zookeeper/pull/1726, this change employs bundle plugin to build another artifact of classifier "osgi".

The advantage would be bundle plugin remains employed to maintain the topology of versioned packages, and the original artifact without classifier is left untouched.

The disadvantage would be we've one more artifact delivered in this project.

```
$ ls zookeeper-server/target/ | grep jar$
zookeeper-3.5.9.jar
zookeeper-3.5.9-javadoc.jar
zookeeper-3.5.9-osgi.jar
zookeeper-3.5.9-sources.jar
zookeeper-3.5.9-tests.jar
```

Author: Wu, Xiaokai (Marvin) <marvinwu@ea.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1727 from bigmarvin/ZOOKEEPER-4331/add-new-osgi-artifact
---
 pom.xml                  |  5 +++++
 zookeeper-jute/pom.xml   | 32 ++++++++++++++++++++++++++++
 zookeeper-server/pom.xml | 46 +++++++++++++++++++++++++++++++++++++++-
 3 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 89cbfaf1566..2e35d0088f0 100755
--- a/pom.xml
+++ b/pom.xml
@@ -820,6 +820,11 @@
             </execution>
           </executions>
         </plugin>
+        <plugin>
+          <groupId>org.apache.felix</groupId>
+          <artifactId>maven-bundle-plugin</artifactId>
+          <version>4.1.0</version>
+        </plugin>
       </plugins>
     </pluginManagement>
 
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index e6d4e6abeeb..1e4d7f18b62 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -150,6 +150,38 @@
             <skip>true</skip>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>build bundle</id>
+            <phase>package</phase>
+            <goals>
+              <goal>bundle</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <instructions>
+            <Import-Package>
+              *;resolution:=optional
+            </Import-Package>
+            <Export-Package>
+              org.apache.zookeeper.data,
+              org.apache.zookeeper.proto,
+              org.apache.zookeeper.txn,
+              !org.apache.zookeeper*,
+              org.apache.jute*
+            </Export-Package>
+            <Bundle-Name>ZooKeeper Jute Bundle</Bundle-Name>
+            <Bundle-DocURL>https://zookeeper.apache.org/doc/current/</Bundle-DocURL>
+            <Implementation-Build>${mvngit.commit.id}</Implementation-Build>
+            <Merge-Headers>!Implementation-Build,*</Merge-Headers>
+          </instructions>
+          <classifier>osgi</classifier>
+        </configuration>
+      </plugin>
     </plugins>
   </build>
 
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 2636f5cd969..4418a97f7ee 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -277,7 +277,51 @@
           </systemPropertyVariables>
         </configuration>
       </plugin>
-	  
+
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>build bundle</id>
+            <phase>package</phase>
+            <goals>
+              <goal>bundle</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <instructions>
+            <Import-Package>
+              io.netty.buffer;resolution:=optional,
+              io.netty.channel;resolution:=optional,
+              io.netty.channel.group;resolution:=optional,
+              io.netty.channel.socket.nio;resolution:=optional,
+              javax.management;resolution:=optional,
+              javax.security.auth.callback,
+              javax.security.auth.login,
+              javax.security.sasl,
+              org.ietf.jgss,
+              org.osgi.framework;resolution:=optional,
+              org.osgi.util.tracker;resolution:=optional,
+              org.slf4j,
+              *;resolution:=optional
+            </Import-Package>
+            <Export-Package>
+              !org.apache.zookeeper.data,
+              !org.apache.zookeeper.proto,
+              !org.apache.zookeeper.txn,
+              org.apache.zookeeper*
+            </Export-Package>
+            <Bundle-Name>ZooKeeper Bundle</Bundle-Name>
+            <Bundle-DocURL>https://zookeeper.apache.org/doc/current/</Bundle-DocURL>
+            <Implementation-Build>${mvngit.commit.id}</Implementation-Build>
+            <Merge-Headers>!Implementation-Build,*</Merge-Headers>
+          </instructions>
+          <classifier>osgi</classifier>
+        </configuration>
+      </plugin>
+
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>

From 3cdc62c132846a6e5fd06782730a986b3e5ea144 Mon Sep 17 00:00:00 2001
From: Aditya Patruni <adityapatruni@Adityas-MBP.home>
Date: Sun, 8 Aug 2021 16:08:32 +0800
Subject: [PATCH 237/591] ZOOKEEPER-4340: add tab unit test for
 StringUtils#split

Adding a test case to StringUtils to ensure spaces expressed as something other than ' ' are covered.

Author: Aditya Patruni <adityapatruni@Adityas-MBP.home>

Reviewers: maoling <maoling@apache.org>

Closes #1732 from apatruni/apatruni/tests and squashes the following commits:

0b25e6865 [Aditya Patruni] add space after , on line 43
dc700a9b0 [Aditya Patruni] Fix formatting
8e686d859 [Aditya Patruni] add tab test
---
 .../test/java/org/apache/zookeeper/test/StringUtilTest.java    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
index 22d804ec21b..35c70e095ea 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
@@ -38,6 +38,9 @@ public void testStringSplit() {
 
         final String s3 = "1, , 2";
         assertEquals(Arrays.asList("1", "2"), StringUtils.split(s3, ","));
+
+        final String s4 = "1, \t , 2";
+        assertEquals(Arrays.asList("1", "2"), StringUtils.split(s4, ","));
     }
 
     @Test

From 5f6ec6cc7fd303702dca31edd2317b33c6e66bd1 Mon Sep 17 00:00:00 2001
From: Bo Cui <cuibo0108@163.com>
Date: Wed, 11 Aug 2021 20:40:33 +0530
Subject: [PATCH 238/591] ZOOKEEPER-4345: Avoid NoSunchMethodException caused
 by shaded zookeeper jar

Author: Bo <cuibo0108@163.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1736 from cuibo01/zookeeper-4345 and squashes the following commits:

3965f2e8d [Bo] [ZOOKEEPER-4345]Avoid NoSunchMethodException caused by shaded
970972971 [Bo] [ZOOKEEPER-4345]Avoid NoSunchMethodException caused by shaded
---
 .../main/java/org/apache/zookeeper/ZooKeeper.java    |  5 ++++-
 .../org/apache/zookeeper/test/ClientSSLTest.java     | 12 ++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 9fba7a5ebd4..a013dd3d5e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -3028,9 +3028,12 @@ protected SocketAddress testableLocalSocketAddress() {
 
     private ClientCnxnSocket getClientCnxnSocket() throws IOException {
         String clientCnxnSocketName = getClientConfig().getProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
-        if (clientCnxnSocketName == null) {
+        if (clientCnxnSocketName == null || clientCnxnSocketName.equals(ClientCnxnSocketNIO.class.getSimpleName())) {
             clientCnxnSocketName = ClientCnxnSocketNIO.class.getName();
+        } else if (clientCnxnSocketName.equals(ClientCnxnSocketNetty.class.getSimpleName())) {
+            clientCnxnSocketName = ClientCnxnSocketNetty.class.getName();
         }
+
         try {
             Constructor<?> clientCxnConstructor = Class.forName(clientCnxnSocketName)
                                                        .getDeclaredConstructor(ZKClientConfig.class);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index db1c81fb25e..3996238c00c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -84,6 +84,18 @@ public void testClientServerUnifiedPort() throws Exception {
         testClientServerSSL(false);
     }
 
+    @Test
+    public void testClientServerUnifiedPortWithCnxnClassName() throws Exception {
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "ClientCnxnSocketNIO");
+        testClientServerSSL(false);
+    }
+
+    @Test
+    public void testClientServerSSLWithCnxnClassName() throws Exception {
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "ClientCnxnSocketNetty");
+        testClientServerSSL(true);
+    }
+
     /**
      * This test checks that client - server SSL works in cluster setup of ZK servers, which includes:
      * 1. setting "secureClientPort" in "zoo.cfg" file.

From f72ef97b66bc890ce8366533eac5be393558a8fb Mon Sep 17 00:00:00 2001
From: "zhongxiong.zeng" <zhongxiong.zeng@za.group>
Date: Sat, 21 Aug 2021 17:21:30 +0800
Subject: [PATCH 239/591] ZOOKEEPER-4346: remove never used field

remove some never used field

Author: zhongxiong.zeng <zhongxiong.zeng@za.group>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>, rainsbaby, maoling <maoling@apache.org>

Closes #1721 from zhongxiongzeng/remove_unused_code and squashes the following commits:

54dd870e6 [zhongxiong.zeng] 1 fix with ZooTrace.java
39279c78a [zhongxiong.zeng] remove never used field
---
 .../org/apache/zookeeper/server/RequestThrottler.java     | 2 +-
 .../main/java/org/apache/zookeeper/server/ServerCnxn.java | 3 ---
 .../java/org/apache/zookeeper/server/WorkerService.java   | 1 -
 .../main/java/org/apache/zookeeper/server/ZKDatabase.java | 1 -
 .../main/java/org/apache/zookeeper/server/ZooTrace.java   | 8 ++++++++
 5 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index 86923635ec7..d60efa0878f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -68,7 +68,7 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
     private volatile boolean killed;
 
     private static final String SHUTDOWN_TIMEOUT = "zookeeper.request_throttler.shutdownTimeout";
-    private static int shutdownTimeout = 10000;
+    private static int shutdownTimeout;
 
     static {
         shutdownTimeout = Integer.getInteger(SHUTDOWN_TIMEOUT, 10000);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index 0d17ce2bc6a..b5b2645838d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -62,8 +62,6 @@ public abstract class ServerCnxn implements Stats, Watcher {
 
     private Set<Id> authInfo = Collections.newSetFromMap(new ConcurrentHashMap<Id, Boolean>());
 
-    private static final byte[] fourBytes = new byte[4];
-
     /**
      * If the client is of old version, we don't send r-o mode info to it.
      * The reason is that if we would, old C client doesn't read it, which
@@ -388,7 +386,6 @@ protected void packetSent() {
 
     protected long count;
     protected long totalLatency;
-    protected long requestsProcessedCount;
     protected DisconnectReason disconnectReason = DisconnectReason.UNKNOWN;
 
     public synchronized void resetStats() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
index 2a396f8ee87..b4dcd066f76 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
@@ -52,7 +52,6 @@ public class WorkerService {
     private final String threadNamePrefix;
     private int numWorkerThreads;
     private boolean threadsAreAssignable;
-    private long shutdownTimeoutMS = 5000;
 
     private volatile boolean stopped = true;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index 34c18384f5e..d8d60d87cbe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -90,7 +90,6 @@ public class ZKDatabase {
     public static final String COMMIT_LOG_COUNT = "zookeeper.commitLogCount";
     public static final int DEFAULT_COMMIT_LOG_COUNT = 500;
     public int commitLogCount;
-    protected static int commitLogBuffer = 700;
     protected Queue<Proposal> committedLog = new ArrayDeque<>();
     protected ReentrantReadWriteLock logLock = new ReentrantReadWriteLock();
     private volatile boolean initialized = false;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
index c411a093483..e9d1eb15a3e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
@@ -33,6 +33,10 @@ public class ZooTrace {
 
     public static final long CLIENT_REQUEST_TRACE_MASK = 1 << 1;
 
+    /**
+     * this field is obsolete
+     */
+    @Deprecated
     public static final long CLIENT_DATA_PACKET_TRACE_MASK = 1 << 2;
 
     public static final long CLIENT_PING_TRACE_MASK = 1 << 3;
@@ -47,6 +51,10 @@ public class ZooTrace {
 
     public static final long WARNING_TRACE_MASK = 1 << 8;
 
+    /**
+     * this field is obsolete
+     */
+    @Deprecated
     public static final long JMX_TRACE_MASK = 1 << 9;
 
     private static long traceMask = CLIENT_REQUEST_TRACE_MASK | SERVER_PACKET_TRACE_MASK | SESSION_TRACE_MASK | WARNING_TRACE_MASK;

From 06467dc8c20e6c7357c19904f6214bb406262ba2 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Wed, 25 Aug 2021 14:14:22 +0200
Subject: [PATCH 240/591] ZOOKEEPER-4342: Fix: Robustify C client against
 errors during SASL negotiation

Before this, the client was ignoring the error field of the response header, and only considering SASL-level errors.

This commit makes it consider `hdr.err`.  It also zeroes the `res` data structure, to avoid a crash in `deallocate` if `deserialize` is skipped, and sets `input_buffer` to `NULL` to avoid a double-free.

(I looked into adding a non-regression test, but doing so requires adding quite a bit of infrastructure to the mocks so that the SASL library can be correctly initialized.  Punting for now.)

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: Enrico Olivelli<eolivelli@apache.org>

Closes #1733 from ztzg/ZOOKEEPER-4342-robustify-c-client-sasl-errors
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 0504a746fc7..0dac4c3d0ac 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -2927,8 +2927,10 @@ static int process_sasl_response(zhandle_t *zh, char *buffer, int len)
     struct SetSASLResponse res;
     int rc;
 
+    memset(&res, 0, sizeof(res));
     rc = ia ? ZOK : ZSYSTEMERROR;
     rc = rc < 0 ? rc : deserialize_ReplyHeader(ia, "hdr", &hdr);
+    rc = rc < 0 ? rc : hdr.err;
     rc = rc < 0 ? rc : deserialize_SetSASLResponse(ia, "reply", &res);
     rc = rc < 0 ? rc : zoo_sasl_client_step(zh, res.token.buff, res.token.len);
     deallocate_SetSASLResponse(&res);
@@ -3018,6 +3020,7 @@ static int check_events(zhandle_t *zh, int events)
                 } else {
                     rc = process_sasl_response(zh, zh->input_buffer->buffer, zh->input_buffer->curr_offset);
                     free_buffer(zh->input_buffer);
+                    zh->input_buffer = 0;
                     if (rc < 0) {
                         zoo_sasl_mark_failed(zh);
                         return rc;

From 1f5e4fe258707f9b82448a5f97c931c392d011ca Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Fri, 27 Aug 2021 10:48:40 +0200
Subject: [PATCH 241/591] ZOOKEEPER-4327: RequestThrottlerTest: Flakiness
 remediations

  * `testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled`: Only resume after looking at metrics

    Resuming the pipeline before looking at the metrics triggers a race between the test and other server threads, causing us to sometimes observe a larger `prep_processor_request_queued` than expected.

    The corresponding failures look like this:

        RequestThrottlerTest.testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled:340 expected: <3> but was: <7>

    The metric we look at is updated at the front of the pipeline, before the portion blocked by `resumeProcess`; we don't have to wait for the latter to observe the effect of the global outstanding limit.

  * `testLargeRequestThrottling`: Allow more time for request ingestion

    The 5s timeout used before this patch was sometimes not sufficient for the server to process the five requests of interest. The corresponding failures look like this:

        RequestThrottlerTest.testLargeRequestThrottling:297 expected: <2> but was: <0>

    or this:

        RequestThrottlerTest.testLargeRequestThrottling:299 expected: <5> but was: <4>

    We can use a higher timeout value as the `await` normally quickly terminates with the countdown reaching zero (as opposed to timing out); the increase in duration is only paid on loaded (and slow) executors.

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1739 from ztzg/ZOOKEEPER-4327-flaky-request-throttler-test
---
 .../org/apache/zookeeper/server/RequestThrottlerTest.java   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index 58e138a22ed..62d371dd4fb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -289,7 +289,7 @@ public void testLargeRequestThrottling() throws Exception {
         }
 
         // make sure the server received all 5 requests
-        disconnected.await(5, TimeUnit.SECONDS);
+        disconnected.await(30, TimeUnit.SECONDS);
         Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
 
         // but only two requests can get into the pipeline because they are large requests
@@ -329,8 +329,6 @@ public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled()
 
             submitted.await(5, TimeUnit.SECONDS);
 
-            resumeProcess.countDown();
-
             // We should start throttling instead of queuing more requests.
             //
             // We always allow up to GLOBAL_OUTSTANDING_LIMIT + 1 number of requests coming in request processing pipeline
@@ -339,6 +337,8 @@ public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled()
             // be GLOBAL_OUTSTANDING_LIMIT + 2.
             assertEquals(Integer.parseInt(GLOBAL_OUTSTANDING_LIMIT) + 2,
                     (long) MetricsUtils.currentServerMetrics().get("prep_processor_request_queued"));
+
+            resumeProcess.countDown();
         } catch (Exception e) {
             throw e;
         } finally {

From 24808051c78f06af22014cb8055e3f7f8fe08065 Mon Sep 17 00:00:00 2001
From: Nihal Jain <nihaljain.cs@gmail.com>
Date: Wed, 1 Sep 2021 08:44:03 +0000
Subject: [PATCH 242/591] ZOOKEEPER-4355: ZK documentation side bar and welcome
 page are out of sync

* Added missing links to header.html
* Added a short description for hierarchical quorums section

Author: Nihal Jain <nihaljain.cs@gmail.com>

Reviewers: maoling <maoling@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1740 from NihalJain/ZOOKEEPER-4355
---
 .../src/main/resources/markdown/html/header.html  | 15 +++++++++++++++
 .../src/main/resources/markdown/index.md          |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/html/header.html b/zookeeper-docs/src/main/resources/markdown/html/header.html
index d0f291ace75..679d582d705 100644
--- a/zookeeper-docs/src/main/resources/markdown/html/header.html
+++ b/zookeeper-docs/src/main/resources/markdown/html/header.html
@@ -75,6 +75,9 @@
             <div class="menuitem">
                 <a href="zookeeperProgrammers.html">Programmer's Guide</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperUseCases.html">Use Cases</a>
+            </div>
             <div class="menuitem">
                 <a href="javaExample.html">Java Example</a>
             </div>
@@ -96,11 +99,23 @@
             <div class="menuitem">
                 <a href="zookeeperJMX.html">JMX</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperHierarchicalQuorums.html">Hierarchical Quorums</a>
+            </div>
             <div class="menuitem">
                 <a href="zookeeperObservers.html">Observers Guide</a>
             </div>
             <div class="menuitem">
                 <a href="zookeeperReconfig.html">Dynamic Reconfiguration</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperCLI.html">ZooKeeper CLI</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperTools.html">ZooKeeper Tools</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperMonitor.html">ZooKeeper Monitor</a>
             </div>
 			<div class="menuitem">
                 <a href="zookeeperAuditLogs.html">Audit Logs</a>
diff --git a/zookeeper-docs/src/main/resources/markdown/index.md b/zookeeper-docs/src/main/resources/markdown/index.md
index 443ba3ab833..e9e7bd9e420 100644
--- a/zookeeper-docs/src/main/resources/markdown/index.md
+++ b/zookeeper-docs/src/main/resources/markdown/index.md
@@ -47,7 +47,7 @@ archives.
     + [Administrator's Guide](zookeeperAdmin.html) - a guide for system administrators and anyone else who might deploy ZooKeeper
     + [Quota Guide](zookeeperQuotas.html) - a guide for system administrators on Quotas in ZooKeeper.
     + [JMX](zookeeperJMX.html) - how to enable JMX in ZooKeeper
-    + [Hierarchical quorums](zookeeperHierarchicalQuorums.html)
+    + [Hierarchical Quorums](zookeeperHierarchicalQuorums.html) - a guide on how to use hierarchical quorums
     + [Observers](zookeeperObservers.html) - non-voting ensemble members that easily improve ZooKeeper's scalability
     + [Dynamic Reconfiguration](zookeeperReconfig.html) - a guide on how to use dynamic reconfiguration in ZooKeeper
     + [ZooKeeper CLI](zookeeperCLI.html) - a guide on how to use the ZooKeeper command line interface

From 2797116b33a505c8b36b396216c26afd7f7ba28c Mon Sep 17 00:00:00 2001
From: Nihal Jain <nihaljain.cs@gmail.com>
Date: Wed, 1 Sep 2021 08:47:18 +0000
Subject: [PATCH 243/591] ZOOKEEPER-4356: Code blocks do not render correctly
 in ZK docs site

* Configure to use FENCED_CODE_BLOCKS.
* Note: TABLES is the default setting. See https://github.com/walokra/markdown-page-generator-plugin for details on default `pegdownExtensions` setting

Author: Nihal Jain <nihaljain.cs@gmail.com>

Reviewers: maoling <maoling@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1741 from NihalJain/ZOOKEEPER-4356
---
 zookeeper-docs/pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-docs/pom.xml b/zookeeper-docs/pom.xml
index 9a23faf2929..93a48d52079 100644
--- a/zookeeper-docs/pom.xml
+++ b/zookeeper-docs/pom.xml
@@ -49,6 +49,7 @@
           <headerHtmlFile>${project.basedir}/src/main/resources/markdown/html/header.html</headerHtmlFile>
           <footerHtmlFile>${project.basedir}/src/main/resources/markdown/html/footer.html</footerHtmlFile>
           <copyDirectories>images,skin</copyDirectories>
+          <pegdownExtensions>TABLES,FENCED_CODE_BLOCKS</pegdownExtensions>
         </configuration>
       </plugin>
       <plugin>

From 561231f8bfe910e63dbd8c281cb25033a0e7d7a5 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Wed, 1 Sep 2021 16:50:38 +0000
Subject: [PATCH 244/591] ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629
 (avoids CVE-2021-34429)

Version 9.4.43.v20210629 is the latest available in the 9.4 series at the time of this commit.  Its release notes explicitly declare "This release resolves CVE-2021-34429":

  https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.43.v20210629

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Enrico Olivelli <eolivelli@apache.org>

Closes #1734 from ztzg/ZOOKEEPER-4337-owasp-failures
---
 pom.xml                                                         | 2 +-
 ...0325.LICENSE.txt => jetty-http-9.4.43.v20210629.LICENSE.txt} | 0
 ...210325.LICENSE.txt => jetty-io-9.4.43.v20210629.LICENSE.txt} | 0
 ....LICENSE.txt => jetty-security-9.4.43.v20210629.LICENSE.txt} | 0
 ...25.LICENSE.txt => jetty-server-9.4.43.v20210629.LICENSE.txt} | 0
 ...5.LICENSE.txt => jetty-servlet-9.4.43.v20210629.LICENSE.txt} | 0
 ...0325.LICENSE.txt => jetty-util-9.4.43.v20210629.LICENSE.txt} | 0
 ...LICENSE.txt => jetty-util-ajax-9.4.43.v20210629.LICENSE.txt} | 0
 8 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.39.v20210325.LICENSE.txt => jetty-http-9.4.43.v20210629.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.39.v20210325.LICENSE.txt => jetty-io-9.4.43.v20210629.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.39.v20210325.LICENSE.txt => jetty-security-9.4.43.v20210629.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.39.v20210325.LICENSE.txt => jetty-server-9.4.43.v20210629.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.39.v20210325.LICENSE.txt => jetty-servlet-9.4.43.v20210629.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.39.v20210325.LICENSE.txt => jetty-util-9.4.43.v20210629.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.39.v20210325.LICENSE.txt => jetty-util-ajax-9.4.43.v20210629.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 2e35d0088f0..a7861df45a0 100755
--- a/pom.xml
+++ b/pom.xml
@@ -468,7 +468,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.63.Final</netty.version>
-    <jetty.version>9.4.39.v20210325</jetty.version>
+    <jetty.version>9.4.43.v20210629</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.43.v20210629.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.43.v20210629.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.43.v20210629.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.43.v20210629.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.43.v20210629.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.43.v20210629.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.39.v20210325.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.43.v20210629.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.39.v20210325.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.43.v20210629.LICENSE.txt

From 726ec30fdd47bccd2a2be021cf6a6b848e9ee28b Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Wed, 1 Sep 2021 16:56:16 +0000
Subject: [PATCH 245/591] ZOOKEEPER-4343: Bump commons-io to version 2.11
 (avoids CVE-2021-29425)

The issue reported in CVE-2021-29425 is fixed in release 2.7:

-   <https://nvd.nist.gov/vuln/detail/CVE-2021-29425>
-   <https://issues.apache.org/jira/browse/IO-556>
-   <https://issues.apache.org/jira/browse/IO-559>
-   <https://commons.apache.org/proper/commons-io/changes-report.html#a2.7>

This changeset bumps the dependency to 2.11, as there are no obvious breaking changes.

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Enrico Olivelli <eolivelli@apache.org>

Closes #1735 from ztzg/ZOOKEEPER-4343-owasp-failures and squashes the following commits:

4fd39da4d [Damien Diederen] ZOOKEEPER-4337: Bump commons-io to 2.11 (latest)
8a7692997 [Damien Diederen] ZOOKEEPER-4337: Bump commons-io to 2.7 (avoids CVE-2021-29425)
7728100eb [Damien Diederen] ZOOKEEPER-4337: Pull commons-io dependency in toplevel POM (minor cleanup)
---
 pom.xml                                       |   6 +
 zookeeper-server/pom.xml                      |  11 +-
 .../resources/lib/commons-io-2.7.LICENSE.txt  | 203 ++++++++++++++++++
 3 files changed, 214 insertions(+), 6 deletions(-)
 create mode 100644 zookeeper-server/src/main/resources/lib/commons-io-2.7.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index a7861df45a0..c7deebb3bdf 100755
--- a/pom.xml
+++ b/pom.xml
@@ -479,6 +479,7 @@
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
     <checkstyle.version>8.39</checkstyle.version>
     <enforcer.version>3.0.0-M3</enforcer.version>
+    <commons-io.version>2.11.0</commons-io.version>
 
     <!-- parameters to pass to C client build -->
     <c-client-openssl>yes</c-client-openssl>
@@ -671,6 +672,11 @@
         <artifactId>snappy-java</artifactId>
         <version>${snappy.version}</version>
       </dependency>
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>${commons-io.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 4418a97f7ee..4fd4f984c62 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -172,12 +172,11 @@
       <artifactId>snappy-java</artifactId>
       <scope>provided</scope>
     </dependency>
-      <dependency>
-          <groupId>commons-io</groupId>
-          <artifactId>commons-io</artifactId>
-          <version>2.6</version>
-          <scope>compile</scope>
-      </dependency>
+    <dependency>
+      <groupId>commons-io</groupId>
+      <artifactId>commons-io</artifactId>
+      <scope>compile</scope>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/zookeeper-server/src/main/resources/lib/commons-io-2.7.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-io-2.7.LICENSE.txt
new file mode 100644
index 00000000000..6b0b1270ff0
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/commons-io-2.7.LICENSE.txt
@@ -0,0 +1,203 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

From 4f515673464e540fa8555b7a3ac85c5d1abe41fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicol=C3=B2=20Boschi?= <boschi1997@gmail.com>
Date: Thu, 2 Sep 2021 16:44:43 +0000
Subject: [PATCH 246/591] ZOOKEEPER-4360: Avoid NPE during gauge execution if
 the leader is not set on FOLLOWER node
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On a follower node, we had this error
```
ago 20, 2021 1:46:28 PM org.apache.catalina.core.StandardWrapperValve invoke
GRAVE: Servlet.service() for servlet [metrics] in context with path [/metrics] threw exception
java.lang.NullPointerException: Cannot invoke "org.apache.zookeeper.server.quorum.Leader.getProposalStats()" because the return value of "org.apache.zookeeper.server.quorum.LeaderZooKeeperServer.getLeader()" is null
        at org.apache.zookeeper.server.quorum.LeaderZooKeeperServer.lambda$registerMetrics$5(LeaderZooKeeperServer.java:122)
        at magnews.zookeeper.ZooKeeperMetricsProviderAdapter$MetricsContextImpl.lambda$registerGauge$0(ZooKeeperMetricsProviderAdapter.java:91)
```

Unfortunately, I'm not able to reproduce this error deterministically

I've added the null check on leader variable, this will cause the gauge return value to be not registered (on `DefaultMetricsProvider`) and considered as zero on prometheus

Not sure if tests were needed even if the fix is so simple, I can them if requested from reviewers

Author: NicolĂ² Boschi <boschi1997@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1743 from nicoloboschi/fix/npe-metrics
---
 .../server/quorum/LeaderZooKeeperServer.java  | 60 +++++++++++--------
 1 file changed, 34 insertions(+), 26 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
index 8834b5fbdb1..5a51bc23d7e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
@@ -20,6 +20,7 @@
 
 import java.io.IOException;
 import java.util.concurrent.TimeUnit;
+import java.util.function.Function;
 import javax.management.JMException;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
 import org.apache.zookeeper.jmx.MBeanRegistry;
@@ -99,34 +100,41 @@ protected void registerMetrics() {
         super.registerMetrics();
 
         MetricsContext rootContext = ServerMetrics.getMetrics().getMetricsProvider().getRootContext();
-
-        rootContext.registerGauge("learners", () -> {
-            return getLeader().getLearners().size();
-        });
-        rootContext.registerGauge("synced_followers", () -> {
-            return getLeader().getForwardingFollowers().size();
-        });
-        rootContext.registerGauge("synced_non_voting_followers", () -> {
-            return getLeader().getNonVotingFollowers().size();
-        });
-
+        rootContext.registerGauge("learners", gaugeWithLeader(
+                (leader) -> leader.getLearners().size())
+        );
+        rootContext.registerGauge("synced_followers", gaugeWithLeader(
+                (leader) -> leader.getForwardingFollowers().size()
+        ));
+        rootContext.registerGauge("synced_non_voting_followers", gaugeWithLeader(
+                (leader) -> leader.getNonVotingFollowers().size()
+        ));
         rootContext.registerGauge("synced_observers", self::getSynced_observers_metric);
+        rootContext.registerGauge("pending_syncs", gaugeWithLeader(
+                (leader) -> leader.getNumPendingSyncs()
+        ));
+        rootContext.registerGauge("leader_uptime", gaugeWithLeader(
+                (leader) -> leader.getUptime()
+        ));
+        rootContext.registerGauge("last_proposal_size", gaugeWithLeader(
+                (leader) -> leader.getProposalStats().getLastBufferSize()
+        ));
+        rootContext.registerGauge("max_proposal_size", gaugeWithLeader(
+                (leader) -> leader.getProposalStats().getMaxBufferSize()
+        ));
+        rootContext.registerGauge("min_proposal_size", gaugeWithLeader(
+                (leader) -> leader.getProposalStats().getMinBufferSize()
+        ));
+    }
 
-        rootContext.registerGauge("pending_syncs", () -> {
-            return getLeader().getNumPendingSyncs();
-        });
-        rootContext.registerGauge("leader_uptime", () -> {
-            return getLeader().getUptime();
-        });
-        rootContext.registerGauge("last_proposal_size", () -> {
-            return getLeader().getProposalStats().getLastBufferSize();
-        });
-        rootContext.registerGauge("max_proposal_size", () -> {
-            return getLeader().getProposalStats().getMaxBufferSize();
-        });
-        rootContext.registerGauge("min_proposal_size", () -> {
-            return getLeader().getProposalStats().getMinBufferSize();
-        });
+    private org.apache.zookeeper.metrics.Gauge gaugeWithLeader(Function<Leader, Number> supplier) {
+        return () -> {
+            final Leader leader = getLeader();
+            if (leader == null) {
+                return null;
+            }
+            return supplier.apply(leader);
+        };
     }
 
     @Override

From 1e74a3395a9c3c4d67093f9a073bffb5a176916c Mon Sep 17 00:00:00 2001
From: lan <liaonan@souche.com>
Date: Sat, 4 Sep 2021 17:13:55 +0800
Subject: [PATCH 247/591] ZOOKEEPER-4301: fix typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- After 'it', use the third-person verb form defaults
- The verb 'set up' is spelled as two words. The noun 'setup' is spelled as one
- The verb 'shut down' instead of the phrasal noun 'shutdown'. 
- The noun cleanup instead of the phrasal verb 'clean up'
- The operating system from Apple is called macOS
- ...

Author: lan <liaonan@souche.com>

Reviewers: maoling <maoling@apache.org>

Closes #1701 from lanicc/ZOOKEEPER-4301
---
 .../main/resources/markdown/zookeeperAdmin.md | 69 +++++++++----------
 1 file changed, 34 insertions(+), 35 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index a8650f138f5..3671f1eea4c 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -199,7 +199,7 @@ ensemble:
 
      You can find the meanings of these and other configuration
   settings in the section [Configuration Parameters](#sc_configuration). A word
-  though about a few here:
+  thought about a few here:
   Every machine that is part of the ZooKeeper ensemble should know
   about every other machine in the ensemble. You accomplish this with
   the series of lines of the form **server.id=host:port:port**.
@@ -256,8 +256,8 @@ ensemble:
 
 ### Single Server and Developer Setup
 
-If you want to setup ZooKeeper for development purposes, you will
-probably want to setup a single server instance of ZooKeeper, and then
+If you want to set up ZooKeeper for development purposes, you will
+probably want to set up a single server instance of ZooKeeper, and then
 install either the Java or C client-side libraries and bindings on your
 development machine.
 
@@ -461,7 +461,7 @@ this.
 
 You will want to have a supervisory process that manages
 each of your ZooKeeper server processes (JVM). The ZK server is
-designed to be "fail fast" meaning that it will shutdown
+designed to be "fail fast" meaning that it will shut down
 (process exit) if an error occurs that it cannot recover
 from. As a ZooKeeper serving cluster is highly reliable, this
 means that while the server may go down the cluster as a whole
@@ -613,8 +613,7 @@ property, when available, is noted below.
     and snapshots.
     ###### Note
     >Having a dedicated log device has a large impact on
-    throughput and stable latencies. It is highly recommended to
-    dedicate a log device and set **dataLogDir** to point to a directory on
+    throughput and stable latencies. It is highly recommended dedicating a log device and set **dataLogDir** to point to a directory on
     that device, and then make sure to point **dataDir** to a directory
     _not_ residing on that device.
 
@@ -818,7 +817,7 @@ property, when available, is noted below.
 * *watcherCleanThreshold* :
   (Java system property only: **zookeeper.watcherCleanThreshold**)
   **New in 3.6.0:** Added in [ZOOKEEPER-1179](https://issues.apache.org/jira/browse/ZOOKEEPER-1179)
-  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the clean up process is relatively
+  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the cleanup process is relatively
   heavy, batch processing will reduce the cost and improve the performance. This setting is used to decide
   the batch size. The default one is 1000, we don't need to change it if there is no memory or clean up
   speed issue.
@@ -826,7 +825,7 @@ property, when available, is noted below.
 * *watcherCleanIntervalInSeconds* :
   (Java system property only:**zookeeper.watcherCleanIntervalInSeconds**)
   **New in 3.6.0:** Added in [ZOOKEEPER-1179](https://issues.apache.org/jira/browse/ZOOKEEPER-1179)
-  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the clean up process is relatively
+  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the cleanup process is relatively
   heavy, batch processing will reduce the cost and improve the performance. Besides watcherCleanThreshold,
   this setting is used to clean up the dead watchers after certain time even the dead watchers are not larger
   than watcherCleanThreshold, so that we won't leave the dead watchers there for too long. The default setting
@@ -1082,12 +1081,12 @@ property, when available, is noted below.
     hash function, but it’s more efficient compared to collisionless hash, and the
     collision possibility is really really rare and can already meet our needs here.
 
-    This feature is backward and forward compatible, so it can safely rolling upgrade,
+    This feature is backward and forward compatible, so it can safely roll upgrade,
     downgrade, enabled and later disabled without any compatible issue. Here are the
     scenarios have been covered and tested:
 
     1. When leader runs with new code while follower runs with old one, the digest will
-       be append to the end of each txn, follower will only read header and txn data,
+       be appended to the end of each txn, follower will only read header and txn data,
        digest value in the txn will be ignored. It won't affect the follower reads and
        processes the next txn.
     2. When leader runs with old code while follower runs with new one, the digest won't
@@ -1097,7 +1096,7 @@ property, when available, is noted below.
        read the non-exist digest value, and the exception will be caught and digest will
        be set to null, which means we won't compare digest when loading this snapshot,
        which is expected to happen during rolling upgrade
-    4. When loading new snapshot with old code, it will finish successfully after deserialzing
+    4. When loading new snapshot with old code, it will finish successfully after deserializing
        the data tree, the digest value at the end of snapshot file will be ignored
     5. The scenarios of rolling restart with flags change are similar to the 1st and 2nd
        scenarios discussed above, if the leader enabled but follower not, digest value will
@@ -1129,7 +1128,7 @@ property, when available, is noted below.
     files. This should only be set during upgrading from old versions of
     ZooKeeper (3.4.x, pre 3.5.3) where ZooKeeper might only have transaction
     log files but without presence of snapshot files. If the value is set
-    during upgrade, we recommend to set the value back to false after upgrading
+    during upgrade, we recommend setting the value back to false after upgrading
     and restart ZooKeeper process so ZooKeeper can continue normal data
     consistency check during recovery process.
     Default value is false.
@@ -1158,7 +1157,7 @@ property, when available, is noted below.
     The size threshold after which a request is considered a large request. If it is -1, then all requests are considered small, effectively turning off large request throttling. The default is -1.
 
 * *outstandingHandshake.limit*
-    (Jave system property only: **zookeeper.netty.server.outstandingHandshake.limit**)
+    (Java system property only: **zookeeper.netty.server.outstandingHandshake.limit**)
     The maximum in-flight TLS handshake connections could have in ZooKeeper,
     the connections exceed this limit will be rejected before starting handshake.
     This setting doesn't limit the max TLS concurrency, but helps avoid herd
@@ -1168,7 +1167,7 @@ property, when available, is noted below.
 * *throttledOpWaitTime*
     (Java system property: **zookeeper.throttled_op_wait_time**)
     The time in the RequestThrottler queue longer than which a request will be marked as throttled.
-    A throttled requests will not be processed other than being fed down the pipeline of the server it belongs to
+    A throttled requests will not be processed other than being fed down the pipeline of the server it belongs 
     to preserve the order of all requests.
     The FinalProcessor will issue an error response (new error code: ZTHROTTLEDOP) for these undigested requests.
     The intent is for the clients not to retry them immediately.
@@ -1178,14 +1177,14 @@ property, when available, is noted below.
   (Java system property: **zookeeper.learner.closeSocketAsync**)
   (Java system property: **learner.closeSocketAsync**)(Added for backward compatibility)
     **New in 3.7.0:**
-    When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailabe. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. 
+    When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailable. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. 
     The default is false.
 
 * *leader.closeSocketAsync*
   (Java system property: **zookeeper.leader.closeSocketAsync**)
   (Java system property: **leader.closeSocketAsync**)(Added for backward compatibility)
    **New in 3.7.0:**
-   When enabled, the leader will close a quorum socket asynchoronously. This is useful for TLS connections where closing a socket might take a long time. If disconnecting a follower is initiated in ping() because of a failed SyncLimitCheck then the long socket closing time will block the sending of pings to other followers. Without receiving pings, the other followers will not send session information to the leader, which causes sessions to expire. Setting this flag to true ensures that pings will be sent regularly.
+   When enabled, the leader will close a quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time. If disconnecting a follower is initiated in ping() because of a failed SyncLimitCheck then the long socket closing time will block the sending of pings to other followers. Without receiving pings, the other followers will not send session information to the leader, which causes sessions to expire. Setting this flag to true ensures that pings will be sent regularly.
    The default is false.
 
 * *learner.asyncSending*
@@ -1196,7 +1195,7 @@ property, when available, is noted below.
   The default is false.
 
 * *forward_learner_requests_to_commit_processor_disabled*
-    (Jave system property: **zookeeper.forward_learner_requests_to_commit_processor_disabled**)
+    (Java system property: **zookeeper.forward_learner_requests_to_commit_processor_disabled**)
     When this property is set, the requests from learners won't be enqueued to
     CommitProcessor queue, which will help save the resources and GC time on 
     leader.
@@ -1222,7 +1221,7 @@ of servers -- that is, when deploying clusters of servers.
     ###### Note
     >The implementations of leader election 1, and 2 were
     **deprecated** in 3.4.0. Since 3.6.0 only FastLeaderElection is available,
-    in case of upgrade you have to shutdown all of your servers and
+    in case of upgrade you have to shut down all of your servers and
     restart them with electionAlg=3 (or by removing the line from the configuration file).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        >
 
 * *maxTimeToWaitForEpoch* :
@@ -1230,7 +1229,7 @@ of servers -- that is, when deploying clusters of servers.
   **New in 3.6.0:**
       The maximum time to wait for epoch from voters when activating
       leader. If leader received a LOOKING notification from one of
-      it's voters, and it hasn't received epoch packets from majority
+      its voters, and it hasn't received epoch packets from majority
       within maxTimeToWaitForEpoch, then it will goto LOOKING and
       elect leader again.
       This can be tuned to reduce the quorum or server unavailable
@@ -1274,7 +1273,7 @@ of servers -- that is, when deploying clusters of servers.
     used by the clients must match the list of ZooKeeper servers
     that each ZooKeeper server has.
     There are two port numbers **nnnnn**.
-    The first followers use to connect to the leader, and the second is for
+    The first followers used to connect to the leader, and the second is for
     leader election. If you want to test multiple servers on a single machine, then
     different ports can be used for each server.
 
@@ -1377,7 +1376,7 @@ of servers -- that is, when deploying clusters of servers.
     **"reconfigEnabled=true"**, then the ensemble
     will have reconfig feature enabled. If the leader has a setting of
     **"reconfigEnabled=false"**, then the ensemble
-    will have reconfig feature disabled. It is thus recommended to have a consistent
+    will have reconfig feature disabled. It is thus recommended having a consistent
     value for **"reconfigEnabled"** across servers
     in the ensemble.
 
@@ -1389,7 +1388,7 @@ of servers -- that is, when deploying clusters of servers.
     command must be put in this list else ZooKeeper server will
     not enable the command.
     By default the whitelist only contains "srvr" command
-    which zkServer.sh uses. The rest of four letter word commands are disabled
+    which zkServer.sh uses. The rest of four-letter word commands are disabled
     by default: attempting to use them will gain a response
     ".... is not executed because it is not in the whitelist."
     Here's an example of the configuration that enables stat, ruok, conf, and isro
@@ -1398,9 +1397,9 @@ of servers -- that is, when deploying clusters of servers.
         4lw.commands.whitelist=stat, ruok, conf, isro
 
 
-If you really need enable all four letter word commands by default, you can use
+If you really need enable all four-letter word commands by default, you can use
 the asterisk option so you don't have to include every command one by one in the list.
-As an example, this will enable all four letter word commands:
+As an example, this will enable all four-letter word commands:
 
 
     4lw.commands.whitelist=*
@@ -1414,7 +1413,7 @@ As an example, this will enable all four letter word commands:
     This will allow for connections between quorum members to
     remain up when there is network infrastructure that may
     otherwise break them. Some NATs and firewalls may terminate
-    or lose state for long running or idle connections.
+    or lose state for long-running or idle connections.
     Enabling this option relies on OS level settings to work
     properly, check your operating system's options regarding TCP
     keepalive for more information.  Defaults to
@@ -1590,7 +1589,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     in such case, both Java and C client will close the session with server thereafter,
     without further attempts on retrying to reconnect.
 
-    This configuration is short hand for **enforce.auth.enabled=true** and **enforce.auth.scheme=sasl**
+    This configuration is shorthand for **enforce.auth.enabled=true** and **enforce.auth.scheme=sasl**
 
     By default, this feature is disabled. Users who would like to opt-in can enable the feature
     by setting **sessionRequireClientSASLAuth** to **true**.
@@ -1773,7 +1772,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     network interfaces can be used parallel in the cluster). ZooKeeper will perform ICMP ECHO requests
     or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find
     the reachable addresses. This happens only if you provide multiple addresses in the configuration.
-    In this property you can set the timeout in millisecs for the reachability check. The check happens
+    In this property you can set the timeout in milliseconds for the reachability check. The check happens
     in parallel for the different addresses, so the timeout you set here is the maximum time will be taken
     by checking the reachability of all addresses.
     The default value is **1000**.
@@ -1872,7 +1871,7 @@ the variable does.
     network interfaces can be used parallel in the cluster). ZooKeeper will perform ICMP ECHO requests
     or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find
     the reachable addresses. This happens only if you provide multiple addresses in the configuration.
-    The reachable check can fail if you hit some ICMP rate-limitation, (e.g. on MacOS) when you try to
+    The reachable check can fail if you hit some ICMP rate-limitation, (e.g. on macOS) when you try to
     start a large (e.g. 11+) ensemble members cluster on a single machine for testing.
 
     Default value is **true**. By setting this parameter to 'false' you can disable the reachability checks.
@@ -1920,7 +1919,7 @@ necessary for the user to first install ZooKeeper, then create
 the data directory (and potentially txnlog directory), and
 then start the server. Otherwise as mentioned in the previous
 paragraph the server will not start. Running **zkServer-initialize.sh** will create the
-required directories, and optionally setup the myid file
+required directories, and optionally set up the myid file
 (optional command line parameter). This script can be used
 even if the autocreate feature itself is not used, and will
 likely be of use to users as this (setup, including creation
@@ -2123,7 +2122,7 @@ options are used to configure the [AdminServer](#sc_adminserver).
     **New in 3.8.0:** Prometheus.io exporter will start a Jetty server and listen this address, default is "0.0.0.0"
   
 * *metricsProvider.httpPort* :
-    Prometheus.io exporter will start a Jetty server and bind to this port, it default to 7000.
+    Prometheus.io exporter will start a Jetty server and bind to this port, it defaults to 7000.
     Prometheus end point will be http://hostname:httPort/metrics.
 
 * *metricsProvider.exportJvmInfo* :
@@ -2269,7 +2268,7 @@ INFO  [main:QuorumPeer@1797] - Port unification enabled
 INFO  [QuorumPeerListener:QuorumCnxManager$Listener@874] - Creating TLS-enabled quorum server socket
 ```
 
-You should also double check after each node restart that the quorum become healthy again.
+You should also double-check after each node restart that the quorum become healthy again.
 
 4. Enable Quorum TLS on each node and do rolling restart:
 
@@ -2481,8 +2480,8 @@ command:
 #### The AdminServer
 
 **New in 3.5.0:** The AdminServer is
-an embedded Jetty server that provides an HTTP interface to the four
-letter word commands.  By default, the server is started on port 8080,
+an embedded Jetty server that provides an HTTP interface to the four-letter
+word commands.  By default, the server is started on port 8080,
 and commands are issued by going to the URL "/commands/\[command name]",
 e.g., http://localhost:8080/commands/stat.  The command response is
 returned as JSON.  Unlike the original protocol, commands are not
@@ -2500,7 +2499,7 @@ The AdminServer is enabled by default, but can be disabled by either:
   useful if you would like to override ZooKeeper's jetty
   dependency.)
 
-Note that the TCP four letter word interface is still available if
+Note that the TCP four-letter word interface is still available if
 the AdminServer is disabled.
 
 Available commands include:
@@ -2784,7 +2783,7 @@ ZooKeeper correctly:
 
 * *Publicly accessible deployment* :
     A ZooKeeper ensemble is expected to operate in a trusted computing environment.
-    It is thus recommended to deploy ZooKeeper behind a firewall.
+    It is thus recommended deploying ZooKeeper behind a firewall.
 
 <a name="sc_bestPractices"></a>
 

From d9d20aa1db311424336a564ae55367b4e20c4c9d Mon Sep 17 00:00:00 2001
From: maoling <maoling@apache.org>
Date: Sat, 11 Sep 2021 13:30:47 +0800
Subject: [PATCH 248/591] ZOOKEEPER-4370: add zookeeperOracleQuorums.html link
 to webpage index

- more details in the [ZOOKEEPER-4370](https://issues.apache.org/jira/browse/ZOOKEEPER-4370)

Author: maoling <maoling@apache.org>

Reviewers: maoling <maoling@apache.org>

Closes #1748 from maoling/ZOOKEEPER-4370
---
 zookeeper-docs/src/main/resources/markdown/html/header.html | 3 +++
 zookeeper-docs/src/main/resources/markdown/index.md         | 1 +
 2 files changed, 4 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/html/header.html b/zookeeper-docs/src/main/resources/markdown/html/header.html
index 679d582d705..f58a99f0468 100644
--- a/zookeeper-docs/src/main/resources/markdown/html/header.html
+++ b/zookeeper-docs/src/main/resources/markdown/html/header.html
@@ -102,6 +102,9 @@
             <div class="menuitem">
                 <a href="zookeeperHierarchicalQuorums.html">Hierarchical Quorums</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperOracleQuorums.html">Oracle Quorum</a>
+            </div>
             <div class="menuitem">
                 <a href="zookeeperObservers.html">Observers Guide</a>
             </div>
diff --git a/zookeeper-docs/src/main/resources/markdown/index.md b/zookeeper-docs/src/main/resources/markdown/index.md
index e9e7bd9e420..85574f30f4a 100644
--- a/zookeeper-docs/src/main/resources/markdown/index.md
+++ b/zookeeper-docs/src/main/resources/markdown/index.md
@@ -48,6 +48,7 @@ archives.
     + [Quota Guide](zookeeperQuotas.html) - a guide for system administrators on Quotas in ZooKeeper.
     + [JMX](zookeeperJMX.html) - how to enable JMX in ZooKeeper
     + [Hierarchical Quorums](zookeeperHierarchicalQuorums.html) - a guide on how to use hierarchical quorums
+    + [Oracle Quorum](zookeeperOracleQuorums.html) - the introduction to Oracle Quorum increases the availability of a cluster of 2 ZooKeeper instances with a failure detector.
     + [Observers](zookeeperObservers.html) - non-voting ensemble members that easily improve ZooKeeper's scalability
     + [Dynamic Reconfiguration](zookeeperReconfig.html) - a guide on how to use dynamic reconfiguration in ZooKeeper
     + [ZooKeeper CLI](zookeeperCLI.html) - a guide on how to use the ZooKeeper command line interface

From ce4c3d52e0dfb59ee758b77450ae13b196488c95 Mon Sep 17 00:00:00 2001
From: gopalbala <balasubramaniangopalakrishnan@gmail.com>
Date: Sat, 11 Sep 2021 13:34:36 +0800
Subject: [PATCH 249/591] ZOOKEEPER-4350: improve the method:
 QuorumOracleMaj#overrideQuorumDecision

ZOOKEEPER-4350 - improve the method: QuorumOracleMaj#overrideQuorumDecision

Author: gopalbala <balasubramaniangopalakrishnan@gmail.com>

Reviewers: maoling <maoling@apache.org>

Closes #1750 from gopalbala/ZOOKEEPER-4350
---
 .../zookeeper/server/quorum/flexible/QuorumOracleMaj.java   | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
index 0845b802979..01f3a8240be 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
@@ -115,11 +115,7 @@ public String getOraclePath() {
 
     @Override
     public boolean overrideQuorumDecision(List<LearnerHandler> forwardingFollowers) {
-        if (updateNeedOracle(forwardingFollowers) && askOracle()) {
-            return true;
-        } else {
-            return false;
-        }
+        return updateNeedOracle(forwardingFollowers) && askOracle();
     }
 
     @Override

From 26001aacfeff519ccd6b0991b0cc38ab10ad6564 Mon Sep 17 00:00:00 2001
From: ruanwenjun <wenjun@apache.org>
Date: Wed, 22 Sep 2021 19:04:37 +0800
Subject: [PATCH 250/591] ZOOKEEPER-4294: Remove unused IOException on
 FileSnap#findNValidSnapshots

Author: ruanwenjun <wenjun@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1752 from ruanwenjun/dev_wenjun_patch-4294
---
 .../org/apache/zookeeper/server/persistence/FileSnap.java    | 5 ++---
 .../apache/zookeeper/server/persistence/FileTxnSnapLog.java  | 3 +--
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index 00f9b02b894..df8a59c1a9f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -139,7 +139,7 @@ public void deserialize(DataTree dt, Map<Long, Integer> sessions, InputArchive i
      * find the most recent snapshot in the database.
      * @return the file containing the most recent snapshot
      */
-    public File findMostRecentSnapshot() throws IOException {
+    public File findMostRecentSnapshot() {
         List<File> files = findNValidSnapshots(1);
         if (files.size() == 0) {
             return null;
@@ -157,9 +157,8 @@ public File findMostRecentSnapshot() throws IOException {
      * @param n the number of most recent snapshots
      * @return the last n snapshots (the number might be
      * less than n in case enough snapshots are not available).
-     * @throws IOException
      */
-    protected List<File> findNValidSnapshots(int n) throws IOException {
+    protected List<File> findNValidSnapshots(int n) {
         List<File> files = Util.sortDataDir(snapDir.listFiles(), SNAPSHOT_FILE_PREFIX, false);
         int count = 0;
         List<File> list = new ArrayList<File>();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index a4670ec0253..403720bdaa8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -561,9 +561,8 @@ public List<File> findNRecentSnapshots(int n) throws IOException {
      * @param n the number of recent valid snapshots
      * @return the list of n recent valid snapshots, with
      * the most recent in front
-     * @throws IOException
      */
-    public List<File> findNValidSnapshots(int n) throws IOException {
+    public List<File> findNValidSnapshots(int n) {
         FileSnap snaplog = new FileSnap(snapDir);
         return snaplog.findNValidSnapshots(n);
     }

From c0b19e0c5c2bbf1fb24e154466b6cc0fa6b5e74a Mon Sep 17 00:00:00 2001
From: ruanwenjun <wenjun@apache.org>
Date: Wed, 22 Sep 2021 15:22:12 +0000
Subject: [PATCH 251/591] ZOOKEEPER-4380: Avoid NPE in RateLogger#rateLimitLog

Author: ruanwenjun <wenjun@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1758 from ruanwenjun/dev_wenjun_patch-fixNPEInRateLogger
---
 .../java/org/apache/zookeeper/server/RateLogger.java  | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
index 1cae4482d7a..21e41b4fbba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import java.util.Objects;
 import org.apache.zookeeper.common.Time;
 import org.slf4j.Logger;
 
@@ -67,21 +68,21 @@ public void rateLimitLog(String newMsg) {
     /**
      * In addition to the message, it also takes a value.
      */
-    public void rateLimitLog(String newMsg, String value) {
+    public void rateLimitLog(String newMsg, String newValue) {
         long now = Time.currentElapsedTime();
-        if (newMsg.equals(msg)) {
+        if (Objects.equals(newMsg, msg)) {
             ++count;
-            this.value = value;
+            value = newValue;
             if (now - timestamp >= LOG_INTERVAL) {
                 flush();
                 msg = newMsg;
                 timestamp = now;
-                this.value = value;
+                value = newValue;
             }
         } else {
             flush();
             msg = newMsg;
-            this.value = value;
+            value = newValue;
             timestamp = now;
             LOG.warn("Message:{} Value:{}", msg, value);
         }

From 531bddd5b43d2f0b3afbe0051642830c47030652 Mon Sep 17 00:00:00 2001
From: Christine Poerschke <cpoerschke@bloomberg.net>
Date: Sat, 25 Sep 2021 19:40:59 +0800
Subject: [PATCH 252/591] ZOOKEEPER-4384: [R] Fix 'sever' typo in ClientCnxn.

Hello. Not yet created a JIRA issue for this small logging change, but happy to open one if that is preferred.

Stumbled across this in the ZK logs; also checked via `git grep -in "sever[^a-z]"` that this is the only place with the typo.

Author: Christine Poerschke <cpoerschke@bloomberg.net>

Reviewers: maoling <maoling@apache.org>

Closes #1761 from cpoerschke/patch-1
---
 .../src/main/java/org/apache/zookeeper/ClientCnxn.java          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index a516d84ad04..0766624473e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1290,7 +1290,7 @@ public void run() {
                         break;
                     } else {
                         LOG.warn(
-                            "Session 0x{} for sever {}, Closing socket connection. "
+                            "Session 0x{} for server {}, Closing socket connection. "
                                 + "Attempting reconnect except it is a SessionExpiredException.",
                             Long.toHexString(getSessionId()),
                             serverAddress,

From d6b50ad739a49226e97ff28d68be605e1fa36fe5 Mon Sep 17 00:00:00 2001
From: Rushabh Shah <rushabh.shah@rushabh-ltmflld.internal.salesforce.com>
Date: Mon, 27 Sep 2021 17:48:29 +0200
Subject: [PATCH 253/591] ZOOKEEPER-4367: Zookeeper#Login thread leak in case
 of Sasl AuthFailed.

https://issues.apache.org/jira/browse/ZOOKEEPER-4367

Things changed in this PR:
1. Moving `zooKeeperSaslClient` from `ClientCnxn` to `SendThread` since only SendThread is creating and accessing `zooKeeperSaslClient`
2. Moved closing of `zooKeeperSaslClient` from `ClientCnxn#disconnect` method to `SendThread#run` method. This will make sure that we will close zooKeeperSaslClient (and in turn close Login object) even if `ClientCnxn#disconnect` is not called which happens when we encounter AuthFailed Exceptions. Also it looks clean that whenever SendThread is terminating we clean up all the class variable.
3. Setting login to null when `ZooKeeperSaslClient#shutdown` is called. This helps me testing whether zooKeeperSaslClient object is shutdown and in turn Login object is shutdown.

Author: Rushabh Shah <rushabh.shah@rushabh-ltmflld.internal.salesforce.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1755 from shahrs87/ZOOKEEPER-4367
---
 .../java/org/apache/zookeeper/ClientCnxn.java   | 17 ++++++++++++-----
 .../java/org/apache/zookeeper/ZooKeeper.java    |  2 +-
 .../zookeeper/client/ZooKeeperSaslClient.java   |  3 ++-
 .../ClientCnxnSocketFragilityTest.java          |  3 ---
 .../java/org/apache/zookeeper/SaslAuthTest.java | 14 ++++++++++++--
 5 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 0766624473e..347a68f80b5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -214,8 +214,6 @@ static class AuthData {
      */
     volatile boolean seenRwServerBefore = false;
 
-    public ZooKeeperSaslClient zooKeeperSaslClient;
-
     private final ZKClientConfig clientConfig;
     /**
      * If any request's response in not received in configured requestTimeout
@@ -870,6 +868,8 @@ class SendThread extends ZooKeeperThread {
         private long lastPingSentNs;
         private final ClientCnxnSocket clientCnxnSocket;
         private boolean isFirstConnect = true;
+        private volatile ZooKeeperSaslClient zooKeeperSaslClient;
+
 
         void readResponse(ByteBuffer incomingBuffer) throws IOException {
             ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
@@ -1313,6 +1313,10 @@ public void run() {
                 eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Disconnected, null));
             }
             eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Closed, null));
+
+            if (zooKeeperSaslClient != null) {
+                zooKeeperSaslClient.shutdown();
+            }
             ZooTrace.logTraceMessage(
                 LOG,
                 ZooTrace.getTextTraceLevel(),
@@ -1486,6 +1490,9 @@ public void sendPacket(Packet p) throws IOException {
             clientCnxnSocket.sendPacket(p);
         }
 
+        public ZooKeeperSaslClient getZooKeeperSaslClient() {
+            return zooKeeperSaslClient;
+        }
     }
 
     /**
@@ -1504,9 +1511,6 @@ public void disconnect() {
             LOG.warn("Got interrupted while waiting for the sender thread to close", ex);
         }
         eventThread.queueEventOfDeath();
-        if (zooKeeperSaslClient != null) {
-            zooKeeperSaslClient.shutdown();
-        }
     }
 
     /**
@@ -1739,4 +1743,7 @@ private void initRequestTimeout() {
         }
     }
 
+    public ZooKeeperSaslClient getZooKeeperSaslClient() {
+        return sendThread.getZooKeeperSaslClient();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index a013dd3d5e9..127f5a2a3f3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -226,7 +226,7 @@ public void updateServerList(String connectString) throws IOException {
     }
 
     public ZooKeeperSaslClient getSaslClient() {
-        return cnxn.zooKeeperSaslClient;
+        return cnxn.getZooKeeperSaslClient();
     }
 
     private final ZKClientConfig clientConfig;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
index b0598bca87f..940bcfe228b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
@@ -215,7 +215,7 @@ public void processResult(int rc, String path, Object ctx, byte[] data, Stat sta
             // data[] contains the Zookeeper Server's SASL token.
             // ctx is the ZooKeeperSaslClient object. We use this object's respondToServer() method
             // to reply to the Zookeeper Server's SASL token
-            ZooKeeperSaslClient client = ((ClientCnxn) ctx).zooKeeperSaslClient;
+            ZooKeeperSaslClient client = ((ClientCnxn) ctx).getZooKeeperSaslClient();
             if (client == null) {
                 LOG.warn("sasl client was unexpectedly null: cannot respond to Zookeeper server.");
                 return;
@@ -458,6 +458,7 @@ public boolean clientTunneledAuthenticationInProgress() {
     public void shutdown() {
         if (null != login) {
             login.shutdown();
+            login = null;
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index b5bb0cd9446..953414468f3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -338,9 +338,6 @@ public void disconnect() {
                 LOG.warn("Got interrupted while waiting for the sender thread to close", ex);
             }
             eventThread.queueEventOfDeath();
-            if (zooKeeperSaslClient != null) {
-                zooKeeperSaslClient.shutdown();
-            }
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
index 1d0bffaafb7..005cf4bac30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper;
 
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
@@ -33,6 +35,7 @@
 import org.apache.zookeeper.ClientCnxn.SendThread;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.test.ClientBase;
@@ -232,8 +235,16 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             Field eventThreadField = clientCnxn.getClass().getDeclaredField("eventThread");
             eventThreadField.setAccessible(true);
             EventThread eventThread = (EventThread) eventThreadField.get(clientCnxn);
+            ZooKeeperSaslClient zooKeeperSaslClient = clientCnxn.getZooKeeperSaslClient();
+            assertNotNull(zooKeeperSaslClient);
             sendThread.join(CONNECTION_TIMEOUT);
             eventThread.join(CONNECTION_TIMEOUT);
+            Field loginField = zooKeeperSaslClient.getClass().getDeclaredField("login");
+            loginField.setAccessible(true);
+            Login login = (Login) loginField.get(zooKeeperSaslClient);
+            // If login is null, this means ZooKeeperSaslClient#shutdown method has been called which in turns
+            // means that Login#shutdown has been called.
+            assertNull(login);
             assertFalse(sendThread.isAlive(), "SendThread did not shutdown after authFail");
             assertFalse(eventThread.isAlive(), "EventThread did not shutdown after authFail");
         } finally {
@@ -242,5 +253,4 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             }
         }
     }
-
-}
+}
\ No newline at end of file

From 2dcc64d9411e7b24402222437215ab2fe1e59c2e Mon Sep 17 00:00:00 2001
From: Colin McIntosh <cmcintosh@netflix.com>
Date: Sat, 2 Oct 2021 13:58:31 +0800
Subject: [PATCH 254/591] ZOOKEEPER-4372: Added check and unit test for
 negative sequence numbers in lock recipe

I took a stab at fixing this and adding a simple case to one of the existing unit tests to check for negative sequence numbers. This is my first time working in the ZK Java implementation so please let me know if I need to make any adjustments. I updated the code to check if there is a prior "-" character in the index before the last "-" and move the index back one if there is.

Author: Colin McIntosh <cmcintosh@netflix.com>

Reviewers: maoling <maoling@apache.org>

Closes #1751 from colinmcintosh/cm/zk-lock-recipe-seq
---
 .../java/org/apache/zookeeper/recipes/lock/ZNodeName.java  | 5 ++++-
 .../org/apache/zookeeper/recipes/lock/ZNodeNameTest.java   | 7 ++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java
index 24d6f13ed62..3fc92690919 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java
@@ -51,11 +51,14 @@ class ZNodeName implements Comparable<ZNodeName> {
     public ZNodeName(final String name) {
         this.name = Objects.requireNonNull(name, "ZNode name cannot be null");
 
-        final int idx = name.lastIndexOf('-');
+        int idx = name.lastIndexOf('-');
         if (idx < 0) {
             this.prefix = name;
             this.sequence = Optional.empty();
         } else {
+            if (idx > 0 && name.charAt(idx - 1) == '-') {
+                idx = idx - 1;
+            }
             this.prefix = name.substring(0, idx);
             this.sequence = Optional.ofNullable(parseSequenceString(name.substring(idx + 1)));
         }
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
index aac76cc6205..7d82627b084 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
@@ -34,7 +34,7 @@ public class ZNodeNameTest {
 
     @Test
     public void testOrderWithSamePrefix() throws Exception {
-        final String[] names = {"x-3", "x-5", "x-11", "x-1"};
+        final String[] names = {"x-3", "x-5", "x-11", "x-1", "x--20"};
         ZNodeName zname;
 
         final Collection<ZNodeName> nodeNames = Arrays.asList(names).stream()
@@ -42,6 +42,11 @@ public void testOrderWithSamePrefix() throws Exception {
 
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
+        zname = it.next();
+        assertEquals("x--20", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(-20), zname.getSequence().get());
+
         zname = it.next();
         assertEquals("x-1", zname.getName());
         assertEquals("x", zname.getPrefix());

From 156e682e3d4bb27338418602c1c3c530da6ff7bd Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 6 Oct 2021 06:41:29 +0000
Subject: [PATCH 255/591] ZOOKEEPER-4382: Update Maven Bundle Plugin to 5.1.1 -
 build on JDK18

More context here
https://issues.apache.org/jira/browse/ZOOKEEPER-4382

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Damien Diederen <ddiederen@apache.org>

Closes #1760 from eolivelli/fix/update-maven-bundle-plugin
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index c7deebb3bdf..e9296e15f70 100755
--- a/pom.xml
+++ b/pom.xml
@@ -829,7 +829,7 @@
         <plugin>
           <groupId>org.apache.felix</groupId>
           <artifactId>maven-bundle-plugin</artifactId>
-          <version>4.1.0</version>
+          <version>5.1.1</version>
         </plugin>
       </plugins>
     </pluginManagement>

From cb899167421d7a24f1e6c3f06aa4a621391df15f Mon Sep 17 00:00:00 2001
From: maoling <maoling@apache.org>
Date: Sun, 10 Oct 2021 23:09:56 +0800
Subject: [PATCH 256/591] ZOOKEEPER-4349: delete the useless oraclePath
 directory generated by test suit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- when running the `QuorumOracleMajTest` and sub tests of `QuorumBase`(e.g: `MultiOpSessionUpgradeTest`), we generate lots of useless files which are not exempt from `Git`. we should delete them after the finish of one UT.
```
✗ tree zookeeper-server/tmp/
zookeeper-server/tmp/
└── oraclePath
    ├── 0
    │   └── mastership
    │       └── value
    └── 1
        └── mastership
            └── value
```
- fix a typo in the `zookeeperOracleQuorums.md `

Author: maoling <maoling@apache.org>

Reviewers: Ching-Chan Lee <leechingchankyo@gmail.com>

Closes #1742 from maoling/ZOOKEEPER-4349
---
 .../markdown/zookeeperOracleQuorums.md        |  2 +-
 .../org/apache/zookeeper/test/QuorumBase.java | 97 +++++++++++--------
 .../test/QuorumBaseOracle_2Nodes.java         | 32 +++---
 .../zookeeper/test/QuorumOracleMajTest.java   |  1 +
 4 files changed, 77 insertions(+), 55 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md b/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
index adc547778bb..0f72d6ee5cf 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
@@ -23,7 +23,7 @@ in a 2-instance configuration when the other instance is identified as faulty by
 Every instance shall access to a file which contains either 0 or 1 to indicate whether this instance is authorized by the Oracle.
 However, this design can be changed since the fail detector algorithms vary from each other. Therefore, ones can override the method of _askOracle()_ in _QuorumOracleMaj_ to adapt the preferred way of deciphering the message from the Oracle.
 
-## The deployment cotexts
+## The deployment contexts
 The Oracle is designed to increase the availability of a cluster of 2 ZooKeeper instances; thus, the size of the voting member is **2**.
 In other words, the Oracle solves the consensus problem of a possibility of faulty instance in a two-instance ensemble.
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index c2396a6403d..8f5f17db7fd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -49,11 +49,12 @@ public class QuorumBase extends ClientBase {
 
     private static final String LOCALADDR = "127.0.0.1";
 
-    private static final String oraclePath_0 = "./tmp/oraclePath/0/mastership/";
-    private static final String oraclePath_1 = "./tmp/oraclePath/1/mastership/";
-    private static final String oraclePath_2 = "./tmp/oraclePath/0/mastership/";
-    private static final String oraclePath_3 = "./tmp/oraclePath/1/mastership/";
-    private static final String oraclePath_4 = "./tmp/oraclePath/0/mastership/";
+    private File oracleDir;
+    private static final String oraclePath_0 = "/oraclePath/0/mastership/";
+    private static final String oraclePath_1 = "/oraclePath/1/mastership/";
+    private static final String oraclePath_2 = "/oraclePath/0/mastership/";
+    private static final String oraclePath_3 = "/oraclePath/1/mastership/";
+    private static final String oraclePath_4 = "/oraclePath/0/mastership/";
     private static final String mastership = "value";
 
     File s1dir, s2dir, s3dir, s4dir, s5dir;
@@ -137,42 +138,42 @@ protected void setUp(boolean withObservers, boolean withOracle) throws Exception
             LOG.info("Initial fdcount is: {}", osMbean.getOpenFileDescriptorCount());
         }
 
-        if (withOracle) {
-            File directory = new File(oraclePath_0);
-            directory.mkdirs();
-            FileWriter fw = new FileWriter(oraclePath_0 + mastership);
-            fw.write("1");
-            fw.close();
-
-            directory = new File(oraclePath_1);
-            directory.mkdirs();
-            fw = new FileWriter(oraclePath_1 + mastership);
-            fw.write("0");
-            fw.close();
-
-            directory = new File(oraclePath_2);
-            directory.mkdirs();
-            fw = new FileWriter(oraclePath_2 + mastership);
-            fw.write("0");
-            fw.close();
-
-            directory = new File(oraclePath_3);
-            directory.mkdirs();
-            fw = new FileWriter(oraclePath_3 + mastership);
-            fw.write("1");
-            fw.close();
-
-            directory = new File(oraclePath_4);
-            directory.mkdirs();
-            fw = new FileWriter(oraclePath_4 + mastership);
-            fw.write("0");
-            fw.close();
-        }
-
-
         LOG.info("Setup finished");
     }
 
+    private void createOraclePath() throws IOException {
+        oracleDir = ClientBase.createTmpDir();
+        File directory = new File(oracleDir, oraclePath_0);
+        directory.mkdirs();
+        FileWriter fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_0 + mastership);
+        fw.write("1");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_1);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_1 + mastership);
+        fw.write("0");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_2);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_2 + mastership);
+        fw.write("0");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_3);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_3 + mastership);
+        fw.write("1");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_4);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath()  + oraclePath_4 + mastership);
+        fw.write("0");
+        fw.close();
+    }
+
     void startServers() throws Exception {
         startServers(false, true);
     }
@@ -211,20 +212,27 @@ void startServers(boolean withObservers, boolean withOracle) throws Exception {
             s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
             assertEquals(portClient5, s5.getClientPort());
         } else {
+            createOraclePath();
+
             LOG.info("creating QuorumPeer 1 port {}", portClient1);
-            s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_0 + mastership);
+            s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_0 + mastership);
             assertEquals(portClient1, s1.getClientPort());
             LOG.info("creating QuorumPeer 2 port {}", portClient2);
-            s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_1 + mastership);
+            s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_1 + mastership);
             assertEquals(portClient2, s2.getClientPort());
             LOG.info("creating QuorumPeer 3 port {}", portClient3);
-            s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_2 + mastership);
+            s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_2 + mastership);
             assertEquals(portClient3, s3.getClientPort());
             LOG.info("creating QuorumPeer 4 port {}", portClient4);
-            s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_3 + mastership);
+            s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_3 + mastership);
             assertEquals(portClient4, s4.getClientPort());
             LOG.info("creating QuorumPeer 5 port {}", portClient5);
-            s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_4 + mastership);
+            s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_4 + mastership);
             assertEquals(portClient5, s5.getClientPort());
         }
 
@@ -451,6 +459,9 @@ public void setupServer(int i) throws IOException {
     @Override
     public void tearDown() throws Exception {
         LOG.info("TearDown started");
+        if (oracleDir != null) {
+            ClientBase.recursiveDelete(oracleDir);
+        }
 
         OSMXBean osMbean = new OSMXBean();
         if (osMbean.getUnix()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
index 482027d1a9a..d32af99952d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
@@ -47,8 +47,9 @@ public class QuorumBaseOracle_2Nodes extends ClientBase{
 
     private static final String LOCALADDR = "127.0.0.1";
 
-    private static final String oraclePath_0 = "./tmp/oraclePath/0/mastership/";
-    private static final String oraclePath_1 = "./tmp/oraclePath/1/mastership/";
+    private File oracleDir;
+    private static String oraclePath_0 = "/oraclePath/0/mastership/";
+    private static String oraclePath_1 = "/oraclePath/1/mastership/";
 
     private static final String mastership = "value";
 
@@ -96,6 +97,8 @@ public void setUp() throws Exception {
         s1dir = ClientBase.createTmpDir();
         s2dir = ClientBase.createTmpDir();
 
+        createOraclePath();
+
         startServers();
 
         OSMXBean osMbean = new OSMXBean();
@@ -103,20 +106,22 @@ public void setUp() throws Exception {
             LOG.info("Initial fdcount is: {}", osMbean.getOpenFileDescriptorCount());
         }
 
-        File directory = new File(oraclePath_0);
+        LOG.info("Setup finished");
+    }
+
+    private void createOraclePath() throws IOException {
+        oracleDir = ClientBase.createTmpDir();
+        File directory = new File(oracleDir, oraclePath_0);
         directory.mkdirs();
-        FileWriter fw = new FileWriter(oraclePath_0 + mastership);
+        FileWriter fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_0 + mastership);
         fw.write("0");
         fw.close();
 
-        directory = new File(oraclePath_1);
+        directory = new File(oracleDir, oraclePath_1);
         directory.mkdirs();
-        fw = new FileWriter(oraclePath_1 + mastership);
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_1 + mastership);
         fw.write("1");
         fw.close();
-
-
-        LOG.info("Setup finished");
     }
 
     void startServers() throws Exception {
@@ -129,10 +134,12 @@ void startServers() throws Exception {
         peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
 
         LOG.info("creating QuorumPeer 1 port {}", portClient1);
-        s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_0 + mastership);
+        s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                .getAbsolutePath() + oraclePath_0 + mastership);
         assertEquals(portClient1, s1.getClientPort());
         LOG.info("creating QuorumPeer 2 port {}", portClient2);
-        s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oraclePath_1 + mastership);
+        s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                .getAbsolutePath() + oraclePath_1 + mastership);
         assertEquals(portClient2, s2.getClientPort());
 
 
@@ -286,6 +293,9 @@ public void setupServer(int i) throws IOException {
     @Override
     public void tearDown() throws Exception {
         LOG.info("TearDown started");
+        if (oracleDir != null) {
+            ClientBase.recursiveDelete(oracleDir);
+        }
 
         OSMXBean osMbean = new OSMXBean();
         if (osMbean.getUnix()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
index 1b1fb3125ba..2a079e2c33a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
@@ -56,6 +56,7 @@ public void testMajQuorums() throws Throwable {
             assertTrue(electionTimeTaken >= 0, "Wrong electionTimeTaken value!");
         }
 
+        tearDown();
         //setup servers 1-2 to be followers
         // id=1, oracle is false; id=2, oracle is true
         setUp();

From 9f355f5a57f35d3760f8e669696622135c457938 Mon Sep 17 00:00:00 2001
From: maoling <maoling@apache.org>
Date: Sun, 17 Oct 2021 15:07:58 +0800
Subject: [PATCH 257/591] ZOOKEEPER-4377: KeeperException.create has
 NullPointerException when low version client requests the high version server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- When low version client accessed the high version server which has some new added error code, the client will get a NPE:
```
 java.lang.NullPointerException
at org.apache.zookeeper.KeeperException.create(KeeperException.java:94)
at org.apache.zookeeper.KeeperException.create(KeeperException.java:54)
at org.apache.zookeeper.ZooKeeper.create(ZooKeeper.java:1538)
```
- How to reproduce this issue？For example:
```
the client version we using is 3.6.0, and server version we using is 3.7.0 which has a new added error code QUOTAEXCEEDED(-125),
we set quota at server side and use the client to create znodes which exceeds the quota,
the client will get a NPE
```
- Apply this patch, we will get the following:
```
 java.lang.IllegalArgumentException: The current client version cannot lookup this code:-125
 at org.apache.zookeeper.KeeperException$Code.get(KeeperException.java:449)
 at org.apache.zookeeper.ZooKeeper.create(ZooKeeper.java:1347)
```
- we should backport this PR to all branches, making the client has upward compatibility
- more details in the [ZOOKEEPER-4377](https://issues.apache.org/jira/browse/ZOOKEEPER-4377)

Author: maoling <maoling@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, ruanwenjun <wenjun@apache.org>

Closes #1764 from maoling/ZOOKEEPER-4377
---
 .../java/org/apache/zookeeper/KeeperException.java  | 10 +++++++---
 .../java/org/apache/zookeeper/ZooKeeperTest.java    | 13 +++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index 4590e0fd9a0..ef38763f41e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -154,7 +154,7 @@ public static KeeperException create(Code code) {
             return new ThrottledOpException();
         case OK:
         default:
-            throw new IllegalArgumentException("Invalid exception code");
+            throw new IllegalArgumentException("Invalid exception code:" + code.code);
         }
     }
 
@@ -441,10 +441,14 @@ public int intValue() {
         /**
          * Get the Code value for a particular integer error code
          * @param code int error code
-         * @return Code value corresponding to specified int code, or null
+         * @return Code value corresponding to specified int code, if null throws IllegalArgumentException
          */
         public static Code get(int code) {
-            return lookup.get(code);
+            Code codeVal = lookup.get(code);
+            if (codeVal == null) {
+                throw new IllegalArgumentException("The current client version cannot lookup this code:" + code);
+            }
+            return codeVal;
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 47ab6c44eb3..c829e85da2a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -18,9 +18,11 @@
 
 package org.apache.zookeeper;
 
+import static org.apache.zookeeper.KeeperException.Code.NOAUTH;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
@@ -31,6 +33,7 @@
 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
+import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.cli.CliCommand;
 import org.apache.zookeeper.cli.CliException;
@@ -802,4 +805,14 @@ public void testWaitForConnection() throws Exception {
 
     }
 
+    @Test
+    public void testKeeperExceptionCreateNPE() {
+        // One existing code
+        KeeperException k1 = KeeperException.create(Code.get(NOAUTH.intValue()));
+        assertTrue(k1 instanceof KeeperException.NoAuthException);
+
+        // One impossible code
+        assertThrows(IllegalArgumentException.class, () -> KeeperException.create(Code.get(Integer.MAX_VALUE)));
+    }
+
 }

From 4f015139e73986c13d6ecfc8dd18a00e6f8a3485 Mon Sep 17 00:00:00 2001
From: gautammsuthar <69046800+gautammsuthar@users.noreply.github.com>
Date: Sun, 24 Oct 2021 21:10:54 +0800
Subject: [PATCH 258/591] ZOOKEEPER-4402: Added Hyperlink At LOGO

Inserted a hyperlink AT logo
So that users can easily be redirected to the SITE

Author: gautammsuthar <69046800+gautammsuthar@users.noreply.github.com>

Reviewers: maoling <maoling@apache.org>

Closes #1771 from gautammsuthar/patch-1
---
 README.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a616babfdff..60dff8fe657 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,10 @@
 # Apache ZooKeeper [![GitHub Actions CI][ciBadge]][ciLink] [![Travis CI][trBadge]][trLink] [![Maven Central][mcBadge]][mcLink] [![License][liBadge]][liLink]
-![alt text](https://zookeeper.apache.org/images/zookeeper_small.gif "ZooKeeper")
+
+<p align="left">
+  <a href="https://zookeeper.apache.org/">
+    <img src="https://zookeeper.apache.org/images/zookeeper_small.gif"" alt="https://zookeeper.apache.org/"><br/>
+  </a>
+</p>
 
 For the latest information about Apache ZooKeeper, please visit our website at:
 

From e5dd8a57cddb6e3958a53b8228f94b74da7ca7ce Mon Sep 17 00:00:00 2001
From: yuMoyu <2394988933@qq.com>
Date: Sun, 31 Oct 2021 14:07:10 +0800
Subject: [PATCH 259/591] ZOOKEEPER-4406: fix the znode type for Barrier
 implementation in the zookeeperTutorial.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With EPHEMERAL_SEQUENTIAL,the generated node name will be added with the sequence number, and the delete() will report error that it cannot be found
EPHEMERAL_SEQUENTIAL产生��点����顺�编�，删除��找�到

Author: yuMoyu <2394988933@qq.com>

Reviewers: maoling <maoling@apache.org>

Closes #1738 from yuMoyu/patch-1
---
 .../src/main/resources/markdown/zookeeperTutorial.md          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md
index 4057a389b66..366c0a9f081 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md
@@ -156,7 +156,7 @@ a boolean flag that enables the process to set a watch. In the code the flag is
 
     boolean enter() throws KeeperException, InterruptedException{
         zk.create(root + "/" + name, new byte[0], Ids.OPEN_ACL_UNSAFE,
-                CreateMode.EPHEMERAL_SEQUENTIAL);
+                CreateMode.EPHEMERAL);
         while (true) {
             synchronized (mutex) {
                 List<String> list = zk.getChildren(root, true);
@@ -463,7 +463,7 @@ Start a barrier with 2 participants (start as many times as many participants yo
 
             boolean enter() throws KeeperException, InterruptedException{
                 zk.create(root + "/" + name, new byte[0], Ids.OPEN_ACL_UNSAFE,
-                        CreateMode.EPHEMERAL_SEQUENTIAL);
+                        CreateMode.EPHEMERAL);
                 while (true) {
                     synchronized (mutex) {
                         List<String> list = zk.getChildren(root, true);

From 864b8a7c8044349b29b0e67952323a8cb2bc2dd4 Mon Sep 17 00:00:00 2001
From: fredster33 <64927044+fredster33@users.noreply.github.com>
Date: Sat, 6 Nov 2021 16:14:48 +0800
Subject: [PATCH 260/591] ZOOKEEPER-4411: [PATCH] improve the grammar issue in
 the README.md

I'm not sure if I corrected the sentence correctly, so this might be an incorrect interpretation.

Author: fredster33 <64927044+fredster33@users.noreply.github.com>

Reviewers: Christopher Tubbs <ctubbsii@apache.org>, maoling <maoling@apache.org>

Closes #1632 from fredster33/patch-1 and squashes the following commits:

452379fa7 [fredster33] Accept change
4a0bceab3 [fredster33] Grammar fix
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 60dff8fe657..cd9db2b460c 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ If you are going to compile with Java 1.8, you should use a
 recent release at u211 or above.
 
 # Contributing
-We always welcome new contributors to the project! See [How to Contribute](https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute) for details on how to submit patch through pull request and our contribution workflow.
+We always welcome new contributors to the project! See [How to Contribute](https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute) for details on how to submit patches as pull requests and other aspects of our contribution workflow.
 
 
 [ciBadge]: https://github.com/apache/zookeeper/workflows/CI/badge.svg

From eb63dd9757e7234515e81799d82cc0af4a0ae7f9 Mon Sep 17 00:00:00 2001
From: lanicc <lanettiesso@gmail.com>
Date: Sat, 13 Nov 2021 15:15:01 +0800
Subject: [PATCH 261/591] ZOOKEEPER-4362: ZKDatabase.txnCount should not log
 non transactional requests

ZKDatabase.txnCount logged non transactional requests

    public boolean append(Request si) throws IOException {
        txnCount.incrementAndGet();
        return this.snapLog.append(si);
    }
snaplog.append may return false, but txnCount increased

maybe it would be better

    public boolean append(Request si) throws IOException {
        if (this.snapLog.append(si)) {
            txnCount.incrementAndGet();
            return true;
        }
        return false;
    }

Author: lanicc <lanettiesso@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1744 from lanicc/ZOOKEEPER-4362 and squashes the following commits:

4b08e05ff [lanicc] ZOOKEEPER-4366: fix typo
4e1ad8d2c [lanicc] ZOOKEEPER-4366: Add test case for ZkDatabase txnCount
40b86bcad [lanicc] ZOOKEEPER-4362: ZKDatabase.txnCount should not log non transactional requests
---
 .../apache/zookeeper/server/ZKDatabase.java   |  7 +-
 .../zookeeper/server/TxnLogCountTest.java     | 74 +++++++++++++++++++
 2 files changed, 79 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index d8d60d87cbe..05ada8ceebe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -636,8 +636,11 @@ public void serializeSnapshot(OutputArchive oa) throws IOException, InterruptedE
      * @return true if the append was succesfull and false if not
      */
     public boolean append(Request si) throws IOException {
-        txnCount.incrementAndGet();
-        return this.snapLog.append(si);
+        if (this.snapLog.append(si)) {
+            txnCount.incrementAndGet();
+            return true;
+        }
+        return false;
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java
new file mode 100644
index 00000000000..afcb09bdbcf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.mock;
+import java.io.File;
+import java.io.IOException;
+import org.apache.jute.OutputArchive;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.txn.TxnHeader;
+import org.junit.Test;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.stubbing.Answer;
+
+public class TxnLogCountTest {
+
+    /**
+     * Test ZkDatabase's txnCount
+     */
+    @Test
+    public void testTxnLogCount() throws IOException {
+        File tmpDir = ClientBase.createTmpDir();
+        FileTxnSnapLog snapLog = new FileTxnSnapLog(tmpDir, tmpDir);
+        ZKDatabase zkDatabase = new ZKDatabase(snapLog);
+        int txnRequestCnt = 10;
+        int nonTxnRequestCnt = 10;
+        for (int i = 0; i < txnRequestCnt && zkDatabase.append(mockTxnRequest()); i++) {}
+        assertEquals(txnRequestCnt, zkDatabase.getTxnCount());
+
+        for (int i = 0; i < nonTxnRequestCnt && !zkDatabase.append(mockNonTxnRequest()); i++) {}
+        assertEquals(txnRequestCnt, zkDatabase.getTxnCount());
+    }
+
+    private Request mockTxnRequest() throws IOException {
+        TxnHeader header = mock(TxnHeader.class);
+        doAnswer(new Answer() {
+            @Override
+            public Object answer(InvocationOnMock invocation) throws Throwable {
+                Object[] args = invocation.getArguments();
+                OutputArchive oa = (OutputArchive) args[0];
+                oa.writeString("header", "test");
+                return null;
+            }
+        }).when(header).serialize(any(OutputArchive.class), anyString());
+        Request request = new Request(1, 2, 3, header, null, 4);
+        return request;
+    }
+
+    private Request mockNonTxnRequest() {
+        Request request = new Request(0, 0, 0, null, null, 0);
+        return request;
+    }
+}

From f4f0bed00dd254e34aedfe408799f557d60fd0e7 Mon Sep 17 00:00:00 2001
From: fengpan0403 <fengpan0403@163.com>
Date: Sun, 21 Nov 2021 12:39:22 +0800
Subject: [PATCH 262/591] fix a typo in zookeeper.h

Typo fix

Author: fengpan0403 <fengpan0403@163.com>

Reviewers: maoling <maoling@apache.org>

Closes #1778 from fengpan0403/master
---
 zookeeper-client/zookeeper-client-c/include/zookeeper.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 467a857eaa1..7d889f60557 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -716,7 +716,7 @@ ZOOAPI int zoo_set_servers(zhandle_t *zh, const char *hosts);
  * This method allows an application to influence the rate of polling.
  * When delay_ms is set to a value greater than zero, the client skips
  * most "routine" resolutions which would have happened in a window of
- * that many milliseconds since the last succesful one.
+ * that many milliseconds since the last successful one.
  *
  * Setting delay_ms to 0 disables this logic, reverting to the default
  * behavior.  Setting it to -1 disables network resolutions during

From 01f935cdebd582211e6d4eef9f81da4228412911 Mon Sep 17 00:00:00 2001
From: Frederiko Costa <frederiko.costa@workday.com>
Date: Sat, 27 Nov 2021 14:50:35 +0800
Subject: [PATCH 263/591] ZOOKEEPER-4414: Update Netty to 4.1.70.Final

This PR updates Netty to 4.1.70 Final on master. This addresses the following CVEs:
* CVE-2021-37136
* Netty codec/src/main/java/io/netty/handler/codec/compression/Lz4FrameEncoder.java Lz4FrameEncoder::finishEncode() Function Buffer Overflow
* CVE-2021-37137

Author: Frederiko Costa <frederiko.costa@workday.com>

Reviewers: maoling <maoling@apache.org>

Closes #1775 from frederiko/netty-4.1.70.Final
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.70.Final.LICENSE.txt} | 0
 ...3.Final.LICENSE.txt => netty-codec-4.1.70.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.70.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.70.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.70.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.70.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.70.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.63.Final.LICENSE.txt => netty-buffer-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.63.Final.LICENSE.txt => netty-codec-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.63.Final.LICENSE.txt => netty-common-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.63.Final.LICENSE.txt => netty-handler-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.63.Final.LICENSE.txt => netty-resolver-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.63.Final.LICENSE.txt => netty-transport-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.63.Final.LICENSE.txt => netty-transport-native-epoll-4.1.70.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index e9296e15f70..cd4449c1886 100755
--- a/pom.xml
+++ b/pom.xml
@@ -467,7 +467,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.63.Final</netty.version>
+    <netty.version>4.1.70.Final</netty.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
     <jackson.version>2.10.5.1</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.70.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.63.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt

From 8d82be71dfce6b6752717ca0a68a77ec3c03032b Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sun, 5 Dec 2021 10:54:20 +0800
Subject: [PATCH 264/591] ZOOKEEPER-4267: Fix check-style issues

Formatted CertificatesToPlayWith to fix check-style issue :(whitespace) OperatorWrap: '+' should be on a new line

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: maoling <maoling@apache.org>

Closes #1662 from arshadmohammad/ZOOKEEPER-4267-master and squashes the following commits:

25d76aa6a [Mohammad Arshad] Removed CertificatesToPlayWith from checkstyleSuppressions.xml as issues are fixed
6fd457e4f [Mohammad Arshad] ZOOKEEPER-4267: Fix check-style issues Formatted ZKHostnameVerifierTest to fix check-style issue :(whitespace) OperatorWrap: '+' should be on a new line
---
 checkstyleSuppressions.xml                    |   2 -
 .../common/CertificatesToPlayWith.java        | 898 +++++++++---------
 2 files changed, 434 insertions(+), 466 deletions(-)

diff --git a/checkstyleSuppressions.xml b/checkstyleSuppressions.xml
index eb23d475f86..513de6b4d80 100644
--- a/checkstyleSuppressions.xml
+++ b/checkstyleSuppressions.xml
@@ -31,6 +31,4 @@
 
     <!-- TODO ZOOKEEPER-3469 -->
     <suppress checks="Javadoc.+" files=".+[\\/]zookeeper-server[\\/].+\.java"/>
-
-    <suppress checks="OperatorWrap|ModifierOrder" files="zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith\.java" />
 </suppressions>
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
index 1101c737172..0cd2172a713 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -36,534 +36,504 @@ public class CertificatesToPlayWith {
     /**
      * CN=foo.com
      */
-    public final static byte[] X509_FOO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aQMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzE0MVoXDTI4MTEwNTE1MzE0MVowgaQx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n" +
-                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
-                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
-                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
-                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
-                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
-                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
-                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n" +
-                    "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n" +
-                    "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n" +
-                    "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQC3jRmEya6sQCkmieULcvx8zz1euCk9\n" +
-                    "fSez7BEtki8+dmfMXe3K7sH0lI8f4jJR0rbSCjpmCQLYmzC3NxBKeJOW0RcjNBpO\n" +
-                    "c2JlGO9auXv2GDP4IYiXElLJ6VSqc8WvDikv0JmCCWm0Zga+bZbR/EWN5DeEtFdF\n" +
-                    "815CLpJZNcYwiYwGy/CVQ7w2TnXlG+mraZOz+owr+cL6J/ZesbdEWfjoS1+cUEhE\n" +
-                    "HwlNrAu8jlZ2UqSgskSWlhYdMTAP9CPHiUv9N7FcT58Itv/I4fKREINQYjDpvQcx\n" +
-                    "SaTYb9dr5sB4WLNglk7zxDtM80H518VvihTcP7FHL+Gn6g4j5fkI98+S\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_FOO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aQMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzE0MVoXDTI4MTEwNTE1MzE0MVowgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n"
+        + "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n"
+        + "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n"
+        + "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQC3jRmEya6sQCkmieULcvx8zz1euCk9\n"
+        + "fSez7BEtki8+dmfMXe3K7sH0lI8f4jJR0rbSCjpmCQLYmzC3NxBKeJOW0RcjNBpO\n"
+        + "c2JlGO9auXv2GDP4IYiXElLJ6VSqc8WvDikv0JmCCWm0Zga+bZbR/EWN5DeEtFdF\n"
+        + "815CLpJZNcYwiYwGy/CVQ7w2TnXlG+mraZOz+owr+cL6J/ZesbdEWfjoS1+cUEhE\n"
+        + "HwlNrAu8jlZ2UqSgskSWlhYdMTAP9CPHiUv9N7FcT58Itv/I4fKREINQYjDpvQcx\n"
+        + "SaTYb9dr5sB4WLNglk7zxDtM80H518VvihTcP7FHL+Gn6g4j5fkI98+S\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * CN=&#x82b1;&#x5b50;.co.jp
      */
-    public final static byte[] X509_HANAKO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIESzCCAzOgAwIBAgIJAIz+EYMBU6aTMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1NDIxNVoXDTI4MTEwNTE1NDIxNVowgakx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczEVMBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkB\n" +
-                    "FhZqdWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n" +
-                    "MIIBCgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjU\n" +
-                    "g4pNjYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQc\n" +
-                    "wHf0ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t\n" +
-                    "7iu1JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAn\n" +
-                    "AxK6q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArD\n" +
-                    "qUYxqJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwG\n" +
-                    "CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV\n" +
-                    "HQ4EFgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLS\n" +
-                    "rNuzA1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBALJ27i3okV/KvlDp6KMID3gd\n" +
-                    "ITl68PyItzzx+SquF8gahMh016NX73z/oVZoVUNdftla8wPUB1GwIkAnGkhQ9LHK\n" +
-                    "spBdbRiCj0gMmLCsX8SrjFvr7cYb2cK6J/fJe92l1tg/7Y4o7V/s4JBe/cy9U9w8\n" +
-                    "a0ctuDmEBCgC784JMDtT67klRfr/2LlqWhlOEq7pUFxRLbhpquaAHSOjmIcWnVpw\n" +
-                    "9BsO7qe46hidgn39hKh1WjKK2VcL/3YRsC4wUi0PBtFW6ScMCuMhgIRXSPU55Rae\n" +
-                    "UIlOdPjjr1SUNWGId1rD7W16Scpwnknn310FNxFMHVI0GTGFkNdkilNCFJcIoRA=\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIESzCCAzOgAwIBAgIJAIz+EYMBU6aTMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1NDIxNVoXDTI4MTEwNTE1NDIxNVowgakx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEVMBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkB\n"
+        + "FhZqdWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n"
+        + "MIIBCgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjU\n"
+        + "g4pNjYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQc\n"
+        + "wHf0ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t\n"
+        + "7iu1JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAn\n"
+        + "AxK6q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArD\n"
+        + "qUYxqJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwG\n"
+        + "CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV\n"
+        + "HQ4EFgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLS\n"
+        + "rNuzA1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBALJ27i3okV/KvlDp6KMID3gd\n"
+        + "ITl68PyItzzx+SquF8gahMh016NX73z/oVZoVUNdftla8wPUB1GwIkAnGkhQ9LHK\n"
+        + "spBdbRiCj0gMmLCsX8SrjFvr7cYb2cK6J/fJe92l1tg/7Y4o7V/s4JBe/cy9U9w8\n"
+        + "a0ctuDmEBCgC784JMDtT67klRfr/2LlqWhlOEq7pUFxRLbhpquaAHSOjmIcWnVpw\n"
+        + "9BsO7qe46hidgn39hKh1WjKK2VcL/3YRsC4wUi0PBtFW6ScMCuMhgIRXSPU55Rae\n"
+        + "UIlOdPjjr1SUNWGId1rD7W16Scpwnknn310FNxFMHVI0GTGFkNdkilNCFJcIoRA=\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * CN=foo.com, subjectAlt=bar.com
      */
-    public final static byte[] X509_FOO_BAR = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIEXDCCA0SgAwIBAgIJAIz+EYMBU6aRMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzYyOVoXDTI4MTEwNTE1MzYyOVowgaQx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n" +
-                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
-                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
-                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
-                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
-                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
-                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
-                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCG\n" +
-                    "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n" +
-                    "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n" +
-                    "A1LKh6YNPg0wEgYDVR0RBAswCYIHYmFyLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEA\n" +
-                    "dQyprNZBmVnvuVWjV42sey/PTfkYShJwy1j0/jcFZR/ypZUovpiHGDO1DgL3Y3IP\n" +
-                    "zVQ26uhUsSw6G0gGRiaBDe/0LUclXZoJzXX1qpS55OadxW73brziS0sxRgGrZE/d\n" +
-                    "3g5kkio6IED47OP6wYnlmZ7EKP9cqjWwlnvHnnUcZ2SscoLNYs9rN9ccp8tuq2by\n" +
-                    "88OyhKwGjJfhOudqfTNZcDzRHx4Fzm7UsVaycVw4uDmhEHJrAsmMPpj/+XRK9/42\n" +
-                    "2xq+8bc6HojdtbCyug/fvBZvZqQXSmU8m8IVcMmWMz0ZQO8ee3QkBHMZfCy7P/kr\n" +
-                    "VbWx/uETImUu+NZg22ewEw==\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_FOO_BAR = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEXDCCA0SgAwIBAgIJAIz+EYMBU6aRMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzYyOVoXDTI4MTEwNTE1MzYyOVowgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCG\n"
+        + "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n"
+        + "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n"
+        + "A1LKh6YNPg0wEgYDVR0RBAswCYIHYmFyLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEA\n"
+        + "dQyprNZBmVnvuVWjV42sey/PTfkYShJwy1j0/jcFZR/ypZUovpiHGDO1DgL3Y3IP\n"
+        + "zVQ26uhUsSw6G0gGRiaBDe/0LUclXZoJzXX1qpS55OadxW73brziS0sxRgGrZE/d\n"
+        + "3g5kkio6IED47OP6wYnlmZ7EKP9cqjWwlnvHnnUcZ2SscoLNYs9rN9ccp8tuq2by\n"
+        + "88OyhKwGjJfhOudqfTNZcDzRHx4Fzm7UsVaycVw4uDmhEHJrAsmMPpj/+XRK9/42\n"
+        + "2xq+8bc6HojdtbCyug/fvBZvZqQXSmU8m8IVcMmWMz0ZQO8ee3QkBHMZfCy7P/kr\n"
+        + "VbWx/uETImUu+NZg22ewEw==\n" + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * CN=foo.com, subjectAlt=bar.com, subjectAlt=&#x82b1;&#x5b50;.co.jp
      * (hanako.co.jp in kanji)
      */
-    public final static byte[] X509_FOO_BAR_HANAKO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIEajCCA1KgAwIBAgIJAIz+EYMBU6aSMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzgxM1oXDTI4MTEwNTE1MzgxM1owgaQx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n" +
-                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
-                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
-                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
-                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
-                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
-                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
-                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBnjCBmzAJBgNVHRMEAjAAMCwGCWCG\n" +
-                    "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n" +
-                    "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n" +
-                    "A1LKh6YNPg0wIAYDVR0RBBkwF4IHYmFyLmNvbYIM6Iqx5a2QLmNvLmpwMA0GCSqG\n" +
-                    "SIb3DQEBBQUAA4IBAQBeZs7ZIYyKtdnVxVvdLgwySEPOE4pBSXii7XYv0Q9QUvG/\n" +
-                    "++gFGQh89HhABzA1mVUjH5dJTQqSLFvRfqTHqLpxSxSWqMHnvRM4cPBkIRp/XlMK\n" +
-                    "PlXadYtJLPTgpbgvulA1ickC9EwlNYWnowZ4uxnfsMghW4HskBqaV+PnQ8Zvy3L0\n" +
-                    "12c7Cg4mKKS5pb1HdRuiD2opZ+Hc77gRQLvtWNS8jQvd/iTbh6fuvTKfAOFoXw22\n" +
-                    "sWIKHYrmhCIRshUNohGXv50m2o+1w9oWmQ6Dkq7lCjfXfUB4wIbggJjpyEtbNqBt\n" +
-                    "j4MC2x5rfsLKKqToKmNE7pFEgqwe8//Aar1b+Qj+\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_FOO_BAR_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEajCCA1KgAwIBAgIJAIz+EYMBU6aSMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzgxM1oXDTI4MTEwNTE1MzgxM1owgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBnjCBmzAJBgNVHRMEAjAAMCwGCWCG\n"
+        + "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n"
+        + "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n"
+        + "A1LKh6YNPg0wIAYDVR0RBBkwF4IHYmFyLmNvbYIM6Iqx5a2QLmNvLmpwMA0GCSqG\n"
+        + "SIb3DQEBBQUAA4IBAQBeZs7ZIYyKtdnVxVvdLgwySEPOE4pBSXii7XYv0Q9QUvG/\n"
+        + "++gFGQh89HhABzA1mVUjH5dJTQqSLFvRfqTHqLpxSxSWqMHnvRM4cPBkIRp/XlMK\n"
+        + "PlXadYtJLPTgpbgvulA1ickC9EwlNYWnowZ4uxnfsMghW4HskBqaV+PnQ8Zvy3L0\n"
+        + "12c7Cg4mKKS5pb1HdRuiD2opZ+Hc77gRQLvtWNS8jQvd/iTbh6fuvTKfAOFoXw22\n"
+        + "sWIKHYrmhCIRshUNohGXv50m2o+1w9oWmQ6Dkq7lCjfXfUB4wIbggJjpyEtbNqBt\n"
+        + "j4MC2x5rfsLKKqToKmNE7pFEgqwe8//Aar1b+Qj+\n" + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * CN=*.foo.com
      */
-    public final static byte[] X509_WILD_FOO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIESDCCAzCgAwIBAgIJAIz+EYMBU6aUMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTU1NVoXDTI4MTEwNTE2MTU1NVowgaYx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n" +
-                    "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n" +
-                    "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n" +
-                    "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n" +
-                    "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n" +
-                    "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n" +
-                    "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n" +
-                    "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG\n" +
-                    "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n" +
-                    "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n" +
-                    "A1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBAH0ipG6J561UKUfgkeW7GvYwW98B\n" +
-                    "N1ZooWX+JEEZK7+Pf/96d3Ij0rw9ACfN4bpfnCq0VUNZVSYB+GthQ2zYuz7tf/UY\n" +
-                    "A6nxVgR/IjG69BmsBl92uFO7JTNtHztuiPqBn59pt+vNx4yPvno7zmxsfI7jv0ww\n" +
-                    "yfs+0FNm7FwdsC1k47GBSOaGw38kuIVWqXSAbL4EX9GkryGGOKGNh0qvAENCdRSB\n" +
-                    "G9Z6tyMbmfRY+dLSh3a9JwoEcBUso6EWYBakLbq4nG/nvYdYvG9ehrnLVwZFL82e\n" +
-                    "l3Q/RK95bnA6cuRClGusLad0e6bjkBzx/VQ3VarDEpAkTLUGVAa0CLXtnyc=\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_WILD_FOO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIESDCCAzCgAwIBAgIJAIz+EYMBU6aUMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTU1NVoXDTI4MTEwNTE2MTU1NVowgaYx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n"
+        + "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+        + "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n"
+        + "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n"
+        + "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n"
+        + "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n"
+        + "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n"
+        + "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG\n"
+        + "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n"
+        + "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n"
+        + "A1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBAH0ipG6J561UKUfgkeW7GvYwW98B\n"
+        + "N1ZooWX+JEEZK7+Pf/96d3Ij0rw9ACfN4bpfnCq0VUNZVSYB+GthQ2zYuz7tf/UY\n"
+        + "A6nxVgR/IjG69BmsBl92uFO7JTNtHztuiPqBn59pt+vNx4yPvno7zmxsfI7jv0ww\n"
+        + "yfs+0FNm7FwdsC1k47GBSOaGw38kuIVWqXSAbL4EX9GkryGGOKGNh0qvAENCdRSB\n"
+        + "G9Z6tyMbmfRY+dLSh3a9JwoEcBUso6EWYBakLbq4nG/nvYdYvG9ehrnLVwZFL82e\n"
+        + "l3Q/RK95bnA6cuRClGusLad0e6bjkBzx/VQ3VarDEpAkTLUGVAa0CLXtnyc=\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * CN=*.co.jp
      */
-    public final static byte[] X509_WILD_CO_JP = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aVMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTYzMFoXDTI4MTEwNTE2MTYzMFowgaQx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczEQMA4GA1UEAxQHKi5jby5qcDElMCMGCSqGSIb3DQEJARYWanVs\n" +
-                    "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n" +
-                    "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n" +
-                    "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n" +
-                    "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n" +
-                    "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n" +
-                    "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n" +
-                    "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n" +
-                    "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n" +
-                    "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n" +
-                    "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQA0sWglVlMx2zNGvUqFC73XtREwii53\n" +
-                    "CfMM6mtf2+f3k/d8KXhLNySrg8RRlN11zgmpPaLtbdTLrmG4UdAHHYr8O4y2BBmE\n" +
-                    "1cxNfGxxechgF8HX10QV4dkyzp6Z1cfwvCeMrT5G/V1pejago0ayXx+GPLbWlNeZ\n" +
-                    "S+Kl0m3p+QplXujtwG5fYcIpaGpiYraBLx3Tadih39QN65CnAh/zRDhLCUzKyt9l\n" +
-                    "UGPLEUDzRHMPHLnSqT1n5UU5UDRytbjJPXzF+l/+WZIsanefWLsxnkgAuZe/oMMF\n" +
-                    "EJMryEzOjg4Tfuc5qM0EXoPcQ/JlheaxZ40p2IyHqbsWV4MRYuFH4bkM\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_WILD_CO_JP = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aVMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTYzMFoXDTI4MTEwNTE2MTYzMFowgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxQHKi5jby5qcDElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n"
+        + "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n"
+        + "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n"
+        + "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQA0sWglVlMx2zNGvUqFC73XtREwii53\n"
+        + "CfMM6mtf2+f3k/d8KXhLNySrg8RRlN11zgmpPaLtbdTLrmG4UdAHHYr8O4y2BBmE\n"
+        + "1cxNfGxxechgF8HX10QV4dkyzp6Z1cfwvCeMrT5G/V1pejago0ayXx+GPLbWlNeZ\n"
+        + "S+Kl0m3p+QplXujtwG5fYcIpaGpiYraBLx3Tadih39QN65CnAh/zRDhLCUzKyt9l\n"
+        + "UGPLEUDzRHMPHLnSqT1n5UU5UDRytbjJPXzF+l/+WZIsanefWLsxnkgAuZe/oMMF\n"
+        + "EJMryEzOjg4Tfuc5qM0EXoPcQ/JlheaxZ40p2IyHqbsWV4MRYuFH4bkM\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * CN=*.foo.com, subjectAlt=*.bar.com, subjectAlt=*.&#x82b1;&#x5b50;.co.jp
      * (*.hanako.co.jp in kanji)
      */
-    public final static byte[] X509_WILD_FOO_BAR_HANAKO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIEcDCCA1igAwIBAgIJAIz+EYMBU6aWMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTczMVoXDTI4MTEwNTE2MTczMVowgaYx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n" +
-                    "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n" +
-                    "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n" +
-                    "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n" +
-                    "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n" +
-                    "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n" +
-                    "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n" +
-                    "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo4GiMIGfMAkGA1UdEwQCMAAwLAYJ\n" +
-                    "YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud\n" +
-                    "DgQWBBSfFHe/Pzq2yjiCQkgWLNrQy16H2DAfBgNVHSMEGDAWgBR7mtqPkJlOUtKs\n" +
-                    "27MDUsqHpg0+DTAkBgNVHREEHTAbggkqLmJhci5jb22CDiou6Iqx5a2QLmNvLmpw\n" +
-                    "MA0GCSqGSIb3DQEBBQUAA4IBAQBobWC+D5/lx6YhX64CwZ26XLjxaE0S415ajbBq\n" +
-                    "DK7lz+Rg7zOE3GsTAMi+ldUYnhyz0wDiXB8UwKXl0SDToB2Z4GOgqQjAqoMmrP0u\n" +
-                    "WB6Y6dpkfd1qDRUzI120zPYgSdsXjHW9q2H77iV238hqIU7qCvEz+lfqqWEY504z\n" +
-                    "hYNlknbUnR525ItosEVwXFBJTkZ3Yw8gg02c19yi8TAh5Li3Ad8XQmmSJMWBV4XK\n" +
-                    "qFr0AIZKBlg6NZZFf/0dP9zcKhzSriW27bY0XfzA6GSiRDXrDjgXq6baRT6YwgIg\n" +
-                    "pgJsDbJtZfHnV1nd3M6zOtQPm1TIQpNmMMMd/DPrGcUQerD3\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_WILD_FOO_BAR_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEcDCCA1igAwIBAgIJAIz+EYMBU6aWMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTczMVoXDTI4MTEwNTE2MTczMVowgaYx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n"
+        + "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+        + "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n"
+        + "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n"
+        + "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n"
+        + "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n"
+        + "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n"
+        + "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo4GiMIGfMAkGA1UdEwQCMAAwLAYJ\n"
+        + "YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud\n"
+        + "DgQWBBSfFHe/Pzq2yjiCQkgWLNrQy16H2DAfBgNVHSMEGDAWgBR7mtqPkJlOUtKs\n"
+        + "27MDUsqHpg0+DTAkBgNVHREEHTAbggkqLmJhci5jb22CDiou6Iqx5a2QLmNvLmpw\n"
+        + "MA0GCSqGSIb3DQEBBQUAA4IBAQBobWC+D5/lx6YhX64CwZ26XLjxaE0S415ajbBq\n"
+        + "DK7lz+Rg7zOE3GsTAMi+ldUYnhyz0wDiXB8UwKXl0SDToB2Z4GOgqQjAqoMmrP0u\n"
+        + "WB6Y6dpkfd1qDRUzI120zPYgSdsXjHW9q2H77iV238hqIU7qCvEz+lfqqWEY504z\n"
+        + "hYNlknbUnR525ItosEVwXFBJTkZ3Yw8gg02c19yi8TAh5Li3Ad8XQmmSJMWBV4XK\n"
+        + "qFr0AIZKBlg6NZZFf/0dP9zcKhzSriW27bY0XfzA6GSiRDXrDjgXq6baRT6YwgIg\n"
+        + "pgJsDbJtZfHnV1nd3M6zOtQPm1TIQpNmMMMd/DPrGcUQerD3\n" + "-----END CERTIFICATE-----\n")
+        .getBytes();
 
     /**
      * CN=foo.com, CN=bar.com, CN=&#x82b1;&#x5b50;.co.jp
      */
-    public final static byte[] X509_THREE_CNS_FOO_BAR_HANAKO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIEbzCCA1egAwIBAgIJAIz+EYMBU6aXMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTk0NVoXDTI4MTEwNTE2MTk0NVowgc0x\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczEQMA4GA1UEAwwHZm9vLmNvbTEQMA4GA1UEAwwHYmFyLmNvbTEV\n" +
-                    "MBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyGOv\n" +
-                    "loI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pNjYGViGjg7zhf\n" +
-                    "bjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0ZHLN6sD9m2uV\n" +
-                    "Sp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1JVjTuE0pcBva\n" +
-                    "h2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6q/wGqcZ3zvFB\n" +
-                    "TcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYxqJUlPGlMqrKb\n" +
-                    "3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf\n" +
-                    "Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86\n" +
-                    "tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0w\n" +
-                    "DQYJKoZIhvcNAQEFBQADggEBAGuZb8ai1NO2j4v3y9TLZvd5s0vh5/TE7n7RX+8U\n" +
-                    "y37OL5k7x9nt0mM1TyAKxlCcY+9h6frue8MemZIILSIvMrtzccqNz0V1WKgA+Orf\n" +
-                    "uUrabmn+CxHF5gpy6g1Qs2IjVYWA5f7FROn/J+Ad8gJYc1azOWCLQqSyfpNRLSvY\n" +
-                    "EriQFEV63XvkJ8JrG62b+2OT2lqT4OO07gSPetppdlSa8NBSKP6Aro9RIX1ZjUZQ\n" +
-                    "SpQFCfo02NO0uNRDPUdJx2huycdNb+AXHaO7eXevDLJ+QnqImIzxWiY6zLOdzjjI\n" +
-                    "VBMkLHmnP7SjGSQ3XA4ByrQOxfOUTyLyE7NuemhHppuQPxE=\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_THREE_CNS_FOO_BAR_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEbzCCA1egAwIBAgIJAIz+EYMBU6aXMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTk0NVoXDTI4MTEwNTE2MTk0NVowgc0x\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAwwHZm9vLmNvbTEQMA4GA1UEAwwHYmFyLmNvbTEV\n"
+        + "MBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyGOv\n"
+        + "loI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pNjYGViGjg7zhf\n"
+        + "bjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0ZHLN6sD9m2uV\n"
+        + "Sp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1JVjTuE0pcBva\n"
+        + "h2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6q/wGqcZ3zvFB\n"
+        + "TcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYxqJUlPGlMqrKb\n"
+        + "3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf\n"
+        + "Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86\n"
+        + "tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0w\n"
+        + "DQYJKoZIhvcNAQEFBQADggEBAGuZb8ai1NO2j4v3y9TLZvd5s0vh5/TE7n7RX+8U\n"
+        + "y37OL5k7x9nt0mM1TyAKxlCcY+9h6frue8MemZIILSIvMrtzccqNz0V1WKgA+Orf\n"
+        + "uUrabmn+CxHF5gpy6g1Qs2IjVYWA5f7FROn/J+Ad8gJYc1azOWCLQqSyfpNRLSvY\n"
+        + "EriQFEV63XvkJ8JrG62b+2OT2lqT4OO07gSPetppdlSa8NBSKP6Aro9RIX1ZjUZQ\n"
+        + "SpQFCfo02NO0uNRDPUdJx2huycdNb+AXHaO7eXevDLJ+QnqImIzxWiY6zLOdzjjI\n"
+        + "VBMkLHmnP7SjGSQ3XA4ByrQOxfOUTyLyE7NuemhHppuQPxE=\n" + "-----END CERTIFICATE-----\n")
+        .getBytes();
 
     /**
      * subjectAlt=foo.com
      */
-    public final static byte[] X509_NO_CNS_FOO = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIESjCCAzKgAwIBAgIJAIz+EYMBU6aYMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n" +
-                    "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n" +
-                    "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n" +
-                    "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MjYxMFoXDTI4MTEwNTE2MjYxMFowgZIx\n" +
-                    "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n" +
-                    "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n" +
-                    "cnRpZmljYXRlczElMCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNv\n" +
-                    "bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhjr5aCPoyp0R1iroWA\n" +
-                    "fnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2BlYho4O84X244QrZTRl8kQbYt\n" +
-                    "xnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRyzerA/ZtrlUqf+lKo0uWcocxe\n" +
-                    "Rc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY07hNKXAb2odnVqgzcYiDkLV8\n" +
-                    "ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8BqnGd87xQU3FVZI4tbtkB+Kz\n" +
-                    "jD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiVJTxpTKqym93whYk93l3ocEe5\n" +
-                    "5c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM\n" +
-                    "IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86tso4gkJIFiza\n" +
-                    "0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0wEgYDVR0RBAsw\n" +
-                    "CYIHZm9vLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEAjl78oMjzFdsMy6F1sGg/IkO8\n" +
-                    "tF5yUgPgFYrs41yzAca7IQu6G9qtFDJz/7ehh/9HoG+oqCCIHPuIOmS7Sd0wnkyJ\n" +
-                    "Y7Y04jVXIb3a6f6AgBkEFP1nOT0z6kjT7vkA5LJ2y3MiDcXuRNMSta5PYVnrX8aZ\n" +
-                    "yiqVUNi40peuZ2R8mAUSBvWgD7z2qWhF8YgDb7wWaFjg53I36vWKn90ZEti3wNCw\n" +
-                    "qAVqixM+J0qJmQStgAc53i2aTMvAQu3A3snvH/PHTBo+5UL72n9S1kZyNCsVf1Qo\n" +
-                    "n8jKTiRriEM+fMFlcgQP284EBFzYHyCXFb9O/hMjK2+6mY9euMB1U1aFFzM/Bg==\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_NO_CNS_FOO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIESjCCAzKgAwIBAgIJAIz+EYMBU6aYMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MjYxMFoXDTI4MTEwNTE2MjYxMFowgZIx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczElMCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNv\n"
+        + "bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhjr5aCPoyp0R1iroWA\n"
+        + "fnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2BlYho4O84X244QrZTRl8kQbYt\n"
+        + "xnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRyzerA/ZtrlUqf+lKo0uWcocxe\n"
+        + "Rc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY07hNKXAb2odnVqgzcYiDkLV8\n"
+        + "ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8BqnGd87xQU3FVZI4tbtkB+Kz\n"
+        + "jD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiVJTxpTKqym93whYk93l3ocEe5\n"
+        + "5c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM\n"
+        + "IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86tso4gkJIFiza\n"
+        + "0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0wEgYDVR0RBAsw\n"
+        + "CYIHZm9vLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEAjl78oMjzFdsMy6F1sGg/IkO8\n"
+        + "tF5yUgPgFYrs41yzAca7IQu6G9qtFDJz/7ehh/9HoG+oqCCIHPuIOmS7Sd0wnkyJ\n"
+        + "Y7Y04jVXIb3a6f6AgBkEFP1nOT0z6kjT7vkA5LJ2y3MiDcXuRNMSta5PYVnrX8aZ\n"
+        + "yiqVUNi40peuZ2R8mAUSBvWgD7z2qWhF8YgDb7wWaFjg53I36vWKn90ZEti3wNCw\n"
+        + "qAVqixM+J0qJmQStgAc53i2aTMvAQu3A3snvH/PHTBo+5UL72n9S1kZyNCsVf1Qo\n"
+        + "n8jKTiRriEM+fMFlcgQP284EBFzYHyCXFb9O/hMjK2+6mY9euMB1U1aFFzM/Bg==\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * Intermediate CA for all of these.
      */
-    public final static byte[] X509_INTERMEDIATE_CA = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIEnDCCA4SgAwIBAgIJAJTNwZ6yNa5cMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n" +
-                    "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n" +
-                    "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjE0OTMx\n" +
-                    "WhcNMDcxMTA1MjE0OTMxWjCBojELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRIw\n" +
-                    "EAYDVQQHEwlWYW5jb3V2ZXIxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDASBgNV\n" +
-                    "BAsUC2NvbW1vbnNfc3NsMR0wGwYDVQQDFBRkZW1vX2ludGVybWVkaWF0ZV9jYTEl\n" +
-                    "MCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZI\n" +
-                    "hvcNAQEBBQADggEPADCCAQoCggEBAL0S4y3vUO0EM6lwqOEfK8fvrUprIbsikXaG\n" +
-                    "XzejcZ+T3l2Dc7t8WtBfRf78i4JypMqJQSijrUicj3H6mOMIReKaXm6ls4hA5d8w\n" +
-                    "Lhmgiqsz/kW+gA8SeWGWRN683BD/RbQmzOls6ynBvap9jZlthXWBrSIlPCQoBLXY\n" +
-                    "KVaxGzbL4ezaq+XFMKMQSm2uKwVmHHQNbfmZlPsuendBVomb/ked53Ab9IH6dwwN\n" +
-                    "qJH9WIrvIzIVEXWlpvQ5MCqozM7u1akU+G8cazr8theGPCaYkzoXnigWua4OjdpV\n" +
-                    "9z5ZDknhfBzG1AjapdG07FIirwWWgIyZXqZSD96ikmLtwT29qnsCAwEAAaOB7jCB\n" +
-                    "6zAdBgNVHQ4EFgQUe5raj5CZTlLSrNuzA1LKh6YNPg0wgbsGA1UdIwSBszCBsIAU\n" +
-                    "rN8eFIvMiRFXXgDqKumS0/W2AhOhgYykgYkwgYYxCzAJBgNVBAYTAkNBMQswCQYD\n" +
-                    "VQQIEwJCQzEWMBQGA1UEChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9u\n" +
-                    "c19zc2wxFTATBgNVBAMUDGRlbW9fcm9vdF9jYTElMCMGCSqGSIb3DQEJARYWanVs\n" +
-                    "aXVzZGF2aWVzQGdtYWlsLmNvbYIJAJTNwZ6yNa5bMAwGA1UdEwQFMAMBAf8wDQYJ\n" +
-                    "KoZIhvcNAQEFBQADggEBAIB4KMZvHD20pdKajFtMBpL7X4W4soq6EeTtjml3NYa9\n" +
-                    "Qc52bsQEGNccKY9afYSBIndaQvFdtmz6HdoN+B8TjYShw2KhyjtKimGLpWYoi1YF\n" +
-                    "e4aHdmA/Gp5xk8pZzR18FmooxC9RqBux+NAM2iTFSLgDtGIIj4sg2rbn6Bb6ZlQT\n" +
-                    "1rg6VucXCA1629lNfMeNcu7CBNmUKIdaxHR/YJQallE0KfGRiOIWPrPj/VNk0YA6\n" +
-                    "XFg0ocjqXJ2/N0N9rWVshMUaXgOh7m4D/5zga5/nuxDU+PoToA6mQ4bV6eCYqZbh\n" +
-                    "aa1kQYtR9B4ZiG6pB82qVc2dCqStOH2FAEWos2gAVkQ=\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_INTERMEDIATE_CA = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEnDCCA4SgAwIBAgIJAJTNwZ6yNa5cMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n"
+        + "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n"
+        + "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjE0OTMx\n"
+        + "WhcNMDcxMTA1MjE0OTMxWjCBojELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRIw\n"
+        + "EAYDVQQHEwlWYW5jb3V2ZXIxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDASBgNV\n"
+        + "BAsUC2NvbW1vbnNfc3NsMR0wGwYDVQQDFBRkZW1vX2ludGVybWVkaWF0ZV9jYTEl\n"
+        + "MCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZI\n"
+        + "hvcNAQEBBQADggEPADCCAQoCggEBAL0S4y3vUO0EM6lwqOEfK8fvrUprIbsikXaG\n"
+        + "XzejcZ+T3l2Dc7t8WtBfRf78i4JypMqJQSijrUicj3H6mOMIReKaXm6ls4hA5d8w\n"
+        + "Lhmgiqsz/kW+gA8SeWGWRN683BD/RbQmzOls6ynBvap9jZlthXWBrSIlPCQoBLXY\n"
+        + "KVaxGzbL4ezaq+XFMKMQSm2uKwVmHHQNbfmZlPsuendBVomb/ked53Ab9IH6dwwN\n"
+        + "qJH9WIrvIzIVEXWlpvQ5MCqozM7u1akU+G8cazr8theGPCaYkzoXnigWua4OjdpV\n"
+        + "9z5ZDknhfBzG1AjapdG07FIirwWWgIyZXqZSD96ikmLtwT29qnsCAwEAAaOB7jCB\n"
+        + "6zAdBgNVHQ4EFgQUe5raj5CZTlLSrNuzA1LKh6YNPg0wgbsGA1UdIwSBszCBsIAU\n"
+        + "rN8eFIvMiRFXXgDqKumS0/W2AhOhgYykgYkwgYYxCzAJBgNVBAYTAkNBMQswCQYD\n"
+        + "VQQIEwJCQzEWMBQGA1UEChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9u\n"
+        + "c19zc2wxFTATBgNVBAMUDGRlbW9fcm9vdF9jYTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbYIJAJTNwZ6yNa5bMAwGA1UdEwQFMAMBAf8wDQYJ\n"
+        + "KoZIhvcNAQEFBQADggEBAIB4KMZvHD20pdKajFtMBpL7X4W4soq6EeTtjml3NYa9\n"
+        + "Qc52bsQEGNccKY9afYSBIndaQvFdtmz6HdoN+B8TjYShw2KhyjtKimGLpWYoi1YF\n"
+        + "e4aHdmA/Gp5xk8pZzR18FmooxC9RqBux+NAM2iTFSLgDtGIIj4sg2rbn6Bb6ZlQT\n"
+        + "1rg6VucXCA1629lNfMeNcu7CBNmUKIdaxHR/YJQallE0KfGRiOIWPrPj/VNk0YA6\n"
+        + "XFg0ocjqXJ2/N0N9rWVshMUaXgOh7m4D/5zga5/nuxDU+PoToA6mQ4bV6eCYqZbh\n"
+        + "aa1kQYtR9B4ZiG6pB82qVc2dCqStOH2FAEWos2gAVkQ=\n" + "-----END CERTIFICATE-----\n")
+        .getBytes();
 
     /**
      * Root CA for all of these.
      */
-    public final static byte[] X509_ROOT_CA = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIEgDCCA2igAwIBAgIJAJTNwZ6yNa5bMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n" +
-                    "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n" +
-                    "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n" +
-                    "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjEzNjQz\n" +
-                    "WhcNMjYxMTA1MjEzNjQzWjCBhjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYw\n" +
-                    "FAYDVQQKEw13d3cuY3VjYmMuY29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMG\n" +
-                    "A1UEAxQMZGVtb19yb290X2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNA\n" +
-                    "Z21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv+OnocmJ\n" +
-                    "79UeO2hlCwK+Cle5uZWnU6uwJl+08z5cvebb5tT64WL9+psDbfgUH/Gm9JsuxKTg\n" +
-                    "w1tZO/4duIgnaLNSx4HoqaTjwigd/hR3TsoGEPXTCkz1ikgTCOEDvl+iMid6aOrd\n" +
-                    "mViE8HhscxKZ+h5FE7oHZyuT6gFoiaIXhFq+xK2w4ZwDz9L+paiwqywyUJJMnh9U\n" +
-                    "jKorY+nua81N0oxpIhHPspCanDU4neMzCzYOZyLR/LqV5xORvHcFY84GWMz5hI25\n" +
-                    "JbgaWJsYKuCAvNsnQwVoqKPGa7x1fn7x6oGsXJaCVt8weUwIj2xwg1lxMhrNaisH\n" +
-                    "EvKpEAEnGGwWKQIDAQABo4HuMIHrMB0GA1UdDgQWBBSs3x4Ui8yJEVdeAOoq6ZLT\n" +
-                    "9bYCEzCBuwYDVR0jBIGzMIGwgBSs3x4Ui8yJEVdeAOoq6ZLT9bYCE6GBjKSBiTCB\n" +
-                    "hjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYwFAYDVQQKEw13d3cuY3VjYmMu\n" +
-                    "Y29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMGA1UEAxQMZGVtb19yb290X2Nh\n" +
-                    "MSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNAZ21haWwuY29tggkAlM3BnrI1\n" +
-                    "rlswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAlPl3/8h1LttR1svC\n" +
-                    "S8RXbHpAWIT2BEDhGHUNjSmgDQNkE/itf/FCEXh0tlU4bYdtBSOHzflbnzOyIPId\n" +
-                    "VZeSWs33V38xDFy6KoVg1gT8JxkLmE5S1vWkpsHIlpw/U6r7KD0Kx9FYx5AiXjw0\n" +
-                    "lzz/zlVNuO2U09KIDwDPVG1mBzQiMiSWj1U1pM4KxINkWQwDy/fvu/I983s8lW5z\n" +
-                    "hf2WuFNzQN3fcMK5dpBE9NVIu27oYuGYh2sak34v+7T700W2ooBB71qFXtm9P5rl\n" +
-                    "Yp9RCEsg3KEEPNTtCBs8fROeXvLDrP0cmBIqwGYDuRNCxFDTOdjv6YGdA8nLOjaH\n" +
-                    "2dDk0g==\n" +
-                    "-----END CERTIFICATE-----\n").getBytes();
+    public static final byte[] X509_ROOT_CA = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEgDCCA2igAwIBAgIJAJTNwZ6yNa5bMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n"
+        + "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n"
+        + "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjEzNjQz\n"
+        + "WhcNMjYxMTA1MjEzNjQzWjCBhjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYw\n"
+        + "FAYDVQQKEw13d3cuY3VjYmMuY29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMG\n"
+        + "A1UEAxQMZGVtb19yb290X2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNA\n"
+        + "Z21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv+OnocmJ\n"
+        + "79UeO2hlCwK+Cle5uZWnU6uwJl+08z5cvebb5tT64WL9+psDbfgUH/Gm9JsuxKTg\n"
+        + "w1tZO/4duIgnaLNSx4HoqaTjwigd/hR3TsoGEPXTCkz1ikgTCOEDvl+iMid6aOrd\n"
+        + "mViE8HhscxKZ+h5FE7oHZyuT6gFoiaIXhFq+xK2w4ZwDz9L+paiwqywyUJJMnh9U\n"
+        + "jKorY+nua81N0oxpIhHPspCanDU4neMzCzYOZyLR/LqV5xORvHcFY84GWMz5hI25\n"
+        + "JbgaWJsYKuCAvNsnQwVoqKPGa7x1fn7x6oGsXJaCVt8weUwIj2xwg1lxMhrNaisH\n"
+        + "EvKpEAEnGGwWKQIDAQABo4HuMIHrMB0GA1UdDgQWBBSs3x4Ui8yJEVdeAOoq6ZLT\n"
+        + "9bYCEzCBuwYDVR0jBIGzMIGwgBSs3x4Ui8yJEVdeAOoq6ZLT9bYCE6GBjKSBiTCB\n"
+        + "hjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYwFAYDVQQKEw13d3cuY3VjYmMu\n"
+        + "Y29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMGA1UEAxQMZGVtb19yb290X2Nh\n"
+        + "MSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNAZ21haWwuY29tggkAlM3BnrI1\n"
+        + "rlswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAlPl3/8h1LttR1svC\n"
+        + "S8RXbHpAWIT2BEDhGHUNjSmgDQNkE/itf/FCEXh0tlU4bYdtBSOHzflbnzOyIPId\n"
+        + "VZeSWs33V38xDFy6KoVg1gT8JxkLmE5S1vWkpsHIlpw/U6r7KD0Kx9FYx5AiXjw0\n"
+        + "lzz/zlVNuO2U09KIDwDPVG1mBzQiMiSWj1U1pM4KxINkWQwDy/fvu/I983s8lW5z\n"
+        + "hf2WuFNzQN3fcMK5dpBE9NVIu27oYuGYh2sak34v+7T700W2ooBB71qFXtm9P5rl\n"
+        + "Yp9RCEsg3KEEPNTtCBs8fROeXvLDrP0cmBIqwGYDuRNCxFDTOdjv6YGdA8nLOjaH\n" + "2dDk0g==\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
 
     /**
      * Below is the private key for all the server certificates above (but
      * not the intermediate CA or the root CA).  All of those server certs
      * came from the same private key.
      */
-    public final static String RSA_PUBLIC_MODULUS =
-            "00c863af96823e8ca9d11d62ae85807e713204c1985a80a2747f7ac863c5" +
-                    "8d82e8c1ecf9698298d4838a4d8d81958868e0ef385f6e3842b653465f24" +
-                    "41b62dc671a1e204820fe67c82367f80cbcb52586a39bf965cf0141cc077" +
-                    "f46472cdeac0fd9b6b954a9ffa52a8d2e59ca1cc5e45cefbd4a37c70f1f7" +
-                    "9c7674ad5d07c78640672e94e31c4e6dee2bb52558d3b84d29701bda8767" +
-                    "56a83371888390b57c8a5bc49a8356316ae9f1406a913729121621098a77" +
-                    "713920270312baabfc06a9c677cef1414dc5559238b5bb6407e2b38c3f73" +
-                    "cfc4020c901f0e3647474dca350e66c4e817c31c0ac3a94631a895253c69" +
-                    "4caab29bddf085893dde5de87047b9e5cd";
+    public static final String RSA_PUBLIC_MODULUS =
+        "00c863af96823e8ca9d11d62ae85807e713204c1985a80a2747f7ac863c5"
+            + "8d82e8c1ecf9698298d4838a4d8d81958868e0ef385f6e3842b653465f24"
+            + "41b62dc671a1e204820fe67c82367f80cbcb52586a39bf965cf0141cc077"
+            + "f46472cdeac0fd9b6b954a9ffa52a8d2e59ca1cc5e45cefbd4a37c70f1f7"
+            + "9c7674ad5d07c78640672e94e31c4e6dee2bb52558d3b84d29701bda8767"
+            + "56a83371888390b57c8a5bc49a8356316ae9f1406a913729121621098a77"
+            + "713920270312baabfc06a9c677cef1414dc5559238b5bb6407e2b38c3f73"
+            + "cfc4020c901f0e3647474dca350e66c4e817c31c0ac3a94631a895253c69"
+            + "4caab29bddf085893dde5de87047b9e5cd";
 
-    public final static String RSA_PUBLIC_EXPONENT = "65537";
+    public static final String RSA_PUBLIC_EXPONENT = "65537";
 
-    public final static String RSA_PRIVATE_EXPONENT =
-            "577abd3295553d0efd4d38c13b62a6d03fa7b7e40cce4f1d5071877d96c6" +
-                    "7a39a63f0f7ab21a89db8acae45587b3ef251309a70f74dc1ac02bde68f3" +
-                    "8ed658e54e685ed370a18c054449512ea66a2252ed36e82b565b5159ec83" +
-                    "f23df40ae189550a183865b25fd77789e960f0d8cedcd72f32d7a66edb4b" +
-                    "a0a2baf3fbeb6c7d75f56ef0af9a7cff1c8c7f297d72eae7982164e50a89" +
-                    "d450698cf598d39343201094241d2d180a95882a7111e58f4a5bdbc5c125" +
-                    "a967dd6ed9ec614c5853e88e4c71e8b682a7cf89cb1d82b6fe78cc865084" +
-                    "c8c5dfbb50c939df2b839c977b0245bfa3615e0592b527b1013d5b675ecb" +
-                    "44e6b355c1df581f50997175166eef39";
+    public static final String RSA_PRIVATE_EXPONENT =
+        "577abd3295553d0efd4d38c13b62a6d03fa7b7e40cce4f1d5071877d96c6"
+            + "7a39a63f0f7ab21a89db8acae45587b3ef251309a70f74dc1ac02bde68f3"
+            + "8ed658e54e685ed370a18c054449512ea66a2252ed36e82b565b5159ec83"
+            + "f23df40ae189550a183865b25fd77789e960f0d8cedcd72f32d7a66edb4b"
+            + "a0a2baf3fbeb6c7d75f56ef0af9a7cff1c8c7f297d72eae7982164e50a89"
+            + "d450698cf598d39343201094241d2d180a95882a7111e58f4a5bdbc5c125"
+            + "a967dd6ed9ec614c5853e88e4c71e8b682a7cf89cb1d82b6fe78cc865084"
+            + "c8c5dfbb50c939df2b839c977b0245bfa3615e0592b527b1013d5b675ecb"
+            + "44e6b355c1df581f50997175166eef39";
 
-    public final static String RSA_PRIME1 =
-            "00fe759c4f0ce8b763880215e82767e7a937297668f4e4b1e119c6b22a3c" +
-                    "a2c7b06c547d88d0aa45f645d7d3aeadaf7f8bc594deae0978529592977c" +
-                    "b1ff890f05033a9e9e15551cad9fbf9c41d12139ccd99c1c3ac7b2197eff" +
-                    "350d236bb900c1440953b64956e0a058ef824a2e16894af175177c77dbe1" +
-                    "fef7d8b532608d2513";
+    public static final String RSA_PRIME1 =
+        "00fe759c4f0ce8b763880215e82767e7a937297668f4e4b1e119c6b22a3c"
+            + "a2c7b06c547d88d0aa45f645d7d3aeadaf7f8bc594deae0978529592977c"
+            + "b1ff890f05033a9e9e15551cad9fbf9c41d12139ccd99c1c3ac7b2197eff"
+            + "350d236bb900c1440953b64956e0a058ef824a2e16894af175177c77dbe1" + "fef7d8b532608d2513";
 
-    public final static String RSA_PRIME2 =
-            "00c99a45878737a4cf73f9896680b75487f1b669b7686a6ba07103856f31" +
-                    "db668c2c440c44cdd116f708f631c37a9adf119f5b5cb58ffe3dc62e20af" +
-                    "af72693d936dc6bb3c5194996468389c1f094079b81522e94572b4ad7d39" +
-                    "529178e9b8ebaeb1f0fdd83b8731c5223f1dea125341d1d64917f6b1a6ae" +
-                    "c18d320510d79f859f";
+    public static final String RSA_PRIME2 =
+        "00c99a45878737a4cf73f9896680b75487f1b669b7686a6ba07103856f31"
+            + "db668c2c440c44cdd116f708f631c37a9adf119f5b5cb58ffe3dc62e20af"
+            + "af72693d936dc6bb3c5194996468389c1f094079b81522e94572b4ad7d39"
+            + "529178e9b8ebaeb1f0fdd83b8731c5223f1dea125341d1d64917f6b1a6ae" + "c18d320510d79f859f";
 
-    public final static String RSA_EXPONENT1 =
-            "029febf0d4cd41b7011c2465b4a259bd6118486464c247236f44a169d61e" +
-                    "47b9062508f674508d5031003ceabc57e714e600d71b2c75d5443db2da52" +
-                    "6bb45a374f0537c5a1aab3150764ce93cf386c84346a6bd01f6732e42075" +
-                    "c7a0e9e78a9e73b934e7d871d0f75673820089e129a1604438edcbbeb4e2" +
-                    "106467da112ce389";
+    public static final String RSA_EXPONENT1 =
+        "029febf0d4cd41b7011c2465b4a259bd6118486464c247236f44a169d61e"
+            + "47b9062508f674508d5031003ceabc57e714e600d71b2c75d5443db2da52"
+            + "6bb45a374f0537c5a1aab3150764ce93cf386c84346a6bd01f6732e42075"
+            + "c7a0e9e78a9e73b934e7d871d0f75673820089e129a1604438edcbbeb4e2" + "106467da112ce389";
 
-    public final static String RSA_EXPONENT2 =
-            "00827e76650c946afcd170038d32e1f8386ab00d6be78d830efe382e45d4" +
-                    "7ad4bd04e6231ee22e66740efbf52838134932c9f8c460cdccdec58a1424" +
-                    "4427859192fd6ab6c58b74e97941b0eaf577f2a11713af5e5952af3ae124" +
-                    "9a9a892e98410dfa2628d9af668a43b5302fb7d496c9b2fec69f595292b6" +
-                    "e997f079b0f6314eb7";
+    public static final String RSA_EXPONENT2 =
+        "00827e76650c946afcd170038d32e1f8386ab00d6be78d830efe382e45d4"
+            + "7ad4bd04e6231ee22e66740efbf52838134932c9f8c460cdccdec58a1424"
+            + "4427859192fd6ab6c58b74e97941b0eaf577f2a11713af5e5952af3ae124"
+            + "9a9a892e98410dfa2628d9af668a43b5302fb7d496c9b2fec69f595292b6" + "e997f079b0f6314eb7";
 
-    public final static String RSA_COEFFICIENT =
-            "00e6b62add350f1a2a8968903ff76c31cf703b0d7326c4a620aef01225b7" +
-                    "1640b3f2ec375208c5f7299863f6005b7799b6e529bb1133c8435bf5fdb5" +
-                    "a786f6cd8a19ee7094a384e6557c600a38845a0960ddbfd1df18d0af5740" +
-                    "001853788f1b5ccbf9affb4c52c9d2efdb8aab0183d86735b32737fb4e79" +
-                    "2b8a9c7d91c7d175ae";
+    public static final String RSA_COEFFICIENT =
+        "00e6b62add350f1a2a8968903ff76c31cf703b0d7326c4a620aef01225b7"
+            + "1640b3f2ec375208c5f7299863f6005b7799b6e529bb1133c8435bf5fdb5"
+            + "a786f6cd8a19ee7094a384e6557c600a38845a0960ddbfd1df18d0af5740"
+            + "001853788f1b5ccbf9affb4c52c9d2efdb8aab0183d86735b32737fb4e79" + "2b8a9c7d91c7d175ae";
 
     /**
      * subjectAlt=IP Address:127.0.0.1, email:oleg@ural.ru, DNS:localhost.localdomain
      */
-    public final static byte[] X509_MULTIPLE_SUBJECT_ALT = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIDcTCCAtqgAwIBAgIBATANBgkqhkiG9w0BAQUFADBAMQswCQYDVQQGEwJDSDEL\n" +
-                    "MAkGA1UECBMCWkgxDzANBgNVBAcTBlp1cmljaDETMBEGA1UEAxMKTXkgVGVzdCBD\n" +
-                    "QTAeFw0wODEwMzExMTU3NDVaFw0wOTEwMzExMTU3NDVaMGkxCzAJBgNVBAYTAkNI\n" +
-                    "MRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdV\n" +
-                    "bmtub3duMRAwDgYDVQQLEwdVbmtub3duMRIwEAYDVQQDEwlsb2NhbGhvc3QwggG4\n" +
-                    "MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/\n" +
-                    "gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQ\n" +
-                    "IsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZ\n" +
-                    "ndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5\n" +
-                    "eZSvu/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbh\n" +
-                    "PBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8G\n" +
-                    "kotmXoB7VSVkAUw7/s9JKgOBhQACgYEA6ogAb/YLM1Rz9AoXKW4LA70VtFf7Mqqp\n" +
-                    "divdu9f72WQc1vMKo1YMf3dQadkMfBYRvAAa1IXDnoiFCHhXnVRkWkoUBJyNebLB\n" +
-                    "N92CZc0RVFZiMFgQMEh8UldnvAIi4cBk0/YuN3BGl4MzmquVIGrFovdWGqeaveOu\n" +
-                    "Xcu4lKGJNiqjODA2MDQGA1UdEQQtMCuHBH8AAAGBDG9sZWdAdXJhbC5ydYIVbG9j\n" +
-                    "YWxob3N0LmxvY2FsZG9tYWluMA0GCSqGSIb3DQEBBQUAA4GBAIgEwIoCSRkU3O7K\n" +
-                    "USYaOYyfJB9hsvs6YpClvYXiQ/5kPGARP60pM62v4wC7wI9shEizokIAxY2+O3cC\n" +
-                    "vwuJhNYaa2FJMELIwRN3XES8X8R6JHWbPaRjaAAPhczuEd8SZYy8yiVLmJTgw0gH\n" +
-                    "BSW775NHlkjsscFVgXkNf0PobqJ9\n" +
-                    "-----END CERTIFICATE-----").getBytes();
+    public static final byte[] X509_MULTIPLE_SUBJECT_ALT = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIDcTCCAtqgAwIBAgIBATANBgkqhkiG9w0BAQUFADBAMQswCQYDVQQGEwJDSDEL\n"
+        + "MAkGA1UECBMCWkgxDzANBgNVBAcTBlp1cmljaDETMBEGA1UEAxMKTXkgVGVzdCBD\n"
+        + "QTAeFw0wODEwMzExMTU3NDVaFw0wOTEwMzExMTU3NDVaMGkxCzAJBgNVBAYTAkNI\n"
+        + "MRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdV\n"
+        + "bmtub3duMRAwDgYDVQQLEwdVbmtub3duMRIwEAYDVQQDEwlsb2NhbGhvc3QwggG4\n"
+        + "MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/\n"
+        + "gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQ\n"
+        + "IsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZ\n"
+        + "ndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5\n"
+        + "eZSvu/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbh\n"
+        + "PBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8G\n"
+        + "kotmXoB7VSVkAUw7/s9JKgOBhQACgYEA6ogAb/YLM1Rz9AoXKW4LA70VtFf7Mqqp\n"
+        + "divdu9f72WQc1vMKo1YMf3dQadkMfBYRvAAa1IXDnoiFCHhXnVRkWkoUBJyNebLB\n"
+        + "N92CZc0RVFZiMFgQMEh8UldnvAIi4cBk0/YuN3BGl4MzmquVIGrFovdWGqeaveOu\n"
+        + "Xcu4lKGJNiqjODA2MDQGA1UdEQQtMCuHBH8AAAGBDG9sZWdAdXJhbC5ydYIVbG9j\n"
+        + "YWxob3N0LmxvY2FsZG9tYWluMA0GCSqGSIb3DQEBBQUAA4GBAIgEwIoCSRkU3O7K\n"
+        + "USYaOYyfJB9hsvs6YpClvYXiQ/5kPGARP60pM62v4wC7wI9shEizokIAxY2+O3cC\n"
+        + "vwuJhNYaa2FJMELIwRN3XES8X8R6JHWbPaRjaAAPhczuEd8SZYy8yiVLmJTgw0gH\n"
+        + "BSW775NHlkjsscFVgXkNf0PobqJ9\n" + "-----END CERTIFICATE-----").getBytes();
 
     /**
      * subject CN=repository.infonotary.com (Multiple AVA in RDN).
      */
-    public final static byte[] X509_MULTIPLE_VALUE_AVA = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIFxzCCBK+gAwIBAgIIRO/2+/XA7z4wDQYJKoZIhvcNAQEFBQAwgZwxgZkwCQYD\n" +
-                    "VQQGDAJCRzAVBgNVBAoMDkluZm9Ob3RhcnkgUExDMBcGCgmSJomT8ixkARkWCWRv\n" +
-                    "bWFpbi1jYTAtBgNVBAMMJmktTm90YXJ5IFRydXN0UGF0aCBWYWxpZGF0ZWQgRG9t\n" +
-                    "YWluIENBMC0GA1UECwwmaS1Ob3RhcnkgVHJ1c3RQYXRoIFZhbGlkYXRlZCBEb21h\n" +
-                    "aW4gQ0EwHhcNMTIwNjE4MDg1MzIyWhcNMTMwNjE4MDg1MzIyWjCBxjGBwzAJBgNV\n" +
-                    "BAYTAkJHMBUGA1UEChMOSW5mb05vdGFyeSBQTEMwFwYDVQQLExBGaWxlcyBSZXBv\n" +
-                    "c2l0b3J5MBcGCgmSJomT8ixkARkWCWRvbWFpbi1jYTAgBgNVBAMTGXJlcG9zaXRv\n" +
-                    "cnkuaW5mb25vdGFyeS5jb20wIwYJKoZIhvcNAQkBFhZzdXBwb3J0QGluZm9ub3Rh\n" +
-                    "cnkuY29tMCYGCSqGSIb3DQEJAhMZcmVwb3NpdG9yeS5pbmZvbm90YXJ5LmNvbTCC\n" +
-                    "ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKWjGpgsuz103xVEW/GSg5I\n" +
-                    "tBoLbXPxockabOTHnOh0VO2sImycyhBH78nMj+VMexn4y+kdCOuJqAA5LApxyhTA\n" +
-                    "KgKlRN7TfoC90IYHjB1dqLMIseg4YM7Oe0e4Z2nL50bHoqXg7OUHaILUQn7ufpYp\n" +
-                    "+VCWxyI43KvaR4+HnST3x47wqeArg/rULGV1a16X+46cxq2eoMAcDfostXHaemvz\n" +
-                    "vg/Wd5xcWfPbF/oY1/sBXH+AK+peVBMen82+3GtAWtNWbyPE3bT4RG+WgKUyfLZ1\n" +
-                    "7A67rX9DkUEVMPQpa50MpLnrRveiM9w6R3mrMHMHbNnwID0Tqfds5zzOi/7cLD0C\n" +
-                    "AwEAAaOCAd8wggHbMA4GA1UdDwEB/wQEAwIDuDATBgNVHSUEDDAKBggrBgEFBQcD\n" +
-                    "ATBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLmluZm9u\n" +
-                    "b3RhcnkuY29tL3Jlc3BvbmRlci5jZ2kwgZAGA1UdIASBiDCBhTCBggYMKwYBBAGB\n" +
-                    "rQABAgMBMHIwOAYIKwYBBQUHAgEWLGh0dHA6Ly9yZXBvc2l0b3J5LmluZm9ub3Rh\n" +
-                    "cnkuY29tL2RvbWFpbi5odG1sMDYGCCsGAQUFBwICMCoaKGktTm90YXJ5IFZhbGlk\n" +
-                    "YXRlZCBEb21haW4gQ2VydGlmaWNhdGUgQ1AwgYkGA1UdHwSBgTB/MDWgL6Athito\n" +
-                    "dHRwOi8vY3JsLmluZm9ub3RhcnkuY29tL2NybC9kb21haW4tY2EuY3JsgQIBVjBG\n" +
-                    "oECgPoY8bGRhcDovL2xkYXAuaW5mb25vdGFyeS5jb20vZGM9ZG9tYWluLWNhLGRj\n" +
-                    "PWluZm9ub3RhcnksZGM9Y29tgQIBVjAPBgNVHRMBAf8EBTADAQEAMB0GA1UdDgQW\n" +
-                    "BBTImKJZrgV/8n7mHrA0U5EeGsBvbzAfBgNVHSMEGDAWgBTbkorEK+bPdVPpvyVI\n" +
-                    "PTxGFnuOoDANBgkqhkiG9w0BAQUFAAOCAQEAhsMbqsqvkbfVaKZ+wDY9rX3EtuDS\n" +
-                    "isdAo4AjmWgTtj/aBGiEiXcIGP312x+0JF+mEEQ75ZOKN+WsM8eLB0F4aqylklk7\n" +
-                    "6yRYauRXp8dfbXrT3ozxekt0cpSMqbzze456krI12nL+C00V2Iwq96k5J/yZboNW\n" +
-                    "Q+ibCaEAHNiL4tGVHSHm6znkWvIuUTbDgDEsm5RdafO27suz5H6zMnV+VE6onN1J\n" +
-                    "I1mQmUs44cg2HZAqnFBpDyJQhNYy8M7yGVaRkbfuVaMqiPa+xDPR5v7NFB3kxRq2\n" +
-                    "Za2Snopi52eUxDEhJ0MNqFi3Jfj/ZSmJ+XHra5lU4R8lijCAq8SVLZCmIQ==\n" +
-                    "-----END CERTIFICATE-----").getBytes();
+    public static final byte[] X509_MULTIPLE_VALUE_AVA = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIFxzCCBK+gAwIBAgIIRO/2+/XA7z4wDQYJKoZIhvcNAQEFBQAwgZwxgZkwCQYD\n"
+        + "VQQGDAJCRzAVBgNVBAoMDkluZm9Ob3RhcnkgUExDMBcGCgmSJomT8ixkARkWCWRv\n"
+        + "bWFpbi1jYTAtBgNVBAMMJmktTm90YXJ5IFRydXN0UGF0aCBWYWxpZGF0ZWQgRG9t\n"
+        + "YWluIENBMC0GA1UECwwmaS1Ob3RhcnkgVHJ1c3RQYXRoIFZhbGlkYXRlZCBEb21h\n"
+        + "aW4gQ0EwHhcNMTIwNjE4MDg1MzIyWhcNMTMwNjE4MDg1MzIyWjCBxjGBwzAJBgNV\n"
+        + "BAYTAkJHMBUGA1UEChMOSW5mb05vdGFyeSBQTEMwFwYDVQQLExBGaWxlcyBSZXBv\n"
+        + "c2l0b3J5MBcGCgmSJomT8ixkARkWCWRvbWFpbi1jYTAgBgNVBAMTGXJlcG9zaXRv\n"
+        + "cnkuaW5mb25vdGFyeS5jb20wIwYJKoZIhvcNAQkBFhZzdXBwb3J0QGluZm9ub3Rh\n"
+        + "cnkuY29tMCYGCSqGSIb3DQEJAhMZcmVwb3NpdG9yeS5pbmZvbm90YXJ5LmNvbTCC\n"
+        + "ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKWjGpgsuz103xVEW/GSg5I\n"
+        + "tBoLbXPxockabOTHnOh0VO2sImycyhBH78nMj+VMexn4y+kdCOuJqAA5LApxyhTA\n"
+        + "KgKlRN7TfoC90IYHjB1dqLMIseg4YM7Oe0e4Z2nL50bHoqXg7OUHaILUQn7ufpYp\n"
+        + "+VCWxyI43KvaR4+HnST3x47wqeArg/rULGV1a16X+46cxq2eoMAcDfostXHaemvz\n"
+        + "vg/Wd5xcWfPbF/oY1/sBXH+AK+peVBMen82+3GtAWtNWbyPE3bT4RG+WgKUyfLZ1\n"
+        + "7A67rX9DkUEVMPQpa50MpLnrRveiM9w6R3mrMHMHbNnwID0Tqfds5zzOi/7cLD0C\n"
+        + "AwEAAaOCAd8wggHbMA4GA1UdDwEB/wQEAwIDuDATBgNVHSUEDDAKBggrBgEFBQcD\n"
+        + "ATBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLmluZm9u\n"
+        + "b3RhcnkuY29tL3Jlc3BvbmRlci5jZ2kwgZAGA1UdIASBiDCBhTCBggYMKwYBBAGB\n"
+        + "rQABAgMBMHIwOAYIKwYBBQUHAgEWLGh0dHA6Ly9yZXBvc2l0b3J5LmluZm9ub3Rh\n"
+        + "cnkuY29tL2RvbWFpbi5odG1sMDYGCCsGAQUFBwICMCoaKGktTm90YXJ5IFZhbGlk\n"
+        + "YXRlZCBEb21haW4gQ2VydGlmaWNhdGUgQ1AwgYkGA1UdHwSBgTB/MDWgL6Athito\n"
+        + "dHRwOi8vY3JsLmluZm9ub3RhcnkuY29tL2NybC9kb21haW4tY2EuY3JsgQIBVjBG\n"
+        + "oECgPoY8bGRhcDovL2xkYXAuaW5mb25vdGFyeS5jb20vZGM9ZG9tYWluLWNhLGRj\n"
+        + "PWluZm9ub3RhcnksZGM9Y29tgQIBVjAPBgNVHRMBAf8EBTADAQEAMB0GA1UdDgQW\n"
+        + "BBTImKJZrgV/8n7mHrA0U5EeGsBvbzAfBgNVHSMEGDAWgBTbkorEK+bPdVPpvyVI\n"
+        + "PTxGFnuOoDANBgkqhkiG9w0BAQUFAAOCAQEAhsMbqsqvkbfVaKZ+wDY9rX3EtuDS\n"
+        + "isdAo4AjmWgTtj/aBGiEiXcIGP312x+0JF+mEEQ75ZOKN+WsM8eLB0F4aqylklk7\n"
+        + "6yRYauRXp8dfbXrT3ozxekt0cpSMqbzze456krI12nL+C00V2Iwq96k5J/yZboNW\n"
+        + "Q+ibCaEAHNiL4tGVHSHm6znkWvIuUTbDgDEsm5RdafO27suz5H6zMnV+VE6onN1J\n"
+        + "I1mQmUs44cg2HZAqnFBpDyJQhNYy8M7yGVaRkbfuVaMqiPa+xDPR5v7NFB3kxRq2\n"
+        + "Za2Snopi52eUxDEhJ0MNqFi3Jfj/ZSmJ+XHra5lU4R8lijCAq8SVLZCmIQ==\n"
+        + "-----END CERTIFICATE-----").getBytes();
 
-    public final static byte[] S_GOOGLE_COM = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIICpzCCAY+gAwIBAgIBATANBgkqhkiG9w0BAQUFADAXMRUwEwYDVQQDDAwqLmdv\n" +
-                    "b2dsZS5jb20wHhcNMTcwMTEzMjI0OTAzWhcNMTgwMTEzMjI0OTAzWjAXMRUwEwYD\n" +
-                    "VQQDDAwqLmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\n" +
-                    "AQDHuzznuHdJ5PH344xCyGYnUnIRhyLGBKN3WDLLrXWtr/5Sf3Q1qkiMiJ4BINsh\n" +
-                    "3Xy0z7VvHmMFlntgHXtkofBUPvTihxsVIypRkCZb5hpsWLotR10AW2JpVl/oxLP2\n" +
-                    "227/36X1zKh33fjImLJl9KzGWHLsbCBleQQJOn7YRsNR/QBZO0XGGkN/R2rRfLF3\n" +
-                    "rseRfI5gJjZkO0WDxocnf/iieOe0XNR0NAZaY1aozzPmZ/pRrOKYB8OFH7F73WOC\n" +
-                    "lPIUGai/byJ9SpbXdLUcMlGhml/4XzcnV/WVRD2P/mlY+xEFG3UEy3ufhNnKFJul\n" +
-                    "yjZrOaKbagamqtOyktzkjnerAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADaMcwVs\n" +
-                    "w5kbnoDJzMBJ01H16T4u8k78i/ybwz7u7krgkU0tABXCRj7S/4Dt3jqQ/rV6evj4\n" +
-                    "gIJ/2kZUp/PHKkV7CxWI48XBTAQUu9LEpxj0Hut3AtNMD9y/J6cFn2978tWsHFHI\n" +
-                    "mYgvclKUDE4WFMvuxfQVuX3RcGQ5i8khEMczY/KVhZYDcLU1PU0GTTJqqrQm59Z4\n" +
-                    "T4UyI3OPBR7Nb/kaU1fcgQ083uxRXcNYRMMZnU6c2oFnR+c6pO6aGoXo0C6rgC4R\n" +
-                    "pOj4hPvHCfZO2xg6HAdQ7UPALLX8pu5KGot7GRc8yiJ/Q1nBEuiPKKu0MIwQoFgP\n" +
-                    "WUux/APTsgLR7Vc=\n" +
-                    "-----END CERTIFICATE-----"
-    ).getBytes();
+    public static final byte[] S_GOOGLE_COM = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIICpzCCAY+gAwIBAgIBATANBgkqhkiG9w0BAQUFADAXMRUwEwYDVQQDDAwqLmdv\n"
+        + "b2dsZS5jb20wHhcNMTcwMTEzMjI0OTAzWhcNMTgwMTEzMjI0OTAzWjAXMRUwEwYD\n"
+        + "VQQDDAwqLmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\n"
+        + "AQDHuzznuHdJ5PH344xCyGYnUnIRhyLGBKN3WDLLrXWtr/5Sf3Q1qkiMiJ4BINsh\n"
+        + "3Xy0z7VvHmMFlntgHXtkofBUPvTihxsVIypRkCZb5hpsWLotR10AW2JpVl/oxLP2\n"
+        + "227/36X1zKh33fjImLJl9KzGWHLsbCBleQQJOn7YRsNR/QBZO0XGGkN/R2rRfLF3\n"
+        + "rseRfI5gJjZkO0WDxocnf/iieOe0XNR0NAZaY1aozzPmZ/pRrOKYB8OFH7F73WOC\n"
+        + "lPIUGai/byJ9SpbXdLUcMlGhml/4XzcnV/WVRD2P/mlY+xEFG3UEy3ufhNnKFJul\n"
+        + "yjZrOaKbagamqtOyktzkjnerAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADaMcwVs\n"
+        + "w5kbnoDJzMBJ01H16T4u8k78i/ybwz7u7krgkU0tABXCRj7S/4Dt3jqQ/rV6evj4\n"
+        + "gIJ/2kZUp/PHKkV7CxWI48XBTAQUu9LEpxj0Hut3AtNMD9y/J6cFn2978tWsHFHI\n"
+        + "mYgvclKUDE4WFMvuxfQVuX3RcGQ5i8khEMczY/KVhZYDcLU1PU0GTTJqqrQm59Z4\n"
+        + "T4UyI3OPBR7Nb/kaU1fcgQ083uxRXcNYRMMZnU6c2oFnR+c6pO6aGoXo0C6rgC4R\n"
+        + "pOj4hPvHCfZO2xg6HAdQ7UPALLX8pu5KGot7GRc8yiJ/Q1nBEuiPKKu0MIwQoFgP\n"
+        + "WUux/APTsgLR7Vc=\n" + "-----END CERTIFICATE-----").getBytes();
 
-    public final static byte[] IP_1_1_1_1 = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIICwjCCAaqgAwIBAgIBATANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9kdW1t\n" +
-                    "eS12YWx1ZS5jb20wHhcNMTcwMTEzMjI1MTQ2WhcNMTgwMTEzMjI1MTQ2WjAaMRgw\n" +
-                    "FgYDVQQDEw9kdW1teS12YWx1ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n" +
-                    "ggEKAoIBAQDfrapp3jHLp1RlElzpR/4sF9AcTYwMF1N+adkHRoVtmTlJV2lTIAjn\n" +
-                    "QLauy0Kkzv8uxmbID3uROgrFNDQ5RxTTCe+kW/vE6Pyzr5Z5ayjSTKeycTE7mAC4\n" +
-                    "6ntoCeEWiD593zlfqVo5PuRSp9Kusd+kexNVjC/BETDPa3yXctcH1ouW9GyGItgQ\n" +
-                    "u4GhCE8cipKMuTltgfK+Gh/5e9lFG9/F2fD+wHUVBULLR3JOQoqwgk2zAwKDwLuS\n" +
-                    "sEd1CBi35+W3apCKN0SEdTKIAxc/R+O/1j2hpOl9yXCCYyveGwJdFXVZtDcx+9/H\n" +
-                    "7NXhOdmw/mTXC5fOQGKciEo2SXt8Wp89AgMBAAGjEzARMA8GA1UdEQQIMAaHBAEB\n" +
-                    "AQEwDQYJKoZIhvcNAQEFBQADggEBAEAO6CE8twpcfdjk9oMjI5nX9GdC5Wt6+ujd\n" +
-                    "tLj0SbXvMKzCLLkveT0xTEzXfyEo8KW2qYYvPP1h83BIxsbR/J3Swt35UQVofv+4\n" +
-                    "JgO0FIdgB+iLEcjUh5+60xslylqWE+9bSWm4f06OXuv78tq5NYPZKku/3i4tqLRp\n" +
-                    "gH2rTtjX7Q4olSS7GdAgfiA2AnDZAbMtxtsnTt/QFpYQqhlkqHVDwgkGP7C8aMBD\n" +
-                    "RH0UIQCPxUkhwhtNmVyHO42r6oHXselZoVU6XRHuhogrGxPf/pzDUvrKBiJhsZQQ\n" +
-                    "oEu+pZCwkFLiNwUoq1G2oDpkkdBWB0JcBXB2Txa536ezFFWZYc0=\n" +
-                    "-----END CERTIFICATE-----"
-    ).getBytes();
+    public static final byte[] IP_1_1_1_1 = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIICwjCCAaqgAwIBAgIBATANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9kdW1t\n"
+        + "eS12YWx1ZS5jb20wHhcNMTcwMTEzMjI1MTQ2WhcNMTgwMTEzMjI1MTQ2WjAaMRgw\n"
+        + "FgYDVQQDEw9kdW1teS12YWx1ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+        + "ggEKAoIBAQDfrapp3jHLp1RlElzpR/4sF9AcTYwMF1N+adkHRoVtmTlJV2lTIAjn\n"
+        + "QLauy0Kkzv8uxmbID3uROgrFNDQ5RxTTCe+kW/vE6Pyzr5Z5ayjSTKeycTE7mAC4\n"
+        + "6ntoCeEWiD593zlfqVo5PuRSp9Kusd+kexNVjC/BETDPa3yXctcH1ouW9GyGItgQ\n"
+        + "u4GhCE8cipKMuTltgfK+Gh/5e9lFG9/F2fD+wHUVBULLR3JOQoqwgk2zAwKDwLuS\n"
+        + "sEd1CBi35+W3apCKN0SEdTKIAxc/R+O/1j2hpOl9yXCCYyveGwJdFXVZtDcx+9/H\n"
+        + "7NXhOdmw/mTXC5fOQGKciEo2SXt8Wp89AgMBAAGjEzARMA8GA1UdEQQIMAaHBAEB\n"
+        + "AQEwDQYJKoZIhvcNAQEFBQADggEBAEAO6CE8twpcfdjk9oMjI5nX9GdC5Wt6+ujd\n"
+        + "tLj0SbXvMKzCLLkveT0xTEzXfyEo8KW2qYYvPP1h83BIxsbR/J3Swt35UQVofv+4\n"
+        + "JgO0FIdgB+iLEcjUh5+60xslylqWE+9bSWm4f06OXuv78tq5NYPZKku/3i4tqLRp\n"
+        + "gH2rTtjX7Q4olSS7GdAgfiA2AnDZAbMtxtsnTt/QFpYQqhlkqHVDwgkGP7C8aMBD\n"
+        + "RH0UIQCPxUkhwhtNmVyHO42r6oHXselZoVU6XRHuhogrGxPf/pzDUvrKBiJhsZQQ\n"
+        + "oEu+pZCwkFLiNwUoq1G2oDpkkdBWB0JcBXB2Txa536ezFFWZYc0=\n" + "-----END CERTIFICATE-----")
+        .getBytes();
 
-    public final static byte[] EMAIL_ALT_SUBJECT_NAME = (
-            "-----BEGIN CERTIFICATE-----\n" +
-                    "MIIDpTCCAo2gAwIBAgIJANqkMEtlkelbMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNV\n" +
-                    "BAYTAlVTMQswCQYDVQQIDAJWQTERMA8GA1UEBwwIU29tZUNpdHkxEjAQBgNVBAoM\n" +
-                    "CU15Q29tcGFueTETMBEGA1UECwwKTXlEaXZpc2lvbjEYMBYGA1UEAwwPd3d3LmNv\n" +
-                    "bXBhbnkuY29tMB4XDTE4MDIxNTA3MjkzMFoXDTIwMDIxNTA3MjkzMFowcDELMAkG\n" +
-                    "A1UEBhMCVVMxCzAJBgNVBAgMAlZBMREwDwYDVQQHDAhTb21lQ2l0eTESMBAGA1UE\n" +
-                    "CgwJTXlDb21wYW55MRMwEQYDVQQLDApNeURpdmlzaW9uMRgwFgYDVQQDDA93d3cu\n" +
-                    "Y29tcGFueS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4v6Oq\n" +
-                    "Ua0goRVn1cmT7MOpJhXFm3A70bTpvJIRpEjtGIz99hb34/9r5AYyf1VhKyWmBq24\n" +
-                    "XNcOJ59XOlyjjbm2Tl811ufTOdcNbPadoVBmMt4039OSUFpVb4wAw2XPWLTCG2h1\n" +
-                    "HNj9GuFHmwcDsg5EiIRrhDGQm2LLLAGoe5PdReoMZCeeWzNWvKTCV14pyRzwQhJL\n" +
-                    "F1OmzLYzovbPfB8LZVhQgDbLsh034FScivf2oKDB+NEzAEagNpnrFR0MFLWGYsu1\n" +
-                    "nWD5RiZi78HFGiibmhH7QrEPfGlo2eofuUga6naoBUROqkmMCIL8n1HZ/Ur0oGny\n" +
-                    "vQCj1AyrfOhuVC53AgMBAAGjQjBAMAsGA1UdDwQEAwIEMDATBgNVHSUEDDAKBggr\n" +
-                    "BgEFBQcDATAcBgNVHREEFTATgRFlbWFpbEBleGFtcGxlLmNvbTANBgkqhkiG9w0B\n" +
-                    "AQsFAAOCAQEAZ0IsqRrsEmJ6Fa9Yo6PQtrKJrejN2TTDddVgyLQdokzWh/25JFad\n" +
-                    "NCMYPH5KjTUyKf96hJDlDayjbKk1PMMhSZMU5OG9NOuGMH/dQttruG1ojse7KIKg\n" +
-                    "yHDQrfq5Exxgfa7CMHRKAoTCY7JZhSLyVbTMVhmGfuUDad/RA86ZisXycp0ZmS97\n" +
-                    "qDkAmzFL0sL0ZUWNNUh4ZUWvCUZwiuN08z70NjGqXMTDCf68p3SYxbII0xTfScgf\n" +
-                    "aQ/A/hD7IbGGTexeoTwpEj01DNvefbQV6//neo32/R5XD0D5jn3TCgZcMThA6H3a\n" +
-                    "VkEghVg+s7uMfL/UEebOBQWXQJ/uVoknMA==\n" +
-                    "-----END CERTIFICATE-----"
-    ).getBytes();
+    public static final byte[] EMAIL_ALT_SUBJECT_NAME = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIDpTCCAo2gAwIBAgIJANqkMEtlkelbMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNV\n"
+        + "BAYTAlVTMQswCQYDVQQIDAJWQTERMA8GA1UEBwwIU29tZUNpdHkxEjAQBgNVBAoM\n"
+        + "CU15Q29tcGFueTETMBEGA1UECwwKTXlEaXZpc2lvbjEYMBYGA1UEAwwPd3d3LmNv\n"
+        + "bXBhbnkuY29tMB4XDTE4MDIxNTA3MjkzMFoXDTIwMDIxNTA3MjkzMFowcDELMAkG\n"
+        + "A1UEBhMCVVMxCzAJBgNVBAgMAlZBMREwDwYDVQQHDAhTb21lQ2l0eTESMBAGA1UE\n"
+        + "CgwJTXlDb21wYW55MRMwEQYDVQQLDApNeURpdmlzaW9uMRgwFgYDVQQDDA93d3cu\n"
+        + "Y29tcGFueS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4v6Oq\n"
+        + "Ua0goRVn1cmT7MOpJhXFm3A70bTpvJIRpEjtGIz99hb34/9r5AYyf1VhKyWmBq24\n"
+        + "XNcOJ59XOlyjjbm2Tl811ufTOdcNbPadoVBmMt4039OSUFpVb4wAw2XPWLTCG2h1\n"
+        + "HNj9GuFHmwcDsg5EiIRrhDGQm2LLLAGoe5PdReoMZCeeWzNWvKTCV14pyRzwQhJL\n"
+        + "F1OmzLYzovbPfB8LZVhQgDbLsh034FScivf2oKDB+NEzAEagNpnrFR0MFLWGYsu1\n"
+        + "nWD5RiZi78HFGiibmhH7QrEPfGlo2eofuUga6naoBUROqkmMCIL8n1HZ/Ur0oGny\n"
+        + "vQCj1AyrfOhuVC53AgMBAAGjQjBAMAsGA1UdDwQEAwIEMDATBgNVHSUEDDAKBggr\n"
+        + "BgEFBQcDATAcBgNVHREEFTATgRFlbWFpbEBleGFtcGxlLmNvbTANBgkqhkiG9w0B\n"
+        + "AQsFAAOCAQEAZ0IsqRrsEmJ6Fa9Yo6PQtrKJrejN2TTDddVgyLQdokzWh/25JFad\n"
+        + "NCMYPH5KjTUyKf96hJDlDayjbKk1PMMhSZMU5OG9NOuGMH/dQttruG1ojse7KIKg\n"
+        + "yHDQrfq5Exxgfa7CMHRKAoTCY7JZhSLyVbTMVhmGfuUDad/RA86ZisXycp0ZmS97\n"
+        + "qDkAmzFL0sL0ZUWNNUh4ZUWvCUZwiuN08z70NjGqXMTDCf68p3SYxbII0xTfScgf\n"
+        + "aQ/A/hD7IbGGTexeoTwpEj01DNvefbQV6//neo32/R5XD0D5jn3TCgZcMThA6H3a\n"
+        + "VkEghVg+s7uMfL/UEebOBQWXQJ/uVoknMA==\n" + "-----END CERTIFICATE-----").getBytes();
 
 }

From 3b0603f526fda4715904bfe2d1bba8a79458f00c Mon Sep 17 00:00:00 2001
From: Nishanth Entoor <entoor.nishanth@gmail.com>
Date: Sat, 18 Dec 2021 22:05:11 +0800
Subject: [PATCH 265/591] ZOOKEEPER-2907: Logged request buffer isn't useful

As per [ZOOKEEPER-2907](https://issues.apache.org/jira/browse/ZOOKEEPER-2907), we have no padding while converting byte to hex and the request type is not part of the output. So I made the following changes:
- Used String formatter to convert byte to hex with padding.
- Added request type as part of the log message.

Please let me know if additional changes are required.

Author: Nishanth Entoor <entoor.nishanth@gmail.com>

Reviewers: HorizonNet <jan.hentschel@ultratendency.com>, maoling <maoling@apache.org

Closes #1221 from nishanth-entoor/ZOOKEEPER-2907
---
 .../org/apache/zookeeper/server/FinalRequestProcessor.java    | 4 ++--
 .../org/apache/zookeeper/server/PrepRequestProcessor.java     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 6db245e060d..e73f85d7cc7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -595,9 +595,9 @@ public void processRequest(Request request) {
             ByteBuffer bb = request.request;
             bb.rewind();
             while (bb.hasRemaining()) {
-                sb.append(Integer.toHexString(bb.get() & 0xff));
+                sb.append(String.format("%02x", (0xff & bb.get())));
             }
-            LOG.error("Dumping request buffer: 0x{}", sb.toString());
+            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), sb);
             err = Code.MARSHALLINGERROR;
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 513e0348224..28ea11a695f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -955,13 +955,13 @@ private void pRequestHelper(Request request) throws RequestProcessorException {
             if (bb != null) {
                 bb.rewind();
                 while (bb.hasRemaining()) {
-                    sb.append(Integer.toHexString(bb.get() & 0xff));
+                    sb.append(String.format("%02x", (0xff & bb.get())));
                 }
             } else {
                 sb.append("request buffer is null");
             }
 
-            LOG.error("Dumping request buffer: 0x{}", sb.toString());
+            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), sb);
             if (request.getHdr() != null) {
                 request.getHdr().setType(OpCode.error);
                 request.setTxn(new ErrorTxn(Code.MARSHALLINGERROR.intValue()));

From 04f3d183de5543bcde7ad2f8b99ca847677f847d Mon Sep 17 00:00:00 2001
From: Nishanth Entoor <entoor.nishanth@gamil.com>
Date: Sun, 26 Dec 2021 14:47:08 +0800
Subject: [PATCH 266/591] ZOOKEEPER-3800: improve the log printing the address
 when QuorumCnxManager#ListenerHandler's port binds

As per [ZOOKEEPER-3800](https://issues.apache.org/jira/browse/ZOOKEEPER-3800), I updated the log message to print the address.

Please let me know if additional changes are required.

Author: Nishanth Entoor <entoor.nishanth@gamil.com>
Author: Nishanth Entoor <entoor.nishanth@gmail.com>

Reviewers: rabi-kumar <ravowlga@gmail.com>, maoling <maoling@apache.org>

Closes #1332 from nishanth-entoor/ZOOKEEPER-3800 and squashes the following commits:

6969ab93c [Nishanth Entoor] ZOOKEEPER-3800: changed log error message
5ae7b1eb6 [Nishanth Entoor] ZOOKEEPER-3800: improve the log printing the address when QuorumCnxManager#ListenerHandler's port binds
---
 .../org/apache/zookeeper/server/quorum/QuorumCnxManager.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 6bb611fea0a..9d9f8bd86a0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -1096,7 +1096,7 @@ private void acceptConnections() {
                             break;
                         }
 
-                        LOG.error("Exception while listening", e);
+                        LOG.error("Exception while listening to address {}", address, e);
 
                         if (e instanceof SocketException) {
                             socketException.set(true);

From be3c3954e6bd940baf4b8d21b4b6a87a71f76ee6 Mon Sep 17 00:00:00 2001
From: Vladimir Ivic <vivic@fb.com>
Date: Tue, 4 Jan 2022 11:26:27 +0800
Subject: [PATCH 267/591] Updating the docs to reflect the comments from the
 previous PR

Link to the discussion https://github.com/apache/zookeeper/pull/1034/files#r322682677

Author: Vladimir Ivic <vivic@fb.com>

Reviewers: Andor Molnar <anmolnar@apache.org>, Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1089 from vladimirivic/ZOOKEEPER-3491_docs_update
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 3671f1eea4c..84ecf94e729 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -650,8 +650,7 @@ property, when available, is noted below.
     (Java system property: **zookeeper.commitLogCount**)
     Zookeeper maintains an in-memory list of last committed requests for fast synchronization with
     followers when the followers are not too behind. This improves sync performance in case when your
-    snapshots are large (>100,000).
-    The default commitLogCount value is 500.
+    snapshots are large (>100,000). The default value is 500 which is the recommended minimum.
 
 * *snapSizeLimitInKb* :
     (Java system property: **zookeeper.snapSizeLimitInKb**)

From a43b9ef0cb2147d6a27f9285f9db02de54a0174f Mon Sep 17 00:00:00 2001
From: "epugh@opensourceconnections.com" <>
Date: Sat, 8 Jan 2022 15:42:31 +0800
Subject: [PATCH 268/591] ZOOKEEPER-4435: fix a tiny typo

Small typo in the log message.

Author: epugh@opensourceconnections.com <>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1792 from epugh/ZOOKEEPER-4435 and squashes the following commits:

ba3d78153 [epugh@opensourceconnections.com] ZOOKEEPER-4435: typo
392b16bae [epugh@opensourceconnections.com] Revert "typo"
52db6bad4 [epugh@opensourceconnections.com] typo
---
 .../java/org/apache/zookeeper/server/ServerCnxnFactory.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index 3db1ca12ddb..62eded3ae4e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -303,7 +303,7 @@ protected void initMaxCnxns() {
         maxCnxns = Integer.getInteger(ZOOKEEPER_MAX_CONNECTION, ZOOKEEPER_MAX_CONNECTION_DEFAULT);
         if (maxCnxns < 0) {
             maxCnxns = ZOOKEEPER_MAX_CONNECTION_DEFAULT;
-            LOG.warn("maxCnxns should be greater than or equal to 0, using default vlaue {}.",
+            LOG.warn("maxCnxns should be greater than or equal to 0, using default value {}.",
                     ZOOKEEPER_MAX_CONNECTION_DEFAULT);
         } else if (maxCnxns == ZOOKEEPER_MAX_CONNECTION_DEFAULT) {
             LOG.warn("maxCnxns is not configured, using default value {}.",

From f1da215e2ac008dc1a691f635278f9ceaa568ab9 Mon Sep 17 00:00:00 2001
From: Shoothzj <shoothzj@gmail.com>
Date: Sat, 8 Jan 2022 17:02:43 +0800
Subject: [PATCH 269/591] Updated Notice file to 2022

---
 NOTICE.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/NOTICE.txt b/NOTICE.txt
index afff440c251..87256b972bf 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2021 The Apache Software Foundation
+Copyright 2009-2022 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

From 7b75017bbb70c9f159b35f7399e29dc53bdc3d97 Mon Sep 17 00:00:00 2001
From: Shoothzj <shoothzj@gmail.com>
Date: Sat, 22 Jan 2022 15:05:07 +0800
Subject: [PATCH 270/591] ZOOKEEPER-4437: Bump Jackson version from 2.10.5.1 to
 2.13.1

Bump Jackson version from 2.10.5.1 to 2.13.1

`PropertyNamingStrategy.SNAKE_CASE` deprecated, use `PropertyNamingStrategies.SNAKE_CASE` instead

Author: Shoothzj <shoothzj@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Shoothzj <shoothzj@gmail.com>, maoling <maoling@apache.org>

Closes #1794 from Shoothzj/bump-jackson-core-2.13.1
---
 pom.xml                                                       | 2 +-
 .../java/org/apache/zookeeper/server/admin/JsonOutputter.java | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index cd4449c1886..de2e44d09b1 100755
--- a/pom.xml
+++ b/pom.xml
@@ -469,7 +469,7 @@
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.70.Final</netty.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
-    <jackson.version>2.10.5.1</jackson.version>
+    <jackson.version>2.13.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
index 0679cfae818..7d945745374 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
@@ -21,7 +21,7 @@
 import com.fasterxml.jackson.core.JsonGenerationException;
 import com.fasterxml.jackson.databind.JsonMappingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
 import com.fasterxml.jackson.databind.SerializationFeature;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -40,7 +40,7 @@ public JsonOutputter() {
         mapper = new ObjectMapper();
         mapper.configure(SerializationFeature.WRITE_ENUMS_USING_TO_STRING, true);
         mapper.configure(SerializationFeature.INDENT_OUTPUT, true);
-        mapper.setPropertyNamingStrategy(PropertyNamingStrategy.SNAKE_CASE);
+        mapper.setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
     }
 
     @Override

From 957f8fc0afbeca638f13f6fb739e49a921da2b9d Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Tue, 25 Jan 2022 12:48:34 +0000
Subject: [PATCH 271/591] ZOOKEEPER-3988:
 rg.apache.zookeeper.server.NettyServerCnxn.receiveMessage throws
 NullPointerException
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Modifications:
- prevent the NPE, the code that throws NPE is only to record some metrics for non TLS requests

Related to:
- apache/pulsar#11070
- https://github.com/pravega/zookeeper-operator/issues/393

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Nicolo² Boschi <boschi1997@gmail.com>, Andor Molnar <andor@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1798 from eolivelli/fix/ZOOKEEPER-3988-npe
---
 .../server/NettyServerCnxnFactory.java        | 18 ++++++++----
 .../zookeeper/server/NettyServerCnxnTest.java | 28 ++++++++++++-------
 2 files changed, 30 insertions(+), 16 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 0891021f35d..6b271326984 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -259,14 +259,20 @@ public void channelActive(ChannelHandlerContext ctx) throws Exception {
                 allChannels.add(ctx.channel());
                 addCnxn(cnxn);
             }
+
             if (ctx.channel().pipeline().get(SslHandler.class) == null) {
-                SocketAddress remoteAddress = cnxn.getChannel().remoteAddress();
-                if (remoteAddress != null
-                        && !((InetSocketAddress) remoteAddress).getAddress().isLoopbackAddress()) {
-                    LOG.trace("NettyChannelHandler channelActive: remote={} local={}", remoteAddress, cnxn.getChannel().localAddress());
-                    zkServer.serverStats().incrementNonMTLSRemoteConnCount();
+                if (zkServer != null) {
+                    SocketAddress remoteAddress = cnxn.getChannel().remoteAddress();
+                    if (remoteAddress != null
+                            && !((InetSocketAddress) remoteAddress).getAddress().isLoopbackAddress()) {
+                        LOG.trace("NettyChannelHandler channelActive: remote={} local={}", remoteAddress, cnxn.getChannel().localAddress());
+                        zkServer.serverStats().incrementNonMTLSRemoteConnCount();
+                    } else {
+                        zkServer.serverStats().incrementNonMTLSLocalConnCount();
+                    }
                 } else {
-                    zkServer.serverStats().incrementNonMTLSLocalConnCount();
+                    LOG.trace("Opened non-TLS connection from {} but zkServer is not running",
+                            cnxn.getChannel().remoteAddress());
                 }
             }
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index 576b0185163..a02d5d75586 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -174,9 +174,22 @@ public void testNonMTLSLocalConn() throws IOException, InterruptedException, Kee
         }
     }
 
-    @SuppressWarnings("unchecked")
     @Test
     public void testNonMTLSRemoteConn() throws Exception {
+        LeaderZooKeeperServer zks = mock(LeaderZooKeeperServer.class);
+        when(zks.isRunning()).thenReturn(true);
+        ServerStats.Provider providerMock = mock(ServerStats.Provider.class);
+        when(zks.serverStats()).thenReturn(new ServerStats(providerMock));
+        testNonMTLSRemoteConn(zks);
+    }
+
+    @Test
+    public void testNonMTLSRemoteConnZookKeeperServerNotReady() throws Exception {
+        testNonMTLSRemoteConn(null);
+    }
+
+    @SuppressWarnings("unchecked")
+    private void testNonMTLSRemoteConn(ZooKeeperServer zks) throws Exception {
         Channel channel = mock(Channel.class);
         ChannelId id = mock(ChannelId.class);
         ChannelFuture success = mock(ChannelFuture.class);
@@ -192,23 +205,18 @@ public void testNonMTLSRemoteConn() throws Exception {
         when(channel.remoteAddress()).thenReturn(address);
         when(channel.id()).thenReturn(id);
         NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
-        LeaderZooKeeperServer zks = mock(LeaderZooKeeperServer.class);
         factory.setZooKeeperServer(zks);
         Attribute atr = mock(Attribute.class);
         Mockito.doReturn(atr).when(channel).attr(
                 Mockito.any()
         );
         doNothing().when(atr).set(Mockito.any());
-
-        when(zks.isRunning()).thenReturn(true);
-
-        ServerStats.Provider providerMock = mock(ServerStats.Provider.class);
-        when(zks.serverStats()).thenReturn(new ServerStats(providerMock));
-
         factory.channelHandler.channelActive(context);
 
-        assertEquals(0, zks.serverStats().getNonMTLSLocalConnCount());
-        assertEquals(1, zks.serverStats().getNonMTLSRemoteConnCount());
+        if (zks != null) {
+            assertEquals(0, zks.serverStats().getNonMTLSLocalConnCount());
+            assertEquals(1, zks.serverStats().getNonMTLSRemoteConnCount());
+        }
     }
 
     @Test

From 85551f9be5b054fa4aee0636597b12bda2ecb2e8 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Thu, 27 Jan 2022 10:06:29 +0100
Subject: [PATCH 272/591] ZOOKEEPER-4427: Migrate to Logback

This is the first commit of Logback migration task.

1. Replaced log4j dependencies with logback alternatives,
2. Replaced log4j.properties files with logback.xml
3. Refactored unit tests to use logback for log capturing.

This patch doesn't cover the zookeeper-contrib projects, only the main codebase.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Chris Nauroth <cnauroth@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1793 from anmolnar/ZOOKEEPER-4427
---
 bin/zkCleanup.sh                              |   4 +-
 bin/zkCli.cmd                                 |   2 +-
 bin/zkCli.sh                                  |   2 +-
 bin/zkEnv.cmd                                 |   1 -
 bin/zkEnv.sh                                  |   5 -
 bin/zkServer.cmd                              |   2 +-
 bin/zkServer.sh                               |   8 +-
 conf/log4j.properties                         |  82 ----
 conf/logback.xml                              | 114 +++++
 owaspSuppressions.xml                         |  10 -
 pom.xml                                       |  11 +
 .../main/resources/markdown/zookeeperAdmin.md |  40 +-
 .../resources/markdown/zookeeperAuditLogs.md  |  49 ++-
 .../resources/markdown/zookeeperInternals.md  |   9 +-
 .../main/resources/markdown/zookeeperJMX.md   |  13 +-
 .../resources/markdown/zookeeperStarted.md    |   9 +-
 .../main/resources/markdown/zookeeperTools.md |   3 +-
 .../src/test/resources/log4j.properties       |  65 ---
 .../src/test/resources/logback.xml            |  36 ++
 zookeeper-server/pom.xml                      |  12 +-
 ...AuditLogger.java => Slf4jAuditLogger.java} |   6 +-
 .../zookeeper/audit/ZKAuditProvider.java      |   2 +-
 .../org/apache/zookeeper/server/ZooTrace.java |   2 +-
 .../src/main/resources/NOTICE.txt             |   6 +-
 .../resources/lib/log4j-1.2.17.LICENSE.txt    | 202 ---------
 .../lib/logback-classic-1.2.10.LICENSE.txt    | 414 ++++++++++++++++++
 .../lib/logback-core-1.2.10.LICENSE.txt       | 414 ++++++++++++++++++
 ...gerTest.java => Slf4JAuditLoggerTest.java} |  35 +-
 .../audit/StandaloneServerAuditTest.java      |  19 +-
 .../server/quorum/QuorumPeerMainTest.java     | 382 ++++++----------
 .../apache/zookeeper/test/LoggerTestTool.java |  88 ++++
 .../zookeeper/test/ReadOnlyModeTest.java      |  43 +-
 .../zookeeper/test/ReconfigExceptionTest.java |   4 +-
 .../src/test/resources/log4j.properties       |  65 ---
 .../src/test/resources/logback.xml            |  36 ++
 35 files changed, 1381 insertions(+), 814 deletions(-)
 delete mode 100644 conf/log4j.properties
 create mode 100644 conf/logback.xml
 delete mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml
 rename zookeeper-server/src/main/java/org/apache/zookeeper/audit/{Log4jAuditLogger.java => Slf4jAuditLogger.java} (87%)
 delete mode 100644 zookeeper-server/src/main/resources/lib/log4j-1.2.17.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt
 rename zookeeper-server/src/test/java/org/apache/zookeeper/audit/{Log4jAuditLoggerTest.java => Slf4JAuditLoggerTest.java} (94%)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
 delete mode 100644 zookeeper-server/src/test/resources/log4j.properties
 create mode 100644 zookeeper-server/src/test/resources/logback.xml

diff --git a/bin/zkCleanup.sh b/bin/zkCleanup.sh
index 45532410e96..b6fe0e75841 100755
--- a/bin/zkCleanup.sh
+++ b/bin/zkCleanup.sh
@@ -43,11 +43,11 @@ ZOO_LOG_FILE=zookeeper-$USER-cleanup-$HOSTNAME.log
 
 if [ "x$ZOODATALOGDIR" = "x" ]
 then
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
+"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
      -cp "$CLASSPATH" $JVMFLAGS \
      org.apache.zookeeper.server.PurgeTxnLog "$ZOODATADIR" $*
 else
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
+"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
      -cp "$CLASSPATH" $JVMFLAGS \
      org.apache.zookeeper.server.PurgeTxnLog "$ZOODATALOGDIR" "$ZOODATADIR" $*
 fi
diff --git a/bin/zkCli.cmd b/bin/zkCli.cmd
index 807ffaa9e5c..7a4391dd9ff 100644
--- a/bin/zkCli.cmd
+++ b/bin/zkCli.cmd
@@ -20,7 +20,7 @@ call "%~dp0zkEnv.cmd"
 set ZOO_LOG_FILE=zookeeper-%USERNAME%-cli-%COMPUTERNAME%.log
 
 set ZOOMAIN=org.apache.zookeeper.ZooKeeperMain
-call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.root.logger=%ZOO_LOG4J_PROP%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" -cp "%CLASSPATH%" %ZOOMAIN% %*
+call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" -cp "%CLASSPATH%" %ZOOMAIN% %*
 
 endlocal
 
diff --git a/bin/zkCli.sh b/bin/zkCli.sh
index ecf9a4525a0..3810e7f6880 100755
--- a/bin/zkCli.sh
+++ b/bin/zkCli.sh
@@ -38,6 +38,6 @@ fi
 
 ZOO_LOG_FILE=zookeeper-$USER-cli-$HOSTNAME.log
 
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
+"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
      -cp "$CLASSPATH" $CLIENT_JVMFLAGS $JVMFLAGS \
      org.apache.zookeeper.ZooKeeperMain "$@"
diff --git a/bin/zkEnv.cmd b/bin/zkEnv.cmd
index 68e231d7084..de9fc929b61 100644
--- a/bin/zkEnv.cmd
+++ b/bin/zkEnv.cmd
@@ -16,7 +16,6 @@ REM limitations under the License.
 
 set ZOOCFGDIR=%~dp0%..\conf
 set ZOO_LOG_DIR=%~dp0%..\logs
-set ZOO_LOG4J_PROP=INFO,CONSOLE
 
 REM for sanity sake assume Java 1.6
 REM see: http://java.sun.com/javase/6/docs/technotes/tools/windows/java.html
diff --git a/bin/zkEnv.sh b/bin/zkEnv.sh
index 8d93a50c7c0..0728c2e709f 100755
--- a/bin/zkEnv.sh
+++ b/bin/zkEnv.sh
@@ -70,11 +70,6 @@ then
     ZOO_LOG_DIR="$ZOOKEEPER_PREFIX/logs"
 fi
 
-if [ "x${ZOO_LOG4J_PROP}" = "x" ]
-then
-    ZOO_LOG4J_PROP="INFO,CONSOLE"
-fi
-
 if [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]];  then
     JAVA="$JAVA_HOME/bin/java"
 elif type -p java; then
diff --git a/bin/zkServer.cmd b/bin/zkServer.cmd
index b03a44386e7..07ac3a30244 100644
--- a/bin/zkServer.cmd
+++ b/bin/zkServer.cmd
@@ -21,6 +21,6 @@ set ZOOMAIN=org.apache.zookeeper.server.quorum.QuorumPeerMain
 set ZOO_LOG_FILE=zookeeper-%USERNAME%-server-%COMPUTERNAME%.log
 
 echo on
-call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.root.logger=%ZOO_LOG4J_PROP%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" "-XX:+HeapDumpOnOutOfMemoryError" "-XX:OnOutOfMemoryError=cmd /c taskkill /pid %%%%p /t /f" -cp "%CLASSPATH%" %ZOOMAIN% "%ZOOCFG%" %*
+call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" "-XX:+HeapDumpOnOutOfMemoryError" "-XX:OnOutOfMemoryError=cmd /c taskkill /pid %%%%p /t /f" -cp "%CLASSPATH%" %ZOOMAIN% "%ZOOCFG%" %*
 
 endlocal
diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index 1a3cd359c27..977c1bbf8c6 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -162,7 +162,7 @@ start)
       fi
     fi
     nohup "$JAVA" $ZOO_DATADIR_AUTOCREATE "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" \
-    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" \
+    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
     -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
     -cp "$CLASSPATH" $JVMFLAGS $ZOOMAIN "$ZOOCFG" > "$_ZOO_DAEMON_OUT" 2>&1 < /dev/null &
     if [ $? -eq 0 ]
@@ -200,13 +200,13 @@ start-foreground)
       ZOO_CMD=("$JAVA")
     fi
     "${ZOO_CMD[@]}" $ZOO_DATADIR_AUTOCREATE "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" \
-    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" \
+    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
     -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
     -cp "$CLASSPATH" $JVMFLAGS $ZOOMAIN "$ZOOCFG"
     ;;
 print-cmd)
     echo "\"$JAVA\" $ZOO_DATADIR_AUTOCREATE -Dzookeeper.log.dir=\"${ZOO_LOG_DIR}\" \
-    -Dzookeeper.log.file=\"${ZOO_LOG_FILE}\" -Dzookeeper.root.logger=\"${ZOO_LOG4J_PROP}\" \
+    -Dzookeeper.log.file=\"${ZOO_LOG_FILE}\" \
     -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
     -cp \"$CLASSPATH\" $JVMFLAGS $ZOOMAIN \"$ZOOCFG\" > \"$_ZOO_DAEMON_OUT\" 2>&1 < /dev/null"
     ;;
@@ -287,7 +287,7 @@ status)
       fi
     fi
     echo "Client port found: $clientPort. Client address: $clientPortAddress. Client SSL: $isSSL."
-    STAT=`"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
+    STAT=`"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
           -cp "$CLASSPATH" $CLIENT_JVMFLAGS $JVMFLAGS org.apache.zookeeper.client.FourLetterWordMain \
           $clientPortAddress $clientPort srvr $isSSL 2> /dev/null    \
           | $GREP Mode`
diff --git a/conf/log4j.properties b/conf/log4j.properties
deleted file mode 100644
index 9e12a38d333..00000000000
--- a/conf/log4j.properties
+++ /dev/null
@@ -1,82 +0,0 @@
-# Copyright 2012 The Apache Software Foundation
-# 
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Define some default values that can be overridden by system properties
-zookeeper.root.logger=INFO, CONSOLE
-
-zookeeper.console.threshold=INFO
-
-zookeeper.log.dir=.
-zookeeper.log.file=zookeeper.log
-zookeeper.log.threshold=INFO
-zookeeper.log.maxfilesize=256MB
-zookeeper.log.maxbackupindex=20
-
-zookeeper.tracelog.dir=${zookeeper.log.dir}
-zookeeper.tracelog.file=zookeeper_trace.log
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-#
-# console
-# Add "console" to rootlogger above if you want to use this 
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=${zookeeper.console.threshold}
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=${zookeeper.log.threshold}
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/${zookeeper.log.file}
-log4j.appender.ROLLINGFILE.MaxFileSize=${zookeeper.log.maxfilesize}
-log4j.appender.ROLLINGFILE.MaxBackupIndex=${zookeeper.log.maxbackupindex}
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log TRACE level and above messages to a log file
-#
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L][%x] - %m%n
-#
-# zk audit logging
-#
-zookeeper.auditlog.file=zookeeper_audit.log
-zookeeper.auditlog.threshold=INFO
-audit.logger=INFO, RFAAUDIT
-log4j.logger.org.apache.zookeeper.audit.Log4jAuditLogger=${audit.logger}
-log4j.additivity.org.apache.zookeeper.audit.Log4jAuditLogger=false
-log4j.appender.RFAAUDIT=org.apache.log4j.RollingFileAppender
-log4j.appender.RFAAUDIT.File=${zookeeper.log.dir}/${zookeeper.auditlog.file}
-log4j.appender.RFAAUDIT.layout=org.apache.log4j.PatternLayout
-log4j.appender.RFAAUDIT.layout.ConversionPattern=%d{ISO8601} %p %c{2}: %m%n
-log4j.appender.RFAAUDIT.Threshold=${zookeeper.auditlog.threshold}
-
-# Max log file size of 10MB
-log4j.appender.RFAAUDIT.MaxFileSize=10MB
-log4j.appender.RFAAUDIT.MaxBackupIndex=10
diff --git a/conf/logback.xml b/conf/logback.xml
new file mode 100644
index 00000000000..84a53896954
--- /dev/null
+++ b/conf/logback.xml
@@ -0,0 +1,114 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <!-- Uncomment this if you would like to expose Logback JMX beans -->
+  <!--jmxConfigurator /-->
+
+  <property name="zookeeper.console.threshold" value="INFO" />
+
+  <property name="zookeeper.log.dir" value="." />
+  <property name="zookeeper.log.file" value="zookeeper.log" />
+  <property name="zookeeper.log.threshold" value="INFO" />
+  <property name="zookeeper.log.maxfilesize" value="256MB" />
+  <property name="zookeeper.log.maxbackupindex" value="20" />
+
+  <!--
+    console
+    Add "console" to root logger if you want to use this
+  -->
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.console.threshold}</level>
+    </filter>
+  </appender>
+
+  <!--
+    Add ROLLINGFILE to root logger to get log file output
+  -->
+  <!--appender name="ROLLINGFILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.log.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.log.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>${zookeeper.log.maxbackupindex}</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.log.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>${zookeeper.log.maxfilesize}</MaxFileSize>
+    </triggeringPolicy>
+  </appender-->
+
+  <!--
+    Add TRACEFILE to root logger to get log file output
+    Log TRACE level and above messages to a log file
+  -->
+  <!--property name="zookeeper.tracelog.dir" value="${zookeeper.log.dir}" />
+  <property name="zookeeper.tracelog.file" value="zookeeper_trace.log" />
+  <appender name="TRACEFILE" class="ch.qos.logback.core.FileAppender">
+    <File>${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>TRACE</level>
+    </filter>
+  </appender-->
+
+  <!--
+    zk audit logging
+  -->
+  <!--property name="zookeeper.auditlog.file" value="zookeeper_audit.log" />
+  <property name="zookeeper.auditlog.threshold" value="INFO" />
+  <property name="audit.logger" value="INFO, RFAAUDIT" />
+
+  <appender name="RFAAUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.auditlog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} %p %c{2}: %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.auditlog.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>10</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.auditlog.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>10MB</MaxFileSize>
+    </triggeringPolicy>
+  </appender>
+
+  <logger name="org.apache.zookeeper.audit.Slf4jAuditLogger" additivity="false" level="${audit.logger}">
+    <appender-ref ref="RFAAUDIT" />
+  </logger-->
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 2565f0db148..5c4bc33bcf5 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -41,14 +41,4 @@
            this writing  -->
       <cve>CVE-2019-3826</cve>
    </suppress>
-   <suppress>
-      <!-- false positive for us, it is about log4j server in log4j-1.2.17.jar
-           ZOOKEEPER-3677 -->
-      <cve>CVE-2019-17571</cve>
-   </suppress>
-   <suppress>
-      <!-- it only affects the log4j SmtpAppender users. As Log4J 1.2 is EOL now, we can't fix this unless we
-           upgrade to log4j 2. See ZOOKEEPER-3817 -->
-      <cve>CVE-2020-9488</cve>
-   </suppress>
 </suppressions>
diff --git a/pom.xml b/pom.xml
index de2e44d09b1..646637c80bf 100755
--- a/pom.xml
+++ b/pom.xml
@@ -459,6 +459,7 @@
 
     <!-- dependency versions -->
     <slf4j.version>1.7.30</slf4j.version>
+    <logback-version>1.2.10</logback-version>
     <audience-annotations.version>0.12.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
@@ -577,6 +578,16 @@
         <artifactId>log4j</artifactId>
         <version>${log4j.version}</version>
       </dependency>
+      <dependency>
+        <groupId>ch.qos.logback</groupId>
+        <artifactId>logback-core</artifactId>
+        <version>${logback-version}</version>
+      </dependency>
+      <dependency>
+        <groupId>ch.qos.logback</groupId>
+        <artifactId>logback-classic</artifactId>
+        <version>${logback-version}</version>
+      </dependency>
       <dependency>
         <groupId>org.jmockit</groupId>
         <artifactId>jmockit</artifactId>
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 84ecf94e729..eaefdda82ab 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -33,7 +33,7 @@ limitations under the License.
     * [Administering](#sc_administering)
     * [Maintenance](#sc_maintenance)
         * [Ongoing Data Directory Cleanup](#Ongoing+Data+Directory+Cleanup)
-        * [Debug Log Cleanup (log4j)](#Debug+Log+Cleanup+%28log4j%29)
+        * [Debug Log Cleanup (logback)](#Debug+Log+Cleanup+Logback)
     * [Supervision](#sc_supervision)
     * [Monitoring](#sc_monitoring)
     * [Logging](#sc_logging)
@@ -436,7 +436,7 @@ in the unlikely event a recent log has become corrupted). This
 can be run as a cron job on the ZooKeeper server machines to
 clean up the logs daily.
 
-    java -cp zookeeper.jar:lib/slf4j-api-1.7.5.jar:lib/slf4j-log4j12-1.7.5.jar:lib/log4j-1.2.17.jar:conf org.apache.zookeeper.server.PurgeTxnLog <dataDir> <snapDir> -n <count>
+    java -cp zookeeper.jar:lib/slf4j-api-1.7.30.jar:lib/logback-classic-1.2.10.jar:lib/logback-core-1.2.10.jar:conf org.apache.zookeeper.server.PurgeTxnLog <dataDir> <snapDir> -n <count>
 
 
 Automatic purging of the snapshots and corresponding
@@ -445,14 +445,14 @@ enabled via the following configuration parameters **autopurge.snapRetainCount**
 this, see [Advanced Configuration](#sc_advancedConfiguration)
 below.
 
-<a name="Debug+Log+Cleanup+%28log4j%29"></a>
+<a name="Debug+Log+Cleanup+Logback"></a>
 
-#### Debug Log Cleanup (log4j)
+#### Debug Log Cleanup (logback)
 
 See the section on [logging](#sc_logging) in this document. It is
 expected that you will setup a rolling file appender using the
-in-built log4j feature. The sample configuration file in the
-release tar's conf/log4j.properties provides an example of
+in-built logback feature. The sample configuration file in the
+release tar's `conf/logback.xml` provides an example of
 this.
 
 <a name="sc_supervision"></a>
@@ -504,22 +504,20 @@ The ZooKeeper service can be monitored in one of three primary ways:
 ### Logging
 
 ZooKeeper uses **[SLF4J](http://www.slf4j.org)**
-version 1.7.5 as its logging infrastructure. For backward compatibility it is bound to
-**LOG4J** but you can use
-**[LOGBack](http://logback.qos.ch/)**
-or any other supported logging framework of your choice.
-
-The ZooKeeper default *log4j.properties*
-file resides in the *conf* directory. Log4j requires that
-*log4j.properties* either be in the working directory
+version 1.7 as its logging infrastructure. By default ZooKeeper is shipped with
+**[LOGBack](http://logback.qos.ch/)** as the logging backend, but you can use
+any other supported logging framework of your choice.
+
+The ZooKeeper default *logback.xml*
+file resides in the *conf* directory. Logback requires that
+*logback.xml* either be in the working directory
 (the directory from which ZooKeeper is run) or be accessible from the classpath.
 
 For more information about SLF4J, see
 [its manual](http://www.slf4j.org/manual.html).
 
-For more information about LOG4J, see
-[Log4j Default Initialization Procedure](http://logging.apache.org/log4j/1.2/manual.html#defaultInit)
-of the log4j manual.
+For more information about Logback, see
+[Logback website](http://logback.qos.ch/).
 
 <a name="sc_troubleshooting"></a>
 
@@ -1141,8 +1139,8 @@ property, when available, is noted below.
 * *audit.impl.class* :
     (Java system property: **zookeeper.audit.impl.class**)
     **New in 3.6.0:**
-    Class to implement the audit logger. By default log4j based audit logger org.apache.zookeeper.audit
-    .Log4jAuditLogger is used.
+    Class to implement the audit logger. By default logback based audit logger org.apache.zookeeper.audit
+    .Slf4jAuditLogger is used.
     See the [ZooKeeper audit logs](zookeeperAuditLogs.html) for more information.
 
 * *largeRequestMaxBytes* :
@@ -2427,7 +2425,7 @@ The output contains multiple lines with the following format:
 * *stmk* :
     Sets the current trace mask.  The trace mask is 64 bits,
     where each bit enables or disables a specific category of trace
-    logging on the server.  Log4J must be configured to enable
+    logging on the server. Logback must be configured to enable
     `TRACE` level first in order to see trace logging
     messages.  The bits of the trace mask correspond to the following
     trace logging categories.
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md
index 957980dcc54..b3954ad676d 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -66,25 +66,36 @@ Below are sample audit logs for all operations, where client is connected from 1
 
 ## ZooKeeper Audit Log Configuration
 
-By default audit logs are disabled. To enable audit logs configure audit.enable=true in conf/zoo.cfg. Audit logging is done using log4j. Following is the default log4j configuration for audit logs in conf/log4j.properties
-
-    #
-    # zk audit logging
-    #
-    zookeeper.auditlog.file=zookeeper_audit.log
-    zookeeper.auditlog.threshold=INFO
-    audit.logger=INFO, RFAAUDIT
-    log4j.logger.org.apache.zookeeper.audit.Log4jAuditLogger=${audit.logger}
-    log4j.additivity.org.apache.zookeeper.audit.Log4jAuditLogger=false
-    log4j.appender.RFAAUDIT=org.apache.log4j.RollingFileAppender
-    log4j.appender.RFAAUDIT.File=${zookeeper.log.dir}/${zookeeper.auditlog.file}
-    log4j.appender.RFAAUDIT.layout=org.apache.log4j.PatternLayout
-    log4j.appender.RFAAUDIT.layout.ConversionPattern=%d{ISO8601} %p %c{2}: %m%n
-    log4j.appender.RFAAUDIT.Threshold=${zookeeper.auditlog.threshold}
+By default audit logs are disabled. To enable audit logs configure `audit.enable=true` in _conf/zoo.cfg_. 
+Audit logging is done using logback. Following is the default logback configuration for audit logs in `conf/logback.xml`
+
+    <!--
+      zk audit logging
+    -->
+    <!--property name="zookeeper.auditlog.file" value="zookeeper_audit.log" />
+    <property name="zookeeper.auditlog.threshold" value="INFO" />
+    <property name="audit.logger" value="INFO, RFAAUDIT" />
+    
+    <appender name="RFAAUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+      <File>${zookeeper.log.dir}/${zookeeper.auditlog.file}</File>
+      <encoder>
+        <pattern>%d{ISO8601} %p %c{2}: %m%n</pattern>
+      </encoder>
+      <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+        <level>${zookeeper.auditlog.threshold}</level>
+      </filter>
+      <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+        <maxIndex>10</maxIndex>
+        <FileNamePattern>${zookeeper.log.dir}/${zookeeper.auditlog.file}.%i</FileNamePattern>
+      </rollingPolicy>
+      <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+        <MaxFileSize>10MB</MaxFileSize>
+      </triggeringPolicy>
+    </appender>
     
-    # Max log file size of 10MB
-    log4j.appender.RFAAUDIT.MaxFileSize=10MB
-    log4j.appender.RFAAUDIT.MaxBackupIndex=10
+    <logger name="org.apache.zookeeper.audit.Slf4jAuditLogger" additivity="false" level="${audit.logger}">
+      <appender-ref ref="RFAAUDIT" />
+    </logger-->
 
 Change above configuration to customize the auditlog file, number of backups, max file size, custom audit logger etc.
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md b/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md
index 0505807e187..171f33ddb4c 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -312,11 +312,12 @@ hierarchy of groups.
 
 ## Logging
 
-Zookeeper uses [slf4j](http://www.slf4j.org/index.html) as an abstraction layer for logging. [log4j](http://logging.apache.org/log4j) in version 1.2 is chosen as the final logging implementation for now.
+Zookeeper uses [slf4j](http://www.slf4j.org/index.html) as an abstraction layer for logging. 
+[Logback](https://logback.qos.ch/) is chosen the logging backend since ZooKeeper version 3.8.0.
 For better embedding support, it is planned in the future to leave the decision of choosing the final logging implementation to the end user.
-Therefore, always use the slf4j api to write log statements in the code, but configure log4j for how to log at runtime.
+Therefore, always use the slf4j api to write log statements in the code, but configure logback for how to log at runtime.
 Note that slf4j has no FATAL level, former messages at FATAL level have been moved to ERROR level.
-For information on configuring log4j for
+For information on configuring logback for
 ZooKeeper, see the [Logging](zookeeperAdmin.html#sc_logging) section
 of the [ZooKeeper Administrator's Guide.](zookeeperAdmin.html)
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md b/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md
index 368540f4f5d..99b366f2265 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -77,8 +77,17 @@ on the left hand side. Expand this item and depending on how you've
 started the server you will be able to monitor and manage various
 service related features.
 
+#### Logback MBeans registration _(new in 3.8.0)_
+
+Logback is the default logging backend of ZooKeeper since version 3.8.0. 
+It can be configured to register JMX MBeans by adding `<jmxConfigurator />` to _logback.xml_. More
+information can be found on Logback's [website](https://logback.qos.ch/manual/jmxConfig.html).
+
+#### Log4j MBeans _(deprecated)_
+
 Also note that ZooKeeper will register log4j MBeans as
-well. In the same section along the left hand side you will see
+well if log4j1 is configured as the logging backend of SLF4j. 
+In the same section along the left hand side you will see
 "log4j". Expand that to manage log4j through JMX. Of particular
 interest is the ability to dynamically change the logging levels
 used by editing the appender and root thresholds. Log4j MBean
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md b/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
index bb1e2f0c203..e44aae8cf0b 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -101,12 +101,12 @@ ZooKeeper:
     bin/zkServer.sh start
 
 
-ZooKeeper logs messages using log4j -- more detail
+ZooKeeper logs messages using _logback_ -- more detail
 available in the
 [Logging](zookeeperProgrammers.html#Logging)
 section of the Programmer's Guide. You will see log messages
 coming to the console (default) and/or a log file depending on
-the log4j configuration.
+the logback configuration.
 
 The steps outlined here run ZooKeeper in standalone mode. There is
 no replication, so if ZooKeeper process fails, the service will go down.
@@ -137,8 +137,7 @@ Once you have connected, you should see something like:
 
 
     Connecting to localhost:2181
-    log4j:WARN No appenders could be found for logger (org.apache.zookeeper.ZooKeeper).
-    log4j:WARN Please initialize the log4j system properly.
+    ...
     Welcome to ZooKeeper!
     JLine support is enabled
     [zkshell: 0]
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index cd8b4412e11..5141766d75c 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2021 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -96,7 +96,6 @@ The environment setting for the ZooKeeper server
 ```bash
 # the setting of log property
 ZOO_LOG_DIR: the directory to store the logs
-ZOO_LOG4J_PROP: the level of logs to print
 ```
 
 <a name="zkCleanup"></a>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties
deleted file mode 100644
index d7f930d3ce2..00000000000
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 2012 The Apache Software Foundation
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Define some default values that can be overridden by system properties
-zookeeper.root.logger=INFO, CONSOLE
-
-zookeeper.console.threshold=INFO
-
-zookeeper.log.dir=.
-zookeeper.log.file=zookeeper.log
-zookeeper.log.threshold=INFO
-zookeeper.log.maxfilesize=256MB
-zookeeper.log.maxbackupindex=20
-
-zookeeper.tracelog.dir=${zookeeper.log.dir}
-zookeeper.tracelog.file=zookeeper_trace.log
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-#
-# console
-# Add "console" to rootlogger above if you want to use this
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=${zookeeper.console.threshold}
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=${zookeeper.log.threshold}
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/${zookeeper.log.file}
-log4j.appender.ROLLINGFILE.MaxFileSize=${zookeeper.log.maxfilesize}
-log4j.appender.ROLLINGFILE.MaxBackupIndex=${zookeeper.log.maxbackupindex}
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log TRACE level and above messages to a log file
-#
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml
new file mode 100644
index 00000000000..a1e627724a5
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml
@@ -0,0 +1,36 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>INFO</level>
+    </filter>
+  </appender>
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 4fd4f984c62..14c74ca637f 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -75,8 +75,12 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
     </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
@@ -118,10 +122,6 @@
        <artifactId>metrics-core</artifactId>
        <scope>provided</scope>
     </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.apache.kerby</groupId>
       <artifactId>kerb-core</artifactId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Log4jAuditLogger.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Slf4jAuditLogger.java
similarity index 87%
rename from zookeeper-server/src/main/java/org/apache/zookeeper/audit/Log4jAuditLogger.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/audit/Slf4jAuditLogger.java
index c4efc1c4e08..b162e74ec0b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Log4jAuditLogger.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Slf4jAuditLogger.java
@@ -22,10 +22,10 @@
 import org.slf4j.LoggerFactory;
 
 /**
- * Log4j based audit logger
+ * Slf4j based audit logger
  */
-public class Log4jAuditLogger implements AuditLogger {
-    private static final Logger LOG = LoggerFactory.getLogger(Log4jAuditLogger.class);
+public class Slf4jAuditLogger implements AuditLogger {
+    private static final Logger LOG = LoggerFactory.getLogger(Slf4jAuditLogger.class);
 
     @Override
     public void logAuditEvent(AuditEvent auditEvent) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java
index 00646baf871..864d2366c97 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java
@@ -46,7 +46,7 @@ public class ZKAuditProvider {
     private static AuditLogger getAuditLogger() {
         String auditLoggerClass = System.getProperty(AUDIT_IMPL_CLASS);
         if (auditLoggerClass == null) {
-            auditLoggerClass = Log4jAuditLogger.class.getName();
+            auditLoggerClass = Slf4jAuditLogger.class.getName();
         }
         try {
             Constructor<?> clientCxnConstructor = Class.forName(auditLoggerClass)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
index e9d1eb15a3e..464d818adc8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
@@ -27,7 +27,7 @@
  * This class encapsulates and centralizes tracing for the ZooKeeper server.
  * Trace messages go to the log with TRACE level.
  * <p>
- * Log4j must be correctly configured to capture the TRACE messages.
+ * Logback must be correctly configured to capture the TRACE messages.
  */
 public class ZooTrace {
 
diff --git a/zookeeper-server/src/main/resources/NOTICE.txt b/zookeeper-server/src/main/resources/NOTICE.txt
index 1b0fb951ccb..efdd6b43970 100644
--- a/zookeeper-server/src/main/resources/NOTICE.txt
+++ b/zookeeper-server/src/main/resources/NOTICE.txt
@@ -81,13 +81,13 @@ framework, which can be obtained at:
   * HOMEPAGE:
     * http://commons.apache.org/logging/
 
-This product optionally depends on 'Apache Log4J', a logging framework,
+This product optionally depends on 'Apache Logback', a logging framework,
 which can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.log4j.txt (Apache License 2.0)
+    * license/LICENSE.logback.txt (Eclipse Public License 1.0)
   * HOMEPAGE:
-    * http://logging.apache.org/log4j/
+    * https://logback.qos.ch/
 
 This product optionally depends on 'JBoss Logging', a logging framework,
 which can be obtained at:
diff --git a/zookeeper-server/src/main/resources/lib/log4j-1.2.17.LICENSE.txt b/zookeeper-server/src/main/resources/lib/log4j-1.2.17.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/log4j-1.2.17.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
similarity index 94%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
index 0080b01c718..df3b831a30d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
@@ -19,6 +19,7 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.LineNumberReader;
@@ -27,11 +28,6 @@
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
 import java.util.List;
-import org.apache.log4j.Layout;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.SimpleLayout;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
@@ -48,33 +44,28 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
+import org.apache.zookeeper.test.LoggerTestTool;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-
-public class Log4jAuditLoggerTest extends QuorumPeerTestBase {
-    private static final Logger LOG = Logger.getLogger(Log4jAuditLoggerTest.class);
+public class Slf4JAuditLoggerTest extends QuorumPeerTestBase {
+    private static final Logger LOG = LoggerFactory.getLogger(Slf4JAuditLoggerTest.class);
     private static int SERVER_COUNT = 3;
     private static MainThread[] mt;
     private static ZooKeeper zk;
-    private static Logger zlogger;
-    private static WriterAppender appender;
     private static ByteArrayOutputStream os;
 
     @BeforeAll
     public static void setUpBeforeClass() throws Exception {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
         // setup the logger to capture all logs
-        Layout layout = new SimpleLayout();
-        os = new ByteArrayOutputStream();
-        appender = new WriterAppender(layout, os);
-        appender.setImmediateFlush(true);
-        appender.setThreshold(Level.INFO);
-        zlogger = Logger.getLogger(Log4jAuditLogger.class);
-        zlogger.addAppender(appender);
+        LoggerTestTool loggerTestTool = new LoggerTestTool(Slf4jAuditLogger.class);
+        os = loggerTestTool.getOutputStream();
         mt = startQuorum();
         zk = ClientBase.createZKClient("127.0.0.1:" + mt[0].getQuorumPeer().getClientPort());
         //Verify start audit log here itself
@@ -322,8 +313,7 @@ private static void verifyLog(String expectedLog, String log) {
         String searchString = " - ";
         int logStartIndex = log.indexOf(searchString);
         String auditLog = log.substring(logStartIndex + searchString.length());
-        assertEquals(expectedLog, auditLog);
-
+        assertTrue(auditLog.endsWith(expectedLog));
     }
 
     private static void verifyLogs(String expectedLog, List<String> logs) {
@@ -428,12 +418,5 @@ public static void tearDownAfterClass() {
                 e.printStackTrace();
             }
         }
-        try {
-            zlogger.removeAppender(appender);
-            os.close();
-        } catch (IOException e) {
-            e.printStackTrace();
-        }
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
index 0815b9f42d4..8cadf3e1ee7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.audit;
 
-
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
@@ -27,36 +26,24 @@
 import java.io.StringReader;
 import java.util.ArrayList;
 import java.util.List;
-import org.apache.log4j.Layout;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.SimpleLayout;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.LoggerTestTool;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-
-
 public class StandaloneServerAuditTest extends ClientBase {
     private static ByteArrayOutputStream os;
 
     @BeforeAll
     public static void setup() {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
-        // setup the logger to capture all the logs
-        Layout layout = new SimpleLayout();
-        os = new ByteArrayOutputStream();
-        WriterAppender appender = new WriterAppender(layout, os);
-        appender.setImmediateFlush(true);
-        appender.setThreshold(Level.INFO);
-        Logger zLogger = Logger.getLogger(Log4jAuditLogger.class);
-        zLogger.addAppender(appender);
+        LoggerTestTool loggerTestTool = new LoggerTestTool(Slf4jAuditLogger.class);
+        os = loggerTestTool.getOutputStream();
     }
 
     @AfterAll
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index 724356e01d0..be81aa6c5b3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -47,10 +47,6 @@
 import java.util.regex.Pattern;
 import javax.security.sasl.SaslException;
 import org.apache.commons.io.FileUtils;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.PatternLayout;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.PortAssignment;
@@ -66,6 +62,7 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.LoggerTestTool;
 import org.junit.jupiter.api.Test;
 
 /**
@@ -339,13 +336,7 @@ public void testHighestZxidJoinLate() throws Exception {
      * @throws InterruptedException
      */
     @Test
-    public void testElectionFraud() throws IOException, InterruptedException {
-        // capture QuorumPeer logging
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.INFO);
-        Logger qlogger = Logger.getLogger(QuorumPeer.class);
-        qlogger.addAppender(appender);
-
+    public void testElectionFraud() throws Exception {
         numServers = 3;
 
         // used for assertions later
@@ -353,7 +344,9 @@ public void testElectionFraud() throws IOException, InterruptedException {
         boolean foundLooking = false;
         boolean foundFollowing = false;
 
-        try {
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool(QuorumPeer.class)) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
+
             // spin up a quorum, we use a small ticktime to make the test run faster
             servers = LaunchServers(numServers, 500);
 
@@ -411,8 +404,6 @@ public void testElectionFraud() throws IOException, InterruptedException {
                     break;
                 }
             }
-        } finally {
-            qlogger.removeAppender(appender);
         }
 
         assertTrue(foundLeading, "falseLeader never attempts to become leader");
@@ -427,13 +418,9 @@ public void testElectionFraud() throws IOException, InterruptedException {
     public void testBadPeerAddressInQuorum() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
@@ -452,21 +439,18 @@ public void testBadPeerAddressInQuorum() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 1 down");
 
-        } finally {
-            qlogger.removeAppender(appender);
-        }
-
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*Cannot open channel to .* at election address .*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*Cannot open channel to .* at election address .*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about host");
         }
-        assertTrue(found, "complains about host");
     }
 
     /**
@@ -476,15 +460,11 @@ public void testBadPeerAddressInQuorum() throws Exception {
     public void testInconsistentPeerType() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.INFO);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
         // test the most likely situation only: server is stated as observer in
         // servers list, but there's no "peerType=observer" token in config
-        try {
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
+
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
             final int CLIENT_PORT_QP3 = PortAssignment.unique();
@@ -518,28 +498,25 @@ public void testInconsistentPeerType() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP3, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 3 down");
 
-        } finally {
-            qlogger.removeAppender(appender);
-        }
-
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean warningPresent = false;
-        boolean defaultedToObserver = false;
-        Pattern pWarn = Pattern.compile(".*Peer type from servers list.* doesn't match peerType.*");
-        Pattern pObserve = Pattern.compile(".*OBSERVING.*");
-        while ((line = r.readLine()) != null) {
-            if (pWarn.matcher(line).matches()) {
-                warningPresent = true;
-            }
-            if (pObserve.matcher(line).matches()) {
-                defaultedToObserver = true;
-            }
-            if (warningPresent && defaultedToObserver) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean warningPresent = false;
+            boolean defaultedToObserver = false;
+            Pattern pWarn = Pattern.compile(".*Peer type from servers list.* doesn't match peerType.*");
+            Pattern pObserve = Pattern.compile(".*OBSERVING.*");
+            while ((line = r.readLine()) != null) {
+                if (pWarn.matcher(line).matches()) {
+                    warningPresent = true;
+                }
+                if (pObserve.matcher(line).matches()) {
+                    defaultedToObserver = true;
+                }
+                if (warningPresent && defaultedToObserver) {
+                    break;
+                }
             }
+            assertTrue(warningPresent && defaultedToObserver, "Should warn about inconsistent peer type");
         }
-        assertTrue(warningPresent && defaultedToObserver, "Should warn about inconsistent peer type");
     }
 
     /**
@@ -597,14 +574,9 @@ public void testBadPackets() throws Exception {
     public void testQuorumDefaults() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.INFO);
-        appender.setImmediateFlush(true);
-        Logger zlogger = Logger.getLogger("org.apache.zookeeper");
-        zlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
@@ -629,21 +601,19 @@ public void testQuorumDefaults() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 2 down");
 
-        } finally {
-            zlogger.removeAppender(appender);
-        }
-        os.close();
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*FastLeaderElection.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            os.close();
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*FastLeaderElection.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "fastleaderelection used");
         }
-        assertTrue(found, "fastleaderelection used");
     }
 
     /**
@@ -858,13 +828,8 @@ public void testLeaderOutOfView() throws Exception {
         boolean foundLeading = false;
         boolean foundFollowing = false;
 
-        // capture QuorumPeer logging
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.DEBUG);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
-        try {
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool(QuorumPeerMainTest.class)) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
             Servers svrs = new Servers();
             svrs.clientPorts = new int[numServers];
             for (int i = 0; i < numServers; i++) {
@@ -944,8 +909,6 @@ public void testLeaderOutOfView() throws Exception {
                     "Corrupt peer should not attempt connection to out of view leader");
             }
 
-        } finally {
-            qlogger.removeAppender(appender);
         }
     }
 
@@ -995,13 +958,6 @@ protected QuorumPeer getQuorumPeer() {
 
     }
 
-    private WriterAppender getConsoleAppender(ByteArrayOutputStream os, Level level) {
-        String loggingPattern = ((PatternLayout) Logger.getRootLogger().getAppender("CONSOLE").getLayout()).getConversionPattern();
-        WriterAppender appender = new WriterAppender(new PatternLayout(loggingPattern), os);
-        appender.setThreshold(level);
-        return appender;
-    }
-
     private String getUniquePortCfgForId(int id) {
         return String.format("server.%d=127.0.0.1:%d:%d", id, PortAssignment.unique(), PortAssignment.unique());
     }
@@ -1291,44 +1247,34 @@ public void testMetricsProviderLifecycle() throws Exception {
         ClientBase.setupTestEnv();
         BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.reset();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
-        try {
-            final int CLIENT_PORT_QP1 = PortAssignment.unique();
-            final int CLIENT_PORT_QP2 = PortAssignment.unique();
+        final int CLIENT_PORT_QP1 = PortAssignment.unique();
+        final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
-            String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
-                                            + "\nserver.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
+        String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
+                                        + "\nserver.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
 
-            // server 1 boots with a MetricsProvider
-            String quorumCfgSectionServer1 = quorumCfgSectionServer
-                                             + "metricsProvider.className=" + BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.class.getName() + "\n";
+        // server 1 boots with a MetricsProvider
+        String quorumCfgSectionServer1 = quorumCfgSectionServer
+                                         + "metricsProvider.className=" + BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.class.getName() + "\n";
 
-            MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
-            MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
-            q1.start();
-            q2.start();
+        MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
+        MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
+        q1.start();
+        q2.start();
 
-            boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
-            boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue(isup1, "Server 1 never came up");
-            assertTrue(isup2, "Server 2 never came up");
+        boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
+        boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
+        assertTrue(isup1, "Server 1 never came up");
+        assertTrue(isup2, "Server 2 never came up");
 
-            q1.shutdown();
-            q2.shutdown();
+        q1.shutdown();
+        q2.shutdown();
 
-            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
-                    "waiting for server 1 down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
 
-            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
-                    "waiting for server 2 down");
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
 
         assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get(), "metrics provider lifecycle error");
         assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get(), "metrics provider lifecycle error");
@@ -1344,46 +1290,36 @@ public void testMetricsProviderConfiguration() throws Exception {
         ClientBase.setupTestEnv();
         BaseTestMetricsProvider.MetricsProviderWithConfiguration.httpPort.set(0);
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        final int CLIENT_PORT_QP1 = PortAssignment.unique();
+        final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
-        try {
-            final int CLIENT_PORT_QP1 = PortAssignment.unique();
-            final int CLIENT_PORT_QP2 = PortAssignment.unique();
+        String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1 + "\n"
+                                        + "server.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
 
-            String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1 + "\n"
-                                            + "server.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
+        // server 1 boots with a MetricsProvider
+        String quorumCfgSectionServer1 = quorumCfgSectionServer
+                                         + "metricsProvider.className="
+                                         + BaseTestMetricsProvider.MetricsProviderWithConfiguration.class.getName()
+                                         + "\n" + "metricsProvider.httpPort=1234";
 
-            // server 1 boots with a MetricsProvider
-            String quorumCfgSectionServer1 = quorumCfgSectionServer
-                                             + "metricsProvider.className="
-                                             + BaseTestMetricsProvider.MetricsProviderWithConfiguration.class.getName()
-                                             + "\n" + "metricsProvider.httpPort=1234";
+        MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
+        MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
+        q1.start();
+        q2.start();
 
-            MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
-            MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
-            q1.start();
-            q2.start();
+        boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
+        boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
+        assertTrue(isup1, "Server 1 never came up");
+        assertTrue(isup2, "Server 2 never came up");
 
-            boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
-            boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue(isup1, "Server 1 never came up");
-            assertTrue(isup2, "Server 2 never came up");
-
-            q1.shutdown();
-            q2.shutdown();
+        q1.shutdown();
+        q2.shutdown();
 
-            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
-                    "waiting for server 1 down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
 
-            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
-                    "waiting for server 2 down");
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
 
         assertEquals(1234, BaseTestMetricsProvider.MetricsProviderWithConfiguration.httpPort.get());
     }
@@ -1396,13 +1332,9 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
         ClientBase.setupTestEnv();
         BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.reset();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
@@ -1433,23 +1365,20 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
 
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 2 down");
-        } finally {
-            qlogger.removeAppender(appender);
-        }
-
-        assertTrue(BaseTestMetricsProvider.MetricsProviderWithErrorInStop.stopCalled.get(), "metrics provider lifecycle error");
+            assertTrue(BaseTestMetricsProvider.MetricsProviderWithErrorInStop.stopCalled.get(), "metrics provider lifecycle error");
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*Error while stopping metrics.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*Error while stopping metrics.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider");
         }
-        assertTrue(found, "complains about metrics provider");
     }
 
     /**
@@ -1459,13 +1388,9 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
     public void testInvalidMetricsProvider() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
             String quorumCfgSection = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
@@ -1484,21 +1409,18 @@ public void testInvalidMetricsProvider() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 1 down");
 
-        } finally {
-            qlogger.removeAppender(appender);
-        }
-
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*BadClass.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*BadClass.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider");
         }
-        assertTrue(found, "complains about metrics provider");
     }
 
     /**
@@ -1508,13 +1430,9 @@ public void testInvalidMetricsProvider() throws Exception {
     public void testFaultyMetricsProviderOnStart() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
             String quorumCfgSection = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
@@ -1534,21 +1452,18 @@ public void testFaultyMetricsProviderOnStart() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 1 down");
 
-        } finally {
-            qlogger.removeAppender(appender);
-        }
-
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
         }
-        assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
     }
 
     /**
@@ -1558,13 +1473,9 @@ public void testFaultyMetricsProviderOnStart() throws Exception {
     public void testFaultyMetricsProviderOnConfigure() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
             String quorumCfgSection = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
@@ -1584,21 +1495,18 @@ public void testFaultyMetricsProviderOnConfigure() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
                     "waiting for server 1 down");
 
-        } finally {
-            qlogger.removeAppender(appender);
-        }
-
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
         }
-        assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
new file mode 100644
index 00000000000..c95a0d32d5e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.Appender;
+import ch.qos.logback.core.Layout;
+import ch.qos.logback.core.OutputStreamAppender;
+import ch.qos.logback.core.encoder.LayoutWrappingEncoder;
+import java.io.ByteArrayOutputStream;
+import org.slf4j.LoggerFactory;
+
+public class LoggerTestTool implements AutoCloseable {
+  private final ByteArrayOutputStream os;
+  private Appender<ILoggingEvent> appender;
+  private Logger qlogger;
+
+  public LoggerTestTool(Class<?> cls) {
+    os = createLoggingStream(cls);
+  }
+
+  public LoggerTestTool(String cls) {
+    os = createLoggingStream(cls);
+  }
+
+  public ByteArrayOutputStream getOutputStream() {
+    return os;
+  }
+
+  private ByteArrayOutputStream createLoggingStream(Class<?> cls) {
+    ByteArrayOutputStream os = new ByteArrayOutputStream();
+    appender = getConsoleAppender(os);
+    qlogger = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(cls);
+    qlogger.addAppender(appender);
+    qlogger.setLevel(Level.INFO);
+    appender.start();
+    return os;
+  }
+
+  private ByteArrayOutputStream createLoggingStream(String cls) {
+    ByteArrayOutputStream os = new ByteArrayOutputStream();
+    appender = getConsoleAppender(os);
+    qlogger = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(cls);
+    qlogger.addAppender(appender);
+    qlogger.setLevel(Level.INFO);
+    appender.start();
+    return os;
+  }
+
+  private OutputStreamAppender<ILoggingEvent> getConsoleAppender(ByteArrayOutputStream os) {
+    Logger rootLogger =
+        (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(org.slf4j.Logger.ROOT_LOGGER_NAME);
+    Layout<ILoggingEvent> layout = ((LayoutWrappingEncoder<ILoggingEvent>)
+        ((OutputStreamAppender<ILoggingEvent>) rootLogger.getAppender("CONSOLE")).getEncoder()).getLayout();
+
+    OutputStreamAppender<ILoggingEvent> appender = new OutputStreamAppender<>();
+    appender.setContext((LoggerContext) LoggerFactory.getILoggerFactory());
+    appender.setOutputStream(os);
+    appender.setLayout(layout);
+
+    return appender;
+  }
+
+  @Override
+  public void close() throws Exception {
+    qlogger.detachAppender(appender);
+    os.close();
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 43bfb2ded38..c8f4ac42cc4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -29,10 +29,6 @@
 import java.io.StringReader;
 import java.util.concurrent.TimeoutException;
 import java.util.regex.Pattern;
-import org.apache.log4j.Layout;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.NotReadOnlyException;
@@ -41,6 +37,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.ZooKeeper.States;
+import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
 import org.junit.jupiter.api.AfterEach;
@@ -294,16 +291,9 @@ public void testSeekForRwServer() throws Exception {
         qu.enableLocalSession(true);
         qu.startQuorum();
 
-        // setup the logger to capture all logs
-        Layout layout = Logger.getRootLogger().getAppender("CONSOLE").getLayout();
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = new WriterAppender(layout, os);
-        appender.setImmediateFlush(true);
-        appender.setThreshold(Level.INFO);
-        Logger zlogger = Logger.getLogger("org.apache.zookeeper");
-        zlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             qu.shutdown(2);
             CountdownWatcher watcher = new CountdownWatcher();
             ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
@@ -323,22 +313,21 @@ public void testSeekForRwServer() throws Exception {
 
             // resume poor fellow
             qu.getPeer(1).peer.resume();
-        } finally {
-            zlogger.removeAppender(appender);
-        }
 
-        os.close();
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        Pattern p = Pattern.compile(".*Majority server found.*");
-        boolean found = false;
-        while ((line = r.readLine()) != null) {
-            if (p.matcher(line).matches()) {
-                found = true;
-                break;
+            String log = os.toString();
+            assertFalse(StringUtils.isEmpty(log), "OutputStream doesn't have any log messages");
+
+            LineNumberReader r = new LineNumberReader(new StringReader(log));
+            String line;
+            Pattern p = Pattern.compile(".*Majority server found.*");
+            boolean found = false;
+            while ((line = r.readLine()) != null) {
+                if (p.matcher(line).matches()) {
+                    found = true;
+                    break;
+                }
             }
+            assertTrue(found, "Majority server wasn't found while connected to r/o server");
         }
-        assertTrue(found, "Majority server wasn't found while connected to r/o server");
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
index aae69aded87..9dc21ba272a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
@@ -48,8 +48,8 @@ public class ReconfigExceptionTest extends ZKTestCase {
     // Use DigestAuthenticationProvider.base64Encode or
     // run ZooKeeper jar with org.apache.zookeeper.server.auth.DigestAuthenticationProvider to generate password.
     // An example:
-    // java -cp zookeeper-3.6.0-SNAPSHOT.jar:lib/log4j-1.2.17.jar:lib/slf4j-log4j12-1.7.5.jar:
-    // lib/slf4j-api-1.7.5.jar org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:test
+    // java -cp zookeeper.jar:lib/slf4j-api-1.7.30.jar:lib/logback-classic-1.2.10.jar:lib/logback-core-1.2.10.jar:conf
+    // org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:test
     // The password here is 'test'.
     private static String superDigest = "super:D/InIHSb7yEEbrWz8b9l71RjZJU=";
     private QuorumUtil qu;
diff --git a/zookeeper-server/src/test/resources/log4j.properties b/zookeeper-server/src/test/resources/log4j.properties
deleted file mode 100644
index 4a2ede95503..00000000000
--- a/zookeeper-server/src/test/resources/log4j.properties
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 2012 The Apache Software Foundation
-# 
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Define some default values that can be overridden by system properties
-zookeeper.root.logger=INFO, CONSOLE
-
-zookeeper.console.threshold=INFO
-
-zookeeper.log.dir=.
-zookeeper.log.file=zookeeper.log
-zookeeper.log.threshold=INFO
-zookeeper.log.maxfilesize=256MB
-zookeeper.log.maxbackupindex=20
-
-zookeeper.tracelog.dir=${zookeeper.log.dir}
-zookeeper.tracelog.file=zookeeper_trace.log
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-#
-# console
-# Add "console" to rootlogger above if you want to use this 
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=${zookeeper.console.threshold}
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=${zookeeper.log.threshold}
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/${zookeeper.log.file}
-log4j.appender.ROLLINGFILE.MaxFileSize=${zookeeper.log.maxfilesize}
-log4j.appender.ROLLINGFILE.MaxBackupIndex=${zookeeper.log.maxbackupindex}
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log TRACE level and above messages to a log file
-#
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/zookeeper-server/src/test/resources/logback.xml b/zookeeper-server/src/test/resources/logback.xml
new file mode 100644
index 00000000000..a1e627724a5
--- /dev/null
+++ b/zookeeper-server/src/test/resources/logback.xml
@@ -0,0 +1,36 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>INFO</level>
+    </filter>
+  </appender>
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>

From 1cc1eb6a2be7323a5c326652d59a070473bb8779 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Thu, 27 Jan 2022 10:09:46 +0000
Subject: [PATCH 273/591] ZOOKEEPER-4453: NettyServerCnxnFactory: allow to
 configure the early TLS connection drop feature

- add new flag netty.server.earlyDropSecureConnectionHandshakes to turn on/off ZOOKEEPER-3682
- disable ZOOKEEPER-3682 by default
- add docs
- add tests for this patch and for ZOOKEEPER-3682

see https://issues.apache.org/jira/browse/ZOOKEEPER-4453 for more context

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1800 from eolivelli/fix/ZOOKEEPER-4453-b
---
 .../main/resources/markdown/zookeeperAdmin.md |  9 ++
 .../zookeeper/server/NettyServerCnxn.java     |  5 +-
 .../server/NettyServerCnxnFactory.java        | 16 ++--
 .../zookeeper/server/NettyServerCnxnTest.java | 88 +++++++++++++------
 4 files changed, 83 insertions(+), 35 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index eaefdda82ab..ce5dcaa01d7 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1161,6 +1161,15 @@ property, when available, is noted below.
     effect due to TLS handshake timeout when there are too many in-flight TLS
     handshakes. Set it to something like 250 is good enough to avoid herd effect.
 
+* *netty.server.earlyDropSecureConnectionHandshakes*
+  (Java system property: **zookeeper.netty.server.earlyDropSecureConnectionHandshakes**)
+    If the ZooKeeper server is not fully started, drop TCP connections before performing the TLS handshake.
+    This is useful in order to prevent flooding the server with many concurrent TLS handshakes after a restart.
+    Please note that if you enable this flag the server won't answer to 'ruok' commands if it is not fully started.
+
+    The behaviour of dropping the connection has been introduced in ZooKeeper 3.7 and it was not possible to disable it.
+    Since 3.7.1 and 3.8.0 this feature is disabled by default.
+
 * *throttledOpWaitTime*
     (Java system property: **zookeeper.throttled_op_wait_time**)
     The time in the RequestThrottler queue longer than which a request will be marked as throttled.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 269fcd942cc..8937039bca7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -522,7 +522,10 @@ private void receiveMessage(ByteBuf message) {
                         }
                         ZooKeeperServer zks = this.zkServer;
                         if (zks == null || !zks.isRunning()) {
-                            throw new IOException("ZK down");
+                            LOG.info("Closing connection to {} because the server is not ready",
+                                    getRemoteSocketAddress());
+                            close(DisconnectReason.IO_EXCEPTION);
+                            return;
                         }
                         // checkRequestSize will throw IOException if request is rejected
                         zks.checkRequestSizeWhenReceivingMessage(len);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 6b271326984..040650e4aaa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -85,6 +85,7 @@ public class NettyServerCnxnFactory extends ServerCnxnFactory {
      * Allow client-server sockets to accept both SSL and plaintext connections
      */
     public static final String PORT_UNIFICATION_KEY = "zookeeper.client.portUnification";
+    public static final String EARLY_DROP_SECURE_CONNECTION_HANDSHAKES = "zookeeper.netty.server.earlyDropSecureConnectionHandshakes";
     private final boolean shouldUsePortUnification;
 
     /**
@@ -227,11 +228,15 @@ public void channelActive(ChannelHandlerContext ctx) throws Exception {
 
             // Check the zkServer assigned to the cnxn is still running,
             // close it before starting the heavy TLS handshake
-            if (!cnxn.isZKServerRunning()) {
-                LOG.warn("Zookeeper server is not running, close the connection before starting the TLS handshake");
-                ServerMetrics.getMetrics().CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING.add(1);
-                channel.close();
-                return;
+            if (secure && !cnxn.isZKServerRunning()) {
+                boolean earlyDropSecureConnectionHandshakes = Boolean.getBoolean(EARLY_DROP_SECURE_CONNECTION_HANDSHAKES);
+                if (earlyDropSecureConnectionHandshakes) {
+                    LOG.info("Zookeeper server is not running, close the connection to {} before starting the TLS handshake",
+                            cnxn.getChannel().remoteAddress());
+                    ServerMetrics.getMetrics().CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING.add(1);
+                    channel.close();
+                    return;
+                }
             }
 
             if (handshakeThrottlingEnabled) {
@@ -510,6 +515,7 @@ private ServerBootstrap configureBootstrapAllocator(ServerBootstrap bootstrap) {
         x509Util = new ClientX509Util();
 
         boolean usePortUnification = Boolean.getBoolean(PORT_UNIFICATION_KEY);
+
         LOG.info("{}={}", PORT_UNIFICATION_KEY, usePortUnification);
         if (usePortUnification) {
             try {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index a02d5d75586..e27361c3790 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -29,6 +29,7 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.when;
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelFuture;
@@ -180,42 +181,71 @@ public void testNonMTLSRemoteConn() throws Exception {
         when(zks.isRunning()).thenReturn(true);
         ServerStats.Provider providerMock = mock(ServerStats.Provider.class);
         when(zks.serverStats()).thenReturn(new ServerStats(providerMock));
-        testNonMTLSRemoteConn(zks);
+        testNonMTLSRemoteConn(zks, false, false);
     }
 
     @Test
     public void testNonMTLSRemoteConnZookKeeperServerNotReady() throws Exception {
-        testNonMTLSRemoteConn(null);
+        testNonMTLSRemoteConn(null, false, false);
+    }
+
+    @Test
+    public void testNonMTLSRemoteConnZookKeeperServerNotReadyEarlyDropEnabled() throws Exception {
+        testNonMTLSRemoteConn(null, false, true);
+    }
+
+    @Test
+    public void testMTLSRemoteConnZookKeeperServerNotReadyEarlyDropEnabled() throws Exception {
+        testNonMTLSRemoteConn(null, true, true);
+    }
+
+    @Test
+    public void testMTLSRemoteConnZookKeeperServerNotReadyEarlyDropDisabled() throws Exception {
+        testNonMTLSRemoteConn(null, true, true);
     }
 
     @SuppressWarnings("unchecked")
-    private void testNonMTLSRemoteConn(ZooKeeperServer zks) throws Exception {
-        Channel channel = mock(Channel.class);
-        ChannelId id = mock(ChannelId.class);
-        ChannelFuture success = mock(ChannelFuture.class);
-        ChannelHandlerContext context = mock(ChannelHandlerContext.class);
-        ChannelPipeline channelPipeline = mock(ChannelPipeline.class);
-
-        when(context.channel()).thenReturn(channel);
-        when(channel.pipeline()).thenReturn(channelPipeline);
-        when(success.channel()).thenReturn(channel);
-        when(channel.closeFuture()).thenReturn(success);
-
-        InetSocketAddress address = new InetSocketAddress(0);
-        when(channel.remoteAddress()).thenReturn(address);
-        when(channel.id()).thenReturn(id);
-        NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
-        factory.setZooKeeperServer(zks);
-        Attribute atr = mock(Attribute.class);
-        Mockito.doReturn(atr).when(channel).attr(
-                Mockito.any()
-        );
-        doNothing().when(atr).set(Mockito.any());
-        factory.channelHandler.channelActive(context);
-
-        if (zks != null) {
-            assertEquals(0, zks.serverStats().getNonMTLSLocalConnCount());
-            assertEquals(1, zks.serverStats().getNonMTLSRemoteConnCount());
+    private void testNonMTLSRemoteConn(ZooKeeperServer zks, boolean secure, boolean earlyDrop) throws Exception {
+        try {
+            System.setProperty(NettyServerCnxnFactory.EARLY_DROP_SECURE_CONNECTION_HANDSHAKES, earlyDrop + "");
+
+            Channel channel = mock(Channel.class);
+            ChannelId id = mock(ChannelId.class);
+            ChannelFuture success = mock(ChannelFuture.class);
+            ChannelHandlerContext context = mock(ChannelHandlerContext.class);
+            ChannelPipeline channelPipeline = mock(ChannelPipeline.class);
+
+            when(context.channel()).thenReturn(channel);
+            when(channel.pipeline()).thenReturn(channelPipeline);
+            when(success.channel()).thenReturn(channel);
+            when(channel.closeFuture()).thenReturn(success);
+
+            InetSocketAddress address = new InetSocketAddress(0);
+            when(channel.remoteAddress()).thenReturn(address);
+            when(channel.id()).thenReturn(id);
+            NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
+            factory.setSecure(secure);
+            factory.setZooKeeperServer(zks);
+            Attribute atr = mock(Attribute.class);
+            Mockito.doReturn(atr).when(channel).attr(
+                    Mockito.any()
+            );
+            doNothing().when(atr).set(Mockito.any());
+            factory.channelHandler.channelActive(context);
+
+            if (zks != null)  {
+                assertEquals(0, zks.serverStats().getNonMTLSLocalConnCount());
+                assertEquals(1, zks.serverStats().getNonMTLSRemoteConnCount());
+            } else {
+                if (earlyDrop && secure) {
+                    // the channel must have been forcibly closed
+                    Mockito.verify(channel, times(1)).close();
+                } else {
+                    Mockito.verify(channel, times(0)).close();
+                }
+            }
+        } finally {
+            System.clearProperty(NettyServerCnxnFactory.EARLY_DROP_SECURE_CONNECTION_HANDSHAKES);
         }
     }
 

From d45d5df963cc3f7641d6dec2920bb22cfe8d0a76 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Thu, 27 Jan 2022 15:34:36 +0100
Subject: [PATCH 274/591] ZOOKEEPER-4454: Upgrade Netty to 4.1.73

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: symat@apache.org, cnauroth@apache.org

Closes #1801 from eolivelli/fix/netty-4.1.72
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.73.Final.LICENSE.txt} | 0
 ...0.Final.LICENSE.txt => netty-codec-4.1.73.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.73.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.73.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.73.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.73.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.73.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.70.Final.LICENSE.txt => netty-buffer-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.70.Final.LICENSE.txt => netty-codec-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.70.Final.LICENSE.txt => netty-common-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.70.Final.LICENSE.txt => netty-handler-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.70.Final.LICENSE.txt => netty-resolver-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.70.Final.LICENSE.txt => netty-transport-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.70.Final.LICENSE.txt => netty-transport-native-epoll-4.1.73.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 646637c80bf..3da21cfbbe0 100755
--- a/pom.xml
+++ b/pom.xml
@@ -468,7 +468,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.70.Final</netty.version>
+    <netty.version>4.1.73.Final</netty.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
     <jackson.version>2.13.1</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.73.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.70.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt

From b2c1b5af36a196ca2e9080750d212aa1a0550f7c Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Fri, 28 Jan 2022 08:27:11 +0000
Subject: [PATCH 275/591] ZOOKEEPER-4396: Read Key/trust store password from
 file

Key/trust store password is currently specified as plain text via system property or config property. To avoid exposing passwords as plain text and reduce security vulnerability, we provide the support of reading passwords from files.

The following four properties are added:

1. ssl.keyStore.passwordPath
2. ssl.quorum.keyStore.passwordPath
3. ssl.trustStore.passwordPath
4. ssl.quorum.trustStore.passwordPath

Specifies the file path that contains the key/trust store password. Reading the password from a file takes precedence over the explicit password property.

Author: liwang <liwang@apple.com>

Reviewers: hristopher Tubbs <ctubbsii@apache.org>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1773 from li4wang/ZOOKEEPER-4396
---
 .../main/resources/markdown/zookeeperAdmin.md | 12 +++
 .../markdown/zookeeperProgrammers.md          | 10 ++-
 .../apache/zookeeper/common/SecretUtils.java  | 53 +++++++++++++
 .../org/apache/zookeeper/common/X509Util.java | 34 ++++++++-
 .../org/apache/zookeeper/common/ZKConfig.java |  2 +
 .../server/admin/JettyAdminServer.java        | 27 ++++++-
 .../auth/X509AuthenticationProvider.java      | 13 +++-
 .../common/BaseX509ParameterizedTestCase.java |  4 +-
 .../zookeeper/common/SecretUtilsTest.java     | 70 ++++++++++++++++++
 .../zookeeper/common/X509TestContext.java     |  2 +
 .../apache/zookeeper/common/X509UtilTest.java | 74 +++++++++++++++++++
 .../server/admin/JettyAdminServerTest.java    | 15 ++++
 .../server/quorum/QuorumSSLTest.java          | 27 +++++++
 .../apache/zookeeper/test/ClientSSLTest.java  | 17 +++++
 14 files changed, 352 insertions(+), 8 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index ce5dcaa01d7..0b658d0c3c2 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1642,6 +1642,12 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Specifies the file path to a Java keystore containing the local
     credentials to be used for client and quorum TLS connections, and the
     password to unlock the file.
+    
+* *ssl.keyStore.passwordPath* and *ssl.quorum.keyStore.passwordPath* :
+    (Java system properties: **zookeeper.ssl.keyStore.passwordPath** and **zookeeper.ssl.quorum.keyStore.passwordPath**)
+    **New in 3.8.0:**
+    Specifies the file path that contains the keystore password. Reading the password from a file takes precedence over 
+    the explicit password property.
 
 * *ssl.keyStore.type* and *ssl.quorum.keyStore.type* :
     (Java system properties: **zookeeper.ssl.keyStore.type** and **zookeeper.ssl.quorum.keyStore.type**)
@@ -1658,6 +1664,12 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     credentials to be used for client and quorum TLS connections, and the
     password to unlock the file.
 
+* *ssl.trustStore.passwordPath* and *ssl.quorum.trustStore.passwordPath* :
+    (Java system properties: **zookeeper.ssl.trustStore.passwordPath** and **zookeeper.ssl.quorum.trustStore.passwordPath**)
+    **New in 3.8.0:**
+    Specifies the file path that contains the truststore password. Reading the password from a file takes precedence over 
+    the explicit password property.
+   
 * *ssl.trustStore.type* and *ssl.quorum.trustStore.type* :
     (Java system properties: **zookeeper.ssl.trustStore.type** and **zookeeper.ssl.quorum.trustStore.type**)
     **New in 3.5.5:**
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 7c0d4ec1f40..c2933e21dbb 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1341,11 +1341,19 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     **New in 3.5.5:**
     Specifies the file path to a JKS containing the local credentials to be used for SSL connections,
     and the password to unlock the file.
-
+    
+* *zookeeper.ssl.keyStore.passwordPath* :
+    **New in 3.8.0:**
+    Specifies the file path which contains the keystore password    
+    
 * *zookeeper.ssl.trustStore.location and zookeeper.ssl.trustStore.password* :
     **New in 3.5.5:**
     Specifies the file path to a JKS containing the remote credentials to be used for SSL connections,
     and the password to unlock the file.
+    
+* *zookeeper.ssl.trustStore.passwordPath* :
+    **New in 3.8.0:**
+    Specifies the file path which contains the truststore password       
 
 * *zookeeper.ssl.keyStore.type* and *zookeeper.ssl.trustStore.type*:
     **New in 3.5.5:**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java
new file mode 100644
index 00000000000..f20c9ce4291
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Utility class for handling secret such as key/trust store password
+ */
+public final class SecretUtils {
+    private static final Logger LOG = LoggerFactory.getLogger(SecretUtils.class);
+
+    private SecretUtils() {
+    }
+
+    public static char[] readSecret(final String pathToFile) {
+        LOG.info("Reading secret from {}", pathToFile);
+
+        try {
+            final String secretValue = new String(
+                    Files.readAllBytes(Paths.get(pathToFile)), StandardCharsets.UTF_8);
+
+            if (secretValue.endsWith(System.lineSeparator())) {
+                return secretValue.substring(0, secretValue.length() - System.lineSeparator().length()).toCharArray();
+            }
+
+            return secretValue.toCharArray();
+        } catch (final Throwable e) {
+            LOG.error("Exception occurred when reading secret from file {}", pathToFile, e);
+            throw new IllegalStateException("Exception occurred when reading secret from file " + pathToFile, e);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 52cb5fe6f0c..0cc3eb218bb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -148,9 +148,11 @@ public io.netty.handler.ssl.ClientAuth toNettyClientAuth() {
     private String cipherSuitesProperty = getConfigPrefix() + "ciphersuites";
     private String sslKeystoreLocationProperty = getConfigPrefix() + "keyStore.location";
     private String sslKeystorePasswdProperty = getConfigPrefix() + "keyStore.password";
+    private String sslKeystorePasswdPathProperty = getConfigPrefix() + "keyStore.passwordPath";
     private String sslKeystoreTypeProperty = getConfigPrefix() + "keyStore.type";
     private String sslTruststoreLocationProperty = getConfigPrefix() + "trustStore.location";
     private String sslTruststorePasswdProperty = getConfigPrefix() + "trustStore.password";
+    private String sslTruststorePasswdPathProperty = getConfigPrefix() + "trustStore.passwordPath";
     private String sslTruststoreTypeProperty = getConfigPrefix() + "trustStore.type";
     private String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
     private String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
@@ -202,6 +204,10 @@ public String getSslKeystorePasswdProperty() {
         return sslKeystorePasswdProperty;
     }
 
+    public String getSslKeystorePasswdPathProperty() {
+        return sslKeystorePasswdPathProperty;
+    }
+
     public String getSslKeystoreTypeProperty() {
         return sslKeystoreTypeProperty;
     }
@@ -214,6 +220,10 @@ public String getSslTruststorePasswdProperty() {
         return sslTruststorePasswdProperty;
     }
 
+    public String getSslTruststorePasswdPathProperty() {
+        return sslTruststorePasswdPathProperty;
+    }
+
     public String getSslTruststoreTypeProperty() {
         return sslTruststoreTypeProperty;
     }
@@ -334,7 +344,7 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
         TrustManager[] trustManagers = null;
 
         String keyStoreLocationProp = config.getProperty(sslKeystoreLocationProperty, "");
-        String keyStorePasswordProp = config.getProperty(sslKeystorePasswdProperty, "");
+        String keyStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslKeystorePasswdProperty, sslKeystorePasswdPathProperty);
         String keyStoreTypeProp = config.getProperty(sslKeystoreTypeProperty);
 
         // There are legal states in some use cases for null KeyManager or TrustManager.
@@ -354,7 +364,7 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
         }
 
         String trustStoreLocationProp = config.getProperty(sslTruststoreLocationProperty, "");
-        String trustStorePasswordProp = config.getProperty(sslTruststorePasswdProperty, "");
+        String trustStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslTruststorePasswdProperty, sslTruststorePasswdPathProperty);
         String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
 
         boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty);
@@ -413,6 +423,26 @@ public static KeyStore loadTrustStore(
             .loadTrustStore();
     }
 
+    /**
+     * Returns the password specified by the given property or from the file specified by the given path property.
+     * If both are specified, the value stored in the file will be returned.
+     *
+     * @param config  Zookeeper configuration
+     * @param propertyName  property name
+     * @param pathPropertyName path property name
+     * @return the password value
+     */
+    public String getPasswordFromConfigPropertyOrFile(final ZKConfig config,
+                                                      final String propertyName,
+                                                      final String pathPropertyName) {
+        String value = config.getProperty(propertyName, "");
+        final String pathProperty = config.getProperty(pathPropertyName, "");
+        if (!pathProperty.isEmpty()) {
+            value = String.valueOf(SecretUtils.readSecret(pathProperty));
+        }
+        return value;
+    }
+
     /**
      * Creates a key manager by loading the key store from the given file of
      * the given type, optionally decrypting it using the given password.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 6bbe698e3d2..1d1a6c9eabe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -118,9 +118,11 @@ private void putSSLProperties(X509Util x509Util) {
         properties.put(x509Util.getSslCipherSuitesProperty(), System.getProperty(x509Util.getSslCipherSuitesProperty()));
         properties.put(x509Util.getSslKeystoreLocationProperty(), System.getProperty(x509Util.getSslKeystoreLocationProperty()));
         properties.put(x509Util.getSslKeystorePasswdProperty(), System.getProperty(x509Util.getSslKeystorePasswdProperty()));
+        properties.put(x509Util.getSslKeystorePasswdPathProperty(), System.getProperty(x509Util.getSslKeystorePasswdPathProperty()));
         properties.put(x509Util.getSslKeystoreTypeProperty(), System.getProperty(x509Util.getSslKeystoreTypeProperty()));
         properties.put(x509Util.getSslTruststoreLocationProperty(), System.getProperty(x509Util.getSslTruststoreLocationProperty()));
         properties.put(x509Util.getSslTruststorePasswdProperty(), System.getProperty(x509Util.getSslTruststorePasswdProperty()));
+        properties.put(x509Util.getSslTruststorePasswdPathProperty(), System.getProperty(x509Util.getSslTruststorePasswdPathProperty()));
         properties.put(x509Util.getSslTruststoreTypeProperty(), System.getProperty(x509Util.getSslTruststoreTypeProperty()));
         properties.put(x509Util.getSslContextSupplierClassProperty(), System.getProperty(x509Util.getSslContextSupplierClassProperty()));
         properties.put(x509Util.getSslHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index d2c72178687..99241dcbdd9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -30,6 +30,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.SecretUtils;
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.eclipse.jetty.http.HttpVersion;
@@ -121,10 +122,15 @@ public JettyAdminServer(
             try (QuorumX509Util x509Util = new QuorumX509Util()) {
                 String privateKeyType = System.getProperty(x509Util.getSslKeystoreTypeProperty(), "");
                 String privateKeyPath = System.getProperty(x509Util.getSslKeystoreLocationProperty(), "");
-                String privateKeyPassword = System.getProperty(x509Util.getSslKeystorePasswdProperty(), "");
+                String privateKeyPassword = getPasswordFromSystemPropertyOrFile(
+                        x509Util.getSslKeystorePasswdProperty(),
+                        x509Util.getSslKeystorePasswdPathProperty());
+
                 String certAuthType = System.getProperty(x509Util.getSslTruststoreTypeProperty(), "");
                 String certAuthPath = System.getProperty(x509Util.getSslTruststoreLocationProperty(), "");
-                String certAuthPassword = System.getProperty(x509Util.getSslTruststorePasswdProperty(), "");
+                String certAuthPassword = getPasswordFromSystemPropertyOrFile(
+                        x509Util.getSslTruststorePasswdProperty(),
+                        x509Util.getSslTruststorePasswdPathProperty());
                 KeyStore keyStore = null, trustStore = null;
 
                 try {
@@ -289,4 +295,21 @@ private void constrainTraceMethod(ServletContextHandler ctxHandler) {
 
         ctxHandler.setSecurityHandler(securityHandler);
     }
+
+    /**
+     * Returns the password specified by the given property or stored in the file specified by the
+     * given path property. If both are specified, the password stored in the file will be returned.
+     * @param propertyName the name of the property
+     * @param pathPropertyName the name of the path property
+     * @return password value
+     */
+    private String getPasswordFromSystemPropertyOrFile(final String propertyName,
+                                                       final String pathPropertyName) {
+        String value = System.getProperty(propertyName, "");
+        final String pathValue = System.getProperty(pathPropertyName, "");
+        if (!pathValue.isEmpty()) {
+            value = String.valueOf(SecretUtils.readSecret(pathValue));
+        }
+        return value;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 1f42b2427ca..255e5cf8ae4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -45,6 +45,9 @@
  * <br>To specify store passwords, set the following system properties:
  * <br><code>zookeeper.ssl.keyStore.password</code>
  * <br><code>zookeeper.ssl.trustStore.password</code>
+ * <br>Alternatively, the passwords can be specified by the following password file path properties:
+ * <br><code>zookeeper.ssl.keyStore.passwordPath</code>
+ * <br><code>zookeeper.ssl.trustStore.passwordPath</code>
  * <br>Alternatively, this can be plugged with any X509TrustManager and
  * X509KeyManager implementation.
  */
@@ -61,13 +64,17 @@ public class X509AuthenticationProvider implements AuthenticationProvider {
      * <br><code>zookeeper.ssl.keyStore.location</code>
      * <br><code>zookeeper.ssl.trustStore.location</code>
      * <br><code>zookeeper.ssl.keyStore.password</code>
+     * <br><code>zookeeper.ssl.keyStore.passwordPath</code>
      * <br><code>zookeeper.ssl.trustStore.password</code>
+     * <br><code>zookeeper.ssl.trustStore.passwordPath</code>
      */
     public X509AuthenticationProvider() throws X509Exception {
         ZKConfig config = new ZKConfig();
         try (X509Util x509Util = new ClientX509Util()) {
             String keyStoreLocation = config.getProperty(x509Util.getSslKeystoreLocationProperty(), "");
-            String keyStorePassword = config.getProperty(x509Util.getSslKeystorePasswdProperty(), "");
+            String keyStorePassword = x509Util.getPasswordFromConfigPropertyOrFile(config,
+                    x509Util.getSslKeystorePasswdProperty(),
+                    x509Util.getSslKeystorePasswdPathProperty());
             String keyStoreTypeProp = config.getProperty(x509Util.getSslKeystoreTypeProperty());
 
             boolean crlEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslCrlEnabledProperty()));
@@ -87,7 +94,9 @@ public X509AuthenticationProvider() throws X509Exception {
             }
 
             String trustStoreLocation = config.getProperty(x509Util.getSslTruststoreLocationProperty(), "");
-            String trustStorePassword = config.getProperty(x509Util.getSslTruststorePasswdProperty(), "");
+            String trustStorePassword = x509Util.getPasswordFromConfigPropertyOrFile(config,
+                    x509Util.getSslTruststorePasswdProperty(),
+                    x509Util.getSslTruststorePasswdPathProperty());
             String trustStoreTypeProp = config.getProperty(x509Util.getSslTruststoreTypeProperty());
 
             if (trustStoreLocation.isEmpty()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
index 8c3731b81e7..344faef566d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
@@ -42,6 +42,8 @@
  * and caching the X509TestContext objects used by the tests.
  */
 public abstract class BaseX509ParameterizedTestCase extends ZKTestCase {
+    protected static final String KEY_NON_EMPTY_PASSWORD = "pa$$w0rd";
+    protected static final String KEY_EMPTY_PASSWORD = "";
 
     /**
      * Default parameters suitable for most subclasses. See example usage
@@ -53,7 +55,7 @@ public static Stream<Arguments> data() {
         int paramIndex = 0;
         for (X509KeyType caKeyType : X509KeyType.values()) {
             for (X509KeyType certKeyType : X509KeyType.values()) {
-                for (String keyPassword : new String[]{"", "pa$$w0rd"}) {
+                for (String keyPassword : new String[]{KEY_EMPTY_PASSWORD, KEY_NON_EMPTY_PASSWORD}) {
                     result.add(Arguments.of(caKeyType, certKeyType, keyPassword, paramIndex++));
                 }
             }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
new file mode 100644
index 00000000000..796cf5f9036
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.BufferedWriter;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class SecretUtilsTest {
+
+    @ParameterizedTest
+    @ValueSource (strings = {"test secret", ""})
+    public void testReadSecret(final String secretTxt) throws Exception {
+        final Path secretFile = createSecretFile(secretTxt);
+
+        final char[] secret = SecretUtils.readSecret(secretFile.toString());
+        assertEquals(secretTxt, String.valueOf(secret));
+    }
+
+    @Test
+    public void tesReadSecret_withLineSeparator() throws Exception {
+        final String secretTxt = "test secret  with line separator" + System.lineSeparator();
+        final Path secretFile = createSecretFile(secretTxt);
+
+        final char[] secret = SecretUtils.readSecret(secretFile.toString());
+        assertEquals(secretTxt.substring(0, secretTxt.length() - 1), String.valueOf(secret));
+    }
+
+    @Test
+    public void testReadSecret_fileNotExist() {
+        final String pathToFile = "NonExistingFile";
+        final IllegalStateException exception =
+                assertThrows(IllegalStateException.class, () -> SecretUtils.readSecret(pathToFile));
+        assertEquals("Exception occurred while reading secret from file " + pathToFile, exception.getMessage());
+    }
+
+    public static Path createSecretFile(final String secretTxt) throws IOException {
+        final Path path = Files.createTempFile("test_", ".secrete");
+
+        final BufferedWriter writer = new BufferedWriter(new FileWriter(path.toString()));
+        writer.append(secretTxt);
+        writer.close();
+
+        path.toFile().deleteOnExit();
+        return path;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
index 32380268c17..f672bf4686f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
@@ -381,9 +381,11 @@ public void setSystemProperties(X509Util x509Util, KeyStoreFileType keyStoreFile
     public void clearSystemProperties(X509Util x509Util) {
         System.clearProperty(x509Util.getSslKeystoreLocationProperty());
         System.clearProperty(x509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(x509Util.getSslKeystorePasswdPathProperty());
         System.clearProperty(x509Util.getSslKeystoreTypeProperty());
         System.clearProperty(x509Util.getSslTruststoreLocationProperty());
         System.clearProperty(x509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(x509Util.getSslTruststorePasswdPathProperty());
         System.clearProperty(x509Util.getSslTruststoreTypeProperty());
         System.clearProperty(x509Util.getSslHostnameVerificationEnabledProperty());
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index ad5eef86f9a..c6812ae0414 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -28,6 +28,7 @@
 import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.net.Socket;
+import java.nio.file.Path;
 import java.security.NoSuchAlgorithmException;
 import java.security.Security;
 import java.util.concurrent.Callable;
@@ -143,6 +144,57 @@ public void testCreateSSLContextWithoutKeyStorePassword(
         });
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withKeyStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                 final X509KeyType certKeyType,
+                                                                 final String keyPassword,
+                                                                 final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+
+        testCreateSSLContext_withPasswordFromFile(keyPassword,
+                x509Util.getSslKeystorePasswdProperty(),
+                x509Util.getSslKeystorePasswdPathProperty());
+    }
+
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withTrustStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                   final X509KeyType certKeyType,
+                                                                   final String keyPassword,
+                                                                   final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+
+        testCreateSSLContext_withPasswordFromFile(keyPassword,
+                x509Util.getSslTruststorePasswdProperty(),
+                x509Util.getSslTruststorePasswdPathProperty());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withWrongKeyStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                      final X509KeyType certKeyType,
+                                                                      final String keyPassword,
+                                                                      final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        testCreateSSLContext_withWrongPasswordFromFile(keyPassword, x509Util.getSslKeystorePasswdPathProperty());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withWrongTrustStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                         final X509KeyType certKeyType,
+                                                                         final String keyPassword,
+                                                                         final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        testCreateSSLContext_withWrongPasswordFromFile(keyPassword, x509Util.getSslTruststorePasswdPathProperty());
+    }
+
     @ParameterizedTest
     @MethodSource("data")
     @Timeout(value = 5)
@@ -834,4 +886,26 @@ public SSLContext get() {
 
     }
 
+    private void testCreateSSLContext_withPasswordFromFile(final String keyPassword,
+                                                           final String propertyName,
+                                                           final String pathPropertyName) throws Exception {
+
+        final Path secretFile = SecretUtilsTest.createSecretFile(keyPassword);
+
+        System.clearProperty(propertyName);
+        System.setProperty(pathPropertyName, secretFile.toString());
+
+        x509Util.getDefaultSSLContext();
+    }
+
+    private void testCreateSSLContext_withWrongPasswordFromFile(final String keyPassword,
+                                                                final String pathPropertyName) throws Exception {
+
+        final Path secretFile = SecretUtilsTest.createSecretFile(keyPassword + "_wrong");
+
+        assertThrows(X509Exception.SSLContextException.class, () -> {
+            System.setProperty(pathPropertyName, secretFile.toString());
+            x509Util.getDefaultSSLContext();
+        });
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 9cafebbc7e9..c269e199497 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.admin;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedReader;
@@ -28,6 +29,7 @@
 import java.net.HttpURLConnection;
 import java.net.SocketException;
 import java.net.URL;
+import java.nio.file.Path;
 import java.security.GeneralSecurityException;
 import java.security.Security;
 import java.security.cert.X509Certificate;
@@ -40,6 +42,7 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.KeyStoreFileType;
+import org.apache.zookeeper.common.SecretUtilsTest;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.common.X509KeyType;
 import org.apache.zookeeper.common.X509TestContext;
@@ -140,9 +143,11 @@ public void cleanUp() {
 
         System.clearProperty("zookeeper.ssl.quorum.keyStore.location");
         System.clearProperty("zookeeper.ssl.quorum.keyStore.password");
+        System.clearProperty("zookeeper.ssl.quorum.keyStore.passwordPath");
         System.clearProperty("zookeeper.ssl.quorum.keyStore.type");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.location");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.password");
+        System.clearProperty("zookeeper.ssl.quorum.trustStore.passwordPath");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.type");
         System.clearProperty("zookeeper.admin.portUnification");
         System.clearProperty("zookeeper.admin.forceHttps");
@@ -247,6 +252,16 @@ public void testForceHttpsPortUnificationDisabled() throws Exception {
         testForceHttps(false);
     }
 
+    @Test
+    public void testForceHttps_withWrongPasswordFromFile() throws Exception {
+        final Path secretFile = SecretUtilsTest.createSecretFile("" + "wrong");
+
+        System.setProperty("zookeeper.ssl.quorum.keyStore.passwordPath", secretFile.toString());
+        System.setProperty("zookeeper.ssl.quorum.trustStore.passwordPath", secretFile.toString());
+
+        assertThrows(IOException.class, () -> testForceHttps(false));
+    }
+
     private void testForceHttps(boolean portUnification) throws Exception {
         System.setProperty("zookeeper.admin.forceHttps", "true");
         System.setProperty("zookeeper.admin.portUnification", String.valueOf(portUnification));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index ec8465c7cf6..b5af84f1e60 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -35,6 +35,7 @@
 import java.math.BigInteger;
 import java.net.InetSocketAddress;
 import java.net.URLDecoder;
+import java.nio.file.Path;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.KeyStore;
@@ -59,6 +60,7 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.SecretUtilsTest;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.asn1.ocsp.OCSPResponse;
@@ -465,8 +467,10 @@ public void cleanUp() throws Exception {
     private void clearSSLSystemProperties() {
         System.clearProperty(quorumX509Util.getSslKeystoreLocationProperty());
         System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(quorumX509Util.getSslKeystorePasswdPathProperty());
         System.clearProperty(quorumX509Util.getSslTruststoreLocationProperty());
         System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(quorumX509Util.getSslTruststorePasswdPathProperty());
         System.clearProperty(quorumX509Util.getSslHostnameVerificationEnabledProperty());
         System.clearProperty(quorumX509Util.getSslOcspEnabledProperty());
         System.clearProperty(quorumX509Util.getSslCrlEnabledProperty());
@@ -495,6 +499,29 @@ public void testQuorumSSL() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
+    @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testQuorumSSL_withPasswordFromFile() throws Exception {
+        final Path secretFile = SecretUtilsTest.createSecretFile(String.valueOf(PASSWORD));
+
+        System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
+        System.setProperty(quorumX509Util.getSslKeystorePasswdPathProperty(), secretFile.toString());
+
+        System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
+        System.setProperty(quorumX509Util.getSslTruststorePasswdPathProperty(), secretFile.toString());
+
+        q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
+        q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
+        q3 = new MainThread(3, clientPortQp3, quorumConfiguration, SSL_QUORUM_ENABLED);
+
+        q1.start();
+        q2.start();
+        q3.start();
+
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp1, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
+    }
 
     @Test
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index 3996238c00c..43878e0b030 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -27,12 +27,14 @@
 import static org.junit.Assert.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
+import java.nio.file.Path;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.SecretUtilsTest;
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
@@ -67,8 +69,10 @@ public void teardown() {
         System.clearProperty(ZKClientConfig.SECURE_CLIENT);
         System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
         System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdPathProperty());
         System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
         System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdPathProperty());
         clientX509Util.close();
     }
 
@@ -110,6 +114,19 @@ public void testClientServerSSL() throws Exception {
         testClientServerSSL(true);
     }
 
+    @Test
+    public void testClientServerSSL_withPasswordFromFile() throws Exception {
+        final Path secretFile = SecretUtilsTest.createSecretFile("testpass");
+
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.setProperty(clientX509Util.getSslKeystorePasswdPathProperty(), secretFile.toString());
+
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.setProperty(clientX509Util.getSslTruststorePasswdPathProperty(), secretFile.toString());
+
+        testClientServerSSL(true);
+    }
+
     public void testClientServerSSL(boolean useSecurePort) throws Exception {
         final int SERVER_COUNT = 3;
         final int[] clientPorts = new int[SERVER_COUNT];

From 1bdba023c19dd9616bf3cd27ce68c140a286f558 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Mon, 31 Jan 2022 16:16:43 +0000
Subject: [PATCH 276/591] ZOOKEEPER-4462: Update Netty tcnative to 2.0.48

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1810 from eolivelli/ZOOKEEPER-4462
---
 pom.xml                                       |  12 ++
 zookeeper-server/pom.xml                      |   4 +
 ...-tcnative-classes-2.0.48.Final.LICENSE.txt | 202 ++++++++++++++++++
 3 files changed, 218 insertions(+)
 create mode 100644 zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index 3da21cfbbe0..78fae001892 100755
--- a/pom.xml
+++ b/pom.xml
@@ -469,6 +469,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.73.Final</netty.version>
+    <netty.tcnative.version>2.0.48.Final</netty.tcnative.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
     <jackson.version>2.13.1</jackson.version>
     <jline.version>2.14.6</jline.version>
@@ -629,12 +630,23 @@
         <groupId>io.netty</groupId>
         <artifactId>netty-handler</artifactId>
         <version>${netty.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-tcnative-classes</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-transport-native-epoll</artifactId>
         <version>${netty.version}</version>
       </dependency>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-tcnative</artifactId>
+        <version>${netty.tcnative.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-server</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 14c74ca637f..fc5c4b6ab76 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -66,6 +66,10 @@
       <groupId>io.netty</groupId>
       <artifactId>netty-handler</artifactId>
     </dependency>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-tcnative</artifactId>
+      </dependency>
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty-transport-native-epoll</artifactId>
diff --git a/zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

From 04c7ad115e298387e4a75dfe14013f6c6aa68a6d Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 1 Feb 2022 11:39:04 +0100
Subject: [PATCH 277/591] ZOOKEEPER-4461: Use logback in zookeeper-contrib
 project

I've only found Ant references in the `-recipes` projects which I don't necesseraly want to migrate, so this patch is focusing on `-contrib` projects.

Please review.

Author: Andor Molnar <andor@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1807 from anmolnar/ZOOKEEPER-4461
---
 pom.xml                                       |  18 ---
 .../zookeeper-client-c/src/zk_log.c           |   2 +-
 .../zookeeper-contrib-fatjar/pom.xml          |   6 +-
 .../zookeeper-contrib-loggraph/pom.xml        |  14 +--
 .../apache/zookeeper/graph/Log4JSource.java   |   4 +-
 .../src/main/resources/loggraph-dev.sh        |   2 +-
 .../apache/zookeeper/graph/log4j.properties   |  11 --
 .../org/apache/zookeeper/graph/logback.xml    |  38 ++++++
 .../conf/log4j.properties                     |  68 -----------
 .../zookeeper-contrib-rest/conf/logback.xml   | 114 ++++++++++++++++++
 .../zookeeper-contrib-rest/pom.xml            |  14 +--
 .../zookeeper-contrib-zooinspector/pom.xml    |  14 +--
 .../src/main/resources/log4j.properties       |   9 --
 .../src/main/resources/logback.xml            |  31 +++++
 14 files changed, 196 insertions(+), 149 deletions(-)
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties
 create mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties
 create mode 100644 zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml

diff --git a/pom.xml b/pom.xml
index 78fae001892..2bcae3b404d 100755
--- a/pom.xml
+++ b/pom.xml
@@ -464,7 +464,6 @@
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
     <junit-platform.version>1.6.2</junit-platform.version>
-    <log4j.version>1.2.17</log4j.version>
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
@@ -563,22 +562,6 @@
         <artifactId>slf4j-api</artifactId>
         <version>${slf4j.version}</version>
       </dependency>
-      <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>slf4j-log4j12</artifactId>
-        <version>${slf4j.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>*</groupId>
-            <artifactId>*</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>log4j</groupId>
-        <artifactId>log4j</artifactId>
-        <version>${log4j.version}</version>
-      </dependency>
       <dependency>
         <groupId>ch.qos.logback</groupId>
         <artifactId>logback-core</artifactId>
@@ -1009,7 +992,6 @@
         <artifactId>apache-rat-plugin</artifactId>
         <configuration>
           <excludes>
-            <exclude>**/log4j.properties</exclude>
             <exclude>**/README.md</exclude>
             <exclude>**/findbugsExcludeFile.xml</exclude>
             <exclude>**/checkstyle-noframes-sorted.xsl</exclude>
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_log.c b/zookeeper-client/zookeeper-client-c/src/zk_log.c
index 436485e97c4..79ebd61f18e 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_log.c
+++ b/zookeeper-client/zookeeper-client-c/src/zk_log.c
@@ -110,7 +110,7 @@ static const char* time_now(char* now_str){
     now = tv.tv_sec;
     localtime_r(&now, &lt);
 
-    // clone the format used by log4j ISO8601DateFormat
+    // clone the format used by logback ISO8601DateFormat
     // specifically: "yyyy-MM-dd HH:mm:ss,SSS"
 
     len = strftime(now_str, TIME_NOW_BUF_SIZE,
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
index b8d04f9c584..5b210de4417 100755
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -91,8 +91,8 @@
       <artifactId>snappy-java</artifactId>
     </dependency>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
     </dependency>
   </dependencies>
 
@@ -104,7 +104,7 @@
       <resource>
         <directory>${project.basedir}/../../conf</directory>
         <includes>
-          <include>log4j.properties</include>
+          <include>logback.xml</include>
         </includes>
       </resource>
     </resources>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
index 3c902f9f059..03e1327c6cd 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
@@ -53,18 +53,8 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
       <exclusions>
         <exclusion>
           <groupId>*</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
index 84a9d983e78..cbb65ea937a 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
@@ -293,7 +293,7 @@ private void init() throws IOException {
 	if ((line != null) && (m = timep.matcher(line)).lookingAt()) {
 	    starttime = timestampFromText(dateformat, m.group(1));
 	} else {
-	    throw new IOException("Invalid log4j format. First line doesn't start with time");
+	    throw new IOException("Invalid log format. First line doesn't start with time");
 	}
 
 	/*
@@ -328,7 +328,7 @@ private void init() throws IOException {
 	if (m.lookingAt()) {
 	    endtime = timestampFromText(dateformat, m.group(1));
 	} else {
-	    throw new IOException("Invalid log4j format. Last line doesn't start with time");
+	    throw new IOException("Invalid log format. Last line doesn't start with time");
 	}
     }
     
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
index 616ac66693c..cc1d16c6d22 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
@@ -35,4 +35,4 @@ done
 
 CLASSPATH=$BUILDDIR/classes:$WEBDIR:$CLASSPATH
 echo $CLASSPATH
-java -Dlog4j.configuration=org/apache/zookeeper/graph/log4j.properties -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
+java -Dlogback.configurationFile=org/apache/zookeeper/graph/logback.xml -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties
deleted file mode 100644
index ab8960b0e4f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties
+++ /dev/null
@@ -1,11 +0,0 @@
-log4j.rootLogger=TRACE, CONSOLE
-
-# Print the date in ISO 8601 format
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=TRACE
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
-
-log4j.logger.org.apache.zookeeper.graph.LogSkipList=off
-log4j.logger.org.apache.zookeeper.graph.RandomAccessFileReader=off
-#log4j.logger.org.apache.zookeeper.graph.Log4JSource=off
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml
new file mode 100644
index 00000000000..b28b897dc04
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml
@@ -0,0 +1,38 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>TRACE</level>
+    </filter>
+  </appender>
+
+  <logger name="org.apache.zookeeper.graph.LogSkipList" level="off"/>
+  <logger name="org.apache.zookeeper.graph.RandomAccessFileReader" level="off"/>
+
+  <root level="TRACE">
+    <appender-ref ref="CONSOLE"/>
+  </root>
+</configuration>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties b/zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties
deleted file mode 100644
index 21ba7e4851b..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties
+++ /dev/null
@@ -1,68 +0,0 @@
-#
-# 
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-# 
-#   http://www.apache.org/licenses/LICENSE-2.0
-# 
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-# 
-#
-
-#
-# ZooKeeper Logging Configuration
-#
-
-# Format is "<default threshold> (, <appender>)+
-
-# DEFAULT: console appender only
-log4j.rootLogger=INFO, CONSOLE
-
-# Example with rolling log file
-#log4j.rootLogger=DEBUG, CONSOLE, ROLLINGFILE
-
-# Example with rolling log file and tracing
-#log4j.rootLogger=TRACE, CONSOLE, ROLLINGFILE, TRACEFILE
-
-#
-# Log INFO level and above messages to the console
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=INFO
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p - [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.ROLLINGFILE=org.apache.log4j.ConsoleAppender
-log4j.appender.ROLLINGFILE.Threshold=DEBUG
-log4j.appender.ROLLINGFILE.File=bookkeeper.log
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} - %-5p - [%t:%C{1}@%L] - %m%n
-
-# Max log file size of 10MB
-log4j.appender.ROLLINGFILE.MaxFileSize=10MB
-# uncomment the next line to limit number of backup files
-#log4j.appender.ROLLINGFILE.MaxBackupIndex=10
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=bookkeeper_trace.log
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml b/zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml
new file mode 100644
index 00000000000..84a53896954
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml
@@ -0,0 +1,114 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <!-- Uncomment this if you would like to expose Logback JMX beans -->
+  <!--jmxConfigurator /-->
+
+  <property name="zookeeper.console.threshold" value="INFO" />
+
+  <property name="zookeeper.log.dir" value="." />
+  <property name="zookeeper.log.file" value="zookeeper.log" />
+  <property name="zookeeper.log.threshold" value="INFO" />
+  <property name="zookeeper.log.maxfilesize" value="256MB" />
+  <property name="zookeeper.log.maxbackupindex" value="20" />
+
+  <!--
+    console
+    Add "console" to root logger if you want to use this
+  -->
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.console.threshold}</level>
+    </filter>
+  </appender>
+
+  <!--
+    Add ROLLINGFILE to root logger to get log file output
+  -->
+  <!--appender name="ROLLINGFILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.log.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.log.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>${zookeeper.log.maxbackupindex}</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.log.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>${zookeeper.log.maxfilesize}</MaxFileSize>
+    </triggeringPolicy>
+  </appender-->
+
+  <!--
+    Add TRACEFILE to root logger to get log file output
+    Log TRACE level and above messages to a log file
+  -->
+  <!--property name="zookeeper.tracelog.dir" value="${zookeeper.log.dir}" />
+  <property name="zookeeper.tracelog.file" value="zookeeper_trace.log" />
+  <appender name="TRACEFILE" class="ch.qos.logback.core.FileAppender">
+    <File>${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>TRACE</level>
+    </filter>
+  </appender-->
+
+  <!--
+    zk audit logging
+  -->
+  <!--property name="zookeeper.auditlog.file" value="zookeeper_audit.log" />
+  <property name="zookeeper.auditlog.threshold" value="INFO" />
+  <property name="audit.logger" value="INFO, RFAAUDIT" />
+
+  <appender name="RFAAUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.auditlog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} %p %c{2}: %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.auditlog.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>10</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.auditlog.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>10MB</MaxFileSize>
+    </triggeringPolicy>
+  </appender>
+
+  <logger name="org.apache.zookeeper.audit.Slf4jAuditLogger" additivity="false" level="${audit.logger}">
+    <appender-ref ref="RFAAUDIT" />
+  </logger-->
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
index 3eae81106a0..10409b82598 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
@@ -69,18 +69,8 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
       <exclusions>
         <exclusion>
           <groupId>*</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index 1e1e3a61227..cf247c355f0 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -90,18 +90,8 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
       <exclusions>
         <exclusion>
           <groupId>*</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties
deleted file mode 100644
index db05af4d533..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties
+++ /dev/null
@@ -1,9 +0,0 @@
-# ***** Set root logger level to INFO and it appender to stdout.
-log4j.rootLogger=INFO,stdout
-
-# ***** stdout is set to be a ConsoleAppender.
-log4j.appender.stdout=org.apache.log4j.ConsoleAppender
-# ***** stdout uses PatternLayout.
-log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
-# ***** Pattern to output the caller's file name and line number.
-log4j.appender.stdout.layout.ConversionPattern=%5p [%t] (%F:%L) - %m%n
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
new file mode 100644
index 00000000000..983c188783b
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
@@ -0,0 +1,31 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <appender name="stdout" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%5p [%t] (%F:%L) - %m%n</pattern>
+    </encoder>
+  </appender>
+  <root level="INFO">
+    <appender-ref ref="stdout"/>
+  </root>
+</configuration>

From d32ec677f8fd00a367b305e1ae8abf127700511c Mon Sep 17 00:00:00 2001
From: Brent Nash <brent.nash@crowdstrike.com>
Date: Wed, 2 Feb 2022 07:39:31 +0000
Subject: [PATCH 278/591] ZOOKEEPER-4291: ZooInspector has very high latency
 when operating against remote clusters

Apache Jira Issue: https://issues.apache.org/jira/browse/ZOOKEEPER-4291
Zookeeper Contribution Guidelines: https://cwiki.apache.org/confluence/display/zookeeper/howtocontribute

This is a fairly substantial change and I will also send a note on the zookeeper-dev mailing list to start a discussion in case there are more questions/comments.

The existing version of ZooInspector had an extremely short cache retention time combined with tying high frequency UI operations to network calls which resulted in almost unusable latency when using ZooInspector to talk to a Zookeeper cluster over a network.  This change refactors the tree view to move network calls onto background threads in the TreeModel while keeping the UI itself responsive and only reloading data on request after initial node expansion.

In general, I think these changes take the tool from being virtually unusable when talking to remote clusters to being performant enough and responsive enough to be useful in most cases.

Some other related highlights include:
- Made getNumChildren() use the NodeCache (it wasn't previously)
- Remove network calls getting triggered during UI redraw animations such as using scroll bars or resizing the window
- Addition of a mouse spinner animation when work is in progress
- Addition of the number of child nodes in parentheses after the node name on the UI
- Move Add/Delete node logic to be encapsulated in TreeViewer logic (and remove separate Add/Delete NodeAction classes)
- Addition of a right-click menu item to refresh a selected subtree (previously this was only doable for the entire tree)
- Fixed the broken "Node Viewer Settings" icon and button (it previously had no icon set and didn't show on the UI)
- Fixed the broken "About" button (it previously was failing to find the about.html file)
- Fixed a number of Javadoc-related build warnings
- Fixed a number of naming typos (e.g. NodeVeiwers -> NodeViewers)
- Removed some dead/unused code

Testing
- The build succeeds, though ZooInspector currently has no unit tests.  I did test it fairly extensively with some remote clusters I have available.
<img width="974" alt="zooinspector-helix-screenshot" src="https://user-images.githubusercontent.com/33364712/148818936-065d19fc-e06b-4b00-8cae-374cd8ac82a0.png">

I have attached a screenshot of the updated version of ZooInspector (examining an Apache Helix cluster in Zookeeper).

Author: Brent Nash <brent.nash@crowdstrike.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1796 from brentwritescode/ZOOKEEPER-4291
---
 .../com/nitido/utils/toaster/Toaster.java     |  19 +-
 .../zookeeper/inspector/gui/IconResource.java |   9 +-
 .../zookeeper/inspector/gui/Toolbar.java      |  14 +-
 .../gui/ZooInspectorAboutDialog.java          |  11 +-
 ...ooInspectorConnectionPropertiesDialog.java |   2 +-
 .../gui/ZooInspectorNodeViewersDialog.java    |   5 +-
 .../gui/ZooInspectorNodeViewersPanel.java     |  56 +-
 .../inspector/gui/ZooInspectorPanel.java      |  59 +-
 .../inspector/gui/ZooInspectorTreeView.java   | 622 ++++++++++++++++++
 .../inspector/gui/ZooInspectorTreeViewer.java | 384 -----------
 .../inspector/gui/actions/AddNodeAction.java  |  74 ---
 .../gui/actions/DeleteNodeAction.java         |  79 ---
 .../gui/nodeviewer/NodeSelectionListener.java |  26 +
 .../gui/nodeviewer/NodeViewerData.java        |   8 +-
 .../inspector/logger/LoggerFactory.java       |  18 +-
 .../inspector/manager/NodesCache.java         |  55 +-
 .../manager/ZooInspectorManager.java          |   2 +-
 .../manager/ZooInspectorManagerImpl.java      | 143 +---
 .../manager/ZooInspectorReadOnlyManager.java  |  46 +-
 .../zookeeper/retry/ZooKeeperRetry.java       |   2 +-
 .../src/main/resources/about.html             |  21 +
 .../16x16/categories/applications-system.png  | Bin 0 -> 588 bytes
 .../22x22/categories/applications-system.png  | Bin 0 -> 1488 bytes
 .../24x24/categories/applications-system.png  | Bin 0 -> 2447 bytes
 .../32x32/categories/applications-system.png  | Bin 0 -> 2544 bytes
 25 files changed, 808 insertions(+), 847 deletions(-)
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/16x16/categories/applications-system.png
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/22x22/categories/applications-system.png
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/24x24/categories/applications-system.png
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/32x32/categories/applications-system.png

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
index 0a4fe94b0b3..2888caff998 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
@@ -18,9 +18,6 @@
  *
  * This is a simple example of utilization:
  *
- * import com.nitido.utils.toaster.*;
- * import javax.swing.*;
- *
  * public class ToasterTest
  * {
  *
@@ -36,10 +33,20 @@
  */
 package com.nitido.utils.toaster;
 
-import java.awt.*;
 
-import javax.swing.*;
-import javax.swing.border.*;
+import javax.swing.BorderFactory;
+import javax.swing.Icon;
+import javax.swing.JLabel;
+import javax.swing.JPanel;
+import javax.swing.JTextArea;
+import javax.swing.JWindow;
+import javax.swing.border.EtchedBorder;
+import java.awt.BorderLayout;
+import java.awt.Color;
+import java.awt.Font;
+import java.awt.GraphicsEnvironment;
+import java.awt.Insets;
+import java.awt.Rectangle;
 
 /**
  * Class to show tosters in multiplatform
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java
index 411900a9a54..46ffb0c4f1a 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java
@@ -27,12 +27,15 @@
 import org.apache.zookeeper.inspector.logger.LoggerFactory;
 
 /**
- * @see http://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
- * I tried to take icons that are available in the Tango icon set
+ * @link http://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
+ * I tried to take icons that are available in the Tango icon set.
+ *
+ * @link http://tango.freedesktop.org/Tango_Icon_Library
+ * The Tango icon set can be found under the "Download" section.
  */
 public class IconResource {
 
-    public static final String ICON_ChangeNodeViewers = "";
+    public static final String ICON_CHANGE_NODE_VIEWERS = "categories/applications-system";
     public static final String ICON_TREE_LEAF = "mimetypes/text-x-generic";
     public static final String ICON_TREE_OPEN = "places/folder";
     public static final String ICON_TREE_CLOSE = "places/folder";
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java
index 06e80a80806..99c780d8d08 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java
@@ -64,13 +64,13 @@ private void init() {
     }
 
     public static enum Button {
-        connect("Connect",IconResource.ICON_START,true),
-        disconnect("Disconnect",IconResource.ICON_STOP,false),
-        refresh("Refresh",IconResource.ICON_REFRESH,false),
-        addNode("Add Node",IconResource.ICON_DOCUMENT_ADD,false),
-        deleteNode("Delete Node",IconResource.ICON_TRASH,false),
-        nodeViewers("Change Node Viewers",IconResource.ICON_ChangeNodeViewers,true),
-        about("About ZooInspector",IconResource.ICON_HELP_ABOUT,true);
+        connect("Connect", IconResource.ICON_START, true),
+        disconnect("Disconnect", IconResource.ICON_STOP, false),
+        refresh("Refresh All", IconResource.ICON_REFRESH, false),
+        addNode("Add Node", IconResource.ICON_DOCUMENT_ADD, false),
+        deleteNode("Delete Node", IconResource.ICON_TRASH, false),
+        nodeViewers("Change Node Viewers", IconResource.ICON_CHANGE_NODE_VIEWERS, true),
+        about("About ZooInspector", IconResource.ICON_HELP_ABOUT, true);
 
         private String toolTip;
         private String icon;
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java
index 58096b26ecf..b6cdf4bf4eb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java
@@ -23,6 +23,7 @@
 import java.awt.Frame;
 import java.awt.event.ActionEvent;
 import java.awt.event.ActionListener;
+import java.io.File;
 import java.io.IOException;
 
 import javax.swing.JButton;
@@ -36,6 +37,9 @@
  * The About Dialog for the application
  */
 public class ZooInspectorAboutDialog extends JDialog {
+
+    private static final File aboutHtmlFile = new File("./src/main/resources/about.html");
+
     /**
      * @param frame
      *            - the Frame from which the dialog is displayed
@@ -53,13 +57,10 @@ public ZooInspectorAboutDialog(Frame frame, IconResource iconResource) {
         JEditorPane aboutPane = new JEditorPane();
         aboutPane.setEditable(false);
         aboutPane.setOpaque(false);
-        java.net.URL aboutURL = ZooInspectorAboutDialog.class
-                .getResource("about.html");
         try {
-            aboutPane.setPage(aboutURL);
+            aboutPane.setPage(aboutHtmlFile.toURI().toURL());
         } catch (IOException e) {
-            LoggerFactory.getLogger().error(
-                    "Error loading about.html, file may be corrupt", e);
+            LoggerFactory.getLogger().error("Error loading about.html, file may be corrupt", e);
         }
         panel.add(aboutPane, BorderLayout.CENTER);
         panel.setPreferredSize(new Dimension(600, 200));
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java
index 1647021f513..da847294ec5 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java
@@ -56,7 +56,7 @@ public class ZooInspectorConnectionPropertiesDialog extends JDialog {
     /**
      * @param lastConnectionProps
      *            - the last connection properties used. if this is the first
-     *            conneciton since starting the applications this will be the
+     *            connection since starting the applications this will be the
      *            default settings
      * @param connectionPropertiesTemplateAndLabels
      *            - the connection properties and labels to show in this dialog
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java
index e3cc7b12bcc..5c4485de5f4 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java
@@ -54,7 +54,6 @@
 import javax.swing.event.ListSelectionEvent;
 import javax.swing.event.ListSelectionListener;
 
-import org.apache.zookeeper.inspector.gui.Toolbar.Button;
 import org.apache.zookeeper.inspector.gui.nodeviewer.ZooInspectorNodeViewer;
 import org.apache.zookeeper.inspector.logger.LoggerFactory;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
@@ -90,9 +89,9 @@ public ZooInspectorNodeViewersDialog(Frame frame,
         final List<ZooInspectorNodeViewer> newViewers = new ArrayList<ZooInspectorNodeViewer>(
                 currentViewers);
         this.setLayout(new BorderLayout());
-        this.setIconImage(iconResource.get(IconResource.ICON_ChangeNodeViewers,"")
+        this.setIconImage(iconResource.get(IconResource.ICON_CHANGE_NODE_VIEWERS,"Change Node Viewers")
                 .getImage());
-        this.setTitle("About ZooInspector");
+        this.setTitle("Change Node Viewers");
         this.setModal(true);
         this.setAlwaysOnTop(true);
         this.setResizable(true);
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java
index 05c256b5a85..9c3beb15ecb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java
@@ -25,10 +25,8 @@
 import javax.swing.JTabbedPane;
 import javax.swing.event.ChangeEvent;
 import javax.swing.event.ChangeListener;
-import javax.swing.event.TreeSelectionEvent;
-import javax.swing.event.TreeSelectionListener;
-import javax.swing.tree.TreePath;
 
+import org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener;
 import org.apache.zookeeper.inspector.gui.nodeviewer.ZooInspectorNodeViewer;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
 import org.apache.zookeeper.inspector.manager.ZooInspectorNodeManager;
@@ -36,10 +34,9 @@
 /**
  * This is the {@link JPanel} which contains the {@link ZooInspectorNodeViewer}s
  */
-public class ZooInspectorNodeViewersPanel extends JPanel implements
-        TreeSelectionListener, ChangeListener {
+public class ZooInspectorNodeViewersPanel extends JPanel implements ChangeListener, NodeSelectionListener {
 
-    private final List<ZooInspectorNodeViewer> nodeVeiwers = new ArrayList<ZooInspectorNodeViewer>();
+    private final List<ZooInspectorNodeViewer> nodeViewers = new ArrayList<>();
     private final List<Boolean> needsReload = new ArrayList<Boolean>();
     private final JTabbedPane tabbedPane;
     private final List<String> selectedNodes = new ArrayList<String>();
@@ -48,17 +45,17 @@ public class ZooInspectorNodeViewersPanel extends JPanel implements
     /**
      * @param zooInspectorManager
      *            - the {@link ZooInspectorManager} for the application
-     * @param nodeVeiwers
+     * @param nodeViewers
      *            - the {@link ZooInspectorNodeViewer}s to show
      */
     public ZooInspectorNodeViewersPanel(
             ZooInspectorNodeManager zooInspectorManager,
-            List<ZooInspectorNodeViewer> nodeVeiwers) {
+            List<ZooInspectorNodeViewer> nodeViewers) {
         this.zooInspectorManager = zooInspectorManager;
         this.setLayout(new BorderLayout());
         tabbedPane = new JTabbedPane(JTabbedPane.TOP,
                 JTabbedPane.WRAP_TAB_LAYOUT);
-        setNodeViewers(nodeVeiwers);
+        setNodeViewers(nodeViewers);
         tabbedPane.addChangeListener(this);
         this.add(tabbedPane, BorderLayout.CENTER);
         reloadSelectedViewer();
@@ -69,11 +66,11 @@ public ZooInspectorNodeViewersPanel(
      *            - the {@link ZooInspectorNodeViewer}s to show
      */
     public void setNodeViewers(List<ZooInspectorNodeViewer> nodeViewers) {
-        this.nodeVeiwers.clear();
-        this.nodeVeiwers.addAll(nodeViewers);
+        this.nodeViewers.clear();
+        this.nodeViewers.addAll(nodeViewers);
         needsReload.clear();
         tabbedPane.removeAll();
-        for (ZooInspectorNodeViewer nodeViewer : nodeVeiwers) {
+        for (ZooInspectorNodeViewer nodeViewer : nodeViewers) {
             nodeViewer.setZooInspectorManager(zooInspectorManager);
             needsReload.add(true);
             tabbedPane.add(nodeViewer.getTitle(), nodeViewer);
@@ -85,42 +82,19 @@ public void setNodeViewers(List<ZooInspectorNodeViewer> nodeViewers) {
     private void reloadSelectedViewer() {
         int index = this.tabbedPane.getSelectedIndex();
         if (index != -1 && this.needsReload.get(index)) {
-            ZooInspectorNodeViewer viewer = this.nodeVeiwers.get(index);
+            ZooInspectorNodeViewer viewer = this.nodeViewers.get(index);
             viewer.nodeSelectionChanged(selectedNodes);
             this.needsReload.set(index, false);
         }
     }
 
-    /*
-     * (non-Javadoc)
-     * 
-     * @see
-     * javax.swing.event.TreeSelectionListener#valueChanged(javax.swing.event
-     * .TreeSelectionEvent)
+    /**
+     * @see org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener#nodePathSelected(String)
      */
-    public void valueChanged(TreeSelectionEvent e) {
-        TreePath[] paths = e.getPaths();
+    @Override
+    public void nodePathSelected(String nodePath) {
         selectedNodes.clear();
-        for (TreePath path : paths) {
-            boolean appended = false;
-            StringBuilder sb = new StringBuilder();
-            Object[] pathArray = path.getPath();
-            for (Object o : pathArray) {
-                if (o != null) {
-                    String nodeName = o.toString();
-                    if (nodeName != null) {
-                        if (nodeName.length() > 0) {
-                            appended = true;
-                            sb.append("/"); //$NON-NLS-1$
-                            sb.append(o.toString());
-                        }
-                    }
-                }
-            }
-            if (appended) {
-                selectedNodes.add(sb.toString());
-            }
-        }
+        selectedNodes.add(nodePath);
         for (int i = 0; i < needsReload.size(); i++) {
             this.needsReload.set(i, true);
         }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java
index e816ceb4b60..eb08e722d84 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java
@@ -26,16 +26,12 @@
 import java.util.Properties;
 import java.util.concurrent.ExecutionException;
 
-import javax.swing.JButton;
 import javax.swing.JOptionPane;
 import javax.swing.JPanel;
 import javax.swing.JScrollPane;
 import javax.swing.JSplitPane;
-import javax.swing.JToolBar;
 import javax.swing.SwingWorker;
 
-import org.apache.zookeeper.inspector.gui.actions.AddNodeAction;
-import org.apache.zookeeper.inspector.gui.actions.DeleteNodeAction;
 import org.apache.zookeeper.inspector.gui.nodeviewer.ZooInspectorNodeViewer;
 import org.apache.zookeeper.inspector.logger.LoggerFactory;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
@@ -45,10 +41,14 @@
  */
 public class ZooInspectorPanel extends JPanel implements
         NodeViewersChangeListener {
+
+    /** Control how fast the scroll bar in the tree view window moves */
+    private static final int TREE_SCROLL_UNIT_INCREMENT = 16;
+
     private final IconResource iconResource;
     private final Toolbar toolbar;
     private final ZooInspectorNodeViewersPanel nodeViewersPanel;
-    private final ZooInspectorTreeViewer treeViewer;
+    private final ZooInspectorTreeView treeViewer;
     private final ZooInspectorManager zooInspectorManager;
 
     private final List<NodeViewersChangeListener> listeners = new ArrayList<NodeViewersChangeListener>();
@@ -81,10 +81,10 @@ public ZooInspectorPanel(final ZooInspectorManager zooInspectorManager, final Ic
         }
         nodeViewersPanel = new ZooInspectorNodeViewersPanel(
                 zooInspectorManager, nodeViewers);
-        treeViewer = new ZooInspectorTreeViewer(zooInspectorManager,
-                nodeViewersPanel, iconResource);
+        this.treeViewer = new ZooInspectorTreeView(zooInspectorManager, iconResource);
+        this.treeViewer.addNodeSelectionListener(this.nodeViewersPanel);
         this.setLayout(new BorderLayout());
-        
+
         toolbar.addActionListener(Toolbar.Button.connect, new ActionListener() {
             public void actionPerformed(ActionEvent e) {
                 ZooInspectorConnectionPropertiesDialog zicpd = new ZooInspectorConnectionPropertiesDialog(
@@ -101,17 +101,20 @@ public void actionPerformed(ActionEvent e) {
         });
         toolbar.addActionListener(Toolbar.Button.refresh, new ActionListener() {
             public void actionPerformed(ActionEvent e) {
-                treeViewer.refreshView();
+                treeViewer.initialize();
+            }
+        });
+        toolbar.addActionListener(Toolbar.Button.addNode, new ActionListener() {
+            public void actionPerformed(ActionEvent e) {
+                treeViewer.createNode();
+            }
+        });
+        toolbar.addActionListener(Toolbar.Button.deleteNode, new ActionListener() {
+            public void actionPerformed(ActionEvent e) {
+                treeViewer.deleteNode();
             }
         });
-
-        toolbar.addActionListener(Toolbar.Button.addNode,
-                    new AddNodeAction(this, treeViewer, zooInspectorManager));
-        toolbar.addActionListener(Toolbar.Button.deleteNode,
-                    new DeleteNodeAction(this, treeViewer, zooInspectorManager));
-
         toolbar.addActionListener(Toolbar.Button.nodeViewers, new ActionListener() {
-
             public void actionPerformed(ActionEvent e) {
                 ZooInspectorNodeViewersDialog nvd = new ZooInspectorNodeViewersDialog(
                         JOptionPane.getRootFrame(), nodeViewers, listeners,
@@ -127,6 +130,7 @@ public void actionPerformed(ActionEvent e) {
             }
         });
         JScrollPane treeScroller = new JScrollPane(treeViewer);
+        treeScroller.getVerticalScrollBar().setUnitIncrement(TREE_SCROLL_UNIT_INCREMENT);
         JSplitPane splitPane = new JSplitPane(JSplitPane.HORIZONTAL_SPLIT,
                 treeScroller, nodeViewersPanel);
         splitPane.setResizeWeight(0.25);
@@ -152,20 +156,14 @@ protected Boolean doInBackground() throws Exception {
             protected void done() {
                 try {
                     if (get()) {
-                        treeViewer.refreshView();
+                        treeViewer.initialize();
                         toolbar.toggleButtons(true);
                     } else {
                         JOptionPane.showMessageDialog(ZooInspectorPanel.this,
                                 "Unable to connect to zookeeper", "Error",
                                 JOptionPane.ERROR_MESSAGE);
                     }
-                } catch (InterruptedException e) {
-                    LoggerFactory
-                            .getLogger()
-                            .error(
-                                    "Error occurred while connecting to ZooKeeper server",
-                                    e);
-                } catch (ExecutionException e) {
+                } catch (InterruptedException | ExecutionException e) {
                     LoggerFactory
                             .getLogger()
                             .error(
@@ -178,9 +176,6 @@ protected void done() {
         worker.execute();
     }
 
-    /**
-	 * 
-	 */
     public void disconnect() {
         disconnect(false);
     }
@@ -202,16 +197,10 @@ protected Boolean doInBackground() throws Exception {
             protected void done() {
                 try {
                     if (get()) {
-                        treeViewer.clearView();
+                        treeViewer.clear();
                         toolbar.toggleButtons(false);
                     }
-                } catch (InterruptedException e) {
-                    LoggerFactory
-                            .getLogger()
-                            .error(
-                                    "Error occurred while disconnecting from ZooKeeper server",
-                                    e);
-                } catch (ExecutionException e) {
+                } catch (InterruptedException | ExecutionException e) {
                     LoggerFactory
                             .getLogger()
                             .error(
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
new file mode 100644
index 00000000000..6bff1ca4389
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
@@ -0,0 +1,622 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector.gui;
+
+import com.nitido.utils.toaster.Toaster;
+import org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener;
+import org.apache.zookeeper.inspector.manager.NodeListener;
+import org.apache.zookeeper.inspector.manager.Pair;
+import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
+
+import javax.swing.ImageIcon;
+import javax.swing.JMenuItem;
+import javax.swing.JOptionPane;
+import javax.swing.JPanel;
+import javax.swing.JPopupMenu;
+import javax.swing.JTree;
+import javax.swing.SwingUtilities;
+import javax.swing.SwingWorker;
+import javax.swing.event.TreeExpansionEvent;
+import javax.swing.event.TreeExpansionListener;
+import javax.swing.event.TreeSelectionEvent;
+import javax.swing.event.TreeSelectionListener;
+import javax.swing.tree.DefaultMutableTreeNode;
+import javax.swing.tree.DefaultTreeCellRenderer;
+import javax.swing.tree.DefaultTreeModel;
+import javax.swing.tree.TreePath;
+import javax.swing.tree.TreeSelectionModel;
+import java.awt.BorderLayout;
+import java.awt.Color;
+import java.awt.Component;
+import java.awt.Cursor;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import java.awt.event.KeyAdapter;
+import java.awt.event.KeyEvent;
+import java.awt.event.MouseAdapter;
+import java.awt.event.MouseEvent;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+public class ZooInspectorTreeView extends JPanel {
+    private static final String PATH_SEPARATOR = "/";
+    private static final String ROOT_PATH = PATH_SEPARATOR;
+
+    private final JTree tree;
+    private final ZooInspectorTreeModel treeModel;
+
+    private final JPopupMenu rightClickMenu;
+    private final JMenuItem createChildNodeMenuItem;
+    private final JMenuItem deleteNodeMenuItem;
+    private final JMenuItem refreshNodeMenuItem;
+    private final JMenuItem addWatchMenuItem;
+    private final JMenuItem removeWatchMenuItem;
+
+    private final Toaster toasterManager;
+    private final ImageIcon toasterIcon;
+
+    private final List<NodeSelectionListener> nodeSelectionListeners = new LinkedList<>();
+
+    public ZooInspectorTreeView(final ZooInspectorManager manager, IconResource iconResource) {
+        this.toasterManager = new Toaster();
+        this.toasterManager.setBorderColor(Color.BLACK);
+        this.toasterManager.setMessageColor(Color.BLACK);
+        this.toasterManager.setToasterColor(Color.WHITE);
+        this.toasterIcon = iconResource.get(IconResource.ICON_INFORMATION, "");
+
+        // Set up tree to display all ZNodes
+        this.treeModel = new ZooInspectorTreeModel(manager);
+        this.tree = new JTree();
+        this.tree.setEditable(false);
+        this.tree.setFocusable(true);
+        this.tree.getSelectionModel().setSelectionMode(TreeSelectionModel.SINGLE_TREE_SELECTION);
+        this.tree.setModel(this.treeModel);
+        this.tree.setCellRenderer(new ZooInspectorTreeCellRenderer(iconResource));
+
+        // Set up right click menu for individual ZNodes
+        this.rightClickMenu = new JPopupMenu();
+        this.createChildNodeMenuItem = new JMenuItem("Create Child Node");
+        this.deleteNodeMenuItem = new JMenuItem("Delete Node");
+        this.refreshNodeMenuItem = new JMenuItem("Refresh Node");
+        this.addWatchMenuItem = new JMenuItem("Add Watch");
+        this.removeWatchMenuItem = new JMenuItem("Remove Watch");
+
+        // Add various event listeners (all implemented as inner classes on this class)
+        TreeEventHandler treeHandler = new TreeEventHandler();
+        MouseEventHandler mouseHandler = new MouseEventHandler();
+        KeyEventHandler keyHandler = new KeyEventHandler();
+        ActionEventHandler actionHandler = new ActionEventHandler();
+
+        this.tree.addKeyListener(keyHandler);
+        this.tree.addTreeExpansionListener(treeHandler);
+        this.tree.getSelectionModel().addTreeSelectionListener(treeHandler);
+        this.tree.addMouseListener(mouseHandler);
+        this.rightClickMenu.add(this.createChildNodeMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.deleteNodeMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.refreshNodeMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.addWatchMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.removeWatchMenuItem).addActionListener(actionHandler);
+
+        setLayout(new BorderLayout());
+        add(this.tree, BorderLayout.CENTER);
+    }
+
+    public void addNodeSelectionListener(NodeSelectionListener l) {
+        if (!this.nodeSelectionListeners.contains(l)) {
+            this.nodeSelectionListeners.add(l);
+        }
+    }
+
+    @SuppressWarnings("unused")
+    public void removeNodeSelectionListener(NodeSelectionListener l) {
+        this.nodeSelectionListeners.remove(l);
+    }
+
+    ///////////////////////////////// EVENT HANDLERS /////////////////////////////////
+
+    private class NodeEventHandler implements NodeListener {
+        @Override
+        public void processEvent(String nodePath, String eventType, Map<String, String> eventInfo) {
+            StringBuilder sb = new StringBuilder(256);
+            sb.append("Node: ");
+            sb.append(nodePath);
+            sb.append("\nEvent: ");
+            sb.append(eventType);
+            if (eventInfo != null) {
+                for (Map.Entry<String, String> entry : eventInfo.entrySet()) {
+                    sb.append("\n");
+                    sb.append(entry.getKey());
+                    sb.append(": ");
+                    sb.append(entry.getValue());
+                }
+            }
+            toasterManager.showToaster(toasterIcon, sb.toString());
+        }
+    }
+
+    public class TreeEventHandler implements TreeExpansionListener, TreeSelectionListener {
+        @Override
+        public void treeExpanded(TreeExpansionEvent event) {
+            ZooInspectorTreeNode expandingNode = (ZooInspectorTreeNode) event.getPath().getLastPathComponent();
+
+            // This whole chunk of code before the "refreshNode" call is to deal with the fact that when lazy-loading a
+            // node, we first give it a single "placeholder" empty child node to mark it as having children, but we don't
+            // actually load those children until the user decides to expand it.  These "if" statements figure out if the
+            // node has a single placeholder child or not.
+
+            if (expandingNode.isLeaf() || expandingNode.getChildCount() != 1) {
+                return;
+            }
+
+            ZooInspectorTreeNode onlyChild = ((ZooInspectorTreeNode) expandingNode.getChildAt(0));
+            if (!onlyChild.isPlaceholder()) {
+                return;
+            }
+
+            treeModel.refreshNode(expandingNode);
+        }
+
+        @Override
+        public void treeCollapsed(TreeExpansionEvent event) {
+        }
+
+        @Override
+        public void valueChanged(TreeSelectionEvent e) {
+            ZooInspectorTreeNode node = (ZooInspectorTreeNode) e.getPath().getLastPathComponent();
+            String selectedPath = node.getPathString();
+            for (NodeSelectionListener listener : nodeSelectionListeners) {
+                listener.nodePathSelected(selectedPath);
+            }
+        }
+    }
+
+    private class KeyEventHandler extends KeyAdapter {
+        @Override
+        public void keyReleased(KeyEvent e) {
+            if (!tree.hasFocus()) {
+                return;
+            }
+
+            switch (e.getKeyCode()) {
+                case KeyEvent.VK_D:
+                    deleteNode();
+                    break;
+                case KeyEvent.VK_N:
+                    createNode();
+                    break;
+                case KeyEvent.VK_R:
+                    refreshNode();
+                    break;
+                default:
+                    break;
+            }
+        }
+    }
+
+    private class ActionEventHandler implements ActionListener {
+        @Override
+        public void actionPerformed(ActionEvent e) {
+            if (e.getSource() == createChildNodeMenuItem) {
+                createNode();
+            } else if (e.getSource() == deleteNodeMenuItem) {
+                deleteNode();
+            } else if (e.getSource() == refreshNodeMenuItem) {
+                refreshNode();
+            } else if (e.getSource() == addWatchMenuItem) {
+                addWatch();
+            } else if (e.getSource() == removeWatchMenuItem) {
+                removeWatch();
+            }
+        }
+    }
+
+    private class MouseEventHandler extends MouseAdapter {
+
+        @Override
+        public void mouseClicked(MouseEvent e) {
+            ZooInspectorTreeNode selectedNode = getSelectedNode();
+            if (selectedNode == null) {
+                //If there's no node currently selected, see if the mouse is on top of one and select it
+                int selectedRow = tree.getRowForLocation(e.getX(), e.getY());
+                if (selectedRow == -1) {
+                    return;
+                }
+                tree.setSelectionRow(selectedRow);
+
+                TreePath selectedPath = tree.getPathForLocation(e.getX(), e.getY());
+                tree.setSelectionPath(selectedPath);
+            }
+
+            boolean shouldShowPopup = e.isPopupTrigger() || SwingUtilities.isRightMouseButton(e);
+            if (shouldShowPopup) {
+                rightClickMenu.show(ZooInspectorTreeView.this, e.getX(), e.getY());
+            }
+        }
+    }
+
+    ///////////////////////////////// BUSINESS LOGIC /////////////////////////////////
+
+    /**
+     * Initialize the view by creating a completely new tree by removing and refreshing all nodes.
+     */
+    public void initialize() {
+        this.treeModel.init();
+    }
+
+    /**
+     * Clear all the existing nodes from the tree view.
+     */
+    public void clear() {
+        this.treeModel.clear();
+    }
+
+    /**
+     * Start the UI workflow for creating a new ZNode as a child of the selected node.
+     */
+    public void createNode() {
+        ZooInspectorTreeNode parentNode = getSelectedNode();
+        if (parentNode == null) {
+            return;
+        }
+
+        final String newNodeName = JOptionPane.showInputDialog(
+                this,
+                "Please enter a name for the new node: ",
+                "Create Child Node",
+                JOptionPane.INFORMATION_MESSAGE);
+
+        if (newNodeName == null || newNodeName.trim().isEmpty()) {
+            return;
+        }
+
+        this.treeModel.createNode(parentNode, newNodeName);
+    }
+
+    /**
+     * Start the UI workflow for deleting the selected node.
+     */
+    public void deleteNode() {
+        ZooInspectorTreeNode nodeToDelete = getSelectedNode();
+        if (nodeToDelete == null) {
+            return;
+        }
+
+        int answer = JOptionPane.showConfirmDialog(
+                this,
+                "Are you sure you want to delete the selected node '" + nodeToDelete.getPathString() + "'?\n" +
+                        "(This action cannot be reverted)",
+                "Confirm Delete",
+                JOptionPane.YES_NO_OPTION,
+                JOptionPane.WARNING_MESSAGE
+        );
+
+        if (answer != JOptionPane.YES_OPTION) {
+            return;
+        }
+
+        this.treeModel.deleteNode(nodeToDelete);
+    }
+
+    /**
+     * Refresh the selected node (i.e. deleting all children and re-fetch them from Zookeeper).
+     */
+    public void refreshNode() {
+        ZooInspectorTreeNode nodeToRefresh = getSelectedNode();
+        if (nodeToRefresh == null) {
+            return;
+        }
+        this.treeModel.refreshNode(nodeToRefresh);
+    }
+
+    /**
+     * Add a Zookeeper watch to the selected node.
+     */
+    public void addWatch() {
+        ZooInspectorTreeNode nodeToWatch = getSelectedNode();
+        if (nodeToWatch == null) {
+            return;
+        }
+        this.treeModel.addWatch(nodeToWatch);
+    }
+
+    /**
+     * Remove a Zookeeper watch from the selected node (has no effect if the node does not have an existing watch).
+     */
+    public void removeWatch() {
+        ZooInspectorTreeNode nodeToUnwatch = getSelectedNode();
+        if (nodeToUnwatch == null) {
+            return;
+        }
+        this.treeModel.removeWatch(nodeToUnwatch);
+    }
+
+    /**
+     * @return The node object corresponding to the selected node or null if there is no node selected.
+     */
+    private ZooInspectorTreeNode getSelectedNode() {
+        TreePath selected = this.tree.getSelectionPath();
+        return selected != null ? ((ZooInspectorTreeNode) selected.getLastPathComponent()) : null;
+    }
+
+    ///////////////////////////////// BACKING DATA MODEL /////////////////////////////////
+
+    /**
+     * An implement of the backing TreeModel data for the JTree in the user interface.  Controls what data is actually
+     * available to be rendered in the UI.
+     */
+    private class ZooInspectorTreeModel extends DefaultTreeModel {
+        private final ZooInspectorManager manager;
+
+        public ZooInspectorTreeModel(ZooInspectorManager manager) {
+            super(new ZooInspectorTreeNode(ROOT_PATH, ROOT_PATH, 0));
+            this.manager = manager;
+        }
+
+        /**
+         * Create a new ZNode in Zookeeper as a child of the given parent node.
+         *
+         * @param parentNode  The parent node to create a new child ZNode underneath
+         * @param newNodeName The name of the new child ZNode to create
+         */
+        public void createNode(ZooInspectorTreeNode parentNode, String newNodeName) {
+            SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
+                @Override
+                protected Boolean doInBackground() {
+                    //runs on a background non-UI thread
+                    return manager.createNode(parentNode.getPathString(), newNodeName);
+                }
+
+                @Override
+                protected void done() {
+                    //runs on the UI event thread
+
+                    //extra logic to find the correct spot alphabetically to insert the new node in the tree`
+                    int i = 0;
+                    for (; i < parentNode.getChildCount(); i++) {
+                        ZooInspectorTreeNode existingChild = (ZooInspectorTreeNode) parentNode.getChildAt(i);
+                        if (newNodeName.compareTo(existingChild.getName()) < 0) {
+                            break;
+                        }
+                    }
+                    insertNodeInto(new ZooInspectorTreeNode(newNodeName, parentNode, 0), parentNode, i);
+                    parentNode.setNumDisplayChildren(parentNode.getNumDisplayChildren() + 1);
+                    getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
+                }
+            };
+            getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+            worker.execute();
+        }
+
+        /**
+         * Delete the specified ZNode in Zookeeper.
+         *
+         * @param nodeToDelete The node to delete.
+         */
+        public void deleteNode(ZooInspectorTreeNode nodeToDelete) {
+            SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
+                @Override
+                protected Boolean doInBackground() {
+                    //runs on a background non-UI thread
+                    return manager.deleteNode(nodeToDelete.getPathString());
+                }
+
+                @Override
+                protected void done() {
+                    //runs on the UI event thread
+                    ZooInspectorTreeNode parent = (ZooInspectorTreeNode) nodeToDelete.getParent();
+                    parent.setNumDisplayChildren(parent.getNumDisplayChildren() - 1);
+                    removeNodeFromParent(nodeToDelete);
+                    getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
+                }
+            };
+            getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+            worker.execute();
+        }
+
+        /**
+         * Refresh the specified node in the UI. Refresh is equivalent to removing all existing children from the UI
+         * view and re-fetching them from Zookeeper.
+         *
+         * @param nodeToRefresh The node whose subtree should be refreshed.
+         */
+        public void refreshNode(ZooInspectorTreeNode nodeToRefresh) {
+            SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
+                final LinkedList<Pair<String, Integer>> childrenToAdd = new LinkedList<>();
+
+                @Override
+                protected Boolean doInBackground() {
+                    //runs on a background non-UI thread
+                    //Make all the network calls here (to get children and their child counts) and collect the children,
+                    //but we can't add them to the UI until we're back on the event thread in done()
+                    List<String> children = manager.getChildren(nodeToRefresh.getPathString());
+                    if (children == null) {
+                        return false;
+                    }
+                    nodeToRefresh.setNumDisplayChildren(children.size());
+
+                    for (String childName : children) {
+                        ZooInspectorTreeNode childNode = new ZooInspectorTreeNode(childName, nodeToRefresh, 0);
+                        int numChildren = manager.getNumChildren(childNode.getPathString());
+                        childrenToAdd.add(new Pair<>(childName, numChildren));
+                    }
+                    return true;
+                }
+
+                @Override
+                protected void done() {
+                    //runs on the UI event thread
+                    nodeToRefresh.removeAllChildren();
+
+                    for (Pair<String, Integer> childPair : childrenToAdd) {
+                        ZooInspectorTreeNode childNode = new ZooInspectorTreeNode(childPair.getKey(),
+                                nodeToRefresh,
+                                childPair.getValue());
+
+                        if (childPair.getValue() > 0) {
+                            // add a placeholder child so the UI renders this node like it has children
+                            childNode.add(new ZooInspectorTreeNode());
+                        }
+                        nodeToRefresh.add(childNode);
+                    }
+
+                    reload(nodeToRefresh);
+                    getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
+                }
+            };
+            getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+            worker.execute();
+        }
+
+        /**
+         * Add a Zookeeper watch to the specified node (which will display updates in a Toast)
+         *
+         * @param nodeToWatch A reference to the node to place a watch on
+         */
+        public void addWatch(ZooInspectorTreeNode nodeToWatch) {
+            this.manager.addWatchers(Collections.singletonList(nodeToWatch.getPathString()), new NodeEventHandler());
+        }
+
+        /**
+         * Remove a Zookeeper watch from the specified node (has no effect if this node has no existing watch)
+         *
+         * @param nodeToUnwatch A reference to the node to remove a watch from
+         */
+        public void removeWatch(ZooInspectorTreeNode nodeToUnwatch) {
+            this.manager.removeWatchers(Collections.singletonList(nodeToUnwatch.getPathString()));
+        }
+
+        /**
+         * Reinitialize the entire tree by refreshing the root node.
+         */
+        public void init() {
+            refreshNode((ZooInspectorTreeNode) getRoot());
+        }
+
+        /**
+         * Clear the tree by removing all children from the root node.
+         */
+        public void clear() {
+            ZooInspectorTreeNode root = (ZooInspectorTreeNode) getRoot();
+            root.setNumDisplayChildren(0);
+            root.removeAllChildren();
+            reload();
+        }
+    }
+
+    /**
+     * A representation of a single node in the TreeModel.  Keeps track of a node's name, the number of children
+     * it has and its full Zookeeper path.
+     */
+    private static class ZooInspectorTreeNode extends DefaultMutableTreeNode {
+        private final String name;
+        private final String pathString;
+        private int numDisplayChildren;
+
+        public ZooInspectorTreeNode() {
+            this("", "", 0);
+        }
+
+        public ZooInspectorTreeNode(String name, ZooInspectorTreeNode parent, int numDisplayChildren) {
+            this(name, (PATH_SEPARATOR.equals(parent.getName()) ? "" : parent.getPathString()) + PATH_SEPARATOR + name, numDisplayChildren);
+        }
+
+        public ZooInspectorTreeNode(String name, String pathString, int numDisplayChildren) {
+            this.name = name;
+            this.pathString = pathString;
+            this.numDisplayChildren = numDisplayChildren;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) {
+                return true;
+            }
+
+            if (o == null || getClass() != o.getClass()) {
+                return false;
+            }
+
+            ZooInspectorTreeNode that = (ZooInspectorTreeNode) o;
+            return this.pathString.equals(that.pathString);
+        }
+
+        @Override
+        public int hashCode() {
+            return this.pathString.hashCode();
+        }
+
+        public boolean isPlaceholder() {
+            //A placeholder node renders as "Loading..." on the UI and is identified by having an empty name and path
+            return this.name.isEmpty() && this.getPathString().isEmpty();
+        }
+
+        public String getName() {
+            return this.name;
+        }
+
+        public String getPathString() {
+            return this.pathString;
+        }
+
+        public int getNumDisplayChildren() {
+            return this.numDisplayChildren;
+        }
+
+        public void setNumDisplayChildren(int numDisplayChildren) {
+            this.numDisplayChildren = numDisplayChildren;
+        }
+
+        @Override
+        public String toString() {
+            //NOTE: Don't mess with this; it's actually used to construct the TreePath entries; if you want to
+            //change the name on the UI display, use the TreeCellRenderer below
+            return this.name;
+        }
+    }
+
+    /**
+     * A class that controls how a given tree node is rendered in the tree on the UI (this is what's responsible for
+     * drawing "Loading..." for a placeholder node or render the # of children for a node).
+     */
+    private static class ZooInspectorTreeCellRenderer extends DefaultTreeCellRenderer {
+        public ZooInspectorTreeCellRenderer(IconResource iconResource) {
+            setLeafIcon(iconResource.get(IconResource.ICON_TREE_LEAF, ""));
+            setOpenIcon(iconResource.get(IconResource.ICON_TREE_OPEN, ""));
+            setClosedIcon(iconResource.get(IconResource.ICON_TREE_CLOSE, ""));
+        }
+
+        @Override
+        public Component getTreeCellRendererComponent(JTree tree, Object value, boolean sel, boolean expanded,
+                                                      boolean leaf, int row, boolean hasFocus) {
+            ZooInspectorTreeNode node = (ZooInspectorTreeNode) value;
+            String text = node.getName();
+
+            if (node.isPlaceholder()) {
+                text = "Loading...";
+            }
+
+            if (node.getNumDisplayChildren() > 0) {
+                text += " (" + node.getNumDisplayChildren() + ")";
+            }
+
+            return super.getTreeCellRendererComponent(tree, text, sel, expanded, leaf, row, hasFocus);
+        }
+    }
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java
deleted file mode 100644
index e08f2d3b753..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java
+++ /dev/null
@@ -1,384 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.inspector.gui;
-
-import java.awt.BorderLayout;
-import java.awt.Color;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.awt.event.InputEvent;
-import java.awt.event.KeyEvent;
-import java.awt.event.MouseAdapter;
-import java.awt.event.MouseEvent;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import javax.swing.ImageIcon;
-import javax.swing.JMenuItem;
-import javax.swing.JPanel;
-import javax.swing.JPopupMenu;
-import javax.swing.JComponent;
-import javax.swing.JTree;
-import javax.swing.SwingWorker;
-import javax.swing.event.TreeSelectionListener;
-import javax.swing.tree.DefaultMutableTreeNode;
-import javax.swing.tree.DefaultTreeCellRenderer;
-import javax.swing.tree.DefaultTreeModel;
-import javax.swing.tree.TreeNode;
-import javax.swing.tree.TreePath;
-
-import org.apache.zookeeper.inspector.gui.actions.AddNodeAction;
-import org.apache.zookeeper.inspector.gui.actions.DeleteNodeAction;
-import org.apache.zookeeper.inspector.manager.NodeListener;
-import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
-
-import com.nitido.utils.toaster.Toaster;
-import static javax.swing.KeyStroke.getKeyStroke;
-
-/**
- * A {@link JPanel} for showing the tree view of all the nodes in the zookeeper
- * instance
- */
-public class ZooInspectorTreeViewer extends JPanel implements NodeListener {
-    private final ZooInspectorManager zooInspectorManager;
-    private final JTree tree;
-    private final Toaster toasterManager;
-    private final ImageIcon toasterIcon;
-
-    /**
-     * @param zooInspectorManager
-     *            - the {@link ZooInspectorManager} for the application
-     * @param listener
-     *            - the {@link TreeSelectionListener} to listen for changes in
-     *            the selected node on the node tree
-     */
-    public ZooInspectorTreeViewer(
-            final ZooInspectorManager zooInspectorManager,
-            TreeSelectionListener listener, IconResource iconResource) {
-
-        this.getInputMap(JComponent.WHEN_IN_FOCUSED_WINDOW)
-                .put(getKeyStroke(KeyEvent.VK_D, InputEvent.CTRL_MASK), "deleteNode");
-
-        this.getActionMap().put("deleteNode",
-                new DeleteNodeAction(this, this, zooInspectorManager));
-
-        this.getInputMap(JComponent.WHEN_IN_FOCUSED_WINDOW)
-                .put(getKeyStroke(KeyEvent.VK_N, InputEvent.CTRL_MASK), "addNode");
-
-        this.getActionMap().put("addNode",
-                new AddNodeAction(this, this, zooInspectorManager));
-
-        this.zooInspectorManager = zooInspectorManager;
-        this.setLayout(new BorderLayout());
-        final JPopupMenu popupMenu = new JPopupMenu();
-
-        final JMenuItem addNode = new JMenuItem("Add Node");
-        addNode.addActionListener(new AddNodeAction(this, this, zooInspectorManager));
-
-        final JMenuItem deleteNode = new JMenuItem("Delete Node");
-        deleteNode.addActionListener(new DeleteNodeAction(this, this, zooInspectorManager));
-
-        final JMenuItem addNotify = new JMenuItem("Add Change Notification");
-        this.toasterManager = new Toaster();
-        this.toasterManager.setBorderColor(Color.BLACK);
-        this.toasterManager.setMessageColor(Color.BLACK);
-        this.toasterManager.setToasterColor(Color.WHITE);
-        toasterIcon = iconResource.get(IconResource.ICON_INFORMATION,"");
-        addNotify.addActionListener(new ActionListener() {
-            public void actionPerformed(ActionEvent e) {
-                List<String> selectedNodes = getSelectedNodes();
-                zooInspectorManager.addWatchers(selectedNodes,
-                        ZooInspectorTreeViewer.this);
-            }
-        });
-        final JMenuItem removeNotify = new JMenuItem(
-                "Remove Change Notification");
-        removeNotify.addActionListener(new ActionListener() {
-            public void actionPerformed(ActionEvent e) {
-                List<String> selectedNodes = getSelectedNodes();
-                zooInspectorManager.removeWatchers(selectedNodes);
-            }
-        });
-        tree = new JTree(new DefaultMutableTreeNode());
-        tree.setCellRenderer(new ZooInspectorTreeCellRenderer(iconResource));
-        tree.setEditable(false);
-        tree.getSelectionModel().addTreeSelectionListener(listener);
-        tree.addMouseListener(new MouseAdapter() {
-            @Override
-            public void mouseClicked(MouseEvent e) {
-                if (e.isPopupTrigger() || e.getButton() == MouseEvent.BUTTON3) {
-                    // TODO only show add if a selected node isn't being
-                    // watched, and only show remove if a selected node is being
-                    // watched
-                    popupMenu.removeAll();
-                    popupMenu.add(addNode);
-                    popupMenu.add(deleteNode);
-                    popupMenu.add(addNotify);
-                    popupMenu.add(removeNotify);
-                    popupMenu.show(ZooInspectorTreeViewer.this, e.getX(), e
-                            .getY());
-                }
-            }
-        });
-        this.add(tree, BorderLayout.CENTER);
-    }
-
-    /**
-     * Refresh the tree view
-     */
-    public void refreshView() {
-        final Set<TreePath> expandedNodes = new LinkedHashSet<TreePath>();
-        int rowCount = tree.getRowCount();
-        for (int i = 0; i < rowCount; i++) {
-            TreePath path = tree.getPathForRow(i);
-            if (tree.isExpanded(path)) {
-                expandedNodes.add(path);
-            }
-        }
-        final TreePath[] selectedNodes = tree.getSelectionPaths();
-        SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
-
-            @Override
-            protected Boolean doInBackground() throws Exception {
-                tree.setModel(new DefaultTreeModel(new ZooInspectorTreeNode(
-                        "/", null)));
-                return true;
-            }
-
-            @Override
-            protected void done() {
-                for (TreePath path : expandedNodes) {
-                    tree.expandPath(path);
-                }
-                tree.getSelectionModel().setSelectionPaths(selectedNodes);
-            }
-        };
-        worker.execute();
-    }
-
-    /**
-     * clear the tree view of all nodes
-     */
-    public void clearView() {
-        tree.setModel(new DefaultTreeModel(new DefaultMutableTreeNode()));
-    }
-
-    private static class ZooInspectorTreeCellRenderer extends
-            DefaultTreeCellRenderer {
-        public ZooInspectorTreeCellRenderer(IconResource iconResource) {
-            setLeafIcon(iconResource.get(IconResource.ICON_TREE_LEAF,""));
-            setOpenIcon(iconResource.get(IconResource.ICON_TREE_OPEN,""));
-            setClosedIcon(iconResource.get(IconResource.ICON_TREE_CLOSE,""));
-        }
-    }
-
-    private class ZooInspectorTreeNode implements TreeNode {
-        private final String nodePath;
-        private final String nodeName;
-        private final ZooInspectorTreeNode parent;
-
-        public ZooInspectorTreeNode(String nodePath, ZooInspectorTreeNode parent) {
-            this.parent = parent;
-            this.nodePath = nodePath;
-            int index = nodePath.lastIndexOf("/");
-            if (index == -1) {
-                throw new IllegalArgumentException("Invalid node path"
-                        + nodePath);
-            }
-            this.nodeName = nodePath.substring(index + 1);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#children()
-         */
-        public Enumeration<TreeNode> children() {
-            List<String> children = zooInspectorManager
-                    .getChildren(this.nodePath);
-            Collections.sort(children);
-            List<TreeNode> returnChildren = new ArrayList<TreeNode>();
-            for (String child : children) {
-                returnChildren.add(new ZooInspectorTreeNode((this.nodePath
-                        .equals("/") ? "" : this.nodePath)
-                        + "/" + child, this));
-            }
-            return Collections.enumeration(returnChildren);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getAllowsChildren()
-         */
-        public boolean getAllowsChildren() {
-            return zooInspectorManager.isAllowsChildren(this.nodePath);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getChildAt(int)
-         */
-        public TreeNode getChildAt(int childIndex) {
-            String child = zooInspectorManager.getNodeChild(this.nodePath,
-                    childIndex);
-            if (child != null) {
-                return new ZooInspectorTreeNode((this.nodePath.equals("/") ? ""
-                        : this.nodePath)
-                        + "/" + child, this);
-            }
-            return null;
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getChildCount()
-         */
-        public int getChildCount() {
-            return zooInspectorManager.getNumChildren(this.nodePath);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getIndex(javax.swing.tree.TreeNode)
-         */
-        public int getIndex(TreeNode node) {
-            return zooInspectorManager.getNodeIndex(this.nodePath);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getParent()
-         */
-        public TreeNode getParent() {
-            return this.parent;
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#isLeaf()
-         */
-        public boolean isLeaf() {
-            return !zooInspectorManager.hasChildren(this.nodePath);
-        }
-
-        @Override
-        public String toString() {
-            return this.nodeName;
-        }
-
-        @Override
-        public int hashCode() {
-            final int prime = 31;
-            int result = 1;
-            result = prime * result + getOuterType().hashCode();
-            result = prime * result
-                    + ((nodePath == null) ? 0 : nodePath.hashCode());
-            result = prime * result
-                    + ((parent == null) ? 0 : parent.hashCode());
-            return result;
-        }
-
-        @Override
-        public boolean equals(Object obj) {
-            if (this == obj)
-                return true;
-            if (obj == null)
-                return false;
-            if (getClass() != obj.getClass())
-                return false;
-            ZooInspectorTreeNode other = (ZooInspectorTreeNode) obj;
-            if (!getOuterType().equals(other.getOuterType()))
-                return false;
-            if (nodePath == null) {
-                if (other.nodePath != null)
-                    return false;
-            } else if (!nodePath.equals(other.nodePath))
-                return false;
-            if (parent == null) {
-                if (other.parent != null)
-                    return false;
-            } else if (!parent.equals(other.parent))
-                return false;
-            return true;
-        }
-
-        private ZooInspectorTreeViewer getOuterType() {
-            return ZooInspectorTreeViewer.this;
-        }
-
-    }
-
-    /**
-     * @return {@link List} of the currently selected nodes
-     */
-    public List<String> getSelectedNodes() {
-        TreePath[] paths = tree.getSelectionPaths();
-        List<String> selectedNodes = new ArrayList<String>();
-        if (paths != null) {
-            for (TreePath path : paths) {
-                StringBuilder sb = new StringBuilder();
-                Object[] pathArray = path.getPath();
-                for (Object o : pathArray) {
-                    String nodeName = o.toString();
-                    if (nodeName.length() > 0) {
-                        sb.append("/");
-                        sb.append(o.toString());
-                    }
-                }
-                selectedNodes.add(sb.toString());
-            }
-        }
-        return selectedNodes;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @see
-     * org.apache.zookeeper.inspector.manager.NodeListener#processEvent(java
-     * .lang.String, java.lang.String, java.util.Map)
-     */
-    public void processEvent(String nodePath, String eventType,
-            Map<String, String> eventInfo) {
-        StringBuilder sb = new StringBuilder();
-        sb.append("Node: ");
-        sb.append(nodePath);
-        sb.append("\nEvent: ");
-        sb.append(eventType);
-        if (eventInfo != null) {
-            for (Map.Entry<String, String> entry : eventInfo.entrySet()) {
-                sb.append("\n");
-                sb.append(entry.getKey());
-                sb.append(": ");
-                sb.append(entry.getValue());
-            }
-        }
-        this.toasterManager.showToaster(toasterIcon, sb.toString());
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java
deleted file mode 100644
index 30916112a2f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.inspector.gui.actions;
-
-import org.apache.zookeeper.inspector.gui.ZooInspectorPanel;
-import org.apache.zookeeper.inspector.gui.ZooInspectorTreeViewer;
-import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
-
-import javax.swing.*;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.util.List;
-import java.awt.event.KeyEvent;
-
-public class AddNodeAction extends AbstractAction {
-
-    private JPanel panel;
-    private ZooInspectorTreeViewer treeViewer;
-    private ZooInspectorManager zooInspectorManager;
-
-    public AddNodeAction(JPanel parentPanel,
-                         ZooInspectorTreeViewer treeViewer,
-                         ZooInspectorManager zooInspectorManager) {
-        this.panel = parentPanel;
-        this.treeViewer = treeViewer;
-        this.zooInspectorManager = zooInspectorManager;
-    }
-
-    public void actionPerformed(ActionEvent e) {
-        final List<String> selectedNodes = treeViewer
-                .getSelectedNodes();
-        if (selectedNodes.size() == 1) {
-            final String nodeName = JOptionPane.showInputDialog(
-                    panel,
-                    "Please Enter a name for the new node",
-                    "Create Node", JOptionPane.INFORMATION_MESSAGE);
-            if (nodeName != null && nodeName.length() > 0) {
-                SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
-
-                    @Override
-                    protected Boolean doInBackground() throws Exception {
-                        return zooInspectorManager
-                                .createNode(selectedNodes.get(0),
-                                        nodeName);
-                    }
-
-                    @Override
-                    protected void done() {
-                        treeViewer.refreshView();
-                    }
-                };
-                worker.execute();
-            }
-        } else {
-            JOptionPane.showMessageDialog(panel,
-                    "Please select 1 parent node for the new node.");
-        }
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java
deleted file mode 100644
index 90016701e68..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.inspector.gui.actions;
-
-import org.apache.zookeeper.inspector.gui.ZooInspectorTreeViewer;
-import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
-
-import javax.swing.*;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.util.List;
-import java.awt.event.KeyEvent;
-
-public class DeleteNodeAction extends AbstractAction {
-
-    private JPanel parentPanel;
-    private ZooInspectorTreeViewer treeViewer;
-    private ZooInspectorManager zooInspectorManager;
-
-    public DeleteNodeAction(JPanel parentPanel,
-                            ZooInspectorTreeViewer treeViewer,
-                            ZooInspectorManager zooInspectorManager) {
-        this.parentPanel = parentPanel;
-        this.treeViewer = treeViewer;
-        this.zooInspectorManager = zooInspectorManager;
-    }
-
-
-    public void actionPerformed(ActionEvent e) {
-        final List<String> selectedNodes = treeViewer
-                .getSelectedNodes();
-        if (selectedNodes.size() == 0) {
-            JOptionPane.showMessageDialog(parentPanel,
-                    "Please select at least 1 node to be deleted");
-        } else {
-            int answer = JOptionPane.showConfirmDialog(
-                    parentPanel,
-                    "Are you sure you want to delete the selected nodes?"
-                            + "(This action cannot be reverted)",
-                    "Confirm Delete", JOptionPane.YES_NO_OPTION,
-                    JOptionPane.WARNING_MESSAGE
-            );
-            if (answer == JOptionPane.YES_OPTION) {
-                SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
-
-                    @Override
-                    protected Boolean doInBackground() throws Exception {
-                        for (String nodePath : selectedNodes) {
-                            zooInspectorManager
-                                    .deleteNode(nodePath);
-                        }
-                        return true;
-                    }
-
-                    @Override
-                    protected void done() {
-                        treeViewer.refreshView();
-                    }
-                };
-                worker.execute();
-            }
-        }
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
new file mode 100644
index 00000000000..a39edd55dc9
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
@@ -0,0 +1,26 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector.gui.nodeviewer;
+
+/**
+ * An interface to be implented by any component that needs notification when a new element
+ * is selected in the UI JTree representing the set of available ZNodes.
+ */
+public interface NodeSelectionListener {
+    void nodePathSelected(String nodePath);
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java
index 6061e17bf8c..32e269ca090 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java
@@ -60,7 +60,7 @@ public NodeViewerData() {
             public void actionPerformed(ActionEvent e) {
                 if (selectedNode != null) {
                     if (JOptionPane.showConfirmDialog(NodeViewerData.this,
-                            "Are you sure you want to save this node?"
+                            "Are you sure you want to save the node '" + selectedNode + "'?\n"
                                     + " (this action cannot be reverted)",
                             "Confirm Save", JOptionPane.YES_NO_OPTION,
                             JOptionPane.WARNING_MESSAGE) == JOptionPane.YES_OPTION) {
@@ -110,11 +110,7 @@ protected void done() {
                     String data = "";
                     try {
                         data = get();
-                    } catch (InterruptedException e) {
-                        LoggerFactory.getLogger().error(
-                                "Error retrieving data for node: "
-                                        + NodeViewerData.this.selectedNode, e);
-                    } catch (ExecutionException e) {
+                    } catch (InterruptedException | ExecutionException e) {
                         LoggerFactory.getLogger().error(
                                 "Error retrieving data for node: "
                                         + NodeViewerData.this.selectedNode, e);
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java
index e4fae41698b..c775d643e4c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java
@@ -18,19 +18,19 @@
 package org.apache.zookeeper.inspector.logger;
 
 /**
- * Provides a {@link Logger} for use across the entire application
+ * Provides a {@link org.slf4j.Logger} for use across the entire application
  * 
  */
 public class LoggerFactory
 {
-	private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger("org.apache.zookeeper.inspector"); //$NON-NLS-1$
+    private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger("org.apache.zookeeper.inspector"); //$NON-NLS-1$
 
-	/**
-	 * @return {@link Logger} for ZooInspector
-	 */
-	public static org.slf4j.Logger getLogger()
-	{
-		return logger;
-	}
+    /**
+     * @return {@link org.slf4j.Logger} for ZooInspector
+     */
+    public static org.slf4j.Logger getLogger()
+    {
+        return logger;
+    }
 
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java
index 45c5a275272..da30596a6f8 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java
@@ -26,14 +26,17 @@
 
 import java.util.Collections;
 import java.util.List;
-import java.util.concurrent.ExecutionException;
 import java.util.concurrent.TimeUnit;
 
+/**
+ * A local cache of ZNodes in front of the Zookeeper server(s) to help cut down on network calls.  This class will
+ * return results from the cache first, if available, and then fetch results remotely from Zookeeper if not.
+ */
 public class NodesCache {
 
     public static final int CACHE_SIZE = 40000;
 
-    public static final int EXPIRATION_TIME = 100;
+    public static final int ENTRY_EXPIRATION_TIME_MILLIS = 10000;
 
     private final LoadingCache<String, List<String>> nodes;
 
@@ -43,18 +46,26 @@ public NodesCache(ZooKeeper zooKeeper) {
         this.zooKeeper = zooKeeper;
         this.nodes = CacheBuilder.newBuilder()
                 .maximumSize(CACHE_SIZE)
-                .expireAfterWrite(EXPIRATION_TIME, TimeUnit.MILLISECONDS)
-                .build(
-                        new CacheLoader<String, List<String>>() {
-                            @Override
-                            public List<String> load(String nodePath) throws Exception {
-                                return getChildren(nodePath);
-                            }
-                        }
+                .expireAfterWrite(ENTRY_EXPIRATION_TIME_MILLIS, TimeUnit.MILLISECONDS)
+                .build(new CacheLoader<String, List<String>>() {
+                           @Override
+                           public List<String> load(String nodePath) {
+                               return getChildrenRemote(nodePath);
+                           }
+                       }
                 );
     }
 
-    public List<String> getChildren(String nodePath) {
+    /**
+     * Whereas getChildren hits the cache first, getChildrenRemote goes straight (over the network) to Zookeeper to
+     * get the answer.  This is the function used by the cache to insert entries that are requested, but don't exist
+     * in the cache yet.
+     *
+     * @param nodePath The full path to the parent whose children are to be fetched.
+     * @return The list of children of the given node as a list of full ZNode path strings or null if an
+     * error occurred.
+     */
+    private List<String> getChildrenRemote(String nodePath) {
         try {
             Stat s = zooKeeper.exists(nodePath, false);
             if (s != null) {
@@ -64,23 +75,25 @@ public List<String> getChildren(String nodePath) {
             }
         } catch (Exception e) {
             LoggerFactory.getLogger().error(
-                    "Error occurred retrieving child of node: " + nodePath, e
+                    "Error occurred retrieving children of node: " + nodePath, e
             );
         }
         return null;
     }
 
-    public String getNodeChild(String nodePath, int index) {
-        List<String> childNodes = null;
+    /**
+     * Fetch the children of the given node from the cache.
+     *
+     * @param nodePath The full path to the parent whose children are to be fetched.
+     * @return The list of children of the given node as a list of full ZNode path strings or null if an
+     * error occurred.
+     */
+    public List<String> getChildren(String nodePath) {
         try {
-            childNodes = nodes.get(nodePath);
-            return childNodes.get(index);
-        } catch (ExecutionException e) {
-            LoggerFactory.getLogger().error(
-                    "Error occurred retrieving child " + index + "of node: " + nodePath, e
-            );
+            return nodes.get(nodePath);
+        } catch (Exception e) {
+            LoggerFactory.getLogger().error("Error occurred retrieving children of node: " + nodePath, e);
         }
         return null;
     }
-
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
index 74c3cb20e88..030b7d2ee74 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
@@ -55,7 +55,7 @@ public interface ZooInspectorManager extends ZooInspectorNodeManager,
      *         {@link JComboBox} with the first selected as default.</li>
      *         <li>a {@link Map} of property keys to the label to show on the UI
      *         </li>
-     *         <ul>
+     *         </ul>
      * 
      */
     public Pair<Map<String, List<String>>, Map<String, String>> getConnectionPropertiesTemplate();
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
index aa9ff6e322e..0db6140acb3 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
@@ -190,7 +190,7 @@ public void process(WatchedEvent event) {
             e.printStackTrace();
         }
         if (!connected){
-        	disconnect();
+            disconnect();
         } else {
             this.nodesCache = new NodesCache(zooKeeper);
         }
@@ -223,7 +223,7 @@ public boolean disconnect() {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
      * getChildren(java.lang.String)
      */
     public List<String> getChildren(String nodePath) {
@@ -260,46 +260,6 @@ public String getData(String nodePath) {
         return null;
     }
 
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * getNodeChild(java.lang.String, int)
-     */
-    public String getNodeChild(String nodePath, int childIndex) {
-        if (connected) {
-             return this.nodesCache.getNodeChild(nodePath, childIndex);
-        }
-        return null;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * getNodeIndex(java.lang.String)
-     */
-    public int getNodeIndex(String nodePath) {
-        if (connected) {
-            int index = nodePath.lastIndexOf("/");
-            if (index == -1
-                    || (!nodePath.equals("/") && nodePath.charAt(nodePath
-                            .length() - 1) == '/')) {
-                throw new IllegalArgumentException("Invalid node path: "
-                        + nodePath);
-            }
-            String parentPath = nodePath.substring(0, index);
-            String child = nodePath.substring(index + 1);
-            if (parentPath != null && parentPath.length() > 0) {
-                List<String> children = this.nodesCache.getChildren(parentPath);
-                if (children != null) {
-                    return children.indexOf(child);
-                }
-            }
-        }
-        return -1;
-    }
-
     /*
      * (non-Javadoc)
      * 
@@ -360,11 +320,7 @@ public List<Map<String, String>> getACLs(String nodePath) {
                         returnACLs.add(aclMap);
                     }
                 }
-            } catch (InterruptedException e) {
-                LoggerFactory.getLogger().error(
-                        "Error occurred retrieving ACLs of node: " + nodePath,
-                        e);
-            } catch (KeeperException e) {
+            } catch (InterruptedException | KeeperException e) {
                 LoggerFactory.getLogger().error(
                         "Error occurred retrieving ACLs of node: " + nodePath,
                         e);
@@ -376,7 +332,7 @@ public List<Map<String, String>> getACLs(String nodePath) {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
      * getNodeMeta(java.lang.String)
      */
     public Map<String, String> getNodeMeta(String nodePath) {
@@ -415,81 +371,11 @@ public Map<String, String> getNodeMeta(String nodePath) {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
      * getNumChildren(java.lang.String)
      */
     public int getNumChildren(String nodePath) {
-        if (connected) {
-            try {
-                Stat s = zooKeeper.exists(nodePath, false);
-                if (s != null) {
-                    return s.getNumChildren();
-                }
-            } catch (Exception e) {
-                LoggerFactory.getLogger().error(
-                        "Error occurred getting the number of children of node: "
-                                + nodePath, e);
-            }
-        }
-        return -1;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * hasChildren(java.lang.String)
-     */
-    public boolean hasChildren(String nodePath) {
-        return getNumChildren(nodePath) > 0;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * isAllowsChildren(java.lang.String)
-     */
-    public boolean isAllowsChildren(String nodePath) {
-        if (connected) {
-            try {
-                Stat s = zooKeeper.exists(nodePath, false);
-                if (s != null) {
-                    return s.getEphemeralOwner() == 0;
-                }
-            } catch (Exception e) {
-                LoggerFactory.getLogger().error(
-                        "Error occurred determining whether node is allowed children: "
-                                + nodePath, e);
-            }
-        }
-        return false;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * getSessionMeta()
-     */
-    public Map<String, String> getSessionMeta() {
-        Map<String, String> sessionMeta = new LinkedHashMap<String, String>();
-        try {
-            if (zooKeeper != null) {
-
-                sessionMeta.put(SESSION_ID, String.valueOf(zooKeeper
-                        .getSessionId()));
-                sessionMeta.put(SESSION_STATE, String.valueOf(zooKeeper
-                        .getState().toString()));
-                sessionMeta.put(CONNECT_STRING, this.connectString);
-                sessionMeta.put(SESSION_TIMEOUT, String
-                        .valueOf(this.sessionTimeout));
-            }
-        } catch (Exception e) {
-            LoggerFactory.getLogger().error(
-                    "Error occurred retrieving session meta data.", e);
-        }
-        return sessionMeta;
+        return connected ? getChildren(nodePath).size() : -1;
     }
 
     /*
@@ -576,7 +462,7 @@ public boolean setData(String nodePath, String data) {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * getConnectionPropertiesTemplate()
      */
     public Pair<Map<String, List<String>>, Map<String, String>> getConnectionPropertiesTemplate() {
@@ -696,7 +582,7 @@ public void process(WatchedEvent event) {
                     }
                 } catch (Exception e) {
                     LoggerFactory.getLogger().error(
-                            "Error occurred re-adding node watcherfor node "
+                            "Error occurred re-adding node watcher for node "
                                     + nodePath, e);
                 }
                 nodeListener.processEvent(event.getPath(), event.getType()
@@ -704,9 +590,6 @@ public void process(WatchedEvent event) {
             }
         }
 
-        /**
-		 * 
-		 */
         public void stop() {
             this.closed = true;
         }
@@ -716,7 +599,7 @@ public void stop() {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * loadNodeViewersFile(java.io.File)
      */
     public List<String> loadNodeViewersFile(File selectedFile)
@@ -768,7 +651,7 @@ private void loadDefaultConnectionFile() throws IOException {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * saveDefaultConnectionFile(java.util.Properties)
      */
     public void saveDefaultConnectionFile(Properties props) throws IOException {
@@ -798,7 +681,7 @@ public void saveDefaultConnectionFile(Properties props) throws IOException {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * saveNodeViewersFile(java.io.File, java.util.List)
      */
     public void saveNodeViewersFile(File selectedFile,
@@ -830,7 +713,7 @@ public void saveNodeViewersFile(File selectedFile,
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * setDefaultNodeViewerConfiguration(java.io.File, java.util.List)
      */
     public void setDefaultNodeViewerConfiguration(
@@ -857,7 +740,7 @@ public List<String> getDefaultNodeViewerConfiguration() throws IOException {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * getLastConnectionProps()
      */
     public Properties getLastConnectionProps() {
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java
index d9fdf5c4a08..69ce842a1cb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java
@@ -28,72 +28,36 @@ public interface ZooInspectorReadOnlyManager {
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose data is to be retrieved
      * @return the data for the node
      */
     public abstract String getData(String nodePath);
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose metadata is to be retrieved
      * @return the metaData for the node
      */
     public abstract Map<String, String> getNodeMeta(String nodePath);
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose ACLs are to be retrieved
      * @return the ACLs set on the node
      */
     public abstract List<Map<String, String>> getACLs(String nodePath);
 
-    /**
-     * @return the metaData for the current session
-     */
-    public abstract Map<String, String> getSessionMeta();
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
-     * @return true if the node has children
-     */
-    public abstract boolean hasChildren(String nodePath);
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
-     * @return the index of the node within its siblings
-     */
-    public abstract int getNodeIndex(String nodePath);
-
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node to parent node
      * @return the number of children of the node
      */
     public abstract int getNumChildren(String nodePath);
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
-     * @param childIndex
-     *            - the index to the node in the list of node children
-     * @return the path to the node for the child of the nodePath at childIndex
-     */
-    public abstract String getNodeChild(String nodePath, int childIndex);
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
-     * @return true if the node allows children nodes
-     */
-    public abstract boolean isAllowsChildren(String nodePath);
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose children to retrieve
      * @return a {@link List} of the children of the node
      */
     public abstract List<String> getChildren(String nodePath);
-
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java
index ce959a1a0c2..dff8f24dcf2 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java
@@ -31,7 +31,7 @@
 
 /**
  * A Class which extends {@link ZooKeeper} and will automatically retry calls to
- * zookeeper if a {@link KeeperException.ConnectionLossException} occurs
+ * zookeeper if a {@link org.apache.zookeeper.KeeperException.ConnectionLossException} occurs.
  */
 public class ZooKeeperRetry extends ZooKeeper {
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html
new file mode 100644
index 00000000000..17fb3dca20b
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>ZooInspector v0.1</title>
+</head>
+<body>
+<p>ZooInspector was developed by Colin Goodheart-Smithe and is
+available under the Apache Software Licence v2.0.</p>
+<p>The Icons used were sourced from the Eclipse project (<a
+	href="http://www.eclipse.org">http://www.eclipse.org</a>) and licensed
+under the Eclipse Public Licence v1.0. [<a
+	href="http://www.eclipse.org/org/documents/epl-v10.php">http://www.eclipse.org/org/documents/epl-v10.php</a>]
+</p>
+<p>ZooKeeper is available from <a
+	href="http://zookeeper.apache.org/">http://zookeeper.apache.org/</a>
+and is licensed under an Apache Software Licence v2.0</p>
+<p>The ApacheSoftware Licence v2.0 can be found at <a
+	href="http://www.apache.org/licenses/LICENSE-2.0">http://www.apache.org/licenses/LICENSE-2.0</a></p>
+</body>
+</html>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/16x16/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/16x16/categories/applications-system.png
new file mode 100644
index 0000000000000000000000000000000000000000..d90ab661cbb29366ea77d3e8fb95841f1ee876c8
GIT binary patch
literal 588
zcmV-S0<-;zP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV00006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY3ljhU3ljkVnw%H_000McNliru)&T_#AOdk;TFn3e03CEi
zSad^gZEa<4bO1wgWnpw>WFU8GbZ8({Xk{QrNlj4iWF>9@00FQ`L_t(I%f*wyN*hrW
zhQC;`PLh_6(FAQJr7#kZfPx4E#iGza=`xl&PtX@Ar1Sx#d6AAG<N-Q@f!PFHxXC6s
zf*G-knI?=aGu|jIcG1psVof(LdRFJ&bNM;vKi`F0Mq*Uq`TM=AFyGzY82N5IOw?EJ
zw$e&T2k<RJ1E`c0sts$Xc3mtINGm11QdZbM^k`Dj^H~Y|iy)tsuqo;5#c5U-WMJ<q
zE;1fh+duTk$&+lYJ&NwsLI$<)r+z)g!o;@>t=aAYaO?!s%x>`Mz@cV#gU@{dK(pP8
z#v3v*G%TN$PzxDqW;gi$^~4bFQGMcmZY?>x_<Hl{W4YDoW4mI=*r<a_SwSsi0C<p=
zQo=o|x9T7C%WsZ(FDc34IF+(;^A@TNE9&6<;__m?`0On}a<2I1%ohQWYIXYTnBs2_
zcDFYYzGY~(E6C4CEIpaJd;Vi$aen#b$2+N+l@}`yQvkLr@GV1&Zy^x}XT3O0PM#b|
zo#PE?wtGV?jKv?UF333EfF1LcR;LfZueMKdyuoh{{(*A14c{`f5Ugs$iq1EYc<aCL
a|KlfqPqc&)?k+h10000<MNUMnLSTYLb^#aw

literal 0
HcmV?d00001

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/22x22/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/22x22/categories/applications-system.png
new file mode 100644
index 0000000000000000000000000000000000000000..4decc893f846ade39d9ff0592c6d206bc333a177
GIT binary patch
literal 1488
zcmV;>1uy!EP)<h;3K|Lk000e1NJLTq000&M000&U1^@s6#I$TX00006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY4c7nw4c7reD4Tcy000McNliru)&T_#9u_J<mCXPE1zkx*
zK~y-)jg?(&RL2#^e>3;q{a$<5OZ>6KCN?#=B*DR6Ck-K((4=XV6g5OmrNm8(h^2n0
z=~MbvSxuhkQ&p*IB`dTpi_%tYAfYeC3KeZ?3alM4226tkn1%JO*SlWt_r1IK_945*
zPOGZtX>?}J@BDSnoEgFYVLM;`X<T;)o7cGFk<p>n{}rQt))5*G_X9*mhbHSj-5qRx
z>CtBL#S(f!XMC>I@|p8TfmhbX$aT=yj(ih6e{NH=>s)9!d|-V_lN-?_Mnzu*hK9of
z!YKUZLBH7zoUDri5UbFGV*^bx`{5g}4%+6UaejGfVHNqs9qnuhD4aTbjfc86@TZH}
zdwZRNP4@+eriz@ro?nTK4mGX^A2^)(`mT0wSI{p4J`ch&QKiMr*b1rTJdv4O2qDl^
zh2|zNxs??Dzy=b@EM09)w0P|tok|+1Lgn$u=+NZ7QmD4?|M~RQ^ah_3uvpHPNu*0m
z&D>^s_6`nB!=Y(tQX!KmVhI=Nbdgqn1A4{c?K2Bz9lB2Or#1d<DBv*9jU3n|lIc84
z=^U44@6ZwS)75bw0Hv})BAMmJ?IcnNI)edDOwL=2x;hdW9eV4(Hcu%o1vj;LuuKb8
zk$Bw>b`Nypb4lxi52vdCjLeWuE#t6hJl5NZL(@oQ3Jh*`3#ye@*0MxsIQ(~D7eG%(
z6E6>TqF5%`T#0hILMD?m$4*DjR5kbWk<p>$z59On($~KFblB_hYl<Q%6m;5}y}Who
z>RRrbO0a+b;n%;kk!N~acxrnP0mR}N3WYLTIs^Rt_Y=jk%^!-44lM)RxOVok>bSr4
z(f;iN+qQ1R?X+XpG`6?6*b#KHBWPnXS{#%B9l;=mp%PCPxIUL)aWTun!U~pYl2;lX
zb!gqPnWZCzLXO4;C#8bHwSUD~S<$IhRD6wrdo`ZAFl)tPi!7z`q|$k+6%)HnMM#0o
zEE%EUux~Bc<@G<lZR-Q*<qEObG9I^`29Lxt^Hw~5*91_4eJ}J}it7(wyjvu4bD2Fo
zEm&0xO;PYQcyN+aXA_lBu>Zvqcc<Ph?cD$4%}<7U{`gq`gW8>FnquC->v3@Sz483t
z;&$7`1ziAduDfo}z3}=z`{td;zr3wYNFk6y@JMev|CpNL<ixDyb=gH<caZ(hKZ%rr
z^XG0Ng&@APz}T7S%-ON;Jp3OcU3)7&*b#K@`AT1>EaY^g5C|c-zuix3OCwSW^0_kA
ziU~mUb{b7nIDdJD_dc#<EvveB^6hU=0@f<H|Ft8hd@gm@clSP^2*V~V(^>^fDQas_
z70IT~03e9oN+E@yiq7;WQGPd_G0aN&iK$;7jHm$p2Y(Y1mbv>|Pjm>k=8=Y3!Q-<d
zg``w4KJ9W1E`=byRHU`70n;kubv0sHcA6U;$ZA40^pXMy1rV{1jxV(JKKF&Wcy9Ba
z&$o+wDa*+FS2#aComyPUIr_ST!ltOGQev}7rsks7$k7RX{Bkts(y-Z_4ly}BQ~fwu
z{6*C$T}@mWzpK>hti&#yIM%r3sqK;Z?AB}X0!!)CM-yW|_+GB@A^v(x?|pHg3oL;^
za_qt#F*`Hyvn$6(4#mB_zDx6q-IwN*;psoTaVT+R{0301H&6lGKwHngksm$s>aWfN
zgTOPuv!UUzHFrH>MNWTW&0SAeq2aIvJPSMx><0RP&jGDK17NFvO%_m5G-qk{{hz!8
zoB$kvy_OUJ|3=Tc0jw$0fjm$EN<alL)fyC_QZ<T2pej|nZgV#|OPQDiWO-%r-ESN^
qxxY>{3Ym9+cwJBpSgs{80Q2AQ5mth5AqzVI0000<MNUMnLSTZy>CNB(

literal 0
HcmV?d00001

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/24x24/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/24x24/categories/applications-system.png
new file mode 100644
index 0000000000000000000000000000000000000000..9c8833865b5e9a1bedcf05b02549c6370871c1e0
GIT binary patch
literal 2447
zcmY*bc|6o#7yeGjUUo*RX_}u9hCyk}$d)~%p&|SBOEM!f){-rSN<vLEO|nM_NkYh8
zvM0=BX)sxavS-OVQ@!=R_kPYj&pqGgJm;MI*Ei0}!bp%$nhyW~K@(#GYnGQ{8_!PG
zIU0msV>uAP+DH#5>X4aYU9Ng!O}tK?1Qb}92jBvU032)zYXcx@fa@m)08`MOKiC>1
z_nWf=0IqujoWD8tEYDuXEMsN=_8jS;zl!NQ{;;LeIsRgHn(%I^B9`OzGqxiD0KX{P
zKtLLq)jr718-pccPnsj$@xIEg9(XrT<zQbwb{2pNMzWx<C(#uW?0W%6KnA0sKN(0C
zW{2TW$WIE<2MxuZw1Vj4{XHQX%IeB0P;EX41cLJS@IqP}82(OY-O$i;M4}%O4i5?n
zQVvp6#{2&ZS3P#@7+eJbM<A3~3?)Jcj_4Y!gd-gMCGuY#15bjxzqcRJ8;^sqbzR-?
z0Yo$u$}aS0{pyqG?e(`3j_`Xd)_`#K7r3gj3jB{YD;33#A}#&BJz166`r4|fpUnS@
z{jP(8vy1;vGruPN8D)*C&4+^jc{Xi6^EZd=0D$|riGeQ0STM#$&<gWWTzhqEmKs(y
zTdG+4OgwS|?r|VBD#wK9qOVw*s!HZv4Rfu&=iokUwgnZNeCkNQYOQFCh5pHma_=E;
zzMQ_4Hta3B$Y%ZizW6BP@4{DOwp?9TnWa_u)lb6}kr*U%shtwkSu;NyH1~Zjgt24u
zdS8EkPhi!<B$DUZeeYv5-uW)W>5i9n$2bkRwRnn;P@%=7yBg0HcwBOy+G^<wz&d}B
z6hq~?OR(p~7dr}uaoP!IEk2Pq^r<1_G}}Q~@!7%$Df|yY0QHhe?nzz(h^#tUq{aDl
zX}xLJZ6<ANeg0d2*dv4C%e8wSAbb)OuQ<P+JS#qeKUk^!z<C=PYaS_(U}oAsZMNT;
z;6a_7e~opzQ!#eqbf%PxDS)jE^PvyPp7uI|p5yB>BPu+32FdPI`r=<BT0wp?l7}1U
z$8OEwi|uTl_Q;*-;A=~Wz}M+Rc;|c~#>L`Hf!)4WHb#pYG-fEt4!HdqNE9cXo@}*d
zr43|8MG7A!*QyHKqp7zdzz`7;9f9wlUd1l*E&=(rQ}T$+ypgru5rB5t+m-&jVGQy@
zky4_#nAz#+<(0$hs+bKXjgrYSadeH*72Z627q9;-(19K97RSFT-1WdFNjwsjzZ^8c
z(JV%pdQA+O_W!tsi@39~P|u<1mti`7eu~KyFLGplQDaDKr{~G-uU69)ONj03%Ht1k
z`hJL~Uam_lnl54}W2UPjrF)tJOi*?`jz_4`_PmN79@?II2kZ^s;ww&lrk6xIq^}?P
z-RiT!!?G)`7WLK&;<<GO5obyhNhYOs=XFGyV?Dw5$!Sdu?oL_O2uL%`sz6gr(%q%~
z!&=TxkfH=XRN*vye`B=u<}@QWVb)S3?K5s(VDGLQ>Aed=Vw^88Pg!%eG=T+-9kCwW
z&&U$%b4ZXdXW_NmXa^UM{(dU8ZqU|9=pcXI__Eqzpd$;ElCnAeZ$L5Hxk6VsVaL@r
z_jBzx1nnit!&mIKTWZ7TM&p)@IOQ_Mk>KF@!&J({mFTR`a;Djs2&dd;?RhkDYWldL
z;e1u+L)1~fZ-e>Qw_}}Xued*A&gf~1T*pN3Tapj;3)vL9(G<xD(F|KRAJ^%<SI)U+
zZf3^sTQ=yS&>Q}8aQM_}bzvP-IEzNc#M7nxzsd**T1M$0=BfzXE3?B6x)Z6SH^~#X
zjpF0u-=t-EpeE8{#)Nm%<_K<F`W&6j6U5H)=PqD}{K8L9po?uUrKHUIpR^fWRW;k>
zw01mG{HdXr;)gogA_FfG6RMEP2*nA8XlW_?MGksrOYvsFZYhk(2%PA?3Fi?j9FJv)
z9@!IrR9#)Au#lV4in{BSgaD^Sp~{4tT6H_QPF(2d$uREI55KaIRXfoeD2caM>M{*j
z84S9OEZV>IAz@GT&|2&uId^HJAswS4B>Im-;-mL#49xB2)j-FYxw(DZYm<mBI371t
z{)CopdC$1%R8bp{<9$^*&`~ISv!^+yzHK0qkc+RD->EF1m=AR?VRl`rrIkeIB*7S2
zqzsekRN3gpix;Qoor!BXIkLEKm#w`f)DD;R-U25XzCYD{PJmYA;*fi$i+k8td%2=N
z+6LB8%+)p$NiFo+n=lg7HoZ`@F+5YMT@z2a|J7X&{zhcyLkp$stgk8N&M;_{oT<n?
z*xPe`QST<W6Z7(fD7F}zFoq2<59(?DK8F*nFEhjV`1sIDU~(PTZ-!RC=F!*IO7JrF
z(YdN1kwG~1mbpZ)2UVzRj2+50IXyLHpBQZhZFbW%EXz7nSoFe1MCL`+Ms$}RUz{zd
zrY4K9qxLb5(eh$>W+7Wn(y~XPME)T7T%)mA5?5lpyYMlrx}=D1@yEu1Hk6!=;y>5u
z>6WJV+K+i33lB^*l$O!t*SV7Qz#4JF`NU!T)8LHu^YZPI8q(J!^!Ba4UG_<_?d$@}
z?nR_7)g|S3=i4Mwijswtx+RMpvI8}0#?p8z<pPpKN)aU8_oj=oQARi<3@<${d+4^o
z+Qm%y<tI0Z4LuYp+RC|h+xXH(D*fa9QWNw}M7MRy`)_YyqbbkTC#4@thkvu^)G7{N
z(#2a^E;=LedM1(Ix)&v1c^yYp7vGBz6m`VtEFMivRo@m5hcffW+KeEDa{P!RMFono
z9mO)}P?^<0Eq6(+^^1;Mokp!g>-qUTD8wYXJfqRPnQ2g<YC&TxY>^YW^l^o-)~>n|
z_e)M+W-qu?hc1W4*cT8gjUVm&5>S~NW{<9v8IanVxch_B(=!`K-Exh#_Z3*C1@Nvg
zsmIeirGyV?J!Xu&$5FNoR8rN5pBv+_5EnyH(bY_`l^A(j$;DvuSV|wwG+ADQKD@=N
z8Mrx1njKxX%&@N+U%a^<>~w%8eKWp0@2m_MY?s%{`DOc3D@vA6H@W;(>_9=R{mjfB
nQBu{1^LN4bb4l3k6F<0I-6YFy#neIAe<da-EDVbDT%!I1w$(L*

literal 0
HcmV?d00001

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/32x32/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/32x32/categories/applications-system.png
new file mode 100644
index 0000000000000000000000000000000000000000..565f406dd147d585f47374e20544996b3542dbd5
GIT binary patch
literal 2544
zcmV<M2@m#(P)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F800004b3#c}2nYxW
zd<bNS000T6Nkl<ZScR=udvH|c75{zTckjM8yLs*AMcyPN5J3WBs`5xcg1iN$PCGIp
zN;|FMOvkp<TBm=sBGqb{sf`u{u_{ibRtE+&sGumQ5KIh^5c1q?-n-e&zVF^=|HwjP
zSe?rB%$&Ki-~G<{{r22*e&4+WH(^UwY#RmOAcP8<rW!zL^Cyk_=if{&?q-4*W452}
zd>AH^(GUqo@b?!El-*1o0HEJDptg2<0pmCbqKem#d<n+u0BE|px~=K|Hv+Zw4?j@5
z@}ZH%%eUV;{hrLUxoPQX>ezS?F+s%WcnB#ryQC1VV*1`CE4JUiWW_dZ+1=Y8{5Aq?
z`ogk%9{!ElWPGl!uEyr>AKEsfWUkQH)%<x~-PZKN^6E!4O?!FvoJvmPO=R33fg{xd
zS&R^m$9rE<>HMg(tg?M(UX8V+vifanie=~8_4Qm=x9jfwf?L$S?&i;?<B_R9>Q-)l
zj4=BA)4P5}jV2R9!4UrX!mHBI@K~H<jGH~DoS#)Wi<OiVq4Cqp81_t{AU7S$7L}o`
zy%SC6TjK-${hFq#hJ}l&l{@aLVS$i<47&l(J=>rH%KfJr4<4F|`Hd!2iK<ym7R_$6
zqNQUHW`hn-Jn;zM(tL?8DJ_KAY=L{khjXpH@c2UDIfmh}0RG+Bf`XiMY~Hd?4_SmD
z#t{(-J9)MPj54fSQ3V~ZQ{z(H@tu#LudC%;;mrA~B~i|<nq5YG!6+tzG34jxA{Y@d
z>J1_s5fF<@@J&R(7z0Nq+b9r<p~vlkq!9Q+B076Kpp;_qZ8P!y@sFgjG0%~c@4x(u
z=>(>ap%xXC4UHds);(`th0$s<A}WX&84G|AAQ+0_%!O_c0_Ye6Aq0dVaV4OHB=!>U
z979!k4n~IDXluJNu0**9Zs<THnSxIn_YO;<^x=^sA8EN+b}&l7C<UbyUVj)oW6&`M
zlR<}6n;Axf9y)Gvjb{uzH|Yi)hsv^CoIH6(mSyS4#~(L@lMx`(7Z$Dhaf+3ihkyU%
zP7~z}2!vwSH%hXC!I23R=B2}G*1<a-Kt{R^k*I`A9YgT?!k|;CQka(kyM?0R#aDt#
zjL%I*;szzuEBxlN@)ADFnTc+fCy|g~)Dy&voK#enI<fzi!-Cu80--ddsj4-<un=4C
z-)L~TC(u9W1HmMTk<kFkip!9bm&?0d?o9w*osP!<VAZNe^*M!=l|`kuE{2NNHr>0D
zSyF5e;xZ^9m<YzuH!zOE+*IuTQ$xh>8-F#(v*l-x?c0@Jx$rM>|AgcGxz@^!>uPmA
ze-xSqlovaoX&ML!s%FjL&wlaMhB@;VZ!RjGJ9kFG+>HFvdE>6`mLRFEe`r`$RcA(e
zs+67MB&Egq-1_x(q<_E<Nmf7rxQG3)r<m~J2cN{-FJC_J;d^_3HvOM0U%jJY&g`lO
z?^#u=@9FcPsxl7*fCiwXFcZO07~MT?v|s7fzHV)kUHyaN$0rV0I89R>FE#vuFvjU3
zQ4yjjV_<LsilQPE7C=Cd>$JmeGo$0m6<Lsk-N~9shzq;h+uF8n+qyyDeq|V5Zy4Fm
z6o3%8+~XJ?2_O;yW>-{^J8Bm2zkTxAH~?^}s!^-O4ELZ9LR^~cN<!fAhS1eJ*#ibW
zhq}cTki@vbpBfuUM!=sM8{q?-L9gRr(DTShGlNnJRn^ej=Y<fJU^eN%C`C$&1&Sh>
zfy5Y|K79@xm5`TZht*<0n%x9S2zW-pF$zV|AP5pHR%_G|FjXZZ;0TzitSKo`MOIN(
z;)Kzt1EmCRw+~enxtLX+0Yam=c=;j@9DGaE5);T##vXg)&7&J-RjCr=qTOUPYES?1
zaV{R0!E*_*0fEO8!t%PMmSe}>-&<Y1<Ms;|_Da{ltE+eLJWux4uc)<1qJmVr>3R$!
z1fg&kzy95B7>&j+L`iH`Wwn)nGy&6epnB~NlU>oyZr-?NZca`<1_u4t$B^R~Zd*`<
zhL>KCb@udLRYmy;Ns~Hx!q237?y2(P;<877zSS5G2{0IV$dZDtt}$d~+t7aX3f_MA
zy<?3>UtE)P46oVn)eF*$qFY2kknUc->~`Mc2~R2^qo9N!7>r@fJ$Ld(qsbWv2G;@P
zCk{vYrur32X56=BHQ&?iL1wxYlv4P{BM{>Xii$FE=<v~)XWX~T)!lq?I)NL6$N=S^
zE?58a9*@VEn`6h=Sa4G3K_JByT)H@jIkPIrT{YEKosNSfDhLE(=<f8uYSDwSNp+8e
zML067@OZuGclEPzTj+4I-nro{IC0{&h^(lm-#OZ-&d5uHj&YMZpU`+pD7<4KbajlO
z{n9YHJIA0Y8cItY$jY{XQUXa*z(Am>8ibetMb&ia0gLm0BCvGj_EH_sE&t)YtLb3B
zF9FPf=UCE1N5^qc6%}zo0wt3Nmnv!CIR;Ts;7oU7^ZI(#XfPZ`lC$R<JurLA7G0WV
z`E=9zdS_l%KAG@GVK(bgQtANDG036<O6lZ#Kw?B0qfliH(XfaVn-La^9`-a7j7A;A
zsEl}2!h-4w($w6Vnc<ij>g{g+@>?t54A~CaQmmyb>+U2zZx~Kz3bL}zIDX=!CWsMK
z%+5h>UMlQ1BXoSC5{$uOHXtk8hD?VQBOVWSKE6x-+rEFunYm_|EP5!ih7D_0=w(&i
z^PLqaD4u5!C1w4cHS<|<aTeM-uHczH`{I|{J6q3w(PX~d-mU2k95=Hx7a5s0M1pac
zOga>lrsKlb7jf{=JK~%FIxdb55AF8({QghQG?gq|SjkaF@XVflf+)p)<mzc{n~HhE
zGg-QP+v5hK{wYUh1{)podItKh?zr4~vdv_&r<7OSu{JH$SuZPE%^Q3F40n$oW~&|@
z{T+B=?;+Li9elF4^Zcn$$QJ}4EnKv2sVyUGk0eS)O_6?i`sC{k07L+C(h2}TUr$R@
zR&H5uI24&U|M}4e-2Iov0PvC|kdeX8p5CtJk7iXY+WdptZ#AeQg~_7B*>hj1EiGT|
zZ)rMyL=<C6B9%5Y*wLi|Z&8gL{qoG)?*dQ~;Mz63WS?g8XQvJw25<y`4uC#ER86?1
zs!IRR&}dabb|DNV9$h^yDG>B_C*suvkP1NQ>%8FZ1G*Bxa^l`~OZH`?0*C>KPPs+^
zgcBZ&MZ+!bp;0X}+X_$>u7N?$?;B_W5C9OGvNtj<k2oFdh8{>_3;>^S4gj~HX5(73
z#l9Z^C}lFBMo%>!sK9?qe9fg~px>9kw;7!huTAmqW&Z&pdN>M(u2oY20000<MNUMn
GLSTaNB-;W2

literal 0
HcmV?d00001


From 4b967902d64fea0b1b75c89df90eccee80a8c1b7 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@gmail.com>
Date: Thu, 3 Feb 2022 07:55:00 +0000
Subject: [PATCH 279/591] [maven-release-plugin] prepare branch @{releaseLabel}

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2bcae3b404d..39aabe4fc64 100755
--- a/pom.xml
+++ b/pom.xml
@@ -71,7 +71,7 @@
     <connection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf/zookeeper.git</url>
-    <tag>HEAD</tag>
+    <tag>branch-3.8</tag>
   </scm>
   <issueManagement>
     <system>JIRA</system>

From a88eed897187e2b5e008fca766fdebb216289917 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@gmail.com>
Date: Thu, 3 Feb 2022 07:55:04 +0000
Subject: [PATCH 280/591] [maven-release-plugin] prepare for next development
 iteration

---
 pom.xml                                                       | 4 ++--
 zookeeper-assembly/pom.xml                                    | 2 +-
 zookeeper-client/pom.xml                                      | 2 +-
 zookeeper-client/zookeeper-client-c/pom.xml                   | 2 +-
 zookeeper-compatibility-tests/pom.xml                         | 2 +-
 .../zookeeper-compatibility-tests-curator/pom.xml             | 2 +-
 zookeeper-contrib/pom.xml                                     | 2 +-
 zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml            | 2 +-
 zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml          | 2 +-
 zookeeper-contrib/zookeeper-contrib-rest/pom.xml              | 2 +-
 zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml      | 2 +-
 zookeeper-docs/pom.xml                                        | 2 +-
 zookeeper-it/pom.xml                                          | 2 +-
 zookeeper-jute/pom.xml                                        | 2 +-
 zookeeper-metrics-providers/pom.xml                           | 2 +-
 .../zookeeper-prometheus-metrics/pom.xml                      | 2 +-
 zookeeper-recipes/pom.xml                                     | 2 +-
 zookeeper-recipes/zookeeper-recipes-election/pom.xml          | 2 +-
 zookeeper-recipes/zookeeper-recipes-lock/pom.xml              | 2 +-
 zookeeper-recipes/zookeeper-recipes-queue/pom.xml             | 2 +-
 zookeeper-server/pom.xml                                      | 2 +-
 21 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/pom.xml b/pom.xml
index 39aabe4fc64..f097d32d674 100755
--- a/pom.xml
+++ b/pom.xml
@@ -31,7 +31,7 @@
   <artifactId>parent</artifactId>
   <packaging>pom</packaging>
   <!-- to change version: mvn -B release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
-  <version>3.8.0-SNAPSHOT</version>
+  <version>3.9.0-SNAPSHOT</version>
   <name>Apache ZooKeeper</name>
   <description>
     ZooKeeper is a centralized service for maintaining configuration information, naming,
@@ -71,7 +71,7 @@
     <connection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf/zookeeper.git</url>
-    <tag>branch-3.8</tag>
+    <tag>HEAD</tag>
   </scm>
   <issueManagement>
     <system>JIRA</system>
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index a2fb72a36be..4bdfc740cd4 100755
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-assembly</artifactId>
diff --git a/zookeeper-client/pom.xml b/zookeeper-client/pom.xml
index 302fcff29e1..9d484e614dd 100755
--- a/zookeeper-client/pom.xml
+++ b/zookeeper-client/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client</artifactId>
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
index b19c47fd8e1..da130c97010 100755
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-client</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client-c</artifactId>
diff --git a/zookeeper-compatibility-tests/pom.xml b/zookeeper-compatibility-tests/pom.xml
index 8ccddbb2d5e..ad73b939031 100644
--- a/zookeeper-compatibility-tests/pom.xml
+++ b/zookeeper-compatibility-tests/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>parent</artifactId>
-        <version>3.8.0-SNAPSHOT</version>
+        <version>3.9.0-SNAPSHOT</version>
     </parent>
     <packaging>pom</packaging>
     <modelVersion>4.0.0</modelVersion>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index 18ede17ed32..02544b3fb14 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>zookeeper-compatibility-tests</artifactId>
-        <version>3.8.0-SNAPSHOT</version>
+        <version>3.9.0-SNAPSHOT</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index ca6047b7b46..e0dabd917bf 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
index 5b210de4417..172f9c8e6a9 100755
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <groupId>org.apache.zookeeper</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
index 03e1327c6cd..2a47599a9b5 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-loggraph</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
index 10409b82598..6067e196cdd 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-rest</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index cf247c355f0..f806e39092e 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-zooinspector</artifactId>
diff --git a/zookeeper-docs/pom.xml b/zookeeper-docs/pom.xml
index 93a48d52079..8878ba96713 100644
--- a/zookeeper-docs/pom.xml
+++ b/zookeeper-docs/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-docs</artifactId>
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
index 64d7fca3cd9..21ae34381d2 100755
--- a/zookeeper-it/pom.xml
+++ b/zookeeper-it/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-it</artifactId>
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index 1e4d7f18b62..55d18874b6d 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-jute</artifactId>
diff --git a/zookeeper-metrics-providers/pom.xml b/zookeeper-metrics-providers/pom.xml
index 71661c63f59..9b876a61f56 100755
--- a/zookeeper-metrics-providers/pom.xml
+++ b/zookeeper-metrics-providers/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-metrics-providers</artifactId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index df2c2147289..2af310ce50e 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-metrics-providers</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-prometheus-metrics</artifactId>
diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
index fc5cd6872b6..9de29b6319f 100755
--- a/zookeeper-recipes/pom.xml
+++ b/zookeeper-recipes/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-election/pom.xml b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
index 0b2b466e22c..9767a94865d 100755
--- a/zookeeper-recipes/zookeeper-recipes-election/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-election</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
index fe625c6abfb..4f23724c46e 100755
--- a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-lock</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
index 5fe3eb961a4..76169c221c0 100755
--- a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-queue</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index fc5c4b6ab76..374ebc768a0 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.8.0-SNAPSHOT</version>
+    <version>3.9.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper</artifactId>

From ebcf18e52fa095773429348ce495d59c896f4a26 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Fri, 4 Feb 2022 08:00:53 +0100
Subject: [PATCH 281/591] ZOOKEEPER-4315: Include reference to third party
 files in the source NOTICE.txt file

More context here: https://issues.apache.org/jira/browse/ZOOKEEPER-4315

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1812 from eolivelli/ZOOKEEPER-4315-notice
---
 NOTICE.txt | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/NOTICE.txt b/NOTICE.txt
index 87256b972bf..8fb1daca87d 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -9,3 +9,27 @@ developed for Airlift (https://github.com/airlift/airlift),
 licensed under the Apache 2.0 license. The licensing terms
 for Airlift code can be found at:
 https://github.com/airlift/airlift/blob/master/LICENSE
+
+This project also includes some files with the following licenses.
+
+These BSD licensed files:
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.h
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_itr.c
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_itr.h
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_private.h
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
+  ./zookeeper-docs/src/main/resources/markdown/skin/prototype.js
+
+These MIT licensed files:
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
+  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
+
+This Apache 2.0 licensed file:
+./zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
+

From 0b0dfe521f374bb473aebc858bdde8fc4c491f7a Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Fri, 11 Feb 2022 13:53:30 +0000
Subject: [PATCH 282/591] ZOOKEEPER-4468: Update documentation about BCFKS
 keystore/truststore format

The BCFKS keystore/truststore format support was backported to branch 3.5, I updated the documentation.

Author: Mate Szalay-Beko <mszalay@cloudera.com>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Andor Molnar <andor@apache.org>

Closes #1816 from symat/ZOOKEEPER-4468-doc-update
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 0b658d0c3c2..23e85804b5a 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1654,7 +1654,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     **New in 3.5.5:**
     Specifies the file format of client and quorum keystores. Values: JKS, PEM, PKCS12 or null (detect by filename).
     Default: null.
-    **New in 3.6.3, 3.7.0:**
+    **New in 3.5.10, 3.6.3, 3.7.0:**
     The format BCFKS was added.
 
 * *ssl.trustStore.location* and *ssl.trustStore.password* and *ssl.quorum.trustStore.location* and *ssl.quorum.trustStore.password* :
@@ -1675,7 +1675,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     **New in 3.5.5:**
     Specifies the file format of client and quorum trustStores. Values: JKS, PEM, PKCS12 or null (detect by filename).
     Default: null.
-    **New in 3.6.3, 3.7.0:**
+    **New in 3.5.10, 3.6.3, 3.7.0:**
     The format BCFKS was added.
 
 * *ssl.protocol* and *ssl.quorum.protocol* :

From 428e6f92132e19390c81e19f67d5380451acdbe4 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Mon, 14 Feb 2022 07:50:43 +0000
Subject: [PATCH 283/591] ZOOKEEPER-4469: Suppress OWASP false positives
 related to Netty TCNative

More context here:
https://issues.apache.org/jira/browse/ZOOKEEPER-4469

I am also updating the OWASP dependency check

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1817 from eolivelli/ZOOKEEPER-4469
---
 owaspSuppressions.xml | 12 ++++++++++++
 pom.xml               |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 5c4bc33bcf5..4bfec6fd2e2 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -34,6 +34,18 @@
       <!-- https://github.com/jeremylong/DependencyCheck/issues/1653
            False positive on Netty 4.x-->
       <cve>CVE-2018-12056</cve>
+      <!-- other false positives related to Netty TCNative 4.x -->
+      <cve>CVE-2021-43797</cve>
+      <cve>CVE-2019-16869</cve>
+      <cve>CVE-2015-2156</cve>
+      <cve>CVE-2021-37136</cve>
+      <cve>CVE-2014-3488</cve>
+      <cve>CVE-2021-37137</cve>
+      <cve>CVE-2019-20445</cve>
+      <cve>CVE-2019-20444</cve>
+      <cve>CVE-2021-21295</cve>
+      <cve>CVE-2021-21409</cve>
+      <cve>CVE-2021-21290</cve>
    </suppress>
    <suppress>
       <!-- Seems like false positive - we are not using Prometheus
diff --git a/pom.xml b/pom.xml
index f097d32d674..ed3d4167a56 100755
--- a/pom.xml
+++ b/pom.xml
@@ -798,7 +798,7 @@
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>5.3.0</version>
+          <version>6.5.3</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From 48191b63dfaa4d6d71572608a31338e15f02f0fa Mon Sep 17 00:00:00 2001
From: 67 <67@gd67.com>
Date: Tue, 15 Feb 2022 11:29:09 +0000
Subject: [PATCH 284/591] ZOOKEEPER-4465: zooinspector logback pattern config
 add escape for '(' and ')'

zooinspect logback config file `logback.xml` currently use a pattern of this
`<pattern>%5p [%t] (%F:%L) - %m%n</pattern> `
which not escape the '(' and ')', cause logback to ignore parts after ')'.

according to logback documents, '(' and ')' is used for grouping, need escape by `\` if used as normal char
https://logback.qos.ch/manual/layouts.html#grouping

this pr update it to (add '\' to escape)
`<pattern>%5p [%t] \(%F:%L\) - %m%n</pattern> `

Author: 67 <67@gd67.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Andor Molnar <andor@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1814 from iamgd67/ZOOKEEPER-4465
---
 .../src/main/resources/logback.xml            |  2 +-
 .../zookeeper/inspector/LoggerTest.java       | 48 +++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
index 983c188783b..6f813039d1c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
@@ -22,7 +22,7 @@
 <configuration>
   <appender name="stdout" class="ch.qos.logback.core.ConsoleAppender">
     <encoder>
-      <pattern>%5p [%t] (%F:%L) - %m%n</pattern>
+      <pattern>%5p [%t] \(%F:%L\) - %m%n</pattern>
     </encoder>
   </appender>
   <root level="INFO">
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java
new file mode 100644
index 00000000000..310e3320133
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
+
+public class LoggerTest {
+    Logger LOG = LoggerFactory.getLogger(LoggerTest.class);
+    String testMessage = "a test message";
+
+    @Test
+    public void testLogStdOutConfig() {
+        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+        PrintStream realStdOut = System.out;
+        System.setOut(new PrintStream(byteArrayOutputStream));
+        LOG.info(testMessage);
+        System.setOut(realStdOut);
+
+        //log to stdout for debug
+        LOG.info(testMessage);
+        String bufferMessage = new String(byteArrayOutputStream.toByteArray(), StandardCharsets.UTF_8);
+        LOG.info(bufferMessage);
+
+        Assert.assertTrue(bufferMessage.contains(testMessage));
+    }
+}

From bce2bf42361163a2c026fb0d629edc22f2fb1c73 Mon Sep 17 00:00:00 2001
From: Shoothzj <shoothzj@gmail.com>
Date: Thu, 17 Feb 2022 17:31:54 +0800
Subject: [PATCH 285/591] Fix typo in ZooKeeper Server Pom

I think that the id of this task should be `build-time`. And it has original be `build-time`.

Author: Shoothzj <shoothzj@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1781 from Shoothzj/fix-typo-in-zookeeper-server-pom
---
 pom.xml                  | 4 ++--
 zookeeper-server/pom.xml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index ed3d4167a56..f14f317d134 100755
--- a/pom.xml
+++ b/pom.xml
@@ -1089,7 +1089,7 @@
                     <exclude>commons-lang:commons-lang</exclude>
                   </excludes>
                   <searchTransitive>false</searchTransitive>
-                  <message>We don't use commons-lang any more, so do not depend on it directly.</message>
+                  <message>We don't use commons-lang anymore, so do not depend on it directly.</message>
                 </bannedDependencies>
               </rules>
             </configuration>
@@ -1123,7 +1123,7 @@
                     <exclude>com.googlecode.json-simple:json-simple</exclude>
                   </excludes>
                   <searchTransitive>false</searchTransitive>
-                  <message>We don't use json-simple any more, so do not depend on it directly.</message>
+                  <message>We don't use json-simple anymore, so do not depend on it directly.</message>
                 </bannedDependencies>
               </rules>
             </configuration>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 374ebc768a0..016a0c569e5 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -191,7 +191,7 @@
         <executions>
           <execution>
             <!-- ${maven.build.timestamp} does not support timezone :( -->
-            <id>tbuild-time</id>
+            <id>build-time</id>
             <goals>
               <goal>timestamp-property</goal>
             </goals>

From 3004c909b78b3056985c8e39925e14bde3baa430 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Fri, 25 Feb 2022 07:59:07 +0100
Subject: [PATCH 286/591] ZOOKEEPER-4478: Suppress OWASP false positives
 zookeeper-jute-3.8.0-SNAPSHOT.jar: CVE-2021-29425, CVE-2021-28164,
 CVE-2021-34429

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1824 from eolivelli/ZOOKEEPER-4478-owasp
---
 owaspSuppressions.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 4bfec6fd2e2..1325af98303 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -53,4 +53,13 @@
            this writing  -->
       <cve>CVE-2019-3826</cve>
    </suppress>
+
+ 
+   <suppress>
+      <!-- Seems like false positives about zookeeper-jute -->
+      <cve>CVE-2021-29425</cve>
+      <cve>CVE-2021-28164</cve>
+      <cve>CVE-2021-34429</cve>
+   </suppress>
+
 </suppressions>

From 609afd1281ace4d29aabfb48628aa9eead56c4bf Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Mon, 28 Feb 2022 15:31:28 +0000
Subject: [PATCH 287/591] ZOOKEEPER-4480: Introduce end to end compatibility
 tests

So far, I add a simplest test executing `bin/zkCli.sh sync /` for testing connectivity.

You can comment to enrich the test script.

This command itself is enough for proceeding the original proposal that merge `readOnly` field into `ConnectRequest` and `ConnectResponse` as it's tested with any successfully setup connection.

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1826 from tisonkun/e2e
---
 .github/workflows/e2e.yaml    | 74 +++++++++++++++++++++++++++++++++++
 tools/ci/test-connectivity.py | 48 +++++++++++++++++++++++
 2 files changed, 122 insertions(+)
 create mode 100644 .github/workflows/e2e.yaml
 create mode 100755 tools/ci/test-connectivity.py

diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
new file mode 100644
index 00000000000..5128eaa830f
--- /dev/null
+++ b/.github/workflows/e2e.yaml
@@ -0,0 +1,74 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: End to End Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  compatibility:
+    strategy:
+      matrix:
+        jdk: [8, 11]
+        zk: [3.5.9, 3.6.3, 3.7.0, nightly]
+      fail-fast: false
+    timeout-minutes: 360
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up JDK ${{ matrix.jdk }}
+        uses: actions/setup-java@v1
+        with:
+          java-version: ${{ matrix.jdk }}
+      - name: Cache local maven repository
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~/.m2/repository/
+            !~/.m2/repository/org/apache/zookeeper
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: ${{ runner.os }}-m2
+      - name: Show the first log message
+        run: git log -n1
+      - name: Install C Dependencies
+        run: sudo apt-get install libcppunit-dev libsasl2-dev
+      - name: Build with Maven
+        run: mvn -B -V -e -ntp "-Dstyle.color=always" package -DskipTests
+        env:
+          MAVEN_OPTS: -Djansi.force=true
+      - name: Download ZooKeeper ${{ matrix.zk }}
+        if: matrix.zk != 'nightly'
+        run: |
+          curl -O https://archive.apache.org/dist/zookeeper/zookeeper-${{ matrix.zk }}/apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+          tar -xzvf apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+      - name: Test ZooKeeper nightly server and ${{ matrix.zk }} client
+        if: matrix.zk != 'nightly'
+        run: tools/ci/test-connectivity.py --server . --client apache-zookeeper-${{ matrix.zk }}-bin
+        env:
+          ZOOCFG: zoo_sample.cfg
+      - name: Test ZooKeeper ${{ matrix.zk }} server and nightly client
+        if: matrix.zk != 'nightly'
+        run: tools/ci/test-connectivity.py --server apache-zookeeper-${{ matrix.zk }}-bin --client .
+        env:
+          ZOOCFG: zoo_sample.cfg
+      - name: Test ZooKeeper nightly server and client
+        if: matrix.zk == 'nightly'
+        run: tools/ci/test-connectivity.py --server . --client .
+        env:
+          ZOOCFG: zoo_sample.cfg
diff --git a/tools/ci/test-connectivity.py b/tools/ci/test-connectivity.py
new file mode 100755
index 00000000000..2ad837571c0
--- /dev/null
+++ b/tools/ci/test-connectivity.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import subprocess
+
+from pathlib import Path
+
+class Server():
+    def __init__(self, binpath):
+        self.binpath = binpath
+    def __enter__(self):
+        subprocess.run([f'{self.binpath}', 'start'], check=True)
+        return self
+    def __exit__(self, type, value, traceback):
+        subprocess.run([f'{self.binpath}', 'stop'], check=True)
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--server', help="basepath to zk server", required=True)
+    parser.add_argument('--client', help="basepath to zk client", required=True)
+
+    args = parser.parse_args()
+    
+    server_basepath = Path(args.server).absolute()
+    server_binpath = server_basepath / "bin" / "zkServer.sh"
+    assert server_binpath.exists(), f"server binpath not exist: {server_binpath}"
+    client_basepath = Path(args.client).absolute()
+    client_binpath = client_basepath / "bin" / "zkCli.sh"
+    assert client_binpath.exists(), f"client binpath not exist: {client_binpath}"
+
+    with Server(server_binpath):
+        subprocess.run([f'{client_binpath}', 'sync', '/'], check=True)

From a5b6c38edd74b263638817f7b65d057c91d5a888 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Tue, 1 Mar 2022 14:30:23 +0100
Subject: [PATCH 288/591] ZOOKEEPER-4477: Single Kerberos ticket renewal
 failure can prevent all future renewals since Java 9

This bug is similar to the one fixed in https://issues.apache.org/jira/browse/KAFKA-12730.

Our Kerberos ticket refresh thread performs re-login by logging out and then logging in again. If
login fails, we retry after some sleep. Every reLogin() operation performs loginContext.logout()
and loginContext.login(). If login fails, we end up with two consecutive logouts. This used to
work in older Java versions, but from Java 9 onwards, this results in a NullPointerException due
to https://bugs.openjdk.java.net/browse/JDK-8173069. We should check if logout is required before
attempting logout.

I fixed the issue and added a new unit test to test some ticket renewal scenarios. I managed to
reproduce the problem in KerberosTicketRenewalTest.shouldRecoverIfKerberosNotAvailableForSomeTime()
which (before the fix) failed with Java13 but succeeded with Java8.

Author: Mate Szalay-Beko <symat@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1828 from symat/ZOOKEEPER-4477-master
---
 .../main/java/org/apache/zookeeper/Login.java |  31 +-
 .../zookeeper/KerberosTicketRenewalTest.java  | 278 ++++++++++++++++++
 .../server/quorum/auth/KerberosTestUtils.java |  61 ++++
 .../zookeeper/server/quorum/auth/MiniKdc.java |   9 +-
 .../server/quorum/auth/MiniKdcTest.java       |  59 +---
 5 files changed, 372 insertions(+), 66 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
index e74cddb05bd..ab2bf636ef1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
@@ -63,7 +63,10 @@ public class Login {
     // Regardless of TICKET_RENEW_WINDOW setting above and the ticket expiry time,
     // thread will not sleep between refresh attempts any less than 1 minute (60*1000 milliseconds = 1 minute).
     // Change the '1' to e.g. 5, to change this to 5 minutes.
-    private static final long MIN_TIME_BEFORE_RELOGIN = 1 * 60 * 1000L;
+    private static final long DEFAULT_MIN_TIME_BEFORE_RELOGIN = 1 * 60 * 1000L;
+    public static final String MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY = "zookeeper.kerberos.minReLoginTimeMs";
+    private static final long MIN_TIME_BEFORE_RELOGIN = Long.getLong(
+      MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY, DEFAULT_MIN_TIME_BEFORE_RELOGIN);
 
     private Subject subject = null;
     private Thread t = null;
@@ -223,7 +226,7 @@ public void run() {
                                     --retry;
                                     // sleep for 10 seconds
                                     try {
-                                        Thread.sleep(10 * 1000);
+                                        sleepBeforeRetryFailedRefresh();
                                     } catch (InterruptedException ie) {
                                         LOG.error("Interrupted while renewing TGT, exiting Login thread");
                                         return;
@@ -251,7 +254,7 @@ public void run() {
                                     --retry;
                                     // sleep for 10 seconds.
                                     try {
-                                        Thread.sleep(10 * 1000);
+                                        sleepBeforeRetryFailedRefresh();
                                     } catch (InterruptedException e) {
                                         LOG.error("Interrupted during login retry after LoginException:", le);
                                         throw le;
@@ -400,10 +403,10 @@ private void setLastLogin(long time) {
     }
 
     /**
-     * Get the time of the last login.
-     * @return the number of milliseconds since the beginning of time.
+     * Get the time of the last login (ticket initialization or last ticket renewal).
+     * @return the number of milliseconds since epoch.
      */
-    private long getLastLogin() {
+    public long getLastLogin() {
         return lastLogin;
     }
 
@@ -428,7 +431,7 @@ private synchronized void reLogin() throws LoginException {
             //clear up the kerberos state. But the tokens are not cleared! As per
             //the Java kerberos login module code, only the kerberos credentials
             //are cleared
-            login.logout();
+            logout();
             //login and also update the subject field of this instance to
             //have the new credentials (pass it to the LoginContext constructor)
             login = new LoginContext(loginContextName, getSubject());
@@ -438,4 +441,18 @@ private synchronized void reLogin() throws LoginException {
         }
     }
 
+    // this method also visible for unit tests, to make sure kerberos state cleaned up
+    protected synchronized void logout() throws LoginException {
+        // We need to make sure not to call LoginContext.logout() when we
+        // are not logged in. Since Java 9 this could result in an NPE.
+        // See ZOOKEEPER-4477 for more details.
+        if (subject != null && !subject.getPrincipals().isEmpty()) {
+            login.logout();
+        }
+    }
+
+    // this method is overwritten in unit tests to test concurrency
+    protected void sleepBeforeRetryFailedRefresh() throws InterruptedException {
+        Thread.sleep(10 * 1000);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
new file mode 100644
index 00000000000..84b214049f0
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
@@ -0,0 +1,278 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.apache.zookeeper.server.quorum.auth.MiniKdc.MAX_TICKET_LIFETIME;
+import static org.apache.zookeeper.server.quorum.auth.MiniKdc.MIN_TICKET_LIFETIME;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTimeout;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.security.Principal;
+import java.time.Duration;
+import java.util.Properties;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Supplier;
+import javax.security.auth.login.Configuration;
+import javax.security.auth.login.LoginException;
+import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.FilenameUtils;
+import org.apache.zookeeper.common.ZKConfig;
+import org.apache.zookeeper.server.quorum.auth.KerberosTestUtils;
+import org.apache.zookeeper.server.quorum.auth.MiniKdc;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * This test class is mainly testing the TGT renewal logic implemented
+ * in the org.apache.zookeeper.Login class.
+ */
+public class KerberosTicketRenewalTest {
+
+
+  private static final Logger LOG = LoggerFactory.getLogger(KerberosTicketRenewalTest.class);
+  private static final String JAAS_CONFIG_SECTION = "ClientUsingKerberos";
+  private static final String TICKET_LIFETIME = "5000";
+  private static File testTempDir;
+  private static MiniKdc kdc;
+  private static File kdcWorkDir;
+  private static String PRINCIPAL = KerberosTestUtils.getClientPrincipal();
+
+  TestableKerberosLogin login;
+
+  @BeforeAll
+  public static void setupClass() throws Exception {
+    // by default, we should wait at least 1 minute between subsequent TGT renewals.
+    // changing it to 500ms.
+    System.setProperty(Login.MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY, "500");
+
+    testTempDir = ClientBase.createTmpDir();
+    startMiniKdcAndAddPrincipal();
+
+    String keytabFilePath = FilenameUtils.normalize(KerberosTestUtils.getKeytabFile(), true);
+
+    // note: we use "refreshKrb5Config=true" to refresh the kerberos config in the JVM,
+    // making sure that we use the latest config even if other tests already have been executed
+    // and initialized the kerberos client configs before)
+    String jaasEntries = ""
+      + "ClientUsingKerberos {\n"
+      + "  com.sun.security.auth.module.Krb5LoginModule required\n"
+      + "  storeKey=\"false\"\n"
+      + "  useTicketCache=\"false\"\n"
+      + "  useKeyTab=\"true\"\n"
+      + "  doNotPrompt=\"true\"\n"
+      + "  debug=\"true\"\n"
+      + "  refreshKrb5Config=\"true\"\n"
+      + "  keyTab=\"" + keytabFilePath + "\"\n"
+      + "  principal=\"" + PRINCIPAL + "\";\n"
+      + "};\n";
+    setupJaasConfig(jaasEntries);
+  }
+
+  @AfterAll
+  public static void tearDownClass() {
+    System.clearProperty(Login.MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY);
+    System.clearProperty("java.security.auth.login.config");
+    stopMiniKdc();
+    if (testTempDir != null) {
+      // the testTempDir contains the jaas config file and also the
+      // working folder of the currently running KDC server
+      FileUtils.deleteQuietly(testTempDir);
+    }
+  }
+
+  @AfterEach
+  public void tearDownTest() throws Exception {
+    if (login != null) {
+      login.shutdown();
+      login.logout();
+    }
+  }
+
+
+  /**
+   * We extend the regular Login class to be able to properly control the
+   * "sleeping" between the retry attempts of ticket refresh actions.
+   */
+  private static class TestableKerberosLogin extends Login {
+
+    private AtomicBoolean refreshFailed = new AtomicBoolean(false);
+    private CountDownLatch continueRefreshThread = new CountDownLatch(1);
+
+    public TestableKerberosLogin() throws LoginException {
+      super(JAAS_CONFIG_SECTION, (callbacks) -> {}, new ZKConfig());
+    }
+
+    @Override
+    protected void sleepBeforeRetryFailedRefresh() throws InterruptedException {
+      LOG.info("sleep started due to failed refresh");
+      refreshFailed.set(true);
+      continueRefreshThread.await(20, TimeUnit.SECONDS);
+      LOG.info("sleep due to failed refresh finished");
+    }
+
+    public void assertRefreshFailsEventually(Duration timeout) {
+      assertEventually(timeout, () -> refreshFailed.get());
+    }
+
+    public void continueWithRetryAfterFailedRefresh() {
+      LOG.info("continue refresh thread");
+      continueRefreshThread.countDown();
+    }
+  }
+
+
+  @Test
+  public void shouldLoginUsingKerberos() throws Exception {
+    login = new TestableKerberosLogin();
+    login.startThreadIfNeeded();
+
+    assertPrincipalLoggedIn();
+  }
+
+
+  @Test
+  public void shouldRenewTicketUsingKerberos() throws Exception {
+    login = new TestableKerberosLogin();
+    login.startThreadIfNeeded();
+
+    long initialLoginTime = login.getLastLogin();
+
+    // ticket lifetime is 5sec, so we will trigger ticket renewal in each ~2-3 sec
+    assertTicketRefreshHappenedUntil(Duration.ofSeconds(15));
+
+    assertPrincipalLoggedIn();
+    assertTrue(initialLoginTime < login.getLastLogin());
+  }
+
+
+  @Test
+  public void shouldRecoverIfKerberosNotAvailableForSomeTime() throws Exception {
+    login = new TestableKerberosLogin();
+    login.startThreadIfNeeded();
+
+    assertTicketRefreshHappenedUntil(Duration.ofSeconds(15));
+
+    stopMiniKdc();
+
+    // ticket lifetime is 5sec, so we will trigger ticket renewal in each ~2-3 sec
+    // the very next ticket renewal should fail (as KDC is offline)
+    login.assertRefreshFailsEventually(Duration.ofSeconds(15));
+
+    // now the ticket thread is "sleeping", it will retry the refresh later
+
+    // we restart KDC, then terminate the "sleeping" and expecting
+    // that the next retry should succeed
+    startMiniKdcAndAddPrincipal();
+    login.continueWithRetryAfterFailedRefresh();
+    assertTicketRefreshHappenedUntil(Duration.ofSeconds(15));
+
+    assertPrincipalLoggedIn();
+  }
+
+
+  private void assertPrincipalLoggedIn() {
+    assertEquals(PRINCIPAL, login.getUserName());
+    assertNotNull(login.getSubject());
+    assertEquals(1, login.getSubject().getPrincipals().size());
+    Principal actualPrincipal = login.getSubject().getPrincipals().iterator().next();
+    assertEquals(PRINCIPAL, actualPrincipal.getName());
+  }
+
+  private void assertTicketRefreshHappenedUntil(Duration timeout) {
+    long lastLoginTime = login.getLastLogin();
+    assertEventually(timeout, () -> login.getLastLogin() != lastLoginTime
+      && login.getSubject() != null && !login.getSubject().getPrincipals().isEmpty());
+  }
+
+  private static void assertEventually(Duration timeout, Supplier<Boolean> test) {
+    assertTimeout(timeout, () -> {
+      while (true) {
+        if (test.get()) {
+          return;
+        }
+        Thread.sleep(100);
+      }
+    });
+  }
+
+  public static void startMiniKdcAndAddPrincipal() throws Exception {
+    kdcWorkDir = createTmpDirInside(testTempDir);
+
+    Properties conf = MiniKdc.createConf();
+    conf.setProperty(MAX_TICKET_LIFETIME, TICKET_LIFETIME);
+    conf.setProperty(MIN_TICKET_LIFETIME, TICKET_LIFETIME);
+
+    kdc = new MiniKdc(conf, kdcWorkDir);
+    kdc.start();
+
+    String principalName = PRINCIPAL.substring(0, PRINCIPAL.lastIndexOf("@"));
+    kdc.createPrincipal(new File(KerberosTestUtils.getKeytabFile()), principalName);
+  }
+
+  private static void stopMiniKdc() {
+    if (kdc != null) {
+      kdc.stop();
+      kdc = null;
+    }
+    if (kdcWorkDir != null) {
+      FileUtils.deleteQuietly(kdcWorkDir);
+      kdcWorkDir = null;
+    }
+  }
+
+  private static File createTmpDirInside(File parentDir) throws IOException {
+    File tmpFile = File.createTempFile("test", ".junit", parentDir);
+    // don't delete tmpFile - this ensures we don't attempt to create
+    // a tmpDir with a duplicate name
+    File tmpDir = new File(tmpFile + ".dir");
+    // never true if tmpfile does it's job
+    assertFalse(tmpDir.exists());
+    assertTrue(tmpDir.mkdirs());
+    return tmpDir;
+  }
+
+  private static void setupJaasConfig(String jaasEntries) {
+    try {
+      File saslConfFile = new File(testTempDir, "jaas.conf");
+      FileWriter fwriter = new FileWriter(saslConfFile);
+      fwriter.write(jaasEntries);
+      fwriter.close();
+      System.setProperty("java.security.auth.login.config", saslConfFile.getAbsolutePath());
+    } catch (IOException ioe) {
+      LOG.error("Failed to initialize JAAS conf file", ioe);
+    }
+
+    // refresh the SASL configuration in this JVM (making sure that we use the latest config
+    // even if other tests already have been executed and initialized the SASL configs before)
+    Configuration.getConfiguration().refresh();
+  }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
index 755712b79f9..db95d8d6d30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
@@ -19,11 +19,17 @@
 package org.apache.zookeeper.server.quorum.auth;
 
 import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.UUID;
+import javax.security.auth.login.AppConfigurationEntry;
+import javax.security.auth.login.Configuration;
 import org.apache.zookeeper.util.SecurityUtils;
 
 public class KerberosTestUtils {
 
+    private static final boolean IBM_JAVA = System.getProperty("java.vendor").contains("IBM");
+
     private static String keytabFile = new File(System.getProperty("build.test.dir", "build"), UUID.randomUUID().toString()).getAbsolutePath();
 
     public static String getRealm() {
@@ -81,4 +87,59 @@ public static String replacePattern(String[] components, String hostname) {
         }
     }
 
+    public static class KerberosConfiguration extends Configuration {
+
+        private String principal;
+        private String keytab;
+        private boolean isInitiator;
+
+        private KerberosConfiguration(String principal, File keytab, boolean client) {
+            this.principal = principal;
+            this.keytab = keytab.getAbsolutePath();
+            this.isInitiator = client;
+        }
+
+        public static Configuration createClientConfig(String principal, File keytab) {
+            return new KerberosConfiguration(principal, keytab, true);
+        }
+
+        public static Configuration createServerConfig(String principal, File keytab) {
+            return new KerberosConfiguration(principal, keytab, false);
+        }
+
+        private static String getKrb5LoginModuleName() {
+            return System.getProperty("java.vendor").contains("IBM")
+              ? "com.ibm.security.auth.module.Krb5LoginModule"
+              : "com.sun.security.auth.module.Krb5LoginModule";
+        }
+
+        @Override
+        public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
+            Map<String, String> options = new HashMap<String, String>();
+            options.put("principal", principal);
+            options.put("refreshKrb5Config", "true");
+            if (IBM_JAVA) {
+                options.put("useKeytab", keytab);
+                options.put("credsType", "both");
+            } else {
+                options.put("keyTab", keytab);
+                options.put("useKeyTab", "true");
+                options.put("storeKey", "true");
+                options.put("doNotPrompt", "true");
+                options.put("useTicketCache", "true");
+                options.put("renewTGT", "true");
+                options.put("isInitiator", Boolean.toString(isInitiator));
+            }
+            String ticketCache = System.getenv("KRB5CCNAME");
+            if (ticketCache != null) {
+                options.put("ticketCache", ticketCache);
+            }
+            options.put("debug", "true");
+
+            return new AppConfigurationEntry[]{new AppConfigurationEntry(getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options)};
+        }
+
+    }
+
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
index 4adcc0b011a..fdd68b5bc83 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
@@ -63,6 +63,7 @@
  *   <li>kdc.port=0 (ephemeral port)</li>
  *   <li>instance=DefaultKrbServer</li>
  *   <li>max.ticket.lifetime=86400000 (1 day)</li>
+ *   <li>min.ticket.lifetime=3600000 (1 hour)</li>
  *   <li>max.renewable.lifetime=604800000 (7 days)</li>
  *   <li>transport=TCP</li>
  *   <li>debug=false</li>
@@ -148,6 +149,7 @@ public void run() {
     public static final String KDC_PORT = "kdc.port";
     public static final String INSTANCE = "instance";
     public static final String MAX_TICKET_LIFETIME = "max.ticket.lifetime";
+    public static final String MIN_TICKET_LIFETIME = "min.ticket.lifetime";
     public static final String MAX_RENEWABLE_LIFETIME = "max.renewable.lifetime";
     public static final String TRANSPORT = "transport";
     public static final String DEBUG = "debug";
@@ -159,11 +161,11 @@ public void run() {
         PROPERTIES.add(ORG_NAME);
         PROPERTIES.add(ORG_DOMAIN);
         PROPERTIES.add(KDC_BIND_ADDRESS);
-        PROPERTIES.add(KDC_BIND_ADDRESS);
         PROPERTIES.add(KDC_PORT);
         PROPERTIES.add(INSTANCE);
         PROPERTIES.add(TRANSPORT);
         PROPERTIES.add(MAX_TICKET_LIFETIME);
+        PROPERTIES.add(MIN_TICKET_LIFETIME);
         PROPERTIES.add(MAX_RENEWABLE_LIFETIME);
 
         DEFAULT_CONFIG.setProperty(KDC_BIND_ADDRESS, "localhost");
@@ -173,6 +175,7 @@ public void run() {
         DEFAULT_CONFIG.setProperty(ORG_DOMAIN, "COM");
         DEFAULT_CONFIG.setProperty(TRANSPORT, "TCP");
         DEFAULT_CONFIG.setProperty(MAX_TICKET_LIFETIME, "86400000");
+        DEFAULT_CONFIG.setProperty(MIN_TICKET_LIFETIME, "3600000");
         DEFAULT_CONFIG.setProperty(MAX_RENEWABLE_LIFETIME, "604800000");
         DEFAULT_CONFIG.setProperty(DEBUG, "false");
     }
@@ -313,6 +316,10 @@ private void prepareKdcServer() throws Exception {
             throw new IllegalArgumentException("Need to set transport!");
         }
         simpleKdc.getKdcConfig().setString(KdcConfigKey.KDC_SERVICE_NAME, conf.getProperty(INSTANCE));
+        long minTicketLifetimeConf = Long.parseLong(conf.getProperty(MIN_TICKET_LIFETIME)) / 1000;
+        simpleKdc.getKdcConfig().setLong(KdcConfigKey.MINIMUM_TICKET_LIFETIME, minTicketLifetimeConf);
+        long maxTicketLifetimeConf = Long.parseLong(conf.getProperty(MAX_TICKET_LIFETIME)) / 1000;
+        simpleKdc.getKdcConfig().setLong(KdcConfigKey.MAXIMUM_TICKET_LIFETIME, maxTicketLifetimeConf);
         if (conf.getProperty(DEBUG) != null) {
             krb5Debug = getAndSet(SUN_SECURITY_KRB5_DEBUG, conf.getProperty(DEBUG));
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
index 4ba6edcefaa..3e57f9a4663 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
@@ -23,18 +23,15 @@
 import java.io.File;
 import java.security.Principal;
 import java.util.Arrays;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
 import javax.security.auth.Subject;
 import javax.security.auth.kerberos.KerberosPrincipal;
-import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginContext;
 import org.apache.kerby.kerberos.kerb.keytab.Keytab;
 import org.apache.kerby.kerberos.kerb.type.base.PrincipalName;
+import org.apache.zookeeper.server.quorum.auth.KerberosTestUtils.KerberosConfiguration;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
 
@@ -47,7 +44,6 @@
  */
 public class MiniKdcTest extends KerberosSecurityTestcase {
 
-    private static final boolean IBM_JAVA = System.getProperty("java.vendor").contains("IBM");
 
     @Test
     @Timeout(value = 60)
@@ -74,59 +70,6 @@ public void testKeytabGen() throws Exception {
             principals);
     }
 
-    private static class KerberosConfiguration extends Configuration {
-
-        private String principal;
-        private String keytab;
-        private boolean isInitiator;
-
-        private KerberosConfiguration(String principal, File keytab, boolean client) {
-            this.principal = principal;
-            this.keytab = keytab.getAbsolutePath();
-            this.isInitiator = client;
-        }
-
-        public static Configuration createClientConfig(String principal, File keytab) {
-            return new KerberosConfiguration(principal, keytab, true);
-        }
-
-        public static Configuration createServerConfig(String principal, File keytab) {
-            return new KerberosConfiguration(principal, keytab, false);
-        }
-
-        private static String getKrb5LoginModuleName() {
-            return System.getProperty("java.vendor").contains("IBM")
-                ? "com.ibm.security.auth.module.Krb5LoginModule"
-                : "com.sun.security.auth.module.Krb5LoginModule";
-        }
-
-        @Override
-        public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
-            Map<String, String> options = new HashMap<String, String>();
-            options.put("principal", principal);
-            options.put("refreshKrb5Config", "true");
-            if (IBM_JAVA) {
-                options.put("useKeytab", keytab);
-                options.put("credsType", "both");
-            } else {
-                options.put("keyTab", keytab);
-                options.put("useKeyTab", "true");
-                options.put("storeKey", "true");
-                options.put("doNotPrompt", "true");
-                options.put("useTicketCache", "true");
-                options.put("renewTGT", "true");
-                options.put("isInitiator", Boolean.toString(isInitiator));
-            }
-            String ticketCache = System.getenv("KRB5CCNAME");
-            if (ticketCache != null) {
-                options.put("ticketCache", ticketCache);
-            }
-            options.put("debug", "true");
-
-            return new AppConfigurationEntry[]{new AppConfigurationEntry(getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options)};
-        }
-
-    }
 
     @Test
     @Timeout(value = 60)

From 640b6dd65fd302ada1ac46c9b8c32f17dadb0d32 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Tue, 1 Mar 2022 17:13:50 +0100
Subject: [PATCH 289/591] ZOOKEEPER-4479: C tests: Avoid some jitter which
 results in flaky tests

With these commits, the various tests in `TestOperations.cc` set the `last_sent` and `last_recv` fields of the "force-connected" ZooKeeper handle to deterministic values (which match the initial value of the time mock).

When that value is not specified, these fields get set to the "real" time at the end of the  `forceConnected` function, which can be sufficiently different from the value held in the mock for some of the tests to fail.

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1827 from ztzg/ZOOKEEPER-4479-flaky-c-test-operations
---
 .../tests/TestOperations.cc                   | 22 +++++++++----------
 .../zookeeper-client-c/tests/ZKMocks.cc       | 11 +++++++---
 .../zookeeper-client-c/tests/ZKMocks.h        |  2 +-
 3 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
index ddb9533e8ac..a36af8417e4 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
@@ -130,7 +130,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -173,7 +173,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -216,7 +216,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -267,7 +267,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -344,7 +344,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
 
         int fd=0;
         int interest=0;
@@ -379,7 +379,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -426,7 +426,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &now.tv);
         
         // queue up a request; keep it pending (as if the server is busy or has died)
         AsyncGetOperationCompletion res1;
@@ -481,7 +481,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // issue a request
@@ -520,7 +520,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // will handle completion on request #1 and issue request #2 from it
@@ -594,7 +594,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // issue a multi request
@@ -639,7 +639,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // these shall persist during the test
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
index 54c0819d9cf..674945e043c 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
@@ -525,7 +525,7 @@ void ZookeeperServer::notifyBufferSent(const std::string& buffer){
     addRecvResponse(e);
 }
 
-void forceConnected(zhandle_t* zh){
+void forceConnected(zhandle_t* zh, const struct timeval *last_recv_send){
     // simulate connected state
     zh->state=ZOO_CONNECTED_STATE;
 
@@ -536,8 +536,13 @@ void forceConnected(zhandle_t* zh){
     zh->addrs.next++;
 
     zh->input_buffer=0;
-    gettimeofday(&zh->last_recv,0);
-    gettimeofday(&zh->last_send,0);
+    if (last_recv_send) {
+        zh->last_recv = *last_recv_send;
+        zh->last_send = *last_recv_send;
+    } else {
+        gettimeofday(&zh->last_recv,0);
+        gettimeofday(&zh->last_send,0);
+    }
 }
 
 void terminateZookeeperThreads(zhandle_t* zh){
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
index 48eddabbc75..a091f2fe8ca 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
@@ -30,7 +30,7 @@
 // sets internal zhandle_t members to certain values to simulate the client 
 // connected state. This function should only be used with the single-threaded
 // Async API tests!
-void forceConnected(zhandle_t* zh); 
+void forceConnected(zhandle_t* zh, const struct timeval *last_recv_send = NULL);
 
 /**
  * Gracefully terminates zookeeper I/O and completion threads. 

From 99cb20e82743ef73db7257a3f9a4c55bc8acf037 Mon Sep 17 00:00:00 2001
From: 67 <67@gd67.com>
Date: Fri, 4 Mar 2022 13:56:43 +0000
Subject: [PATCH 290/591] ZOOKEEPER-4473: zooInspector root child creates fail
 with path validate fix

zooInspector root child creates fail with path validate fix.
create node update UI only if creation success, if fail show message dialog about the reason.
add basic ZooInspectorManagerImpl tests using mocked zookeeper client.

Author: 67 <67@gd67.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1818 from iamgd67/ZOOKEEPER-4473
---
 .../zookeeper-contrib-zooinspector/pom.xml    |   6 +
 .../inspector/gui/ZooInspectorTreeView.java   |  36 ++++--
 .../manager/ZooInspectorManagerImpl.java      |  16 ++-
 .../manager/ZooInspectorManagerImplTest.java  | 113 ++++++++++++++++++
 4 files changed, 160 insertions(+), 11 deletions(-)
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index f806e39092e..52ac31a1da4 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -114,5 +114,11 @@
       <artifactId>apache-rat-tasks</artifactId>
       <version>${rat.version}</version>
     </dependency>
+
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 </project>
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
index 6bff1ca4389..86422a3009e 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
@@ -19,6 +19,7 @@
 
 import com.nitido.utils.toaster.Toaster;
 import org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener;
+import org.apache.zookeeper.inspector.logger.LoggerFactory;
 import org.apache.zookeeper.inspector.manager.NodeListener;
 import org.apache.zookeeper.inspector.manager.Pair;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
@@ -355,6 +356,12 @@ private ZooInspectorTreeNode getSelectedNode() {
         return selected != null ? ((ZooInspectorTreeNode) selected.getLastPathComponent()) : null;
     }
 
+    private void showWarnDialog(String message){
+        JOptionPane.showMessageDialog(this,
+                message, "Error",
+                JOptionPane.ERROR_MESSAGE);
+    }
+
     ///////////////////////////////// BACKING DATA MODEL /////////////////////////////////
 
     /**
@@ -386,17 +393,30 @@ protected Boolean doInBackground() {
                 @Override
                 protected void done() {
                     //runs on the UI event thread
+                    boolean success;
+                    try {
+                        success = get();
+                    } catch (Exception e) {
+                        success = false;
+                        LoggerFactory.getLogger().error("create fail for {} {}", parentNode, newNodeName, e);
+                        showWarnDialog("create " + newNodeName + " in " + parentNode + " fail, exception is " + e.getMessage());
+                    }
 
-                    //extra logic to find the correct spot alphabetically to insert the new node in the tree`
-                    int i = 0;
-                    for (; i < parentNode.getChildCount(); i++) {
-                        ZooInspectorTreeNode existingChild = (ZooInspectorTreeNode) parentNode.getChildAt(i);
-                        if (newNodeName.compareTo(existingChild.getName()) < 0) {
-                            break;
+                    if (!success) {
+                        showWarnDialog("create " + newNodeName + " in " + parentNode + " fail, see log for more detail");
+                    }
+                    else {
+                        //extra logic to find the correct spot alphabetically to insert the new node in the tree`
+                        int i = 0;
+                        for (; i < parentNode.getChildCount(); i++) {
+                            ZooInspectorTreeNode existingChild = (ZooInspectorTreeNode) parentNode.getChildAt(i);
+                            if (newNodeName.compareTo(existingChild.getName()) < 0) {
+                                break;
+                            }
                         }
+                        insertNodeInto(new ZooInspectorTreeNode(newNodeName, parentNode, 0), parentNode, i);
+                        parentNode.setNumDisplayChildren(parentNode.getNumDisplayChildren() + 1);
                     }
-                    insertNodeInto(new ZooInspectorTreeNode(newNodeName, parentNode, 0), parentNode, i);
-                    parentNode.setNumDisplayChildren(parentNode.getNumDisplayChildren() + 1);
                     getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
                 }
             };
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
index 0db6140acb3..0897bac9eed 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
@@ -106,10 +106,13 @@ public class ZooInspectorManagerImpl implements ZooInspectorManager {
     private static final File defaultConnectionFile = new File(
             "./src/main/resources/defaultConnectionSettings.cfg");
 
-    private DataEncryptionManager encryptionManager;
+    //package visible for test
+    DataEncryptionManager encryptionManager;
     private String connectString;
     private int sessionTimeout;
-    private ZooKeeper zooKeeper;
+
+    //package visible for test
+    ZooKeeper zooKeeper;
     private final Map<String, NodeWatcher> watchers = new HashMap<String, NodeWatcher>();
     protected boolean connected = true;
     private Properties lastConnectionProps;
@@ -390,7 +393,14 @@ public boolean createNode(String parent, String nodeName) {
             try {
                 String[] nodeElements = nodeName.split("/");
                 for (String nodeElement : nodeElements) {
-                    String node = parent + "/" + nodeElement;
+                    String node;
+                    //for case parent is "/" and maybe other cases
+                    if (parent.endsWith("/")) {
+                        node = parent + nodeElement;
+                    }
+                    else {
+                        node = parent + "/" + nodeElement;
+                    }
                     Stat s = zooKeeper.exists(node, false);
                     if (s == null) {
                         zooKeeper.create(node, this.encryptionManager
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java
new file mode 100644
index 00000000000..5057d543cba
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java
@@ -0,0 +1,113 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector.manager;
+
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.inspector.encryption.BasicDataEncryptionManager;
+import org.apache.zookeeper.retry.ZooKeeperRetry;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.stubbing.Answer;
+
+import java.io.IOException;
+
+public class ZooInspectorManagerImplTest {
+
+    /**
+     * test create zookeeper node operation,
+     * no easy way to create a real zk server so use a mocked client that only validate path
+     *
+     * @throws IOException
+     * @throws KeeperException
+     * @throws InterruptedException
+     */
+    @Test
+    public void testNodeCreateRoot() throws IOException, KeeperException, InterruptedException {
+        ZooKeeper mockedZk = getMockedZk();
+
+        ZooInspectorManagerImpl manager = getInspectorManagerImpl(mockedZk);
+
+        boolean createSuccess = manager.createNode("/", "test");
+        Assert.assertTrue(createSuccess);
+    }
+
+    /**
+     * test create a normal child node
+     *
+     * @throws IOException
+     * @throws KeeperException
+     * @throws InterruptedException
+     */
+
+    @Test
+    public void testNodeCreateNormal() throws IOException, KeeperException, InterruptedException {
+        ZooKeeper mockedZk = getMockedZk();
+
+        ZooInspectorManagerImpl manager = getInspectorManagerImpl(mockedZk);
+
+        boolean createSuccess = manager.createNode("/parent", "test");
+        Assert.assertTrue(createSuccess);
+    }
+
+
+    /**
+     * create a mocked zk client only check path validate
+     *
+     * @return
+     * @throws KeeperException
+     * @throws InterruptedException
+     */
+    private ZooKeeper getMockedZk() throws KeeperException, InterruptedException {
+        ZooKeeper mockZk = Mockito.mock(ZooKeeperRetry.class);
+        Mockito.when(mockZk.exists(Mockito.anyString(), Mockito.anyBoolean())).then((Answer<Stat>) invocation -> {
+            String path = invocation.getArgument(0);
+            PathUtils.validatePath(path);
+            return null;
+        });
+        Mockito.when(mockZk.create(Mockito.anyString(), Mockito.any(), Mockito.any(),
+                Mockito.any())).then(new Answer<String>() {
+            @Override
+            public String answer(InvocationOnMock invocation) throws Throwable {
+                String path = invocation.getArgument(0);
+                PathUtils.validatePath(path);
+                return path;
+            }
+        });
+        return mockZk;
+    }
+
+    /**
+     * create a inspector manager instance from zk
+     *
+     * @param zooKeeper
+     * @return
+     * @throws IOException
+     */
+    private ZooInspectorManagerImpl getInspectorManagerImpl(ZooKeeper zooKeeper) throws IOException {
+        ZooInspectorManagerImpl manager = new ZooInspectorManagerImpl();
+        manager.zooKeeper = zooKeeper;
+        manager.connected = true;
+        manager.encryptionManager = new BasicDataEncryptionManager();
+        return manager;
+    }
+}

From aa1d22d92dc26a587f9d55562c34ed4751e1d1bc Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Tue, 8 Mar 2022 10:35:33 +0800
Subject: [PATCH 291/591] 1829

- rename commos-io LICENSE file to 2.11.0
- create file for commons-cli (ASF project)

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>, maoling <maoling@apache.org>

Closes #1829 from eolivelli/ZOOKEEPER-4482
---
 ...ICENSE.txt => commons-cli-1.4.LICENSE.txt} |   0
 .../lib/commons-io-2.11.0.LICENSE.txt         | 203 ++++++++++++++++++
 2 files changed, 203 insertions(+)
 rename zookeeper-server/src/main/resources/lib/{commons-io-2.7.LICENSE.txt => commons-cli-1.4.LICENSE.txt} (100%)
 create mode 100644 zookeeper-server/src/main/resources/lib/commons-io-2.11.0.LICENSE.txt

diff --git a/zookeeper-server/src/main/resources/lib/commons-io-2.7.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-cli-1.4.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/commons-io-2.7.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/commons-cli-1.4.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/commons-io-2.11.0.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-io-2.11.0.LICENSE.txt
new file mode 100644
index 00000000000..6b0b1270ff0
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/commons-io-2.11.0.LICENSE.txt
@@ -0,0 +1,203 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

From 09117f8ed850cc12eba0d6f0ed7615e7983039aa Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Sat, 12 Mar 2022 15:10:28 +0800
Subject: [PATCH 292/591] ZOOKEEPER-4474: Drop unused ZooDefs.opNames

Changes:
* Unused `ZooDefs.opNames` dropped.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: maoling <maoling@apache.org>

Closes #1822 from kezhuw/ZOOKEEPER-4474-drop-unused-ZooDefs.opNames
---
 .../src/main/java/org/apache/zookeeper/ZooDefs.java             | 2 --
 1 file changed, 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
index 9cf70787668..d74bb80079b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
@@ -161,6 +161,4 @@ public interface AddWatchModes {
         int persistentRecursive = 1;  // matches AddWatchMode.PERSISTENT_RECURSIVE
     }
 
-    public static final String[] opNames = {"notification", "create", "delete", "exists", "getData", "setData", "getACL", "setACL", "getChildren", "getChildren2", "getMaxChildren", "setMaxChildren", "ping", "reconfig", "getConfig"};
-
 }

From 7c864336d221d7f76f18f62ab84c3e98f0a77104 Mon Sep 17 00:00:00 2001
From: deko2369 <keinissy@gmail.com>
Date: Mon, 21 Mar 2022 13:59:16 +0800
Subject: [PATCH 293/591] Updated programmer docs for generating jute files

Changes:
* Updated programmer docs to build Zookeeper C client

Author: deko2369 <keinissy@gmail.com>

Reviewers: maoling <maoling@apache.org>

Closes #1831 from deko2369/update_programmers_docs
---
 .../src/main/resources/markdown/zookeeperProgrammers.md        | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index c2933e21dbb..1e585a735a8 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1401,8 +1401,7 @@ If you're building the client from a check-out from the Apache
 repository, follow the steps outlined below. If you're building from a
 project source package downloaded from apache, skip to step **3**.
 
-1. Run `ant compile_jute` from the ZooKeeper
-  top level directory (*.../trunk*).
+1. Run `mvn compile` in zookeeper-jute directory (*.../trunk/zookeeper-jute*).
   This will create a directory named "generated" under
   *.../trunk/zookeeper-client/zookeeper-client-c*.
 1. Change directory to the*.../trunk/zookeeper-client/zookeeper-client-c*

From a160981e37d2907717284ec9f6eab5e17e8aecfa Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Mon, 28 Mar 2022 10:34:06 +0800
Subject: [PATCH 294/591] ZOOKEEPER-4494: Fix error message format

cc maoling eolivelli

Author: tison <wander4096@gmail.com>

Reviewers: maoling <maoling@apache.org>

Closes #1838 from tisonkun/patch-2
---
 .../java/org/apache/zookeeper/server/util/SerializeUtils.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
index fcc5c8f4b70..464621e6afe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
@@ -101,7 +101,7 @@ public static TxnLogEntry deserializeTxn(byte[] txnBytes) throws IOException {
             txn = new MultiTxn();
             break;
         default:
-            throw new IOException("Unsupported Txn with type=%d" + hdr.getType());
+            throw new IOException("Unsupported Txn with type=" + hdr.getType());
         }
         if (txn != null) {
             try {

From d7cb4e8b7b14ea94e7ea8cd2a8e43fa7e8668132 Mon Sep 17 00:00:00 2001
From: 67 <67@gd67.com>
Date: Tue, 29 Mar 2022 09:52:54 +0000
Subject: [PATCH 295/591] ZOOKEEPER-4464: zooinspector display "Ephemeral
 Owner" in hex for easy match to jmx session

zooinspector now show "Ephemeral Owner" in 10 base number while JMX connections show in hex format. this makes it a little hard to match them.

It will be much better if hex format is shown too, I will create a pr add hex format just beside the 10 based one.

Author: 67 <67@gd67.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1813 from iamgd67/ZOOKEEPER-4464
---
 .../gui/nodeviewer/NodeViewerMetaData.java      | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
index 5c2df8d88c5..6a369c51d0e 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
@@ -118,7 +118,7 @@ protected void done() {
                     for (Map.Entry<String, String> entry : data.entrySet()) {
                         rowPos = 2 * i + 1;
                         JLabel label = new JLabel(entry.getKey());
-                        JTextField text = new JTextField(entry.getValue());
+                        JTextField text = new JTextField(formatValByKeyType(entry.getKey(),entry.getValue()));
                         text.setEditable(false);
                         GridBagConstraints c1 = new GridBagConstraints();
                         c1.gridx = 0;
@@ -164,6 +164,21 @@ protected void done() {
                     NodeViewerMetaData.this.metaDataPanel.revalidate();
                     NodeViewerMetaData.this.metaDataPanel.repaint();
                 }
+
+                private String formatValByKeyType(String key, String value) {
+                    if(key==null) return value;
+                    String formatedVal=value;
+                    switch (key){
+                        case "Ephemeral Owner":
+                            try{
+                                formatedVal = String.format("0x%x", Long.parseLong(value));
+                            }catch (NumberFormatException e){
+                                LoggerFactory.getLogger().warn("parse {}'s value {} to hex fail",key,value,e);
+                            }
+                            break;
+                    }
+                    return formatedVal;
+                }
             };
             worker.execute();
         }

From 91e0520133b82acb87ab60962fce5eae992d87e8 Mon Sep 17 00:00:00 2001
From: Sylvain Wallez <sylvain@bluxte.net>
Date: Wed, 30 Mar 2022 23:54:55 +0530
Subject: [PATCH 296/591] ZOOKEEPER-3652: Synchronize ClientCnxn outgoing queue
 flush on a stable internal value

When packets are added to ClientCnxn's outgoing packet queue we ensure there's no conflict with an ongoing flush of that queue because of connection loss.

Synchronization used to be on the state field's value. This value is both not stable (its value changes over time), possibly causing improper synchronization, and global, which can cause contention in applications that run several ZooKeeper clients.

We now synchronize on outgoingQueue which is both local to a ClientCnxn's instance and stable.

Author: Sylvain Wallez <sylvain@bluxte.net>

Reviewers: maoling <maoling@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1257 from swallez/ZOOKEEPER-3652 and squashes the following commits:

82e2cad2c [Sylvain Wallez] Instruct SpotBugs that we know what we're doing when synchronizing on outgoingQueue
b0bc03d6f [Sylvain Wallez] ZOOKEEPER-3652: Synchronize ClientCnxn outgoing queue flush on a stable internal value
---
 .../src/main/java/org/apache/zookeeper/ClientCnxn.java      | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 347a68f80b5..cef17432643 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1175,6 +1175,7 @@ private void logStartConnect(InetSocketAddress addr) {
         }
 
         @Override
+        @SuppressFBWarnings("JLM_JSR166_UTILCONCURRENT_MONITORENTER")
         public void run() {
             clientCnxnSocket.introduce(this, sessionId, outgoingQueue);
             clientCnxnSocket.updateNow();
@@ -1303,7 +1304,7 @@ public void run() {
                 }
             }
 
-            synchronized (state) {
+            synchronized (outgoingQueue) {
                 // When it comes to this point, it guarantees that later queued
                 // packet to outgoingQueue will be notified of death.
                 cleanup();
@@ -1645,6 +1646,7 @@ public Packet queuePacket(
         return queuePacket(h, r, request, response, cb, clientPath, serverPath, ctx, watchRegistration, null);
     }
 
+    @SuppressFBWarnings("JLM_JSR166_UTILCONCURRENT_MONITORENTER")
     public Packet queuePacket(
         RequestHeader h,
         ReplyHeader r,
@@ -1671,7 +1673,7 @@ public Packet queuePacket(
         // 1. synchronize with the final cleanup() in SendThread.run() to avoid race
         // 2. synchronized against each packet. So if a closeSession packet is added,
         // later packet will be notified.
-        synchronized (state) {
+        synchronized (outgoingQueue) {
             if (!state.isAlive() || closing) {
                 conLossPacket(packet);
             } else {

From 78bbb123cfcbdd8da9d118f08b49d1d00c43f53d Mon Sep 17 00:00:00 2001
From: Edwin Hobor <edwinhobor@gmail.com>
Date: Thu, 31 Mar 2022 00:27:23 +0530
Subject: [PATCH 297/591] ZOOKEEPER-4505: CVE-2020-36518 - Upgrade jackson
 databind to 2.13.2.1

CVE-2020-36518 vulnerability affects jackson-databind in Zookeeper (see https://github.com/advisories/GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.13.2.1 should address this issue.

Author: Edwin Hobor <edwinhobor@gmail.com>

Reviewers: maoling <maoling@apache.org>,Enrico Olivelli <eolivelli@apache.org>, Mohammad Arshad <arshad@apache.org>

Closes #1842 from edwin092/edwin/ZOOKEEPER-4505
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f14f317d134..5ff25149d93 100755
--- a/pom.xml
+++ b/pom.xml
@@ -470,7 +470,7 @@
     <netty.version>4.1.73.Final</netty.version>
     <netty.tcnative.version>2.0.48.Final</netty.tcnative.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
-    <jackson.version>2.13.1</jackson.version>
+    <jackson.version>2.13.2.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>

From 2173c92a2b054e2fa55fd69d0d9ea892b7cc7e66 Mon Sep 17 00:00:00 2001
From: Dora Horvat <horvath.dora06@gmail.com>
Date: Fri, 1 Apr 2022 07:20:45 +0000
Subject: [PATCH 298/591] ZOOKEEPER-4490: Publish Clover results to SonarQube

The newly added script runs maven with the clover profile which generates the test coverage data and then uploads it to SonarQube if the necessary parameters were given.

The required parameters for publishing to SonarQube are:
- Host URL
- Login Credentials
- Project Key

Example commands:
- Run clover code analysis (without publishing to SonarQube)
`sh tools/sonar/code-coverage.sh`

- Run clover code analysis and publish the results to SonarQube
`sh tools/sonar/code-coverage.sh -l ProjectCredentials -u https://exampleserver.com  -k Project_Key`

Author: Dora Horvath <dora.horvath@cloudera.com>

Reviewers: Norbert Kalmar <nkalmar@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1835 from horvathdora/ZOOKEEPER-4490
---
 pom.xml                      | 118 ++++++++++++++++++++++++++++-------
 tools/sonar/code-coverage.sh |  70 +++++++++++++++++++++
 2 files changed, 164 insertions(+), 24 deletions(-)
 create mode 100755 tools/sonar/code-coverage.sh

diff --git a/pom.xml b/pom.xml
index 5ff25149d93..8bfded44ca6 100755
--- a/pom.xml
+++ b/pom.xml
@@ -445,6 +445,97 @@
         <maven.compiler.release>8</maven.compiler.release>
       </properties>
     </profile>
+    <profile>
+      <id>clover</id>
+      <activation>
+        <activeByDefault>false</activeByDefault>
+        <property>
+          <name>clover</name>
+        </property>
+      </activation>
+      <properties>
+        <cloverDatabase>${project.build.directory}/clover/zookeeper-coverage.db</cloverDatabase>
+      </properties>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.openclover</groupId>
+            <artifactId>clover-maven-plugin</artifactId>
+            <configuration>
+              <includesAllSourceRoots>false</includesAllSourceRoots>
+              <includesTestSourceRoots>true</includesTestSourceRoots>
+              <cloverDatabase>${cloverDatabase}</cloverDatabase>
+              <targetPercentage>50%</targetPercentage>
+              <outputDirectory>${project.build.directory}/clover</outputDirectory>
+              <alwaysReport>true</alwaysReport>
+              <generateHistorical>false</generateHistorical>
+              <cloverDatabase>${project.build.directory}/clover/zookeeper-coverage.db</cloverDatabase>
+              <cloverMergeDatabase>${project.build.directory}/clover/zookeeper-coverage.db</cloverMergeDatabase>
+              <outputDirectory>${project.build.directory}/clover</outputDirectory>
+              <generateHtml>true</generateHtml>
+              <generateXml>true</generateXml>
+              <includesAllSourceRoots>false</includesAllSourceRoots>
+              <includesTestSourceRoots>true</includesTestSourceRoots>
+              <includes>
+                <include>org/apache/zookeeper/**/*</include>
+              </includes>
+              <excludes>
+                <exclude>org/apache/zookeeper/version/**/*</exclude>
+                  <exclude>**/ReadOnlyModeTest.java</exclude>
+                  <exclude>**/KeeperStateTest.java</exclude>
+              </excludes>
+            </configuration>
+            <executions>
+              <execution>
+                <id>clover-setup</id>
+                <phase>process-sources</phase>
+                <goals>
+                  <goal>setup</goal>
+                </goals>
+              </execution>
+              <execution>
+                <id>clover</id>
+                <phase>test</phase>
+                <goals>
+                  <goal>clover</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+    <profile>
+      <id>sonar</id>
+      <properties>
+        <sonar.php.coverage.reportPaths>${project.build.directory}/clover/clover.xml</sonar.php.coverage.reportPaths>
+      </properties>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.sonarsource.scanner.maven</groupId>
+            <artifactId>sonar-maven-plugin</artifactId>
+          </plugin>
+        </plugins>
+        <pluginManagement>
+          <plugins>
+            <plugin>
+              <groupId>org.sonarsource.scanner.maven</groupId>
+              <artifactId>sonar-maven-plugin</artifactId>
+              <version>${sonar-maven-plugin.version}</version>
+              <configuration>
+                <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
+                <sonar.core.codeCoveragePlugin>clover</sonar.core.codeCoveragePlugin>
+                <sonar.clover.reportPath>${project.build.directory}/clover/clover.xml</sonar.clover.reportPath>
+                <sonar.surefire.reportsPath>target/surefire-reports</sonar.surefire.reportsPath>
+                <sonar.core.codeCoveragePlugin>clover</sonar.core.codeCoveragePlugin>
+                <sonar.clover.version>${clover-maven-plugin.version}</sonar.clover.version>
+              </configuration>
+            </plugin>
+          </plugins>
+        </pluginManagement>
+      </build>
+    </profile>
   </profiles>
 
   <properties>
@@ -481,6 +572,8 @@
     <checkstyle.version>8.39</checkstyle.version>
     <enforcer.version>3.0.0-M3</enforcer.version>
     <commons-io.version>2.11.0</commons-io.version>
+    <clover-maven-plugin.version>4.4.1</clover-maven-plugin.version>
+    <sonar-maven-plugin.version>3.7.0.1746</sonar-maven-plugin.version>
 
     <!-- parameters to pass to C client build -->
     <c-client-openssl>yes</c-client-openssl>
@@ -785,7 +878,7 @@
         <plugin>
           <groupId>org.openclover</groupId>
           <artifactId>clover-maven-plugin</artifactId>
-          <version>4.3.1</version>
+          <version>${clover-maven-plugin.version}</version>
         </plugin>
         <plugin>
           <groupId>com.github.spotbugs</groupId>
@@ -854,29 +947,6 @@
           </execution>
         </executions>
       </plugin>
-      <plugin>
-        <groupId>org.openclover</groupId>
-        <artifactId>clover-maven-plugin</artifactId>
-        <configuration>
-          <generateHtml>true</generateHtml>
-          <generateXml>true</generateXml>
-          <includes>
-            <include>org/apache/zookeeper/**/*</include>
-          </includes>
-          <excludes>
-            <exclude>org/apache/zookeeper/version/**/*</exclude>
-          </excludes>
-        </configuration>
-        <executions>
-          <execution>
-            <phase>pre-site</phase>
-            <goals>
-              <goal>instrument</goal>
-              <goal>aggregate</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-antrun-plugin</artifactId>
diff --git a/tools/sonar/code-coverage.sh b/tools/sonar/code-coverage.sh
new file mode 100755
index 00000000000..3ff55c77795
--- /dev/null
+++ b/tools/sonar/code-coverage.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+usage() {
+  echo
+  echo "options:"
+  echo "-h     Display help"
+  echo "-u     SonarQube Host URL"
+  echo "-l     SonarQube Login Credentials"
+  echo "-k     SonarQube Project Key"
+  echo "-n     SonarQube Project Name"
+  echo
+  echo "Important:"
+  echo "    The required parameters for publishing the coverage results to SonarQube:"
+  echo "      - Host URL"
+  echo "      - Login Credentials"
+  echo "      - Project Key"
+  echo
+}
+
+execute() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+  MAIN_POM="${SCRIPT_DIR}/../../pom.xml"
+
+  mvn -B -e -Pclover -f "$MAIN_POM" clean install -DskipTests -DskipShade
+
+  mvn -B -e -Pclover -f "$MAIN_POM" test -Dparallel-tests -DtestsThreadCount=8 -Dscale
+
+  mvn -B -e -Pclover -f "$MAIN_POM" clover:aggregate clover:clover
+
+  # If the required parameters are given, the code coverage results are uploaded to the SonarQube Server
+  if [ -n "$SONAR_LOGIN" ] && [ -n "$SONAR_PROJECT_KEY" ] && [ -n "$SONAR_URL" ]; then
+    mvn -B -e -Pclover -f "$MAIN_POM" sonar:sonar -Dsonar.clover.reportPath=./target/clover/clover.xml \
+      -Dsonar.host.url="$SONAR_URL" -Dsonar.login="$SONAR_LOGIN" -Dsonar.projectKey="$SONAR_PROJECT_KEY" -Dsonar.projectName="$SONAR_PROJECT_NAME"
+  fi
+}
+
+while getopts ":u:l:k:n:h" option; do
+  case $option in
+  u) SONAR_URL=${OPTARG:-} ;;
+  l) SONAR_LOGIN=${OPTARG:-} ;;
+  k) SONAR_PROJECT_KEY=${OPTARG:-} ;;
+  n) SONAR_PROJECT_NAME=${OPTARG:-} ;;
+  h) # Display usage
+    usage
+    exit
+    ;;
+  \?) # Invalid option
+    echo "Error: Invalid option"
+    exit
+    ;;
+  esac
+done
+
+# Start code analysis
+execute

From 5b12b0e4eb010dca9b46047f559c6847d7e0b5f7 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Tue, 5 Apr 2022 12:14:20 +0800
Subject: [PATCH 299/591] ZOOKEEPER-4467: Format OpCode.addWatch in
 Request.op2String

Changes:
* Format `OpCode.addWatch` as "addWatch" in `Request.op2String`.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1819 from kezhuw/ZOOKEEPER-4467-op_code_addWatch_string and squashes the following commits:

97f891da1 [Kezhu Wang] fixup! ZOOKEEPER-4467: Format OpCode.addWatch in Request.op2String
ebe6faa30 [Kezhu Wang] ZOOKEEPER-4467: Format OpCode.addWatch in Request.op2String
---
 .../org/apache/zookeeper/server/Request.java   |  4 +++-
 .../apache/zookeeper/server/ToStringTest.java  | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index a68203b207c..41e3d7fcd36 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -355,7 +355,7 @@ public static String op2String(int op) {
             case OpCode.deleteContainer:
                 return "deleteContainer";
             case OpCode.createTTL:
-                return "createTtl";
+                return "createTTL";
             case OpCode.multiRead:
                 return "multiRead";
             case OpCode.auth:
@@ -364,6 +364,8 @@ public static String op2String(int op) {
                 return "setWatches";
             case OpCode.setWatches2:
                 return "setWatches2";
+            case OpCode.addWatch:
+                return "addWatch";
             case OpCode.sasl:
                 return "sasl";
             case OpCode.getEphemerals:
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
index 365600fba93..25f3f564323 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
@@ -18,8 +18,12 @@
 
 package org.apache.zookeeper.server;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotSame;
+import java.lang.reflect.Field;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.proto.SetDataRequest;
 import org.junit.jupiter.api.Test;
 
@@ -37,4 +41,18 @@ public void testJuteToString() {
         assertNotSame("ERROR", req.toString());
     }
 
+    @Test
+    public void testOpCodeToString() throws Exception {
+        Class<?> clazz = ZooDefs.OpCode.class;
+        Field[] fields = clazz.getFields();
+
+        assertNotEquals(0, fields.length);
+
+        for (Field field : fields) {
+            int opCode = field.getInt(null);
+            String opString = Request.op2String(opCode);
+            assertEquals(field.getName(), opString);
+        }
+    }
+
 }

From 54cb5c39a445c63967ec7c3a46724fe87908440b Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Wed, 6 Apr 2022 13:27:16 +0530
Subject: [PATCH 300/591] ZOOKEEPER-4504: ZKUtil#deleteRecursive causing
 deadlock in HDFS HA functionality

Make ZKUtil#deleteRecursive API fully compatible with older versions

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1843 from arshadmohammad/ZOOKEEPER-4504-DeleteRecursive and squashes the following commits:

851bb1ee9 [Mohammad Arshad] Added javadoc for ZKUtil#deleteRecursive(zk, pathRoot, batchSize) API
e7b33116c [Mohammad Arshad] Added test case to verify ZKUtil.deleteRecursive() in sync and async mode
008b2bd4a [Mohammad Arshad] ZOOKEEPER-4504: ZKUtil#deleteRecursive causing deadlock in HDFS HA functionality
---
 .../java/org/apache/zookeeper/ZKUtil.java     | 22 ++++++--
 .../java/org/apache/zookeeper/ZKUtilTest.java | 50 +++++++++++++++++++
 2 files changed, 69 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index d2063414470..2ccdfc877f6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -49,7 +49,14 @@ public class ZKUtil {
      * If there is an error with deleting one of the sub-nodes in the tree,
      * this operation would abort and would be the responsibility of the app to handle the same.
      *
-     *
+     * @param zk Zookeeper client
+     * @param pathRoot path to be deleted
+     * @param batchSize number of delete operations to be submitted in one call.
+     *                  batchSize is also used to decide sync and async delete API invocation.
+     *                  If batchSize>0 then async otherwise sync delete API is invoked. batchSize>0
+     *                  gives better performance. batchSize<=0 scenario is handled to preserve
+     *                  backward compatibility.
+     * @return true if given node and all its sub nodes are deleted successfully otherwise false
      * @throws IllegalArgumentException if an invalid path is specified
      */
     public static boolean deleteRecursive(
@@ -61,7 +68,15 @@ public static boolean deleteRecursive(
         List<String> tree = listSubTreeBFS(zk, pathRoot);
         LOG.debug("Deleting tree: {}", tree);
 
-        return deleteInBatch(zk, tree, batchSize);
+        if (batchSize > 0) {
+            return deleteInBatch(zk, tree, batchSize);
+        } else {
+            for (int i = tree.size() - 1; i >= 0; --i) {
+                //Delete the leaves first and eventually get rid of the root
+                zk.delete(tree.get(i), -1); //Delete all versions of the node with -1.
+            }
+            return true;
+        }
     }
 
     /**
@@ -73,7 +88,8 @@ public static boolean deleteRecursive(
     public static void deleteRecursive(
         ZooKeeper zk,
         final String pathRoot) throws InterruptedException, KeeperException {
-        deleteRecursive(zk, pathRoot, 1000);
+        // batchSize=0 is passed to preserve the backward compatibility with older clients.
+        deleteRecursive(zk, pathRoot, 0);
     }
 
     private static class BatchedDeleteCbContext {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
index 51df907023a..a73ff2fa7e0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
@@ -25,10 +25,12 @@
 import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.File;
 import java.io.IOException;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.UUID;
+import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
@@ -119,4 +121,52 @@ public void testListNoneRootPathSuccess() throws IOException, InterruptedExcepti
         assertEquals(1, bList.size());
         assertIterableEquals(Collections.singletonList("/a/b"), bList);
     }
+
+    @Test
+    public void testDeleteRecursiveInAsyncMode() throws Exception {
+        int batchSize = 10;
+        testDeleteRecursiveInSyncAsyncMode(batchSize);
+    }
+
+    @Test
+    public void testDeleteRecursiveInSyncMode() throws Exception {
+        int batchSize = 0;
+        testDeleteRecursiveInSyncAsyncMode(batchSize);
+    }
+
+    // batchSize>0 is async mode otherwise it is sync mode
+    private void testDeleteRecursiveInSyncAsyncMode(int batchSize)
+        throws IOException, InterruptedException, KeeperException {
+        TestableZooKeeper zk = createClient();
+        String parentPath = "/a";
+        zk.create(parentPath, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int numberOfNodes = 50;
+        List<Op> ops = new ArrayList<>();
+        for (int i = 0; i < numberOfNodes; i++) {
+            ops.add(Op.create(parentPath + "/a" + i, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT));
+        }
+        zk.multi(ops);
+        ops.clear();
+
+        // check nodes create successfully
+        List<String> children = zk.getChildren(parentPath, false);
+        assertEquals(numberOfNodes, children.size());
+
+        // create one more level of z nodes
+        String subNode = "/a/a0";
+        for (int i = 0; i < numberOfNodes; i++) {
+            ops.add(Op.create(subNode + "/b" + i, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT));
+        }
+        zk.multi(ops);
+
+        // check sub nodes created successfully
+        children = zk.getChildren(subNode, false);
+        assertEquals(numberOfNodes, children.size());
+
+        ZKUtil.deleteRecursive(zk, parentPath, batchSize);
+        Stat exists = zk.exists(parentPath, false);
+        assertNull(exists, "ZKUtil.deleteRecursive() could not delete all the z nodes");
+    }
 }

From d5876e88d6bab3cc1cee04f996b9804ff21581cb Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Fri, 8 Apr 2022 22:08:55 +0530
Subject: [PATCH 301/591] ZOOKEEPER-4514: ClientCnxnSocketNetty throwing NPE

Moved channel object null check to sendPkt method to cover all calling scenarios

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1854 from arshadmohammad/ZOOKEEPER-4514-npe
---
 .../apache/zookeeper/ClientCnxnSocketNetty.java  | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
index 2686feddc68..df53978559a 100755
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -304,7 +304,7 @@ private void addBack(Packet head) {
      * @return a ChannelFuture that will complete when the write operation
      *         succeeds or fails.
      */
-    private ChannelFuture sendPktAndFlush(Packet p) {
+    private ChannelFuture sendPktAndFlush(Packet p) throws IOException {
         return sendPkt(p, true);
     }
 
@@ -314,7 +314,7 @@ private ChannelFuture sendPktAndFlush(Packet p) {
      * @return a ChannelFuture that will complete when the write operation
      *         succeeds or fails.
      */
-    private ChannelFuture sendPktOnly(Packet p) {
+    private ChannelFuture sendPktOnly(Packet p) throws IOException {
         return sendPkt(p, false);
     }
 
@@ -325,7 +325,10 @@ private ChannelFuture sendPktOnly(Packet p) {
         }
     };
 
-    private ChannelFuture sendPkt(Packet p, boolean doFlush) {
+    private ChannelFuture sendPkt(Packet p, boolean doFlush) throws IOException {
+        if (channel == null) {
+            throw new IOException("channel has been closed");
+        }
         // Assuming the packet will be sent out successfully. Because if it fails,
         // the channel will close and clean up queues.
         p.createBB();
@@ -336,7 +339,7 @@ private ChannelFuture sendPkt(Packet p, boolean doFlush) {
         return result;
     }
 
-    private void sendPrimePacket() {
+    private void sendPrimePacket() throws IOException {
         // assuming the first packet is the priming packet.
         sendPktAndFlush(outgoingQueue.remove());
     }
@@ -344,7 +347,7 @@ private void sendPrimePacket() {
     /**
      * doWrite handles writing the packets from outgoingQueue via network to server.
      */
-    private void doWrite(Queue<Packet> pendingQueue, Packet p, ClientCnxn cnxn) {
+    private void doWrite(Queue<Packet> pendingQueue, Packet p, ClientCnxn cnxn) throws IOException {
         updateNow();
         boolean anyPacketsSent = false;
         while (true) {
@@ -374,9 +377,6 @@ private void doWrite(Queue<Packet> pendingQueue, Packet p, ClientCnxn cnxn) {
 
     @Override
     void sendPacket(ClientCnxn.Packet p) throws IOException {
-        if (channel == null) {
-            throw new IOException("channel has been closed");
-        }
         sendPktAndFlush(p);
     }
 

From e5f84f46283d70b618ce00f2df51f4bfe31d9a44 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sat, 9 Apr 2022 23:12:14 +0530
Subject: [PATCH 302/591] ZOOKEEPER-4515: ZK Cli quit command always logs error

1. For connection closing state scenario, changed the log level to debug
2. When JVM exiting with code 0, then logging info instead of error

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: tison <wander4096@gmail.com>, Enrico Olivelli <eolivelli@apache.org>

Closes #1856 from arshadmohammad/ZOOKEEPER-4515-cli and squashes the following commits:

e7e248bd5 [Mohammad Arshad] Logging error only when exit code is non zero
31e124a2a [Mohammad Arshad] ZOOKEEPER-4515: ZK Cli quit command always logs error 1. For connection closing state scenario, changed the log level to debug 2. When JVM exiting with code 0, then logging info instead of error
---
 .../java/org/apache/zookeeper/ClientCnxn.java     |  9 +++++----
 .../org/apache/zookeeper/util/ServiceUtils.java   | 15 +++++++++++++--
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index cef17432643..0c9799c7345 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1284,10 +1284,11 @@ public void run() {
                 } catch (Throwable e) {
                     if (closing) {
                         // closing so this is expected
-                        LOG.warn(
-                            "An exception was thrown while closing send thread for session 0x{}.",
-                            Long.toHexString(getSessionId()),
-                            e);
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug(
+                                "An exception was thrown while closing send thread for session 0x{}.",
+                                Long.toHexString(getSessionId()), e);
+                        }
                         break;
                     } else {
                         LOG.warn(
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
index 544e13d7f47..944bbc03cd9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
@@ -39,7 +39,14 @@ private ServiceUtils() {
      */
     @SuppressFBWarnings("DM_EXIT")
     public static final Consumer<Integer> SYSTEM_EXIT = (code) -> {
-        LOG.error("Exiting JVM with code {}", code);
+        String msg = "Exiting JVM with code {}";
+        if (code == 0) {
+            // JVM exits normally
+            LOG.info(msg, code);
+        } else {
+            // JVM exits with error
+            LOG.error(msg, code);
+        }
         System.exit(code);
     };
 
@@ -47,8 +54,12 @@ private ServiceUtils() {
      * No-op strategy, useful for tests.
      */
     public static final Consumer<Integer> LOG_ONLY = (code) -> {
-        LOG.error("Fatal error, JVM should exit with code {}. "
+        if (code != 0) {
+            LOG.error("Fatal error, JVM should exit with code {}. "
                 + "Actually System.exit is disabled", code);
+        } else {
+            LOG.info("JVM should exit with code {}. Actually System.exit is disabled", code);
+        }
     };
 
     private static volatile Consumer<Integer> systemExitProcedure = SYSTEM_EXIT;

From 86690ff40cb5c9f5782f0971db16e8fd1c3528e6 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Sat, 16 Apr 2022 15:37:42 +0530
Subject: [PATCH 303/591] ZOOKEEPER-1875: NullPointerException in
 ClientCnxn$EventThread.processEvent

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>, Enrico Olivelli <eolivelli@apache.org>

Closes #1855 from arshadmohammad/ZOOKEEPER-1875-npe and squashes the following commits:

4a7d471e3 [Mohammad Arshad] Corrected impacted test cases
12f44d62e [Mohammad Arshad] ZOOKEEPER-1875: NullPointerException in ClientCnxn$EventThread.processEvent
---
 .../java/org/apache/zookeeper/ZooKeeper.java  | 78 ++++++++++++++++---
 .../org/apache/zookeeper/ZooKeeperTest.java   | 23 ++++++
 .../server/quorum/QuorumDigestTest.java       |  2 +-
 .../zookeeper/test/ObserverMasterTest.java    |  2 +-
 4 files changed, 92 insertions(+), 13 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 127f5a2a3f3..281355b1ac4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -442,7 +442,12 @@ public boolean isConnected() {
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if an invalid chroot path is specified
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) throws IOException {
         this(connectString, sessionTimeout, watcher, false);
@@ -491,7 +496,12 @@ public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) thro
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if an invalid chroot path is specified
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -556,7 +566,12 @@ public ZooKeeper(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if an invalid chroot path is specified
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -624,7 +639,12 @@ public ZooKeeper(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if an invalid chroot path is specified
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -640,6 +660,7 @@ public ZooKeeper(
             sessionTimeout,
             watcher);
 
+        validateWatcher(watcher);
         this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         this.hostProvider = hostProvider;
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
@@ -724,7 +745,12 @@ ClientCnxn createConnection(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if an invalid chroot path is specified
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -786,7 +812,12 @@ public ZooKeeper(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if an invalid chroot path is specified
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -852,8 +883,13 @@ public ZooKeeper(
      *            password for this session
      *
      * @throws IOException in cases of network failure
-     * @throws IllegalArgumentException if an invalid chroot path is specified
-     * @throws IllegalArgumentException for an invalid list of ZooKeeper hosts
+     * @throws IllegalArgumentException
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -926,7 +962,13 @@ public ZooKeeper(
      * @param aHostProvider
      *            use this as HostProvider to enable custom behaviour.
      * @throws IOException in cases of network failure
-     * @throws IllegalArgumentException if an invalid chroot path is specified
+     * @throws IllegalArgumentException
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -1013,7 +1055,12 @@ public ZooKeeper(
      *            configuring properties differently compared to other instances
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
-     *
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      * @since 3.5.5
      */
     public ZooKeeper(
@@ -1034,6 +1081,7 @@ public ZooKeeper(
             Long.toHexString(sessionId),
             (sessionPasswd == null ? "<null>" : "<hidden>"));
 
+        validateWatcher(watcher);
         this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
         this.hostProvider = hostProvider;
@@ -1111,7 +1159,13 @@ public ZooKeeper(
      *            allowed while write requests are not. It continues seeking for
      *            majority in the background.
      * @throws IOException in cases of network failure
-     * @throws IllegalArgumentException if an invalid chroot path is specified
+     * @throws IllegalArgumentException
+     *             if any of the following is true:
+     *             <ul>
+     *             <li> if an invalid chroot path is specified
+     *             <li> for an invalid list of ZooKeeper hosts
+     *             <li> watcher is null
+     *             </ul>
      */
     public ZooKeeper(
         String connectString,
@@ -1194,8 +1248,10 @@ public void addAuthInfo(String scheme, byte[] auth) {
     /**
      * Specify the default watcher for the connection (overrides the one
      * specified during construction).
+     * @throws IllegalArgumentException if watcher is null
      */
     public synchronized void register(Watcher watcher) {
+        validateWatcher(watcher);
         getWatchManager().setDefaultWatcher(watcher);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index c829e85da2a..9d45802bbfc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -815,4 +815,27 @@ public void testKeeperExceptionCreateNPE() {
         assertThrows(IllegalArgumentException.class, () -> KeeperException.create(Code.get(Integer.MAX_VALUE)));
     }
 
+    @Test
+    public void testInvalidWatcherRegistration() throws Exception {
+        String nullWatcherMsg = "Invalid Watcher, shouldn't be null!";
+        final ZooKeeper zk = createClient();
+        try {
+            zk.register(null);
+            fail("Should validate null watcher!");
+        } catch (IllegalArgumentException iae) {
+            assertEquals(nullWatcherMsg, iae.getMessage());
+        }
+        try {
+            new ZooKeeper(hostPort, 10000, null, false);
+            fail("Should validate null watcher!");
+        } catch (IllegalArgumentException iae) {
+            assertEquals(nullWatcherMsg, iae.getMessage());
+        }
+        try {
+            new ZooKeeper(hostPort, 10000, null, 10L, "".getBytes(), false);
+            fail("Should validate null watcher!");
+        } catch (IllegalArgumentException iae) {
+            assertEquals(nullWatcherMsg, iae.getMessage());
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
index af2fed8cf88..a9e65a44574 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
@@ -204,7 +204,7 @@ private void startServers(List<Integer> sids) throws InterruptedException {
 
     private void triggerOps(int sid, String prefix) throws Exception {
         TxnLogDigestTest.performOperations(servers.zk[sid], prefix);
-        servers.restartClient(sid, null);
+        servers.restartClient(sid, event -> { });
         waitForOne(servers.zk[sid], States.CONNECTED);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index 4ba33c7a854..ab30a1de047 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -213,7 +213,7 @@ public void testRevalidation(boolean testObserverMaster) throws Exception {
     public void testInOrderCommits(boolean testObserverMaster) throws Exception {
         setUp(-1, testObserverMaster);
 
-        zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, null);
+        zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, event -> { });
         for (int i = 0; i < 10; i++) {
             zk.create("/bulk"
                               + i, ("Initial data of some size").getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);

From eefae2b7127d055f6eb9b4565790cd57d6d39957 Mon Sep 17 00:00:00 2001
From: Manu Mathew <manu.mathew@netapp.com>
Date: Wed, 4 May 2022 14:48:38 +0000
Subject: [PATCH 304/591] ZOOKEEPER-2108 ZOOKEEPER-3908 ZOOKEEPER-4491: fixing
 zktreeutil, adding ssl support

Currently, zktreeutil tool **doesn't compile/work**. This PR brings back `zktreeutil` to life and adds SSL support to connect to TLS enabled ZooKeeper server.

**Following are the issues fixed with this PR.**

1) [ZOOKEEPER-2108](https://issues.apache.org/jira/browse/ZOOKEEPER-2108)  **(Compilation error in ZkAdaptor.cc with GCC 4.7 or later)**
    The compilation error in `ZkAdaptor.cc` is fixed by including the header file. Also, updated the `ZOOKEEPER_PATH` in `configure.ac`

2) [ZOOKEEPER-3908](https://issues.apache.org/jira/browse/ZOOKEEPER-3908) **(zktreeutil multiple issues)**
   Fixed the issues reported in this ticket.

3) [ZOOKEEPER-4491](https://issues.apache.org/jira/browse/ZOOKEEPER-4491) **(Adding SSL support to Zktreeutil)**

    -    Adds the SSL support to `zktreeutil` to talk to TLS enabled ZooKeeper server, If SSL params are passed, invoke `zookeeper_init_ssl` method to connect the server.

    -    Used the same OpenSSL library auto-detect code from the c-client `configure.ac`  (https://github.com/apache/zookeeper/pull/1159)

Attached the testing log.

[zktreeutil_testing_connection.txt](https://github.com/apache/zookeeper/files/8585349/zktreeutil_testing_connection.txt)

Author: Manu Mathew <manu.mathew@netapp.com>
Author: mathewmanu <manmathew@cs.stonybrook.edu>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1870 from mathew-manu/ZOOKEEPER-4491
---
 .../zookeeper-contrib-zktreeutil/README.txt   |  6 ++--
 .../zookeeper-contrib-zktreeutil/configure.ac | 33 +++++++++++++++++--
 .../src/Makefile.am                           |  6 +++-
 .../src/ZkAdaptor.cc                          | 31 +++++++++++++++--
 .../src/ZkAdaptor.h                           | 17 ++++++++--
 .../src/ZkTreeUtil.cc                         | 12 +++----
 .../src/ZkTreeUtil.h                          | 19 ++++++++++-
 .../src/ZkTreeUtilMain.cc                     | 15 ++++++++-
 8 files changed, 120 insertions(+), 19 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt b/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
index 43b06fa72c2..8250498bf57 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
@@ -38,7 +38,7 @@ Once ignored, the whole subtree is ignored during DIFF, UPDATE and WRITE.
 Pre-requisites
 --------------
 1. Linux system with 2.6.X kernel.
-2. Zookeeper C client library (locally built at ../../c/.libs) >= 3.X.X
+2. Zookeeper C client library (locally built at ../../zookeeper-client/zookeeper-client-c/target/c/.libs) >= 3.X.X
 3. Development build libraries (rpm packages):
   a. boost-devel >= 1.32.0
   b. libxml2-devel >= 2.7.3
@@ -60,7 +60,7 @@ versions.
 Testing  and usage of zktreeutil
 --------------------------------
 1.  Run Zookeeper server locally on port 2181
-2.  export LD_LIBRARY_PATH=../../c/.libs/:/usr/local/lib/
+2.  export LD_LIBRARY_PATH=../../zookeeper-client/zookeeper-client-c/target/c/.libs
 3.  ./src/zktreeutil --help # show help
 4.  ./src/zktreeutil --zookeeper=localhost:2181 --import --xmlfile=tests/zk_sample.xml 2>/dev/null                 # import sample ZK tree
 5.  ./src/zktreeutil --zookeeper=localhost:2181 --dump --path=/myapp/version-1.0 2>/dev/null                         # dump Zk subtree 
@@ -71,4 +71,4 @@ Testing  and usage of zktreeutil
 9.  ./src/zktreeutil -z localhost:2181 -E 2>/dev/null > zk_sample2.xml                                                         # export the mofied ZK tree
 10. ./src/zktreeutil -z localhost:2181 -U -x zk_sample.xml -p /myapp/version-1.0/distributions 2>/dev/null        # update with incr. changes
 11. ./src/zktreeutil --zookeeper=localhost:2181 --import --force --xmlfile=zk_sample2.xml 2>/dev/null             # re-prime the ZK tree
-
+12. ./src/zktreeutil --zookeeper=localhost:2188 --dump --ssl=/path/certs/root_ca.pem,/path/certs/node.crt,/path/certs/node.key   # connect with ssl params to the secureClientPort
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac b/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac
index b4a82a76af8..43867482ff6 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac
@@ -26,8 +26,8 @@ XML2_INCLUDE="/usr/include/libxml2"
 AC_SUBST(XML2_INCLUDE)
 
 # Zookeeper C client
-ZOOKEEPER_PATH=${BUILD_PATH}/../../c
-AC_CHECK_LIB(zookeeper_mt, main, [ZOOKEEPER="-L${ZOOKEEPER_PATH}/.libs -lzookeeper_mt"],,["-L${ZOOKEEPER_PATH}/.libs"])
+ZOOKEEPER_PATH=${BUILD_PATH}/../../zookeeper-client/zookeeper-client-c
+AC_CHECK_LIB(zookeeper_mt, main, [ZOOKEEPER="-L${ZOOKEEPER_PATH}/target/c/.libs -lzookeeper_mt"],,["-L${ZOOKEEPER_PATH}/target/c/.libs"])
 if test -z "${ZOOKEEPER}"; then
       AC_ERROR("... zookeeper C client not found!")
 fi
@@ -45,6 +45,35 @@ if test -z "${LOG4CXX}"; then
       AC_ERROR("... log4cxx not found!")
 fi
 
+dnl OpenSSL
+AC_ARG_WITH(openssl,
+ [AC_HELP_STRING([--with-openssl[=DIR]], [build with openssl (autodetect openssl library by default) )])],
+ [], [with_openssl=yes])
+AC_MSG_NOTICE([configuring SSL using --with-openssl=$with_openssl])
+saved_CPPFLAGS="$CPPFLAGS"
+saved_LDFLAGS="$LDFLAGS"
+if test "x$with_openssl" != "xno" && test "x$with_openssl" != "xyes" ; then
+        CPPFLAGS="$CPPFLAGS -I$with_openssl/include"
+        LDFLAGS="$LDFLAGS -L$with_openssl/lib"
+fi
+have_openssl=no
+AC_CHECK_HEADER(openssl/ssl.h, [ AC_CHECK_LIB(ssl, SSL_CTX_new, [have_openssl=yes]) ])
+if test "x$with_openssl" != "xno" && test "x$with_openssl" != "xyes" && test "x$have_openssl" != "xyes"; then
+    CPPFLAGS="$saved_CPPFLAGS"
+    LDFLAGS="$saved_LDFLAGS"
+fi
+if test "x$with_openssl" != xno && test "x$have_openssl" = xno; then
+    AC_MSG_WARN([cannot build SSL support -- openssl not found])
+    with_openssl=no
+fi
+if test "x$with_openssl" != xno; then
+    AC_MSG_NOTICE([building with SSL support])
+else
+    AC_MSG_NOTICE([building without SSL support])
+fi
+AM_CONDITIONAL([WANT_OPENSSL],[test "x$with_openssl" != xno])
+
+
 AC_SUBST(LOG4CXX)
 AC_SUBST(LOG4CXX_VERSION)
 AC_SUBST(LOG4CXX_INCLUDE)
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am
index 641077a88e4..7d665d079c9 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am
@@ -14,9 +14,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+if WANT_OPENSSL
+  OPENSSL_CPPFLAGS = -DHAVE_OPENSSL_H
+endif
+
 AM_CXXFLAGS = -I${ZOOKEEPER_PATH}/include -I${ZOOKEEPER_PATH}/generated \
     -I$(top_srcdir)/include -I${LOG4CXX_INCLUDE} -I/usr/include \
-      -I${XML2_INCLUDE}
+      -I${XML2_INCLUDE} -DTHREADED $(OPENSSL_CPPFLAGS)
 
 bin_PROGRAMS = zktreeutil
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
index 1df175a9bac..199b1ed6976 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
@@ -18,6 +18,7 @@
 
 #include "ZkAdaptor.h"
 #include <string.h>
+#include <unistd.h>
 #include <sstream>
 #include <iostream>
 #include <algorithm>
@@ -172,12 +173,36 @@ namespace zktreeutil
         disconnect();
 
         // Establish a new connection to ZooKeeper
-        mp_zkHandle = zookeeper_init( m_zkConfig.getHosts().c_str(), 
-                NULL, 
+#ifdef HAVE_OPENSSL_H
+        if (!m_zkConfig.getSslParams().empty())
+        {
+            mp_zkHandle = zookeeper_init_ssl( m_zkConfig.getHosts().c_str(),
+                m_zkConfig.getSslParams().c_str(),
+                NULL,
+                m_zkConfig.getLeaseTimeout(),
+                0,
+                NULL,
+                0);
+
+        }
+        else
+        {
+            mp_zkHandle = zookeeper_init( m_zkConfig.getHosts().c_str(),
+                NULL,
                 m_zkConfig.getLeaseTimeout(),
                 0,
                 NULL,
                 0);
+        }
+#else
+        mp_zkHandle = zookeeper_init( m_zkConfig.getHosts().c_str(),
+            NULL,
+            m_zkConfig.getLeaseTimeout(),
+            0,
+            NULL,
+            0);
+#endif
+
         if (mp_zkHandle == NULL)
         {
             // Invalid handle returned
@@ -201,7 +226,7 @@ namespace zktreeutil
                     << std::endl; 
                 return;
             }
-            else if ( state && state != ZOO_CONNECTING_STATE)
+            else if ( state && state != ZOO_NOTCONNECTED_STATE && state != ZOO_CONNECTING_STATE)
             {
                 // Not connecting any more... some other issue
                 std::ostringstream oss;
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
index 4b68e28db1f..91e63e0ac8f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
@@ -110,15 +110,18 @@ namespace zktreeutil
              * @param leaseTimeout the lease timeout (heartbeat)
              * @param autoReconnect whether to allow for auto-reconnect
              * @param connectTimeout the connect timeout, in milliseconds;
+             * @param certs ssl parameters to initiate SSL connection;
              */
             ZooKeeperConfig(const string &hosts, 
                     int leaseTimeout, 
                     bool autoReconnect = true, 
-                    long long int connectTimeout = 15000)
+                    long long int connectTimeout = 15000,
+                    const string &sslParams = "")
                 : m_hosts(hosts),
                 m_leaseTimeout(leaseTimeout), 
                 m_autoReconnect(autoReconnect),
-                m_connectTimeout(connectTimeout) {}
+                m_connectTimeout(connectTimeout),
+                m_sslParams(sslParams) {}
 
             /**
              * \brief Returns the list of ZK hosts to connect to.
@@ -143,6 +146,11 @@ namespace zktreeutil
              */
             long long int getConnectTimeout() const { return m_connectTimeout; }
 
+            /**
+             * \brief Returns the ssl params
+             */
+            string getSslParams() const { return m_sslParams; }
+
         private:
 
             /**
@@ -166,6 +174,11 @@ namespace zktreeutil
              * is established to ZK.
              */
             const long long int m_connectTimeout;
+
+            /**
+             * comma separated ssl parameters to initiate SSL connection.
+             */
+             const string m_sslParams;
     };
 
     /**
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc
index 270bf3105c7..77fdd96d024 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc
@@ -296,12 +296,12 @@ namespace zktreeutil
         return zkRootSptr;
     }
 
-    ZooKeeperAdapterSptr ZkTreeUtil::get_zkHandle (const string& zkHosts)
+    ZooKeeperAdapterSptr ZkTreeUtil::get_zkHandle (const string& zkHosts, const string& cert)
     {
         try
         {
             // Create an instance of ZK adapter.
-            ZooKeeperConfig config (zkHosts, 10000);
+            ZooKeeperConfig config (zkHosts, 10000, true, 15000, cert);
             ZooKeeperAdapterSptr zkHandleSptr =
                 ZooKeeperAdapterSptr (new ZooKeeperAdapter (config));
             return zkHandleSptr;
@@ -343,7 +343,7 @@ namespace zktreeutil
         }
 
         // Connect to ZK server
-        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts);
+        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts, getSslParams());
         std::cerr << "[zktreeutil] connected to ZK serverfor reading"
             << std::endl;
 
@@ -424,7 +424,7 @@ namespace zktreeutil
             bool force) const
     {
         // Connect to ZK server
-        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts);
+        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts, getSslParams());
         std::cerr << "[zktreeutil] connected to ZK server for writing"
             << std::endl;
 
@@ -517,7 +517,7 @@ namespace zktreeutil
         }
 
         // Load the rooted subtree from zookeeper
-        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts);
+        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts, getSslParams());
         std::cerr << "[zktreeutil] connected to ZK server for reading"
             << std::endl;
         ZkTreeNodeSptr zkLiveRootSptr = loadZkTree_ (zkHandle, path);
@@ -630,7 +630,7 @@ namespace zktreeutil
             if ((execFlags & EXECUTE)
                     || (execFlags & INTERACTIVE))
             {
-                zkHandleSptr = get_zkHandle (zkHosts);
+                zkHandleSptr = get_zkHandle (zkHosts, getSslParams());
                 std::cerr << "[zktreeutil] connected to ZK server for writing"
                     << std::endl;
             }
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
index 0a9be03f842..2fac401f785 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
@@ -185,9 +185,10 @@ namespace zktreeutil
              * \brief Connects to zookeeper and returns a valid ZK handle
              *
              * @param zkHosts comma separated list of host:port forming ZK quorum
+             * @param cert certificate file path
              * @param a valid ZK handle
              */
-            static ZooKeeperAdapterSptr get_zkHandle (const string& zkHosts);
+            static ZooKeeperAdapterSptr get_zkHandle (const string& zkHosts, const string& cert="");
 
 
         public:
@@ -252,10 +253,26 @@ namespace zktreeutil
                     const vector< ZkAction >& zkActions,
                     int execFlags) const;
 
+            /**
+             * \brief Sets the ssl params to be used for SSL connection
+             * @param cert ssl params
+             */
+             void setSslParams(const string& cert)
+             {
+                 sslParams_ = cert;
+             }
+
+            /**
+             * \brief Gets the ssl params
+             * @return the cert
+             */
+             string getSslParams() const { return sslParams_; }
+
         private:
 
             ZkTreeNodeSptr zkRootSptr_;     // ZK tree root node
             bool loaded_;                        // Falg indicating whether ZK tree loaded into memory
+            string sslParams_;              // Comma separated parameters to initiate SSL connection
     };
 }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc
index 8afebf6e2f7..28157506247 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc
@@ -43,9 +43,10 @@ static struct option long_options[] = {
     {"path",         required_argument,     0, 'p'},
     {"depth",         required_argument,     0, 'd'},
     {"zookeeper", required_argument,     0, 'z'},
+    {"ssl", required_argument,     0, 's'},
     {0, 0, 0, 0}
 };
-static char *short_options = "IEUFDfx:p:d:hz:";
+static char *short_options = "IEUFDfx:p:d:hz:s:";
 
 static void usage(int argc, char *argv[])
 {
@@ -128,6 +129,13 @@ static void usage(int argc, char *argv[])
         << std::endl
         << "\t  specifies information to connect to zookeeper."
         << std::endl;
+    std::cout
+        << "\t--ssl=<ssl params> or -s <ssl params>: "
+        << std::endl
+        << "\t  Comma separated parameters to initiate SSL connection."
+        << std::endl
+        << "\t  e.g.: server_cert.crt,client_cert.crt,client_priv_key.pem,passwd"
+        << std::endl;
 }
 
 int main(int argc, char **argv)
@@ -143,6 +151,7 @@ int main(int argc, char **argv)
      string zkHosts;
      string xmlFile;
      string path = "/";
+     string cert;
      int depth = 0;
      while (1)
      {
@@ -171,12 +180,16 @@ int main(int argc, char **argv)
                           break;
              case 'z': zkHosts = optarg;
                           break;
+             case 's': cert = optarg;
+                    break;
              case 'h': usage (argc, argv);
                           exit(0);
          }
      }
 
      ZkTreeUtil zkTreeUtil;
+     if (!cert.empty()) zkTreeUtil.setSslParams(cert);
+
      switch (op)
      {
          case 'I':    {

From 24073884e114c6d6a14d559dd74d219bc259792b Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Thu, 5 May 2022 08:25:19 +0200
Subject: [PATCH 305/591] ZOOKEEPER-4510: dependency-check:check failing -
 reload4j-1.2.19.jar: CVE-2020-9493, CVE-2022-23307

Upgraded dependency-check-maven plugin from 6.5.3 to 7.1.0

Author: Mohammad Arshad <arshad@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, ZhangJian He <shoothzj@apache.org>

Closes #1872 from arshadmohammad/ZOOKEEPER-4510-upgrade
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 8bfded44ca6..e0d5b1f9c25 100755
--- a/pom.xml
+++ b/pom.xml
@@ -891,7 +891,7 @@
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>6.5.3</version>
+          <version>7.1.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From aab3ff65c4daecbbf8fc3fc5369a2e456603fbb0 Mon Sep 17 00:00:00 2001
From: Ananya Singh <purpul90@gmail.com>
Date: Fri, 6 May 2022 00:21:05 +0530
Subject: [PATCH 306/591] ZOOKEEPER-4529: Upgrade netty to 4.1.76.Final

upgrading netty in master as per review in : https://github.com/apache/zookeeper/pull/1867

Author: Ananya Singh <purpul90@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Shoothzj <shoothzj@gmail.com>, Mohammad Arshad <arshad@apache.org>, Brahma Reddy Battula <brahma@apache.org>

Closes #1869 from AnanyaSingh2121/ZK-4529
---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.76.Final.LICENSE.txt} | 0
 ...3.Final.LICENSE.txt => netty-codec-4.1.76.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.76.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.76.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.76.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.76.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.76.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.73.Final.LICENSE.txt => netty-buffer-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.73.Final.LICENSE.txt => netty-codec-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.73.Final.LICENSE.txt => netty-common-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.73.Final.LICENSE.txt => netty-handler-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.73.Final.LICENSE.txt => netty-resolver-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.73.Final.LICENSE.txt => netty-transport-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.73.Final.LICENSE.txt => netty-transport-native-epoll-4.1.76.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index e0d5b1f9c25..47bef4b4c3b 100755
--- a/pom.xml
+++ b/pom.xml
@@ -558,7 +558,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.73.Final</netty.version>
+    <netty.version>4.1.76.Final</netty.version>
     <netty.tcnative.version>2.0.48.Final</netty.tcnative.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
     <jackson.version>2.13.2.1</jackson.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.76.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.73.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt

From 5b6823aea4389aa04b0a51f0c4d376002a77af9a Mon Sep 17 00:00:00 2001
From: Brahma Reddy Battula <brahma@apache.org>
Date: Fri, 6 May 2022 23:08:46 +0530
Subject: [PATCH 307/591] ZOOKEEPER-4531: Revert Netty TCNative changes Removed
 tcnative depdency as it is required after netty upgrade to 4.1.76 Removed
 tcnative CVE supressions

Author: Brahma Reddy Battula <brahma@apache.org>

Reviewers: Mohammad Arshad <arshad@apache.org>

Closes #1873 from brahmareddybattula/master
---
 owaspSuppressions.xml                         |  12 --
 pom.xml                                       |  12 --
 zookeeper-server/pom.xml                      |   4 -
 ...-tcnative-classes-2.0.48.Final.LICENSE.txt | 202 ------------------
 4 files changed, 230 deletions(-)
 delete mode 100644 zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 1325af98303..0890bfef4d0 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -34,18 +34,6 @@
       <!-- https://github.com/jeremylong/DependencyCheck/issues/1653
            False positive on Netty 4.x-->
       <cve>CVE-2018-12056</cve>
-      <!-- other false positives related to Netty TCNative 4.x -->
-      <cve>CVE-2021-43797</cve>
-      <cve>CVE-2019-16869</cve>
-      <cve>CVE-2015-2156</cve>
-      <cve>CVE-2021-37136</cve>
-      <cve>CVE-2014-3488</cve>
-      <cve>CVE-2021-37137</cve>
-      <cve>CVE-2019-20445</cve>
-      <cve>CVE-2019-20444</cve>
-      <cve>CVE-2021-21295</cve>
-      <cve>CVE-2021-21409</cve>
-      <cve>CVE-2021-21290</cve>
    </suppress>
    <suppress>
       <!-- Seems like false positive - we are not using Prometheus
diff --git a/pom.xml b/pom.xml
index 47bef4b4c3b..76d21a26678 100755
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,6 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.76.Final</netty.version>
-    <netty.tcnative.version>2.0.48.Final</netty.tcnative.version>
     <jetty.version>9.4.43.v20210629</jetty.version>
     <jackson.version>2.13.2.1</jackson.version>
     <jline.version>2.14.6</jline.version>
@@ -706,23 +705,12 @@
         <groupId>io.netty</groupId>
         <artifactId>netty-handler</artifactId>
         <version>${netty.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-tcnative-classes</artifactId>
-          </exclusion>
-        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-transport-native-epoll</artifactId>
         <version>${netty.version}</version>
       </dependency>
-      <dependency>
-        <groupId>io.netty</groupId>
-        <artifactId>netty-tcnative</artifactId>
-        <version>${netty.tcnative.version}</version>
-      </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-server</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 016a0c569e5..a90c0a4df6c 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -66,10 +66,6 @@
       <groupId>io.netty</groupId>
       <artifactId>netty-handler</artifactId>
     </dependency>
-      <dependency>
-        <groupId>io.netty</groupId>
-        <artifactId>netty-tcnative</artifactId>
-      </dependency>
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty-transport-native-epoll</artifactId>
diff --git a/zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-tcnative-classes-2.0.48.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

From 724864487457d6f2eb7c331ef338936e1375072b Mon Sep 17 00:00:00 2001
From: Manu Mathew <manu.mathew@netapp.com>
Date: Fri, 6 May 2022 17:52:40 +0000
Subject: [PATCH 308/591] ZOOKEEPER-3806: TLS - dynamic loading for client
 trust/key store

ZooKeer currently has support for reloading the Quorum Truststore & Keystore automatically when the certificate files change in the filesystem without server restart (https://github.com/apache/zookeeper/pull/680)

However, Reloading of key and trust store for **ClientX509Util** is not present; i.e., the server presented certs to the clients will not get reloaded automatically if the certificates in the filesystem change, short-lived certs requires the process restart.

Changes:

-  A new config property "zookeeper.client.certReload" is added, if it's true - ClientX509Util is reloaded automatically.

-  ZK uses an _X509AuthenticationProvider_ which is backed by an X509TrustManager and an X509KeyManager to perform _remote host certificate authentication_. We need to update the X509AuthenticationProvider's TrustStore as part of the X509Util file-watcher.
- Junit test case to verify the cert reload.

Author: Manu Mathew <manu.mathew@netapp.com>
Author: mathewmanu <manmathew@cs.stonybrook.edu>
Author: Manu Mathew <101424654+mathew-manu@users.noreply.github.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1839 from mathew-manu/ZOOKEEPER-3806
---
 .../main/resources/markdown/zookeeperAdmin.md |  10 +
 .../org/apache/zookeeper/common/X509Util.java |   6 +
 .../server/NettyServerCnxnFactory.java        |  13 +
 .../server/auth/ProviderRegistry.java         |  26 +-
 .../zookeeper/server/ClientSSLReloadTest.java | 229 ++++++++++++++++++
 5 files changed, 274 insertions(+), 10 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 23e85804b5a..f7e38b9263f 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1740,6 +1740,16 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     **New in 3.5.5:**
     TBD
 
+* *sslQuorumReloadCertFiles* :
+    (No Java system property)
+    **New in  3.5.5, 3.6.0:**
+    Allows Quorum SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false
+
+* *client.certReload* :
+    (Java system property: **zookeeper.client.certReload**)
+    **New in 3.9.0:**
+    Allows client SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false
+
 * *client.portUnification*:
     (Java system property: **zookeeper.client.portUnification**)
     Specifies that the client port should accept SSL connections
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 0cc3eb218bb..1fbbc7205e6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -50,6 +50,8 @@
 import org.apache.zookeeper.common.X509Exception.KeyManagerException;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.common.X509Exception.TrustManagerException;
+import org.apache.zookeeper.server.NettyServerCnxnFactory;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -281,6 +283,10 @@ public SSLContextAndOptions getDefaultSSLContextAndOptions() throws X509Exceptio
     private void resetDefaultSSLContextAndOptions() throws X509Exception.SSLContextException {
         SSLContextAndOptions newContext = createSSLContextAndOptions();
         defaultSSLContextAndOptions.set(newContext);
+
+        if (Boolean.getBoolean(NettyServerCnxnFactory.CLIENT_CERT_RELOAD_KEY)) {
+            ProviderRegistry.addOrUpdateProvider(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "x509");
+        }
     }
 
     private SSLContextAndOptions createSSLContextAndOptions() throws SSLContextException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 040650e4aaa..68335485bf7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -124,6 +124,8 @@ public void setOutstandingHandshakeLimit(int limit) {
 
     private static final AtomicReference<ByteBufAllocator> TEST_ALLOCATOR = new AtomicReference<>(null);
 
+    public static final String CLIENT_CERT_RELOAD_KEY = "zookeeper.client.certReload";
+
     /**
      * A handler that detects whether the client would like to use
      * TLS or not and responds in kind. The first bytes are examined
@@ -514,6 +516,17 @@ private ServerBootstrap configureBootstrapAllocator(ServerBootstrap bootstrap) {
     NettyServerCnxnFactory() {
         x509Util = new ClientX509Util();
 
+        boolean useClientReload = Boolean.getBoolean(CLIENT_CERT_RELOAD_KEY);
+        LOG.info("{}={}", CLIENT_CERT_RELOAD_KEY, useClientReload);
+        if (useClientReload) {
+            try {
+                x509Util.enableCertFileReloading();
+            } catch (IOException e) {
+                LOG.error("unable to set up client certificate reload filewatcher", e);
+                useClientReload = false;
+            }
+        }
+
         boolean usePortUnification = Boolean.getBoolean(PORT_UNIFICATION_KEY);
 
         LOG.info("{}={}", PORT_UNIFICATION_KEY, usePortUnification);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
index 3315e44edf3..bab8059e0b6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
@@ -55,21 +55,27 @@ public static void initialize() {
             Enumeration<Object> en = System.getProperties().keys();
             while (en.hasMoreElements()) {
                 String k = (String) en.nextElement();
-                if (k.startsWith(AUTHPROVIDER_PROPERTY_PREFIX)) {
-                    String className = System.getProperty(k);
-                    try {
-                        Class<?> c = ZooKeeperServer.class.getClassLoader().loadClass(className);
-                        AuthenticationProvider ap = (AuthenticationProvider) c.getDeclaredConstructor().newInstance();
-                        authenticationProviders.put(ap.getScheme(), ap);
-                    } catch (Exception e) {
-                        LOG.warn("Problems loading {}", className, e);
-                    }
-                }
+                addOrUpdateProvider(k);
             }
             initialized = true;
         }
     }
 
+    public static void addOrUpdateProvider(String authKey) {
+        synchronized (ProviderRegistry.class) {
+            if (authKey.startsWith(AUTHPROVIDER_PROPERTY_PREFIX)) {
+                String className = System.getProperty(authKey);
+                try {
+                    Class<?> c = ZooKeeperServer.class.getClassLoader().loadClass(className);
+                    AuthenticationProvider ap = (AuthenticationProvider) c.getDeclaredConstructor().newInstance();
+                    authenticationProviders.put(ap.getScheme(), ap);
+                } catch (Exception e) {
+                    LOG.warn("Problems loading {}", className, e);
+                }
+            }
+        }
+    }
+
     public static ServerAuthenticationProvider getServerProvider(String scheme) {
         return WrappedAuthenticationProvider.wrap(getProvider(scheme));
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
new file mode 100644
index 00000000000..f9996c827bd
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
@@ -0,0 +1,229 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p/>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p/>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.Security;
+import java.util.Properties;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import jline.internal.Log;
+import org.apache.commons.io.FileUtils;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.KeyStoreFileType;
+import org.apache.zookeeper.common.X509KeyType;
+import org.apache.zookeeper.common.X509TestContext;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.apache.zookeeper.server.embedded.ZookeeperServeInfo;
+import org.apache.zookeeper.test.ClientBase;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ClientSSLReloadTest extends ZKTestCase {
+    protected static final Logger LOG = LoggerFactory.getLogger(ClientSSLReloadTest.class);
+
+    private X509TestContext x509TestContext1;
+    private X509TestContext x509TestContext2;
+
+    private File dir1;
+    private File dir2;
+
+    private File keyStoreFile1;
+    private File trustStoreFile1;
+
+    private File keyStoreFile2;
+    private File trustStoreFile2;
+
+    @BeforeEach
+    public void setup() throws Exception {
+
+        dir1 = ClientBase.createEmptyTestDir();
+        dir2 = ClientBase.createEmptyTestDir();
+
+        Security.addProvider(new BouncyCastleProvider());
+
+        x509TestContext1 = X509TestContext.newBuilder()
+                .setTempDir(dir1)
+                .setKeyStoreKeyType(X509KeyType.EC)
+                .setTrustStoreKeyType(X509KeyType.EC)
+                .build();
+
+        x509TestContext2 = X509TestContext.newBuilder()
+                .setTempDir(dir2)
+                .setKeyStoreKeyType(X509KeyType.EC)
+                .setTrustStoreKeyType(X509KeyType.EC)
+                .build();
+
+        keyStoreFile1 = x509TestContext1.getKeyStoreFile(KeyStoreFileType.PEM);
+        trustStoreFile1 = x509TestContext1.getTrustStoreFile(KeyStoreFileType.PEM);
+
+        keyStoreFile2 = x509TestContext2.getKeyStoreFile(KeyStoreFileType.PEM);
+        trustStoreFile2 = x509TestContext2.getTrustStoreFile(KeyStoreFileType.PEM);
+
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+    }
+
+    @AfterEach
+    public void teardown() throws Exception {
+        try {
+            FileUtils.deleteDirectory(dir1);
+            FileUtils.deleteDirectory(dir2);
+        } catch (IOException e) {
+            // ignore
+        }
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+    }
+
+    /*
+     * This test performs certificate reload on a ZK server and checks the server presented certificate to the client.
+     * 1) setup() creates two sets of certificates to be used by the test.
+     * 2) Start the ZK server with TLS configuration ("client.certReload" config property will refresh the key and trust store for ClientX509Util at runtime)
+     * 3) ZK client will connect to the server on the secure client port using keyStoreFile1 and trustStoreFile1.
+     * 4) Update the keyStoreFile1 and trustStoreFile1 files in the filesystem with keyStoreFile2 and trustStoreFile2.
+     * 5) Till FileChangeWatcher thread is triggered & SSLContext options are reset, ZK client should continue to connect.
+     *    In Junit tests, FileChangeWatcher thread is not triggered immediately upon certifcate update in the filesystem.
+     * 6) Once the certficates are reloaded by the server, ZK client connect will fail.
+     * 7) Next, create a new ZK client with updated keystore & truststore paths (keyStoreFile2 and trustStoreFile2).
+     * 8) Server should accept the connection on the secure client port.
+     */
+    @Test
+    public void certficateReloadTest() throws Exception {
+
+        final Properties configZookeeper = getServerConfig();
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(dir1.toPath())
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+
+            CountDownLatch l = new CountDownLatch(1);
+            ZKClientConfig zKClientConfig = getZKClientConfig();
+            // ZK client object created which will connect with keyStoreFile1 and trustStoreFile1 to the server.
+            try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                switch (event.getState()) {
+                    case SyncConnected:
+                        l.countDown();
+                        break;
+                }
+            }, zKClientConfig)) {
+                assertTrue(zk.getClientConfig().getBoolean(ZKClientConfig.SECURE_CLIENT));
+                assertTrue(l.await(10, TimeUnit.SECONDS));
+            }
+
+            Log.info("Updating keyStore & trustStore files !!!!");
+            // Update the keyStoreFile1 and trustStoreFile1 files in the filesystem with keyStoreFile2 & trustStoreFile2
+            FileUtils.writeStringToFile(keyStoreFile1, FileUtils.readFileToString(keyStoreFile2, StandardCharsets.US_ASCII), StandardCharsets.US_ASCII, false);
+            FileUtils.writeStringToFile(trustStoreFile1, FileUtils.readFileToString(trustStoreFile2, StandardCharsets.US_ASCII), StandardCharsets.US_ASCII, false);
+
+            // Till FileChangeWatcher thread is triggered & SSLContext options are reset, ZK client should continue connecting.
+            for (int i = 0; i < 5; i++) {
+                CountDownLatch l2 = new CountDownLatch(1);
+                Thread.sleep(5000);
+                try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                    switch (event.getState()) {
+                        case SyncConnected:
+                            l.countDown();
+                            break;
+                    }
+                }, zKClientConfig)) {
+                    if (!l2.await(5, TimeUnit.SECONDS)) {
+                        LOG.error("Unable to connect to zk server");
+                        break;
+                    }
+                }
+            }
+            // Use the updated keyStore and trustStore paths when creating the client; Refreshed server should authenticate the client.
+            zKClientConfig.setProperty("zookeeper.ssl.keyStore.location", keyStoreFile2.getAbsolutePath());
+            zKClientConfig.setProperty("zookeeper.ssl.trustStore.location", trustStoreFile2.getAbsolutePath());
+            zKClientConfig.setProperty("zookeeper.ssl.keyStore.type", "PEM");
+            zKClientConfig.setProperty("zookeeper.ssl.trustStore.type", "PEM");
+            CountDownLatch l3 = new CountDownLatch(1);
+            try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                switch (event.getState()) {
+                    case SyncConnected:
+                        l3.countDown();
+                        break;
+                }
+            }, zKClientConfig)) {
+                assertTrue(zk.getClientConfig().getBoolean(ZKClientConfig.SECURE_CLIENT));
+                assertTrue(l3.await(10, TimeUnit.SECONDS));
+            }
+        }
+    }
+
+    private Properties getServerConfig() {
+        int clientPort = PortAssignment.unique();
+        int clientSecurePort = PortAssignment.unique();
+
+        final Properties configZookeeper = new Properties();
+        configZookeeper.put("clientPort", clientPort + "");
+        configZookeeper.put("secureClientPort", clientSecurePort + "");
+        configZookeeper.put("host", "localhost");
+        configZookeeper.put("ticktime", "4000");
+        configZookeeper.put("client.certReload", "true");
+        // TLS config fields
+        configZookeeper.put("ssl.keyStore.location", keyStoreFile1.getAbsolutePath());
+        configZookeeper.put("ssl.trustStore.location", trustStoreFile1.getAbsolutePath());
+        configZookeeper.put("ssl.keyStore.type", "PEM");
+        configZookeeper.put("ssl.trustStore.type", "PEM");
+        // Netty is required for TLS
+        configZookeeper.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+        return configZookeeper;
+    }
+
+    private ZKClientConfig getZKClientConfig() throws IOException {
+        // Saving copies in JKS format to be used for client calls even after writeStringToFile overwrites keyStoreFile1 and trustStoreFile1
+        File clientKeyStore = x509TestContext1.getKeyStoreFile(KeyStoreFileType.JKS);
+        File clientTrustStore = x509TestContext1.getTrustStoreFile(KeyStoreFileType.JKS);
+
+        ZKClientConfig zKClientConfig = new ZKClientConfig();
+        zKClientConfig.setProperty("zookeeper.client.secure", "true");
+        zKClientConfig.setProperty("zookeeper.ssl.keyStore.location", clientKeyStore.getAbsolutePath());
+        zKClientConfig.setProperty("zookeeper.ssl.trustStore.location", clientTrustStore.getAbsolutePath());
+        zKClientConfig.setProperty("zookeeper.ssl.keyStore.type", "JKS");
+        zKClientConfig.setProperty("zookeeper.ssl.trustStore.type", "JKS");
+        // only netty supports TLS
+        zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+        return zKClientConfig;
+    }
+}

From 6f0052d841b268a576f49c08425b49417cb2527f Mon Sep 17 00:00:00 2001
From: Houston Putman <houston@apache.org>
Date: Mon, 16 May 2022 12:07:38 +0800
Subject: [PATCH 309/591] ZOOKEEPER-4519: Add closeSocket method to Testable
 interface

This is backwards compatible, since the new method on the `Testable` interface defaults to a no-op.

Author: Houston Putman <houston@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1863 from HoustonPutman/zk-testable-socket-close and squashes the following commits:

1f9d814f5 [Houston Putman] Fix style
475c9f516 [Houston Putman] ZOOKEEPER-4519: Add closeSocket method to Testable interface
---
 .../src/main/java/org/apache/zookeeper/Testable.java       | 7 +++++++
 .../main/java/org/apache/zookeeper/ZooKeeperTestable.java  | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java
index 780cbe893c1..a1c9c96e9c5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper;
 
+import java.io.IOException;
+
 /**
  * Abstraction that exposes various methods useful for testing ZooKeeper
  */
@@ -35,4 +37,9 @@ public interface Testable {
      */
     void queueEvent(WatchedEvent event);
 
+    /**
+     * Close the ClientCnxn socket for testing purposes
+     */
+    default void closeSocket() throws IOException { }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java
index f7e403c33d6..1822200396e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper;
 
+import java.io.IOException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,4 +48,10 @@ public void queueEvent(WatchedEvent event) {
         clientCnxn.eventThread.queueEvent(event);
     }
 
+    @Override
+    public void closeSocket() throws IOException {
+        LOG.info("closeSocket() called");
+        clientCnxn.sendThread.testableCloseSocket();
+    }
+
 }

From f770467d3b1a3b088208601b14dfc3f375a4dcc0 Mon Sep 17 00:00:00 2001
From: jithin23 <jithin.girish@gmail.com>
Date: Tue, 17 May 2022 13:44:12 +0200
Subject: [PATCH 310/591] ZOOKEEPER-4537: Race between SyncThread and
 CommitProcessor thread

Zookeeper server can get stuck when it has just one client and the only way it recovers is due to a socket timeout or another client commit request.
Sync thread reads commitIsWaiting outside of a sync block and acts on this information in a sync block later. The actual status of commitIsWaiting can change between the time where commitIsWaiting is read and acted upon because commit thread updates it outside a sync block.
Fix here is to ensure that we read and process commitIsWaiting inside a sync block.

https://issues.apache.org/jira/browse/ZOOKEEPER-4537

Author: jithin23 <jithin.girish@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1877 from jithin23/ZOOKEEPER-4537
---
 .../zookeeper/server/quorum/CommitProcessor.java      | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
index 86dce2b7f85..11ba0936122 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
@@ -213,12 +213,11 @@ public void run() {
                  * request from a client on another server (i.e., the order of
                  * the following two lines is important!).
                  */
-                commitIsWaiting = !committedRequests.isEmpty();
-                requestsToProcess = queuedRequests.size();
-                // Avoid sync if we have something to do
-                if (requestsToProcess == 0 && !commitIsWaiting) {
-                    // Waiting for requests to process
-                    synchronized (this) {
+                synchronized (this) {
+                    commitIsWaiting = !committedRequests.isEmpty();
+                    requestsToProcess = queuedRequests.size();
+                    if (requestsToProcess == 0 && !commitIsWaiting) {
+                        // Waiting for requests to process
                         while (!stopped && requestsToProcess == 0 && !commitIsWaiting) {
                             wait();
                             commitIsWaiting = !committedRequests.isEmpty();

From 4b1b33e72ca819258b8675948b9a80dd6290edb0 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Tue, 24 May 2022 15:31:52 +0800
Subject: [PATCH 311/591] ZOOKEEPER-4327: Fix flaky
 RequestThrottlerTest.testLargeRequestThrottling

This test failed following assertions in ci:
1. `RequestThrottlerTest.testRequestThrottler:206 expected: <5> but was: <4>`

   This is caused by no happens-before relationship between
   `connectionLossCount` and `disconnected.await`. Places
   `disconnected.countDown()` after `connectionLossCount++` to solve
   this.

2. `RequestThrottlerTest.testLargeRequestThrottling:297 expected: <2> but was: <0>`

   Large request throttling is handled in io thread, while
   `prep_processor_request_queued` metric is updated in processor
   thread. Places metric assertion after `finished.await` to solve this.

Additionally, I find one more potential flaky case. After connection
closed due to throttling third request, reconnecting could fail this
test in slow sending environment. It is easy to reproduce by adding
`Thread.sleep(i * 100)` in sending loop.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1821 from kezhuw/ZOOKEEPER-4327-flaky-RequestThrottlerTest.testLargeRequestThrottling and squashes the following commits:

e21c2f8f7 [Kezhu Wang] ZOOKEEPER-4327: Fix flaky RequestThrottlerTest.testDropStaleRequests
3df34b827 [Kezhu Wang] ZOOKEEPER-4327: Fix flaky RequestThrottlerTest.testLargeRequestThrottling
---
 .../server/RequestThrottlerTest.java          | 60 +++++++++++--------
 1 file changed, 34 insertions(+), 26 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index 62d371dd4fb..ed22399902f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -229,12 +229,7 @@ public void testDropStaleRequests() throws Exception {
         }
 
         // make sure the server received all 5 requests
-        submitted.await(5, TimeUnit.SECONDS);
-        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
-
-        // but only two requests can get into the pipeline because of the throttler
-        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
-        assertEquals(1L, (long) metrics.get("request_throttle_wait_count"));
+        assertTrue(submitted.await(5, TimeUnit.SECONDS));
 
         for (ServerCnxn cnxn : f.cnxns) {
             cnxn.setStale();
@@ -248,10 +243,16 @@ public void testDropStaleRequests() throws Exception {
             Thread.sleep(50);
         }
 
+        // assert after all requests processed to avoid concurrent issues as metrics are
+        // counted in different threads.
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        // only two requests can get into the pipeline because of the throttler
+        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
+
         // the rest of the 3 requests will be dropped
         // but only the first one for a connection will be counted
-        metrics = MetricsUtils.currentServerMetrics();
-        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
+        assertEquals(1L, (long) metrics.get("request_throttle_wait_count"));
         assertEquals(1, (long) metrics.get("stale_requests_dropped"));
     }
 
@@ -261,13 +262,22 @@ public void testLargeRequestThrottling() throws Exception {
 
         AsyncCallback.StringCallback createCallback = (rc, path, ctx, name) -> {
             if (KeeperException.Code.get(rc) == KeeperException.Code.CONNECTIONLOSS) {
-                disconnected.countDown();
                 connectionLossCount++;
+                disconnected.countDown();
             }
         };
 
-        // we allow five requests in the pipeline
-        RequestThrottler.setMaxRequests(5);
+        // the total length of the request is about 170-180 bytes, so only two requests are allowed
+        byte[] data = new byte[100];
+        // the third request will incur throttle. We don't send more requests to avoid reconnecting
+        // due to unstable test environment(e.g. slow sending).
+        int number_requests = 3;
+
+        // we allow more requests in the pipeline
+        RequestThrottler.setMaxRequests(number_requests + 2);
+
+        // request could become stale in processor threads due to throttle in io thread
+        RequestThrottler.setDropStaleRequests(false);
 
         // enable large request throttling
         zks.setLargeRequestThreshold(150);
@@ -277,34 +287,32 @@ public void testLargeRequestThrottling() throws Exception {
         resumeProcess = new CountDownLatch(1);
         // the connection will be close when large requests exceed the limit
         // we can't use the submitted latch because requests after close won't be submitted
-        disconnected = new CountDownLatch(TOTAL_REQUESTS);
-
-        // the total length of the request is about 170-180 bytes, so only two requests are allowed
-        byte[] data = new byte[100];
+        disconnected = new CountDownLatch(number_requests);
 
-        // send 5 requests asynchronously
-        for (int i = 0; i < TOTAL_REQUESTS; i++) {
+        // send requests asynchronously
+        for (int i = 0; i < number_requests; i++) {
             zk.create("/request_throttle_test- " + i , data,
                     ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, createCallback, null);
         }
 
-        // make sure the server received all 5 requests
-        disconnected.await(30, TimeUnit.SECONDS);
+        // make sure the server received all requests
+        assertTrue(disconnected.await(30, TimeUnit.SECONDS));
+
+        finished = new CountDownLatch(2);
+        // let the requests go through the pipeline
+        resumeProcess.countDown();
+        assertTrue(finished.await(5, TimeUnit.SECONDS));
+
+        // assert metrics after finished so metrics in no io threads are set also.
         Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
 
         // but only two requests can get into the pipeline because they are large requests
         // the connection will be closed
         assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
         assertEquals(1L, (long) metrics.get("large_requests_rejected"));
-        assertEquals(5, connectionLossCount);
-
-        finished = new CountDownLatch(2);
-        // let the requests go through the pipeline
-        resumeProcess.countDown();
-        finished.await(5, TimeUnit.SECONDS);
+        assertEquals(number_requests, connectionLossCount);
 
         // when the two requests finish, they are stale because the connection is closed already
-        metrics = MetricsUtils.currentServerMetrics();
         assertEquals(2, (long) metrics.get("stale_replies"));
     }
 

From 7a515fee0124eea389c599995915927e49cf4c57 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 1 Jun 2022 17:33:57 +0200
Subject: [PATCH 312/591] ZOOKEEPER-4551: Do not log spammy stacktrace when a
 client closes its connection

Motivation:
See more here https://issues.apache.org/jira/browse/ZOOKEEPER-4551

Modifications:
Do not log the stacktrace, just write the message at INFO level

Author: Enrico Olivelli <eolivelli@apache.org>

Reviewers: Mate Szalay-Beko <symat@apache.org>

Closes #1889 from eolivelli/fix/remove-spam-stacktrace
---
 .../org/apache/zookeeper/server/NIOServerCnxn.java     | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 02cde23a917..dd62154fc87 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -330,7 +330,15 @@ void doIO(SelectionKey k) throws InterruptedException {
             if (k.isReadable()) {
                 int rc = sock.read(incomingBuffer);
                 if (rc < 0) {
-                    handleFailedRead();
+                    try {
+                        handleFailedRead();
+                    } catch (EndOfStreamException e) {
+                        // no stacktrace. this case is very common, and it is usually not a problem.
+                        LOG.info("{}", e.getMessage());
+                        // expecting close to log session closure
+                        close(e.getReason());
+                        return;
+                    }
                 }
                 if (incomingBuffer.remaining() == 0) {
                     boolean isPayload;

From 02e481cdbf1f0393d60b9f359f69b1fbe8fa84ce Mon Sep 17 00:00:00 2001
From: vinayvinayu <vinayvinayu@gmail.com>
Date: Fri, 17 Jun 2022 19:25:12 +0800
Subject: [PATCH 313/591] ZOOKEEPER-4518: remove useless log in the
 PrepRequestProcessor#pRequest method

ZOOKEEPER-4518 : remove useless log in the PrepRequestProcessor#pRequest method

Author: vinayvinayu <vinayvinayu@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1862 from Vinayvinayu/ZOOKEEPER-4518
---
 .../java/org/apache/zookeeper/server/PrepRequestProcessor.java  | 2 --
 1 file changed, 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 28ea11a695f..f836927236d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -770,8 +770,6 @@ private static int checkAndIncVersion(int currentVersion, int expectedVersion, S
      * @param request
      */
     protected void pRequest(Request request) throws RequestProcessorException {
-        // LOG.info("Prep>>> cxid = " + request.cxid + " type = " +
-        // request.type + " id = 0x" + Long.toHexString(request.sessionId));
         request.setHdr(null);
         request.setTxn(null);
 

From 3fd25d4ebc854328ccc3f8d1c42f6e4c63a84fac Mon Sep 17 00:00:00 2001
From: lanicc <lanettiesso@gmail.com>
Date: Fri, 17 Jun 2022 19:30:01 +0800
Subject: [PATCH 314/591] ZOOKEEPER-4549: ProviderRegistry may be repeatedly
 initialized

We run two ZooKeeperServerEmbedded in one JVM and find that ProviderRegistry was initialized repeatedly.

Author: lanicc <lanettiesso@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, tison <wander4096@gmail.com>, maoling <maoling@apache.org>

Closes #1888 from lanicc/ZOOKEEPER-4549
---
 .../org/apache/zookeeper/server/auth/ProviderRegistry.java     | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
index bab8059e0b6..19198db90c5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
@@ -44,6 +44,9 @@ public static void reset() {
 
     public static void initialize() {
         synchronized (ProviderRegistry.class) {
+            if (initialized) {
+                return;
+            }
             IPAuthenticationProvider ipp = new IPAuthenticationProvider();
             authenticationProviders.put(ipp.getScheme(), ipp);
 

From eb725a0d8ab4430c6ea96d1b4fedc41739aeb62b Mon Sep 17 00:00:00 2001
From: maoling <maoling@apache.org>
Date: Mon, 20 Jun 2022 12:51:17 +0800
Subject: [PATCH 315/591] Revert "ZOOKEEPER-4549: ProviderRegistry may be
 repeatedly initialized"

This reverts commit 3fd25d4ebc854328ccc3f8d1c42f6e4c63a84fac.
---
 .../org/apache/zookeeper/server/auth/ProviderRegistry.java     | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
index 19198db90c5..bab8059e0b6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
@@ -44,9 +44,6 @@ public static void reset() {
 
     public static void initialize() {
         synchronized (ProviderRegistry.class) {
-            if (initialized) {
-                return;
-            }
             IPAuthenticationProvider ipp = new IPAuthenticationProvider();
             authenticationProviders.put(ipp.getScheme(), ipp);
 

From 794790c9f6cbacf158493867f3058a6de748b54e Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Fri, 24 Jun 2022 15:30:51 +0200
Subject: [PATCH 316/591] ZOOKEEPER-4308: Fix flaky test EagerACLFilterTest

There are several problems in this test:
* It uses `ParameterizedTest` which run tests in single jvm. But
  `ZooKeeperServer.enableEagerACLCheck` is `static` and loaded from env
  variable.
* It uses `assertNotSame` which assert on object reference equiality.
* It asserts on `zkLeader.getLastLoggedZxid()` while client connect to
  `connectedServer`. There is no happen-before between
  `zkLeader.getLastLoggedZxid()` and successful response from other
  server. The commit and response are routed to different servers and
  performed asynchronous in each server.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: maoling <maoling199210191@sina.com>, Mate Szalay-Beko <symat@apache.org>

Closes #1851 from kezhuw/ZOOKEEPER-4308-EagerACLFilterTest
---
 .../zookeeper/server/ZooKeeperServer.java     | 13 ++-
 .../server/quorum/EagerACLFilterTest.java     | 98 +++++++++++++------
 .../org/apache/zookeeper/test/QuorumBase.java |  2 +-
 3 files changed, 82 insertions(+), 31 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 86c13aea386..a87acc1244a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -110,7 +110,7 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
 
     // When enabled, will check ACL constraints appertained to the requests first,
     // before sending the requests to the quorum.
-    static final boolean enableEagerACLCheck;
+    static boolean enableEagerACLCheck;
 
     static final boolean skipACL;
 
@@ -157,6 +157,17 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
         LOG.info("{} = {}", CLOSE_SESSION_TXN_ENABLED, closeSessionTxnEnabled);
     }
 
+    // @VisibleForTesting
+    public static boolean isEnableEagerACLCheck() {
+        return enableEagerACLCheck;
+    }
+
+    // @VisibleForTesting
+    public static void setEnableEagerACLCheck(boolean enabled) {
+        ZooKeeperServer.enableEagerACLCheck = enabled;
+        LOG.info("Update {} to {}", ENABLE_EAGER_ACL_CHECK, enabled);
+    }
+
     public static boolean isCloseSessionTxnEnabled() {
         return closeSessionTxnEnabled;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
index a27d5cf9f0f..4141c586ff8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
@@ -19,14 +19,16 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
-import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.CompletableFuture;
 import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
@@ -38,7 +40,6 @@
 
 public class EagerACLFilterTest extends QuorumBase {
 
-    protected final CountDownLatch callComplete = new CountDownLatch(1);
     protected boolean complete = false;
     protected static final String PARENT_PATH = "/foo";
     protected static final String CHILD_PATH = "/foo/bar";
@@ -48,7 +49,9 @@ public class EagerACLFilterTest extends QuorumBase {
     protected static final byte[] DATA = "Hint Water".getBytes();
     protected TestableZooKeeper zkClient;
     protected TestableZooKeeper zkClientB;
+    protected TestableZooKeeper zkLeaderClient;
     protected QuorumPeer zkLeader;
+    protected QuorumPeer zkConnected;
     protected ZooKeeperServer connectedServer;
 
     public static Stream<Arguments> data() {
@@ -70,6 +73,7 @@ public void setUp() {
 
     public void setUp(ServerState serverState, boolean checkEnabled) throws Exception {
         ensureCheck(checkEnabled);
+        CountdownWatcher leaderWatch = new CountdownWatcher();
         CountdownWatcher clientWatch = new CountdownWatcher();
         CountdownWatcher clientWatchB = new CountdownWatcher();
         super.setUp(true, true);
@@ -78,16 +82,31 @@ public void setUp(ServerState serverState, boolean checkEnabled) throws Exceptio
         int clientPort = Integer.parseInt(hostPort.split(":")[1]);
 
         zkLeader = getPeerList().get(getLeaderIndex());
-        connectedServer = getPeerByClientPort(clientPort).getActiveServer();
+        zkConnected = getPeerByClientPort(clientPort);
+        connectedServer = zkConnected.getActiveServer();
 
+        zkLeaderClient = createClient(leaderWatch, getPeersMatching(ServerState.LEADING));
         zkClient = createClient(clientWatch, hostPort);
         zkClientB = createClient(clientWatchB, hostPort);
         zkClient.addAuthInfo(AUTH_PROVIDER, AUTH);
         zkClientB.addAuthInfo(AUTH_PROVIDER, AUTHB);
+        leaderWatch.waitForConnected(CONNECTION_TIMEOUT);
         clientWatch.waitForConnected(CONNECTION_TIMEOUT);
         clientWatchB.waitForConnected(CONNECTION_TIMEOUT);
     }
 
+    void syncClient(ZooKeeper zk) {
+        CompletableFuture<Void> synced = new CompletableFuture<>();
+        zk.sync("/", (rc, path, ctx) -> {
+            if (rc == 0) {
+                synced.complete(null);
+            } else {
+                synced.completeExceptionally(KeeperException.create(KeeperException.Code.get(rc)));
+            }
+        }, null);
+        synced.join();
+    }
+
     @AfterEach
     public void tearDown() throws Exception {
         if (zkClient != null) {
@@ -102,19 +121,29 @@ public void tearDown() throws Exception {
     }
 
     private void ensureCheck(boolean enabled) {
-        if (enabled) {
-            System.setProperty(ZooKeeperServer.ENABLE_EAGER_ACL_CHECK, "true");
-        } else {
-            System.clearProperty(ZooKeeperServer.ENABLE_EAGER_ACL_CHECK);
-        }
+        ZooKeeperServer.setEnableEagerACLCheck(enabled);
     }
 
-    private void assertTransactionState(String condition, long lastxid, ServerState serverState, boolean checkEnabled) {
-        String assertion = String.format("Server State: %s Check Enabled: %s %s", serverState, checkEnabled, condition);
-        if (checkEnabled) {
-            assertEquals(lastxid, zkLeader.getLastLoggedZxid(), assertion);
+    private void assertTransactionState(String operation, QuorumPeer peer, long lastxid) {
+        if (peer == zkLeader && peer != zkConnected) {
+            // The operation is performed on no leader, but we are asserting on leader.
+            // There is no happen-before between `zkLeader.getLastLoggedZxid()` and
+            // successful response from other server. The commit and response are routed
+            // to different servers and performed asynchronous in each server. So we have
+            // to sync leader client to go through commit and response path in leader to
+            // build happen-before between `zkLeader.getLastLoggedZxid()` and side effect
+            // of previous operation.
+            syncClient(zkLeaderClient);
+        }
+        assertTrue(peer == zkLeader || peer == zkConnected);
+        boolean eagerACL = ZooKeeperServer.isEnableEagerACLCheck();
+        String assertion = String.format(
+                "Connecting: %s Checking: %s EagerACL: %s Operation: %s",
+                zkConnected.getPeerState(), peer.getPeerState(), eagerACL, operation);
+        if (eagerACL) {
+            assertEquals(lastxid, peer.getLastLoggedZxid(), assertion);
         } else {
-            assertNotSame(lastxid, zkLeader.getLastLoggedZxid(), assertion);
+            assertNotEquals(lastxid, peer.getLastLoggedZxid(), assertion);
         }
     }
 
@@ -144,15 +173,17 @@ public void testCreate2OK(ServerState serverState, boolean checkEnabled) throws
     public void testCreateFail(ServerState serverState, boolean checkEnabled) throws Exception {
         setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
         assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed create", lastxid, serverState, checkEnabled);
+        assertTransactionState("failed create", zkConnected, lastxid);
+        assertTransactionState("failed create", zkLeader, lastxid);
     }
 
     @ParameterizedTest
@@ -160,15 +191,17 @@ public void testCreateFail(ServerState serverState, boolean checkEnabled) throws
     public void testCreate2Fail(ServerState serverState, boolean checkEnabled) throws Exception {
         setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
         assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed create2", lastxid, serverState, checkEnabled);
+        assertTransactionState("failed create2", zkConnected, lastxid);
+        assertTransactionState("failed create2", zkLeader, lastxid);
     }
 
     @ParameterizedTest
@@ -187,15 +220,17 @@ public void testDeleteFail(ServerState serverState, boolean checkEnabled) throws
         setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         zkClient.create(CHILD_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.delete(CHILD_PATH, -1);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
         assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed delete", lastxid, serverState, checkEnabled);
+        assertTransactionState("failed delete", zkConnected, lastxid);
+        assertTransactionState("failed delete", zkLeader, lastxid);
     }
 
     @ParameterizedTest
@@ -211,15 +246,17 @@ public void testSetDataOK(ServerState serverState, boolean checkEnabled) throws
     public void testSetDataFail(ServerState serverState, boolean checkEnabled) throws Exception {
         setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.setData(PARENT_PATH, DATA, -1);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
         assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed setData", lastxid, serverState, checkEnabled);
+        assertTransactionState("failed setData", zkConnected, lastxid);
+        assertTransactionState("failed setData", zkLeader, lastxid);
     }
 
     @ParameterizedTest
@@ -237,15 +274,17 @@ public void testSetACLOK(ServerState serverState, boolean checkEnabled) throws E
     public void testSetACLFail(ServerState serverState, boolean checkEnabled) throws Exception {
         setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.setACL(PARENT_PATH, Ids.READ_ACL_UNSAFE, -1);
-        } catch (KeeperException.NoAuthException e) {
+            fail("expect no auth");
+        } catch (KeeperException.NoAuthException ignored) {
         }
 
         assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed setACL", lastxid, serverState, checkEnabled);
+        assertTransactionState("failed setACL", zkConnected, lastxid);
+        assertTransactionState("failed setACL", zkLeader, lastxid);
     }
 
     @ParameterizedTest
@@ -253,12 +292,12 @@ public void testSetACLFail(ServerState serverState, boolean checkEnabled) throws
     public void testBadACL(ServerState serverState, boolean checkEnabled) throws Exception {
         setUp(serverState, checkEnabled);
         CountdownWatcher cw = new CountdownWatcher();
-        TestableZooKeeper zk = createClient(cw, getPeersMatching(serverState));
-        long lastxid;
+        String addr = String.format("%s:%d", LOCALADDR, zkConnected.getClientPort());
+        TestableZooKeeper zk = createClient(cw, addr);
 
         cw.waitForConnected(CONNECTION_TIMEOUT);
 
-        lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
 
         try {
             zk.create("/acltest", new byte[0], Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
@@ -268,7 +307,8 @@ public void testBadACL(ServerState serverState, boolean checkEnabled) throws Exc
 
         assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("zxid after invalid ACL", lastxid, serverState, checkEnabled);
+        assertTransactionState("invalid ACL", zkConnected, lastxid);
+        assertTransactionState("invalid ACL", zkLeader, lastxid);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index 8f5f17db7fd..4f723f2994f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -47,7 +47,7 @@ public class QuorumBase extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumBase.class);
 
-    private static final String LOCALADDR = "127.0.0.1";
+    protected static final String LOCALADDR = "127.0.0.1";
 
     private File oracleDir;
     private static final String oraclePath_0 = "/oraclePath/0/mastership/";

From b34e1716e8fa430690252288f2e15c38fe65f325 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Fri, 24 Jun 2022 15:41:41 +0200
Subject: [PATCH 317/591] ZOOKEEPER-4511: Fix flaky test
 FileTxnSnapLogMetricsTest.testFileTxnSnapLogMetrics

This test writes txns to trigger snapshot and expects some txns remain
in txn log. But snapshot taking is asynchronous, thus all txns could be
written to snapshot. So in restarting, it is possible that no txns to
load after snapshot restored. This will fail assertion.

This commit solves this by disable automic snapshot taking by
`SyncRequestProcessor.setSnapCount(Integer.MAX_VALUE)`.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1852 from kezhuw/ZOOKEEPER-4511-FileTxnSnapLogMetricsTest-testFileTxnSnapLogMetrics
---
 .../java/org/apache/zookeeper/ZKTestCase.java |  6 +-
 .../FileTxnSnapLogMetricsTest.java            | 59 +++++++++++--------
 2 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index 21343c161ca..eb8fcbf934b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -21,7 +21,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
-import java.time.LocalDateTime;
+import java.time.Instant;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
@@ -100,8 +100,8 @@ public interface WaitForCondition {
      * @throws InterruptedException
      */
     public void waitFor(String msg, WaitForCondition condition, int timeout) throws InterruptedException {
-        final LocalDateTime deadline = LocalDateTime.now().plusSeconds(timeout);
-        while (LocalDateTime.now().isBefore(deadline)) {
+        final Instant deadline = Instant.now().plusSeconds(timeout);
+        while (Instant.now().isBefore(deadline)) {
             if (condition.evaluate()) {
                 return;
             }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
index a93dcc80b05..65648fefce4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
@@ -22,20 +22,21 @@
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.File;
 import java.util.Map;
-import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
-import org.apache.zookeeper.WatchedEvent;
-import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.SyncRequestProcessor;
+import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
-import org.apache.zookeeper.test.QuorumUtil;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,43 +44,53 @@ public class FileTxnSnapLogMetricsTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(FileTxnSnapLogMetricsTest.class);
 
-    CountDownLatch allCreatedLatch;
+    @TempDir
+    File logDir;
 
-    private class MockWatcher implements Watcher {
+    @TempDir
+    File snapDir;
 
-        @Override
-        public void process(WatchedEvent e) {
-            LOG.info("all nodes created");
-            allCreatedLatch.countDown();
-        }
+    private ServerCnxnFactory startServer() throws Exception {
+        ZooKeeperServer zkServer = new ZooKeeperServer(snapDir, logDir, 3000);
+        ServerCnxnFactory cnxnFactory = ServerCnxnFactory.createFactory(0, -1);
+        cnxnFactory.startup(zkServer);
+        return cnxnFactory;
+    }
 
+    @AfterEach
+    public void cleanup() throws Exception {
+        SyncRequestProcessor.setSnapCount(ZooKeeperServer.getSnapCount());
     }
 
     @Test
     public void testFileTxnSnapLogMetrics() throws Exception {
         SyncRequestProcessor.setSnapCount(100);
 
-        QuorumUtil util = new QuorumUtil(1);
-        util.startAll();
+        ServerCnxnFactory cnxnFactory = startServer();
+        String connectString = "127.0.0.1:" + cnxnFactory.getLocalPort();
 
-        allCreatedLatch = new CountDownLatch(1);
+        // Snapshot in load data.
+        assertEquals(1L, MetricsUtils.currentServerMetrics().get("cnt_snapshottime"));
 
         byte[] data = new byte[500];
-        // make sure a snapshot is taken and some txns are not in a snapshot
-        ZooKeeper zk = ClientBase.createZKClient(util.getConnString());
+        ZooKeeper zk = ClientBase.createZKClient(connectString);
         for (int i = 0; i < 150; i++) {
             zk.create("/path" + i, data, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
 
-        if (null == zk.exists("/path149", new MockWatcher())) {
-            allCreatedLatch.await();
-        }
+        // It is possible that above writes will trigger more than one snapshot due to randomization.
+        WaitForCondition newSnapshot = () -> (long) MetricsUtils.currentServerMetrics().get("cnt_snapshottime") >= 2L;
+        waitFor("no snapshot in 10s", newSnapshot, 10);
+
+        // Pauses snapshot and logs more txns.
+        cnxnFactory.getZooKeeperServer().getTxnLogFactory().snapLog.close();
+        zk.create("/" + 1000, data, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/" + 1001, data, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
+        // Restart server to count startup metrics.
+        cnxnFactory.shutdown();
         ServerMetrics.getMetrics().resetAll();
-        int leader = util.getLeaderServer();
-        // restart a server so it will read the snapshot and the txn logs
-        util.shutdown(leader);
-        util.start(leader);
+        cnxnFactory = startServer();
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
         LOG.info("txn loaded during start up {}", values.get("max_startup_txns_loaded"));
@@ -90,7 +101,7 @@ public void testFileTxnSnapLogMetrics() throws Exception {
         assertEquals(1L, values.get("cnt_startup_snap_load_time"));
         assertThat((long) values.get("max_startup_snap_load_time"), greaterThan(0L));
 
-        util.shutdownAll();
+        cnxnFactory.shutdown();
     }
 
 }

From de7c5869d372e46af43979134d0e30b49d2319b1 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Mon, 27 Jun 2022 08:19:39 +0200
Subject: [PATCH 318/591] ZOOKEEPER-4492: Merge readOnly field into
 ConnectRequest and Response

According to [this comment in ZOOKEEPER-102](https://issues.apache.org/jira/browse/ZOOKEEPER-102?focusedCommentId=16977000&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-16977000) I introduce a `Protocol` abstraction and going to moving all wire protocol concept into `cnxn` and this scope, so that client and server's business logics handle only deserialized/real record.

cc eolivelli maoling Randgalt

This supersedes #1832.

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1837 from tisonkun/protocol
---
 .../src/main/resources/zookeeper.jute         |   2 +
 .../java/org/apache/zookeeper/ClientCnxn.java |  31 +----
 .../apache/zookeeper/ClientCnxnSocket.java    |  20 +--
 .../zookeeper/compat/ProtocolManager.java     | 121 ++++++++++++++++++
 .../apache/zookeeper/server/ServerCnxn.java   |  14 +-
 .../zookeeper/server/ZooKeeperServer.java     |  21 +--
 .../java/org/apache/zookeeper/MockPacket.java |  10 --
 .../server/ZooKeeperServerCreationTest.java   |   1 -
 .../zookeeper/server/ZooKeeperServerTest.java |   7 +-
 .../quorum/ReadOnlyZooKeeperServerTest.java   |   5 +-
 .../server/quorum/WatchLeakTest.java          |   4 +-
 .../apache/zookeeper/test/MaxCnxnsTest.java   |  14 +-
 .../test/SessionInvalidationTest.java         |   2 +-
 13 files changed, 155 insertions(+), 97 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java

diff --git a/zookeeper-jute/src/main/resources/zookeeper.jute b/zookeeper-jute/src/main/resources/zookeeper.jute
index 796ea396755..d52b4afefe2 100644
--- a/zookeeper-jute/src/main/resources/zookeeper.jute
+++ b/zookeeper-jute/src/main/resources/zookeeper.jute
@@ -65,12 +65,14 @@ module org.apache.zookeeper.proto {
         int timeOut;
         long sessionId;
         buffer passwd;
+        boolean readOnly;
     }
     class ConnectResponse {
         int protocolVersion;
         int timeOut;
         long sessionId;
         buffer passwd;
+        boolean readOnly;
     }
     class SetWatches {
         long relativeZxid;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 0c9799c7345..837c12d5a08 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -285,8 +285,6 @@ static class Packet {
 
         WatchRegistration watchRegistration;
 
-        public boolean readOnly;
-
         WatchDeregistration watchDeregistration;
 
         /** Convenience ctor */
@@ -295,23 +293,12 @@ static class Packet {
             ReplyHeader replyHeader,
             Record request,
             Record response,
-            WatchRegistration watchRegistration) {
-            this(requestHeader, replyHeader, request, response, watchRegistration, false);
-        }
-
-        Packet(
-            RequestHeader requestHeader,
-            ReplyHeader replyHeader,
-            Record request,
-            Record response,
-            WatchRegistration watchRegistration,
-            boolean readOnly) {
-
+            WatchRegistration watchRegistration
+        ) {
             this.requestHeader = requestHeader;
             this.replyHeader = replyHeader;
             this.request = request;
             this.response = response;
-            this.readOnly = readOnly;
             this.watchRegistration = watchRegistration;
         }
 
@@ -325,8 +312,6 @@ public void createBB() {
                 }
                 if (request instanceof ConnectRequest) {
                     request.serialize(boa, "connect");
-                    // append "am-I-allowed-to-be-readonly" flag
-                    boa.writeBool(readOnly, "readOnly");
                 } else if (request != null) {
                     request.serialize(boa, "request");
                 }
@@ -1008,7 +993,7 @@ void primeConnection() throws IOException {
                 clientCnxnSocket.getRemoteSocketAddress());
             isFirstConnect = false;
             long sessId = (seenRwServerBefore) ? sessionId : 0;
-            ConnectRequest conReq = new ConnectRequest(0, lastZxid, sessionTimeout, sessId, sessionPasswd);
+            ConnectRequest conReq = new ConnectRequest(0, lastZxid, sessionTimeout, sessId, sessionPasswd, readOnly);
             // We add backwards since we are pushing into the front
             // Only send if there's a pending watch
             if (!clientConfig.getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET)) {
@@ -1088,7 +1073,7 @@ record = new SetWatches2(setWatchesLastZxid, dataWatchesBatch, existWatchesBatch
                         null,
                         null));
             }
-            outgoingQueue.addFirst(new Packet(null, null, conReq, null, null, readOnly));
+            outgoingQueue.addFirst(new Packet(null, null, conReq, null, null));
             clientCnxnSocket.connectionPrimed();
             LOG.debug("Session establishment request sent on {}", clientCnxnSocket.getRemoteSocketAddress());
         }
@@ -1406,12 +1391,6 @@ private void cleanup() {
         /**
          * Callback invoked by the ClientCnxnSocket once a connection has been
          * established.
-         *
-         * @param _negotiatedSessionTimeout
-         * @param _sessionId
-         * @param _sessionPasswd
-         * @param isRO
-         * @throws IOException
          */
         void onConnected(
             int _negotiatedSessionTimeout,
@@ -1629,7 +1608,7 @@ public void sendPacket(Record request, Record response, AsyncCallback cb, int op
         ReplyHeader r = new ReplyHeader();
         r.setXid(xid);
 
-        Packet p = new Packet(h, r, request, response, null, false);
+        Packet p = new Packet(h, r, request, response, null);
         p.cb = cb;
         sendThread.sendPacket(p);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
index 9b53107e3d7..35af4a2f121 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
@@ -31,6 +31,7 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.ZKConfig;
+import org.apache.zookeeper.compat.ProtocolManager;
 import org.apache.zookeeper.proto.ConnectResponse;
 import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.slf4j.Logger;
@@ -48,6 +49,8 @@ abstract class ClientCnxnSocket {
 
     private static final Logger LOG = LoggerFactory.getLogger(ClientCnxnSocket.class);
 
+    private final ProtocolManager protocolManager = new ProtocolManager();
+
     protected boolean initialized;
 
     /**
@@ -131,27 +134,18 @@ void readConnectResult() throws IOException {
             }
             buf.append("]");
             if (LOG.isTraceEnabled()) {
-                LOG.trace("readConnectResult {} {}", incomingBuffer.remaining(), buf.toString());
+                LOG.trace("readConnectResult {} {}", incomingBuffer.remaining(), buf);
             }
         }
 
         ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
         BinaryInputArchive bbia = BinaryInputArchive.getArchive(bbis);
-        ConnectResponse conRsp = new ConnectResponse();
-        conRsp.deserialize(bbia, "connect");
-
-        // read "is read-only" flag
-        boolean isRO = false;
-        try {
-            isRO = bbia.readBool("readOnly");
-        } catch (IOException e) {
-            // this is ok -- just a packet from an old server which
-            // doesn't contain readOnly field
+        ConnectResponse conRsp = protocolManager.deserializeConnectResponse(bbia);
+        if (protocolManager.isReadonlyAvailable()) {
             LOG.warn("Connected to an old server; r-o mode will be unavailable");
         }
-
         this.sessionId = conRsp.getSessionId();
-        sendThread.onConnected(conRsp.getTimeOut(), this.sessionId, conRsp.getPasswd(), isRO);
+        sendThread.onConnected(conRsp.getTimeOut(), this.sessionId, conRsp.getPasswd(), conRsp.getReadOnly());
     }
 
     abstract boolean isConnected();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
new file mode 100644
index 00000000000..5633b81c17d
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.compat;
+
+import java.io.IOException;
+import org.apache.jute.InputArchive;
+import org.apache.zookeeper.proto.ConnectRequest;
+import org.apache.zookeeper.proto.ConnectResponse;
+
+/**
+ * A manager for switching behaviours between difference wire protocol.
+ * <p>
+ * Basically, wire protocol should be backward and forward compatible between minor versions.
+ * However, there are several cases that it's different due to Jute's limitations.
+ */
+public final class ProtocolManager {
+    private volatile Boolean isReadonlyAvailable = null;
+
+    public boolean isReadonlyAvailable() {
+        return isReadonlyAvailable != null && isReadonlyAvailable;
+    }
+
+    /**
+     * Deserializing {@link ConnectRequest} should be specially handled for request from client
+     * version before and including ZooKeeper 3.3 which doesn't understand readOnly field.
+     */
+    public ConnectRequest deserializeConnectRequest(InputArchive inputArchive) throws IOException {
+        if (isReadonlyAvailable != null) {
+            if (isReadonlyAvailable) {
+                return deserializeConnectRequestWithReadonly(inputArchive);
+            } else {
+                return deserializeConnectRequestWithoutReadonly(inputArchive);
+            }
+        }
+
+        final ConnectRequest request = deserializeConnectRequestWithoutReadonly(inputArchive);
+        try {
+            request.setReadOnly(inputArchive.readBool("readOnly"));
+            this.isReadonlyAvailable = true;
+        } catch (Exception e) {
+            request.setReadOnly(false); // old version doesn't have readonly concept
+            this.isReadonlyAvailable = false;
+        }
+        return request;
+    }
+
+    private ConnectRequest deserializeConnectRequestWithReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectRequest request = new ConnectRequest();
+        request.deserialize(inputArchive, "connect");
+        return request;
+    }
+
+    private ConnectRequest deserializeConnectRequestWithoutReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectRequest request = new ConnectRequest();
+        inputArchive.startRecord("connect");
+        request.setProtocolVersion(inputArchive.readInt("protocolVersion"));
+        request.setLastZxidSeen(inputArchive.readLong("lastZxidSeen"));
+        request.setTimeOut(inputArchive.readInt("timeOut"));
+        request.setSessionId(inputArchive.readLong("sessionId"));
+        request.setPasswd(inputArchive.readBuffer("passwd"));
+        inputArchive.endRecord("connect");
+        return request;
+    }
+
+    /**
+     * Deserializing {@link ConnectResponse} should be specially handled for response from server
+     * version before and including ZooKeeper 3.3 which doesn't understand readOnly field.
+     */
+    public ConnectResponse deserializeConnectResponse(InputArchive inputArchive) throws IOException {
+        if (isReadonlyAvailable != null) {
+            if (isReadonlyAvailable) {
+                return deserializeConnectResponseWithReadonly(inputArchive);
+            } else {
+                return deserializeConnectResponseWithoutReadonly(inputArchive);
+            }
+        }
+
+        final ConnectResponse response = deserializeConnectResponseWithoutReadonly(inputArchive);
+        try {
+            response.setReadOnly(inputArchive.readBool("readOnly"));
+            this.isReadonlyAvailable = true;
+        } catch (Exception e) {
+            response.setReadOnly(false); // old version doesn't have readonly concept
+            this.isReadonlyAvailable = false;
+        }
+        return response;
+    }
+
+    private ConnectResponse deserializeConnectResponseWithReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectResponse response = new ConnectResponse();
+        response.deserialize(inputArchive, "connect");
+        return response;
+    }
+
+    private ConnectResponse deserializeConnectResponseWithoutReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectResponse response = new ConnectResponse();
+        inputArchive.startRecord("connect");
+        response.setProtocolVersion(inputArchive.readInt("protocolVersion"));
+        response.setTimeOut(inputArchive.readInt("timeOut"));
+        response.setSessionId(inputArchive.readLong("sessionId"));
+        response.setPasswd(inputArchive.readBuffer("passwd"));
+        inputArchive.endRecord("connect");
+        return response;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index b5b2645838d..661c2aa2f09 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -41,6 +41,7 @@
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.compat.ProtocolManager;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.metrics.Counter;
@@ -60,16 +61,9 @@ public abstract class ServerCnxn implements Stats, Watcher {
     public static final Object me = new Object();
     private static final Logger LOG = LoggerFactory.getLogger(ServerCnxn.class);
 
-    private Set<Id> authInfo = Collections.newSetFromMap(new ConcurrentHashMap<Id, Boolean>());
-
-    /**
-     * If the client is of old version, we don't send r-o mode info to it.
-     * The reason is that if we would, old C client doesn't read it, which
-     * results in TCP RST packet, i.e. "connection reset by peer".
-     */
-    boolean isOldClient = true;
-
-    AtomicLong outstandingCount = new AtomicLong();
+    public final ProtocolManager protocolManager = new ProtocolManager();
+    private final Set<Id> authInfo = Collections.newSetFromMap(new ConcurrentHashMap<>());
+    private final AtomicLong outstandingCount = new AtomicLong();
 
     /** The ZooKeeperServer for this connection. May be null if the server
      * is not currently serving requests (for example if the server is not
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index a87acc1244a..4260913b796 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1073,14 +1073,12 @@ public void finishSessionInit(ServerCnxn cnxn, boolean valid) {
                 valid ? cnxn.getSessionTimeout() : 0,
                 valid ? cnxn.getSessionId() : 0, // send 0 if session is no
                 // longer valid
-                valid ? generatePasswd(cnxn.getSessionId()) : new byte[16]);
+                valid ? generatePasswd(cnxn.getSessionId()) : new byte[16],
+                this instanceof ReadOnlyZooKeeperServer);
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             BinaryOutputArchive bos = BinaryOutputArchive.getArchive(baos);
             bos.writeInt(-1, "len");
             rsp.serialize(bos, "connect");
-            if (!cnxn.isOldClient) {
-                bos.writeBool(this instanceof ReadOnlyZooKeeperServer, "readOnly");
-            }
             baos.close();
             ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
             bb.putInt(bb.remaining() - 4).rewind();
@@ -1381,8 +1379,7 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
         throws IOException, ClientCnxnLimitException {
 
         BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(incomingBuffer));
-        ConnectRequest connReq = new ConnectRequest();
-        connReq.deserialize(bia, "connect");
+        ConnectRequest connReq = cnxn.protocolManager.deserializeConnectRequest(bia);
         LOG.debug(
             "Session establishment request from client {} client's lastZxid is 0x{}",
             cnxn.getRemoteSocketAddress(),
@@ -1406,21 +1403,15 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
             throw new ClientCnxnLimitException();
         }
         ServerMetrics.getMetrics().CONNECTION_TOKEN_DEFICIT.add(connThrottle.getDeficit());
-
         ServerMetrics.getMetrics().CONNECTION_REQUEST_COUNT.add(1);
 
-        boolean readOnly = false;
-        try {
-            readOnly = bia.readBool("readOnly");
-            cnxn.isOldClient = false;
-        } catch (IOException e) {
-            // this is ok -- just a packet from an old client which
-            // doesn't contain readOnly field
+        if (cnxn.protocolManager.isReadonlyAvailable()) {
             LOG.warn(
                 "Connection request from old client {}; will be dropped if server is in r-o mode",
                 cnxn.getRemoteSocketAddress());
         }
-        if (!readOnly && this instanceof ReadOnlyZooKeeperServer) {
+
+        if (!connReq.getReadOnly() && this instanceof ReadOnlyZooKeeperServer) {
             String msg = "Refusing session request for not-read-only client " + cnxn.getRemoteSocketAddress();
             LOG.info(msg);
             throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java
index 9d880fd39b0..e4e6548ea23 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java
@@ -35,16 +35,6 @@ public MockPacket(
         super(requestHeader, replyHeader, request, response, watchRegistration);
     }
 
-    public MockPacket(
-        RequestHeader requestHeader,
-        ReplyHeader replyHeader,
-        Record request,
-        Record response,
-        WatchRegistration watchRegistration,
-        boolean readOnly) {
-        super(requestHeader, replyHeader, request, response, watchRegistration, readOnly);
-    }
-
     public ByteBuffer createAndReturnBB() {
         createBB();
         return this.bb;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
index 03f6113de87..ac46b4e0f29 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
@@ -48,7 +48,6 @@ public void submitRequest(Request si) {
         zks.setZKDatabase(new ZKDatabase(fileTxnSnapLog));
         zks.createSessionTracker();
 
-        ServerCnxnFactory cnxnFactory = ServerCnxnFactory.createFactory();
         ServerCnxn cnxn = new MockServerCnxn();
 
         ConnectRequest connReq = new ConnectRequest();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index bd141206905..4d41dac1a9b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -162,10 +162,9 @@ public void testClientZxidAhead() {
         output.put((byte) 1);
         output.flip();
 
-        ServerCnxn.CloseRequestException e = assertThrows(ServerCnxn.CloseRequestException.class, () -> {
-            final NIOServerCnxn nioServerCnxn = mock(NIOServerCnxn.class);
-            zooKeeperServer.processConnectRequest(nioServerCnxn, output);
-        });
+        ServerCnxn.CloseRequestException e = assertThrows(
+                ServerCnxn.CloseRequestException.class,
+                () -> zooKeeperServer.processConnectRequest(new MockServerCnxn(), output));
         assertEquals(e.getReason(), ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
index 165dbdca1d7..3ee6016f086 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
@@ -22,7 +22,7 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.mock;
 import java.nio.ByteBuffer;
-import org.apache.zookeeper.server.NIOServerCnxn;
+import org.apache.zookeeper.server.MockServerCnxn;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
@@ -55,8 +55,7 @@ public void testReadOnlyZookeeperServer() {
         output.flip();
 
         ServerCnxn.CloseRequestException e = assertThrows(ServerCnxn.CloseRequestException.class, () -> {
-            final NIOServerCnxn nioServerCnxn = mock(NIOServerCnxn.class);
-            readOnlyZooKeeperServer.processConnectRequest(nioServerCnxn, output);
+            readOnlyZooKeeperServer.processConnectRequest(new MockServerCnxn(), output);
         });
         assertEquals(e.getReason(), ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index 70f1844eac6..2fadcf36f96 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -255,8 +255,8 @@ private ByteBuffer createConnRequest() {
         Random r = new Random(SESSION_ID ^ superSecret);
         byte[] p = new byte[16];
         r.nextBytes(p);
-        ConnectRequest conReq = new ConnectRequest(0, 1L, 30000, SESSION_ID, p);
-        MockPacket packet = new MockPacket(null, null, conReq, null, null, false);
+        ConnectRequest conReq = new ConnectRequest(0, 1L, 30000, SESSION_ID, p, false);
+        MockPacket packet = new MockPacket(null, null, conReq, null, null);
         return packet.createAndReturnBB();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
index f7c7a9534d7..0034fd6d04a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
@@ -51,18 +51,16 @@ public CnxnThread(int i) {
         }
 
         public void run() {
-            SocketChannel sChannel = null;
-            try {
+            try (SocketChannel sChannel = SocketChannel.open()) {
                 /*
                  * For future unwary socket programmers: although connect 'blocks' it
                  * does not require an accept on the server side to return. Therefore
                  * you can not assume that all the sockets are connected at the end of
                  * this for loop.
                  */
-                sChannel = SocketChannel.open();
                 sChannel.connect(new InetSocketAddress(host, port));
                 // Construct a connection request
-                ConnectRequest conReq = new ConnectRequest(0, 0, 10000, 0, "password".getBytes());
+                ConnectRequest conReq = new ConnectRequest(0, 0, 10000, 0, "password".getBytes(), false);
                 ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
                 boa.writeInt(-1, "len");
@@ -95,14 +93,6 @@ public void run() {
                 }
             } catch (IOException io) {
                 // "Connection reset by peer"
-            } finally {
-                if (sChannel != null) {
-                    try {
-                        sChannel.close();
-                    } catch (Exception e) {
-                        // Do nothing
-                    }
-                }
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
index a9229d2b16b..1e7870bd293 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
@@ -53,7 +53,7 @@ public void testCreateAfterCloseShouldFail() throws Exception {
 
             // open a connection
             boa.writeInt(44, "len");
-            ConnectRequest conReq = new ConnectRequest(0, 0, 30000, 0, new byte[16]);
+            ConnectRequest conReq = new ConnectRequest(0, 0, 30000, 0, new byte[16], false);
             conReq.serialize(boa, "connect");
 
             // close connection

From a7e4dea7abccff018d123d54dd5d3ccc1544484e Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Tue, 12 Jul 2022 13:03:07 +0200
Subject: [PATCH 319/591] ZOOKEEPER-4573: Encapsulate request bytebuffer in
 Request

This patch is based on #1903.

This closes #1903.

Author: tison <wander4096@gmail.com>

Reviewers: Andor Molnar <andor@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1904 from tisonkun/encapsulate-request-bytebuffer
---
 .../org/apache/jute/BinaryInputArchive.java   | 18 +++----
 .../apache/zookeeper/ClientCnxnSocket.java    |  2 +-
 .../apache/zookeeper/audit/AuditHelper.java   |  4 +-
 .../server/ByteBufferInputStream.java         |  7 +--
 .../server/ByteBufferOutputStream.java        | 12 +++--
 .../server/FinalRequestProcessor.java         | 45 ++++++++---------
 .../zookeeper/server/NIOServerCnxn.java       |  7 ++-
 .../zookeeper/server/NettyServerCnxn.java     |  5 +-
 .../server/PrepRequestProcessor.java          | 42 +++++++---------
 .../org/apache/zookeeper/server/Request.java  | 25 +++++++++-
 .../zookeeper/server/ZooKeeperServer.java     | 49 ++++++++-----------
 .../zookeeper/server/quorum/Learner.java      | 10 ++--
 .../server/quorum/QuorumZooKeeperServer.java  |  9 +---
 .../zookeeper/server/CreateContainerTest.java | 14 ++----
 .../server/ZooKeeperServerCreationTest.java   |  8 +--
 .../zookeeper/server/ZooKeeperServerTest.java | 22 ++++-----
 .../quorum/ReadOnlyZooKeeperServerTest.java   | 36 +++++++-------
 .../quorum/SessionUpgradeQuorumTest.java      |  7 +--
 18 files changed, 156 insertions(+), 166 deletions(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
index c4d1bbebf9d..ae1310af03d 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
@@ -47,27 +47,27 @@ public class BinaryInputArchive implements InputArchive {
         }
     }
 
-    private DataInput in;
-    private int maxBufferSize;
-    private int extraMaxBufferSize;
+    private final DataInput in;
+    private final int maxBufferSize;
+    private final int extraMaxBufferSize;
 
-    public static BinaryInputArchive getArchive(InputStream strm) {
-        return new BinaryInputArchive(new DataInputStream(strm));
+    public static BinaryInputArchive getArchive(InputStream stream) {
+        return new BinaryInputArchive(new DataInputStream(stream));
     }
 
     private static class BinaryIndex implements Index {
-        private int nelems;
+        private int n;
 
         BinaryIndex(int nelems) {
-            this.nelems = nelems;
+            this.n = nelems;
         }
 
         public boolean done() {
-            return (nelems <= 0);
+            return (n <= 0);
         }
 
         public void incr() {
-            nelems--;
+            n--;
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
index 35af4a2f121..17c0ad27925 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
@@ -141,7 +141,7 @@ void readConnectResult() throws IOException {
         ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
         BinaryInputArchive bbia = BinaryInputArchive.getArchive(bbis);
         ConnectResponse conRsp = protocolManager.deserializeConnectResponse(bbia);
-        if (protocolManager.isReadonlyAvailable()) {
+        if (!protocolManager.isReadonlyAvailable()) {
             LOG.warn("Connected to an old server; r-o mode will be unavailable");
         }
         this.sessionId = conRsp.getSessionId();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
index b98c42d2588..5aca1711f7a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
@@ -32,7 +32,6 @@
 import org.apache.zookeeper.proto.DeleteRequest;
 import org.apache.zookeeper.proto.SetACLRequest;
 import org.apache.zookeeper.proto.SetDataRequest;
-import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.DataTree.ProcessTxnResult;
 import org.apache.zookeeper.server.Request;
 import org.slf4j.Logger;
@@ -127,8 +126,7 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
     }
 
     private static void deserialize(Request request, Record record) throws IOException {
-        request.request.rewind();
-        ByteBufferInputStream.byteBuffer2Record(request.request.slice(), record);
+        request.readRequestRecord(record);
     }
 
     private static Result getResult(ProcessTxnResult rc, boolean failedTxn) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java
index 9a93abd6115..8fe8b6fc94e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java
@@ -21,12 +21,13 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.ByteBuffer;
+import javax.annotation.Nonnull;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.Record;
 
 public class ByteBufferInputStream extends InputStream {
 
-    ByteBuffer bb;
+    private final ByteBuffer bb;
 
     public ByteBufferInputStream(ByteBuffer bb) {
         this.bb = bb;
@@ -46,7 +47,7 @@ public int available() throws IOException {
     }
 
     @Override
-    public int read(byte[] b, int off, int len) throws IOException {
+    public int read(@Nonnull byte[] b, int off, int len) throws IOException {
         if (bb.remaining() == 0) {
             return -1;
         }
@@ -58,7 +59,7 @@ public int read(byte[] b, int off, int len) throws IOException {
     }
 
     @Override
-    public int read(byte[] b) throws IOException {
+    public int read(@Nonnull byte[] b) throws IOException {
         return read(b, 0, b.length);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
index 2531cbaffee..35a528cdb86 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
@@ -21,27 +21,33 @@
 import java.io.IOException;
 import java.io.OutputStream;
 import java.nio.ByteBuffer;
+import javax.annotation.Nonnull;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 
 public class ByteBufferOutputStream extends OutputStream {
 
-    ByteBuffer bb;
+    private final ByteBuffer bb;
+
     public ByteBufferOutputStream(ByteBuffer bb) {
         this.bb = bb;
     }
+
     @Override
     public void write(int b) throws IOException {
         bb.put((byte) b);
     }
+
     @Override
-    public void write(byte[] b) throws IOException {
+    public void write(@Nonnull byte[] b) throws IOException {
         bb.put(b);
     }
+
     @Override
-    public void write(byte[] b, int off, int len) throws IOException {
+    public void write(@Nonnull byte[] b, int off, int len) throws IOException {
         bb.put(b, off, len);
     }
+
     public static void record2ByteBuffer(Record record, ByteBuffer bb) throws IOException {
         BinaryOutputArchive oa;
         oa = BinaryOutputArchive.getArchive(new ByteBufferOutputStream(bb));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index e73f85d7cc7..bc5b019f812 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -20,7 +20,6 @@
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -271,7 +270,7 @@ public void processRequest(Request request) {
             case OpCode.multiRead: {
                 lastOp = "MLTR";
                 MultiOperationRecord multiReadRecord = new MultiOperationRecord();
-                ByteBufferInputStream.byteBuffer2Record(request.request, multiReadRecord);
+                request.readRequestRecord(multiReadRecord);
                 rsp = new MultiResponse();
                 OpResult subResult;
                 for (Op readOp : multiReadRecord) {
@@ -350,7 +349,7 @@ public void processRequest(Request request) {
             case OpCode.sync: {
                 lastOp = "SYNC";
                 SyncRequest syncRequest = new SyncRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, syncRequest);
+                request.readRequestRecord(syncRequest);
                 rsp = new SyncResponse(syncRequest.getPath());
                 requestPathMetricsCollector.registerRequest(request.type, syncRequest.getPath());
                 break;
@@ -365,7 +364,7 @@ public void processRequest(Request request) {
                 lastOp = "EXIS";
                 // TODO we need to figure out the security requirement for this!
                 ExistsRequest existsRequest = new ExistsRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, existsRequest);
+                request.readRequestRecord(existsRequest);
                 path = existsRequest.getPath();
                 if (path.indexOf('\0') != -1) {
                     throw new KeeperException.BadArgumentsException();
@@ -378,7 +377,7 @@ public void processRequest(Request request) {
             case OpCode.getData: {
                 lastOp = "GETD";
                 GetDataRequest getDataRequest = new GetDataRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getDataRequest);
+                request.readRequestRecord(getDataRequest);
                 path = getDataRequest.getPath();
                 rsp = handleGetDataRequest(getDataRequest, cnxn, request.authInfo);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -387,9 +386,7 @@ public void processRequest(Request request) {
             case OpCode.setWatches: {
                 lastOp = "SETW";
                 SetWatches setWatches = new SetWatches();
-                // TODO we really should not need this
-                request.request.rewind();
-                ByteBufferInputStream.byteBuffer2Record(request.request, setWatches);
+                request.readRequestRecord(setWatches);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase()
                    .setWatches(
@@ -405,9 +402,7 @@ public void processRequest(Request request) {
             case OpCode.setWatches2: {
                 lastOp = "STW2";
                 SetWatches2 setWatches = new SetWatches2();
-                // TODO we really should not need this
-                request.request.rewind();
-                ByteBufferInputStream.byteBuffer2Record(request.request, setWatches);
+                request.readRequestRecord(setWatches);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase().setWatches(relativeZxid,
                         setWatches.getDataWatches(),
@@ -421,8 +416,7 @@ public void processRequest(Request request) {
             case OpCode.addWatch: {
                 lastOp = "ADDW";
                 AddWatchRequest addWatcherRequest = new AddWatchRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request,
-                        addWatcherRequest);
+                request.readRequestRecord(addWatcherRequest);
                 zks.getZKDatabase().addWatch(addWatcherRequest.getPath(), cnxn, addWatcherRequest.getMode());
                 rsp = new ErrorResponse(0);
                 break;
@@ -430,7 +424,7 @@ public void processRequest(Request request) {
             case OpCode.getACL: {
                 lastOp = "GETA";
                 GetACLRequest getACLRequest = new GetACLRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getACLRequest);
+                request.readRequestRecord(getACLRequest);
                 path = getACLRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
                 if (n == null) {
@@ -473,7 +467,7 @@ public void processRequest(Request request) {
             case OpCode.getChildren: {
                 lastOp = "GETC";
                 GetChildrenRequest getChildrenRequest = new GetChildrenRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getChildrenRequest);
+                request.readRequestRecord(getChildrenRequest);
                 path = getChildrenRequest.getPath();
                 rsp = handleGetChildrenRequest(getChildrenRequest, cnxn, request.authInfo);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -482,7 +476,7 @@ public void processRequest(Request request) {
             case OpCode.getAllChildrenNumber: {
                 lastOp = "GETACN";
                 GetAllChildrenNumberRequest getAllChildrenNumberRequest = new GetAllChildrenNumberRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getAllChildrenNumberRequest);
+                request.readRequestRecord(getAllChildrenNumberRequest);
                 path = getAllChildrenNumberRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
                 if (n == null) {
@@ -502,7 +496,7 @@ public void processRequest(Request request) {
             case OpCode.getChildren2: {
                 lastOp = "GETC";
                 GetChildren2Request getChildren2Request = new GetChildren2Request();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getChildren2Request);
+                request.readRequestRecord(getChildren2Request);
                 Stat stat = new Stat();
                 path = getChildren2Request.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
@@ -524,7 +518,7 @@ public void processRequest(Request request) {
             case OpCode.checkWatches: {
                 lastOp = "CHKW";
                 CheckWatchesRequest checkWatches = new CheckWatchesRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, checkWatches);
+                request.readRequestRecord(checkWatches);
                 WatcherType type = WatcherType.fromInt(checkWatches.getType());
                 path = checkWatches.getPath();
                 boolean containsWatcher = zks.getZKDatabase().containsWatcher(path, type, cnxn);
@@ -538,7 +532,7 @@ public void processRequest(Request request) {
             case OpCode.removeWatches: {
                 lastOp = "REMW";
                 RemoveWatchesRequest removeWatches = new RemoveWatchesRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, removeWatches);
+                request.readRequestRecord(removeWatches);
                 WatcherType type = WatcherType.fromInt(removeWatches.getType());
                 path = removeWatches.getPath();
                 boolean removed = zks.getZKDatabase().removeWatch(path, type, cnxn);
@@ -557,7 +551,7 @@ public void processRequest(Request request) {
             case OpCode.getEphemerals: {
                 lastOp = "GETE";
                 GetEphemeralsRequest getEphemerals = new GetEphemeralsRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getEphemerals);
+                request.readRequestRecord(getEphemerals);
                 String prefixPath = getEphemerals.getPrefixPath();
                 Set<String> allEphems = zks.getZKDatabase().getDataTree().getEphemerals(request.sessionId);
                 List<String> ephemerals = new ArrayList<>();
@@ -592,10 +586,13 @@ public void processRequest(Request request) {
             // error to the user
             LOG.error("Failed to process {}", request, e);
             StringBuilder sb = new StringBuilder();
-            ByteBuffer bb = request.request;
-            bb.rewind();
-            while (bb.hasRemaining()) {
-                sb.append(String.format("%02x", (0xff & bb.get())));
+            byte[] payload = request.readRequestBytes();
+            if (payload != null) {
+                for (byte b : payload) {
+                    sb.append(String.format("%02x", (0xff & b)));
+                }
+            } else {
+                sb.append("request buffer is null");
             }
             LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), sb);
             err = Code.MARSHALLINGERROR;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index dd62154fc87..83e7491e51b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -40,6 +40,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.WatcherEvent;
 import org.apache.zookeeper.server.NIOServerCnxnFactory.SelectorThread;
@@ -427,11 +428,13 @@ public void enableRecv() {
         }
     }
 
-    private void readConnectRequest() throws IOException, InterruptedException, ClientCnxnLimitException {
+    private void readConnectRequest() throws IOException, ClientCnxnLimitException {
         if (!isZKServerRunning()) {
             throw new IOException("ZooKeeperServer not running");
         }
-        zkServer.processConnectRequest(this, incomingBuffer);
+        BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(incomingBuffer));
+        ConnectRequest request = protocolManager.deserializeConnectRequest(bia);
+        zkServer.processConnectRequest(this, request);
         initialized = true;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 8937039bca7..ae482ce2b5e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -45,6 +45,7 @@
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.WatcherEvent;
 import org.apache.zookeeper.server.command.CommandExecutor;
@@ -482,7 +483,9 @@ private void receiveMessage(ByteBuf message) {
                             zks.processPacket(this, bb);
                         } else {
                             LOG.debug("got conn req request from {}", getRemoteSocketAddress());
-                            zks.processConnectRequest(this, bb);
+                            BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(bb));
+                            ConnectRequest request = protocolManager.deserializeConnectRequest(bia);
+                            zks.processConnectRequest(this, request);
                             initialized = true;
                         }
                         bb = null;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index f836927236d..9733a48aca1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -332,7 +332,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             break;
         }
         case OpCode.deleteContainer: {
-            String path = new String(request.request.array(), UTF_8);
+            String path = new String(request.readRequestBytes(), UTF_8);
             String parentPath = getParentPathAndValidate(path);
             ChangeRecord nodeRecord = getRecordForPath(path);
             if (nodeRecord.childCount > 0) {
@@ -360,7 +360,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             DeleteRequest deleteRequest = (DeleteRequest) record;
             if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, deleteRequest);
+                request.readRequestRecord(deleteRequest);
             }
             String path = deleteRequest.getPath();
             String parentPath = getParentPathAndValidate(path);
@@ -388,7 +388,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             SetDataRequest setDataRequest = (SetDataRequest) record;
             if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, setDataRequest);
+                request.readRequestRecord(setDataRequest);
             }
             path = setDataRequest.getPath();
             validatePath(path, request.sessionId);
@@ -560,7 +560,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             SetACLRequest setAclRequest = (SetACLRequest) record;
             if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, setAclRequest);
+                request.readRequestRecord(setAclRequest);
             }
             path = setAclRequest.getPath();
             validatePath(path, request.sessionId);
@@ -577,12 +577,11 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             addChangeRecord(nodeRecord);
             break;
         case OpCode.createSession:
-            request.request.rewind();
-            int to = request.request.getInt();
-            request.setTxn(new CreateSessionTxn(to));
-            request.request.rewind();
+            CreateSessionTxn createSessionTxn = new CreateSessionTxn();
+            request.readRequestRecord(createSessionTxn);
+            request.setTxn(createSessionTxn);
             // only add the global session tracker but not to ZKDb
-            zks.sessionTracker.trackSession(request.sessionId, to);
+            zks.sessionTracker.trackSession(request.sessionId, createSessionTxn.getTimeOut());
             zks.setOwner(request.sessionId, request.getOwner());
             break;
         case OpCode.closeSession:
@@ -632,7 +631,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             CheckVersionRequest checkVersionRequest = (CheckVersionRequest) record;
             if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, checkVersionRequest);
+                request.readRequestRecord(checkVersionRequest);
             }
             path = checkVersionRequest.getPath();
             validatePath(path, request.sessionId);
@@ -656,7 +655,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
 
     private void pRequest2TxnCreate(int type, Request request, Record record, boolean deserialize) throws IOException, KeeperException {
         if (deserialize) {
-            ByteBufferInputStream.byteBuffer2Record(request.request, record);
+            request.readRequestRecord(record);
         }
 
         int flags;
@@ -786,10 +785,8 @@ protected void pRequest(Request request) throws RequestProcessorException {
 
     /**
      * This method is a helper to pRequest method
-     *
-     * @param request
      */
-    private void pRequestHelper(Request request) throws RequestProcessorException {
+    private void pRequestHelper(Request request) {
         try {
             switch (request.type) {
             case OpCode.createContainer:
@@ -813,7 +810,7 @@ private void pRequestHelper(Request request) throws RequestProcessorException {
                 break;
             case OpCode.reconfig:
                 ReconfigRequest reconfigRequest = new ReconfigRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, reconfigRequest);
+                request.readRequestRecord(reconfigRequest);
                 pRequest2Txn(request.type, zks.getNextZxid(), request, reconfigRequest, true);
                 break;
             case OpCode.setACL:
@@ -827,12 +824,12 @@ private void pRequestHelper(Request request) throws RequestProcessorException {
             case OpCode.multi:
                 MultiOperationRecord multiRequest = new MultiOperationRecord();
                 try {
-                    ByteBufferInputStream.byteBuffer2Record(request.request, multiRequest);
+                    request.readRequestRecord(multiRequest);
                 } catch (IOException e) {
                     request.setHdr(new TxnHeader(request.sessionId, request.cxid, zks.getNextZxid(), Time.currentWallTime(), OpCode.multi));
                     throw e;
                 }
-                List<Txn> txns = new ArrayList<Txn>();
+                List<Txn> txns = new ArrayList<>();
                 //Each op in a multi-op must have the same zxid!
                 long zxid = zks.getNextZxid();
                 KeeperException ke = null;
@@ -947,18 +944,15 @@ private void pRequestHelper(Request request) throws RequestProcessorException {
             // log at error level as we are returning a marshalling
             // error to the user
             LOG.error("Failed to process {}", request, e);
-
             StringBuilder sb = new StringBuilder();
-            ByteBuffer bb = request.request;
-            if (bb != null) {
-                bb.rewind();
-                while (bb.hasRemaining()) {
-                    sb.append(String.format("%02x", (0xff & bb.get())));
+            byte[] payload = request.readRequestBytes();
+            if (payload != null) {
+                for (byte b : payload) {
+                    sb.append(String.format("%02x", (0xff & b)));
                 }
             } else {
                 sb.append("request buffer is null");
             }
-
             LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), sb);
             if (request.getHdr() != null) {
                 request.getHdr().setType(OpCode.error);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 41e3d7fcd36..1aee6aee24f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
+import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.List;
 import org.apache.jute.Record;
@@ -78,7 +79,29 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
 
     public final int type;
 
-    public final ByteBuffer request;
+    private final ByteBuffer request;
+
+    public void readRequestRecord(Record record) throws IOException {
+        if (request != null) {
+            request.rewind();
+            ByteBufferInputStream.byteBuffer2Record(request, record);
+            request.rewind();
+            return;
+        }
+        throw new IOException(new NullPointerException("request"));
+    }
+
+    public byte[] readRequestBytes() {
+        if (request != null) {
+            request.rewind();
+            int len = request.remaining();
+            byte[] b = new byte[len];
+            request.get(b);
+            request.rewind();
+            return b;
+        }
+        return null;
+    }
 
     public final ServerCnxn cnxn;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 4260913b796..0303ca645bd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1375,17 +1375,13 @@ public double getConnectionDropChance() {
     }
 
     @SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification = "the value won't change after startup")
-    public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
-        throws IOException, ClientCnxnLimitException {
-
-        BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(incomingBuffer));
-        ConnectRequest connReq = cnxn.protocolManager.deserializeConnectRequest(bia);
+    public void processConnectRequest(ServerCnxn cnxn, ConnectRequest request) throws IOException, ClientCnxnLimitException {
         LOG.debug(
             "Session establishment request from client {} client's lastZxid is 0x{}",
             cnxn.getRemoteSocketAddress(),
-            Long.toHexString(connReq.getLastZxidSeen()));
+            Long.toHexString(request.getLastZxidSeen()));
 
-        long sessionId = connReq.getSessionId();
+        long sessionId = request.getSessionId();
         int tokensNeeded = 1;
         if (connThrottle.isConnectionWeightEnabled()) {
             if (sessionId == 0) {
@@ -1405,22 +1401,22 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
         ServerMetrics.getMetrics().CONNECTION_TOKEN_DEFICIT.add(connThrottle.getDeficit());
         ServerMetrics.getMetrics().CONNECTION_REQUEST_COUNT.add(1);
 
-        if (cnxn.protocolManager.isReadonlyAvailable()) {
+        if (!cnxn.protocolManager.isReadonlyAvailable()) {
             LOG.warn(
                 "Connection request from old client {}; will be dropped if server is in r-o mode",
                 cnxn.getRemoteSocketAddress());
         }
 
-        if (!connReq.getReadOnly() && this instanceof ReadOnlyZooKeeperServer) {
+        if (!request.getReadOnly() && this instanceof ReadOnlyZooKeeperServer) {
             String msg = "Refusing session request for not-read-only client " + cnxn.getRemoteSocketAddress();
             LOG.info(msg);
             throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
         }
-        if (connReq.getLastZxidSeen() > zkDb.dataTree.lastProcessedZxid) {
+        if (request.getLastZxidSeen() > zkDb.dataTree.lastProcessedZxid) {
             String msg = "Refusing session request for client "
                          + cnxn.getRemoteSocketAddress()
                          + " as it has seen zxid 0x"
-                         + Long.toHexString(connReq.getLastZxidSeen())
+                         + Long.toHexString(request.getLastZxidSeen())
                          + " our last zxid is 0x"
                          + Long.toHexString(getZKDatabase().getDataTreeLastProcessedZxid())
                          + " client must try another server";
@@ -1428,8 +1424,8 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
             LOG.info(msg);
             throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
         }
-        int sessionTimeout = connReq.getTimeOut();
-        byte[] passwd = connReq.getPasswd();
+        int sessionTimeout = request.getTimeOut();
+        byte[] passwd = request.getPasswd();
         int minSessionTimeout = getMinSessionTimeout();
         if (sessionTimeout < minSessionTimeout) {
             sessionTimeout = minSessionTimeout;
@@ -1447,16 +1443,16 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
             LOG.debug(
                 "Client attempting to establish new session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
                 Long.toHexString(id),
-                Long.toHexString(connReq.getLastZxidSeen()),
-                connReq.getTimeOut(),
+                Long.toHexString(request.getLastZxidSeen()),
+                request.getTimeOut(),
                 cnxn.getRemoteSocketAddress());
         } else {
             validateSession(cnxn, sessionId);
             LOG.debug(
                 "Client attempting to renew session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
                 Long.toHexString(sessionId),
-                Long.toHexString(connReq.getLastZxidSeen()),
-                connReq.getTimeOut(),
+                Long.toHexString(request.getLastZxidSeen()),
+                request.getTimeOut(),
                 cnxn.getRemoteSocketAddress());
             if (serverCnxnFactory != null) {
                 serverCnxnFactory.closeSession(sessionId, ServerCnxn.DisconnectReason.CLIENT_RECONNECT);
@@ -2182,7 +2178,7 @@ private String effectiveACLPath(Request request) throws KeeperException.BadArgum
         case OpCode.create:
         case OpCode.create2: {
             CreateRequest req = new CreateRequest();
-            if (buffer2Record(request.request, req)) {
+            if (readRequestRecord(request, req)) {
                 mustCheckACL = true;
                 acl = req.getAcl();
                 path = parentPath(req.getPath());
@@ -2191,21 +2187,21 @@ private String effectiveACLPath(Request request) throws KeeperException.BadArgum
         }
         case OpCode.delete: {
             DeleteRequest req = new DeleteRequest();
-            if (buffer2Record(request.request, req)) {
+            if (readRequestRecord(request, req)) {
                 path = parentPath(req.getPath());
             }
             break;
         }
         case OpCode.setData: {
             SetDataRequest req = new SetDataRequest();
-            if (buffer2Record(request.request, req)) {
+            if (readRequestRecord(request, req)) {
                 path = req.getPath();
             }
             break;
         }
         case OpCode.setACL: {
             SetACLRequest req = new SetACLRequest();
-            if (buffer2Record(request.request, req)) {
+            if (readRequestRecord(request, req)) {
                 mustCheckACL = true;
                 acl = req.getAcl();
                 path = req.getPath();
@@ -2299,16 +2295,13 @@ public boolean authWriteRequest(Request request) {
         return err == KeeperException.Code.OK.intValue();
     }
 
-    private boolean buffer2Record(ByteBuffer request, Record record) {
-        boolean rv = false;
+    private boolean readRequestRecord(Request request, Record record) {
         try {
-            ByteBufferInputStream.byteBuffer2Record(request, record);
-            request.rewind();
-            rv = true;
+            request.readRequestRecord(record);
+            return true;
         } catch (IOException ex) {
+            return false;
         }
-
-        return rv;
     }
 
     public int getOutstandingHandshakeNum() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 594c87fb90d..b6eeb758ac9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -254,13 +254,9 @@ void request(Request request) throws IOException {
         oa.writeLong(request.sessionId);
         oa.writeInt(request.cxid);
         oa.writeInt(request.type);
-        if (request.request != null) {
-            request.request.rewind();
-            int len = request.request.remaining();
-            byte[] b = new byte[len];
-            request.request.get(b);
-            request.request.rewind();
-            oa.write(b);
+        byte[] payload = request.readRequestBytes();
+        if (payload != null) {
+            oa.write(payload);
         }
         oa.close();
         QuorumPacket qp = new QuorumPacket(Leader.REQUEST, -1, baos.toByteArray(), request.authInfo);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
index f27ce827421..2f24347b778 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
@@ -31,7 +31,6 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.proto.CreateRequest;
-import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZKDatabase;
@@ -78,9 +77,7 @@ public Request checkUpgradeSession(Request request) throws IOException, KeeperEx
 
         if (OpCode.multi == request.type) {
             MultiOperationRecord multiTransactionRecord = new MultiOperationRecord();
-            request.request.rewind();
-            ByteBufferInputStream.byteBuffer2Record(request.request, multiTransactionRecord);
-            request.request.rewind();
+            request.readRequestRecord(multiTransactionRecord);
             boolean containsEphemeralCreate = false;
             for (Op op : multiTransactionRecord) {
                 if (op.getType() == OpCode.create || op.getType() == OpCode.create2) {
@@ -97,9 +94,7 @@ public Request checkUpgradeSession(Request request) throws IOException, KeeperEx
             }
         } else {
             CreateRequest createRequest = new CreateRequest();
-            request.request.rewind();
-            ByteBufferInputStream.byteBuffer2Record(request.request, createRequest);
-            request.request.rewind();
+            request.readRequestRecord(createRequest);
             CreateMode createMode = CreateMode.fromFlag(createRequest.getFlags());
             if (!createMode.isEphemeral()) {
                 return null;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
index 6722473f2a5..f9fd6d8b588 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
@@ -27,7 +27,6 @@
 import java.util.Collection;
 import java.util.Collections;
 import java.util.concurrent.BlockingQueue;
-import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -221,11 +220,11 @@ public void testFalseEmpty() throws KeeperException, InterruptedException {
     @Test
     @Timeout(value = 30)
     public void testMaxPerMinute() throws InterruptedException {
-        final BlockingQueue<String> queue = new LinkedBlockingQueue<String>();
+        final BlockingQueue<String> queue = new LinkedBlockingQueue<>();
         RequestProcessor processor = new RequestProcessor() {
             @Override
             public void processRequest(Request request) {
-                queue.add(new String(request.request.array()));
+                queue.add(new String(request.readRequestBytes()));
             }
 
             @Override
@@ -243,12 +242,9 @@ protected Collection<String> getCandidates() {
                 return Arrays.asList("/one", "/two", "/three", "/four");
             }
         };
-        Executors.newSingleThreadExecutor().submit(new Callable<Void>() {
-            @Override
-            public Void call() throws Exception {
-                containerManager.checkContainers();
-                return null;
-            }
+        Executors.newSingleThreadExecutor().submit(() -> {
+            containerManager.checkContainers();
+            return null;
         });
         assertEquals(queue.poll(5, TimeUnit.SECONDS), "/one");
         assertEquals(queue.poll(5, TimeUnit.SECONDS), "/two");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
index ac46b4e0f29..6c22091f426 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
@@ -18,10 +18,7 @@
 
 package org.apache.zookeeper.server;
 
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.nio.ByteBuffer;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
@@ -51,10 +48,7 @@ public void submitRequest(Request si) {
         ServerCnxn cnxn = new MockServerCnxn();
 
         ConnectRequest connReq = new ConnectRequest();
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-        connReq.serialize(boa, "connect");
-        zks.processConnectRequest(cnxn, ByteBuffer.wrap(baos.toByteArray()));
+        zks.processConnectRequest(cnxn, connReq);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index 4d41dac1a9b..e9f9b7db544 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -26,12 +26,12 @@
 import static org.mockito.Mockito.mock;
 import java.io.File;
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.SnapStream;
@@ -150,21 +150,17 @@ public void testClientZxidAhead() {
         final ZKDatabase zkDatabase = new ZKDatabase(mock(FileTxnSnapLog.class));
         zooKeeperServer.setZKDatabase(zkDatabase);
 
-        final ByteBuffer output = ByteBuffer.allocate(30);
-        // serialize a connReq
-        output.putInt(1);
-        // lastZxid
-        output.putLong(99L);
-        output.putInt(500);
-        output.putLong(123L);
-        output.putInt(1);
-        output.put((byte) 1);
-        output.put((byte) 1);
-        output.flip();
+        final ConnectRequest request = new ConnectRequest();
+        request.setProtocolVersion(1);
+        request.setLastZxidSeen(99L);
+        request.setTimeOut(500);
+        request.setSessionId(123L);
+        request.setPasswd(new byte[]{ 1 });
+        request.setReadOnly(true);
 
         ServerCnxn.CloseRequestException e = assertThrows(
                 ServerCnxn.CloseRequestException.class,
-                () -> zooKeeperServer.processConnectRequest(new MockServerCnxn(), output));
+                () -> zooKeeperServer.processConnectRequest(new MockServerCnxn(), request));
         assertEquals(e.getReason(), ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
index 3ee6016f086..298b5d1d95f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
@@ -21,7 +21,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.mock;
-import java.nio.ByteBuffer;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.MockServerCnxn;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ZKDatabase;
@@ -35,28 +35,26 @@
 public class ReadOnlyZooKeeperServerTest {
 
     /**
-     * test method {@link ZooKeeperServer#processConnectRequest(org.apache.zookeeper.server.ServerCnxn, java.nio.ByteBuffer)}
+     * test method {@link ZooKeeperServer#processConnectRequest(ServerCnxn, ConnectRequest)}
      */
     @Test
     public void testReadOnlyZookeeperServer() {
         ReadOnlyZooKeeperServer readOnlyZooKeeperServer = new ReadOnlyZooKeeperServer(
-                mock(FileTxnSnapLog.class), mock(QuorumPeer.class), mock(ZKDatabase.class));
-
-        final ByteBuffer output = ByteBuffer.allocate(30);
-        // serialize a connReq
-        output.putInt(1);
-        output.putLong(1L);
-        output.putInt(500);
-        output.putLong(123L);
-        output.putInt(1);
-        output.put((byte) 1);
-        // set readOnly false
-        output.put((byte) 0);
-        output.flip();
-
-        ServerCnxn.CloseRequestException e = assertThrows(ServerCnxn.CloseRequestException.class, () -> {
-            readOnlyZooKeeperServer.processConnectRequest(new MockServerCnxn(), output);
-        });
+                mock(FileTxnSnapLog.class),
+                mock(QuorumPeer.class),
+                mock(ZKDatabase.class));
+
+        final ConnectRequest request = new ConnectRequest();
+        request.setProtocolVersion(1);
+        request.setLastZxidSeen(99L);
+        request.setTimeOut(500);
+        request.setSessionId(123L);
+        request.setPasswd(new byte[]{ 1 });
+        request.setReadOnly(false);
+
+        ServerCnxn.CloseRequestException e = assertThrows(
+                ServerCnxn.CloseRequestException.class,
+                () -> readOnlyZooKeeperServer.processConnectRequest(new MockServerCnxn(), request));
         assertEquals(e.getReason(), ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
index 2131158d811..8803a73cbab 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
@@ -39,7 +39,6 @@
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.proto.CreateRequest;
-import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
@@ -319,15 +318,13 @@ protected void request(Request request) throws IOException {
 
                             if (request.type == ZooDefs.OpCode.create && request.cnxn != null) {
                                 CreateRequest createRequest = new CreateRequest();
-                                request.request.rewind();
-                                ByteBufferInputStream.byteBuffer2Record(request.request, createRequest);
-                                request.request.rewind();
+                                request.readRequestRecord(createRequest);
                                 try {
                                     CreateMode createMode = CreateMode.fromFlag(createRequest.getFlags());
                                     if (createMode.isEphemeral()) {
                                         request.cnxn.sendCloseSession();
                                     }
-                                } catch (KeeperException e) {
+                                } catch (KeeperException ignore) {
                                 }
                                 return;
                             }

From 05b215994f5e145c2758c4089828b57ba471b329 Mon Sep 17 00:00:00 2001
From: Szabolcs Bukros <szabolcs@cloudera.com>
Date: Wed, 13 Jul 2022 13:08:53 +0200
Subject: [PATCH 320/591] ZOOKEEPER-4566: Create tool for recursive snapshot
 analysis

add a tool to recursively collect and display child count and data
stored in sub-trees

Author: Szabolcs Bukros <szabolcs@cloudera.com>

Reviewers: Andor Molnar <andor@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1902 from BukrosSzabolcs/ZOOKEEPER-4566
---
 bin/zkSnapshotRecursiveSummaryToolkit.cmd     |  24 +++
 bin/zkSnapshotRecursiveSummaryToolkit.sh      |  39 +++++
 .../main/resources/markdown/zookeeperTools.md |  38 +++++
 .../server/SnapshotRecursiveSummary.java      | 137 ++++++++++++++++++
 4 files changed, 238 insertions(+)
 create mode 100755 bin/zkSnapshotRecursiveSummaryToolkit.cmd
 create mode 100755 bin/zkSnapshotRecursiveSummaryToolkit.sh
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java

diff --git a/bin/zkSnapshotRecursiveSummaryToolkit.cmd b/bin/zkSnapshotRecursiveSummaryToolkit.cmd
new file mode 100755
index 00000000000..ee893108e6b
--- /dev/null
+++ b/bin/zkSnapshotRecursiveSummaryToolkit.cmd
@@ -0,0 +1,24 @@
+@echo off
+REM Licensed to the Apache Software Foundation (ASF) under one or more
+REM contributor license agreements.  See the NOTICE file distributed with
+REM this work for additional information regarding copyright ownership.
+REM The ASF licenses this file to You under the Apache License, Version 2.0
+REM (the "License"); you may not use this file except in compliance with
+REM the License.  You may obtain a copy of the License at
+REM
+REM     http://www.apache.org/licenses/LICENSE-2.0
+REM
+REM Unless required by applicable law or agreed to in writing, software
+REM distributed under the License is distributed on an "AS IS" BASIS,
+REM WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+REM See the License for the specific language governing permissions and
+REM limitations under the License.
+
+setlocal
+call "%~dp0zkEnv.cmd"
+
+set ZOOMAIN=org.apache.zookeeper.server.SnapshotRecursiveSummary
+call %JAVA% -cp "%CLASSPATH%" %ZOOMAIN% %*
+
+endlocal
+
diff --git a/bin/zkSnapshotRecursiveSummaryToolkit.sh b/bin/zkSnapshotRecursiveSummaryToolkit.sh
new file mode 100755
index 00000000000..f7659971b1b
--- /dev/null
+++ b/bin/zkSnapshotRecursiveSummaryToolkit.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# If this scripted is run out of /usr/bin or some other system bin directory
+# it should be linked to and not copied. Things like java jar files are found
+# relative to the canonical path of this script.
+#
+
+# use POSIX interface, symlink is followed automatically
+ZOOBIN="${BASH_SOURCE-$0}"
+ZOOBIN="$(dirname "${ZOOBIN}")"
+ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+
+if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+  # shellcheck source=/bin/zkEnv.sh
+  . "$ZOOBINDIR"/../libexec/zkEnv.sh
+else
+  . "$ZOOBINDIR"/zkEnv.sh
+fi
+
+"$JAVA" -cp "$CLASSPATH" "$JVMFLAGS" \
+     org.apache.zookeeper.server.SnapshotRecursiveSummary "$@"
+
+
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index 5141766d75c..d4abe385467 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -23,6 +23,7 @@ limitations under the License.
     * [zkCleanup.sh](#zkCleanup)
     * [zkTxnLogToolkit.sh](#zkTxnLogToolkit)
     * [zkSnapShotToolkit.sh](#zkSnapShotToolkit)
+    * [zkSnapshotRecursiveSummaryToolkit.sh](#zkSnapshotRecursiveSummaryToolkit)
     * [zkSnapshotComparer.sh](#zkSnapshotComparer)
 
 * [Benchmark](#Benchmark)
@@ -218,6 +219,43 @@ USAGE: SnapshotFormatter [-d|-json] snapshot_file
 ./zkSnapShotToolkit.sh -json /data/zkdata/version-2/snapshot.fa01000186d
 [[1,0,{"progname":"SnapshotFormatter.java","progver":"0.01","timestamp":1559788148637},[{"name":"\/","asize":0,"dsize":0,"dev":0,"ino":1001},[{"name":"zookeeper","asize":0,"dsize":0,"dev":0,"ino":1002},{"name":"config","asize":0,"dsize":0,"dev":0,"ino":1003},[{"name":"quota","asize":0,"dsize":0,"dev":0,"ino":1004},[{"name":"test","asize":0,"dsize":0,"dev":0,"ino":1005},{"name":"zookeeper_limits","asize":52,"dsize":52,"dev":0,"ino":1006},{"name":"zookeeper_stats","asize":15,"dsize":15,"dev":0,"ino":1007}]]],{"name":"test","asize":0,"dsize":0,"dev":0,"ino":1008}]]
 ```
+<a name="zkSnapshotRecursiveSummaryToolkit"></a>
+
+### zkSnapshotRecursiveSummaryToolkit.sh
+Recursively collect and display child count and data size for a selected node.
+
+    $./zkSnapshotRecursiveSummaryToolkit.sh
+    USAGE:
+    
+    SnapshotRecursiveSummary  <snapshot_file>  <starting_node>  <max_depth>
+    
+    snapshot_file:    path to the zookeeper snapshot
+    starting_node:    the path in the zookeeper tree where the traversal should begin
+    max_depth:        defines the depth where the tool still writes to the output. 0 means there is no depth limit, every non-leaf node's stats will be displayed, 1 means it will only contain the starting node's and it's children's stats, 2 ads another level and so on. This ONLY affects the level of details displayed, NOT the calculation.
+
+```bash
+# recursively collect and display child count and data for the root node and 2 levels below it
+./zkSnapshotRecursiveSummaryToolkit.sh /data/zkdata/version-2/snapshot.fa01000186d / 2
+
+/
+   children: 1250511
+   data: 1952186580
+-- /zookeeper
+--   children: 1
+--   data: 0
+-- /solr
+--   children: 1773
+--   data: 8419162
+---- /solr/configs
+----   children: 1640
+----   data: 8407643
+---- /solr/overseer
+----   children: 6
+----   data: 0
+---- /solr/live_nodes
+----   children: 3
+----   data: 0
+```
 
 <a name="zkSnapshotComparer"></a>
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
new file mode 100644
index 00000000000..2d5f30b638f
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
@@ -0,0 +1,137 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import org.apache.jute.BinaryInputArchive;
+import org.apache.jute.InputArchive;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.server.persistence.FileSnap;
+import org.apache.zookeeper.server.persistence.SnapStream;
+
+/**
+ * Recursively processes a snapshot file collecting child node count and summarizes the data size
+ * below each node.
+ * "starting_node" defines the node where the recursion starts
+ * "max_depth" defines the depth where the tool still writes to the output.
+ * 0 means there is no depth limit, every non-leaf node's stats will be displayed, 1 means it will
+ * only contain the starting node's and it's children's stats, 2 ads another level and so on.
+ * This ONLY affects the level of details displayed, NOT the calculation.
+ */
+@InterfaceAudience.Public public class SnapshotRecursiveSummary {
+
+  /**
+   * USAGE: SnapsotRecursiveSummary snapshot_file starting_node max_depth
+   *
+   */
+  public static void main(String[] args) throws Exception {
+    if (args.length != 3) {
+      System.err.println(getUsage());
+      System.exit(2);
+    }
+    int maxDepth = 0;
+    try {
+      maxDepth = Integer.parseInt(args[2]);
+    } catch (NumberFormatException e) {
+      System.err.println(getUsage());
+      System.exit(2);
+    }
+
+    new SnapshotRecursiveSummary().run(args[0], args[1], maxDepth);
+  }
+
+  public void run(String snapshotFileName, String startingNode, int maxDepth) throws IOException {
+    File snapshotFile = new File(snapshotFileName);
+    try (InputStream is = SnapStream.getInputStream(snapshotFile)) {
+      InputArchive ia = BinaryInputArchive.getArchive(is);
+
+      FileSnap fileSnap = new FileSnap(null);
+
+      DataTree dataTree = new DataTree();
+      Map<Long, Integer> sessions = new HashMap<Long, Integer>();
+
+      fileSnap.deserialize(dataTree, sessions, ia);
+
+      printZnodeDetails(dataTree, startingNode, maxDepth);
+    }
+  }
+
+  private void printZnodeDetails(DataTree dataTree, String startingNode, int maxDepth) {
+    StringBuilder builder = new StringBuilder();
+    printZnode(dataTree, startingNode, builder, 0, maxDepth);
+    System.out.println(builder);
+  }
+
+  private long[] printZnode(DataTree dataTree, String name, StringBuilder builder, int level,
+      int maxDepth) {
+    DataNode n = dataTree.getNode(name);
+    Set<String> children;
+    long dataSum = 0L;
+    synchronized (n) { // keep findbugs happy
+      if (n.data != null) {
+        dataSum += n.data.length;
+      }
+      children = n.getChildren();
+    }
+
+    long[] result = {1L, dataSum};
+    if (children.size() == 0) {
+      return result;
+    }
+    StringBuilder childBuilder = new StringBuilder();
+    for (String child : children) {
+      long[] childResult =
+          printZnode(dataTree, name + (name.equals("/") ? "" : "/") + child, childBuilder,
+              level + 1, maxDepth);
+      result[0] = result[0] + childResult[0];
+      result[1] = result[1] + childResult[1];
+    }
+
+    if (maxDepth == 0 || level <= maxDepth) {
+      String tab = String.join("", Collections.nCopies(level, "--"));
+      builder.append(tab + " " + name + "\n");
+      builder.append(tab + "   children: " + (result[0] - 1) + "\n");
+      builder.append(tab + "   data: " + result[1] + "\n");
+      builder.append(childBuilder);
+    }
+    return result;
+  }
+
+  public static String getUsage() {
+    String newLine = System.getProperty("line.separator");
+    return String.join(newLine,
+        "USAGE:",
+        newLine,
+        "SnapshotRecursiveSummary  <snapshot_file>  <starting_node>  <max_depth>",
+        newLine,
+        "snapshot_file:    path to the zookeeper snapshot",
+        "starting_node:    the path in the zookeeper tree where the traversal should begin",
+        "max_depth:        defines the depth where the tool still writes to the output. "
+            + "0 means there is no depth limit, every non-leaf node's stats will be displayed, "
+            + "1 means it will only contain the starting node's and it's children's stats, "
+            + "2 ads another level and so on. This ONLY affects the level of details displayed, "
+            + "NOT the calculation.");
+  }
+}

From 2cd0c23454071faf0a16c58edb2414591ae5c5c3 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Tue, 26 Jul 2022 09:39:20 +0200
Subject: [PATCH 321/591] ZOOKEEPER-4565: Refine chroot strip to accommodate
 /zookeeper/ subtree

```java
if (serverPath.length() > chrootPath.length()) {
    event.setPath(serverPath.substring(chrootPath.length()));
}
```

Currently, chroot strip code listed above could result in illegal path
(aka. path not start with "/"). This will disconnect zookeeper client
due to `StringIndexOutOfBoundsException` from `PathParentIterator.next`
in event handling.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1899 from kezhuw/ZOOKEEPER-4565-refine-chroot-strip
---
 .../java/org/apache/zookeeper/ClientCnxn.java | 22 ++++++++++++-------
 .../org/apache/zookeeper/test/ChrootTest.java | 22 +++++++++++++++++++
 2 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 837c12d5a08..96ff8eb088e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -855,6 +855,18 @@ class SendThread extends ZooKeeperThread {
         private boolean isFirstConnect = true;
         private volatile ZooKeeperSaslClient zooKeeperSaslClient;
 
+        private String stripChroot(String serverPath) {
+            if (serverPath.startsWith(chrootPath)) {
+                if (serverPath.length() == chrootPath.length()) {
+                    return "/";
+                }
+                return serverPath.substring(chrootPath.length());
+            } else if (serverPath.startsWith(ZooDefs.ZOOKEEPER_NODE_SUBTREE)) {
+                return serverPath;
+            }
+            LOG.warn("Got server path {} which is not descendant of chroot path {}.", serverPath, chrootPath);
+            return serverPath;
+        }
 
         void readResponse(ByteBuffer incomingBuffer) throws IOException {
             ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
@@ -886,14 +898,8 @@ void readResponse(ByteBuffer incomingBuffer) throws IOException {
                 // convert from a server path to a client path
                 if (chrootPath != null) {
                     String serverPath = event.getPath();
-                    if (serverPath.compareTo(chrootPath) == 0) {
-                        event.setPath("/");
-                    } else if (serverPath.length() > chrootPath.length()) {
-                        event.setPath(serverPath.substring(chrootPath.length()));
-                     } else {
-                         LOG.warn("Got server path {} which is too short for chroot path {}.",
-                             event.getPath(), chrootPath);
-                     }
+                    String clientPath = stripChroot(serverPath);
+                    event.setPath(clientPath);
                 }
 
                 WatchedEvent we = new WatchedEvent(event);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
index 0b156156d0d..fca48c751f1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
@@ -25,12 +25,15 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Arrays;
+import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.junit.jupiter.api.Test;
@@ -60,6 +63,25 @@ public boolean matches() throws InterruptedException {
 
     }
 
+    @Test
+    public void testChrootWithZooKeeperPathWatcher() throws Exception {
+        ZooKeeper zk1 = createClient(hostPort + "/chroot");
+        BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+        byte[] config = zk1.getConfig(events::add, null);
+
+        ZooKeeper zk2 = createClient();
+        zk2.addAuthInfo("digest", "super:test".getBytes());
+        zk2.setData(ZooDefs.CONFIG_NODE, config, -1);
+
+        waitFor("config watcher receive no event", () -> !events.isEmpty(), 10);
+
+        WatchedEvent event = events.poll();
+        assertNotNull(event);
+        assertEquals(Watcher.Event.KeeperState.SyncConnected, event.getState());
+        assertEquals(Watcher.Event.EventType.NodeDataChanged, event.getType());
+        assertEquals(ZooDefs.CONFIG_NODE, event.getPath());
+    }
+
     @Test
     public void testChrootSynchronous() throws IOException, InterruptedException, KeeperException {
         ZooKeeper zk1 = createClient();

From 9b6ec9060604347fc996fe69dc33a21222fbd0c4 Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Sun, 4 Sep 2022 15:33:16 +0800
Subject: [PATCH 322/591] ZOOKEEPER-4547: Change the documentation of
 client.certReload numbers

changed the versions to `New in 3.7.2, 3.8.1, 3.9.0:`

Author: Li Wang <li4wanggmail.com>

Author: liwang <liwang@apple.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, maoling <maoling@apache.org>

Closes #1886 from li4wang/ZOOKEEPER-4547
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index f7e38b9263f..8e19f0418a9 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1747,7 +1747,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 
 * *client.certReload* :
     (Java system property: **zookeeper.client.certReload**)
-    **New in 3.9.0:**
+    **New in 3.7.2, 3.8.1, 3.9.0:**
     Allows client SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false
 
 * *client.portUnification*:

From bc1b231c9e32667b2978c86a6a64833470973dbd Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Sun, 25 Sep 2022 16:21:45 +0800
Subject: [PATCH 323/591] ZOOKEEPER-4327: Fix flaky RequestThrottlerTest

This PR tries to fix several test failures in `RequestThrottlerTest`.

First, `RequestThrottlerTest#testDropStaleRequests`.

Place `Thread.sleep(200)` after `submittedRequests.take()` in `RequestThrottler#run` will fail two assertions:
1. `assertEquals(2L, (long) metrics.get("prep_processor_request_queued"))`
2. `assertEquals(1L, (long) metrics.get("request_throttle_wait_count"))`

This happens due to `setStale` chould happen before throttle handling.

This commit solves this by introducing an interception point `RequestThrottler.throttleSleep` to build happen-before relations:
1. `throttling.countDown` happens before `setStale`, this ensures that unthrottled request are processed as usual.
2. `setStale` happens before `throttled.await`, this defends `RequestThrottler.throttleSleep` against spurious wakeup.

Second, `RequestThrottlerTest#testRequestThrottler`.

* `RequestThrottlerTest.testRequestThrottler:197 expected: <2> but was: <1>`

  `ZooKeeperServer#submitRequest` and `PrepRequestProcessor#processRequest` run in different threads, thus there is no guarantee on metric `prep_processor_request_queued` after `submitted.await(5, TimeUnit.SECONDS)`. Place `Thread.sleep(200)` before `zks.submitRequestNow(request)` in `RequestThrottler#run` will incur this failure.
* `RequestThrottlerTest.testRequestThrottler:206 expected: <5> but was: <4>`

  `entered.await(STALL_TIME, TimeUnit.MILLISECONDS)` could return `false` due to almost same timeout as `RequestThrottler#throttleSleep`. Place `Thread.sleep(500)` around `throttleSleep` will increase failure possibility.

Third, `RequestThrottlerTest#testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled`.

* `RequestThrottlerTest.testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled:340 expected: <3> but was: <4>`

  `ZooKeeperServer#shouldThrottle` depends on consistent sum of `getInflight` and `getInProcess`. But it is no true. Place `Thread.sleep(200)` before `zks.submitRequestNow(request)` in `RequestThrottler#run` could reproduce this.

Sees also https://github.com/apache/zookeeper/pull/1739, https://github.com/apache/zookeeper/pull/1821.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: Mate Szalay-Beko <symat@apache.org>, maoling <maoling@apache.org>

Closes #1887 from kezhuw/ZOOKEEPER-4327-flaky-RequestThrottlerTest.testDropStaleRequests
---
 .../zookeeper/server/RequestThrottler.java    | 12 ++--
 .../zookeeper/server/ZooKeeperServer.java     |  5 +-
 .../server/RequestThrottlerTest.java          | 66 +++++++++++++++----
 3 files changed, 64 insertions(+), 19 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index d60efa0878f..4a401e5b919 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -195,13 +195,11 @@ public void run() {
         LOG.info("RequestThrottler shutdown. Dropped {} requests", dropped);
     }
 
-    private synchronized void throttleSleep(int stallTime) {
-        try {
-            ServerMetrics.getMetrics().REQUEST_THROTTLE_WAIT_COUNT.add(1);
-            this.wait(stallTime);
-        } catch (InterruptedException ie) {
-            return;
-        }
+
+    // @VisibleForTesting
+    synchronized void throttleSleep(int stallTime) throws InterruptedException {
+        ServerMetrics.getMetrics().REQUEST_THROTTLE_WAIT_COUNT.add(1);
+        this.wait(stallTime);
     }
 
     @SuppressFBWarnings(value = "NN_NAKED_NOTIFY", justification = "state change is in ZooKeeperServer.decInProgress() ")
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 0303ca645bd..817e84b3e59 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -749,9 +749,12 @@ protected void startJvmPauseMonitor() {
     }
 
     protected void startRequestThrottler() {
-        requestThrottler = new RequestThrottler(this);
+        requestThrottler = createRequestThrottler();
         requestThrottler.start();
+    }
 
+    protected RequestThrottler createRequestThrottler() {
+        return new RequestThrottler(this);
     }
 
     protected void setupRequestProcessors() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index ed22399902f..15259207599 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -67,11 +67,17 @@ public class RequestThrottlerTest extends ZKTestCase {
 
     CountDownLatch disconnected = null;
 
+    CountDownLatch throttled = null;
+    CountDownLatch throttling = null;
+
     ZooKeeperServer zks = null;
     ServerCnxnFactory f = null;
     ZooKeeper zk = null;
     int connectionLossCount = 0;
 
+    private long getCounterMetric(String name) {
+        return (long) MetricsUtils.currentServerMetrics().get(name);
+    }
 
     @BeforeEach
     public void setup() throws Exception {
@@ -115,6 +121,11 @@ public TestZooKeeperServer(File snapDir, File logDir, int tickTime) throws IOExc
             super(snapDir, logDir, tickTime);
         }
 
+        @Override
+        protected RequestThrottler createRequestThrottler() {
+            return new TestRequestThrottler(this);
+        }
+
         @Override
         protected void setupRequestProcessors() {
             RequestProcessor finalProcessor = new FinalRequestProcessor(this);
@@ -141,6 +152,24 @@ public void requestFinished(Request request) {
         }
     }
 
+    class TestRequestThrottler extends RequestThrottler {
+        public TestRequestThrottler(ZooKeeperServer zks) {
+            super(zks);
+        }
+
+        @Override
+        synchronized void throttleSleep(int stallTime) throws InterruptedException {
+            if (throttling != null) {
+                throttling.countDown();
+            }
+            super.throttleSleep(stallTime);
+            // Defend against unstable timing and potential spurious wakeup.
+            if (throttled != null) {
+                assertTrue(throttled.await(20, TimeUnit.SECONDS));
+            }
+        }
+    }
+
     class TestPrepRequestProcessor extends PrepRequestProcessor {
 
         public TestPrepRequestProcessor(ZooKeeperServer zks, RequestProcessor syncProcessor) {
@@ -191,18 +220,22 @@ public void testRequestThrottler() throws Exception {
 
         // make sure the server received all 5 requests
         submitted.await(5, TimeUnit.SECONDS);
-        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
 
         // but only two requests can get into the pipeline because of the throttler
-        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
-        assertEquals(1L, (long) metrics.get("request_throttle_wait_count"));
+        WaitForCondition requestQueued = () -> getCounterMetric("prep_processor_request_queued") == 2;
+        waitFor("request not queued", requestQueued, 5);
+
+        WaitForCondition throttleWait = () -> getCounterMetric("request_throttle_wait_count") >= 1;
+        waitFor("no throttle wait", throttleWait, 5);
 
         // let the requests go through the pipeline and the throttler will be waken up to allow more requests
         // to enter the pipeline
         resumeProcess.countDown();
-        entered.await(STALL_TIME, TimeUnit.MILLISECONDS);
 
-        metrics = MetricsUtils.currentServerMetrics();
+        // wait for more than one STALL_TIME to reduce timeout before wakeup
+        assertTrue(entered.await(STALL_TIME + 5000, TimeUnit.MILLISECONDS));
+
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
         assertEquals(TOTAL_REQUESTS, (long) metrics.get("prep_processor_request_queued"));
     }
 
@@ -221,6 +254,9 @@ public void testDropStaleRequests() throws Exception {
         resumeProcess = new CountDownLatch(1);
         submitted = new CountDownLatch(TOTAL_REQUESTS);
 
+        throttled = new CountDownLatch(1);
+        throttling = new CountDownLatch(1);
+
         // send 5 requests asynchronously
         for (int i = 0; i < TOTAL_REQUESTS; i++) {
             zk.create("/request_throttle_test- " + i, ("/request_throttle_test- "
@@ -231,11 +267,18 @@ public void testDropStaleRequests() throws Exception {
         // make sure the server received all 5 requests
         assertTrue(submitted.await(5, TimeUnit.SECONDS));
 
+        // stale throttled requests
+        assertTrue(throttling.await(5, TimeUnit.SECONDS));
         for (ServerCnxn cnxn : f.cnxns) {
             cnxn.setStale();
         }
+        throttled.countDown();
         zk = null;
 
+        // only first three requests are counted as finished
+        finished = new CountDownLatch(3);
+
+        // let the requests go through the pipeline
         resumeProcess.countDown();
         LOG.info("raise the latch");
 
@@ -243,6 +286,8 @@ public void testDropStaleRequests() throws Exception {
             Thread.sleep(50);
         }
 
+        assertTrue(finished.await(5, TimeUnit.SECONDS));
+
         // assert after all requests processed to avoid concurrent issues as metrics are
         // counted in different threads.
         Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
@@ -327,7 +372,6 @@ public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled()
             RequestThrottler.setMaxRequests(0);
             resumeProcess = new CountDownLatch(1);
             int totalRequests = 10;
-            submitted = new CountDownLatch(totalRequests);
 
             for (int i = 0; i < totalRequests; i++) {
                 zk.create("/request_throttle_test- " + i, ("/request_throttle_test- "
@@ -335,16 +379,16 @@ public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled()
                 }, null);
             }
 
-            submitted.await(5, TimeUnit.SECONDS);
-
             // We should start throttling instead of queuing more requests.
             //
             // We always allow up to GLOBAL_OUTSTANDING_LIMIT + 1 number of requests coming in request processing pipeline
             // before throttling. For the next request, we will throttle by disabling receiving future requests but we still
-            // allow this single request coming in. So the total number of queued requests in processing pipeline would
+            // allow this single request coming in. Ideally, the total number of queued requests in processing pipeline would
             // be GLOBAL_OUTSTANDING_LIMIT + 2.
-            assertEquals(Integer.parseInt(GLOBAL_OUTSTANDING_LIMIT) + 2,
-                    (long) MetricsUtils.currentServerMetrics().get("prep_processor_request_queued"));
+            //
+            // But due to leak of consistent view of number of outstanding requests, the number could be larger.
+            WaitForCondition requestQueued = () -> getCounterMetric("prep_processor_request_queued") >= Integer.parseInt(GLOBAL_OUTSTANDING_LIMIT) + 2;
+            waitFor("no enough requests queued", requestQueued, 5);
 
             resumeProcess.countDown();
         } catch (Exception e) {

From e2bc3dd1618405a67e9b412f8ef67eb84141eb76 Mon Sep 17 00:00:00 2001
From: chenhang <chenhang@apache.org>
Date: Thu, 29 Sep 2022 16:36:01 +0200
Subject: [PATCH 324/591] ZOOKEEPER-4616: Upgrade docker image to resolve CVEs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The current docker image `maven:3.6.3-jdk-8` has many critical security issues.

maven3.6.3-jdk-8 › dpkg1.19.7 has [CVE-2022-1664](https://www.cve.org/CVERecord?id=CVE-2022-1664)

maven3.6.3-jdk-8 › openssl1.1.1d-0+deb10u6 has [CVE-2021-3711](https://www.cve.org/CVERecord?id=CVE-2021-3711)

maven3.6.3-jdk-8 › gzip1.9-3 has [CVE-2022-1271](https://www.cve.org/CVERecord?id=CVE-2022-1271)

We need to upgrade the docker base image to version `maven:3.8.4-jdk-8`

See [ZOOKEEPER-4616](https://issues.apache.org/jira/browse/ZOOKEEPER-4616) for full details.

Author: chenhang <chenhang@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>

Closes #1927 from hangc0276/chenhang/ZOOKEEPER-4616
---
 dev/docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/docker/Dockerfile b/dev/docker/Dockerfile
index bd2977f7402..a1b33569e79 100644
--- a/dev/docker/Dockerfile
+++ b/dev/docker/Dockerfile
@@ -17,7 +17,7 @@
 # under the License.
 #
 
-FROM maven:3.6.3-jdk-8
+FROM maven:3.8.4-jdk-8
 
 RUN apt-get update
 RUN apt-get install -y \

From 3daefac37e8a7b456542c91adea541a938df1214 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Wed, 5 Oct 2022 17:55:54 +0200
Subject: [PATCH 325/591] ZOOKEEPER-4575: ZooKeeperServer#processPacket take
 record instead of bytes

This is the first step mentioned in [ZOOKEEPER-102](https://issues.apache.org/jira/browse/ZOOKEEPER-102) and we should not play with ByteBuffer among the request handling code path.

Author: tison <wander4096@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1905 from tisonkun/request-supplier
---
 .travis.yml                                   | 20 ++--
 .../zookeeper/DeleteContainerRequest.java     | 51 ++++++++++
 .../apache/zookeeper/audit/AuditHelper.java   | 22 ++---
 .../server/ByteBufferRequestRecord.java       | 64 ++++++++++++
 .../zookeeper/server/ContainerManager.java    |  7 +-
 .../server/FinalRequestProcessor.java         | 54 +++--------
 .../zookeeper/server/NIOServerCnxn.java       |  6 +-
 .../zookeeper/server/NettyServerCnxn.java     |  8 +-
 .../server/PrepRequestProcessor.java          | 97 +++++++------------
 .../org/apache/zookeeper/server/Request.java  | 62 +++++++-----
 .../zookeeper/server/RequestRecord.java       | 46 +++++++++
 .../zookeeper/server/SimpleRequestRecord.java | 68 +++++++++++++
 .../zookeeper/server/ZooKeeperServer.java     | 75 +++++---------
 .../zookeeper/server/quorum/Learner.java      |  4 +-
 .../server/quorum/LearnerHandler.java         |  5 +-
 .../server/quorum/LearnerSyncRequest.java     |  6 +-
 .../server/quorum/QuorumZooKeeperServer.java  | 14 ++-
 .../zookeeper/audit/Slf4JAuditLoggerTest.java |  6 +-
 .../zookeeper/server/CreateContainerTest.java | 26 +++--
 .../server/FinalRequestProcessorTest.java     | 12 +--
 .../server/MultiOpSessionUpgradeTest.java     |  4 +-
 .../PrepRequestProcessorMetricsTest.java      | 10 +-
 .../server/PrepRequestProcessorTest.java      | 27 ++----
 .../ZooKeeperCriticalThreadMetricsTest.java   |  3 +-
 .../CommitProcessorConcurrencyTest.java       |  3 +-
 .../quorum/CommitProcessorMetricsTest.java    |  6 +-
 .../server/quorum/CommitProcessorTest.java    |  5 +-
 .../server/quorum/RaceConditionTest.java      |  6 +-
 .../quorum/SessionUpgradeQuorumTest.java      |  6 +-
 .../SyncRequestProcessorMetricTest.java       |  4 +-
 .../test/LeaderSessionTrackerTest.java        |  5 +-
 31 files changed, 438 insertions(+), 294 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java

diff --git a/.travis.yml b/.travis.yml
index 81471d9ed04..7fd2dcd02ff 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,15 +5,14 @@ matrix:
     - os: linux
       arch: arm64
       jdk: openjdk11
+      install: |
+        f=$(which javac)
+        while [[ -L $f ]]; do f=$(readlink $f); done
+        export JAVA_HOME=${f%/bin/*}
+
     - os: linux
       arch: s390x
       jdk: openjdk11
-      addons:
-        apt:
-          update: true
-          packages:
-            - maven
-            - libcppunit-dev
 
 cache:
   directories:
@@ -21,13 +20,10 @@ cache:
 
 addons:
   apt:
+    update: true
     packages:
-    - libcppunit-dev
-
-install:
-  - if [ "${TRAVIS_CPU_ARCH}" == "arm64" ]; then
-     sudo apt-get install maven;
-    fi
+      - maven
+      - libcppunit-dev
 
 script: mvn clean apache-rat:check verify -DskipTests spotbugs:check checkstyle:check -Pfull-build
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java b/zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java
new file mode 100644
index 00000000000..b7fd12689d2
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import org.apache.jute.InputArchive;
+import org.apache.jute.OutputArchive;
+import org.apache.jute.Record;
+
+public class DeleteContainerRequest implements Record {
+    private String path;
+
+    public DeleteContainerRequest() {
+    }
+
+    public DeleteContainerRequest(String path) {
+        this.path = path;
+    }
+
+    public String getPath() {
+        return path;
+    }
+
+    @Override
+    public void serialize(OutputArchive archive, String tag) throws IOException {
+        archive.writeBuffer(path.getBytes(StandardCharsets.UTF_8), "path");
+    }
+
+    @Override
+    public void deserialize(InputArchive archive, String tag) throws IOException {
+        byte[] bytes = archive.readBuffer("path");
+        path = new String(bytes, StandardCharsets.UTF_8);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
index 5aca1711f7a..d6df7d92438 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
@@ -20,7 +20,6 @@
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
-import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.MultiOperationRecord;
@@ -58,7 +57,7 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
         if (!ZKAuditProvider.isAuditEnabled()) {
             return;
         }
-        String op = null;
+        String op;
         //For failed transaction rc.path is null
         String path = txnResult.path;
         String acls = null;
@@ -69,8 +68,7 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
                 case ZooDefs.OpCode.create2:
                 case ZooDefs.OpCode.createContainer:
                     op = AuditConstants.OP_CREATE;
-                    CreateRequest createRequest = new CreateRequest();
-                    deserialize(request, createRequest);
+                    CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
                     createMode = getCreateMode(createRequest);
                     if (failedTxn) {
                         path = createRequest.getPath();
@@ -80,23 +78,20 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
                 case ZooDefs.OpCode.deleteContainer:
                     op = AuditConstants.OP_DELETE;
                     if (failedTxn) {
-                        DeleteRequest deleteRequest = new DeleteRequest();
-                        deserialize(request, deleteRequest);
+                        DeleteRequest deleteRequest = request.readRequestRecord(DeleteRequest::new);
                         path = deleteRequest.getPath();
                     }
                     break;
                 case ZooDefs.OpCode.setData:
                     op = AuditConstants.OP_SETDATA;
                     if (failedTxn) {
-                        SetDataRequest setDataRequest = new SetDataRequest();
-                        deserialize(request, setDataRequest);
+                        SetDataRequest setDataRequest = request.readRequestRecord(SetDataRequest::new);
                         path = setDataRequest.getPath();
                     }
                     break;
                 case ZooDefs.OpCode.setACL:
                     op = AuditConstants.OP_SETACL;
-                    SetACLRequest setACLRequest = new SetACLRequest();
-                    deserialize(request, setACLRequest);
+                    SetACLRequest setACLRequest = request.readRequestRecord(SetACLRequest::new);
                     acls = ZKUtil.aclToString(setACLRequest.getAcl());
                     if (failedTxn) {
                         path = setACLRequest.getPath();
@@ -125,10 +120,6 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
         }
     }
 
-    private static void deserialize(Request request, Record record) throws IOException {
-        request.readRequestRecord(record);
-    }
-
     private static Result getResult(ProcessTxnResult rc, boolean failedTxn) {
         if (failedTxn) {
             return Result.FAILURE;
@@ -191,8 +182,7 @@ private static Map<String, String> getCreateModes(Request request)
         if (!ZKAuditProvider.isAuditEnabled()) {
             return createModes;
         }
-        MultiOperationRecord multiRequest = new MultiOperationRecord();
-        deserialize(request, multiRequest);
+        MultiOperationRecord multiRequest = request.readRequestRecord(MultiOperationRecord::new);
         for (Op op : multiRequest) {
             if (op.getType() == ZooDefs.OpCode.create || op.getType() == ZooDefs.OpCode.create2
                     || op.getType() == ZooDefs.OpCode.createContainer) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
new file mode 100644
index 00000000000..5ddae2460ac
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *uuuuu
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.util.function.Supplier;
+import org.apache.jute.Record;
+
+public class ByteBufferRequestRecord implements RequestRecord {
+
+    private final ByteBuffer request;
+
+    private volatile Record record;
+
+    public ByteBufferRequestRecord(ByteBuffer request) {
+        this.request = request;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    public <T extends Record> T readRecord(Supplier<T> constructor) throws IOException {
+        if (record != null) {
+            return (T) record;
+        }
+
+        record = constructor.get();
+        request.rewind();
+        ByteBufferInputStream.byteBuffer2Record(request, record);
+        request.rewind();
+        return (T) record;
+    }
+
+    @Override
+    public byte[] readBytes() {
+        request.rewind();
+        int len = request.remaining();
+        byte[] b = new byte[len];
+        request.get(b);
+        request.rewind();
+        return b;
+    }
+
+    @Override
+    public int limit() {
+        return request.limit();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 7abac587aa9..2664348c244 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -18,8 +18,6 @@
 
 package org.apache.zookeeper.server;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
-import java.nio.ByteBuffer;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.Set;
@@ -27,6 +25,7 @@
 import java.util.TimerTask;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
+import org.apache.zookeeper.DeleteContainerRequest;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.common.Time;
 import org.slf4j.Logger;
@@ -129,8 +128,8 @@ public void checkContainers() throws InterruptedException {
         for (String containerPath : getCandidates()) {
             long startMs = Time.currentElapsedTime();
 
-            ByteBuffer path = ByteBuffer.wrap(containerPath.getBytes(UTF_8));
-            Request request = new Request(null, 0, 0, ZooDefs.OpCode.deleteContainer, path, null);
+            DeleteContainerRequest record = new DeleteContainerRequest(containerPath);
+            Request request = new Request(null, 0, 0, ZooDefs.OpCode.deleteContainer, RequestRecord.fromRecord(record), null);
             try {
                 LOG.info("Attempting to delete candidate container: {}", containerPath);
                 postDeleteRequest(request);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index bc5b019f812..693a6b86e58 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -269,8 +269,7 @@ public void processRequest(Request request) {
             }
             case OpCode.multiRead: {
                 lastOp = "MLTR";
-                MultiOperationRecord multiReadRecord = new MultiOperationRecord();
-                request.readRequestRecord(multiReadRecord);
+                MultiOperationRecord multiReadRecord = request.readRequestRecord(MultiOperationRecord::new);
                 rsp = new MultiResponse();
                 OpResult subResult;
                 for (Op readOp : multiReadRecord) {
@@ -348,8 +347,7 @@ public void processRequest(Request request) {
             }
             case OpCode.sync: {
                 lastOp = "SYNC";
-                SyncRequest syncRequest = new SyncRequest();
-                request.readRequestRecord(syncRequest);
+                SyncRequest syncRequest = request.readRequestRecord(SyncRequest::new);
                 rsp = new SyncResponse(syncRequest.getPath());
                 requestPathMetricsCollector.registerRequest(request.type, syncRequest.getPath());
                 break;
@@ -363,8 +361,7 @@ public void processRequest(Request request) {
             case OpCode.exists: {
                 lastOp = "EXIS";
                 // TODO we need to figure out the security requirement for this!
-                ExistsRequest existsRequest = new ExistsRequest();
-                request.readRequestRecord(existsRequest);
+                ExistsRequest existsRequest = request.readRequestRecord(ExistsRequest::new);
                 path = existsRequest.getPath();
                 if (path.indexOf('\0') != -1) {
                     throw new KeeperException.BadArgumentsException();
@@ -376,8 +373,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getData: {
                 lastOp = "GETD";
-                GetDataRequest getDataRequest = new GetDataRequest();
-                request.readRequestRecord(getDataRequest);
+                GetDataRequest getDataRequest = request.readRequestRecord(GetDataRequest::new);
                 path = getDataRequest.getPath();
                 rsp = handleGetDataRequest(getDataRequest, cnxn, request.authInfo);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -385,8 +381,7 @@ public void processRequest(Request request) {
             }
             case OpCode.setWatches: {
                 lastOp = "SETW";
-                SetWatches setWatches = new SetWatches();
-                request.readRequestRecord(setWatches);
+                SetWatches setWatches = request.readRequestRecord(SetWatches::new);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase()
                    .setWatches(
@@ -401,8 +396,7 @@ public void processRequest(Request request) {
             }
             case OpCode.setWatches2: {
                 lastOp = "STW2";
-                SetWatches2 setWatches = new SetWatches2();
-                request.readRequestRecord(setWatches);
+                SetWatches2 setWatches = request.readRequestRecord(SetWatches2::new);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase().setWatches(relativeZxid,
                         setWatches.getDataWatches(),
@@ -415,16 +409,14 @@ public void processRequest(Request request) {
             }
             case OpCode.addWatch: {
                 lastOp = "ADDW";
-                AddWatchRequest addWatcherRequest = new AddWatchRequest();
-                request.readRequestRecord(addWatcherRequest);
+                AddWatchRequest addWatcherRequest = request.readRequestRecord(AddWatchRequest::new);
                 zks.getZKDatabase().addWatch(addWatcherRequest.getPath(), cnxn, addWatcherRequest.getMode());
                 rsp = new ErrorResponse(0);
                 break;
             }
             case OpCode.getACL: {
                 lastOp = "GETA";
-                GetACLRequest getACLRequest = new GetACLRequest();
-                request.readRequestRecord(getACLRequest);
+                GetACLRequest getACLRequest = request.readRequestRecord(GetACLRequest::new);
                 path = getACLRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
                 if (n == null) {
@@ -466,8 +458,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getChildren: {
                 lastOp = "GETC";
-                GetChildrenRequest getChildrenRequest = new GetChildrenRequest();
-                request.readRequestRecord(getChildrenRequest);
+                GetChildrenRequest getChildrenRequest = request.readRequestRecord(GetChildrenRequest::new);
                 path = getChildrenRequest.getPath();
                 rsp = handleGetChildrenRequest(getChildrenRequest, cnxn, request.authInfo);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -475,8 +466,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getAllChildrenNumber: {
                 lastOp = "GETACN";
-                GetAllChildrenNumberRequest getAllChildrenNumberRequest = new GetAllChildrenNumberRequest();
-                request.readRequestRecord(getAllChildrenNumberRequest);
+                GetAllChildrenNumberRequest getAllChildrenNumberRequest = request.readRequestRecord(GetAllChildrenNumberRequest::new);
                 path = getAllChildrenNumberRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
                 if (n == null) {
@@ -495,8 +485,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getChildren2: {
                 lastOp = "GETC";
-                GetChildren2Request getChildren2Request = new GetChildren2Request();
-                request.readRequestRecord(getChildren2Request);
+                GetChildren2Request getChildren2Request = request.readRequestRecord(GetChildren2Request::new);
                 Stat stat = new Stat();
                 path = getChildren2Request.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
@@ -517,8 +506,7 @@ public void processRequest(Request request) {
             }
             case OpCode.checkWatches: {
                 lastOp = "CHKW";
-                CheckWatchesRequest checkWatches = new CheckWatchesRequest();
-                request.readRequestRecord(checkWatches);
+                CheckWatchesRequest checkWatches = request.readRequestRecord(CheckWatchesRequest::new);
                 WatcherType type = WatcherType.fromInt(checkWatches.getType());
                 path = checkWatches.getPath();
                 boolean containsWatcher = zks.getZKDatabase().containsWatcher(path, type, cnxn);
@@ -531,8 +519,7 @@ public void processRequest(Request request) {
             }
             case OpCode.removeWatches: {
                 lastOp = "REMW";
-                RemoveWatchesRequest removeWatches = new RemoveWatchesRequest();
-                request.readRequestRecord(removeWatches);
+                RemoveWatchesRequest removeWatches = request.readRequestRecord(RemoveWatchesRequest::new);
                 WatcherType type = WatcherType.fromInt(removeWatches.getType());
                 path = removeWatches.getPath();
                 boolean removed = zks.getZKDatabase().removeWatch(path, type, cnxn);
@@ -550,8 +537,7 @@ public void processRequest(Request request) {
              }
             case OpCode.getEphemerals: {
                 lastOp = "GETE";
-                GetEphemeralsRequest getEphemerals = new GetEphemeralsRequest();
-                request.readRequestRecord(getEphemerals);
+                GetEphemeralsRequest getEphemerals = request.readRequestRecord(GetEphemeralsRequest::new);
                 String prefixPath = getEphemerals.getPrefixPath();
                 Set<String> allEphems = zks.getZKDatabase().getDataTree().getEphemerals(request.sessionId);
                 List<String> ephemerals = new ArrayList<>();
@@ -585,16 +571,8 @@ public void processRequest(Request request) {
             // log at error level as we are returning a marshalling
             // error to the user
             LOG.error("Failed to process {}", request, e);
-            StringBuilder sb = new StringBuilder();
-            byte[] payload = request.readRequestBytes();
-            if (payload != null) {
-                for (byte b : payload) {
-                    sb.append(String.format("%02x", (0xff & b)));
-                }
-            } else {
-                sb.append("request buffer is null");
-            }
-            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), sb);
+            String digest = request.requestDigest();
+            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), digest);
             err = Code.MARSHALLINGERROR;
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 83e7491e51b..5ffc81da1c3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -42,6 +42,7 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.proto.WatcherEvent;
 import org.apache.zookeeper.server.NIOServerCnxnFactory.SelectorThread;
 import org.apache.zookeeper.server.command.CommandExecutor;
@@ -392,7 +393,10 @@ void doIO(SelectionKey k) throws InterruptedException {
     }
 
     protected void readRequest() throws IOException {
-        zkServer.processPacket(this, incomingBuffer);
+        RequestHeader h = new RequestHeader();
+        ByteBufferInputStream.byteBuffer2Record(incomingBuffer, h);
+        RequestRecord request = RequestRecord.fromBytes(incomingBuffer.slice());
+        zkServer.processPacket(this, h, request);
     }
 
     // returns whether we are interested in writing, which is determined
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index ae482ce2b5e..f95200d560b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -47,6 +47,7 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.proto.WatcherEvent;
 import org.apache.zookeeper.server.command.CommandExecutor;
 import org.apache.zookeeper.server.command.FourLetterCommands;
@@ -478,9 +479,10 @@ private void receiveMessage(ByteBuf message) {
                             throw new IOException("ZK down");
                         }
                         if (initialized) {
-                            // TODO: if zks.processPacket() is changed to take a ByteBuffer[],
-                            // we could implement zero-copy queueing.
-                            zks.processPacket(this, bb);
+                            RequestHeader h = new RequestHeader();
+                            ByteBufferInputStream.byteBuffer2Record(bb, h);
+                            RequestRecord request = RequestRecord.fromBytes(bb.slice());
+                            zks.processPacket(this, h, request);
                         } else {
                             LOG.debug("got conn req request from {}", getRemoteSocketAddress());
                             BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(bb));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 9733a48aca1..35293359fe7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.StringReader;
@@ -36,6 +35,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.DeleteContainerRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.BadArgumentsException;
 import org.apache.zookeeper.KeeperException.Code;
@@ -101,7 +101,7 @@ public class PrepRequestProcessor extends ZooKeeperCriticalThread implements Req
      */
     private static boolean failCreate = false;
 
-    LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<>();
 
     private final RequestProcessor nextProcessor;
     private final boolean digestEnabled;
@@ -311,13 +311,8 @@ private String validatePathForCreate(String path, long sessionId) throws BadArgu
     /**
      * This method will be called inside the ProcessRequestThread, which is a
      * singleton, so there will be a single thread calling this code.
-     *
-     * @param type
-     * @param zxid
-     * @param request
-     * @param record
      */
-    protected void pRequest2Txn(int type, long zxid, Request request, Record record, boolean deserialize) throws KeeperException, IOException, RequestProcessorException {
+    protected void pRequest2Txn(int type, long zxid, Request request, Record record) throws KeeperException, IOException, RequestProcessorException {
         if (request.getHdr() == null) {
             request.setHdr(new TxnHeader(request.sessionId, request.cxid, zxid,
                     Time.currentWallTime(), type));
@@ -328,11 +323,12 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.create2:
         case OpCode.createTTL:
         case OpCode.createContainer: {
-            pRequest2TxnCreate(type, request, record, deserialize);
+            pRequest2TxnCreate(type, request, record);
             break;
         }
         case OpCode.deleteContainer: {
-            String path = new String(request.readRequestBytes(), UTF_8);
+            DeleteContainerRequest txn = (DeleteContainerRequest) record;
+            String path = txn.getPath();
             String parentPath = getParentPathAndValidate(path);
             ChangeRecord nodeRecord = getRecordForPath(path);
             if (nodeRecord.childCount > 0) {
@@ -359,9 +355,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.delete:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             DeleteRequest deleteRequest = (DeleteRequest) record;
-            if (deserialize) {
-                request.readRequestRecord(deleteRequest);
-            }
             String path = deleteRequest.getPath();
             String parentPath = getParentPathAndValidate(path);
             ChangeRecord parentRecord = getRecordForPath(parentPath);
@@ -387,9 +380,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.setData:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             SetDataRequest setDataRequest = (SetDataRequest) record;
-            if (deserialize) {
-                request.readRequestRecord(setDataRequest);
-            }
             path = setDataRequest.getPath();
             validatePath(path, request.sessionId);
             nodeRecord = getRecordForPath(path);
@@ -559,9 +549,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.setACL:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             SetACLRequest setAclRequest = (SetACLRequest) record;
-            if (deserialize) {
-                request.readRequestRecord(setAclRequest);
-            }
             path = setAclRequest.getPath();
             validatePath(path, request.sessionId);
             List<ACL> listACL = fixupACL(path, request.authInfo, setAclRequest.getAcl());
@@ -577,8 +564,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             addChangeRecord(nodeRecord);
             break;
         case OpCode.createSession:
-            CreateSessionTxn createSessionTxn = new CreateSessionTxn();
-            request.readRequestRecord(createSessionTxn);
+            CreateSessionTxn createSessionTxn = request.readRequestRecord(CreateSessionTxn::new);
             request.setTxn(createSessionTxn);
             // only add the global session tracker but not to ZKDb
             zks.sessionTracker.trackSession(request.sessionId, createSessionTxn.getTimeOut());
@@ -630,9 +616,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.check:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             CheckVersionRequest checkVersionRequest = (CheckVersionRequest) record;
-            if (deserialize) {
-                request.readRequestRecord(checkVersionRequest);
-            }
             path = checkVersionRequest.getPath();
             validatePath(path, request.sessionId);
             nodeRecord = getRecordForPath(path);
@@ -653,11 +636,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         }
     }
 
-    private void pRequest2TxnCreate(int type, Request request, Record record, boolean deserialize) throws IOException, KeeperException {
-        if (deserialize) {
-            request.readRequestRecord(record);
-        }
-
+    private void pRequest2TxnCreate(int type, Request request, Record record) throws IOException, KeeperException {
         int flags;
         String path;
         List<ACL> acl;
@@ -792,39 +771,41 @@ private void pRequestHelper(Request request) {
             case OpCode.createContainer:
             case OpCode.create:
             case OpCode.create2:
-                CreateRequest create2Request = new CreateRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, create2Request, true);
+                CreateRequest create2Request = request.readRequestRecord(CreateRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, create2Request);
                 break;
             case OpCode.createTTL:
-                CreateTTLRequest createTtlRequest = new CreateTTLRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, createTtlRequest, true);
+                CreateTTLRequest createTtlRequest = request.readRequestRecord(CreateTTLRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, createTtlRequest);
                 break;
             case OpCode.deleteContainer:
+                DeleteContainerRequest deleteContainerRequest = request.readRequestRecord(DeleteContainerRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, deleteContainerRequest);
+                break;
             case OpCode.delete:
-                DeleteRequest deleteRequest = new DeleteRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, deleteRequest, true);
+                DeleteRequest deleteRequest = request.readRequestRecord(DeleteRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, deleteRequest);
                 break;
             case OpCode.setData:
-                SetDataRequest setDataRequest = new SetDataRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, setDataRequest, true);
+                SetDataRequest setDataRequest = request.readRequestRecord(SetDataRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, setDataRequest);
                 break;
             case OpCode.reconfig:
-                ReconfigRequest reconfigRequest = new ReconfigRequest();
-                request.readRequestRecord(reconfigRequest);
-                pRequest2Txn(request.type, zks.getNextZxid(), request, reconfigRequest, true);
+                ReconfigRequest reconfigRequest = request.readRequestRecord(ReconfigRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, reconfigRequest);
                 break;
             case OpCode.setACL:
-                SetACLRequest setAclRequest = new SetACLRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, setAclRequest, true);
+                SetACLRequest setAclRequest = request.readRequestRecord(SetACLRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, setAclRequest);
                 break;
             case OpCode.check:
-                CheckVersionRequest checkRequest = new CheckVersionRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, checkRequest, true);
+                CheckVersionRequest checkRequest = request.readRequestRecord(CheckVersionRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, checkRequest);
                 break;
             case OpCode.multi:
-                MultiOperationRecord multiRequest = new MultiOperationRecord();
+                MultiOperationRecord multiRequest;
                 try {
-                    request.readRequestRecord(multiRequest);
+                    multiRequest = request.readRequestRecord(MultiOperationRecord::new);
                 } catch (IOException e) {
                     request.setHdr(new TxnHeader(request.sessionId, request.cxid, zks.getNextZxid(), Time.currentWallTime(), OpCode.multi));
                     throw e;
@@ -854,7 +835,7 @@ private void pRequestHelper(Request request) {
                     } else {
                         /* Prep the request and convert to a Txn */
                         try {
-                            pRequest2Txn(op.getType(), zxid, request, subrequest, false);
+                            pRequest2Txn(op.getType(), zxid, request, subrequest);
                             type = op.getType();
                             txn = request.getTxn();
                         } catch (KeeperException e) {
@@ -899,7 +880,7 @@ private void pRequestHelper(Request request) {
             case OpCode.createSession:
             case OpCode.closeSession:
                 if (!request.isLocalSession()) {
-                    pRequest2Txn(request.type, zks.getNextZxid(), request, null, true);
+                    pRequest2Txn(request.type, zks.getNextZxid(), request, null);
                 }
                 break;
 
@@ -944,20 +925,14 @@ private void pRequestHelper(Request request) {
             // log at error level as we are returning a marshalling
             // error to the user
             LOG.error("Failed to process {}", request, e);
-            StringBuilder sb = new StringBuilder();
-            byte[] payload = request.readRequestBytes();
-            if (payload != null) {
-                for (byte b : payload) {
-                    sb.append(String.format("%02x", (0xff & b)));
-                }
-            } else {
-                sb.append("request buffer is null");
-            }
-            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), sb);
-            if (request.getHdr() != null) {
-                request.getHdr().setType(OpCode.error);
-                request.setTxn(new ErrorTxn(Code.MARSHALLINGERROR.intValue()));
+            String digest = request.requestDigest();
+            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), digest);
+            if (request.getHdr() == null) {
+                request.setHdr(new TxnHeader(request.sessionId, request.cxid, zks.getZxid(), Time.currentWallTime(), request.type));
             }
+
+            request.getHdr().setType(OpCode.error);
+            request.setTxn(new ErrorTxn(Code.MARSHALLINGERROR.intValue()));
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 1aee6aee24f..86a50fc5516 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -22,6 +22,7 @@
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.List;
+import java.util.function.Supplier;
 import org.apache.jute.Record;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.OpCode;
@@ -52,12 +53,12 @@ public class Request {
     // associated session timeout. Disabled by default.
     private static volatile boolean staleLatencyCheck = Boolean.parseBoolean(System.getProperty("zookeeper.request_stale_latency_check", "false"));
 
-    public Request(ServerCnxn cnxn, long sessionId, int xid, int type, ByteBuffer bb, List<Id> authInfo) {
+    public Request(ServerCnxn cnxn, long sessionId, int xid, int type, RequestRecord request, List<Id> authInfo) {
         this.cnxn = cnxn;
         this.sessionId = sessionId;
         this.cxid = xid;
         this.type = type;
-        this.request = bb;
+        this.request = request;
         this.authInfo = authInfo;
     }
 
@@ -79,30 +80,42 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
 
     public final int type;
 
-    private final ByteBuffer request;
+    private final RequestRecord request;
 
-    public void readRequestRecord(Record record) throws IOException {
+    public <T extends Record> T readRequestRecord(Supplier<T> constructor) throws IOException {
         if (request != null) {
-            request.rewind();
-            ByteBufferInputStream.byteBuffer2Record(request, record);
-            request.rewind();
-            return;
+            return request.readRecord(constructor);
         }
         throw new IOException(new NullPointerException("request"));
     }
 
+    public <T extends Record> T readRequestRecordNoException(Supplier<T> constructor) {
+        try {
+            return readRequestRecord(constructor);
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
     public byte[] readRequestBytes() {
         if (request != null) {
-            request.rewind();
-            int len = request.remaining();
-            byte[] b = new byte[len];
-            request.get(b);
-            request.rewind();
-            return b;
+            return request.readBytes();
         }
         return null;
     }
 
+    public String requestDigest() {
+        if (request != null) {
+            final StringBuilder sb = new StringBuilder();
+            final byte[] payload = request.readBytes();
+            for (byte b : payload) {
+                sb.append(String.format("%02x", (0xff & b)));
+            }
+            return sb.toString();
+        }
+        return "request buffer is null";
+    }
+
     public final ServerCnxn cnxn;
 
     private TxnHeader hdr;
@@ -423,18 +436,19 @@ public String toString() {
             && type != OpCode.setWatches
             && type != OpCode.setWatches2
             && type != OpCode.closeSession
-            && request != null
-            && request.remaining() >= 4) {
+            && request != null) {
             try {
                 // make sure we don't mess with request itself
-                ByteBuffer rbuf = request.asReadOnlyBuffer();
-                rbuf.clear();
-                int pathLen = rbuf.getInt();
-                // sanity check
-                if (pathLen >= 0 && pathLen < 4096 && rbuf.remaining() >= pathLen) {
-                    byte[] b = new byte[pathLen];
-                    rbuf.get(b);
-                    path = new String(b, UTF_8);
+                byte[] bytes = request.readBytes();
+                if (bytes != null && bytes.length >= 4) {
+                    ByteBuffer buf = ByteBuffer.wrap(bytes);
+                    int pathLen = buf.getInt();
+                    // sanity check
+                    if (pathLen >= 0 && pathLen < 4096 && buf.remaining() >= pathLen) {
+                        byte[] b = new byte[pathLen];
+                        buf.get(b);
+                        path = new String(b, UTF_8);
+                    }
                 }
             } catch (Exception e) {
                 // ignore - can't find the path, will output "n/a" instead
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
new file mode 100644
index 00000000000..6265f168e4e
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *uuuuu
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.util.function.Supplier;
+import org.apache.jute.Record;
+
+public interface RequestRecord {
+
+    static RequestRecord fromBytes(ByteBuffer buffer) {
+        return new ByteBufferRequestRecord(buffer);
+    }
+
+    static RequestRecord fromBytes(byte[] bytes) {
+        return fromBytes(ByteBuffer.wrap(bytes));
+    }
+
+    static RequestRecord fromRecord(Record record) {
+        return new SimpleRequestRecord(record);
+    }
+
+    <T extends Record> T readRecord(Supplier<T> clazz) throws IOException;
+
+    byte[] readBytes();
+
+    int limit();
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
new file mode 100644
index 00000000000..a1c78ddad6a
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *uuuuu
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.ByteBuffer;
+import java.util.function.Supplier;
+import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.Record;
+
+public class SimpleRequestRecord implements RequestRecord {
+
+    private final Record record;
+
+    private volatile byte[] bytes;
+
+    public SimpleRequestRecord(Record record) {
+        this.record = record;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    public <T extends Record> T readRecord(Supplier<T> constructor) {
+        return (T) record;
+    }
+
+    @SuppressFBWarnings("EI_EXPOSE_REP")
+    @Override
+    public byte[] readBytes() {
+        if (bytes != null) {
+            return bytes;
+        }
+
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
+            record.serialize(boa, "request");
+            bytes = baos.toByteArray();
+            return bytes;
+        } catch (IOException e) {
+            throw new UncheckedIOException(e);
+        }
+    }
+
+    @Override
+    public int limit() {
+        byte[] bytes = readBytes();
+        return ByteBuffer.wrap(bytes).limit();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 817e84b3e59..f6c2b93ebf5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -22,7 +22,6 @@
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
-import java.io.InputStream;
 import java.io.PrintWriter;
 import java.nio.ByteBuffer;
 import java.util.ArrayDeque;
@@ -39,7 +38,6 @@
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.BiConsumer;
 import javax.security.sasl.SaslException;
-import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.Environment;
@@ -276,7 +274,7 @@ protected enum State {
     }
 
     // Connection throttling
-    private BlueThrottle connThrottle = new BlueThrottle();
+    private final BlueThrottle connThrottle = new BlueThrottle();
 
     @SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification =
         "Internally the throttler has a BlockingQueue so "
@@ -290,17 +288,17 @@ protected enum State {
      * too many large requests such that the JVM runs out of usable heap and
      * ultimately crashes.
      *
-     * The limit is enforced by the {@link checkRequestSize(int, boolean)}
+     * The limit is enforced by the {@link #checkRequestSizeWhenReceivingMessage(int)}
      * method which is called by the connection layer ({@link NIOServerCnxn},
      * {@link NettyServerCnxn}) before allocating a byte buffer and pulling
      * data off the TCP socket. The limit is then checked again by the
-     * ZooKeeper server in {@link processPacket(ServerCnxn, ByteBuffer)} which
-     * also atomically updates {@link currentLargeRequestBytes}. The request is
+     * ZooKeeper server in {@link #processPacket(ServerCnxn, RequestHeader, RequestRecord)} which
+     * also atomically updates {@link #currentLargeRequestBytes}. The request is
      * then marked as a large request, with the request size stored in the Request
-     * object so that it can later be decremented from {@link currentLargeRequestsBytes}.
+     * object so that it can later be decremented from {@link #currentLargeRequestBytes}.
      *
      * When a request is completed or dropped, the relevant code path calls the
-     * {@link requestFinished(Request)} method which performs the decrement if
+     * {@link #requestFinished(Request)} method which performs the decrement if
      * needed.
      */
     private volatile int largeRequestMaxBytes = 100 * 1024 * 1024;
@@ -313,7 +311,7 @@ protected enum State {
 
     private final AtomicInteger currentLargeRequestBytes = new AtomicInteger(0);
 
-    private AuthenticationHelper authHelper;
+    private final AuthenticationHelper authHelper = new AuthenticationHelper();
 
     void removeCnxn(ServerCnxn cnxn) {
         zkDb.removeCnxn(cnxn);
@@ -329,7 +327,6 @@ public ZooKeeperServer() {
         listener = new ZooKeeperServerListenerImpl(this);
         serverStats = new ServerStats(this);
         this.requestPathMetricsCollector = new RequestPathMetricsCollector();
-        this.authHelper = new AuthenticationHelper();
     }
 
     /**
@@ -371,8 +368,6 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
 
         this.initLargeRequestThrottlingSettings();
 
-        this.authHelper = new AuthenticationHelper();
-
         LOG.info(
             "Created server with"
                 + " tickTime {} ms"
@@ -1015,10 +1010,9 @@ long createSession(ServerCnxn cnxn, byte[] passwd, int timeout) {
         long sessionId = sessionTracker.createSession(timeout);
         Random r = new Random(sessionId ^ superSecret);
         r.nextBytes(passwd);
-        ByteBuffer to = ByteBuffer.allocate(4);
-        to.putInt(timeout);
+        CreateSessionTxn txn = new CreateSessionTxn(timeout);
         cnxn.setSessionId(sessionId);
-        Request si = new Request(cnxn, sessionId, 0, OpCode.createSession, to, null);
+        Request si = new Request(cnxn, sessionId, 0, OpCode.createSession, RequestRecord.fromRecord(txn), null);
         submitRequest(si);
         return sessionId;
     }
@@ -1595,13 +1589,7 @@ public void requestFinished(Request request) {
         }
     }
 
-    public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOException {
-        // We have the request, now process and setup for next
-        InputStream bais = new ByteBufferInputStream(incomingBuffer);
-        BinaryInputArchive bia = BinaryInputArchive.getArchive(bais);
-        RequestHeader h = new RequestHeader();
-        h.deserialize(bia, "header");
-
+    public void processPacket(ServerCnxn cnxn, RequestHeader h, RequestRecord request) throws IOException {
         // Need to increase the outstanding request count first, otherwise
         // there might be a race condition that it enabled recv after
         // processing request and then disabled when check throttling.
@@ -1613,14 +1601,9 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
         // in cnxn, since it will close the cnxn anyway.
         cnxn.incrOutstandingAndCheckThrottle(h);
 
-        // Through the magic of byte buffers, txn will not be
-        // pointing
-        // to the start of the txn
-        incomingBuffer = incomingBuffer.slice();
         if (h.getType() == OpCode.auth) {
             LOG.info("got auth packet {}", cnxn.getRemoteSocketAddress());
-            AuthPacket authPacket = new AuthPacket();
-            ByteBufferInputStream.byteBuffer2Record(incomingBuffer, authPacket);
+            AuthPacket authPacket = request.readRecord(AuthPacket::new);
             String scheme = authPacket.getScheme();
             ServerAuthenticationProvider ap = ProviderRegistry.getServerProvider(scheme);
             Code authReturn = KeeperException.Code.AUTHFAILED;
@@ -1660,15 +1643,15 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
             }
             return;
         } else if (h.getType() == OpCode.sasl) {
-            processSasl(incomingBuffer, cnxn, h);
+            processSasl(request, cnxn, h);
         } else {
             if (!authHelper.enforceAuthentication(cnxn, h.getXid())) {
                 // Authentication enforcement is failed
                 // Already sent response to user about failure and closed the session, lets return
                 return;
             } else {
-                Request si = new Request(cnxn, cnxn.getSessionId(), h.getXid(), h.getType(), incomingBuffer, cnxn.getAuthInfo());
-                int length = incomingBuffer.limit();
+                Request si = new Request(cnxn, cnxn.getSessionId(), h.getXid(), h.getType(), request, cnxn.getAuthInfo());
+                int length = request.limit();
                 if (isLargeRequest(length)) {
                     // checkRequestSize will throw IOException if request is rejected
                     checkRequestSizeWhenMessageReceived(length);
@@ -1706,10 +1689,9 @@ private static boolean shouldAllowSaslFailedClientsConnect() {
         return Boolean.getBoolean(ALLOW_SASL_FAILED_CLIENTS);
     }
 
-    private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHeader requestHeader) throws IOException {
+    private void processSasl(RequestRecord request, ServerCnxn cnxn, RequestHeader requestHeader) throws IOException {
         LOG.debug("Responding to client SASL token.");
-        GetSASLRequest clientTokenRecord = new GetSASLRequest();
-        ByteBufferInputStream.byteBuffer2Record(incomingBuffer, clientTokenRecord);
+        GetSASLRequest clientTokenRecord = request.readRecord(GetSASLRequest::new);
         byte[] clientToken = clientTokenRecord.getToken();
         LOG.debug("Size of client SASL token: {}", clientToken.length);
         byte[] responseToken = null;
@@ -2180,8 +2162,8 @@ private String effectiveACLPath(Request request) throws KeeperException.BadArgum
         switch (request.type) {
         case OpCode.create:
         case OpCode.create2: {
-            CreateRequest req = new CreateRequest();
-            if (readRequestRecord(request, req)) {
+            CreateRequest req = request.readRequestRecordNoException(CreateRequest::new);
+            if (req != null) {
                 mustCheckACL = true;
                 acl = req.getAcl();
                 path = parentPath(req.getPath());
@@ -2189,22 +2171,22 @@ private String effectiveACLPath(Request request) throws KeeperException.BadArgum
             break;
         }
         case OpCode.delete: {
-            DeleteRequest req = new DeleteRequest();
-            if (readRequestRecord(request, req)) {
+            DeleteRequest req = request.readRequestRecordNoException(DeleteRequest::new);
+            if (req != null) {
                 path = parentPath(req.getPath());
             }
             break;
         }
         case OpCode.setData: {
-            SetDataRequest req = new SetDataRequest();
-            if (readRequestRecord(request, req)) {
+            SetDataRequest req = request.readRequestRecordNoException(SetDataRequest::new);
+            if (req != null) {
                 path = req.getPath();
             }
             break;
         }
         case OpCode.setACL: {
-            SetACLRequest req = new SetACLRequest();
-            if (readRequestRecord(request, req)) {
+            SetACLRequest req = request.readRequestRecordNoException(SetACLRequest::new);
+            if (req != null) {
                 mustCheckACL = true;
                 acl = req.getAcl();
                 path = req.getPath();
@@ -2298,15 +2280,6 @@ public boolean authWriteRequest(Request request) {
         return err == KeeperException.Code.OK.intValue();
     }
 
-    private boolean readRequestRecord(Request request, Record record) {
-        try {
-            request.readRequestRecord(record);
-            return true;
-        } catch (IOException ex) {
-            return false;
-        }
-    }
-
     public int getOutstandingHandshakeNum() {
         if (serverCnxnFactory instanceof NettyServerCnxnFactory) {
             return ((NettyServerCnxnFactory) serverCnxnFactory).getOutstandingHandshakeNum();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index b6eeb758ac9..1818bf9bb95 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -804,9 +804,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     continue;
                 }
                 packetsCommitted.remove();
-                Request request = new Request(null, p.hdr.getClientId(), p.hdr.getCxid(), p.hdr.getType(), null, null);
-                request.setTxn(p.rec);
-                request.setHdr(p.hdr);
+                Request request = new Request(p.hdr.getClientId(), p.hdr.getCxid(), p.hdr.getType(), p.hdr, p.rec, -1);
                 request.setTxnDigest(p.digest);
                 ozk.commitRequest(request);
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 259d9fff915..eea11d33a2c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -43,6 +43,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.TxnLogProposalIterator;
 import org.apache.zookeeper.server.ZKDatabase;
@@ -702,9 +703,9 @@ public void run() {
                     bb = bb.slice();
                     Request si;
                     if (type == OpCode.sync) {
-                        si = new LearnerSyncRequest(this, sessionId, cxid, type, bb, qp.getAuthinfo());
+                        si = new LearnerSyncRequest(this, sessionId, cxid, type, RequestRecord.fromBytes(bb), qp.getAuthinfo());
                     } else {
-                        si = new Request(null, sessionId, cxid, type, bb, qp.getAuthinfo());
+                        si = new Request(null, sessionId, cxid, type, RequestRecord.fromBytes(bb), qp.getAuthinfo());
                     }
                     si.setOwner(this);
                     learnerMaster.submitLearnerRequest(si);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java
index d4c83aeab7b..6892d3dd8a7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import java.nio.ByteBuffer;
 import java.util.List;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 
 public class LearnerSyncRequest extends Request {
 
     LearnerHandler fh;
     public LearnerSyncRequest(
-        LearnerHandler fh, long sessionId, int xid, int type, ByteBuffer bb, List<Id> authInfo) {
-        super(null, sessionId, xid, type, bb, authInfo);
+        LearnerHandler fh, long sessionId, int xid, int type, RequestRecord request, List<Id> authInfo) {
+        super(null, sessionId, xid, type, request, authInfo);
         this.fh = fh;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
index 2f24347b778..240936956fc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
@@ -20,7 +20,6 @@
 
 import java.io.IOException;
 import java.io.PrintWriter;
-import java.nio.ByteBuffer;
 import java.util.Objects;
 import java.util.function.BiConsumer;
 import java.util.stream.Collectors;
@@ -32,10 +31,12 @@
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.txn.CreateSessionTxn;
 
 /**
  * Abstract base class for all ZooKeeperServers that participate in
@@ -76,8 +77,7 @@ public Request checkUpgradeSession(Request request) throws IOException, KeeperEx
         }
 
         if (OpCode.multi == request.type) {
-            MultiOperationRecord multiTransactionRecord = new MultiOperationRecord();
-            request.readRequestRecord(multiTransactionRecord);
+            MultiOperationRecord multiTransactionRecord = request.readRequestRecord(MultiOperationRecord::new);
             boolean containsEphemeralCreate = false;
             for (Op op : multiTransactionRecord) {
                 if (op.getType() == OpCode.create || op.getType() == OpCode.create2) {
@@ -93,8 +93,7 @@ public Request checkUpgradeSession(Request request) throws IOException, KeeperEx
                 return null;
             }
         } else {
-            CreateRequest createRequest = new CreateRequest();
-            request.readRequestRecord(createRequest);
+            CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
             CreateMode createMode = CreateMode.fromFlag(createRequest.getFlags());
             if (!createMode.isEphemeral()) {
                 return null;
@@ -116,9 +115,8 @@ private Request makeUpgradeRequest(long sessionId) {
         synchronized (upgradeableSessionTracker) {
             if (upgradeableSessionTracker.isLocalSession(sessionId)) {
                 int timeout = upgradeableSessionTracker.upgradeSession(sessionId);
-                ByteBuffer to = ByteBuffer.allocate(4);
-                to.putInt(timeout);
-                return new Request(null, sessionId, 0, OpCode.createSession, to, null);
+                CreateSessionTxn txn = new CreateSessionTxn(timeout);
+                return new Request(null, sessionId, 0, OpCode.createSession, RequestRecord.fromRecord(txn), null);
             }
         }
         return null;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
index df3b831a30d..8a700bbdf4f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
@@ -39,9 +39,9 @@
 import org.apache.zookeeper.audit.AuditEvent.Result;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
-import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
 import org.apache.zookeeper.test.LoggerTestTool;
@@ -290,9 +290,7 @@ private String getSession() {
 
     private String getUser() {
         ServerCnxn next = getServerCnxn();
-        Request request = new Request(next, -1, -1, -1, null,
-                next.getAuthInfo());
-        return request.getUsersForAudit();
+        return AuthUtil.getUsers(next.getAuthInfo());
     }
 
     private String getIp() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
index f9fd6d8b588..0e6c1b58f92 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
@@ -19,10 +19,12 @@
 package org.apache.zookeeper.server;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
@@ -36,6 +38,7 @@
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.DeleteContainerRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.ZooDefs;
@@ -91,7 +94,7 @@ public void testCreateWithStat() throws KeeperException, InterruptedException {
         Stat stat = createWithStatVerifyResult("/foo");
         Stat childStat = createWithStatVerifyResult("/foo/child");
         // Don't expect to get the same stats for different creates.
-        assertFalse(stat.equals(childStat));
+        assertNotEquals(stat, childStat);
     }
 
     @SuppressWarnings("ConstantConditions")
@@ -224,7 +227,11 @@ public void testMaxPerMinute() throws InterruptedException {
         RequestProcessor processor = new RequestProcessor() {
             @Override
             public void processRequest(Request request) {
-                queue.add(new String(request.readRequestBytes()));
+                try {
+                    queue.add(request.readRequestRecord(DeleteContainerRequest::new).getPath());
+                } catch (IOException e) {
+                    fail(e);
+                }
             }
 
             @Override
@@ -246,14 +253,13 @@ protected Collection<String> getCandidates() {
             containerManager.checkContainers();
             return null;
         });
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/one");
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/two");
-        assertEquals(queue.size(), 0);
+        assertEquals("/one", queue.poll(5, TimeUnit.SECONDS));
+        assertEquals("/two", queue.poll(5, TimeUnit.SECONDS));
+        assertEquals(0, queue.size());
         Thread.sleep(500);
-        assertEquals(queue.size(), 0);
-
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/three");
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/four");
+        assertEquals(0, queue.size());
+        assertEquals("/three", queue.poll(5, TimeUnit.SECONDS));
+        assertEquals("/four", queue.poll(5, TimeUnit.SECONDS));
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
index 0181d2ebeae..4b47d6cbb3c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
@@ -96,7 +96,7 @@ public void testACLDigestHashHiding_NoAuth_WorldCanRead() {
         // Arrange
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, new ArrayList<Id>());
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), new ArrayList<Id>());
         processor.processRequest(r);
 
         // Assert
@@ -109,7 +109,7 @@ public void testACLDigestHashHiding_NoAuth_NoWorld() {
         testACLs.remove(2);
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, new ArrayList<Id>());
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), new ArrayList<Id>());
         processor.processRequest(r);
 
         // Assert
@@ -123,7 +123,7 @@ public void testACLDigestHashHiding_UserCanRead() {
         authInfo.add(new Id("digest", "otheruser:somesecrethash"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
@@ -137,7 +137,7 @@ public void testACLDigestHashHiding_UserCanAll() {
         authInfo.add(new Id("digest", "user:secrethash"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
@@ -151,7 +151,7 @@ public void testACLDigestHashHiding_AdminUser() {
         authInfo.add(new Id("digest", "adminuser:adminsecret"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
@@ -167,7 +167,7 @@ public void testACLDigestHashHiding_OnlyAdmin() {
         authInfo.add(new Id("digest", "adminuser:adminsecret"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
index 001e2363548..6826910103c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
@@ -117,7 +117,7 @@ private Request makeGetDataRequest(String path, long sessionId) throws IOExcepti
         GetDataRequest getDataRequest = new GetDataRequest(path, false);
         getDataRequest.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, 1, ZooDefs.OpCode.getData, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, 1, ZooDefs.OpCode.getData, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
     private Request makeCreateRequest(String path, long sessionId) throws IOException {
@@ -126,7 +126,7 @@ private Request makeCreateRequest(String path, long sessionId) throws IOExceptio
         CreateRequest createRequest = new CreateRequest(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL.toFlag());
         createRequest.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
     private QuorumZooKeeperServer getConnectedServer(long sessionId) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
index 062cae1f9db..bfb0db5f3fb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
@@ -29,15 +29,12 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.when;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.WatchedEvent;
@@ -94,12 +91,7 @@ public void tearDown() throws Exception {
     }
 
     private Request createRequest(Record record, int opCode) throws IOException {
-        // encoding
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-        record.serialize(boa, "request");
-        baos.close();
-        return new Request(null, 1L, 0, opCode, ByteBuffer.wrap(baos.toByteArray()), null);
+        return new Request(null, 1L, 0, opCode, RequestRecord.fromRecord(record), null);
     }
 
     private Request createRequest(String path, int opCode) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index 9e71205697d..d80c5e08ed2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -24,11 +24,8 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.IOException;
 import java.io.PrintWriter;
-import java.nio.ByteBuffer;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -37,7 +34,6 @@
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -66,13 +62,10 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 
 public class PrepRequestProcessorTest extends ClientBase {
 
-    private static final Logger LOG = LoggerFactory.getLogger(PrepRequestProcessorTest.class);
     private static final int CONNECTION_TIMEOUT = 3000;
     private static String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
     private CountDownLatch pLatch;
@@ -120,34 +113,28 @@ public void teardown() throws Exception {
     public void testPRequest() throws Exception {
         pLatch = new CountDownLatch(1);
         processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
-        Request foo = new Request(null, 1L, 1, OpCode.create, ByteBuffer.allocate(3), null);
+        Request foo = new Request(null, 1L, 1, OpCode.create, RequestRecord.fromBytes(new byte[3]), null);
         processor.pRequest(foo);
 
         assertEquals(new ErrorTxn(KeeperException.Code.MARSHALLINGERROR.intValue()), outcome.getTxn(), "Request should have marshalling error");
         assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
     }
 
-    private Request createRequest(Record record, int opCode) throws IOException {
+    private Request createRequest(Record record, int opCode) {
         return createRequest(record, opCode, 1L);
     }
 
-    private Request createRequest(Record record, int opCode, long sessionId) throws IOException {
+    private Request createRequest(Record record, int opCode, long sessionId) {
         return createRequest(record, opCode, sessionId, false);
     }
 
-    private Request createRequest(Record record, int opCode, boolean admin) throws IOException {
+    private Request createRequest(Record record, int opCode, boolean admin) {
         return createRequest(record, opCode, 1L, admin);
     }
 
-    private Request createRequest(Record record, int opCode, long sessionId, boolean admin) throws IOException {
-        // encoding
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-        record.serialize(boa, "request");
-        baos.close();
-        // Id
-        List<Id> ids = Arrays.asList(admin ? new Id("super", "super user") : Ids.ANYONE_ID_UNSAFE);
-        return new Request(null, sessionId, 0, opCode, ByteBuffer.wrap(baos.toByteArray()), ids);
+    private Request createRequest(Record record, int opCode, long sessionId, boolean admin) {
+        List<Id> ids = Collections.singletonList(admin ? new Id("super", "super user") : Ids.ANYONE_ID_UNSAFE);
+        return new Request(null, sessionId, 0, opCode, RequestRecord.fromRecord(record), ids);
     }
 
     private void process(List<Op> ops) throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
index 16c7a7dd1c8..681e8348b07 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
@@ -19,7 +19,6 @@
 package org.apache.zookeeper.server;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import java.nio.ByteBuffer;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.ZKTestCase;
@@ -67,7 +66,7 @@ public void testUnrecoverableErrorCountFromRequestProcessor() throws Exception {
         PrepRequestProcessor processor = new MyPrepRequestProcessor();
         processor.start();
 
-        processor.processRequest(new Request(null, 1L, 1, ZooDefs.OpCode.setData, ByteBuffer.wrap(new byte[10]), null));
+        processor.processRequest(new Request(null, 1L, 1, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null));
         processed.await();
 
         processor.shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
index 1050a474bc0..e5f668d1f3e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
@@ -43,6 +43,7 @@
 import org.apache.zookeeper.proto.SetDataRequest;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.WorkerService;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
 import org.junit.jupiter.api.AfterEach;
@@ -129,7 +130,7 @@ private Request newRequest(Record rec, int type, int sessionId, int xid) throws
         BinaryOutputArchive boa = BinaryOutputArchive.getArchive(boas);
         rec.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, xid, type, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, xid, type, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
index 4b67f5b50bb..4a45983555a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
@@ -22,7 +22,6 @@
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import java.nio.ByteBuffer;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -31,6 +30,7 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.WorkerService;
 import org.junit.jupiter.api.AfterEach;
@@ -192,11 +192,11 @@ private void checkTimeMetric(long actual, long lBoundrary, long hBoundrary) {
     }
 
     private Request createReadRequest(long sessionId, int xid) {
-        return new Request(null, sessionId, xid, ZooDefs.OpCode.getData, ByteBuffer.wrap(new byte[10]), null);
+        return new Request(null, sessionId, xid, ZooDefs.OpCode.getData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
     private Request createWriteRequest(long sessionId, int xid) {
-        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, ByteBuffer.wrap(new byte[10]), null);
+        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
     private void processRequestWithWait(Request request) throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
index 46958d1949c..46a4c387479 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
@@ -42,6 +42,7 @@
 import org.apache.zookeeper.server.PrepRequestProcessor;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterEach;
@@ -160,7 +161,7 @@ public void sendWriteRequest() throws Exception {
                                                         + (++nodeId), new byte[0], Ids.OPEN_ACL_UNSAFE, 1);
             createReq.serialize(boa, "request");
             ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-            Request req = new Request(null, sessionId, ++cxid, OpCode.create, bb, new ArrayList<Id>());
+            Request req = new Request(null, sessionId, ++cxid, OpCode.create, RequestRecord.fromBytes(bb), new ArrayList<Id>());
             zks.getFirstProcessor().processRequest(req);
 
         }
@@ -174,7 +175,7 @@ public void sendReadRequest() throws Exception {
                                                                + nodeId, false);
             getDataRequest.serialize(boa, "request");
             ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-            Request req = new Request(null, sessionId, ++cxid, OpCode.getData, bb, new ArrayList<Id>());
+            Request req = new Request(null, sessionId, ++cxid, OpCode.getData, RequestRecord.fromBytes(bb), new ArrayList<Id>());
             zks.getFirstProcessor().processRequest(req);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
index ef1f1219452..5216eb70324 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
@@ -23,7 +23,6 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.SocketException;
-import java.nio.ByteBuffer;
 import javax.security.sasl.SaslException;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
@@ -32,11 +31,13 @@
 import org.apache.zookeeper.server.PrepRequestProcessor;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.txn.DeleteTxn;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
@@ -220,7 +221,8 @@ public void shutdown() {
              * Add a request so that something is there for SyncRequestProcessor
              * to process, while we are in shutdown flow
              */
-            Request request = new Request(null, 0, 0, ZooDefs.OpCode.delete, ByteBuffer.wrap("/deadLockIssue".getBytes()), null);
+            DeleteTxn deleteTxn = new DeleteTxn("/deadLockIssue");
+            Request request = new Request(null, 0, 0, ZooDefs.OpCode.delete, RequestRecord.fromRecord(deleteTxn), null);
             processRequest(request);
             super.shutdown();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
index 8803a73cbab..3d60c8b9174 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
@@ -40,6 +40,7 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterEach;
@@ -317,8 +318,7 @@ protected void request(Request request) throws IOException {
                             }
 
                             if (request.type == ZooDefs.OpCode.create && request.cnxn != null) {
-                                CreateRequest createRequest = new CreateRequest();
-                                request.readRequestRecord(createRequest);
+                                CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
                                 try {
                                     CreateMode createMode = CreateMode.fromFlag(createRequest.getFlags());
                                     if (createMode.isEphemeral()) {
@@ -355,7 +355,7 @@ private Request createEphemeralRequest(String path, long sessionId) throws IOExc
         CreateRequest createRequest = new CreateRequest(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL.toFlag());
         createRequest.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
index 72bceafa371..17ccdae6ea6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
@@ -26,7 +26,6 @@
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import java.nio.ByteBuffer;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -34,6 +33,7 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
@@ -65,7 +65,7 @@ public void setup() throws Exception {
     }
 
     private Request createRquest(long sessionId, int xid) {
-        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, ByteBuffer.wrap(new byte[10]), null);
+        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
index 99cd171c01f..a619866d91c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
@@ -33,6 +33,7 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -100,7 +101,7 @@ public void testCreateEphemeral(boolean localSessionEnabled) throws Exception {
 
         LOG.info("Fake session Id: {}", Long.toHexString(fakeSessionId));
 
-        Request request = new Request(null, fakeSessionId, 0, OpCode.create, bb, new ArrayList<Id>());
+        Request request = new Request(null, fakeSessionId, 0, OpCode.create, RequestRecord.fromBytes(bb), new ArrayList<Id>());
 
         // Submit request directly to leader
         leader.getActiveServer().submitRequest(request);
@@ -138,7 +139,7 @@ public void testCreatePersistent() throws Exception {
 
         LOG.info("Local session Id: {}", Long.toHexString(locallSession));
 
-        Request request = new Request(null, locallSession, 0, OpCode.create, bb, new ArrayList<Id>());
+        Request request = new Request(null, locallSession, 0, OpCode.create, RequestRecord.fromBytes(bb), new ArrayList<Id>());
 
         // Submit request directly to leader
         leader.getActiveServer().submitRequest(request);

From 90f813ea38a85ff2715662bad75f9bb6387fe4a6 Mon Sep 17 00:00:00 2001
From: Mike Drob <mdrob@apple.com>
Date: Tue, 11 Oct 2022 22:23:12 +0200
Subject: [PATCH 326/591] ZOOKEEPER-4303: Allow configuring client port to 0

https://issues.apache.org/jira/browse/ZOOKEEPER-4303

Allows specifying an explicit port 0 for the client port or secure client port, which will default to operating system behavior of finding an unbound port. Modified ZKServerEmbedded to report the actual port instead of the configured port.

Author: Mike Drob <mdrob@apple.com>

Reviewers: Kezhu Wang <kezhuw@gmail.com>, Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1868 from madrob/zookeeper-4303
---
 .../server/NIOServerCnxnFactory.java          |  4 +++
 .../zookeeper/server/ZooKeeperServerMain.java | 17 ++++++++++
 .../embedded/ZooKeeperServerEmbeddedImpl.java | 30 ++++++++++-------
 .../zookeeper/server/quorum/QuorumPeer.java   |  7 ++++
 .../server/quorum/QuorumPeerConfig.java       |  8 ++---
 .../embedded/ZookeeperServerEmbeddedTest.java | 32 +++++++++++++++++++
 6 files changed, 83 insertions(+), 15 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index 57495c10aa4..f081ab24bad 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -663,6 +663,10 @@ public void configure(InetSocketAddress addr, int maxcc, int backlog, boolean se
         } else {
             ss.socket().bind(addr, listenBacklog);
         }
+        if (addr.getPort() == 0) {
+            // We're likely bound to a different port than was requested, so log that too
+            LOG.info("bound to port {}", ss.getLocalAddress());
+        }
         ss.configureBlocking(false);
         acceptThread = new AcceptThread(ss, addr, selectorThreads);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index 7bd30baa6e9..d6cbbe4a1ee 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -244,6 +244,23 @@ ServerCnxnFactory getSecureCnxnFactory() {
         return secureCnxnFactory;
     }
 
+    // VisibleForTesting
+    public int getClientPort() {
+        if (cnxnFactory != null) {
+            return cnxnFactory.getLocalPort();
+        }
+        return 0;
+    }
+
+    // VisibleForTesting
+    public int getSecureClientPort() {
+        if (secureCnxnFactory != null) {
+            return secureCnxnFactory.getLocalPort();
+        }
+        return 0;
+    }
+
+
     /**
      * Shutdowns properly the service, this method is not a public API.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
index ec6ae637a0c..ad41a3228e7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -1,6 +1,7 @@
 package org.apache.zookeeper.server.embedded;
 
 import java.io.OutputStream;
+import java.net.InetSocketAddress;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Map;
@@ -45,6 +46,9 @@ class ZooKeeperServerEmbeddedImpl implements ZooKeeperServerEmbedded {
     private final ExitHandler exitHandler;
     private volatile boolean stopping;
 
+    private int boundClientPort;
+    private int boundSecureClientPort;
+
     ZooKeeperServerEmbeddedImpl(Properties p, Path baseDir, ExitHandler exitHandler) throws Exception {
         if (!p.containsKey("dataDir")) {
             p.put("dataDir", baseDir.resolve("data").toAbsolutePath().toString());
@@ -103,6 +107,8 @@ protected QuorumPeer getQuorumPeer() throws SaslException {
                         @Override
                         public void start() {
                             super.start();
+                            boundClientPort = getClientPort();
+                            boundSecureClientPort = getSecureClientPort();
                             LOG.info("ZK Server {} started", this);
                             started.complete(null);
                         }
@@ -142,6 +148,8 @@ public void run() {
                 @Override
                 public void serverStarted() {
                     LOG.info("ZK Server started");
+                    boundClientPort = getClientPort();
+                    boundSecureClientPort = getSecureClientPort();
                     started.complete(null);
                 }
             };
@@ -184,22 +192,22 @@ public void run() {
 
     @Override
     public String getConnectionString() {
-        if (config.getClientPortAddress() != null) {
-            String raw = config.getClientPortAddress().getHostString() + ":" + config.getClientPortAddress().getPort();
-            return raw.replace("0.0.0.0", "localhost");
-        } else {
-            throw new IllegalStateException("No client address is configured");
-        }
+        return prettifyConnectionString(config.getClientPortAddress(), boundClientPort);
     }
 
     @Override
     public String getSecureConnectionString() {
-        if (config.getSecureClientPortAddress() != null) {
-            String raw = config.getSecureClientPortAddress().getHostString() + ":" + config.getSecureClientPortAddress().getPort();
-            return raw.replace("0.0.0.0", "localhost");
-        } else {
-            throw new IllegalStateException("No client address is configured");
+        return prettifyConnectionString(config.getSecureClientPortAddress(), boundSecureClientPort);
+    }
+
+    private String prettifyConnectionString(InetSocketAddress confAddress, int boundPort) {
+        if (confAddress != null) {
+            return confAddress.getHostString()
+                .replace("0.0.0.0", "localhost")
+                .replace("0:0:0:0:0:0:0:0", "localhost")
+                + ":" + boundPort;
         }
+        throw new IllegalStateException("No client address is configured");
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 18e97bb2f0c..220d813f42b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -2139,6 +2139,13 @@ public int getClientPort() {
         return -1;
     }
 
+    public int getSecureClientPort() {
+        if (secureCnxnFactory != null) {
+            return secureCnxnFactory.getLocalPort();
+        }
+        return -1;
+    }
+
     public void setTxnFactory(FileTxnSnapLog factory) {
         this.logFactory = factory;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index 1b37f291f51..d478c409c8f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -271,8 +271,8 @@ public static String getVersionFromFilename(String filename) {
      * @throws ConfigException
      */
     public void parseProperties(Properties zkProp) throws IOException, ConfigException {
-        int clientPort = 0;
-        int secureClientPort = 0;
+        Integer clientPort = null;
+        Integer secureClientPort = null;
         int observerMasterPort = 0;
         String clientPortAddress = null;
         String secureClientPortAddress = null;
@@ -427,7 +427,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             dataLogDir = dataDir;
         }
 
-        if (clientPort == 0) {
+        if (clientPort == null) {
             LOG.info("clientPort is not set");
             if (clientPortAddress != null) {
                 throw new IllegalArgumentException("clientPortAddress is set but clientPort is not set");
@@ -440,7 +440,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             LOG.info("clientPortAddress is {}", formatInetAddr(this.clientPortAddress));
         }
 
-        if (secureClientPort == 0) {
+        if (secureClientPort == null) {
             LOG.info("secureClientPort is not set");
             if (secureClientPortAddress != null) {
                 throw new IllegalArgumentException("secureClientPortAddress is set but secureClientPort is not set");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
index d9868b235df..00bfced0cd4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
@@ -17,12 +17,17 @@
  */
 package org.apache.zookeeper.server.embedded;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.endsWith;
+import static org.hamcrest.Matchers.not;
+import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.util.Properties;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.test.ClientBase;
+import org.junit.function.ThrowingRunnable;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
@@ -95,4 +100,31 @@ public void testStart() throws Exception {
 
     }
 
+    @Test
+    public void testBindPortZero() throws Exception {
+        final Properties configZookeeper = new Properties();
+        final ZooKeeperServerEmbedded.ZookKeeperServerEmbeddedBuilder builder = ZooKeeperServerEmbedded.builder()
+            .baseDir(baseDir)
+            .configuration(configZookeeper)
+            .exitHandler(ExitHandler.LOG_ONLY);
+
+        // Unconfigured client port will still fail
+        try (ZooKeeperServerEmbedded zkServer = builder.build()) {
+            zkServer.start();
+            assertThrows(IllegalStateException.class, new ThrowingRunnable() {
+                @Override
+                public void run() throws Throwable {
+                    zkServer.getConnectionString();
+                }
+            });
+        }
+
+        // Explicit port zero should work
+        configZookeeper.put("clientPort", "0");
+        try (ZooKeeperServerEmbedded zkServer = builder.build()) {
+            zkServer.start();
+            assertThat(zkServer.getConnectionString(), not(endsWith(":0")));
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+        }
+    }
 }

From d3879db1ed019892373683694663b05ade0db6fe Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Wed, 2 Nov 2022 05:26:12 +0000
Subject: [PATCH 327/591] ZOOKEEPER-4460: QuorumPeer overrides Thread.getId
 with different semantics.

---
 .../zookeeper/server/admin/Commands.java      |  2 +-
 .../server/quorum/AckRequestProcessor.java    |  2 +-
 .../server/quorum/FastLeaderElection.java     | 28 ++++++++--------
 .../zookeeper/server/quorum/Leader.java       | 32 +++++++++----------
 .../server/quorum/LeaderZooKeeperServer.java  |  4 +--
 .../zookeeper/server/quorum/Learner.java      |  2 +-
 .../server/quorum/LearnerZooKeeperServer.java |  4 +--
 .../server/quorum/LocalPeerBean.java          |  6 ++--
 .../zookeeper/server/quorum/QuorumBean.java   |  2 +-
 .../server/quorum/QuorumCnxManager.java       | 26 +++++++--------
 .../zookeeper/server/quorum/QuorumPeer.java   | 28 ++++++++--------
 .../quorum/ReadOnlyZooKeeperServer.java       |  4 +--
 .../server/PrepRequestProcessorTest.java      |  2 +-
 .../server/quorum/CnxManagerTest.java         | 12 +++----
 .../quorum/FuzzySnapshotRelatedTest.java      |  2 +-
 .../server/quorum/LeaderBeanTest.java         |  2 +-
 .../server/quorum/LeaderWithObserverTest.java |  6 ++--
 .../server/quorum/LocalPeerBeanTest.java      |  4 +--
 .../server/quorum/QuorumBeanTest.java         |  2 +-
 .../zookeeper/server/quorum/Zab1_0Test.java   |  2 +-
 .../org/apache/zookeeper/test/FLETest.java    | 16 +++++-----
 .../zookeeper/test/FLEZeroWeightTest.java     |  2 +-
 .../zookeeper/test/ObserverMasterTest.java    |  4 +--
 .../org/apache/zookeeper/test/QuorumTest.java |  4 +--
 24 files changed, 99 insertions(+), 99 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 705c6cc3645..236c7ec2452 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -827,7 +827,7 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
                 QuorumPeer.ZabState zabState = peer.getZabState();
                 QuorumVerifier qv = peer.getQuorumVerifier();
 
-                QuorumPeer.QuorumServer voter = qv.getVotingMembers().get(peer.getId());
+                QuorumPeer.QuorumServer voter = qv.getVotingMembers().get(peer.getMyId());
                 boolean voting = (
                         voter != null
                                 && voter.addr.equals(peer.getQuorumAddress())
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java
index 32eb8a8186b..f277dcdf3ff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java
@@ -44,7 +44,7 @@ public void processRequest(Request request) {
         QuorumPeer self = leader.self;
         if (self != null) {
             request.logLatency(ServerMetrics.getMetrics().PROPOSAL_ACK_CREATION_LATENCY);
-            leader.processAck(self.getId(), request.zxid, null);
+            leader.processAck(self.getMyId(), request.zxid, null);
         } else {
             LOG.error("Null QuorumPeer");
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 654ed1cef09..91207d110f4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -307,7 +307,7 @@ public void run() {
                                         QuorumVerifier curQV = self.getQuorumVerifier();
                                         if (rqv.getVersion() > curQV.getVersion()) {
                                             LOG.info("{} Received version: {} my version: {}",
-                                                     self.getId(),
+                                                     self.getMyId(),
                                                      Long.toHexString(rqv.getVersion()),
                                                      Long.toHexString(self.getQuorumVerifier().getVersion()));
                                             if (self.getPeerState() == ServerState.LOOKING) {
@@ -356,7 +356,7 @@ public void run() {
                             sendqueue.offer(notmsg);
                         } else {
                             // Receive new message
-                            LOG.debug("Receive new notification message. My id = {}", self.getId());
+                            LOG.debug("Receive new notification message. My id = {}", self.getMyId());
 
                             // State of peer that sent this message
                             QuorumPeer.ServerState ackstate = QuorumPeer.ServerState.LOOKING;
@@ -446,7 +446,7 @@ public void run() {
 
                                     LOG.debug(
                                         "Sending new notification. My id ={} recipient={} zxid=0x{} leader={} config version = {}",
-                                        self.getId(),
+                                        self.getMyId(),
                                         response.sid,
                                         Long.toHexString(current.getZxid()),
                                         current.getId(),
@@ -535,12 +535,12 @@ void process(ToSend m) {
 
             this.ws = new WorkerSender(manager);
 
-            this.wsThread = new Thread(this.ws, "WorkerSender[myid=" + self.getId() + "]");
+            this.wsThread = new Thread(this.ws, "WorkerSender[myid=" + self.getMyId() + "]");
             this.wsThread.setDaemon(true);
 
             this.wr = new WorkerReceiver(manager);
 
-            this.wrThread = new Thread(this.wr, "WorkerReceiver[myid=" + self.getId() + "]");
+            this.wrThread = new Thread(this.wr, "WorkerReceiver[myid=" + self.getMyId() + "]");
             this.wrThread.setDaemon(true);
         }
 
@@ -663,7 +663,7 @@ private void leaveInstance(Vote v) {
             "About to leave FLE instance: leader={}, zxid=0x{}, my id={}, my state={}",
             v.getId(),
             Long.toHexString(v.getZxid()),
-            self.getId(),
+            self.getMyId(),
             self.getPeerState());
         recvqueue.clear();
     }
@@ -708,7 +708,7 @@ private void sendNotifications() {
                 Long.toHexString(proposedZxid),
                 Long.toHexString(logicalclock.get()),
                 sid,
-                self.getId(),
+                self.getMyId(),
                 Long.toHexString(proposedEpoch));
 
             sendqueue.offer(notmsg);
@@ -800,7 +800,7 @@ protected boolean checkLeader(Map<Long, Vote> votes, long leader, long electionE
          * from leader stating that it is leading, then predicate is false.
          */
 
-        if (leader != self.getId()) {
+        if (leader != self.getMyId()) {
             if (votes.get(leader) == null) {
                 predicate = false;
             } else if (votes.get(leader).getState() != ServerState.LEADING) {
@@ -839,10 +839,10 @@ public synchronized Vote getVote() {
      */
     private ServerState learningState() {
         if (self.getLearnerType() == LearnerType.PARTICIPANT) {
-            LOG.debug("I am a participant: {}", self.getId());
+            LOG.debug("I am a participant: {}", self.getMyId());
             return ServerState.FOLLOWING;
         } else {
-            LOG.debug("I am an observer: {}", self.getId());
+            LOG.debug("I am an observer: {}", self.getMyId());
             return ServerState.OBSERVING;
         }
     }
@@ -853,8 +853,8 @@ private ServerState learningState() {
      * @return long
      */
     private long getInitId() {
-        if (self.getQuorumVerifier().getVotingMembers().containsKey(self.getId())) {
-            return self.getId();
+        if (self.getQuorumVerifier().getVotingMembers().containsKey(self.getMyId())) {
+            return self.getMyId();
         } else {
             return Long.MIN_VALUE;
         }
@@ -897,7 +897,7 @@ private long getPeerEpoch() {
      * the leadingVoteSet if it becomes the leader.
      */
     private void setPeerState(long proposedLeader, SyncedLearnerTracker voteSet) {
-        ServerState ss = (proposedLeader == self.getId()) ? ServerState.LEADING : learningState();
+        ServerState ss = (proposedLeader == self.getMyId()) ? ServerState.LEADING : learningState();
         self.setPeerState(ss);
         if (ss == ServerState.LEADING) {
             leadingVoteSet = voteSet;
@@ -945,7 +945,7 @@ public Vote lookForLeader() throws InterruptedException {
 
             LOG.info(
                 "New election. My id = {}, proposed zxid=0x{}",
-                self.getId(),
+                self.getMyId(),
                 Long.toHexString(proposedZxid));
             sendNotifications();
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index ce8f7999c45..aebde052452 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -271,8 +271,8 @@ boolean isLearnerSynced(LearnerHandler peer) {
      */
     public boolean isQuorumSynced(QuorumVerifier qv) {
         HashSet<Long> ids = new HashSet<Long>();
-        if (qv.getVotingMembers().containsKey(self.getId())) {
-            ids.add(self.getId());
+        if (qv.getVotingMembers().containsKey(self.getMyId())) {
+            ids.add(self.getMyId());
         }
         synchronized (forwardingFollowers) {
             for (LearnerHandler learnerHandler : forwardingFollowers) {
@@ -603,7 +603,7 @@ void lead() throws IOException, InterruptedException {
             cnxAcceptor = new LearnerCnxAcceptor();
             cnxAcceptor.start();
 
-            long epoch = getEpochToPropose(self.getId(), self.getAcceptedEpoch());
+            long epoch = getEpochToPropose(self.getMyId(), self.getAcceptedEpoch());
 
             zk.setZxid(ZxidUtils.makeZxid(epoch, 0));
 
@@ -658,13 +658,13 @@ void lead() throws IOException, InterruptedException {
             // us. We do this by waiting for the NEWLEADER packet to get
             // acknowledged
 
-            waitForEpochAck(self.getId(), leaderStateSummary);
+            waitForEpochAck(self.getMyId(), leaderStateSummary);
             self.setCurrentEpoch(epoch);
-            self.setLeaderAddressAndId(self.getQuorumAddress(), self.getId());
+            self.setLeaderAddressAndId(self.getQuorumAddress(), self.getMyId());
             self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
 
             try {
-                waitForNewLeaderAck(self.getId(), zk.getZxid());
+                waitForNewLeaderAck(self.getMyId(), zk.getZxid());
             } catch (InterruptedException e) {
                 shutdown("Waiting for a quorum of followers, only synced with sids: [ "
                          + newLeaderProposal.ackSetsToString()
@@ -746,7 +746,7 @@ void lead() throws IOException, InterruptedException {
                         syncedAckSet.addQuorumVerifier(self.getLastSeenQuorumVerifier());
                     }
 
-                    syncedAckSet.addAck(self.getId());
+                    syncedAckSet.addAck(self.getMyId());
 
                     for (LearnerHandler f : getLearners()) {
                         if (f.synced()) {
@@ -870,15 +870,15 @@ private long getDesignatedLeader(Proposal reconfigProposal, long zxid) {
 
         //check if I'm in the new configuration with the same quorum address -
         // if so, I'll remain the leader
-        if (newQVAcksetPair.getQuorumVerifier().getVotingMembers().containsKey(self.getId())
-            && newQVAcksetPair.getQuorumVerifier().getVotingMembers().get(self.getId()).addr.equals(self.getQuorumAddress())) {
-            return self.getId();
+        if (newQVAcksetPair.getQuorumVerifier().getVotingMembers().containsKey(self.getMyId())
+            && newQVAcksetPair.getQuorumVerifier().getVotingMembers().get(self.getMyId()).addr.equals(self.getQuorumAddress())) {
+            return self.getMyId();
         }
         // start with an initial set of candidates that are voters from new config that
         // acknowledged the reconfig op (there must be a quorum). Choose one of them as
         // current leader candidate
         HashSet<Long> candidates = new HashSet<Long>(newQVAcksetPair.getAckset());
-        candidates.remove(self.getId()); // if we're here, I shouldn't be the leader
+        candidates.remove(self.getMyId()); // if we're here, I shouldn't be the leader
         long curCandidate = candidates.iterator().next();
 
         //go over outstanding ops in order, and try to find a candidate that acked the most ops.
@@ -960,7 +960,7 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
 
             self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
 
-            if (designatedLeader != self.getId()) {
+            if (designatedLeader != self.getMyId()) {
                 LOG.info(String.format("Committing a reconfiguration (reconfigEnabled=%s); this leader is not the designated "
                         + "leader anymore, setting allowedToCommit=false", self.isReconfigEnabled()));
                 allowedToCommit = false;
@@ -1424,13 +1424,13 @@ public long getEpochToPropose(long sid, long lastAcceptedEpoch) throws Interrupt
                 connectingFollowers.add(sid);
             }
             QuorumVerifier verifier = self.getQuorumVerifier();
-            if (connectingFollowers.contains(self.getId()) && verifier.containsQuorum(connectingFollowers)) {
+            if (connectingFollowers.contains(self.getMyId()) && verifier.containsQuorum(connectingFollowers)) {
                 waitingForNewEpoch = false;
                 self.setAcceptedEpoch(epoch);
                 connectingFollowers.notifyAll();
             } else {
                 long start = Time.currentElapsedTime();
-                if (sid == self.getId()) {
+                if (sid == self.getMyId()) {
                     timeStartWaitForEpoch = start;
                 }
                 long cur = start;
@@ -1476,7 +1476,7 @@ public void waitForEpochAck(long id, StateSummary ss) throws IOException, Interr
                 }
             }
             QuorumVerifier verifier = self.getQuorumVerifier();
-            if (electingFollowers.contains(self.getId()) && verifier.containsQuorum(electingFollowers)) {
+            if (electingFollowers.contains(self.getMyId()) && verifier.containsQuorum(electingFollowers)) {
                 electionFinished = true;
                 electingFollowers.notifyAll();
             } else {
@@ -1533,7 +1533,7 @@ private synchronized void startZkServer() {
             Long designatedLeader = getDesignatedLeader(newLeaderProposal, zk.getZxid());
 
             self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
-            if (designatedLeader != self.getId()) {
+            if (designatedLeader != self.getMyId()) {
                 LOG.warn("This leader is not the designated leader, it will be initialized with allowedToCommit = false");
                 allowedToCommit = false;
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
index 5a51bc23d7e..2de080bd380 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
@@ -175,7 +175,7 @@ public void createSessionTracker() {
             this,
             getZKDatabase().getSessionWithTimeOuts(),
             tickTime,
-            self.getId(),
+            self.getMyId(),
             self.areLocalSessionsEnabled(),
             getZooKeeperServerListener());
     }
@@ -291,7 +291,7 @@ public String getState() {
      */
     @Override
     public long getServerId() {
-        return self.getId();
+        return self.getMyId();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 1818bf9bb95..0ed3b1ebe90 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -491,7 +491,7 @@ protected long registerWithLeader(int pktType) throws IOException {
         /*
          * Add sid to payload
          */
-        LearnerInfo li = new LearnerInfo(self.getId(), 0x10000, self.getQuorumVerifier().getVersion());
+        LearnerInfo li = new LearnerInfo(self.getMyId(), 0x10000, self.getQuorumVerifier().getVersion());
         ByteArrayOutputStream bsid = new ByteArrayOutputStream();
         BinaryOutputArchive boa = BinaryOutputArchive.getArchive(bsid);
         boa.writeRecord(li, "LearnerInfo");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
index cab95b05621..efd2e376208 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
@@ -71,7 +71,7 @@ protected Map<Long, Integer> getTouchSnapshot() {
      */
     @Override
     public long getServerId() {
-        return self.getId();
+        return self.getMyId();
     }
 
     @Override
@@ -80,7 +80,7 @@ public void createSessionTracker() {
             this,
             getZKDatabase().getSessionWithTimeOuts(),
             this.tickTime,
-            self.getId(),
+            self.getMyId(),
             self.areLocalSessionsEnabled(),
             getZooKeeperServerListener());
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java
index f5d0dbedaf9..f1649ff93e2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java
@@ -35,7 +35,7 @@ public LocalPeerBean(QuorumPeer peer) {
     }
 
     public String getName() {
-        return "replica." + peer.getId();
+        return "replica." + peer.getMyId();
     }
 
     public boolean isHidden() {
@@ -119,12 +119,12 @@ public String getQuorumSystemInfo() {
 
     @Override
     public boolean isPartOfEnsemble() {
-        return peer.getView().containsKey(peer.getId());
+        return peer.getView().containsKey(peer.getMyId());
     }
 
     @Override
     public boolean isLeader() {
-        return peer.isLeader(peer.getId());
+        return peer.isLeader(peer.getMyId());
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java
index aae4552f498..46db6865b8a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java
@@ -28,7 +28,7 @@ public class QuorumBean implements QuorumMXBean, ZKMBeanInfo {
 
     public QuorumBean(QuorumPeer peer) {
         this.peer = peer;
-        name = "ReplicatedServer_id" + peer.getId();
+        name = "ReplicatedServer_id" + peer.getMyId();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 9d9f8bd86a0..eb5346af4bf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -466,7 +466,7 @@ public void run() {
     private boolean startConnection(Socket sock, Long sid) throws IOException {
         DataOutputStream dout = null;
         DataInputStream din = null;
-        LOG.debug("startConnection (myId:{} --> sid:{})", self.getId(), sid);
+        LOG.debug("startConnection (myId:{} --> sid:{})", self.getMyId(), sid);
         try {
             // Use BufferedOutputStream to reduce the number of IP packets. This is
             // important for x-DC scenarios.
@@ -481,7 +481,7 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
             // understand the protocol version we use to avoid multiple partitions. see ZOOKEEPER-3720
             long protocolVersion = self.isMultiAddressEnabled() ? PROTOCOL_VERSION_V2 : PROTOCOL_VERSION_V1;
             dout.writeLong(protocolVersion);
-            dout.writeLong(self.getId());
+            dout.writeLong(self.getMyId());
 
             // now we send our election address. For the new protocol version, we can send multiple addresses.
             Collection<InetSocketAddress> addressesToSend = protocolVersion == PROTOCOL_VERSION_V2
@@ -510,12 +510,12 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
         }
 
         // If lost the challenge, then drop the new connection
-        if (sid > self.getId()) {
-            LOG.info("Have smaller server identifier, so dropping the connection: (myId:{} --> sid:{})", self.getId(), sid);
+        if (sid > self.getMyId()) {
+            LOG.info("Have smaller server identifier, so dropping the connection: (myId:{} --> sid:{})", self.getMyId(), sid);
             closeSocket(sock);
             // Otherwise proceed with the connection
         } else {
-            LOG.debug("Have larger server identifier, so keeping the connection: (myId:{} --> sid:{})", self.getId(), sid);
+            LOG.debug("Have larger server identifier, so keeping the connection: (myId:{} --> sid:{})", self.getMyId(), sid);
             SendWorker sw = new SendWorker(sock, sid);
             RecvWorker rw = new RecvWorker(sock, din, sid, sw);
             sw.setRecv(rw);
@@ -610,7 +610,7 @@ private void handleConnection(Socket sock, DataInputStream din) throws IOExcepti
                         electionAddr = new MultipleAddresses(init.electionAddr,
                                 Duration.ofMillis(self.getMultiAddressReachabilityCheckTimeoutMs()));
                     }
-                    LOG.debug("Initial message parsed by {}: {}", self.getId(), init.toString());
+                    LOG.debug("Initial message parsed by {}: {}", self.getMyId(), init.toString());
                 } catch (InitialMessage.InitialMessageException ex) {
                     LOG.error("Initial message parsing error!", ex);
                     closeSocket(sock);
@@ -635,7 +635,7 @@ private void handleConnection(Socket sock, DataInputStream din) throws IOExcepti
         // do authenticating learner
         authServer.authenticate(sock, din);
         //If wins the challenge, then close the new connection.
-        if (sid < self.getId()) {
+        if (sid < self.getMyId()) {
             /*
              * This replica might still believe that the connection to sid is
              * up, so we have to shut down the workers before trying to open a
@@ -658,7 +658,7 @@ private void handleConnection(Socket sock, DataInputStream din) throws IOExcepti
                 connectOne(sid);
             }
 
-        } else if (sid == self.getId()) {
+        } else if (sid == self.getMyId()) {
             // we saw this case in ZOOKEEPER-2164
             LOG.warn("We got a connection request from a server with our own ID. "
                      + "This should be either a configuration error, or a bug.");
@@ -760,7 +760,7 @@ synchronized void connectOne(long sid) {
             Map<Long, QuorumPeer.QuorumServer> lastProposedView = lastSeenQV.getAllMembers();
             if (lastCommittedView.containsKey(sid)) {
                 knownId = true;
-                LOG.debug("Server {} knows {} already, it is in the lastCommittedView", self.getId(), sid);
+                LOG.debug("Server {} knows {} already, it is in the lastCommittedView", self.getMyId(), sid);
                 if (connectOne(sid, lastCommittedView.get(sid).electionAddr)) {
                     return;
                 }
@@ -770,7 +770,7 @@ synchronized void connectOne(long sid) {
                 && (!knownId
                     || !lastProposedView.get(sid).electionAddr.equals(lastCommittedView.get(sid).electionAddr))) {
                 knownId = true;
-                LOG.debug("Server {} knows {} already, it is in the lastProposedView", self.getId(), sid);
+                LOG.debug("Server {} knows {} already, it is in the lastProposedView", self.getMyId(), sid);
 
                 if (connectOne(sid, lastProposedView.get(sid).electionAddr)) {
                     return;
@@ -839,7 +839,7 @@ public void halt() {
      */
     public void softHalt() {
         for (SendWorker sw : senderWorkerMap.values()) {
-            LOG.debug("Server {} is soft-halting sender towards: {}", self.getId(), sw);
+            LOG.debug("Server {} is soft-halting sender towards: {}", self.getMyId(), sw);
             sw.finish();
         }
     }
@@ -943,7 +943,7 @@ void setSocketBindErrorHandler(Runnable errorHandler) {
         @Override
         public void run() {
             if (!shutdown) {
-                LOG.debug("Listener thread started, myId: {}", self.getId());
+                LOG.debug("Listener thread started, myId: {}", self.getMyId());
                 Set<InetSocketAddress> addresses;
 
                 if (self.getQuorumListenOnAllIPs()) {
@@ -1297,7 +1297,7 @@ public void run() {
             }
             this.finish();
 
-            LOG.warn("Send worker leaving thread id {} my id = {}", sid, self.getId());
+            LOG.warn("Send worker leaving thread id {} my id = {}", sid, self.getMyId());
         }
 
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 220d813f42b..e7ed9af6384 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -628,7 +628,7 @@ public void setJvmPauseMonitor(JvmPauseMonitor jvmPauseMonitor) {
     /**
      * get the id of this quorum peer.
      */
-    public long getId() {
+    public long getMyId() {
         return myid;
     }
 
@@ -990,7 +990,7 @@ public void recreateSocketAddresses(long id) {
             QuorumServer qs = qv.getAllMembers().get(id);
             if (qs != null) {
                 qs.recreateSocketAddresses();
-                if (id == getId()) {
+                if (id == getMyId()) {
                     setAddrs(qs.addr, qs.electionAddr, qs.clientAddr);
                 }
             }
@@ -1418,7 +1418,7 @@ public void run() {
             MBeanRegistry.getInstance().register(jmxQuorumBean, null);
             for (QuorumServer s : getView().values()) {
                 ZKMBeanInfo p;
-                if (getId() == s.id) {
+                if (getMyId() == s.id) {
                     p = jmxLocalPeerBean = new LocalPeerBean(this);
                     try {
                         MBeanRegistry.getInstance().register(p, jmxQuorumBean);
@@ -1586,7 +1586,7 @@ private synchronized void updateServerState() {
             return;
         }
 
-        if (getId() == getCurrentVote().getId()) {
+        if (getMyId() == getCurrentVote().getId()) {
             setPeerState(ServerState.LEADING);
             LOG.debug("PeerState set to LEADING");
         } else if (getLearnerType() == LearnerType.PARTICIPANT) {
@@ -1880,7 +1880,7 @@ private void connectNewPeers(QuorumCnxManager qcm) {
         if (quorumVerifier != null && lastSeenQuorumVerifier != null) {
             Map<Long, QuorumServer> committedView = quorumVerifier.getAllMembers();
             for (Entry<Long, QuorumServer> e : lastSeenQuorumVerifier.getAllMembers().entrySet()) {
-                if (e.getKey() != getId() && !committedView.containsKey(e.getKey())) {
+                if (e.getKey() != getMyId() && !committedView.containsKey(e.getKey())) {
                     qcm.connectOne(e.getKey());
                 }
             }
@@ -1941,7 +1941,7 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
                 // and then got the same config in UPTODATE message so its already known
                 LOG.debug(
                     "{} setQuorumVerifier called with known or old config {}. Current version: {}",
-                    getId(),
+                    getMyId(),
                     qv.getVersion(),
                     quorumVerifier.getVersion());
                 return quorumVerifier;
@@ -1970,7 +1970,7 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
             if (qv.getVersion() == lastSeenQuorumVerifier.getVersion()) {
                 QuorumPeerConfig.deleteFile(getNextDynamicConfigFilename());
             }
-            QuorumServer qs = qv.getAllMembers().get(getId());
+            QuorumServer qs = qv.getAllMembers().get(getMyId());
             if (qs != null) {
                 setAddrs(qs.addr, qs.electionAddr, qs.clientAddr);
             }
@@ -1984,7 +1984,7 @@ private String makeDynamicConfigFilename(long version) {
     }
 
     private boolean needEraseClientInfoFromStaticConfig() {
-        QuorumServer server = quorumVerifier.getAllMembers().get(getId());
+        QuorumServer server = quorumVerifier.getAllMembers().get(getMyId());
         return (server != null && server.clientAddr != null && !server.isClientAddrFromStatic);
     }
 
@@ -2275,7 +2275,7 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
                 restartLeaderElection(prevQV, qv);
             }
 
-            QuorumServer myNewQS = newMembers.get(getId());
+            QuorumServer myNewQS = newMembers.get(getMyId());
             if (myNewQS != null && myNewQS.clientAddr != null && !myNewQS.clientAddr.equals(oldClientAddr)) {
                 cnxnFactory.reconfigure(myNewQS.clientAddr);
                 updateThreadName();
@@ -2315,7 +2315,7 @@ private void updateRemotePeerMXBeans(Map<Long, QuorumServer> newMembers) {
 
         Set<Long> joiningMembers = new HashSet<Long>(newMembers.keySet());
         joiningMembers.removeAll(jmxRemotePeerBean.keySet());
-        joiningMembers.remove(getId()); // remove self as it is local bean
+        joiningMembers.remove(getMyId()); // remove self as it is local bean
         for (Long id : joiningMembers) {
             QuorumServer qs = newMembers.get(id);
             RemotePeerBean rBean = new RemotePeerBean(this, qs);
@@ -2428,7 +2428,7 @@ QuorumServer validateLearnerMaster(String desiredMaster) {
 
     private boolean updateLearnerType(QuorumVerifier newQV) {
         //check if I'm an observer in new config
-        if (newQV.getObservingMembers().containsKey(getId())) {
+        if (newQV.getObservingMembers().containsKey(getMyId())) {
             if (getLearnerType() != LearnerType.OBSERVER) {
                 setLearnerType(LearnerType.OBSERVER);
                 LOG.info("Becoming an observer");
@@ -2437,7 +2437,7 @@ private boolean updateLearnerType(QuorumVerifier newQV) {
             } else {
                 return false;
             }
-        } else if (newQV.getVotingMembers().containsKey(getId())) {
+        } else if (newQV.getVotingMembers().containsKey(getMyId())) {
             if (getLearnerType() != LearnerType.PARTICIPANT) {
                 setLearnerType(LearnerType.PARTICIPANT);
                 LOG.info("Becoming a voting participant");
@@ -2521,7 +2521,7 @@ private void updateThreadName() {
                     : "disabled"
                 : "disabled";
         String secure = secureCnxnFactory != null ? formatInetAddr(secureCnxnFactory.getLocalAddress()) : "disabled";
-        setName(String.format("QuorumPeer[myid=%d](plain=%s)(secure=%s)", getId(), plain, secure));
+        setName(String.format("QuorumPeer[myid=%d](plain=%s)(secure=%s)", getMyId(), plain, secure));
     }
 
     /**
@@ -2598,7 +2598,7 @@ public QuorumCnxManager createCnxnManager() {
         LOG.info("Using {}ms as the quorum cnxn socket timeout", timeout);
         return new QuorumCnxManager(
             this,
-            this.getId(),
+            this.getMyId(),
             this.getView(),
             this.authServer,
             this.authLearner,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
index d2f6b39b69a..0efa4677053 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
@@ -88,7 +88,7 @@ public synchronized void startup() {
     public void createSessionTracker() {
         sessionTracker = new LearnerSessionTracker(
                 this, getZKDatabase().getSessionWithTimeOuts(),
-                this.tickTime, self.getId(), self.areLocalSessionsEnabled(),
+                this.tickTime, self.getMyId(), self.areLocalSessionsEnabled(),
                 getZooKeeperServerListener());
     }
 
@@ -186,7 +186,7 @@ public String getState() {
      */
     @Override
     public long getServerId() {
-        return self.getId();
+        return self.getMyId();
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index d80c5e08ed2..689b8eda9e2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -182,7 +182,7 @@ public void testReconfigWithAnotherOutstandingChange() throws Exception {
 
         QuorumPeer qp = new QuorumPeer();
         QuorumVerifier quorumVerifierMock = mock(QuorumVerifier.class);
-        when(quorumVerifierMock.getAllMembers()).thenReturn(LeaderBeanTest.getMockedPeerViews(qp.getId()));
+        when(quorumVerifierMock.getAllMembers()).thenReturn(LeaderBeanTest.getMockedPeerViews(qp.getMyId()));
 
         qp.setQuorumVerifier(quorumVerifierMock, false);
         FileTxnSnapLog snapLog = new FileTxnSnapLog(tmpDir, tmpDir);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
index e8b19dced0e..ad43d8826b0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
@@ -251,7 +251,7 @@ public void testCnxManagerSpinLock() throws Exception {
             LOG.error("Null listener when initializing cnx manager");
         }
 
-        InetSocketAddress address = peers.get(peer.getId()).electionAddr.getReachableOrOne();
+        InetSocketAddress address = peers.get(peer.getMyId()).electionAddr.getReachableOrOne();
         LOG.info("Election port: {}", address.getPort());
 
         Thread.sleep(1000);
@@ -339,7 +339,7 @@ public void testCnxManagerNPE() throws Exception {
         } else {
             LOG.error("Null listener when initializing cnx manager");
         }
-        InetSocketAddress address = peers.get(peer.getId()).electionAddr.getReachableOrOne();
+        InetSocketAddress address = peers.get(peer.getMyId()).electionAddr.getReachableOrOne();
         LOG.info("Election port: {}", address.getPort());
 
         Thread.sleep(1000);
@@ -386,7 +386,7 @@ public void testSocketTimeout() throws Exception {
         } else {
             LOG.error("Null listener when initializing cnx manager");
         }
-        InetSocketAddress address = peers.get(peer.getId()).electionAddr.getReachableOrOne();
+        InetSocketAddress address = peers.get(peer.getMyId()).electionAddr.getReachableOrOne();
         LOG.info("Election port: {}", address.getPort());
         Thread.sleep(1000);
 
@@ -503,7 +503,7 @@ public void testWorkerThreads() throws Exception {
         try {
             for (int sid = 0; sid < 3; sid++) {
                 QuorumPeer peer = new QuorumPeer(peers, peerTmpdir[sid], peerTmpdir[sid], peerClientPort[sid], 3, sid, 1000, 2, 2, 2);
-                LOG.info("Starting peer {}", peer.getId());
+                LOG.info("Starting peer {}", peer.getMyId());
                 peer.start();
                 peerList.add(sid, peer);
             }
@@ -513,14 +513,14 @@ public void testWorkerThreads() throws Exception {
                 for (int i = 0; i < 5; i++) {
                     // halt one of the listeners and verify count
                     QuorumPeer peer = peerList.get(myid);
-                    LOG.info("Round {}, halting peer {}", i, peer.getId());
+                    LOG.info("Round {}, halting peer {}", i, peer.getMyId());
                     peer.shutdown();
                     peerList.remove(myid);
                     failure = verifyThreadCount(peerList, 2);
                     assertNull(failure, failure);
                     // Restart halted node and verify count
                     peer = new QuorumPeer(peers, peerTmpdir[myid], peerTmpdir[myid], peerClientPort[myid], 3, myid, 1000, 2, 2, 2);
-                    LOG.info("Round {}, restarting peer {}", i, peer.getId());
+                    LOG.info("Round {}, restarting peer {}", i, peer.getMyId());
                     peer.start();
                     peerList.add(myid, peer);
                     failure = verifyThreadCount(peerList, 4);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
index 3dcaf5de1da..c39bc54e0fa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
@@ -533,7 +533,7 @@ public void createSessionTracker() {
                                     this,
                                     getZKDatabase().getSessionWithTimeOuts(),
                                     this.tickTime,
-                                    self.getId(),
+                                    self.getMyId(),
                                     self.areLocalSessionsEnabled(),
                                     getZooKeeperServerListener()) {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 618ffa04f69..dc537abbd4d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -76,7 +76,7 @@ public static Map<Long, QuorumServer> getMockedPeerViews(long myId) {
     public void setUp() throws IOException, X509Exception {
         qp = new QuorumPeer();
         quorumVerifierMock = mock(QuorumVerifier.class);
-        when(quorumVerifierMock.getAllMembers()).thenReturn(getMockedPeerViews(qp.getId()));
+        when(quorumVerifierMock.getAllMembers()).thenReturn(getMockedPeerViews(qp.getMyId()));
 
         qp.setQuorumVerifier(quorumVerifierMock, false);
         File tmpDir = ClientBase.createEmptyTestDir();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
index f5df549c51b..7ac563698b5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
@@ -73,7 +73,7 @@ public void testGetEpochToPropose() throws Exception {
         try {
             // Leader asks for epoch (mocking Leader.lead behavior)
             // First add to connectingFollowers
-            leader.getEpochToPropose(peer.getId(), lastAcceptedEpoch);
+            leader.getEpochToPropose(peer.getMyId(), lastAcceptedEpoch);
         } catch (InterruptedException e) {
             // ignore timeout
         }
@@ -113,7 +113,7 @@ public void testWaitForEpochAck() throws Exception {
         assertFalse(leader.electionFinished);
         try {
             // leader calls waitForEpochAck, first add to electingFollowers
-            leader.waitForEpochAck(peer.getId(), new StateSummary(0, 0));
+            leader.waitForEpochAck(peer.getMyId(), new StateSummary(0, 0));
         } catch (InterruptedException e) {
             // ignore timeout
         }
@@ -152,7 +152,7 @@ public void testWaitForNewLeaderAck() throws Exception {
         assertFalse(leader.quorumFormed);
         try {
             // leader calls waitForNewLeaderAck, first add to ackSet
-            leader.waitForNewLeaderAck(peer.getId(), zxid);
+            leader.waitForNewLeaderAck(peer.getMyId(), zxid);
         } catch (InterruptedException e) {
             // ignore timeout
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
index 6ff491a6aa9..74d4370732e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
@@ -85,7 +85,7 @@ public void testClientAddress() throws Exception {
     public void testLocalPeerIsLeader() throws Exception {
         long localPeerId = 7;
         QuorumPeer peer = mock(QuorumPeer.class);
-        when(peer.getId()).thenReturn(localPeerId);
+        when(peer.getMyId()).thenReturn(localPeerId);
         when(peer.isLeader(eq(localPeerId))).thenReturn(true);
         LocalPeerBean localPeerBean = new LocalPeerBean(peer);
         assertTrue(localPeerBean.isLeader());
@@ -95,7 +95,7 @@ public void testLocalPeerIsLeader() throws Exception {
     public void testLocalPeerIsNotLeader() throws Exception {
         long localPeerId = 7;
         QuorumPeer peer = mock(QuorumPeer.class);
-        when(peer.getId()).thenReturn(localPeerId);
+        when(peer.getMyId()).thenReturn(localPeerId);
         when(peer.isLeader(eq(localPeerId))).thenReturn(false);
         LocalPeerBean localPeerBean = new LocalPeerBean(peer);
         assertFalse(localPeerBean.isLeader());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
index 67bb673f113..62847461d16 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
@@ -29,7 +29,7 @@ public class QuorumBeanTest {
     @Test
     public void testGetNameProperty() {
         QuorumPeer qpMock = mock(QuorumPeer.class);
-        when(qpMock.getId()).thenReturn(1L);
+        when(qpMock.getMyId()).thenReturn(1L);
         QuorumBean qb = new QuorumBean(qpMock);
 
         assertThat("getName property should return Bean name in the right format", qb.getName(), equalTo("ReplicatedServer_id1"));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index 3bdbcd908dc..107ae6a72e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -162,7 +162,7 @@ public void testLeaderInConnectingFollowers() throws Exception {
             // epoch were accounted for, so the leader should not block and since it started with
             // accepted epoch = 5 it should now have 6
             try {
-                long epoch = leader.getEpochToPropose(leader.self.getId(), leader.self.getAcceptedEpoch());
+                long epoch = leader.getEpochToPropose(leader.self.getMyId(), leader.self.getAcceptedEpoch());
                 assertEquals(6, epoch, "leader got wrong epoch from getEpochToPropose");
             } catch (Exception e) {
                 fail("leader timed out in getEpochToPropose");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
index 15713e423cc..0f679b2d268 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
@@ -368,7 +368,7 @@ public VerifyState(QuorumPeer peer) {
             this.peer = peer;
         }
         public void run() {
-            setName("VerifyState-" + peer.getId());
+            setName("VerifyState-" + peer.getMyId());
             while (true) {
                 if (peer.getPeerState() == ServerState.FOLLOWING) {
                     LOG.info("I am following");
@@ -410,7 +410,7 @@ public void testJoin() throws Exception {
         // start 2 peers and verify if they form the cluster
         for (sid = 0; sid < 2; sid++) {
             peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
-            LOG.info("Starting peer {}", peer.getId());
+            LOG.info("Starting peer {}", peer.getMyId());
             peer.start();
             peerList.add(sid, peer);
         }
@@ -421,16 +421,16 @@ public void testJoin() throws Exception {
         assertFalse(!v1.isSuccess(), "Unable to form cluster in " + waitTime + " ms");
         // Start 3rd peer and check if it goes in LEADING state
         peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
-        LOG.info("Starting peer {}", peer.getId());
+        LOG.info("Starting peer {}", peer.getMyId());
         peer.start();
         peerList.add(sid, peer);
         v1 = new VerifyState(peer);
         v1.start();
         v1.join(waitTime);
         if (v1.isAlive()) {
-            fail("Peer " + peer.getId() + " failed to join the cluster " + "within " + waitTime + " ms");
+            fail("Peer " + peer.getMyId() + " failed to join the cluster " + "within " + waitTime + " ms");
         } else if (!v1.isSuccess()) {
-            fail("Incorrect LEADING state for peer " + peer.getId());
+            fail("Incorrect LEADING state for peer " + peer.getMyId());
         }
         // cleanup
         for (int id = 0; id < 3; id++) {
@@ -459,7 +459,7 @@ public void testJoinInconsistentEnsemble() throws Exception {
         // start 2 peers and verify if they form the cluster
         for (sid = 0; sid < 2; sid++) {
             peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
-            LOG.info("Starting peer {}", peer.getId());
+            LOG.info("Starting peer {}", peer.getMyId());
             peer.start();
             peerList.add(sid, peer);
         }
@@ -478,14 +478,14 @@ public void testJoinInconsistentEnsemble() throws Exception {
         peer.setCurrentVote(newVote);
         // Start 3rd peer and check if it joins the quorum
         peer = new QuorumPeer(peers, tmpdir[2], tmpdir[2], port[2], 3, 2, 2000, 2, 2, 2);
-        LOG.info("Starting peer {}", peer.getId());
+        LOG.info("Starting peer {}", peer.getMyId());
         peer.start();
         peerList.add(sid, peer);
         v1 = new VerifyState(peer);
         v1.start();
         v1.join(waitTime);
         if (v1.isAlive()) {
-            fail("Peer " + peer.getId() + " failed to join the cluster " + "within " + waitTime + " ms");
+            fail("Peer " + peer.getMyId() + " failed to join the cluster " + "within " + waitTime + " ms");
         }
         // cleanup
         for (int id = 0; id < 3; id++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
index 0fdac4556a3..59ed266f6d7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
@@ -128,7 +128,7 @@ public void run() {
                     LOG.info("Finished election: {}, {}", i, v.getId());
                     votes[i] = v;
 
-                    if ((peer.getPeerState() == ServerState.LEADING) && (peer.getId() > 2)) {
+                    if ((peer.getPeerState() == ServerState.LEADING) && (peer.getMyId() > 2)) {
                         fail = true;
                     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index ab30a1de047..68349540760 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -330,7 +330,7 @@ public void testAdminCommands(boolean testObserverMaster) throws IOException, MB
         ObjectName connBean = null;
         for (ObjectName bean : JMXEnv.conn().queryNames(new ObjectName(MBeanRegistry.DOMAIN + ":*"), null)) {
             if (bean.getCanonicalName().contains("Learner_Connections") && bean.getCanonicalName().contains("id:"
-                                                                                                                    + q3.getQuorumPeer().getId())) {
+                                                                                                                    + q3.getQuorumPeer().getMyId())) {
                 connBean = bean;
                 break;
             }
@@ -344,7 +344,7 @@ public void testAdminCommands(boolean testObserverMaster) throws IOException, MB
         assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
                 "waiting for server 3 being up");
 
-        final String obsBeanName = String.format("org.apache.ZooKeeperService:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Observer", q3.getQuorumPeer().getId(), q3.getQuorumPeer().getId());
+        final String obsBeanName = String.format("org.apache.ZooKeeperService:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Observer", q3.getQuorumPeer().getMyId(), q3.getQuorumPeer().getMyId());
         Set<ObjectName> names = JMXEnv.conn().queryNames(new ObjectName(obsBeanName), null);
         assertEquals(1, names.size(), "expecting singular observer bean");
         ObjectName obsBean = names.iterator().next();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
index 760d9a4d7c1..72a5f140b52 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
@@ -115,10 +115,10 @@ public void testGetView() {
     @Test
     public void testViewContains() {
         // Test view contains self
-        assertTrue(qb.s1.viewContains(qb.s1.getId()));
+        assertTrue(qb.s1.viewContains(qb.s1.getMyId()));
 
         // Test view contains other servers
-        assertTrue(qb.s1.viewContains(qb.s2.getId()));
+        assertTrue(qb.s1.viewContains(qb.s2.getMyId()));
 
         // Test view does not contain non-existant servers
         assertFalse(qb.s1.viewContains(-1L));

From 4ad010384ea9903501f145de041bab14e763fbb1 Mon Sep 17 00:00:00 2001
From: liwang <liwang@apple.com>
Date: Tue, 8 Nov 2022 18:50:52 -0800
Subject: [PATCH 328/591] ZOOKEEPER-4632: Fix NPE from
 ConnectionMetricsTest.testRevalidateCount

Author: Li Wang <liwang@apple.com>
---
 .../org/apache/zookeeper/server/ConnectionMetricsTest.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
index 45d5c67ecf9..ac734d2969f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
@@ -57,8 +57,8 @@ public void testRevalidateCount() throws Exception {
         util.enableLocalSession(false);
         util.startAll();
 
-        int follower1 = (int) util.getFollowerQuorumPeers().get(0).getId();
-        int follower2 = (int) util.getFollowerQuorumPeers().get(1).getId();
+        int follower1 = (int) util.getFollowerQuorumPeers().get(0).getMyId();
+        int follower2 = (int) util.getFollowerQuorumPeers().get(1).getMyId();
         LOG.info("connecting to server: {}", follower1);
         ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
         // create a connection to follower

From f1d69fdc8a4407f85e0d9af84daac93c00fe82f7 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <enrico.olivelli@datastax.com>
Date: Wed, 7 Dec 2022 11:49:30 +0100
Subject: [PATCH 329/591] [ZOOKEEPER-4642] Remove Travis CI

---
 .travis.yml | 35 -----------------------------------
 1 file changed, 35 deletions(-)
 delete mode 100644 .travis.yml

diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 7fd2dcd02ff..00000000000
--- a/.travis.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-language: java
-
-matrix:
-  include:
-    - os: linux
-      arch: arm64
-      jdk: openjdk11
-      install: |
-        f=$(which javac)
-        while [[ -L $f ]]; do f=$(readlink $f); done
-        export JAVA_HOME=${f%/bin/*}
-
-    - os: linux
-      arch: s390x
-      jdk: openjdk11
-
-cache:
-  directories:
-  - "$HOME/.m2"
-
-addons:
-  apt:
-    update: true
-    packages:
-      - maven
-      - libcppunit-dev
-
-script: mvn clean apache-rat:check verify -DskipTests spotbugs:check checkstyle:check -Pfull-build
-
-branches:
-  only:
-  - master
-  - branch-3.7
-  - branch-3.6
-  - branch-3.5

From 21a707b73e588a7bfc53dfcacaa14f5a1b386159 Mon Sep 17 00:00:00 2001
From: Mike Dobozy <dobozysaurus@gmail.com>
Date: Tue, 13 Dec 2022 15:43:29 -0500
Subject: [PATCH 330/591] ZOOKEEPER-4627: Upgraded jetty library. (#1955)

Co-authored-by: Mike Dobozy <mdobozy@redhat.com>
Co-authored-by: Anup Ghatage <ghatage@apache.org>
Signed-off-by: Chris Nauroth <cnauroth@apache.org>
Reviewed-by: Mate Szalay-Beko <symat@apache.org>
---
 pom.xml                                                         | 2 +-
 ...0629.LICENSE.txt => jetty-http-9.4.49.v20220914.LICENSE.txt} | 0
 ...210629.LICENSE.txt => jetty-io-9.4.49.v20220914.LICENSE.txt} | 0
 ....LICENSE.txt => jetty-security-9.4.49.v20220914.LICENSE.txt} | 0
 ...29.LICENSE.txt => jetty-server-9.4.49.v20220914.LICENSE.txt} | 0
 ...9.LICENSE.txt => jetty-servlet-9.4.49.v20220914.LICENSE.txt} | 0
 ...0629.LICENSE.txt => jetty-util-9.4.49.v20220914.LICENSE.txt} | 0
 ...LICENSE.txt => jetty-util-ajax-9.4.49.v20220914.LICENSE.txt} | 0
 8 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.43.v20210629.LICENSE.txt => jetty-http-9.4.49.v20220914.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.43.v20210629.LICENSE.txt => jetty-io-9.4.49.v20220914.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.43.v20210629.LICENSE.txt => jetty-security-9.4.49.v20220914.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.43.v20210629.LICENSE.txt => jetty-server-9.4.49.v20220914.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.43.v20210629.LICENSE.txt => jetty-servlet-9.4.49.v20220914.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.43.v20210629.LICENSE.txt => jetty-util-9.4.49.v20220914.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.43.v20210629.LICENSE.txt => jetty-util-ajax-9.4.49.v20220914.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 76d21a26678..e54f5137784 100755
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
     <netty.version>4.1.76.Final</netty.version>
-    <jetty.version>9.4.43.v20210629</jetty.version>
+    <jetty.version>9.4.49.v20220914</jetty.version>
     <jackson.version>2.13.2.1</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.49.v20220914.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.49.v20220914.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.49.v20220914.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.49.v20220914.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.49.v20220914.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.49.v20220914.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.43.v20210629.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.49.v20220914.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.43.v20210629.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.49.v20220914.LICENSE.txt

From 50d5722dd3342530eae4a737d9759ec5f774c84b Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Thu, 15 Dec 2022 13:15:52 +0100
Subject: [PATCH 331/591] ZOOKEEPER-4641: GH CI fails with error: implicit
 declaration of function FIPS_mode

Modifications:
- remove the block, as it is used only for debug

More details here:
https://issues.apache.org/jira/browse/ZOOKEEPER-4641

Author: Enrico Olivelli <enrico.olivelli@datastax.com>

Reviewers: Andor Molnar <andor@apache.org>, Chris Nauroth <cnauroth@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1951 from eolivelli/fix/ZOOKEEPER-4641
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 0dac4c3d0ac..74b04717195 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -2751,11 +2751,6 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
         OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
         method = TLS_client_method();
 #endif
-        if (FIPS_mode() == 0) {
-            LOG_INFO(LOGCALLBACK(zh), "FIPS mode is OFF ");
-        } else {
-            LOG_INFO(LOGCALLBACK(zh), "FIPS mode is ON ");
-        }
         fd->ssl_ctx = SSL_CTX_new(method);
         ctx = &fd->ssl_ctx;
 

From 9a43bc95aa8c95808d585b7aafb375a1e438a581 Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Sun, 18 Dec 2022 18:37:53 +0100
Subject: [PATCH 332/591] ZOOKEEPER-4654: Fix C client test compilation error
 in Util.cc.

Author: Chris Nauroth <cnauroth@apache.org>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>

Closes #1967 from cnauroth/ZOOKEEPER-4654
---
 zookeeper-client/zookeeper-client-c/tests/Util.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/tests/Util.cc b/zookeeper-client/zookeeper-client-c/tests/Util.cc
index 2b9da84eb57..7b49ecac549 100644
--- a/zookeeper-client/zookeeper-client-c/tests/Util.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/Util.cc
@@ -16,6 +16,8 @@
  * limitations under the License.
  */
 
+#include <time.h>
+
 #include "Util.h"
 #include "string.h"
 

From b069edeb2436a051ad2b18e03fd67ae8ec23875c Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Wed, 4 Jan 2023 07:40:32 -0800
Subject: [PATCH 333/591] ZOOKEEPER-4570: Admin server API for taking snapshot
 and stream out data (#1943)

Provides a snapshot command for taking snapshot and streaming out data

Author: Li Wang <liwang@apple.com>

Co-authored-by: Li Wang <liwang@apple.com>
Co-authored-by: Enrico Olivelli <eolivelli@apache.org>
---
 .../main/resources/markdown/zookeeperAdmin.md |  51 +++-
 .../org/apache/zookeeper/server/DataTree.java |  36 +++
 .../zookeeper/server/ServerMetrics.java       |  12 +
 .../zookeeper/server/ZooKeeperServer.java     |  52 +++-
 .../server/admin/CommandOutputter.java        |   6 +-
 .../server/admin/CommandResponse.java         |  78 +++++-
 .../zookeeper/server/admin/Commands.java      | 102 ++++++-
 .../server/admin/JettyAdminServer.java        |  26 +-
 .../zookeeper/server/admin/JsonOutputter.java |   6 +-
 .../server/admin/StreamOutputter.java         |  52 ++++
 .../server/auth/IPAuthenticationProvider.java |  17 ++
 .../server/persistence/FileSnap.java          |  10 +
 .../server/persistence/FileTxnSnapLog.java    |   4 +-
 .../zookeeper/server/util/RateLimiter.java    |  60 ++++
 .../apache/zookeeper/TakeSnapshotTest.java    | 103 +++++++
 .../java/org/apache/zookeeper/ZKTestCase.java |   4 +
 .../apache/zookeeper/server/DataTreeTest.java |  55 ++++
 .../zookeeper/server/SnapshotDigestTest.java  |   3 +-
 .../zookeeper/server/TxnLogDigestTest.java    |   3 +
 .../server/admin/CommandResponseTest.java     |   7 +-
 .../zookeeper/server/admin/CommandsTest.java  |  93 +++++--
 .../server/admin/JettyAdminServerTest.java    |   6 +-
 .../server/admin/SnapshotCommandTest.java     | 257 ++++++++++++++++++
 .../persistence/FileTxnSnapLogTest.java       |   8 +
 .../quorum/FuzzySnapshotRelatedTest.java      |  12 +-
 .../server/util/RateLimiterTest.java          |  62 +++++
 26 files changed, 1073 insertions(+), 52 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 8e19f0418a9..b4c01d35d05 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1208,7 +1208,32 @@ property, when available, is noted below.
 
     The default value is false.
 
-
+* *serializeLastProcessedZxid.enabled*
+  (Jave system property: **zookeeper.serializeLastProcessedZxid.enabled**)
+  **New in 3.9.0:**
+  If enabled, ZooKeeper serializes the lastProcessedZxid when snapshot and deserializes it
+  when restore. Defaults to true. Needs to be enabled for performing snapshot and restore
+  via admin server commands, as there is no snapshot file name to extract the lastProcessedZxid.
+  
+  This feature is backward and forward compatible. Here are the different scenarios.
+
+    1. Snapshot triggered by server internally
+       a. When loading old snapshot with new code, it will throw EOFException when trying to
+       read the non-exist lastProcessedZxid value, and the exception will be caught. 
+       The lastProcessedZxid will be set using the snapshot file name.
+       
+       b. When loading new snapshot with old code, it will finish successfully after deserializing the 
+       digest value, the lastProcessedZxid at the end of snapshot file will be ignored.
+       The lastProcessedZxid will be set using the snapshot file name.
+    
+    2. Sync up between leader and follower
+       The lastProcessedZxid will not be serialized by leader and deserialized by follower
+       in both new and old code. It will be set to the lastProcessedZxid sent from leader
+       via QuorumPacket.  
+
+   3. Snapshot triggered via admin server APIs
+      The feature flag need to be enabled for the snapshot command to work. 
+     
 <a name="sc_clusterOptions"></a>
 
 #### Cluster Options
@@ -2087,6 +2112,20 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
 
 #### AdminServer configuration
 
+**New in 3.9.0:** The following
+options are used to configure the [AdminServer](#sc_adminserver).
+
+* *admin.snapshot.enabled* :
+  (Java system property: **zookeeper.admin.snapshot.enabled**)
+  The flag for enabling the snapshot command. Defaults to false. 
+  It will be enabled by default once the auth support for admin server commands 
+  is available.
+
+* *admin.snapshot.intervalInMS* :
+  (Java system property: **zookeeper.admin.snapshot.intervalInMS**)
+  The time interval for rate limiting snapshot command to protect the server.
+  Defaults to 5 mins.
+
 **New in 3.7.1:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
 
@@ -2620,6 +2659,16 @@ Available commands include:
     Server information.
     Returns multiple fields giving a brief overview of server state.
 
+* *snapshot/snap* :
+  Takes a snapshot of the current server in the datadir and stream out data.
+  Optional query parameter:
+  "streaming": Boolean (defaults to true if the parameter is not present)
+  Returns the following via Http headers:
+  "last_zxid": String
+  "snapshot_size": String
+  Note: this API is rate-limited (once every 5 mins by default) to protect the server
+  from being over-loaded.
+
 * *stats/stat* :
     Same as *server_stats* but also returns the "connections" field (see *connections*
     for details).
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 2818e15aa9e..cd45a7c3437 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -1744,6 +1744,42 @@ public boolean deserializeZxidDigest(InputArchive ia, long startZxidOfSnapshot)
         }
     }
 
+    /**
+     * Serializes the lastProcessedZxid so we can get it from snapshot instead the snapshot file name.
+     * This is needed for performing snapshot and restore via admin server commands.
+     *
+     * @param oa the output stream to write to
+     * @return true if the lastProcessedZxid is serialized successfully, otherwise false
+     * @throws IOException if there is an I/O error
+     */
+    public boolean serializeLastProcessedZxid(final OutputArchive oa) throws IOException {
+        if (!ZooKeeperServer.isSerializeLastProcessedZxidEnabled()) {
+            return false;
+        }
+        oa.writeLong(lastProcessedZxid, "lastZxid");
+        return true;
+    }
+
+    /**
+     * Deserializes the lastProcessedZxid from the input stream and updates the lastProcessedZxid field.
+     *
+     * @param ia the input stream to read from
+     * @return true if lastProcessedZxid is deserialized successfully, otherwise false
+     * @throws IOException if there is an I/O error
+     */
+    public boolean deserializeLastProcessedZxid(final InputArchive ia)  throws IOException {
+        if (!ZooKeeperServer.isSerializeLastProcessedZxidEnabled()) {
+            return false;
+        }
+        try {
+            lastProcessedZxid = ia.readLong("lastZxid");
+        } catch (final EOFException e) {
+            LOG.warn("Got EOFException while reading the last processed zxid, likely due to reading an older snapshot.");
+            return false;
+        }
+        return true;
+    }
+
     /**
      * Compares the actual tree's digest with that in the snapshot.
      * Resets digestFromLoadedSnapshot after comparision.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index af156542f03..ef28e32e131 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -72,6 +72,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         FSYNC_TIME = metricsContext.getSummary("fsynctime", DetailLevel.BASIC);
 
         SNAPSHOT_TIME = metricsContext.getSummary("snapshottime", DetailLevel.BASIC);
+        SNAPSHOT_ERROR_COUNT = metricsContext.getCounter("snapshot_error_count");
+        SNAPSHOT_RATE_LIMITED_COUNT = metricsContext.getCounter("snapshot_rate_limited_count");
         DB_INIT_TIME = metricsContext.getSummary("dbinittime", DetailLevel.BASIC);
         READ_LATENCY = metricsContext.getSummary("readlatency", DetailLevel.ADVANCED);
         UPDATE_LATENCY = metricsContext.getSummary("updatelatency", DetailLevel.ADVANCED);
@@ -276,6 +278,16 @@ private ServerMetrics(MetricsProvider metricsProvider) {
      */
     public final Summary SNAPSHOT_TIME;
 
+    /**
+     * Snapshot error count
+     */
+    public final Counter SNAPSHOT_ERROR_COUNT;
+
+    /**
+     * Snapshot rate limited count
+     */
+    public final Counter SNAPSHOT_RATE_LIMITED_COUNT;
+
     /**
      * Db init time (snapshot loading + txnlog replay)
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index f6c2b93ebf5..d61f269c9f6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -120,6 +120,9 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
     public static final String ZOOKEEPER_DIGEST_ENABLED = "zookeeper.digest.enabled";
     private static boolean digestEnabled;
 
+    public static final String ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED = "zookeeper.serializeLastProcessedZxid.enabled";
+    private static boolean serializeLastProcessedZxidEnabled;
+
     // Add a enable/disable option for now, we should remove this one when
     // this feature is confirmed to be stable
     public static final String CLOSE_SESSION_TXN_ENABLED = "zookeeper.closeSessionTxn.enabled";
@@ -153,6 +156,9 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
         closeSessionTxnEnabled = Boolean.parseBoolean(
                 System.getProperty(CLOSE_SESSION_TXN_ENABLED, "true"));
         LOG.info("{} = {}", CLOSE_SESSION_TXN_ENABLED, closeSessionTxnEnabled);
+
+        setSerializeLastProcessedZxidEnabled(Boolean.parseBoolean(
+                System.getProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true")));
     }
 
     // @VisibleForTesting
@@ -535,23 +541,46 @@ public void loadData() throws IOException, InterruptedException {
         takeSnapshot();
     }
 
-    public void takeSnapshot() {
+    public void takeSnapshot() throws IOException {
         takeSnapshot(false);
     }
 
-    public void takeSnapshot(boolean syncSnap) {
+    public void takeSnapshot(boolean syncSnap) throws IOException {
+        takeSnapshot(syncSnap, true, false);
+    }
+
+    /**
+     * Takes a snapshot on the server.
+     *
+     * @param syncSnap syncSnap sync the snapshot immediately after write
+     * @param isSevere if true system exist, otherwise throw IOException
+     * @param fastForwardFromEdits whether fast forward database to the latest recorded transactions
+     *
+     * @return file snapshot file object
+     * @throws IOException
+     */
+    public synchronized File takeSnapshot(boolean syncSnap, boolean isSevere, boolean fastForwardFromEdits) throws IOException {
         long start = Time.currentElapsedTime();
+        File snapFile = null;
         try {
-            txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
+            if (fastForwardFromEdits) {
+                zkDb.fastForwardDataBase();
+            }
+            snapFile = txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
         } catch (IOException e) {
-            LOG.error("Severe unrecoverable error, exiting", e);
-            // This is a severe error that we cannot recover from,
-            // so we need to exit
-            ServiceUtils.requestSystemExit(ExitCode.TXNLOG_ERROR_TAKING_SNAPSHOT.getValue());
+            if (isSevere) {
+                LOG.error("Severe unrecoverable error, exiting", e);
+                // This is a severe error that we cannot recover from,
+                // so we need to exit
+                ServiceUtils.requestSystemExit(ExitCode.TXNLOG_ERROR_TAKING_SNAPSHOT.getValue());
+            } else {
+                throw e;
+            }
         }
         long elapsed = Time.currentElapsedTime() - start;
         LOG.info("Snapshot taken in {} ms", elapsed);
         ServerMetrics.getMetrics().SNAPSHOT_TIME.add(elapsed);
+        return snapFile;
     }
 
     public boolean shouldForceWriteInitialSnapshotAfterLeaderElection() {
@@ -2139,6 +2168,15 @@ public static void setDigestEnabled(boolean digestEnabled) {
         ZooKeeperServer.digestEnabled = digestEnabled;
     }
 
+    public static boolean isSerializeLastProcessedZxidEnabled() {
+        return serializeLastProcessedZxidEnabled;
+    }
+
+    public static void setSerializeLastProcessedZxidEnabled(boolean serializeLastZxidEnabled) {
+        serializeLastProcessedZxidEnabled = serializeLastZxidEnabled;
+        LOG.info("{} = {}", ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, serializeLastZxidEnabled);
+    }
+
     /**
      * Trim a path to get the immediate predecessor.
      *
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java
index a8fe8bdc049..b9a87830e1c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.admin;
 
+import java.io.OutputStream;
 import java.io.PrintWriter;
 
 /**
@@ -31,6 +32,9 @@ public interface CommandOutputter {
     /** The MIME type of this output (e.g., "application/json") */
     String getContentType();
 
-    void output(CommandResponse response, PrintWriter pw);
+    /** Print out data as output */
+    default void output(CommandResponse response, PrintWriter pw) {}
 
+    /** Stream out data as output */
+    default void output(final CommandResponse response, final OutputStream os) {}
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
index d9e7239a113..f47b4e94293 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
@@ -17,8 +17,11 @@
 
 package org.apache.zookeeper.server.admin;
 
+import java.io.InputStream;
+import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
 
 /**
  * A response from running a {@link Command}.
@@ -37,6 +40,9 @@ public class CommandResponse {
     private final String command;
     private final String error;
     private final Map<String, Object> data;
+    private final Map<String, String> headers;
+    private int statusCode;
+    private InputStream inputStream;
 
     /**
      * Creates a new response with no error string.
@@ -44,18 +50,35 @@ public class CommandResponse {
      * @param command command name
      */
     public CommandResponse(String command) {
-        this(command, null);
+        this(command, null, HttpServletResponse.SC_OK);
     }
     /**
      * Creates a new response.
      *
      * @param command command name
      * @param error error string (may be null)
+     * @param statusCode http status code
      */
-    public CommandResponse(String command, String error) {
+    public CommandResponse(String command, String error, int statusCode) {
+       this(command, error, statusCode, null);
+    }
+
+
+    /**
+     * Creates a new response.
+     *
+     * @param command command name
+     * @param error error string (may be null)
+     * @param statusCode http status code
+     * @param inputStream inputStream to send out data (may be null)
+     */
+    public CommandResponse(final String command, final String error, final int statusCode, final InputStream inputStream) {
         this.command = command;
         this.error = error;
         data = new LinkedHashMap<String, Object>();
+        headers = new HashMap<>();
+        this.statusCode = statusCode;
+        this.inputStream = inputStream;
     }
 
     /**
@@ -76,6 +99,38 @@ public String getError() {
         return error;
     }
 
+    /**
+     * Gets the http status code
+     *
+     * @return http status code
+     */
+    public int getStatusCode() {
+        return statusCode;
+    }
+
+    /**
+     * Sets the http status code
+     */
+    public void setStatusCode(int statusCode) {
+        this.statusCode = statusCode;
+    }
+
+    /**
+     * Gets the InputStream (may be null).
+     *
+     * @return InputStream
+     */
+    public InputStream getInputStream() {
+        return inputStream;
+    }
+
+    /**
+     * Sets the InputStream
+     */
+    public void setInputStream(final InputStream inputStream) {
+         this.inputStream = inputStream;
+    }
+
     /**
      * Adds a key/value pair to this response.
      *
@@ -96,6 +151,25 @@ public void putAll(Map<? extends String, ?> m) {
         data.putAll(m);
     }
 
+    /**
+     * Adds a header to this response.
+     *
+     * @param name name of the header
+     * @param value value of the header
+     */
+    public void addHeader(final String name, final String value) {
+        headers.put(name, value);
+    }
+
+    /**
+     * Returns all headers
+     *
+     * @return map representation of all headers
+     */
+    public Map<String, String> getHeaders() {
+        return headers;
+    }
+
     /**
      * Converts this response to a map. The returned map is mutable, and
      * changes to it do not reflect back into this response.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 236c7ec2452..848583a0f54 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -18,8 +18,11 @@
 
 package org.apache.zookeeper.server.admin;
 
+import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.File;
+import java.io.FileInputStream;
 import java.net.InetSocketAddress;
 import java.util.Arrays;
 import java.util.Collections;
@@ -31,7 +34,9 @@
 import java.util.Set;
 import java.util.SortedMap;
 import java.util.TreeMap;
+import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
+import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.Environment.Entry;
 import org.apache.zookeeper.Version;
@@ -41,6 +46,7 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.server.persistence.SnapshotInfo;
+import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.server.quorum.Follower;
 import org.apache.zookeeper.server.quorum.FollowerZooKeeperServer;
 import org.apache.zookeeper.server.quorum.Leader;
@@ -51,7 +57,9 @@
 import org.apache.zookeeper.server.quorum.QuorumZooKeeperServer;
 import org.apache.zookeeper.server.quorum.ReadOnlyZooKeeperServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
+import org.apache.zookeeper.server.util.RateLimiter;
 import org.apache.zookeeper.server.util.ZxidUtils;
+import org.eclipse.jetty.http.HttpStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -104,10 +112,12 @@ public static CommandResponse runCommand(
         Map<String, String> kwargs) {
         Command command = getCommand(cmdName);
         if (command == null) {
-            return new CommandResponse(cmdName, "Unknown command: " + cmdName);
+            // set the status code to 200 to keep the current behavior of existing commands
+            return new CommandResponse(cmdName, "Unknown command: " + cmdName, HttpServletResponse.SC_OK);
         }
         if (command.isServerRequired() && (zkServer == null || !zkServer.isRunning())) {
-            return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests");
+            // set the status code to 200 to keep the current behavior of existing commands
+            return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests", HttpServletResponse.SC_OK);
         }
         return command.run(zkServer, kwargs);
     }
@@ -144,6 +154,7 @@ public static Command getCommand(String cmdName) {
         registerCommand(new ObserverCnxnStatResetCommand());
         registerCommand(new RuokCommand());
         registerCommand(new SetTraceMaskCommand());
+        registerCommand(new SnapshotCommand());
         registerCommand(new SrvrCommand());
         registerCommand(new StatCommand());
         registerCommand(new StatResetCommand());
@@ -530,6 +541,93 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
+    /**
+     * Take a snapshot of current server and stream out the data.
+     *
+     *  Argument:
+     *   - "streaming": optional String to indicate whether streaming out data
+     *
+     *  Returned snapshot as stream if streaming is true and metadata of the snapshot
+     *   - "last_zxid": String
+     *   - "snapshot_size": String
+     */
+    public static class SnapshotCommand extends CommandBase {
+        static final String REQUEST_QUERY_PARAM_STREAMING = "streaming";
+
+        static final String RESPONSE_HEADER_LAST_ZXID = "last_zxid";
+        static final String RESPONSE_HEADER_SNAPSHOT_SIZE = "snapshot_size";
+
+        static final String ADMIN_SNAPSHOT_ENABLED = "zookeeper.admin.snapshot.enabled";
+        static final String ADMIN_SNAPSHOT_INTERVAL = "zookeeper.admin.snapshot.intervalInMS";
+
+        private static final long snapshotInterval = Integer.parseInt(System.getProperty(ADMIN_SNAPSHOT_INTERVAL, "300000"));
+
+        private final RateLimiter rateLimiter;
+
+        public SnapshotCommand() {
+            super(Arrays.asList("snapshot", "snap"));
+            rateLimiter = new RateLimiter(1, snapshotInterval, TimeUnit.MICROSECONDS);
+        }
+
+        @SuppressFBWarnings(value = "OBL_UNSATISFIED_OBLIGATION",
+                justification = "FileInputStream is passed to CommandResponse and closed in StreamOutputter")
+        @Override
+        public CommandResponse run(final ZooKeeperServer zkServer, final Map<String, String> kwargs) {
+            final CommandResponse response = initializeResponse();
+
+            // check feature flag
+            final boolean snapshotEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_SNAPSHOT_ENABLED, "false"));
+            if (!snapshotEnabled) {
+                response.setStatusCode(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
+                LOG.warn("Snapshot command is disabled");
+                return response;
+            }
+
+            if (!zkServer.isSerializeLastProcessedZxidEnabled()) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                LOG.warn("Snapshot command requires serializeLastProcessedZxidEnable flag is set to true");
+                return response;
+            }
+
+            // check rate limiting
+            if (!rateLimiter.allow()) {
+                response.setStatusCode(HttpStatus.TOO_MANY_REQUESTS_429);
+                ServerMetrics.getMetrics().SNAPSHOT_RATE_LIMITED_COUNT.add(1);
+                LOG.warn("Snapshot request was rate limited");
+                return response;
+            }
+
+            // check the streaming query param
+            boolean streaming = true;
+            if (kwargs.containsKey(REQUEST_QUERY_PARAM_STREAMING)) {
+                streaming = Boolean.parseBoolean(kwargs.get(REQUEST_QUERY_PARAM_STREAMING));
+            }
+
+            // take snapshot and stream out data if needed
+            try {
+                final File snapshotFile = zkServer.takeSnapshot(false, false, true);
+                final long lastZxid = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
+                response.addHeader(RESPONSE_HEADER_LAST_ZXID, "0x" + ZxidUtils.zxidToString(lastZxid));
+
+                final long size = snapshotFile.length();
+                response.addHeader(RESPONSE_HEADER_SNAPSHOT_SIZE, String.valueOf(size));
+
+                if (size == 0) {
+                    response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                    ServerMetrics.getMetrics().SNAPSHOT_ERROR_COUNT.add(1);
+                    LOG.warn("Snapshot file {} is empty", snapshotFile);
+                } else if (streaming) {
+                    response.setInputStream(new FileInputStream(snapshotFile));
+                }
+            } catch (final Exception e) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                ServerMetrics.getMetrics().SNAPSHOT_ERROR_COUNT.add(1);
+                LOG.warn("Exception occurred when taking the snapshot via the snapshot admin command", e);
+            }
+            return response;
+        }
+    }
+
     /**
      * Server information. Returned map contains:
      *   - "version": String
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 99241dcbdd9..3c82f85529a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -33,6 +33,7 @@
 import org.apache.zookeeper.common.SecretUtils;
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
 import org.eclipse.jetty.http.HttpVersion;
 import org.eclipse.jetty.security.ConstraintMapping;
 import org.eclipse.jetty.security.ConstraintSecurityHandler;
@@ -259,15 +260,26 @@ protected void doGet(
             }
 
             // Run the command
-            CommandResponse cmdResponse = Commands.runCommand(cmd, zkServer, kwargs);
+            final CommandResponse cmdResponse = Commands.runCommand(cmd, zkServer, kwargs);
+            response.setStatus(cmdResponse.getStatusCode());
 
-            // Format and print the output of the command
-            CommandOutputter outputter = new JsonOutputter();
-            response.setStatus(HttpServletResponse.SC_OK);
-            response.setContentType(outputter.getContentType());
-            outputter.output(cmdResponse, response.getWriter());
+            final Map<String, String> headers = cmdResponse.getHeaders();
+            for (final Map.Entry<String, String> header : headers.entrySet()) {
+                response.addHeader(header.getKey(), header.getValue());
+            }
+            final String clientIP = IPAuthenticationProvider.getClientIPAddress(request);
+            if (cmdResponse.getInputStream() == null) {
+                // Format and print the output of the command
+                CommandOutputter outputter = new JsonOutputter(clientIP);
+                response.setContentType(outputter.getContentType());
+                outputter.output(cmdResponse, response.getWriter());
+            } else {
+                // Stream out the output of the command
+                CommandOutputter outputter = new StreamOutputter(clientIP);
+                response.setContentType(outputter.getContentType());
+                outputter.output(cmdResponse, response.getOutputStream());
+            }
         }
-
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
index 7d945745374..44c88de9d76 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
@@ -35,12 +35,14 @@ public class JsonOutputter implements CommandOutputter {
     public static final String ERROR_RESPONSE = "{\"error\": \"Exception writing command response to JSON\"}";
 
     private ObjectMapper mapper;
+    private final String clientIP;
 
-    public JsonOutputter() {
+    public JsonOutputter(final String clientIP) {
         mapper = new ObjectMapper();
         mapper.configure(SerializationFeature.WRITE_ENUMS_USING_TO_STRING, true);
         mapper.configure(SerializationFeature.INDENT_OUTPUT, true);
         mapper.setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
+        this.clientIP = clientIP;
     }
 
     @Override
@@ -59,7 +61,7 @@ public void output(CommandResponse response, PrintWriter pw) {
             LOG.warn("Exception writing command response to JSON:", e);
             pw.write(ERROR_RESPONSE);
         } catch (IOException e) {
-            LOG.warn("Exception writing command response to JSON:", e);
+            LOG.warn("Exception writing command response as JSON to {}", clientIP, e);
             pw.write(ERROR_RESPONSE);
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
new file mode 100644
index 00000000000..e8f68e6499a
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import org.apache.zookeeper.common.IOUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A class for streaming data out.
+ */
+public class StreamOutputter implements CommandOutputter{
+    private static final Logger LOG = LoggerFactory.getLogger(StreamOutputter.class);
+    private final String clientIP;
+
+    public StreamOutputter(final String clientIP) {
+        this.clientIP = clientIP;
+    }
+
+    @Override
+    public String getContentType() {
+        return "application/octet-stream";
+    }
+
+    @Override
+    public void output(final CommandResponse response, final OutputStream os) {
+        try (final InputStream is = response.getInputStream()){
+            IOUtils.copyBytes(is, os, 1024, true);
+        } catch (final IOException e) {
+            LOG.error("Exception occurred when streaming out data to {}", clientIP, e);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
index b93e55a32e4..9f6fb4005be 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
@@ -18,11 +18,14 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.StringTokenizer;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
 
 public class IPAuthenticationProvider implements AuthenticationProvider {
+    private static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
 
     public String getScheme() {
         return "ip";
@@ -128,4 +131,18 @@ public boolean isValid(String id) {
         return true;
     }
 
+    /**
+     * Returns the HTTP(s) client IP address
+     * @param request HttpServletRequest
+     * @return IP address
+     */
+    public static String getClientIPAddress(final HttpServletRequest request) {
+        // to handle the case that a HTTP(s) client connects via a proxy or load balancer
+        final String xForwardedForHeader = request.getHeader(X_FORWARDED_FOR_HEADER_NAME);
+        if (xForwardedForHeader == null) {
+            return request.getRemoteAddr();
+        }
+        // the format of the field is: X-Forwarded-For: client, proxy1, proxy2 ...
+        return new StringTokenizer(xForwardedForHeader, ",").nextToken().trim();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index df8a59c1a9f..1a91d1c3020 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -99,6 +99,11 @@ public long deserialize(DataTree dt, Map<Long, Integer> sessions) throws IOExcep
                     SnapStream.checkSealIntegrity(snapIS, ia);
                 }
 
+                // deserialize the last processed zxid and check the intact
+                if (dt.deserializeLastProcessedZxid(ia)) {
+                    SnapStream.checkSealIntegrity(snapIS, ia);
+                }
+
                 foundValid = true;
                 break;
             } catch (IOException e) {
@@ -255,6 +260,11 @@ public synchronized void serialize(
                     SnapStream.sealStream(snapOS, oa);
                 }
 
+                // serialize the last processed zxid and add another CRC check
+                if (dt.serializeLastProcessedZxid(oa)) {
+                    SnapStream.sealStream(snapOS, oa);
+                }
+
                 lastSnapshotInfo = new SnapshotInfo(
                     Util.getZxidFromName(snapShot.getName(), SNAPSHOT_FILE_PREFIX),
                     snapShot.lastModified() / 1000);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index 403720bdaa8..16f9cf71ed5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -468,9 +468,10 @@ public long getLastLoggedZxid() {
      * @param sessionsWithTimeouts the session timeouts to be
      * serialized onto disk
      * @param syncSnap sync the snapshot immediately after write
+     * @return the snapshot file
      * @throws IOException
      */
-    public void save(
+    public File save(
         DataTree dataTree,
         ConcurrentHashMap<Long, Integer> sessionsWithTimeouts,
         boolean syncSnap) throws IOException {
@@ -479,6 +480,7 @@ public void save(
         LOG.info("Snapshotting: 0x{} to {}", Long.toHexString(lastZxid), snapshotFile);
         try {
             snapLog.serialize(dataTree, sessionsWithTimeouts, snapshotFile, syncSnap);
+            return snapshotFile;
         } catch (IOException e) {
             if (snapshotFile.length() == 0) {
                 /* This may be caused by a full disk. In such a case, the server
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java
new file mode 100644
index 00000000000..cb9473306ab
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.apache.zookeeper.common.Time;
+
+/**
+ * A class that provides simple interval-based rate limiting implementation.
+ */
+public class RateLimiter {
+    private final int rate;
+    private final long intervalInMs;
+    private long lastTimeReset;
+    private final AtomicInteger remained;
+
+    public RateLimiter(final int rate, final long interval, final TimeUnit unit) {
+        this.rate = rate;
+        this.intervalInMs = unit.toMillis(interval);
+        this.lastTimeReset = Time.currentElapsedTime();
+        this.remained = new AtomicInteger(rate);
+    }
+
+    public boolean allow() {
+        final long now = Time.currentElapsedTime();
+
+        // reset the rate if interval passed
+        if (now > lastTimeReset + intervalInMs) {
+            remained.set(rate);
+            lastTimeReset = now;
+        }
+
+        int value = remained.get();
+        boolean allowed = false;
+
+        // to handle race condition
+        while (!allowed && value > 0) {
+            allowed = remained.compareAndSet(value, value - 1);
+            value = remained.get();
+        }
+        return allowed;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java
new file mode 100644
index 00000000000..a9953b7c029
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java
@@ -0,0 +1,103 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class TakeSnapshotTest extends ClientBase {
+    private static final String BASE_PATH = "/takeSnapshotTest";
+    private static final int NODE_COUNT = 100;
+    private static final String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
+    private ZooKeeper zk;
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+
+    @BeforeEach
+    public void setUp() throws Exception {
+        super.setUp();
+        ClientBase.setupTestEnv();
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        if (zk != null) {
+            zk.close();
+        }
+    }
+
+    @Test
+    public void testTakeSnapshotAndRestore() throws Exception {
+        ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+
+        final int port = Integer.parseInt(HOSTPORT.split(":")[1]);
+        final ServerCnxnFactory serverCnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+        serverCnxnFactory.startup(zks);
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+
+        try {
+            zk = ClientBase.createZKClient(HOSTPORT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                final String path = BASE_PATH + "-" + i;
+                zk.create(path, String.valueOf(i).getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // takeSnapshot
+            zks.takeSnapshot(false, false, true);
+
+            // clean up
+            zk.close();
+            zks.shutdown();
+
+            // start server again and assert the data restored from snapshot
+            zks = new ZooKeeperServer(dataDir, logDir, 3000);
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
+
+            serverCnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+
+            zk = ClientBase.createZKClient(HOSTPORT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                final String path = BASE_PATH + "-" + i;
+                final String expectedData = String.valueOf(i);
+                assertArrayEquals(expectedData.getBytes(), zk.getData(path, null, null));
+            }
+            assertEquals(NODE_COUNT + 3, zk.getAllChildrenNumber("/"));
+        } finally {
+            zks.shutdown();
+            serverCnxnFactory.shutdown();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index eb8fcbf934b..826a875b4b7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -71,6 +71,10 @@ public void starting(TestInfo testInfo) {
         // accidentally attempting to start multiple admin servers on the
         // same port.
         System.setProperty("zookeeper.admin.enableServer", "false");
+
+        // disable rate limiting on the snapshot admin API
+        System.setProperty("zookeeper.admin.snapshot.intervalInMS", "0");
+
         // ZOOKEEPER-2693 disables all 4lw by default.
         // Here we enable the 4lw which ZooKeeper tests depends.
         System.setProperty("zookeeper.4lw.commands.whitelist", "*");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
index 151e87343d0..07a69f14f01 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
@@ -516,6 +516,21 @@ public void testDeserializeZxidDigest() throws Exception {
         }
     }
 
+    @Test
+    public void testSerializeLastProcessedZxid_Enabled() throws Exception {
+        testSerializeLastProcessedZxid(true, true);
+    }
+
+    @Test
+    public void testSerializeLastProcessedZxid_Disabled() throws Exception {
+        testSerializeLastProcessedZxid(false, false);
+    }
+
+    @Test
+    public void testSerializeLastProcessedZxid_BackwardCompatibility() throws Exception {
+        testSerializeLastProcessedZxid(true, false);
+    }
+
     @Test
     public void testDataTreeMetrics() throws Exception {
         ServerMetrics.getMetrics().resetAll();
@@ -616,4 +631,44 @@ public void testDigest() throws Exception {
         }
     }
 
+    private DataTree buildDataTreeForTest() {
+        final DataTree dt = new DataTree();
+        assertEquals(dt.lastProcessedZxid, 0);
+
+        dt.processTxn(
+                new TxnHeader(100, 1000, 1, 30, ZooDefs.OpCode.create),
+                new CreateTxn("/foo", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 1),
+                null);
+        assertEquals(dt.lastProcessedZxid, 1);
+        return dt;
+    }
+
+    private void testSerializeLastProcessedZxid(boolean enableForSerialize, boolean enableForDeserialize) throws Exception{
+        final DataTree dt = buildDataTreeForTest();
+
+        try (final ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enableForSerialize);
+            final BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
+            if (enableForSerialize) {
+                assertTrue(dt.serializeLastProcessedZxid(oa));
+            } else {
+                assertFalse(dt.serializeLastProcessedZxid(oa));
+            }
+            baos.flush();
+
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enableForDeserialize);
+            try (final ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray())) {
+                final InputArchive ia = BinaryInputArchive.getArchive(bais);
+                if (enableForDeserialize) {
+                    assertTrue(dt.deserializeLastProcessedZxid(ia));
+                } else {
+                    assertFalse(dt.deserializeLastProcessedZxid(ia));
+                }
+                assertEquals(dt.lastProcessedZxid, 1);
+            }
+        } finally {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
index 89dac35a326..4e8c6f8e2c5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
@@ -166,7 +166,7 @@ public void testBackwardCompatible() throws Exception {
     private void testCompatibleHelper(Boolean enabledBefore, Boolean enabledAfter) throws Exception {
 
         ZooKeeperServer.setDigestEnabled(enabledBefore);
-
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enabledBefore);
 
         // restart the server to cache the option change
         reloadSnapshotAndCheckDigest();
@@ -179,6 +179,7 @@ private void testCompatibleHelper(Boolean enabledBefore, Boolean enabledAfter) t
         server.takeSnapshot();
 
         ZooKeeperServer.setDigestEnabled(enabledAfter);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enabledAfter);
 
         reloadSnapshotAndCheckDigest();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
index 6f6a2909980..ae58fa563e6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
@@ -80,11 +80,13 @@ public void tearDown() throws Exception {
     @Override
     public void setupCustomizedEnv() {
         ZooKeeperServer.setDigestEnabled(true);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
     }
 
     @Override
     public void cleanUpCustomizedEnv() {
         ZooKeeperServer.setDigestEnabled(false);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
     }
 
     @BeforeAll
@@ -189,6 +191,7 @@ private void restartServerWithDigestFlag(boolean digestEnabled)
         QuorumPeerMainTest.waitForOne(zk, States.CONNECTING);
 
         ZooKeeperServer.setDigestEnabled(digestEnabled);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(digestEnabled);
 
         startServer();
         QuorumPeerMainTest.waitForOne(zk, States.CONNECTED);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
index cfa130690f5..8009dab474b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
@@ -18,8 +18,10 @@
 package org.apache.zookeeper.server.admin;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.HashMap;
 import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.ZKTestCase;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -30,13 +32,16 @@ public class CommandResponseTest extends ZKTestCase {
 
     @BeforeEach
     public void setUp() throws Exception {
-        r = new CommandResponse("makemeasandwich", "makeityourself");
+        r = new CommandResponse("makemeasandwich", "makeityourself", HttpServletResponse.SC_OK);
     }
 
     @Test
     public void testGetters() {
         assertEquals("makemeasandwich", r.getCommand());
         assertEquals("makeityourself", r.getError());
+        assertEquals(HttpServletResponse.SC_OK, r.getStatusCode());
+        assertEquals(new HashMap(), r.getHeaders());
+        assertNull(r.getInputStream());
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index ff8dc203302..2d74776e317 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -18,18 +18,25 @@
 
 package org.apache.zookeeper.server.admin;
 
+import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.REQUEST_QUERY_PARAM_STREAMING;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.IOException;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerStats;
@@ -50,37 +57,52 @@ public class CommandsTest extends ClientBase {
      *            - the primary name of the command
      * @param kwargs
      *            - keyword arguments to the command
+     * @param expectedHeaders
+     *            - expected HTTP response headers
+     * @param expectedStatusCode
+     *            - expected HTTP status code
      * @param fields
      *            - the fields that are expected in the returned Map
      * @throws IOException
      * @throws InterruptedException
      */
-    public void testCommand(String cmdName, Map<String, String> kwargs, Field... fields) throws IOException, InterruptedException {
+    private void testCommand(String cmdName, Map<String, String> kwargs,
+                             Map<String, String> expectedHeaders, int expectedStatusCode,
+                             Field... fields) throws IOException, InterruptedException {
         ZooKeeperServer zks = serverFactory.getZooKeeperServer();
-        Map<String, Object> result = Commands.runCommand(cmdName, zks, kwargs).toMap();
-
-        assertTrue(result.containsKey("command"));
-        // This is only true because we're setting cmdName to the primary name
-        assertEquals(cmdName, result.remove("command"));
-        assertTrue(result.containsKey("error"));
-        assertNull(result.remove("error"), "error: " + result.get("error"));
-
-        for (Field field : fields) {
-            String k = field.key;
-            assertTrue(result.containsKey(k),
-                    "Result from command " + cmdName + " missing field \"" + k + "\"" + "\n" + result);
-            Class<?> t = field.type;
-            Object v = result.remove(k);
-            assertTrue(t.isAssignableFrom(v.getClass()),
-                    "\"" + k + "\" field from command " + cmdName
-                            + " should be of type " + t + ", is actually of type " + v.getClass());
+        final CommandResponse commandResponse = Commands.runCommand(cmdName, zks, kwargs);
+        assertNotNull(commandResponse);
+        assertEquals(expectedStatusCode, commandResponse.getStatusCode());
+        try (final InputStream responseStream = commandResponse.getInputStream()) {
+            if (Boolean.parseBoolean(kwargs.getOrDefault(REQUEST_QUERY_PARAM_STREAMING, "false"))) {
+                assertNotNull(responseStream, "InputStream in the response of command " + cmdName + " should not be null");
+            } else {
+                Map<String, Object> result = commandResponse.toMap();
+                assertTrue(result.containsKey("command"));
+                // This is only true because we're setting cmdName to the primary name
+                assertEquals(cmdName, result.remove("command"));
+                assertTrue(result.containsKey("error"));
+                assertNull(result.remove("error"), "error: " + result.get("error"));
+
+                for (Field field : fields) {
+                    String k = field.key;
+                    assertTrue(result.containsKey(k),
+                            "Result from command " + cmdName + " missing field \"" + k + "\"" + "\n" + result);
+                    Class<?> t = field.type;
+                    Object v = result.remove(k);
+                    assertTrue(t.isAssignableFrom(v.getClass()),
+                            "\"" + k + "\" field from command " + cmdName
+                                    + " should be of type " + t + ", is actually of type " + v.getClass());
+                }
+
+                assertTrue(result.isEmpty(), "Result from command " + cmdName + " contains extra fields: " + result);
+            }
         }
-
-        assertTrue(result.isEmpty(), "Result from command " + cmdName + " contains extra fields: " + result);
+        assertEquals(expectedHeaders, commandResponse.getHeaders());
     }
 
     public void testCommand(String cmdName, Field... fields) throws IOException, InterruptedException {
-        testCommand(cmdName, new HashMap<String, String>(), fields);
+        testCommand(cmdName, new HashMap<String, String>(), new HashMap<>(), HttpServletResponse.SC_OK, fields);
     }
 
     private static class Field {
@@ -91,7 +113,16 @@ private static class Field {
             this.key = key;
             this.type = type;
         }
+    }
 
+    @Test
+    public void testSnapshot_streaming() throws IOException, InterruptedException {
+        testSnapshot(true);
+    }
+
+    @Test
+    public void testSnapshot_nonStreaming() throws IOException, InterruptedException {
+        testSnapshot(false);
     }
 
     @Test
@@ -208,7 +239,7 @@ public void testServerStats() throws IOException, InterruptedException {
     public void testSetTraceMask() throws IOException, InterruptedException {
         Map<String, String> kwargs = new HashMap<String, String>();
         kwargs.put("traceMask", "1");
-        testCommand("set_trace_mask", kwargs, new Field("tracemask", Long.class));
+        testCommand("set_trace_mask", kwargs, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
     }
 
     @Test
@@ -288,4 +319,22 @@ public void testStatCommandSecureOnly() {
         assertThat(response.toMap().containsKey("secure_connections"), is(true));
     }
 
+    private void testSnapshot(final boolean streaming) throws IOException, InterruptedException {
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        System.setProperty(ADMIN_SNAPSHOT_INTERVAL, "0");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+        try {
+            final Map<String, String> kwargs = new HashMap<>();
+            kwargs.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
+            final Map<String, String> expectedHeaders = new HashMap<>();
+            expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID, "0x0");
+            expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE, "478");
+            testCommand("snapshot", kwargs, expectedHeaders, HttpServletResponse.SC_OK);
+        } finally {
+            System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
+            System.clearProperty(ADMIN_SNAPSHOT_INTERVAL);
+            System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index c269e199497..b06cde6fd20 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -61,9 +61,9 @@ public class JettyAdminServerTest extends ZKTestCase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(JettyAdminServerTest.class);
 
-    private static final String URL_FORMAT = "http://localhost:%d/commands";
-    private static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
-    private static final int jettyAdminPort = PortAssignment.unique();
+    static final String URL_FORMAT = "http://localhost:%d/commands";
+    static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
+    static final int jettyAdminPort = PortAssignment.unique();
 
     @BeforeEach
     public void enableServer() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java
new file mode 100644
index 00000000000..5b5dbd979ef
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java
@@ -0,0 +1,257 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.REQUEST_QUERY_PARAM_STREAMING;
+import static org.apache.zookeeper.server.admin.JettyAdminServerTest.URL_FORMAT;
+import static org.apache.zookeeper.server.admin.JettyAdminServerTest.jettyAdminPort;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.UnsupportedEncodingException;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.nio.file.Files;
+import java.util.HashMap;
+import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.IOUtils;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+public class SnapshotCommandTest extends ZKTestCase {
+    private static final Logger LOG = LoggerFactory.getLogger(SnapshotCommandTest.class);
+
+    private static final String PATH = "/snapshot_test";
+    private static final int NODE_COUNT = 10;
+
+    private final String hostPort =  "127.0.0.1:" + PortAssignment.unique();
+    private ServerCnxnFactory cnxnFactory;
+    private JettyAdminServer adminServer;
+    private ZooKeeperServer zks;
+    private ZooKeeper zk;
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @BeforeAll
+    public void setup() throws Exception {
+        // start ZookeeperServer
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        final int port = Integer.parseInt(hostPort.split(":")[1]);
+        cnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+        cnxnFactory.startup(zks);
+        assertTrue(ClientBase.waitForServerUp(hostPort, 120000));
+
+        // start AdminServer
+        System.setProperty("zookeeper.admin.enableServer", "true");
+        System.setProperty("zookeeper.admin.serverPort", "" + jettyAdminPort);
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        System.setProperty(ADMIN_SNAPSHOT_INTERVAL, "0");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+
+        adminServer = new JettyAdminServer();
+        adminServer.setZooKeeperServer(zks);
+        adminServer.start();
+
+        // create Zookeeper client and test data
+        zk = ClientBase.createZKClient(hostPort);
+        createData(zk, NODE_COUNT);
+    }
+
+    @AfterAll
+    public void tearDown() throws Exception {
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.admin.serverPort");
+        System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
+        System.clearProperty(ADMIN_SNAPSHOT_INTERVAL);
+        System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+
+        if (zk != null) {
+            zk.close();
+        }
+
+        if (adminServer != null) {
+            adminServer.shutdown();
+        }
+
+        if (cnxnFactory != null) {
+            cnxnFactory.shutdown();
+        }
+
+        if (zks != null) {
+            zks.shutdown();
+        }
+    }
+
+    @Test
+    public void testSnapshotCommand_streaming() throws Exception {
+        // take snapshot with streaming
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+
+        // validate snapshot response
+        assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
+        validateResponseHeaders(snapshotConn);
+        final File snapshotFile = new File(dataDir + "/snapshot." + System.currentTimeMillis());
+        try (final InputStream inputStream = snapshotConn.getInputStream();
+             final FileOutputStream outputStream = new FileOutputStream(snapshotFile)) {
+            IOUtils.copyBytes(inputStream, outputStream, 1024, true);
+            final long fileSize = Files.size(snapshotFile.toPath());
+            assertTrue(fileSize > 0);
+        }
+    }
+
+    @Test
+    public void testSnapshotCommand_nonStreaming() throws Exception {
+        // take snapshot without streaming
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(false);
+
+        // validate snapshot response
+        assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
+        validateResponseHeaders(snapshotConn);
+        displayResponsePayload(snapshotConn);
+    }
+
+    @Test
+    public void testSnapshotCommand_disabled() throws Exception {
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "false");
+        try {
+            // take snapshot
+            final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+
+            // validate snapshot response
+            assertEquals(HttpServletResponse.SC_SERVICE_UNAVAILABLE, snapshotConn.getResponseCode());
+        } finally {
+            System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        }
+    }
+
+    @Test
+    public void testSnapshotCommand_serializeLastZxidDisabled() throws Exception {
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
+        try {
+            // take snapshot
+            final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+
+            // validate snapshot response
+            assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, snapshotConn.getResponseCode());
+        } finally {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+        }
+    }
+
+    private void createData(final ZooKeeper zk, final long count) throws Exception {
+        try {
+            zk.create(PATH, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        } catch (final KeeperException.NodeExistsException ignore) {
+            // ignore
+        }
+
+        for (int i = 0; i < count; i++) {
+            final String processNodePath = zk.create(String.format("%s/%s", PATH, "n_"), new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL);
+            LOG.info("Node created. path={}" + processNodePath);
+        }
+    }
+
+    private HttpURLConnection sendSnapshotRequest(final boolean streaming) throws Exception  {
+        final String queryParamsStr = buildQueryStringForSnapshotCommand(streaming);
+        final URL snapshotURL = new URL(String.format(URL_FORMAT + "/snapshot", jettyAdminPort) + "?" + queryParamsStr);
+        final HttpURLConnection snapshotConn = (HttpURLConnection) snapshotURL.openConnection();
+        snapshotConn.setRequestMethod("GET");
+
+        return snapshotConn;
+    }
+
+    private String buildQueryStringForSnapshotCommand(final boolean streaming) throws Exception {
+        final Map<String, String> parameters = new HashMap<>();
+        parameters.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
+        return getParamsString(parameters);
+    }
+
+    private static String getParamsString(final Map<String, String> params) throws UnsupportedEncodingException {
+        final StringBuilder result = new StringBuilder();
+
+        for (final Map.Entry<String, String> entry : params.entrySet()) {
+            result.append(URLEncoder.encode(entry.getKey(), "UTF-8"));
+            result.append("=");
+
+            result.append(URLEncoder.encode(entry.getValue(), "UTF-8"));
+            result.append("&");
+        }
+
+        final String resultString = result.toString();
+        return resultString.length() > 0
+                ? resultString.substring(0, resultString.length() - 1)
+                : resultString;
+    }
+
+    private void validateResponseHeaders(final HttpURLConnection conn) {
+        LOG.info("Header:{}, Value:{}",
+                Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID,
+                conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID));
+        assertNotNull(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID));
+
+        LOG.info("Header:{}, Value:{}",
+                Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE,
+                conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE));
+        assertNotNull(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE));
+        assertTrue(Integer.parseInt(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE)) > 0);
+    }
+
+    private void displayResponsePayload(final HttpURLConnection conn) throws IOException {
+        final StringBuilder sb = new StringBuilder();
+        try (final BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
+            String inputLine;
+            while ((inputLine = in.readLine()) != null) {
+                sb.append(inputLine);
+            }
+            LOG.info("Response payload: {}", sb);
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
index 44a00993443..466cf3f4b07 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
@@ -393,6 +393,10 @@ void testSnapshotSerializationCompatibility(Boolean digestEnabled, Boolean snapp
         SnapStream.setStreamMode(snappyEnabled ? SnapStream.StreamMode.SNAPPY : SnapStream.StreamMode.DEFAULT_MODE);
 
         ZooKeeperServer.setDigestEnabled(digestEnabled);
+        // set the flag to be the same as digestEnabled to make sure the last serialized data
+        // (for example, datatree, digest, lastProcessedZxid) is setup as expected for backward
+        // compatibility test.
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(digestEnabled);
         TxnHeader txnHeader = new TxnHeader(1, 1, 1, 1 + 1, ZooDefs.OpCode.create);
         CreateTxn txn = new CreateTxn("/" + 1, "data".getBytes(), null, false, 1);
         Request request = new Request(1, 1, 1, txnHeader, txn, 1);
@@ -401,6 +405,10 @@ void testSnapshotSerializationCompatibility(Boolean digestEnabled, Boolean snapp
 
         int expectedNodeCount = dataTree.getNodeCount();
         ZooKeeperServer.setDigestEnabled(!digestEnabled);
+        // set the flag to be the same as digestEnabled to make sure the last serialized data
+        // (for example, datatree, digest, lastProcessedZxid) is setup as expected for backward
+        // compatibility test.
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(!digestEnabled);
         snaplog.restore(dataTree, sessions, (hdr, rec, digest) -> {  });
         assertEquals(expectedNodeCount, dataTree.getNodeCount());
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
index c39bc54e0fa..a75fb383014 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
@@ -150,7 +150,11 @@ public void testMultiOpConsistency() throws Exception {
             @Override
             public void process(String path) {
                 LOG.info("Take a snapshot");
-                zkServer.takeSnapshot(true);
+                try {
+                    zkServer.takeSnapshot(true);
+                } catch (final IOException e) {
+                    // ignored as it should never reach here because of System.exit() call
+                }
             }
         });
 
@@ -373,7 +377,11 @@ public void testGlobalSessionConsistency() throws Exception {
             public void process(long sessionId) {
                 LOG.info("Take snapshot");
                 if (shouldTakeSnapshot.getAndSet(false)) {
-                    zkServer.takeSnapshot(true);
+                    try {
+                        zkServer.takeSnapshot(true);
+                    } catch (IOException e) {
+                        // ignored as it should never reach here because of System.exit() call
+                    }
                 }
             }
         });
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java
new file mode 100644
index 00000000000..b19e9682391
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import org.junit.jupiter.api.Test;
+
+public class RateLimiterTest {
+
+    @Test
+    public void testAllow_withinInterval() {
+        final int rate = 2;
+        final RateLimiter rateLimiter = new RateLimiter(rate, 5, TimeUnit.SECONDS);
+        for (int i = 0; i < rate; i++) {
+            assertTrue(rateLimiter.allow());
+        }
+        assertFalse(rateLimiter.allow());
+    }
+
+    @Test
+    public void testAllow_withinInterval_multiThreaded() {
+        final int rate = 10;
+
+        final RateLimiter rateLimiter = new RateLimiter(rate, 5, TimeUnit.SECONDS);
+        final ThreadPoolExecutor executor = (ThreadPoolExecutor) Executors.newFixedThreadPool(rate + 1);
+        for (int i = 0; i < rate; i++) {
+            executor.execute(() -> assertTrue(rateLimiter.allow()));
+        }
+        executor.execute(() -> assertFalse(rateLimiter.allow()));
+    }
+
+    @Test
+    public void testAllow_exceedInterval() throws Exception {
+        final int interval = 1;
+
+        final RateLimiter rateLimiter = new RateLimiter(1, interval, TimeUnit.SECONDS);
+        assertTrue(rateLimiter.allow());
+        assertFalse(rateLimiter.allow());
+        Thread.sleep(TimeUnit.SECONDS.toMillis(interval + 1));
+        assertTrue(rateLimiter.allow());
+    }
+}

From aa8790c72bcb02ce6f15dd93bbf6df4a14f9015b Mon Sep 17 00:00:00 2001
From: Dongjoon Hyun <dongjoon@apache.org>
Date: Thu, 12 Jan 2023 13:14:34 -0800
Subject: [PATCH 334/591] ZOOKEEPER-4657: Publish SBOM artifacts (#1969)

Reviewed-by: Vinod Anandan <vinod@owasp.org>
Signed-off-by: Chris Nauroth <cnauroth@apache.org>
---
 pom.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pom.xml b/pom.xml
index e54f5137784..9de520a8dff 100755
--- a/pom.xml
+++ b/pom.xml
@@ -918,6 +918,11 @@
           <artifactId>maven-bundle-plugin</artifactId>
           <version>5.1.1</version>
         </plugin>
+        <plugin>
+          <groupId>org.cyclonedx</groupId>
+          <artifactId>cyclonedx-maven-plugin</artifactId>
+          <version>2.7.3</version>
+       </plugin>
       </plugins>
     </pluginManagement>
 
@@ -1188,6 +1193,18 @@
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <goals>
+              <goal>makeBom</goal>
+            </goals>
+            <phase>package</phase>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
     <resources>
       <resource>

From c7e15cee13abcfcad7bece2631716d5238c566a3 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Thu, 19 Jan 2023 11:57:30 +0100
Subject: [PATCH 335/591] ZOOKEEPER-4649: Upgrade netty to 4.1.86 because of
 CVE-2022-41915 (#1963)

Co-authored-by: Mate Szalay-Beko <symat@apache.com>
---
 pom.xml                                       |   2 +-
 .../src/main/resources/NOTICE.txt             | 225 +++++++++++++-----
 ... => netty-buffer-4.1.86.Final.LICENSE.txt} |   0
 ...t => netty-codec-4.1.86.Final.LICENSE.txt} |   0
 ...=> netty-handler-4.1.86.Final.LICENSE.txt} |   0
 ...> netty-resolver-4.1.86.Final.LICENSE.txt} |   0
 ...ort-native-epoll-4.1.86.Final.LICENSE.txt} |   0
 ...tive-unix-common-4.1.86.Final.LICENSE.txt} |   0
 8 files changed, 172 insertions(+), 55 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.76.Final.LICENSE.txt => netty-buffer-4.1.86.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.76.Final.LICENSE.txt => netty-codec-4.1.86.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.76.Final.LICENSE.txt => netty-handler-4.1.86.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.76.Final.LICENSE.txt => netty-resolver-4.1.86.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.76.Final.LICENSE.txt => netty-transport-native-epoll-4.1.86.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.86.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 9de520a8dff..232584547a7 100755
--- a/pom.xml
+++ b/pom.xml
@@ -558,7 +558,7 @@
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.4</commons-cli.version>
-    <netty.version>4.1.76.Final</netty.version>
+    <netty.version>4.1.86.Final</netty.version>
     <jetty.version>9.4.49.v20220914</jetty.version>
     <jackson.version>2.13.2.1</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/NOTICE.txt b/zookeeper-server/src/main/resources/NOTICE.txt
index efdd6b43970..03601608eba 100644
--- a/zookeeper-server/src/main/resources/NOTICE.txt
+++ b/zookeeper-server/src/main/resources/NOTICE.txt
@@ -11,10 +11,10 @@ for Airlift code can be found at:
 https://github.com/airlift/airlift/blob/master/LICENSE
 
 This product includes software developed by
-The Netty Project (http://netty.io/)
-Copyright 2011 The Netty Project
-
-The Netty NOTICE file contains the following items:
+The Netty Project (http://netty.io/) Copyright 2011 The Netty Project
+The Netty NOTICE file (https://github.com/netty/netty/blob/4.1/NOTICE.txt)
+contains the following items:
+---------------- start of netty NOTICE file ----------------
 This product contains the extensions to Java Collections Framework which has
 been derived from the works by JSR-166 EG, Doug Lea, and Jason T. Greene:
 
@@ -32,29 +32,112 @@ Base64 Encoder and Decoder, which can be obtained at:
   * HOMEPAGE:
     * http://iharder.sourceforge.net/current/java/base64/
 
-This product contains a modified version of 'JZlib', a re-implementation of
-zlib in pure Java, which can be obtained at:
+This product contains a modified portion of 'Webbit', an event based
+WebSocket and HTTP server, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.webbit.txt (BSD License)
+  * HOMEPAGE:
+    * https://github.com/joewalnes/webbit
+
+This product contains a modified portion of 'SLF4J', a simple logging
+facade for Java, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.slf4j.txt (MIT License)
+  * HOMEPAGE:
+    * https://www.slf4j.org/
+
+This product contains a modified portion of 'Apache Harmony', an open source
+Java SE, which can be obtained at:
 
+  * NOTICE:
+    * license/NOTICE.harmony.txt
   * LICENSE:
-    * license/LICENSE.jzlib.txt (BSD Style License)
+    * license/LICENSE.harmony.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://archive.apache.org/dist/harmony/
+
+This product contains a modified portion of 'jbzip2', a Java bzip2 compression
+and decompression library written by Matthew J. Francis. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jbzip2.txt (MIT License)
+  * HOMEPAGE:
+    * https://code.google.com/p/jbzip2/
+
+This product contains a modified portion of 'libdivsufsort', a C API library to construct
+the suffix array and the Burrows-Wheeler transformed string for any input string of
+a constant-size alphabet written by Yuta Mori. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.libdivsufsort.txt (MIT License)
+  * HOMEPAGE:
+    * https://github.com/y-256/libdivsufsort
+
+This product contains a modified portion of Nitsan Wakart's 'JCTools', Java Concurrency Tools for the JVM,
+ which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jctools.txt (ASL2 License)
+  * HOMEPAGE:
+    * https://github.com/JCTools/JCTools
+
+This product optionally depends on 'JZlib', a re-implementation of zlib in
+pure Java, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jzlib.txt (BSD style License)
   * HOMEPAGE:
     * http://www.jcraft.com/jzlib/
 
-This product contains a modified version of 'Webbit', a Java event based
-WebSocket and HTTP server:
+This product optionally depends on 'Compress-LZF', a Java library for encoding and
+decoding data in LZF format, written by Tatu Saloranta. It can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.webbit.txt (BSD License)
+    * license/LICENSE.compress-lzf.txt (Apache License 2.0)
   * HOMEPAGE:
-    * https://github.com/joewalnes/webbit
+    * https://github.com/ning/compress
+
+This product optionally depends on 'lz4', a LZ4 Java compression
+and decompression library written by Adrien Grand. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.lz4.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/jpountz/lz4-java
+
+This product optionally depends on 'lzma-java', a LZMA Java compression
+and decompression library, which can be obtained at:
 
-This product optionally depends on 'Protocol Buffers', Google's data
+  * LICENSE:
+    * license/LICENSE.lzma-java.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/jponge/lzma-java
+
+This product optionally depends on 'zstd-jni', a zstd-jni Java compression
+and decompression library, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.zstd-jni.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/luben/zstd-jni
+
+This product contains a modified portion of 'jfastlz', a Java port of FastLZ compression
+and decompression library written by William Kinney. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jfastlz.txt (MIT License)
+  * HOMEPAGE:
+    * https://code.google.com/p/jfastlz/
+
+This product contains a modified portion of and optionally depends on 'Protocol Buffers', Google's data
 interchange format, which can be obtained at:
 
   * LICENSE:
     * license/LICENSE.protobuf.txt (New BSD License)
   * HOMEPAGE:
-    * http://code.google.com/p/protobuf/
+    * https://github.com/google/protobuf
 
 This product optionally depends on 'Bouncy Castle Crypto APIs' to generate
 a temporary self-signed X.509 certificate when the JVM does not provide the
@@ -63,15 +146,31 @@ equivalent functionality.  It can be obtained at:
   * LICENSE:
     * license/LICENSE.bouncycastle.txt (MIT License)
   * HOMEPAGE:
-    * http://www.bouncycastle.org/
+    * https://www.bouncycastle.org/
 
-This product optionally depends on 'SLF4J', a simple logging facade for Java,
-which can be obtained at:
+This product optionally depends on 'Snappy', a compression library produced
+by Google Inc, which can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.slf4j.txt (MIT License)
+    * license/LICENSE.snappy.txt (New BSD License)
   * HOMEPAGE:
-    * http://www.slf4j.org/
+    * https://github.com/google/snappy
+
+This product optionally depends on 'JBoss Marshalling', an alternative Java
+serialization API, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jboss-marshalling.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/jboss-remoting/jboss-marshalling
+
+This product optionally depends on 'Caliper', Google's micro-
+benchmarking framework, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.caliper.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/google/caliper
 
 This product optionally depends on 'Apache Commons Logging', a logging
 framework, which can be obtained at:
@@ -79,61 +178,79 @@ framework, which can be obtained at:
   * LICENSE:
     * license/LICENSE.commons-logging.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://commons.apache.org/logging/
+    * https://commons.apache.org/logging/
 
-This product optionally depends on 'Apache Logback', a logging framework,
-which can be obtained at:
+This product optionally depends on 'Apache Log4J', a logging framework, which
+can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.logback.txt (Eclipse Public License 1.0)
+    * license/LICENSE.log4j.txt (Apache License 2.0)
   * HOMEPAGE:
-    * https://logback.qos.ch/
+    * https://logging.apache.org/log4j/
 
-This product optionally depends on 'JBoss Logging', a logging framework,
-which can be obtained at:
+This product optionally depends on 'Aalto XML', an ultra-high performance
+non-blocking XML processor, which can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.jboss-logging.txt (GNU LGPL 2.1)
+    * license/LICENSE.aalto-xml.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://anonsvn.jboss.org/repos/common/common-logging-spi/
+    * https://wiki.fasterxml.com/AaltoHome
 
-This product optionally depends on 'Apache Felix', an open source OSGi
-framework implementation, which can be obtained at:
+This product contains a modified version of 'HPACK', a Java implementation of
+the HTTP/2 HPACK algorithm written by Twitter. It can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.felix.txt (Apache License 2.0)
+    * license/LICENSE.hpack.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://felix.apache.org/
+    * https://github.com/twitter/hpack
 
-The bundled library Metrics Core NOTICE file reports the following items
+This product contains a modified version of 'HPACK', a Java implementation of
+the HTTP/2 HPACK algorithm written by Cory Benfield. It can be obtained at:
 
-Metrics
-Copyright 2010-2013 Coda Hale and Yammer, Inc.
+  * LICENSE:
+    * license/LICENSE.hyper-hpack.txt (MIT License)
+  * HOMEPAGE:
+    * https://github.com/python-hyper/hpack/
 
-This product includes software developed by Coda Hale and Yammer, Inc.
+This product contains a modified version of 'HPACK', a Java implementation of
+the HTTP/2 HPACK algorithm written by Tatsuhiro Tsujikawa. It can be obtained at:
 
-This product includes code derived from the JSR-166 project (ThreadLocalRandom, Striped64,
-LongAdder), which was released with the following comments:
+  * LICENSE:
+    * license/LICENSE.nghttp2-hpack.txt (MIT License)
+  * HOMEPAGE:
+    * https://github.com/nghttp2/nghttp2/
 
-    Written by Doug Lea with assistance from members of JCP JSR-166
-    Expert Group and released to the public domain, as explained at
-    http://creativecommons.org/publicdomain/zero/1.0/
+This product contains a modified portion of 'Apache Commons Lang', a Java library
+provides utilities for the java.lang API, which can be obtained at:
 
-The Nappy Java NOTICE file reports the following items:
+  * LICENSE:
+    * license/LICENSE.commons-lang.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://commons.apache.org/proper/commons-lang/
 
-This product includes software developed by Google
- Snappy: http://code.google.com/p/snappy/ (New BSD License)
 
-This product includes software developed by Apache
- PureJavaCrc32C from apache-hadoop-common http://hadoop.apache.org/
- (Apache 2.0 license)
+This product contains the Maven wrapper scripts from 'Maven Wrapper', that provides an easy way to ensure a user has everything necessary to run the Maven build.
 
-This library containd statically linked libstdc++. This inclusion is allowed by
-"GCC RUntime Library Exception"
-http://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html
+  * LICENSE:
+    * license/LICENSE.mvn-wrapper.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/takari/maven-wrapper
+
+This product contains the dnsinfo.h header file, that provides a way to retrieve the system DNS configuration on MacOS.
+This private header is also used by Apple's open source
+ mDNSResponder (https://opensource.apple.com/tarballs/mDNSResponder/).
+
+ * LICENSE:
+    * license/LICENSE.dnsinfo.txt (Apple Public Source License 2.0)
+  * HOMEPAGE:
+    * https://www.opensource.apple.com/source/configd/configd-453.19/dnsinfo/dnsinfo.h
+
+This product optionally depends on 'Brotli4j', Brotli compression and
+decompression for Java., which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.brotli4j.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/hyperxpro/Brotli4j
 
-== Contributors ==
-  * Tatu Saloranta
-    * Providing benchmark suite
-  * Alec Wysoker
-    * Performance and memory usage improvement
+---------------- end of netty NOTICE file ----------------
\ No newline at end of file
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.86.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.86.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.86.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.86.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.86.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.86.Final.LICENSE.txt

From f26d9b7a84e6ce2d2269a9011ce46b6d28b430e1 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Fri, 20 Jan 2023 14:19:02 +0100
Subject: [PATCH 336/591] [ZOOKEEPER-4659] Upgrade commons-cli to 1.5.0 (#1970)

---
 pom.xml                                                         | 2 +-
 ...ommons-cli-1.4.LICENSE.txt => commons-cli-1.5.0.LICENSE.txt} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 mode change 100755 => 100644 pom.xml
 rename zookeeper-server/src/main/resources/lib/{commons-cli-1.4.LICENSE.txt => commons-cli-1.5.0.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
old mode 100755
new mode 100644
index 232584547a7..2528c271958
--- a/pom.xml
+++ b/pom.xml
@@ -557,7 +557,7 @@
     <junit-platform.version>1.6.2</junit-platform.version>
     <mockito.version>3.6.28</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
-    <commons-cli.version>1.4</commons-cli.version>
+    <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.86.Final</netty.version>
     <jetty.version>9.4.49.v20220914</jetty.version>
     <jackson.version>2.13.2.1</jackson.version>
diff --git a/zookeeper-server/src/main/resources/lib/commons-cli-1.4.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-cli-1.5.0.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/commons-cli-1.4.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/commons-cli-1.5.0.LICENSE.txt

From 3e7f551bb9372c87930a4490c8572d976dba976f Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Mon, 23 Jan 2023 09:33:19 +0100
Subject: [PATCH 337/591] [ZOOKEEPER-4661] Upgrade Jackson Databind to 2.13.4.2
 for CVE-2022-42003 CVE-2022-42004 (#1972)

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2528c271958..8deb1ef3b71 100644
--- a/pom.xml
+++ b/pom.xml
@@ -560,7 +560,7 @@
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.86.Final</netty.version>
     <jetty.version>9.4.49.v20220914</jetty.version>
-    <jackson.version>2.13.2.1</jackson.version>
+    <jackson.version>2.13.4.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.7.7</snappy.version>
     <kerby.version>2.0.0</kerby.version>

From 43647aa5caa812041bd9f1141f5f02a467c7f360 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Mon, 23 Jan 2023 09:36:39 +0100
Subject: [PATCH 338/591] [ZOOKEEPER-4660] Suppress false positive OWASP
 failure for CVE-2021-37533 (#1971)

---
 owaspSuppressions.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 0890bfef4d0..70203213232 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -22,6 +22,10 @@
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>
    </suppress>
+   <suppress>
+      <!-- ZOOKEEPER-4660 -->
+      <cve>CVE-2021-37533</cve>
+   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3262 -->
       <cve>CVE-2018-8012</cve>

From daea9e300f2332134600b1088265bae7b02d5383 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Tue, 24 Jan 2023 09:16:10 +0100
Subject: [PATCH 339/591] Revert "ZOOKEEPER-1875: NullPointerException in
 ClientCnxn$EventThread.processEvent"

This reverts commit 86690ff40cb5c9f5782f0971db16e8fd1c3528e6.
---
 .../java/org/apache/zookeeper/ZooKeeper.java  | 78 +++----------------
 .../org/apache/zookeeper/ZooKeeperTest.java   | 23 ------
 .../server/quorum/QuorumDigestTest.java       |  2 +-
 .../zookeeper/test/ObserverMasterTest.java    |  2 +-
 4 files changed, 13 insertions(+), 92 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 281355b1ac4..127f5a2a3f3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -442,12 +442,7 @@ public boolean isConnected() {
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *             if an invalid chroot path is specified
      */
     public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) throws IOException {
         this(connectString, sessionTimeout, watcher, false);
@@ -496,12 +491,7 @@ public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) thro
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *             if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -566,12 +556,7 @@ public ZooKeeper(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *             if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -639,12 +624,7 @@ public ZooKeeper(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *             if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -660,7 +640,6 @@ public ZooKeeper(
             sessionTimeout,
             watcher);
 
-        validateWatcher(watcher);
         this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         this.hostProvider = hostProvider;
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
@@ -745,12 +724,7 @@ ClientCnxn createConnection(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *             if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -812,12 +786,7 @@ public ZooKeeper(
      * @throws IOException
      *             in cases of network failure
      * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *             if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -883,13 +852,8 @@ public ZooKeeper(
      *            password for this session
      *
      * @throws IOException in cases of network failure
-     * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     * @throws IllegalArgumentException if an invalid chroot path is specified
+     * @throws IllegalArgumentException for an invalid list of ZooKeeper hosts
      */
     public ZooKeeper(
         String connectString,
@@ -962,13 +926,7 @@ public ZooKeeper(
      * @param aHostProvider
      *            use this as HostProvider to enable custom behaviour.
      * @throws IOException in cases of network failure
-     * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     * @throws IllegalArgumentException if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -1055,12 +1013,7 @@ public ZooKeeper(
      *            configuring properties differently compared to other instances
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     *
      * @since 3.5.5
      */
     public ZooKeeper(
@@ -1081,7 +1034,6 @@ public ZooKeeper(
             Long.toHexString(sessionId),
             (sessionPasswd == null ? "<null>" : "<hidden>"));
 
-        validateWatcher(watcher);
         this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
         this.hostProvider = hostProvider;
@@ -1159,13 +1111,7 @@ public ZooKeeper(
      *            allowed while write requests are not. It continues seeking for
      *            majority in the background.
      * @throws IOException in cases of network failure
-     * @throws IllegalArgumentException
-     *             if any of the following is true:
-     *             <ul>
-     *             <li> if an invalid chroot path is specified
-     *             <li> for an invalid list of ZooKeeper hosts
-     *             <li> watcher is null
-     *             </ul>
+     * @throws IllegalArgumentException if an invalid chroot path is specified
      */
     public ZooKeeper(
         String connectString,
@@ -1248,10 +1194,8 @@ public void addAuthInfo(String scheme, byte[] auth) {
     /**
      * Specify the default watcher for the connection (overrides the one
      * specified during construction).
-     * @throws IllegalArgumentException if watcher is null
      */
     public synchronized void register(Watcher watcher) {
-        validateWatcher(watcher);
         getWatchManager().setDefaultWatcher(watcher);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 9d45802bbfc..c829e85da2a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -815,27 +815,4 @@ public void testKeeperExceptionCreateNPE() {
         assertThrows(IllegalArgumentException.class, () -> KeeperException.create(Code.get(Integer.MAX_VALUE)));
     }
 
-    @Test
-    public void testInvalidWatcherRegistration() throws Exception {
-        String nullWatcherMsg = "Invalid Watcher, shouldn't be null!";
-        final ZooKeeper zk = createClient();
-        try {
-            zk.register(null);
-            fail("Should validate null watcher!");
-        } catch (IllegalArgumentException iae) {
-            assertEquals(nullWatcherMsg, iae.getMessage());
-        }
-        try {
-            new ZooKeeper(hostPort, 10000, null, false);
-            fail("Should validate null watcher!");
-        } catch (IllegalArgumentException iae) {
-            assertEquals(nullWatcherMsg, iae.getMessage());
-        }
-        try {
-            new ZooKeeper(hostPort, 10000, null, 10L, "".getBytes(), false);
-            fail("Should validate null watcher!");
-        } catch (IllegalArgumentException iae) {
-            assertEquals(nullWatcherMsg, iae.getMessage());
-        }
-    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
index a9e65a44574..af2fed8cf88 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
@@ -204,7 +204,7 @@ private void startServers(List<Integer> sids) throws InterruptedException {
 
     private void triggerOps(int sid, String prefix) throws Exception {
         TxnLogDigestTest.performOperations(servers.zk[sid], prefix);
-        servers.restartClient(sid, event -> { });
+        servers.restartClient(sid, null);
         waitForOne(servers.zk[sid], States.CONNECTED);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index 68349540760..ffd65997866 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -213,7 +213,7 @@ public void testRevalidation(boolean testObserverMaster) throws Exception {
     public void testInOrderCommits(boolean testObserverMaster) throws Exception {
         setUp(-1, testObserverMaster);
 
-        zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, event -> { });
+        zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, null);
         for (int i = 0; i < 10; i++) {
             zk.create("/bulk"
                               + i, ("Initial data of some size").getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);

From 778c4519e676278d2b76330df6e60032437a9973 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 25 Jan 2023 09:45:55 +0100
Subject: [PATCH 340/591] [ZOOKEEPER-4666] Fix license files for Netty: some
 files are for 4.1.76 and some other files are for 4.1.86 (#1974)

---
 ...76.Final.LICENSE.txt => netty-common-4.1.86.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-transport-4.1.86.Final.LICENSE.txt} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.76.Final.LICENSE.txt => netty-common-4.1.86.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.76.Final.LICENSE.txt => netty-transport-4.1.86.Final.LICENSE.txt} (100%)

diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.86.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.76.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.86.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.76.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.86.Final.LICENSE.txt

From d35bdfb9d3a4bc3d94f22785604418d4f650365d Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Thu, 26 Jan 2023 09:12:14 -0800
Subject: [PATCH 341/591] ZOOKEEPER-4571: Admin server API for restore database
 from a snapshot (#1961)

Provides a restore command for restoring database from a snapshot

Author: Li Wang <liwang@apple.com>

Co-authored-by: liwang <liwang@apple.com>
---
 .../main/resources/markdown/zookeeperAdmin.md |  23 +-
 .../zookeeper/server/ServerMetrics.java       |  18 ++
 .../apache/zookeeper/server/ZKDatabase.java   |  40 ++++
 .../zookeeper/server/ZooKeeperServer.java     |  82 ++++++-
 .../zookeeper/server/admin/Command.java       |  26 +-
 .../zookeeper/server/admin/Commands.java      | 222 +++++++++++++-----
 .../zookeeper/server/admin/GetCommand.java    |  43 ++++
 .../server/admin/JettyAdminServer.java        |  57 ++++-
 .../zookeeper/server/admin/PostCommand.java   |  37 +++
 .../server/persistence/FileSnap.java          |   2 +-
 .../server/persistence/SnapStream.java        |   2 +-
 .../java/org/apache/zookeeper/ZKTestCase.java |   4 +-
 .../server/ZookeeperServerRestoreTest.java    | 141 +++++++++++
 .../ZookeeperServerSnapshotTest.java}         |  55 ++---
 .../zookeeper/server/admin/CommandsTest.java  |  85 +++++--
 .../server/admin/JettyAdminServerTest.java    |   2 +-
 ...ava => SnapshotAndRestoreCommandTest.java} | 212 +++++++++++++++--
 .../zookeeper/test/ObserverMasterTest.java    |   2 +-
 18 files changed, 891 insertions(+), 162 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
 rename zookeeper-server/src/test/java/org/apache/zookeeper/{TakeSnapshotTest.java => server/ZookeeperServerSnapshotTest.java} (68%)
 rename zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/{SnapshotCommandTest.java => SnapshotAndRestoreCommandTest.java} (56%)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index b4c01d35d05..636c6cde227 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2115,16 +2115,22 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
 **New in 3.9.0:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
 
+* *admin.rateLimiterIntervalInMS* :
+  (Java system property: **zookeeper.admin.rateLimiterIntervalInMS**)
+  The time interval for rate limiting admin command to protect the server.
+  Defaults to 5 mins.
+
 * *admin.snapshot.enabled* :
   (Java system property: **zookeeper.admin.snapshot.enabled**)
   The flag for enabling the snapshot command. Defaults to false. 
   It will be enabled by default once the auth support for admin server commands 
   is available.
-
-* *admin.snapshot.intervalInMS* :
-  (Java system property: **zookeeper.admin.snapshot.intervalInMS**)
-  The time interval for rate limiting snapshot command to protect the server.
-  Defaults to 5 mins.
+  
+* *admin.restore.enabled* :
+  (Java system property: **zookeeper.admin.restore.enabled**)
+  The flag for enabling the restore command. Defaults to false.
+  It will be enabled by default once the auth support for admin server commands
+  is available.
 
 **New in 3.7.1:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
@@ -2641,6 +2647,13 @@ Available commands include:
     Reset all observer connection statistics. Companion command to *observers*.
     No new fields returned.
 
+* *restore/rest* :
+  Restore database from snapshot input stream on the current server.
+  Returns the following data in response payload:
+  "last_zxid": String
+  Note: this API is rate-limited (once every 5 mins by default) to protect the server
+  from being over-loaded.  
+
 * *ruok* :
     No-op command, check if the server is running.
     A response does not necessarily indicate that the
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index ef28e32e131..e3476ff6dd7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -74,6 +74,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         SNAPSHOT_TIME = metricsContext.getSummary("snapshottime", DetailLevel.BASIC);
         SNAPSHOT_ERROR_COUNT = metricsContext.getCounter("snapshot_error_count");
         SNAPSHOT_RATE_LIMITED_COUNT = metricsContext.getCounter("snapshot_rate_limited_count");
+        RESTORE_TIME = metricsContext.getSummary("restore_time", DetailLevel.BASIC);
+        RESTORE_ERROR_COUNT = metricsContext.getCounter("restore_error_count");
+        RESTORE_RATE_LIMITED_COUNT = metricsContext.getCounter("restore_rate_limited_count");
         DB_INIT_TIME = metricsContext.getSummary("dbinittime", DetailLevel.BASIC);
         READ_LATENCY = metricsContext.getSummary("readlatency", DetailLevel.ADVANCED);
         UPDATE_LATENCY = metricsContext.getSummary("updatelatency", DetailLevel.ADVANCED);
@@ -288,6 +291,21 @@ private ServerMetrics(MetricsProvider metricsProvider) {
      */
     public final Counter SNAPSHOT_RATE_LIMITED_COUNT;
 
+    /**
+     * Restore time
+     */
+    public final Summary RESTORE_TIME;
+
+    /**
+     * Restore error count
+     */
+    public final Counter RESTORE_ERROR_COUNT;
+
+    /**
+     * Restore rate limited count
+     */
+    public final Counter RESTORE_RATE_LIMITED_COUNT;
+
     /**
      * Db init time (snapshot loading + txnlog replay)
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index 05ada8ceebe..f20af88d588 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -36,6 +36,7 @@
 import java.util.concurrent.locks.ReentrantReadWriteLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock.ReadLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock.WriteLock;
+import java.util.zip.CheckedInputStream;
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
@@ -48,8 +49,10 @@
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.DataTree.ProcessTxnResult;
+import org.apache.zookeeper.server.persistence.FileSnap;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.PlayBackListener;
+import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
 import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
@@ -620,6 +623,43 @@ public void deserializeSnapshot(InputArchive ia) throws IOException {
         initialized = true;
     }
 
+    /**
+     * Deserialize a snapshot that contains FileHeader from an input archive. It is used by
+     * the admin restore command.
+     *
+     * @param ia the input archive to deserialize from
+     * @param is the CheckInputStream to check integrity
+     *
+     * @throws IOException
+     */
+    public void deserializeSnapshot(final InputArchive ia, final CheckedInputStream is) throws IOException {
+        clear();
+
+        // deserialize data tree
+        final DataTree dataTree = getDataTree();
+        final FileSnap filesnap = new FileSnap(snapLog.getSnapDir());
+        filesnap.deserialize(dataTree, getSessionWithTimeOuts(), ia);
+        SnapStream.checkSealIntegrity(is, ia);
+
+        // deserialize digest and check integrity
+        if (dataTree.deserializeZxidDigest(ia, 0)) {
+            SnapStream.checkSealIntegrity(is, ia);
+        }
+
+        // deserialize lastProcessedZxid and check integrity
+        if (dataTree.deserializeLastProcessedZxid(ia)) {
+            SnapStream.checkSealIntegrity(is, ia);
+        }
+
+        // compare the digest to find inconsistency
+        if (dataTree.getDigestFromLoadedSnapshot() != null) {
+            dataTree.compareSnapshotDigests(dataTree.lastProcessedZxid);
+        }
+
+        initialized = true;
+    }
+
+
     /**
      * serialize the snapshot
      * @param oa the output archive to which the snapshot needs to be serialized
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index d61f269c9f6..bbb0f7feeb8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -19,9 +19,11 @@
 package org.apache.zookeeper.server;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.PrintWriter;
 import java.nio.ByteBuffer;
 import java.util.ArrayDeque;
@@ -34,11 +36,16 @@
 import java.util.Properties;
 import java.util.Random;
 import java.util.Set;
+import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.BiConsumer;
+import java.util.zip.Adler32;
+import java.util.zip.CheckedInputStream;
 import javax.security.sasl.SaslException;
+import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.InputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.KeeperException;
@@ -127,6 +134,7 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
     // this feature is confirmed to be stable
     public static final String CLOSE_SESSION_TXN_ENABLED = "zookeeper.closeSessionTxn.enabled";
     private static boolean closeSessionTxnEnabled = true;
+    private volatile CountDownLatch restoreLatch;
 
     static {
         LOG = LoggerFactory.getLogger(ZooKeeperServer.class);
@@ -541,12 +549,12 @@ public void loadData() throws IOException, InterruptedException {
         takeSnapshot();
     }
 
-    public void takeSnapshot() throws IOException {
-        takeSnapshot(false);
+    public File takeSnapshot() throws IOException {
+        return takeSnapshot(false);
     }
 
-    public void takeSnapshot(boolean syncSnap) throws IOException {
-        takeSnapshot(syncSnap, true, false);
+    public File takeSnapshot(boolean syncSnap) throws IOException {
+        return takeSnapshot(syncSnap, true, false);
     }
 
     /**
@@ -583,6 +591,61 @@ public synchronized File takeSnapshot(boolean syncSnap, boolean isSevere, boolea
         return snapFile;
     }
 
+    /**
+     * Restores database from a snapshot. It is used by the restore admin server command.
+     *
+     * @param inputStream input stream of snapshot
+     * @Return last processed zxid
+     * @throws IOException
+     */
+    public synchronized long restoreFromSnapshot(final InputStream inputStream) throws IOException {
+        if (inputStream == null) {
+            throw new IllegalArgumentException("InputStream can not be null when restoring from snapshot");
+        }
+
+        long start = Time.currentElapsedTime();
+        LOG.info("Before restore database. lastProcessedZxid={}, nodeCount={}，sessionCount={}",
+            getZKDatabase().getDataTreeLastProcessedZxid(),
+            getZKDatabase().dataTree.getNodeCount(),
+            getZKDatabase().getSessionCount());
+
+        // restore to a new zkDatabase
+        final ZKDatabase newZKDatabase = new ZKDatabase(this.txnLogFactory);
+        final CheckedInputStream cis = new CheckedInputStream(new BufferedInputStream(inputStream), new Adler32());
+        final InputArchive ia = BinaryInputArchive.getArchive(cis);
+        newZKDatabase.deserializeSnapshot(ia, cis);
+        LOG.info("Restored to a new database. lastProcessedZxid={}, nodeCount={}, sessionCount={}",
+            newZKDatabase.getDataTreeLastProcessedZxid(),
+            newZKDatabase.dataTree.getNodeCount(),
+            newZKDatabase.getSessionCount());
+
+        // create a CountDownLatch
+        restoreLatch = new CountDownLatch(1);
+
+        try {
+            // set to the new zkDatabase
+            setZKDatabase(newZKDatabase);
+
+            // re-create SessionTrack
+            createSessionTracker();
+        } finally {
+            // unblock request submission
+            restoreLatch.countDown();
+            restoreLatch = null;
+        }
+
+        LOG.info("After restore database. lastProcessedZxid={}, nodeCount={}, sessionCount={}",
+                getZKDatabase().getDataTreeLastProcessedZxid(),
+                getZKDatabase().dataTree.getNodeCount(),
+                getZKDatabase().getSessionCount());
+
+        long elapsed = Time.currentElapsedTime() - start;
+        LOG.info("Restore taken in {} ms", elapsed);
+        ServerMetrics.getMetrics().RESTORE_TIME.add(elapsed);
+
+        return getLastProcessedZxid();
+    }
+
     public boolean shouldForceWriteInitialSnapshotAfterLeaderElection() {
         return txnLogFactory.shouldForceWriteInitialSnapshotAfterLeaderElection();
     }
@@ -826,6 +889,9 @@ protected void startSessionTracker() {
      * <li>During shutdown the server sets the state to SHUTDOWN, which
      * corresponds to the server not running.</li></ul>
      *
+     * <li>During maintenance (e.g. restore) the server sets the state to MAINTENANCE
+     * </li></ul>
+     *
      * @param state new server state.
      */
     protected void setState(State state) {
@@ -1151,6 +1217,14 @@ protected void setLocalSessionFlag(Request si) {
     }
 
     public void submitRequest(Request si) {
+        if (restoreLatch != null) {
+            try {
+                LOG.info("Blocking request submission while restore is in progress");
+                restoreLatch.await();
+            } catch (final InterruptedException e) {
+                LOG.warn("Unexpected interruption", e);
+            }
+        }
         enqueueRequest(si);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
index b422715bf2f..5d06356b20c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.admin;
 
+import java.io.InputStream;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.server.ZooKeeperServer;
@@ -57,19 +58,34 @@ public interface Command {
     boolean isServerRequired();
 
     /**
-     * Run this command. Commands take a ZooKeeperServer and String-valued
-     * keyword arguments and return a map containing any information
+     * Run this command for HTTP GET request. Commands take a ZooKeeperServer, String-valued keyword
+     * arguments and return a CommandResponse object containing any information
      * constituting the response to the command. Commands are responsible for
      * parsing keyword arguments and performing any error handling if necessary.
      * Errors should be reported by setting the "error" entry of the returned
      * map with an appropriate message rather than throwing an exception.
      *
-     * @param zkServer
+     * @param zkServer ZooKeeper server
      * @param kwargs keyword -&gt; argument value mapping
-     * @return Map representing response to command containing at minimum:
+     * @return CommandResponse representing response to command containing at minimum:
      *    - "command" key containing the command's primary name
      *    - "error" key containing a String error message or null if no error
      */
-    CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs);
+    CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs);
 
+    /**
+     * Run this command for HTTP POST. Commands take a ZooKeeperServer and InputStream and
+     * return a CommandResponse object containing any information
+     * constituting the response to the command. Commands are responsible for
+     * parsing keyword arguments and performing any error handling if necessary.
+     * Errors should be reported by setting the "error" entry of the returned
+     * map with an appropriate message rather than throwing an exception.
+     *
+     * @param zkServer ZooKeeper server
+     * @param inputStream InputStream from request
+     * @return CommandResponse representing response to command containing at minimum:
+     *    - "command" key containing the command's primary name
+     *    - "error" key containing a String error message or null if no error
+     */
+     CommandResponse runPost(ZooKeeperServer zkServer, InputStream inputStream);
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 848583a0f54..1911b5a57ab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -23,6 +23,7 @@
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.InputStream;
 import java.net.InetSocketAddress;
 import java.util.Arrays;
 import java.util.Collections;
@@ -73,6 +74,8 @@
 public class Commands {
 
     static final Logger LOG = LoggerFactory.getLogger(Commands.class);
+    static final String ADMIN_RATE_LIMITER_INTERVAL = "zookeeper.admin.rateLimiterIntervalInMS";
+    private static final long rateLimiterInterval = Integer.parseInt(System.getProperty(ADMIN_RATE_LIMITER_INTERVAL, "300000"));
 
     /** Maps command names to Command instances */
     private static Map<String, Command> commands = new HashMap<String, Command>();
@@ -100,16 +103,16 @@ public static void registerCommand(Command command) {
      *
      * @param cmdName
      * @param zkServer
-     * @param kwargs String-valued keyword arguments to the command
+     * @param kwargs String-valued keyword arguments to the command from HTTP GET request
      *        (may be null if command requires no additional arguments)
      * @return Map representing response to command containing at minimum:
      *    - "command" key containing the command's primary name
      *    - "error" key containing a String error message or null if no error
      */
-    public static CommandResponse runCommand(
-        String cmdName,
-        ZooKeeperServer zkServer,
-        Map<String, String> kwargs) {
+    public static CommandResponse runGetCommand(
+            String cmdName,
+            ZooKeeperServer zkServer,
+            Map<String, String> kwargs) {
         Command command = getCommand(cmdName);
         if (command == null) {
             // set the status code to 200 to keep the current behavior of existing commands
@@ -119,7 +122,36 @@ public static CommandResponse runCommand(
             // set the status code to 200 to keep the current behavior of existing commands
             return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests", HttpServletResponse.SC_OK);
         }
-        return command.run(zkServer, kwargs);
+        return command.runGet(zkServer, kwargs);
+    }
+
+    /**
+     * Run the registered command with name cmdName. Commands should not produce
+     * any exceptions; any (anticipated) errors should be reported in the
+     * "error" entry of the returned map. Likewise, if no command with the given
+     * name is registered, this will be noted in the "error" entry.
+     *
+     * @param cmdName
+     * @param zkServer
+     * @param inputStream InputStream from HTTP POST request
+     * @return Map representing response to command containing at minimum:
+     *    - "command" key containing the command's primary name
+     *    - "error" key containing a String error message or null if no error
+     */
+    public static CommandResponse runPostCommand(
+            String cmdName,
+            ZooKeeperServer zkServer,
+            InputStream inputStream) {
+        Command command = getCommand(cmdName);
+        if (command == null) {
+            // set the status code to 200 to keep the current behavior of existing commands
+            return new CommandResponse(cmdName, "Unknown command: " + cmdName, HttpServletResponse.SC_OK);
+        }
+        if (command.isServerRequired() && (zkServer == null || !zkServer.isRunning())) {
+            // set the status code to 200 to keep the current behavior of existing commands
+            return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests", HttpServletResponse.SC_OK);
+        }
+        return command.runPost(zkServer, inputStream);
     }
 
     /**
@@ -152,6 +184,7 @@ public static Command getCommand(String cmdName) {
         registerCommand(new LeaderCommand());
         registerCommand(new MonitorCommand());
         registerCommand(new ObserverCnxnStatResetCommand());
+        registerCommand(new RestoreCommand());
         registerCommand(new RuokCommand());
         registerCommand(new SetTraceMaskCommand());
         registerCommand(new SnapshotCommand());
@@ -170,14 +203,14 @@ public static Command getCommand(String cmdName) {
     /**
      * Reset all connection statistics.
      */
-    public static class CnxnStatResetCommand extends CommandBase {
+    public static class CnxnStatResetCommand extends GetCommand {
 
         public CnxnStatResetCommand() {
             super(Arrays.asList("connection_stat_reset", "crst"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             zkServer.getServerCnxnFactory().resetAllConnectionStats();
             return response;
@@ -190,14 +223,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Server configuration parameters.
      * @see ZooKeeperServer#getConf()
      */
-    public static class ConfCommand extends CommandBase {
+    public static class ConfCommand extends GetCommand {
 
         public ConfCommand() {
             super(Arrays.asList("configuration", "conf", "config"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.putAll(zkServer.getConf().toMap());
             return response;
@@ -210,14 +243,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "connections": list of connection info objects
      * @see org.apache.zookeeper.server.ServerCnxn#getConnectionInfo(boolean)
      */
-    public static class ConsCommand extends CommandBase {
+    public static class ConsCommand extends GetCommand {
 
         public ConsCommand() {
             super(Arrays.asList("connections", "cons"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             ServerCnxnFactory serverCnxnFactory = zkServer.getServerCnxnFactory();
             if (serverCnxnFactory != null) {
@@ -239,14 +272,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Information on ZK datadir and snapdir size in bytes
      */
-    public static class DirsCommand extends CommandBase {
+    public static class DirsCommand extends GetCommand {
 
         public DirsCommand() {
             super(Arrays.asList("dirs"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("datadir_size", zkServer.getDataDirSize());
             response.put("logdir_size", zkServer.getLogDirSize());
@@ -264,14 +297,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * @see ZooKeeperServer#getSessionExpiryMap()
      * @see ZooKeeperServer#getEphemerals()
      */
-    public static class DumpCommand extends CommandBase {
+    public static class DumpCommand extends GetCommand {
 
         public DumpCommand() {
             super(Arrays.asList("dump"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("expiry_time_to_session_ids", zkServer.getSessionExpiryMap());
             response.put("session_id_to_ephemeral_paths", zkServer.getEphemerals());
@@ -283,14 +316,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * All defined environment variables.
      */
-    public static class EnvCommand extends CommandBase {
+    public static class EnvCommand extends GetCommand {
 
         public EnvCommand() {
             super(Arrays.asList("environment", "env", "envi"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             for (Entry e : Environment.list()) {
                 response.put(e.getKey(), e.getValue());
@@ -303,14 +336,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Digest histories for every specific number of txns.
      */
-    public static class DigestCommand extends CommandBase {
+    public static class DigestCommand extends GetCommand {
 
         public DigestCommand() {
             super(Arrays.asList("hash"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("digests", zkServer.getZKDatabase().getDataTree().getDigestLog());
             return response;
@@ -322,14 +355,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * The current trace mask. Returned map contains:
      *   - "tracemask": Long
      */
-    public static class GetTraceMaskCommand extends CommandBase {
+    public static class GetTraceMaskCommand extends GetCommand {
 
         public GetTraceMaskCommand() {
             super(Arrays.asList("get_trace_mask", "gtmk"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("tracemask", ZooTrace.getTextTraceLevel());
             return response;
@@ -337,14 +370,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
-    public static class InitialConfigurationCommand extends CommandBase {
+    public static class InitialConfigurationCommand extends GetCommand {
 
         public InitialConfigurationCommand() {
             super(Arrays.asList("initial_configuration", "icfg"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("initial_configuration", zkServer.getInitialConfig());
             return response;
@@ -356,14 +389,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Is this server in read-only mode. Returned map contains:
      *   - "is_read_only": Boolean
      */
-    public static class IsroCommand extends CommandBase {
+    public static class IsroCommand extends GetCommand {
 
         public IsroCommand() {
             super(Arrays.asList("is_read_only", "isro"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("read_only", zkServer instanceof ReadOnlyZooKeeperServer);
             return response;
@@ -380,14 +413,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "zxid": String
      *   - "timestamp": Long
      */
-    public static class LastSnapshotCommand extends CommandBase {
+    public static class LastSnapshotCommand extends GetCommand {
 
         public LastSnapshotCommand() {
             super(Arrays.asList("last_snapshot", "lsnp"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             SnapshotInfo info = zkServer.getTxnLogFactory().getLastSnapshotInfo();
             response.put("zxid", Long.toHexString(info == null ? -1L : info.zxid));
@@ -400,14 +433,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Returns the leader status of this instance and the leader host string.
      */
-    public static class LeaderCommand extends CommandBase {
+    public static class LeaderCommand extends GetCommand {
 
         public LeaderCommand() {
             super(Arrays.asList("leader", "lead"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof QuorumZooKeeperServer) {
                 response.put("is_leader", zkServer instanceof LeaderZooKeeperServer);
@@ -450,14 +483,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "synced_followers": Integer (leader only)
      *   - "pending_syncs": Integer (leader only)
      */
-    public static class MonitorCommand extends CommandBase {
+    public static class MonitorCommand extends GetCommand {
 
         public MonitorCommand() {
             super(Arrays.asList("monitor", "mntr"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             zkServer.dumpMonitorValues(response::put);
             ServerMetrics.getMetrics().getMetricsProvider().dump(response::put);
@@ -470,14 +503,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Reset all observer connection statistics.
      */
-    public static class ObserverCnxnStatResetCommand extends CommandBase {
+    public static class ObserverCnxnStatResetCommand extends GetCommand {
 
         public ObserverCnxnStatResetCommand() {
             super(Arrays.asList("observer_connection_stat_reset", "orst"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof LeaderZooKeeperServer) {
                 Leader leader = ((LeaderZooKeeperServer) zkServer).getLeader();
@@ -491,17 +524,81 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
+    /**
+     * Restore from snapshot on the current server.
+     *
+     * Returned map contains:
+     *  - "last_zxid": String
+     */
+    public static class RestoreCommand extends PostCommand {
+        static final String RESPONSE_DATA_LAST_ZXID = "last_zxid";
+
+        static final String ADMIN_RESTORE_ENABLED = "zookeeper.admin.restore.enabled";
+
+
+        private RateLimiter rateLimiter;
+
+        public RestoreCommand() {
+            super(Arrays.asList("restore", "rest"));
+            rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MICROSECONDS);
+        }
+
+        @Override
+        public CommandResponse runPost(final ZooKeeperServer zkServer, final InputStream inputStream) {
+            final CommandResponse response = initializeResponse();
+
+            // check feature flag
+            final boolean restoreEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_RESTORE_ENABLED, "false"));
+            if (!restoreEnabled) {
+                response.setStatusCode(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
+                LOG.warn("Restore command is disabled");
+                return response;
+            }
+
+            if (!zkServer.isSerializeLastProcessedZxidEnabled()) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                LOG.warn("Restore command requires serializeLastProcessedZxidEnable flag is set to true");
+                return response;
+            }
+
+            if (inputStream == null){
+                response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                LOG.warn("InputStream from restore request is null");
+                return response;
+            }
+
+            // check rate limiting
+            if (!rateLimiter.allow()) {
+                response.setStatusCode(HttpStatus.TOO_MANY_REQUESTS_429);
+                ServerMetrics.getMetrics().RESTORE_RATE_LIMITED_COUNT.add(1);
+                LOG.warn("Restore request was rate limited");
+                return response;
+            }
+
+            // restore from snapshot InputStream
+            try {
+                final long lastZxid = zkServer.restoreFromSnapshot(inputStream);
+                response.put(RESPONSE_DATA_LAST_ZXID, lastZxid);
+            } catch (final Exception e) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                ServerMetrics.getMetrics().RESTORE_ERROR_COUNT.add(1);
+                LOG.warn("Exception occurred when restore snapshot via the restore command", e);
+            }
+            return response;
+        }
+    }
+
     /**
      * No-op command, check if the server is running
      */
-    public static class RuokCommand extends CommandBase {
+    public static class RuokCommand extends GetCommand {
 
         public RuokCommand() {
             super(Arrays.asList("ruok"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             return initializeResponse();
         }
 
@@ -513,14 +610,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *  Returned Map contains:
      *   - "tracemask": Long
      */
-    public static class SetTraceMaskCommand extends CommandBase {
+    public static class SetTraceMaskCommand extends GetCommand {
 
         public SetTraceMaskCommand() {
             super(Arrays.asList("set_trace_mask", "stmk"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             long traceMask;
             if (!kwargs.containsKey("traceMask")) {
@@ -551,28 +648,25 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "last_zxid": String
      *   - "snapshot_size": String
      */
-    public static class SnapshotCommand extends CommandBase {
+    public static class SnapshotCommand extends GetCommand {
         static final String REQUEST_QUERY_PARAM_STREAMING = "streaming";
 
         static final String RESPONSE_HEADER_LAST_ZXID = "last_zxid";
         static final String RESPONSE_HEADER_SNAPSHOT_SIZE = "snapshot_size";
 
         static final String ADMIN_SNAPSHOT_ENABLED = "zookeeper.admin.snapshot.enabled";
-        static final String ADMIN_SNAPSHOT_INTERVAL = "zookeeper.admin.snapshot.intervalInMS";
-
-        private static final long snapshotInterval = Integer.parseInt(System.getProperty(ADMIN_SNAPSHOT_INTERVAL, "300000"));
 
         private final RateLimiter rateLimiter;
 
         public SnapshotCommand() {
             super(Arrays.asList("snapshot", "snap"));
-            rateLimiter = new RateLimiter(1, snapshotInterval, TimeUnit.MICROSECONDS);
+            rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MICROSECONDS);
         }
 
         @SuppressFBWarnings(value = "OBL_UNSATISFIED_OBLIGATION",
                 justification = "FileInputStream is passed to CommandResponse and closed in StreamOutputter")
         @Override
-        public CommandResponse run(final ZooKeeperServer zkServer, final Map<String, String> kwargs) {
+        public CommandResponse runGet(final ZooKeeperServer zkServer, final Map<String, String> kwargs) {
             final CommandResponse response = initializeResponse();
 
             // check feature flag
@@ -637,7 +731,7 @@ public CommandResponse run(final ZooKeeperServer zkServer, final Map<String, Str
      *   - "server_stats": ServerStats object
      *   - "node_count": Integer
      */
-    public static class SrvrCommand extends CommandBase {
+    public static class SrvrCommand extends GetCommand {
 
         public SrvrCommand() {
             super(Arrays.asList("server_stats", "srvr"));
@@ -649,7 +743,7 @@ protected SrvrCommand(List<String> names) {
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             LOG.info("running stat");
             response.put("version", Version.getFullVersion());
@@ -676,8 +770,8 @@ public StatCommand() {
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
-            CommandResponse response = super.run(zkServer, kwargs);
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+            CommandResponse response = super.runGet(zkServer, kwargs);
 
             final Iterable<Map<String, Object>> connections;
             if (zkServer.getServerCnxnFactory() != null) {
@@ -702,14 +796,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Resets server statistics.
      */
-    public static class StatResetCommand extends CommandBase {
+    public static class StatResetCommand extends GetCommand {
 
         public StatResetCommand() {
             super(Arrays.asList("stat_reset", "srst"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             zkServer.serverStats().reset();
             return response;
@@ -723,14 +817,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "observers": list of observer learner handler info objects (leader/follower only)
      * @see org.apache.zookeeper.server.quorum.LearnerHandler#getLearnerHandlerInfo()
      */
-    public static class SyncedObserverConsCommand extends CommandBase {
+    public static class SyncedObserverConsCommand extends GetCommand {
 
         public SyncedObserverConsCommand() {
             super(Arrays.asList("observers", "obsr"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
 
             CommandResponse response = initializeResponse();
 
@@ -760,14 +854,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * All defined system properties.
      */
-    public static class SystemPropertiesCommand extends CommandBase {
+    public static class SystemPropertiesCommand extends GetCommand {
 
         public SystemPropertiesCommand() {
             super(Arrays.asList("system_properties", "sysp"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             Properties systemProperties = System.getProperties();
             SortedMap<String, String> sortedSystemProperties = new TreeMap<>();
@@ -782,14 +876,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Returns the current ensemble configuration information.
      * It provides list of current voting members in the ensemble.
      */
-    public static class VotingViewCommand extends CommandBase {
+    public static class VotingViewCommand extends GetCommand {
 
         public VotingViewCommand() {
             super(Arrays.asList("voting_view"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof QuorumZooKeeperServer) {
                 QuorumPeer peer = ((QuorumZooKeeperServer) zkServer).self;
@@ -850,14 +944,14 @@ private static String getAddressString(InetSocketAddress address) {
      * @see DataTree#getWatches()
      * @see DataTree#getWatches()
      */
-    public static class WatchCommand extends CommandBase {
+    public static class WatchCommand extends GetCommand {
 
         public WatchCommand() {
             super(Arrays.asList("watches", "wchc"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             DataTree dt = zkServer.getZKDatabase().getDataTree();
             CommandResponse response = initializeResponse();
             response.put("session_id_to_watched_paths", dt.getWatches().toMap());
@@ -871,14 +965,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "path_to_session_ids": Map&lt;String, Set&lt;Long&gt;&gt; path -&gt; session IDs of sessions watching path
      * @see DataTree#getWatchesByPath()
      */
-    public static class WatchesByPathCommand extends CommandBase {
+    public static class WatchesByPathCommand extends GetCommand {
 
         public WatchesByPathCommand() {
             super(Arrays.asList("watches_by_path", "wchp"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             DataTree dt = zkServer.getZKDatabase().getDataTree();
             CommandResponse response = initializeResponse();
             response.put("path_to_session_ids", dt.getWatchesByPath().toMap());
@@ -891,14 +985,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Summarized watch information.
      * @see DataTree#getWatchesSummary()
      */
-    public static class WatchSummaryCommand extends CommandBase {
+    public static class WatchSummaryCommand extends GetCommand {
 
         public WatchSummaryCommand() {
             super(Arrays.asList("watch_summary", "wchs"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             DataTree dt = zkServer.getZKDatabase().getDataTree();
             CommandResponse response = initializeResponse();
             response.putAll(dt.getWatchesSummary().toMap());
@@ -911,14 +1005,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Returns the current phase of Zab protocol that peer is running.
      * It can be in one of these phases: ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST
      */
-    public static class ZabStateCommand extends CommandBase {
+    public static class ZabStateCommand extends GetCommand {
 
         public ZabStateCommand() {
             super(Arrays.asList("zabstate"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof QuorumZooKeeperServer) {
                 QuorumPeer peer = ((QuorumZooKeeperServer) zkServer).self;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
new file mode 100644
index 00000000000..509cad72ea9
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import java.io.InputStream;
+import java.util.List;
+import org.apache.zookeeper.server.ZooKeeperServer;
+
+/**
+ * Command that represents HTTP GET request
+ */
+
+public abstract class GetCommand extends CommandBase {
+
+    protected GetCommand(List<String> names) {
+        super(names);
+    }
+
+    protected GetCommand(List<String> names, boolean serverRequired) {
+        super(names, serverRequired);
+    }
+
+    @Override
+    public CommandResponse runPost(ZooKeeperServer zkServer, InputStream inputStream) {
+        return null;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 3c82f85529a..effececdcbd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -236,6 +236,7 @@ private class CommandServlet extends HttpServlet {
 
         private static final long serialVersionUID = 1L;
 
+        @Override
         protected void doGet(
             HttpServletRequest request,
             HttpServletResponse response) throws ServletException, IOException {
@@ -260,7 +261,7 @@ protected void doGet(
             }
 
             // Run the command
-            final CommandResponse cmdResponse = Commands.runCommand(cmd, zkServer, kwargs);
+            final CommandResponse cmdResponse = Commands.runGetCommand(cmd, zkServer, kwargs);
             response.setStatus(cmdResponse.getStatusCode());
 
             final Map<String, String> headers = cmdResponse.getHeaders();
@@ -280,6 +281,60 @@ protected void doGet(
                 outputter.output(cmdResponse, response.getOutputStream());
             }
         }
+
+        /**
+         * Serves HTTP POST requests. It reads request payload as raw data.
+         * It's up to each command to process the payload accordingly.
+         * For example, RestoreCommand uses the payload InputStream directly
+         * to read snapshot data.
+         */
+        @Override
+        protected void doPost(final HttpServletRequest request,
+                              final HttpServletResponse response) throws ServletException, IOException {
+            final String cmdName = extractCommandNameFromURL(request, response);
+            if (cmdName != null) {
+                final CommandResponse cmdResponse = Commands.runPostCommand(cmdName, zkServer, request.getInputStream());
+                final String clientIP = IPAuthenticationProvider.getClientIPAddress(request);
+                sendJSONResponse(response, cmdResponse, clientIP);
+            }
+        }
+
+        /**
+         * Extracts the command name from URL if it exists otherwise null
+         */
+        private String extractCommandNameFromURL(final HttpServletRequest request,
+                                                 final HttpServletResponse response) throws IOException {
+            String cmd = request.getPathInfo();
+            if (cmd == null || cmd.equals("/")) {
+                printCommandLinks(response);
+                return null;
+            }
+            // Strip leading "/"
+            return cmd.substring(1);
+        }
+
+        /**
+         * Prints the list of URLs to each registered command as response.
+         */
+        private void printCommandLinks(final HttpServletResponse response) throws IOException {
+            for (final String link : commandLinks()) {
+                response.getWriter().println(link);
+                response.getWriter().println("<br/>");
+            }
+        }
+
+        /**
+         * Send JSON string as the response.
+         */
+        private void sendJSONResponse(final HttpServletResponse response,
+                                      final CommandResponse cmdResponse,
+                                      final String clientIP) throws IOException {
+            final CommandOutputter outputter = new JsonOutputter(clientIP);
+
+            response.setStatus(cmdResponse.getStatusCode());
+            response.setContentType(outputter.getContentType());
+            outputter.output(cmdResponse, response.getWriter());
+        }
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
new file mode 100644
index 00000000000..cb346b2e024
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Command that represents HTTP POST request
+ */
+package org.apache.zookeeper.server.admin;
+
+import java.util.List;
+import java.util.Map;
+import org.apache.zookeeper.server.ZooKeeperServer;
+
+public abstract class PostCommand extends CommandBase {
+    protected PostCommand(List<String> names) {
+        super(names);
+    }
+
+    @Override
+    public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        return null;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index 1a91d1c3020..f162f0cc6c1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -99,7 +99,7 @@ public long deserialize(DataTree dt, Map<Long, Integer> sessions) throws IOExcep
                     SnapStream.checkSealIntegrity(snapIS, ia);
                 }
 
-                // deserialize the last processed zxid and check the intact
+                // deserialize lastProcessedZxid and check inconsistency
                 if (dt.deserializeLastProcessedZxid(ia)) {
                     SnapStream.checkSealIntegrity(snapIS, ia);
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
index 9bc8ee5198b..847b12c28ff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
@@ -170,7 +170,7 @@ public static void sealStream(CheckedOutputStream os, OutputArchive oa) throws I
      * the checkSum of the content.
      *
      */
-    static void checkSealIntegrity(CheckedInputStream is, InputArchive ia) throws IOException {
+    public static void checkSealIntegrity(CheckedInputStream is, InputArchive ia) throws IOException {
         long checkSum = is.getChecksum().getValue();
         long val = ia.readLong("val");
         ia.readString("path");  // Read and ignore "/" written by SealStream.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index 826a875b4b7..8d9430e1cf6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -72,8 +72,8 @@ public void starting(TestInfo testInfo) {
         // same port.
         System.setProperty("zookeeper.admin.enableServer", "false");
 
-        // disable rate limiting on the snapshot admin API
-        System.setProperty("zookeeper.admin.snapshot.intervalInMS", "0");
+        // disable rate limiting
+        System.setProperty("zookeeper.admin.rateLimiterIntervalInMS", "0");
 
         // ZOOKEEPER-2693 disables all 4lw by default.
         // Here we enable the 4lw which ZooKeeper tests depends.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
new file mode 100644
index 00000000000..85f514dd72d
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.util.Set;
+import java.util.zip.CheckedInputStream;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.persistence.SnapStream;
+import org.apache.zookeeper.server.persistence.Util;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerRestoreTest extends ZKTestCase {
+    private static final String BASE_PATH = "/restoreFromSnapshotTest";
+    private static final int NODE_COUNT = 10;
+    private static final String HOST_PORT = "127.0.0.1:" + PortAssignment.unique();
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @Test
+    public void testRestoreFromSnapshot() throws Exception {
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+
+        final ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        final int port = Integer.parseInt(HOST_PORT.split(":")[1]);
+        final ServerCnxnFactory serverCnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+
+        ZooKeeper zk1 = null;
+        ZooKeeper zk2 = null;
+        ZooKeeper zk3 = null;
+
+        try {
+            // start the server
+            serverCnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(HOST_PORT, CONNECTION_TIMEOUT));
+
+            // zk1 create test data
+            zk1 = ClientBase.createZKClient(HOST_PORT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                final String path = BASE_PATH + "-" + i;
+                zk1.create(path, String.valueOf(i).getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // take Snapshot
+            final File snapshotFile = zks.takeSnapshot(false, false, true);
+            final long lastZxidFromSnapshot = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
+
+            // zk2 create more test data after snapshotting
+            zk2 = ClientBase.createZKClient(HOST_PORT);
+            for (int i = NODE_COUNT; i < NODE_COUNT * 2; i++) {
+                final String path = BASE_PATH + "-" + i;
+                zk2.create(path, String.valueOf(i).getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // restore from snapshot
+            try (final CheckedInputStream is = SnapStream.getInputStream(snapshotFile)) {
+                final long lastZxidFromRestore = zks.restoreFromSnapshot(is);
+
+                // validate the last processed zxid
+                assertEquals(lastZxidFromSnapshot, lastZxidFromRestore);
+
+                // validate restored data only contains data from snapshot
+                zk3 = ClientBase.createZKClient(HOST_PORT);
+                for (int i = 0; i < NODE_COUNT; i++) {
+                    final String path = BASE_PATH + "-" + i;
+                    final String expectedData = String.valueOf(i);
+                    assertArrayEquals(expectedData.getBytes(), zk3.getData(path, null, null));
+                }
+                assertEquals(NODE_COUNT + 3, zk3.getAllChildrenNumber("/"));
+
+                // validate sessions
+                final SessionTracker sessionTracker = zks.getSessionTracker();
+                final Set<Long> globalSessions = sessionTracker.globalSessions();
+                assertEquals(2, globalSessions.size());
+                assertTrue(globalSessions.contains(zk1.getSessionId()));
+                Assertions.assertFalse(globalSessions.contains(zk2.getSessionId()));
+                assertTrue(globalSessions.contains(zk3.getSessionId()));
+
+                // validate ZookeeperServer state
+                assertEquals(ZooKeeperServer.State.RUNNING, zks.state);
+
+                // validate being able to create more data after restore
+                zk3.create(BASE_PATH + "_" + "after", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                assertEquals(NODE_COUNT + 4, zk3.getAllChildrenNumber("/"));
+            }
+        } finally {
+            System.clearProperty("zookeeper.serializeLastProcessedZxid.enabled");
+
+            if (zk1 != null) {
+                zk1.close();
+            }
+            if (zk2 != null) {
+                zk2.close();
+            }
+            if (zk3 != null) {
+                zk3.close();
+            }
+
+            zks.shutdown();
+            serverCnxnFactory.shutdown();
+        }
+    }
+
+    @Test
+    public void testRestoreFromSnapshot_nulInputStream() throws Exception {
+        final ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        assertThrows(IllegalArgumentException.class, () -> zks.restoreFromSnapshot(null));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
similarity index 68%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
index a9953b7c029..c9d74a4cb05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/TakeSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
@@ -16,26 +16,26 @@
  * limitations under the License.
  */
 
-package org.apache.zookeeper;
+package org.apache.zookeeper.server;
 
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs.Ids;
-import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
-public class TakeSnapshotTest extends ClientBase {
+public class ZookeeperServerSnapshotTest extends ZKTestCase {
     private static final String BASE_PATH = "/takeSnapshotTest";
-    private static final int NODE_COUNT = 100;
-    private static final String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
-    private ZooKeeper zk;
+    private static final int NODE_COUNT = 10;
+    private static final String HOST_PORT = "127.0.0.1:" + PortAssignment.unique();
 
     @TempDir
     static File dataDir;
@@ -43,32 +43,19 @@ public class TakeSnapshotTest extends ClientBase {
     @TempDir
     static File logDir;
 
-
-    @BeforeEach
-    public void setUp() throws Exception {
-        super.setUp();
-        ClientBase.setupTestEnv();
-    }
-
-    @AfterEach
-    public void tearDown() throws Exception {
-        if (zk != null) {
-            zk.close();
-        }
-    }
-
     @Test
-    public void testTakeSnapshotAndRestore() throws Exception {
+    public void testTakeSnapshot() throws Exception {
         ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
         ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
 
-        final int port = Integer.parseInt(HOSTPORT.split(":")[1]);
+        final int port = Integer.parseInt(HOST_PORT.split(":")[1]);
         final ServerCnxnFactory serverCnxnFactory = ServerCnxnFactory.createFactory(port, -1);
-        serverCnxnFactory.startup(zks);
-        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        ZooKeeper zk = null;
+        try  {
+            serverCnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(HOST_PORT, CONNECTION_TIMEOUT));
 
-        try {
-            zk = ClientBase.createZKClient(HOSTPORT);
+            zk = ClientBase.createZKClient(HOST_PORT);
             for (int i = 0; i < NODE_COUNT; i++) {
                 final String path = BASE_PATH + "-" + i;
                 zk.create(path, String.valueOf(i).getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -81,14 +68,14 @@ public void testTakeSnapshotAndRestore() throws Exception {
             zk.close();
             zks.shutdown();
 
-            // start server again and assert the data restored from snapshot
+            // restart server and assert the data restored from snapshot
             zks = new ZooKeeperServer(dataDir, logDir, 3000);
             ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
 
             serverCnxnFactory.startup(zks);
-            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOST_PORT, CONNECTION_TIMEOUT));
 
-            zk = ClientBase.createZKClient(HOSTPORT);
+            zk = ClientBase.createZKClient(HOST_PORT);
             for (int i = 0; i < NODE_COUNT; i++) {
                 final String path = BASE_PATH + "-" + i;
                 final String expectedData = String.valueOf(i);
@@ -96,6 +83,10 @@ public void testTakeSnapshotAndRestore() throws Exception {
             }
             assertEquals(NODE_COUNT + 3, zk.getAllChildrenNumber("/"));
         } finally {
+            if (zk != null) {
+                zk.close();
+            }
+
             zks.shutdown();
             serverCnxnFactory.shutdown();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index 2d74776e317..c60ae868d31 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -19,8 +19,9 @@
 package org.apache.zookeeper.server.admin;
 
 import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
-import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_INTERVAL;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.REQUEST_QUERY_PARAM_STREAMING;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
@@ -30,6 +31,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
@@ -57,6 +59,8 @@ public class CommandsTest extends ClientBase {
      *            - the primary name of the command
      * @param kwargs
      *            - keyword arguments to the command
+     * @param inputStream
+     *            - InputStream to the command
      * @param expectedHeaders
      *            - expected HTTP response headers
      * @param expectedStatusCode
@@ -66,11 +70,12 @@ public class CommandsTest extends ClientBase {
      * @throws IOException
      * @throws InterruptedException
      */
-    private void testCommand(String cmdName, Map<String, String> kwargs,
+    private void testCommand(String cmdName, Map<String, String> kwargs, InputStream inputStream,
                              Map<String, String> expectedHeaders, int expectedStatusCode,
                              Field... fields) throws IOException, InterruptedException {
         ZooKeeperServer zks = serverFactory.getZooKeeperServer();
-        final CommandResponse commandResponse = Commands.runCommand(cmdName, zks, kwargs);
+        final CommandResponse commandResponse = inputStream == null
+        ? Commands.runGetCommand(cmdName, zks, kwargs) : Commands.runPostCommand(cmdName, zks, inputStream);
         assertNotNull(commandResponse);
         assertEquals(expectedStatusCode, commandResponse.getStatusCode());
         try (final InputStream responseStream = commandResponse.getInputStream()) {
@@ -102,7 +107,7 @@ private void testCommand(String cmdName, Map<String, String> kwargs,
     }
 
     public void testCommand(String cmdName, Field... fields) throws IOException, InterruptedException {
-        testCommand(cmdName, new HashMap<String, String>(), new HashMap<>(), HttpServletResponse.SC_OK, fields);
+        testCommand(cmdName, new HashMap<String, String>(), null, new HashMap<>(), HttpServletResponse.SC_OK, fields);
     }
 
     private static class Field {
@@ -115,16 +120,6 @@ private static class Field {
         }
     }
 
-    @Test
-    public void testSnapshot_streaming() throws IOException, InterruptedException {
-        testSnapshot(true);
-    }
-
-    @Test
-    public void testSnapshot_nonStreaming() throws IOException, InterruptedException {
-        testSnapshot(false);
-    }
-
     @Test
     public void testConfiguration() throws IOException, InterruptedException {
         testCommand("configuration", new Field("client_port", Integer.class), new Field("data_dir", String.class), new Field("data_log_dir", String.class), new Field("tick_time", Integer.class), new Field("max_client_cnxns", Integer.class), new Field("min_session_timeout", Integer.class), new Field("max_session_timeout", Integer.class), new Field("server_id", Long.class), new Field("client_port_listen_backlog", Integer.class));
@@ -230,6 +225,45 @@ public void testRuok() throws IOException, InterruptedException {
         testCommand("ruok");
     }
 
+    @Test
+    public void testRestore_invalidInputStream() throws IOException, InterruptedException {
+        setupForRestoreCommand();
+
+        try (final InputStream inputStream = new ByteArrayInputStream("Invalid snapshot data".getBytes())){
+            final Map<String, String> kwargs = new HashMap<>();
+            final Map<String, String> expectedHeaders = new HashMap<>();
+            testCommand("restore", kwargs, inputStream, expectedHeaders, HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+        } finally {
+            clearForRestoreCommand();
+        }
+    }
+
+    @Test
+    public void testRestore_nullInputStream() {
+        setupForRestoreCommand();
+        final ZooKeeperServer zks = serverFactory.getZooKeeperServer();
+        try {
+            final CommandResponse commandResponse = Commands.runPostCommand("restore", zks, null);
+            assertNotNull(commandResponse);
+            assertEquals(HttpServletResponse.SC_BAD_REQUEST, commandResponse.getStatusCode());
+        } finally {
+          clearForRestoreCommand();
+          if (zks != null) {
+              zks.shutdown();
+          }
+        }
+    }
+
+    @Test
+    public void testSnapshot_streaming() throws IOException, InterruptedException {
+        testSnapshot(true);
+    }
+
+    @Test
+    public void testSnapshot_nonStreaming() throws IOException, InterruptedException {
+        testSnapshot(false);
+    }
+
     @Test
     public void testServerStats() throws IOException, InterruptedException {
         testCommand("server_stats", new Field("version", String.class), new Field("read_only", Boolean.class), new Field("server_stats", ServerStats.class), new Field("node_count", Integer.class), new Field("client_response", BufferStats.class));
@@ -239,7 +273,7 @@ public void testServerStats() throws IOException, InterruptedException {
     public void testSetTraceMask() throws IOException, InterruptedException {
         Map<String, String> kwargs = new HashMap<String, String>();
         kwargs.put("traceMask", "1");
-        testCommand("set_trace_mask", kwargs, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
+        testCommand("set_trace_mask", kwargs, null, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
     }
 
     @Test
@@ -289,7 +323,7 @@ public void testConsCommandSecureOnly() {
         when(zkServer.getSecureServerCnxnFactory()).thenReturn(cnxnFactory);
 
         // Act
-        CommandResponse response = cmd.run(zkServer, null);
+        CommandResponse response = cmd.runGet(zkServer, null);
 
         // Assert
         assertThat(response.toMap().containsKey("connections"), is(true));
@@ -313,7 +347,7 @@ public void testStatCommandSecureOnly() {
         when(zkServer.getZKDatabase()).thenReturn(zkDatabase);
         when(zkDatabase.getNodeCount()).thenReturn(0);
 
-        CommandResponse response = cmd.run(zkServer, null);
+        CommandResponse response = cmd.runGet(zkServer, null);
 
         assertThat(response.toMap().containsKey("connections"), is(true));
         assertThat(response.toMap().containsKey("secure_connections"), is(true));
@@ -321,7 +355,7 @@ public void testStatCommandSecureOnly() {
 
     private void testSnapshot(final boolean streaming) throws IOException, InterruptedException {
         System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
-        System.setProperty(ADMIN_SNAPSHOT_INTERVAL, "0");
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
         System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
         try {
             final Map<String, String> kwargs = new HashMap<>();
@@ -329,12 +363,23 @@ private void testSnapshot(final boolean streaming) throws IOException, Interrupt
             final Map<String, String> expectedHeaders = new HashMap<>();
             expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID, "0x0");
             expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE, "478");
-            testCommand("snapshot", kwargs, expectedHeaders, HttpServletResponse.SC_OK);
+            testCommand("snapshot", kwargs, null, expectedHeaders, HttpServletResponse.SC_OK);
         } finally {
             System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
-            System.clearProperty(ADMIN_SNAPSHOT_INTERVAL);
+            System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
             System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
         }
     }
 
+    private void setupForRestoreCommand() {
+        System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+    }
+
+    private void clearForRestoreCommand() {
+        System.clearProperty(ADMIN_RESTORE_ENABLED);
+        System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
+        System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index b06cde6fd20..41f00751a7e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -63,7 +63,7 @@ public class JettyAdminServerTest extends ZKTestCase {
 
     static final String URL_FORMAT = "http://localhost:%d/commands";
     static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
-    static final int jettyAdminPort = PortAssignment.unique();
+    private final int jettyAdminPort = PortAssignment.unique();
 
     @BeforeEach
     public void enableServer() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
similarity index 56%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
index 5b5dbd979ef..f7d357e7227 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
@@ -19,20 +19,22 @@
 package org.apache.zookeeper.server.admin;
 
 import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
-import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_INTERVAL;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.REQUEST_QUERY_PARAM_STREAMING;
 import static org.apache.zookeeper.server.admin.JettyAdminServerTest.URL_FORMAT;
-import static org.apache.zookeeper.server.admin.JettyAdminServerTest.jettyAdminPort;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.BufferedReader;
+import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.io.OutputStream;
 import java.io.UnsupportedEncodingException;
 import java.net.HttpURLConnection;
 import java.net.URL;
@@ -40,6 +42,11 @@
 import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.zip.CheckedInputStream;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -48,8 +55,11 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.common.IOUtils;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
@@ -60,13 +70,14 @@
 import org.slf4j.LoggerFactory;
 
 @TestInstance(TestInstance.Lifecycle.PER_CLASS)
-public class SnapshotCommandTest extends ZKTestCase {
-    private static final Logger LOG = LoggerFactory.getLogger(SnapshotCommandTest.class);
+public class SnapshotAndRestoreCommandTest extends ZKTestCase {
+    private static final Logger LOG = LoggerFactory.getLogger(SnapshotAndRestoreCommandTest.class);
 
-    private static final String PATH = "/snapshot_test";
+    private static final String SNAPSHOT_TEST_PATH = "/snapshot_test";
     private static final int NODE_COUNT = 10;
 
-    private final String hostPort =  "127.0.0.1:" + PortAssignment.unique();
+    private final String hostPort = "127.0.0.1:" + PortAssignment.unique();
+    private final int jettyAdminPort = PortAssignment.unique();
     private ServerCnxnFactory cnxnFactory;
     private JettyAdminServer adminServer;
     private ZooKeeperServer zks;
@@ -91,9 +102,10 @@ public void setup() throws Exception {
         // start AdminServer
         System.setProperty("zookeeper.admin.enableServer", "true");
         System.setProperty("zookeeper.admin.serverPort", "" + jettyAdminPort);
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
         System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
-        System.setProperty(ADMIN_SNAPSHOT_INTERVAL, "0");
         System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+        System.setProperty(ADMIN_RESTORE_ENABLED, "true");
 
         adminServer = new JettyAdminServer();
         adminServer.setZooKeeperServer(zks);
@@ -101,7 +113,7 @@ public void setup() throws Exception {
 
         // create Zookeeper client and test data
         zk = ClientBase.createZKClient(hostPort);
-        createData(zk, NODE_COUNT);
+        createData(zk, SNAPSHOT_TEST_PATH, NODE_COUNT);
     }
 
     @AfterAll
@@ -109,9 +121,10 @@ public void tearDown() throws Exception {
         System.clearProperty("zookeeper.4lw.commands.whitelist");
         System.clearProperty("zookeeper.admin.enableServer");
         System.clearProperty("zookeeper.admin.serverPort");
+        System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
         System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
-        System.clearProperty(ADMIN_SNAPSHOT_INTERVAL);
         System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+        System.clearProperty(ADMIN_RESTORE_ENABLED);
 
         if (zk != null) {
             zk.close();
@@ -131,19 +144,85 @@ public void tearDown() throws Exception {
     }
 
     @Test
-    public void testSnapshotCommand_streaming() throws Exception {
-        // take snapshot with streaming
-        final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+    public void testSnapshotAndRestoreCommand_streaming() throws Exception {
+        ServerMetrics.getMetrics().resetAll();
 
-        // validate snapshot response
-        assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
-        validateResponseHeaders(snapshotConn);
-        final File snapshotFile = new File(dataDir + "/snapshot." + System.currentTimeMillis());
-        try (final InputStream inputStream = snapshotConn.getInputStream();
-             final FileOutputStream outputStream = new FileOutputStream(snapshotFile)) {
-            IOUtils.copyBytes(inputStream, outputStream, 1024, true);
-            final long fileSize = Files.size(snapshotFile.toPath());
-            assertTrue(fileSize > 0);
+        // take snapshot with streaming and validate
+        final File snapshotFile = takeSnapshotAndValidate();
+
+        // validate snapshot metrics
+        validateSnapshotMetrics();
+
+        // restore from snapshot and validate
+        performRestoreAndValidate(snapshotFile);
+
+        // validate creating data after restore
+        try (final ZooKeeper zk = ClientBase.createZKClient(hostPort)) {
+            createData(zk, SNAPSHOT_TEST_PATH, NODE_COUNT + 1);
+            assertEquals(NODE_COUNT + NODE_COUNT + 1, zk.getAllChildrenNumber(SNAPSHOT_TEST_PATH));
+        }
+
+        // validate restore metrics
+        validateRestoreMetrics();
+    }
+
+    @Test
+    public void testClientRequest_restoreInProgress() throws Exception {
+        final int threadCount = 2;
+        final int nodeCount = 50;
+        final String restoreTestPath = "/restore_test";
+
+        // take snapshot
+        final File snapshotFile = takeSnapshotAndValidate();
+
+        final ExecutorService service = Executors.newFixedThreadPool(threadCount);
+        final CountDownLatch latch = new CountDownLatch(threadCount);
+        final AtomicBoolean createSucceeded = new AtomicBoolean(false);
+        final AtomicBoolean restoreSucceeded = new AtomicBoolean(false);
+
+        // thread 1 creates data
+        service.submit(() -> {
+            try {
+                createData(zk, restoreTestPath, nodeCount);
+                createSucceeded.set(true);
+            } catch (final Exception e) {
+                LOG.error(e.getMessage());
+                e.printStackTrace();
+            } finally {
+                latch.countDown();
+            }
+        });
+
+        // thread 2 performs restore operation
+        service.submit(() -> {
+            try {
+                performRestoreAndValidate(snapshotFile);
+                restoreSucceeded.set(true);
+            } catch (final Exception e) {
+                LOG.error(e.getMessage());
+                e.printStackTrace();
+            } finally {
+                latch.countDown();
+            }
+        });
+
+        // wait for operations completed
+        latch.await();
+
+        // validate all client requests succeeded
+        if (createSucceeded.get() && restoreSucceeded.get()) {
+            assertEquals(nodeCount, zk.getAllChildrenNumber(restoreTestPath));
+        }
+    }
+
+    @Test
+    public void testRestores() throws Exception {
+        // take snapshot
+        final File snapshotFile = takeSnapshotAndValidate();
+
+        // perform restores
+        for (int i = 0; i < 3; i++) {
+            performRestoreAndValidate(snapshotFile);
         }
     }
 
@@ -186,16 +265,47 @@ public void testSnapshotCommand_serializeLastZxidDisabled() throws Exception {
         }
     }
 
-    private void createData(final ZooKeeper zk, final long count) throws Exception {
+    @Test
+    public void testRestoreCommand_disabled() throws Exception {
+        System.setProperty(ADMIN_RESTORE_ENABLED, "false");
+        try {
+            final HttpURLConnection restoreConn = sendRestoreRequest();
+            assertEquals(HttpServletResponse.SC_SERVICE_UNAVAILABLE, restoreConn.getResponseCode());
+        } finally {
+            System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+        }
+    }
+
+    @Test
+    public void testRestoreCommand_serializeLastZxidDisabled() throws Exception {
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
+        try {
+            final HttpURLConnection restoreConn = sendRestoreRequest();
+            assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, restoreConn.getResponseCode());
+        } finally {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+        }
+    }
+
+    @Test
+    public void testRestoreCommand_invalidSnapshotData() throws Exception {
+        final HttpURLConnection restoreConn = sendRestoreRequest();
+        try (final InputStream inputStream = new ByteArrayInputStream("Invalid snapshot data".getBytes());
+             final OutputStream outputStream = restoreConn.getOutputStream()) {
+            IOUtils.copyBytes(inputStream, outputStream, 1024, true);
+        }
+        assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, restoreConn.getResponseCode());
+    }
+
+    private void createData(final ZooKeeper zk, final String parentPath, final long count) throws Exception {
         try {
-            zk.create(PATH, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create(parentPath, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         } catch (final KeeperException.NodeExistsException ignore) {
             // ignore
         }
 
         for (int i = 0; i < count; i++) {
-            final String processNodePath = zk.create(String.format("%s/%s", PATH, "n_"), new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL);
-            LOG.info("Node created. path={}" + processNodePath);
+            zk.create(String.format("%s/%s", parentPath, "n_"), new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL);
         }
     }
 
@@ -208,6 +318,15 @@ private HttpURLConnection sendSnapshotRequest(final boolean streaming) throws Ex
         return snapshotConn;
     }
 
+    private HttpURLConnection sendRestoreRequest() throws Exception  {
+        final URL restoreURL = new URL(String.format(URL_FORMAT + "/restore", jettyAdminPort));
+        final HttpURLConnection restoreConn = (HttpURLConnection) restoreURL.openConnection();
+        restoreConn.setDoOutput(true);
+        restoreConn.setRequestMethod("POST");
+
+        return restoreConn;
+    }
+
     private String buildQueryStringForSnapshotCommand(final boolean streaming) throws Exception {
         final Map<String, String> parameters = new HashMap<>();
         parameters.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
@@ -254,4 +373,47 @@ private void displayResponsePayload(final HttpURLConnection conn) throws IOExcep
             LOG.info("Response payload: {}", sb);
         }
     }
+
+    private void validateSnapshotMetrics() {
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertEquals(0, (long) metrics.get("snapshot_error_count"));
+        assertEquals(0, (long) metrics.get("snapshot_rate_limited_count"));
+        assertTrue((Double) metrics.get("avg_snapshottime") > 0.0);
+    }
+
+    private void validateRestoreMetrics() {
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertEquals(0, (long) metrics.get("restore_error_count"));
+        assertEquals(0, (long) metrics.get("restore_rate_limited_count"));
+        assertTrue((Double) metrics.get("avg_restore_time") > 0.0);
+    }
+
+    private File takeSnapshotAndValidate() throws Exception {
+        // take snapshot with streaming
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+
+        // validate snapshot response
+        assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
+        validateResponseHeaders(snapshotConn);
+        final File snapshotFile = new File(dataDir + "/snapshot." + System.currentTimeMillis());
+        try (final InputStream inputStream = snapshotConn.getInputStream();
+             final FileOutputStream outputStream = new FileOutputStream(snapshotFile)) {
+            IOUtils.copyBytes(inputStream, outputStream, 1024, true);
+            final long fileSize = Files.size(snapshotFile.toPath());
+            assertTrue(fileSize > 0);
+        }
+        return snapshotFile;
+    }
+
+    private void performRestoreAndValidate(final File snapshotFile) throws Exception {
+        // perform restore
+        final HttpURLConnection restoreConn = sendRestoreRequest();
+        try (final CheckedInputStream is = SnapStream.getInputStream(snapshotFile);
+             final OutputStream outputStream = restoreConn.getOutputStream()) {
+            IOUtils.copyBytes(is, outputStream, 1024, true);
+        }
+        // validate restore response
+        assertEquals(HttpURLConnection.HTTP_OK, restoreConn.getResponseCode());
+        displayResponsePayload(restoreConn);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index ffd65997866..573d361ae86 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -293,7 +293,7 @@ public void testAdminCommands(boolean testObserverMaster) throws IOException, MB
 
         // test stats collection
         final Map<String, String> emptyMap = Collections.emptyMap();
-        Map<String, Object> stats = Commands.runCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap).toMap();
+        Map<String, Object> stats = Commands.runGetCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap).toMap();
         assertTrue(stats.containsKey("observer_master_id"), "observer not emitting observer_master_id");
 
         // check the stats for the first peer

From 205840ee9f937fae1b61f6854f86f6fb3bc70a28 Mon Sep 17 00:00:00 2001
From: Martin Polden <mpolden@mpolden.no>
Date: Thu, 2 Feb 2023 19:35:13 +0100
Subject: [PATCH 342/591] [ZOOKEEPER-4669] Upgrade snappy-java to 1.1.9.1
 (#1976)

Signed-off-by: Chris Nauroth <cnauroth@apache.org>
Signed-off-by: Enrico Olivelli <eolivelli@apache.org>
---
 pom.xml                                                         | 2 +-
 ....7.7.jar_LICENSE.txt => snappy-java-1.1.9.1.jar_LICENSE.txt} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{snappy-java-1.1.7.7.jar_LICENSE.txt => snappy-java-1.1.9.1.jar_LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 8deb1ef3b71..89961743a8c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -562,7 +562,7 @@
     <jetty.version>9.4.49.v20220914</jetty.version>
     <jackson.version>2.13.4.2</jackson.version>
     <jline.version>2.14.6</jline.version>
-    <snappy.version>1.1.7.7</snappy.version>
+    <snappy.version>1.1.9.1</snappy.version>
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.60</bouncycastle.version>
     <commons-collections.version>4.4</commons-collections.version>
diff --git a/zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.7.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/snappy-java-1.1.9.1.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.7.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/snappy-java-1.1.9.1.jar_LICENSE.txt

From 7a3135fbc39239096b5c25f8313289aec052106b Mon Sep 17 00:00:00 2001
From: Vivian Kong <vivkong@ca.ibm.com>
Date: Wed, 8 Feb 2023 03:29:46 -0500
Subject: [PATCH 343/591] [ZOOKEEPER-4668] Add s390x Jenkinsfile (#1975)

---
 Jenkinsfile-s390x | 71 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 Jenkinsfile-s390x

diff --git a/Jenkinsfile-s390x b/Jenkinsfile-s390x
new file mode 100644
index 00000000000..c26baf6a3a9
--- /dev/null
+++ b/Jenkinsfile-s390x
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 'Hadoop'
+    }
+
+    options {
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    triggers {
+        cron('@daily')
+    }
+
+    stages {
+        stage('Prepare') {
+
+            agent any
+
+            tools {
+                maven "maven_latest"
+                jdk "jdk_11_latest"
+            }
+
+            stages {
+                stage('BuildAndTest') {
+                    steps {
+                        sh "git clean -fxd"
+                        sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
+                    }
+                    post {
+                        always {
+                            junit '**/target/surefire-reports/TEST-*.xml'
+                            archiveArtifacts '**/target/*.jar'
+                        }
+                        // Jenkins pipeline jobs fill slaves on PRs without this :(
+                        cleanup() {
+                            script {
+                                sh label: 'Cleanup workspace', script: '''
+                                    # See HADOOP-13951
+                                    chmod -R u+rxw "${WORKSPACE}"
+                                    '''
+                                deleteDir()
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

From 3cbceec20afcf85bbfe59be237a96ee105ac60f0 Mon Sep 17 00:00:00 2001
From: Chris Conroy <cconroy@gmail.com>
Date: Wed, 8 Feb 2023 19:27:42 +0800
Subject: [PATCH 344/591] Fix add version for container and TTL nodes

Container and TTL nodes were added in 3.5.3 (not 3.6) according to earlier docs: https://zookeeper.apache.org/doc/r3.5.3-beta/zookeeperProgrammers.html#Container+Nodes

Author: Chris Conroy <cconroy@gmail.com>

Reviewers: maoling <maoling@apache.org>

Closes #1948 from cconroy/patch-1
---
 .../src/main/resources/markdown/zookeeperProgrammers.md       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 1e585a735a8..ddd722b9000 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -219,7 +219,7 @@ name "<path>-2147483648").
 
 #### Container Nodes
 
-**Added in 3.6.0**
+**Added in 3.5.3**
 
 ZooKeeper has the notion of container znodes. Container znodes are
 special purpose znodes useful for recipes such as leader, lock, etc.
@@ -236,7 +236,7 @@ znode when it occurs.
 
 #### TTL Nodes
 
-**Added in 3.6.0**
+**Added in 3.5.3**
 
 When creating PERSISTENT or PERSISTENT_SEQUENTIAL znodes,
 you can optionally set a TTL in milliseconds for the znode. If the znode

From d8a739f4cc5e26517ecb42fc3bfbc11c0213fd97 Mon Sep 17 00:00:00 2001
From: Vivian Kong <vivkong@ca.ibm.com>
Date: Wed, 8 Feb 2023 12:43:55 -0500
Subject: [PATCH 345/591] [ZOOKEEPER-4668] Fix s390x Jenkinsfile (#1981)

---
 Jenkinsfile-s390x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Jenkinsfile-s390x b/Jenkinsfile-s390x
index c26baf6a3a9..21cef360601 100644
--- a/Jenkinsfile-s390x
+++ b/Jenkinsfile-s390x
@@ -18,7 +18,7 @@
 
 pipeline {
     agent {
-        label 'Hadoop'
+        label 's390x'
     }
 
     options {

From 629518b5ea2b26d88a9ec53d5a422afe9b12e452 Mon Sep 17 00:00:00 2001
From: Tim te Beek <timtebeek@gmail.com>
Date: Fri, 10 Feb 2023 16:54:14 +0100
Subject: [PATCH 346/591] [ZOOKEEPER-4672] Code cleanup - apply JDK7 Diamond
 operator consistently (#1979)

Co-authored-by: Moderne <team@moderne.io>
---
 .../java/org/apache/jute/RecordWriter.java    |  2 +-
 .../org/apache/jute/compiler/JRecord.java     |  2 +-
 .../java/org/apache/zookeeper/ClientCnxn.java | 16 ++++-----
 .../org/apache/zookeeper/Environment.java     |  2 +-
 .../org/apache/zookeeper/KeeperException.java |  2 +-
 .../zookeeper/MultiOperationRecord.java       |  2 +-
 .../org/apache/zookeeper/MultiResponse.java   |  4 +--
 .../org/apache/zookeeper/Transaction.java     |  2 +-
 .../java/org/apache/zookeeper/ZKUtil.java     |  6 ++--
 .../java/org/apache/zookeeper/ZooDefs.java    |  6 ++--
 .../java/org/apache/zookeeper/ZooKeeper.java  |  6 ++--
 .../org/apache/zookeeper/ZooKeeperMain.java   | 16 ++++-----
 .../org/apache/zookeeper/cli/AclParser.java   |  2 +-
 .../zookeeper/client/ConnectStringParser.java |  2 +-
 .../zookeeper/client/StaticHostProvider.java  |  6 ++--
 .../apache/zookeeper/common/StringUtils.java  |  2 +-
 .../org/apache/zookeeper/common/ZKConfig.java |  2 +-
 .../zookeeper/common/ZKHostnameVerifier.java  |  2 +-
 .../apache/zookeeper/jmx/MBeanRegistry.java   |  4 +--
 .../zookeeper/server/ContainerManager.java    |  4 +--
 .../org/apache/zookeeper/server/DataNode.java |  2 +-
 .../org/apache/zookeeper/server/DataTree.java | 28 +++++++--------
 .../apache/zookeeper/server/ExpiryQueue.java  |  8 ++---
 .../server/FinalRequestProcessor.java         |  2 +-
 .../zookeeper/server/NIOServerCnxn.java       |  2 +-
 .../server/NIOServerCnxnFactory.java          | 16 ++++-----
 .../server/NettyServerCnxnFactory.java        |  2 +-
 .../server/PrepRequestProcessor.java          |  4 +--
 .../apache/zookeeper/server/PurgeTxnLog.java  |  2 +-
 .../server/ReferenceCountedACLCache.java      |  8 ++---
 .../zookeeper/server/RequestThrottler.java    |  2 +-
 .../apache/zookeeper/server/ServerCnxn.java   |  2 +-
 .../zookeeper/server/ServerCnxnFactory.java   |  6 ++--
 .../zookeeper/server/SessionTrackerImpl.java  |  8 ++---
 .../zookeeper/server/SnapshotComparer.java    | 10 +++---
 .../zookeeper/server/SnapshotFormatter.java   |  2 +-
 .../server/SnapshotRecursiveSummary.java      |  2 +-
 .../server/SyncRequestProcessor.java          |  2 +-
 .../zookeeper/server/WorkerService.java       |  2 +-
 .../apache/zookeeper/server/ZKDatabase.java   |  2 +-
 .../zookeeper/server/ZooKeeperServer.java     |  2 +-
 .../zookeeper/server/ZooKeeperServerConf.java |  2 +-
 .../zookeeper/server/admin/CommandBase.java   |  2 +-
 .../server/admin/CommandResponse.java         |  4 +--
 .../zookeeper/server/admin/Commands.java      |  4 +--
 .../server/admin/JettyAdminServer.java        |  2 +-
 .../auth/EnsembleAuthenticationProvider.java  |  2 +-
 .../zookeeper/server/auth/KerberosName.java   |  2 +-
 .../auth/SaslServerCallbackHandler.java       |  2 +-
 .../server/command/FourLetterCommands.java    |  4 +--
 .../server/metric/AvgMinMaxCounter.java       |  2 +-
 .../metric/AvgMinMaxPercentileCounter.java    |  2 +-
 .../server/metric/SimpleCounter.java          |  2 +-
 .../server/persistence/FileSnap.java          |  4 +--
 .../server/persistence/FileTxnLog.java        |  2 +-
 .../zookeeper/server/persistence/Util.java    |  2 +-
 .../server/quorum/CommitProcessor.java        |  4 +--
 .../server/quorum/FastLeaderElection.java     |  8 ++---
 .../quorum/FollowerRequestProcessor.java      |  2 +-
 .../quorum/FollowerZooKeeperServer.java       |  4 +--
 .../zookeeper/server/quorum/Leader.java       | 32 ++++++++---------
 .../zookeeper/server/quorum/Learner.java      |  2 +-
 .../server/quorum/LearnerHandler.java         |  2 +-
 .../server/quorum/LearnerSessionTracker.java  | 10 +++---
 .../server/quorum/ObserverMaster.java         |  2 +-
 .../quorum/ObserverRequestProcessor.java      |  2 +-
 .../quorum/ObserverZooKeeperServer.java       |  2 +-
 .../zookeeper/server/quorum/QuorumPeer.java   | 16 ++++-----
 .../server/quorum/QuorumPeerConfig.java       |  2 +-
 .../quorum/ReadOnlyRequestProcessor.java      |  2 +-
 .../server/quorum/SyncedLearnerTracker.java   |  2 +-
 .../quorum/UpgradeableSessionTracker.java     |  4 +--
 .../quorum/flexible/QuorumHierarchical.java   | 16 ++++-----
 .../server/quorum/flexible/QuorumMaj.java     |  6 ++--
 .../zookeeper/server/util/BitHashSet.java     |  2 +-
 .../apache/zookeeper/server/util/BitMap.java  |  4 +--
 .../zookeeper/server/util/SerializeUtils.java |  2 +-
 .../server/watch/WatchManagerOptimized.java   | 16 ++++-----
 .../server/watch/WatcherCleaner.java          |  4 +--
 .../server/watch/WatchesPathReport.java       |  4 +--
 .../zookeeper/server/watch/WatchesReport.java |  4 +--
 .../server/watch/WatchesSummary.java          |  2 +-
 .../apache/zookeeper/GetEphemeralsTest.java   |  6 ++--
 .../apache/zookeeper/JaasConfiguration.java   |  4 +--
 .../apache/zookeeper/RemoveWatchesTest.java   | 10 +++---
 .../org/apache/zookeeper/SaslAuthTest.java    | 10 +++---
 .../org/apache/zookeeper/ZooKeeperTest.java   | 12 +++----
 .../org/apache/zookeeper/server/CRCTest.java  |  2 +-
 .../server/FinalRequestProcessorTest.java     | 10 +++---
 .../server/PrepRequestProcessorTest.java      |  2 +-
 .../apache/zookeeper/server/PurgeTxnTest.java | 28 +++++++--------
 .../server/ReferenceCountedACLCacheTest.java  |  6 ++--
 .../zookeeper/server/SnapshotDigestTest.java  |  2 +-
 .../zookeeper/server/TxnLogDigestTest.java    |  2 +-
 .../server/admin/CommandResponseTest.java     |  2 +-
 .../zookeeper/server/admin/CommandsTest.java  |  4 +--
 .../server/quorum/CnxManagerTest.java         |  4 +--
 .../CommitProcessorConcurrencyTest.java       | 22 ++++++------
 .../server/quorum/CommitProcessorTest.java    |  6 ++--
 .../quorum/FLEBackwardElectionRoundTest.java  |  2 +-
 .../server/quorum/FLELostMessageTest.java     |  2 +-
 .../server/quorum/FLEOutOfElectionTest.java   | 12 +++----
 .../quorum/FuzzySnapshotRelatedTest.java      |  4 +--
 .../server/quorum/LeaderBeanTest.java         |  4 +--
 .../server/quorum/LearnerHandlerTest.java     |  4 +--
 .../quorum/LearnerSyncThrottlerTest.java      |  2 +-
 .../server/quorum/QuorumDigestTest.java       |  2 +-
 .../server/quorum/QuorumPeerTest.java         |  2 +-
 .../server/quorum/QuorumPeerTestBase.java     |  2 +-
 .../quorum/QuorumRequestPipelineTest.java     |  2 +-
 .../server/quorum/QuorumSSLTest.java          |  2 +-
 .../server/quorum/ReconfigBackupTest.java     |  6 ++--
 .../quorum/ReconfigFailureCasesTest.java      | 12 +++----
 .../server/quorum/ReconfigLegacyTest.java     |  6 ++--
 .../server/quorum/ReconfigRecoveryTest.java   | 14 ++++----
 .../quorum/SessionUpgradeQuorumTest.java      |  2 +-
 .../server/quorum/StandaloneDisabledTest.java |  6 ++--
 .../server/quorum/WatchLeakTest.java          |  2 +-
 .../zookeeper/server/quorum/Zab1_0Test.java   |  2 +-
 .../zookeeper/server/quorum/ZabUtils.java     |  2 +-
 .../server/quorum/auth/KerberosTestUtils.java |  2 +-
 .../zookeeper/server/quorum/auth/MiniKdc.java |  4 +--
 .../server/quorum/auth/MiniKdcTest.java       |  4 +--
 .../quorum/auth/QuorumAuthTestBase.java       |  2 +-
 .../quorum/auth/QuorumAuthUpgradeTest.java    | 10 +++---
 .../quorum/auth/QuorumDigestAuthTest.java     | 12 +++----
 .../quorum/auth/QuorumKerberosAuthTest.java   |  4 +--
 .../auth/QuorumKerberosHostBasedAuthTest.java |  6 ++--
 .../zookeeper/server/util/BitHashSetTest.java |  4 +--
 .../zookeeper/server/util/BitMapTest.java     |  4 +--
 .../server/watch/WatchManagerTest.java        | 14 ++++----
 .../server/watch/WatcherCleanerTest.java      |  2 +-
 .../server/watch/WatcherOrBitSetTest.java     |  2 +-
 .../server/watch/WatchesPathReportTest.java   |  4 +--
 .../server/watch/WatchesReportTest.java       |  4 +--
 .../org/apache/zookeeper/test/ACLTest.java    |  6 ++--
 .../org/apache/zookeeper/test/AsyncOps.java   |  4 +--
 .../org/apache/zookeeper/test/AsyncTest.java  |  2 +-
 .../org/apache/zookeeper/test/ClientBase.java |  4 +--
 .../org/apache/zookeeper/test/ClientTest.java | 10 +++---
 .../test/DisconnectedWatcherTest.java         |  4 +--
 .../zookeeper/test/FLENewEpochTest.java       |  4 +--
 .../zookeeper/test/FLEPredicateTest.java      |  2 +-
 .../apache/zookeeper/test/FLERestartTest.java |  4 +--
 .../org/apache/zookeeper/test/FLETest.java    | 14 ++++----
 .../zookeeper/test/FLEZeroWeightTest.java     |  4 +--
 .../test/FollowerResyncConcurrencyTest.java   |  2 +-
 .../zookeeper/test/GetChildren2Test.java      |  4 +--
 .../test/GetProposalFromTxnTest.java          |  2 +-
 .../test/HierarchicalQuorumTest.java          |  2 +-
 .../apache/zookeeper/test/IntegrityCheck.java |  2 +-
 .../org/apache/zookeeper/test/JMXEnv.java     |  4 +--
 .../test/LoadFromLogNoServerTest.java         |  2 +-
 .../zookeeper/test/LocalSessionsOnlyTest.java |  2 +-
 .../apache/zookeeper/test/LogChopperTest.java |  2 +-
 .../test/MultiAsyncTransactionTest.java       |  2 +-
 .../zookeeper/test/MultiOperationTest.java    | 18 +++++-----
 .../zookeeper/test/ObserverMasterTest.java    |  4 +--
 .../org/apache/zookeeper/test/QuorumBase.java |  8 ++---
 .../test/QuorumBaseOracle_2Nodes.java         |  8 ++---
 .../org/apache/zookeeper/test/QuorumTest.java |  2 +-
 .../org/apache/zookeeper/test/QuorumUtil.java |  8 ++---
 .../zookeeper/test/ReconfigExceptionTest.java |  6 ++--
 .../zookeeper/test/ReconfigMisconfigTest.java |  2 +-
 .../apache/zookeeper/test/ReconfigTest.java   | 26 +++++++-------
 .../test/SaslAuthDesignatedClientTest.java    |  2 +-
 .../apache/zookeeper/test/SessionTest.java    |  2 +-
 .../test/SessionTrackerCheckTest.java         |  2 +-
 .../apache/zookeeper/test/StandaloneTest.java |  2 +-
 .../test/StaticHostProviderTest.java          | 34 +++++++++----------
 .../apache/zookeeper/test/TruncateTest.java   |  2 +-
 .../test/WatchEventWhenAutoResetTest.java     |  2 +-
 .../zookeeper/test/WatcherFuncTest.java       | 12 +++----
 .../apache/zookeeper/test/WatcherTest.java    |  2 +-
 .../zookeeper/test/ZooKeeperTestClient.java   |  2 +-
 175 files changed, 463 insertions(+), 463 deletions(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java b/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
index 259a683e0a9..a6d74a97883 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
@@ -32,7 +32,7 @@ public class RecordWriter {
     private OutputArchive archive;
 
     static HashMap<String, Method> constructFactory() {
-        HashMap<String, Method> factory = new HashMap<String, Method>();
+        HashMap<String, Method> factory = new HashMap<>();
 
         try {
             factory.put(
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index 13cb1ed29c5..c26e249102f 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -143,7 +143,7 @@ public String genCsharpWriteWrapper(String fname, String tag) {
         return "    a_.WriteRecord(" + fname + ",\"" + tag + "\");\n";
     }
 
-    static Map<String, String> vectorStructs = new HashMap<String, String>();
+    static Map<String, String> vectorStructs = new HashMap<>();
 
     public void genCCode(FileWriter h, FileWriter c) throws IOException {
         for (JField f : mFields) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 96ff8eb088e..c29a2141d58 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -140,7 +140,7 @@ static class AuthData {
 
     }
 
-    private final CopyOnWriteArraySet<AuthData> authInfo = new CopyOnWriteArraySet<AuthData>();
+    private final CopyOnWriteArraySet<AuthData> authInfo = new CopyOnWriteArraySet<>();
 
     /**
      * These are the packets that have been sent and are waiting for a response.
@@ -150,7 +150,7 @@ static class AuthData {
     /**
      * These are the packets that need to be sent.
      */
-    private final LinkedBlockingDeque<Packet> outgoingQueue = new LinkedBlockingDeque<Packet>();
+    private final LinkedBlockingDeque<Packet> outgoingQueue = new LinkedBlockingDeque<>();
 
     private int connectTimeout;
 
@@ -465,7 +465,7 @@ public static boolean isInEventThread() {
 
     class EventThread extends ZooKeeperThread {
 
-        private final LinkedBlockingQueue<Object> waitingEvents = new LinkedBlockingQueue<Object>();
+        private final LinkedBlockingQueue<Object> waitingEvents = new LinkedBlockingQueue<>();
 
         /** This is really the queued session state until the event
          * thread actually processes the event and hands it to the watcher.
@@ -1019,11 +1019,11 @@ void primeConnection() throws IOException {
 
                     while (dataWatchesIter.hasNext() || existWatchesIter.hasNext() || childWatchesIter.hasNext()
                             || persistentWatchesIter.hasNext() || persistentRecursiveWatchesIter.hasNext()) {
-                        List<String> dataWatchesBatch = new ArrayList<String>();
-                        List<String> existWatchesBatch = new ArrayList<String>();
-                        List<String> childWatchesBatch = new ArrayList<String>();
-                        List<String> persistentWatchesBatch = new ArrayList<String>();
-                        List<String> persistentRecursiveWatchesBatch = new ArrayList<String>();
+                        List<String> dataWatchesBatch = new ArrayList<>();
+                        List<String> existWatchesBatch = new ArrayList<>();
+                        List<String> childWatchesBatch = new ArrayList<>();
+                        List<String> persistentWatchesBatch = new ArrayList<>();
+                        List<String> persistentRecursiveWatchesBatch = new ArrayList<>();
                         int batchLength = 0;
 
                         // Note, we may exceed our max length by a bit when we add the last
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
index 9ec38a19709..42588201008 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
@@ -59,7 +59,7 @@ private static void put(List<Entry> l, String k, String v) {
     }
 
     public static List<Entry> list() {
-        List<Entry> l = new ArrayList<Entry>();
+        List<Entry> l = new ArrayList<>();
         put(l, "zookeeper.version", Version.getFullVersion());
 
         try {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index ef38763f41e..eace4adf12f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -417,7 +417,7 @@ public enum Code implements CodeDeprecated {
          */
         THROTTLEDOP (-127);
 
-        private static final Map<Integer, Code> lookup = new HashMap<Integer, Code>();
+        private static final Map<Integer, Code> lookup = new HashMap<>();
 
         static {
             for (Code c : EnumSet.allOf(Code.class)) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
index d43e7284165..4ddacaceae8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
@@ -43,7 +43,7 @@
  */
 public class MultiOperationRecord implements Record, Iterable<Op> {
 
-    private List<Op> ops = new ArrayList<Op>();
+    private List<Op> ops = new ArrayList<>();
     private Op.OpKind opKind = null;
 
     public MultiOperationRecord() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java
index 16d2fb29df5..2e678c93c7d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java
@@ -41,7 +41,7 @@
  */
 public class MultiResponse implements Record, Iterable<OpResult> {
 
-    private List<OpResult> results = new ArrayList<OpResult>();
+    private List<OpResult> results = new ArrayList<>();
 
     public void add(OpResult x) {
         results.add(x);
@@ -101,7 +101,7 @@ public void serialize(OutputArchive archive, String tag) throws IOException {
 
     @Override
     public void deserialize(InputArchive archive, String tag) throws IOException {
-        results = new ArrayList<OpResult>();
+        results = new ArrayList<>();
 
         archive.startRecord(tag);
         MultiHeader h = new MultiHeader();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java
index 7a6ba73c975..20913c414b6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java
@@ -34,7 +34,7 @@
 public class Transaction {
 
     private ZooKeeper zk;
-    private List<Op> ops = new ArrayList<Op>();
+    private List<Op> ops = new ArrayList<>();
 
     protected Transaction(ZooKeeper zk) {
         this.zk = zk;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index 2ccdfc877f6..ae0f3b8a2f6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -40,7 +40,7 @@
 public class ZKUtil {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZKUtil.class);
-    private static final Map<Integer, String> permCache = new ConcurrentHashMap<Integer, String>();
+    private static final Map<Integer, String> permCache = new ConcurrentHashMap<>();
     /**
      * Recursively delete the node with the given path.
      * <p>
@@ -202,7 +202,7 @@ public static List<String> listSubTreeBFS(
         ZooKeeper zk,
         final String pathRoot) throws KeeperException, InterruptedException {
         Queue<String> queue = new ArrayDeque<>();
-        List<String> tree = new ArrayList<String>();
+        List<String> tree = new ArrayList<>();
         queue.add(pathRoot);
         tree.add(pathRoot);
         while (!queue.isEmpty()) {
@@ -307,4 +307,4 @@ public static String aclToString(List<ACL> acls) {
         }
         return sb.toString();
     }
-}
\ No newline at end of file
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
index d74bb80079b..77c3de37cb5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
@@ -138,19 +138,19 @@ public interface Ids {
          * This is a completely open ACL .
          */
         @SuppressFBWarnings(value = "MS_MUTABLE_COLLECTION", justification = "Cannot break API")
-        ArrayList<ACL> OPEN_ACL_UNSAFE = new ArrayList<ACL>(Collections.singletonList(new ACL(Perms.ALL, ANYONE_ID_UNSAFE)));
+        ArrayList<ACL> OPEN_ACL_UNSAFE = new ArrayList<>(Collections.singletonList(new ACL(Perms.ALL, ANYONE_ID_UNSAFE)));
 
         /**
          * This ACL gives the creators authentication id's all permissions.
          */
         @SuppressFBWarnings(value = "MS_MUTABLE_COLLECTION", justification = "Cannot break API")
-        ArrayList<ACL> CREATOR_ALL_ACL = new ArrayList<ACL>(Collections.singletonList(new ACL(Perms.ALL, AUTH_IDS)));
+        ArrayList<ACL> CREATOR_ALL_ACL = new ArrayList<>(Collections.singletonList(new ACL(Perms.ALL, AUTH_IDS)));
 
         /**
          * This ACL gives the world the ability to read.
          */
         @SuppressFBWarnings(value = "MS_MUTABLE_COLLECTION", justification = "Cannot break API")
-        ArrayList<ACL> READ_ACL_UNSAFE = new ArrayList<ACL>(Collections.singletonList(new ACL(Perms.READ, ANYONE_ID_UNSAFE)));
+        ArrayList<ACL> READ_ACL_UNSAFE = new ArrayList<>(Collections.singletonList(new ACL(Perms.READ, ANYONE_ID_UNSAFE)));
 
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 127f5a2a3f3..09006ed103e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -285,7 +285,7 @@ public void register(int rc) {
                 synchronized (watches) {
                     Set<Watcher> watchers = watches.get(clientPath);
                     if (watchers == null) {
-                        watchers = new HashSet<Watcher>();
+                        watchers = new HashSet<>();
                         watches.put(clientPath, watchers);
                     }
                     watchers.add(watcher);
@@ -1665,7 +1665,7 @@ public void multi(Iterable<Op> ops, MultiCallback cb, Object ctx) {
     }
 
     private List<OpResult> validatePath(Iterable<Op> ops) {
-        List<OpResult> results = new ArrayList<OpResult>();
+        List<OpResult> results = new ArrayList<>();
         boolean error = false;
         for (Op op : ops) {
             try {
@@ -1694,7 +1694,7 @@ private List<OpResult> validatePath(Iterable<Op> ops) {
 
     private MultiOperationRecord generateMultiTransaction(Iterable<Op> ops) {
         // reconstructing transaction with the chroot prefix
-        List<Op> transaction = new ArrayList<Op>();
+        List<Op> transaction = new ArrayList<>();
         for (Op op : ops) {
             transaction.add(withRootPrefix(op));
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index 4ee378fac05..ebe81001228 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -59,11 +59,11 @@
 public class ZooKeeperMain {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperMain.class);
-    static final Map<String, String> commandMap = new HashMap<String, String>();
-    static final Map<String, CliCommand> commandMapCli = new HashMap<String, CliCommand>();
+    static final Map<String, String> commandMap = new HashMap<>();
+    static final Map<String, CliCommand> commandMapCli = new HashMap<>();
 
     protected MyCommandOptions cl = new MyCommandOptions();
-    protected HashMap<Integer, String> history = new HashMap<Integer, String>();
+    protected HashMap<Integer, String> history = new HashMap<>();
     protected int commandCount = 0;
     protected boolean printWatches = true;
     protected int exitCode = ExitCode.EXECUTION_FINISHED.getValue();
@@ -95,7 +95,7 @@ public boolean getPrintWatches() {
 
     static void usage() {
         System.err.println("ZooKeeper -server host:port -client-configuration properties-file cmd args");
-        List<String> cmdList = new ArrayList<String>(commandMap.keySet());
+        List<String> cmdList = new ArrayList<>(commandMap.keySet());
         Collections.sort(cmdList);
         for (String cmd : cmdList) {
             System.err.println("\t" + cmd + " " + commandMap.get(cmd));
@@ -126,7 +126,7 @@ public void process(WatchedEvent event) {
      */
     static class MyCommandOptions {
 
-        private Map<String, String> options = new HashMap<String, String>();
+        private Map<String, String> options = new HashMap<>();
         private List<String> cmdArgs = null;
         private String command = null;
         public static final Pattern ARGS_PATTERN = Pattern.compile("\\s*([^\"\']\\S*|\"[^\"]*\"|'[^']*')\\s*");
@@ -188,7 +188,7 @@ public boolean parseOptions(String[] args) {
 
                 if (!opt.startsWith("-")) {
                     command = opt;
-                    cmdArgs = new ArrayList<String>();
+                    cmdArgs = new ArrayList<>();
                     cmdArgs.add(command);
                     while (it.hasNext()) {
                         cmdArgs.add(it.next());
@@ -207,7 +207,7 @@ public boolean parseOptions(String[] args) {
         public boolean parseCommand(String cmdstring) {
             Matcher matcher = ARGS_PATTERN.matcher(cmdstring);
 
-            List<String> args = new LinkedList<String>();
+            List<String> args = new LinkedList<>();
             while (matcher.find()) {
                 String value = matcher.group(1);
                 if (QUOTED_PATTERN.matcher(value).matches()) {
@@ -237,7 +237,7 @@ protected void addToHistory(int i, String cmd) {
     }
 
     public static List<String> getCommands() {
-        List<String> cmdList = new ArrayList<String>(commandMap.keySet());
+        List<String> cmdList = new ArrayList<>(commandMap.keySet());
         Collections.sort(cmdList);
         return cmdList;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
index f3cb9a7c7b0..ff7f1544344 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
@@ -37,7 +37,7 @@ public class AclParser {
     public static List<ACL> parse(String aclString) {
         List<ACL> acl;
         String[] acls = aclString.split(",");
-        acl = new ArrayList<ACL>();
+        acl = new ArrayList<>();
         for (String a : acls) {
             int firstColon = a.indexOf(':');
             int lastColon = a.lastIndexOf(':');
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
index d677b69d269..e2409921fa8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
@@ -41,7 +41,7 @@ public final class ConnectStringParser {
 
     private final String chrootPath;
 
-    private final ArrayList<InetSocketAddress> serverAddresses = new ArrayList<InetSocketAddress>();
+    private final ArrayList<InetSocketAddress> serverAddresses = new ArrayList<>();
 
     /**
      * Parse host and port by spliting client connectString
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
index 3f1ce4fdd28..bfd771943e2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
@@ -50,7 +50,7 @@ public interface Resolver {
 
     private static final Logger LOG = LoggerFactory.getLogger(StaticHostProvider.class);
 
-    private List<InetSocketAddress> serverAddresses = new ArrayList<InetSocketAddress>(5);
+    private List<InetSocketAddress> serverAddresses = new ArrayList<>(5);
 
     private Random sourceOfRandomness;
     private int lastIndex = -1;
@@ -62,9 +62,9 @@ public interface Resolver {
      */
     private boolean reconfigMode = false;
 
-    private final List<InetSocketAddress> oldServers = new ArrayList<InetSocketAddress>(5);
+    private final List<InetSocketAddress> oldServers = new ArrayList<>(5);
 
-    private final List<InetSocketAddress> newServers = new ArrayList<InetSocketAddress>(5);
+    private final List<InetSocketAddress> newServers = new ArrayList<>(5);
 
     private int currentIndexOld = -1;
     private int currentIndexNew = -1;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
index 77237433e49..481a3aa2b42 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
@@ -34,7 +34,7 @@ private StringUtils() {/** non instantiable and non inheritable **/}
      */
     public static List<String> split(String value, String separator) {
         String[] splits = value.split(separator);
-        List<String> results = new ArrayList<String>();
+        List<String> results = new ArrayList<>();
         for (int i = 0; i < splits.length; i++) {
             splits[i] = splits[i].trim();
             if (splits[i].length() > 0) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 1d1a6c9eabe..5bd736ea8cd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -51,7 +51,7 @@ public class ZKConfig {
     public static final String KINIT_COMMAND = "zookeeper.kinit";
     public static final String JGSS_NATIVE = "sun.security.jgss.native";
 
-    private final Map<String, String> properties = new HashMap<String, String>();
+    private final Map<String, String> properties = new HashMap<>();
 
     /**
      * properties, which are common to both client and server, are initialized
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
index db5af19c54a..4abe29bfb5d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
@@ -320,7 +320,7 @@ private static List<SubjectName> getSubjectAltNames(final X509Certificate cert)
             if (entries == null) {
                 return Collections.emptyList();
             }
-            final List<SubjectName> result = new ArrayList<SubjectName>();
+            final List<SubjectName> result = new ArrayList<>();
             for (List<?> entry : entries) {
                 final Integer type = entry.size() >= 2 ? (Integer) entry.get(0) : null;
                 if (type != null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java
index 5bfa8bb5c00..f91b9674a04 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java
@@ -47,7 +47,7 @@ public class MBeanRegistry {
 
     private final Object LOCK = new Object();
 
-    private Map<ZKMBeanInfo, String> mapBean2Path = new ConcurrentHashMap<ZKMBeanInfo, String>();
+    private Map<ZKMBeanInfo, String> mapBean2Path = new ConcurrentHashMap<>();
 
     private MBeanServer mBeanServer;
 
@@ -135,7 +135,7 @@ private void unregister(String path, ZKMBeanInfo bean) throws JMException {
      *         unregistered. Mainly for testing purposes.
      */
     public Set<ZKMBeanInfo> getRegisteredBeans() {
-        return new HashSet<ZKMBeanInfo>(mapBean2Path.keySet());
+        return new HashSet<>(mapBean2Path.keySet());
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 2664348c244..5362b9790bc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -48,7 +48,7 @@ public class ContainerManager {
     private final int maxPerMinute;
     private final long maxNeverUsedIntervalMs;
     private final Timer timer;
-    private final AtomicReference<TimerTask> task = new AtomicReference<TimerTask>(null);
+    private final AtomicReference<TimerTask> task = new AtomicReference<>(null);
 
     /**
      * @param zkDb the ZK database
@@ -157,7 +157,7 @@ protected long getMinIntervalMs() {
 
     // VisibleForTesting
     protected Collection<String> getCandidates() {
-        Set<String> candidates = new HashSet<String>();
+        Set<String> candidates = new HashSet<>();
         for (String containerPath : zkDb.getDataTree().getContainers()) {
             DataNode node = zkDb.getDataTree().getNode(containerPath);
             if ((node != null) && node.getChildren().isEmpty()) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java
index 8ac8f618522..44e89c90351 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java
@@ -101,7 +101,7 @@ public DataNode(byte[] data, Long acl, StatPersisted stat) {
     public synchronized boolean addChild(String child) {
         if (children == null) {
             // let's be conservative on the typical number of children
-            children = new HashSet<String>(8);
+            children = new HashSet<>(8);
         }
         return children.add(child);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index cd45a7c3437..d60528224b4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -152,17 +152,17 @@ public class DataTree {
     /**
      * This hashtable lists the paths of the ephemeral nodes of a session.
      */
-    private final Map<Long, HashSet<String>> ephemerals = new ConcurrentHashMap<Long, HashSet<String>>();
+    private final Map<Long, HashSet<String>> ephemerals = new ConcurrentHashMap<>();
 
     /**
      * This set contains the paths of all container nodes
      */
-    private final Set<String> containers = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>());
+    private final Set<String> containers = Collections.newSetFromMap(new ConcurrentHashMap<>());
 
     /**
      * This set contains the paths of all ttl nodes
      */
-    private final Set<String> ttls = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>());
+    private final Set<String> ttls = Collections.newSetFromMap(new ConcurrentHashMap<>());
 
     private final ReferenceCountedACLCache aclCache = new ReferenceCountedACLCache();
 
@@ -194,7 +194,7 @@ public class DataTree {
     public Set<String> getEphemerals(long sessionId) {
         HashSet<String> retv = ephemerals.get(sessionId);
         if (retv == null) {
-            return new HashSet<String>();
+            return new HashSet<>();
         }
         Set<String> cloned = null;
         synchronized (retv) {
@@ -204,11 +204,11 @@ public Set<String> getEphemerals(long sessionId) {
     }
 
     public Set<String> getContainers() {
-        return new HashSet<String>(containers);
+        return new HashSet<>(containers);
     }
 
     public Set<String> getTtls() {
-        return new HashSet<String>(ttls);
+        return new HashSet<>(ttls);
     }
 
     public Collection<Long> getSessions() {
@@ -496,7 +496,7 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
             } else if (ephemeralOwner != 0) {
                 HashSet<String> list = ephemerals.get(ephemeralOwner);
                 if (list == null) {
-                    list = new HashSet<String>();
+                    list = new HashSet<>();
                     ephemerals.put(ephemeralOwner, list);
                 }
                 synchronized (list) {
@@ -730,7 +730,7 @@ public List<String> getChildren(String path, Stat stat, Watcher watcher) throws
             if (stat != null) {
                 n.copyStat(stat);
             }
-            children = new ArrayList<String>(n.getChildren());
+            children = new ArrayList<>(n.getChildren());
 
             if (watcher != null) {
                 childWatches.addWatch(path, watcher);
@@ -781,7 +781,7 @@ public List<ACL> getACL(String path, Stat stat) throws KeeperException.NoNodeExc
             if (stat != null) {
                 n.copyStat(stat);
             }
-            return new ArrayList<ACL>(aclCache.convertLong(n.acl));
+            return new ArrayList<>(aclCache.convertLong(n.acl));
         }
     }
 
@@ -965,7 +965,7 @@ public ProcessTxnResult processTxn(TxnHeader header, Record txn, boolean isSubTx
             case OpCode.multi:
                 MultiTxn multiTxn = (MultiTxn) txn;
                 List<Txn> txns = multiTxn.getTxns();
-                rc.multiResult = new ArrayList<ProcessTxnResult>();
+                rc.multiResult = new ArrayList<>();
                 boolean failed = false;
                 for (Txn subtxn : txns) {
                     if (subtxn.getType() == OpCode.error) {
@@ -1389,7 +1389,7 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
                 } else if (eowner != 0) {
                     HashSet<String> list = ephemerals.get(eowner);
                     if (list == null) {
-                        list = new HashSet<String>();
+                        list = new HashSet<>();
                         ephemerals.put(eowner, list);
                     }
                     list.add(path);
@@ -1490,10 +1490,10 @@ public void shutdownWatcher() {
      * @return map of session ID to sets of ephemeral znodes
      */
     public Map<Long, Set<String>> getEphemerals() {
-        Map<Long, Set<String>> ephemeralsCopy = new HashMap<Long, Set<String>>();
+        Map<Long, Set<String>> ephemeralsCopy = new HashMap<>();
         for (Entry<Long, HashSet<String>> e : ephemerals.entrySet()) {
             synchronized (e.getValue()) {
-                ephemeralsCopy.put(e.getKey(), new HashSet<String>(e.getValue()));
+                ephemeralsCopy.put(e.getKey(), new HashSet<>(e.getValue()));
             }
         }
         return ephemeralsCopy;
@@ -1894,7 +1894,7 @@ public void addDigestWatcher(DigestWatcher digestWatcher) {
     public List<ZxidDigest> getDigestLog() {
         synchronized (digestLog) {
             // Return a copy of current digest log
-            return new LinkedList<ZxidDigest>(digestLog);
+            return new LinkedList<>(digestLog);
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
index abc2e5d14b8..a147f3b7d30 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
@@ -34,13 +34,13 @@
  */
 public class ExpiryQueue<E> {
 
-    private final ConcurrentHashMap<E, Long> elemMap = new ConcurrentHashMap<E, Long>();
+    private final ConcurrentHashMap<E, Long> elemMap = new ConcurrentHashMap<>();
     /**
      * The maximum number of buckets is equal to max timeout/expirationInterval,
      * so the expirationInterval should not be too small compared to the
      * max timeout that this expiry queue needs to maintain.
      */
-    private final ConcurrentHashMap<Long, Set<E>> expiryMap = new ConcurrentHashMap<Long, Set<E>>();
+    private final ConcurrentHashMap<Long, Set<E>> expiryMap = new ConcurrentHashMap<>();
 
     private final AtomicLong nextExpirationTime = new AtomicLong();
     private final int expirationInterval;
@@ -95,7 +95,7 @@ public Long update(E elem, int timeout) {
         Set<E> set = expiryMap.get(newExpiryTime);
         if (set == null) {
             // Construct a ConcurrentHashSet using a ConcurrentHashMap
-            set = Collections.newSetFromMap(new ConcurrentHashMap<E, Boolean>());
+            set = Collections.newSetFromMap(new ConcurrentHashMap<>());
             // Put the new set in the map, but only if another thread
             // hasn't beaten us to it
             Set<E> existingSet = expiryMap.putIfAbsent(newExpiryTime, set);
@@ -158,7 +158,7 @@ public void dump(PrintWriter pwriter) {
         pwriter.print(")/(");
         pwriter.print(elemMap.size());
         pwriter.println("):");
-        ArrayList<Long> keys = new ArrayList<Long>(expiryMap.keySet());
+        ArrayList<Long> keys = new ArrayList<>(expiryMap.keySet());
         Collections.sort(keys);
         for (long time : keys) {
             Set<E> set = expiryMap.get(time);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 693a6b86e58..6f61cdd5dba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -442,7 +442,7 @@ public void processRequest(Request request) {
                         null);
                     rsp = new GetACLResponse(acl, stat);
                 } catch (KeeperException.NoAuthException e) {
-                    List<ACL> acl1 = new ArrayList<ACL>(acl.size());
+                    List<ACL> acl1 = new ArrayList<>(acl.size());
                     for (ACL a : acl) {
                         if ("digest".equals(a.getId().getScheme())) {
                             Id id = a.getId();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 5ffc81da1c3..1a8575cd45e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -74,7 +74,7 @@ public class NIOServerCnxn extends ServerCnxn {
 
     protected ByteBuffer incomingBuffer = lenBuffer;
 
-    private final Queue<ByteBuffer> outgoingBuffers = new LinkedBlockingQueue<ByteBuffer>();
+    private final Queue<ByteBuffer> outgoingBuffers = new LinkedBlockingQueue<>();
 
     private int sessionTimeout;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index f081ab24bad..0372f46675a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -324,8 +324,8 @@ public class SelectorThread extends AbstractSelectThread {
         public SelectorThread(int id) throws IOException {
             super("NIOServerCxnFactory.SelectorThread-" + id);
             this.id = id;
-            acceptedQueue = new LinkedBlockingQueue<SocketChannel>();
-            updateQueue = new LinkedBlockingQueue<SelectionKey>();
+            acceptedQueue = new LinkedBlockingQueue<>();
+            updateQueue = new LinkedBlockingQueue<>();
         }
 
         /**
@@ -403,7 +403,7 @@ private void select() {
                 selector.select();
 
                 Set<SelectionKey> selected = selector.selectedKeys();
-                ArrayList<SelectionKey> selectedList = new ArrayList<SelectionKey>(selected);
+                ArrayList<SelectionKey> selectedList = new ArrayList<>(selected);
                 Collections.shuffle(selectedList);
                 Iterator<SelectionKey> selectedKeys = selectedList.iterator();
                 while (!stopped && selectedKeys.hasNext()) {
@@ -587,7 +587,7 @@ public static ByteBuffer getDirectBuffer() {
     }
 
     // ipMap is used to limit connections per IP
-    private final ConcurrentHashMap<InetAddress, Set<NIOServerCnxn>> ipMap = new ConcurrentHashMap<InetAddress, Set<NIOServerCnxn>>();
+    private final ConcurrentHashMap<InetAddress, Set<NIOServerCnxn>> ipMap = new ConcurrentHashMap<>();
 
     protected int maxClientCnxns = 60;
     int listenBacklog = -1;
@@ -613,7 +613,7 @@ public NIOServerCnxnFactory() {
     private volatile boolean stopped = true;
     private ConnectionExpirerThread expirerThread;
     private AcceptThread acceptThread;
-    private final Set<SelectorThread> selectorThreads = new HashSet<SelectorThread>();
+    private final Set<SelectorThread> selectorThreads = new HashSet<>();
 
     @Override
     public void configure(InetSocketAddress addr, int maxcc, int backlog, boolean secure) throws IOException {
@@ -629,7 +629,7 @@ public void configure(InetSocketAddress addr, int maxcc, int backlog, boolean se
         // cnxnExpiryQueue. These don't need to be the same, but the expiring
         // interval passed into the ExpiryQueue() constructor below should be
         // less than or equal to the timeout.
-        cnxnExpiryQueue = new ExpiryQueue<NIOServerCnxn>(sessionlessCnxnTimeout);
+        cnxnExpiryQueue = new ExpiryQueue<>(sessionlessCnxnTimeout);
         expirerThread = new ConnectionExpirerThread();
 
         int numCores = Runtime.getRuntime().availableProcessors();
@@ -809,7 +809,7 @@ private void addCnxn(NIOServerCnxn cnxn) throws IOException {
             // of 1 entry --  we need to set the initial cap
             // to 2 to avoid rehash when the first entry is added
             // Construct a ConcurrentHashSet using a ConcurrentHashMap
-            set = Collections.newSetFromMap(new ConcurrentHashMap<NIOServerCnxn, Boolean>(2));
+            set = Collections.newSetFromMap(new ConcurrentHashMap<>(2));
             // Put the new set in the map, but only if another thread
             // hasn't beaten us to it
             Set<NIOServerCnxn> existingSet = ipMap.putIfAbsent(addr, set);
@@ -946,7 +946,7 @@ public void resetAllConnectionStats() {
 
     @Override
     public Iterable<Map<String, Object>> getAllConnectionInfo(boolean brief) {
-        HashSet<Map<String, Object>> info = new HashSet<Map<String, Object>>();
+        HashSet<Map<String, Object>> info = new HashSet<>();
         // No need to synchronize since cnxns is backed by a ConcurrentHashMap
         for (ServerCnxn c : cnxns) {
             info.add(c.getConnectionInfo(brief));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 68335485bf7..8d90a2c749a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -809,7 +809,7 @@ public void resetAllConnectionStats() {
 
     @Override
     public Iterable<Map<String, Object>> getAllConnectionInfo(boolean brief) {
-        Set<Map<String, Object>> info = new HashSet<Map<String, Object>>();
+        Set<Map<String, Object>> info = new HashSet<>();
         // No need to synchronize since cnxns is backed by a ConcurrentHashMap
         for (ServerCnxn c : cnxns) {
             info.add(c.getConnectionInfo(brief));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 35293359fe7..8404ed9b82e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -214,7 +214,7 @@ protected void addChangeRecord(ChangeRecord c) {
      *         rolled back in any failure.
      */
     private Map<String, ChangeRecord> getPendingChanges(MultiOperationRecord multiRequest) {
-        Map<String, ChangeRecord> pendingChangeRecords = new HashMap<String, ChangeRecord>();
+        Map<String, ChangeRecord> pendingChangeRecords = new HashMap<>();
 
         for (Op op : multiRequest) {
             String path = op.getPath();
@@ -467,7 +467,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record)
                     LOG.warn(msg);
                     throw new KeeperException.BadArgumentsException(msg);
                 }
-                Map<Long, QuorumServer> nextServers = new HashMap<Long, QuorumServer>(lastSeenQV.getAllMembers());
+                Map<Long, QuorumServer> nextServers = new HashMap<>(lastSeenQV.getAllMembers());
                 try {
                     if (leavingServers != null) {
                         for (String leaving : leavingServers) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
index d152fabd8dd..d2fa93f5a83 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
@@ -109,7 +109,7 @@ static void purgeOlderSnapshots(FileTxnSnapLog txnLog, File snapShot) {
          * recoverability of all snapshots being retained.  We determine that log file here by
          * calling txnLog.getSnapshotLogs().
          */
-        final Set<File> retainedTxnLogs = new HashSet<File>();
+        final Set<File> retainedTxnLogs = new HashSet<>();
         retainedTxnLogs.addAll(Arrays.asList(txnLog.getSnapshotLogs(leastZxidToBeRetain)));
 
         /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
index 307a53de52a..91b9ca5dfc6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
@@ -38,11 +38,11 @@ public class ReferenceCountedACLCache {
 
     private static final Logger LOG = LoggerFactory.getLogger(ReferenceCountedACLCache.class);
 
-    final Map<Long, List<ACL>> longKeyMap = new HashMap<Long, List<ACL>>();
+    final Map<Long, List<ACL>> longKeyMap = new HashMap<>();
 
-    final Map<List<ACL>, Long> aclKeyMap = new HashMap<List<ACL>, Long>();
+    final Map<List<ACL>, Long> aclKeyMap = new HashMap<>();
 
-    final Map<Long, AtomicLongWithEquals> referenceCounter = new HashMap<Long, AtomicLongWithEquals>();
+    final Map<Long, AtomicLongWithEquals> referenceCounter = new HashMap<>();
     private static final long OPEN_UNSAFE_ACL_ID = -1L;
 
     /**
@@ -107,7 +107,7 @@ public void deserialize(InputArchive ia) throws IOException {
         // keep read operations out of synchronization block
         while (i > 0) {
             Long val = ia.readLong("long");
-            List<ACL> aclList = new ArrayList<ACL>();
+            List<ACL> aclList = new ArrayList<>();
             Index j = ia.startVector("acls");
             if (j == null) {
                 throw new RuntimeException("Incorrent format of InputArchive when deserialize DataTree - missing acls");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index 4a401e5b919..5fb84d5842e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -61,7 +61,7 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
 
     private static final Logger LOG = LoggerFactory.getLogger(RequestThrottler.class);
 
-    private final LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<Request>();
+    private final LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<>();
 
     private final ZooKeeperServer zks;
     private volatile boolean stopping;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index 661c2aa2f09..331f38d7f27 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -547,7 +547,7 @@ public synchronized void dumpConnectionInfo(PrintWriter pwriter, boolean brief)
     }
 
     public synchronized Map<String, Object> getConnectionInfo(boolean brief) {
-        Map<String, Object> info = new LinkedHashMap<String, Object>();
+        Map<String, Object> info = new LinkedHashMap<>();
         info.put("remote_socket_address", getRemoteSocketAddress());
         info.put("interest_ops", getInterestOps());
         info.put("outstanding_requests", getOutstandingRequests());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index 62eded3ae4e..88bf0cc1cbc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -57,7 +57,7 @@ public abstract class ServerCnxnFactory {
     protected int maxCnxns;
 
     // sessionMap is used by closeSession()
-    final ConcurrentHashMap<Long, ServerCnxn> sessionMap = new ConcurrentHashMap<Long, ServerCnxn>();
+    final ConcurrentHashMap<Long, ServerCnxn> sessionMap = new ConcurrentHashMap<>();
 
     private static String loginUser = Login.SYSTEM_USER;
 
@@ -198,11 +198,11 @@ public static ServerCnxnFactory createFactory(InetSocketAddress addr, int maxCli
 
     public abstract Iterable<Map<String, Object>> getAllConnectionInfo(boolean brief);
 
-    private final ConcurrentHashMap<ServerCnxn, ConnectionBean> connectionBeans = new ConcurrentHashMap<ServerCnxn, ConnectionBean>();
+    private final ConcurrentHashMap<ServerCnxn, ConnectionBean> connectionBeans = new ConcurrentHashMap<>();
 
     // Connection set is relied on heavily by four letter commands
     // Construct a ConcurrentHashSet using a ConcurrentHashMap
-    protected final Set<ServerCnxn> cnxns = Collections.newSetFromMap(new ConcurrentHashMap<ServerCnxn, Boolean>());
+    protected final Set<ServerCnxn> cnxns = Collections.newSetFromMap(new ConcurrentHashMap<>());
     public void unregisterConnection(ServerCnxn serverCnxn) {
         ConnectionBean jmxConnectionBean = connectionBeans.remove(serverCnxn);
         if (jmxConnectionBean != null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
index e8711988125..7066a6dbeae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
@@ -46,7 +46,7 @@ public class SessionTrackerImpl extends ZooKeeperCriticalThread implements Sessi
 
     private static final Logger LOG = LoggerFactory.getLogger(SessionTrackerImpl.class);
 
-    protected final ConcurrentHashMap<Long, SessionImpl> sessionsById = new ConcurrentHashMap<Long, SessionImpl>();
+    protected final ConcurrentHashMap<Long, SessionImpl> sessionsById = new ConcurrentHashMap<>();
 
     private final ExpiryQueue<SessionImpl> sessionExpiryQueue;
 
@@ -110,7 +110,7 @@ public static long initializeNextSessionId(long id) {
     public SessionTrackerImpl(SessionExpirer expirer, ConcurrentMap<Long, Integer> sessionsWithTimeout, int tickTime, long serverId, ZooKeeperServerListener listener) {
         super("SessionTracker", listener);
         this.expirer = expirer;
-        this.sessionExpiryQueue = new ExpiryQueue<SessionImpl>(tickTime);
+        this.sessionExpiryQueue = new ExpiryQueue<>(tickTime);
         this.sessionsWithTimeout = sessionsWithTimeout;
         this.nextSessionId.set(initializeNextSessionId(serverId));
         for (Entry<Long, Integer> e : sessionsWithTimeout.entrySet()) {
@@ -133,9 +133,9 @@ public void dumpSessions(PrintWriter pwriter) {
     public synchronized Map<Long, Set<Long>> getSessionExpiryMap() {
         // Convert time -> sessions map to time -> session IDs map
         Map<Long, Set<SessionImpl>> expiryMap = sessionExpiryQueue.getExpiryMap();
-        Map<Long, Set<Long>> sessionExpiryMap = new TreeMap<Long, Set<Long>>();
+        Map<Long, Set<Long>> sessionExpiryMap = new TreeMap<>();
         for (Entry<Long, Set<SessionImpl>> e : expiryMap.entrySet()) {
-            Set<Long> ids = new HashSet<Long>();
+            Set<Long> ids = new HashSet<>();
             sessionExpiryMap.put(e.getKey(), ids);
             for (SessionImpl s : e.getValue()) {
                 ids.add(s.sessionId);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
index 84d265c81d7..bb6a45db84c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
@@ -169,7 +169,7 @@ public int compare(TreeNode left, TreeNode right) {
       public TreeNode(String label, long size) {
         this.label = label;
         this.size = size;
-        this.children = new ArrayList<TreeNode>();
+        this.children = new ArrayList<>();
       }
 
       void populateChildren(String path, DataTree dataTree, TreeInfo treeInfo) throws Exception {
@@ -208,8 +208,8 @@ void populateChildren(String path, DataTree dataTree, TreeInfo treeInfo, int cur
 
     final TreeNode root;
     long count;
-    List<ArrayList<TreeNode>> nodesAtDepths = new ArrayList<ArrayList<TreeNode>>();
-    Map<String, TreeNode> nodesByName = new HashMap<String, TreeNode>();
+    List<ArrayList<TreeNode>> nodesAtDepths = new ArrayList<>();
+    Map<String, TreeNode> nodesByName = new HashMap<>();
 
     TreeInfo(File snapshot) throws Exception {
       DataTree dataTree = getSnapshot(snapshot);
@@ -229,7 +229,7 @@ void populateChildren(String path, DataTree dataTree, TreeInfo treeInfo, int cur
 
     void registerNode(TreeNode node, int depth) {
       while (depth > nodesAtDepths.size()) {
-        nodesAtDepths.add(new ArrayList<TreeNode>());
+        nodesAtDepths.add(new ArrayList<>());
       }
       nodesAtDepths.get(depth - 1).add(node);
       nodesByName.put(node.label, node);
@@ -261,7 +261,7 @@ public static Comparator<TreeNode> MakeAlphabeticComparator() {
   private static DataTree getSnapshot(File file) throws Exception {
     FileSnap fileSnap = new FileSnap(null);
     DataTree dataTree = new DataTree();
-    Map<Long, Integer> sessions = new HashMap<Long, Integer>();
+    Map<Long, Integer> sessions = new HashMap<>();
     CheckedInputStream snapIS = SnapStream.getInputStream(file);
 
     long beginning = System.nanoTime();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
index 0e5ec868f35..4ad590c9972 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
@@ -99,7 +99,7 @@ public void run(String snapshotFileName, boolean dumpData, boolean dumpJson) thr
             FileSnap fileSnap = new FileSnap(null);
 
             DataTree dataTree = new DataTree();
-            Map<Long, Integer> sessions = new HashMap<Long, Integer>();
+            Map<Long, Integer> sessions = new HashMap<>();
 
             fileSnap.deserialize(dataTree, sessions, ia);
             long fileNameZxid = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
index 2d5f30b638f..44478316603 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
@@ -70,7 +70,7 @@ public void run(String snapshotFileName, String startingNode, int maxDepth) thro
       FileSnap fileSnap = new FileSnap(null);
 
       DataTree dataTree = new DataTree();
-      Map<Long, Integer> sessions = new HashMap<Long, Integer>();
+      Map<Long, Integer> sessions = new HashMap<>();
 
       fileSnap.deserialize(dataTree, sessions, ia);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
index 4df319f86a4..8468b522747 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
@@ -69,7 +69,7 @@ public class SyncRequestProcessor extends ZooKeeperCriticalThread implements Req
     private int randRoll;
     private long randSize;
 
-    private final BlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    private final BlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     private final Semaphore snapThreadMutex = new Semaphore(1);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
index b4dcd066f76..305d0e2ec99 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
@@ -47,7 +47,7 @@ public class WorkerService {
 
     private static final Logger LOG = LoggerFactory.getLogger(WorkerService.class);
 
-    private final ArrayList<ExecutorService> workers = new ArrayList<ExecutorService>();
+    private final ArrayList<ExecutorService> workers = new ArrayList<>();
 
     private final String threadNamePrefix;
     private int numWorkerThreads;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index f20af88d588..a8729841ce4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -110,7 +110,7 @@ public class ZKDatabase {
      */
     public ZKDatabase(FileTxnSnapLog snapLog) {
         dataTree = createDataTree();
-        sessionsWithTimeouts = new ConcurrentHashMap<Long, Integer>();
+        sessionsWithTimeouts = new ConcurrentHashMap<>();
         this.snapLog = snapLog;
 
         try {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index bbb0f7feeb8..72be66aab29 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -241,7 +241,7 @@ protected enum State {
     private final AtomicInteger requestsInProcess = new AtomicInteger(0);
     final Deque<ChangeRecord> outstandingChanges = new ArrayDeque<>();
     // this data structure must be accessed under the outstandingChanges lock
-    final Map<String, ChangeRecord> outstandingChangesForPath = new HashMap<String, ChangeRecord>();
+    final Map<String, ChangeRecord> outstandingChangesForPath = new HashMap<>();
 
     protected ServerCnxnFactory serverCnxnFactory;
     protected ServerCnxnFactory secureServerCnxnFactory;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java
index 499dd568071..8d0fe9394a8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java
@@ -187,7 +187,7 @@ public int getClientPortListenBacklog() {
      * @return map representation of configuration
      */
     public Map<String, Object> toMap() {
-        Map<String, Object> conf = new LinkedHashMap<String, Object>();
+        Map<String, Object> conf = new LinkedHashMap<>();
         conf.put(KEY_CLIENT_PORT, clientPort);
         conf.put(KEY_DATA_DIR, dataDir);
         conf.put(KEY_DATA_LOG_DIR, dataLogDir);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
index 322de178f73..b3714c25654 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
@@ -41,7 +41,7 @@ protected CommandBase(List<String> names, boolean serverRequired) {
 
     protected CommandBase(List<String> names, boolean serverRequired, String doc) {
         this.primaryName = names.get(0);
-        this.names = new HashSet<String>(names);
+        this.names = new HashSet<>(names);
         this.doc = doc;
         this.serverRequired = serverRequired;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
index f47b4e94293..d68d8ad399f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
@@ -75,7 +75,7 @@ public CommandResponse(String command, String error, int statusCode) {
     public CommandResponse(final String command, final String error, final int statusCode, final InputStream inputStream) {
         this.command = command;
         this.error = error;
-        data = new LinkedHashMap<String, Object>();
+        data = new LinkedHashMap<>();
         headers = new HashMap<>();
         this.statusCode = statusCode;
         this.inputStream = inputStream;
@@ -177,7 +177,7 @@ public Map<String, String> getHeaders() {
      * @return map representation of response
      */
     public Map<String, Object> toMap() {
-        Map<String, Object> m = new LinkedHashMap<String, Object>(data);
+        Map<String, Object> m = new LinkedHashMap<>(data);
         m.put(KEY_COMMAND, command);
         m.put(KEY_ERROR, error);
         m.putAll(data);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 1911b5a57ab..dfdbe8e23e1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -78,8 +78,8 @@ public class Commands {
     private static final long rateLimiterInterval = Integer.parseInt(System.getProperty(ADMIN_RATE_LIMITER_INTERVAL, "300000"));
 
     /** Maps command names to Command instances */
-    private static Map<String, Command> commands = new HashMap<String, Command>();
-    private static Set<String> primaryNames = new HashSet<String>();
+    private static Map<String, Command> commands = new HashMap<>();
+    private static Set<String> primaryNames = new HashSet<>();
 
     /**
      * Registers the given command. Registered commands can be run by passing
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index effececdcbd..98f2cb0514f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -255,7 +255,7 @@ protected void doGet(
 
             // Extract keyword arguments to command from request parameters
             @SuppressWarnings("unchecked") Map<String, String[]> parameterMap = request.getParameterMap();
-            Map<String, String> kwargs = new HashMap<String, String>();
+            Map<String, String> kwargs = new HashMap<>();
             for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
                 kwargs.put(entry.getKey(), entry.getValue()[0]);
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
index d5649c8d35c..1e24c928353 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
@@ -52,7 +52,7 @@ public EnsembleAuthenticationProvider() {
     }
 
     public void setEnsembleNames(String namesCSV) {
-        ensembleNames = new HashSet<String>();
+        ensembleNames = new HashSet<>();
         for (String name : namesCSV.split(",")) {
             ensembleNames.add(name.trim());
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java
index 02ec5932182..a240c45b656 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java
@@ -322,7 +322,7 @@ String apply(String[] params) throws IOException {
     }
 
     static List<Rule> parseRules(String rules) {
-        List<Rule> result = new ArrayList<Rule>();
+        List<Rule> result = new ArrayList<>();
         String remaining = rules.trim();
         while (remaining.length() > 0) {
             Matcher matcher = ruleParser.matcher(remaining);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
index b6415fd80f9..4fca508df1d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
@@ -43,7 +43,7 @@ public class SaslServerCallbackHandler implements CallbackHandler {
     private static final String SYSPROP_REMOVE_REALM = "zookeeper.kerberos.removeRealmFromPrincipal";
 
     private String userName;
-    private final Map<String, String> credentials = new HashMap<String, String>();
+    private final Map<String, String> credentials = new HashMap<>();
 
     public SaslServerCallbackHandler(Configuration configuration) throws IOException {
         String serverSection = System.getProperty(
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java
index 40b1698e32f..3c615f4faf7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java
@@ -151,9 +151,9 @@ public class FourLetterCommands {
 
     private static final Logger LOG = LoggerFactory.getLogger(FourLetterCommands.class);
 
-    private static final Map<Integer, String> cmd2String = new HashMap<Integer, String>();
+    private static final Map<Integer, String> cmd2String = new HashMap<>();
 
-    private static final Set<String> whiteListedCommands = new HashSet<String>();
+    private static final Set<String> whiteListedCommands = new HashSet<>();
 
     private static boolean whiteListInitialized = false;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java
index 0f06e4a66cd..e6b6d0f5b97 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java
@@ -109,7 +109,7 @@ public void add(long value) {
     }
 
     public Map<String, Object> values() {
-        Map<String, Object> m = new LinkedHashMap<String, Object>();
+        Map<String, Object> m = new LinkedHashMap<>();
         m.put("avg_" + name, this.getAvg());
         m.put("min_" + name, this.getMin());
         m.put("max_" + name, this.getMax());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java
index 3162043a7a5..ed274085a08 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java
@@ -84,7 +84,7 @@ private static long nextLong(long n) {
         @Override
         public Snapshot getSnapshot() {
             final int s = size();
-            final List<Long> copy = new ArrayList<Long>(s);
+            final List<Long> copy = new ArrayList<>(s);
             for (int i = 0; i < s; i++) {
                 copy.add(values.get(i));
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java
index 71218335c64..5af8995a428 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java
@@ -48,7 +48,7 @@ public long get() {
 
     @Override
     public Map<String, Object> values() {
-        Map<String, Object> m = new LinkedHashMap<String, Object>();
+        Map<String, Object> m = new LinkedHashMap<>();
         m.put(name, this.get());
         return m;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index f162f0cc6c1..55e7f723f43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -166,7 +166,7 @@ public File findMostRecentSnapshot() {
     protected List<File> findNValidSnapshots(int n) {
         List<File> files = Util.sortDataDir(snapDir.listFiles(), SNAPSHOT_FILE_PREFIX, false);
         int count = 0;
-        List<File> list = new ArrayList<File>();
+        List<File> list = new ArrayList<>();
         for (File f : files) {
             // we should catch the exceptions
             // from the valid snapshot and continue
@@ -196,7 +196,7 @@ protected List<File> findNValidSnapshots(int n) {
     public List<File> findNRecentSnapshots(int n) throws IOException {
         List<File> files = Util.sortDataDir(snapDir.listFiles(), SNAPSHOT_FILE_PREFIX, false);
         int count = 0;
-        List<File> list = new ArrayList<File>();
+        List<File> list = new ArrayList<>();
         for (File f : files) {
             if (count == n) {
                 break;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index 7d4366065df..e095d2faa4d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -332,7 +332,7 @@ public static File[] getLogFiles(File[] logDirList, long snapshotZxid) {
                 logZxid = fzxid;
             }
         }
-        List<File> v = new ArrayList<File>(5);
+        List<File> v = new ArrayList<>(5);
         for (File f : files) {
             long fzxid = Util.getZxidFromName(f.getName(), LOG_FILE_PREFIX);
             if (fzxid < logZxid) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
index 6949c43697b..2aedf1dbf67 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
@@ -248,7 +248,7 @@ public int compare(File o1, File o2) {
      */
     public static List<File> sortDataDir(File[] files, String prefix, boolean ascending) {
         if (files == null) {
-            return new ArrayList<File>(0);
+            return new ArrayList<>(0);
         }
         List<File> filelist = Arrays.asList(files);
         Collections.sort(filelist, new DataDirFileComparator(prefix, ascending));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
index 11ba0936122..3be43c37e30 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
@@ -90,7 +90,7 @@ public class CommitProcessor extends ZooKeeperCriticalThread implements RequestP
     /**
      * Incoming requests.
      */
-    protected LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    protected LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     /**
      * Incoming requests that are waiting on a commit,
@@ -111,7 +111,7 @@ public class CommitProcessor extends ZooKeeperCriticalThread implements RequestP
     /**
      * Requests that have been committed.
      */
-    protected final LinkedBlockingQueue<Request> committedRequests = new LinkedBlockingQueue<Request>();
+    protected final LinkedBlockingQueue<Request> committedRequests = new LinkedBlockingQueue<>();
 
     /**
      * Requests that we are holding until commit comes in. Keys represent
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 91207d110f4..f4a5f9882c7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -646,8 +646,8 @@ private void starter(QuorumPeer self, QuorumCnxManager manager) {
         proposedLeader = -1;
         proposedZxid = -1;
 
-        sendqueue = new LinkedBlockingQueue<ToSend>();
-        recvqueue = new LinkedBlockingQueue<Notification>();
+        sendqueue = new LinkedBlockingQueue<>();
+        recvqueue = new LinkedBlockingQueue<>();
         this.messenger = new Messenger(manager);
     }
 
@@ -925,7 +925,7 @@ public Vote lookForLeader() throws InterruptedException {
              * if v.electionEpoch == logicalclock. The current participant uses recvset to deduce on whether a majority
              * of participants has voted for it.
              */
-            Map<Long, Vote> recvset = new HashMap<Long, Vote>();
+            Map<Long, Vote> recvset = new HashMap<>();
 
             /*
              * The votes from previous leader elections, as well as the votes from the current leader election are
@@ -934,7 +934,7 @@ public Vote lookForLeader() throws InterruptedException {
              * outofelection to learn which participant is the leader if it arrives late (i.e., higher logicalclock than
              * the electionEpoch of the received notifications) in a leader election.
              */
-            Map<Long, Vote> outofelection = new HashMap<Long, Vote>();
+            Map<Long, Vote> outofelection = new HashMap<>();
 
             int notTimeout = minNotificationInterval;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index 58ca9905dfe..ef01ab32242 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -47,7 +47,7 @@ public class FollowerRequestProcessor extends ZooKeeperCriticalThread implements
 
     RequestProcessor nextProcessor;
 
-    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     boolean finished = false;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
index 8d371ae5790..82e56c390d8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
@@ -59,7 +59,7 @@ public class FollowerZooKeeperServer extends LearnerZooKeeperServer {
      */
     FollowerZooKeeperServer(FileTxnSnapLog logFactory, QuorumPeer self, ZKDatabase zkDb) throws IOException {
         super(logFactory, self.tickTime, self.minSessionTimeout, self.maxSessionTimeout, self.clientPortListenBacklog, zkDb, self);
-        this.pendingSyncs = new ConcurrentLinkedQueue<Request>();
+        this.pendingSyncs = new ConcurrentLinkedQueue<>();
     }
 
     public Follower getFollower() {
@@ -77,7 +77,7 @@ protected void setupRequestProcessors() {
         syncProcessor.start();
     }
 
-    LinkedBlockingQueue<Request> pendingTxns = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> pendingTxns = new LinkedBlockingQueue<>();
 
     public void logRequest(TxnHeader hdr, Record txn, TxnDigest digest) {
         Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index aebde052452..b15f5f555cc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -127,7 +127,7 @@ public static int getAckLoggingFrequency() {
     volatile LearnerCnxAcceptor cnxAcceptor = null;
 
     // list of all the learners, including followers and observers
-    private final HashSet<LearnerHandler> learners = new HashSet<LearnerHandler>();
+    private final HashSet<LearnerHandler> learners = new HashSet<>();
 
     private final BufferStats proposalStats;
 
@@ -143,24 +143,24 @@ public BufferStats getProposalStats() {
      */
     public List<LearnerHandler> getLearners() {
         synchronized (learners) {
-            return new ArrayList<LearnerHandler>(learners);
+            return new ArrayList<>(learners);
         }
     }
 
     // list of followers that are ready to follow (i.e synced with the leader)
-    private final HashSet<LearnerHandler> forwardingFollowers = new HashSet<LearnerHandler>();
+    private final HashSet<LearnerHandler> forwardingFollowers = new HashSet<>();
 
     /**
      * Returns a copy of the current forwarding follower snapshot
      */
     public List<LearnerHandler> getForwardingFollowers() {
         synchronized (forwardingFollowers) {
-            return new ArrayList<LearnerHandler>(forwardingFollowers);
+            return new ArrayList<>(forwardingFollowers);
         }
     }
 
     public List<LearnerHandler> getNonVotingFollowers() {
-        List<LearnerHandler> nonVotingFollowers = new ArrayList<LearnerHandler>();
+        List<LearnerHandler> nonVotingFollowers = new ArrayList<>();
         synchronized (forwardingFollowers) {
             for (LearnerHandler lh : forwardingFollowers) {
                 if (!isParticipant(lh.getSid())) {
@@ -181,14 +181,14 @@ void addForwardingFollower(LearnerHandler lh) {
         }
     }
 
-    private final HashSet<LearnerHandler> observingLearners = new HashSet<LearnerHandler>();
+    private final HashSet<LearnerHandler> observingLearners = new HashSet<>();
 
     /**
      * Returns a copy of the current observer snapshot
      */
     public List<LearnerHandler> getObservingLearners() {
         synchronized (observingLearners) {
-            return new ArrayList<LearnerHandler>(observingLearners);
+            return new ArrayList<>(observingLearners);
         }
     }
 
@@ -217,7 +217,7 @@ public void resetObserverConnectionStats() {
     }
 
     // Pending sync requests. Must access under 'this' lock.
-    private final Map<Long, List<LearnerSyncRequest>> pendingSyncs = new HashMap<Long, List<LearnerSyncRequest>>();
+    private final Map<Long, List<LearnerSyncRequest>> pendingSyncs = new HashMap<>();
 
     public synchronized int getNumPendingSyncs() {
         return pendingSyncs.size();
@@ -270,7 +270,7 @@ boolean isLearnerSynced(LearnerHandler peer) {
      * @param qv is a QuorumVerifier
      */
     public boolean isQuorumSynced(QuorumVerifier qv) {
-        HashSet<Long> ids = new HashSet<Long>();
+        HashSet<Long> ids = new HashSet<>();
         if (qv.getVotingMembers().containsKey(self.getMyId())) {
             ids.add(self.getMyId());
         }
@@ -430,9 +430,9 @@ Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean por
      */
     static final int INFORMANDACTIVATE = 19;
 
-    final ConcurrentMap<Long, Proposal> outstandingProposals = new ConcurrentHashMap<Long, Proposal>();
+    final ConcurrentMap<Long, Proposal> outstandingProposals = new ConcurrentHashMap<>();
 
-    private final ConcurrentLinkedQueue<Proposal> toBeApplied = new ConcurrentLinkedQueue<Proposal>();
+    private final ConcurrentLinkedQueue<Proposal> toBeApplied = new ConcurrentLinkedQueue<>();
 
     // VisibleForTesting
     protected final Proposal newLeaderProposal = new Proposal();
@@ -669,7 +669,7 @@ void lead() throws IOException, InterruptedException {
                 shutdown("Waiting for a quorum of followers, only synced with sids: [ "
                          + newLeaderProposal.ackSetsToString()
                          + " ]");
-                HashSet<Long> followerSet = new HashSet<Long>();
+                HashSet<Long> followerSet = new HashSet<>();
 
                 for (LearnerHandler f : getLearners()) {
                     if (self.getQuorumVerifier().getVotingMembers().containsKey(f.getSid())) {
@@ -877,7 +877,7 @@ private long getDesignatedLeader(Proposal reconfigProposal, long zxid) {
         // start with an initial set of candidates that are voters from new config that
         // acknowledged the reconfig op (there must be a quorum). Choose one of them as
         // current leader candidate
-        HashSet<Long> candidates = new HashSet<Long>(newQVAcksetPair.getAckset());
+        HashSet<Long> candidates = new HashSet<>(newQVAcksetPair.getAckset());
         candidates.remove(self.getMyId()); // if we're here, I shouldn't be the leader
         long curCandidate = candidates.iterator().next();
 
@@ -1326,7 +1326,7 @@ public synchronized long startForwarding(LearnerHandler handler, long lastSeenZx
             }
             // Only participant need to get outstanding proposals
             if (handler.getLearnerType() == LearnerType.PARTICIPANT) {
-                List<Long> zxids = new ArrayList<Long>(outstandingProposals.keySet());
+                List<Long> zxids = new ArrayList<>(outstandingProposals.keySet());
                 Collections.sort(zxids);
                 for (Long zxid : zxids) {
                     if (zxid <= lastSeenZxid) {
@@ -1355,7 +1355,7 @@ public void waitForStartup() throws InterruptedException {
     }
 
     // VisibleForTesting
-    protected final Set<Long> connectingFollowers = new HashSet<Long>();
+    protected final Set<Long> connectingFollowers = new HashSet<>();
 
     private volatile boolean quitWaitForEpoch = false;
     private volatile long timeStartWaitForEpoch = -1;
@@ -1453,7 +1453,7 @@ public ZKDatabase getZKDatabase() {
     }
 
     // VisibleForTesting
-    protected final Set<Long> electingFollowers = new HashSet<Long>();
+    protected final Set<Long> electingFollowers = new HashSet<>();
     // VisibleForTesting
     protected boolean electionFinished = false;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 0ed3b1ebe90..d534b8f45e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -133,7 +133,7 @@ public Socket getSocket() {
         LOG.info("{} = {}", LEARNER_CLOSE_SOCKET_ASYNC, closeSocketAsync);
     }
 
-    final ConcurrentHashMap<Long, ServerCnxn> pendingRevalidations = new ConcurrentHashMap<Long, ServerCnxn>();
+    final ConcurrentHashMap<Long, ServerCnxn> pendingRevalidations = new ConcurrentHashMap<>();
 
     public int getPendingRevalidationsCount() {
         return pendingRevalidations.size();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index eea11d33a2c..169c3d1d2b0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -114,7 +114,7 @@ int getVersion() {
     /**
      * The packets to be sent to the learner
      */
-    final LinkedBlockingQueue<QuorumPacket> queuedPackets = new LinkedBlockingQueue<QuorumPacket>();
+    final LinkedBlockingQueue<QuorumPacket> queuedPackets = new LinkedBlockingQueue<>();
     private final AtomicLong queuedPacketsSize = new AtomicLong();
 
     protected final AtomicLong packetsReceived = new AtomicLong();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
index 78c927a7d7c..8983bdf3bbe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
@@ -54,7 +54,7 @@ public class LearnerSessionTracker extends UpgradeableSessionTracker {
 
     private final SessionExpirer expirer;
     // Touch table for the global sessions
-    private final AtomicReference<Map<Long, Integer>> touchTable = new AtomicReference<Map<Long, Integer>>();
+    private final AtomicReference<Map<Long, Integer>> touchTable = new AtomicReference<>();
     private final long serverId;
     private final AtomicLong nextSessionId = new AtomicLong();
 
@@ -62,7 +62,7 @@ public class LearnerSessionTracker extends UpgradeableSessionTracker {
 
     public LearnerSessionTracker(SessionExpirer expirer, ConcurrentMap<Long, Integer> sessionsWithTimeouts, int tickTime, long id, boolean localSessionsEnabled, ZooKeeperServerListener listener) {
         this.expirer = expirer;
-        this.touchTable.set(new ConcurrentHashMap<Long, Integer>());
+        this.touchTable.set(new ConcurrentHashMap<>());
         this.globalSessionsWithTimeouts = sessionsWithTimeouts;
         this.serverId = id;
         nextSessionId.set(SessionTrackerImpl.initializeNextSessionId(serverId));
@@ -150,7 +150,7 @@ public boolean touchSession(long sessionId, int sessionTimeout) {
     }
 
     public Map<Long, Integer> snapshot() {
-        return touchTable.getAndSet(new ConcurrentHashMap<Long, Integer>());
+        return touchTable.getAndSet(new ConcurrentHashMap<>());
     }
 
     public long createSession(int sessionTimeout) {
@@ -202,7 +202,7 @@ public void dumpSessions(PrintWriter pwriter) {
         pwriter.print("Global Sessions(");
         pwriter.print(globalSessionsWithTimeouts.size());
         pwriter.println("):");
-        SortedSet<Long> sessionIds = new TreeSet<Long>(globalSessionsWithTimeouts.keySet());
+        SortedSet<Long> sessionIds = new TreeSet<>(globalSessionsWithTimeouts.keySet());
         for (long sessionId : sessionIds) {
             pwriter.print("0x");
             pwriter.print(Long.toHexString(sessionId));
@@ -222,7 +222,7 @@ public void setSessionClosing(long sessionId) {
 
     @Override
     public Map<Long, Set<Long>> getSessionExpiryMap() {
-        return new HashMap<Long, Set<Long>>();
+        return new HashMap<>();
     }
 
     public Set<Long> globalSessions() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
index 98c0d0c08bf..2369eabe36c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
@@ -74,7 +74,7 @@ public class ObserverMaster extends LearnerMaster implements Runnable {
     private FollowerZooKeeperServer zks;
     private int port;
 
-    private Set<LearnerHandler> activeObservers = Collections.newSetFromMap(new ConcurrentHashMap<LearnerHandler, Boolean>());
+    private Set<LearnerHandler> activeObservers = Collections.newSetFromMap(new ConcurrentHashMap<>());
 
     private final ConcurrentHashMap<LearnerHandler, LearnerHandlerBean> connectionBeans = new ConcurrentHashMap<>();
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
index 0e7071b91b7..1d7e5c5c37e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
@@ -45,7 +45,7 @@ public class ObserverRequestProcessor extends ZooKeeperCriticalThread implements
 
     // We keep a queue of requests. As requests get submitted they are
     // stored here. The queue is drained in the run() method.
-    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     boolean finished = false;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
index a41a9187743..30f759fb897 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
@@ -48,7 +48,7 @@ public class ObserverZooKeeperServer extends LearnerZooKeeperServer {
 
     /*
      * Pending sync requests
-     */ ConcurrentLinkedQueue<Request> pendingSyncs = new ConcurrentLinkedQueue<Request>();
+     */ ConcurrentLinkedQueue<Request> pendingSyncs = new ConcurrentLinkedQueue<>();
 
     ObserverZooKeeperServer(FileTxnSnapLog logFactory, QuorumPeer self, ZKDatabase zkDb) throws IOException {
         super(logFactory, self.tickTime, self.minSessionTimeout, self.maxSessionTimeout, self.clientPortListenBacklog, zkDb, self);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index e7ed9af6384..f5931fb97b0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -889,7 +889,7 @@ public void run() {
 
     private AtomicReference<ZabState> zabState = new AtomicReference<>(ZabState.ELECTION);
     private AtomicReference<SyncMode> syncMode = new AtomicReference<>(SyncMode.NONE);
-    private AtomicReference<String> leaderAddress = new AtomicReference<String>("");
+    private AtomicReference<String> leaderAddress = new AtomicReference<>("");
     private AtomicLong leaderId = new AtomicLong(-1);
 
     private boolean reconfigFlag = false; // indicates that a reconfig just committed
@@ -1066,7 +1066,7 @@ public static QuorumPeer testingQuorumPeer() throws SaslException {
     public QuorumPeer() throws SaslException {
         super("QuorumPeer");
         quorumStats = new QuorumStats(this);
-        jmxRemotePeerBean = new HashMap<Long, RemotePeerBean>();
+        jmxRemotePeerBean = new HashMap<>();
         adminServer = AdminServerFactory.createAdminServer();
         x509Util = createX509Util();
         initialize();
@@ -1108,7 +1108,7 @@ public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File dataDir, File dataLo
     public void initialize() throws SaslException {
         // init quorum auth server & learner
         if (isQuorumSaslAuthEnabled()) {
-            Set<String> authzHosts = new HashSet<String>();
+            Set<String> authzHosts = new HashSet<>();
             for (QuorumServer qs : getView().values()) {
                 authzHosts.add(qs.hostname);
             }
@@ -1660,7 +1660,7 @@ public Map<Long, QuorumPeer.QuorumServer> getObservingView() {
     }
 
     public synchronized Set<Long> getCurrentAndNextConfigVoters() {
-        Set<Long> voterIds = new HashSet<Long>(getQuorumVerifier().getVotingMembers().keySet());
+        Set<Long> voterIds = new HashSet<>(getQuorumVerifier().getVotingMembers().keySet());
         if (getLastSeenQuorumVerifier() != null) {
             voterIds.addAll(getLastSeenQuorumVerifier().getVotingMembers().keySet());
         }
@@ -1680,7 +1680,7 @@ public boolean viewContains(Long sid) {
      * Only used by QuorumStats at the moment
      */
     public String[] getQuorumPeers() {
-        List<String> l = new ArrayList<String>();
+        List<String> l = new ArrayList<>();
         synchronized (this) {
             if (leader != null) {
                 for (LearnerHandler fh : leader.getLearners()) {
@@ -2306,14 +2306,14 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
     }
 
     private void updateRemotePeerMXBeans(Map<Long, QuorumServer> newMembers) {
-        Set<Long> existingMembers = new HashSet<Long>(newMembers.keySet());
+        Set<Long> existingMembers = new HashSet<>(newMembers.keySet());
         existingMembers.retainAll(jmxRemotePeerBean.keySet());
         for (Long id : existingMembers) {
             RemotePeerBean rBean = jmxRemotePeerBean.get(id);
             rBean.setQuorumServer(newMembers.get(id));
         }
 
-        Set<Long> joiningMembers = new HashSet<Long>(newMembers.keySet());
+        Set<Long> joiningMembers = new HashSet<>(newMembers.keySet());
         joiningMembers.removeAll(jmxRemotePeerBean.keySet());
         joiningMembers.remove(getMyId()); // remove self as it is local bean
         for (Long id : joiningMembers) {
@@ -2327,7 +2327,7 @@ private void updateRemotePeerMXBeans(Map<Long, QuorumServer> newMembers) {
             }
         }
 
-        Set<Long> leavingMembers = new HashSet<Long>(jmxRemotePeerBean.keySet());
+        Set<Long> leavingMembers = new HashSet<>(jmxRemotePeerBean.keySet());
         leavingMembers.removeAll(newMembers.keySet());
         for (Long id : leavingMembers) {
             RemotePeerBean rBean = jmxRemotePeerBean.remove(id);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index d478c409c8f..05246baba7e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -547,7 +547,7 @@ public void write(Writer out) throws IOException {
                 Properties cfg = new Properties();
                 cfg.load(new StringReader(qv.toString()));
 
-                List<String> servers = new ArrayList<String>();
+                List<String> servers = new ArrayList<>();
                 for (Entry<Object, Object> entry : cfg.entrySet()) {
                     String key = entry.getKey().toString().trim();
                     if (!needKeepVersion && key.startsWith("version")) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index 0e29ccfdf6f..671d328ff43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -41,7 +41,7 @@ public class ReadOnlyRequestProcessor extends ZooKeeperCriticalThread implements
 
     private static final Logger LOG = LoggerFactory.getLogger(ReadOnlyRequestProcessor.class);
 
-    private final LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    private final LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     private volatile boolean finished = false;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java
index 461f46a0827..88260764328 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java
@@ -24,7 +24,7 @@
 
 public class SyncedLearnerTracker {
 
-    protected ArrayList<QuorumVerifierAcksetPair> qvAcksetPairs = new ArrayList<QuorumVerifierAcksetPair>();
+    protected ArrayList<QuorumVerifierAcksetPair> qvAcksetPairs = new ArrayList<>();
 
     public void addQuorumVerifier(QuorumVerifier qv) {
         qvAcksetPairs.add(new QuorumVerifierAcksetPair(qv, new HashSet<Long>(qv.getVotingMembers().size())));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
index fb5dbcc3671..66dfcbae7f3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
@@ -44,9 +44,9 @@ public void start() {
     }
 
     public void createLocalSessionTracker(SessionExpirer expirer, int tickTime, long id, ZooKeeperServerListener listener) {
-        this.localSessionsWithTimeouts = new ConcurrentHashMap<Long, Integer>();
+        this.localSessionsWithTimeouts = new ConcurrentHashMap<>();
         this.localSessionTracker = new LocalSessionTracker(expirer, this.localSessionsWithTimeouts, tickTime, id, listener);
-        this.upgradingSessions = new ConcurrentHashMap<Long, Integer>();
+        this.upgradingSessions = new ConcurrentHashMap<>();
     }
 
     public boolean isTrackingSession(long sessionId) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
index 5376ae6c520..d4c7b21608f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
@@ -66,15 +66,15 @@ public class QuorumHierarchical implements QuorumVerifier {
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumHierarchical.class);
 
-    private HashMap<Long, Long> serverWeight = new HashMap<Long, Long>();
-    private HashMap<Long, Long> serverGroup = new HashMap<Long, Long>();
-    private HashMap<Long, Long> groupWeight = new HashMap<Long, Long>();
+    private HashMap<Long, Long> serverWeight = new HashMap<>();
+    private HashMap<Long, Long> serverGroup = new HashMap<>();
+    private HashMap<Long, Long> groupWeight = new HashMap<>();
 
     private int numGroups = 0;
 
-    private Map<Long, QuorumServer> allMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> participatingMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> observingMembers = new HashMap<Long, QuorumServer>();
+    private Map<Long, QuorumServer> allMembers = new HashMap<>();
+    private Map<Long, QuorumServer> participatingMembers = new HashMap<>();
+    private Map<Long, QuorumServer> observingMembers = new HashMap<>();
 
     private long version = 0;
 
@@ -255,7 +255,7 @@ public String toString() {
             sw.append('\n');
         }
 
-        Map<Long, String> groups = new HashMap<Long, String>();
+        Map<Long, String> groups = new HashMap<>();
         for (Entry<Long, Long> pair : serverGroup.entrySet()) {
             Long sid = pair.getKey();
             Long gid = pair.getValue();
@@ -326,7 +326,7 @@ private void computeGroupWeight() {
      * Verifies if a given set is a quorum.
      */
     public boolean containsQuorum(Set<Long> set) {
-        HashMap<Long, Long> expansion = new HashMap<Long, Long>();
+        HashMap<Long, Long> expansion = new HashMap<>();
 
         /*
          * Adds up weights per group
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
index ed38533ec42..cc1723cf381 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
@@ -38,9 +38,9 @@ public class QuorumMaj implements QuorumVerifier {
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumMaj.class);
 
-    private Map<Long, QuorumServer> allMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> votingMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> observingMembers = new HashMap<Long, QuorumServer>();
+    private Map<Long, QuorumServer> allMembers = new HashMap<>();
+    private Map<Long, QuorumServer> votingMembers = new HashMap<>();
+    private Map<Long, QuorumServer> observingMembers = new HashMap<>();
     private long version = 0;
     protected int half;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java
index 5788e6adf5c..2af2f53c946 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java
@@ -53,7 +53,7 @@ public class BitHashSet implements Iterable<Integer> {
      * HashSet we need to go through all the words before return that
      * element, which is not efficient.
      */
-    private final Set<Integer> cache = new HashSet<Integer>();
+    private final Set<Integer> cache = new HashSet<>();
 
     private final int cacheSize;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java
index da76f467f57..19062403944 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java
@@ -30,8 +30,8 @@
  */
 public class BitMap<T> {
 
-    private final Map<T, Integer> value2Bit = new HashMap<T, Integer>();
-    private final Map<Integer, T> bit2Value = new HashMap<Integer, T>();
+    private final Map<T, Integer> value2Bit = new HashMap<>();
+    private final Map<Integer, T> bit2Value = new HashMap<>();
 
     private final BitSet freedBitSet = new BitSet();
     private Integer nextBit = Integer.valueOf(0);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
index 464621e6afe..ba91faaf87c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
@@ -162,7 +162,7 @@ public static void deserializeSnapshot(DataTree dt, InputArchive ia, Map<Long, I
     }
 
     public static void serializeSnapshot(DataTree dt, OutputArchive oa, Map<Long, Integer> sessions) throws IOException {
-        HashMap<Long, Integer> sessSnap = new HashMap<Long, Integer>(sessions);
+        HashMap<Long, Integer> sessSnap = new HashMap<>(sessions);
         oa.writeInt(sessSnap.size(), "count");
         for (Entry<Long, Integer> entry : sessSnap.entrySet()) {
             oa.writeLong(entry.getKey().longValue(), "id");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
index 1cc7deb9dc0..7f72175efdf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
@@ -55,10 +55,10 @@ public class WatchManagerOptimized implements IWatchManager, IDeadWatcherListene
 
     private static final Logger LOG = LoggerFactory.getLogger(WatchManagerOptimized.class);
 
-    private final ConcurrentHashMap<String, BitHashSet> pathWatches = new ConcurrentHashMap<String, BitHashSet>();
+    private final ConcurrentHashMap<String, BitHashSet> pathWatches = new ConcurrentHashMap<>();
 
     // watcher to bit id mapping
-    private final BitMap<Watcher> watcherBitIdMap = new BitMap<Watcher>();
+    private final BitMap<Watcher> watcherBitIdMap = new BitMap<>();
 
     // used to lazily remove the dead watchers
     private final WatcherCleaner watcherCleaner;
@@ -304,10 +304,10 @@ public WatchesSummary getWatchesSummary() {
 
     @Override
     public WatchesReport getWatches() {
-        Map<Long, Set<String>> id2paths = new HashMap<Long, Set<String>>();
+        Map<Long, Set<String>> id2paths = new HashMap<>();
         for (Entry<Watcher, Set<String>> e : getWatcher2PathesMap().entrySet()) {
             Long id = ((ServerCnxn) e.getKey()).getSessionId();
-            Set<String> paths = new HashSet<String>(e.getValue());
+            Set<String> paths = new HashSet<>(e.getValue());
             id2paths.put(id, paths);
         }
         return new WatchesReport(id2paths);
@@ -321,11 +321,11 @@ public WatchesReport getWatches() {
      */
     @Override
     public WatchesPathReport getWatchesByPath() {
-        Map<String, Set<Long>> path2ids = new HashMap<String, Set<Long>>();
+        Map<String, Set<Long>> path2ids = new HashMap<>();
         for (Entry<String, BitHashSet> e : pathWatches.entrySet()) {
             BitHashSet watchers = e.getValue();
             synchronized (watchers) {
-                Set<Long> ids = new HashSet<Long>(watchers.size());
+                Set<Long> ids = new HashSet<>(watchers.size());
                 path2ids.put(e.getKey(), ids);
                 for (Integer wbit : watchers) {
                     Watcher watcher = watcherBitIdMap.get(wbit);
@@ -343,7 +343,7 @@ public WatchesPathReport getWatchesByPath() {
      * it in this class.
      */
     public Map<Watcher, Set<String>> getWatcher2PathesMap() {
-        Map<Watcher, Set<String>> watcher2paths = new HashMap<Watcher, Set<String>>();
+        Map<Watcher, Set<String>> watcher2paths = new HashMap<>();
         for (Entry<String, BitHashSet> e : pathWatches.entrySet()) {
             String path = e.getKey();
             BitHashSet watchers = e.getValue();
@@ -355,7 +355,7 @@ public Map<Watcher, Set<String>> getWatcher2PathesMap() {
                         continue;
                     }
                     if (!watcher2paths.containsKey(w)) {
-                        watcher2paths.put(w, new HashSet<String>());
+                        watcher2paths.put(w, new HashSet<>());
                     }
                     watcher2paths.get(w).add(path);
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
index be98f988218..c3b7e602f1c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
@@ -80,7 +80,7 @@ public WatcherCleaner(IDeadWatcherListener listener, int watcherCleanThreshold,
                 maxInProcessingDeadWatchers);
         }
         this.maxInProcessingDeadWatchers = maxInProcessingDeadWatchers;
-        this.deadWatchers = new HashSet<Integer>();
+        this.deadWatchers = new HashSet<>();
         this.cleaners = new WorkerService("DeadWatcherCleanner", watcherCleanThreadsNum, false);
 
         LOG.info(
@@ -151,7 +151,7 @@ public void run() {
                 // there are millions of watches, that's why we're doing lazily
                 // batch clean up in a separate thread with a snapshot of the
                 // current dead watchers.
-                final Set<Integer> snapshot = new HashSet<Integer>(deadWatchers);
+                final Set<Integer> snapshot = new HashSet<>(deadWatchers);
                 deadWatchers.clear();
                 int total = snapshot.size();
                 LOG.info("Processing {} dead watchers", total);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java
index 9d244b07609..527d75b12d8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java
@@ -42,9 +42,9 @@ public class WatchesPathReport {
     }
 
     private static Map<String, Set<Long>> deepCopy(Map<String, Set<Long>> m) {
-        Map<String, Set<Long>> m2 = new HashMap<String, Set<Long>>();
+        Map<String, Set<Long>> m2 = new HashMap<>();
         for (Map.Entry<String, Set<Long>> e : m.entrySet()) {
-            m2.put(e.getKey(), new HashSet<Long>(e.getValue()));
+            m2.put(e.getKey(), new HashSet<>(e.getValue()));
         }
         return m2;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java
index e506143f1d1..1f3519bc9e6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java
@@ -42,9 +42,9 @@ public class WatchesReport {
     }
 
     private static Map<Long, Set<String>> deepCopy(Map<Long, Set<String>> m) {
-        Map<Long, Set<String>> m2 = new HashMap<Long, Set<String>>();
+        Map<Long, Set<String>> m2 = new HashMap<>();
         for (Map.Entry<Long, Set<String>> e : m.entrySet()) {
-            m2.put(e.getKey(), new HashSet<String>(e.getValue()));
+            m2.put(e.getKey(), new HashSet<>(e.getValue()));
         }
         return m2;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java
index 9cd36ca16de..f423a9c97a2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java
@@ -89,7 +89,7 @@ public int getTotalWatches() {
      * @return map representation of summary
      */
     public Map<String, Object> toMap() {
-        Map<String, Object> summary = new LinkedHashMap<String, Object>();
+        Map<String, Object> summary = new LinkedHashMap<>();
         summary.put(KEY_NUM_CONNECTIONS, numConnections);
         summary.put(KEY_NUM_PATHS, numPaths);
         summary.put(KEY_NUM_TOTAL_WATCHES, totalWatches);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
index 7dcd9e815c1..6591cf3ce05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
@@ -83,7 +83,7 @@ public void testGetEphemeralsSyncByPath() throws KeeperException, InterruptedExc
     public void testGetEphemerals() throws IOException, KeeperException, InterruptedException {
 
         final CountDownLatch doneProcessing = new CountDownLatch(1);
-        final List<String> unexpectedBehavior = new ArrayList<String>();
+        final List<String> unexpectedBehavior = new ArrayList<>();
         zk.getEphemerals((rc, ctx, paths) -> {
             if (paths == null) {
                 unexpectedBehavior.add(String.format("Expected ephemeral count for"
@@ -112,7 +112,7 @@ public void testGetEphemeralsByPath() throws IOException, KeeperException, Inter
 
         final CountDownLatch doneProcessing = new CountDownLatch(1);
         final String checkPath = BASE + "0";
-        final List<String> unexpectedBehavior = new ArrayList<String>();
+        final List<String> unexpectedBehavior = new ArrayList<>();
         zk.getEphemerals(checkPath, (rc, ctx, paths) -> {
             if (paths == null) {
                 unexpectedBehavior.add(String.format("Expected ephemeral count for %s to be %d but was null", checkPath, expected.length));
@@ -141,7 +141,7 @@ public void testGetEphemeralsEmpty() throws IOException, KeeperException, Interr
         final CountDownLatch doneProcessing = new CountDownLatch(1);
         final String checkPath = "/unknownPath";
         final int expectedSize = 0;
-        final List<String> unexpectedBehavior = new ArrayList<String>();
+        final List<String> unexpectedBehavior = new ArrayList<>();
         zk.getEphemerals(checkPath, (rc, ctx, paths) -> {
             if (paths == null) {
                 unexpectedBehavior.add(String.format("Expected ephemeral count for %s to be %d but was null", checkPath, expectedSize));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java b/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
index aecc7ede144..22d8d6efdeb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
@@ -35,7 +35,7 @@
  */
 public class JaasConfiguration extends javax.security.auth.login.Configuration {
 
-    private final Map<String, AppConfigurationEntry[]> sections = new HashMap<String, AppConfigurationEntry[]>();
+    private final Map<String, AppConfigurationEntry[]> sections = new HashMap<>();
 
     public JaasConfiguration() {
     }
@@ -47,7 +47,7 @@ public JaasConfiguration() {
      * @param args login key/value args
      */
     public void addSection(String name, String loginModuleName, String... args) {
-        Map<String, String> conf = new HashMap<String, String>();
+        Map<String, String> conf = new HashMap<>();
         // loop through the args (must be key/value sequence)
         for (int i = 0; i < args.length - 1; i += 2) {
             conf.put(args[i], args[i + 1]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index 93ab353abb8..945b87cb0ae 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -481,7 +481,7 @@ public void testRemoveWatcherWhenNoConnection(boolean useAsync) throws Exception
     @Timeout(value = 90)
     public void testManyPreNodeWatchers(boolean useAsync) throws Exception {
         int count = 50;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
         // Exists watcher
@@ -510,7 +510,7 @@ public void testManyPreNodeWatchers(boolean useAsync) throws Exception {
     @Timeout(value = 90)
     public void testManyChildWatchers(boolean useAsync) throws Exception {
         int count = 50;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
 
@@ -546,7 +546,7 @@ public void testManyChildWatchers(boolean useAsync) throws Exception {
     @Timeout(value = 90)
     public void testManyDataWatchers(boolean useAsync) throws Exception {
         int count = 50;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
 
@@ -578,7 +578,7 @@ public void testManyDataWatchers(boolean useAsync) throws Exception {
     @Timeout(value = 90)
     public void testManyWatchersWhenNoConnection(boolean useAsync) throws Exception {
         int count = 3;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
 
@@ -990,7 +990,7 @@ private static class MyWatcher implements Watcher {
         private final String path;
         private String eventPath;
         private CountDownLatch latch;
-        private List<EventType> eventsAfterWatchRemoval = new ArrayList<EventType>();
+        private List<EventType> eventsAfterWatchRemoval = new ArrayList<>();
         MyWatcher(String path, int count) {
             this.path = path;
             latch = new CountDownLatch(count);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
index 005cf4bac30..be9194f59e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
@@ -128,7 +128,7 @@ public void testAuth() throws Exception {
     public void testValidSaslIds() throws Exception {
         ZooKeeper zk = createClient();
 
-        List<String> validIds = new ArrayList<String>();
+        List<String> validIds = new ArrayList<>();
         validIds.add("user");
         validIds.add("service/host.name.com");
         validIds.add("user@KERB.REALM");
@@ -136,7 +136,7 @@ public void testValidSaslIds() throws Exception {
 
         int i = 0;
         for (String validId : validIds) {
-            List<ACL> aclList = new ArrayList<ACL>();
+            List<ACL> aclList = new ArrayList<>();
             ACL acl = new ACL(0, new Id("sasl", validId));
             aclList.add(acl);
             zk.create("/valid" + i, null, aclList, CreateMode.PERSISTENT);
@@ -148,13 +148,13 @@ public void testValidSaslIds() throws Exception {
     public void testInvalidSaslIds() throws Exception {
         ZooKeeper zk = createClient();
 
-        List<String> invalidIds = new ArrayList<String>();
+        List<String> invalidIds = new ArrayList<>();
         invalidIds.add("user@KERB.REALM/server.com");
         invalidIds.add("user@KERB.REALM1@KERB.REALM2");
 
         int i = 0;
         for (String invalidId : invalidIds) {
-            List<ACL> aclList = new ArrayList<ACL>();
+            List<ACL> aclList = new ArrayList<>();
             try {
                 ACL acl = new ACL(0, new Id("sasl", invalidId));
                 aclList.add(acl);
@@ -253,4 +253,4 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index c829e85da2a..186d7b6eb22 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -550,7 +550,7 @@ public void testSortedLs() throws Exception {
         LsCommand cmd = new LsCommand();
         cmd.setZk(zk);
         cmd.parse("ls /".split(" "));
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("[aa1, aa2, aa3, test1, zk1, zookeeper]");
         runCommandExpect(cmd, expected);
     }
@@ -571,7 +571,7 @@ public void testLsrCommand() throws Exception {
         cmd.setZk(zk);
         cmd.parse("ls -R /a".split(" "));
 
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("/a");
         expected.add("/a/b");
         expected.add("/a/c");
@@ -590,7 +590,7 @@ public void testLsrRootCommand() throws Exception {
         cmd.setZk(zk);
         cmd.parse("ls -R /".split(" "));
 
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("/");
         expected.add("/zookeeper");
         runCommandExpect(cmd, expected);
@@ -608,7 +608,7 @@ public void testLsrLeafCommand() throws Exception {
         cmd.setZk(zk);
         cmd.parse("ls -R /b/c".split(" "));
 
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("/b/c");
         runCommandExpect(cmd, expected);
     }
@@ -626,7 +626,7 @@ public void testLsrNonexistantZnodeCommand() throws Exception {
         cmd.parse("ls -R /b/c/d".split(" "));
 
         try {
-            runCommandExpect(cmd, new ArrayList<String>());
+            runCommandExpect(cmd, new ArrayList<>());
             fail("Path doesn't exists so, command should fail.");
         } catch (CliWrapperException e) {
             assertEquals(KeeperException.Code.NONODE, ((KeeperException) e.getCause()).code());
@@ -691,7 +691,7 @@ public void testSyncCommand() throws Exception {
         SyncCommand cmd = new SyncCommand();
         cmd.setZk(zk);
         cmd.parse("sync /".split(" "));
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("Sync is OK");
 
         runCommandExpect(cmd, expected);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
index bcfdfcc6931..2d94d2ba464 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
@@ -72,7 +72,7 @@ private void corruptFile(File file) throws IOException {
     /** return if checksum matches for a snapshot **/
     private boolean getCheckSum(FileSnap snap, File snapFile) throws IOException {
         DataTree dt = new DataTree();
-        Map<Long, Integer> sessions = new ConcurrentHashMap<Long, Integer>();
+        Map<Long, Integer> sessions = new ConcurrentHashMap<>();
         InputStream snapIS = new BufferedInputStream(new FileInputStream(snapFile));
         CheckedInputStream crcIn = new CheckedInputStream(snapIS, new Adler32());
         InputArchive ia = BinaryInputArchive.getArchive(crcIn);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
index 4b47d6cbb3c..cb86963e48a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
@@ -50,7 +50,7 @@
 
 public class FinalRequestProcessorTest {
 
-    private List<ACL> testACLs = new ArrayList<ACL>();
+    private List<ACL> testACLs = new ArrayList<>();
     private final Record[] responseRecord = new Record[1];
     private final ReplyHeader[] replyHeaders = new ReplyHeader[1];
 
@@ -119,7 +119,7 @@ public void testACLDigestHashHiding_NoAuth_NoWorld() {
     @Test
     public void testACLDigestHashHiding_UserCanRead() {
         // Arrange
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "otheruser:somesecrethash"));
 
         // Act
@@ -133,7 +133,7 @@ public void testACLDigestHashHiding_UserCanRead() {
     @Test
     public void testACLDigestHashHiding_UserCanAll() {
         // Arrange
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "user:secrethash"));
 
         // Act
@@ -147,7 +147,7 @@ public void testACLDigestHashHiding_UserCanAll() {
     @Test
     public void testACLDigestHashHiding_AdminUser() {
         // Arrange
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "adminuser:adminsecret"));
 
         // Act
@@ -163,7 +163,7 @@ public void testACLDigestHashHiding_OnlyAdmin() {
         // Arrange
         testACLs.clear();
         testACLs.addAll(Arrays.asList(new ACL(ZooDefs.Perms.READ, new Id("digest", "user:secrethash")), new ACL(ZooDefs.Perms.ADMIN, new Id("digest", "adminuser:adminsecret"))));
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "adminuser:adminsecret"));
 
         // Act
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index 689b8eda9e2..b10258fb5b3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -371,7 +371,7 @@ public void checkGlobalSession(long sessionId, Object owner) throws SessionExpir
         }
         @Override
         public Map<Long, Set<Long>> getSessionExpiryMap() {
-            return new HashMap<Long, Set<Long>>();
+            return new HashMap<>();
         }
         @Override
         public long getLocalSessionCount() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
index 3a45a8d9610..299cdaa6495 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
@@ -186,7 +186,7 @@ public void testFindNValidSnapshots() throws Exception {
         List<File> foundSnaps = txnLog.findNValidSnapshots(1);
         assertEquals(0, foundSnaps.size());
 
-        List<File> expectedNRecentSnapFiles = new ArrayList<File>();
+        List<File> expectedNRecentSnapFiles = new ArrayList<>();
         int counter = offset + (2 * nRecentCount);
         for (int i = 0; i < nRecentCount; i++) {
             // simulate log file
@@ -234,12 +234,12 @@ public void testSnapFilesGreaterThanToRetain() throws Exception {
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
         assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
-        List<File> snapsToPurge = new ArrayList<File>();
-        List<File> logsToPurge = new ArrayList<File>();
-        List<File> snaps = new ArrayList<File>();
-        List<File> logs = new ArrayList<File>();
-        List<File> snapsAboveRecentFiles = new ArrayList<File>();
-        List<File> logsAboveRecentFiles = new ArrayList<File>();
+        List<File> snapsToPurge = new ArrayList<>();
+        List<File> logsToPurge = new ArrayList<>();
+        List<File> snaps = new ArrayList<>();
+        List<File> logs = new ArrayList<>();
+        List<File> snapsAboveRecentFiles = new ArrayList<>();
+        List<File> logsAboveRecentFiles = new ArrayList<>();
         createDataDirFiles(offset, fileToPurgeCount, false, version2, snapsToPurge, logsToPurge);
         createDataDirFiles(offset, nRecentCount, false, version2, snaps, logs);
         logs.add(logsToPurge.remove(0)); // log that precedes first retained snapshot is also retained
@@ -285,8 +285,8 @@ public void internalTestSnapFilesEqualsToRetain(boolean testWithPrecedingLogFile
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
         assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
-        List<File> snaps = new ArrayList<File>();
-        List<File> logs = new ArrayList<File>();
+        List<File> snaps = new ArrayList<>();
+        List<File> logs = new ArrayList<>();
         createDataDirFiles(offset, nRecentCount, testWithPrecedingLogFile, version2, snaps, logs);
 
         FileTxnSnapLog txnLog = new FileTxnSnapLog(tmpDir, tmpDir);
@@ -307,10 +307,10 @@ public void testSnapFilesLessThanToRetain() throws Exception {
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
         assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
-        List<File> snapsToPurge = new ArrayList<File>();
-        List<File> logsToPurge = new ArrayList<File>();
-        List<File> snaps = new ArrayList<File>();
-        List<File> logs = new ArrayList<File>();
+        List<File> snapsToPurge = new ArrayList<>();
+        List<File> logsToPurge = new ArrayList<>();
+        List<File> snaps = new ArrayList<>();
+        List<File> logs = new ArrayList<>();
         createDataDirFiles(offset, fileToPurgeCount, false, version2, snapsToPurge, logsToPurge);
         createDataDirFiles(offset, nRecentCount, false, version2, snaps, logs);
         logs.add(logsToPurge.remove(0)); // log that precedes first retained snapshot is also retained
@@ -560,7 +560,7 @@ private void verifyFilesAfterPurge(List<File> logs, boolean exists) {
 
     private List<String> manyClientOps(final ZooKeeper zk, final CountDownLatch doPurge, int thCount, final String prefix) {
         Thread[] ths = new Thread[thCount];
-        final List<String> znodes = Collections.synchronizedList(new ArrayList<String>());
+        final List<String> znodes = Collections.synchronizedList(new ArrayList<>());
         final CountDownLatch finished = new CountDownLatch(thCount);
         final AtomicReference<Exception> exception = new AtomicReference<>();
         for (int indx = 0; indx < thCount; indx++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
index 9eab2e8cd2b..e7bb38da9c1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
@@ -50,14 +50,14 @@ public void testSameACLGivesSameID() {
 
     @Test
     public void testWhetherOrderingMatters() {
-        List<ACL> testACL = new ArrayList<ACL>();
+        List<ACL> testACL = new ArrayList<>();
         testACL.add(new ACL(ZooDefs.Perms.READ, new Id("scheme", "ro")));
         testACL.add(new ACL(ZooDefs.Perms.WRITE, new Id("scheme", "rw")));
 
         ReferenceCountedACLCache cache = new ReferenceCountedACLCache();
         Long aclId = cache.convertAcls(testACL);
 
-        List<ACL> testACL2 = new ArrayList<ACL>();
+        List<ACL> testACL2 = new ArrayList<>();
         testACL2.add(new ACL(ZooDefs.Perms.WRITE, new Id("scheme", "rw")));
         testACL2.add(new ACL(ZooDefs.Perms.READ, new Id("scheme", "ro")));
 
@@ -279,7 +279,7 @@ private Long convertACLsNTimes(ReferenceCountedACLCache cache, List<ACL> acl, in
     }
 
     private List<ACL> createACL(String id) {
-        List<ACL> acl1 = new ArrayList<ACL>();
+        List<ACL> acl1 = new ArrayList<>();
         acl1.add(new ACL(ZooDefs.Perms.ADMIN, new Id("scheme", id)));
         return acl1;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
index 4e8c6f8e2c5..fb73e1572de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
@@ -100,7 +100,7 @@ public void testSnapshotDigest() throws Exception {
         zk.delete(firstNode, -1);
 
         // trigger multi op
-        List<Op> subTxns = new ArrayList<Op>();
+        List<Op> subTxns = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             String path = pathPrefix + "-m" + i;
             subTxns.add(Op.create(path, path.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
index ae58fa563e6..c6af1724ab8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
@@ -236,7 +236,7 @@ public static Map<String, String> performOperations(
         client.setData(path, updatedData.getBytes(), -1);
         nodes.put(path, updatedData);
 
-        List<Op> subTxns = new ArrayList<Op>();
+        List<Op> subTxns = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             path = prefix + "/m" + i;
             subTxns.add(Op.create(path, path.getBytes(),
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
index 8009dab474b..855acd0b591 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
@@ -47,7 +47,7 @@ public void testGetters() {
     @Test
     public void testMap() {
         r.put("missing", "sudo");
-        Map<String, Object> m = new HashMap<String, Object>();
+        Map<String, Object> m = new HashMap<>();
         m.put("origin", "xkcd");
         m.put("url", "http://xkcd.com/149/");
         r.putAll(m);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index c60ae868d31..85c4a78e9fc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -107,7 +107,7 @@ private void testCommand(String cmdName, Map<String, String> kwargs, InputStream
     }
 
     public void testCommand(String cmdName, Field... fields) throws IOException, InterruptedException {
-        testCommand(cmdName, new HashMap<String, String>(), null, new HashMap<>(), HttpServletResponse.SC_OK, fields);
+        testCommand(cmdName, new HashMap<>(), null, new HashMap<>(), HttpServletResponse.SC_OK, fields);
     }
 
     private static class Field {
@@ -271,7 +271,7 @@ public void testServerStats() throws IOException, InterruptedException {
 
     @Test
     public void testSetTraceMask() throws IOException, InterruptedException {
-        Map<String, String> kwargs = new HashMap<String, String>();
+        Map<String, String> kwargs = new HashMap<>();
         kwargs.put("traceMask", "1");
         testCommand("set_trace_mask", kwargs, null, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
index ad43d8826b0..920c1391cc7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
@@ -78,7 +78,7 @@ public class CnxManagerTest extends ZKTestCase {
     public void setUp() throws Exception {
 
         this.count = 3;
-        this.peers = new HashMap<Long, QuorumServer>(count);
+        this.peers = new HashMap<>(count);
         peerTmpdir = new File[count];
         peerQuorumPort = new int[count];
         peerClientPort = new int[count];
@@ -499,7 +499,7 @@ public QuorumX509Util createX509Util() {
      */
     @Test
     public void testWorkerThreads() throws Exception {
-        ArrayList<QuorumPeer> peerList = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peerList = new ArrayList<>();
         try {
             for (int sid = 0; sid < 3; sid++) {
                 QuorumPeer peer = new QuorumPeer(peers, peerTmpdir[sid], peerTmpdir[sid], peerClientPort[sid], 3, sid, 1000, 2, 2, 2);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
index e5f668d1f3e..21970f3ea4d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
@@ -63,7 +63,7 @@ public class CommitProcessorConcurrencyTest extends ZKTestCase {
 
     @BeforeEach
     public void setUp() throws Exception {
-        processedRequests = new LinkedBlockingQueue<Request>();
+        processedRequests = new LinkedBlockingQueue<>();
         processor = new MockCommitProcessor();
         CommitProcessor.setMaxReadBatchSize(-1);
         CommitProcessor.setMaxCommitBatchSize(1);
@@ -174,8 +174,8 @@ public void committedAndUncommittedOfTheSameSessionRaceTest() throws Exception {
     @Test
     public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
         final String path = "/testAsMuchAsPossible";
-        List<Request> shouldBeProcessed = new LinkedList<Request>();
-        Set<Request> shouldNotBeProcessed = new HashSet<Request>();
+        List<Request> shouldBeProcessed = new LinkedList<>();
+        Set<Request> shouldNotBeProcessed = new HashSet<>();
         for (int sessionId = 1; sessionId <= 5; ++sessionId) {
             for (int readReqId = 1; readReqId <= sessionId; ++readReqId) {
                 Request readReq = newRequest(new GetDataRequest(path, false), OpCode.getData, sessionId, readReqId);
@@ -225,8 +225,8 @@ public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
     @Test
     public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exception {
         final String path = "/testUncommittedFollowingCommited";
-        Set<Request> shouldBeInPending = new HashSet<Request>();
-        Set<Request> shouldBeProcessedAfterPending = new HashSet<Request>();
+        Set<Request> shouldBeInPending = new HashSet<>();
+        Set<Request> shouldBeProcessedAfterPending = new HashSet<>();
 
         Request writeReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
@@ -287,7 +287,7 @@ public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exceptio
     @Test
     public void processAllWritesMaxBatchSize() throws Exception {
         final String path = "/processAllWritesMaxBatchSize";
-        HashSet<Request> shouldBeProcessedAfterPending = new HashSet<Request>();
+        HashSet<Request> shouldBeProcessedAfterPending = new HashSet<>();
 
         Request writeReq = newRequest(
             new CreateRequest(
@@ -423,7 +423,7 @@ public void processAllWritesMaxBatchSize() throws Exception {
     public void noStarvationOfNonLocalCommittedRequestsTest() throws Exception {
         final String path = "/noStarvationOfCommittedRequests";
         processor.queuedRequests = new MockRequestsQueue();
-        Set<Request> nonLocalCommits = new HashSet<Request>();
+        Set<Request> nonLocalCommits = new HashSet<>();
         for (int i = 0; i < 10; i++) {
             Request nonLocalCommitReq = newRequest(
                 new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
@@ -461,7 +461,7 @@ public void noStarvationOfReadRequestsTest() throws Exception {
         processor.queuedRequests.add(firstCommittedReq);
         processor.queuedWriteRequests.add(firstCommittedReq);
         processor.committedRequests.add(firstCommittedReq);
-        Set<Request> allReads = new HashSet<Request>();
+        Set<Request> allReads = new HashSet<>();
 
         // +1 read request to queuedRequests
         Request firstRead = newRequest(new GetDataRequest(path, false), OpCode.getData, 0x1, 0);
@@ -476,7 +476,7 @@ public void noStarvationOfReadRequestsTest() throws Exception {
             2);
         processor.committedRequests.add(secondCommittedReq);
 
-        Set<Request> waitingCommittedRequests = new HashSet<Request>();
+        Set<Request> waitingCommittedRequests = new HashSet<>();
         // +99 non local committed requests
         for (int writeReqId = 3; writeReqId < 102; ++writeReqId) {
             Request writeReq = newRequest(
@@ -530,7 +530,7 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         final int firstCXid = 0x100;
         int readReqId = firstCXid;
         processor.stoppedMainLoop = true;
-        HashSet<Request> localRequests = new HashSet<Request>();
+        HashSet<Request> localRequests = new HashSet<>();
         // queue the blocking write request to queuedRequests
         Request firstCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
@@ -592,7 +592,7 @@ public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         final int numberofReads = 10;
         int readReqId = lastCXid;
         processor.stoppedMainLoop = true;
-        HashSet<Request> localRequests = new HashSet<Request>();
+        HashSet<Request> localRequests = new HashSet<>();
 
         // queue the blocking write request to queuedRequests
         Request orphanCommittedReq = newRequest(
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
index 46a4c387479..2de0987afed 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
@@ -81,7 +81,7 @@ public class CommitProcessorTest extends ZKTestCase {
     boolean stopped;
     TestZooKeeperServer zks;
     File tmpDir;
-    ArrayList<TestClientThread> testClients = new ArrayList<TestClientThread>();
+    ArrayList<TestClientThread> testClients = new ArrayList<>();
     CommitProcessor commitProcessor;
 
     public void setUp(int numCommitThreads, int numClientThreads, int writePercent) throws Exception {
@@ -318,7 +318,7 @@ protected void setupRequestProcessors() {
     private class MockProposalRequestProcessor extends Thread implements RequestProcessor {
 
         private final CommitProcessor commitProcessor;
-        private final LinkedBlockingQueue<Request> proposals = new LinkedBlockingQueue<Request>();
+        private final LinkedBlockingQueue<Request> proposals = new LinkedBlockingQueue<>();
 
         public MockProposalRequestProcessor(CommitProcessor commitProcessor) {
             this.commitProcessor = commitProcessor;
@@ -367,7 +367,7 @@ private class ValidateProcessor implements RequestProcessor {
         RequestProcessor nextProcessor;
         CommitProcessor commitProcessor;
         AtomicLong expectedZxid = new AtomicLong(1);
-        ConcurrentHashMap<Long, AtomicInteger> cxidMap = new ConcurrentHashMap<Long, AtomicInteger>();
+        ConcurrentHashMap<Long, AtomicInteger> cxidMap = new ConcurrentHashMap<>();
 
         AtomicInteger outstandingReadRequests = new AtomicInteger(0);
         AtomicInteger outstandingWriteRequests = new AtomicInteger(0);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
index e4d32456a53..67d646c9787 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
@@ -49,7 +49,7 @@ public class FLEBackwardElectionRoundTest extends ZKTestCase {
     public void setUp() throws Exception {
         count = 3;
 
-        peers = new HashMap<Long, QuorumServer>(count);
+        peers = new HashMap<>(count);
         tmpdir = new File[count];
         port = new int[count];
         cnxManagers = new QuorumCnxManager[count - 1];
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
index 84b233d7221..d84396ed57e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
@@ -49,7 +49,7 @@ public class FLELostMessageTest extends ZKTestCase {
     public void setUp() throws Exception {
         count = 3;
 
-        peers = new HashMap<Long, QuorumServer>(count);
+        peers = new HashMap<>(count);
         tmpdir = new File[count];
         port = new int[count];
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
index d1afdaa80cf..7feed9c0524 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
@@ -43,7 +43,7 @@ public class FLEOutOfElectionTest {
     @BeforeEach
     public void setUp() throws Exception {
         File tmpdir = ClientBase.createTmpDir();
-        Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peers = new HashMap<>();
         for (int i = 0; i < 5; i++) {
             peers.put(Long.valueOf(i), new QuorumServer(Long.valueOf(i), new InetSocketAddress("127.0.0.1", PortAssignment.unique())));
         }
@@ -53,7 +53,7 @@ public void setUp() throws Exception {
 
     @Test
     public void testIgnoringZxidElectionEpoch() {
-        Map<Long, Vote> votes = new HashMap<Long, Vote>();
+        Map<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 1), 1, 2, ServerState.FOLLOWING));
         votes.put(1L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 2), 1, 2, ServerState.FOLLOWING));
         votes.put(3L, new Vote(0x1, 4L, ZxidUtils.makeZxid(2, 1), 2, 2, ServerState.FOLLOWING));
@@ -64,7 +64,7 @@ public void testIgnoringZxidElectionEpoch() {
 
     @Test
     public void testElectionWIthDifferentVersion() {
-        Map<Long, Vote> votes = new HashMap<Long, Vote>();
+        Map<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 1), 1, 1, ServerState.FOLLOWING));
         votes.put(1L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 1), 1, 1, ServerState.FOLLOWING));
         votes.put(3L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 2, 2, ServerState.FOLLOWING));
@@ -75,7 +75,7 @@ public void testElectionWIthDifferentVersion() {
 
     @Test
     public void testLookingNormal() {
-        Map<Long, Vote> votes = new HashMap<Long, Vote>();
+        Map<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 1, 1, ServerState.LOOKING));
         votes.put(1L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 1, 1, ServerState.LOOKING));
         votes.put(3L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 1, 1, ServerState.LOOKING));
@@ -86,7 +86,7 @@ public void testLookingNormal() {
 
     @Test
     public void testLookingDiffRounds() {
-        HashMap<Long, Vote> votes = new HashMap<Long, Vote>();
+        HashMap<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(4L, ZxidUtils.makeZxid(1, 1), 1, 1, ServerState.LOOKING));
         votes.put(1L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 2, 2, ServerState.LOOKING));
         votes.put(3L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 3, 2, ServerState.LOOKING));
@@ -97,7 +97,7 @@ public void testLookingDiffRounds() {
 
     @Test
     public void testOutofElection() {
-        HashMap<Long, Vote> outofelection = new HashMap<Long, Vote>();
+        HashMap<Long, Vote> outofelection = new HashMap<>();
 
         outofelection.put(1L, new Vote(0x0, 5, ZxidUtils.makeZxid(15, 0), 0xa, 0x17, ServerState.FOLLOWING));
         outofelection.put(2L, new Vote(0x0, 5, ZxidUtils.makeZxid(15, 0), 0xa, 0x17, ServerState.FOLLOWING));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
index a75fb383014..73ad201c109 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
@@ -430,8 +430,8 @@ interface SetDataTxnListener {
 
     static class CustomDataTree extends DataTree {
 
-        Map<String, NodeCreateListener> nodeCreateListeners = new HashMap<String, NodeCreateListener>();
-        Map<String, NodeSerializeListener> listeners = new HashMap<String, NodeSerializeListener>();
+        Map<String, NodeCreateListener> nodeCreateListeners = new HashMap<>();
+        Map<String, NodeSerializeListener> listeners = new HashMap<>();
         DigestSerializeListener digestListener;
         SetDataTxnListener setListener;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index dc537abbd4d..82084e13ce1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -62,7 +62,7 @@ public class LeaderBeanTest {
 
     public static Map<Long, QuorumServer> getMockedPeerViews(long myId) {
         int clientPort = PortAssignment.unique();
-        Map<Long, QuorumServer> peersView = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peersView = new HashMap<>();
         InetAddress clientIP = InetAddress.getLoopbackAddress();
 
         peersView.put(Long.valueOf(myId),
@@ -174,7 +174,7 @@ public Object answer(InvocationOnMock invocation) throws Throwable {
 
     @Test
     public void testFollowerInfo() throws IOException {
-        Map<Long, QuorumServer> votingMembers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> votingMembers = new HashMap<>();
         votingMembers.put(1L, null);
         votingMembers.put(2L, null);
         votingMembers.put(3L, null);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
index 2d63f24e58f..bbf36367ef0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
@@ -73,8 +73,8 @@ class MockZKDatabase extends ZKDatabase {
 
         long lastProcessedZxid;
         ReentrantReadWriteLock lock = new ReentrantReadWriteLock();
-        LinkedList<Proposal> committedLog = new LinkedList<Leader.Proposal>();
-        LinkedList<Proposal> txnLog = new LinkedList<Leader.Proposal>();
+        LinkedList<Proposal> committedLog = new LinkedList<>();
+        LinkedList<Proposal> txnLog = new LinkedList<>();
 
         public MockZKDatabase(FileTxnSnapLog snapLog) {
             super(snapLog);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
index fbd33d2a02f..51d80c2c219 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
@@ -127,7 +127,7 @@ public void testParallelNoThrottle(LearnerSyncThrottler.SyncType syncType) {
         final CountDownLatch threadStartLatch = new CountDownLatch(numThreads);
         final CountDownLatch syncProgressLatch = new CountDownLatch(numThreads);
 
-        List<Future<Boolean>> results = new ArrayList<Future<Boolean>>(numThreads);
+        List<Future<Boolean>> results = new ArrayList<>(numThreads);
         for (int i = 0; i < numThreads; i++) {
             results.add(threadPool.submit(new Callable<Boolean>() {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
index af2fed8cf88..1ffc74f0d46 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
@@ -251,7 +251,7 @@ public ProcessTxnResult processTxn(Invocation invocation,
                 ProcessTxnResult rc = new ProcessTxnResult();
                 rc.path = "";
                 rc.stat = new Stat();
-                rc.multiResult = new ArrayList<ProcessTxnResult>();
+                rc.multiResult = new ArrayList<>();
                 return rc;
             }
             return invocation.proceed(header, txn, digest);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
index 194144b14af..b832f4f9679 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
@@ -49,7 +49,7 @@ public void testQuorumPeerListendOnSpecifiedClientIP() throws IOException {
         long myId = 1;
         File dataDir = ClientBase.createTmpDir();
         int clientPort = PortAssignment.unique();
-        Map<Long, QuorumServer> peersView = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peersView = new HashMap<>();
         InetAddress clientIP = InetAddress.getLoopbackAddress();
 
         peersView.put(Long.valueOf(myId), new QuorumServer(myId, new InetSocketAddress(clientIP, PortAssignment.unique()), new InetSocketAddress(clientIP, PortAssignment.unique()), new InetSocketAddress(clientIP, clientPort), LearnerType.PARTICIPANT));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index 2a116dce076..8249cd2223a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -303,7 +303,7 @@ public void writeTempDynamicConfigFile(String nextQuorumCfgSection, String versi
         }
 
         public MainThread(int myid, int clientPort, String quorumCfgSection) throws IOException {
-            this(myid, clientPort, quorumCfgSection, new HashMap<String, String>());
+            this(myid, clientPort, quorumCfgSection, new HashMap<>());
         }
 
         public MainThread(int myid, int clientPort, String quorumCfgSection, Map<String, String> otherConfigs) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
index c395a62e6be..624661044b6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
@@ -46,7 +46,7 @@ public class QuorumRequestPipelineTest extends QuorumBase {
     protected final CountDownLatch callComplete = new CountDownLatch(1);
     protected boolean complete = false;
     protected static final String PARENT_PATH = "/foo";
-    protected static final Set<String> CHILDREN = new HashSet<String>(Arrays.asList("1", "2", "3"));
+    protected static final Set<String> CHILDREN = new HashSet<>(Arrays.asList("1", "2", "3"));
     protected static final String AUTH_PROVIDER = "digest";
     protected static final byte[] AUTH = "hello".getBytes();
     protected static final byte[] DATA = "Hint Water".getBytes();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index b5af84f1e60..b7aed52bce3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -896,7 +896,7 @@ public void testOCSP() throws Exception {
     public void testCipherSuites() throws Exception {
         // Get default cipher suites from JDK
         SSLServerSocketFactory ssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
-        List<String> defaultCiphers = new ArrayList<String>();
+        List<String> defaultCiphers = new ArrayList<>();
         for (String cipher : ssf.getDefaultCipherSuites()) {
             if (!cipher.matches(".*EMPTY.*") && cipher.startsWith("TLS") && cipher.contains("RSA")) {
                 defaultCiphers.add(cipher);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
index b465865b3f5..cb03b2f8f71 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
@@ -117,8 +117,8 @@ public void testReconfigCreateNewVersionFile() throws Exception {
         final String[] servers = new String[NEW_SERVER_COUNT];
 
         StringBuilder sb = new StringBuilder();
-        ArrayList<String> oldServers = new ArrayList<String>();
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> oldServers = new ArrayList<>();
+        ArrayList<String> newServers = new ArrayList<>();
 
         for (int i = 0; i < NEW_SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
@@ -238,7 +238,7 @@ public void testVersionOfDynamicFilename() throws Exception {
         StringBuilder sb = new StringBuilder();
         String server;
         StringBuilder oldSb = new StringBuilder();
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
index 4fba09f848d..12036544470 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
@@ -66,7 +66,7 @@ public void testIncrementalReconfigInvokedOnHiearchicalQS() throws Exception {
         ZooKeeper[] zkArr = ReconfigTest.createHandles(qu);
         ZooKeeperAdmin[] zkAdminArr = ReconfigTest.createAdminHandles(qu);
 
-        ArrayList<String> members = new ArrayList<String>();
+        ArrayList<String> members = new ArrayList<>();
         members.add("group.1=3:4:5");
         members.add("group.2=1:2");
         members.add("weight.1=0");
@@ -88,7 +88,7 @@ public void testIncrementalReconfigInvokedOnHiearchicalQS() throws Exception {
         ReconfigTest.testNormalOperation(zkArr[1], zkArr[2]);
 
         // Attempt an incremental reconfig.
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
         leavingServers.add("3");
         try {
             zkAdminArr[1].reconfigure(null, leavingServers, null, -1, null);
@@ -117,7 +117,7 @@ public void testTooFewRemainingPariticipants() throws Exception {
         ZooKeeper[] zkArr = ReconfigTest.createHandles(qu);
         ZooKeeperAdmin[] zkAdminArr = ReconfigTest.createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
         leavingServers.add("2");
         leavingServers.add("3");
         try {
@@ -144,7 +144,7 @@ public void testReconfigVersionConditionFails() throws Exception {
         ZooKeeper[] zkArr = ReconfigTest.createHandles(qu);
         ZooKeeperAdmin[] zkAdminArr = ReconfigTest.createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
         leavingServers.add("3");
         try {
             zkAdminArr[1].reconfigure(null, leavingServers, null, 8, null);
@@ -183,7 +183,7 @@ public void testObserverToParticipantConversionFails() throws Exception {
         int[][] ports = ReconfigRecoveryTest.generatePorts(SERVER_COUNT);
 
         // generate old config string
-        Set<Integer> observers = new HashSet<Integer>();
+        Set<Integer> observers = new HashSet<>();
         observers.add(3);
         StringBuilder sb = ReconfigRecoveryTest.generateConfig(SERVER_COUNT, ports, observers);
         String currentQuorumCfgSection = sb.toString();
@@ -217,7 +217,7 @@ public void testObserverToParticipantConversionFails() throws Exception {
             fail("Reconfig should have failed with NewConfigNoQuorum");
         }
         // In this scenario to change 3's role to participant we need to remove it first
-        ArrayList<String> leavingServers = new ArrayList<String>();
+        ArrayList<String> leavingServers = new ArrayList<>();
         leavingServers.add("3");
         ReconfigTest.reconfig(zkAdmin[1], null, leavingServers, null, -1);
         ReconfigTest.testNormalOperation(zk[2], zk[3]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
index 498b4b6c4ec..2f9a5303e22 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
@@ -60,7 +60,7 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
         String server;
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
@@ -154,8 +154,8 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
         final int newClientPort = PortAssignment.unique();
 
         StringBuilder sb = new StringBuilder();
-        ArrayList<String> allServers = new ArrayList<String>();
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
+        ArrayList<String> newServers = new ArrayList<>();
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
index 746da1d85af..80b2a215f7a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
@@ -52,7 +52,7 @@ public void testNextConfigCompletion() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
         String server;
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
 
         String currentQuorumCfgSection = null, nextQuorumCfgSection;
 
@@ -136,7 +136,7 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
 
         String currentQuorumCfg, nextQuorumCfgSection;
 
-        ArrayList<String> allServersNext = new ArrayList<String>();
+        ArrayList<String> allServersNext = new ArrayList<>();
 
         for (int i = 0; i < 2; i++) {
             oldClientPorts[i] = PortAssignment.unique();
@@ -294,7 +294,7 @@ public void testNextConfigAlreadyActive() throws Exception {
 
         String currentQuorumCfgSection = null, nextQuorumCfgSection;
 
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=localhost:" + PortAssignment.unique() + ":" + PortAssignment.unique()
@@ -375,13 +375,13 @@ public void testObserverConvertedToParticipantDuringFLE() throws Exception {
         String currentQuorumCfgSection, nextQuorumCfgSection;
 
         // generate old config string
-        Set<Integer> observers = new HashSet<Integer>();
+        Set<Integer> observers = new HashSet<>();
         observers.add(2);
         StringBuilder sb = generateConfig(3, ports, observers);
         currentQuorumCfgSection = sb.toString();
 
         // generate new config string
-        ArrayList<String> allServersNext = new ArrayList<String>();
+        ArrayList<String> allServersNext = new ArrayList<>();
         sb = new StringBuilder();
         for (int i = 2; i < SERVER_COUNT; i++) {
             String server = "server." + i + "=localhost:" + ports[i][0] + ":" + ports[i][1]
@@ -446,7 +446,7 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         String currentQuorumCfg, nextQuorumCfgSection;
 
         // generate old config string
-        Set<Integer> observers = new HashSet<Integer>();
+        Set<Integer> observers = new HashSet<>();
         observers.add(2);
 
         StringBuilder sb = generateConfig(3, ports, observers);
@@ -475,7 +475,7 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         }
 
         // generate new config string
-        ArrayList<String> allServersNext = new ArrayList<String>();
+        ArrayList<String> allServersNext = new ArrayList<>();
         sb = new StringBuilder();
         for (int i = 2; i < SERVER_COUNT; i++) {
             String server = "server." + i + "=localhost:" + ports[i][0] + ":" + ports[i][1]
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
index 3d60c8b9174..8876f74c905 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
@@ -149,7 +149,7 @@ public void testLocalSessionUpgradeSnapshot() throws IOException, InterruptedExc
             mt[i].shutdown();
         }
 
-        ArrayList<States> waitStates = new ArrayList<States>();
+        ArrayList<States> waitStates = new ArrayList<>();
         waitStates.add(States.CONNECTING);
         waitStates.add(States.CLOSED);
         waitForOne(zk, waitStates);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
index 2cfec4d52dc..1483d80a899 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
@@ -108,7 +108,7 @@ public void startSingleServerTest() throws Exception {
 
         //Add two participants and change them to observers to check
         //that we can reconfigure down to one participant with observers.
-        ArrayList<String> observerStrings = new ArrayList<String>();
+        ArrayList<String> observerStrings = new ArrayList<>();
         startObservers(observerStrings);
         testReconfig(follower2, true, reconfigServers); //add partcipants
         testReconfig(follower2, true, observerStrings); //change to observers
@@ -129,7 +129,7 @@ private void setUpData() throws Exception {
         zkAdminHandles = new ZooKeeperAdmin[NUM_SERVERS];
         clientPorts = new int[NUM_SERVERS];
         serverStrings = buildServerStrings();
-        reconfigServers = new ArrayList<String>();
+        reconfigServers = new ArrayList<>();
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
     }
 
@@ -151,7 +151,7 @@ private void shutDownData() throws Exception {
      * the test servers.
      */
     private ArrayList<String> buildServerStrings() {
-        ArrayList<String> serverStrings = new ArrayList<String>();
+        ArrayList<String> serverStrings = new ArrayList<>();
 
         for (int i = 0; i < NUM_SERVERS; i++) {
             clientPorts[i] = PortAssignment.unique();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index 2fadcf36f96..93d3b845c41 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -228,7 +228,7 @@ public int readyOps() {
      * @return a message that attempts to set 1 watch on /
      */
     private ByteBuffer createWatchesMessage() {
-        List<String> dataWatches = new ArrayList<String>(1);
+        List<String> dataWatches = new ArrayList<>(1);
         dataWatches.add("/");
         List<String> existWatches = Collections.emptyList();
         List<String> childWatches = Collections.emptyList();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index 107ae6a72e4..dcf7819b12b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -1195,7 +1195,7 @@ public void testInitialAcceptedCurrent() throws Exception {
             FileTxnSnapLog logFactory = new FileTxnSnapLog(tmpDir, tmpDir);
             File version2 = new File(tmpDir, "version-2");
             version2.mkdir();
-            logFactory.save(new DataTree(), new ConcurrentHashMap<Long, Integer>(), false);
+            logFactory.save(new DataTree(), new ConcurrentHashMap<>(), false);
             long zxid = ZxidUtils.makeZxid(3, 3);
             logFactory.append(new Request(1, 1, ZooDefs.OpCode.error, new TxnHeader(1, 1, zxid, 1, ZooDefs.OpCode.error), new ErrorTxn(1), zxid));
             logFactory.commit();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java
index fff5e62de0c..0755e892016 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java
@@ -42,7 +42,7 @@ private ZabUtils() {
     public static final int SYNC_LIMIT = 2;
 
     public static QuorumPeer createQuorumPeer(File tmpDir) throws IOException {
-        HashMap<Long, QuorumPeer.QuorumServer> peers = new HashMap<Long, QuorumPeer.QuorumServer>();
+        HashMap<Long, QuorumPeer.QuorumServer> peers = new HashMap<>();
         QuorumPeer peer = QuorumPeer.testingQuorumPeer();
         peer.syncLimit = SYNC_LIMIT;
         peer.initLimit = 2;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
index db95d8d6d30..e7de1dc353a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
@@ -115,7 +115,7 @@ private static String getKrb5LoginModuleName() {
 
         @Override
         public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
-            Map<String, String> options = new HashMap<String, String>();
+            Map<String, String> options = new HashMap<>();
             options.put("principal", principal);
             options.put("refreshKrb5Config", "true");
             if (IBM_JAVA) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
index fdd68b5bc83..bfb61a7d8b1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
@@ -154,7 +154,7 @@ public void run() {
     public static final String TRANSPORT = "transport";
     public static final String DEBUG = "debug";
 
-    private static final Set<String> PROPERTIES = new HashSet<String>();
+    private static final Set<String> PROPERTIES = new HashSet<>();
     private static final Properties DEFAULT_CONFIG = new Properties();
 
     static {
@@ -214,7 +214,7 @@ public void setTransport(String transport) {
      */
     public MiniKdc(Properties conf, File workDir) throws Exception {
         if (!conf.keySet().containsAll(PROPERTIES)) {
-            Set<String> missingProperties = new HashSet<String>(PROPERTIES);
+            Set<String> missingProperties = new HashSet<>(PROPERTIES);
             missingProperties.removeAll(conf.keySet());
             throw new IllegalArgumentException("Missing configuration properties: " + missingProperties);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
index 3e57f9a4663..4221ceb81d1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
@@ -61,7 +61,7 @@ public void testKeytabGen() throws Exception {
         kdc.createPrincipal(new File(workDir, "keytab"), "foo/bar", "bar/foo");
         List<PrincipalName> principalNameList = Keytab.loadKeytab(new File(workDir, "keytab")).getPrincipals();
 
-        Set<String> principals = new HashSet<String>();
+        Set<String> principals = new HashSet<>();
         for (PrincipalName principalName : principalNameList) {
             principals.add(principalName.getName());
         }
@@ -82,7 +82,7 @@ public void testKerberosLogin() throws Exception {
             File keytab = new File(workDir, "foo.keytab");
             kdc.createPrincipal(keytab, principal);
 
-            Set<Principal> principals = new HashSet<Principal>();
+            Set<Principal> principals = new HashSet<>();
             principals.add(new KerberosPrincipal(principal));
 
             // client login
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
index 67c5d70dc6a..f1a9bcac8d6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
@@ -43,7 +43,7 @@
 public class QuorumAuthTestBase extends ZKTestCase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(QuorumAuthTestBase.class);
-    protected List<MainThread> mt = new ArrayList<MainThread>();
+    protected List<MainThread> mt = new ArrayList<>();
     protected static File jaasConfigDir;
 
     public static void setupJaasConfig(String jaasEntries) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
index 46d65c9a4f4..fb03f23d6b2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
@@ -87,7 +87,7 @@ public static void cleanup() {
     @Test
     @Timeout(value = 30)
     public void testNullAuthLearnerServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
 
         String connectStr = startQuorum(2, authConfigs, 0);
@@ -106,7 +106,7 @@ public void testNullAuthLearnerServer() throws Exception {
     @Test
     @Timeout(value = 30)
     public void testAuthLearnerAgainstNullAuthServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
 
         String connectStr = startQuorum(2, authConfigs, 1);
@@ -125,7 +125,7 @@ public void testAuthLearnerAgainstNullAuthServer() throws Exception {
     @Test
     @Timeout(value = 30)
     public void testAuthLearnerAgainstNoAuthRequiredServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
 
         String connectStr = startQuorum(2, authConfigs, 2);
@@ -144,7 +144,7 @@ public void testAuthLearnerAgainstNoAuthRequiredServer() throws Exception {
     @Test
     @Timeout(value = 30)
     public void testAuthLearnerServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -178,7 +178,7 @@ public void testRollingUpgrade() throws Exception {
         // Start peer0,1,2 servers with quorum.auth.enableSasl=false and
         // quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
         // Assume this is an existing cluster.
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
 
         String connectStr = startQuorum(3, authConfigs, 0);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
index b1b1dedf65e..c70c5c9c3ad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
@@ -81,7 +81,7 @@ public static void cleanup() {
     @Test
     @Timeout(value = 30)
     public void testValidCredentials() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -103,7 +103,7 @@ public void testValidCredentials() throws Exception {
     @Test
     @Timeout(value = 30)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -126,7 +126,7 @@ public void testValidCredentialsWithMultiAddresses() throws Exception {
     @Test
     @Timeout(value = 30)
     public void testSaslNotRequiredWithInvalidCredentials() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerInvalid");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "false");
@@ -148,7 +148,7 @@ public void testSaslNotRequiredWithInvalidCredentials() throws Exception {
     @Test
     @Timeout(value = 30)
     public void testSaslRequiredInvalidCredentials() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerInvalid");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
@@ -169,7 +169,7 @@ public void testSaslRequiredInvalidCredentials() throws Exception {
     @Test
     @Timeout(value = 10)
     public void testEnableQuorumServerRequireSaslWithoutQuorumLearnerRequireSasl() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearner");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
@@ -198,7 +198,7 @@ protected void initializeAndRun(String[] args) throws ConfigException, IOExcepti
     @Test
     @Timeout(value = 10)
     public void testEnableQuorumAuthenticationConfigurations() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearner");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
index d9a32a7559b..475c899732a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
@@ -114,7 +114,7 @@ public static void cleanup() {
     public void testValidCredentials() throws Exception {
         String serverPrincipal = KerberosTestUtils.getServerPrincipal();
         serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -138,7 +138,7 @@ public void testValidCredentials() throws Exception {
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         String serverPrincipal = KerberosTestUtils.getServerPrincipal();
         serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
index f02da0b205b..287761ac322 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
@@ -138,7 +138,7 @@ public static void cleanup() {
     @Timeout(value = 120)
     public void testValidCredentials() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -161,7 +161,7 @@ public void testValidCredentials() throws Exception {
     @Timeout(value = 120)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -183,7 +183,7 @@ public void testValidCredentialsWithMultiAddresses() throws Exception {
     @Timeout(value = 120)
     public void testConnectBadServer() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
index 5a2a5b79b58..8d42528afd0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
@@ -36,7 +36,7 @@ public void testAddWatchBit() {
         assertEquals(1, ws.size());
         assertEquals(1, ws.cachedSize());
 
-        List<Integer> actualBits = new ArrayList<Integer>();
+        List<Integer> actualBits = new ArrayList<>();
 
         for (int bit : ws) {
             actualBits.add(bit);
@@ -77,7 +77,7 @@ public void testRemoveWatchBit() {
         assertEquals(1, ws.size());
         assertEquals(0, ws.cachedSize());
 
-        List<Integer> actualBits = new ArrayList<Integer>();
+        List<Integer> actualBits = new ArrayList<>();
 
         for (int bit : ws) {
             actualBits.add(bit);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
index 8c1922f353f..9ea76e70220 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
@@ -28,7 +28,7 @@ public class BitMapTest extends ZKTestCase {
 
     @Test
     public void testAddAndRemove() {
-        BitMap<String> bitMap = new BitMap<String>();
+        BitMap<String> bitMap = new BitMap<>();
         String v1 = "v1";
         Integer bit = bitMap.add(v1);
 
@@ -62,7 +62,7 @@ public void testAddAndRemove() {
 
     @Test
     public void testBitReuse() {
-        BitMap<String> bitMap = new BitMap<String>();
+        BitMap<String> bitMap = new BitMap<>();
         int v1Bit = bitMap.add("v1");
         int v2Bit = bitMap.add("v2");
         int v3Bit = bitMap.add("v3");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
index bd613a44488..f65391c497c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
@@ -236,7 +236,7 @@ public void testAddAndTriggerWatcher(String className) throws IOException {
         // 1. start 5 workers to trigger watchers on that path
         //    count all the watchers have been fired
         AtomicInteger watchTriggered = new AtomicInteger();
-        List<WatcherTriggerWorker> triggerWorkers = new ArrayList<WatcherTriggerWorker>();
+        List<WatcherTriggerWorker> triggerWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             WatcherTriggerWorker worker = new WatcherTriggerWorker(manager, paths, watchTriggered);
             triggerWorkers.add(worker);
@@ -246,7 +246,7 @@ public void testAddAndTriggerWatcher(String className) throws IOException {
         // 2. start 5 workers to add different watchers on the same path
         //    count all the watchers being added
         AtomicInteger watchesAdded = new AtomicInteger();
-        List<AddWatcherWorker> addWorkers = new ArrayList<AddWatcherWorker>();
+        List<AddWatcherWorker> addWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             AddWatcherWorker worker = new AddWatcherWorker(manager, paths, watchers, watchesAdded);
             addWorkers.add(worker);
@@ -297,7 +297,7 @@ public void testRemoveWatcherOnPath(String className) throws IOException {
         // 1. start 5 workers to remove watchers on those path
         //    record the watchers have been removed
         AtomicInteger watchesRemoved = new AtomicInteger();
-        List<RemoveWatcherWorker> removeWorkers = new ArrayList<RemoveWatcherWorker>();
+        List<RemoveWatcherWorker> removeWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             RemoveWatcherWorker worker = new RemoveWatcherWorker(manager, paths, watchers, watchesRemoved);
             removeWorkers.add(worker);
@@ -307,7 +307,7 @@ public void testRemoveWatcherOnPath(String className) throws IOException {
         // 2. start 5 workers to add different watchers on different path
         //    record the watchers have been added
         AtomicInteger watchesAdded = new AtomicInteger();
-        List<AddWatcherWorker> addWorkers = new ArrayList<AddWatcherWorker>();
+        List<AddWatcherWorker> addWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             AddWatcherWorker worker = new AddWatcherWorker(manager, paths, watchers, watchesAdded);
             addWorkers.add(worker);
@@ -359,8 +359,8 @@ public void testDeadWatchers(String className) throws IOException {
 
         // 1. start 5 workers to randomly mark those watcher as dead
         //    and remove them from watch manager
-        Set<Watcher> deadWatchers = new HashSet<Watcher>();
-        List<CreateDeadWatchersWorker> deadWorkers = new ArrayList<CreateDeadWatchersWorker>();
+        Set<Watcher> deadWatchers = new HashSet<>();
+        List<CreateDeadWatchersWorker> deadWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             CreateDeadWatchersWorker worker = new CreateDeadWatchersWorker(manager, watchers, deadWatchers);
             deadWorkers.add(worker);
@@ -369,7 +369,7 @@ public void testDeadWatchers(String className) throws IOException {
 
         // 2. start 5 workers to add different watchers on the same path
         AtomicInteger watchesAdded = new AtomicInteger();
-        List<AddWatcherWorker> addWorkers = new ArrayList<AddWatcherWorker>();
+        List<AddWatcherWorker> addWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             AddWatcherWorker worker = new AddWatcherWorker(manager, paths, watchers, watchesAdded);
             addWorkers.add(worker);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
index 9ed145aa38d..17e44eb9b01 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
@@ -43,7 +43,7 @@ public static class MyDeadWatcherListener implements IDeadWatcherListener {
 
         private CountDownLatch latch;
         private int delayMs;
-        private Set<Integer> deadWatchers = new HashSet<Integer>();
+        private Set<Integer> deadWatchers = new HashSet<>();
 
         public void setCountDownLatch(CountDownLatch latch) {
             this.latch = latch;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
index fb25d2104d0..6e4220a77bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
@@ -32,7 +32,7 @@ public class WatcherOrBitSetTest extends ZKTestCase {
 
     @Test
     public void testWatcherSet() {
-        Set<Watcher> wset = new HashSet<Watcher>();
+        Set<Watcher> wset = new HashSet<>();
         WatcherOrBitSet hashSet = new WatcherOrBitSet(wset);
         assertEquals(0, hashSet.size());
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
index 4e1c3168233..37efedab9b1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
@@ -36,11 +36,11 @@ public class WatchesPathReportTest extends ZKTestCase {
     @BeforeEach
     public void setUp() {
         m = new HashMap<String, Set<Long>>();
-        Set<Long> s = new HashSet<Long>();
+        Set<Long> s = new HashSet<>();
         s.add(101L);
         s.add(102L);
         m.put("path1", s);
-        s = new HashSet<Long>();
+        s = new HashSet<>();
         s.add(201L);
         m.put("path2", s);
         r = new WatchesPathReport(m);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
index 0ae952f6cf3..3b0d0e2ae07 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
@@ -36,11 +36,11 @@ public class WatchesReportTest extends ZKTestCase {
     @BeforeEach
     public void setUp() {
         m = new HashMap<Long, Set<String>>();
-        Set<String> s = new HashSet<String>();
+        Set<String> s = new HashSet<>();
         s.add("path1a");
         s.add("path1b");
         m.put(1L, s);
-        s = new HashSet<String>();
+        s = new HashSet<>();
         s.add("path2a");
         m.put(2L, s);
         r = new WatchesReport(m);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
index d1b5a1065e4..2f0d408fccd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
@@ -156,7 +156,7 @@ public void testAcls() throws Exception {
                 id.setId("1.1.1." + j);
                 id.setScheme("ip");
                 acl.setId(id);
-                List<ACL> list = new ArrayList<ACL>();
+                List<ACL> list = new ArrayList<>();
                 list.add(acl);
                 zk.create(path, path.getBytes(), list, CreateMode.PERSISTENT);
             }
@@ -184,7 +184,7 @@ public void testAcls() throws Exception {
                 id.setId("1.1.1." + j);
                 id.setScheme("ip");
                 acl.setId(id);
-                ArrayList<ACL> list = new ArrayList<ACL>();
+                ArrayList<ACL> list = new ArrayList<>();
                 list.add(acl);
                 zk.create(path, path.getBytes(), list, CreateMode.PERSISTENT);
             }
@@ -268,7 +268,7 @@ public void testNullValueACL() throws Exception {
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
 
-            List<ACL> acls = new ArrayList<ACL>();
+            List<ACL> acls = new ArrayList<>();
             acls.add(null);
 
             // case 1 : null value in ACL list with create
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
index ea02aa82a6b..f55e9675e91 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
@@ -281,7 +281,7 @@ public String toString() {
 
     public static class ChildrenCB extends AsyncCB implements ChildrenCallback {
 
-        List<String> children = new ArrayList<String>();
+        List<String> children = new ArrayList<>();
 
         ChildrenCB(ZooKeeper zk) {
             this(zk, new CountDownLatch(1));
@@ -366,7 +366,7 @@ public String toString() {
 
     public static class Children2CB extends AsyncCB implements Children2Callback {
 
-        List<String> children = new ArrayList<String>();
+        List<String> children = new ArrayList<>();
 
         Children2CB(ZooKeeper zk) {
             this(zk, new CountDownLatch(1));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
index c315270034c..f1667db1086 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
@@ -64,7 +64,7 @@ private ZooKeeper createClient(String hp) throws Exception {
         return zk;
     }
 
-    List<Integer> results = new LinkedList<Integer>();
+    List<Integer> results = new LinkedList<>();
 
     @Test
     public void testAsync() throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index 43c2fad07b7..e2257c1563c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -230,7 +230,7 @@ public HostPort(String host, int port) {
 
     }
     public static List<HostPort> parseHostPortList(String hplist) {
-        ArrayList<HostPort> alist = new ArrayList<HostPort>();
+        ArrayList<HostPort> alist = new ArrayList<>();
         for (String hp : hplist.split(",")) {
             int idx = hp.lastIndexOf(':');
             String host = hp.substring(0, idx);
@@ -465,7 +465,7 @@ public static void setupTestEnv() {
     }
 
     protected void setUpAll() throws Exception {
-        allClients = new LinkedList<ZooKeeper>();
+        allClients = new LinkedList<>();
         allClientsSetup = true;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
index 5ee50f19a34..96db26f804d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
@@ -135,7 +135,7 @@ public void testACLs() throws Exception {
             }
 
             try {
-                ArrayList<ACL> testACL = new ArrayList<ACL>();
+                ArrayList<ACL> testACL = new ArrayList<>();
                 testACL.add(new ACL(Perms.ALL | Perms.ADMIN, Ids.AUTH_IDS));
                 testACL.add(new ACL(Perms.ALL | Perms.ADMIN, new Id("ip", "127.0.0.1/8")));
                 zk.create("/acltest", new byte[0], testACL, CreateMode.PERSISTENT);
@@ -145,7 +145,7 @@ public void testACLs() throws Exception {
             }
 
             try {
-                ArrayList<ACL> testACL = new ArrayList<ACL>();
+                ArrayList<ACL> testACL = new ArrayList<>();
                 testACL.add(new ACL(Perms.ALL | Perms.ADMIN, new Id()));
                 zk.create("/nullidtest", new byte[0], testACL, CreateMode.PERSISTENT);
                 fail("Should have received an invalid acl error");
@@ -154,7 +154,7 @@ public void testACLs() throws Exception {
             }
 
             zk.addAuthInfo("digest", "ben:passwd".getBytes());
-            ArrayList<ACL> testACL = new ArrayList<ACL>();
+            ArrayList<ACL> testACL = new ArrayList<>();
             testACL.add(new ACL(Perms.ALL, new Id("auth", "")));
             testACL.add(new ACL(Perms.WRITE, new Id("ip", "127.0.0.1")));
             zk.create("/acltest", new byte[0], testACL, CreateMode.PERSISTENT);
@@ -204,7 +204,7 @@ public void testNullAuthId() throws Exception {
         try {
             zk = createClient();
             zk.addAuthInfo("digest", "ben:passwd".getBytes());
-            ArrayList<ACL> testACL = new ArrayList<ACL>();
+            ArrayList<ACL> testACL = new ArrayList<>();
             testACL.add(new ACL(Perms.ALL, new Id("auth", null)));
             zk.create("/acltest", new byte[0], testACL, CreateMode.PERSISTENT);
             zk.close();
@@ -242,7 +242,7 @@ public void testNullAuthId() throws Exception {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
index c8a4fffe702..aacede199c7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
@@ -43,7 +43,7 @@ public class DisconnectedWatcherTest extends ClientBase {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
@@ -200,7 +200,7 @@ public void testManyChildWatchersAutoReset() throws Exception {
 
         // Create 10,000 nodes. This should ensure the length of our
         // watches set below exceeds 1MB.
-        List<String> paths = new ArrayList<String>();
+        List<String> paths = new ArrayList<>();
         for (int i = 0; i < 10000; i++) {
             String path = zk1.create(pathBase + "/ch-", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
             paths.add(path);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
index 2ad1fe1b8e0..eb62dd65364 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
@@ -54,8 +54,8 @@ public class FLENewEpochTest extends ZKTestCase {
     public void setUp() throws Exception {
         count = 3;
 
-        peers = new HashMap<Long, QuorumServer>(count);
-        threads = new ArrayList<LEThread>(count);
+        peers = new HashMap<>(count);
+        threads = new ArrayList<>(count);
         tmpdir = new File[count];
         port = new int[count];
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
index b9e3749538f..5c372b9dc7d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
@@ -55,7 +55,7 @@ boolean predicate(long newId, long newZxid, long newEpoch, long curId, long curZ
     @Test
     public void testPredicate() throws IOException {
 
-        peers = new HashMap<Long, QuorumServer>(3);
+        peers = new HashMap<>(3);
 
         /*
          * Creates list of peers.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
index 52cd1851a87..07ac68b782d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
@@ -74,8 +74,8 @@ int countVotes(HashSet<TestVote> hs, long id) {
     @BeforeEach
     public void setUp() throws Exception {
         count = 3;
-        peers = new HashMap<Long, QuorumServer>(count);
-        restartThreads = new ArrayList<FLERestartThread>(count);
+        peers = new HashMap<>(count);
+        restartThreads = new ArrayList<>(count);
         tmpdir = new File[count];
         port = new int[count];
         finish = new Semaphore(0);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
index 0f679b2d268..b147f7ae82e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
@@ -90,14 +90,14 @@ int countVotes(HashSet<TestVote> hs, long id) {
     public void setUp() throws Exception {
         count = 7;
 
-        peers = new HashMap<Long, QuorumServer>(count);
-        threads = new ArrayList<LEThread>(count);
+        peers = new HashMap<>(count);
+        threads = new ArrayList<>(count);
         voteMap = new HashMap<Integer, HashSet<TestVote>>();
         votes = new Vote[count];
         tmpdir = new File[count];
         port = new int[count];
         successCount = 0;
-        joinedThreads = new HashSet<Long>();
+        joinedThreads = new HashSet<>();
     }
 
     @AfterEach
@@ -191,7 +191,7 @@ public void run() {
                          * we first update it with the vote of this peer.
                          */
                         if (quora.get(v.getId()) == null) {
-                            quora.put(v.getId(), new HashSet<Integer>());
+                            quora.put(v.getId(), new HashSet<>());
                         }
                         quora.get(v.getId()).add(i);
 
@@ -296,7 +296,7 @@ public void testTripleElection() throws Exception {
      * @throws Exception
      */
     private void runElection(int rounds) throws Exception {
-        ConcurrentHashMap<Long, HashSet<Integer>> quora = new ConcurrentHashMap<Long, HashSet<Integer>>();
+        ConcurrentHashMap<Long, HashSet<Integer>> quora = new ConcurrentHashMap<>();
 
         LOG.info("TestLE: {}, {}", getTestName(), count);
 
@@ -401,7 +401,7 @@ public void testJoin() throws Exception {
         int sid;
         QuorumPeer peer;
         int waitTime = 10 * 1000;
-        ArrayList<QuorumPeer> peerList = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peerList = new ArrayList<>();
         for (sid = 0; sid < 3; sid++) {
             port[sid] = PortAssignment.unique();
             peers.put(Long.valueOf(sid), new QuorumServer(sid, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port[sid])));
@@ -450,7 +450,7 @@ public void testJoinInconsistentEnsemble() throws Exception {
         int sid;
         QuorumPeer peer;
         int waitTime = 10 * 1000;
-        ArrayList<QuorumPeer> peerList = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peerList = new ArrayList<>();
         for (sid = 0; sid < 3; sid++) {
             peers.put(Long.valueOf(sid), new QuorumServer(sid, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique())));
             tmpdir[sid] = ClientBase.createTmpDir();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
index 59ed266f6d7..68bfa312768 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
@@ -57,8 +57,8 @@ public class FLEZeroWeightTest extends ZKTestCase {
     public void setUp() throws Exception {
         count = 9;
 
-        peers = new HashMap<Long, QuorumServer>(count);
-        threads = new ArrayList<LEThread>(count);
+        peers = new HashMap<>(count);
+        threads = new ArrayList<>(count);
         votes = new Vote[count];
         tmpdir = new File[count];
         port = new int[count];
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
index aafd36ac756..d9d67c4023b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
@@ -635,7 +635,7 @@ public void testFollowerSendsLastZxid() throws Exception {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
index 6776fdf4e70..0ea8053dc4c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
@@ -93,8 +93,8 @@ public void testChildren() throws IOException, KeeperException, InterruptedExcep
         String name = "/foo";
         zk.create(name, name.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        List<String> children = new ArrayList<String>();
-        List<String> children_s = new ArrayList<String>();
+        List<String> children = new ArrayList<>();
+        List<String> children_s = new ArrayList<>();
 
         for (int i = 0; i < 10; i++) {
             String childname = name + "/bar" + i;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
index ed6a30d487d..010d69b3365 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
@@ -101,7 +101,7 @@ public void testGetProposalFromTxn() throws Exception {
         Iterator<Proposal> itr = db.getProposalsFromTxnLog(zxids[0], 10000000);
 
         int createCount = 0;
-        ArrayList<Long> retrievedZxids = new ArrayList<Long>(MSG_COUNT);
+        ArrayList<Long> retrievedZxids = new ArrayList<>(MSG_COUNT);
 
         // Get zxid of create requests
         while (itr.hasNext()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
index 35992513d61..e91261ed39f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
@@ -214,7 +214,7 @@ void startServers(boolean withObservers) throws Exception {
         // interesting to see what's there...
         JMXEnv.dump();
         // make sure we have these 5 servers listed
-        Set<String> ensureNames = new LinkedHashSet<String>();
+        Set<String> ensureNames = new LinkedHashSet<>();
         for (int i = 1; i <= numberOfPeers; i++) {
             ensureNames.add("InMemoryDataTree");
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
index 4aba36da244..1fc467cc290 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
@@ -52,7 +52,7 @@ public class IntegrityCheck implements StatCallback, DataCallback {
 
     ZooKeeper zk;
 
-    Map<String, byte[]> lastValue = new HashMap<String, byte[]>();
+    Map<String, byte[]> lastValue = new HashMap<>();
 
     int count;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
index 5b80574e6ed..49db1707814 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
@@ -111,7 +111,7 @@ public static Set<ObjectName> ensureAll(String... expectedNames) throws IOExcept
                 throw new RuntimeException(e);
             }
 
-            found = new HashSet<ObjectName>();
+            found = new HashSet<>();
             for (String name : expectedNames) {
                 LOG.info("expect:{}", name);
                 for (ObjectName bean : beans) {
@@ -220,7 +220,7 @@ public static Set<ObjectName> ensureParent(String... expectedNames) throws IOExc
 
         Set<ObjectName> beans;
         int nTry = 0;
-        Set<ObjectName> found = new HashSet<ObjectName>();
+        Set<ObjectName> found = new HashSet<>();
         do {
             if (nTry++ > 0) {
                 Thread.sleep(500);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
index 30c2772079a..bec029d2c24 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
@@ -130,7 +130,7 @@ private void doOp(FileTxnSnapLog logFile, int type, String path, DataTree dt, Da
         } else if (type == ZooDefs.OpCode.multi) {
             txnHeader = new TxnHeader(0xabcd, 0x123, prevPzxid + 1, Time.currentElapsedTime(), ZooDefs.OpCode.create);
             txn = new CreateTxn(path, new byte[0], null, false, cversion);
-            List<Txn> txnList = new ArrayList<Txn>();
+            List<Txn> txnList = new ArrayList<>();
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
             txn.serialize(boa, "request");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
index 98fafdfde52..cf6d46a6df0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
@@ -106,7 +106,7 @@ private void testLocalSessions(boolean testLeader) throws Exception {
         zk.close();
 
         // Validate data on both follower and leader
-        Map<String, Integer> peers = new HashMap<String, Integer>();
+        Map<String, Integer> peers = new HashMap<>();
         peers.put("leader", leaderIdx);
         peers.put("follower", followerIdx);
         for (Entry<String, Integer> entry : peers.entrySet()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
index e31eba26159..9bdefc05177 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
@@ -85,7 +85,7 @@ Pair<Long, Long> getFirstLastZxid(File logFile) throws IOException {
         }
         txnLog.close();
         rmr(tmp);
-        return new Pair<Long, Long>(firstZxid, lastZxid);
+        return new Pair<>(firstZxid, lastZxid);
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
index 0ee0825e9c3..fada1c479be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
@@ -82,7 +82,7 @@ private void waitForPendingOps(int timeout) throws Exception {
     @Test
     public void testSequentialNodeCreateInAsyncMulti() throws Exception {
         final int iteration = 4;
-        final List<MultiResult> results = new ArrayList<MultiResult>();
+        final List<MultiResult> results = new ArrayList<>();
 
         pendingOps.set(iteration);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index 4ff593222fe..0fdf02ca7aa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -192,7 +192,7 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
     public void testInvalidPath(boolean useAsync) throws Exception {
-        List<Integer> expectedResultCodes = new ArrayList<Integer>();
+        List<Integer> expectedResultCodes = new ArrayList<>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
@@ -295,7 +295,7 @@ public void testMultiRollback(boolean useAsync) throws Exception {
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
     public void testBlankPath(boolean useAsync) throws Exception {
-        List<Integer> expectedResultCodes = new ArrayList<Integer>();
+        List<Integer> expectedResultCodes = new ArrayList<>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
@@ -318,7 +318,7 @@ public void testBlankPath(boolean useAsync) throws Exception {
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
     public void testInvalidCreateModeFlag(boolean useAsync) throws Exception {
-        List<Integer> expectedResultCodes = new ArrayList<Integer>();
+        List<Integer> expectedResultCodes = new ArrayList<>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
@@ -361,7 +361,7 @@ public void testChRootSetData(boolean useAsync) throws Exception {
         // setData using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String[] names = {"/multi0", "/multi1", "/multi2"};
-        List<Op> ops = new ArrayList<Op>();
+        List<Op> ops = new ArrayList<>();
 
         for (int i = 0; i < names.length; i++) {
             ops.add(Op.create(names[i], new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
@@ -383,7 +383,7 @@ public void testChRootCheck(boolean useAsync) throws Exception {
         // checking the child version using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String[] names = {"/multi0", "/multi1", "/multi2"};
-        List<Op> ops = new ArrayList<Op>();
+        List<Op> ops = new ArrayList<>();
 
         for (int i = 0; i < names.length; i++) {
             zk.create(chRoot + names[i], new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -499,7 +499,7 @@ public void testNestedCreate(boolean useAsync) throws Exception {
     public void testSetData(boolean useAsync) throws Exception {
 
         String[] names = {"/multi0", "/multi1", "/multi2"};
-        List<Op> ops = new ArrayList<Op>();
+        List<Op> ops = new ArrayList<>();
 
         for (int i = 0; i < names.length; i++) {
             ops.add(Op.create(names[i], new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
@@ -745,8 +745,8 @@ public void testTransactionBuilder(boolean useAsync) throws Exception {
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     public void testMultiGetChildren(boolean useAsync) throws Exception {
-        List<String> topLevelNodes = new ArrayList<String>();
-        Map<String, List<String>> childrenNodes = new HashMap<String, List<String>>();
+        List<String> topLevelNodes = new ArrayList<>();
+        Map<String, List<String>> childrenNodes = new HashMap<>();
         // Creating a database where '/fooX' nodes has 'barXY' named children.
         for (int i = 0; i < 10; i++) {
             String name = "/foo" + i;
@@ -777,7 +777,7 @@ public void testMultiGetChildren(boolean useAsync) throws Exception {
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     public void testMultiGetChildrenSameNode(boolean useAsync) throws Exception {
-        List<String> childrenNodes = new ArrayList<String>();
+        List<String> childrenNodes = new ArrayList<>();
         // Creating a database where '/foo' node has 'barX' named children.
         String topLevelNode = "/foo";
         zk.create(topLevelNode, topLevelNode.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index 573d361ae86..edde2b5dac5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -439,7 +439,7 @@ public void testDynamicReconfig(boolean testObserverMaster) throws InterruptedEx
         waitServerUp(observerClientPort);
 
         // create a client to the observer
-        final LinkedBlockingQueue<KeeperState> states = new LinkedBlockingQueue<KeeperState>();
+        final LinkedBlockingQueue<KeeperState> states = new LinkedBlockingQueue<>();
         ZooKeeper observerClient = new ZooKeeper(
             "127.0.0.1:" + observerClientPort,
             ClientBase.CONNECTION_TIMEOUT,
@@ -456,7 +456,7 @@ public void testDynamicReconfig(boolean testObserverMaster) throws InterruptedEx
         assertEquals(KeeperState.SyncConnected, state);
 
         // issue reconfig command
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> newServers = new ArrayList<>();
         String server = "server.3=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ":participant;localhost:" + PortAssignment.unique();
         newServers.add(server);
         ZooKeeperAdmin admin = createAdmin(clientPort1);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index 4f723f2994f..42740f897e3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -183,7 +183,7 @@ void startServers(boolean withObservers, boolean withOracle) throws Exception {
         int initLimit = 3;
         int syncLimit = 3;
         int connectToLearnerMasterLimit = 3;
-        Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peers = new HashMap<>();
         peers.put(Long.valueOf(1), new QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), LearnerType.PARTICIPANT));
         peers.put(Long.valueOf(2), new QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), LearnerType.PARTICIPANT));
         peers.put(Long.valueOf(3), new QuorumServer(3, new InetSocketAddress(LOCALADDR, port3), new InetSocketAddress(LOCALADDR, portLE3), new InetSocketAddress(LOCALADDR, portClient3), LearnerType.PARTICIPANT));
@@ -279,7 +279,7 @@ void startServers(boolean withObservers, boolean withOracle) throws Exception {
         // interesting to see what's there...
         JMXEnv.dump();
         // make sure we have these 5 servers listed
-        Set<String> ensureNames = new LinkedHashSet<String>();
+        Set<String> ensureNames = new LinkedHashSet<>();
         for (int i = 1; i <= 5; i++) {
             ensureNames.add("InMemoryDataTree");
         }
@@ -384,7 +384,7 @@ public String getPeersMatching(ServerState state) {
     }
 
     public ArrayList<QuorumPeer> getPeerList() {
-        ArrayList<QuorumPeer> peers = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peers = new ArrayList<>();
         peers.add(s1);
         peers.add(s2);
         peers.add(s3);
@@ -418,7 +418,7 @@ public void setupServer(int i) throws IOException {
         int connectToLearnerMasterLimit = 3;
 
         if (peers == null) {
-            peers = new HashMap<Long, QuorumServer>();
+            peers = new HashMap<>();
 
             peers.put(Long.valueOf(1), new QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), LearnerType.PARTICIPANT));
             peers.put(Long.valueOf(2), new QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), LearnerType.PARTICIPANT));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
index d32af99952d..a7f4a7e1d10 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
@@ -129,7 +129,7 @@ void startServers() throws Exception {
         int initLimit = 3;
         int syncLimit = 3;
         int connectToLearnerMasterLimit = 3;
-        Map<Long, QuorumPeer.QuorumServer> peers = new HashMap<Long, QuorumPeer.QuorumServer>();
+        Map<Long, QuorumPeer.QuorumServer> peers = new HashMap<>();
         peers.put(Long.valueOf(1), new QuorumPeer.QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), QuorumPeer.LearnerType.PARTICIPANT));
         peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
 
@@ -165,7 +165,7 @@ void startServers() throws Exception {
         // interesting to see what's there...
         JMXEnv.dump();
         // make sure we have these 5 servers listed
-        Set<String> ensureNames = new LinkedHashSet<String>();
+        Set<String> ensureNames = new LinkedHashSet<>();
         for (int i = 1; i <= 2; i++) {
             ensureNames.add("InMemoryDataTree");
         }
@@ -240,7 +240,7 @@ public String getPeersMatching(QuorumPeer.ServerState state) {
     }
 
     public ArrayList<QuorumPeer> getPeerList() {
-        ArrayList<QuorumPeer> peers = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peers = new ArrayList<>();
         peers.add(s1);
         peers.add(s2);
         return peers;
@@ -269,7 +269,7 @@ public void setupServer(int i) throws IOException {
         int connectToLearnerMasterLimit = 3;
 
         if (peers == null) {
-            peers = new HashMap<Long, QuorumPeer.QuorumServer>();
+            peers = new HashMap<>();
 
             peers.put(Long.valueOf(1), new QuorumPeer.QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), QuorumPeer.LearnerType.PARTICIPANT));
             peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
index 72a5f140b52..ff53b0fe932 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
@@ -314,7 +314,7 @@ public void testSessionMove() throws Exception {
             assertTrue(oldWatcher.zkDisco);
         }
 
-        ArrayList<ZooKeeper> toClose = new ArrayList<ZooKeeper>();
+        ArrayList<ZooKeeper> toClose = new ArrayList<>();
         toClose.add(zknew);
         // Let's just make sure it can still move
         for (int i = 0; i < 10; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
index ce1cd1b3c5f..865d82b0c7c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
@@ -65,9 +65,9 @@ public static class PeerStruct {
 
     }
 
-    private final Map<Long, QuorumServer> peersView = new HashMap<Long, QuorumServer>();
+    private final Map<Long, QuorumServer> peersView = new HashMap<>();
 
-    private final Map<Integer, PeerStruct> peers = new HashMap<Integer, PeerStruct>();
+    private final Map<Integer, PeerStruct> peers = new HashMap<>();
 
     public final int N;
 
@@ -165,7 +165,7 @@ public void startAll() throws IOException {
         try {
             JMXEnv.dump();
             // make sure we have all servers listed
-            Set<String> ensureNames = new LinkedHashSet<String>();
+            Set<String> ensureNames = new LinkedHashSet<>();
             for (int i = 1; i <= ALL; ++i) {
                 ensureNames.add("InMemoryDataTree");
             }
@@ -294,7 +294,7 @@ public QuorumPeer getLeaderQuorumPeer() {
     }
 
     public List<QuorumPeer> getFollowerQuorumPeers() {
-        List<QuorumPeer> peerList = new ArrayList<QuorumPeer>(ALL - 1);
+        List<QuorumPeer> peerList = new ArrayList<>(ALL - 1);
 
         for (PeerStruct ps : peers.values()) {
             if (ps.peer.leader == null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
index 9dc21ba272a..5afcb0d34a3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
@@ -156,7 +156,7 @@ public void testReconfigEnabledWithAuthAndWrongACL() throws InterruptedException
         try {
             zkAdmin.addAuthInfo("digest", "super:test".getBytes());
             // There is ACL however the permission is wrong - need WRITE permission at leaste.
-            ArrayList<ACL> acls = new ArrayList<ACL>(Collections.singletonList(new ACL(ZooDefs.Perms.READ, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
+            ArrayList<ACL> acls = new ArrayList<>(Collections.singletonList(new ACL(ZooDefs.Perms.READ, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
             zkAdmin.setACL(ZooDefs.CONFIG_NODE, acls, -1);
             resetZKAdmin();
             zkAdmin.addAuthInfo("digest", "user:test".getBytes());
@@ -174,7 +174,7 @@ public void testReconfigEnabledWithAuthAndACL() throws InterruptedException {
 
         try {
             zkAdmin.addAuthInfo("digest", "super:test".getBytes());
-            ArrayList<ACL> acls = new ArrayList<ACL>(Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
+            ArrayList<ACL> acls = new ArrayList<>(Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
             zkAdmin.setACL(ZooDefs.CONFIG_NODE, acls, -1);
             resetZKAdmin();
             zkAdmin.addAuthInfo("digest", "user:test".getBytes());
@@ -208,7 +208,7 @@ private void resetZKAdmin() throws InterruptedException {
     }
 
     private boolean reconfigPort() throws KeeperException, InterruptedException {
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
         int leaderId = 1;
         while (qu.getPeer(leaderId).peer.leader == null) {
             leaderId++;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
index 9e1b83802fc..712497f3586 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
@@ -115,7 +115,7 @@ private void instantiateZKAdmin() throws InterruptedException {
     }
 
     private boolean reconfigPort() throws KeeperException, InterruptedException {
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
         int leaderId = 1;
         while (qu.getPeer(leaderId).peer.leader == null) {
             leaderId++;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index 65026a6b9ba..20ec82d0989 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -288,8 +288,8 @@ public void testRemoveAddOne() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
 
@@ -366,8 +366,8 @@ public void testRemoveAddTwo() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
 
@@ -473,7 +473,7 @@ public void testBulkReconfig() throws Exception {
 
         // new config will have three of the servers as followers
         // two of the servers as observers, and all ports different
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> newServers = new ArrayList<>();
         for (int i = 1; i <= 5; i++) {
             String server = "server." + i + "=localhost:" + PortAssignment.unique()
                             + ":" + PortAssignment.unique() + ":" + ((i == 4 || i == 5) ? "observer" : "participant")
@@ -507,12 +507,12 @@ public void testRemoveOneAsynchronous() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
 
         // lets remove someone who's not the leader
         leavingServers.add(getLeaderId(qu) == 5 ? "4" : "5");
 
-        List<Integer> results = new LinkedList<Integer>();
+        List<Integer> results = new LinkedList<>();
 
         zkAdminArr[1].reconfigure(null, leavingServers, null, -1, this, results);
 
@@ -547,7 +547,7 @@ public void testRoleChange() throws Exception {
 
         // changing a server's role / port is done by "adding" it with the same
         // id but different role / port
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
 
@@ -622,7 +622,7 @@ public void testPortChange() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
         int followerIndex = leaderIndex == 1 ? 2 : 1;
@@ -761,7 +761,7 @@ private void testPortChangeToBlockedPort(boolean testLeader) throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
         int followerIndex = leaderIndex == 1 ? 2 : 1;
@@ -950,8 +950,8 @@ public void testJMXBeanAfterRemoveAddOne() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
 
         // assert remotePeerBean.1 of ReplicatedServer_2
         int leavingIndex = 1;
@@ -1035,7 +1035,7 @@ public void testJMXBeanAfterRoleChange() throws Exception {
 
         // changing a server's role / port is done by "adding" it with the same
         // id but different role / port
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         // assert remotePeerBean.1 of ReplicatedServer_2
         int changingIndex = 1;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
index 27156865d25..e5cd89d43e5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
@@ -112,7 +112,7 @@ public void testSaslConfig() throws Exception {
     public void testReadAccessUser() throws Exception {
         System.setProperty("zookeeper.letAnySaslUserDoX", "anyone");
         ZooKeeper zk = createClient();
-        List<ACL> aclList = new ArrayList<ACL>();
+        List<ACL> aclList = new ArrayList<>();
         ACL acl = new ACL(Perms.ADMIN | Perms.CREATE | Perms.WRITE | Perms.DELETE, new Id("sasl", "fakeuser"));
         ACL acl1 = new ACL(Perms.READ, new Id("sasl", "anyone"));
         aclList.add(acl);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
index 9d859eeaa42..85f76c21381 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
@@ -331,7 +331,7 @@ public void testSessionTimeoutAccess() throws Exception {
 
     private class DupWatcher extends CountdownWatcher {
 
-        public List<WatchedEvent> states = new LinkedList<WatchedEvent>();
+        public List<WatchedEvent> states = new LinkedList<>();
         public void process(WatchedEvent event) {
             super.process(event);
             if (event.getType() == EventType.None) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
index 250dc887b11..d0ea52bd2da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
@@ -43,7 +43,7 @@ public class SessionTrackerCheckTest extends ZKTestCase {
     public static final int TICK_TIME = 1000;
     public static final int CONNECTION_TIMEOUT = TICK_TIME * 10;
 
-    private ConcurrentHashMap<Long, Integer> sessionsWithTimeouts = new ConcurrentHashMap<Long, Integer>();
+    private ConcurrentHashMap<Long, Integer> sessionsWithTimeouts = new ConcurrentHashMap<>();
 
     private class Expirer implements SessionExpirer {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
index c7efeb17790..49e648b0e72 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
@@ -137,7 +137,7 @@ public void testStandaloneReconfigFails() throws Exception {
         ZooKeeperAdmin zkAdmin = new ZooKeeperAdmin(HOSTPORT, CONNECTION_TIMEOUT, watcher);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
 
-        List<String> joiners = new ArrayList<String>();
+        List<String> joiners = new ArrayList<>();
         joiners.add("server.2=localhost:1234:1235;1236");
         // generate some transactions that will get logged
         try {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
index 905b6cd78c3..c782e9820bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
@@ -169,7 +169,7 @@ public void testUpdateClientMigrateOrNot() throws UnknownHostException {
         hostProvider.onConnected();
 
         // Number of machines increased, my server is not in the new cluster
-        newList = new ArrayList<InetSocketAddress>(3);
+        newList = new ArrayList<>(3);
         for (byte i = 4; i > 1; i--) { // 10.10.10.4:1238, 10.10.10.3:1237, 10.10.10.2:1236
             newList.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
@@ -203,20 +203,20 @@ public void testUpdateClientMigrateOrNot() throws UnknownHostException {
     public void testUpdateMigrationGoesRound() throws UnknownHostException {
         HostProvider hostProvider = getHostProvider((byte) 4);
         // old list (just the ports): 1238, 1237, 1236, 1235
-        Collection<InetSocketAddress> newList = new ArrayList<InetSocketAddress>(10);
+        Collection<InetSocketAddress> newList = new ArrayList<>(10);
         for (byte i = 12; i > 2; i--) { // 1246, 1245, 1244, 1243, 1242, 1241,
             // 1240, 1239, 1238, 1237
             newList.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
 
         // servers from the old list that appear in the new list
-        Collection<InetSocketAddress> oldStaying = new ArrayList<InetSocketAddress>(2);
+        Collection<InetSocketAddress> oldStaying = new ArrayList<>(2);
         for (byte i = 4; i > 2; i--) { // 1238, 1237
             oldStaying.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
 
         // servers in the new list that are not in the old list
-        Collection<InetSocketAddress> newComing = new ArrayList<InetSocketAddress>(10);
+        Collection<InetSocketAddress> newComing = new ArrayList<>(10);
         for (byte i = 12; i > 4; i--) {// 1246, 1245, 1244, 1243, 1242, 1241, 1240, 1139
             newComing.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
@@ -232,7 +232,7 @@ public void testUpdateMigrationGoesRound() throws UnknownHostException {
         // This means reconfigMode = true, and nextHostInReconfigMode will be
         // called from next
         // Since pNew = 1 we should first try the new servers
-        ArrayList<InetSocketAddress> seen = new ArrayList<InetSocketAddress>();
+        ArrayList<InetSocketAddress> seen = new ArrayList<>();
         for (int i = 0; i < newComing.size(); i++) {
             InetSocketAddress addr = hostProvider.next(0);
             assertTrue(newComing.contains(addr));
@@ -325,7 +325,7 @@ public void testUpdateLoadBalancing() throws UnknownHostException {
 
         // remove host number 0 (the first one in the current list)
         // and add back hosts 6, 7 and 8
-        newList = new ArrayList<InetSocketAddress>(8);
+        newList = new ArrayList<>(8);
         for (byte i = 9; i > 1; i--) {
             newList.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
@@ -486,7 +486,7 @@ private StaticHostProvider getHostProvider(byte size) {
     }
 
     private Collection<InetSocketAddress> getServerAddresses(byte size) {
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
         while (size > 0) {
             try {
                 list.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, size}), 1234 + size));
@@ -699,7 +699,7 @@ public void testLiteralIPNoReverseNS() {
     public void testReResolvingSingle() throws UnknownHostException {
         // Arrange
         byte size = 1;
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
 
         // Test a hostname that resolves to a single address
         list.add(InetSocketAddress.createUnresolved("issues.apache.org", 1234));
@@ -733,7 +733,7 @@ public InetAddress[] getAllByName(String name) {
     public void testReResolvingMultiple() throws UnknownHostException {
         // Arrange
         byte size = 1;
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
 
         // Test a hostname that resolves to multiple addresses
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
@@ -748,7 +748,7 @@ public void testReResolvingMultiple() throws UnknownHostException {
         when(apacheOrg2.toString()).thenReturn("www.apache.org");
         when(apacheOrg2.getHostName()).thenReturn("www.apache.org");
 
-        final List<InetAddress> resolvedAddresses = new ArrayList<InetAddress>();
+        final List<InetAddress> resolvedAddresses = new ArrayList<>();
         resolvedAddresses.add(apacheOrg1);
         resolvedAddresses.add(apacheOrg2);
         StaticHostProvider.Resolver resolver = new StaticHostProvider.Resolver() {
@@ -775,10 +775,10 @@ public InetAddress[] getAllByName(String name) {
     @Test
     public void testReResolveMultipleOneFailing() throws UnknownHostException {
         // Arrange
-        final List<InetSocketAddress> list = new ArrayList<InetSocketAddress>();
+        final List<InetSocketAddress> list = new ArrayList<>();
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
-        final List<String> ipList = new ArrayList<String>();
-        final List<InetAddress> resolvedAddresses = new ArrayList<InetAddress>();
+        final List<String> ipList = new ArrayList<>();
+        final List<InetAddress> resolvedAddresses = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             ipList.add(String.format("192.168.1.%d", i + 1));
             final InetAddress apacheOrg = mock(InetAddress.class);
@@ -821,10 +821,10 @@ public InetAddress[] getAllByName(String name) {
     @Test
     public void testEmptyResolution() throws UnknownHostException {
         // Arrange
-        final List<InetSocketAddress> list = new ArrayList<InetSocketAddress>();
+        final List<InetSocketAddress> list = new ArrayList<>();
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
         list.add(InetSocketAddress.createUnresolved("www.google.com", 1234));
-        final List<InetAddress> resolvedAddresses = new ArrayList<InetAddress>();
+        final List<InetAddress> resolvedAddresses = new ArrayList<>();
 
         final InetAddress apacheOrg1 = mock(InetAddress.class);
         when(apacheOrg1.getHostAddress()).thenReturn("192.168.1.1");
@@ -865,7 +865,7 @@ public InetAddress[] getAllByName(String name) {
     @Test
     public void testReResolvingLocalhost() {
         byte size = 2;
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
 
         // Test a hostname that resolves to multiple addresses
         list.add(InetSocketAddress.createUnresolved("localhost", 1234));
@@ -884,7 +884,7 @@ private StaticHostProvider getHostProviderUnresolved(byte size) {
     }
 
     private Collection<InetSocketAddress> getUnresolvedServerAddresses(byte size) {
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
         while (size > 0) {
             list.add(InetSocketAddress.createUnresolved("10.10.10." + size, 1234 + size));
             --size;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
index 622dadfa77a..f81afc86708 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
@@ -189,7 +189,7 @@ public void testTruncate() throws Exception {
         int port3 = PortAssignment.unique();
 
         // Start up two of the quorum and add 10 txns
-        Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peers = new HashMap<>();
         peers.put(Long.valueOf(1), new QuorumServer(1, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port1)));
         peers.put(Long.valueOf(2), new QuorumServer(2, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port2)));
         peers.put(Long.valueOf(3), new QuorumServer(3, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port3)));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
index f519c95d197..5fd4b96b177 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
@@ -51,7 +51,7 @@ public class WatchEventWhenAutoResetTest extends ZKTestCase {
 
     public static class EventsWatcher extends CountdownWatcher {
 
-        private LinkedBlockingQueue<WatchedEvent> dataEvents = new LinkedBlockingQueue<WatchedEvent>();
+        private LinkedBlockingQueue<WatchedEvent> dataEvents = new LinkedBlockingQueue<>();
 
         @Override
         public void process(WatchedEvent event) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
index 0987c4cf7e9..180cd08a611 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
@@ -45,7 +45,7 @@ public class WatcherFuncTest extends ClientBase {
 
     private static class SimpleWatcher implements Watcher {
 
-        private LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        private LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
         private CountDownLatch latch;
 
         public SimpleWatcher(CountDownLatch latch) {
@@ -103,7 +103,7 @@ public void setUp() throws Exception {
         lsnr_dwatch = new SimpleWatcher(lsnr_latch);
         lsnr = createClient(lsnr_dwatch, lsnr_latch);
 
-        expected = new ArrayList<EventType>();
+        expected = new ArrayList<>();
     }
 
     @AfterEach
@@ -266,7 +266,7 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<EventType>();
+        List<EventType> e2 = new ArrayList<>();
 
         assertNull(lsnr.exists("/foo", true));
         assertNull(lsnr.exists("/foo", w1));
@@ -302,7 +302,7 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         client.setData("/foo/bar", "child".getBytes(), -1);
         e2.add(EventType.NodeDataChanged);
 
-        lsnr_dwatch.verify(new ArrayList<EventType>()); // not reg so should = 0
+        lsnr_dwatch.verify(new ArrayList<>()); // not reg so should = 0
         w1.verify(expected);
         w2.verify(e2);
         w3.verify(e2);
@@ -341,7 +341,7 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<EventType>();
+        List<EventType> e2 = new ArrayList<>();
 
         try {
             lsnr.getData("/foo", w1, null);
@@ -408,7 +408,7 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<EventType>();
+        List<EventType> e2 = new ArrayList<>();
 
         try {
             lsnr.getChildren("/foo", true);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
index 8a17885b18b..22da89a2e67 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
@@ -63,7 +63,7 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
index c4ef9e23dad..389104b9aef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
@@ -45,7 +45,7 @@ public class ZooKeeperTestClient extends ZKTestCase implements Watcher {
 
     protected String testDirOnZK = dirOnZK + "/" + Time.currentElapsedTime();
 
-    LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+    LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
     private WatchedEvent getEvent(int numTries) throws InterruptedException {
         WatchedEvent event = null;

From 0374d566db047e69e867febbbf00f8a42a558104 Mon Sep 17 00:00:00 2001
From: Vivian Kong <vivkong@ca.ibm.com>
Date: Mon, 13 Feb 2023 09:09:44 -0500
Subject: [PATCH 347/591] [ZOOKEEPER-4668] Fix s390x Jenkinsfile and use s390x
 agent (#1982)

---
 Jenkinsfile-s390x | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Jenkinsfile-s390x b/Jenkinsfile-s390x
index 21cef360601..bd48a1c280a 100644
--- a/Jenkinsfile-s390x
+++ b/Jenkinsfile-s390x
@@ -35,7 +35,9 @@ pipeline {
     stages {
         stage('Prepare') {
 
-            agent any
+            agent {
+                label 's390x'
+            }
 
             tools {
                 maven "maven_latest"

From 2d1bac7e077f49a7149d3fb878a2c73b9e627f6e Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Mon, 13 Feb 2023 16:26:27 +0100
Subject: [PATCH 348/591] [ZOOKEEPER-4674] TestReadOnlyClient.cc: Stop/start
 "normal" server in test setUp/tearDown (#1983)

Co-authored-by: Damien Diederen <dd@crosstwine.com>
---
 .../tests/TestReadOnlyClient.cc                | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc
index 0d4d579f444..e864ef266ca 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc
@@ -71,6 +71,24 @@ class Zookeeper_readOnly : public CPPUNIT_NS::TestFixture {
     void setUp() {
         zoo_set_log_stream(logfile);
         zoo_set_debug_level(ZOO_LOG_LEVEL_DEBUG);
+        stopServer();
+    }
+
+    void tearDown()
+    {
+        startServer();
+    }
+
+    void startServer() {
+        char cmd[1024];
+        sprintf(cmd, "%s start %s", ZKSERVER_CMD, "127.0.0.1:22181");
+        CPPUNIT_ASSERT(system(cmd) == 0);
+    }
+
+    void stopServer() {
+        char cmd[1024];
+        sprintf(cmd, "%s stop %s", ZKSERVER_CMD, "127.0.0.1:22181");
+        CPPUNIT_ASSERT(system(cmd) == 0);
     }
 
     void startReadOnly() {

From 2e9c3f3ceda90aeb9380acc87b253bf7661b7794 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 15 Feb 2023 08:36:39 +0100
Subject: [PATCH 349/591] [ZOOKEEPER-4647] Tests don't pass on JDK20 because we
 try to mock InetAddress (#1959)

- upgrade Mockito to 4.9.0
- use BurningWave DNS mock tools
---
 pom.xml                                       |   8 +-
 zookeeper-server/pom.xml                      |   5 +
 .../zookeeper/common/ZKHostnameVerifier.java  |   2 +-
 .../zookeeper/common/ZKTrustManager.java      |  13 +-
 .../zookeeper/common/ZKTrustManagerTest.java  | 132 ++++++++++++------
 .../server/quorum/QuorumCanonicalizeTest.java |  29 +++-
 .../test/StaticHostProviderTest.java          |  53 ++++---
 7 files changed, 170 insertions(+), 72 deletions(-)

diff --git a/pom.xml b/pom.xml
index 89961743a8c..a488ba7934c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -555,7 +555,7 @@
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
     <junit-platform.version>1.6.2</junit-platform.version>
-    <mockito.version>3.6.28</mockito.version>
+    <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.86.Final</netty.version>
@@ -571,6 +571,7 @@
     <checkstyle.version>8.39</checkstyle.version>
     <enforcer.version>3.0.0-M3</enforcer.version>
     <commons-io.version>2.11.0</commons-io.version>
+    <burningwave.mockdns.version>0.25.4</burningwave.mockdns.version>
     <clover-maven-plugin.version>4.4.1</clover-maven-plugin.version>
     <sonar-maven-plugin.version>3.7.0.1746</sonar-maven-plugin.version>
 
@@ -764,6 +765,11 @@
         <artifactId>commons-io</artifactId>
         <version>${commons-io.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.burningwave</groupId>
+        <artifactId>tools</artifactId>
+        <version>${burningwave.mockdns.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index a90c0a4df6c..1d8d5ba722a 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -167,6 +167,11 @@
       <artifactId>junit-platform-runner</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.burningwave</groupId>
+      <artifactId>tools</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.xerial.snappy</groupId>
       <artifactId>snappy-java</artifactId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
index 4abe29bfb5d..2c5ef2ef7ca 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
@@ -49,7 +49,7 @@
  * Note: copied from Apache httpclient with some modifications. We want host verification, but depending
  * on the httpclient jar caused unexplained performance regressions (even when the code was not used).
  */
-final class ZKHostnameVerifier implements HostnameVerifier {
+class ZKHostnameVerifier implements HostnameVerifier {
 
     /**
      * Note: copied from Apache httpclient with some minor modifications. We want host verification, but depending
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
index 34bf4dc977b..2573e3fcead 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
@@ -58,10 +58,21 @@ public class ZKTrustManager extends X509ExtendedTrustManager {
         X509ExtendedTrustManager x509ExtendedTrustManager,
         boolean serverHostnameVerificationEnabled,
         boolean clientHostnameVerificationEnabled) {
+        this(x509ExtendedTrustManager,
+                serverHostnameVerificationEnabled,
+                clientHostnameVerificationEnabled,
+                new ZKHostnameVerifier());
+    }
+
+    ZKTrustManager(
+            X509ExtendedTrustManager x509ExtendedTrustManager,
+            boolean serverHostnameVerificationEnabled,
+            boolean clientHostnameVerificationEnabled,
+            ZKHostnameVerifier hostnameVerifier) {
         this.x509ExtendedTrustManager = x509ExtendedTrustManager;
         this.serverHostnameVerificationEnabled = serverHostnameVerificationEnabled;
         this.clientHostnameVerificationEnabled = clientHostnameVerificationEnabled;
-        hostnameVerifier = new ZKHostnameVerifier();
+        this.hostnameVerifier = hostnameVerifier;
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
index c549a9ce9d6..7b4e8783ee3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -30,10 +32,16 @@
 import java.security.Security;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Calendar;
 import java.util.Date;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Random;
+import java.util.concurrent.CopyOnWriteArrayList;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSession;
 import javax.net.ssl.X509ExtendedTrustManager;
 import org.apache.zookeeper.ZKTestCase;
 import org.bouncycastle.asn1.x500.X500NameBuilder;
@@ -49,25 +57,46 @@
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.burningwave.tools.net.DefaultHostResolver;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 // We can only test calls to ZKTrustManager using Sockets (not SSLEngines). This can be fine since the logic is the same.
 public class ZKTrustManagerTest extends ZKTestCase {
 
+    protected static final Logger LOG = LoggerFactory.getLogger(ZKTrustManagerTest.class);
+
     private static KeyPair keyPair;
 
     private X509ExtendedTrustManager mockX509ExtendedTrustManager;
     private static final String IP_ADDRESS = "127.0.0.1";
     private static final String HOSTNAME = "localhost";
-
-    private InetAddress mockInetAddress;
     private Socket mockSocket;
 
+    @BeforeAll
+    public static void setupDNSMocks() {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+        hostAliases.put(HOSTNAME, IP_ADDRESS);
+
+        HostResolutionRequestInterceptor.INSTANCE.install(
+                new MappedHostResolver(hostAliases),
+                DefaultHostResolver.INSTANCE
+        );
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
     @BeforeAll
     public static void createKeyPair() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
@@ -85,20 +114,7 @@ public static void removeBouncyCastleProvider() throws Exception {
     public void setup() throws Exception {
         mockX509ExtendedTrustManager = mock(X509ExtendedTrustManager.class);
 
-        mockInetAddress = mock(InetAddress.class);
-        when(mockInetAddress.getHostAddress()).thenAnswer(new Answer() {
-            @Override
-            public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
-                return IP_ADDRESS;
-            }
-        });
-
-        when(mockInetAddress.getHostName()).thenAnswer(new Answer() {
-            @Override
-            public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
-                return HOSTNAME;
-            }
-        });
+        InetAddress mockInetAddress = InetAddress.getByName(HOSTNAME);
 
         mockSocket = mock(Socket.class);
         when(mockSocket.getInetAddress()).thenAnswer(new Answer() {
@@ -143,106 +159,140 @@ private X509Certificate[] createSelfSignedCertifcateChain(String ipAddress, Stri
 
     @Test
     public void testServerHostnameVerificationWithHostnameVerificationDisabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
-
-        verify(mockInetAddress, times(0)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        verify(mockSocket, times(0)).getInetAddress();
+        assertTrue(hostnameVerifier.hosts.isEmpty());
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testServerHostnameVerificationWithHostnameVerificationDisabledAndClientHostnameVerificationEnabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(0)).getInetAddress();
 
-        verify(mockInetAddress, times(0)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertTrue(hostnameVerifier.hosts.isEmpty());
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testServerHostnameVerificationWithIPAddress() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testServerHostnameVerificationWithHostname() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(1)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithHostnameVerificationDisabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(1)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithClientHostnameVerificationDisabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true,
+                false, hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(0)).getInetAddress();
 
-        verify(mockInetAddress, times(0)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertTrue(hostnameVerifier.hosts.isEmpty());
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithIPAddress() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithHostname() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+                hostnameVerifier);
 
         X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(1)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
+
+    static class VerifiableHostnameVerifier extends ZKHostnameVerifier {
+
+        List<String> hosts = new CopyOnWriteArrayList<>();
+
+        @Override
+        public boolean verify(String host, SSLSession session) {
+            throw new IllegalArgumentException("not expected to be called by these tests");
+        }
+
+        @Override
+        void verify(String host, X509Certificate cert) throws SSLException {
+            LOG.info("verifyWithX509Certificate {} {}", host, cert);
+            hosts.add(host);
+            super.verify(host, cert);
+        }
+    }
+
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
index 07445f3253f..aec017a0833 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
@@ -19,13 +19,18 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.util.LinkedHashMap;
+import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.burningwave.tools.net.DefaultHostResolver;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
 public class QuorumCanonicalizeTest extends ZKTestCase {
@@ -35,16 +40,28 @@ public class QuorumCanonicalizeTest extends ZKTestCase {
     private static final String ZK1_ALIAS = "zookeeper.invalid";
     private static final String ZK1_FQDN = "zk1.invalid";
     private static final String ZK1_IP = "169.254.0.42";
-    private static final InetAddress IA_MOCK_ZK1;
+    private static InetAddress IA_MOCK_ZK1;
 
-    static {
-        InetAddress ia = mock(InetAddress.class);
+    @BeforeAll
+    public static void setupDNSMocks() throws Exception {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+        hostAliases.put(ZK1_FQDN, ZK1_IP);
+        hostAliases.put(ZK1_ALIAS, ZK1_IP);
 
-        when(ia.getCanonicalHostName()).thenReturn(ZK1_FQDN);
+        HostResolutionRequestInterceptor.INSTANCE.install(
+                new MappedHostResolver(hostAliases),
+                DefaultHostResolver.INSTANCE
+        );
 
+        InetAddress ia = InetAddress.getByName(ZK1_FQDN);
         IA_MOCK_ZK1 = ia;
     }
 
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
     private static InetAddress getInetAddress(InetSocketAddress addr) {
         if (addr.getHostName().equals(ZK1_ALIAS) || addr.getHostName().equals(ZK1_IP)) {
             return IA_MOCK_ZK1;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
index c782e9820bd..9ee7dabe3e2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
@@ -30,11 +30,9 @@
 import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -42,16 +40,42 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Random;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.common.Time;
+import org.burningwave.tools.net.DefaultHostResolver;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
 public class StaticHostProviderTest extends ZKTestCase {
 
+    @BeforeAll
+    public static void setupDNSMocks() {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+        hostAliases.put("site1.mock", "192.168.1.1");
+        hostAliases.put("site2.mock", "192.168.1.2");
+        hostAliases.put("site3.mock", "192.168.1.3");
+        hostAliases.put("site4.mock", "192.168.1.4");
+
+        HostResolutionRequestInterceptor.INSTANCE.install(
+                new MappedHostResolver(hostAliases),
+                DefaultHostResolver.INSTANCE
+        );
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
     private Random r = new Random(1);
 
     @Test
@@ -704,10 +728,7 @@ public void testReResolvingSingle() throws UnknownHostException {
         // Test a hostname that resolves to a single address
         list.add(InetSocketAddress.createUnresolved("issues.apache.org", 1234));
 
-        final InetAddress issuesApacheOrg = mock(InetAddress.class);
-        when(issuesApacheOrg.getHostAddress()).thenReturn("192.168.1.1");
-        when(issuesApacheOrg.toString()).thenReturn("issues.apache.org");
-        when(issuesApacheOrg.getHostName()).thenReturn("issues.apache.org");
+        final InetAddress issuesApacheOrg = InetAddress.getByName("site1.mock");
 
         StaticHostProvider.Resolver resolver = new StaticHostProvider.Resolver() {
             @Override
@@ -738,15 +759,9 @@ public void testReResolvingMultiple() throws UnknownHostException {
         // Test a hostname that resolves to multiple addresses
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
 
-        final InetAddress apacheOrg1 = mock(InetAddress.class);
-        when(apacheOrg1.getHostAddress()).thenReturn("192.168.1.1");
-        when(apacheOrg1.toString()).thenReturn("www.apache.org");
-        when(apacheOrg1.getHostName()).thenReturn("www.apache.org");
+        final InetAddress apacheOrg1 = InetAddress.getByName("site1.mock");
 
-        final InetAddress apacheOrg2 = mock(InetAddress.class);
-        when(apacheOrg2.getHostAddress()).thenReturn("192.168.1.2");
-        when(apacheOrg2.toString()).thenReturn("www.apache.org");
-        when(apacheOrg2.getHostName()).thenReturn("www.apache.org");
+        final InetAddress apacheOrg2 = InetAddress.getByName("site2.mock");
 
         final List<InetAddress> resolvedAddresses = new ArrayList<>();
         resolvedAddresses.add(apacheOrg1);
@@ -781,10 +796,7 @@ public void testReResolveMultipleOneFailing() throws UnknownHostException {
         final List<InetAddress> resolvedAddresses = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             ipList.add(String.format("192.168.1.%d", i + 1));
-            final InetAddress apacheOrg = mock(InetAddress.class);
-            when(apacheOrg.getHostAddress()).thenReturn(String.format("192.168.1.%d", i + 1));
-            when(apacheOrg.toString()).thenReturn(String.format("192.168.1.%d", i + 1));
-            when(apacheOrg.getHostName()).thenReturn("www.apache.org");
+            final InetAddress apacheOrg = InetAddress.getByName("site" + (i + 1) + ".mock");
             resolvedAddresses.add(apacheOrg);
         }
 
@@ -826,10 +838,7 @@ public void testEmptyResolution() throws UnknownHostException {
         list.add(InetSocketAddress.createUnresolved("www.google.com", 1234));
         final List<InetAddress> resolvedAddresses = new ArrayList<>();
 
-        final InetAddress apacheOrg1 = mock(InetAddress.class);
-        when(apacheOrg1.getHostAddress()).thenReturn("192.168.1.1");
-        when(apacheOrg1.toString()).thenReturn("www.apache.org");
-        when(apacheOrg1.getHostName()).thenReturn("www.apache.org");
+        final InetAddress apacheOrg1 = InetAddress.getByName("site1.mock");
 
         resolvedAddresses.add(apacheOrg1);
 

From ac219cef2ad7999fc95c8fd4eb3b945ba37abd43 Mon Sep 17 00:00:00 2001
From: Vitaliy <vitaliyf@users.noreply.github.com>
Date: Fri, 17 Feb 2023 14:20:37 +0800
Subject: [PATCH 350/591] docs: Minor clarification around
 globalOutstandingLimit comments

This comment better explain how someone with a typical 3-node ensemble may end up with a 500 limit by default.

The code that "causes" this is here: https://github.com/apache/zookeeper/blob/cedf09370b88b682ae4f7bcd29c683798fa31928/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java#L166-L170

Author: Vitaliy <vitaliyf@users.noreply.github.com>

Reviewers: maoling <maoling@apache.org>

Closes #1946 from vitaliyf/docs-globaloutstandinglimit-comments
---
 .../src/main/resources/markdown/zookeeperAdmin.md    | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 636c6cde227..1e317a0b471 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -620,9 +620,11 @@ property, when available, is noted below.
     Clients can submit requests faster than ZooKeeper can
     process them, especially if there are a lot of clients. To
     prevent ZooKeeper from running out of memory due to queued
-    requests, ZooKeeper will throttle clients so that there is no
-    more than globalOutstandingLimit outstanding requests in the
-    system. The default limit is 1,000.
+    requests, ZooKeeper will throttle clients so that there are no
+    more than globalOutstandingLimit outstanding requests across
+    entire ensemble, equally divided. The default limit is 1,000
+    and, for example, with 3 members each of them will have
+    1000 / 2 = 500 individual limit.
 
 * *preAllocSize* :
     (Java system property: **zookeeper.preAllocSize**)
@@ -635,14 +637,14 @@ property, when available, is noted below.
 * *snapCount* :
     (Java system property: **zookeeper.snapCount**)
     ZooKeeper records its transactions using snapshots and
-    a transaction log (think write-ahead log).The number of
+    a transaction log (think write-ahead log). The number of
     transactions recorded in the transaction log before a snapshot
     can be taken (and the transaction log rolled) is determined
     by snapCount. In order to prevent all of the machines in the quorum
     from taking a snapshot at the same time, each ZooKeeper server
     will take a snapshot when the number of transactions in the transaction log
     reaches a runtime generated random value in the \[snapCount/2+1, snapCount]
-    range.The default snapCount is 100,000.
+    range. The default snapCount is 100,000.
 
 * *commitLogCount* * :
     (Java system property: **zookeeper.commitLogCount**)

From 255b0c9137a75635cf6e2c112672a045c58ce1cf Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Wed, 22 Feb 2023 17:23:00 +0800
Subject: [PATCH 351/591] ZOOKEEPER-4475: Fix NodeChildrenChanged delivered to
 recursive watcher (#1820)

The semantics of persistent recursive watch promise no child events on
descendant nodes. When there are standard child watches on descendants
of node being watches in persistent recursive mode, server will deliver
child events to client inevitably. So we have to filter out child events
for persistent recursive watches on client side.
---
 .../org/apache/zookeeper/ZKWatchManager.java  | 15 +++++++++----
 .../test/PersistentRecursiveWatcherTest.java  | 21 +++++++++++++++++++
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
index 95a07f0e7be..9da4249447a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
@@ -404,13 +404,13 @@ public Set<Watcher> materialize(
             synchronized (existWatches) {
                 addTo(existWatches.remove(clientPath), result);
             }
-            addPersistentWatches(clientPath, result);
+            addPersistentWatches(clientPath, type, result);
             break;
         case NodeChildrenChanged:
             synchronized (childWatches) {
                 addTo(childWatches.remove(clientPath), result);
             }
-            addPersistentWatches(clientPath, result);
+            addPersistentWatches(clientPath, type, result);
             break;
         case NodeDeleted:
             synchronized (dataWatches) {
@@ -427,7 +427,7 @@ public Set<Watcher> materialize(
             synchronized (childWatches) {
                 addTo(childWatches.remove(clientPath), result);
             }
-            addPersistentWatches(clientPath, result);
+            addPersistentWatches(clientPath, type, result);
             break;
         default:
             String errorMsg = String.format(
@@ -442,10 +442,17 @@ public Set<Watcher> materialize(
         return result;
     }
 
-    private void addPersistentWatches(String clientPath, Set<Watcher> result) {
+    private void addPersistentWatches(String clientPath, Watcher.Event.EventType type, Set<Watcher> result) {
         synchronized (persistentWatches) {
             addTo(persistentWatches.get(clientPath), result);
         }
+        // The semantics of persistent recursive watch promise no child events on descendant nodes. When there
+        // are standard child watches on descendants of node being watched in persistent recursive mode, server
+        // will deliver child events to client inevitably. So we have to filter out child events for persistent
+        // recursive watches on client side.
+        if (type == Watcher.Event.EventType.NodeChildrenChanged) {
+            return;
+        }
         synchronized (persistentRecursiveWatches) {
             for (String path : PathParentIterator.forAll(clientPath).asIterable()) {
                 addTo(persistentRecursiveWatches.get(path), result);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index 80d8c400cd2..e74ee2fd683 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -114,6 +114,27 @@ public void testRemoval()
         }
     }
 
+    @Test
+    public void testNoChildEvents() throws Exception {
+        try (ZooKeeper zk = createClient()) {
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            zk.addWatch("/", persistentWatcher, PERSISTENT_RECURSIVE);
+
+            BlockingQueue<WatchedEvent> childEvents = new LinkedBlockingQueue<>();
+            zk.getChildren("/a", childEvents::add);
+
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
+
+            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
+            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c");
+            assertTrue(events.isEmpty());
+        }
+    }
+
     @Test
     public void testDisconnect() throws Exception {
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {

From d79811bf28f00fb1db6ec6002e884af6cfd0d7fc Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Fri, 24 Feb 2023 07:20:58 -0800
Subject: [PATCH 352/591] ZOOKEEPER-4639: Provide auth support for admin server
 APIs (#1966)

Author: Li Wang <liwang@apple.com>
---
 .../main/resources/markdown/html/header.html  |   3 +
 .../src/main/resources/markdown/index.md      |   1 +
 .../main/resources/markdown/zookeeperAdmin.md |  15 +-
 .../markdown/zookeeperSnapshotAndRestore.md   |  68 +++
 .../zookeeper/server/ZooKeeperServer.java     |   2 +-
 .../zookeeper/server/admin/AuthRequest.java   |  66 +++
 .../zookeeper/server/admin/Command.java       |  11 +-
 .../zookeeper/server/admin/CommandBase.java   |  20 +-
 .../zookeeper/server/admin/Commands.java      | 124 +++++-
 .../zookeeper/server/admin/GetCommand.java    |   4 +
 .../server/admin/JettyAdminServer.java        |  16 +-
 .../zookeeper/server/admin/PostCommand.java   |   4 +-
 .../server/admin/StreamOutputter.java         |   2 +-
 .../server/auth/AuthenticationProvider.java   |  19 +
 .../auth/DigestAuthenticationProvider.java    |  41 +-
 .../server/auth/IPAuthenticationProvider.java |  15 +-
 .../auth/WrappedAuthenticationProvider.java   |  14 +
 .../auth/X509AuthenticationProvider.java      |  76 ++--
 .../server/admin/CommandAuthTest.java         | 410 ++++++++++++++++++
 .../zookeeper/server/admin/CommandsTest.java  |  19 +-
 .../server/admin/RestoreQuorumTest.java       | 116 +++++
 .../admin/SnapshotAndRestoreCommandTest.java  |  63 ++-
 .../server/quorum/QuorumPeerTestBase.java     |  17 +-
 .../org/apache/zookeeper/test/IPAuthTest.java |  59 +++
 .../zookeeper/test/ObserverMasterTest.java    |   2 +-
 .../apache/zookeeper/test/X509AuthTest.java   |  37 +-
 26 files changed, 1103 insertions(+), 121 deletions(-)
 create mode 100644 zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/html/header.html b/zookeeper-docs/src/main/resources/markdown/html/header.html
index f58a99f0468..c308b2d8894 100644
--- a/zookeeper-docs/src/main/resources/markdown/html/header.html
+++ b/zookeeper-docs/src/main/resources/markdown/html/header.html
@@ -96,6 +96,9 @@
             <div class="menuitem">
                 <a href="zookeeperQuotas.html">Quota Guide</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperSnapshotAndRestore.html">Snapshot and Restore Guide</a>
+            </div>
             <div class="menuitem">
                 <a href="zookeeperJMX.html">JMX</a>
             </div>
diff --git a/zookeeper-docs/src/main/resources/markdown/index.md b/zookeeper-docs/src/main/resources/markdown/index.md
index 85574f30f4a..d3e3864f342 100644
--- a/zookeeper-docs/src/main/resources/markdown/index.md
+++ b/zookeeper-docs/src/main/resources/markdown/index.md
@@ -46,6 +46,7 @@ archives.
     Documents for Administrators and Operations Engineers of ZooKeeper Deployments
     + [Administrator's Guide](zookeeperAdmin.html) - a guide for system administrators and anyone else who might deploy ZooKeeper
     + [Quota Guide](zookeeperQuotas.html) - a guide for system administrators on Quotas in ZooKeeper.
+    + [Snapshot and Restore Guide](zookeeperSnapshotAndRestore.html) - a guide for system administrators on take snapshot and restore ZooKeeper.
     + [JMX](zookeeperJMX.html) - how to enable JMX in ZooKeeper
     + [Hierarchical Quorums](zookeeperHierarchicalQuorums.html) - a guide on how to use hierarchical quorums
     + [Oracle Quorum](zookeeperOracleQuorums.html) - the introduction to Oracle Quorum increases the availability of a cluster of 2 ZooKeeper instances with a failure detector.
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 1e317a0b471..83a749d0a08 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2124,15 +2124,18 @@ options are used to configure the [AdminServer](#sc_adminserver).
 
 * *admin.snapshot.enabled* :
   (Java system property: **zookeeper.admin.snapshot.enabled**)
-  The flag for enabling the snapshot command. Defaults to false. 
-  It will be enabled by default once the auth support for admin server commands 
-  is available.
+  The flag for enabling the snapshot command. Defaults to true. 
+
   
 * *admin.restore.enabled* :
   (Java system property: **zookeeper.admin.restore.enabled**)
-  The flag for enabling the restore command. Defaults to false.
-  It will be enabled by default once the auth support for admin server commands
-  is available.
+  The flag for enabling the restore command. Defaults to true.
+
+
+* *admin.needClientAuth* :
+  (Java system property: **zookeeper.admin.needClientAuth**)
+  The flag to control whether client auth is needed. Using x509 auth requires true.
+  Defaults to false.
 
 **New in 3.7.1:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md b/zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md
new file mode 100644
index 00000000000..576f18fdadd
--- /dev/null
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md
@@ -0,0 +1,68 @@
+<!--
+Copyright 2002-2004 The Apache Software Foundation
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# ZooKeeper Snapshot and Restore Guide
+
+Zookeeper is designed to withstand machine failures. A Zookeeper cluster can automatically recover 
+from temporary failures such as machine reboot. It can also tolerate up to (N-1)/2 permanent 
+failures for a cluster of N members due to hardware failures or disk corruption, etc. When a member 
+permanently fails, it loses access to the cluster. If the cluster permanently loses more than 
+(N-1)/2 members, it disastrously fails and loses quorum. Once the quorum is lost, the cluster 
+cannot reach consensus and therefore cannot continue to accept updates.
+
+To recover from such disastrous failures, Zookeeper provides snapshot and restore functionalities to
+restore a cluster from a snapshot.
+
+1. Snapshot and restore operate on the connected server via Admin Server APIs
+1. Snapshot and restore are rate limited to protect the server from being overloaded
+1. Snapshot and restore require authentication and authorization on the root path with ALL permission.
+The supported auth schemas are digest, x509 and IP.
+   
+* [Snapshot](#zookeeper_snapshot)
+* [Restore](#zookeeper_restore)  
+
+<a name="zookeeper_snapshot"></a>
+
+## Snapshot
+Recovering a cluster needs a snapshot from a ZooKeeper cluster. Users can periodically take
+snapshots from a live server which has the highest zxid and stream out data to a local 
+or external storage/file system (e.g., S3).
+
+ ```bash
+ # The snapshot command takes snapshot from the server it connects to and rate limited to once every 5 mins by default
+ curl -H 'Authorization: digest root:root_passwd' http://hostname:adminPort/commands/snapshot?streaming=true --output snapshotFileName
+ ```
+
+<a name="zookeeper_restore"></a>
+## Restore
+
+Restoring a cluster needs a single snapshot as input stream. Restore can be used for recovering a 
+cluster for quorum lost or building a brand-new cluster with seed data. 
+
+All members should restore using the same snapshot. The following are the recommended steps:
+ 
+- Blocking traffic on the client port or client secure port before restore starts
+- Take a snapshot of the latest database state using the snapshot admin server command if applicable
+- For each server
+  - Moving the files in dataDir and dataLogDir to different location to prevent the restored database 
+    from being overwritten when server restarts after restore
+  - Restore the server using restore admin server command
+- Unblocking traffic on the client port or client secure port after restore completes
+
+ ```bash
+ # The restore command takes a snapshot as input stream and restore the db of the server it connects. It is rate limited to once every 5 mins by default
+ curl -H 'Content-Type:application/octet-stream' -H 'Authorization: digest root:root_passwd' -POST http://hostname:adminPort/commands/restore --data-binary "@snapshotFileName" 
+ ```
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 72be66aab29..f460b2d5bb4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -2069,7 +2069,7 @@ public void dumpMonitorValues(BiConsumer<String, Object> response) {
 
     /**
      * Grant or deny authorization to an operation on a node as a function of:
-     * @param cnxn :    the server connection
+     * @param cnxn :    the server connection or null for admin server commands
      * @param acl :     set of ACLs for the node
      * @param perm :    the permission that the client is requesting
      * @param ids :     the credentials supplied by the client
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java
new file mode 100644
index 00000000000..5552a2420cc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import org.apache.zookeeper.ZooDefs;
+
+/**
+ * Class representing auth data for performing ACL check on admin server commands.
+ *
+ * For example, SnapshotCommand requires {@link ZooDefs.Perms.ALL} permission on
+ * the root node.
+ *
+ */
+public class AuthRequest {
+    private final int permission;
+    private final String path;
+
+    /**
+     * @param permission
+     *                      the required permission for auth check
+     * @param path
+     *                      the ZNode path for auth check
+     */
+    public AuthRequest(final int permission, final String path) {
+        this.permission = permission;
+        this.path = path;
+    }
+
+    /**
+     * @return permission
+     */
+    public int getPermission() {
+        return permission;
+    }
+
+    /**
+     * @return ZNode path
+     */
+    public String getPath() {
+        return path;
+    }
+
+    @Override
+    public String toString() {
+        return "AuthRequest{"
+        + "permission=" + permission
+        + ", path='" + path + '\''
+        + '}';
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
index 5d06356b20c..5bc332a2828 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
@@ -45,18 +45,17 @@ public interface Command {
      */
     String getPrimaryName();
 
-    /**
-     * A string documenting this command (e.g., what it does, any arguments it
-     * takes).
-     */
-    String getDoc();
-
     /**
      * @return true if the command requires an active ZooKeeperServer or a
      *     synced peer in order to resolve
      */
     boolean isServerRequired();
 
+    /**
+     * @return AuthRequest associated to the command. Null means auth check is not required.
+     */
+    AuthRequest getAuthRequest();
+
     /**
      * Run this command for HTTP GET request. Commands take a ZooKeeperServer, String-valued keyword
      * arguments and return a CommandResponse object containing any information
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
index b3714c25654..2a9ef99bb8a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
@@ -26,24 +26,27 @@ public abstract class CommandBase implements Command {
 
     private final String primaryName;
     private final Set<String> names;
-    private final String doc;
     private final boolean serverRequired;
+    private final AuthRequest authRequest;
 
     /**
      * @param names The possible names of this command, with the primary name first.
      */
     protected CommandBase(List<String> names) {
-        this(names, true, null);
+        this(names, true);
     }
     protected CommandBase(List<String> names, boolean serverRequired) {
         this(names, serverRequired, null);
     }
 
-    protected CommandBase(List<String> names, boolean serverRequired, String doc) {
+    protected CommandBase(List<String> names, boolean serverRequired, AuthRequest authRequest) {
+        if (authRequest != null && !serverRequired) {
+            throw new IllegalArgumentException("An active server is required for auth check");
+        }
         this.primaryName = names.get(0);
         this.names = new HashSet<>(names);
-        this.doc = doc;
         this.serverRequired = serverRequired;
+        this.authRequest = authRequest;
     }
 
     @Override
@@ -56,16 +59,17 @@ public Set<String> getNames() {
         return names;
     }
 
-    @Override
-    public String getDoc() {
-        return doc;
-    }
 
     @Override
     public boolean isServerRequired() {
         return serverRequired;
     }
 
+    @Override
+    public AuthRequest getAuthRequest() {
+        return authRequest;
+    }
+
     /**
      * @return A response with the command set to the primary name and the
      *         error set to null (these are the two entries that all command
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index dfdbe8e23e1..74dfdc3c113 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -25,6 +25,7 @@
 import java.io.FileInputStream;
 import java.io.InputStream;
 import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -37,15 +38,23 @@
 import java.util.TreeMap;
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
+import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.Environment.Entry;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Version;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.DataNode;
 import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooTrace;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
+import org.apache.zookeeper.server.auth.ServerAuthenticationProvider;
 import org.apache.zookeeper.server.persistence.SnapshotInfo;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.server.quorum.Follower;
@@ -74,8 +83,13 @@
 public class Commands {
 
     static final Logger LOG = LoggerFactory.getLogger(Commands.class);
+    // VisibleForTesting
     static final String ADMIN_RATE_LIMITER_INTERVAL = "zookeeper.admin.rateLimiterIntervalInMS";
     private static final long rateLimiterInterval = Integer.parseInt(System.getProperty(ADMIN_RATE_LIMITER_INTERVAL, "300000"));
+    // VisibleForTesting
+    static final String AUTH_INFO_SEPARATOR = " ";
+    // VisibleForTesting
+    static final String ROOT_PATH = "/";
 
     /** Maps command names to Command instances */
     private static Map<String, Command> commands = new HashMap<>();
@@ -105,6 +119,9 @@ public static void registerCommand(Command command) {
      * @param zkServer
      * @param kwargs String-valued keyword arguments to the command from HTTP GET request
      *        (may be null if command requires no additional arguments)
+     * @param authInfo auth info for auth check
+     *        (null if command requires no auth check)
+     * @param request HTTP request
      * @return Map representing response to command containing at minimum:
      *    - "command" key containing the command's primary name
      *    - "error" key containing a String error message or null if no error
@@ -112,17 +129,10 @@ public static void registerCommand(Command command) {
     public static CommandResponse runGetCommand(
             String cmdName,
             ZooKeeperServer zkServer,
-            Map<String, String> kwargs) {
-        Command command = getCommand(cmdName);
-        if (command == null) {
-            // set the status code to 200 to keep the current behavior of existing commands
-            return new CommandResponse(cmdName, "Unknown command: " + cmdName, HttpServletResponse.SC_OK);
-        }
-        if (command.isServerRequired() && (zkServer == null || !zkServer.isRunning())) {
-            // set the status code to 200 to keep the current behavior of existing commands
-            return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests", HttpServletResponse.SC_OK);
-        }
-        return command.runGet(zkServer, kwargs);
+            Map<String, String> kwargs,
+            String authInfo,
+            HttpServletRequest request) {
+        return runCommand(cmdName, zkServer, kwargs, null, authInfo, request, true);
     }
 
     /**
@@ -141,17 +151,93 @@ public static CommandResponse runGetCommand(
     public static CommandResponse runPostCommand(
             String cmdName,
             ZooKeeperServer zkServer,
-            InputStream inputStream) {
+            InputStream inputStream,
+            String authInfo,
+            HttpServletRequest request) {
+        return runCommand(cmdName, zkServer, null, inputStream, authInfo, request, false);
+    }
+
+    private static CommandResponse runCommand(
+            String cmdName,
+            ZooKeeperServer zkServer,
+            Map<String, String> kwargs,
+            InputStream inputStream,
+            String authInfo,
+            HttpServletRequest request,
+            boolean isGet) {
         Command command = getCommand(cmdName);
         if (command == null) {
             // set the status code to 200 to keep the current behavior of existing commands
+            LOG.warn("Unknown command");
             return new CommandResponse(cmdName, "Unknown command: " + cmdName, HttpServletResponse.SC_OK);
         }
         if (command.isServerRequired() && (zkServer == null || !zkServer.isRunning())) {
             // set the status code to 200 to keep the current behavior of existing commands
+            LOG.warn("This ZooKeeper instance is not currently serving requests for command");
             return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests", HttpServletResponse.SC_OK);
         }
-        return command.runPost(zkServer, inputStream);
+
+        final AuthRequest authRequest = command.getAuthRequest();
+        if (authRequest != null) {
+            if (authInfo == null) {
+                LOG.warn("Auth info is missing for command");
+                return new CommandResponse(cmdName, "Auth info is missing for the command", HttpServletResponse.SC_UNAUTHORIZED);
+            }
+            try {
+                final List<Id> ids = handleAuthentication(request, authInfo);
+                handleAuthorization(zkServer, ids, authRequest.getPermission(), authRequest.getPath());
+            } catch (final KeeperException.AuthFailedException e) {
+                return new CommandResponse(cmdName, "Not authenticated", HttpServletResponse.SC_UNAUTHORIZED);
+            } catch (final KeeperException.NoAuthException e) {
+                return new CommandResponse(cmdName, "Not authorized", HttpServletResponse.SC_FORBIDDEN);
+            } catch (final Exception e) {
+                LOG.warn("Error occurred during auth for command", e);
+                return new CommandResponse(cmdName, "Error occurred during auth", HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+            }
+        }
+        return isGet ? command.runGet(zkServer, kwargs) : command.runPost(zkServer, inputStream);
+    }
+
+    private static List<Id> handleAuthentication(final HttpServletRequest request, final String authInfo) throws KeeperException.AuthFailedException {
+        final String[] authData = authInfo.split(AUTH_INFO_SEPARATOR);
+        // for IP and x509, auth info only contains the schema and Auth Id will be extracted from HTTP request
+        if (authData.length != 1 && authData.length != 2) {
+            LOG.warn("Invalid auth info length");
+            throw new KeeperException.AuthFailedException();
+        }
+
+        final String schema = authData[0];
+        final ServerAuthenticationProvider authProvider = ProviderRegistry.getServerProvider(schema);
+        if (authProvider != null) {
+            try {
+                final byte[] auth = authData.length == 2 ? authData[1].getBytes(StandardCharsets.UTF_8) : null;
+                final List<Id> ids = authProvider.handleAuthentication(request, auth);
+                if (ids.isEmpty()) {
+                    LOG.warn("Auth Id list is empty");
+                    throw new KeeperException.AuthFailedException();
+                }
+                return ids;
+            } catch (final RuntimeException e) {
+                LOG.warn("Caught runtime exception from AuthenticationProvider", e);
+                throw new KeeperException.AuthFailedException();
+            }
+        } else {
+            LOG.warn("Auth provider not found for schema");
+            throw new KeeperException.AuthFailedException();
+        }
+    }
+
+    private static void handleAuthorization(final ZooKeeperServer zkServer,
+                                            final List<Id> ids,
+                                            final int perm,
+                                            final String path)
+            throws KeeperException.NoNodeException, KeeperException.NoAuthException {
+        final DataNode dataNode = zkServer.getZKDatabase().getNode(path);
+        if (dataNode == null) {
+            throw new KeeperException.NoNodeException(path);
+        }
+        final List<ACL> acls = zkServer.getZKDatabase().aclForNode(dataNode);
+        zkServer.checkACL(null, acls, perm, ids, path, null);
     }
 
     /**
@@ -532,15 +618,13 @@ public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwar
      */
     public static class RestoreCommand extends PostCommand {
         static final String RESPONSE_DATA_LAST_ZXID = "last_zxid";
-
         static final String ADMIN_RESTORE_ENABLED = "zookeeper.admin.restore.enabled";
 
-
         private RateLimiter rateLimiter;
 
         public RestoreCommand() {
-            super(Arrays.asList("restore", "rest"));
-            rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MICROSECONDS);
+            super(Arrays.asList("restore", "rest"), true, new AuthRequest(ZooDefs.Perms.ALL, ROOT_PATH));
+            rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MILLISECONDS);
         }
 
         @Override
@@ -548,7 +632,7 @@ public CommandResponse runPost(final ZooKeeperServer zkServer, final InputStream
             final CommandResponse response = initializeResponse();
 
             // check feature flag
-            final boolean restoreEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_RESTORE_ENABLED, "false"));
+            final boolean restoreEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_RESTORE_ENABLED, "true"));
             if (!restoreEnabled) {
                 response.setStatusCode(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
                 LOG.warn("Restore command is disabled");
@@ -659,7 +743,7 @@ public static class SnapshotCommand extends GetCommand {
         private final RateLimiter rateLimiter;
 
         public SnapshotCommand() {
-            super(Arrays.asList("snapshot", "snap"));
+            super(Arrays.asList("snapshot", "snap"), true, new AuthRequest(ZooDefs.Perms.ALL, ROOT_PATH));
             rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MICROSECONDS);
         }
 
@@ -670,7 +754,7 @@ public CommandResponse runGet(final ZooKeeperServer zkServer, final Map<String,
             final CommandResponse response = initializeResponse();
 
             // check feature flag
-            final boolean snapshotEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_SNAPSHOT_ENABLED, "false"));
+            final boolean snapshotEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_SNAPSHOT_ENABLED, "true"));
             if (!snapshotEnabled) {
                 response.setStatusCode(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
                 LOG.warn("Snapshot command is disabled");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
index 509cad72ea9..ea7e5d90734 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
@@ -36,6 +36,10 @@ protected GetCommand(List<String> names, boolean serverRequired) {
         super(names, serverRequired);
     }
 
+    protected GetCommand(List<String> names, boolean serverRequired, AuthRequest authRequest) {
+        super(names, serverRequired, authRequest);
+    }
+
     @Override
     public CommandResponse runPost(ZooKeeperServer zkServer, InputStream inputStream) {
         return null;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 98f2cb0514f..a237e4c3b5f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -34,6 +34,7 @@
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
+import org.eclipse.jetty.http.HttpHeader;
 import org.eclipse.jetty.http.HttpVersion;
 import org.eclipse.jetty.security.ConstraintMapping;
 import org.eclipse.jetty.security.ConstraintSecurityHandler;
@@ -89,7 +90,8 @@ public JettyAdminServer() throws AdminServerException, IOException, GeneralSecur
             System.getProperty("zookeeper.admin.commandURL", DEFAULT_COMMAND_URL),
             Integer.getInteger("zookeeper.admin.httpVersion", DEFAULT_HTTP_VERSION),
             Boolean.getBoolean("zookeeper.admin.portUnification"),
-            Boolean.getBoolean("zookeeper.admin.forceHttps"));
+            Boolean.getBoolean("zookeeper.admin.forceHttps"),
+            Boolean.getBoolean("zookeeper.admin.needClientAuth"));
     }
 
     public JettyAdminServer(
@@ -99,7 +101,8 @@ public JettyAdminServer(
         String commandUrl,
         int httpVersion,
         boolean portUnification,
-        boolean forceHttps) throws IOException, GeneralSecurityException {
+        boolean forceHttps,
+        boolean needClientAuth) throws IOException, GeneralSecurityException {
 
         this.port = port;
         this.idleTimeout = timeout;
@@ -144,11 +147,12 @@ public JettyAdminServer(
                     throw e;
                 }
 
-                SslContextFactory sslContextFactory = new SslContextFactory.Server();
+                SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
                 sslContextFactory.setKeyStore(keyStore);
                 sslContextFactory.setKeyStorePassword(privateKeyPassword);
                 sslContextFactory.setTrustStore(trustStore);
                 sslContextFactory.setTrustStorePassword(certAuthPassword);
+                sslContextFactory.setNeedClientAuth(needClientAuth);
 
                 if (forceHttps) {
                     connector = new ServerConnector(server,
@@ -259,9 +263,10 @@ protected void doGet(
             for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
                 kwargs.put(entry.getKey(), entry.getValue()[0]);
             }
+            final String authInfo = request.getHeader(HttpHeader.AUTHORIZATION.asString());
 
             // Run the command
-            final CommandResponse cmdResponse = Commands.runGetCommand(cmd, zkServer, kwargs);
+            final CommandResponse cmdResponse = Commands.runGetCommand(cmd, zkServer, kwargs, authInfo, request);
             response.setStatus(cmdResponse.getStatusCode());
 
             final Map<String, String> headers = cmdResponse.getHeaders();
@@ -293,7 +298,8 @@ protected void doPost(final HttpServletRequest request,
                               final HttpServletResponse response) throws ServletException, IOException {
             final String cmdName = extractCommandNameFromURL(request, response);
             if (cmdName != null) {
-                final CommandResponse cmdResponse = Commands.runPostCommand(cmdName, zkServer, request.getInputStream());
+                final String authInfo = request.getHeader(HttpHeader.AUTHORIZATION.asString());
+                final CommandResponse cmdResponse = Commands.runPostCommand(cmdName, zkServer, request.getInputStream(), authInfo, request);
                 final String clientIP = IPAuthenticationProvider.getClientIPAddress(request);
                 sendJSONResponse(response, cmdResponse, clientIP);
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
index cb346b2e024..3f5d50a88e2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
@@ -26,8 +26,8 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 
 public abstract class PostCommand extends CommandBase {
-    protected PostCommand(List<String> names) {
-        super(names);
+    protected PostCommand(List<String> names, boolean serverRequired, AuthRequest authRequest) {
+        super(names, serverRequired, authRequest);
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
index e8f68e6499a..b0caa1923fb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
@@ -46,7 +46,7 @@ public void output(final CommandResponse response, final OutputStream os) {
         try (final InputStream is = response.getInputStream()){
             IOUtils.copyBytes(is, os, 1024, true);
         } catch (final IOException e) {
-            LOG.error("Exception occurred when streaming out data to {}", clientIP, e);
+            LOG.warn("Exception streaming out data to {}", clientIP, e);
         }
     }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java
index 179eac8dfbf..1de8a741184 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java
@@ -18,7 +18,11 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.ArrayList;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
 
 /**
@@ -49,6 +53,21 @@ public interface AuthenticationProvider {
      */
     KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData);
 
+    /**
+     * This method is called when admin server command passes authentication data for this
+     * scheme.
+     *
+     * @param request
+     *                the request that contains the authentication information.
+     * @param authData
+     *                the authentication data received.
+     * @return Ids
+     *                the list of Id. Empty list means not authenticated
+     */
+    default List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        return new ArrayList<>();
+    }
+
     /**
      * This method is called to see if the given id matches the given id
      * expression in the ACL. This allows schemes to use application specific
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
index 6e2687521d2..1a13d5a1a8a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
@@ -21,6 +21,10 @@
 import static java.nio.charset.StandardCharsets.UTF_8;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
@@ -123,18 +127,19 @@ public static byte[] digest(String idPassword) throws NoSuchAlgorithmException {
     }
 
     public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
-        String id = new String(authData);
-        try {
-            String digest = generateDigest(id);
-            if (digest.equals(superDigest)) {
-                cnxn.addAuthInfo(new Id("super", ""));
-            }
-            cnxn.addAuthInfo(new Id(getScheme(), digest));
-            return KeeperException.Code.OK;
-        } catch (NoSuchAlgorithmException e) {
-            LOG.error("Missing algorithm", e);
+        final List<Id> ids = handleAuthentication(authData);
+        if (ids.isEmpty()) {
+            return KeeperException.Code.AUTHFAILED;
+        }
+        for (Id id : ids) {
+            cnxn.addAuthInfo(id);
         }
-        return KeeperException.Code.AUTHFAILED;
+        return KeeperException.Code.OK;
+    }
+
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        return handleAuthentication(authData);
     }
 
     public boolean isAuthenticated() {
@@ -170,4 +175,18 @@ public static void main(String[] args) throws NoSuchAlgorithmException {
         }
     }
 
+    private List<Id> handleAuthentication(final byte[] authData) {
+        final List<Id> ids = new ArrayList<>();
+        final String id = new String(authData);
+        try {
+            final String digest = generateDigest(id);
+            if (digest.equals(superDigest)) {
+                ids.add(new Id("super", ""));
+            }
+            ids.add(new Id(getScheme(), digest));
+        } catch (final NoSuchAlgorithmException e) {
+            LOG.error("Missing algorithm", e);
+        }
+        return Collections.unmodifiableList(ids);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
index 9f6fb4005be..9334f7c5e72 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
 import java.util.StringTokenizer;
 import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
@@ -25,7 +28,7 @@
 import org.apache.zookeeper.server.ServerCnxn;
 
 public class IPAuthenticationProvider implements AuthenticationProvider {
-    private static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
+    public static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
 
     public String getScheme() {
         return "ip";
@@ -37,6 +40,16 @@ public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authDat
         return KeeperException.Code.OK;
     }
 
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        final List<Id> ids = new ArrayList<>();
+
+        final String ip = getClientIPAddress(request);
+        ids.add(new Id(getScheme(), ip));
+
+        return Collections.unmodifiableList(ids);
+    }
+
     // This is a bit weird but we need to return the address and the number of
     // bytes (to distinguish between IPv4 and IPv6
     private byte[] addr2Bytes(String addr) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java
index 65dc4376bb0..6347ede5a22 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java
@@ -18,7 +18,10 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
 
 /**
@@ -52,6 +55,17 @@ public KeeperException.Code handleAuthentication(ServerObjs serverObjs, byte[] a
         return implementation.handleAuthentication(serverObjs.getCnxn(), authData);
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * forwards to older method {@link #handleAuthentication(HttpServletRequest, byte[])}
+     * @return
+     */
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        return implementation.handleAuthentication(request, authData);
+    }
+
     /**
      * {@inheritDoc}
      *
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 255e5cf8ae4..9dd27603a38 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -20,9 +20,14 @@
 
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
 import javax.net.ssl.X509KeyManager;
 import javax.net.ssl.X509TrustManager;
 import javax.security.auth.x500.X500Principal;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.X509Exception;
@@ -53,6 +58,7 @@
  */
 public class X509AuthenticationProvider implements AuthenticationProvider {
 
+    public static final String X509_CERTIFICATE_ATTRIBUTE_NAME = "javax.servlet.request.X509Certificate";
     static final String ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER = "zookeeper.X509AuthenticationProvider.superUser";
     private static final Logger LOG = LoggerFactory.getLogger(X509AuthenticationProvider.class);
     private final X509TrustManager trustManager;
@@ -143,39 +149,25 @@ public String getScheme() {
     public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
         X509Certificate[] certChain = (X509Certificate[]) cnxn.getClientCertificateChain();
 
-        if (certChain == null || certChain.length == 0) {
+        final Collection<Id> ids = handleAuthentication(certChain);
+        if (ids.isEmpty()) {
+            LOG.error("Failed to authenticate session 0x{}", Long.toHexString(cnxn.getSessionId()));
             return KeeperException.Code.AUTHFAILED;
         }
 
-        if (trustManager == null) {
-            LOG.error("No trust manager available to authenticate session 0x{}", Long.toHexString(cnxn.getSessionId()));
-            return KeeperException.Code.AUTHFAILED;
+        for (Id id : ids) {
+            cnxn.addAuthInfo(id);
         }
-
-        X509Certificate clientCert = certChain[0];
-
-        try {
-            // Authenticate client certificate
-            trustManager.checkClientTrusted(certChain, clientCert.getPublicKey().getAlgorithm());
-        } catch (CertificateException ce) {
-            LOG.error("Failed to trust certificate for session 0x{}", Long.toHexString(cnxn.getSessionId()), ce);
-            return KeeperException.Code.AUTHFAILED;
-        }
-
-        String clientId = getClientId(clientCert);
-
-        if (clientId.equals(System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER))) {
-            cnxn.addAuthInfo(new Id("super", clientId));
-            LOG.info("Authenticated Id '{}' as super user", clientId);
-        }
-
-        Id authInfo = new Id(getScheme(), clientId);
-        cnxn.addAuthInfo(authInfo);
-
-        LOG.info("Authenticated Id '{}' for Scheme '{}'", authInfo.getId(), authInfo.getScheme());
         return KeeperException.Code.OK;
     }
 
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        final X509Certificate[] certChain =
+                (X509Certificate[]) request.getAttribute(X509_CERTIFICATE_ATTRIBUTE_NAME);
+        return handleAuthentication(certChain);
+    }
+
     /**
      * Determine the string to be used as the remote host session Id for
      * authorization purposes. Associate this client identifier with a
@@ -242,4 +234,36 @@ public X509KeyManager getKeyManager() throws KeyManagerException {
         return keyManager;
     }
 
+    private List<Id> handleAuthentication(final X509Certificate[] certChain) {
+        final List<Id> ids = new ArrayList<>();
+        if (certChain == null || certChain.length == 0) {
+            LOG.warn("No certificate chain available to authenticate");
+            return ids;
+        }
+
+        if (trustManager == null) {
+            LOG.error("No trust manager available to authenticate");
+            return ids;
+        }
+
+        final X509Certificate clientCert = certChain[0];
+        try {
+            // Authenticate client certificate
+            trustManager.checkClientTrusted(certChain, clientCert.getPublicKey().getAlgorithm());
+        } catch (CertificateException ce) {
+            LOG.error("Failed to trust certificate", ce);
+            return ids;
+        }
+
+        final String clientId = getClientId(clientCert);
+        if (clientId.equals(System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER))) {
+            ids.add(new Id("super", clientId));
+            LOG.info("Authenticated Id '{}' as super user", clientId);
+        }
+
+        final Id id = new Id(getScheme(), clientId);
+        ids.add(id);
+        LOG.info("Authenticated Id '{}' for scheme '{}'", id.getId(), id.getScheme());
+        return Collections.unmodifiableList(ids);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
new file mode 100644
index 00000000000..a6f200a1024
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
@@ -0,0 +1,410 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import static org.apache.zookeeper.ZooDefs.Ids.OPEN_ACL_UNSAFE;
+import static org.apache.zookeeper.server.admin.Commands.AUTH_INFO_SEPARATOR;
+import static org.apache.zookeeper.server.admin.Commands.ROOT_PATH;
+import static org.apache.zookeeper.server.admin.JettyAdminServerTest.HTTPS_URL_FORMAT;
+import static org.junit.Assert.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.X509KeyManager;
+import javax.net.ssl.X509TrustManager;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.X509Exception;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.NettyServerCnxnFactory;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
+import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
+import org.apache.zookeeper.test.ClientBase;
+import org.eclipse.jetty.http.HttpHeader;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+public class CommandAuthTest extends ZKTestCase {
+    private static final String DIGEST_SCHEMA = "digest";
+    private static final String X509_SCHEMA = "x509";
+    private static final String IP_SCHEMA = "ip";
+    private static final String ROOT_USER = "root";
+    private static final String ROOT_PASSWORD = "root_passwd";
+    private static final String AUTH_TEST_COMMAND_NAME = "authtest";
+    private static final String X509_SUBJECT_PRINCIPAL = "CN=localhost,OU=ZooKeeper,O=Apache,L=Unknown,ST=Unknown,C=Unknown";
+
+    public enum AuthSchema {
+        DIGEST,
+        X509,
+        IP
+    }
+
+    private final int jettyAdminPort = PortAssignment.unique();
+    private final String hostPort = "127.0.0.1:" + PortAssignment.unique();
+    private final ClientX509Util clientX509Util = new ClientX509Util();
+    private final QuorumX509Util quorumX509Util = new QuorumX509Util();
+    private ZooKeeperServer zks;
+    private ServerCnxnFactory cnxnFactory;
+    private JettyAdminServer adminServer;
+    private ZooKeeper zk;
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @BeforeAll
+    public void setup() throws Exception {
+        Commands.registerCommand(new AuthTestCommand(true, ZooDefs.Perms.ALL, ROOT_PATH));
+
+        setupTLS();
+
+        // start ZookeeperServer
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        final int port = Integer.parseInt(hostPort.split(":")[1]);
+        cnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+        cnxnFactory.startup(zks);
+        assertTrue(ClientBase.waitForServerUp(hostPort, 120000));
+
+        // start AdminServer
+        System.setProperty("zookeeper.admin.enableServer", "true");
+        System.setProperty("zookeeper.admin.serverPort", String.valueOf(jettyAdminPort));
+        adminServer = new JettyAdminServer();
+        adminServer.setZooKeeperServer(zks);
+        adminServer.start();
+    }
+
+    @AfterAll
+    public void tearDown() throws Exception {
+        clearTLS();
+
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.admin.serverPort");
+
+        if (adminServer != null) {
+            adminServer.shutdown();
+        }
+
+        if (cnxnFactory != null) {
+            cnxnFactory.shutdown();
+        }
+
+        if (zks != null) {
+            zks.shutdown();
+        }
+    }
+
+    @BeforeEach
+    public void setupEach() throws Exception {
+        zk = ClientBase.createZKClient(hostPort);
+    }
+
+    @AfterEach
+    public void tearDownEach() throws Exception {
+        if (zk != null) {
+            zk.close();
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(AuthSchema.class)
+    public void testAuthCheck_authorized(final AuthSchema authSchema) throws Exception {
+        setupRootACL(authSchema);
+        try {
+            final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, true);
+            assertEquals(HttpURLConnection.HTTP_OK, authTestConn.getResponseCode());
+        } finally {
+            addAuthInfo(zk, authSchema);
+            resetRootACL(zk);
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(value = AuthSchema.class, names = {"DIGEST"})
+    public void testAuthCheck_notAuthorized(final AuthSchema authSchema) throws Exception {
+        setupRootACL(authSchema);
+        try {
+            final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, false);
+            assertEquals(HttpURLConnection.HTTP_FORBIDDEN, authTestConn.getResponseCode());
+        } finally {
+            addAuthInfo(zk, authSchema);
+            resetRootACL(zk);
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(AuthSchema.class)
+    public void testAuthCheck_noACL(final AuthSchema authSchema) throws Exception {
+        final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, false);
+        assertEquals(HttpURLConnection.HTTP_OK, authTestConn.getResponseCode());
+    }
+
+    @Test
+    public void testAuthCheck_invalidServerRequiredConfig() {
+        assertThrows("An active server is required for auth check",
+        IllegalArgumentException.class,
+        () -> new AuthTestCommand(false, ZooDefs.Perms.ALL, ROOT_PATH));
+    }
+
+    @Test
+    public void testAuthCheck_noAuthInfo() {
+        testAuthCheck_invalidAuthInfo(null);
+    }
+
+    @Test
+    public void testAuthCheck_noAuthInfoSeparator() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", DIGEST_SCHEMA, "", ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    @Test
+    public void testAuthCheck_invalidAuthInfoSeparator() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", DIGEST_SCHEMA, ":", ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    @Test
+    public void testAuthCheck_invalidAuthSchema() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", "InvalidAuthSchema", AUTH_INFO_SEPARATOR, ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    @Test
+    public void testAuthCheck_authProviderNotFound() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", "sasl", AUTH_INFO_SEPARATOR, ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    private void testAuthCheck_invalidAuthInfo(final String invalidAuthInfo) {
+        final CommandResponse commandResponse = Commands.runGetCommand(AUTH_TEST_COMMAND_NAME, zks, new HashMap<>(), invalidAuthInfo, null);
+        assertEquals(HttpServletResponse.SC_UNAUTHORIZED, commandResponse.getStatusCode());
+    }
+
+    private static class AuthTestCommand extends GetCommand {
+        public AuthTestCommand(final boolean serverRequired, final int perm, final String path) {
+            super(Arrays.asList(AUTH_TEST_COMMAND_NAME, "at"), serverRequired, new AuthRequest(perm, path));
+        }
+
+        @Override
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+            return initializeResponse();
+        }
+    }
+
+    private void setupTLS() throws Exception {
+        System.setProperty("zookeeper.authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+
+        System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty(clientX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        System.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
+
+        // client
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
+        System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
+
+        // server
+        System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
+
+        // admin server
+        System.setProperty(quorumX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(quorumX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty(quorumX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        System.setProperty(quorumX509Util.getSslTruststorePasswdProperty(), "testpass");
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.admin.needClientAuth", "true");
+
+        // create SSLContext
+        final SSLContext sslContext = SSLContext.getInstance(ClientX509Util.DEFAULT_PROTOCOL);
+        final X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider("x509");
+        if (authProvider == null) {
+            throw new X509Exception.SSLContextException("Could not create SSLContext with x509 auth provider");
+        }
+        sslContext.init(new X509KeyManager[]{authProvider.getKeyManager()}, new X509TrustManager[]{authProvider.getTrustManager()}, null);
+
+        // set SSLSocketFactory
+        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
+    }
+
+    public void clearTLS() {
+        System.clearProperty("zookeeper.authProvider.x509");
+
+        System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+
+        // client side
+        System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        System.clearProperty(ZKClientConfig.SECURE_CLIENT);
+
+        // server side
+        System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
+        System.clearProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY);
+
+        // admin server
+        System.clearProperty(quorumX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(quorumX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty("zookeeper.admin.forceHttps");
+        System.clearProperty("zookeeper.admin.needClientAuth");
+    }
+
+    private void setupRootACL(final AuthSchema authSchema) throws Exception {
+        switch (authSchema) {
+            case DIGEST:
+                setupRootACLForDigest(zk);
+                break;
+            case X509:
+                setupRootACLForX509(zk);
+                break;
+            case IP:
+                setupRootACLForIP(zk);
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown auth schema");
+        }
+    }
+
+    private HttpURLConnection sendAuthTestCommandRequest(final AuthSchema authSchema, final boolean validAuthInfo) throws Exception  {
+        final URL authTestURL = new URL(String.format(HTTPS_URL_FORMAT + "/" + AUTH_TEST_COMMAND_NAME, jettyAdminPort));
+        final HttpURLConnection authTestConn = (HttpURLConnection) authTestURL.openConnection();
+        addAuthHeader(authTestConn, authSchema, validAuthInfo);
+        authTestConn.setRequestMethod("GET");
+        return authTestConn;
+    }
+
+    private void addAuthInfo(final ZooKeeper zk, final AuthSchema authSchema) {
+        switch (authSchema) {
+            case DIGEST:
+                addAuthInfoForDigest(zk);
+                break;
+            case X509:
+                addAuthInfoForX509(zk);
+                break;
+            case IP:
+                addAuthInfoForIP(zk);
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown auth schema");
+        }
+    }
+
+    public static void resetRootACL(final ZooKeeper zk) throws Exception {
+        zk.setACL(Commands.ROOT_PATH, OPEN_ACL_UNSAFE, -1);
+    }
+
+    public static void setupRootACLForDigest(final ZooKeeper zk) throws Exception  {
+        final String idPassword = String.format("%s:%s", ROOT_USER, ROOT_PASSWORD);
+        final String digest = DigestAuthenticationProvider.generateDigest(idPassword);
+
+        final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(DIGEST_SCHEMA, digest));
+        zk.setACL(Commands.ROOT_PATH, Collections.singletonList(acl), -1);
+    }
+
+    private static void setupRootACLForX509(final ZooKeeper zk) throws Exception  {
+        final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(X509_SCHEMA, X509_SUBJECT_PRINCIPAL));
+        zk.setACL(Commands.ROOT_PATH, Collections.singletonList(acl), -1);
+    }
+
+    private static void setupRootACLForIP(final ZooKeeper zk) throws Exception  {
+        final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(IP_SCHEMA, "127.0.0.1"));
+        zk.setACL(Commands.ROOT_PATH, Collections.singletonList(acl), -1);
+    }
+
+    public static void addAuthInfoForDigest(final ZooKeeper zk) {
+        final String idPassword = String.format("%s:%s", ROOT_USER, ROOT_PASSWORD);
+        zk.addAuthInfo(DIGEST_SCHEMA, idPassword.getBytes(StandardCharsets.UTF_8));
+    }
+
+    public static void addAuthInfoForX509(final ZooKeeper zk) {
+        zk.addAuthInfo(X509_SCHEMA, X509_SUBJECT_PRINCIPAL.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private void addAuthInfoForIP(final ZooKeeper zk) {
+        zk.addAuthInfo(IP_SCHEMA, "127.0.0.1".getBytes(StandardCharsets.UTF_8));
+    }
+
+    public static void addAuthHeader(final HttpURLConnection conn, final AuthSchema authSchema, final boolean validAuthInfo) {
+        String authInfo;
+        switch (authSchema) {
+            case DIGEST:
+                authInfo = validAuthInfo ? buildAuthorizationForDigest() : buildInvalidAuthorizationForDigest();
+                break;
+            case X509:
+                authInfo = buildAuthorizationForX509();
+                break;
+            case IP:
+                authInfo = buildAuthorizationForIP();
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown auth schema");
+        }
+        conn.setRequestProperty(HttpHeader.AUTHORIZATION.asString(), authInfo);
+    }
+
+    public static String buildAuthorizationForDigest() {
+        return  String.format("%s%s%s:%s", DIGEST_SCHEMA, Commands.AUTH_INFO_SEPARATOR, ROOT_USER, ROOT_PASSWORD);
+    }
+
+    private static String buildInvalidAuthorizationForDigest() {
+        return  String.format("%s%s%s:%s", DIGEST_SCHEMA, Commands.AUTH_INFO_SEPARATOR, "InvalidUser", "InvalidPassword");
+    }
+
+    private static String buildAuthorizationForX509() {
+        return  String.format("%s%s", X509_SCHEMA, Commands.AUTH_INFO_SEPARATOR);
+    }
+
+    private static String buildAuthorizationForIP() {
+        return  String.format("%s%s", IP_SCHEMA, Commands.AUTH_INFO_SEPARATOR);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index 85c4a78e9fc..93c318787a1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -61,6 +61,8 @@ public class CommandsTest extends ClientBase {
      *            - keyword arguments to the command
      * @param inputStream
      *            - InputStream to the command
+     * @param authInfo
+     *            - authInfo for the command
      * @param expectedHeaders
      *            - expected HTTP response headers
      * @param expectedStatusCode
@@ -71,11 +73,12 @@ public class CommandsTest extends ClientBase {
      * @throws InterruptedException
      */
     private void testCommand(String cmdName, Map<String, String> kwargs, InputStream inputStream,
+                             String authInfo,
                              Map<String, String> expectedHeaders, int expectedStatusCode,
                              Field... fields) throws IOException, InterruptedException {
         ZooKeeperServer zks = serverFactory.getZooKeeperServer();
         final CommandResponse commandResponse = inputStream == null
-        ? Commands.runGetCommand(cmdName, zks, kwargs) : Commands.runPostCommand(cmdName, zks, inputStream);
+        ? Commands.runGetCommand(cmdName, zks, kwargs, authInfo, null) : Commands.runPostCommand(cmdName, zks, inputStream, authInfo, null);
         assertNotNull(commandResponse);
         assertEquals(expectedStatusCode, commandResponse.getStatusCode());
         try (final InputStream responseStream = commandResponse.getInputStream()) {
@@ -107,7 +110,7 @@ private void testCommand(String cmdName, Map<String, String> kwargs, InputStream
     }
 
     public void testCommand(String cmdName, Field... fields) throws IOException, InterruptedException {
-        testCommand(cmdName, new HashMap<>(), null, new HashMap<>(), HttpServletResponse.SC_OK, fields);
+        testCommand(cmdName, new HashMap<>(), null, null, new HashMap<>(), HttpServletResponse.SC_OK, fields);
     }
 
     private static class Field {
@@ -232,7 +235,8 @@ public void testRestore_invalidInputStream() throws IOException, InterruptedExce
         try (final InputStream inputStream = new ByteArrayInputStream("Invalid snapshot data".getBytes())){
             final Map<String, String> kwargs = new HashMap<>();
             final Map<String, String> expectedHeaders = new HashMap<>();
-            testCommand("restore", kwargs, inputStream, expectedHeaders, HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+            final String authInfo = CommandAuthTest.buildAuthorizationForDigest();
+            testCommand("restore", kwargs, inputStream, authInfo, expectedHeaders, HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
         } finally {
             clearForRestoreCommand();
         }
@@ -243,7 +247,9 @@ public void testRestore_nullInputStream() {
         setupForRestoreCommand();
         final ZooKeeperServer zks = serverFactory.getZooKeeperServer();
         try {
-            final CommandResponse commandResponse = Commands.runPostCommand("restore", zks, null);
+
+            final String authInfo = CommandAuthTest.buildAuthorizationForDigest();
+            final CommandResponse commandResponse = Commands.runPostCommand("restore", zks, null, authInfo, null);
             assertNotNull(commandResponse);
             assertEquals(HttpServletResponse.SC_BAD_REQUEST, commandResponse.getStatusCode());
         } finally {
@@ -273,7 +279,7 @@ public void testServerStats() throws IOException, InterruptedException {
     public void testSetTraceMask() throws IOException, InterruptedException {
         Map<String, String> kwargs = new HashMap<>();
         kwargs.put("traceMask", "1");
-        testCommand("set_trace_mask", kwargs, null, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
+        testCommand("set_trace_mask", kwargs, null, null, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
     }
 
     @Test
@@ -360,10 +366,11 @@ private void testSnapshot(final boolean streaming) throws IOException, Interrupt
         try {
             final Map<String, String> kwargs = new HashMap<>();
             kwargs.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
+            final String autInfo = CommandAuthTest.buildAuthorizationForDigest();
             final Map<String, String> expectedHeaders = new HashMap<>();
             expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID, "0x0");
             expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE, "478");
-            testCommand("snapshot", kwargs, null, expectedHeaders, HttpServletResponse.SC_OK);
+            testCommand("snapshot", kwargs, null, autInfo, expectedHeaders, HttpServletResponse.SC_OK);
         } finally {
             System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
             System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
new file mode 100644
index 00000000000..38ca7f89766
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.admin;
+
+import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
+import static org.apache.zookeeper.server.admin.SnapshotAndRestoreCommandTest.performRestoreAndValidate;
+import static org.apache.zookeeper.server.admin.SnapshotAndRestoreCommandTest.takeSnapshotAndValidate;
+import java.io.File;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class RestoreQuorumTest extends QuorumPeerTestBase {
+    @Test
+    public void testRestoreAfterQuorumLost() throws Exception {
+        setupAdminServerProperties();
+
+        int SERVER_COUNT = 3;
+        final int NODE_COUNT = 10;
+        final String PATH = "/testRestoreAfterQuorumLost";
+
+        try {
+            // start up servers
+            servers = LaunchServers(SERVER_COUNT);
+            int leaderId = servers.findLeader();
+
+            // create data
+            servers.zk[leaderId].create(PATH, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // take snapshot
+            final File snapshotFile = takeSnapshotAndValidate(servers.adminPorts[leaderId], ClientBase.testBaseDir);
+
+            // create more data
+            for (int i = NODE_COUNT; i < NODE_COUNT * 2; i++) {
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // shutdown all servers to simulate quorum lost
+            servers.shutDownAllServers();
+            waitForAll(servers, ZooKeeper.States.CONNECTING);
+
+            // restart the servers
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                System.setProperty("zookeeper.admin.serverPort", String.valueOf(servers.adminPorts[i]));
+                servers.mt[i].start();
+                servers.restartClient(i, this);
+            }
+            waitForAll(servers, ZooKeeper.States.CONNECTED);
+
+            // restore servers
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                performRestoreAndValidate(servers.adminPorts[i], snapshotFile);
+            }
+
+            // validate all servers are restored
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                servers.restartClient(i, this);
+                Assertions.assertEquals(NODE_COUNT, servers.zk[i].getAllChildrenNumber(PATH));
+            }
+
+            // create more data after restore
+            for (int i = NODE_COUNT * 2; i < NODE_COUNT * 3; i++) {
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL);
+            }
+
+            // validate all servers have expected data
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                Assertions.assertEquals(NODE_COUNT * 2, servers.zk[i].getAllChildrenNumber(PATH));
+            }
+        } finally {
+            clearAdminServerProperties();
+        }
+    }
+
+    private void setupAdminServerProperties() {
+        System.setProperty("zookeeper.admin.enableServer", "true");
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+        System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+    }
+
+    private void clearAdminServerProperties() {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.admin.serverPort");
+        System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
+        System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
+        System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+        System.clearProperty(ADMIN_RESTORE_ENABLED);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
index f7d357e7227..a2f31fe866a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
@@ -19,6 +19,9 @@
 package org.apache.zookeeper.server.admin;
 
 import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.addAuthInfoForDigest;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.resetRootACL;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.setupRootACLForDigest;
 import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
 import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
@@ -101,7 +104,8 @@ public void setup() throws Exception {
 
         // start AdminServer
         System.setProperty("zookeeper.admin.enableServer", "true");
-        System.setProperty("zookeeper.admin.serverPort", "" + jettyAdminPort);
+        System.setProperty("zookeeper.admin.serverPort", String.valueOf(jettyAdminPort));
+
         System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
         System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
         System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
@@ -111,8 +115,16 @@ public void setup() throws Exception {
         adminServer.setZooKeeperServer(zks);
         adminServer.start();
 
-        // create Zookeeper client and test data
+        // create Zookeeper client
         zk = ClientBase.createZKClient(hostPort);
+
+        // setup root ACL
+        setupRootACLForDigest(zk);
+
+        // add auth
+        addAuthInfoForDigest(zk);
+
+        // create test data
         createData(zk, SNAPSHOT_TEST_PATH, NODE_COUNT);
     }
 
@@ -126,6 +138,8 @@ public void tearDown() throws Exception {
         System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
         System.clearProperty(ADMIN_RESTORE_ENABLED);
 
+        resetRootACL(zk);
+
         if (zk != null) {
             zk.close();
         }
@@ -148,16 +162,17 @@ public void testSnapshotAndRestoreCommand_streaming() throws Exception {
         ServerMetrics.getMetrics().resetAll();
 
         // take snapshot with streaming and validate
-        final File snapshotFile = takeSnapshotAndValidate();
+        final File snapshotFile = takeSnapshotAndValidate(jettyAdminPort, dataDir);
 
         // validate snapshot metrics
         validateSnapshotMetrics();
 
         // restore from snapshot and validate
-        performRestoreAndValidate(snapshotFile);
+        performRestoreAndValidate(jettyAdminPort, snapshotFile);
 
         // validate creating data after restore
         try (final ZooKeeper zk = ClientBase.createZKClient(hostPort)) {
+            addAuthInfoForDigest(zk);
             createData(zk, SNAPSHOT_TEST_PATH, NODE_COUNT + 1);
             assertEquals(NODE_COUNT + NODE_COUNT + 1, zk.getAllChildrenNumber(SNAPSHOT_TEST_PATH));
         }
@@ -173,7 +188,7 @@ public void testClientRequest_restoreInProgress() throws Exception {
         final String restoreTestPath = "/restore_test";
 
         // take snapshot
-        final File snapshotFile = takeSnapshotAndValidate();
+        final File snapshotFile = takeSnapshotAndValidate(jettyAdminPort, dataDir);
 
         final ExecutorService service = Executors.newFixedThreadPool(threadCount);
         final CountDownLatch latch = new CountDownLatch(threadCount);
@@ -196,7 +211,7 @@ public void testClientRequest_restoreInProgress() throws Exception {
         // thread 2 performs restore operation
         service.submit(() -> {
             try {
-                performRestoreAndValidate(snapshotFile);
+                performRestoreAndValidate(jettyAdminPort, snapshotFile);
                 restoreSucceeded.set(true);
             } catch (final Exception e) {
                 LOG.error(e.getMessage());
@@ -218,18 +233,18 @@ public void testClientRequest_restoreInProgress() throws Exception {
     @Test
     public void testRestores() throws Exception {
         // take snapshot
-        final File snapshotFile = takeSnapshotAndValidate();
+        final File snapshotFile = takeSnapshotAndValidate(jettyAdminPort, dataDir);
 
         // perform restores
         for (int i = 0; i < 3; i++) {
-            performRestoreAndValidate(snapshotFile);
+            performRestoreAndValidate(jettyAdminPort, snapshotFile);
         }
     }
 
     @Test
     public void testSnapshotCommand_nonStreaming() throws Exception {
         // take snapshot without streaming
-        final HttpURLConnection snapshotConn = sendSnapshotRequest(false);
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(false, jettyAdminPort);
 
         // validate snapshot response
         assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
@@ -242,7 +257,7 @@ public void testSnapshotCommand_disabled() throws Exception {
         System.setProperty(ADMIN_SNAPSHOT_ENABLED, "false");
         try {
             // take snapshot
-            final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+            final HttpURLConnection snapshotConn = sendSnapshotRequest(true, jettyAdminPort);
 
             // validate snapshot response
             assertEquals(HttpServletResponse.SC_SERVICE_UNAVAILABLE, snapshotConn.getResponseCode());
@@ -256,7 +271,7 @@ public void testSnapshotCommand_serializeLastZxidDisabled() throws Exception {
         ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
         try {
             // take snapshot
-            final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+            final HttpURLConnection snapshotConn = sendSnapshotRequest(true, jettyAdminPort);
 
             // validate snapshot response
             assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, snapshotConn.getResponseCode());
@@ -269,7 +284,7 @@ public void testSnapshotCommand_serializeLastZxidDisabled() throws Exception {
     public void testRestoreCommand_disabled() throws Exception {
         System.setProperty(ADMIN_RESTORE_ENABLED, "false");
         try {
-            final HttpURLConnection restoreConn = sendRestoreRequest();
+            final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
             assertEquals(HttpServletResponse.SC_SERVICE_UNAVAILABLE, restoreConn.getResponseCode());
         } finally {
             System.setProperty(ADMIN_RESTORE_ENABLED, "true");
@@ -280,7 +295,7 @@ public void testRestoreCommand_disabled() throws Exception {
     public void testRestoreCommand_serializeLastZxidDisabled() throws Exception {
         ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
         try {
-            final HttpURLConnection restoreConn = sendRestoreRequest();
+            final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
             assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, restoreConn.getResponseCode());
         } finally {
             ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
@@ -289,7 +304,7 @@ public void testRestoreCommand_serializeLastZxidDisabled() throws Exception {
 
     @Test
     public void testRestoreCommand_invalidSnapshotData() throws Exception {
-        final HttpURLConnection restoreConn = sendRestoreRequest();
+        final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
         try (final InputStream inputStream = new ByteArrayInputStream("Invalid snapshot data".getBytes());
              final OutputStream outputStream = restoreConn.getOutputStream()) {
             IOUtils.copyBytes(inputStream, outputStream, 1024, true);
@@ -309,25 +324,27 @@ private void createData(final ZooKeeper zk, final String parentPath, final long
         }
     }
 
-    private HttpURLConnection sendSnapshotRequest(final boolean streaming) throws Exception  {
+    private static HttpURLConnection sendSnapshotRequest(final boolean streaming, final int jettyAdminPort) throws Exception  {
         final String queryParamsStr = buildQueryStringForSnapshotCommand(streaming);
         final URL snapshotURL = new URL(String.format(URL_FORMAT + "/snapshot", jettyAdminPort) + "?" + queryParamsStr);
         final HttpURLConnection snapshotConn = (HttpURLConnection) snapshotURL.openConnection();
+        CommandAuthTest.addAuthHeader(snapshotConn, CommandAuthTest.AuthSchema.DIGEST, true);
         snapshotConn.setRequestMethod("GET");
 
         return snapshotConn;
     }
 
-    private HttpURLConnection sendRestoreRequest() throws Exception  {
+    private static HttpURLConnection sendRestoreRequest(final int jettyAdminPort) throws Exception  {
         final URL restoreURL = new URL(String.format(URL_FORMAT + "/restore", jettyAdminPort));
         final HttpURLConnection restoreConn = (HttpURLConnection) restoreURL.openConnection();
         restoreConn.setDoOutput(true);
+        CommandAuthTest.addAuthHeader(restoreConn, CommandAuthTest.AuthSchema.DIGEST, true);
         restoreConn.setRequestMethod("POST");
 
         return restoreConn;
     }
 
-    private String buildQueryStringForSnapshotCommand(final boolean streaming) throws Exception {
+    private static String buildQueryStringForSnapshotCommand(final boolean streaming) throws Exception {
         final Map<String, String> parameters = new HashMap<>();
         parameters.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
         return getParamsString(parameters);
@@ -350,7 +367,7 @@ private static String getParamsString(final Map<String, String> params) throws U
                 : resultString;
     }
 
-    private void validateResponseHeaders(final HttpURLConnection conn) {
+    private static void validateResponseHeaders(final HttpURLConnection conn) {
         LOG.info("Header:{}, Value:{}",
                 Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID,
                 conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID));
@@ -363,7 +380,7 @@ private void validateResponseHeaders(final HttpURLConnection conn) {
         assertTrue(Integer.parseInt(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE)) > 0);
     }
 
-    private void displayResponsePayload(final HttpURLConnection conn) throws IOException {
+    private static void displayResponsePayload(final HttpURLConnection conn) throws IOException {
         final StringBuilder sb = new StringBuilder();
         try (final BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
             String inputLine;
@@ -388,9 +405,9 @@ private void validateRestoreMetrics() {
         assertTrue((Double) metrics.get("avg_restore_time") > 0.0);
     }
 
-    private File takeSnapshotAndValidate() throws Exception {
+    public static  File takeSnapshotAndValidate(final int jettyAdminPort, final File dataDir) throws Exception {
         // take snapshot with streaming
-        final HttpURLConnection snapshotConn = sendSnapshotRequest(true);
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(true, jettyAdminPort);
 
         // validate snapshot response
         assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
@@ -405,9 +422,9 @@ private File takeSnapshotAndValidate() throws Exception {
         return snapshotFile;
     }
 
-    private void performRestoreAndValidate(final File snapshotFile) throws Exception {
+    public static void performRestoreAndValidate(final int jettyAdminPort, final File snapshotFile) throws Exception {
         // perform restore
-        final HttpURLConnection restoreConn = sendRestoreRequest();
+        final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
         try (final CheckedInputStream is = SnapStream.getInputStream(snapshotFile);
              final OutputStream outputStream = restoreConn.getOutputStream()) {
             IOUtils.copyBytes(is, outputStream, 1024, true);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index 8249cd2223a..2a7b692589f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -402,11 +402,12 @@ public File getConfFile() {
     }
 
     // This class holds the servers and clients for those servers
-    protected static class Servers {
+    public static class Servers {
 
-        MainThread[] mt;
-        ZooKeeper[] zk;
+        public MainThread[] mt;
+        public ZooKeeper[] zk;
         public int[] clientPorts;
+        public int[] adminPorts;
 
         public void shutDownAllServers() throws InterruptedException {
             for (MainThread t : mt) {
@@ -415,9 +416,12 @@ public void shutDownAllServers() throws InterruptedException {
         }
 
         public void restartAllServersAndClients(Watcher watcher) throws IOException, InterruptedException {
+            int index = 0;
             for (MainThread t : mt) {
                 if (!t.isAlive()) {
+                    System.setProperty("zookeeper.admin.serverPort", String.valueOf(adminPorts[index]));
                     t.start();
+                    index++;
                 }
             }
             for (int i = 0; i < zk.length; i++) {
@@ -510,6 +514,12 @@ protected Servers LaunchServers(int numServers, int numObservers, Integer tickTi
                     i, PortAssignment.unique(), PortAssignment.unique(), role,
                     svrs.clientPorts[i]));
         }
+
+        svrs.adminPorts = new int[SERVER_COUNT];
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            svrs.adminPorts[i] = PortAssignment.unique();
+        }
+
         String quorumCfgSection = sb.toString();
 
         svrs.mt = new MainThread[SERVER_COUNT];
@@ -520,6 +530,7 @@ protected Servers LaunchServers(int numServers, int numObservers, Integer tickTi
             } else {
                 svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, otherConfigs);
             }
+            System.setProperty("zookeeper.admin.serverPort", String.valueOf(svrs.adminPorts[i]));
             svrs.mt[i].start();
             svrs.restartClient(i, this);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
new file mode 100644
index 00000000000..45ce447fe30
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import java.util.Arrays;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+public class IPAuthTest extends ZKTestCase {
+    @Test
+    public void testHandleAuthentication_Forwarded() {
+        final IPAuthenticationProvider provider = new IPAuthenticationProvider();
+
+        final HttpServletRequest mockRequest = mock(HttpServletRequest.class);
+        final String forwardedForHeader = "fc00:0:0:0:0:0:0:4, 192.168.0.6, 10.0.0.8, 172.16.0.9";
+        Mockito.doReturn(forwardedForHeader).when(mockRequest).getHeader(IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME);
+        Mockito.doReturn("192.168.0.5").when(mockRequest).getRemoteAddr();
+
+        // validate it returns the leftmost IP from the X-Forwarded-For header
+        final List<Id> expectedIds = Arrays.asList(new Id(provider.getScheme(), "fc00:0:0:0:0:0:0:4"));
+        assertEquals(expectedIds, provider.handleAuthentication(mockRequest, null));
+    }
+
+    @Test
+    public void testHandleAuthentication_NoForwarded() {
+        final IPAuthenticationProvider provider = new IPAuthenticationProvider();
+
+        final HttpServletRequest mockRequest = mock(HttpServletRequest.class);
+        Mockito.doReturn(null).when(mockRequest).getHeader(IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME);
+        Mockito.doReturn("192.168.0.6").when(mockRequest).getRemoteAddr();
+
+        // validate it returns the remote address
+        final List<Id> expectedIds = Arrays.asList(new Id(provider.getScheme(), "192.168.0.6"));
+        assertEquals(expectedIds, provider.handleAuthentication(mockRequest, null));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index edde2b5dac5..f6ad52ce5db 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -293,7 +293,7 @@ public void testAdminCommands(boolean testObserverMaster) throws IOException, MB
 
         // test stats collection
         final Map<String, String> emptyMap = Collections.emptyMap();
-        Map<String, Object> stats = Commands.runGetCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap).toMap();
+        Map<String, Object> stats = Commands.runGetCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap, null, null).toMap();
         assertTrue(stats.containsKey("observer_master_id"), "observer not emitting observer_master_id");
 
         // check the stats for the first peer
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
index bb04a9fdd66..65925ec8968 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
@@ -19,6 +19,8 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
 import java.math.BigInteger;
 import java.net.Socket;
 import java.security.InvalidKeyException;
@@ -35,16 +37,20 @@
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.List;
 import java.util.Set;
 import javax.net.ssl.X509KeyManager;
 import javax.net.ssl.X509TrustManager;
 import javax.security.auth.x500.X500Principal;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.MockServerCnxn;
 import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
 
 public class X509AuthTest extends ZKTestCase {
 
@@ -69,6 +75,8 @@ public void testTrustedAuth() {
         MockServerCnxn cnxn = new MockServerCnxn();
         cnxn.clientChain = new X509Certificate[]{clientCert};
         assertEquals(KeeperException.Code.OK, provider.handleAuthentication(cnxn, null));
+        final List<Id> ids = Arrays.asList(new Id("x509", "CN=CLIENT"));
+        assertEquals(ids, cnxn.getAuthInfo());
     }
 
     @Test
@@ -77,7 +85,8 @@ public void testSuperAuth() {
         MockServerCnxn cnxn = new MockServerCnxn();
         cnxn.clientChain = new X509Certificate[]{superCert};
         assertEquals(KeeperException.Code.OK, provider.handleAuthentication(cnxn, null));
-        assertEquals("super", cnxn.getAuthInfo().get(0).getScheme());
+        final List<Id> ids = Arrays.asList(new Id("super", "CN=SUPER"), new Id("x509", "CN=SUPER"));
+        assertEquals(ids, cnxn.getAuthInfo());
     }
 
     @Test
@@ -88,6 +97,32 @@ public void testUntrustedAuth() {
         assertEquals(KeeperException.Code.AUTHFAILED, provider.handleAuthentication(cnxn, null));
     }
 
+    @Test
+    public void testTrustedAuth_HttpServletRequest() {
+        final X509AuthenticationProvider provider = createProvider(clientCert);
+        final HttpServletRequest mockRequest =  mock(HttpServletRequest.class);
+        Mockito.doReturn(new X509Certificate[]{clientCert}).when(mockRequest).getAttribute(X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME);
+        final List<Id> ids = Arrays.asList(new Id("x509", "CN=CLIENT"));
+        assertEquals(ids, provider.handleAuthentication(mockRequest, null));
+    }
+
+    @Test
+    public void testSuperAuth_HttpServletRequest() {
+        final X509AuthenticationProvider provider = createProvider(superCert);
+        final HttpServletRequest mockRequest =  mock(HttpServletRequest.class);
+        Mockito.doReturn(new X509Certificate[]{superCert}).when(mockRequest).getAttribute(X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME);
+        final List<Id> ids = Arrays.asList(new Id("super", "CN=SUPER"), new Id("x509", "CN=SUPER"));
+        assertEquals(ids, provider.handleAuthentication(mockRequest, null));
+    }
+
+    @Test
+    public void testUntrustedAuth_HttpServletRequest() {
+        final X509AuthenticationProvider provider = createProvider(clientCert);
+        final HttpServletRequest mockRequest =  mock(HttpServletRequest.class);
+        Mockito.doReturn(new X509Certificate[]{unknownCert}).when(mockRequest).getAttribute(X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME);
+        assertTrue(provider.handleAuthentication(mockRequest, null).isEmpty());
+    }
+
     private static class TestPublicKey implements PublicKey {
 
         private static final long serialVersionUID = 1L;

From ee8014adc748901b642e66c5734082d50b077a84 Mon Sep 17 00:00:00 2001
From: "henk.wiedig@t-systems.com" <henk.wiedig@t-systems.com>
Date: Sat, 25 Feb 2023 19:42:40 +0800
Subject: [PATCH 353/591] ZOOKEEPER-4636: Fix zkServer.sh for AIX

AIX "echo" does not support "-n" argument.

Author: henk.wiedig@t-systems.com <henk.wiedig@t-systems.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, maoling <maoling@apache.org>

Closes #1945 from henkwiedig/fix-aix-zkserver
---
 bin/zkServer.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index 977c1bbf8c6..91d335c00ad 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -171,6 +171,9 @@ start)
       *solaris*)
         /bin/echo "${!}\\c" > "$ZOOPIDFILE"
         ;;
+      aix*)
+        /bin/echo "$!\c" > "$ZOOPIDFILE"
+        ;;
       *)
         /bin/echo -n $! > "$ZOOPIDFILE"
         ;;

From a9517d88605ed61fed8f3dfdc2f5a04dfbcee1f8 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Mon, 27 Feb 2023 14:28:59 +0800
Subject: [PATCH 354/591] [ZOOKEEPER-4677] Cleanup code in the DataTree class 
 (#1968)

Signed-off-by: tison <wander4096@gmail.com>
---
 .../org/apache/zookeeper/server/DataTree.java | 273 ++++++++----------
 1 file changed, 122 insertions(+), 151 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index d60528224b4..a6f60539089 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -86,10 +86,9 @@
 
 /**
  * This class maintains the tree data structure. It doesn't have any networking
- * or client connection code in it so that it can be tested in a stand alone
- * way.
- * <p>
- * The tree maintains two parallel data structures: a hashtable that maps from
+ * or client connection code in it so that it can be tested in a standalone way.
+ *
+ * <p>The tree maintains two parallel data structures: a hashtable that maps from
  * full paths to DataNodes and a tree of DataNodes. All accesses to a path is
  * through the hashtable. The tree is traversed only when serializing to disk.
  */
@@ -100,7 +99,7 @@ public class DataTree {
     private final RateLogger RATE_LOGGER = new RateLogger(LOG, 15 * 60 * 1000);
 
     /**
-     * This map provides a fast lookup to the datanodes. The tree is the
+     * This map provides a fast lookup to the data nodes. The tree is the
      * source of truth and is where all the locking occurs
      */
     private final NodeHashMap nodes;
@@ -118,7 +117,7 @@ public class DataTree {
     /** the zookeeper nodes that acts as the management and status node **/
     private static final String procZookeeper = Quotas.procZookeeper;
 
-    /** this will be the string thats stored as a child of root */
+    /** this will be the string that's stored as a child of root */
     private static final String procChildZookeeper = procZookeeper.substring(1);
 
     /**
@@ -127,7 +126,7 @@ public class DataTree {
      */
     private static final String quotaZookeeper = Quotas.quotaZookeeper;
 
-    /** this will be the string thats stored as a child of /zookeeper */
+    /** this will be the string that's stored as a child of /zookeeper */
     private static final String quotaChildZookeeper = quotaZookeeper.substring(procZookeeper.length() + 1);
 
     /**
@@ -136,7 +135,7 @@ public class DataTree {
      */
     private static final String configZookeeper = ZooDefs.CONFIG_NODE;
 
-    /** this will be the string thats stored as a child of /zookeeper */
+    /** this will be the string that's stored as a child of /zookeeper */
     private static final String configChildZookeeper = configZookeeper.substring(procZookeeper.length() + 1);
 
     /**
@@ -145,7 +144,7 @@ public class DataTree {
     private final PathTrie pTrie = new PathTrie();
 
     /**
-     * over-the-wire size of znode's stat. Counting the fields of Stat class
+     * over-the-wire size of znode stat. Counting the fields of Stat class
      */
     public static final int STAT_OVERHEAD_BYTES = (6 * 8) + (5 * 4);
 
@@ -186,21 +185,19 @@ public class DataTree {
     private final List<DigestWatcher> digestWatchers = new ArrayList<>();
 
     // The historical digests list.
-    private LinkedList<ZxidDigest> digestLog = new LinkedList<>();
+    private final LinkedList<ZxidDigest> digestLog = new LinkedList<>();
 
     private final DigestCalculator digestCalculator;
 
     @SuppressWarnings("unchecked")
     public Set<String> getEphemerals(long sessionId) {
-        HashSet<String> retv = ephemerals.get(sessionId);
-        if (retv == null) {
+        HashSet<String> ret = ephemerals.get(sessionId);
+        if (ret == null) {
             return new HashSet<>();
         }
-        Set<String> cloned = null;
-        synchronized (retv) {
-            cloned = (HashSet<String>) retv.clone();
+        synchronized (ret) {
+            return (HashSet<String>) ret.clone();
         }
-        return cloned;
     }
 
     public Set<String> getContainers() {
@@ -287,11 +284,11 @@ public DataTree() {
         this.digestCalculator = digestCalculator;
         nodes = new NodeHashMapImpl(digestCalculator);
 
-        /* Rather than fight it, let root have an alias */
+        // rather than fight it, let root have an alias
         nodes.put("", root);
         nodes.putWithoutDigest(rootZookeeper, root);
 
-        /** add the proc node and quota node */
+        // add the proc node and quota node
         root.addChild(procChildZookeeper);
         nodes.put(procZookeeper, procDataNode);
 
@@ -326,7 +323,7 @@ public void addConfigNode() {
         try {
             // Reconfig node is access controlled by default (ZOOKEEPER-2014).
             setACL(configZookeeper, ZooDefs.Ids.READ_ACL_UNSAFE, -1);
-        } catch (KeeperException.NoNodeException e) {
+        } catch (NoNodeException e) {
             assert false : "There's no " + configZookeeper + " znode - this should never happen.";
         }
     }
@@ -382,21 +379,19 @@ public static void copyStat(Stat from, Stat to) {
      *            the diff to be added to the count
      */
     public void updateQuotaStat(String lastPrefix, long bytesDiff, int countDiff) {
-
         String statNodePath = Quotas.statPath(lastPrefix);
         DataNode statNode = nodes.get(statNodePath);
 
-        StatsTrack updatedStat;
         if (statNode == null) {
             // should not happen
             LOG.error("Missing node for stat {}", statNodePath);
             return;
         }
+
         synchronized (statNode) {
-            updatedStat = new StatsTrack(statNode.data);
+            StatsTrack updatedStat = new StatsTrack(statNode.data);
             updatedStat.setCount(updatedStat.getCount() + countDiff);
             updatedStat.setBytes(updatedStat.getBytes() + bytesDiff);
-
             statNode.data = updatedStat.getStatsBytes();
         }
     }
@@ -441,32 +436,32 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
      * @throws NodeExistsException
      * @throws NoNodeException
      */
-    public void createNode(final String path, byte[] data, List<ACL> acl, long ephemeralOwner, int parentCVersion, long zxid, long time, Stat outputStat) throws KeeperException.NoNodeException, KeeperException.NodeExistsException {
+    public void createNode(final String path, byte[] data, List<ACL> acl, long ephemeralOwner, int parentCVersion, long zxid, long time, Stat outputStat) throws NoNodeException, NodeExistsException {
         int lastSlash = path.lastIndexOf('/');
         String parentName = path.substring(0, lastSlash);
         String childName = path.substring(lastSlash + 1);
         StatPersisted stat = createStat(zxid, time, ephemeralOwner);
         DataNode parent = nodes.get(parentName);
         if (parent == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (parent) {
             // Add the ACL to ACL cache first, to avoid the ACL not being
             // created race condition during fuzzy snapshot sync.
             //
             // This is the simplest fix, which may add ACL reference count
-            // again if it's already counted in in the ACL map of fuzzy
+            // again if it's already counted in the ACL map of fuzzy
             // snapshot, which might also happen for deleteNode txn, but
             // at least it won't cause the ACL not exist issue.
             //
             // Later we can audit and delete all non-referenced ACLs from
             // ACL map when loading the snapshot/txns from disk, like what
             // we did for the global sessions.
-            Long longval = aclCache.convertAcls(acl);
+            Long acls = aclCache.convertAcls(acl);
 
             Set<String> children = parent.getChildren();
             if (children.contains(childName)) {
-                throw new KeeperException.NodeExistsException();
+                throw new NodeExistsException();
             }
 
             nodes.preChange(parentName, parent);
@@ -483,7 +478,7 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
                 parent.stat.setCversion(parentCVersion);
                 parent.stat.setPzxid(zxid);
             }
-            DataNode child = new DataNode(data, longval, stat);
+            DataNode child = new DataNode(data, acls, stat);
             parent.addChild(childName);
             nodes.postChange(parentName, parent);
             nodeDataSize.addAndGet(getNodeSize(path, child.data));
@@ -494,11 +489,7 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
             } else if (ephemeralType == EphemeralType.TTL) {
                 ttls.add(path);
             } else if (ephemeralOwner != 0) {
-                HashSet<String> list = ephemerals.get(ephemeralOwner);
-                if (list == null) {
-                    list = new HashSet<>();
-                    ephemerals.put(ephemeralOwner, list);
-                }
+                HashSet<String> list = ephemerals.computeIfAbsent(ephemeralOwner, k -> new HashSet<>());
                 synchronized (list) {
                     list.add(path);
                 }
@@ -509,7 +500,7 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
         }
         // now check if its one of the zookeeper node child
         if (parentName.startsWith(quotaZookeeper)) {
-            // now check if its the limit node
+            // now check if it's the limit node
             if (Quotas.limitNode.equals(childName)) {
                 // this is the limit node
                 // get the parent and add it to the trie
@@ -538,9 +529,9 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
      *            the path to of the node to be deleted
      * @param zxid
      *            the current zxid
-     * @throws KeeperException.NoNodeException
+     * @throws NoNodeException
      */
-    public void deleteNode(String path, long zxid) throws KeeperException.NoNodeException {
+    public void deleteNode(String path, long zxid) throws NoNodeException {
         int lastSlash = path.lastIndexOf('/');
         String parentName = path.substring(0, lastSlash);
         String childName = path.substring(lastSlash + 1);
@@ -550,14 +541,14 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         // for no such child
         DataNode parent = nodes.get(parentName);
         if (parent == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (parent) {
             nodes.preChange(parentName, parent);
             parent.removeChild(childName);
             // Only update pzxid when the zxid is larger than the current pzxid,
-            // otherwise we might override some higher pzxid set by a create
-            // Txn, which could cause the cversion and pzxid inconsistent
+            // otherwise we might override some higher pzxid set by a CreateTxn,
+            // which could cause the cversion and pzxid inconsistent
             if (zxid > parent.stat.getPzxid()) {
                 parent.stat.setPzxid(zxid);
             }
@@ -566,7 +557,7 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
 
         DataNode node = nodes.get(path);
         if (node == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         nodes.remove(path);
         synchronized (node) {
@@ -578,14 +569,14 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         // only need to sync on containers and ttls, will update it in a
         // separate patch.
         synchronized (parent) {
-            long eowner = node.stat.getEphemeralOwner();
-            EphemeralType ephemeralType = EphemeralType.get(eowner);
+            long owner = node.stat.getEphemeralOwner();
+            EphemeralType ephemeralType = EphemeralType.get(owner);
             if (ephemeralType == EphemeralType.CONTAINER) {
                 containers.remove(path);
             } else if (ephemeralType == EphemeralType.TTL) {
                 ttls.remove(path);
-            } else if (eowner != 0) {
-                Set<String> nodes = ephemerals.get(eowner);
+            } else if (owner != 0) {
+                Set<String> nodes = ephemerals.get(owner);
                 if (nodes != null) {
                     synchronized (nodes) {
                         nodes.remove(path);
@@ -604,7 +595,7 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         String lastPrefix = getMaxPrefixWithQuota(path);
         if (lastPrefix != null) {
             // ok we have some match and need to update
-            long bytes = 0;
+            long bytes;
             synchronized (node) {
                 bytes = (node.data == null ? 0 : -(node.data.length));
             }
@@ -629,15 +620,15 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         childWatches.triggerWatch("".equals(parentName) ? "/" : parentName, EventType.NodeChildrenChanged);
     }
 
-    public Stat setData(String path, byte[] data, int version, long zxid, long time) throws KeeperException.NoNodeException {
+    public Stat setData(String path, byte[] data, int version, long zxid, long time) throws NoNodeException {
         Stat s = new Stat();
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
-        byte[] lastdata = null;
+        byte[] lastData;
         synchronized (n) {
-            lastdata = n.data;
+            lastData = n.data;
             nodes.preChange(path, n);
             n.data = data;
             n.stat.setMtime(time);
@@ -649,13 +640,13 @@ public Stat setData(String path, byte[] data, int version, long zxid, long time)
 
         // first do a quota check if the path is in a quota subtree.
         String lastPrefix = getMaxPrefixWithQuota(path);
-        long bytesDiff = (data == null ? 0 : data.length) - (lastdata == null ? 0 : lastdata.length);
+        long bytesDiff = (data == null ? 0 : data.length) - (lastData == null ? 0 : lastData.length);
         // now update if the path is in a quota subtree.
         long dataBytes = data == null ? 0 : data.length;
         if (lastPrefix != null) {
             updateQuotaStat(lastPrefix, bytesDiff, 0);
         }
-        nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastdata));
+        nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastData));
 
         updateWriteStat(path, dataBytes);
         dataWatches.triggerWatch(path, EventType.NodeDataChanged);
@@ -687,12 +678,12 @@ public void addWatch(String basePath, Watcher watcher, int mode) {
         childWatches.addWatch(basePath, watcher, watcherMode);
     }
 
-    public byte[] getData(String path, Stat stat, Watcher watcher) throws KeeperException.NoNodeException {
+    public byte[] getData(String path, Stat stat, Watcher watcher) throws NoNodeException {
         DataNode n = nodes.get(path);
-        byte[] data = null;
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
+        byte[] data;
         synchronized (n) {
             n.copyStat(stat);
             if (watcher != null) {
@@ -704,15 +695,15 @@ public byte[] getData(String path, Stat stat, Watcher watcher) throws KeeperExce
         return data;
     }
 
-    public Stat statNode(String path, Watcher watcher) throws KeeperException.NoNodeException {
-        Stat stat = new Stat();
-        DataNode n = nodes.get(path);
+    public Stat statNode(String path, Watcher watcher) throws NoNodeException {
         if (watcher != null) {
             dataWatches.addWatch(path, watcher);
         }
+        DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
+        Stat stat = new Stat();
         synchronized (n) {
             n.copyStat(stat);
         }
@@ -720,10 +711,10 @@ public Stat statNode(String path, Watcher watcher) throws KeeperException.NoNode
         return stat;
     }
 
-    public List<String> getChildren(String path, Stat stat, Watcher watcher) throws KeeperException.NoNodeException {
+    public List<String> getChildren(String path, Stat stat, Watcher watcher) throws NoNodeException {
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         List<String> children;
         synchronized (n) {
@@ -747,7 +738,7 @@ public List<String> getChildren(String path, Stat stat, Watcher watcher) throws
     }
 
     public int getAllChildrenNumber(String path) {
-        //cull out these two keys:"", "/"
+        // cull out these two keys:"", "/"
         if ("/".equals(path)) {
             return nodes.size() - 2;
         }
@@ -755,13 +746,13 @@ public int getAllChildrenNumber(String path) {
         return (int) nodes.entrySet().parallelStream().filter(entry -> entry.getKey().startsWith(path + "/")).count();
     }
 
-    public Stat setACL(String path, List<ACL> acl, int version) throws KeeperException.NoNodeException {
-        Stat stat = new Stat();
+    public Stat setACL(String path, List<ACL> acl, int version) throws NoNodeException {
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (n) {
+            Stat stat = new Stat();
             aclCache.removeUsage(n.acl);
             nodes.preChange(path, n);
             n.stat.setAversion(version);
@@ -772,10 +763,10 @@ public Stat setACL(String path, List<ACL> acl, int version) throws KeeperExcepti
         }
     }
 
-    public List<ACL> getACL(String path, Stat stat) throws KeeperException.NoNodeException {
+    public List<ACL> getACL(String path, Stat stat) throws NoNodeException {
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (n) {
             if (stat != null) {
@@ -829,7 +820,7 @@ public boolean equals(Object o) {
         }
 
         /**
-         * See equals() to find the rational for how this hashcode is generated.
+         * See equals() to find the rationale for how this hashcode is generated.
          *
          * @see ProcessTxnResult#equals(Object)
          * @see java.lang.Object#hashCode()
@@ -977,7 +968,7 @@ public ProcessTxnResult processTxn(TxnHeader header, Record txn, boolean isSubTx
                 boolean post_failed = false;
                 for (Txn subtxn : txns) {
                     ByteBuffer bb = ByteBuffer.wrap(subtxn.getData());
-                    Record record = null;
+                    Record record;
                     switch (subtxn.getType()) {
                     case OpCode.create:
                         record = new CreateTxn();
@@ -1005,7 +996,8 @@ record = new CheckVersionTxn();
                     default:
                         throw new IOException("Invalid type of op: " + subtxn.getType());
                     }
-                    assert (record != null);
+
+                    assert record != null;
 
                     ByteBufferInputStream.byteBuffer2Record(bb, record);
 
@@ -1049,7 +1041,7 @@ record = new ErrorTxn(ec);
          * But there is a tricky scenario that if the child is deleted due
          * to session close and re-created in a different global session
          * after that the parent is serialized, then when replay the txn
-         * because the node is belonging to a different session, replay the
+         * because the node belongs to a different session, replay the
          * closeSession txn won't delete it anymore, and we'll get NODEEXISTS
          * error when replay the createNode txn. In this case, we need to
          * update the cversion and pzxid to the new value.
@@ -1064,7 +1056,7 @@ record = new ErrorTxn(ec);
             CreateTxn cTxn = (CreateTxn) txn;
             try {
                 setCversionPzxid(parentName, cTxn.getParentCVersion(), header.getZxid());
-            } catch (KeeperException.NoNodeException e) {
+            } catch (NoNodeException e) {
                 LOG.error("Failed to set parent cversion for: {}", parentName, e);
                 rc.err = e.code().intValue();
             }
@@ -1118,7 +1110,7 @@ record = new ErrorTxn(ec);
     }
 
     void killSession(long session, long zxid) {
-        // the list is already removed from the ephemerals
+        // The list is already removed from the ephemerals,
         // so we do not have to worry about synchronizing on
         // the list. This is only called from FinalRequestProcessor
         // so there is no need for synchronization. The list is not
@@ -1182,33 +1174,28 @@ void deleteNodes(long session, long zxid, Iterable<String> paths2Delete) {
     }
 
     /**
-     * a encapsultaing class for return value
+     * An encapsulation class for return value
      */
     private static class Counts {
-
         long bytes;
         int count;
-
     }
 
     /**
      * this method gets the count of nodes and the bytes under a subtree
      *
-     * @param path
-     *            the path to be used
-     * @param counts
-     *            the int count
+     * @param path the path to be used
+     * @param counts the int count
      */
     private void getCounts(String path, Counts counts) {
         DataNode node = getNode(path);
         if (node == null) {
             return;
         }
-        String[] children = null;
-        int len = 0;
+        String[] children;
+        int len;
         synchronized (node) {
-            Set<String> childs = node.getChildren();
-            children = childs.toArray(new String[childs.size()]);
+            children = node.getChildren().toArray(new String[0]);
             len = (node.data == null ? 0 : node.data.length);
         }
         // add itself
@@ -1222,15 +1209,14 @@ private void getCounts(String path, Counts counts) {
     /**
      * update the quota for the given path
      *
-     * @param path
-     *            the path to be used
+     * @param path the path to be used
      */
     private void updateQuotaForPath(String path) {
         Counts c = new Counts();
         getCounts(path, c);
-        StatsTrack strack = new StatsTrack();
-        strack.setBytes(c.bytes);
-        strack.setCount(c.count);
+        StatsTrack statsTrack = new StatsTrack();
+        statsTrack.setBytes(c.bytes);
+        statsTrack.setCount(c.count);
         String statPath = Quotas.statPath(path);
         DataNode node = getNode(statPath);
         // it should exist
@@ -1240,7 +1226,7 @@ private void updateQuotaForPath(String path) {
         }
         synchronized (node) {
             nodes.preChange(statPath, node);
-            node.data = strack.getStatsBytes();
+            node.data = statsTrack.getStatsBytes();
             nodes.postChange(statPath, node);
         }
     }
@@ -1248,19 +1234,18 @@ private void updateQuotaForPath(String path) {
     /**
      * this method traverses the quota path and update the path trie and sets
      *
-     * @param path
+     * @param path the path to be used
      */
     private void traverseNode(String path) {
         DataNode node = getNode(path);
-        String[] children = null;
+        String[] children;
         synchronized (node) {
-            Set<String> childs = node.getChildren();
-            children = childs.toArray(new String[childs.size()]);
+            children = node.getChildren().toArray(new String[0]);
         }
         if (children.length == 0) {
             // this node does not have a child
             // is the leaf node
-            // check if its the leaf node
+            // check if it's the leaf node
             String endString = "/" + Quotas.limitNode;
             if (path.endsWith(endString)) {
                 // ok this is the limit node
@@ -1293,10 +1278,8 @@ private void setupQuota() {
      * this method uses a stringbuilder to create a new path for children. This
      * is faster than string appends ( str1 + str2).
      *
-     * @param oa
-     *            OutputArchive to write to.
-     * @param path
-     *            a string builder.
+     * @param oa OutputArchive to write to.
+     * @param path a string builder.
      * @throws IOException
      */
     void serializeNode(OutputArchive oa, StringBuilder path) throws IOException {
@@ -1305,7 +1288,7 @@ void serializeNode(OutputArchive oa, StringBuilder path) throws IOException {
         if (node == null) {
             return;
         }
-        String[] children = null;
+        String[] children;
         DataNode nodeCopy;
         synchronized (node) {
             StatPersisted statCopy = new StatPersisted();
@@ -1313,23 +1296,20 @@ void serializeNode(OutputArchive oa, StringBuilder path) throws IOException {
             //we do not need to make a copy of node.data because the contents
             //are never changed
             nodeCopy = new DataNode(node.data, node.acl, statCopy);
-            Set<String> childs = node.getChildren();
-            children = childs.toArray(new String[childs.size()]);
+            children = node.getChildren().toArray(new String[0]);
         }
         serializeNodeData(oa, pathString, nodeCopy);
         path.append('/');
         int off = path.length();
         for (String child : children) {
-            // since this is single buffer being resused
-            // we need
-            // to truncate the previous bytes of string.
+            // Since this is single buffer being reused, we need to truncate the previous bytes of string.
             path.delete(off, Integer.MAX_VALUE);
             path.append(child);
             serializeNode(oa, path);
         }
     }
 
-    // visiable for test
+    // visible for test
     public void serializeNodeData(OutputArchive oa, String path, DataNode node) throws IOException {
         oa.writeString(path, "path");
         oa.writeRecord(node, "node");
@@ -1373,25 +1353,18 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
                 String parentPath = path.substring(0, lastSlash);
                 DataNode parent = nodes.get(parentPath);
                 if (parent == null) {
-                    throw new IOException("Invalid Datatree, unable to find "
-                                          + "parent "
-                                          + parentPath
-                                          + " of path "
-                                          + path);
+                    throw new IOException(
+                            "Invalid Datatree, unable to find parent " + parentPath + " of path " + path);
                 }
                 parent.addChild(path.substring(lastSlash + 1));
-                long eowner = node.stat.getEphemeralOwner();
-                EphemeralType ephemeralType = EphemeralType.get(eowner);
+                long owner = node.stat.getEphemeralOwner();
+                EphemeralType ephemeralType = EphemeralType.get(owner);
                 if (ephemeralType == EphemeralType.CONTAINER) {
                     containers.add(path);
                 } else if (ephemeralType == EphemeralType.TTL) {
                     ttls.add(path);
-                } else if (eowner != 0) {
-                    HashSet<String> list = ephemerals.get(eowner);
-                    if (list == null) {
-                        list = new HashSet<>();
-                        ephemerals.put(eowner, list);
-                    }
+                } else if (owner != 0) {
+                    HashSet<String> list = ephemerals.computeIfAbsent(owner, k -> new HashSet<>());
                     list.add(path);
                 }
             }
@@ -1403,8 +1376,7 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
 
         nodeDataSize.set(approximateDataSize());
 
-        // we are done with deserializing the
-        // the datatree
+        // we are done with deserializing the datatree
         // update the quotas - create path trie
         // and also update the stat nodes
         setupQuota();
@@ -1414,19 +1386,19 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
 
     /**
      * Summary of the watches on the datatree.
-     * @param pwriter the output to write to
+     * @param writer the output to write to
      */
-    public synchronized void dumpWatchesSummary(PrintWriter pwriter) {
-        pwriter.print(dataWatches.toString());
+    public synchronized void dumpWatchesSummary(PrintWriter writer) {
+        writer.print(dataWatches.toString());
     }
 
     /**
      * Write a text dump of all the watches on the datatree.
      * Warning, this is expensive, use sparingly!
-     * @param pwriter the output to write to
+     * @param writer the output to write to
      */
-    public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
-        dataWatches.dumpWatches(pwriter, byPath);
+    public synchronized void dumpWatches(PrintWriter writer, boolean byPath) {
+        dataWatches.dumpWatches(writer, byPath);
     }
 
     /**
@@ -1461,18 +1433,18 @@ public synchronized WatchesSummary getWatchesSummary() {
 
     /**
      * Write a text dump of all the ephemerals in the datatree.
-     * @param pwriter the output to write to
+     * @param writer the output to write to
      */
-    public void dumpEphemerals(PrintWriter pwriter) {
-        pwriter.println("Sessions with Ephemerals (" + ephemerals.keySet().size() + "):");
+    public void dumpEphemerals(PrintWriter writer) {
+        writer.println("Sessions with Ephemerals (" + ephemerals.keySet().size() + "):");
         for (Entry<Long, HashSet<String>> entry : ephemerals.entrySet()) {
-            pwriter.print("0x" + Long.toHexString(entry.getKey()));
-            pwriter.println(":");
+            writer.print("0x" + Long.toHexString(entry.getKey()));
+            writer.println(":");
             Set<String> tmp = entry.getValue();
             if (tmp != null) {
                 synchronized (tmp) {
                     for (String path : tmp) {
-                        pwriter.println("\t" + path);
+                        writer.println("\t" + path);
                     }
                 }
             }
@@ -1508,7 +1480,6 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String>
                            List<String> persistentWatches, List<String> persistentRecursiveWatches, Watcher watcher) {
         for (String path : dataWatches) {
             DataNode node = getNode(path);
-            WatchedEvent e = null;
             if (node == null) {
                 watcher.process(new WatchedEvent(EventType.NodeDeleted, KeeperState.SyncConnected, path));
             } else if (node.stat.getMzxid() > relativeZxid) {
@@ -1558,16 +1529,16 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String>
      *     Value to be assigned to Cversion
      * @param zxid
      *     Value to be assigned to Pzxid
-     * @throws KeeperException.NoNodeException
+     * @throws NoNodeException
      *     If znode not found.
      **/
-    public void setCversionPzxid(String path, int newCversion, long zxid) throws KeeperException.NoNodeException {
+    public void setCversionPzxid(String path, int newCversion, long zxid) throws NoNodeException {
         if (path.endsWith("/")) {
             path = path.substring(0, path.length() - 1);
         }
         DataNode node = nodes.get(path);
         if (node == null) {
-            throw new KeeperException.NoNodeException(path);
+            throw new NoNodeException(path);
         }
         synchronized (node) {
             if (newCversion == -1) {
@@ -1664,7 +1635,7 @@ private void logZxidDigest(long zxid, long digest) {
 
     /**
      * Serializing the digest to snapshot, this is done after the data tree
-     * is being serialized, so when we replay the txns and it hits this zxid
+     * is being serialized, so when we replay the txns, and it hits this zxid
      * we know we should be in a non-fuzzy state, and have the same digest.
      *
      * @param oa the output stream to write to
@@ -1721,12 +1692,12 @@ public boolean deserializeZxidDigest(InputArchive ia, long startZxidOfSnapshot)
             // epoch + 0, which is not mapping to any txn, and it uses
             // this to take snapshot, which is possible if we don't
             // clean database before switching to LOOKING. In this case
-            // the currentZxidDigest will be the zxid of last epoch and
+            // the currentZxidDigest will be the zxid of last epoch, and
             // it's smaller than the zxid of the snapshot file.
             //
             // It's safe to reset the targetZxidDigest to null and start
             // to compare digest when replaying the first txn, since it's
-            // a non fuzzy snapshot.
+            // a non-fuzzy snapshot.
             if (digestFromLoadedSnapshot != null && digestFromLoadedSnapshot.zxid < startZxidOfSnapshot) {
                 LOG.info("The zxid of snapshot digest 0x{} is smaller "
                         + "than the known snapshot highest zxid, the snapshot "
@@ -1782,7 +1753,7 @@ public boolean deserializeLastProcessedZxid(final InputArchive ia)  throws IOExc
 
     /**
      * Compares the actual tree's digest with that in the snapshot.
-     * Resets digestFromLoadedSnapshot after comparision.
+     * Resets digestFromLoadedSnapshot after comparison.
      *
      * @param zxid zxid
      */
@@ -1801,8 +1772,9 @@ public void compareSnapshotDigests(long zxid) {
             }
             digestFromLoadedSnapshot = null;
         } else if (digestFromLoadedSnapshot.zxid != 0 && zxid > digestFromLoadedSnapshot.zxid) {
-            RATE_LOGGER.rateLimitLog("The txn 0x{} of snapshot digest does not "
-                    + "exist.", Long.toHexString(digestFromLoadedSnapshot.zxid));
+            RATE_LOGGER.rateLimitLog(
+                    "The txn 0x{} of snapshot digest does not exist.",
+                    Long.toHexString(digestFromLoadedSnapshot.zxid));
         }
     }
 
@@ -1814,8 +1786,7 @@ public void compareSnapshotDigests(long zxid) {
      * @param txn    transaction
      * @param digest transaction digest
      *
-     * @return false if digest in the txn doesn't match what we have now in
-     *               the data tree
+     * @return false if digest in the txn doesn't match what we have now in the data tree
      */
     public boolean compareDigest(TxnHeader header, Record txn, TxnDigest digest) {
         long zxid = header.getZxid();
@@ -1829,8 +1800,7 @@ public boolean compareDigest(TxnHeader header, Record txn, TxnDigest digest) {
         }
         // do not compare digest if there is digest version change
         if (digestCalculator.getDigestVersion() != digest.getVersion()) {
-            RATE_LOGGER.rateLimitLog("Digest version not the same on zxid.",
-                    String.valueOf(zxid));
+            RATE_LOGGER.rateLimitLog("Digest version not the same on zxid.", String.valueOf(zxid));
             return true;
         }
 
@@ -1840,16 +1810,17 @@ public boolean compareDigest(TxnHeader header, Record txn, TxnDigest digest) {
             reportDigestMismatch(zxid);
             LOG.debug("Digest in log: {}, actual tree: {}", logDigest, actualDigest);
             if (firstMismatchTxn) {
-                LOG.error("First digest mismatch on txn: {}, {}, "
-                        + "expected digest is {}, actual digest is {}, ",
+                LOG.error(
+                        "First digest mismatch on txn: {}, {}, expected digest is {}, actual digest is {}, ",
                         header, txn, digest, actualDigest);
                 firstMismatchTxn = false;
             }
             return false;
         } else {
             RATE_LOGGER.flush();
-            LOG.debug("Digests are matching for Zxid: {}, Digest in log "
-                    + "and actual tree: {}", Long.toHexString(zxid), logDigest);
+            LOG.debug(
+                    "Digests are matching for Zxid: {}, Digest in log and actual tree: {}",
+                    Long.toHexString(zxid), logDigest);
             return true;
         }
     }

From de8768807fc7a3fcabc9762b033cf59e695cf14b Mon Sep 17 00:00:00 2001
From: Colvin Cowie <51863265+colvinco@users.noreply.github.com>
Date: Mon, 27 Feb 2023 14:41:01 +0000
Subject: [PATCH 355/591] ZOOKEEPER-4296: Add null checks to
 ClientCnxnSocketNetty onClosing (#1697)

Co-authored-by: Colvin Cowie <COLVINCO@uk.ibm.com>
---
 .../org/apache/zookeeper/ClientCnxnSocketNetty.java    |  8 ++++++--
 .../org/apache/zookeeper/ClientCnxnSocketTest.java     | 10 ++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
index df53978559a..b2ca4c22506 100755
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -244,7 +244,9 @@ void packetAdded() {
 
     @Override
     void onClosing() {
-        firstConnect.countDown();
+        if (firstConnect != null) {
+            firstConnect.countDown();
+        }
         wakeupCnxn();
         LOG.info("channel is told closing");
     }
@@ -253,7 +255,9 @@ private void wakeupCnxn() {
         if (needSasl.get()) {
             waitSasl.release();
         }
-        outgoingQueue.add(WakeupPacket.getInstance());
+        if (outgoingQueue != null) {
+          outgoingQueue.add(WakeupPacket.getInstance());
+        }
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
index e707cb332d8..a6e4c135d9d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
@@ -90,4 +90,14 @@ public void testIOExceptionIsThrownWhenPacketLenExceedsJuteMaxBuffer() throws IO
             assertEquals("Packet len " + length + " is out of range!", e.getMessage());
         }
     }
+
+    @Test
+    public void testClientCanBeClosedWhenNotInitialized() throws IOException {
+        ZKClientConfig clientConfig = new ZKClientConfig();
+        final ClientCnxnSocketNetty clientCnxnSocket = new ClientCnxnSocketNetty(clientConfig);
+        // Should not throw
+        clientCnxnSocket.close();
+        // Call onClosing explicitly since it otherwise won't be invoked without more setup.
+        clientCnxnSocket.onClosing();
+    }
 }

From df320056140a49423718ee6f0a7c35538281176e Mon Sep 17 00:00:00 2001
From: Scott Brenner <scott@scottbrenner.me>
Date: Sun, 5 Mar 2023 21:43:49 -0800
Subject: [PATCH 356/591] [hotfix] Bump actions/checkout to v3 in GitHub
 Actions workflows (#1938)

---
 .github/workflows/ci.yaml     | 2 +-
 .github/workflows/e2e.yaml    | 2 +-
 .github/workflows/manual.yaml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 16171d26ca2..45ff90cc651 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up JDK ${{ matrix.profile.jdk }}
       uses: actions/setup-java@v1
       with:
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 5128eaa830f..ea3c85e9874 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up JDK ${{ matrix.jdk }}
         uses: actions/setup-java@v1
         with:
diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml
index 191a8b0cdd4..ca00519c965 100644
--- a/.github/workflows/manual.yaml
+++ b/.github/workflows/manual.yaml
@@ -45,7 +45,7 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.buildRef }}
     - name: Set up JDK 11

From 14b936201b719ab5cf6346d1ed7dfc4ff382cbb7 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Mon, 6 Mar 2023 15:57:47 +0800
Subject: [PATCH 357/591] ZOOKEEPER-4679: Fix CI failure and warning  (#1987)

1. Run `apt update` before installing C deps to avoid 404.
2. Update actions version to avoid set-output deprecation warnings.

Signed-off-by: tison <wander4096@gmail.com>
---
 .github/workflows/ci.yaml     | 16 ++++++++--------
 .github/workflows/e2e.yaml    |  9 ++++++---
 .github/workflows/manual.yaml | 16 ++++++++--------
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 45ff90cc651..cafc94729b8 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,4 +1,3 @@
-#
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -15,7 +14,6 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-#
 
 # This workflow will build a Java project with Maven
 # See also:
@@ -52,11 +50,12 @@ jobs:
     steps:
     - uses: actions/checkout@v3
     - name: Set up JDK ${{ matrix.profile.jdk }}
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v3
       with:
         java-version: ${{ matrix.profile.jdk }}
+        distribution: temurin
     - name: Cache local maven repository
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: |
           ~/.m2/repository/
@@ -66,23 +65,24 @@ jobs:
     - name: Show the first log message
       run: git log -n1
     - name: Install C Dependencies
-      run: sudo apt-get install libcppunit-dev libsasl2-dev
+      run: |
+        sudo apt update
+        sudo apt install -y libcppunit-dev libsasl2-dev
     - name: Build with Maven (${{ matrix.profile.name }})
       run: mvn -B -V -e -ntp "-Dstyle.color=always" ${{ matrix.profile.args }}
       env:
         MAVEN_OPTS: -Djansi.force=true
     - name: Upload unit test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3
       with:
         name: surefire-reports-${{ matrix.profile.name }}
         path: ./**/target/surefire-reports/
         if-no-files-found: ignore
     - name: Upload integration test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3
       with:
         name: failsafe-reports-${{ matrix.profile.name }}
         path: ./**/target/failsafe-reports/
         if-no-files-found: ignore
-
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index ea3c85e9874..e497c3f0396 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -33,11 +33,12 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up JDK ${{ matrix.jdk }}
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v3
         with:
           java-version: ${{ matrix.jdk }}
+          distribution: temurin
       - name: Cache local maven repository
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: |
             ~/.m2/repository/
@@ -47,7 +48,9 @@ jobs:
       - name: Show the first log message
         run: git log -n1
       - name: Install C Dependencies
-        run: sudo apt-get install libcppunit-dev libsasl2-dev
+        run: |
+          sudo apt update
+          sudo apt install -y libcppunit-dev libsasl2-dev
       - name: Build with Maven
         run: mvn -B -V -e -ntp "-Dstyle.color=always" package -DskipTests
         env:
diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml
index ca00519c965..905ba49f33d 100644
--- a/.github/workflows/manual.yaml
+++ b/.github/workflows/manual.yaml
@@ -1,4 +1,3 @@
-#
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -15,7 +14,6 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-#
 
 # This workflow will build a Java project with Maven
 # See also:
@@ -49,11 +47,12 @@ jobs:
       with:
         ref: ${{ github.event.inputs.buildRef }}
     - name: Set up JDK 11
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v3
       with:
         java-version: 11
+        distribution: temurin
     - name: Cache local maven repository
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: |
           ~/.m2/repository/
@@ -63,23 +62,24 @@ jobs:
     - name: Show the first log message
       run: git log -n1
     - name: Install C Dependencies
-      run: sudo apt-get install libcppunit-dev libsasl2-dev
+      run: |
+        sudo apt update
+        sudo apt install -y libcppunit-dev libsasl2-dev
     - name: Build with Maven
       run: mvn -B -V -e -ntp "-Dstyle.color=always" ${{ github.event.inputs.mvnOpts }} ${{ github.event.inputs.goals }}
       env:
         MAVEN_OPTS: -Djansi.force=true
     - name: Upload unit test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3
       with:
         name: surefire-reports
         path: ./**/target/surefire-reports/
         if-no-files-found: ignore
     - name: Upload integration test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3
       with:
         name: failsafe-reports
         path: ./**/target/failsafe-reports/
         if-no-files-found: ignore
-

From 16227468d64dd7e1744517a2e587099d5501c0c1 Mon Sep 17 00:00:00 2001
From: Enrico Olivelli <eolivelli@apache.org>
Date: Wed, 8 Mar 2023 14:07:17 +0100
Subject: [PATCH 358/591] [ZOOKEEPER-4676] ReadOnlyModeTest doesn't not compile
 on JDK20 (Thread.suspend has been removed) (#1985)

* checkstyle
---
 .../zookeeper/server/quorum/QuorumPeer.java     | 17 +++++++++++++++++
 .../apache/zookeeper/test/ReadOnlyModeTest.java |  6 ++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index f5931fb97b0..6fc3ee2009a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -43,6 +43,7 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.concurrent.atomic.AtomicReference;
@@ -144,6 +145,8 @@ public class QuorumPeer extends ZooKeeperThread implements QuorumStats.Provider
 
     private JvmPauseMonitor jvmPauseMonitor;
 
+    private final AtomicBoolean suspended = new AtomicBoolean(false);
+
     public static final class AddressTuple {
 
         public final MultipleAddresses quorumAddr;
@@ -1408,6 +1411,19 @@ public synchronized ZooKeeperServer getActiveServer() {
 
     boolean shuttingDownLE = false;
 
+    public void setSuspended(boolean suspended) {
+        this.suspended.set(suspended);
+    }
+    private void checkSuspended() {
+        try {
+            while (suspended.get()) {
+                Thread.sleep(10);
+            }
+        } catch (InterruptedException err) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
     @Override
     public void run() {
         updateThreadName();
@@ -1490,6 +1506,7 @@ public void run() {
                                 startLeaderElection();
                             }
                             setCurrentVote(makeLEStrategy().lookForLeader());
+                            checkSuspended();
                         } catch (Exception e) {
                             LOG.warn("Unexpected exception", e);
                             setPeerState(ServerState.LOOKING);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index c8f4ac42cc4..49f871c1ce4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -300,7 +300,8 @@ public void testSeekForRwServer() throws Exception {
             watcher.waitForConnected(CONNECTION_TIMEOUT);
 
             // if we don't suspend a peer it will rejoin a quorum
-            qu.getPeer(1).peer.suspend();
+            qu.getPeer(1).peer
+                    .setSuspended(true);
 
             // start two servers to form a quorum; client should detect this and
             // connect to one of them
@@ -312,7 +313,8 @@ public void testSeekForRwServer() throws Exception {
             zk.create("/test", "test".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
             // resume poor fellow
-            qu.getPeer(1).peer.resume();
+            qu.getPeer(1).peer
+                    .setSuspended(false);
 
             String log = os.toString();
             assertFalse(StringUtils.isEmpty(log), "OutputStream doesn't have any log messages");

From f46b8fb87ff3b06bab58bb6fcb73439a86bf9ab3 Mon Sep 17 00:00:00 2001
From: doxsch <28098153+doxsch@users.noreply.github.com>
Date: Wed, 8 Mar 2023 14:08:29 +0100
Subject: [PATCH 359/591] ZOOKEEPER-3731: Disallow HTTP TRACE method on
 PrometheusMetrics Server (#1682)

---
 .../prometheus/PrometheusMetricsProvider.java | 23 ++++++++++++++++++
 .../PrometheusMetricsProviderTest.java        | 24 +++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index e17b097859f..af4bff9d218 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -52,9 +52,12 @@
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
 import org.apache.zookeeper.server.RateLogger;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.security.Constraint;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -134,6 +137,7 @@ public void start() throws MetricsProviderLifeCycleException {
             server = new Server(new InetSocketAddress(host, port));
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
+            constrainTraceMethod(context);
             server.setHandler(context);
             context.addServlet(new ServletHolder(servlet), "/metrics");
             server.start();
@@ -235,6 +239,25 @@ public void resetAllValues() {
         // not supported on Prometheus
     }
 
+    /**
+     * Add constraint to a given context to disallow TRACE method.
+     * @param ctxHandler the context to modify
+     */
+    private void constrainTraceMethod(ServletContextHandler ctxHandler) {
+        Constraint c = new Constraint();
+        c.setAuthenticate(true);
+
+        ConstraintMapping cmt = new ConstraintMapping();
+        cmt.setConstraint(c);
+        cmt.setMethod("TRACE");
+        cmt.setPathSpec("/*");
+
+        ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
+        securityHandler.setConstraintMappings(new ConstraintMapping[] {cmt});
+
+        ctxHandler.setSecurityHandler(securityHandler);
+    }
+
     private class Context implements MetricsContext {
 
         private final ConcurrentMap<String, PrometheusGaugeWrapper> gauges = new ConcurrentHashMap<>();
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 9284f52bba9..eb9cf8bd2aa 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -31,6 +31,9 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
+import java.lang.reflect.Field;
+import java.net.HttpURLConnection;
+import java.net.URL;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -50,7 +53,10 @@
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
 import org.apache.zookeeper.server.util.QuotaMetricsUtils;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
 import org.hamcrest.CoreMatchers;
+import org.junit.Assert;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -61,6 +67,7 @@
  */
 public class PrometheusMetricsProviderTest {
 
+    private static final String URL_FORMAT = "http://localhost:%d/metrics";
     private PrometheusMetricsProvider provider;
 
     @BeforeEach
@@ -395,6 +402,23 @@ public void testAdvancedSummary() throws Exception {
         assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\",} 10.0"));
     }
 
+    /**
+     * Using TRACE method to visit metrics provider, the response should be 403 forbidden.
+     */
+    @Test
+    public void testTraceCall() throws IOException, IllegalAccessException, NoSuchFieldException {
+        Field privateServerField = provider.getClass().getDeclaredField("server");
+        privateServerField.setAccessible(true);
+        Server server = (Server) privateServerField.get(provider);
+        int port = ((ServerConnector) server.getConnectors()[0]).getLocalPort();
+
+        String metricsUrl = String.format(URL_FORMAT, port);
+        HttpURLConnection conn = (HttpURLConnection) new URL(metricsUrl).openConnection();
+        conn.setRequestMethod("TRACE");
+        conn.connect();
+        Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+    }
+
     @Test
     public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
         final Properties config = new Properties();

From e50a0bbae1bc0b812ac2656f5ba3f9eab7c3d62e Mon Sep 17 00:00:00 2001
From: Guoxiong Li <lgxbslgx@gmail.com>
Date: Fri, 17 Mar 2023 15:01:29 +0800
Subject: [PATCH 360/591] [ZOOKEEPER-4671] Java classpath should contain libs
 about metrics providers (#1908)

---
 bin/zkEnv.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/bin/zkEnv.sh b/bin/zkEnv.sh
index 0728c2e709f..46a4621c42b 100755
--- a/bin/zkEnv.sh
+++ b/bin/zkEnv.sh
@@ -111,17 +111,27 @@ do
    CLASSPATH="$d:$CLASSPATH"
 done
 
+#make it work for developers
 for d in "$ZOOBINDIR"/../zookeeper-server/target/lib/*.jar
 do
    CLASSPATH="$d:$CLASSPATH"
 done
 
+#make it work for developers
+for d in "$ZOOBINDIR"/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/lib/*.jar
+do
+   CLASSPATH="$d:$CLASSPATH"
+done
+
 #make it work for developers
 CLASSPATH="$ZOOBINDIR/../build/classes:$CLASSPATH"
 
 #make it work for developers
 CLASSPATH="$ZOOBINDIR/../zookeeper-server/target/classes:$CLASSPATH"
 
+#make it work for developers
+CLASSPATH="$ZOOBINDIR/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/classes:$CLASSPATH"
+
 case "`uname`" in
     CYGWIN*|MINGW*) cygwin=true ;;
     *) cygwin=false ;;

From 3eda8a3a00ef3230d6c16f6ddf9201a3c0f5ca07 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Sun, 26 Mar 2023 20:20:58 +0800
Subject: [PATCH 361/591] ZOOKEEPER-4682. Make FileSnap.deserialize a static
 method (#1992)

FileSnap.deserialize is effectively a static method. Change it to a
static method so that we don't need to do some new FileSnap(null)
hacks for workaround calling this method.

Signed-off-by: tison <wander4096@gmail.com>
---
 .../apache/zookeeper/server/SnapshotComparer.java    |  3 +--
 .../apache/zookeeper/server/SnapshotFormatter.java   |  4 +---
 .../zookeeper/server/SnapshotRecursiveSummary.java   |  5 +----
 .../java/org/apache/zookeeper/server/ZKDatabase.java |  3 +--
 .../zookeeper/server/persistence/FileSnap.java       |  5 +++--
 .../java/org/apache/zookeeper/server/CRCTest.java    | 12 ++++++------
 6 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
index bb6a45db84c..7bbb773fa98 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
@@ -259,14 +259,13 @@ public static Comparator<TreeNode> MakeAlphabeticComparator() {
    * @throws Exception
    */
   private static DataTree getSnapshot(File file) throws Exception {
-    FileSnap fileSnap = new FileSnap(null);
     DataTree dataTree = new DataTree();
     Map<Long, Integer> sessions = new HashMap<>();
     CheckedInputStream snapIS = SnapStream.getInputStream(file);
 
     long beginning = System.nanoTime();
     InputArchive ia = BinaryInputArchive.getArchive(snapIS);
-    fileSnap.deserialize(dataTree, sessions, ia);
+    FileSnap.deserialize(dataTree, sessions, ia);
     long end = System.nanoTime();
     System.out.println(String.format("Deserialized snapshot in %s in %f seconds", file.getName(),
         (((double) (end - beginning) / 1000000)) / 1000));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
index 4ad590c9972..c7791dafbd0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
@@ -96,12 +96,10 @@ public void run(String snapshotFileName, boolean dumpData, boolean dumpJson) thr
         try (InputStream is = SnapStream.getInputStream(snapshotFile)) {
             InputArchive ia = BinaryInputArchive.getArchive(is);
 
-            FileSnap fileSnap = new FileSnap(null);
-
             DataTree dataTree = new DataTree();
             Map<Long, Integer> sessions = new HashMap<>();
 
-            fileSnap.deserialize(dataTree, sessions, ia);
+            FileSnap.deserialize(dataTree, sessions, ia);
             long fileNameZxid = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
 
             if (dumpJson) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
index 44478316603..c0a66de772c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
@@ -67,12 +67,9 @@ public void run(String snapshotFileName, String startingNode, int maxDepth) thro
     try (InputStream is = SnapStream.getInputStream(snapshotFile)) {
       InputArchive ia = BinaryInputArchive.getArchive(is);
 
-      FileSnap fileSnap = new FileSnap(null);
-
       DataTree dataTree = new DataTree();
       Map<Long, Integer> sessions = new HashMap<>();
-
-      fileSnap.deserialize(dataTree, sessions, ia);
+      FileSnap.deserialize(dataTree, sessions, ia);
 
       printZnodeDetails(dataTree, startingNode, maxDepth);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index a8729841ce4..b50d00babdb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -637,8 +637,7 @@ public void deserializeSnapshot(final InputArchive ia, final CheckedInputStream
 
         // deserialize data tree
         final DataTree dataTree = getDataTree();
-        final FileSnap filesnap = new FileSnap(snapLog.getSnapDir());
-        filesnap.deserialize(dataTree, getSessionWithTimeOuts(), ia);
+        FileSnap.deserialize(dataTree, getSessionWithTimeOuts(), ia);
         SnapStream.checkSealIntegrity(is, ia);
 
         // deserialize digest and check integrity
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index 55e7f723f43..cb7efc403e0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -26,6 +26,7 @@
 import java.util.Map;
 import java.util.zip.CheckedInputStream;
 import java.util.zip.CheckedOutputStream;
+import javax.annotation.Nonnull;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.InputArchive;
@@ -53,7 +54,7 @@ public class FileSnap implements SnapShot {
 
     public static final String SNAPSHOT_FILE_PREFIX = "snapshot";
 
-    public FileSnap(File snapDir) {
+    public FileSnap(@Nonnull File snapDir) {
         this.snapDir = snapDir;
     }
 
@@ -131,7 +132,7 @@ public long deserialize(DataTree dt, Map<Long, Integer> sessions) throws IOExcep
      * @param ia the input archive to restore from
      * @throws IOException
      */
-    public void deserialize(DataTree dt, Map<Long, Integer> sessions, InputArchive ia) throws IOException {
+    public static void deserialize(DataTree dt, Map<Long, Integer> sessions, InputArchive ia) throws IOException {
         FileHeader header = new FileHeader();
         header.deserialize(ia, "fileheader");
         if (header.getMagic() != SNAP_MAGIC) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
index 2d94d2ba464..37e9b78ab9f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
@@ -70,14 +70,14 @@ private void corruptFile(File file) throws IOException {
     }
 
     /** return if checksum matches for a snapshot **/
-    private boolean getCheckSum(FileSnap snap, File snapFile) throws IOException {
+    private boolean getCheckSum(File snapFile) throws IOException {
         DataTree dt = new DataTree();
         Map<Long, Integer> sessions = new ConcurrentHashMap<>();
         InputStream snapIS = new BufferedInputStream(new FileInputStream(snapFile));
         CheckedInputStream crcIn = new CheckedInputStream(snapIS, new Adler32());
         InputArchive ia = BinaryInputArchive.getArchive(crcIn);
         try {
-            snap.deserialize(dt, sessions, ia);
+            FileSnap.deserialize(dt, sessions, ia);
         } catch (IOException ie) {
             // we failed on the most recent snapshot
             // must be incomplete
@@ -154,16 +154,16 @@ public void testChecksums() throws Exception {
         List<File> snapFiles = snap.findNRecentSnapshots(2);
         snapFile = snapFiles.get(0);
         corruptFile(snapFile);
-        boolean cfile = false;
+        boolean cfile;
         try {
-            cfile = getCheckSum(snap, snapFile);
+            cfile = getCheckSum(snapFile);
         } catch (IOException ie) {
-            //the last snapshot seems incompelte
+            //the last snapshot seems incomplete
             // corrupt the last but one
             // and use that
             snapFile = snapFiles.get(1);
             corruptFile(snapFile);
-            cfile = getCheckSum(snap, snapFile);
+            cfile = getCheckSum(snapFile);
         }
         assertTrue(cfile);
     }

From 31e3f1cde33472e5bf54a7a79e3acf066cc53fba Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Thu, 13 Apr 2023 00:22:02 +0800
Subject: [PATCH 362/591] ZOOKEEPER-4687. Improve SuppressWarnings in
 KeeperException (#1994)

Signed-off-by: tison <wander4096@gmail.com>
---
 .../src/main/java/org/apache/zookeeper/KeeperException.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index eace4adf12f..06826a672ed 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -25,7 +25,6 @@
 import java.util.Map;
 import org.apache.yetus.audience.InterfaceAudience;
 
-@SuppressWarnings("serial")
 @InterfaceAudience.Public
 public abstract class KeeperException extends Exception {
 
@@ -182,6 +181,7 @@ public void setCode(int code) {
      * interface should be private, but it's declared public to enable
      * javadoc to include in the user API spec.
      */
+    @SuppressWarnings("DeprecatedIsStillUsed") // still used in Code - kept until 4.0
     @Deprecated
     @InterfaceAudience.Public
     public interface CodeDeprecated {

From 89c1831f84891f425f1fa9224210587124f1c1ec Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Mon, 17 Apr 2023 16:23:40 +0000
Subject: [PATCH 363/591] ZOOKEEPER-4688: Upgrade `cyclonedx-maven-plugin` to
 2.7.6 (#1995)

Closes #1995

Signed-off-by: Chris Nauroth <cnauroth@apache.org>
Reviewed-by: Christopher Tubbs <ctubbsii@apache.org>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a488ba7934c..9252090cebe 100644
--- a/pom.xml
+++ b/pom.xml
@@ -927,7 +927,7 @@
         <plugin>
           <groupId>org.cyclonedx</groupId>
           <artifactId>cyclonedx-maven-plugin</artifactId>
-          <version>2.7.3</version>
+          <version>2.7.6</version>
        </plugin>
       </plugins>
     </pluginManagement>

From a64dbf5b06ca1a73dc2ad6c7d31e679e312082aa Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Fri, 5 May 2023 15:58:42 +0800
Subject: [PATCH 364/591] ZOOKEEPER-4466: Support different watch modes on same
 path (#1859)

Signed-off-by: Kezhu Wang <kezhuw@gmail.com>
Co-authored-by: tison <wander4096@gmail.com>
---
 .../org/apache/zookeeper/server/DataTree.java |   5 +-
 .../zookeeper/server/watch/IWatchManager.java |   9 --
 .../zookeeper/server/watch/WatchManager.java  | 115 ++++++++++--------
 .../zookeeper/server/watch/WatchStats.java    |  89 ++++++++++++++
 .../zookeeper/server/watch/WatcherMode.java   |   2 +-
 .../server/watch/WatcherModeManager.java      |  96 ---------------
 .../server/watch/RecursiveWatchQtyTest.java   |  50 ++------
 .../test/PersistentRecursiveWatcherTest.java  |  48 ++++++++
 8 files changed, 219 insertions(+), 195 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java
 delete mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index a6f60539089..603cb0b3803 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -675,7 +675,9 @@ public String getMaxPrefixWithQuota(String path) {
     public void addWatch(String basePath, Watcher watcher, int mode) {
         WatcherMode watcherMode = WatcherMode.fromZooDef(mode);
         dataWatches.addWatch(basePath, watcher, watcherMode);
-        childWatches.addWatch(basePath, watcher, watcherMode);
+        if (watcherMode != WatcherMode.PERSISTENT_RECURSIVE) {
+            childWatches.addWatch(basePath, watcher, watcherMode);
+        }
     }
 
     public byte[] getData(String path, Stat stat, Watcher watcher) throws NoNodeException {
@@ -1511,7 +1513,6 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String>
             this.dataWatches.addWatch(path, watcher, WatcherMode.PERSISTENT);
         }
         for (String path : persistentRecursiveWatches) {
-            this.childWatches.addWatch(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
             this.dataWatches.addWatch(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
index 1bc44c805a0..4eea5eca03a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
@@ -144,13 +144,4 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      *
      */
     void dumpWatches(PrintWriter pwriter, boolean byPath);
-
-    /**
-     * Return the current number of recursive watchers
-     *
-     * @return qty
-     */
-    default int getRecursiveWatchQty() {
-        return 0;
-    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
index c5b133059b2..c85c3d84639 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.watch;
 
 import java.io.PrintWriter;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
@@ -45,9 +46,9 @@ public class WatchManager implements IWatchManager {
 
     private final Map<String, Set<Watcher>> watchTable = new HashMap<>();
 
-    private final Map<Watcher, Set<String>> watch2Paths = new HashMap<>();
+    private final Map<Watcher, Map<String, WatchStats>> watch2Paths = new HashMap<>();
 
-    private final WatcherModeManager watcherModeManager = new WatcherModeManager();
+    private int recursiveWatchQty = 0;
 
     @Override
     public synchronized int size() {
@@ -84,25 +85,34 @@ public synchronized boolean addWatch(String path, Watcher watcher, WatcherMode w
         }
         list.add(watcher);
 
-        Set<String> paths = watch2Paths.get(watcher);
+        Map<String, WatchStats> paths = watch2Paths.get(watcher);
         if (paths == null) {
             // cnxns typically have many watches, so use default cap here
-            paths = new HashSet<>();
+            paths = new HashMap<>();
             watch2Paths.put(watcher, paths);
         }
 
-        watcherModeManager.setWatcherMode(watcher, path, watcherMode);
+        WatchStats stats = paths.getOrDefault(path, WatchStats.NONE);
+        WatchStats newStats = stats.addMode(watcherMode);
 
-        return paths.add(path);
+        if (newStats != stats) {
+            paths.put(path, newStats);
+            if (watcherMode.isRecursive()) {
+                ++recursiveWatchQty;
+            }
+            return true;
+        }
+
+        return false;
     }
 
     @Override
     public synchronized void removeWatcher(Watcher watcher) {
-        Set<String> paths = watch2Paths.remove(watcher);
+        Map<String, WatchStats> paths = watch2Paths.remove(watcher);
         if (paths == null) {
             return;
         }
-        for (String p : paths) {
+        for (String p : paths.keySet()) {
             Set<Watcher> list = watchTable.get(p);
             if (list != null) {
                 list.remove(watcher);
@@ -110,7 +120,11 @@ public synchronized void removeWatcher(Watcher watcher) {
                     watchTable.remove(p);
                 }
             }
-            watcherModeManager.removeWatcher(watcher, p);
+        }
+        for (WatchStats stats : paths.values()) {
+            if (stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+                --recursiveWatchQty;
+            }
         }
     }
 
@@ -123,8 +137,8 @@ public WatcherOrBitSet triggerWatch(String path, EventType type) {
     public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet supress) {
         WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path);
         Set<Watcher> watchers = new HashSet<>();
-        PathParentIterator pathParentIterator = getPathParentIterator(path);
         synchronized (this) {
+            PathParentIterator pathParentIterator = getPathParentIterator(path);
             for (String localPath : pathParentIterator.asIterable()) {
                 Set<Watcher> thisWatchers = watchTable.get(localPath);
                 if (thisWatchers == null || thisWatchers.isEmpty()) {
@@ -133,20 +147,23 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet
                 Iterator<Watcher> iterator = thisWatchers.iterator();
                 while (iterator.hasNext()) {
                     Watcher watcher = iterator.next();
-                    WatcherMode watcherMode = watcherModeManager.getWatcherMode(watcher, localPath);
-                    if (watcherMode.isRecursive()) {
-                        if (type != EventType.NodeChildrenChanged) {
-                            watchers.add(watcher);
-                        }
-                    } else if (!pathParentIterator.atParentPath()) {
+                    Map<String, WatchStats> paths = watch2Paths.getOrDefault(watcher, Collections.emptyMap());
+                    WatchStats stats = paths.get(localPath);
+                    if (stats == null) {
+                        LOG.warn("inconsistent watch table for watcher {}, {} not in path list", watcher, localPath);
+                        continue;
+                    }
+                    if (!pathParentIterator.atParentPath()) {
                         watchers.add(watcher);
-                        if (!watcherMode.isPersistent()) {
+                        WatchStats newStats = stats.removeMode(WatcherMode.STANDARD);
+                        if (newStats == WatchStats.NONE) {
                             iterator.remove();
-                            Set<String> paths = watch2Paths.get(watcher);
-                            if (paths != null) {
-                                paths.remove(localPath);
-                            }
+                            paths.remove(localPath);
+                        } else if (newStats != stats) {
+                            paths.put(localPath, newStats);
                         }
+                    } else if (stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+                        watchers.add(watcher);
                     }
                 }
                 if (thisWatchers.isEmpty()) {
@@ -199,7 +216,7 @@ public synchronized String toString() {
         sb.append(watch2Paths.size()).append(" connections watching ").append(watchTable.size()).append(" paths\n");
 
         int total = 0;
-        for (Set<String> paths : watch2Paths.values()) {
+        for (Map<String, WatchStats> paths : watch2Paths.values()) {
             total += paths.size();
         }
         sb.append("Total watches:").append(total);
@@ -219,10 +236,10 @@ public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
                 }
             }
         } else {
-            for (Entry<Watcher, Set<String>> e : watch2Paths.entrySet()) {
+            for (Entry<Watcher, Map<String, WatchStats>> e : watch2Paths.entrySet()) {
                 pwriter.print("0x");
                 pwriter.println(Long.toHexString(((ServerCnxn) e.getKey()).getSessionId()));
-                for (String path : e.getValue()) {
+                for (String path : e.getValue().keySet()) {
                     pwriter.print("\t");
                     pwriter.println(path);
                 }
@@ -232,31 +249,28 @@ public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
 
     @Override
     public synchronized boolean containsWatcher(String path, Watcher watcher) {
-        WatcherMode watcherMode = watcherModeManager.getWatcherMode(watcher, path);
-        PathParentIterator pathParentIterator = getPathParentIterator(path);
-        for (String localPath : pathParentIterator.asIterable()) {
-            Set<Watcher> watchers = watchTable.get(localPath);
-            if (!pathParentIterator.atParentPath()) {
-                if (watchers != null) {
-                    return true;    // at the leaf node, all watcher types match
-                }
-            }
-            if (watcherMode.isRecursive()) {
-                return true;
-            }
-        }
-        return false;
+        Set<Watcher> list = watchTable.get(path);
+        return list != null && list.contains(watcher);
     }
 
     @Override
     public synchronized boolean removeWatcher(String path, Watcher watcher) {
-        Set<String> paths = watch2Paths.get(watcher);
-        if (paths == null || !paths.remove(path)) {
+        Map<String, WatchStats> paths = watch2Paths.get(watcher);
+        if (paths == null) {
             return false;
         }
 
+        WatchStats stats = paths.remove(path);
+        if (stats == null) {
+            return false;
+        }
+        if (stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+            --recursiveWatchQty;
+        }
+
         Set<Watcher> list = watchTable.get(path);
         if (list == null || !list.remove(watcher)) {
+            LOG.warn("inconsistent watch table for path {}, {} not in watcher list", path, watcher);
             return false;
         }
 
@@ -264,17 +278,20 @@ public synchronized boolean removeWatcher(String path, Watcher watcher) {
             watchTable.remove(path);
         }
 
-        watcherModeManager.removeWatcher(watcher, path);
-
         return true;
     }
 
+    // VisibleForTesting
+    Map<Watcher, Map<String, WatchStats>> getWatch2Paths() {
+        return watch2Paths;
+    }
+
     @Override
     public synchronized WatchesReport getWatches() {
         Map<Long, Set<String>> id2paths = new HashMap<>();
-        for (Entry<Watcher, Set<String>> e : watch2Paths.entrySet()) {
+        for (Entry<Watcher, Map<String, WatchStats>> e : watch2Paths.entrySet()) {
             Long id = ((ServerCnxn) e.getKey()).getSessionId();
-            Set<String> paths = new HashSet<>(e.getValue());
+            Set<String> paths = new HashSet<>(e.getValue().keySet());
             id2paths.put(id, paths);
         }
         return new WatchesReport(id2paths);
@@ -296,7 +313,7 @@ public synchronized WatchesPathReport getWatchesByPath() {
     @Override
     public synchronized WatchesSummary getWatchesSummary() {
         int totalWatches = 0;
-        for (Set<String> paths : watch2Paths.values()) {
+        for (Map<String, WatchStats> paths : watch2Paths.values()) {
             totalWatches += paths.size();
         }
         return new WatchesSummary(watch2Paths.size(), watchTable.size(), totalWatches);
@@ -305,13 +322,13 @@ public synchronized WatchesSummary getWatchesSummary() {
     @Override
     public void shutdown() { /* do nothing */ }
 
-    @Override
-    public int getRecursiveWatchQty() {
-        return watcherModeManager.getRecursiveQty();
+    // VisibleForTesting
+    synchronized int getRecursiveWatchQty() {
+        return recursiveWatchQty;
     }
 
     private PathParentIterator getPathParentIterator(String path) {
-        if (watcherModeManager.getRecursiveQty() == 0) {
+        if (getRecursiveWatchQty() == 0) {
             return PathParentIterator.forPathOnly(path);
         }
         return PathParentIterator.forAll(path);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java
new file mode 100644
index 00000000000..fd0c0259edd
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.watch;
+
+/**
+ * Statistics for multiple different watches on one node.
+ */
+public final class WatchStats {
+    private static final WatchStats[] WATCH_STATS = new WatchStats[] {
+            new WatchStats(0), // NONE
+            new WatchStats(1), // STANDARD
+            new WatchStats(2), // PERSISTENT
+            new WatchStats(3), // STANDARD + PERSISTENT
+            new WatchStats(4), // PERSISTENT_RECURSIVE
+            new WatchStats(5), // STANDARD + PERSISTENT_RECURSIVE
+            new WatchStats(6), // PERSISTENT + PERSISTENT_RECURSIVE
+            new WatchStats(7), // STANDARD + PERSISTENT + PERSISTENT_RECURSIVE
+    };
+
+    /**
+     * Stats that have no watchers attached.
+     *
+     * <p>This could be used as start point to compute new stats using {@link #addMode(WatcherMode)}.
+     */
+    public static final WatchStats NONE = WATCH_STATS[0];
+
+    private final int flags;
+
+    private WatchStats(int flags) {
+        this.flags = flags;
+    }
+
+    private static int modeToFlag(WatcherMode mode) {
+        return 1 << mode.ordinal();
+    }
+
+    /**
+     * Compute stats after given mode attached to node.
+     *
+     * @param mode watcher mode
+     * @return a new stats if given mode is not attached to this node before, otherwise old stats
+     */
+    public WatchStats addMode(WatcherMode mode) {
+        int flags = this.flags | modeToFlag(mode);
+        return WATCH_STATS[flags];
+    }
+
+    /**
+     * Compute stats after given mode removed from node.
+     *
+     * @param mode watcher mode
+     * @return null if given mode is the last attached mode, otherwise a new stats
+     */
+    public WatchStats removeMode(WatcherMode mode) {
+        int mask = ~modeToFlag(mode);
+        int flags = this.flags & mask;
+        if (flags == 0) {
+            return NONE;
+        }
+        return WATCH_STATS[flags];
+    }
+
+    /**
+     * Check whether given mode is attached to this node.
+     *
+     * @param mode watcher mode
+     * @return true if given mode is attached to this node.
+     */
+    public boolean hasMode(WatcherMode mode) {
+        int flags = modeToFlag(mode);
+        return (this.flags & flags) != 0;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java
index b8a1dda7408..e05ba900e51 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java
@@ -23,7 +23,7 @@
 public enum WatcherMode {
     STANDARD(false, false),
     PERSISTENT(true, false),
-    PERSISTENT_RECURSIVE(true, true)
+    PERSISTENT_RECURSIVE(true, true),
     ;
 
     public static final WatcherMode DEFAULT_WATCHER_MODE = WatcherMode.STANDARD;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java
deleted file mode 100644
index c1a8225f8ae..00000000000
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java
+++ /dev/null
@@ -1,96 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- * <p>
- * http://www.apache.org/licenses/LICENSE-2.0
- * <p>
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper.server.watch;
-
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.atomic.AtomicInteger;
-import org.apache.zookeeper.Watcher;
-
-class WatcherModeManager {
-    private final Map<Key, WatcherMode> watcherModes = new ConcurrentHashMap<>();
-    private final AtomicInteger recursiveQty = new AtomicInteger(0);
-
-    private static class Key {
-        private final Watcher watcher;
-        private final String path;
-
-        Key(Watcher watcher, String path) {
-            this.watcher = watcher;
-            this.path = path;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) {
-                return true;
-            }
-            if (o == null || getClass() != o.getClass()) {
-                return false;
-            }
-            Key key = (Key) o;
-            return watcher.equals(key.watcher) && path.equals(key.path);
-        }
-
-        @Override
-        public int hashCode() {
-            return Objects.hash(watcher, path);
-        }
-    }
-
-    // VisibleForTesting
-    Map<Key, WatcherMode> getWatcherModes() {
-        return watcherModes;
-    }
-
-    void setWatcherMode(Watcher watcher, String path, WatcherMode mode) {
-        if (mode == WatcherMode.DEFAULT_WATCHER_MODE) {
-            removeWatcher(watcher, path);
-        } else {
-            adjustRecursiveQty(watcherModes.put(new Key(watcher, path), mode), mode);
-        }
-    }
-
-    WatcherMode getWatcherMode(Watcher watcher, String path) {
-        return watcherModes.getOrDefault(new Key(watcher, path), WatcherMode.DEFAULT_WATCHER_MODE);
-    }
-
-    void removeWatcher(Watcher watcher, String path) {
-        adjustRecursiveQty(watcherModes.remove(new Key(watcher, path)), WatcherMode.DEFAULT_WATCHER_MODE);
-    }
-
-    int getRecursiveQty() {
-        return recursiveQty.get();
-    }
-
-    // recursiveQty is an optimization to avoid having to walk the map every time this value is needed
-    private void adjustRecursiveQty(WatcherMode oldMode, WatcherMode newMode) {
-        if (oldMode == null) {
-            oldMode = WatcherMode.DEFAULT_WATCHER_MODE;
-        }
-        if (oldMode.isRecursive() != newMode.isRecursive()) {
-            if (newMode.isRecursive()) {
-                recursiveQty.incrementAndGet();
-            } else {
-                recursiveQty.decrementAndGet();
-            }
-        }
-    }
-}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
index 78b13bb3348..0582ddafc84 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
@@ -51,28 +51,6 @@ public void setup() {
         watchManager = new WatchManager();
     }
 
-    @Test
-    public void testRecursiveQty() {
-        WatcherModeManager manager = new WatcherModeManager();
-        DummyWatcher watcher = new DummyWatcher();
-        manager.setWatcherMode(watcher, "/a", WatcherMode.DEFAULT_WATCHER_MODE);
-        assertEquals(0, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(1, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(2, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(2, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.PERSISTENT);
-        assertEquals(1, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(2, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.DEFAULT_WATCHER_MODE);
-        assertEquals(1, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a", WatcherMode.PERSISTENT);
-        assertEquals(0, manager.getRecursiveQty());
-    }
-
     @Test
     public void testAddRemove() {
         Watcher watcher1 = new DummyWatcher();
@@ -125,7 +103,7 @@ public void testSameWatcherMultiPath() {
     }
 
     @Test
-    public void testChangeType() {
+    public void testDifferentWatchModes() {
         Watcher watcher = new DummyWatcher();
 
         watchManager.addWatch("/a", watcher, WatcherMode.PERSISTENT);
@@ -133,15 +111,14 @@ public void testChangeType() {
         watchManager.addWatch("/a", watcher, WatcherMode.PERSISTENT_RECURSIVE);
         assertEquals(1, watchManager.getRecursiveWatchQty());
         watchManager.addWatch("/a", watcher, WatcherMode.STANDARD);
-        assertEquals(0, watchManager.getRecursiveWatchQty());
+        assertEquals(1, watchManager.getRecursiveWatchQty());
         assertTrue(watchManager.removeWatcher("/a", watcher));
         assertEquals(0, watchManager.getRecursiveWatchQty());
     }
 
     @Test
-    public void testRecursiveQtyConcurrency() {
-        ThreadLocalRandom random = ThreadLocalRandom.current();
-        WatcherModeManager manager = new WatcherModeManager();
+    public void testRecursiveQtyConcurrency() throws Exception {
+        WatchManager manager = new WatchManager();
         ExecutorService threadPool = Executors.newFixedThreadPool(clientQty);
         List<Future<?>> tasks = null;
         CountDownLatch completedLatch = new CountDownLatch(clientQty);
@@ -149,11 +126,7 @@ public void testRecursiveQtyConcurrency() {
             tasks = IntStream.range(0, clientQty)
                     .mapToObj(__ -> threadPool.submit(() -> iterate(manager, completedLatch)))
                     .collect(Collectors.toList());
-            try {
-                completedLatch.await();
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-            }
+            completedLatch.await();
         } finally {
             if (tasks != null) {
                 tasks.forEach(t -> t.cancel(true));
@@ -161,14 +134,15 @@ public void testRecursiveQtyConcurrency() {
             threadPool.shutdownNow();
         }
 
-        int expectedRecursiveQty = (int) manager.getWatcherModes().values()
+        int expectedRecursiveQty = (int) manager.getWatch2Paths().values()
                 .stream()
-                .filter(mode -> mode == WatcherMode.PERSISTENT_RECURSIVE)
+                .flatMap(paths -> paths.values().stream())
+                .filter(stats -> stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE))
                 .count();
-        assertEquals(expectedRecursiveQty, manager.getRecursiveQty());
+        assertEquals(expectedRecursiveQty, manager.getRecursiveWatchQty());
     }
 
-    private void iterate(WatcherModeManager manager, CountDownLatch completedLatch) {
+    private void iterate(WatchManager manager, CountDownLatch completedLatch) {
         ThreadLocalRandom random = ThreadLocalRandom.current();
         try {
             for (int i = 0; i < iterations; ++i) {
@@ -176,9 +150,9 @@ private void iterate(WatcherModeManager manager, CountDownLatch completedLatch)
                 boolean doSet = random.nextInt(100) > 33;    // 2/3 will be sets
                 if (doSet) {
                     WatcherMode mode = WatcherMode.values()[random.nextInt(WatcherMode.values().length)];
-                    manager.setWatcherMode(new DummyWatcher(), path, mode);
+                    manager.addWatch(path, new DummyWatcher(), mode);
                 } else {
-                    manager.removeWatcher(new DummyWatcher(), path);
+                    manager.removeWatcher(path, new DummyWatcher());
                 }
 
                 int sleepMillis = random.nextInt(2);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index e74ee2fd683..077af3c456c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.test;
 
+import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT_RECURSIVE;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -171,6 +172,53 @@ public void testMultiClient()
         }
     }
 
+    @Test
+    public void testSamePathWithDifferentWatchModes() throws Exception {
+        try (ZooKeeper zk = createClient()) {
+            BlockingQueue<WatchedEvent> dataEvents = new LinkedBlockingQueue<>();
+            BlockingQueue<WatchedEvent> childEvents = new LinkedBlockingQueue<>();
+            BlockingQueue<WatchedEvent> persistentEvents = new LinkedBlockingQueue<>();
+            BlockingQueue<WatchedEvent> recursiveEvents = new LinkedBlockingQueue<>();
+
+            zk.addWatch("/a", persistentEvents::add, PERSISTENT);
+            zk.addWatch("/a", recursiveEvents::add, PERSISTENT_RECURSIVE);
+            zk.exists("/a", dataEvents::add);
+
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeCreated, "/a");
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeCreated, "/a");
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a");
+
+            zk.getData("/a", dataEvents::add, null);
+            zk.setData("/a", new byte[0], -1);
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDataChanged, "/a");
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDataChanged, "/a");
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDataChanged, "/a");
+
+            zk.getChildren("/a", childEvents::add);
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a/b");
+
+            zk.getChildren("/a", childEvents::add);
+            zk.delete("/a/b", -1);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a/b");
+
+            zk.getChildren("/a", childEvents::add);
+            zk.getData("/a", dataEvents::add, null);
+            zk.exists("/a", dataEvents::add);
+            zk.delete("/a", -1);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeDeleted, "/a");
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a");
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a");
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDeleted, "/a");
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a");
+        }
+    }
+
     @Test
     public void testRootWatcher()
             throws IOException, InterruptedException, KeeperException {

From 628583a473545b7b3381d011faf0c0209ac0d126 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Tue, 13 Jun 2023 09:06:22 +0800
Subject: [PATCH 365/591] ZOOKEEPER-3411 Cleanup more references to removed ls2
 and rmr command (#2000)

This is a follow-up to #1175.

Signed-off-by: tison <wander4096@gmail.com>
---
 zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md b/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
index e44aae8cf0b..a33e83c33b4 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
@@ -162,13 +162,11 @@ From the shell, type `help` to get a listing of commands that can be executed fr
 	history
 	listquota path
 	ls [-s] [-w] [-R] path
-	ls2 path [watch]
 	printwatches on|off
 	quit
 	reconfig [-s] [-v version] [[-file path] | [-members serverID=host:port1:port2;port3[,...]*]] | [-add serverId=host:port1:port2;port3[,...]]* [-remove serverId[,...]*]
 	redo cmdno
 	removewatches path [-c|-d|-a] [-l]
-	rmr path
 	set [-s] [-v version] path data
 	setAcl [-s] [-v version] [-R] path acl
 	setquota -n|-b val path

From b8d458f5c46cb3064d4a56f471d441011a558991 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Tue, 13 Jun 2023 21:13:33 +0800
Subject: [PATCH 366/591] ZOOKEEPER-4471: Match removing WatcherType to
 standard, persistent modes (#1998)

* ZOOKEEPER-4471: Match removing WatcherType to standard, persistent modes

Before ZOOKEEPER-1416, `WatcherType.Children` was used to remove
watchers attached through `ZooKeeper.getChildren`. `WatcherType.Data`
was used to remove watchers attached through `ZooKeeper.getData` and
`ZooKeeper.exists`.

ZOOKEEPER-1416 adds `AddWatchMode.PERSISTENT`. This watcher could be
completed remove using `WatcherType.Any`. But when removing through
`WatcherType.Data` or `WatcherType.Children`, part of
`AddWatchMode.PERSISTENT` will be left behind. And we get persistent
children or data watchers.

We are never claiming to support these type of watchers. So fix it.

In rare chance, we are going to support persistent data or children
watchers in future, I think we probably don't want to do such "magic"
thing in ZooKeeper. So fix it.

This is a step towards ZOOKEEPER-4472 which proposed to support
`WatcherType.Persistent` and `WatcherType.PersistentRecursive` to remove
persistent watchers.

* Refactor newly added tests in WatchManagerTest

I found it somewhat hard to follow in self-review. Add given-when-then
comments from my best hope for reviewing and maintenance.
---
 .../org/apache/zookeeper/server/DataTree.java |  16 +-
 .../zookeeper/server/watch/IWatchManager.java |  31 ++
 .../zookeeper/server/watch/WatchManager.java  |  57 +++-
 .../apache/zookeeper/RemoveWatchesTest.java   |  69 ++++
 .../server/watch/WatchManagerTest.java        | 313 ++++++++++++++++++
 5 files changed, 466 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 603cb0b3803..c6e2ff45693 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -1558,16 +1558,16 @@ public boolean containsWatcher(String path, WatcherType type, Watcher watcher) {
         boolean containsWatcher = false;
         switch (type) {
         case Children:
-            containsWatcher = this.childWatches.containsWatcher(path, watcher);
+            containsWatcher = this.childWatches.containsWatcher(path, watcher, WatcherMode.STANDARD);
             break;
         case Data:
-            containsWatcher = this.dataWatches.containsWatcher(path, watcher);
+            containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.STANDARD);
             break;
         case Any:
-            if (this.childWatches.containsWatcher(path, watcher)) {
+            if (this.childWatches.containsWatcher(path, watcher, null)) {
                 containsWatcher = true;
             }
-            if (this.dataWatches.containsWatcher(path, watcher)) {
+            if (this.dataWatches.containsWatcher(path, watcher, null)) {
                 containsWatcher = true;
             }
             break;
@@ -1579,16 +1579,16 @@ public boolean removeWatch(String path, WatcherType type, Watcher watcher) {
         boolean removed = false;
         switch (type) {
         case Children:
-            removed = this.childWatches.removeWatcher(path, watcher);
+            removed = this.childWatches.removeWatcher(path, watcher, WatcherMode.STANDARD);
             break;
         case Data:
-            removed = this.dataWatches.removeWatcher(path, watcher);
+            removed = this.dataWatches.removeWatcher(path, watcher, WatcherMode.STANDARD);
             break;
         case Any:
-            if (this.childWatches.removeWatcher(path, watcher)) {
+            if (this.childWatches.removeWatcher(path, watcher, null)) {
                 removed = true;
             }
-            if (this.dataWatches.removeWatcher(path, watcher)) {
+            if (this.dataWatches.removeWatcher(path, watcher, null)) {
                 removed = true;
             }
             break;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
index 4eea5eca03a..c3900eb64e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.watch;
 
 import java.io.PrintWriter;
+import javax.annotation.Nullable;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 
@@ -60,6 +61,21 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      */
     boolean containsWatcher(String path, Watcher watcher);
 
+    /**
+     * Checks the specified watcher exists for the given path and mode.
+     *
+     * @param path znode path
+     * @param watcher watcher object reference
+     * @param watcherMode watcher mode, null for any mode
+     * @return true if the watcher exists, false otherwise
+     */
+    default boolean containsWatcher(String path, Watcher watcher, @Nullable WatcherMode watcherMode) {
+        if (watcherMode == null || watcherMode == WatcherMode.DEFAULT_WATCHER_MODE) {
+            return containsWatcher(path, watcher);
+        }
+        throw new UnsupportedOperationException("persistent watch");
+    }
+
     /**
      * Removes the specified watcher for the given path.
      *
@@ -70,6 +86,21 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      */
     boolean removeWatcher(String path, Watcher watcher);
 
+    /**
+     * Removes the specified watcher for the given path and mode.
+     *
+     * @param path znode path
+     * @param watcher watcher object reference
+     * @param watcherMode watcher mode, null to remove all modes
+     * @return true if the watcher successfully removed, false otherwise
+     */
+    default boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherMode) {
+        if (watcherMode == null || watcherMode == WatcherMode.DEFAULT_WATCHER_MODE) {
+            return removeWatcher(path, watcher);
+        }
+        throw new UnsupportedOperationException("persistent watch");
+    }
+
     /**
      * The entry to remove the watcher when the cnxn is closed.
      *
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
index c85c3d84639..6e9a3a52bb0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
@@ -249,36 +249,69 @@ public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
 
     @Override
     public synchronized boolean containsWatcher(String path, Watcher watcher) {
-        Set<Watcher> list = watchTable.get(path);
-        return list != null && list.contains(watcher);
+        return containsWatcher(path, watcher, null);
     }
 
     @Override
-    public synchronized boolean removeWatcher(String path, Watcher watcher) {
+    public synchronized boolean containsWatcher(String path, Watcher watcher, WatcherMode watcherMode) {
         Map<String, WatchStats> paths = watch2Paths.get(watcher);
         if (paths == null) {
             return false;
         }
+        WatchStats stats = paths.get(path);
+        return stats != null && (watcherMode == null || stats.hasMode(watcherMode));
+    }
 
+    private WatchStats unwatch(String path, Watcher watcher, Map<String, WatchStats> paths, Set<Watcher> watchers) {
         WatchStats stats = paths.remove(path);
         if (stats == null) {
-            return false;
+            return WatchStats.NONE;
         }
-        if (stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
-            --recursiveWatchQty;
+        if (paths.isEmpty()) {
+            watch2Paths.remove(watcher);
+        }
+        watchers.remove(watcher);
+        if (watchers.isEmpty()) {
+            watchTable.remove(path);
         }
+        return stats;
+    }
 
-        Set<Watcher> list = watchTable.get(path);
-        if (list == null || !list.remove(watcher)) {
-            LOG.warn("inconsistent watch table for path {}, {} not in watcher list", path, watcher);
+    @Override
+    public synchronized boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherMode) {
+        Map<String, WatchStats> paths = watch2Paths.get(watcher);
+        Set<Watcher> watchers = watchTable.get(path);
+        if (paths == null || watchers == null) {
             return false;
         }
 
-        if (list.isEmpty()) {
-            watchTable.remove(path);
+        WatchStats oldStats;
+        WatchStats newStats;
+        if (watcherMode != null) {
+            oldStats = paths.getOrDefault(path, WatchStats.NONE);
+            newStats = oldStats.removeMode(watcherMode);
+            if (newStats != WatchStats.NONE) {
+                if (newStats != oldStats) {
+                    paths.put(path, newStats);
+                }
+            } else if (oldStats != WatchStats.NONE) {
+                unwatch(path, watcher, paths, watchers);
+            }
+        } else {
+            oldStats = unwatch(path, watcher, paths, watchers);
+            newStats = WatchStats.NONE;
         }
 
-        return true;
+        if (oldStats.hasMode(WatcherMode.PERSISTENT_RECURSIVE) && !newStats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+            --recursiveWatchQty;
+        }
+
+        return oldStats != newStats;
+    }
+
+    @Override
+    public synchronized boolean removeWatcher(String path, Watcher watcher) {
+        return removeWatcher(path, watcher, null);
     }
 
     // VisibleForTesting
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index 945b87cb0ae..a5de63596da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -34,7 +34,10 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.BlockingDeque;
+import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.LinkedBlockingDeque;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import org.apache.commons.collections4.CollectionUtils;
@@ -847,11 +850,35 @@ public void testRemoveAllDataWatchesOnAPath(boolean useAsync) throws Exception {
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
         assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
 
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
         assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is not a watcher");
         removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.OK, useAsync);
         assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
 
         assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is still a watcher after removal");
+
+        zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1/child", new byte[0], -1);
+        zk1.delete("/node1/child", -1);
+        zk1.setData("/node1", new byte[0], -1);
+        zk1.delete("/node1", -1);
+
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDeleted, "/node1");
+
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1/child");
+        assertEvent(recursiveEvents, EventType.NodeDeleted, "/node1/child");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeDeleted, "/node1");
+
+        assertEquals(2, dWatchCount.getCount(), "Received watch notification after removal!");
     }
 
     /**
@@ -895,11 +922,27 @@ public void testRemoveAllChildWatchesOnAPath(boolean useAsync) throws Exception
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
 
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+
         assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is not a watcher");
         removeAllWatches(zk2, "/node1", WatcherType.Children, false, Code.OK, useAsync);
         assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove child watcher");
 
         assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is still a watcher after removal");
+
+        zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1/child", new byte[0], -1);
+        zk1.delete("/node1/child", -1);
+        zk1.setData("/node1", new byte[0], -1);
+        zk1.delete("/node1", -1);
+
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDeleted, "/node1");
+
+        assertEquals(2, cWatchCount.getCount(), "Received watch notification after removal!");
     }
 
     /**
@@ -953,10 +996,26 @@ public void testRemoveAllWatchesOnAPath(boolean useAsync) throws Exception {
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
         assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
 
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Any), "Server session is not a watcher");
         assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is not a watcher");
+        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is not a watcher");
         removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.OK, useAsync);
         assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
+        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Any), "Server session is still a watcher after removal");
         assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is still a watcher after removal");
+        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is still a watcher after removal");
+
+        assertEvent(persistentEvents, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents, EventType.PersistentWatchRemoved, "/node1");
+
+        zk1.delete("/node1", -1);
+        assertNull(persistentEvents.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(recursiveEvents.poll(10, TimeUnit.MILLISECONDS));
         assertEquals(2, watchCount.getCount(), "Received watch notification after removal!");
     }
 
@@ -1090,4 +1149,14 @@ private boolean isServerSessionWatcher(long sessionId, String path, WatcherType
         return false;
     }
 
+    /**
+     * Asserts next event from queue has given event type and path.
+     */
+    private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
+            throws InterruptedException {
+        WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
+        assertNotNull(event);
+        assertEquals(eventType, event.getType());
+        assertEquals(path, event.getPath());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
index f65391c497c..5f40ef3559d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
@@ -19,6 +19,7 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.ArrayList;
@@ -38,6 +39,7 @@
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
@@ -342,6 +344,317 @@ public void testRemoveWatcherOnPath(String className) throws IOException {
         assertEquals(watchesAdded.get(), watchesRemoved.get() + manager.size());
     }
 
+    /**
+     * Test add, contains and remove on generic watch manager.
+     */
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testAddRemoveWatcher(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1"
+        manager.addWatch("/node1", watcher1);
+
+        // then: contains or remove should fail on mismatch path and watcher pair
+        assertFalse(manager.containsWatcher("/node1", watcher2));
+        assertFalse(manager.containsWatcher("/node2", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher2));
+        assertFalse(manager.removeWatcher("/node2", watcher1));
+
+        // then: contains or remove should succeed on matching path and watcher pair
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.removeWatcher("/node1", watcher1));
+
+        // then: contains or remove should fail on removed path and watcher pair
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+    }
+
+    /**
+     * Test containsWatcher on all pairs, and removeWatcher on mismatch pairs.
+     */
+    @Test
+    public void testContainsMode() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in persistent mode
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertNotEquals(WatcherMode.PERSISTENT, WatcherMode.DEFAULT_WATCHER_MODE);
+
+        // then: contains should succeed on watcher1 to "/node1" in persistent and any mode
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+
+        // then: contains and remove should fail on mismatch watcher
+        assertFalse(manager.containsWatcher("/node1", watcher2));
+        assertFalse(manager.containsWatcher("/node1", watcher2, null));
+        assertFalse(manager.containsWatcher("/node1", watcher2, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher2, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher2));
+        assertFalse(manager.removeWatcher("/node1", watcher2, null));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should fail on mismatch path
+        assertFalse(manager.containsWatcher("/node2", watcher1));
+        assertFalse(manager.containsWatcher("/node2", watcher1, null));
+        assertFalse(manager.containsWatcher("/node2", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node2", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node2", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node2", watcher1));
+        assertFalse(manager.removeWatcher("/node2", watcher1, null));
+        assertFalse(manager.removeWatcher("/node2", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node2", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node2", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should fail on mismatch modes
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: add watcher1 to "/node1" in remaining modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains should succeed on watcher to "/node1" in all modes
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test repeatedly {@link WatchManager#addWatch(String, Watcher, WatcherMode)}.
+     */
+    @Test
+    public void testAddModeRepeatedly() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        manager.addWatch("/node1", watcher1, WatcherMode.STANDARD);
+        manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT);
+        manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE);
+
+        // when: add watcher1 to "/node1" in these modes repeatedly
+        assertFalse(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should work normally on watcher1 to "/node1"
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} on one pair should not break others.
+     */
+    @Test
+    public void testRemoveModeOne() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" and watcher2 to "/node2" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove one pair
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+
+        // then: contains and remove should succeed on other pairs
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.removeWatcher("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.removeWatcher("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} with {@code null} watcher mode.
+     */
+    @Test
+    public void testRemoveModeAll() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove watcher1 using null watcher mode
+        assertTrue(manager.removeWatcher("/node1", watcher1, null));
+
+        // then: contains and remove should fail on watcher1 to "/node1" in all modes
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: remove watcher1 without a mode should behave same to removing all modes
+        assertTrue(manager.removeWatcher("/node1", watcher1));
+
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher)}.
+     */
+    @Test
+    public void testRemoveModeAllDefault() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: remove watcher1 without a mode should behave same to removing all modes
+        assertTrue(manager.removeWatcher("/node1", watcher1));
+
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} all modes individually.
+     */
+    @Test
+    public void testRemoveModeAllIndividually() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove all modes individually
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should fail on watcher1 to "/node1" in all modes
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} on mismatch pair should break nothing.
+     */
+    @Test
+    public void testRemoveModeMismatch() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" and watcher2 to "/node2" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove mismatch path and watcher pairs
+        assertFalse(manager.removeWatcher("/node1", watcher2));
+        assertFalse(manager.removeWatcher("/node1", watcher2, null));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: no existing watching pairs should break
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.containsWatcher("/node2", watcher2));
+        assertTrue(manager.containsWatcher("/node2", watcher2, null));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
     /**
      * Concurrently add watch while close the watcher to simulate the
      * client connections closed on prod.

From 3702a45459b4946d3c45d29c6f201077b66bf2ea Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Wed, 14 Jun 2023 14:58:35 +0200
Subject: [PATCH 367/591] ZOOKEEPER-3860: Avoid reverse DNS lookup for hostname
 verification when hostnames are provided in the connection url

Instead of altering the behaviour of `ZKTrustManager`, I'll add the following improvements:

1. `NetUtils.formatInetAddr()` should prefer using the hostname of resolved addresses when converting InetSocketAddress to String. Previously it only picked the hostname if address was missing, e.g. the hostname was unresolved. This change has the advantage of sending the hostname in the InitialMessage instead of the IP address, which will help avoiding unnecessary reverse DNS lookups in the election protocol when TLS is enabled.

2. Add extra debug logs to `ZKTrustManager` and remove logging the exception stack trace when IP verification failed. Logging of stack traces makes sense to me in error log entries only. Many times we hit into this when user turns on debug logging, seeing a big stack trace and believes it's an error in ZooKeeper.

Target branches: master, branch-3.8

Author: Andor Molnar <andor@cloudera.com>

Reviewers: eolivelli@apache.org

Closes #2005 from anmolnar/ZOOKEEPER-3860
---
 .../org/apache/zookeeper/common/NetUtils.java | 15 +++----
 .../zookeeper/common/ZKTrustManager.java      | 40 ++++++++++++++-----
 .../apache/zookeeper/common/NetUtilsTest.java |  6 +--
 3 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
index be8cb9a6389..a02499a6877 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
@@ -27,17 +27,18 @@
  */
 public class NetUtils {
 
+    /**
+     * Prefer using the hostname for formatting, but without requesting reverse DNS lookup.
+     * Fall back to IP address if hostname is unavailable and use [] brackets for IPv6 literal.
+     */
     public static String formatInetAddr(InetSocketAddress addr) {
+        String hostString = addr.getHostString();
         InetAddress ia = addr.getAddress();
 
-        if (ia == null) {
-            return String.format("%s:%s", addr.getHostString(), addr.getPort());
-        }
-
-        if (ia instanceof Inet6Address) {
-            return String.format("[%s]:%s", ia.getHostAddress(), addr.getPort());
+        if (ia instanceof Inet6Address && hostString.contains(":")) {
+            return String.format("[%s]:%s", hostString, addr.getPort());
         } else {
-            return String.format("%s:%s", ia.getHostAddress(), addr.getPort());
+            return String.format("%s:%s", hostString, addr.getPort());
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
index 2573e3fcead..cbadd1e0af9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
@@ -39,11 +39,11 @@ public class ZKTrustManager extends X509ExtendedTrustManager {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZKTrustManager.class);
 
-    private X509ExtendedTrustManager x509ExtendedTrustManager;
-    private boolean serverHostnameVerificationEnabled;
-    private boolean clientHostnameVerificationEnabled;
+    private final X509ExtendedTrustManager x509ExtendedTrustManager;
+    private final boolean serverHostnameVerificationEnabled;
+    private final boolean clientHostnameVerificationEnabled;
 
-    private ZKHostnameVerifier hostnameVerifier;
+    private final ZKHostnameVerifier hostnameVerifier;
 
     /**
      * Instantiate a new ZKTrustManager.
@@ -87,6 +87,9 @@ public void checkClientTrusted(
         Socket socket) throws CertificateException {
         x509ExtendedTrustManager.checkClientTrusted(chain, authType, socket);
         if (clientHostnameVerificationEnabled) {
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Check client trusted socket.getInetAddress(): {}, {}", socket.getInetAddress(), socket);
+            }
             performHostVerification(socket.getInetAddress(), chain[0]);
         }
     }
@@ -98,6 +101,9 @@ public void checkServerTrusted(
         Socket socket) throws CertificateException {
         x509ExtendedTrustManager.checkServerTrusted(chain, authType, socket);
         if (serverHostnameVerificationEnabled) {
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Check server trusted socket.getInetAddress(): {}, {}", socket.getInetAddress(), socket);
+            }
             performHostVerification(socket.getInetAddress(), chain[0]);
         }
     }
@@ -110,6 +116,9 @@ public void checkClientTrusted(
         x509ExtendedTrustManager.checkClientTrusted(chain, authType, engine);
         if (clientHostnameVerificationEnabled) {
             try {
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug("Check client trusted engine.getPeerHost(): {}, {}", engine.getPeerHost(), engine);
+                }
                 performHostVerification(InetAddress.getByName(engine.getPeerHost()), chain[0]);
             } catch (UnknownHostException e) {
                 throw new CertificateException("Failed to verify host", e);
@@ -126,6 +135,9 @@ public void checkServerTrusted(
         x509ExtendedTrustManager.checkServerTrusted(chain, authType, engine);
         if (serverHostnameVerificationEnabled) {
             try {
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug("Check server trusted engine.getPeerHost(): {}, {}", engine.getPeerHost(), engine);
+                }
                 performHostVerification(InetAddress.getByName(engine.getPeerHost()), chain[0]);
             } catch (UnknownHostException e) {
                 throw new CertificateException("Failed to verify host", e);
@@ -144,9 +156,12 @@ public void checkServerTrusted(X509Certificate[] chain, String authType) throws
     }
 
     /**
-     * Compares peer's hostname with the one stored in the provided client certificate. Performs verification
+     * Compares peer's hostname with the one stored in the provided certificate. Performs verification
      * with the help of provided HostnameVerifier.
      *
+     * Attempts to verify the IP address first, if it fails, check the hostname. Performs reverse DNS lookup
+     * if hostname is not available. (Mostly the case in client verifications.)
+     *
      * @param inetAddress Peer's inet address.
      * @param certificate Peer's certificate
      * @throws CertificateException Thrown if the provided certificate doesn't match the peer hostname.
@@ -154,19 +169,23 @@ public void checkServerTrusted(X509Certificate[] chain, String authType) throws
     private void performHostVerification(
         InetAddress inetAddress,
         X509Certificate certificate
-                                        ) throws CertificateException {
+    ) throws CertificateException {
         String hostAddress = "";
         String hostName = "";
         try {
             hostAddress = inetAddress.getHostAddress();
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Trying to verify host address first: {}", hostAddress);
+            }
             hostnameVerifier.verify(hostAddress, certificate);
         } catch (SSLException addressVerificationException) {
             try {
-                LOG.debug(
-                    "Failed to verify host address: {} attempting to verify host name with reverse dns lookup",
-                    hostAddress,
-                    addressVerificationException);
                 hostName = inetAddress.getHostName();
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug(
+                        "Failed to verify host address: {}, trying to verify host name: {}",
+                        hostAddress, hostName);
+                }
                 hostnameVerifier.verify(hostName, certificate);
             } catch (SSLException hostnameVerificationException) {
                 LOG.error("Failed to verify host address: {}", hostAddress, addressVerificationException);
@@ -175,5 +194,4 @@ private void performHostVerification(
             }
         }
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
index a7006bf7053..fbe49221470 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.common;
 
-import static org.hamcrest.CoreMatchers.anyOf;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -40,7 +39,7 @@ public class NetUtilsTest extends ZKTestCase {
     @Test
     public void testFormatInetAddrGoodIpv4() {
         InetSocketAddress isa = new InetSocketAddress(v4addr, port);
-        assertEquals("127.0.0.1:1234", NetUtils.formatInetAddr(isa));
+        assertEquals(v4local, NetUtils.formatInetAddr(isa));
     }
 
     @Test
@@ -60,8 +59,7 @@ public void testFormatInetAddrGoodIpv6Ext() {
     @Test
     public void testFormatInetAddrGoodHostname() {
         InetSocketAddress isa = new InetSocketAddress("localhost", 1234);
-
-        assertThat(NetUtils.formatInetAddr(isa), anyOf(equalTo(v4local), equalTo(v6local)));
+        assertThat(NetUtils.formatInetAddr(isa), equalTo("localhost:1234"));
     }
 
     @Test

From e8b2fbeb101e22378aa47df291cc9ca6e58e1e8d Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Thu, 15 Jun 2023 13:14:22 +0800
Subject: [PATCH 368/591] ZOOKEEPER-4472: Remove persistent watches
 individually  (#2006)

* ZOOKEEPER-4472: Remove persistent watches individually

ZOOKEEPER-4466 supports different watch modes one same path, but there
are no corresponding `WatcherType`s for persistent watches. Client has
to resort to `WatcherType.Any` to remove them. This could accidently
interrupt other watches.

This PR adds `WatcherType.Persistent` and `WatcherType.PersistentRecursive`
to remove persistent watches individually.

* Assert removing WatcherType::Data from AddWatchMode::Persistent is impossible

* fixup! Assert removing WatcherType::Data from AddWatchMode::Persistent is impossible
---
 .../java/org/apache/zookeeper/Watcher.java    |   7 +-
 .../org/apache/zookeeper/ZKWatchManager.java  |  40 +-
 .../zookeeper/cli/RemoveWatchesCommand.java   |   6 +
 .../org/apache/zookeeper/server/DataTree.java |  20 +-
 .../apache/zookeeper/RemoveWatchesTest.java   | 629 ++++++++++++------
 5 files changed, 481 insertions(+), 221 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
index ab4b654880e..6347fa4569e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
@@ -191,6 +191,8 @@ public static EventType fromInt(int intValue) {
     enum WatcherType {
         Children(1),
         Data(2),
+        Persistent(4),
+        PersistentRecursive(5),
         Any(3);
 
         // Integer representation of value
@@ -212,7 +214,10 @@ public static WatcherType fromInt(int intValue) {
                 return WatcherType.Data;
             case 3:
                 return WatcherType.Any;
-
+            case 4:
+                return Persistent;
+            case 5:
+                return PersistentRecursive;
             default:
                 throw new RuntimeException("Invalid integer value for conversion to WatcherType");
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
index 9da4249447a..514da01cf24 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
@@ -153,6 +153,18 @@ public Map<Watcher.Event.EventType, Set<Watcher>> removeWatcher(
             }
             break;
         }
+        case Persistent: {
+            synchronized (persistentWatches) {
+                removedWatcher = removeWatches(persistentWatches, watcher, clientPath, local, rc, persistentWatchersToRem);
+            }
+            break;
+        }
+        case PersistentRecursive: {
+            synchronized (persistentRecursiveWatches) {
+                removedWatcher = removeWatches(persistentRecursiveWatches, watcher, clientPath, local, rc, persistentWatchersToRem);
+            }
+            break;
+        }
         case Any: {
             synchronized (childWatches) {
                 removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
@@ -225,18 +237,6 @@ void containsWatcher(String path, Watcher watcher, Watcher.WatcherType watcherTy
             synchronized (childWatches) {
                 containsWatcher = contains(path, watcher, childWatches);
             }
-
-            synchronized (persistentWatches) {
-                boolean contains_temp = contains(path, watcher,
-                        persistentWatches);
-                containsWatcher |= contains_temp;
-            }
-
-            synchronized (persistentRecursiveWatches) {
-                boolean contains_temp = contains(path, watcher,
-                        persistentRecursiveWatches);
-                containsWatcher |= contains_temp;
-            }
             break;
         }
         case Data: {
@@ -248,17 +248,17 @@ void containsWatcher(String path, Watcher watcher, Watcher.WatcherType watcherTy
                 boolean contains_temp = contains(path, watcher, existWatches);
                 containsWatcher |= contains_temp;
             }
-
+            break;
+        }
+        case Persistent: {
             synchronized (persistentWatches) {
-                boolean contains_temp = contains(path, watcher,
-                        persistentWatches);
-                containsWatcher |= contains_temp;
+                containsWatcher |= contains(path, watcher, persistentWatches);
             }
-
+            break;
+        }
+        case PersistentRecursive: {
             synchronized (persistentRecursiveWatches) {
-                boolean contains_temp = contains(path, watcher,
-                        persistentRecursiveWatches);
-                containsWatcher |= contains_temp;
+                containsWatcher |= contains(path, watcher, persistentRecursiveWatches);
             }
             break;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
index ddaf15fba5c..748f0c2f2b0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
@@ -37,6 +37,8 @@ public class RemoveWatchesCommand extends CliCommand {
     static {
         options.addOption("c", false, "child watcher type");
         options.addOption("d", false, "data watcher type");
+        options.addOption("p", false, "persistent watcher type");
+        options.addOption("r", false, "persistent recursive watcher type");
         options.addOption("a", false, "any watcher type");
         options.addOption("l", false, "remove locally when there is no server connection");
     }
@@ -70,6 +72,10 @@ public boolean exec() throws CliWrapperException, MalformedPathException {
             wtype = WatcherType.Children;
         } else if (cl.hasOption("d")) {
             wtype = WatcherType.Data;
+        } else if (cl.hasOption("p")) {
+            wtype = WatcherType.Persistent;
+        } else if (cl.hasOption("r")) {
+            wtype = WatcherType.PersistentRecursive;
         } else if (cl.hasOption("a")) {
             wtype = WatcherType.Any;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index c6e2ff45693..1f0e7a74974 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -1563,11 +1563,16 @@ public boolean containsWatcher(String path, WatcherType type, Watcher watcher) {
         case Data:
             containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.STANDARD);
             break;
+        case Persistent:
+            containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.PERSISTENT);
+            break;
+        case PersistentRecursive:
+            containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
+            break;
         case Any:
             if (this.childWatches.containsWatcher(path, watcher, null)) {
                 containsWatcher = true;
-            }
-            if (this.dataWatches.containsWatcher(path, watcher, null)) {
+            } else if (this.dataWatches.containsWatcher(path, watcher, null)) {
                 containsWatcher = true;
             }
             break;
@@ -1584,6 +1589,17 @@ public boolean removeWatch(String path, WatcherType type, Watcher watcher) {
         case Data:
             removed = this.dataWatches.removeWatcher(path, watcher, WatcherMode.STANDARD);
             break;
+        case Persistent:
+            if (this.childWatches.removeWatcher(path, watcher, WatcherMode.PERSISTENT)) {
+                removed = true;
+            }
+            if (this.dataWatches.removeWatcher(path, watcher, WatcherMode.PERSISTENT)) {
+                removed = true;
+            }
+            break;
+        case PersistentRecursive:
+            removed = this.dataWatches.removeWatcher(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
+            break;
         case Any:
             if (this.childWatches.removeWatcher(path, watcher, null)) {
                 removed = true;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index a5de63596da..5f3cf9b1ded 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -30,6 +30,7 @@
 import static org.mockito.Mockito.spy;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -45,6 +46,7 @@
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
 import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterEach;
@@ -97,9 +99,16 @@ private void removeWatches(
             MyCallback c1 = new MyCallback(rc.intValue(), path);
             zk.removeWatches(path, watcher, watcherType, local, c1, null);
             assertTrue(c1.matches(), "Didn't succeeds removeWatch operation");
-            if (KeeperException.Code.OK.intValue() != c1.rc) {
-                KeeperException ke = KeeperException.create(KeeperException.Code.get(c1.rc));
-                throw ke;
+            if (rc.intValue() != c1.rc) {
+                throw KeeperException.create(KeeperException.Code.get(c1.rc));
+            }
+        } else if (rc != Code.OK) {
+            try {
+                zk.removeWatches(path, watcher, watcherType, local);
+                fail("expect exception code " + rc);
+            } catch (KeeperException ex) {
+                assertEquals(rc, ex.code());
+                assertEquals(path, ex.getPath());
             }
         } else {
             zk.removeWatches(path, watcher, watcherType, local);
@@ -118,15 +127,50 @@ private void removeAllWatches(
             MyCallback c1 = new MyCallback(rc.intValue(), path);
             zk.removeAllWatches(path, watcherType, local, c1, null);
             assertTrue(c1.matches(), "Didn't succeeds removeWatch operation");
-            if (KeeperException.Code.OK.intValue() != c1.rc) {
-                KeeperException ke = KeeperException.create(KeeperException.Code.get(c1.rc));
-                throw ke;
+            if (rc.intValue() != c1.rc) {
+                throw KeeperException.create(KeeperException.Code.get(c1.rc));
+            }
+        } else if (rc != Code.OK) {
+            try {
+                zk.removeAllWatches(path, watcherType, local);
+                fail("expect exception code " + rc);
+            } catch (KeeperException ex) {
+                assertEquals(rc, ex.code());
+                assertEquals(path, ex.getPath());
             }
         } else {
             zk.removeAllWatches(path, watcherType, local);
         }
     }
 
+    private void assertWatchers(ZooKeeper zk, String path, WatcherType... watcherTypes) {
+        for (WatcherType watcherType : watcherTypes) {
+            String msg = String.format("expect watcher for path %s and type %s", path, watcherType);
+            assertTrue(isServerSessionWatcher(zk.getSessionId(), path, watcherType), msg);
+        }
+    }
+
+    private void assertNoWatchers(ZooKeeper zk, String path, WatcherType... watcherTypes) {
+        for (WatcherType watcherType : watcherTypes) {
+            String msg = String.format("expect no watcher for path %s and type %s", path, watcherType);
+            assertFalse(isServerSessionWatcher(zk.getSessionId(), path, watcherType), msg);
+        }
+    }
+
+    private void assertWatchersExcept(ZooKeeper zk, String path, WatcherType... watcherTypes) {
+        List<WatcherType> excludes = Arrays.asList(watcherTypes);
+        for (WatcherType watcherType : WatcherType.values()) {
+            if (watcherType == WatcherType.Any) {
+                continue;
+            }
+            if (excludes.contains(watcherType)) {
+                assertNoWatchers(zk, path, watcherType);
+            } else {
+                assertWatchers(zk, path, watcherType);
+            }
+        }
+    }
+
     /**
      * Test verifies removal of single watcher when there is server connection
      */
@@ -338,6 +382,96 @@ public void testRemoveAllChildWatchers(boolean useAsync) throws IOException, Int
         assertTrue(events.contains(EventType.NodeDataChanged), "Didn't get NodeDataChanged event");
     }
 
+    /**
+     * Test verifies removing all watcher with WatcherType.Persistent.
+     *
+     * <p>All other watchers shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentWatchers(boolean useAsync) throws InterruptedException, KeeperException {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+
+        Watcher persistentWatcher1 = persistentEvents1::add;
+        Watcher persistentWatcher2 = persistentEvents2::add;
+        zk2.addWatch("/node1", persistentWatcher1, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentWatcher2, AddWatchMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.Persistent, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.Persistent, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.PersistentRecursive, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.PersistentRecursive, false, Code.NOWATCHER, useAsync);
+
+        zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(persistentEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/node2");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+    }
+
+    /**
+     * Test verifies removing all watcher with WatcherType.PersistentRecursive.
+     *
+     * <p>All other watchers shouldn't be removed
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentRecursiveWatchers(boolean useAsync) throws InterruptedException, KeeperException {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+
+        Watcher recursiveWatcher1 = recursiveEvents1::add;
+        Watcher recursiveWatcher2 = recursiveEvents2::add;
+        zk2.addWatch("/node1", recursiveWatcher1, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveWatcher2, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add);
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.Persistent, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.Persistent, false, Code.NOWATCHER, useAsync);
+
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents2, EventType.PersistentWatchRemoved, "/node1");
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", "test".getBytes(), -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+    }
     /**
      * Test verifies given watcher doesn't exists!
      */
@@ -360,30 +494,10 @@ public void testNoWatcherException(boolean useAsync) throws IOException, Interru
         // New Watcher which will be used for removal
         MyWatcher w3 = new MyWatcher("/node1", 2);
 
-        try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Any, false, Code.NOWATCHER, useAsync);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
-        try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Children, false, Code.NOWATCHER, useAsync);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
-        try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
-        try {
-            removeWatches(zk2, "/nonexists", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
+        removeWatches(zk2, "/node1", w3, WatcherType.Any, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", w3, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/nonexists", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
     }
 
     /**
@@ -461,12 +575,7 @@ public void testRemoveWatcherWhenNoConnection(boolean useAsync) throws Exception
         removeWatches(zk2, "/node1", w2, WatcherType.Any, true, Code.OK, useAsync);
         assertTrue(w2.matches(), "Didn't remove child watcher");
         assertFalse(w1.matches(), "Shouldn't remove data watcher");
-        try {
-            removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.CONNECTIONLOSS, useAsync);
-            fail("Should throw exception as last watch removal requires server connection");
-        } catch (KeeperException.ConnectionLossException nwe) {
-            // expected
-        }
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.CONNECTIONLOSS, useAsync);
         assertFalse(w1.matches(), "Shouldn't remove data watcher");
 
         // when local=true, here if connection not available, simply removes
@@ -682,25 +791,17 @@ public void testChRootRemoveWatcher(boolean useAsync) throws Exception {
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
-    public void testNoWatcherServerException(boolean useAsync) throws InterruptedException, IOException, TimeoutException {
+    public void testNoWatcherServerException(boolean useAsync) throws KeeperException, InterruptedException, IOException, TimeoutException {
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = spy(new ZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher));
         MyWatchManager watchManager = new MyWatchManager(false, watcher);
         doReturn(watchManager).when(zk).getWatchManager();
-        boolean nw = false;
 
         watcher.waitForConnected(CONNECTION_TIMEOUT);
 
-        try {
-            zk.removeWatches("/nowatchhere", watcher, WatcherType.Data, false);
-        } catch (KeeperException nwe) {
-            if (nwe.code().intValue() == Code.NOWATCHER.intValue()) {
-                nw = true;
-            }
-        }
+        removeWatches(zk, "/nowatchhere", watcher, WatcherType.Data, false, Code.NOWATCHER, useAsync);
 
         assertThat("Server didn't return NOWATCHER", watchManager.lastReturnCode, is(Code.NOWATCHER.intValue()));
-        assertThat("NoWatcherException didn't happen", nw, is(true));
     }
 
     /**
@@ -711,12 +812,7 @@ public void testNoWatcherServerException(boolean useAsync) throws InterruptedExc
     @Timeout(value = 90)
     public void testRemoveAllNoWatcherException(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        try {
-            removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.NOWATCHER, useAsync);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
+        removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.NOWATCHER, useAsync);
     }
 
     /**
@@ -810,213 +906,342 @@ public void testRemoveWhenMultipleChildWatchesOnAPath(boolean useAsync) throws E
     }
 
     /**
-     * Test verifies WatcherType.Data - removes only the configured data watcher
-     * function
+     * Test verifies {@link WatcherType#Persistent} - removes only the configured watcher function
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultiplePersistentWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+        Watcher w1 = persistentEvents1::add;
+        // Add multiple persistent watches
+        zk2.addWatch("/node1", w1, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentEvents2::add, AddWatchMode.PERSISTENT);
+
+        removeWatches(zk2, "/node1", w1, WatcherType.Persistent, false, Code.OK, useAsync);
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+
+        zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        assertEvent(persistentEvents2, EventType.NodeChildrenChanged, "/node1");
+        assertNoEvent(persistentEvents1);
+    }
+
+    /**
+     * Test verifies {@link WatcherType#PersistentRecursive} - removes only the configured watcher function
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultiplePersistentRecursiveWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+        Watcher w1 = recursiveEvents1::add;
+        // Add multiple persistent recursive watches
+        zk2.addWatch("/node1", w1, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveEvents2::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        removeWatches(zk2, "/node1", w1, WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+
+        zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        assertEvent(recursiveEvents2, EventType.NodeCreated, "/node1/node2");
+        assertNoEvent(recursiveEvents1);
+    }
+
+    /**
+     * Test verifies {@link OpCode#checkWatches} {@link WatcherType#Persistent} using {@link WatcherType#Data}.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemovePersistentWatchesOnAPathPartially(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        Watcher persistentWatcher = persistentEvents::add;
+        zk2.addWatch("/node1", persistentWatcher, AddWatchMode.PERSISTENT);
+
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+        removeWatches(zk2, "/node1", persistentWatcher, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(persistentEvents.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Data}.
+     *
+     * <p>All other watcher types shouldn't be removed.
      */
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
     public void testRemoveAllDataWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final CountDownLatch dWatchCount = new CountDownLatch(2);
-        final CountDownLatch rmWatchCount = new CountDownLatch(2);
-        Watcher w1 = event -> {
-            switch (event.getType()) {
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeDataChanged:
-                dWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        Watcher w2 = event -> {
-            switch (event.getType()) {
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeDataChanged:
-                dWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
+
+        BlockingDeque<WatchedEvent> dataEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> dataEvents2 = new LinkedBlockingDeque<>();
         // Add multiple data watches
-        LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
-        LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
+        zk2.getData("/node1", dataEvents1::add, null);
+        zk2.getData("/node1", dataEvents2::add, null);
 
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
         BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
         BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getChildren("/node1", childrenEvents::add);
         zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
         zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
 
-        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is not a watcher");
+        assertWatchers(zk2, "/node1", WatcherType.values());
         removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.OK, useAsync);
-        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
-
-        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is still a watcher after removal");
+        assertEvent(dataEvents1, EventType.DataWatchRemoved, "/node1");
+        assertEvent(dataEvents2, EventType.DataWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.Data);
 
         zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk1.setData("/node1/child", new byte[0], -1);
-        zk1.delete("/node1/child", -1);
-        zk1.setData("/node1", new byte[0], -1);
-        zk1.delete("/node1", -1);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
 
-        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
         assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
         assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
-        assertEvent(persistentEvents, EventType.NodeDeleted, "/node1");
 
         assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child");
-        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1/child");
-        assertEvent(recursiveEvents, EventType.NodeDeleted, "/node1/child");
         assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
-        assertEvent(recursiveEvents, EventType.NodeDeleted, "/node1");
 
-        assertEquals(2, dWatchCount.getCount(), "Received watch notification after removal!");
+        assertNoEvent(dataEvents1);
+        assertNoEvent(dataEvents2);
     }
 
     /**
-     * Test verifies WatcherType.Children - removes only the configured child
-     * watcher function
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Children}.
+     *
+     * <p>All other watcher types shouldn't be removed.
      */
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
     public void testRemoveAllChildWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final CountDownLatch cWatchCount = new CountDownLatch(2);
-        final CountDownLatch rmWatchCount = new CountDownLatch(2);
-        Watcher w1 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-                cWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        Watcher w2 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-                cWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
+
+        BlockingDeque<WatchedEvent> childrenEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents2 = new LinkedBlockingDeque<>();
         // Add multiple child watches
-        LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals(0, zk2.getChildren("/node1", w1).size(), "Didn't set child watches");
-        LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
+        zk2.getChildren("/node1", childrenEvents1::add);
+        zk2.getChildren("/node1", childrenEvents2::add);
 
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
         BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
         zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
 
-        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is not a watcher");
+        assertWatchers(zk2, "/node1", WatcherType.values());
         removeAllWatches(zk2, "/node1", WatcherType.Children, false, Code.OK, useAsync);
-        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove child watcher");
-
-        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is still a watcher after removal");
+        assertEvent(childrenEvents1, EventType.ChildWatchRemoved, "/node1");
+        assertEvent(childrenEvents2, EventType.ChildWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.Children);
 
         zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk1.setData("/node1/child", new byte[0], -1);
-        zk1.delete("/node1/child", -1);
-        zk1.setData("/node1", new byte[0], -1);
-        zk1.delete("/node1", -1);
+        zk1.setData("/node1", null, -1);
 
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
         assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(childrenEvents1.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(childrenEvents2.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Persistent}.
+     *
+     * <p>All other watcher types shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+        // Add multiple persistent watches
+        zk2.addWatch("/node1", persistentEvents1::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentEvents2::add, AddWatchMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add, null);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.Persistent, false, Code.OK, useAsync);
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(persistentEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.Persistent);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child1");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(persistentEvents1.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(persistentEvents2.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Persistent} using {@link WatcherType#Data}.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentWatchesOnAPathPartially(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+        removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
         assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
         assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
-        assertEvent(persistentEvents, EventType.NodeDeleted, "/node1");
 
-        assertEquals(2, cWatchCount.getCount(), "Received watch notification after removal!");
+        assertNull(persistentEvents.poll(10, TimeUnit.MILLISECONDS));
     }
 
     /**
-     * Test verifies WatcherType.Any - removes all the configured child,data
-     * watcher functions
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#PersistentRecursive}.
+     *
+     * <p>All other watcher types shouldn't be removed.
      */
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     @Timeout(value = 90)
-    public void testRemoveAllWatchesOnAPath(boolean useAsync) throws Exception {
+    public void testRemoveAllPersistentRecursiveWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final CountDownLatch watchCount = new CountDownLatch(2);
-        final CountDownLatch rmWatchCount = new CountDownLatch(4);
-        Watcher w1 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-            case NodeDataChanged:
-                watchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        Watcher w2 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-            case NodeDataChanged:
-                watchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        // Add multiple child watches
-        LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals(0, zk2.getChildren("/node1", w1).size(), "Didn't set child watches");
-        LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
 
-        // Add multiple data watches
-        LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
-        LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+        // Add multiple persistent recursive watches
+        zk2.addWatch("/node1", recursiveEvents1::add, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveEvents2::add, AddWatchMode.PERSISTENT_RECURSIVE);
 
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
         BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
-        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add, null);
         zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
-        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
 
-        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Any), "Server session is not a watcher");
-        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is not a watcher");
-        assertTrue(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is not a watcher");
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.PersistentRecursive);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(recursiveEvents1.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(recursiveEvents2.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Any}.
+     *
+     * <p>All watcher types should be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        // Add multiple child watches
+        BlockingDeque<WatchedEvent> childEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childEvents2 = new LinkedBlockingDeque<>();
+        zk2.getChildren("/node1", childEvents1::add);
+        zk2.getChildren("/node1", childEvents2::add);
+
+        // Add multiple data watches
+        BlockingDeque<WatchedEvent> dataEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> dataEvents2 = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents1::add, null);
+        zk2.exists("/node1", dataEvents2::add);
+
+        // Add multiple persistent watches
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents1::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentEvents2::add, AddWatchMode.PERSISTENT);
+
+        // Add multiple recursive watches
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", recursiveEvents1::add, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveEvents2::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
         removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.OK, useAsync);
-        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
-        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Any), "Server session is still a watcher after removal");
-        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data), "Server session is still a watcher after removal");
-        assertFalse(isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children), "Server session is still a watcher after removal");
 
-        assertEvent(persistentEvents, EventType.PersistentWatchRemoved, "/node1");
-        assertEvent(recursiveEvents, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(childEvents1, EventType.ChildWatchRemoved, "/node1");
+        assertEvent(childEvents2, EventType.ChildWatchRemoved, "/node1");
 
-        zk1.delete("/node1", -1);
-        assertNull(persistentEvents.poll(10, TimeUnit.MILLISECONDS));
-        assertNull(recursiveEvents.poll(10, TimeUnit.MILLISECONDS));
-        assertEquals(2, watchCount.getCount(), "Received watch notification after removal!");
+        assertEvent(dataEvents1, EventType.DataWatchRemoved, "/node1");
+        assertEvent(dataEvents2, EventType.DataWatchRemoved, "/node1");
+
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(persistentEvents2, EventType.PersistentWatchRemoved, "/node1");
+
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertNoWatchers(zk2, "/node1", WatcherType.values());
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertNoEvent(childEvents1);
+        assertNoEvent(childEvents2);
+        assertNoEvent(dataEvents1);
+        assertNoEvent(dataEvents2);
+        assertNoEvent(persistentEvents1);
+        assertNoEvent(persistentEvents2);
+        assertNoEvent(recursiveEvents1);
+        assertNoEvent(recursiveEvents2);
     }
 
     private static class MyWatchManager extends ZKWatchManager {
@@ -1159,4 +1384,12 @@ private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.Event
         assertEquals(eventType, event.getType());
         assertEquals(path, event.getPath());
     }
+
+    /**
+     * Asserts no event from queue in a short period.
+     */
+    private void assertNoEvent(BlockingQueue<WatchedEvent> events) throws InterruptedException {
+        // Short timeout so we don't hurt CI too much. It will fail finally given enough run if there are bugs.
+        assertNull(events.poll(10, TimeUnit.MILLISECONDS));
+    }
 }

From b3487c525542c44de1c65f2207cb5563afbf644d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Thu, 15 Jun 2023 13:58:01 +0200
Subject: [PATCH 369/591] ZOOKEEPER-4393 Problem to connect to zookeeper in
 FIPS mode (#2008)

---
 .../zookeeper/ClientCnxnSocketNetty.java      |   9 ++
 .../zookeeper/client/FourLetterWordMain.java  |  43 +++----
 .../common/SSLContextAndOptions.java          |  31 ++++-
 .../org/apache/zookeeper/common/X509Util.java | 112 +++++++++++-------
 .../org/apache/zookeeper/common/ZKConfig.java |   2 +
 .../server/NettyServerCnxnFactory.java        |   4 +-
 .../auth/X509AuthenticationProvider.java      |   4 +-
 .../apache/zookeeper/common/X509UtilTest.java |  33 ++++--
 .../server/quorum/QuorumSSLTest.java          |  98 ++++++++++-----
 .../apache/zookeeper/test/ClientSSLTest.java  |  53 +++++++--
 10 files changed, 269 insertions(+), 120 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
index b2ca4c22506..f82ead06aba 100755
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -50,6 +50,7 @@
 import java.util.concurrent.locks.ReentrantLock;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLParameters;
 import org.apache.zookeeper.ClientCnxn.EndOfStreamException;
 import org.apache.zookeeper.ClientCnxn.Packet;
 import org.apache.zookeeper.client.ZKClientConfig;
@@ -452,6 +453,14 @@ private synchronized void initSSL(ChannelPipeline pipeline) throws SSLContextExc
                     sslContext = x509Util.createSSLContext(clientConfig);
                     sslEngine = sslContext.createSSLEngine(host, port);
                     sslEngine.setUseClientMode(true);
+                    if (x509Util.getFipsMode(clientConfig) && x509Util.isServerHostnameVerificationEnabled(clientConfig)) {
+                        SSLParameters sslParameters = sslEngine.getSSLParameters();
+                        sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+                        sslEngine.setSSLParameters(sslParameters);
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug("Server hostname verification: enabled HTTPS style endpoint identification algorithm");
+                        }
+                    }
                 }
             }
             pipeline.addLast("ssl", new SslHandler(sslEngine));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
index 42a4e284e4d..de2f79dcf1d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
@@ -92,27 +92,28 @@ public static String send4LetterWord(
         boolean secure,
         int timeout) throws IOException, SSLContextException {
         LOG.info("connecting to {} {}", host, port);
-        Socket sock;
-        InetSocketAddress hostaddress = host != null
-            ? new InetSocketAddress(host, port)
-            : new InetSocketAddress(InetAddress.getByName(null), port);
-        if (secure) {
-            LOG.info("using secure socket");
-            try (X509Util x509Util = new ClientX509Util()) {
-                SSLContext sslContext = x509Util.getDefaultSSLContext();
-                SSLSocketFactory socketFactory = sslContext.getSocketFactory();
-                SSLSocket sslSock = (SSLSocket) socketFactory.createSocket();
-                sslSock.connect(hostaddress, timeout);
-                sslSock.startHandshake();
-                sock = sslSock;
-            }
-        } else {
-            sock = new Socket();
-            sock.connect(hostaddress, timeout);
-        }
-        sock.setSoTimeout(timeout);
+
+        Socket sock = null;
         BufferedReader reader = null;
         try {
+            InetSocketAddress hostaddress = host != null
+                ? new InetSocketAddress(host, port)
+                : new InetSocketAddress(InetAddress.getByName(null), port);
+            if (secure) {
+                LOG.info("using secure socket");
+                try (X509Util x509Util = new ClientX509Util()) {
+                    SSLContext sslContext = x509Util.getDefaultSSLContext();
+                    SSLSocketFactory socketFactory = sslContext.getSocketFactory();
+                    SSLSocket sslSock = (SSLSocket) socketFactory.createSocket();
+                    sslSock.connect(hostaddress, timeout);
+                    sslSock.startHandshake();
+                    sock = sslSock;
+                }
+            } else {
+                sock = new Socket();
+                sock.connect(hostaddress, timeout);
+            }
+            sock.setSoTimeout(timeout);
             OutputStream outstream = sock.getOutputStream();
             outstream.write(cmd.getBytes(UTF_8));
             outstream.flush();
@@ -133,7 +134,9 @@ public static String send4LetterWord(
         } catch (SocketTimeoutException e) {
             throw new IOException("Exception while executing four letter word: " + cmd, e);
         } finally {
-            sock.close();
+            if (sock != null) {
+                sock.close();
+            }
             if (reader != null) {
                 reader.close();
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
index 01e97c3f594..4e61d7b9b42 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.common;
 
 import static java.util.Objects.requireNonNull;
+import io.netty.handler.ssl.DelegatingSslContext;
 import io.netty.handler.ssl.IdentityCipherSuiteFilter;
 import io.netty.handler.ssl.JdkSslContext;
 import io.netty.handler.ssl.SslContext;
@@ -29,6 +30,7 @@
 import java.util.Collections;
 import java.util.List;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLServerSocket;
 import javax.net.ssl.SSLSocket;
@@ -53,6 +55,8 @@ public class SSLContextAndOptions {
     private final X509Util.ClientAuth clientAuth;
     private final SSLContext sslContext;
     private final int handshakeDetectionTimeoutMillis;
+    private final ZKConfig config;
+
 
     /**
      * Note: constructor is intentionally package-private, only the X509Util class should be creating instances of this
@@ -70,6 +74,7 @@ public class SSLContextAndOptions {
         this.cipherSuitesAsList = Collections.unmodifiableList(Arrays.asList(ciphers));
         this.clientAuth = getClientAuth(config);
         this.handshakeDetectionTimeoutMillis = getHandshakeDetectionTimeoutMillis(config);
+        this.config = config;
     }
 
     public SSLContext getSSLContext() {
@@ -101,18 +106,32 @@ public SSLServerSocket createSSLServerSocket(int port) throws IOException {
         return configureSSLServerSocket(sslServerSocket);
     }
 
-    public SslContext createNettyJdkSslContext(SSLContext sslContext, boolean isClientSocket) {
-        return new JdkSslContext(
+    public SslContext createNettyJdkSslContext(SSLContext sslContext) {
+        SslContext sslContext1 = new JdkSslContext(
                 sslContext,
-                isClientSocket,
+                false,
                 cipherSuitesAsList,
                 IdentityCipherSuiteFilter.INSTANCE,
                 null,
-                isClientSocket
-                        ? X509Util.ClientAuth.NONE.toNettyClientAuth()
-                        : clientAuth.toNettyClientAuth(),
+                clientAuth.toNettyClientAuth(),
                 enabledProtocols,
                 false);
+
+        if (x509Util.getFipsMode(config) && x509Util.isClientHostnameVerificationEnabled(config)) {
+            return new DelegatingSslContext(sslContext1) {
+                @Override
+                protected void initEngine(SSLEngine sslEngine) {
+                    SSLParameters sslParameters = sslEngine.getSSLParameters();
+                    sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+                    sslEngine.setSSLParameters(sslParameters);
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug("Client hostname verification: enabled HTTPS style endpoint identification algorithm");
+                    }
+                }
+            };
+        } else {
+            return sslContext1;
+        }
     }
 
     public int getHandshakeDetectionTimeoutMillis() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 1fbbc7205e6..56b9f8ed1c6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -68,6 +68,7 @@ public abstract class X509Util implements Closeable, AutoCloseable {
     private static final Logger LOG = LoggerFactory.getLogger(X509Util.class);
 
     private static final String REJECT_CLIENT_RENEGOTIATION_PROPERTY = "jdk.tls.rejectClientInitiatedRenegotiation";
+    private static final String FIPS_MODE_PROPERTY = "zookeeper.fips-mode";
 
     static {
         // Client-initiated renegotiation in TLS is unsafe and
@@ -145,36 +146,30 @@ public io.netty.handler.ssl.ClientAuth toNettyClientAuth() {
         }
     }
 
-    private String sslProtocolProperty = getConfigPrefix() + "protocol";
-    private String sslEnabledProtocolsProperty = getConfigPrefix() + "enabledProtocols";
-    private String cipherSuitesProperty = getConfigPrefix() + "ciphersuites";
-    private String sslKeystoreLocationProperty = getConfigPrefix() + "keyStore.location";
-    private String sslKeystorePasswdProperty = getConfigPrefix() + "keyStore.password";
-    private String sslKeystorePasswdPathProperty = getConfigPrefix() + "keyStore.passwordPath";
-    private String sslKeystoreTypeProperty = getConfigPrefix() + "keyStore.type";
-    private String sslTruststoreLocationProperty = getConfigPrefix() + "trustStore.location";
-    private String sslTruststorePasswdProperty = getConfigPrefix() + "trustStore.password";
-    private String sslTruststorePasswdPathProperty = getConfigPrefix() + "trustStore.passwordPath";
-    private String sslTruststoreTypeProperty = getConfigPrefix() + "trustStore.type";
-    private String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
-    private String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
-    private String sslCrlEnabledProperty = getConfigPrefix() + "crl";
-    private String sslOcspEnabledProperty = getConfigPrefix() + "ocsp";
-    private String sslClientAuthProperty = getConfigPrefix() + "clientAuth";
-    private String sslHandshakeDetectionTimeoutMillisProperty = getConfigPrefix() + "handshakeDetectionTimeoutMillis";
-
-    private ZKConfig zkConfig;
-    private AtomicReference<SSLContextAndOptions> defaultSSLContextAndOptions = new AtomicReference<>(null);
+    private final String sslProtocolProperty = getConfigPrefix() + "protocol";
+    private final String sslEnabledProtocolsProperty = getConfigPrefix() + "enabledProtocols";
+    private final String cipherSuitesProperty = getConfigPrefix() + "ciphersuites";
+    private final String sslKeystoreLocationProperty = getConfigPrefix() + "keyStore.location";
+    private final String sslKeystorePasswdProperty = getConfigPrefix() + "keyStore.password";
+    private final String sslKeystorePasswdPathProperty = getConfigPrefix() + "keyStore.passwordPath";
+    private final String sslKeystoreTypeProperty = getConfigPrefix() + "keyStore.type";
+    private final String sslTruststoreLocationProperty = getConfigPrefix() + "trustStore.location";
+    private final String sslTruststorePasswdProperty = getConfigPrefix() + "trustStore.password";
+    private final String sslTruststorePasswdPathProperty = getConfigPrefix() + "trustStore.passwordPath";
+    private final String sslTruststoreTypeProperty = getConfigPrefix() + "trustStore.type";
+    private final String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
+    private final String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
+    private final String sslCrlEnabledProperty = getConfigPrefix() + "crl";
+    private final String sslOcspEnabledProperty = getConfigPrefix() + "ocsp";
+    private final String sslClientAuthProperty = getConfigPrefix() + "clientAuth";
+    private final String sslHandshakeDetectionTimeoutMillisProperty = getConfigPrefix() + "handshakeDetectionTimeoutMillis";
+
+    private final AtomicReference<SSLContextAndOptions> defaultSSLContextAndOptions = new AtomicReference<>(null);
 
     private FileChangeWatcher keyStoreFileWatcher;
     private FileChangeWatcher trustStoreFileWatcher;
 
     public X509Util() {
-        this(null);
-    }
-
-    public X509Util(ZKConfig zkConfig) {
-        this.zkConfig = zkConfig;
         keyStoreFileWatcher = trustStoreFileWatcher = null;
     }
 
@@ -260,6 +255,22 @@ public String getSslHandshakeDetectionTimeoutMillisProperty() {
         return sslHandshakeDetectionTimeoutMillisProperty;
     }
 
+    public String getFipsModeProperty() {
+        return FIPS_MODE_PROPERTY;
+    }
+
+    public boolean getFipsMode(ZKConfig config) {
+        return config.getBoolean(FIPS_MODE_PROPERTY, true);
+    }
+
+    public boolean isServerHostnameVerificationEnabled(ZKConfig config) {
+        return config.getBoolean(this.getSslHostnameVerificationEnabledProperty(), true);
+    }
+
+    public boolean isClientHostnameVerificationEnabled(ZKConfig config) {
+        return isServerHostnameVerificationEnabled(config) && shouldVerifyClientHostname();
+    }
+
     public SSLContext getDefaultSSLContext() throws X509Exception.SSLContextException {
         return getDefaultSSLContextAndOptions().getSSLContext();
     }
@@ -295,7 +306,7 @@ private SSLContextAndOptions createSSLContextAndOptions() throws SSLContextExcep
          * configuration from system property. Reading property from
          * configuration will be same reading from system property
          */
-        return createSSLContextAndOptions(zkConfig == null ? new ZKConfig() : zkConfig);
+        return createSSLContextAndOptions(new ZKConfig());
     }
 
     /**
@@ -375,14 +386,18 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
 
         boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty);
         boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty);
-        boolean sslServerHostnameVerificationEnabled = config.getBoolean(this.getSslHostnameVerificationEnabledProperty(), true);
-        boolean sslClientHostnameVerificationEnabled = sslServerHostnameVerificationEnabled && shouldVerifyClientHostname();
+        boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
+        boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
+        boolean fipsMode = getFipsMode(config);
 
         if (trustStoreLocationProp.isEmpty()) {
             LOG.warn("{} not specified", getSslTruststoreLocationProperty());
         } else {
             try {
-                trustManagers = new TrustManager[]{createTrustManager(trustStoreLocationProp, trustStorePasswordProp, trustStoreTypeProp, sslCrlEnabled, sslOcspEnabled, sslServerHostnameVerificationEnabled, sslClientHostnameVerificationEnabled)};
+                trustManagers = new TrustManager[]{
+                    createTrustManager(trustStoreLocationProp, trustStorePasswordProp, trustStoreTypeProp, sslCrlEnabled,
+                        sslOcspEnabled, sslServerHostnameVerificationEnabled, sslClientHostnameVerificationEnabled,
+                        fipsMode)};
             } catch (TrustManagerException trustManagerException) {
                 throw new SSLContextException("Failed to create TrustManager", trustManagerException);
             } catch (IllegalArgumentException e) {
@@ -487,16 +502,17 @@ public static X509KeyManager createKeyManager(
     /**
      * Creates a trust manager by loading the trust store from the given file
      * of the given type, optionally decrypting it using the given password.
-     * @param trustStoreLocation the location of the trust store file.
-     * @param trustStorePassword optional password to decrypt the trust store
-     *                           (only applies to JKS trust stores). If empty,
-     *                           assumes the trust store is not encrypted.
-     * @param trustStoreTypeProp must be JKS, PEM, PKCS12, BCFKS or null. If
-     *                           null, attempts to autodetect the trust store
-     *                           type from the file extension (e.g. .jks / .pem).
-     * @param crlEnabled enable CRL (certificate revocation list) checks.
-     * @param ocspEnabled enable OCSP (online certificate status protocol)
-     *                    checks.
+     *
+     * @param trustStoreLocation                the location of the trust store file.
+     * @param trustStorePassword                optional password to decrypt the trust store
+     *                                          (only applies to JKS trust stores). If empty,
+     *                                          assumes the trust store is not encrypted.
+     * @param trustStoreTypeProp                must be JKS, PEM, PKCS12, BCFKS or null. If
+     *                                          null, attempts to autodetect the trust store
+     *                                          type from the file extension (e.g. .jks / .pem).
+     * @param crlEnabled                        enable CRL (certificate revocation list) checks.
+     * @param ocspEnabled                       enable OCSP (online certificate status protocol)
+     *                                          checks.
      * @param serverHostnameVerificationEnabled if true, verify hostnames of
      *                                          remote servers that client
      *                                          sockets created by this
@@ -516,7 +532,8 @@ public static X509TrustManager createTrustManager(
         boolean crlEnabled,
         boolean ocspEnabled,
         final boolean serverHostnameVerificationEnabled,
-        final boolean clientHostnameVerificationEnabled) throws TrustManagerException {
+        final boolean clientHostnameVerificationEnabled,
+        final boolean fipsMode) throws TrustManagerException {
         if (trustStorePassword == null) {
             trustStorePassword = "";
         }
@@ -540,7 +557,17 @@ public static X509TrustManager createTrustManager(
 
             for (final TrustManager tm : tmf.getTrustManagers()) {
                 if (tm instanceof X509ExtendedTrustManager) {
-                    return new ZKTrustManager((X509ExtendedTrustManager) tm, serverHostnameVerificationEnabled, clientHostnameVerificationEnabled);
+                    if (fipsMode) {
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug("FIPS mode is ON: selecting standard x509 trust manager {}", tm);
+                        }
+                        return (X509TrustManager) tm;
+                    }
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug("FIPS mode is OFF: creating ZKTrustManager");
+                    }
+                    return new ZKTrustManager((X509ExtendedTrustManager) tm, serverHostnameVerificationEnabled,
+                        clientHostnameVerificationEnabled);
                 }
             }
             throw new TrustManagerException("Couldn't find X509TrustManager");
@@ -606,7 +633,7 @@ private FileChangeWatcher newFileChangeWatcher(String fileLocation) throws IOExc
      */
     public void enableCertFileReloading() throws IOException {
         LOG.info("enabling cert file reloading");
-        ZKConfig config = zkConfig == null ? new ZKConfig() : zkConfig;
+        ZKConfig config = new ZKConfig();
         FileChangeWatcher newKeyStoreFileWatcher = newFileChangeWatcher(config.getProperty(sslKeystoreLocationProperty));
         if (newKeyStoreFileWatcher != null) {
             // stop old watcher if there is one
@@ -633,6 +660,7 @@ public void enableCertFileReloading() throws IOException {
      */
     @Override
     public void close() {
+        defaultSSLContextAndOptions.set(null);
         if (keyStoreFileWatcher != null) {
             keyStoreFileWatcher.stop();
             keyStoreFileWatcher = null;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 5bd736ea8cd..f4670102946 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -82,6 +82,7 @@ public ZKConfig(String configPath) throws ConfigException {
     public ZKConfig(File configFile) throws ConfigException {
         this();
         addConfiguration(configFile);
+        LOG.info("ZK Config {}", this.properties);
     }
 
     private void init() {
@@ -130,6 +131,7 @@ private void putSSLProperties(X509Util x509Util) {
         properties.put(x509Util.getSslOcspEnabledProperty(), System.getProperty(x509Util.getSslOcspEnabledProperty()));
         properties.put(x509Util.getSslClientAuthProperty(), System.getProperty(x509Util.getSslClientAuthProperty()));
         properties.put(x509Util.getSslHandshakeDetectionTimeoutMillisProperty(), System.getProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty()));
+        properties.put(x509Util.getFipsModeProperty(), System.getProperty(x509Util.getFipsModeProperty()));
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 8d90a2c749a..13c8560cdf6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -578,7 +578,7 @@ private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext) t
         SslContext nettySslContext;
         if (authProviderProp == null) {
             SSLContextAndOptions sslContextAndOptions = x509Util.getDefaultSSLContextAndOptions();
-            nettySslContext = sslContextAndOptions.createNettyJdkSslContext(sslContextAndOptions.getSSLContext(), false);
+            nettySslContext = sslContextAndOptions.createNettyJdkSslContext(sslContextAndOptions.getSSLContext());
         } else {
             SSLContext sslContext = SSLContext.getInstance(ClientX509Util.DEFAULT_PROTOCOL);
             X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider(
@@ -590,7 +590,7 @@ private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext) t
             }
 
             sslContext.init(new X509KeyManager[]{authProvider.getKeyManager()}, new X509TrustManager[]{authProvider.getTrustManager()}, null);
-            nettySslContext = x509Util.getDefaultSSLContextAndOptions().createNettyJdkSslContext(sslContext, false);
+            nettySslContext = x509Util.getDefaultSSLContextAndOptions().createNettyJdkSslContext(sslContext);
         }
 
         if (supportPlaintext) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 9dd27603a38..e3f5b2c76a5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -104,6 +104,7 @@ public X509AuthenticationProvider() throws X509Exception {
                     x509Util.getSslTruststorePasswdProperty(),
                     x509Util.getSslTruststorePasswdPathProperty());
             String trustStoreTypeProp = config.getProperty(x509Util.getSslTruststoreTypeProperty());
+            boolean fipsMode = x509Util.getFipsMode(config);
 
             if (trustStoreLocation.isEmpty()) {
                 LOG.warn("Truststore not specified for client connection");
@@ -116,7 +117,8 @@ public X509AuthenticationProvider() throws X509Exception {
                         crlEnabled,
                         ocspEnabled,
                         hostnameVerificationEnabled,
-                        false);
+                        false,
+                        fipsMode);
                 } catch (TrustManagerException e) {
                     LOG.error("Failed to create trust manager", e);
                 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index c6812ae0414..ddffd426dd8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -360,7 +360,8 @@ public void testLoadPEMTrustStore(
             false,
             false,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -380,7 +381,8 @@ public void testLoadPEMTrustStoreNullPassword(
             false,
             false,
             true,
-            true);
+            true,
+            false);
 
     }
 
@@ -398,7 +400,8 @@ public void testLoadPEMTrustStoreAutodetectStoreFileType(
             false,
             false,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -472,7 +475,8 @@ public void testLoadJKSTrustStore(
             true,
             true,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -492,7 +496,8 @@ public void testLoadJKSTrustStoreNullPassword(
             false,
             false,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -509,7 +514,8 @@ public void testLoadJKSTrustStoreAutodetectStoreFileType(
             true,
             true,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -527,7 +533,8 @@ public void testLoadJKSTrustStoreWithWrongPassword(
                     true,
                     true,
                     true,
-                    true);
+                    true,
+                    false);
         });
     }
 
@@ -601,7 +608,8 @@ public void testLoadPKCS12TrustStore(
             true,
             true,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -621,7 +629,8 @@ public void testLoadPKCS12TrustStoreNullPassword(
             false,
             false,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -638,7 +647,8 @@ public void testLoadPKCS12TrustStoreAutodetectStoreFileType(
             true,
             true,
             true,
-            true);
+            true,
+            false);
     }
 
     @ParameterizedTest
@@ -656,7 +666,8 @@ public void testLoadPKCS12TrustStoreWithWrongPassword(
                     true,
                     true,
                     true,
-                    true);
+                    true,
+                    false);
         });
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index b7aed52bce3..820394bf868 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -32,6 +32,8 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
 import java.math.BigInteger;
 import java.net.InetSocketAddress;
 import java.net.URLDecoder;
@@ -116,11 +118,24 @@
 import org.bouncycastle.util.io.pem.PemWriter;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 public class QuorumSSLTest extends QuorumPeerTestBase {
 
+    @Retention(RetentionPolicy.RUNTIME)
+    @ParameterizedTest(name = "fipsEnabled = {0}")
+    @ValueSource(booleans = { false, true})
+    private @interface TestBothFipsModes {
+    }
+
+    @Retention(RetentionPolicy.RUNTIME)
+    @ParameterizedTest(name = "fipsEnabled = {0}")
+    @ValueSource(booleans = { false })
+    private @interface TestNoFipsOnly {
+    }
+
     private static final String SSL_QUORUM_ENABLED = "sslQuorum=true\n";
     private static final String PORT_UNIFICATION_ENABLED = "portUnification=true\n";
     private static final String PORT_UNIFICATION_DISABLED = "portUnification=false\n";
@@ -478,9 +493,11 @@ private void clearSSLSystemProperties() {
         System.clearProperty(quorumX509Util.getSslProtocolProperty());
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testQuorumSSL() throws Exception {
+    public void testQuorumSSL(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
 
@@ -499,9 +516,11 @@ public void testQuorumSSL() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testQuorumSSL_withPasswordFromFile() throws Exception {
+    public void testQuorumSSL_withPasswordFromFile(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         final Path secretFile = SecretUtilsTest.createSecretFile(String.valueOf(PASSWORD));
 
         System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
@@ -523,9 +542,11 @@ public void testQuorumSSL_withPasswordFromFile() throws Exception {
         assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testQuorumSSLWithMultipleAddresses() throws Exception {
+    public void testQuorumSSLWithMultipleAddresses(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         quorumConfiguration = generateMultiAddressQuorumConfiguration();
 
@@ -548,9 +569,11 @@ public void testQuorumSSLWithMultipleAddresses() throws Exception {
     }
 
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testRollingUpgrade() throws Exception {
+    public void testRollingUpgrade(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         // Form a quorum without ssl
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration);
@@ -596,9 +619,10 @@ private void stopAppendConfigRestartAll(Map<Integer, MainThread> members, String
         }
     }
 
-    @Test
+    @TestNoFipsOnly
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testHostnameVerificationWithInvalidHostname() throws Exception {
+    public void testHostnameVerificationWithInvalidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -613,9 +637,10 @@ public void testHostnameVerificationWithInvalidHostname() throws Exception {
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
+    @TestNoFipsOnly
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testHostnameVerificationWithInvalidIPAddress() throws Exception {
+    public void testHostnameVerificationWithInvalidIPAddress(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -630,9 +655,11 @@ public void testHostnameVerificationWithInvalidIPAddress() throws Exception {
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
+    @TestNoFipsOnly
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname() throws Exception {
+    public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -647,9 +674,11 @@ public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname() thr
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
+    @TestNoFipsOnly
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testHostnameVerificationForInvalidMultiAddressServerConfig() throws Exception {
+    public void testHostnameVerificationForInvalidMultiAddressServerConfig(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         quorumConfiguration = generateMultiAddressQuorumConfiguration();
 
@@ -667,9 +696,11 @@ public void testHostnameVerificationForInvalidMultiAddressServerConfig() throws
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
+    @TestNoFipsOnly
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testHostnameVerificationWithInvalidIpAddressAndValidHostname() throws Exception {
+    public void testHostnameVerificationWithInvalidIpAddressAndValidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -684,9 +715,11 @@ public void testHostnameVerificationWithInvalidIpAddressAndValidHostname() throw
         testHostnameVerification(badhostnameKeystorePath, true);
     }
 
-    @Test
+    @TestNoFipsOnly
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testHostnameVerificationWithValidIpAddressAndInvalidHostname() throws Exception {
+    public void testHostnameVerificationWithValidIpAddressAndInvalidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -751,9 +784,11 @@ private void testHostnameVerification(String keystorePath, boolean expectSuccess
             ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testCertificateRevocationList() throws Exception {
+    public void testCertificateRevocationList(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
 
@@ -817,9 +852,11 @@ public void testCertificateRevocationList() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testOCSP() throws Exception {
+    public void testOCSP(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         Integer ocspPort = PortAssignment.unique();
 
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
@@ -891,9 +928,11 @@ public void testOCSP() throws Exception {
         }
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testCipherSuites() throws Exception {
+    public void testCipherSuites(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         // Get default cipher suites from JDK
         SSLServerSocketFactory ssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
         List<String> defaultCiphers = new ArrayList<>();
@@ -932,9 +971,10 @@ public void testCipherSuites() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
+    @TestBothFipsModes
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
-    public void testProtocolVersion() throws Exception {
+    public void testProtocolVersion(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         System.setProperty(quorumX509Util.getSslProtocolProperty(), "TLSv1.2");
 
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index 43878e0b030..392c636dea8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -22,11 +22,13 @@
 
 package org.apache.zookeeper.test;
 
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.hamcrest.CoreMatchers.startsWith;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
+import java.net.InetAddress;
 import java.nio.file.Path;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
@@ -42,6 +44,9 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.ValueSource;
 
 public class ClientSSLTest extends QuorumPeerTestBase {
 
@@ -73,6 +78,8 @@ public void teardown() {
         System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
         System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
         System.clearProperty(clientX509Util.getSslTruststorePasswdPathProperty());
+        System.clearProperty(clientX509Util.getFipsModeProperty());
+        System.clearProperty(clientX509Util.getSslHostnameVerificationEnabledProperty());
         clientX509Util.close();
     }
 
@@ -106,12 +113,36 @@ public void testClientServerSSLWithCnxnClassName() throws Exception {
      * 2. setting jvm flags for serverCnxn, keystore, truststore.
      * Finally, a zookeeper client should be able to connect to the secure port and
      * communicate with server via secure connection.
-     * <p>
+     * <p/>
      * Note that in this test a ZK server has two ports -- clientPort and secureClientPort.
+     * <p/>
+     * This test covers the positive scenarios for hostname verification.
      */
-    @Test
-    public void testClientServerSSL() throws Exception {
-        testClientServerSSL(true);
+    @ParameterizedTest(name = "fipsEnabled={0}, hostnameVerification={1}")
+    @CsvSource({"true,true", "true,false", "false,true", "false,false"})
+    public void testClientServerSSL_positive(String fipsEnabled, String hostnameVerification) throws Exception {
+        // Arrange
+        System.setProperty(clientX509Util.getFipsModeProperty(), fipsEnabled);
+        System.setProperty(clientX509Util.getSslHostnameVerificationEnabledProperty(), hostnameVerification);
+
+        // Act & Assert
+        testClientServerSSL(hostnameVerification.equals("true") ? "localhost" : InetAddress.getLocalHost().getHostName(),
+            true, CONNECTION_TIMEOUT);
+    }
+
+    /**
+     * This test covers the negative scenarios for hostname verification.
+     */
+    @ParameterizedTest(name = "fipsEnabled={0}")
+    @ValueSource(booleans = { true, false })
+    public void testClientServerSSL_negative(boolean fipsEnabled) {
+        // Arrange
+        System.setProperty(clientX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+        System.setProperty(clientX509Util.getSslHostnameVerificationEnabledProperty(), "true");
+
+        // Act & Assert
+        assertThrows(AssertionError.class, () ->
+            testClientServerSSL(InetAddress.getLocalHost().getHostName(), true, 5000));
     }
 
     @Test
@@ -128,6 +159,10 @@ public void testClientServerSSL_withPasswordFromFile() throws Exception {
     }
 
     public void testClientServerSSL(boolean useSecurePort) throws Exception {
+        testClientServerSSL("localhost", useSecurePort, CONNECTION_TIMEOUT);
+    }
+
+    public void testClientServerSSL(String hostname, boolean useSecurePort, long connectTimeout) throws Exception {
         final int SERVER_COUNT = 3;
         final int[] clientPorts = new int[SERVER_COUNT];
         final Integer[] secureClientPorts = new Integer[SERVER_COUNT];
@@ -159,11 +194,11 @@ public void testClientServerSSL(boolean useSecurePort) throws Exception {
             assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], TIMEOUT),
                     "waiting for server " + i + " being up");
             final int port = useSecurePort ? secureClientPorts[i] : clientPorts[i];
-            ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + port, TIMEOUT);
-            // Do a simple operation to make sure the connection is fine.
-            zk.create("/test", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.delete("/test", -1);
-            zk.close();
+            try (ZooKeeper zk = ClientBase.createZKClient(hostname + ":" + port, TIMEOUT, connectTimeout)) {
+                // Do a simple operation to make sure the connection is fine.
+                zk.create("/test", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                zk.delete("/test", -1);
+            }
         }
 
         for (int i = 0; i < mt.length; i++) {

From 880f6064183c216d56d8c3e46a655c2b143f6d5e Mon Sep 17 00:00:00 2001
From: Paul Chesnais <paul.chesnais@gmail.com>
Date: Fri, 16 Jun 2023 03:05:58 -0700
Subject: [PATCH 370/591] ZOOKEEPER-4655: Communicate the Zxid that triggered a
 WatchEvent to fire (#1950)

* Fix a race condition in WatcherCleanerTest.testDeadWatcherMetrics

Because the metrics were updated _after_ the listener is invoked, the listener does not always see
the fresh metric value. This fixes it so that the test waits for the value to become what we expect.

* Leverage an existing method and refactor the rest of the code to match

Since there was an existing waitFor method in ZKTestCase, along with an existing implementation of a
waitForMetric LearnerMetricsTest, this commit moves waitForMetric to ZKTestCase and refactors the
metric-related usages of waitFor.

* Communicate the Zxid that triggered a WatchEvent to fire

With the recent addition of persistent watches, many doors have opened up to significantly more
performant and intuitive local caches of remote state, but the actual implementation can be
difficult because to cache data locally, one needs to execute the following steps:

1. Set the watch
2. Bootstrap the watched subtree
3. Catch up on the events that fired during the bootstrap

The issue is it's now very difficult to deduplicate and sanely resolve the remote state during step
3 because it's unknown whether an event arrived during the bootstrap or after. For example,
imagine that between steps 1 and 2, a node /a was deleted then re-created. By the time step 3 is
executed, there will be a NodeDeleted event queued up followed by a NodeCreated, causing at best a
double read (one from the bootstrap, one from the NodeCreated) or at worst some data inconsistencies
in the local cache.

This change sets the Zxid in the response header whenever the watch event type is NodeCreated,
NodeDeleted, NodeDataChanged or NodeChildrenChanged.
---
 .../zookeeper/server/watch/WatchBench.java    |   6 +-
 .../java/org/apache/zookeeper/ClientCnxn.java |   2 +-
 .../org/apache/zookeeper/WatchedEvent.java    |  39 ++++-
 .../java/org/apache/zookeeper/Watcher.java    |   5 +
 .../org/apache/zookeeper/server/DataTree.java |  12 +-
 .../apache/zookeeper/server/DumbWatcher.java  |  19 +++
 .../zookeeper/server/NIOServerCnxn.java       |   2 +-
 .../zookeeper/server/NettyServerCnxn.java     |   2 +-
 .../zookeeper/server/watch/IWatchManager.java |   6 +-
 .../zookeeper/server/watch/WatchManager.java  |   8 +-
 .../server/watch/WatchManagerOptimized.java   |   8 +-
 .../java/org/apache/zookeeper/ZKTestCase.java |  42 ++++-
 .../server/RequestThrottlerTest.java          |  16 +-
 .../FileTxnSnapLogMetricsTest.java            |   3 +-
 .../server/quorum/LearnerMetricsTest.java     |  15 --
 .../server/watch/WatchManagerTest.java        |  37 ++++-
 .../server/watch/WatcherCleanerTest.java      |  32 ++--
 .../test/PersistentRecursiveWatcherTest.java  | 134 +++++++++------
 .../org/apache/zookeeper/test/TestUtils.java  |  14 ++
 .../test/UnsupportedAddWatcherTest.java       |   4 +-
 .../zookeeper/test/WatchedEventTest.java      |   4 +-
 .../zookeeper/test/WatcherFuncTest.java       | 155 ++++++++++--------
 22 files changed, 360 insertions(+), 205 deletions(-)

diff --git a/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
index aee5b2f18ab..7de1be0370b 100644
--- a/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
@@ -191,7 +191,7 @@ void prepare() {
     @Measurement(iterations = 3, time = 10, timeUnit = TimeUnit.SECONDS)
     public void testTriggerConcentrateWatch(InvocationState state) throws Exception {
         for (String path : state.paths) {
-            state.watchManager.triggerWatch(path, event);
+            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID);
         }
     }
 
@@ -225,7 +225,7 @@ public void tearDown() {
 
             // clear all the watches
             for (String path : paths) {
-                watchManager.triggerWatch(path, event);
+                watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID);
             }
         }
     }
@@ -294,7 +294,7 @@ public void prepare() {
     @Measurement(iterations = 3, time = 10, timeUnit = TimeUnit.SECONDS)
     public void testTriggerSparseWatch(TriggerSparseWatchState state) throws Exception {
         for (String path : state.paths) {
-            state.watchManager.triggerWatch(path, event);
+            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID);
         }
     }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index c29a2141d58..727d97daa6a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -902,7 +902,7 @@ void readResponse(ByteBuffer incomingBuffer) throws IOException {
                     event.setPath(clientPath);
                 }
 
-                WatchedEvent we = new WatchedEvent(event);
+                WatchedEvent we = new WatchedEvent(event, replyHdr.getZxid());
                 LOG.debug("Got {} for session id 0x{}", we, Long.toHexString(sessionId));
                 eventThread.queueEvent(we);
                 return;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java
index 1de3d3ddf68..1303629c914 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java
@@ -31,27 +31,38 @@
  */
 @InterfaceAudience.Public
 public class WatchedEvent {
+    public static final long NO_ZXID = -1L;
 
     private final KeeperState keeperState;
     private final EventType eventType;
-    private String path;
+    private final String path;
+    private final long zxid;
 
     /**
-     * Create a WatchedEvent with specified type, state and path
+     * Create a WatchedEvent with specified type, state, path and zxid
      */
-    public WatchedEvent(EventType eventType, KeeperState keeperState, String path) {
+    public WatchedEvent(EventType eventType, KeeperState keeperState, String path, long zxid) {
         this.keeperState = keeperState;
         this.eventType = eventType;
         this.path = path;
+        this.zxid = zxid;
     }
 
     /**
-     * Convert a WatcherEvent sent over the wire into a full-fledged WatcherEvent
+     * Create a WatchedEvent with specified type, state and path
      */
-    public WatchedEvent(WatcherEvent eventMessage) {
+    public WatchedEvent(EventType eventType, KeeperState keeperState, String path) {
+        this(eventType, keeperState, path, NO_ZXID);
+    }
+
+    /**
+     * Convert a WatcherEvent sent over the wire into a full-fledged WatchedEvent
+     */
+    public WatchedEvent(WatcherEvent eventMessage, long zxid) {
         keeperState = KeeperState.fromInt(eventMessage.getState());
         eventType = EventType.fromInt(eventMessage.getType());
         path = eventMessage.getPath();
+        this.zxid = zxid;
     }
 
     public KeeperState getState() {
@@ -66,9 +77,24 @@ public String getPath() {
         return path;
     }
 
+    /**
+     * Returns the zxid of the transaction that triggered this watch if it is
+     * of one of the following types:<ul>
+     *   <li>{@link EventType#NodeCreated}</li>
+     *   <li>{@link EventType#NodeDeleted}</li>
+     *   <li>{@link EventType#NodeDataChanged}</li>
+     *   <li>{@link EventType#NodeChildrenChanged}</li>
+     * </ul>
+     * Otherwise, returns {@value #NO_ZXID}. Note that {@value #NO_ZXID} is also
+     * returned by old servers that do not support this feature.
+     */
+    public long getZxid() {
+        return zxid;
+    }
+
     @Override
     public String toString() {
-        return "WatchedEvent state:" + keeperState + " type:" + eventType + " path:" + path;
+        return "WatchedEvent state:" + keeperState + " type:" + eventType + " path:" + path + " zxid: " + zxid;
     }
 
     /**
@@ -77,5 +103,4 @@ public String toString() {
     public WatcherEvent getWrapper() {
         return new WatcherEvent(eventType.getIntValue(), keeperState.getIntValue(), path);
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
index 6347fa4569e..01c3ae75a9f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
@@ -26,6 +26,11 @@
  * server it connects to. An application using such a client handles these
  * events by registering a callback object with the client. The callback object
  * is expected to be an instance of a class that implements Watcher interface.
+ * When {@link #process} is triggered by a watch firing, such as
+ * {@link Event.EventType#NodeDataChanged}, {@link WatchedEvent#getZxid()} will
+ * return the zxid of the transaction that caused said watch to fire. If
+ * {@value WatchedEvent#NO_ZXID} is returned then the server must be updated to
+ * support this feature.
  *
  */
 @InterfaceAudience.Public
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 1f0e7a74974..be1c7538593 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -518,8 +518,8 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
             updateQuotaStat(lastPrefix, bytes, 1);
         }
         updateWriteStat(path, bytes);
-        dataWatches.triggerWatch(path, Event.EventType.NodeCreated);
-        childWatches.triggerWatch(parentName.equals("") ? "/" : parentName, Event.EventType.NodeChildrenChanged);
+        dataWatches.triggerWatch(path, Event.EventType.NodeCreated, zxid);
+        childWatches.triggerWatch(parentName.equals("") ? "/" : parentName, Event.EventType.NodeChildrenChanged, zxid);
     }
 
     /**
@@ -615,9 +615,9 @@ public void deleteNode(String path, long zxid) throws NoNodeException {
                 "childWatches.triggerWatch " + parentName);
         }
 
-        WatcherOrBitSet processed = dataWatches.triggerWatch(path, EventType.NodeDeleted);
-        childWatches.triggerWatch(path, EventType.NodeDeleted, processed);
-        childWatches.triggerWatch("".equals(parentName) ? "/" : parentName, EventType.NodeChildrenChanged);
+        WatcherOrBitSet processed = dataWatches.triggerWatch(path, EventType.NodeDeleted, zxid);
+        childWatches.triggerWatch(path, EventType.NodeDeleted, zxid, processed);
+        childWatches.triggerWatch("".equals(parentName) ? "/" : parentName, EventType.NodeChildrenChanged, zxid);
     }
 
     public Stat setData(String path, byte[] data, int version, long zxid, long time) throws NoNodeException {
@@ -649,7 +649,7 @@ public Stat setData(String path, byte[] data, int version, long zxid, long time)
         nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastData));
 
         updateWriteStat(path, dataBytes);
-        dataWatches.triggerWatch(path, EventType.NodeDataChanged);
+        dataWatches.triggerWatch(path, EventType.NodeDataChanged, zxid);
         return s;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
index c7bf830b4ef..231a063fe12 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
@@ -33,6 +33,9 @@
 public class DumbWatcher extends ServerCnxn {
 
     private long sessionId;
+    private String mostRecentPath;
+    private Event.EventType mostRecentEventType;
+    private long mostRecentZxid = WatchedEvent.NO_ZXID;
 
     public DumbWatcher() {
         this(0);
@@ -49,8 +52,24 @@ void setSessionTimeout(int sessionTimeout) {
 
     @Override
     public void process(WatchedEvent event) {
+        mostRecentEventType = event.getType();
+        mostRecentZxid = event.getZxid();
+        mostRecentPath = event.getPath();
     }
 
+    public String getMostRecentPath() {
+        return mostRecentPath;
+    }
+
+    public Event.EventType getMostRecentEventType() {
+        return mostRecentEventType;
+    }
+
+    public long getMostRecentZxid() {
+        return mostRecentZxid;
+    }
+
+
     @Override
     int getSessionTimeout() {
         return 0;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 1a8575cd45e..61cbe71bad2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -705,7 +705,7 @@ public int sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, St
      */
     @Override
     public void process(WatchedEvent event) {
-        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, -1L, 0);
+        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, event.getZxid(), 0);
         if (LOG.isTraceEnabled()) {
             ZooTrace.logTraceMessage(
                 LOG,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index f95200d560b..3ed77183434 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -162,7 +162,7 @@ public int getSessionTimeout() {
 
     @Override
     public void process(WatchedEvent event) {
-        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, -1L, 0);
+        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, event.getZxid(), 0);
         if (LOG.isTraceEnabled()) {
             ZooTrace.logTraceMessage(
                 LOG,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
index c3900eb64e9..0d537b4ec67 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
@@ -113,10 +113,11 @@ default boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherM
      *
      * @param path znode path
      * @param type the watch event type
+     * @param zxid the zxid for the corresponding change that triggered this event
      *
      * @return the watchers have been notified
      */
-    WatcherOrBitSet triggerWatch(String path, EventType type);
+    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid);
 
     /**
      * Distribute the watch event for the given path, but ignore those
@@ -124,11 +125,12 @@ default boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherM
      *
      * @param path znode path
      * @param type the watch event type
+     * @param zxid the zxid for the corresponding change that triggered this event
      * @param suppress the suppressed watcher set
      *
      * @return the watchers have been notified
      */
-    WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet suppress);
+    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, WatcherOrBitSet suppress);
 
     /**
      * Get the size of watchers.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
index 6e9a3a52bb0..568de2a82d0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
@@ -129,13 +129,13 @@ public synchronized void removeWatcher(Watcher watcher) {
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type) {
-        return triggerWatch(path, type, null);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid) {
+        return triggerWatch(path, type, zxid, null);
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet supress) {
-        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, WatcherOrBitSet supress) {
+        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
         Set<Watcher> watchers = new HashSet<>();
         synchronized (this) {
             PathParentIterator pathParentIterator = getPathParentIterator(path);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
index 7f72175efdf..0a6b4279fdb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
@@ -202,13 +202,13 @@ public void processDeadWatchers(Set<Integer> deadWatchers) {
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type) {
-        return triggerWatch(path, type, null);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid) {
+        return triggerWatch(path, type, zxid, null);
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet suppress) {
-        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, WatcherOrBitSet suppress) {
+        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
 
         BitHashSet watchers = remove(path);
         if (watchers == null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index 8d9430e1cf6..b29deedb0bc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -22,7 +22,12 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.time.Instant;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.util.ServiceUtils;
+import org.hamcrest.CustomMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+import org.hamcrest.StringDescription;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
@@ -40,6 +45,7 @@ public class ZKTestCase {
 
     protected static final File testBaseDir = new File(System.getProperty("build.test.dir", "build"));
     private static final Logger LOG = LoggerFactory.getLogger(ZKTestCase.class);
+    public static final int DEFAULT_METRIC_TIMEOUT = 30;
 
     static {
         // Disable System.exit in tests.
@@ -103,7 +109,7 @@ public interface WaitForCondition {
      * @param timeout   timeout in seconds
      * @throws InterruptedException
      */
-    public void waitFor(String msg, WaitForCondition condition, int timeout) throws InterruptedException {
+    public static void waitFor(String msg, WaitForCondition condition, int timeout) throws InterruptedException {
         final Instant deadline = Instant.now().plusSeconds(timeout);
         while (Instant.now().isBefore(deadline)) {
             if (condition.evaluate()) {
@@ -114,4 +120,36 @@ public void waitFor(String msg, WaitForCondition condition, int timeout) throws
         fail(msg);
     }
 
-}
+    public static <T> void waitForMetric(String metricKey, Matcher<T> matcher) throws InterruptedException {
+        waitForMetric(metricKey, matcher, DEFAULT_METRIC_TIMEOUT);
+    }
+
+    public static <T> void waitForMetric(String metricKey, Matcher<T> matcher, int timeoutInSeconds) throws InterruptedException {
+        String errorMessage = String.format("metric \"%s\" failed to match after %d seconds",
+            metricKey, timeoutInSeconds);
+        waitFor(errorMessage, () -> {
+            @SuppressWarnings("unchecked")
+            T actual = (T) MetricsUtils.currentServerMetrics().get(metricKey);
+            if (!matcher.matches(actual)) {
+                Description description = new StringDescription();
+                matcher.describeMismatch(actual, description);
+                LOG.info("match failed for metric {}: {}", metricKey, description);
+                return false;
+            }
+            return true;
+        }, timeoutInSeconds);
+    }
+
+    /**
+     * Functionally identical to {@link org.hamcrest.Matchers#closeTo} except that it accepts all numerical types
+     * instead of failing if the value is not a {@link Double}.
+     */
+    public static Matcher<Number> closeTo(double operand, double error) {
+        return new CustomMatcher<Number>(String.format("A number within %s of %s", error, operand)) {
+            @Override
+            public boolean matches(Object actual) {
+                return Math.abs(operand - ((Number) actual).doubleValue()) <= error;
+            }
+        };
+    }
+}
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index 15259207599..088f80c4857 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -19,6 +19,8 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.is;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
@@ -75,10 +77,6 @@ public class RequestThrottlerTest extends ZKTestCase {
     ZooKeeper zk = null;
     int connectionLossCount = 0;
 
-    private long getCounterMetric(String name) {
-        return (long) MetricsUtils.currentServerMetrics().get(name);
-    }
-
     @BeforeEach
     public void setup() throws Exception {
         // start a server and create a client
@@ -222,11 +220,8 @@ public void testRequestThrottler() throws Exception {
         submitted.await(5, TimeUnit.SECONDS);
 
         // but only two requests can get into the pipeline because of the throttler
-        WaitForCondition requestQueued = () -> getCounterMetric("prep_processor_request_queued") == 2;
-        waitFor("request not queued", requestQueued, 5);
-
-        WaitForCondition throttleWait = () -> getCounterMetric("request_throttle_wait_count") >= 1;
-        waitFor("no throttle wait", throttleWait, 5);
+        waitForMetric("prep_processor_request_queued", is(2L));
+        waitForMetric("request_throttle_wait_count", greaterThanOrEqualTo(1L));
 
         // let the requests go through the pipeline and the throttler will be waken up to allow more requests
         // to enter the pipeline
@@ -387,8 +382,7 @@ public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled()
             // be GLOBAL_OUTSTANDING_LIMIT + 2.
             //
             // But due to leak of consistent view of number of outstanding requests, the number could be larger.
-            WaitForCondition requestQueued = () -> getCounterMetric("prep_processor_request_queued") >= Integer.parseInt(GLOBAL_OUTSTANDING_LIMIT) + 2;
-            waitFor("no enough requests queued", requestQueued, 5);
+            waitForMetric("prep_processor_request_queued", greaterThanOrEqualTo(Long.parseLong(GLOBAL_OUTSTANDING_LIMIT) + 2));
 
             resumeProcess.countDown();
         } catch (Exception e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
index 65648fefce4..1a569e4d47e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
@@ -79,8 +79,7 @@ public void testFileTxnSnapLogMetrics() throws Exception {
         }
 
         // It is possible that above writes will trigger more than one snapshot due to randomization.
-        WaitForCondition newSnapshot = () -> (long) MetricsUtils.currentServerMetrics().get("cnt_snapshottime") >= 2L;
-        waitFor("no snapshot in 10s", newSnapshot, 10);
+        waitForMetric("cnt_snapshottime", greaterThanOrEqualTo(2L), 10);
 
         // Pauses snapshot and logs more txns.
         cnxnFactory.getZooKeeperServer().getTxnLogFactory().snapLog.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
index 5df14600a15..aa3ba3622ad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
@@ -26,10 +26,8 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.test.ClientBase;
-import org.hamcrest.Matcher;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
@@ -38,7 +36,6 @@
 
 public class LearnerMetricsTest extends QuorumPeerTestBase {
 
-    private static final int TIMEOUT_SECONDS = 30;
     private static final int SERVER_COUNT = 4; // 1 observer, 3 participants
     private final QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[SERVER_COUNT];
     private ZooKeeper zk_client;
@@ -113,18 +110,6 @@ public void testLearnerMetricsTest(boolean asyncSending) throws Exception {
         waitForMetric("min_commit_propagation_latency", greaterThanOrEqualTo(0L));
     }
 
-    private void waitForMetric(final String metricKey, final Matcher<Long> matcher) throws InterruptedException {
-        final String errorMessage = String.format("unable to match on metric: %s", metricKey);
-        waitFor(errorMessage, () -> {
-            long actual = (long) MetricsUtils.currentServerMetrics().get(metricKey);
-            if (!matcher.matches(actual)) {
-                LOG.info("match failed on {}, actual value: {}", metricKey, actual);
-                return false;
-            }
-            return true;
-        }, TIMEOUT_SECONDS);
-    }
-
     @AfterEach
     public void tearDown() throws Exception {
         zk_client.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
index 5f40ef3559d..ba97b887e6d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
@@ -133,7 +133,7 @@ public WatcherTriggerWorker(
         public void run() {
             while (!stopped) {
                 String path = PATH_PREFIX + r.nextInt(paths);
-                WatcherOrBitSet s = manager.triggerWatch(path, EventType.NodeDeleted);
+                WatcherOrBitSet s = manager.triggerWatch(path, EventType.NodeDeleted, -1);
                 if (s != null) {
                     triggeredCount.addAndGet(s.size());
                 }
@@ -729,6 +729,12 @@ private void checkMetrics(String metricName, long min, long max, double avg, lon
         assertEquals(sum, values.get("sum_" + metricName));
     }
 
+    private void checkMostRecentWatchedEvent(DumbWatcher watcher, String path, EventType eventType, long zxid) {
+        assertEquals(path, watcher.getMostRecentPath());
+        assertEquals(eventType, watcher.getMostRecentEventType());
+        assertEquals(zxid, watcher.getMostRecentZxid());
+    }
+
     @ParameterizedTest
     @MethodSource("data")
     public void testWatcherMetrics(String className) throws IOException {
@@ -743,41 +749,54 @@ public void testWatcherMetrics(String className) throws IOException {
 
         final String path3 = "/path3";
 
-        //both wather1 and wather2 are watching path1
+        //both watcher1 and watcher2 are watching path1
         manager.addWatch(path1, watcher1);
         manager.addWatch(path1, watcher2);
 
         //path2 is watched by watcher1
         manager.addWatch(path2, watcher1);
 
-        manager.triggerWatch(path3, EventType.NodeCreated);
+        manager.triggerWatch(path3, EventType.NodeCreated, 1);
         //path3 is not being watched so metric is 0
         checkMetrics("node_created_watch_count", 0L, 0L, 0D, 0L, 0L);
+        // Watchers shouldn't have received any events yet so the zxid should be -1.
+        checkMostRecentWatchedEvent(watcher1, null, null, -1);
+        checkMostRecentWatchedEvent(watcher2, null, null, -1);
 
         //path1 is watched by two watchers so two fired
-        manager.triggerWatch(path1, EventType.NodeCreated);
+        manager.triggerWatch(path1, EventType.NodeCreated, 2);
         checkMetrics("node_created_watch_count", 2L, 2L, 2D, 1L, 2L);
+        checkMostRecentWatchedEvent(watcher1, path1, EventType.NodeCreated, 2);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
         //path2 is watched by one watcher so one fired now total is 3
-        manager.triggerWatch(path2, EventType.NodeCreated);
+        manager.triggerWatch(path2, EventType.NodeCreated, 3);
         checkMetrics("node_created_watch_count", 1L, 2L, 1.5D, 2L, 3L);
+        checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeCreated, 3);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
         //watches on path1 are no longer there so zero fired
-        manager.triggerWatch(path1, EventType.NodeDataChanged);
+        manager.triggerWatch(path1, EventType.NodeDataChanged, 4);
         checkMetrics("node_changed_watch_count", 0L, 0L, 0D, 0L, 0L);
+        checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeCreated, 3);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
-        //both wather1 and wather2 are watching path1
+        //both watcher and watcher are watching path1
         manager.addWatch(path1, watcher1);
         manager.addWatch(path1, watcher2);
 
         //path2 is watched by watcher1
         manager.addWatch(path2, watcher1);
 
-        manager.triggerWatch(path1, EventType.NodeDataChanged);
+        manager.triggerWatch(path1, EventType.NodeDataChanged, 5);
         checkMetrics("node_changed_watch_count", 2L, 2L, 2D, 1L, 2L);
+        checkMostRecentWatchedEvent(watcher1, path1, EventType.NodeDataChanged, 5);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeDataChanged, 5);
 
-        manager.triggerWatch(path2, EventType.NodeDeleted);
+        manager.triggerWatch(path2, EventType.NodeDeleted, 6);
         checkMetrics("node_deleted_watch_count", 1L, 1L, 1D, 1L, 1L);
+        checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeDeleted, 6);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeDataChanged, 5);
 
         //make sure that node created watch count is not impacted by the fire of other event types
         checkMetrics("node_created_watch_count", 1L, 2L, 1.5D, 2L, 3L);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
index 17e44eb9b01..3320f1a247c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.number.OrderingComparison.greaterThan;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.is;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -140,7 +140,7 @@ public void testMaxInProcessingDeadWatchers() {
     }
 
     @Test
-    public void testDeadWatcherMetrics() {
+    public void testDeadWatcherMetrics() throws InterruptedException {
         ServerMetrics.getMetrics().resetAll();
         MyDeadWatcherListener listener = new MyDeadWatcherListener();
         WatcherCleaner cleaner = new WatcherCleaner(listener, 1, 1, 1, 1);
@@ -156,19 +156,19 @@ public void testDeadWatcherMetrics() {
         assertTrue(listener.wait(5000));
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
-        assertThat("Adding dead watcher should be stalled twice", (Long) values.get("add_dead_watcher_stall_time"), greaterThan(0L));
-        assertEquals(3L, values.get("dead_watchers_queued"), "Total dead watchers added to the queue should be 3");
-        assertEquals(3L, values.get("dead_watchers_cleared"), "Total dead watchers cleared should be 3");
-
-        assertEquals(3L, values.get("cnt_dead_watchers_cleaner_latency"));
-
-        //Each latency should be a little over 20 ms, allow 20 ms deviation
-        assertEquals(20D, (Double) values.get("avg_dead_watchers_cleaner_latency"), 20);
-        assertEquals(20D, ((Long) values.get("min_dead_watchers_cleaner_latency")).doubleValue(), 20);
-        assertEquals(20D, ((Long) values.get("max_dead_watchers_cleaner_latency")).doubleValue(), 20);
-        assertEquals(20D, ((Long) values.get("p50_dead_watchers_cleaner_latency")).doubleValue(), 20);
-        assertEquals(20D, ((Long) values.get("p95_dead_watchers_cleaner_latency")).doubleValue(), 20);
-        assertEquals(20D, ((Long) values.get("p99_dead_watchers_cleaner_latency")).doubleValue(), 20);
+        // Adding dead watcher should be stalled twice
+        waitForMetric("add_dead_watcher_stall_time", greaterThan(0L));
+        waitForMetric("dead_watchers_queued", is(3L));
+        waitForMetric("dead_watchers_cleared", is(3L));
+        waitForMetric("cnt_dead_watchers_cleaner_latency", is(3L));
+
+        //Each latency should be a little over 20 ms, allow 5 ms deviation
+        waitForMetric("avg_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("min_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("max_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("p50_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("p95_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("p99_dead_watchers_cleaner_latency", closeTo(20, 5));
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index 077af3c456c..440485e660f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -20,7 +20,6 @@
 
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT_RECURSIVE;
-import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
@@ -33,8 +32,11 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.Watcher.Event.EventType;
+import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.Stat;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
@@ -81,21 +83,28 @@ public void testBasicAsync()
 
     private void internalTestBasic(ZooKeeper zk) throws KeeperException, InterruptedException {
         zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b/c/d", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.setData("/a/b/c/d/e", new byte[0], -1);
+
+        Stat stat = new Stat();
+        zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b", stat);
+
+        zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c", stat);
+
+        zk.create("/a/b/c/d", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c/d", stat);
+
+        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c/d/e", stat);
+
+        stat = zk.setData("/a/b/c/d/e", new byte[0], -1);
+        assertEvent(events, EventType.NodeDataChanged, "/a/b/c/d/e", stat);
+
         zk.delete("/a/b/c/d/e", -1);
-        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c/d");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c/d/e");
-        assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c/d/e");
-        assertEvent(events, Watcher.Event.EventType.NodeDeleted, "/a/b/c/d/e");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c/d/e");
+        assertEvent(events, EventType.NodeDeleted, "/a/b/c/d/e", zk.exists("/a/b/c/d", false).getPzxid());
+
+        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c/d/e", stat);
     }
 
     @Test
@@ -104,14 +113,15 @@ public void testRemoval()
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE);
             zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c");
+            Stat stat = new Stat();
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a/b", stat);
+            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a/b/c", stat);
 
             zk.removeWatches("/a/b", persistentWatcher, Watcher.WatcherType.Any, false);
             zk.create("/a/b/c/d", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(events, Watcher.Event.EventType.PersistentWatchRemoved, "/a/b");
+            assertEvent(events, EventType.PersistentWatchRemoved, "/a/b", WatchedEvent.NO_ZXID);
         }
     }
 
@@ -125,13 +135,15 @@ public void testNoChildEvents() throws Exception {
             BlockingQueue<WatchedEvent> childEvents = new LinkedBlockingQueue<>();
             zk.getChildren("/a", childEvents::add);
 
-            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            Stat createABStat = new Stat();
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, createABStat);
+            Stat createABCStat = new Stat();
+            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, createABCStat);
 
-            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", createABStat.getPzxid());
 
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c");
+            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b", createABStat);
+            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c", createABCStat);
             assertTrue(events.isEmpty());
         }
     }
@@ -141,9 +153,9 @@ public void testDisconnect() throws Exception {
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE);
             stopServer();
-            assertEvent(events, Watcher.Event.EventType.None, null);
+            assertEvent(events, EventType.None, KeeperState.Disconnected, null, WatchedEvent.NO_ZXID);
             startServer();
-            assertEvent(events, Watcher.Event.EventType.None, null);
+            assertEvent(events, EventType.None, KeeperState.SyncConnected, null, WatchedEvent.NO_ZXID);
             internalTestBasic(zk);
         }
     }
@@ -158,17 +170,15 @@ public void testMultiClient()
             zk1.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
             zk1.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE);
-            zk1.setData("/a/b/c", "one".getBytes(), -1);
-            Thread.sleep(1000); // give some time for the event to arrive
-
-            zk2.setData("/a/b/c", "two".getBytes(), -1);
-            zk2.setData("/a/b/c", "three".getBytes(), -1);
-            zk2.setData("/a/b/c", "four".getBytes(), -1);
-
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
+            Stat stat = zk1.setData("/a/b/c", "one".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
+
+            stat = zk2.setData("/a/b/c", "two".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
+            stat = zk2.setData("/a/b/c", "three".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
+            stat = zk2.setData("/a/b/c", "four".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
         }
     }
 
@@ -224,22 +234,42 @@ public void testRootWatcher()
             throws IOException, InterruptedException, KeeperException {
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             zk.addWatch("/", persistentWatcher, PERSISTENT_RECURSIVE);
-            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/b/c");
+            Stat stat = new Stat();
+
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a", stat.getMzxid());
+
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a/b", stat.getMzxid());
+
+            zk.create("/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/b", stat.getMzxid());
+
+            zk.create("/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/b/c", stat.getMzxid());
         }
     }
 
-    private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
-            throws InterruptedException {
-        WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
-        assertNotNull(event);
-        assertEquals(eventType, event.getType());
-        assertEquals(path, event.getPath());
+    private void assertEvent(BlockingQueue<WatchedEvent> events, EventType eventType, String path, Stat stat)
+        throws InterruptedException {
+        assertEvent(events, eventType, path, stat.getMzxid());
+    }
+
+    private void assertEvent(BlockingQueue<WatchedEvent> events, EventType eventType, String path, long zxid)
+        throws InterruptedException {
+        assertEvent(events, eventType, KeeperState.SyncConnected, path, zxid);
+    }
+
+    private void assertEvent(BlockingQueue<WatchedEvent> events, EventType eventType, KeeperState keeperState,
+        String path, long zxid) throws InterruptedException {
+        WatchedEvent actualEvent = events.poll(5, TimeUnit.SECONDS);
+        assertNotNull(actualEvent);
+        WatchedEvent expectedEvent = new WatchedEvent(
+            eventType,
+            keeperState,
+            path,
+            zxid
+        );
+        TestUtils.assertWatchedEventEquals(expectedEvent, actualEvent);
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
index 00c6c070a04..e3306c1fe76 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
@@ -18,8 +18,10 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import org.apache.zookeeper.WatchedEvent;
 
 /**
  * This class contains test utility methods
@@ -57,4 +59,16 @@ public static boolean deleteFileRecursively(File file) {
         return deleteFileRecursively(file, false);
     }
 
+    /**
+     * Asserts that the given {@link WatchedEvent} are semantically equal, i.e. they have the same EventType, path and
+     * zxid.
+     */
+    public static void assertWatchedEventEquals(WatchedEvent expected, WatchedEvent actual) {
+        // TODO: .hashCode and .equals cannot be added to WatchedEvent without potentially breaking consumers. This
+        //  can be changed to `assertEquals(expected, actual)` once WatchedEvent has those methods. Until then,
+        //  compare the lists manually.
+        assertEquals(expected.getType(), actual.getType());
+        assertEquals(expected.getPath(), actual.getPath());
+        assertEquals(expected.getZxid(), actual.getZxid());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
index a3d6eef7bdc..cce26276cdd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
@@ -59,12 +59,12 @@ public void removeWatcher(Watcher watcher) {
         }
 
         @Override
-        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type) {
+        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid) {
             return new WatcherOrBitSet(Collections.emptySet());
         }
 
         @Override
-        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, WatcherOrBitSet suppress) {
+        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid, WatcherOrBitSet suppress) {
             return new WatcherOrBitSet(Collections.emptySet());
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
index f4a0298f233..a9bc11da2a6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
@@ -61,7 +61,7 @@ public void testCreatingWatchedEventFromWrapper() {
         for (EventType et : allTypes) {
             for (KeeperState ks : allStates) {
                 wep = new WatcherEvent(et.getIntValue(), ks.getIntValue(), "blah");
-                we = new WatchedEvent(wep);
+                we = new WatchedEvent(wep, WatchedEvent.NO_ZXID);
                 assertEquals(et, we.getType());
                 assertEquals(ks, we.getState());
                 assertEquals("blah", we.getPath());
@@ -75,7 +75,7 @@ public void testCreatingWatchedEventFromInvalidWrapper() {
 
         try {
             WatcherEvent wep = new WatcherEvent(-2342, -252352, "foo");
-            new WatchedEvent(wep);
+            new WatchedEvent(wep, WatchedEvent.NO_ZXID);
             fail("Was able to create WatchedEvent from bad wrapper");
         } catch (RuntimeException re) {
             // we're good
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
index 180cd08a611..44440a7c3bb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
@@ -37,6 +37,7 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.Stat;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -68,14 +69,17 @@ public void process(WatchedEvent event) {
                 assertTrue(false, "interruption unexpected");
             }
         }
-        public void verify(List<EventType> expected) throws InterruptedException {
+
+        public void verify(List<WatchedEvent> expected) throws InterruptedException {
+            List<WatchedEvent> actual = new ArrayList<>();
             WatchedEvent event;
-            int count = 0;
-            while (count < expected.size() && (event = events.poll(30, TimeUnit.SECONDS)) != null) {
-                assertEquals(expected.get(count), event.getType());
-                count++;
+            while (actual.size() < expected.size() && (event = events.poll(30, TimeUnit.SECONDS)) != null) {
+                actual.add(event);
+            }
+            assertEquals(expected.size(), actual.size());
+            for (int i = 0; i < expected.size(); i++) {
+                TestUtils.assertWatchedEventEquals(expected.get(i), actual.get(i));
             }
-            assertEquals(expected.size(), count);
             events.clear();
         }
 
@@ -88,7 +92,7 @@ public void verify(List<EventType> expected) throws InterruptedException {
     private volatile CountDownLatch lsnr_latch;
     private ZooKeeper lsnr;
 
-    private List<EventType> expected;
+    private List<WatchedEvent> expected;
 
     @BeforeEach
     @Override
@@ -127,15 +131,34 @@ private void verify() throws InterruptedException {
         expected.clear();
     }
 
+    private void addEvent(List<WatchedEvent> events, EventType eventType, String path, Stat stat) {
+        addEvent(events, eventType, path, stat.getMzxid());
+    }
+
+    private void addEvent(List<WatchedEvent> events, EventType eventType, String path, long zxid) {
+        events.add(new WatchedEvent(eventType, KeeperState.SyncConnected, path, zxid));
+    }
+
+    private long delete(String path) throws InterruptedException, KeeperException {
+        client.delete(path, -1);
+        int lastSlash = path.lastIndexOf('/');
+        String parent = (lastSlash == 0)
+            ? "/"
+            : path.substring(0, lastSlash);
+        // the deletion's zxid will be reflected in the parent's Pzxid
+        return client.exists(parent, false).getPzxid();
+    }
+
     @Test
     public void testExistsSync() throws IOException, InterruptedException, KeeperException {
         assertNull(lsnr.exists("/foo", true));
         assertNull(lsnr.exists("/foo/bar", true));
 
-        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeCreated);
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeCreated);
+        Stat stat = new Stat();
+        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeCreated, "/foo", stat);
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeCreated, "/foo/bar", stat);
 
         verify();
 
@@ -160,20 +183,20 @@ public void testExistsSync() throws IOException, InterruptedException, KeeperExc
             assertEquals("/foo/car", e.getPath());
         }
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
+        stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo/bar", stat);
 
         verify();
 
         assertNotNull(lsnr.exists("/foo", true));
         assertNotNull(lsnr.exists("/foo/bar", true));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(expected, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         verify();
     }
@@ -200,20 +223,20 @@ public void testGetDataSync() throws IOException, InterruptedException, KeeperEx
         client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertNotNull(lsnr.getData("/foo/bar", true, null));
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
+        Stat stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo/bar", stat);
 
         verify();
 
         assertNotNull(lsnr.getData("/foo", true, null));
         assertNotNull(lsnr.getData("/foo/bar", true, null));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(expected, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         verify();
     }
@@ -238,8 +261,9 @@ public void testGetChildrenSync() throws IOException, InterruptedException, Keep
         client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertNotNull(lsnr.getChildren("/foo", true));
 
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeChildrenChanged); // /foo
+        Stat stat = new Stat();
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", stat); // /foo
         assertNotNull(lsnr.getChildren("/foo/bar", true));
 
         client.setData("/foo", "parent".getBytes(), -1);
@@ -250,11 +274,11 @@ public void testGetChildrenSync() throws IOException, InterruptedException, Keep
         assertNotNull(lsnr.getChildren("/foo", true));
         assertNotNull(lsnr.getChildren("/foo/bar", true));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted); // /foo/bar childwatch
-        expected.add(EventType.NodeChildrenChanged); // /foo
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(expected, EventType.NodeDeleted, "/foo/bar", deleteZxid); // /foo/bar childwatch
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", deleteZxid); // /foo
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         verify();
     }
@@ -266,7 +290,7 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<>();
+        List<WatchedEvent> e2 = new ArrayList<>();
 
         assertNull(lsnr.exists("/foo", true));
         assertNull(lsnr.exists("/foo", w1));
@@ -276,10 +300,11 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         assertNull(lsnr.exists("/foo/bar", w3));
         assertNull(lsnr.exists("/foo/bar", w4));
 
-        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeCreated);
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        e2.add(EventType.NodeCreated);
+        Stat stat = new Stat();
+        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeCreated, "/foo", stat);
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(e2, EventType.NodeCreated, "/foo/bar", stat);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -297,10 +322,10 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         assertNotNull(lsnr.exists("/foo/bar", w4));
         assertNotNull(lsnr.exists("/foo/bar", w4));
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        e2.add(EventType.NodeDataChanged);
+        stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(e2, EventType.NodeDataChanged, "/foo/bar", stat);
 
         lsnr_dwatch.verify(new ArrayList<>()); // not reg so should = 0
         w1.verify(expected);
@@ -319,10 +344,10 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         assertNotNull(lsnr.exists("/foo/bar", w3));
         assertNotNull(lsnr.exists("/foo/bar", w4));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        e2.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(e2, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -331,7 +356,6 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         w4.verify(e2);
         expected.clear();
         e2.clear();
-
     }
 
     @Test
@@ -341,7 +365,7 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<>();
+        List<WatchedEvent> e2 = new ArrayList<>();
 
         try {
             lsnr.getData("/foo", w1, null);
@@ -367,10 +391,10 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         assertNotNull(lsnr.getData("/foo/bar", w4, null));
         assertNotNull(lsnr.getData("/foo/bar", w4, null));
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        e2.add(EventType.NodeDataChanged);
+        Stat stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(e2, EventType.NodeDataChanged, "/foo/bar", stat);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -387,10 +411,10 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         assertNotNull(lsnr.getData("/foo/bar", w3, null));
         assertNotNull(lsnr.getData("/foo/bar", w4, null));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        e2.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(e2, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -408,7 +432,7 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<>();
+        List<WatchedEvent> e2 = new ArrayList<>();
 
         try {
             lsnr.getChildren("/foo", true);
@@ -429,8 +453,9 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         assertNotNull(lsnr.getChildren("/foo", true));
         assertNotNull(lsnr.getChildren("/foo", w1));
 
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeChildrenChanged); // /foo
+        Stat stat = new Stat();
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", stat); // /foo
         assertNotNull(lsnr.getChildren("/foo/bar", w2));
         assertNotNull(lsnr.getChildren("/foo/bar", w2));
         assertNotNull(lsnr.getChildren("/foo/bar", w3));
@@ -451,11 +476,11 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         assertNotNull(lsnr.getChildren("/foo/bar", w4));
         assertNotNull(lsnr.getChildren("/foo/bar", w4));
 
-        client.delete("/foo/bar", -1);
-        e2.add(EventType.NodeDeleted); // /foo/bar childwatch
-        expected.add(EventType.NodeChildrenChanged); // /foo
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(e2, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", deleteZxid); // /foo
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);

From 6254f3314199ad215cd06a7bfa8d5570dd3f2062 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Fri, 16 Jun 2023 21:59:26 +0800
Subject: [PATCH 371/591] ZOOKEEPER-4655: [ADDENDUM] fix build error (#2012)

PR #1950(ZOOKEEPER-4655) was created before #1859(ZOOKEEPER-4466) merged.
It changes `assertEvent`'s signature which is depended by #1859.
---
 .../test/PersistentRecursiveWatcherTest.java  | 43 ++++++++++---------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index 440485e660f..be8b90e616a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -194,38 +194,41 @@ public void testSamePathWithDifferentWatchModes() throws Exception {
             zk.addWatch("/a", recursiveEvents::add, PERSISTENT_RECURSIVE);
             zk.exists("/a", dataEvents::add);
 
-            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(dataEvents, Watcher.Event.EventType.NodeCreated, "/a");
-            assertEvent(persistentEvents, Watcher.Event.EventType.NodeCreated, "/a");
-            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a");
+            Stat stat = new Stat();
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeCreated, "/a", stat);
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeCreated, "/a", stat);
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a", stat);
 
             zk.getData("/a", dataEvents::add, null);
-            zk.setData("/a", new byte[0], -1);
-            assertEvent(dataEvents, Watcher.Event.EventType.NodeDataChanged, "/a");
-            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDataChanged, "/a");
-            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDataChanged, "/a");
+            stat = zk.setData("/a", new byte[0], -1);
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDataChanged, "/a", stat);
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDataChanged, "/a", stat);
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDataChanged, "/a", stat);
 
             zk.getChildren("/a", childEvents::add);
-            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
-            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
-            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a/b");
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat);
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat);
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a/b", stat);
 
             zk.getChildren("/a", childEvents::add);
             zk.delete("/a/b", -1);
-            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
-            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a");
-            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a/b");
+            stat = zk.exists("/a", false);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat.getPzxid());
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat.getPzxid());
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a/b", stat.getPzxid());
 
             zk.getChildren("/a", childEvents::add);
             zk.getData("/a", dataEvents::add, null);
             zk.exists("/a", dataEvents::add);
             zk.delete("/a", -1);
-            assertEvent(childEvents, Watcher.Event.EventType.NodeDeleted, "/a");
-            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a");
-            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a");
-            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDeleted, "/a");
-            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a");
+            stat = zk.exists("/", false);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
         }
     }
 

From 878c7602ec65da49a4fa464cda2f8d7409f89909 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Fri, 16 Jun 2023 21:37:48 +0200
Subject: [PATCH 372/591] ZOOKEEPER-4705. Limit merge buttons to squash (#2011)

---
 .asf.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.asf.yaml b/.asf.yaml
index a050c4d88b6..90b1339d2c2 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -41,6 +41,10 @@ github:
     wiki: false
     issues: false
     projects: false
+  enabled_merge_buttons:
+    squash:  true
+    merge:   false
+    rebase:  false
 
 notifications:
   jira_options: link label worklog

From dbd1ba3b531c28d0da332ebdd7ccf3d336462d51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vill=C5=91=20Sz=C5=B1cs?= <szucsvillo@cloudera.com>
Date: Fri, 16 Jun 2023 21:48:18 +0200
Subject: [PATCH 373/591] ZOOKEEPER-4700: Update Jetty for fixing
 CVE-2023-26048 and CVE-2023-26049
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I18a2da2e104a21e0b248c444077d49e326893f57

Author: Villő Szűcs <szucsvillo@cloudera.com>

Reviewers: andor@apache.org, eolivelli@apache.org, tison@apache.org

Closes #2007 from szucsvillo/ZOOKEEPER-4700
---
 pom.xml                                                         | 2 +-
 ...0914.LICENSE.txt => jetty-http-9.4.51.v20230217.LICENSE.txt} | 0
 ...220914.LICENSE.txt => jetty-io-9.4.51.v20230217.LICENSE.txt} | 0
 ....LICENSE.txt => jetty-security-9.4.51.v20230217.LICENSE.txt} | 0
 ...14.LICENSE.txt => jetty-server-9.4.51.v20230217.LICENSE.txt} | 0
 ...4.LICENSE.txt => jetty-servlet-9.4.51.v20230217.LICENSE.txt} | 0
 ...0914.LICENSE.txt => jetty-util-9.4.51.v20230217.LICENSE.txt} | 0
 ...LICENSE.txt => jetty-util-ajax-9.4.51.v20230217.LICENSE.txt} | 0
 8 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.49.v20220914.LICENSE.txt => jetty-http-9.4.51.v20230217.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.49.v20220914.LICENSE.txt => jetty-io-9.4.51.v20230217.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.49.v20220914.LICENSE.txt => jetty-security-9.4.51.v20230217.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.49.v20220914.LICENSE.txt => jetty-server-9.4.51.v20230217.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.49.v20220914.LICENSE.txt => jetty-servlet-9.4.51.v20230217.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.49.v20220914.LICENSE.txt => jetty-util-9.4.51.v20230217.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.49.v20220914.LICENSE.txt => jetty-util-ajax-9.4.51.v20230217.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 9252090cebe..a7b7ebae82d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.86.Final</netty.version>
-    <jetty.version>9.4.49.v20220914</jetty.version>
+    <jetty.version>9.4.51.v20230217</jetty.version>
     <jackson.version>2.13.4.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.9.1</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.51.v20230217.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.51.v20230217.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.51.v20230217.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.51.v20230217.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.51.v20230217.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.51.v20230217.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.49.v20220914.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.51.v20230217.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.49.v20220914.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.51.v20230217.LICENSE.txt

From df8a53a974e295cc6d9337800b693751ece4e440 Mon Sep 17 00:00:00 2001
From: Binyu Huang <huangbinyu000@outlook.com>
Date: Sat, 17 Jun 2023 03:58:07 +0800
Subject: [PATCH 374/591] ZOOKEEPER-3615: Provide formal specification and
 verification using TLA+ for Zab (#1690)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* push zab-tla into project

* update experiment

* modify experiment/README

* update data

* update experiment data

* fix bugs, miss broadcast info of proposalMsgsLog in NEWLEADER, modify LocalPrimaryOrder; update pdf and README

* add apache license to pass building, and updata experiment data

* add testVars in ZabWithQTest.tla, update README

* + handling of cepochSent in receiving NEWEPOCH to decrease meaningles… …

* add Apache License in tla file

* Update line number of actions from tla file in README

* project migration, update README, add test tla file by extending Zab.tla

* modify .cfg by adding license header, delete .aux and .tex

* upload zab-1.0-tla

* update ZabWithFLE, update results

* update zab-1.0

* fix bug, modify README

* modify test module

* Update spec: implement phase of recovery-sync in ZabWithFLEAndSYNC.tla

* update ZabWithFLEAndSYNC: Replace Value with recorder.nClientRequest, and modify actions related to TxnEqual and nClientRequest

* update ZabWithFLEAndSYNC: Replace Value with recorder.nClientRequest, and modify actions related to TxnEqual and nClientRequest

* update zabWithFLEAndSYNC: fix bug only occured in multiple servers(>=3), when follower may receive LEADERINFO twice.

* update zab pre-1.0 in paper DSN'2011

* update zookeeper-specifications: update framework and tla code
---
 .../server/quorum/LearnerHandler.java         |    2 +-
 .../protocol-spec/Zab.tla                     | 1233 ++++++++++
 zookeeper-specifications/protocol-spec/doc.md |  102 +
 .../protocol-spec/issues.md                   |   40 +
 .../pic/case_leader_process_cepoch.png        |  Bin 0 -> 406431 bytes
 .../pic/protocol-spec-mck-bug1.png            |  Bin 0 -> 273630 bytes
 .../pic/protocol-spec-mck-bug2.png            |  Bin 0 -> 237170 bytes
 .../pic/protocol-spec-mck-bug3.png            |  Bin 0 -> 371170 bytes
 .../protocol-spec/verification-statistics.md  |   44 +
 zookeeper-specifications/system-spec/doc.md   |   17 +
 .../system-spec/zk-3.7/FastLeaderElection.tla |  535 +++++
 .../system-spec/zk-3.7/ZkV3_7_0.tla           | 2032 +++++++++++++++++
 12 files changed, 4004 insertions(+), 1 deletion(-)
 create mode 100644 zookeeper-specifications/protocol-spec/Zab.tla
 create mode 100644 zookeeper-specifications/protocol-spec/doc.md
 create mode 100644 zookeeper-specifications/protocol-spec/issues.md
 create mode 100644 zookeeper-specifications/protocol-spec/pic/case_leader_process_cepoch.png
 create mode 100644 zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug1.png
 create mode 100644 zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug2.png
 create mode 100644 zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug3.png
 create mode 100644 zookeeper-specifications/protocol-spec/verification-statistics.md
 create mode 100644 zookeeper-specifications/system-spec/doc.md
 create mode 100644 zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
 create mode 100644 zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 169c3d1d2b0..e9d5cd4e5e8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -1031,7 +1031,7 @@ protected long queueCommittedProposals(Iterator<Proposal> itr, long peerLastZxid
             // is the catch when our history older than learner and there is
             // no new txn since then. So we need an empty diff
             LOG.info(
-                "Sending TRUNC zxid=0x{}  for peer sid: {}",
+                "Sending DIFF zxid=0x{}  for peer sid: {}",
                 Long.toHexString(lastCommittedZxid),
                 getSid());
             queueOpPacket(Leader.DIFF, lastCommittedZxid);
diff --git a/zookeeper-specifications/protocol-spec/Zab.tla b/zookeeper-specifications/protocol-spec/Zab.tla
new file mode 100644
index 00000000000..4016f08e1e5
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/Zab.tla
@@ -0,0 +1,1233 @@
+-------------------------------- MODULE Zab ---------------------------------
+(* This is the formal specification for the Zab consensus algorithm,
+   in DSN'2011, which represents protocol specification in our work.*)
+EXTENDS Integers, FiniteSets, Sequences, Naturals, TLC
+-----------------------------------------------------------------------------
+\* The set of servers
+CONSTANT Server
+\* States of server
+CONSTANTS LOOKING, FOLLOWING, LEADING
+\* Zab states of server
+CONSTANTS ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST
+\* Message types
+CONSTANTS CEPOCH, NEWEPOCH, ACKEPOCH, NEWLEADER, ACKLD, COMMITLD, PROPOSE, ACK, COMMIT
+\* [MaxTimeoutFailures, MaxTransactionNum, MaxEpoch, MaxRestarts]
+CONSTANT Parameters
+
+MAXEPOCH == 10
+NullPoint == CHOOSE p: p \notin Server
+Quorums == {Q \in SUBSET Server: Cardinality(Q)*2 > Cardinality(Server)}
+-----------------------------------------------------------------------------
+\* Variables that all servers use.
+VARIABLES state,          \* State of server, in {LOOKING, FOLLOWING, LEADING}.
+          zabState,       \* Current phase of server, in
+                          \* {ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST}.
+          acceptedEpoch,  \* Epoch of the last LEADERINFO packet accepted,
+                          \* namely f.p in paper.
+          currentEpoch,   \* Epoch of the last NEWLEADER packet accepted,
+                          \* namely f.a in paper.
+          history,        \* History of servers: sequence of transactions,
+                          \* containing: [zxid, value, ackSid, epoch].
+          lastCommitted   \* Maximum index and zxid known to be committed,
+                          \* namely 'lastCommitted' in Leader. Starts from 0,
+                          \* and increases monotonically before restarting.
+
+\* Variables only used for leader.
+VARIABLES learners,       \* Set of servers leader connects.
+          cepochRecv,     \* Set of learners leader has received CEPOCH from.
+                          \* Set of record [sid, connected, epoch],
+                          \* where epoch means f.p from followers.
+          ackeRecv,       \* Set of learners leader has received ACKEPOCH from.
+                          \* Set of record 
+                          \* [sid, connected, peerLastEpoch, peerHistory],
+                          \* to record f.a and h(f) from followers.
+          ackldRecv,      \* Set of learners leader has received ACKLD from.
+                          \* Set of record [sid, connected].
+          sendCounter     \* Count of txns leader has broadcast.
+
+\* Variables only used for follower.
+VARIABLES connectInfo \* If follower has connected with leader.
+                      \* If follower lost connection, then null.
+
+\* Variable representing oracle of leader.
+VARIABLE  leaderOracle  \* Current oracle.
+
+\* Variables about network channel.
+VARIABLE  msgs       \* Simulates network channel.
+                     \* msgs[i][j] means the input buffer of server j 
+                     \* from server i.
+
+\* Variables only used in verifying properties.
+VARIABLES epochLeader,       \* Set of leaders in every epoch.
+          proposalMsgsLog,   \* Set of all broadcast messages.
+          violatedInvariants \* Check whether there are conditions 
+                             \* contrary to the facts.
+
+\* Variable used for recording critical data,
+\* to constrain state space or update values.
+VARIABLE  recorder \* Consists: members of Parameters and pc, values.
+                   \* Form is record: 
+                   \* [pc, nTransaction, maxEpoch, nTimeout, nRestart, nClientRequest]
+
+serverVars == <<state, zabState, acceptedEpoch, currentEpoch, 
+                history, lastCommitted>>
+
+leaderVars == <<learners, cepochRecv, ackeRecv, ackldRecv, 
+                sendCounter>>
+
+followerVars == connectInfo
+
+electionVars == leaderOracle
+
+msgVars == msgs
+
+verifyVars == <<proposalMsgsLog, epochLeader, violatedInvariants>>
+
+vars == <<serverVars, leaderVars, followerVars, electionVars, 
+          msgVars, verifyVars, recorder>>
+-----------------------------------------------------------------------------
+\* Return the maximum value from the set S
+Maximum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n >= m
+\* Return the minimum value from the set S
+Minimum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n <= m
+
+\* Check server state                       
+IsLeader(s)   == state[s] = LEADING
+IsFollower(s) == state[s] = FOLLOWING
+IsLooking(s)  == state[s] = LOOKING
+
+\* Check if s is a quorum
+IsQuorum(s) == s \in Quorums
+
+IsMyLearner(i, j) == j \in learners[i]
+IsMyLeader(i, j)  == connectInfo[i] = j
+HasNoLeader(i)    == connectInfo[i] = NullPoint
+HasLeader(i)      == connectInfo[i] /= NullPoint
+-----------------------------------------------------------------------------
+\* FALSE: zxid1 <= zxid2; TRUE: zxid1 > zxid2
+ZxidCompare(zxid1, zxid2) == \/ zxid1[1] > zxid2[1]
+                             \/ /\ zxid1[1] = zxid2[1]
+                                /\ zxid1[2] > zxid2[2]
+
+ZxidEqual(zxid1, zxid2) == zxid1[1] = zxid2[1] /\ zxid1[2] = zxid2[2]
+
+TxnZxidEqual(txn, z) == txn.zxid[1] = z[1] /\ txn.zxid[2] = z[2]
+
+TxnEqual(txn1, txn2) == /\ ZxidEqual(txn1.zxid, txn2.zxid)
+                        /\ txn1.value = txn2.value
+
+EpochPrecedeInTxn(txn1, txn2) == txn1.zxid[1] < txn2.zxid[1]
+-----------------------------------------------------------------------------
+\* Actions about recorder
+GetParameter(p) == IF p \in DOMAIN Parameters THEN Parameters[p] ELSE 0
+GetRecorder(p)  == IF p \in DOMAIN recorder   THEN recorder[p]   ELSE 0
+
+RecorderGetHelper(m) == (m :> recorder[m])
+RecorderIncHelper(m) == (m :> recorder[m] + 1)
+
+RecorderIncTimeout == RecorderIncHelper("nTimeout")
+RecorderGetTimeout == RecorderGetHelper("nTimeout")
+RecorderIncRestart == RecorderIncHelper("nRestart")
+RecorderGetRestart == RecorderGetHelper("nRestart")
+RecorderSetTransactionNum(pc) == ("nTransaction" :> 
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    LET s == CHOOSE i \in Server: 
+                                        \A j \in Server: Len(history'[i]) >= Len(history'[j])                       
+                                    IN Len(history'[s])
+                                ELSE recorder["nTransaction"])
+RecorderSetMaxEpoch(pc)       == ("maxEpoch" :> 
+                                IF pc[1] = "LeaderProcessCEPOCH" THEN
+                                    LET s == CHOOSE i \in Server:
+                                        \A j \in Server: acceptedEpoch'[i] >= acceptedEpoch'[j]
+                                    IN acceptedEpoch'[s]
+                                ELSE recorder["maxEpoch"])
+RecorderSetRequests(pc)       == ("nClientRequest" :>
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    recorder["nClientRequest"] + 1
+                                ELSE recorder["nClientRequest"] )
+RecorderSetPc(pc)      == ("pc" :> pc)
+RecorderSetFailure(pc) == CASE pc[1] = "Timeout"         -> RecorderIncTimeout @@ RecorderGetRestart
+                          []   pc[1] = "LeaderTimeout"   -> RecorderIncTimeout @@ RecorderGetRestart
+                          []   pc[1] = "FollowerTimeout" -> RecorderIncTimeout @@ RecorderGetRestart
+                          []   pc[1] = "Restart"         -> RecorderIncTimeout @@ RecorderIncRestart
+                          []   OTHER                     -> RecorderGetTimeout @@ RecorderGetRestart
+
+UpdateRecorder(pc) == recorder' = RecorderSetFailure(pc)      @@ RecorderSetTransactionNum(pc)
+                                  @@ RecorderSetMaxEpoch(pc)  @@ RecorderSetPc(pc) 
+                                  @@ RecorderSetRequests(pc)  @@ recorder
+UnchangeRecorder   == UNCHANGED recorder
+
+CheckParameterHelper(n, p, Comp(_,_)) == IF p \in DOMAIN Parameters 
+                                         THEN Comp(n, Parameters[p])
+                                         ELSE TRUE
+CheckParameterLimit(n, p) == CheckParameterHelper(n, p, LAMBDA i, j: i < j)
+
+CheckTimeout        == CheckParameterLimit(recorder.nTimeout,     "MaxTimeoutFailures")
+CheckTransactionNum == CheckParameterLimit(recorder.nTransaction, "MaxTransactionNum")
+CheckEpoch          == CheckParameterLimit(recorder.maxEpoch,     "MaxEpoch")
+CheckRestart        == /\ CheckTimeout 
+                       /\ CheckParameterLimit(recorder.nRestart,  "MaxRestarts")
+
+CheckStateConstraints == CheckTimeout /\ CheckTransactionNum /\ CheckEpoch /\ CheckRestart
+-----------------------------------------------------------------------------
+\* Actions about network
+PendingCEPOCH(i, j)    == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = CEPOCH
+PendingNEWEPOCH(i, j)  == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = NEWEPOCH
+PendingACKEPOCH(i, j)  == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = ACKEPOCH
+PendingNEWLEADER(i, j) == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = NEWLEADER
+PendingACKLD(i, j)     == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = ACKLD
+PendingCOMMITLD(i, j)  == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = COMMITLD
+PendingPROPOSE(i, j)   == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = PROPOSE
+PendingACK(i, j)       == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = ACK
+PendingCOMMIT(i, j)    == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = COMMIT
+\* Add a message to msgs - add a message m to msgs.
+Send(i, j, m) == msgs' = [msgs EXCEPT ![i][j] = Append(msgs[i][j], m)]
+\* Remove a message from msgs - discard head of msgs.
+Discard(i, j) == msgs' = IF msgs[i][j] /= << >> THEN [msgs EXCEPT ![i][j] = Tail(msgs[i][j])]
+                                                ELSE msgs
+\* Combination of Send and Discard - discard head of msgs[j][i] and add m into msgs.
+Reply(i, j, m) == msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                       ![i][j] = Append(msgs[i][j], m)]
+\* Shuffle input buffer.
+Clean(i, j) == msgs' = [msgs EXCEPT ![j][i] = << >>, ![i][j] = << >>]   
+CleanInputBuffer(S) == msgs' = [s \in Server |-> 
+                                    [v \in Server |-> IF v \in S THEN << >>
+                                                      ELSE msgs[s][v] ] ]
+\* Leader broadcasts a message PROPOSE to all other servers in Q.
+\* Note: In paper, Q is fuzzy. We think servers who leader broadcasts NEWLEADER to
+\*       should receive every PROPOSE. So we consider ackeRecv as Q.
+\* Since we let ackeRecv = Q, there may exist some follower receiving COMMIT before
+\* COMMITLD, and zxid in COMMIT later than zxid in COMMITLD. To avoid this situation,
+\* if f \in ackeRecv but \notin ackldRecv, f should not receive COMMIT until 
+\* f \in ackldRecv and receives COMMITLD.
+Broadcast(i, m) ==
+        LET ackeRecv_quorum == {a \in ackeRecv[i]: a.connected = TRUE }
+            sid_ackeRecv == { a.sid: a \in ackeRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![i] = [v \in Server |-> IF /\ v \in sid_ackeRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]  
+\* Since leader decides to broadcasts message COMMIT when processing ACK, so
+\* we need to discard ACK and broadcast COMMIT.
+\* Here Q is ackldRecv, because we assume that f should not receive COMMIT until
+\* f receives COMMITLD.
+DiscardAndBroadcast(i, j, m) ==
+        LET ackldRecv_quorum == {a \in ackldRecv[i]: a.connected = TRUE }
+            sid_ackldRecv == { a.sid: a \in ackldRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in sid_ackldRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]  
+\* Leader broadcasts LEADERINFO to all other servers in cepochRecv.
+DiscardAndBroadcastNEWEPOCH(i, j, m) ==
+        LET new_cepochRecv_quorum == {c \in cepochRecv'[i]: c.connected = TRUE }
+            new_sid_cepochRecv == { c.sid: c \in new_cepochRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in new_sid_cepochRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]
+\* Leader broadcasts NEWLEADER to all other servers in ackeRecv.
+DiscardAndBroadcastNEWLEADER(i, j, m) ==
+        LET new_ackeRecv_quorum == {a \in ackeRecv'[i]: a.connected = TRUE }
+            new_sid_ackeRecv == { a.sid: a \in new_ackeRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in new_sid_ackeRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]
+\* Leader broadcasts COMMITLD to all other servers in ackldRecv.
+DiscardAndBroadcastCOMMITLD(i, j, m) ==
+        LET new_ackldRecv_quorum == {a \in ackldRecv'[i]: a.connected = TRUE }
+            new_sid_ackldRecv == { a.sid: a \in new_ackldRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in new_sid_ackldRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]
+-----------------------------------------------------------------------------
+\* Define initial values for all variables 
+InitServerVars == /\ state         = [s \in Server |-> LOOKING]
+                  /\ zabState      = [s \in Server |-> ELECTION]
+                  /\ acceptedEpoch = [s \in Server |-> 0]
+                  /\ currentEpoch  = [s \in Server |-> 0]
+                  /\ history       = [s \in Server |-> << >>]
+                  /\ lastCommitted = [s \in Server |-> [ index |-> 0,
+                                                         zxid  |-> <<0, 0>> ] ]
+
+InitLeaderVars == /\ learners       = [s \in Server |-> {}]
+                  /\ cepochRecv     = [s \in Server |-> {}]
+                  /\ ackeRecv       = [s \in Server |-> {}]
+                  /\ ackldRecv      = [s \in Server |-> {}]
+                  /\ sendCounter    = [s \in Server |-> 0]
+
+InitFollowerVars == connectInfo = [s \in Server |-> NullPoint]
+
+InitElectionVars == leaderOracle = NullPoint
+
+InitMsgVars == msgs = [s \in Server |-> [v \in Server |-> << >>] ]
+
+InitVerifyVars == /\ proposalMsgsLog    = {}
+                  /\ epochLeader        = [i \in 1..MAXEPOCH |-> {} ]
+                  /\ violatedInvariants = [stateInconsistent    |-> FALSE,
+                                           proposalInconsistent |-> FALSE,
+                                           commitInconsistent   |-> FALSE,
+                                           ackInconsistent      |-> FALSE,
+                                           messageIllegal       |-> FALSE ]
+
+InitRecorder == recorder = [nTimeout       |-> 0,
+                            nTransaction   |-> 0,
+                            maxEpoch       |-> 0,
+                            nRestart       |-> 0,
+                            pc             |-> <<"Init">>,
+                            nClientRequest |-> 0]
+
+Init == /\ InitServerVars
+        /\ InitLeaderVars
+        /\ InitFollowerVars
+        /\ InitElectionVars
+        /\ InitVerifyVars
+        /\ InitMsgVars
+        /\ InitRecorder
+-----------------------------------------------------------------------------
+\* Utils in state switching
+FollowerShutdown(i) == 
+        /\ state'    = [state      EXCEPT ![i] = LOOKING]
+        /\ zabState' = [zabState   EXCEPT ![i] = ELECTION]
+        /\ connectInfo' = [connectInfo EXCEPT ![i] = NullPoint]
+
+LeaderShutdown(i) ==
+        /\ LET S == learners[i]
+           IN /\ state' = [s \in Server |-> IF s \in S THEN LOOKING ELSE state[s] ]
+              /\ zabState' = [s \in Server |-> IF s \in S THEN ELECTION ELSE zabState[s] ]
+              /\ connectInfo' = [s \in Server |-> IF s \in S THEN NullPoint ELSE connectInfo[s] ]
+              /\ CleanInputBuffer(S)
+        /\ learners'   = [learners   EXCEPT ![i] = {}]
+
+SwitchToFollower(i) ==
+        /\ state' = [state EXCEPT ![i] = FOLLOWING]
+        /\ zabState' = [zabState EXCEPT ![i] = DISCOVERY]
+
+SwitchToLeader(i) ==
+        /\ state' = [state EXCEPT ![i] = LEADING]
+        /\ zabState' = [zabState EXCEPT ![i] = DISCOVERY]
+        /\ learners' = [learners EXCEPT ![i] = {i}]
+        /\ cepochRecv' = [cepochRecv EXCEPT ![i] = { [ sid       |-> i,
+                                                       connected |-> TRUE,
+                                                       epoch     |-> acceptedEpoch[i] ] }]
+        /\ ackeRecv' = [ackeRecv EXCEPT ![i] = { [ sid           |-> i,
+                                                   connected     |-> TRUE,
+                                                   peerLastEpoch |-> currentEpoch[i],
+                                                   peerHistory   |-> history[i] ] }]
+        /\ ackldRecv' = [ackldRecv EXCEPT ![i] = { [ sid       |-> i,
+                                                     connected |-> TRUE ] }]
+        /\ sendCounter' = [sendCounter EXCEPT ![i] = 0]
+
+RemoveCepochRecv(set, sid) ==
+        LET sid_cepochRecv == {s.sid: s \in set}
+        IN IF sid \notin sid_cepochRecv THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid       |-> sid,
+                                  connected |-> FALSE,
+                                  epoch     |-> info.epoch ]
+                IN (set \ {info}) \union {new_info}
+
+RemoveAckeRecv(set, sid) ==
+        LET sid_ackeRecv == {s.sid: s \in set}
+        IN IF sid \notin sid_ackeRecv THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid |-> sid,
+                                  connected |-> FALSE,
+                                  peerLastEpoch |-> info.peerLastEpoch,
+                                  peerHistory   |-> info.peerHistory ]
+                IN (set \ {info}) \union {new_info}
+
+RemoveAckldRecv(set, sid) ==
+        LET sid_ackldRecv == {s.sid: s \in set}
+        IN IF sid \notin sid_ackldRecv THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid |-> sid,
+                                  connected |-> FALSE ]
+                IN (set \ {info}) \union {new_info}
+
+RemoveLearner(i, j) ==
+        /\ learners'   = [learners   EXCEPT ![i] = @ \ {j}] 
+        /\ cepochRecv' = [cepochRecv EXCEPT ![i] = RemoveCepochRecv(@, j) ]
+        /\ ackeRecv'   = [ackeRecv   EXCEPT ![i] = RemoveAckeRecv(@, j) ]
+        /\ ackldRecv'  = [ackldRecv  EXCEPT ![i] = RemoveAckldRecv(@, j) ]
+-----------------------------------------------------------------------------
+\* Actions of election
+UpdateLeader(i) ==
+        /\ IsLooking(i)
+        /\ leaderOracle /= i
+        /\ leaderOracle' = i
+        /\ SwitchToLeader(i)
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history, lastCommitted, 
+                followerVars, verifyVars, msgVars>>
+        /\ UpdateRecorder(<<"UpdateLeader", i>>)
+
+FollowLeader(i) ==
+        /\ IsLooking(i)
+        /\ leaderOracle /= NullPoint
+        /\ \/ /\ leaderOracle = i
+              /\ SwitchToLeader(i)
+           \/ /\ leaderOracle /= i
+              /\ SwitchToFollower(i)
+              /\ UNCHANGED leaderVars
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history, lastCommitted, 
+                electionVars, followerVars, verifyVars, msgVars>>
+        /\ UpdateRecorder(<<"FollowLeader", i>>)
+
+-----------------------------------------------------------------------------
+(* Actions of situation error. Situation error in protocol spec is different
+   from latter specs. This is for compressing state space, we focus on results
+   from external events (e.g. network partition, node failure, etc.), so we do
+   not need to add variables and actions about network conditions and node 
+   conditions. It is reasonable that we have action 'Restart' but no 'Crash',
+   because when a node does not execute any internal events after restarting, 
+   this is equivalent to executing a crash.
+*)
+
+\* Timeout between leader and follower.   
+Timeout(i, j) ==
+        /\ CheckTimeout \* test restrictions of timeout
+        /\ IsLeader(i)   /\ IsMyLearner(i, j)
+        /\ IsFollower(j) /\ IsMyLeader(j, i)
+        /\ LET newLearners == learners[i] \ {j}
+           IN \/ /\ IsQuorum(newLearners)  \* just remove this learner
+                 /\ RemoveLearner(i, j)
+                 /\ FollowerShutdown(j)
+                 /\ Clean(i, j)
+              \/ /\ ~IsQuorum(newLearners) \* leader switches to looking
+                 /\ LeaderShutdown(i)
+                 /\ UNCHANGED <<cepochRecv, ackeRecv, ackldRecv>>
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history, lastCommitted,
+                       sendCounter, electionVars, verifyVars>>
+        /\ UpdateRecorder(<<"Timeout", i, j>>)
+
+Restart(i) ==
+        /\ CheckRestart \* test restrictions of restart
+        /\ \/ /\ IsLooking(i)
+              /\ UNCHANGED <<state, zabState, learners, followerVars, msgVars,
+                    cepochRecv, ackeRecv, ackldRecv>>
+           \/ /\ IsFollower(i)
+              /\ LET connectedWithLeader == HasLeader(i)
+                 IN \/ /\ connectedWithLeader
+                       /\ LET leader == connectInfo[i]
+                              newLearners == learners[leader] \ {i}
+                          IN 
+                          \/ /\ IsQuorum(newLearners)  \* leader remove learner i
+                             /\ RemoveLearner(leader, i)
+                             /\ FollowerShutdown(i)
+                             /\ Clean(leader, i)
+                          \/ /\ ~IsQuorum(newLearners) \* leader switches to looking
+                             /\ LeaderShutdown(leader)
+                             /\ UNCHANGED <<cepochRecv, ackeRecv, ackldRecv>>
+                    \/ /\ ~connectedWithLeader
+                       /\ FollowerShutdown(i)
+                       /\ CleanInputBuffer({i})
+                       /\ UNCHANGED <<learners, cepochRecv, ackeRecv, ackldRecv>>
+           \/ /\ IsLeader(i)
+              /\ LeaderShutdown(i)
+              /\ UNCHANGED <<cepochRecv, ackeRecv, ackldRecv>>
+        /\ lastCommitted' = [lastCommitted EXCEPT ![i] = [ index |-> 0,
+                                                           zxid  |-> <<0, 0>> ] ]
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history,
+                       sendCounter, leaderOracle, verifyVars>>
+        /\ UpdateRecorder(<<"Restart", i>>)
+-----------------------------------------------------------------------------
+(* Establish connection between leader and follower. *)
+ConnectAndFollowerSendCEPOCH(i, j) ==
+        /\ IsLeader(i) /\ \lnot IsMyLearner(i, j)
+        /\ IsFollower(j) /\ HasNoLeader(j) /\ leaderOracle = i
+        /\ learners'   = [learners   EXCEPT ![i] = @ \union {j}]
+        /\ connectInfo' = [connectInfo EXCEPT ![j] = i]
+        /\ Send(j, i, [ mtype  |-> CEPOCH,
+                        mepoch |-> acceptedEpoch[j] ]) \* contains f.p
+        /\ UNCHANGED <<serverVars, electionVars, verifyVars, cepochRecv,
+                       ackeRecv, ackldRecv, sendCounter>>
+        /\ UpdateRecorder(<<"ConnectAndFollowerSendCEPOCH", i, j>>)
+
+CepochRecvQuorumFormed(i) == LET sid_cepochRecv == {c.sid: c \in cepochRecv[i]}
+                             IN IsQuorum(sid_cepochRecv)
+CepochRecvBecomeQuorum(i) == LET sid_cepochRecv == {c.sid: c \in cepochRecv'[i]}
+                             IN IsQuorum(sid_cepochRecv)
+
+UpdateCepochRecv(oldSet, sid, peerEpoch) ==
+        LET sid_set == {s.sid: s \in oldSet}
+        IN IF sid \in sid_set
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                    new_info == [ sid       |-> sid,
+                                  connected |-> TRUE,
+                                  epoch     |-> peerEpoch ]
+                IN ( oldSet \ {old_info} ) \union {new_info}
+           ELSE LET follower_info == [ sid       |-> sid,
+                                       connected |-> TRUE,
+                                       epoch     |-> peerEpoch ]
+                IN oldSet \union {follower_info}
+
+\* Determine new e' in this round from a quorum of CEPOCH.
+DetermineNewEpoch(i) ==
+        LET epoch_cepochRecv == {c.epoch: c \in cepochRecv'[i]}
+        IN Maximum(epoch_cepochRecv) + 1
+
+(* Leader waits for receiving FOLLOWERINFO from a quorum including itself,
+   and chooses a new epoch e' as its own epoch and broadcasts NEWEPOCH. *)
+LeaderProcessCEPOCH(i, j) ==
+        /\ CheckEpoch  \* test restrictions of max epoch
+        /\ IsLeader(i)
+        /\ PendingCEPOCH(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+           IN /\ infoOk
+              /\ \/ \* 1. has not broadcast NEWEPOCH
+                    /\ ~CepochRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = DISCOVERY
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= DISCOVERY
+                          /\ PrintT("Exception: CepochRecvQuorumFormed false," \o
+                               " while zabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ cepochRecv' = [cepochRecv EXCEPT ![i] = UpdateCepochRecv(@, j, msg.mepoch) ]
+                    /\ \/ \* 1.1. cepochRecv becomes quorum, 
+                          \* then determine e' and broadcasts NEWEPOCH in Q. 
+                          /\ CepochRecvBecomeQuorum(i)
+                          /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = DetermineNewEpoch(i)]
+                          /\ LET m == [ mtype  |-> NEWEPOCH,
+                                        mepoch |-> acceptedEpoch'[i] ]
+                             IN DiscardAndBroadcastNEWEPOCH(i, j, m)
+                       \/ \* 1.2. cepochRecv still not quorum.
+                          /\ ~CepochRecvBecomeQuorum(i)
+                          /\ Discard(j, i)
+                          /\ UNCHANGED acceptedEpoch
+                 \/ \* 2. has broadcast NEWEPOCH
+                    /\ CepochRecvQuorumFormed(i)
+                    /\ cepochRecv' = [cepochRecv EXCEPT ![i] = UpdateCepochRecv(@, j, msg.mepoch) ]
+                    /\ Reply(i, j, [ mtype  |-> NEWEPOCH,
+                                     mepoch |-> acceptedEpoch[i] ])
+                    /\ UNCHANGED <<violatedInvariants, acceptedEpoch>>
+        /\ UNCHANGED <<state, zabState, currentEpoch, history, lastCommitted, learners, 
+                       ackeRecv, ackldRecv, sendCounter, followerVars,
+                       electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"LeaderProcessCEPOCH", i, j>>)
+
+(* Follower receives LEADERINFO. If newEpoch >= acceptedEpoch, then follower 
+   updates acceptedEpoch and sends ACKEPOCH back, containing currentEpoch and
+   history. After this, zabState turns to SYNC. *)
+FollowerProcessNEWEPOCH(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingNEWEPOCH(i, j)
+        /\ LET msg     == msgs[j][i][1]
+               infoOk  == IsMyLeader(i, j)
+               stateOk == zabState[i] = DISCOVERY
+               epochOk == msg.mepoch >= acceptedEpoch[i]
+           IN /\ infoOk
+              /\ \/ \* 1. Normal case
+                    /\ epochOk
+                    /\ \/ /\ stateOk
+                          /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = msg.mepoch]
+                          /\ LET m == [ mtype    |-> ACKEPOCH,
+                                        mepoch   |-> currentEpoch[i],
+                                        mhistory |-> history[i] ]
+                             IN Reply(i, j, m)
+                          /\ zabState' = [zabState EXCEPT ![i] = SYNCHRONIZATION]
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~stateOk
+                          /\ PrintT("Exception: Follower receives NEWEPOCH," \o
+                             " whileZabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                        EXCEPT !.stateInconsistent = TRUE]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<acceptedEpoch, zabState>>
+                    /\ UNCHANGED <<followerVars, learners, cepochRecv, ackeRecv,
+                            ackldRecv, state>>
+                 \/ \* 2. Abnormal case - go back to election
+                    /\ ~epochOk
+                    /\ FollowerShutdown(i)
+                    /\ LET leader == connectInfo[i]
+                       IN /\ Clean(i, leader)
+                          /\ RemoveLearner(leader, i)
+                    /\ UNCHANGED <<acceptedEpoch, violatedInvariants>>
+        /\ UNCHANGED <<currentEpoch, history, lastCommitted, sendCounter,
+                    electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessNEWEPOCH", i, j>>)
+
+AckeRecvQuorumFormed(i) == LET sid_ackeRecv == {a.sid: a \in ackeRecv[i]}
+                           IN IsQuorum(sid_ackeRecv)
+AckeRecvBecomeQuorum(i) == LET sid_ackeRecv == {a.sid: a \in ackeRecv'[i]}
+                           IN IsQuorum(sid_ackeRecv)
+
+UpdateAckeRecv(oldSet, sid, peerEpoch, peerHistory) ==
+        LET sid_set == {s.sid: s \in oldSet}
+            follower_info == [ sid           |-> sid,
+                               connected     |-> TRUE,
+                               peerLastEpoch |-> peerEpoch,
+                               peerHistory   |-> peerHistory ]
+        IN IF sid \in sid_set 
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                IN (oldSet \ {old_info}) \union {follower_info}
+           ELSE oldSet \union {follower_info}
+
+\* for checking invariants
+RECURSIVE SetPacketsForChecking(_,_,_,_,_,_)
+SetPacketsForChecking(set, src, ep, his, cur, end) ==
+        IF cur > end THEN set
+        ELSE LET m_proposal == [ source |-> src,
+                                 epoch  |-> ep,
+                                 zxid   |-> his[cur].zxid,
+                                 data   |-> his[cur].value ]
+             IN SetPacketsForChecking((set \union {m_proposal}), src, ep, his, cur + 1, end)
+    
+
+LastZxidOfHistory(his) == IF Len(his) = 0 THEN <<0, 0>>
+                          ELSE his[Len(his)].zxid
+
+\* TRUE: f1.a > f2.a or (f1.a = fa.a and f1.zxid >= f2.zxid)
+MoreResentOrEqual(ss1, ss2) == \/ ss1.currentEpoch > ss2.currentEpoch
+                               \/ /\ ss1.currentEpoch = ss2.currentEpoch
+                                  /\ ~ZxidCompare(ss2.lastZxid, ss1.lastZxid)
+
+\* Determine initial history Ie' in this round from a quorum of ACKEPOCH.
+DetermineInitialHistory(i) ==
+        LET set == ackeRecv'[i]
+            ss_set == { [ sid          |-> a.sid,
+                          currentEpoch |-> a.peerLastEpoch,
+                          lastZxid     |-> LastZxidOfHistory(a.peerHistory) ]
+                        : a \in set }
+            selected == CHOOSE ss \in ss_set: 
+                            \A ss1 \in (ss_set \ {ss}): MoreResentOrEqual(ss, ss1)
+            info == CHOOSE f \in set: f.sid = selected.sid
+        IN info.peerHistory
+
+RECURSIVE InitAcksidHelper(_,_)
+InitAcksidHelper(txns, src) == IF Len(txns) = 0 THEN << >>
+                               ELSE LET oldTxn == txns[1]
+                                        newTxn == [ zxid   |-> oldTxn.zxid,
+                                                    value  |-> oldTxn.value,
+                                                    ackSid |-> {src},
+                                                    epoch  |-> oldTxn.epoch ]
+                                    IN <<newTxn>> \o InitAcksidHelper( Tail(txns), src)
+
+\* Atomically let all txns in initial history contain self's acks.
+InitAcksid(i, his) == InitAcksidHelper(his, i)
+
+(* Leader waits for receiving ACKEPOPCH from a quorum, and determines initialHistory
+   according to history of whom has most recent state summary from them. After this,
+   leader's zabState turns to SYNCHRONIZATION. *)
+LeaderProcessACKEPOCH(i, j) ==
+        /\ IsLeader(i)
+        /\ PendingACKEPOCH(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+           IN /\ infoOk
+              /\ \/ \* 1. has broadcast NEWLEADER 
+                    /\ AckeRecvQuorumFormed(i)
+                    /\ ackeRecv' = [ackeRecv EXCEPT ![i] = UpdateAckeRecv(@, j, 
+                                            msg.mepoch, msg.mhistory) ]
+                    /\ LET toSend == history[i] \* contains (Ie', Be')
+                           m == [ mtype    |-> NEWLEADER,
+                                  mepoch   |-> acceptedEpoch[i],
+                                  mhistory |-> toSend ]
+                           set_forChecking == SetPacketsForChecking({ }, i, 
+                                        acceptedEpoch[i], toSend, 1, Len(toSend))
+                       IN 
+                       /\ Reply(i, j, m) 
+                       /\ proposalMsgsLog' = proposalMsgsLog \union set_forChecking
+                    /\ UNCHANGED <<violatedInvariants, currentEpoch, history, 
+                                   zabState, epochLeader>>
+                 \/ \* 2. has not broadcast NEWLEADER
+                    /\ ~AckeRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = DISCOVERY
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= DISCOVERY
+                          /\ PrintT("Exception: AckeRecvQuorumFormed false," \o
+                             " while zabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                    !.stateInconsistent = TRUE]
+                    /\ ackeRecv' = [ackeRecv EXCEPT ![i] = UpdateAckeRecv(@, j, 
+                                            msg.mepoch, msg.mhistory) ]
+                    /\ \/ \* 2.1. ackeRecv becomes quorum, determine Ie'
+                          \* and broacasts NEWLEADER in Q. (l.1.2 + l.2.1)
+                          /\ AckeRecvBecomeQuorum(i)
+                          /\ \* Update f.a
+                             LET newLeaderEpoch == acceptedEpoch[i] IN 
+                             /\ currentEpoch' = [currentEpoch EXCEPT ![i] = newLeaderEpoch]
+                             /\ epochLeader' = [epochLeader EXCEPT ![newLeaderEpoch] 
+                                                = @ \union {i} ] \* for checking invariants
+                          /\ \* Determine initial history Ie'
+                             LET initialHistory == DetermineInitialHistory(i) IN 
+                             history' = [history EXCEPT ![i] = InitAcksid(i, initialHistory) ]
+                          /\ \* Update zabState
+                             zabState' = [zabState EXCEPT ![i] = SYNCHRONIZATION]
+                          /\ \* Broadcast NEWLEADER with (e', Ie')
+                             LET toSend == history'[i] 
+                                 m == [ mtype    |-> NEWLEADER,
+                                        mepoch   |-> acceptedEpoch[i],
+                                        mhistory |-> toSend ]
+                                 set_forChecking == SetPacketsForChecking({ }, i, 
+                                            acceptedEpoch[i], toSend, 1, Len(toSend))
+                             IN 
+                             /\ DiscardAndBroadcastNEWLEADER(i, j, m)
+                             /\ proposalMsgsLog' = proposalMsgsLog \union set_forChecking
+                       \/ \* 2.2. ackeRecv still not quorum.
+                          /\ ~AckeRecvBecomeQuorum(i)
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<currentEpoch, history, zabState, 
+                                     proposalMsgsLog, epochLeader>>
+        /\ UNCHANGED <<state, acceptedEpoch, lastCommitted, learners, cepochRecv, ackldRecv, 
+                sendCounter, followerVars, electionVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACKEPOCH", i, j>>)
+-----------------------------------------------------------------------------    
+(* Follower receives NEWLEADER. Update f.a and history. *)
+FollowerProcessNEWLEADER(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingNEWLEADER(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               epochOk == acceptedEpoch[i] = msg.mepoch
+               stateOk == zabState[i] = SYNCHRONIZATION
+           IN /\ infoOk
+              /\ \/ \* 1. f.p not equals e', starts a new iteration.
+                    /\ ~epochOk
+                    /\ FollowerShutdown(i)
+                    /\ LET leader == connectInfo[i]
+                       IN /\ Clean(i, leader)
+                          /\ RemoveLearner(leader, i)
+                    /\ UNCHANGED <<violatedInvariants, currentEpoch, history>>
+                 \/ \* 2. f.p equals e'.
+                    /\ epochOk
+                    /\ \/ /\ stateOk
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~stateOk
+                          /\ PrintT("Exception: Follower receives NEWLEADER," \o
+                             " whileZabState not SYNCHRONIZATION.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ currentEpoch' = [currentEpoch EXCEPT ![i] = acceptedEpoch[i]]
+                    /\ history' = [history EXCEPT ![i] = msg.mhistory] \* no need to care ackSid
+                    /\ LET m == [ mtype |-> ACKLD,
+                                  mzxid |-> LastZxidOfHistory(history'[i]) ]
+                       IN Reply(i, j, m)
+                    /\ UNCHANGED <<followerVars, state, zabState, learners, cepochRecv,
+                                    ackeRecv, ackldRecv>>
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, sendCounter, electionVars, 
+                proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessNEWLEADER", i, j>>)
+
+AckldRecvQuorumFormed(i) == LET sid_ackldRecv == {a.sid: a \in ackldRecv[i]}
+                            IN IsQuorum(sid_ackldRecv)
+AckldRecvBecomeQuorum(i) == LET sid_ackldRecv == {a.sid: a \in ackldRecv'[i]}
+                            IN IsQuorum(sid_ackldRecv)
+
+UpdateAckldRecv(oldSet, sid) ==
+        LET sid_set == {s.sid: s \in oldSet}
+            follower_info == [ sid       |-> sid,
+                               connected |-> TRUE ]
+        IN IF sid \in sid_set
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                IN (oldSet \ {old_info}) \union {follower_info}
+           ELSE oldSet \union {follower_info}
+
+LastZxid(i) == LastZxidOfHistory(history[i])
+
+RECURSIVE UpdateAcksidHelper(_,_,_)
+UpdateAcksidHelper(txns, target, endZxid) ==
+        IF Len(txns) = 0 THEN << >>
+        ELSE LET oldTxn == txns[1]
+             IN IF ZxidCompare(oldTxn.zxid, endZxid) THEN txns
+                ELSE LET newTxn == [ zxid   |-> oldTxn.zxid,
+                                     value  |-> oldTxn.value,
+                                     ackSid |-> IF target \in oldTxn.ackSid
+                                                THEN oldTxn.ackSid
+                                                ELSE oldTxn.ackSid \union {target},
+                                     epoch  |-> oldTxn.epoch ]
+                     IN <<newTxn>> \o UpdateAcksidHelper( Tail(txns), target, endZxid)
+    
+\* Atomically add ackSid of one learner according to zxid in ACKLD.
+UpdateAcksid(his, target, endZxid) == UpdateAcksidHelper(his, target, endZxid)
+
+(* Leader waits for receiving ACKLD from a quorum including itself,
+   and broadcasts COMMITLD and turns to BROADCAST. *)
+LeaderProcessACKLD(i, j) ==
+        /\ IsLeader(i)
+        /\ PendingACKLD(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+           IN /\ infoOk
+              /\ \/ \* 1. has not broadcast COMMITLD
+                    /\ ~AckldRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = SYNCHRONIZATION
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= SYNCHRONIZATION
+                          /\ PrintT("Exception: AckldRecvQuorumFormed false," \o
+                                " while zabState not SYNCHRONIZATION.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ ackldRecv' = [ackldRecv EXCEPT ![i] = UpdateAckldRecv(@, j) ]
+                    /\ history' = [history EXCEPT ![i] = UpdateAcksid(@, j, msg.mzxid)]
+                    /\ \/ \* 1.1. ackldRecv becomes quorum,
+                          \* then broadcasts COMMITLD and turns to BROADCAST.
+                          /\ AckldRecvBecomeQuorum(i)
+                          /\ lastCommitted' = [lastCommitted EXCEPT 
+                                                    ![i] = [ index |-> Len(history[i]),
+                                                             zxid  |-> LastZxid(i) ] ]
+                          /\ zabState' = [zabState EXCEPT ![i] = BROADCAST]
+                          /\ LET m == [ mtype |-> COMMITLD,
+                                        mzxid |-> LastZxid(i) ]
+                             IN DiscardAndBroadcastCOMMITLD(i, j, m)
+                       \/ \* 1.2. ackldRecv still not quorum.
+                          /\ ~AckldRecvBecomeQuorum(i)
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<zabState, lastCommitted>>
+                 \/ \* 2. has broadcast COMMITLD
+                    /\ AckldRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = BROADCAST
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= BROADCAST
+                          /\ PrintT("Exception: AckldRecvQuorumFormed true," \o
+                                " while zabState not BROADCAST.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ ackldRecv' = [ackldRecv EXCEPT ![i] = UpdateAckldRecv(@, j) ]
+                    /\ history' = [history EXCEPT ![i] = UpdateAcksid(@, j, msg.mzxid)]
+                    /\ Reply(i, j, [ mtype |-> COMMITLD,
+                                     mzxid |-> lastCommitted[i].zxid ])
+                    /\ UNCHANGED <<zabState, lastCommitted>>
+        /\ UNCHANGED <<state, acceptedEpoch, currentEpoch, learners, cepochRecv, ackeRecv, 
+                    sendCounter, followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"LeaderProcessACKLD", i, j>>)
+
+RECURSIVE ZxidToIndexHepler(_,_,_,_)
+ZxidToIndexHepler(his, zxid, cur, appeared) == 
+        IF cur > Len(his) THEN cur  
+        ELSE IF TxnZxidEqual(his[cur], zxid) 
+             THEN CASE appeared = TRUE -> -1
+                  []   OTHER           -> Minimum( { cur, 
+                            ZxidToIndexHepler(his, zxid, cur + 1, TRUE) } ) 
+             ELSE ZxidToIndexHepler(his, zxid, cur + 1, appeared)
+
+\* return -1: this zxid appears at least twice. Len(his) + 1: does not exist.
+\* 1 - Len(his): exists and appears just once.
+ZxidToIndex(his, zxid) == IF ZxidEqual( zxid, <<0, 0>> ) THEN 0
+                          ELSE IF Len(his) = 0 THEN 1
+                               ELSE LET len == Len(his) IN
+                                    IF \E idx \in 1..len: TxnZxidEqual(his[idx], zxid)
+                                    THEN ZxidToIndexHepler(his, zxid, 1, FALSE)
+                                    ELSE len + 1
+
+(* Follower receives COMMITLD. Commit all txns. *)
+FollowerProcessCOMMITLD(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingCOMMITLD(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               index == IF ZxidEqual(msg.mzxid, <<0, 0>>) THEN 0
+                        ELSE ZxidToIndex(history[i], msg.mzxid)
+               logOk == index >= 0 /\ index <= Len(history[i])
+           IN /\ infoOk
+              /\ \/ /\ logOk
+                    /\ UNCHANGED violatedInvariants
+                 \/ /\ ~logOk
+                    /\ PrintT("Exception: zxid in COMMITLD not exists in history.")
+                    /\ violatedInvariants' = [violatedInvariants
+                                 EXCEPT !.proposalInconsistent = TRUE]
+              /\ lastCommitted' = [lastCommitted EXCEPT ![i] = [ index |-> index,
+                                                                 zxid  |-> msg.mzxid ] ]
+              /\ zabState' = [zabState EXCEPT ![i] = BROADCAST]
+              /\ Discard(j, i)
+        /\ UNCHANGED <<state, acceptedEpoch, currentEpoch, history, leaderVars, 
+                    followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMITLD", i, j>>)
+----------------------------------------------------------------------------
+IncZxid(s, zxid) == IF currentEpoch[s] = zxid[1] THEN <<zxid[1], zxid[2] + 1>>
+                    ELSE <<currentEpoch[s], 1>>
+
+(* Leader receives client request.
+   Note: In production, any server in traffic can receive requests and 
+         forward it to leader if necessary. We choose to let leader be
+         the sole one who can receive write requests, to simplify spec 
+         and keep correctness at the same time. *)
+LeaderProcessRequest(i) ==
+        /\ CheckTransactionNum \* test restrictions of transaction num
+        /\ IsLeader(i)
+        /\ zabState[i] = BROADCAST
+        /\ LET request_value == GetRecorder("nClientRequest") \* unique value
+               newTxn == [ zxid   |-> IncZxid(i, LastZxid(i)),
+                           value  |-> request_value,
+                           ackSid |-> {i},
+                           epoch  |-> currentEpoch[i] ]
+           IN history' = [history EXCEPT ![i] = Append(@, newTxn) ]
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, lastCommitted,
+                    leaderVars, followerVars, electionVars, msgVars, verifyVars>>
+        /\ UpdateRecorder(<<"LeaderProcessRequest", i>>)
+
+\* Latest counter existing in history.
+CurrentCounter(i) == IF LastZxid(i)[1] = currentEpoch[i] THEN LastZxid(i)[2]
+                     ELSE 0
+
+(* Leader broadcasts PROPOSE when sendCounter < currentCounter. *)
+LeaderBroadcastPROPOSE(i) == 
+        /\ IsLeader(i)
+        /\ zabState[i] = BROADCAST
+        /\ sendCounter[i] < CurrentCounter(i) \* there exists proposal to be sent
+        /\ LET toSendCounter == sendCounter[i] + 1
+               toSendZxid == <<currentEpoch[i], toSendCounter>>
+               toSendIndex == ZxidToIndex(history[i], toSendZxid)
+               toSendTxn == history[i][toSendIndex]
+               m_proposal == [ mtype |-> PROPOSE,
+                               mzxid |-> toSendTxn.zxid,
+                               mdata |-> toSendTxn.value ]
+               m_proposal_forChecking == [ source |-> i,
+                                           epoch  |-> currentEpoch[i],
+                                           zxid   |-> toSendTxn.zxid,
+                                           data   |-> toSendTxn.value ]
+           IN /\ sendCounter' = [sendCounter EXCEPT ![i] = toSendCounter]
+              /\ Broadcast(i, m_proposal)
+              /\ proposalMsgsLog' = proposalMsgsLog \union {m_proposal_forChecking}
+        /\ UNCHANGED <<serverVars, learners, cepochRecv, ackeRecv, ackldRecv, 
+                followerVars, electionVars, epochLeader, violatedInvariants>>
+        /\ UpdateRecorder(<<"LeaderBroadcastPROPOSE", i>>)
+
+IsNextZxid(curZxid, nextZxid) ==
+            \/ \* first PROPOSAL in this epoch
+               /\ nextZxid[2] = 1
+               /\ curZxid[1] < nextZxid[1]
+            \/ \* not first PROPOSAL in this epoch
+               /\ nextZxid[2] > 1
+               /\ curZxid[1] = nextZxid[1]
+               /\ curZxid[2] + 1 = nextZxid[2]
+
+(* Follower processes PROPOSE, saves it in history and replies ACK. *)
+FollowerProcessPROPOSE(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingPROPOSE(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               isNext == IsNextZxid(LastZxid(i), msg.mzxid)
+               newTxn == [ zxid   |-> msg.mzxid,
+                           value  |-> msg.mdata,
+                           ackSid |-> {},
+                           epoch  |-> currentEpoch[i] ]
+               m_ack == [ mtype |-> ACK,
+                          mzxid |-> msg.mzxid ]
+           IN /\ infoOk
+              /\ \/ /\ isNext
+                    /\ history' = [history EXCEPT ![i] = Append(@, newTxn)]
+                    /\ Reply(i, j, m_ack)
+                    /\ UNCHANGED violatedInvariants
+                 \/ /\ ~isNext
+                    /\ LET index == ZxidToIndex(history[i], msg.mzxid)
+                           exist == index > 0 /\ index <= Len(history[i])
+                       IN \/ /\ exist
+                             /\ UNCHANGED violatedInvariants
+                          \/ /\ ~exist
+                             /\ PrintT("Exception: Follower receives PROPOSE, while" \o 
+                                    " txn is neither the next nor exists in history.")
+                             /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                         !.proposalInconsistent = TRUE]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED history
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, lastCommitted,
+                    leaderVars, followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessPROPOSE", i, j>>)
+
+LeaderTryToCommit(s, index, zxid, newTxn, follower) ==
+        LET allTxnsBeforeCommitted == lastCommitted[s].index >= index - 1
+                    \* Only when all proposals before zxid has been committed,
+                    \* this proposal can be permitted to be committed.
+            hasAllQuorums == IsQuorum(newTxn.ackSid)
+                    \* In order to be committed, a proposal must be accepted
+                    \* by a quorum.
+            ordered == lastCommitted[s].index + 1 = index
+                    \* Commit proposals in order.
+        IN \/ /\ \* Current conditions do not satisfy committing the proposal.
+                 \/ ~allTxnsBeforeCommitted
+                 \/ ~hasAllQuorums
+              /\ Discard(follower, s)
+              /\ UNCHANGED <<violatedInvariants, lastCommitted>>
+           \/ /\ allTxnsBeforeCommitted
+              /\ hasAllQuorums
+              /\ \/ /\ ~ordered
+                    /\ PrintT("Warn: Committing zxid " \o ToString(zxid) \o " not first.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                            !.commitInconsistent = TRUE]
+                 \/ /\ ordered
+                    /\ UNCHANGED violatedInvariants
+              /\ lastCommitted' = [lastCommitted EXCEPT ![s] = [ index |-> index,
+                                                                 zxid  |-> zxid ] ]
+              /\ LET m_commit == [ mtype |-> COMMIT,
+                                   mzxid |-> zxid ]
+                 IN DiscardAndBroadcast(s, follower, m_commit)
+
+
+LastAckIndexFromFollower(i, j) == 
+        LET set_index == {idx \in 1..Len(history[i]): j \in history[i][idx].ackSid }
+        IN Maximum(set_index)
+
+(* Leader Keeps a count of acks for a particular proposal, and try to
+   commit the proposal. If committed, COMMIT of proposal will be broadcast. *)
+LeaderProcessACK(i, j) ==
+        /\ IsLeader(i)
+        /\ PendingACK(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               index == ZxidToIndex(history[i], msg.mzxid)
+               exist == index >= 1 /\ index <= Len(history[i]) \* proposal exists in history
+               outstanding == lastCommitted[i].index < Len(history[i]) \* outstanding not null
+               hasCommitted == ~ZxidCompare(msg.mzxid, lastCommitted[i].zxid)
+               ackIndex == LastAckIndexFromFollower(i, j)
+               monotonicallyInc == \/ ackIndex = -1
+                                   \/ ackIndex + 1 = index
+           IN /\ infoOk
+              /\ \/ /\ exist
+                    /\ monotonicallyInc
+                    /\ LET txn == history[i][index]
+                           txnAfterAddAck == [ zxid   |-> txn.zxid,
+                                               value  |-> txn.value,
+                                               ackSid |-> txn.ackSid \union {j} ,
+                                               epoch  |-> txn.epoch ]   
+                       IN
+                       /\ history' = [history EXCEPT ![i][index] = txnAfterAddAck ]
+                       /\ \/ /\ \* Note: outstanding is 0. 
+                                \* / proposal has already been committed.
+                                \/ ~outstanding
+                                \/ hasCommitted
+                             /\ Discard(j, i)
+                             /\ UNCHANGED <<violatedInvariants, lastCommitted>>
+                          \/ /\ outstanding
+                             /\ ~hasCommitted
+                             /\ LeaderTryToCommit(i, index, msg.mzxid, txnAfterAddAck, j)
+                 \/ /\ \/ ~exist
+                       \/ ~monotonicallyInc
+                    /\ PrintT("Exception: No such zxid. " \o 
+                           " / ackIndex doesn't inc monotonically.")
+                    /\ violatedInvariants' = [violatedInvariants 
+                            EXCEPT !.ackInconsistent = TRUE]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED <<history, lastCommitted>>
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, leaderVars,
+                    followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"LeaderProcessACK", i, j>>)
+
+(* Follower processes COMMIT. *)
+FollowerProcessCOMMIT(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingCOMMIT(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               pending == lastCommitted[i].index < Len(history[i])
+           IN /\ infoOk
+              /\ \/ /\ ~pending
+                    /\ PrintT("Warn: Committing zxid without seeing txn.")
+                    /\ UNCHANGED <<lastCommitted, violatedInvariants>>
+                 \/ /\ pending
+                    /\ LET firstElement == history[i][lastCommitted[i].index + 1]
+                           match == ZxidEqual(firstElement.zxid, msg.mzxid)
+                       IN
+                       \/ /\ ~match
+                          /\ PrintT("Exception: Committing zxid not equals" \o
+                                     " next pending txn zxid.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                    !.commitInconsistent = TRUE]
+                          /\ UNCHANGED lastCommitted
+                       \/ /\ match
+                          /\ lastCommitted' = [lastCommitted EXCEPT ![i] = 
+                                            [ index |-> lastCommitted[i].index + 1,
+                                              zxid  |-> firstElement.zxid ] ]
+                          /\ UNCHANGED violatedInvariants
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, history,
+                    leaderVars, followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMIT", i, j>>)
+----------------------------------------------------------------------------     
+(* Used to discard some messages which should not exist in network channel.
+   This action should not be triggered. *)
+FilterNonexistentMessage(i) ==
+        /\ \E j \in Server \ {i}: /\ msgs[j][i] /= << >>
+                                  /\ LET msg == msgs[j][i][1]
+                                     IN 
+                                        \/ /\ IsLeader(i)
+                                           /\ LET infoOk == IsMyLearner(i, j)
+                                              IN
+                                              \/ msg.mtype = NEWEPOCH
+                                              \/ msg.mtype = NEWLEADER
+                                              \/ msg.mtype = COMMITLD
+                                              \/ msg.mtype = PROPOSE
+                                              \/ msg.mtype = COMMIT
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = CEPOCH
+                                                    \/ msg.mtype = ACKEPOCH
+                                                    \/ msg.mtype = ACKLD
+                                                    \/ msg.mtype = ACK
+                                        \/ /\ IsFollower(i)
+                                           /\ LET infoOk == IsMyLeader(i, j) 
+                                              IN
+                                              \/ msg.mtype = CEPOCH
+                                              \/ msg.mtype = ACKEPOCH
+                                              \/ msg.mtype = ACKLD
+                                              \/ msg.mtype = ACK
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = NEWEPOCH
+                                                    \/ msg.mtype = NEWLEADER
+                                                    \/ msg.mtype = COMMITLD
+                                                    \/ msg.mtype = PROPOSE
+                                                    \/ msg.mtype = COMMIT   
+                                        \/ IsLooking(i)
+                                  /\ Discard(j, i)
+        /\ violatedInvariants' = [violatedInvariants EXCEPT !.messageIllegal = TRUE]
+        /\ UNCHANGED <<serverVars, leaderVars, followerVars, electionVars,
+                    proposalMsgsLog, epochLeader>>
+        /\ UnchangeRecorder
+----------------------------------------------------------------------------
+\* Defines how the variables may transition.
+Next ==
+        (* Election *)
+        \/ \E i \in Server:    UpdateLeader(i)
+        \/ \E i \in Server:    FollowLeader(i)
+        (* Abnormal situations like failure, network disconnection *)
+        \/ \E i, j \in Server: Timeout(i, j)
+        \/ \E i \in Server:    Restart(i)
+        (* Zab module - Discovery and Synchronization part *)
+        \/ \E i, j \in Server: ConnectAndFollowerSendCEPOCH(i, j)
+        \/ \E i, j \in Server: LeaderProcessCEPOCH(i, j)
+        \/ \E i, j \in Server: FollowerProcessNEWEPOCH(i, j)
+        \/ \E i, j \in Server: LeaderProcessACKEPOCH(i, j)
+        \/ \E i, j \in Server: FollowerProcessNEWLEADER(i, j)
+        \/ \E i, j \in Server: LeaderProcessACKLD(i, j)
+        \/ \E i, j \in Server: FollowerProcessCOMMITLD(i, j)
+        (* Zab module - Broadcast part *)
+        \/ \E i \in Server:    LeaderProcessRequest(i)
+        \/ \E i \in Server:    LeaderBroadcastPROPOSE(i)
+        \/ \E i, j \in Server: FollowerProcessPROPOSE(i, j)
+        \/ \E i, j \in Server: LeaderProcessACK(i, j)
+        \/ \E i, j \in Server: FollowerProcessCOMMIT(i, j)
+        (* An action used to judge whether there are redundant messages in network *)
+        \/ \E i \in Server:    FilterNonexistentMessage(i)
+
+Spec == Init /\ [][Next]_vars
+----------------------------------------------------------------------------
+\* Define safety properties of Zab.
+
+ShouldNotBeTriggered == \A p \in DOMAIN violatedInvariants: violatedInvariants[p] = FALSE
+
+\* There is most one established leader for a certain epoch.
+Leadership1 == \A i, j \in Server:
+                   /\ IsLeader(i) /\ zabState[i] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ IsLeader(j) /\ zabState[j] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ currentEpoch[i] = currentEpoch[j]
+                  => i = j
+
+Leadership2 == \A epoch \in 1..MAXEPOCH: Cardinality(epochLeader[epoch]) <= 1
+
+\* PrefixConsistency: The prefix that have been committed 
+\* in history in any process is the same.
+PrefixConsistency == \A i, j \in Server:
+                        LET smaller == Minimum({lastCommitted[i].index, lastCommitted[j].index})
+                        IN \/ smaller = 0
+                           \/ /\ smaller > 0
+                              /\ \A index \in 1..smaller:
+                                   TxnEqual(history[i][index], history[j][index])
+
+\* Integrity: If some follower delivers one transaction, then some primary has broadcast it.
+Integrity == \A i \in Server:
+                /\ IsFollower(i)
+                /\ lastCommitted[i].index > 0
+                => \A idx \in 1..lastCommitted[i].index: \E proposal \in proposalMsgsLog:
+                    LET txn_proposal == [ zxid  |-> proposal.zxid,
+                                          value |-> proposal.data ]
+                    IN  TxnEqual(history[i][idx], txn_proposal)
+
+\* Agreement: If some follower f delivers transaction a and some follower f' delivers transaction b,
+\*            then f' delivers a or f delivers b.
+Agreement == \A i, j \in Server:
+                /\ IsFollower(i) /\ lastCommitted[i].index > 0
+                /\ IsFollower(j) /\ lastCommitted[j].index > 0
+                =>
+                \A idx1 \in 1..lastCommitted[i].index, idx2 \in 1..lastCommitted[j].index :
+                    \/ \E idx_j \in 1..lastCommitted[j].index:
+                        TxnEqual(history[j][idx_j], history[i][idx1])
+                    \/ \E idx_i \in 1..lastCommitted[i].index:
+                        TxnEqual(history[i][idx_i], history[j][idx2])
+
+\* Total order: If some follower delivers a before b, then any process that delivers b
+\*              must also deliver a and deliver a before b.
+TotalOrder == \A i, j \in Server: 
+                LET committed1 == lastCommitted[i].index 
+                    committed2 == lastCommitted[j].index  
+                IN committed1 >= 2 /\ committed2 >= 2
+                    => \A idx_i1 \in 1..(committed1 - 1) : \A idx_i2 \in (idx_i1 + 1)..committed1 :
+                    LET logOk == \E idx \in 1..committed2 :
+                                     TxnEqual(history[i][idx_i2], history[j][idx])
+                    IN \/ ~logOk 
+                       \/ /\ logOk 
+                          /\ \E idx_j2 \in 1..committed2 : 
+                                /\ TxnEqual(history[i][idx_i2], history[j][idx_j2])
+                                /\ \E idx_j1 \in 1..(idx_j2 - 1):
+                                       TxnEqual(history[i][idx_i1], history[j][idx_j1])
+
+\* Local primary order: If a primary broadcasts a before it broadcasts b, then a follower that
+\*                      delivers b must also deliver a before b.
+LocalPrimaryOrder == LET p_set(i, e) == {p \in proposalMsgsLog: /\ p.source = i 
+                                                                /\ p.epoch  = e }
+                         txn_set(i, e) == { [ zxid  |-> p.zxid, 
+                                              value |-> p.data ] : p \in p_set(i, e) }
+                     IN \A i \in Server: \A e \in 1..currentEpoch[i]:
+                         \/ Cardinality(txn_set(i, e)) < 2
+                         \/ /\ Cardinality(txn_set(i, e)) >= 2
+                            /\ \E txn1, txn2 \in txn_set(i, e):
+                             \/ TxnEqual(txn1, txn2)
+                             \/ /\ ~TxnEqual(txn1, txn2)
+                                /\ LET TxnPre  == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn2 ELSE txn1
+                                       TxnNext == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn1 ELSE txn2
+                                   IN \A j \in Server: /\ lastCommitted[j].index >= 2
+                                                       /\ \E idx \in 1..lastCommitted[j].index: 
+                                                            TxnEqual(history[j][idx], TxnNext)
+                                        => \E idx2 \in 1..lastCommitted[j].index: 
+                                            /\ TxnEqual(history[j][idx2], TxnNext)
+                                            /\ idx2 > 1
+                                            /\ \E idx1 \in 1..(idx2 - 1): 
+                                                TxnEqual(history[j][idx1], TxnPre)
+
+\* Global primary order: A follower f delivers both a with epoch e and b with epoch e', and e < e',
+\*                       then f must deliver a before b.
+GlobalPrimaryOrder == \A i \in Server: lastCommitted[i].index >= 2
+                         => \A idx1, idx2 \in 1..lastCommitted[i].index:
+                                \/ ~EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                \/ /\ EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                   /\ idx1 < idx2
+
+\* Primary integrity: If primary p broadcasts a and some follower f delivers b such that b has epoch
+\*                    smaller than epoch of p, then p must deliver b before it broadcasts a.
+PrimaryIntegrity == \A i, j \in Server: /\ IsLeader(i)   /\ IsMyLearner(i, j)
+                                        /\ IsFollower(j) /\ IsMyLeader(j, i)
+                                        /\ zabState[i] = BROADCAST
+                                        /\ zabState[j] = BROADCAST
+                                        /\ lastCommitted[j].index >= 1
+                        => \A idx_j \in 1..lastCommitted[j].index:
+                                \/ history[j][idx_j].zxid[1] >= currentEpoch[i]
+                                \/ /\ history[j][idx_j].zxid[1] < currentEpoch[i]
+                                   /\ \E idx_i \in 1..lastCommitted[i].index: 
+                                        TxnEqual(history[i][idx_i], history[j][idx_j])
+=============================================================================
+\* Modification History
+\* Last modified Tue Jan 31 20:40:11 CST 2023 by huangbinyu
+\* Last modified Sat Dec 11 22:31:08 CST 2021 by Dell
+\* Created Thu Dec 02 20:49:23 CST 2021 by Dell
\ No newline at end of file
diff --git a/zookeeper-specifications/protocol-spec/doc.md b/zookeeper-specifications/protocol-spec/doc.md
new file mode 100644
index 00000000000..1c351de1d53
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/doc.md
@@ -0,0 +1,102 @@
+# ZooKeeper's Protocol Specification of TLA+
+
+## Overview
+ZooKeeper's Protocol Specification focuses on the Zookeeper Atomic Broadcast (Zab) consensus protocol proposed in *Junqueira F P, Reed B C, Serafini M. Zab: High-performance broadcast for primary-backup systems[C]//2011 IEEE/IFIP 41st International Conference on Dependable Systems & Networks (DSN). IEEE, 2011: 245-256*.  
+
+We have completed the the [protocol specification](Zab.tla) for Zab using TLA+ toolbox, and we have done a certain scale of model checking to verify the correctness of Zab. From the experience, we have found some subtle [issues](issues.md) related to the protocol specification and the Zab informal description. 
+
+To handle the ambiguities and omissions of the informal description in the paper, we supplement the specification with some further details. If you have any question, please let us know.
+
+
+
+## Specification Development
+
+
+### Requirements
+TLA+ toolbox version 1.7.0
+
+### Run
+Create specification [Zab.tla](Zab.tla) and run models in the following way.  
+We can clearly divide spec into five modules, which are:  
+
+- Phase0. Leader Election  
+- Phase1. Discovery  
+- Phase2. Synchronization  
+- Phase3. Broadcast  
+- Abnormal situations like failure, network disconnection
+
+#### Assign constants
+After creating this new model and choosing *Temporal formula* with value *Spec*, we first assign most of constants.  
+We should set CONSTANTS about server states as model value, including *FOLLOWING*, *LEADING*, and *LOOKING*.  
+We should set CONSTANTS about server zabStates as model value, including *ELECTION*, *DISCOVERY*, *SYNCHRONIZATION*, and *BROADCAST*.  
+We should set CONSTANTS about message types as model value, including *CEPOCH*, *NEWEPOCH*, *ACKE*, *NEWLEADER*, *ACKLD*, *COMMITLD*, *PROPOSE*, *ACK*, and *COMMIT*.  
+
+#### Assign left constants affecting state space
+Then we should assign CONSTANTS *Server* as a symmetrical model value(such as <symmetrical\>{s1, s2, s3}).  
+To compress state space, we need to assign CONSTANT *Parameters* as a record, whose domain contains *MaxTimeoutFailures*, *MaxTransactionNum*, *MaxEpoch*, and *MaxRestarts*. For example, we can assign it to format like [MaxTimeoutFailures |-> 3, MaxTransactionNum |-> 5, MaxEpoch |-> 3, MaxRestarts |-> 2].
+
+#### Assign invariants
+We remove *'Deadlock'* option.  
+We add invariants defined in spec into *'Invariants'* to check whether the model will reach an illogical state, including *ShouldNotBeTriggered*, *Leadership1*, *Leadership2*, *PrefixConsistency*, *Integrity*, *Agreement*, *TotalOrder*, *LocalPrimaryOrder*, *GlobalPriamryOrder*, and *PrimaryIntegrity*.  
+Here the meanings of these invariants are described in the following. Except for the first four, all invariants are defined in paper.   
+	-	**ShouldNotBeTriggered**: Some conditions should not be triggered when we are running the model. For example, follower should not receive NEWLEADER when its zabState is not SYNCHRONIZATION.  
+	-	**Lerdership**: There is most one established leader in a certain epoch.(Established means leader has updated its f.a and switched its zabState to SYNCHRONIZATION.)  
+	-	**PrefixConsistency**: Transactions that have been committed in history are the same in any server.  
+	-	**Integrity**: If some follower delivers one transaction, some primary must have broadcast it.  
+	-	**Agreement**: If some follower *f<sub>1</sub>* delivers transaction *a* and some follower *f<sub>2</sub>* delivers transaction *b*, then *f<sub>2</sub>* delivers *a* or *f<sub>1</sub>* delivers *b*.  
+	-	**TotalOrder**: If some server delivers *a* before *b*, then any server that delivers *b* must also deliver *a* and deliver *a* before *b*.  
+	-	**LocalPrimaryOrder**: If a primary broadcasts *a* before it broadcasts *b*, then a follower that delivers *b* must also deliver *a* before *b*.  
+	-	**GlobalPrimaryOrder**: A server *f* delivers both *a* with epoch *e* and *b* with epoch *e'*, and *e* < *e'*, then *f* must deliver *a* before *b*.  
+	-	**PrimaryIntegrity**: If primary *p* broadcasts *a* and some follower *f* delivers *b* such that *b* has epoch smaller than epoch of *p*, then *p* must deliver *b* before it broadcasts *a*.  
+
+#### Assign additional TLC options
+We set number of worker threads as 10(if unavailable on your system, just decrease it).  
+We can choose checking mode from *Model-checking mode* and *simulation mode*.  
+
+-	Model-checking mode: It is a traverse method like BFS. Diameter in results represent the maximum depth when traversing. All intermediate results will be saved as binary files locally and occupy a large space if running time is long.  
+-	Simulation mode: Everytime TLC randomly chooses a path and run through it until reaching termination or reaching maximum length of the trace, and randomly chooses another path. Currently we set *Maximum length of the trace* as 100.  
+Here we mainly use simulation mode to discover if there exists deep bugs, which is hard to be found in model-checking mode.
+
+
+
+### Results
+
+You can find our [result](verification-statistics.md) of verification using TLC model checking.
+
+## Adjustments in protocol spec from paper
+>Because the pursuit of the paper is to describe the Zab protocol to others in a concise manner, which will lead to insufficient description of the protocol, there are missing or vague places in the paper. As a mathematical language, no ambiguity is allowed in the TLA+ specification, and this is why we need adjustment.
+
+Overall, we categorize the flaws of the original paper into two classes: abstraction and vagueness.
+
+### Abstraction
+
+There is a missing part in the paper, in which the pseudocode uses the **Discovery** stage as the initial stage of each round, and omits the **Election** stage.  
+
+On the one hand, in spec, **Election** helps advance the state of the system, and is also related to the liveness and strong consistency of the system, so we cannot omit it. On the other hand, our focus is on Zab, so the **Election** module should be expressed with a small number of variables and actions to reduce the state space of the model.
+
+We use one variable *leaderOracle* and two actions *UpdateLeader* and *FollowerLeader* to express the **election** module streamlined.
+
+### Vagueness
+
+We categorize vagueness in the paper into two classes: vagueness in variables and vagueness in actions.
+
+#### Vagueness in variables
+First, the character **Q** is used everywhere in the pseudocode to represent the set of Followers perceived by the Leader in the current term. We divide the set **Q** specifically into variables *learners*, *cepochRecv*, *ackeRecv* and *ackldRecv*. We use *cepochRecv* to let Leader broadcast *NEWEPOCH*, *ackeRecv* to let Leader broadcast *NEWLEADER* and *PROPOSE*, *ackldRecv* to let Leader broadcast *COMMIT-LD* and *COMMIT*. We will explain the reason why we use these sets when Leader broadcasts *PROPOSE* and *COMMIT* in the [issues](issues.md).
+
+Second, *zxid* in *COMMIT-LD* is omitted in hte paper. We will explain the value of the *zxid* in the [issues](issues.md).
+
+#### Vagueness in actions
+Totally, adjustment on vagueness in actions can be divided into two classes: Completing the missing description and Adjusting the protocol structure.
+
+*	For completing the missing description, we categorize four classes:
+
+	1.	Complete the branch of action where after the Leader node processes the message *m* of type *t*, the receiving set of messages of type *t* still does not satisfy the quorum.
+	2.	Complete the branch of action where before the Leader node processes the message *m* of type *t*, the receiving set of messages of type *t* has already satisfied the quorum.
+	3.	Supplement the logical action that the Leader receives the request from the client, encapsulates the request as a log entry, and persists the log entry.
+	4.	Supplement the logical action that the Leader tries to commit log entries based on confirmation information from followers.
+
+*	For adjusting the protocol structure, in order to improve the readability of the spec, we impose standardized and unified restrictions on the spec. That is, the division unit is to one node receiving and processing one message. Each action, except actions in election module and environment error module, makes a node receiving a certain message a trigger condition, and then produces a subsequent state change.
+
+See example when Leader processes message *CEPOCH* from one follower:
+
+![case_leader_process_cepoch](pic/case_leader_process_cepoch.png)
diff --git a/zookeeper-specifications/protocol-spec/issues.md b/zookeeper-specifications/protocol-spec/issues.md
new file mode 100644
index 00000000000..6d7b41c93d7
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/issues.md
@@ -0,0 +1,40 @@
+# Issues
+
+>This document describes issues related to the ambiguous description of the Zab protocol. 
+
+## （Issue 1）Issue introduced by vague explanation of broadcast object set Q
+Because the Leader will only accept the client request when it reaches the *Broadcast* stage, thus when Leader broadcasting messages from *Broadcast* stage, we naturally use the set *ackldRecv* as the object set when Leader broadcasting *Propose* and *Commit* messages in the initial protocol. 
+
+On this basis, the model checking found that there was an error in the protocol. After analyzing the execution path and the violated invariant, we located the error in the action *FollowerProcessCommit*. The Follower received an illegal *COMMIT* message, as shown in the figure below. In the *COMMIT* message, the log entry corresponding to the *zxid* does not exist in the local log.  
+
+![protocol-spec-mck-bug1](pic/protocol-spec-mck-bug1.png)
+
+A quorum of nodes including node *A* and node *B* completed the log recovery, and entered the *Broadcast* stage. Leader node *B* sent *NEWLEADER*(1, <[1, 1, v1]>) to node *C*, which joined the cluster. Then Leader *B* received client request and broadcast *PROPOSE*([1, 2, v2]). But node *C* did not receive the message because *C* is not in *B*'s *ackldRecv*. Later, the Leader firstly processes *ACK-LD* from *C* and then *ACK* from *A*. So, the object of Leader *B*'s broadcast *COMMIT*([1, 2]) contains *C*, and there is no log entry with *zxid* [1, 2] locally in *C*.
+
+We found that because the set of objects when the Leader broadcast *PROPOSE* is *ackldRecv*, the Follower will not receive messages with type *PROPOSE* until receiving the *COMMIT-LD*. If a log entry is committed between the Leader sending *NEWLEADER* and *COMMIT-LD*, the corresponding receiver will permanently lose the log entry.
+
+Therefore, we have made amendments in the spec. When the Leader broadcasts *PROPOSE*, the set of sending objects has been changed from *ackldRecv* to *ackeRecv*. We successfully discovered errors introduced by the vague description of **Q** in the protocol through model checking, and fixed them in the specification.
+
+## (Issue 2) Issue introduced by lack of client request logic
+Since there is not discriptions about client request, we need to add a process that describes the Leader receives a client request and encapsulates the request as a new log entry and appends it to the local log. This process are represented as action *LeaderProcessRequest* in the spec.
+
+In our original specification, when Follower receives the message *PROPOSE*, the *zxid* of the proposed log entry should be the successor *zxid* of the latest local log entry‘s *zxid*, otherwise it will be regarded as an illegal *PROPOSE*.
+
+On this basis, model checking told us that there was an error in the model, as shown in the figure below, where Follower receives redundant *PROPOSE* from the same log entry. 
+
+![protocol-spec-mck-bug2](pic/protocol-spec-mck-bug2.png)
+
+A quorum of nodes including node *A* and *B* completed log recovery first and entered the *Broadcast* stage. When receiving a client request, Leader B encapsulated the request as a log entry [1, 1, v1]. Before B broadcast the proposal of the log entry, node *C* that joined the cluster later sent *ACKEPOCH* to *B*, and *B* replied with *NEWLEADER*(1, <[1, 1, v1]>), and added *C* to the set *ackeRecv*. So the *PROPOSE*([1, 1, v1]) broadcast by *B* was also sent to *C*, so *C* received the redundant proposal for the log entry [1, 1, v1].
+
+We have analyzed two repair schemes. The first scheme is to atomize the actions *LeaderProcessRequest* and *LeaderBroadcastPROPOSE* and merge them into one action. The second scheme is to relax the constraints, where if the Follower receives redundant *PROPOSE*, it will be release this message directly. We chose the second scheme, because we think the situation is not serious and will not affect the correctness of Zab.
+
+## (Issue 3) Issue introduced by ambiguity of zxid in the message COMMIT-LD
+When the Leader sends *COMMIT-LD*, the paper does not express the specific value of the *zxid* carried in the message. Therefore, we naturally set the *zxid* carried in *COMMIT-LD* to the *zxid* in *ACK-LD*.
+
+Therefore, the model checking found an invariant violation, as shown in the figure below, the Follower received an illegal message *COMMIT*.
+
+![protocol-spec-mck-bug3](pic/protocol-spec-mck-bug3.png)
+
+A quorum of nodes including node *A* and *B* completed log recovery first and entered the *Broadcast* stage. When the node *C* that joined the cluster later sent *ACKEPOCH* to Leader *B*, *B* sent *NEWLEADER*(1, <[1, 1, v1]>) to *C*, and then received the client request to broadcast *PROPOSE*([1, 2, v2]). Then, *B* received the message *ACK*([1, 2]) from *A* before receiving *ACK-LD* from *C*, so Leader *B* committed the log entry [1, 2, v2] and broadcasts *COMMIT*([1, 2]). Because the object set when broadcasting *COMMIT* is *ackldRecv*, *C* did not receive the commit message. Afterwards, *B* processed the *ACK-LD*([1, 1]) from *C*, and replied with *COMMIT-LD*([1, 1]). Therefore, when Leader *B* reached a consensus on the new log entry [1, 3, v3], it sendt *COMMIT*([1, 3]) to *C*, and *C* found that entry [1, 2, v2] in the local log has not been committed yet, which was treated as an illegal *COMMIT*.
+
+The repair solution we analyzed is that in the action *LeaderProcessACKLD*, the *zxid* carried by *COMMIT-LD* is changed from the *zxid* in *ACK-LD* to the latest *zxid* committed locally by Leader, thus making up for the missing commit information.
diff --git a/zookeeper-specifications/protocol-spec/pic/case_leader_process_cepoch.png b/zookeeper-specifications/protocol-spec/pic/case_leader_process_cepoch.png
new file mode 100644
index 0000000000000000000000000000000000000000..74a0c7e59d14014cfb763d302c05e79905876bea
GIT binary patch
literal 406431
zcmd42XIvCd^DjEEOO~8-mYg#zAR<{nK*>QQOU?@{prGU+prB+4A}TH*IcHGGASijs
zAYoU6D?#qyFFgPA-239(`?)VpL(hDty1Kfnx_hR&X7=Li#S%cFtEr<2;NSp&Huwiz
zpnz){a5rZF(ANh90RSKbaAMs6D2PB7fC<b1fLn<B4~2lH5b_Vk1M7nlmdQtT)Ya{7
z85?Tq+|>9Zn!Ll_$HxPg0suU{0{o1%u5*}MSaJ}ogVM>sDl&kOy@S7x+O1nRFD3kQ
zzQq4Y$5VfL08EHn%K8uee+yAMI{7<*D%=9O?>YKAc!IbF0HC=JK7IiJfPYEn4i50S
z#9#(!{J;)^IPMa={DpHb@x8xr<sY8g#_AwX4``$-_V#`*06;bh(m8@0TtFFQXb_8g
zIl6fP067PURXjbt9YK5-#QY$S4~Q@2%isGSa$Nogwzt3cuS|P;mw)kJx_~vohHtp}
z`*_%g{JHr5^Wf<b2-@pUx(XhzxcX@ugJ&AhZeQKK^)B%h5bt>1GcW`(6^OBJpmu*@
zTw>Qi?K>a_`Egks{MA8Q0(2l2ceKBu2VxcwYkGMYT#ol8{hqU%rVfZHKn!;a(76p_
z1`x+N`D>W`%~R;-ZTxpzxOL8c>S}+}2kiYo^jBL8f$n!M>6h|<xH{?lEgwP_>U!G@
zq!R-GgeS<&)Bwcb%!7#fyPI702kZj`7V4^gN&my+7ifIhe;$x-?Bu0&9mJq6kRWG2
z%}d=c`4c?-LG(v=NTI8n&ShQD4v^{q*V~sX0kjXK$HD$j|3O_KqfTCGf7=8S<m7LD
z**B0Mx6aY&h6ad1-65M!UUx3_y_AFX3AldQ7FZWb?BnrgZGdzrmy?IqC7lbz(*8jv
zf7gYY2Ke2+q=Ws0I{O6Ny0jtKPiW|Ud)-?g2Kxhj0^9`Dfg1n^5D4abfH!a-a2wvK
z-vO`wD$xY&0YAV6Z~{dBru<XG>`#docr*b*fnC50<njNv-t|AFPCyVyKmV8dS6van
z`A=!kpBnDKI@p3Ipa*z>*MT5*0_*(KnkldfQr!N%{-<?&P^JUeUk@-}mj6G~|Dpbe
zQw`Mj=HGP#|7nqf{Ga;x8u&NxwedCa1)xk&6{r&QCV0FCW=W_#RN)^z{=<*AjyHz4
zjQ0g^3GbVoTa@2_*+?H)0yX-}hEAY;|A#H0S3#LF(CbiTP&z0XN(W^EM4-}OJ8Do>
zuw@yLs{Xfzmsa^_ME<8v|7rmIXEgriBN8XVC88&~M#TT$HOU0YWd70jkFEcwCI9N{
zy?^cfPY?d@?f<954R8eesrT<_{M`dc9OMI}AJPf=2x)=T100ZcNCRXL(t3&iZeR1y
z=(_ydn(?3hxP#;3_Ak#r`u;QGm-EA4{H^$w_}O1l0-WFh;Cu$uy?sLb++17(IMl!=
zf)j_1mxHJ<horcqBmi7KUoLq7;K1n5a|4HN@ISQZMF3E4zqq(){tr#J9RRB2z~$fg
z9~!?r08o+uz(AuzpkL5m@}QR|Jn$|-4z4stfDPaV_(6Rn0a-u^xCUqdx_}{Y8?XRu
z!TIV6&T~H?7(f6IffyhWcmg~FvVj7i7<dg-0M$S}&;oP<eZXg66!-$ng0p80_zs|f
zW8f4A2ZsQM6o(pz5r-Xz7e@$35=S0K1xEwtCXO+V1<qX@7aT8~KpX^4G)^K;I!-pu
zOPq3?Dx5}~PMnW8V>sV%P&ivSKX6WPA-Gp?X>eI_ui}c~%Hyix>fzqTwZV14^~DXv
zeT18W`y96j_Z@B>ZYS<%+%LFGxZiP)AOM5}LI>f5h(P2a>JUSSCBzxx2Z?|rKr$gk
zkoS-#aGWO~OOPGNFDO2g8p;6`0cWr_^bXVk>I;p4CPA~Iuc39&9_R!V1w})D<B{UA
z;0fU=;_2X-<GJ7k<Hg`*;=RJF#p?yv(i+||K0ZDjJ|DguxE3w&@8gHzC*kMeBk?=%
z$M9G1j|d0|7zu<3lnD$8><I!0VhCOkyd!8Q7$;aGz!H)WvJ*-YY7$x!dJ#quW)i+3
zY$F^e+#oz9q9EcWQY11YawG~NN+l{GY9bmTS|d6orX=PgRwlkpe4qFs@pIz$#J$9G
z#0MlKBwQp4Bt|4|Bo9cQlT?xnkf2C@U7@-nct!n+^_9RYDObv_bX@s%<$#ow^eX8!
zQcKbR(iGBi(r(fPQY;xYnJAeKnIl;wSq@np**MuAIT1N8xf;1Gc_?`%`3Le5@*N5y
zimMdr6!sJm6gd=)6w?$(l+=_Gl!la^lu49tC_hqeQV~#HrP82sq<TbEOw~=bLJgtj
zrdFqRppK?4q3)$#qrs=)qtT(cPm@SfK{HH)rlq2lrZuI7)8^2&(k{_K=&sV~(0S0M
z(pA$<(Vft<(yP%s(Z|!jryr;P$-vBTjlqc_fdR?zh2eyegHeOgoiUBEo^hTD$|T5S
z#1zbw&(zDb!%V}h#O%PFz+BBd!-C5q$YRVA#!}2O$a2KW#;V2Y!}@}?n{|hcj_n%T
zeYU4;ZERcY)a)wkZtPFl+u64{XgSn4JUE_n^l+d#Sva*h136!E4s)Jz@p0YZisC|Y
z&2tlT%X2$(KjrS?M)R=q=<^_W-tx@w67kCOy7Ff6_VfO{%6HZ5YV6hetDAfbd^&ug
zd~f;Y_(}Oy`F;6|_$LMM1>^<X1@Z(&1#tys1YHGl1V@B$g=B@?gz|*Ogz<zGguR4|
zgr`NWh^UDKiM$m-iPDMQ6pa$C7u^%%5wjFa6YCfIEiNPOAzmUrD?ufpD-k8pB=JL1
zP|`s%M{-h%R7z7SQmR1;BP}HDB%Lq)RfbwdUnW+jOXgfwPS#KMz3i48kKA3kT)Am^
z8u?rDN%8{<cna4QA{AN`eksZ-1}Ii5?kkBXxhuU<+Jy1JoM0ue6=g1Ed*zqPODY^H
zcU1~imQ*=a?Ny6Zm#=YObG-KI+J>5d+I_WmYJ1nkulrrEz5Y{OQ9WF};|Ao0){TT4
z!x~f?cQmp!7BsmuT{PcnqP1kS!n8WH@wD}{)3m2`Salq9%5~7Xa=PKVJ$hI4O!Tt#
zmTwB)^t;)lkE^e%pP@fzz-!=TP;Uqr>KJAi&fns@<$J5y2;b<IQI65Nv4k<gxZi}@
z#Lnc6$?@&$w^MJ=-r>I!c&E#h+|=5%-1Mi}4YPE!C37+JaP!X=Ocrhy4VDC!rk1ZP
zkE}GTo>{F~%UH))PucL<z->O-GTD0Aw%U=~+1q`%i+9)T?wh-3_J;OF_DA=0?&aP?
zJE%KkIed4#=J?cc%SqWO-D$&F**V>L(?!`O!)41=)iu*~$4%WW+YNJH`+mXwpYDe4
zW$qUqW*$gSLeIONjb2n<?p{6KY~FD1F&`nH7@s9yMc-$>Xg@u_SN=HuHvSC(G@v6t
z7|0*^I1m-25|k5!4K@w_0H=g|!3RSGL*hd=LN!B6!=PafVO<DL#6tusTrK=%1Wv@g
zh^|QP$VZWD540Y<en|Y#{ozoQcvO1SVYFFv(<9bL4<4;N)_VLlhAhS}W;#|Wwjd4~
z=N2~{FBShH{&#|7!ly*>#LUFAB!{F=$r8!WlP^-7Q-)JzQ}dtTKk<4pm8P2ZI-N2-
zG<_vQKcns`$J2zThtKSueaw{3EXX3x3d~x1e)D<53!WEGUYupSW`D`Ko`cL~$&Jtb
zndg`{o_{U>eF1AhV!=tFTjAH2S}*I0t`=n$;}-`Nua}sX^q0z)mcL?pmH6ts%&Tna
zwejnoa=G&IH!N>b-{QUve7p6|`rT;7jf#f%BJW=!>5z$)KxJU%cGcagscOCIt`G7b
z-q-Nf<knKxCe-27h18+zUF(+`EE>idbsM{yl$vUrMVrf7I9qaBX<Jj<h}#~uU9^X`
zA9eV2>~y+xu5{UT&32o2Pxct~4EO5w4)kgEb@!|Fw+|=}w0u<j*!W5QQ~hVz&vk<`
zgSA64L$$-Q!*wHaBMqYpqfKM5v9@v5@y>}G6Md69lb^pBd>Na%Gxc@adV1-r<JZk^
z9^WuCK{Kbb59aXZ66Pu9GZ$DEiWUVHkxQ~mt*9HQ!DW->*%gPC@2mc+XKRnvN!K$s
z*f+{IB{y5PG`B{#t+v;``+Ps$iP@#x&E4bQtJ%M{KZrI*uVMT!7eA5?7!S%0r4PG~
zZXGQgdmf+uOu#Z?U;mQ-)qi4kvT+)GMsW80T;ROvx8Co$3(t!SAA3LhKfVA2JmNZo
zd*vTx06=O10Mw(P|6ujk{_hV5&R=_05aaxvFUkLf|Joy77Jxnk@E-KvjdnoqW*Pu0
zO90?1D4*OK0B(^2z-<KpS4!&N{HF@Ir~b3Ayu82%_Yj4~=l4AC{ay6Goc`K#f~0@?
z{oiL$8!0L2%R2wd`Jw}$B*fDupn>3U0l1Vn5K5ej9)KOx0}pgk!1PZmIJgif9zFpf
z5itqKP)h;e;y@s{PzW9#6!e;K!ohL?N{L6sDWQf>ZDdct<x3;^FzqEF_w}kyTH`S^
zkJLTCC?aAydIm-&-m8540)o;qvU2hYit0BsG_|yKbWLvGF*O6-GY3Z}XBStu`~Cre
zLBa5l(C9~xV`Agt6VfxDKFiE{{vx}mxTN$|+3WH*)gNkV>*^aCo4UGtdi(kZK7JaX
znEWy|{q@@nYI$XKZGB^NYa8?9;PB}9C-&FLrCvAy<S(`U)$G6Yq6GEAg+d`vf=j({
zaD%}Np@iabO5jte84=j~QgcZ@B&4~X_Ohyzh+E1SO?%I8jF^r`8pVsbRPB#u|9gr>
z{eRNzU&a2T*DScT!2OdTxVR8J2n2$Mj|V1vLeTTV$0sBv{F8|PPFMaUvdcvNZ@K`5
z;D9oqP$&WTPeDRNLh=7PUCe{wBEO3n;0go>oJ<f(KovMYd#`>2Qy04|M)^ITaXcx*
z8XNdBWlz7L(ZbodO9t^{8xWP~(+CKC{Izmo&pRQDZVdKV%cM%Df6ERQ@yT?AuS*-I
z1z&c*04Qx2?B?~(jP-d2-<hAB)#|u@MOLJiyhc806F`Jc!C1qK+!naT_YoqJ?mp7v
z{8n$>cSRUmCTL!h51M&x4ww;?G4O37q3{eVjA?;N`8#;TO7|F}c5T9L)-F|N4JA(+
z^5hktDmT@&J|8$~XQ{7%(AQld!3nFeT9VTt!M+oc#CiF`#ux?K)kh7V;%TVNd{$i;
zD|COwqS()}yb~{gBTQN3W`?drlY_@eXu=Qj<VEV#u2d*Hg_Q=)&*@-F3rpc0Qykbg
z&Nc45xHp4eHz16(OAA!k^NOwCF!X+`%mqNZxgc4EkzRCip5SzKs%-QiY=FTGdPEI}
z7GZZM-Rj=+N#~{3xe2Wq#<#&RWw8j8Fb@?@ta~@z=&o$0ocN19N8<<U8|%UkbL0gH
z*lM~@)xOIuLIS+m-I@X*J=y0wmKrTr%x6iqcpSy1gEMiZ9_Ai@{I2!EemJ!xkeu38
z(YERpJn~kHwhXJ|r#hdy;G6d9JUKoRKVI`}&^FsqFU+19PPC~aL?+s}?7rRKwlc|F
z*dC|$QkTh%($4c!Bk42+s1y$jFy8&U?k1SNc2p~**HSK87^Wch?NQTHeP89Hu8jy9
zL^)OEY}!Hah&=f>m8cDssiL+Zv|OLQUSB)(D3a~nEwy)B6boAXiDF*UbZ@i+psRgn
z;?P6+k<f0ee?`P-oANkJYNZ?*5H6?PV&#(A)3Gbl+c<Oe`Nv#tZ8?~312J*ToZ8j!
zoNbkWa6Jv&7We+&^3yGx81fEF#|Vp2n2x`%L-6wht~rJS@7jaD^=)xDeyLFMhi~OV
z>qzD^|ESY$Ix}`+Z_cL4T5<}jO~Q#DU7q*dVV=Bxg_JQ{!(pbXJtJ(`>FzfE)_QhI
zm<;MQXJ<`i<D(&8u4ho@g6Gxv%ES+QEnoGlr@nP3(7|ZM9?h$pjMpS??jfb!=$Hqd
zq>pN^a9YhhwDm`S?r&P`jeJ!1TX@2lRLH6|#x-Wm&2yzG=_z?VX95+(bNHJ4$38<L
zw3Ho&u57s=PEjm@+A!>#>12UX)I%g<=s3pF&(`ooA{)LWd_C*x&rO#8(fvS=EXo<!
zzz1ET8^REA+Y+)e*6mPiY=5X$uk-m!1Y4T>jNhWZ_gmQ<fojjp<5Rzng8PF>W`H<%
zTCQ2`nKq^%IfC|#sRg5PYWZD-v--!_y0)#-Etdw$cgYO*W*xK`aT>W_6U1!ox-|HE
zh2_yM*%8Uuv477}H<@hle2Hz>NN4#Zjg8XxR=Qgh%}iO(IN-xv#_GO!pXc3<bT3jh
zdbzB-8A*EqbWyq^t*qU1W>l;D`n1RrES^5YQwPd8o@ffW^iJgqw~h_6kxYuz%<F}w
z$xL2_ACtGp;+tfAU2nT}o`q0eDcGr-HYk2|0XVk3Ef0SqR>fYYCpfS<$T$BZs)It@
zr{zwc;82xZMQW`pGP9tMoiTzNUeJ3BA<;5X6VBIVrr8-WO_Z<qePC2Np`SxDn#1w#
z=~2H9>H<h&icR>9bN>RM-q~IGFeN>&bSn+DuARR3Ne+gq#;+R#QRwXRAL7%GN;{<G
zMf9WhP0tHkyzNmVEDMXSCqc=fl{%vN9BHpIzg4xVi$+*5IHhUQI6`t+&J}cxDkmC@
ztYdpvy-vGraWG<WhePci<29c@Hv}htT<;_q$cfR^yzS`RqKcYAo~pq&4A2`XUi*jP
zs#+}+A4Ou*xb<b4@4{kk=B0~&=6X-#h(AOuXNG^mZa8K~3C}rxFdgX408i9HUjT{H
zh6LtVuWdd4zEWyK<)a>+caK&c#li&%e>Dt;D<!JVTo;Id$o0AjQ`wjb=s&DU9*Ezs
z-(j}OSgYhRv}tk7zu%g{m&a~AX3L5qm0LNlL)yQ_ezq7FlRiz$`OGhpf3@z@Dk1M&
zFs%oqB`s-Xszs_twMMkL0$$uB8^MP0ibXM#liTRHd9xK$k0_s2QoY|zq2lUzJbU1f
zd(cr{UpY6@=uWPMx%zmSD3DOvy{9=tx4~Vn@X@-!7j=eN<&L|NOb6_-5vo(aMb559
z_o}eEhYMLZSa3RUNgrdZyRY^uso|wPm}}X%A~iZ?*Aeb*`y~=3^8v$Uo~N!e?NpQL
zP7?Wnw_BJ}B5j)I1J&1$3LTJIQT^`cKWBtG&S){}Cdt1!-6B-dX<E_BgVkBdh|+L{
z;)9A+q0CNxGJ{aeOl<_KyB#IM4V^I26P!g?$HqBT9F}8@ri&qTM0Bu1aQi=X!cq)t
z$w*1H4~MvWvf0{Iiam>MdFPt+J8PS658LP6me3s7hCr}W^KkNxJa4-%yqMP1c+-w;
zCWE@;>JfX-W5))ksH>8SYl#xWk_JA&d;G<|0#=ykvMRe98|9>QtLR8q=%Xjy!pB3x
z)w{-@DH#Rv2?ntv+<?h(XyWse9|^w<HdYGakHjA36HT8fIeE1SV0tGlJxE0LYv}Rv
zoS!{q?WK00klM;U6dOZ$Vq&}78P62Z&HeOEL2n)2e4CqRZgzK$(SbG0J?0Mj!oT(P
zZaM4bv4_Ig(H+O{mV5E2&vaj4YLWOk&Pg;w{(`*>&ho&ACz6J`Q^?GA4_IVZX5***
z3&61IS9oNo{Mmhb=9*YOC;yql#rO+=^eAUDV2Ha{(Pnq8+cSm1n=@U@TjS0>os&C5
z{{0L1=-xv`m$);vvaR4O28r&#KpIJTW%2hNxznjw#+|(u6DMi}OHMa~Xtz<O62%kA
zmv<xmxmC=Qiy`HQNEntKMSkT>e*#?IANnj2mZj^p6}I1+tvP~H7I=)~89km7vqPW`
zka1)h_239nMmbnx%p=QaN^GgBCM}K5t<-!)jI)d1nS-kTfzok>?%7g-N!uiNTOlWV
zUo4St#p*RPs1%$sbJov3O$;E%PF{3%C%t!aJK0NoI}+kvYS$Seo5z>o_hjJxsIF?%
zwUTFE<OKK?i*^=nb?J-Sa+EW(*GgA2O$p<Q%bh&{mD(RaclJ}U=IjiSJNA+1WR}gR
zI{Z_jDr{J$&5T#rSi6Vb)L7>zJkfiR#}-v-i!{HKzmw$X<!=?izjxYRt!ZpS@3lIV
z&syNRq|dA?7;`A_ev%*-C%2rRs1;E)uZq4s?&Z+>q0xxP<odGqs`}Wor%%+5Xnz={
zw#b#h^;Q-i#>RNwo4AM3&nzxoRQF0`@z<=(U<@>hu1(0j06y6IqQ9>=e*o_vU8+}L
z^iH1M{%*YUUow%xpVoFgGmK;_o1O)dbZ-bV_$CFvIW{v>8<{(e_}L#pG*Q^pG%0gR
z;_AUiS5MA6=vp~P*>GdEk{G+;wn1y6jeUmRx0~b~4-li?%6@#*w=YT(HsJK^xZHUr
zp(mH0XDI+W-O<MVNDrNP(39#Bi1Qwy<(>x2==b;zj|w{kv&*Ntj<6i`hU+ge?($*o
zWS4ajo$+^QYnJi^304+}Gz^Lk%cW*LT+ElcQC{-s)m~^Ewg5f1m?sP`(>uM_nACkd
zfaq9SdO!bd0Cumwww($a+$}3mj!iVF8{b*=Wf}^URA*Mgy&mI-!-IS6koH&3OL+6r
zUh>jNoF#qgq5bRc^fObhgco;S#vO2L#F1nInl~O4w8)-spGKp!qON*J=QE<GdlLC&
zlydX}gA$f_KfV0b(q^#6YgF|l)Q5~ePdZAfac;|wN`>7$i^|fqjd#L(BZ2S5I7vf^
zQ-W&Cst^^e|Hn<CU>yv8G}3KxmWi#{`?dL6Y=O6+9-YZPVq1Hq9cI?I_+cdWQ2qjN
zsc^STHGCL&HPI|?E^hLsL+7vHm7oOz#(vuF-@|fQi{v$L#mMhdGfErAWlPUIj+R&!
z(fq<F%E^jvE6zTL2PtOqN}rm?F?85xM0hT32Jm2DGiynqup~-vrez5)^SnYL|C(IP
zbcM^79kmL}_ohdR28qkblE06a(r74b)rH^Rrc=6Op7DTaDS#HOv=q@7!7!-m#y(58
z*u-$YabktY#T*1|B%EZS4!&7qv!{c*7+d(qxSQ@v_B%p7=o#?oUGN@qKRhZGbh}Ed
zpWj%4xP}&sIbx_urNG7-PI#AfrjX>kE_xOn(4~ayKhyN(?k7evwN=W|1Z?|K`-3wX
zj9gbcMePMZZ{Gd-z6#e=ppbLJ3)<2IhHKi-h=zw^g(XsaH-*M80H<WXQyVOIq5f;_
z@z3{p>&SZ2jRgn|42zb?!FOspq}nHJjdpbK#V!@Rs#If4#9RDl-crAOYxZjfu)~wK
z?|g>=nJ;EN?6lJ4@%0w~^BIwgZ-rZWO}|-|-hr@QzehqE9W`g<f`rXWbIK^9eG|g@
zZ3QKEhfT%fwB>NFS=&)B(;r<sbP0}7p$EFTxH#K{Tb4(wD&kWxGjOpj^?i6h;_vQ{
zbe#$BS#~Y_v73GSvjD}OJmA0$o90^*YENzB3n%Cc9okECc)3{OH&ptLN_u%gW57W+
za@vm!pCX`_B~Lx)<)IBPBBf0cJHOJ4F-%lpw{gpMjzzs~eyeAt_ckcsM(thfzQvsQ
zSH_1#^=up1_}6C+n8jr2_83WoqPsrVe!u%`-u_uGIU;DL(c1CdsG#b$ajl^rs}5WR
z)%P~ErfJN23rHhG&uqRN72s{#iZ)D?j3JCd!b=!LmK>kCRHmpON3G^N!k>Gx^F!}C
zw@sAiG70D|kDFy9Ouw9|7s2hlTa+r?Y}q1}>6U+*jbzZ^S*e)M6@IdFz2!#^b78<l
zKDq!Hk6P`PRnLSfta_MSl0^32+3u0*8N_vrwdlttxE|E3Qrv#8e2~u+eSg`{tm-I_
zrgpi2Nrm(K0?CKb09Arc=mHn!&RJ-9j&;=C*dV!2C~c8S%7^*CHkfbr+I;o=dfcS@
zE37+08rxcQ<~$xjhu!;bFzK-`J)5}JQd940>ly26iWg_9Ng&U_fmF}lhLK|Edm=c{
zKYK(BZ~Z{*U)gS|&3o0;@#EdWnm40TDoei9?(MBA0k#7TL=InHDvR}*I5tEj8Sh=2
zIOZ%K>Zh9|a(CP5d0$03Z3slAEZ0+6?h(ul!`$6Y!-2KHh%S$q|DLJ}+f}_)^Jq5R
zUOrR6;iD}uz|GpUu@*5DtEiG(g3LP8SSd)HsqYhUK?Of3Fs!Ywo!Ipz-Cey2PH(dT
zgkZsfQkBhvvqF3xHo>29;J~VP$VNcM&vZiU!^^)%a7633<P%yLTj>-4Z_;ITYJO-j
zZt{bV`O8f;?U$Aiqy-{qEP_paEz;4>^}tT==~X)g)=B$=2jay^5i$qfF)G3lqYGD4
zJ3aBsihE!Y_2`+*n#e=V%6lV1K)=6aIpEhSDK&X}mO5MItf&RKRF-t)&5n>AZ_z>$
z_Lc1Vd;6~@SJh;G_=w{~AU{VTtK>qvT}x{5wPcXgrB{U=eKefoQn9GzqJosKt<fRE
zcbhE|YpmG*6}J4Ub|sPwp@%ka3KzTpx=*I+Jv}|4bsBpWI=9KW2JLV@&fR{@!0<g`
zJ3=1&voD|6o6r)@Cgir?qW-qO>}iv!M4F&1k)YZwX1ur!VEJu^J-B@t;zg`1r7|FN
z$9{_#qMMhMcQfCK1+?$#DZP~^ZPc&+<w-5TC)7=0$jy?GFJ+I3>|IPy;luDEyAw~z
z$u?~nTf^n8ZLD(2k)nmm)>n45yL}`+GAL{S$M%C^iwQ0EsCKAZv^hq9`>RDwB1PJ>
zuihR@_7Jv(XL2zxlS252W^4}|LyO+I;!<Ub;}zP3ys{Vot*K~oNLX7Qz)XYjo7H(s
zn6Yc;Y<jBjocwtoJCA6nOEx<7o6v7<FVMBJ5sf_bH~LiJ(^fVfU^em_7n`vRZUd<M
zBe*7$uI_iwWLCJlS1Z3=`^Mo~pOl-MZ=mV^qygKxQlZsRaAoHVCPLr4NU=h?F~oQ(
z)1*O>9&+REYFY!Hb=pX%at@heIPV2OB>NaVaG+ynsZU*YUj5ve+dq}}Wz2Xb(eQ9u
z+MSJWRGOq!w%ejDWqifFU}ws8b=|EhFL6KNmsy9~N{;tT)QTbIXsF`+2>H0wd~er5
zyaZi4cZIQ-=dq6t0gG>MpdGbL0Si2AIW?-dB}1=$RHovdP?)*n2a#a+)2h~~dta{@
z_*`Rv62I5?5cMQ4D;MheEr;Fc%fDhrWQk=`vhY4rd;2Qibl1GMPP^o;jxhtC(-q&3
zz{8~VY8dGXc|4O=uhn8qB$c;Etww>aVr}Vs$<@WXI;H|#PCToKZzj_zIwMqtyS@kR
z4x3Fv%llZ13xK6XXXyf<LfE6<W!sd+N+aveGxQrC=ezCh{1ncpc^Sj1`vH%Ez-umm
zZwncd&oK!zTOtL+Ep;Px_f35b#WI^s!rmL;8xXAAC>#~A-V-9f18#GQY`2<%Dnc{s
z6?^&?hS=YYKNd9#KaO(uYIDULzg?*ySgwykO}-l6KV)?`brrc6Ch4{73y}zX@%%wQ
z)Dfq%m%nettAE^IpSDF`x%-`O;b$q<H^81wX^QrGvh(BUz9q@(+!%r<YOHEV$a(Qj
zi$frK);z1bDY@cR9%=H}Bv(E}IOFA=8Lqn>oPewj!Rx~^1l~j&=PX>QI}3b#3L~Wz
zq^-oNt<>(1>C@dy>TkQgDm%G^(lmqxlzrY?SYDs%Z#ND^CV8mvpWVc4B)6y+yRr$7
zwg|{3zy4_NR$|xPw!Z%froHxD;)<UHJvT%D^@UVS^YU>i`m-K-Jp-C)I<p_|B!2#8
zA6`{s{tWReS8Vut)~&bs{^<tdcGba^{uLuHzYp)U37^3x5w{VPP8C{L8`!je4^?05
zML`>&uTAP%li@C1$mFK{QVbJ&tl~!8;RwA}`OHUux7TiC&l!1R*Wp)F_s%;kw09If
z!UEc<?j@+EE)u<<yxrvP_ypklDSlM8v$NAXR62H;cK3}%3b2|nY6d}#B-oL|>?#aV
z`y}7%W=hYirPH;%`mWJ32vIC~a?nAdLZ{^Vlnj~Xuu``o3ATfp{JPx(rXyV+3_3l!
z5n(>y^mRT&0V#g|9HzQLs@f63I=PRm`8oQ&=8LPy(gz6}p@Gha>EZp6jPpN!Xe*cV
zzqd*``FfI_V5vL!(v8390Wp~A(i1EJUH;NS-1N+Jka7tU_<^E7RFFl$jUVR^?<H_8
zDJ_H+CHzfM-u!RoziR(2FM+=hT3VC<@Pk>`lD`o5{{RC2nSekfF>o<@{wu(Ow%CW!
z{BHCB$I%dC|5SNPG3((jLI?f9xc-F$dcAPp!DoBHrZ;)P@$oZEO=Tw;j=Wdf1)wp0
zhp+UpSJ_~`^m$%@jo$^J_odi$YJb+UzG+fa#$v`rF;t3Cq=;eWH4eb_fZW)BC`>B~
zM*0d)U|66v=H*pd8FKSUr@xdzU3m?;Al0H|pTv`rTo*_Z@y_PUp;~8RexX&@n$)D<
zc-Xfqsnl4r&dTp6!SPOY@RAIpn90{sB4ukH^*s570m%2|{7LUft$!i=@@cS%m|)cS
z`{p7mxO>mc)pD}pGOLe%S(!g-Uw`_Q5)EiGj;72T;v?a9CfK*-@aUVhUm_UY+SsZS
zZZ6p7d=(`mE=lE*PcxVBxSQSqdPdWulO`Km_I?G-mRR=Xf~Xen6@f!le781U6@j*}
zxBB<?*7=8uKKFerc5-9omRB<I^6|}mAh3A>KoBAHI~PDHTvr=ahjEFOiQG+;Urn<W
zaEdW=G7aFt;qmHz-N`M#-ZoY8=J=g;+%H*H_7&CS-{M&IzTf=l8aB4E7KP)<OwLH!
z$>xo^bXD=)*&msLZvY-YLz?8J#kj~TXYR|MhFuGkA24mv%VEg+5^sOf(%!u82Rz13
znpcuS9poW=1PUj^3APgh3goQ%QhoUxSd;f|O$)JZMc+f8wXXV_&*&nV;%VNgm7qw{
zk_W|Ao=u*Kj|H-mBIMA>*jjjx+==ruCr_V;(Ri5*cUZiP)w&@A@-p+rw;KZlJ8jv)
zXc>18`1FrF_Qn^z04TQ1>ZVU3hpT>{T%GCne^N}@oR%@w+Ld4w6pW92iK&l?beZ?>
zW~V*lE1xNni;-?-@ItBt{5pyg$)6tlmiNu4>w1TS4^QrLp4(DELjDy@R+4HJjP(^Z
zzQriwXHfRqmqG0*H_11<nR1$G<6Lr{){Yy@)e^_bv}Lv7I;&bkiv$Q63<PD?Nmvs*
zN^gu|%^g>Cy8t{AXrJhbUjUgGfTAcx=6<e2`FlfDMOI%s3HG3;X}xrbaB8GaF}dcT
z;mdA(RlHwH2i{fBH@%gz8A-uI;b9tLZf!ZSoJ*>-2!WO86(k|(7O~~w*ZZSZTk0Ds
zvzIJus%+l8c3r!Bo3?W}ToY%#>D<f$o9e&BaHOY7G%FY9boayN#6mxhGc~7~ksofK
zp4P#Yq$^9&35O?wA$5ZN1CeAA%-GW3Vx1T|Lww6K*o26ObA9&I%(lYNVRc%RG41U;
zH(mBpLN@BBpBmjL_0jFLl|u7%F<k&rFml<%Wj$Zdpp(p(J`{=ru<{KT^`|_3W%9#X
zp~s=RX5*a>Yy5|*NvgzWhAZUQYb`R~%gNlm!O7)T1JhMAt$A}F>(m4XRN>7}#Ys|B
z6Zw+&Nzb^aTKG<tzT1&Gxb6p@o9ItI%D2Kx-WPN5p|rsKh`J*uE0vTRz^*lBx-H?y
z;?iBg20DqqA?V++Z~C}eDyyOxpNQXm9|s}*{KO|LVQ0%tkXeAmr6-*00_agChZz;R
z8O0+5MMRHhpu#lLAFgdi`%~bXr|1ACD$K4kv9Smo)Gmo>l17-l6I6=hZl?_eKJ(Kj
zA$z1jlSbjfLhQWVptlfbM{;&&*$pPO^jVd8)0VqE!{kxzq-+*lhBeD)>R+!rGlGR`
zd=zsrHo=K1tnh;6tj=<T0`l88xJ!@UC$GYo`TAKkY2ysS;A?)CFrn(`C>>yh_E3g4
zVr);;q#MDx+@8XeSzhL5D}>f~pW#VQKl5OcJI`?@_W9jwjC!)<!kwCGM@YqLbYzd=
zV_OakZF@`$t<#DpfpvS9QLS@R%=q%yo`K`zvq{eZ=DoDhKm~brt1-QT0R=;m>dD_+
zZg%7qN0cZboip9xK7GOQU6Dc!H!Cl`Kqq1D8LJd4`4!q#JK{p@XOtb~_kJ@pv4+EP
zh0_sZ+3)Fk2N#yAeny*wN1yAR{bV=fJNgX29NsExd-w?vi<tnelX7OYLNf^?rj!OF
z>)$j=-3J}bKh1XgrN4VFT$(aJ5EK=Z$*^iRHgh(!7z2}xU#cJt{G6kaz~GVm$r8eZ
zikxbyPA&}Smzg$F&)bQ9`b!<<!OnOlvg{dQW7Q!*o0V`B{aRoA%kI~2{XD*Xn!VSZ
zW<Mw}`{&+u;A_OXFQrn!gRQa8!rodDzQoYI<^7UI#T}9+9j3;qGdtqki3}==Rf<YZ
zO{!?4gs<Gh@-2n&M+`ZvkmKLix>aA__yQJRBJ~LolV+d_Pkk7}f=QdaHE~4F29G^1
zLFa8G)#QZJg(+Xf^d`3sw7@w9x7PK!UR!_U1_}chMr4lq6Jea-3xdsRY*?@Cy;H*%
z&$7Ap*#~0<)ipnLL~m-?!`V@0-4{SCslQls0DR|a3!o<ua`oAlP_Y+MN{{zzSX^?Q
zku$D)hMb!+D7zZFD3}&_Z>h;=MORcdx4VDVxz0$%SuFsOm|N3=)Va@>3-Ny%UaJkq
zZM$BFZtqKd%v7IvSP&b*UW=hiUJh&Y-YHARh$KJyNv!^^s$Ej>i9`$|fcVBkj&v<!
zG-qo3K@i_Y2rtt)&#Q@y$)}H(33oSWu4{f8@|H@6zd>s7&Z?k9L#|715K?FK%ndVj
zU{PH&t-><9brLXMG-oY}gbrP~fy&jS7pd`oIMq6nP-c9Zm{o;okE!uaQ6)X|Tp7~4
zhQ7(Pn;Kv1=FR!+NM0l^HSF0hgOve~gD7R8YRtytHeT@YFPn^1N%bzoj&xfV-8aqD
z52&XY;N(Try$}bUk=Kz)YFVCGX2zOSJpMTPE3tcl4x6#En8>8nlNuMwqe5SWZheQb
zu;87s)sY$MkZ5_giTjAy03T;~&e3uD`L~GSHUam@MBn+@5En}-(Ff46yzP4OV0O*(
zg)Ll2Gpj+U+5GKWZ`vLXq$bsRKPsRQ0ryyPT_?8Bv)Z`F0<CNew&&k-T^pgP*8TOg
zZdeDxk>7~Ci|$YSEqh<_C@(AiH~Z`sll8l<u#zwK4X#fGIN~OqsyoP({cUG8$Vz{z
z8>x6>wb0;eECaMzatk+xz);O|S^56&C5={|MR#8o-4tTFnQz9LKA*0^d~d<o$dgsc
zA{ez$kI*|2ypxAk8`U+EcIsZD(j5%F3iqts?4H3sM5o%@>5b{lsJ#4y@I||H*)hOG
zmPAZYWpQT$w57SnP0_uGdi21MuaAm$O9>yade&PhF=Ugo)SiHBcM&6ptADamWrRC%
zH-6}O9b|K3=;;BDK&+<FG|NGs`}a43d1hhpY90tP`p%I!qEkg|80y!=sC#I{ThBmg
zHiWskL!+dW_k1PFz=tf7=~Q2nhHS~CT##4xr+{XEzYo@I#k=b#CiZazyDQzvUfQzN
z=fv+M)2({Jm6^M~9O-gv#}vdX5ZLO5>(9kU`H&0Xu?zaA7TSHVp89Lg%^z2TTE-=U
zXLDH#a|Jl403L{Ks)mAo4KFhud^)Lx6S)lr0}(jO%_P28U%b?KBQlrs<)-r*mw9DL
zjK?!&oc_?``?^neWK$Ke?WkQam_>4CgsLFsRC!tMcF>7Scbk;EoR~y{SYc0_b`opb
zw{jCbmGNpp^y984M}o$He89C5N1qVZw?PSFrBU;Ssh%xzn0i!=iZI$N>P*2C>1KJp
zJHKA=n)&PQP+Hr^z)U_ypGRxHsc&5%k=^b1M;8F0ErPwW=3AKO66#G|sn7d2bb6c2
zPfceAUzrLvSnmS4W|L2!MSMw2W9Nozq0CaGE2L1htw#wZ`K%cHipWsd=17)zfLF^a
z2Jak|d+0`PSPE&lzXq*jMp&{CyV6+%nmz$$i4b^?b=Qx!y8s@!-#Wd0a%V7+B{;1T
z!d$TWX=%kr*^po_->%D+9Gh2u<}u#JjZN*Qi(ne7sA<mOsi|vBaC!VZ>Pjgtz8jJJ
zOv4?3g=OPAvA~;@DSFX*Vl*;^4G*Ilzl2_lKci$ZQ~dcTkfuFq#)Y!qCzpt84vtqT
zt^;A*kVgg<y^{RUFw=+$N-f78Se=)_WZuG8Zlrd<(x*CB(&KHkDl;E@7{ZeVSU1Z8
zthhgvayGgOm|)z2D`3z8Zqhx~^y<a(>Fnq4HU?Ick3HLF3R=t_MD5*)Cy7$_(=sgE
zLvW+MkI-1ahu0?}K9s46)KKsHRx`$lHbXoVxXX>T9Bf!!w?n805Mg3nhH*ivByCJ{
zuBMl-H>{S3==`08UvuY~(`JfEQx!hzAn;+}%Uy07A;P*ZYbCXb%$ylvekaq%cpT~x
z3BMDj+Y((1;ZtpSHc!LPuu`?;6T-K3Um#3V<pzA}A&NA#e<d>E%q7r^UT5-fNM&Zh
zW?N4W$DiXX87e77yL0z;gc4k;SA~CEn$)2)2xI%5js8nTpnQeXlN<H8_@A#HJRn*r
zXK^8rCz$6i-w1B-+j3YlB!~MikHr0!-zuO6<4K#+B9e<b*&pww94nP`@jg!#f6(Y6
zZ1|~x<Uzz;cOle%S0u}(ID%Q<p!c2%rKiWXdA95ijqQe5X7l~|w4eSdSR``u&2f@-
z>=OhDI=^`d85?v$5Vu4(JvP7iX@J!chp#F9w$hWdPnF8>{h=^CURtW)U=i+B!-QjY
zCWPJcBKiE53U2Zag7e*Z6HyA%i}cV)mY)C96{QY>yk7q#rX847AwmsvicpvqJ5y;=
zUQa}d?7eh59(WI>!|Y#MHmX!X#mp3Q%kSE0jG67i;@4p6x6pQRF6S?$+u3?O$PzsZ
zKRWO%+`|=R3ifH1YB(!lSz$ZsHg~n7Q=x#D^>lYeFva$<v0``+vvUQ-imUU7mzUPf
zX9tZL<-+HSA4B+HW?yKGH^@xryEDGmE0R9$kKZk-`BL(jX`8_c;rmHz@Xa>`0F!^T
zq>6`7!l<L7`MPcNuGP1qhiZpD&wiI!C~E3hD@jtWvRRAo%B8>$dzf+9OY=0=VTA`B
z*|$$*1wZXzqeUORdie_e=J@xIi96{>Tvm?l){-qe^ub1tZKH$vge*-E!q|r;aAuTk
zZQ<8$|K)<%F=&oKW`IV%z_R%sm&HSV22VUI9^b_W5zR$!XR1TUvswsH`w30Re&&Ms
z-*Th&qle!P<tn3~%_(ck-YR^=YeDH&?y}dHu0Vzy5k?=d6U#^jZ0H4`i@xIRgd(-s
z=Xkn(yzO0d^9@x}VRwst<D8~%!pU-i@~isFUyAI?@VD177eK03cdHlZ9e*!g*gQeE
zw%43Gnz3m#X-V7n6yFV>eTvf5^i3i4vW3gpG+=+atayJAa!tcVgb_S#av4cSSzjI8
z>%0}xr~G}!wRD)JtYZd@@0g(qx>8xN5QDl2?-ri;a%s!Y3q>-mHK-YP=X&6SL2m*F
z1FmMDcArWGR>E5b*%e8o=2ObzR@W0fy?#w=)1Cg-dH!#*?FEj4o|CLt?#A|}200V@
z{GbG#7xhvwd_#fixhEzB4M@iu=3k6x1Yd(c#{<}&nPj^fB|qQ(CANG+m8nI4MT~Si
z+q)aPFwv!0Qt#7#+*>J^_I!c&mjzBDN6dyVtHeTEO;M3#mA>@>tJzJA80aORyh=oF
z#iNF-%xW6yW!Kld()sS*A<C2iqC4fSQ?I+{V->`D&V_U)TBuhdNz`9ix>_PktF~_~
z_WRU}cu?{55Wk%8BkjrDmUx&;?p>7PDNLurkF7$H$Foy;){2oYB7`P*CcPXbX5E*6
z(@69nAEjk^=YjhB|K4Xde0g>qYqH$jO5G7U9h*<;(vy#S+k|w*GtnryNPEN7d3f4^
z!O2;kWp#DE?dhLMLb<F0os8hz&gUUtCXby`p&EY~b#qV@)zlF3<K^`b-5e9<dMYw_
z?`>=+ikxW?o7%ZZfxvUaFE581yB8iyed3^}u;nU#`~>~36o>IVls%*<OQoJ&G*e#T
z0sud1RPAoY)_QWdF-^U62&Am0C-UJ=8ylk^zV*hxa~NPeep5gQQ+^9KM8(D+<lgsi
zOiIr(yv!H>gmN?*m@6qi0r!xh0{(9HUw^q9VSc8_u+Kz|fZx=_ihe}@eo^-Bq(q6H
zc<^1vey0~=;K4>kxSoY+HrZo`^7-$kih;FlFJF7o%Sm*_OQYoNB(FhK#wL8_cP(pl
z$|`wiYM$OsQr`SKfOQ$f`Zt%B{0U}V2DETfOKHMx;ppk;T_e(<xrK9?^>j1<8sqW5
zF8(6c08foTqR~_W0LIY@aWm6F;QChtjw<s{yp12{{{%vDHh)JU`Ni1zSxITp11eCv
zTe#y!wqRJB6>)F8_VZVS5{iT<Adx$6qjfT!NG#%3|Hte2gVgmKODhUx40HNle`X79
z=vy5}RYfmV6!a-`>!z<O#aE!h<Ph4aJj;x?#To9EDZ!Z=hNXJ)*|7C1CD_<vtk5$1
zqm@wyjI`9}GCk6-jZR?!k}W2vYx9-VX%EPNVLzd7RsP(Y2^H=kZsE9d-)?46)cIg4
z1Lc>Nk`jJR+{TWrc&hjO=9q|J!D<BV3Ux__C?@x0aS`#pP?OZ~cx<qKjof+_^YEE)
zd$o}XTJDD9rehN~=EZ9tH=C%;I+gUI%odW~NIIAaU-DiX3qk~a7`j(c+RbwExc5u{
zw_TAN#S;CwbisH1A0~yJ&ECHEb+&3ROD;1L+{W|i!9U}XazmM)FI~xBJ*2(Yri$H1
zVlxkx^74@@tb|*Nd9NDF7(GzWyySk#397~S;T!<Jw7ecohoIUMRpi+zrQ0D0b##p-
zA%?Z(V5?d^NYvna-~k(B-2({p<3Ps>L}38wyzA?KKb%Ob74hvY_@?c+VmUnW2G$J4
zaP-}fxFP0beR)%DeGdG+tXG553oS%`*p>IYdZ{zy-Nh)pf?g{nMlbeTX(A$rOC2|V
z4xhr3=jA!lzn(@b`TrOP-^iuyADWHiGhwS%!VH<+YzeSssOL2TXX-4-GHc7Z#JFs2
zv#?G+cA>|sEK7&9X4c@i%^NP`*Di_0urb$s;YH8+wC?<zzBeaj(EN<+nxt<OiJ#Oo
z1TWRO`vtq^*ddY&<J~KZjYKb#Gr>RWxa%AH(~y+*O6u;12yoh4XnoScOLV|dgRKxG
zqWAk!>8#-Gn&|qT3fu`DJE{-;_P$Pttos>7dq4OfdsQs>EYuyxG;B+&sU_gIl)F~T
zKYK_W`m=vVsnBEZPnf9CQ<8i`zW+Vax^8@j>zdTp<es$rhJlgRP5SItFN?k|x(BI#
z%R1;vRYpGN{o%;HuD=a<mL;Xs<XX<T%}o_0pxGJWrz>R1Z@1aM+LBjhX;t!l&fYiH
zc5c0MOXsn~k5J&-Fn^L4>DQkpy362<+c3apEVWAYh29qP#xF{`Y3zXT)7)i#$sHYI
z5<Pc!$%S@y{QeB71V8e5AbB!7<q<hGw!I4s7kMZaV|4>9-a9u_YL3-h*SKTt<z}_M
z#KI4x2jBIaix>^%VJDPMP2kqgw951Ct$3CF9`;eJzD83_`~hyP=I3Xp#Y%qHzl6ye
zDylpxLFP!4C;gU;?ahviMueeGMHCP05`reKR<~Kbwp@lTc&^V7Y4&3Rls|lA9qG19
zR8&oY(Z7Ue-G&Dw&fm8X86R6?ZX2Vnex4CDKJ<W0BHz`=l_o>^e!>BHY$U~dSV%dx
znzo8=ijDOP&je?#g1--%e4&Z~xSN(l{ltAz(6UM=UIQ`m9^r-Ydb#ZBeI4t9`mS%e
z*e%5zHk&iMT1#bJ__-4|Ur+3MfATkI0B=6Wd5N%a1jSY)?V-K^lJ59KiE*bS!|{n;
z7S*dILTBRwF+iLHlilw8aYJh&AZ&U>g&o_xqG!jv#YTqBL%E)*f?m6%?ujGXhUD1+
zCr&m|1A|Z5>lN@T1|H{a@T0TvH}3h|byz19L+y}ImsD%*(NOQ#dbd4J#%!U0&X3m#
zc{X@_6rI9kSq4t-C19)yQu3+mu&UmeN4-+!Ha%^3D*N-Nc?UJg^*?h}XG{S3_r(a{
z-76}k73Rn!7^Qcq>q(r$dN+bMe{@&4$n`jRwkkD?fv-T<I!PgI2W@L<BV9FXklxzt
z@q`<ne{udUIl<R230T9<1z~J_A-sS26CBcoaW8P0c4=zNUS9KDxpQZkzuzn^Dq|9m
z$S-PZ!iKCUsm4VRjh(sKQ%13x;)p%%zbgCD?7ELs?L)?X`5}etos8ByTLSLuHts92
zi8Aa|?%879s^pgUr`i~w&n{Rm+VK`<uc=O{dzGc%Uel{*ez+TT``$vgSO0{J>F`Pa
zt)!u{IW2#ts_SF&K8&GJx6{(*%sA1r{Y@@C?F8oVcD?xB@g2pF(A*ZO8@)Wqsp0Pk
z2^u>0Z9`5K;p{zaIOsdSQ<rnpT!K}~gZ<)obfjqB5z9I_vz)karP%DzD<7vPtipWX
zV#{ufX76{-2!5Z*(T=Oz_o*9rvlyzG_K^9OpBD63I-PNP%npW?1K*%JW7f*L!GMa$
z`@Hh|m3qDozGd@?Z$l7IEVbtx{3KuV<wmE>IfJj`f|u#)SMnk|F94D=DYrL#kF(|X
zueP?(?ebKM?pARycC32AsFZxOk3I4o!})Y9vPGtf!%Hk}?;qQJoBnX4LZ<%jJHYn`
zUzPjuYXymgMuOel*UsNK#t!*1dEaf$Yao^k;j7#?nI3Fs3_Lge+#5kXai)&43RmwQ
zcR#VTup?PdaouNAs~se6i5rIV5wNVtY!)!e7&5u35Kel*n9F)Y*QdVkQt9}4<}YxP
zu**u)WCp?>5S}Eo>Bp}tTPFNUJ@&)U_mbLm=CjyQZ25dFYR!?{_C`$14|b+>VX8AS
zM%RWVu(z`c7}_|ov3+e^Xk^zu$;|yHSkpT(d+xKHUOzs4`_%J%1xmq?PA2L5M4-v*
zn9Nf&TtdUeb=vG_lYZWMxyyM$2u%CHYM&}ZQXDS>-f?-$t1Y#7O7rZ1tr&ysKj}j*
z(_-zHR;L5JiEkcH2TR!y+AhOmwjAoNk?E%7`S&w&u#Q|g3;KXDi$^e)ZJmVZ3-yHt
z4t;6uZr|r_tl=Aa`1A^EVffBLTCd#)#{=$7VxfMR6DC-H>?QgG+-&FMJGQ_q@n%xL
z+};=SG~t{lvWO2!sgd^&7=Odgw7#(SwxeUPf<mW}1h&?_!M-w!nW<L*3ND-GY-5NN
zPFHfnoE43rXLPzsRZ*iD4z_8ezm04hW?$B4AARScGiB9BO_-z$M9G{o*FS06#&}Fy
zS7>d>aHT!*$kWa$5mgpb5g0Dk{h_tCcWC~HmGU44a7>wzO4nVrPx0T%g?RTY);Q%C
zpzFI;sSz?ID&_2PfrK6^ed8g1{oL<LvpB?s*_4Z`2vojAe9Rb5eWmi$>>=E2xjreY
zKhqY#=AasCn1{R;-1B6u+|&GN+OEy>i26uyA&1gBJCEPH7-82|c6C>JEbF@$3AEn9
z-Mi|kt!!)zgE%tR_3U5tHhHT0Pe$i=tMc1ket=V4)M96bMWH;UQ2JTDR<6#?bze+*
zKGawftv5Y?N_XDjbhk5Z0LMJ}D`Rlf*&R&ct!a)rOn<azO@-tSxxoB|LxbbJVj-4~
zDSDwu+$`=n#K6(_u+MrUQac$X3wqBN9q?yX-sHMKg9);$?C{{^{i+ma0_;5>VYDdo
zqa1yy9?NG(yF<ML4{@QX5;q!nR|y}_R^q{V9@;s>*?WUj6wxUe%jXJA{4!PnxtjeV
zjP?hd%0#B0(iN9;QTCc<irE708-@&Ly4Y^i?7YFrNM{}C%dHqq)5ghhp|=h97~Qz^
zOGK~9n?f;t@KT03&#xzfpfA@OS%cS>wPZ*DKj^lEHMOt_H^+PvNsQZ2=kOdL5Og#%
zem*=NwvyexgiOenY{tf10Awm$SU*;hTa8tU$r-cOiO*Lb+c|KHL)J|uF%z!{c~9jU
z8q@YAby$pQsw;0?vv`pLK+5?>O+@xY_E35`7N)LFIB8?iLXgoYd9F51jCY?mGd!nz
zL9z{<`pE1SIw&)%DPVdifV<(@*cHFe&>Qx}Nd;I67M4|VyYqtBGYeI`)RP#s3!rdx
zX}lRvsF|(%PQ~7?=-Ej1U`B|jLwFLiJMxbFFyS7#%)K@eZ175CJR55>HWNmUlCNzR
zk?Lux{jz#6pXm4PS$qubjGp|RIYWbMeZJ}94Z5Z(hea(Wcd$ccWt{>lQt*h;`PuVl
zUR3`VbMN5|N8A4a>%Am;7eVwIB{~shi5|U2MA;zvVi5$<gCHSD^e)2cRxcr<6RWQl
zeOKME-0$SRpZj^A_q_kW&pCU{%ynHmvpaiczSpPCve{4d4+O@V`}mH9p~K#(se^2@
z_K`Q-SPOJOVUc?pgjrZoprTC0E%QuyjzyBeGErsG=@sLVL)1s3p$kB3gA1}3UWWRk
z56ckeod7`9U0#JT?=>0q^7iNb852^{_!o}N?8NG(d7a#%yl>a(k~)&1tqKC@=d*gQ
zZ~LFm&dPCv4jE?d#EsW0R?TyAv0AGA2o6ckQTv`^S@P}fqa@*~+qY-{wF7<{NU5@0
zkq{kdH;sL{LWvD6TyV?&o*8pF3uY~DgEhxlRMu#HPcGu1^1<CXK0HaG$GW5Q<Ds(a
zlm<N<G<sUy!B)!_deAvF(R;_^RrS48BoZaQkv_f6a<~=1rOq!joUo7aCGTief|O+0
zGe543cc*ufNt6qUYu{sq(6ss(`zslUSf6?0r2Y5H=lLFPZq%0}IUk%%lcfQJHK@Cb
z4euqj$Lb0l)~RF8V;}3gy5}LL*RJL0?GaoLYZE+t@<HO8=Lb97qSbEgb9cbN!vK8(
z0J?E7+ouME7D>dqK|_}Qk8~F*U71ppc?O6!ZM#X9em+}Q;!J|eSOAdqa@2Y*v4Mxa
z0bNItydTX_<Lb9y+{EF7x366CmREhKfkK&MQzIz+6>Ka%IQn2TzfXk{;U>YO%fo0E
z_!P1f*PZy8H3C0(zWcylz9~^zJ|#tS#*f@2==#;6RBuJoJcYfR+Iix^!dBGr`tyMF
zQ8Gqi?t==U0XR3*a7LL8!u@#mjFMf{|G+E+%wLtZDl8P}J-`xxLtuh^L~%u>S^8(s
zfKK{9dp4~4XU~2Cd_?yi%Hk0#v~o<hu-7Pi#+FU!+UKn_5FW+*c_Hrh_J=V%PYWmi
zb!*pWA?A*O2W4N6U)TEkpBt;I6z8QRz6xZ<UsWFR*S@X6syibM5MFCrO$Ce04F?9j
zS&X-DX;Y+;zIP7QdKpCE1cM%|3VB5^y7Ya;8aGaR`a4#ykRTA`zti`B+kS$5{pu2M
zNIJF_57V~U-c{m->fZbOXR;qouPB1dr_z#yJYVl_Dj?ZB;SSJy0Q<r8ST;s*SlKb}
zqp47BoCmte2BYNb_6%W}W7E;x43qp_O!Yn<+c-VM-*-KsJ5MZkp+x^Xa1|ULVV;gD
zF^CU9B>kw8URYzbRtuLTht`Z+&0FFwbw>JPo^}+jKhIf>3**2FOiCR|uJoku&89{u
z=;D)`$3TC_*nSlw*bX2m*#SEW?D!rabTB5pUm^Bg;T)$b)X+P#yzudw)2nZ=9R9=X
z!`a&u`V-&MY&83O63;d$ursl1wK22dbjpAxc|Gt=&0z^TdS|-UZ*RIeO{Shf?5;YS
znl@Qmfn3)w$N>Mjozu38+Alz{05HPJyy&CevDa`qy@%H1oo{@Cf|HioUc6sG5Yk3F
zURW9T@;I?Ybk{;qgIz1J`BZ15SdG;^P{UQai*$QM{Sf*)CuOU~Q?-}oQ44&t#XSp2
zI#(Q18ezdu3Cy?E1N`&wPE=UA5^5$<ewbQxVAu7+K=^?3Xi_GnkRtb|9j3b$V3wW_
zxL{b<h<q$^)YJ40F6RpT5OglSi~N^Hx|W%|^jpg^n8LMA+~wX<NL)!B<6DL95FU|p
zPN`?Y2I9Ys#td0;&_A?^<1wb_5iRsmN^C<*f*mB*xXG=SVVE%lECQ(EH#VJ?amb1?
zd6IGDDmDU|TQc@T*z@D0MAWT1QJcB@KD)t&Ni`nb*BiRxi?5^RW98_Z?C(Rh>@kmS
zl%euy&pfy#nq}!%)&?8tE&l8k?iRD9v8i$MsVATpq;VQ_Fm9T7D}J26ArL?<g=3{7
z;EK!t2N3zQ#$S;6XMrF0pM^ilrvG*paK$P5yZO(;KLh^l_vbDCGZK(j{ojCl{`WY@
zRLFGfdtRyhHF<qikO^qE05umu?JKVaX&5GYT@#aqI<Y`E!piIwT)z&|j+W+V{)J=2
z`Jr8dtVVN7?x*}Zu}b))X-~jCqZZV?l+`h&?kk}k4%X)JBXhG@o5nO<gL>U<VQ^Vx
z{qK-K0`e0VriCBgqajCq9;_B{OfRb5<ZE3Xa?BvdME3q5ZMz|<h)#KG7a}4B-<w&H
z>|)o-v!sb80{tVR3RAz@6c6=Y+fn4K*xNy}>+6|lH&3nJw;sOWXB^J6iJ<CvCE*z*
zlGMyM4oH=+X)RGl-MOrwxqX+ZTE~ziluh6GP)o)eUN$^QIX1uAPdohY4r2=FkNrmn
z-zZZ+?a(gqo=}Cdy=7K(w$=A078{~NYjA?;Gl>zVI~BQoF*}i;o^4Q9xt1qZ$<#ob
z&~_L0m~>RBe&-Zax_tio<ze2Qi&9%?m36OQOSbkqnuG>VxnFX8Y;#8I2dw7pm`zlh
zS$$nz2)h!@t6@=#R?09a)A(*sGST#6AK{{=0e<$yu)s;eJIu)=G;y3V5hj07-t6-l
zrM=zPIhcU7hvc?yBe*D|G*KYN%;xtC3I`w3-G`}>LB6Pv!B+eIi%$#15zXj(3Dtv0
zIjIdn+nc~8yw%ip?n4}x)P`qB_#S}mCcOPE0J9BTSLqic*p*RcobeN3?V+);x3h6?
z92jpnVou_EBQf%Ju~8n!hnRT_E`z}ES)!?`5GlP!G%0kddA7;5h1R-_o2j^Q?L+T{
z9M<$VpBsu(tJ!-@fS%M-nXDTyLLXo<);Z_bdm6*;HF>!7%TrFXWQ@K$#ur)iW`5Fj
z^pP3*fe6HtX)FmE)mshminhv1IJNNOjJm8z52r(#ceGDsBUl;ZbSpnFCtJV7)x?z}
zg7+1qxU$9euCP=qGFM@uEQ4-1G1;7qsuTh8jVT^7BUz7#7*Dtz67d~qhAdUPln6r=
zP}vIuGT~HG<X&%R8kX-Q|0FL7puXp$L+scqUoyVUCrtWnH<TgmU8z4{x_MdqN}7^H
zW8I!*5KX&wSiLTGdsp^2mtpg1nuo&viwcpcu(Nnx^^2d$3hTw8fFSTzZlqDm$zM48
zy#;$5oEYgsH><PPm(KgfwpmRrNuN{k^*5Z^h;X7(2f4E^0qD0x|8QMrc<>cgYyuXl
zGLTR2d9?4+7;7|Bn1%p7eP+4NP*z;{97jH8Xn4aV{`Vnuw6f4lr%MX4a2_WBL!scc
z%AdUpm$=nLW@-_|k{Vz2N`+tFq84shNK;k$^u)9xF;9I%1xFnPRB!{q23T$tQfXV3
zOJW!B)sj;6-LKB-KQ5dy`8M&Hx7rI0F{bP5$Rn1H<Q$(yJJOcsS**MnpJ@vm-W<P^
zMnlA7n5w8@uAobWsh!Z#aWC`X;J#9XI2oe`d#WX*7hGU7XIlA&9m%Ewcd~aiU$R>e
znLYVgMSUk3yiit9pWfC2vcRy|6JVUWIPRlg09GWn6->>7<@ENn-vMw%0FOUyd%8s`
z^M(IcUqqgDtxnE5dtSa13ja|~PZ&*lPt10o%!x+vk4ORN(&SyKHwMGbWTgZs5+e9X
z4I`4c_kb0tneI}!=eua#>l8wG%=%ozm$!x2G@&r5RPhz=>0Owqzd2WL-Rk{afO8&1
z>vqkV<<ZahQOb57FWTFWRampWbb<7NDIVqLf80p^6!l7e)3x;|4o<cUOmI4mUQ361
z_*WaB7*BfoEts{$_;-wuY`zTBRPTL8`$}IT@j6Gtpkc@HIG@QD%7|{l-WN?-BX_;s
zZdANP>9il61%B+w(=2lpw~%2ebB3_+?;Z_djJlDug|u1JjmJj%Ukf4)^%k3EJqTen
zx9W(@u6{e<p-6!#=E3wkxfSoS1*a`QkYL5oR0<e`8H%T+t`eS2!z$xEtSoW~`#c!%
z`z$DT4RC5S{8Z}0(kp)16JlkH!2u?27hgoiJ^(%F%3HV0SW~+k->NaQQ-K$L6>YyX
zBEwKXSbI6Cu-3>Nl{ii+F|0Yb!rjDvr!_PG`CRws7LVmeITmz&iqI9vMzT2g2%*EJ
zKv3xWLz&L<*LfZpER?#J2J;Ys1QoORecK#iK4DfL%I}#JjP2gQ!`<rO?4WznXiWBd
z>ipegyLtu2MAKHX=fZ6A&WuO#?2Cruo~>;I+l2`NNWkyLG`gsWkBQGhnL&?ibNgmy
zQX-+uYYWyXDRyLNzK9zRcVz~EDD61b_4Rk-xd*aBsIu5({_K>jVB`+sW3F6bK7evo
zgAt2=;h<{Ujlk>tx?0W^I}DSrThn;^XqcTG5?jbf`7NI~+>S_T<*!z%Y2r)QWs~g{
z3a7Wis*H<Zy|{I2wOnqsyEuGz9#nYm@3?p&y*Q!qeBKpvwO*S56LB#|-6R!5Wc#vW
zdzJ6jbv8Fg>1OH%Ilw|EnRtu?)0B@?Lp4IaTUB+^Ds%4cxfHMbO52s03veT<^qftP
zfeaH#q-j4iAnpj(5HZQjyf^qA@I79<Im_kiwG!(&x{Wcgn)Fw?yR2Q(ng`skT+&%-
zWENut`y-eJ)Z_r1%>bP?*Au)9t68+hs-QJulh)k0>t>{Kf-;559SPJV(qu@6wQau}
zHXFU_WeZ)=kT$W78`Nbp=mm$<Au!|*o6rq0wgC#-{R{VroJ8dodn3CXB)$QEd$usT
zCo-1kz-a#?IxKN3x-?o8%UT64HJ%am*Soi^-w4hLiSUVMkh7IbEKl_OVS%SFPS?a;
z3+2Z|t%gU~;pg;T`ZeW=qh>aeXU|u^qX)}{;{<Px0!aoW`=Etxa$Tc;E|6{q!Kp(~
zY1G~t^&2b~x(S3@M~v~khTaE@R=WkD>*9`T0LJ_S#cPk14m-n7o0?R_^gEs84eY)K
zsIh(vvD1YFH-Gj(v+Q~2=!w#JUDpf_@h(QQJJCXKweOfu(KQqseKD*<uG9}?l>f>n
z#EKN}$@p5>Ei5!=lD|O+7=HNpYG_sbf!v09gYo1O(9&X2Ran^0GAXLIx7wvoUbb%~
zCObBs<;Xbi#9&71>Rtz^`q0{EVAJA-pB$?JUyVeh|Ba-&R}q#2MK~6%$j2A^4Xsy%
z`gP2oY<MLaP${rx^%y^D>Vfoy?aLc^6j2JAh>~N)A`eM8;m;)fK(Fm?X7-Y;seQ1r
zVXPcJaS6#$MP>Co6$=NgbJ<=#!_9q&R$nHZWk!mfwfoERh_6iL3lA&ZoU%l63e}H|
z<Nfbb9^ZN}#{C(*EQV1lg!Ha;j73R@K0Q9axmnk4t%HFRbl)7sJv-rH<9Zkd-H4bb
zy9!9lYB=T;K-W~Gd<R+s_m9@7soc(Y0+A{t%iUG1;(KvLS{WNn=0BE(>u-@fcy326
zSNk00(!bO0QoZo24x(T;2})Yt3f26+poY)Sq_-dT+-cmwdkhxBE25iw!IIRdY=iM$
zI|%OW4rlQ2@>|FWIuij~X3p?LPi!Y!LuO^)+#;{M^)O?IuQ;%?ek-f|S0_=s7;s|J
zEtVG+TEG3dG?hKBdHJ6c^L64;=}V(8=Gz)`v6iAxk5bI~+K)P9C!0HC)~F-YF%3-X
zaZjV3r?}6%$XyGE_AR4a7iYm~!@~el&Fvm}u_&x1V^2z?)e8jg?$VAOPgCA8tp|S^
zg1+TLV!G(!z^hxj;`jtC=huOnv-hrxpb|CxP6|7Xmz1ZHw!)7cKz62rNq1P)Zx0b{
z%yk;+P18i6GBd*0#bT5R(1G1`tD{b4(=Iv2H>0hv#`~6w*2^>_+~29_%ECVc$#w05
zcTyq{0iTPYT&T<s6$`p9K^~<&X}$7NJ_B7oRf)L9N+h+W1#$Ynyptl~jHs-Hc3Tv}
zK2Bcq^QvtCb}#s_+_!iX{Pb8u?!){Oxz&n~MCRQTMX6Kyt!@IEW~^F+h}hnII!NI8
z!xj`<rtvbk)5(ovcAjD~sEIM$)iuK;V4W$n)KjgSJN`1NN9Gs-G0}kK-KTgvZ_Uk(
zSCv@DFQ~S03)1f=WhAgj_X2u<t;3{0pSWEBnezGsbKi2-tF*P#LvVNa=ct=M{W7#M
zD58gc><5+hQE~&Mb8RpVD}YL0%a1<Olew~;kOF12t2-9gHyjJUg5xB{_$6zq_$3pY
z?kaBsdVct$V@^`6JPO%#fL{m!?&7%9ihOJSlYj(8)PsXl#y&@ke<a8`jx6Gb1!Zrf
zU}LQBx<Pa&HDF790+BVJIRo*+^<)lbe~vhNd-;i{wRf%QL}i+!e-!Ah?Qs1(L#4jn
zVcumY3BS${V;d=O`wBvG5&{1CUHkc|D2lJr+2s%&IEnZ5Z1?J``>#U7yE_@T&?QYC
z1q&EiyU8fcBVX@w%N&b4f-R&iDL=k1;)sV_&ea2=e&BAK{{aQDJ5W?XCeaRbQl910
zVs+Xxk30)`B=w#xbRTblMo4CEJu5T){f11AOKZH+rPM9Iek}5onghdUgyt=;`x<jR
zjF?|OoLP^(c1)y8W!CP#Qz;reH{)k2-$WCglHBRC#BEcDzG?Gbt7P}p#sti|-)WeW
zEevhR)!*}bn@Mu(fk=8DK8@<a4CGKRqziC{35W5D#rlhcYqX4SPHx-`M;(~-s^rxR
zxJFPmL=OaqoU7<ffTm~HHzx<<p!zcnl;E|q4B(W}RzOm8W~}aI_XwGR_Y9vj2gX^*
z%X5&L5rX#Y46an%SY}fCL_F7f8CVWePzP17Vy0}COAik2=FXyrbO}h<7{2{beX1{W
zouEM$U`EXDNq+*&L6)rc&WoC6i>LT<G`%Qt+(fMyz$RRI#!uZy=9|l}infVMgm$b1
zorEYW^KqdH7_W7Ef}2UJfOOHEK-p+1Cb9J?uS7{HQn1h0$Ei{nffkO3?|*={*=7fO
z#8~%M$X_UeKJD4zpp{OuvNsR*eGqOw-)J>N`;D2Re+1ADG7U;!h|qghUpy+ac0%SO
zxK+`z{q~d?YHJicsoc_Lc^TyBP0?7>BomMw`8pFcp(auB+sWG#hg&+ZXN6KaiTk{?
zbK1lpo0G!QVl>=IJi5QaW^s_RA(iL-Li?-lPXPAjTu+2!2GO-vJr)C}!7SKfEWyZ7
zYAY0V+)>_zT}MZ}wVtTuUDx8<1#bsEeZS;A7?7*kUMI{w>bs_0tKJV|f~QT|-?r8Z
zaSD1qpe^#+mpiBIOE+z5+M>_>S$JhZid%IrP=dfySMy0AK9k6iUMrEz6#B`G)ECtS
zO%x=9%2qYuESM3^>6<%HX^aPwGa_lV!`gVp_UOPbXGFn?_w^V1ddcCFZTA<FnRiZC
zWu`uc9)L`k7rdMEIUreUeDPQj)X`dF`C5)q<sOiTvE-6AN;3N0g#YS^H^)8+Yj{WU
zhpt*nR8xOK3cI_nYXF>T&hLHZq}#og>8jBxkl+D1*|x%b6YT<yU#&YJR6it>`T5&^
zjWbsIK=$0FbKIX@a%;{cB-F!f)`CMJ@_FX!0Kp4<n$@Is-_&GSNLLzUp=+g{@O7(Z
z>U~I#?$k3Nq@gjR_&zDqYgeLq(mUJuMDU!Vl3g1*196N3QiTOm+a)8v(#I})#b^Ct
zi`F_P$RnUadpLIFU43F1ar&5%UA_iA<*rl^U*Ae>>s%lIUpQYk=bqQ0j^-C_ep=lv
znoB!2wOifH6n#|@k>~Rga+3clpH$HRb@gbxmTN{-YDm=4W#-g6!?IA8K-`iGdKi67
z_k}Pc*7N;kd|J64qG!{*<wPvW0<v-*gK~)xmPBC$$#d-u9U~KXd)`zRDksg<{pw0S
zJDo9&=^0qw4f!duo{Ze{%Dwx^Jl&z^$U$;Jt!qpNrlWt(qNYLjB=K*x(BBBqAAsoJ
z7XTjtnxa4W(Z5^%{r?9ZD(n!!;RS?8I7S+D|Nob+2GD4vN+|M=&Ir$V;*X>V*!X{8
zgRce?9qwOK0CWU*xUK_yDJq0FV|hGi#@A=er@8vm3%|`}4xKV&A6LBWEm7+aRcsL?
zJ*^pjFQ@rhXayuEh9%Va3+G@!q9zw)vY&o+bo1~J89Z_xH_@)NPJV<3vF^1ROM>Nc
zNaYx(Xf@Ilrwz&89XcGQNbD5X_{O~w|Leug1B`(s#v-3VQNpDRjDR+4)Ymmiu6)3b
z349XAPra)`b$@_#!|dy@grG!DR715_-g4GX=p}QNhfwp0$EDYWzfyJ@JQx*wKv@FL
zlbpihBge@1l*wlO-*2Yt>6sB~*AfW9A0=zgPit4m(!cONRF#7ZUzfIvtR2zsg)vUH
zt5ieMRLBKonnH^aaR&_tt93LotCp#1E+kYqN;+RygwyG^_ot;{msWGIqsGhNofa|i
z!jbQr#RmX<5HmM^X%~;FJrBmz6+;xx4JH9Ug2s$X9%6AZD^D}%@ZR%Qzj&!dU4<4d
zLzk&f8^QKbovx#teafO!P<muI1=x;!+W*(Gt<crepAWMNc$a@ARxLP_e@j9EM=Fo>
zVSB`9CXpf;<<^Nh^3tf>Z@Qc8q+=B2`2(a7ydO%d0b%SrLU8wRk^__~hSm(ocQLS>
z*&kiXfaiLhfAF->-6U~R?M^^hm*7Q$4(!CxbL(R9XSMSywrJ6a(!G3Y|4Mdyy)TYI
zob#UV^n5*;kq+9=TsH<*U+QbQiw9BNtt!82OhkY>Wx*G)9=Nj(nblIik`i@`YwZ}|
z(XoZ<T<3*xL#1P=-(<%oo`$o!qjqG2pVx2did)Xp9^BHYs8Rg7n%eaPcStdm6s>Un
z1{L1Z$>atnoRvDzHJ+7D&}{u0rQdY*IE#YkxKH8}S7Iz-s{=nzc0~)Nb?;AQe<=j)
zQbD2A1HPs%5nX(sG{=zMnYY04TLXH<c|iTiZG~Do|4o?uxO56hZ-I?SRc3Hf%}Dv?
zJHB^~zl!3ZJ!?;*61VwqvJG%=##>bqpw3>al;OR>gHirV59bf}@5~(Z-92Xd9WIdZ
z-b?L7l1-dbXDdiXK+|MnQsH3AeDB%eL5RqxnS91{5X@!V51@}v&LhXM-0Peeb32Z4
ze|u&~0YBl)Xl5!-`u<xP8CYNP@EeO;PiWIfc3OOEf%IWgw{Y@pOeL~S7oa_VTHV)>
z&b@9){_RPSXZZRdsqi6&G%Aur4xh*1T%RwKW+UvZdTGT&cCOU>Iv@kFwGf_pnK!Bd
zJy{(?aD&i%2@OX;TwyQET$HqukHEdjfjZAG#k+lNOWe-S`zrD!lD?>xL2a)z+%EZ&
zrNv_5w5ZIcbtQZCcxHdG{pQ;R4YW1CW|p-KZL{7M)~bRi2>-%)ifp;gzt`BQYjxgn
z4m({5mF3$z4GL;$=zxdi<ZBw)nO8&YQDZS-^eX*Fbk=q|EKg+6W4y4LmgIApj6OGV
zRsBcR+yrFW8^;<BP({o{8D`x!_R(}ZE|Qaicd2c0VQE)psPV@e^Gz2mFVTmrf{D0y
zICZ``XDsrXWNA0%EmU87%nqb5>VY&b>z4$C))pKAZ9hU6>5_E1XV2`OM~*UxsMSox
zbM;98k1TAeo_rG-V2&(#BA86Vofv6FjgT?m#Ijv~6sf+0p8f1!p;l#Oo$EI5(0;{p
zlAoz%NBT&?GG%$dpg8#DkeFE>C!*HvUPJxV2U}ajQcYI4Nt$KGXTkQA40~JYx(hve
zbYRc5Y&Z8{_LFSc1Ny*qaC5e%Ejz4IsG*g^1doM3E`WsUM&4u8JC6f()Mt=j&k!cM
z(2rKPL-lt?`@4EnIW}al%u1!<{DmWBOmU0k7YSXs!(cXa=0!oe$AE6&2&{HmrNK7i
zbHGxyKjJ3#mk4i|Ghq8{sO`74KliFjTQF?O8E74g*Lp4D|EADD<l<HsqV5&<(w74p
z$`-D=Y4dV~+WOHePUd#PwVWe1ceoS~DunOv<dgk9L2-5trLnCgOyfYWwF!l*UaTg$
zqhMChiE^o;mMYjq3;lwXTglwYQ?8sIGw+1PtkBwmzi^_Q4h4mfw*hU|#Q`(gU;x3J
zl?YQI#0Yg|fr{_`N~?w)9NcvCjPVXIXK)YUs&*5X_~=n5TIDC+5W8}co{pLf&Sf<Y
z4lumkWhvfB@I2n}5(r2>d>s8u8x#0cl1N{{nTpe=oQz{4M5|ULFUw{DG1p|EVr^3|
zq-iQ=FSu74!WsC4k&)s2Ev$dKk^(fd6j?Tg&x4YyO~eMFJ0GHn2RWkv^{LZ(f|A*Y
zVdr$ZY13rwS__EV`r!oWETg9^o_XL)ZwugC+$t7Jfj<C#4>^6K3>h_cV@OJ8a}_vj
zVtmXCfBnYtn<UNr4X=KO(CC0Oj9)XSyi~HIwc2X#P`(UVX!K31uxT}aH+1G>V!RN3
zKg%?n8MXDfX2C7c>U-v`hDztB@fY_qZb(w&BL~0mn2&aTy+~}ZXI;VS&G>y&RHyuj
zX01NYN8-d^`gcc4dQ?xa_w;>=O1wsbBM0@ys$2`=Rq2f9`Z^n$`YFW>(A3dTMr4v$
ze>O)RoO@EQv87m8z$wuGjz?yiwlmd)jP-Zh{9ZkwxcURjl9*+_JfucEfA{kME>qQA
zkRp!2M7vMH2raP|Zbrn=ozpv)W}a;YJ9)el($rL7Ly_6siiHt3U-Hm-u3QQqu5)J|
z^KUA3jBorc!<hFvDf|~&#A@M;;LF$;jlMxiJ+S-mdGg@gx6~(BwQNQnc-!+&jBI3+
zZg?@YfW4@CF4_OR-<w+7G=`i2_IJ-B8aN^ge2vW0zsmNmRRCFAI-<rQJT*5Pflo4!
zt$YWJD1*M>j=ZSPn8wK?!_ExHNIDwNG_41w%&L-lhFRyIFoXoP1j|xiExDgoN$?S{
z-M$dwte%AZo?A`<y*zXr9XShHX%g-n0_4f*D3@d`H<}t08rU8D(Fzu+GcGmZiQrXb
z&f3D+AR<QBd~HfhH-CI0WSA@0>VJ1SbLZE1!#m?CNt*b-`Mp0<@INKo-;7>7zz+VY
z;r_Gor|h%R`I{yD|FvYkBKw<2{JYCPV*s}Be}v`#ZQ%bz_)o*1AwbVRI_$r-<yw;w
z8aN`n|5?+Z`$t$V!Yji2AIbTjh0s6D9YF2<o#G(ychJM%8~y|{{CDIZUH6~*QCF4l
z@6ms+{8Lc=DJuVN0IE$=-T#!L?;3#8^Z&pGBaE@}4Nz)MUn^d>z2U6qj6e1sEw#VI
z=<G=uAdb#`=gzFz$+gkd)uT6`g#%EJxZg8oKBRx*jPs3;{xqM?A=tcLSNs#Iu6MR%
zMJQblBo?RP{?Y#ULW=@5qf}W=%IlX|ab-Ums3LUW*NFp_$9zMp>tmLXOW>{(aBE*{
z;|G6mh*C!8XBXvdRy$t7WA!#L{?HG?z{~UcwXv9$dXc#|DlVZ;CbsydXgv7ms@8Ab
z{$3v5@`Is4)E{5H#oM&@l+<<U2#dBsSS@R9+V-S>x^v)9At}$slJ)f6@p)47fW&~3
zgk7~ApUKO2t4kj}Te5^U%@(pwJVa+7tiAIo=WnPDQE;!_4xivmudRkkPj|ZJN0Fme
z2IR+*KBpMAUFn^F_7|CH9X{WCgLHYKk>$E{_tPr<5WCQfGAq^uW#2_j58Q>l`sFwV
zt)|;G0;_gV4Prd49o5HTZyURx#Myq(IpFMD2#y*2Wy5fOUMI{jAuLg<p-QhcPQ?$o
zllCZ6duCbq-BVnlJSx&1gWG)#75&D!GV3E=arPiNzA$TlSoI0LaET!loz`*Gm}3q8
zZSQ+*075mEBUOGHtQ{OAbu5k6#!CP4S9&O-5{Q8Jd-+N}9*-XJN`Sm|N^MfA{0Y6M
z;%v`~0fb4hk1(+{kj_4a!19pd1>JD}0IqDVErtwB2^L53t2e}-cZE(>O(E4HA{%M0
zceFR&Z_YmvaN5=0xRKgJo0L_A)X2U=G*qMg!uC4atNlwq8}J!z&M5HY&UqqsF!}c&
z$>c$u9<?Oj1Y^>uiC5%ZFrZe1HkOobWg+`P$#tHz_VWkHwz^uH-H4ZSsHjLe;vIXt
z^=zTx!jH%1y|bG)^bK$z{e3F@{#OWxyT8E7dgt)&U<8Em9E?$0^$4CCu+mJIo^5iE
zc4(Ux6ZP7BE#7@R`aSK%YU+UeTt1}W@7)tBR<LL*@|7tD?G`P1@PrY>UtY%l$n&*E
z=oGujH8HZ=&6!~p=oKmCo;aj|N(=U(8COm_t*<+&+Le%CYdNufEH_f`zU4GmG)3~P
z+09d(Zen5D?^L09>4^5fa4a!Nt4Ar}4YEDHs5A_?@#c1@y77!y^~7tLF9t83Ci4Xt
z#bzWgbp$ELat2R}TU%RIiZlq2Jhgaj*y1$(F;E#c74@S~Cq62AlU^!!zvIls-@{|d
zbj#TuXWQtTt`@j5T&T6a^B0u!Gi1G&6Gz3hHvT@;rsbx$4&7^E@5WNxqcUH^-IO$G
z9WJegyDltV`Vr3nwH1yCyVAo<p%i*=6i}>oU=EIPtd?83Ei7I;OY-MJ(72vRvmkpT
zGkzuRgf3Oa#pCnY3vVXR0#Kon>9qKRGvfG+CxX$2z;nAE;FzV3eX2C+7xY4CWhnW%
z3uS45OD1h?^B;29^6C58bj*ci?;dqr{pQT)pa3RZmgxLGFQTT{8!m8|7@EC$zI{q$
zYg)8smXtdw7h&qx=WeRgh`ir(L7#>0wZw?5rEo&p`t6u8m7%B=B%6_@SoKr05RZqt
zkQ3q$9z4%<-v*Q?b#0`P{s`CLs&8mY19_}!=b2<V8y2Tj-kw7jWe@*AYHu|+C0laI
zY5G$PhsLp)jU)Lhh6_!+b!L4M_CgeTW{(>$7vr3hrZ&y=FFNwU;nGLj;oKWB=zFQ_
z`SbTi?5@i`g^EsDG)7$+4${3<e6|z~Yo2EkVdl{gxZ~)XhKIIuLTMp6ia7_a@2?#J
zGU^L^IxMw!sf}I;@5Wt_UuK-ve0Td3)f>m(4-eQee5sc#s*W+t#EGUM)(W~j5|&+W
zx#aFjlaMOu<5UT3`_0HVEGgaFm~7olI{)h33T|~jH=h7keWCGr-2!K|-3#<mSg@D6
z%qM~{BB^7-pQpsD(6qCnJy$W|I%v%=H+Lpr0)=l8wj$H6^^bT=?|_&!hOhEp%v{%m
zaRJy5=l(bFx;?ecb){;K-51k5ZG=?j15Yvq!k47#QBf)HeS}W&kcj17Zo+AhluJcx
zj0uKA(6FN7wki$<E~19{fcH&lg5OF*LPFSi@-RZwy5!ov)HTyqR_BS_^<0QsMdz4x
zFef)w1=D%O;l6x-%C9z7mgN?jeLsml|K};1;QJ=XA(_j@S#69v9=#IVNvO<;wZ+V%
zhwWMV1AT;H3y?=<7Z);h@}L*w!gbwug+Bn9DjW}LC#rBqMFqL?L&RKBi{HNS1}ebZ
z_zI0|tG#kZGHpsn4qi+Kel;`D4Rq;UX*lWyixEKiQJ$r!b+y|&;gs!aPE{c1=dZui
zN5B8RTgdzVKG9Pj@0Jvu{@ELDjMjMq28}A2TGQA*KmV{sdI+nwI^^H5@K9IZT<H5g
ztO7YS82L$db^Ix2d3oMaWZfd;eH{s2<Y1b<Lf%%Qa`*^HFx4k}yP+1l`(yXVf%|Nw
zd3C>uNc%!UgKbSUw#~X}5y}drWN>1@z(uMJ4LAlEM5&?*F}<cYD-&mOg}!dS+XI!}
z)bA@)(_~D4ha_IPsGPq>*G9s{+*Sx-E7YyKaL(!WAV+r!R7U(Jg9+Vxkm?Gn50NHQ
zi1{!2eptt%CV5$=YtElDmSX5`YHCXIiO>#*4L3!n*=0Jz^=U`Wd7R}HLP0C@e6uw~
zX=S|tIBCRMIZLN=As5%wF=3*R``vlBuRq`5$wr^*QZgUHlq|Gg93Yz{3BL|eZdM!)
z=-+>GqljpV=mZ}{05<%ikNpL^ab*y*!>7vH+pX~+;fc7NE$z{$o9@xj?PPE&8W3IZ
zqPbPW$uSFnXy|d!r{?1ixn!drcSq>npue_$m5(I*qSQ)jXLnyR17e)m6zP7^adhu5
z9BXKDE0d|diTCaihWC;Jz1_!21Qkd1k0oNmE7c2JGd+Mb*O%H!EataADX6L37spRN
z`#p1YFKhycLt;cW^)K;Yh6fMw<k0nF1^q1-_8L;RwOBQdPhAKo)>G}vK0hoo8uuPk
zsb=EH*uLl20PRQDp65)!$+21};@*%^vTgHr^x05jjBb#TMvLU&Ef-C~_q6vQr_!fq
z5SflEWsG^>UpO2MoGHO)ix<IJF;c&U{jL~D&n=#%zRyX{NqnV%oBm4MaX3<GE7pMw
z$SeY43sTkBQm)@o68|=^e`!7hm-&OfU`;To1>kTR#So96)fDo*I3O~KKJ%SO@k#Xs
zxqnNW+lC|og_;nHCjsg~Z}RF`b#W&D-Jor6Ht+K1&mWL|dX{FON(cpAQFY5St#!WX
zWcZ<%-)GOb8=RNdM}H!PX|z_mM}2`UaopDkO+~U3>!8h|$}mp0uNU1~VGWI062y?i
zxB4-1j8JFWKml&SuH=CaYn@cCVYkMmj>sYIqf&r5Hc|m>4LNCiP+(h8D90D^jVCRL
zC(q4>vf{WiUf#a1T7R-znRNjZjPy$#?Lrgyeq(y5Y|pPY^x|yH{Y*zl{_U2T{1-^6
zW<f<-z^^l{?|F=<xdU1cq=@`_UjPSQif*zWIP*&r+`8_Tip1+?1Se-;Aahkh3faxn
zsJD<>306*m!K3W}M!D%buutK_4&Ia3*}lw%wd5~{gzrh~2dX$ztx#iW$KWhKA$xkL
z)3?xvv6@jPvQ)#ZG<xi%X{G_0wAkh6fzM6>U-P(YL8~K&sZ&qioWHwHA;`Y5TZ7J&
z=})aq_zxER2NeFN_$H(?9>@C|9M%N^t$$YjUii25ze51{_`ePRgC`qL{@e54_W`PV
z<H>(l{yXGPuYWiG4;1|easKB}{(aAXF=^oV$U*<p^Z(uZzdHo}1M`;uqT2sGlK%_f
zH89`#|AOfMpxHA3n*DDM-hXCM|4qpQ=2yRy?c?)=&|(J~)IDNEBV?Gs9(ki_MFWXM
zg`Av;1Xd~E3r@F_6}J7Z8$mbR(@py0l^%nHFyU6r6q<U~zHjc$?j=v^E`kl+$7MZA
zwoj-}Oo7rSQwZea>=}R;fBy7Xhrc!&))~*q4wr&D0YK8qtL&QG)ob!Kbj*V3oY(%3
z&r+AKcWtZ}7V7WfG7-q}TyAF&XqzkV6ad84_WDZlUpN3Y`n&;6ohW_%00N(~o$>%u
zTrkkKpej$X!o)T$@w+mv?_+Ts^#jtx4ca02=NTAYw0eI!gu9!AFV=YW?(4-WF5Z+M
z5&9Hgq~25t;$yY7u>!}@V*y3Ac$kDM11u%R6iI}tO@bQH*HqIz45}`OxBeiqro{8{
zValc$6#k(5mqswGG^w2{bd4T;R#NXK7PI_wnNsy}r}LF$%{o`Q!oycoAVsHaGxi^O
z@xRx*R$%sBUU3`(4XD7VcEc=0Uf~w2w73CXV3=`M_+3lxC+Y6xd|(bj9~BB^p}nkp
z)*D6FFsWJYlwM^b5Bh!VL8_J;eSgET&3(|TmpXX5w29st(Y||DLP#-$!uh+7iB1=V
z@I+2L7{3cka=DW;ILO=mfFN~IceAZPhwkg8`0Baz5`+~nmBDIqkxMccgFw35DW!ey
zgaYe`t{!{!_6IU?!?X`1#%$$$?6~YZz}Hdst2PH~e`OOk7DhM=6QjhW_m6j1?9eta
zX4dseO{or*9sZ~*yv<UTkabn~;D@hWaX8v!?Z*cc7HbMe(|@$PeI>s{`FNPJ?IDIt
zovJ9kf&X^`w0VrKN+I`}7ZTgciI82L8(=ryeu$!egM?2XJf-a@O8w>~7u~9p`n~LX
z?A0*I&Yl4#>q-L(c%Um5Tsh>>bOG70#pf3Lj>*=Qg|}|*Q;;1pE=Fj)uL*IcM-v|~
zUp>-tM5zNGlmSi+$>iKm^6hK&$k`>Ucp4&;ZBdiaKJz=E;YF1;p-vunA&lc@GMrFZ
z5K^+;okxV0l25MlxZQj#qkB6O=cV)Op?KcM`R%WhulY9}eHVB5i;E=q0prSAXVTf#
z3Nxl{Z7y*m>CBdD)n<O^4fmDi2k-A<4GuK18$K!tsFJt9A@M%CU_g(sx2IL;$^>vZ
zFrO#p7M6GI#cu&V5GC?{dB5zMe1Uk9BTv7-a8{m5&N0+WQB{y`i^h7D74*ut^4D+<
zE-Q~KbNouG1UIR;&=70iXC2}&eb}v?NP|0Qr`*8%QXyOC_g^@xV}nV=NX>)-#IE`6
zeq;#7b{iJSoXP8YK|}vhd|)CU9$xI9Cx)3rjddZ)$FZPl9!7LonuQU^^Ju1LQU%f;
zQ3Py_e}34q#37_0&){PEVS5Z9L$QyJO{#^ta*rdVGdwT0WVEh|wSR!daC~i!BE!V7
zN|@+!-9n7Di7exIkLP1abzxBlin3=$cWX8myPgHd+f<3B=oi3kXT#m{$=vd3PLC)C
zgP6w=v%i*q%wBN#1sZ;_m=KpUIdR!kF|yZm4PMScD&3p2nb<tpue}AL&3Lw03ZKPE
z=`(r9vPhRM?OM>j2bkL791u>!bRD!Ej4C&fzSTC!$8&K)drL|XM<GG-EzY;~5&@p&
z-WR9tIw#e9$g$ofa1W!hLjCMhTbgeOfkR%(Tk($uj54|$R>Zpo^fk;;E(2n*b}G|6
zlTfkB;?aG#t>2<46e*k+6VFVA;d|N8+AlRJdIjw%{VMFrj1XC?oL<D?SDKrjM0pPi
zGQD_ikw`MlM7~tph;Lc1jRz3X@W|K%%3XQ;1(4{+Wt%iD#XL}^cmPH83n~y>Af1o+
zmR8xMc@&lnv;GOIGtrO(u6#e$mlZH7-QOVoJ(Zh_tFb;(A~Bq~W(4@OH|!Wr!z>-N
zK8z|qkmB~@`y$HbL7}hr#&H*Q1#qY!pSzd4ikg&I;!h6vkogh*wZw~%6CmKPRphgC
zwwI`?)3ZC0U+I@ghSuq$QR)5a{S!c7e^lRFO#INU@%1|m@`oOG6pPyqO@)W$v*j#o
z&MtLMRG6U-n7~yb%xON&?hYlkvfcVoiek4)yRr1sLb&$Ms57K;-8|CI0FN(8*#E)d
zo$2aBPJM5-G%cwKE-q__A=WQc-e;fH&Z(Y-P|~lh5Z?e^d8A!R(ZYyNR9~RXQ{*m!
z-&s3#4o|geH4#r!+37JR3eBwzL)*o!R^RV8{FU9an|XJO)MF$4z)<JObuO!$;baUB
z8+upZSmCE!Mombml@NJf-o0@sXQ2%ws&8&$=Q6a62vq#QDE$?&4`>zlTa9(M3Ih}u
zO|^v_>B+8GvPG1oX|r<(WKiRtYghCKu|*_nm6dM>G~03{X+UOSSE|^%DC~tycK#b~
z-2{a=k&+~*)MdH53+-Pk(&!lQy?^_5$q}_J=?=i@CKW{hHlVSvLX9eRlLxuqbcm3X
z_)^Xu_{@Py-|ZOQ?dLC*u@y#!`C~*wQes=pqtCdNHY9=u1h_I8C0tmiwJTeEw76$G
zB-8agNu%i_kY03<@a|Trn>&D1B-lS1E;}O7_3anVE@+=f&)1F=Q@hIfCf&vgVq&V>
zmZQpI!TjfwXwKg;Lxidh8d%BM)-WnDq`?&ccyEg}oX$0j5EUDz`TAaStDY60<u>r<
z{nA8sn_JUH=3FGLWnkh5wTd=WvBOrqJKGt#Ckc6_ogB6#tl|=c+Lv_dT1aV|YIOg|
zV*b>)tqx(N0nrTu9s)ox=~lhaSLYRNnQ~bCJD!csK79)cByw#PYjngQwAzg9-2Bl|
zYol3F!tgsbdq(%7%O1opht@n!%k3R`Lf#f;1h;XCGK12iO}g@Lm9#XV8q1nw171nZ
z9;Q(Is-8&n5p1LiUZ0va*>v;^rl%ip%fHpmUb!P*)8t$}@ZuD7FaGz6L{8wV=NhRN
zctun}Z0FUrRG26b+APiu$xa3Ms#o|v5EL`Zmb_#l!dYFvvz|J%I_VZYTA?HK4QhlQ
zTl0#7eeh!sw@qeU2rcn@lxBqE8Do}YaW5QkH=5y`Xw0ghx%L)R17#51kgH%f=MV8{
zI51t;1xE&IaAgE?QM9n?oHV18&pxaI&!41*b1mDrEz`}U9q!INN+IX&=gSO!V2PJ$
zk~%cB5j-(`L0&k?4}?Wf52i#bGt4=owqUjWln3>K`t<CRM4pl68iKDcX@n;H#cutw
zQjQaglh(y}G&DQWN{=+(CRt#$4tz+ZDKY()*h<dAmX*#t1Eaof-fPe9zWxw3TO%q~
zq?!3(S>UeZKz>l6XayV9#`E^5?)(Oom<Dq+Fj48eB^)Rdc4ry@wuYa(zCeB)WcUk5
zK!2L4>-pZ3av*_ZPe-TLB@kR@r5@@eIOg>-fyakyxK(_}AtX}XG(Ix&Z+_tKc$ohZ
z1^==D|AqAb#ryvQ?E^v(0PFup5%M3<AL#MtJpj=EKe;iX{{%Jv51{`ijrrdQ=Rcv%
zKsjoKBLHmuAI$%sc$vQ=oq?SY6#s{5(D^@>#XS4RZuC#|G{HX$|HMxJF-hS^VhYjt
z8W>a5NgwBJsOs7aDRMc_B7*fGjo-II+8ni7YALQ$;A~*{EsTq7vSI)^WCf|WfJv}=
z&g8n${(H4?5cTFRSHP*6F!3-BM=d&h^*jPysWI6ujjUW~mP%4EflY728lPDlCFOV}
zljr{G|GW|_SPT+uN85e<#7|a;^Ae{tlyDl8b>2R8*p3?lFy}eF=LaGey&;`K=GrlK
z+p3+8^oU!^=r^gtPIXJW;Qi72#$RUr_Vk=U&AM$uzY6n63l-8ViVcT$Lt>0cl={_c
zT(iyN{Hy^6f3I;QsMJ047_r#%7fyi1bK~S#_75QXekd2l%?Sm#MpIA=Ix}Ma36xa#
z2^%h>G%xVj`_p7x)1<j@5uN-!ujFwxPVpzfCv)d7&>RV<h4TmiH)<NlN_CTmSJv{q
z@jD3=)H+{aZGLzd_x{zg*+jEHYex>}Xa6nx+sYJJehiGgA)Ho`w*-^5A9PFl?CWDR
z{xtWO#ZMRApT%8<RhsnM*1TA6MrFl5uORlUd?D!?^&bv4Kn0?$i2}mT?=ptBDHJ#;
zJ)q#aufPS*eP#a34vM#h785i6!mzoC<#81^)6K1+QuYV6C5{*sRLx3v;|kRpD(`(B
zQ$wcQ+LT6B_%qN`Z$a(5153lJ;xAkRmB1y_Sl+cHu=S*(Zl#;qTz2EDNqD}$u+E8<
z6#9L!cnkBxUpkE>Lk|>9w#YfNRPdn+>mg%tDr_$tFgebvowvRrM+T>bz5GV3+Y%Cp
zHLlo}okxhlzRZG^!+1;pPQ=$A9-Rq9M*M~2U<>YECP&+2`IOne&K?|k)p+22y_b9a
znbuCVfXMqRAH^gEs_o(>Wmq&;6+?(JN7j6%sz$SR%bUOPs-7FsO=x?P=8(U%ta$+M
zTSv5o5_iLCP)#vNRA8(WSWot0q)eQ!$C~!RYp>klyGBiv>8Z)Sqsopx9|vQh=BO;g
zDX0WvthCZSFu2cP-vXIQV<AkT+GOaP@meO}m{D$B`nM3;Ypt`dmILc~{pn1FL_51C
zYR!6#(mlH~hDkEzR&l%JgQg(E7?RYg>dj*wpB7I3+G*ex6ZRt?4~mcU!aQ!LUsdAN
zm>obh1vGm13kF3|e<}Mdix=oI5HeS=V|NSH7+bx2!voY+)*|Ni;*FpEDRk0pbNq#F
zf9M+7H{<gCi0Az<BW7l7bY+1RN&E^f7S@O0OH`!!1y!hUZ<Qobz0K-S{~`^cVMDS^
zLnfI_q->H%dlXI)?qdJ*0`TW1`vJacsirSceVH*D4X$T730dFY40S(E+tPUYB!5jA
zcIb;G#Yp(BU2F9Oa*#}HO!$Y49gvT3JCio$oyeU43V_*kl|D@{b#H#X*#6P#b-+m9
z4L!zV?V8(sD*t<98*J)RJj9+bkh_A&BvMoDNJ}P@J|#oNrSle63P9joI}rh#baoc=
zyVaFex^nHV<M8*H@4Y%N3e8uxaNo*`9#-bRZFrx(a;}UqslcSk0+yRV>VA?M7fW>}
z^M~MXs*+S%X*S>HHidgzn6GhBwfk9X>><Fkkgi<=UEd=w8z+nfA%U6o^OiW#qU4qR
zw>@i3qE5o-k0sjNwN{tQM?D<$a8xfu@ItF0Ull@FKDA5$Ho?Im!4}AP;80LFm~3ea
zLv_(!rl_s9t7lkz1N<dxyS;!+#0DaLzIEtZky7iMzES3@B$>w{%|EdIat0Btr7?bD
zh>`V!{G`J>^=Rj_*$>KjbIG?iCkQKEGYmYu&oa#Vopj)!xHAS`i3vh!tx@;5)zm1n
zU{oHX7U#Nzk1efvjI}>)2t8npPagS5)sqXr68SwU2_i3mM^UtMl|YiM#UDx9E%1ER
zq&BS4T%~?VCE&~T6QJbIH@t{|3d<mx8+F<k91~jxS<#Es{QAt5$Jbvm(8(`cz)Rsf
z&Fvr8^V`z%Sm*kNsm>P$^UEP5G|QkWsQHTlX|l)S-Ors;Qr3(Q8vK|a?Ahx95t+pp
zN8qPhlC^4&(ePWrX!(H(o9m`-MmXm^N}>~rQnivQcE4MQGk@bNuZcBAr9_`4g@Dld
zmBrS!dn_cmepf9|&GV*h2`&3XH8)Q1_+Q-qNO4;DUf53x@O@ASZG|T{&M5<rtdm7g
zfsD0cHyNy2#jvo+!=FO;gMaI*Q$JMaV1U1`>hRL~f~HCd{j^&bS9M16Eb^I3Uz&i~
zHRTiA_t`DT6_y54D7g4nBb*(zz873{==^1Rz3qx-=XKfL)kVG|RmEEs)otvOgwQ3F
zLf4Hz!_13zHRQFR0qak-YIlb5$61dkCC`Ogxbt?ZHWpY(pAmk4m1%QKG&8oiOonQ(
zBSqEZtSN-dpON@AzrL;K^W?jeaexq=De==awL#VU>FL(90WwxlJ;K+dUaW0HX3}Kj
zL;bmL*yrPTE~MRyGg1|^0!7U9J7^bOgA;Fy{^n`?@Pw-9-5uPsYImW#V|gmh*Vfvt
z7=bkfg^=cFtuagMkeRvf=9X-4&E*KlfC4-wST^nuYl{{fg}M>PN<W_yP1=O@zq=0-
zrt0gx<2K|a@D}?D`q?`fc21Rxnp!(dtp!e=X)(mhpng_z`@q{;Gkr@{J$LsLw(D)s
zRwbr#&80V=b*UJ5NF-FwsbWbJud2SM`rZUqp)O4+uHWN;e&s{H=wPH+4=2eOii0{f
zWgQ$OOjU6F(_P2$m|;VIpUZU7C~~Boj<`n4eE}ubXU}GZwJ?ZYmdnzabII<}9g<cO
zv1Gn&ftNm@OCW5nD09DQF2%D26S@i>qtsems3scLBjYgc>&kaACVlaGVB7~Zw9O~Y
z`5Mj!q3wF^w0b}`r5*B$AjONOu$gTwr<`NHX!l<3;K)z(5sTf<rTu}xDmYii^}w-t
z0;X-W=@37enbf#}PQ!grTjZF@Twv+3^eidH^j&08$nAdL8(vgkw4yVZJu5*fMDHm{
zjt}p&fMjLxt5syfX%Z(OI9Ui~ebf-&(=!pEPQcHdEX|&wiNmQAbC?QZkv_hjO)Yg-
zfqj?F8t0jGyP-?AATRS0)oja<tqB%4R#kpIH%*^@9Z`_<67$ZY_quAF+$8Wz&;U+<
zUkEz)bKHX;lD?0e9o)CSufRMKI4Llevwl+zV;JqKjcHL9-ZZASl@+@3oEa1L&sVX2
zV|Y~>s2hL}KmwL56QoKULv~(q2}taxL;Nyg+4}vmq;t|^kCy2HrgdU`??doThnD`-
zS%^Txk{LpwO*dMAN3zV%UrAkH=x(zY5S@>4TD>;70{3z-eVOtaSgr5HtBPlGh<@R$
zM$E)S?_QG0J7}G+h{<|9r_AiW`~dR-)!QE|y;(gyY3JT*R~X~1ROTdXG{(AVuMk-%
zW)i7ob>4h-fgbA`Nx7~5^u@-^sX`pXPl|oFI}Y>^HkVR%Azf392r9>BmS^rPoOEX{
z`1OxxX>KCp4axetDojp!+tNGU8g#dLZrw?K&}C}MWNIjmgZ~NtQ?WoLUL3%I)!S7U
zEkl`6xv=U*$uauRT1mFLl{|?|^t%$LHQo(L3P#t}MevS@dszmkb{bU+{JQ0>C&Kr~
z4|rT^NY85BCgH45<#E^`S|(v_RC&<s<yy_B#$>rS;T<Ps#Cd1%R;u{c1x)G-N0!Pi
zk?cK(lSH!qKIh8=3K0H-Z=c7^#t#ZahGu1MgQQ9nAoE}M`wbZspQT5n+e?RywMIwo
zt<XBjN)YAu2M$Pd_^bj`(LCP;`cv6AP+8#S%CM7CfXUZynt8$N>=L;poq6w>!n+Iy
zO*Llvft?k?8yYv3=*G%ojDk)>M}4Yuq-zxt#O)_%W=8&2?Ux2W?D>1?awKrkt@X>j
zzpm8}_M+2chj%KS8moF*nrTfn<_nF8{OFR|pps}BcUo*WP);d_%Ao0%*&(7H#b2iJ
zV0C6mMaLV|ksldWK3;7r&U7*WPCw%0qIi2ISBBt*FO+p1eS(LTbGWS$2OrIKi(C=<
z5hZE`zcRfoep-tTeTv4@O!!6jQeYUgOKPn?q~c<04T59jR{tO7-a4+yw*MO+0-^#U
zNY_A0q@+_2krEM6X<;HFF#&0i(cOXq7p-(ir^JZSNSBNr0@9nvm@ww=#JaBQdw-wb
z^Za@LvDe_N9h_{(j?eq^4xC`=Qi`?9=WG}Cdm9*h>AAp{dLfif3)R;M>DbuNk;uQA
zdSE8GOsDr}{WN>c)BNODo0HUVcEJ3FXc*7n8ivW6=WoOp7tbl%u{w+OC_gg2F2j8a
zD)0a&iOw_z%tgE*?aX>B`^!lwo_3c!0mHZtolcquZ#A7C>bq5Z@~!rsOuquVHonhf
zk&1Ae=c$q2eTfn2Sz_v0ye!L#iRV|)a?jg<)R6h<gsjA%R%dRHr{06QQPz%RU!vwW
z>v}A;)^h70RSDz))<J)ozfdv!?9uR=;FC&?3nmrLiM&^(;x&eDMYj8%$CEEAOXE3_
zba^lB9aklrZbjifGlg=WN665QPXs2+ep^_&6PGt@-NIbDR;S6+IJvK7W9X-aV5<~+
zi#@F_b08VHxO;A$UH&*hf$PoY3zW5(=A~=7<DF8G1;UorFSB2=UdXW<y5?mt<;Kne
z7^4D_%WmnU)i2&v>bO;O74aqNo!jLgUVVC(h_8U|l`Hz7bqdZD*_QNz@^u3(ndr2{
zS*#03Vqf0X^M+~uvtwBQ9*;U8JRpo+CJ>bh6T);f+^LhsLKoT!Z60;$OFFXmqIhb>
z**#>|W0k)SIQr1woEITP0P>0ka_&-89zMD?iMb;0KP>Lb;gzy|g?9|VE@r<$uu0Z$
z#(kLQH&xX`OYo{ha53LPlGwTG^zzdLcnx2e@Yew?>|6AG4_m|h#@bQIi-pxBqV#2T
zTc{gN79V==`WBSsxJEN*V9uv2#+FVa3JhmUryr%0#MOVjGJU#Sfd{?UN+2<sY6I?c
zEH=$EZ=OdD<}!<jCwruQFQr0QE<+W=Z$Mz!Z8uX|$#|c6v`6aA4k8BWYtIK}*)r$G
z)OlM_9ESYGO<#B3KiBUz=vBW(-!6zaroP1XWacJXhoqZ<s%oWLNLEA(%}Y0*u(}I&
z5Q>zp9MhHR17V|-6{fO+U$tZmG!ix6wcm&k`jmQX(e3}G>dB{=>LvMefOE!Bkb>(w
zoK~w37(Eq=?CV-K!<gk;(ZBTur&30|`)jr^f#sttc_MLv0_&93QlSXyxX2}y@_q*z
zmql1mes8oIFfZVE#%lg$-D{1<;w=<T#8k$IS-VShej;D_VWRF!n@ldrdC<_Bt9-AY
zIw!ue7j4Q!ZE6oIGUFA|?<NlvS<%}usn@bJS??*I;>ywr<e)h1^NezKZ@$`<zJcb=
zP^hA4w@oP!-Axsyz-R92zIY7Y(#4H!#n!T{hTNT@BRlL4mVI5ON<t&P=M(VRI3%v<
z^Q2s&zo7Ga-PP<F1#Zu$ms)sd9i#N@SlZ#tXl&vkdvNZIq0N^htGW;#jgP$t{g)Ye
z8rMp6-g@||pu1ApqnBpRxXds{iYeO%$c$Iae$-ohl9u@*d~gF1^$a?-cF?Xw<?-tN
zSd&fez;dJ=@!eMj;};Do>nrOL^=%kqMdu&0#ZB#G__;_PlA3v<9D)`o@RkLX2Azsb
z<>R~8i3d|iZ5Yq{r!tvuIb9Cgl2u#lQKH5xEjf?^b+~yJ0L*zrA`;oTg8DtAs_z*m
z=Xx5f2%dW*n8qH+R$*3y>L1{GaGa~iRu{Y)f;yy>zh|es_y|{JsZ$kdxy;hk{(k>}
zZVIM@GbC_Tp%tT-yvQ|N%BY};21)cCg3lvmOvJ8m+{@?4Ok$KRQ$^<^GEaHX?Qo;r
z0<E%}=M^SvgDtE;pH5vLBr_jFmLUbaKNU1)^5J>Mn*{RkOt?tPWuxt^39gpO)1^ry
zXN?VdND;7Zcl7>%a|TBpy!JR5POF9b8dnW9Rk{62PhVeVtf_0d>Ac%FRrOC~GG!H#
zEx-+F(k!8(hR!pN?e231V#7;D(h@!!#_d_uI!A1me%&NLVv^|JwB8Zo(Ggm5rDWmL
z&edpRA8#(2m8Gzj%p{weTOUTwe;jfat1`Nx$<oN7^A{rEj+CoF*R|qRst`H-bZLJd
zu>qk5jj5EiFq(UP=l5?cDG!;yg52=1Skgf_oVFDy227IN<n*>89t@D2i=o}WtA5@4
zG^tCX854RZ9qMbDzg~;Q9_CaIxiYI2RrM<!PQ4`B6aNmPzUDPv$Wx*JY;VC&OrnJZ
ze__WRyp^hq6MRH9+Wexx##le~?fN8AEf&g_5S?=7Z2;X_R_i8GJywuBk--M{&W=O?
z;OnDu5{LHV@e@V^ptK*b)Zb{-2_p3aU%U1D$lpZU+^iD->(7w@(e}?Z{?$PKbHx98
z@e_XTKaTis1MGePhcVXKrvQ(jso$;fKf!T-qU3&nmS$8%uqO>bDd9f?KkebHt%W7@
zr5aA|GT+G7sU1qPeS4iVC&Mg4qy5w@Dw1fI)?1)e@gg3Y*{!IA3j~~hk+#-wZnWf=
z%fU~?gyvIS{I~6w1!?j4(1&a-!a5&Fy^f{)E@#2namz<4Fc?mAS({6x9Os$4k)j?^
z6IN|UzrJrlTgPxwZB!(kG3=Ylnb}WY*{gXRrMwZUjy`85noQjnH?>Vr`l-;RZRoQS
zPdf)EVY|h1+tuMcca^U*rcuzS+omEGF2Kl8n}zS11W?zcjq2-q<K^Y+?b$$!JBHI?
zYm+Yr;qgtxOFCV}WnqAViNFuLmZ_z6nZUMSWYjI!V_K>@uEY8C9>}y&)bEb7**C!o
z<%>h|VarkUPamHuV2uabE_YfLfd=QbWyon<#SRy`w$c3EwYM{3)3cq=Efiz8o+5o}
zbPREkC#xFd>le~t3fg%#b$b?;%>$pVewbbla-;CQa^1}(!Psj?-bB6SeTIx(whGs+
zEqcl8Vulrq6wWE%S~`@#+v;6_mYo=_x|&-0IYW{#&EW2~SJD>z_2c6>da3Y;Q(Eb5
zm5vbrO<{oUgGXQ&fdZZOQU#U%0-^4e9hUfIL%^9+!Te^_d%S=fbW;GzH(n~t6)}4G
z!;rWP^*dW>20@Q=WU_;z0~|u52K+#;XU!jIpFjI5g41x>-4;?No-y$*6_In{;>?b9
zTP1NibGnHO8vzKJ0EJx(l@BdUBAEl@-XUaoBZ=l_l~7)?Wq8@z$8Y!A6|MxxS5YK%
zO86Z{L=<{@S>{gndKW&-t*L3)iML7CrBl}j!r{H9l3}74_lPDFZ&a`3&{m;Dv5@ZD
zk<~Hb$<G58E5!n{c2BAM3^S8ruG$z<8Re8E!iDkoF|qBw(Y}<?Uq=Se2i+GnmyU8o
z-*{a!(_NkZz_S$5M;G@x{>`abR)g{CEh1GR9*&<#J1{E%sfqub3H~Do5%?7Um?D1j
z@Bz~PPg4E=c)m9Ru<w6R@&TkD_~oqXso(vA-+F?7Nl1Th{4E;z(`v{@{%jij=^*^H
zECc!qKlB4X`VzoN{5HR@@J|o>-`WM^+rM1ve@X+qFaNXu@TbdgqHy?c=^^|c$En!%
z_#`x7TtEEJW&-d(I`}bV|C+~v$N_qfOm(zDh$Mso7hvv?_j$5%Znj6`+v8xZx`)pG
z-OaH4BNh)6vljGVGm!7MbCDs!N7&34$~YrmB9Y4?v1y*+_Kwkfc-xXf`V@3h$yy}H
zII|l}G6PeHG&W^XZ5kJ{oHXba>-EZSB|J$CYa8p|GkPG-ws2VhFhnXTS*)sy7@ZWQ
zy?UuDESpGA4Mbc{9N|8!-T|&27eKqCLj9F&8%aftY$~bF;|ku$crzb=2f039bfvF)
z**#%$90zgC&IzkjYl~~;h*2hcd-}Z&U_EdH7q{39ZS~;|9UR@CF|y;+jc&8NCoQZ@
z^m^$v_7SBsm;_IaiVbNYhh19)Ge8Sb+A7y;O+<ZO*0iKkC<)5PWvINjK<4bocIj}B
zIb6SX56*U6+49NeI1}iEzBTk+7aH*Hgz(~3kD~||fwth2c`=OHTNEEW{*#&7%T0Gj
zlbJik)z_MC9hpCpqXm8OTn!79F9Vz&9l{hP@RS%Ggbul_=z2;<740ehr^1&UE}>*I
zm~O$^WfLguVm^3q1@7^+QCcA2q_}~lmJpydadtiPyn?e=?p$76vGo^aS1WIaX9ZKb
z@518xnK<<#WE>8vrZys5{NUs*IE~EHB4v`$Xc}HknpN#vOEo<40{*Tnk)!i&pI)EJ
zcLx!TmMgOQe1K5FS#jM2dYXkzGhU3K+qMlUp}BCVP}>g3CwU=5@!`hl*1^*{D5tT}
zc56)Lv=`ydeQe5iQ2Au+cTmolo)Ye|&s&rzx~`r5;z(W$IhY<-raih3R(u*T54E8;
zB4MD(AAH&KId|H#efcfNp-zO71vn^!ACuR(JS|CeVO_2+oY!bKCaJ{qqq;;`<Ac}!
z<80Y^&QWQul5^_-4iSpb@(n)BY^Ssl!D}rI7~hxZf44B?>)5n?<({WuPbw4LD=1}t
z+<av5tRSpz2|V4hd^#GF+L}r2vOtcLZcQ{}u_>vcLvKx8J~(v2yuPZ%awF`B1^U+F
zC8EUX@HjCOliI072Piog$nY$lIo5~KlgTBU1m5)E&Xu_w0c^<42tJQ^ZX{h~Oftw|
z!iVfQ0Y<v$OSi6gRoklrxj*mUawNxQVba)ATP=2T_!X<z``h2_`_7X1Ieygl4O6lx
z3nW~^_*9{$A%^9#9aZGfklPg#_I57Kw{)Xw2HxGK(f)`aMmT5WWnMMJqbsK*b!dGM
zU?RK#Dq78I7^b}pHN9w<kmoRO1NC-|ba!%I307_8^NWykglKvUEx99fLKXm5v(|5l
zU~6m&1+p}~EVAF^@+4!j-J|G730b#69rC4HmI3~miSXR2<G*~UkT6<c72@M9td&W|
zA2-UB@0KCU4#aF~R<fCL+x00g=W}uF&7V1rQ>4X#yNz`^dhA_Gpq+A8v?!QEN{VJ7
z1D`a(iJTVV)GJ-&w7Pz|f9*>+lg5TNU0hTO^JN5LgP&nky8~fd%O=IXG^U@Q!E`0t
z>Z{6YRq4?t-K_R;9hgjUr={fZUU^k-(k#G8GaT)UrN<?p4^Vo?wb{;j){0#8YDgnq
zjd$FYaj2lCh<C7B;p`|<BpEUB4Bqod5HEunin1qgm_VRDw3zd`G%DWiOWXR(T3+K(
z=A^CuelH6aX~Yz3ke@S26wU&eP|#s)TPovDCIZ=9vt2Tsv7uR-XL?hn-o5^1l9(b^
zK77#Hi6l0&#d2Y~c(E%J?F_^KmBEB83vdbVz8)LxoBY*Lmv`{EC;sfr8j;L{yKY5(
zZyr}DUP180ZUZ&^eZBFQHPM9N5~Pu+%!8%~ezSYmG@~aR3BzTzP5evg0&N*gqfK0I
zi}TX6O;l~{OFL&(&jsE6;K@f^;_2Q^6@Y<3%F)}MA;kdh1fU3bu3{70L;W0%Bjpec
zL(hsPuVoR|krgKQ7`Hn4=T@n@HE%Z?CL?nIJClat{UaGyHo1L@`!j<98o6p4rBP=%
z4w-SOSg{e8*z>slWkUFyX_fqStd9(^6k1ef)y+a8g7xl#h=&cPeB{uknH^N*vp9qM
z<F0JNEZHoQU9Y^P(%tf;&r3bL-hb(o8sq6tPuM9v7y?=>05KO8{+5El($EEuN`a|n
z(;F*KFmy)<Z>RciyIf*+_1qwq0Sb*p%#DxC3VVcepiDb}tzB|{P+YjA&|_C60%3#T
z?q8Fa*(JOa1Kzd4-pgimsNDdY<=AK+DqJCo4Kg%}r?PW$*=AJ^CXBx4)c*8}LB3W^
zD$COXYL0Lvo3oLAV+efVs+<EvhCj=XKdtf~E0A9s|5;@GCIS2@QjGb3ANBkBSE2Ez
ziut`<`G0)|mNnVUe=7+AW#TWQ!k^Te6B*)(ituE^k35`{UjVJ)SzsCU_a4=MUPFlX
zS4hsuk^gv9|6~yVcL@;(Xdm4r`x%o1Ff{;r1>gaD>xV4#kHiyTKjs_bnwPf0sHspm
zMQ+W&PD|OesV#SF!HCf`5}yZ66g*elbJNC8(_)NCf@ovh;1yu^(z(<U-Y^xVAelEa
zyMEa1zt5F#E0tthd|9w@DP2nZbjTx?{%3nN^{D2jA%4cU1eWI<upPr+7g%srt%rPm
z3VJ9{Je{1$hC8!%l>6O|QBGHmvp1t(o(J7dW9QFdP;Ad?npzU+EF;F-p#jPZRp?aS
z!L3HC*fkZ_3N0o?_a%0{si@c+XBH#A7HR*aYkw`{1mauzMb6?4(bDaO)$78-3Xb%-
zf(ExX3hgC6j;c}QSk~>fwk^|*z;0qf$`;e<r}Rc((w?Z~Qjx7KB(j_RiSEO`ie`ir
z!KnTG0hV@)%u7>CQ{z;GKr}A!Bzg}ptZ~a<USNd?r)RB;hVv!+TkKuEsi#L$C10+m
z+sl0pw6!j<vJkpZJ%iirXi$q(0t72K_d6Jng?Z72lxS|+8?`5<tFmSq?nUWvTVW42
zjdyH1*p@MKOkD(Evz{5MD1gx$3UW|Hcsu4!w@HwTs=fpb$YtpHe>zvHFOd027b5C0
zhJ7;(XNQ3+a4pLsXQ9Xk(o^gC!b#Vfv<d|)<+JFc`m3N@J>T{MWQyjgj^8P8mI1xc
z+c<O75G9mAjG=F+luA9{Y>D;Qz0D<D-WP+ZD%fbO6uYKoAV8jZ-!%)ag*n)EU-BjM
zXn~-8{FlHNaFY&axSgPN%tATNChJ)@_fGYVYBIT>-J^{XCz=T~D_sC6l=*F6al5?L
z;fuXO^k_3Wd)<#5+J5$X3W$}hE_ZyhbrpF=qbjUokqYUD+w72&O5j5%F<1i>g_dQ6
z!MLD>7Qa}?O)*cWrkA0*Uy`Yn7v1UBA?E<wIVfsA38ig<n4Ho_<1F;yBRiz+MO8zO
zW}aAMt1QnR<t!coY~h_3+jJ|wr+tKQUdz6Ic0QLp%;r&3I*l1Sa~6$ynkq(v*c}Zu
z$ABJ<wLCck0W=GWP>d-Op~q#hoUv2jH-D#-XYGE@u-}(5X=knBS^8V%XYahc__@;}
z1O+mVRXuk*e3_w&WMeM<#}^R{@GJ3vuW)TeJPWHsU4&EHPR<a%Dw5dUNA(3AXC&~h
z0i+2Az@mg<Q&FHELo3%3vV&J>5YCqjZk)TIil@Gk&=^X5Y?8=fl|cz|A5U0h7sPcJ
z;JB8Df)trN0=gLSvdgLRug7XG7-}@s<nJ;g@7|fKM0|MS++?@*yt`$r9FRVY{?ugy
z)dR?^`ZX{CflnmeziO&q^sJvX)lVJx|03i5RcHZP@Dl@Q;G7?i-}TtZgz@|FyCnP9
z0i;48+LISPQGomy0idw>ADWEcN8B4G`XRmep~d*6+W7mFA4-jrLr?bnL*N0(HBNLT
zz{$WY{NLpzbTa$<(7tX72KoLlqdxg|`}zI%FNDk(lwD{mC8wC~TD;*bRFnQ%M`84R
zdpE1C(Z|f|M3NYXtx$_Xy!tra@<<Ptbvk4d#WOVhRp!ajB%FQhW4G-at3Yx4xC#WT
zjLeJuOr$eFvGn1Gi8+M8i4s{PFhX<98D;L=U3_(;Om(JzUB3@E&|L{$4&ejLsM*MG
zjwwiH*$~)99+{XbY1KtcB54^7mx51S^8ZXrq&IA;6G0Hakx8s%13pa{)(_nxuw&|y
zmXv7SqAg#>Zq0OWoofg)9a2Tguv8srdnR>3LYS4h975PH;cQA?zJw;mp1Y-XTbwF|
z>3WZB%=MC}sAaZ|mNs&oa5?w(vhy}d3^&O-Q(TLT7qlEiGh~reaZmTo6$)MQ8*2R)
zzOC|+dZXr>H2SDZiB&=5NRu!^zi^ts-nMMeJSnI+;^<h^mfvZ4sZAsSF6-l|_eJxg
zGK=G^!6uJ~FG3_BF_RL038sPbcPQ%h=IhX!G3gaTaxx=R4d+f3pXNb03~DfTo()uA
zJBWcPVM4Kb#|hgoc?TbGH(<nXU9r%g-I8d>qQ7UAD8SEiu9(vhR^tS^_o?ukivBLb
zfduvl&DRBZPA^ab#PmjlG0A}t6qPXLI^%r@xie~s6u#x1rFO9c=k)osnwo6e@hMzC
zI<kF%Re{WN5lqkYHo)^zeO*JXIom+`L?c-Uii~61#e6*=r*JXO%w#b(poQhD1D!Rp
zI|eRoYsNqFRr;y6q)Y#`Yxce2*^rt6&>jzYquc0nBfVIK31@2oun<mqaU8-%;PDx*
zz^!#Mua8OSQ1?P}KLY9iK>MC_dQ_Hqk^7mn*b0g5^i9Nt_fF8*SX6gM3q7F=Od=tx
zpy_2(j916-)P+d0J(V?bPz`H*AC!<O-!a6hQNrs^T@Mfq4!O_^iz{V_W?vL<<LQEf
z5)7Gvov{XzBVZzhB(VP;<1U!j$#IIYjH~uIRzX<l=^PmQ0zOrm<3MF9^)_$wu3EXN
z@j_&>{iXDa!tZq?Uq<133@tTDSbOvpm^T-@g3%V(0UUpxhx+|-tC5;(N*!WC(Z^eL
z#SV@n)PnKtW8z}p+NNFv)?Gd?25mX6g|XS>*brE7WjVGlN;AuR+qIVl6pl0Ry$_iv
zS%Jq$>(^?Ms5`}<6?iq@2tGsTBM4OiE0eP51sb2r3%IEcc9yz^stDO<LhrVH1{~R2
z3+dn!>J&!l=-Zi>WzJoh>Q<UALqWPqZfWG=8eOwJ?B!>!-5Ar1RV_~!Dt%`3B)k(r
znvA)!i>SDNpdrx7Fzz<o_8k=9581?miMDk@T(zRv3CkVKH_tjl1ynA1R&5{kD0eFa
zzVr%w2*oReE;4Kzpi5`k8n6}aP|T?*<C@8(ao4kD_jaI{xl#n;D=Wx_QOW}TQ6Nx{
zVkfF>y1NTP?ZeOwR9)^J#j!MIh!UfXkqx_Cq_JFXYH>+RoZU*7G6#Nbbq!AX!Z+H7
z8i^Z1h59M-4isK{2Pd{u&8{^>2n}I_1kTQ`_-p$+T|Ms&WXK4@v;kMVF`p5_CENgp
zuPfv7<TFW~a~^@Z!+3>6xghNGb<uT4zgL2~mBk7%?(d(g@V7Ba?#=BK7eWDK0f1Ky
zM50~K)?8Ek4(hJxE`DhG;Y(9_X}(W=!fbqRIXmN`9eY5t!E)zX+d`->ErDab!KxEX
z;{ouJJL7VI<a(E5{+;Z}wRpCoNdxwq0rQ$&T<&TVcbu-XdXu5Ku=bTxN{@XhVP|pO
zdD^xPLQm^6KwScj{Pqr(aKDf)iwv-+*cq8edj1as4K}!TZ1LqlreImD@oqN+c?uFp
zkQ!|guwsa?Fe#{^<lfMc$Q!)G#;9|?l_BcUr#*-+UKU3Upr~d%BMvZAOqD(c68aU?
zzMvJ~J~=gbTAcZ~Xcas^cv1G$jp;{>dk^i_wz4q-cX0m8N-TIu+)#mslnC<%u`XcS
zrCHUWd^!3t_*&cJ=fxkXa&J|#DCA>TD{=l=K7AR?HJHhKD9V?12H-l_l-dDmf~xJE
zhXe9AiZ3c;m|e)CdH5+{){3|ysZFUmw0j|Pfl9#$qtjLkro@Y&cL=6>kC@Yp(~q~u
z)GVTjXQIOy2Tizr6o}Rd(#OfbXIFfYkc{p|fji_&+;zwH!z2N5wmHeYKB2i}&Z{?i
z{6HUP&qFtF$p&<{K`P`-9`bb?xn9rv;t=M;X|g?wu1q)w$ZyZwIqe&oPlwje7?R%7
zM(=7*ondE4LPfMaXGDqTr%oqNG(MYs!p$xwKG~v%cR1ob$u8>35X2a?JA@;X5d99|
zU^}07<mmhtmSlY;{`{bUJ(HewzX5i}3}<AsB4j#qNw2$A!`Dh6l?l>**SMtN@oiJV
zB7!^e<{L-Rzml~qY#uA$%PEBQ=qvh__3TbJwl7qxRprBg$N{6}0WO5`CE%m0#Z!Wf
zay^@(D?5+Ub)+X^1lh@SIYS-+W}Rdw|4Yu{HNdlJ&ZLu_6^&7{8vRsWQ)|<DBdpFq
z*XQv0`$5*UmuEj2_@b>A6Y|@(Svpg$m6q`4!LLk7vf0d`s2NS}darU2OD(1ovsw+`
zYYw$oS@<|=YCDFdX-K{0glrPUy?yh9k$1&@r;m=98-{BwGd&KnD38Qy;+{!tF%G6_
z`A(?_><%rb>{I#qk_jo2;KizNP-r2%f-<*ryBo<Jc4GiLlPrAhH3ect%x-f~{9()1
z5<0(AiBzJD7N!J`pZ7hd{O+Nd$Foi@iQ$iCVA&GO8*fD7_#Xv{p9(rJ+RNt^pdR2e
zlR+1#oZ1SoI9;^w>y=OL;0@l|IE6{F6qJ}vWZdhqi&v%=@~_|S{S5tjInC*XL01cF
z%TuLr2#e&9+!|_sGHz)`TW##Ym`l*eGhQu$Vu^Dx!i<8W_@f0HQAjGu1=1HD<+yb8
z(Be>}u!0Usz9qs82=HoYta2ISsIE_o^qobj+dY0GE5?r?opoPClk!!PzTa`1a!V?(
ztWM^;{`~ecMyoL{ATx^p*pEQvk-0dvg~_uqlQ3GG+;0qbm5($@5D+R$D~jvbSP(0}
zd9TltLPLg&4qL+;p)RltA+shZq9+!DU03V1SmrX!tLqa-9pVC`E8F`vd)7#vIF7>a
z9!J{cj%MNBFXh6U;FZHo4h4qO$F&<K?;qDiFiLU6KYiLdRN~Ev(L(Jab^{2kI`lA&
z@xg@LUa^^X#SYhc#p-zsESsF9Id!;+HlS;ekGYaU28c{*Mb259DLMPp<yc1B7x2H5
z93{jxAERVYud|(qgSdUgCsRI}-toom@Ctwf-HqLRYqM~HS>zmw7@kZHZ$lpMHHZ{$
zZ;2s{a0v*Q=ZkWk0${%&zSav5Au}cpPczm`G7lW(yQ{BsJAenH>tFH8fLM=tR6btN
zRi)$l(R(3f|N0A*_yaxs3vKv6!Vtf9`~WLX&Nu-q-2btF|J%Cr&%*tudgB)a@Vh(!
zmiH$yzn6DUWYK>X-anS(|J?9vjsLgf=Reine|G-QjlhooV&U}IulV4<OQe&4oImxA
zK;#7Bl83l5CNUU&^k6&@D1#G(xyQEJHNI%G6*(mLs$Pi*ES9~i1A5g7a(it+w>T6A
z#HIxxKlo6MPu+cmnEJAw67VdZU#N@|)O07lsE){=j78(Kw%a%WAw8^(Ty`MGg+eCr
zBH0k3!NR4kVAnG@<o=>;eHun@d2S{^dX6t&A}zl1X?eCR|1JI+Hb^`Gloo4Eq-)dl
zd5m?l1IWS~EmSNMBwAj}e_1^_?h{e&qcEwiceC+ixAqp!`;26sZZat~!Z{!a97p=u
zJ}VrNTS+#}0f}8}!4IBO-4l>C2(s+w7dTA!fMql2zbd))I+xU|hJLiRbX&k?9E%iK
zGxCLsOcPF151`7U?hI2VEcTyA9I#Fm;uug$fr>mf2h8~aHQ;R)6C;H}aBm`8ncv5b
zo*?uK|N9i$vhr%0E%zVltH!*gvM~!<X5SGKY0j?8URM>e_f-B}*!?gH_$BWD{r;)G
z`(tZ$!k&A(Z!EH|6NphyMWi_R?>?&rQ`kx$K4_Rt(%&XYN)#ipp1d&seD?gJ+cw+T
zffv3VzTt32oKc=lN?ine<dZEjx;BYw`mN2(Hp7#!1Ja|yFKHEv_sbuCy&{l|iK!~_
z@Ipu*4u!hNHfa_h-&nigcp}c)GnSL;YbIMfJY^#Ig31^$>0MyT#w{#eQ|ZY3=!|n)
z2E;Bdk*V^@7AYD#&mjG;86rQ)z+%p_KG&uvp0N>VC0v6!E0L5aT(xVGc1A_3cQ#bZ
zT}w!>#+Wod9HdGl9|!`)Ma6>#HBU9iA{s)ni>>vUGs^OMv(4si#A{m$<divZQB*&}
z#78|q-%4X2H>6Av2tpflI8b^V9suSKV4Dwcy78RRGT3Kh4&ldoZeRMnzal8EqMA~>
zGpo<%1ATaaEg1}F+GIc5Y$wpgFk*vcM$MTVr|+<fNKW;Td{Ah5lz5lQLN#D*wEDHd
zz`_~0l5Gn;-W9-z)(K~t$G(Ek*&1iW@zx1VG%8E(q(0}cPNZ{?VPJZGYa8?^ZRC++
zTvk(6rxFX{qK80-K07r=Bz$XIviXkn_F@%<WqM9R0LPOk(d!?slcKL}7GX;3N^$N8
zgOu)&YNjTgLX+UD>u7DdrdRQ;7b@@cGcU5@yKA8LDes*VOEcDimK@6`cfEUpjBKux
zOA+WGfbiBeILx9nrnxj$F~}U=F!rgYK8`1jr`kI<QRnsEy4j48gf$QN*5#a^GvQCa
zxD%-M#5nH9jQV?;{YM1)Phhtibnn;P`}0Tu;l1}~TKzq>{@n2QHGa9#{l5ASRQSi0
zfkS@6%fBxBqj!EXIRihCjmDpV1pL--PW|l614#F;2rFR2zxDt!x!<gv6V2Q$;Fl99
z=D$`RH-6I5K1t*H2Qw(^C-zSi-^(i6G$y05Oq%@H;*}Up?ysld%*V;|0IPux=6v+P
zmbwnBJysXe#LG$@&D*YmjSMDn#HRXb?nu2>axo|-OsJ!T-=Y&Y+my%!g@tQ&nI5WS
z9p};Y*-X|wDVg|`&qdD4>GvIEmsAU#Rv=z%rdsL_s8%Av*%CSASxY^iZp|+3c_57P
zssbm+-qYku$<3nvLKVTG1Zsh%gS*|<deEU=^~)o!s_U$Z9M$)pJ-r5!rrwEq0Y^C*
zTI@7nsF31ISMatt<uV-eyiV0drJ8Vcqu&hkf^LnXT{S=<38lGA8p=VVE?I>J^4-NS
zp#b;+&7_uqMw4}XG0u6BklW{JU#AO;m(hJme?z)}%&*n$?G{<FK`(^F_tO$w?mKA8
zo9a90=IqpD4F=x=XuhmP&cW_sT4EHL<~^*ZJ=#swpG+8Ia+PgZt}LoB>b~N#TD6~(
zEu}EFy&G>(wf=czUqNoYFGe_M<MR79o)254MK>VvPcyeOEWxMBD6Vk7w3T~0!3U~C
zX1DT{^EQf*Zh~3t_qP=nIx|Q|zNT{?cuu(?lj~Eiay<@y{N<vX;bo<(t=!m7C#4HM
z%y>IoF53R6on4@Dm=mLr5?s>Rlo+xucvEUL=P#$vqYm;qs@-=~T@)GWj*Gaasxhc<
zcn;*Ho~$h+;7_Uk%Wti3kCt~=d)7dH6+4Tyk!W=H%J|?N(KpGGk(SH!VE$fnnz<DV
zVAyt`^S~*y+A_DuV`y<vLs!Kk@9K5ko-dFRZwT$x)^qI<e%QNYU&??Cc=UoXW-UyC
zsMtoD9^JX5Z6hfVCofmkUQuZmcBNe8)ks8?dzo!%g9NfrY7&c&P5*#-o<T)^N31a-
z0beFHwaDXRSQg=<XnT+%5+<a`Yc>s3ZQU=*f)dA#O%&V`p+c>i7JZbXZ-RoK_A;@e
zoe$F?tTvFUmZ*0w3+Igby&pktV2%$WRt320p#n(_meESCA6oCcCnIk|WQb!G<fF1x
zAGq4NLrwWcO~*DZP*rjlGp_^_v`dTYJ}kNHhG()!>`qsqB#=B?^W2!&00or->${NS
z<frewpjrjXUfHJtDm7VeZxNBe-qdcf?gPc7d$>z1?WV6i`k-rOh^+`&H{;@cYyL8y
zk%_~ug__2ys!9T<3Ln?%dIpf3PN67-BX5T*M7GH##(~3Ns;B{VvkGX1L~Z7i=H!Pe
zjx}@>eWzF+$?K>|`Y*-?`qH^NMC*f@eT2YNHgzu~qp)t+d2o#Pl(r*6(^YU$+>ZDY
z>;Cqjw=ph_d)+{@OWH0kzR}ItsB_(Gy0h4{Dkl9(pUX~aO_GU_SsffZzrLUnH?~g|
zwZMc|!7y}Y&|}8uX~&u_7S7o)tED^GQIyZ>JPI6$NB88WKXI-DMQ6ta$YPbIRk{=}
zV}M4a2!%&om-|2=RJseV^SrMJ(hJYvUZQ(oPJO*~dlPaEH`;B4GeDJv4SQTfIfS@e
zBkriwD%hAbu9C)Pq&iD*4aWCLy3$DWhup=V<^pBF7mk>0m_x#k#Bsd+_rsS`H0*aC
zXh>B=Y<#gnJyx2Do(QeTO&`nOKkspQCWW;&I^|(}gMDwaowr%TzOr8$ysBSdeiUA3
zu&Tc~GghavzVR(@)ATqmal^7Ev<<G|M!j3#NL9sWzex4a^`I<wb8Rzr8iMs|tWVrn
zZlf0w930%b{r;&%yw7)#6LhcXHlKi#kJ~ZR;c4~A_EG1<(dKOjN3FdyAzV<y(DoSx
zX*&g7kNZdFrMX5bI?h-~6^V|B`QWa&r*|tRx_(WPAr!!adF`CKL@snLiRLL332WyZ
zXgjW0t$snU<yMR-=r?6nxwo!YGb)Jk1#Zn~)zl~MTvh^1y_0EVSz*)tS1v1H>Da@M
zB=G0Zt7TSY);{N}s>db1>09&ah`Ruq@$!D^I76>1Q;;>ln>wTF!<Pjsp8n$I78khj
zk*VUEgZOOmav8G93>WKw0tXS!;M`G#crL!E{ckRt{f*Y<DLPf;Mm&#-#l%9|)AIw)
zQ`sKTH!+|V+6TP4=M`{9sPs##NOB1A=DiJraCy02K{4ZAkl~H&Q%7kuj0IhuLv)|J
zol(hXFhV2@T+RNf2nX&Y2;g41m#uGOP93x+F+Z!V#ULClLG^kKaU<?5f!x>QUl2#3
z-Ce;<ih{V91#A=ssG+am4JP0eII})^5uEC$stQP@t<N*gQofXJRGdzd=tsSXH^fC5
z@XkC!|GZq)2<%$EX2E)%HWx~7Au9KhW^GL{Vpgo9<^Ae&o`;1*GD@;QVs4ibna`w;
za3e-K2rmIAooKpP8Y?^weK{{Vmj=kQb~Q%czAWCc?j;FO^I$9y4zEbUjG>e|AgA#H
zfc7Ys$fIFF58x7NYuz5Uz^KQOtM!YW&b%AJxOaZ-F3`ePyEEV6D0gkBTPX;jD25_@
zgUmQ^v7XB!WVlz_6J<I8O)I;>X8R3KcA~~h`kT+=)tt`E_i2FyEKp=yE7=}=*hgrv
z-%Pg~fq4?nIJbV#pdRK*N^aYbCYGoxCVrv3Z|Cl*J0o@Seplwj7v%whgPG!SeG^eB
z;2r4$#@J^AwDt#yUqsF^@r+jY8{I{m71#JMAlXq#b5!AXfha=jkucr}SB1KHoYiEq
zSQZIpkaP%Sri}eK)xPkgT-maqoBQ0@!vPPB9DG_+-{4AQ)RPO&hbD_}-QX8SR0;JN
zJoWU?JyUX^%shL~nCkT+Mg95ai4@H|Q1A!1?!{Q-RM)6SX4?xeo+AY)F}5*C#VX2W
zvuOmk`5oK{GmsKzEY&941^uiO07QqN0MT}KdkY08+)fiFZBCi|-u0uUb@zuEC$|9S
z;NI5O0sd!_@AnS2ECK&H2!rp|TaUo+AT=H*;NH$HbnJ%8B?SW=!~5Nb(HWWVJW^Fh
zxkpIoqn~o7l_vx?X$!AS9}~nJBap|5*_gTjycLG86@D2FfL11(iu{u`joMEQ7YQE{
z=RNP<^zZ0$5N#DCOQ-{PW(dR_*Ww))cWIQ-%S-v8uEp2xcZ%T-)X47C)W<*zf++d^
zvW#Y|HYW$U6Ga`KQrTdm8s5OQV7UO_J0+C#@oOr87qsp?HQ^(Qp#(y`Bz;jV*XWNr
z#Em#y%g63XH`en6Y=>LMb8}nqIhTR<kZ{}MXqYr=m&${z(?C&l*g-+swalaH;lxrE
z{DDbOZOeOc)h4yUx3#tB8KVLN)FlPX_ho%&zy!4xKQQ)gb?ot(sj2y^Bd!o?4<O4=
zb$I_hUf$cy|M9rcJz3s5PXF0Ru}YfjT&wrn%3cEwlS%-Y<$ltVdN_=8sYInyU<u4%
zxN%V1@L26Y$+DI-Evuhf!*ChIK+OHbf57V?+|?n%co$J1nHl`T6$oaJ91nO<g}I(^
zsm`D+Uf%!7=+!ubC@#9W*$6of1tqKoh9SmPQ;{F%(5=Xo*(vU!)tMxxSF`frs)~Rz
z?S=CB+Ru^khVhPu3pED#grVs%LO0+fHfr!rDFA%V7rGFVAvxuG&EEHvP8M#ggR*4v
z#`L~gL)7hx?kh&Ss>;E)-@J0?Ua4pu!+nD;`?3&*!Dn3Th}+~k8Vmv@ar^Sy&$`L5
z<^fQr95s{${}YSQIU4_uDWzGTy?X%z{LTf;Iwq3PrxW4(wW4_Y7T{N?7YT5ZG5MWT
z#2&?M%!A2x?>y={jQ2CDB%V`>c|lVbX0v4e8d%kcZdMKx9(I~;Ei|D_hScaFc1dvN
zFea2KnObet#QqSw^_bcG6=KKd+gumnYW;SMOU~79r{Mc#ktZv|V5MrSPHmsTsrCan
zLoIqRxX5q=Y25^!fQut9#n-VvbYN29hmp2T*S&N$Tem@pgqu;}Y<OER7gcpGdZY|D
zYFR8j5LwIC3hQi`?>%qGNqW!_6&N$|)idWc`hkevty>2MjRrOFO_QE4XlP=ymU7Pa
zm^M`g;6xzu?NY<gakTL+;dRQ95B&OZxB?eYYM#ckHkD&a!vS^tjRUg@hs06zl@H}}
z+N)}YTw<RBKc*ZK;7%qPId13pZLX;Oi#T&qd;KBg`~&+^AN{Rs_;*e5vl#ki9R8as
zbn<+%<Db>XkJC5*que`jDF0o@0WbZd^!xeDcv7(B=KPah^qU#|dnkYFC4Rs1ui@nW
zg5G{peg7*8wO=ZT2>|E%HN2lD@Fy+(6IAfcA3MaKJ@%iV%a4A(J{aKe10=n3Mx6y7
zukME4sZH@HiPxOHR6SO%F?<n!y8|SjQlQ-XrPDOxo~CJP_3P>cE}3f%OArK@W|JHx
zLXA^VpKyIJ6WLfy?zzUIxVy_n4r_kDT;pzj!>{Nn8R*;^UKa(JWpZhF`*tzc)JEs4
z^_4ifUqP_19u+Z#^|QA+dFd`e=yA|)W^P3;bWHB~lH6Ga!yTa+n7zg0cSP7n%B9Ig
zqj~uP^(7Z4`}^y9`V=DWT$#e(iHMI_aa~~Z;A)>rM7oFLRq|~Z+?$jsS7xQYXuXP!
zdtxax^hPpT&MCE8Z`vt7qR~oE)p?#5V-?cGlnn&6(b?WzfAQ>g#KFaKL&UANyB7&#
z7f4+s(zxSa8B-;jwF8#)8tp(ePT_FD!x=FzG-@@hpqGo>lrtSBm(1Nd>*&Bi#-ZSJ
zT7PX^Up)}ch9h2Dd52X5p(m4<ilK>Af-mgSq-?nS{RYd6LO9$Nrp!;?rJmSaz(nIt
zWPwi3CcDJQGm#R*oMD}U8C5}hx#H{|CY=hpX&d9(gwpk4+e4l$=IG$j-4N8gY6=rW
zp6+mh`3@z>+Td(HOc-aC1GwLH%jpEUM2gUui8mdlNzr2#ZjE|ly@Hjw=n0ohGWKWX
zbF4=-+H{F{!dpSE+>`9DP-PTQ<dcTU;CDtFaxl_FtyE~(YVbMG2j-iP-xP49Wsn(z
z=CdlRwY^j@!kO%4O9N^%dKItBwIVg+Jq!zxtqPW}7o*rcB#Qx)O(QwCmbbPC?vu=S
za_zjF^E5acBhJQa3Vq_@<k92Kwx|L@jen>QerXhb`vjGe0S#6fAZup8ssjlQ-buka
zoLTU-vZXom@kX6Fv4SS&5>jFNmAzZ-gD;nf;aTq&sBw)5_6spx4i`6`+k_X+wVB&m
zJr963CQeiEXOwQY$E-G7`9XQ3i4aIZuSGQpp|BGd5zINvudM5;Y^JivsIXrB&f(_1
z>Nh;u3W#&Fn(+8L=pf&V3`?vB+En3|W4<+SLvCJqh5Q!6Yn`JcP+2bjnyuA2%GoRs
z__zH6mwsYM|4KdZk@!JO14u5oAM_QX?f-f3&)MhiDGE?D`~s2EtxrC&hreehV1oRq
zcDVbm==NV&^~I8(HmHA7ZGcZQIQqxr2Dq92obCROWB9>s{NG;m1l|8{2~hYw4pMM1
zkI2$>@b@1EO#ecdeogrQ!4J(w{?xU6qr(0*1@m2U%m!96PlsK7$p+q8V@oW3p%Qga
z$7`c+l36t>0+~2pt@Lm;dwW9Y2%~729cGr=L!@niB7Z_+Tijqw@^X!6u?;%6efsvR
zhBHqSxNkhaOTRmKrp!GAl_AVJ+tlotV(ck32~WxJv0kWfYd$oR{`PR63JFE!hr`d~
zPc$62CducnZ%DZXu=sVd*@K}}uLI70rjq$8+4b3%8ZM2~S>_9YoyFKln3PC&(@#}S
z*CtkRO+TEz)PsKiI#blGj%p(24lM=iP?Vf>=XX#v<c!_dZ!j{E(3*Zb-#eLGG#mN`
zq$NV13_S6lKT-RMsSV83FS15_g@h}f!Q5%aG%o2xR;PliZP;1t9&TLx7FYICxMbqe
zH?~0dDhVv&<F3D120f##3mtP2>k!g(PCDm)aEjXk)S;r+SkF>-kfHKZWtB;bmyS;T
zHv~3!#76+CL`z`$d?4LGHyP=T;<e*Nt`6GJ@x&|yzR1(AEa-o9*{o(e^8%a`x3=ie
z?tSU(JC|mQu0w1-eOz9fIXTj1z}1t>^Y%!hAl(DlNAvgfeSvZBG1;wvQLR;nP7rb}
zbW3r{VyVQ|q*+Zz>M}lznav;DSgdFg#bL3nb#x0RiGg&0&snD=`2~sLQrnON8Sl+W
z5oea)$B%?xWl-RJ_UWSkOCk;$gt6g<q(xx1Nm7E@k&tIDbmqy|mc$$#s(a^~Z@I%0
zj}o?VA6J^>G2mqpf1tE<UMlN~-AcbR)%EgWZF+%?Xg^hgyLFc4qXcd~j>2y&0WS{y
zSAg{nK+@w|&UlLn?E+JOEsz{gxrbrT&YtOa2~e-DtT_H~_Vm`bCscnWv<<i$KMlor
z0c)f#Ks>kGok0n72rphoQ@F=>Qg(i2sFO~biu=Z0Hr-DO*lU<D4KWS%56*lBvlGa0
zsi^bG=;b!8<!cwakO^HC`KG*Y9ju>;h&)J+cS$RJVx(v(&?Pf?hwPyxW7pkmnfB^z
z7Nn*?VPnp2zmJ*zs5kgNeX6bAr4^F7(o|n6D8wuG?cQKM%3G^L34LeH^y$)$<%p|>
z%aX)9qZAf9RT3kMsV9~Xz^Y}n3PhOLj!dQ|UuQmqVTr*~cj%}1$vypat$~910+P<B
zZ(nme29Rqk?hN(GU0n7NI8Mde<Pf^4@eJtgO6WXaJZgSt{ZgWgMZArOKFT{*Uae8r
zDVv*~e2kCo^DvATqu#a<l?aeEC9_Mq1MvD>HJH=U4&3x3(^?m1=-=AMH$nYm;wAd2
z<LN4;wqrXU72hj*%kyDPuN_;H$v2DCi9dvBZ$CqiSJ1AJac}pN3V#Pdziit1LP|CV
z37j~fh^48i%4~;IzsEdFI^QqoHr7cLe7)zX*naPF#MfJUWnsSO&2iy2RyNXMu4Po@
zd{$K15Xo2l^%l>9m1naH*rI)GOi~lR?0CZsKNn#<BAr~Dk9=M855xn96$N3s6RwSH
z()V#X1?&1r;@nPiz248(Pl>k0CHOpMC?%6j;_HG$_6lUdm?zlu!YGg5LVMW0gP6yL
zm8=@IiA^ddr@9HEEmGp#?elxao+Y^-ohuFdKs{cio^(lkTSJ!Iv3z*JOxDsbcNolG
z5@kF;J(z&#53Ak%4&wO^;@Z@EmWfnyld4=d@OJnP5)qj>e7~i53d0u$yPqYMk8+?K
zT7p)Hs|gA7##mi`L(Tgchj<d@ifXh)0ZN&_@WfeCq4YIH(4sMg1?!2Oft8+l+GjLZ
z!5lNKTblc&$i{U@g0nr$?b@ho&S$*z=+w;W%+ZX}RbPM&6qHE;S#D`9?n1-U#&A`g
z_jpTJ=cFN}AM5L7ju)}drp6%EN*#v2mJZW9M;$Ha@k-VepY!HNyN1kT`ewFif~YQa
z*HITfTcnP^-ZKbYD?_Sl9p}MZF_En=)`Aqz4-{IrP}HoAb2KuqCY_n!ymVEnTd<d#
zZ$-&l6T5$i=rrTT<$9xEOd0EhP(#@-wNRI4FPW6w81^TQ=Z)PKG)AhC2L`yMp&Gy{
zk?+?a6q2zqhbu9Kg&t#_1S(8su)RcayuE^A<vZ*_qq0WZJf=yN{8Q~z59Bq))QWHG
zoJ9wm8pi}hn;-_Hk-pX*@eA5<Dq=G_$HlJswjUg$BWkJDzL9an&lPX&1}>a}xdR?;
zt4FB(P#=b}Hpn@kNSga-YD2v+b4wCBjX2XcV=NkSX1Om7pY3#tXtu+f>4+N!o=^nC
zh|nUTKD-`o^T5Cu<qBg5j;?*cKK+7S*`visM8Kbj3GWJhBZIor?wZ@fLeT;!v-d{|
zgdR8r#w^%@f<QA0vnsSX#3VDVgleWfsIQZzu6#*+)2*V1Gn7r+yLdS^%8WM>h##bC
zqasp;IyI!H&)1X<U6BZxxgBb&vhw;7UEb^0y@O(*B&@MYIDRzC{Xp!4DFOxFyn<OA
zYM{uuH<26Qz)QY4y&ABna0j!Z7q8cEslnpM5wS;w;{yldHH$sujd0V;jX4vN-p`Fc
z8+#)It3MwyduQ-Q)p6fiO8)E1(Sx{@JIIRcy5smRMLC~Q0^v&CchCqW@VDH<dpk@6
zIIq6kV7dd;xzr<6H&A1Yp5Sn)S6EmKwwWw5L!t3*w`b9Us|2>RB&38*!3khum(MpZ
zl?BEF$+MWj`XsEo<7SHK%P)_k-Y7mC^URd;4dZ8AH$CXwC4!mbj?gU#cA-YJc3m*u
zbJ6#L`a7gGbNYVGe)CuTwrp$e`Z^Js$gsJ9PfLcBA6flNRNi*MM30N{MmCu2cA)x!
zb9xlF`^Z#cI^4;ve3!x*C4;vc$i4`3xqFZFod38GBGk)B#zxi!j?84m)1l^E)G=gB
z3&C4kMyXn(l14nzQ!j&OL)P(~UyOB@KA!24b2jZpXhTtEjmsrhX7rCUg%pT$XOfK%
z^y=YbR`I-ssr@Dos%Lj@rz+di^7F}V?$w3DY4OfDM--s9V9Rf(6z^s(i*{|?R=I<T
z-d}kcKyLEkOyY)YovB@&tOc#DljhmDknHP<Z%37^0qaHvpPoI!h#Y$+TTG4%dAg<$
zFRw=S`#Sa6py=FJFTg4hiv&vC0=5-bl7r(zMSoyt7-`~pr*0uMn0#qY>g~0hhyc_&
zH%V92noGHQ8p##b#6eqt5+{z~LoAd(Xd$gJWo%pKdSk0E@W@_hHZ}YM+}N|9GjMfQ
zcJHcqFYDAem>4hr4yUqM=cmAjl6R=sK=OrtEf(mJ&dJd0tjTe_mAd>?4Y{GF7m@KM
zZh-FzSr<K+MF|QJh(kN;;mjsDsLmLHX%m?qM6=NOe9u<kX}4u%QEkVg$fSf=!HrV|
z6cdxUZfx%>)#KzQB21|E*j5&Xp~D^c5)L?YKAmajE?1EP4R^XV)6V6l@F}`DEo};l
zzPJ<`gJ*KUG%IN5rt)IkBlib%Zn3-2c;^jnUk`!I^~^}e9XvrIaDHVJfHQ^9<=!KH
z80*MI^=e2M<XmaVzRs5S4eKYhjiTQQucZ#KXr2*M=hdsDqd2X>#Q9lBdnj0`1`_dV
z*(%hB8h;&Q5Uk*6v#cRZ8I!#f&Scz&ou(*paK6~MDt-N?{Z%asu2*%{xVM=6<x#?D
zDApIJlxID9oR4rrcF*kVUXAE!{(#Zq4!GEG`<-pY8{#!ti#nOlK1@&u&HfPE`b*oE
zs_lHl@uh`9=zu=zNIS!N_U61Xvim91$LdsNryJYcYg}Y6`j-}>9v@c#!*a6uh_2}l
z*!ud{F6?8B!((`gRb=17YLwc>OvJM_qN<k{%Lik|9^w#-4go&=K;y>qYcXIO@R{B?
zdRBa0^NNWMTa%EW;7FfXsRqLT%b``tbEWdk(ClGAsdw58&JD-VI&U&mtvL@l`il3%
zRp#1h@A*!zr5wKMFlLJl$14@$9PX38+lLx$^AZO<PN%RZIutE?rSw=<vWx;R+=Amo
z^{`WVExF~p=G^{p#w5~)8=9&W*2~(>Ek>E{b60#&RXA|Nf-ug`g-ZhPMvsek8>`Xt
zHH+Rlod9KisTy9DVG6vbP)m2`)J6WfM9I_}wcP`F_c>0j4Q*>uZBt>$4Tlxv7l#6;
z<nj^#Yc1M!<}JCurX&hz2y9Zi;+NVadbw4<-F@g7wHR^ucm|~uwTx3iiGX3((P<e(
z6B3bH>zxUm+of50LMY+*Z;2m9E_6J9KV+d|Ogdzr1y?!_Q{;si;@Z$RM8Y5p%zRA~
zB0D~9+;@fQ<GVO2il5z)O?U#z&|q4RI`-Errew{G5yIO!FGcqFu+4q^i1V-YPO($t
z=c|FFIn2k2$@bY3Q(S%i!e9VW@f`$2*<M_4p?QPhP0lg2Jp@P9n95;InWsx0HNUUB
z%+uiN<|ZQWDgKUQ)E?x~*RoI`>(nNz3CtqNqE3UHgK1#MJ1>1H%^mT-Kl>;UH)bO0
z%5(&&@-XT84mzdCw_bGd-WbfvCR;u*#EZ>NyBd?JTdxMlhpZxwV&Gi3ZA+!jSftXD
zNV^t`4R<-(wHH%b;TX7bQ%I%F{QOSv{NoP>1?TbshnTv{UL4AQ5~fcIRX~gPCs*Td
z9@(#LKbU9#OP0r<1OHId{zG8$^9ny0L~cJQ2fx9(|0oQ9A$xy7ynh||8|wRqVDY~h
z)SLPjc@4O|KTH&Usr!DC|9%ty{^89)S~gI^poV*oIYLc!%&;hhH)ICcDR36C$a@Gj
zE%0ZF>(EffJ-kk&=SOn~)fv9rvd#mOKN9fmwZI*G2blwv&uH=Cx2@IqVhEL*`^qbK
z%^ELNz~myc;5ogR;q4aj?h!5ISg@l0GLuQlyT@BODHHO~!05j3AjX!@&6^7c15@8Y
zd?VjM6eR$19y#Cq&D8gcw|Aoi+Jqw>r5dhDp2(@D1A20Bt;l%n*reT809YU760Ah<
zKpZf^M+Gn|2ToqGLbRa!7XE)P*{!QBA%&?PYv^XCs1iK~I^c^?nrPzt(t<zdi+}0c
zVKAh$_DKn?4JPQrfXn_K&vy`P4j2(I<X@LhI2rKNOyZQ()XS32oI(YiG`XvmGBPq;
z9A8B5j}S_hloEifhWp<^p8!=k-19p~i4%|rSbqn70df{`mJU&nuV(wZN2{CPL9ado
zB5!>hP{OP3ntcbs?OVPn!chhG!glXa;&Xj3)#^#pPa<Gn`Kuq+1rZFsgZy>AgW{=h
z5#QDTQyIe9?C+qyA;80BDFH6(JK{CfvYT2)(8(q+nJhCLGc<dBX#j?CcoY*;?OW`j
zv*L@RZTX;t5?IUJ`vS)C#(oD0D6;<N5MuwwC^vVm82=ydmF)lZUd=wx{e4&NeFt3y
zI*Vl)zC%5}iz!O@ci%*?qL`_OCQo$y>Ru-@s3CVUwMfU3b+5uRg)W5YfySEP7PH#7
zzg|V1pV-g+|JZxasHVELZ8Qi9h=PUQf&$V(k=}xZE`lh%L`A6r(vgx-q&EQpMI}l{
zN<?}My@>QCL0SOmkWfM(#k2I;K6~%?+h?3JzVD22-XHG|M%Kt$nQJlET65m>y07cH
zfoG2j-orBv*-&){%nhn44|t%Aqc1<n<O=!PGBIN-R&b1R@7N1E^d|)$AMkqOl;;gX
zD3=M|fg-qL{mx|ZTjlHz>ubwrzR*#j(b|)Pp&oI%nR64y^QhA+YD|MqRHWtu*em*k
zZbjd(stUQT#q4mIMV%aw((|KQ80oa!4A8s)NbFxpWWRB~U!<-_&S=J1Og!gq+swt!
zv3Evf>Cjwn97k1*Iu}kQ<cBgnb+(8B^$qO>iM65ifs(Km8V~Xv2Xh-M8|e6B*dH1e
zL}i0S3qVvB_wJ|zR}Pss2yME&a>mcTEA7CPGpO>*bQXHn+Hw0wmWr*kc`w7~&7_d)
z9R@UU!5RSJ2=JXa3uHXUXBY@UIUU&!`0&?!vF^RKy~_1zzCNnv(YD_w+%?z$P2Vpq
z-!E|=FbV)0y8jp`evJ)(fAiPIUjo3tG6cVfu)l|me=~^xJ)rz*@9&L2nS{R`UjEKA
z{Nt2=Mxwu)`+Y^{VtzAi|IJSR-`f5AI{%#DSG&J16ByIarTv3fCgSkl;tNnVHYb-P
zO#M$+mw(JNzvrJn)5@>8MtMjB#DX>56v1Y<o%Ne&Q5uz3ij(KPf|F=Wc+cPTn%_Yn
zx>uC%$%QYBrYr|Q#Z;mO0kdp`OAM3g6Kl1(hyqsM%I!W!;fweqjj!X|H10}e5jTxK
zbJwhH+xXah*l65ZAxa+4ykI->9zASYUX|v9>Yu$DOwMWG$1u?m!sbmw)XvXNqX+CV
zO8T;TJjD~ms|fY<{O9zx?%%Ul=vOj*Pe5Xn{C<MkA?3@lfQ2bv<wPY1+Ryk)$i=oQ
zvqzvE+ZWO=0%9g`-u;CO+i}2nO!CZeP%3G9&E?cNH*MBOjizjLq8v=1({5rrZv0RA
z5-Jzbvu#YA03+cYHZSSJs;MdLM9l;kTAe{Bkjy||nssIR=2q-yS;-GC&w-3;mc5@<
zo{!5F4wUEs99<xQ;WG6W)>y<i`+BBet_kznm#qnxy0Vwh17xq@3K5Z0VKfm!83D5<
zwj_q3Ct}6f1}0puJECPj5f7Ad=XW-<?~Kkz`*dA6o9J|O6DHs{8(JB3V*#;giv)@^
zWA4l$!UlUjOw#zAnQ^YZ&o!ydZc0?~i=uvO|8#zZ;8L^(1~SS{fS!P5LQ*iLZT4&`
z>CSxNC7;I$n=otL9tL}AzFP&1%#VN>4(UOD2Rq+}wVbDoB%SPAb~0>t^;Qn+wOW(c
z>Z?ml^mz1;Rz>*E;K^P1)cNMR&T8z;2nHIOHN7Aeeh`h}5l`T}SM_7-TT*||+;=((
z_HNIyk4N7SSJy2FzIYR0BIv?xQ`&lef^tpw_kG(CJS&j%B>E45*Rbs~KCh7$8s78^
z9?`U46KJ*KKPM<(=C2IQ{xx?${MWgg)JxuFSeGITB66PQlcIJLvA`fbGAKkY4YYlh
z^=;+IKCXfGQth0hcgZQZqvhJFy^Qa+UnuB4-J?f3a%sz_6p-fRoF<hiSpN)78Ln?U
zUb3ENrpP((jUTr__U48D{qJ-S<(@V?%FJqVAy-i@RMpO}sIe2^t-PXR`_^L6!AcIh
zGAx-qmSTyv)^Ha|_#vDjFB*)^A$|AGrwq?rswb>t(_57yLr5YR@o#?18ds;F4%JoZ
zddz|uI$zIq3hdmw{Pop0#%n63gMwv;_4Y_VF?<xRW1<77Br4V67WtVVx!jItQ;LXH
zXo}gl*VE5)u-gef`z2=X6HUkq#eU}>;3)vQ`>+6sL7jpzuk+GcZl7FJTKb-bk1Z~y
zM>1%iO|}2_p=3<HtnK_;To_b05IQIe%-`s?Il0;gdDd2|8P@qRX<J*u0?B}z;OSRU
z`l5x}U&GD#9?IWeP>|KaM_>=4WZlp}W@*gpo#@t4m+qLiZ(~g;y<o(cKvf*S!9@|X
zwlmk$`OY`zRiAK}C20>q9-}5_bw~H1)J#m)40)eM8l-Z+mrN!f?ffu_VbAYmdXpl?
z%~Q*FO#Or#4Q0qi1|WE6XOjd76LUgXIV2|5d~44!8x?C<Sx*!`t#U%Uc~Zvd8h=uE
zOAF01Ws-6lm(Vzeq$3P8AKhx=8&%^aAoOs|87`=+)0Sr47Wbkd@keJGwfm_QX!|bV
zZs!tj0s4WHl>pXFFtr|5xr&`7>fITw<Z-@@&^zt<j4o76J9*wX=W&a)OE<S?hd>2&
zG}gB@7Cc4W31L_9#+^4GqXK%ttwDJ{s(AZHW#ldWs|VMA$V3%53ZyJQBt|Oib!GT%
zV*tLs5WMB;);^MTrV-zmvu1LnKRv>&vi-QQi&K}-)j#w^GN8)9e;-BXH_;CL>=vgc
zNr1HT(&HE#oiXvSgLWH^x}l0%<mOgF-l@E?8BnWG4D{u8SMRP@DK!vl9c$tv+@R2R
zc+YV)GHww&(2XRe+?jW_4AWMc2mUd)Z0YHIY?&=@yr83ze~?iI_6A}%@I!#aK}-w>
zs6`caxD$wZtX7olkZ?k4YhYknS=IRN78CB`i}ST}A$x|%fkbLQhIYtj+D>K2Ndmv_
zs5deUaVE!jr(`~p;zDadccxE7eM_SBdi;+3$yvYB*%?^axIuRgKzlG^2NpO~hlxZ!
zKyN(ThKR^W04!mhOqtw^^q(eAPBykHI0twOTPrDT_KK{W%-r9P1CWL0^cUA4QRs2o
zamC`&K_pBk(xH3N^JpR&)(qXz@=hc&Sph?5Nl>Hs<?osgYT_Tq*A;<&=~AH=+D6^s
zMmeja@g?Q4@R($XDNeWatUIH$Y++CDyXiu~pgINA*PQ@xBJ_kT{V7Ag-diR-KWfah
zU^|;Ur~#I5W`u+0y3E;)*|V$F0aXiM8X|6O5o^$0NH>dwgZbrPSz%I%R-4k}QCq^}
z&mmol-9g9Q4`$1O^4Km~zGxM${7ajYI}gqTZPn~lEliD6i2(qhE3})kPqA-?w+2wW
ze}aNhl$-nAb`h8>5)H8z<u&itaC1M^(1EJx6U9hpr8)M<=d7jY_R_}jYx3-?AwN>N
z=l0e_FA!x3{u31SOevg6Jfab=YCYmx>RaT!u)`c=%ibg^a%4clgspvJ!;UBKM;_`R
zH19xxShh70SMp&hJJ1w&O8f2mdWX_)XGc7xOXo-UQEC<W00Cl?!4{y5L0I^jjERN5
zSyOq(_Kq(+c?<Y?u7AHn{$L$w_AKx%l=3}{s1!zU2k;;yxiWjDPHg#FK4r`VB2iT`
zuYZg2s`v3lfv|peCig+cSIZ?rBmq>#((9if9jsks!IO2oiw0&Ev2~ao=R07<?UPM3
zmx_5gL9T~?nI|XAwwN$cX7ql7bj$W0v+TYml;H9P4l=r0hy@tc(|IM1z;u1kDy*u#
zy%u1o23bqv=LBpR!7S)ci<ONr)9vp)^pq5uscG{IHnjjk@1|U%t>9q}_?tpHHis-o
z`*&Bg83rm<FPN2$SEO;D_0GGU!`rrax`#W_X}FA>-$diYL4?HeS=asqS)XoKy)x1l
z?>Rx58%cN;<~oCh$ff@fdBnbm+<5FJFuNEq#`41l!l`!FNjTAYL6v`*PqcC4O0Cd)
z^hU|-$W)0p-bNVPpSQ~Urf71yKKP!7J69SlJD(W$^2K_`1rdX}47kkGu@;lat`m)S
z<$+ZAiel)0G@|$&qyCB!e+P`eV#Gf_H^098x8U*5jz32N5vA(NKf=}Dt{1<5`nL_n
zUyd1nd13&2sAqn+_GkA$&-+)@{Ll0LYW^S5@V^*p09W?sRKI?jmJBri-z<!!`W;Ry
zX2qQZ0ggfcp`_?PWGMfYc}3-%IiVsn4?jPU_nnZaT{*fmv}Ll>v-LnHzVb`ZWR@gj
z4_mn;-G=jfAS`wkt$X>D!|Z-oHy=L#jyk&<Cs2l_fg?u)c+==sP3k0HQ~4x}_cMpm
zNMErR;{;`Up1VyekOKG~e3{)bqp1D_eR~Gq`$%cRAj7ud_P~@Z)CxWm_yB_lgGmqX
zO@Y~FD)-iXSs#BN))VbC-Yhje``YY;2^U~f4#Jju8_7DDKIeXES!dEz=3Jz;%FT55
z^xfmH9`6@*zWmsFQquQMgOld%O%Y3tyvP}5QvhWMg-y@y-KhW*abRHe49pDA&*Qg#
zg0kY@1JxaYmH45h7Jl?6XoWX_8cfkf5F+>BD~=HWXz>xglf9*+OYo(fF_@~S#K?vH
z1i|<L?7{{7UmK;M5oGF7BCxpcp(Wiog6zq(!RL%2hj$KGSg_k9K18)Inc0PwLec`3
z{{Z+#L#{`yWII3(Fc6B#5V;a^L|b?O>;r&;|Ibgqf(36*19%13wVxo=Spd|iN+eu^
zxNaW_qnXGA08vP-fV&t_Le_!+Tn0cuE|9@ToDWb~Q3R=g7+WF{2#m3GLjU_s#Kioc
z^q}Ei6C&czgxFz2MU*4)jy9bPRE9G+n|_*EV@of$=^rP?3HL{z%XzX^-1bOUM^sV3
z3p9ZmKV;<f`s7tOYU0QXkLJid<r)y%@gTR4UVrky(h7K?_Y<R8lYfJVf2>vG00`5>
zg%Y3RR6`jp3*B|SvV8NiEyrpN`0n9&DswLL*y}qfw^!z*054g|(btP8EG$VSfld;C
zhHY8#u*zN~rDfeJXnSJ{t3>7z!iHx>3Lu1g=$8jO*R*WH@?Aq4n_@79X%F&o!?F9?
zo4Fa74_M>mJvY+8+kuTTYz(7JY|srIo7RatwT86ryY){Egl5ty9B5_e8!bX4hRDht
z&RI%`UeVEvTU<zJO5L+&86by;5oLz=Ms|Q2HlJ)^V<u#8(pDg5mbOXUBK}CLV^dc|
zn$fk`Wh*_b>q|$_jxsLuRX+FxY}f=+UqOh?cXEO!Y-?+C2hoUY1;VIjn&Pq&H!Q^F
zJ#11Chu`2+m52^@h}jK*(OkQmw~elAcM+LCtxpRI3py34vben1yc#laV_jRtnW$~<
z>5ZK-7!6)#t!sap%*0OK$<#9Pw+-nF;?Mw3dO%M*A~WD`%}|wD6wx#AOQ^lq{L2u6
z72^Dp{yzJ8-V!dP6ke|=pc3Sb?x}X4oAX^5&p=hURDRx?Py-X{^^65nKCj*yj00~M
zC2J~n+XOGnuB-_kr3t!NlNP{37s&9F6mg|PUA^5WhhJf15L)0Ze=)X%k4Mzw`;=CF
z{cRt)O(41_ZagMx2A)AF-^T?dCu@^e{j{i69~u7yshCzys0Pe~>DO*>Cd5AWx=g$6
zk_Dsc21{p>hBnH2os!`AbtutyMam^OU?k%wsCwilXbN(d%>d9>jhI~U8enylzpbup
z+Z6I9Df6D176_~1od$6J3PEU>MS1nmYcU!ysuqZdiak&m^u}Cz>*+h%^;p-GG=a2)
zVPUgm4;_awoz-<xpNBl^^K!HGbpts#eS1FTwUt#XM0n}W6lqsWO)=;d<PDVQ%y_Gj
zT#F?7NC6>O^!8rrE`oHGwrxdmxKhINR@Zl;T%q*F{#3oMjpy5anf$p+wT}IXID-y%
z`8)Wc(RvOQUJkZ6FP=o1AUD<~QLtC~+KV8A6BHo$2(%!*P0U(BzN2lOjUR{Z&=VRJ
z?+i)q#ahO<z*Z#908G#!!N9`S501|&H<8N}!&0)ES?+k+ieG4Ce^nkD5b{DgsDLtD
z&?I^u7!;vPe3afC3inMg<pfFrp*3vUZ+{mkDDV?RI2vjY`?#F{ZA)@)3ISE|jPu#&
zjYy}kN_CMTOQRHK!8PPeMz2M6%jQnU#qGu2iQu4k@YES7^Ci?~52WWZrK5mC-vZnN
z9Pok+d71XZu?-Ejz`Sw+5w6A`3l7*w>Ueel!^=r8gWJekqhK_&b$s?xIWXNhp2H_>
z>m+egPJUIozrQ6+`QAz{oEnq;6<V=ZV_PZlke>1twC*8#7GF$Y5l7h9;20*qGRhg)
zdqw7X7`#-c@#+D8sayXm)>bKkb2vt|Q39;Q`BBg05@srMRhH?2l8;bw1L|vko=$v3
zdA1;Mr%*ept}%-nfdO;Y25xw_sJ*GiDfh*h8<%{8zPs2?RF`<4={w#2&_Tf5)-^8Y
zjC<D|>(TY=aE99D(QJi4oh$(0D>?Oxy?Q){^bdsUA8OQJn$us<)o;k^-^q1<J4ydm
zrDm_H{{!LzQYk=z$AA05AHWL;7yhNWKXmDTeExIL1kMBKVgCdb|EL!E-(2iE{3|^A
zm;dA!uJ^A*^55HkbJ|&!z}zqqN5pXovtJ74cAm<>Mu3U4pVmxG{fns04|k?>Qd6}i
zhJ#f+^?)H76%DTp0>TUx!9pFExx@%gpK0eWQ%ke!7Qy7PdO1cDG@n_p);7ZlVzy9g
zVw8<Ip!ME7z5pzn5NG#AWNB-FbS1<0feM*A<CaO)0zOGt@8#BgK|P;a6UIc*K(Qu*
zDK?^&>D+nwSQS0-j3154k1Fa?56@}St6&7D*zs2Tmui@%z-<|M(OCpHd^|R&ULON_
zK7n#eR%jy6B&zX`y42fW30%(%*Pgp-yc%#W2%%w1@PrPln7(&x5+0N^*}XNk`Juk@
zHKU2Py*lm_Ui4Z?OlV?K6D#Q&;JgEOa03U@5n>B_3W7dKMUkZ3)dq(hQ{JVs1_##?
zWwMvnbXhlEBTJnZz*GEfoO!A50rV>x`{cA#bkjK?YvRZpyFI;n4x_61ZJ~6f$@{=a
z;gs_jOf=9B+Z7Bu1|>Zm$=AQ$=^`gqB4P;G6>S`R%=#j;P3-cb4XgBMzt34@Wva4$
zoe;jj6a%hwEt^N2T$8pSFwF-ASC2hce}Wp{t~E2SORb9cP+uX2d0QOen|#P=FqRq8
zC4y?6BaH8o+xhimz2f!q>e)B<P#1M#?TKMeZVVZoJi7EUgjWhTzT0U54n@sNWA%G;
zCnA;;j($wSmZsloU2R|BXf}A0@RU*UV&jdrqpf$CAjY<KrCXUUnYlEc?K6cJ7wvhv
z;QnK2!pqU~uW#f87m0At@Y2cdYBjIF4m^!<J4ZS>8cm<2>wTKz4Wwa2^379q1E^q+
zO(TwUsnGfClL75fK=x^IWqz_kWMO=>;l{^!LA%OSjteidYo+!kN0598N_aFlx<M85
zxIU!~9mg4C_SNNw1GjdeXu-pr1Zirf-3$U4Guwh>_Cs_iv7$;W&HQW@+Wm*Wk>A`h
zeX}Sc#_*<=x%0EO&%)9@WwWKvPt|$}ra8_tyx1=MiN>teIx)wc3d7Qu29x<wpqnjp
zr^2I^!_H08q;y}(r%4^m7V;c+2DnKX%bf$KfCa+@)UtX+McEg_pf5e%Ijqtrb1u>+
z4Wrplzk{pvYuV6(*iLkUD<SPtG&fbQ%ooZQJsy)uJm+}en>N+;nudWnr+a-;-5U~>
ztM|093?IbOGJreZR?Q0<1>8HFen`0Kk8DbACB08se2ErIS0^Yeom{4+t@K3DP{iAC
z>8<DdKA)CZb><mOo4NDK03mU2>pP3m)@ovBekytisGEJbjZeV|E{ChIWv{cQ?>P4G
z*5}1W+dc%$@*YS>bP4JvX!#$V1F+5l{s_0@1b>F`)67i*!*^2aE<0-Tku{Xy=a}(I
zfO%-3E4DgT#YBY*&!eX`njbuEk(cW<j&ch3Z?LRY;85V>W#Z;UVx$r{wITtC8d&f@
z_q85<IBZrjHkOyUW2t#PLcv3mMBU#!_LX!Uji@kf&0}Z89}OPxsW-s#8Xf|s56l)b
z<qJrH+3Xo4Ny0M=`W<by;v)qVtDovhV&FqRs&NeZtQ>btOoL`$um@qfHp|*@I-77z
zDmrEMu<mrLCbsw7)rP#g;TqTaF@9aPZ-J%ONkXpkf`koV)}UIv;>+MVA?z(C7pll_
za!(m5ULWGV16W`##2g~#$%(<T@JX>YAMm+-IRKE`vNPKn`@$}%vH0WC3>8DDQWe{1
z%o>F`@CHs`mX&LMKQZniA$ERt178=UaWPKE{^AQ(MZvHGkMmtmNNt0It3{WWza1Ub
zK%;<~y7JgwtuQF=UgGJO6IU$V;^j9SZ&P39-eea*+#Z`Y?T1#pb=Uvkr$#@j;z7vQ
z)HGRXDFyKzEt(jb`bZkwC<YY%s8fKnQK)71!Khczoz1?n2LIF|i#M;RTKvL1+`pe;
zqD?q$2Nci^0g9q}HyYdw?YcYu<_2i(uH$&T`*8$Kl2|B6l<NBl_pr=J?&?Gz<fbCF
zA?}2;su|emc>P;bdh7^>Hk86_fRh4@h4$$x-kEzBO{+5?lJ%y{N7*x2RC?=a!mSXm
z-1{8fSC?@Q*v>YX<FsynA_Rfs17(lTl)DvLcH@)3S-y#n{9<n|a5ugn_i6i{%2_MZ
zW_avTbwb0{50-wh`lESclJl>Bj9T=5Df37mOkJE;TRC}I31_TEL-4gIBfoKxaqcw@
z-P!p<#)L$07_Bb(-Q{UAxpNO7!87p^<e(8vTv#D|$7jEUVdbc$5gYY%CnIxi%F?HA
zbiVfNT?;p2%4w#D_9X&Wi8_SO>n)i)*v{(Hdv!q-HWxk-E!)jltGLj{7oI&9RpeP;
zsXMgCmyJruAm|8p?~R`6akj@;%Q@bY+!^Y$es!F3QC)%O=-#l+j%WaH(%g1DF9!}D
zHSiqWYd9op|NMK4Tj7*!(f4Mh2FvK_goOy|g1Hfu$2e3=6D>}QbRpxdX|+W!y36}?
zWp4R*9i=Z@A-4B=#O1CiHd7}%_sF`j0`9QBUE7f!B-N%!GyP)>#Cl@A<~glX=Wi@!
zDJO)#+MF77T^+BBk|<ds7nd$4QR}<SYo9zn<~#j`Q7x+|$y@04yIR7?yq*EI!9t%8
z8c>B+RwFh_oS!|x&2WXPn+@~orFBnL^X>N^S8joGs3<P*zzj~xCVcqdEXIVktr*>m
zuSij6Wavu1LG|69e<Up7JpNT*Ldx7Mi*@VBsu~ZD<=v0>Eb>vCtvcYh&5vHhwY?vZ
z?VI(>ZbO_yIiRSl3CDJLoWP70PHddvOWE`fBgCRCgokoCtiNuk8G2lOYxq8+Mp60O
zUI~1mD)RlBQhc^wfOTW#Fz?O!#;TFU0JE>qz(@f$<CY$E_0n`}LhW1-bqg!}j8LQV
zJ29gxxroW3oU|Y2<)4MK!B;%PcJM6&x`({$7}50|KlCyNoVd@#xaP0FKbD&w`Gi;b
z+2d$ty6czP1p36z<t$Sdw(go`sD$Yf6tQ}pM+vvX=gHQY<T2kI9kIHcV%nQVmknH6
zizY94W&$wkz4T6a1#M(SEc?F1MRu=%9}OdJS<XJY@)u$>uj^KGpqn!>jq-qPOyHII
z*|P)lTnwl6+ATUV#M9-Dtc$F;yzkTPT8e(uR-{(M_xX_#2`U#B;OKmHM63MZn!EXm
zd{VEsYYWC#viPjk(+;X-ngt)FABmBfm$As!foS--3WKPLPY!J8rb2SAv$ucmDPNxi
z6rT<w^Q#^qR}Xn^MlSlc?(@5<GrO45FvqzfDel~eTu-+G?F$j(T#7b(eQ8GVC*(zr
zv-5nT=5a!X!K4U)IBg@7CArOTu(Bd-Q_Q|_>diBO;4`@kijVKpbF@8zdH+CgP{edI
zPh(4K=Ng}`!gz74d1=-Di|(#OS!6%Qpl%J<>)YIM_aAwmXvlB1NRM<yIVRFi`MGr*
zG+m82EpK>k#;U*itav={t*70=BF&&04$upwMWcIrHQy`Mq9)W-2yS{f*6jIrLRw=a
z4ex9g%O4}+XpFM`gBPWfR#jB<*Hpl|XdJ3NXHbQSEk>sA>YWD4NcpqPzQ$~AtZU>~
z&39ZUE=x<ZKfOj{+J`vf4W%K7S>Yn%)VN6c28@1jx;svsvdsw&+fsbAi)VCcg1cdc
zxMam{h1I>h*dpf{X~I=rWU)DywWZ0>;xj&D{)6P}-&!*@x9Dh--Wp<3Ux~<jc|fU~
zB%IV#u;bxwrH=kdqg&$7Cpe#{!Sr92HtK5E+^vU5g8G7vLuDy_Fg2{}2kdMsg}!QR
z6QHwP7%9GK%IT@ix+NF9nc^kH2vWtxopD~(jfweMpvn{jcYwt3s$sz$iH!LXu8)H*
zO&GXn8GgRSk}*SXIUvNB$xnkDJcUQ<;=l>}Ixrd1<q<C)jf4=4GLPmDvyl_Z;o2tJ
zX5_0$VOF#8E-v0oXk@E}H-`RxEq0&eabcw!V|+g-N_L(?7iNyF-sGPf2v-_kJ>Rly
zs;}mw(wlFi{<xZZ{~NWG6;mxq_H&H$qP?$Y*`W73=Z+aZT#7S5v|YkR;%#cZAG_EM
zqr2YtwSKOPj;WIF2vW1D?eiCmjIJCw38>0g!-Qg%aB^YAjuwd5K7CxdU-3&@G_PYt
zbuVtPtJ0P{lWN<voI9QvrFKCB_qYPOc>`lPLW_Ut-hi^7V&~E;yx_aNFd_SasNrM-
zuEI)%1iE3f^zP=NZEPIVG`mIB89&e@@r0;zOUtQmXXKS`h^=}K1IdkysZM<6v08%l
z$1f6<$n!1v-|Id^f4$5kJx}NU;#A-=cj)P7`1s;=8wngF9#Y*Tr8iHN>zr<4Qsp91
ze1EEwCH3Vk<FYidE^hxHp90U$6(!QbhApJpqAu=K#7pyI7`z5>z4xm;<y4nUx`vDW
zm`n)NwwT1IA(FWZ8&R8(hHW9|a(n3Eg9_twM_<$*0Hkdbz5DfR{_-6>mhBWUmMORb
z$v~LFP^|4OV>+$vSfdv+#Uj#Q+!gkDB;0kN88Ft%a~A^!NZD~VELh%JOg_#h5kn}&
z#}*hV7nw`kh3)i=S-xLk;^*K{sqW&RgPtSs&sQQsO8E>JrwM6jH0=oc^{C=UraQWz
zvtjm0gS$2dbI1_NajaS$MWoEKQP0Bb3PYdf552-6CSw!N&LDsMfJNG{MXG%e6YU5R
zSYenBkt}h_*KzUvA<j9|HaD`rS!!{Fnr(RQTDj4by$tJebMJ6n2lJ|E6_PlyHr4Y{
zSz#S8rJ7j1;5y0=2E^qSl@B`n4oNWe_K=$MZ_oI_BjIOABG}0Jfp{1fq4Q8?)AMEn
z5QvUjMZ59W2sC3wI9{j)JW9wp+0}^EidJF6Lgpc{u6u`eZ(1@k)+X>ng;xbj##(9=
zjifo4KYr@Gmy$^(dt3A<C5S0MPz2l7nQ@}rrNG%nr3ojPqPhO;anLFKQwf^J7&KL!
z*eO80Q{o3{B?rvs0VN$R+@ew(uCAZ4S#vz)A8H<Ld^YhVt0G8&oy%{TWv@CCCKD)$
z^C`0ZK!CQJ)a6n>aP@M_Z9MY6Y5nyP2)0dKzNxstfy{uN2!vqSqMFVTVyz}rAo*)b
zp-!ANZ0D!C#NTW7Rk+<Z=$*<G%k+96L(XyAQ4*PW3*K6CdtHWQm=|gTgGpS2fj0mt
z>NguFwun7F>DEtIkJo3&{si6q^z<XB>z2C>5c`#2Z+6>{?CE$-g$-L;P8EE&&7;k@
z=RvhPdKdm^Cx4D99KRzE-TMhbuCA|S>=rG4Q`FhLlSny+>fUo$e)X-xV>}rE-w=lg
z1;k`_+Y1&Ku8tXz;gfHFjF@=$@Y9gi$Xc|kw;|LdXFH#jSr*cbb3($BXt639ukT-r
zYP`BtpY0>F9mSY7RHP=u8@Zq<nzK`cYTRu~A*Ao>vH=00?o~(t>49s6!sAECX}w0)
z>C0^IrMMm~6B2DOFC1qptrJ<%)#0+275YZmUZiAt1ZFP0-%RkI7<ze!oOm4D?@XCZ
zAx$xDeoVyV(*m%M222O6fQ*JX66M?~3G&xRuOkk<M|pXg6J{J#nXD+h6$`k#3pR-U
zYHZB%{e_^kB4;nN1p2eV?8n@LZ@VLIKsE1Z;a!Ze7$G22fa>R`jOI|pRenKgB9>S+
zPcV32?`%ALJ~3v~%)?@)!xdwwDEN;1K2_Mr#Bc`ONh;FkYf;ha(M+073(@4Y^rnIU
zb%p$$Zoq*9Kv44}0%e;B$f5T~KTebGfxqa(oU}qFDWhPj?SyYC<|of-lQ-Bd?{WMD
zr6oxnE|hqWLpYnxtSQ5K7gYJuroschJ+!TVe{v&VZCcBJTWZe*Y}|#<jbnS`o~R_4
z!aktie3Y>y)x<)&GFlykYE{x`ahbjPt=UpyG-C3FL4jg+3U|{exCcqDjYUYo?VKqy
zu>h#|(2Mn7@{A3^EN87WmqMCpj@!Ongn8G`G+aNxyAXH^#BwNSDhwA>mN+h`EPsd}
zO=zq$IZIBZoNeh$aw~A;f6rPM|0P&C@!eGDGqt^dCmu6z0aR{+GIbPL)~x!m4?YzQ
zfG|HnAAaR$lVSZ&%{mJ|kgnr=-kt%K<rOxaow_8KNSmO93t80xw+zJih-T{$>Ob-q
za8H|0O~)apyFIRMr|kM>uh*pF4B;YL`wno!R#fDfCii60%f##g<lBKTh@%*I8Xc%H
zQYj1R^34%ogwUBK5RRy}^-%cIvO`_J8+WfY^UdD4AoR8hc8l>9_nuk>+({?!o?Vj;
zML(8!Noo#By9-QJx-n|8SxxRxPRg*4q{a4pC!#Qqiovm{i`p|O?knA%s#3rnWZr{h
zSnkPNj*T^mdVjpB$NTu)f^yYMG#C3EV-t}0uG9$B)f)%USurN!$$G+Lwp9g~)r49?
zRucfrM#NN?b4)aW3DtVW#GRg8w(tP*o@b__ihGzg#0e3G2l7Z<4NXJk2e8R}Ysu|f
zPvVbu4>=*#PvK4<ZR%h?Y)7bgqRgAUiJe-YOED&>3V1W|>oXgva;vJ@nP*9!04dCP
zVK&!?6~dy%zGew)!E9cftC~%fdM~l-MdQ{jG#EFbuQG5N5}E_e){?bCvM?pQO#cX9
z^sO*vkg(Jp4R%r5;d+0Kuj67*vx3l)(1)V^NsddU2^<>vb^v^L<@oPH2EVxG|H3yn
z8vgUepU*!&slUuq|I^=Z*1Gq<@&W(Lw#8q0>fd$|1Zw<ya-$3)7;;u-HVj6OWi7!$
zy3pYT4N5lYwSfgz@@WhLcf0#LJS#7{6z-lM1cLx3XaZ$)cJDFeD!?b+2UG4E1#<la
zz3d6}`3WkM9sn%m9AuAvg4Dq;z*yWY`VA!x)d@eC0dkFBoFMZHs7iS<2OOaBZ8ri5
z#Ft~hp&B5VI=rn5?&NkP{SySdv9ta_nopz<{vVDe|KA*3@V{P{={gx8x={TDG4YTK
zQ7gS90AvqZgOKua|I@Mi|M}Q#3a>KpE_^7RFhC)W!VmSK$UQ^aMOu=IFFx-lC|e4L
zARhoH-^ob-UymI9&qpQ_{I)j%mZ2te0Ycoq17v7rVW^@1*kREBbm*P`c<BH1?XSD=
zKYjbxGyXr%ElA}5|1qJCi5A{sDCwf&{K4-AJ`NB(Lc+@Yl2;|3Z0|!9OR5!5avD^i
zCqJpTpLoPn5!e;Cun$A=!RIPwYss%j{6S1Tp0sfr4Yj6`w^olrl+8R84gI!gb3w4C
z;a>?LPYrfvs-M42rT^j@0aZ@_ViEl|m4@X0WzzB2O!24k4TFs@j$z&&5ZY;FU0Zk~
zH0nZv6tsOrw=L^%L!GM!(sr_>i$8e4w2nVpG|e(Hq%xM;5Z~A1iobd%+|@;L!Ot$b
z(?omGy0}<5l>S7?@E|P{;50T74rBIHHo!84-cOsjIowuKAw3|`rukV}`<~8K<<0M1
zptn@b3&-mHh2Nj79yiHIP3?SFaI>0q;!Xn~Ul7IBh<<6S;hT%WuDeYl=E&900|n=<
z<Qm9@%*AVX>x=d~Prbevv&xgB`E(d8d-h#b&YKs<)Y&nOTQQQq>hw@q<z>$y7@aaj
zhe<BpPvBKvez_4dUP*(8cY_w6=Fr;AT~-iCipy9R&U<xQv?RVwVbQ(}5L>CUyi-fe
znbsZoK6y<hek@bgPGMi*yv4njR2It03NC$bFKfOyb1nWJO`A8DdY9^|ONoT|!p@U9
zZT^0rtZ<I~<|4rBB$as_e;~?=kxexY1I=ANrF1rPp%N%MbQ6!?(M@OKtSGa$O+B9O
zYsH(bio2IPR1v*xYLwYYTYsCTkMlK%H%=37F`N}FqV^_V#}Q92@zB{7?sex@;10~n
z7L|L|VA!kVl3b*2c|;%kV)2#Y`-rFSP2!oYj(y0OVF=E`2)^W}wQiPU_u^Nj+i<cF
zKE_s6{VaJ2qnRQ8+~fV{<*=|(yTTa<v}U%9FK2ihn^DIBui4lnEIj05MWF-L3EE?Y
zdGGRbhZ^<F(&iRl9~1V>Wa^6>`yvb~u&=7FHMWdOGmK-WHT?EqFz%qR;QdKf3zPJ`
z!^qne5flB&h%fPX-S?H%dy1~l%nrz37u=26lnSXSQ0(+yQ2pqn3wo5)CF8=}&BK1b
z=u{}vLne#-2f2>^Ml$}^Z{?zv#V^F$(j2{eZ-<N#rdHf@xoA0G*kem=BX!L7-0Ksn
zTpVO4ciTr2`cc)18|`Nvev`Y8pBe#&TV@4ceX<uXWI$KNYB)s~Lci2mSRrqC`NY+k
z_#4{8-j9vP#6L99e~HdEzq0q8QA{%}HsrRxT5G`7{63fS=%nf|kM8o)y5!h`!?m1q
zR(-AumX}9-zfPCf8*l2M!c)U-&y7J2X*74$VDTZoUeyN{E)^4^9)f;%-h!>$?e|L(
zbD1lsbS2~sBIZlyD`OO=6qD}Uc)Q<AmFctuxZS9akM}7}%K+I(<42<MApc;0Oj7YC
z?~<DZ9eV!6*o%T0+V@W$G3uM;zCTqfqtEKdspCcT^;HyqcwI-e=VBhEZzPW1$>rgW
zt;?4;Y);h$?9D3sMWZjR=uTIb)v!efTn+ywfR^9vch9WBfAnz35HB6>ec-yaESMo6
zkn%lQ>~;(&Pi9l`VZ!msC@lsz4Z3>c#(TCPVoWVi-OBF!%8|y>SKstBLj!j<5rL#4
zB{F-chQk?lmIp8V`1WMhbV0r4gL~FWzO^G85}SD`+bVZNuLfy@GU`v~mNeM0U(jB7
zsAFu%oH9D+Ke}f~V|eX&vEK0tXJ+TOqQb@;iVD;-xxaNlK(P6%t3XD7EUI7rF&O%%
z;q@=KAU$>N&F$xbB8A6fd04-!ocSk>B{E}S9~=s$lU3JP4)ZE56R7Y>y4jwRtf$GG
z38bxGBkyF@e!O2Wun-C><hfTi_5rJp)EuC0B&Rn~&nAx$ZnFr45ev5-tXvsZG${w5
zzgKGD8~v$;&KY*IwRjh!$CH`$zO3v0usnc9RI`*cH`CM!5lCP3>4J0#y17Wbaobh%
zf>6o!-u8mWz{H~K5-V+TzxB*vyKC83lzAPavB(A2%$i{}DJy20cj+1WmHivsAJgr=
ztI~rb)x}oUMBon}9K=uL<e)A=Ha85=OR!I2BuwC3CJ(vbNyr&O{k74j+9!UrYJaAm
zPfVGuQVMch{+nzPDE4t{6|WpybLDTcNmE>IHc?P2qIiPb2=AXKf12&mWui=1Q&MaJ
zYLXcWyoakcA{eHBMEN^Q*v-;b_cF&e{6$0&B1tiEn!iI2v?iYE;C%XH>|y<VE$ffP
z^^sO*ClW1=q+=lE>&VEnQW?J%vxabo`Pq($#GXEwhkd_2J{3ES;_P}(x|36VU9uwG
zh<-)Q#8rDS;NB<77?j%L+UaqW;LDOBSMkyX0srMM{5-X)&MPr74i9SL+LXl0s-%ml
zsS}>j&LkEsn2cqSA5e_0?Z0Ip6!iE5MCk$HGQt7Y*6>9KZCpkBgBj=W=e`sXfR%#!
zYHIoz$JEUE66W&`<08FEi_-|82^;xXyC-8qQo)|c1*aAe>~Gb@!B15gD(tTS1aJ>|
zIH-wX2K8D#%xg?h=-??`q}tFX*x>dkyjp4z?*9{X1t4Pollxr&aKB|U=vlR=6dv=1
zeVdC(Zt{DBHzsiIaFlq_i|0Ohyt(bV&<)53G?jR1Euvt3Hk?(<S~&X{nUqm3YxB{t
z@1!r^lUnfE>+EBV>?oa|ptpuiB_VL2VzC+g<?COobOcEluw$7d)ya3jfzI~`-OK_y
zU;pcu`p8>h69|hN*aLjT=lggt%ZDZn8oI4Ly+_=(4)*cY+<QWaR(6S-C)Y7;y^ENi
zAp9bDaunPao!F-j-$d@J#b-5na@ud+%?G##rRDS1roPZB%juTH{G<u??X@5v40@i3
z&n)|~-pa|CN2^ddD)9V;U)OfXqPI|<0{0NPIK4yHnKF%9dP?bXn=7LI333CB902aO
zi(nv7ewhIPc`~n-kS^AKQ<#1H5k1YyAA0lt3D8?xl?Anzo#gkjE~@P7C<c-_b%6jm
zqeF55<e}r8q`m+~=7OjEym7zj-|s0c?Wk~}RbkYZTSrPUhXWK&`1~HXQ-*78p6xa{
z|JG|C`@GHiI$UBw2?GQjIj4GfjEVJntpE(q@XG(xPf)LR`YuVNOQoezwF2fM_0_2R
zN)Pl~@8TO$Vo(n9N*Q4c8+ivU5on*YR5ho%c<0LW;BlY32-oaJA33#ua=-szGONMG
zo^N9|^W(B1p^iuY#{EvKW4!-YAobT$`ImL!zf|e?7bzk&V3+pC$Z!v!TmP0a{-Rp{
zt7?#Xhk9<7l&7^&O^!~3AMsy9P8^X!2=c%ZH;DjXI1e8qC{csX`$zxwtG~$606Xgc
zHEVlb<rz+E9@*MU=WP&e0|Y{1jvgHsQtmZG^gZ_G5aW2A9zfN@kP-vhDs%?7Q7#My
znrBTCQd*DVn~*tcSBl3ce3FZ?23%f#i`R``9)(%{6*s=DFa-m+Ixj6&V<!H=!fF3r
z%^DmF+RU+Ry8lJx()Z^yp=TD|lA=Mvi$8*uPm1x|;7)|iTl22Bs|k&kR0N53sPx9x
z_ax8EFmt;mo1e@|^iVIgZ-y{8agy$RsvT3~AQaug8NYkkbZcid-Q7CJXyF1+mfcD1
zMe0!xh4+j*f3emV`3NC%0Z1+@l3dk9aW2mK-Fws<UGu>iEeCVMTiCD$P4iJ#evSug
z!qlZeU<VQ|jt^+(WD55RK%OBWjH-tAikNpLCATl>1^5}d*XcYGjZy76)=&yYYvEzF
z*wp1j7Z^VQ24{4f5OMS@=qj{qES5h<?#@ZI`dIF5XuzM;0SYjd;NuIv)~&kg@T=zV
zU$;o?1rE~AL`}G~t1;35MVdQI*zniuL-b>|yu!C77cUsGvvf;qw+FL$cxZU<{nPCZ
z`T~NrKpx5>7~tQQZGVFDHZ@Vu^&M&o13>Ep_<n9g?hW|fbip7kfMWpY&mUL1Uv&@u
zP{ICu{+q49f5Cfx5$yiWf8g*H=>bkE3gtMDwQVt+>iOVjsjCzjjTF%IO~7n~Ja#;P
zjD@>ETFx_7<$fU&N_c~#z79~heuAKcSd6(!qq2HM+S=_mZ{N4xeBEiIB^sq%PG!SF
z<Rws>VY}MsfhyJ7057DRkm@TGRT-)BS$4M1&6UaU#f?gJ3eGmzY)qo`k_+h~p%!Bu
zfI+sqg~87(R98;~ig@$<$iS}*m25@&Uv-fix9jbkOfXWI4hv>C9Ztp0ZrbM01YX8L
zL*dR~rfmBbQ)+$OIjy$?^W<x-x?gE$h%(Q$Ph7s*KyHD$qOC2V7Ht9cd>IVS&H23*
zPbEm_fUh$;1ht$Wx?@F;rq?JE?Kf`tJePVpfdO=lUse5LlUg-F3a2;!#qlTTOal*6
z9|L8J^qCMZ-7<f&uf6o}>!)oDTVik|$UReS-T#^Eu~ctCr7!0ug~rzF(PDbm`_8%O
z;WGw4{%)H*xGJV#)M-0hoQ0>eMdS2WPM`GrA{Key3H>U8ZkjodE@~kzP5KkH29Z^W
zs?*icUhy|DuG#Z?n<w_<@!<&wH_zi^(GEROQQxHDAY}NHkM7A=p;uv}IFi8#jDv6$
zbI_sCT#c<x+>7^Fzg;ycy;^tc?#E)+6}G+$!M&cl3ZNrcyro}PtLY0zd6SH>mqX5T
zJc`K}X(_53LR)HXGo;|^-b^ah;~oz`QNFk$q*LokOndezC0;jE-z6##LIAQcBf-2l
zKQa)$pbF6%on*b?CLW%fAh)vf@x+x6l-*6<{RsfsWrpz(EZh8j;{vZ?#Ka^ROw(q#
z^j0rH%li+YYuB~u@1n~3Ro8dHb6UZG)m?AbEce22ply}|dYw>h6l?N%%u8bw$vO5a
z)?`;8LyjnRBjn_Q>)>T~a}-Y#w*#0S7#)!({Mg!gg)4E95dhH3Wqx>26?44qTjS!U
zr)!8ndX!F@>W9xYQ^A^Iy!Z4cj|{N83kNNUv7EUx(b(k<Jm)4k=Go^KH=%8nEcYMp
z?=y5E7H%Q=Go2C>;f_opaEASTpdSMr^H+|_G?GekU%bAkMMPd!pE0VoOL0)E+?DEl
z)o|5~Xb$U#VuQ7ud69f$akCHTu4cV?gtpQc=a1ZpKJ*J}To=MSRby`+O>9aCwL6r6
zEfPC2>YegPB9DiUAwIK8??{kd_?+L_=&F>o`QW*CmZUXL*aH)Ep+;5K?CO#*wB0qA
zMV9FwhqaUCZp!6xrpW{@{3`+jPOLq8p6M82%3y3idTfTv?_JpKG7<aBY{ur-3&aCI
ze*<NPqOO#pDj@UdCVI*@HYhd*-l{`~>U#47-YQEjm+NZ|oPnk+0W*!goni;9dKC}2
zmh*Dd3}+AX?_Q&{`W>&C$(xQQo`p834KyI6AoV@O+7CsiuP(YpqACH+r;OCuz&j&N
zN`x+hVg5lCOL(s1mF^D$ta2MHdg9mKrRp5!JP7$7vjuT<i=UCjy2fI^K*QMljYk2=
zTHp=)oNLeg5<MLkZLWz&OCL(+Mi}3|rpU4gEr*1XB#Qk~@NY(CT_k6A0)U+M8s1Z8
zs5rc2RPijSdER3&X{O00t@j=dvXM&UTb0YG>`V-LhG|rq;Ua(>H!Z)^-%P&zo%LFr
zeN3sbhuen(a41EdWQR@fBD2lWb_Gaq;@w!ytY%h@N+XxGxKy(mk~>tcCYvtCM~NCJ
za4#?6x51R5S!x*Ty7N2=Oc*d2+Sk-b1)hS6vd&rWrF*9y-k3x<93W#=xaRe5%*k)Y
zerUl}TOzs+cojzMDzMejm8_34TQTQu9l?{io12_!rY;IU{L1`vgZ4O46(|ycifgdM
zm3bl99sGr&z#SQJN_}ZXS(kGC@XN<&rFCRn@ODPM=QhQ{yA>{`#4sR=#V`g;YQZWd
zb??fCESM@8W);=?{>yX054e)i<M`W${FIw1@+12}c5~W;mhBsyb2oFpH=7&Vq2HJ7
z^xi*a0Geopva4}}pQAo`rw5z1_h7b9t!9uj*3#>qK42e0+?(}07M1g2Bl428JU3NB
zHp|hqTr^2MMvB48VQ6KQ8_*)$SK(D>JYAoHzlaKuBlhg<5*xd=e&lAAI{7JgH8B#x
zbMyc)v}yIY3_&PuT&HB#BL~Z^!{v41<vxvRKZ*nHIIVn*VE>+wK3AM(BRQ_(R-!S#
zN%xv-!!3ZnPDdaiOwH<|ytq~#6*8eo!f)G{oE8Yh4a_4Wt8-8+E}NB!bRFOs%Gfw~
zgRO{;n*2~ZaIW!Ku`Nn14A<4n>DFvOL;3nbxA#N{me`K=F3nYQr_uLx#Z|V)xmT)S
zV74Q^vbw_hnSFDJ*jdg%Cfw9b0taq?FX$d{vuhiMysbIuOYUy6-tSS(8PeVHin}Tn
z!O=|f_>)?}VBoX4ZDyV)egUS{zkCo}x13LFeR)DoTl;Qjmb3SWHVMia=+Ib&Gu>>&
za<y5U>h%nmC%V|1pmwz3<!HSpMsn${KE(;gB>mHPD^rN7grc??=2(1g4emI}L@dXz
z%L-MuYb6qcc0l=Fpna>>$w0<jmUfh3QyY!N47BOMz)~IFIKdc#>OArK8d5s9FxF>!
z#`eDL)8;LMW1rQy0(}TKaQ*?k1`!m|@(IZ&%qrNMU&}k=o^p5anSL|S>>T+vvGkU~
z4prv1QIjcrQst70DUkedd4^b{p(-T-IWDG@<tNkiOVib|`v&cAf><Z;8w4S?u!k`c
zW~&y<_*Qf<3MWbwJ3Ij>zJsz|`@XwP#c*F=9;L_-761~#c)n-0-+D(KEHcQ^o`>{l
z`WC;ti%dM=uSJ|%G%=<YND3A$jl~_zO++=w<`UYpaF0_v6HA;#ax4rQ3epXq>Q1@b
zXV<-+QW>mb`c)}EtU(cjAP9e+A%u2{;fG*gi|>}=-2yjX?{mF62!9gaVixS)=~v=5
zrPif^osDQ>TQk999joL}XT6k*YR|F?Pk2~qK6(*MEBKNX63=?0c7K06o+Om-SK8J*
zfi6C?ew14=;Zt?%TZVIh2hC^EgL~rALF*ll$Yl^a_EOj4S&UlBvU!(4GBQJl_wJ!<
z7{jhM7j>@{if^;!L_=g(Mt^Dm5f-RCEFqblv3nZ}t2sE!f5PGUHb<f#kNj}~`+^@$
z7K9t~jVD~L;;rg3TImH5oi@^rJlQ6WjAV_79Zk#QY#gf<w(mdO)JHf`2H_QtyCNu5
zt0*=YtrMqDRozT}-nYr=TP3pDf}71Dubw}8QrOKm7fQ!3J4RsBBbVIAnY@Fv>j$)&
z!njR5pE16B{ETI)Fuv-Un?PJ}v|LKk!8IP|-N=q{)@t}CG9~Qd=4UW-e!1DgCDj)^
z?t`K%Emk7UombE(T{R9$FPOIJJRuXz;U_&|6nig*<AO=uxGY0AUKjMF!(AmQrHj^8
z%gIF`<f>ceYz3+r8p+GAb`~fRB{MB#sve>D>~ZgP0b<_64{2utI8II!tWm_V<6-l$
zNY1sRm#pa1@5&m}_TRFzPMSVT_v;p^ew#3MI8T(hhMjQ(!3OUJ-b)zTS0LR*g3oac
z<~{l>Ov80R!tkGQlX^b`cI(UNCitKS0cRuAH6hCxK`8yYn!)RLv-T(8Lff9zc5?Ws
zIQJOE>&s|4c*Sfpk5(ruFVzUiJI`wU=yklrrtO;mmE`wci5{V`{36F~?HD~Siy`1s
zTzII?R!L%eyg;x0`QD4sW^egj9$QHb@TuBbp@<4aZ~!7|gHrq1&S`~+%QT)FQX9xI
zvp$TVk(Qlm{oL55$Q4&|LEKWY2RYytHp4M^se+ukl{Ye%Y%aUaT3)W1Q+vs-_nhL=
zHIBWU<P(!eADB9j5x!uiyO>tLv}QjwZT;pk8*e?R_?7E=RiFzYMobrKI{k_ffP#~!
z=?uxbroJ4oUVNkK@uTC$0L`r)X?||nE7~mh^Fz((08WzUScz;vVknrl!U4Hi0YBM>
zlQIqcfx%O`=TCh}_u!JMX#JYhz<*F{a$js4#YCdT?E__hX#x#!+wJj;+eX7K$j$qo
zJ`HD&0KmUca75f@jqSyoL_x5aOUr5ow-G~T3C<S(2Jlam!7)7tch<S2$8C5KU-MNY
ztM~DAhh#Fpn9Hi?cG0?T`Tj(O8i;gjtihZpPk>^o6J3og*Gu@;*oL#jb#+hJU(lis
zUxl6z6s^WGP`*GaXeg=)U)Rgl)x<cbtdH-GZ!{nteuw_xfQt2O+?LzTIDm)vOKe9&
z<`8xAk$d0CNF!|cScAg)4?X6OH6;Dh$LxKHeCtgLxPvyX#5i81u}eVh!HEN<OvIzD
zz<7DR8QY5LXr)tGhjISNq-0I!yO@bi7Y1EiWTYB5!41P0KR>`MSM~tE&ZEw8sjlp`
zS!IPN)s#&Ai){Ni&Pcq}xcEM55;~vS@yeLBPNFgHBdSF;N^ax=&+A9=A+#_2Cm4wK
zXp3Sno$EL=+i4urjk|nz8WJU!<EP!V3|E3o7y4-L;vk`w156GXZ;vFi3(N;jSMC?R
zTCRFG7`3Fiui3Jv%EYpO`kdHdtp~t3E&AYgwTqA4&N_a!a^!5bL7+JUBRDKq`HWu#
zC?K;IlND?oAK#A(E<fK404m6E!1D`%uRceT!sW*{d|-);ZE!AiN~40UTe`-KN*{&d
zw?h?js=#-*>V&g$9{euP`WtKg<GT*P(j326j{i@q#ov;wzgLZbTnd0Seyw+b(t&`b
z(4V~njl&fs+AO0_=IdxcH_M8!jOvFWE6++!0+mCHu5{`vXNUe${&X2l1LO<3Rkq{R
zj~e5Sf1cKMc};T^ma*Ulx0?-_SX+fWmta;DIMmcOP>YZ^QrhDY`z|7ukY^r&=(;U6
z#$T7_9241MqBn%vRdWY_Mz#<ic4<_ihN-y`pPl5zrf35DzjGghcLU&8o6^)I?mggs
z>6%t_@G$Y7)JZ%sAyVb3;=-|}*sNOAr%!OZWSb0_i4to3lr!OD^*VCdbNLF^7ZacK
z6BI4q(PyF(G+T+boUwJA?kCrF;ot#{v@M8=)Woe#wTr9h3_wr~=uW|u!|<r>#Ag4D
zUw~<u12VkF|2A~_0o>ID&is)4fN3BNXl^$}e)GYjd&jY`Ty_P4pgNJ;*8u4$yNdhU
zm^%v)v~JfyI-Id$Q{Mn<;j~JfFl}c9Xw9kD#8$otQ+ksL&ia8Pq!Fe~2UN^+fM)bX
z8$it1*gClQ0b@+WbN^y9;_RdP>INbzfJ^Q#r69ab!*Vi_fCz-(TwfI(<fiCJojf3}
zEJLJ(5-vLf%>t^^K-t;;E97%b$Oq7lNT`So%vG!37GFqEbpr&5^}U;15Z}!V@8PYz
z&hA+xB&lRd3avNieU#mTA!;zH^ExD-A1Fv-PH4O>Hno0|*h=9Ton9QRh*hqBai&kA
z!PSgcTkz$wqD+9e2Ra8zuA89D9?@1ctFG$9rvM~z6Hz$ujdYJ-TWGt%D>*DAQN5(M
z!tl86nEc}T6;0>T&tnyh+9yVk7wT!w6AM`gv^1og156FWb|`|*n`hPuYnPHXou;Rd
zZChU`$Z|VqH_0k~d7}}_OGtq{pEuHm)MftQ4Fm7=0|<)Rp65dPWY{6FfT{Yl*gN~{
z=2brgz|)n?Lyf@Y|BJUb4~M$#|A$AmWGnkV*6c)yY?I2CL@7c{CF_LjWEi{bTZjsU
zWS#80u@fPLjCE#G*=Jf9X1Sh^uB+?5uIv8Z_xJf7$MbvsV2%UF;ryJR_xV2G+w1iL
zIOV$V`<%eE`pl`fA!D^}K1ySDtqFdgAr==yX<$5vw($<xzy?{f;MO0lW+Y7El}Vlb
zWuU$rSWmb@Dneb0Tnkjk&ooxpke?h3H~E5(P}N+?F8RD3{%rpCtCo%W4?oh1iG@j@
zk$CDbkwHB+hJMhCo$1@>dCAD%@;aSE?=z%X$53xhD9?pDQP!cLjrwY}XY!qWqs0u<
z3t-=uVc(KaoL`3IKc6fOojMIB{3r~xx;|!BJ#W|5xc>P^zt)441IP|D^G;;7pmGP7
zen@Rr)}(F2by2@Lp@g<PRmLV^7wU%y;&U}%n$MVO9J`}vh<_gm>;o2c`T#BabYS2w
z?Ew6z@xQkN*f$k1tsZJAOvFNCiHL)WKfC$w75^)g=4g^dV;St55#+UsCnlOAfXHwj
ze`GawlsW~Wwg00P@KmucbN+7llCGu7d+!G`)((X2<<Ua1c=iL_Y1<4l=*Rl;@ww@`
zlBc(&i(vXd%VC)OcJ1!t4=_1Z=*~JoJ3jrTN_Q9w0AVje)GrfG=lDhvU$jT)txnxc
z?r-_Y*m8=krhkFo=$6+2o!9TM(@V>x2KR~BnNlgPtJ5*(eoaYT{R1*7rD)mER@?S1
zbU@o@kK@$UpnHOM6L!<8pPtxa7q6JOOkyqf2tE6ArfHD;_n9VW>H#&^iYinXwQ&iE
z6UGHtLs64Qe+fr0LHWqQSWiSm=$j=bxLxovlsEAG>H1>hm8J6zjsft7M7C*86Hm_m
zirAR5eedztMC3R2$(lr7f<1}Kw1U8G$DrywdqUjnLIQf#bBlD<CKaN8WNx+(nn$de
zWp9Pqx;Qy14LMk(cY<Fpv4+Z$wTV3#d4w=ob*8fI{PUZ&FBWX8(ISwJ<O<sU_5SOf
zw+?G`@$dQc{|3SXV@4llIz_~r@D23@Hu-YWnM+pS*`0uFeD`pVM;@AA+`S~S`f+6c
zNvIh0UFc~_eyC7rCxRnXG_;@Be0DYe=nsv`?c=X=KR(<-u3Tud@bvCQYuRp@DPBEM
zHhBFk8ulHrbDzk$3=Ug5tPNRKKJ02ajn(4QUAkXg@+8D}9QjOpi{Y;Gy&sY^(Klrd
zg=w)zg9UVX;NJLmgn({O4x7LX6ZVz1tc@;g1}Q^d)cVdnZyx=t28a1XXR-l-vJpxS
znITV6SAo#ikuM#-eS6aHMp4A)k>szwK@u^N$2^*xt~rpNErU#s%463(SzG}1$|W-Q
z$(~%s9+>ZV8-$SEqwceo>sO=TkMgLo&1qYSJ9|xfWBDU{+gAj9MvJ6Omc*wdL6!@_
zb+Nr*jvM-~=81CqZ+yRez9M=5=GsM4759y!Qr8;gDyPmjoaq9Az2U-?Mu-z6xpplJ
z!A^$JF1j>K*e`S;xX|!4o1V8B0CAe6+jzmstnr64_pIn&BDyZ3?u=OVr4e=Ku%}e!
z$4)dRe}ZWZ-m|&1Ie;#TzI}a+T<3HQ_v}L-9JrF``G~R@WxmiUaIMc1M70TS<m&o`
z8OMg>OrE~PqPn+NHE%r|H$8RtDY=4CFMfY_2T!zGwzJxiCjb*}*%xXXYVZxoyXc$u
zJJX6EwFGh)xOa!Iz{|`x`^_`8Ib>+Jc+yWLzTM(c6HMR?W4!r!qJx_tP3CIcQN*L-
zobVmb32a(%n?)+7I?s|eSBgB?RCXSU2F^PZ3l((MKY`H_*n#-(5Tay$jJBRbfSg;0
zBz`H@_eny*TSt|f16%<LBQqy2Bqy5LeQx)F3s6cz8R1eyokH^QccCD%f#wCCV|s!4
z_}INTguDSyP}NB#Dc2`b3A9gfFX=&{g+%3k>M>#xCV`!w$Z6Fub4us3id6eTMTAk2
zeQetJBmB_)Aw9Z7hpS$qBvH$`5;pJJf(XOiEoM>h^B8c<Om1aEE#`@i&*iMnxdhZ1
zr8|0}@?WE)&y_cD(`aWvOR2KchOycz<;3Xhz=@45rFh(#uM*Dvj8!tUpYoHyjo^(g
zJaaEQ1{^1HDt^vB>H5dlb&X9Oc~YT<xr(^7I~scpgF|yhqPG(FW4jP&#^v2jX3QSh
z6d&CCIxuEvyw{3`$H=+SpRR0#ZYcfbGTX!u?X68|h7PfVoQBA0*h<NNN&JD-6Dh_a
z;?ND{h%&bf@%FdjN*^PKmJ%Nh_kZR7V*O?{F~n<`eHMXn?%qyZR3u`SA9|c>x9#^I
zpL63m(dM-p)o;ExK34>5xN4y=_fTpcr{F?6+93x7m}h?j0W5)$dGc*|^+dQEvTC*B
z>eh7k#3$mMCS@hdNFs15o0#FhqJ5M#c%Yj-8FEBdhj@cHh5<j^B<mLy#qisU65g;B
zINyCYRH|T_eAbVj?pUfGa?C6iS{JYpi<jsXQNlwvP|M0Z@XJ%mKlqVqPms*68SBAS
zMOxN(JDM}CadaHT*0|x5vQm#{5<`cO>d6o{Bs#W}%8KtV#WxHOi15W=b->pfdDKty
zPIjgRZPGbTslV}&9I}GQC$hb#+1Y&vSuO@w=f`RrLt;GPp|!)V>a$x)mG_iADqdu~
zo9|&Z=%ExjK|@(Xk}#fpMB9EUUo`<4<!2jWd+t4kmuIHoD`SLF3V}h$E8?(rDV@+!
z7$IOMfKmvT09epO8YtNa*jRKfDzb9pZhKwxG{cjfO-{??HD{+RV+p!J>zjs;r*91v
zW?~piLZ{FJ-Ka<~-qhV5JZpdv#Y5vnn6+d#ww08|Z@sV5Yh#w`O*iVe#bGF}B4~0#
zPEb5dH-P~Db*PTx`~P{UGzQS3;W)2+Y~t%(WF_FHlrg*UZLHwlCHBCWeo}Y3t<LA2
zr#{G8%fpZAlD~2sI^3z%bL%<X2|5At08x!}naoBs!3P@>O$*>O#6;hR3gV4zX2kQm
z#pIY1wIg0RUh<b_frNEb^On^Zn5Kh|e2$ocNAA2Pa^feu(SUtuOJQ?Fr{Kbl$PdHC
z4;KUco9ZlNWM1gU%iI?VE8vlke8>2O3xc<Re5eTtbaB8k^tlRfw}og@6m0Z0<dg(J
zj{zl=Er(|x`a{>MJ8GsBDu3vxVzpXLnkHPFqI=VZxx!R6Rnz%z9Mxl_^9J-3I-&LX
z8^3`H$eiPlyW4Zpm^>tYRM1_Cm1j%Q@KTQNlfpxX-{QwS=msZFe1rFyr6m(&B|<_Q
z$SUu&Suu!M03Le4H>N<m*x%1J(e@;}HDM!IFLpT3Fs;Zm%3W%Vud82%wpmg};WB6o
zhS>(@le-Lm135rJf$_L*^h~ct6>?)m<tD;;b`jdctjyXH>~c4*A&;&94m;n-T}0O<
zsss$hif}**K#6WE8$VcG(5uYah#;}{oU1rSVnElY;}4SNed2eKvpvgZVWG5eQD8-3
zZDPf?whuRMkwUur^W1+-8g%%6YvNCPR{K7cf%|^J5zwlx5Ig{=*#&f2L5@-d17A!+
z-`&eHXwI8&AR!b@PUP}j&pnN1ruStr6ulJ>WHR}ih9rLYZAu4YFEU|Kw1L15=zJ56
zY*xXZ6UeHHB}>=$H98sS+Kd`&Tc5tykL<m9I!YtE_mwwD!1ZB*-;V7NvOS)H*-oVL
zwdG%*bRWO^esNau?V@*YfgI<~eQ(CaAV>$S5bu;-oKKX8q$sjJJ<d&pF&`$^qXjn`
zgu)Y@7sDV%WL9vLINs@DC>U*fgXm_WAvJlsHq2(OxZ;(Fm=KM*LF<j9tp++Y70U4_
z-VQ<dQG66ti&&1dB?g}lpFXKgdfZmQbOW2L<|>&QEh#Rq0(yE&;Jf4X>qiP?>_NgH
z?meKwO3y*GBS`dRL78=B$Pj#O;J$K<h`1^A3LXoeaO0Uxe3s_!sggY`UnehgMvL!|
z4DF0AH+2a}3i}~EbAg;)9jC6(AfHMV7gLI-BJFtiuQ1=d@Nfkc9pIr8E8gyjv)bgu
zLw5qlD}O8{>dG|W$-Iff?t*d0o15g57O%I-eQmm#)T=Z#IBx*M3ZLA0Oo>Cm#sr9l
zolCr@02^Wk*!Xt}Sr=1E0^<dr9p7QqV;_7yKW9|tz3d)u%=`8hs#O65R#}4I#XoB#
zbNK)zkx;on&R*0}VCv{lW6gM*7VL#9qg9HD7<XPkV$H*6^G4(9XH<<04l{&7OgosV
zb4#`0flYXz2?m)Y-ZGQJKWWz5*i_w=W|6U?_|_}V2&{5r_^7H8NMH{|Jp!bHQi3}-
zegoCy6d}G4VIP42+7o9QI}pO&qk96-r-fm8k_c8^HtjE;7rX7+^JE>WKG&DWFO^i}
zZ#rjptyD1kwPJoLWVwLX2@s1y)%fkjEvrM0eYa-uK2-H&CA{IacErgD_6H!m8BrFw
zDTY_>Ta+e-kRWc0vJL<$YqT3GI9pu5M#(o#RDNtdeYBQFsABH6^S$u!rXv(hN{-*s
zEV3^T^rRP9<EQ*$Yog7k&E=f$l?tn}ic>9e)#=g^jQ-c<)N7t5N6idE@aC<8V4^Lg
zrks+eGfBQUk#+vHV^>onrs-n{?7R8^^)$Y*o1F%xt3#l>s`ui{3AK^#*-podTcW~g
zqQgRI6Jc6tnCgpcZ|-Y%Gde+5pSH<5Ry#m4SPG0Y(KT|H12!f?L;}-7J79u(92xAT
zSd^y_)7>xY|0vDfPu)!8XwcQ2m3O;>?Jl%s1Z6T;%8oL=Bwh-iRYDNp_t-3Uan70;
z-PxL!wrG3;ghG#<lLp`F7;%3C91M~_&<e{==9cJNJc&0b_pJPqi|jcpRo_~lYRpx-
zGY7g447irl4!s5@2)K7sIz7WXKtyGHz&RqIIwn4?C8KaV`A1vP@qJ98i0>{VxXo1%
zkkJrgkpYFeQQs~d22gvp)FYJyShqc6U5eSetv0^>r23+>3P6r>uXR!~{nVB2f=3;F
zAo{DIWpl>W{C*@_ei^kvcrmw*;)7pt#}JkIv(V}srat#A1l!63udm#17JPi1SHg>*
z`!j+b=nHJmrr>ruw59Mf{b_cvw-u`;3v=@~=8a0<e9ii#(Obm+xWe%vza)qaqUsr{
zO1!*8J#vO%JFvt>X2L=rBJkn1vo4Fm4dbUG%Lj^6!;7Bb6kbRNaGWw7Qx@YB6(}dU
zlU-jEx1R?(_k$U!tnhQ=9dbl@D?k9e(tf>rqSI35Ms1H|bzSnCR#;i4g!c}84Gqvl
z>@q#*)P^b%AU)f&Buj#cpfG#CKL>GfL=kDVv48J2ynFO@^y9-TPIJs!cUf3Ft)?`y
z<A4nMsjevHu^*WC^s_=6GJn(5tq4NJso(`oSwET66$VC%ikRkro39ql6a6$s?xPxq
ztlhvIkh|^16<Lh$b;ZAI%Ng@opZGQ>oPLOAaP+Vm5-=Y?{kx8m@WaLZwvmHCf7Zbe
z@HeyD@gUOhKt5lG06?*(tyoB0w=q5bx!<b%<*FRv(z=)LSuy7R#OlOj-;AysR>B*B
ziL9<ms5{S;d%p(Sf5u9BDqMYRvnD7wTM-q8JA~D+ISt);|7bv~dISzc^7L2niT03$
zoe;d_M0-nMc7GPy)<n?V*W_KQip7U8veg$zB9#HI{Jw)82BurauOuO(!6td5f-=kc
z@j@5Q8AS?ROp3MEC3>}LH5ahop73*5wx8JeF~as$`26MfV#!$ar$zlN{^yzJCDU5c
zD=Lb(MN<udc?e<-@XwhjX#lXY2G=E`M3{H4xG{LAHKu=hjpF|7GQVRwT2_Lk<X19_
zOPK}OgyP{qd`p)))dqXHVAO(&@vRJ<?#6kko?CLwx#g#0nC>X31uA^q=e<-7*%ZWQ
zFDnC~0A`GRb%~xT>Sohl?xw63V$;*Zu%>evyPU16IF`%uF8WqAXMd;0n=>HF1EMt{
z7*o<ec0?cN867ItKoCii=OeFs>lyQwnFvOwOVcvK${K*o7pS!gAly@CpX?xJ45LGj
z6DI_9d|#ZI+`QG)(X5YX{iImueK-z$f`eP~R+t_?`8y@M&00Ac1^W$@kf%=c#IN@P
zl6baQ1hYx`utWKmnpOWd6{{V#>GA3Y;Zr4Y&-*V$fk2>OGcpINQ^24QZ?L_SOpsJr
zJJ`DNwQO`uxvKoljpS9#*DHia=OsPGt|VrC7L@^sSdgv)%Fm1t7iAIZu!ty82b%yS
zz}9fn35TX*OyYSAL7PKyw{je^bUKBLQ)wd;mvKAsC?13-I8x*Y9<_-eogmxcr=Kz8
zlo1p9TkK+9-O^9AQ){ObrCwSqa5~FB_4H%r2c|v!(8&YwVe>-=#SiX1THt+_0iqB9
z;+&G~583y44@{jM;0@}bUtzjD0Dfz9;5U#dI_d8KgQ-6!j{ZfKmHu<|=wF0e|3>Kb
zw;yPG;tacz1aUDbg@Lf%{iKnOgqLesEtyl#I=Vy(6m1{a&hyZ>y_kP}m1+4Skc{w|
z7sw^jbka^_#Vawe$HUc%0*8BSkWuwS`q3v9=n+>RetuT2FINV1`<szb0Ky9h%42PK
zdzyX(SNgNF&n4VY+V&TW3Fq50TH(I7=UPwGZ)AS?vgre1ML?hc8K)~twjlypSG+2m
zoybP8zUjJ#EOYxRCVy`|%Vn3_?;5RJMqTY0^a+~d6^NRp{^nHUAi|PuvL$JluSG`Z
zL@4@Mdvu`BsI=^m#)HeQTI#-;B>8%u?>5>@2AKkWJ~!{lXvSSs@p`&4wBvqGIg3=j
z?h!jDkoBYlrWrDtQI75lb_fzYug&@54Oev&dhknUxhx~yu?YEYZ6=az=oo~BY?-GH
zfbBPYlROluc5g!+PKDm;xyQCqo@%CNfBs*J7(dla{-GT*PAN$QqH6#V9BxP+pqAZ5
zeAkEtu8!Y8gCa8o`5gx$D<RkhdW@`(cT7f>Ros#A?ZW2Zgy_?-ca>BIM)EXP?d?cs
zsbg2xQB34x_(lvQW@GZgJMAllOQt2XT$XQ2^zKhAtT<}jJi1{Wq@2+;0u)wz<l(^g
z7rRKrk~)-}Z%9^c>{s4bez3dZ2Qcb=2jIzs{O?DAN|elRpvR~w?G$PZ5HojONA1xr
zPz6Fq5p<#KZo4f9-M7QmE&vZ?koWw#iix10`70(_ABw(Szt6_-;7B2XbLSS3p5V}H
zf?ay3%TztB7WOL18<TF#0cny_so4v^uhOakVhcM$@cf6!$d`ZDA<5p!J4p@Cr_zJJ
zvHvgw;;H9t5d3vd>RA$x8FQc;lnv1hR?2kS=bi0Cez4&>jdEtL(_e9L8fkOySFt|>
ztbgYQCBK7*SgZ|O2Gd)+3e1~`8~X64<w`x`_Tme;^(0($nT=@!Hh}o=0xFQdZq9F@
zsY`#^opmr9Sr_ja^>M}t|0$C@l9;<?OEDT~r5s<o9VZ3P7!K&C_pt<e2UJe<7ZGlJ
zJ1S<gaH8#4fbdR&2lGZv^TQLy5_`3oiy!8VK6Uu~Wf#a*fE>&}wOGDTC;AcZ<N-q2
zLh9|m84uW!ID;9B2o*Oh9>AF%S2TCYu3kHBaBgUN*Xt0+wYzeiVFMlPUK4HKu!b8w
zcuwqAgSH8Qy~|&-qw@8InM)$FMM(yS2FF!-K_G^WWe}r~Rs4Uk8_KtzhJ$d$LB4PU
zw>eP3R6&#lfhnvQpny`2_{umf0PaB@BKmZtku}GC<xM<U`j~B#G%i%$y93`cFc`cw
zduHM3=iG1XAb`xbcDwsG5cdEsg@$;1*l0$KL%~XAFL9jdQAOSj;6*)3z0XJoM4>4N
zz>ppOiy{A94**g<SkH;yK-a!P_62(Y#|pfGkL)F6YkWRtEV<1Xv&~CHoo$#>%Rgee
zlccofc-+J~Kz{4eQB{8K7@r6lp&5NFiV2V!*9EuXkqO^FsD((Fn<)juqS%EJW>SMA
z2PIO2gk}bo{?rBfHzlKA%0cKGWBc@g@($uHV(lf6=bnFvST0*4htHD5De2m*cxh~Z
zEp9tHBZ>FiOx^eT=5hL#p#*KuW~cboH@T+<79ToVzwX7;2k6RD9#d(Ea|7}O>At+f
zll5lDBBHBaCRY0=(i@~}Z}^*o=pQ|$`J#eF{O3je?vT)dWBUw0mjqqQJ6KZS?@Rjr
z9&uQg-w?kNdJGuAKjSJLnGUY4$`R)mJ+`$JCX|snaR1Dpb_DBfvJxd<mxaue_w^el
zHd^7k;4{4oJ|jn+b8r@^d3O`v9=!!G2=By&+tdEb7yjChKNt5?N$GFiu!mwX2yiER
z0dcx5K(wmc2z2^QwcVwA9VZ<`q_X;a`#bj9CY{nxm9yKmp0D=Ed9!YqL}opx0rI!u
zJ(KHR`Bn0oACazavKu7vspg%~vjjyP7EO$VN*>tF?+!53>VNQm2v>)HnelI+vK%ml
z?Vu2NV8=~F<{cQ37vFQWW*SgST~`z|pTy?zd5E!pdbriF_dMru_Cj6A22SWsi=FcF
zQjahXn60ZgFm!Pd!n9y#zp7_~oxtwCC0&Ti(tZOR@%%O~=&Ap5vVQl-e>LRa57wUx
z8qXlJ6V3cE&iLyCF`N14Gb}WFY|=?=1(P8KW4pDjBYXQeoof5aFb2@_0cZ6u>8gJ-
z(Lb!=KN#pns1_v);XD?X2iyr!V*|R3lRxZSHrTz_zD#V8I$V+-85x!z3ZyOIUbjI-
zwkaY5FMjUKeVIeoA<|lRn&U><-hIKVdC+w3)0?I!8RkSbdN|M}|Bu32f2{7Ww__i*
z^y9y7N3g4FuH~~rSId^;*`UVi>S#qw9DsaJIwzj^Ev(?k@^@q;f~C%ge1<0zvmSgG
zpE#o~U=E0xd`Vw)9=kg%0`(g8nTg*k`G-0d<WJu(f1sU3G6B5DSs<A>l(LsXx%M}E
ze4Mhp-AyEOBJj&Zw^1m|n)is#NL1;kF3CnV$FxE30WY7Xquzq__s>>oVNgKplN}?{
z0l$vl?rM0Ti(ILb_l+@@G|Dd%OPh1UC9-(gtNfS!`1j-S`*x`R3KrgA$7Y>(f(bJT
zp9r55w3$oXY&JW4XE+R&+O_<*(rD@YX^A<;+fT9W!QFXW_}y@_RteFh+h6wOm;IaP
z1Ys`UYGek)th}U!cGU>m{|E^Fd0u{A#n6Ahiub`7v#v2VvM^vGSu@=M0fv_dBIT#6
z6r5bpi$lSw+8^tW#19L;UZ~CqJJYWUiz7fc!bzuypL<(U61A<DSs_=a{eoB;1Fi<O
ze)0wlyWiIYX<B9f>)-#+@ycIM$G^GxklKSr7aLrD8W`C*(}<vVX?d@%a&q;8!aFr|
zkhcl*C8<M~e5H&SpIZ4Wo6!d%FawdNpfp6wr497uNEml<ji0#2BN@qEhxd6OGoX@x
zIjjH2&SU=CA14s7!~dvvr@W~Er5pm3=pdiKf4d`gg#o#}pEi>6r#Rlfg_FfV`Q(pq
zvgaQLi+#}nyqJGV%>65-7+OCNp`%Xp{RaA<V+yY;P`00s|KIOiz_b1e0)V%1T@|t~
zbpF?++w=+<Yq;@;yx)Ji1pdo2;EIs3KjSl?qYEh9{XC?99%1Sp5R!h}htyRg{)}D`
zfAijdzJUK(Z}8WG&^J(j+|rPP@Gkb~AHnaIoIGafzl5s42WkKD{rx2D{}pQg3Yq?K
z742jxQ^Wr_S{4#OlnaQl|BP~fa^3%u^859q|MXV8e|oFf{n9kxJz~Mc14U)gkUsrC
zZ0D!2;;#q&=WRgwf3x*JwFUpa^S?_A{{OJ?i2qqG@&D$=C#U~9Hj`A|#rA*Ox<6d=
zf7!YJ?cn_(|M-9Z<o&Oi&HsLIe)n9zKl8utt6#Ch|CM9&|E=5mM<Vrq>h%7D&;MV1
z-YDQ&xyf)!cKw190Jyr`3^4vShSwY88k$<~kLlD3FZuW|(LLey=c`edPyOIVVXAFy
zc&{jms!cWV^iELl&{WkJO8dd6HXHWV!ET66Ni}(OyK2l-K>M;3=3<Vot5wpCsluz|
z+USkVmH^{YrP8Y6+>5fXab5F22-FXl)Lmsjh3f#>fz)5<i<pgnG7~9+xE@_Odu)V7
z{n%p<32O<Dvd*JkW9M%^+wK_yxn0?_Nr~|tE)wRk)e!R6;b$+X>bzq8zL1IRdeX+P
zggw0eOOVuVCp1zZD#Ds9_)_e9%))JvXA)?w2MEoNpD3B33~fnj$k>lHnJw+@oAY;5
zE(H}iJYV)hK3|2!yfll-?=w)QE<is9OpX#>PpB24Ha}CHN6+uL0WfAwNP_m2qSqe}
zu)7g~ir?hD4H?lX#4A*_IxSz%c&b>u+6w)gzJF)(lbp-|wj4&JZvA&hMQ2KEH0eZR
zA?&NmBniPom0g;W-g|j4O?G5=C#qU-BUHXGq&7N!`#dm(<+~v1-jsL3tXapEA%}Dg
zn13UzR}g^_uAk`K#Qh*)ujG?!A>{`He*+OjXEgwK`-bWsyEA1-ILA(%k0+<=`shkf
zN-COL@G+64;iHP4AEUnYL*SapB@F;@_a`*h^6${x0lJ5sEHoOO05mrfSTK0D-m1qQ
zx+hP@g3*ui`(h)3ynbdyK9q6P0k>7{{1paahTC$rM;AvdN>g@fWLA?G3+tuH2ie0H
zcCxAO0-(#VM7o@#y77IXPTgK5<qFhb+;B<-hN;}`3r%92IpK+YzH5veIoVkOs1}05
zc0VeJC`23o6}C$zOaqz&Nl;*h59LV6%lOH@2F&mQ>}zZx)oFH=t&C!~vsH!8tRF;a
zKlN7~W)y{Ye%GFP7TCHx(}UvrqM7v=u3p>|5afBv>n0^$Oj32Ih>3gZe1ssQXykxR
zP6gb;%{=>ni!GDMal%z&6teT(5t#eyB{vY%`%!{{>Nvwh?eoj-jxQRUraT6+s*cw-
zUGPs5F8mE-xp($Rqq(NK&u&V$GJ2ph|LBCGaxW4b<JYfs!D5)2qQcje>~y4{T3Z6X
z5bja(mBS^E$)1-qUTu+L?q$atNd{xVB7rfJJtBPduvSuk_bXCa;kH&@eAyYv8Qd8|
zE(aN_(BZ|a2)6yk$=dG_zfnND<6#dHw$+4;bA4g=KyCf2%RczuA;M;qOtLy+c?q~|
z`|_FAauajw7c-YljEY(xWd+$4zWaE_X)peHNZRK#fwCRs+!4yB#1$D?Q|pdrDW7fd
ziOw?JR>ogQd(m81Y;u@P0MWOrWT;xw(5kzDJ>SxxYi6#P5?l9Lv9bAwK{^i2W6;MP
zEEJTs*>ckH-EMFLZ;vpdCr_iUr8$h1SHHP+!cT)1tXT0;)wne!mAsJ@*41&Rd_Mu8
z;}U^`DQR$P!sN2&rlhC#Nl1^5G?rS;P=Zku*%xzH%$fX{{)x#kjD6nl{#M#++9=l7
z+=p$^x_s0{0iXx~p?5{Fpj?-t0XZeIA7;>D^6rz%6G@c3GWS$*Gf!2`!czr~5i2K$
zI@lQ3766tmPm(rK9XqzkOtQ42&MtAoWrKlO+{Na+OWx7(A5zEGl(}N`6sO)^U`P=+
zzRY(B-gm^B)8{*?Mm+{@TuA)@u8*lNUsd<l3`Lf?C_4IRa~QHt3<!Vv#*+B_E_2h}
zQjNhe8;Zn>Fo-(h-Zl#{!<O<A;;3k*KT-9ASx34z`|IL}CtZ4<yI@EP`^f@vHLc6c
zM>T-shS*Ga>1H#tfh5=(k8d7Fb+qC?6$+g=o1{?FdahGWJmRg{Ee6=CrVQ=38=+&G
zO9N)a<DN00Os1Txy5jlWxfbXF-x!_*^XeO)<7G4Z9oPta9!5juoQd(64q-%>-VaDL
z_0R;FmZVRXCRF7U*n9BD^R;b4Gj>`-E}A$Vi`#tpO~T-t|CW2vOS8eZO~`3E8QK--
zEYP8=QwCbFfLPN2RER9k7;%bn`8N<E_Ec>0g(=1F%ZEp(pZa$+&@5g}VsUmAVIdHN
zgL~<R`PCU%2XoV+Ebo-$)e6W_H(>XPjU;Wd9l?ss`T61u0%#kjh%ge47h~F`En1rK
zGY`MJYcHYgKG+%EG!#n=OZOPwd~@q&xm@(sB||bVF@a<h`d%Qm&)xGH(7&X?*Iu7E
zK0%gtFGn+*TAIAUd>vU&%RW{*|6#>@S>klR+P?gOeNhMV>-w@c0`N}kvpDQPw;7*J
z;JO~FV?iXN@Jao&Wb?D4<Qv6o@f*j|MZK@R5VI8BWT!kUpp<VT0F)<yD*WL|TNQ~*
zIYu;K9^o0VFwVbhZ8$rU6g63X?&Xyu;um@J<wyziJu(y&@X{6P5JZ{FiJ`*CD3nWn
zl)ZdCF>EKrvotVNncY;Ul3c(IapL5$jPN+j!I_wr4LTWA(v|;V0IQsUSbj=9NtDM@
zblMcL%6x9w52#5mZ#D>CmcyGk!%kx!_a=Fq|LCFrD4q6D;m)0S5cwGqC~?v=zNhjM
znN9HQo80*P{uV?pguP4T+0Pf-q$aEQ$UwT`$=f8sk^WEUi+9P1!|~tUIkDTD7_3>C
zh%T|+0l#Z9p=~fz>Vq+3akJcIef3Q0FlQyY0-tf;;#1t=qy+gxQQEgclL6j1AbbZ(
zsUFI-a2ueb4_BD#U<>TILfCzHs#(FdM_rR{<l~w}ufx^5Ufue#Z0YnIAX<9XPLkG+
z0?`@A9=TNWxo0WXURO|!a=dTkeQ@Ms0c?;G&!HaC$5-_em(wzr(?&w{^+9k9$rjEG
z<b^4ee7GGxojJPhz1j^9Tc-RdlR0CaK=r3W5-oJzG-7;dqw+XN45Tpzg-_|Sf%Yh)
z12E9UI+SprH{bW!<CArT2<NgVcMoUGy-j{KBEx^H`O;TpWcYp~U>LU4F<n+-E$JL}
zDjU%d&<8zYPh{-L<w-?LN1X~WzVINSPb}5M&*vCT;b6K&3@BgaT-JqoigYCTB-RMA
zTuRj-+(nzBU3|z|F=(xw2tAi?l$yS_;>T6pL`yBbQ5sw%wCIufA*%ssJ$t`rGEibC
z>n-PV6FEDPI8?0nn1a1*!lnA$ZQHsO+M(Q84)bD=!bpp%>J#gC8n<`UfYTC5x<)pe
zfOyJ7=;3li8ayC#%xizVVa8oqk|0u8WPIE6Ir`j<OCvs_^QzXydR=Ih=5E;^`SGVA
zoT$6(bBw*vy2e<zU|HZgCZ$hM(8TlT`4`<vo^`|P`Zp&0!b6=*tGC{W8K?EAriP=e
zT?*LWG9%|AvH1fKjxQqgl(bNR^+Q2Oj5`!cu+Nctnc{G#GRN?ZjB{E{;9^SGvGVGn
zP3n?8KSBDTHiC5Wri*~-VhK+ULGWU8Yp{!Cj{CATR#BmtE9xwb)Dw_HWoSBJLr)Nm
zC4eWzvI8yl8p>#7(ZZVfD)gA|@RNat2;(d?T~k<HE!Wj!AiAu3Aev7o;{y_l4hKqg
z2mM0m_)=|20+rkKYK1^OS!LdJ^rKuz!>E29m(v+^jcU-nrS1wdw|#%$Y?KnABm_)^
z0dJXs$Kg=j5TQA^$-B)-v%DG8@!TDq%dqRm_I4)Z<z8od;KIx~zn)ZL4MJ_CmB1g&
zK$c&KoFVoR^1HJ0xJ6FkuVtWZ+dK$2<|sA&S|-LNhpQ9PSUWynig_cIY3q&LI3Ryi
zBb*z+1^}g_+kpu?S@`WpKQm#t3bD|^)g61-_lEw+PELqRxxnSu%5UG)tKUtH8eFbP
zebNH^bH8<g{nizL{kh+dcXD--;-3!bTA$Z?JtmmeB(COv20FP9xPQ-`@A$DeZ9M{H
z2ipA3_euLjVR@`lj!)puJ7d+kv)M;^vhKv669uJ@gn_i*qwv?wSOZh~@@tgJ3yHQD
zTc<teu20^yoz;_i+h=Lf9AUu!TI;D7v=CsX`~*a~m=q3T<N&mm3(b}hP-<9AzA)k8
zfkrPHXD!m@a!d@F3qLI2uzt;08JYk)JmJdwMj*>6!W{H5{Tg2WBCzvilqg-6wNPcC
zI_<we<|8a5eU2?5C_JD<CHQ&Z=g&5#8^y`Qo0qH%`VDsV-OmR&LEX0bsDlVrpp);s
zgigSe#7j)UIargQlznOOdVf#NMCy(^xinJT^O_g~(;#i=z<fPP3~&>MBn`4Pahr4=
z=wjO+C(MKkb}k*>+DxC+tDRa7RGVw`kZQ^d*fg?c+Piqv*i7+*d@Vpf&WJsj(#|{G
zvb(WK=;>S(pKjy7U3zmd(4n_QF%H$3H@doe*!fuIu{TY;^66dA9=$S8T&jCy&ba(}
z04V_XrW7Mw@@Gj{{~UZzuZRFJf1@n0dUO_e3TtDY;sAx2`(}P2iZ$|l?heV^*8|+!
zjU2MBQE&jM$i-jesmMVvQPGN=I~I-F@Tmsmto;k2$R7t}qyK2IyU_li9_V<cbf;(I
z3)p{~272kgP*lIOasWxxFG$s&pMNS^{S|lh^M}A+<10;YcV!8?7m2I|u7=mzGEAOW
zO(E&JBqkMm4sZ5|S}J{m;8*;UDhF@dS7TE+T!2yA>2mD$(Rsy}IWN#7K|b=nMz_vw
z4Sb<NK0-L8FuS$H#*p<$dc;wNgg!9O_T^V^q?hU^3Wr>$3n%YE&g{ayxh#x;!4)~;
zX#O#6Tig<j8`}6?o8GdHk&W5C$)N7wGc#}N+L9W?zJ5M?`Go&#Ib+e8rkU>iI!!aY
zAub>s&`?^?;QMa!$?OQRPI-aE{V{UG%B&yarAy;5CRa$4+p%V8W&Y*7JWIqGIspMX
z_!*Lt+&ugqaXa`vUE?v>Imygszr+Rmi0~A#`w5-66_JScF${12ZGt?MFc4YqF8W18
z9DlrQn%6(ZQ`^{6JWkPL99Yek#NH!r9N(yqz3_o7xx-&%$tww%Vj?$z)CH*vd8|V8
z>2-oI5s{wrMpa<V5ZsS}3>Ea-2eKc|JirrOp@-XnbfVaZBG?xTBwc>IE?0n8erl{`
zy<3T@ZYaG;>xk#=*+1_VaLo0p+kPMMspNxu`VqGM7BJp)CrE%d#>m6KYpp|(U?01T
zII^~QiXc3MUe#2rXv|j4$HZ_c^|F1Y4Lc(Z@_{Oa_EUMMw%}rwWPd_tb7UWc2YI<x
z6{6@_!cz6j?Ic;HJ0Lh)dZN9zCI4yuopF61ssiD1+;R$w+u{j=RA=2povk%esTk75
za>Q;>c$AU0RQt$z?H44R8yHP{naGTxh}D~9P83i5NWf?$>!`AJDUN5r_$713m@~Um
z=M%9|V4#A3pcl$T-0sXBP4;C!7RY{;B-~eS`Z;d%xSmwyNB3&BH<O=eJ%yP@y;h*r
zsF)ui=et{W2gdkq1reNZn|96G!mrclJC3K;%@HlB&*uG<Onvg}gphc3Ty{9h6?R>=
zz^xy0B(T<V!Pd59Bxw#u4ZM8cwrcXVcXt)~!;^f!D@GMU3>K+DbiU$Q1%-#!`$BoD
zn}SUioJJP|lSR%bNf=su(Ys}cvjL;g(4C+u>MZ+*bKB}7clK-<Etj4(?T&=r18@_p
zR6ep1@ga(iDiEk_*iOvHNs;Uut4!Q#PsbHMl~}yA^lhPY?odX0kZ{ri=YbS9vK&zd
z5AH<KOW{q3`{?znli%GLFXVpSSPyt5>M9YO5c#z%sbb3rZN@inafN%V?z`tv7hQ=4
z*ciK;CAzrf^rTe98&wA31ThInQXpfu8Tt@d2nOKOQ9P7Lz1Xfr>1I6TY07=h%{$<h
zff3Q5B+AqXTn`8gdZ=<lE0Q~0Z35hd2KV?9LNm+yLS7Od?3+CHbl-F@&ShvxDvYBY
zkb@@{d}bZHxlU#zGU8*gzk&K7Xk8NaauVZ1B~gMSrATF-2XZ&wGA-9AOu}K%a0#qF
zc*6DT^P8ke9I_v9o!L<v_06ZsQ;xc!7svvZ882;WDjFMit-oS{QoJ0C{7IE%kf{%p
zRrfeKaHj1#LnOc}bpoH2AK<AlzIHnIt>#mewm@<I_xj9*uchf2ZbqnTAhS9c;EHCz
zyHLYhhGP*&7eB0p@=jG1z4L1lwqN5vmGEY{=2-xq809YdLnuO{YO*{3D8wZt0wJu;
zjd#F7AD-HND8Qal*p^~CwOOg#6++*aXb)q;Sl*SJ1%R*ZsXeY&y}vW(8?NPp;oQaW
zTjNyr5jmad%Hl=02;$9iiqCnx2ad&D>cB|ws}>5=An&+aT{6{P8w)z}A$rk+C0?9~
zvbi^x0>`4%wQrMj$VU-#R$Ys{*<AuxCe#o|)~$9eUoOB)w{R_u%qNlO)`VY&Fd^?y
zN}dyKm!Z)eM~OFq3`&du*Bq^OeHn=8@p`LpZ;^0*7@Q-$kj&RzD-^-hDM6QN?V^=`
z^9!09iIukq!E9cfyVgionm&E^87*6(H^<3Mdy{f<2;MS<fVe=^JN0VUX8K7`Df773
z;f65lH$qObs-&o7sGJIb)k3lOg1O)dlm>0q=OfFToS65aitp;x+9u(U5XF)9dCS3x
z9;seaA)^|D)o917Mhjz-BI^U-+U+iWh&zNf&;v@h>Rt@9=busDR!nNyv*Pud*K2UL
zPds?E5usOBkc(pNwaxXs)87UZYn3o^ukXrfZ87rgj$E10)+-2%IOF)vPu|^F)JG`E
zUG>tjf$MjomPrBtXZYNNr?v`y7?a(V5|iuR@C*ZBQi*wEhIxI?Fy=Fr@Mb4l>0D78
znUXXEY@y_#_Q8sj7;x=CzZnBO0H57!#vTan0khS~Yj`O5&AD@0<T<{-_c3wL{;u*N
zd1IC)zk6F_7Ktm~U$pWlq^m@rwrLoN!rc4<W~mPjVZTBsiF2=W_1IG6A>4@%{HPUm
z$x4!&@zws!I9hJaMmnY<qhFvxeP-vi_`*^U48~Ox9+PU=^sq-Hp$Yf$U`QH0M>S**
zL+n6Ye*^8y+3XMZ0aG)dlj;Of%*4jav6d5_?<IE{kBG=#JKCw5S12kV(g_H`!mr?z
zxs)HS5Il06OL`nC?9i*8&c2Q3)-NZa#<wKpjFOFcv&=9^I^uJjSz_oR$_uK%swGvr
zt{HEZ^254<?UC<C>&>h=v!I-gnYP;PO!bhdPK{5^`5&ML6Kz_~06cA<yTV`7;|YNi
zTHg>MH78`=BVOcE;CtO1Bofhxas}@xLuz9wi7hGA+%4I;E55p8FR}`=MQlHdf`Wt*
zN21L4<-bjYIAa>oQVRq|toXB$)Yoo;hSK5Gq{)enTB3?q;X<IS)Vm*cQ0scqg~Ck%
z^iXziIRDk-7u+L>fdj=M$6-A+-4i>N!@)2nLxR&}@le%+KDg;^l67GBwi$sv!2;vA
z`8ldh?bYH3yQNuZkM>}La)WD9ZG~sO)n^T9THPFELpf$?HU=ONoB&3AFTbxJF#5jk
z$r+ey661aPVP?(V*geZ29Rc0`N}IYpw3o46<y?Ekbc<{7zKHH=pU+WZO133)#jW{g
zVNg!LBty(%8i5hR5Ycfu*6QnuQRs&(Eq8l$r_{Fi9&gpMQ-Om(^VBzfnMwm(mjnHS
z4l^EbMoJ{6G;77eT=P)?i-%&-*IbCGL859`$30xigH8&-PrHe5M6xJ;&HU!jo-S%|
zIBrWyE;MPF-Q4FgB^L2<(HBKJytcG&rxxIF;>H6mFLU#&_jBVjSAumzM`w1eE|Z>q
zmw#WXsp{=|Q5|NswFfO#1*kkY;C2--0EvTnPB4fpSTwzTy3nUgza$~yi9^HPhNKs%
zO_s|ix#?zJ5@&D**#Kwqb!0C}a5Y=gZ)DzoFxPBY3J1Lz-Y|aOzb@>vq|j{>UvA8U
z?ar|T@DV41bRxugOvuo=1Zw6}Zib;)PC3^F$5K8nns$o4SW2X6<X`Kl41)G<$BhxJ
zFasNV1cY_Hoz|uNzG?T;zTxv+uZQrpcfTh-E|O0NYGOXQn<bAhUfi-ROqv0;uEV+H
z%CB#9lr}c76+UBvHjkXj)W=}u=(%D)j~Uzi8vv0Jq(8)`*WU(_tjh;xT@{G(SPd2_
z=f<5KYRy!-eWOsuwq)on&GP;X4Kj4nULnJRa1TJJiVR~>Y=JyMiuHDeq;pzVof_?C
zm|)BjIf>`D9kbtA%}f#4Hwyin9RLhI%Y$0E;g`gO-t*=Q{nJ)TecvWOihe`4y%p?v
zAARY<E9HPp?-F^pg{8jWS=(S(^(+)^aHXhB$78$ryNPM#=jv4mej-$)c`B5rBm0hr
zwhrN}sc^@OiKx?!DlaXW#L?cH$HgHUJ<e6~^@Nl@FF<!hmx*ZS_)^&5TVMBAYblPs
zJEQ0k+EW#+w*H^Qt~mycX<Ky)Fvh6aB0sSA*q?mO(ozy$FRN{Q>uisL|AVNP7V9Z8
zgShw6faif6t~Ws>EY%GpQsr&ZPN!kqCCuK{eHJQBUkRP@iJbI4$>n(m6<d-th<{J1
zG%D}UuS=L(my*{5dduTq;mEhR=Z~-FOWIDuD<7x@g_>;}RArDZkSz)R_1IuAh^!zm
zl@j9@+%9hNa{6||H>vu2oGWc-KoRT~iMZp9x}xMzLSq<Ev<IQ>h=<LvDMAY)cUz!4
zPu&_O`VHQBXun7lHagQuTO7#SxfEl6g7C7L0KIxpjj(g*<{<>mSjAQP5;tvRg;X;n
z_%UgXN6#+fKwi`JK;T}<-nVZUrwek?RBBLDJ~jtCsn1qiX255nVMLHz1)UA)4!7eN
zzHcTdq?+jNgx=jQ5}aC`?jX11P+&)2X;zt)eEkiiYU3Kxn)hQFl9Kxpg<DUFqH5x!
z2O`_-b~s;Icd5M%uxv~{bnWq$xbS146^*Vf6&nP5D8waC4iAZIv%<DYV1l>l#{AqX
zKbXp7Zi>9;8H9`a`L6JR1RE>id-(39zSq=g-Ye91Rw`z=8>h}`pE;dRYL|1@dHN(=
zKvf~{LA6#RXMZrAVj9T^km~xujs|z;n$~aZXj=8fz@W#hd!m!~by#0CMWINSz_%d_
z!e8}$hGn~kkG@hH4wPL~tbgHgQGG$9q@(QO+|6+ZSegAe%vED{R_9(Od2(}no+Q1z
zol=j8qk<;e0?J(!F;i1LrZ9KOMc*Vhv#nx8+UXqLPt2oSkx!qpo4vxs2)Z~lHtGpo
zk-2uA??~ARz`++G<9jc2l*(G9$a(6|`oG^@)qhni9Wbu~FnQd$@e9TN_s;|F(Z8sL
zT=^;fapf!npcD@Rvde-)2dU@ZzHBan4t^<9TvWgg!1nIBh(Fm0AY4dS`V?Lv%x2Uh
z_`w2_am>CH?`D{dVGJ)$UCBQ;$)x*fTJsxtj*)6Q*@xNzuKVKYAFBv@)W_sNPHLwn
zl$t(Z&jtDDth~R2`d$hyw3>-}1>nsu{Ra9zb#mg%i}+o$(Q|)W$FFt$Wj%ji=&wIG
z_#B<8Pm<89$*`DFE|{#qlD^#>dfnf=n(fUM>bKmOU+0umzGU|Wb;MVGTX^mC<N4`Z
z=kJs}-D=5L5!Mhhx|dWmBO-sI&|s*jVsY4?!ZAfo-Z*Y+-@YKTpt$(vLF0?P+Al2_
zvLivc6Ux4syWTIb(vZswZuMU}>HPA8`KctJR4RsG0L~a`2*|N6=rT>bJaTp5+}rGU
zNUPLb*!A{HcS{HOKI@D{QR(5z_~;(D(+^akYu=fzp7ji{;T%beXDgo+xZ^<S;Xzf9
zO03&&AclOoZ3tB#w%hb9-=cehs&m;H4X((`_fG4%3BOBBz)7AUi{KUC5>6)NzHDGk
zic7?C6gg&DU;DOu|LkYRV$Jns&jjrtJ}@8I)2|F&%cyCel~D2_`IEZnsSN4ocPeyX
zt2Q#!H`gJHPM=rmLRU~DudRnmsO$9XIxE0nxDIM_iu0@CP85;e?*-g`qU{WR-IQUb
z??lN5MRCs`-nIqC;Y!A6&^PN3IF{Z#)({F_YdI?t@7a?81DRBM6S$TZ9i*0!*}&u`
zM}CWjbm`}k+V*Ep8_gGo={$Wrs;Y;s@#<#?b~mWfy7SXkF+8}QiyaPxvd8qk@9lG2
zd{(%)q(!dNVVOzr(x{Nqmds1D>8OFh$dzk9oIf&lq4qAN40w__6#x@5i2PYw!Fy6I
zqzH4=-eCykSi#IXB}De?i=V)Tfi41V=dP}L6A|W#v^K`J+Ug;c9@Rc?GdVXD;UBBj
z8=PaX;UM{7<~CGqH5*!+Ln*6=>8Jty^=P#AY2<?o0iggQEdTJ$X7JsCCoA_$-tP3f
z(5`CQ>}B*J8VolkmwgGrfye<KG>pizBdlead_(C%n*B`)?fboXmg}*O1{z_;VMR~x
zR8x;o=b^Q{n>1J`@f=lv_(rMi?BKR=^g?~#qi+hgYWehgy()@i6t45VHop-@bBgB2
zGwu~lX#aNf{y<+lblEb$GL|qM?I=<h@Up(W_g+@|;h~`nZ5T`B?wfqY4-xmzisI@B
z0SVeV%Vx}Oi)sY-HP;rUXqejO=5UN-{34yQ#OB$zAI$HUF>`j(rOMDgFGe!9QC?E%
zT~UnpI&{}M<YUe7B1O+D{RCfmD8Aiu(!Wu;lH?)$xRCn_ztfdwJ$qOmoCYXk2~tuz
zBm=9)x*jklM|YH#8dX~-kmOrss)R?muexH5x*WP=9Tkjdr2*_yeEc`%hY&uhAYA@^
zn@SOpWMe13-ft7(YIC*jq>+*`SkOU{Lv!Fge1cnVp?rwSMV*D#HueJ~IhrZm`O$f@
zBBC?Ct*#!QzPeZOeCVNz<4O|l>8~E7H7ek~!zWZKkqg=dGmy{XA-yIhz|_Mb*t89$
zBPT#H`hAu~(K`LS*rik>^Jg_Oj#6e464R|m_K-V{EtIEKb?m(0+1D3ZZiY&Bn8JpV
zw^S%i9Ln|1n_((i@D7K!hy@*36tNU|Tv|#7l`XL9Tj!z*p{%3zWwlAGEwjlJ+`aYP
zENjs?oFx=%I`;^F_7n}E_q+n2*EHZV#664;PC3e6qLIM!D4p+aVB~<LYWTB^^KwPi
zr`gW>9)RV2>`!8q=Z1I8@QqO)33*7|7fv%%gLUI;wzjoCQkz+0b%w%?8J{%=+I>XL
zls|zXfJv+<!WRI!+(t@1!c`Wj5PFnYqiB0&vXEo`#xTotwpYKA9o4kkU^Fb1f6_bR
ztRx3LJeXtwjFX**)8n7uO2Tvn0t5O@96XEGYxHsTn!evcvij~A813q`@+d*iG${0V
zFbN-KTzkfiTcQuug-cOhXrBzgfg@YK5ExQ!2kvlQR;+UOzggree|-4W3!kV=wsUEt
zCsWV<V1-_P{jRQj!Sj0dV9g{Z9UF95fkWn6YXcX@{eq_;vw{NFBR0gIJ}}-KG0WMl
z%kd8GT1uqyD`=Z>Wvo`~xdtfC6ZGXfN8K;z`kH()SQEH*w(s%;Y?8_t`W{7ta`~dP
zw7i?({$uw056k9ym0|aQBaJiwhi~$^9NdG_ON7=_G~emDmqkufN_7vxHGsYaTmqNR
z+g0ec$UT9Z_TwvwSw4KvDNQV?H{zsF;#Z^iYJ(9m1<=Lp<;G1Fyys3B-X2L{2Gj?4
zknCTqRMGZ!3+EN%FW`GK&Un_z-KO)XxPfQ9dFvfx+r&(l0D$7f?MRLPXdIU&#y7HZ
z)_LEwb)DJedDV%d_*!lxvpby|GCb24lC%r~uqedmm|%zi9H>da^`0+P-EOH%H5POz
zd+J@)&d<kS(E|!BVC#?HW4EWY0kC&gq5-adzcFPKJE{0Xz7h;}Y9(FDp4MX_7`lJl
zn>bAFT@Zhs=mCbPRpSkJ#wbr9F7EbbtYk$(qSgLKqlwe`K6E=)`kdQ*xMm~rLSfd|
zVRxaY=8W%s>xYOl10qL>UYIA_{KRdmhIe&3YU=ZL3xneECoY2|e>h3fUrFx`qmev9
z{MG};Umg3<*q0|B+oOr-)!3|3D!y?mcc*`6blTD(oSLT1B)|d?{U$~(hUsp;XdA=k
z_k)4#j{X4V$F$u$;^-SfH%9-u<*QROgKb8G6thSAnfc(&&b6PgSb)y008--_tt;vV
zVfo=HBmsM%X|IECtZi+MnE!C@+q}Ff%jHBuk!R+)f&22iO$F>V>#6UlqJdxoLTK7D
ztF3)aEkUUxeYj+GVl>XrKUFr!hA)l<!)<(zHjD{5gp63iUt5aEw$~!Q3_SrqX98h0
ztdtA9z<QjJu<8<RlHu+$0pFm#1J@Wmp=q^1Rd1&}g<uMG1^RGTIN{cLlUF>CWF-@d
zNE#96gX#;xPFFr|{|36L2k9A=p<Q*8AL)=KLy69KlkOVg92WV|z3oilg>DtKE~%o_
zhzni@;YFE)bW!?Fozi>^9RWlKU}Fwb(x^&-FK4>!j}hi!mC!dU=q`k--z_CR%D7Or
zilpOX{Hq%$MGmFwgF>F0*vk`;JF!G{l9r2qhbXZNd&8F*w(C-9UQ|1OvjulQ{xF9z
z)C1ELjcyivI9SEIT(X%@(g=O0`7w`+=!$*cGJ`di)O25H+p%(#Scy0E5(;%<l)in3
z!ML9l6k@E;{VAWjLj|r%6vJ3+!wAsc(~CmmIKM>G`_{R}f-m&BZWm<|GU~aLfuW(}
zVLEcnd~Jy3;1oeKJeu{vkQw)!b<#OIS?BW)vZ6ETHrWCm?y4sB9^9pGAxBWl1<)Gj
zekiXk0KV7NFqrYoAFgX?uWP9$nSfiWb$X2wN64~GTK+bBKGy*Hc4RaPe+}{wXw5}e
z*nZLE$-#H?Hnlc~yvjk<T&FE{x^worxpf@q5YRN~jwd29`DCt>I|jshoS+#E@%(@>
zrM~o{SZ(~y=vJRckq7skEUaW=ZQe0vhCBBQ^5i!Zp*JSlAjNj;xtkv~{h!_D9P{$=
z67OSCF;LfPtv*s#a5w!d7fqoFls1JZJGNm$=|IyE9~PAFLEWgMD3TZ)cj&ffBY2bY
z)~A(wSLsQm%RZpSh-E##&%B_t#oZLM#&2mP86C5dCVBOGYVvv7M018`UQ~79$q+HQ
z`~>x0#RtPZxki~{>H*)1+YT9PTv+_5WGi%pNa{u4E!aOGyQ$*YJpeB6=ma)6$cDe9
z_H}z}ebRdz1%5)?LzPWHb$#0&AR3@IBE&|MLrAQ8I57QM*8X%{*}CSn>Bg)o$(U<O
zIJus80FMa(J2?t8!K<w#a4BFwc=lxkRhAfCH5>T<u=nQSQ2+bi_}B}PeK!hGwvb&j
zO16Y3`!bd6TlSGLBeFA!5JF|omVM2>BwNUmeT=d*gBZ+A_q)$IpYuKEzR&NU`@i3H
z-G6jdZ%=c*w|Tvu%VY7?LEnlg-(A&*bLug%=r__c2!e*J0q<pX*(GL1S37xpc0N<$
zduLp2&-{Fs2U<L>_<FxsC`c5z^ST^+PCbe7u*#8M=I@QI!bIy&s`Z^}&C_>n<}F<7
z))fYQJYsTVE}(yWgJ}5OOs94V4`r@>M*WyS(aLHcEQokSaKSYj<LVNzWiHp^a(L{@
zGxJJ%<jZ<SLC<A)<$AB`3|%l482T3nx=f~f>|Y#cyMN<A^Zvzw-fiapO1E&WHYaam
z#_m)8_stA}71hYBqMK=)Q;K_%ABPw}@Q5UQOL1@z3S&C6V&1pNhFW?Du2SkW;;@B_
z^(?3-)RsXsIVL_O<WCUl{Z9u(Qb*MvCg(~ofAKj(&7uKz9)+n8?j6>WvJk#y1f{N4
zW_(#)WfA<?b5=WcMj{3>dU$5AUPAax-E52V*~=;kpC~?8<o;9ppZE-zkxrocO9|HG
zJ~c2&$yMQm^k0PiL!mGiXFyR=<$XLo==T(f__t3N#b3o3P>}uQ9Pw`z65!+oRB3;e
zaew(u{7=MRKRG@<L=!ZZnbCF(9|`{UC4G5o=1nPiGe1q^r>y*2!gT7MqdD>%z_M8M
zb5@B3_pNQeQ{`)?+^Gz1&XeM~HzICnaG2^m0JU>GiVdWSBxEiLa4qL_?Vd-d;pyqd
zi8q`S@)~(&e@b)oH7Rnld=}yz0aS=9xCu&_v?zoqcH2zK*JiZLY%F-q^rfd6tI1{h
zR$X6iTT<K#`rK0kb{pm>l!Mo?Buwx(XiL5A#1sWHMwk);-vi@b-(_$lS;%%0B2=9^
zky)JZ+EImTH1|n)VI^p4pslK&m@1QqIuwMFuC!G&lyqR)j&x53euMO1o+try!9De2
zGClOfF&)2}fN}y-NGL0r7B0M0p8!Z4NSc`|GAzdx38#SXfBYEIDc(5frPwXqm&;he
zZ$4FbczF0i%f*eggPOjW-<k5m#dsQ1eh?jqDMf)}R}ty^pd#lt$hj^2WU9}IZoQ3Z
z``6<!A~djg#;Cj;Jls59Hm7?yD)+K7&jI%OpjRt|LhJ0abG5afvTDo%yd}?T#PNH-
zkGQ49Z3=uUsGaI<x%{$M=rw3;4s**5fK2YaJKl1`Nvbrv$Oe%lliN%1zy6xac8EQ6
zAN5?27atgo<bnHk+Nn)kn5_N8J1Qmi=@}2}lIAP4L8%_&UFqG!YP7@{Fe8SjOtd{(
zq+0|iE^X)iP+-DrmugO&bi(|}+RW7Sqd+o8r)I+krt|WOqwNZ7c5<Xl1P`7H6Oe#w
z>uGAOEoNpOIX924RltY1@-_S13B0&fekWJNQ(}CPI^?XrQF?4&{{lTJ5h)13>>%Oz
zfDlx-oiH95RxjQZSy`0%U7GbLZT;Slg&d!20kR+1J04m4`vMa(dEC@}JUA9%nh&q&
zK?=0t%YO7smiv{NZ&l8V4sZqsCfLtBq^|pV!(EmpTDhWTt#GijZzNlsluqU&#9^YM
zTG`h3Tp>JT>X$|2U3{I75?zAaB<VkwCqImNBv8*uC$d@&5CgA~ULlxqr+rru1{40f
z=i#e8W@fu?4n^=}V~?Bq;tn)6)?w@y{2%3`4H-Zhjw9m-Cd~|jTzC{9paAPN(A1jx
z6-=_$m?ElQvKFw`Yz={s&+LF$d#j4PULMAWsd+CH!KV(ra9-Uqk*eS>BaV%eiG8?_
zv*(sVqs;5gyYn3lqMw^3lBIcGRoX>OQHRiJaoJby<vc?@21m7?A-v2(*d^QHnWI}^
zc|G3DhyS=`!VS?qRkrI#_9lp0gSU@Y{R3g#P^VoQqT{Dg|4)xjO}{GaG97nznT^WW
zb&{zYKnA>D-nHt?$er2lRjKfKA6IFC2NVUB!df2UQo-S^stw-|Mg<x%b*IM7F11kA
zOEMfCO?=kF+CN|dA8+u`#S>7c(rXKJ_|!~n@NbYHysPIZL;SVHjq**IAUCho?yuEn
z>cpM)=F@zg)?Y}h&xkiOfR)LkP&&jz{39^UB7w`g>g%r@TDKRQclC;_^#Z+wJNQ22
z_OZW|<#B(byxg3~j<`Mrxqwiu#U;iejEmNuHZufC|B_*t)62gz-ZKzwk#48_=GV<Z
z?+%5HZ^qu!#|)VIEnkdRM7CIBk02i*9P47S*k3$vIk#!ORk8E)H^^FaMS?YEMsuKA
zVDO1vnU?^O2bkE7pvm-vXGQSD+ff~4nr|X)RpZ#o*RD+a-xX>~r25}<cLk@~+-l&a
z6U#Wsj#YVG3b^TBhydRfe@j#GQkWD6VY^Nu&J^TVxLP^phbZPkQXqN#g$mt!LFhZ@
zOM|HK{bC?WgAjkMzz6$R2*Iak8y184f8lC2W@oey)!X_O>HSawaP6*+fRpk<4B+gN
zbm{pTm$1=G`$(|}p)V!OA`&6(pf45qPf%x|j*0X{jtLr|v(Tcq%s1c=>pW%D+Qw#4
zoE6>@MxDT}*WeV`2sn9Pc72zzEUX8JU|0ChnRJZ#n)3VW^v|?y#bBfickiDnC8%2$
zxTp^9&)Ke<Wi;zN6t-y$GXEkzZT={bF`J22;=2rliKx^@aBQR7xu%=h={=iYW%=V{
zF%M%YSd`d~MWr_*0iu19kK4F-N!gp_4?g?fkef}vb~jfWui>uQBQ45MB~QU>L@4Qv
z9~1;n>g$eM-erS_t{eArq?DHx*G`mGea>Y1TqjN~L-o}=whv#im5w{=MG8-<Yh<)G
zzSUX2SynQ=ZWV6z-BmJ|ry*LxQ&L$SO#mgiZO~iQW-m_|xqg7SS^o$oKRwydA1G4Z
zQ(p7I!<D)M7MKMosw?$9Xx!1+sg>~;t%Hze9dCg7D*x)DLN9`wAhQJYs37N2G=$6L
zkE>HR^!r7d{gYfSy)-@Rc<V;z`=aBg6n3@xHZa?g{wp>ksfOEuZY8I~i4U0^)Ld(H
z`pr=QC?|YnN}()J4_^^iqcl}f_|5adxc@^pPfuw+-;cMVa6BSQ6dAi*hX`Eh3j&M6
zbtj7nCqhW@^<N1?+cP8H>eY=t(vO|@FO~-s@#)^Bg;&7eH@iADG|pz^juSJ8S!no=
zZ^FSkCjfg#en{OLSJH*Nj^~O{w=6dBbt-`?;ub9CtW<@wu<jrGKY{(^LaB;6lra&|
zo*V{*3RZ>}uG#mrrv7pf;fj8-q?wp$%nY7IWdD9HCrD_vHjRH(VV&JvM0O%~zy<1m
zttI)>)bQ@E<6c+C!e%fuV|I^TJh#k;k3mcH9|lwu|KMD(gZ}pU{D+S;U>E(L2aGlT
z!Ol4N+n(>Qq~rg{G5++2GobF^V<jk{3o;u;PP3jWKmh+tQdu%O1+Ak_^aX-)wgEc9
zrS;{-(<i?{W1CM8M#2{NbkxrRwh;mVdQ8v0f*!mlpGFFXo!n0xEkX5*>XSQxJ-eVd
zI~}M@c5>bT;Pii-&%Ya811I=*WBVVj*MFb!pNy#Gw6~1|DM(aL$n2T<QTx1uF^uwb
zN8stXkL5Ni*~%n}Uel7!H$fYEqVsDWn#?ApuP*o0orwB=btzxxy_R(K{#`whC6H=T
zh{Vrnq$I+G@XQsA(RsE~UDXJi-&hbz@pyQT^rJQrQFQ_A{|fu<-a7(IIlS>=4i*~k
zMbv5ZR?Kw#*>%U=9@NLwi{Q`dE{242S16qtfBOvzDERS{G)>wy-@Ee*T4f47`Vb4z
zUr3v)fgSGa=q$r#*f8Z$0e&G@_Kesz?=-(3KXA@CagkG{jpptvrrAe(+q6$Wohzcz
zkH!u*jiPv^x*x=qw9C}Wz9D@!O}z#w5d!k<Y`S^^tiz5KXBz9Wz&_?t)4&q2e5SLS
zf^>8`7&4vYR+#@wQVWLtR<$hvIl_m`z57K}kU4s49<o|7502XX2|<hkFugxYwr&9Y
z-UxfzTp{2lsv)<rRW<u==VBd5yLhdvfoWnlARr(kq}0p`!7^*D@y<S0^h|W_TT>g*
z^$3gn@;PbB1ZvVNlePtt-R{pP%lq^bGlx~4vjKK-4#2zlzG+zY@}HC!$XB33kaK|h
z_hY0QYC0Ww{O_;vl28DGE*!O&4n{8?Ua|xTU<tHsu%f?QwIufGI@|VAe}lMxgTBkh
z0hwRv<^j1)ktmPJVbubvqq}&oIMK24@mragL9>43gBMmU%ZFc&^%dtMaCzJ3-ca?i
zQ($1#N*#diIDD5(uW+gjfCzdNSzLYK7f%LGArcXm7bAC#0mTNrGwq2Atn(>+guo<~
z4uM4?dvMoNqsUev<nSV2jhn@`x=|r~Uw>?7M@Tp$SU+<Aj$G5;ntBq*Jyf6_5Eq@=
zN&rsE8Q_}GZ9gn?oiUh4=ag(@Fj(4*P`}jltLzJE=@J&Vq}<`TVkjp+nMS791mfYD
zHwc%(kq0H8OiPi%&h=cBV`s&#w#O*0i?9^W#Jx;arkV^@&Y4AX5*PrmKO3o9k|N5W
zs#TB!uUT|#m>JUcC8d4iqWK#D%y2&1Dc=tT^l;cV1;ufJp}#>6C~BknZZPk!fnd7F
z$1P>jlebcTI`&=Ad>t1c8$+k8@at$>1?Mx4-ED{QBE+-qkCa>JO3t6?gfLyI@d>6$
zKVN^UBCxqHMm~FtLB&IP$O<>`BiO~L-5N^>8^NrrQ&r??JZt;DE&Jof7D`i-$FjSu
zSNV_IA8#*FZOY7~X^|3;><Cq$8Gowrj#nwP@EJlTUweG;=$=I%ugIe>Y*i~X_s!(q
zY0XDEu%2IJ1SI@w%%jMv<iVMVtorr}!L{PNe*3_Dc(UbJv)<m0h{4;#)j_2L{FU;z
z6ysS3UbgprU94x0BHAv&W_*{@whb4UzNrT-p{PWEl$Y2S+&FBGQ*mUv*leMe;=(ae
z1%lt_ym@~r8u@*(rVZWZ1`UOX0_l+&@fu#eRq(m>yxUA`VWFOL0wWiTx>>66<sh;2
zpVPx28e_c<6H5&RprW)wzQfxu)o)c7+RYCDFLQkD5a)vaEBl|N87X<LJEcMMX~Q9I
zhg=<CKv@De+f^sXj=K~GsQp<zmY_aAd#i|pouZ#g(vZUOk-ngwSOyX3$s+`ow~g9i
zmHBm<?-p%`-V-uAt6+JGW1lBu*sq@Dee&VXjWcR-ON_p-@>dkcK&44t4J^OD_&D+x
zM_|u+FS+@K;D4%v{EVVhzp=baLmm{Q#5;9w1A+v`8T*z^xVm&meba_!ZL0oex~BSr
zu=^$IL5>b0)x6`RFtQ+gfXoi<8#x0YFOmG;TC}h*w)|IVPx{?wJ-4=(V=+oaqDnqI
zH|XdDB)XuFjb<GC4%G<qbX$15Jq8>vrSAWBanUnTZ**v8lhtPK8ldv|ZqznR?iQcu
z?TZ|bn7&ecLw071gl!(K5ssbS!qx5(0&_QK?9xjh&pymDNMyR@v(UcW9!=*O3i^@q
z1i5**t`A&d9RZ5r8(~2>5T-s@Xa$$g!Us%7-7lq^X*w{9*xY{bS&jFeYShF2Gjvoc
zqog>$-ypQ=$o2?67-&nP&e+1uR(p`(s)k59JwXO%+p>t-;x|Rw*=l~qSHfRlsy^H>
z-fF`EV@ZJ3(*<TGOU@F~Za0rPv=9=?=GyC@=y{H{<7Q}5sAKbAMhjj2tgNhlm+tJT
z2EkVkM@MAOJq*AfMM~W>`ljyTRp!!E8G0sS*?Klb=e0D|N4CWDD#LE_23F^A{$r)r
z%<iG)ya&&zPP9Uzl6WDKCQ`{8utF;)6}QMQ8(1GslTsCiB=nkF#{EjN5DT`N)JZqo
z1<%~%$upG@TxL>Y$(|SjTKc!Ph%k&-bWZi^HpP2_lQA9=jvI$HXIe(-htAFQcm*BW
zsP^We7?~&@u?3kr+IEIQ?@DcZxMTOqF6gqU%*3)kK58$QS$=U2*VnV5ePi?&(9B&@
zo8rUCVA~>Fp#-1P9zjl^1mPY2vbr@rxy9S5mzY}R6~mK>Kq<~IE>H)Qk1Qt=lV!M2
z(-(gOP;Wgz4^+Nw=>@P56L~PZ-|PCY6yumiyiT0w?z7gH9IN#;H4VX!>tcp)YujCV
z8QS~P{SD?xPHkVrfme7=UEvl6-`pNBy3X5{;E%<Wd2M|zs>j*ZT$T9p0Tg&Yz2ni@
zWBZ*rm=dbvI)KOqa{<aw)pcowK=%N(EC9poR4DAcdj}7{S*03(mBLr_(@_4*JD5n!
za?&l4q>dAhj*47Ab3)XqFZo*=GxCbw(kJ^4=otuezv4Rw#YRubUH=fXyYUJ9=aPSv
z=<s}&d}mzMu|ofrzc3NW3U^xGC34h_-@!+`ceR2<EuDHe24B{23oe#=(?dBJ6?H51
zezMDFQIJr4>@O(c@{b>z#A^f(oLHA{7VE%rVf?irPSSRYJ?-a@wCY$;P~@efv*CLy
z=6bnsr*42PL1R3HFgr1wSxZ8w>if4{)s^B!)oCCq6&1PK#XNnVjeU|o+#_WJ{3_rX
z&F8@we_9~?m&(khx_P-BZ&{X?DP4Zvl5=IpTr&S->!Y`ixI{o9@=J>mD5e&Qr8uuB
zK~~(a)ErE+1x-Vh?)k2Z_H;ugQ20oH03uZ+RU{df0T4FOF%CHS!`~pnk5e_cct~Q0
zYHG3z;5VZJ+LMyzpOuVbMYH(&ePOp>xexA?_&ADM%BxfLjG}#sS6W&{A0$Sf@3n6j
z-M(fihIV^(Y%%j?Fyg)aXGh~u_<V;dpdc6633%_d^%%u~>*)GyIfxR=&=^XF>oS@z
z!wm}84mYx`=AN7ZcDPr?XTEDY-G#Y^{?Rz3ZX`%8ebVn~<3TFASpfvsdI#(|9o_M4
zKTAmG%N$h~p>tV@GH+ssRc2mOQ??(WaQE97))qjxsZfC9ML(-kKv-=jUmBnAdaGqw
zE+w)r@b1;Kbaqwguiq&wr?`D#lF05HL4e}|am(Q(YL>#8tpU;bdEZ{uQr1Oh&VrNG
z+Y^#sS`w}|VOrAPWn5_a2rA$by9g|^%TaOa4#1=1!xuh-a09ZmkWZMA=Sabc?O%)M
zH)pnUrfC+x*I%)=5>8!AapY$Wyy~cRe*mNd{E7@dHOm*jy2RWG82>uYRKy^dJj;L0
zn`@6rW$bO<3$~GzWq301^Erc%_lsLTDhK6p*r;tO01T_tk>G{lECz@UO4H?~qTz=3
zmiA&E`Up#ST;p>fjm8|lxa-H=K^?vYu19skVgqNUy1+BACFHAx3wW<iftzmWe(=w%
zuDlLkVKseVnhXu$8IBu|s$}n4T*=n716r1^&N*o$cLA(rfIo%3Pe=}8PV>lHaNcI*
ztoOWn?%TV8AYJ4mQ{)4PJ-6s9suh{|jKsuU)Ka1#xR#Ll5Cx#LZnag9FI?9?D^+gB
zcm2k4?U&mh2%O6b)M)QFQ(Let5>CGz06CCZ;a(k9w8@@H*3<1?p1h*+3wG)c=4^~E
z&}6OnbSD{7%v^m-56H3N04!1;7)ba!t_zJLP<c8Z5Zc)xmuwA3Zq%p3C%tND9njb0
zD)*)+wN37ReAHk<gDi4!?Juwr4lDiGdq(~IO>_;#G0^CsCXdzhlV!;h%Wle#SrE6{
z?$7gPeUO%ZLaPIMN<T_C1zdL(Na@fmj%6c~P*Vj9!3ZCFbf`kgLpd8U5lwMiv0i2B
z!OKDZB-VYcv23zLk+f*G!MkvAG4~?cxzLV@!xRvS3ZHWm&k1N?&@huSi1vlfM`O;D
z8QQI$o)I;XeD(?v!`;~$^xEAYL9*0<;qGzaVI?4BKafZeZ+m`#iiNOF5`!@^QAj@W
z*P5>f9?Bb~CkeC3hs7TH;?7gDKbmOKS8wzequdwKIm`eAD>00>BJ5!C*&@q(yu<rG
z$TO5TM(?7cxv^?Jn@IdRUy(TG1~orch-J5}HZhDWi4Y>?BX~|-iK4ikMYQC#ZD|9l
z9#yHZsFslHS=lN}@w7qQJaQd3I%4FXJ2~Vp1FL~JG_F;69Z=^BM}7gHC7PBHPL1Kq
z=n!8$#ix$xjiE{U^>Q!hnXdNS6B8xSw+mj!s}5lE(VtG`k>5}Hy5^0RFT%|`M*$ND
zE%ba_t&{@K_UF`N4*`Z4^*))boXZKC?4P|4P@N-aSf$Li2fn1sPO`2#=MJH3X(i`W
zb=(|{y*+Wkq;TkFrLIupOmkbn$Ym|*fCxz=ExgxZ9O)g<EQ>*M<t)>Mj>JJYHh8a~
z+%{S{#>>mg54K%2*yMZ1AyP_=1wYKDe}h66<jMfhS-ko^uTvMmkc3*@5(jO6I+^tl
zw|k$rpn3VzJp&KLOVtUvFWpmh_zGlxR7G58Am+LRfWXx$$2xd6%`q~tn04GG$^)Io
z^99A2iU=}OvR&PHIfvc%UwkoR@)E+7{E3R30@bW1{N(bfA5+`Ln8cViYLqLA7C8e*
z_DO|cLnyCbG-866=#OF9V4|72BLai6AWPhEsdxLH#-k5EUQul(Cbm@pZtOF1eVXBY
zoa57raL*II({nm^oVP15a0&+A;nBvu7@=3aN>^Tn(IA5fB^a*ftum+%8_^nkS^U$2
zbW9HI>?Z7SmS%_gSM?`1MYX9_bB9If;d9|CJak`M?wz_3%?P{Ya2RH4D`+VTW%zAZ
zf!o?@N?kKIh&Ld!u>95+vb|io%E(=$ZE<7fk1h3oud_seI!iO{?>g%mAQD{TC2mmv
z5OG<}_pd^01l3{L!u)m-`6Uo~-o6IC*eyu+t!5xg?nIPjZuWTUvS&Yk-2N37A&<9M
zpAvs#G?+}EfTuEP0N9Wfo$^wfE^RFS+p_-Ae%*4mb2B10o$4YeDCSolKQ>zSGv0)0
z0FS{?{dxsF_fQsJ7l+AGTs8kDmZK*-YuS0krfi@+|GLyW(mwR8GCxJeFks{d6qtfU
zS5kV55RylF1WbfBj3I91-MBP8IHl<A0Y95eUsf9@?oPS(L6`ak#cCCKBBz?zc5W6!
z1vtE(2c&2j-C#iT$RUyTrTc~6t87D<sJp*G!GS|rb5mWaUTE@V#1&u(wL#p&c@{q`
zhx>aFZ_fxu`^Txc??gs?&|^erJ~r+uv5|P8OMCO}K}Cx@u$dQ_DYgpKk0W$&)_pG!
zI<i4N&gY%?<Z73=yL}s(9y%>4y|SS?;%n2wqMidvnL69BQ$|8!$0Faswi>Wbv-t1L
zpwk~ZGwQob73gP5xD^D67)w55^lT4}-E5#U|4cWLLyx3H$P@f=_p}Kr_Lx(i192cV
z*}agupu&21kDJXvStv%(Of)^w1dio6es&r}9$BCzrK6T|j@p<YV4KB}_dqwm)BzD!
zG+fVmbBZxA&%G#ACuNR{dZkk2=O=SuJ;xcJ1GLbYfTWv-Xh+b(I+HK2rMlQFX1V35
ze{@w!-MGlwp{&d@*e-j4TiS5sD#*GY>S`c!nEyvfn0hOA6YCfywVUXl!}5LMQcA&e
zWkdD&01M+iO_2Rhahe?AE8G$fpRrSD-XNsE2SoT$E&&8ztdt?@9AM1iF1yL=6j{J(
zZ3nMlyg5Gz7rYs-*dBOh+GFMO`T>~8k!U!6fSN`h>5X|js;aE|b`bp_jNM{6R(xe9
zI{Gb*DWKE~VxoBp-Yz?paYJ7JS_6(>1Wous<8l}%=bTNfKJ*<n>&jUhI)E;lH155O
z983lH>$2c$$f-Ym(6*;0s1DVr=!0GAP2RxRya~T)e<_xl)0e(9bF5Udv5E$}XBh?f
zDHT65YSMzJ-T`k&F<cu8?m30PSzWT{)%CIZ9#Z-7+kW~>fNb;d8Ri~jIALVTsgtC?
zWLAkYVP>+JAs8PtZeOTGv$JTPz88K;tDM5eR27251_b)TM92$BZosx%-Tze9;O)B7
z(^pSn-3FI_;>+G9In+P9^t`6(72P9ofOAWMu04?|71qmxX@^!{V+DcwMT&cAKu9QZ
z05B{yTG}Oul$T&bAUn4vh*J6RutlSWey50@?g95M=zdS0ZSGt8KW;K{<g*hvSO=iZ
z;E+h|rfQf)F-deP=qPnf+lrl1GJ(mwi4l1{XCm?>wz0iKd2Y}sp4<teRWSOqiL35H
z7~vbeyIoU)q6SYpwVLbUPNBB_7yD#V#P97T3HV&~wgGS9PfZEChX#Zo`%^XKIG91*
zYNjph$ik(mAfh1acHg~fGby?>ap!MU!qm3;&+aO1JsHs8S&$_t0Vyx=GMWQ`rKzye
z3u9#nhx|>|h>5bM(kF3i2lF>CJL*nRASUiRwjaNd_rKKUB7uv#iBIcEjD-RCgRnL>
z$VIrxY6q`bN&cp{GcV*_#J6|jQZ=*q!?<Y;(qQtC@QZk#w=^p>j--XZ@Uzta*L=^f
z|I$wWANRcf;C=q%KmX42{Fn0{aPV)c=%1;d04b$yr4j)oIUj+|ZQYa<(gR}xgiZG>
z$Uvnu9fUggKyF>GU;w~5^TL}lq$@gW3lf0l?_ME69Ei_&sKs6jv|MAfIP^`vx%(xk
zZkkPq>03*PX9xX!v8}rtqpwzZow7(I=Qe0R!5&NZ{2(z-m8-)`dSk!4X*;F&J?Fwz
z+|2jctXBVlR6dSH@z>{4xv|0$xN#tXh(KPpA><f-ecx354FN75$lFj%t1P|Oqpop&
zNkUonGm|}n*p;2KU%wSqFo)3ihHyH)?}n4JBWgGAUGsbOaJvQipjYBP72(bxW4Ri!
zZT<s{wGbAHs?~{vNd5*D;c|NX;<{8fnS`TEpR*O%LLb=Ph=@@>qa?_cQGe4jWL%5=
z{;QzXXOK&Tz-3W%eUbC!Coi2<BZf1dh-o|@aZC7dbtq*u%=>`j#}nivnEn!=Ca6-N
zG+9Yl(6g@$dTV;i+4EfGezfmL9$E?>Y;x=mU<>fB?*g;k*ig4E{S6Y|1g?^Xz+gzo
zEF=oy6pI3MKCCT>>#p?PxyR6G#iL`?fHAVu)_IECz<wyY(L06unYMwf2*pUYTEyRR
zYZSldcK?_D_ivfVr#(oWjldY72j$xdSOttcQ&4!bVJD$PIoSK`J?(c*=<DvV7Qw6M
z{vb<EF*3C9R3lo;^^E#h|4sO$TbvZ@__oii_7aCnoVs)7Giu83y-ZiNkvB&X{vQbA
z%k}L8UhF>*#+c?TFWpHNwDoqtllMGlcYl_Hg+WQ)y%KXM2Y>wp-{qZ>rxcTy@E!-|
z)NdNlY|+VLStY6Ts-UY9R`B)vX_5lv0M%9OXl|+ZNf{#tvsbjC;niln?<%TQVS)8s
z1AObP85>U<2|qB@Ut7c~MqG-ld$8y9{7Nhw>-Sb;*IU|etqs!C$bJ;z+>S@P72=`Y
zIm`t8o>nfLT~Tt~yXAH1i`BA1&Ry15nvdfxIJh6iQ)S?oXC@TVU=iz>exa!QUR;)O
zPK{=8PJ8OpJFyWK<xfLz992N@{uMpVs2S#^DWVh~N$@~nq43aXD>G<mHkxg4Uws{{
zavXr=UR5ylP7e33-CC~LbbI|k+3Rd{p<xr^gK>$p**vL7jL)U4w4(MGBnN-g2c{${
z;Zcz-Y|EBnyos?67G?3qk+E`nlDEfYA6Dvr1T7ti)hhKt1=P>tcKZYcam+Cb%jYz^
z^R;T?xSiRXk6lGV+RLrcQDw*wq9eYdYgZ87hn4D!_W!))FC{oUbsKl!iMIVY{@5+1
zrA|wTN1EdWKbk+ptr$O)opq{%&>~n0%s%&G12Drk#A$9R6(ya=@+V6BZx7S>8p&t+
z+^r5YJKfqP`ClJ|Qa*f0uORDcoG9{UF{j$}BDSE;prE-Y2f4Y(+M<S86oC6;e!i{F
zGVhUiG8u86JG4$y_&A|~V~PI(f6nbCqV4G|0<;TqsTqe%$#)Z!ny8sDYmL&ZK7~zp
z`LU^~ihCX2kW_mHy8^fGJ4sAL$`j9fu~Kox)UcJiSalm5jU5hu#|8+YMl`7Ky?Rvn
zPsO&nKDb%II*oV<C7Pq)?rgCJyuzu?j3nNA=vwo#NrB~;qUnS-MxA?TBh@bOm82Tm
zlvB6I$+MrnuRelnN3tdr+o_Kk>y<mO|G1KJF-Lwz{bQTK_@_iTo~y5o2DqHbG`!;S
z;@yUEh2ZG22ayu?hiwqE$7j9*zIZ&hUuJ)jzYB+ATQjjTtd<1V#ZHLmxJb*stap)1
z0fRHKVa6!iVAV4K1OE{%u=#T_9>uZ)kwQ@6Pzl%cDRLKV3H3&?+@5^Hx~q{tuqHng
zcWkj@+#-J0H`hmKr^#RM62i`^hm^nrHnr%<?oUIqzL|^GWo6n~W@(&@U-3~jtHH}>
z-Fm-M+7x)a=4~&hE)Ax;JQ<c?=o&lhxtTh7d(_nc)^rDxODczOk=~zf*I5A%z0kJb
z9+G=0d)J;Hf7R@qr1l+(7kWYu&KrbC6uK(%eu}6o$)6LQ&suSll<VzC(w*}(Gf@@_
zf8n;m{Qc3uoo|50j`sMkJiTkDIc%H8bCPe~MJz`vyC2TJnKC%#wt?9ohg-Rnx|6{(
ztm<#b+m0bMICw^q_r0lfrFF-)!GRb#by04!R37D~d-1mO<3Hmw+_W4UZI9;NL-e%(
zQ?=`x`}$o_e*eVp`&~ITVqpl6VxwX}5MA0~^4euDhoF`0E~~qfvYwADlO!VP`;_lu
zP|v4|QbwM;lcXxtaCC{D>b^=bj~Z}*2Q@H;Ijr!{ztE}?_RAxha$^zvlt=a5j>H!T
zBSL%%ipjXf9JR=*P-bQ8c7J><#1IEF5X=?m8Qq`f#CpHvl|!^L+oR6~9c>wTm-IQ{
zow_noD~sIB$h`Q;%6v<`Vq5(nRVyoYw20hoOEhS8E_op<Y;`uJ2cZGrgIg|RifeP|
z3685hGtYf)#TCvBoogvC@30IX9^gI$u}}WY?+eQUWUm2O(#(g&Wk5!T9lqbqD_vN)
zc~X#wnZ7o3(^|sz%Jr+%v6}1-n$0Sr13u<&cGRLK!BuqKK&#r8l%>vxt>DsI-Bb$L
z)ACpRn(dc5)&g+>QKX&W`3Rab1o7XUcqU&=puiXOVHdmb*ja&#SWV*~|Hp^*(n-2W
zR?yUAXR?jsr>a(dAaO(hdik_1g4rTd(1W6>K`@&mt}wn98l5dc@C1;!>i0gZO>r&3
z!wtVBlqcpdSWC!8P7S7tz#lkJYSDKyF2xrY4ir_qJ6SB-R7FMAxNW0MU-UQ>bchb_
zaJ(tKTO4@dKI;>TB}yaLAsj63030pII@;omahciFncBY4TAh*$&(M`VukLQ5QQm06
z#7(IdO9<dQ+XjrertAMyBM_mDnKxDw^-*4)`N;+?$wt;C(aZ4fJHnwKboslv-`T#c
z27#2zlMlrSDwtg+1eoBDmm4vgELS*Z-lZrdS~gth4av@N3A@bqr6xdDn>}90cn?j-
zUiNk;q)!VeF}<<Kf^rtn>=RU<x`v8=`lh7RRW&eb1u#zoG)3~Y9$tvNSjmHN%JE5-
zP+nE0Q=cj$boJ%bFjeE?fQ(uuI!%eph(~o_cVFiv9WcIt@$o6D#p<y*psinjk(Ya!
z#0}zz9be&+J<6`cd)*l&%fkbgy6f2VP|H%%r}xq8mWbEbO8Dr@XKHb>FIdpZ3d;~x
zfQL;3z#mGMt_OBx%OsmLG-ZqpcH~9Hp6DaI6iXfNT?uVpVS4UuCydF7IE#xq+{Wod
z9aNlm%@~gG$4J>N4=<WE2Y+|Z+kdDxrt)~;*u+DJUXSAF<+rK#$Z-JJ=9^P3LyD-a
zAhCGqTw$o*`ZK*ulHn%U-@$8rN?1r2ETlB7o5BZi-Hjsi<n~Wv8;1P+aU<JZfy+Ot
z3Ht8{O5Nt!+$~c?@BH<lAcqTj9MYUxD<M-LOkKkjT^`!TMM{F*>5|cQcpl;!?kJ|V
z%&7}`4fpA1uD3_&Vm~0wV=-K^D*VNVF?La@HK>=e+%C8AghdPKL_lF7)i^#(-!{ck
z1^Y&zD!LXoeCU?Nsb6dtoWAAXZmn+`#327FJzgVN<|x7wzG^TA;UW)$&k<?x;XT=s
zncY?iL-m==QJ(oBZkFH5S@kYen)e4hdz{Jr`PdkAp>FgGf8Sa@$MHkJaZ&IJj%(W}
z4<R=$scwncJwqtD(bDW8+>;iESoeM0<<XNHRMq0zQP-5pbKQqBVuNT4cw_?K!WyDA
zZqkc)(+-StD2%)|J3DK81;4$LH5g$cf<)x`=->WKrF{4KQU>4|zb+bd)U_*M1K$t`
za7&;))lii#@h!Nr_*T=eZsWO47y4s=8+~w!Lhl-sqQ-z3<FVT*y9_%&zixgn-M%^P
z-YeIDwa0q5WNiz+b8w`A{AX?_`RMI|r;|eN!|yFa;)*wpP6nTHp%pw-$82u{;FssM
z^^xCncv4L)o+WvYi)8<dbEccQW{$1zc1vV{w;nBXCA4z&<28G%vQvVJ<=}}%-x69A
z3vJp5e==yLT8!zt`A~A4`EI=T=Dgb{LOPym*}U5;bg}wUy~DC~8#AEyV>KL3Ln3D{
z=yNv5xsL_euRKh$5vFWx@4dW7Cwr1^BZ1Jx#Uk_)F~YWOM3H?LA2$iFmHv;@J#yAH
z*`A9s7j=y519p7l&3oFIi3&vs22$k~pi36q-85N^L2(hxJZ=YjJR<8KqRBH$@3I7q
zUUQiqf6`Zk({l|0siNa=5MBSNn-xK5lYEIYnQ(E}M2X6#nJdinn+JAp5{r6$p)2Xp
z@O-=AH=l@+2`dRKY$mr8%6`!HebWfg{!;PJ>>Jy;Mo^%7=x1#WOc;8lsg+pSMA8`F
z`Doi7b3f2khixU65YIK>3+nTMe2qD7tL27=L;YP`TkMWBV*0*r&iW&UtZBrH_|K~p
zp;wwCO=}up)?k#e7KiX(uH|a~bN~kMVIX#sQH`^JGY-Z7_@n~|jsNya|MLU(8qljh
zk^lAwF?#v{SezRP_2fC|LF>XN`K5Z|%SB4mG#xO!9JAOQ1SpjNX2u8r%KVL);R1%X
zYX8E_z=2-U%QtPCGeCGAGQpax#|t}TgOU{P95h{ak(h_7{B^28z4u@L{ztXw)});v
z63=p<RS$4F$;$xwb1acB0(t`iE?kvsWN;F;XQpP@-ugN#w6?)hXK*Qc>IEwLjc>de
z|L&<Sfvg)*V+LhB_%!{ZC8l`8uwmn^OwwC)cjUc=mf}_Ra_sH>klcy|GRMC2ul1GM
z(tN9L*agEyA3{#Q{6g&_D?GT1Gsg=rSm;q;y&og(p!+I?`UL|^a;PDl0>+2@^&=eZ
zZI27@vWiL&@wq#nXXI3<BeX3#xB=?B*C+f=q4+(Jn^4xa#o6H97U1I+5i$CoTroR!
zj4M~Vb>p13==lX-R|LdzdtlGc_EugzFs0BK5d(ZSuvc~_6n^aL?>?1jOc@Ew#T6PK
zpH`lxwU7xXVC9}AC|XdRL8;q_O9zw5L!ozVgt^!B``MA9pvz8X${o{ZdY@<;1hxW*
zGTb<3MoTQJ#=?p$XT3djMXbf~y7jPkquvge^I?VQ``UM}MxUo>H|8%G?*0gAHIu7&
zWB$hW+VP_kElb39+b~9p-8?S{D5rrJ1dx@Y0JJqhe|Wine4xSqw1|fOyG8WWKM0L!
z|4wK;_$&MmNb8R_=f8gc|2*K6tv0snKSB+U(i*?37g*#n6@V+gps6P*87udMR*yeh
zq6BCTKuO^ccEaXT+E(#WTO^FN2A@wz)bY@rx0W2Wp+42l_4NktUT{jN=8uKj$1m-j
zsrdNMcZ@YPR-6iBG%d4K(TxfdJV!{*CEgzA(r?1k0n3+Tzu7Y1GpU4cX8r7q5p&X5
zK15k0_X=a|X?g5FLGZxm{P~Q(useT4e*QlXP>I=&4L81b<rQzvZr|YCn<c%U)a2-f
zxU%nGeBqOH$){9>nhN&Xjt;;&gry-zG7yVQ9tTo<*wh3M^`SzysgsVHZ!PII4P22M
z8hadKZx_sWVt8(1e;ES8Wv2w1Q#FM11Vq)2JkeIGK+af@v%OxEz<g_T;1fFW@nBDX
z%JAcquB+-F`KD7<OcM`S|GtR-J0$<;-$;G{Yx*}}{~t*H%g&&`4&(!0WB`du84D1d
ztpM3%0Pvp*9Qh~h`9ER_frkJhDX9m)OYRx~DAwk`jyMo%e{`!J{hMypX>5x$A0T;=
zSlV{b2+oC9050iYa+Y!dRGmv40GtahT)k*M1gnKUBMSrQHeb5V#VA5uJ>Hg7n_7?h
zndjk@n>z1@FX3-)N_eKBLLJ_5sWmmP;5CmGQ&c|OUUQtN^v=4hAS-{i$IXMDG>wV)
z<9^W@s#2j$*v6F@5+-mt-7qEv){7w~bAWrta(zp5j8wtB>Aou^!SUf83Y)KLLidfr
z$KYh6NC-bHHo(n(`Lh(OfF7%9I`1-gz9x1}_o6{_p9<f{prNOx?04zD%oJ{&ViS~X
z@dAsTZP7jieO<gqcUsz^RAEnW)z2rls;s~4BnT2$sot$UVLu0q^@pEABLJn^b8Z?F
zf)Zeg^`n5x9wHZYnv@VVWmo;_16jM>RYqJ-RAW~xc=Z+*<90*TTtgTMB?96;D(i00
zfXmH2eG36CIT9{P0TsCrhlw`FA;lvsITJr?G(qkXEt>azc<8a|t@P^aaTrWCfHmKD
zPch)vY8=pB;#sy(cl!Vb1_gBSIUP@<qA5|X8i&R(D_cG8&OzaquXKcX`g!JpmQuym
zc`uW0r`B0F|C-Z}m7NNIwL8E;oe^hKJbx*}<@-iOVEtn_Z3WKS8qXQG<R-&HXfn_@
z!9~^zRx51P#q$129wdF$dT}Q0=(P#M195JJukcfhO{*e)Dh%OGTYBvn!6UjAbGCl}
z`F0>{FT_h$(On`tp}A1NZEEeqNvY&SbKrXAaP^i+QbuY?x|HzaLZpM6wRM|es=6<R
zu470H;}v$VbLyT>xt*S`Z=ipOXhTf-rN$SPk0SDf&(=cl!*fSHL4jQr-@VCT0=8@6
zN@5S#qZ0Rd;$n5xDOal5qH&;q+|d3k$@s;7^-qD+)|&j{lN6aiqbRS<759cr{w$|$
zXdKdmv)&+JTu&jtEQC3|0_r#~XEejvg<Z%j$yBO0Q&N3WKUdGD&^#OT9(L7T&C*A`
zZg`;uH*dZq6L$^8u_-7<P{F3*9wUX*ws})trLwpxj`$!C@RISZ)=DO{KEcm=LKL)Q
zipD0tOa;#GSS^?OV~5m=dTxku*M7+wb1BHm9x9mf{b8$r_}HAF^p1G>Ym2c|LT^m5
z)`#+Zg%5M`bA7^hjFLnWG^D?SD%-i$nx<eFa8wRojTg&zSEM-MgZhp9_Ccpga(8|0
ze#cGFev;YauJdzD-soSue)rJy87?Iy)+Ouvmnzt>S8m?lQ0~|3Z|*#|U|lokS+O$F
zWI>oR0K}Xv?LEo~?g+z{I$T9`#g3Qf!Kna5!X;-L&f0fakYqmd`JEvb_XvN+Np&Zg
zXB5GQ*@kwu3e<6Cc&5>JP(Mh14l@Z7$<|X((o^`PWy&w5ilQX`2HoQyiI#<T=SF8u
z?7qLfGuiy(_RhTRw0R#&0QLAB9TwG7aRy=3JO#TQrFmYn#AVa#XJ6^ej7`~m3u{}(
zGY*mY=F69srrT%Eg~aLEUY^EVDI3M`GXL?ga;d3^vb$nL>t-Z!CnIhhzwwa8S~|xm
z1$(c>J8MzK7$!~RA*DkU5yE)W!;cWTo)7D)<a+ONH#0CU!Mfe6+;iAz7CMvXta<*-
zbc5Xh%yaDPYYT!CjFb$yFzse1YZMOSSj9mjh$vsFpC$QqX&lGsjUS3O`c7*4d^a8L
z(t^Ic%<7}3n*cMA`Qcs|a2JUg)Arm%YpjOPoBER3If*^Xl^3BDLHvN$sGK2)o9fg1
z$j-ig)VVgt5l-SoLO80JK(#D6nZx|c!(`K}8TY9-ou=2Z`KG{yR_Q7&?vPT@%_q%z
zBB_u7lzmRLm48}nE100aygeC%o9YQPpYmNlo8KX|qGK$%-^H=7*Z3&#kp(q%u|&tC
zzTH?W#GoWRtury~5XJ<db%9YUT)(v$kjlxnzHciDb(GgpQ+Xu3DBTs+ew;bkkn;>i
z*?Nh{nbg(gOT3%h-AXYE2vQi1mS2m5dkSfof0jZfalN?pwulBKgnmug`aVDZNhLmH
zYHI|q)3G3mr!72%B22xg)><!rN;YX3D?flMIA3VZAt4USL|(q`eokrMK~ojzM^%X5
z-I^#uXc8<j6=&TRR9cgJTUlBStPSwS_3?8$MIz`;;n^^j_g!0i;mj%KKfnBJEqb3L
z&j98nLP)P$LUIw_<46e6fRI6!n<_mh$r3H=O%q6{>X4Vv7P9!^CG&6rb|F6E*|FmO
zAi{+73aN<DBc$gMwT%)=3cw5t^R{b>i@1air9*fVeQBgotytFH`}ohFs-Gpp;A5iz
z?PthNfpBga9Bn1mISb<;^lfMKbqxg@PI&^`S@k4zThCpI(@69ZgV#@|B5AJEf~F9+
zrPaf}zQuD0AM(^53L`LDQIiOi$kjXht=})|{X8Z=n636yJa$qU#@NkjNkk-~A#&u;
zyh=U034*+YdYNeO?Qnf--Cwq{QZ3WJ;9H(r6HWa>DT?kdm~KP0+PPQTNN<tUwg?Bn
zJ-aWGs3-Fr@D9q-aJACTdm%OF{aM43)jIGot4J(J_{q^+Uh&DLB(x(ZL;<I?)r_?j
z!$v0HkCtV+8(SVO3qTE;#vPxpSAL)6cItao*Uz4Jvoh;P760d<By;Wx+fgJF%AOd4
z7wZFWqtwW(0)iuY<dIXzqS#gv*FMnwxw<p|#$#^^yr8gMWBjCYb&*XSiUl;*;BKc%
znEJST9aepB5=n1Q{GPtvdnGV>%-Z6%{}?e_B|DyRT)0%RHIA>w(8Wl5&0<BYTBAzc
zxOgWk3KGxF&SuVL=9#8>^vyhWz9AlUrh&Vi>Qd{}`{$i~s|V1^#BKp$ExcG4_$&g}
zG>YUV#4hh)YMzh1O*-WGBspf?ha970@f0R#vVXzps~o%rCM01w%w$G5J0S;(EAkgm
z{0-U$KLUK!5)a|MBQhhT-rpeGF^>a<Up-O~M^1GmbAmjn`1FP|kR8{lS8N%uVs-vp
z_^#46Yr6U(bdWD#l@C#!-5hoMN2@duga?Y^3u}v9fS$omFA8{<-uUWR#)^ez@vM!-
zh|sG((Uu|Z&;HbkJ6-XiZtEW|+W=q2IH2X=WkU#jw+0a)yzrCZc6l^kUfVtPE>+@K
zI6kjepYw%wjD*0c>1WOO$Mj1OHstWaWdIwg_8XM2$l3B_K?xr*oN+BKFtSrhacu0f
zuIQCY?P1#i=2qQykq4^^zdS^_7=SEY_tDs2h2j5HjFe;lC?9J;CjYgLy!&@f_!r&t
zPbzo<#L<WX8PE{8j+vO56NlOc+H3k{o8u4$R6jpXj1=nEMiNE0j2r@3_GCZ27pVcY
z?*HkjQ-{~Fa5gnC31mw94a%#WieNtG86bbE_%rmIXj@6j{|$O54``I$AJGS9h@Zyy
zU%Zd~BQ*O@4cW{8%>6l&{v4Ia#>>R1%P(y!Z!BE?wtdj7@kFHIg^=UH-5~od3I)s%
zo_y3(J@gRg*2zVdgbQfe4b^oS&OFhxEV%F*`+l1mt*v9nZ|HC{?#G)?I|JrN64h-C
zDN|*FaGm*`16Xhs(I~HE5Mhtc#3Y91xdB>mVGDdc5851}Gvms-pD<pH^3LuF75ug8
zO_U>aVO<<Dm%Y#;W0E$J21;G1wRb)$=1u-`A2;atnD6S`KB%Au)^%STP7QwVR^()m
zuAGftQ*e~Zh};*;ll@SQ5#@5P(&Y~TxQ#!qr5>=mxJR5hP$ic=&nLQ~y=s7Wv^|6P
zo@8_t%t}^(uT>$GaT;GsTZVG);xE7hwRINtZ*^xctyCD9Q1xx$#bWc&yI8I`e`f9)
zpW^}N!Y$ROIXlNJtcJ{ZPdci?yU17UCgi^OU)}v9{cCMF4u_*TXkDSv9Z6HDLTMXL
zEbz$sYu8tGS<DFica#&{UcYY4Bc>lc$sVD%o^+lu$9KrnWX!zmjCi?4iE!VWAD4cJ
z1ps}B`?@Co>{9%BL4YpBf0l^gC@6ockR7rchBG!|A&=WZal?frz)lB^x;P%Okj{Gt
zZ$NEkEcZ;fi`zeGSiR)4T#~1W(U<FBGT8i75-@Qp!$OG^<88<GunIsndWD$?sW=39
z81JlmQ3R?&)Lw5g8EpFBBI$^blK+fMB!s}WfO_p_eLOIhr!)Kw`jLQa8wF}%DDI@~
zyAwIWiwD5KFlGG)4e%NfLd^erFc^1I@xKK_F~3k%BP99-;9YJP0KTHB3Maoo0P7t<
z1$Auz>rc)JM+*S>2~`dJ4U%*L!eReC9M!ea_MgE(GdpU6JODkAfR6yWX@0w83qVo`
z&;h3cXlNxsVY6n2&mn`>7m1a5e?pP}C6odP{qP^5x&QC>{^MEvzuP;&`~TivU>W)U
z<>KJ>lX)ijumE>NWG}pd^V-@xRU^oB4}C~vnb`=e51dRLIG0~)cEq_Y9HeAYWPBL*
zBM<(~edesBEQ$FaltmhFgs2Qg1N?jJ{}6l^2lW75zdwyW8g`Sfl*SAHvorre`~WKR
ze{IwMg#Ix8E$T<ZUh|3qx4TvL8zdTsT_i;TJOAy9%}p>3AdD5*Eunw9OS|E{;q4Nb
zynbZOG5WT-&ZDYx4P$A^Ow9rlL;fdF=q;N}J9w7j-K&rsAhi&9#8@^auCD*+t?ze(
zIT2>F7t-?k=22bxq?b>DR@Cj6Co*y1e<?2<8F<eWc7ti1TV+RE!5dbkcLCK-mJx*n
zG*5np#KR`@&M=PqfsZIUdY^btHRm~x>2`2Xh-8DPiWP8+TYav8PLC0OYTLRvT&kd0
z0v_1eT>X61@AyoT-^dMrh($1^&Z5Fj9?~adNQ)gkz{};sasP30JIG%pPaZu1XynLi
z;v?gh&fPPO1+&0o#8Nv47{^8gs&-P^@80}?_L-)m<LT&F8i@wL?Gd#3-b>pi*Y*5@
zzt?QGKLhScy>hCUj_HFhhRhs$u&ohKh%CYszqoB$6t0kPkbr5U-&xDJ9-gC$k^gFI
z<M52Uk+aL|@$Dsol2ozW^gycR0)CPsVnp{XUMhB3E||HtGvK7A;g^EV`^F<Jpw0I(
zMhl4~PpDS(7)2Z&L4<+S(!;<%k<GR&EwV+*DSvwSNT~``O#gY~@!l)q-e=!h-}t1r
zCteA^z|lx5(wl3+iP6B2*B!yK9Q?SJw=deECids`LA?xdAvNPX_pO_`bxUfdKC!El
zwX5Vage(kmbRb!D93kU(#3ji3Eq|;QG+OgWtpRy*`GFDz3G)(0MdTm>Qg|MxT5u-}
zza6BB0APlBEEYbesiKqo2AUa~#j~;EWE*{TllLs4Ok+C2bb$gmr;Z%H78ktCVMHQk
zB(V)c`*FO*zG#32-N{$i+~(+hHsjt)$}8oj8j{v3SoUL@L1ZqxzK6_-<BF<KH^*K#
zS=1hrWJ4U8o1DSk_{x}_m(8KA&ks5)WS)$;N-AolBtD)J!A*6cxMnv_O1*2^9Au3=
zB(z`8t<|&i+Azka0LCzjYzBCv!x~Zw1Pt`sv`4pod9f4ByNzKRGyH><R<2df)kALH
zbVIKggezXZ#jmMSZRY@E>O@NTz_MZT60-n8sg>Y_XScfTw;5tGCTT!f?uh=fcOmj_
zNm9d|h&68=>1V#1E-glwX4Lsv`0Wt0$?HCQXQkhMba`Q`@5M%wbpLtQR`ej%Rc`7~
zBZWp-n&4G}1Kt!E@&MXbE@$y}#|nIl44X=dQvg-9&U#xabpte6A~=sOwP4*+I@jW_
z@Cy)P+YZJocBsL&bK<TNZte~1!z<JcLhPx>4D+%!1&SoVSwfhA#5C%q<>cs{5P1t<
zLQYpet57X2Yq-RXvoVA^P4SRfPU_p&n>YKf+%!DAB}sLano`?H;rKhi<O##`BEO!9
zb+TY*b7CO8c*FD{Z;r|Qyt=ethagAB*XDaz%Xdjv7dv&8JGj-V0G|5DatZnS0>fDH
za@n3M7nyHz$HOZ!)6s5t-t)n{d*$}@#%$W^!v+uT4VS&x)eQv>yv()&KD;-ly1o-k
zzgB03n^1=>d)z+9q0l@aE0)BsUcK-szoF|j)<)8q$)fxQPsIg-7Jk3?DXb6106zm?
zG$!O?ytw+j&rJ;NgiEJEl0z6BEmoK=-g3Sq?AZH5k4_yikXE!4l7g?sIwW=kLz(&&
zBSMxXcG+FM*Uc0IXfH^n$>plX53aox$n$ZVXt`cIzo{yKE<+U><k`%3CiOc#xjW=J
zC};1>C+BGw<;Jq+wu1WKWxgwVd9@oW;GRc%xP^MLC<Te<4Cjb<`<~#=-;fkeTX9FL
z{K|dH1EC`%V`QQ$D*7<ig^gZ}uJu+5hieN^>BFJA!EiWVD70IS*>&HD4S_N`Lj=5+
zI&Hl=Rr6Tj1#92en}#1KDzS+cH@y&N<<V}>H(UW<#R_L&052a-!bo?MQ+Jj`@5u+Z
zz*bItYFV!6@=TZWc+cYj?xb7KOamKfUcY(s=J6zITNqg5R}Y^6bgDFCpo+6O*e(lO
z{eDnma-Xp*IM}7oa?X`&uatALvZm_us%xGzgS_k(h&tIan-?z~vrJ;0>PGT6ab<XH
zq((j{eKuiHETnAKdt*bQ6Y5-McnS!6kQoU`$GH3W`H`3Mg;HJx9Z}6dIp6*y_qv{N
zfm<COfnre?&U1b$)-lg@r>VL+x<e#zzvUwLyZaWmf{liHw^qMCooZ%$FCB4N#mb+r
zc1BOj-{UAyfAmQELv~#A^?=x8AVYt8w9WUwn0xP_rvA0v8$?7ws`RP?qSBO(Gy&-%
zg7g*zk!FbW76?Up6A)0U^iHIN4v`j=BGM()&^rkT1PJ+^rN6zOz4!Y(GiTm8^S*Qb
zU}hy*kVUdqa)0mpx;~dX+_Ym6M(ZGj*6AZ3NIiCw|Hk4L{p8A#<S%kx{PxunEp>w!
z<bK^>BscjvxV>>yi$h(=FsUOG7#*Uq&J@Aovx7GBVt7DeN*z5*%H^!r0iq*N<2dw^
zjj$pu_EqMc9en;~#(KhEznVOCdmI1e3;T)vQBn9Eq9F8QxQ7`pjN!B0bIQcX#_MB#
z#E5)?{CQ0)nRIAH{^&InTB;mUrs@=OyXcJ0EH7pFp;bq`w5>q&@$Ka?f$+D<fg}2v
z%@#8d9rH8cJ)|ls`$1kgzg=IZNp}6@o_(cr4nkx598+m?&~>^Ny91WwQZx?nF_-Pv
zxXCG&#LIjAl>L_lJer4g8%oX6-E!^)7`3jcB=-i0v*vju?}BH@m~A^tIHDFVIIrrV
z$+Sn1m^{S`3DwFmS*m7Y#2uJ#<aOCV*|mvg2s#4;v^H!pdlZ}2q$6O&1l9#{sZ=CF
zobM?}mF_x9`oc$&rHjwYrNrJ8rJ95!cL_G0J(>oW3(5+<uJmef={wyPh^cC;irQbV
z$a#6z4lpZ51Gxf!fG7fmHpSP0g$zN5raZtU+&Hv9{R;H+Ly^)4>SoHk{BGpBIF_aP
zPTIG}?>6S?<n<th)=xsz8m9RUwgpHBp7O<)Y0B7;$jGcae^+E7xL_f%1Ye4`P@RRC
zp$k6y9MaDI0ooIij^H$I8}v-^{KJQRgf{Vp=w+ps=K@b~x5{xki`GqGuK7qwQKn5}
zYWc5~LdIT?t5sdDoRyJ$BZIT8-z!^TbZkz!+o}K7VDzKZOjb%kN@c!x?KT~1EIsxG
z-!#NRPSDr-c)#gaH|!dbdvHM+Co8Y)2nc9OBL~m(US6P%Mu~sxnBiocj+-W0x-3=)
z@<3hj&u|8U8&J~4+mh}@RcDcjeDN=z1VZi_YEfpsQF-Uj?Yx?UPE#Mwn<QQ)+(&!{
zA|A~fVi=q=H1kb&=KJ5QurZQGvD@=`^JOENaEhqjE*?a0N2RT5y^ci=ow>8Q=SGyu
z$;1(suNp#f^{vet|CcnKS)3WP545%V)1BPnC$w3HH_E;I$}MzRixbM(5QTY**=K#z
zzJmFia0>iTCs7G|*bq(ND$yu&l+I`^kE~&;zi*5Q;=RcI$s}hs@W=e6*U%fZ301B7
z5T1x#5j0A!GwB547L*$I=A#UyFG^+$bQAC26N8n;z<0<O)NV0j!8?O<Y3zhTu;-Yt
z1K@LMxnsxrizxyZ@#Q#&65v9>gRL1pkB%CQOU%=6Fnn{^zdW)^d?9q8{_=T;(W;kK
zHy!EnbDNgi*l`L_k^!_PNq=0hH!Xb!Jz1NOT7fEZ)_=CDWhK~l+=f&S$X^&ji!Ky*
zD+KaT;l+E5Pm9XmRN*?<A6N9V&h&~z%Wxi66r7jA?32s2a=$HQTo%2V^2sx^^>z&}
z*v^qpO*!O#zfCzoW|DY!)A~;QbPw>B3PHJweckSlJ)aPUTUpYkT+~<Q;5rv?i6$Ik
zk9&A1@b(Kz-LzNm311pcx0}P8D!Z6Jz1FY$S=f|WpewwTskTymF}ut)-s!WYtV-(|
zE9%KiS>Kzq?%COq`qXKSRUvgpgUn}O&p9y*i+t~soC@=_1OiuqPsAf^RbiRhrP4*o
z#JcqiFOj!8ZG;B07dL!S+lfEeVSqCOBTD7WE)a2et}Uml)19o)p5vk_ktU{2CZqQB
z2_qdKPW<`}p600(WPa3iChDUDRNiR)98SDg-^iKfm`$=<Pl@?$pJ9G38(w;sjaWq*
zk_x4%XeBy=8%}p}M*&AU1ul#y%Ud_T(ZFA3K}f4jP)~icDgKo-nBR+j^)C`zOk3<$
zSz4?}j<;aDj<1%}nOpzY&C?xgpV5^GW9M%H<tOlQ-yF|j9WBs3zm7iw27{5`QkQ?z
z!Tfy(AZ_@)q2c$tPYDdM8KVDzi1|$p{}-wI_nk+-Np*jA`Ny35B>zvl()~Z%mF@r5
zu1pX7skHBsE&LZr1MRs;16&6WZ1TB($vGk&0f5h`53sqwSX&l02>|GU*d>6&nk0eT
zz6CpV`nciY@eiE%p94w-j_l9V?!(v#U_5w1Fm>dx((Ki^N>V*D;8S_*FPg?GXSx=&
z65vN>YIEOky*Ile$=Z*L^|i41$Z{czz?5J%+z2iz^y|zF0$Gbkqsc}2YCb<w<I)kQ
zBRQ5lNX7%{bKMtTU;%qnB3|!tW9$b6S3pqXP}x+s)%#P()wc7pZk}31M5GmjD1uKg
zz#*o|MK9KJ=*m3UFOqW(2zE^#kCc^nxAs0t(N2F++5j+Oh!2oS4IejPcB6$=cgw8x
zj|=gNMh7W`nC9aht_2I<)e(7WuE}`M#t7zg2~oFv1-9a+Hdi+LEVxrrgd=u1aO@P(
zr@LL4`m{H}A?UTI<0K0D1$~b)-J9-p@wPj!D{wp-Cdd`{6gWsd-8g!BmG9ooUiNdQ
zhn&X>TTe3jw}2AXr@YwVtb7ljGuK9TrXD7G?4*6ZvZvId32!>hW&t8R<}vjNC5kPT
z=x>W{ub#{I&pHyPdGGDg_olY~>Rk4?)b@>@*C<}{atR5^RT7Ga<PV~EyPj|88y7OR
zDOs=OME4q3os{b$t+TU2qHk9vzyD1${0+1Jr_2gC#s1Oa1cX??4M08f-_<YwdwtCR
zw|fjSK7UH_*XVB-&%Xz?6@I#q^hfeyPV#pz{U42W?LUq6KR0fZI{vH6{#zaM_pbll
z#^blQql(R51MDRo=g%Gu(<U!k-B=p`B^Z3XFfOE(bfLganlLP-6!u*fe)GRufUJ3_
zm5%;LKq5f<`-_AFYKi}NCWeQoVqxK)3IZq)BYAyHU=3QAZP;Mx*e~{2>Gpl~=qje~
zGv$|5vzks1z64VJAadfx)vyBLi~Amflp}(gEM)vPRxKH<93NIb9P>?@=~!>suQ4;U
zTc20%2Hu#53MtVlGXJ!k*_u;qiBLJSyf4>NY;Kj+VB+3<f%j3wn;A`cLh&1tb5*q~
zvCHzL3vslVh7b=uQXeN#fyY0<H|v6)UohtHc=d(MJ+qe6O-mAR-_)&j$|{Nzc*Y6$
zi=?Lrs?VPp4vQ#vS!||0`sT8!!RtEkT0_pNdeHxz5maJ&019mvnQZmOc69~b#Th5M
zf7&vch=f!?ZaDjXYSv4#yWePV>5%`)J;M;0n{9Wa?~tAxR6x1U%Wco|5c6@T0SzGp
z^+ePJH;1mp)3Fy|K|Lkd%coNhgbskFwV8Bv$6cB^!Qns|!VP>E4uaVWI@Fw3slkUW
zWI2t3q`-U!4h`bd6vjb)xGVKc(DDy8tTb5~KMhkXJFBtQiCEB4A`Z551ADwQ)T5I_
z<9G@S6GjNyk9aig7Wx?PPG}~MXg${#O5h6}xR{q$g0@_3+93mw)vnllV1~vduZHb|
zUD@>W?gqPUJ#7dzXl{$wp%=U#?R9_p-5>(Tr^>rxz}3WbDy*e(&-4V~Cs736C(z-q
zU?36m<dR@seVj;~+wp_<>F7bOqE9Z_W>q0|clYQW3ufZ#u=gGgan6NdVN1u|$hdYY
zd=qYoNPm8*7xT+I;>oDT9T$<6rlz)pKJRSbr5LB%BxP0GiQmQCkC_<V$rDl(#i0WD
z@)CkMHVw5G>TNFPoXtH7|CJHL<yv(U(S&GoSe~i1;H!#HVC7xDzE)`mbpuw1p^M1i
zK%TAC%3L%-1uInzu0kY#lSlIp;P?{jZW>2EW}$uW&aBLJ$xZRg?=d(Q7D2okINW~w
zyrA_OZf_AW8S(nHyzGk-GcEz`>`mifms}5ZGydR5Ro_pb?=O>3wYRY>>2*S){op+i
z3aB$))-%7p1(U(0s*~Mo=^R-p0*1sw5+!T2*Vl)ap>H{l;AJJn1I&u1_!g}Hq9{r!
zyq&QL*)}RKhZFB)Pib$mlPpc&($+Z(ShumgsUfb+=VBE9<;y-PiY6_{1?H@)fnxWE
zJ|2bM$iu&y96WnIvI`d#75UKJsU+|{nlI{Nm}zQ19pzGHLSZQ|sDxUa*_z{1*%TRl
zYP*Q+<E_tF!k|`;rE}=@i8x;`;oNB5f$9(n1Cp6OF~3QqbM_5<G8`&fgA?eiWS9Ve
zAR!jtQ@QUrZeOI=3cYDb^|I09BL&ApUhj*?aKpkpjP1hS)By&zV}vd5Cf-owtHr)N
zWr-!|1T0cN(b3h=_iu48kvie6*AiNaJK_Y-b@7%KL+!>|b(WOS2^iW456DG)#I_>E
z#IC3)qG5FCNL<yk@N1b(v+?T`@5|FE51&62K+cZUogf-bweL9IRfkSt8@f*Cqlg0d
z24G(H`c*YBuBoom@&7R3rt!kX?STBnyIb#)+LU5yDS!P%!UMgHrRX8A261k{(6+h<
zibH1`xl?Q4d1C3P?9Vp$SXb*P9qW1l*~+_H^jeKF1^IpG8tn<afQCKqnc*?-W_i(v
z=NXEWc#wGwjwTE<3@&jTx$-G($3(A2ZQZN2qL}+Fz4e-omSy8W7ky+>>dpKNt7+Ir
zu?+uOpt;M7(d&jpvafaRF+!!2wONRiW6NXg3g(WOaLczpKXoux_&&>N*>(bvKzVS4
z`D;TcNG!T1J|AvwTAx+)bHnv(s?<I0>B2W7gniAmkRA=5aK-e(s>U_XeB~EQ&U`?G
zT}F!u@YxacMxI<+f6TjWbY7?OBaWg+G+e3fI4<xG;I3kS;G-_6L^fwVSXglEy(NUR
zD!V13GJWqV6KSWEnBJ|n(VqLnAG8>*O9!2_7(C&bi>gz7gYFxTlMWTO>mQ#DT1rvY
z3h;)I`x`NCu8C(lqMpX(=8YCr4O#CXpN3z$@8+a8HxJsX-iL${*@5|MM9&V{;t)!2
z+v<)yzoR##=%>TJ?wcY0bt<9celY=3L$J}1Vv1HfGvPJ<*%IJ`30-hrZ>|bnqN**m
z-0&Mno|dd61PRr2@ZH9wKEBZL*@ty70Hy{yI<$s_%h#{0G_*L+PX<8zlh3oLT=x9u
zPUj{F2`PcRP)<Oy4v^2nUrtI|iS;kqhk5c%fJG{kK-<Iaj1|LQRB6Tg_WJ}CXQz|B
zW*87Wp+pvfB~GtrR&a3-H6;-vjqOS4$xbd>-`A6O7M{A`AN4YeE~M|%-4c0Q8D5Ib
z&AYbQ6Na-ADLImL<9A%rUIOyG29ExXraLXaw%Y0;1Nhn{z3ou|;GV-)2jg&H4@-fE
z!)-?~IIe=dn}Z(d;Ga!zQRN)vJnuyZ`h(=w5>(C$h|E4qi-A!XHN3w_7IQJC(r?t1
z>{+VmCs(H`l~=5VE~ao+PW$vz_0&vpf{KTAP7A=wL+ll0M_pMNOHU_)hsXgoeccj1
z{wGwm7W>}(3hi2bnkS6^r`(gl7>Uaft0=dw=q|h*_Q63Xk_xJaonK^`5?uhK)nzl9
z^;P@oU{4Bu!;icwoOjk%u5-Vg9H~RZ9ysndcHX@+wO&~Pu}6L^c;nja21cKqWV2yu
zzs%DqazVvIF+eUmq*78=!X$O_NppRYhW%&+!9VJ4V$l@uvs$V~a;k%CNzaa4@%D?f
zZ()=bP})V`$|^}J=Qb5De+}OocRam?*2y#z>s1=5_p$CF8j`ynhBo345JqZ({`&@A
zRzUqYn4)v#vfK1_xu~wvSD>~#hzB$V|FkUssgHny>EGSWTYsv&KPBJqmBk1kz5TmF
z`mbW@?<(nc4fVG$;dlK6`~|Yrgz5i`9?JR8=pp+*s{Cf3KdSuZf2i_@{-w(Aj3C4U
z6@~RAF@^V+)BL^`fJplcAPF|g?2CXgJ0O|8p~hsrzdxjhNIiR+E$8gOSeMk-LC@$Z
zG#EtDRDjmrb_6{#D}d*S0(|J9D^^xqf|$9i5}&oFLbj+hQmNr@-!C?Zfge2!@uu$L
z{8h0$40C|<oVfW!nAG8YixgK<M|G)uOT@TQD-9YPeiHWa?c*ytGQ|Q;SH@to(?Fuh
zh*I2;wXCpd)oWG5$>Ro~7iYABw-`9eVe;AQXs1A&fnpHlR{WHy%JO9i*R9(vedpGu
zlqDBKmyl8Nj`GGim!KTpRmyJ);w<!OUlipYUfnc*TD*662l9B*3IhsKqHYxppg~Ax
zHXqfp=&Bljgo|jgqTT)?xqg=fZA8k|GFfMMCS(VS*QToTg!vCc^Uk%8e%@8O$fYr7
zE=nMGBDz^e3>IT}y5XFbG4L2`Nzdv;?Qi)GH+AHsF2<IB@BN<mMD{A_HY??!5;;K#
zAAmi&yoikt1HZT{()ET;p+9s?e()oQVp#RMATqD{-iZ~Z+flT1ns@ox++2)m&b5rm
zQl3{U4oBvqO_0sq&gk3lhX*SEx$6Aq67=8DrGV`E_Yx40)&M6T>Hk)K{{QnHluDG^
zAOOks*Vx|}fa5<`$lqG|-v|8v_J<5umRS&W09))Cttc@CG&y7RkBMNyzb1macd?C-
z^AW|Gzbz(<NJ7G0SV#i#V-a9w`E#x_J|*Xfd-k}trG9jG7Zb91?43yUwVbboM0ln2
zdi@XeH#Fi}#hcC6aH<(c>34HI9CeR>Xx7|qK40P2B8_kzGwDWBTn9Y=YiHU%{Y&Rl
z2L#y#kaTAt3zw~LzU<iEwR)Xo%Eq()M$R2`SV$`}XdY42hTS=UVDw@W`{9lxYyB~n
z^*p$H4c1@2=OD?(=r@e|1asVfJ9T6oq3#PGMCWxfy4j)L)lG4qoEsmNErk?Pxm@(K
zl^mN~Gzn)pQc7L~?a<`ZRivwIYV@QB)v&m1m9UDPwST>#=qlIjYby&c0X#`V96raG
zp=}=Tr5zi#-Ktgv`wHuIoKwczp<;_~yk<f_yPl&+Scz9{V~rXa3Id~yZ#6A~Xnkx1
zEfVORj89*iG|;0TPBIADSVYzEMp4nHz2^Gl=DZAgt8`7tX(+ncK9tDEL*oO{#Cp}I
zx>=(2Ts=HB>QfALJ?SsMc=}{5T#B#G-}|0zbpDwsJ|7jxGy$b|uk`Wmn&ZW)9Y=e}
z$vNx=j(Adm)g5_QG_TPIu3wt^CMzFp+5FR6aVf7Id|pBn2jKknL3KzbypBeU^_b{k
zo3xI_9n0P|swrqq$x@itdSMNzth~t;j3^+#;b@h`Z2=;(OGFt*Kla`wE2+(6?dBgV
zjjq%^Nhiq`x<^5UI93}jpyYRZ)1<OCg$OIh=XWV``{V;$bcOrH7f~X`@eCNh6q>H<
zFYTF58Ws=Ev|(NLcx{<NZ12%9w!P-H@)=}Gu~X#J{8|EX&HmLaQbgL{1kFC*!E*^}
zHvCHvo{-HvOwd^561$}C5jTexcprK_bl^s3{rK4oPPd$VNVOiw%n<C4tk@>#6zRzi
z(DTOcGkd?1AvKicOa4I_+6#;yZeS;M5EJrtfkNOtxbUwt*Xm{8s;Zoq_fU~+A7>j$
zC<(xdIRpy5j8|9`eQOM(lN`EYI)_hqJh>N#AXM*W^E!)t@T&Kj3T_x_>so99+BbFp
z3+V=y=2N!IM@$^AAx<l*$+-2ZuyAJls!)q)?)4+a6VK0<XB;4$QiQx9n0!9UQ!YS+
zs&okvwQFaZs<ndQHR!%D7!PDNLKa~(vs=g3O!Z?sD-*BtwAO0P3}@6Bb6n@{d6T<z
z$Fc(~gPeuEXrcsOqw|#I?XBAIHFca+TE!CxpU=B#GjWMvN{t&LZc-s63SaX(=P95j
zdBkyU3H-RX<i{WKs<}TM>xT>CUEWSqritB%y{@OinY=Do#dzm|<#+R`jRWJe!?RdB
z1L%Z~>hvzbf5C$4<7;@UM$z=l!ydkPov-@C!5vo%gMm)*1Tm*{qq!{)v>~l;J*|~h
z({b|~$MXfu`*&{wws4@%A*?T8@&|@ZVQE-rYkZa`Fxw0}PV_7QrUGbJbZ=YjHDm@i
zN<fH(f;ata^eHa87~66L8-~KLI+$fND5CBo^+Z0Ve9O3Y3^NKvo$07v_M&>=ep{VS
zZ0((^)rX2gWz>C_-RUV|qq7hCDEC`)U(YT@pIBgucdmHix)$Fb@myJG7*ph2H`Z^@
zuhQhBb}g~|lq9I5{AED<%l84X%J(SWs#j}EdZ?jjo@-Fh0w~DOI?lNOPlI{w$px}<
z4oPDV=E$C#yG^3hvMhIPUE?b0l9}fddp1Wq@4)Q#K#PokS5nOrzzEIc>t7_yFb7&T
zC~!St2K7+sQt5#=@ag9gG0v=el#VtVvwx8U9vhGt%-SgPGLTVsyrI!tZs#D5wBOT<
zO{eYTiAtMe0Zi+n^-XDy$DpD<2fa*#d29vsP4Ox{-j6D5-|>8ieSWP+L#S+FH8uJ#
z5;@3opOQPbk(+BXbtY>QQMjd}e0*93L8}gLg~_2kPr$5Jdq1xMeRJa*i=|`}&Nba<
zwrUdER#{mh30RZ^Yb^H0x61?$0G2{V#cRq%rWzHFCVQpRn?<i2jBgjj8wTfYV#e!J
zN$5i!u9lfuX(9$DHXw-c@pFAa7UrykT4G8<g-?tM_RLJAsYLm?r{LSV`fFdSPbL{I
z81v1juRW(>baMr<2Lc&2P16gLU6YgZsu1!lN}ie%9!KKnS$^Mv4sol<+jg4C|0n_{
z8b^@DUBfKmBOYRjEekt(J$`oCnf7N|V-<TZqlVBAS!3L69%g1={<@`c6j0tQ|GSAx
zJEmBBhLGcN8V1P`hjZ8wdZDMZ5!(d*LXAp%1In+CT_nL#KK!=gu%cF~J=;wQvUjrl
z5w8<_@f^Ta-ZMzHq?m)%St`mZIEQ!py*`akC|!?}o?4Z9P2SU5J#--W>G_w?5QXoT
z?tK|cQF5rCoal!&Hrd=P><e&J3-swdQz4FWiy`p2WrPRVy@<R~MK&jN-1}swYnCSs
zTQ6hohqErRnlX!~dVvd?@5ZwxloDuh23v~)U*hBz_aY=v&O0XR58g_Vc@*!c+<Z(1
z8TgB&jhvKBc>PL`5wy8bBD1os0e!l8*XP5xDefUPAKLA4V3Y~z-V3M07cZ`b6<}eJ
z+?$KHKBvz4zoJ)vsIk9G0?QD{jzIVyx*Hd440c-No4XrCC((a2WVRt813m^#B=dbH
zJKA|$bM&xBZ7<5KEbIrvCpPaCBye)|#cC68wm&#;IBc^ps0T84G@i6)=+@zL7Inbl
z&(fy`+@;cEa~z^9>4VND-wX|qK1;EoZN*C;IpJBb2i*@K(FCf6Eny1dk=&#?!3;@<
z0-r*ws$18I_{4;C-2qzFiRSjo%fm*uW>@^py!PPkqRs-+td$K4ebI!aF{CprvRxR7
z3#`R9FLj_H5v}~bo^}w5NJ-`h{RzJ6uOGVD>29b$H@>-$st~l=tj7`fvv~^7k8N3;
z@0_RUDYJsAObGwVFPi<@_f4+uT|cE}tIIW%zGW<Z`1E%{lVp=-<9Xd9ul9lfuk7aS
z0Gt{$Vqqv&i4`i1%h$q7;-()DPk@*mkEKtg^7G_ZFC`7Y(ZYo~K^$&^rB`LH$1jIr
zUgFQrRDJOHEfnk$R3TSqVgACrwdu`Gw;8G(Yh7ugVl4O5DTZZw?(I|s*QYgoal4iI
zZNDbf@F|BS)1}7<rhQR>*y^l6t8<<SWC<@l99|vUC0K%mezo!4r@d9|F~~FZ5dh7*
zBwhG<QvckovxPRo8-%!vPwgTCS6w)da$B@|Bk^16vX$w;H4o=AOpTrJeyzx5`5+C+
z_n#$sS?-vbZ<&lkY*KFu7XX(?h<|w0q5@fWskdmv;blq2&rPY{7do!LQ*$Q+rwUAG
zKHz54yFQA5(XDgyXf978<g6rL@!e?pc!NgcY2nvzrzR`jouX{SAK9$fHPkEw^CT`$
z7vRpK+6CGh!N!h+vsInqBvbInb*2k96S97;#NQ(s1TOD61-vVcedy>VJ`u+-$12aZ
zC|5rQS!jJGq~GCgQ{(IQ_G10Sa~jfRlic&z^9KH3lVIz~>4CM=<EB9{Y~km*#;B*2
zI54MgR$G>ySYFV&7;~3F&c#3t1n(D}s^=jE1x}oPuRRm&;e%1;|4?gh##Z1q;wpSA
zhAXHP6+KlVRye8gCl=ZDdq=JKuq7QNvoio55^3cs_Hpi<^p^7av2_}wTCzoJpCgHh
z(~h)t?^f#&2FzDkmf29kXY{wNLiq4+wLuE!YhQ?Hmqktiqe-vd{EmBp>Y0p>{Zd-k
zFD*|i9hBR&Bl=0=D!H$uMU?r>bX^cPZwi+V=>eE5Zi;KIs~?Vz7iE|d=+P0qs{3iK
z>qb^xl#B6d-}9D4%}nq|RzhK#BL#(vm~)aTWn#?x?Mlz`%?2sc$Obz&;o5pM+}qc&
zcv{CF28<0mskHbi=;<{K2D(WU2BGCZ-4xq84y?>IakSlA7GMEOyhT7M+Udu1>i%Od
zO}prq^9SVViYD0_yp_;doIv-SApW3`I2d>lpW~2j)zCw&zGO7vF|Cm*vr=0V48M+e
zm)vqSOui%W;AQM{TPHKinHl>$3uLmN_i*4NJr-_@UK5}M?A@@AS`?+lrw?p$bByhH
zIzR2XTAy5i+vPIxcp01Uc%moJ-PA`9s1`~7B5?s-@v+5(y)~x@Z|BAP9ePrWjj`@1
zju&6ykM|4<RD<4r`fz>de90PvMJ^3RLfx^*Mf-S9YDF{^5<ub|Wq~>E2u-#lh7#ag
zPrRi9U-J~+J@MCilF@3ew+9Y%43pR0Eo??E1UyrNYLx-!ofuGX@MAN&=h%LLC3$$D
zmdy7|&9r!XY_CqzogDNF1`RED1|`SVEBJB8VD?b3=m#dKIy@Dw|H;Ux(YQzNcwL;1
zx?_94C#P_|1Gg+{Iq}|L<`UKJUAxqAeef@&mB%b0`gFi0?XdK4kO^lJ+b#=rX*ti8
zoDYIg%F7kZ0+E8o<{!oovajOjCS;GJu6AA@*dDC5c|@jk--hJtdaD)=0(|*&fq5}0
z5#3zUnlL(iOV9mv>D5lH>~XN&H8DMkkBF`s^@8#Xq<ro=XAg>75OekI^@y&m`;%W!
zzek@G_sp{&&eI0|K*KtzoH=|YriUo!od@5nv|<$MD%nvaa$a;|K7-JF3=cZ(s1#Q*
zcd=nqUIF7k+kK{>9>Bkny2lKgdW<q@CSjO!y0Jej9@5_wA=7MTWY+u9Ob}$UMST2m
z5yJx6Dn7|6dQgSPcQ9T&utYYDetLD8uQBC@O7A;qSuzEmia|M4JN1O<HN6qZEvl_j
z@p@K~yi|3x*qgHMOcJdl_y8?hZqbbZI!{xiC8*$BLMB0I>w6<6&qiLqo004Y@qN)$
zAAIGKstD?lin7fY`!@gL?c-ts84@4I)EnG>!6y{6T3c*B<VsUsz7CuEaa-<%PZC5H
z7&C6&>0C;o9%5?UZ`T%aZyTRTt<Mo-7EO1$Kdsk&){9^|*@6HR`(YkBdATK?806*F
z`?-S)dRJzxRUwcP9XCk@Yc4sWBL7<y(DWeLHollj?w**uJtuRX*WP<}$BH<@eYrN?
z4gKgr3IZ_&5t68i{&vHvU|UFCT|9PDV!yB2No3MxdV5~ok<*YJvbL{Skk_t(<%vf+
zi85tz^q%%cKo#=wyv9MZ92AXB;8$}Kn&z5z$;)&nv0ji!&JvmL3u@3E4A2)pD#2y8
zlg8*^kHbEJqVH|OrbLArd}_gWG6quDNxZMn({w-HS6`Iv>AF)YI8`Y<Ir;0c0ZPq$
zV{7HyTj{9-d?;gRTFE37D6%TOghii3^djl@L_F5PdoFQRDb6A}H{$nK9jEzJ*`~wJ
zx*N%4BqyPK=Y{ebB~WW6aw7j6-rKlsOyZlTuCx($d{oc*=5)P4L%Ouka9?@avm`d<
zy<lxKT~C%<^+-%Ud2A8dWd2aGf9z0LNqw~HFwT5YPL6{$+dpdMd14Qvw%P1YEEB+x
zSfJDueKv}yd@yY~B4XQG(-!wC#NmUyoBGn-zOInV%iM=2iGTzsp%)ngB2m0W(8Lx;
zNO<7wBvTs-x)=|hNczV}XuV!Ts(k8X7MPhcTQ0lzT_yF*;>ZE;EcxLff05V_GXR&;
zhPr@=N2&X_Eq{ypENHI|L$RQ6rTg?&D$YJ$o?}6daa`WH%FMwyslGe)$RpSamsMsN
zo9P~Gr5k7pwFk!UsCkya2^ftBE&Y^_j!6==v{lQ9Fx;joyT`^jQX=hsqip7F-7t01
zLHnT2yQ5A|zTG0OxB?t#^$p8&g<(XNK=%Wys)k%^HCXW+ia*4MQ;Rclmd*5y@?qs&
zEG?Tg)EevEB}~afKJ8=OYaXqM8MA9kwNPM3&1l^4y>4W+6LGmDg7ZFKtVuc)kkmrW
z7L{Te=7I2CrHI3FOhJ}S|DSiokxyS62qqkEdKGPCZ*XamGV?Sj^^!qsnW|y?8SQkz
zm|crv=m;Q!7Mg5*CK@6EV%lh!yB@q8w|%22ZkGu&^x^9BWu}gyLO%tl8ctPnq;7s%
zdcot=^SxBf><00!Z~E<Vc4K<;g{G%e+<F24K8QF5;*^936B&Mp%1hhXyO;aqo7E44
zi^hr^B+g74P23d*qOV-ez5E5`p1DBhkxG?rxTLcqxV1UCt_`;nP)r~o2TpBLTQx9h
zz^lAbh*V-)!LAUqR(Pl8)<s<p6!ktNX-GXJd0sA<dGJnfX*yw=XHhS@4#@zJ>wE=5
zD_R9V>3OB5dsUZ8_<gUWjuI3~M7<SKd||wA6#Qx_mQK4cbu2SI^vT4;sq<$&Cf0(L
zv2)RU99$l+i{n+tw_)eI<{9cPI#eLe3>!^nLWY$D`5tRrL}A_~jz#~vb+ME?ud$ed
zO{U+&LtU#pKLQekq)Agw?x9|^l5xP!oX71B4g{*q>`tw)NrPz{mt5Sl1)GkUPSQNj
zxCzD?N1zEsYW~%Cl3Ra~u++D4WJI<12~#i5klXJ|M@iAPd<GgPEPm(W`e9^0OsvJi
zZo_E2$ItsFU<!{N#xmRa!Ee1ahYJ!z%0jdRNJz($pPJ20Z88tfZ5;HvLvHtJU87Lv
z5@XZ4R6)l|*L58S5`i+O5t)z)t@_xTd&gdHTAUxy_&j^zHs2Pk^%qID7$@m>WtTqZ
z$K0gG`Npn+zZkssIHr&(lYM)+<E&Ov0a`lN{6M0Gb<4sulEz1`!w+hn7S(FzHgOc=
zHjs)f&}lX+ypxKK`A+d%?=>g<0#pmv4Wi#|zXp9;Tb*DmC0J@^wJ~_3p{Zd`KUnM1
zirsVf<mn$FUd4$fsXSYh6SZE=Ezw?Jk#9u3&*K8lAC>+G_aWE6+=r7#NT6X}+YrO#
z%lDHM2<AFE>>^0w^KpWPct?yVH9-_B+%s_M^0C-_#_2(qa8}U$X;cM{g!ppZ_1!ZH
zR+*daWc0CNoPAGBCMdt%nm#TZ<|#Dj(neB_zGZLj)@`Y)Xv<RYw4XvOwF}`7u`Qj_
z&V@5ucS@a-<kV9iI7m0#QX^hSbU}Ax$x_yERSNBtKBK7O0X%XkqfKSzp694Xki^-&
z%O^?dPwi6N-%-*1T$5k$XL+m0gBSc_40l{OXP?&Ay5HKFBezs^EbG<VB)RVY+6ojx
zN!5yg;VHcUrcb*@kN;IJo<-fUfc!k5{hp4T<@vbe>QjCciVsf4Kxoi-T3wp2E{Gz>
zJu6v`C4?F&o8O{};Srx98niwC38Y6;iqkVk;&zL#h8sDbSPAnA)OkhsFzI>ng~kWD
zf;9A1zHNLvu;Bn2lWh&e3za;b3kS`KPh?(}!gu$8S5>Yb*N~W1=zvxawd4Mn`?I6i
ztS9T8h5Bby)7IOEB!qJHXu*kC17nTEJ5syH03PV$jX%PzKdhpEh`9c_{YPc<pX{PP
z9Hak>H8$e_OXVLbGV+2yA~W)Trhxr+$^2&I{LU=<TZjfc4(#-|EbVX5%Abe+U{z9s
zu2llY8j7x*|7Vuyf9sxmV&2T36$ID;DzmTW96hiTZbJa_%5yIM81Uf0JqXL%C!t66
z_}of@EM8CK<HEa_ICxx@4VD<pz^Ms=52f-woBpOU;<A33yxnqgjESR%F}7lzHMcK`
z^!jOnwgas=UKHB}tXQ!vT{+YeHr!k^!#9$i-d}qX=vXNG?POVKCOLMowfv|V|Dv3r
zf;UF*g_0(q+AlW8bU(OSeoUOS@vggms>}MaV=1uH?ULZ8_U-ltrUV(hDo#KHkHijj
z<uKIUx-@EC8@~j6-KH9xPuVE#Xk34J{UFgg;c@is+=uTzsj*=ml4a{%C@2tL1Wk=D
z)RzMD!AK-KR26rv^Ros|q`a9stiaMr10tvEc*CYfUD@lQ`*3}Z(=iN9)nz^z(|*Zk
zuQQviRvKMYnr}UAZjoyw*3b92B&f-VO@Q;A!q(4{Vpr3BU=7R849CDifLx9V<m=am
zy1ZSdMp-jgjbcsc%r!Vmv>6J@@337A{h0{588~?j`T`&7`N>DA19k<`W<J@ecz47T
zxg)b%*Ntdvs3u=FHP%7Azb{$`QDb}d{hr>smGG4<0Ej?=%HWAYa<+5$h;8<NVb6&;
zR1oiFXWBt!!4#4$HEeCYIcsK_Ll!lo$-kjFkrXQ%+4+kRUGr>PNJK;jF!g_udaTHe
z?P+gqPFe8jw2+)l?zwFDie`EyNUF3KN_je$lylD%KfPohP6QaeOTfRSDCfh``3#Tl
z(i%QgU?z5cU!0r6kuSgN=NyhHj+Q1tsa{xYFTrNlmik0=r3WI)*C!RZ+gc;FL~^`_
z6?$rU77{=C^76qxZ!2u&<t4wcT|)kJ#|#0;Hz*y13J-+pB&(0Z5QiKIH#Oqb_g}qZ
zgm&*XzSzsrHwD!>iFSb!lr964N9XsvYKYXOPV`t;VOxEb$#w&czXn%l(DDMw)K*a7
zLSBwk1K>@sGmIrn;a!z_VZncqFa(OuSP;0z2}Z?01}KYpVccxiQ5L0S3$qcweWS@q
z_~oyho@{Uze99s`p<N!YU%YO85v#WLwpDM5BTC||X|GC{-|EuW`YD&?``Vov4&U|-
z6nX`OW1pWx)clOZneLRur#CkQMo(M!O1znfiB4|#iia)0JAllSzyT%t-mX1zGb^76
zj8fDmi<~+w30>Fx&0+OY@jkA^g7EFzkar9Ts2_-!JjZz!<SS&f61__ugcJl-#)1+M
zs#R#+{K400UM98I%@(pbKHBt2vDlW%P$eHng4#<Rd@~ECGoLlr&RclSzcDpT()X&L
z)98Zn1ad$h;b*aHUzF(5Iwo*FEgj9x&a{{SmBl;x&GqC-I?^9#1qOVMlw==%Dbky(
zOb8R}E%P~h%nYl|$5YNtz4ATGSRTFM?|AVw6L@00FiB;3M~E`0ATvAV$Vyo6DD)_B
zC`}h!KJpidLZCNoxrmE1QDcRtLoafk6-rS_@QC>WqY)vv+5=ItM$FI5EG-@hAF74Z
zee<gQ#&MaAotY-1S%$YTz!6Kk@Ctz)I<l<BOP3GQO%#rb-fZ#!4{NwX`S?}6>Gvo#
zw?Z_`j}l0LBno&J2(O96Fh`prF}KI7BwOaCjFUZA`ZPFWTiQ2MqTb{O<0oMjw(cTc
z<C1nBgxQp|t!l=5t!4WG06by|KJ{d85gF3Tg2@R{q6_2#tpjfDn2pt8L{D>Vj&9@G
z{b_nNt@a=6Y8@RhB%#S8jiP7^eZY_paEUb@17Quq?)tS@>FDjl@OF#J`#0L_>$Dip
zv#fVsk`p=_28`C-qt7oCR^)#$udV!Ab?!&#2S{;A0PYS82Q+LnP(yqZMvoL~jzxxu
z{K{b_Jisyf<>CFGH6kox`b~*u`nN*NUR+(c^SE(=?v3j+ACM+K7ngGs|3}Bj>~jlH
zCbDChQ($0wnqtY8xw&~K3j=lf>2Eg+^z+{6yi6Xw)V@@h`$|_eMa@$u;My$YB(zJ!
zxnUZsD1leTPWLKuVOe^q1uRBh*0ta?A_>a=Md~AuP^)vh6MP|Rcb9K_8Iagq?!9jE
z>`ckWVvz#i9_e+>F}I9T=fp|`aAOR<tH<@thVnj&H5#zzgX5O65r<6tYL?KVbVsMr
zvy_Od58^6LO@UU_k>iA-tTXcJ4di)l-Pd0UEE(ltJ~vHM)EasFUaRuOd>z8QY7fdw
zZ7LsI%Sh4!<^4p{*JvLr8l9I1(&8HyA>pl(i=c>0*Oo*hPJ8NG3cK9Ay4;S|L|q1l
zy)l{su~jsre6NA;qz;@jYVL0B4<KGT!Vv3~{rT(hX?VV`15QJ%WQwb~gD>vhE8<N$
z(jjZX4NCJ_8-N>D+II(i<hKFKS+(B|*nPPjXbsFkyvnicYu$lVlSHzFXm(Fjr7tXh
z>jBiyqo%EGJKU(D8JLzPNx#j?4L6McPzrOpzZfTnDgF{gP+I8Mqr}JhEa{|AK8$y0
zAEI6YS~yg?3>CKiJ0f46Gb^~JpUcDLaL1i{SD-qL*zuw0+*A{6b|tvdl(o>|XwIB#
zSbXQKkJd<@eXlTMuENPMetNGe6@4VT7JAHSGnD2*ExuTc0(=C(Cki9fV!>jF1P{SX
zWR>(>^vgWjpPifE3^doI2Nxth(y!1~y>`Hf``Vj>_t(Q8U@0EqBd{@DO4OqAwvO=4
z=0d>9kFXHTFx{b-GyvJHryC`SlS%UlULuP=zm@mdECcV$B9iVr+%R|6aGV}s0vAWR
zA54M(c9VM%@tZX%-WkJ@VMcJp?w$^HGjHAKsr;VLxNkXh=^*xoZ;mskz0;ZlU&1G#
z(+9#AE`b=#9I~(D)yjPo2h@1y=QpLjAQuhF>}(t8w0MV_@UsXKYdt0502VDXqu%C3
zr-EnRE~gs-M|W90nVYQY3AE8fdV&~kKBAow>VPF83bdR{eA2qD1zSgRMXzyW_#eB!
z-Zc8Ef1Q^!lDCm*RZ8h%AYVfSV62fk>vCE9qOOG3yy+br_Kx``@9KqRrJ>&4<AWVg
zfk#T-;H`|5ROIsHrrtR3OJwCP)OL|4Oi>UIKGOw2$djE4wBNC7F`oeHYQ1szZQjV<
z1M^Kq3$aUfN`l)QpJgcg*|DID(A(ok`z5#!g*BcQXxXYhevmaj7gO<5qgaO*JyZXy
zp_v83nb>M2eju8=kuw&3r%N(DK`7;y4qUfBKop{^bA@9TW&$A9TCmB$Cj?y}xsMod
zk+T3|&sZp1xv5WT??W+lux)c)R*~~FA!XkF<i^je!im}5CZ#~UWE)NuMdYg+M$EtU
zLxxru-{C$zd)89xke6bz96tk`vARu-vu{b<C!<ffqfw@F4sP0a_JGFV&_PpPt|M?%
z0!N7elG(p|o=uWk4ukqIg6COWboh*~+2M~;L`jstv(}BreCQ`J1ebZ=-BEC!gE>ON
z6(w5IFvxD?+jMQG)5*^Br&byTC#9sVpVO~FTrV1E?U$dt1Pi%>K>FrDeBIcwg!OKA
zgYo1_aW0QxLfabNb9AlrBo|xUeVVXCcIG&PpX^3IZoiy^aS5L=M$;7Dq&6^vA72rP
zb<k$LplMhmR|Rd)D9io`lx%1UOnfLVd7(F)$Uf^lkNvoLI#-zQ>^h6?Ef!*LejboN
zkZ8y7h~$KcW^L(4px^mzT@H-|<1|n_ihTT57<g{`Q66SNU8uV5!;HRJ6y+0AzTiPe
z<Jv*Q@$;tFDOtbj+pQqS?>_rE3wutE5tiEU(l}=oJkOZ|ke1laa|VlTr>o4IOy?M4
zbQ`*c=CEkweP11^om*2-KcZp2BhP|CM&+<7IcD)L700%6c`xYE;6*i>K97Pu?>tXB
z-QCBgq^hLuYnHO324r6+UAlCocUHpKZSd7-tI_P?<fCJY6J#s0Ot8{p6su^BjR=OC
z6%!|N=-RK(JHlBa5DB#F^<HUV?<#7i<xwvwSsU-NxoHQvcS!0SRb%brp=zIeM0;{*
zJ=_<$Oul6Ef1adCPvSF}?YM+r)kLc>D)#aLvcTZe`shxXjk}4Z;3SY+b^fPJOaGj#
z)4(WP`J%~=to?6zkiRcRkGf}JR#mHkB~1$MzSe)k(=0#S<mY!SG%2r(G@aH3+R*t+
zL;)W+$Q0(V?Sh5!!nt5K^J)9W3rLNQPwaK$=^L}H*-|cK?Sj8-qSsTM1>H&tDqY&r
z_s*C2Lrq#><D=)a1Ik#r#UX<DS_kqntW!?<XegWzU{~%WHTRmMa@%HXHEZ?Nfz&(R
z=RXZBvOg{&pO~p$s1Tzy_hcH3M)fsxH#Zz_I;)3-&w+wZA~3>&M^SiM>^uroyB7hR
zAoyx{)uA3<12OHKVfqUPDH9iKTkOBv&!O`DdtaG%z!!CC9z)#x7YNIG&S&ua7rm<%
zT;AQO%~z$g7=@zNW}+ChE=Yv2knDEYh*4lb?!#8%gGI|ldCASm0LXgl#9J($o^Slr
zVwkfnD{Rb~GF0b2xJg&x#eG~?q}R@`t=>W?KY-(&@1Ccnof<lGewaE*q??A(6;(Hz
zT5N-Ts;*PltF{EHOS$wyP1Y-c;sVu|{@!4okbbV~^whwyJ!ds%J<vdOdlDx$iAm_(
zV;Wjmmjt}j6Af@ZUrhOwFb-C<IVm)_(jwlqT2=sIb&r3d$;<R>zLT$EQvPK>7)##H
zxq&mYbQ#}cc@nZT6i^*`BYL>dtt$2`vnDu}WV-Q`7`+Zp|6X98v^THQa$LVxnj+6>
zvzxQ>gHRgUrBny&LQb8bU^Uqh*za4`Nk$Wub(LOJErz43qn>y8vtmQcjEx#E*vIis
zg-pABc{w=`DETC)Z98+w3AC6TIy54+xNv<!YVzKFV~3(>CKHvXHA$CwLo{;XCV90z
zt0EP?mIf^?h(nmK;hR31<BjL=G^pJIh<Ou)Nb5?7WPae>kJ;f+p4br;B||Z=?WSL&
zWD?>`L%%W7WL=IvjZSTHF!7jnE_2>9mda#I`G{lLiNS86vc<*}IegMIur2trE=8ts
zfu;$9RMJh!eeKB4+6=EW3#C>p-`ajBei(d%qyVHpr+VmS+UR18IaCV!6pNV4fKVbn
zWX?#Aw`Nq?BD^T~$-zM`q|a8LKN&t1*0HKP&_bov)J#>iC}p*K-AiSXJ(xKmJBq@l
zb!Wh$m8gi41X(N&=ZMuG2YXVB+*xdBN}V>0=Vy30T7xndXSq8d-spDExd>QtK<MzH
z7?)(<Dgtv0&VzlRA{`##a_e)_ZXZ7lvkIKoV!(~!%I)h??(ftB#MNx7o0VmX`?pq4
z6}KBS%p{JL6p?n2FvZ&dWPz3)U#x`%R`Ok<5f2b?ZEa~0d%F|f&f_+A&6>Qah7Bsk
z4o~MFQjmRD<bjG$1YU4xfL(3XI#Z&J(kY&^l1i@Hz-`n}wP>w4zR=0{=5tfyQ?6%F
z6(Q+3JlEOLu@aTec%PXXKMT@Dv<;+E-Vs!QPnRAv#I%9}u*FCA6Hr&~Fvo>K4b>mJ
zqREdV3yvnd{n;kyY%eDT9)9);V$JdM-Y#ECh(t29llg#pk&L;~)c%(7&Z(w0`%kCk
zhmP#8B*$U5U0Ora59itO0-f{p(EI)i^XwZNW$VrFlwH9$o+m}lzI>|9By;uC;To&F
ziK@N5b1_=^g)Kt|_;n1Y{-@5o>zyTBL1Y)2?5t^$6GU5Q_g1Enzv5D4@64T=)@tdf
zxn^7eNfL+s)K(MhatZcW0{<c8f@MrpisG-+*Yo@{mbNm_n%qaJ&zC^j2294}rZ4G3
zXjKG}g1xPhJ`>s-E-l6RAW08Pfxcbn5bl{ajy6&f2yb9-XEOt0%R}~Dk4%?M=XQIa
zzP;mM_SLF`_1zUN_vuSK<m&*ov=`NYZ&`%U4r0LKIwP=}ZDE(?sNEt*J~1u9ipQIw
zNuOMX$i^l|zs9h?eaK|^ob(G2+34w~zj#GG;&Uu>RFBsDN3|A2vz2xICedie1Can|
zcwdYDA4b#%|GPMt{eKn*|3QKOA-(-Jt^M8r8f?P+zwZWIk{3q)0TTx{{<tZB@ANlK
z9DsNI{Tu)HIop0W)bIudL`KrTCVn$&esgDj>#ZF=UHqd={b%&l-xBWM=C|Lrw%_;u
zm#F(cclo1c{XbQx*6CYsoP7QB^8MFq`FrE>0q^oIkEpd@faBqbnI|@MsRhq+R6aVY
zF{Zm0D_PWtMV}W+TTY*sY0SDn=Vz-rX|6nx>G4{?R+k4lmh9kL0y#byS74k4_fB}q
zd@sKAkT4;~!k>(Lz`_+7Mm*Q&xU~DVs>4_Kz~5^%E(irj@-eW|J<*$Ju7v0(YYxK?
zO~L4$?aGypFI2<dqY6VV_>flzTh@dXEXEnuwMcBRjo)t!P7cm7-=BXANX%O0fSByH
zFyeJn+b4RAUtWfc_+I;NW;;`>+Hr!urB2;&RxsIxtc&PvQDVXK=;EYOia{2pK7xy>
z83p1hb1$2tK7&VDc~!1l-L^FpNWEzCibJ&2pt#lvJ@sL{8+CtGN!RfoPnjH>47vwZ
zJkOT|(G!e#E(c!sVE`J~&ErRzr$rx+S|UaATN|Q6z7~Gs)3|HTFV;mum}>>hXiF^t
z(kN>(>`<IMOZng@z~y<x<J_rBKV<G&sg78rv8lIjCBuD1o0KlnAV*cvlFhqroABo8
zeyc!S>my&^#3T1_oI365l=)3EjEVi6`5uos{X!Ehk#SI33@EalCj&^g8l8MLQpGKu
zMDfb#Ra9s$KV>#6*+jd}dC)smtcgjjx-Ant>hOaN&A^In{PU7e)dD0}DI;Hu=HE>l
zmn^P4B}Ckf(^a3&feeFgZt)<P8%lg~y3<*Jm0<X3aW{u3#gmEVs$6GR@(L<%_T41(
z^mn<cTgq{LjhwOE>H%vQQ1?6);RTi%m|u2`w5D5EvwUPt^y=rha~JouNyg*3GMj>o
zOrZ&d0sU&y=;?gJz#BN5+$}$9Mw4$KKyT-;$3?hVi=&7{Aj2lz@E~P-0Yl<=O|)zt
zh0}vaJF9lzNS|>;$@Hl6P(P?y2`82Y+LjtATWd_znS?f=Xc=b+*M9`^ufu31!FtBH
z3txsEG_gINB#q=LYe~kB;+P%^>G56%4>5&d&yIq}J@+E33Agac3mHQf@YzQwUG+}c
zsuykbZ4JR8gDZM8iay78?Cdx>qmiYCwO-Q!M!)8Ddv=yQT5^Dq*qZYt^qV(+?4E&U
zP!9ac66k_+4yQ!URXmw7ZtX}fPSQ&I)Y<<-Zv4b>ZZLyP>*_#F^3~Xz%3ny5Q%Q~h
zx8;2A7*1mw!1U2ZT9Zv2Qd4|smzb!iJe;-Zp`3R-wLJ;3`+C&|avxg%A~CV<TB|)`
zd0e3^LIWIVG7WpOO2xsgA=0~!V8R`5A7Gajs<J9_I0@JAai#d|ujUGf+1T`@&H91;
z_jc(Hh4x8o;av%h_XhWW^~U*xE*1C2fY6hVvFGq$PgUS6{POrf%qNjj2j1o>@0*oG
z?~~^X<dnUEa>lOxnQON@w&7Jdp?31Rd6}u_2qmo&I5*Cu8^n(H{$j2d<pC`5(eVv{
z%}p~G%sk=`lNw*v@N(Sc>ek`(fAjsyauDgDE0R{pfm*LyiLSR35=o?N!-__`2=N%y
zL_0@9z;JNho1_oL5oA!iG`E`2?|vpiZ#+3IQ~L)4O^^fQ6VZ<18xI5z?7LxHit^@x
z6KIWy9eL_94j#OQ%d7{}xbQ{q43R8jK>68<0FJv`QO;x>Sj5OpL51+1`FJGCk9ygB
zw@rds%9;n^unVb@<cQry#OCf#HLe`g`7H-|m#2=!gc!S6n8CN!sx$BFdvDmzmB2sB
zQ=O@9Hp9Dhc*1fR<!SvFxM1dp^aE`cmV4F~^BUj;Sq29hX4A3om%O<P*?*DfP6|6Q
z6zwP-5aLS53`~^Oe0X{RV^BKi3ztAwdV6W!oO8^gur>89nb%$)Q`U^1_r=Ant$cav
zro|MDoj!^fmp8(xtYK&q2-E=!AiDaj^GcgE6FRG2?^itiHhe)TX7r6OzxB%h`d<BI
z+~d5=9NG*iI;Gp{&`D|2D_V!gc<!MO^sQ8T8Uji1;4*wy=iJ4n^ih)u;VNN_vSi6%
z-?ZwDd8Op<`;_rC;#S^0qH*SfdtVZ9ybG%l?u%fhZg%0>W$*gQduYWRwtA7|#`obu
zZ!^mXeP1=qk=vW4J(A8R@ZN@joQf_Bg@n@E@OLmfT0phO2y|$+I;!!LozlY=difRu
zbJv^O8#1lGRlDAZGVQzCG<!fJH#s>TE<m%P+i698$M9Kn5~Uyjt61$j>&{_rzl5ha
zvo{#=fHQ11$Fj^%r6rm5^SPo=qNP#FnD_MfQAHjnMHxKX*;6wp={WRR2_D%2z|e}v
zB|b{}8v9REm8;)$2>iihuGuH@kT;}1UX^7#-pWtg$-Hj1HQ8}%zbU30?IP^x4;ni|
zM-%Gt^H{IG{-XlCJw{HH8J|6^gHQCVn%#WYQ)!u3-b3G{)<CkzX!4qzll%*p;1A?$
zVe2!DcW@w!4;xgY9Pj@{+B~a1d6C);ZIbphyz{nK@2VvxQ=$O6|Gc_G#&$o8H>FfN
z^Mzbf`OemHn-u?Ix&at`9$37tz_f4w=Xxb3l<6%&LgwiZqSrPI&>1=zcRcIIcP>_a
z-4Yk7*jJOGRHq^hSGv7r&4umnIOeIp)v^SS0#H0!l@|Ytx%Z4}YH#;NK@dbb(m_B0
z=^!1cHoAbI(jf}crAZ4Ah=TNv0!oWY@6tP=_aeQ7mLR<))CeK#Om)3yulMY8_Wp41
zxc7Wu5GG+TTmJKTo?ipo=}e0rfv7i44YOom#4;zuH|paN9~^j-V*eue7%%^tpj(@W
zt*_oxy!vQrKd0<0Wp^PdxoqTEMU%hm4Y15IL(GuW)Hu$IR0uC>!GI5w`>nxdujVkg
zFhgRJ)uH@0=(zZ!#WGcTG#%BgBqU=04ZI5f7Hy}FAt}knlA>Zm@`)Vsmj--Ak}eVx
z4-g}wn@oN*;*CYuaQv4ai0HES`^{FBG?>BLW__;-Khd4qX?b<Qlv6ege*<GY9wERF
zK<RE^-{xxupg4o4{q|s9iU(5f0e;+St<|tL=j}S<1K-DWs3sLuuoILTZmT!Dhd}8?
zRa=Nlm-vmXbT&j<j$Hp<Gr_2x79#OQtcE9`kU;M0ZMl*c@B1d)*0ybO&t#zuOTH4_
zIUG)&@XZT9&TpPZ>-#(FzUM-YP`WRiSCsj;Get0$n~M*~*%l1Wwuq=MDOCAf$=BLr
zUgtUxLXCv#Z>0Q1Pyx8wNrJ;x7;BLuoDK$#uGYY0f334(4mb5ZAX3c=Wk~3j<vx6`
zFcfgycQzd`Zrl#csJdm0;Qi`<ylZ`G7>V1#2A4rBf|ujkN9Jl~Eb_u}+%JC371d)>
z`OA(PKYmyu4ZcB~K+zwq-gn56Zg|=e$Lz>i&9qAd%=oz5=c*^5S6i;%tvR{Lmw4qk
z#%fPG(I`RL0E4)pUtI^J&8~JmKj{9vb;rI8daD6)REr~VI?nN8bKE`kQ9jNVF1%|+
zs7R4nwe^$pBm-^NNzDi@S{_;t5-xSw^%P^8v)n3i<&Uu{fB1Z#U$ilvPJ(1V$Nfct
zz>sRAFD|A~r^`YJW=3M56+~v4HNI`~-N{sXD$ncd+)|rNmR0^KW1nEv_u?%6m(kbz
znO|qW&73?aYg4%ldGH+=-o+^kVWg9W;9-iYqCuV}IZ2i*A=Om_?yFqh0@a@$*ckCm
z)q`SW1<)NQ)mSCKV~Ruyv)q7=EiF2=z26cLCF_hCb|b?xzR;t+ci+5V=^_3oqs8p<
zotn}~IC7*uKPS7?<L)0>*FVi7{-_uMt=B&`{<F+hw!ioW{V|U-16Y`xXBMuOpU`G_
zjs3SOJ4C?1dQ;eI4f>0qk@tVJhvtX&4ug(&p_>LOYJfc?PmI_(84RDA>t{h<l>|h-
zh5#NJzZwwI=D%P3`T@WRKm3lJ(brZb;QhA^f9KKYtNsGu0r1^m^beJQSL6@B;QxvZ
z>Qee|0e{WuUlA<73}}8a0)Q7v8^6_ozoden{~Yz7gZ=ZGT=Unl0gf?$>jq8v0rtQj
z51HSj1L`oSjq6Wg5XWBxJBskLXHby4Q3w2g<q@<a;ivyQ%Z-n~8T*yL^5?|;`+q0b
z;kqr@!G-o%Oiq5ILRF$jiUD=V=S8lK9r;gHUZi;;hU_}fg$<>7Bw6`6gQH^oK18;B
ztFr8U(YDRNBG+lEx6_Q4Ait3D^@`E%F;#9X=)U3YnT$U%E3i~;6Qr-}b8TFN8|Ih!
z<@yVlVrG}n&?470U(CQ*3w#<U6V?r*l^W7=MVKKu3MjKj>|DQW7YJ{&F=yH8C0Vr2
zWuFiq&NabKI<Y;=%@2&wdhevL$7aoXZHuzskCk*@j8+TWj2!EKA$-6y;9`~Hn2x$-
z<wu|sm@sPo!5tI*ML-Q#h(Httz&sp~2m{T%VNT?JCx{&K7>&lLzvHP-(UWMpQMyz5
zif4(F@;t2$^`0H=y?i2#G1|#kkyF0rn0ey@1_{V<Y;cVbg*+*oH`cz$@ZgPEC>i)<
z^~q&LE#z5}=FeHbx6@pKp`*r6fF3CQj%P|{A;R;5l2@~q1@tsf8tl{xB?+X#*7jsx
zyU3}6(V93i$?vY^<v99*Cs!*bibYSV{GpXTV(IT_5Fa?A5}&?319-at5K3JI4UvBd
zB|j1Zph~Rwns!vUh%`^4!snMsQ5t=cjrsAoe&%)JmsCl+KZx2`a!R9J>;y+En=d?n
zio$%8C<JqlY8T2D8Gc$|#8#-^;co_xGO>zvM>&HYVSUiUXz9>2j;Q>lTlGZ`HO`-|
zO)VM^H4z7H$+*I9gx|RVed^#u!6+z|<|6C8@8oAcBsAusc?-gDZiqcK#W1zQ39*fB
zKCHX&H`30IvrU@r*==4<MYrM~gm(HfZt;o|K)75R<Ykqq(J7D6lq0+Emn}S&r$Wl|
z-hCPM3eTB5emMatD#}&mQ3KeR;4g%aHLqSzi(ZjFn~jcsd|U4NWiS09Kw0J<r&hba
zq+^Ot_<&9yH*l@h?OBDki^Z{mT2<&E?%y!ep~uzuF^qRk{>A~q!RJX&!O*HIn`sY^
zdqq)9cw2fQ?JXZSr%`3HCD^R%$s@FA945F!J_9G8U8$arm@}^aIlj^)F`T=#a1Sah
z$}k}$QRyt`TlRgBXgbwY$kr`0J*{f7IVq`X9C|yHp=a0G-(eo8jvQ>zh;Gj6>32=;
z=i*?i{rl*tPq|x~sHonfff#PxdJ~k8!=*Mwx4i`0j*NT~65lrN$v`Q`F^JGbi6SQk
z);VXJrSgs!-L)8{v<I_R!qzl0k-Vhqd6lR^6h^4=<b7uA%0AbnX#Q6Es=QB!I<nXA
z_<H#vENhl5+t@|2oVNXU&p3(jQ!TR7Uhps|748XAJH~qnIb2y})`!y0;9x7V(3dKp
zNg8}{c|!j^>^8CC@FZTClNNg?7fZKt(v6O-Mf=>FMxh~oBqi6j&MF)^ELLa5nP>yx
zr;+(rqvO+NY6!0~<13$YQ2P-OJon5~mwF5kW|df%;9kzA_;@|CA!YCLKvKYzRa!HU
z5kF;l6+4R3k<^E^?IIh8SW%~X6+p$mQ>*47;aiU2NhCnNF`)mk{!Omyq6{YkV}e{m
zcdU?xd1h#L0tw7hB^){VGp1ecPWjq7^Oxy#*oAM_nOMzTF&8S;T)w2f;l*pGE%77i
zPX0E7^Qq~@h{fJhbge;@pX6cQa&yW~TnUi1c)Z>|#MYUb5`NTKUl(+Ca{Yy~=f(Fb
z7v6w}UrD@PzkMn`V*Z@<f-##w)J;6o!3o9`aZ;gYp#Uf`6LMJ1Bj+GVanVqx1u^}J
z<G8m=&nr`RMFMYZyw_P(8@qxs3>ZGYHy7N<PWS}e@n|CZqCSwrvE200)NQP~ajf=R
zHs)t@;Qk^FlJ9zt$%X<Fv`wG%0G&8OK&<K0i#-JVDSqXkwsnc#8E&U?38IVTT^S-Z
zPU)g9+V)|U@@{aRoHremF9MLHCtYl6ROVzv6)Txd(_?TF<!j*Dc9rs^u=Wf~x=il0
zj%iF2MeD~>FIuVgOMbSJx1*O=gxY$fkJkvfRuWX5!UyZ85-Oc#%bxx8+EY~&6Pi4#
zP`-T;A1H+N+eh{U<0-ZnS!?1}I4L(UW*`%ggHa8pi}!2zkFJ4s5d>e-rAG;fd``Qu
zF(VGaVn>}}!ReoAW5Ll+&6J5Q%8s+qVO{%gITR;ext3PNQExSTI4!ewkY4GGb6PDB
zZ!Mj#B#_Gm6DmHzoS)>4w<yF>ZdtOTRf0UtVq|p!ESGj_<zrS6oH9?}#vX-pyY)0g
zFDDkAUWj=0h*$GozHZ=nx`A-jJ)7x5mdV~aYTn%le1`MH?k@u@21j@(2XD=|*KE~(
z7?bI7X1SD~$YG&2kJ{`b9@X<z34spvcr_|Fr=7A0mFo~fB%BEA0Vr3{Cq>0r?QVC0
zgsicgM#k?$G)a`lU!F)51y_|N53&U{yB|H{qc2<$=zC%ww_vz5)Uq(Ma$oz?q3e%8
zGaUOEjtm7t5Iq7SY(|k$Bh=WN;}08yJB=Rb!ZgQS@;<CB@;k4`ayOef(d3g3#48)}
z`5?vOj+SN)%`i*t&?r{h0*5aa+bOBjVaH}lGHdv$y)j(a0a=x%$*u4=?<C&najh_%
z8Ghz(kEV9KLUFr8y86+mE+*ZTjkl%Y)xPubZh5*}dP82xxkFjP&(re<j&masN1$L3
z;86MwCtGMfgH<qLjX6o3%65#%S>(Pad67=%QwTvw&f5|37@+sV)pz;M&B59zy&$RW
zBeY6K00*%Ay6)JOn`J!EXH)!WuxcH@V^M7OeAU=<&g@9-4Z*UTkldQq?N$BBTkl)?
z@czw^ez5JT_t7Z)X`ou*SRe`J^TlUr=(|kTvC>@hdXLixrNx%)<IbVW`D1G~&34aa
z3Opkjxf0^p>erW`&bd(?189&XeyE{wOi_A8N%>$`xWuLrTq2SX#VN>Z%f-KJotXqk
z+?-^5a_0jXPB)z{`T{yH^faB|$mv66d#wBUBM3J(3bn0w1*_X(Tsu)__=Ii2-l*m=
zibq0bb1j4x{N#-uAHi!?;29+w*t<xJ%{Uja++xjrb4J<;-ajUjYJQPu=7ezi$gWhB
zzAOCp0|jkN_6lk0MfBI)WZTVK`Fw0ur!CV5rV2@lVhXysHE`V%WxtC|<(p0_Ov+@&
zj*HUcyyX~%Di4R$p_~a4l_SK9)qZce4xTJJQHdN7$7f#{?%KY3^LHQx0(51@(NMx+
z`bFuSac;zy_a5eV280M+tK9)8RymsH$Knp%Zqcu@$B(Lya5~&-!y?T|aIphrSxnh3
z5k|HHUY++2e|giAF?PRQel^{P$+SEOnMrotMN?l8#`C;Am_qW<Kl1!$q-lS%ai6N1
zOhx74p=dg5^Fn7?Xy6?Lb%aW_Pa7!o%w2+-RMQ8w`?PE!=t@do<pO>p1)!5IQ1~0o
zPlh=m<0xmgYZnD7#!8%zGYsUuHa5o+o27*>Ge_`#AlS<%n`4ewFeIC)iRtJ68sGk>
zN(D+=psM{76lls1#0UP%Z1G<eE&xOPF5{~{0GwAqmik|}3jdFiWFk#Z^@bmQeftO7
z09^b2WgGb?#^!gHDzH0`3HMb2*yDeu;HdqHo#7|=+W`i6H_&eUH?f!h-@oHuXvp_p
zXb1pv{OvyT?|s{^jlaKsfg%4i@c8$?_<sir`A`isZxO#wGvreiP6N}^sW(^j45-b^
z@B_;#p=Ym4>kQ?VcIUdV3zW4VTPuobDR;jGF~6u_ahGkU4sVgF#4cg3EgN+Xsh_Kz
zw2fP!kH^*7b=<!!#J5;-Kckqcz;C9p@ccll8u6C~n5oh~jpi?t!n$Hy+dvGS86abH
zMrW=F(c^}({jB<sUBKU|vL`(@mXOV3`U`HG6HpFbhmfPnLJ|QZY;?<nqAc4Z+AkHU
z+7X@C*u3qXCm$sWxOpd$3LR42$$PF83kc#)Trl`J466$Jb^~9ev>pv2Ch+CCOp(<I
zodaKgOiO!0FVTlbdwnbev~vZ3=le-Jz@0wqGR+G<Ci7A<J?+>kD{4u~(+eQ^SSm|h
ztxcEoAXY18Fe{(l*ho3+Yt!`8U^VOj`fP5!-IBlQ+t_g(vY~oX%Iq!0F71uB*!v}K
zIzlgdOt7<}<7Qx;nSvP34r&^}83I&l2@c)Y#2D7*c6kNxrQNBmgbhTP)D08h`o6Y#
z?63;0>M;h+z{r|zlsU1A9LI%=aiMp{%(nbOawB}DL$c%3H8`FJyFHl9qG)+Ht%tE*
z*$-`ELZ{#vWy4Ij&1$EFMQ@FjRt*SvT_KP1Nfxj@xHrpqcYfrJJRSe)3y%#g!0mq4
z?j%(&dXXC4oD%*@S{kE+Pj_(@g;%(URP`iE9{L(lv}lsXd=?*(+qdA1Q*jyzZXv{|
z<sr#aCXR<5+<SahK6<nrb6-SSgYQDn_`_Ek60J)X{`px+J50*3uT9WSI0v2{Y=rcJ
zcUx#%#_C<Q%ocI*aw(IvkZwcJyLG>5?A>j>+xWJZ>-oy61@%di9xzL-h5=WZ46A%@
zI98QA>g6kK!DLXK+zq<JV7aLIA}R1iEia34Z1VxX{tJ&I!ART>?77%3!}4DQ(V0Z(
z_0T|3a}x&@y5oUHeqb_D@d|V<!;JKQ_tftG*s|zg{fOULSeFXDqQbcxAk4q`i=c;^
zejvZPYu?msYsj8v#7km8uqwf<z<B!QOF9y{>qG2cJb+O+Oqn@w97NF~3<iv>TT=-p
zsxG{{CqO`)MBdN~-l0#=VfJqxeQt1hPUY6Y%}vr+7N)`oxrWi}NWt@?a}d(WN&Y^0
zivhVZwf_ETw-6Fq70*ja*!Y67IYOhv=Z{i_*0V42S{Me<i5)8zm0PkLY?Cg^1J*w_
zrzI9Fv@8-HdT)e2lH`8z@$yQd;7B__%~D5>bh*;ZV`Twzy@wdy5;%fQd+L?V_}(JI
zdr4k8-Z_Dgi>}x`A>B4g-2Aj(XdM&|uU2WN4r!67!$MJwh;kJ3D=T>H@KnElfs1wK
z13DgZx^iFgOImRapDSqyf$UG$m7ZY86ZG(31gK1ybx}{ALmZEhOyXuOd47+u>I1Io
zt1mqcFUhzNdn(yil4nk8gCqh6@d{&sH%!1Q=A%s}h2T_btj4}k-{h;zZVSE}<_??e
zZ^Si-p3_OD2lp0_FyLo7$rL$Dw&o0TY*1vyM`W2x`am9-cAw|DCbwL`A@R>7{|X_o
zX7*xHV6gz8IO;i0q*#Z_Ww1X=Hd4BpgB7DQSzQuxQ6b$aAw4gqsQ0n0(^hU~?~E$9
zB9ICH`;uX6eu0yuC$Sl&GYIlghr$`17b0D0GNbNS2R~Q&a(RTV=P&}F2tlDkIOw7}
zH0fMp6MrQR@cw(J7URJ?S@+##?qVNV2cFU}ayhM?g9kj#^`D*!<i#S<=WS4OYb+df
zUKGQ2H(4&@@?=#3*wUj$PPKGNcF0zatX655fJc^*2{5Qf$Av(v#DZIdw~drJ#ym4T
zR41Hw@l!Xar0RDdGqS`>Y<2we3EjK%N88457OxSeO&ER4wM{%{Lqo96gcn=(gaPH^
z)AIZ<`!pgpH8Yme()n7k<Xg4ny2E3Be-U_#f?|rzxd(URvhBad$A1R=90+fYTG}g1
z;&`~ZyG_+qj?MwrB!fk6MA-&FR<n50F^zUKbm@9Hbs$`x*hE{e$-*#cMr4_~RzQ-H
zYM;kgtJX|!)TUCC8D)opvEazip{3*3h0HJ}HBF%`tF@B%zso#s5{?VrQT5<`%>tBn
zKhBooaD?d4!`3BgX$RYK5ba=tOstlsl$!BP4s(M+9|qgU4BF|9?ukwS7DkV|frN1a
z8t~*C#S#=J6YqS@ZPjZUibcGJshTEg-1q7T%-CY@4pTC+Y*bYrFm?U<h_lpUi<VtO
zhfo$i?WU>V&@R1%9NiPvp7b#1;Dw6t8s%l<BD%(a7=IuRCCZW*D~>e605OB=JFMU&
z5fmBQkWyDCd<z-M-=UZ&Lv<<k6Cc4f)u8pPQA<j6)=3=J2?I5sP~`h8eUgGw66LLj
zX-)3rd~0UhyK9nsM~y>5gSbGB$E8~h!iIWkc^eBoH->OUX<=&WJ+c5*#p7v8{Cf{i
zjyAfnUQK$pPI_lmyJ0fLx2ho?`+`D4EdmfDG_0MPx&y_@NZx1FP^Ya878YJ>u1obL
z6pUcM+7q9b+#b80;|@%|RqXde0bIX&dx>;o$#qOoJFm6&iGzIChlYUt*^eRDZfc41
z_;N9-IcLYr^!7ck-<L94PukzDc6L3#kHBg;u<qk-5_O!)(jopLcy5t#ubO!e6~psz
zc8$%Q#m!iBp-b(xYJdf5Bo<BuAw@6tpkUGawxdS@np`rY=4M*86$7s&>B;Ts2W?$4
zEf+e{moME#wXc_rT9TnFPvWu87^hCAMe5POrEGAV-Wv<eoNY#f&C?jiPX0`}Rpvy+
zcrpX;L|MWFO9f2u$skt$i-V;+x-_i7k<Z}!Zkh1Q$z5T-6rJ)(NUrhcM9kCfL^2Hn
z-)Al?Z%JYenUoj4wy2?{VO^j|l}gTz7|?yp@kl5{)hpY0ad8XuGU&|g>(s25S31Mx
z^iW|Ea4Fjf`?Rt&P7mv!4Y9>0VMr{zN6c#K!yQQ4rxxXGG~0{6+CQ@hfBK>dbLfB7
zn;hn=4`Sa|sRgy_uv8~qb36s42{DWF##^}~TJ;&il$AeSMLG(1HELf9y-aT7qM`H;
z%)^u+*WN>yomlqg9%7?+IilRzbx#iK!bYAsh=&jKB)%<gB=%y?v1L-Sj64i*MZtqT
zsUtY9WAy^ug#a2g+I+$E9=*=Za1p@lPitj027E&su<oG(m(flCMc^zJoXIvRtze-w
z4Pv#8^5D%m`IgGN;*fmMjyF$RJ2-e|#???@xtuTrtX12lLc<Vej9D88z!3MvxSF*b
zLd0#H8CJ~aZqzLicimTX;?NFVtn0B(Jy^OLI0d`X<hl~YNrZh-t-Vs9&D&g)+hEf>
zmRlELvdGiOPZLj%>-fR*TwKZ|c72@Qs25mxB(N_6C9vGcJRDEzen_>3bT79(YAnxL
z#YCd5$y6G_A7#tTDA+?x<Hri1`H?V22p`)2Ud=SlIHfY@c+3QGFK>1zz+I^$OHMVG
z!Akk5b$v~KH(4J+GI{1FRj_M&8L*TubuEA%qq{>+05YrTQz3Vc?5&g6Ga%l^_^&V6
zv#2>xgfE2&x!CE1`m5s*mCKCrso9y{Wr3-bKc@V$Og4=qb2Fd2#fWqW?rIFU<?+;z
z5xlWqwW>b>P{y8J@^iIK;E_!Wk5S~W^~;#5%`soHpH5DNOi$g-w#W3n-jL~H^NqY0
zU#hnMz!X#o-@TlNdx>5Qb5({FBDPDu&MtxUJaXnujQb>eI8&Y15+1sc*Yh*P8YLtQ
zv6oJh!?Z?0{NOa;=2k(DT-#P=uC1LqUPI4!FFk7<^Gr)aD6qWW?-4F9CFjEsQ^#i9
zV>lLx*=@<Pam_a=2a9HDT3h94suO-ldVXd3h>LbH^y9!&eQk|@FY|ww{D0#(|6xrz
z(gi;O2--PQ$D6;cDY4h^t@0pzVvptj)|ztZ|7=aE0Z5Aewx-M(Rb}`Gc=I24%`XT;
zTl04l_3s=1CvNkrBLuLUU#;Q)&DhQ8za*dkmW=w#&i@}ykN=T8@T>Lx-3$Nz?Z2d;
zzu_K0_=)v70XP?lU6_4*#{h6GjE+wkAPVO~&^{|Hu$;VD1?&)u&dy_-MA-ltOk6Si
zsGc(mTn6L}^uw03{vybA2;rsw-EdjzU`9|a@6qZ=y>R?3$1Pq9*4fl6nmu!(updFR
zOY8CZJf7yY_be+d-7!o^y<of`<s~teHj!0$n6#X<6PVFZ!*UC8i(5jBPVjwvNkZn=
zRH7lMjY`NFyo2+dp(YCT5(AA`OR<>FagX3Mn4nI(S^Fj0Iqo{iJeAN80PeFHqU~@u
zLDfv}o=a@O$x8>e-1!z8zKe-7;OwRco~%)z>+F8ym(>)87Uj%1`Pr<+6yC3uF+%sb
zD(Xs9s0x1Y;{IO1HNG~5s(I%pTAl|E)2NuPikMpK(GOJ!=e3MuFJv(exK|>N3S<Wp
z-Ngby$9%}s5FmMYCx(vua^d{ocyEG>aKYLg;rm3@9;0`!7u6K7{G>cr$L3jHWVG-B
zWhgYbWc4sm#Ua`G3y+{XN263xo~1MQUZbkm9DQbm`@GS{e#k3DvU4TKO~AS#%xl-G
zqvMPz^i|0#%7xud?_|W}{g-``f<gO<gm-wRKRaduQ|WsD7X?nHI=Nqba(a2IQc+h{
z6X)*UTOyZFjESdu8r)jowM1>t!8g97i4je6E;6n+bn>q=0Dt<hs;NmNz;%Qw=+)%B
z6xau43Z#d&`(mOVxw3A+oH1gtd#ht#@MATHURPFwh+}r23@%7CUZU^5Vs(Xmnh!|T
zeu4#|O;=X--{Ga4l9f3y6qX{B$J*h?EOaboN9T2uyK}@I4a@R-g5k_~G=<HZvX-O$
zcPeC6Q5(`ad~K$@NvlQ0@gpQ@&g|t4=|$YdFOuGF-0Ll&riI91{a47b(jZ2#^`ogW
z=cmF?7H2!$1^IbGj1rjNChAH?A5Os}7~;}_vS5hK=+`*Ql^Ee9vu}HtvoJx^D^q2d
zB5N@4D%-pBQQb+I<VAGLP3*PyupTIBlYW_r1BYZ>k31$$t0{x4q0THV2qQ(?`z*&u
zKmIYtZ9iJjm*<xs7v3f%pqd<90Q0q_%;A&;o4<RW$G9L|lLB~)^}IM1nO=2iM^k-N
zG^pDNd~6AEX~y7T7;O+X4^y#%+`+R=dMSwxw56IFxB2q`A2A;7)e-g-CIj<3f-}q%
z)Pi!LY`85O+pZa&?EI^PH!aKFUXxgU8-)frqmRiXt@@M1yO&y8>#*+Vv%}7)6*f4<
z=KJm5d#u5;?bCPj+Y`hseiA%q|3M}6bxg{cyW{K?t8%b4N!km?#uv3U5idfex8FS^
zd}{ZN{tg-Uir$PJs<y+zXPNVjB54jbPY2d{7MN^ZH>Nrdnxkd&v5BuPca`E_-a|yw
zcmx4Wbx^8q3^D_XihCEx1Mz?Z(e6&J^jl0u-gFiYC$|^dUekVQiYfbQ&6Oa(`<mdY
z8_^}G#VZ`;a*2XvN|z}#>}cEBF`!+0qvVEm-qLC9qeAw*o;!+@de?BWz?F6SC<d`X
z#z<P!)mW5k2G~&!eEpG8I3`3>&$E*2aCkXx5a6YmA$!_Kf?$MROP8^suJkxjbV}?>
zOVdOty#&v->Om*TR}VqASeEQ>xQ7zI^stQa#RvfkBM_Efy(16nUt)}Xv)RHlnbp`h
zzNY<AR*SrcGlTY}?Xx~EaYSRfE&Kr>8&RBNK@T{1=c$YP-WurDt7L}PuUgwKy|OCz
z<P77aZW80I!n2~gKjmoK^3W)iq~C73|H?Owg@$42Z6j$q#ait1ax~wrIwlJVq{(p-
zA)(Bh+I;UIIuNfUS$8|VOT!v*bAhf4zzQKY6bmk0KWUt55?KMfPnf2v*bvSh4=3<9
zHe4yYnxdqeHn<yEjLeHDqJc$V$}|i}j+(1JI?F6tE}=U)*qqbMgXz>Hnp}@H$(WNE
z>^#uqN!?&-Tcov+)f-KDSk4;wUQo}@`NX~{&B1!OCse7?+GgIZpO8gv%fZ}RSqrn&
zckYW5_WWt8N9MHE>1A{6?p@{9Ll7_id&5Ws{xVJrTZHy#r_oqKkJ1?HAkm*cu1vb-
zvIb^n$I>@BH>Y9m#a*WiY|{R+QOjE00#}B)iWWGqbx<N6#wfb?1#KkK)<63uK?oo`
zR9VO}Dku3^Skczmvz%jm;^2wTwKn!jGszYAkQv748WOF9bZRZfyQ3J=T{09U=)?{X
znwBBUIxZZ=t~fCHWrP7)h}ud`Pf9=8f4k$Kn26ud7Pzmi(y#2%#uZ0~g%;Y&a@P91
z@f;#TWvq8u+aWJ(TwK?ar~LhW5}q}M^Hx2KY1!Lk68W}E9Gn0uGF=S$3Ql>H_7KAe
zb1if@<sx(5`>OfHjY{o@+tcOf=vY8T4N*ojh0YD(6p+obkDL{?L{jI5nN4YLU(#n$
zz3c-d$HdIA4D%a&H&j*`JKAQ0WBI3Q{XMQ~D#dl2`*L{`d|cRXsu9}IDhGX$K5>my
zG((CJInZIFx>G0P!j9?|X!nlEKbDA0{<!g2s-hxa*o}bieQQy{7yE>5F_hfVxz}XQ
zJ2R!_h|3*!+1$bhVpfSfYUM_xhI~32NF$|yTpOKS)2$P#{vlW2tLFCy!vwW7STsrF
z-P;OYd8;TxtyQ8p$<-tAw>Q?iO=VBQA_8wZ$+AAHJ&CE!$bTRy5UFj98ye?c`SFri
z*2<|}@g64m5JerNEC_y&3hSP2Vu5B`Zp%M|1xfv=sI9X{ic!!?z3$;18kwsgmxv}X
zTO-t6npBcSa<<2?;wg>P(UuX`{*G<POiKAV0c-csgsI#8>Q<B%byz3#)_x~7Y5-2Y
z>EZPHQVHbbarMBZMqL|$rqw{pX1UF0gQY^8AEJom<96Pj^C3W7nJf^GuigE)Q1hi|
z8h`7^v-9q)f^#2;coKn8N;?Oa+Kb5~7ZDB889I%!qLj8wY6}J3(dql&7+D_{x!bsi
zSRFXqKH5#BN7Tq#423?v(%1H5D!SoTjC+yU_V|ohU%{Ljy2EqyMy6agR|C&GmuFUl
z&#9<L{2u=x<0QqIV(dZzpV9?oA`CRH+RT;O-ZU(Df9EC~p5$CYIp}jsEhaa<P~htJ
zWY{860n4$<oa6MeYnNECsTFv?M`n@ZyL5osZ~#-M%(OTg`1nf4fUBV1;oZlDb-W)1
zSO}A95{^pYNEjuyw9_Gzf6Q4r>ULYFY`nTV2XeGVqgX=8{plX=8X%hMz<_oCBDnXh
z?)&o9@)=F1YjdCV8W`zv2(EvV%W<E<dYt%Tr!iFfE0e$=XcyGepx%9*WJyi_D>zC!
zlsTs=Ugt-Y*?W5+&#~2|^=GKs%COLpV7)6jn61r{v^IIXEtN7fgyM%(gtarnxA@qQ
zcaDwWBg99gg&#iN5GW;6BY3&I%n_QQtzp+g)CQyTj>fT~AFCXnsQjdBiNw0TC~|0F
zikvq4F7+1y<pLSct&vCX2Wy`3g;K8e40x%Ctyrvz`1^+X3ahHv@$;4(y}o!kz3d>L
zVt5s(FoD3d#PV}_=**hRQAW`o>j8BXj3|&3=UhAb1v6n3QbnHJRG!*>wxX9wHtX$b
z;+!c<N*W6;V-y|i%NkaBRTh?-5{D;pGU8yPP}D{;MRl4!=)nU|teV3&dMAswH{iRs
zm5Mr`Hk@>Eb4Dvh(JGE6H(rh&Ey(wDu(HZ83xy}|>)R}hT+_Hz>t#i~Q1;!KPqTXT
z$X|(SHamH)|H|(75pF$h9!DA$p7_c}8f9B6Z4S*_pT8^0BKNOu4rBuX^wpy~44=B1
z)5%<EY*)iI+DkRJ+=rw^gc&DrxQlPfA`l^04hZvDSo9I725i@J205$ZoRe8}fzgZi
z^CWI64t@VhM<n(3Zg1aOF@9269<6jziRN5UEiJPvgD8GiH0^mjQEV4`&`%0Z<+t^{
zVQ2o}_5f{0P5`*9N}BT>=&E$o&tn}kplaIP9shJIGeBle^QFh+ucv`t0ngNKZBP@N
z9dc8V+u`%fy)Td0l{1seMY71K)+h-;!l8=kWqc*dFNHX-z@s5IFm@-0Xqhr}-jiw!
zLs^KTSOL`8QQou9!?Aop+{~V0R9wx*Tcqk*4E{@b<GCp|SPRYBBR0E&Qi;qtCk?HN
zF*B)YhQE*UcM#hdlT)1D_!3#(w=7t$c=h~2JDv>f6C`3&fwm2?{$e(a_z~MZr(l!N
z+G<N%7|P}Tey-XpfK6li=%;6fUpJ*zw;OT1d1vLrW%iif<$^Yr9|mg^!VsNvJxD;^
zI8F(@2o1sC8Ltwf0PmXyC?9sq0BL&@BCkYH>J-)qQHY>}8{v)YHz@n#HGYmGV~f5l
z1THBveM6si7L7!T&te_%LNNv?Z3mR586<R(%-LFF;W2}4n{)9@FW1|%B)&Hga@kPz
zpjGr<`XZ-!LLQq&U^ki7k8qiv&-Z!jKusP~@72+yZy^f2=?wr8WLHM#4u_C!O;spk
z&>h{E#{K+)rM}O_-%q6`ev<-*8EoBw^jL>;4=|`pg~rPtM77ZXd+T*wnSA@F;oSEH
z%KMA10=e<Uj$O3j^Bsy**+jkgx$(`pwJ(6C)fpaXGlskDP&^>g6Yd!rxhjlDII1RX
zX*?`v9$5BGGrnxqk<NNSf*}ooh@%En%YncqyJ7@45UAn2QWq_oZ^H0K`S><^Jq-RW
zECjHg5`mT{)4B*ZeK_ZTL-|#Ok4=WKd*1qbfxzXspcYoJ!g6=c`CYJC*9nZHH1HO9
zT&tp4TS(vMg&+K7@-4au)BYRPBo|xPyY&`Eqz_@hydD5H$dy?G0qCKH4)<tc=V+hR
zp#mJG2Or(bxd-(R@M^wckK`Nta7R$Fi<lrM;%a@_lpY062J5?A6ybuqj*Jm|km(-5
zQ(hT5J8vf^!dk$sR2k`=g<ePQm6rm5l710T?>A4$_(GjC`&mT28D?vTUW&!QMJ2~$
zKl}{p8Brm|-vnPn!gpZk4nu4(ij9-nWPXDcLaPULOUCpG)DYjS1e~nMTGt~FT(P&-
zJ5?@$@WXgUtd|XnoCWtJufx~fJ(stgt@i~Jk1N=t*=XHTqi0abX)i#%HIQUV%1MvP
zaq;?inP(a$+_o}vjKz6*rqO61;=@;GOA>-s6hIqC_H>Mpfn@TKAo5L9>6LCPhn?cj
zwI8}W=|Wai6*M1f3`>ya2o+KFw1Fy<V$xxR09Sh*te?8xWhoJBaQElva{?j1w{@63
zClUZTABlu7r$ea~pCQNeBAQ6EHi1r!hg(=wD#s*kKA6Vs?rMWi+1P*>CD=o!s(Jiq
zL2ztrT0haG^lRjml~`Xp=A_kU1PXHJT@_}{CKaPcF_PL*55`}8t{Q(H{os0)zOWn5
z-RC#EKl7WrzY&jw01-#<S+h={A*rJ7+UE$I7&Yr{FsUp@FTQ2ZqGT6;m|}DR9x#{4
z4S1Z;Vbqtp-kr7-0VP)E!mb0A!e-N*(mRt!+fYIW_gS;vY~T0}d$i`Yg~7^~zKNU-
z#j`J}b}v4EhbRDJ9dd_lVBLIFJtnOGDS2_2zV@Bu>rS2*Mtt>M9tRL0TTQf4C6X6i
z`r&M7tYOG+>NeXa;z<3D{wMD9*+nl8<P_c2Zx;vp<L)Jl;OMF}%!C#B@;r``Sug0&
zRB^c*mY30cVcCeB>R4Fb+yi2b&w@Peg82k)w=di4AVC!7U?`qe;K=`ul#0lUb0V{D
zXT_Yhrw3X;{nbcF<_%G52|%>pyN3jqi3kY46Ygr31Ig+5NjMY!no5^S(3Hc9Gi9lw
z_{!b0Dr<w9rMzN&P4>`D$Y3ii-caIlhnsI{<w-ggKPB(lA%|xLpXvbJdPtL3v7U9n
zija2=yt+Jc@g{=%Q<Paze_M(_JD1wVYxPN=zX(Y2bXzI4teJVs8B_-cduquJx#P~+
zi6-oOc0TrfwpOn-@7$`+#`-S{G)V)Jo>whw<7RjJTz3xbsAq{77ZRuz-t65Omdx}U
zZ(xWUga@7FhIyU)%^3q|n9hC|aRu5LC%Kg(VKzk9>+;!ym~QT?+EzMa_inL!dJw5T
z`ciu@eh^yaFD0n6*1U2<oLix_@)^Oob**koF8rYsh!D%!k!Yre+^2S!Gq2HC1iGH=
z+g17+h(#&>&xMr)gIPhoij(Im6ku1~@}{vJsUmGBCDql$tt+2nZf2}AC*`OTn%5zt
zE*X0bQQfl!ZUbslkmC|sm)Y5wwp5fC4J0<-6Gk{A-jMRWwS=Dw;*78kE3Uzd#OU=9
zh<@&t-(m`~S=?1>LlotYcyhVvasRDaikEROVFJRR?U)s#FK*;+Hh9NblcZ#uc3Imv
zzP%YlZ2UEbRQ2IwhPyii#Y&v5i)84N0*_LA4$kqaAvH9u(hzVABm7p(VF~n-ms+nS
z`mVjVF8^tQA?ivc-N7pQVpL9EWB0Sv-fvB_W@atNJaaBJT{rNd)nnIgP?(vGT)s@S
z`q-qu6nU1ltmN|;qy84BfU+=ct18+x)2(XE9I9YlG(nnh++-&DU@O#18mszJ2OWoe
zHe9Eu=f1qlp<}MOc2Qn+?%}>hl!1StgLu2{?Xhne^5A*=uk4Qhl^OBRd>>PSpRnJt
zpq~F83!3?lSkO=Se~$%y^xwyVKK)lL=!Xvm(+z>Id4I9mt3LeVUS9>qv;c4BH-AIm
z4+Z5{1mhp##y@xM&s((qrgdBbcsIm3f6p4VOn*%y|Nq~>j}s7pUM2Wz>`#u&f5$ul
zj`=qO<<Iy3L`?xU{O1_TfG!XfzJKY!7_amf!Hh5Ts1V<RDkBF#uLbUHu?s=<jYWVP
z-FuLS<p)FwsV`LNjezq_ufP9C8*shA;m@i1b-MoJ>z5;6871}t!`-<=0pZPcT%@b6
zYMiK6G97rN+Dyl+J~#8(dbOgK^!k}yB=nu_MHXkLOvFkWl%nSgOmdg<xyw-R1;W=~
zv0DIN=>q5zsoaN!GEhb;H-R2w&7c0jG>)R&ApNPuu8-|cpNgNEORA9aT>K~u9o@6C
zD~7tLVl}K?e(l1jV9_pezxx%rgGgs|XJz@74mk=njh{h_aO~&`Cosnt!}(%}9=rh;
zfil^gRn)7*IJTqOb(*Ng7;m&wj&X<w-M*4<yye||f|I}g8fosB7$?>_VO@AyTK`_J
zusY3OsA%TQHWEE@c`<MlgibJ_4mVW3E`NPa!xlg2l+;k=_U^N_q=XhZBs<^SPDyAG
z@RWaW5`uk;qGmP)v+1EH{Cq;Cqhf@CwQ{a=<i~QTvRTrq#)z)}V~o3DgWu0<dZAl=
zBgxq!^l6a(xklH;zX;aLPZ$^u#kxQdOAN{^5IOWzp1V!fJh;+iN~EgbvF}=2;P_gS
z&Ce-a8PV5zf%4C^siU9_O+px^dsu&r-NP|p>iw?7<(kffR6)+|sE;)8Bq<M@R&D|s
zzl0uhYPQRwMu8a$JMs|mhzv0&QpV<O|Nh+vC<iZ1r;Pw@Rmd|G{1-ulIvA&o)Vm6#
zQ@+b?#CQ$X)C@5pw75GsKXyOry+Z8SDt!dx;4PteQXht)%>7>Z!BV{`#fA<Piz)1e
zd28+N?2Z*C3+U<!C@DsJum|O`esI#wHcg&NLKr#zMc`+@oBy@N3p;`d>*S=w-@x5M
zhsN1Cc{r`?Iy%c7Xm)(M5vkz)K}x~o?yG1>Td0DOfqG~FgDSlN!Ph1uz*eZrwG|dR
zheg-MLfmsU=33~hi%-edy4h_W6-uuDcrCjU>-Q`UI1cs}c8Dn20NZ1Mp~@gO4auIC
zH_GsgVEo$0lo~}G?B=#ydUZXN_{lf(6G5T1r8l6e{SMbyz>;hm7{R|%7Mt|!E!&q;
z@UPB94fPA8$}k%$Kam;Jiu(-kUT6WfO6C4LoDN?w;3`h4Hhvt=bC6q`ym$M>`-Z_;
z1RE8y_vSBRh`dk_5Zvj4=4&e>H3vY-xuKYx&Z(3qo5`m}<X7OSi(&vK?~&M<-yeJ$
z#xMvWyU1x_gSeqjLeF&TbAh_^Nxnll$kKjlT3hkNr8n1j=7rhmD}<(?@&{ud<p_WT
z)D5j-YU2zG<cex<xr1qW|8?tNSH-rz;b8*N#W>f<-o)|clgMU_8o)9s4rB}h1i^(H
zwSJ!xUdC_V@^GALWQkI9{wV(1dnMgkdBRxKFNp!;x|4wkJ9&#;{S3skV!AVsjnrhI
zfQBp6dgsP)CPpK%SFd>!R%T3Pl<T_uIl}=V)*Fs%NxL}Bl?yh#RH6D}%R4SBR4FpM
z6)(MpjRsuU;~De}_`j9<2Qa{7%CZrgdS&L8ZH#H`w~(c&sx-ocJ}eaPcFAfpX1nhU
z3k@hzpWlbjU{gx_ka2|ICGBZx`y|-T)U@E3JfHAr+)w+@ueDxYeE`tUFiQ-9-(f^e
z)TocRYp8wpO?kDtRrOg>(FC6RSb?>dD5cgQ*@T3#MkpP2zb%t8PA{#?Z!$N5qevcM
zsx&x2HzFBb$SqEgND}yAhtx>bH?CtpMuiM7Gy-)-FLkB*gy)WnpS-Kgu(9u;V+d#e
zz{4)rpV|Gb$@yFzcLnQ?;>4;ddaRTPsZX{VoQ%)&CvvR_+7KyQs&fa<$NK3%uiy1F
z5-Y<Z+VBkM&P-_xN2NoaJuS~`Y23J=8S$qiYuDQub+7yB*VChoG9XtmEm;_%j=8C3
zUz9Ujmmv(nR6b+A;ktG=S@3BaeaWz$s*19bDkBlXzKj6_-(^GdA>rXb&*im}A*43h
zYUppWN3Tiao+R-WCQRGARLh;2WVT||vrh;}$bI}*bo5Nd=e8_l_72smQ#Y+F44l9e
z<sIZPh^F>u_Z}~SX($=VGuKri7ifi(Sb(Zg`*0KhFRORu^{!bulsf{65G7+HN}p`>
zq>Z1;aQj@*)E|~B4esUyZb0fVJWo_Rhcu@9eU_8Nu8Pg?8!)=y!?p8o9q}N0rF`IH
z#;P#Qi_+u33bmmfP6Gv}g^xZ;n>>`Mm>*71mkOas)1L`ZxmoG8LAGhkN!=m|5x|y-
z;5aF9MtRss3*r2F?K@M3;mY^R^@qE;LfjA1**PeME{{C=+9C)$`GFOp?tX|3T;v~B
z4~3U!w*<V}B45opFc-c*Sh|oFN%wOpohs>sF{;EtnR`t5c$Z{P;X>hYgl%nINN|s^
zu0&}ukTY^Gcl>^Ro+`a9z}6Lv&Gq6PcZrR?DU0GemxC$mr#Q^QT@^f{SJIzo?X|yZ
zRt40poKY&(DWUiq*eA%6y-&;Q6HS&WWllE(nmU8JRb=#Tf0B?;-XmOVP~n6aUwp<<
zi*>-S4CP@RL5x_$<Cdz|%2Tgy#x5{wM8a-s))gpJCZt<6|3z^8x_bEo>gRi>#f>tb
z&ArMY{A8YkEK_crZs}Yg|G8i!;1AW)trva`XV`=l!uUTZANN`vhgQETld8`&Q)u*Z
zXDjVfJMyyK(Cj76W2r@Ztf+^#a6=dYT9xCJVa-`+hG-GHTPqLEw{N1{^DLh#5NbQJ
z;|xO}o-&;~3T6wFQsZmQC8sJ69KmO=9Yl_CBGADz-AJs}`AH)7i!V9_$r%L^&)FpH
z1kt%pb!+Sa9vRjlpKQ2F`()pKVCi!?-d84ookYIxWDDdo!#avE^+D6LWT6g+6*ACL
zt2FoY)6K|YU3J4~_QHO_X~UMXq}f@&F9w4*?(nzC*6N;RE~rB8t&l0YE<@+eku4cc
zE6$eZcQGiZN(%=jiHEOB@ExwS5zn8-n2T<bDSV1`4+gnT$Bxd?>#N=f`K59EZ7}>d
zfNn4fpzFVR)d0-SDfQ2=da>HFKUJyEe}vT^s{GgSl=Lb;?8MGa;70|VS-&7^wUmo@
zBY-^riIOOgatOE#|0Z?+U2*<buK~gVP+I*qIsOBMOKNKZW;EJ=@Am&y3F_>lYL^M1
zKyv!uuFn60_|E`moZlRAfYy9z?6*zMp8^uN5<oKiKdI%vIOM;)U*>+rJN}YsDzpFR
z{BsaFe&Cd57UzN8%(jq=JXtqBf8;Jpg)W&~TqpYOTYiZDUe+M=OR@Q|37`PvNFG5M
zrg0)eM{ZfJxNDF2za}@2AHMy=EBJMG|Fxf4IrM+`5eDB0HC5>e4~%wW>=?7q=N*2K
z14VrcFiayNQ%1a@I8h?8^o}9H58CgCmNCm^L5p-~yYT1JM`bilKBu>f3OoFZ%`IBn
zRRw)ixs$92dwZ7;gc>mW9c3gq-S0i2IFG!)2pl#C1a)s7+Jv2!uRFPfjMnw7$d$>W
zmv-Q2*>=`RczDwtWKG3{Gw_5l+ny3w<5ruYyu%{cX~*uxELWxscJQ}*lB87YR|NTV
zV*KhL?&Ou*>moVn5ijOE77x>D7l)GSQP?fWE7qQFmGILgx+bD5GsiQPw)ZrjvUQda
zOf-X)^Jd)CP4Qej6r3N+3HHs;@_OLR8=3rQXuE5)-=iVfP+^?<3;)+Y+$ki5dRiWn
z%~?Ye>X*}vrZOqfMxn}_SihzAMe1)B3Xf_;`)KUq_Y$HSC3^>Vx*~WguVD?9BLHOV
zGz=o14;IrJwTinp$(!mFCBU-wHg$RJZh_EkRlfLw5Yo>KaT9zFPQ|syW@ZCl0AXgy
z%rilOCy*+OFV*ursW6!aO}MY=rp#2|_4r93mg^ytTQZy&L9qSljm3|ik-<xc-QcyB
zOV|hKtd2kxj8T`4p6OI|fP@*8VX?g+Z|nU`_dtmAV8U&RS-E-Np6f-Me-RMjhk?9w
zc5n#f8NgenjuO$8@{BdCuS**+A(_5X(YqxfH!K+(n-o=o?}rlLREw9u!NzDf3|jE$
zl!-11F|i~Z<{>kY&flj*aH*>7evYmYe~G-s$<YPXqdb|m=NHxT(uKUzY?}9Fb+mTP
z=1ixyf$BHy1cvU%LXom>AR@>i-4#y`!EvkF=Ej7wTy=LhLv;r;iCydO-<ApEg(eiG
z(R`hp=*&$JZ6H5*4$8dccS)<kQ`?RM=HPNDp#Hu;=EwZGE}^h;I)zUHgdS_d6yh02
zoEsCvbiY~We*gTuIj7*3jID|6C)pbET8b{;P0Io!3OWyu)ZLtgs`D0gWuZu3c44;}
z2c>mixt>o2Ker|)e<pfQP22Uuu0wxR-~g`bx30ek@QKrt&jy?_$<RF!UK!M#tP3e~
zuDCl=DU5VK6Zzf?7nCC$ZyWYw!icHnr=M8R7s&O$4ghVWY=CD&l^NWye)_scsPUh}
z2ID`b2Zh!+V;8TC12!X)%K!?A5>Ze~>tH=P9i3Yoya{`3SY!Xlun6~>)RV{0KLMm?
zlnx$8a(0Y_XWl@=BXQQ*F%O=hZ8}r@9(6l>J(n8WnMYW88jU13X)wEwzt4O(ay>&f
zs_DsBENA;!ZFG~mq}iq^Z}D`BfuK}$d~41^5SMT#zaoL=t~sn-FPei0yRy82^F^ah
zbRGcHEaxec=gA9Ay}InLK0O260D|WlIj>=z9%53$q*chUiHO})-EvovoOy)>#hF_M
zv5oOXrB4%*xMI8OVWFH?n~2a(?d4cLWX%Vu07ikA8P1*KdJ(*Lyq6SuahZs33i>&r
z5ONF=a=J6_tuh~wrqIzQ4|<2^#maWdN;vv0#Fi?S=+4~ZnBDzScT?jNgPM1Xt}gM*
zgTO-AQ*>OH*ldsrvjZ!I;h9Sw(ysAaMdp>6Ii8xA*&4T>c~kHUbQ5q#8-gOCR`A)P
z?o7cJOiDP8OSD?V09v(Zb#@{rdTZE6^U@=3#RIi@j@MK=0g?{64mGT=<fUVZ4Nn*`
zB29*vuf+maMZ01i6MVUZrl%n6(Q-~qIAq$f&IP*zCKw?Ni)nTaCq3xhAZ-tN_n*bv
zSBoQuv)rGzh7zxHXFC0ev9`cKyH$uGAi%?RN0D-Q|B{1j!!XSE;!AGYg5ila&FGNy
zcvu8?q8d@(usNj3jXYpzS!FhOS-pdrRR=@f%0VCXaGEdHIMrBG^x^$Gy$%e{b5AZ^
zdKxg(tzh*{dSqth<Q0Z5Mhp^Af)!lcHk`1LoL}<~sY!i(+s5A}{_gN=T`jMlEvHfw
zNj=u>Eo3GLYzm%iGDoLquBX7<6sz|va%P0Jf3#T0o!&~Rb$2ejux^9kh+%K3;#LZ>
z^85}?a_Xo^;hwu}SQYw|ri<CzmG?oY7Ym=;jS7#15$Royt7y`9fP<oZ4=^BnC$(CR
z#%Hi~T>j$o$?y(K#)qoGz1C#DHS6i?LV)dH;2`u;3j?@erALKYQHU|5*g~C0_vDmG
zStHhfB}wGhk=<?80FDeWh(Am_fnfD9Pf)P1K)(65BCMt~rBkQhP+mCKRF&O?G*A4a
z(ZW7i7@P15g4>jz`B#1W%D#`xp0+VTuLcs>b6lEI)Nw|6d^IyisOGnNcktXap%Bkq
z54;f_{$`=|k$0gAt;$Ok00@Ic*kQt=n|R)DGrcujL(Oe%^_4yYbGTI}^Tw|bR9>1P
zaA{>2189}5Sb-JluvC@y7-)z108)oUHMzT6C@Re}WYppwHF3cWBtqfikM#6RhkA2O
z4&J{Ahz~OvFOr)SuJ-2M%XjLr=k`{qE^Rc5fv{lRm!0j}IIBsTOYFV<Lcau{U<@5R
zr!?6WzJ|y-DZ}SlAy&qOaUa)90=$5zQ3LE{G^kU(3r49ZauHMb(Q;{+skWA=KR#%n
z0_A%xkyHU7&3u6f0mO%@5jy*`Tgf8DI13-&fI{{4M*w6|4<DK16#bElJG%cFdWGJ@
zg;7OR(LZ0$|JOcZ8K}cuY(Ny2OJK+GP6>fm(3e>f-#*0sw7sf6aj_f(*Y|{z;DpD-
zq=YW6sgDVl?xH-$a%w}b{Ge%q$|EWWw3vV10CT_J)*TO|$0>}pu-`*RF5M3Tks{{E
z8OB|FEbcppX#kcq!=&cre2VMRYjBFc2wv{LfnHJ6ZIM8ehN@H^gTI1rq-qZ|mfaE{
zxekO4XFsDH)?oP&y^IRoV^o&BfHldY0R*VhsJqz}6%!LO)httuvPQA&8^~k|WZ4}|
zX6k*q<Yu)QeCiZ2c~lg~h93m(;0VlB#+In37><z3gGOAnFk5Y5CoUI_M1n8P_qG>X
zPBFDR{($c0Ats<Fw#j0-S4`S}%BaCJ6LqCDL%h0_EA(mPlOEm=$s4l_+m^i87t1P4
z&~_Q=-CK76W2JA7tOneDmrUmo6!*8vB?PX>U1`lbm-^Z9;V0GU-S0R)AV`A<{S|Ac
zS3CCJ5Uqr=;4KE$n;Q)Z<b{`s-xNyt3&y^&9&GYo7K`8{kY0*}vo;B2gY{6*H`V9o
z8P=v%lUL#lYmBFv49kbxkoGHcchv`|=+zr};SWmj>|lxWo)Z;%mntM*#1TS3YTJKA
zM!#apa1rzK1+FsrPT&2G@-j*c=Z@aFB)GQA2rq#l4L01@pLEGQL$e{eYU}G0qN)<j
zira6RMDRGzy?#xlYY=aI5=XeT$c9Zo4|HU5RgH~_T(ca1wa-;v7jd<VVzfA+dvwLM
z_X=}2A-mDgQn^T#VJ0&+&6!w;SRW9pb!vo1GCURTzf>4aK>CO(=}5LyFBndV7Xsg>
zCd6*5nO$6((#VM%6UeR7n7b^%G5!j3`)cuB^A$vnuU?RfHT7%}awHO<C9r}e+tzgf
zA<Cnv!x;6)DKFnK@MPDD#<Z#U>IfB4{PgdEQR8`V#2D%>P|PCDSQ8&cp|#;+x4W!l
zb}L)GaIRQTb+YQoH?Rr!@3TguW^B_Eht0~znxRy7Y)~N9%?2s&6VtG_UgX>4zF+R2
zM2Myy+~n%%ef<1?F!$!+Q19>m_-G-7vhP!oec!iC$d-fbTTEq36B0tkj3xUPLRk}{
z#7OpS?2=H{LYPs=k{O9%#`JwTEvGu?ea?A*exK|5eg5d`>UB*sujli=@5jC0H(l+5
zv?a-a$V7fVC5g8Hnmih{W-z|Ri#5i9{^}F{X`6~N($|vpSkE68>qu6ZdHa?-W833|
z<ZrRR*|Uo3r5o#M*H7Gl@@ukrra$4j=058oogiFC&DRQX&X#SD#nED>o)p-Oi+4<c
z%XMo*mD(E)oKbRPcFJD*==6#EBQz`b30oU7W|{>^M$KV-bEz|T{Om@~;rUhOVm8O`
z*{6#hGgizAKS_KUpMSnznF?H(O9yQFHV(->0Jrd+HIA5KP1GDg9Z4S7jljO`eEV#P
z@7T$;N+HE#NslR|Lqd|QA%`H2pFyw3uzu0IbI(@~=t`i1YF50*-`Lv(m3V5YOc-!J
zeIv81$PF?A<>`sRL-1M{?dEtKYU3P1d)CllqHDu4M`~z!u0f-IYGYik_Tr1sfjYJF
z$K{h+pdi>7m-fp>AXL8p;EPg{?0L_^&WCVF9r3hnM|r`0)n#GllN3jE?t)M54>A*M
z^^9P2Q$O?qU7nw4jAMDOc%5ImN6gLjL_Pbg^MP5!$OUPE8SiB3(%8fZGHpE}(hYAr
zYs7#p;W@Eh>j{6Y)2qxcQ|WL9DfF)2k6C;|2@6#6t%+|&s_`+btloF?<Ftso;^0sD
zK0mw^OD*=GxWoEkYP*s{kXO!YRD<}+%E}P~JL@#|3lt`YH6Mn&04ae2t&&NW0OBHN
z;n(!>y6tCRo<$x+wJv@4`6$SgMaG-io5C%}{oDnUMPI7PVw%`m$>5<zQA{tg!tMHR
z)b8%|n<>39(p6UQ@a%Hc$AZIym))3_9x&JQ=J9kkrYBW3w&q1fJDc8MHnN&K-}3hA
z^%&AkbqWF`cS`{R#9;}CAX~1`@>`XH=Pu$=!77OOLXybKWjF*AWYwA`eTUQ}YU{rF
z!o^jvPyO;V{9XDyM3_g#s={>8{BbUrWCJXnt0eGz204(A0u|pHXUA3?3m3=7I-w!;
zmf<Dp;Yjb2OQLkkCXWX82Ia`s@{vkgx)`{}Mz>MHB*8L&)G2)bgL8tTB&8bK^Img$
z&3g5QDReQdTvzcQA9P>l^o)Y<#YnO&)l)_L5*ex%9oRAq;uW9@r`C?AYO1>HSip<B
zxTV%n_uE{}-w)@hLas6<^ek?zG%rnAp>wiH8Ly~~<oS>>`lNKp*?e^cf<gWwk{)?U
z+_4?aR%M0Pje%<wP`!|UuMuqM%;Zs9VRxlV>8+0amZ_geve)24a-Yim%=_eL&B_Vn
zIn`@}Wu#LznmRP+FW3iPF@C1U$FY<_RO|%P!#QS8xSqr_M9X1(fgZS-H*Qa&oq-l!
zr5;K_`)3n6CY!?DN5*ag`>o6fduNTAjc37!{ZDgzQms>4ib#M(9ji@Oo)(kVOKM>1
zWvoMD-`Jzn+b!cCbN4hGycTs}JN@iE|Ipf#*EYA2t`=cUs;b_$D=VTN%byJ4V`i8J
z6oYmt83=Mbp^Ef%^AJ0a9=(^Ke<ZcE=v1=uQ>P?7r^|=5_CkYz9Tt)p$;j)Z`ngCf
zou_$S#+#MrwrP*Oi!~3w;VzGHb*85QadCi>USzz%e+B_f_F!foaoKit#TWU_gX^v~
zVk@(0FzXqS2>AozIch>$m69h_Xy)L1iL&s+g!5P>lHH6aJ<?_Ir7pjL;)JAN+i9s;
zry-TAs<V7mMi5A0)ZN(uq3XFUQzOX?qtmN*)T>`7(xn@vp4u|A6@7F6QE64~T!3Pi
z=awn}8G!rK)My5*GTivI5e|Rji=(w3A*)^l02{77oB76wfj+3pr-`Ff{8-Hs145dz
ziA#)p#>s2K&*QrJLMdVIISCtq7lDYw&9>yPeI&wP`^j08cZY+i|DLxr`6c8e@h#-!
z{YS`Y4Lxz}!}!F8KVD4s>ERDKT}mNjMYfwyPi~IKAwrv6XO<Z!;Cwjksy6m_ky=A0
z!#FMRN9V%U<uO`hovVP|gWL^9U0|s_9lwngLB6kd%?Daac1Q32F}vzZ+~fC766RZ#
zXMhNqIEZ=o4Z)|s1WJHm1ZlxEzyIU+fm*vUDc}KcB*wHa`9})ji(mTX|9^e}%EuKH
zl7#kt9{y8rKaeN=ef05eTKKOLrC)N|z$w0@l6TXpcpkf1!)#QyJ=2U)Y+-ZB0|&R1
z#qHE*ry0d%Ub5>_CtZ8&a%b&f-PtR~2Zi=d6r-34X84RTtZ}rO_e{eZ;dOCj%k{kS
z`l@6T>9i^BkK!J)=SqkrH@4FG`1bK?pkVh~2%A`7GC#Lq2PLq^2x6INgg4OTR#Y%M
z7NB_PWc;g!<S-$&s}*ZjSI*72W<$9VZ}37<q!TZkg`^t?4v8m_E*<e6ySq(8Onv}e
zyzY^DDA&9pqW{<xUN=^G!6C7eD8~ExY|2Kd`kLESZ23XULt`&?sA#b~&YIZ=U072Q
zr}8<>W3QUn>ELhK85FKMVo?Mj-RiNrEvUi(G-)RSo5swMZGJ>Q<V)oj$W;=ORDr5J
zJa~#xr!^_~NZ3t{1#R=kBXVzk(;Ii6w7S4o_1sh})B2jKe(Odtxg&RHpE+?B$R%e0
zHq%KU38~qrNZt#`Ra!2~FW;I^W<pOikfTS#K7)|Je|eW0ROnUm-txAhRk_w3wY+BS
zvpqZg##0+hR<FYM-=3k@Kd~SD>d9x&-I!cBatmnfj|$Nxhx>byD1j)OxH>S`?Z)cH
zhtHsU-giHPrhy*OEoWVlAhO19hbfzi4D_FW2K9;%ZM#i}s^r{!CW^~ma>3*zDnRXz
zMT{7#j+2Xu+^+28o7Kk*ip|0Y#bCL=J>HYJ3@Du!+Q!WgQWWxE9;pBOfdc)y8Dckq
zUXp35MU`v0ybsmPu=aeKss%!PiDp@+Tuk$7n5mBVs8_8hjK_yBr)ar)Gq2ex^jIod
zO4sCrjE0uofDNn0<WP|y03qLM1KGwsi90m7X#$-w*%odBbnj2Ey!i||HLvj*ga$sc
z_AK#F)U*h3CA#}}n?`oplH+lX)}w0TGb^Vz4V#BAOP0<h*|wsuFJ12Cx_Kz_2rtFb
zX!8Kj`>;v}H^%A2<Eh$YGvmQ$s|`y0ydG~zEiAph^;T+NAMeEg?lDrw7fMHxPH}?Q
zMca`x@{q0bYsf!cIRvA+(|}&cT7YblA!Hk?@oL+g%m*dS*}g2}9TVIgOGhku5(cjX
z6{ClN!m-0%58iaT9zLqocdV-*=k*23i{#GlT$M;ZwjaFBf<farb4itilCLcE$Blz=
z+2l9V>qb6c;%5-}Gf1ptWuVHAK~$z_^)qOM)IL88kwo#{sxaOs7A+SOe{?)AYJcM0
z0W$+4D{}p?*($*P$H4eQKpDgf6kvM>4+DHz)B(liAb$GR;=kZEhtD89A2w({q!Bvf
zNoQx>?F)|e-RsJq@XnS61b+rnR$G@}P91|rhz=DQJzDA?GAwm`Sw(7kF%34+hb(`W
z6Z-!kCx09=s9XCg^1{G>Vhd$}E$083EjC%0fA|uupKsRhU)*fdP7%;|a|$O&5`Dvf
zDSeld`vBN@b8TDn?6e(Mai0F{wdr?}aak<j4$*~a`qnbr1xwZ`frg0BAj<@1yOOA5
zQrcoI@DE98S7VH|C%u-8iHzTAAW4W~MlM(ZpKZB>TpOB&{)w&s1X7icKDmpY$$$mY
zKJ{>}QA#?NWPfv8%2bc!Hg-KH(@{(cYTxd8ymf-J=UATi!rhzt+a^1)knIBxHUVHr
z0+UYBK)!LY8y@<PTs$#ocu*BSZ@pP=F?n*b`!2^~(8H#j{G!D@I^}gSZ#6r)I~Ix7
zzGjtKV8_4Zu1?6WJo{JN1-*23F~d2#Lm}PoO6!T%4wJ^1viX<hS-EYfp&tYU5XK*l
zft&xwV~ks7RHq`<MynNXo;CFBh~|!2&RrGaPwZ+mnCb3%MHaC2Zv$qW)V!pMXf#1$
z7QEH9Tb@|oaoTFbOg|^)pHO+Z6aD=X8Gfc(7aF7XqvZb;UNxz1MC{yMRi~UJ0E;8k
z1QlaHLAfr8-?tfW_vOj^h%3ChCMx;dj(diFu9zgUbDymX06__L2ExbIjNS1ioSn`)
zg><PzZ8gPfA=Pqen}@Pdk896Y1~P^2{XreYl8@0bd;^a1kAN%kk4mpfqUwZ9*F|7~
zH>M_SW+j?G$s}uAh@TOWiYWR4Eg(Oi88bjIhWx!Ytt^#y7a_ZqE=wM*OPj=+Cum>O
zT4-U^owdZ|a7A@guZa~SqxH^rJ7`1xM*AH8XP9W%-@zt4XZN(?zSpgD?R=Bw!|2DZ
zK>G%ZI-nfa02k^fZL$j+f7T{n4rBYxG_ZI*j(F*yI`%2|kQ<qnU>{I6?jLAYH~6kT
z(IoV^TWKa0?Xggq11GjWm34Q5xqKme{9$cmQT)J-`9U%HlBy@ew<imV^kkIv3NkNX
zW<97ybS7t0f&(mR#1%hfq&ei0qSskuuj8}a8jEQA#FHBWq0Y8MKfBi+gKD1t0+SYk
z?695L=uUAijAhul@vgj}%bR0Ex<b~KOWGLz^oU6(#~UVLFOn%Zuq0jl>{%r1;?zNc
z*-UIMw}U_Y;UzQiNlS(5wemM_qYEvkk8r2%O}MjUA=V_0mshM_LX!5iMIN#!9!xNa
zuu4>Ts4p}%=02)#zY+*F@JJN<3#IU91LRX87u<hXjSWaPI!M>!d}lA^@S|f5?T^_c
z(?)q5m&mhuR*_Y4&gbb7yq!8NAq5ZVa5x&Kj~8qgMbo`H&E2$Kv+=RO+59Gr&R(AG
z1R?8v@18xDmt0!{jJQ;>?Ry1Fy&`SJC9A#&`{kx8U?e$Os~!Eb2L3BKtWVv!-)Q0M
zi*;LvMyMp9?h&j^nub20#3hej6L)%NpGHa39nt_ep0LMtgm);I1J4UM6j#!+iI9Ei
z+v}P;U{LJN`DWIeOZ%99N|TMX0yQYCXUT+{+u>D4ZY0o&{h;aW*kQ`LwK$RH?916G
zmz}B<n0a>QLVzSmFn8BREB$Vx{c14y;c7O*@aWE?1&bN3?Wzr)42#}!uBIwC=#xaG
zb-j5<uCm;UquI_Kug*^k)b2ZIXaGlB=OElVC8^9_VPzhPq&pR?3=X6{d9rprmma93
z`pLTeW{3WuUptH_)Kjt36bKnxk`GQSN2zjfS});*&S#L(8vm`|I$jyQV4Gyo0ehV6
z=IAnX{{aEjrhkTm)_-&L1LLk(&yHzI|6ELDXfyk?_51W@wUPTnh4sx<ie7CG4*8zv
z?BP(Gk8fA6`ox;Ou_Vqr>>s))j5-!0?X4o2!t@M8|E!>T#ASh&+ovc0s~UxpqR`kQ
z0Il;JfUbCo2Y~f!9EbeE3E3CF*kXUh3C-ESnm{C*|Gnw6nVt2F7j?QV8Y&;ZzEZR2
zLzloFu1BahA9Yn#VsKD)xE29DgC5VstOl1=xvOlpLJtXyu!^3lxVS3LW;En5J69`H
zezUPR>&98h-T_<4W5Ms>bA<GhbCC7VifYo_^anlniy`R!6&n8VB>=Aa)$&hB{yS^_
zKk~&N-wBk_s==9e?p_88k|akF0=5ekZYCEuGs5$#18$TaE$0y9770O@w{|x{mi528
z4Sym6|G&bCZSYKDX9+lNnx;_}uPMrxuZy)-TUa@s>g3-)$K@BCm)M&FLY=7?7L#Ys
za95dAEgp$sjczY?UZghF(e={Z0DflSSkW|?d<yxCK^ximCo}mkO%7AI9=;D1qQ-)S
zGM+kLH!LSEKr~C}dw1X?trG9qbIzg3wPF;V<^;Q0{OoFY4i_Qup*Cy!PF>N&v;p|e
zZOq4;()KHHAz4n?#J{_bJO4sPn#XnzD(dA|bhguXuTQd|l~&@$tt1Bv$*yTCZF~eI
zbY%{CsplRr-DRi52jX~W2UzTVkL>apq<A$Y{`N#-rkcqQV*0bS_i^=4%<?M)O|)IK
zm8=wf5EVZW!sWG;bNk^2&^-K5(?bsMBeDA)_}e?#w--N4mN_Bx1DF16jp2>|>1Qmf
zn}`;KB4CbElo}t72@}8CQGmNOH)M&nBlz?Rm5rs>MCd0yUpvw@bC=$q-y3>{AlXr)
zE{uz~gAFp%ufu)nT;AjM$TQe3)`~3juA9SDg)FC*03%=c!-1rX{KJ7v`b(Ant7T-d
zQI(Kaw0LEw$gnQv19$2)?W5SFVP{~571!dpx#vMs2TjzKIi-*!jihc1lN`MdRB}H!
z7P`Nf8Fv5fH#hes>(a<ol%G0jAgu(V*XLi~Q(|+8mGjn~C8N584~%+@r?A@mzVGyz
z|IViQD}4J44|yY-TvGV{JlL!;;`!-oc^TSq((7DNJt!su8lSw0$&Dj(5G;p&OCUqQ
zFhPSftDAY%CP27B`s6<84W*(V_=@c(^LzH+iJ9BPVn)zP;}~bqb1OFrXGf-z;NB5^
z(<{1#h@gw;n)E1C<DqF*UvQYpxc?rG`w8w2&(_BA_Y49usGStvo+6qIzkTbos`+&O
z2XxiQ`yup_o&HaZXZ4B<#tTGabLrksNxUdao7WpDz0g!$3l?c=T;SK;DnBWrF~85R
zl$J-c-7IWH#r?U}mA7StvwC$rI_60kkRQxSzF*@qfG_=T;xa}=i^28B9K)+epD<=W
znAdy!K|RciL*A|Ih`!~Uw<e;Y7Svp~>1%n6gnwYJU%b{>GSk3rNa+t%{wE5Qtc>O`
zrydPpaY|7&ze(#@Mg<4beT>bL{t4}~>3~BKlCvj)L!RfNVabyB^YG65v6pDzcMnGk
zX1>)?rmYNBKc{8$2eLwcLDr%>|H8UZ#mi#5gPRXs6vj$|FF6`l=UCL##2=ootIO_Z
z74<(xCsx7q(nP;Z5c3(d0>%-sY%!lfnEj#C7BAE^jyKp(yoTAr$Kf@WPp=G4Y~^1L
zxvB{A6XFvQ`oZ7XMV{|L8Mlw?5K4qP$qR3p`Uvqt7MLu;^Rmp;_ho6!(<iB_cf7c2
zY1)PQ2cJ;f%+DH|+StI^YVedkf*q84cuyx-<X&-$#a>{NF@@>im<yG71o%#8jj+c=
zgKJm^+$QSzPL_y{RFR>rROq`n&!)7pl@Al{(b_EUrsVL6u|7y9g0T)RA(pbn^&wQg
z86{n>mupl_og@{P_0+(t(&{d}by04&G|+TJv`^P~=w$)AF6K3hA8YCe=*-C;F<p)$
zu2aDhCKktr#Uvyg`e|<$)J9uO$@@w?oc2kjI>OuCq~ZN&VZ+bMZ8QCahOdHJZ9%H3
z?f_UMC51o(8oYO}wzj4+{DViK_4zpG>{lYipZIYiqJc}IRXUZm30}vj59LQ3jLbjC
ztBXDjs?ugL`e-_|zAkf#&BRV5zT??q@WGI*$J|aKC)tD^mQPy`c!_7R9qv)1u+<xB
z^`Vz3yu}@?``f4Dxe>VuSZyUSw)R4OmWxu3whcG3qTnsCg711vjQ&h?s&kS_uByfn
zrb?&T6IYarAEB0gg%CqUXLWt)Pp?L|m+6|M@;jZ`|4<~Z{{Ef)%h!Fzu5|keJ<}W%
zN{TGjyo#i-vPorra`WNcWaE?jLE<br-R48`+I~Y4m<H=i*lj19JvDjbKpfNGYIzmk
ziI9g&43dIMC+sd-T`zq1slf7HP-|ayZ;JvOjdl4+y}fZm<zS7M4rcgvYy4)UIx``q
zBln<VDDv>aMq+?F-E$YcBG%8K#^hrUHG1!!t5tpzGYUkyxwHv&xY>3zW1~8aH6gTL
zwJ<))CHmC`z1s=2+DDu&C_T&a(hgpy5kg55TF8(Z9B+OxNpa-SdJxn&{zF{NXnX*Z
zHjQi}!nTLw;46@V|GHf8`l4tnkmZ$(nmS6T!SS_$55vumaaPy3^Vjfd26%n2DTs4F
zn{_3>DX>!^SQV({4c=V{^7|aA|05}gpHm_E8A2_089tAEU0wpz{;ItEy^8m1iUpW{
z{AE?i*N40NS-wB0y!HF$mM<S=Cm$WF%%xf2OppGw6ka*x6YEy?!Nof~f&EZpg7Lj#
zfo7eZ1i12prFz|Hv>OBa$(R0#*uK??d-{l-`>~XcL!}YkiEl_N2@SWnmnoY>H&O{^
z*w3K&9Lfp;?CzyAZr2q`ipO~nHXNgFa>Y)J26VON=bJU}!aH>+={4k6GlIg?QqQ{=
zzJF2LRG6iIQ2Iz)fmgA)1#d8Dzr{M68GuiTnw}xKU^o*|-+E6D7*CPdh7be6OXzy%
z+VI;UZ~N9*Pf#3C-$K=g9NfG2W&qV_Ekn#SgB&szOs}Smn{_xdYP*wF{m2+6d$9Y+
zYP}-OqVADkU3ue~smNLMK{(JS9zi}nHF3#-f6(1>aPh;-?0dCq)Ozo>Mz{jISPIx%
zfYrR`1_Sq;kU=XoGU0|=rz;~@4&yVe2qP|VZE(mZQFmJ1!Lq`X<+N+LE;bpy;nu<d
zZ(==<;0MvVC3BKd(2CVaxZ`YQZgevX-V%)?c5KHTo`Aj~AQqKa$wK9P#NSLiMO1Z^
zEV=Y}yh9>c>A)(8F$b<X!g-u0W}pRp<EF9OT>`3OV_U8oaKV#V16At^?mTLKMVykm
zliPdH?@%oj-;sHe{7x=eoWM0383q)x8%Nqg+dUb8%`6T_Lwg;Pw@+yHpW-!BlL+&9
ztRx0jy?s;vDGKH5`Ff}Yahw40#5s0us-#EBExF3x&kwvd@GurFU&N;QPBTg7>Dvc1
z%na!s(`n^u`-uvZ{)(MxyrQGcLWJ%vD*Y*Ou}?voY?by4W<HPG_vu*C_=|bvT$^V(
zJ5JNx4fO7!U01_%Imx2rmo>n;smn%{8xDeX6_pA4@60P~j!g}nDt^XlskF5neD|Pt
z4z-#yz&~7wZYULeKMH0AbH<{%S}}A6rZ%Ssyb81)7+!kl{PrDIJMQtKRSq@Ek`O?Y
zTx>o;NXNHBN7OX1(~+em{`VKbvIe(awLg4c7NfBT%fYC<|F+oU?VAQys9xF5FAw0-
z?FqupI7UNtJ7e1SNgdTXQ;s|%k6t|Xsf%$;7Nj>wI}&lhZx8kUkJNncg1mt}48XJn
zhVkB+K2&S0zzd(xAl}wTZsYx#`zorMIxM9+aQ#o0r&Z)`r1u+9oo&8MFu)AlK)NxE
zLuZfAca_LuX+0_IUoDI)q<D+&B#%xRoR^(EU=doGqWq>QWOi?P_X`Le+IfK9pQ$^E
zWQ=EvsRB|9{`dMvmM?p%X<SRE>>AhfdqmA_BIHVSaG5>FtCEqH%!hc+%Z;x|a3N%4
z5}B8#8Auj^9%<=g_4|jf1U0iieiwVYFu~lLo!yec`rsZt5cM2SVh$RH4Cm#*`L!BH
zK&eU0V=58}WYw4A?ipOsoY)sosI>UO{=Q?ChQiXx`e!8=SR5E45Hth|;$@P=3o_$-
zV6bN5dxY$Zs#yEegTl`KMZ|+T{srenl_l$}#Iv%T)~s`jfi#FKnD!Ex64=4+TN-FL
zoR7O!<A!Pv^7iE(8}qA97g#}zh$Trm1+YgPDAt@2K1;LMsEhM%R~I5Y!7#-6ZCWKQ
zsndpTPxZ6sNW+dzcU`#oyp&6o#cXXQ>EsEG{M%v(6SzwAPI2YH4G6a<nY#7f<iZ)k
zlMWrcfK9ITUfPX_CmO^^-&jg{gn?^>lGy^7@q?Jp^lK`hG*mJ~(TX!MLe00tZQQ(U
z6M8=5!?<}`Kxtw2-T*qahmP<)Y^klQ+p@s&adbHO;QO4TgK&A@fIx<5-`GBn`IQ0Y
za1Y6AThZWj?sKOU;`723&pt-UKHf=0FxkT8#}JHt3PpaHCOgY?+sX)o8~SpAJ=}U+
zM#)0?7cKa?UP!~Gm7iXqozrlfheSX@2nhnyY|#xMv+Eg|0c}UpYjAHk9IL7rbJ!5q
z85ug%pouSY4qwB3tV@u&KDQZ6<{{{Ar0v`z%Pyk1E+<A^z$xT=<}Hj{Jg*2!em3+>
zY)DL`)u6u@9ndo$cg}I)GYCZP+vKIgBeJnOFf1|-eqmfUb3^q6^i1>$TVMP=asDf<
zY#ErdGml%8l%7)N6C#Nc{@z^<%5{WH43q^1aFt1MOWN2b0$iU!fn+{;fIP(f_;lRU
ze3}_ipB^O;cdO$wq}#xaY6u;~)m_$#VCcrr1P2e#;05k@I44^knt0yl?b+0;9G{o0
zeKfi)@w_=O&dG2m|1$`dNVAl|+_l;|eNau2zB)n5)ZVzmB%;c4Z~X*=ERRKM5NuhJ
z2Cf3Ep_ti6@C^(I#Hvz;!UFGna%&#)y;gHPt}8$)FLw0^=43aB!oiQIhUi03>}04Z
zKk)Z%Nw*E(UK|tk_VRwv%RF|_R6d%?M_RMtuoaEM+v|gKFT}3bM8Rn>z&N*hi8_?^
z&cn_2q0CGUwH~IP+p}}yaSz|9Nb!x=j|)A_c6%lrS1@iD;5$@ZIO$YyAnOSWg^}K(
z(xT|chf7@$dhOw7KnEzvhKrg@q`Jo6ETyFrtuct!IZ@n#a^&yBgwM^#`c?OfqCaXP
z!<&QTip<itfy`e3TdTOP?l6fyT}3c@m1O6>5gj>E#r`(oYRg)t)2Yjn9-?E2TQs82
zyT&YFr|(%BP8TgC6O-4E8GV=sis`Fr)TIcNkVVAMXVAKNmEuY-md;O~04co4DUh!a
z&lU&QEm%+-8(n?Z>**LI%#@16NU-$|5Pe@E2GP`rqj2M}mhIej)fI_eJDfukeHGhA
zZFZ@Xl+NPewCQ<1F&PRV3V)A~j;YG+M1{Kos<^Afz);7~X#DuFm9b1GsQx#_JD2)@
zdr+ZKFJpuW$@*w5_&7U3wFOd9(}E74IyMND&oI!H#h1L7GPqoG*jQE#|63;aS<h>X
zDXo*Q&*@TeP<=FOfzXp+L>*&17Zw~t=CXlnHV%JUF*b+*ZU~y(W-mdjaJbtO=E3Jh
zov7MAKR2n=<%dWh0ee#l34T}@<gf$jG~O@v-XJEKR+PtuEL?ithV8tI-rcCD7=KI0
zU{%+Q7ChT>5{8Iog{eydndd|%l5%dx6WVOciIYt+q6Q72Qe%|DdAInVOVJ($eVWM1
z*qzBX)@{5GZajo`hK54v$cl?DkVB{hpHhVn8{_W_l1d#!hvT+p-KO6is#|K|Pw5Lh
zh^B7@6Hky|fvJ5GZ?NiW4ygs6fAk8b0+)G;GfHEP_ub#ipU~c?e@GZnz(}vJTtl=V
z(E?NWKZ9u0nJ(gCIYL9FYVP-U>fhzS`ZU~~VsL%FCprx3_Ed&#-nP&*zal02rkR8M
z9Kl0C&OX7*+5)!3EQ(R%;&@Q}bd<zw9gJ4-+yM6;p?jca%FQDwD=Ep_`x9?AABHm!
z{D=k@bJ?4ZlU$-d86TeXPq7(v|8PIY!ku%>$imLIhN30zKD__-kzkFpVf_wpJ3?$3
zvQ@2_7wQ00w9H74^;Kn{hc03@CCrSI*YtRya>)}@N*%w=iy1HmD5D;coQdoN*^Vhb
zJZ}xaChUaV)-(q>Z-IvU7t>$1Iu`3av()uT<FMh>R&^3;ky@bWLAef-_roPdnh#61
z^p>(vg*jFx^sCBWGvhp^#rNpW)Nv~c((@0J9~t%KypLMHB~cKCNz?>;)O%hLpiX;C
zZ&c3TDMTVa$0gbSow0al*XDWQ6Mj<shg<i?5V%^vPsZ9kqsa$$^3~jCGdbi9Pq%k8
zACEMYRJ(UVZDK-OD(%3?h^5u7(3P+{6K322h%a1jCvzGz9eo+D;ft5-oD!`WJeJJG
zMRx(<r=vDZy}kTrbex<W4n1z+c@kzHc|)Dj-?$aQiART5HuSzP1?s^URZ>6p@f-4+
zUGfq$eYF3=nc|0c@A_V4FnuHJP2W8Sj`IZ|!apCQxD0#rzDCO4|DL_=lxjc~A79(Y
zHb$XwOv+~50gcAQ+iO>i<v##S5t;ajVZ!nq(A}jkF0KYE^mp%$I5Nl*k>p!sD7kI^
zfFIoq3-_ve84S8gDb=^`j$Y2jtxanXtT4mFpBz1LF?i3)`!W-&wMo`eY_3lM_fN0G
zb*ce~ouK!tN#prCr)cm~d4WNNu$;Y3uwL41b-jE)8>`EsLtBsa>#1+K`*P{?u=DPY
zq3mVYM^Xe@fLRfIK%sIcnC^08P*4eMy!sAh9un2#tdL4~>;8e#755I0^4nLqt|(s(
z*z!lY5URZKW5A3e&lyN0gi$`N952y?dQWB_sj`Em$h~~;$M{<-`Gu5UrF4PBd@^;9
zm_DkoQJ2WSV3i{}3b(-#yB&lG-ipzJM571pcO5$E3P)PmVTmFaonOly-1GFL60xoa
zrPoB*Kf?o?!4SaM{6MTEL*wOS!(w~2vDKru`UMpEVAPgcbv9l#AP}gNUXM{)je;l&
zrvXZtc_cd#6u7~K?dH^dX}#XeAK5aLtzgmZ4b=Kweo|r#np7<KWVmVOhW!xo;y?t~
z8wsBPhNwnSc0qU&A^L^^^Imky^+gcRTiWqvG{Kdq)Pq~<7|l7_NJz!5vbNvX#MxLc
zvEdEfX!IKVWV8>u=$f=W;id8b#u)&?mWu9n$v7mF8XwSP<{89`!tBX0zc$#BHWq!b
z4J-8FCH9(6!WkP)nX5+nv(zVi_ZIGCHM4`m(EA#X<F>t<iN+PW&F~M?fmePT6XSZo
z3oAdneunDO#xtQ}XK*f*vXKcd+L1BPF)>X^(#&nM^dg`wbgN^HD;pS&I13nV(mbc$
zcaUCbzznJdw;%R_>?Q3Vac>rN05glF={&RaAEfr>dJtlr$``d?*R^#&RS(e0-)4AD
zak(yE;}J}yD{^*#^&)bjW@u57b%SjK*E&C`FfW335##~&0E?YqrO@ChVATOGXe?U(
zjbjHA7v3x1`S6m};oqK2o?c#(?|)@d;9o<*N)t}g$dn9^QM#TK7Mg%+0M^b!bf16B
z;(=SJoq9-o>^3fClH0&jH)!~##J&bLoi_t{Jd)iVT4l@(S0{wS#A`Zas?!GtypN`S
zs2rj>Uf;DsQkWO&eVw3ssA+!rmWdn^JbpH5r-UK4%CkBleopSrzJ$hvJ1Y)jSY-G(
zRg9V&W+003ti9Xzbi{9=9Hksg1ED67HMR7K&3t2f-S#Cvl09o2i*#+Gb-)|W$HV2Z
zCt$4^&BetvgBQmPXzZ6Uw$^XB+4ctaCYq&K7|^P~8y}Ktwu-jNF4mL4@TYj+Y#Sw&
zXLJkWad%go$5KlzP_E7}(HuYGg$V}-0<wkmy6@}qhTP72rz?{W#UePk{B8CqSi~@8
z@zP8Aqik`|V1&p;PSW+<m}Y^qgj}OjzA$0AUQvr{=fgc^nCTUAt}vWff^>qPtVXEW
z%<xcQcE~l4I;kQ(2DhiSRd4qZ&mO(Xt6vb^s+v`;8OQAix=@6RY~@fp4)`R86gwDL
zmM%>DZ3`44nKvptOx1ntd;~e3w$p3d=0h&e%{JAOvyI&5ZX=f$Fy}2C)QCfd4Nc+#
znen8Y$X+zfQNp`oaLjexcBOSCxg|isdNobu14-(O5mt9nW3;%P*(pM0+H>+*J^}0l
ziNKM7K9E8Jjp`G`wvU-y&3?_TC&qkzM`>UCDbuK|>{S~r3Px}(<kCmf*B|eE4mcY(
z7XdRG_&z81lsDCz)*HvpQxNlNz?SmUDv_32FGIlD4h&RJZxz;ccffT&J$RPQoT@N1
z-dFi3Gw{8iN5(R|j>v)RX(afO>!*?L&8t3%UjZLPa4+Q2sBt*YAQ_Cky&W$MR_I@Q
z`jJU4p3g(N0M_alCp7yJb+Qz9Yf@N;!6)gR7rg>|RuEiUGQvB>A-*~yM}xNtXk<&o
z^>#w3o0*I;P!7A&vb)=JPy7!b*N;r{4HUbnu+V$3(%Cxhtt-_&tD#4V!cYg%r_IzP
z&X?-@3Cbk4yGyp!4VO2)?RWBRY7H`P4mk?(@I_r_-_n^(w0++k83+GFG)MM$>|{Zf
zFV+F2=w48$e|u{)J0S$qJ8*!|ZJcQFa<z?mrLezek5ZC%Wmvn=i9o9XNM&y8baXBw
zuxS$TEv%3QHcRSzhv$Y(eDki14pt`Zvk<+kcvB^*4pFs~BZ(70;~8429e767%pUj~
zTkdp>SxvELyF1AqBjb<3qUJlqI&i%WAaCPxuo9wO#WFX~-wNvxR-h?fxg*<seWj{W
zMBh3u;*`1eq<&j5$lHwM1ys;C?PPuiE!9K=cIl9~511C{SaMgyK%yd=0P7%nN}(~v
zZp&A-fwoWc<ua<Q=rhQ6Q@Y!gOWC{kP)jnEoPRoot;-l#_%cO9D10=%aG1c?;(dwX
zyr)MEtVAy(B5SlvP_mv<RMz?0<u>15v*vr%k)xk-OVmu<tSSsuCv<K;wKd<@c!@cA
z5hN%&d<CWx6PnodKwT8h$S4J=((PbrRijfN?gfTXi>{|^c#q2Q1Y!h|9{Rg>Zl@=#
zzjtmpytv(HsuiGY7tNA7XpOzXch2N$n8@9@1lXkTrA$UmtGU%>l~d4)nuKJn%FaiG
zICbQW8~f%5(Rw97^nwx5kwY^A)UQkuyt|r(afnDPG1{Xlo=F#-K&SG-txLc?k+u?X
z5z|&J-4>pw9y}19(#{HOeN06=8B;A;G1<C}Pe-k+c*Mz6N^GpPUgMQo&|;9kdS@TE
zBFj2C31~B>Cl8>j(<9(qxa5xa4q$wDgyh`t`faCc)gRZ_9BA(*bckj*JLuZ?<><?!
zh$ip@L-Kv1GmthQ)K`DQf%PTHa35p!ttSB)z6A=3v^=djQe9vP!yBhbo?XlHRBy=4
zh`t;ig7d7n7FN9wYv|cU7HzKLyuNsS=eZw~-D^>*wWEi18AYCe`md#3PzmWYOHzQS
zkR);5Ez_(>$LVNvB{X5&ZaS(yl#pqr(s1_llh-}>@61MwOO=M-=sskb=qW_JzK?d<
zb}D~{7WEoA!xl`kndwc8vh9xMs~~s1z%(eB7<+qOoOoB8c~vNaKShk|NOB|Z)BslU
z6%^Co1c??CBUxdCXxnnca$rqb?e*94xK+-kdsEaq$LIM$v#1q3U)h+mtaY_d5*jwl
zaFQ`(UVqURFBoTYqA%`auRDWnMQwt((d*g7XJSr=x7?e&8UxO8?~yur|7~b@&opQ~
zJ`jUixjD5LdSD!`HVD_paAi)EG8hd{oT*3-3@lC-EiJUTa7);yE$)#1s+A`YU`B_?
zkSDGX1fZ1G)sbE^i7SegM@iL<?mE`bU%knm0P$S60(>=kU_L7qNsW*P?$X6WqTmMD
zp(4ZkllF_7NoRxZ31@S&S%fIu-q;`SD3a%$>Y`dwNO(+C^@n0n(d#Jg&md1&&LO-`
zqWke%DrF)5KsaU4W$K0goUWWlW*x_GVOfV$41nP#TYeiuRil^1$#jT;DT={X+*pjS
zzI$2a!YbG(=EH<hG_UxHGAr+H?uKZkeYs)>6Xsh{A%N}P42A~`!R;}~J#I+)MwX!a
zldqOCf)XmmUQC`Y9<)7MK*t%LdYmRaf?DUo^{gG|*@563V0;d4^)%pGsqPr<tm}jZ
zo^V|`cEW+S*LOVK?Mf80VbA0>_sciU6GUk-sO2rM8A+DzSvpUwajY85*K=R>1`ek9
zvd4|lAg(6mpfqI)4dsSlGpJ9(9hfSMM-c>l(i~?TP)-W*mP4H?Z?9*}(o6JpVH$l0
zk{!DOFVqc8piJ=*byyVOOHs;k8Lx=*b=9Y?*QbUwxhu=F44JYe3>p;dPgaz9A`|kF
z<*W}1ibpO-W8z)AY|#lM+F40PlJan)PMe{P+KKCF8=Hf1b8g4dgiqd@Pt&}+rpKRR
zp9`35E(4KdS%T|blH8a_l`>n~D)Y8WS&g%AtX-`J?bUQU<5i>C1`&%V&yqs4M?SC)
zcK4z8G*bi4lrR1RFy2Qoq;fhkXYX)jPpN#oOt&>`!KL0fXY~Eii^Kdex@nzWsTYjp
zKTfyoHkV;sJ0(MNIe=+DH(+nBP1xi46|7KRLMocCQ{-Gg+#+D<xH7Mgdnjg63yJNL
z!E9g#k~#c*DO?9{6^}9<x6`{YipozOWiNDcagJcWU?%vKa-(M{SO$j84MsmE`meUC
zOQ&~kuf~!N<{ZTfRA$^ybyF^{9=Y5+*e009b(^QUhvW6!DRVVM(LvGMmdYi+J9V?r
zHsosq0Kz+HiD`rC$L#y%HyL}lGeX^t@E<Z3DZj?XF}0=aLQx;$@DU@qkKjF{yHZr(
z&w#P7+ubDUNds*AQ871Fwe9vT8sKcdn$)1s<$N{LgJLOeuK6Y*1n4G}BZS~qwFodV
zHcp<zaNcoy#wCNy<;{Ah(bx)M@ptDwgQU)eHA;CrqMm!w%t-Dda}(^br3P3Qz^(Dk
z<s_iZs||$Z-LGLJ1Y=%u`PYOvCdehoyt*Kze*)iWEW?wSrcMQPwlJ(nW2a*wjAUhN
zWSd!u8(Fv+x09MZIk?5?l6xWPc76oE?}33iR`Idgqp@kw@h2GL2=`qH2NKOH-e)KL
z5fH|m5DO1yrdSPzKK3ldJI|aIJ>Dd2%{7Mstd)uBgLRFgI>3AVdpmOJt2__gQYpvn
zyuC6pU4KO&S@_;9YOk*KiOHM#0u4O68-BQm5^%du^N6q8Tf+Hkl9gLdwffHWw*}ff
z`I80Q6kP?+Yvn|8o9zw+2DX#|1PE8BMZB&b2tjb#WHYrlAH}I%&+gCVP8j_Rx?I!f
zzppr<uktpIUP?A)Bp$9kLqw0O_inH^AQ`#~(Cr)^z89->tM#47FhkQOcRcwcln>Ng
zp!T3<H@f~d@wH7eqyN=eERHa^Y2|2Ze`rDdq(8Z5!zF6~?U_Co(2yWI=iZH*&&b0S
z%|wPF4wEFHH&j$77sn|*8(Sa9nf8cWV(gK7+4D}9kww7ri~>VCC^<k-$(jI!Wr6B8
zU@FNpjtj%?dB~rt1DDRaiWtATWSQaoNYZoPrk<im{o?>O&*$&1u-tMSLhL0SCZKRj
zv(FLYFG&nVa5bDlQK5lb$@?_Uc4+H~N%!W_cSoJhBq-}l1Z(umSm#2kcjBAb+HomB
z98968^sF_(W9t(SlPRor$YRj-nuL0f7qbw{nUrv!E8ZVHTDom;y)$&(?W@dSwk7Cc
zxWz2&T@4^NRV52=t0I(Xl6wzIb==n~hp*%i_6j7p@9BOvy@yOsI<Zp-xbrbcre<X~
zz)DSBlJYMxd*SY0HkaNrB)6lSdNhXp<uIR=r&R6y+<v`Y)+OX6hJ6zxW*nq#8rWo}
zpFA;hztD}jcu+1`A<VD(*_?uRn)}0^w96}o%Yhl6AgqWU2c8j<+av$Y7GRQ>Vmq*T
zJ1((AFmlx~bZWz#3qBun(V133Y3er5Q^AalfM!<zOCK@6p{acJfhi62vj*-0ZW8xD
zmfa7*uHAW?8uCV%>Ub1!a<)oPT(i3u%}~Wc7$Q3PKj}_O-YIH_(o`1v&?yh6FlVIY
zlam5PHpF6B1$cB`AY+RCEu13BG^(@E6>X%<Y)f@%ku*f`b=n+-5@=H<F7CQ~&`})I
z3?vNV>Pe9Z@;??hF=17ou@P9RsrRm-HV3|Et<j|8#zT>N7^-La%F2QaSZHgLRR@wy
z9SnED*)MY<>M;5)6~nASt&){?RqB`b-Fy6zFNJ|s=Y`Fa{sR)M>V7+S)r<oHu8#+*
zeAmX~H8(L<?SVU<n$=kz;l8wYob)C3_&FsUio1T}DwXZWSRP=WscskKbx|kp5khXj
zY&6Nr3+X4v2J>K5K0YXr^tN)%#8wr4GoIu4)kB|HJ{5IC!qt^V;AVNG3qW*TxY6qF
z_~iSV>kjv9#HvaKmLt;otvJ>uRU)IG-Q-$zzRGZm#6qx}*%8Gm+zC`%Uh$eS)HRen
zYqvy69$gz8)Z*%L3@(_{*0o{ZZ*8I61DY8!KIuB)O~`CdtADP}Q#ay%Y^2NzZkebe
z-Vr+>dRP@0=|kmc=Zh02u+4gMA*M`8?s$QmalacRmI5u$LL*xlU)l$bzUTHlzLK<6
zA<Ihp^d!Z;+0};;5#k7M#7hWWBOS(g95Uk>4_D4_KVRmb(wU6B_@=v7-?w_2?|ILW
znZ(mO?5F`rZvU_j2pD}48P3Xk7zd5==>r1;r-L3`8o&RfaNz!Uq6kEUzs9X?Ys!(b
z^`yUujt0Ndjl>tKOH1N1{qDM^wF#r6uQ~NyQbTn)g?eRW4}tb38?(@-mblrzyKx;@
zWlEpttN^cDd24e4&dpPHBP>+v3ak|ZGX!^$kMCqRdSalFwyLoD4YcD<Hr+!RfrV9`
z^Vv0e&+?tbmX#MlrK_*IF(w2-oN*hHjz7J>c2JyZ99pa>E1d>}x1xE1HwxWB8{?$4
zoq}dAe=ThHitY@U+JCW|sCybpMaWosDx=T2h3~nP)a>Z2Z1@(X#?5=zYQa4qq7IkY
z-h6~`rvPr=Sl?i1r9FsR_dg#$%i8Bz+-NMSa=Z5qb6dj!U>${se|v1X9KsIqjF<Uk
z<5BGDYh)KEr#^ito}pd+xXSX1Tm{$c#hdyRH&vx}Uc)6`DAA};M8iFCLk0v5Y;F`V
zZ=smXXiw6@eP}ARUlg6?QTbGMynLt#-p({3mehAye2B(I;VuZ&0is$^1i~sVk`x3M
zGMj$EqDodbMm!?F=sf~nt~h>dcvLR6tomd__9?CNiM@LTkJffmV4<%D4Ddb~3F#;x
zPgpvA<5OU?ghVCP@I3`nu?h~`X}_eo*sDegRQ*Z^l}hHU1iGn-r|cGxEC`|9e%b@8
zAC3dHw6XMg56-qEHyRYvsrR{5hU%C;GXF58Yf7;YQ06_e*`9a+F7g=^8cfJ<%h?<E
zY5_F^tvVk1bd@eEd3wTAFZFe`=;1kcc2HdlXsiw~>_AQMRBT_R>%@xh?MTtUOuV8`
z511kFXIc#MC&)aIGhlp5+*7Qx#eG#q=_zjYH3Wmm1GXp7Vh7??f)b<8;ojCCv{kc>
zj2+ec6z{O6Kbr$fk1>xQR2n@Vk2qzju)=dCtvxXJIyf3a-yPT8o`Q{+Br|pyOSysF
z!-yyEw+mq0(S2PlcB+Wg6QUT;aU=$PgDi{~QfJ1E#a{-7c*?zkGhkH<Z}jk=JFClo
zOj(vocrr5@suea&vn@pKMNmL0eUO#-;VNUoX}%f->{wqI5pup-p>B<osH(~ZS$f=1
ztyD(rKvI$9vB;=VFq7v86yNar3NP_gf>4gM$LM$%-_zw%F34>fx&kGWe)El6%L)iH
z^7HW%k?m+^@<5IPuCFoD8b1&Q*A*!5a^qKAy$~x$(f$}LY+*4G5}bdRr5`RvP{p%t
z1QS$?N&09)peuHo#eXW07)7%3!zzpW(i%h+C9@kg(sCR+-k_t<ML&9mf=ep@)81BO
z#cFUPUEuC^SN-8C{Q`nj(e(TAb2-)=uCXR(Dyl|bv3VDRkH&RTU4g|m?!?1YT_0S!
zN>Tv^$WBLYD^z(MADK$Zo9<*u%vO|9qZVVVJU%c*GZ83Kj74STn9V09G#|h##^!EV
z0mf__kX3|DFUs014ZyB0N;sT2(YQcbc=ni$>zedFM(((`a}AOQ{5^FE`-vAP;c5g6
zrwv|Kym9EeQHk~21uoSI<iWSy-1vOySI<kzXT#7%zro0Zx%>F>$QYnhAacWN$&ZsY
z>48JH_d}b;0ly37ZvF0Mg^d>HxkH^aQG(9~g0=Qm5;xnxuX_Q_rDj}0*qDcos<~p{
zcpO*}82L1DtG3QSDdBBRlrFbk(p$>Q5;np7Ga#nx^y9fXP<q4x0u^>_IS6pn#|68u
z_W9xYEDVvhDj&~2t5IOHb$U`-(P7b6aPf#)`9XK31t!lTxF#MN-7G;8+PMR;5s_F5
zF(j1wy5#VsaoAFO<cD@l2Hh#pWT(BuOxfDAJyx{@DX(cSJw0nZBsak7pR0-Uj4B)7
zG{rTAZ)+EvHQ*CHoyW<V%6ALZAAN)!LjwYBLZhJ+WFEK)Zhvlj_SHcHaaFyG{6hle
zHz$C`d)xSO1DK>LuXM}PBMIz>wUSw4c3TWw!C|@7a6`#hbuRw^HAs+`(`7-{wcfXV
z)JgpNXZ@UIL<Je*I~b|e9M^W0XA48*_0?sLS!nEb=c5`2@gXbw<{{7cjyxb9y*v?Z
zD^xnH(4mvWGr4~&Lq{;XcE_Axg%g>@)I>=%8kWE{@R0abfhw3%x_x89MR$y=KDFMx
znByO*wR@|Ll-PUvj2Xy%>Xf+Y7I)}|f5ot`vYKkCMschB^W+xKRA0rUcS1`v9W;07
zpLbjVJ@vSH>yavN2yVb8-G-oxaYuH@2CO+Oq**Cm?d{)4e$8v;`G7xT3rOv^vtSX=
z9C%>C*l~j<jnaLQg3CZg<Vxc@vGqy97Rrwhi|g(fLsLkQ8Q@YQjzf~r(~&wgX!P+o
z%T`uueotY__Xm$Y4mYU<MzeWp0t*=IsW6Elm5|6O_PFl*7g>{RwHml?>(olT1<^J*
zXU#ZA%c1V}KdS>rLDr7?r;}ULbGMH#m7ydEodu-d#^BUJ_eesSx?whGN~$1t3EpA5
z(}l-ds-2OtRBzRaPiPcG_)jkjeg+Ao<L1eYKxk|5LCKOW9`d>ulZL{1&g6z8IACLE
z9Hti(*0jV%JL4n<<dU5gA684XT&0p<xn<xb9vUN5Aa!rIqaT<yzB>#1|Li>R(J%AF
z^P8B@PyhoN|MbT||JzW;AO5bq^~VQ+p#g5CBx_tkBwn^1P){Ft-AMXaRlCer=R;2{
z(Un&3HB@y9xY(Df)jwxSbsDr@5A5CLg<IlsJ9-lttqDE@EUP!Flq=(P#^)d+)*k0u
z`zN#VLpc?x4i@pntY-it1saDiHJypnBs0SxxSVUkd^=}$S5mQ^z3w~X{UeXt_tZf|
zeRcZTuPWVTFt``<Q5=e$z9EN<u?4rjb_h&lf{l7F9&SGvI7n;Y9VXxY_Q1$17T{&}
z`F5RD0m{w^MePWNA!N0h#e<3W3L2vjl{t%O+8XWsQ9Vk6d$aZgT15a6c=Es@y$eV-
zVZQp;4z=?y9_>R^VK`mG9|4@~IWE{GIoqX(;38ZDJpa*AAqW0|gB22X3^}%f5;}^Y
zuwW1>4;U>t{hEkbzpe>urX1v}89_Og#~_y*+)S143%X|W30UaQdOhWBYYI4DzFx}N
z*l*dKX4%|itRTN+-uS>qw}1OiE^ci4NzD!&dh2Kq&^*76{`udZ-a~Qs)ftd4Vu8-~
znF?TsZTujz?G8b8x}~0hOe>BgywO#lt!(~8)}COQf_Q%h$@ZZ!C;)~$x49r|nna+%
z70?S2%{$rX1^3UO9@<s1F6uPks!HPm$v5n&fQdHO&?JvUf*F_!y`cR9iL-$L6$J}(
zt=H10&`&Kp{StwE$@7oK1la29339|V>1H#~kbWIX06zBPgLb??DN&H%*m*67x*k|J
z>-)(5tnQ^3<L?!Q0vMmQvbdb*9adH=^P|T$Ws;e@fm)u!a$pjxEzmn%@3{!`A6SLH
zrCqY0-GqEp8zXam25kTrpZ5d^21}y1cvHxn#NQtPwQ9dVXp-FhlG)E783`b~6xskK
zD>}$x-R(Bc;A&#r)mQ>B@ia@;b+rj2c~yh%_t%_LLxt|#2t4z4t!`2!Npm}MT$VVt
zwRd~We`kQyH}K2pAQ%*S_Xd$)Zg6Q3jrk1@)cxnNX#n#|oPqo0%Kv%@pKpga`$}RE
z_)7X$Wq4xlRt|7IbV#Bq^2G!&9F}dGl&DLR-&|h#4ASx>>p_ugC$3wOgcHN2*N-hg
z2%=S=L9;%{w%ddgK=uCj6MZGEX0>P|VxH`pfoz8&`lr_w00M+>0<oV$fU@Xa$^ypJ
ze@oeG-zfW?k^^5!`}c>p|I5QGm)jR^qSja*e<9$|H*$TWAF%ZMXLeaf|G{xqzjNGA
zJedaYWWr@Ox1c3b<YlW}8V$(*%EtNMx#T-ji2gwomhoNA!jKMQAR##_obwxg?JJxN
z%RENz5>Q2h%B^=HCU?>gAWXR()n3Bc)_MW<6TQ&T{Q)`W^2;^z0o!}qfi*pUTs+@P
zJfFc%4uZ|jZH)IAj`9v<qhN08z=|BqroatomU|Pt{yrvuhKVQx*B&nOIl<I=UAwx}
zCFgRrRlOMN<{ov*l~UdV`{HJ@oLq|^R@0BY%LQZ&x}xf>3;e$QuLs>F^M4Rv!~Z0}
ziveFKBAWgU7Jeb?d*nBm_-~l}E1hY-+*APS8&A7_;c4*Sp;y^1dc6cnC>&=tcMbsX
zMY96H7xx#jq4_~<f_@Ympq=iE9KHT3N45@BxZD;r&;9CcPk^Kpd5dQ6leg;ai~7VU
z3}i42&-~(CGd>`{3M|uifz4}VB+38+y8kPW{sA)I*yqnoiu!{|zrf;uV$#sBuMdQs
z=ze;AgKw|@4F()if4G6)0UZ1*!oTbbU6E`;-du@U1p_(8J9B_i0ERC8pe26g(6Pcl
zW5=)P;(e~c;14DbDEdaauW%$u0tD<=d_sQ3C$T@{Q!jwHU-3!n8$SJ6PJX?PucyZY
zr}|4M{UWvh2~EBcD*azbKIG4cow<J;di^u#=yy%|T?D>r%J;v>$Pys=KYq=BhkgI<
zZNF&1Z*ThtyXODrxBV)x|LxoUw|DyuyPLkD>UVwp?QMS`;Xl6Zt`+jTuKEvF$S&gl
zPppvNt&(r5YyDpf?2lUIr`H0s$}g72x8nnv{>v5qbo?(o@$L9_zoP9o&ic-3{{yt;
z`8&k=$twGH{!@S*_ZM1q*V6l{Rm1;hTJ>jc{X6>qEJ|@eKjzQC=#c&c4*sqQe#F5q
zy5cJimVU#*zc7}6!o^){xsd#mwftS*WPCN3zv`PG&9vVE`<r?J%(Oq_;5R$%?{V<E
zowkdEh@b3*Kb?M83qZf>!GEs>esC4Kg#JOG{&&p!Zyfc9XYfxd@PE<p)%fq26us+I
ze7DDclF~0G`!^~5vjX_vgjB$=_!&X|KiCz2f~jwo{{Iq80kHI=qw`;Y^e)8w<SPEz
zq4?%20#NY9A^mIY`&U}^KVRxUWB>0)@?Urqa=%K@-x%8ey{G)`y}tWb->&1ENd0kx
z|4F3&ME!5Nv*1r20bpnT;L`t3mFX`&+P~JO-^|~?lKuaTrhnn}{$N#p6aHN){qFsI
zWBq@k(%&8aJChoJ_4t3F(qC%QUEKRolNOPVd<(q%?73t~+#y<!2ga)gUW>!eAM}iy
z^OtZ>DF!1hCIzk!7+v2BJ*g$9DAn!leyo@IArH?1XXo=bHMkGy9*J2qbe*AUwZGbC
zsIt^*YfgQHFQ~M@vLf!m*+(}YN_AaTUIG##TeBNZDV79xyjeH&Nz=QfX}5YI&a^D2
ztqdh+>0}ux%JmEZpssWC5T%`j^(7YJXFgnwzHSqqqSp?Ll~8xdn?4y_s@s%jHgPan
z*bg+Gep!X{trJ!JOPFwv>B}!6!Q=lI9(ZfBGgEvX1KMfxtC)e2r9ba(`F)1zZVT;x
zVAId;GMBGIO~1}E-Cywg?wv2QOb<wWC|!1UX>Lq9ANv2;d(UvVy1spQ5<&FdYm`W$
z_iln{5d;a*BZw9R!C;gSy+#d!L>D!B?_Cf*N-#5eorz#DChwM9*LC0b^ZeiUIR5Xa
z=fm@1j$>PUkD0Y+?X}lF&)<2T-x)PnVrg{oj3VSgI5*q4E)vDg0Szb*s(#O^LUqYD
zR)91Uwi?g8fcDaP7GD*+Y#+}+Zx#Qk8~2@IzW+2}c9M-a2vvrKbrY$IK!)~7L=D<0
z`x&>+?u|qZhI<*fjju_tKff~)>uP=i3n1BIB}1;K!Q`)AaVglM9XDR+1Bc#v#1S0r
z{(5lV`_m>Tf-Ia8+`%?q4-isTtU7NL1oO<9XUWu8X85P-GTpv|MA+>##=b9Vzszad
ztzbo;BFkqHYF%Ioj9gkvMyArTUlJm;zAZ4q>AC*5yibJ+X)FXZ#YhLh_VO&Q>wr`T
zrE_0KGD>gUa;ogh+b;^^1j03+P@*4=>P{mit?{l@c0{sv#A#K8KrN*KMWOL#n>6Pj
z(yQ+sVq9Eei<$8#C(%mQHPAMkKCWDnm9lNSg68658&xN&1V-Av!oQ^b(UrVm(piec
zsmO$azvh!K&D*;QpVZ~3?(;G1(#_8J*d+Jm7kx>Yse9Wpsd<C&Z9hHVmmcKRKn;at
zl<jU@At0<YMiuTEmUngSz;VZGzRu`|)+3LCy**)y=LN8-Aw(NhgV=JU56>O}%H`Mv
zS<&tFHCqWK8J#})0A&rJwe^+--%6a?)9w%5%dt`ZO#b=K`IFl`Y*rBW?lYY?7;pjF
zLNU;It4XWHpbkYEL4Ah;&lf3kB(EhO&&G@$2LE{CFZWM8W*$0i#ZfSV6>l2D;-lo(
zMtLJC`c%JSggUF8_jSBXbnMZO<=xM}K-@sF{Y4nCioIX4vv>BhI_!n=&p2#CEO9lO
zcN+Twwfx#&ybV<t=rr1#G+SfDH7PD;m1@$g|2fKI&@yxky6S3i6QhTohPM--y8&-~
zMgF*ma;W4daaiL-ft`UmrjcCHi=6U$p6M#=9WH)!kj|v10y#?ZjlZ-xB<^mFBr82C
z<bzDstjf9gMP-lsi)RFsx92^B6Wsha%VT$7_#sxQ-B#U|DmlhzFI}1Vpm}a0xfrG!
zOFpanJA*5v$zA!>`<`O+VhVH)Z5*>Ld`$=8M^2IksSlG2LV!x`CzkBEZ`3tJMB=@K
zL8}Pn=dFyDHDp9+udZ=36STW_uvX-;XHy!xB7kdOtxjgP4#A1Lzf_trRRc{szqctP
z5XTm@U(-zQ^t>JAnJwP)Hm78SQ<QSF!}|T%?9AiC)Lsh!xg~Goax^%hT@tOE6w8!2
zUc&ZG*NjQSvc7|cH8%>77VcJdD~LMBiRG>=?&&tBZGTdfK`jloq<C)0SR;U@;w{_R
z{U*-q*J4g+0yzUlfWq#m<kDJh=b!R~ZCV#OH6&E(waAdAR7;Z56Rf~wK|_MrWA8lM
zXGY(MKaZ99cy%m?h(cMAj%Yn6Esy8EX##R<Z#uvb&_Yd1rtmB{#BG_TjSQoNPApXv
zuaDlV8R67vscWyQbrKzg*w)__nK<2Qp<DbmFGMQ){5@ZO!~H!rH9f;Dpst=5?xYW!
z$%m2AIO;mcl;_)fJDi}5FS3LL9*<uSR9|*|a#a%ZZ7+QtiwEUNUD*g;Lzd3xY>#kH
zrLwwpJ;j0O*4ul_Sd|A5M)5j7p4**<Td+aR;A8}7MlNLOuzkr+{c-x^)^3t6yq5SI
ziP)>6aX!cMD_AZx&I3Rl$eT^L?XKa#ZMPN*r;2!*MN7sUv7e`lS5c(tL~7V&ah(Sl
zTW?j~iC}Tpg(UYbO3rdX1Wx)MQD&&6JRY!_ckR0_J#cC~+uO#4{`d)<(ZiURCGdp5
zVxwvTfjql2Z(K^>t*(Kmp~3l*o!IZLMTs0Y%p%%=aXJYrjLI)B$^TXo8oHoOJMmpO
zI;UpT`en1m_cu6PKCY%+7!K6N8}YJdCophiSxu&>d6VPduHdf!EVHDDD_4BgAj6eF
zw%hn0HeMU|-9L+mdkaPbX+jPGul=tl8Z|Z{m!kx0cjP6!Kd%iv&QhOI(~S<j@+9_X
zLD8lh%7N~OkzAeaF^+A_K@Z6`2v|-Po@)YkUApvYRnPM8{Z|4J*H9gOhI{xQ98nlC
zq(#`#p7%kmJw~&z=PW@fUMN9dU{*c!v8S~YgS_<3R?coflwc+p_X?1H1CmBQnWLGI
zYnAqu^YebOx4x|8C92B}O3L2gWWn=)=TzbcuWnq+qWX%_Ma^vVwE>Y}p2ay58J|qI
z(p6fcmmbhAKUc9yc!YD35f#(15>HmNfCIHfWfh-GL#%pe4LKHivTnB5k1NbSqM%L~
z7?|AK$_#g1a2@zrakm96i1<#Yk75Aozi<8I=j_#&9~r4Rwy^hgj4*tWu%OPRl^-g_
zj=;&neRYz3wM7)%WdeS4JS%FVSa^N4uH}I@%IqHY*{BT3!XV-+JnU9TntK=9_0>xi
zc-aEF*<@-?cVe69{H+`v-*Di$M0uaVsuQA4cJ|8>1(LM_p1~Hy*u%;*Rby8(;-&8^
z#dnjOXMr<<%l>&+N<2B|!$uJ3+gg=E1~M!JEBMXPpq^C}m0VC#V3b?&)~S%lUce~T
zp=Hz>>LdpP4IaeaalwZQrFJ!`Mc33%rEH?B^;+8v$&-HIE^5##N!DF7i@q;+k0#9W
z^<d*4OTri;z!d1P4)9fsEq}Gc+3<EG_I^XmzD>BumDUF0b2ps_>H8R}PdgUmfWCjP
zoz9-K^DH&wXILzYgofNsMnk!2uypcc-5jNtS2u|L8}@houb3L49bx@pqfO;dT)*SK
z#N8ghQs?LMbR!BDOFJoNhAxPJP%l<)RAC6z_v5ye`ZQFUH_VD4&AIF*eaiQaR~?*E
z&Yp?!qLGE-^+k>58-qgV++H>+aUH6iruS_EDs@u=FKY6>QmABBEo6TB;Z~qQ<hLe;
zXj5O<GM?=ji<A-EJ<m0Fe5sKK8GF(eta`W+&8s@8-o1w_W8GKCQt!TJ28VJ1Q0W_w
zm}fgMoyfhKOhL0I$GK9MUH_T*#bIofI*YXu&Qlw8PR=rqCScCliDSfwvErfXYH#Ki
z?Hh#_Q)^s{aAyux&yN)!Dj%gLeqW)Vn9hv&aI32RjRN@yjOF>HNmTFIQa%S~{+}rz
z>LXK~6BA)QZw;c3%=m{q6Fjs8xzV*uT?3|C8ua>vz6m$lwP|!Z;4edex6SP5uN@^j
zmv#ImcLU}U&FEQeFBlEAwJ)*vR3Bbl*aDvWQr04!4APZ35%#B*AFNOMX@;Td7ujVB
z?3jBKP}hsn7fv6Za88xJk)3@QJ7Xz#f27qD(}6cscNZu6Q9;FlNV@0OpWrvfYT;r!
zVT?4{k^Ac{GsfSaHz&ZN2DmdeZuKN$D?G=#T3I8F2b)vgB6Yg6L(ke{vf-ZjPVh1v
z6<YHfQ+j<&44CkgJzbW9cc2GpLjsG@xbg!xn#TG7CU1ugPl1j5{RugsylL?zYHp?v
zUOY9ZqF;4<C1oLV_fhQK(G}rN)(rfP_6TF#{>XM132IS-7C5+}u`$$4Zg7<V{T+wk
zH6^aBCMzj*V7~W`hfbgj^D=3R{7MXwZpMRFWL~jH!S)RU4Xb7Yfe9IAJkr$^)7WpE
zSDTm-?liRCVci+ojGNh1KYdy7#(MQ3Ci<a}BQ~`9BdPi{@)ms+c4?-8JHwM)RtvVO
z6Sd1ROOmL}(OS5crutW?Xc5cJq2UMFyZLz$G^^<bghmkp5?J{_n(a0k<ZK_2lP8IC
zUz<>M`()Yl>~4zj%euq4P@25AtMM_do<+<jz3xq^T>*@CZ9+40X2^;j<Ysrzg9M8?
z3uC5c&rG~=F<)y{Rn7xaWv@+Pf%|JuR@-im!4C-SS+AmXa?uIM?~n|AN7)#2rFJLU
z@P&azJh_qbk_IbTUp$UdJJ0!zuJ#xo!Pie`D~>A2ASF6YY0st#&L7O27}#ivXap)X
zRj!<j)ycBaLT}7KZC3UO`wdXMY_t%cO$*~4-WQR$18&_Cu)0&oon|jvLJ=Kli|bH6
z)I9}RiwHIfj52L=$^5){a*{z^-^~0x&x>YUfwj!@#5nDjLhih{nPc%#I(vj5d13c$
zL8wbP;0+n}DEQ%=SIlRlWV;?|{m-%5>(YDCUYqSON61eo15z+-Pw*grTKvNJK&zpx
zPFLcClhbqd@ZgsdNj9KWw$#P+Gn}q$(7v2FTX&70hjRc7*H7_V)U#}d^Oqp2lfvP-
zxZ~=*$Na#+7Y~LVr@^demq=WcrV6IT_VnnlzT-(yW+x$%#nZlP+2Gvooa~$zP?2_r
z4}oPegDfbcGYg*BrDWaC=t@tb;zpwg!_MWqNXCb$Kdj=fikzL3(<P%qOOAEI+itqV
zFdjs-h!<V}UgFL*lUzQ}OlX*%3^K}`W>hzT*DM~O^}7S;%4)xPkTF5p#vV@YO{ko+
zq+}jjiVAhLB*-NQEzCL~vW|w(!?3YFLF${;A5;*&w=nXhHA7aZ56C=lTjsu~!ym>3
zzGO&MXe`z<WD^Lhx1$6C9PKCOEm*Yi>)!NxJ`rwE3Z_gkCq*4vzjQY~dJWSdor9=#
z%NT~#tlQR3@LSf#ykASZaW}BOu}{lohIk5XcrUEaf*MMJAd9{YztGp1;x8A+o!H|q
zpqN`&n76fdQ>!@;z+;Fda}75B0ci&uE6cIC7Ujh+1;opA?#CYM2<<m$xVBn@dzjjM
zW@aN5NFbA4SXNYQHjIq6zYwBqK$m)GBwv{3PLQlQOikr-MHdx#KOuLvOaqo3CW_Ix
z$WmbL&36d+c2*ZhnqBnm`{^^ASO}h>8>Qs!vm>0M0eL!;cXOHk^%agn*hvKz<gQ^=
zK^ovmCzsM0moyP!iqHEs9^d$f1<_U;FL3s<X)wCky=UcdzAoOrtcfnR;ABTfnnK|S
z&V}=?MSPxXKU4`SOps%p0As&^(WycgBfvB&CCi<b+=(WgHph_1PZDxC*FO_VQhHt0
z;94cV66K1N>^D}N{izd%6^T<p&PLd#!yWBkw4Cl4Z(O{rOH%)Ux7X-z;gif&XJeEk
z9uVHf4y0nG3ifa{`0_vZ<2PFmJbl3vt4q~{pkI8HC4*xE0MH5yj`b4e3_x)q8{>{)
zdP}9EyBMnv5nZf$=Z^<WG9XnGPk6WV2F<sfYyz?Kv0yhS+t>2;>OKEnmiLCFS@sX3
zOU;r*ocR=a-VRo%A&-+@@#8!gXS9&oI{vzl2AXFZx|{JiF&ZH?csA8oVkgexq2Q0U
zhx2<qL>Bfkm7JdzrfSWK4>)BmCKA6)T+6Zjpxs^Tt(`3xf$=TG&>)WvB0S_3z~pwR
zhZZCDFRijXBc+TqrAZR#H@JMxW{Z|E#HbpXu&5VMK?K)CizI?KVt;>cet5Jg(xl?3
zi=m~LkU4Qs@9v8G$g3rKv@kfV+@IA{p}d|A8MJj`z=zwYQ_GYb;}y5W#wReEE#W@(
z*qwh+BU=)~JcF@xDZ|`B-7JBdsXYo{xLM-l=i)Az=1e<sH+c8~F}b!Tr3Sn2#!uEZ
zS7b$pW*kXB@`vOsEdon!*#4a3Tj6}$Jc#~c$J<vJJL6Z9Jo_`73etRBHUX|)ZLA%a
z<0<6sT@4(l)a1)JzK4JPi&wEcgk+JB$6g+vDbLSUZ6cBv=Wfn_#K&Alm;9BtV*fi&
z1}HlFJ7DIr0_}3|mH)EmUk(4|y*YtE7R_bK32+3EHw<h5Wo+o+j`kmZ0TcndIQZD8
z$&$UZ|JpJ&?9aFi3rLp|UI3U-N=(}E1wS{xw=E>;uSj29?%%jk&2Mn#e^gTOB`(Ak
z!Yv59%l7N*Wj;(KP`7s(Tl4$O0loio8ZLuk5`L%K{D1BF=Y79V;qSL7uwSGEtX5*Y
zfdthbzd&1$FZ|jq$o>Dp5+DJWO%WyNM5V8`lY1T+o4ae%wk9UJHx@Rump#Sz8je|Z
zrbfX_Y<U4cle|xDk%lFhxq209!xW!C1$(-Qk0zf@aZK1WhX@v`Cdj&TM3_-sNz<1N
zXJBA|YG50VdHfNg%_M!a6IXrnqX$V6kE6uaK9jZMkKpLUDU^1{D=}R)vA}<#r^_7<
zda-PuQ7U1<&dxy&XGtQ9Cf&8MXxRB)Gd=x@_{8{Aj+E;HS0fNcN<ub^SGq~x*fty$
zJ4hFV&NB!&b3Mt4&}?ob{PamggC`KQnjX~suyXnZd`fKi-Ts~}Q*H_!r7B|DNaLCx
z3CQHHp$iPO4LLCUJ5H~NgR7mP(prsg;|qbnYu;Yu?`7QZUi!w~s$^mLjp6-vzXLEl
z)ADA71qs^4cpM5Y{eDV^y^)~)!fJkGy+u)zIPh+V<t)v#ekFils$cybn*Av~<fuH=
z(!F>Yoa$oFG{S2ot0&IaA9wdoD)3|{*vrVB8vaVUZQQcxUbW&)!hO|MW@ZZXSG->8
z+EIvCZ#r3Idkwg<TxIO|@#2i6lwPv{yR5a&JK~iSX5FVUcYra&I8dI?jAua4{^PoQ
z@n;ok3O*r@en#RuMT8)hKxV?<<LA$}uyQT7`28(3Io&*SNWQ$32Yn!VWuP5gZl85?
z`~_4wXXH4FM3uTB=mE_#bFkZcW{S5v##4VGnYGI2`VX)Z*uHa9@I0$w_HlqP^xzgt
z^Rcbx;(O;l(O!`GpVPYT++qteVWXT!%N#xmVsSVIOE9Uv(ByzF79E^0{SbRXnjYDe
z4P^1vp>XQ~TdbTo!<LA`(5dVtIgQLO_%DS5?i`-C#|7Z+3fNS&pq!%hJ9cAZZr~be
zUzhU~n=<)ks8&91ni7Lp#)pLdSk@jFw-Xd_-oyPV+&3raFj8|LJjdT_zr)J)wFS)o
zMrLH!Gr_@&$kCzv<?~GJwqUWCQSACO&8k;6Ya8hkvk@y__%OXQ|M%RtjLON@Qcoef
zDz9YXdVYbz&eXzQ$e9#7*3FzL6m&Y3XMSeR3+lMtpOc8zU-Juj<@L&t4Q3Ipa2?hD
zPL8{5-l6RJ;?}i~nT7@TFIGhRTq6gj+XOK}Up-JTKdYV@iS&Y%Py+5N$+1H8KlR7l
zZo9PxZT|GRlagP&bteDjtf0i5B{Q=sHO2l32S;rFJ0x#7vc9(>bV;%;`vI~r+)13b
z#9BmyS?BPY-jx^RB6zCmIbQ^PxM{}hv-prpwIA9e#mba;Gj9ruiVsQdcLY`q0M$v>
z#rRu>ue4k=P^`&LWt)Z?zLuWNuyoNRk5Lh_DP7C-Bwf?vdUzR8cfHT!(9f^<H)i%#
z@^j*KG9)I>Rj>39<sJ5N1#a5gU0Pf6GFhN#!(e82oLqXmzHZIXqL;;XDe$yGgZnyn
zrNypPtGJm{pf-Y`zV`el!L`1A#`N@jp?HHzKF<0<q6?hqJN7le^r81}`B#7D{ePS1
zfZ6Py$?tOK-xJ{9jTPZ?M87~h(<nM@hfu&~t4!NUMHq(Q-<u>_AJoIjuym)n!7QzU
zDF5hl|H#{p!?Hd9y6*qF$rxXziv3Tkm0ph&0%F6)|MuzpJMZjwN_<KnB@h=6q@eu?
zKBEM_{J-+!|BgnB%fHOI*Bie}a9Llyrvil9CtZfx1ApQ7uvLv=QrP0a$E+3?ciJm*
z6-3auSWXOh>J`z=AGPX%O_OURHT~XKmMKUu(wz44ug7#Pq_M+n|A9iUR2WKn_DHU=
zU2wDdKWTSswOAh$MJprP(NC5@6BrGVQ?K1nqHmvTdcCg9i6mpG8mMAB;B9W`xbwS^
zxXv~%<V*}gUSOyDB&8`z%Y!8<f4VN$^7Aw_b?7tq5GIy7I7od{p0_*QvkVY&rhLvb
zp3@Nw!FVuCS*1v&eXN=K$Yg71!}Rb$!;5<T8ZvlMZT8$)*Tl9l?s|qJ3#@)>{_t_O
zzGrh|Ye=rgkGa+F@kGQtM9U0=a=gj%+Wo$EzWA>_vS}c}Do!T7>323ob$G>FE3$av
zO~@t0dR3?6->*H2#}jdnmz7zC(ye4tb;y`D35G@QJUeVbb&HLObTD68>upK+9BnNC
z;X0eOcrxrqLV*HD%88?Hx7%5e%vVHnn(V{~>Ltu0&K2ZLI=HmPsh7ieIM=x-V&Bi|
zo-235%|v0#Z*C;4%UhV$qwtce4C4kOeUmeU_f>ctQaYse%*Fue5M)~?oRtZkymG7b
zV86!EvE=q{g^i;}3R7mG+fdQDk&)VCah@JQ0?1@PmLB;oWnu>K-#sdm)NKtkWq1}V
zYZN@dnbem*x|H^KtoB8IwP@W2e=Z~g?iJi7yy<@h)mHBU=Ov?_TO6T&Ys{Z(Vrp{R
z^D*HUBf{c7xDIEQ^p8DF#8NdpfD#h%Le9lzr3|dvlrYgpz{h%K(iaw*V%tf?#2VQk
zb>{w)C$fd00w8u6FcgSpFz>nG-5{)N+33BDa!YHisNe?c!-3wH#uh>Tw=ldj7)6&A
zGdeAlT3GGEmN>mtQ<H@I+=zl)56@7%%uC_eyEu(vDm_}FIC|(cM2yZ#Kq%A;w#i<L
zBF!%`v9DI<pu!oj6{=)vd=ww3$Q<bBSUe%8i2`@F)Bj|<3RyO(N6~~u?g`jLz-vsD
zom?G4RS9X{Rnh1vJiF}G94amd%Z^5LD$v(VJN-O2bLcj$oN|WOd6`%T%_F{WNIcaP
zx+@DB$qK5&7_ON48leYQT$txhE#~}LqaJDky-I6*og4QIk)=Myc{Qryi>Gb%Y!uWU
z)gF%FxB6gbPVz(F9A%zQo9QIB(<bX-BgoY&^}W{c^<w&QI;uUo4QCc(RcM!9|AsqM
zKA@X1+BhbCk+O26k{Xg3$gN!B!O~Is(Q(_fPEKi98#VLxTn7TyM%8_$ZP8b6b9Ah!
zH?g(0k)64xXLzSONI2fdfaIWm#HH6~BmCwh#?@-2gyiP7rU{Y#tCN<Ly^lM5`&X_<
zL#{|OpFx+hbI`KzgK&Rwy8x;d`@*d=?aYF2rt?Iaz6FgbqIa@1>Ay;>%YP1(onjOW
zQn(GhIW4|GhO?P&8wo6VmNkk@%BJV48){OZ_^LN=<9wJGj%K|WVEXPMQq2|Bn<WGo
zG2>t<_he4xWFapOLO(LpQI#$|a8uoU{f(MfRoP9gRd9DO2R$PgmPI>VA$Kp8k!lW{
zT1a$H^+B`K1=^_}e<3S*Fa3EcoW-SMViPMGJ2R|5<+KqBdm%~BL4~JV?LADMXN^kS
zGIvK>DWZ#4w0O190l?Lym7y{LOb<uAzWt)=%~7f()k>h9An52^ubM;*$KEG71)z+5
zsUBWI4tZTF2b`n~64q@^O(y#ntUpZZ!b+<f^e83dK-oeYlj}#Cg3$`>vw+ZYPZJ)~
z!dvK=;%SKc`axek?P~GUviHS(cf~c;kZQexA&hP9wkv*A4^TQ`N6lN}*J-ym=N65%
zq^{n3_AFionoHk#uo(H1j2i9O56rdvWe_Wapst0U^x7oksX^(EUEB>>I$xUx`o(Xn
zKY*1w4-4P@#$hy}U~Cp=6%ueV7H_BgHveQ<1^3JRJx^)8`FkW^*6Jf7GZ#rd#x9bJ
znhSn}DxnYHcu2o5=C`WrgZobAvoaYo<>}|5=n^S|n>Re4yaT<=<z#=Kcw7-G)?CKZ
zWvm_LRlg_UDP%HOv*y)LnfvsFftlHGbcq5ji{Pi7gyl)*EO>>8o0<POvCfOT^K+5D
zr9H_R+-e#tJZ5~~QMYDv3}zc4=Y+zCnNFB)yBeWm=ePGeD^eEao@;7EKiA=5hjzRg
zpuz8u_cfofL?x$&=hrnfkJp|LQ^~hh8Ao7(s0X$)&0;mU5)bqsRNZXkZOmwV-O9;V
z3-bDa9cx>2EP=rMb*<LvZgqkrl^ew58_wNh3<suTT>+#R8>D$-8K5Ub`)bMrL>!gG
z=&jowN!s%pY*h`sy?9UHdCZ-tFqK(bDG(-T3y+KS7q<wPOvev*5{nYNzAYI)zdrap
zVYQQSfZeVCdSt_CAfM(j;gv?X;5^&oDl|V}l|yIDUt7=$Kc$_vNi!-dOC#bt!KLFH
z%6B6VfVjDi<)iUoC*e@(Jg8FD)Efoc2oK-$1+BOSZ%H9FMi(h26Sw!VFL_5-&<yY?
zwB$-AA;F$gi{(mGMZF2#O%o$7%I0^Om87!<%&$9f>KrPVw)r0{hXFIE$7__ND$-^w
z$_e9I011+wT2y&9qi1B=6RLtASjPPNeyj+oh~sV~Dvr<s^Q;|(3pj0dH7SJTb#a~F
zt6UQQ-V;;v=EvPwp<quD6EEhctd8@%GAWI&ayW>S-l(xqAB8xZTn*g15;$*rRk!=A
zQlxR;2k+{pn?}dZrni_k<SU^&0Ny5ViRH03$8SVEVwIZo*tF&Kpouclv~|DA;Mve&
z5Hlq)IYlvebW{=DPAVS2Y`kf_5n>xeMvgW(aw!cNxJmFi2BlFS&qg#b_P}c(waajs
zu9l1(0C~D}VNRTi6VKER^FmSO`&^0iI=mD;MU6YnuACFa;zOFP!wL#$8&`x56Pl^_
z>o$>H7FlCM1H_nPeMP$nMAGo0Z#0j2z10~2)2nv5p=KyDxM4U(^pj&kFUsV8(7BF%
z*0O4p&bd;^gQQUJN7bd#cmzW$S??-p9N`y|u++XdVu(AiwkQ3`!mHL$J5w&0A7`4i
zQr4dgF$zzhpy0pBWGCCfFebHe-*fxHzB9TT!4|WRWrj+iEP^JMCLf_fE;4H>zhqg<
z78($zfrTuDJeUznO@f5zD7advf^au-x$kU>m7^L+QWs}(4Bs;tUrAt)kn??1$s4Q4
zm8JG^l#dO+#fmMkjT+(_QokU_RAOXqf&IDr<AbN|kJ06KE74c+94BgBt~sV=GmEi>
zlLPl08PB&~HUg#*(5*b;h6hihNwpm^VwZBJkQwdNP;;OnAdUe@PV1iU&5sM))6TWG
z&#x_tUz}eE1+K5`m)4%3<b@7-ck{h-aKIon(&8eR9Y_Ik?AHf=>No;OKrb6HfI}CU
zZ89#NB+NNbE!ODGt9YkC(kYl+o@x+w2JZXuZh}Kt8K*ET$mQ-V+8Iy3X3eTdf|k0a
zjIU4kUJ%E1C99TwP;v0V1wiWkZus=iWop3|k_r>MIv?8zac|C0O_c`6=GUCEywyT;
ztP({Fqi*i6$Cf-$OK~d|aanlT{RaL_ldsBDhkNJCF4k%i&E@orE{Yc@MNX}yZavz)
zM&9v55vK1OYx}qe^K4ceJeTegl`g{_TFEa-bB9%|Ari6s1E%ekpB%aInV~EjGzWE=
zF;PUNM#yPdv1a>HyPMim7?I>Ka1QM?ELwaSy!PH{TX?C+0gUHiLN?dt5<E|g`o8^q
z(l&#a9_|acN8am~;u3%_Kt_dlm*k|a6jEV(f?7@enf8v?1Z!5EW3IkuMR0^p*Idii
zU*nhUvtYn-*#Ts9+)AtGnA(I`R7OM1o{XkS#-8ik2ESb1zWz<AxyhyG62QyMYl#Of
z3j@q&WLzTn<j9+H`c4cD$0KG$Lyb5>jFLo8Bb7GfNYmgA3xdF;!06AmrND*uTajfE
zefYJuB%`?0rQA84;f3DeL0)|L!k63GNudls_l#L@qB-F#oSn<0HGpo8zx=b;3PXxv
zO`D4V(ZpZ`lho6)h7{A_AT?8Wm!!=5V8S+GhxxExT(p-5+%bUBes+f60~g~NI`rgu
zc;>jw3U5#@`|CyDS!u~AK*p?#B#Tzyg!n$G{fxY5UntxCnOaLJK9WbMT$8xJSS7RJ
zyqv_EOS1@gD1&Ll!7=F;y@GUe_VZ>Tb(!MnbMvNRBOs?<MJq=9=g+y~K{z<?pErI}
zV8A>_x`aZtkR_cG={B=rM`_Mk!@3PkkoD@Ig9FvC;S0V+QU=6$-t2KHnFv1|ePtc=
z>k<ggu?rdk6?I}+Z!S09GJc-T+)qIimGs!aKMiM+^SvkFfEX9rCb)SvT{|1uV&Pa}
zU&R@f5m3or&6VM=kCV$><ovOp^ZiC7>_{iroMXD}I$Eu>(p;qwQrM-tbwXPmysng*
za$kyv;g0$WqFky^#fz0<MnT*`W~7u=1bLjCyHyErbN1;=NBeo{S`9kf66`TvZeFxf
zh^3FayLxg={eWqGizX~n&AcHDUYF1mn#tY0usLpzg<4WXL=vnijaDUJF{=6?JSuEf
z-y;~E#rYY{3yTY9Bvi>Cfh$`cM-@MF46oUAo)SwG5#*z)KN9cU3?TFuL+f|?oOHEP
zJs2;joyu#PD<78STW5N|@#?C`gN7Ah=xugPhx;C*c?gQLGn+u}HY^k8{-j5yj%H0=
zZF_BVW^U-cSpHIuBwpfu9NhRI*~bcI1cv+=?$+5OiKg~!IBr;MO=`?N7sqS58pLxO
z?n=G)-+n7%KM{xFce7EA?J-?swTXs16n4AZYQc`i+0~!xk?{;INAGt#k3#x*$Nj0H
z!YJ)j6xbM@Sz$Nt74mHAg~6cMh>V4_S$%HJj|TNguff+L2d4+<h0Z1LXLP<5O0z>^
zMy53QLE`<Us@4Wy)7<+vjVK>$fY^)Z??A?;c=Nu8IpIMaP!&;FMyTXu1z!b+pORyS
ziEOK$=Cg4Vt}x2)V%K$uqW2hnuGcD1F73=`e0QLNDpsOq5>Q2|bwTubp)U?oLL!qn
zKZAmonslhXW7HMsDjUAOl9xDt6#ub(a=-kEVrB8tTb=3zCVGC>>$|)|Senb8WT2Fv
zptFDXgrmKZR-?dv;<QUmg!5lLnT@qEN%GSv<UQO#oP>F_dL0Kxo^(yf`K-T&HPo7r
zf5;Yb)J(G&?l@nV<#h4SB=HZP4Ksz{^icYL1w^Ejse{<QC}r%JwEKoP_Ep@8a7=^c
zsJ(u2W|zZ8q`kk$B$nNOoQ)V`Rq#}~811~Sls1;ibI|iPvG2YRZx(vY2aY9iP~fhv
zMBVdI>q2Afub^;GB`e(R2~<x-Y3HWuhlJ*~4t>^JCA$JZP)%TQGf$4*(1L(r<cgk1
z<#h@!5=itIqgwqHxf!mfD>%`vdQdR3qW>V2_G~FJ$4*9|(7xEA-Z*kt;Uk~+we!1r
zB}AlGab}Cl%IoeK9SJM2JEkgt&~E`KtlsB^4{<#!^|Yk~_gh4$Bh4Y=O$|g(atO~b
zc)rnztZ#`EU5y}nbLJIo6}xOa>EWm6`|X)BV{vuJ&5+21Zv!V4Cg?$AMjzl}CcZLo
zB<rh5qTT<{V45Qmmd;(B<dpf$EwJ&%qrkf(j+=mOk(TIj?6m*w`lMHyt#aXyqz`FN
zdvt|=paKiH<TeuL6Ox?PNo2Edk-oYp?)>^F&Itv26@<D@xXWOxZ-)AP3C@erKj()T
zy3|;qeDT49*9_bhKy+k5vDvLwAKW96@ZEm1#Eo4g^cgB7oCfN1Yh$7ULe#a)=1<>W
zVedm5oU`reQ&8qnlvlk?d2dChRw?<(lb7VIty*4L(ny!M7Jxefx3<+*S55ttcU#t*
zx)BS@;)>*YtCO^L#r;t58tG4I0mmR?R^dFeE#T@t$c5~{Y{SaMTA36l4+3fh(??1z
z8wH6<b$4$(h-NN64TX%U;KhZs5g|_^+HDRfcIJEE8v+p=iAJprjmbC<c!D$%ZZ7#-
zuD$EN^8TvEzWWJp&QJ_f%+N}ZyyD7i-%E@LdKo522nmC+y?Hk2A}3us;>Pd68<iUC
zC~Go#zAAK0_8p#6o=`WX_sX?GxA!kzx^H`#OCW(F&}%!pwv%$ovhqJ9ufCcLD%EZO
zl(`s-W=%e!UZO=#zm>^PNp^Jcc68*U(4@W<8((>?FaPch4c&fi-ae=yQeq9u2GLYO
zYW?)gVn=dzyA~{dDI7|;XL>&Yq(LCOig^2aRMgBi<VY|^rmuv%J^Ck$pvr{a%;V?v
zExyGCjj~GAL+t9PX7*5d>7z8+T?&K6Q(#ROjpeX!ufD)W<f2K<4Aq2o2t8D$_~8$$
zG^O9Rq%!>id1}yaFF<xIbp1yxekjY`_ysbL`31@~FM>*<o!}Nk7=mWB_oq{~`AOwZ
zeQl;8IU}oyVgU+QHW6~JBc9oKEj%R<CRkh;hNt}W*)Nb*V83M2!lbLGGyUtV>wDUH
ziLK3Vs0`#K+MLiaMUdt007@twUwT>Denk1sZAX^(DZ**|Vez|0JY02%n&?1M5<eab
z0gU?BHgQOGFDu)W*fPnM(pXnhaeKY(G>iEb4XZe5`*Q`O8&xkYSmd{F??0-ORFFc?
z_M0=zU`RefXyHrqh@SK}DG9Y-%wPC=mIINdKUTA@kKMNo1j1u+RMEA?7y(q@XR>fk
zKLL4TfW1zc{>tz`hw2XHb^LfA1oKfLB)4;!9O_<*kwLMR6wYm>Dlkv2HMIrt)@2%S
zTrH0IqS5l+jWF70Rtqp#Pz7Y3M9WxOp8fVJa3#3f{}<>03K-;gx4Y9X)VKK@f0~$~
zt(OmKdyM|>LKcn{#@t3a7X>-pG07O7vwX>TJFh-k%r|M3rGXQ_n$7s^Q;RHur+b+K
zopaEwAcDLXFBsm!?Kw+}GOgyKqqtA4NmUhOD62|Vpym_lqC05ksy}B0u>knW&<H|f
zHMrJQ#NOMkkCYnxc|-R*t{hsejeVdw5{HH$y8@^n-N%8m7!?$qHX~^*Y)^!jS6)W`
zQ03TuvDuWr^I?L^)4S|~Yyu)>X2~bPZ9>DSeKMN)9pW~;dv}j59OJLvV=}p5V<J0{
z-Z?Oo+Htv|lC3hXLKE?9;&&F<_+5Zg1klunw>|(B+?QbNAN&;nWH0|PzV+9}WvlTm
zP~P7~-hgHE|2>&Wtv8$E74aLr)z!Sja)A#9HZIHK2{eBflv9KLr?8s3Xgxh3Q|#Bo
z#d&_-B_a8L@%kIt|BcSa`CM9<9RKU>|8G?0e*)6W75dV@KoI}8fOm@S##(l#dBvfn
z%DoeE6~32)ck&W8o+Vs);n8sr=b-NFwEw8JrsPiXo%=#huWw5om>X?UU6$|bK05H=
zm(@}f$n~K4B-|m=^nqu)=kdGzNXU$xsd}tPX(4;uLluz1@8A6L7v`1Kn-R-oVD~dW
zX5wy2<A;k5e2%yo598G9vHA8>cX016qf}1hhxEFXL%&SH8}{xoK`Q*&4{W7B5dHjv
z$6x-UM!*gEOe1xGuF|`4q5g~6+|NGubkNuT##P)&?kg;q*I_A}UKAP;TvU7eIOF20
zwhqkD?vgqGx7RAh5>Y__x!N_Uj|$CaO>+tG!VPImbZ00pH+iAUQS|(|)i+WQ*UHtq
z_(m!;*@X^g2Ici6c}vPZ{5Fo>(IR|7(uqvDetCPYZ<FPsBZ05dD67K)Q9bYT3F{s<
z)8;|3raF@B^~Qav%CFfqkXF4*od5b-v6K}4wdkXy-(>sm)A`pB{m*TF&>vC6r7+^p
z3%~XE2I0SV;SW8d<MaP#82v>M&HjrZTK;dG(f@%Ux>dn<@ZW~*|6qP-^8d&W{h@^j
z@Bf~F?t_efZ~SJCF84(K)$rHee>E8YIg~6MY?FP;2WAb}m1{qH9AM!x3-Cq#|IQbw
zUzA{Zx7&#nD8G|k50;F^7|I#bg?&(x8x&_cT+3ybhwDvTg$%`fyOw?=8iM_L!TAf6
zmpe8L4!Y!s1kn1-*(_kdhky?1)Z{K1f@LOv^1^xtg*E+V^_z9yQx=}w>9BmwiM~>Z
zQQ%y$*fW7!gt!Zbb^QX->giD0-A!EUEl~o)Z5%RRzg5fnU<D$VAv}{^@#<<7U8(5G
zCWVSm(raGCITXuvgWH<|vfx%({@z4FV^SSATS|`G(2ix0S=bwYA*2*9A|T9A7aex*
z)%k&V+A@E8Ll*mR{l}*nRU*8jZFRDxenu+ZCtca$O+397VXUmc3U`ZElf-{iHgDej
z^Sfv2W9PaJHk?K5!REmabx*UA!LZ9*7DsS|1r7El^hKow^;Q#IxByi8qka9011lT*
zLYVQrU|G4js`4+2H=?X+{RmKOeg4E3u|VeLJWsHgXUn<4hji`W{1J#Q>;9SATTb8N
zVegmyDctWei-e?T5DIKM;Xn$6OD|h^1b(0gAh*HkPtQxoX1l`Bu!iQ(Elum|^S<8J
zVFWFhSo)ZcJ_(&3fDgXTHT3y$Fj{;ijxC@IWN3;kZ=`J$eB+^EWiR+5N2Hs(G$xKu
zlZ&L~Ha^J@Ob>M4;|JFwQgBZe;cF44z=D2^iqb}6ToCHzOd9RT^*omkno*C*xN9e*
zh)W;EB#<RXbg-ze|E!odJdQ?(02XNx{)|9&JqhDJS?F2sQZ|3z$09AV1wDL^*jtaS
zq|&-5zi9Uk#R9(XT*0t{VicQVTo<_dX6{PkQ+w{lnIkQMVQnq>+=w)}lt>M8Tl=dY
zaGv8hk6kkih0>zyfx2ffMZ29{O<d^Nax9+*8-qi(RjP`*4S|1xl+btlw~SKXL@3w|
z`<MuIsGk@re4GOOZAk#xv~4yK05`OU6-;@wGny;rZl!Y$uYI0gPyXQOZ8Ps#s;7Fs
z;G(iAYl?K~4~RVD>0=>UneAUD+G<kSh~{^8er2Yt+LQvHF?umIC|@%yQo<KSzerEX
z^!oK%3-HLfGzLH&cFT~X@}dv4Ecye;F!!^B8z-#dZ#5)1Mn&v9ak$;zf7D=O-pCpK
z-u5dW81@u99#9k4-5xG!jxz(KN|A*MIY?4!RP@r+POo7<k_Rdi>uL(<N`wl&hnA8`
z3TWO~+&c=0%chg_KuPw3Nx?vmwtU{R;w8vBSs2dj=LbzKH7q(g!9z5g*{{haT&>(x
zB{&4nANFKP>I4C6IH)FqjD)))k{{#pQ9~fn_EkLr_ZRm8%3HQJ5AWp(OmtXz$={g?
zS|<MmvdNBSqY|)22b7_AIs?d$BxZMApz_p`h7z-h(TgUgihQ4Gn8pUqKS%r2jSeF+
zQ+vpw+DZLs98;D^+b53bF}5GKz0$2SY#OVo>l@rAbgI|PibG!#EWEcyh<V_+cLXqF
z1xzq*fE)=`-!*R@0}ih#J~HFjQEy4u7Ckn&>S&LdQZjp#LizzGu6aQGG;XB`sAf3D
zvSFSk!Y|+^7-iO*vxaJpM$U$YIMxAHv?W(gt6dvzJ$+cG3~j8Kyv)Lr>@|+t3qe-*
z)ybG1Zpx^}lqq`ol)QVI@~X#f@7w1s^V{cO?C=>d$f=-@kcNE~*ZK3X9H{5D;+ehE
zRYU`O<s5;E9!@uKQ;F$6;xk-hCBQ9sGbuAdhRBY=Uc(Mrka~<o8oxLz?BRc9Y)_j)
zS50K}ytQG;^4xTSZ1GKq<j|;yaPVRJB0Avw0U8dD^1<(Ni8}KPOhETBg-v*nkvgcJ
z;WpGN^QF|^S`m@xOnT}0dF4tvlEe$9)^`vAu5J(hImQanYEee81+#LqdS(}aD$yC5
z)rN0c1aI6~dPSPAX`P~Uo$GLy?fM6_Q!(cLSN$%wYJuF9H2yCWi#zEBX*PudSzAO&
zKOX4aKa_3b?Aq&anv>#4R2T4+S?(W;QV>Vy!huVwdMxDUh^`#zv#=-AN6p1gYfJ`H
zU)I*g(g<?ix+Y6`_3hVas%k`BY&N9=Jp>3h3~##u(Hqu|>ycSC<_W(h8S^sT(M(j$
z$(8suwVd|$mBlN1+wxl8tO@=c{=@Bz3f$XHD<qEnfbD0Df7AE;jj){1_3eqHS*nFa
zlVQGlx2=9C>^>zknA-<a$_bbH1I`H53hf^qvsjvtb!BiOg1p+v{qKzXGwb*wM%78D
zdRm(?f!bZJiO~~P42^J|Xyg3UJ$#tp>o(@e8*SK$NkQ?<XWJSK#(hIqIRbNvy2U2r
z11Y5jSxEe4x4g2i>|z8_-4D?jD=Yy$3O9p$&Hzg<|LXiXvl<C?j_{7M0IKUB><Yf$
zAj|yJQF*6>Z9MMVMwbPRhnY*C1#_E>UDc*J|LmmJIIJe~evN^#SrxBL@HkIqmZ|46
zH7UH7fR)rJe?bg>Fx(}CZKW`xMaK&+NVh%T8;w-ECIhWB?Z2iQaWh40h`vjMLxM@Y
zPy25EhqTQlD)dnql>FkY0{u3Yt0A~wK^S$be&T1Z<|?_F>FB5xm3iITqag09hSKci
zOUBKDVc?qjm<;%S1Tq-DpZ$S*Hp;2oc0v#%U6iroE}p|+Q`?}%^cM5M$U@e_9)$DS
zLbQE13?+E);+;R^lkIuj!bmwyfMm2tHE%{vs>k6@$4q|C>XLZ&OyJX_BJLzulJ(nc
zKeRM{x0xo~JQm7!F7BX!n=o#h;^h8lVz*}8hCL!E?<NDcx7pw~*BX#}f>hqF*xZ!E
zGAmXPy#u$6Y-8~s^QV~<X9~DF%u-%fvXiQBvcNP)=QRgRQ$&~3RAPt}0#{=hos2r~
zTP6g2#Jwy~;NaXuI8UTFeT^my-aJy%<z}wvK#~7+<ufW~e@mw{P)MJ51^d@>1y1a6
zJDmdeushHR6VzBx8~b+l!VFy-ODI!GhDoE<qpT%3!SnDCn3BS-YnB&F#xk3jU?iBP
zjR7i!?u51Dna)8fI@)g3qX>}SzZAJ}*Subh`M7vpQC3yYEKO?d%JWX{c+*`uD%2#r
zJQ?Mpg%(F4x@DZ-7NZk&8r#P!embT(^9zu?`z~J-B@(8gOS<Bw41&-cuD?FF@*l_Y
zWOruIfyu-uoKUQYN0sBOTK8XCHBKx>a5r65;IPqqOtp?UaF6`S&kQ*~4!p>N(x4PJ
zI?~5p1CP+l+EYVqt<(myUQMxu1a&{)q0(FzQ?4o8!)}XDU+NGcOJIgQejMG$u5pi$
zdu!DYD?=35{5uHhSZe>xlBVXx_)S>-teDZ2O)zpkVF7v#kWVm;kt$)OP|r&MCBZ98
z&l@$^$spTMRo`Mf&U&+tY2jSXL}N?kaj^Ei+XxK>etYnB1%W4axBcKzni*v`0gfp>
zqOH!JpYBWg%q!PcE(*-h+&s(#^sMc1^F?~wjqQMIEj$&bXwh?bLnIpzV`LscvV2YX
zlf7Z;1Dku4Hbhl-MDW;zMx{HzY8bj;SY1Af=YDGEa<%ivmD_wdSw`X``VXom{ReME
z7p9UWa#e6jc`7MBydoEGXHU3`9DB2jgP}Qp2zaqp^noL0MoQ2nCNoFPW*lc4Hp_Vn
z_FpV(Odd#4BwH``x;B4YdDeXJCc73tswR8RYb7j7-1pV&kqZqvcC5<~NR--!OC+q{
za5GsK6c`|{J80=ia2yq9W5p<40EH|li%!P=z#}tTl__y~O+Dm(`?Jpq8N@!F1DYGQ
z24Mrq5d#L_-;;m9lgImv1e~g=E@J%2?XlNt<N9Ql13kWr_IlCILyH9$LQmJyd5x%(
z5^d-28sKj{8W?1!?PPO=q{7!fe)Rv!N{kk#&7`jLzct~Zbzig2lTzu-SLst^;M1@}
zZ4FL(cnj(IaRP8Dogc6`W?#b)<Zoli(SCj&g*poPetdN4`J-8)o^|%jFN(<59%p;P
zrC35G!)n11%d}v}034`Z6WYBDqS@I54m<LtU!UQO<V|VJ{AerEOPmm%T$#gHXW_^y
zV+imBhQPvY_q!EJ5~fwyb>ZH}V=?2QW!P<;mCP*iO+CGt;hI<Zj}j%zx3P%O#nx0%
zRpq`PcZvT*9i2s0^1+_?N~@fi8f~0FK27o@JxYw&DusaM%DVL9_^MTAYgZ#M5%xBA
zBAY@GBMNVB4?EM2TH*JmR1<X&k*FZ1yk{mrtRzfNyb$1#&}qV5bsY#~M^hjIZ~#L?
zIdO|1p?Qf4csJ~P+R;RDUDVwC%ZcDM2p2eIg8JIa1^1=4IV5iKXxfSnsr~F{Cf_JC
ziP77fmZ56ukB!uK73uSK8MC-o$l_!wqFYE%YQ3{E_h=_D;OV3964w(9Y#O!Lh1J~d
z-m&igg6Fy*jz|U9y7X$fbS>jPM+d-I1P%e?`BE3>dvx^)y^hakJp0ySkCa9~K5n?7
z!46WCu8^rqMBsNdTg0;A|6C3^TMpmHIF&dWXGMH6Dh1E!;8oD-%=38D<l04WI^?EE
znUWSd!YsO$!_$?qLu&fSi|>`l(6^=Cr7m%7mI;31@R;Y=Ew3ADt+MQmjY!+$CUgnn
zfC4I?+UHL+`3k@*l^UjgmKc>)SZD2t^WU&O9OmRG3Rz+>5FWNv<auv!(&Gdumjj%$
zLzi&cSv})c%<#^8SvAgM{J4T9Zqs`SJF6;BQTkG43!yELxp39Q9PB94!JoOMF0tEO
z5T&(WP{B%)U%TL-aIfkY$iw<j-~OP%un6k$8cXLt%|_TJZ)O9O0x5%oYwa5doKH%v
zKYPh1ughx4k$mv5R89R#_8DsLiXgHeURs3UjgCE>{mL`<p*?MH?|tgS^VJx$RDy=+
z+k>E&q>dY8-+*9{N_2J?R<6N?@CigyuL>1f=vb^+XsYRsJMz=jB(2<Qh^Ais2{8zd
zn)T=)fTG3K6?xL#j*K@(TRlO!pAOP}tC8YpXzmU^+)aOC_zbZw`$I%Z93{A$fdIrs
z%0?)|HyC|nVIQM08qs@}QtJ{RA5%4FY`mmGu2b7SU!NOHK}^AHT~2=(VM5ZXopGFT
z2*p3Y2fc=_&J#>_Epj-7=s$d_ez<$YMZyR!ib-D8z1U^#YC~4MX%ky$?_HiBhN*Rv
z@VL)Ir4ONI<?4AfZ?eDJqa@GW)XO@zL*DsKT6lgvz8e&ItC+qf=@Rw$2kbBg-M+*)
z00`{AsU`kGbpATx@+jbG{<86}BmbqE02(hrGXNjd`%mQqPzCx2IlSDsw9Wv~LnwGf
z=TxCRy#4qJ@U*J3HGO;mRa~(+RjBw^)3!}Ji3_rQgqePCD<H!E!C&>WUB6WtKtb+b
zat-6(kiz}{07)u_b>e=3>IC-$vTF)T&PDtOvOwb)OE??h*2C@e?(IWwMLk!dXE(T~
zqaiAdfeGAhy#s_2!sUWkIvxzICN|tK7>pDl!&*GV-#Oy<zY7$NtO5?I1HVAy1V~#f
zp5iai@HQCc7SL%Ou=xfp`U`{u6f>+Hf&ANbE#kq*M(|1%_@@$-;TPz2e87*h#Q*)j
z|9c+(cRc*>b@4xWepth3ox5U}va6HQC1b#j*}?v76D?PY9VqPGOzr7DNA+aA@>XWo
zQUbWlft<I;HTRjEmxT%N0>So0mkbl;_U!;d(66a~6O!Gw`%9qrx3cUH$@1^YvfuZN
z%X`m1hh9p}E(K`6B^Q4w(a-_M06~$^joQF=5B~z?8y+3k9D91{Df54!_;S40CgDM>
zi;5Z2QI3VT-M&Zx{}<8Oh)>$sdH1FBOdOaGOL!EJL3sTdxi@|-KexB-2g910n#y_;
zM|!;_>cJ<7hmj&~FY)lXR;Pb!9P$ClNlQDdzY9!+5uAdW6{FoW({7>)Dims=0xV_*
z+lYhkpig@`cQx63jtFlx;8Ops($duUi(R;E`29!C!>hU~m)yhe4eBdu`jcXNj@peA
z;!#g3N?oiVwn48bRrvI-mc~Y3w|T109!;S=`SSv-UI{#Xm)Mo=mT^A$5OnPcJW`DQ
z(Y=Q>kMDMXK=}8Yfe)e?-2&j`l*Ryw)SMkp$&<QMkxmzP>Z<;lJ=wSPm7OcAFCpcz
zf3t&;pxX&5)WcPeNE`8qMMR|W@$xQ}HMc(CUC%LMe0-OsgSf-(?pETS&Sm%iIS;=%
zCjh0tb@00vf3qh*|2+SYKbH#t;K$@8GDR7N$_Z7rM|ecZb2}4IFg1s-kQx?Q2&YON
zM9ziUIp2tdf1i1h|8QVinU|M1==w^K3?nEZk~cH1kCigR*o8!;>|0xTUhwmJVW#*;
z*1_aX7*ZXUTR1uYF)sdyJpU2r{2oJpjjrDW;6LN-KPa3}2F6*L#oh?*=E%+Yp|8Vh
zGVQ5%{8j<3$#RiZEgxi-lTx(JSdfuta#8WPIdq6*D9d_+&%SkZ+U(2SVX8pctXo(2
zs10T95o81oj6H3vl{34}9#4oO_&FLQ_R0HR!g34*B(g}=ST=ET0M_SH7W5AhB=K7*
zbSWPCSJQtIL4t$XE&$uRmI+hg=l;E1`mLb(&Ait9Ip=?v*GDe^rVyx8)@q8}b6QIv
zAQq^)md;tH{;gQ*m7GYH;>z^4MnQQfe6kwMu0Zk&G-T~B8}Kd7_7^BejPW9%Vt_3;
z;71x;?DFwV;Og3p!E3iD4!@*h{&O+)-x?|s{K437%cN}}bn`v5i+he^n*^#p+|n^a
zi>TX^1B+fLwp?$bdvN0xdfuo_&vS*!LK#ie8-r-av%?DcG3g?A9FDhMzPd0bt6H8v
z_ytPwB44Xhmo3)<c})H8;bRin$CKg^#tn^@&|{isAuDgKAMQ+R=&7oDQ(y5(`9m~b
zxoua@30G}}w-ce+3{hl3Vp4LNW%kI^O8XPKT<yr0rE(q45A?4O^*4q-47#glC>x0H
zq5{=8C-a|W?B5Gp$)<p8A9fbQm{^!}&169Jedl|W*A495`mTHKQmTF1@Ot5X{2j#2
zPlGay0<tUP=FYnV7@@*Qs(VwbD2qsp$|uGAfhL2&y_!=VS9(d&)JH>~ySZ$>zx2YD
zx`wl73=BHTl(st;IpE9p9=lKPVK^(c-5|leUQ}uX<3D2(7dzL5%x3vUKX*rOI99rM
zURUGXyIjw<@amusKW?+tC={Mc7sM15loi-Hme=Ks7asd|P4v<wRkR0Wq$&1&dCF>s
z^Zm9RaLxVxuzya>|EU4<8d$<k2Mm^?O|bp4Y!{La;%66^t5xHQQ}Jw~fNvXCzd!|h
zs)1k&`^*0*of8er=hK%A-ygx(UzG%x{N3dwkPjU5o7wwahH%O3{ktyg_r&pUd;Ver
zFKZJbLFnNBHlG9Q|8u^8K}+=EFOcQh|3ln+Mm5#7U86x1lq$Uwkt$VsCn6#sVn750
zgor3rKzfisDAJpNfP#QZ6Dg4{MM5v4AVo@$lF+0lC}C?tJo|p1@A=B}o-xiC-=Fh?
zA8a-&Yp=a>t!vG7%{jpX^r}B(EY65<fI17nYJsgqr6#XWDV}AHK8iCsIpYVrC8xFh
zUhc_i%T@>zK3>P88)2p($5`g)!5GL3``s{16(^v1QFo84P{v`UUPrdY>@;pi^!<+=
zob`@d4u`W#uzbEG-f2D7n!?&!>D99ECo~z7W)#)~D?&X(YQ_Y=v-bvH`x%qCijObK
zvv&eAMb@%(vrL=wgt(+Ro<?|2!Q3!UCaD4d><wUaD|=UG=k@+!N=&HUpTd=}8O5>D
zm5<5sdl2=trDl^SO(SS#4>VNo3<sKrD&9exO*<<x<KQBsE@Yi<id321x?Eq&?AEc@
ztlKeG?@=4rBYI(+>W_C4A25JEzvJ1qP_3DJaN@Mb`lap3)a9Q}l7=S3G&K;a^Trp3
zJ2p-jumBa#U#a>MNx|<fE4(qgVx&lZ+R?suHbmT0OV92Vf;J9i`n42e75O#Pp@5z7
zyZvAocaMtO(`%PY&H1b^1UC4&PDP!8z7WKu>&evsSVCkW#bi5DrGTK&+!W!7-)Gvi
z_R^T1yuHH9?3U|Q2i1HzERN4(3%CKddjp6Mh)RRA%NM1MX5LiUew-J#x1(OEHuUv{
zpV;IfL+<UH7tgrKWr5;4kIr<}Xq&c@H+qY4eEl>H(v9pl$XGly2_;$Xy)9?&6*}Te
z#N;twKZP?93lG?Oa!#zikL~wa5Sc7YF$AI`h!{L3rpYg{Q+oV$`pT^o3uPmpyA6=>
z(itw5w>eXLx2L$$OK)Mpc=r$n&UoGq_!~gA>v0_Ub<NhMM8?CQ?Y9=mz0B9vx6G{W
zUFSKV*`eBH1Q>%s&H*}+#((?_?Ey_8F9{WGm`p^T+q&reSh0a@o>JiWmRc{-tmG#g
zcR#wo<E9SF#=6s|MWfb3+mDnhfHx=;r4XrroVoI?QKKWr=lr;Ii*=PbS|XmiF`Xx%
zM*PF?$h%C`zUVtMV8YZ*V25rlv2=<fp|^qH+HInFU`cJ|>M+}@r;5K_&0Ipxs7QYv
zZ@#FzkxVSceW~u$Lva9Tl6OzO8>R{rEul#?P5bTEi09AT%)6Fo;iu5w##&!>&P5iQ
z(;PVH>yDR=?4v0I*yS<67Kcqj*%R8&l(*G;7o^=osvSISO#fN1Q1|A8#d87qenb9q
zllAZK9FAb;y>x2=2Ojgq(D;DtekCHss=a>Nt-%p3%fBmJQ6S){DsF1^=?cT{JF`K7
z{Z26|I{)V~H=2jW?(sMyxteNNws6Ps`|NY^Y`E3KJw<891S?9#9hKUjnO*u|Z!S<Q
zP^thAVF|~49Y|K(DQzRwwuHKX{;*uNuVq{9n$k@(pI&<+)>|JXaq_8(_a=4@3l`Qj
zLT8KSyL7&#%pqfK#+z&%FGQL|A3}9ZU*Da@-7<X@n;N9g%6gki^7v_|2K73SNu+d>
z7d45I^<RR^1<Fb4lembi17kgv(wkvX!}H4NFDctVF}cZ9&ziu_hEfJVhlVRHL{vE|
z$Qm@iZ9Bb)XSm<;<nz`H*MM^CS^t*|(pm)AJw#g3i2^(}wv*0zEUX-5NF*0XXyT0b
zibMV6rM?XXOqiWbdCkIbJgcvoi8u$oBgBbLR%FRw=b7WT!3a(OekU98ajKEhu3O_Q
zBw}}?P4-?9M@6jA&}rG#x4y|{vX@`J+p+t43?;Ge+7Nq90Hrrn-$~Z#)^cRNdAO6*
zr_pmWGc7X`?;J|6U*e3nWzUY{ewmp{oh+fckd*q^=dJObDHx=?JyHEIJ-WJSG4HKu
z4R_V~_;`;+K94nFjx0LcllNK?B1rG9PBuV<2vU-|zi`>26FN_l0=#EJT9n5Wwr1}L
ztmN;H<OP*keb-`qqpW8;kV(qxMuP>6zGDeGAoLy^`1XebB0)VRu+q%a-{<7y2e$D6
zchk9!x|Yz9?uS-)TUT-LbiFgRC<M^&LTXtdw=PSMQ?0|iOK1BD4DVBRymo1|Qe&TL
z4pQ&3-0K{fHZVY`9~X8q0I&g#wowddr_@HS63uh3G<npPv(}e)K8&YhKyE$C#bb&s
zFnY^-bu11hOruAM0$9?<4d7Fc&=>Q8&<32}#75@=Q^N(ZH}RKBLhl)eVw)=Z(I=1<
z%XvM}q+-_H2j8gro+M`TT)FUYZI@g_Z`REm@s=Qyg&f_h<Jptb1r9L=rGPiZ+;|0=
zh$g=4@LT@khzAP^YIl}yPWl`oE@aUrH0W>_#6qm(!%h+OqKj^@X<>P2bGABe9|=`3
zdX&Ko)&C8W(=OKeTjRGUj`J3r`}tZ|YHM__bbR0k52ijyf8GHJ46fwd<JwMsWC@=B
zyH_U^@UPf9dfZt~&f|SQC{^-s`n?0azwrG}=KJFObZ~7((Qsn>N^vagffE;@q6ePR
z+|t}B18SZn*iHRv_jmPI+0Mn~vbGz_``2@R?zC6DMVB7HFS~XiGS+bjMp?XX644o!
zk*8B&j+aZhU3)iIW(2NX7-PcXFU+NCiu#yvQj?Kisudnz4Apa4DdxWY!&w5bAix-J
zdl84#b4wx>7Eg%7RUdpB6blc1F#7Fo0FuzD-U(a)-CeQom3kvYEqK?D`b1Ap{aWI5
z{_*L__hBE_sqA6j^8+jAO=JQEAPF}=UX|Oy#G{)AyP+vGsYw)+NV(ZDbr=pve8}ah
zShyrVA@RLu-K^w_b@9_vZX>P&jB5GJ#pkFB$0djR@eX-|a^?sIWbEKr2{2<j<tO^N
zGWN#g72Y4Qp9=?WKQDU_fAJB|i{_XzteJr*u-*F)^MT_H>JqU!Loo;AFc|84->Lr8
z(}46>Pes^lq9jhRo!LeR(nfi!JNb`Gai*r89X^D!DjlFgoI7r1OIxcJJc?yb_rTsq
zCs=)#6R)WmH9B$nFXVc$Fw{%psd)Ku&Mz1r2+Y$eAFP-=wwupPE3Ty}Y5tDqHEqsW
z8l5m4^lkdp#BJy6`CQNTJTgg6TX*iEw|1b$m_BKyAAW+W;jK<8dh<{a&`vlzqPVXl
zg#9M&DwN=`j?$%EMv0T0Tio#rjE<T*ag=BAu=?-i>r9S9MHfq=9%nkzU=uVcFNOP&
zqFaI%S+CHIXiuD3!0nel2h>(BU+vMrBDoymbTo-D<6QrNq)~?-NxJ~m<iL4O_UlSb
z_W4d;w0;?2Nceb1k?RDp<4|&c?zr8%rjhIiDz(nEZThE%1uy+M&>u~f!Q?9&&>crp
z#qk~;Vk_)|{iP04SXlDmw!JzX6LUq2W7HK3Ma^f7Ph0yR!_z=EN-;mEE;ZvYxeS`N
z`>_H(YmOfs#JmNEg~e4YyiaB&6kSyP`QWiAgWR*@n6(rd4?5*Mn<j{_x?&1jH$;&e
zJS2Fco;zOQ@dhC$WAHe9z^<4ZKXvHn#MeXS^15hWVEkR)V1(yQwUlNCyZ8__wN99d
zbJ$7w5%~&8Ag2R1cx(*0ShV&~x}XR5?5u^GOH%&&=H8?8F*0oYpT8VD)500?%JL-k
z0`8>w0Rv5vaZ5snHR#Ib%-lS6H;XU<p26=NIA-#*u8pmkI-I!;%{i^zy=vDT63Iad
zsiK@fae^G%ps>T?Na%KMq*%wK*v+5c?dKL2<g0{{k_%U&oBu){X{bDs+lR#?nu@z&
zsm{_3#Dw0O8~e6Xdp@OYIk1MkSLUV!`txB@X&kq+8&4@@@5WdsPF_U0Qf?MNMZKYH
z2E0gSdmy6<@Gv>XNENPjyWc-Z8)1g)LMDBFcQlF4jb7U7u&0;+cHK~BHAGUR<altn
zE|$Zbrz}2dx@%i?>GQRkH(kP*7dhIJ<mk~b2(^KDMA!#oh*A=m6rqGj<9i)2zT^&*
zK!U!wjYg=ZMq6Cjs(-BD$BqD~%87PUamZbFeb?jKnq31$0E%ZH3}=<L#}cnbR|y^4
zGOOj!*rZ%<wJd&kB{3=c(?Rc=>D^MUMqk<AHa!~?#jIFQW0HGD31Gjne`;%q9c2~a
zar7smv;1C`90i%k$?q2T0yT8N{2G#asJ?E8X#T|~n3q~j6(jcc6-l-L;g!y_-g&ku
zzG5wo7X$=NM@(6&yO|TaPD(LzOmrMAqtJDjWCK-X$WOdt4MB+qs4|P+3->N)Jq+7@
z=!$F}UT>mJAuhUHjxxKe!f-0gy$6Ov;4$48zyp-$B`NL(gDaXKGI!<r?Hylf3!Bmx
zgoAroGIM%;k9cBpASy3cw6rbnP+SS2gYC_L06WOmd?LtJLKuN^c=FkW%(R8Ys8(R+
zMoNE{^;U{HMy%33S9xluXQxe(qIv?EBxsibd+b0b%e1R^;rR<|B$0VsL@wE~WaCyc
z{9;(^&}Z-cWDG?gEdR)e`wO|J0K<2-x=k;h|M<1Zm2C3cSwP*c^+Pfvqma|dtyK1_
zCqt^yv+XMxy}Q=n^rkTk`-fHlN4@!akGupe*1;4+p(8g+;&o}3WJ+ud1od-Lo4clj
ztsErxVIT6J`$oM2Zhk}nu#f{v3_6(i797ogT2pQ92+Cjgh4k3jwtAq~UR{FhnAWZg
z{Dm|@d$CL?6(Y9pBd;8mdvN82!mF?HYCn1xz4-WyE(nU}oVF`g^%pV~KlPq{-Mtsf
z5;+ECr~ykjM#!(G^(^oiV98<G&l1N4Z;m;yY1N_Ynzq~bSS;3+mWCL$8B2VQiiLmB
zSOELw;<=d>#@;XNHW~PYXm#(As;cnk<@w}KBlc!_yQ){`*XD)mb2pwcy<LsIMTiRt
zDmo1`5!e&4Em8@t)jxDvVts!tF*+GXlx!(7ok<(cluGT}<$gE*zAu*XTqQjZUX-1L
z?JYiwoF|l`g<u{&q1`(1c`Nz>pL*dLeQ;O7+eSg#yh8<AHfwgmkc*5wJ4L4e3?7jN
zZCTG=fzl~_nMv5~;8IW3dD7f4ZyYKS3YUn7>T|r{C_Na)83elwbz^h@F%pIR7%(9e
zr{=Q{Fr4+8aW){aeir*xkg_nn8-h2@(z*}1FRFT@$DoI#2{Q5$iW{&!>~!Au{z7bl
zxYx*df{>8N4S_t%j&?q}()4>fpWGCV?EIvo_njDf*>U&g2bMS_0r-j^qt_C9hn-{|
zIVY{WYE5U!K3;Z=<$b&2ufZ{a)xemLW&@YwY6BUh?i~P46e3`w9&Su`==!brXpnKZ
z=?T+~d^rKcW21*#8Cd0u#yFKryN)=`J~&(C1o+Ou%x<5bdQMZYBHlp6Q?P0)zqP3d
z$F6H_oGfJNE1sJ7JJe@T_IB#7y2jV4qC5h6UZwZOG|CDZ(+TyasS)?1YbBdz)N9nm
zDC!;4psgJ7X=yq}JAv`@eAGo#iGYaMevqqS*Yg*`h=Mi%OJNa``w8l|eO4#?OWhm`
z<`laQ#A3u#Kdr8Ko?{C=OQ%kRg7>D0o;}X%U?v$YXY_}MQ_%cUP1WBwo9kx3-v}NG
z=Afl0bYu>=`e{a)tE{|Uy(rkW)PqjMvZL=qqmGX9MW$=sQf0sW$~fySc>VPKR*Jl}
z+T_*D6?yX3N(LThwk-J1cU%>pHwfnkmio^Ef&JjbH(GwaU$gq5@gw#?vgJYQ3D@U+
zYp<Wh=3Hge(n}2_DRr~syzc<6_~PW$#WN(n^qNL?L1fHN>yJ$`Up>huY?yd9P(xN$
z1tY00+z*o1JLdpbiXCXXK1}fTJA=}g+G{Gj><BvC_s30f;7mldip*BhjFh!3%jykx
zV<LTzixlp|=QhaECW#4o{i0w!u{?__6yarXY3wVgYh7$g!o>Y5<^v+FH417Rdcz*B
z-fgsg6)X{=rI-9eZUZ)VN)kTjhrfBFx?U;%*Vpb3=YBKK=*^5bv6M!-AWixW*rpH1
zz~I+24h&Z#o&OB>Iixk!ynNj2cphgWz4z($7-a3LR#$(780kcBUo+wiNRwHLU6kk~
zv2=3Izm<LwGO5_&GVQS;o@92zDpA69ZFMG^Dh6PQuK4K^61xfTY@4^lpYZV}GIsN)
z6Bn~7k7-cSfJ)5(x-cBxuapeZ{(1}qfk2{dfD%nyuK!d|4>3hVR^{f_T4v0%WtDU1
zI0IWU^M8NV!|#-Z$^G^V-<<i_25sEXdT27UDKnl`o<D6CZs3dv_o&hKLx;6H<FZj|
zq@pIuC6pN=@$sqSy#nIT-iz`Y)A%CxU4?5wcF#V)N+Zpm;PM<&niLNS^Ggu)OTu~v
z5}=8X|3XrNKhj^$u=-FpUac11{Qg$V_vnpl<J1XVt{DF1vml$)q|4zBqQRtJ7ao@>
zP)d|e7q^=z&q<A+v5Di6N}Bz}$IqhccTQ#?<N!pAz%6|^*|lYc#)U$J7m9&$Sp^@Z
zj&>TxP95iTv&3seOZ3LDE&IoW6dBftE5+GGAT+%<{c^yZK{dTu1Xo@E!RerP&feL1
z^k5^T>HF{M3Lo3%qZ=9I)DPcKbjz6dd=S`3Yf>=yb~qBQ0Ke^+?Gq@8$y9dFz0$RF
zMr+`zzmrM#0N@zBat>VMy{$=QRE>ky_pRU3R-K(~9E^BjPcma?^9fjwC1JqNhKTKf
zCboQqGek=#Dfm5bEC^AlX_;G>=#b?<&>mFZMzeM5q8Le-<h#VBs0!<9Clj$tZ9&s>
zrZeHO;(f_l0^NGkna}jwkMhhB5p7=nc4bNSR~$+-{zAe&6Y^wHqtwOi`Qa+@4fcdK
zr9{0j5MpuGnC_I`UKDNr+H`C?F>Ux3T4%^wKPVB7&z8N#cP=&kA_MDVyQrWH4k{9W
z;W0^~5+vL9S6fSS6N9pzcJZHt;^WOAFIKE##-g(>Dt~4Axj(nRY|^uz_#Rm4E7JW6
zYdmB|^LmAlUbufS{Va1nn1MU<o=fZO+SBZp?hw~~v!HEOx!(HC$4-qQxgpJ8gfI3)
zi>L9Nwz*;nfdoNrcHv*XDbuf6*si5reQ8s4v&8w<#iNazH>h>j<Z?$ZRJBS6E$n)G
zG`WLoW&K!e@R%Tyxfj9RVZ2hzv54rH?8vS6QX~h2adm*28t$@}Q&WE;{Ov}tb@^t{
zon3rR=C#6^4pDY$ggL@$CdBFF+wLRt0|UD>f6gM$#8{kamV@N|(w#=x#Ri3!dlf8o
zbtgl#)DQS}_y`y-<Rsahc$BDzc(>r~@bX9}W;i%Z4zBvn$@Cp_t3;e7<QLE3KxG75
zUb)j&sO%U|smk@O5_wy7`AdwIp!Ai;aoV9$ykJ6CjUx03@8iOZ_-bE_SiJrnX&kjz
z)m-e}lS-jd-G~phw1iK=dK=_d#F>N+7s}<xF=t_t^9#RfPrLl|4^mC-Np3Nh^1a*k
z)4FYYAy-W-StC4GSiSbUoY}&`3UA=vb|1VVQ7rb_q~7y&j}iI1SEZ0E%z}k|yil2y
z_n7A(9YDY}ft-K*ay6&t{FVdRJ{<z?v+oyviQpj_5srGtVhx02`>~wr)@7b{d>1^0
zNBsPQ+dO#|>>e}*U}aMSTZ99`xDBF^Gdtk~I5SX%uWhJ8+KTw%cu8#KEoZl9&iIG2
z&OT7RS|g;A`0VBR*g^FT1g{<xZ^1|&1w;s}Tqce0rw+f7<dzl;nM~B@jlF%(e%_)B
zXisP6N_`oOxp*97phuN8XSKsyd#flV>zNS>1O7tbjT&~zQq9?_Rlf(I7gU8G&W75q
z@DHE(*uHXS-0UB}<jj&P6%#^Q*ICmqO)XZqs<&-WFB`}0c^{2WD^?wTii^{lxmUY&
zt?1me1f(G$RW{a^=EL%eu9MDMdpOOrjqe=PpH|K~8J>KrHFT0wP9-B}hP-<GoS#8d
zSwhr=YQB#J`Xe}&GlT$lf@b_fs_XLhSj(m+{<CVBAMbIhRi_!xZI@^1moT|A-H2xL
zcssc8vj0r?e+3%qK8Vm?W>ym1q;b_X0!g7R5g2gq_@(?3c{<fRtLV;6z0?nP=ySET
z)o(1EOn<kTjQjlQ(PfR(hy9TTD5>#I%`I&GlcmOrco67Jp>ckZRChAmX%fmrmwoRo
zzjIwsIzHIV(k0{F``=Y$rhS^e)L)1{HYZXB#R*W#9U=$$U=1@dK?;a|D90f(xJF%V
zTlY-rqrw~OkLoP~@Ge(4%sQG0jHJ8w6GY;~e+kp3ojE5#RRnedD3QMaRtUo4ar&B<
zC(qtlblT#q*uNWXW_eTdq+0qdx>V}tccGDdk>mcr%D@bond-TGY~5v`96v(2#>{Hk
zf8N>NcXnbP&a7fE&=uSz3y<_Cu@CG=SyPq4s(8IcWZS&uH`E2<gl-C)%OF8wGtk5D
z_2r{XA=LHr=@0Jhl#0AIgenhKM~?YN4mqC(#vZ(*f<h#Qgbc1torp>1?YTqyT?L=D
zS&Yy}+Ba6IWt&@~w>D0B9#oy0OYx)Jp!$FgP30fIviD|inw3e%@dguzvf)3o(9Q3_
z?}FdYkR3Tnby(@@hTr2q+XR!rU1mHYMo*Uj=l;=_;=L%VLH-k(;NxnZb~F6<3Y*X6
zlHcKPMkOLB-0A#Tuc(tG*q{!3SH}DerQ{{f>HQnT$kyeIoy1_%>OIApi9fm|?Ks+)
zaB5ARAykRPHYd(b9-0Ws5Xp%73lZ%TEN>z%ndN)e+;BSgeSUF%^G{8O->Cz6Lq+jh
zU7lLD^h}qAyS-=G%fQ0B@l0T8&<@Is^1-uOcZpt1AER7d9I;k5&C3mMR?Gc)`E#x7
zLq_M*V*=fS7YO^fZHupwQUK`O5szZ8MYi<+Ie{}1DSw&C{ULc>BXix;sViP4@=Az*
z*2Fm*mk$}|kBdu=pX!;Aif?=~VBIPbBbg-qs$#BioS!@N+*LUDOt!=Kh;mEqg^-Qm
z+KorXkEOeXB*BsGJ$}8vmayUI$0QNJK~?YzxkLZsT5V(u$S;8PLz^X+;(e$}6)inj
z&O4z0fM8?^D*vKmP-~Omo$?EPYo%S6x!ZK&zn4W?I?@|0Z|tVv_frine$~_V#<RK`
zPIfp|eBTljEqg0(&h|?Fn!?2Sk~)O^hi>V0;pG#mIi#CspkyrZN;LC%K)NqBMC;@*
z1B3TQMwCWFKWr!N`3t=o#=dUaO^r3N<v(tPIWZewmv|#3HYZRhz;Ahp4~gjeV;bw^
z@hid>x4x*LWck4x^}dkTT0T=odhI^+;t<9j*rr@T`YlV)xMKSR4N9tEDVU<3X?+d#
zd_VnL+*Se)<R?^RWe@~C5H=@_;ljz!0qHPO171&K@m%ISek0kp*lD0RBE>jeDlQ$B
zYM#WfwBUCr9O#@xDjuM515GQ~x$Hq_h7UfDhMgpvd80=@>j_ee8fi)CL1ugpGoNb8
zY-SFy3b!+DbfV55my`gRD+_*jza%R39g?sAv3}{}<T)=lX^L?wrp_(h)c)Di?<&6-
zqa0b&nH`Vos|js0!LXAkT@rh02Nds^RC8#7hMO9{)359AZZ;EfUUTVQ9D?vma9*@9
zA9C{pWP(&=9;8y$lQg5dV7M0jKkgq<JjAMAL_;We&awq#f_W~O_tAJr=?TH1C&@%7
z?+Xtq=k*dkwKkex{Mr~OCK9c;w;yfH+Av|DMw<{d`1%*(CBj80?nR$<0%3j@wPNNU
zIC5oqzg&T1nw(W@F3!6wHhTT4gvoIC%~vf<J)IS8BpMb?K?3f*Iyc(=m7X*yK@`iI
z{XZ|c=6fpcUH%>xhP(aBQb?eS2ai6b$4sQ5ah@F__!_}I(03lw6Rzb_KQ(Qn)zJCz
z1x}zZ?zzUCsjQjYWK&qe&c<ux%;n=IKD=g1zMm?HFhAMv&~}duaE{RTm29mqkZ^qz
zv&OgN8@{aZB%?vyZ{GR_Vi$83P{nT~qMViytZ+5KjKp7{EU}En2G_^x0G;7L;oG`}
zm-tWCUOhw3V5UY86H;grII8aWo7@LeRBdlU8qDgH!AO{EpjZaS&kmKd%qJM=*&V1w
zfX%DOFEAz)Gbq|kE|}7T<KaRcstb-zv*7++&K=EVx_E2ae=Zi3CqBz)@jbg+>SF>q
zZu|k@iC2p0Q~=JDEX~hv>xle?#L6q|h1RS!8k}!7x-Ye8|K#adQ*)iJ>G=fiGsSO;
zw1B}^NV)#V6U6A|yjvfE*a-E)0*87PW04LiPhSbicvr(lkydRN#Iq$vYAA7}Ul5VF
zPt%H=5Cq2uW#~s>y}77MM=)u;)sXz~vaQrG{aeNg;UJ9daXyNXU?E2?X$EX+B#s27
zyA*_OwoLj-uYMN^SaaspPxy0zN#`%5>W`fOMKKbb3JnQ8pr&O>50+2Zu(p_cTayl9
z+S*}oC7U(jb2{T4VNuooGmdv#$untak75QY9kHcXpYwEZaiS&A$>CnQXy1l#Ms$R1
zebsHR7jRz95gHWm`4Tr=+rIo4vdiU4QtfY>>Gk78x?2%pX=*Z@2TpR<2McBO&*B^t
zC6iuAT<Vhxk~Q7Z#ykT7Q>BzhmIe}bXN;6_rKR{L@g2fT^Q}US<WJlFUu3(Njt@EM
z`~*~0c86|B3)_x?!1h^BY$JL%{2kREcpy2|$pn&4V%Zax?7}^3UVoTU^cD3NJ|AS_
zDrlCw>?5n%D<+F$`%_r^niAx}VN{K5zf5FLR3A$ag|>&A?{nh@+2^?Xx*z1r*!R_U
z3&7N(*cdK}pQQYS^g}a>=m0w+t(U-CA@K*)Ss@cQHQG>-5sPL1NY#_J<5{il!Uvb=
zD@W<5<3y7IEGt#|I7`onA_oj!!)6d_QgsI67-B%p>*2TXN(<$dTmfF#h1dRCVkv2#
zS}j8rBN_-T(H#izKv#Nab4A4HTH6dB&<?Dyz~FEd#gB3cee)IpnHilv!;6pUQde1?
zYQ2_<uqR?x;3*wp1W&5c3VXcHezY4!Xvy);(sQZCe3{jBjnon5!fYDJaYXLONSHL%
zg=nzbb*u!}dB)&MuOem=G&QK0ed|y5_TwpCQD*+4<@ZdJL!z#NDh+WxZ!&X57?-fj
zXpkEmixs58HRB@ry+U=qlbhiY{#tdd&CSugrYpA>%@bFSw_m8ddqqq)<KG~_V?%D5
z{DqvH2dd6QmDX=As!E1D{XC%Er8Qu-d@pW2K4OMcOju}%0#6tI5s7#Cdf&dkJbk7u
zynap8@yUs)`oEB%q0P+A+lYF*XaZ4b=lAlqou~9vaFyD0u)z9Qp+5Po!8hGcaLFUH
z7`UDtBLR_+pU|%~dmqVoBXOkC%bBB*qUOYschOMz>)@Eh#MP?Z{9j9R-UDRN?Z+KU
zhm4=FR!b?x;qL6=r}svcPvQq%*TuAc^}`Jh^|A@@zCwcyat7eJjO76keK@uEUNdz+
z+Me-gkT!Kvv91bA#e$z6WT_$A1Q>+!|46UEd!1AXAc}zHqH2A6s^+lv?ES#PO0m%E
zr{Sg1j>N%hRN(jx)^k7l2;0csO{wxbJ4B@F%{2MfzMsU9JPT}Fpa=VurNuOC+tT(?
z7^Wi_nqCBf$K>Y?`UqK4+~a-Z6_wr;zR99j%5J@UdgJzY)gcX;yDFxK<<mW_y|h6n
zR}(y?xFI7Jg}{885&Y1s5nA7AKCEBx{CYZE^1F;1Y*DJC#F-fSgsMylN77pn7t=h;
z7QBlDNh05<&0kC5p^w~}rR-l^Qe3V3T_BzPB^3L9ELz<!0gMmqv1$upf*|82-r`0u
zx`Xvs{QZTZQ2se{`XPzfiT54;YAUn^G_$RyoiYILGmJX7{Cm1XIH;tGEdkd=bdPVU
z5i&gf5Gm#i`j7nyZvT->s?Jj>mATVjarX7g=$9w_XCO0+Hbk~;JSgKnNX7xNWymUv
zSeu5Ft1X2tt%m32--zfN#rbMN`rN<HT!qeu>vRsxtZj$;whP?46;THB3l9uxB1eqX
zqw)8tU~GF`aqTap>jw;ILjd+LHtY}22`o{Eou=4223R2&!0N8+;00b7v4qBL*NyqZ
zrG}xN%Am?^VA6NlKmLVe?jNijZycFWM>A-=@LtRx!5|Ek4J^%1Dfy4zYXkpj0sF5O
z;Q!H{Os8(6!Ef}_fdA20%76TG8R)>8P28r%7s`Pp^RNCw2-`2gOFTqB+LJHfB|5MI
zi3x@`Mu9Q^wdy~QbQ_#wDJ$(p`{-5SR&>}g$jDSJ`ERZK_-|MKZ`ytH-&)!HZ^OIs
zPwznZ?0@wx<DUV>{(F4i0DE64OTQTv5sT;`^k=YR|M`Mo|9Rp6Z1UFspCj;pF|yWF
z@FW_1gWmt!8&vw&r26+X7#jw?Y(Ou{*iKa>c)W9BdbK|6u;9qvr<9eORPaJTQ|XKF
z+rX#%Dn(6Xcu&T><F%=2Rw$vce)A}``_yrLaYOSp*%xPXWy0J-7(M8tRHI4o<POFf
z@4pa!Jv%&%?#F~vL4-4n-)GnL_xU76kz2y3x5*Fz35f2@43q`t@)vTbgX#A%8pk$N
z7yQaaMcz~X^_W^LR^(NudRxDCADw`PO<I$k&&S^&zW=k`*lJTl+AUwIO^8L&Ppf@F
z)0mD)4G!bJHxCAWc5B=;QgaW`Q4?f44ch>TyhC;?nma%7U$}Y@L_2g^kqB`i|F-9}
zGgISjmyEr)9zjz20cP@`XHAxw-ptOI$Qkp3oWT9*dBhM^5Tm5JI$w6w@*Gsqv327H
z*)b?hQWg0FDKxHA)tI7-VgUR#`<6rpD{3p>UY#L%=IR7jy%e|5d)HO>sSqpETgzXE
zlLA;NPRNwOCEh0J+|L!e-gZnpg5#kY{++ScQKpwhXmdexLwDd=8|jyELJ4e|4^G!I
zt_<$XQ4D_+H*#Z}5Ie=Sp2|Rh^~B1=;YThf6N>0-79qX*tg9;gi7WgH0zxVhy()$K
zQRrsAbd&|@32hYG7~0!vAdE7}9p10LuE`u);q~+~|Ik;{*7>OFOYG-<-{G?rGG!DX
zzyX;LlOS5KzpNS8$-m`%fdr!dra=o(i}!6T!8RU?W_#tCug|!%(AkA^DJ?O^u^34n
zcNkotN|6j=%V;x*lY5;4$nd_<^V3U+rf)unDg08AR*I3MA2L$2P+w+GJ`uZ}u1dZ%
z5v2VWvixeP$+^{EP{euEM`v+vNN9R-CH&4Q{Ywhm+J{{jP%J7Y*E3(SjKW2|rZXX~
zQ1<a9Q5ACSj^xgX^A!!ey2vg5^e0~#>u3{*Mocu?4ROM71<Gse|IT?U?}BUTrY)01
z$CRHWRKgNd5#k$l7h<2|xSHliUOFx}5cp9?y$Z}zRJTM$i1ca}foRtn+!kLm@4;EU
zxt$4h|J2mqMV8jRXT4W3X)S0z(2r>8{U^X-=6WYdntJ~0;%qlYuc|_$x>;l5n%hMh
zQDx_HT-YLCQ$#Ug8wOlJq@gZU1E4CzV9#*SZpbIXz*^+DDv__>2gbF!hbYyLlOcaf
z28$c9J@5qV2^hXaJ>u4PK*L)ueBRzC4>fad-!GF}x$frufG(eV?O}?y<TyyqHI!i5
zR3w!66u@F4N7~Ygd*hxsjRXaM5VDFN6UtvVS7y&o=2{mUzeF$Dwccq5v=Chf5vQ>3
z&^bGD1TZX_vsQ-fYezP5dCGlvXlm+Toft^HZ#u#*ORzM&15rkNJet;UD9jlssB|0*
z^$Zp2RZ~5erS1BZ=YG&#Be@fXC-0`SLi`cTk&;Ne6~5jt^n}nDckeW=KHJLRhokKh
zmUArWty;+M-2PegC+PIO!~2V5!E`seL-`#r(jQt`;enHEY{|=0aldbQxoja_<p$&j
zo%E}d-wNq_ag1?61rhW;e|(xV%5V&4adSPnWD>)@&zxF4@79u}>9fqX5k*TxTjpJd
zG4chHgXfC_UrgiM+F4Fzx{kE=5Ea=I`akHUFCBk?d7x9slSmBN|M;akI}cJy+sWt9
z$IhW?JfEgDDp0drc;?(oe9o%y*-LkCh5PLsQe42mFR~8G_103Q-y$`^$0CFULz%rE
z@}h#S#ss{RNJ}zSv<k_yj;XF*x`tAp2ohn$&&2(LGhfa0m=<(;#_P?`6tk#h<BDVC
z$DNAwLtSfbnLsbspwB2a@=xp5_;t6%Y|#*(oKKf@9ynhQ)?K-Bl58Uq2SH(8Q$3GM
z|DmfT011P!<cNIAz&KJ;0gdM~INxB`(4fh?vD*XmuW6Xgt({_}^aMtEA5|E3Of`wH
z-<VQQp)d2|v;8{a?{?olt#LHEG~u%)4_R661B>u|yLAkR7_BML^g-m?lbx13Yqxa@
zf`si#gN6#$<OhIp71fax+%Yqa3pZxr&0Vwgt|~}4!+q^eREf5mZ^)ZEx<sZ(5g>=+
z9ytp=)5+}sQjgUD@i)E81sU}t3e`G4M=Bk<k+&}Yte^kwCESMjR9bbB<xS`CafJah
z)!?{1QfLc7hjOfzDtPOaS$3S6e8qbtOrdzS%~T*dOWn0@5E3ufYIZX65p4`6fb~Gn
z!B?<x*n4nXkRf4-6`904->b9g9$qaT;P~22AWLCLTzN=uD2d-KRqB#K({UZz1C*0K
zgLZ2*kV0~G{TO@u<Bij0+KP2N2mbf|6=kDD`zv_?XQX9cpJ4rTW_cHrg<dXD0qLl0
zpu?J6ZyU6SS!j$NS#^{4t&PNj+c|qDBJ0l;GsVdM_@~d84VxZ!j!&xpC??)6=6Bv)
zYN$x)6!sJd2Tx++r)LM)^oA5{%H<A!Qd8|V^LocvHlb`N4m=`0SM_SuD^J^L4bmzD
z^5OaP6I&lmp^7)O<W;9E8ArimRrGEI2qHw&&VQxxBF!&<Ac4C#I8P4k6LBFmhR<X6
z{m(u32M=O6>e2~kda|RU3sJ7Ui004%1QTu2nftf^=24uW6A~M~QsCFPnTOLTovFKW
zy1?r?MsQCTfB#-t2=URUK=9@-fBbd@NMq#B0EILL7GB`z^$|u>W#hJJF2@BYGjA8Q
zgMQ!U%u6;l6GG}H?mMRR>t4r9fD%Q_{51*;zi~e)m#AP?7gs=X`!vXVvD#`Dx2cgG
zmgyTaF7muw^oog?wfu%>_Buq=iWEp=GACf;I~B*(Rf+j~^LX3WnBiB@vs*{7xg$-L
z`Oc9SK0Ei}>gS)ti>*P-8Y`8XFHZwlP;^)jc#Vg#nUf0e72Q>7=;e<&TlOtUn0?z}
z%#qnzSaWl`!~N(|A=ek<IZ2Q>X`b~Z;!On&_VlHuj2#k1VOWg9vvc6}IA8qiz{L99
zbVK3z+X~Y2d*617i8fenWGFb+JMPjw$FiquN=Z(8pbl^DMHwNNx_sRZW5IMz^_E-9
zcYUqCTQdHb=`9xdQOvDJhhIuu6jBVra(R+*Y44x9Ov^p*ORm-KReaQ2$IxL-o&aLO
zybnvh1sbPwXAc*N@UBlR{ETVQiQ;{9@rd(!sU3o%hGe$_T)?6c9ROWjk@xn;W1hGs
z96Dgl#aac-l<&*Kn5f6#*S-%~|A#%QhzqcLvv#N?icH6yN`xN1$CYR!C^VuaV=KD*
zA`J@W)pQgA<hd_=Ibj5N6L?a1)H$ab#tO`r+WeurlMzL|-~xu)E-;@lD7sWnTrBXc
zxbm1?c9bU$-g3r?HNC9D%fGSBXUfha!PBGgKIE`l7OqCuivm%J64X5+LltqQPxDXu
zi}Gz|LAXX<&~)fkwM?fH&e}&=r{>Nt$6s|>5+|{f69ENc%QBkEEkwRYZ0X5h#UcGH
zJk=&8LOvN?-+Zf+Bo!jLmMzQ|a65`l>jd_dEcN<v%Me&b@htN59gv1=&VH<|4~d+!
zgAtb4jKD1^vlor~!^if?d(#TijowvfaJU0H9c~pvm7l^%FG~Vr=(;x@v&T+VEBObW
z@8@<6)P4F6JU%aiyxmoj-(Tj_P#p|pzR#EzTRF&>nRy91#!lrfAwLAvDf$3<IlUOf
zg2p{tG<6mxoDr?6h$ZN+5T)Qpzr$`2Zl4ILl)h_eiuqB5<pK%7PncoRzqP<)t;3~*
zX3V?}<l65P^W#!J>*JcHjJf+r<Umj{3np<CL+(h@gtNfhDVooeY3(6@A!@${76S~5
zFrV3(K-P{U)fLnn8dW-0Y<R`Cw4%BDyOb&dY*(XB6?Dze#AaM4<!c*nH_mm;7dq1p
zzuA5{ci_+YCO7o?(CjUkm=<Hg6xI)(iaw2k<A-2gOVOcFHa$r~L0^6Bo#yG9rrQdV
z&rnqX@5{e+jc7PQ?={F8OvpjazBVo(XiUFrmX<Epe|dw_Hy^RRdnVm2pZVTMQNl>!
zjCh^+$4~^(W?RS+JDWGa$Mq^q9;24@M#9~@;Kx0Q@SPB78YD7(=JQfh#jX(FP8~5B
zk;3(Zu`kmI?ddlCW_#zkW4Y}8pL&&@dj@->5ys)gG4A=>-EFMjdiip_ne9UK&DE}%
zQ7s}v(A`e3)z6216y{CzAGNOx&(O_zpv^sW*Fg5T07O&@_Jsh3MSISF3b^f>$Cs>4
z3%t$TeRKo_RSaiWBKP8qPL%uriz3LC#JpV?{)_X5#RNuAnSf@#lcErMdFrZSBPII-
z<OW}WvI$*s)q~qAmHe0xA_FKpY;cmeo`8Qop&$;QtWnsRzR1J7C}VSvi4o#M&-1&5
z7>{F>qcMFXy&Jil=33uL431lTRY!aS6tF&t9$3HXCfzD=D1A;eV+A{JLeQupCG;(w
z#JaIRX`otu>)=@%to7pZdgSR4QP>wn;E?D_cw}_p)YCmXrfTl|ZL~XVp7ACC7DV?!
z>1YZ_rfqyiAC?VQ^K-LdVKCe;*yCDd?joLt{%+e#nFq1~wX;5*`eigwXsl6ba4FGQ
z1w=Ys{pgUvdN92A(ZoL0j!;>VK7DY&#?;UHoa>_1r>r|W59Gzaa|0PqN`QTEn{>(q
zcw7wiqiTl|%!^Mszcmmrf4&>{)O#S!jSr!n{e>;?YwglC$k7-ly4!f5faE=hrt453
z4&EfeGf>*^jLLuf@rnED`mXBg0X$eO?X<bpU8eTg7m<LT%sm06T|5bn*GvKhbwM==
z>0shW@1l4sZ}Xqy+A6>5+uf=MNrB|xKGgl}b>A)tF{VEM;(CVc*JEI}7>?f^jwF8F
zA_sa-lSeNtHXjM$mM?74dAuI0Jr%w|<!-n>9;`H5Ot6~H6!1~l*@%9A;wE0{E(eeP
z^Sb##%f29~D1$6uj#SZwhC~W_E%6wLEi`qem7S;7L4Mvb7n|q4D0TI>glm)vM8HkV
zP#hn643<QBpYBln3*lKk&J7kLQjN$MT}r@ruQ!wX5wA9B@Zz*$Ws8?=p}W7U*2m_Z
zR|eX~c3xA&?Za$m_;i|I;{yZP-hhc^FvDav=qZ6!PHZq+cP(rkR40c`qn9iCLyB3c
z^5;kyO<TY#cDpIGH{zr-?bG9mT}R@<1f1hXvrbUUrmIBEXaEtGr_fQ;Y{gY_LWpT4
zwRY`XF+Jc%38dZvNEjfPb_&JaPGXF8%eF|lLpn83#?w@jI%CGQ*#A&6jdi^K=jo6;
zy!X$YJIS^D$8YC|1SdZNmkCtlR~iTK`Z!xSe{$>bmzRQi6JLD%c&5&ZU+H}4VPo^=
zw_TC$dMEifzC*tpa3@~|%qlkh<(1+1ZMhkyi!3w4<jUKW#;iK&RyDdqCx!oVxwJfC
zx5`fCt)f}D_bidMXF*0*yA@{U4;4f{|4;6j8r>gI_yPPU6TF!@V9EG*8YB+?i@)~2
zR762$C;R`m{N{g=g#RVhdF{U#pXt9qn=z0(`46S+FXaE=l>Hg$7d=T#NK*{*#`1VR
z+6n+3ll8B5eP(73|IoSmNi}Wcn;9cx<`-1Kf3ndiksq(G9OM6hIIo#WaW4AQW9*kW
zV}C!^DNcv)Z$`L3S&hfr<iwvA|8Ty%6eItO&Aq#ml{nbD&pL-R>dr?!woR*Ga16iQ
zu+~@GKV)gv^}R28{uQCk3v^N|;6gvY<x4NHA3LwM1+s9T7`p{q3XncT4-X1|B@N0x
z%Q31PFk(s9ubi@^yKcIYT9<Y?Pg{$B_|V``QWAnhcNfPp6SFo3?O3Z=U1?l!E(DND
z@3$K9Y;pH^@XxU3&OEJQZ8Y)+=FyvEAxOEN|8NFKo6?4)E~l?7{=@yvPt1I4IwhMP
z#X<*IzXd7Jjw|r)zYxHYgj9s>qIa_K?3}lOCs6S*iplIsK1}@hez@lE)}^1W(4dVB
zuhR18thcU=_R~vbr>nrN4X?P_J~&x%*+g8=|3+Eq32R%e@fYKl+}9HMB`A|%^Z%1l
zoSXG8;-Fpy_-XW!XQ?m}D3X{;<-#k#uFj|%2e)-JKarS}&sf(A*<%if*q$OwzgXWD
zBBjl4h`#t$adZ3;=kvOOxEI_P0&}|t;FX7!7i8#aGlxzLz3w`<oO+-m7|d-+&#9JS
z;1KuST$ts4QN^~iGSPeafGUyEPilUrjs~uEm{kH#+?IwY%2VKqlt~%Ze71>QTR0wf
zo-w<z4B|59_(_9eH@Em-4-Jj7zpWTIhMa%*=E<cKZ@cKDAY~w<kpu_1f{Z5pKGt0h
zFTR1>BM|sIO*&QH-Z1o&_KkdpwqbBDEWF`}I7{2ac-h?Iw`4E_-@<A>sMcJ@@dDiN
zUEh@mQ0*Qp(*d<rsszREC3Dve|MNf<|HCxzzh*S|^c57NWtVVj>cNF6P`CG=znMJ#
zpI&^)ke`UezYqo*FV(rFz6mJAr$9M-D^x$WIrm9&s6{czvR{u<{e`*ozOG?n$EWd&
z4o^!{W13jJ1plq{i##?aujo(ISQ&T8eX22Fpo+Z*Vm152VP`yvKo9=K>Nnf7iZ2TF
znkE0NVxZR!y+95q_~ifmT<`?Da3M+9|3sb4B{MC0;iB?lQ0WEi9X+QO;bz@i%YR?|
z-;{TiSJLL}r<9FyB-|ON9$WwT7Xe+(s$H%v{{EVoa7@I7U;ogZZ+>M=L4w1{NR@_h
z8wjCHY10%ws@!}PrMUjLs5_3f;4WFdr1}{l=XN}Y`#o?`HJ|*zI4$HA6QfI41=xja
zV*X;5w@=UwYUy9~oU*#aYPxd$w-=wk#Imczp;RHL5NxN3FJ=S~-R~FYk#^T(uO(Qu
z=l{VgOx_y~4wx@{7Co@xdmD6r1$z@1sXz>kqlUfyg2xDWKJ^x~>Aia3@Vypz+1EW8
zP{hVhA3Mkc-U#X97daJnBbKO&XN=bijUegvE^<!(0#}nQKi%(JmOZ@dZmm9(e37N?
z0gFvrQ&x|d{?l1_j|mj)E<T7r{M&ul`~SsjnA_?L=r#N=Re^s7>tD(OkelEP{Rd8z
z1j90e^NTkge>8D7vLCR%_?T~=^x5?7gM3^018s<}n?x2|z0#ORIr-W!&joGW=EzI`
zpxe)es9+jervk3MS3K0gKn>D_!9#>K6_^Ni=XwJugCocqiM8SU_eU^pwDhqjz?#v$
zi1bKF(0onkP93-jebQlbl36oO&+P5@J~c{WJoDzLxiKeKYvT8)eOasK5*BbP2%|%T
zyja?#gWaw<#e$XZQgM%i)4+>Y9y$`3z%`+=pxp2m-|uE+4MA=O`1i#9{tLP4@ru10
zK}XdF4r^%(V73$5w?8+Dm{i;624J@)Ysx2s%bsqw)x?(x*QlxLiIrY8X-X@RWz-&#
z+5Ux2qtQp=U`@yWSpMK{0sm~~dX9AtbibJ2`0Ad!2Nq>}hcIa2uF6*mtj4xp%i=G2
z?}WWe6*+!+4ln}`@%H<HCh|8SLeq3{!1UGG%kma6pWCl=y8dpb?rhw175O<hd5eye
zvFk&TX&J;a0Jew(oknLC(oApo&>=hXmYk?dbJn>JEy0!{J?mPdHjbXgy0;%Vb|227
zm){xaf0Y2d{U0o&85MrP?st%k3%`8MPMr10a=hK5oPM*lTlvwATLX_q{-l9Wu{Oz-
ztWXCOQ)D)w4YehNdCEdyubEF^Igo7`+S=}PW44Z~)m^DBw!?)!TlnFL?Dux@-Z&VQ
zM|D7yt`*RHhXbVH5!a?RXCf72_Li?tA1LL?k9U>G>DER*h`S__b4yF^PmM7o4BiF4
zC=!YfFvn-ak-YK*=ZMFz;?1|q-E!C6TqWv7KKC(XK7Y5TYsZ|O{E-xn_lt|v0Bdsj
zda#0*-NvaVUel941HimkNxt6dne&;pS0v5~Ts6d)zKMd#qfUV=)eG!9`}lUmlTMa|
z?j>$Lr4l;t60iK1N4%QNWYZJ9BA>5)Vj3v%uu<&t?}$>~hBavJG?18k(A+2!iaBk<
z;9LVJs0QPluSvDq9IxNR87F5_Qk?MiNldSrznx<c2-w>_s^O+1ArcJefPM4h4yrZ9
zWI?@xdfovW>-zN-v$7`Qp<{vljUUa+QnQZh3p2uYxMx<EpkOJ&ac1OsDrn202cwu#
z<$!Y9Y0xiHt-H+7&mcEHtze$_MX9ZAzM{m>f)Jaw3pbf6IgngrO;Yg8pamZ}`S=Y@
z64r;{2JSJ&8aFmiicJJ9z`n5YCuXjCJ`a0RrEJT1D#gbM`*{2kls6K$RJWF~8?pR_
z(Kw?o3u)~@?B8~tU6O}-8m`OObF8p)Y<NBWv|Q<&P-aHtBAZXqM38fx7pZO}aOdCe
zm$>Z~wC!|_EavS~G1sERQ}#~v9VkvUVs>UEFsi*EbncfW<GOS*dbt=ZBhZ79Qu?uc
zFgK;t7Bn+-FiQ<LP<&h<`kH=ByfMp+Bg~S$aPBF$d|ZKRoURGDnP|uZ(}0Yqw&uE(
zU3bKk9-1WHSC`lX=iJ(DTfcp)^6ce;=SFN+H@ZIG_%?F(9pCmf8G0fc8iHIRW5Dz;
zpL(4H1MTzBJp!S`7`fX)3s>f9Ukf_f^Y1z@nhKgmr<<`Z?ib86=2Iv=VDwRJAiz=u
zO$K4OSOQBi_aRuev-~6XOvPZir(j?VziIQZMCbkJm=E{t)*<hGDqCIwViZ=uWLarI
z1Puz+QUeL*DPuf$?tI^x<_nnnn6v#|t)5*?;oUH$RZ=nTzIA5IwOq#CEzsn>f;@7Z
zF;A|pBR*KnBy14f6FZpS>XVC6&2LC_&j#-Br)HwMU#I1?2=jFF-!s91qxczgq(Hl$
zHsA%o@+aOB!bkJ|P8rgqg+UX>>$-z^!3&oIo~-Yhc`W`?JmN+@QDuqD>5OEF;|w%D
zU5|&r&IpDbN3dQzluUlrLPO6Qbg%iu-J5IJ<rC`M3-uN8Pd_9#anp?gEpQTV4ZaX=
zLCmeqXJ`ualL&eIBzFXv+i<bxn$O(RYurEI*T+tt$I8$o(B0|=Iw(7!qJ-*B!t6>*
zj-{aVd`1g``Qlt!c+n4@eK`#>`ldmk%rQqY>30JH0|JP{I>lYklt>-m)JjGyl#eEB
zO!#8b-&}9sUETl6s3Ic$!r2Q8-lw|l)0Z7}CqWx3Z&&iI<Ch!9&kY#tsX|R8B{Fr|
z+IciTsh%RU6e?~C8>en|;$c50*9X1+faem_RNx4#jaULUDdtO?noE3WkELDZSHH1$
z<Jr&jdh)bBuguK3JH;hG&$oWB?=IvLrUOhqw1HhBO}E`I70PQ(c*wy2rg1cuAybXz
z$zGU5d>D$*OTP{wWtmBJ#)2{w0LBPlT&aPPe}U|2kw??T#3Zjs77M0xl2Y5dDS>_$
z7I?p(oaaK#x2+^oZi4y~|8@Vzf8Xx|!*fni`SV%MUAI`8=Urd4e*RAwDEKD~*zWHR
zf}+gmM(LeN0y<6<qS1TjTiN6yd-FAy1m2maqm-9&nFnHn!bNi1k7ei?dvL)68TdkR
z({`MDT|-NZMTK0a%r{5IbQLYkC=8IRpuQ-t0VOUXl)#lN|5yj}0^Dc9=SHEp;^noa
z9^JIC4viMOkQOi;xrE%BH`wj8%97vPEc_n+l@WA<B4ViAfy;LB@-!ag2^a(QDslZ;
z%%t(Oy62vc(r&e@(|gGsQ&&6Xb4+^meNid{A2H-BAce++c+HOwWdXEcj0j`NSdQA8
z+m2J`EOLp}VRPO-Io4~H($Ze^ah6f%XK+>(xydg^zcQ}DU$GCvPokKQn?M#U2e8t+
z)R10)&kzRa`~UP0G(F(O1WJ}I7WxP92;9fHvb{@84r%aZ;(sWa+eqV#94c<i&7s^w
zhLTHw5zrX5k1x-`=GWskd$ml*SqrrQBcBH@T;=OAGM}>cx^m@jtmOKAO9lgmT^E`y
zQr{cfg5DJ&>5_wHetpsHH(>v!2HJKnc;46Xt#YX}k+WbKJMGDlx$EljDS9;Elg=@8
z1s%22oUw}zEdk`nIiO%Xnuxv8k^b}MWTU`ZJN8@tLUg)DW{T|9uycDiOXFpB`21#J
zjQ@OxIZ^IFJ1J5jqUkD76I}7VDYN-(3fJ8R#c`$QG~d4vUG3TDgDBFkZxGZ71y1{1
z#B*HQdFBr4T<dcW1&`??LH$)_2HI$Q<0+S*RG!}<ylKxk4wSnYPoiqvHK{zICd6HA
z?<|=6(QSo}8<SlKt$V)AJOkr;xql&wZuINYL$appszb21L6(f&fsrF<j$dQ56=2ym
z#24l2zmg%0EE@P-KGo#?;<`e_V<R<x0lk6bh0{Ih8-cs0hM?CX$2u9OI|ZoB;3Mz%
z#fw)Vy$vTDxBnmZ-ZG%czwa9c3u!^=m<k9=2@(nj0#YI(-JsGr=>cP?bPEV5HKZHq
zW;6&Q4U%J{djo_4W8Me;<NTlJb=^<Axu567^<qwcI}Z2TcEs=d{S@LxU+2oybe5*W
zt83-kTK;ciOk4l8DkT1IoL>-Tg}WpKa-Cm9w<=KJ6V^??{n@-hl8vpi;$BHa<Lx8R
zuZh3>V0eJ_`k4(3;QB%a7zX__bLNlHKVoUlHam-c_|r%V@R0eZOU&>3A>oZQ=rqCa
zKTNyKuE72y?>ibdf>l*K>lb(UU3H(4VrDDsV>OtvPQia^qc-OZ)O%PF*CM)ZO@8|M
z->UR9rCj`TY<IMbUHDG0G)03d_yY9dh^{(~%3?Q%$$H{^vb{pg+uKWu6cJh^1vNUN
zg00BVG*KBw!c9CC?z4AdeNH%^cUPdx&8YM4pG~1<k!69p_O`@fie0KMkeelhuW(9H
zL@=C`f2Yxk9Mat-PP=iu86j5JjJVNzS1S6pSQi7%V_q)}Hc@YtKTp0x0vnU23(Ri9
zf!&wvHIxoZ8YQ8RJwufIcw%m@1TM=T5|v68M=fkk-HA%f|6y-vnNybit%lxnh!fM>
zSlE3tNSD3iirr6Hr2#(@s4qI20s07+oo-*l`!F%c-KN-q#{98RTTe&6B~cAWp~Z-d
ztr-gh(K1I0bUm-;-Ac?`H|!6BAB5ge8RMvTiSSUqyin{V-df5Exz{Gc02A#*7khLo
z`J{T#hdOPWzp2&#LHqfK1r@FkSrt?_52R+`xd#P{MOoDJ<dZw<E%dG`2&)iB_uqW}
zJ(uVrx2F^tcGmN!t)b~bllv?@yPG@g`>Mjw>GXl0^{i)r(TKIDpDth!BgK!c9x$z`
z!-4>spS`*)_a|HSc<_1UCwJx8NMBZkfT8A1ki-t&ohj9pIev^@5CUZ}Z9>gtM{B?b
z|1sWo@HzzK@nCj>v8PlG$ff*6G$|>E^$p6#ESwNaDKN!2s->b;q%9(2+IV6@d+AA{
zJ{2LSs0mLHz+(1<8mMeC6zE=_6e5j^v*xzEFPVj^-_@QKL8G{LG;-O@nW`*GYO0$&
zyg6nGAe%Xf!F``_vk>;1(H&F%Gxxfk*)j|Q0y2o1ly^xfm}=aQ%BC9Xc}fjwmUNX?
z^uxA`W>q+oH)G8>ixPW|ln5+(2T-60-|*yH_@><jcRyKMaAtZZI7`?yE`MK`c6qt!
zq{UPU)7^m})5ndp9xCpsj-F?nDdad8p)nT!MJN941$H#zzBIKg>5!k*_#NRn9;`XY
zMS3>+^a4!hC(xehZa1+KIyA>Bg~ThR6NZw*PMofPy<6+8>2|G@!O_sq&Uq7&aPqTk
z&&x@=N`*^v+&*JBeES6coR)|)h1ggNs)BQi(7<bD^WMJh?@M$&8pr10L>l?VWQP5r
zZy|~oXgFq<SXrJX;UDq{bbF2S6GP#RN|U$&LmaD`t=vo@2E6<9WHX#MGj!!(xT^Tz
zGy5;10UqR%-@Q#0DW7?pBGjlQmOd$=hGOknzvtyB#b}ncG6x~!h&Pa)ezAdW!ue5w
zjIt5DO3uv8_g26ly2oTT`cXlN3iqJix8uYBr~>!9O3C|#bE}E2vd)l!?B;xjFOwv@
z2YswTv_;mfGej3XC|0C&F?#-uD%R-Po7*e%mjY3^&vlW>8vZ&}2}aMUg)=zGzV(d~
z$x2rRkLP}iZ*WUIVlO>z3OLY&SB|;*)<0yaP8;4?Og%P}-(2T8$S!@1%bchFQPVD#
zRNa78MLQMx<eAzh5QMSx;Y>-#XjO|c)sSp$BdhmqWHpMUwbUP2X?b_naft_P0H@9s
zjR4$)X#G}u3bzXKojAP!EkY!m8b(EVk8ri{YcbsL9)HSfBUP6@DPmO~{rE31_paAe
zu&N#$=pY-%k7em(whoZuF8b=8XNQ$am@dwV;*RC{RxZ0N5x58Fhm0{KhD*|7HxXOp
z7{>cO3`uKvg(RBeiC#a_7eUjHaTFLHIVndp-Mq(5lrsJe-9asDIJwqE=JMqg+orM7
zlRjJUu_w|fjfz7EV6BtQ<WD=ox`9QhPmTO4^%d9;3Hmr}p&G_b!vsX>8-y*@Ut{Rn
z+xnucap4YwAU$y(p95lx?D*Eog7}+F2dUfn>kQ)b9t4p(qlcooRY?ygs8eHlnTSJ^
zN!VW)&mZggL!V9Tn~@ME{HWcL*O0AQwuz=}V~(-w>k2{Vg?mb#_bl?<=g8mY9VW=&
zo&d`5RyG5v+wOE*i!?cfnX}XNy>N$eX$O9m9N8J|&)4@~@xreLw222EvYLyO@~$-|
z?rzt>p3GT&DAYBbo>R-ssEPFj49&d3A+Q?|qjq*K%wd42eU6$@r*Iz?{G8&hNYDjg
z<!6I(1=l$%Ug$*urew8%(Ls}{=Fm=+(I>Eo{iov6%$l;gl&Ozm!LcSGa-9i8GK$v&
zzf(ztAGl!w^s!RCGkhm1(WBgGt(jqHOGNVWlCk5cfVokmO1DEH4ZTmE)=(kKyi$iu
z0D%U}-CYP`weyg0Uw}mIqL%~~ANwRz^W4cOd~exKs@VCpZ~rLBBbs_RXNBy`huq7Z
zUlocM4<<L0j^6J*7)W>?s}bh`E;lXo^ou#Ls>AA`R)VE2!LPdeddz_+`mVVuc$2!t
zTLKLX4(*Gn$>n)`>Wmx41MSh#2uc{w`XRtenq9=$9SnxYS^C=Zr?yYWy%px{Z5T{(
zsRLxAW}m*M1D^B;b~xffNceNOJZ3gAgtM-`k%kZcDr(tEOz&CjB{hEmS<5@}(K|%2
zHVph-BU?Vy5)&O>+AIQR#sw<}?Hd?y=nEyxL7w!oY!<M*=&k+QrET71ACCIQPp0LP
z?D$}^aC*j(b2!{^+RV#9<n&dLtzp)JO;*!1exl&WX2*QX`w35JpmYFltF#C%(R5Hs
z0n;_1&=fn&Z`LtrXi~s_tH$2zV;6EWHl0AX<G!c9b^aF-$62fTgk|d&(SDNma+g^C
ztfyJh!#S2*CiDUmZ=vchBITI<DvrB4eBM;{-(fd!yd85wVVzPB7RYx<S+s7%6lI3V
z-}kMhT=tKwz2BW*!qI*v<-NX|G@DSGkJla-^-)#15Iflqb}0LvSs<i9L42@WpktA3
z$>4PC_h~@>yqtDZR$-^Ana40<E@Qm8IoB4z&KIcL!C_(u8;oKTIPXbe-PWO(r^YWL
z#QCilMaWlU_Kt~cy_PibLBOMj7F-RaI~sdal(P-t;3n210)y})TMDr(;|lY5YX=YB
zu;UdJI6z8v9(++B2kvCQncOK6SdBg$Dd~REedD#k_babSU#XkfwUdXW%qERA_ig)S
z53R3Eim_0uX#*`}Fc8b4B7h$nSsb-oG{$`@UT0^<IinFYYg8P~!<ES!4W5=1^fuSM
zuEa}SVNxO~hDM(V!iG%m;XYxeJBA>~`V(EuT*>RY+c%XH&|Q$3R^cwhZStGKVltBh
zhR5LxdiWRwyWfxV+JJSR0q<VWv@!ytw~53c4uUX?>U>jFaqgKLue-+=lt#JYg}qjK
zJ{G<mN$uVyJH2|nWw7|&2X4B7+t~~&R>S-8#p@$7;@_O<Zck{2A8H%f_pX^OA$s;b
z0oqBp&gmzB<TBT8@~*vua1YCHpf<Kv5x79}aA~Z*CbsX3qyAtDaf<tL({Xn@;GY;x
zl@G*gUn>H-2i)pSVh3ew^n*h6yPzK5UX?bLs;~u$OO#Nq17F&`1AZKXJz9ou?JBO_
zawWy1!!cQ-iFSuGLg3r>gL%DK!2gxu<R-+kOLr=`%^9_dSJu>@Ke@Q*GIPyR`h_;F
zkc@z9_miI$Ng{c2xfQtw>s!x+bv1_`JbV?qHHdB*O;u4!GqVEO7LV7vA4TJY0Mj^E
z6Pz<<d;!f~#VUOVJEPg{2#Rgr(i7YLXwm&4=>Betxif$h^+VV4@xHi`LK|Ms&yaU)
z{8h+MO^CUAtq%{EvPhR@B-OaFbQeq?-)+lOn%XFiN_~ZVian?UJGGfjZf|@YuINqh
zH;mmyeXuT_T;PQ(vK2OsRZ^14OlHpW!Gx59;?UHLvcCDgpQ|4`ijse|^b-vw5}cg5
z^njIOxk)tU#p<|ggmzu7y+~?Fwy5QFV&b#I2khpi*&@kRnLe|H>lxdpPQFL;)Z|d7
z5h?YHE0M5UQ;=kp$M03lsS?3<+nvgaw2G>f#r{#Jyem6oki>&zT(~Qi!vs?rwSPhm
zCWVCSjW~*IG~Hq1h-JBL)Tfs!)^lk_z#AKDKhaDFkvverAj45jI0c~Tf`{FVz0DDQ
zB8}y$wdwix_PKIL1Vx&J-go3h0;w!kRTI}Bki7t+u{rj^O_<cc)rWUDs;g?{Ur$H8
zX&bhD+j?gqYHSbZsp4Z-MXReZuANcea8j^gdUBMOsw3la#c{SN2l;GgS27=Ai(tdG
z&kwZwDz$p()`KGnTz25h%-$S(Rq^Ts<&qK|b%6p7fiRVp`;sB8n|OwW=x`8q^8;Jt
z#b(}(L0sEFC$rnclx{(Sv;OzEsl|RU-)ppRgQ7ffnqFKiLl|xa<wp*sX~xkN+l-q(
z#aO>{udb|pnGiM3yE-K#lC=m=4VO%bRe7jpGTx~28LD|&1_N=w1*ea1;+Znn^^ziI
zKjcf%_<r%yxDi9D+4&Biz7IB!lr9a<SLu!9%zq+k=}{G~wp-#jR!nEV0juGd8jToE
zIo+Qx_GR{Hs4=adR%P}EhXby8FsxZP3(7BS9s>%1-p*6aYIPC8xsw+wt|LQJ!Xq*s
zGom~qJ6@#KvVkIj*e_KSp$22tc6?A~@9cx-*R^MJg76RBs8^o%)O_12WD&@1%ev@>
zZrnRC#|8%wuFT-&aI#o(y($c$G#e6ja4fh*Iy~!CR4P_^uVXi!ib;=~ghOhVQt}{5
z{XE_jtJIQb)Pp4n5<T@;GP+PHE=2A*z;Pk6Z`516j}laJYN{QZ5m&LK=hxsUd74Au
zH$5?IkJQ_In325VXkzk<NO*Ww(!qNt3U&*Ur~))#nefs>-~~b(maU|aAAf_xBc}Kz
zl7{w*!E4{k1K!7m2q|}&063NOHQ0pAWk(p>s@U;0!^oV<L-I@WoHkoMa-LTQg*tr!
zz0nj$3;ShUJIe1Jb58>RaD;cRT9gaPG0zYqPA!syMt0e|tDxJS!I_s|o(6qqXo>|R
zV;fYO$B`D^UcM^5I=(sUCOZe_)!hw4sw$?$YXD&LmpQcNAYcxCji~a&*~tFys`{_m
z`K(I*(@*tWboTFrh2K%E{|Hn7fS%vEtbbYs1Nb+v*#`gt;^+GNFMqlTpM@^~Nell7
zUpV})L;subg^u44{U6~AfYGw_2hBm?ot~fjC*DM|umU(E0FgJPt!C4boj{DqCUU+H
z6yiaU9OAD`PBzLPzEuGk9s@1jd-P4{B?}3K(hgb7drFmGM3h_r*+UnIMRplNU^xAD
z+Yn}}>C`>cI9nOq9mFY1S|mVo<NyqVulcpB__gXFR%a@~crp<F3&1hpIlp_Jz^qOn
z1Def>OPPN2$^c>&2*L~lEG6)<I6r`EoddvoKHi@MpegwVkPXKHUFkvq%&J>O;%H@#
zUMk^567h6KgvdTcfcf?rXq=Os`T-clbs1C^Krb%<))!8O;)Dy)1byH>{y&rbpKtbm
z4uk(W!Tw)f4d@m@jCg9`I(PZB&TWSZ57?MuGF31nL45AXzOPoaqkd|{Tn{tylqJM?
zs0tekJ--S5cn<d5{t$pte)BE<3|bicPrlTj#`kAe=-=k|fFn5B9|rjU2sQr8EC1}p
z|9Jd28P{xB85BbxOrR5WBEwkKQ7sJ`<NxVa71`G6>TIVH>U1q1$>{WC(fad3*irX^
z{$CLdK=t&bbYtuI=e_8|;5E=G7dy-VPq+SyNQ~}NvCT0!q|$!tyun+iB2gaB>e|3A
zU1clHs4Q<fPTf@Yv8A-PZBSvHZx;RzhCLFqCtF|NIO4_w8*n&`CAGd%NE`B<&V@!<
zXF>AOcXiP@O^rwFUitW&IQ3$?tLsw(?<!SKHgW_-4w>C6%X?M|B`YmIp2X=zx0?lX
zKVrWoO*b4BQhtPP-@NPl0VoU~N~I=?`&C7pOgJi7Z@!#lD;4e#iOc8Zuk!Y02j*}K
zr<ZPb*PfZd-_1mV@FO7%J^idY$mS~}mk9?&?u95ycf+8!pY0Ak#E(mo9erGLlr1Y0
zAet)tiyRlxRu?j9y7Vqp<>lme@^V`1u^76nq)hvm)Br53JKxO{DlmfYL{|5EDglQU
z+wuI2K9K`*x-1@kuG-lZ6(SvWBbBC_@)y+$DU0JJF`rk{K-IB*vLjpj(_WUbo>5br
zfy}la8)NAn5qrKe__*5<>s9>3aNIqYpX=5yqEZ}Zo`ORF5SLKS^A}AA0}3*$$PJLb
z3Yjp&<_3zUy1{7%ygc1=X6yuSeGmZW7-XmNVakf?o)>cSUFD7CMdoEBzpy~sFw^Je
z{jg_FNOkn|%VuK!j@H*$t`;ttq!4JSw44Z<QdGKBUJNCfx4-Zuth>D)aO%<e>TXpw
zCHHO$?Qj&^b}m{#X~t7{J|!hh&HY1sMyW_q7ErBI6Tmwb63*T~R`5zF88Tc~hb>HC
zsHmz>^aYxH1G4>!LPG4TP9nzyT_<i@9y=aBUkIj#UaA<}PtHq`i$U@wjC)iUMJK$I
z)c@fXenT!#`vyz7Ys7IjT{f$B`h<4s=D|s5Djn}WxL{^i{VkHrp_u|NJ_4n5d@bno
zQdr%`jp1coLuz>6ElG;h0xD%4jj6_s7EncE@Rop-r88DtZb<6M)I{h`Rk29FQ%%s^
z)H;hB*&I~fJRu-KXC`;)C>oq+%bR;*M$@keo!g(C-e@8ynrUX+bWJI}iroH`vo7IQ
zulU)Pax4P-F{>s)6k;lTS0m=FX4Y$2#!lxsdYl%fz2$J&4n~Pdh|e&6LRLAh`@HqG
z?s~(JEcsT7kDi}`b32Wu(CdgKb$8$XrDyy(<9WbZut=2*ShB-NC-5evP)WqlO_dv%
zosgHKVDehIgtZHKPy7#~mRYInr}B!{N3@KKHd+>}gYyd7ef8#&PUXUQim4s}*NJmg
zKO+-zEuC}Lb+NNkCS5~n6b0-LH~@K;``_{`3whv|nTB{0uAKNX_wtkU+Q?Ll&xuy<
z!X-0z&mH+Zd#2|^WuKl=BFY&bw|5kaPFqElz!;&TjhLlU|7|>1mU{Y+x&)+pY};%R
zDkfaWX8!h4A?>CL8I^w8a)FK6W#Di$(+)Sp0M<Zi+!{3liLSOe)3U-&jFJ{nqA%aS
ze(goK`au_IQf$rcY293!&)&wM9`D;N&fpKdalx>vk(n*R*?xQ1PPuyMVv`qxeN_v2
zsH)(FW))WE>;k9+&bN5g!<2EnQ7C(zS?nW?BcBsrdcxF<V#5^$^3RXS5Ij?tNY00C
z+S<|I%J9_m^LqBduqs+=5JrRN!Ib3E*8uh&t4WHPL@(L;(^4J55|=LO^Tl)(36lam
zQ4`%56p|VTons?;S~c=4)0t~_VDhsv^d$6|MUu%IaLfSTR;;>~(KW5Y(0rLFwc|3m
z59XLcrsI;hZ2NiuDK0T+&--DLuTs3tVemPITF33RPH-7rC`#rWguBI~LLbNd=*!@X
z+84Xok(C~8ifl~yDw7T>;s-70`uaO`wt2O;HjmwIw}~%T=hC2&L2xR(59d|LbUU+E
z6Mx?HRivT9Yi$058-@y;=e*y%_8EVVG4p?CD-=oAa_h}><<NnCnZ>ln@(;(;q3JFy
zR%a7_ezS2qm%Kem{wnTC#jR;A`knSPcEmUzRKYiUYR0bqRZn%I%cE##r}7Bpn;+h-
zvc7Ir?%6OU2G|*E_I@YN5nCMShZ^n-Bl{uyO)SrL#ljgRJ0>p4t@zaUtk>$am3@bB
ztR+3^|E{jsry;9wO`GDctJ5Du!n2x(C;j{!@W;77$f5rze$EDeKYjy`f8G!OSsneo
z!CxEx$8+;_j36Fv)?s!+1hfn@_Sa7U|4Ixu9<KNI(9}<1WKa#xY&nX;V;|9Zd~fR*
z2;`_}1a77Odh<UBk2ZhYL}~vONb>*vKxPt8OFH$hp?|@&7qk9ES!u(5!?geS+J0lP
zXCLctAouJaXK?MGyZo8j@obdnjA96t`7eCx6Ik>0{~EYtn&V8soC1YfR;K@-flIe-
zdHW>WfEoPpe;@x53HV2idKL-zkHYmi2`?JX2D#TtBQF!--uIABK>lOo;@ai7KBDH?
zMW;KLd)PB7D#2lZjzy_(dR2lXv~o*cqyCMF0{G&n%M(mY>Uu#(OcX3-;!GUJ9-0LS
zUnp%U<~Au0eqNTaXC!#B!=6vQd|1q+r^P>rXqWd)ED2*7th_9J$$m;LLToC&I|3@}
z$lt42DDwWuwT)(ms8f!I=;~WDbAQx2-QBRpoTDUgHezWBv5!PU-1j76O4hQ9QX2^X
ztjL7}<;>l}<zl8=y(1))!lCLpYYZcAG|3C|(C>p*Ju1!-x3)^@9+aUG6cE_>@QKM-
zvD=CL5k0S$^(T%f12)xyOd+D!0_E0K($anze>ioc5B83FXwt+a^fn+xHoZAo<bI=M
zO3l@mSy8V0vc(IIkXy`m(^>b@E^z}2-S1}Sp_g&@Fav1aGH}VH0dBl^+~*^plC)ZL
zKPfj}A<N3;CZc$K(NTb@tzfYI1nhla%X^xz-Nam7YBbYtHI~Aq6{l)@IBm8ezpvHi
zccqbhq09x!R61$zXYN?x8|(HF$cdi0mSRmp^0@#oYUl(9!RW>_F*~79tsEc;zQJSK
zcvguOA<i3bb-}{zJMS{$$|^fM2E65inG!s&Z)B^vek@Q*l~0*sOZG6kp4X@`l=1x1
zhl{!#_ZRLnmP+I9%_D-Pg>hO~{|+-6KE9o*@FrI?HN)-o`*Y|?{?Oe=o-CO(-N8@I
zFKp9&WsRfmEv!?G$*ZhfKFsFX7<s0P-%beH0qGL@xxOXu4{;w8tXCZl#SW@>O^thF
zWXTe}*xqGiL?l>A5s`52m$0<U&=Hs*16qj+n8Yx*SyRFlgY@e9C<C#mtUIyFY(4XO
zE4md$8&lDn_b@rr9eP>{+3QnXsk!#Fu|T)my!hK1qt$#s$7=zfl1s1c_l=YQbJGFY
zrr|1nK!t1t_k2k%Zz)>UsG<C&9u?0-#HG9#5rdqoE1P`C$H%p0F;kaI=h!qWaO&e`
zn1m`DDdy^l)eZMVYIQZU5r&xQ+Hf@l`lzPtRkds!{Q1y6RwUoavZhKuEJe~XM40W{
zT?x0+yqgKUA+Zov71lSx<?nlY6=g5HmSyAJD?|mitDnO~xA|4FBhZwzBO0Sl?x!9T
z1GRx%vG-rpsBq{{zMTwZZPp|4AU(+hxFlZ>6UC7giEp^;-}h|fC|%)m@sR6hrf$_H
z-sH`c>En?TE>v6}4ztfGYlgexzm?CJsECrKYS|u3+WC^3ierts4Oak9%-~~K^pck;
z*93aR3Ew#b4Gz+iq*5I3rSdAZC`|$)R*slqKoRr<2?j0_BNLtI#ZiGqgotl0_4B}|
znt=-LwlEq;829jKz#CF2;(o904syS6anLJ(h-&VYHRXsrfNv@1Bzmf)nSJPsa7{VU
z<3RNZPKoimd{<{!Ph&||(7Uz9&tIbH5lymvukN{PRA#nup{RhVuDKGQR`!-}CH=A3
z&XN0C{-%ULLk2GHS-2kN6we(0VJ7Qfm#?g5=tB(LZmhKbp@(3w;r9k-&y$;L66=sp
zQOt+!-J23r*d7KMJCKzdn_Py2Q@7}$b=!$w$oL$2Sunb(KNT4=;R)voiw`J)$@XZ}
zQa8#44m{(9lZU&rL^j*&9H!;?w3oGMMcRCyIH5JJVn_}HtBczoJiOGHsE6Cb00}QQ
zrD@0Uu9^B9WCSC_eqXXD(IfWfki0&u%s-RxN#kI5!3ZQZfe&}sN+82<2jgkLp2bEc
zChG^K&IQPR>n5wZ_)Km6EbC?dZ{MhpvT!+`Bi(_q>F@?4RRh729A(GP@*KUJbadA&
z%3i&`Mx`S4s&S*uj9Ho%vZt5)2xAr@QViC7LvQb++LMz=J{qXY`F1Aat=UJI`1nss
zbpq)IMq;4DFk*0(c`h4uDsEPbd?ykgGZql#eSLRfF{bw|lJ3|i19}^$gldvk7=u1Q
z`Esi^4`)E!*0vl!2Wf{XAJi+Zo)<26QB;1Y&LMLDhk*KmSvZm$#%e5Uy?~@!OS;(E
zLwQXvQKOyX_I(PP5XU;k??NVg&3u?jc2=Ol*yZ@DUj)Qy>}SKYaKars%X!slvU2go
z%B5!7(@#>Mc{m9F9EU}lh1BaLG@x-(X1+OhM{h(et2*AK;QFA!S>PehsqaKY<-J1J
zPna~NuZbpH6L0goB%i%DN7;;}e$Owc6BV&*)L}S0hq`(F<EP!Qw{Kp_EwE}W0Tx7u
zh<7k<K#Chj_ic_CD*#7dthlaz!25AUh`xuVjrP&~``rHiQStuyfQv0}#@sD<A!J3d
zqR!`&Lx&4eu0-I5W2~aALm>yWIOPR)yxAP^eA>b)$)2V+N@D%=8!<Tn2?-2_j$4Vr
z#oXl*@eL*Bw3%XEHu~qN?!6&K>9OAf+(E=}lIT)W!f+Bi!Yx%&vpKG_`Bu=eeQjo}
zk&n$%JbG%IT#=Y>{+;y8v`qi_ivxo);YdaxdBdlbIWZh6pEublC8p;oMqeYY;s9Q*
z4$RiSX*HYRaxSu<JEnCFz_(jvrmmt6yWo_oiN}hixk{z$9;80bnXNu-{eWxeTm+G>
zBq>pB_&(k4VY@0d?kUhDO%Y29jwpIH_LE%wlKr{wMzslEy7yn!MvXrf$O^ujWpQ^A
z`*p)~3qaDW+r$t=Fm_1rlVOLKqXHt58eB719#=fz5f6&d7W&G%_>*<mR^K+Q0<czx
zlj5n1T2TXxIK-2oD%I3%{*s-WL7FVvu@NnAe6GIn(bFr%<+hvB4RK)wL)}#!1)sc?
ze>nE7@7f)f?bOXjD^lJEr9Fa^(<skQ>IimvTwKY_B<`NpSfc`((s0BCeC5Z0XTHMC
z>H!Y#FEpKuzlbyo7@Y2}3ay%Q;p___ih`5s^PZijhSQyfbk$XP?LOlCmR?+0SDO<l
z!Ua47SvaPSDEcC<*zSHdK8}_>&3J`{Z;56>#W2!^IU6vFQ7DI4)j^@+)d!7H`_o&r
zg>+=sT(Yc17YSszqZ1>%-l&wBOuNiw$TJgAy9D8L24CV~;_L5QmbV5wwO%hhiB){?
z{i5ce)a`jcAWg7UX{83E6JL@tk#;c_O(1`)oN1KP5b0w6h|VBG{|ENFi)+e60_+=-
zm|vPl6{}|oM>B-u?+oHLO#C<NFVzU7+D%(gE{iB%7H0dwKSLy`RepXyP8C~3V8H|h
z`(QH;RWNf+FsZs>$>M6OMP5lx+NauIE@#)R5T(7V#M5B~Q9B(Fr(D2EZd2+}f&i_n
zr86r*i**4ar~I9Ybbfvz8wxrx$8ofcdy{Pb#GG^<2Y#<eS6WcJ)3&{$Q!CEE@H)go
z{vdxkQ5aJ$)Fsb6Jpp})8XzVh;grSFtUruwwty%j?P%lbFM&5AH|KTj4Y;E25}oee
z3F5$MYc7$)Ujl17@isG3NRS{YB(sZIH?F9^#xc8pQA2GnqD1E--3*nYb4<VY#o3<;
zaBHzlKWDb8?0S)MHQs<o4vhpWs}?d6&bT+cyO{^CF%0e0A)pFBfN@C=H6Gyu<7M;L
z2{#;Jy9f8DmdBNeEy;N)hrG;u?<$TzU~K7P2y^$f?*M%n*gP>`*r>}GY*Z+MxO8`D
zi9|9v-p=Nr?YXPNc*n^hg33puhqZeR=(q^uxp8j`)H5L5oyVqic}C}kjiyXG`93S@
z{wR(mak)>ohiE}gRkY9Dz>JsqVxv3i#e;wH;8hFO=xJ1h4FRWvR643j)>xRsz1R25
z9<L(FfvOp-JM11!g)>tbc4w0y<=?cbs0x~T{C1QilEN<Q^K(*DC8CA<qDOInGrM4W
zDJ|@qOr=bylx(_zoka2XLi87bmA9N}H!P_?ftMuDJ?|E<(5$^tx5=Y&-r>}_seZSz
zFMRqH$U^WYd%^20|85OanG-4eqlsp2=-n?^&roP-&5WvqOl<O1nmUcQaZ`naZ#7y#
zkFTP%y&+Yh@rZlSK|b-QhMG%{<RJvz6s$1lCP=A&D;_l~G5w@0BKC`6+xy4aQ7WX2
zWTX!vB~y?vRZ59x41mqRB<FUsr<rp`>{8jT=awKE1S;)7`Xi{M7|_Y3q^%1kN}AQp
z^%YS}w<hgh9p0{d7ArXS)NNJGSJJ20X6_uO(l9vU=a1qok=0jW3mS;n`*brzX%>;Y
z8I_S=iHPG`O5*{~UG<{}>XQwGb_pZ_2vz$cY64Q3D6$w4?c)(;dEnek{&CzU*|w+m
z{+-ueta{{=SE6}wHx{UAA;@;ak}5R6mf~2;*v_jmxO|GSQSybC2hJSt+6ONCK_qE;
zI~qNK&_RsemI-D+r5c<16L7!v5-SoA@ye*7AKx&4VG;3ogE2AjC~8IO#2HvZz9hHd
zBe3I+hsU|zU6%4eD=$P|yLpqVEl@|Jg@}Ua{<%^-pxBKoJx!C@r~&kS`!lvbztn@Q
zft1jTAbLoH9xieoJ~e_u1}|V!4?d&d082*X_$k&X+{f&T?A6C#>J`gr>gAp-bH6pS
zo#+BFAr^OjI}slL#HthGrY9zUs;9r#P@v=Zqhb8JN&IK@E)ewyw2%Kl{QgVuJJ50l
zvU<<`PGkp?d~g2_?gjLVw!d4;z$-v;{omBv|336@^>zp1mM=o#TGdi2`d^~9GiX%x
zAJpalL>&JM1o?k%;BWcz@LBHhS$6SXjrG4($^YoS|D|vKYs0_W^M4KewKwp>c{KH;
zH9?iS8-7A9NQgI^nEr_+*(?JJ%;1HA)8NFvd+hN4=&=K$JRsHhOqzElz&!gZ{*aEs
zME-=B&tT?1AH+QyX%{dxAwd5XxcF^|SuN;b8fH{-)s}nS(bvneW@X$}n#ly+cW`GE
z{kkS|9>%chK>$^ch`3U~7!b9im8gTlpk1f!L$6`WEUrT^IR21lfXLajM#bcLw{C<s
zhghOLLT1m;XZxEed$Omq9)P+6pWu+A6>51Rg1?UK4iSLr71(;xdlzFg+@(`}-E))E
z8>#ObsWR6AXKCb*9aCFu-#k}B>HJQRAC(j}s>~CWdbN{2kzqW|N%x^tcJ~ygN7AF6
zghc)zYp!zMO+&-2cI(;#mw>uyjY+Z1${JYc>PtPrOi`}h_(NMkt!`;H=tbO1OoeX4
z1fC=3NqzRF-0XJA_O_t4{<Wo-O0}_aG5(XzDHJQ`>UJ1leeer-Fj{ipnteSh!eMmM
z@W`>$srW^s#j4YdciK_%>ra*tAu(pML;Bs~op++j3k9sRw|Br=O7AijdghC#x&;d$
z+--&f0q_>@oH$2k)EfWz;Ezi4p4}@%Ay;0Xn|JIIdK(qL+<fjdg+K=t!(M>h!c;|0
zA&ojPM#-s)+gtqTxE)T70p0@tsM>)S&ZbMM`Xk?X+h}u1tC*ZhHcwR(m{YQ{&?VJ_
zC=vCbW^&AODw>j8>C0V1T+aIPp@zK3z>2Zyb(Itb7cG}OM!9qkqVZDy#v7;|BAm54
z#xGz?Eg>emd&x-7B33gr_6L&pUJd8&H#N7>_|&I5206L6c1lil6Hme-d6cx@HJ)E^
zdRx2!<G`7?X6g5P(I=uI0wqbDeAnMPE^Beb9BR{EQg<~4wEZqRIl1h*-Uc2L`gR3H
zI#X)CYo((+_odifr^0yU1B$IJt#b{#EpuDhsv0@$lxPDK&VSJ%BHk|)(ReiNI2#D9
zDkO9P!p1tZuU02>Vo;WsXkFU!LBA+@PvuE?=)GoJzJ*UOtT|&<o;n?s0fOD6*d!0S
zXyGq7am;`^&WyShvd`lr#c;9o$HcQbTLJUCmuBdatUMjWZ+r?r|BmWW2{{U}Sqj`8
z)kD*<-~f@6rBS{N2tVa=zOOG^mS)L>GDls~<EK&gA{O2_cly#PFuW?;tLXqw>dnJD
zsjsRm045EG^z}bG>?u39KjoRMRTy{p6LX8jc5o5BCV$uR`f^FPE{+A0Yl5@3$M_gv
z_Qlg^%7S<tH?wR>1LTBQl*D#KEli!S`_3<Je=Rl0%GmUf_QJWI2te6zMra7$8kJ1G
z_A`$I@}h3kU3E(~JxsPLma8sF;c4lGx3y6@%`b5pCs%QToz&R#dbnAXeW9bgJ~pV%
zojNXG-Jw1x-r2>n=0wim8Ljd(SG)yFm-6*<vZtIG@OyL-h5Y1-BX0Uq;x8>Jm~|@2
z?b!;hU&$hCxbRZKk-SUdRih88dvgq9j{=2Q05N|}^p4Ey%2@%AlOp#MY+1AJ@p-sB
z8z0)eB&H}d%_O=#S|!dFoh0RY!ht8p0-iTJP|HG_LtW<PJlW=C)zMP7A&3%Ft*T0<
z3d>mUj?7$1gXw7+j2e=N%7J72^)S1tC`XQ7dtUb>i-d7y6``+`ZMCVKnksW3=dWKM
zh;Ci0Jo;D!J;6*LnBZ<>;GOc_rsPAn{5!0^t1`KhhoAJ-EeGk*iYHlr8v7B?=wZ_O
zNaw~Qx{h_wmx;}Re7oa>I+>uI%*JtnoThpk(OJ`3i`rUO&gi91NFKQmH}NAjqVr+L
z=-4PLdO*^5bRzl#5-xXk9JQG;$LV3rf~8bh>$58l!7_0<qD^f*yQ=O&N$P2`@7Pjk
zFRyhsLhqcWG}A(v#;T~VKv<r967|&-edn_=-Ipr2I{o?LOM{Zd`0=}sB(>itUs!x&
zKVxgN{L*}BhY1ESWhy43p;~_EohvvOvub-<(kjMc@D4w};1bD=ZO8OaH{&b%XzRe}
zSyLpMI=J~VR?q(y&J)c>JATrx)lyyj0vml@?#%@qjmU<(V)3oU=k6+aXn!z?>K-to
zl(8J}hm$s{fWoCfFMUt5!Q|6M54ZDuVbxz$-mH<CsNGDzPV`LNJYpei6EBG|L)8RI
zfzZ^%HWDh;gLo~`{o}~Gy4v>xx3U@plmWr&Rc~y7B{}|nsb)s_m$CtfYFiTZ+s1o2
z5XrWKt^t*y;)SZJfS%ots1QdTB*(pK5|3BDYHlK$!{?Wg(K6@os#t4dj9wU?WkG8`
z)wAVLPfs_|{8_kWpGk}33}a4=If|)1XyZLG(Zpv60;L{I;KJQ$Z-rmIRX0vQ(GzPQ
zZd90hM`in^T8{CLzN<Vgs*LT9OkGqLy?w83^MXVm=K+@zQXsg@BaIg$9qyZJC#I$1
z%;X5xNxRBdpfNk2w1tlODD>6M$!nds;JBtmh6%_Fd<Rf<yTDiQkHqT*1GyUFR0n0s
z(?g8Hr_Cy!ARLuwRpR#W>pxb7#+%{UnV$j!GQw_C9Kisqs0e_#OQL`qL4!j`G>037
z!CmnHXUJ0aa%J@M&{r|ildSJl9w<2UL_k`))O-P~V;XQaxlN>@ssaf0{|Ivb<M|)=
zWuGD7=BzpN&n?dQV1M1Q|K9cYAYi5dmHl@vSJnR=mn(eVdV2qCg#efa{JjkL-Q7R)
z3iv;_aQZjO*#E`bx+*YUBmOmV24|cB7iVI#KQId7hk1W-;(oh{{EcP&hA;k3EdMWR
zvp?XZ-=N6<vl#M!GkyUiufK^50Ig0h!87p8oT5+q0gzETa30r;Y!jEE61C44<*joR
znaoTeO59@L%DAw2?!i%6rx6ysbuR-#qKkPJxe!UVqgaa#3v#~K1#5X4&d%N1O7w-(
z|ILFUaP%*tUH#@uKyTD;53pY-c1Bc!-t9++ASxN&N?k1xaQGQXZus^ik)fCc3+Hpl
zEX&K_+LbVDp>8q2vM|Ysoi0XvJC)??6P`lqy07kbX|F$1dtf%RVrVkGnY)qGJ)Fje
z%g({6qDcazK_&*O4=2L=2ZJo`&<d8Pd(2UDU&n_1WX87xjN6~SKIolRb#h469vXge
zcEeCQhm`O80VX}nAx&SEew+e^{aQNGyV3f}#MF97W(bzsk5yD+J@;9C>wYy-X{Y~I
zV~VEzjugqk8{7`4rC6|C&lc5(xQ2uj>V+#-l$S#m;!AFY8EAdFYzi%xh*B;>1RyHA
zgPLzanh$|MpLDx95^QlGVwx(Zc>0KT!2W%)Xk(ZGm%=OJR+8Ea=adp*lfah+!U5o;
zB@57e8n!R!z~O)%anO&`)I=rT)3OR<amEuMVDaSk$&VE$sTu2t<)&-#(Q$P@2RcCX
zxXd;rCb~4RQCu+8OnYo|6MR9F&#LP?>YxvDbkcWuF>i4qBbJC0a}fq5{4l+UnTuI4
z3jm^JMS60ou=KeLI}|^RXS!V_imH(|=lg_6b}@1h_{PH>(@DUQmjkWTA^6S^9t2|$
zi7x1KwdEThoMpKU=F9kGik=j>Bvl<x{M_Z?ZKIbn$GW^B0>pQf%P-DvU0>MEPOy1l
zGNN2o;+$}uf*^Wyaw3R?k`2LbBO&tbbHo!cdK{p4;F@ye)l0An+U~cEXvB)cMH|1B
z5ba&tX?2=Bp9(1A_|G3?;8w74dbsZs%$>pSMB$s1Af*#+jG>_{+53r0JgJ^451zM9
z-<K?#w(Vt*Q3+31zx##klI!%fA2~tp$n!<v>sd6%dO%x*-OVfjP6i{zxuQI3vNxJ<
zjkvQJBGrfX?OBcjPftfg;<_Cs`1!z#d6cz{AE(lV9#VgYlie5x5@RL^B$%kk`Q*|d
zZ@~yR-{+>b)J2rf<~Aq0MigG(r0Amv>8p$xy}E9rK@Km>d2Af?;;yiZH?`s8gxef@
zG3`ndudhe=+VA<J)!Ti*;qaQb7|&35NgQ4XJg=(S*DpQ1ZLi&EIVzwl67$*J@ok6|
znc^nVvzd3uDH7E9TMQ5ot#KlWyQI2B-io|}H{}@9Wa$fXbtq$EAAXQJrM&Rz%acOt
z`bRB2+&sp|NL^e<l4rLc1)ecnoq-h155QZx3~i<yC)Z-Smjcc&&n{a_)^<NZ!vNFI
zG*X-(R=pKO_H%<byl{X?g|@2WX$J4*Z2|gmQtJUp&JX4O)3&#o-GKW`n;;1ublL=E
z%Ys}{v(2(&ryk2SBB@P)6lWWJR<e0qvUDN+wj~LZ@!MGYMPxWZ5(Dm3rzZ?ESJ%+z
zy5<c~miVJ=i`+Jnd&~(Pt|A}P7$-UQoM_bf$aY@6zVkstKxzBP(%9+#*Oq}|A+9jZ
zHf}wh*FUb$AA_FY>u}hGzJVxE`C&`+wI6mh%$5`3P@QyHFK0^***i}$#+`07@81dC
ztVXs>_<n{y#2{PX(=x5iOgIMtw^LA88sivTvodzuCnTqKWbtiAN@(gpa?tf^7bVl5
zQkiv!exahZjWVC@3|r3`@bPok)6h?ueU-zpc`q<^Lc@Je%w=<+q&RnMWFyEke-^KR
zh*ql{E?SYlGxL<2N9yajLhG;HPWpQN(&RXU&rk?X51Y7<+rh7Rpw6UJ012a%z=EA_
zFiSB%vZx8;8GiH@rZ#*|+R`!iZPH$($B6!@jJe>XX?Oc^$grqnG{X<BDpa7;#m4@F
z`Ph%}CEwiCT>rr_p3klz;NDCnV@Iw|k5}|ZaYsQJity4{lhdr4YO&)2#lg9D;?tcN
zsi(c){9~IxEjMS_a+pki6c~z&8}v@X_XfB7(VP*)%_!VUqX^v5Xp1?Xno&1LYE4y(
zVWe{H?$cqw6~6VO@iYHE!PIu?c)?H@vjOzwX(Ln*1!Ayc=x!S~z4oP{Zlt(mxjJZ9
z_D+$C;D_F6;#Z63#Oa<-GF?ki{B-;xwwv>n_Uj%m3M$3hHxq6rLIuhNpXOhH#UC}C
zDB!ND;H-f{J<zNI(cV{hdcIBON~1Ylb?%bs_u+6Q;;hOrFSe{mu2+|zLpX>6IoXQu
zwMuYr?wy$8NLmr(YF())c!<QU;?wMG(Qgy<U!@ZOy+xKmYOf@ir-PNf_Uo-go^6<a
zRcF2O4KE!Fr!eIUrx%r#p9AS^i*aV};a5b!!SHKZXtPKd8~*l$lro=y=wo>2gv5zH
zCquQ}oa+yc@A?W(Yc1N^4m97@R12Yxu<%as8?y?~TfADaNjDgKPdlv7tSQVY481+o
z83B|3mL<0FhS+NTo3PKjql@2Qfg2#ktE#vS6xd(G7LAfp&0J^BYo^75esG3LHGPz<
z@%r=~6`@zrCv}$yxI+5RhJd~!MBQWpq_5x}0yz(YDi~0zb>_P1m9Y|rXFj1$H>*Bb
zhCN^hJ(!KL(s`P9e<tAPtx6a>R0M<E0+5yklF()m(eHKkC^jh0Q+b$q9m3C7T)c&j
z&!v&Sc`4Q^Zb!_yGUlBc6^{Tc>R!fYj~4|GzDk*IsD<h0s9|bje6`=n2$@lyx#?ZO
zi{i}Y)%_*D$CTna1>M2CvO|17nG$vh7PK|-&Thk9{f=b)dtT)<Z<1?XOhiDh1e@R-
zPhPCCUmTIT;fg`ZVU>cw0wrz_L|+yd_4B8sE4VWUy*!T!yGueD5v597=f*ZLnlIpp
zvQ)`_Y_-bthI^IL9GBVQ?H2&JFG4c4XU3D%iVkCoAi^R*{2}A@SH!Ov-YBm$!L;$}
z7=>Ja7!O_%+r1@;L7HI)0;`Nr(x1@$H+Ky_4~vx1=0z62OuPL;=*qX@jI^dlOfoN_
zW*EUXc(_c37xr@K&nAwinEp;esLRCF!XvPGJ(GU0u1jy8`lq<G%m<kt1iU*Fy9BB1
z;1{PCV4p7R+LAm@G*R^u<NEsUK4n)I@h6?$2wybuj;SAp;~)cL){P9T@9x;4G#Id|
zC!gV(jo1u=OkKtg_2O$|F5mHMYqrIi0Oe;l&@XyrK;T%d*8sAw;Oz|~&aMZcGY{a;
zJmL<)HzF*edWEK%9dObXz{-CGHPESFM&d8c2YI#A?u}(tx>QO%Wv12uYw2nD%$*~C
zHSUX!ONNv0w9kp{Dh-|#qt{I-*ybIS4T^Ht9onqy$qF&?%`#SZNH060I(!58{p}cz
z!z;TxY>Gu4wK_o;@bajwdrBkVDyEW>5`GFFhjiO-ejIUiZCj=iN%)n@sxd*o7dw;9
z-SW-MrrFL5ol#Sp9TntWNL>U??<;Wpff$P|s?5K&bVU6U{^n`A<4@HP*d6?<=&oj#
zri!|%+7Z3>ac{4<Et-$*UYIiHng`wTgM-75K5dy%NcrSKHE>?2osgubf{wOm79KF|
z?aS67PwIF&UO!3kkA8Bbr*~RY$ty#lg60RcPDPb*rU@svCU|^Ny^^qdaJPXoqME@W
z0;PR5<)`RTDF%TC!f+mffGbMa%W(mI5%o#DfdM3TjLVrKvd~^!x19Hl99-Z!0>YL_
z61M-KQK&d~v*|=4^{NK5ViOt>f?2;}cZsWRS3t0e3D)QG3d+}TwbwVY-TcD*$Rd^b
z{xk~FwG+xNhP6ZlH>zNKOfZ2FUwNxDeMKu;nH2a69zQb@P#k(YIuYA<VsGbSCw*4}
z)Fw!?F~#uC-BDg;RFwZg@ruT+R9+?CBCZ6vyA5Sg#ETPOpm%{Di9E!-le_@>1lN)#
zIusy$V`Sn{#YkvOSs8v+AJMlqIMEI|UnMj3d=~GD*=hA7U-cZ92#%I|5?Qcb@898Q
z9lJCN5WqMsdak|jZ?wRMeR#h;P=!}JF@OpV!N^xZ%=_Rf+`IP9@^;%y{Yi!T<AVch
zA#$B)DdkvRj))ZD_u^v2>OdG`5^k@10zum7HNT~V+KF^5O4JNiA2q!_yxmjX&Udx#
z$pc+fV%`eV6bklmj6e;4GnKm;gK0M$y{a9piWSJ_8v8z5_BG#BiNAOA0>z#FTR(P*
zTS!<cOoy;gfJaTag5h@{J4Kv;OivVr8aC%NCev^OpCYg+CnM$LsRLm^uvs5!A=0PC
zj6|Bv4p^HCLb<O88`PF1u&7F^^l-LR7+>M~^ynx?Sau=rx`zv4NW!-yACsv#+9;a0
zR)e53MBgvoZfloL<*KSMmN4$}n%#|W*)e4REPECO0aI%Gj&`l?gH^0m*=ar;anQ7e
z@PL7He3tVFlM?D-RRe$|r(!u~J`w^kH>n$Qcds0s8kZb$K(~HM-rRj3Yk6LP5u5V!
znt^F6EO%6z6Y!VDxh_Npz%C8ss)+&tGeuy*mkqia*Lba>HcN7sxvE)TeUawJn*sVS
z*e$>YNOoRQS<w9#5tFIP!v*6@Hk+09TuArVa`8t4r1Z~*@$AZ_k&bvStX`X0O>P@6
zIIQ`h8T*{EP5sF9_j+Syv&jYeJ%9EdCjZ5~+P$f!Mkf$PBO3R~X&U%!ONffS!+WP$
zaNF(^{oP}aeu3w8hxdf@X1a+yMOT3J0$vC0N3XwrD193<)6AUEt=&{!9c4f-?`{je
zq3kr8hq8XoN|nw$iG}-1J;0uCpOB`*n&dZ*2#PViGO!4!?xH|QJuSKWXw`m+`iB+q
z%Xtu+4dyGy)SBsiEL(heA4jiwO?87%C!;O75Lp4y*ZgXK>4}UA>v1<9)m4$g!qpp1
zb;~^LItCU%lqTuStR&fR*4@(k*xc|&t#o?=-7sDpRVTWkW`&=&6Bp{u6Pfl6Y#v<q
zdfBklQmRxsKt08BwqAg8oXA6IvAMzgS><DRbu_v@;;ZWeqd@v^a+Q|fURYQYE8Gu-
zf8N*Dnvu1?kSH$9cef*Zb|z3qhlw+;g~<I@;o5OpYM~MN?451iX%9})8!;AgN*Z-4
zteQ+7nX&pAEZML9nT|qOshaGb;8+gem|KBZ`GZ&-2*7@W&?eN{U$ExJt(4!!(OQ&E
znM$>7J<rA$UDa;f+tEql_Ty($HTNK9YF&lJ@68orUCl6vts9w8PApdzISR>Sd(U_^
zF^}<yJImGj^>O1et&hqH!bJCHWP(MHicjv?@}hQVV0{GX%I4-o1KgW5zOr%4q+PFs
z^=Y-B$CV*jQ9Xs!34wBNdrHe?>;X#vOf>+0QE$#7r{I_*f&Nrj-=g?b1(IFY^?1x>
z<E5GWcG7K|Jf1(%tUoZW3mE{ubq01_$Xo;ZCY2w~`Zs|1P36xf%3lM&HGKc-tnd?E
z`}ZyRiMXr&vu87Qa0(2m|C=Q5ztP|El=AJ6-L^^pb1G*z6M(P*jMod<zgr_=M1T#?
z|1So3{*<VUo}Qdd?a3Lc^*7Y@7Y6np&;NVL%HJCr65%*dx=mU58>iXQw{S{bH5zMv
zm`}zz*|{^uca^zj`GyNf8S^OSyvQ!MTJWa+pge4X7M?tw#$TT3FA2wrjobHYUYNa*
zz+_ZtgG@>6&0zsKAG*)hd@hXw{6&oj1Mguw>R5*G;(4=r_-ZcG;^|;!>BEbb(dfq1
z(WQ=8+IM(w)r|4Fd3%GnwWL1>q~ty5oNTVPJD!9WSL!V$;&}(&g7!sl4ZFY*#w>#}
zg<b|~g3L~2d<|{_bUgI_7tx>_Y=vOqS8^Y`98I_gSUjCNW*|5bz@`AN<8$usO^1Lh
z)871}Uqqk&*ma0dX(6-E1_A)FkN?>7M5zl|;oco3WdufV?1UJeRvx?0)ObTRSj+@E
zm*zt}A3Y-?qU=b~a|C1TzCjw=*u}=&H%_&5Fp;U9Nvf}3^$*sa469W!EVET_v1cHp
z|C;bWXQ6aT$u58|Ms(FBc(v!({2VI<M3eWX;bCzfIMl`>Gm;EDZAR2=+4CEYk*+)Z
zdIw$@SS~jA84jJOCsyAXMubsVI!*J?pSr$#F1yCj;dOg@sZZ%wL7X1^oZqS~)^o{`
zAmZ27h@<&MB(D^X;00rgZ(|v#+wiqN3O6c%_X=i0UvnlSt5OhnoKeajJL%xNf!&xF
zOU5p!VwU1pLfk<Vvk)WQXoK>`5ejK<<IZa_+{d^jW8&K~o_TB)21v4BL{<Z&_<LB#
zoerZdb6sq71h|;cHPu|_dXOBlRnFK>R*>a<;|?iV<}SAkB~YyYF&p*Yv&kgTt+YfR
zGfSBq8Tmyz5-JzX_F0=(2-Xb8s33w3z<4slP!|#SV7*hhodZ|ei#BBF8dU*k%P!%#
zIXQP)Dd#k;ZFe*%5G80eEY@}OCT51#>w=!27skG`21#|b^&Vae3p!{Nf4BS4momlh
z&6LZRas{V^ohz$484uXJO8x!*HwVX`Khy6S{c&(0CMd-B0Ez3lUqo+wi!lQSuhlO>
z<&)79kx<J5+(~CnXJwyHld@4KTXtrxr}E3{D3Obw6!jN>{uG5Tm`%Q;)B~a(0d;q7
z<WG1o`;7^76u(YoX+@u--(qChSN^6^&GdM^Hyi#lE8H>w1MlCyCqN(@=!M}X1VuBz
zbdd{6$0IR*zYlivUqr@tk^LY%If3|~CK6%g%iRs9XnZ)Y2JTE6O&SO+jnf{%KOW(*
zi$Q+&L(*#XT@PjQaQMMMMEq8t{mN;aL#0f(H+46VyR&18^$T~qFW?w3<!{7CEAM($
z;fp+lP?25oWY9O-ZUMt)Ktl}7f`bqQ|6>+^o{^A0&&ctjaDsp4q0HVtf4m|6W*VC^
zs8cO&S<vZOvGZqzbkP#6&9=)W?2F3MCWM#P*YVS@Ntl)k@pd>t6e5y9Uya#r@N~~M
zu}%E4Zs?Tx0xj9cG7UX)mHWnMO(9Eh`GxXLgw)wdeRlr;x2IF|&&->@h|-sUxq$w0
zAQj_jPI%f;@UZ828!RaL=MFuj`l0a36Z`NzyBM#lTfF6rFBPKuuE$T0mhsn46yt%a
zHyuxg^RmY5wNH3Td=T54nd$TN`Z6;!;CZi~Gxp;c184Q6Yp;n)za!7iIhlW+b5~@R
zZT>g|rEm8jRwZOye-R1!l`#HwZ948&K8=D>XF#ZBajupncIHZ$iLmal%_|@8QG^W(
zPx>$Ub=M!|p5NI&Dx7p52=EqYzy`O2n4AQi%t!J3xyZFaqgw+NeeCJa8&v)md+!<6
z)VA#pM?q1FD1vl?f`ZbdOO2>B5fD*2M0yhtr345>L3&eAP^$D!1nDi(1w?uaHK9pQ
zKtg~J|4X;q?LOz+d(M5{_qm_$7azd6)|_k1(dHau{KhMhYIsQ{EfpX4$fEXtrzrt-
z_fy8q$yMg41PGCtM6m?4&Gc*YmMSQKy@Ne&_v6M@29i7_;*AypaujODCQWXoop-Z8
z>t()m^{^5<Xyyn+gvrzFAgWHN5YCPRH+Dgo9NF%I=_QYC3qkHwNKHG5w_G>|g$pqs
zwSXyo<l5cU{x0aLdu;F@f)2(Z6)6$D1K5quaS|ZqMx`QqC!hd*F8|KXs{Rn`WH8{S
zpL9coDN5s0P<WaaBihHR*&0O?H!Mo`uf2SM^`GLmJn`}7`Xwy|e6(sm`GlRfc3Zv6
zY=rcPNd8K~y@pt!0xyJ(TG51TjrsKr-p6q~XcW-1;dk!o|GSFJII#b<U*AA~ZP)=l
zaR_JJG|f@RM;`=NR~Sx}O7%RGma}|D>=;te<$h1Ryzq6}Cu-b4no-oN7P$C9;tUQN
zJx?r})n-|qJ}GZZ5Lq2}?AHGnDY!=CV&%_nHyf#u<N`nAVxr&rgC>9p`$d$07WhZ|
zsk`9^51SDZ2%HF!s=pFiV)NPxFBP0lx`F2kpNT#*X)-lU^zPSiudrY5u=m&MEn8wQ
z={i?Ml{WL-yP#)``GY5d0xpWXv5bCsai+R|Lv`3Z=E}B!#>Y7?1~+RZt{E#Hd(BKs
z9_~|{RR3c(TA2p<byhSm5UXwRT`f~`Bl6bR6(>bs(ZxZ{(x&15SN!3OC)-LwK3b%S
z#;kT%B@IP0lRurBCS4tBxIhxce}0dfHNi8eBvcY^SHz(Y(%3EI4208PQRa(L6w~v`
zbo8`CzjMw%P>CDysqb%`6g}|`^a=92x{jSij5(^|QBO%{G2<J|D=&z#A9kE_?NiQ+
zXV#>fs?E=N(WFHVb%3%zq}{s<%3#v}kXo9Zh=GL1K{$Zp5!*_N5Z<>uuq|1#EuBC%
z>D8=s2uTZ*47F%}U_kIUd{ZfUp#ktI{#*5!1gOXOe_ERLEON}Jl}o02<bklCC^37W
zX^JOKzqW5y%7v{}^!!W^R*emY<({>B{Pe>IWJVc)6=!<`CzR9dEBi?mv(G6bkz3Tk
zOQVK8Nh#<B;cn!M9VzmI{)7GaVP~HL_WlniAd{GL7SNAh4thw<fAQ0Z*@=T!%#A6G
zLw=lwa1}h$Vt`0lcsJX$YK^1J{nE<Xh!$G0gV$O{=Pl=hU%d3BbT#fLccoC&9VE^k
zym8kksGX*7wiB|fjqTjG5bLy!vOY^`aRbh@E85Pz1wH+*mh{W?L$-7N)Y$af&2%Kd
zOZ$MD0c%hCwfdciov{s2JZb>TF&J1S(d0`Z&GW7~HB1s><#(u!-7X07eD=UlO|tgL
zY`~A;z-@kX_<K1a<t`Cs0(i~xii17B%m;LZ<1cfk=g>e#z(pAr^N+|7z$g7(2mG^J
zSZ)RV<re;>w8ym%q7>Qfr)Y^KGr35l(Fk__U@8qE;H7AtF)8Y<@j&&-^J*b3Tnks`
zP!F452l)&hXx0&oqA4V)=G%$FC1aX=g~=bs!%+~e2wt)37`|watB;?7r7M~68-JHL
z?LSP)Pa}dTl3_le68XbT{k5Kb1ZL+0k`-wEE!A*th<q7V&>B~<!tDgnmAWu|XZbGk
zrjsS&WpXpE49AE$E_P-r827Z!2z`FLdxvy^ZJUg8C8Ub%=uUsMg3XQ=?3eS=)Cxsq
zjx0uhUkc=J-u7|u)}PKdbVcj>H;_^vppT;e;-4=rZ7BbSGsJn!6}UK7F1$$Aho;J%
z4s!clY)4&5eWhG_3KjR0PG2Q(2&F5O8f7yM2Eo?%u{q&z!+ap-)~4^_n4_Azyuc(?
zadVvX`fO#?m0s~j?X0{hel|TVz|r#WR^tz0`@<vB26T4C-X^f1;NJ{>vAp*F#df~P
z@*XbIB|NznH@x2}cDx)W5$hzBHAf0cYJSX^E|Vx<b3e9&as<k^x|VM0kV+$&tkEJ{
zoaT$m%keQ>&r;7q#Vkw~O>XeI33dkwy%OlDWWu%oeXo8Pl)nfB8U7{g(3K$e-3$O(
z1@Qr*1SGDiD&hIs0FU`m4FJhF1n05#v~+O@g1o;OAM$1G!tI9n6CP{#6_kn{v4FtP
zpN6FZu{mToir#tcLEZJ4@sS|B3zr(UzRyM9X|mzV?DO4#L)gwW`VJn@2w*Dz8xs9%
zr*Y2`0Fr0hh;%!Y2}88jL<b1#S;elQjf~~z^<^T$b8Vv?ZBt|AA1cG7o4{i(cZmu`
z6=@lyyZ8$kIi?QGMp^5L?p%ok$FABo5&4+cYYaN|pRuO~ZQoLa?SlW==+o~e{B!~S
zVxi!@*<Zf?13aR!hlQkZP*0M?)9Vb_zQcJo`<^-<v>WRHbvXUTmG*&m{&5N!PU<zX
zFyyM^rpC_`#NQl?pXLCr^XHlHH(zJF0wqgA%oZTf6of#aeg<fE#->;zS@~ppyk6S~
zRW~49=p;1jPZfF3sv1DQ+Sn}qp!AU&TbKB^i4-Bh&_k0=m0={KCp+h+DK<L}_)Y%R
zbQ=(~H{`SlxrZ!200by|iXCO+UMak)Pp)A-|9mp~d`0fun!XTGk8d>^=Lej3Tt0}<
z5NQk_EcdmHcy>I$p|7vGP^S@fEc&c?iW=`j$B$*G(OL|lGN&=$UQuSacuiQ}?NPhD
zvVq$-P>OFfr8`wXw;iIH4hA6y(|MACOhG`fR=!|VkMrlS?P%|#aM~VM68dlIWG5h|
zpmV+`GgB-yP!<wOz6cY*mQT*N$Oij!4{=viM%%s+TP|tk2r|ig@HT`I-5m2cMPLz3
zG)Gba26z^Um>xwDC&9Sp@1<sG?Lbl@st<v$LFhFB*rXdIAPxMD*)(wQR77pM5UHGI
zpkvaF4Tl3T$_>dy4$?dro)rcI)(Dvz*^jP3X<3`%!q$76sQ{VcfV)IxEQHao-$=W)
z=k%lzDu~3H+2!<hOl5r_Qib@cwl>*FQn|$->~irUd+2zKKqmqdR0p)&yB<~l4TP`&
zpaI=dam{AmSJnJ|RVCk7rQeMBV^ObtyuX3ARsa;{@8`HiWjF*Vu9lqn2HN9r-`L*=
zZf4oDfE))l9OB@F?9RbK_%~2w|6VaO8G)EXlA2doqIb7}baBK7#p(10?tdH!n310^
zlib)p`2Mnt<tpgz0RY~C+M+MCfGm!XHGzwXeZRN{u3ryt{G8?+=#P!#^dXah#DKOh
z|9;+$1M>G3{`d2`0M;%Qx+_hhSlbi8(*N@o{za_sTc}tN2#lZJ6#yLay*3`QFJf*Q
zM_>5`83Or}(f~ZyAC&%+)qH-k+JCU*pG5t>Wa%Gt|97McBL<LJ92<eu{3|P{9fAm1
zT9tHpBmn5U?mB|l_zERCN9SV@i#z0-fZwNB^6x(O@BI2d`B;Fhemwkxt^R9DRq_9z
z6zT6g`IAz>-u@w!|1(Pc!J+?-Qol3RpS=4gQ_=nBO!eCi{b%$3zC+XhutTVg)&J=Z
z{g2u4r{H7xe~Hx2Pr2AO5g`Et?||+G4~v3-$vsLLuJlV(-KT$w>YrTZIK8v?oy&$E
zqPBnpr}Kyfut5u=2T4i<ZdneP@KnFp@8`!6%~9W#A_h>3U%o5Fd%twxYhTM>I&l1}
zehZ*4e|%lL=}*n{r$_~T|AzGM%F9=u<{Jot+SDhTZ%3$-fCfPwfGh0M2L&|R-}S>1
zp!t4q*^h^RXuf~_u%p@3*wS$6v;*@g^!U}Rxj6k}AsKl#4?t9TlDO$rU}kVjG+F}-
zZCzuNVZVM^HQTtS@_{bX=3TM%xtO>{{2&$k6JF|((u1G|4w~G|;q3!Qy^7EP-xR}H
zgNf)3rf3h*7n`pXu?-bCRG_@fOc5KH9;T}md~0BBtCU5bg0JB8(CZxwb%k!-0+mRa
zwwFmsuPRCbdBq)BT^>p@RkkXh+ObvAP*?WiOaD<_@x8+0J92@B`uBf+1_FRi?mx0S
zk840hfJWlwK(!wIm|nA1Dz-RBY}#QzG9}sacy(REm9cwsW3O%~3+-gO(|t5;IRynY
zb@Lp;DtdPdFHNR-`wcXg06H*BNAW{2n~+inX_uG?phoo~HZ?^^imC)PKmkHdBW7v<
zO!K$&Luexs@JR4S@<+gSEMi?q%mDXvNT6`L;4vODoCK(J|1Xf;3r`^WxyVicvLt#n
z8nAqRfQ@N%1CwGk063l(2QiSvo|b8%Frc|&aw)bw;{Jo#)q&ZU1vUf7V4i&*z_6x<
zqHv}Fukiv2G5_#E`Je;Stp99wJBn@Zu>a_jE&-op@Ax0h|9=GiPk7}22>Kt%$NzEY
zKa2cG85{_p_{Wexfx+^Qj=241wygEYqGeWNweoPcGL1KfZkH%?zv%7UZ@BT%rV(Td
zIJj#+RA)EieV_^G&|i7pf3y$z-rDf5)**jD*8mlXK$!Danm6#vpFlxIK(*qJB=H{)
z*X;vGC*V*{MbZp6LL8rz?}z#5RP`e<aZ*9XK3$ffJZ=w<5fqNioi+=AQWJv^#M|KV
zsYI+Emuf)66;-Z8@5ytOc%~RcdZ!P?W9IdG!zY$av6^S4d`HYY^GSDbX3=<dWulI!
zM>p2jd)Q~($6(f;dfXV--}%8Q@;K#13+c<;RuTGM?(Qzuj*|0p;k0MI^sB93%Rfi^
zo&g3r6r%~(+~*tZ!ppV#Ngot!zqFW=sB#i-Zn~-z(2Vw3jeH5NCFI@hY(99Upq|EU
z>xJ{w9N5+l1@6Mjg>FvCB_?WKZKe5`7RJ+k<-YjxDb-$IM>Jd)3qC@W{91xNW?89e
zu`b8LyD6>07r#z*|Jc>`Ct63mz#let`Js%cRes1<-y!eHR>&bExCV}^2tyNRFjp6n
z=mpr8dk<43v{#;daBe^UNN%L_p%cG6t+8>ZCvfXE2VbP^j~*N-tp)DG`{z6mV@6QY
zE^xH>8zEhUl$Q1EZUvJMkVO4A@RRuZ#i$1G*yIX#d(l$Fo<|P5rMH<;a*XqiGdmtY
z4K&80+NRGCfsS-sy`;Mp-pNyed6G+sYPFjgRZrT_2})lsxj;qf?|H`Lu*ySC-@6Y>
zoQGBGW+{=D8!oFwB4jwQ#VAKIBf{Dqv9(Blun)x*t76)+u#t|<j)lbHMXjo;h8Nk-
z>;cG>u%i@Key+SXKP*0eLUjc+%U7T4W<JKWnl_40JxMYmDqvDi8^PpsP~}b*>u!~2
za4i?CVpNV5oV|LD<3%$^6t*6^F94*Or(Qv9pucBT<m@XEjhhqbNoV(>qO%+AJ@a8G
z?UZG!tLGC`Y<X)BW;<qVDJle3YVvLe#;U#2k{)CHojm@IkTR-9U;29u{l(8p5!Roa
z*4NJtWW}JT?l~2f-pngkbB4U~Win&MSGIY(1duo(fn^1ZgYFwlg2P6BiEM{$<K|BB
zMm_OuoiOd#Z}<1&J(+QIt&<^({XxU*(AQSn!uuR!2lQQ!5k1crh3~r9F6yhWQgV1Q
z`Roe-=Kjyma80F#gCEa;gN>-3iCoxMZhPbKqH_jkwcPl4l;J7?sg&nt?i+SDV>IpH
zRW_n039_?>Xo~)g_)Kv92)GA6yM6{m*+OP=3pX4_7D?2qTbXvyRz9L+IH^Qs*TFg~
zap{!v@HMx$HC*oxUI7Q#pKpr&8%@3RpEa<+5}WoW<4Rm-C!vPQ`pj{a-5k$N&RjdB
zOie2XrIkv#+W7e~RFFQ@kCzx)2n#o;8;0v<8I4VK+h!|a_C=)7k^w9+p6weZv0G<9
zP%Mi&(ovP(s8aTg-RM~@68~2`gN%^Z#ZzHhH$F@safmh1#-Ny%jn=Z?xLyqJvYFUa
ztxq@Kfl|*uJhay8F$@Iss2hZd+Rge6{0(^F@LB%#^jGd@40-*R(GUssQ};~sCoXE&
zh`;Dh9kLvw;)T52v;7;z!DB|Ye+rDiTr{mQT!}dScouvb4g2mhJztVdZhMo79%E8F
zRrJb0{ULQMzr`%~9*0LWcs4kETV!mp*-u~~g<oD9YrNviDojnmq0jK~<G||D^IR=i
z+wm~P0<MoTXGu9D(BDK;AQDKOm%ljcTExlKB0}KGka`12q!zY$s`I*7{8e)Vm*T6Z
zGr;M@j0aa-?o=>AT+tt%-JEn@Lng?Wzj^bp@Cm;tlk-)xV>2V4rcMBDAKdpv!uE<I
zv0WSV#!KFW9HBC)^Ojp847?s*qj@%(>5|8efniB8mjxB1eNW1|l699;L%3vsCRLw@
z+g4g{hs5i=Yy<@je(vEm9i<M_zL_%v4Mor>o|`gRN?}R3C`ltZEmSzXaJ=sddzf0j
z>&MTsR<^mwxH{X}BA*sBN+RcML4ov8xxKsci?;y|>W>ALVrfWclZw49`LYGda2MX^
z0k?D+5X|}Euc^cvB5;w+Ix4Md-f7dUu9N3oUfgYYGfRmn8O1~I1(si%k0d}{w|5A7
zZve0O;WyAU;JH&nf9G=CX}B65620xh;85w^6Xy215LqnvwMv2=EZZ+xDR(2b3S4jF
zQWp%O&u!0kKrlC)Tbc&B`98i=CTkl}9zN>k?h|s8GC^N}5ODesfI~g_T-KR@&BE}E
z(Z_K{7Xq3A^;2=)0qR+PsWapyTyQfz0}*OaKD18qDp<M6<6c`)Z#U;}WBtMEc1Gu=
ziO3w5nUT0J5T<ej1yLXC7e7n0SU)UJ^H`#yf8x=A(bQpr;ZiN_%~XQN-r#|eh*faM
z5rTFe>aQ7fewWB9#4`^wz7nEqnn(oF1~t4`VYr@|M8;bs?xYxg74<*4ANJKdUWF$8
z;+<fNXo6n+Zxk!=aZ0lvemp%j-pEv6DiI?SsdiT>PM#Kb1bz>j$~4uE7iozDGu1g3
z6WKlsJd3{J$ZJ=&Q^|8^>R#kfq9;_EW@FR`u-e*mrm%1fEN;Bjvs2Kmn%A*FI+9t3
zOLaP)`fkCjXUEem4%e{CApi3I{m|RNmID%oa8aznxgN7VOaJBO+o62^_d-DUs?K+m
z6d$*lBC*|%fkUmPu%@b}eOr+)-7~0dC4*Dk{Z>Pq;$3zv<4UGE)cfcFmonhu3#Q%D
z4~xE2>%XG*q&QU~<N<c;l-jX03cA-#r1ryaiKB3B4D=K*YELAz{MgxH$peU1qV|bY
zt4%9ak-)K9p?9_m>vnr}GDTJ*w(QWC1SqqEtmm_@FY@_<bB2$<u)I8KoLTxrNiM8J
zr_3@o1)C37#PbC<@DTMzTG7JEb4I3hAM;$P1;cu8_Ey~&Q{3b_5U8*E28#AVOuEdQ
zQS1vNI#>rFD_i#f^Sis`!}4gV)rWuD(r5+i68IIU))|FS=;DUvlRxLlzcVt`aAZS&
zHoyJ(<9_Mg!!qL&`pDmmB{EqNh-h~>5M_WSzeYLau%L#7^t<NP>!Ej|YR>(`=4$^g
z4t@=s{elg=u+3(yO{GZGwt_H(&QZ2d_JLGkSiX>9@{M5Ug{z?3Z$5xxW9*{1=+oJA
z0Hy;7{9kZggX%DF!8;BGvc4-uR8ZtkBZ}PJj`oicY!_j7`A>JSJ-;jN&Xs&rHY#2<
zz7<8QC}yX4qyc|^F;s&7jG?JIm=G>ld1goIwT%GxZI8>=GdP*AjATF&rl=t<uA|U?
zCjiW-moT{l@V*r~ar(U%RC;Wv#pc%9c;qK4ldb;B-^4+`wHr6B>w=cBgW}$-T(iMV
zR6?A#GWOMUJlS^7*425z*W1LO%OK0#5}5}iY89l6^ITGfS+MqtXR}_W2MW)DXr#m*
zQc2_l`;VP%OG3Q-&Fue8)Q}@BY(g6?(P3PSctmTFben#S_^1g~HOroWg_IPYvAlFa
z?~ZAbyYt&k(f*eY@xCV~uZWcTX8bO$fC2r@n#03^)-}@+^vwu=que0?nl?nz^b-5-
zBWaU%(dNRWN9+v({gOSW9SHz5Vti2D#Uo!sGfnN{r5Vuv@|CYln*flltB3P2mSZ$A
zoY9ZSU4TJa{0!bFpfIX`NIDR(_@Nttevmv^aGNG`E0jTy<d|!Bw3Dz&cdoNH9o^2E
z+sWFSCl){J;fs$F$ih>#(w|yEl|CljdROfvXOz-LW&d{f=BLVww1r6zS%PNYNlcwl
zcwP-ytik`%nG7T;;FzOwOexyUc=1y??mqIO+K=y3I^Mryur+_oe^KDY)}kwq%$fm!
z5@CvU(#0TJOf7W=v#RR*w>6yw3{4_?+nt}Z6tv$^xa3!K;v@VyS$B#4zw`%U@8NqQ
z%QpPc)G*}je&bd)p}D=tp^W?<i5E%~1!pcj9DltDT6Rn#Dq%N5Y>kLeEFGd%x~9xe
zoGrO%GIKR(Qm^A`;EQ`IVEOmk3OyzxLp)B;tIbI{Q;_dAdGGo!cll4PuNQdU8t_F?
z)+btlW&Lt(nT&RtYffa?N(Qc{QV#D>>-4r&S(^v++EnmoT{`LTSz!Hi+R;L6bRx>S
zHZ+^)?#WSXcz-Zktx<+Ln?I3a{PF2+$*+;{zI_2e&J_kBs~1JcA^r{V$mE%JfK_0C
zw!MgbSO5sevf@(!dFAV3FM!1f0CNK1A&2{a+;M&HBJpSQh`-uN{HPW#1Ks)ikRKf<
z{-`7V<6(`fN6rI7Rr`M=(Edb6`I!y+6DTJA$(cVPWWIyI{w<A_WRH^${tDqlG+H(Y
zD9^GVa}Oa2VdOL-g@m80RlH|+I_ue%Y59;@_kPl>7f+Jq_Bi>J2$1sE%hm-n+?@Re
z!U9)AGt;DO)!E8}&^W{%j}p);0<?(2oW>y!4i%zsToCew_<wrnZTb^HB@%Ct0J2?m
z6d@f2Zp%V5{^hWZzeZ7g9|icf&or7)Uyqgohb0*Bl7ue;ALOm~uM>3}p<Hzo`-%>1
z?yGx?EdoCKiE_Dd;`Y?`xDN5q@GJ0l5rOE)&*EVqAb|7NTmQe!&HwfUf_w_{izXQW
zP3-=8iNG+Q--mrCojn4>@EetCsQD>UfhV>9{5aq>!~~#u?%&4XM9{i~Kpb+l8CSE2
zMMaeDPwHxxS67x_HV|}@@rgrc9ygQxu(4(HMB(wjnXpnPAie6#2k__At3bXX>6{-E
zkP{*qPo_`>Tm&FGb1Xg(@rBMB2$SKzf$);OI#)S%ej5ewcMG7un$BaOdlZI<8F>Ur
z(~a>q6%bE5mip(Dz-#b82I@bKQTTn#_qPLAsi81^@{?gGksb(}oHjkec&G<>Ip5Eh
zO8_qi|Kku#Vt`>KZap9m=D)_KCedYIoOz>-pmw{OCW-d>l@7*3#{Y%_b<+eN0NG<2
zEsi-8h>vdakoI<tN3y3eGN+3^3>scA)}K1(sbzFdg$1Yb5Qen-U*2neij?2^;Rmxr
zi8tzg3e693DE1EnEdseLf65yhAaBwCYRvztNN&=z0wsHlKmiyMMD9rlO7&5!##2v`
z7d|hak6wMA^-Sy**5Wf*kmsyN#^VTVJ^BAnb@0C}lK*O(NI+qoe=E_pxq*pzenuoT
zg>}H`E0W1>O1Lbj=T3Q~d3BI<S#8y&;wP>P<1MoatV%2$J*z{0R}qa4sJUUd5CDCf
z98FFvX9EFEa)2cL3|wXwiJ#)z@NY<1f6w~=RZ8(2B-TG7U;RSB0ty|FbO#ya(;{uD
z&)7Eni(V@gtQt>Vn0q*kPEOl$%G4cSWH%mS4Zh|$vBZCi6>u^_{2(O#gG71p899*?
zCU$0m__4D7It?C;Lu|^4oC(iX_3rQ*G8vppv-n7CN=dyB({GlQ_9sbZ5mlReX`IAW
zD#H5Fq9oC4Y0P}pALe%CN0ijHX5f7|Ir2^BR*`*b`U9{#RAZzYLIFf)fR0?>K<|JH
z^}d~ZU(4YrD#XVI2sV`*&$CE`9&{?c|9&|J<9dUEG7!aQ<I)Q4JcL{^P}cF|E@Q0M
z&<;|~G-vOOwd6ITWq555sd$L^Q4{aTMbo9y8I6A-pwDEYBT7_HTDtYHXHZ!@QlA_O
ze<<2t9~aY*lMD#mC7EeD;0nU;WJUFRTwC&)H!hxXlj<Ba<+S}ER{yUifgB*Ja<{uW
zx~{1bBom@B-WV%f>43IDWf|I`HMc9$%xNo1>sBO=L58c~V(}9XK{HQN1O`)^$zsEP
z><)e`c&#i)VN{;slu`L)rZz40KtblMlkYE&7FI9D9B2Ac_6ojX{wPHfCk`Mr;E;{c
zm?F=+re^cSR;iygXPh2_ph>Z90-y9}cG`TvAqgWbn$j(3g|@Ujab?Q*;m2BpxWrJk
zv*_jAst*rnOIQIEr@hZ%3K_K)^Qwm~JjG60VusT&C<cc!{f;$(kwXQO#wz%$Tvl$X
zcLfcOP}-(sgw2zWki>_9{&2ETx|N#r<sAl7^(${YpD;B&LCNq%=$GBOv*7V=m1z;h
zs0cPB-NFU72MIfywduhYE2^V68eJ)<qLk;{cn0;;bkyY>q@vkyanbnCoDPk3E?ByA
zi|VEN3`LPiFDA@HBl6!EsaV|-JpnH_c@bUXYLZ;pv=Q2HXt=zZ%&_8Z<t<h3Hd1Qn
zP|@E-a14FOYiGuK^3@d%>8qes^*xoaVh`<$`02GH8L*ND7NWQ^{%A#|>{l}HKp%1@
z(Bf{~b>Vikc9v)!*16e)uOjqtF+3p)Pp?6IidQu(LB%(}(>#&vl-<aC$}2WcoiF~A
z=lL*(%U3!mEjjkf*AsIbG#DJDN=yYA1WQ77On5_gOg$-rI78;{b@~lxPzmRJ5{L5;
zGcZotExjZG{Q02N3|PLG@O%_uN}aE?`i)1&`S)#@M^{;<PF%h+%a>V8q)AuDd9-7c
zBfnO3XT8oTM^Vdv+&GI6wH;4-)IzG>&tdJ6+;DqYpK;<YZ0DIoY9ww&FM2lFN3FWQ
zaMs=JU0KY<^@-vkdm~kA)0~BKm#Y;g?!W{v$-tfIR|LC#JadWG)TO}<B-TprFmG)j
z&%OKJuP(+Y`!F#kjjqDm&2jAdWw`ccp+n^cY}$vR2gRPpMypIejo)^sTG%k1jsp18
zXd_zwBK~x<be}ys`zcSW>w<vTq(L{il%f)KCv)zo%(B2}-o>r@*3Rg}wFVZ_ZQPlX
zB6VDb@xW>25$CDh)pAGstbL(R(<?^IK{w7DgD~%R=ThFcq|&-Wxk#6xM~Tx$`zjU1
zl{9(AO(kCXI%-y-vk~{rkDjKAsqX0L_Bk)au_~i8>vytW@rv=v83ZnIWlwoH)+VY{
zC^GZKglUOpet%h1XB9+rvuSSM)dbqIF}7QWz=JjLkqwz~-jC0h8P&hJ<~PZi*#v9k
ziBh8;Tg~8HS@Pyz^sG5?7YHoh*4avpl0SuSZ@uiO$Qo|eJKeljs}{B+B_=svUzhaY
zPVqU5j6jR(jifEJg10cPW+kGpEpGdQ*P4(U{=St<!^-@sO*{ALj&`N~TJM`VeDA8Y
zPZ4!zQbYYf<t4c6lA@&=WRP1f+tj#qVF`5Yj{MtAub^{Guq(GxWL8pqu!!c=@CL=f
z)xhlc=|)RNQaLAb?nm1{8sV~{?hKa;ttch6%iYt~QblBZ$@#qD`e@1WH7--}a<sZA
zaT(jTq9Z&lmCE?8asH%KWN8PF^Ga+j=N05dq6=;SaLnl34c&a@%u4HVCh_{r7abMe
zhmZR88g{B)s=9Ujgx0*wB1^Z=nvk&hD1JH|LMI8~RL30nG|Q&jb8+M92TaDgCH&k3
zc@J4d-Js-<8j_)^kel;n4#eW+WzW}{iB^@@3_V52YVc37usF*}Wk#%CuA&m^=qTFb
zU+8aiPBZ(SH4?;3X6uu8$<p>^+`!hW-l-3LWpGSyU+&)1Wqo<zl2MW|_Gom1h$4l9
zIO!rT_?eSr$eO(BOy1e*lEE`#eKaBJ5Qzs~Dzgx+S?*P$J|-thn0!tNFM<t1TKo8B
z8!2R`+GjWOO7(_nZ}2KQ)}ApRN!5CNxSjxL1mU}|=qN=FSkq2B+Oq{2jBd?NE-)JH
z$kC=dsO@o)tVO-)iTg4W1j04HU3>29qi%XnqE=$WD#%pXT<H;Exr0Wt%tf>y&idLI
znudYuj`winc|L(i?j7Xw@{MPRQzY<PV$ThncE|%K`LjidU5imZUR;FUTUps*lS57B
z!PF)UR4B>qH8F#X6saI929=ot0onqJMoO-?eXIr?&hSVKDmWp&MSE-j(`m=%Z|^-E
z%9WaD&~wS_Md2{eV=>rlc57*XwYat!Mcr_=18=DfR1p+CYFfvln>2XrEnRp;Rf=lu
zB0jFSSci*RCMBH^g<dxtGh7-jF<8Q>IyoJF7RCSa+_|Wy_a1_{{0r~NM%+BMYoQ&0
zV3d~x4yNE>GCM4;skzzgLRHFq%sN_KxX^6QLdW?FMvc6Vb8Yw2cEO4SJfDQqAp*=e
zYK^Tl)P&Nj-e}Oao>TkW=u>?Mw(dB=pS8yFC_`GM#8*VMWWdUm$4H6sd@$(sps?x)
z)0WUkqjqQoPn#k$E+@3`0bFR7Cb6KJvZ7So$9W`Rr=+EE=y2uagwk0r7H7w0^v#=^
zbgkka0Hm}4-9G0A)(MT=>)f~tiH|L>+%+czrSNCarcQ#|wCIa~gAI`m00jmIpVH26
z1gaU(&tjcaxM1~dy>FH(ITnk2Wt1UytskRPfVz0k7TM``Q+jN9McH%vguAC&&xbNN
zKY#n0;h3D)7L^XVAuv5GULaBc01H#I?FN^kNU@Wu<fa%PyDUUt$$K}4pa-OD_~s%;
z??4Yu9q|={iZ&uPFEs<6`7RkaF}-jH1KoZEmU`a)RfYM(?fMQ;`pf_N6R-5=A87xA
zDf<&^jPV~a%l-+C?8k^7Xl4L3*^gg<XYcd_fBC&Z<ae|$syP6WWcOBdyUYG*K_G2T
zB>;-t-lf2~kac<R<K&hu$ib<%BP-iLhK(}l2QnEn3RSVw3LtGT9Mmd;;J5LQOf<6X
zyhTC`v1Jk6t`hH!dMGcqBw5eL-B9kJ5bB_~fU+pqv?LVuOK7@~sTKA`3}HbMaYJVZ
zi<wLgqwFdS`6{j`w0wEygMA|Vy}AfJT`uD9#!QT#6&Z5`O42A?*m@p6N?0r0OD?ZG
zk`vc>ZtM1?7())>35NBzr=eP~L;%LZ7qwcQOCBU2s#Lt#TU3@aB(zpHT`J!sHO4DE
z&%2o-O^e*DU{zaacv(|k-cX*<N#ISH!m!EkJY?nMFb4uI{wIz}5?S{Z-sg}QP=tVi
zx97hWLGIxh*<3#>m7PSFt`Vkshzm~?`-m?4k4bllcqGxCd<4!^i>C^(iPa1@#UE+Q
zVk#<%7*Rhx)%xIkBwb(W)-ey0GuBtG9^>n6xB>uI@!)LR1Q27>GuqAJsbSEQ4NWz#
zwrk8<a{ys1R%uJY-m|7v(hVA|a@!5RY_tvl5+mvD8(0sXH!#@mnP|}J61_XO{UazO
zH+}PM6xVnQ)wd-vQ?dv7io&oS!c#oohv+ep53*V)Ed5bsS|E8fgrp?bm^~&j5$^lW
z!t3(H!(GAX3b9<XC(??i{l>_WDB^ey`SWxcqG^|WhS+Xe5wocF%KezT0NvFah3lab
zH}jF@S|HnwBgT$Qy1jnD8NQM#5M=`n<6_3qhu6tG&NGB1-l}hiTK{ai1GcN|Y_z3&
z8?jqzqFy0+;V!ko={84<c4VL5;2B7H&nnV=UuBu=WWuucDbwtv6ef*9yFPTE^NoeA
zIF%!Z@4If<7Wq`JNv7F1@Bl}mSn?+}zXIwWN<HsxbOGptrZwfr<qCTD7|HuSC+QtP
z<+JqT?Su%TYL+ovl{mI9xy;2*eC#T5Q7Y|dxs#W#HRC5H-l{USW*&yCV;4hQ&eE)N
zgDVv;`1O7R(KIl@nPO)*LbiFNpG78@&zDtnEvUmP(=<zs(|8_h)O*Z5IV9M^&-(~c
zQ50F6vCj)PtE^Qz#}_0i^MnT?e^MeBL3LZTA0<E*lo>%-xr`#3Q_dcCp?65(!F^(T
z;-{0YMtY?JTr*wFWKjqN`N|deO(M#{!6aTqk(KGv^$c4a#+>=lB&YMyLG$-*3)L~7
zt}moN+YNEM4eEF(Q*2A7R>li7p;%BeDN?{CN8M>T6T6gi4gJDJ;l*Q&5-nn~Tfvdd
zJQ2@XI8G0vjFE*8%H;$irSDWmt@p1>2iaLG@jhzjMt}M8AxMwX|5zgj8wrS9_!q!@
zt^zkga=ve2&|4LKUu!j?nkUhQO>wvzY#uhpIn3`pYKeW?!MpvIZVcswK!aNo?u|q@
z9QOO15FH5s!tVyrnXTLl(5xB61fR`*Ujm!*j4XNGSs2)k3+jw61S))?Xpu%#IdfAu
zILwbG$e4dV4uA&}@XvOX`*_(ZuoDNfc6XNMxp-Fnl0t0L9#<kJn$BL4y$@sTLwBK{
zMg!J&E&n>Dg~V+t&=C+wV9SzxJdM)ZX=LqmnqjnXXERps-Sf69cR|l)PNZJq2adU4
z+YN`lPSe}%pvmvARJ<GDj$6R$edY;b5?*)x%%mi_oBWnMF<s`_5>2O#cbwT+o%O_m
zgPzwd(5ys08XnMTsH_ky)jaYdGHLD7hf7|GA(t|fX1^x3Dsl|K%`wT)CZo>yf$dtk
zaP~l5fAi|d^yh~k2b4!Ukly07{l9@+rboj8@VWpZ)%89_X_9Dfiq`|7*;j><qe5mX
zuQEUw!%A_^{7SmmXS38G#eA1>?IzirRo`4cpoFT=W^mPQMK3|~0@mD7c0yTpyo;hU
zkKeS=^XRe0cq$5cUm4s$+jXo+b2K$c=}hX_Y|EZzR35=ayn9n|{IK@?ZlbP7H*vDe
zmi5CDGzkbeLF^#M$ph0kO+?6drs1?#Oo_H~5)pI;Z53_^72n@7x2U^(C_sSLT8;N&
zXLKdP<|2d37!o5<a@h)T+>ZBDZ-6-+=n<3}Vt<5~ir>KYG#<g>2eg|O2cAzSqU6@5
zT_S-3W8HbaSMQx6!;0&5Zpaw8D3A`xkEd!GFVg)0Wcm2fEh`EU!*d+afw4;`9WHWa
z)knsj6WX36y=&(<XKQmeB5(ef*kOHXh?Qf3PtSN4p)78!Iep@bP7I`;QI{vW@nu*e
zz^ixdWjTyI+nqd)4eVR2w8s-hPJpJIiU#FDDOL1>qg<K2R0Xip1PneZ9`ACM$hUt7
zezBIQT}&*gD>_4jw&vT%j~uB8xq-`1mt)8W*(=)I9+wvO?m=4;W^n+34ql@v<q&|y
zQS4GSeHs`$?NSyGUy^)hPFJYsFTT*>%55<C=Jv&h+N?+hU^z9$#yP7?m`Lv-=6xRx
zyhq%g@zc;F&8mtz#>h`c)i%nwno3a)-F!Cyr)(wzRk|G?lA$hihw~=p-UsV_<<bs?
zlE!tu8$8pDhXx(LfhsE3jAxP$Lqi*`9K->&upcgSr+8sUgt7<MoM0Ec3iU)JJ@UGE
z@+ljqmJdl1H~?>q6Q4nF9VGJ+kFHLAF(L;b6lzOXT|=x?qm;?akwY)qv{<;bjdnC@
zjg40f3tcSK*Va#E#7G}{(bvXmz;%p!CII>ziqksWM{Y@F`nvzf_~yG2xc1ScF<y2h
zYnqE(<73}I8~{;)OjKEtJtj36g42qoB5t(lcVvG_U}RgHoNRg1;;NiKb^3{zVYKq?
z;}%yzF-LCqL7b-1E?7kXyx|m?&hJxAbciAsY17zjYQ>|*_u%XC)Tu_BzPe`|@N`jr
z=dhNMCZq1p1x^64%{APfePI{v-pd!0YgayjanC2D=ySy=k-hYkQ;0@&3DnUqvbI5W
z;<zG-a19!R2d|vVt#zC@ZkB+kKo2OMwt{?Va8N=KPPHBCpD@x2FyH7zqbsIrec)~%
zQj~5odHbc}gSdVUt~w|9{eX|Otg4+{hk?BehU*e{F^TNcW5^lP=?Hh26KT@Pb_i2C
zP*(kBLe-%%{?v_1aS4Y~rrU|vk!G%zGt8^|_!W%M^con?H_KrLE`^2;)92D?9`*^n
zAGXQj{OJ<|Y%mvbr9|#^TyYoqxN7<mT7Ok}rgnv2PX_3lWwt#35@hwp{rFn5l<W%*
z{%VCMoVgS)a7YqkTYF1_0&rBo7&y$%I;G^hx#J`r6=(}$Owow)GKZ3JmE5TZk>GVA
zFXP#jVjOg>7SE?l90GcuL(8d}j+2?8u%!eA`rFa>0`8SoS5Y2$n!<Ff&>$aP{E4$y
z?9w}jt&M;b_P%x!Q}ArXdxF)zCMrlGJF+7BMX}RYJdX&6IOSZFmhs?lJBcxyH(2i=
zN%D2jco!tpNVb)GIc-!15JqoF2w=s$_HX+2`yD-aO`@R>Cz;ZH&hg2c$O?LuIf{Ja
zlRMS1V-f00rDyqJ24wikc+S^_Fny4%$oi#^q)Z&&7hhK7#2vCrSRl6>mk)|O;C}ve
zp~vP$L4<9pcqcW?;y6<D07c(YfE<@5*uNwCIAuW{-XR<&mQFfGUs@{4RXH`<HAkAs
zRqJG0gqaPkaR~z#d;YIrBTWfCK%*;KxL~~2$b(`*XWccUl1aKxPNyR{qHEf7-_kn}
z_xFLDx0%J&?JU2(6pn%THZJh6&4BVdjntB$ib22C)=zhy>v-|&%Is?O)4`NS*2)1~
zt7ffwVgQbw;5G=i$6-Hp_B!ks70Nmd=g{&7C46q3^_r4uv%FNw3~pk-q^Nd~-Ee{k
zNIpG@AzGWLj=$iek!-0njA383_Db7ymONg}b7+#s;%Y3*c)Jp`+V4zn*)$E&QVsVx
zl6rj9Udn?Ihffc@8+2^=58HR>D)>B%hfs?m4(wlP#`h3>adbVA+Zi5$!f@#eX-AV?
zogPIrc-Mal!(%0^U%<LDE;hwnCCZVHH{+)X5viE9?AUY?Yig?>>qwoUmv9;uv9{u9
z^?u)}#b&9YUC_qxNNEXNfR5NSGtvvjX&&Pla7NiBQ-AXEkODK5KMOkB^p=tj<hHA$
ziqQfHeFM>vo^uevhTMvJ0=Zo<58NT8mc_uY5fAVh1jG<Y-i;25=_pM&9yx+Onq%#q
zIE=B}%-F05iWaE;1{$VM41nI&U!ZC$gB(T7WI(7C1)Jm}`LGqQ0KhKw_zcr)O~%)z
z*VK7F1fa#EULIPVW=1%<94GM}<SKHJyJe%EyYS&_t}iZId{L=^$H%DCCE0*4*0m)V
z5K^Zu^ftbm6zGFEd;_7yx(H@O4ZfB<Hx<0l*AarZQ&3zy*xIqHpz?!qd{?}^!O#Re
zGP!D21{|X(fjd#OuTBy<$VE9iF^w)8Awr65a4%OnqM92K-Z0<nz@!;Om$KsS9!)#y
zq#)t}7=4<ci}QF%nII@@LAp7drdxl`u9rqF$*t3*4fhVRH87BS)OIZy54}m0*>~~#
z{0+oNa<zuM%Cs}u>bAC^o7glpG18{g>%A}XdQ<ycOEC3u?j+ig3}Q0@caY(CYRO~z
z6j{oz+dDXj%weKQt(mJ-WNZec-^m?O7Zzf;{ITV^)J+TakJt7?j#jRTr!6&{1vclU
z-={Ndg#z-ThAa9Gg%pQ`UY<5-8dVrp8+y8`qAI!FzE)uAluPaaGZ(G*s)b@AweBD5
z>7k^%1a2HW_4VzES}b&p9#@IcZ?sobgvH+7lD{zQu@hH19=T~&ge@>WU&By4b-&q;
z7bN!So)Qms@u2)0$njX6@HY_C{6U=iSsdv)0V%itXu=_VV8i$A5?MPnGF4PF>4fLn
zLW9sj`USj7!9E?iT~;fhV#IZ7xrReg@2!DBmn&y=)UaGps&s5w75s7Kl?BxGC_t=_
zDDc?hrkk4RS@zA4SHbE;dLRnwuXvF}3$Wcb4xg&q2i2~rk2)?&i`9@sh)wBih0N(+
z3*Ml|nszEd=wVc3Y974!>|(G409avzdRmzxHljDtU6hF~lQMFS6;NB@tQ;>s7wUY$
zZpi9V{%bv!iR+fR2QL9YDpVNaJz{kn@6rSTvP3Q8jcSJ_6R${kWhJ1e1PT~cLgAym
z`31_GNO^aef@$1MP8!XAh=n$l!<oy4x+|Uu^^*gao>;vRS*W0GaX)wE)FU5|EH&sW
zVl05r2;r==#P&QhQ^c80HzPv*XznHe6<)Pf#%~Fq@7=)N%Hx_p(wiFVJjP??N%w+K
z?q}Lf>Fr5k>O3yk{?c7LC~IA`{k0zcrR_*a>?YG*=+6olpyWk=j-GU;fUF5rkP~D^
zzk!x&b&w;=q^AJch7cWvL}PNh9QZ)mLE_Nf{%?8SBS4;aR{E2_a=d>B_Wr#g?DwDl
z$oJ-ddnEHmCis!R;J1LbFn=PY13=uLzJY$mWqJ;dP?4i+kXb7WsZXajZ#P^-jNV3k
z+0WlIYp@JJ%|XF<?QbBB7h5C|@;ulOSoWjKE_J$?dU2zHI_ccyxZ#?Lcju+_Vs3^i
ze0=8oyp>fhiCYG+{KK)$WPaRq*xI^tooK$X!@IEwbw_dZr&vM#Q?9&Px08$C?7rNT
z8)-wlKd6B_5m#nY(T{eR*`(rnFxtms{Zp;V9uvla6VXc9*j@9_y|WpIwE90mK>%0p
zcb_V8#E3+>O0HGfy~Upo0~#apy_I%_e*>*)wCgc#%jcjTuZQvH77KHiRmLsPw>)gh
znjD?El-t3(2fBFP_hg5|#f2a=tFW_`L0YIrZ8dd%zL+}SlkeEAazqFr23R*-Ip@nx
zf&w`-hxl|pT4fM<>duG`EYVzT^mO^_=;zW?Gbe5a%pfWdQEn(sm`Kw!jl5)jbqU@x
z>MQE_N{sPFM5fl1Q_Hz)ppL6Y?><+jkX*79d!WaOE|;p=b#WR_Tw2MV|D2RjqX<-4
zwTlEON{>u8rJTUGg%_=eIt$s_A}Dt#?sxgEaa2;owt6Rfr9=W<2l#@W-83dCn%K;e
zA7kFBBumz3x@tUNyAbFv`=r_J!QIVA^fHpWKvC1UKnqzIKN10CksT+g<8qoc*_)&X
z?1wL}=xum;74$f@#B>Dd(7lHof5-fxLuSUS18ONZdSH-_l7=ho-zQxId}M0`CET9q
zm2Hp{=Du;#(9ZLWxO3dlI@?l_b(Hi3>mB{uI-55OC_0c=`xGz0y@~hm?TrXpzbnf%
zkkB$@sHmAx;KCa_f`~c7lI0cV(r2=jAj_rq@LlfMh%gxgll`zT628CTlHVYNQ>4xp
z+v6`A6^sGyyJ38HYx^Zugsye3FANJmxGPa4(R5?;j%MfS`z)W2U%60Acb!mI6;HT>
z+h|9g_@Xlj3vZ3K%>gc8Von_&Lh|j4wQV$eIdb!Ul~WO;=bkrzytX$77nwyKBM$pI
zj5nc^j3OF1QSrA1&&V%K5oo=hH(cF~=ehE62gyWq1y+E5uZCAi^u>#}PH~NV6{wmc
z_q{J0$Sh0f*A{%;o!MaN6}|u}T8MbX8^J~_z})of^W-{vke*2tDX?dwOL;Nt<glGN
zC}gzhxKh$HcGvlC(B%+m8QPYrw%*JaH-!CCiKzC5<3xnz(VW>L@AhUwyqK4$CeV1T
z%tg3=oGJ4@jnkcna)<5Z`2eL#0o$C?KvBZ{o6UkasC?L8uU}itzV%?Vr{2$$+zV!L
z1FFa<P&TO%DKZ1htFp+j2S`bQEB75Uo#HAr#M+Nfe9p|f6wF6S8{6$nVi<%|;PnZg
zDv1I6GGDqdJ+v^}8`Y(F?e)`I(v{3d8oI!vjSLJCX%Ueu;Ik%+jJpy{JwrwUo3SmB
z3fnNa<t&uN7^aH_a?e@6kQo~iHQ!YXug%rg4dqmT<@=v^o~`hZ)4ea!Y?U(APQMnP
z>wqYY3&htd_ok(`Ht?VVu9gkliX`Y3cFR=GZ`FQ0Vx(1#7Of@bJrdml!*!riKp()J
zHO)*|O6L|95ne`r($4c?2Lb5CA*G>S#5eYu+%58Y%EB2_*O>H3)I_>j1P!@Yjtg$x
zRTO18T8|63-C*44kaBHeX`Gh8kX~}d{-uOt&!?^wV%GiYZNMe=oI!#NuICdM%}Q_w
z$t~%}7Eo1DXz7=E_rv;`j#T7b;g~snkHmv#{=lUeWeBIoYRW+kL>Jg;a*I7|vp0ki
z!I6H(Bp<wfiwFz32mHP=%8&0$FA)ITU5t=eQ~FwPC5C1FTvbI)42_#%QnuN-x>`%V
zgfD&^^;sipD2%4w{s(&8HN+~X$`q%p9Y!C|{@n1TLduFI!TP9)i%9z|>SCS8;DWpQ
z^G8wpHbi6_fO`^5ItO8>JCB>zz?B~W-E>DCJvL3v9Nrr}+|p_syiOUtncY}*e=dQ5
z*|+ZT*}q^n&E-~fR0gh%rFkvkqbZbW?(FWhaQTSHPTh+DzMYE5>K=(|mfh&OJb?vd
zPy_fNUm}%Z)B(&WZ;CnayipsZU1?~z)NiC=FZHRNU|83-brM3ia9C~5qVDhj7PY30
z_v>j-WgwqiW;+vzK~Oo!2Bl`(#}8|}E51YP-Pn+5Qr>(PMXhq0g(o)pbyC{nuXn;o
z3&Rk5mvAVf8}f<mOd;Ac2&pLCSmaw$E?`ryp<Y(Sl(|_^db(uT^jU;-r-9|U>eQ!@
zvfwp(ED)f%I7~h_Wj8>y#R`#2-X27C_F+>5ir82~YsKED*u;%BM$qLKUKa1>hyY}3
z*aKN;FMIUO<08k(=Syhc1l9{xRWB^UBsdKxL#P$YclELK<JViKgz@wd!gV~r9Ug>U
zVuKbsX}@Rlrf|H&-7CNT&87Z{D{d#71^jt7$q#5_r}9X8M1Y?aW}?TkyL3v=7^${s
zGl~!vQdr8g&?e!G@6OD+X?-?4v@8|7C8Vf2Xwtq^`IO8Lze0TD<m!prYGrc?H7|F1
zubAw~^f59@g}uwB{rYfi4QUrY5)1&zzb8x*#St^6vUE)F$JvevdO37S8npVSMw{ZL
zR`GA|2?ldZiAS99ueZeLw?SB8%>Z_oq?6USZ^nly?qRn{xvr4>gOs)@8H+8I+4@S+
z2^BFpYAuD}$IHtCTbbm+X+|W(b|U~C_tYt8f^?Hu536x6i&a_5L8pqgj0iC_ES%!j
zeJ3r$m*nK4f&;gtMy5~_@!4=1;$-ep!-arW?|YxKGFI4p^Gcp;Sak{u<pld&Y^o_0
zoAnn@O3o3WNww2~9wByNfonh{c>u`JK7>m#<!Wl{QZ5}tm2I<oCawycZ7Dp(318y1
zxfiL$<Y)6>mdd3aajHR{#M#@xw4^9L<QC~@j8~0vTRXb9Ioyp6a}pz56FVoeUroTN
zb^2dnd=%JIVTVkp)5YtzdaJH!&mf+iv6&{H0#L>5WV18eYs74~);P~7#5f<)r+p-q
zv=>G+ZiJNSuZ7Nv<36iNPM<Jt#XD%4we`rF1n*0h<xoyYZ)m?>Pkf@g>H4upf<Lfl
zWO*w(7{vrc%&)neiasVWa)!)0INvWUY^3l`!}D<7tNZX&(cACz?t><uiw8izcb46n
zrDr6!?Ew%E5Qg?cc<taa<Vp6_(loWqnm%%G{+DM-E~f-e^@?)4J~a(qg<@7*=*V3_
z4Y80pdUMJ?&)4-_a+_mfn|L>mG+taTMtv@U?VZVv_G#iulOkPp-vg3P{`Kr`tib5k
zNd;?O_QVdQi`4fy-h*7fW&s9XVmf&0#4y~ou+h~u=ZjwHlu1^hpWD<eff|(?A1BL|
zEX0#20Jv)&Aou`j)ux1-5Y2^JhXeD8*IUR!18!YD0?C3MzE+z&%qenlFLPt(oeFcQ
z*EhoUJ+M>k1zt|hC)F7{KQ1?)eHC<!dz+F?kAl64e4!6+3%G!-4eZs%-695+VasUi
zFZf$&FK0^{=eU$+wv31H%&YXC^5A3gN;BC`!$318v+8ui=bne`kF>vG2>22%{6X$e
z)DU5f&d}dnneh(GUp)+UuF|M0e~*fl-KP2(!@K?~hUc)G@gs)k^F4;=@;!zp`p+>u
zC7}CFL(<+M{=L3GdLjN%gbvi6s}BFjt^J;~3q;E}bJL>+0fgGW#o>Mr-F^QVh|B!}
zS^L+2(5M4F7XOIaegETcO^N=%vjwnh|BS@}0lXg(J-@3Y_HUq<A4wkHKqX>8HslRE
z$-M*UbMVn`pm{L}Cu;Q;aH{HKqw_=k76SCMA&-Gec3P2W@a$qUA_PHCy6%E8hEk52
zc5r1HyLUI_MvR=f^^WoE>{g5@ALL=hp)ZJAU*6JpAsNOHjdv8!0_g4-r|sycbr%wz
zK`iR<%E{fIVqSyi;*1SWY{rP$vS*ms&ToFE-Xo{&pHrGajv~ws;uIOXm_Da@WlW&6
zCa2fWtdqZN#Ce5n@N;&2*saLD*Fgh)taFtMvJZjr7!hr8BAA_K6a!0C5hj^RYoPcO
zt(l18@Z`Bz%ad90kCHfO!-%#};_-bwIK@G_A2-S2Aik)Kp4kq}h^9$4RvEVSQD56|
zYPL|zGR@a_i@7XUBXcJ+(EC6o{RxB{iLyeWcd)^0RJc^abK*d;ol7pv)*#9_nf_Lc
z!Ky^E@ZqQeXDfZL^$WfWcZ@msPv{>~%p(E~cia6$58nIHl3@LGZ*e_OR^7vWZ)k`b
z$LtKhZ)SeQa)-tF#p5^@R%AK<TYAoeG&o%mNt1XQPl1^Z`gC0nFC3U_KOE#C+PXOL
z0iR7c6k_^G?4jSQ&FuPprYX3_K`@DZUz*r;J6siLh`0LS{QJS8aBa?%Jc~@h5I+?w
zYum_>#zUbTPoZf58_#RiX8?D$y7HDY?5P3XMM!_QoxvilWKZlD;dRPxmvg(1x;d!D
z-q$QH7~DPlC_ng!4?P-8ki_SNLCg=pg!@FN{OtEd_6(zP(B-W<i~00d*;TJn8A{hZ
zEkZvJH7$l6Tu6Vy6MFMTh<7f<CNdnzI0RCC{p5(?0=Q*8zQBlu<UXsQYC6!+CHnFp
zYCbf&yR&#?@fB-(k#C+d$Q8^0KkqX;4T1$UCfHPZVG1T~I(_UU6%<v2mOJekLl#44
zt(^KQ*bfC=ZM!PDyMeg^naM%W!rAR{H2{A8lzgh@lW`+h_Kt2fLz!hr$|mb!4Z+;Y
zG>5kCI}48496-{aD4rmm-#=pvqbF$LA*&m+^$#4-snLkC;_~`yW7KUT+q?#!;+7lL
zPd<w%o{<)dxfW0cQ*D|)f@suKJWf2(HKQ6N2xmeru?ad^W)kD}mN91NPYh?bgxXjm
zZmP6yj)D#+&piGv@qQ2eTBl3FEyyt>cBd7=1nX%z1xs&l!`tg#$leI=s#nreFF$Vm
z42T{~bo0eYi;h*w&y6%eOQfG59Oy)Jh(-7ug5!{z@vL;DWF*)Cw-_QnTI4)iwz)1;
z%$;)5&{n1Tg`Y)1WuEi@W9`l3p<e(0;gO=URrYntnuL%gG=s7wi9(1W$reMhWz3-L
zTlTb2AtEMwvW%Sw*|#t=w(K)#3^S(RTj!k5sn0pz`@X-w$NfhS)687+Uar@5y<gYs
zdM+uu4CbFPC0oll#^piW8jsTv*A+Y+zUSB!Iih{2aiAV<!m)lvG!5A!rM6zxGr==M
zKO0~)+DXdX%|S|$p#Z$6ocfV1oGOUrPZ=niI{XbT_T}Tiky(e@RITfwjRfA{t5=0r
zec;D;>*@sk;_>K}YGBw&HGHJ_!J63@KDNv~d;4hPKso7|K-$pf&hD$7`@*r*Y{CQZ
z7~ghM8>aM;&^h2xytH07bouj4RyS`c2cWE)0B3l$|Gm4yc9i|-oO^5QM2zQ95X6#b
zvnQN!ksOSxMu(cG()JT-EMxX{Z?!0KE1O)heS9~4<)w#(*zF$iGjz}s7s6l#5H4Wj
zkqr>;z|c5kgGDL2NpEbdo>e954Et6((QdC#`%J7W(@Wd}y?p$-E*XddIx;`y_=E+m
zQ7N;;v9;IT-Cep|MP{ZrsYma2)qq4zMTWS;%^I=k#}1yg9`~d^)v)8@$&%=L)Im#x
zFd-!~geL5?Bg}MO#A?7@M!HD2B*HCN#+Hq1C1PJtPDCqHodPU>^D1M@6g>n)wIu)%
z1a2V)w3(2H+op~}hCRI_bNCEnN;QbO2a>OV;^eC59b)D871bYc%-)TlvG_HSP`l}X
z^Ltv`o6+)#BZ~~!F}*tvcTdsqvr1K_5;G}Y^$qRl0;iX3(GW0VKXEDy<<=90Dr3!d
zgW|Y|VbO1#Nhidlz2+^o-4p#2R_M&-lvt-TRI+zVfNNiyE<lJw7?mE<j$n8fKCS?3
z%{OwWS7WOi>NQgCNIx5eC76q`23U|bl3DV7ZG|6)W?ig1G|b(Yc~qSqsR(0T{QRs>
zDs;?}*W=L9_D}p=hg&Q-R_s#Xncm+}*nG(OFQQ~uPX{cDQF;@4`;YlPDPqJe(dx!S
zxj2)m203Q-6gfiYPAo7^ylDN<64`jFKZVN~RSFOKzD1P5<aFky4t%G)RqsTXw%b^U
zCU3txcT2?R*{uT_9<MRl!X^oT%{AyPFlz#Jm%Ujg<KJc($-ifrhFSl%Lc}=bEaJ#+
zCCWi+X$rXdesxJaJj_?<c%YV`327BC_3f^^HJ8Itaj2iLVMmVMF|O@Vy|yJq4p0iw
zcV(2KPR5X;$O_J{sESo#O|6rBLwCIk`R1H2GYPg-b9l|=7i)<mr2C!ohUHN%MS-@L
zNN}>C9kBJ}MM!IqzQp5>DZP&=U3AGjt1w}`nz*$;$U?|Mv{mO4zD{R11bPe3Py38i
zCay)&PQb<&L;R+DYm`N=o$b@k()E&VI;1STEH4*X!Hj)7pM%T<I*5~cjeKYt!$TXz
zFd)^P8NT>A*88Zo)V&r<F8ma*WPywBh>>Jg)>GJf#N69`rT)v~CFZZkOGZF)bWc_A
zwBa&6=icMR)20RJ6{JgMu_rm5!ba95-64kt0KTzMmIaddxN&(`qlHWAC9O^&M9HFQ
zh7u(^tKy)FNY64*>kldVMiZ<g2MA?i&tKW$sr#&Me*W`p)U;EE0V+*_Zi9V>Q`C!h
z20Wm8l71Hb5Rkq`*b~}FJ_AT@zqD56x^u)Ug>HGDyx+PgbbK4GB)*qx6qV^6&pKKj
z@S-Q^Mlg&dN>-d^12!N@w+X05n9#F3!}k^P_#Zk;K4sf1phPE+&0fz;H0==(h<~tC
z5d|U_ZDA$iR-teMwlP&Dpbquu(s)Dct26SM<$>?Nev&=v*4p(B;x-XrK9+3!w<=J|
zHa#!}<pZj07KF;(I3MVa`+zH;ZFwAuEr+eULb!nZsT-I!4aZ_ZNKEgZmJr#*ga$Yt
ze)%^v{a>K1Kj8Iyu=>ATr~ik)zu@rc=i+}Wi560<fCc%OY-6Ol2%)<#Ad}l~by1q$
zD3Rk{#hcCLr*q~Si0mlow$Gw&D(;?9r3C2jVEE4-aLOZ83v^dTw};S1Ne*=U0m^B|
z)^Q`$zR=hK(jLHQ&t#Q3eU?e3(73p)y&dAu!;H(mTeXtZ;tyLfCuC6YZH;Q<C>G@e
z{2GfPSJlfaHR=yCG7uxlLX%Dm3JV{UO*uDH!~(Sfjb0YdO)*maWt*qMAOggRmY5xf
z?!r5XH!Z(56ATVCQj>Jrv1i7G-_PgG+_oLg`Y4*$+y1Jz;ecK{kmWzPmiLlXss+kg
z!#NFQ1}u;-WH)$b>m1SEhfaOJZGZ6AXh^6oy}QbEj-Ny;W;E#vF}$Gw3PQ*v%Cfi$
z@eW9r*RtZaRCV84e45Mp+~%dU@%ZzFqYVx8oZmyG@7H)c8jV!dSxpZ6U;=#klgdAW
zC8?^!tra^w8|SyDvdyxgJLaMHo%V;D4~h(#P<o`8?sEC`hWb@@m1W9hkENUV+7$rX
zQ~)i5ALR(=^6NJw2N0$%lV4%ixLmgQW~24rS}mkK4Q#<0E7nXog=r8&vg{?ad7*O0
zkrBo>x5V4#GFKeAo5$Bir*Z49sy6936#t}Ozt*~&+s#gUXJ4@euIdS$o02CT90XpB
z>uOq0#$!?OC_ac9nH{g&3O#s(%&tXtU|Fsh`m$)e=;fjsyLn4^vG;WZP9wiw`SU>#
z*Vl0*hKO!jJBYYg-hUTipBt;gB678SQ2P2OQ5);o<d7R;pD$-Gd$105WIQ@*ogy%H
zAin!NI{?op=U)EqOJr++GE(_-{W_ayX9nSlvHaJbU61=z_7?p`s?7^7Jm(OR|5(I<
znQ^i+<w^-KD0PNb07Wcj1RG(sbia)Z0a0OD9!m*RYBMX%T(P+O7B2m~WEDWA>l(xS
zjCIf4*p9|k#-p48IG<ncr9PxELZ-jwM3yE;__YCZ%Q$M+@rZ3#=lz%71?P+zJ?SZz
zuaXXXhY5xru5rcskOvU@cTxepuXJ*$`QZJoQqc^zoUv2QD`hVpJw}=}2(|>;YfFX3
zcb#V<d6Fyb3Fag>!u_4wfX&%CB4@>`LLHe`!c2ZcGYV2+<0lxjafj3?d|PbMnTOTA
z9f?czFfj7yNSiOp9bhsjzJ03Z<)3A=aY*5Wsc)rS6@xE(8C$YqpuaZ6ws?CSDA$HV
z1yGIvb)-p$z}93fi;sU;V_5Lj)e;f^w&9J9^ZMk04YxPkNA(2hWsH+v&OEOG;7E~E
z2a)0k=iSWB3E699ebf^~HoXD2@+GDKGx-s#DT~WJ%qA+lw#39l`51>tKs92d%=j}G
z#EI-U4Zu^HCnetZLqw>u?+HG!@cm)5UGKbdh76A<v2L#-IbNr2KdDw?>`X-3Z^W;t
zQBG6!$qB^Q{buCAS#9iEgwh!D#dOT)gbx*ctJCRX+IN`O^$)HGU-elQROnfd=8(L>
z2T|EAqVWP2WO1Pc{5*~;n4vNdi{`L!Wx2Iwe52KEMS5Q2wf>oWW%)eNF}m(EQpx=g
zFs&ENTc=EB!aKHtS)Gw|Um$|#X9vq;i(c*K1_07JhaS17p4ICUWAt2WJ>z=}<G&XN
z)D^;f(^MR$w4w^%!%F7IWuyVH8_4m&)$$igz5^?pot=zzZhhl7nIdkp=3|p@^MKa<
z$1<{r7qDy1MzMgUQA=EKp_OySQS!sw$%aCU3r?+ukRe)!kDrJmDAg=tIbk4hPL$c!
zeB|uj9dsZ&19#B1IYYd^EEB*$F)gc$WNR{q8xLHwjG}g(xvV2?8_D@tVcnqA?Iv1c
z4yx)*JFuINJh(uEl1&Mv4P&S%>Un&Zf$_juw>#EmQsRA>@<?YB{OFgm*W6;m&O+&T
zaVUMKtS6@t?AWQ%q!tv*cg$$P<vv8MkpbC`EkdW<PxLwyq~MN*Qv#_v>!#X)#u*u=
zTUDq~;9@EP+^iFZ?p=AT{K*`GY!t%a?PC4SMw($!7HO@tWW~OwGE>O(o{oPj3o_nV
zSB(k$qK=Qi*al!muMu@a5l0D4m&mVhhK^>{gPYa4d-tze1UaWK?Y^H-_gz;sOIE`}
zzni;=+(3Zie}G!Rp^*JV>o+g5olu<W^zU@hV+%v;$|Tn^lVYU|=WjN0yfVmZ!U^kH
zw*x!%_qwZ#>{~?DAb+AbJMV<I#<S!$?Hb{Vf<48PUhlp_j}gnoZxqQMTM^c?Q8YcM
zF(bhCWL3n{D154Ht*Of%IARb@$nS#TFak=HHLe}J>)jb^EUoi=C$!{(yn$PBcJkYs
zZ~C%)MN^=%--eo}=G^#;W2T=!xbtG~*aP5F-IiTtk{?+L;Cy~Be~mC8L;V!@_piEh
zFAux)oy!>R(K5XpUCL4ozpB@*o9oBk0OqfgKz?~()CP{R;VCD`q+?f3tr_*5eNuk#
z`?<Lf7>A8j(Wj!?rei?|>W>Ex9CKY+ymT(4t&_$93^f*6QVDUm#cKSz5vywkxc{`Y
z<FQx1A1Zw0C1V5^LFe@vR!o5nL1>uJd2%Ec2&Tm;=Hr#ML}+jgaPX+U?nO;z-#abO
z&TKyl)$(QN6tL4<)I{f>%mD)N03j^|<AfGK4giN*0Ls8-HtYmi%F9K*TQ@Y{w&fY!
z-8f^rp;y4;^CV-xi`J>2HqUc2bsWfU7?-+~D@9GW&^bYCiVcm>R(gNnv+Ruc>vz%}
zEB15lJtq|6$mqVPO9-6(%n#6L8+Ni5CmZx27a&3@>BE%@{fiFaEKE#YtuOgsqPAb6
z_F_cN39=}Y6ylrf1jrhgLsa|RuNDAQf>qZ2ELWmahRT}sOShrQt7<GIqK`{v-X2%6
z8>=gM9e%ucdzx}_0adov3>Ea#rpgkYj!o+Umgi3tI}KWig74h&wOxwx!?+_9G3l6d
z;#walx$1#eGLKSSvk*dqNMY&)!p)CD)j8wV-D85GUxvh!o2ozQ<%Eb$ZrFM3L*%@F
zz;4sCH<Ld>-DV5>IMpN@{LwHiYI+@^i$AnlK4B^slJ@lZ8(%HexicNlH`X`00?%u6
zD4h+7I+?wPU8mFjNrwNc2xp)HR-knNM#M(mV9H@bz*X+}-o|tMs1;40^a=n|>!UU=
za&Fcl+7A2xwHL6_*yqXSH0^;vz`F^Z3kmvlyIbvV>nI=v{7*gZCjx)Zt@~#IG5JqF
z@ZbLP*QY?~4)CV_`3;{vR%XjysqeR6-AgX_e&{#5Z}aI4G_eT}ZN$Vt&I)l2@{FM1
zE_X@Xyia>KyiY)@ML9&jJ9QL)ZwX8%G?7}#0n=a!Ln1KKJ+iufS7zZ^U~=rDMEyD?
zQS@-u8<OI>1&Y^B>iT^bh`xlI4>F#*9GKxyKQhKK=;E3oE%9b)5WaPDoBkiXd@6!0
zbygWnxX}}5&b5BJ*Z^A~u4}?;VL7FFJVfPqTo}f7Y3Uk7E)*aa{4Kdz9*U23BEy?3
zD<dv~T~w{Jx3rFoGiO}9OHsC+_K|xo@W6bwEd+zjnqsG&bK<)`RT^Gjjp1{>HS*Op
zLC{hyKv3-SdK+hP^;4c9=j<psnKREW1kpbp0qx#?T_+BpxNa#o_6U5-JOJVI6WYQ%
zwivpP*s!p+-mi@6{z{yim?-(!EPsgirhV#d=9~{;7TWmK5yT0iNE3`10|fjdW!T{y
zVoaxV_9D^cs>|5zE%yeKLk_`Ojrzv}Nyi^sm>#mF+mSYaokaG-%H2aLYL(&Y3b}p{
zw%Q=)iO;(jB5^BcS2Dh}ntx8zSNaeoHn9~YC!xY`I*Rmxk2m4h8rOKpzB;=Fb&S>s
zMZ#JXTBNvaSi0Ov(e;MJvnPGi?S=)d27<UCGhunaTX3O;a~-v!Ofe_>lDvVlLpAwW
zvaH2Y1EzT`1=*WE-huSrzebmxK*FRPk>IZ=mQXR_?4W*si=2S*(%5VkRKr(b1fdPw
z+QaYBDHXKI_k%0n^X^W<KFGYTxcRcj<fa_&NQ}-&`enA5OriU-Av?oC_pKdu2D~jG
z$6Zr*I7>%#62;yPpUx}!%Iz(6L^{!20z|Y~g2^DifXiyp^%HQMP7?eT+fi+zZgZ*)
zIPQMU5wZM9)ss~`QO0NJ8V(+IrxEfW)A|?ODAq=lQ+`QJx|afKkGNXOymzOz3=C>)
z*m2P=ZQl)bobN(JMAo;1=oc3WXl{i6ml`m!vwmtH{H&YKk_mC5_IpeD=Fuz*D<+-{
zN2_odUW0?}*7^P-DutQxVD3$$pv;5nro@2eqk(Vwo6O)I6}V;{ypOQTan=iN@*VBL
z70=zf0a}xipDw9qNU;Y@JxC6~vxU!JtRs(RO)i~N&3u0ULt)|U$539wcX#eQ6*U=^
z^LHo?8*gWv7$_&Kt;kZ~WGj*#@N7ka$kk10s<CO2Wu4>SR+nd|JW0`rcU&H02jicK
zH9xaAanQ&KJ_j0(0*X1r-7Lt_1+!luTVH>HY$^N-*`nKnZ0)E2t`tR-jRcoTG_HkW
z4&;z2`13}e3GpL9jrvUmOx~cm=CE7peo=Sl%A&82LFaDe9|H3_O;x0=z>3I7aO4oU
zr1h;tP)_uUu*1*_raZf>bqykY{<TG>)W)d;YQg+B9s=5`=W@_d7zgOMK_igwXGSBB
zF9;p}GF#lMe(da<5SsI+)J+%T&&}tHBh|w~U){Ew)8koZRoyMnIKa70oQ92q@nPk}
zfEE-3!1Q>Oh`2PMe$YPt=778RjkC}AUDN5L;JoQZPq&$K=dM**9lp+mzPy``alw#b
zeDl%3^B>bNoXJ*qoXmRTnptnryg|<O=MG|FctvAj0q?^MygXcH3_*~OIp}Wd01}q`
za2ge1bAlX55km-9k&Eh%z9>|*zGHofMZzF%fmMh{{JGnckb~{s61=9jn}jy7u$2T)
zqEQP{f~+}>2Eh;zaxpIYoNRnJ+}-|#tnJl(wT0M=y3C)m)I7tOa|YzDvQ_4x8_*zR
zFREM$`4!4hqiIiIoi`(Dd^uYng<+0AW_j^`_5B+;arQpFJa0B?y2gz)t;y#a&|krf
zE+0u%IB9N6;*}VL+PkUI@t%M;XBY0@EfS5jwDMB76%7*?Q_iC+etgD>J}U<e2ynT`
zj=>E8>bu&@PPXvX8aq6i$3-&7$x`fDL{4or!o$JAj&I*}uETAoUrO#z*w}<sw6#LR
zCY1<iV7=)A5Ai}kdTU(swBI=IbfuQM6^v_pL%&AN+8LK-yt{#Tm3}=GKyY2K;ig=q
z`T;~1M{rmgn7u|jYf*J2rM#=Q)XLd2yHc!(-^sQ_Ri<}p4*eN6j+%zGy-+4)k)?25
zYPgFV7EVa9k5yj|FDU`wxI-5cwD+Z$uJ?>I+qf&pEU&h=vIGLa0a6D!hu})`7=ox$
zVPsi}(C=<)Hy#>>YX&}GO7euO#JdfTVJp2gYhNHrd7<L>=nsQ-*hz`Iuc%TKIqK<5
zd{4~%r3oX$%BqSAr_&ej1OgMG-mx0j;HkN+KfflA0KNw7F)mG9yS(?cGdB)?o-ML+
zc`W8POpob;oj^6*v_dW0<wNAE&HCaXB~KlxoRzf8r6vI1zbNSkD9ed{^E;2KR9p;Q
z?scUfphb}%p!=v(4aE598Z|82VHcVb(R<N(OeWM-dUm#H=ADN|&cu6p{d$~+=yTAa
z<5wAVZRm4oy+Ry=7-wmF((THAw0X0tOi0G@)Rjjtdsp97o<~j>($znI&P}EVZS+G$
z{otgD-K;vvQRO(=K>(MU76}2vla_Z<Rx6#~SWjt%JEczc-9D|$$j_(Ic8dS_a0Idg
z%6H!=K9gV)&*%38q|+~3c8;y7)FI%_qA`#AGQ3cciDy-M_SyuGx1f$ZXUR)?Qfd@g
zcUpD@t^9~~8d@(K3}f?Vi$)zijb~p}^6@=n@9?Jen;^2^UszS@NQZ}p@drtd8EFsF
zRHbh-TNqOI3qqP=O%<pio7&;e4fXZdJT!TDqmR}%<EB3YJnRmBk_dQD?|C&iT?4A`
z4D5KLfM?^F4BMy|P62WK<CpjdyZEc6B>|q^B*TLHl*@07PQgE%8?Ver7j&XuaFN<j
zS|S0COEq@6HdIYABSqB(a+d6Q$H7T4pwLWEY3W+Xu?vQdw}>@s{PuDw7EJLtmK5*}
z+Gk7|>><<z8p;LbpmH-;7<ZmdO-nUDaCyl0vF#_O6j32wYyQ~w4n31gL2NH2T{o&*
z0J@oS6hf1zU_;iYoT8qpC0FH>Ep;jfzq3_p=Qu0*o*HL{Ilr(FwQUIIPg1+mSbt0w
zp}Jf7y@gzwMP=U2spElBg^938kEdr#Cbi!#JdJ63$l>deFWjzwHJ>T=GiUmZJX^Le
zs!~K<(iC}^IB&R{M>|aRx<WQqAF>2Tx)<Hw_p$3Es?k`~SR=<2QA(2IeiqYNtyUuU
z5SBMZj{u-LcyK6OF*6#&GDEg2(0o9+kgK1snV(*msxs=XzI0#Py1V<?!S>PT*eDR`
z!LP=kQtON~CSZXfUW$WL1eQ^o6L|p95~%@f<^4n0BXG~Z^W<FA89>*gcTbx)6~Jun
zY4Yy9{R?Ijl>PIKKlFKje)u2J-k&e_z?;7{`SXqKEG&weEE@$Qae#Lqi-0QCQzRqm
zlNLD#$eT5Rk+xc};IbXZ3XoV4f7KW<f7KW*FOeN_m19U%+Q6hFxm3MJ;!z#f=?va4
zkLA`K2f;5ceFJ&4%0+0lvJEPjAmkHhjI@CaDYCM+ltfsaxM;>n!Z#l=VaydpwX;3+
zD(tW0_T6UXs>@B@S`BQ`=C~eXd5IdZn*ntMIHxxW$}LbnV5VIB$QFASVTZO_*s06R
zyQwLL8KqX)GAIVdMJ?-_*=UON)phPZuaiOOkaH-Keki<lMkc(FJh+lmkvNG*m0a-h
zb?_jSly>A%l>HsLkHipE@;%=tLC_VL;#%j#Zv45i(a$CkU*+O72XD|fF>k65=5I5S
z42S{{5meN%uVk&MM!xU4QLA=C!sT@V<RW<Uk#vb;s^anod5q%}Cf|RLACsDvjRqXh
zJ8`-7@%x=048YhXCj~DpnGbY5>rp3eXIR(h#c05)=gy7koo8SY_z2)n7NnYxB8a;W
zaf}VVz(ygzPHG2<N4oi`c3FX!9H#12q_aT&zAAa839P+9&;ubgTwAm3SilXUSv*@a
zI*iZfA+F2WLDti`Ao^M1nRl|MZ_SDDg>Ud)L{*Epo{{)caG)pe8#)$p0&!>ejk;9+
z(#N<2LccbO#i_(-Ca@Z&r^sS5xepZx=ZSe2P~VX?vwKhKi#ycmyzJH8rxLqaHIlit
zgXz7QW+C0PHMwFOa}o|LAv{O)7~eR(zqupxWH}*AZ)Oh&iv_7A!MG9f<SoGP_$vGm
zxlNyJ1b4);9SKbOT>W9tSdnf&?qXWPIL8mr)fjzk(VB!%RGJTWEYW;Ln|Pt+J@w)M
zl9Q?$-wb7|VH2B6d+Q><xNnlQXysJuLsFvf-qa}kAazEb8Dttq4?r;2s`;0suk=an
zD&f_tox{G(Mm8sWSV(aYJ-YesJa;RSizrlF=)}jB%R+jE`;=8Va4WKs-#JI~RNDyw
zhLf7D_tfxpy1U6W+Cb&OXc>$%;yQf`zAVc!G5P45z_@?k0jdwa0vHOiYzA*=-KuO+
z<yv=!5uS=u5sGSQYS|w?U|vkzwqLw8N}kzz^|I=F%Uo9O0$wD~TH8e;!7ip_@!5=5
zsP<PKi+B*Lp%pq5<&5GX7wp;0ZT9dXApMFx^gYwEtm6w0A_pC!NP=3<S?jAT`P%Vc
zJ7A#p3kP^x{U}9Anx4RrzHs=hE6NUehs#{<E5ARVB%;!MRCsshE_;|@!;G0k3>;ya
zOLn1cG^pO?tE)VAXQ*#(dij0Fwt#vA*tYeG&(rN_5`-ug9(flcepB|5Edg2VHZ5qv
za)-%vR5t6wzyNy85r|{@bH@*WZ1<_+Uxa!sd;sWR7V7r0P2UHAis+*_CdC21=0tId
zNL9pTj_-!pA{~G1u<<539O_b{&O$WD!duTvABMHyoe&CsOKs0`U88QD`~jLgbVdiZ
zI$Jz2{Pq4>Za`~JlKEdJuRrC(|3sX}=Kv^|K0pO;Z_WRw5*`4y`B?zqxXM^RMOU{U
zp-vnQRTP9bn{Am)`~W#$PLEo3GKZ(J?~aV>nyG(By8$W_W@JE24B|UQmiq{pXQW*F
z8|w3ut}h2;X|#YGdt;^LEva2m?k2*@i9d}Zd9zJ*;$Y61=TJ>jR3SjFS#6EVGl3#@
zKyfK`Y=C_7i!B<nJBB<P$ZG)8-F+AWd_|6uu=WG=PUQz^`v*vtdgy0k#6KFNerc->
z9#H{rZ-A>9cbejXpI8Sp>(Vzesq&bHwe5{M;GqyZ`~xJAMdP)?Zc(?VP}tU`AD}q%
z-elvyj`<k%%Mn$9)BWv;Mq~&0!>Nt=z#pK8{Ak)am`)$iGWh4&{?_swuu=3cSNiM8
z8t9T(nP`Z%RZZIaX+W5giXn(2<^h)!G$DY7Si=zPfdy@w<j*_wYrFsJi!A&1i~M=2
z|GdgQ=Z(KF(-=5e#(z86LIUdVlLf-_zXN2`K^o{3*?;Sl%HKK#pv3;8ts4i*7K@ty
zjGO^4u|jDm0F$@Ru^UDJ3RH}k`EJS&5Q8#|dN2MTy<*b)ul@PQr2>L?|B1hUcIaNy
zf9ue_Q24dw&wlYK{ZCM#vrcAF7!Lr0!+z`d56}%y;0DrQWOm5?e_U8{CZS{M*9)kN
zc^$tjz((DU|N3y(4%j;F*+yY6Z}-r6VZX+yF%TTT-EXOH9hT7d9<Yr$=smXY;lSxZ
zX94Rwg?T910rhK~>i=x{OIQIdPtqEIt*o9WyY0{+0TlHID2=wi2OvP>QfR-9Nbugd
z?&+rfb+_wcIQ~75{y&VC|1peyi~0XW7^P9=e-9%d*ZM~oS?`75Kj#IY?f>h%PzD4b
z=3fHvx9&^($9!@hxI_OIME^c3kbaFKNhexE1M0uK1+&*Hf6oFxJLQ)V@V^S6-^1X4
z44~g8x_=9xy_V2_gr4kP=>0l*=>B&Xp|k!kuQ3N0U;y;szX#Yopv%pFdn_gY_q@F$
zp9%~x?td9zzdZ>47+}BOpMM`FK!4QzKlMlK-hlr9?|8sK6(ajtAPfO*?HVZj^pb0V
z&6t%|^_!H`a}!5(&3x*GvWNRJnW6SzesWgF0M%caDq`tnSM&UktaYGL;K&AT^t4(I
zGLh_sYYRb07Pwf_!n2zg-WGf{^z!!6*`7)Cm4|kZI+z$8&OW(WG+C!BOQ1#NE#7+Z
zy-!MeYi%3smhP8ibA9l%@NBP*k@@;J3_HM5u_xS#By7<R_YgB1CIu|mjrwai?}}`|
z0+K`@2*iD!_~Zjnwz@&|QM>u*cD9G8^>lFD6iM6yQ2U8xz`&L^`L1Uj%+s`xKDu3K
zS@Qh(-0EcEcBFwe=N$lX{0A)86LS<blj)a9Yw*SFoLIub$fA|uWfS})X~JZ#!{Iha
zb>3oS+Gz&n#GL-IxAtEnu$r5kJKXpQnRzS1oATGAZrt1?b0y-ciuHPHdzCu&_6AG|
z*@QVz<3NERyM(yN#?u>jy}N`AHFGHfZ=5{60?sa!cf5s)K2-Pcd&$-fJ8%=(5A1{-
zVBF0rhX?P#L(8Qfj8o*ta5cu#U){JezT`fZHbkp9#H!bS^>~8T1(wXfW1!&z)I~O&
zi7?eV25pK}9pYaK)MBb;>N0eHl`-XE7Mr8b;b5Iit!hv~dy|QjGgQZZ2xOc#I8_o>
zoHOFrz4+<uM1by)>9Em|n|-~RvvB9>VEb6lbt2!9#S4rxMRk0%DNLDB<b4*kX`O;B
z0C^`KiDG!=%N8o@&VOUT^6RQzU0=zWIC<Tx3za9L^sc*s+WSvb4PvnGe5MHL*=_-^
z5DL2e?c0xUo^Q<V;?iinIL!3?cFfN3LT+Tu2^^GfL_BF)nyb^gIL`EiEv6!BQ7nay
z>A1dWvV4fgNc$(iCDkQ!Gzo7Wixl%y0LoD>yq^iO;p2nxiJ!IK7VryRyOLb7<UC3*
zzjEvn_w4*<sJwguIvx=3V_WH`7%ydT6Q<g(y+kMw7#`*|y>*czKOo`Vbg%izbBTI%
zl_>3xv+$YsWHr?QHltz_5%)4_hf`dY8z_SG#zgTn?Cn4$=&?^8sm?CzdZjfw<MZt9
zi5hC0vQNLmV>8+I=+QzDF28V`Y%~Dd>5!IazIs}|^T6cW`HRLw*Ao?lKZfgSJBVF5
zxL`9#F{gDR&yy3T;~9}(P^C1CGcG=gMsIPvB5|9^!bM3w>EqCBvcjpL^_3HP!a9um
z3vwU(VH%+X6Z9Cp5x}N(p5|4TA|y3##q%vbZ4LMG@_O5~?~F`EW{umk-9xd(4N3b8
zK>pz?k~lUF1O(8IQO3&hbuy35hf(cuFO*gd9G!)oPj}Uv)Acs9)rz|m;yMJd;Inra
z-eRqwVVH7YxllM}2*Z-9;bQA;O-5N$?Zrm?LfPEo;F6Ac;aYoA+U_%iCsEd9H#4n4
zIWoYRP}yQ>_BQXUOQrj;m&J{<Rx|RP_Ggzx#G;Q_#Ocq~6_eAjg6#Orrm3S;Wg_2d
zKf=JyGq<N+%nUF8Y#7@7DD2uukQ4pJHPYDdJB%|b0<#b0z{Y63TdGZ*{S1*F7JKxV
zHP|IgFH+=n_iK}?AE4AoaFG;hy6lK05c>ugU?p^8=;W<Fb)ATaefjw#)*uid;t9G2
zwS|rh<J;;1%<n@ycU$e1o*Tq{&Snt)FHigKyl}f8eZ@k){h2RE#K~5TYe^gCRRD^Q
z@lO;V1VHii(~f4+jVy8PL?qs-R9h=_43j-|Ci~2U@cijB3L0Ptvi||sGdz?m30-c;
zU3~wJpzZi>BL8F9KG&1tRiW<#-X#>!j|90c#gCh{4jb<#LS(Hbbwp#;72bZP<K4yv
z=UgDGhCotU0C9`|99C`NZ}6b#lmCDRPXOS-s!nF+;VR^pI))*dIQ1|&n6TEQbE3d6
zO>5xnlF|7N?LV;Tpp>8BK@D&WU~Ya8ScBLbjpR1ji0*EMd%K~UQg<FFJsIP8)R;H@
z3Q#-3k~k@Z{QOr}ZCOErAaoa7B)C-eA;1&2jX#Ju0Bm=3N!9P9g-f3$7kU>&=k*Qs
zTU3}GeKPan)iL-rVb1+>I&L*V+J>ydw8Mq2I5I?F@)MRjLnXABct3H%z_XNxqC47{
zUxU4;0MZ)yT5AZpmq{?HRk+X#)P#D**$oMJQL`g{@s|%K1m(ru8Dx%l>9Mc<21xZ5
z#$t&G=yG^rRj3DuaMIJ>W$*MF1ADtdXI0O^`SH3PQqRiV`n9rz&n51ybH|S+8cC3p
zf}k=~dx{z`v+b)>@tdATEyoAGB8TgfBh`J!hQqv9zLeUCFV~iJ82igCGZ_dm;ZikT
z#_N!!DKNk2X~D|o_)w%A!E_i9aHKKz&42vR=kVmF?y0gHQTRy*(~dPKas$u(ldFeB
zlA`NTm6`Q$L2}0iE|8Q4Al@L71DRKgONrtI-dwra{x59fETT^YGaNbT(|)z#YAVYp
z65v^v4!256O~Yb;Zam0rT!QiWH8u(gk6-FFsLjaC)#@$QNi_bbFVMt`eSD_P^D8F^
zas)tg`rSm1?f5SD<a84FFAxq)g`vw?w0trxKMaTr-2S)`bC0(Lv-*jS<AlI6Q-<q;
zAv;!LC1u)ZYz>EA;UyxQ8Z0jhF;&#`uVUW2qc0D0`Ch#eY~e0qJ1cbSy8BgmBg^n6
z;M{Uo;1m(R>K1*9IGD{3gUgMAI}A({<|<F8COMm5JHqRht(9+oIR9nodOn?DQ$PTB
zedZ%nxlc7QiN-y@qKWS`R9wC*+7D2k{apNq4PwP9>yz+XrBLtvpElgwmWr=}{Bs**
zw=Y3gxPO3d0Z=VKz%H%>bG2ZD4R2nL9z)}LR{ZhMF&GJ6_C?*$e!5nC_{!kf2^YN8
zwf(6HO~=|p54JZSG<^uJ6;7rU!d}}jK5I1>V(XnJhr=D6@y^n>+;pVRzgRi;EpLO1
zD{1~D|7z+y2OY3BUx}tDkTXfay$BIJTUebiAOdv+Dd-Yi@XfqZZacNkWBlW}AoCM9
zUMp#-Y<n07t8C9f$HAo3-3;ml+%6+&knC*li0g7ENvq0olkd%R-b(uPI4r<dUUjwM
zPN$Afm?Xb#-i|Ek71;ogA}MVaIs{;LRs2TJo)2g!?HE=S%JuRRihMWT!C*3XQl2S~
zIscL)+hbyhlzA8U7>yY@2Cg_r*lOyD+W~5<f(Z3~Z-YPsQ(AXz($xW3TE~?UJ8ZT~
zL%ehdD^F@`D`;%D5<0Vrv7e&wC}z&unL)8dnd^5RRPKguVs`mlzhK;YM%MtkL!dd%
zu>~Hitm;b@M;%u5_vUv!Z#=2y+P=yxe$mm$?+B;Zy_gYiTVNSiCeeTyn<nM$rg%?<
zqmG<~F_QyY&H1`wTViWtH+x)3Qi1R0oULy+S9jW;Y?Ye~Vy7J*2dd!~Z&4%WK+fL#
zCY~$>r>5TlmPK~f62Q*Ma5-%f2BP{>bZFhanM_C_#g{|5b;Td9`Adcgrmj`dJc_*H
zo_p!8%me%!R2h7E-k(s7o3><e30UF}rQCkQ<6~7fzuj2Xt?JnY3Vgx11K=hmz#SMB
zAh9qXdy%$mihr`X(kNBEa*F?TE>F-zE0w~_$v6$mB1-Bdu$h9))2MEM5qM@C;7Nqg
zC#1DtV-=cx-Y_J9WcTM^eB2#GtdlgoeUor0$gc}@pGMbLX2?`uC)lfgHj*nLcVQ@%
z<jO<GHF?tX*5N$?BhKw;LY6`ASqxcfxTPUWCqZ#I_{4{g*XcB>60J`bANO?_o7oag
z`ZN#6&4*&JZ@>o-vUUV`6N$!1tc!i!Mv|6lR(;VjSW|4FrDRn&aP;wKV-QHVn5V&)
z(ux}OA}N!H363N*k*y6KX>+oS=;c@4q+qo;{Oz)dQmMB;TrHamugK)a;jv#!Plf*A
z%h0RLQ)F?&@>)_UMcc2^JXSYaku5?sM)jf4?HjLe5l`564<=d!2}+FsXESCN{+8B^
zIhs8*twUk<;pXbbvI}-hX%r`)Pp{;dE<O6?DIVcPkwc)!n#A#DR2g{L_wBdtIyEVY
zNOkF=Na2!?RT@TPwok!N^twOK9DCyHRh81gYSe-$onMKhz+6<p;TRWvDimuJ#%KD~
zeCsJVd^UA)%QTgtLtB0MQnsH&3W9mw{*0LhTP?~ly6f6ifEU{R19Y=}z#So%W#IK;
zwq~m&;!|S4s)QmDO6BaQUG6sn_73ZSjoK_jWV)rL<%s14JNv^{<5t2g9G-dCFKU*X
zUiSdegIGiAly_@s^nOdE$GaJ_G#-SitM-t)Hxqw~a>*0B^_7{g+ur8q+BBm;JDrVV
zT+eVQW@jPZpE`EJ-IINjXRqczZs2Q;;_v{Og6LqWneW-Bz6tT|zP+n1p9x8r?m6=8
zpf2cALP`wt{qAOPD6*tENBH9T>vS+~T00m-^(I^}C4cgtws-3FTWWm}SDm|?dQFld
z*ncd;=~Ok0agSUD@(0w0j4t;|L+#!8ul1)G(hBnzEBTUx5Nr1;S&pT-XKzb#+YELA
zS<TIrLM)jP+jDGG2SZ43hRFBxUwZ5*n?bw+*jUk3FdX;QJ|B9cA9|-}ER%GVSQ(`#
zJGw8Bz8S+xwepq8kqGr3PV6mP`sBgCY|^T=JoZXw{_2ra$+uoD83DWhK*be02FSuZ
zqDde}hIhEqahY^qnRZ1QEg93*<)@gBDlYf!uDr|l;B5k3-_J~`KfVi8(|?(8V0oql
z=t>pkJk^Gb&ZnLx7ZSwhuK>AY4^9UyljY`^uh!<~FWB&?J!WBT-@fc3<7cez7?4q9
z?tCh0Nc~)(H%05)1M%Q@ySZGcJ7Ue1a=XtuZ5;gdcjwcqLsiD(HtALdeq~Mmt6s_u
zHRxaTQUHaPJ>L|Zz5y9<#_R)l0KYn@>>>VtLG^?7uwH-sJD&%<_>&XxpKts}?{)8M
zf6@m4+%Hi65@W=t?S}5jr4)e6japt9;J}SiK;eq%#0R2pgjlrp7wLWmeQ&jmSuJBD
zlXTgh{dtVMUFJWVGX2#Q{YrMz8f==;y>z`eWZg{_1{s};z3n7M&p&<okWNFZ4hy0U
z;DmnArC!@p#RoJ^m{C=_L#Umb@d{)n!s|9{W+R-Hs#4~uKIZU2*()Zq%;plJGg4ng
z0uj^9-Yu8m3KTH!%7#CkkEHRB0SLcSnPkH{o=J&_vXF;!PsXUjN_9)>$73<g4cDpJ
z55K<<IaQKudr)M*&?EB!m{rDZoCq#AzRW1f2J{7Tf_zU?`~`Zn#g~iKXFEFe!fGsF
z3|;-StM7iGh{pT)OJ9~>^)J6VZ33XVPbLL$x#b1XrHVdh&3@XOt*{QoqGOTD)Kdg>
zb7mNlhkOq2X4MQ3rK7wHR#eyLzKkp|2`=cpN;N153Cd5F(cqDaIn%8RB(O~CYMvAk
z+UGg}LU&HKONLzCm)HANr<zD%v_;o~Pfwkno-7GXxSbGbAD?`uuK4xac75<uR4I3h
zbU+gTDD%&C#T=&k=C%>JTiIRA%zagvACHZV-)!T!G@Mu+%+>d(iY`cCW>Ww_XTPDI
zBf?_T4Lv0qjD)PH24z#MNq8d`i_Zx*og4vfj>=cti%a5DEHaetYX*G<LCx}Vy9!(E
zvFJ$fA*2cb7a*w<ih>JL1|gDu9?pEtk9$r5td1$?l6S3#MBBAi8Ty*BmFMOa7ojW|
zXKQo3a#UITAyi`?F+5yG#!P3x{d=s+=*SI!5A`P-BQ$bNu)PMS0mD@Ne)EB{6lKBq
z7BZFHAC6~>d<t#p2_D;OMn^rJEJltgq0bk5{TAzZa$kFN<>L!(`)?-ho7Fjj4T{_}
z523P5TfxZU3k0$5hk4rgYq)10pryCVQ{XY5yUn1bDI3bqV`RQ&UfSh){r2-EiF5=<
zzsx4=p$&a6dc~%7u}PzEWwtVb8P1$w*&54#0#qQmpHt*`jQM=qqjFSKW+^%xauRXi
zAuc=uaqaEW)1tyaT%qojvW?B^CyLjbQ7#`(bFs5CxAP>@wb3(A<tLXVhuhCUN8@p;
zxf086ICz+iT=B<V_qDV9FH~127r8^`*vfeA)$os{qz>H023ug>zbW-+Yv3ST;Kh_^
z;y}^Q|D}tEvZ>P@-{7<%rO;vf`?kug2hpW2DRt?&mex0?#>QG$x)#hnq#QM!JNfE*
zd%Z(cUVV>d+a(z;083xa3oN{kywRB_$KyP*fc4~ML8(Qf2pe(u0WwoFQr75nU39MX
z<nd&@JmF&B$-7=58jPIyeq<+-W3W!r0&$J#8->uvM{dSy8D6{GS1z@gbg6&!Nn$)4
zE+F@Qy_E8Pb=-qZl-_1`8qmWJz;i$PZnWR8WTI#@(1oF*I#eu?AyI<TAsU%549Tzm
zG9pAz5u!R1dw^p6Ll3F}aWbAE)-xc`i}Uq3<55FbhJj;6q+6(fxfAE*%fCz80@kT~
zY#~(THvl1)<ea;}r&wc_no69%d$sYEvF14m&^>+841Ed3TK(0t9<XBwKL|hB49-y*
zULMckFAr?#+?P@aL`=H6eSIHxGyl7N2BRVYw)}!9(G1}srp4U{A4NzLTb}@<ef;{+
z={1=$NxPErGK@zr|ECvi$vO}OgK;a*@Is2%p{TYdR9RFTAlx<FfC_nFvyj`TXi9uj
zSejECm&z-R=rK~A!3BPyIIdoL{nRF1C`-I3^>HD!I3fe9^ZHKg6)o;o{L6JZm4X2!
zwLNNm5HRfm4#j`C6#t2p0H6_nLL&Y&G~WC4r(5w~pZwJX;2=JQI-s^C#=>_)#ejtL
zh<V@l4ZwR3uvFgy%B}CSF+0MCcP#7dfi1roQ(*CNXk*W%O8BRLmwA7t2FIV9mVbbi
ze+4X;CI6uj@IQRxr<whquJ(WKa{|BdXA|HtwkH7achlcc(7*>}e`pE(h0CSeru%O>
z@7;eF4ES44Y!9fM{9nKG#~YkDRGCp*EE_<*arPvtHCrlW6^&Zm93NM#NaHiOXV~P%
z%sIggz_)B>3TrR0%G1pSaivBP*~aKekI0^svs7pjUbeY2vah*EFsHmW+s1ohcHmX|
zi4ge?rW7-HdWy#W#FO-}X~zaQ9r6p5RnaJP>X@|9n$F<9#9nBcI=haq?pfJ~6&Kw#
zk3Vd;?a+fB9Yr=^_{&xV5$yI96LKRPV+;2vzT}25<+cyj?P%fFvzn8zWKa-YJ;)OV
zqcW1GWZR_o{Q%h{)!RrAjugMJyP<BBi*oF`_b#~kz0B5>5bL33zq#6>Aa!3XtUfaw
zRf=v}f`v^nFJ}xJhUjKEJED~4R_AW|r?GzuuG6h&1c5-NbQ<&{d3&rsG-x;D2gnI^
z7}@(#B1&=Ukn`}z`$C+<YwA$dsnag&H!Vc3tV<-Xvq?Y7;yq5dcanbUt<xWL!DFd^
zBoB0w|GPKP?O?LBIrV8zC}!EK_y?%pCkuui+y?d={)_4eSfvBtGQc9}>B;(+Y(M(<
z)Zem!`2UZG_b)czbSHst{g%N1E^$AV>Z3rCKeHad8R(A`Cg<h8#Jx;Ma_^m}lY7iY
z0EYjY+M6?35J++U&Qo#<=2X;Z+C)Gf5m>ZWfuW5*K&!^z0oR`6uj^C@!_ibbqARIr
zSb9^?a;^ur)%eV4nexH*akgqkEuwlttc|sz*fxd6ed@tEPT58_Za;Jbri?8fNZ7Z`
zs|H`!(Kk=>RMkBGB;s7jEb^g@byQ+G5qI5D?V$a@@W6V;ZqNI?*Qwcd`Y>5!H$;*M
zj#O78?wf`U<PM1SQw{US#>={Iw(Qqb(s{IL`l)^e#sO`G$NJa^kWKN@+&60nR*&^t
z4t$sL7Z-(DEe!X}olfuesn4b#VU7!_>8Q%K<N1_}-p<*{^bW?VlB2$R5Z`iO`-Vuq
zk8%O&-|;zQjWJA^+=O=k7H3}AWE$Jx9E{bkLW&Z3E4Cu18L6dy>-u*sf5wz^j88xH
zGsZ%lGKKtl*;_v5K0=(pF>Uop3-`X^8df&H>Up-Wo6fDexLlWC@7ujAXn~?>PTv3|
zw>sIQP}|T9t$6U>hEo5>t*_E<<8FcDwQOZ4(Q!!W#X2#-XL~BNLNzmH^-d(h7!J={
z^ffunaz0vgtz>qcBR}tIOC0Ohr!aoR?cVP{K(SMY%4EZZ<jV(^W!=3w2eAFJ_8H2?
zhj}h8v7c$Zz&WuNB^DQBWn#IITNo04Xed9+BpJ<+4{=qqJXCwX|LGX4E_VcDDTQSl
zgW`b<5E|L(g>}2+cOM=$RKb@~?Z$K@?G|Z;z5Oxkhj5l2?Rx=tUIV)krw|u_dN6$d
z6jgP=F;n00l=ZE}R_<oyii+ji$tmCT9|;Ie1ekd%sOUb^&4R^crjG|>ZyKWPI#tll
zy!x=*QzoS=er3Z33Y*8Gwq;wON7uf?;=l~%jZd2~gjm1){;MAoPma7Zm)lLrj%cs#
zcrG9mR)spKIgJ`KzfM$+b|e-R;$)eeRg=f=BsstSEG?S0JTm3!d7K&MX{$6Za6~Sq
zB3|IxY*ckEX8#)bxd+aoH4$y|`q4T6XU-MqbDBDzY__5U3kN9oqR3OEkZNLDQ%}ew
z-}}tgG|#CYAh!_<8&}VgvCBgx?YM~!YSvx9uSWZej2`rpVfI)I*>H2=zENBy^6bZm
z%T1R8ZH5+P7?T$bw85Vn6fkk2n&%~Vy|yyC#})>?#XJTH@!Tu!XwgDmwe|0{Wmk4=
zCLM<cQnqIao%-Y+B4g8}0ud8N6Io1sIuu*9XqM`uEM(pF=&j2!J-pNG{=8c)`i#Lb
ztWrxbVEi7PAr}*>HHj0=OmOc!E$wFKEiR`gSu3AJCG8#`5~U9@vh=%qE3dB{oiCz_
zOUF)2=0~|m>zIA?bW=imm+FreEce{VS}=f#kb6i4)r7Dd^fXR4M)5p-<AxC@2@SXB
zsT{wnmulsmXzGl=$zJORI_CK>ZXiA#fKQ3}(Ta)FIAkQj58+cY#6do{B2pbSdo;SE
z^hj}Q!egF}RjvKU1*rmFH;tNLV?a{eMw95LLh}&{M59M5<xg&BwEh5@mg=o!-{}7=
zC27I?Dj_XJmsjQN4Rc89>pCmI2Fl>IAG~dNidmfnCk@AQN1pY|dUoxhcBOe#g9CrU
zou}p(kIAodIQFmIHrFqt_0kvtcdc=wm^$g=!LwFs3)=5gO}nyW3dM*iSS#)F{YeU{
zO5D)<T%spM1>VU7((A(%sONUyoJI4JSHWR6rwOT*STNwDl?Zbl8XGutY-+qw_la$y
zlDE9hLB|+e^1TOq8*aL!Il?>Nx>EorA&6>>KUu@#>jf{mdBajyRLOW;4k-3%@SHKT
z&3c?~@%{kBj2nV`U1v+qB9ccDybtk4jkVm@i4K_&_p6^(OYNTGd2u%=9O3m<tV!}}
zHnqbv;#5axLexA!4T!5#A?IL?7#gOb2bYR%Ccc?f`a*=OL&l^bG}Ni{ecCf0M7mE~
zgCcbl>aoV1IgRrp9Oms1ncepYwby<Rn=PS_)H(680v2S&F=;R3-j!np29hGyea%9;
zMoN0aY1b)PiJo0PH0j-38YkHbCmu<Rn_LWp>l4))7~<h}hf+7LeynOY@Oz~qtYP}F
z;OP4T`VG5F0Fv+91F4OqCa{1vED}}`9#R8^#1@g20+pLon_T#0-n}`pBAU7e_jo1v
zI$duve>%m%L1k@P2u#!g>_Q??oLS^t$|V;R%UrLzd7xdcGiJPE=-^!uy-`8oDz%Dm
zM-B7YZO;L|B26#w`|IXyW0h_3!1Eo|uy(*@rzf%;8mS7YLfn=1ZWoI-`S8(s(&A#Q
z=w&Wb4QAKb8Jt#-p*MyJD0aB<<JsbhAiRDL8+V3-5hfL=F{L5ZuS`r6qwZr4p$RXn
zoN>eFt|fe8iJY~s+RWi3Rz^eb0!2e7zO~4AHBju-QNL1c!sQjWq9s1l*PRXyXYJ)*
z-tm?%6WO&jUf-H#s71Gc1?zbH3~-_-{&H(Ot44FKiY>F@BUyS|Qr?yAdRg>d`X_An
zVUKuKJ27kC;XaQ{th-BgrCe}<K#1CD;fg502Zs=2`R>?F3z$nqL~7q@gPM0SiE>d|
zHTf!^8aB}hG%n<TFN#$LB5&m)#7k6;!@O5_E$Z=C$~^Sp;pP6Jdm`6PcV~r~IYg<i
z7$=ooo3$O?Nz?WMWJGPkr!j|}Xo>`23&N$(dt49h=FrO2<PrSku|Fdt@b96um|o-0
zoZyd?A@R>5$$ytWAWpj}K=PdF0wr+(MY)Tbd#--ql1ji?=WkW62itMLO;0cbQzd!;
z!Sv|79l(JHb|vsHZ7qOD_fvj$Pburq7j%DUd>!6PN}NxEa<czQQGmpSD{=2E{>)WC
zSqneOd_c+!2K;XS#80ON9R`vaV8yTpv;Mg__z&KC@5Rq0!_P9$Z<!kXI^%y6=@zL$
zWM#nEH-WqY>`*vl(jvY9auY%Sp6H<g#=PuU(FV3Hnkqs_!%c;_17Ki1;)kc!P`!}Z
z)2|Jj6y}W1e~wz>i;)A%oQbh`3^E!qB{;5FQRJzn#I@$k1IS)zDJJrC8CxXeKuCZJ
ze$XBeNOgd$d}%ipOs1`CKulPvVLDd_=nQc4EAd3uscGf#I(k|k=CC8#8PCSu=CLEa
z%$Lkp^y0x6mM(Dm!F|eYJYU;9uWGGXj*zD*c7E{<nLNM}$T2<`$|{4DL}*bCFPaZ6
z1aQ4@%(blI=L?85O_pQMWhwSp*x<4)ucxX4+B6De1N>SjjR6UiUzqU(o6>1XzH#m0
z`_Y-@&dS3gpo<)3vAnmgdr6(SW8I$bYZ@<z90YT#J5n_KlCVb0DOeVXX25Uk_SH5t
zIlh^_hR-d@uw#7XA-jIqboi&+fyF5%n{?HLXQVI0qF2O9qum!6Ct!1XgDOo7t9BFX
zjz6_{WYH4&QrOJ*;!`nG^RZlz!c1&oc~k)+hvI>7C2zbz4xkPo&gCLbX1GeTHCLLe
z(((O7{-54M{`-K7BWk|hu^ydBh~cXzPjIhj+EZ@QI<{bCcV6KR6=f4S$DBXmuGi|s
z3KnwBT!x>!ef;HRR><A&=-0qQzGqtvJ+eh>WpUiTag`DElU<X$$F3Qq{l>0&_$Rx@
zLuA~W^g(*!D%=rvy4C2@^Pnc728t1~|08S}heNY{ZNM#|xyc2smX99TguWX65M?!9
z1;Tc8G#ojWe?v;3Bq;lsZWowfZnUj%-ip?^1Ea+%uAs`-mb>t%F(40M0g?gOQEePN
z0?Jx0I=Cq{{)E~IQ`s*qP%riPoiYCj0mO%s_0K{6xBr`<l!Q3{H$kcR-v~<LbpS>t
zBnprv=<+9KVz)w9kw-ttguW!N8D(Cma=SH>8@XzXlXN+;zTsT^q^-`R-ci&(Y75wl
zxr-XJA_Wi`!#Ba>*Kmcgz%14|viYqBhU-j{j`8~E1{uJB3JC@5w9R&tq02c7u$^mg
z4Z+qFiZfOFOPv%|fea%~W0x~o;+sd|(sx&9hEEJ!H23+c%XFG+v2b3YIUiB4`52MS
zocU4R9Ph^8V8cD6Zja|}sYrQc(G%z^`R%cljza?Gz%|%WRD&Mv*dp-v&cub5I*ti&
zG=%qN6F&BoQ}~+kJBVvgE_&xhH)!!&%EtVPD@AJp5wM$B$4(Z(J&(!|+s$?_+f}@!
zWi<LK_RFHb$cx9_T)b*`WxN0ji)o4^)o&1Zsu(?dfNEtiYIJNE+G%O&7_}^)AGfr+
z0q$T=Telsr)ArzY#$8}I@nII@291QV*YQ$WiCl$*;rc$m`kpt7u6Z}bUvWnCNt<-*
zxZ+Esc$@utlAqYeu>^8r!3UgBEL66a2q<B|=1K~#lRpqL8nA8F8!=E>a74bXN_6-s
zasXJg-Gy;umW_Z>x;b?ogiruHI#$TFL>d6C1hlR|E?@@7@OqS8Ius`t=rcH&6=NuD
zu$wu%{R5=_Qo9nV<9nYIsE}Au^vG?vxfet=oJ0dUY-@_WCh#qpVlybzE%juR!Y`<v
zQzm(SaJjxU<95Qw*5~f0{J}D7eLZA}Hfnl&V<u&P<}O$aF$*01-IvV~bva^nbFtQI
z8U-&@;C%X(&RkfZN_M3FqE>nHBi8Zww=dbO0qZU&a#AapFK71|?L1YfiflnVY#@&5
z#|4ahXF9LL)1>f3Jl0hIa8Z+8f?k})P5BkH{_Y##@dXg!Y26q?JlVZdvzCa7N7zYS
zc<twF*f#cm*n97&CcCU{JW3O!S?DDoDAJ{OA}UQp1f`3pbPy1b9*BT|0uliQK_Ma_
zB4FrEAoL<lsnSUhk)BWkg!nr?W!`yo=9_2U-^}~H-&*sBYmuyY?sK1epM9Ub_qDIf
zE$X^#y!z1UOUh}VLBUzNGnLjU80R*DqCE`8j=`ee-`7+UchHI3+c9w*a(QWYh}7kW
zX=x8u0=OEg^QB2sd$A#}i3xgmY4vB&2euV@vZek!4t@{IyHAV@-t`f&mfg3!gIXE@
zn`C1-;dL;ufqiIoULwq_(((q{%z1OCU*27EjLpze;*vv-1bfVqmH^An4NAO~2G2lV
zw5-g@J9qe>Jc&3f%+0KQMs&4&+M#ihc(SJz8J@-u94=r1B}qr?5{@3E@3kDCPrIYZ
zW2Y-1E&BS-9TTG~Q&GDsQ%v_%4e`5Ek#|W{)8^MvSMd`MZoC?AzqKSNdHnf7M&n__
zr_34gFH#`o1k^NJNbP=-!XTjG*L>%qe?&`Daz-*)wn(R5AmV7-xM1vQ!$&kG{2Bt-
zXr@uvX7Ru}d+-S-1ZY^5yqg)lBr3T%UNDeZDsVeZO||KSV0LHWJ(Y^a>tBixQ`z{&
z+<N@Mh5#H5ez2Hu<b1RdQ>QD(dsmMSVchYzgG4tJAusmT0mT#?YFK--AK$v<io@LJ
zGz~4`$dfgoVmMik@Q{+8KsX6@zTa#)z6z*=AB6~pAo->_mV;@?y$1=;aH!^$2p8;h
zCNx|*t2V{$;pB+=<R(&OE6w@|G@-nG_Z>=UUaAL#4c`GJ=RN|2*eKHl{QP%3NrL`&
zJW0%Nc#_KNkhvIB-Cf2a<Vg7@=I(PHRsB~=*LE$JKEcj{dLVK$VK38k)4!7Fb!&oG
zd7Bu5bAd62N{~A?4N9N;gFeNqHTiE4ubG~$aE;xI<bhiHy%gCl&JjR`UqdjBCK=0E
zehr599qFvbB%cq9q5gEYDs<HRfuga^BlWAm<vp=FowBt!YTHfOOVa7JHC{GRxYUZ5
zz@!>t%F2g8U4+w*aKRbqkizXhQjqG-uPMKKp~iKqoI>C^9ptO3#;#Lv|0Ml-5@EIl
zHXL^8WA&kZ=5A=&@!-D8)rDm}Jz`~rTI}IaDY2WzQ2$7a9b^l%r03q9p5bVtz1MIW
z8q)C;hPUw}`FWzkr3weKU9`H}`5$~NdP{dWFY{2G^*QTLpXPnol-;uFt`3hk;k%CB
zmG#s<_Qd<Tp9o0WjQ~P%2XlJ>*Dxgc7idX41q5f{4#*A)@#j;TygjffEkjm%!Bj%#
zB98%i33XK$GLL%*jLMCqF*TgocWel*;gO^1;$kD$dv2@HlGf(zom<rnJV{i^7Y}Jr
z?r{K(b`5XP(1>ZaF8T%`3A9jPQ};7?fu|FAkL*=fYcO1$Ud-#`yPd5PyrOEj7g4R2
z?dPz0hNzo8=OHF#fL#zBqB})D)V`VXbhjkFP^eOF&7iUM3Rw4IxY2`dPJ_tJ3oo{e
zQ|b<@-}^u_2rWe}(P4^K>a8wMA9NII!VH(QJ_@>T6@)~LyfQ2PvVGacZE^ZW&qd`S
zmR<eePuF<&p2~uo5BLU&mNj|zvD!6QTw*zKD!uQ<>OJ(Sn6v!P@A_#JJoiSkflHQI
zX}IsQ`GpEU7af}qxZ;6aIaO)Ohp4-PYN%i$p0tn7_KTn1yn<gw(~X%qrzwA2as!fv
z*El*)&TCACW`>@maBoJHw=Nx;LemSi7#t#ZS)@ibL^zJkOV4jkUy1Ft-zRar;EJ^7
zBaIQ_B^~P12joV_$YVg8P-uJ%w&;%!UBPunzS2H;ZNU^A3+3W_Wc8#<%Xf7;*R<YJ
zzR6^toDuO8nztT_eLs0=FPSVhJpRHj3!heTK%lqf=7B95$^cG+B=N*VT=rMMt!B`8
za`Bj1?SPZFmoQ}iYL~x^j1-T7V*4WGD;2~CQ-oMDeM#<D=N!s*-M>&z7R3kcI#n%4
z`r&l*-cnCt)IW8I9`)YN&|-|u@}u0dwoXD7+3IGKCorX{;n~YeUr>!(jA3`}{EmB0
zTJ=hiTs9a%Mi%H>{FGS5@F9L;d<(`5eWv+QMdJn2(9ZX4CyegAb;DiQxBkD!1NWB_
z?_X7RzhC>8f5J|`RD*x7`Tnl)`D?oOM<%#=kUmC6mrYWTnHK>0v^iDRUfwmW)LR-h
zUazl0B}Vu%5<Bm)QlzFA$XrDOc=h&4>!X;(ld$!mfk2v=U~Zy9>lP<VPxLzWb$P@J
zZa~a<LQ@CL2l64pn%Cc6T1{_+__w%xQB>G#fc>VEZu7fNx_|a!Gydh;6o3ru2{cwM
zMoc#agd|)UTxJhlbN21}GA2{djbmTzIa?kp+KIS@q<0Cp7zVbSXgzbXsy;q`ZC8I<
zW6kR8DwCvPnd0X#TFJ#Xqro>Bf>4*NMn<hix@`Opce&qw$bG+2<m)tjW&rbTmwCzj
zp5PXP2vzM&Ks}z~5VcO*-2E)iQq$L!uZ36mv2vQ)L${&hQwIBq)>w2n*gTYe5}k89
zCm!b|mXU4a@5eo@{m@%1|G{jDqmG>dvd_wuAB93Os*4Z>rp|%G2Ma-cW8KQco!MFW
zNv6?R(V(KiMT&!U#yYN}LE1tz&!@wQFzmQqW33XA_N8Cc$9%V}kKWsv<;l0-CtcPR
z$xUB2Y|$XOtmE|jj^Bwl8yFFIEV%#5PRx3aO9y}=J)C(tY9PBY)X}y(=aHx6Tw&;J
z%vQZ!f+>D{Bx=Uw+M28UO6lP2OyaYQc?1*28NClKkjk_vAA-o4aO`eEtuvfIa;!n7
z|Lig4S<GNfblo*2{K_JBdh$LmJu&C@9W@23fiHvWf!oL8mfqf|nwe&d@(?sLzOj(@
zsb}2#=!df&&?g?8@9%|`-o4Q(5T+?sSwC@jaLeLOX?{gvwF~zZV^w{w=6WrYC(q&&
zP|EPPU1iHDE~e!MQR+&584Z(1N|0eyoAK(CFP&?pOV6<#VlmG!TV_t+4tsoy+tyR~
z8-z_&1uJ=g6hsvEc<JP0p{(nbC%fcId7IiSe_AOhN~YvU%z8Vz>@-D4-BFX`dM~T;
zT&Jax$<$bGg`>MH2QG(wj>_Tka(e^RQN;Zw%gVk6I|K51UxMkhL1c9hf$1DUJTWeV
zq+eYVK2=r7=BaD9FVL|}uhQohSKMtzdFt)}FBBE&^!G~X6ge(GJn<Xk%tyJJ!(_Hb
zoSvle;TWb%Hly{6E*r{;1?EN<#r0fC8<-$DQjbwK^u0$ut)WT0vwV@qMMk<Mt<@5X
ziAlOoq++1Fl?#XM<*U--qX_0DD8{k*EoIp}&x@(AExJTB6WUjwD<_P7-Z8bCT5<pt
z2v?>S#J*tlt3B!FUAbe<oI!0aPY>_BchEhQo;FI)VWobZ-FqZ3YLDafOaw=r`Ly}|
zM|G!YDDMcUwdO0@Jx`iRGOg<EI_^pekDA8hdA{jSt-SdxCSOSLz0s_}li_k9Z-<&b
zE11}ZUPR$uoGR^WVqK?LYt)jPpv%;9m)&ONRT*08&Ik$Zs{nF22xY1jCwEv(M(4>Q
zBE6i>T31UXHVhe@I{!(_VIL{0wJlq9&H9p|g<;)$2D#%!7H=nIqNQ+e6yJD-p9f+m
zo>z;Dw#FBS1Zwift=mXLL;=Ed1C*g!bb68z0Wc9_sHT*XO=YXp>f$aH9RVGGO_4Xf
z!juUuw5=ERZtTkX(U=fj@Rp5ftV1tX<xb-KmydN{@Vxj%KXNaNl42!gD@p|aNrC!#
zR-mZ3IHv3Q@XFyvHjb8u5*Pi2&#!)Y7v*HBGb~!WV%30QaVHBC1DkRQXC#rl>I7qS
z(=%~{D}}w)T(7QPHE(hKC}mrq;SOCfx$e2DvNRg6wa<R<&1?Od$_h3u!L^3P!>(Lq
zvx?(G981^kSs~*cNq755a%f^CP(s6_%<*4P5@oeV`WL-B-f`Kj*;N)5_6x~~@Xfr>
z^?#;qRl3#Mh#Kjbl59pFa;iNH*sW{_OCO%6m7pp))ya7PXVvWhdKX&9>s8D5*FJoG
zth6*#*FN-UtZuBW-6am7sqGE3;C@RBP5B;1i1={<@v(7`;>Yl~A+W3fztmx+OpeR7
zI?G?ye{1Hx@PiYYeASfj_D_{7gVrO<vloc%0HWyLGD(+u`4V0}1gBUkeqLYcMCkUN
zI@^$y8<!|wXqkFe#oPn!jJ|@wabp&v*R*G>8WOZ0`BX)4@Gvs^v%pHZ$2D!%EU_Zw
z)>>&|-_+jOIw*7LBsZ~Dht1dGc16ECI=xi8{7!P#+M{ElEzP%^><Xlwn?8jf1qBvn
z5^E804U4|NWj#Fda56@2bo68zExYp@f+kZOMYzbS=nInz4_}@WS~+6<_7p(OB{P%=
z(>^IzZ$4Ow^oq?M8;T;a5M|X54-?<^t{5RL)CCFRKzZ24y?7gDukiBJF%EwP>07(g
zZeCm3zMZV9uuX5G_cRkjaKnyoh}=7l{EdZFn#*>@apya@tYuf5kMP%<iXNNMX}hVx
zadh%i`E*hvgD=+lZY}Nb!ZAr+KljGL!JP=CtaPLAtsS@%<?g@-2n%8Ik!Db<o^G2D
zj0L{$2L3EoD`OhHpZu{_g}~Oha#$0`V6<@zX;@uU)SoA5FMZb6tw1<df8M7}TP1?Q
z7rbRbWW0c#Y*@JqWg)X!&YN1(Rny}9y$?2ebNBYRJ9vvy*Te}L@<k~fN;bQDYCeE_
zXn}h(G0BpuUsxe=G$|lrq_Lvs?8@aw2kJj_!f`V&=@O=xNv2>K@+9xU0Wy~rV3L~)
zaK9(#V&5Mxq$6=+ZQ3_V$lF?`jXtZeAz5m$Iu{FTo*dQ&&#qQ}4#B%D>$j1M<erzY
zWYB6{@(fCPAEGt5nmJN?6VnmbeNhSh$?-<S#PNu6R>coDj8D@+79mqt9(z$CJD?*O
zIMaqDJ#1?o^8O@)K=c*7D>8ObD3nKe_=#=o$C)*oh_Pewz5<YRe>LSH*Bb;;P&{>C
z3dhejp{UWZH80_?kKW00K^G5XTG|F(I?Gd9=xf}W`~c;i-ecd|591`$>l1v9h=B;!
zf+`)n<bzxA)9(krAWFrP1?vvP!^CQX$z0HJx#dgsR29OMF6{PVXYNXOwF~j|cxeuV
zwtntuL_P!?2IGK;_y%EBKS;V-5v0&!=yHuOZKT1{-@@vqxQTY4uJ~ro;Rj*iQyaKv
zIQM&#%p~DmdN{Y0-kHh)_gd(Jh3^A7SAKytiQvY~=m!&rm??`Jx##mzPcxw2S?8@<
zT6TzebsScG6mOWUVcS+eVsIh0BIori<K<cFNLZ<FoqKe!U?Cpah&=M@U9PodyVqw8
z`r*)%5oX<;AvUu!kmm_?=rnZ-K?-crlEhawN!$wiia;e@BdRfKk1k?xa6;EE^ytGc
zDw!fL*wpj1FK^_`UG-77+KaO8+)E&{)-E;f9v-DpnzA+RzhbBx18^t5(bj!Og8Yc)
z0EiCw$6Wv)X;<%uEecDL?}yd`77oOB07@0|uK+0AAS^hR2O}Dwu-4mbhM=zbNA|kE
zpj&=q0{Q*(Z$u!!p<e!y&pr=`ME;65<on-$`Q@((@1GGgKjIW9R{sW-T*%KE@SVSN
zDzD`rZs6Z-<`xh?X2QMqo{@}Qb1X)ky0Yif7>CeqFMF3GaOXBVI2@-_Yp)g_ntE~k
zsZ9EAS`>uT6gd^SWV)*bQn?-k=w?E}2h~GZgYcorkxgZ-IM1!2q?D*9jw9yxrScpJ
z=~J^D?8nQ+tq`EE!5m0@MiD~@xtrHYKd4&1fM0f$@OI@gPhAo!uPJAEaO{asj#aNt
z-SXF&^M_d$Hdw*cLTmQo!G4~Mf|fuV5F=-&FIJ}4rejmDDY@NIlh(B<=)F@xr<`9I
zXEj@qyp^nb>-Gz!tCTxzn`3)vWJ$Q`Krk!Zgm}a&8`0o^&oE6gEGr)1nJ#-5JKZiV
zpd48DB1gEAqhP+yVFjQm)@T57Mq&3V$cPuceTQGc0UkOuli&Mk^TLXv^1|BWrQl}w
z(&t^Gc~6u4Z&9(gs0>w+`%nkIgHVnxq)`(Sb`^=kvigYng!BK^IMDXuXk{#Y=sbl;
zd~)MwWocn_5n!Ev4+D*OFjuD01Ac+n+18*VjWEVqUZ<+8+Uz$V=YOsJwKFh3JE2>r
z@J4diTNCSP=zVQ$f)4GPkthh0El3{tK>|})$_ER$3gJoYyPUmOHb=Nr{9pR6o;H~v
zo()&z-Pp`Jx{s=>re?gPEXgD9!-bf5fxGX&Hqz%YQ68$N#!$nio?|FoOOYedt=B~R
zyiGx-+C8+qstk#xy=XD+(7!C`;K&}Mq;qgPMkYbzl;SarA<U^~c(xT*!jhQu6394}
zq4Co?QKA)cdafdTt(PMfI=FZZq@|y+aA+y)=Lun-+KH@Z3Ju=3hf?R7LmaH-8ZLbs
z_lo-FD)ZV{4}WJu_mspoH^?|aSWaJpKsHiv!6*Erp&&oasA`H|#Z8Sg<3KBlp8wr3
z8_Q3;`=@Lj9O2W)-UWb1b#@bm7g}n@t6adBgUF26vGzy}F$kL@!RKl}v5GCF6&vdi
zyQx@fEGBsUMb!y`sfUdo8<<bgfXf^#@5%v^#z)nF!HC(W37G-81%smV_SS{t&2Dik
z$1l5lIq`liR_PZ-ktnh%Snr`G#E9>dLNkVmOCuewgfa!fov(z|M?byPseVj%b~RE-
zfF*j@EVv`>dxIeAPd5mT_XAClBv69_X-tv57a-munxsh~=tzS2=INHISB2^0SI3;a
zPRAU~&tBoWjyPj;>$YvZ$mFXX#`qNK$ZSW$@vGJnsjdtK71d9&E1#YTp-ebGDH|^@
zz3gu<m{yt(TwUL;d2rW=(2^cLU>Ex;E8xz<GfFs2Zz+p`R33V1ZKk7y<+!=|^z{QO
zW{)%=LmfLBAQ|#T6T40f^mUz*EI$h=2dAqtm*^yW_R-nBC#DRFP=zi?O!<`-&ERK%
zLO&LRzkrMcfIQ;T?j;hedf?U2^17>bBjKv^k%vWAW76|XvYnNRlL9gjT|Vx^210%6
z{J}kll5da(rV)o`C}<za-iyW^WV$bpKT(5SvUez>{xW_>@Izac##gh$Q#rm|=4LkY
zurO%xJ?H`TQ*diyF>CEeF5Il9pxQ;|7C-BWW(TfwFSXZvxA%Nr$*(I-&s9N49>gcR
zf<Shs1R6``1<vYSuA@9>Ygo13D+8c;B=4k!%ARBHn4ReEt5WIm7mGWyKdjst_3R~j
z08xrqMB{p*CPaXGgh9vze^>*Im9$?_Uww66Z8K@G$iX}7BVFf_*#xHpjfa(=sDw$5
z-2o4BEBX$aDBRP+#5e($8Ms9{f}b@QxHRIdyb<2jHPBxA*!AgfL+1>~qelu$H%JnZ
z^lC|0_Y%Za1$GZFOcwPt2yl&$JC?KF9-Dv)T3KJ^S?y6d>H13hyZqtN+f+f7nh*d}
zUfi7ua>1hNFaQO~NYc5fTpm%vqjK@xDtGm@p!_P$6D@qKR_|}$mYK6YM(%|bC$-*(
zIl42E2Vq4s%Sl2}c_n=r&O7o2D=cp_Y&nuWjv?6in9WZavde4GtUCjbdt)yHVYf1h
z+H5BVd9yXUpcws5f7Rkxmt>erlGbGySUdkft~>n>?lh%I*Qp0KLSp_0+Yz8l>4YAh
z#j!PanNCs7MsT)CHoCLS1$5^*BxiJ$K09Z(dMYvy9_gs!)q1RU_T^pG(P_}>V88=N
zLwiDHVUoLgP0Fm<*_QtKMKJZ{K^>ckI&O(C9EyrOxjhJ5boj&xqUf#?ptW|7iDAh1
z3uvFJ+!c#3^DXJsT~#s`yb*b$D~JtPyD46K3OsNqc>uwqF72}92ndqt=b*!(9ML`G
zaN1aFCAz!M(@wR@0q6K@>-bL+Pb_}}&gZhR^SAO?kl@<hj{pbirOAGD-?xG939G1I
zz<K-Q|G7V2kIbjot#8Sfncg1Lx5X*-DzS_R3GiRtfBv~wSlDSc#~q`=;EXqO0jk1Y
zx!2Cx9jR(Tt44DcmycgEyQ{mXoC2v{ex0{mZ>%Ah2BD~w>r{A1VvRA}*i$pVctF9>
z_7LDiLGL3hS|FRD(N6f12|bq=b0!_$@J9tEaRqN_+aP<yex|3A;zJ?*W5GSB1F{Py
zm6&qB8}}GiJAA%ol$j;cNdwg+q+-iZj*%j#p+}g9o00R9yKTZpSFbM<PSN>FdB<g^
zS*QKw-wtl-s=Z6g0Vv&`P{h~keHgq1lq`ZIUW6a{202Te3dl!pe}fQ=zZia3ZKi$o
z@I*w5xxgc86U&?f*ZnD($HG8aC&H6x{0(w?8}Qv&6W(lY_mFk~pf5xZz!RWlU5ME+
z7+x3=H)oB1P81?XFu=eKV!uIfuYs?ct%t3jass}TjR~Z+uepFi_zXUm9I^)JQZOWA
zD8Ad84)YbNK&I>f%-x0?F$?4%(4<iZ+TYqD%epW>j;#X51|^=qHMU+3`~Xor!*UO8
zid;P9z-zmOK5V-=)=8ye0Gd2(Ov~7+uE1Q&Z=Q}n*cwO6qcwB$<mUF!f87d`D+p(M
zDiBjf-yi~mFsu^ZV2_>?L8fZ_KC{29AgGjlU&87kGDip2bdTc8cgi9J@eK_7yp{#=
zLEW81n*`c1G8Q=gF!nRV_n{3)NUo1SZD*2}e8R8HlH@#MdViM9W9*Yog6r|mw=>-+
zkWyg`!|d#o+(Uq0r|}X=32@&8X_HB<0PN-B{=+pp`pDGqBLlCh%lnQgNYAZ4m0(q=
zWN$vnadJw5A*{F7oi@>fkyj#(_e#IS$i?L$*V5o?i}>5a!M+-bhL4ZBegDpPVtkm1
zB*)Z<+TQ9%taKv2)AKk(BVlVR-~moP1<!5?bUZ7;MZQ5^z$b}EB*BB!Cdni<pm%7x
zfEh@Cx1YYnif7w%!LZMF0wws!&Isf-I|knmV?@kOf~CVqf!~Z6{4^}M!~f&B4|!W3
zVA7JN$r_6lVcR)m*yo!+Ey_t?pD&1BfMsL{xwnl3>`;S4Kh7=*S~nT$xp4UFp%zP{
z(Bo-(9=<{;g;I5%?~3-RQfL?A5VKjtZ;(fU>c7q%bPNBm^nlgrbuc%ukJ^lHkYF3Y
zq*V%D#edh9$+CgGC&&TT$ZeV;9MhL<FnC-vkl{UxpCt!vKzG+b>l0wL;*7-hkap)`
zTVG&g6-(<MHp36&^LG5hwQ&0P&(a7S^QIo}RPRtqCH3cLnA?@Jd2$#jV9nkx-VNjg
z#oWJk7QoZkG=W9aBYcDKZNfE3{of$aRVl=eYYF(3ey|nL6Z^wJL<h-m>vg7Qzya8S
zo_sar5rmp#D=BQ)gJ$hA3DMRJ{zv*B>;M=ZgT`MiI8Q$MkAr;oB0pTku4(eO*<Sr;
zW(zGwHM~^p`&+(%<h1(_O@ZeJQ!tfO-%n!in>e|G+m#vPDSY70b1+TuQm3>(kBA=n
zE|lh0%$d#c7i(kM&}5&vn$eeUEfdx5e);Rg{(brY%<$uCm;AKalC=j(G<^~bud>8U
z67JH*TAgkosxflZzhnvp)%oSP<7M%}M!J+D?XOuGggFiz2sVp7y%41q3Em;UJ_Ew9
z&%pYJ9X<p7@wpB>14;+FuJlQ4te%=j&zp}gXBrzD#_NiI7YaA)BXJX{oCOpVn43<V
zp2HZ5)-Y*Z#qjM!fv5e$r4s(Qc|hy*A2(Ny7?~DM-+wdBRV{vA#dussGq}4jr@iBe
zSIKqW+K7xIq9h)A`MIT2uco)m9i7tsiwG)D$4ylO(mDpZ%H+@l?J@vX%m1^jB7SfU
z&Kuwj01LA)&b>DOh)d;8%iM`-zYh)r$#<ct;>bG5uz;+hYjXu$@BGylA5Ey<|Fmv*
zlL0ukZ;)R-8}V1qcIhYk?fvme!rqeLdF+=pkDoM)7v-?!xPrPQCBt-mnKl=VKQh(n
zH9D$GYyP(0@zR8%6NKY9^<n|V+mk=t)3KyKxO<<U+`Tmdn3&Bwq(S_6;=Hj$99Q{a
zX|xfWj}A|l<&Qfi>A#%k-*f!$e{}pauKx<h@A%V#{p9$s{Pf-`!nyzE>i>sl`~5Zb
zNB8vqYqr2zetD_>o7VPUG~1sX%|H8o+DrO}UjE}h@8y&Ju@(GuSoz;=vl%(T{lRql
z>e!NK(P8u%h4}cEXpRJ^1Wr&;B4EmaNA%}6-5+0toJQ$QU2;9YxV-a7W;r)MaF+A3
zF5Xy)Bpt`^T_4=Y<+98_^F^=t;P^Q-XHljzH|x}+XNCO^G&FpH2$GOG?KepJ_h6x}
z0vv|dtp7Ot&u`jyo}KFM;f;+97oVtTTH?Tw`Iz_2x{RvaflJ|v79x|t-wX6&emjKw
z{&)!gHH`T`p20~jm<5i%id0n8%0Tp?4g!-9JreT#PqB&iKYtI%JO}Hwc@&vSl6+3B
z3^=u)MxUGfHSqb%;GnzzPc0Au#1DTp`9H)azb}jOzcx1c9`^h`H0OV7#T|EAyuc#l
z04gjn*yppO_L#M0DDfz!Z5{o4#EJSX;=F=r@R~yHu!B4s=^)6TM4{z=e6=8dw4t3A
z?>`Pd`P1;f2ekkE@SN&}&%sgk4Fb$}n|X5>P1=nFPj*#Jlzaq5`3>@+9>ly;S7G0S
z)<4F%xm}1KV!t24H1)z%#D5K3{^P)n*@!=k`#r|}9zXwsaa(}-!T!tq{+4mi{T_J#
z#s2>M2K~pz?erhx{-bd-{(Fs^@h9V6`IB4ce~oSP{OfG{C+quHn)d&zep~t9<+uOM
zru~;h<X`;uzs$57|6Ojo{@>=do&K$E``=>QgJP-%*nATY*H_MiNr0n`p3v4B8X$V)
z!x5s%ID8mqJzQLGklCXUq28D6d|N=5A}{|~NtASYn44nTd?vI1Z2D3#jUPxsw~+Uj
z_siL@N#4o|)V1xAe%eq}xqdTGX5KRpS5{~L36&=%A)gYH;wB+6H!@_A*=Ks~RfSkL
zrrhk-)uXn3PT6;ss)l6;dai-=|BlSWPdHeZJj@C6sTGuzYGp=2!MF&GOvgi;66|<W
z;VGfAWeNo+jw;#kv}qlBldE;zZ}O%>TYWMKMP{BPiXr!yg6TovbqcXc1$2^6Lmxr$
z0LoEsi}@Oeci7tw11UrhIo(qr9~1!D^~o^UN+*;QVvPpk=>TKPkHMQu?(mX0KnC$T
zI3Ll$uneHS*9OiOTT?x|YcwE9X1cI<6i`<HK?Zjcs~$NLLyeex3fta~B%Vb~6~Wfk
zh%#hSJxGqT>;Q%)NbqSy0~aV*#)HH6N<C`p3lsTt#((DepLP9@4gALj{<IB<O0;eY
z?G<1gVGlr?v%*s0^b+(k9vS+!`LnWm>^uFjH}7X`4~=SY=7k&cbg0~;f6ZLBvzPE2
z%K!Hsfx*4qU-X&)h6?l)|H42-`H#Oqhrt5{$UUgiq)76K^i?<);lVNdW=ViHb*bAy
zr!9sL6vy0=N^><xO?34_3(Qe6oE61MW+p~sKQGN#S!;ax)UCczvr&0?^g?!_u5oY%
zA6{RvP-b`m%f#~<h-X^*A+RqKVE1YnTY+Tj6UuEb7gGxI@xiW7PZPF2^S07N<YOWc
zrRq;HMd2$g2yT{WOT1NS3o3s^#?>S5Q}9f>QaiQpr;f>6chffdgIhtiNp6w?E(+Xy
zM(b(JLo%P0E{?}jo9pV;YpH|=ZTz;>6RT8~@_ltjdkf0t;F8}ULNMIQE)}Rxyf7ca
z5F^j@!41+UiN0pY?xOw|@e_7m&+BCA(iHM&Ec&A%cnk@Iq0s<bz{W-naR8m+9k+A0
zz~zQUP&=1Zd3lMVh@tjxkhu%nLz}*X8=_Wh#za$`F1*X7&KGvWUd_JPJ!SBc%$B(#
z?_HbM`R-9L4p(*Fx4GHQKE4*V5iPp1OBc=H9kk1&GEv$)-K}E~x+%BWa-m1Wq8@xB
z4iQ0?8GV?dzioBIs&$;XbGSUU>Ki0CIQs(?G@uF@ZGBJ<cAu5AX-j#0W&*WIv&;C<
zt%H)u=TKDj+X^QQ*DT}vmjY&Eg4~kc%?GB8v;n+cizV!SoRe~Js*_jFMOmU<{|0;d
z>LOpYREFxlQ7)7ROvJ$*on2)b3WpLe=fGioCAzNO(H(m7eJ|NY#5#*dvld<^^Rg;A
zV*D$LazvVDW4%_qkCd*9D3oQR{Q9u&A+`LIb19KA>jMLfkBSfaW!bN4Jb$(N^#CKn
zN9rA)SF;~ey{n{F0dab|qLxc@)1BHv!`)rg<FM<+*O}X)5M2t#wp$+0r(;Y3mW~*W
zlS@o^MRcfBR?qNeE$Nj=4|;XRp`x@*KRuqmAum2c#r)}YikP$%D5ZCo`ukoc$k$-V
zAnACvnPo|?dWKtJt7vF?xej~cleIMM(*Y1F3yiSDka}1aI>j5q3U@3gZr#Av$ml;I
zG4MrpSF+kYa*IjYBcD1o7I+7pm8+!HoP8S|PU6ak8x;|<n{(YGc8tS^hD+PuW}_}W
z88F+vE+!>tbG+@0t{CL~4q;0ZzKchm9$ZH;!woC?7wt=tmxt`r1~SjQ^ou!9(PA)R
z<k$8ltjM<gmJ5K1!5)wT@u7{aX$-yMlNJ~wjBVBPR!UE8nX^((`x6S!7c)w0sSMF(
zkQ@oI(bF|F^<<dU;T`B<olX2z$8vE2%dwMGMvh|%5pDZIxHoatc|aR|-(I3DlA$r<
zn%el=Y{8v~M2fQ>UN)PRR=9(WJX1M!Gy-wYP41*|lE;Wh{0fk4#{-jUNa2lpo&K((
zqQvZk*JCAbEuYm4!^XmT!Ptz{E36o4rL@R*en?z)6T@X(SvI~H+x#ktrR9MuLvzzk
zW)Xlfy}{my6+6sg<*B=Xy0wc6mr&LBdSTHu&7~J8etm`QkVTu_T^1iY!>7XhkEuU<
zJoiB-tIKAGd9NI@b_$jvn&vN*%ja;K%>(Ay&iV`{q>?!Yos!5trkKM3CjN#5>4kg0
zBuVrx2J?4_&eyfoyFokC6wMzz6!g>;qfw1N&2PXL@;rW~(jy?P$C}+`Cn*+iT{w$7
z_tde<mj^stiCi+ys`0f9^y@Wh{-mWKB}4}iKwIpdsXarGPX`zVfYVk+#paWQau#Z#
z6(3!fgpv%xy1cK?MAUVrxAD0_K2xMz*}2zaNz^AmO$j+ecbHh_KF$RT-~nLT{bqPa
z!)_AXv#FKFC8w=NZsr;r@g1QUNFU<xl995nGd`4ZJrkBdXFs|5xPfRkeU7SpvEE1U
z<k%@Dxgj{y2a>J_nmCGce^63+M@iKx@Q9`PRS#94!MOW2PNqcj!g$y#2J^kt5(bCH
z2~Gk_ZTStkdqe8{{cjK1pXE|D(verBq|arHthroNQR*W=@NHV*86_ecfqNwJXPUR;
z#xEO?Kh*ACL2v4@C(XEBa!ZhQGj5TI*~$l;Vu!2saN?#-wX}qYBnD&@Tw1_a&xs@d
z?afr(D4pS!DcY;d0jB%}*1o3N1H`T@xK-aB(Vjz2N1O~YC(mZTNStSgm;Ly@FkV4e
zOyl#ug%8~Bw2q*O!l#%ZgmZRE;^lZpV0@n97ELvE$m(RM!l>*U+E02<T2-&FY9C+C
zr5bOm)+Z$4h8jl|2tp5URVxq5cSg+W7uVXnZa%_Ht4}oN@M@zI?NvVpzer$BMH7AN
zCK>PS25Da-a2r_(CdIV7x;rsbWhFRtdg?&vy*AL%-qth*{&;T^*9$mbe_xBo>D<@O
zrt&XlK7@%q>a@yy@>%WZzIvfYN;@tsJMK}c9McF&xM`m(SB+11qh7-K{(Lc@5cfdP
z*gH-@(7{FG!1P#5RQA#Hw;GB12;4K!*m=1{yT#{}nezw7!NT)p-97XnR`Tr}*STE6
zp7Uy-pI=lzNirrreB&ZbI^KJy{>9gF16xTsT{{MURcrXUIOG#8?atwaJ|zkvtPa5k
zLs)1|Qy+xOAh3IqM!ieelHFUD9En1w6{en;@*TeHajXbV^M+VHb<ib^dJxW)=NGA;
zWSF*fp|+P#?@6L)LTY^ILSa1*tx!VC{zQG3FS3E<_q{Pu%tV-8?T7V;$_$=U{20B3
zmt|#VZ%E6pb3CGEXK(R}*SxI`AvWW<R_@ziQ4bUJDr%~VT{`r}Ij6eZu(V7^qnaMy
z-Y1aI+HWdM=rAB?N3SCxehJ3-tmUlq(XpUx%MY%jUC(KmZ_($LcS>=8zAaN<Cm5?;
z7tDpJ+Ivv~Wg`Y+HzvcX#aUCm=ztg{weQGwymw5&!>0wt^ur?izB-+JYo$@{^|7_t
zJ&IR`Fc}3@AbMMMBADndioa6MEPAjk`1$Yy=(v8}-BvYZuo|>w$ohzNUEEd2L5o|;
z&lBT$w74E*N;N-?B^-P?b6=^R&%;^~ZUcymqU6NAC4!GGOgH1JKg^BPrZNg7<KB;s
zaeVwR9WHdTiC*HO=-lLf$6E17tXAp^Vz-wEx-9L(*t^=zH6ERPlc}9A?sg@_)3z_1
z*A;v^u%Q~bX;VQ=7HXWNjc&WshYhp$IWPEl;>mWIn~}VOn*W@&=};%MnEVb9tNMAJ
zB^uz6G%lP$n{h`ISAwr=^_iVB%cX6co#i=|owl*Qr*D1#^)0yE?sZ4DT491gBNL<3
z5cS~7rK;K}4sE>7r2QuZMN|s`jkG0(O(E}bHczdVT3WL^4Jtpj!qt=q73K77Rd|p)
z=r&;wC%6dIr37uPM0TcA--Lye#gnEa&t@)V%M7_%PAv*L#=iD-x#>wZ@)2T7<FtFE
zH}Zhf5ZeUTkX(&|Nv)26)8WC@UOQboI7Q(#1qt1GUx($W5e9PsC2?~a<g+@P%~*m0
zNoazlhG2!+v_d8@JjqOQJ+hW$r)BjbR@!+hR;-#1MY{wyn1UXh@VhvAmT)oITUH?v
z?I0GL_b7S4lHl8R!n;=*Jh`QVa_&d{C^qi`PP3bMw_+TF!j(R;{Fg}=%hs-_o-4L{
z`g&S%>PwY7=K|+Y3pA`&x{n_pi+*X{2-%h8ytiM;?YQ*>|AQ-qx1>Whn%M%V%2g+E
z21^j{JuX~Ns7+sZX>Fu~Tz<``M+u%SS4y9|ia<u}77f_d7P{rEB<pu*nwjXo)~e$N
zCLiSGRdYBTDlRGw%we6eP<?N6<^aVkRn`7F-;5>%rK-C>eiGXxHCJxrypumhSV+I=
zN@&a(%UoQG&7HY-x@m8WdkgJONL_hQ&9ZwI#cScGXF_01mI&FTpDQD~9ry3OsLOwQ
zzgM?E%lVFT;@4(?BNl2z6HO+W?eR2WE7d0$la<G!7lg$+cU`{-7pU;mOAohR*d1yg
z0!{h*T`>+p(&XMi$J%2DY)(B>vR;~WUi$`_d6_;vLngA5c|EK>nYb39hpJho85GFO
zOAZ<p`qEf_E3Gjtw`-2Jm*S}G#p*)hmPMHES~JNa0iX=u+>OS*b75kxcir7SUZS%+
zsK2x|_WJgx*2^j3qN0TrW2@qN7i)+~gg{X2xU0^eVKqFb&aH2HspuKMJ;v@pi=ELv
zk*3>P>iDlsCaAFBW_;vyWNh{EmqNoNg%eRJpH0piB+(br!xCv#&fX}Zam{!cVx`@z
zCe+N!Onir(j7fujd<)meZgh}H&KWU#9Y1%|(_HYJpxft|Rho`aEl)n83wDy3IE%B6
zt`+smJy-dmq{gUO_Sr$v0opr*Q%usj%ntTAMeaS^K0e#rxz8%jUeNuuEPmQJ_YiBG
zb<?=I<e`ON(X=m4C#uFKF1U!ED{SmpZdg?DnF_hf2zjk8Y2{>1PZlK!y6ACr)WEdM
z`j5qq^vYLNo;-Bu%v)b|mFKhE1L(*JenM-V73(ZE4Kr0^)08;k-PC#>(|g?<TM=sS
zpqU_6YiS$b_(eb{24VmRTNIkF2@)&u&zg%IeOU`eN3GTHbhdg5DT1TiMG%P6^dsrO
z%a|J9g8cO6xir;c!q$=k)^b5y)Tq~FNUQc?!sSvIUG`#%$0mYByE{W8rE8P-OBg(-
zHy`0q_g@sI=u7lz)kIi6Iddac`?fL1&i+8gjrHSphWTPnyy==pP3(SWSp7RxsYeY@
z|KI+_lQr#M`Dy`5;y1q9o3(&*3-dW`9{M}wmJ~oXwhhseIZ?Ye)`%<H?ARI+#8P(e
zx}j!}()xa*?^t5co^)LNm%gRHgHQe+{)M)zVaRFdx1l`}ARPSz3)gq{^?&>YMOsqB
zHI}rA<-s7{ZXNe8yP6Gh)pjSIkppzHZuhiKD9L>Qw+-*XBDMkUl<gbjlZ52n{_fhR
z=w#9lfovbk8n-w}`5R<oGn@Rl2L*V$%J<+X^5ggAi6#LLi-+f#wY?~xj&n!xaM1{e
zcrqSn+sdVjiaLCX<;rzHN*i$bH9A}U?)UDie<EA(5Aq4ZZ@x}@p1RQ&mIAS`5YBra
zUD;+h@Arb{?-Tp}FR<1>Fb)GDlb?9tGX5yp3U2}MQ-P~OL}$cOWY09_vrWW0D7lxR
z^nlF*)BVo7{Db-W!<x~tr~|c>Uk7)#ntNEx{p`C5oj#yZz|$^ui0j^|7f!aL6|A4K
z9r?;=<knhAs*#(=zd>GR*#Xa-G)Y39hPoRKH9_&K&`(L^s3%F}{nm(8wI4r2f-stJ
z4M4!dzxM#~HOCw=b$km<6(Dqe_~rx6Xn!ez=BLYO|MU&G@JDNAL}MG`ruB}9i8YZn
z2yEN+pT5|)xgq{%FTHO1C+?(1@6TO!kLAza$A1>^Z$7vGEa2bSOaHOJU%baq4(a4x
zKE?qW%em%fiFJrw^j^BIDcJClvY`88b9tc1#kj<S6%LN7wwsEO9qI2hmB@zpBs^gH
z{_x+*NdNwh+0JMH)No#832=zGYQ0018YF2g>t{{Ah-d~16$e3z_H;2i^K+u2jsL6b
zaV-aBr0RfZfY6H{UyLiiy%>AqV9wC{WSP=II4xcQtNvodH>Mhq!yi}?TKvh0RlBRY
zvhg;p@rbngjcTT6EYOx79>2aRObaYxLaJim)iW&SzAeZ)yPKCKImPzwOnqtD@{v|;
z?eyfH4u{yabC)mHMotSgLwSP-lD_t2&wDCF!o{l(m1`9uCc5vg?_OD`-aSe4$Yl=k
zaPnYDPYfVtC28Y_j2ljrIuja&fgqs5!L_p|1s)ll&Tm!qur@A>tPRK#hd1sDl1v8F
zg-C+sr39aw1XS4D;~(UR*84RveLatRPkn>DdP9*m8hvuNbbUk5gkzO$Nsn;3wU)b|
zM1gn5%JnO|$Ecr}>~UetP`&2qv?=e1_VpA{q@U;6A6DP~nVA8w%c?WN4T-+ftOKPh
z(H7;gvZBwFY)}RROG{f>Sicda7l|zT_uuebu;pH+@nyk5O9xs>qUe}ON`xcNH3hIJ
zmJLHyvB`O3$7Dmh#Z43kxgzNp4_%XHpH_|9K{ifu2Qv{@uJO|2C1cjn%r2&^m#^h<
zdiVR<T@R1r8BdqUiHM`-j!>H7<~G%*>R&~&1P@QrR7;^<l*KN&C@=DIKCaK5=QK%{
zn~6Xj+uKOF!+snVa{>nf)Y&H32+*u)gi;a_Ah+u6N#-J`7HHZ8x*WNxg~QU{pS>=~
zZ}@y#tuTeuwD-JP1se#B*x3pJsimNPbuO1Glk7L6E&)e}0=ypw+a{=Q$GPDok6p}T
zFR+Kot5Nw(asz-|IEofw{|z#{afip#`iLKe1|cmKUKL(9(PtL)#xj}x&C6w-fv7k4
zW{%Qx!ry#egZjgz_OffaNQQ)a6Oe-Pfjg3i#L=VaMT2?A`@U3_bkl#JRo@BK(mKmH
zFG|yjDPwAI-{*%m#d}#U@bcH<=fzUqIgZ>a|1kHa4z-?qgf4Sme1_M)e$)GY(=FtK
z#Nu5C5(AV@?wRBv18lC98{k-~?z4}b7Y(FcqL<1mYU-rk=5jRhJQx=1a%9t;n2v9q
z`hq6RHlWz$I+&RJLZNK)%K1$JF@=rCmr)+>heFcL56J94RCjL7p9ZSf{$2&;H#f<m
z&O47`yo{Skdv|MsIZz%${^&4DH~K<l_`%HiM`wjO=;@|aO&<_dHXDgIrh|NSde>8d
zXy_-uP^@^#lEticMWlXJ;+b<dP6&uVp`yxf(v;A5*O3&&1prPAHD9>oWRg%m>h@MH
zI?&k2*7dmeKB?=~hu;}zb9+9&>nXFNIR$#$H+>1b;aC?09TB7R4f5bqX=z_c#oJ>p
zC2@6TQ}VAbfJD~CD^xAI6x0d#uWpB(+snF6blp7<_r`C<WDSxuS*l04oH#EgyU3@D
zoyvNS^cD0F>fpX!68Px}Ra8j)>9+}+Pxdleig%%1gz_nc`^SrS?ZzKpvU+(d?eLHu
z{YO<#iqclTP_=r#P#>7XI~U(QG|b7eC58j{tWhd=`pbb$FILFT;Wq{!OzYM8G@%8O
z%`TeTHzIMGV>-EY=hzCaOTOU1y?KwT+!%`4z{FyTp-s>TX=lvgFT_afB#+CXujK*u
zIS!Pjak3q8YSoV*=9eq#Mts65U>zF{%?2Yf*p&v?fX4cr%z%hWoa@CSUepO0<~182
zQ=yUk@zi0}Pzn`@4xa-HKD%i$G=*j{lE74lDoIT62*e@iMkX|~7UC9qAD*|8;9AsX
z*~sjD?N_FAyVb|Dj-vEFi>h_juvzdJuL_2MY}y5uJ~$!qu_QN@#;81HaAJf!$bKx!
zQFXV(uTikgj8EjE7fJ7lZNuzWU`jEy6vPhfDC!VVVp$7mkfvuj>hd~mWVstBiD7Ay
zhI}mGUaRL0b!q0>93iTxXL#^FutU34$)$cQsTeF-I)<Coi#5LfaCd{l&O}in>b=q|
z%Pis`nUlx?7ba9qPt7)sA|LPy5sVWWgZ$Pk$BsEuzt>rM-*M}~5hbJaf>tiA+g^IR
zC*VOu2CVgPb^|Z(kg8!8(cK8Yl;Sj!nB?!l%~mkc)O`Hxt)}yfEAez0Zb~gWiY7cg
z`8SEBQ*-Jfs4!QtkA9El^zvGeN5o{zOCpYaZ2y=HigW$94GgblN5LEoD2NC%!fXV;
z%((L;Q;E!5XN{XMhbUGpzYOX1HEw?XfT<%R)e4*MlGQnZPOtltk{i1PQO20lr|4@Y
zYSHTY0egFh?R}K(U2ic6k4twjJ(0<RSP2A49Eb^CZjDyN*}YN^=Z8%XY(BR;WjD6M
z#9X%HwW(u`UBbJm7n-1@tPgjUN65p)aP5l9{<H($mDM7f_=jA((*D%qNe90?pu9kv
z;1g&g;IT(vPMn@{D#bwjJTg<gnI6a+S<i_a6MJ~nq+yQK%FTZ$O{Sk<owBpCM2nxi
z47Q+;1sqm9m~TfI7>stp*1r&o@`f!Py;JT;?m)@X=kS*;DRF<s)mXMlIbkSjg@W5x
zi90(yLb~{gCxI`mCdU+GN4Ua!sj9Z)%iq80hKw~adR~;)lodsJe}Wt1V>1W_mx(H_
zf~`#fTB)o#%Ir_ih`+jh-{fL=kw42+)#OquUgg|?w~9OQ**vHE1Mf}ovsa7yPE_=Y
zyGb9-OFDVVC!Rt&!f@f59DcNAf}5BMD3eX9iGgqGb1k)}-npDai`$xC4-9`IGt-6<
zrLwOV(P>j1ih~OiYw%(9&;p^DU@l^hc|kA9Jkx^sOut_?I>$(5TaN2lH0op?!*1*N
zm)5m#{!?1oiMK1YJA+^N&EimDwNR3L4Y4@iii4zJ<H9q2)j|^WMMLTmlHIzN%a1R%
zRc<<sWv@V;#c#CP!XSbq<?z<pV&SrQY1!K<<JQf~7aNbkO5$QOxax${6imCxun*po
zi~yq~`T0Y&0atyFrJqT&U6e+dPMF>i!COrHaR-c;_+p^vcQIJ4XLea|34BCyc0<9a
zrIWnK{WnJ;d>0#IW)oH}-x$l9LPV!A5F={E+!;D#kW};KDe@U#nm#VQD+KC;M_@r(
zemCmTyr9MJR!^9Pd#Ebg^bBYIMr0FpB~m-0&mb`{_ksAuL4)JLcJ^*;s=S#Y3D&YC
zHexe=8p|-WB>IwcX2|u9z6BG<LQ0H@!ev2I(@WPR77)c}np9gZQGW<Qc2@2-s_Wt<
zPQitDSp;I1Y6(JL3g2rl7`KU{ZWGxyCjg%pQ&SpfDh}Jr=S~w$&C6eQyEAvaL|=os
zZP4h#<jD#;S`lg32pUDw#JThOjc(==bEghs9wxyU?m+2UGu7@LxHTZC;B%_|B=syM
zw%sPw-+2{5t$7s2KxQiuVMaczdceN1=5D&}ajhK-y*Ei8EKDAqgx(;=VO<rP+HcTA
zri^=YIWC{mT>t8O^e{!qbNcDG!o&PlC}X0i`A0Gn>G(jk9f1ZH<~OO?mu6X6`VPf+
z|D{#VXY{aVegr$jE?Qn0SEvpp4<YDk`TWp&_**_Bt&tm0X06^i*r@WIGAZYi(G`2i
zlMyPx*YisYN2((?dx@^t6-sjZRu!}n&15;J&hw$vRpxR{-}-`glw@IZ5O=x$3?Bu>
zo(<u{k*nED2MIFRa&U@egG2B=4Qf7(O%}rhH&m`x%AJp6YH81$!<Q{?aH#7@k;1K=
zy0z4egw3VKc2;mhONa27so0$KIqO4`uL={IX#F<P+)UC6pI%B=p~L{|hgtvr?$08j
zI%qZI=6j+s+da7cw3V+ufjaC4_Uui!A;Vsw^5p4$`%@Z%CpDx+m7j;KNqTc|U}28p
z5{+hiXoUT!+Ig0WaJSOkyKgD>iN8%-Yx<<td(MQW5He)G>;1BPaqbN@WO?8Yb5QGM
zR;j4?zT)ReWI6^s>(G)*js-EaMPCA^=zSEWlgecfb@Qd@GxYW>{j(vbnb_c^Kwt1i
z69t4<R+bm=gXqmAmnMr&SGiXS86#>Niv>axNgc@W7+wXHlS1j}ZuH3h31}Jl6SBZf
z8Fuf1dZwiY@-s}N2FD{kslS(R-wy=5Pk{DHJIsS>u1p4~NvNfZpG0#}h?n!)xIjxD
zl#%*M;f9LF+jF9*3>bsD8eE>3iw&}D4(7oGnyIP@7CM*h+|zgP&eo+%@~(`yAnSL@
z(s!KiFl{|L6z1$cYSRERy-fL_R-XHAXkBk%cqvI|(4qzRzIV61N<*=<ijQKqpp~KA
zGc0CmU@n;5k8>JZzC;^{_re7YfxcU|g^{D8Z`w|jRb3*qN`)~waRMGdClRb!IXkE_
z0w{~)<U<rCTpLhJe&_!Ut5(W)+EVTt`D%i9y4}HLHEdwVDc<@FqB8x7rOyK*Kc&GR
zB4|{hkiKKNYec$KO;p0uw7{5UG267m=J#(Q7FG#^BV**lZLi8P4uI?xPm&}mVXdk2
zR;|V?hBM1e4;MNKy{qipI$U`3;x$v7*v61LH2+>TT<#4qY151l^|g>Ix{J?zzJoI+
z$x41+G>46+JyyPM1D&Nxg%gK0*B<zwYM9xXBp*;3UfM6M<@q*23vlOt$w;>{NQUbY
zd>c|$mPDsu`w_Q@35`{6QU19aJYi0~%~>w4JkP_o#?)DQnO~i=YZFIWY^}ubLQ08Q
z_|~S{eN}N-@^Dci`^>{A)yp<gI(Y~9GDFOm15KMIxoc061giGlsPCIEn^63aRrEnp
z^<35Cg`AP6dCBX;#|%Aj7tWcJH7B$zXE;<%C$d|w9Zsq*=Y{o^x>#wS4jr+?l#O&J
zj8>n@aj;F4eqZORM*Ai5gM^>&qBp_7kXW;;PIPFhTCepfzgaXF5WN+@VDPBUPEF|v
zi=99r+y|YVi(MfKWk-7RKsVhAhe~Coba6`thCqLo%Y&+al>fRiRlMS$W-Gn`UE!EG
zRR$ohnK%Dermz2ynEcNBg=km%3+>laG|-)M2ee;*(VgqGhpoyrAR@BKpWtK_vX-Lz
zdDO1cdd;sg7=K8cf&}kAVutS&>>&9g25;gH^<$crLy-h0I6+0&C9p>5LX}UT;!Hfl
zsWPIj$a{-TQ_;HzDTP#A)>X*t*_&VoygZ9Vkyt_UvT3LZMh!||(l8#(;)P<MfXB%Y
zjJZV90k%jptO&Mu7z!}JQ$<YV6G-As)G(C%fGGljH>ddqIRdCBPeVbXyzwX*pnBJJ
zzEjDEw!w%gFl-dU7O^9!4zR!VwosCOkOs)JV?c-h<y`<3{>YE-As+->wKzx61SPx|
z_YLy(5fN-5sz(Td+y<4u_I<J(Ng1Er45Ndy4Q{YSHrL8U%?C;JYl!B39M<aXv@pKR
zdE?N1`nu=WeO@qulHQM_$Rd84)J|v=WE=6*{eyJvkF#=_r#ne815oKd+^;rC%3u)*
z6igx;VMMVo5Fnvn0|CJ#;1qwjU+9l(SNr1SU3Kd}InV0cX~`CJBmx3wf;Cx3DM!x*
zuvC8-t!}3*7yoi`^wO<xt8Fzx$i!XMzCU$4b2HcHc>;JfmH+${{$E+D;tf}$j<daJ
z?|j`(pA@+C)eCj3qTJ`LVySiOXhOOm@X4Pa@82@I1sH9xm><`4WaFMB4$&C+rN3Gw
z&;J|5J{223j#^w(t4@wJHf4{O=MH&p>v0WK2>uOr|BLASPd1kE(=#6GKl*=ngZ|4W
zdJX7BK149WMG2Q1P*fW=nplGS!<$toy;A1$3$i|j)y1q&uCzS8a+Bhe5Iaxqz}Nqq
z+w*^JZv=x3X#GVpHR;6OvtTG(6%Z#1HOgN*KnM=UjVkh?^zK_~eRW-S3rQ5*XO*aD
zJ7R!Oy!^;z%i<q1Mt%J67FB;KyQ(|<0NlMcK8>U`BW~62w1$@IMMqnTyN&4SelAUT
z|MaZ%(j$SXC9%wy>2x$WQ2zq>#r%f%y<pmTyS(0-Tnpl;-sCls8s6j^1fB5x!+Srj
z`d}#0duj<<SIbhqE1!@)s_k+sGI5x_<%_DDkCMIGr-X^Bs$ZBfS6Aps$M8w_)CGvS
zIG>QsXjg+47uUTkNW$J>UDwMUx=m)=w!)34R9AJ{Pt<5do!p<8p6#?#6SHHV@4~W_
z+RHu@amV~v99QVum;=|fFKID&)E**U#y8fn`Eo{vzy&gi0rOv360Ou*4x01OcK3cf
z7GKFR`aIASp$YMCjjCmWA18FbPMLhD%9i0$6-8y}6_h<X)>RrjpA^Rt6@#a3E%isV
z!a^;wo6ZrPY^K)xO7>LhgOB%ZxIFXUI(w+Fq|NU|?8#I;=G(99udIuS&IJgMnJA(T
zfK#+Des{?lA40UbfL|GnO8y2Z&cl|hou37nNMWFK^PHkj)!3SaBt*2Dt~tYC*)qZ0
zE4RB~OnY=|^VHS%_i6dhzK`(<)g66qJIjGS{qjkRwBmG>T-5Oc_xHbfT?e@h;kk=e
z><wmsANv452e*3ZC#2c8QPc@EjmrC$a21T(V-1?8>z@e;a;I&~UAaVkJTii$lI5I|
z_%3VCrz{|`;HJXRrMkGDJ2$9q%Cx<ZeRlNGy9afGbd3qv?8XNrDrkB=tkns9-kqt5
ztLAbs)FUqcA9L>+)nps3>(Y_lq&KAqN|TPXfJzhT(o0l8KuQEDK>|UL-UOs8D7}bC
z4Lx*3K$I>$37}FF5O{%*@4VkSWv{c={<-%U`!8c;5R#W?K6B3NzVGaZLtY}+>r17{
zWp#ZbpF4M5c4B-7)BWCQT)N~bBsx{w?5waGY~me4Z$?!$=RJJI{n7AkDcS)fv$in2
zU%v(aE0L&J4#ujzrdXNXo8-mBJ>3zqRL{CEN9oBUK));bp4p>sg#nLz*@P<v<nGje
z_ep}?v~x7@=JhK`9H^!{(VSDQBJu%xweVzkzb)Q0DeO}m`$fC2_KI<)2+ljto`K7W
zkv%|uNNTdOc+JhbohBMIgv99(WD9(2ymEBtYW*-qYp<nf$Uy?-Gb1^#04tN-lv0<X
z-qh~j6uwD*27V>G_b61#<5<b*M;2^k*5;tuBsCPg2Ec%#a~Xs*kX~a4Z&?^YNMSEj
z&66zSoPS^w7tIy*f5McH*(B2gYBy=NU1qRFG;rf#b=~g>?-Kj%Gk^EYofEvlbFL#Q
zS~`)>j0(?mzKje8PFuCwtv3mi0UUjEx6k{91f~MRvQUn?GVk81?8&^|v%908h-lV)
zb^iV^ab&ui9U(P~FcVG*LehGkbYDrB)SH(0jLO*2gwL-$zZyQ$<a_HY$cKOUac|At
z+d(J^YjOj3hagl0tNw%XZt?bR&47zL{bCV#nH8&}CRz(cp-@ez)Y(b#Se^%Bo{=|1
zBzvqWBgxjtC(DZ?)qIUHas9sD19<qHExtS}9LxW(SVljLN327qD8y$hW@r`jE7gB`
zra(BZn|w;-$J!J^x!l13Gn?KtnD~uncCehv&^PM+fpJub&tl=xyoFxR`eQt8<XTHh
zQ*{3epJ(<iDkW6j9+wR3-e$~6et6c%K6XEvF(7oa=_64Q)1~1st!Y%@rIOv={ZW)V
zCta7%X(|4J*kdp2J73sztd~s5dax+T_m?(frQ!=${yhfnwST6zH|(Vnx+GfpiKDNG
zUYi?WC*iE|X0HNMD2~B{AdG=WrYuN|y$q|T5kS89*5mDyjx$M0u9N;kq3Pyu$N*nz
zj(1SCm(Zhzj%=#1BrAp7^#iwuE?U3uwM?o~Mh`+9zbnbH|Jf}C(o9=se4HosqxLQr
ziV$uFKF*+Vsv-O8|5`^h-2v3ni6hs9DYhzXe9ijveSgkPN*-}2zf}ltzCv~v#sB8C
z_$Hb8DLpMu89_C&lLhB|O@?wvNNDP)OM!yXX0D~)=?<^;0=-ybuOTg2<Rw9=kHwL<
zpmYEjghlx|T(OsrIxcQk?BN7w%txEbF}0;p_Da{i&`<W=G(@hjclrb(<$KMA-tq00
zoTo$UIqaFTt{R6|m_t0IDT6k<OcO&Wx|YkDFG`P9>!oK;B!7(XC)bpud@K#265zvX
z^B`34t9=k^J0b)hSE%GGUw*C>!k(8emam^PYNNSxdq4!-%V7-2z+?1^W-RVF0$>Qz
z%&~<sbt)@ODQa~5p1uEVCtz$~FvIAU*pYGx7X8YFngH#0+<ygosFcRA#d?u%Y$E5I
z_>mf=<R2e-sqV|e_ih|61$r7WiF`IW6~FVH%aclbvRhPGhhbFmDOCa%l6S#plT(Mx
z`b@I)zmOyU4JG+M<Ofith_9;$W<f0H^u}QGcBQUtdo%5)Bgts*!#`w?jF5ltavt)g
z5mTNOVg6-fgdwS*16wNpWCdv<T*g?B^Y5?kV4ULrpHvfm{Xc2^Y}aXf(Wm#*hGFL%
z(qK=g9}UVm{|EX8%@A%rNh4mxH<IWn&$WoR343Ki>F+&X2q$=Sv}cN2X!i%ar#83G
z%Z;%%x6h3s%b<>EwOyCkO<PN2Cf)_x!x++7At%9!ZP_cMzjA4Wu|)psti~SBz^Y%$
zh&`$zmX<bJN2m&<UZ_<7Sjoa7P&6RS5OMX7(4{u{R|N5u$j4JEUv-RB^BP<=UQ+8m
z`F(kAUi&6+h(GCrQo+C(kD8y`98uV{g302^6orZSVEquIh(U_+^Dj@F1fruZ)tUSo
zJqP3TRF8|*yyGQ!oKw9x;vEE&{A$ej)#69o2TQ#O4k87*8wrRT45u+HnTe05#VE6|
z{t0H>Z4J+2U-568A5kn+8&M)ZNd-GsY8Jp1C(I9o^g<XBg4jAfmHLaU<HcP?Q;zxH
zAjv+;U%WDwanm-&ohG~^>t=uG4V}M`G-OLiKk}uv;*>TI6NfWlF0~o1Jwp?NsgXmu
zNK?HQd+n!F9o#}DJ<ofCn`-VN62bHVU^vzRT-}Qu#b|9NWsbsfEDlYcS4p;pJfBJX
zcG;u2x^j*F0G3eH1SS(ulP2@guevFTLajgrp<Y@f+M#`li-8l>D57ErQ@(CppR9NC
zrkGgmbaS3eOKL3*+zxExXa_<7<yyG+0F)W=LS|u8P;_8c_;LQ081>KhR||rtE$1J;
zsuaIN{a8ad1=<W=P0>Hkhx1h<Ns>#>UIE???t3+Y|B$^&alfo`WAMk~7<-<ZREt=u
zg!BM29p`Bkp<oCtL^M8sOd2f|1BUU%i<lU!H!3(d<4*0OH~Y#Rd6fO**NfFVY_zA(
zUn7QwUmSs-AFh{=dq575tlJsE6tO#sZx+rjl;Qd%mr@r3j6(Su{<^QyuM1sTi&E4P
zih&R>A7ZlO{L8moAb=Ncl?E`d%e&f0;HoL+3H+lumX-M|EBAv%Yv`k;)Zn=l7eyd%
z4HCCP(FJ_KUOZhj#kUmspaNDK{o+P4h3riVlJXcN^~{a4$#uo(@vDnDx>E>)^Q#EQ
z&ohtgG12{VsCXVXx{sN=H$R`)i(0ZgmOA9dY3)v=KwRbKhcV@Cppfk`e995u{jLg=
zSepHM;EG+TXogDnel_JZJ=s}161ZW|uVKu9<X$Dp0MTA+#>K@D_R-=Se?Ic88Hyc#
zc3o%Hl@61Ie|k=$Pr<G-!w-)cVSMo0BrPkw*}A`B9mct-mUix$0iVBJT06KzB@jhU
zW&3Bg10%--6!hhgXlDQZ_6uY({br(#9s4xzGHW+x#>LJ5;6u-1GIMU-s2OlQt$%_R
zas48)6hPwtAv19n?LX75sSq!#?#%dTEI#_RN9p5Uz}|4S)-yFQPu_wcOuU?l>CTj`
z2wFqO6{--xH6}vy;7%nxQ+HDPN6FB4w|kZw>v}<H0`&{I>+()~=MrlZLr^jV0thWf
zm;zoAu)ikvZ(9C#&A;xd;TCJR_$Hm_VX7|XP1e=a{r);CPhsXxauAXxgZs^DI7{9B
z9QE~5`m+uZoi^>VRAY`2u?(YYXm#{jE|&^PpdL6`OOc^cH;o2WL$Q;bJa#{B-{mxT
z$R$n|W=^{$I5X3n@^KE;P}|kju9RVPl|DXRVQdUeMxJ4&3w;}a>^1HdTJ1+-&8Ubs
z3HwQ%EM+Frw%XUGl%R_D8CcFnEEcR?`GNv4^r?n_in@vZ7`P^Et&SBgyY-|c4m!2h
zbdsh0*E@*gu6?LLrBA9}gdXu4P;hQS>P0i{l9-9^fK&)53RvM%HHKlK42C&(=SLOC
zCbT|Kt?}~9T#sgm>^T^q{Cnf%_#<G<y@T^VxBPv=t^O;jwpM#~^>ISPtWK^DA=FA!
z$4KB+jg%TCEmg9|LMID$S#_914}M{3N_HDbW`t`+UR91_7#sK41I~Q;D>m-ToRJTC
zB42RKqE)rEfc`aD8geZk!m4R~u4!lYCxWGW>O{OO=4~(o?3pZv!$79<UUf!I_#QL-
zp}nER?&{Asu@?p1mv7#p?R&vS6#~*fv5`_l?TZfxPEd99Yd|iVkEx8PzS?io=zPyR
zzS!8_<Un!wIK<w0k=%6mcdnKqR36lAQY!!q&mSqd@cqy<#zHt!T+R)n`}6(Y=Dg@U
z@WL>n7#J1RYti3S8rwS_eJ+x6O})riPlYbd9XERB-sJdAZ+K)UP8C7*7<AbZH;B@_
z#WXPtjmKVEbm<_Jkuuyx6%4$5?rtR_V_b|ze8RCwMeUN5f6%X>sEWS*1SDH6i5aNr
z?-l{vaY^&UQ4_^M2jslaVI9|Q7mEGznwrV{RaG|U{h_o)%C)&2(6yEJHV{s@y}5la
z$7KrEY<R>X!#Bj^!?rxBe@InsJ8z?uDj_={XDPK_2S}L~c$Fe}@MeQu@|s1QaH+xk
zzy<edr1bVC9WPd2fH)xl8xEwMZJSu+@6{Fr62MP`;UZ5{20IGh3mkbrE$bd@k-On7
zc;a7Dr*D%XPHo1>%t8~XrT&XV{~UjEuQ_Q@NF1;LlaugT{a2C(a$aza-vX0y#N{?Y
ziK<UjS%{(s`SZc>608{)+<Ul)GH8Mq4zWnG`JtRbbFewNMYAmML#y$1&ymn8)=Rgj
zC@$6AC9wQk{C@Mr#Ss53ep%IvqhRs7@}G*IDR{2ms;f)e(ICk6b1WJ8yJMVP2hN<M
zHT;C#9qoRdY9(jh!X;<w2#te_l(Ct=U6jY<_-h@t%Y$GP_m6E9w<?F4;fGimo1^vg
zpRLx`R2gtG8=oS)6(mkQZLztI4E#s?hb*O2uxv!c2}m;hKGyEZ7Jgz7YQF1I+j*7p
zt!>ZA%9U9qVL(JSPU!VM&y1W$LtEflQmCeGz&E-bf%kW|cv54#*8wlW#PNGPcmFCA
zAlHX%&?7o%CsiyuEW~%3mEYhgPI;iB*<E{*pqXK$nNN1Eh?&@B!lSTreb-4U2<_<t
zJN#~K*T7-?l<%0Fw{U@SXZkJvCl+aM-U>v~S@IA+un;egVk8m*okb2YW>JVo1Qwg=
zU8bX<tPg*@Lqp1S#NlsNLoGY~6>~>#)ZAKl@Yav_K<=k420fHUVSH}7y`lw#_~UVX
z-Rh`J+sUR8Io~=FRGX(?_jLNjyU(gHvo(umYlCIZKS;b0jOKTQ;6*Y~11qEcQ?#34
zeOwV5CMm30N4?(SAFK7OzNb}?#%Rk_M?;X7L~nAgwhby?WD!Wpr$4r`+Y>#1_0x<Z
z<He@k8C_9{ld2Clj$8O6ma1$(7h@SO;*E>$Zb5`DQ1uA!I7nh9*!Bx^d&@Vq`_?4}
zu6|DXPX4f7<@jo@lxskBJ->C*>xy42(MYCFNyu6)l#i(6^H|Y~k16Ho{k%NWN{O#q
z<G1eAwNY?LW5Pe%Aq-rX$?B>|f;>U;>Le;_$zfG;sMv9vcE8fa(x1<HE77H|UM4@u
z87fLagZ>{L`{c_+eW0xRQ&!2M!a(Wu46k3$?%kpCKGaN!(h($+9*`76xN`sd(SIvA
zW^%;}_p=BC{Cy4|>kWLdg07%$x77H=dELk<Ml^jRfllD1i}=5nuvwx7Xl;M43V0ji
zlYrxuA!h?y)OW5;DWz%H!}+g_jg&%<*=YNtE{P)(yKJ!`Ly(0MY*9a&9dV05yOUXI
zTmfYCVTa5~5>o<lg)!DW^V)8Y1r4u&^;Ce5?3@w@-4(_ETJz}ZkV`HURaHmFHq-4q
zLKWPz`^1=3iLA=IpD_?Ca_MnzdjNS|o~9M}o~{AjWy?=by6J#W91PTY_aBUMeZZP9
z7@q5=@kVQV8Rw*P&d84nR;AwI1TT-oa6D{KI1Y+8>|*JG@&t}F6|sBrb#*oBYX10!
zT|B?-(ZY`n<$l`tHIW?ifYEl(pg)cBH-tGt7>w}%*N-x;&67?1m!v-=a5FTB(Hk8}
z2aK6X8%c=elM#5pAd{llv*8{`vju((DeDukuhW@z#Zi#fO!Y<eeduVq&`hCLIk?`n
zKXm1Bmo75`M2}f7+JpWfV~1N#^$Tg><I;%kHSo+qZh3=Gj(=(^y;RIsO_MGMtZ1$c
za(?#tLczutK>o+21UwXa>QVTOv|%*mAJ40kO)T+eom}aXeM5=tSE@D0>Ln=`K7wbA
z2xR>S2bh*^dpfKmT&au^W(LCosEGH$`zp)YUb+|Z5mqj?(P6Ms{I7+9z#sTWg2_`$
zdtTg)_ZeHS{9JC;!Rto%;~BvA(TYUxyCy6kx2FV4SrKf<U*L+`7qSal3_;0D)7O?C
zauH^aJt?<V;~~w^K6Gr6Ad&4{6P{H^o2VJemi^VRB&GH$b*W)Ye^d3=lMEHZWBpUV
z4g=*W(s!h=Cfm6(QK1W{!U3Q50!MG{?q;v_scm!=dgoDjri(S)eU+SZ%m1K;Ei)3y
z*{uY)x&S*!&(%f6e&Nn8zzXXuve@^W{Pk<NNiRBEac<OKVnJ=~HIk(o?U}~w1#Pwk
z!&x0Ms&Q#W;8)0|1Z7h;Ojs)Jn`BX#5gYbmDPr&tmZz-KVccIB#zJ3_1R_=-jYWej
z@!SUeXIxqTzQ)BxYm#(8?alC3e}p%DGW+36)_RYtwql7#bl~2u0?F8<k)mNqIO#VN
z0#y6>21b~Q;+uV0`zwq#-98q)N*<(7=^wRyd~4AK3A#r}-3GwD7BweWrxdZqZk<yL
zi`JcRH~#chGb1@s#;!|;SDm7J1q6~4&uNc0z6Y+dk-k8=c9iXG;1BUfyI5LY3U9IV
z`_fvohSSmWiDV}b9^yT`M5HEl7y&Z4Fw<Rx0Yj-_;^-&KEE&N37hCbMm^W9<jWZ~s
z3_0<j3MZ-%q3L`R_(8gixFbZqrD<~U3ergLx43y)7_3=xv9q^}(zG2wH+@25Wn7OL
zE;10;+7bD?Me(pEe(xHpTt~14WH5%^V9?KNHB(h%T%w>9?tq3tb~(<iM@n0wC3d1;
zEV%agrc@DRbJla|cMdwya(?4z*(FzjKroS337WV<Lon#)1bQ(tdO;HmBac){n8x2P
z|I(#sRI?5*Rg?T`(USGh`m^rvAS?JB-v?paOuZj|pi)j1WK39_yB`0jEB(==B?FUd
z`b|~Gs@iwmMJ?%#xV7`Q$<jz3kEDx)ZXSdapnHBDVS_gqgfcq8Ew6^vuKb==RW)DE
z4Lq+A7ZHa$53%b7JV!~7`H%Y{d&P(xAK<WK)$a(C3P-UQaY?WvsnMU2r|aI{Z9X{0
z<!1?G3+fa`0vU$1KUNz<c0=)~<G1R2c^Lk1V_kx9tQgx?{<UTw8D$3NfyyU(p_e~x
z+<3P5CRx2os;H{w;M<%TI8!BZPHy>LQ-0ZLfnPTZZ*m>a&?rl=?=oHV915q7DF06~
zn+P57FMo<&pGC<0L+1J}ja1OgcY&<?!UD+H67wfw&^yoT{~?<SF3}OL0~Kaumm@B}
zLC26G|C#*X&!~f=5j95uJh`@a%`UDNLHbvzVP~h1i|d8t=eH4l5b92?V(s*@6y(6l
z^%>v56j75y%@TjD{>Yv2C~MLC8S|q4=KgP|wWWcdV1hvki4K5*lV7z!n4p7cwnM|c
zdnpc!o8GFoJ85q-`o66fbKP)txxRK6npV_|ijTN9K}yG%MOVqi{dFN2*P24GuFtv>
zVvqqWRT9-zb<P(x-CR$hoZ2i;xmI|u$#DV!cFkS%ZoC;<`aP%VG5hDe?Ft&Pz1Z&R
zQP)-NjIufrfQ<mX5B$Uz^cS%Qei!kz`57@o69C>NE|$k6&?7fKQyn>}-j<qsN~5Rr
z!*Ss7+qQs3)Y#bV>X*~t&FjUiP#kuZ9(en$n{U>q+4bq7J68_d#0IM5)MwFbwp;$9
z={rya1(flb4sF?seJ-~MYR$8E19)P_Z19>t96GMk`g|jkD)di06YhhOMKB|j<_d-&
zAlT*l{wZO8#C7wh!TLVxiLK-oS_<){lwEP(w6E>=LQYcW^^&JtXZrQE_I9hzZ|}gg
z#{7-1LzeU(jsx^F9n*mqkgw<A(>AM~{sIx+)v(~-HLc0@JG9C`4Bi!^I)F}tFd+<Z
zyH;QtEYYJHnEi*$l3V>-bM=H!1x(}~K}^25U!+H-B}OM%jjT|u&i>yS&`>bCad_tx
z-+}w|K8NoMAvLFTE5zo6<=VMzYsRH7Z(sTDJ~dZdV;#sWY(_+FLaYN}9B|mc<L8)N
zo2ds}bsOWy_PByk{~4&OV8#5Qg}0ClzAo;Q@6OT1lhONyJ6N8*Pogm!S~nAS7$P|F
zwDBY%xYU~2ZW7*Fo8^x=5DejU*yeju_vo=^tDmp*?tT1-m}}IJ)+OP(ulk|4`T#mm
zB2cu;@Cjt8>V|4XgxS5*uw8d<TZJ8V7gadip^H^hB-IGH-gN&f6esm21Y$<cNJ;rR
z^poGjkPGXyasooDVmn(^{Uh(8j7WRJ9*1Da-P%sqCEInEOoA2mS{7J+`(}euAeQZ_
zXF=0v;@!n!Fs;Bt#Ah0Nx}}?`k8Hke@bpqqLc;-;<NFtHi4qln0|;D^IO<iqg}lQ?
z1#RR>InqBO@9rzS{o*zvO?M*zK6G7eo`Z#w7_N>Q+)n~e$K>{iq++6Gfqvrbf!8Z-
z*zp_ouO#n#z2wwnPLG>GnVno}3SMq)V|6f`-z;fBig7l5kh^GO_{OqfeH^=_-_4&?
zjC`jM%zp2GL<1sy<QBO0u_{T-Xqwk&jKRlqI$iC}%Wqz892_=%sS%n+xZhE^G*Xux
zR3+;R*0gs*xA0BRHGTq)!-{`wDD-7E9D0!)BG2a)>xa8+Z?t}jh;$@PfqV*r1D8e*
zH^c4s2Z4hfoa2W_6<h5QB|;yb$_cn%&80TDy;2%D!n-hk&h1EGj>gm|Rsw03Et9q6
z!|y^AbcM`(Cs`GNxs8wkK@A*J(J(Ul7~MQn=UN44JJJj13#U-@^~~RrI8)f7a9g3I
z=%whE&wNYE$vxo9Kl~qhQeT+hZ*Pns$8feb#pK`lre(PS)rN%yNAVpt6Pao7T2mvP
zy!T~nv}Zx__052oiCJSQkO!QV+EvGD)Of}I-bm;#sjF_txOBpq5QKx!&Tq59gHN16
ziGv4L!$`K+IBw$Pv9th*qMI9#!5`wxz}3(pPPU@@PkwMp*$C|UM|g<-<i1!})DT9-
z&8s+ml#kOO%ewFHh-mYjbGe8yGzB8`Tnn%oinxhCs!QzD#g2L&`5M@DEX(Z7HMAW2
z-_n>a!IO#dR5b`re0Q5xI+ZJ(V&A&fnLw3B7Nk(EN}lNPjJ96%GLwOs_wnTHmgtLw
z&0Na5e9>>JZ@%re;nW5ZdW1fn2#$!URl08FJ}N$s1QZ})pIMCE$qW4Td}^ch>-t|t
zv!@|D1$+oYAc5d|ocZo<Jv_&n)c?a>4MLFo(a7E|yf-2H>x4WkmDyRATkA)+q_@<$
zPF<hBFYU3b7p3`OH%w!EX*9JXc<qI4yX{Q`KPDPmkBhDtzGw#nbdS3c6QW`}+sST)
zGgEWHk6e;3it1BpFBiRSN9UC;1b=?hoPf1$PU~MNSQ%GtZeP6Tmc8ho$Kf@qf0=8E
zR+Q}R+^?;zf5>QWLa-PFSo+WoaiGxC_Cv<H!jQhD6R01^*{FZ;=ecl6lWhS)tU$jN
z&-G3&?nuzUy8aqe_Lnug%pz8QB3JxD1hdZ9RC$+77wsEy4K+7lCEnh?8&luE-TOBD
z1>J0$rY#0HJ;bENcJq5zVHVMR@C-o_>~8Jj&g+cz^<Rf2hjht~&*r8`f(<i&$7zO!
z2l#T1yGvm7;)B25d=5R3JS{z#+AtY@%S?@UdG3V#a(WIy&L4qjRdM0F^9Xp33pg?A
zp=tO5bDzWznCr{ER8L;l8(pby&*5OjWvw>p8~$R}bM;N<UOJn&Psn+t+@&8btUo6W
z+uudbIW8{iN&mo||4z0?vRQdY+`yw_?@A2h4;H?W<#&U6x2Celr@0^U2874J_oI>S
z6Or1K-QR=iXaJSr`_rB3knj6fOi;oKJoBBAn<igPLp+pEe_)C(5%mBJp%G`6*vt|~
z;s+A0WnrbdD5wcSAC#CX?0$9(U$()ESr&hcr_7^aP%+#xp}X1=G3fl%At<ZpIAvqn
z+~JYgJF&!c;yU%|$go)CtzROQUL;BUx7y03KYTWI9$`p#Quhjf{CYmP(+KBGlEYF*
zm=bLP4}u)VmdG(YEJOj6D0k9K**2&@U0Bvyu>aHew55(w#GZ}kl&ayAfsRxQ2yQ1~
z&^-y-<iIvYD2q7`%L3d}@)h5cF|rThmoa8r7Vn+dM_rdS_Mk0%bE^0JFUpAk0f}|0
z5Et>8TBTff-}sZ~!+sxEBELM~*pYHr!7@}@ZqDlE^Xj+-Ud?**_e$y|?dH?D_u#I~
zV_0}m3P%Oy`uhc8KpXY3$(u=N=x=Dt@$pGE2{9#Ru(2%ms>;V><CEDMIzDJ3R+t*;
zWyT0_dAUzT@OwK92nn4MCmM#29~6wl*F&Ub2j2+gm4Nlc(4CMIy?fMzpFZ1t^`f&V
zc;r(tx6EpM5)6_BFD>Ht+d+Dnm|<u>wFJ8eO?BQ--t5jdlbLl55$v9Oa+Sh2ARu%c
zUa_-%E=8JH5e1mm(m1?b1eyrUsJeN(?U4NOUN2b1w8w+C(C+W1M^e{&$dX-YC2svf
zK=J5aG$&;3J-b(g=F}884_T#@S!*b`w&FE=riN1}5B^dqm@7r0y6aahX+-~PzKBEn
z`X3TKa0e@#ND@{#yJ$&yB(o#JJM*FSAWrv&ACGp4@_{N*#bXdc3qbl-IY}}^8D~(x
zlgKq>Jrg)?BIni=XP)8~YqXmv6=~f@sRoe^VP%N}<w-?r=osM^;eIHy-Z6yPlY7ee
z(Ua0so4&n81+j;j%>mJA+xdrR-akmb#}|bWOv0({UGG+V92b$yvhUj&pD^8<oY}>m
zU+wg==)a4W%qo63*!`QSQK|UV&vRd7jhBOU^j3S>j!Lja<&#1$F10MP+s^Uk5I(>3
zTF<kK#Haa8M82%I=m2joOV0wK)K^u+?L&s+cTEJauUSC#Ko|mjx$hI8aZMA<#-AKK
z+iSNMyh3tlY~t?^T}Iw2)+txIp+g?uBcWXb3R_r!4tzgOE`exU354Cndqfe9AMxbq
z{eW$>wK$t{k^8wOV3V)H4{B2(_YGvD+m5>%adMY{;7tYyt9Q1#`{2j`nB+J}`NhoL
z)?Eg$Y213@6Y}}bL<s%z(slR;1<CZ87Y&~RboO-W#?bSJYbX73AOXpA^bc9GFkc`)
zlp7cxbQt;|R3cm4{d_^%(%0B98d+_avlr7#_VSNQ%DF9IU<w#~05cj_F$}OqJ$#r|
zb93H<4E>h~u5X(POZ9fc**_&>Shh?A+UMoUCOS5zmCnOjl}`7HQ@7UT6R!oa8*=Pl
zwhWk`P!q6T08}wq1Hyc0AEW@nEWUOwj>P?k0EZgA4oC@qetv#x{&%T@O-18I;n7Lf
zwU0{hv|&hMJG$>3$DQu)P4P!HyU(prlb9&`&Y0C_pC07&yJk^VAf_W&2)4t%1_L%N
zE(&<9*tAk3^tbjnD{gj!SK|IWx*akv=aM%&(Z@p#MV9#e$iQ>&D(NR}1iyFePIuB2
zxB}nM-e32#3{a5IKY~$%f+}c?rY=`wHPK*B(*VY&UZAnxc*<<|Q2qdG^YutzE^oqO
z&fm77WtIr5I+0?EuE?^g5ohtz4nJKC4z}4q)NCdSaR94cK{aq(f1wswnc9n9jyjo^
z-zJQgXDtgZ`Sb>qvgAH*dQG=(6A?$)k?5^iO)1ozG>s|U*r-R@9?Htf*hlrO-!vC`
z98hzyr1Ao{k+x7c3r&Eq?}_5MQiD{1u=2c46KTs%<kRL*OY13;sbExz_GIXKkU2{w
zX|h`ctQ3hzj|qDCME`~xzIP@ttc^nMOLo#VUOQ%*iT3__o=+ahm0jg%`rtzlZ2eid
z4)>;mR70N3q27dMk(g8*x}G8|y1$M<t)?|)2pqW0+REQ2XZ!t0;gJ4?ru3Su={u`G
z2jz@BUR5VErhF~^yhp>V&|H)P;n?fG4$r}$`_UjO<k4@jFseDn4JOix`(*~KUDi5K
z)2i8$EKRk`@XS?LqqY->V!6$NnCs<=pq<n7J-0wu#_17)%P=ZUEt9;fCI=`}A$BsP
zvT#iAko@$VzQls=ZTZZQ2-}~hc7y|i=s`0!o7zjdx4EGM{%B3><<j-#0*4n(VQ~o&
z(ug~F?miYaqCVkQjBnG0fgYS#ASs9Vn}1y_QESLN+H17%=8Ld7?x1r$F!QX}-_v1#
z5Jn-JiFp@nch&jc(5c^Ghm-8@v3g%yveeeUI0>>J7w<L2Yv76?|NkxLBajV-?I{{Q
z%yoV$1kI11<JuAtvMk=EHfBuTNYj$y0WBg|32FTioZq`8w)3yOTU(T?Ur}yJ&0z@&
zeqEe9Y4BF^PV|UVWN2^C5NEZG)q2dn`(juZcu5xe<oI$_Joaqp+RgPKv4YO24fANH
z#FMT?AoKA1PJ|567fhwE9<?UOoV=9w)4b*StX?lrS$^|NhM{OmvaUi|0<U1rY=j_?
ziCt+6e+IfON_b$-uU>+SqtM*GVy`YHKiGN>-x?1^?!K2lhj{BCC&uGQZ-$|k4#?q;
zkUhBr&KVQ4#jmn{BN9`!#Ll$Bq3M3`JDjW$(0s6QeXw~P8KhhBF~4IoWOC*1(XUl5
zO_)SKG`8>>fv8e^N`ySp+UgnqeD9IvqA{8O+o0aM+jTd9Ul<dsVJNMp*V;0Z^^u^f
zQAZ1yTbVdz#CwTBm5i%rWX-lXEls)mGB9hFAk3&KL7?}xcuW$X{MdXAWwRop`s`yF
zC948=u;R=7(;V!6O1GRdX}X&MkYAJIl8b3daRg(>{fc&2T{=d56`4xD@tS`nTO-Wz
z)_v%vh1)*BtM($v0YxWk6XV<8n-=-Y4A@1M92X4)J~+c43b0<<lG-fd`-kkSZnq$E
zz5qlqe*Y>*i5K~-Y&k@vJw-VTuB)UoUeEThdtHC>n8vIu^rUy66}~?}x`dh`iT?a^
ztiF_KTE~?aAY0p679c8hBZE#Vs$Ww`s+3R^N#rGP8-VKXuwe(~PaWlS?6Ah=A@QWK
z`@6oiL;9vt>o7p#fxIJWO#MFV6+_%~kg~NP8MiE1nJ?{hR}C<Vqm4#-gAF24a~k0U
z;sKiezO^eUnt$-OXOmo+f0uAnDrhrM*u6HrRo5bgnMhnc2!~LhcbKrq3)ZX?!CQe;
z;xaZ}k}c2k?9-`yv+wUw3S<r6609MRwg*=mU$^B#1}Bp4^)6oZJxY21>$SZ5)MWh7
z+Rt+iJ;a~$n@@$9rbz-O&(~nA@aTc|XVVf^LD;)(#u!P%lPla7cS+_{oTvU7^IG1&
z+wXgxF0K^~OBE$WC;;y;_J7|@<zV(&&Tijp$Yc6qi5t68IUivfS=fYN1P)mSi&%ih
z0lwu@A>rtL(6doVYeMb%mBu%B8x+;d%WoTuZV#EjRd;;4q2SQph8wGklL+rRZp*D2
z{varYgR<%g4(~`2b~+yOc8fY;dU3*w!JW~&Z#V1SBo#HEArm!~Yo2ne>u1$CxUAYE
z>rk=STjEKic9DAb?Ip`?p=<cnIFnWaO|4fsKk5L(Z8gl2{|m4R<xl%uH!hcqyaX!K
zFF_+$S+!Zc>ODzU!Edn0c(QPFdN;?aar)}(rP_WEMcCpdmrr4L^Auo!nTXQXi~z?S
z0#F=RCT%>ZE?_m0xHstoi_2rG%^H87Z=0yt<K?s`ee1Lxf3xjH>aVF)a&2&h#c4I%
z;GNxa?2R$w*m@yG!#*DtCb5ul>v6>6TWZ*@5JLhg8lfAeQt;k;mM?3g8}Y^WQ*r*?
zVdpQ&hD7f}%44t)3W6v=ZUh9`=Ll0ltt~SQkgiOvqip4rH|la*(r=52u}?--brx3K
z8Vpq(6s8Aidd}qfp$Yl0K4E5rL?VRUGwD%K*_N;DCy|c4JC0vP6GYS9<I}H5KU3T{
z88+X9m`7-mzPs=OY{gy+pDNg&hH#&iWxw@h-&A{&0OO5(7wxuV(x&-*+hwY3J72b?
z!KiqP>tvgaeskr)o9kNS^QJ7bXf4Rv2M809Jai4s3|~0xKepUP6-s>H@#yw^@a;H7
zwC47ttF}EYl?UhFkTjwcCM^<4*?o0;m8Mg}1GD`*u%=_iM4KvZtTmSAU@3--%jIWP
z!{@!Q1OhCErbSaBsOIWNwsiO7T+&n;R4N#Rkvq+B6T`EBaVQ3CW*l{L23OPxrTaAL
zrTsVh1n#ODD@~%<2Km;rMR}<3<f4aiz34{nL0CL!SQrP10g+YfpxWTsIlC4@!t5vg
zmbpgX)^k^*b@m2%i2&NG0R|TNXHo0hXOP_vP|TCaLN^QRqziF#OWvgXcq6Xe?(NHW
zJw~X=dxdYYMK?GnD!V!06S$Q|EW-r@PA>9erz%x&A9l)oO8F|%TM<V8UCk}^?rX}9
ztObMH&-}ONv}N#R+4bCUFy$IaWyiFm;0z~y6id<GfMY0;+LCZwUkOL{bc@afW-%cv
zyihqR+mS!BdF-d6=Qb%5iH?BPIfQ5m44-RN#LGko!5yKqn!bYLCq(g_v%xR3G28dB
zw?<ge*~fby?mh)hZ@$Q9@BZ-og#N^O^6$^9Nfw>4GkdC+X6-o{c6oh2#DAle5WLZn
zgq33fvVYbgZdEO8wfr9BGd7wGWK^&69N`tptNXgYAll>5jjkb$6fu)-Eg6JWnINA(
z`e-CDwjDew*r34s?Bl8@ndn=JkRpd88P(nuE-<4x1c3HK=zSi44@~0&Yz~}VO&a-S
zlIFh*t*i}bTL<X(^f1Q>I!Z`7ov&IDLSmFs?yc(0G}lPU+};*4X*!V~R%*kor{pR|
zP_$F%P-R9+9T*%3g1LzuIIw4~i(kD=QuKPgMUp05tE%PS)!*6t1@2)lrk}Mz+PH9x
z@1N1os6<LZ1|aO3L7$Ml>e_rxTkW;uO)Jvq$tEo;3wF-8UXx3mrknTo_-B>lTLSI~
z94Q6R%AYlt!AJY}_C9E57K1nPn4`M0?Xa-QvTVr751s~+NT)C+WS5*Jq0@k%dY>>e
z^zQvnxZFTmvAu~jmRw!>=~t((J-l>2kGwzNLw0)c96joVadmLH-WER73d~=(rViBY
z%$Pv=mJ?b9Kg;JGnukzc1V8ZaCcJI{<g4!30x2JKv2>yYz2$f9%YH$ql=qCgtl!w?
z({spF$vhH`t}dP7j&p%O)d)tsN)on+>GyXa_0W0NCol;v)_Sh#z90Pxc~i<iORzpV
zA48NozX#rhjDR}K>MN*Vw=g(f6b{Exzx6yh4*64Qw`AfMYw$A9+Cg<eL6y8vzOZBs
z$+`kWTU|twF6nu}g{_(i<#`?+THoCCyu&(jYsaFitQXoSKljuH@gWDLAd8fkTJ)}K
zwZl_3G1~?}9d{Sn_$Q^>XHnYL>qcmIX!7RO&bs^T0n`DR&;O#G2&%E2U=ObS|McLM
zU=L2w_<~YYQlc=co(k{Om!mQ%U2jM!`hoFd#cN#wR__CLTpyaXTQOo<m?y{x!2oXA
z;;&;gI!yS!%?;!n^yCNCI40<#P=;l9eq}h9UJ*!U&ieC$C01KKVr;d6d+>LVTk}-;
z6lpme)8VUqVBA~&bE!C*D!?$l_tE2VVF8cihnD^~e*KOkUUOk3Eei3Hmg-6Kw+3?-
ziqDOPq04@&XEq={Toe@K@9rCP8O2qA_?<peC`0^oL@V`H!0kDdo5*wluHQWpBG>_L
zXBgwpZN8@2cE6T|>AbM*6y0o%l0ZL2w2a(%GEU&}X9P0L7cYAJ4ZlBNT<&PbNOYLI
z_M_RzY?SZm3%kQz@c^}@A4S*6*Y}<;#yo6033Nz(r?qqD!);*{;&XYFzCBNrS)uHW
zK&5DU`Z(eT29~IO6LeYB!lEgEbJNjAX$$`O?zjbQw+ZWd3ecrfz4Chy#cU^M<HOO*
z`RgCDdZF|ntTXq}YLj0Z*RmOQs99^H&CfwgWF&uONIP_h^QT$h^*{L&7b&<f2uLsb
zy{jydtt?dU$iF?D-O@^9e4j;^&MC~Q1>5#lcrYz(g$XdJ^3vw*Xhsu+6Pwq@AAR@@
z7EABxYblD|u0jtC=+`z49;&H*n;kTZDQcpLBZv+x6h$^`(OTnSNlm$;9Xa=AAKH~?
z%vv@3T?zC^wL>wLWwkyuaD_4wEeUb)2&r1q_f?KS$Nn;Sz6`8in<LILi22MW<@q|D
zM7+Q&%O@e<<h$<NJoRqHheYopsLy@jig%_EL6yJ|LmKVYRKu37cbHb2*DeXBM22Yl
zvQ%kAZ=JXXde!tk|688j_KHyPN{pZg$Z9<qZw7FO4n3x^>jse_JdGVZSAKC$&AL;=
z=TeCN*f2A0z)BY{kgrVSR!>X+R5r6^5ajEPijBImSZK1^pLpy*T)!yS7KC&37c~j@
zz_>ltncl^sYJr}D?JtiW6t2g=yuiK8{xw@IdH;g1tUBl9*ugnvsG`a=yCpllsnJ-J
z$`Gg9mY0hsqZG>@$L}YA0Lrd%P!Yq^;DzSs#w&%h*7*vfCz0-AZXuhcPj;U?eKDI-
ztl#LZdVI{*y`wx(#j0_+@nM_bW%h8gaj&^Pbo2hJP7PdL!fNBM7=-;Ju8PuCc=`TB
zOJ0b9WRgjtHKRt#7iNtUZ2oPJ`G1@3*s>rG*9z}!Ra^CB{V>ns_JkF<?Z@;R^|H~l
z(rrS2cacLv?D+RFofft8zp-oS+>5f0QHPhdxX0W_el<sk19vc}C<L3=8W@rchuupZ
zb(|t;jbZ@V*Qosb2O->SNjgSqNl(d9+gs274iB?LYpa2c?JhMInd*S<tAV6+U!H9`
zH-`HP{b4^hFt+RadKHz&>&7lP#&r{9C#sel-h!jN6^0JS8n>?IylbfRJ0IhF)88Dn
z-dsz2(K|)-THAH<xHsn`r&|C5WNqz<W~)V~9tZWOpo7u&E;MhIAH>i2A6&dt0+F4_
zXA_`6+`B!dJ4;#vk<fH*R43q~zoxh=^w8b+qjlD2I;;B^A0j9bf`AbLdi<;l@Go|R
zN9;kl{~QPC`5s(+x@6BQ{>I}ZjYEKrW&C`W>d-*a>B7D`XCWpw#}B5gkz0Gkl03u1
z?mL$nStF~08AWT65YZ0s!nbJfMu@`m`}@7BIt-q|Dh#Q<MRGk@(l`9_P0RaVv8!ZC
zse0TFs`lr7N(1eZQqd4h-3Qv!=~9)6+RWiX+VqETqF#mivXgSDm~-FV9J-SaW(AwC
zLoB}htxa)t`hn1LJ1az2I{wM_zxea1%<wU^rj0Bj2zW_=uBG)&FglTDavZqhWPB!G
z`e@z?{cvfz`p?w3K*qQjrJ7Cphcy4K+b<`(lCbaM(z@kHb6nl*P=-I+DxdLjuRbdC
z%Sb@GvS$ZIU(Dy@4Fm${%0>=IK|S>T`~Pn7?4*x;r7WiAY^U}gw$}&AqSy@U*eqtE
zt8VBVjk^!xAeYQ47rj`$TiBs1`r=W`e#MH$yd))^#k}wyk#3L?#(QH?ea@7)2PDZ!
zr6NY)&cF+&oEH&ErK`rFz8>(FgR)V5@f6LbT;InfDLrepWBIV2)fheqkt1LN$CXnt
z2*de843eBsb8Lw#{Yb`=(FZxV=yTa#36RMrPj2WwKdyK%)6~WO)x_AoGq!J1$i+K>
zOLFewR{$B&MAc|kDdokGmf4-|Xp6?2Jrmy>;~e3FbhL+c-;l!d4n*IJk_Z|&1GW~m
zsHp{sktOO~%ai|y%%FY7;;OlL@-vco@Iw~iSZ{9(b6gow^rDd@LX-!5J*73JD&aPB
z&N=rZu?vfqMj4#)!#^0m>=+6NmVCF|5S-{xPU8U#`cdX~K(tf+l&s%pk;JV{NtfGj
ze$IKWiDvlf;6$?eME`ywgszjL!eMdZ5pGxiZ1TV>i8fZl(Mr9^ja9+0cX>!^gXJgx
zT23D<wTMx<C<)5lqygmxItJUneae4(7Jq&>dlVKV#^z{{d7fpLZhsrc--;viiI_n%
zc3%HTynB(?ec8#e6~FK_r-jL{K~2ux`(aV52h}Yj(X`QsfUjdLR;FK%IsZa*1EK8j
zkb&2u{+MOUIqO7PdBfwz(ya{U>LCT4N54bs-f3D9?hLt*T~rXI)>0xiHPR@Fcc&_%
zO@tgiX1|z;SLl4AqpD!Wa)alsLdzu{+QDvNIDa4LHwFtg?ki$$nr{;1fZ|!v?e)z<
z&W+BFTXc*8r>+}}RjrIHSeO+Em$ckyo*PK}xoA2y{mz2uPxWJ0GYNhrq)ly4v%5*W
zQYCyDlv_{>bCJHU+yqCnpvO(WpmBeMj2%%9yU+f|L2x$pm{nW!9k_?M(*DqmdYFf2
zaei*Wnjo?J?@mds2X-#$03pSC@3vPou(SU+AK&}`%`$bPQTUV(1L+5mGapUH5MuJP
zl`P2d)SnlU#oceu{+mlK<pJf|DzV%Ehq_3}MxKf4*3F#}UjnM2mM|UI1$lM%B2xT!
z@1wKG|1V6eZe)KkY)y5Sm!Nq39xxy<tZC)zsz&+9!MLs3-MNgyD3$OF-zaGppMSn>
z$TLtRPpN#?52kfF!*f8pul7!NOcI(5kUEBS<IyRw59gxW-0ig;UN#Cw2U=sM6m-D>
zUnt)S2(P$$2Qr+Cd803(*9u*vFWwP_itrf#+G<kHt@Wk~^<EYHj?qTmJ;ZzJ6b4^$
zb9PD&Xlau<Z7gZ5n`f?*<6NDnfJY|&i!~^jF?-pBWPf|mq{`|rlp)F~9`Ny!nwV`5
z3kJO)dVKey3Y_hk<8AvE>k>(qfHs+0LZ)$Bs>V4(4N|_dJf&aW<j_#fxh(kRL+cE*
zljnPuK`19e<Dwx#n>2-{BtZ~5_)GYr7@~4*b?*m*5YCy|9JkubnJz11^b{wIWDoR~
zYIvx1H%OmAokI~;7;NHUW|3%4B@-^kI(oR3>D=S#{h1QBMWY}Oe}Nlc#{_ab%vGwk
z$HPzc$l%aj4NN$42-JBN4NTAiHsj5L9uD}u3J(vT80+%Z{GXFb)bZx_@swipKoMxt
zATc1E2>GnqFBdcWi^P@&g2pVnf5)v%&hNgw%l9s^A-5EM^0G}Z^3iKyFHK5l)f;o#
z4b!f3L(&RK9M3e-|4#Hc5dEDb@|3H5q#3=d;a|EiF0vE$r9kcLdi&L^sJHG#Jl>Gz
zx}8%nNCEv>HVYplD;pt3)JL^Wm7!bNCGwu%7@PdoyCENy?l&Lv`JSYhhw@p09+}=H
zDSD|OYqAR+(Bb6~xO8D9@pwZ8KOw@3M@t5=MM7Ko<++nezQ+aE-{x*QC(qjmsy;lo
zT?OAD8$rUDP~N=8!s-QOR(^v&N&MtfZX!!E%<$aZS1A%-xy7#Mwi?+}f@tgcCUv;l
zhipRaHm@OR7U05IkDc8bpkuh@CJ%FM1=OBN&LRkVYXkn$kRh4dVpWWa_9>|d%(Kfw
zl7aM+FwbvjJxdCSf~eoxGSz8D5Hhi~XiZ#7kO^GuSl5dZzhQ4La&u^+QB*uCGjjMF
zi2>ny(HcQVl>5<5z71`xJxSEm!#G+`29CR|TB4Hf6|O9W+SDn%;<Ua?&$55HA^F{_
zw-KG7RYo@Sb54(N+UlhUEutU6b_lRMK=R3^hhNnCJ#cV#8EaTt9`q|qE|4jG+sAMt
zij@@%$Qwr1U+XwGA<E2Z%OFeuleJQyU@gUJ$f2d6`uAs-VUNlM=bxPU8l%ruzif**
z?F3ps@lE<p=6%LimxgqO{=^NU8*^e1q3;2-dHwV?f?3j$9IK;p(!H<QbLl<t8KLz<
zcOwTvsFymE<u@a>tqI&wXfMcO1r`z|0yN_H%wB<e?@qSL!CI%EPgN7N%Ra8$Nf&sc
z7M1&*;z6wS!l!i&d21IAP!0yRNePAG7cFRyMV9EC;Nu9TmZ>A>JI3A(HY-MdH^L@F
zEaeYOKj#*RF+#)`^Dipu(ju;rCWK@Nbs(-5eH=X%#K03M7dPwB+<eqDF4>V+w_6^o
zNb%8^m%Nl3rH*G-oQ%|@9Yi+4b{Da$Ov?x@JZuLSih=QMu`<}s`W=PY2iDNO@d?W<
zz5nl-QhfWtTKY8=R2Px<BER4me(^?Do53rS$<?{QblSbEHTgB_#k;>Io#jNt``r{e
zvMh5u3X||8@ZfSGvRq^k4R9>LwZWX7Uc%!cGe&sS-m2B<wHv!0As01TyKm|?6lu&?
z92;Uc=v?SNLdX#Ci#9O6Mc5Ru0Otiix6ZLNZJ6JgW{q=7DVA5=D|P*f)!g%v1Dbry
zDaJ6yh4-$0shio7q{JelR(LL|j^th;*@BP@8s<@8jT@13n<U<HyXqNeC$x-9o$=$y
z;~n9pG2#r4;(x9M5<5}h2vq{Q&+MmY&ngQ^<d3Ci;ngYTN<W_sH;-hqDyMOw`#z(G
z`ddpv#6zeD`0P<2<UuI`gC6+OD55LSR_)oa2p9~g(`0%*s#G-CSTdthsS&vmyF#Bk
z&;Ec}`%Mulqz@U7yu7$p1t5z@L1ed26}K$)U>Z@L5;5UUv#;=EWi-p_FuCaI`9UHX
zU~s&6@s1>dutDKf2kTy<ZaRWPBdf}mvND4}k`wpmk){dH-PiBGJl0WtUFvuHtH9@j
z@UY`|7aa)a_eN_ls)+HBZeGH>zYq^!SMwQ}#e4NxLwuVG7B=Rc4OOq#a0%Mm5hdUs
zk}KQ-=}AlL*0^}pwEt=dYnA|ITWg&XB5hK~E-j5*F57UY9WhCdx-3tgEBS;!p>C@3
z!AHZ|UV3t3wSy$(8e|@Z0f#iPd~?IzMMA$DeiML-;r#NNa-|gh@ba%A*KXyws&K}c
z%xlja!gd1C%@R9#zM&v+ze;t)a@q6OK*qQ?)>!HszLPyf!0G4pQyA)5N%BX(4!&&J
zNgB4$p+<n1J2fMqLEy)R^ubu*6>H6zE5tiMC{_^S^kb4e%EohbH2uLB>u0LcAL)46
zaPt?3pgm6dzdQAoRYs)S1QYQxA**ovoq<uo`3vr=d3((d4_x&36nH+o8SD^aEfKIC
zhT=`renN4=eUO9*1%k&g!*x+4qgOp(+|Tj#2YNxNv?CvD<a%kmnT~De8#7OG(8Tt}
zWpcdm5ClAhi3aB{5Y#|Tv1h|F+^R1>xP!SWqLwFh!MH{v9%Dltow2t?Gouw+R}Ar5
zW!NUEUcA%32G{6o@vZb$pNk99(9m$Z!RNKv5|~2%_%hdHvJr}|$wV?@7lCExB@UVd
z{Vd#{_DYon%=N4rD57%k%1_Nd9BFcR+HzyG!8R^}QnY=~dC{(BZMWALvQTlnJB84I
zVPqVSA9hY7;OU`Em3q~V<w??OzTDI~0o5FbJVe5fzsT{$9Z)`R1z4@srRBqR7HfVB
z3wG)h$^b7v+HVDXk-;UZ)ut?&Y}nuZQTkYyS8Zi^zVdNmdD|)=G1rgeCyHHUXflD_
zA67Q&S^}2o=2q<Hq>VnDcyVvj^T729G+)(b?c`VfxjOhbvzP;B1ZEg;ovVP5p~Yo`
zchjcul{u0b*<hFokvi1~fh{+`Ja0XzLrebO!GP@9iIQY>UxfcF0Sm30Ii&<2i0XgH
zGVSrGi_~DqncuW0<<arKFDS{E1VwfKO#Lr*<CwuMLb;)EImdcD(*Re5NLy336hl(&
z%6(P#>kqP8YB)Z>>v7GH|2~%p{D;Hy>i=u-TrLH|vukz#kU^g!!OT6<|H$7XAb*}<
zm~wh1Ugfj&*M!<^Z4HTvAAK1)H~IT3e4tJ3G4BYynTF1U^6tNeRX_jIj-zQv4BKd0
zup7}Uy4Qt*kpq3F%1QjxD-xflubInTmQ@M0{Jhi(k)(f5rVx=)oap;<W0kv`1ulw1
zMz7;NQfo^y=EjYaLU-41E;~34jy>;{95G`3`{l~tE6IsiZBEjJ1wxUa)Gdt$1x1OS
z-Y<MzzEKlsie)jVSOWv!`1&E$dcD!N8MIH&L=t7Ww6*7ut}uEhc&06ZC6f3YyBe1c
zj}300_R-X;N^-ouCkDzNZYE$e-BKe6R%v>?%9};a5<NAbeZfgD`jxuryBc_O|FQOs
zDVe%bo5IaM(uP6#SS<Exn|y2bn_c?QFLmF)Uayk3J59rc>@;J{Vo7Qc_8>D3c=WK#
zwb&mYrS}mA2vmc;L)+*unH`QE3gkxlzrM-aI02j-tKtok5zspLur9$Pp_2uYWNqt&
z`mW5`+&mp`S+<#i&HM$92p&Z0M>sWd9Bo`~%e6aLmRdviYl&iRBiNe1V_`JnnRfhi
z4C<W<ZfzbCp}~)xMmi!6TUnRp65+zf+TS%9K6#?Di&%;7mA_pCT8-a9Zg<VRYWI<0
z8#8oelj`&*)Z4cXi?>b8HCY66X;$>2FKH^TA>$)%0Xd~h%cIo@oiI8%+&i2%JoO#N
zAouGUzV;2L?3Mk@<cIz)dST}R2>EWn2rC?Ix%Hy`cenVQ_}tzT`(4sB%JOUG<&=~*
zU9NR9ikSMM0?oPEz<+;72~HUNEku7HJP3~)VtP)UyifIG>1X?3i0}VJ+?&Tk`Tzg^
zQ$z@neH%iu?@45oY>A<=L<~uG6T--tv1BJjC_-7wHdzK)X6#ehvQEe{L&`pbG??-J
zU470uzwbHU@8^&2ALn*E{&2f-o8h|Vx~|vqd_Erc$L0EjWG|UV4{J(76c92zu`ZER
z@SZazr$^b{jGBf|#Ljad`c3PcFNZKhsQ#*({<og<PfDv_Z%u+Xm+(F`l(8S<v(6I-
zdI1&`KtOF%?lW0PdG3o+X(h_sfvf6Y3Ex{;`c~lhMvuq#IJH4_JeMkjz6WMrv9F&&
z7!eFqDTKJ18pl-_*GfxMR%t*e*RSUdH&#Roac}p<j)Q~_t&(+LR)w4P!D4|j><`N3
zA5wX$#4_iljW^GrUcYjz%>zgy<ZxbNyG3tVC^N&?lLUCaIRQ)!O9}u*usA>Z=sff3
zS5uDmOZEDx6%}`0X3Lxx)(2gzIY?H~`x`0~C9fv$_2yrxqWcMZFKAbQg+(%q5(7vP
zIkDoJ(8;zl)r6{EMpfo#Uuk1eg<>UUU19yGenOy2X(f#XoK$!U+yN8uTMr4Ybd<SN
zWp~e^S|UI=cRoVcoqa*;e&cURu_gO58!K|{c2hTI%E^irLAF%93s0O=r;2As7p^l@
z?Ir{wgf!x{2Yh)2zm+`s-1Stq94PPaSyReW=z(aebQey63Rv(?ugQx&&L<?O_7?dZ
zmt{{26fH>}RY<E?YuFt!<NvMA7pzvhe|UI<emV!>%-7<RaKZ?^!{ELq`<#Q2p0v>I
z)yMfW78OqBdbLSRjeNYJ@7UiIfX=o5T~@A#EucAQ#oZ{)i8gaG>`XfQxee|clfSvK
z4l61vO=_k;Dg%u7Pq&Jl2Q5XJe!G2Z+0A_!mW;03ibKiJCJba&Tx5xK4sx-Vl8QE%
zYc54MV8bZDq5M<^%eUYUsiz<RWRi%cU>3@waNIODoH)&H(tLL&p}^_0Dr`egaO^IC
zB+CBr>DZiATF2doASV8`+c#S|zyjX*TJD$zj^26-{wdwPh-MxT_l+`9gK4^cQ-(ME
zdYb5UDJ6|B_km&MF)lim1diW0QvXheTcp(2eE-#L<YhtFyW%Hz=g*U=<?y^`r}py#
z>AK79*OSFwI_yuPr*b;N1Pb}8<^bV48`Xc(@^+HjzzKKt^tz*;OF+4^AF7$Vt^#Nm
zRIO=pf*qGFJ=-Y*j!KsVR_<_qZfc5led<g)&X#kp*)@vwSWN1@cAvjvpd&CvX99Cz
z4~m@<7FYATI&|KSa_TInXiq3H30^&O4dh&a3{>(f1>F!z>{w*YUBU6vkJZ!e)W8r$
zJADPR)S6l}e9x{BHf}IkYt&}mC^W%iEda`li99K0j~_Aq=0H2_DXcAz#d7oim57?A
z>Dy8$wA|p}iYZ#yErIN?uv0-hLIt`P%z&e~9ToI<JllFq=$hy7o#zNJIPH_7-4`8F
zhW0SWS?;{l$EyZD?|yIt6m}XFV7B3sW-RFD-iKobdQq_TodqDP3n60BnkN-}d8tWo
zD8m`5zZ4Mea&htM)rvP=+*u|;LD0Gp<8yuCuwD!>bM=Yyc3&f6wst4RRNe70k(X}A
zhZM+q+!S8S6q<vA#1>gTs<I(LDP0C<>#2OO(@5tEY~f4e#<%ZFd#eiW`-8Wnw@o%$
zn^YkPrXh8h;fR9;hh=|$HPq#4L`u2Q>es@LHQCN#E8{z`csx5@hk`e5AKCR*QC*r)
zDQjzQ#of<dUJXwl*seP(zY97KvQv%2ouGlc=J<*9lQD}oDa1sTbIqAnZI3cI(E2|X
zo4zHkNIW!D>U9WUR+l-H<(rgXll4#i`I=lR|9Lzt)AFFYFw<GNb_W&*!0IB;bWP(j
zBUn@0EF;Ujf@Ss|+fEkA)Fv$gd-KHctQ+)V$W0$8|Iwg?1Qn9@8wQ@HHTC@E)nvt~
z*qh^$C*>SYpFI_RiU9J=*3V3}ALX+{-z*JqapoHST@2p1+=N9=Hd$g&v%mG(@Sd|=
zYowueO8;G|X`*&Jq=#G7A`l%e-uwOPIa3af20dHzE6=QdYi~@u6mn&jIeOdm=8B$o
zkK=geQ02qNYshp_Y=Iqb>}!?kPAMMlT@G2Raja`;MPJB(Z(3~X9|9P@G;T5>wx;b2
zS$9);Jz!2)eB%zUwc9hZW|a&Tjbe!E^{wJ7V!k4~)}UdmK{ECPDxh4yR$Khy2z=JE
zp=}oPXDYJuE~KaMm^X|M$x%gzOm5axRfT-wY#X~{R(rQ7gUdb4-uiopf^T!tyACo+
z3?X=f=CR;>rb9$|VsPVWoL}~b;m2#T1Bv+}rpCq(eoL8-;=*W66nF9wminiwP|SdD
zHJ87tg)8eqmNpK{KVB&lc1G~|Gbau487sc*j>}j0fB)v&6wuEjW4b=#6jmHjdH;ae
z3KQFe_B4fa(VX+jPwF$`Laz^swH6D15)xZjZp&G~ucrZ{UUV+5Fp>mKG|*@t(^`Dk
zUp&A1u)oxdsL(lWf!HWI5qp7h1$>ct8CPGFl1%ud17<nWK&0=zrTpxJ39h!Bq!41s
zfWN8VNhlzLvGMz4qw2Jy9U|9Q%3S_~yS{`vaA4Nox|07V0|%K$J+o&-L8rBay+@i*
zwo>#h7C3!fo?Z;`q%6NtS{xUU<ad1JwItdV#iVj<wIefk8$BJoppv!#{g&rQyG%(j
zY#*0=`qRRrvFWMP%uKnz)tp6A$#%Edrs0E7&<UFkTWi)|w*1#`*cm`5;Pv1IC_AmG
zdrosg-<%9RgNfs7j4ShXOrKtVloP^{hZyiVEVjYweC%4(Rj9h83e>df2v3fr5i2-Z
zZ<HLBJG#v{#3x(lkBc}?z!L2%ywAI!6~rPx;s6Sa3XUU;jo<t`32?KZKFy!h=cnZK
zLYS+H+Ht_F^`OA_ovI3RhKVQpg>HqSi##vvOzsT{-LKVNChW0OSc+Mm!-2e7aX{G0
zM(WRV%9jmMzNwqhy`E8({GrcvD&eGb(Cz%#leelPM~n>~2ml$0O<jd7NH5Cet?n%e
z$M(sr$L`2pX(O$hU7d^B@_av>9qxxpOU9JMCIC3;S$wy%pxswE(wPhvn_gW4m^Dvw
z_d{5cFUOs-;o)<0cSU(fE)nZ&t}oUCtPM5d6D9ZNuXI2_**7Ob$?AFfv-=>l{)acU
z>PdF8<cNOK8Q!4Q&$@@*sQ~V|aO#lsvk%G+(2=RP!|X<Xaf`LMlzQmK+I+}Wdt=T_
z^HXPMVzIO9khy>Sa?9WK3v!2&x%aq^W{>ePIFF-Zl92EUAAzF&K`JM$?et8-&V_3+
zT1?7mJwGqk4u%6+-L-PD>j4-Ng*Cm+eZi9HR)Iy*uH_lK)83uS%g}Q=$tJ00!Obkv
zb#b6$ds+XQ^$CC^lMO0}7~Tt^g}9Zk3AzZ4sKBc>;Z*}0ms8cII~sTTL!<U@vZQK!
zT4HenG97ory1-L~T`)GfJ+S7?bD5-jk_YW({pRhcC#L6|jlB{c#+*$Oskna}Aye>#
zOYzsL{EoM4Ej26!?*=%bf!Q8u^bUv|phDub3I&J$T$)TNUR8vb!3I^3M1-T9^x)^6
z;~!Y{PprWV*I+Ct5kMBlA-aGoF1j|yeJB%Zey{3_bi7iyhnP6&>pR!OrU218sP-z~
z-&tQ7sl&*w0)&xyH>k{bo;G)Kgg@sUEryQ6gaG*q=#x8hU+uZ=WV0Ku&o8pH>vh0b
z+cYU#w$#SjqPugJI_cWF+D@d0)H;HGqO>B&>}!SVL!sK?$G;z+Zw9iik3Qi!hXLLg
z9egx8fv;_os_L$BwETHxFXv;tx7_WlwzPPS(bHFp8r9>6<wj6ibRJ4ML7B-Cz-xp=
zlv)0D+?B>1<;gspbDVV&|3uZV{Zjm$PZx8qDCI-#4jAZM_;wZOQ#0wNU)wA(H16K8
z3joaE9pdrso%UVz#e1{T(#7jXyvGY~8iK+A+8#SCnDjFS3u797zgnQ&NGvZ{v}vZE
zAkJ(COp|3|u1IIueCSJVy&6sYD09fk=Ny-wiqt#gLl|{A#yv3*r*5TIwaJ&wnMSb2
z6Yb@$n<TqkGXBu#p_Twz_hyr;l<@tAGN3b4pc|qK>cFamaC6RaiV()Ru5*Fclz;q8
zm#~q^HbEin(|Xzqh@zP5Lb`v^(+2{&!zU3=CKO2AqjVO;V^!%JUpJ)c8;w${tR=6p
zf=(>}5$H#SlrTHWpAF&n$orJpUA13x@}ur`L?tnuSIQfC+;z^^3}>DTdwo|I7ByQ*
zKHy4L(Ogtb!JnYR%jrfFC<UbI=%X$EZ!}z&xMnYke**luY2s|tcgc^*c3esNUcG9o
zwmFcVptFnuK;C74mFm~DhX>7*(im}7l@jk|2djy>a`$-+GmNw{vZRiQj-O{@5?9<%
zkl$e^bl}+ySP+vtdqcFWLu166Riq*`o^Mp&Aa3#8>KQR#<$mS|Qs~gDES-8o_CHu~
z2Sv%2-+6iQm-GY4s=TPL^9|sx2=0>z=^jU`6w2Y9w(;Now;adLjrrq)qR(1{zUI~&
zkc_gHsCaxoeI)t3RmTVk-O!tmicOCyxcK!5yaKIWJ7~<)&cYUHNM&vqeL?4%*oxY`
z+>Wr5ThFJspri1|+jN1eVH0^!6^NaCbLC6*kI(aGrG!P@KN*_N&9t^hf{g`7JKYoq
zk^YqW?jwCFG^WkD^1HK9_=3egR+KM#<X*;|>ZL}H*Ba{gr=%nmrDkI@E@CW-o(;cZ
zT`#4qduKaB_u?y;z9DAm$b_NTzzKlrb3+N48kwgdcK-Mc_dofA+=;NdUi{NG+e$<M
zf$W(|SCnXPfH`=J6d8G(`_^;61j@1g!1h?84A{yFRZ&!^$)BFrc7@_gvX4SP*npCh
z@lQ6}t}Lu^u-WeBIq%Fn|DgZ$nh9#Xt5rT=ck?9DzYhd1G~lE`+!lvZ0FFQ*3717>
zStWEjmN=&ERWCMgDld*zDVh9wv?fz<F`Cy5<eJ#y?>zXlux|I(O_uaLh*#kh9GIy$
zwEf>W(sryTl+JW#_6G($nsQBS{lce~ITY`g{=!`ph5ZE)GT=qP7h%!mv`BJgN~`lF
za)eWS#^*)zrs*5?lAJO@DjbrW+q*+2^@;EQ4*fd`08xV*gy=!qh~yuY3(}P<eL0-%
zKWFoA--4PxmG*5B_|{_<7GB^gCv?1wR(z;MQzeIN#*z6auxNH*vlO~K+VAvr^N4_I
z>~Zau_Pd{PK|f2rb7)jYjB&<T@LuiqW)4NxK!~nSr8ZD?659f+5eYZ)Wtu0qI2qkS
z3(wt?nXefZD?O|z$q3BsMYbO5qk2%nRPIjhgkdU&9o0E4wK4Q@d^w3D@3Zo5<M<h_
zxscbjNw<R2h9!RNryE|xj9-`EQL80EgaI1?Fh8bWYZ>3t26Ous2xXOyVj~3>*K_tf
zh`v<;w&TUAEH}%)#SZE$5Z3>YxMPSS%h+<CONEJabFydB@5`Q!9|i6IoIQQbCWk$_
zw#;gRV?G0cK@?>X+!yhuQGEuSZPW``GK2{+){EwLrz-U=-u^(@D^d2VdEmE|^951z
zZR<5}iOQw(pD_*-I3|Ri{e*#tPrWmYAlFqyxNiGO*kjgDS^d#{({Qy|UAwDJ8PMx{
zU(UDkrz^mp7>K~r*r?;*XMr}JY0-r!$$9X%qc6ncOSoaxft|2a&w-hA(y%tc2h8#t
z&2uy|4etYTv^xz_NX}<1lsTY=z2vr5zuDO@4*uUi323offrd=XAVxOE1lOWu`D5FV
zK1}Sq5K5kYn<DYvyTa>20Sm>YscfylqBn$5t+bc^>ej$1*Yo{<SUQ3yD%X<Fmwj_k
z{LcWu-F74gMYJ0%90FnY(J|nrR@Wqz17_SC`bm#|Z90YJ@C@xqGDeFfrnX>GuO}W3
ze8@<>+wi^!dqfD$A%|ylU9E9XSgsUu)SS<QCHNX2T`<@$#k|IoSQ*8DkiE<Sa24dL
z9x3D;od((zN68-PM{GqvF}3pB(HNj~Hv~)|pCS9wKyjjO1^x8~WE*{C2n5va5C5mv
zzXKLL;61=ZRP@Rn=tg+qX%&!$RrFVVAbt*dWCr=)-mQ|23;M6GhS9D7kcX`U`D_U7
z9Pr>K7av-cGnj_|0RcPhrPxE290qguKOi~a2kzqY7+}rv_Z0B|aR%xC`UC%f{#$>c
zP+#uQ=licYASmo-PrJ^BT{iKSkvJnG?v;&L#r}s3e#R900(WyCZjpk1+9tKgQ1g}G
znsA-)M|{5rFVJ|*Che#1hi+Nr(z9P6Bu=jA8&$}zRpoGmTzvk*?M`=o4_8M)Ogm<w
zunUrAAU{#vW<=S&>lG-~G2vp`_(TQeT4msUrH}oc>th}M{W9Y|hY9;{*SUZX{&UVS
z{b=WRfYgE?Q}ORa%bS2uxe3-^-oJSX6N}z{1%5ieckT{w<<eO2uu5vmUT`h3VV<U#
z)0YB1v+7&5`hj+C;I4C(V!%1H+*Ms3d4*;nv5>xpn#qiO43Tt>oM*QU;d{?7td&nc
zWRQV~1)KlKTD9*ixC~spL^>y6f^YL)sAT9l<Ec8aSPN(IN3D7n%UdQ?HWxE&51D<{
zJ<|j<m-S=xJq%AdFm1XBGK!FjXo@n<0FY*AgX5=V>+YI|`;!%eeZze|-1y3^!SgXG
zD{4FIis$#Y0Cx{`a6B8Ynf{mTM_%#lOQ#f*g(%$cGiW#N^{%|eeVk{0`uTrA5qhou
z!~B185`f1@A0ULjG*I!n#Hb#QEw9hC7Aat4ulb&IS9%KbhN}9qF@db#pE|~D&5AZg
zc>-AePHO|9_V%Ai`e4d10jET<%U601)QPP|bi5IX&xSHSD<F%R3pM+tn=#e9+|!;5
zg^9S6;Aw^7o)6s%W*gJtn6gvx$J2f^+%%3MyPZ32a_qsq<MH1=g8t+VPhc&Sxv#fR
zVg=Qwy(ymqH9-zlf%0LJr!u3snR4m#5X!CLgp|@k5lB~hqI<{XwttH}nZ0D%g9jmI
zNMUqkRnB>1GMLR}WyhuDtIF@@#x$W%tzh`zcAbX7Nmtt_$z%}hNuhu~C$*b&ltYD(
z+IM^m#3%Ks{(9ZAt-4LGHkJm0Dw=zqe^?4meR>jOiirkp@&MGZ3z!C@r1ZLoQ5wrh
zz*^|`L_mYTq>-D4uWz}tDPnSCuP1)-zPu9de)7E?jki-Vuagfqqb}kT3m_DH*D$j$
z_%z)&X!5Z{EYscDf!emJ=klOu&*MYaz8?2A>clC3ZHxTthBpv=J?k|mRo67`S9afP
zAe$IiRjY1#EGJ0qqU*_DCcaAzj9MHk{R$06jp)myMckTf<EP-3BlYYeQuOXrhnPkc
zYWqF^si<+R7LPo;@64rp@wZ;#(|InW;GxD8>T7n3<!pJ3G9BVk<+QTbNGTn^aHd<d
zo87QZN#WDe$`9tXfl=T1j_oS*@6P}uSEm_Dc+TuOU7jMCdL);qtX%V3SYM}vQOBvX
zp{~@$@ygCJ=8@h0goVNf1(@XGit5zZUJlLq(3++I6Gdt?H}gzc`NRD%MW<b+?t(=7
zbJd30-ZN|H$uF^das^#J%Es~1fL;Fy5X}j=Zw?Z=z)T4Do_T(K=i(*U6b)*1^wmkn
zZkjr9NaRXL_*TV_vy+Nuk~RgNuMFgg32gx7=(1%&<;o<_pZ48z5zjQle|So~J+_JY
zbb2uC)Yv)Y&(f;G&l7}iJUhwyOP0?*_UJ3D!Lu7ZRoVF!(M^_V(n!1dL#awhi-sDD
zL_b={il0;d!r>ZpC(9JnXvWMmyW+cmJ_&pfhHY%`5L;Jh0IR1%LXBqo4pBq$f0RUr
zmPTd(sxLKO?H77(Q?Klq{ZB+GX}Y{Wym|!WHsL)LH^AL4vgtNd!4%|G%`zJLD)un+
zeb6h#_Iux>tv^T#xH`mt6RLD&TD`7Fg2%&}hP$C6z|#+`iMF~5<Y>0!SwHUeHK>4h
zIn?RrgX!ANb9?=@BqN1*c$WFSV-$c=sk-4#hCZ1NNTY0ZKDJNM%D1xgG;Pjv8QaJe
zzZ7wE)Lb@IFiD~Q`zL8ocLR&_R6tP_#9_tvCp4<C!6Th8IXT(i0hIJj_k<dikhe-X
z)$TIN2Ra(h-a&SQa}I~{!c^~4cb!4urd_bKLN3%r@0Mi@WyU7*I<dQ@x-aGN7IWjF
zYPGG%?c*L-JJ<x5LGOoIs~@+cP9Fi#A1plD;5fnvAT+5oMEdrjG>Aviv=}m>`$()#
z=O8tk+U-@XXTts@QB68fS4RBJh94>!d5qC`Buqz8he|1LcP+y@0Q=^f!y7H&Bqdz$
zBkCyuuc)x0uV1b=5){HtD6oOR_eY7JU=o1HYd!(!=6jYQ)sA|I$dJWq7jEp8w+J7?
z1~KKB44aJeCqD7&D2@v(*W)^M!OZ9Y)dZN3fi%7|-?!W4EG=YlB!FnWB604+As^93
zQf2VishP&2>~3b+D~ipEr;qKG@^8x#ATx3ukQ2z@a^(3s%3eFrc#!Z3o%gdm(`^Uy
zZ%LkcCR?Zy&9`w`M@{J7TeEZUD0HK0Hzr*|X#yo`TI`ErqfRCTsBG?nd8R}~M~*3!
zU2`4~zVc|*$Sr#2sUhp+iw67uaWY%+|A79xXCn!AA!gE27CpOx4YDl-)9D{<gV1+c
zGz%yn-MGfvVk!O_uGI6T!rk&+s$r;bAFGUgG@Xah46yH9X#f$KB?QBXNFfcU8@Jx=
zEdjK!>$mRqMAd6CYX(dwJDuXoVy;;zN#~;-0$Mn2#w*A=KN-r9Y<a^yw(3Y5CU0#_
zP>dGR(}5V-d4liz?n*?MS<}QnpkTPz`^PHFW>VOO<8CrJO55Boir!cc+&!WF3&sqr
zRPuGmTivs8veieDC7gtN_102j04Lulf{dRQ;w9C@FH3(qNyj~8Z@MV_hP&t;X7Ckc
zp$yFx0&enkIR<2X{sR(4=vjpG{_JryiT4;YOxbGD`;y@E`yT0}*mIZ%Qj+$QLRc*C
zu0$sT?|Qk_z-E+mKl6{OuhMl9hZ-J=JEHSM^dhsGteFhc<cjak1E8yojtcSCRyHLi
zbj?f9uTuKb6?;Q!eznNwSuuzzBdum7QM&s*o?@@LeAiW@!4d{ysF8VYWt1#k4Hwa_
zKsJrJmJ3lJPcN&TdIpuSn&MN_=Pfz?r5E@QQ;J^<WaxghU`mcX1r@hgZM+UghE;SI
zd!PJZp;H*4r*Kvv&B25%MD%q<>hCp}4jszCp#*87WLZFB0%b;c_Tc&Guo7<C%R7j_
zW21mdHFh*?t~o?s&3eY^$Gz%j2K<a-v=2NU-=NdGHC1Uw8N|JRgUIZLozZf8|I6`r
zp7%j%(ctBeX>+^->`gZ+#l!;o>?Of1eAu0>uK8(;jzaz;IpkHEQSsF3C0LSysIw{j
zozc5qzN;iz73pTIdcPFH;k@g>Y0}p$(MqSi7~1{<bgGh+2AFl>iT9SBRr(wxPv1Ff
z9ulbC6U{GWE|Vl2B|CK2%{JZdG`C+-oj#;e9DQXhWXv<L9PKq@6ujqzz1<u;WO#J@
zOX{l3jSbhTj?)j#ma)J7L!SBXB0Erc;u0%epz_Glvul1&_uD_9l~$WK+{A;wnga;?
zby!yv<e%~Xhe)m0Kt(C3;1tb*<c;)L95nQvzI(Hqg^?!RM&y!C<JCHmpLCf|;@IV5
z6{AR7$_+4&p8?;j3$_W^(Ot$`INfo3uD^EwUX9I{b(IqF&-opvo+s~{5_rJV9D9vl
zapK(b2)%_-V~o#YRhY<+PrY%iq38GpdLHwZxb=pB8{toWBaqT>kzo|)k9oZ?Hr4pr
z<K^?sV|g6!95W#CW>J2R-)!U_<Vi4w>)!k3QNogUVd98erquETIl)UVAH6w$G{n-1
z@|kK(-D6|8B`M)G86}<x^gE0q93P!`yde!tmMGWG-)zbJ?8zsPBM4QP$>KdNX(}D?
zd(E+s9e0VYK$|$RKF^7zg?MZA-ENKb?F|fYy0|0tOtI$SL$kGBWZ<DKt!AeahAr<H
z=5atgKJ3+W@}84of{wZ0Q7Qf22+WA5xxO#$jJ`h_n4Uqx81Hd1$k6ob@DpX3C4lsQ
zt@}^1+eGf8K*;o#<oQ;O;(I~nOa(ERoU8En2hJ9-q&-+eLOM#-dm8Aby`>8F7Vx*~
z=(u<1n#7W(;E&!dG~H`lUJYc9`BBz)SD?%D=}U>9ROv+m0nU3g3}bF{B6<G+dUSMP
z{VgtWpj#bUG_YggEo~0Jw0XL|JeM!^1wkf6S11@<j@>CtMtj59X_{n%EXque0hs9T
zIr&?tp;g(qs<s>&q9JH&-oLXQ1MUBIU>~<4lHOYw1!)M2!igj52}B%(($upSK@0PF
zel<tnQr44mXbpild!FlR1+Xj4JgMTdkPV=RB@O8SAD*{^9GHe(@Af;qmyL5})cl4g
z6`Y}IMpC&+cEz#<l?yW|kuGFr+xzWf8+WzGd0ALb-s`UwlDZAFPv*&{ed(u>rT|9F
zf<)|0yXSuiEF4EQsSW`d$vkG}3D_<SYKC2&>6dZKHnw@j_V$`eBsaBxk?T1H(jh2u
zVZ5qzqDCYlLQ&jcHfA_7B1AG-NLo%(Q+?GGB=S2#SLIwoyi;>r+h+2pi73KUdfED$
zaOdJh;av=H^gi-=HyI`92N*V&4<gQe*h(L(8VyWv`HYD&aqaM@^a?B(HZvIJ9_S6%
zbL`g&NYVhgTyTq8<ubXwt)XsS4I=HLlThGEpwW>)iY(EwsHFK!kFNe$iq4)YZfEX0
z`;xM*7Itj3oeL+(DEtjg5|P_b1Qz(<RDC#l@v>%ju2o8ix5``owji0D7}IC}fQku1
zyJ83SvwT`7&le>dX=+#BoWDA<g>A)##X@78k_5Epew@9z&To1vx?|I~kQT9+CP%i9
z*)0_RW&Pdho3GkFg%HLQ6LR-?LfXe$1S6M_LqnQpZ_9A>78ZY!Hgl8WPe@qbQZ*mT
zn8l6Wi_7PQ8R!~V+tVI~uib{+{|6+1NFhM#%cJ$3$o)ToWDF>j_xpD<K7Gvc#n0^g
zkB@z25B+LykO0&{PF>%}FNP7S;Uri}oA3gR1EB#I_C;wQhE2Um-cyt;bh{SzeMjEK
zmbUZ=Q{oFacnY^e3+so8J?H}qeywwng`P?~Q=LG@-h*7TiGs78ZB5cjtqH8&i_+D1
zfOF@4`|)GU(6m#3IZyX-%~pxz3JvpvW3WuzNva@Wi{Bg1@%t4{e$_fX$+4`u1S-_j
zcy@HUciELfkNq<s=_;1`&Xtv2alVa%y9bhlX9^jFI8c{MJ>JtGcEpB{n2ii>J?r?+
zIhiv_JPDFP_N?E3W2*WdR=%yiK7w7}7%Zzx51{%U9b2>>x?J?fb+2WnF7i-weTx&3
zbA|de)`N^b<wAJ3;+T5RDIzgx>a0Yn=2OK`9GH=YWF=dm<0P1=sW_eSO|8$5Hu{TN
zoEXV!hc6U9qz`sUn7}ZOYsfQH#k&;yUcjFRqUBXxo``?WN|%|o9UuulNI#pY6>hE3
zxLFz$^iTt;O-TLB=Q~+?75TlOiS{u<5nK8Xi0QG=;n<T^lkfAPM1#6g%#c5f4C~W_
zd;>z?g_kGGu~dQfcioYtl}hgG7j!N?QR@sSesJMs(q~um?^ci9ODAh^>PYTMoCIRH
z$H1V4>XDFwbyAjd9NS!o*F%(yvwZu}ustr+6JXefa{F9OJO#DgkRBX7Us_Wmuj8*g
z`Gs)<SV<QbFNM~Hja{3uc>kxAf4`p!TXbo~0CH(SQAjh#4znTPUFuGKTci#3t(q-W
z73ni)WIl@(+zzY+2{Hu^yUfiWDk4p(n6zCOuUCP#PSYqN*m_$DYq7>U_G4Vh<K~DN
z_0l_Dl}Y>Q%WO+ai^-&x-G}{WE;L$AZzyB21*<EURo8rrb8qFt?&pMzl^uCb+-|Ue
z=|6V63#H4o$kCO~P>6o`X<!3W5Sp&|Nh920_VwoXOYWti6FX{v#_uEikPm>BSa7<z
z6sIe<)K7kSXkEP#egsJTD{6Opl@WmKSr1`Knrj8rkw@6_)jv8CH~Vq@(ClSp%xlhH
z>IDE&f!l;eB+Vypg)gAlRhr(c=Iqt)3lc@{e<*D|K{gz9vyhjJdc0dgy*>5=*Pc?|
zP5XSycJ{*itwB%Uuw8@rBAg~bTLq`igOuzJ$*BiAsSVns08)Xn>g|V@fHA@B+ARa!
z87}Uk+=GaY0*x`06vEVkT9D57_0DQ7Tam?+?H}ysV2v2l0NtfvW2M`ka-4+^?A)Fa
zyGNg%UA;Y1_riHBvPFxYdt;Ky)mln(x-yQmtRCEp)H83)-dw&RFm>vr^9(!NMQbZo
z?S6zPIVTz?gD|HDFU*>Ua7t(@w7tD^{iVrW4YgAz#TLaCxq&q<{TU_^y{GC^cwixm
zJa(vix2dzAljCah11Klbg)%cctqIN$4;mG?Q_Q@(L!LIRjAN>fMBT}_)#F<3xRrld
z&?KXEzcg&yKu_@H^(;i!+?wOQ-W2K*a=0Y~JPjcU<WP3ZXysv55W4hZz^V73zS$x?
zzclZs=rx}>!a?I|J1#4agqcnNq%|oa9wS;7ho4pE<d=_IUfPtMf}gRF`c74#B$^3-
z*5@+A48JTHCourifMwAPA?%%8ioeL5Fs%Qn`88q$&pfM7c844*6BZSZkanaoDt%Yn
zsDhm$=hENy^A$OzT(;RP<81n2bH*?#ULTwn?UL>BjP#I_H-VL}29o7ll||ax)`Q)G
zMJDcNPaD&fH(Te8CffKHAzZ*x9RL|Z*k&W^%_mNOhO10kei3@F=fENsqs#x(aSI46
z&g*_iD_gXm6gf{94)*u1P>XqRdN}MkFK0zqX2Z{bz<J=IT9{8Q<S`ILKst^<6yvQd
z--SUVJ2X$ny?Faf3+$xShbymmk~v3l<Txj>pUE(Zt4)9xC7}-@ZdhbQh9s)Wa280+
zaU^CKMCxpTudkJNK1_?S&0Ko%!rc=?@P9O)V+)sC3huw0S-z<nu85oG+$G`?<_jbk
z6(~+bvGW*Rw|G^s4(1a~fFH-@g^RqB(Yq~(h<W#U)$DjRt$#0{rn>;)gCTT!a;vC5
zEnaCg?#W-419`u^9k1^dJ%7R~IJcOj%7YpWL!BMlXmegrX1y^|k}0TjVY+@;%VvT8
zS-8oXaB=Y==5;krmOBBA&FTFJl!5t(`nRX!%2HD#l3f4vNsGxW`{P$9n%vA677pz5
z6Fxuutze}di>zI)doLI^kkeD_Q9Mm>_6u<^QEsT&2oq@0!EWvu%u)ydr+ZGFg2Wk6
z=GuM3-x$_u5q%Eb6TXO+@CI~VeX|tb$;8@>(WSsQOewbr1u|GlV{{E<27A2g)A#9N
zUrv%$(cGQqH*c+%{Cu;FhXAn>5HL+{&zCm1=pSa1+4T&0h3LQO|0q;JwxJ=s|BR&7
z>CesbE+;uYfylTlM#CdZ&8|XbeW`HLugNdylWV!Adrm#a8?LIk+g`oI*?e*HwnSHp
zJ(nB5!{|+Tft9*<rJ{+dGx$PXWA;?NV6OdAaNXVa7pi`@M);N`AIt}@f|DRZC<&x&
zV?!Z9<XwG^b+CAKTVUHCol}<*-zMFe5&tAq<7CPx!SSpWa1rUjz7>`NuSmf{<Jsg<
zGDiwri=@+eR;f_OPgR?Y<7rCi0cz3EbXDy4yXGWimah35<{*Qs&N4xtR*0;@&BMjd
zT@nsmXPk@yVEYmI{Bzmdq0^guEUryF8=u8q-v?GQE`C96T0UR92F-_%X|0ti5qgfp
z#dC+dmkKm0<F40Yiw8^b*$nu6zdNzboC@hg@lrsv!kT$eG?$RS=b>r#I<mFz+LLu_
z*s?dDyO`%|`(Xb-{@FHr>kGe@jUQdssM6s60eev>Ous_iT-!5Ev81X#d6WWX18nub
zEcR&HI=O3K?rhxP+zVz;8|q{NH2vr0GM}Pvw(0!?lH}ApY6p}CUrz)-_^9=8T>4h-
z#up2d+&Y`a*^sb(FaKD=C9IhL{fr3hN<1o8l+VT(NnQCX=>!4Mz5fxX^#AA=|0PWd
zP<{V*)1*|5`RvCE4P}-2tpERR0FtnPnSzoq@gaGIyuP*Izfc!mE6(X?I8T_;@y;)=
zJu9<+3t`G^c(oiBt>3)?fjU5sK#y<zs?isK8F5QEp0<HaGKSVeJz!^49`6L9A}<T{
zFQE*PqClF^CpysAsMP?vJJ-Cl4*+5Mzm2VO>jFMw(EmCr)+N*R>IG+Rpk)>F>}bru
z0N-ei<>ti3Rp&J`cZHnaQ7n6`?iAUYpm!(1L>q|KnR@4|iQpjV0Hnn!?MiMQ#LySL
z>Px!W^Bc=DZv1Znl=#Ju$MT{K-T(N`;2#t|0XW}u!9&NRQ5Oi+Bt_*fyj|G&SDm+D
zz{rbMC$Dne7wo<9qaETMAs8bD7VXJty7!8vg_I{n8f&EsdI|0wOvZ*w*O~G&Y8Kv3
z9doUDy7r7~QsJ9kprM2rK&^*v+)>GxK2=!9x#pdAtnmV&rv;Ybs`#Pz$9_bp|9<GA
z&|)bnn1%rqXlTzZ+BrBt9ist3%sB;I>9*8I(l@Xfn~G&kqpCleLZ6s3HBaH>OonuX
zg`UT2|FJFHusIA}!HG9fva1i(Tzm}l9opi@&rT?h8D~GdkP_4X(UxsL74>it(q=O@
zssfyEYN0UN{W5w1vmr(P6;ddH$oFV-YF@n7I2Q1vGT1XfgwIIE`cssiYliTMxpjP$
zK^HA}VT+q4N}5kVa+3NH<dI$fOVdMhT41T<^D#_Yt?%VB%;hqCx0#OE6)E+d_!9=)
zKq8_JC9KN;8b`NXoQbHM6`5W&8?*kXzV3v+6ox(z?GRhP`L?$A@y}R@7xzp(kSRC=
zjx&%0x>d+Ki{k7PkJc;$hHpi!gw0*ux1O~Mm(OA!;&>mNd00gX0EBV6v_mR-Pp6)u
z(>pJ!{in}K+!<+8Hb1P3c(nHG$f2rdME;z1;s>R-F<)kKg5G^%1@625)`fUjSgX?w
zPAOys@Me(YIW{2mJ|&&4M>V8%R-|uvRkWU~Fywy8H4I1dbcSN)YmZlXViPk!{KS8<
zz103Y+Y6}=jVLZ31=I=pXQ(??jJ%LYrp2bjGrjoJA$gWocTThgn)27SrnOa`FVIdk
zla>>mY2`m<bNegnPr)v944gWDbaJbh=4ADxzh=c|O=Kvu0Y!m%A7Ixj06=?_66(J6
zQH%YEBXOgw{D`f&u;I2~6r$34glL-X&G<=|;j&C=!Q8EiuDSXTXjnb>4=_s+yVFIH
zvW(|+&IRtomfN{<iCTRVoP)2cQmIM56<-y9PJ4y&nssp9)!zT}7S%H^;*a-fHsGKA
zwT`bZOJCHbhx=dnHNgFF@6*@mlYh2m#G(vuzYz^<v<e69ZJ-wrj6(Fn3!EG+GK@8|
zswuu~T-z^IcN~7_!7GP9>i4g5|FO2WSlrsb7KdSEUIs=8Gyk>K;TeujppTGns7^Pb
zKx5Xyw~5+m=Ny!k-4!rORrc&0S$AKDoo#dKgRvV(twJc4Gw9e*N2NO2pgwDvx2ff+
z0<ZR%(UVIFp&NNwFH$!N;$BQ6K(Zc$`Iieb<2j0d<$%A=siyqRln?O)%c&;E7ZxFk
zA6Ew)Z`|Jn9qTxbGhr0Ug1LaiRPLFx#O`OzP4UDVlh;l*bB69^%&K#YDa&j^-)kRm
z{0%6%OYvO)O(Aqi$N^Ya_iL1)bdT_WA9vn1H`OQWy33m1v>lI)F%=WpF9t02U@!u`
zH^q1hKqT_6X3Te?)UhLH$KWzv(~86O(<Q+Q@9uSbGmC#Y&jb|GV{RZkE$SIBs_Buv
z!-@L-m8)R~)r<K%!&>&L0WqffuazRAhBVe^9exg@7vADHC`+&gKwh6mWf782x%-id
z%PSj}6bj!c#@A=7%@v*VB$U7O$?3v#9!<=Du&O1a<6T&29;$t+Pjcgn4T|3mmizE@
zqRSX>QfCG-5*~C_Y<8Vcx)HrS5Zi_J@<w|B;2eCz&-G!dCJ=$OL1%S`r0up^GIc$l
zRc0(*pv*ZAM?{9{Bhn+t>e$<-E0`3r`lC=s#LoF9zz3g<=i2~qWEQlufN#c^QtagH
z(|-dWDBeyR@EZ|)aGSeDrf=D%DOB8wGx7&a95t?aG>H<Svc{k!QA4M@$@ynY3*5*M
zcC*Rs(N()mmd}zc`8vgK=DR)__$RnWeK9l$!7}RU!emte8Vo=zVJQY%q`le@wD4%a
z?^d%AXYNB|)U|Am_tM98`rVxQy8`x0m@;>W2?kPhhf(xGQK1AqaAE674wxUCFQCYI
zcGi7-qhWcpD%I>5w4svaOk(|uPVfcPKE{%^TiAf!m?}efE{wxYgh1j^qOpz*<G&*#
zdIZ%HfO{n<t07KpOPY;q^472s);wf)ICcIc4njZ8cn630LZ(`~YY|&k)VNd;bTVBd
zAbWE8L6fb+W_1BHQ|fH$L*ZEXzK~h3p}ycA9zA`yS4@j2rFmL0a<#!6h=lHg>c+}4
zU#6Z*{ymMEM$cxB?_2J~PIY{*_$F%{0ipAs^KDI!1~!_iq{GVtg{P4QqrJ~U&HOPO
zDpw>ImLB>rh`r#M*1aUEN;C<69I4wv;~-U9&;mlzPx}fA{0Xabx)wCKx0f!!hLm`>
z`km$e-OXJz?fh^jIteC%JH9fBW>d1a1=d&eD{kbIN-0I!pBl`I?;A<kDlyOOWsAl<
z)95*V>`yQMj_LX#HIF>poB1By)la+f9;xai<my#$w5|9&L@VyedyyjPxOC8_t4_c#
zb(qCh)}?ehZ)K+=e><L_npo+VaA#aU<h?gkSNNIZ)RTN`i7zgsB&PRFx*Y`LL+fu&
zUU-U)>J(7DLi!36SD4nU5P75HBM{Y}Zo7ZyZup#jBlkBqO^)!__sXWvL)EdQr4;oS
z-CaZJPii}z|Kas*&?At)u2*e)>O+-H6f5h~7pPG%+mRHoWoc#P9ZAwWjkAGSc#gAq
za^AkpBvrQPdpCQ}T}>9fFV8N-jz;Ou|BrY^7Sz9uXFSo^@IT`jqx#Msez8H>stEak
z<&Y1k7y_R6=o`N7XA(-CF5gIVL$qwn=9fHMvzzWAKD*&R=}>xMwUznG(cKL0m*2Kr
zT8=~+MUeZ@=}a=PS2=-HZlPfo(o-^~=fiVt2Lk86IXmsA-t+pd$v>|Z8{JUTcZ$8v
zo`;M{KsQ1O^V5LehOm_=aZKV2K={UD9kkAGl3PBGu4ffx_|8n#MYVT>_<6z<`i@zL
zKjikH%~Qtqp3#&K?R~)5rViLiC*+MWeaj-F65q$7&dQ~`ihk}r*+WZ9YVrDh_PXCs
zc}gXepoR;vtexO=uuwol`f0jeGthKyHT|I8-iR;j6{zrgk&W2EuqV05&N;l@{>=R0
z>c_J=J>23)Qvks72=Jrz*v)Y_18{`|#~79|zuoe>#_`=d<4Ed$1g}%vgV~HQdMVd$
zg)iS#yP?d;VA|oKJ1q=&E>b8*usEC$MIa@l%zHBI50B;h)mzS0?;LNZNZj>mI%OD;
z$}-#g@(qw2hzdmB05&}0G|j!N3A!vrbm2Fl7m}9b#wRi{`SOE9HTD%xol*Gv>(#0E
zRNG1gf7~R+j~wX1o(}_6gnuz643v;I|0iSO`u}1~q*{u`-vjVD4=-eW>x{O$4%${t
zoztfMA;V_`_wG{V0GqDB{3#Wpb8CG=hPcm+L+-ZlU`sz={H(oeBBcLy?D7S@pTB_g
zKm2wkY%24p(?tfr6mnEhq5Sm!im7P(FPMtK7biA_K<`pM+NrU}_A{KR>3>bpJgB+C
zV<?4RElN!;e3Y8}n(p`Wl_t`S8LLC&i?&%Wb?1iO_}?Ptf+&`^I$FS~fFkUJ0C9S@
z&KcdMy6_Sk5%P@1CRmh_tJ5i@R1ofQ`6UaG&jswfPdHFnYTq37;*`?O!V-OQ9{XqY
zmoqzk4oY1p=={QL@HX+6Z^ZS#j$3Y;yhJ@U+h4$z;yfHhv`D`>3w}W?S`}2=n8k-q
z$Zak@#qL5k6e$)rfG*8R1ZLr=90D}PnyRCknmf;OG>boId=dTGHjD2AI6O%2D=Pua
zX`p*F4iMfW07(lCx@U$@F&zO2&Q3OhNxQwb_-x`hk1&;yWT;FA^jve{6u7HEn|8VK
zXjI}d<ITVDbq%yT<htC2F?h{J2#4My#bCzU(-uLUJ&CLA`$j==hFqX(C<qzG_=x&1
z{{NhR=l|yf{QnYw|G(y-8%SQgMQz=4r`3|6(~2$)wN%rdxC~3Mag@nq?s3zEn5i16
z6R-6uk_^JHzWXHmsuQ#XWGRfJ&*&R1%>1p*?%i!|rosKTYx2U;72jx~lh?eROAyNW
zupq6{A)A@kKUpQif6~w3ovAtrd3)8(<GUB>koVpa=i2c=$?E>c<S*3hm8Hg~4jrbq
zy(ajgWB3A{S-aAKOWQc#4SjMXN;~0xcwzP~qQ3jmBN5pe%(+syMEuQBb!MHQmY9?5
zZ}SDL@5b1^_`n1Nf5e2-K>#P;(~dR^r?wC`1YOP(?|pPOUD^)0*%cfZDDwV0&)ki)
z)somhrjnq)yE7{q+!D*kT&E+U)5t4}X->DtwS7Nx9VY#Jx@r-!BSt51NG!1RIp<Z1
z?4;Aq+sDxLxHpUs&(W{MoFo%fkiO;K^`DA)q5k}g*R?Fac{B|!>lAi@;|jox_h?st
zi=M($`qGrXpNp(rP7ISsQ^V%bt(%vPtOS(@8>rWXUxF&k*#!eVxx)Bdz+^(#KcJag
zd-1g26#K=(H01FDe#*~SeW#K<fD|8j0vK^)oQ;CR-@6Rd)c$BIF-+6}HJ?8@E6IvM
zjRXSYz7A>*%#Qa~gzv&Rk<e6{X3tXthu&^~f#B=2EP*`3_nQJ<y+`|8#FI)O{?I3|
zx?S*!fha`{E{b@|Iw-ttHFHr`f-VLA{&Cpnz-W&~b1p$TFka}ROMHTRJq%LZ&oz03
zC^9>!H1z763@Z?PTzSo@?jz<kWFe<Oh>A|tmtEwZ9wTQmFun8qn41@WdPpD1w%lao
zUXEIN7tY@)KB=Xv4}_xT|L>c3{(s|62k1Zlt{n|R;YLS*FsEQ+A--e(O#EN>tZ(to
z()2nV=ac=kTGM>CZZu>gl>FVjJzHMg-VZ$c=0SfWOJIktK9h?g3B9iiB&?vnsi-oJ
z58+;7UXtK3ct#|k<|@_vNsCyh1_}j$0JK!|N8ywp=_!7JJ1)V6N^YW`JG#`G*CVoK
zR(jv5a;)9WLm!hVF+N3?Q@D5>SI~lO#9?#4Y|9qRkwkQ*9|}8*xn)H!#BiOg<g*{Y
z5P96R4_#Ln-{ww9aG(-9#C@S{a1L6q^<V$UYLLnDw6m(sIe1-C;`IHd=dbQO&Tv>z
znLgA=J|D1<o{N$~icw8dAYMRRgW#i?yo<Z=6OKL<mtM_JO*bze^wkR4xZihW7oW)w
z>^oKk<k!%7ss8v4RiL;4h*!7+{QTFq8uqo&{8O{$O3-jGymrIa{XjE}zVcYO;cfrf
zVel;*Q?)7pSP6TA#zH&JV<Aj*&cdz&Ns95{@4@BVmff62VlI4oNu!N(?@>s$%mY0q
zy{D*OOa(@J-CvJn=jnPh={IYR6R!>Q^7<UFieH~(xe(|h{NU;BxI}jmgZUQ=&ve(4
z8S*t@FiLt{+wB8Coa|^d)^udE7+0sGu2eR+s`@+FxLLeT1>yFotn{73zFZfW6{U}u
zSwzPlsiVF&xquteJ3^Zt{yKms6s&svXlXY(MZDEMDg`nzy9QcX$S*~~%^9Ufr)W8g
z+;Mb+qZ1PwyD)x)o+Fm{=p%-wU}94_+ic+0lM^wQ%sR4|V`F1Sap^@lY7W$4wt3nz
zvE$N{!iHj+Pv5fnx#U}=!@6URpBJr}(~z}|dwSic{AW_bFo}?b*M%I_4HHy+?|FFH
z#BR81Ib|!Z#&ap{co%8*M)<FcPaTC@eyp(_3_)s6bekyk%r!VCZR=V+mF2}|2DW-v
zK9CJDWSe|ZTH&#n-Q@EUZ%39q|6;GuKnI6AZ=Q-Gc-)h<#QALuL6P!1UIGU8jG8t!
za=vFbfF^$nSSu_u9e@;0WuN&w*t$3i%W(Kn#pbk{t`b#U0n%24dq%9G+k`C~wr(Bo
z_S0UeK9$YmGxz91SLofornA}_MX}v+H@gcooh|ul^uVu=glRU10f?|gxnz`v44P{R
zPmQc8^awlFK0$w1G}dYBg&#2ra3$!yOkEVJ{0Bs_<`$)2AJG?FfF7rxn^0-Mi_(bB
z@qJ&veQ|%#<G<`t`~36+XMz|P6h!=Gd8-imp`|%yb9q|V6D!j#T~y!a;QHd8#z!%+
zTg&5iQX?Ay>yJ`I6%S*>Lg36c{pt(-XV2TA&}}BZ*OL`Y5Cp=o7{as@&qntMB>TI}
zK>L#3X_#t#%J}?J+%QcjKJ-D?J5WZ?vClPfduktA$M7D7@r_L*S{na=?)M!!xNbau
z^_9W?LHZl<9c_4FxC@pz-JXqKoM&Beks5Cp-`=Q!ualdz`DR;vw34r<?nKYEpA~Xz
zN|KBgxL9Oek$k-3oe;1`2R-83Dt&?qLJCpSf$DS;tVys}uNvaqmPsPS@_7$F*goT>
zN^d63h&-Cb>E4%lB#xqBMh?oo%fC4Yr=>O6Et3W^ghp;f6jXg<Qi_CX2gP?vV&d>V
z!blqu29O4^;Lfc`a1xPjr8M_L_{NCW1(<(x`i8Z!7)&1VH9+@p=pw7|3hdFyRo4-_
zFH3V%PIE%{n>73C!h>q2&O96<-hHh$baL1cYs?pqv{?X85eO~<Ur}7%kJC2uWboYB
zG??}Hshb1+GWLMbU_0)k*X??4-7waZEL?1h2A!02l1uGEAqS$n8z)mR2cwy5Z}{F!
ztG@GHxv^AJ->s?Wp7E_6&`H)}3GC*seQoNnI{)~K>4|yxmM$vDlT!?ruNSlnXz1}W
zNDM`e^oM|cvX^Vxo$s^N-BKRia4lCTfUFa^Iw)}GEhi6DTJo9b&y`i*ZnPif)C!&l
zB}Lb#z+$n5(!JB`e?%_t+SOpr{u=YkUMaT@dKazZmN59~;3&-=T!u8DsHBiB{s9TC
zTso0f)><Jp3o{N#2{s7K-#*s-lj;42^Gg-UM^w0|_SV#ThGpyO(P67<b2m@6yv-gD
zYGaa-<G#E#qi9k;2Jx^A>u$N4qGthHk8ldHdCun@=`V8Z=ogdNUR4U9ftJ9X^(|m&
zqP4#JWkG^7&(5rR9l)kJ=gNb9@V^E%uD?CY{&0vteejuvnkf+{MVX5x&z|*X?G<?>
zQj_=4rljd(nn%)rmCRL}Xjb2MZodq*>k^+A6@e<=fLIM#uiPQ+tc-Rms9EIYT5UMj
zc<`4Oq*GR%?|!tZd|i-zeJ-sXwethY2SmGnB!QD3&-cP(bR3O|blHb9WtdXmb6&;X
z)q?#`5wg(^3G#6Y9bB3j2nhn^i)xBu>D+guOP;yE6?rkT?b5{;Gcz;m)~DMR^lBdt
zSg8-OUf-=yOyGGnRIP0lXjziAQJwwe$iixG_0g>^6W*W{RL+<);O)g|t@7eL!P{ZV
z0N5`EkdJv|%6tL#;1g)~Jmm$TxAWiAKAO3JzjtWm6gJhppQoPRJUbMa+lSRrae5SX
z`36Q@M1uGVX&vZNLomK0vX>WF^($xEvUIoQKJi(bc?gUCH{tQ<vjNNjF2&N-z9Wv<
zNbU<~0y8pZCAdl8scsTF4toqU_w6&;8S%{N=A?)3VMh0}D>(|y`e_yF)9vJB1$moP
z{x?-2i}fP3SHa|SOZ2(9{G5!7uw)4#JQdRo<EQDFXPn1`3@YsPvA(YBsr!DF`ZlOy
zfKNbJ%A8>M*nX%$ijj*g<V6jL2zH6)%{ajY5f3=R8`fwgnd_8Qfu1ZkxojDp53)l0
z;m4Xz$gm#@B>$#_V|{p1z4aWgTTCcM&Y7mePFNKO09n}2DV)T00@ZPB4@nE8%wNTg
zK$Ga))xDMaIcM&surX^u&sNlRc<6unctQ|=S#xua1B`{!Wd&HtyfiIDSTF-~sNsAC
zb79}V{>zzbwLb@D@_UdU2^TR%=WD90&~^<TBDE>4nXQiHa$)dSSxSw7a~A8XeCUUS
zyg_{tNz2AlTW?MTY{)dxo}X$wuul7->MM41zwTAA$P;BvMP%I3=40xeCUo8WQ#|Rp
z)>hP{;DI+)yZy`TaIjK+WZIHWdJyf|RS$hNo0kM=A8xw{i@cQ@pb<3H=M<9s0~XKt
zbjO%OD|-c#8Rj{V3u4r=d@KX*1giqpBZ8nBqiH?U$K>bw3?XkR;fYk{gU|q}Fn4{s
zpV3GBw3KcD=q*Ku;+wINioMwf_b)u}*$m*R8p$?NXz)p9gQyVw{`5vL_<L_%$h&Ft
z<X%bDdUfd-eN^WuyL{P9XxPNQ_CbL!6-}zi1HScrr0m$fobIjcu9dU>?v^E_A9O;-
z)Ayasec;PedwYc@et3m$p4mCaOPjCw#Yy63b^ia@d(Wt*{x;noL_h?j2}lhJNC)Xs
z1QBT>Qlv<Yh;#vw79<b^=_LXJ3Q8{`O{7T;J<_E^Xeksafdmnvg!tdTXPz_vne#m7
ztXZ>Woq039!mNevy|efJe((FfuFti&G8EVwAi7a4Q-ptc@9OQ_77RaB@=DMgjoEuc
zlAqLOpqe+{YxtsC+e|7|+B71JKh#}1ALKeJm!GqGe;tv4pd&xe=fFo?CvyNfLvk0x
zlTI|uKhNBbLYg(wKl6p?8m3E}r=~e8dGJMT7|4MgN3mebyT|!S8d%Y}IJ`2P73s(I
zmNwdf(bzR*W=-)fu_5MNYGM`L^&RBgMXRZCZ#~`HOEPY=AIG-9%{U*GtF}<SteVM=
znZp@dU{k8N0W>!0p!ae43vacUJ-Jo<y}eyZ>_evpub}p)Hk#A#ceuEBv#G2uuca%{
zUq9GiEJgxRq(HLuA_^j9)>21wsthmlv<rKnX1n$!m@i#8`TbA{b#l(h$BN~xBkm23
za39X@W`F63M^d|K&lT4Auk9Kr_uGIh0%z2ol&t^Ato<cibjf4DVK_|m09Z*BQ%SZZ
zkn)=(PmCi6QnlQI$QhgMexdZ4eP|Bxvbn~dc9>jV*w31yM5*{CKte`!$4<Q9OrrR|
zaB2RVKKO@uC18G=IFW)40^+Y-2{}r9RHuvlAF8w(4zjZLQST;k^+3M&xg}8EnU+>~
z{KZA3DoPap|HZceii_re{(tA9Zj&Sbk&8-+{2S@(-~W1hejk`mi=SkJt&NFb^nRYy
zja}u{4e~EtJSQ5Mqj7!3HX+k;AlLj-<gQ}!1%Icyo3s~g#$o)xLJp5a)IZ<aA;$Il
zdt|GBa0A+H?rkk^EzzH1QEL2GAuC<7kTFOBO95bJc+YWEMiRwpvypEQYEo*9{69b~
z>VQP5->0eTTze>#YL<Z;Wcv0keI&b&*d>}Yu<rjF(mI(F;D71nQ=jYC)sU5@^Y4HD
z7G$5oi(g^zIdVc(`AO2gHT!f%Pa{$?pd0;-zH&nEBK5Bj*AozB>JJqa*%1qrI1BVx
zr!;2_3nzH6Vi>c}fihC!3b`MC6y;%UAWTKw<9e%dUy`?j8)Lc)CrTdUuD%BhA~RZ=
zamY>?!kU6k!PXI1(UjpNdA%>ah?UpK^!lTM)Js{HRl?1&aw)J2KycRmo_yM$9eNm|
zUy5^UzHuY#ogJlM|Mq$=;PSn>{fOq8*d>9=neYGb?fsuVs1+w=6YDYKJu=2U>IQIS
zvAR~`SS4LjNs*59O8C!S+7yO_2STE8BWvR0c2s}~zv%B@Z)X^3^TZNLdzw3C3QpFN
zOuF4NqpMu{vG>Nz$WS?LpUT8njN-r%b-+MC|MTX^_8<%_p_6%nA_S2ntO6SJR!7@0
zmvjyhxnuj`Osl!?L(EiA`4a=mh&I3}mB1PA(?a5~)_)C-Uu0*i)Ek#>&5oYd`Cnuk
zaAGJGzgT&<Y6v=Do+*0i1Ltvb3{<WFBHXKP6HS(SoD&Q$ve$EW_X8~@o@2ctG_EPm
zpJ!?jV1M|(zHFdG|7#fjpAKoB{clv1$NWW)3;$0^BpQD$7Dmh=c%XVLv2uZ{v9ogC
zxUk$&MFW?Q4+lftb_I<BE-jq@sHM-y9!LL5Y6|EPcww9gUfP0?q}~zD`&a8#<Af)C
z$}PlZ3Nwr3OGd8MkxSo>J-yDCs(5Hcvf(o+!RGp+?#MaX7?f3%tt6uITs3hlqJhiR
z;W?+8<8|V->A)=vPz-`WtcM^f=p({xesOcs?PBBh$wu1FmkzhuP$<k(9<V0{IfQ(X
zmfm6mYM>vGV}t4w5xx1bf@kVyTnUaNo-*qz1wNQ`)#U3pRouq{UbW+?TvHx>3E>!-
z%`(m*Pc+tguN<x3JC-}SmswkL)cAhi8{dgsuxvcQ*Wz_C10;qJ;^#k9cfK^`-b>r{
zReIkw)|zuyhBCxQQ&mE>7_l|T|ER731_yI$YGB9De@F0=*?cf~)q$z-Y}2;7&J*+I
zw!l?^j>$|1#Z(%J0Z8{In;@uPS!!TRrc$M5$!a<C=jXXwd9DT~A@vJCQKy~mb3xWe
zzlTj4fcb~{m(*Dlt&GU$FNPBa79)LBH%6g9ff1lh!XX^A0KG!Gk0~K)C%M<F$4s<*
zIg!bXDZ?j;Ogg_!Ql+Lk`+GC-$9M|wW}i>kku|9(|DvXvA7<HlYz%VIZaMrTYFi-f
zOP&g<svt|E@w1La7`Boz-SS;UK*MX)cC8ye!hU6Swx<#vb$@-PUn><QQ(Jcw_{>1b
zTl%g5Kb`gcS2}B~2Idwvy;?k{1zJ~0POF%aPI&^q9bgr*6^%`E4>_6;C0jTYl{Pf9
zO5*jhqs-*RS!B|pkCmTosJY%%yc1mCk>k0$d(>I^QMm_;vvRtjnM3ZWfO&eZqCgAU
zUP<^)aPFEPSao=8`9!hJ7cwTF(*{<g1|%YZNCf!`BhZ$LZBJ|r_1V}BdmBt`bCeyt
zo|L`(?f0Xs&wfF8Mw8s#->Jnu-m=sS(qB`ezhUB)lRlElBm#4f2v268&(?Fcr`s(g
zy+OX0l(k~?{iVx)2KnM$&cvv2dLCCvwJX9YKLY8j2c0O5n9>rQ+H;xIlKK8Tu6NWt
z9v}|tKmHWFby7Kx%<8?tcy`<wtmpYVCAQl2LUHL5GSu^FVQ~&O3tz=vRY{bTx)nwn
zP_;Y7S!;{;VSMoD$*>z!hhAIcTv>|=@CC>*t{Ja`E+f(>iju%ZaxsTIvdc1?b2G~J
zJ5n~zM{jI~4yFfre<g98S;F(d9Vc5hn!=HK&>5T@Dy%z#i^Nz$4sH0{I`f2Vz??Q2
zNQ$(t9In<qv$7O)zCZQSk4OfpL*-6h(*9B2jHXpN3TjF6EAx0xS8)-3l*??7x8a2*
z=1yw78KPSMy4b34Ca<NaJ75cCN80QMq#JU5_z-MX8v%awoZwiS;MacT)qB7DGjb;H
zW2%lBJ2f7kt2!{W$w>A&6wcXdw>r7y4QA9jTiXvxT44(Z^_8LLuSR<YW}Em!kD2|R
zyjt>M{QQ*bX8*lD-(&+ZDaL#=b3maEJ1PPK%Emz?gC3XwnXk-)7Y6s$OU(@{@v8W6
znts}KQ0>PmzM+5F+HlaZ?}EN9K>b14;It};%>(%~5p2*KpXY*D&g;29n>%iO0j&LE
z@ofzHJ<x$?mFyL3^ln0Oa+xvXEfwBt0M{lTL=GTEV*ukd;1Ph_T9M=bu3plrQeEg3
zGO!|L-}dM%+CjwE_Gwq)ykh!=^Eto9kFF7$@uC$Ts1gN8z`dCUZenV+U@<JD`tGr{
z3;w2q-dPilUkOxS<NeH*o;Ey-8J`-G!tE!*8sJGvfU!OU%0`mG49l^S@{K>k&1PzT
z+GEPMP{8hWFeR7iU|7i2=Ofkmt~GM^eatc5uNd(DvuFvCa<SH_E0^XXxRerVJqh=k
z<AVz!PLr;v&(&QRMfe+Z`nA4w=YSm<Qy?MA-mhtg`_=s7p5+g*v_~dm!5{Y?(LH!a
zy>wV<;h@8C#+H-eJ5MAfh=e=2NA@6LaH}uu=!%Jqn2zSSb}`%ym)l<^_wbEuLH<5T
zANC#^&)<>N{GOTE3d)SMc4!vJ#%GK5Oq|$5Rg!Rer7Oi4MNG%-Q9pOu<&hNC9BA>n
zZR~4I>#J)TMAKIe$nCWdR+BWQq{{-quV9%bVAhC{>J#}bTz}5$?yo{GUZ0u961Nll
zkzMASG>)*okA4%n&-gSH3?gRMD7>dlTI!H!3?~AAL5tm9tanjlwL*P6w~;PZb@4`j
z)zxdf;;9h7w*<qkjcoC~h+K=gAs8264?Oupb-{te(E~dN)yh*K`t?Ebc8sI!UwC_S
zCYx8KJ1!Z=UcRUvS)3&nofhqfE=R&SNl0X#FiDN*(kl<KL2B_eMUj!-0Y`08i+s_I
zzA|f<ANasBGh=mx->uOOacdP;os8NWPn9(`Ps?3y%sMiaToz3;FU#Orxb%ooMT04a
zR0s29Nr7=d4FIFT!Z_w<Y6k{!9&B7TUg`B4KA-;kVDS`co%T__C!H!SRdHJG&W}~p
z>VTF=Bd9(uRgNrmoyY-6pImRaRBrIrue?#nHsPzKsB3uaUFt}Cfr<|?<CAxOz!LJg
zfhauw$=#obgq&S<=B&b}GCpf>A3KYz^O{8JR|Pa)I>bBi5o&RpeWS)Wz16P$l!y!U
zgwAHIS3#q)K3b%e#U;CvBAzSH%+ICqw4&*HpI&1O089f1l_ca*gn`)*G~D}@zRn*i
zowjXe1}|={9>Q@v&@lh54oe{4c-GwNROu%$Q?-50*7>b&aby?k`B$M-Gi@gKO%OR7
zsDVAcgeUpK?}gJGi=gh_kw(_Y>(`aDvAJ+I&lTQjStwt5cZK)0TLWX0p`D{lpW&@=
zaqIc=IZtFMwDv@tR07HETjkESBsk_rx0|?NFJWh6G7qySR-E`AERL;wk90m?bI~Qy
znlWz*3x*@;$spV!ORV5kpm>i<RMu}c_U1Oao8CC}<RzV@M7A%T{f<*Fn2oaFZ*a69
z^?BD3Xxx4Zyxc}}{RazAZL_$?nf4H@Hu4Wu^y;}rdu9%-b^`uTYS~0{*ki-!!PmB?
z#~1Z!HgM@u^OYDtjgjo1ztDPcE3$PPWz9z;d@A~!_exE7e!!d<dRzcvfaOZN+J^41
zkg*$(O27*m)*m?7s~NcjJ>;={@a&vGJUZIZ2g*ixQ9=qi@gduhoXg8I3Q28uKNFu^
zTf-aoSfkdbgB8^tAx~ojs0xLioU8z3Ie7_>e*;JU_azemKmM=!;2*2O{{L___`N9c
zcfj|*F;@R=Ez9zi<sTRtJO89Yr25-0k&>|4_z5)p4D`;77Ar)!+ev~{j9sP^&9-bL
zbiO~D-=&Ehs{iWvbnP0(DpFhGa;M$NbA(8vDFbC%yY3jzK-9$|diLXti6KBi(68||
z$apx6uaK_RIRNzLj^wqFG@Y!wlKSYHi8o_9R40A_%f6zMH)1jvwdTZ}WIpk8oN*-U
zcT-9gD))x|fRU;Xdw)wTgTB)xbj4YkWRhPZFsLtFp{XY}b)ZdSU@YyfM5q0psm7*?
zAWVw*imm<Kmz4vqD-5m=doQch(R*LpXsum{K1u}OR_flsJIUZ>yR0S)k>j4Fpm@_v
zAnA#6X6ofSrwv!W(gYQs;imgk3S~B0)CA;Fg?iCWtLiTIiRu!hxW|9{e#cl<b8rM8
zsq%}r%6b4@yK>7?3?zl)(ZdOWz(9Fb6~RTBh+v*0+oI3?ytGG_9_Okoc0&D9uPzy?
z8RqNanQq9vbahVXlceFpo8%Qj2>GI%y&npPr7QkGV!_@k#sF50oiI7Z#jUH}c&#9|
zL7ADcJl``q8~YlMnT#bIes=8uArFo=$YvP9tQIaur0;nO;kKJ;kdZw)F=*;YrHGeV
zH8BX~34IuqY)Sj_)g554%Aw)pQqWNnpge~40-zWJ*P9?c2QrML6HbgnZ^i@x?S3z=
z6*W>y$+DN7z(8TyqUcJ-dDM+Qf}`QVucOH~y~0RV|29b^kJ5N5tjQoU;yh^+hz4-Q
z;KPs<&1rn+e2!RbRp(+5XS0y8mg5--)N|j5T7Z{cY!mUni#n2UuwGM?F1i`-_#t9;
zl^QDSLj)R6DhU_Ts=ucMHf4XSu7k7NYiwSA2_W2B#?UTmOjKG?KqR6k`8sK|dWS;K
zOCPU!8JExeps6qvGaB55@-p##Gpr-H!TxNBO7y|r{bqXQU;aKP)}#=iClnRG3iX@=
zsK!6clZ*&nww|qWN9PA?Z11_lRee0%`<`-Uxw6NNJ*ELEN5oS8jgkk(O4j_pDS74%
zMWZ+e1w+t?U&b&vY&S<2*bFxTD2}E!A`-)-%@3e5IQq2M+kh7J4zkr}{U|OJa8HJ!
z9?RRcAG3}trH39JD0zJyWd9<Q>5>ejI>emTP&gyTY)}TV?M7V1SP&N}?!9X7Z_e7q
zAmi7Ajyqgy=VM+_)t~88=~}c0DL}&kO?eJwB>(6<QH=7+(Pq?%pA<)QF#^sy5gJBB
zMt8D1K&@v3A5<wN1;Ot(P37MCEH6Z>HCc7ZblqJdO6$q#k5??M6rPAxZ6>lek>f7O
z7>76y$;a3v1%1-4uhz6Jdw;|4eXbYsZ0@2gGUmcZo=z*#c=|2B<a}N&eliU~bidCp
zQT?;0y7F7LD4kIE_uUd_*=k2cY8x;H4<EcLNc*L6@=zNe4sa81OtveQM~w0U(^g%~
zsr91O<j)sa0Tryh(ZjDkFQ8?7-2(i~L)B51HWifF*-fksKKDctDnsmOTBdWKZftAg
zIp-bfS1rV0z@IeKIS}V|LFYnmF@NN9833qLkEt?W^af-{o;cushN%C-+QZnkQH%zq
zoNr=mMY7aHBwv0)S!x+PAv%<k*(3Jm%z#t_eagV&FHJ2Zc#ZMJx=(?DVczUjRo8{0
zUm4h)$`ZNb8o*rN|2kd+cL7RfrTs9_Qx{)K?^Spm==@#h3PM&J4R3wSE4TX#hv%I%
zRcB-o-2P-B=D5X~85K*uIZ74r26~g2tj*HST?Ls9mol3Zp1`9pRe^7`W?)abf&J)G
z+tLwV+$=&s+r5?~Zrzm6Mo|Pq>bt<~?O^9nEQplp`8y)rZ}oOlf|K@Vhg);!W!yxc
zO~~q_m(rz<4iIuMbiVe1t+uz^iTE7waGM9*<oCme5m|abj4;3Pg&nLaJcxEuiJ9XT
zQD$_xui$;c5#Otel2IeOeUcxeY~#%su5<{(ND`~PG8b_7rrW~_Q^-zcLTsIat~*x7
z{`R%4$<Vh_S20rZw~C)0^w#m?Yqd_R+c^uNz}6%xkus9UOBDU=<hikE)ed>gm$qnX
zBqz+&aVhjwjSf2XobZ*-p3{~<0o6VjkS5v2Y|WV`u6ZL2@*?(T&Y;#5BTG=ave40$
z$Q$DW+U)HNXcp=fvMDjR(XX5YHf^#W^jm1wTkBL&;2eCm{`$%X(Lrh*5gG!Zmx#(E
zYdT&dO;9dEbp@&MSijxNr*G~Dud0sxs9Oi^yNCF+U^_)mO93Sh>kjA>csB#1Jhe9G
zqp2HSu(<p{q-XWyrk#DLnVr&TPiRY*8=CdfDe7ba*u&<dKAVU(@Mu5go1GG*dE#T5
z5Qq@zvT;rtJ~-N4Jirgg4~Wz3!OsA=7i|vc<x<jd*YkIFV=t<2i8Zvne4l>xPTnN|
zOG<0|fX<rM@GP67PedTVqfrL%bPgnK0<2%~9H|0O)t|quX%re(Z0q2t8|*x_R}>$g
zi3z!6#5p)NY5TTrG<+Q=V7IA5NNuUHEldwrAK2JXrV-7%^mf{13CMKV$HMSG35YJ>
z^nS9u?4%<g6Cxxb2!pd;TuvNQhz8n>N*|BSjOUowgl=8DUuOKno0|;)d&acO(cY4<
z86&5Z&*nk7Mx;ZyV&({xLT7=Ra_4}ETfNF73L^#f>H1Czy9x@CuUMo2k>Y#8%3IG9
zF<a8%AF7fa%JrE>6J4wJfX>j(#J?$<4xZNS(Oe&{4{~t=v_rIv1aO@5=?B>3)p%BW
zBv(rS&QZf8@20%S(FAy5nAOjmLlHMMqD1|h9t%cscRO*Bj)D2woLK`RqpwrxQ`@xk
zX5#gfbUnB9_9#!L$}4qjD&OipX+BQei;#foeWS3E)rs7F`|SPx{-qGNA@7qncq^xn
zM9!ri<q$pTFke?eEJ9mL{*^Ym0zvi6KcC4vG7NBvuFOrYHj5;1??w~-OCA=Gp8tFX
zS<j$~5J8*K*F#vaaWP~Vp;?dA{dm8W6lOn(otbH*;g|FCly(Z<8fq(ga?c@7@>(cT
znP|C6uz<(@o-Kv3^vK0hG)RS|p7$G6)tlo2Ra!pLQpv1;ofMYm`92hxsv{H?;d5Hh
zZeB%lp`81Pp)N8Kk*g$y_1ZxXZr{ml${z%*sf4eU>!0@cQ)3Yiw3s2>y<jE^C**!t
zCrfkcs?o&ZqQ_-6Ci=dI4JCk(#;~tVe*H~)s1o%iU}T)bn-Y?a-cANFuEudsAwPWo
z9BP-9@uBy~@lOA+!V682Pu-F?AG<k3mF%5mxkTJ2Uo=4bMQZBdOleoQP<WvFZWs7y
z_kE{yVWI!VY(+>2e|qh_ux*m2M_s=B8XHcM>QNWyA~E*8Cm{5ooS!26{?X%qnoKq%
zWd7bs>j|#HdkRb;l|Eh<$$elW)=D#{HgKBR&RDnuB3OV>?#Q{>L6u@m)2GJz5T0xA
z?`RHf<t1CM`eMdrohMSL!ofZ#9uTcXeUcRn2cjco_xz6Q?{G6=xi?k2TO74LxuMoa
zz0YoBUYw9bXMJ<6Vhr_r({fs9Qfauu?z?>K5YN@8#nRTw(oZj_b>VWzqo)W%Fo3i)
z7o(wYe5c=3u8}&lL8cr0MOc=uV&k~i=Jx0*6>FWyH~LJd&}j)k6{|#hoEB(Gxqd*A
zLIx4}U)vK!+84_;6XXW@KO3aGXuv|h4)`x_h{MojU<OU&qAl)xz`lZGiGSWy?%`LX
zRLx>+Kir`}E!9_cGL(r+csF2cWjkoWFo4OEqA=_Now6veE*A1HNIuZRl&vfV{%#CW
z)g|ojx?@(^JevjujuUGeH5M0c{#t{`iPk482K6A%M5;4oOsC(}5TK`=2ZEV*R+(kn
zVKiPuudJLz4?HH?7177;r4TE>*zb|rJ-quwh0tPAWks=@B3Ye;Lp4azM2lW@a}rqq
zTN|q-JL}>ZxCp+ug>dFBIMe+|V?Op_b@Q{2b$nJyugW)BqVt*C#kJAZFkbS_Cyx|8
zd6`pw7R<{tuN3<{t{>}6#gq>2Z>UxWYZEMtrNT_PB1Q$}qm+5evWa}gQ4Ib+qyxUD
z8@B8;=A8YypGb9jr*`NM6-h$By39lH+UeV%W#4TL0gZd4lro2<rMun2v6oyE*3#w)
zoR;iH-)SR0*sQ_GoHo6@;FQwS{C1w|cb=%@RG+|;j4!o&vWa?PBWfTiK|QMHzQDDk
zRUmnDzFd(a9QT6awXP8KYTvjLWl|$ypWD9-(phHNx?GiS$dYFLu&vl1-a;tHjz?;#
zK)COb(g<_baGP(9%2(AaFFp>!;4=A``Qst356}H(^=_$~Qd(9uiPoROKLT#mgolYM
zN{knu7U3-|X{c`{Q_;!yM_eFl%_xIj<^#SMKLj;|YS6QYWN{Q4_@z*6xL!TovHN<`
zNtt+&PTJRV8ZT~w{JmiW^VQgNQmz%@xW|+lGLD_;d?68MHr*~&!nbqIF@j**Tyt>k
z>CJP!na|W}3p(j2(}?rh9x$5iP8E{Rjpg3&8dDaN<<Ubk(i>(YSF%?9`IauvTfKb{
zMf3O?C=V#LfW{z77z5v3M4K{_)lakcgGRYeZpaqT2obsReOr^3-P~K{Te<IFeu95?
zCt1$fac*}UjX<3-U5p#Z=O^0|vUV`=mw;cF=m+!t{l0Y9!Yk|GrpuQr%dfKo4K|0j
z$Bc$KZi1xjBW5}U05%l5NOhGrX!T{M=JcaUC~ua!Z_;VhXYVY<x46+oJDxvOA=I{R
zI^xicoAN(ww&w<5i&E(Qt`z!S8_IRwjGYzPD2BsT<^@#f@3o$%*UF}^pBq9tub{bU
zE$f+VMk$QIX11AhOc^ZE{%!C408~Ga>rQ0(>;At*+V4+0Ew?0y)?}A>RH&^U8GFaa
zr=jon>>VV0-8>#YJt|<i1I+f&B?u;^Q9qMOEqN0C0D=LKwL>dSjQe@z>!+5|GMB}J
zUBwVzt)AD@o`rwzlmrl^b3LF~-hIG<CUT4ti`yMN9DZ0KJ=r5q`JhoGuXfh83;Fy9
zaG4jofr03Y6D6oIVLwp@mp64nW7ewwie+iZ?&go~Yd3P#*dBnM1dc-KF)(&7iZt+)
zt2k_<4%3YT^Vp`VY3>-y#}4dyKTy*|>#@5m0!4yK8gMtWl3Z{gK2k`xHWL(hRC!hE
zPcx4e@rw627688yYM8HRW#scUgBVx3@V3lry`hqNAs~L34+7|8(~<*Ndcp)i4y0(@
zRuRX0`d%(Ev-YT~X4_LKLmZO2KD6&7m@K8vfKR9)e7Xeg-4}#`;oD7y7phC_w~wWZ
zH*z*D%%ARUR)XG%kLy{PcX9qIJOM#%NEo1Mk6#r8FbY!Wpw+%paG%z-&ZrYB_=EbX
zl^LHBH)A<jjBQi-+jkY`^=By5H$kPVGzg#Cm{s2P0DnT!j^UgpHEz)Z3Yf7#9DthL
zeZ_>gBE*C4_yVUsmcd#o>%65r$i)VGJiup)LgJ7Et5NyvmrwKL$jl$0nnc=;{@Jpi
zWi5Q^<a&;F!{V3ZzC{%&|18Wq>L2`+Z{N-U@J_1#w9t3%zgFlAzH2i=;RZ+<`NWXZ
zC@kQjmfqP){FTZ@5rF+ZxevVZ-NymQpFO416!`fOaOmM`hyUs|{<k*Yzn#|q@dNse
zxE|P9(v&Hoc6ZAUhQaI4I`Z{7UC#L>TK|@JQX*wPTLkm!Qs%MjER^o+z%wbvJ`kOz
z3l<c6oYM=j-m%W;1+h22_j2ULip83k8fR@a|B?~{Uo(6oZg8OmWz?lz@!DoiORgFp
zUiC1eE&TbAh4&w-s~$vH-Q~gE#Vx-U(cd6?vT_odt`fJ*u6>rwHLFx@v2tHxT29Hf
z%6V$};`?#wKIUI&$+dTL0)RcogwTeYLvkYso%J=I&8>}j3x`Q!of6NodY@Q`z!X9w
z$yJcANW0U^wQ>aQo@KeNP9QrmY1hxaC4XS<)yk5AxZ|q^`A{7f6m>WM`@ZR^agRak
zqY0nuB^en$CxiP_zP(wFN|>*c^}bu86V<Kx?C>ZU`%n0SjiXGlkq>s%rSBP}RYp*M
zQ8F4LOIz>$;&MFbHGuG;?%tY()c2!~@xs{g*cE=lezY>4eYLlBxu&IRdHaZczSsMR
z?aNL0Rn0+xv1=VI1B!6OhYvuU*4o;py64b=e@Mi>g3;FOto4tTb=c#Q*Om>RO~=Ln
z+!J=6ABgmc&TlZ;9H1wx6l1j+NX7cm_u4Xyn!SfB`Epg=^&uRa^6Ke~)RE6mzC&$@
z5yiyfBR5ipSS(bc8f7F}a+GB~*Tmi*8h)Tpd8{(8kSX17lbl}iBJqSS5tkakH(4PW
z@=h(NZANb^XaxmsHqLElY`~W84gG$e&r1#jGFKYGu^@(BrRu8(2b-ou?%1-HM8;5&
z^m7Hy8|@zx?})$#MyQ<DY!)od9j;e}Ro+uVksR_@0?m6r7!BUQlNi8?@Lw9h=(A1-
zcGxgCrMwZ1LBV=Z+7~HHAp%04VAq9#vjcvL5#hw-2<5d$LhHl6DInbpY{lf!%EV$0
zyYb9?9I!OeMsPxottrbycx-i${b>^S`)iLDISSCJbl&X4=;mHv29y+vg~w1>J~b0%
zIvR%EjFs*jsH26o?7ix`!~~=k#mflOiyP}U`#yIoHX&cSEsj1vUCe%au-I7JoOTet
z+O3@k=DaLVenu>eGs?~W)~=cF+UR^bSOW^2toUw8TsBlbgvCIm3Ls*=vre3Zj)J<$
z!?gqSOGT~zv4|g8E`!@f%HJmRq%|M@$~s+HcjH+R=AgafBQ9h4==G!gFxgJu{Shfb
zuO1;;40tJ~XettI(1-*eT5Rvg(NL>6z$GZCd{8>KJ@<_t!-;0_cZ9-Ao+q?sM(4Ey
zzSq1NLcW^#l~4f{C1qAe0H;eYOrXRB$R%|Os>IX?@NV(WZU+Nv)||ak0Ih_C{u8Ol
z5b6PcusKxav`jie43gK|lj9x<wJ%;W=1+GTul)XF-fsT2$)ZTsLmCa$p~BD`&uylZ
z%tyGi)erYsN$?|JR!B53C%Q*Bj>5VTY<|^0tF^7ZRf$fMlVV~X=AgE(>p&>q#gWlp
zd8+eK+P$4uPs<SQj(q(Qd<3_G>>T}OzpC0e<#-A*6z1;y>^otQ1C&<dOgqE(zKVVY
z+j&xy>RagYLkx2WuBU6m!I<VD_m6_-4)H;9KI`7Ot1J!=x=RN6=sAY{)y^^9rRIBP
z-}u;LmAjOrbMlxRG$Yq81z_2AJDUmQ5XJ9Vavw%LpJpB82Blx>e3~Kg+Hc_7R~oi2
zHrqa-K(alH2jx7e5Vx8bY;(-b-Kov{u%-ExSO)#k<7WeT*5CLx+0z#jzRM><zglam
z9?22F$x7igNCaEEPw^7u*)i58VgKiMrQy1!joC>|J?mQ*iOa+6C3G~t=nFT0>@T$S
z3ks1yRgetycnX;o8{0ao>0YtC;MHVzcP{5{R%_{35BKyvA(xnotdC{&yWbru{}$Gh
zb)F}GBDD}|d$s6J%gDAw4FHD8w;G>EOYF!@vUl>FRoD*jw3$tdFG=;da*74Q9#$UG
z8Vq#=I6ffRqUDl+f(_8ko+n=**~19i;m;;7;qxu)d?Zb*!(5KyBUA6U3k9<6J*6Mb
z)Av41PgILS;^GGU5)iBunTT-;GfA%iDn<;{5}J@}xLnI~=>4*}fj2Nd+4*Vt*s74V
z-~%DOmU%o+E%dbDrz5OOyNRV2o|u3hXM+^$01>PeC<mj0EgRmnRPTgydVZpJD)ytg
zaPN3eIg0WDtHmn1HZ?1sOB!lWx=0f1cj8h}hi33Vb&5^PbY<6F7db|#LIm!l-rPVa
zQCP^1MBm~Q#(6UBHwr%~=|0gkKCtC*`6_nxUb>?smT{2BdVSwUUcW9@%j4Pkv~h<y
ze9CE&7Z;F)A#c@^f)fd%?zYg6Xx!AM?d0-=ouzP-U>M(|Fs))&3`sM-M)np%315<H
z6s^OLd9#w(31VDoI~%aRM&_xI1c(+>H>aVFMI^r7bdtRt+~~!=oRHDwc!MB*#_Tkj
z0o}|sCXW7~{Igi1SU&<4-4ANe%;TNWRK#4@)L@AVMBtO$>smWQ-ut@0vmcCmFkSSq
z{=zf=mCnPzycgsN(hVFQc62AYU;7+Igv8R<TKZuwh}l?gCQwG!#{xx}Gk;rV>Gl#N
z8~Dhw_&}fexhYc0kCUteG~nC-C(i>C_<l1Z*4WY5tjXIw%TZR%$M{;ieC&hvCJml9
zF--C~Cs~PVtugQ<vI(Y^-Si|BqT2t|Q#IWqc;!5zDcj6Gl=)o<OR(*u(4Jr3m-%1H
zd`b0B95`(V@{zhlWa;v8cj$;Vnc4;510u(&7A4niM-A-Dh@{^72)DRd+v=S~1iv72
z;@YkU?(;)nrbN!_hP*(tZIxHcNdC4v`#=dH<?~2^?y2EEpx#fyA`<LCvCwl`m*?$P
zA+^S7LRqwg)B5fDrT(Ww?1sY4ORjgXJsM7H-WZcY=PyiQXEtLyrJ)w>vw)v&V{8#C
zmVoJ)a?9>j-MaWxx!ugSCHUqQ>glzN$o37yorVs%yTDAt5v11;+tV{761%dpqMUf?
zQL@kN6joX*Gb-Q@+Uhq49k6;ofpbEfz+7Y=0`z%*hW9tpzD`T{bq9SvF1pOf*WGO+
zY#9UiFXPWoP+wB+WAb}b0{Vg}^0Vy{CEL8GZ{xc^EIsI!S<~leRmf=N;dWksx+JI<
ze3*MyGy(?e*4Mm`Nz#5{iZSkR8e{f7F`p7^{*;bYZp#th%Lqd<`0Q0KeSD=c_np&U
zP>keGSRFWSLS?6DN|fvz2YY{JXk@%3TapmacJ82<lV_7EHMB@}gjeG^Neq3P9cpq~
z-6=~BsFz*=O+0KOMC3{g3@7*m8$bUVR`u)yRdh6Bnm>FeRo<2tXeqNWZtavnyiJ-W
zpIEKEvPa!|bxY7)!LVESeB1l^dj7|CA_pFKd6l<3ieB~nzmcYPdYon=*7CMNM;EgJ
zG>s0}cy1K*xtW}?tV`)h2dMk;QX7h(U%VLYUSLc6L<=SWY<BonOHEH3e%oawN^Ol7
zoc~v`;oqgG+CmY`f2f8YM`*z2-?{?<2}-=D5w-th68U#*EO`cwt;M$yK*&6WNkEsa
zfgsJH@wyga@C#nQIp({Ayn%}7*(`QeDJ8Xk@huPi7~e*abMxUxAgcEZNq``QW9j!x
z(Y^%p7*Fox0Wo1oNtk+!kA}g?Ek__hvc$h*dHD9N1ge<e=-9Pns>1vcZFfJeh<WYL
z+`Wvjg@OH}=N-gp3aGW+QR=~Dqxj{i{VQ!>!Xl@>ex*3^>c)nb`*LR9Nr$<9C}0`<
zLp8sH4#5NEE$RmrHoyW$1!{$)C>h%d9*w?Q5S@n8oW_FQ1KJ#qD@*zp#(2KCfZ&00
zfRQ@<v<2#UaudRV3EBjVJLkxT6HlJJS6ci~m^ZdDBz~E%?*&{?Kh&(m@Eo+z?({JL
z{#Jq7ptXUOgAKUyrVI7B($y&6Koc>&3FYV-qzGa3G$SC)Rb8~briv-0V<zOvD<ix;
zf>kr*!~=Sfw21|?*+aB&K(?}g?>Rn``pLYZ#rqTP=0A|@yGFj8xxq%O2d_1zE2Sb{
z0wMC*`OE++U>vuPhhtVzaI9SKFF@Jk()C<s_HDWC>XLy<d4);v=R!{l=}`ZI_wh{E
zB~|vM`)`1HRsnJVQ0sLYLS2Yi`+8a0bY6mIlkPN6CmF08J(sOoyB4#Ixa<;;{smWi
z=WiL?EWk0r<0Gz|c4(a;TTKMo`nF4895o!{?jx*|4SYmr-uFGNlz6xqrv9SQ)D9@Z
z|8EqDIb-htMf;CcA=cw!U(Xp9(@?)r0VLBelWh)xJa2MWD-bFZ5;37A`VA_BHjPsS
zQ)?=F!kEYEumX>;D|-jV9=S4pJ|4t}+1=Zz)m?5W0f2YQXM6#NRqYoc$PKW(2+-l~
zTaDpO@=|wDHC^w9oy}!BN?ov`)8(aZ$-I+&YY6o8WB~ZDMy6pNri-~)o48E^3*b_5
zZ-bv9l~LrqwK^)dzX>RsD5SuH&RN;Yo<C#Db)%2p6-;aIO<~9<sA3Ivj|m|IdDNuL
zawC^usPhL$+hK{jE4I1zhAu5u1{q#oztvHv8o=yMc>pB>Ih1f4)Ns7}_T(1XH(Qq^
z4<jn}f;fI|&K)k|6@D`YC6uSz@~Yi^(e#I^dOid%d0$BVi|`RIaE!l6wS;D@X(GZm
z9~gLGH*zt*asdtD<j<0snqK7RA@4ScN%18vroOfqTFcaMsVxvHqz7Q~rU0j-osh>u
zsLu7`9c#oa-y0iSI3Jr6ihnPxCw(hw<R*`hO)HRVp51x*^cB>b=zT;3_)elQ2n;7F
z1D#}|Xg=i>s*+@4-ERwRagrf1rS7zZ_&lnPZoZfWYc#+wmXU&2d(@kEyF)*ah>s5V
z%#tjdO}K1{4Gvt6Lm%#4LT;uip7aZ7n|&`}p+3!lDieEq0G`m3YM2L%9f|ehb27cL
zJk`r@#GG?)F?~!Wfn(%B9P!mXBP&r(ldwL5Zot{Bse*I~%i@afL%nA~k0iasX^6)d
z>$sEql&;_KcnTN91`{(k!1D4KmHZnXx7W}%4H#DM*=KE_AnQycR8)2U;<4rg)0`H|
zB0S|l5mTUgzkYD47Ed(hC=N(O+(;?&(BkJ#fCVScHBC9JIGV5>^nSHgvZ7+GjH*nT
zjQB%kgUoN_-X&sJQw5bt5?DW`Z7vmSAPE=h=vup4in~**+}K`cI7pw(7k&BMQ~r;K
z!{>oOnME*qf1rXQMwU7S>QVRQD{}0lV$8c{v*qvOlDCd$xs&Q<#h^?tJ<Vf{oqNSa
zpF(YpB8e>c_a~3Y!bI+#RVFfDJIS%A<Mr|L%-Oooi_JO7SzhkVQ%?%b+32v430~`8
zDjDxsG692?cmYdnpxnY|92U0AhFM)`!}`>Jw<}rUp4xR|vRXl!)f=vGYg~#wC`++@
ztvW*O@WTm2z~RL32m(zHFMv>p|3gK+uO;e83Rao|#zw3jcJH*^5lt^{-TaZjwxWWf
z@)S95Un%q?>(m-}%U#!Y+kXKhP&l64^ww?y;dNZR3n1y?nx29Jg!O79N<Ymx<IAWd
zdx})lk`(LRboq04iUPs)rU2d~g7LH(27C{sV!f>1UW!87#N$cX<zk88CgMF&an2;>
z(${~n%Mcy~EYaG2wUG$+2zdx&kCQY>_DU`i!PL0p$GR0frBJlgh>&5g&on#96bMnM
zKv|}}GDriYFLU^c69b6K4!ZLN;nohuaWx)~>a`_atqbSR%HqnnI$U0#V6ApF?R937
zr-sqs-p=oQJ*o&uM1TG{iYO4U7jqvIlG-2<2)|g`)N!dU4d=<wmV+r=7s%ecAU_`A
z{S6r5f-h+L0ojEH1l35bD_a&Gd6%ayeDL)Vee9lWTH!D%c=yTh5B=>WLGll<JMes+
zA<L7@i7a|Rn=y*)LTdi#@p+M?+ow*K;aR@TH1R8hqnr8T*Tll4^}A0lSYFV2y}H=;
z7ZW4VhhRyf(aW|4Bnf`VR_lrnzf5>f^M;sL9*=fpOSY^r<$L}0a=t?z0siSUC=ICv
zn34j#kmDX>TP~oR07A(&in>}(;v_$2n`SXttNiM`X}^xP*(wDb7OC1^pv7YS3BK;<
z`Mcu*m5{xatC3z=t?y`bzPw?Q`RbBVSJ!(fxv(y+#dH~ua5J6X16B+`IVwZ~<4U)^
z1?5Q-%BQP|<xS75?iKQtXK<j;JYv`IqY-owDEV+7TwrNNzXs~wzZiki1~Pf$x@y^=
z{H-JeP@A)8ra@qi-)f7K2R()BOKjNG2d_MlzA0V#iMjZB<mNVFA)Yczks-noJ0&R-
z5-iby%#Xx<4z=lS5gZ#62cG%5x9Tl#e8PG7f2rq6Q7M8q0C!6ySq8}G5dg#m04|ir
z_t4gb;8ut>Y^V%3Y>2STF4`W`1<0@mT&ikPsp^L{VmQBUFkG7+h^g}YL*-q&0N0Bi
z(CurwwzVQnXrH?^X+INrMRc?(osGA(#5{Gkgq^c5m3}J|xN?d_FcQ&(#M`46$D^DW
zNb>%K+&e@C<*Y_53#%7fbJ}CFDL?D&O5tCXucbepWXAVwK0g&B`k|Rtcur$A^-eU%
zSL?E^TRszpx1K{aUYmrdOtd6C0>IQQ<3eZdU6TiUPTUj}I8h+EI1y}icL>AX6p4Bt
zZQBW`TB+@dy_&_hB^_^G!<QA3cRmTB)4=DJp_->9+AjI<&Ksl@f^ioT`&ZO;!f~86
zVgm2SzG^Y0tg<vY$eMjQ%OFJPN|TM3%4nkf&j?_3!4brOg~DeQ4!fi&10*f0o4x?R
z70QZBUS{BNzwiq0l4M2~4t*y1v~CR>U)wDGr-d+szd`{1+Cu&_RKtHLIpEuWr_Y1)
zAOx>Uv>C|b?F5>crZ2ONd~k?(yOLnSy$KO4@?Im5Sv#eVc^#9?sw#o=2Pq^b0kv!&
zLJ%rI8YQfnP5)#IAWZewK(#-Jyz1i}x5<`q4|KC)ZVGs_U^IUY?Ha39{Q7t=+#7&w
z#sX%m&KtzJghTDrRpxfiGRJcbFxKvm9lKYRT!igK+^+CP4L8)Cl(=_<ZVtecoHPiq
zKF2VfZ*sFM1IVu5WsMizF0K0ftf%JBeQPAdf)VrFlS(a9VKwPYU5yzp?tVIOrM*I*
zIgA)!<L4?S5V*2MhSy1W<3N!x0jNE$_9aCe#{D&oG~OHh%rWa=;%w88t|_~F!sZRp
zQROrsxf@<7a6C0G3>fuytw`v_Srg|{Ww}j0|6ny>Xw3-~W>?pzLM0ZwlHXq`QcF?g
zlm(R5!C61s)ISoeRX9s^7IPHMR!#1wXW|J5W&4YTN9&wuCuRZ|8P3ty>Q;_L#6N|=
z@AwN%OWT`7%}dCu^!iBO)E<^y+8?vIv7Np9lL)A;)F#Pb)g(XMm;5_K8OnQ~0|PdD
z4=!O|XR75WWJY?pw+GgD+LbH!aO;QW_AkB^^-NEzWE`U-G8eB>y|1U0^UDr7q11RV
zx4T31b|BhxzXxMMecnIcH{=4EYlVTdvyBaAf2e}az%v8J?Qq&|rYRscvfoGV9J#(N
zRwt*eZ#%zlNgD|+GA!dH4kY*3^5rtpL!NnG$Dx05|L_4c75Lho>mR+@7r`x_#x~W<
z9m~p1``*I%L@5kF^*V|sB2&pGA4ta7z(J+f#POga2Wj)3&;6cKy8bMCT})psui>8Z
zh($HJ>z)?38x#P*$!y#>XRBAUlK_!<BfIPto3nLa)OF!Uk&h+R+%z-kJ0&l_oqTQi
zTZ2M>PwIvLbmcg6@oNVzctnV+kGe*Am~Hv|NorQ73jz5O<{1<&+=n`bKiSA~kG02h
zHhi_1z5Xs*#C$Bjb0yJ`=|Pl%8s`XPt`ETl=xb2yKQQoUs4I6&!?4MDW@9-Qzo1r|
zx5dtH^+PZ1r>a}057=Hs{|w%uxO2+#9c8-S%e%s?FKcpgWbLV47t)z!qP006Xfs4n
zK#=MPZRpw*veictN{(%ZOQpw~FQ%?J(w<X@)tuU9Ea1llspwWf<2DYMIocJ88Uv_x
zcv8DqB_9ZXk;~gX#4Q`6@->BR9>eoV#|dUuo@yTa+G#G#bEl$)@8z})T$%S<NVc?1
zdrL`ruubB=k55S5v4D(%sx8}N-ArH@%o`q@FL}}CJyZ`!#vaF9%{Xl)iuGkVfg05o
zj^5tPvgoiDkA0kpSkQC9+pn+?BjRwi44zslgv08q8P#_EKuae6kz152Q?k`38=>gv
zQ7)RY(pm;E${ziGJQdyxOl^*S&&3x<ZD8$vt}6pHc|(-#?etr`%1^lkZGC=qEsh4|
zago~4ESJa%;ACE|G7&;y<Ck{tW_|c@?6)uPTCXvcDe}dheaz}PFZ<kz6IVf;!yF<Q
zd^%NhW!6@>+HR*y2-kf{$4uI`zjS^Q?<Q3DRU=}5^f<J};OG(YJsb|@t|lejC1%d0
z__)pa_1SO-`?-h~`C3S~S8&?1(nR(J<VZ{98%)j(gITqo0G3W>s0|E_hdpTdf|zJ}
zZ&D@gEBA2f`0(WJr(#J#eH+oZThz67MA{Vi081P}HM-qCv}AsVk#?r0w&-q>qTZM5
z2Wvq=C|vBXfG7jHqzjv+69D0`&q<sZlGw?yqX?ODY$I|Wy~R4Zn5ORij2`=DcSkr`
zp6UX9V_@Em(@$EAWDR0)CHlQrxW$geHx&W1`7N6ev-yN8wy#Ge4L;HERk|7jJAf$a
zA*p;bi@8)UgkS{E7J?brbtYN2zC<Bom33L0zD&uucZB>1Xg<DHZ1_b|*VoK4S%u{<
zOkd-PyC;IH;fA6iaU?{yKc}oT+?%I<QjWcMDAoNy)wB_-fAHFGS*Z6hE6c@apIVM*
zIME1BV42r`33T<9!?c-6H5BZo6C!#1!rL;`X!vtyC#LF)lKmXfQS)OL6r&wYqqP*t
z3V@rg_m`G9#KkEJ#=KZk?H_dYyIx&0Po}%knT99%eO1)^-=d5!Y<{qq+W-yhFS>U-
z$$TS=m65rLvV~>at#OGB53&sE^Cp4>RE*OE#urvRdWJ!l!Dp|H-}wn!yzfLJ5{5BH
z&BP=O9PaY%aQV#21o%$40%~VGE9?VWA@qlo0#W?>fEM^Uw5a7+hV#d9Pm3lD4U5f*
zOYT&L%tPvE3ua7uJSS{V(`RJ*K9>#qpNu?w<)87*hNhgd46b*p_~_9ZlpS9NQ63bE
z;={Q-Ym#4Dl5BWt^7Q_&QN%+Yqtk`!uWBxEMs3bbH*Tg74Z73Frl!$Tjtx%Yxh6h#
zQXvU5q7AlZ?-Gaf2QH_ck8Y!S_mH0rYC&*C_H9vE7FU#3#2cnEtn!wx1RGXAel<{a
z@S^U)Cydc@)P-w$QcQ>HQn(KY-~EM2;~DFjpmTxc@9deK93>BKD2~b0d$xE)f^(xD
zP^o96dVkLcLGKU%weeX;@@=B)en!E9w5e#H;Z#b7dXYkWFW1>mYr$$;_eN|qTJ3&i
z^uQYTyK4ENIt?U0jN>Dm*|ai)TXSPe>JV<1W863SKu=&ohmX_J<%_^emdsTBP*5U*
zuU!nF+tEU=)e)OYF*n?XothFiW&$g-8)wfBRW-r9Jjm5m{H~d)E2qp_*4$cyMeTFg
z@_qyjl!q`0sYNzFLoJx7+w}-FXKmQ}iVhl1UbmXBe~7y-SoUQ<2Ha5IQ=7~?vl`Pb
z9~$J2Wfa#N0Tw_{<(SP^_cUh`T^+a56)fL9cIUZRrIGj37%WCY9L=2Oles_cIDw{r
zhP9>G_s%ISf^8S(9hOY!(?3k!#jwW2K)W=1Zlzz6z4J*hqXr5kc^5%7CbcAG*2l^*
z9f7xJLwJKS`*#fMC0wtHo0phJ>MRv|qR|s>QhDQgKq}$Yi1}G<9)SN`ErpbLrs-E@
z9K;_xZqx=hIUP0}Oo|fZJe_3PFzrA(Ni9Z5L`;JjBG@5$EN3CH+ds^R`~=3@UA*K_
z*vT8T*cl@(&WDk>$b0@{*K~?Ace%A<OKXHN<9*tHWup1!<5p=MI#%Enzlylid1O`t
z+1uGG4J0cojD%g)_;Et7bZS<B9;uX=)0`55$-@qw5VSxUF56O>a$LS^^~T`rxyNZo
z1=7JEGa?yo#87!n&JE^q1J)*LNV(ILl6a8Rsp5&RIo<n^3eRS1Ynyb{<p(uaQ|`+w
z`a7i4ThNBd^@EdP7dp?ABIMY~1~XH}jV*6|@ZY3{Z;b3JT#3EZtC{lRo%nVBcjtqh
z1ExOIvXhKXZj#kWQ~niO6xOis$^tx(!rA~ALl|E?F87M+q5_rG(K}Ytd;U)0IJre*
zG<Ou#r~>ln*t&hXCQxkQqjA~RvFhwB{g*E}7au!zT#|TnL5Jt;nGqYU>e5;eDT#=~
zxc4B=dv?kb^BS6(co%QyJTu_Wa9C*{;$c6>b~m+;)xSBF^l_B|;lUCM<`tfCAy|=n
z&Aufv>zZ~nr;q)f8#!B;&T#9KH5DdSr<-S#OJLlys8c!j=;-t<CP*0En!X~D!#Diq
zaHpyHlWQgh<o(K^NoM3_O{i4tNeM3==7B(Q-y$g!hRunh$?3~p&A&~4&L&B7-Cwos
z=(FB1<P8;~WoKV!a0{Y+7UGhl_Mj$Q!Wb+WF$QYbjMGy7Zb$c4(y2DFeDX>sLd>|W
zq3(y3naSFyWawR0#8;Xo17RWFW+LNJFNu>d*LS?aGW*lJa@p9>?05QBlPWiHYddV&
z=!^m~btk>|%U>_!pR}Cot$(NnYGYP-Np4!#wpXq+nVvH`8^Q)IR1g`IV~fwEb`KV#
zzUVuC>Fae8>c>&dq?Q<E0znIvBeXdn>ZkTy=WHA&_o^R%&a$*Obp0Iq=q=5q#Z8Ze
zdl&ff&H<515h=h6c{UDPi_*rfBEd<N3qWYXbxpov2#ZC1Q^SkHB&pBD<=gm_gAabM
zkxTD3QJsZx1FB%EPIfQ^i35md^a+5#_x{+7^C#n{bxXtitjIOHs0$+gSx9IettxBF
zp(y7Mxfj~r<1fH$?e0Ek@CEPtDFzl7Pyx%f<KBKBs=yGGiGt)1-GyrrPoOQ;`AMLL
z)gII6=lJp%O<S11f9;CSQR7s@j!|t*)--!rsBnz^<4}6q_`g=4n4zA{Zx<W80a@UC
zG&pgErHQy7*$8Pgx$s?UVNRm17&EE&l!u39#hNO$<D4=&>BNsRt_X?uP*Lw+|A|=S
zHdTM$^gcx8O|vgnIeuBhl|lL@lS0RjRF8Vbd<SzdJ=E;901e#wwsxL^N^^TMP+{$t
zf{=#qkHTVGrdNKtzz3s5JRiR<+vAQb0G`BJ_ir$-{HPUSl6@8Q;ndGigSd7L?S;l$
zNA)tJue;N1uQs25OdC>hojy7(NA1=ounq4cabN-4iI~SAmL;xJ=rfTnZ=TLxZPqba
zKlp3Go`Jwjm-CX1KsDtXf?iXO2%>NrBtlKSiy)Z=u~>1rH;V=e_Y8IT52!iRB=x&a
z>c8<yYXC1ZWdRYh@48aY&aJWiEVuY~1dabPKi9vy#{OZ*a@XcRJY;bK=tt#Rk^ev|
zA%8e61{#5Y1Gy`|VH&_(0x~bbw^-&7hp8)*jn(v4fpOyx`pn}}a*Q8)B<e6coGM8q
zt{YcAfdg}%*bJb@Qwf`B`MyfJsQt?sTzd%gSLn$~`D9LeO3JwYAF8gxKUBl#!6Z*@
zl4SEKUmj4`ztH_dmBsn{6lihXg!LN1x~+iu(9)qF`8<gHshGlRN;zNshf0657={Mw
zqxF~w1Ta^41tLts2v&Z-RsVvVp8=Yr(h@KXpk_vYTs`!Cu1cY0p**nJ`3bZ_sDUo1
zD4-s(0R-Ct69|Gh?4Sq!PY&P@)!&Z*Xdzi4{`Ck-|Jiv>|I2x0lR3fv_Pn(J@d!@;
zegtB`5di(ze?5Zie|BO(Bkr#g0~4%Z|K`NR|Jf1z&z1e3E6WK4e*Dip`~UQ9P^(D<
z_sA_Gk2Z*LQSBNhh9t2&K$z=zFK?B4Rv{Djok^!RpFd0LH*-r*D#=a^j3g#>q;9O6
z?s5J-*oJ>XpOy;tXX3wDHEPU$k;^4gO=NBab+!%_F)b)!oW+*Ate_mN8T!)Ti6PjD
z4UYC+Y!AgK6IY{^Yw3(WEN#i}1b<!_401E~y^`vR+E7Vz)a4YRX~3!RqvwVR^~dsz
zlssS!n1ttH=JtS>S1s^<pM=8^Ze*wrX#zKnO56=aY2Kx96AFE8PSi(#1O*AgHaGk;
zwU;jK^>n6?ei6!saW*}sfW4;G`64Q_MJ2<Xj`1t}t)IB_(CakIwP*BqcC`2*^u4Q$
zP{u-lkyz!!m04hi^rj<oKaJi<8;WFXb6tw0esqui4&Hk^cl!5P`2WY=dqzdoEo-A~
zK#&ZQv*a8kBhV(YfP!S9l^i6e1{zvHaz+KoB2l7bkW7=K<Q%#Y5fJDmHqf+pz31$3
z_Sx@#9rqjGxWDdS##r=Pv*xU-Syj*Tq{D5*qJ3BBgD5snmbvu_qZO5e(?nZb5Ki5n
zjM)YC1{a1v8gboG$I^%I{0Kwvq)^xPwi}98Kr^%6_mTEmcC|*4!}*(^5XU<6Y=_v(
zgeI&&|7^q{&Wt%ydi(G_*EikRlsbRH9Wu0Mm;cbFUBRnT)7qgtZUL#v?)4J+Rl1HI
zT{-Es6&7!8NkFI^=I4t%Z>VJs<U`h#(N5Ow^27<)KI@AaOkjAaBeXY44b?|j+!|kb
zfU!++E}2!oFGc@YxN?`3e3~$E_NY{Z0_lo~C$slmX8H<~E}Y%;Pm}WX88iD3hh+7s
z8jv^$CMW-iu`qy<e*gAntO-x2d?JX-P-dgC<JTC;c&cDhC@XZ*l5SXU7Zl#!$~&>A
zcm*8|G%$M2sd=Hg;i|7HRM>H~l`XGJsS_6w5)jXK>|RWx)h0E%b8V~OE(c2ouQnnl
z0q-Ijg60wjQJ&cR`P+P_+mO6*s4n6L)D5d_&O3F;MO1%&J(R3INrCTOY*S!m)Egai
zZ@5$}fuczMrq6VmqWzdi#$!&ih{dD<t}8CrxfA0&fu4{}Q(gW9W&+Z_2avlx+w8fO
zw_w2BauTBdw6!EN@7%01(F#M~ZkoBATDaMI^K;XeY1zOyeiyF9jX7q`1zHV0qWt*J
z6_KqV7%4!1ev5+539o?u#?*pi6Q0}|H!;2QK%LXAO^CnU)@q_9FdW$yl1&U_1=xW*
zRgjSD4rzvkVV6<!({kS)t&!5a+6R_WB5nH+Oa=`=NSNP8F3GHD#~u5A$#g~;zpkgY
zf|b*dHa)Y6=ezvHCd`|M-ateQApc8UMIOvU6%0PDA7nf|4cy+ZwOznkOgnu#)kg+e
zoJ}0xaRotNTq=RCbW__WCx*?tOC|0y;x|ED0n+~92z^v|=Ssv1Da?0mhhA&UON#(P
zEV)_lF~l^D;x&HVd8fhnIOVFh(5U12Krb+a)FN&ynu*L*m~}9sHlO$NsT7;r<pC*H
zB7=;cT{HG@Hw(H6EWM&xA;18OEqquvRa#%#sxql174UW4%qjR5#r>y=1K&Qj?C2Tp
z6ttxtdSlOCmuM8rzFvO}z-Z`O8@;CIRYdkaomQ`kk#FT5JCC>WLoL}QyTBBRcRy_<
z@NY{OHE`}<hJV43W}n<GCm-qDMp676#&C7DG6!o#?BJ|K>nfd3=NE3KdysB8YBYv_
zP=0rY_y{#a1Tl>-+(#d$I2UY=jLX;8M{>TdDHPS@zap%w=xKnHTx}zQ-s&_L>ogU~
zinY6)${jX-HB8n6Bs}o)vO35%<ygx>XwwO7W(rKPTFyiy#uPt!lAcnd52T4H>8ahg
zJtyxM*on23E+=z+1W?t?MUSFbhbvo~CPe79Y8u1)lW#{xCgw*wqzn-+n0*I<F0s`p
z1|oGsmqjnirI{(B&~w8DD#&P)oAlLw5~nNnZbZ)gZ)&n6A;z133>Z^6nEt>hr?2h^
zE*Kac(0#wHo~+_I^)?h4=O4q=hJu8$lfvvi!Cyd|I@2twgQzSI_Cz?d%%hV^8YeSI
zGbsG03yAY}*X@dZrsp9Ca^e{VuMzv5!5MlnYeS7sW+bCcOCZS$^}a#j!|XJQJm~OF
zpwr(KP4U{@7~!mxo$ghqf4bWL&Oqd#m7I`OC>r=yFe$eB7>ce3;I~`ij?4TQDJJO*
z8J{ZQ@!ro5#+zSVpDm*KRwoW;I_Cqh*623X@mf|A4RltDU7_PviJvQ3h6e3G#S-<$
zB67kP-^-zP$O^>DwTCmxROso<T+R02W1q@9U2M7h9}aY&0t1^Syrnx^$LB-nW`nT2
zHTi?d48Z{PM(L9EsHY=4Kh`F^^T(#=I-P&6)+@fxH2|ZjqSjk)LVe9KuEEl6WKcWv
z6a-Uwz7x01d<Ipdb<MjlI)i&pBp?st%Y2>~7017H+1&uBGnHwuqsR6$*<C9PL6mBk
zxI624n79;o-jb5y%f?c5Od)i7EpU&42)V0StsUogU~Jfwb4?R01eF574g%XcWtm`-
z{j0;zE2K)y?^-YMZsyf_y|cD?Rv=(x`^5TH+6BeOlJ{}?DBZb<-YjNxPpvZ=@(3&D
zhYp7{MBR%dtMOGZn61|v($}kJNDK~!LkU0FN@K)g_l|&M`v8!(2(6(H2&jl)<Eu<T
zypXjNVYYzZ!WLdg*6q*Ao<yc#E^2x=p9bZi0jO?$bg3e|80z1-*ERn{l|);|%zk-)
znX5^Frd#VHZl|3C);l?&M?x{NicUd5h#eG&7tMa0$-HqT2rZoFF;27!7Ek<O$8n=l
zx$x>tFZlCDWV4*2#9E7dt&?t@1#|-feSZER=tc4VCqtE`#t<KlXU7$vajxitb~yFn
z`$LL|AhypKnRL=Yx8(WQ8sA5yeWlSH8U}C0jh>O;y2RDu2B_qw!|g_|Z~FxCpnDOn
z<eLh0Stu>1CUenwMx=YYbs`sOVb+In-Mh1ZRn#!Pi0rFS*|oS>jFVpF#8I>u-F6BS
z&S*DMcsi*k?=}~1T#bX;nO#Oh?i``q4RoH4DyLt-t=q2lmgXg%e)1Hl>d)+)*I3Hk
zo()NWUS)}^-NoO+UP7y(*jm`5V4kby%;r-l;*VSV1B?ZN*<O;jk~#ve^|6*ra|DwZ
zbJf+xJ`bZMig+nlT-5%E5MZaioSu-ROaSzyO^{_`2xU1eyx1{$I*5A$=Tt772HVf`
z<r{sg!DtM?5ZlprwurXK-0QOGV6GV1UI3pll8dn%MDm5>S+`CUJZ8Hc9B1D2+7qX5
zesB6#nsez+anMszv~1u^06GAvT)4&zk4Os-sfo^}F;(a%|HKnR7QkH8Zj+JYc4w8+
zNvI1B!e7TCy4|tc-4@rzYF#N+K9?O$y}dR19`iZbMqc1mO-AAZjX6PlDttBFmue9|
zB;$FPOM}Eop+7PcR%IpYV#E)+-f{i`q;TmGyaU{9ge-vvS0G8s45wK=2D?nZ-J0#c
z#WSEjQ>95iV9CzIK-GIxQHPU2ijhEtw4Iqd&QuDbpB-qqJ*y7oh#0<2pR64LTKuUc
z(WCKghEJ>m5^?|?5sRq8@~OgUI>a*BieGS?I}QfRMjpG81*>|dvDCB1kMbXi0LW_R
ziWo`@*uyu-p0ZD-n>QR{rjM%vn;x2Zs~TJUWFaavS}gLjN>VTYN5Y9pVeIF^_^}%>
zCCoYQ-ej}NEsL%1mt3yWOO(2L<TwWz_&pOGk@$Kg>Vgw!OmvEcuFyWK2Y7ms=CWOp
z_8PBO%+w?wn0<<UPxtT_s7l2iD~s%Xsmx}tiv$MRd=PiXd2H=!tLoy2%rgjVz3yD0
z23^faQWzT&)jxnAmtjsiDX4G)SSqX43tioow6(5f<`m7Ssj+1t^*OqSoEaZO1@kDy
zp%u<R5h4tljqm{kf#P7Y-o>Vf5_7deMZ@@8B#|_ZGF|UtGP^)|-^hDf79L)tw%KJe
zZD|2I0&U?t<va~hKfgHCtwydoWBS_o2Ks)1Zte6iCl0$pXI6bXvLl&F{r9@qul#7`
zo_rp2FGV5tHNC#@vm{Ezh%SEa47(PVK4HJT2$%+Pg*s?(nIBHEmHZ`b9;>-4A6wHe
z4urAl_dCw7k(ILt5HgtN*kO|{mWMuke0f^x$#~7}d}g&9ix&6x8-P~OP@KkI!`aMc
zMQAG}P7tjc{t0W<(Mmb)rOjnZDpn?3niEX&VROAclf{vCKU-jtT#Z%mVgmsQ{}LaJ
z!n(teWeOXe3B5D|`5I0)j7!}p$2eYAB-0WH=Q3O+eUwM1{NSQu^-a4kpv}<c$gEfb
zpiy(`rdicQK5k*_8bmrqdTrW&T&eacU76GSzF{^VB!ZuzKTd)?g|0nnPSJc#v8){X
zk?XDllY4@-waqH5<8jl>k^+FiQ3RvP$oCM+JQL1G=A37eWZn5dazfqXpWCxqB34Or
zaRqTkAL``<CWqSThG>r0{Fr8TGBciLxEUL?rN#s*&i#BjMJAcG7EIsljp6Ffz5%z2
zg`;}o@Zz&3cTvpDMItz^0^_+-!SAYJBwWoc9j<TX-Dp1I+7p^a$FpnhrB`5izq$AI
zp0u)leVaIWc^VOQHV&T4J@$__ob;Z=x_=04Gm5h>|E}OgP@wfr;8vXxL!t)7#j4-1
zKX2ixE`gH;4cpbJLm}oBa^c7Kq&CaelD?{tlRA9+JXb3do6Eq!P&gE7sZ037R5=7G
zLUDiWC#vT2gfmCfGQ(HF2aya0#Gv-}LqJEtX^#eLs~ZUiA>)mz?IxN%U(9HVa`A#f
zNNt#_-Yc@sb_WHkF{v<hQ@?(2>B*&+pjD6%qSkdT{Mdcw$ZW~?Db@<vbfKn~rm<UY
zH(q9)=9h0dvVU7uOHzV6NrN}ZKQ^}??g)-e8x55LRzA%Lk?E^F-iB0|2}@q)YEa)3
zk(!<6v-2i+ZL8X$ve-_MuDl}qL;tA>etCu5OKT<48N;qu`&Bx=X87B}JrOzsLv>F_
znap*q9ZSts|Ct{zvabeFXskX)cQn)IQ4obY7-^dE8}?iKh>m;?B`P(Eb^);@d1|8z
z0n&(&EP}>~Js9(98N2G2@z<T>PG<a;$?P>RdFMEbo>>#iX5eNSho!lB<C6hUgUGE;
zT}J$b?C53b?$PMNy2OFlQBohusvM<BMwVCjv7_=_{Pi=FHtQ84wRxdT4=L7QwUTAd
zS3hY$LR-V^oouvd+<a|MXzskj{`SnZy+_cS>hrtEgqz8hAN=AT-%Eax0TR?Dg&HB0
ziN~IyS6%~o0=;IP1Cx-JoE{NXL1KPFsr}{P{o9hyJi6ZW=Y5lk2Wp6`nHIw6uNP^}
z(nv;WvnMmcqDMl0r54s^MeFo>eUCcTVWILpg1XV{<a`r&X>9ZwVTW$C0yw1Emp9wh
zrpzI2yu;m2N`kYQd4Eu(?va2fZ3oNC+ZSf^fKNt4$CSA`Rx_Evv}#-fUy5h%)R%Ba
zJzmtgF+@7hbt5A|ea}Q$?jkGb8tmaT9QlU}eI*qLe<E1qQvMT_<nw^Rz>dq4pM`)s
zM*sUXsxF)z(D|{SZdHOYR$@*fYWk#FRLaYDc<It(OZS`w?kf^h`N$vfeJATLk4DM@
zm)VUq-3XXDGX846*U2(bvy4JS!^_T(Hc9I7$z7RiUfO-f6($p2=3vAZ7E|`nQs={M
zE&gUet~Hm+tP6DdgcC&T`9tV?+nms`TlTRJ+OWg{#j48c+MUHS$vY|Se2><~B+utI
zt?$cOP!g0~l1;!~Nw-9(7j6%Zpl>5lzK$J5k!Kbblz4u0n9yZy{!pVcJ5O3HFH!ER
zE;kU;w{6k;$lP=RVmfRSK>gHgkxPx+gWuZAJ<L$Q<0=cKf0Vi%N)|v^QcwZYJ=J@!
zVY+|_kqlmB5@!VexYY4scFv^RB}uAs<XqDwli<s`R#M{&p-WB9f!>(CM*vpo{3(tQ
z1Md>hTj`9pDVaBWx`=UdEq$2yKDr4OvHRf#AG_D;QAM6t8*uu(#;jVxwXjaebFayV
z&Tb_I3n*PdmDEcF6xTURiheL$zUDN6Gg=)b!fxMBK`2X&l^!ke!dz=wUWsxzx7>;&
z#w<jYTWd$j1PP&iBP#X)kowlKLRh7fV};;?Hp_S~P3UWzW9oa!grFn&ZkW<JA$9?|
z^196~6()-swnV65L_><UoKW_zg>j72=YLSwM-o}JxZP)2cT+0)2^{qmq9A%0fAH1{
zvLdu*k1QW!*l<qv<({n&pf?y(C)uORT9S={|J*@y^`4#Jc$B5l*CNXte}P1|n@Sk0
zQ;#o}ej14qKAWQ{uVcjM?nv0507QY{jzDk4XNt7QrWSg=5RK{Fu<K>0N$%N!D3?p2
zruLezUC1wiX3B7)Slt}^6*e(E*D?;Gtbl>FvL$y0h$KI*tUSo|N>-`uxL7D6R>yPR
zo|(?#M*}@cXXF}Ei~;EXOh?^|ue31hm2S9x;?5kL>-vKHwvogtBp7}@h>m9)CWQ`5
zMK<mw<N=raUectvjwRLapu?*Z-@gh6y$BjrR>G>}1$9Aa4g&-9Cw9a>e8Jq?GCb&u
z7Jjp+*k)_R%sOH!N&N|QvFNk*Bb#KCjk^xW23-1cx5Wp%Ay^~X$_Nv)Vd8nO)`tN)
zI!H!?-lv$jsQ>^)k<d(q+zbEmkevxek+aPvI)21zh!SdaMmBqeZ9K~QzIffl!zb@$
zs66qK{P$Mm{@OmSEZ0_|p2cc{?XBiL_0x)D9ZdFX+<i0&aw#mbbZ*6b;fIU{w}ei-
zpcIv`$F)1YWToOBauvV?zb%;9$ya8D`cUNl+6^p8mpHWW34VUOu=ca>n_;fO%w^2O
zBsFdrxhAQMLIyq?3Rwkie^;?_a0VzK03{P%zNCuL3bc7n&@z<RH!u<_Y|l_~>k~%?
zHDSITbZ?cSLo9MW!+)hq?20{}W76tT@b~=@0oz%Hn;uP3K<1^x|DA+Ao&AO~J5&rw
z(JmHTryv&98-r(p!cjc$mUD~x*ITO0nCneKPEBHZS+X4K+5Mu9q<_Ncn*rbm6@Cc}
zD#J+>nL3)*W)@V<RGALEp{-9_OgHekr?za8dRK`&;NT<;21W}9QGh9|&=<kj=Q&QE
z`O)_HuIE-sS*lCv8uC2~2T$R^w2K|!=9USXK2IvLt}4;1HI08ubJEx;eI94e-Eb$V
z#)Dunf9zf*;X6Q}=Crf-`$;gK0YAb{1$Nk*r_+tEGu2*9X6nh1I{360?eS6F=AgN`
zFTJ`}*1MOjb_>v33=5*fiXGp;xP+j?m>FOqPJsmy@w)GIL5W9NhHqU+aan89$FdP^
z0LpIey!&iwB?1@|SV7FUmIUE#x|fzyoTc_#L5sVXWT3jr+njwIa*_U1dUOr}0f?7`
z5dMa*cnkdsmw57P+>K4E?*_Okj&w?qH1tw!Fv?wybADtD3^=oQuTbFZ^6(?3x(Jbb
zqmQNwFgo$x`D!+t07E?GLfbqukuSGns6j`sT;C~lD~QRdl?@%g(~TJbv##7NaP)79
z3-`>|_T%iVcBnK}O^PtRcgY}C-K}s>h{ap_$Sy>g0LF%9YY~ga@vW9|sbUDmX|vA8
zNB9e!vA4*!KD_L*sf@|e(YA-(1={S{sJ1!Xt_q^fEFLG8Qwq2f%O0iDJ;}>=l-lK#
zx<#$&z{<*0rdzH2070I?7MMg<CKJVK*F}h^aG^+%Dj4EUGNbA+%Jvy=zR|Z0d4L}T
z7=)AwJI*Ds)XNC7@lvU6ZH4g>CzFjRnJDyg?kM&5A>UK06I8WW4${tmX?nJ=FoE28
zfUbziyY)@}?1wlKGvj0i%ey!MAoWuYZmwH9cEu9-qNXrQqlhJPT}t83wVi@a_S>U`
zoO%m>32gVX-}`_4MyE*s=yP=waJs|oPg1Caljfk8H<7lCvwN@zlR)xmq3nBVo=?LO
zVvIi^q^%-BldVG2J1#C>!{8@l1<CUROXY>B8@1L#EJB0Tm7wEYbw=rvRCIReXyi;!
zp+>DThnBvzGzE|Hq=*UP{ey;;_2f%+8;lz?4i?nt*6<R?FUPTY^Rru~+r7Lwo}>aS
zGp@utu?60sMip)WOE(3*@2v3yOORDa7d*aIFuVssgl9yYD}C^G#cGJU*wjwDa1zQf
z*@Wa-DVgwDmQ5-{+3&+_Fgh8+UTrU#;yahr*4m;=y$0{PdwSZD)xPqLAC#4)-(MG5
zw!PQ&fLt=zhzsm9_J^Js)ww{>2$-Su1{TPxx-G;oGzxs-Vjpel(1z*mp76ril!e;R
z?!}ma{*e6#GS(R~;zE1={CP_~36Fu%-@j|Z|20{}{{g?mC5Tkez{<X^H^n)z768`c
zsK|5S3!7fnN)MyzCQk8DqJ3hW-EK4jt{T!)L+>6fX-0a>r|K5%KYxmU7Ig~i#j7@`
zT+C;mKR>{30Dv4hn{_Y%4%7j_fm;;+4i5Y`wBY~ue*op8^YU^0SALEE<>2^fQ^yMX
zUeL|E7#X0^tW5jn@n<yI<b2>;fN!5jI(@--a8ZSbsy>;^xrk+Vv6q2CdId&{t;~VB
zVy$vu57CFtuCAr`OttKujhim2_Q<b#NF>Lp*zjGE>syU-CK%QK7**!yeyk<GJFvUY
zW!L*~hq0Sis{Cg(O)X0K8g|rm4H8_9vx?UUP|vAtYdoiVf1Ap3TmT}@&kjzRab?`I
zxa)Lojdg>Dx6g}Kd>DLA82e)N%lYF*LoMAJEpGmD88U<iX`Sk&&0fW%UcD&o!NB;O
zoX*rxjmc02Bd-NLBU7n#r$C<oNZ+|k)IOXFr(cgg>DDEIi3Q4Uq;wsh_>y>W6Mv3=
zbX^ZnaGKjrj9LYXZt<oUqtQoj0stEF5HI@$y-idr6kn(I+~I1MUB8L7+6qUnAgE)l
zNZPYoKX&(Qq5K@LCc_?%@%DTAJU3o?A?j(pdy{ist>ILeZr-L-yL5aUeHQz;B1u3w
z)^J0o6_Z??_9WSJsD$Tje4A*O0JT_ukIXkp=%zV<v*PPstzd+Tb?iF~`z%W|rA^sV
zzox@KRMqa*%slOpNYvdHuiaa~%!VhT8sGX!!-gGeAGOI^BnP#K`sdRgr1ZMZ18qR|
zfSlQ<KlZovww7NcMc7cKo7tz*46T+}Q{%i?SQ2%x+vg8{tXwHmlrCCv@Nhh~;7pwu
z4t|vN@bPOa4gxdyz$u6-!@DR;=B;02K6>v!0f2bNm;DTU$9qvB%Ufb$ezxg)8<KNq
zAOc<Ka*gq~dszl!4|KKl4sc~~^znyLtMIF+G;>+cAzYqPx=Cc4c4PK>&RYn39MCgB
zLnw4t(E;_Y{@lE~SwBC&C66%FVVB#G*o@15J`j_bmL-_s>RZ2M71k#Ktm)0X^4)pO
zv9Y=Z4erCH%DqXWml~MDr{h8N(DYus7}|U}v<PaRYCBPo$!goKN<q+BJ`)q(vlEh_
zdV5AP2j+%FRLnWdm!))U=RW_WMv57}D07bIeZ~lJO{Q3q?=?+{DM$lMj*CSi<oZ?h
zYxHzxJcEs@{AGodnEam}vPS}E9*&gCn&`4%Z^rjycr)w!8n1@h5OT;rGF#tpV9TSt
zyB6-ue4G>7Tv_2zy@u^ny@cDD*&KfZfb;1i4lAOVW)Ql>*lT-T2lg`4Cq}mxEL50J
zeThnCx;bOJ=z6YrTI2$t#fmVz@DKfMCSqL&_vg1wAtvU9Dc%mA?8{M4`a9S@B=~J`
zygI<fydg1dF4W0G^0f(P=sW4E;zl!vu$ODNj;8Yoc<2^+led>VG@8tvy~_Q3k0CoM
z0Lyl)EdCUL*~W~+ZGf4@Lxu_X-upJ}aG;V3_{b1^cmo(nxh4ttwke>>G<ueeWmdMt
z4_p+r{g42fPAdTVGEMhq#e6hAM8WmqfF2M?s3=G?PI?fU`5^AP0ber7%$3&LlW*b0
zmA^nA(%P^R;b)EPr@uh@zd%>)h9GnBTKbD?QY+`*#qg3E7w^s=!@pW-{{ppI{sOH@
zALcI4^}aZ%(q&rcO&X`WL?h5KXm^FM?0(_a7mEtQ`I?eG*XM-HtBKZ6&ulbk{`^Nq
zAajs^{}H=?{K&i-W}#yo=9IDur6$u6A=>UaYzAA2M~Bw!`}(EhmPVVHC2H6Lj6S!l
z=lK*IYa}{%?j4YT(gS_HdRy4H^58!>EAXVx@#SiGIM9b~pF4p3W@&F0Zuz^E{qgz@
zt~dLck-+Q6&FQK5@kJ`jW7QB~x@JCfForwjF~+&}Vo3IJGuXDC$)C{sed?7k7}BjU
zt0DK|N&LlCU<9cn2K*1h$hG~qA(;MVh`j%{ljPs+bY^>fwK3AJF3~3T%Pq<Q_ui}S
z)5Ru^^A>prDuovJy^c3tMAJmAQ{)ox5pJuUm9U>(F99kh4Dgb~U!d$GFj@w-ev$Go
z7Lv;Tm$ilHKK}FPy8oAD|NflUe;Xd6Ye15z|F9}S#m|?NTy?cdy;yxSgIW$1|Bo#w
z4uD6weu2PS@YNTmz2{=bAA$YUll}_?14{cn4&bUbN3k<fhqjX;2+p?kZEZ_+t3J<L
z%%Wh%4Q4{n8TIwzx-ZMIf!-pa?=D)phuF6{<DU5Hp1h@2Tl@1@-udfSHYaZZ0N)QT
zasU}8OD%?L=_OeBqiLH~KjLN)8>z>y7h;>#6OuI6Xn!(=N7je{UHu@T#+H~(8N+>Z
zEw>mp2~tgyS=v4hkpE+Ru^K)Yxb?2~uy1{XZ(QgCg0EnpD~<mj$C2;Y=wD9jO!5!*
z+QJ@PhD{&*ZM18<l94`|6=_sAN&d-|E=Q>(I~jVo#>k_7`trcvx1yl+7S0^t;{t~(
z^mf6i?@O<j$Fk_P0F2W+x31f&t9B=j=`eQ4KW|sU7GSmEUsWJDhVFlE=neLNvGU)J
z=|4}<A>At!nPiv0O+jJd!<c$E6*o$S>W>3CFQ4VT^gA;Mn?AIeyp}L?jKao5dkXsH
z!5cGI^2PpPT8Uqvf9|lIzusXMbHH3F^N(L3@@D38=#1%5@;q(m^apfLA8)D%r-KP6
z`2a~m!y|P@E^Y&Ocs8Y%Sfn!LnBwz~m0_$NBSNz~>t2#QNkz}fi-xX{uC69#9m0!&
z-TiN#Dehmr;op}(^KZ^_W^Cq5-MfN*Qq$OPG8Jw<T~&QWPtW)*Zw0-}`Sb16{ny|1
ze|~ZdU-*wCikxpsK<=E3#ng}prru#4uybP%W#1}=|KR;!uBq@huIW~F=Y9<dXDa38
z0iwlAKh(D*A9x~U_IOp^SUEfAv50SxE3i9)r;Gu{H*H{(ATFN9<9>lY0oUW|@9^Ka
zAHhIZm6}jd(TW{pl-mB(@)H9){15JzW(#E&Nhl%{Y6n^-{n{(y1o0n6_5XYk$9}Vj
z>ZXqV&bVrXl`m~qa#@u@?9{vre*2})#7~D@!|{<1UWtAb3&FeMe$n4|wlh<g;$gty
z>;1RGC;uDckB={zwxa|J)E7TJD{ZGP>6cRq_Ya%UpQt5))Ek?tcsh^nStgn*TeOLD
zyD$F-ABOmi4{Hj%v6dZDyArL;gH^kRt-wiGS;3_j<0<BBwbnQuM7|CkEKK&j{DCy)
z##7%NlJk3x>{rVbX#w(4>Nh?9g>l}56Qw&j&065)VnY3vvB|KJ+kpT+_rG>~6cC4_
z|7p4^vA?$5SF8;NvZfZJsFx-d7ex6KE2bshe{<4is%(!&{rv*_J8B`=sp7^J+C2{^
zQ$;aSkCi*|Zr|lXG+*{@Pd&NO&)WX|4O0DYTc-D)e&wLzH@i`8H?c&6i@@M&5)?$9
zmsa@v)8>~_-ZibJsC^F2lrWV<4~3XdTvGob?*Gnf1?3bwq&);XOt~Pd!sS+^qM0@(
zgzr>PU3_f4WdYn~Y_pWdN^efHY2VkWHvX27XCqdq9vyba^W_|CEJ-L3jP6Rq(N+{k
z9^eCfA^zG3{5KYDO$gDSC@(LltossWmj1%8lB-0~Z?p04z{YaLpYB76-|WMQ$^Z1&
zUxkk8f^19=3O;|ktBpXKL?}R8?9Nw_qlz8Ew<Xouf<2EB&uLYEZb%=pwhXs?yYA^A
zs7?CvmV&s=vw&bZ&hXAZ^OnQlzYY+aU$ON)^kBO1P>~vA9yI*;_EKGWir_feUAqT#
zt#>vYVp3MNB$iv4{*WK53m8^K-8O^b50e@mKuRP)e;OcV;C~$-$7Q}GX9hT2<k)%B
z95?U{$4;%aZ~0zUV>jK`B?kBceg8ODGsxJ2bElQ7yqP@RL!(4>4NOVuKR9d>D*3r?
zo(Qfc#*F<}Y!>{N*qmYXzhd#<GH1rWXU-z--cAlKC%*dJ;;OPzaUGA<KJmR25Z-%n
zMB>%-IqUX&ZblQ%XFm{guQ-7J|L^Wc`ggH^{Kl5QbE)UBw=a!=<E7NhsRz#vMKw-6
z_oBQ^Lt{`k2!=dJ-mOp>5e`{2r4T0W^8W%ESpDzqI-1`0FFDhjbD{srsYd>uQ#oz=
zi2?$4as}_G*5y=eL6vMTk8pzi|H1i-{cQW=67aur&wtzz&iteP<AeWod-z`u{v&DK
z2$IJ+0$}m*o@HinsILkDG><sCV80)?xx2v>)tWD;!u9^1AM~D?>xk#8tlFc4TOX4>
zfU3=#ub1xs!{_`<n9}{tn@Z|Tdj&#<6bugOKXQfd^JvIq->=EguVppU8ox=eQ2R~h
zu>>)j9~}?(@gSw-p9iY-zfK+@nk3s?j$)x*aNB1LTFoyw4sU+}#$`CM2AIK4b~>|e
zi64VJ(NKN!#;-i|x<s-!=JRxH!mZ=qrw?D!=-_7i!=V4}fB1gme`@eDL0{|Ih`n2`
zv}duP*EeFDJyCDC9L}WQls<eOeqntuvRW#^=fiO!ew`Ui7{rZxh#8)4%!lb>UER^Z
z6t_BE1(g%FR!FO>@c=%#_#kmTR|1dG#5DTJ12^}7<Wc`4vQ)qQ&0R4!cdF)-YqnO@
zK7Dh9%?A^jf!xUt@>kFw_W)fnyx88&x^<(IBtef2Vr5HttM;S(e;yd{-yQF0MjIfM
z_&?JBzi;J#To0T!iE5Q({6sCob_LjmP~Jv*mfY5aAY8NOh+s_`K9t6DkT?HDq*L{X
z)vZhHsROR^r@lU;7L$J-SVn*2?GBskWzZ@cqk?Me?2_UnqdK~@8*pNn_L?gl)I!^+
zcb>+Ab#nT6m!>Xk^=XNjihwcCa<lD&OA$L6f9C44%>Fv-F>lUhX=bJGQ4b=?+|bKb
z3$(Yme)F6oN<R4tm8&HDy_PjuL$CiH%w&y>xs#245@u91z+F4BW7{+z_iA08vPn4L
zy@2I4LM8jZ?JC;;8P!Hfe`7&YECeHlSfOpcj$C20H!J&qVSUZ?+OWDA?htkRH94J1
zY{s=mZnNBWEj}q<>QV|AQuLa`zK$$dQTJ7*xT-9w>W;@B>HV$H@GrN#!QbrX)=X}G
z;a-r3Mnx8$1Lmp>a4n&mIuvMI%FArlE;P?N1M<_|>&{v8QW&*U4K4d?f>kB&{g+Sp
z<9_o$eFFR6eBVDd%-`>mn}54cW_|n*SzPq*-ZATsadbzq=r+cn>rlrN6niiZ{BfI&
zZmi5I`Lv?EFbu7E;AdtTC&fP)c0Z|oL(z@@sQ^$$k@%O~Vi^3_8QPhwdW*A`X4NF?
zJ?TlRfhS%BlQM)8Qk7ftPwPkXyZuO(dt{|9tK2F&63A>1`p<=uzploF<pBBDLv}|X
zVX6+7JK#;UdV1z!Nnjj|A}P{CO{=5{Tr>C@X2|v-j_gk_A8Nk|oXnmjn=+5IJ^ca*
znq|HT$8$#&#{@`lg92lX&ut2K+hEyk1i7c-BcOhvEs4?p@D;=G-_(?1<8lkP64GO3
zwuBnqMbU>&tB|%B399$)3cT5xH?RF>>OK5T!h958PM>I~22fpS^y3Kr^m9^v^Er}I
zUl)2No~l=>W|~A8u<JpK+vd~k7Q#}G8-iy0zY{5TA85j%yq@te%m1*uep}~=Y@3nN
z7B&7bB~20_4|E3&t2Gm=e}TR*1jC6Zb1w{lBGJ^p7KxOtesi7+i~jsMOZ?!URsH@R
zw=4ehbAMee{Ljz*|G)QV_WND+_5b#I8n<8rFdIE}8}~6Oks=~qsp<!zUj!1{HyG3>
zxRma?Da8r>a3z6SsiS?uosbvQVxseNclvuynX#FDAbP8QIkt9E;ve?qxcZy9Vd=#g
z`7&k0yx(@_AT~dIR&O~P`+bRQ)Y$ZsS!!~s0@`6Mxzm55&HjH;Xz(AvR6sBO{|(wz
z{$mU==-0%5Ktur}NAqo{=^XSMB*D>2808|gsVk}bqdnc0tYX@`(|y#l7To8D?|*29
z_6ZAZnx4i3ESQ9_$7^l#`Uo&J%!nr!E7tB0tH_-fjyV`CU1F_zI?Q+{s`7yZ8$;%-
zi_HGl)MeZ?tbrBU2q_k>%wqBx;MbiEEPnBA)KB0*lt<W)=bNp(V%E_Cr1J;i&x><?
zY{}|D&{`*imJV_Q8wjOBd{PUYEYtsRHMXjV<ti~~b!OT7z-UJr9niHx(=3^@4JLPS
zuK5LGg9;hcO&w~b*I9=Q#Rd<PmPY;LO6DAB7Z|<rQiDv~Zv0(lsem)*sZr9iw-o2!
zrb^TrlcpKPIE`HxY5F40r&!`s??3kiK?$!Yxe4}K)RNI(Hz|OLpm|<iM2Pi+eKj%U
zfvo{)r!(zrm#eUEP!vR1uE(d>^3lsGQ92l%`WNVd!b&yb_H(0IS#Z_6V6&|t7W7GM
zZOe_0v#u&F&yQvr^mBdhzZ>WJ-se=kAP(zb@t-O9v2qnAg4~NRg~T8F71lYktC*87
z_q~wWb}40$;PFjaE8q3ca_T$_)$mY#JT4%nf7IJOt4ZB$h?s&+*~s^*Hk#@5pDrDK
znF!R4QzTp49%aS3V(+A#?Bdjr3rbGvQ%Kj=l;l^B-^Vp1x~(lHW`tPGoHJ*((qL+9
zHz7Mvm_aeg81DIr*z(?_jO3ohYk+5!up83=^Q!*RST~hQlspX<Hq*Kp(`C)&vfAyQ
zA#<H^OUDVDejF5b(mfv^i@S~**6&crs;@u4<M5p?c=PKsb<D%Kj}PJ0Ycu6enhd6&
zQxxCLyM8Zyci|=H`4kwF>ehpr>V1pJVKw!MdAq^KD!qO(ugzC=>bJM!XZOjG8YWsf
zwm0%F5Fo%CC#j9K5m&cN5PrqJ?p&C`M&`DB3mxADA;r02mH6VCefeUnvJJjaa;F8>
zrX+OEMT^U<x-80V6bNmS0Oh?j+p=7&q}EjJj^>%`HAjtNHE+d8?i2lTTx9B7T%jM*
z{UwNY5{p1)y;}p*LAAPPW;{FGktC@uWoz-SDMH$eF_E$Ya-eU{oHZpOZ`TEmT*QK=
z+Y<X<q8u6gpL`xma*uH=IHld=;bE3(e79R++dLYIzX@IFwBX0iV3ZfS=}ePz>>P5~
zNoH$9W9lPWCgNq*BV#DzDr!g%ra#}r5L9%7N%13wtsK!iq|!o5?2p6l_B%n72n|{9
zT6Y{V(w-5ZtC2w|=xX&zuLY8YSRH4`qlU@y^71;rs!@-HjLfLqEA_PB=^#}bp~8v|
zu4~NZwig5iEwT|etJ!qt#=j$JxgYPl%y!UYt9wm1vM!gLWYsUhCQcWuW)bc_<|Grb
zs81#LOq<&5_-_k|n$_hU`RA@xP&q2ZhpwX`?XJ{1<6FvCF+It3x4_Gd<D%RYP8>(G
z<eh{hFI!>*<<Wk-AFw+Zq-C7EbQ@SFX^z+V74lp$OMNN$o(nR9knzkY55Rn6DY9e0
zy+I7v$WP`^jkj7Ek{Kx%P6J%%uD|X}+B3X;|4Iy{TTeOkeAOotwMTn@ZI67r9#4sR
z@F*~K?{NCz;@x@qwL}x{D|M>={-oxLw8pxrj&CN$hXc0&I}gX8V#xW(i~9Em++e#S
z11|3A3l=7FEp=^)2iY-rK`a7A*pVG;!Gvi|w99u?ri^1YA$U8gs3(<IO*vBRCKKbn
z49vTPg2|Po+d^=x#l098ukqNhOz{aoTA@@k8ZIbv4o)))x{OQ5p9Iy;ZnjmshCBZu
zEkz7*@{h~+TPvU_cJ!>VMXBk(6U@2l6q6WRn_7S$$>JFoE|XfijhczNSyL4!_dL>c
z!cm1f)PTL=2k3H!+mYYf@97h{^+qjeKWxn8+XJp6(bX~ZN*7zO?bRq3#j!U=Nv^rI
zG3=Lrf%?~Bz_`a}-V~tp-}@LxY+rDZ(<-N(Ppjb8JTZ2Bu~I9n!?W3QKYVFL$*CG+
z1c;BI#3KCbyPPF^OlQJfy^A>NzQpS!F}y>)GBCK$FxTS~k}wC*5mAKw0+Heb&?Sfs
zMC*-L;{rBL(UAoSgGybyAO{<t_4lg*0fv*GkL0JOlHR}p9m}DE1Jb?gM-J!mjXGYR
zCTi2P-n^?@STUY6Jzw10Ue%qiNBsir+*}o-p5F|*K4v|p%&tWYREVNq)EtyA%_UK!
zM$@`+U4M1nPc=cPq!M_l;{Pc-yC%pFcNJi-6!>|x5(7}P!u-536{r{m?fK5Ly3(;B
z^BI4$z{I*}_562KccCMr$lK70Y&g;mTZoE}j1Pgoh>!SE-=WfwI1VN^F{z8U@n&;R
zo_;^TdruCYX(`{{Q85_}ehne5*<*uuj!eKLt!z*Q!DhabB1mJ~B!PjN;Ct_>>G<0u
zgBM9zj2@!^m36xw(+Bf}(OxCycG}q&Hnrab6d$VHd)&du8vl5{<o(maPC)Nnt)02d
zX|)&8Mua0Bo9V(6qq7PLj+S4s6^)TWbe?!{Y1Jp}-CltYbC7Mfmu1i0H^9=tAgDbO
zEEjSKKy&OdEtr|HT0Lkpp=5@A4l@or34NQSifvy?@MDnPVdJ~V-myW$!<$*rx!nqd
z2xeVU4X$}I+Fbhqt;{hk+JS*2UgHF!J|&_eJUM<;226r`T#mapqp14{yU@eN8O7{W
zrvF4jsI0b;SI#o(s`}a;4Y@1aCm+uUYL%txFVd8+44!)|!Ia)~B&#7xR%IqbQ}z@q
z>fjD4^qD8sO;)tqF+LR^;Ep7&uYv2T_bNQpe<s)kW=?jT<5URsMVJO6OiK?;JC{ur
zTP+E~_&Y>e>Q-TMj1{Wbl5_b@K<2@_0QTrB&Y%>^)je<XW)qn6-M`0VChN)fM%b51
zo0;E3ePBcGkO8228L4BZ!QDVAT`|QNmbjvH2?kxg3$bxmh#fii8E|zC-c%7L`HZ3;
z#Tykta=GcxDgp7#VLnqpNzES0j`-sG>Nyrti0yqaIeo5CHKn}b3>D$>d!C78Q2(Z?
zo%6Dvpz$<aiM=~}Zez6sKes}xsJKjBt>7C~s;K7ospH^hQ$rL_A~!s}xQSXKuJ+I_
z1a2J*MgZ7ODKTJ{1vA}*+M~Ds{B$Ap=vqDHAZ?d6<z3RpoIRD{mN^nh9^EBhfu`l<
zu~xCIEM|;?(|mTQqBfGR!CBT|+&Wg2)2!AYm3Sygbqh&<^X=h@)M+gVyKK<h^bDA=
z&35MoGQPvf3b{Z*xm{<<5I3Uly53Qw&7IWqhWep}*XuB=#M<|icR8C&?gH}2LQpM~
z(M!eW=y;?`1;X<KM2)UOijCvka!cXidlO_sY|2Ues|NWE#Umo4-C@sF<xrq86N~mm
z6;uSSsq-vaPwv6qSIk4?^P?V3k99LCnh=Fj!b-wM%oN2!;lQno`9~|q*pV0&%n@T3
zaX3s4EezLf2r#yK-+9;IOEQt3$xMv6ErOyYP4lkRW~{#Xn3OKxx!t4s&*xe%qIanC
zEP&#zw{K#@Iq}q)(MHNnI6Arq!itxK(V>-7@}I_&+Rw}|jZ_v#L<SRtew66s?iu5L
z#p0~EpJ(*Lo`K=;lfC5(Vx>;z9s0J`#EWK=HSpyH=r)S{GuN1+e4#vC`FORd`SEjB
zcT#6A#n_&&I_iB~yG*C|QT0EovZ?VRn=6bjlsTMQX=bD{!RHEJ9Z)0cA7WGI)nZ-B
zzR&LOBC1vsif=z=?Z^Okj)vfGT)YL_?9qX{7V1)6oyDZVRJFj!0h4`HOG{F)OtAn}
zZw$3x-x~XMU`}itN{>tlQx?a`Vnu*inmQp7eYI?z8F0Pgl19###@Nfcm#b?^6kWrN
zJf5&*y*An!$wUh;1N_%w2#Uxoi77mX1D-EVoj3i-xs)e@^wZ}&)oF$&&v09sNz84I
zXfoYn$~uf%nAaX5@WJ&_fU1Z6Ewlc-`Jv;)UR&o(O={{(8{#nxuM+B}xQob!O%p{}
z!h7N27WCNq^A|8-bbai*aw%UlAhPXlU!|x4eV)c^Y%}|$CZNxwv13*;F~J$ei6#uk
ziJYsz94}H2`Pajd%N59TvIh>GhS1W&HltwVGvI>$PG_h2RgKk^sFTs?m8#uDj2VhB
zJczFYwPe-V%8AZ@Tj%fHlZ>uN9{<d1NZo_PKh04+C9+D)pb9`%{G7;v5^7`Kre#MQ
z=~83Ud;8b7=6AkDvTlFu8S6<n6^tbAVt7j=$0yZT!&<BSc*-k#KKqyp>vmQbjuH_<
zsR6F_T2IKiGJdX1+RRzWSajAdV#hLd4H_iJ0J=0Aw4_Xhb;Zyh8&3yG4SwwQEWMw%
zd9ayM6?UV8V12l02gE{JlHft1Z*C5Vo0%13)3xF|mX)!?sJ$Cl5mT_N+Lxp$l_B>8
zLxEkZP`gAq#zE^7VB|Npl^Lql3$PSRi-j(8)QpB7X@NgCi&w_v-2r8pQGDrt`Q(`6
z@$jUu-zWe*0m78>4Xo)xw*@KsqCCX2Xw$GP(48FD7s-&2JScll1Jx$32tiU@!Y-_?
z#3=K__^_-Z<&iZ0p-0&<(qwK6TiVjOP0X`gV%$v+ihO$Ck;U-$kOk$!c(FXiFp1ix
zu_G}1c9!IrO^ue26PeY|GTJ<e^*gc1U;#6M*Su;jgcZ`OA;%QsDV_7#2!>W(Xcl|8
zZvhg8#(9{DG*jGG{BXVbjS#2i^0U}<hi9_a7-=T1MX^buv%{1n@d$r-mu}>j7Zw~C
zw)9oTT9SZ;*q$dX&XNH-#0j$1A3S>`=YhOvj$$>t6F~oqqQPAda;VF6Z&zA!sPl33
zkCW4?Q%s3QMkTuhC`)JsCWLN7;2E*ng)r8{^~pmmG9D>gr{Jq^7KD}WyYkbxSZ~){
z+O%*-I~@nKV8y&$?eYM&ziZXVXcF7n>aRz1waL?S*9m0$K8tklU!(VW{cK-BuQi!9
zepolGl?-FI!|aVALHWkE(spBbPoB((9rl&G9IZW@*RCxeW6dvRaOL?(k;ox0&w4_4
zA$;);b{k{W0lDf0CxN|4gh0k(zFyaEZ?vseRle(|ruS+893+%9-DX2rgYjuXt-OX)
zdGCd7bl*sC(Hne7H!(NrwGxEn{1T=ssEX%&ePwfkE&dbK(*$dVrneY7j4m_lHEm7L
zU+E_S1{)_`cg<O+lpoz1`X*TX64VYNc3#wAL*#Ay%e1_hNn^ce&AlvtpQq;2EkY1=
zenMgbk=zOGCkQRRJ^ONP{7ZOsYbJ7!y61TQdy6-3HQbqF-npP5j$e=Z_O1J*&wqgy
zmgZY0i=6Zl55PN-YZcTmIRH!L3#3^@Po=Xe9IPul+_L=_7c~=V1_BtS216DY%e9cc
zKi$zJ2vf1wifYe4O5wT2TL+8EYi9JNce<yq#&cKE-<-au^C<Sc90-uI!q#`D5yrtJ
zK4EWn%S6NToapvVm+oA!30#|I>-`#c_j{`?TJ~o>isJGX6Hk6&_a3bUKw~kXCQ=Zo
zn7nM*r(+dt7W!J3Tc~{&k|3_ZV!-#I)DrfGbRx1*S>nNvJMgY6VFRBO1Gh^P1nYn5
z%QvL2y@^!pW~VxORw&Ovm;98Xr)e(|T&)1$nH*teXn34-_9bj^z|{${_3;?e`ntqQ
zFC(*vZw6l6J8rjxim+GC!C0$fzpviFamAYHwN9>L$SY*3CAX-Bt4a^LX&&ZGJ^8Hs
z$kI&MI3tbOkQU%awGx{PLE80zL(_VrgG6VwQGPtrwPv@8?3x<lm`SYDH}<I+DTR|X
zP11B*UVfm83)DTHK|gDo0_gC={gp1J-#NLXjJ?L(T_v>Mm*L(<rgCp_Q*DsVD9+46
zuC$WbXJ3X<<FBDFE=F=4PiB0VomW!6yEY~C4W8Gk%;&ATXLw7&w6T&oxJMYVS1|1o
z$l~1Ss>l<^=}&|yRetw&=0uOIsxQVVTF6a9YZOU(;n!Lj@PlCD<^YV<Dm=XHGfoXi
z5lXC+grXxuNK1rc-l%Vls}3+I-}1Yf*bV!mr#06L<ih|FA{>GiLvYt)j&lj(8lBcW
zQI_7<UHRrbW=Qkwtc!=PTH~5taW@FVosMGJA7ZY(@yl^C?Ds3&qU?8dCk+wc*860n
zr$oeU)N|(h)2|%rs|_K<-d+Po*N9zvpdO-LpFEik)fi1ATWEKomiYR7KX*6rUV;>K
zqo?Ak7DnwjA4{<M3lv2Kw7Kk|zIt!WYHBl4aSoRCx3n)oqmm=@8J>^5;cD?(0Rdf@
z_)9^+Rf{Ev5bH7e6MwB`{IFy!pWe4Va(8u3;e(H535QSLRrk;z#e`F5Z5<*cCfNGb
zmFR;l+2~JD(azn@WwO4nBPo&V)k7v)DOVEilV&xRFi~{0+yHVn#^%SE@_GDsbKP!3
z8J`>TZ7Ijlq#;l&8;$b!UU^F;2{mzJtXlg@wOG5k)^Q6qdo^H>V0JLaf$3VPr-MCg
zRFtvYbX9ZvU_-3dbJRts^rE&|HfUMwA_D-0I6uUiZYpXWYb)>bb2Xlm4|*FfJx}L9
z2Qe7+DQ*9#h-j;}sfY=>S>Fx04xM?5rjIOtVKq^{>*ZT7<n2sCA8Qk}#hA-O!Xgej
z(7_I#%bMbBCvcPi$*XrPy%CzHy{TqOSb0b^zmZDV)<m(-LcEu`)!=aww3i0R9+|)-
zL5w&zbbLhKlrkp_(tw$M|5eKAxoGV3!r}pSPKeALZT};pg|FY+l-umG=Sq;e-4(AP
zw9V#gO%7s5xhQt3yLLV^)Fqpi^G49+S)owXW#7u);jyY_qZJ5Q>s2VCJxDOT%fGi9
zz}vRY^M8xkJS#C_HWC$QiEz$^RXh&sEdxMya`++t(Jn|hUhX}1uPf_%6^0^8dfVAd
zyGnvvc6!ibptKdH&8_lvM~s<laBukfX=oHve5|4oCjQv@;(asonv&|)ZLvuIma?!m
zx1<`qWz%^zE}|@zn{7c>dR;6TMpd$aA&K#$>~*pTvKvT(oUb*I2ve6bhmy?%EiTi>
ziB(xjb3d0M+NrQkMERbc#u=m+Tn$FVGvWBZ;;A3hGqGhOZEI6hn?5I~`4%pk#N3y<
zCH}nm@_lQ{Ir(kl6*91GG@KB27pMYMti>}r0wNeN6M}SyV<Z2Hgh(65oyKV*=e1bc
zy!Pd9)Ik}5lAp34+6bXbga>fZzCB8iHG@hFZT%~0X7d}W<1RJ{rX~xuUxvBynx75*
z-lMy$g55JH0XHs$3=eB%!~+Qix;%)z^owB%c}w9%0%Mj@ozt+^@NL%FRxZEm59{uL
z?4nNE*ziMitsK};Ka3f2CRRE=T$z9BL)?O1w#Ghp$fG#+BURKgN}loyX{g&355I34
zT3wK8mrNikgcw2yaYm>eJ0rUJ*QRg3)D9(Tz}*#%Y!ApE+KQ)-v=_e=1eLrbVCk@0
zUtxl=1Ddl(=NkCYvy{#f0k7z6Du|=MVad&gWZOv&ne_Unsf^A2vYG4gJTH~P!0O)G
zz7M`m3rLsUThTRHu(m~6N8E;cYbCz<DKvz?31b>l=ESbFv&m2H?K-=(vaLLYn5qz_
ztm~Xm5vAHLmM+|3WY)|$`J>6`?D`rIi95mwt*#(4DKr{f$>+B8x6*owD{m0wxkYpe
zyx9%+qJCMJq=`yKR-SPXadGA37pO6HGj(NqgB~BU=x-5&C5`}{V=`<DKr?d*V;j46
zt~z<>#7;Q7SR0wFzS{6!Cz3rQV(`15i!Je@%Y1;*M?7L$0I5|G11G6z<W^=!hsU@&
zA2#qL=ATQ~ycCZ#8I+l7-_p@B-q!$YIAmX|Q4(7Vs>X~npQlWDmvNG@X&LV0hZ65{
zBq$(#_jueqx~yuSpxHZEg^=rjQh<`t-DxqEl`bV!XFWgm0p1b6gu*j$e+;j$D0(r@
zL$1VC>xR`j{4!1+t&3n^I6c$_ZA$#8lWn8e-Qx|TUS~rdX}OJ4t~YXA>UIqRgqp55
zd#<(70o)MY;jhzCY9Y;{GsDGL%iCjiJVVu`mL#F%{VW9>W&4u899J5m#sHcXDGVQu
zHx~uQiHR}5J9WMUI9LMYkmInGN~vId@|Dj&=dB;jEo8(sR9Im{(2yQBF=yfv1e^wU
z7pbJCS|gJ*Y<FzJ*}7Dd>hdg&E~5WkpS3}cI*Yr`S!lfAMe;hJ{cVHPWx;}xCn2IZ
z77I^16olMSLrRyl`ks}*`t8q8k`!aqYS<dCe#7#0LgwDA@;046f_b1_%2u10%jglu
zcxD;8itm0t-*-upv+YK+Gd{k_I7GEBV!6=lDp)bL7C2ia9OX)hE#7pMc82JCIi-Jk
z?8E!OF(N9uv$zNpL^}Z8JGQFFh;^CYM->LcyenW}40){+K|!u)-0?8$q7Q;Hm9r_>
zYcb^I9l`^7BNDdT=l6gphRr_LfpKCfP@@vfq+Y}NrVSI*YEjJF=^}{>-2(UWlR3KU
zHV75Jxj)7+pueY}?T!aA;T@ylea9B0(~2Ul6`4}%`(|^HUXSE&U99QPQdyF6<5NC^
zjK2N?F~IG1*ilIIboE735!SUkh|=fH!x^dXu`bA4MH=stAJ{MPfL!l2$n8AFF<)d$
zRfH-Wx2<Iwbuq=qG+UvbllsoL7Fiv{P+nQ@05r|jXf!o$Kk;x+a#uMdafJCI<Ad2K
zunXr_IPVbDEv;fK{I2t5$j@A<O4CtarP4u~@zNLhL;O|60&*8fZm;s0<F{CYT-;@>
z*=l^`3X#;N$TO^D8S5jH(kji-{H+_}lg}t_`U*ZMWaQ@jc4&Gw(*Y**f?UCAV@|qB
zNY2xv_agYTW!<!@`$NuU<hkPe=W|-03y3tPCrHFOrC;O)2|)RfZHSU{F~&`!Rt`44
zx~7S;nkFHQ-7LJu^JiZr@5NLKed_QP6#sw7d+(s8-hba01Vy^^PDBt?KolubBO+Zy
zKzfOaNE0F;5F{q_-VqRx-c*|OPUry<P+I7afJl{u5|$A7p7q;%-??|@&OT?(%sw;c
z-t%u}O_EifXFbp7{r<dP2r-h5LcT+n>eWv(s2@uW0>GAjGtVLupjXf(oGbO}ArF5;
z^QDX;p{$|$XSw$sM3Z3Ni*7B#*#Yp9P5!X<iUs^>uk80Iv9^^}?aPho!5!wO5$YEg
zDGaAM2T+!+2Fwf6g)cCZiJ##@5>5TnOQ%J#Hxm76*=F0S2&3H)K8oFG3kre=w!5)5
z+J#|}%SRq(JunxD!KE&3lLoY>pqn++1Jvujueh=6snVQJIFSY?@LMoeilpydGav#V
zthY=}?%T3YIk7?{fPp5ci*8V2z1&v2(}RhZwRQaNp$S}*r$h6iJ#c|S(VIsaP2rHs
z@M6DQJ`^ipv62u}sY*{+YYLxP3twZ5(Nispam(^u;QXo1!pHhBSaL|dYQ|%zAARvq
zCUl9N;#~=}-~98et$tD_XGUiGWn))VzOzUi%NUDa89QH)>ZEv7H8JieTs|Qb!;fMB
zQvUUJBmmIU#;TIk*V6J~ZEhz9kr_FQn~SRXl68t1O&^JRD!Sy|S#P{d^dW14IhtEl
zkGP1AwWqHCG1f0FJhd%$>@)jq&){`K{6OvB=qJe556eu*FK!ddr*RIGU_1~+h@u6g
z6QF!<9gLXheWSF)3KP!wTYf#OeGHXX-Q&b^x9GJ5f=TvCB#C8oT$>|du+0<?iBT6J
znk?A#!R6y3>vMiY?w<^-G>2;nh6-Ehj?zX~y5GlMC-Uf@W}nGW&ZYMV(-IGo0O8F&
zMCF0qgNI@bt<jEYmM^S?vVHaQgTp(QnW%&IbGQ9ZR4JTO^+r+0BcJgCDlxkZNX-f9
zgJv7lmhP*Sx-?p&tRfGCn;`Dvq;$Ee3&VtDCYk^;Jsh@+<>?&uc8m6UYqkpu^9>s%
zsex3rIS49?4A9)%laJJyL|q1FlA}n~tE`docMshy^lAgFq+~qI-Va!LTu%D&@B(gc
z<`FCH(`Viu+^P-JeXJDD=!4B^c3UJg)TKCr_UgVs7#PFDvmhNmeNa^lE`N=<w$#r9
zd@D=5z?+)Qx9TzPykA-DN>z9F=^oJ~S?2OXokp3F4sAau+Ow7Ucr+K_xNtBG*Gqcd
z*2vDJ2N|hM5J+f?FM{MN#o)1>WlIdxK*1b=HQpyTij^>gaKDLe;Af*XCzhA}>Y}9=
z^xWl8{Lty~>ZZ}R>vl|(9dM2p?SwI*pD%Eb!-%hHt&s*l%MYq9$wa2Dy=-Z1Z$V@}
z6S-+dK+91=9h|XVk1#vT%P=P76QG&|gOS2NI=24k;OHxJ*?f_tjz!00m^fbi#@IhV
zwU87Wd{Mk3sRj)7;;I>I<Ef-*khmL(E1Jy)Sw@U@dLFL=qlU1w$>sO`FUJzAYgYu{
z^sBY@p=+1I+iVC`0*IP@)3#u=AmDVy=JtWG*VZJBd3Q2h6Z#j^0Y#)Pdv4kGPE-1b
zxX?OSgmV8VqgYyDKa{r0N7~}em;t$rI2SkcHx~O{ltz?Sh-z>I9gJ~e4LweeMsYe@
zv>50)g3xN&E$gEDYk2dmC%So(zRP+?lcipH$g;g<WFe#oRBIDLZ+aY@G)~o1&H9Ci
z6HTaB@#Sk<N~cT5_&JEgiF|YZ*>DHXk9rK9TiS8OK{9ZsI{`20gO+?XRat#K^WkN6
z_#d4G5r3$RJ`(@UzjV6~pTL5AbsBpn<h;bO%>nzGYZR%f$TaQXbO%d+RTp|$BR;?k
z3P^lsvqn-i)il~AS_3Jt=&OSw4)MoYX0)rzR8&<4V`wLvQF@91v9W8E3aNnuUp;uQ
z`>qOZFL3F%Q$%@xam)>JFN`_;(t=+5UFp9YjH&6!Cu*NfJ3~3!bUv-Wo}XVBDzYod
zB^yNj8B(oWQ+e{9eH-@c^_`tQ12^NswKB|1*0Lf+p*<lG+@mvApLJ$+`SFKXo$U{~
z6?f?NHZ5g$=?Qs8AD6CRJ4Zt^tGa|V^(T<G-8@~E7lcpiBIi(2qlu3kdYrz<*dA0Y
z#XxHNGe|Q1{Lo%^NFP5YxXq?ucF2LdxUlVtPF;3Lo2-r}XLU>3V{MBN``Qx3<G$rj
z6h4BX{z~t&9saS+Kl?*ge<ml&>T>k^gFXoReo4^KOtk!~NWK9`5KA=x8R9r0Ee>C1
z1LN9M7pzHMd2G1&Cc)by{JB@J<ETV5u+^QzPJ-{yuOvh-Dw7hr2T)gAfEeQ+JHjWn
z3XDawmP*ko0Rf)5(%tw>v&-p&ykfr(6qkQ*|MDSPACKU`Ih0LR;}c+N7_KX=3Pn!U
z%-l;jIyZ3HCRT?+_3hq9tT`kK?dS{V-|A2XOi6UM0NkIDq19gj2V)T{ZvOEM@m!tn
zyR7%&-I}e3YNDY!IJXUSsEu_fAQ;IHh&o+M(TcS$M>&^CaS7pnZa!<<|7~}H;35{U
z*koAh8OMDtAYKKhvjT#XF-$0?vng2Z@KTTTUFXNH>Bk>=6pRf-dn9c(#(95V7ggM)
zdTH)C<doyK&Fnz-ATC9pF${tWxnpt_;cn6U1?J~_s|qFQ!49f^Y~MI<$Qd1-`($R^
zD1fL^BZB47w_rm%J4J-#h6Q~bnk&#th#PvSPTbn$<x7T)-9LHr!{}6wYD3yTFlFa4
za0X+ijw{>q*WEbW-o`cL)HX~H_YPk2J+NDS0ao|7VA+s{#;#p{Bnrp}bKVx?!0JBB
z%;Nkee@A&W2i%SQFTzxuA&Sr8bu?;U_COG~Uh~O}p^duplbc2i><Vh}0qe{i0*5eF
zeWTb3<EL7fy#)lk2<HHAf>ZEeE)}AI#=CH<0qn`nb1!#Dbhyz|NHd@onXjfj$^f>q
z`G7I=kQ%2bq#OSFL*<I_FxHt8qjrvmqA|lJ&?uTT)9FCB{cl*Z3s4;ZM)dJxdm!PL
z);rV!EnOSVZi8^W^x?LqrgzDsQr|3CQpyxWRd4FRvivq=dUj_BG8X|0Ya%2@)u{q;
z(xcp-I6l>5<L1vkJ1r@qyU6=I@s}m@$an1@8g!Zab~0oQ(uI(cIRJVOm|S62=}JSy
zFX>0yJSNV4{_8%rKX7utzmTEnUFYkIyk#cU(t;8@=a6(OqcJEhB1;vq{!D_RTmQrG
zU`iS#E!VE_bCppnIsJ9~!=h{7l)7wv$`huuPT<`bzB4(bWR{*f&(8z@H)TWb=w;@N
z8^=r98rbzOe;_rObVUa$5OaHA+DOyWOm~VuiNgq}$FuUeE}kR#WJir(Z6BjVou5oX
z-}#oN61l1wzAEU;H*($*xOyUsa9c*lAWc^cC18_23kLm+ui&c_zv5r|FPnC_Z${6R
zc#U*s=Y70pMrG3S)y8xc9SW&E0tZeUOsGR`6T?|ij5`>H^ocJHJxnGz?_9~T(Y3Y-
zPEz(rN_oya!@v`il2m=7Md2s<QKX^Z^wS<}YXv-__t|<`AHVr@&svMQEX(%;G}Ab6
zcIH*;z^FVK*8>mbSL}hZA+~zonjH?$FRD&r>i;Ca%K}HRuCG@0lkIMreRi+6gp_{J
zo^${cq-YT#z1jDV*A|aD*<pijOg5?+Bl&`!O<7)Pe;+)p9BWJY_;dJ^SFQ+Bfmj(t
zlpuEiLCXo@Y0Ra7?@^b6HEE2HG|Sqk<L$}v+(N>|Czgpt)~Es*LM+A0B&dU_P~fam
zfxH#duP#aIv9p(nUL&zJv^HdChr(V)&<z;)KIXpl`d-&SXBDnVopt>y(xVMnYs5*I
zwf|WDkvXw_ax0jAwTYcI9kn-h3FY2I6T5HEi>YD8h5xCSgoUEP=^GrRJ(>028%@@a
z(KA=;!>vX(m_Ij#EmC0tv#%=DhPt+;=T9DJk~ly|K(O!D6q?J<rk~rIt4R5M(tsGd
zt(GT4?XK-PTjt*QRa`OU@@dl9CBPonjlSf=NPh?uo+(le>u>e+dwrzHQ_~lf-IX%5
zH$r9<Uifl5sL7+sg!H>}0YYHyEUOAUUabGrk?a5Ld}vF|w^~=0ud<4nd-~<V+Se5C
zTpuwE;Ldgw&MKYV_<8$Hebg0`1zjx$dMqEIH0ypjN}uu=uva}#aw6#T=FW29g^v2*
z^lnE6-cA)8N7@8K(MP)E57wjK<8>)*PTyl+LnEnSC20D3qw`<^hOtfZGetSIh*;O+
z_<7v={;$4*-h#_(_hDY2s2c@W1^4ZlS3uuv-{Nfy?rFk`V)UCO7DT+B{gz(jtRBCP
z;_<-KOkHc|m1q4wurxu@hYOlLWUvOUe!(7u29+d9Zvr-&nanr3FOM6jrV($2t5d&p
z5oG%KBH2*kk641in9l+SEU2<h`u>t}n1GuaSh^423VxiF>pEE#fmzO7qLE(;%B8A!
z^A8nQ*VVLU0%Q6_WyMvygja&J@#6OR-Pc~yB|f@HYcVe`?P>!01Futou^?3M>x}Q6
z=QO@Y58?s;KlXt!U}AE{N&U~ne>a8WTHd+;SrWSBsJa;CF)^Y09Y5Bd^l{H-)>S#I
zB%M)<L*H<C>#yf^#)0!KIl+NyEdTb+Rcb&g$pU}Wwabbn<VGofe=D3SwehNUAX%4b
z?3~$c_SP3+YSn$-5N3=sCK$p~PyYrTp?<r1%7^#yx2eb-uF<r+H$^f`?ia>>HMyW|
zbR|3Zcim4d&i^;FL*H6*M4caLMnv~ztC&wB`Bc-nk8c)x7tLopcaC0|4U@gbJi)xe
zbXSgg{Qv~f83Gvv$Qwk8y%?@sUi$v5O;`ilhVLENNcq5Sb7ANmT51+cB0Wu0F<?c~
z?9Sz-usM)ux=ajjCVi4C<1pgT6kiu}{wS*`%2ed76?mX*T@m2N9QN@DCswZTvo8ML
zAVY{mLS7YhI{6F0;{aykV|aWpY;h7j>NornjGCGoKgv~xb-|?BGK>Zm?rl8ke8;Ng
z&)Q>@kbB|mwxOpR5!ctCyfax4CEghI&GrgM+zwOF3&tEp_kP6i+r!KM9TThDXf6RB
zS_ouAy18?V06noWkYK_sBi)9n{tISO-ud%qvB-UEu?Z5jR4>yh6Vft<@FqyaN*^qk
zrP|Kwa2}=f#~oQ)?l`0t(h2fV@%u97fP{so2w0!6FsU)34h)k;n4C!)=}um;+VOa%
z6mL0KNOPtde~8hgEiQ<rx>nG<<IvZ^LnP-HyC{>ZTuSY?QUn4ndWh>5wPt9q2;S)B
z<7M%!d~}T_@86FH$+*`4dKM)+JEYFQe@oxN<d!DPMG8BeXd#!<*mjkI#a$kpp-0i@
z_eB@yEG`E%#V#)k3UbpdU3X2(LSHB=wchmYni6PAe!_lThw)0d!27*Yx<r32-#`Y*
z-!N9x_!5h%4oROigk-(NEqtX_@%aM0ZgA&v_Nx%NQO=sc$~+mSW;)TSb_l_uw?Y8#
z5dw+y8Dcgt4z`-27EX7Nr{F)Z)5l->&J%CLOUJp*qsEZdwuQIo16>A=M8kw$2(5wC
zta{#yOLad#*nap}=qQjhAirK0cn!QD|8a6*M078P2618x3OIOXYc=itZd_IArss_o
zwfZr3enpnDoF~h%A@THiENf{^adZS|Fw%%HdI=D?H_5(lOUwtMzXMfSrf-S~EPeOc
zzZKyv6O{?AZ@~-xfBnX_y#KfZ|3`ih?_78;5c<#Lf8wG3pLb@{fHmS-bZ?_Q-w!#P
zT)>))VUQAUb^hZ~R2RLsN#y){xn7TzwKe%0?@Fw<y~xQe%3Bf`M6KwybfL1%6(#Cy
zy#90Z7**j}nypOcwt8^K=6ja$3y5q@lQE8K15)SLof|d#yB8Ay;aBHzne~g3p)jB3
zGtDZLLT3tcBoAZxo_#2aPR9N^lpN7kwooGG;-T1PsLK|Z6qL&?{U%Pf2VAha+;TZ~
z9GVxn(s=!f_Q+4{S{n625w(uUeNtw<8^=Tsv80}~Le3#s#LHJ*q}+o?s525vs=f1F
zzRp-``1u5QKEFTeshT3p;XljvcKLMP5!AF5acvSO3J895)Z1R=oYF#|w5Mh>GxqUc
zHvOkf(o%%0CxM@&p1fJVW5*pu+$YDM=1^cOcRN_t`JwS`d@IZ*?yih(J6d(E?F!`G
z3wTEVJ5pb3nLDX2uI_)da3F2rp?$D8^m$bwe7p6Wf%>(2oSdDJWv~+8s|UWd@MhiE
zpqWn7Fy^CHLiQn#ro=K`->x8P-2U#Qx;PMEZpVsuiuj%WsCt}B)LrvQi^l%^V%qtg
z6}}61wFQZm@lPm|<!9q(B0vU-4$CIdR{~h%BVfi^dSlYkauyTC?U{2?H~*CE&0ieK
zE|6FH*Eye6w*WFLxe>W_j+j17NR%s5euc{h&FjKpuqu+QdeKMVF=v9B4oe%IZLn8o
z6>A|y;WQ89w9A9|1`Smg_=)siUgC94aeF<t<VyFjZM^Dc>Vpl;V1{E<^ts!?N@{wX
zU=V03SUB^-b;z6z<WPh3-Zxk~H!Tu5!|4<DeCy@b00kG?#QT86NYwi<LHJc2UYf>~
zJ{07%0Qw3Z?oJ%-K0?u9fVYj-Y1N)(vwg*ji?jM%+`R5bd@qf|wLPN6lsZ>W=|~}X
z9V|Q!La)kGiiqyf`bsj-APhsT+8b(`60J2IT<$bXq-jZu705QLJh|gU#juTWfd`-6
zCRNrh!(t#8hwIeUiQGlW-5!p&wERj&_v~f|uYA7isANkD-n<2qvtz&xq0~=H<wyCE
zuSl4n6(AEVXtv#1wh0^0b2AjFmmJpr>m{Bv=TM-<@mWCQe2~zf=s1cCHPs;ssg+3R
zxQ5hdw6m}VyyX}2n&ateLoD}*4So#qUmR@09hrkVSDCU4ohdTFF42Ne6^HaAdTWd!
zo$yPMjcl71E#~>iHz!%lx;L*PO81KOL=&sUE?w-z-iP7D0W^tj#R3fB<)T1=Er$}s
zTTtQI@Pu<J%O!ZFCCZ8f<yf8jTT_(REMlfh_0-GRo!NF@CR~{I^fSev0B|CtN2yB}
zDIR}qn7H}o+QEkl9~x425@*X+zY9K?-uKe=!0rn77yt<?a26EqEw&rR17pl(MpS9W
zSQ4jifB7I@2Nx&L-=%6E-F>8YSvJVFu}9~$h5{);c;nOR@o?tFX=jX6O?t0`Y5GwE
z_o_I_VKrhu)*zP8vvp0a&lQDRI^Q8iG5kr9CsYOdnUjT8iN%wn)4!Wi290Vqxp&>Y
zTFDI;nJU}f{i3VCndf@;9jrgYNHLZ`%F5gv2^zv<pKd^$zY)o^-SRfFxQT_ziDNL`
zL~kW1KJ_rpU!pT1oICeI$0dX*zPNJg9ZUbUN+I>_^oNS`x_3tS&7a@-aY=F&I^#y*
z=>y#W(7L65JL?lzt}&RuJX97Z`KU2bA~}8W%`5IJU+8Z?NWe&AKeT&yyPhze@_cz4
zqMybi!!!uL(*Mgb<&Wt3yDvwd`pbJYEk&ZZ)BDfPksu-Ne}+R_)^dGbG%`+!H$@e)
z+&&$f`ONoMX=Qg-vk%6IRPhJR<YzyK6m8Olm>cbjv6)xI6A)#WtttpjK{kV;60B>&
z+2`LCo@i2@0znSm#5p{=Yta2*mkar%1woj&xx!JB>j?Mo@DOKXrx~aYej*qWten{M
zYm^O1e_GXMbaE$mCKK0v#{I)xZs=P1NEu7scb{uJ(eIxG+62+)YrpV)*?*BnI_VIG
zWepZqCq2p~u3%wIaA|4eJ7T|CQ*HD?<8&3f0s6|?tc7v&gQ!#{<#TTZ*$S&A-ht+S
zTtAcsk+ufsM;fGHt<O&uQlDSUWv=+nQ}94!Oc&vtp%@(M_(<s$>2DHIab>MNpOxcm
zB$wW)p#g|nF%ou5)_I4z?NmI&6{AS2$nmgSiS}`&0hida1GE&pI+`aB5Fx!5CP)in
zd>meyfzhN|$MLgzv5y+wrw6{5uZw@e+-34zSBdHp%8IzVZCCD^OQ-6GXXRFFNFdCC
zW$q;)t7o?UeOO8Dhsd~(C1z$mO6C^EA8C?OqB;IB`>G$0$+c@fAb#XGFZ*IxVLv;^
znR)D^yV{iEvLK?{U9fs!#!Ew!Q@@AZru&CVye|)pBUk@JRZ73LZWLxj65q!!rnB}-
z8W<RHi>ZV8SJRIB?rT1Ok*g{e@DJ+GKm66Z{DR8uH|xwC{`U?w@#gLsm)2r>!4`}K
z4|=jH>ccwHr0)v^G{0!Foc+=JZM*WsOYAXS<&C#Yq->6UNF92I9*>TK@F5vjoRKQ|
z&O9xt;bD32g87y~J>lT*@cf8hcoUuTjU`cb9V&}q?@cl|d!|5N#ChzExZlSak!(!|
z;c%W@xk0Ys9?p1~6<-?afE>v!A&KSD9Vjuz5C|eh;ID>9eFmWYemGp_%j$rDtL-DP
zEy+8n{FBeos=c=yMBa1%{cy>5g5PMno@6}=`ewGbmNOix?F{hgQI{v>18?fZxfeF2
znXWdBE-K&zpZV`vywMu~czRptu%mPEo<(WE1)o9Tfb{H$Z@Wd92CFGPo=~4wZF*u=
z#wUDtRM-uT2npoyf$^Zmk8ufSHxc_iNfeV5JS+mqh6bBrg>vF&vq$p%U+LQ#sb&dr
zUrp67chzw0T3*FXE(xhKBe2%MXX4gMdiRS4us6$kea6*uR3@?USZD;fp3&W4FPau9
z$W-e+fTf}9kx77_>ktFBdLeYG&?3a|Zp<Zl?x~{c37L^BztYV+`>)N7#Gj;H7fkD?
zHtyWmm&}_OAS&*75)kMYMqCsZQfe>^k<jI};L=+z;|~99t8=B#O}Q}4QSW<FH5Jo~
zp!kpuz>|n0=ck;pRS5$a0%5^!L5|0|B(lY<Wn<}OI`h>wcAB-af{*k@i=ufKT6O~P
zxd|wxv(XMwz>`$6WJn~}6Lf#and<oEFy0eXE8`QR8d(2UJbfc1o~qIYKT>+~!Uc|B
zqD5f4Q37tv^7uv!iPrjKrH8c0UxPk})iSZMYl3_XpOw1SdGdzg^b`XUDgkU@n*;A%
z+-_fg!Y3Dnj>|;+izm0|`jIi~ir3DQ4eI;7UQh2lI!#4gLEs4F)D@$s%+sT6{IDsk
zwSl<M^uR3PVKrP#pYNXZZ(YG(QGf3zP2faNo+0UheA1mWHZ(tlskH$_bL63&E%_>6
z>>1bXm`@q_pS`O{k4^j;`}Fq0q}Dr0@Oe9o=*|rn<^_C8zC^xZyeO?_A9v;QJ}<iM
zFEmcV?cDr<tK@zbSssWZc@wbx(Ab>oQ}rit;CW}4Ew~&DdWEuyGNvbSOMjtfo7<+7
zLO5=H#H|mDm&<+6e!F+_=*OXu=EHhLTw24v0WD4WSOK>#w)GO-3Jk0(*H-nxAQZ=@
zF`sq^a!BJ(q^EcuIBrA4$K4BbpGL2iSzr8hUE!|?&8v{B1}wa>xf8=LHhXkBl&L~D
zpVOm;$Z?B$xh{K@;Ub0MX^<p+Cz>(^K6*Cf=+i<c;#$xOCZdCzXgh0P>K@=jh!J|Q
zuq5?Z!Os1X4faNcGJf^)rRLE^F19;$r(ZzntvvwjCZtFcp*=YgM(5@>ePvx+Iyzq2
z80RqhywuHW2-2h$i;eJ>T|QUD7R+!qlq;-iL6C_)69+WQfgGbqWv+_Qw>e1!KDpoH
zB`00twN3XUW7i-3dN$$xGq|*n@(R!(U8C3&abOI*o!qHTueCz10(kTJKb9;mJsw{}
z-=fVn{%%s3-4&hqx-d_qoeuw~;^dxN=C9Kw&=R(eV*6>n<X+Jp2YT76URxr^41R$n
z>PAuL``#g~g2u%mpa1^Gvqr+|M`J)J)ydMVFD%N_$`;`&**YNCJ1+g*f;=VL_|c<S
zb@wUX;~Qbr7rZRL9>c+#nj0m2BYnB52O8E$Lcr{S=2x?+YsJ5$e~y>CS2#3fKaGEQ
zA*nI3xP?}Yo>p@iGBZbjMnIn#I*^eQ$)jiNa|;rdwQ(k1QyuPG-+#WeE2LqO^(C28
z&_n^kdwz*7I0UK4%_FP|7`{wPp0@k`ybjaQR3Fdy=>gudkOuN+&f}Ji=-pDE*Ax3y
z;nt8|G!tsE7VsnJL}Fva>xg&Vp(YB0ZmJC?_RWm1lPKYqzu0f$<A&-I={wh<%Q-Ff
z>4e>IVTpgGUH17A(1M5%)7;0+8C+}EYTR{s6Ll?df!S0$An<B898$+peDc_if(DvP
zH<Z=lmLe`BxIZghl%G#?6Y5G5^>bcfPm|i?p`vaQSGWC`%R-SoEyTQBx`ZeLvqkfr
z7Zr#yQ9gY2ZYnCL8V5t!;%nP$&LJ0zt)49e7lzZcvwlrlht*ZZQ;dj>J!iB4ND-Af
z5DLJ~&Rbs%U0bkTdK6e@sJcPbU2Vo|wvo1Dn;x!eOo~{>f;}D35DXjgIr1I2)-+cf
zv$VIh)^zcALYJ0ii#ZLd*ehLO($?1C-PT)Im!XIPLnJ63+q27AK5LfVho;_q?B>}U
zu2DSv`pckv<$jBXK;cuUZQxsTG`KyWc!FiH-5w18nZgFYQ|PuT^D{s9q7CbJTduN(
ze#j169Q*g@QDzVP%^o-ZR@%J&h7X6l2&Aq+__me=UbShxBY!}O5(45>427*FQeLG!
z*8iMJ<0~}%tH!_TLp|%P%!(ZBE2!pY8BKD-1?=3sW};?!gY{!7jGU9+Q(e0t_C$;-
z;I}HSgf%?34%1^41>qRS+ou$`sS5yEZ{_b+?d}#er0cgNFG&BAIoBtWeed2knwz>^
zs-z*SvmqEa*gNq&ff;$><Ma?=Ski{)h?yKLJu9=50gs_qc(=k45{C&$c>DH3sm@Id
z>1eqTTNTzK)5{9Mt{4gsUNuhfG&mSVkElpCNq-+8$A)6kc*A;<^;a7~KQ5TKj}Gh*
z9VGo;Ug(9gc@#w0kkq<2k{B6H<ihu;7x+Z)yuKafrBwB~Ljfs4@=HKTBY8>b5mWOU
z9Tz66WPC)WTE*CmJgyjBf9;pulav%>26AH(LOWDRlrw4)riZ5{r8k#VKL1OP(<fcx
zoc)8JA67%ZMgOAz`+ClZZ#P;mM4P7{7P%;UnhJGN^XpeW>o`**iQSPh=iy2FX&s)q
zk$OcZe#u!9@_imTJTCeP*n`ZvVKFQ|M&K<{m(n8{)(e~j7+qQqxtBb0?P(LOo~OgL
zDBg>_PcNMOWqQK&>BNEn1>tv)y7W$Fr_Nl?H(Owiedgvf>GWwC8`H*co0nG7zg!;P
zQvBXocJ1M(Rdz&qE{hvjwDaj(Ov*>ZbgFaKT9$;#OS|~!y^OcyipUb<Heiq)*h>B~
zmRPRs$8x=lM)n^nH&_&u7b&m;4Mnj5DrmUFC&b*7w(+$S+xwQcL`-V#_HS!7b#TV@
zQX%BGbLl&TDNl*oRiBMOpS~%uZ`2XSWNcW{^PG$miSpHs%DP?ikrwJFWa#}56+hTa
zR*Qvkqga3;4NI2n<v0`auCeS;jRq%~Ah(C3^PgAZ<K;SNH+ai*t!flD<41t>p`*bQ
z?yoREv1!5p?)V|xnB0)RZ)7rAiBngkJNUkod$QiiRxJ6Hp=dHl_IlE4)R^Ml!u!BZ
zCl}F>kPTQ$rbPE>Of70oScJGov1vE-UFv$RKRZgcOUl?;{3Aj}izQsQK(ID3_r|^%
zM%7t-e+%tS;GRKE9Ut|(Of8+Uwd-{MaA9M+>2&hM@4DnmwYHm+P=!D3pZh{|*hp9`
zgv$}gBCe2M11<!yABS-EnT1W|hBorgQB`y6w_h4l7@yx38&kB8iC4RhVnF;RM1-BG
zf&J94!7j%0B=n3N!sk@L!VR(G@uJ@40Y}g4r0n8CzlXO3gT1GjM-y@xI>cc}eIgW#
z4l$mA0qI>Nd&_y3%+UT>##43R=7H6uAohxEaM5SMkI|)I-#xs~1`{VNewu$KH#_Y-
z+yA*lqrfFoJNLE6*hs$;?U-ES`Ae$Fx}20RR5XGlBLl|Iqe%0As8ZGeu79YW!a30E
zp;b+-7K4yFNOwXs|7b5f0waK8j#EGCwZCxoqcQ!_#IFE^jJrJNgV*9(-U21#!B0Y3
z=jb+A&o3ex9}^pL{a1z+=5%ny_dRx`{xC1J88rp6ztkOyYf`$Vbhqf386uAEQpK!J
zs)F-@UDZES2VeB}p$v!+a_VUjfduZhb0cz~Mzrf^LX+@149kY63(>ZCYh(GPLGx8H
zf`!U0%$s1(K$^D}+e^fym7`9ZrZYA>mrR9P;^N}jS%94*yeP&vc*<+9hr{ZFm0d`x
z39_$KY(FRmq65HAOpzDS!U%!o%9H{`O!wK%iONI68^_0|+kfQztNO26iLl+xejGSh
zS81b!|5`s8SxVd@7m-He<ymL8`e$Q*POrm2TW|e=q3g)qiQbm_0%+2WJLfjVlBKSA
ztOH7-^5c}pr)Ar1F2u3^mE{YcNN$;!c&Roa!LjbvG@lO!Ud9l_i-0%o3GuNPyZW9Z
zhRF9wX(=b-Ai)dLBV^8}>b>m#Xw;^5LJWRIVS*d~D<d_!`eL~G?clc1d-H3xZK5Z<
zKuTAxaEBlw=3&k>K+}EfUNL<5>0SBpX>rO-MX#s3*q^_G)gH~fqjCq#Mo^OCj!G3p
z11MX`ra9v-0|8jO!MnM-<71<sU-h?fOXIg;Z%=Wo1~+N1zgX}7ow{J`CVD1o#V-~m
zg}gASYD8F{g0cf|4Nmwf3&ZlmNfn$QDp%qreapXSI#4;?r4lNPt^*uMyUU8bMuJ<=
z3lwk*u+?p^HUYD86S_~?Xtegtzje+%*<ZFiv3dO#Lm<_v(2_nN%Nm`z)Dx%A8m){<
zEk-0fwke9o>8I(r=SM%7V^^)Avg?1e#*jxg)|+M{!M8UcJ8;qoUM37By#?WVPQ=c#
z3D0&ji!+9`#q-SW+YNj#;v-H!;ME8j{1(68<Hp);G?(75{O)`3oDNWkZ<3#s_!S9r
zq1AYU-u-FC+M2RuzkhO*qD%t)s)6bZp!tBru*J_6JU1WXuR7h<*-NPk8~9y$9&xl&
z46cAI`c8RzT5w&>JMKt}0-^ig+b8<Zzf&=<O&;4&4D;~)Dv4zd-#jn5$^C<Xez9Kv
z&U6{xi%EFAnTYVV1hT(u9#2*lqoRpcHaabg*RNV!=EXl5G`Y9@y8@9tx+7gdQNpQS
zuRu7g<Wi&~ebijBk0#|d4jdcmk{8LwjKfae?CzRuD#5!?7uyr&gw;=ToTk9_VQbaQ
zXm?}vv~5X*d#T3j&d8hq_xOi_=X@WoBfqo6B6eW1h%G$NjyuV_%bt;_P=SXr0nmp;
z)aN3*dFhgZ@s5H94vFKhm$ib}s8c*FYoBRQ2@T6h8@)cQR=<uk13WNHI~{DJ=UmUO
zk)#_^R~Ih31tiole@gzyZF!Vvm(Ij<SAGrw>BK-#!nSVe;-uW(6cRVxn1_&D|5$$Y
z+-IG7g0nEsb5Tc@a9QO<ueaw<^H7|KMuJXM2Zw71pCv!*1)yZyVnTHTStI@IWYKcg
zPqBb>SXFRn`Z?|<alJr%f>!q32cz6;!*zcH$jdtmannjz{j7Dfgdy|{j*y;kc57k1
zWdzKl=qf}k9G-VK>N4GE_$hTu$1_SQ)N4EIJ3^b=Z18*y=ZgGsH7o<h-obqK6J4ja
z8+MQ&404hiLvG5wGZ{PE>Ln{jwYEQLc>Slrh5ROoscC)h(%q4_xaPA345vJ390B(_
zVBZ)k-R9W(qF8Io`1Zjdp5euQQA^ya8CV6jDJm>A8p*PFt}`uH|0|bPy3NN0#FE}Z
zK57oYaK$OiZ<-9o?Rb6TJ6fi0a-yU1lAPG&)6n94e9q*j78R$l7S;bcgv9@jzru;)
ze2)nO3Eorx)%tROOfO0}hqCe5HLb=z*kZuy$585~0!^!^AjwAV{}$o7&JR!4f7B-Y
zc@lhe^H0|kr=VoS=XL6TNj&V;Z)BJe-reMyX~0RpZcMr~(;(_fZLrE4|6-+NZOiW9
zKmIR8C7LT*uKnBb|2ZS0sJI~T76pn=U<M3~&IXB<sV;?<yDsXZj<micxObX+(wE9L
z)s)!G`G2XNCA9_D{Y1<(#B!);CZ-;Nycjymq~$RmNw*nMfsCgaVmFjugoy>+<3IQx
z*$Swm@)2%59X$1E*dArGk|ellm8Y2bYaNdSxl$QXDc8JKVXFkOL+}LtL%;trW^b+O
z$yHQaV5p94nhA88!@1@>Qduds`i}$tO_eP(@OPml&W@^j4tutK(|*ct*w*ml(W5&f
z%8$=S|C|2$|CA4Vamd^FDo#yzIKf?f+#-79O-qo><#_z_rUa3z8dttr@klV;(tgA$
z-~8_n|No&Q;oru+j+}AOJ;*<}|2pBZ6LlAC9KZ{LIht#6`J)63FVMec;4Z4$kR;*~
zdxPJlC{45B?sKNr`J<;QtKJw!s53Jfj9!PMn2}G2F$kIdThq)YV{)zW$79C>cjI-!
zU(hfMB=YgnjJ&l7Ma|~2Z2vjCio6BZ;}$M}3%8C7#LZ29RO<y02Q*paS8#`U7VGh#
zJaYX(77J>ZuGkGVdI>eyg6#{%09Ww~uI_Nd@jrr_N4_l|%@egmuc%=%K5>3e_854g
z&1*hL`@Hg7?~<t^p{i$;1|(070n8PEk!JlEoT8@~EiqBr7%RH)EiEzCU-zV!=M~54
z3d|Jw2AC^CvJ)4=i#<!`-Dam+1GqDaT+G9?`VO~eX86-C-w33Csd{Y{H@Z~+F%uiy
zaTCc7;7?-$$^f^n^tXK-m9t1zAGI3SL`^|c|J%Xa(GKptEUh|M11lxSWp!g6N&pQW
zjb&w8&&-W(6Tnw^8MK=|3SZnDHBNb??pVHug<t8ri?B1G4wEXpyrc4Ymdu>sNz~cl
zA*_%L^Z+eVY3J~AoKr7(e15&Q?;Ur(3&Q<<+Yi1gG(#DexVx5DLXP}&Rv@!FeTooH
zd3Y#<rj6-Ld5R*>Wa_3UYv1?m*;6Nhg0SM(eZO9_ek&BEJE;Im6s$TYd_V|cDVzgu
z6kflh)9ag{*2^<K>-uwcBQ{axj*)o&uP^B|L)4ndeHv6=JUxqw^{4MK&d?ZUl7r#I
zQzE9<ZC$=y!nW>fGp12i%2B*NeY<+_iZZ)GaMSW?;9%2N+v6`Xkr+Oi4uKg&S`Yqx
z65{ip;)d3rHxI9g?3qZsxpQ@ZSupa%ECp`%Y~AhG?z98J51Y$Lks-F(ixMYh*J8ZA
z5w$?{k(Je-hVrT@K27~OURoNzM><?bbUm=hw>o{$i*pFvz1ohN@v0XYPx-@Yt&PMy
zb$>=7Gt_<b6#f|EEkDzKQnl!XRl`BYF+Ml64l~n=%|ulcA{Kj0CZv1sxLAZwIl2_3
zUNxwTs_6Cj_}S$G0&AT5Gs3j#v{BW`8^07`9hVS;f*260B5Jf;kHda-d`aWbQEHw|
zDi3%VdX6ndhR#=o|JaRC)w|0?5db{Pkp?6O<&C#ujG|(iZ)#d=u$;yrf%bZQk6#3(
zB;OmXioz`CLAcu>{>0Kg*m)@)lQz;D%(Eo-ii51b`Hr$!MIJpGo8L}i{uy-fZRWTg
zMgp@Wx%M=j0`^mK7;2hL95_`sDKzrC|H&5Hfy+Mn`2b9|8mrY#sJpE6x~%I;jC1gB
zqk^-^GnFx)(F+p&=x_^Rdg4*9K;({Gh0YFf;je{hX$Gxg(kD|!-DXj>TVArfEHMPS
z9T~zf<I20GP8byun%kFo>~hJqT3_Z$eZ!N~1%Xk2x`DFBU`1{*Diz!?=*B_a0)yA<
zD=<B*VYy6lhPG}ry~-Z7l>*tyYa>G3OGfkKQniNsqUvOZ4y&j4R98Q#@8jDQ9~;f>
z_bZpp>NglI+bN4R-ToR?#8a+M*FV<jrR^Q<yT|x3AqMIG<!ln9<>C5-7?!kKi0Sdj
z>sKeskI^56ZQfbvJ2uC$I|DD?=Na|{mwP5^sOI+P#`32pV4me(m<OJdR&ZyM%mVis
zl6a%EhF8uvKeb3SyOJ8O{2Z(|TaQ&$bV!{2Wd1ZWbiVy4)}YrhE=fFg_5q{FQyQ69
z@sg_v!S?4!p-XiQAw&VoF%K|6rK<woi@H+RoUC9I5V@NvS{gYYSDf#kONFL^Xoi=I
z9<cV?ivXp>5p4I_IY5I*YJ0}qkyEYqtG}2luA;#Dh8Dl>Sa{L`R@60zbFCB*A&sG<
z-&RGp@et4~h9H~~xZx~1aj+pCzX`p$W3}@;9C2n5e=jbcn)Z@^RVv2SUB4ekjv-D~
z_5YOzP?z-bl^V~mJSDS+@X^;>h!%uP){%<pSMB+f-6zmz3wI0~fPGS}DX}qJ9wgXX
zAJ6st);Ba!3C#@f;RzW56OV`DR{t<O`eo7@D8Z%h!*AkH5<R<wUA#rY#B~TFuL3sS
zgm>^R{))c1`6~4J>|_nLInFA%Jk*{qJ8hK4Ws&EecHlmLR;L$rj`+K0ON+=giR)#J
zOnH|!elMWu`H36}yY@)DMGV_;d%=s>OYLv&43A#hIK_c<yh$FhaqwT+(IEIcyx4!n
zrd6N#RUln#IbL}RyW;}wRC+VYvH=sWYd70o&Cx5Dx4SX>$4YMNLwEL~Pozt}6YuQ(
z)Vr&(407#(hr40Iw}3K&cbPTPlz5HkJ{c4^H^@w}ARonCd)KcJd%=|NF|Tq$+wG*`
z0A>^t)n|>1J(S_1XjG5;R9!-(<F%q{V63jfSEHY_`A;h~>*l=CD~dwFGBt8rH{Hfm
zHBTOH9$W1A<fFbHdjxSE<`frK=6ipV8eW@YuT>boWYTm_ZZ+u$TQ4D`opE>wHig9k
z+&D4@$RI2PU|S@*|K%N57lW|W8_Y3ldw=Tjs3|UrjUoH^EQpQK`tEfuQ^^`o+wYX3
zew^`<c(zvpPP7sBQw9sNIGxr>t-`N*elz_$VoW`+&6&cy$3cJn@>1YZU3zE-9k@CF
zle=OkX_j<T6<%rQGB&+&#1r+-tEQ$sv+Z^Z_F6aF8keoQ9+kx>q#6KUkvRtjrYfu2
z;72(&#%8yUb0a7kZ>Ojk4H)gQa!EbEf)b}iS2yXqeqX8cyn1J%LkKkv;Xb?GhhG9y
z@0Jg@5CT@owC_w-9yf$PO-`(_)pEstM~FU0IRtMiUh68$5kD<ygMXsjCs_n`&>>aQ
zu}+;iwr_{$U_A~D^DX|lj*a_w*7WJ<?otQQl^E5bMjPOzNG2k4Y@&Q^SAnId_BZ3i
zNS+%{_AVaClXQa4u5LhU{Q44NkLmg<6wRW?`&tgp#D2<@*KK71^%tvZMQsXg`cE9A
z=7xH9>{-844Z<#~;jB-;wq18Sk+DUMzg0-`^mBYc)buX-)-4culmCy39^OkspukC@
z^s?_LUnXS7bVU-%4JbYWDu|1}yE=q{2<6%JmY5~YH$x!KC9%hk{b~1JLW`{b@_wSa
z8Yv<a`3!FaNbtnV!#Fo&T{6M(`ylh+?W@kH%L$Kh(!auaOk{b3Wx>FIDEJyH$GEgx
zfIZ7H5t-su!c_%8ggy@35;kn$6g)RBxriBvc^OE##{OA(?*FRuaOC2!SHA5r44j0y
z2(7SaKg@+QW`q#MlOWChP2kjOku1q*aP1HMo`Z`RZCwqO?qg-|aj`cLX0(eD6Jj5)
z7}+7=s_Z@z0u2#sZ@|elliP<=7lPqwQlDr4niTUsy`<BQ-1T0GVV%hWouSzTOw^Qe
ztUWi7<W{`s(o&HfHcYuf=$^MRa3;(u2|)sf_LhHF>W<`YFF5+ZiAO6s{V-wR`LP-!
zfx8i1Hn+a(VNG_wcJFJjdzQ=6Epw4O$xXjA)9Qpq?*SHINp2;fx1Kl}jl;9m5~0zt
zvKlD)0GFG2wM_yAEopO9+cz|B6gAN$N{*o<z(Uh#9wK?^9w?gN&e+R*8#zWl&2K(-
zAtyCIFSsNq7Y_*3e7Q&aBK{w$k0_oAickU41n@68>&qOCJ-6hhFj(o#Gj$yJ(_Jn^
ze5=7{;)+>NlAk-<?ZFL-*m3C&^=IHM>n!TeI5{z;*MPWm!oJX^Cj7o7WMgm11M12{
zUwXkWJ<o83hQ#^ThikN2{UXJ+23RQuvb3fsP{jyUExZj5lq#=mjG=F6+Xg51>+5mG
zWS8Im5$ixpIRyFJ_Dlf$#2bO_L7n?qQ70tb#!+G`;P!y6_hmBq^=_SKbMPmLX$!D;
zN&64gSY}WElHkpMap({>I_;BhHr{L*>MNOex;lL9xBPCE5uGZ%&weMwPNx^moe%_T
z5Ce@xZ7xNw-UyXGVfOm56yx!2rwQ&w^0!T^hhErM376-S&lO##)HpX(u>1}|gkY_A
zdth^o{V-1Wp;ZCVH_Rt*J@dPa=(`*NL)6&v)uD5~UwXXVSakVRsu%0f4#R%^>Jq0F
zV30eSV`)@OSdG}0BU)SM&sWe;+cNQ8!8Q8P{JTuvX+fHBteR0df)0Nat}aLMI4!74
z;N4K<L0ux1WGrtu>=$I>MkBj?WZz41rT%y?_IhBNiJH*LN)Ol~{K%W_4P$RMq~EBp
zMsRa0jEFuv7YU!2(jYZ@eG+uKyO#BiR<Q?GuhUl*RcKDq=~@aMCcrLiD2I|6{lzQb
zE`Erq@7y}UiyE;{SLvSRgnSIzh6th56uae!4MBMT3eE|P_8%F#6uGeJC-O1rSE$x}
z`-e)(^8ufq;%A{6owbDCs!J4+niyjebi2%RCHFkVa>D0)8kEI)dh@oGt=*7pRNruU
zQhTCF*xVa0pHAC^w2r#deD^l@WsoILgK=(m(rTWnP!-_XNsoFu{@g9Y{ZXmApu4x=
z?bSBV0f_G+YMF2Nrt$ni6(}|~Mzz_I3U-%u;@jvIL)&ypHej=UOgPU4o0hsDhg+%+
z?An{&t--vqNvZN9eJ777W~9a_q@5Gd6#tB5AF*8VXhpZRwQ2I{*R-|0A3GV+1&M-T
zPw(CQ#%jACy@v^hvAd(B&X#zDrGM77?m)GT&gr;2+{|~o`Vo|C4`MyI`BEJ%zsHj*
z4^1Av@(i(8A&uGsJT7Gbt~d9B2gQBaDE1|J!{O`LtNM!-hlb|Y`PlXH*#;e@Oq=E%
z=jqKynO;9Kwml9Y&rHd~0SgGD{H0nKMT;Co;$SAVxG+@VRol(S_^*$~rwJYVRl^Ch
zYiNFSk22*dj^h5z)3eg0LyS0;UygP1*dK`VK+dJ@6_|K6DN*?>TXY~4$yhKY2E)0L
z!}22^hkHC(a_OGO8_)|cw92tRBy}V5?q)B8p|i@z2F!^GV)qFN9xDe8&Sic{>c}9T
zIk=TAWdW~}Du1dDO7EC;$qvNC9`LO+jT(PJ;UKI#P^UN*a_D&ZpQ`P{@c5~rhg#?M
z?DX{vn`-9<*rmP=U~@9~R-g(<C7`kR?3=JC(7J3CovB@(ZrvDp$a=}y+u8-E_;qvY
zIBB2#+G?<(S&|^<mHT;2-hrMyeMD12dIb782>El}$+NWuyQ+nyBl>at{O3GSL#KI1
z+Vdj+P^A@cn@h$EsK5XFxN@|lZfUlZAf7@p=)};YZct>hx{piaOFmf7>wN0*f0d-g
zq3iWC;qZ%vTj?VW+UOHs%ngbs39AX<P9C3)>?5E$lkNxEP}51iKZgSJ<%+iLG4MvM
zY_pHOW$BLRFCZLX4^dOlI?#=x)U}-Y^UYnPMgZZ|^hE7x^2@kMD%*h|u9!<Bg~BUS
zDUsvqZ3Tr<83Y}l+3$Ht>qf>VU=w>42||v-$zh^~i8gq;PzYA|W=*Z3rU|p3P+VFz
zT;@1mb+_qn@;Qb)+Z{(yrMty=^lT2!7O*2p^vz<zE9H#1kT=2)>nkq!CoNp95BjYk
zxXz&JeFGVPL1pij&FXGU2Nm!RO#H0vJ5xE$Q-ywk0T8T$0&B?@zt@tXQ0lLu=hxjU
z&9O%z2)l2(H>hCdk~4F&6xv*}JMg!X!bn^zE4DVm58sz8JJnzOv*2^VfRFq^Ys>$;
zDCD|SOe{$8ad}}lQv2w%LDfEo6U3d4av`N!e|GS0jnCOARFT(T<}6g&KBygZ&AS!&
z%~z5mrK@v3?*!HlndLs|5>_Ps?uLh-@uCGlvS&lhCY$xu@4gM>DK>VDOH=k9mr%$J
zDi%V;IyHqdp?=$jVtE?hcKt*au;^)N%e_>;We0h9!Z%*&&=@?s=v=DUzfpLJ*P8d}
zvxS6|>@D7ef)4Td(Gw_YVv!vfCkzS9jncXbUov8{+vN5gx6fi6vWdv%x6IQ?)VcPW
zGfXu?qFAt?`2g0%ngAymJRuncw^`sf+8`^i^M;((B^h#quM1Q{mzapd5LV8Zfx8g=
zFJD-_Oz%?U9XD%SXKt7&=tr^^nx8_?db^sFB_5|ur+%>PyL`3#Yv)T5o9dB!y{FkW
zkAX7M76FGHRxxZFqlkjE&=&C|>BF|P6c{6yxAZ``nZ=XE6VumpG>I(t_F*%)mE3R;
z-;*0Iv8>o1Cu%)L(OKTgYLf04Dq4hTmCdyci*d{j!8!6}FHl9i_?^<PE2WaHxO06a
z&aG#u&S?9PU?<aKk=aol;8Jz9BY^|U2`WhEJ4BQ9E<Rve%@8E!>-D{3BwDPDMyg*1
zmio|)C=o!9B0$(>&~fv*`nAPi;HK2BqQ9xu4Jy_fn&<99<NR@b7k7PjXS2v}NkSdj
zUTL|{NVGM4B1(;SY;4|JMb3XZ)u!LP$XAA9AFsdo4;5SnvI%#)F=Mbi%rEz`zgyg=
z`9mseTydakpx3nkI#U($`S!LBz<>}1uM}%aLOKv=nMKn@%zsmBh<#+~Zf{*F#Y#h$
zJ5md=@WOc@t9S8QyPb;m&+Qp=x1ltFc)J116|G+jO~!+rgOKy6AxK?9Ac*`0U)l^n
zSm_pdwh$<@X)|m5vHPdc*{NAvfnAH^`hal#3~KzxI-0L8HxyQ<oeR2auM#f=eOiip
z-YpPNW~le7#7f#4?@kh28B9}KWiEct<Y*mU&$#}Mhj>JeB1!M|8K8rgcqzO{HiEnT
zH$zQb=UoR(Ehbv<Z*@_1pt<t|_l=%ZbEW=;3D7lHOAaNT{zDb%!_2YVmYERVrY1eW
zBfG`@!w%NvmJJRUe3siasp!=^EP<;|*fYAG6XC5~o&%*bRs`I(gT$T1^_}GE$K6tH
z-auXO!YA2KbBMag{2G^8^HzNQzM#b!*F-UpQhN4N85)B$Bt_L5Y70q#aA}2_wE0-e
z(}eBmx@fl6n<Jge+<$`}8;IC~#&N|R__CqIvP{I8(z=48^}M}wnt&SQVdVMNmI(>p
zNE_jND={4l)z~UNF{d>MJLLfoL)e{TT;>iTDR!|VWGu!ojeodI_9VA#vI2&5yLs1Q
z;z)H;H6nt@B6eQ>y#<=C4mmJ7>^U?rN3HsYOg;S>FOcVU9G}i9B_sT8$-FuFe&Saq
zt0&h5UzhsbGkn|MN<!-b8z)bZOjGKR4dn`KgsOVW?9i9_jYjj=^25Vl(nH@BTpM|Q
zF+<EjCeTo>oJTzb2f9Dd{B9^HNhYv^2C1HcbzlB`zN7k`G==|NfjwJ_3yndpf@7EY
zNxtQ!UM7xB7`?hO0=+`l-K;L|oMt+smJUXzjQ>Gd?Z~{^|7|ny)=_skJ};hn0Fvd2
zU|q&_%fu{k9E{HT^&EfGBrtpZw*FDydhO64#-LTDwykq%245}rV87k}`MtZ0t$)x#
zE%5GvGkPF=e|a?gP=?j{ZOYO>wd><yrX!QTmWqsm+haQ^amB&aUEiV&MN0hBd*HMC
zpeGE*=pw8FI1ry7nG(0x<l0)ZOd1-l7|uD_=&tsRh$t}u482^oiCTUg;F?jYgBxfy
z{((|JNLmx)BZMZBEP<$}ipPfE1tO#Mt~RjzP>F>|<6i&1Ol^UAR-v$^dzx}4U<tDx
zbo3Vf(DA~gQ0GdsuY}iETF9qz4A%y%eyJBE+Hctljl<>O;p%k3Yi`a}ZPjI)$8j~u
z1y7<P8^f;J-$Q5L`PNii++!nLOE8MPJ&%-6At-jat3#vp1e2cQblL;ks_#%=kDF=W
z6E(3Jg5DN&7HF!xgCE`TBiayHKnKCa)Wt%@P*uxvc0-QdTMZdVF*P>xS7NaNH*UZ3
zdh)UfY%M^I)|?Hg(~y{dZ*S%2@&HS{joc+0hXDgS&$D~J-Wd?JBs_?E;kQRHlm6-7
z=f#iP4qAaFgpZw&>q)WvzuIg6COKQ5FR+@vXGF{ze6sLOtt&z8qN`NI=cC`R#wOiV
zbfu&(SJ&Hpo$Ig88+rZd)&--lW%4xtxhzx={XY_p{(o`=1C&7@)(v)4{rIm_`L2KY
zQpi9h9Gv~{su9ioFTb5>BqX*pZ+xBYxlESZ{BP}@=T}o*wC<6P2uSZlDbkB{DM3Vf
ziK27?r3gsxK>`Q}NEZ-LdM{D}NRgJ%s}un#K?tEpheRMofq3?N?|a7ibnY1U>%Hd>
z$R5eg+H0>lpJ)D_|GKx=MabXEK&<~&rYJM%dO43x03}P5`r6fo5%pwA7Lr#aGRmY~
z7X9{DV2qelz#2=~CtF#CmJYtv^ptxtl1kUiwv+a{RXf>$lCl2q%RpK$=N){9$mf5i
zdI4LJ<Jy1*wGeI~zJ}L^$gII+Pk0miN(=uSAqGo3L0smB10=4(qXhgPk>ZA{ZdVsa
zCh2v;+~ytt?9EVuKKrnA463qUzeTH5s$AjS(C)L7v9Odq@glYE-TYN^bl2^?lO&LJ
za~oUhSDWb1LkYQ!$;&!&=B_1c@~`@@$*S+pJ-kat{ZaqH6|c|7nh$`>-(lJNuh0<g
zmSFFmm09)u@o-6~@G$t!w1)@K99iG)QE5ruv!&e+)$`7JY`K|SltnY5o17T8UCLkZ
zZSUO!DxfJ$MI^C@k_~a82N^(wzWw3VI}4u04H>4NTVsbrBs>>8G`-y^O%)^zZ;yTt
z=@Ci{<1sU&y5Yq`wwkZ4*aJ)y-j%OX2ENcA3tk*m|I6*fE>IOAqTlXjVP8l241DQK
z)yc}aHNXe++B?R_H`dfglfP3%glvm}G<*^){)v!T4znao;kfqK!R?sN(8MrK8<W<V
zItk;M_uILnts^1%G{&1r;*8Nh4^QoRVU$?NfOk9qnW|j>Aa&$@LA8y@eJ-f!y#2)U
z%Z!er)MWYfYI;gDKZb}GCHafBfa+$-@tTrcW(3^Q4>QJ^!t@B<>#1?6K>?>YsShC)
zxsjlpXY4-Bc2AARJG~Azd?s(F&3AqjAxj|mu5ALxU=Tf&Qws52O{3C!cYUog%bD$K
zZ7ANk^=QcV^TvGVy({F5Z=r+05_=c(_^sY3uX^>|e~JC_V)a3<<VJ_<xOEN}w<|)|
zfz{0NiUOlU0eoQI>{%>Hs@6X%^?wF4|DApPPht5-f{X~+->?6jPMWUIbGvz_;r?B#
z_jx2#f;s7kJC~nezHlojvk^gIjq@sDe0^|zM^T7|&f8u3BH~H<orgT!v6!)=Rq!s$
z46`Hg>V+Pm4mZ_@WKs(&M)y|kEM#Y!gRf3>fL4~ob@8KCkta+c#2qyXQys0VM-k5G
zq+o!`#bWIq&L8ioW>pGNOoO9hmNs8x88>-n5bj4ai4d<Zzl^qP0Wc4}D$@NC<gP%g
zeKXuVw+N->LefKCYryVHmee>7@^jxfAIVswI*j+O9weq>Kq-y1A;Wq_IH80L&Qs8f
zM1jj{CFb#~p|Qg&XZf{H#+}RT?e6*tUN_{=82SED?^4^%{P`zuq50G>cj^_vX@dlH
z!<%Gh)ttEPUg=~a7&mp`9EPhIV81@Po){))*I{MKs@Jumeq>Izm6}a*znvE_YOWHV
zof|@*kK-c<fjGI1>^GkBp~oD3)!QQoBUxMCgS%I+7NOd=NfFMMd9a6=LpdT%%X+|^
z0*548cjf}(9+b*o)9Wku{e5wuFu%Uqz+zmM1POVXoz(`dI=kLwo`w^LS{RpBS>>C6
zg>H5M#>5aN-SO?@a!Wqwpxc=C)GQikx(N3%BxNt4Ec&MywX5xSKQ=);Mg^H`jeMG@
zw;nsheIn5nDA4u+ur|mS$5DK=$OScqzzuF22(x9cp!40}l-0xOH;!3PD?~P3ZcqgA
zVBN>SLcF4XNxXp3gfxQDKp?c4&bOsdfIGIJPrC8<a>VP=AHPF8w^`Q#n@?E*bsS!W
zFjL5E+%Q)>2Qxy5oa^%iqZVZ&ZygtgDlsy2*~k2@7O5Nd-vgQ%e9bH3cw?-_kbMf6
zKjqsQEj8CqA|~i}o17}Yh~7e$|0`1Xt!^bu<sm25d;Le9MqC%&y2#O4D75QWQ_da9
z`mVf<FP4>$g8+=!b#jY7A~OLFWGP=JfUmd_Ih$vl<}V!mpOsp#x>Gwf%x+~*W*o|X
zd}~>i^!iGiFc5U{ypbU#fMGdttv(({HuT3kp=HCpRxQo#Pr%F2rDa18gW68srF3(n
zA<+5j*)7_FZ#X&pGS(#ud<P&pPE?e>_``CtH@_-SU}ISExhZRsO-4e<r!ru_<&8e2
z3gbMY5m>i_0Mk6TXL#K_yJkR5zDBO)08_Vdzb#0gvunEiUQ=2+IP+)r@Ti15dYKCE
zgPgNg4Rv$I34)z+&A6-r*3&8=<}QI|yrU$3ZV_uG=BT8?Pg2G71wWQeh;uW@<}y8$
zc1r)D{<i86@}<IB$Eo<+morV%((MOC(#wzGq%b3#JRbwrJMl)>H*eO}`CBQL+9(~_
z39p%w+9G<BKKE@=nD4pig(2ZD3GNZ*xNnMmXB9LH2DN5Ai+ea5J_~rnU9|)bWs9#B
z$?FP}Uwo$*1IiCl96D(h^8*R|=}9kXW}4~jjppR<c$_A>-;@~J-_-Jyg~T!^@t16e
z-z7PP%glnAp;PN^hi2#6)==qnMK~6}_r>+bXnE$c->ePf)8wYo5k9|@6EgYzv?84{
zEcjd+2Ad~J0f0HSQk>Z2lopO5vc+ZsWEC26+re(aT+5eRl{f93_j@@WR$*1WIy4P&
z9{Fi1`N9kkhv=YV^ZTZAg03FDRsyj{kCmO;K74b`{4~TGKSh>vfpXssfG>&zMF%gH
z4wrNaj3z<|8Nb$=?&jPrYZ7xt_fu|U+?UDE@H*-B+Z@)vK#atx0%5`jtbgD1UIdq#
zhWnZ-+w5@wP?)l<_DZ6zNj65UJ&_vPey*}Dz*#(a_2B$?-F|Q?4n%bd4V-%O=L`|=
z?k}84m7|{?qS49ng0_9r#Z`G^>Y){oCj(Z3-6jmXRjpir=QAD>hn)-;QFm_SERN9%
z=kk24?Tkv7z0(WN01GH)cmv>83Ig!#ULT8iZiq3gI;CtMX;GO%aZgZ#Hc!3?GT1qQ
zLOsLC&b7F83Ab@}v%Nsu@j(H1$NBxBPP(1=qP+fY$IET;AHVPH1$%BQD2i>Vi{pDP
z^AzB$gKH~FLwLVEcJ^D7>;s9Ol4E%srR`!jfk{#z$i|`(y0Ok49nS3*ghD5u={4ta
zcYc;|%<(u-VwY|b9HHWVzabp?J>jB{@Ij;Rm=O4vBo0un=?dTfd7j8uAb=85*_&c~
zubY}X!4#kLe*5{wMLXQ_vgI`XY-*{$$C@gUu`JsZ#~xFsK<=k?y8yb8$M;+HJ>MzN
zJq#0FlSX;31p`G9hv6E86k0)NZ<!)0Y`LyaYRDrfk<5}*EJ&?K*PQpfO9>x!*%Z#a
zqrnh<a|aNxySwa^zMf8KN?6OgB)xcW@2H{dODxp~gUgA5JV(~E;P@_Zj(6mlsy(Hp
zmV4FWZm`U56m{k`*$^QIOZ=<HP9l99MewnF75i8%B8@6c8ZjhjEBiy3p>2X|8})vm
zEbLfKzhUFpF{4Lb`-aCQe=DIEqd^Aa#4Zd#68>CpJyvREGnSm_z52YpK*+NyL3VOj
zP%J8}(HcohRDp>T#_^|wkow{3C%ewtE1v{<{Yf(3NniU|PZp%y3!j`ydKvuY48%<w
z^U<tdhI*TX-NJYr!w=1Wj;ULsmVb*2n#vA22aLRKB<EcYU6|z~C-ANxQsI*t2<02c
z@hV;|>(U2?xs<bY@;lAD^|eWF`gHGSewgPpxLDTXZcNMJ(hLd(B?CpfcjR9Z`aoNo
zd$_`c!+;6H`{&Xq&%8VD74|;$R3(&+On%g(rrF5ZRa3xaV5XA5+$%6E>|}j5k)tVg
zFQnegDoFCJqq4J4ZEY^SCRsVG5WC-(Ll4ZSQjh|nQnn_Os=0^k_of}1Ls*nD@FNi~
zN9gZ5@Y8<wZ*G|6h(6OD(x8E?Geq-&fxv~jOzD<x=ErTZ%I}0f`1^bEOWozkcDSN$
zeCzEL*JV-*gdMt#Nj@Hm;I=pRjleORcFe7{gm4zm9ssoI`RQWJy|NI&u!AGDboafL
zM?loDAx(?z^Pk+b;=UdFM}n3mntPL*BA`e1w}}HeXN7NomY#iFwmG-sIXD-uWY#M#
zS({4h#Tzf)NwuK9zX4#M$q1vRg!2cuslzLn8Z=6{-vLwE)YdqcbEQ%{BgU55<H6)T
zY%g!y>Ce$oDOAEAP&okFM~Gg433bj@FCysA#=~BY8+N#hZnt>iB>TiVZ@`|tp_kRs
zRmk6fCxfmcxNNQ6h{`zil+3U&37=)usBG>Br*|=T8|t4N2}dVcjDZER2SCj(J(zOh
z2-j)hHPC&8ySf%6eXu$7_3feB`4GKv)aTVonEky_i|h-5PQbB$2O2dtwf?KuShtT)
z5Luw=yFNOK6Y8EA_`;%uFSrKS(NZ&<Levg;UAJiS_h3GRx8Xv>*&LdA<TL`blNek&
zyfsLSzx^pB*u~3cn*{Sy+{KWvg=0eFNg*kf4-Jv*x+UG)sPcGDu4jIZ*BnW1{)P^T
z9|1vND6h<mcPq*RajxSj@4fAZ5Vn^s4halPs_XY<_=mZ6ohTlVfVxdySv2Z08`K#D
zT;^E3i=c3st>5M~c=Xy?$}9B(&=yv}ockSd3BZulqk)c3;^-GB<K*uLH7!PM*9BAV
zrI36dCTsDJU`G7&7^%%a0LYIevtBKdL#S_N+wJeASDj*oLawITe*X2bkV4_|sz!7H
zY0R0pb6NnesKJM~*Tcs-hUDfET!`uLoBM@r!vlt441@S^mU(WinPqL2l)RkC&$F<1
zCox5tv#vIgqG2CK(TmJh&l(<7n^&qfC3xf7T+pAy>OyoFx4v~o*fLB5!>v{Xe?U~5
z0K%3!E?bK+`%alZI(7Q)-5?(mqPiACGEPYnY3GRXMjhira9Q2Xm<ifJZ1-yAjf5`~
zEYn(nH+LE)#3Z~RPiy^AU2?kEm8paNHFQcLYhWRhCG;=Al8Xsc*EMKvNtxk*Gm*Z}
zp<XqP@-ZtElO<ES1J6Oa8EdU~Zy%gv7`S2gaNBVet+-p|CAMxIQkmtof_g3~PbH76
zEwX>n6v{-VT+Q?1Jm}wg`~s4x&aJPJiQk$>3p!e`D-Yop;Aash8V?b|z}TiE)^Byl
z`%TW~OPjrvuPCjSt<RsGwz@t$m<Q3OrBhNsT@HTXI_wjXTwn>!QbMG{6qOsJYr5Ml
z8N?HNw*-IR=w?O33J#?kNxo0=F~E)x7wK9#sA@2^CetBY_=|3&^X<x;U|--2Y3P{$
z{xIh!h=SXV$REC>fvrwZz%;hl_`8Nbs!9}Zyfslcxb38<k*dD?uxA!;YVS6vdTNnw
zKa2Fq5Am;Gcp3Or?toLn9lkW9!BR-Al<Yx7wP`rG-F=IaoDceaYuh^=r1rG?<#8(b
zCR7!Z6%DYClu`nfPxECaSdoP{91tE8E$mz5KcVpPsTdFi%nYZ6*Zg`a5-z%99npV&
zC`qv?S+X4aDWLz0aEF|z)kcQUriWsPy8ArRvyj2i@thkP+Lw)j<L9z|f%%%UA9DO9
zF%)gR^_fFLBP96}V%NR<cw8hDYMN9y=t2yY?zDe6%=&1ly=7+q5ArvVA#8}x1?abM
z-iW?7Y<9xonPf=PKF>pm*gH9k%rXh4h$k_m>C2W_Iv51IydHO0j1#~-@5Yt(5yh~l
zc$Cm;IoHmwj%Ql(Fa4Ruw+F^F134ZJt6K(wDy(&5x|E6*-B5PP6*g9=UB+5--(jYz
zHf@LmHQ{&oJ&Tm0v{j^_hO@>iyE}wltc7I@h_xkx4yt83e-`TA&2G}#22oHu1Treh
z8)PFzl%3B%kKBmTtYv7}%$v~{2F3daBgWyUgKzM8UsLN*K_|pcP!alCgloh#LO&il
zqv0yec8ER7_H~`L_ZHe{OBc;qHM&mAA}hKy6qHurZ!#0{0{KeiSF#5J<cg4P?VfL;
zA-^tYC~*HI^ZQL^ik}x>BIpkm(uuQZh6_1tKb{L0(T}FG$u$OP&j_?d>VMx1D^Yau
zUs)LqQs#6p4r9Ou_aZm|Q7e^lr^Eb%H$_WUt`qL#Kq=F2gCWgfw1gq^g0RA{X%=W{
ztjT23SSTzjIUsDJR3&eW%QbWI(Xf3Bqz4kaDwNv?mce;;7gW2ld>@Dx?3>eAk!#i)
zXNy=CsDe8Ij2O<ue%&Fzy{yrqIwWcWml-~R59{ng%c%x!<oy#T;Y0&t@Lr2ZL1I7U
zd<~?AS=1rp!<XB9K8f7P4W8Ic`>~<^YaQW}CC!vdxTPCyQu`^NQ6X1p?%mPKW#VNK
z8XDpMWzi)3iN9^CNX3upidoYno8!PR@bMtWrJue(c;a$p3cz-e5x;3%Aqo%x!Up&{
z&M3GepLpV0!C7Jmmtgbe*Jm^}BGE@dNShIY;WPFW;mq#(m?<7;7Pq8X33E%Wo6x}5
zdl6e@)mPh-Rks>$PZ=Bs>>~Igo<m>SDx9Jlz607(;}}P)#t}e6`BNw@=&|h;`W&eM
zrhz_MN4^28z(P~|S5;;&<kl5%>cgnIK)PG%_l|7k(><JYv+ny+y?wy{>M<Rnq`iS)
zz{*p0%rO`k9<-u+s!(HH=8;wRmn0j$7oKf(aUZK#yq1RJpL)`q-S=Y&uF-tI2LFsS
z=~MO&N$+F`RZ7cN!9Rr!1z;}~g1_zpt($et!TVc2s&`@QMv@J0$82g_$z0J8Rl5ol
zUsr*C7}spXa|j=dW1e_(X?53*ABjL$TfeD0Y(7t{e$etc$zY_|Wn=6+GW0ox3ly@>
zK9m|&$b#UxxK8K=zy{2_2vMdbH?E4escxZHK1B!pK77)YDMp%|>bia6+w(O&C)%@S
zxgy@~PaSMN3L0O@=j^;tkBs<T2)Qu6EFv;q+?bO%jo@?Nb*@GiXVEH`Wc}FMprW{_
zGDCZXrX_fyho|DG*5={3se5zT=Ge&$_duVS0Zzk~YG-Iek1X<iC$&Jdoe<6t14^~u
zNJbAKBg4g}H*f)5^48BQOZR;)ODLNy+#JHDJ0`C97v>)2x#T%?jSujtE+E~|i|*@Y
zg9XuSKx0L!{F$%&vm05c(0uUSpQGNlC{N##`cInZK&%5A<jcAIARkQ^+<)8PI%ynk
z<z<|-jeps_VERkaMm3O1=cd6f2{Xe0heVrwTGq3+n2K4WYCPwg0R3Y>XR9P#<%daW
z>0L3?gkm7|n9A<5GJ7qePlMTQm8&_iU)VO?=1|Sf%c<Qk=;6q-LIu5TGOGFR;kC*^
zfLfcerV#@R^{xZ9C7KGWL0`d7g8J?%I%!=@S<1S)zk@P>@Yqck0CbxOq9t;}o?Lb=
z^n+N|&UI3$BCU@U&Y!f}?=qtAzk!W7C8v%GTy!?P1eiNXYVT@{A4eI8**gdPoWY;S
zR^_}7aauv`Ut0e0Hc7=t5&(eBI(s}q1d24mDc}psrb5bEvhwlTZCUfHAv|Mcg)(v>
zP~O%;>)*l<!tlA1YvHG(-17%dpwayZq3N6%03oN73vss^tkK{4oC1AMx<?<<!|St%
zLK{tC-2uEs?^Gm`<sh7C`LaL~a&Jzk6Xab$$V!=X*7~sZ4o-eL<h})8`b&bh0$9)y
zOT#^_2sJ`Yo#C48y)l}pIEl5kme;yGF<I=NA2_9vk)V~;Ug=PiyT@kITRqON`_h)O
zhbqfFAiB@xd@P@H3|%@qIr;u8^$ik46o76F+Fv8Gz$ns}HRlmGT*uc{yCDyw54DVD
zxzu;q7=P-ED_Z<e)x4?#KHEW%13aHJcA&cAhFu|S1v*zjqx%#aUS#DA=G~g-zEt#)
z{i*fK5xVqB)dY+k9&Nwaw`u`=1w=F-Ns8;N(e&9Ag>kXloxZyns4twJZwsz4mc;Om
ze@xM1)q=Fx$0J*h2U7_;!c5jXMC!!5?Hw_ZDXQmL5{=nUlJ__xL46}VKR;Ioh^oLo
zit1+MTzXG<0!-8JQZwO+(EU)GtxMVCsIK61Q{rsv%gO=x>jL2!1RqpPeDttc&+GJS
z)ssEn<vUvH{Uf^RP1m7GOkMRf+_^Is4{;Xjl`&vN7(KzI7UEP1P+v>k$GzEhHrtz`
zlqjhp@|i;fg9YmRkXQ&B5Guka+3cw2yaXB+)F=Y07TpyyI?7tp>%Pxqh-G9x0CA^s
znscr#TseP8fb^g_fszTbbl%@_wBpily;a|N)7>Wfet|+PCu4eOusKSPoYhOWg+7l@
zEWnw(m=BQe%4`b@!z|wwHYLq=2JQbq91VXZiWAD$FNN{-SdBiLJEivY`yKS<RZoT-
z9tl7^_8K$a{v;vaq;J6`FC0qZ!Znsa>)8VXI5ss+44OmngLB|!|9P%vRWDU`o7e1l
zn|M0ScD;MUG=dtYL;#)p!@ysO+-@_w^Bvi-fg#&gUiDImdMOFi?(u@o8x6|vS?Pmw
z2BAYBD(Kx|dxpcIWZq`d)4X4`FXoH2mQXySRo$jGO5x{+?PWJjD-~AS?4wQ>C$SUX
z|HQ?f)|^+K+-h%*vhd3Nut8p+u3tAcx}cD++ONV^yv}QOkxM6rvZ-Er+`9Pm-qF1j
z6IKXm*I$ygUqh)tQ-JqETsn!!z1mI8q?pU{6nxty2>9b0P-~!0{u2O=U(>!L@U2F`
zejxyU&9!Znf8o}-VqxX|lPOV(R$Y#9MHVI>)hjs*6-_mywXzK4e3=4ZHv&6O8bZk5
zkbc889M=`%x!z6T<q-oMoImy6N=Leo>TS6((tdC<f6M1XFTR^V$iTn64?)G@)Af4H
zxGG{^DT98}#CGqm{~ERj93Etn@}cNA3qLLU;kJq5T0GK<zeiT0uJc?ARx?wmk21n@
ziKcaobBz=R_6Y2_oe6+FFG~@!1YOL+>lOz3JwEx=9^%b!wa#Ix4|3*h-XFf_Mfj8J
zJP|!G4$ih`f(c`PVazi(&~NMnBIVyTH=OIh`J1%FzklTaa+gy(bCFM%^GDY<{!5DD
zWftOAr-+2SVIGe^s<{-0jskNNC+v7}E(6-KuI7LEGFiUT`UlL)V+Wb;-+Zt<-bq1{
z<Ue87%sS<X-A+(b+MpAY^zX|lZ*8oc_$4KIOTSdjh5Kz<K?tw5Z!)eDV`K;JBG>|S
z7;byk#W&W*;E>mHX(|$F?-*X4XT~aK?Am`whq3-MT#jbx-+(MRVvb7BH3XY#)7^u!
z>nbGY?ru|QCOhdoTA=4Q4Y@fOdOQqgxe&$a6oYy-m@j0y2}?Ly{pOZ)`^A8>HntgK
zriRQjfi21RZ+UylUOnBofrGrW(9i^?Mi>al0T8{0$BH|~q@{Wy0)vjXHrPk0`FHB$
z#n07-1HBo&;w4;XGI^xF^^D)HMJ`FNO${H%S`Sr6Y#d)#FN~I26R#kcyZ@SZnl1Fp
z<o{#&HR@xmy`*f{Ps`+?xPcYotxIJ1^_>oDs*Jvul#L(JBYDj}wly|7AYQ8XEI^Yh
zLVb{iVhZ6}k`VQ}{C@<b|D%3Jn%bA1jV)sMJM-VD)8a!y1nDxni-72jin=ODSVX0p
zak*QosaROSfWdiXjvC#NmF}3nn$+Dr_oba8ayTzx8|!kPu)F5Cc4+r!L$6@<2t^!z
z(7cS#74Ot1Pn%$Ts)LET!+Wy8dJyn{BGhs_cAlf&`TYJ!0{j-~@lzQa*EOe;$etQN
zT?Q#YQ}ODTIcioLoUkx}d;ceJwar%vb?becS(ZaEd%EB=ZaF^7%-``sP5Sj(_)>y+
z?S=Uq;`(lfR3s(*pJNW81hsF`npTv;(L4}ensIw<y!)>5VkAKPLJX7?%CV+$5UkGC
zVH^Ze->?uYvM(!#b+V*bI7j`b!A|8(rLoDe55r^BRAe{aiqj6-Hx(WnZ$xnE<7fxN
zDQ3?kU;1&mZJIC3RiXGSqp4S3ZTO1{cZbnvvp;hj4U~?wr%_0a4MI~XK(3)ypehqg
z%JREP&A!y5A`izy62|oVDW`-BjQzu@F0;WTFr~TX33p&jy=mr5lFzE5wIgZ7#Y#AJ
zEG<XJZ|dE~H9byck_@{`ZFa}TZ6qU+<>C&Zv!pT(Ap{Ly7*K&he(3U!xs1ac{bc$@
z1)`giQkn}G2@kQ`Jq6_Uv0zs0WnFd*iwSb6+-QEw%eL%;m9z9`)lMdQU4@;1hdy8@
zEb_qfTn;KX$QCY#MZc=`R0vaXZg0sBn3ViseoZi$cZoHcM3XG)3J2VEn#f0x>$eld
zQ6&dRN~s!q4{Erm<d0=Z`{T8p<9s9@d(iiIlED?0zG^SlhMWSeF+Ll@xHTb~EshF+
zlD|1*8#ZkRdWk_J9}{`LraL}mz4x=dXUNx1_1QTqaXiO9o*!qM+P?ypytf+BJf!(<
zAj2i->~(t*&ndT$jEpkt886Edi4gQa;cGM<QO4CBgN!c#wcscVx#I;=FeW?b^RFFm
zcl6dWpQZJ#e*&|?fK(!^Y2Udq;TdK}UO7<L%B!pC=%j;`rE}!V@RbxwAK5VDm)$H+
zg1}xgNGIu~n)|pMpjBf)h^ScJe=zCgm}YiSwJoeVL%M1J1eM=qdG(m|3fvKw{pvyh
zN7*-Ph|9|5t9Ew`@s7CW$96@kjz|Amv>TO34`YG4W_?G36dM!5WnRNEbt%;j$5y#s
zXOB6`^{swE3`RYPXXUMDsjU|<r>^hG=zc7tA#<}GUg26S)3_ZjMli;rhxx81Vipp+
z)ZJ^KeyhqG36q%MGI#1_zM;u8XC6v(x}>C^?r#aU=L*0vNxJ6AKAKKV*t7ISurG&D
zhk3eH4wL53Ut>r2wk!aY+)Vdmf>ht|%?bi-AD2dwLLtbl!@~!lBHp&qj0h@ko8m1J
zzuF*JMNLCS68fX#k4PC+8cd9!S_HfC8D~ncKH4~!8~9V(@wp+xW$B>uGuf1l&qod*
z)g#lv$Aq1Xv^xm!_7p#60`h|qr?UUP-CsYdDk5#4Vuu>`7pP%Zi!luBmKEitduhKd
z6ld6I#hiG{s>%JRv}}1<Hg4rl=OB`Pt1v9O;7wXTr|bbPds+!2UYjqUN1X3aU3%BO
zgb$!2LDa<CHdZzl`q+v3=78^sR!-M4dKez051I8GCohgral)UJbU3HfZ<hTyYW?=1
zR$V^lp}p@Wk&M8J&A_C_Du5^npg#P|=gGB{?5({<@d3PQt;``YiBV-yGy*&hUCV}-
ziAd)|4qIA=xcRGIW9$;Ms?ynFUrJ;rjh^ZiUA%UA>qo<SM#m!I>9qXl<#Ej%FSV*L
zYw?ynGlKd85Ctli+>lHcs^0b5mEdznsm*jY<;hV2XCHb>9UmXL=|@DK3szuR#vd1A
z;IW4=FhJ2<Z)fX$mFcNP-A1Z67U%UcZ!_I}uBw*!=~2eg3D|C7_DFn5H#Y}WDC1t(
zn0nB=E`1%c9%h5V7fPPZAp(|-8np#KO#X=BbrjY(SlisLhPwhCmQ*srul~0Lt-+4_
z)+x!}f=t66gK3P1DGmb9Ocfb>CdJ!IK0-U1+T@p8QQhj~RlRnjFNAy%6ok+<bnHt3
zf`3oPlb1R<C*uK6<MZE5sCuRSJQ$V;*-tpwseOzxQJO}Wh2||JUfjeWK~NydpqD7!
zXbjPvo7VOByy<LpUB-i{9P)sH-27WiX8i|e?~28to2|{s{PC1N)f`tp%1x0t)P2>J
zYm+>s761PG*D$iF?cf}zI<P$yu8cLys;nKkZs=o_CcjL{GR7akbe)9rsR;>Z4{3M)
zg#u<t4Gg>W$F}+_9dZfWzgf8yKGo)ux#jqLqRVsW_K>(&!VEMaUEjbM7}tHtRIRNz
z^ZoaBPhnH`!Efx;;BCS}5Aj;_%vo;OI_I}7e}?ze5t6n`7C|OH;*Zw750<d18*DZ7
zojCSB#hlhk(h$Rd;Ql+Q=SetOxq4X=2Ok<TPPku5-G;mW$w}w0&USDg+t!x3TFLmD
zcb}~i1~@QNd%$kHF+|s!W!Wldg-EwYrw^;fOI(>e*bJ<9!L%K8W7#om9jn5CqvqUL
z+FZoJCV$3QOb05?nTdWn43eT(o)kyBmY;RB`fdk>?jx%%lce&q;-X-Nm+!;LVfG8z
zgBpx#Lf$od<5!n+v(jD5TpuYXCz-U{LCAyQ0L(uc2&x7GHd@1(uy)y$siljemY#L9
z4mX4a|D;2NQuNi*jRWQ$PcfQ4eDE&Uu>6#(oaJ}=-0y;4_&b*$0vTBUlJt4{16MFn
zX)BO2tV$D*qx=pUwP4&<+wfAa0X(w6zH^O$tQ%g3#Df`I7g|J~Su(j5m_1`kzlY(~
zB`^4P6kuLx2M?4A4s5M0teI_TxA+c?hy;*yfL=u>e;8_jm402<oCslFzRWO95q_8W
zUa{lA^Jw6j-bNCi`)rpGMuVQf4&-;gRugi{@k%Yff3vmi-k?L0Qw&AC`gw*eD{H=y
zw*G~m_qR+g-_*X^kl}%;*AaBY+pcK<gU>F~6TWzl=;5Y(vlMtis$>QV`uOOC&JwvU
zZUGI1(0kr=7Yfs!&Aed!Yj7TtANtfo+d)E$8<7B88Q9R666{uC1ydh>;&*>heM<ga
zSA8-y09w+;hX9oyfKyB9Vsx%{XF5FbiU^^dXnq=kcvR${<kyo&A{S}*I-D7%qJoS$
z`&xXrZIw3GFpN+8JJKQ6iLpbcIBM-<<O$hq!l{ASs#uMIl-IbYWhRFmUU?r)0@VO=
zeDiT^zl>7s8Fv+Dtx&6Mo;aIH%`_4!FOHP8LM_{57IWE*piW7_R<+>`-B_5#hW%@z
z1U4dayQOtOp<5+X+|Ao|W`zr5<l*Exqf6$de*Fa14q2*Mi~RtcdibV^TuUlX?5v9m
zAGRl5Z&NxUae3=R)^>y6$%(&8E#X&=sD06akY9l^R_QfSkl^sEH(Ytv@!P5KeX;M>
zW0r!E9LnU?kNN=?+WbR3hIjIRNf!O_kQw-)g1QD~@U@b;Y}vG);O8%XI=z{(&O=%x
z?&A2Q%iJ>ny$(2IiR|b-i&h^3b8oN(S8Vx<V`)_V5%;)E$&I9;2O*(`oGh;nUqRuG
zB9&hTpB3MG^-+e3gnn*Mq)cu-0#z}Ee?$0C?2aZ2=Z2D^jHw3Z8&Ue}iQRUq%APYG
zAxn+J1qO~JN!tzZdYE)kKL&nnhsc%OwR4(i82Z@n&NFYWA#U7q4!R_N@R=y-$1E`t
z2|wTO8=M-iDj(`Sv(sEdM%#g~!2=OM9tL|bSK%8qSNytFeGsS#WnH9K=ZP0Pe8bZ?
zX_X>tLa849|7BLd|84FGfLi%CUSRe=-D~pn@BRhSa8Vij>-D1}EB_Y<L>W2r>VJEP
zqwnti8zZAx6!0&QrD$5^!Il3-_L+9&{ZGs1|6C9#c@3=pU%rPVrC8uM{$2VHyvxd5

literal 0
HcmV?d00001

diff --git a/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug1.png b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug1.png
new file mode 100644
index 0000000000000000000000000000000000000000..d9e763aba977c5d927b1ede737a2f790d15f2867
GIT binary patch
literal 273630
zcmeFZ2V7Il(l~rVLhoIr1Ox=6DNUqBM4E_*h#<u%MSAZw*yu$-KtTZkrAkx;1eMSc
zMd=`*^j;IB1k(NopLW~tyZ64|`~H95{od!mCX+e4vpaKkXJ=-259KRm0$@9<YoH52
zAON5b{sELp;FL~~^9=wnG6IeQ06+&oqMZR42!UCELtp{`sywRSF!UGmpufQ|-Tj-C
zDb{WSZEfU*i^jSJ=X8FOW^K6c<>f}j1_16Jem)oVP77IFu@s`61F5rsMU()k>vq0g
zS{E*y+o$l`_dfi`wLSQ=1wfz7KCM6S{}RM*@8D|(vTy;+ZENpq=MKWJ0RZ;M&dbLS
z0BH8{B7uHh`!JXQE+4RgARMy~JN^Pc+J|j_fnWU0bLpZsn5P9464UkTK8^su(hcH;
z0_+??8Z1~4KIUQX>;V9*LLjW^?(S(1!q-4p0?gwD!u#}9Z2y9e<6pqnuiO4k^ZIqi
z-{D_)0ZW1vpK<o}a=RY<^T&VZhr63UD6gN_5%81A$w&Vp_{{~%?W?P&;Xcd+!YdxO
z=Z!&_1BCI;Aa}pOR18l3`eq;u=BMJf^VJ4r3GjgMG5hOh3_+M5gmpdK&hJ0(eZ1`r
zXI%pjW&`0MXFr2WAbbFXV;p>SOn=Rj=i_<t*Se^xZ}@0y{fhr^-3NqzscX#N)odTX
zPk+P7!QfZ=P?iv<OXeV+0RW()0nV4tgD}|hpt8QMru*#y+W=J$anjz$|IFj#e{sM4
zq9FdFgNNQ}5C(aH2Hfz`-RFHjf1JB72>s+8n&;$fuwNFG1N4=j(<N{u?aK$+Vt4&#
z`$1ly-3}gFzsdv};NWYq-!?EmRkgjt866M?d511Ic$n?;yH5x2<#&3&F0d?&!OQLE
z*Z}dc!wznG`}o5ktmqqH`fFL(Wj~)w`*^UOup3@}7xrZcwi6cOa{cTD5C+==y9b;D
zw1G2#5a16cTfh@=0i3_A)U1HNez~IyTnBsrN5BD)`4#h93G<(KJit#=AOu(iJit7@
zzn44x^R5FB0OCo%V}B_t1Kjv|H{fRpS6~jT!5uIJ+`!-dAnX8^`K`9gzzm3S{{8oF
zwO<Em+JWtL1JnNfe~kYP`$tYKkl%B^mi7OwMj_VU%G2o3oT1UD(WQ}u9fE1X)L`ep
z&r@KMhpE6${>H~2`Kjlqd#I<V2dF2ghmp>=eEvp8M!*Ef(JwM|0Ok7^vVa`{X)3`^
z!!$tZAY~X2><}OWQv~bLf+4_~l|ZcauN>}6<+msDmpuK>0r1Du_%$E>F?uR`Uiwq?
z5`SBg<tU5NZ~Xq0^<PTzm$useF7Mx3@b~rqamN|32is}*`_uTf1<)91CA1yd2<?Er
zgVq2-Pz>}9v=jP%AO5v|-Jeg_@%P#;{%nsc_*|TS&+{9<zdiB&{^5J9?AYQl;xAPE
z9D@A7{tRe)dIkG9J39FZX@N6>gOGuTovgHw{4sfX0N9^j_VWP150jts285^c58Ul>
z0MNitD3rH<;Lc(I;N=N$_}Bh{lTZNwc18gBP;2M!6YvW?*!~was3lmzk#-Oe1VjJ{
zkRN$K8BhaG0Xo20z!<m$Tmi0v{nZKV=RQCn5C+@?qJVhd9*_=X0l7c{Pz*c=UI8`0
zJD?G013m%WzyL4`_MTZ_8NdSD009Dl&_b9YoREVMI7AF01(AoSKr|sbkaLiWkSmaD
z5J!jy#2*p{xebYjq(ZVFPaq|bmylXWBcub;0~v-)LKYz#kUc6W6%!Q~l>pTdDmf|@
zDlIBQs!LQhRE|{MR3TJ%sFJ82P~}sVQ&m$nQhlNtpqijsrrLr6P(~;ZR2V7)Re@?l
zjiHv%8&Dr;1T+qs0nLY2K<mKg+y|Y2u0VHTG%!w>5KIQ_!TK;Wm>tX;76D6uWx<MJ
z)vy*=A8Znag^{V5srjj;s8y*As4b`+sROB_s57XaQCCs7f@5ixdYguZhKEL+<^(tv
zuh6*AgwiC?Jf=a@G|=?WOw(-9($XHJm7>+4HKx5z>qi?!`;fMr7DL-hJ4=hFW2A%A
z$<yi5S<-pX-J;8&E2XQa>!q8gBha(ai_xpn8`Im<2h%6h7t+_!chS$%6ByVT#2GXg
zE-|<;++=vbP{Gj3@QvXIBO~Ks#*>UDjLwXaj1L%JFn(a1WZY%qU^>dA&1B8w&y>Ve
z#MHnv%=CkqnfVCwDP~J%KjtLn66R*+F=jjqCyOkL0gF8giY1$+nx&Uzjg_8Nj8%*E
zDr*R925Tj27wZZeJ=+mBZMN%d5p3CPwQNIdTkM?d$Jve9-Pse^OW8Zv7dU7+j&SI3
z*mK<BDBx)3nC66Xig0Rk+Hv0IEaYtEoaLh766Z4Da^Z^Sdd~HQ3(L*Ht;l_uJBT}*
z`#tvr50vK!j{%PxPcqLdo<W{HUIAV$UI*S--U{Ac-kk${2TmPuI1qOLePH0g-a(;*
zItN`3rW~v}`27&<(9uIChXN1f9BMtZ!pFs@#%ISD$M=eFgrAE4DE~$NQ2qk`PW~+c
zK><AhFM)>w%>pZeJc6eLT?Fq7)(bAeIpLacXZU?M2EHW3Eu<ynCiFn4MF=a*FRU-@
zFZ@LKi!kA^_+hidw+^EZe-~j8Q4zTza$lrL1S<*`H4+UIEfXCPqZd;Va}vuGYZu!&
zB7VgDNc54KBMagO#0|tl#LL9LNia(wB)lc^CHf_4Bvm9`B_B(6AEi2~bkyl+_R%gW
zDk)_tXQ{_hJ<`<DC#5~4^QDJmm}InM0%Xc$CS`eK&&l4Bt&v@m6P2@+OOb1rBOg;b
z=60;`*ywSN<7bcGI$n2tL;k3|oqV=@zXG#@t^!KojRH<lO3^_vNAar?r;?FUv{I82
zN%@4bk8*|b;tA0c*G@b-F{Hw!azQ0Q<-<wplc!IjPQE+2tE#N(r}|2DT}?*KRjpKQ
zL0w$kLA_9YTH~<Bb&V$)6PiMr*EI7qClJDj>xg{B)G3iu_NShmn%9!la?vW+T04F0
zw9o0P(>vO#+Tq#_XP{^F&cvPhqQjwMrjw;Jrh8b|QMXJNtEZ$Fs@I@Tt#7EGqCaFH
zU|?rZVt_q+;%xZY7DFaOQ^PF7sdGoq`JAgWqB1&blxFnpyx4h<^EJkRv4L@#@%Ibj
z7rZaLHK8%NV3KVzck%eeu#4@coTf<AQq%2Ar!OU68a0zJ^EYd{%zD}Sa>?Z#^E2kD
z<`Wij7U343t{l4JeC3TLt>tCQXO>%5I#%gcv(`%1QPzVt;x<7x9aj%sb-Vf=$%?#=
zth`2j&HP&FHR5&S>-pEWYz=H5*<$Uq?K16_?N8a?w_kM7a7cBSzoBs>^~QpuhGUxJ
zq7%X?!)e7?+d0b_=c4bD>$2l&>{{eXaWi*AyVJQ}bFcN_@No5L@f7q7^6c@F@{01B
z@K*Is_s04d`aJW6_}cis@#6vw`A&Zc|GWN^0h$5X0r<enft5k*K^{S!!AFB*gXcqZ
zL!O4hLhVAE!i2+ahE0ZRg+GaaMA$|&p+r!3P_vPGk;OL|Zo1z5eCyb))LWak&2QJ;
z5x5h1XZo(*-Lfc_D4(dIXtn6v7+8#R%$Hb&*oU#?IQzJd@yFsb;)w}%2_F-WCq77|
zB;82*lB}GZbC2ep$GyQ6L`rcgdumAPbed6G^?jlHarZaVk?9>7iW#|?44M9!6A#Wk
zc=J&7;k}2%ET^o2?9<ukNBoasAMHH0f83jMDyJe>AU8gDFV8ve>l3{v)%i#AGYV)5
z0t)5|FBi5yRe4(S?9j9LXQU#JqKV>*#VsW#N=i!kOOwl}%KXa~%dN}1pPzaDrb4FT
z37Q8T{{nd7|6=LowU>jh3|}=>s#I3I7JL1uinA)N8d4oxjjeI2nRs*MO;7FF+NL_S
zx~jLbZ;Rduzsr8l{XV&#q5e)i1rvhVYVc}UX>@FyZbCMVHd{3Jx0tkiX*F#9(5Bng
z+^*G*`JnOPU59E%?MIc5HJ_9}Rd*_NR()3bT=hlyOLf<Yt~cE$yX$(?d+K`;y^Vcm
z`r7&p`acbvALto08~i$CJv8yv{_Dc9+c0h<V1zIl`HlKp+;_I`8Dsoo`Qwt~=n3VC
z_mgKPJEu&iMyKtjmuGxuh_iR*nCCL);qxU6@(b@4br-vrtd?e%y_N|pQLF5$kJcpC
zUay~8@5EYQXK_9_%0|MEgFlKk6*rr<E^Li$yKfVA;_wIY#k(rI?R(~X^MpVmE%5<K
zl2k`FB!8p0Qz%~7eXjqs1)$(3)eX>B-Y5b9<|_ce*$vtcR=@avKXX8S@mWC_@@v{h
z{|)?$kGOvWv>|{B(0(^r0j--M0C-Ud07pRjtkwW<ff)cUodl>96n;-Xi-11$Prq{i
z2My>$<Xt4$y4(JG>#x3k@i{@%Z|(luZ;%@W1;za`fAvji0NCkZy7U*Jki!5KI|RxO
zp|k*SkPm9mNCB_kYJpHeVbnCVbo302V1_C-fC>VIQo*3q)G*L$f`o(j0T??qhwyPN
z8cvhzw1>U9<Zq@tp%Xd%vXT2@4^~vc*5?*I0}t<kgNMY9h)YNwRa8<wp>k4H`;3mR
zp1#3Z(@SQT%|Y|b&fejMqm#3Xub+QFU{G+#?K^j)qGMv?Qq%6IXJkHjn3Z2p`1Dy(
zaY^Z`%GXuZHE(L`nwnc$+uA>LeC+M(9~d0^Iy^EtH9a#sH@~pBgxmPBxwXB6-`(5i
z3j#oYVe5C!{)R7hkS{723<{&&=L<p=2qq{yj9U0O4TqKq?R9U?!}2%jxK5`$dD%!W
zqHqz*ZR^v+z$2<SDTdo;?I&md8e_NqOPu}A*dKh2g02PC&kIUL1*L{Uq0}_g;6+0R
zT3$3XbPRMqFNR+)rk@wf{>A$HMFELGKpHR@j28T7W29$f`?oL3cQ9O(K^Xy<pb)S#
zLD>NWKqBVHNdSMQ|AGu^jd_EX8_86Ca0^_<OZUPnZS->9Lg%I{1_+(ukw@x}4Iw<y
zG-FHR26(+m8Q=Eav?>ob8HN$Z?heV*C%3r0pN)OU6s^(R%g3mTkP0wv-!Ft0oFe6(
zsUE92RL+JWZCou#+kQ<dP?uI;j~Rz-G3wiOJ@6ZiL0h2exOb<}U-hr{!1MjgKVVo8
z?#VaF8t;sFFV^QasZQUcj;dm`{FJlncA$M~Ypa~I(VxNEO21M^h^gX^{0j{_ky}zH
zwVr=8(uj4+k4w4BWpax8&-A+t;FRt^$Hl*<6Xw+orq-E*PPbOUIb7H+P8FQIM{I|G
zH_1RmDm_1>P$I_Q?Oq>$`P{R7w79*WpZO<KVkiz7CwpjU5_!9#%Bit^q(Z;u4xz;E
zLz%Y~xj&?4z2IHX>ubRqbGr9Q^2Gz2=sVtQ$W<j_qwV|YWM><6mI~ta1O<rZmD4F2
zTS<OajDC0|dAp#e|C3l-^7HA(_ex@N-CoI<SCjIp#+ko~<+dW}Y!<>3I}g06F(J)4
zh{GclW!YMckjyG(8wqJBJYywF6h7jGY&ox4W{k00Qk8->=SX6A;@x;nv8$WrgR99|
z3Lm;`S?Gv5o<p4j1*$$?#aXU?n~q`jS#=@QVQ7MWMDHM+dZH4GiCQs^2@6EqYA6`S
zOLu+=C{LxHzlJ!s2{V67)WRh_#u6G;hZ2=8)4LX0sjnHID{e||jp4?LuXtjY&2jIy
zpAyW%E+l-O^5p4|>?^o$KkPj5V9KluDnUcHRA^en?cwYusTp&7a(o3<LDU|w!#^Zk
zcIgYsyz(g4wkN$afG2W;tMpo>T!mh}>$*E_6PX`dmGw2q^IUbGOgA;XCr8^cjewiE
zZ8c6MkM(5Q^6#1Ga8nDa;p8UZO`h?VZgqi)>T2#j8$LDcd2y3`mGqp<DeEb#NT#d9
zL>E$273*qt=yI-L*x}R*;!$B8q0dB=Ptfq+E9kf52UwN%(#+&mq^qnBZhk)ttF5Zj
zO|mG2r1V4`v=F2ddG5;a+-dvpg(cs58XP8yEE06JxlNGso#Cp&g#>jU;jXKBd+cL%
zBgD^m^KA++Y_<I;d&2H*O(a>UJhSe|#@W#^;m&&%Az{ydz;|3XKc?$nS$r`q1uCyA
z_qj}TfIrhOGC)y!{?uOoTzkzCkyGJ_#(KVfb;FVu7SguPbYD&!gC9)}P-hstd$2#N
zh&teV>W?G7Cg+Xqy(j=zz2tBZ!=Q|6liVttZAskWajMT+J3fYgm3zv0B9X5-fRkuL
zda6`h7^L?|=uLP=b>2oXuZXlN1kc}#KdgZ`-J_H|Vmj6TNuc@653RY)>T2YhQdV7C
zFIvyGdK5kwOK3$^x5wGx8*y1<hH}x$3MaOC?zG(WD{i5myL#8^;K}7~2QSyvmk&P7
zzRX~yl`?iov#J?99?mgb^>#x&%kO(Y>42plvg`*j=|M#QI8VKd(UIE(aXiGK_la%v
zmHwV5uLSCKY$8v1r}`WvA^{5E&dNPUXw5y;rz0K6sK!V4P(-}<G`+|&GEen<+A}9h
z|N69oQ9VaTms=|Nv8VHoZUQW~Ub{}sBCQHTN(H*UEFv6HqwwbT)iGZD;`SnMM)kYC
zDM?8Inib~!N;!;EZZeAYlJofMo#wAfD3%$K<wK`mzbJ)Ir}G7g_cNI<id}wNS%s;}
z__!^WL*HLekofUqGmI_dmPBH}<MCbSO`LMt6DL8*J`sE~L2fzbW4qrr9U(9Ct%$I=
z9U;O3onOyQywpb)b?z-_a#MP&{$O2tJSs^?MHKo)Vb>2Gt0@=8i94~<j{bzB0NZ}%
z$!D)XUB?8I4<F3?axO(z)4E9A|KN1ObZ-@kb74%ZTM;pmI|<A2snhjWv!BdDyp{Hm
zb4*UR>r1$$E4AwNpm^@3g}Ui`qbDcc@0~U-4L!1D{9(hzG$>%H@9MhQ9(qHX0yLhg
zaxRacYA)2BHE*#T%YCL#6Jh`8Ew{=_fcelETlWOE{jQ=Xi<MB4jO>@OflGc=2L=#N
z!`unZ(pM3rObRfm*gdp*Y+)!swRe^8fi$e7VL1h}jJy)2fHTWYBn#qwTQd~srw62E
zilkY*)(>Txu06jOzC10}d!JV{J<A<oI&dc~P_L60!x5oK)E?T}tv|@;DkIYDSw;Lt
zn_V&=5GuJCx08Ge#o>s5JkdYsIbjt_2tLGk_uQSaqT(;cA~f%6THuvkad|^q8hVpm
zamdpzhxq(wU&uyo5#B;*Z-q=h4@EV@qb-rma*WNB@0GPrUc7qc!S%wFBm=~UQ1b<K
z!-S9GktR*WKSJMC$6q`<Mgi19)ZQoaLJT>|u0CCTzP34T7|@M1J`kpjubpO%IfS`M
z<`(7g4hoHroo$;>Bh<Pj2sR(wK^x-va3?O~Zx*^JYl_t*jaqhB9O|9XdtA|jwT3<l
zfk!;xHy58yj;tfCC&&_AvCA#Sd1Fg)mvIKy&^d+Nupf(Yo0vP}j4SoL3#QJv?;4~n
z;<Kr>$-NE*|Mr?6OU{leo%vU+uWRY$^i<{d_t%f!uXf&Kl94{!azbs?YWZp16+u%R
zd`hk*(QZl@e+BzO%QMj3bGt15VLcXDJzBf#ovP4|=*q*xaSE-P68-)d7=Dg!$O=mU
zHd>oLJRD6MJ-K%5_(*ar0=AXR9#nx44C1u$WL=Ih9-h5+<+A>doU=3Yn%~IW-C>9E
zr*oO3o|L*+-gX%os~D}Quu}i=I4?)P>!hMBE?E1c#v`uaT|0-5ySwY_CuC~fUkMzw
z$SwaqHWcnxV<<cS8Bw#A<+sj=XPnZ_p<0R%#L3(@>FCK|%$vGExAnDZ=kxO>n^7Hq
z__v4LLz)TlQa{$W*9Od6e2MaSnWEIa%ow5;^;*l!uCmZN6Rq7GOMUttE0;+lhc?Hm
ze*e*%-M}&Gh+xDm@hX8~F)kB}j6bK`Kg<pkrT5Qi_n%C=kW>Ty<F8-6ICIL7vm4Ss
z)P&)$mkmO+t5)Bg(2(7l?>k?>)-RUGsJl?1sUtM;1E~`hj(OWx&*fTqMc+1M+G2+#
zPXX}0%8lb|wmfl{%o=pKPrt^3!|=JLGu;6>(d>f{axWU7d*5(Eqwk)zsOzXb>v6m~
zR*A1xLtxe4VcaT*$NRE}e33xv+aE)AofsFZ?5=nukES5`Bbh(tN$)&k+45D3Mjo&0
z*I}%awid@U2lk{27cC>ApII*Konv%&bl}it(mz(hf9>eaO)88g1#m1gnL>}!PQ&BZ
zd^Yem)MO4H@hIbOoDm9jklMV6(QJ7iY<weUh(RL1Hjye$B9CF`a`nz&@9_6Fv0MHU
z3(dmmQFI6sWEPU{^;=XV@^x|o#__Yc+{8NnXji%O@e|)|K3E0~^_Vk7vKm{Gl+a&t
zM=vW(uE*uV!n|)NfBRhVEL~*&K+U7XhFs$ZLzkKB{nF%1U)PR?0YgNMsn4`67#byr
z%<TQBiBne<UXLO^Hf-~;9Fw|3N>W0y5oPg-)1JeoR%wLOT}{1wtMW6->$1HIyCs~2
z$lX2M)k&=O)joA`tlCAKM}7yts(nqLV&Xy`o5Grx)HHl}dD{491b2{W>-cN)7D9ns
zELp@w;ZxD#i)3Z8q2j&5W2G#&k1A&fu_u@hco!~q$+v{6j9O`U2Fr|n3hz>rGP)40
zu!s*pTy;WszJ-q>rUUP;UB?Bsdfpk@L*4W@&3279s<a+$AAXj=c8Sd=(C)xgeG8U#
zRSc^=Wm9SmR=lmC26=EJZKbzNu<X^fJNJTAK8J;s7zpNPIleKuVD;U~rhRUtGfjLa
z<u+^Q<$$6oIO{?w@=E`z8+S-{Y^spjk9TojTKTv?2936j9mEGtX0P)G)$b~j<ct$K
zq$^HM1OQuh-7ItU4*16e_b`5}LUrO~=)*AAsS{H&YWj&40uQkA6R@_B$=Gc)Z#S7S
z>;|b!>608^L~kqwpj*G~Hp4L-WGQ*#pqCHYyJlAH?aW#`>~hc3LCeGZdxytYMkiNM
z(>rZ8=Gzsxr)49H%D8Me)5uv>tw*mZfHeRS(9%rb)4AmLS-x4fZ*}v%EUfx<l@`BA
z-biU#1Hka!<YHK-cj8Ys?#~d;A7LywrSDH|{7<wow3z}pp?5{Ix_S{LI`epP&(i`t
z_he|y*Rqz3bA|lZcAY<mn@*3@kK(7BR5S0cAwO9y#L<$Mq4!Y7k(~Ix=3Kt2E(T``
z!03-*39n|B4@%Y0J!tB7Pxln^{ykkTyOb=FdF1lN%z@ofUD<T=BZa*?))(vQ_nu##
z|1!^>I{(^gE-}4oa9)le8gxqn;f##Wa=WXIuh2l4$8i2o^rjaP3xD-(XfZrOwgXih
zCX7pNMvojB<5Bf5tPBE&w#DQ(G(@EPUQ1d#H$lN6*tvMPvDo5l<)}5NtYUmBlH|)-
zy|g}{qo&TW4&bVsW$tGYa(4x*scJMNK7FXv;WCd3_&I7Ke95C5%z;ygMmY7TWU4=o
z$?{I|$<Oc3c!;tzJI`Ts98y*6f}dWCiL5+60h|;ank#CKuf;g6kJPlnx!o^(o=lDo
z=yMve%DL$J>|z@CYO{iT$|(21on9B?Cy#B)J#2_7xUN>zu$l=z9J@CqWw>g7F;z0>
z#z_8G{x`HDkM349Z~KvA)FD`x!9GizDXQtp)PoBU|G*#3?l*UYVrBr14c`x~{<#o)
ze8FV0Tw`6$ovd+vUd~TqKRydy`k?zw$X0*4D%>4u(B^$#f#I`(N=L2i<($N=%7D#p
z6CYO=+7`b{xs;pNR=$2$?W*>MBZ%MK>ASYD;9X;w`De`&q$G?ZM&NsO32M@*T!}}m
ze!zCaN}u&b;w@IfTzyV{{dsv;yIyCFuC7JQL{1J&KH~*GdRjwMq*p@eLa}CKi}A9h
zsw0teev)67ucclH2agl^a74q<#F_hjQtSC|=3`uDgy0?V;fnVAc-o1;CgUi!m@wu^
zR~hLFx)jsS`|OLNcOOO2ytj;#QXc*G`c|AoAw-Ak!k_668PHPt|5R%KM5*nsWkDy#
z4-!T3af6!5Sf!e1cO?vCP?p_Mdi%rrcoq8*-2<Fi8*%{A4u6v%9u&|#S=4G}AiKi0
z(kF{P&~nCYT-yCOAD>4+63y{Al5vGv`&9rN-GXMZ2{LUPu~)6g4tQ#L@)Aewfp3We
z76A@INp1B_Mchr5^-_%V?`26d-_t8rWj58TGTu-CmI7qpE?f%#b~_c<7bI(Bs*iOa
zOU;B_);O!jX;ra4b-+4Y-rM?o<unC|i(u*A>^dOc5^v1@?laWjX`u=2;d30h65qTZ
z@!Qrr;aiL3Rw89VyC4e1EhD!XY`}pxG?OY;fniggu=JoYusz%*G9S5DQ|^6L&EPfC
zqlzlN;_Y|lhr-i4?_~(^%`s`TNiE9Pi++;4SlJ}@eB@Q8eD%=dSvbM}(SZc+U_*Q|
z?((h-ypvS?^5L4>^EFXEON*Wlo6-<PLUx&}gy7P~rCSFYZv<W|&GQ${p^mr`gx+4m
zZ{;nl`tvrtzuKhV*jZB@DCJTAC=&5FSg(1V7oWR5GGKld{}^XG-mH54UIE_oJi@l_
z!Tf`G<-v60)AFuA^rAyL7Lr3po+lSZs1ZYOv~BK27{~SDnuw>N#fbDW*Nk0PE55MF
zhWieIaBEzGT^50J0@H+GCUW9Y&+x3x&JR{O6~5?od8_$~CWK#!715yOF2J@=n%|6I
z3%UVkz|$JW8@)<kZq>C<kH#4Ye>%Bi>)PWg`PnMn&Dw6@X8_rxf6GWg=VkV#LD|U{
zl{I{YIl(*<_c#+OYZ++HpH%W=J0&!8s1+w3z1hXRa40&e>H%?7;5@y|+*N}80a3vg
zf7+Lg=p%U6DdzJ?*6}b+oO(7<djgyqD?Kc>vc55mSOdYM(iSrt`l3Vj$4W1WU6!+W
zZ=SZivp_OQC>?Q;bKIo>$da}DCOY2Pe;RUs7;=9p3pi!qPyP2V=s&8YqLRfu<y`O5
zr5buyXO}1ghkL7+%w|%JB0TYF(|WDrBL%G|P^=h7dcIRwhq7JE=-Andhfb-axZn3*
zqgCG-9oAF~Dr%tsReG(Nr0jbB?;16?Un^e;GcM8IvA(@ADt&t>2QrVw;`Zn#a$$JK
z$?+(+Fp)_{y3JJu<3zhSiGG&b8Fm8?lSOk3W(F4}q~3S#Y^rlk!dGr%QIlsY@)aon
zUSItbUctpOdHtEAdiA%NqiLhL&%?E-tEyhnt>)|B_oI8FH*?fQO48u{Cj*(7r?>d-
z9Pc{xA-eb)9WgO%9cQ<F8GjNNz?*H=(`P(Tox)RK7b9z{5#w;6LF4UE&uf!|N-vbc
zyE-)xQ?zXq;OpqsD(rmgusyD*iSQ7nTsI|2FiMJ8`cj0DRdakfUloz&WVx0+<$ieR
zYPZL9{fqaB4pC0oK6S@F2o0b(@s8TKq}!pBXpSrGs3K&WUDm-%@~?93z6EHM{RnI{
z&uU*Wz(ovAM!XMHns34!vPQM!F9kRr^6xAnY5Dd9hHR@PpH!+yyJ{b%8NEc!)$f<W
zqyNF-8lA`!+NY{76d87#rviyqsF)GjwgZU3r%1ORr4_F-*k^LQ&-dtb$&t?Bkp_l6
z%~}e;jdwkVOOD!-V|10AyW(<Bor7gUrNLp-LFH&D8*`uoKK*Q|FaBzB&-#z0cfH42
zdVP|zpPQF-n_Lyfinr9|JeiC~(*!-<2}*ACeJqR5c~xjf5}a^+T&Z)5eo0Gdbt^-T
zX`w&;q#rR9k=0+PbZM#(w8kpzPW=mA?|<7?5-4TxKT{>4=Uk^fiQH1#ud#@>bvT~3
z`9z38Uzo;}fR$0DUf*Q{%`V44>EluE!#BR(7O$PdJhLR5X;Py;TCZVNP&foRp*{~v
z7W_<brvRw4`^z2_V5%5gm#>T%MUD4juon>cQgZ1+9_y^>|C($D6ky^xyt>oHX0|u|
z5{E%Ac+_cr4&5h*KZ0C+jH}!(!Xc7gqvLsb6dET9YLcruk4s0{esmnJpQ8WJlwdxN
ztjZ;3wYM1)IK#9lz_Z0=oE4calmdu!wIT^Li@AHME&w^MI6n@M_-{y3v+E<%(_%x7
zU3UV9_81<%(|gWdwCF82?wXx^Pd;h(ghzXrdB4(zcq{x?jtoARa0buWn$^@oroo0N
zbteb?;JaY+nR7*4UAd<(@42Mqj{V2&?j?jn?rpZPgLoT<qN@;POd0CgQs9Bzr*H1t
z-!fLQ#%(EWJ_hV=>YOVaeS7HgWiT*Wczxf`yDCXIMda_*JQ;Ru;2m>uWF}{ueP#B$
z69zxdOl&n=Q%K5xUlHf+uJ%MR%$vYVygWb*#ICJ3)+^Z7OJg+}`_MgP!r>Vm;hk&G
zcg??U;bfAVj0Nx_+by;D<Ou>?p^+@xcf}tyc2qjh`;C<3MJ-z`A;>z?-E5$0?Jna;
zCn(U)f_ZpMF3vqd!U@46Od3nB2o4c^o5UShvnS9Ozz5%PYtO$YwXihz&SBC<u3eC4
zKwYf7Vp-!d?M-}#P4lcj1#sqLs-G}_Ok~1cE_xnx9?2Z^xN^#v?#syKeEK=v+c8B4
zXUcn4uYLdGeYMJS{Cc`^6*IhO7$t+ja;6H-nhT~5gltg&#JlY*iTrnI<^S$eCVnPW
zf_<<c1M!jqw5&=^z8{LT$C<ihsjI%IHPXLwhvS>I*6fP%4@W`W)zRp&HkFQDUNStb
z5Y@w<O95!hD8L7^ADKj+O7i*Wrrd4uD->X{{Q`Pe4oYr<zoIFaK(j9Kjx%fqSIE95
z7&rtZZhXN>DZq0}#1$dCV9QxMdJzjr#uVW800o#iikRG0)g!TYPylQQhIkkG6oYL*
zy{sW|g!7U~7z)6vM?3~!0aeJETpbF4@uUE)-L!L=M1;6L1;{^%AhViNfP4FDWo8k+
zsV5HVnI#Ia!5xu70h%G?w((7aO(X%_Ekd+`{|)6+@GK;j_*jG-GXvTh8c6c#g1=>S
z&x!&t(GvJjJ>os6^-&6d^F#d&RUpC{)x6=CyeE<d%5@91%aDwZIG+MG*at-vL{k7^
z^F`0U<Duv8=t6d%{{K-pcH%@{`EPGH!gw6c&jiJA?xGx7=gt52sozJwg5L_0oX#B~
zG>lQ>0v@uI<hiJJX6*3zQrTt*rLvVnX!%*TNIHK?|F<#tzo%=4B@+V4?Wjt4Giq32
ziZ}5cBX-@er|P@x$iS+{gdRsrS1`=&Qie#nt*W0QWOIDQm~g|AJS-@HL&V609U*fG
z^3~nyZ`;Y=`SN4h@!J7ymT&HD$9$0<=93sAJCtnD)yhg>v_LIHqrd(4Oq>6%QvP@H
zQ-=OS&B<BQ33KApFU#b13cyJL7CtSJOP6;q;khY*q;DMs*q@Imz@GeGB%-uVB0rKr
zq5{!|WCNe}#+UI6xIv6vUSqJl)o9hqB5SVtouln+wv4r+Kq>up9!pc)bc8UT0yK>?
zs<W39&*0t<zwCa^=vepmfyl>;ikoMcIt_#X8UrPKG%lLVKuxf~-@b~4x4@%v_%bKk
zo8at0xBAY$tm|KW{;XfAHN9Ew{$u-%C&zEUZaSXot&qb7-KhhYW~t)vgzaafir0wY
z?gcViPna5NIyq)c#{7`r&7zi-9qRLaqOXotf9T&DIoRbe!YJ2?cu}*;OfVrDlJYgB
zh{s5UvNG-!VRDYHURgR%-@no+GV+>CFi;dOya)4QeJK4X`F(#k?GlO0TzC=@BS?dr
z8pqtKA_({rWakXkUOIU5uX=hjas@r5GtgryydJ5scYziO+D5cp<Nw?)B$bfL!6|o8
zQy%p-dkRiEVT_C$$7+x73Pv0Sz26h(C_qo&1=>xs{~JMdqzZnSER);%oO8+^`L-v_
zbao+YP~}oKV&R0$=E>LxSgvHtJ=I!ce!TWM-1;4VB<<2PiSN?Qe3^v%9wkDc9mP*0
zIQ90`${FYW9WrmhCTh0shki4s(MQd-WwT|HlfR#NQWzT!T+lV9txlP;OXdi&4eYJb
z5f>|}nRJ*hPFH^8b}iMr_kGgK*6Xvng(aW-Nys^yqjBCBZBB#Etna_$%tCjgD8Q{j
zR7W@7l-#n6AgL^IlSIQ*DL`uYWHNzz7`1Q*JvUBf1g#};?Mcvj2cN{|bg}tn3U--n
zuoHz?;dKD*8IDM`L;GD{O3i#wF`0ESQ+4otI8AoZ@RQWg?1z^R*lG>r=m}q9y?Clr
zlLu!Wt?oWakmJVdncOz-*%JLBQ?dHUfT<((gh<js9~Qca?L6i^DbT4%2OAejw8jZ$
zPKPUOD`NY1RFTd2HF%4rLVb;iqm#Swx^QLOj9bRJgs`QSg!GsSQFz|?E4da{aQ7T3
zt6q?J8uxjkUuo6%oMHT@n_OP84$>d3KE;~xsw|Y!=H;;#IOV@XO{3f8AQ4~2nYUQu
z;Oz5RGDjLy#SEPi`nuGM*tI#Bn7;&3#}zMi(ken$xXdTXi3CUT*Bl8_Sp=JN#8E6B
z?~EOv(wK?0%eS^_l-Zh1(54A}D5kA`zV&{w7F*k~a?Joz12_g}Xj@pJ@Pn9U^eTaU
z>cMI%cJap4@zCvHM(X>g&u=_5{QzU~9jV*<=>d^d5Z9A;HFKj8+i-B}+^G!A%e{Yu
z`^8<VKp^pVCy<P;A&97Vdg!l<Bbb;YY|ewGUt)a&g}c~V&hNCb=)+hx$73Q8*qWv;
zm@9%^-7~<=PljrEtzwRD<9?zBJ5+%~AAqD90RflHCz9LXcnRKByD8?-1{7Pwp&$=r
zG@LF>XNuA2Xxp-Bb#?ZIAs%z4wTu2~AMdoW^wG5$w0sFdjxB*L!YH6z(IaWoM$v63
z=7<jz;MLQ|1z~4!Vl|_l{#G+rWH!q#e>1!F!tWdVAw6diFRtQCfnHqD&5v<JFMRG~
zGF~!s<@>~^^+X=b0mZJ^ZB4;M^j0Fryg?MTt3}je*5Q=0`-xfs>>Z5mut@zz5<e*?
z;^YDn9zhf2I_+==Ih>L8y)gBgwg{C>QFUO{EMwrMj1wd62d$N9yiW<v>-dbZ;M#9T
z2rnE9Drg9q&5ZGjM{flNa6WC34o$?RLRls@RM~Be0B-C&kt>^gE_o`G6mkW%7+w|L
zj$}bK8enEVkR?$=PczAxqZeqKk=Qe=yW$8g#EQ&ya5M;Fe5A1BWV)LaKy-d8nsm1u
zv8g?@_Q#H@|F7;YL;a^74?+K1lQa&U1c#HkBEICX3o7Glo>wFm8H%R>>>Y|joU77@
z<5UJ7K8Q3v1<c0q54{@t4DRw>slkqJqp>oWoAn|Zv#&$K+ef7<%5Sh6d3wJr_#S1h
zM{RMdyl9j*3&1Ck`!UsytJX%zD~X_vWMieX#?~Ll+1_<b*i0Q9Wr<#j_t6N*$w|Xj
zlIbxM;cBe`7;cmkhI=XZpn5p8aM8c?^I?loLq1RABVW}x*y|Spk7MZ)L(CsmBvJrs
zUedi&<fgaL+bQ^9$KH{N*Mf&@?uLqRZ0LJO9`i6*J;bmlHGw2@iEjtv2TH{6$SECs
zM?Y<LPfPahlqiAu!<#Qm-umqyQ{uf!-sp$6sa~KRQ60ORACztQrkki&G`f`K-c9A|
zTAbnJz@QD_-W+Wf;%6VhNMa_+ic=PlRMUy4OYut|02%<o0&wqrN2a2%msxkIh|HiR
zwDbwoREm(jVQ?m<(GEhL4)<3-zvutfm3=h(();7WwN?S{b7Gl%O+34Cw{HcDDD9dN
zz$yGA7+nGvl=gP|D8PNCy<w2%D>Sh%cN=uv(cy?)?NjjQ>AUSXUow6B1S=c9Zhfk&
z0m-?9p{*DG_DQUHe3A3RV5Y*^(QjRDHs=NEv57q_2KF8lpdcN`+nx-nv6XeK!iBV^
z#L`dGh=aR1XF^z`yOB1#yCWj$_jgT{SEv%k9P>|{1$N((57}*hC8Z?~BV5L#o2Sfg
z%LIAy2AODOsYG9qeSRySiODg<sv<-!iv+=Q6V8N*k_y!&#S=8ym+j17Rr^QHDaTIa
z4BoIAv+nr-VNSZ^U~Fc465Tae1x{rN<RJ`hM-)+sZ2p9qFzUl61zGiz*DOYHRU$pD
z;bjC_@<$Xi#(te<3~xBOIW*Mk()WDuNigbIs%z{(K-5TFO8(79)YcRr=;d6bGRhUP
ztCXCOyL|*7O#zJhhNfzWY&&GV+&IiOb01>UZ-8J*04MH_@-Tbw;hbne?0Mv1xG@va
zm<@HJ83lOZ@eq{JvpjI)*iR#I-%$LYO{|a9K?TXvKFyPYqe6UNh)~>k?T&oa9#l(U
z{uCY@8`}UC_#6(m4s2niS)>4LVSHsl2-Dr`{ZE_*aA{lxb4gljNl@0OK1dkRp%`D&
z=;}Ttm(~&i&oYuTI~`0gLw`hmJNw2fg#VEr+7h$=0#~;EWDR5d3fv?=p1S5^x^q;;
zF9dxRGryDb9^538>JP4w{(d^{FIVLL5e)A<@pti~MUlxNV%j<r>Z>f+`Ok=<l);FQ
zW!J7MoB{Rqu_Fa25;%=1OpZow7{5DC0j|B3BeC6w6iwxF1)&->`TO75Ont(?e$S_W
z%P{+GNs>s^fvEWa&Bzd6<b%3(B9~e_{GgI+E_Fl`7<lm{3tv4mC#kMo(z0zSRvBRT
zuC4R<2aXO#!H)xbCOF!L9DZ=yd!p~;di+G_W8N0!)M1;pRK@e%oo_9qo=_V<;okM7
zU5O=FlRF@56u=H1V>q==cY6H<Q8-6(#FV9V*u6;5`uf9IaaSw*naY#uk?xCdtZ`Rt
zF2BE;ColOsl1nbk1@|Tk!Q|Adlo9WNsyj>f$-D7*J14FaJ%}+P!Y9CH;-SrlJZ};C
zidqX7veczKon7e;tK^@LlQ-B)H4snrMdlz`z>w3^2%2gf48?+SF=liDpXZHZPyH<(
zzwSu#u9tdVYIb1bV7D%<fz|VfdyA^o>1gNbkuTAqECoelZLb=A-4B0edimmGo&KFN
zNdY?1L%^=Wb_bSxcQW}aW~wcD^1bT#*%!&D`US34#R|tLM!tP<25@+gVV96<pq_<V
zp{4*w+_Aaj1~8tr(Ei+bG?Q#ZJ2g*=AHwWWJCGZY8#l)3DZmOdoSYB>5U5@$C9^JE
z6;2uvK%KAYFL?DPX^FZv_J~D=@X4f0EOh3leacVL-gCVg2N2UpphGw-gnE@p3PYk6
zoROgF5+~S!S`J)CaFE->*HeJ*UW}Clbb5V6ds`SUMmUFToXX|a3eFGu*d`j+b+y;y
z(AYLRyUYQhHE<usjE7P4<MQ{evm$UJm*X}VJ-^gV?#*R&S5sb4*Mmucs}!Q?7_4M+
zK1;4Y(U(+G4~zI>891sb9aJ%DSeJ^BXV#Q=?3d-e#}v@BmgX$N_Z3E4#(+1$I3q@V
zx53t)A*I*DlcO{l>n6jjrmCo>ERqdm+~evt6mG?O)shtzAzLR_CJ8=7cJLI?Np<1L
zVYE78+UiVTUAIzbK+U`Oj;V{~Cv+!`FYpENzmf@0LBb+Fqh4g(#TrjhceTR>@qOm_
zM4aBmyOXs8>obxJ<)x*c_|+aKai4~YCQwCkn;t;FUx4B#NKuHHy$F8Lsf$38s4U6t
z%l`nk0G%5jk=lNVmn6t8^3)}_x?k0o-4aVFS6tS&oZ9~JvEe!glLYXBuh7r>kw+Id
z?f@QCzSIy>1<D(1)szxOhh-juUL67tJgx~NT0Nn%<~|#5ZQFM|Xf5~NZkLb})uDt-
zvUkgtE!&DFlevQ~yj|F<f2iCcWAA7HRdkFRStw_?@1^%~s@_CU1yt)X5g&5v@X=42
z!RbJ=YMNkrmPR0CjGcI~rS!`TQ>DWZ3gF_O#~O%dqyR8H-UxfU^+lLDE~%`9Xoyee
z+igb<$%>}*`Y2~c39N8UU>%%oLXV-}RJ~_BgHz7*eu7Unt{G4q&4UdNnMikk<cfk!
zdznR@QW2>NtHnaMCrFP`PDAl$vBoh`xl_6y!dcBs9809oV`ho5265B5V&eihr1b^b
znPeijKZge6gtd3E8BzdzvqS?R+(3n~D%&t7Gc-~FA>>WWw#F6I0u9(ZfeK|rG?H}+
zSDwpZiyh2{$KSZU^2%k|nPG{QhAY^}hxfC6Q!#@@BtZ4{=&td09jPn~P7o)8>hBKv
z%AKWpp@GNG{WK0Mx6}-sVw#CO+bTF=AI5Jl@k#y`qzToig>mv^2xA~UCK@~&@5~fD
zf_tAh7GL1J{KH7SCgp&A=C%1xH<6(n$IkaJP1Pa4I!;tP$0E1SW0B3sLnAR;j#Y2!
z`k&{{ZOruFNS$byz||?H*m<dZD?(fD)@+-R?h%8hjRkcGNb;}`1#lzkV1_jl^UuDi
z>b?e7MAV*SR1EI){xQq{mgiB1@qoBr;vs_rM~g*My#N6NFyJ3P4X$i`&%9l=oE($;
zvL;zc?sks2@B8xU48!M#7LraILNgprpZ6Mbv%}j~xQv4)Lm>sY5gN0J7!92a>su&p
z62oQQ&0JMxO{=;Z<ipJ<X#AOTBJ9PXEeeo;z+RNQnL{;*nuOtz-1DvL0_WN!6qA{r
z)M-nQdFyoiwqR$(95gPO$J&Gml0bdoW)*CUpPjNo-5h7B;+7JRer-JNQgeCjm|g9I
z;|+dl){5D|!p{j8Xcv>4F!6BK2qnCH*A#0r^9_wat$OK~-*nM}0xSXoqGo>n8fN#|
zk;lO0hQD%R%<G9TJnMwqaPwqUa?^M;y^mtNr09e9-^Ri=J|FK)Rl9C3t*2vV@|6KA
zhnGA-d<buq+uH=E)n0-NfOq|SUnhbOtbz?O^N4r>G&HKB$uS|M5C7x##s6FTh4nx6
zgz3NM0PTlraELf~Wo9EhVQ4SlB~GM?$FjPl@H2DkQ*s~kiX1eSO{P;!?CSxl3oo_5
z8-+S>LBPc(K7ZDPI>+Ycr`IQV9zI<nE15@HS}n^i+JA5`IexEQ)F?%8>W%jgJM>v%
zBI!v4ILkL0A)M8a43<IDjbpSgjA@s8TzR6;zsph(Ytd$SwL7G6199Q4F~N+Gt^<S_
zV|iP0YwF9Udt3=Rc+<u@#GQyw3I{h&dI<hl74f|PCUwc-YlQo_T+!h-o-qiv2vsK}
z*2ME}E~|{X)@+zOPB*&5SUDpedQetc#^d4az1<rQg079P*CBB!UvKY;Tm@I*7~&@<
z@#UH)3<`I1lx*Y(2j#|s$3MN04{no~bY`N@oO#v8KXdD=C>!fzG6J8rz1I8Amm3Wp
zW-z8**5o4a8;S0%3^4|7H+9WPu-lxjx3GDzYtW&-4W}X^@M_>Zqlov$HMi%&6^&_w
z1W{~Z+WHsCjPV^=UxaDC*Pj;qs9!sxP_KvnRw@B)C)2pV`TP;lgF~p-f)5K91?8QK
zI7b(riwx6glV?g&uUL6swVGdEyi|XP`~?B4XLq$k$G(G3O3A2M53YI0t}7ie)!2OX
zUClsl@66MgOVaH-E{(JfX!rdnbbh2}#J><YHD5Je1<lkWFL7z)mT@+4RkSXIcp045
z1i=;4A2@SzW1S;8DJv3@U-~n+{R`=R^8aILx4i{}bJJ8@%uz7@zM!eWzNngMA8!%^
ze|a9YoIiIsgoPemP!@|%oG6oviC`E2-?uepfw>d&be(A-P)DNuq#oqWW^3T=o0z7j
zrD5_tdzu*W8}E9$VxP_OwfmQn-)*b8NOh2zf(Ccm>gn%p4Q#yADlj~fU3Mm7<Lb!c
zBxAxfi(1&gGIv*O^T%`p)11YxgXuadC9+R+xGq!ws~*FDpSSR}M~4g26m}Ya9s6Ud
zD|!ZtZo#m8#b=()6#r0v^Ts9H<Mr~*ejaM7Y|SsZ>KU-`=z8uTs4<qdIUC~e)Jgdn
zv*y5Ts@bVpiA2$aFS^qmH^j%@g8dIin5xePyX-}LBX+z6#Yi-m@Qfa;GmkBweOa5)
zyEH4yA*oBBSokgl%F<H6>e55XeGSJ;<~CyJ@p6+#@d^#8L3+&?$I6U3tL#|0`qsHQ
z^N%*=H%=wAdLKC0&b>FO14IO(8qd}X5&iHsSZ#e=ZbKIvs!1czy~0upb+nvSx_U<|
zFG*rBXy)6wFL&+&6P(?L_Vl)61~ASVB26QH<CTK3Ph7JIW7O}Gk*Swz3=uLNPQ;QY
zM~oG&&Bn9^t*Ir)jMLQ%hFJ>2kuf30+bt2i12S8WHI;LM@{`Czn&;5`7Y`d&iZe?1
z&CCX)_48Ppk+CRR)Wow~F7oj(P5kf_D>zWct??ck^^cjK&wO&0d~j>r$-Fku%`P!1
zeNTyS(sjK0{L4~T1HuKoZ_}P&F8^@>rFRI?F3~g|&1>18-#nsbOt{A4J6QiBKT_S$
zlJqEoJ}7%CmFR>++$pa@^R~J(7oN!c=y8VKD#M9bY%jy1B5VAh7)~nP9{I)JW}Uvh
zeSiX_E#iGC!1Z0!CcP^Gj{Zl;pHnC+CysYz7OU5aV1EssEWzB7PEL5uc+=mtwBgy<
z!bh&+A2}R3LBJ#Fw+$=QE@AHdn(~XeELDt{NXr|UW%z-s5NFTww@=fA)6cYN^QS1E
z35}a<|D5z*YEWWdJ|nynpzGPUomPc?T9l+NFcAvFMm*<v>EyTEQ6O)9=2)5BV_#*v
zEk<y|b`>%>j2b7tx?YOkv?TXLaA7@?C*iL;+rn9_qTdnpM`vY4>mCNcvjaaZen3})
z^uMe}f$?NjBe3If;xn<8ZGu7s$4D7<86I?@bMXtVYUgLKqm%>mTW)q(-LCqEZP+=m
zJH4GvdIX;8H|C2N=0SmPhFs9($0^^O_^>*K{rs%fFXA&jo0NgVXkp6nhaNWHEo#gX
ze!TSFdoqc>gJe|~o*w58GwxQ*6=@YzB1jCNbAsnX@4nLJXDE|SN;xdq_BEYr!k(Wg
z1njOB;9{H=*t9?j@I-2|i$tmgm!3ulh7+z~0k{**YHyJvp=Wy)yEwla`+8uVJcX-V
zd3ET9gB`BTWYRK!<!9LW2rBjnR&o~wpsA;F8vlx-R~L7f{AzRhleA?0l9y`mjyz8m
z(tXW)<b53YhAMP4Vxn+-!yd(jS?&cx2!^X=YpQr(G6N`}BYHSP@_T8_X8lN{<{?lg
z3!yqr;-7$B#FdrAwna!mg3C957kmCMyz%M(?whip|EULx|9va#uck?~7`_$PH;HIK
zFxJGAWrC7MoA*$Mg(YP)nv(*wsAy6zZ_yP&({6qSLI$|o!qjo=QT38RB0Bi!iN&$`
zGdSv3Hp3mF?ws%BeF_UAKjog5s{BPA<YNBwLV^3HI_o2U%)WEZR~~j2^A-y(q-zO2
z4jn!`kY~Dm#klCv!{nrLd82RvYj{f+%qr{*R<~sG<akHMlEz@4-!bd9z-9@Nl&S`C
z{*;ulR}m~hWAp71wAJ+keH}xJ^Wg}yI}?iLgGKgvH~RuvXbTv&ULxw7+iENb=)M)q
zTjSI<@7`bHfkQ;H+t$(jeQ7WL)h!L=>zIkE+zmfXE-<vJ3J&)3s&`Qaa2Cu=Zjc?h
zF#x$IEVWw$4%z?b#nn8Pw!aIxy4LA}^E5jfhk**fQkXRv#*72sRnfArC0Q?k&ostK
zTWU1Eew$|e#_)cWm%QDLg!J!8A>FjWzb=2%;u;A|sE$qINzm~kV)kHFq~xK0fb0J2
z18Cfq8yj8ct1<`|a@1U1{pCc#!|Xa&4Hc9DXssgTM%?bGDX9YE@K|uy@4MdA{9W5O
zb~R3eGJIg*-mUzOIFT-HyNelL)T}ArD?CILE*oCXvS|x@`<5?e&3)XH)-6RrvT^zL
zDZba>3yuEwt*iZqp4t7cDZHnlCC(!*1xqJPEX&K;nJS78ChPFUbZDl3BpTM@Rx_Ky
z$o_YtOy%o-bsOgUt52=QPbQ66y(s#0<$xWKdoeGEQQ{NpoZ9|=7o{*Gyu$>XhUh@b
zix9F2s+kH*l$(#+?ue^Oyu-+wJu}MQz<!*e>DWu+SDl7$4e$XShw9q=XT^1VE<DpF
z{$tf`mwtTQ`X=&aC3FgNGK|laU=nnjOy7f@K93hbd0^Q56L}5eSNHDBopj$^zDce>
zC}43g6)MQ+!|Qv*o{n_}vC2-6c0p9qu9{%Yn{ya&IZvlB@Syzl^Zg!Zj|O@0q;Y-T
zVFSBHS(EQphjnl48c1t30HhUC1zD8bdliapyZbbvvmS~(5R}}q<6}`Z^E^9TeCAu)
z=Yu0pt>#)%^<Nf9Fu$oQAqSx*@=%rL?VfjJz%Y6&1$a%{!i^h`Q}^-|sWs!^dJ$^E
z8FM{w<T*RXqoX<;!Uq_%KBKI-@!<Ya>Q)MnVmc{KiU2o}?#YfsBF<9)TQhosNZ4U0
z`R;QSvR4VZxNH`TtQL@s;FGMRcvVkwjOE^~|7b^Xe|Ft%1_Mm-Hn_IY%ka0@otAsm
znF6T-H@+L+Bi~+SpFMWc@u1RXc<_2F0;+@KY#7OmQtvvvc8O#73kwsk*JG?c-OTld
zFDKjdLN?_`aCgsJ=EBl*3zjzmP$IdUMsLQ{o||vYzg)Ov{t!H+-HBmSXLcw@wr_`D
z9nSe=8kwMYVzAx*gPvQ;8`iZKXrl^i9r}wUM}5Dm9qKDC;ufm}o#dC&|H`EDKQN&X
z6-njm6u<*KfSJRKFTwG+U!I;oH6x?)XWjhp&r+EUZIsckJBN5y%5CrSKVhADR9gB$
z+rVa=$l*8zh9wV>yWni=?@R-WgQh&0U04)j(6XJG3I^L+l9h(>QEFzn*KAg+7}FZ^
zSce&Yz!SzfS2P*JWN_lGMy7`E2i=HDPD4H;&I_-sKg699)0U4cd;Fz^SbVUyjrGSo
z!EzzDMq|A(np9S=geU)Kz&H;GSNHuN^4>ij%C2i1S1LuC5;=saD2j-Z9IsADl1`|k
zxl2;Sq=?X5B7{)sEDcGNnB-KF$vGs-VM2^Skwa!2FXo!7-<t0Gxu5rW?&tgcKJWMQ
zzMs$g{rvv$xx4qQYwf+)T6^ua*IsLFT=s}w&9xUn=R6m$i7=B;pYvKu>?%XE&%B5q
z%vbPDDK}j&xJ8rqO{-u@IrisAM^aTMq%zOD?7kUsQvQ|8^(7ha{W8_wh|pFMO%K)x
zBe73VFDfs^Se@?b0c$WMMN?NRP)nJ;i<$HC?$QG;i)Umd=&oEwS)t3+HE*+NAal2-
zHU!M(b-(;tV425t*gzU%WTG99$iv5&V4+vBz(P;&?;66EQShsX68iZ)IvUX)h`99r
zk+$%!f^_~>+wXxp4-1g-NM27VGn73?k0FCE<$4tw@D7>ovpaa|P>in6g78PSOWQZ(
zd3f90x!7p0m7vTqLsy}>50d!qxCjpo!fkjCT`Q81h=9FrT8~eyi~K&A?v)a{@u76Y
zqHS`&1#Vx_wDh8u>2X1^AgREOzaJ?Y66vL6vBOG<wY<+cISpee3nmq2-<o;eLwWrN
z-LmI=`CTg)TV?+ic%hMUiJ8Y7Xy#kfKGAcSVfaE$cT+6K{cB;o^h8|ug=J-V2Kn^L
zb`{;Hb4O>!x%NCZ-omNL8zl3=4_0Iuu#oFd!BU>!8(%g$=U&)X<Ks0x(%Rl?9Q)|G
zwPxU*UGnoE#MuTO4xX}vLtz{PTOKyxsa?_>u)vLD@LQq(xp2L#^QWgGcG^$xxZb&}
zsL=hv{wt%+5x6H<Rerv#3Q87zuz@zC@`>?1^OQ8#!;2dS15J0Z79Bpb#jxVKOq1{J
zZ{3$PUllQWe~LgM5(q$sATM!mb_B8hhJ?uqmG0J1iPc~0d6L-&`iAwDOl_;_H!aD*
zDAx+Tcvuf(^Ud7IV4OyCbiNzfjwha1EZd$;<fKkMIB~^i+l==E{sw09lh3CKRKYzX
zVqZe%?x9ZVA`z6a@6JC(lE)h-lmfs6n+exHu_{>dPm#m7C{q;ojbusmFOG3W35qQf
z!(-_Y<ncw%A)b*$c_l5f8}R-Q{+srfr2T@pa<X!v7;e(IGo*`oSwSo;XGvmII+5b;
zzF}|Oo$hP<ML%CVl!EIq2Ea5n^C?C#L%2ie%APj5TxNv**LJkzAW@Bu+6SmX-bI==
zVYHFFc{jxbQY8MV-Qus`{&(U0YAT5h!p)}EV=o&KjK7Je{7{<N>?PRQ(sv;#?Y!r<
znu}k$roTD(-{&9whePFm!Vmk;X>N?Z4CYOni<IHpMhrd~w}D^~?NrgJw1<DV0~kF{
zgoJ<RdF_JpT*lke*K3ZX^eJ34>noo+k+>7qctzH<F+IUT)`-xTb3M$q4soT25qht(
zPL39FT6LzKdUmGTIn~i>-KOW~B{ZGih(@c6PDyY_X-b#|_pD_OPiesLaCk@5yq3jr
zcO6dca`--8b)|G_=1z79&6;?3ZxMs<Li=p0E_hk6*IADl6rf)72-_@iEoeweuCaJn
zN6M(G>#ADZSGDR5on%6RL5RmaJ2|e<6ywQ_?U<Qe>4|98_dVGCZuYS1@vq?@id7cz
z7Q8B`l-WZ2f{DI8EQL`z+Eh3{MJ{^vj>d~^x#&LV{!nq5w(9lsE=R456ti?RONGIZ
z|I)%@9wrO}yfBn+h|QvgQ>1!c=6zi9VDWLc6AGO+x@R^^Mt+#1WFvz&2vs4|oh?FZ
z$|L605%MSVnp*TP)eO9Fbe(;*@~p|{@Qu-`J}s9sy^qRAUZ|7RoF<q{D<cn|fFeui
zz=3*nbTg|#2D9cbL5uc6RW5cId%7{1%j}FVOn>C2ES(v%^JGVktX)=_SoOjrbK<w<
zI<F4u1mBm^m~d1&W_FF%FJe(wCz=Y|(<Fa93zX4*tP+ev>Sc7a&4i|b7Lm~I^H>_h
zrnIg7DPmzw$wB_lG1>oxxqAPOaU_J9ET>>OY{l#77)=?wHG|r`v?-nS)iiie$FuLl
zT8f4J{eb;keOwa}byX(k#STnG48E%G5tE!b_=-IvaC|a!4!PKxJO>94s|4w73wl{g
zg>U*WF`dz&B7|u+cJ>b_SwiM4dvl61lxoi0&j;1iO8JsLJYulY|E7{@jO`R*h}T*?
zjL@hwEdI-}{jZTzq;HG=&ymy2I22p$g2$6Wkb#}Rp8DuS$|s8w#-v(1c!Zxj-X<<@
z7a2J5hjoGXz~+~RF^C29&uL}j*9t2OHhDk({>~p~d4A~PMaz=69Ae;73yV>1G*PkM
zu+loEOra?ywTEA<??4vhWT+7m+i%zKHL%mI8tWuF`xhD<;xdmEO1y6M6zz||synEI
zZC$<S@!Dy$O8N_zpd2Op&ah^W)mq+jmR)K6eD{a*wUmon)*PJ?cO`4mv-JFLc;K{A
zba044p|R-MHi767G}LE>zx4{tmC$@0C}y=JJnz=`{PsDDH;vc5s8HS#q%n?etjlId
z^d6*!W@~uo)O*F9a9@3d@>+3GuS%5Ii>HAaU6jwU<0j7qw*!<eJoUZD^$qK^kE9Hm
zE@^DOw`X{*?C`SdHuuY)mECRqcC+$a*HK1GesrSqqwf=j8Oge>2b#BzSZmzZ^ej(~
zzcVf}-C86-=+TAP``G2b_F+5blp~cwMvJ7tw|f!d`O6_Z=aJnQ#Mfw#{}9{@pzzoE
zW^pJb4B0K63@P74cXv)ixxr!e>qd7TUq9e-Z2#Li@*=Y|_ebkoH-%4wcGFl)(ZZRS
zemQxbskZOMfVG}aT|N8O+pjItXnn6B6S`G*YxIKK)nYv@vyBz6K&}F6c1Bs0HxX>A
zhS^nvX+j$Fzu>c}A)q#^{a`NkX!y|y`pK>z`7h|F-59_7`2N*p!2kM&;FovpTO1*N
z;dN)lAisljiKoO%&j?A9tH8$^7>=I>+jj<YWd!nAMHwNFo#&X?mltXk##q&jYMj){
z_@T;K7P`E0gJNv+zPYi1(^SO?uxZ@b$|ot}Xh&KeSqeYv?zujaQ{zx_FE}}0>}LAl
zX#e^)sn^Rg=RWE>J$X@{@q__&!Mh0YS6vbmQtv(Yp%O+j%l!2LYR2(N5AWmQFBYDz
zvRYG7t>6(MI`Zz*hAZ<)n}C)yY|CLm5^@3_2FUA)diE&ic|(Rvy|K3R(`oacMxMKh
zvLudKU8o*@o&BbPHJ}|?;J{%{^L5(CqhHaRot-Xgo_D?PN1xNB2=(#<F=u;4X8am{
zSkd9R+=>$BoRg-rxXzdS4u>VSR=AyXpFimop%bWk#?s_K`0{Yo>yT+P4P+%skm`{`
zS-795ZkH-JF)C0x(qO#h>-{+y$-9@QXF195Pg-_dG3Z0ski|y%WK%FsiVndWLq-_|
zdR*<dSsjY*?opFT>^60XYjy8}kdIr;I-iRLB#upJ;et;Eb2=`pU#+tF<8KcBR{PDR
zHn6^QXXz}zd*{~i<#(=IGK!FkOs=g>Gi#iN9eEg_!6g^B9aqw~xU5m-;l4G`Uh;k3
z!Uav14x0Y+q>pTz9>v6^Z+9Yt27Cuxj>{<7KU6T2Bh6a9gqdZPsd?|Ajq&j#-kG+>
znF=ynCo^Bgo!cfpO(6CETbuPi6k2&klIc6!TPWM47q@F}(;^?)*^95`t2dWlc%eai
z`BUUFI=sX;jwrg#oLUaiX*+nbm%W*b`dh-naZ7)#q^EtcZ^~*)-yen=BtMQH^}l}7
z3ml+f2eV%@KaN(%^}Eevduq-v2p6Avt-jQPB@;<WLo;n4GW#u>CHA&f2G`)(T<l?K
zj~T^9zP5^VBE_DmFU~x#|8VoO1>)Rl=BiS6xoQ#G9=k?XnDG|pN3H#=d(Q6_+?zEd
z>x=v6UNO9MHR>5HG>fV=v+c{orWv%eS%ZfoU-pQ8w(nzBK=Ou9AhC)l%U2s{O!k#>
zL=NZXej3!$>K>+*om$rvRnTw!sPdcj*TJPX&!xTm()Jcvxir)ve9!C!kFIZ)vE8Iu
z3N^7U(@oq;riMa?kSu&l%Au3D9kxu`>lkb2yb^N@JngSAY7_WVL~4MThachIE*;#m
z-P)tI<TlT-@_6^ORf*lxH%$vY^GazW1FVaV1a_`|Fyh9R!(8mS7NHqlM%ttU)uJ}&
zSBckQcW*{K4~gIEIXFo>v(vJ8G=Wrm@DDTBkUqmV<q+2<aui*Jx&E+H+H08~+Sz{M
zPMSvf+h_}?y6CP5f}0%~t~DB`@g(}#z1eLsuhmyDFIL-NQ(=NJ!dvhI^CvbcPzC;5
zeu^ZBi?IG?;Qmkf@BhNhnt-)I#NacCtn=rkRS+iJ0Y9~I7bs=?w9hWodh4SHW?#R=
zTD%I#%E{gEu2w8Ugt*-cs0gJw{9{umP;4E7d&FQ~YJ;)g;m)w54${E$MWAxUzX8)1
z_2cg2K691SgJxd8{l=TjOdIh0c>DAQ(@y3s?SDdvaO&u}Hjl&Lhz9g6?-iaPnAd8<
zQSJ^(OA^N-(0eFcSyN%-N8I4#@~<C*ck5bx-KyKVuv*@<nQ^&ru`jt4O1}j7C*T{n
zX^Bn77CtgJ6CUhUJnU8BIz&6YwxKf+DG=9~+y}|>n`zCa_sE1K2`-J2{$ZlR?92Ze
zn1_s(TEg0?OHB}7xD*UBuQ4ng_yDKQYdxI|L9kb?KuIrP3hlUx=5CrHQ+F8|lLksN
zt(hGVPoGIGr#IV|5(bTh8Y}K!^$q$^B|*t_ypS*yWGO!(8F?{OE`h{y{l7iK{oj5!
z3F%y5JwIRzC}D-mgO{D#=AGs|S&_isacC;*iujaaL3QWE#boSahg%!j2CU~dY0H1y
z-LT;VH9Z>Jzp!4_U5)?D?PIlu`C6|&<lOe!>a0nlwQ(}Dx@we~((ppJE%hfDrkF$5
zox)|li+Avl+ue@aLp9#bE(-dw@P+R?<EV^zYd@^<XC<(d{B%<c_TJ0d`M%|T!^32y
zJMdD+wO^Go{x=DnV#9D~nR%J#a|w6mZ^vAAb3=2SGY+<5J3q}?@%&Xp-@3chp}R@P
z!|#YqyKz%($$ZaujPFUD5)Ish`#N!^gVl>A(VJ$?U~sHT>jd=Dd)Z3HuV1l-uZ7UA
z^)eU1>Ueg`&?G84><Dj~SHJJF=+73MC(ScvCs^bZmY;dOv8eK00;z92g0Mw6XVId=
zNKZwl8nF-#Ov5r{?ki>ogFMp3TliCC4v4^{_@BZUQUjy*{V76+@*CI=xF&qJ4=w%%
zW=;WG8&hh7uW%6-lMo>i0^B;Nvv3RUSJoxt3lCd-gSWo<d_1c##N}eu8n5Mw3vT{4
z+hmix%*_r`2zf3|`m<#+zLxv=HplJc_}#tMS)r^Njk<SEwp!+XnJbug5$q6~YacVo
z!{8d>(tD^P5n_RBQ8A4Q9K*Llh{JJ|*bEcONXXC0Da^T7J|+D!_oeVrlU=>NU2~tM
zED4%7+js$`iv5?bk_cIST&9Z%pe;i=YZ0gu0p{!h2>XxcYl7oyG1rAy*aFcLa!G`|
z(K!6@P`{%VSIZtEbSNL_{}#G284hJOw)btmOkN1S@L{vBzj;>sZ<+P!N!dA(@6W0X
zgv#u5{P4c!VzrcwDr*a+D&^lpYY(nd`d^t9^H*YRRF?f0cc>0<EpzdwNN!kQfYXt#
zA+dlpyo|e@O1e&-?mpx&YGlRA8H=W+SM|&olNm$)G9)3n|J&pz)|kpi0wl59omNy?
zd<%C`c&Fp>4|<_S>E^`}PiAbl+_%Eay(&3;SF^}<Gr#1hkm%dav*I2*RGd8N8mYLZ
zIA}xHRyo_PyQZfqip-jcYCu@YUxfN!(TUvX=sOXCxX=Sl^;sSPySr>cX>zQwxVBLL
zwk_r_^7G@WHz}NtwOVN8ZYHh^ubH2oiLPh<o47x^;JQ8oa3<bLEuv#KC)xPXoNRLQ
z>v11$M%KwrZ3%oeHzVfh_u)D249!ui#r~I7m6Q#fLLBA%p3Gv#vH!}~f4vC)GhF#=
zWDZjjUbgsWop46kglB=vsCA;3yvftBi4yjFy(m$;eO76f0eWYitV((oF~>^JLunt^
zV!Ma{&Y^z|?TG>&SfHVZ6iprz>(rx{#?0w!mwv$C`{H`L$-&~zvTs{MO4hj<F8ysz
zk;)PU!PWl<qO1QyNwKFB=b&7C*8X<$<v|<;g9Z7z8%jh6HkIvv%DR27<-((hiR-h|
z2d^bxt2NuY_zpcmK7sVDwbKP(5Y{!5aYc`W+0vHOYvcN=8RK-1o19k>D-8B`7q2<K
zyPU(y5Zm5?aBAo|+JYJD$hZVb=sQwNYcb7=3JEC9(?{awS$rC0NIuHQJ?Src=up8%
z&f&cUBJT}WZBWwnW5EfK6fQ_dUL~R(@b9i0)4+Q_@08#P+PgFXwhHhj@bdo&{{bc!
zqqo%a@5vG(WWvA#H&q+YCccII6bTfAJA_@cZsP`7<A5h2G#Io9RcI)IJ+q$Hz#N@l
zhjLd#DWA6E;Mnd&-E4lGpkN{>_Lck(I5#R#xZi49ZWBQYBw{AqY=H%&*v#Jp`9xbb
z{S<i%F7+<&xPKly`VSaIpy*E=;!2sCeFDK?+Y=gyXI%!Zeu`|8gmF%1{}hR8qW;t1
zcmFfaY5m}wWOhU$i&zzYwnJs{{#M!CulIR1XKw8=9{F(Xxsz1TQ`vKCERDs9nDmb5
zrgn`J<|-k!(tb1LWbn@cOF`b>1-RNMeYayT@`~5q#clh-EAcwj;dY)A^?BvZdEaJa
zoDDLN5vaA=C^Z(?@48>1oAzXEuCDs@e=wXhzSg!ljWaPLzFJGKK3V4Y8(rV19;<Dd
zOB}-YJIv61tzjq<`Az+U--CG1USztd0VXyciFrCfJWaufRTA6Ec(In#f<tDj3qq8Z
zZ+tJ!l{<6hS;`v`f0_S8R^Y$N6#TDlBWuvUXuKZZjJ-tq4izFdj<JRl`BLlIE&ZGY
zKSiFz?j+w&upe{hyK4<KFYW}vdg8VlxuNMcxmgg=N*$zfFZ~p0s7;Rf01>&U+vxv*
zH^l-tDQFo3>pJ_0+=lsgZu5UltDKkRkyLB5Y5X#G(pYGdnigbrk%P1Xd^-H&l$PT0
zXRUq5Bv&0NF}vXEQ@Y7S|IDQ+opdymrk{gFc0_5H-TK~L>7(3w*=Cl+oez}{mkh6e
zxy0o<*qrHC1Y>fYhKzF*?GU`_LFR=I+fBRMOyd|V9{yoCLY<-75BK!{+Y1{c7`ePl
zK(A<D9-MOfNju}~+6dyC>EfF4m@wKRI^%Bg{=A;)3WTnydcZua+J|RRPD=5WpyY?-
z#BVI;o%Hd@c+BDMdv<KT#gYi3s!*!Tn^er0wdKOX)-M$gzgKIXS!rRh=wqne-k{mW
z^Uu!;G@12pIGBZAzW-PMNdK`QPzKUT#xE<wRq1o*AtKywKtrtT;IS!osNMyI&ms4S
z51nliUXq%pf=!#(O~dE2`bh(pa3muzC%!c<4)1Dc%lo!>nKfj;j*N6TvHIWwN%}SM
zDz!HwGIy_4pMJVm{1JFGQ7znt6YpR2U};0Z%Fal6uQmtE_`!_y$9rCwX}ZjPM6MfE
zxmISI*)$ff+um7k&3y1lqO5hD=k|9m7)c>Z)=bsSba=O@>4(4b)$L2qZS4OTbpM#Y
zg1`~$fuT%6aDLvndL8rRYT1gtY%IF3bw~cacJoW0;S7Hw+qLfCs?@8Nq&xd>ovSLJ
zv>lvWd+==k!Lla$ylZDK80W4p&E94F?4!BOp46Rnw4gu}wGQo)3;La~O(1gu);8%m
z*9{byp)!wHQ88^Q54L^T_{C4lw^C*-1(((zH|3HBV!CYR!onxv7T(VeU_l=abmulG
zsJ+hfJz(#7V$T|<SVU{r{C&gzwDT6K*9@x{N_!d1oi|(MrJn!3COvnLp27T@fr$w@
ziElP4+xhl^`Z{XU1J?>~jf8hEnJ0gWkRi^dkokf6hD}1>iCRNy{t0w+8l@Ns#FsO$
zk@AE3!ML`|a^gu^n;CV6&dTF1=R^|*3}Zi^rL>J-qb`3O>wI!e>D3~IH50ZXb+e-W
zRI&CSAdDO>k3*X$#shdMWowtEkKaDZ``-82XiVbz(j2)TGcul)@DpQPMet2n{cm*G
z=y2&W(}i=oV~b414`jE7FF88>;P)dB#y47QS>1JhTE*_?Jr`p@LV~tqBL^`vUR<Zo
zz=f_S#&It_GPKfFoI;4YdddJRB5-Wv;hZHV>q~9?MyZ$zxhQ<Jb{fVU59Li?cP}RL
zM|7Oix>s6F=b{R~?W(xG;+2sDQYPt(;?g!2jfk^NYZzx@(1l}l&SACRHmx5`$PFv+
zl)=2huxRN+2l7dFnmtezY1GEd`NYBY+ntUJZFtIIr}O;IrBP+tvMVQ?gS@27yP9tV
zY1sX#dltWL3Htm<%zFm!o^eo1<jbi&5WZvZSju$bV7jM|`-xD??)`Ohub(W_PY(B%
z`ts`Kl;>D-+Xs!}04E;Up+lGUZ1Q<h>bx`92dygfYCzrH=b4mO?WZWMtvR=+y06Aj
zrL@dbc~NZkBU)fj?n?csEA~BljKS9uiZ$I%pY6i%^*OO;7A+&~)UdeKaB$t(iU@9$
zM{V81&wc7`<!&Pp{o`MDmpv^m^^5r0Bgn&dyl~IW%hBkEOn|6^mHi$&UcMGnYURf?
z?5U6!U3W2D@rwP|0ZN{7!I|aJb^81i+;uPC)6FUB7JZ`fr-%Z5AV2SgIof}V<WB1v
z#n$gsZ=>9n<e%}4+^|2LgwFu1>u6sNFR#@(=p?8o^la2J@<qFhrTU1jF|~CbjQ2AI
zFTL@Ak1Z%$4L?C`jXX3c^B8SIy0*((+t;~WdG5&mLZkl}Px7YiYbU<6>+GUc%)D#z
zA`Ev^rF~&bZL7@9B#+lH%hUMFo{;+=Nc!+&np)OUu8WTMVmHvQP1OWO<)wgGb`}S5
zqC1fJ9A^2wO1E`t<uCQvKM;qtgBBYYmD-p`O!$G$PXG>mqaJ8DWkeVSLaW6Zo;`$s
z4wf<5XM&u5*Yw6+M&(*QU?UIr13&<o_Xw)qf5&25pf3TP_juS3QvDs*&`{5**8Es>
zLm3S^F7XQ3G3WwUO#q*9t9rbPw|1-K!1_qFguTSNcIyKkd%84bp@Sz&Lsru$0Drna
z5Ph1XI<*pr90YP&+R?dTH98ba=#f@FwV&z=9swSm`sBf=j=|i)`}R|$R>Fqg4fNhm
zX+=wYCp)rhfm<gF9zT`#t(Y~%d@0yiBj2SrdGV)+WKrkbk(ms^Fk1c;87%8e_-y5W
z2+c>!Z;#vVq09ZovWI~fJvn<1&xNUV@NC@tDZit(Y4tDtJUKWRJ`Te+ew><AzCj;|
zxa+LtJ-m?G>QnkQ;8yPBPZ2K|$4111v?%7yNwAb*(#e9@ebh+q1E9*adlL3vKM}3%
ztJ~+^YDzT1!;lZJjVP_hMW^5Gy1dP=!*fg3)0^{F7gcWs=7)PE`N)^id=AlCxFPQ)
z=3OW|2IO%+9GzJ-I85gyI(sW$KGRvC>2pe;Ci!4v(h8=*YNmVmez*`+6*r{|{64}Q
zSUDZ;mjyGes-Lcw2$MdtJPX;Jx646h@}oE3Z6YT^1w+UBE(>zC!;$>p7$-u{YSoih
z_h07Cj?Y0X&u*8booyjnSFw4+R~dBx*(=D^+-3khtfDmMNZLyuQOI}cwd*?+fwNx<
za*s<!`aab7flQ6f7UX7Ry*~}9@P25s?cC(Dmu6oC%iGM|MqWU|@s$L(%N()K`v&=L
z2L}aTJbS)_ls$Tp|LmjZ&IJR_Q;Y9eH%>x%y4=Qh9?LF~JcYlKbKBk>$yfIrMY?tx
zINIgv{uFU|9^RZcL4M>P?HQqe_KJN`i^X6X$4-=g^hBZwuguRQ9Ilm?H>p`2Yv?+#
zxRE*47+Kwyu6b^Er=}{=JSI=wWEFd*^OXs?{P1Gd5zFj;?6JN4Vw-gDZEvqUd8b#i
zVMFi7{(8oow4yKPI%j!qpJ#ruU}{f~%&er;M`BI4{?vOy`)dOlPA84pM6gK(W?WY3
z3!6nZJKf|*`6;>1mbVsPQZHZc>@68ww8|nUU=Ei>%(39F3(x?q7gnh1OWng$&1ZyC
z)5j!iU%koo-O=<xb<?u+r&6yJ1K)PNx$uO)QMeU2aP=#gQpN^~3tbE4K5CC??0aSB
ztKha@VXM?CU7bDlSLGCaWZ*GG5+Pp6w+h&Wb#;)#OqYEMSUc}#=LMgg^&a<Hs=lw-
z@9{%QO(&}@KeR+q>XAz(lu)VqpJ0m>p8kk*vT*l8ZZ&PF<fq7j8TX=Mjz!vCBIRr~
zG43wCKc+IhFovOq)pn$@6?|7X*Tq%wW<_cGJ&0B3SNgm9Bq)E-4KogCZ~X3j^XTL6
z`)C8BG)H=6^OU2vLFTS=J<<J?5z0EhGMQ4`fR}!|6q$MQuy!UzlTti4(<ju+$oX>5
z{iGmfs9SD^LPPRSkA-$_=F~Y)mj4Qb%~BWI66%kC9PZw8{u)%Vp?Qf+twIbJ{1jO&
zJ0i`_c8HmDWlq#3%t=i(ZG<|i^ohF1f){n(@yJl(#ziNdGCf`ld6EU=NO_zf@d#8C
z)<M~B#JXu`B9aBkDWpliNP<t{Jt7+F#T;IuLts5ci5z|i4y2sy#HL{~A7ge|3Njx>
z=RHT+WuO^FI<*PifTf>)9M5XNJrfUnad>T^de-$^X1?Kl-51$`L9>gXss}TxAgke2
zN5i_wuKb+*DCda%cZ|=Ncb&=C?bdz1Bxr-mHHZ`#R1GH&F63?B@Xnbc;}*E!-4crR
z75i}&{@VVQEkq3@9v^n-m1!;ZTd<@mA?Vc7cPdcwQ%2^d;7ww5epH@-u;D%aDMIZv
z8PlNhaeCKAg;6^MS2Yyrf70?(gbkWmfr_irl$E@#D0~8bU%byw4OcBxRPuJP;e&OC
zeL{<EIEgGf*ov93D0us(y)yd^T)lfaptE)S5qx$G1OmfubBR%0l9A~GUI-vOfHBR^
zf~)BkW?z^EJJLlRVIv!}!dDpfpF^;PvamgDRFaYTfEGJ(7O)Owf~(;U6MIU<SI|i0
z5hd8&-loF;i+n$k0lr_#teDA|{b<KN3T~@UEJSBU=M!{5yBmeB8g?Jb!_`d1hdLz@
z@HTLuvicK*W5nIq->GEuM?<RU(}%AR%qBqcr^uE?@$l(s;fUy5IyT>%rwk5`i&uY*
zyXoVhFkF*7jWl_8T`fL048p)+b|E1h^N1Do2zNc1&<ZpX*NBF;a4zo6GrbL;K1X?8
zY-~T9WI>TWiDHYzz#p_xDP9J|q4*tk&Jau44)f_nuzV`6$p}*+j;Dh&R21AkoxP&D
z4`0S$2k4R&c#WS8A+`yMIs?@|V6KK();9Qzj|#ht&<KGp6S;NXJdbP8<v5tDj%xU7
z?NCSDF$w%f7nr{~ZIdZNiyJVI<1I8`O)$8rv|@=xdBsChie6M)&H-lWHI2RdkQlx?
zCL|trPC`4%TVa+UD8((9ExX)Lo0#j)#PUT(6*Ov5jz_>srGS$Up$8#Y^j?%h4NxPG
z81~XJUD%4jkJWp_KAwDqJja5v814suZ=`cy7A}aHj2}gC`Ge49mB^^81_&(YOu$m5
z08j9NeP98$J#cS<nHpj}n<3gEp7B#eF@a?Hu%MohMT&rrYn#BW6>LQz48UBGNa^Si
zknWKP$<^S+67h4E`9|U9!>!#U-HU`P{OW~@Yq5hx88HPQ2*D0EguzB-y4iUY*8;1(
z4MzbbuF!(=s;Ia&IfyyB%NXw8{(wt1JMV&PBSGlst^i@Hn+;(k?3L9KBaqgf2lH>K
zhY{C_J>7kHFSN5eeEWH%5+=4DR6$oZom)to70p~=YyjW-BM?-o%rHBzk83k8Ix$M2
zzF$XsEqo4~6<|`xH+a|wLWdWj__;t6*N9;oi~@oxhBw4Wq8*(=z<QLEKogzElnT%T
zgptB1Rpr-a=SlcF^4m?UPWw=ldlnW}#YrZ&jwupG38%>e32Q(al@dt5JuL7i6c%^P
z?&qy7A!7zFejnjSau)Ze$h|mD46bwl<+X^6uhJ+7o;+l_u%}kG!<sB=jQJ^|3<4i|
zMev}45>EWtmOyfTSl~n`7>%DF;%zBrV@9xKyBg@+PvoqZ{XC0eaG3pSnKmeGABmP&
z(mo_H$`Em&+i=BCkr<GhWW)tVo)Us^&x6rfkt*8K%UB3q-4fgn!yAP$K*O-R2q7OM
zF4Lg!*d@>){vgQ!+M3Fk51{u1abc7Q0=_C5gr)gwr1u4JVw6Z_slT-)kWN1=&?gl9
z$6d)Ib^*(QeElTC1b8XAiN7vpGVSmJ02P*j1H4~)88F1qhl0Bmlt>zM@%s<o5zZ6j
z_-<Bb&n1M5rhouXiA=a^6hkxfxDKmx2;}mQb}FuCF;K#WZ9&+UP!BFwfrx*NOb3(O
zNCCnN7LmkI&ZZQUHwB=SfdWGaYw#hY6?{OyCXfOi7Dx~ZdE<x3Bl`;$!xEnd%BceS
zPlLiviL5SiFv3l&X9{tS$&7&f>ctE^N4~xAT?^V@sNP~ep(O{1YEi;X4Wi6{2fZL_
z762Bnq#Ga9%tt3K6}m&AJ0W9p1vi<!nZl|PVpGtjoIpxcXFOnXG7x9Vl;*GU8Ui6{
zK_8Sj(yExF`wPf_kZ>b;%SQ@)SmH=j1ru(vKpTG{C!a96Ear<lAX;S{60ZCi$khUS
zaKvOip}-&C1GjZ$95Svf6geC06sg&Yh$LM?xjsVqJt5j#rO`viPH8t=2%DL|H=jf}
z&w&7>DNR!$V;g~6AlFH~j5sDI6FtWJDWVq!f!+pLLJdUcLYFUmq5mQdf-4FaxX9G@
zh{-HsvC8;P=)Q<!gDW2VweHv355z%~creJTKE&aJ`Wj7_8L`3FyA0g@hjuo0iruVD
zL;y>eTz5FmK&kzDY5VtVZZmYYA39@lsQ6-sU#j1o+^q2n6hy!cR<;n<%l<veZK1rd
z5x_x60@lGN_V1fXXoKLo7~Tlw-F`JiB#>x4M<Od3qwH_M4UX!W9Q^d5)6Hmet65p8
zXO`IlkJc|UYfrI8nA|WzLX?;G_JL6$tm8og&W*-(?Cflx1<kOVySVx}h=y*Odr9-6
z;rTOzu}wQG#)FB)4&$(gJbc5U<MKr?F8eBSc6<fCaLag7{Q=rid@Hvs_l=_e>YUe-
z+uJ406-hVbb+@J>J@=pX8MH``Y$W^O^4J*n_V`6^K9<MPzdV@Jx<uMq(Z#tY>pB1S
zd{fo%{0`kfzb7j9#-<1z(<Q!62L;zmm$hIO<0w|0?E7HaQU?=<lKe|<=h7w$URSRf
z*!-Nl#`M(cw@$IS%!7z?45n!lHdb^Ju0dNOD!m*=a@X-BFYRbL^B}OzVMWiS2Sf9Z
zsS4gT91ldidY_>rENm0+c+|;GM551bs_-T%cdPx!r+p9RTpc}jZH}FCM^l-|KUYHi
zrwXJ!#!jh+zMC#+8gp3D?CIikcAfhbPFMKdou*LT1bjg}e_{?l8LPUW-F0&)XsE!(
zb;en(<RjG7wk^@&D(7`yED$s;;oDzBi~C_)u|{i=FeYZx3b*!3=*s-i#0zPZFRu6Q
z4|$(IuTrz_la9-Ei{*FWZKvyJEHj3H3A0Vr@r@t#C{n&^#Vw(E$-R;J<KLRvzD9`5
z>UtGezOnn_J4NvD41v@zh&iDCjR`25!a+c;-g*72PSv;0-=;Fd{$W3PHcj2vzvv)Z
zdf{wwOGr$p-sVND-M8ABTK0U&V5yMTZ!m#+PNT4T{!Pp)r;guE?LQcmd+m{frN96A
zWo2{MJUOp=?SqW1g=%a|ek~c-!9utUyO_;b6sMm(k6knW-UjNC6L-5juDt3qy)jL&
z`Cp8f%*}`O5K9@U<qQ!Eg{DjxrAktInt<}30lpTn0L$Y~?`vOUt=*wF6s%cb?Uk%z
zty|9C`TDN^!v%9SiM~eyjlrjcSb#xVpP|_0b!}%Y;?t?mw2nTQv+HW5s)zjk1-)kI
z`6<m$hfXxfE>!wtMO~;frWqK!QNinv`wSU;0u+!du|bfshf5t8d34BGv!Q?L>65OS
ztLqkd<{HY_7*sv@5cY|gu-azN^N-oBZ=7u7-A_F`dj0&jvzMaPZ)CkzF4`yMHkmGn
zDOgQ~^8IW`1nT06ZI86)Mqgzq+_>damtOX|V##_x+eaT?I=f%f!WRS`F;MIbG|j?5
zgU{S7xI&Y_S8(aYZ=`BVAG1mfy%zbitOL(~did?+WxmY;=hZ6ynT!W0mD<W0w-Y?2
zO+Vx-TVi)_^sst8H9bdig+rR0Q^;}i;l~G*JmiDcNm<sB@2rGZV9!E~MLK^C`f&;D
zNehJ=g4`qIMan?o+b7tj4qO@Orqovu9}`GXNXK=iBFZ^Qdw&{Ry!YjZHzRa{-0UIu
zwdT^RTa~pBL)hZ{EtJ$oyopvh;e%wV;nK0C$TaWs2T78?Py4JFi7qudsPRI}>wGkA
zB))Qv!3N!zeHv4H|GaCMd%-iK-mHOa(>9)*ccbjNb3sj*$Hy-{a*VIZ!jP#VM_WsO
z>g5Qd*rY=wK`x^&HJ0u=DKVaeaY!Zc;?`vAScT+IQh~~zpK_DT8g4#3{Y?(zJTZ(#
z;-lQgFT+y3-K%>c?l7ysIi*riInc5Kzc=6Q>Km*YC_IhlHz|9Nc|}jgqnfHyE8r>7
zQUaD^mYqY<Eno7#Jsq}mF1UTJvchEMg^@&Dw=O`EG=9j=a%E&-_t^@+G1El3@9%#E
z+}IHM#;y8u#^C|NZSPx3-j6JD%fe#X`T~m{pK<5<U~JO-2EJ6l)Ol4P*0sYgepwG3
zChf-@I57(f@ASK^FpdsxdGl~iV*Vwo1#_QiL}cApdPQ&d|E$jGHzz*mk6Q3bWCKwT
zzFI5!QUPV*yb7!P<fc_EVPH0KcLmHo!tJ?YBBF4JiMukNq0-m^Et!nLun&f;>)B_v
zEVZ<ETA7|W&zW}4^Jtp+mGo6Q{FrYJgiIJNZFuImvN$j9R-bt+f=r4h#Bp43>18uk
zBSE-}!c@H0X=KzEwWG=Mwm9T}Zp+=9sn>VO%$rm*k`&PscmHtugXl$ae%yj1i>Fku
zR%$4cXQbo8y&ZX$Z5Y7DJyL=>VuNg7^dm0c`Q3(Z7*O$3<QSu0tn9FYo0?m-?R%Hl
zL+&>R#@B{-Y-l+zQ!l5#_(@iET6oCH;f5sgOM+7ImWioP>-Hr<vc_t#1TH_FAkSh_
z{WrxiW@5!liN;G^zc8{&+LwmyyR?+ruKq1oPsx<MJMYACd9gQV{kMm=>~YCR-5qc0
z=haDUBMeZEE$vGW;fyRoI~3WtwL>nZ%|G7`1_>iL04jLp?j;LuF`r8Mn8%sN=Uz#n
zCcAuZ3HcCrI_que%07*h=E}5kn;~Or`ll<Cu6rUT$<-a07|7A|K4Xb4urEE<qCCBw
zT^+T9-`&b;gK<Y$ep4(7P%_?-N*7JtU-e4x%|OO~->21M+s<t_7(7(<sB>^7JY;ks
zM84$S%?-@!NOTc5a=aHAS%ooviU@-R#Os1P><35At)+Ib7gZ92*(p=@W2-Yx<SE!z
zYpm4CYg_U3`@Q=ur}{NjufDNx?e}`r*rh-5U{!hjrO8zvg=3t+*RpYGIau_wkt<??
z{AxlbPQQrKS}vwj%Rv^Imt<{H*ArYk;rB%$=cO~UrvJbL74Cb(E9SnpC!WsJX@9kJ
zeRB26wV$7Cjtetc<%z1IOCz}s;{#ViDB@UZ>`##$$I`*va6vJ3>FPr5nZ7wiKbBl)
zruau5NLO1^JDmSO;{~@iygSo7=e5BVuB6w#$Ai8#4?Gsjo7G-VR%cwp(<*=Ed2U*2
zJ?yJdR+YqzU4C4@h}@d3#Nbe6M0=gCqENwenQunoTmw6qZ_2B=MTgp3=7}A$lm6D4
z{it?}tofQ46GKl_WzzTswwNDaG?2;7i-=UNV$gdWlEwo-4MaZgDpuA;xWF$3;?9!u
z?#?5zU%mDE+vRx1J||XZES?B%XuA2NQlorF_uHerwgE35$BtSIpG5|KiU5mAd3#j}
zDV`r`5AdbT&K_S$Z|zcr`cs|HEnb7^Ybyw^k+NA}{&gE;3C|)_HT!r$j{KI&GMDW;
z4;ml^edQl_9jZ%~9Y$_OQXwXPmqUGSYY9!`>eMVMu_~L%xsP@v&D8-G#YAR~!Reiu
z%=Zs>Uw$BQxud`MI4bFTYqk0E(7pVRMd=!Q?%US8tQV8roYsAF9X%1h=}4;ulyOVr
z7!p|S(jOm?alZ&{I2Y{N5cVV6MkZnWW(848VF?766fQ~5eL9cRUVu>QTt2C7I8@x$
zr(PYm(`DkGQ|EU#@!f89#1VJe9JI)sYBQx3-ua!BJqYV#)d=wc)XkprVznHG9Q~QF
zO=HS7tKenk-DA0@ej8=Da)&M-ZCtXy`?uwad((D$Hm=uPq!mIrx65*hTxnAAwiZ+O
zPMh>Gl#M(}HIJ_#8d7g}K)Qhvsrr#`CLGgJZjt$WnCakX#Ar$fr}ybB8`bOdxwYr>
zj;0CGZ!-ImJ`}ESj(L`faLU`mMl7j(Q?zKC7VAQ8aOb4-ge;iq6|VMzdthNadarNE
zVane3Ytx4l4dZ*(7M91l$Pl|zrHwxnXo>TZJYE!^AswuG<}CZ#XpL>ET}&~f7hSqH
zU?zx3NO76k$AJBp&gq{*#?uYS7lDe+ie})lt*J<meUFUipa+#zxebOlR-6b`RleCJ
zyT1Ow&Z9SEoQ)Nl?n~dCjQ?Ql=wg2GQ`8&Mw=(2716#QxGT%hBtXsJg7oI31sLe5i
zxOrf;eptXEkv`fN6ceC(K+EpkYF9OqveDY_=?fcWzcf2N>CUlJqo?Z=59(jB6)eDM
z`fni;e{-h&Cu6(W1JuvxpkJPwkP2IW#8u^dD%f99=eiXgEJJPES8|{H#=7NJpDOe1
zM16}X_Cj^9L%Fz><=SdS#Q55;@f%v}2zLu%;_OUFZMxVwOcHFZg%<{Fjp)rjgt&?8
zV~2RrvQ)9NPsrarDUI~dfZa-8+}uu|?$dEBs53jeAbQiQ{r1K;k~A!{Sjh@{M`~s>
zUJ?kC^8o5jfJy&OyKH03R5+d3mX^!RiovD#j1|0g)GqV5faF{zeDnl6ePfHMqB%9!
z@p$XgyIwm~_iWw%Vk{%|(;iH<Rv}lvd3${d>;dj^!h>AUO~bFFq(#ps8kzjZnHk7&
zDyAM12co1Ok#yv9A5&0IX%Y(!*m*lMJ*WQY?zc7WZu!y*>91DlEKyYW7Qnk1=aS;P
zFU&-};#*9&9gu&V|MFYcR-P(-s4wuRh*3nIGhYSD$hw$1$AlJ`Z~KvdPZYAQ^#mJS
z6#}L%RBzhQ)t+3hXO*r+(Vb&T+1c1U=C1v|cA3GIeXm?MYjmS)?xnm12Y|YLu>FUI
z)y9q~GYHkjV_k&ci$XDF0nt8wWwqE9oa!Duojl*M9C5g+F~xgMH|Lo=kC>9an;9f`
zyg;;*HIUQ6R&1^Iah7e?YLE(AGd*^w%z3+Xvev;DCk9LHN{f~2Npd;8LzDDc{V+la
zE!u<IyXF-tvy44aiP2-c9rSnY!Bh6Il*DBT@ecOzNEaJlMTS(hv>^v;|4!L~k6mT;
z9_?F>ieG2Mza~NYMZZ`vJ3>LW^v(3ud$->`P!-iTZ=2qRXR<3YeKuE}9dqOxMtnl<
zF|b_}uHDE_5p88-a2F;*RI=f1LY_~Ex1(Q~(V!Mmsl-l3-+dpGRogpEqt*(;>qGs3
zae3rP_bvv$$_Ac%*$p=55D1(*GTd5$U;r}VjoNzc5*vO3zko?J^As}7f@BlnFBiz%
z4`i-g7I^cGVP%KF_R>A|w}&$2vk379G^U)1*=hsgkMKGC%{+;eb=lynZo`E8A#ETK
zxlXxE&SK%xty{R-m-QHzQ_8}Mn-<Bg?PI#~mVMbYuHLm8xl3xLytfYg;h27{Trxnm
zLrJ6DuqQeId59a2R77YG4W^GWvaH9?6K$GLbBROAvDN6BjHWLyjk~=WgR<iVj_eoo
zaxhc(gyy3f@=@qA@(U|>u*Bz)r|x@Ao9vq(A;Q-u<oyZp_h_#tP%i@^Y#^N3jS#Q$
z_XP`1{3Ubp2&K_cdK&%|ErAr;10*iS{G;6h*QMh!V8n_=qTFX;ko+Yhu>H7^3{lFu
z=&v8D!Ia?~fIUr99caD-X#Si$>C(x>HI_i>@Q}X~_!>}%f(%!eQ7}8<p|v;$J4V4)
z@c^gkN*GrzG~Uwt6FUi)@%kxJO_D}A4#0qF1%wj=*?M7wqcFES#GL^>y8WW^O&iRK
zfvp1f$ZhIEl;e2vcjzc)N16rU7y#lJ;+^sj&<M7w5}+vy;CSok@;i7W=<PHy!qM1F
z2oF5`JNBbYY}G4(N5D_Vp@8>DIG6~e<7rAd{W8L3fVb^y)ZZs+1ryz4a%v2Ymm1HQ
zlTH@6jw~*-aV(3)<YxR6ECR6B0L#WTPJvV(frl1*a2fTnY!<>z2jTmV1Y8TS+f3Z`
z7`O%mr%#&3U`MFfs+IjGpTV#Wz%(ky{zknuz_i(8*-Z#HEn6tK2<H;gkt&w{7^oKF
z2*gmcAG3$(Ifx)HqI37wH?i!115fKga#MkebAXHS4|4Mvgp3^%kNZ<NMA4$1BnQX6
zARKWN!a9kNgR4bXzm`4}+Xt?oVduXSVHyl}t%<ug8DF&;oz#uNe4q;B+p*jRgqsTP
z`|hg0ttBO((@ZTBAwRh(!e8<c4%oxoJy}gHeCWuZN?1W|KjZ^Jwn979r3h|nnSgdT
zDzP1sX21fUxdOgMxQ}5o>HhOATctMmLB+)V2cSy+^$WsjL%DkvHnsP|*A6IQ`6t#k
zGIw`ZQ#+s%w}N)SDm<Dgnz;7>QLdASZGS?3ffBv3P3=@%9rl>+2!sPN%iVppX%5Ow
z3Wj&4H2x-#=X!AIU1LEuxH>4Su2Hlk7wvec_KXDNmqu_J6CPI+{gngch8At9-M<*R
zmP4^IGItQc)Q|K7^@>Bugvp<j2T|xqw0MS0o(A!(03L-Mhm+~1+Wq$M<!mN4_$TG(
zfn)~-DL+pkNZ=dp%0^2vnH>oh&vXC-p-mY4i82$Rjx@<Jxfeh|E5e*F@@WsAgFXoE
zg`Fh-PxkopFDPejf@bh_V!#^~C9kMohDnf|;1=n3H3tjOn>pC$R|e}exb%+)h7Z!(
zEuPuYF=HEI)!(PPpJ*3*b`HgiY<SS6Bmdlk%x1J>5H0^Zh%M3P@(k|k3@Jj8-Fz?Q
z%+F}Y_dnOVxAtI_Uj@i;$JY};huyR<F3<dYh<O&+pECU&a@_;Rto1={iQ?)2w3F6a
z@$@7e+d$_0IseC~dsgE*2EI6kSOJM;d4tdW9>>B2P~txf#*%1(56Reict1giXdA7?
z<*ATB!iGP&?L{4Y=qG&9CYVBiTJy3WyziF*3MCj;O8M_Jx&?+HT4aEnjNjp_R^(Ur
zDZSu`s_dfYRji%?R&H*RpZ2|l;Scu)Ju`LgR^;ucb9-%CRmU7bU}l9059_0GysV=9
zn8<)dtiy_v#ul9KNsa4LMAZiEm}_FbY=5=cQ1QxW#_PAry7h%iFnvp2=<VT>C!1eL
zf7r2ybZc8}{)SbwoBdAA3)|&xGE1~=vnCm3>(A_(Sn=Jf&Ci=p{}%IYA)z#l@1&dr
z%r1&Uc~22eEi-p%-#QX54+}^^xCn-KX8n>{6WV9BRPY58bK{@{{6`2V_Z2V%zizcw
zfYAM+#q)3j_ITkKcY>Hp2QYBRm&7yO*h9WPFe@7%jmA_e?2<PjYMU|WF90mS)G8Z7
z2TZOoLrB3NVU^G^9bn3}{;6akBojM(dl0@hDFEIE%cGOZaBDHo6KeVOFhgM}I%&fr
z%&ajpP;DA)ZV#!YpP>D^$dYGHD%>U%+5AHg9K;G`a-9Hyiv8FofYd~|-{6I1f`+dZ
zA_dhd1a0Lz0BBDr%5?%Iy^J+xBm|`kgVxyuDt!Lr7w94YW$_)*T3FdIfFqt@d*%qN
zcW)#Y#gvj}x{)Odd^)wmXiHDT?c<gw`8;-%lPfUyH#jIi_tfU=$u|a7r&}DMB(O<H
z#|?5eyA&e!gz(;^c`G1B!<4lr=fF^g)RCEAtTd0BIoM4Ldj3UpKI!aX4Txk}ja^G6
z8sG_<AK7$qS61$X>B`2h(c3g#t|=YMzZR^qYW}9$8TMmPZKH+qnO2R=$rjkPI2cvi
z%>BNrdhWZA)r%`mMc94}TxD)B1Kiwn3U(G5JPFbBhy>bE49f4?N;dZ!6%q)89>85f
zQ3wkXq*!Asfe@>K5R{f`BB=1sA3gzl?;>vGDG3b3ewHi>&eevSU{&P74|gEpo-{Sr
z_m5vfV2_-4RPYSxT?;oSqykW;tB9mtc!j*0P%PowLlywFn1Yed12y+Cx!*`FuZiFX
zQo>v5T4EEUPZzcWM}z}vI>$#K7N7zb(-TZQSSUBzv_|GAnHxih!7ef^iSAwp2Hp^K
z=O{=+dVhnv3^6u3Jky9!%;VcaKP7N=L@I;<h!csaFo1qSG3VD0WuW455>xmK1v^ta
z2*6v^f|*=H;c5Klm|!#TxOxaTa2kIC<#lftu`#7obhr@Yfx+L0*41>d@p%o%B!$ud
z9%lS4T5^-=icTpQgRZ~W67y3;;|a>CV&)(MNz=J7u|W&K+9*H(>w8(;VDEVHP$y#+
z+Ho!kUR&w&5w^g;5*bBIY;h{gET5So+(SU<!d4Ouj<`LPIhJfdCn-WAKnr<vy{{2m
z_Un-ed)6oqc&0<<e${UAXGR8q#=qzXYGsLVN#0<d{6J`NQDSBv8NW!W&w<gF{obAd
z?P0`BS7;Y9Y`5UC5ymVgV=^#NNpvTe&Lc{{+LPhsnbSb?8Gs`AchF??_ZIdqF6@*B
z*rfowOYn$~RRC`nphDgbVQ0byRoLZ+7Xk?)L7{ABe9r~u9s`pGHnMCKmB(xdh#3Ja
zO29KZ-vX`cfwvn4!q2@0dO)r!G#cr+i7ucin%8uZBM#5ayfZh_(-U1@Em}W6`ECID
zkW+gBS_0XuUz6W7qcT|7;OV3VUq6>S&70Q$&FTXw<re7^GlkwFG454YsB<#?>38CA
zd}rj=QrZ2*JJLR_<W*9B<k?Qhi}9{ceQ-A&?=0?ka;wE6yvp!h+|`>#j+S=viu1Rb
zY$~HA7oDHw5Ro#dcHY|KLG_O|KjyXJyX{B9lePALm(8-!;WEe1){nihG$rH9>z`%U
z&hO*aO6CkUjSqj>TJz0n&4K0O35%9mJeRQ{6yx|?e0a<d=Fry(q5kO|8h}!Vd053^
z-m~v_M&oRAE<bqSU4QJ_k0<hC&1qxH3TUPbn|{xdJ(lJY&JSNV5{ry{X;R}_&)UAw
zzY5k)-Uqo@LDbPljW7p-prFI6wQ&Re@gNYYu3|XxwEgO4w9G7E<q-M(1a7c){386;
zQ$n6-gY~1bm&vK5L)ek9p;6diKgtBDT0>h228RW{jho12g^p1dofw~DT&5=HMeZh@
zX`u}Umdyx!%TSEoH2iL^T(^{w7n$45j6p|DFqe@xu(<q)aGHuQc_(B&2(}d8i<F}^
zBqqeu1aC@Ry!I|t42quCapg*M=qq|KZ9_wVBj;5%b75+5nd#y?->0&X(RS_Ex}#M)
zUV1P2t^49z#?Ey0hLWex?L0qG9x*L?JbE;bckM2AFo7xpuzp4GX+VVKIH;Axp%Tg@
ztdDo2Ol~(L8Xf{Q^>qWg7{SU=t9|x&yva2PZlKYXhbm*#VNg(A(!T)X@e7>Vsu9@E
z>_-_eeLV`dn;uOWMSRZ^lR~g{07j1{k0O}Q?+to_RUo7_F1Ue8mybZ2G!LX1l%uO~
z=h}ufvpY#)%%Mmop-1@?1xt?wOYgd=-UJrR8RAd)z%KcO&Fw~`Oo*kvC?RkJ4^BQ2
z3!3U1sLB`~oroaAN*-#26|xwXVVFvQGhDoeC!p*&2C<C!2r76_=KN}R8saU4y`8B~
z!Oej6i@Rje%lRY$mJb%2#*`)OuW>Qh8SQcy;DT&zKF=FU7z>s9HJY{$76YL(CNQ>z
zluvpv$~Ls*nyD80(V`AEJ>`BJHi~YWNXqD*bqGES&Pw9MRnX?&CJ4oFo)fb)9+vmC
z476A{=Pg(|yK^V3^}swm!4e?N2Ql1$)X6}@4{8(B57jd{?@(#bC&|5RY|dHA$3f_h
z1H-sls6K(+g|H!|3QRbxtA%P1WUvE_5AM7!+-=GTCUBpMogtO}fMI%}`1F@BF;KGa
zkcCG0&QAzeybEH+7`>gKU(O)VEcF_<f#zAl<`lH#s;R0EMu%914$#NABWj)vI_ox!
zcq0a;o!J&)EY%#L5$uC+0L*G=grPkl(E~icDUcV=<M(!1Xs7(%euK#c+?P#=l@Oh!
zMThVj`_UsHG=>PbYlu97r94JE@~MQ8P-B|%h6FO!YvJIL1@Q_*<cS1Q&t5{&zYF#z
z880@zs0Ivwm`z2Y0q{2s!X!FgP~n8|(H7{_5A=u$pt3u2fx<zROl(XW-!M|%MreG8
z0c*rTxCRSC_eD@6=($$G2V<nb_ZbvISXwnq*|(aAD1#@NL4LX;h|85CQaeQ$L4~Ho
z=k=z_e49%&=^CZ+$7>a*u9g&e_$?sqR*4xp6D&x&?|0sAH)XMX^R6hi{YSt1FAJOv
z7xbjoz9Y$^MQTgA)QEL9GhGq60T-5Df9mSQ>|o1l-B)&Uw!VOf<iPM+nhiJjg9*&i
zrxSR#=o!l0s|`*-dz2fum)U5lk0G{=9>-o6<g-pGA4onrZ1kr1SeCM-=@`H4aIG{K
z*PYmY-?7!6`av*HGezgt^6l0K)Dm&fO(oF<2iTpB;O1NoQ@TgNJXsNZ+yS~R+DgY`
zDRlywVV4Zln8NL1NKas|V95lXM<!Rm=6$vkozlofF|}AY&!tT%f>b@Q!91Y?L~lk5
z+Huc@*bcH19bm!k97`eQfVgz$6QM$G(FsM*PA!Or8$`JvEBI|8Z54fknPq$mE`|IQ
zS<V_=4LmS`UN86)ku&p%Ib=9-!`kV(aF&Ra%p+#QDvs5dS}5$4jd>Qr!ZnM4wi#47
z-DfkoUG7fIa&?5e70|~~>V*0NLrbD^XmEcD=1S2*bl4p@&jMZdu#!Z~b^vr~Q}X~F
z9l<;^fazwp$oTv`P;~qB5$=}$NR5+JZJJ(dYwO!6C>WF|v(-%g_;LLX5i!*VH~IaY
zQ6~%ZIPsKHx06~4UTH>=neHO*>+h(XG=5p(6X3qP&u!8g3*&Dln%UglweT8n?ac2i
zi_I=`*D0xZ8D1!GC_JDiaeEb6j%+-z@U)<1<%R^(ZR7+JLZ4MA)n8IVo=dEZ31{X0
zu=~+jyPdBbzi4f#y?GziB&&U$PS>MLyu-nK9io`746lw^rBVx2l2Iqjp4Obxwr$<|
z-$cXa&y{`YSz9f)iZrkCK5GEZWNARG2+W<!9-yreB&vl~n5tO6(7G*mB&iiSwBa}9
z-k9;?iUzsXP{!vtBO?>TPm3i@XAio&Uvr93zoF{+aPF$78Iag5A~!wI)K+jEJ%-Gn
zy=(vfn0xQ2rrvE`7)3>tA|TR1DI#5(6a$C|2na}xv>+li^creJq<4@aRiu{?>AhF!
zJ#+}YlTafBes{UYKIh)EPZ{U#Grn)!KadfKA#1I7y_rv$&%9fM=?-x9Q88#3pXO+;
zYe?%5>d#`xEZ03WVO|pX@*WgU&^_t$?}sn4{GTJ3fW9yqd@wVxBLChO#x0Q<x=d4D
zBg?K?0M?}=DSj$Tl+XG}=9A~8&}9rD$LM$OmSdcaaT+xKdnX6ghC?2vE~CF8hA4_+
zoATVT^@me{r?)U&FsefOF}(FY=Xis0zP0h)1|R#JO)<@eXg%W@CElvuZdO5V@r9yc
z%4^+*fBJ!eE%+O-5`>k24UO*4hDLyYRbT7XSBqpP0PT<76DKJB)m`bE==}k>Eux|D
z2k?&rVyEVDt*4VziqPC?i1ka=Ud)y)LzhXA<>CCy{W+%>44)XW$M%0Va*NCR1DwET
ztp%`00!TUN5&jLZ8o&MPzDnS$h^NG50r&cHbD%W0Rf2}K7&Ajd<eu&NMQp%Qfs}%*
zI9uj=Q^I9Uvn@l$EKNrf<M>#+6}pd{bXMj5YqO*E_<cHk1^1cnPiC&?pK&5tOrda$
zJUsZEIV>Nl<*hWj3JjS`K*!tU_3^$o^h?}+f$S<MKDIQEebAVcG*uvD0qJHrn*1ba
ziJaYpF9idsKkFfnStyUcGs&6m3ZKzkUH;jT|NU74{b+Uo3ez4qmCR<Yl?;v$xT$Fr
z|J^|oVkyV2q=C;YA9xzvs|i@V(YJst7y^7&ZeDM`<4XbDsSk27XOS+A@a3Q=zRCz1
zwPcBfuC9?4FMozxw?|*Ea#Kp%aIt%W58h}f-cY)sQpxtVkm&s_g73tCbDaau^WR0M
zjW{?~Yq@&&Y<VcKnaGY80g_#|)a=Y{`nD8ev*t?kLd3Dh9rQe_mA0MP>6SPAig@SZ
zu{Gc#vuK?Kn(JV_Dk@PlFn^8MqqoTeGw)t$L~+kh$Hd&_{w~lPE)p(5eTMj3X6v=z
zz?!{z_tIaQ{c5C{!kYnWzvQ!@k%LQAsD4&G3K`-kWu4Iw{aPyGsPv5@{e=?2ia9y;
zc_!L<`7vfNdO_ed8%i~;cKpFa*eqf(p$Qg}#3dLaX3HVVMn{-qH}bDDOX=z&ddf<Z
zw+2Zp2Y!>Fmf;-+m!>NgT{{R8vw+6d5GldrOGjLD!Lzs}BZU(KD;+|a14rW|nQJZ{
z0=^vE5Uv-mRs4_0A*5d4K5AR_T5RBrAeu#Y1Wb<)&=!6b8P{RvV=7}SI&i)>UrZAo
zTAY-mbTG4oX@&L6h7hb!ugxe1+wJnZEAfbYJS09rS^|=btr~U010pu@68b@_3%Sjo
zWbw+%vC_VcW$A6`A75?X!%9-xeK}H8ljIzx1M1E?J!wK*Zo58rixuto?uw+WtxE1y
zh+LwmSV`W=(G&&qMzK&R!1Pl`rp{kZt}mQFVt>Q*4otj^yvx@sI-lQu@(|1bES!5o
z+5M$G(*c*znLPo%gC#xF_pL$VC0uRVIhp&TMd~!_@%!F$J(yo>J<ocYM;i&-nYp0m
z4-$jcK-ZzBoy^n*0b*`pM<?P)PS^t79hLSwdxn)CyzwhqL|Up*+3YGlFQ<@Xk-&h*
zCJxM8oy&l;U2Q~d0bX!9#O3S(O0|}_Wyt!Z%D`3`wcgGax)K&I0WIC@P2)A>ua<T#
zYe?=jaU^~eqya&phbZI<TPS)c{d$m6Sb@Ntv2`)smZYIP<+WX;S?M=BzF8}x<eh@s
z6H!8-P}<}q{nXg0^Sj!kOXG-s%}-8}sK6absjfJup6xdlnMercwDCdF^+2|MCV8vv
zWJCJ2dU@8*K0Z9L@nF^I^hseNl2;Pw+M_+h>ZC9)MzCiOG6B2=*@Bm)JyTy@k&h=`
z3?f*~X`ef{7SF2G7MtrW*)V>FmO1KZpiKm|+J_Pphm+I4*%!=K2>A_pgM*-w99=OE
zJ=#e_a*$H=B5*LT*xWikIY~jGnqv>gzgy<KRbr%H&eIulv#1Yk)9RE<ex6R8yX`J%
z(+5%=K1M=^D|dYKnZLi548_iyzN#77aDA^VxO7^mD|Tdc#5=ihgV|@N5Fx7J%+}tv
zk{6g!o;-ZYLItyvQl=7lL98hHN57p>`;ba)wh5g(CiNtR5QveBkSTiREgO?|7QP(q
z5`1_SA3)y_IV$zW{Eld1RZeXu4%#uQr(A_n6g*EpnTWmHBlL8;{Wod=_3UW6*Cgp4
zxVB`hU79ntGhuXfUv6$Pe$#j%WGK;GjeJ^%50}@rM*;1V?*TSOsn2?dwS^2G0kp9)
zTdVu6wf3w#ht1SD!`aftazn1|oA(823}cy16AqEk*P9J|%c70J25JsV?j@7&veJba
z!UL&~j2b&8V?#`AgpyC~NpXNpK#(MlQh++0jbx=*Efp!K1sTlUU|Np4`^$QLd)Q2!
zlez<#ZfzksK*8NN?t;vD9Kadg{jf)L)t3`fKT~g{&&BQWP`AeWB{V_tnOUN^%8Zue
z0Vyt-=_SW!(~uV%qN9sb28%5pqHp!=7)!P~a%8tzs!b9lpBj_GVgZxFXWfplPBVS~
zuysXUgCy>->G8QEBe-maQqs>Go$sm=ou}Va--{)X==7n0o7lte%00b7(FN_OoWJGs
z7+v-GgK2k;mE1jqxyN*%5x3K6^wjYpIV>5a74jjb^vO1<>M{$tY+;KL0cE5tHF{W`
zqxgrHbLrP3NFO?bvNK=dr&{}f#zJl-5xFm?IXS}}%&Cq$$oI4tN*7MU^I4L9V)$h1
zIK^+g%QN&uhH{g_I$;+pa6l6c?c_H}o-wtTL?=c<bHA?WK8smfb~t%jUN?2lrasPh
zLVII4+DU?X5SG~fbNe3M4@2>d&?8a?NX;lG!@H!5(9=d9-Kq&hN9jG_S?y26pJy#(
zh6X;);H{SSN#;U478L94g${f3E&Eg5eLlH_Ax1RchkbZHE~eWT#Fz?>QDsax{H;k^
z+{jZV6!ChtU|Bm4#G(33IzcxQR(9LW1Oi>oxLa<1*zfg|8r-(PWf?jHsV4fQ>iL~Z
z(#)ZEqWwTK=Ab~UQw!z1p0pY}xgxlxoRQ;s5C~FdT1Fs7W>)-?+p*w)el^r&s9XAL
zrlKK}<aZpDC325S_TP<%pk;@MHHS>Mg0$oBR6j(;1M756%xEUEVM!Mi2vSQ7u0oN3
zT8+kjDA&LHNRN&Zr87L+xcwp1we|?))Mqb!%%LZFiZsMjhfJQ_tQ=`a5{iCXhTr~J
zxfZ?k>w3dHGt{G6!A+7GT4h+t>U|#nhJA1N%*S00IA<X(M+8fu*t?gKE9$B3PBjlP
zK1E~RqRW-FccE@>KbNSCm}@g<p$|F&m@P~VG5K5d!Xq8%%+MeysUh;x<_xtOz3(3+
z)*GwkP>2&t0(OtEaf?P+Rc6kdRh$UT9Z!rk!}IB4cB)sMuUA4h5whBbJ%^a2E%e$i
zzR>21sJ7?8>_4h>%S;V-n__eeLoi`3{0_bsM~r3A#93j<7#O}8*{-F&7>Ruu9xVyp
z1%gNnpp$$S4zli=#Zt1g$Zq=?gEk5r+cGjG?-g4WnVIG->GujeMc1C^sVSy)XlrvY
z8d05=t2PH|{tP^QaMSE<i+_5SXpymqZ=W=KBNp7|Wvg%!)>Gbhk8|YdO&<XW2h8bL
z)`8HjVr3?MT3hIoVzuGFCkzrs09=g^=dwLOsZj!8BPX3ytW(l<J<*k;oO>`D(l*>P
zB3zX3P@<fmOR(}VlIJK9y@96`KDEJFtsIbg%MUlmFZV^Lx6P!b7g;BYCGZgrnF^`X
z_ZEBze_KY-s;5NPN|by_fSXv6(n5E)HZyz64KD|-XkeQB3$3e0=5AR+ym<6DBR<~l
z>Ad@pg!=1>_`@S(f0<iAa+z^OP=|Ur^GzHa0kddxJGT$1+!I!*ja?YMw0JFGm-Sg8
zBK`8KIG96)hrlsf5%B)f{lAh*4<3{z2b}t**f228hjaf}hTfxYFlO4c!O*8}+P6XZ
z`}=F@>rIhJ1{@mAq~4KEZe-lf#>|0f*ecwzxuv3R-zVR#!EN`lk(f=2XRLQy@!LrL
z9^KaFxlG(*?*>0Nf3M>LKwc+bG*eAKDbZ@V;vWNfpaH)Dy)1wRCLZd&+~8oy>RQ}m
z`<ypNzr8b5r1m!MOMLQ38bxfZstw?7mzDibLhXnc^6~OGpR9Qmvm#iAN?FaP_*kxk
z_aP%eZ+i!C%jj=aTq>$h>}HN17v&>u_O(G;FLv0SxHfghqZMmJ@n*gYSPz*hna-~#
zlk4^udpgYs_*<Euj0^BxTTI%eh$ZR@7lS%~OEmS57W@CZ$HtPlv(CD+C~rlXRzT(k
zt3r8S!0n+FhjlK%ndfDdA|3aC2zU5+@=L9OnNla`<8A_?F&3aE5Rfn}?uoC|=f_7+
zaMeZ=SHiH+Bec7pUHVvive$3Oqsd3&yztPri8?x3M;@|!4)D6kD{kKb2q7+DsZX8E
z$}Pq+v5r?-H^uo5yij8(@!>YMbagf1MgkH0#*8-`nvbw$fw>&h9Egz535d0oXH1aN
zn>(>E?W6i7Itun0*id#n&vFcR+h25FzpzP22be}Jt+3PHy@RXQzjsc}aRvo=PMqy!
z2(lx_`pi9%hUO8iBxXSyW-{@{vKUC0xi;W)SDt!fr8KTXH{LVl*W6~Ng2+-PQ#6oQ
z*lYdgG*TbIJD-^0OjlH8RsxeEE>oUFsbbk*6VICu1oLAgE9;|)TRF(Y2~eZdDw<<9
zt`U+uO5<pQl;>0FbUz&9VXHUw)Jut|r$2Ra>j-eb8tM1b{~}nge=baaT)Se{tghKF
zEbmBZ2wZs0d^0l%U0u2x6s<R03V1f6{3YYh{7-DvmyCngt?ax(pH~#q<&KOt51+Aa
z)Ei{Xi>Xb~-ari>m)01YYP6jh<jqTEoK&^GM1nk;i+~ZPhJmgB$-?}%W5Mpf{jVMq
zMd595&dV|(S7eFp5GE{p6SIf#`i&POa|JBhIc${N%ol28zGfz!zLLNoCyABCFNq^F
zu&xey(qAU_u6K#~)@M;rl6xK(#ng>OXC+NGn1*|JU0fpqw{R+2i#hY3G$L0~yq1-`
z|3Z3EoXFoVSawxty=fyrJfVt=N|jTM`#|M+Bc=MlSySRJOrlBe&LIEQ(HQ<Of|8BZ
zjn?&PtbHr#R*6;fxfYY}1-ReyY&Q=xdek|i9)TC6f;nr99v}|%pT8$9UU*gXNQ<~d
zb=KhyHDQ64v6?Q(B;##AhjI=>(c@$vQX!irnCp|F8sOSvgDU>Bdx$zNdz1dbXZ~A3
zxwBSnhq~$T@|V%S%c>V*POsHQxq*@=|MQd~nSVPK5s$^40T7Z4M|}bE)|_af#7(yA
zX1p7joL={ON3qPheWOOT*pQ|E;SiH0;jv^WJ_;ZXdawFfj_(4d8EP5a8VlyP@wESy
zpXb@tb%4eK`ZZB^cn)Q*Sa^Ugf?)v&KxJqHOzc;9`x@Mw{QTz5BJNHG-szK!2FQys
z7Dv<J_$p`qc(zkVBUUNk6EKPnh1v7LlrMWU)v&eEx873xiy+CTyWlT^T-VF*-VB%D
zL3G&WrG6O(JlD;BeG=@#YfAL>p)gLDIBsIbq(KSfr*(iF>GbV;+l#4+LhLJW!$;V*
z$z+;eupl112ot}y6pZ?<lZ<JeAp|I3f4BupAeA>5+aV^rbx+lvkfV?&(Y4Q3{cE&f
zdIPEj{?8tr;S*#Jz~FczcYzJ<MWYu$vupjKnJce`0A5@J(D@cC+&fa#0~Ux%C*Duk
zKT39i=2NrIUf;KgUfo~<=(yp3i6;J!LZd)br%`Uk0g}1xpOxW~zvWIP0Zg=a5}a#T
zorb!)&a)F0bt+`dLQ=_N`CEnyAK~qH!LV&_R$^TzM`CW{`?)cdcP5KHDyV-s=bM(+
zO!tK6WZ1Jrr{1OC7Mb}K5s(d~8n8mY#};Ix(8|HuK}3sRO<WY6+!X&T&IwzFPm8h+
z{&4@tkC7$;LXgO1j#QNWs4LV*b54nljxFXLU=pA6{9+5b8$y8O85IqS;5UmEa*G@A
zN{A~o*iP7CWl3QST}LRj9=$qwT9XXRcT#uWs1LKUHM2CkA(VbHY{~pE<4u~ztRVfd
zJtfYL=_MP8`$pCYlCG{QVMaI5b*9(x<Q#0qUFcX2dZR!O^GpmmwoO~5|8i{wz~iFr
zu&lOU4uSjqCW)~;VSpVXm~%Ay_P|%E2rv1-EZh7RdbVgq<<&F^&G?bM(GH+6UQOQ^
zbYfFj=eh>g-vi1^D;skImB4wr70yZ*$P-MN8p7Q&3${VMMixPsWN2$*6sl3gz|5p9
z`ZR9cfaSH&to1XTxQio13V?<xdHtw+B_E`}rZZ!ux-z(1g&zcCAq|UW6MKT~S)nW7
zEFNamKGx-6{5LSralAxiYx12M0Vwp0^sb@5&Zm1X9LK?5abdD4sx=-IGOn}K5xLtm
z^e)TGlrNa%U3K#4y1y~&(olgwzs*Vyl1t+MU}jAuyDO4p(&bwPKvacig6L0ei41~t
ztF=;J6Fod1pBW6ZEu2kSgE+R9NQ$O1ML`+-17ObW&aHg>8>QbY0)EPS$pqn5?DG{$
zm8TL%8^Ux(b4T~z2$RT9P4IXDqnat(92Dh@PPhtV>ZHByhNd&;<dh!s=jF^=JKX<z
zU0n{sgxDP05+k`28<dHB3wZiX$64QTibsPL3$_x@)5_(z{bO27Xw|gmza7)2@(RA)
zh};;O6dSWT%En3)NQeV)y+Pi-@Kt^XvEXN(UeO`)f$Z0^h8>>tJr(r{y=KX`x_An6
zL^X_<A285pk@73;dI<#M#UA9)CEV=z(O|wj1C{6(jsU{e_kd3bM*UP)2{LvTgm6bX
zLy%@bZir%1mS_NX33+^auJBFzk<*H5aU=;WL4`|qa;xmiis;V!+3g3v(IcJSiz1Y>
zZ-xi&lqK&0hzwjFZD3d`m>v%cy}KMT^r^qrxUA@B(-Tbnbh(j!c$epLO%e1Pf?Y4u
zHb-6g9ORRJzF6M1+z{7sMFXXy-yU&__;p&?j%u!bv`**Fb~+w8)}GE0r4eG1<o9Ih
z5{gK^y>BYmBgTbHM%bB`C#evcBs3PaOFvT8yv7)D(Rm4FRAY%hVk_tCpLl(!?i`Ml
z30Rm^1Ud*_I!7rl+m@JDBo6vj{oLl+lK8H)EZ8H2fXD)fzA`1HNd7lDC$$Td%d1R6
zn76X?LfOIu0K)S59jvL#8b<t?c?R3}Xmjc2#6^z~mHm@(#NVImL8k$(NxbsO7p*FG
z=E^kBXYPu+M&G!LrYGi(RNZA$6l*?ws<2)7xs-08_u!p@9T^OnC9n%HVU}iw`%KXG
zllkkmkC%Sl=uoE~3G6U(Dj(=CL#aU~iLznPjuC5$;Kw%NE6MJ_rMs0yrB2Y{pBjn{
z^9tenNHtqEO6o-v1k$>>3bl2bipy0s(~k>V4?%tDR;cia*XrT7U8_uL7g~yxKrpfB
z)s5zXiOxJ$!3DUuc86_;l;Haw{xJs-2}gU;>|Ek5TE_vGvBEqCW(fBe%-DKl_pm;s
z$iC2kH&~Y4i6;?g#Gu?GohU<hi>}W+D|gKvWEOH;{pba*+44j*71@-0p;Tn8$y3(O
z>5qbwh6FxlET8+m{d%qHYu6u#$POe3ZGWFObQ)6K3)3=yaAG>#E$wXM$bgmnC|SaG
zO;CJh8;VR9O{h;7eXZTD15gD9_vYpN19hp_e4k*-Uk-Sf3pKXn!3;WYF;%(Syxt^6
zYF$qBgV6Csp&Idzy)x=M$Bv|}6cdQW6lUq56Ci=*jEaX<4K@^AsvmL4b{TW?hH~St
zC)69*=kkw_*`Mwh4JBlgUl+ADv35F^PX2BF#`RW1U*`f{tJtK9|HP*vX&UT{uY74^
z&Qr<93fgJ6ZK$n}_PCv-V<AJ->Z(KEvaDFYM!UVP-1dEdec4lF<vC?CoSX?T3-?Vu
zEVIV_AWjH&&0BO}t+7V;zJzS`RR4l61$IHh`du;5qS<>bcHJaA9hIuA8!D;Y+-YeM
zo<srow;Xq^To#|MJg(;ht5i-P!kw=5ETKfWl~c;6P72Xm%PT`nL)Xgc69(5Fhg9wD
z7(cz5qL<IjM9;#he_Y|~3h>TX)F*DGSwlH*ezD?%GEb4IK+>J9)QQ0LyDk#%rUdcA
zkX(v9krC{4BIrqP>X6=L7@6<gS(bC}+AF9r1l+S&8oG-Uy<@t+Xhhx<dcNLZ<BrYt
zS$KsA2>Sk~#`Z-2y+kGYay1^-d}@ZPX==KM>b}z2K&}*>ez0w>$ZIn{#@c;`ANtZ?
z0hiyZa`ECB9&Bt(49x;m(Z|RYuTv=SG>f*XV=N>Pe&|V0aJ6drCxzz!k+0wFEg4vw
zD?TWkB<FG=Y&lBUV8ppCy94O0(MOJya_28`Nmm~Gz^c1t?rbNczM!#U0Vrv9%$J?Q
ztq!t}mJ$hsk;((iYdmwyja01*+@pAVw5>pAov>Z`#CxT&)c85+kM^fAWr%%JPr#14
zFc!#Rcbr%_jYlni`xSJ?zU7U|!xQ1&Z2>3cQ0?d6`3i!6_)hr8KJYn6Zq;{2hFS}y
zr2s?$?)|XeF&-VlQ<d1uobupwuaaH*fUGW~H_fBXX^Xfg$j{zJ`Mxt5RQn<bvhzb?
zyWMHXU8|1@^QLxcblUy{a5*?e&45o)?J~@l?%noe*|brst#=g3=15P{IKN}<yX!(v
z6@YZ)3%h?hS&66PiW4tCQE~Yah3;<8AHC?R>wOR|_H=7<o_>F$gc|OrzF_y%lR1_D
zfot9`avZU%{V%$S!c1oKx44*<MlWp?7|q$Xbsv|o|Mcu^YMw00^3u$=%baC9YX`4L
zNOv4{4Mru4b4B-n#L&2@S6_aKj53WG4&oceWOUs@akHPq33SK<0b#5nBZ!{Ls>(@f
z?{Xz2;^mc{oq%0NVuHfz$wg7>lM@Nf;i4kC(9cmnGckONdeR4dWn0_R5%g+Tqq%^K
zKJhnz*dQk3{|Gx^@UEdd)@R9X8Q8n6r3YAb|Bui<Z6-TJPv=0EX)H&SIFmcUEg|SA
zo@u#}t(%#4%v&#0X?<$jp|~`CC!LOAB*ssdDOhwAHK0#~*E<NK!bz*o<J7xje|hAj
zhgcO}O9?ZX)-^fm5@#qYltdvFFMs&woMyT;OzwF%0ScErqx0pwns1ci&d61U<1qqw
zm$Lsu!a@FTnE)OvT}Zk`oJ^~bA{yJ=p}#w_<*99Yz|fafX)vWAw0iv8W5)>GzIf}M
zw=~8)Zs}5dKT7oro6>@w`T%dx{9HK;!h_i#kQ$$_*kvv!UatFNj+JuXxhuIUeY!Br
zLiN6pKarq5cJ-WEoEr_Kv&X7TAZUL1@@2&aHH&HG_MKcTu73V+1;hSF7~s#(Wd8a;
zW<DcZqGsc+h}$m|u7-^(x<h?=yk(3YZt6F9ddi;GkC9AQl?4*beSX$G7{quefn4+i
z97vh~o&!w7EOS7W{J%}Zo|ivmY5}<mPbc;l0UdJtkMmEv89iiNMRW!Nv{nDde+*Ud
z_Vi{O@_iT_aFwb8ekkZU0tigtxQy`yvdEW^y8%`ht*+1Gut-`_*zE2Y-TQejks+Fc
zXGjaWl~BAeU~l>?<BJ+IQWbjaS2>>q@Ay?mmGOJUcmgmoVHNk#7@F>k3dP-N4@^0F
zsZw(FEP)C+v;MTbZ2C-Qkh->8O#<1LfpbRf`CSeHG|>`ZuNi>r0Op{>9N=d7x5og4
zSf5<HhdTq*C{D=!O4xY97Vu~k{JTTgg-^*{5u+|%`3?duM}>H-*fRYVp?rBoeZbW(
zPxD0YUzHAlqCG<p=vnfAy}x4tclg=QDR0SfI}4eIcVr~-2bal}(;|Rldt2<mPAz-Q
zpid35q1lRq6qBcIe42IT`g`L-teXc&b$wB*6PGdC<S!8F^3m71W5SHlMuL3Oh{mXT
z!jx9raa<?DRIz%3Z$`{Gr4&hAI?g#(@(NQ0V2IPbyAXd}zt`_s7(<V^M;*L-&b@C*
zie~L@@58F{a^|*#E427cIsHT96emht>f>Q4Tyx-Rs3eFUQLnJF-hHb<OlP!2B*mXG
z)XhzLVobTPfI+yoYiT1Wqav`o&Po!fjqKQ8ikZf|^92M-eV`MVhDt#Bu#p8^Gg_ki
z%5*Kga-Uue380M-R+(oK)P0gpx%*MZcSG|+gV@icy=yBIX0)i=;>~vS&mUJi=BPCb
z3dTV)mW|02^Iuu`IX>LmfrvWVa#ZBffuUX~BZ&fpIu%7gI(?p)+@_Jt+v;&ddnOTE
zjG=odh`0KV-5z*@F~;z*e~D_&AeqyrLsBohwEWfrgAlfdt4=)W4lavAQ>Q;qwwAMg
zNe!hgNU%kBvc@|a*$3iPo}~!23Y$|pI2+lAg7~Wm=4Y-mI=w(Xc7c7%ig#!^7M)79
z?(WCzXcl}a@(mghV9G7EnvU<LUeO2cnG%s-Gp|_cM4|1zY>98;-=~#R$i#cjg;*5p
zEuq`VCc0`1q}-&!MmyVfoLi3PUv8)ZC@XSg99(0mze<m&dGrZDd2u*@*_1amru1<X
zqEWflR9j=jA8ZH|sVnuBp~;-z0y@UqwJT1g#`H#PPoQoQDAFlZkae<ISG+`^D~EF{
z(r!ewN7PdGhKGNCfolZ)qPAZ=YJC@)9`7MLbt*XZ<in#O(jmY=Wy`L&{DIaP@(U>c
zyWzB-(WMWm*XYv|r4yZo`^7o^wU?3&^b+1hPC}fG%6=3oT&mx_8=lVWT_zpeJhn9c
z-qQT7>?X9s_41DGW7ESpDrTM$Z;9o6`xx62T4EyViN$xV`Lh*T1TB%I4r8eWeOjA5
z=&cW13(qqoXN*+M9QgUBJ~u2kmbW(n?fAj3R*4B#=@0ju0pTyLrvD=bN<X^pB{2zg
z=WhR5(i;;Y?^?TLg4KCCAz@Lv0~E{S?mZ|6es)3-I7*2zVN68$da)$95(n>?oca2a
zu7~oNwGfulE(qze<4ZhCgVKxoq^y10TzTqP!~#`uPQWyWr2m?nM3)7HC!ZwTvwk*3
z`_a)@T%DxqFe!(@2wDZ8)$B6Ys#=>aPxCZync0v8qom4<!cKKcoSTuPTQYUO{eZI@
zP3${EK-i|;=GpXMtDN9#dQWHQie$jD1U(*mEc~iABtnw<YvXjFNn#zmG22tuZ<*Hh
z9kt=|TM6nBl{<zCAL8W*jm4)S113+>A8bNrK{Cs<qVKNTF<UZ*c2fj7x`%9<eM_}2
zQQCI^<kp6SGKM12-_Jvr5hWI7HI!}2W$E%hTq0Z|<`NPlJUt+FbWnLr2|||JL$vZv
zukUUoV>d6*sF3R}&4eXw%DdjR7ozQssK2=Dh12Ky%FMG7#xPxMcVmR9I4=gWh(5U2
zTG&F}L-}M?mo}82T&`T8pZeVecYV4R(o%R!xV$iqxWt!>p6f<TY>o%@v2Ugc>1Dkf
z_bLVC5poku|0X;CvG79OlVvU4nDuo!n*wPV6CfvQFpcu%%$l5&j4$wD4vlA1!ptt0
zHbSve*_I#mhS3R)_U+71BKLF$chT5S>Yky;jK(0faOP*!E4$Wq9=xSW*Pgz4x?FMW
zW4`ga7Od%A=0Uy1{20Ji!6>(^vrpy?k*{+ClDUFdtG`UV-u6fe7kvY|oR7+^Xw+TQ
zt_DZ=^{j#gmf<9d?hHl-{EW_i5ZkQnqb;qh4qvq;6aekgnhNa76k33-A@Z$*yJCG%
zha44|(!Tczuckro2M3L>CrCL=b0`Ui4bot36VPF)a3=gCCAQ!VrT`C;m_A$1#HTZx
zu#$XH9fN{Z-8?X{R!Zh^R<T(05;~?6_7_1&g8)Z(grj9`@S(i%pI73oa*t@;RP_wY
zrg7MNPe)%%70;!&>lLBdIa)XOJ68;5>_k~oxxGM*RZK6kf=!vUJpKt>+z{S1K>bZR
zPhO5y2*G!Vn;4aao0oXwt+m^<%cT=tLt&T~W^6kU@Nx!;hz+VL43$rvi8j8^+oCsr
zkD(O#DnWcBxNENH4tg@RAu78-jkeI;AVZi9q`9xDGma{R8Fw;UK1hu4pGxlhLn(|Z
z)K=a6dI${w!-C%{|14Q_0|1^@LBJn?cOIDtEi%}RCX8uCM#C*h$!r<gg~QDs6A>LD
zvw)CuM~4Spn-MEH9*TQ9p1fBKeUcBI25C5l{q@iunL2F41E$JV53~%v!Aq+Y+bGh{
z0~W8o@a$OsW;hkLT_nn~t4EeZt+zGRmKfS&^|n^w`#*uwrdIvkzo4fzZ+A2UISY=h
zLz-~HEcUJdr4`E4=J2Jqat!3<aQ&nAeKkC>Lbr$BLXYmYEMgR!r_Wj-BEul(Tv&A{
z)dJ4_ZRPm;NUPm&b-wH(A)bH=678~24zk@ZB~e=zoh<hka17|gum;;)dB(GJmQjI|
z+omax#bQV2*X4b(nX>bVZZNvAHeYW7EP1UTnxt`y%iu3~x_p>S`?FKeD}+hj0J{d{
zcL?=F+pFDxlHfT)%0F+$lJNZLKLDJ61U&!0K1QbcGQm45ahXVO&XhAxh3a)^@&lL-
zrP#Sy;VH8Lemm<&EOc`lOCGsEKYoB0h5}LVj}Itt+>V8M*Cw^Y;n@bM&Q+FWx0zmF
zZ+uf?^=mj~)YDU@?CO#w&Vrwtk3;i$_u+PPNtIMn=mwr=*+{rcnqkaaD@*2^S>cPg
z4zEuu&kaVtV%ke@fMp>zODmjoJR&Y#N=4s)gmNqVBk1_^_`NkV52h*Z`OJ1*XIkpW
zij%4%qm7V|5S<?#k!Vidw!RzEGC45Lm3ptZcAA&0Okq|@D^OFm^#-#i>JTVgZ@vxc
zyR7wnB!fQ*Q?&0>t~A~<Zjiw!*ES4Ixwil&OHke<&C&S2!TB)JCV+kZ)$aD+AFKgR
z@>a*i*#gD0YSri7=}LQw9WvWv#51;wzHdX$ms4@YkuZ%#cHJp&(Dr~<Zpkz?_Y=ir
zgZn_@mvTni%b~Wb`<3*~;U~MfX{H(Ride%rinB*iu}WRL@7;Oa(LwF+K!kboM%y%s
zU@U*x@`}!QHcLZo%0&_I()(ThpPqkA&cf8A5kmo_8(|<Lm%8c*(Ov0GkEmGD?W)P8
z%O2BBf{Tuir-Z1TX6oPoaUY0(-G%z^44`qP&VBw^B|Tn@%S$=s*r*wBDYtum)sXj4
zeD@#e?%;I%TMSckhdq%I&Nb(PZ;8jz)TKcRvC8Qp%*7aiXzk`uV%izbM_B5{OB6=C
zK{dH$mHCCH)AcYx-HFW4G2i3#!gkXijdFOA>d$6|9+JoRu*~~1Id+i=IY7sE)`x<X
z7m1r#_3-a2Zi<jP{~GgF@ZawqoHYPc8pEmIcJMldTOP>l`1o<5Xj!@&F0A#=^c1SP
z*^R%p8!~hbw^qjl+f{dn?V6c~Hh#|m+DXG$_P=Z(|IBxuK3_rH!bVH_t-9t>t-;9?
znke;AG-E|IO7Y_hLX=fs%p4a|6ParB$4%?)oS`Ap0IY&`9jK*O_RK)<)$c~~>6Nyn
z!xAT+k-jIL1LOIPQ#{Smee1i8q7tQA)}Ye)Eual{HA)j_wiIR`<V!T#z)ARfbVjjm
z*-j~WU9QPW36wUdM7K&pHnE@~?}$Qh$GJY<pRE`Ba{t4RDp~pay7K@1h5Bz7H_Kn+
zm-zqT=0pheX8!mK$S_#CDstV#k`I&`(_MAP$QSH@Ax@XSh4Do@Q8PG;rG#Rct!$Qa
zChzzQYU(T0*V5J-aOE?H$Z@8qq4KZkrfM5=(yW-{bJup&JNqF;WNlYIl4vu(V8VQ4
zX2~wP@k=Ln;0<sXEUdlU%2}i|yhGJ_q$DRhO7UrnTHI;HkmetspC<LSpd=zz#16ew
zQvspEwwS3ugg9@TYO6dfm^RYmdSkmR>ifidh~vX;p7cr@q5-BTm1~g!FfYlJbiRTu
zcgZ(<Bt=QTmc}X~%vY3?K(BW9d1g=2SV=XnM`pR3LLL=biP7t{v$x+N@7w3eP1DiP
zOIH&k;syO)@^XtQp52b-dBjlKQw*oXS@S7Si4fXkjW%ScOmL3c-N2M`dqydrUNY!c
zPuR8>FkpL1tiR?Exp*dl3<dA47St}eKReRzF^P98yQ)O~*h!SsURm$=>GZS@@fKyy
zWKh4ptZ|Nt7_#LnMw0kjF*zGWr&=%wcXpsRg3^|K2y?6_>na#l-YYSNt~O|(UDEXT
z$4!F7sW<eck<y9cF~oN>>USXM?Cq-a%Btf(Pg_f6l7KvCo@AjSc_YDX=Y7Wd>wW;c
zQL*@XT^dmbieCE%&GR4j`a5_Xv};}X+)N3rYo`Zjq`}EUvxE*>LaL*m&Y@4$Hs0VS
z9YAVPqGu6E!qep~n>mnUSbFD;jkOVBhZy~vo%>%Z_)s&AwkxHmUC%%gNffU^o&ej#
z*UYfM3<~s&Tc&i1WFO(ZEQFVDPzhk%%Vw08pk6s&4*_6d5BLm-F`co?k^TmZ5xGaC
zVW69xTl>S|J@$`R)Qfosu?ZYbJzG=;BR%F)UAb=Tv1K+3KTLElnYsQJ;(9c2rMb@6
zqsa2?wDb9|wU$@|ve&oW6$gh7x%6*Kg37~^eZ({Ejh;gQNnQPfkAId-k_uuBH<1cx
zHy9+lwp_#>EB7!#xH9Ms*i~OS+s=CdklaMobbaW2Om1b_eMlmVnQTxu8nzQD`ux@$
znCIn+hTqQt%HQb@|43+Q^G^V&_G{+9SG-kYH8AFxp%R>_PNkj<Kq6UCwEFr><!EO}
z_uqVpulPzL*%_S|8a9lEOGN4ejlP9}=sP}pJc?GOy0>E#_qnhHM(h0wGa+GCx|9AG
z)9+qdIq<XnWVs;_wq6z8Dzs+?0+#~v3f7u}uX3cL>2h1(KFp4%W?;T%W?Q)1vnw7<
z(<eOK^?pTHdNQUTXWVfBWu2K9>+z(TY1DtcSNU8sk1UdBgP1i|jC<t<{l2&0vPFe!
zW$g#;;{oc;#f6Y`<D}^e$$C29N5Jv+CB}-*Q-E|iB37$tt}hc-&oq5bzH6jE6wPGl
z;KS4DdU@T4+wG&~2=j?Hw7{#3?P-g0%IViCDXkaS8<N@A4E>($8L<y%V`*34YKQ)=
z>pJ)1@e?7@Nz7;3nZ^G>MNo&@j;zl->5W7*{ZU$c{VSTFxVa^e2HJz~BeY(=m-%%G
z|K#@is0KU9+k#b3)M%U>BQ`0UpkNOow+z4g%W{2x!s$yok@Z4=D<8X~xt_EC>DR&b
zb_i$K+Ypn~y=Xuisy=;ih7r-sw*d|uP&g45R6x#9x+7!&-An~YWIx|HK3Pfbrg%A&
z%&BXX#2s_$Dh8T`02j#Pm(DyDbEQ9H?8_Z?MJQQdQ`or8qjB3AI_+nkR1glNC0Nq1
z`;NYl=Q;4Pua;T{+U?_W$&g~J2XN---p%;wcE9lSV^~JJ;Cz?e9?<~mdP4$NPN)XE
z;!TeM&&2?|I@63#EC$`}yb!N%N1ptgVF~MqU@?1psATfA=R@Md$O%L?6iokWds`_A
z6nbn=g@Zir5Oec~M#2stD!i1hx+DVWymT?C);!GSfckYJQOEMq$}^ij^)BnvUx4xs
zoJp64h!WdCc1A43DtkwaUbQ7bNIAV|3S4D*K2e1ra8Ov5pzan|PA!Ro-wgxQuXr&K
z@k;WHW*li`o<GDN5WgyTd68s_9{^XoG=1pyv-)bl^-2JaDeGelFjzGM5}Rr!biLAf
zGqvvO?wD?IQQqBg$|EV^>1t3x|8kj5_HvzPxQa&rH_h)q5GfvXOLPnM;PmXYll@vu
z_m*Ld-PhtFCx<}(wDSznEJ^WL;nK-Q)3z&as=}H1>VAN4jt8K(`OmKdcg)!gQ=LR!
zf#6)!(@(lAF_serfdwVqqlfa;<MOn(bg5SXeXei1#|{C0;(4Ka0NnBAh12uT7#)a9
zu3#VPzI5Tt91XdTvwiNbkmx)|3?-uzR6OLm-0F^!kAM_fu?`hDrg=9GUd)?)rO;Rn
zXvzs)3h5L{N<-9#s68^rrB8~6{!xRCZ-ljyrG<q~zgqQ@oRUxVT*J8Clf1iwT<6*G
z1kjG)^CptEg=&;>KNuytW(q#|=u@J2wMYKqM<~zN6MzW*Tl6J4>*aSayv06*X9taV
z4`2OSi8u7VY1_<r#Uz#&d<@XdaWUZ2G%VU3PlgL_YGRt`zEbKl?lf*$pT#247oM;n
zWtrb%)C6!>?Y~Es{zt|2{}(@_W{mB;cMGgN^d_2H`A@I<=SrA5`U-Ku28HlojiNJ*
zFqZ?#n_34SVRrWXOOfxt-z#Rm>C@`B^zr?t7ergpb(QSbgec)NEGxP^7{XIR;1yiF
zZ{QX$gty>SS5K|Psy(}d?FG^&-wBvk9q#U}J?pvt=#Kig`w<C54<o0LQl<4+6rO7A
z6pzVkCBF`<)||XzgjH=QD~ulG3Ug0yAEjv3J-tr66iuVV_R5@q$D#i=(ebC(gq)wa
z$*c6?LoR^i6oi{Ff+~)I<g$Q_N_{`Oic2+OTRRh*fLOZd>|h7kcCLp@sKdsKr@noQ
z#M07N3r#Y(k25x9coED5DwyB2Ds=fBkYBJ@5`p+ZJkij9E8!W7;0Kym4`4PcaxWp{
zXdW0eaV5&F#F*vshS8-*0@;%hnSoJenND8>s&HWHWPmi&IKtc5Bxio!3Zio|FsABZ
zPo;F9`As+)zplYdFf`CDj<f<!jxnAF%h_r?t>3PS&5d!+g!y;S=Uf$dn0ZjiIur9&
zl@hZ#(7DUoMPA!&Ir~mNa;LWm<s!uoLsUvBER0$WvMJ@hp8mC)8O(`6b}!DJolfB5
zt*|_*mr>1TwT!R>gM_<AiW=438BmTTW*tQNainTEd$RrSk6&!LTfa#WqR;S@#!EMR
z?_2pw%vr<lfm{nYzvV+Ix5eJ>);fqWxGHM)=4Gj`3%fr2$o<K;Xv}C-RDkWK#$4(h
z{PoLF>4&(#2u>lFwIJCGGHCM2VDnN+SXiGApWW*GsRZTJ_JgwTY{VNco~h8Akc88c
zNnD0q=6dsBF1ln0@UA&{jZ!1IcHJ4(iOV^gJ?0S;x>_ab=+E@e!k<cPOY|&%lB%>r
zybI8aj%&FVgd2}ycjVuqeR#roy*c>+$CkIdfffjE62;1NWzcW6;bHU!w8wAPzBq0R
z(R|Bmi>6!BR?RHC7AM|w!?zhg{x9*IK!FcPrey*hJjh^O)<Y&jwG7R%cl8SICp0+&
z2X(j=UdO)8QIjQ+1>%~gw;b)+Y$J8dk4cF0lz24=%v@i<8(v(w;$nbKNXN@mJckKp
z@ZdBGC4!a-6*ai1XX0P$`>?3)r_1#QnpU5a*suG6c;?e}q3Ls?t2<+8nV|FP-3SB>
z+3CjW<KBMu44SFl7_(H{Q2$w?>eI`gFzT~gM1C=!uMx0ldOxkJ0!B(vb+8a^d}AB6
zci-_O?|)WIRei2gcFL@s=Y%vWRzhYqp@2msHFkB*vSK{Q@@EF_4L}|-#fqH@SKxM*
z8y~D_V?k#q&o3H$a~O`UcvHd8Dn2nkTkW~QU_uXZpfk(sG!j^b4lp5mChz+be-W6I
zlUbiFkYFdq9iahl&W5)p*P-5q16*?>T%mgIK{kXG-4aN3#x;E&%E@yX?P?!nvq61o
z1*N}By>+9^5<KRTL5EaPdrTzE*}VuNXGXBnpDrIEbCCNG9PSIK!?aYVJ~-kPnJ`EF
zobd&Qp8`-qEW`YpottG%x1W=YKD4>#w!w&68QL|tc&zU`=gT|}w_2PzFrENe@#p2M
zL-VY<_En%Rk#l}L>ko8a34DG1<8b07)gZdMUovW;@i}<ZH8}iSewSv1#O!;F8N|~m
zJGADgm134XG-x=Q2V>f4j8PjfKnv`3VyfR=X1L6M7(!Q0Or%{QM8K2{`W|ITzog3N
z9vqQqWm^-teNg#1`1B^6;i|W8Xb;#AZ<66c;43wiObqB|ztO>8`wt!m97qpQc2!M|
z_S8GFFMH69KO3i|HP?E<(wJdW@fSfl01|!3v049n-@q4KjTx6Mwq6pRVliU7-56)}
znzB)WlvfoK2`UA4ACHh0R(2eVk9g~CnV+?^(6W<37l4*kz;&p8@WuH06%$OQ3x2Hv
zh>w!fLYa<~@R9bTik{YewlZ~GPcY*i-dp<Q?j#AMg1ZzK6LR%{K661saL}b$;~-<Q
z20qMH_pQZteWQdFI;K0*Ez$nCy#cpzg1=J+*YGj$)_0E%|01wO(lp~w%0?LuO9S9J
zzH`70#L00a^8tQ`6Mxt|k$BV)(~R(a20Z(i^uy8V0LtR$&-As&qsQfSPtsah=LB?!
zMw@{)*QGe!>QkB0!6>r=0~M%<eo6i_<?x8W6bJG5WMqIPwe0^|w&#h&ZbVj)2l+DA
zU<HEBct~EcYdoA6?HD?H6e3w(yF}ixbY0<VfwI%v&-EV%t+{#uwuTM=YE+tGlTEu>
zv7xcf(cZ+Ae8ADe1<$UL|7-O`e93u}oDI{BUO<}V&*7DEky~CXsz%p;8YeS7n=PC%
zIB8+&YCm}90ZPckthCf!l_FWfn(zN0>;ON}QX4y}<6|BH66KQ52UjkkCs!1HF^~&L
zI%~0|>~Qw}VyD1mrH8wZaRR<#X<JD<eV%3;a2^Z11&W5A=hy#>!zV#F%a4JSvLKuE
z{nyvK-v%rtKimBEu$8%c_=G41!iCY&A3s*Al=*zclR8igdnGWn0dMrmuI;R7AOC(i
zyOK#jsU&)Q6DH8LNN!yfv(@~d;Sq6S2Qw)jPg?`SyaXTtZ%>`4HA}j-ligDFtaX`q
zg(>$`vFCF6EtP>dXG}_}snnGcJH7&%<%6WQLpv~w!7j)LmJgUYhSzBx(0}Cu@jovL
zUyAIPq?r0lYK!_NE?y0Ag07E~>i_~c+vK0LjuWML>tp-8r7--NNd4}OZB5(Cu_Z!2
zslC?e>(>_7p9f!UigLDP5DK&pUEf+@Oi-7`aiyO-IgKr-xeq;(QZtMuzPfkQqoNt>
zA}z^Ic$UtLv;3jB9|r~V97f5V!fH>zAk@gj4zN0%Uy4ZfEhJveG;P2yyn0r14#r(2
z`Dk`<TZh0AG{hDEGtAS!{GY!j{^uOcTJy}=)$4QwFzoLkP?L0e^IULmQ%&vg4znz?
zj5h6DB7r9B0InjIb1R~&Amcl}eQsKY+mtG|2N_w`jFl2PCHXhjy_Fu9j;zUOdy6dx
zA2g4Ys7>E=MY%aFw3#H`y4B>UXI_=z>0R~+=n<_BNjMj+s<C-Z<at;$Vs-TDJhfg(
zE2_NEA^jm{cSd`U-BeIaG$?OzC~uH6Aei8gXVa_xwSA_bvJfpe6cz+fJX#_#;T?06
z<IsW<Jw}g618((MO(`u|)cc9|bmESa#eW!{B0|N745h6|qOlX=ik*OD!fr>%d?s}A
z98q_8BWYEax<JxCnKRR`TcJTJO?8NNLZm2y-!0U&Wr#U2CC9p2(yS+0_|TntUw<&l
z9`MD^kzPi?+=_snFz_up?WMDlP*-Ysa}U_u{Y~{5t*JB8Kh({4vY_>D)-sR^I=_-u
zwS&#35P;T)J_1@9%4r`zVbh_r6-MTyx^qH57bE4Jb#k|QH;*x}sShTA@Jv`!4fvKr
z9V>&VGqbmWzu(*N#%&{J2U4`GPSTy<VP4H(Mkl%gel}+CdbsCVSvt^}O3fx}+S!Tb
z3@U)_`drJgPMAT|aLY<{I{9*8$_8_{hfU705ZCPOGkWbEcH6@<YCv}f434uwFNwQZ
zYqwu&ufftMNK`>@q*BkMePU@oC1v-#cTj9}fv{k2oWDUc?uVb2Ty!kZs%+vf<Y!h8
z9ycZrXZwc-pFKS=N*yU;5$-|+rc-*4NS(ee_LeoB3S?wnZm>5P-WMsDlDs+q(U$@a
zk$dVn{RM0ZVWK-~3Cxd5r5GG8q47$i@pa7c=&-!pSdfhRxWyQ!-gox*hdgs4Qg%$b
z1hUuV30WK54S`oG3Y;SjPbUSk)Z@DVGKgXYG+9}|RbrV618HMMR};D`cg_LMfVbt^
zLndeka+ja?@zY-EEu_=%NuQ7IO>Q`hh&2m)%b%>sZVGUGI&0-G?+&TceGX)0#LQum
z)?hi5k7ibKdBy=sqgBG-d3oR_sYm5Wz`&P*8~%3Ww+g%V82wNOWYFOPW#P!6AvD(Y
z=}|>g)<LmtC4*bw``ae1NNN=Rx%4-|7{&dlH(+A``G$O+F@8qtkd5+jhu*~B;vz6J
znQXufYUh~y@F{C!U4CcP9)(l=vIpp+Kq7xgE4rDYJ->yoB<g^mTeJ-q)*ic6UJ=c2
zBHAzO$X6cnL7W>}_EtwXDBxw|8<F1}rQ6I;FfHHo_lHfJsn?2QUtX{TYC$^DLzMFH
z+f_9(fPXd<aQGH~U(hG>Ox4vcs_}|_E(m)v5mk}>0cO#0sMo`1mm+vfy)7(fRW$P+
z9UtJmi~U9Q6&@epc14R7p025?U3-EEy3lw)C|JE;Xk!KodYPhB%NI4z99UY6EaA=5
zTYCN)bb)G`pV5atgV{V~3&pD1%hinLeNfy7Skg=*88-zO{%-Cif-lN=SQNMx^9lzG
zWR;B|E=k%|Lw{q5t-A1Yn`KLNxdE@h0D#?lNz67t7-KjUN+yuZiA*#XEMitpNw;0j
zAZrXCaJ7+^8wWGlI!YC{EwfenA+z`QKGX$wKI#35e1PQ)Tpu&D+Uqg}VU0ut@2Dgw
zeoI;_%e~AIZon*td>H@mjzc`!6Q$u{cJuf#*Vm`4O-_|{34<meq8qN%yH^ZYcKt6Z
zBpt*=jFZ#_dPlGJ`i^c7N)HxnG(7?~CByZ1eu9-w*kA0LA#CC%#;@n6+dYUQHKN-Z
zz#Y=eDJnI>5BVq%4!DeRwxNEZZq<u-Hf~KcSfK?4J^?aD2Vun!Z~jDUdz&u64aTdf
zayNv{hWSUMMcWmpO3maTwizZ)m!lsBIGL-+>F6=1uIlW`5|844d^KrBFbQkdjPC28
zK^8HP#N{XwMYq7iaqpG5$dgqkd3MVC(I!D}p+7|LuN17IS_i-ES4mySPa-P4OnMf>
zDGaMaz4_z(y{v24VsCm(CKjmX&J~ZO@_SJ4dny#!7U>_nVT_b_)b{tUlj@g#Oq+Be
zvG0AZlj#&G$O?4-f&)P60R}viOAf?E(!iF|OS<+0zmj_A5JlO_DZ>-_qwaF1^axbI
zog|rT<HO>3gJ#&~JsmAL0v6Zqv{g>`gD#}*LmfGg^Y2{+&SUZu-9$Y*JsbWSO{B|6
zzmf;^R-|{=YsQ0&q|IuNK02u|`mH?IQ}wJ4z-vD4%t3FImKXp;3J}mRWLGOU;N<uk
z`!j~@4hkA>9(6r|HTMA`y?a!v_2%khv1`Br=D0B0f&%-^O~j}(!)uzO0UtB8F_ll|
zO~fyt`hcz<%zAI2KYk=xUzb^(NFWxUe7!qlp;khvWstI1>Nt;q%r`fBIl+Z0Pu9Hs
zFYaS8nkbp0-;Vgnrlvo#^GDC$EEg3le`~t)Z2cEQ@bhKBN2U*?;(4OJ*qg!lPWl*9
z=srd<jPQT3{FeAI{L?fY?SQX3PUY(MG)AsXnroy1Y_$?aq3-x&VRoS_>hx*k=_qd~
zB3Sq{7!Z-c+ue~T7g2X$fRO#9Jj5bHajfKkE#jzjVc|iHPU#@AAtU(c_fiIqcc=?_
zA2#*^Gce@mEpvmuDHCeNmSvRqswUpl+;HH}-vwrYR{a;X-+xsX{?or}z9+L(1#I~;
z<xRAB5YFUAl8?Ji?F7eLkHh25SIP|2$vbT0$V%Tu)KS5OtLe%a5U`C#wzB_4@cQTQ
zto+yk>qQIiVcJV<>CP$GFzQsEz()#*H@x%wf);<{GOdAPi4;f~YI-!`E%rliR^2Rb
z%iZ#Dq4>p|tylh1*m_dwAl|uEbPb5Gk+D#ZY_4?QgR|^qVlUdYaKPXs)rrQ_kemg(
z$ZffgM5o?Rs%xy>RNMpXk@@WKntH?Cvt}F*ON%`bEbP=^+?UProI0nZaVe$mc|~ot
zA6puNGv3xBxQsyA_vGWl<0rQdGF$;<Ym3*P@O^sK(?mWAlJh)|EdRlfMt|r*+YmXa
zNkQxeN_e(M@j;3GP+jEOi3|Yn7~26DpcwAUI{3nvWQ%4dm~<q0k|+i|SN?>+os$|r
z1#cDh6#=4NuJ21f#LLOt0hwT#jbQrI@?PjYi31Zqw2-<p<Dp-GyU@$2)uoS-3UEUJ
z1Qli6gQIU<Ml>kq$qU50F7M2e(zB9_d-#q$VL6bqXU#ALJZTseco6WfpKq5hd9o$G
zsQJE%2SQCS{4&>+k?$Y{_Cw^_vP>!Yo(Z<-wBoWr`Vo}AP8}T;)O3H;v^uOkJb&*d
zzMNYDMMWDc$3<cI!1yay+sfLnOATyy=q`w833(5;0_0ak36NWzd4}Ux&U9l$hKB6p
zRlS3oI4{2e)7k8!uz2a=ii-)H|HTXIh=TcUXx)xWm!6=b<NE6x_Yz}2)L&!a4YFrE
z7uzc!1yD?xdgtnxf;ltoIN%ybvHK+(;{)kG$<P9`g%<8kN{d{L!SBgfHPdHQ&TsaC
z+H?;JcaV?V4L82{nH##1RbDcKS6J{ALQE2HAk>I)PClx-Ib_=G>MXWOw~P0}&Pou6
z+RWS2z#hq7ru;AB-aD$P|L^t;f+Ah%JxWzTkS;YS0s<lmLg=XU4$?vmf`EW@0R;gO
zkWNIJ^xjpZ_uix@ln_Y5cRv2+dG5O9nYqu*+?n}<#agZdnB<(#`JDaU`?ZzHammXO
z6^agiPNZ%5t%QuSM>fx0E?eZWaAZS$q;3DuK!Q05O7&3Ymc>f{h}yhl=`YFUTNch?
zpL95MlSX_r3?%Ls(*;HoL3%GVGw?3hI3w|Fh}90UG~Z=$m(Oj#WP`rhFrZdkzfE+s
zpw;(Z`5*SJ&`qaxKj|Gog#8#ksw;phwO6$};S+Qp4}Vr?^|pEU7s`LJVFFdw%or$x
z?hI(|DRhFvUoHkV+ho?JaqE_gLZPvcASNKqq~d}=2?%`0H+NfKV{H~Upw}|Cz`H)p
z$LwJ@+2hO_AQLcg3;ec7+$(Tg!Oo|wtD!oTxDk_YmDc2BGt+yGK4%oy-#|~ogSPSV
zxEDQbNXR)S4*sYu>>(PPcG>37PR-C>utI}Pd>yKX4tKNjAo#as^+KE56ujerBeK>j
zNJTa2nS9mI=@%8bOB~wBJ7>HbO_1Qy;BIaRcsH!@LIg2%K+o#nr6?C~_xEk48E7{_
z{XPB<uTVb+akpAJ>2~%bV06l?cLkv4W3JwsPq_n|<ge04U~TJrkA-(FYae$oRf*5c
zd;%?5JVI|T8n8m>RD@3_hz&@v6eHUno^u3VjX%M%^V-*Y&#JDIxC+RJudGb$d=u5c
z^MokTPGFBP@jHWfew=43J4-8y)t<fl)n`)&D}Y+v6!ChGn!kp6$u`v3I#Ma$JtMn%
zLEUKwAmzkj6oXvQF&*bLxH6v!lk7KAV;Gra$>L8*?Puy%^u-qq4*KAf<Qjrsgm?F2
zpj3)XKxxOK&^^oixt53kQ=`-^#*`)7D-V;u@VzY&<%`uNuMRX_8jJzOYQeV<@*9@K
z3>VjR-Kq5hj>|TPP*V$|Hnxc6`Em2T;m+})h*=dr=hoAbkpVe7!Fz6+e;V_#mJ9i3
z0>8`*h7DMB2T-SHc|pc_bpm%aj);bJLobV#8}{OodON6h8pb)^XWG^#zI$mPaG#IX
z{myzz*1}XIwg}e*PMSpwHW#ma{=1p2-i<=n$JIJq#VJNM`Lde`UvJ#<{NqpGF17Ir
z_2b9>fqWXg7(5KUcz!)ly%DFeBz86bB<5&Wl*V?w^{)K;(sFuoP3oVlAs@}u-WgNT
z%*N3wI$_Uox6mic`#W7L8G~%o_r(ajxeMF!7N4F{?20;na%hFODVsH1c#z4atJC)2
zFrS5aWOh?W+A9dY=*EfA1wJY-6c>&|FUIJ%cOmog@D{z6CWpuG#gdyBjg2lDUNpLJ
zxxBoE6Rd#I(*<wDV0JKOhv_iIbi?drW5eD$zUxVVE+aKaqIw0#>FT4TIk>ssJ;<$r
zZdg2tZRUNjL>F=7gg+X@XuFX%Ix0=IKG}0r555}Q2Uwj6Ftni<H{q$<Q3f5=V3|eR
z^)(ZYXHqeeo7tjjHe5BUUZ_9cS}ub>{bruj3lxO|0t8F6b@G#@%HiuNb=Ri5CuB*L
zPB`8~olz2J|4V7v-<vBXi^-P{FJ{EtuGc!-(LX5kz$NM#FHCNU2j%L1k6XW{wI9_{
zuJI&=&$cBMv>kdWTkd+h{sRF}ZGX>Ty;-p%)F=$c>pX9_lZePZ9O#^mK6f{%J^n;D
zb_Oi}e{KK&xv$bPH`C!j**x>@>D^&tBcpDcbO&0ds{#0|R$9$PPXpFEsiaYzyz+i!
z5sYovVm#eEBD=Fz+o53c%PHrv;3oqv<M-%dIl*WQk_4x3feT+&K!P)x;g-p0E5&aq
z2RZh@Tf@sXe_ZoeVLQ~c->FpF{RPS}C7m)zhDJ9>Y!=H%_D?i6@pfAR=pH2wdx>_u
zPeA8p`<yv8`F}HdQ2!X&=&y-A-#R?EJ1}?aA=_&9MIRj=A`2G&fMnJRSI&Pz0V4ky
zObMzBf(7ORZ)cwbvtjgg3ja_ev;(r6e65u(>3(4SL&BTnw5fFni&4Jd_D1<inodQ=
zj{ncsQ33gLwCwX|vwKl(I~1p;#H4`bY;-|S35Ko>?RavV7;jMJTRFN*N8=LY>hqJ0
zD<aqi)QZI&Z?7PcnlIp8RZafd>$Qivbv>#lFTLtrTMP~eO`xv$e<sZRA8x=JftM&U
z?mEtQ(M7*YBrB-%GH+GLOS}4aI}x|Z1w9i#dcMsX`@?h?hXR=s*h+X><itrjc}GIp
zNzkylg*VLhEmrxyUovklC;O4a^wrEqj@i@(3!gU+eJmxj8J={@#O<pQ{ak&)?Lm=F
zHYAYBF5gjiW1Hpe$@It7wJ*)}3hOU4%owVmYD}9)Pt3kYAC%}B2sZdi7wD)930s4a
z;fw#!9QGd>#{PqUBl&0ie}SSkIDLfddN&5{aajq-Ki&tjJ4T;%4DIJ$%F=CGnw?J+
zK*^3@$PrinT8>b7CKGj0+a}+cNN6v-Hlk(hW8x{+&29IN8NQ*5o7sK}wF{5Sqg=d}
z?qqy_h*18eIZ2qQ)98-3<3S5E!nw8kV9dSXYk8nD?@ljPlCvRo%svwq(WuRxL*F4s
zC4@0ISo<jZ`@PNMwn&rH_UUy~W3mdFasA<@j1CL_m?v-Uiq8mPj!Q9&a+Xq$KGp)_
zR{xicOx$0g%Tp@xrZ~6Lh3@m^?k7^zDqJOhGG^|$eYVesgbH^xsx3`b)ur3R#gk2c
zcX|p-MvAv;eQe63(*$K&&&RG^-i;zR86G=ANNd~1j=F;22IVhoz|BtVjz%HM2^_OD
z`pIbZPTFu?@sNAqkOKP7<XC)Vq2HyFd@~2%OL9-cclRF-A8UeKOS*u9XD`ZY+$$i+
za4K=sjW^5!TD<AG3BM$lwyH$qtyf$uEZN`l%uYS<2&>ehKJIdC>fYNCEXNeT>_!9B
zD-hcdI`c&dj7TeF$}HK%#{D=@Dw*{PvYj!grGD)S)F?-NuQlLzGJ7h{NCbi$NnLHy
zxGH1uU5n}fEs#U$3u|8x^suM^Vwh^t{gGCgesb626}aKBsn+xF9L6w{odQEilPm#Y
z3Pr`e_<$krh9HwkiLdkIJYNaAONi>r>C3Y&iGC|heij+U<_@(~QX)WIvslV?GCa%w
zZgZ_!j;T*C<I6t7RQvMMn|OYmK}agavv+N`r`v0)bbK}*W<GfF*!}Ja>H!88p?AjX
z;o4x$ow?m(7oqJyEfJcp<1><8#Gy3E!4OdtnJuM@fIh>}L=3AY!GthGH}y2FI`PF*
zXN1%)i)psjcQ{SG<S4wP(TAJA;!fL3`4gr==1pz$_<NWxReVpZLw$I6#!D0_r(OC9
z4V@YAgpEcJ7Xjlc)>I8Z>TWFV>^L@O7S3*tln%-E(`nULJ)MwxWF{bk@H-f^ng&lL
zbREU*T5mOXEqIYu%9(O;HbRo)O%tjU*Ty~>l2Ir`M_T@VHo7}me2(^#9@Huct5kA!
zrDR&#y_rRwr0BA)?ha3I8Uxw(#2cmx-5ovxjnn7tD~~ezK0MecdphuiTV}c=r+oTr
z?ESz!j;o4F+E7h%)0u^PFWgz#F>Y6J{^l}1>HNy3h9}@rzSnU0v@(lCdK1o!J&SGb
z16o*@yQfxi#ZmRmk-y=W4GzDx>I7|uD{6nk-5N{;p6Q*CR;#Szj(^F$l~swNFBB)l
z$qr`vEAMq_P1se&KA3YwJarnR0eo<7kUypt*_uc#8PtzH=%L|wrzkN|f%EKicf3-T
zKg7}6qqNP@#mxfAm=XVY_{vznc=6QQ$Lh9w5!B_uFOd9LtpdRgw}cbv&Dzw|^q)C2
z5wsxgUPm4Ol~69+01j9KMyGl?J&$y6^lm_}5q0<Al)+@jgqP+~Mg+fZYEPK)nNO~A
z#>>ikJ+uB3O%^65+sqmvcyPff7!L#US46advc*gGO!i{!B-0O8XuW)C!>pdlKPGF<
zC6Lp|_wvzGb=A>Z42++yAW)fAyXq^t-%a0`LbyRtN}jvvQVHbR`Qi6+|07PWp&gsk
zw~jqY0a=#Ix-{Bf`dzQ<y%4A~4fs%I!_e*yuMXn(cA*))MLhttDa*g&$)f}yp2WlQ
zT_Vf#_bPw<IM~nuDgS__7J$3ESMjLz!JRH|mQ;7kdoMoRr54_x0;B?dhStt!tI+@m
z2#|dDt~2gN2`j2|b<GR9f|!5I)R^L7CpTx>!_0h@hxaEWIZ>qhQPJN~d9J{T`KCuG
z6v*^Iz&zaatV%3@ZZ$Dn)iE)W@{uj;FOTmXRslwh%M@J!yvuc9XiNJmE>}4<NS|VW
ztn^?tiJV?#Qpjl>5C&d1y)`jMcK{#M)4avg+=?1H764^1kX4L(Fn`H@)r>o$x+>_!
z%7aV`8RCM6MGQC#fHt-_6dasKdEoFFVLeG;+BNOYa}@SgoCN?7$25)K{uV_bra-Pv
zme^Yk>r!T+k7%m0d=C;`uwm(pOr9lkQ}N_p)XU*xZ5P8?`M)T>u78EoJn7yPMEwn?
z`3v(&SfzNOv_V1ScWv#C#NQ0thJpG^&u_@4YDaJ;2>167kbPj&WU2NJsJ61JTdmfo
z_)G0{y%u^#A4e)oOM{qr(<mwZ8YM;f(D;`Vvb|Yo)5bsOmGmZq>cv?FBXUEgKDK(j
z%1P{&UO`O3k6LAyXyaQp#-I6a?^@i%n;}9Rp_DFV*8f0EH@bC~>YKB`dX!g@Fgq=}
z>iW4^idalec>MV0;%N!dX{5u%Ge)Dw_T!QLuMDLPtjNk@*;kO~9>`v=KHd$C#4~N2
zGiKJJW<-(c6B8+GR>&B>pql$FQ#a3mYuK!y^xq9Yej8n53+U|blI_oqs(^)^hgxP?
zQgz1VFRmYrdjbDb@=eQG@-Bk~bW1nYcJ3B1<?zq9L}o|ORD%8c%n1A|?DRJ1bzT}$
z`xlh<-)F)9Z+|C=T^7Jxz#;YBDELd$7pvb--a3>wk)H2Zjhg1SGm2U9QxjpiLx!=8
zRAwf=g1Iix29NS$zt&^uLZmI3s)=Jq31;S7+175=9sCXVi)%>6c%yYH2&?5|d>=jW
zph3Y82?U);4}uvE1~|U*MX?;6XKLeFW*Y<14ofzg<Ydcomp$4PX@w6nuoT23nA1Oy
zDGrl*;PR6O8!X2K+UkKY-$GMUGe`P`yY64#8M}~9-{sz<?EV(Tagp(AZyV781bF#D
zzWE;rkUy{}B1%!?%bzU9aRPrHg0us*F?rX|8_9KaB6%-Hr1qYI+-D9}`Od4~?`glB
zG#9%_5CS^H7aVEp8A}J)Un2^Zyx1)xz3?tFzrQ)^@U%J5cd%JumGWx}`({D|;9J#<
zB&Q_!JHhP>Rkc7Ua!Mf<0+zu(t9`IYOKo+-f$5{Hbxp%9`{tkYrFv5{YMkQj2Ny3R
z6x<t=U}n{~WIBvT%Bx}x=R|i<pAmu)1~i-%TKVQ|x)+T#$+$n452-*S<Og>O@Y={W
zr99j#pfc%U9;KDxNL<+efjs{0-TNhJ&1IKVGl7TlTXj7P&s~v+j}r{uZ1lAN29pKI
zYlId$rNNk59AIw(2uh0?YgOD#!=GhZDR_+y+WL%gGuHJ5_&&5t?5h-O97z{BjLUat
zg85eh|5)aZE*a*5EMMY-d~;S`>by`TVGOi=0sU}rI$%+-bJxw3m>MiTg@AXM;1ITW
zGYL&UuACP`>c6Wb?@D$hF}n<XUoD^Od`!Lzk08i?LMW(=5QLYUE_*fcYQDNvcFW~A
z-{TI}>B4Avi10dWMhyG-H_WLeoV3+H;<J~I<-<DDU9rbkKNwPl>%IM^&gKia-iDA+
zT2||FItRRTAW0=LGnlJ3Oyf;8l-V&ocJ(Z)sMt|oF==j##WZl!fbHY`vZ}yONx_Gb
z;v&IepXhqQdAC3VYVwd&1e)jQG*t|F2NA9_>@xhT$Eew<&vkcqg@fnu{TtAM$B@Ho
zo*^W+ESm5<!EL_@<e1b7Ov`dllxYvBCuqE9Bf0gc^jbCk?vHsD<cF+BvAh@C1K+&K
zuMLiRqQW}Q<90<X@>m9)WYSkoWgHv2Aeo<QzN7pg^RuD%n`YT}dTpK|x=c9B&*!bM
z+WBz&gW2;@?7T1z>9Jy((J;_*6m@*lh1aRqV)pZWXVQytf>Y4J1W2Fa#>tmx2;m(r
z1MPWES%*<=JBtsMrh8*a=VcBv4By?$)^@o!zx=?O714=$&U@{7+s*2VZa-B1KagkO
zDnc3&-<^YXro9&9{WC5HwZ)z?pIfL?P?a>@@R0t-7`Oeh&jr?Gxw{dwmox--wLp%Y
zP)`JprjE#nmYTGv#vr^RqT$|%w4tP<iFb411O?Zx*q7&)Q^xltMM^GHF@*NsHSoF?
z0{@d81*;q+Fj`^145ckibT6>tR9l0|>%Gp0BRdl3bUhJ?-@Z~;+Pz%!bvYc;>|VPA
z3BqGmG)JX~3R<{|rOCJTJ+JI!UD%1+vGR9ouyoz9k9Ij0a?-p0%4G%HXF6GRc|Qcd
zjb4vKSaY$<F-l~2vL97cjpk6_4<3&vXd|19iNrWZ`l?LX5jR~NM^I0CAQg^(5jnN7
z6c>*!S=ymvPRYv=Fn-{$XP2;->h~T(og^y=f!r>>5JLV7S*zO?Kdp;>je7}JoMx&m
z3yvXzQdu$5dDii8UM=8SghA?^XLzN?KfEtK^_s5VnZ6?k^BS^n7!C$M(5BpCJ2(x+
z8lY=RfRbgi5nc_YG}BeicT!GN+Nlp|{;0~Psfb7L+&=Y4x;zlky5=7o``<ZAk)klP
z@t?q!=@vEQ>GqPsB?3weeg^-uK)CATCW+OX7&-St)Dw{k9L(p{r+A=F7F4F|PRFz-
zb#N$y_=|D;JBI!(mh)^A{KWa?O0J)^J3p5POy6fQbBop|kn80|jO?hZBj-NRP5$RJ
zkH6Z;7fn9*?!$*myeh^Y;vl3+no5vQm&H(}M+0)lT<Tsm)ivr##@5dY--L<$=m`Ne
z6sH+l-<pUy$CHXr%I{&p%tz`&?PjW8k$%Y_+wz_l>|n2e_|!UZ&NPmS&j~dRGrfJ^
zf-d~*KF)_teZuv*TYUj)iuZZnxeO<=;+Xo1stdKx_)zJS`#D#yTr>b0CP^zOE<m|}
zqNDDGgJV!kQ35I~kf&nhv%)8X`0Q)~-Qb8H1OmAP$^RUUp<VnOed9ll27XSrcgaaw
zURDF02n`Jh#l^XNNeBq-mu7NeCUP+cNd<F2#@6q*p)S~;V35|P7UmtrkA{NM4>&Ye
zBE24zno*Fwns6t#UnT7VC$bvT8j@96CQuAVwL}r<fw8g-QyI2$yTxukC~}Z>-~HaJ
zyp%!n!n{{W?j+Yp$8Mndss7GTLhOcJ3Fb?duPx-q8+o6Z4vr^3iWNzGn%LOO?`5!p
zo6{{Mk3K8G8W1a$nSv)$+1D02oRkdP-DrsKEbkW0<f+jtd|2B-<fTBB^^ct6Bre&L
zZkq_Npr*62ztQlWglV0gPUvMsvcYh*JF}9uR&{M^zd~4Jj01nxGUr1>8TapUPZAJ!
z=7?!6V3I<8J~l0oyBtr3Q|&Zij(jn|2|xQ;-N<~BMBl&Z{Ciesoi%z{HH0xi@?!|e
zv0C8R@;<H#%IMO}tBP--!nG}r9Jk)lc4|AAp670rJ*%UGxIfZlIuz_)zzM<HP$4k-
z>iF<^7+N<bXUr>#@-%U3>ayqyzMZT~Nf@@}1nOKSHm+C8%~d$Jl~@*RHcr*E)Ulav
zLh)9vQ@g3nH_XK<AK#=_1FhLS2fpv>x88qD&@^wga!{HIzNwepQfd+FhfJUI%cWKm
zyn$~hgQJdf_TRy~#m|S8X^C0QoZI8sRm@dV_!dYXS9bc-#<M(z3(i^7;)mLNZyJoK
zcZEPVZ|Ae~e$cok+qFOK)FnHA9Y!e{$brt?d35GlQDlbvVmW&nwZ<4pNv*^7(pa&J
z8bY6?X7jeaUYbi5mF+!*GAMfLSk$En^?72M+)@>}+XUDZt+49#MEorRCwd`Ln(eqD
zfY-&Nlvw8J;Z?q>&?XeF!a}+#xG=Iy_liAx_c;<-BDM?7#p!ETKKLvjfOzRtXYHpg
z`(A*BFC@ojcV<DZ+)95_NH`J~g%N9oQ3Q&4ujod}9~VS=nTq2FGU_hebhhT9YuuYW
zeL`ZZ2+={1?=;}82(rX7u|_9o2OvL$>7t#n2^kH4hWQ&!D{jK0rER@Q`&>CMwdtwI
zK}fg#|LUT`i!E=n|Kb&=3Kmad1abau(qe3g`ti+D+u=YZYu7#Adi5JG>=JWce|LZS
z`N1!`i=GzJpad4RxEHqkJ@6LB4a}I|DsxK@&?Gz7zbt$Jq+(+cp1XIzuY9<YfPYNB
z^^<7@d4-^Zftuh<>7rX~+j4MW#-roo8;^oa9Mm(w*2gyaNA2}rR&ozH8QxB;Ep*e(
zWMGGhS;{vM97_{j`<HRoWZ!PQRzEY{Vn}(lM^DbzClBfH(I5l+4>hJk-(3Za<ceiG
zl57gmvRK<Ogy9J=ZS~es61+WIp2hp}r*kpeyg431nRG?+fIIgC5j0pj4~9dlA7%KF
zhyOT(Mjv?qkyeTH$pwWOJ=$&?F8(*LfhPB-i}E?w9+QtB{dY_Fzdr~3{q6y~+UR71
zK5R3ojoDB8!F(l|(R@Ag*W_o`4bfGxmGq5ZYJ|{9o5kf&C6C5Aq*1Dlw!u5%MpM1Q
zDmk(3HTQs-ZZvFpBhY@hkpa3dC3fNRagcs}U*Q9~$xm)4muz@*ST6xkvguX)M@4&L
zQNZBH4vN^Y-oW{ecorAL90S%yvE={f&bhx1x_>7A*JzDai&_63V6?&C9F$^C<B^?K
zjYE=H+MZ9e9Na&4JKLlK*0~$Oy(YX{{`@-?o;-a$tHOWWCA4WrV0Q*Tt-WvK-G@;l
z@^d^~{1<Kl7C^EH%h#n4Ysb@igvq>ZR2y|<c9}1*l&H?6R5iNv{bn#@jfOf3Hl(eK
zicLMe1|9;rf2n#q*Qxe(dH9?#nDh(0-u0F~^0=~~8WyR+^cT<HnfhpgIafRjv8xs9
zg#RXZd*Boq@L*R_cG(EEWF*SroEsM~q3i2Jv!g>DeOdZ2w)#hErAVT+L>3_afrF|q
z8&YJ@7xs*QX`;3C7qm5h-~Acu?W?%bX~LLpy|bmPuK41si<lsQMTRU!pFtmw>>gA3
z#66?c;2vB08`;a7y;|#K*W`BZTY6QzEHv%cJ7S)U61=1NT8#cHJ=G|3rrc7{K$l;q
z$;d()W^vKZ_tx71MQU|g4~wa#g)1FJDp!B;aXI~4I8%c(KGq2MRS@T8`Ga46y+}a_
zLe7RA(ldXh$ZJw4cpk#*w$4D*)Ah-yTMtOi%IX7ZO+#wLvj>CR$0J%m7m)nXy=ZgK
zVwi(_C3l<oEWf_~_FSCW3tUErhvSnEi;wwD4uT|~)`5KHknBK~T0lg6>5OCQR&R%|
zhuPT8{)~DhGXV+K_kRPTRG!qSNm6>$x9{*2{M9%`pNsIVD8@S;x6mUTxzq)|zw(ec
zJVtTURi}^ZB^SXt;pRfoPWm04&+;QP$9tOWr+)zA%QJPtOJTasd3No|pFh8atP~!j
zL`J+7Vg;7$!kaCYn;O)|%Z^RGZJvLRQ+qj9a6>yCBs5uAsPFp;)-8I@G*$hiDl+pQ
zACD>5&7Y--ecyK)?hlJ1+)f+%u=|dJTzX~1w5jn6+tU(3lbzQqAfGBKOrxmu$UbY0
z#|W3&!O6^vVOnMHPLWA@si&d^t#@=`Fb3u$rlCqU#pvTSZ8`=c&(O*3S@!iuPxDuO
zt94oE_PHes9O3LPJ((1n(@iaZ6~=4&A2s9D5Y3f&I(f7261eIX&&GmeAAcVaWwvL<
zkEhrd0rTFZqBZ*Pe>d+@%a=7UK^~AZEyKrUnHj1i${~Nvdo#eicfI1;mJk<GCCuPe
z^xFsIChNIR+70bW;#%7qmGULqelMOzySFz9w>RIk?#e&(09VDu<Jj&@g}Xu@X^*u>
zKHlDt{_{(`I6f=K0^t}r?92Syk$KIOy8Mpx3isbYvGY$JQ7h$?77#IeCv4{vY!Q-v
z<hKZ7nf<q^OYcZ;2nxNdI7+$sFGSCVHegWN(095ISTy`C8~K-AZ*U}iSy6Rq>S$`(
z=-vB6v#!PiQ!V~CDbLLt6AMwJ=uLy7$fAK;@oE^2@WYIO>j`q#;2F1V6bYrmQ{ck8
z<9#_if9k?rAW^b(DYHVViJ#62OC82iPOZIPeD(ONP!9e}fJ`toud!03JPNwkJ!n$7
zK?5)w*_o8$bSXCF8(@r(G?q&B<%dSJ_gAbLX4Z(aN7v@@`f-pzkdUn=`9StNY@yfB
zdjS-kzh%Tn{U^RVvb$u}+GSAyg;F0rY&UEtd`*E)6%MY;wGVNU7yd}=W$RB@alKqH
zthxAz(_4SMMzn0XKK%20YxdI>oxdn4W_wcyE{%Vsa%Z-_QeS~`#`~{yKA(k3>AH#j
zurg8p6_E9OS(jGlOTXPKPY&*}0aLS|b~n;RB23QI*T;nmO>U~MJ+}~BhJizVjkHqT
zck*YADS2?{$yqUyrlb^i*b&SZ^CbNFyK^*L*VlpRxIy(cHAhq6ii?MIX}jr5xI-Vx
z2E8ABttp)MyUVwuznvi#2MR9<zoc2d71eE=Uq=(Bt-F5P^8S8h_CvqVd0WwrRr)A=
zEwc&OF(VfLI`=GqbMHfbtnWR4kiyiN5Q(E6yp<xmdz1SWFjA@(-m5vGiGs9UD#B&A
z51I3tPgBd9`A;O9nrS=T$l{G)+R0+ah{(U?p^E4X@hvL4I}(VIzy1FEc;vT|x)lla
z-wJ9sP9q)1hP*Rkg>3BO;9xoU8^nB}kT2`w6uI5y$628$QT2%O>$dsT^ul=2W@aNl
zbExWOdS*?5E8As0V9aa2iT?VIV?aD&Pk8X?uh{wBQ1$)b6N{BEj;Zx!U%mbUtm53g
z=7x5cDz0>?CIw_GC5lLJQ+|Wy`&))L>JJZNzAIh`FhDWj%(Tk9ZNIw$Z8V85`XS`W
z@56KH(NRFJIzR@zF7d87Dy>lUrX43qDLLH7j(-j9X}>MP8GQT*CVzI=etu)g*^OgT
z9F>H0l_*=%cHou!5kquzzxqz7u=3IMl1DXHe<@^T;F&<x9aHs5<G*n=Ei0Z6wrT7C
z1JU(`{&d=&Ug<$HYt$wp>pOmf`|p~P`@cQKkU~36q%3&Q=LJir0E#)fYg_GW#%%C`
zl3ub~MUDxF0Xr@n&qli?-FCfC6HBMkO9!u+_pS!i%x%Uw?u*d0JACjR!6<J{FBq+3
z{it}9^~kQ^_ouF;Qcuz#D-~TxWo{_Yjz$Sj#~bf{u|EiuA9@jYw#CZU^|Mci-#stR
z|Lt$`BZL3MD4FE{<6}tq<K%J?wvRF2h59?Lg#m8KrwKrvyOf{Y+RTrkYsH@^8z%JV
z4YB=tm~JqV{FR{(ub7vkyuwL&CfXc~+yAm)UvmcQ=DNTjn!gzJcH(Nm{P*GYQ#YQI
z_F#<Wl24Kx3NGyEYUJRe)R@-{Jvg!xxcPFrc=Ocz9|$b*h=xhy;b^IMrpyF<M8Gsg
zVKNC}ZCQ`$%}I%@AY*T`Fx63zEK=A4`@-wt{}mjC#_lP{$8hd~XlwnpI|3BUDh1>Y
z<m3xXgehd3%W_ZmLL|_PksZHUPJYf7fJ7JysEmtm4qb8L7+L@e3<c=G<}zL={uU&7
z;@>1=l2Z_{yGTpSZ?T6>>9*Iibhbpu%(J(kf3A)Co6pLZvgj?`+Ub+(#hl7s>3)8&
zd@U@EW>EMeVxa>T4?{miMK4fR#lKaiLR)qW5QR-&?YW4o;k}zyD{{ZlrD~7GYVY>j
zs$9PI5grd@50^kU#WUab!PoK*lDdWF7LFtL8Y}EmZn?NCq)Pk%u_Nnq4xE!ZP7LkT
zp-ew2`n+N!kma+9iLQrmsRxhIOtGeLT`TFD$d91DPjnG2R&=-<N<F(YE4x;UzFkO)
z_=|z+L(DIKckYd!(AncfUtH~#Z4=QbmQ+@G!D_{HMvkEfz6J|DHo(CJGFYMsImE2#
z_J>$*`{&t8&uo$%%wAQka&m(~*-3DR-XP}WoYHeeH*Wq)gf33)Xgk*Psbq?HQEjua
z$S!HzuofS^Gq~R%Ur+4y?DAqr&zbC6p>Hg&80rcIF{n0Y%~i%9q4-m0?TAHMblo8^
zZkV0e%*Ht-DgFtr)(Gv^0j0swxJe1?`+D;qvA@18<QH@0@ur^uFn)-KlE^JLY4l{*
z?(cfyg%CaWM?gn>_%vS@`vhmHd|HHUim!;Z-xrv&-`J{3>#3d}f22BTVmL4zJ-{J}
zndpvXXy@ii$98>LO&Y`1!L)*VHZPigOc*KW2bBOrNN8W6-tR^`4>XXzUD3wu`!N&x
z=fCT!tB6Ox6)Q5FOkc7H{`}bggJB<1`~YNbq4mw2m`m}?3v>>_Lg?fE`Aw6br7Shc
z1#_wMOJs@i8<o5ll&dkiyRmq`KxJa`awU4yhaS<;b5<`rWuH3uwOGMf)76@CUD}q6
zr?|3?6+-<L3%ig9t(4u#|5OlX!x7AZ(3;#*vvikmsL`@DnrSwtEI>iv%kcyT)wcAO
zT?4!kZUtM0t6;&tYvz7up#l|P9CP~+{_T_V+O2D`ubl|w{YomI=&F}M2$`wU2%SsN
zu15R5s`@@I@I9tO_QId7mtCR#Zxs(h^}e4z#MC^ZEIQSwI&c36Qp+8Ww*X$X4<(!0
zOD&u@Yjtl9vX{RH7+)8DuU$BNJx^IL^U%6bWabqt2!05>4`l02!15TH5@;AiMmFNQ
zf>B@Nx>zyBgTTbAQ>Z|H+ja8eLe8ni;7exd&KAN4k=Oty3du>ooQS~VSE)MrFE5QG
zxchO!!Q#8Kh7UxxsURI;%udR*IIE==5~`n<M(5@<gD&MzQ)a#BWR$niOtqCGWxd9b
zC5(k)6aP94DJwx#PV9}aV2W~7&VsJ%RL>baX~0$Td^DeY#WEF&zMmbrFqKUee2t)+
zrKpM88b7msr~#T*=+e7_KJ0xB(!xK!go=SJ=Co7`?lfT-)X=rNDd--J+TY&u&qfKd
zB5e;J^jB)LraHY6R{QSy=6!a8Khxk&b4t;qlfO+?W&WdD892JfgRJDlI@*Btt>o0Z
zP~p>a@U9FJREG#w%li@87Ze4M)qy(C`G3xhHIn{Fk`p5ox?JOU8QAC3z_=YRvO+D4
z^;B!DB4)MNHc9MvC#^#xm6>Yso{_U=n}%9^ls)^Bti6_c8f6fK;Qy5~3;jJ1tg;uK
z#}#jYGN#=?u0<D7>8NrZ^v~9M`HvOPzU9&>etK7~tgq+-03X3mFdF}tPBPS=tq|pl
zL~yaW>TqBi(dT7fw$Ai$ZavCuS2NYyIIASOt_z9YIw35{hL*=Bvk6hjEb9ENyl{)y
zBM2^AUU4#cUGLj&c_|*3wI#E#eH@e7#ycYNfY&`q{i!b*=|@+JR9GCe!Y8T>v3*WS
zgMoKsQH{>14^`J-cpMq-o>$`ewi0`-ULR5K@T$zcOCD4`(+02C5N8tzd+~Z$ncHEV
zOSoOWI{bL7sh)Y}IlB&31!)qqW|D?gR(M7oN|(Zd@%pY|wLH>yaH7@)&skm6pSy~r
zvxJE~`Um2%v2Yn+zELxW*sLLr&g@F~t3W~Y;Zj#db@>P7Mpv!^?ZEQMX^}{(*w=X^
zq&B`uWibnt`@1E0Ge^tnRp>W(Ps?R{amTCG9TpZ21B$n(uS`o1KYDAED#!bdZ0g|p
zX{$5mt3L~9?ZIiMCA&_ykStc5c)?spK4PTJ$Hm1XzxSTfj|V&Ldke5_gAQA>z~0l@
z3n{jEtXLRO9G7s}V%={VVXn<GSwD=Fiw^yE9mVl2O|{S)Y%?FJ?U>eUW*X#^?qp8~
zbhR)mlAz(8S;{zB;@jzk2p79Cfp{~`)tc1)el~&3D|h)G3S3uj|G`k`Y{z>rg0&%j
zYgzo9T^*58z6IQ)1SRwthc2BC84F!uN0DhnlD91t_duPj3sveb@s#Z><pprQzYA0W
z_S*nF8{uAEv`(7IZlk;u>74~)u0)3fC^ZkeNf6#}!|@08bnJ&^SG*3E!KA(MnxhxH
zx>X-n;wim0`q<B-y}ge#?Rng-m>c^IaaAFQy3=qh@S}w$2KNIdULzbM3zjLm^<n9N
zTpO-mnanxvQJxifMyqsw95=l*gxkm+)?1!8vu@1`PMmWf^vy9<w@nd|dc&oz-mGPb
zNtgEpUU7THnrDUzCoxJgyy}xa$nMx@3nT%5B7q<>x+lF)ZoXwf^IP%WZ&T4PKV3zE
z<KUvJ74r!B)Y_~St;YPdat-K9Ad*v)s8Ib68#Sh09KJ`H9pI+Q+?L7Tx^|_;Ea5fX
zMAwuI@4!7MVNn@-#c{@ONRw5dSx~edEY?Dx8odvupw|1ZsqKI$8E5l#isN~iR}sfR
zx(2TTvs=1E=d=5jGU~sb4tuaXxPSt}-~Vbh_)N&XO490UhO4%BrE~;o6!<^F>8^9t
zeq)~bZAY5#h5QEHeS%lsZmEKHLZ`vK?IWhFCTe-^k?lyMLcX?}uLm)sz!_3sb-SK)
z%_aQ7wd@5+x_P)5I(OOk6#-cDF2+{@`L!d{Ksufp7qPYGvbUniV;ne0*XS0W@}zsJ
zjkB<i(<4j;IxKyBob|!RqsWorR#RD?o5;7i_B@Z!A3p*hBzzNxPUx)}z@Z4uKc6`{
z=fiwVMz$BBZ#cbiHu`pLB+0yHeA2Q(dOKdi=htrZR;i2t%mSQu=Zf_>KRkP&=2+D!
zyF!zC|1BYj0&@0`nCXGAnG-!Z)Cc5ZER60}qcmR9ab5v2vD+*@zTtM8?)~(n&`js+
ze;}1&SsM6JlCx@ur53tLL@<nEa<gXqj8Enth?O?$^8FgqXAO!uS4b|nocg?a>k)mb
zkCh|FH!9$vIIGTit|94K3|SW6==tmfy=jbXG~-)78T|bu*MoD<7G8zsKRvJ)V9*=|
zLz}vBX%qzV;R4WeoD|h_wm~`}+iROO>mtw>6VLD|SX42?@=1p!PVi*M27NxzJ?UaG
zaKAcYP$N8a&QZR!f}-4jg{;``KvMfU*)^rf;@Wj2fzf|LpZFQM_-P(O%sQf4vK==(
zvweTa8s1u+@i?V?<GVP04%SrB_3_tP2C}!Sezj3AFdI8l;4>3In@{XIm4lIGUv=F2
z(Bil>BM)7LMPw+|_fNLgAtq+bFJn^Ru^(POaD)&q65q90#j^$);XZic9fBvvwLO=2
zUp{Rd3RIAQ@;(e#Vcu8N1p+CfDwTCl?18P-L2%m>GvGg#_63`zaPLfiMb{DMa#3|Z
zwg?%I?0!%p-tuPQDhIZgSlQ^iRHo4}upA%JLiIV$_*QPaV(K*47XN6dL7Q8ZV&yZt
z_bNT=f@f6d-Se1YdwHMSrS90Ok{CqRX#0hpRf*VFPoLeO3b}M=)ABW_Grx7i64}0v
zQO}8q+Ot%zoyXZKG*9u>4chU0ZbuWXaqj!TFnh9a$<3%dviP(<J7O-LicO)s^wn{A
z+!2=#z2+a`iAcOUG;O!TV1v8ld~RW=xrejGSC7bl3bx`i<8y<3@$m}>AD|HnI=uft
z?*FuGF~Ct_@aOux=$Xwt<ev{ECtHnSUkQ1*YOw3USL5C;TvZl1A8v+?HD8}MHQ5?L
z__T3O8f`KUaK^imJ>irpyx=Nyl{Ku%?Bm3*1+;1iY>5lkjNIH-0|98!ZEV_d3n6KN
z6?iT<9{&RwwnKHb;I8)&VzOCUw)ep?L%v=l_#Uvrkax9QMm`6D1qx7%&JjF>J*kzS
zhzfk}8Q{r2&u3xyar*VHB6z@=&UxiBZ?Wv_-202IWK9ewLW~SsBc?aPiX1nuOzaX=
z-MBwoe{46y$H4K<5Z^9QT)L8D^YE~y#jw$41xgLj@-;;(ZfslP4)Ovqq_cB#58V^*
zhw){tW<`IZ?+hW~qa<*kPhJOt`Qb$i;%AM{1*YlQKbDZji;^ajro9heT0ReJ)VkY~
z=@IS}sgEygS7&Wz4GB&_wn>Xr<DrwuOK+8V4Yea{no_T=&|r<-_V{XG>fs3}JRf|+
zm%tQx{wQ~md>l%=(`DH-?UVUD&jDNiD8-E{Kjob!*_F;5-sl^nLOeH?44y(Di<E?`
zU{U!Bw1Ck-$Qdx66tEVOo@}*%j>mjuvQd}~Dz^CovG$z0(`!!aL{BDt^$8*MM3zTs
zbNvRF*frza><Rnlhe<srsV(xb#S(cD6V#5{ifJDs%dl%zOx~ca{Oc?9O4xpT(!Fd5
zVnQ94xadYlxQpIS11y8*E`>7;vGWF_PC^kq>Lg$PvP8`-LH49gta>{WiRHy1PU6?K
zpA+-#va#1%z8m!{aS!3(3;zXB@!yz|;QT8stPag2=-{#y8n9I6Zn{e~c!u#F#fk6j
z-HZ1$cL`is$;Q<oS)_C$5`z!b(Wta?C!;lsz(gzO1^o}kx))W-2@Q1YDKI~DndN7|
zQc25DXHAb2Kk@Y!v)tA%!(Cq_YPX+Lv&TnW+NVdP+KqXu^OBjF5!#jgFDE-*{B!xv
zwnc{;Q-m;s&=|j=>9<Y&$I;P$z$3S3`u|<F<G=qL^q=4V3nn0d9}pjEQcLs#_exb%
z_CJv4Z;>{Zv~|g6lqUd<g=Ro&!?_5($Rl~sd(Jzyb2O)n5nXVS3IQEsjf!p&$;x!%
zNyd2`llcA4dA7JcnYvo@Z?x_T6Y&FVHObbi_gXP^A*j5iERMp)-d}6dIFKW|sDX)(
zX=HRRSL841dp2AoXvg)_W4QBs$%B&$KdmBBe`lgOKr82l#F&=6!TP6JVo+MCCz|zd
za%bCnJMi0<KlVeK$%2Q^<<N7eC>Mfx0Hg1dyy#1?H>8{U7V$24>EJQvb7RaH!6{C>
zmLTNVkzthnT&Nh?P$ZoFJ?r}KoCx*0ku^<T#e`B?n8|8cxj<FMkEoh&hv@_pj8fWe
zBwl`o?&_SG89;5tJ82D9uv!p=fQ4ZO`;3??wGcPY>9G2QHrMWTx_ELm=A-9NujgBq
za{!br=bc^s>g?7M>Pk;h=d}+Zi7EuAoKdMi(o{YXHoyGYPq+H90c_)lb3^@+X~0WA
zzZUuQHE#{yQK{3?N8lizy<|n1h&7P5d$*lVefDtoAepT+K)7$mmO-V{sw{}E$N^~J
zyNm-L<Ep_>Cejn|7^&XJYt6@c-#MuK*|T<#FKX}XkBV$mrOm$*r@{S<DZlg&b~?X-
zx7?KT>UiU&{ynFg;|K~?>D^{-47L2n>zvDXyFAA}E$%Z6wOSPc`Lpm?F~DHBV8oUE
zCdsrywpM5d5dZgp_#e)t7SLRg3s9J>Ypl-hP94=cLMvL|?bj@m72#^~#h=&gQep@4
z)y;nUbB}!59zQFExN<+^jE?N&<_^;jsd6OC{f=V(+LW!E>3aReZGU*Jz5I@RsgNYT
zRgNj#M3fez^iV)16A>V{1@=M}>D@lH-&wnK^0$21ZQ2JoI7vq;fNBd8-Rya4qb><v
z(#vV7Y0LoVkj7eGFa2~Z9?J4MlcMhaNi2(L&Dd_o^;5v>w4_H^D4<<$Mevc<`X6M<
z>VF^JFka*<_hZ^k7ie-S?t}oA1<&^_efKm8rMChytnWcpUE7|E?YG2FAFqs6e0Bop
z&<?V9f{7M6z_Z&`*g4z@Nr1mKH`R5x8U0w5)ci^Lm(oEF&|tt_Af@Y?2<jggjHs<V
zpl?t-<6com8DVVtUz2}of8O?$*J*X$e~bO;Kf)gwC8EIGvu&KWsc>W$loK6`O<ZAj
z&GGm$EAkt(rF8{>=Q7n2l~Ps;$SVA;<Fs^lihG~L`9ADs@mX-bN5P}Yd+wi(3JfW~
zRLHp_rr$ee{W9gAK-u4ROrU3>r&SjQC<WV*4f}GI768HEuDw*`%F3xZ`_vyBcBzQu
z*(Wfs2^ad6F?#Iro)sRiD64qo!P5u}B^rOah`^`V1HgE<(S@Y1i0z0v=imPEoizVR
zAK#VR8vc9f2E0GwGjdGwDgFfUD>6@~)Qo_}tL1ZE^bVNEh^UIQkAW+fdusgG?zc=5
z=`G1Nmm<?E?!7Bz?)M&jjL$E+{9^O))?ntfENutFr+0)cT9)=fiM+}!*Eh53a^=uY
zZjNm2cRw%Bv6b6WfHE$ftJ6;>tXJ5h|6qy?v)Dl?-8`<O;}!$Qws?w?n%`!BjV_rF
z$_i|o-drEM#_Wrj8_7EUh0AUK6$j9Z{c|curJIJ8Rk0Yvjlq-AW*a0mBBykfc|zx%
zA~hDJHhQ$J<Jy}5fZj9+3PaUUIg>rm!=+J`;^Jz0BPigBN&Iw_5w*W>{^PY{8W|Uv
zrO$O7DvIKFpk=bUqqZaE^Z|AkJttRzZGHx2GA1<`0h<oyZgkSDN#c?}LGcsgkF&2J
z!j@vouuWbko|4ZRj{n>oF3sQT9bgJcxwO?`bu@S%kWX%P-24#+LFGHmO?UZG0Sf=^
zuD}y35D_@JhtPc7q_S@@le6vah!(y;7V@(Cr^(;Me_(^SLC%2E;0+92<od9H10!?P
zue)3&8PUeiJVXR(EFV}J-wmQtl?VmK(Km`p9$$X_q(A?YRXr40o(H@eA5x7rVNSYM
zb?Ba`mHN95FBclQXncHYzAmWz?v=g7<+O1*OWW6&=Z=l^b`~o}!U6zAYdGDNw%I3x
z;XmSjR7x4Jd@FQs=KVXV>3%T!K5DscQq;QYy*5P$eCWi--BRU6%3U(xCJ*bVWjEWw
zi2jKxD|{iBCK9Lk7ncdzMm_<gDOFJi*6)qPjV?VfV;kRO-y3o#>NfeAm;Jy>h<yEc
z#c7(L1bP;no^$3=sH{E()RkuYOe4kn;*6(4u86>|N)7LAEYuwA&wh3%yO);U^W`4f
zR2D$j&t0#pw44W2TPbX%Y43~gX18}uM+%F}ba|TC-y6?QL+?8H=hu`tb4$>I8n^{U
zoY{jiKiihutFO$Mqe{#i;9C6)4TAXrW#Pxoxz2p|I6xyw@}qZvmPu#AS{#@>dpdEF
z@IXSQKK;}UiyG&~w|_O&dTG#O(X_n}^dN+uaEepIlSnQV)UWL6FE^hJuSD3i(NmvS
zZ!WGE@bj)p&hl$9=5zcBQou7olqqJA6KjKqCT9oDs>GN(xLdB|gmdsfAdNx^_jdmS
zVb+*gwcJZM0?vv52Al8GK)AZhbUaetbAH$HoRPphqiB^Qn@=qI2hv+&IhXb}4f$HS
z>$sv0dP-4(Q%C2zU>?QIr=@NHJoqgLGN9`J#47UFF7p4!7ZW2|)tfAJ;>NcwiFaPl
zQ*54xURJux<!Ex_AzfxOrLJr!xTXT>M(5t+{LW|c6h2l>tBufyFbuHr3CO@y?l2wc
z1fF1qyZ1X{KL^?m@i>SDa@>@y_;d<dZ{FS-wyJykLT!*L)M?&XtV~*)BS>2}#jd&`
zRv=nU4j!k%W(2)QtL8tIj*Y&PkF5nC<--23rR?NtJH9sW%w=<AZ?aa65uW7zUr$V+
zzvu|e2V5<T=j^&fBJ(bCKO+H&bp${H9_pE9wm_XQe0o<ha=~y1hBd*&<3t%10zJ{i
z$o<XfbRgeI-UA08>*B7j)}bxC5U{#J2OR)~Q@eBijs#!!FDZnnJ@6qeZLuY6{^D3O
z9|5pbG||{7_CD{Iy$8<p@|_`k&p&)v^)`TTCIPSP9`Wl@EGQfT`}kaYOAur!X-*c1
z<cjz}LwFJun^RpIWayVF(a)AEai@(prR@%?IS`Eb$QE#s7`-_u-8g7fc1)o8(h5&w
zz1QO&8^(-Ba3Py?p4J1l&(1zfr(t;VKp!+MNFQIM#*lYIqgfWFBoM<oPye((^%F1L
zn()Z4uCb!2J)y-EDO!_csUh_MnIQWD%&sLIR*4LqXkDN<^7vw`5anv?BQa+_Sambi
z&os@M7SfJVGvI`SY(0Gc4HW(6y!R0Cf=y;{MdwA2t`IG22Z_^!+m~%G{c|+e_OVRM
z2RfVx%P!lJZZwiXQ30LY20Z3&VM{BH6vg!=B2LBHJY9Uy+Z^e0&)RJI*Lukk+(~wj
zw6JG`(U#~=dEZXU$QD-cI(I#v09Y|&Fjq}WDi@EHl<g9a(R2I$M)WR6pWDX+aq||!
z)fO!r?}``=F0C^e_h?=>I*X~%vf2s$=mbtb<9I=p`fHT-W$0>>9Q8A12(wiK>G8~>
z?%QT|!d;x|Ql{II(%DusJ@b<(V=Z1pTinm!Uyt*mODP#|w8njkKKE&{){U`XB!;!P
zEJVTRf^V2Br!5J8Kvlu(59aTO%*>wFu!tr`cyipQMCZjzi7&E4i2i?tA6(LYM@t1P
z&am&tOUL2O8ve*9oV68f<OB+)cX;;Ymc>MFx+?U>j^`IAbT`?#&{(zbsU=j>Pl6bA
zS2@HKtzdnYein&s!-@IgHG+RCi{mUm^+y$LVJplw!JJa4dMvNV`vU#sG{1ePbI)Fc
zV0G}*^A5|J1uz}3Zi#@mRNC!6u_{JD&Cs#Cv#GW&%6|91n#+CcG~~CV<+l@>39M1q
z<0t~&-i2x2<zJa-$;J4$&BBh4t{{+)((Rcl@B_8n=A~ev8`PX)z@WMZaXiTOId!M(
zH!a-W2DaLX%;64_t5xO3uKTnr6J(}`v&oyrmYj`2n1*x8wB=piCA(G_?E)@faWBzF
zuxX<DMmk48(bJv7yq^B~$G28zcqJ>j_G{zCu=|VI?R1v|FM(GWcmu7dt|WXntREie
zSJ~g$SlO=v=@SXh{3@Ot0`y0^S1pUEg)6Y7tHi{0bf<(%c6WMLT-H-g@rVl(<qJCF
ze+r0;3KJ2*{m`!)Jpl_-J#Fdnkw|+NWUIVJ)Q&z}UipJ<;WhS<!>9S}vwRtulofYa
z1*1<@&#5lr)e-v3*`0&51U@vl#%C6Bi0M$r^5OyZt)$)xP4XX?)@zM!8^5f3Ny5j8
zyk|+$=zw17S-4CPM+NeY!k?l)8~4~*NpxdqQmuB@C?6EJ=G@D>+IA^K*@Bn}Tl}~{
z3bWg1j*s%xEkvyJa7^2bRo59BMmR{WYg23G+>cF8OXywPaH9S=@;^U+h?J-gFlV<=
za8XskcIH+<8?{svb6L@hhH}<m$d`kD>$-3%Zbq%4Q|E<t)~r#Ig9QRTZyPp?lNjgq
zGnlnCyUU~|A1S=D?j~SaaYOJoRWP}8w!TFf{#o!)8jP-)3pY$hW_BuxaMJZV4${%>
zdtpPIYbw<l*@a7d>(0eVHdF|on&QRJXGVg7{q>S4AdtXf##!b`F+Q(~%zBuJYahSm
z=clZ&ty)n(&+{AC@MLBgu<>%ikxK{K27|dw+g&j!*elCQ*@$B<(#7>e;1;!HaQrhA
ztB20~W-$lT<dT>-sF#!z^xT2?1%F|g8j7sR{Mg*TyZ#SEZEWjkAr&RH)>~z6`KJYb
zwz~=RvcYh8x7!;emp5x~v`wVSx0FZ;nYH@HRV<k)QByeuzZPU=Q#57fP@mH1>yzfu
zD5)wz!J8^a0@qL{llaPaMg8*PL^^>1cXx>{WP$34E}WbEO;5i4Z9lF3co{#Vv{b(b
z5H|jV%9=|O?hptG&IJ$N{x)^DW~ShwY$g|w=OL<g-bTQ?+27X6-&-h~YqyVK>fGfN
zH||S|rr>#Z^B^I?O6BR>Z>M%oqQC-8P7HNvv7L<E)xpawnAx-2rUjAJ)?CpVYEF?l
zcpb6c|5&wD-SDY+k`^<^qaVe=9l@PYE@|YnFxDO&-#JMCn*FFxI`y*^E4=<&$|naE
z$VEw^(tMTnv}^7cgI$9s7i!|7@RkHvHrA4uAf*KFnJ$PCtY$eGGWzM}=H}!k|BI2W
z(=|LV%C}D_&xw1dLU4_Emzbzb*0M8)R|fFtTWjs+TPD^LI!Gx$@us!eSj9F9$UF6*
zHxI~)Lsg_mPQgU~VjbqR5>3~E46iw`sSeWGHvGVNz}$YF%(UtKoU#(AAaDQ{gye<F
z>XRKJ_XoSB$ZA}sVB}S}UeKdseZ1#R*h$iT8-$^x=Rjc$$x8?)d|hxCg?|_*fIG&!
zArv}GikkL2pyWDvlV;{!R9~~EIVwGoB2RA9PSFm<DL)Gdxyweh#Rw9Z_OU9%QcfjA
z`V;ts+h_ILQym4GR9d*xr+vzuk9GAlTQ|t_AwiOO1_Id_(spoapu>_%QGNWtsV3If
zv#`&xYbhWmBQkl-)__mMhJjyW4pmZuL7r3CEbDR-0&yuIQ&oT=97vt5&DEsYUG{Mb
zuqGW$y_^zvq2o%8n$iO{#Vn-#|Ck*>wOitD!g>ZQV=Y+%>F|^|DzoVE38V3&KZ-hm
zanv5OW{(ov9DD94tMAJ{-8jiILHD+|c!`zn9&-rCD(^6dZplWgl=gOUGC50J>38=J
zy}U*1v^W9Q2#etM0|jlt4!vKUNj)axntaE6#M&}Q5Nrt*l6^^0aA{7m{Y)dY>XlXA
zjH(0q2P?89Kle{+qC4T4Z=jO&nsS24mV^I5y2=7t7wB3Rzxp$shdLk4@eCOM-r2kO
zHIBoc|NFOy>Bm0LSsap2GH?6ZB{-ekA8CZ;Z7OqDqsy}yRKFNc=f8Ur#rds`{qk5~
zd-uJ2A+pSK3v%nt97r7h#*Ub9RZ^go=$<Cuwn-mfR$g|^?~A~3bQ9h&=d=vlaas8(
z*-<m-SGeimRGcSHT#xHsmUF$#g>B_~CZBX$t_zVypx0eK38~JW(te0Tq*s?Uw=8b|
zyesCypTe8bUssp3C)du9%x3Jf-!1W00lxVU1cb;w<Fq?WEMH4eAuBiKrSq6&zE(Eo
z-}>K(d(Wt*x^P_-1q7st^ctljO+Y{qh>B7~s?tjkM4B||5E2mST?7OK1nDgzy@rm6
zh|(gRBubN#P(mQ(yX)Kc>@oJacb_xPuX}&NAhfkI*PQSBK5ZAvp&R?>dB}h?ePOal
zSymQ=mv~5Jss|94d#DCY!y4i_IaTJdM@@xl2iqeu{GC(`KcE@?z4Kt~_YZ~)*bl(p
z$<+M_oDOG0y20naZal>6A`xCWIU0YKl1?mh{FWYNhADL`U-5`~9>(Y_#{7!;GVigd
zfmobc{&U6zW)-DAnwJJrAGi;|1I52|2xdfij3AhY492ncG;~xV^L!%$0)irLm^(FW
z0>RyMH>I-A_r?%2aoGM<9x`VQR0B`R+I9rZnTd6^87A&NsuoI?hNvy*mz#B5xYxd<
zTzO6Z3TP6!<JI5+Zw8UM?MC1{Mg#V?9vk*EM|00XJ#EQ8d7e*1%Iv<@(QE<3jz|db
z{N@nF7?OJ#-T$Ex3?xR)bkm3CoS6LREv(ki8QXqne`=@av=@OwX)^;WE(kUXX4kYS
z3*G2nq48F?|Itv|-PG;?v4md><<n3yP~;anf5Bp=mW@$Nv}Yfy*H;`{+$<IAgfki5
z<!@QOyt1WeKJTkghnh@v;0EN-vF~VhW1X!uu~#mgI|OouQG|phN(rEhV%t`48xH`4
z#{>DgE&P7ZITsbaRQjWMIq0*3uS3GqJH2)$;17)=?#(pcvUBzXtUFa)ZgO6|=TAgU
zKp6g^aR$%FuSq4NMv+WVfk5FPr#HXsSq;rPM4q&-RNOAebGbEY-XWZTsQp*H23(ko
zr!N}GPj(|h>ec6uLs3S>I}?M|pK`WWeq$-QIjUeYNDGorlOY6~&dl)R8BeeHPe}(I
z{q{A!y|q72iud%DQ`q@#UBMuEkRI%;#CXDaN_!pHYm(hV#S_HZ4dl1{mGNP7$|urB
zaEe41-BDO$xf8<jo?a3e*bPV;n4r42kzy>E)^qM`C9&pylijl2%{S_n{3Ck0!u-bk
z#&-c*3aFaslbUN8%N&;Z@9kY@sFB^iSaATYBy$I#K}oS)HWMKtZ<`j|ua<Pg-NF<p
zvxDUl`rNA4ksq&-ZxesIuC>G0Djm64#HLk^*bWV5L*8FAp+ABd^=Z+_D9jsxS6sHe
zPA+!_2x+=VnCJG(Tjd5FgooQ4D-S;LzBwL*JS9(ZP)fStYshnCA$&tMhT=K>F#3kq
zF{JrXW^>xy-sKyXSGqc`T&t2uq+vl}PRJaJquQ5#nhYy4d1>_2$JJMjmD$_c0gs7+
zztFucaV6PHkf+a<Q?P!=h#B96Rlp;Ao)?2kZGj{pFG1-kwHRTa2RR2Dq{okACITO%
zfE1Xku#oIKr%%F<#~P%l!T}^E05Vefhvw_|MgS9O*(hXK*7%ONkXo|p^}XJoHMP4<
z!lmEMI-`R*D<$LR2KRyD4xHpg6eNta;h(Iq{y-e5;R<Zz2Y@Sh#yjA`Zz59={rmc@
zO4twe1<+10Nz_Y#VL*{-WyS8-uhzs;j~pg{DBj-lK}l?xn}>u_-De-?Z-zowZs&Q8
z0f$^3<TE@G{M;laKdl6R9{ibz998KLi*U;@%I@j>ym;rgn{v9+^65bC;;g|HQ1L3x
z6ujUz01-xd$V(CIP*C??HliWg@Q;YZ4A!86WVA!m{WJE}Et?d+184Js`+o`#xb;cX
z0NdbI3{ZDy!<eBrT5!dK>AVjp+30Z<?zr5i726`uy3SqYE^D(;)}NObPg5RhYBf;Z
z3`dYTRS2ReRl^CdCq(~^m2FM~f6aL7SrqhhW5^5nHCj1?KALa~c4E-vjuZd|0_TFP
z#^^sZl0O)#sKcwxpaihTezXRB7<qY<a3-;Q{O3=5TT4i2tKCBv%L^t2QbMHk0i+yo
z7wW(VK_D7!0HoR)xkhOsn&Gn0`+YzQYeT+8bSML!&Cn2&u(DUE$s(+miJ0NlLj@r1
zC)YX5B`t>bJdzXqKmP_A${FGtaAe53CCT4l|Aib9crb*Kff`hASzfBv{DNPqN1GiP
z2Kx>mAFk&Mx<6}g&vZ_bP}uu@t)>b%acF3(5q;o=tRaD7GFKL%6zI6nI7gFaGME^q
znJci~!|dDgJUdfCGIhjk$g@K51-vfveflzajrPce%2bOsL^8sLL98zjKgv!BsPIHO
z7p2t|BY!5cbKtFgNZ_1tbcu%}?~mqHmQBmQ9u-?WKjs$(kipXOKlB7x2o|RFUZ(#Y
zvz6f%V5!FCQFIa4TaB4;CD?5FX&wa2H~S@1r-iPi{Z2ZBN5gn$j^Ioam~_qxO#>{`
zqQ#8LoQnF{y9;5=ED=u>UGg`yCE&wfh`H#0XkMFA4-KXWUite$?wA+0cIqzcV~5H`
z!BwJw;>Q-T=l8XEp$Gx!sv+tK>iL&Ct2KY7G@xfd@c0TaM+%er-#ZK0#Mu5!Yk+Dh
z?tZVjO1j&8_;^?3j#IB&b|FdqlDZ53mFMk~T;!)jJ-|AN#5vNd{(}szI`vYVZ()5n
zHwBkJ;3jvJSuXhb`NzcE5lMaEx57az!A)c6P-@ikc%Mv+!HZePz-h(ZeF2G=_i`_F
zWz)sH@_%m?@Lxg!Eg2G_R%kf=ma^B1(wy9pyt3qzh+0y@u9Iaz>;(gxCp?-oCX!L=
zn+Ty6fJWf<ckx}_4poxq9Fe%}l6LdBRw^XqriI1j-*1d*gn-cF>c8O%N#4BH$hJoH
zL;05Wq9@7U3*UYo7Qv`@SU7V%%K$k1QL6uG2mYTQ|M~epV7-j@7P6FwqmP=4&Zw@h
zR+a?}gcHtL=o*L<&d1$AG=?XwL!~eivLi*HCcI=Sawm7Jhc1a5MOP~;EyYrHNzcVW
z`c_%K=ca(ieDVXX$Cm(}@68YNr5`=aF4&bn*Fm_Wc#T|GcNAY1hhG)V1zCLebQN!N
zm2Rt1-K?mM-!iTd|IdHvfA{e;gwP{K<tnO!|KBNaRwTJAY9VsBC>uxIgxuYT(S9R4
z@Zl7Q!q)qYl5!&<$on#x<B;h(`<m?L^*4rWdocgvpFv9aln9W^rigeuAWx9_)$B%_
zH4M{-_gn3ib|)LYS&s3!slC(!tML>FJd5m)bMh~`i5Mv+%GA#!b641DTU`lX%SR8H
zTdwPMWn*e|9lyG5$L~y{(GfUxAW36YF4>J;q&?LOnXT~Q?a1cWul|#Vh*3}s7-tGk
z)4qgbD?m?(p)uQPt)^xEW4&hW^t75+kE+Q)!$q%6>?wQr#tY8=*hJi^@L-K9LGKnn
zWTzXn9_H43Qtbo#3^kk!obMId?hHx1PVi-k%F`E%9<?Pyfn79YSe6`uH!6C=GzE<M
zN+|<s@-G)wM@<$K3Dwh9x;W~q8x)1#v0*NmW3)(mcs=YbY#7o+N$>MknVd7pt6I$z
zPrLJd$0h%ox%bM|*L7RN_qw#l@jkBtpGuZYEh~SEI0q>z2AKOk#TUtnvuT-VJ%`6n
z9;HiYyR?hE$Mn9TboO3H3?gE}U(YGf4^PpXvoS8|5m6hXJ1(T_9xL*n+lh_Xce$n!
z^K?HG+57-j-d_vzdU)`CtG>q-%htke@!+*eILBqY1imun&-BsfKK`#)&IO?2B$38c
zPN+LE0)H~-1xJr>Hn=Wm4l%6jirxHu5pNW+HaQpx*DEmSobrC{Q^(7&fRxu1uHOcI
z-q^kEf|l3VjmxTk2pOOJ`a!wUx8BV%U8*~+Tk@&E-^`DM@uBd?q0lk;{&}B{+v#^?
z*C5HDHn%u!e$RMAT&Bb0$0-@k#>RKIzRPZb7ELfSj+cnEAr14riv_>#rpB9f`4Ulm
z@J8g${zoFhxBz34x{GXnj`US!DeMIJHD1ODji#GQVS&;n3u5IzkZV<N4(DzIsN33B
z;O_NL-*z&i+y1@2M^tX$`oc(eL%n^;>JdUGg1SeK4`swQfs88)oE3U9p;;y{vDy8t
z2DdqbSkfsi!HFn{zrD6U;x#fY=8q=j8J=t3W$rtwD~}JP{0=r9HE-zP2l(O44pT7x
zUrU}a$wF`W61w<+nTupBKoI46{P^c_wRbO%2YB(7WWQ3C6MVl^RuB-Z6Z0BENf>H0
z&PqSCB-#AkU4;P?3upL|z}d#y#tw2VJ<joRqusLP?c@%ZrGuMe;&aUv+p;Q2y=;78
z0rw9eaX?@3I8i}0!do5lJq4<r^~rpS-c*IU<w?0dt?J7RWPf5plLvWa0=N=8Y}g{)
zxB=P^WPTLb_S3pS;oe8>yZe`wT>`fS=X!mCWgSU&z)QtK;dM}H)Ne&!Z^c}im*GxF
zb#6vezmBfAS2>HK#in5Lu(={Jq8UEKnCM;W9xE5bH01odCjITk`wgwyJrm~8gk@`6
zuN?W;?WRj2vRD(MO#I+EaJ(}ytHKTlh&EBVcI#`*B*=CL`D{`Mpk8_4kVc0P6}yHx
zk$0F*8Ixk&uv=*izsjXS0io#_@Ax<}HymTvX6YrJoW1ov66pS-AkC9WVE27)uTGs%
z=)CooZ|m)-D$Vab{Zc^Y#_k0E;>IAHO%bYEVQl%=JU08@v3T0AGpo<AJ`v_7T>3y0
zhWQf@0WY8@6*FSwYOdLU*OF7UMpb$i6vg5nW31w|*|!29#MUiu&1`W7?czchd<m$V
z9(KEW)M$d)x^FJbraVi<m%dMjyh}QSEIdE7rIdj^Wa05SkF!6ubRSfhE?pn{4%eWF
z65*uVWG!MC`mci+Nnv@9<HCvfv)`6Uu%9;Xx&3|)80Hmu;9`KafGZyAB9dkC%FBVm
z=D|z?`sWKrDN88S;h>=Cgy(>lja8se595f}VFY22QlzO2l@Gw~GwO&GRByRY%iar<
z>pnyEQu~pd8^m%Py89Mla(#8{;&}V9R{TM!s#Z~4%U0y`i~hFn-G(8H3L9(ibRaZ~
zeQ6=RaZ=hq{3bdeW~H&)71$WX@mwLTc!0o){cAbuTOjWFS^>Ty+A9OBkEqb_bu890
z8GZ1ue)wyJo})EttFq5G2F8GEi*9b~nkp>{d7#X*5qw8XRi$!QIQe6OwY!2(r4(L_
zFo5?-#<dP&xL4zBc-*1$A)?TpNJ{NA>;l;)9?Kq64>jYuC#G#+mcmw)y@?cp35U9k
z7Sjc#o*(#rGhf!qB2`Z(X8I5@S^SH3D45`Q6$RsQ9Q!j~k=4jVJ^Vy{TW#qFO+oR$
zPW6Nyoq!)2Jb@^sFCQV^3KAAj&G2NkRp!8Y>6M|Wov;hj%|eG`1VjXJu%`H2sJi8h
zFWVrU@z=<{378A)3yirNUpZVDf{`qpkTcJ4mQy~*wu*I7opEc#{@D)Xe7OlbTkH;R
zE#yKmvgd!uh<M)JHnhU?=Bs6U3;jnQec@`T7ACCD)zGW;TcmdO-zy8-!Annn4!>0J
z^!-ARxEA`=(QSQow0MCHsCff`^gNzoPm*1gPqBiX@Pu>dN9slH(k(~UmR!R&2OYb1
zK9X|O=uHMbO<2nx5biOO)!t^4hrw9lSzgq=+pY->0R%-#QQ&J_c4aczgK@^ko?I)1
z%S?mYcC@Gm2ACVN@&=qoQ7;N(7QLSeVx(g2?oRIsof9jSUNBZU$bx);v%#c84Kcy#
zJdNmrmUb(e!peVWW^GrriGnx;CO&Ha$ZnU1ac@rYQaj((*7q)W#MtC~?h_R35;Sa%
z%CmG^t@r}n)6RgaLa_4<-0vOo_`10@-css?C)<ELp-9glq8-5|&E<(^@kqDS8ff<}
z4uwYc{dLgtaVfT=i;b`4Y>t529w8Tp6NpA)x_-8ztM60~SIL|aYw53p>Os`YaDheU
zqj%`b#z`;P5#?^STFyaEUXJPV=JI;Ly~0b~n@#p|WDgAt_EBJQzp!-tJ>bl06-0yd
zP-KBxH71+mj;AP9G*kC0Gl^EcP#sD!j5l<&Key9!^G5*l>nkrAA19F&D8+JnFmBjP
z=W6te-%7T+znF@Y)?LmlrV;R<%*1}_hH$qdUpGvu*3syUuf(OYi#FpTG-hw$56Sz)
zW#F-)$Hm9D*rhW=!O@xzs{0s~MraS%zzG*O!R{tR<9%(=WO*nD-?HO?X|^~=k6$?L
zUq^ouCv{vz2$vSEm;jTpyX%km9-?B5_1la<X?YqeZ0?NXJ?p|;I}VOfyMXm={KKw8
zvd)@~T%GmCHzi#fh$9~gAhDi9da^S?oub(aUS@9V(`w#Xi`fE{-WXNH&R?&R<ppBC
ztP=0rzfn&z`%e%9im{y)(I2QN-nnA724?p+2C>Y202F=4$m3yCxc(q-&WO_6t>T}1
zdDsGGc{RI2=cinjn+|ztH)&N*_woO(&GIdQ`pI~hfXCoau0QSTRGr^xt7@`#gu0oa
zMfTTOCM8{EQ+C2TJ${zGw*Qt&UaRNbetZ+ra4*LzIq_H02(5)k%~f)+H7Z_1?8>yy
z%#5`H-}Z`ZFs(?3yrd~~_TX*mc(Xf={qd<aYLmU+Bpr5{SX(h#A8LH;n)T{SW$|y>
zB{Br3zP2%hWSgiksazNno^iFj-!I$lr^^Z*#}yDX8YxA`Hoi9mPZeHNXo}ICr`|ua
zd>4LV|M^ycX7Ba*mdXyob|`=bOdo}*%D?<0@6u*&-?&qXyiU~sHu^h9%vz4#yyyo>
ze^0*Xi>k6u|4ljoFK%G95$FOz2tz2$MQ9-<nbZ5`&6nq>K}VxIIwU2i=1(ZCFGlh5
z{BT6wGJUWIn_cE)`1fWZVNCE-*WE3NC#Nn0#W+(Fj^XNISG@XQrB326*1e>U49KrW
zup;txVtr|7fl-VdZh3oo{_DBh#^Dq%G3>@p8xDn0k3n3Cc@(#@C;hH0G3qXD5;=>K
zMTXRnrHK8JxESkB5AV|FjC>oheW35Hl{Q8%o8tLjWvfq^lu#~Nd-9y6FpEC|$PSQV
zWb0lbeQzTD6b-XJJ18|$3cU;S)-Xjku|x?)2%L5iW_n)%cYyHuUI+{y4paRZQ;L3a
z7*O}Z%V{Cv;~d->c`BL%m?}^H2eDzV_dX@rENiW$>S+w2D;=<~TMi?xVpKLigHNo(
z0ZQY4F|0G2*|B;&?Q?{3P7Yzo$PvmAH}4>;K$0|k$s8)^l|r~TOk2wHvubm-G{`CH
zyjhIPe(^)frx^v?uK<;qH{vem7cTsp8e{N7YFIsZtxa3ItNYa=l{@%d@{J^b!S4Re
zk1x9T*f|PZ3dD&2A9^kSfBSv1%L|JT+X>e&feBx~RH1~yYnxb>vJg5T3z<Fo#7dj9
z7uCzSeV{Udw$a>GTKZEtrC{LBX0md<)y3t9pX_G%DHa=BKlyq;P%*Xh{)<DRxrx-{
z`}`h9$!~c4qfb)g6Q2a~N%p*GBpJVuB}Kp!y-)sviZjQOPP{DwSEmuD<n)rw8bYom
zYVOmj&6g&-CDAd#>aU$Qzkbr{XArHkdOO?f_HRQU^`EU_oS|1(o}+vAd^nG({@L?#
z8tH+Qb6b$8Rh+#?!|pSpl6>>z<*&V0Eg6UJE(9K^r1co7QyIO3#Ov`jGWH$+&?E)L
z8N)Y4*^fT3uYUdS-j))0xkq@N7f-btD@N>sMZRjr1z|=OHufG!X_P=h=7%)Zi#6A2
z07Ln^#(+J@zyFu)aIZ8}clJgBkZp%#FEP>?S(xHHuYUd4;*r;Q*7q3`G()ZrjTY;E
z68Lf%E-)A-jGL&M({yRb5-D(E=cmeSi0$14SxWJboD<4)LBj{F$qcSR0Kq}e3a{IW
ziL^5JKb%y2X0kU3TE5Rm6D%w{H)t9wE%zV@{wE!-PMIb4@LG0Un+eEmiaCx%u2CUD
zlji~CcQmG%w!-mV{(4D>;==wu!o}u!SC@~i<&q#D*dP8n{C(E8bfN$w*0km$&ABL=
zBd%@P?+C}B=i5(0UTjtxJ&+!CstM@~F0Ot+h}2z>twMHOlSTaQOX_&=%tm+c(R5%H
zeM7DX_j@to)l?VA*d6Zh|CQg=|N85+MR>?-vI-Uf!0U!1whpZ=rQ81R8eZ&SZA!A)
zZ$5Ln+fNfSbBVE^1~m?%fjgVTfttWWk-oqY!PFAzIjE2Fc4UHTss1%7A63y$YZ^&W
z&*LyH&Ex-K`9j2NCrO$Xa8--~_VcjKRbiOcUHq|TNF;i~c4c8<-n*nZDKu%Z_Ue+&
zY(kJTpZ}<iV=CzyF=Uh~j0dORSWPItbPVV8438WNM$T&_>cxG%VuNmP%@T1L)!;}a
zr?%g^sY)n>?&8x1PWm-g^6;oZT=Qpl4}yaa<LE?Cnf`q6Xh@syiel?aKPAUj$64!c
z@y@>>nP5Pu*?Qcx`O=wJ%)-iu0$%eyDZc;H;s%K%Z#l5|WV*sG*|2@e-Bl+$^!K^!
z=%XvYEjkbKJ?0BN06viZzrNq>*NMnA2q!RX*P4v&7Q@Q!pWA*s&RkJjDQe&^FoMqG
zhWr_fZYEi6Ad=u~dA7(Q6TwigQ3x08mKRl_7uSrN@E|PS4rme0d#?1V?mB;NKE<Xq
zN;`;B4tHavB^2U(iq}Bgp@5@)v%BJ(?E`ty-*yE=3t@o2@h8ZATp4-I?}-aT<{Xrl
z$d0QdMB?6rDx%fn*M1z4<MXl<{ez_W4izL{KFg*sU*_`rpg<pf{QtD|gnE%+Q1@;k
zH%T^hdiYFr(DrZ0kBY2{FY#WZK~?J6>sNPv>N;9zS4q>Z?WY&FB7rx3ffKtyR)*|6
z2ojDNl>4*|lU)0UrV8^1lbJoF_M`aix0+{}I8ia#bx-Is;9U=gn&LwGi!YJy<4$%N
zu!X)D_W0)0W1fiAhe0h}B)R7{S5tX(G+&^tbw{4__lZ^4rxV2>{jy*tGTSUw4boR%
z8@hL37~%2oPnPj?Vd+9$n22lN+jb%0#G*T+JCQW7U^t)|SWR}6qvXnWJK%xf-1LMN
zVTfg~mrRR+fLFp!J;Cl8zxe5|u%8d-olR5^b9aFOJ3Rw_GM*}?zB5LW<1535bMn;J
zy|sx=Nvbfo68(%-g!qxZB0Gk0<O%CqHsv;@ges$ld%PBsO1*ZSRWbfXS8_p+Z|8|!
zu-(<k=XseXbI8I~q9ntBgC16K*gImRS8BCNerEBQxw<#xjYOtTLrjiP%g_k79NSJ<
zVdCU-T9%qwv#jP2-!V_1<PUp?xz?`x7gkicT>NhfPzdMhw!!^@NrryJZlnexl2%09
zc#)p1Gp=b<Qm&HAl6UU!o%d$AT=DZDmT%Y#-VcZay?|wQnQR1%g6EsC!;9O!3b;q+
z6W(xzY0ZrJ@2$C}OZrOd23+YPW7lo^orki=D6jd<qWeJQa5bRSe6(1B-yn0TV|>$Z
z#3@!R0g68}Whus=E8AvaE>!yU3$%+`wM8utWNt~go`wnBQ?mqrSWR5vYQiI<f{@JH
z0_z{qwO)$>>z=ko(>4&>x@Y>&;?OTmQ@e})W`wGeE2+ReZ$|9W^X{tSN&%o!AFo@F
z-t`?)vovC*A|kX}zNxF9pKTi!|CaIrdF9nPky*-B>f*l{MQ9t?STUET<(n{-RDlRS
zAtCN!^WnFTdbbbHYiE<!pcXh4G6(S%Nfc@pnxbxn-xjEwI`;}%XfC_SP9YX5{Z0Dz
z@oW>Z4rK4DlS0Tkc=*UEnH$L7(5Q^plv&HkHSww!Ig7YjwM~=WqCaKV8J0QHr^hFr
zo?RIF2I&A_D+M*TR^m+1s%_EQLMs2pf)*$ev}5VpCj9x{)xBK$Ahahqce8Oae_Qun
z3rqlNLMdq8XM+6%U<$a)qIYioYuR$p<!{Aml*e}MHi&l|b2q)|q>HLWc3e|w;P(MD
z!L|V;H&lrz_5qm=wQC@D4Qq=wx6HKMYU#P>1z4$QUK?3idi2dDO@2|IL9VZHn}!IK
z-5WtzMOq?l|LSFJAtGt0mk%$zUVkAjAC_6OWV7IKSI$bMIhBPaFVDeDXJap;EKrQV
zLi6ET%DKMtNPd7nH~tY1CZH&J+B7<(U-Ch8C||VDe)OJc;UMMRi^|at&hF<c$s8yw
z`w%4IjCUB!4t<E%uEsd%-0Pl}Og#3Q-*-(^c!L(^s0_JQ@?neyE46|&0a}~X6<$gq
z^%5}|Gnw>DwKw(Lb-TTVlaQCtR>Ic4`0Mk2!41~93Zx)%?cE(BFJYPTfyxD1PB1RJ
z7f9z3-j-1Y<HYYenCvoRYJC^I2$h{gA4v}w18mZ7$;<Itks4*<_)qC=LpF5(_mMVZ
z^n;-!{b3rY5=lCAgYb^>3GCTr!ayv>j3zgGOIhTfSk7XnS_;N*w6-SPsON4rl*+xx
z&o6q1myyp&$QfB(fMg#GL5Fo;Q&d=s^HTdvdKALemQWAMU6=cv%X#jQNu?`fVh%|M
zUQ5yD>%zMYO(qu$9lO7^Z#MlUR)c<&|8_s*<t4TY({#}A>xkvagre(BfRqu)mtN7D
zQ6fNCw{r8}cHE?wzv}T0cGaEs6iKB22uvF%NP(dR1Xv4k9y<nQLK_*{dL_RjKY%K%
z8c!<-FvjPtb1jRfURH?}QgS-ihp2;l-v$z!ih(!IJDm<TUfgt&7L?97Sh1<Jw2iV9
zh@EW?{wtSuF!}OICQJDh>w7-8+%gn&cTnuWDm2GMt~b>~ZHUu#>t3}L&C_D<(;N+!
z_x27V4K9I3kYS=fj;vKZS~hQxLXU61<uD9vyi%k;a=reFU{VUpdH+73R9i0~oZ%*i
zf!#&S1_ydg<^aHA40~b=g7a>O7RKRkt~-ZI=*PC}W#+FmN0eXj7wn~ov>btUBT3iE
zz5r#-O%Rzv6{eKJu6PPGyj}>M@m4q<uZWIaYFq@r`S~TK%Qahnxl1+^m4CRpphs0^
zr(WDzL&VEcv!9}63q__L2z}J4)Lj@}C?@UQ_pSVd*fbf^7Q&q*2PUVp6A^|jbIo1#
zMM32|OaZ=9IsGW8`32pDZN6uIcf>O9fHYvkfDdUSB^xF%f$ec5IiOm!B(;p!_s!dL
zwzs~QP6Q{5H>un@z-F7Chnao|{?|cge_<cPlZ^G|CETav>MTJm@h$_o>i+ankJ<`D
zYD%0eBtj3xzUW?!-ynUfE3U4|hox51C5kmQHYQ)J`d4a~8^z^xttO3T?HnWuj5D+@
zBa%q=<Y$yh=)*^-*65;nNU_9m$Dad2*7Vo5Huop+pvHwL@I!!d2}l}4`XEhOv!iMI
zs<-!fp%3SFQ#2ZS;QnIGMPA}rdMwY@bf-iMr+hQkTpRnyBa~{gJbF?P-fyqTgf`*z
z_~dz}R>_maJzM^j>1w_TOQl!!T1r|rg$1>yIJ$rOD1FekA`^fqo_}Cp0L1|zX4<S!
zk&fOTqTSkr;=uH_e&$kd@r#TbWBd}_U!yb1-e|X+F5?dgr^H$SFLhai{OaoCrOM1`
z@+o|rBO8QyI!_;=npro>luSMuDto_RVjP3y$lOKD)f~bTTP=gZ7s;MErg}b~w`|`x
zh?z#0y<y^CT4QMvG0@DKivml**U}+e+Tu`alawM!VlKv8XQ=I9#eGlY483kWKeZ2k
zn-Z+c#^rsdHrDh44K1Mt$pBu92OTIt9si+0^zZ_G`!Z@@n1-7uMFJBc1PrC4+XBNH
zg7qDOb3)~C#<5qT<&NB+{gmv=u`j-MiJMtZ09|CzJ^iNU+?Wh${s9eK4c_uRkp$fR
zes$`VP`wcltG1%oiZre`!SQ8I=j=?b*(sr%<&(pmou`@4Qc*9es{WyY3to%^cWY>Z
z*pVKSuN?X3$X@8bMs9;EO4B!XowiU_ZI`Os6BRhDuMhH#yWA8?A{zrG(Q9Ix6{Q8~
z0Wck@V<6hMp2fICBR^Hy->3B@-S0}5y3>^DEX^u}HY9c3`{cMlE35G<EYrXy&pZfc
zZ#JK(B)S<jP0P<y@k!sgW0@ne@0j$^z_kFkOay@CGsD<{ur=BntFbFQ(`0$CDnq(9
zjxC%Vvs_};{hIGwEEzX1ApODai1}Ky@2<{T5KeJe(BMy7>)WOIrG-a7>}~CLr6p1h
zUhg_9iE6w*=#f1Dp2fj`Xr#<=w13&D@0}5=H8enKpc%dmC^mMuNe{Mw{I}6v_6GaV
zk7#(J1LvT~)gHO2g;6m^^aV@tQ~lo$G#}}|-pyo8K_mVC9)PLLVz{}%VQ`aLA)eXY
zL9bt+o9&H@)XqYh{CfIgV3DC4B_#yW40fJOY(w&aUDM;J+Ov}C0<kM^b5Jj{a&p%D
z7ruM&6=TA#KG$B4(*E#YY<6k?nfeb@^<3)vDB1PNl-45gr0qo;)H6E-ovopu<H8~*
z-B_I9^LFvJ;)`m`BfX9ca^f`gk@88ysKDFo93JWmB2~SvMITvm4yEq7WIy~g>BIWc
z#m}=x#@xHM*5S4aRLjvo2BbvhMUn3pN#W@m;y*5JJJQW4t{07(uhMz395i~BKY4Rk
zJZIhhvwp(MZ++)Ks75}Ip&`AWb4)GuIJ;2jRpwz@-vfwpS(L5-O8=;u58*UQwgWkk
z*JnM9X6wG$w)-y|EwT+dB%XROpPS3y@XT_2ie*n+fW$WB>c)-i+oQyjzo#2b|9tj-
z#Q4YF)D6F(vY5D>`wR>|`l77}N3PNhvw1PbyJPbrANV*jjWSYu0UaS|WKkxFIZ|pw
z<3h<AsbGxG5-8^(Ztjwqz1#A`bxrq$yTm>>0-miAcG^dDFDvWaUXPk1*gbST4Lh&Z
z^XuuR7agCf`X;TY&ybm2BmB#WUW2bBW+j?42DSbyZS{E5)yC^%Q)<7Oz8cQHOB-a0
z1iVt22QPaN9NDJjQ|JtYek|$<59qV$)NS&Z4mMr*9x-b|>lLp<MB;h-Rn}$4$E#Fp
zBbS)!-P)4QkN^Fw|FCVwsyVFJUD;qvm1vS^Zx<G6tn}9No>lMHW%=!hK<S5U_;4E_
zCk!=YyZ^d7NO1tc12L!`4fB=QOO60f-0o+-Htq|YoI;sAmR6dbpn`R};_~cQAH-2#
z+E5I`@Mg&Cof}V-*%=lbmp#oJE)EjD%t<>-k@m-3ez;Bbwh2{_0em7NFDPNyHL%th
zCL2izHrcy*Xls^wAN53kS~o_{?^<^V;Z2vGP;{PBhDHi1p16IsKSWh&A$nA<7*);>
zyHP&YO!`pmCzv~um_vVql*7J#<_YS*_>Rt}!4Jwvw0kiTRKBTp=6&|NoKkwq`(>jL
zp#MI4Xs22D?Pd5YW!Xs#OncBZEA>{x^Zf`d%VqWXyr2C6BPZJL4=-UEZdE?BN`#8x
zwd*4#Th=BoFBL39231Bmmp<31&er|yT|sBxG5tm>wsx+EFY4U+p7P&}w-C*JKz>fS
zz)>MqBJky0DO&x4;e-2c;vL3g%uxpa8n^zp(=u&a3WAp^ms6hx5Bt|DRhv36B&<OU
zJa4ioy9xe}fbs_LRvGw=8@ff}_H5kJ=0#>>SytSrUuBmDD{xcV?8@(5@&?So_l|qm
zSS>G?os-`5!U2_eV&z1IgN>bi^@1J$@o&@-XT^5wLV0@*&qli{5!fl|y<e$$D?IK8
zQ0x3dZYxkw@ncOnDbGgj8cLQX7=4q<yP3<o@ZvFVTe8Gk(3<U;6-IAo3s;O;jrEZe
z|5<;3O6C_vsl!;y9|DGr;|<vd<QX4b7nl=eC!h1$+6CElPOa+*x-#`Mln0rxlnZ_w
zDbM?w>c+nVW87M~ieKHa!#5M{?DDN}fBp<Io@6zey~~_Ab7_Ii5pNGKxTQABf-h~o
ztoylq1)lq1BGhdcjbk<;qHrs4PIn-w(~F+1>kjMNkw}u&(CR1kQQ3CI1{h~(g~>I-
zh#8CL23-^bqND1g1tM6_(d|{L>#j#rH*iwqdTOK;(HjOyU{9}WQSGfJz;xYKq!+eO
z?Z!_y#TZ4z4TK!s8&#vaTchM=?lX0g6Ir?d<2GoxXh(Oba8+<x=zTTAnbm9R5VGZa
zJZ}5DNi3Ml+PWt>0psRaqE|f{@Ype%vYGo9lPmSPXd`YVG=@NJS=C%&nBlmMehjcQ
zGi8SqsC=+l$R(=eCRG{_eyxD^Qm35=g1qIS`-g`A2(ejU26V?Pb{-~GOP;vM_a!gL
zua71lp*CDmyR*EBFllyr=&he4wNJ&eJqX;3UxeSLQJc-HC(2U&pGfJgmUG5adKFa>
zM7IekW29x0o&Hsuw`WmN)Rq(V9mA*Po~uoJ$y|4MFI9<$A3Ca#%%Hcsh?TgwZRrxg
z$k{z642HeXtxn*gRBNi^=2rFr51_=f0@aVN<Nem6*aOnmOY5b0CoX@w*^Y6>nt8$s
z{%YJ`c=E@_z&y0(6J*6^<X{nrQ>QtcstG+LBoS2r(`T%8&z$o$F}c^=;>8u)<U-<8
zyduVGL^0*W>P-0CDlVm8#;pJ1-4SqRL;lTJiRWR~@9U>>wT^Bna(Q+}PVRpE(AvyU
z<Qq2v`+)v?@(&G3WctaET`Y}|ZkKhqGx9w01v1w0Dh{50!#72MPF}^soC)F+Axk^`
z7g7dp0`C^$CPzh>KR2RORhwq(GsH7{8N`+o8Xji6l?aUB^ZZ#)FDNpBsaJ3iT?yT@
zI=O#|=?F2L9;-g?OM2p9?=dQQJG}s82B`py#1(hFa32R&=z2d-2VD)S{g(2n%t`%Q
z_)8|lr0=g<G$=6$&hH7~g6hzYav$|Rv+D=ROxAk~bnic&td0o{k`W`QVCLd0$xnz@
zwVS+3i4sK@OnZ!tWe)&59MQSwKf3)fi1_>ur0Y#@6D-=loThW1d3%LPWRGkXC}q83
ze@OPHly@71;21E!wQo<A&U51fWP||IfJl!gm1FxrytW2k!nFViO1VTYF`K00A#$<J
z8E3tmP|iF}lMw)^THtw4WhRDpTD;13_x^qlKP!8PCCK9}{-GI}Oz7Mno-mZl<!r|N
z_J4JkPZDVw<e-W@lv8+8x+8m<VtM5DEgh^>e(mMM+hV6f8pshZ@It_l)xW6#V=Y<_
z_U%U!&b|2UQhV_XYlc@ObBPe+d}+3?1*Zj9K7ykj4iJH&he>K@8h?PoIHVRAlrK4i
zeQvi$zcg5*-GU&17m;4+G002Z>RvEa{nE~7BF;B0u0&5hwr{!m^)x+z-IDvm`%Gdb
zW_*7!%W=v_^LAaR0#SV1EZSldzFUGQhp!bQ*?X^(ug?X^>x~LL>3kL<w3Bgesc7g7
zH4kpq+fB!%qgP`613o%DfY;uy9FOI&3lsiamcIdZTTOG6Afn3E8f!NP4P&E!-2q=0
z)~Kqle(+?r=(+rCS<kPA$LRFM=i7_+lyWF%li+%9`jv<d#GDp`VJ?soTg=?RHSij~
zDvA_BdNEB@?y9VH^b!^~697}k2^fxOd>h0Ss%Y#(mwb^;>#c>%!NX12>9b*p$nO`K
z$~jt)))lAL;W3bm{N|k1^FUrlMC5Z0f_n=o>h%!=UE49@mxG~E@x#K8Z!dN9iRF{g
zl=f~WPMa;5Mq9Fq2g}r+aQMZk9)+N9FI|awW;NC0F7rrVMd5i*5xS{B)@$~Yh>@x;
z6Y&mNJMd?~L&*jvLRR~1*xqVy@0!;b^XeS;DITXYf`YV2rD-ZwEb|27$Uo!1hl}m)
zA0t-hHN~EFiVFmFGLp+^oWjr92YT8R&AGj@@Mtp$81WzD$2K-h0)D(X0~T%Vw^H)g
zeE|*q9&7j4JHp!;{V&|2S9)%hn}M$Cc2`YKfFyvH;6Zt7S0ipHMdzLa(?2xG>^<N_
zYUV=|P0CibeucgdXlwf_i-r@WbK0tGh&skOLSy3Kz=%E7P0%OAZqV9%ukd21>}VVK
zX=lvqm7C&gK{t;Ow_1!XwLd?>CJi12X|LsD3?staQd^%I!8AN<--cK2#$PL0T6bkl
z`-euwY7-97XBWU|y(p+kgnz|$t=7_)0qJShH+M(xc^#e*?%*!8V2hJ&<40J{_?_AZ
zb=qA%X0863JC;{1*+4ttP!?+1%M|31L@Uvbe#o6)g!{{=v1}S8zND>{Xy*3&!{Z`=
zruP%<y&Ej7hrZHOuwNGmU!Dk91)PsG$ihv%Q9Qc7<I!gKj1|6h2T5pX&ZM^ou5ymK
zKGo!PyY^*JJCB>FS2}Q(zB^x+?6xF40^Ua>7UcCgEA7?%?zO_NkslF*V6DY%3MF#L
zkO^8a;m531*+&WKbm?K4%7<>-io3#iD47-a6e-iYi$1T4l}K81(LO$nS*tZ!h$m!p
z_+I|?H)I7g?ITE2mQve%NESyet>VllnO3(~*^bgLZQ=4tTRHSe%Aw{=-?d`>iW@g}
znQ<eK_?%AqKNy>p{@Bo8^tWijGYy`YpFA^yYJS3PRKyd#s7%XPb`G1C{UoZ`(&{I3
zN2z>scHskA3^EqNDhCsS&0A?RzPhU!ydQ<_1p#VQ5Jqp;4VdrrEy#b<&@LyW-V2oB
za#zU_qb)hs&OQa>7>3ROoXJZM@0(OV@jh22#pk=RomL+Z4A%kbYTRB^a$FH=vIN7S
zzH5RGcJ~})O;cT)JEE=Dw+<C<qke}BgNRbC<rUi}BGN?H`j*teMyHG>HuyP66{MxG
zI8{NLBUP{OKmz~{nY4||=qHZ=0?fQD;nTEFa~3*1$!gcTzVFUc={*{TedkV@Cn>XK
zVejh1Hyr~V<G*||Aq9{*X0+$tc!swYxCg|&{Q4x)J{U2>{_8JcCKns~H<WWU=hdi9
zw4eE-3(I{wCiTH0+QdU#x-o9}&q#UIu=2b2HM@_CfO!CtB;auwK+FjxNMba4Gasdw
z@unQm7JLo2RIM(@3AeMj)Uw$od;}g9DIB$_f^5>_EveYt*==$;dNvK<E%6S3F2TJi
zVuq~_3<J5lFSzKXdFkM*UrGDai%K{hJG@$IMd;r_vpj{sk<{M{%KFK^L@O=QEr4uB
zKTB5fMelPh%coU)p4aF+H;u5jF!RsJ;!#$(c=Yq|1&9YQ|I(<@YC*)P^4}G-xnmpw
zpL}=-xaKt>c8waK;gAHFIxcl3Pbl@UJE@%}!$eOz`>X>2n*p<EGFOh*Ow>L|nE7N{
zorAp+)WA!KpmZuyZ-<_lu)4zpm@9SlNoGqb(?wRo6fcbo|J+WGxM2-kb9Q>g+|>HO
zilANjqPTx)n{eNH?;}d3f^c)KKHs|7H9Rq&B979$eW8&i%V+G)q{zQ_(aPH1+SYd1
z@4BVMzol<|R84_lH6E&y+iB`sa*W)m$QZ@tOgITzO%|lXb9&z)-oc+8z|rP5MF7HG
zaAq|<`x^^Rm~0+{kZx!J$W+7Q+5fEHRa$~p%T^F|m)XgIDBRsjwTXMPJrX*=An_vg
z)E5<$I&e0EJyIoKv}+wtDERr7+I)^e`fu`H|0lDh|G!?hu=^`$Wc(FtgiQQb$B)TT
z;|Fy77H`w<v9a2g=6m1%;C{Nl=5V|kw`xa}um3vb7^-1L;1?pJ1dK*(XAhS~R0LgO
z`?!xJ0KD)sQ#XH|J4oopm-+N~$WD0Ym2smohwGOwGsrn*ByvR>tXciYFkzkHShmyu
zJg6M6_ZaXe$ha$fS6FuD+f?;<Qu^X5*$_jbD&~#Fp7<IZElyXSLKEFflMd28{f}`3
zEl!WhoXxf?y9Q7NmkJyqq^%bw)Ny+h`O=Da=jsR_80lNmMmabE9+Bq_SSoWO&psnr
zqL`Gs0GxTNW_BP-PWLpGF-&b$fNT{*I)mk`o_uRcr{n{K2G9R&(P{xvNM)ao@19s|
ztUmo8rzEDW@k`fcVJhU{A`)Sb()0r9nyMWFiG?r;2bpk>F<)v!ZN-w5o~CfS9ngGn
z1-tvdNseNlMI<?DwGf};28W9|8|3ZG+Heh-k+oXgJ{*;X(jqUDeqUmK-FNefn<}1t
z0JP|f)f-Kx@5i&FAv^f0zqa(>KKBcc;U%-Y^R9S*W>-LCGn`IjV-|YTD77zk0k52S
zS<Ii<*D}7|-fKNCrAt%qiThU+E7t(yQ5s;r&3!ORzI>bdXcRz0KDE{Y4qltIN1by9
z6)kaI?~J+|k|z0`hWS#mmu}wFeCFqQdyyopwzRyh&au!}{$xz{^&RV2Q=0^S@hB}5
z?nBhBDt>erOsmQNw1x=k6Q~?Ax%9WKwqlDQ@bbB8M<)O5UZKtnf0}r?ODQRrKkR|N
z>+NDANY3MU+5Vi>7RPE|7T6Ugc;%+8>&PzH#7zC|&v#kU&m9kVvlFg_#ebloHg5h)
zIuJP-as&<}%%_>4+je%<#59@b_cO<++l_S8^GJ2%S{aO$Qm=i*nyih3?~MA_*v@-~
z@Z!A=w%YDZn5(Oezd&7%H=xr|xqK-@H-vWhWe6CjH#uLkfo>v(8`fJw1bUj>hF&^+
z`F>J|{40RcHc0-qF+M`+=4XZiwv6MBZur|6qvFA3g=ME!Z!5@b8A&_0VhA1);up?N
zaIs(4)095B0_sB$B~EsYu#h;I48E<e7_{o}H{Y_rMSMZK$YxI>-MqCkX=Z-mSz)4j
zL3@?pU8BD9b|HK5gNpI_-!#fchyI~Se3a{`JnQnSv3mJJu4kB?9qgkRxZD3EEle}#
z2p8(E3$jMw>T?gZSCVT_<!#1oKl;uO!YH|?1Vyp}(K`&Cr>N<QHO!ucdNoA(HbhaD
zIF9Y?oM1ajI4$dxqP_@jE-Oh{PL1gRU`Lxv{_Mb7ZEl(_cMsUg0`AlW<9Xw!%^moU
zZ(Ga=mN(|njc$pAz_L$`NTFmwN`0>;ITEJ_D2C5k5hY|vz~{&PcyU}dn!Zd$b#`<?
zB+!Oq{i%=GBGB6}+!W9M19w*>itq1ie1tOMc@Ve(Eki?mNL+JQGAUwf|5*p=MXP__
zL;L%`Qo>3e?j^b`45={+>ND&tL%s1PgaqIu{6Va=fkcHYAY(O^gqNp1@x)|<*yoMS
zx|w@C^S=*g_-0xMfWRY7D*!9O=_#hew26hdlMy5<IjF{@UMhNh`uB8$Phmx&yziW!
z_qRF&8BV+P>tUt<TZRTQg<No>8X+-AN>cbfHN)tR5Mrl<^w0y|Vlv=LM3lQ{g@!M!
z+RsPkhvfucSdvlfvCw7Pdx!Wa*TT&Dkkh}?emLlogyGQk-^|5p`je`s5di!XY2o|p
zK=o-x(C(v4;T#FI<Io$Q;r-fh?_b&?3vHP=JM8au2W_!~!E&$LuVJ=se=dp#rW}bp
zYV;8w{KBvcaJK%7bmsry^9TNPyru?T0RrPJU(J5TS!BmCUcucJ;xPYt&k2ggRfP2l
zh9b>~f;C@8hPjVHY(`hd-t_;<^KKJC`21dTlVJ0s;XaB4DvJ?cI!~Ak?zp!NZ7zz3
z#I93+OqEfOs<cA|E6fAGUjNQC63RUX)x!7Y;W-BcLXrbNxfl*ncH~di3fbnJ{VBiw
z^o+xgM0=p&gdf%|T~iRuJ^*~mNBa1qDPtNYf3_C?oLcV!459<JzW=dl|G(ne5F-$x
zeD*RK-gNRxu9TH<i)@ULVfb?>_PL!S=9uMoq%6U+*O~%o2A`+i20X<<Rb<5?{EcPv
zTbP*}wPUn5f=}kq*~~QuX4o*X7w7N1?7K|!fq^;{u2mFI5+#d%ZoDX#H5eZGbAI|;
zSAx9(F*mbmKmSBH1Ow!{D`6aX`+G(4+;Mpg#Ej0Z9Cco$;eb$=5j@=s9c^U|TF4tX
zt)>xBVqF1%T)|)e)^_xZ(7UZa=yJ}CYklh%21<Y3lK#xPW5X$~*M6^Gt(u>|rnqT!
z2Ssuv>rg&7!xs>QrfIpO<j9N6<)1$pc7?^Zhf2h)FkWqY<CHn_+(Y@mNB&Sr&WI*b
z82B>|?Z_B{I6lcHPRS^&th}G04B`_T7uoh2l=>2m(=R^nAtFL~6S&H6$DL({cQ_`u
zv1pXq+K+h)xov$yl9?BJ6DT#^Aofv;8vDGrg23GBu%9Xc5g-unWhkh}P8)kuFn{Z@
zTW3H&A`0#XWFZ30*IoG2NRSQDsD!Nenb@;7+Vf_^u)Artq{;o+dzvA+I#=soQ4@mq
z&-Y@)udH`&n-@w;u8y=GAR(41E;qj$1;bO3YsE0wGE$@t?uMMN94?ZzD~q?E^<I7W
z6DuG8=Ir>9=jQEGX<L__cYCtveWI9pA8-UQKxOb!BfGHK4;}d7q2Nv*{Hwsf=ljbc
z4|0N^PMTd3d&TsvgOURFOkcFZROI0W33DASIJcM^YQCR{R*%{Z);XGF+y@7y^gxBp
zVNLvwkE3d;&hJo4el%-=1_k8f<2AKhc?!$7{PeuNywB4m@j06&3P`VAtD-q)A2<3N
zMdnc%&aK9Q`-_<ZAN5vaCpr2B?z1ZoK7XA(N(sricz__vP7eG9F;KrE8S8J9T|o5<
zq_)O#&<Z+vYt6!9C>-#IO{Aw#NlKfxI&8*~iI|K=#+07)!!N4pmrtz$Gl`GXS-Xgt
z_BZIZrP@A)H+(Z<SD%@xL+8!T;Q078$ZMdnFMcf$65XrfksE&B>iML32ax!hGU*l}
z;95euCp$v53BLDLt<9|e1N*nhU%dS*%9J{o($c@o4gTHWEvjH^vJNga>kVF)(0CeP
zFS(}9IDU&Yh5vU(YQ=Sic<R?xd<Fz(=_>*?_dTj*zc^X9a`);V0l_<+T6ss4IosQ}
zy(c{>Z}97hSV%OuX-R~El1;wYD>@q(abx;MDtNbb&cKJ|1^v?0vZjaR=wRpGs;tuQ
zXP?MG4#g`^>I9@EcV`qIVbcL<1iQZeAU}PPgVN}j3mk)(T<3kK6epNip63d^dQq8e
zPKxFS!`?7Vo_rNB=ml(3=mUva*cj5TI@%{wve1)qKSYMhlC5Z{yUh(JinO6h{iUko
zkkP8%0qD`#^i)klZ-K~UeO^E7$O^q6or2^z>z`%@!DC|=@BK;OKD`BO#5+V;008D7
z{>1J^VABWh`g-8C&BEXftPrEO^Y#NME4s*{6^w_tU837X|J2v#U#i>z6(gHXhD;Iw
z&K;Rc7Av&MEH46B9S-nLzhJRZE?c?U*7Dx)VwJ=n8^IG7YPid-5%$&9%e|L>Q3pY|
zM<Bk?r^|vPj@Mh`7OgwXnc9)F%U6oHVf8{hBlnFbS_){otTrVPq$^||6w<v5yby2Q
z*xrRNeC;nTY7pII6(`0L5OzB(lZ#wu_lovh1}hY}40<)91<9T|b$tuOq|HuN*NBe^
z^r||()nYk&^o#Wv_2y@p7ya;%x#&IdjLUud&WtqDa_2U|IQ{f^;6#jveNl51&DY8z
zPFf;o#>CbSN}sy&oxwlyfcD*bLW*%u6ah!5DC&sg4Sm;x2J$09zMK#?WTC>c5H1+{
z2l0>+AIP4xauE=`+`?^OPG0G~QiU@Pb-wVgr_`UV3<|{YIxTc3^9MWg^C$bz9f|ge
z0xKb(d=+4ZcogdB0TpgBy1ECa7q_QdLaA67DPWrM`Q64??!D2Tq@S~7AP2ub{ziXb
zErUG>_(4-B7!bsQ2x>S&xg5-5GI<|yoOo9V{f8t6l&U?fo!1GfXZQCqKN^V9-KPWO
zptRMJz4nxpBSa#Vk5UAcSpyuOm_-=o$YLHB(ptwOy<u&B^Zf$#YY|p~Cb!z2D-Xw<
z59cta&Yk6shEgwit_V_!$UG|wc*R8dhQNJw(!Htvz+W2)C7oc;H%hV!*hVhO4$qoX
z6bwMM`frHA(;#i>!|4kbw;r{&R#&eqHiEYQ%<ik%RZZTJe_f*$3xB{(tOpifKarMX
z3LB?N0wHv;Yfw4r_n(^2y~}d#99)dv%@=CR#s~pME}EaeN`&2e)&9#sO006%h{hja
zU}4$|`a~q-rYX>T*X_~t{de|?e<2CQIGu=O%b!#w+p6<_q<$<<zD&t2fs59kqV~<s
zMO*SSR3SFn2uz%?uYmRvln8H9Ou)N6#rSJ#cp1bVrhaT$dEZwAj&Kuy&yKwsjt7!1
z3SsBTuzzUYej%%!d4SF&Jpr|LALM`Xl)eK(TJ%AI5$+p1EQmzw2|9apyo%ZY@9JQY
zi)~iPBVZO71Nl-j@@Eip*b8~6o<D|F^Twy8{#FC?uQpDh%Z8t;GT*s|T<XI_X#-u!
zD<Sxo4txZ)_XtAa4S{qAk@0{){Q`XLBc!pl9HaKLm&uk`V1U23P|#(U3O8uYeAaZR
z*_Pzm<=6cX9j!YltTeebxqBB27+%a%2OMwXC({DQw1tTcMi<QFvwKT(m8~6(uEg<8
z9jtnGsVF;D1~1+L`J?{i?vhA$p~!(wAdX1}_MJ(x5+5*n^-4&y*u>Os!?}Le_u>bV
z)=FYy3H%0-%xdsjcK+zF;OZ~Z6FelTya%sP8By<<t8oX}5uCHmSihDiYO}{QpgQ!j
z>c#HkVjal)B7RB%e67}zg*b~*T%a9vy!dK$q*pQ`r=vUnWDr%rvo)x3uT9;YG3p{m
zuv5aww_QvW*ahhVnP&&|^^L28w~Ed}6*V2I2Na+>4G-^COEWi{bzxnbHQ&GIxs{0r
z=qb&+hQ@PpP5|w?3h`nu!+-^+F~;?OG56j<O$B<JFo=RQ5s+R56s3vuj;M6$CDec*
zHPWjPKt*~J5s=<RYCs6RcR@gUZwW|;gc1UTxX1gxclIrJcjud(+4=rp4q-Ckw48IE
z=l7JzB_=j?W0Gp(_Uw=-1%NDlKM4h)T#Hw!n4H2b$xWkjTi(y_c1y&`37!==y-ee|
z*&R;!_T@)UQo2iZpqz%Jhl4!Cfhxj^s>Rd^L+SQxtit860ynU6RQdF`;R>yc1Y=^d
z4V8^DLGZJXPLq)J9R-4*mwyN*VvR0Ot=_hyj5*F_65eu{gq$Ghg0FN*Hv4gOB8X{@
zSqOsJg22pSY#ay{2)Q(#YWPF&Hq@|vHJRE%^^yw9^!4(S1%#60GG`t{^oQUnrIlPr
zr@g|%5C`aeR7A%x?G>*Xy6#)5zImVA53Qnvo6RIYDe7rdfouZ$J|ZcpEAFdQJlzmV
z2LnYhbnRBrpFJJVjYm=3esqr*Qcm5;?$t)+@q``y9~uux{!ILv1H9l`^aH|MvJ>pj
zwN2kAcp1XwHAXe6bM)IiDB<Nm9l&Ekz1#HmJV*jUFd;o0?SP<b_K)bU_g$t%;jj?;
zl*z>v%cm;FPV_3z!>pu@x~nZ{46_PGf7bAsXlTQ&!rby&$%I_{$7nu|C8nRxtO@LX
z+nOI~4U7^OG&h;lnn)a=pV2q(=8&hCD$p(12}m+hTvI@gb`RV1Eg<+8oR?W!ecn2!
zRAsyoy#Fywr?$s(X2{0lcNsx3ldd!qSYQn5hJqPR<GfZOnp(EqW-)CA-<)bJf>QkN
zoAhUh*CfAk6MpEY!hd{3y6Azj&;x&UOKwVgez;OJV^p%ehFTtk!e#bGpQ1;?3U=EV
zCdGy=L3`tU9VtW`L?0JV_*7N{sk5j2RzZ<)DmvhBv`6|lK`)z!ZqBPqUu|0yr;SP_
zvGiBNvZ1Empn$71chSim8w9;qs6#9FeaJVJ!H>V*J^Wt8MyzI68u^COJr(63X;e)Q
zo*r!#>J2=r+$>HkR%Wa>_iQs?Xi?<u+QtcduukaDqg(S=3QK18DH(A-1H~P>Da>d5
zu5ylbZOXR0RP%qNIdwu#b;o>EAra=}SEp;{?E9JqaigUvo|IT;aOc^k?JEc3hO{<z
z95j8bc20q}cur&A2{CSM-e=I+O@GvF+W>~|DAv-QIIRVdt1}&o=iJ_!9%vm|sLhJF
zI;LelF*Pza<>m&&WE*H#@dtzPeAF>Is@@q*Q?3zjE2r*pNM3NrL+QqAL&B|Yiz^Ze
zjQ_-Q)>vxr$JC2hSS&86*)%(RJeBe{cic{T7k#n*fImL@NU?80_KIfW1vWW%LF^*+
zgOJumFUNBBij(HI-~?&`lC#h3i&xTXts$Cdg?F|HO6HdycHf>Pbs@2zlo~h&X6CRy
z*;ihI(Me}(1y{GAh}5<+Z--G1+CwB3f~FrrxK<xw9Sp0q`1LYF@lj$1OoBYGZ*hMd
z=6by6doiQ@4Qh#X__`H>`nZVA(Y_>lt8dg4)l-;xBbHe9OEv)$58AMeYiA4)fk}o1
zvzsS~nZ8LMDg1Jeo-r}MUX?qxWrX$N4ma<FoMJBr36{U}!VVTKR&lLwdRttc=ZBo}
zn7})8-FoA@??VT8*j3GN$OLy2zVjs+O87(160_w9dosC6L{Z}+l&iKiT89qsH{TK2
z_Q1yc5H?@rRtBa<@7q5gl@S=_KtJ6MxJF_zB}nyjGFW7L8wq2wT2flO#Nvh@Y1C(H
z8eWRN>i6&*6ZygOsgmWTn;<dqxZh*UA;UHU^UC|vid(<-b9Ad4>Yru4+=%+<bt(_(
zQ@Dx!L`97gMd7=+8Yf)1s+#Lr8HM)mD2u&lRhb5VAc_x+1}Mc5#cJW(1y8e(4lK*l
z6JGC=e2VyDLVk@-;qJk(T-*qqaE5wtP;^R?W<%pAi00Nz663KcF3ta(=V^nS@XLv<
zM<hT`XfK{^qDAwoG{jQ-dbZpt;Up`^QyFT&V~BL4-wLKi?H|-vE(*35mD^=CC(S)M
z_~}pJsZCJUPIw}((+yZ-*<_7l2AUi<veiaS;(o#uQ-Xd;S#`Czk=Df8-_KIB;n}!>
zs>cUu{&c#hrG6OFf#G|Q-)<wP`!9er(MJ3HCGTo>#lqRgkS(91(Y<8WxYZ>UJB!@Z
zoXd64<O=*8c<8=YmV;RXx*c}=LtZvBJ_=^raUW<DQ~)x02<Q&hieAe)Y|izuP5!i{
zn>|}%0RiJhON;M*RvM_Bc`uCSc!={t;KRbH;dgIey;VEVu?~W)v?%3{7LD{!^yyd_
z1u+0EsSd`mxQK6+0iTW3E{pTRdj~(XW@*JN6Je#DR&@wXfXGj`TKI>DH0>69y6xjt
zu=2{+ypBS&L{h_n_|%dGXLo@_VP2p`a}Z4uVLf#h$lfC;cbsyEewUXEwqizae)Wg9
zt{m`u&vbil_rUN-*dG@A8@LDhZ3Wc#ieq7GI=4gY2FK68E7OX6nj;}0-?y>@n~uJe
zuFvvC=Ji^QoxV9K3-gu+@6I>zjqA^%k8sd$nsbx0+lO*Qm>^;nPOYKd+p4ZbC}H){
zir^re%~ebbDVp!}u)-!rZIV#>vk(h!<~os8NxFTBOR0HTPj})m**a8j&E(+DvS}r&
zr)q`gcn<$Y;*Jd}_3DZUU7!N2p2rTizKKr=o7}}4?#FWRAh)j)Gux7#9CLu7q$}vL
zmD)tbW(%il!z?-NZYGhrKEKL7YZ^rsqzttZ<tn!QL6YP#yL83w%Zr|kj^E!sH_F)`
zqUvXl#=c&Hc4TeZD6y@VEdC4#p9$xA=ib5{A+JrYeQEh4V#w)>pd@4X-T<N{v?rT6
zLo2zG%Mz9S*0&^2PtjM|R``426`UdOJZW_ldp{j)`3T38E$(7GNsW&^*lRfHv;b}A
zbdSExCd4|eq4Tj0I^k1wZ%3jDc^QYj>QX06HEN#B&cA^<qcH8nB?M2OeDo>b)!l%O
z$)Kb^L;62eZobFvb_4_$xG2QI7Rbxg-!Xc8RDz8v0vQCIinVNB`l)&-`^s!KCl<xV
z#jKDex=ZoWZHbGbW}q`Pa&;zRmsxov*}Y5or$b)FwvmCc1HD9;h3xO*YE*p}Fvar=
zeGQiqr(%cjBTVz|)(vVN14>)7tH)K?z_nId<ph;q<ps6jbc9cZNUpWyj~|&!8~bOl
zK;~P3By9KtdTBKpW4aQl=AOMyTO?R6SyC?0c)Zd(Bi!`!-l*BREGF(M-P>)RL@hz5
zx!IgP_C4!5?MNVzRbhHx0&y9kDuJYJG-?T?0dxaXcnTSEe4aijW-0^flwa~j<j6@#
zugsaRwuPadb<_pZOb8k8sBr<R#mrBNgjP!aq1|ZbMEY18y^EPR6KC4(<3jY~4r%V`
z*0QHFf~WowoNBGgFJ(M|cyfVTK)G^*(c-x+!l5hYmj8lQ#&fjYd+nraxdXXK@$+L?
zNT&>E3SJXN;-9<aA^VEw^&o&EeIS@oi(ji#f{V9_Fbby#=J*`1uR|LzZgxs3Ou?m9
z0z^ZpH7XfaX93cJ3P)SeX)K9yZj+h<a(SOCaoJe$;;+Lm9=V~0y0clvY$xPI?btrM
z3(?u?wzihNuWkpL4CJt^@t&%-;F(;=uN}+|+uOu|X`crT5VrU|ArYx)@JL`z8V94I
z?Un*JRBgP)EwJ?Jla`QA>d=qt`_lc-tZcB_zpcpU7EGVrb=>dJsU+r~hpMi9^SPPs
zs4^FDrRCq-TZ>7mrLCOisBn3f;*b^}W+o^UiD4qnK?G6`8fqr=wcWiczdP>zC_DgO
z*J2oD%O$^rPoBhC=JY-Gf20clOD_8ay`v2Kl|$QTTonq|aX1e{ZpN%tV-r2(za~08
z=Jk+D^on2grTe@Pv$5r;t6Q0@isqhIT+LabaKVXUa@b84&OMfCwi9<A_itFi**VY@
z%!LH9E{UpKZT6^yZiri08%HgwwcJ|S@g31E>>q;D8B5zh@z^fM3@4Ify7H>+KD2aR
z+DH~?xO)Er^NzU8)kNqX(Cf|r&8gn(b)Re)vJNsYClBi^>7e^Us;UR_$zrC|zQ#y^
zU7e998xb0pXSFAz+rCtD4HgJq(PT|w=F<=<-?_OL9MFzB#^|7c`*gU>D~yUDw{EI*
zqaM7b){h_^aId=@e!xqiSp#0NGgV1KD56b{e@O&U2Cj6t(CP#8_3k*u7gKo>XL|9V
zU#p;Jg<lWec=ilY-7NGk26B7T%qZJR=wV2X+meyiDiqZ}e<BG^&QsdvL)TQIP`ldk
z{aw>eF3zDWdhSw{2~W_1BUyY4i)>>wk4H65x0Yv&;RD@eWL=<Q{u6mq!*CIL^BfYK
zBlblOqnw-=NwWm!wZiwRR=MK4Ry7XYF0yMn?`=@hEezQpPxVm(AbWnrKegMyL}SLd
z?8~T?^SX=BEBI#}>bswh4=qKbKQ+lYPG>V))XeV4S+0SirDKVxU)=Io5I;wL#rGLY
za4>9Qzl+DV9Om%yN-yes<v-<qHeDg!Y~Z3GiDVS-^UvtkdHJxZmgVztg2qTDd?Rrx
zrW;OT9AWUK@%t~FL4JLhoayWO6wm&RmmS<+MTeoZNFX6IAp*YSs^!%Ic<eD0p4CAg
zQ<O$8%dEU;dZP{$H4a)t5e_wWbxnV3>F2Yc5}9M{mT6+ieC0S4N^(zdE#dldVYX<N
zoRSyejTgDq$c9B(qZMlWfSGm)ns}l=fIeSr^!p&kpgzc*Nop0eJq<4~+f8YMGSX0g
zRQ4a<kDUhHpI7b#r){gS>wT(?t&Xl>l2+dSb*e)-Y+Hs67Nq$@aJIljEmJT1*0TK@
zEUZl&xH3SA&@84ImZ-(3T(DNo@>2=cY_DYEw$IgVf6GYxP0%yTtuQ6@b>?!iau2>!
zy3t4=r?g;d@K|ctbJPp{1F%*~Hc^giAs*4yRajG9l$g#^Zx7DQwUguNfYe#`EXvdm
z<w&?=hvnD<{aIMO+v~j6552+zz5bQ$Yv(78X~^q6fe0A6)ZWO8`D7EF^z44kVrLnL
zsM^gj@!4s+k94n+K6cD>TQRh+X5g=*f0s$rte#JF*9?CezWMOS;Zdm7i+=77yfaN9
z^#!O3s6HF=je+<+ZIddB>E88*B>#SRnao~{Jjp?6UdFNS^P(R`=a_ugSM=kTr3mJ?
za)NSWHCI<cCB_!~jR*PP&@y@JO4_uoG}pYxEOtLwWb^>vL$DER3F!}##vbQrl#3xz
zHFD$0CJO%YRG?ozvp#{=bKUVbVG->vW&TOZ-;+U`PN4Jjvn+nYoEOdN1&X{LyH>LJ
zS>|$?;_#C*otFDA5_$l~P=ugn!H;3D2UA^AI$p~muTJf->h>(K9LW<{G30mq+$(BS
z_5gsZokEI&9)evTAsr@P4bJ*s{I&4+fBR=)fXH(im9gyDo48#R5KA2qOsh{0HEWYP
z8Rz1-^s;L9!5#eo7{ea4Obs87yM~d+t6VJv12{hNO8KN-9luofh}&T~W-9sbNw@#v
zDe}LKX8s?%=URO6*V$cWpXtPsu6p{^YB^e!6(3}x#`heXTm0P$*LOgG(5%06DcC+$
zAN9P8<qgN7g_9R_+VgT>XQ_%+=ogjv2_<wJo&Hdc9HB!6b+0nmaNHBychY_JqsUT<
zWq>uOX7Jg&1FsI4x!~1K3f)yjdr#fvDY(K{`mw_9UvIL^)k2Q)*o$bB-*NZDdJ+eS
z_#X~fzqw95$sF`Qv-Sv8&R$ITaE9vDhHt5;>qv+P6`uC3dg#C>_5?fyD)Q@>W`>ks
z;Gckyia7c*U7*1v6v+B<tsVMNKD%3^(#OOs(ph1#y3ftM0sGRv8XYiQ9D*)DP`2g0
z5g&mnvb+<B#q#?x4lL@NeIvSf^6z_|=o9)ZIv4fmot!E%@C$AhD*tuaStv_Vuu$+Z
zN2D2U9C)^Tjui>Cn%lL+wpS#2!Jry5hi;WZ8CS2W%^Kf5V=tz?0(88q_HAodrCbd;
z7#nQ!jjzycxw|kv+e+;m2?7`}6JAaIG(U7nffJ`Ma7z)l^H}kpay@g{o!N3E0&-R$
z3FqQgu^|}V-IWU^aVYR{*8$C3(&I73J;BmH1X~vu?HGXTNixC$8akWc);|P=w4gx_
zl-l9BC>t%lYaWJA$fcSv!~2D-)^HqI1_PG4nGfw3Ch#k2&~YPh`lfM0eXvSNu_hWJ
zM;?wu7u@;L0}V4LELu+mxeoQ~!Y^FfESrDE@E=H7e$z%KO%SCM%)sK?UE1esx>vsE
zbT$K3LF!_j*cy<!pcpxg(woXb<cQtw`og+gMBcf<-7LsLuoToDWz|6y&b--c#csjq
z-Ad2aCDxzeC5x+C=%O;c=XuAMwdQti;`zf%9^6fI{eBtRsNI!g{?n{x9;q5CHDZ0p
z{HC?n#(-Xf1gg&Wny6fJp-26-C%0<wq~@2*fXkS&Rx@W_5;2vbiWsF=1`02l&6BTA
zvto;XLZY5|)>vfTrs8L0lFdpEvD+Qp#Fn6r77$wPo#&?u-st3|s7b_x2ozIe{7MAL
z;*l&zn@!rsUor{5B2oGDz$Zv!zISsprRHZMLqCb5jpz*AAj$WII`ipy_oXeA9eaxQ
z-0d0thI{Hp2xUaIM;wTA(?=hqe=QE85K-Iq-E=hfuOq5`Y<%6_{CC1hK%4SaYl}9X
z`YJwHU}vmuI^%hIH}`~|U5#Sl6t^PKHuq5mh+{Iq1Y?`z<i8bdEVa(7=Bk!z^3Odh
zVNtbTsTZiO5xf5+bJd{&x^QWXBf`$1+z=ccql}OhT6oAEoI5tATt?@+Ek;xQler$N
zgmW{K4JcCuv=P^Fu6Kvp3JL%KejZeNm(?tI6QLR_ep4)n8Q=_k0*8jeNm)If*wzej
zT>5no0gOKn;#=@Avv$p;WALO|#C|nmSi$@e;Mh_ZbGv3{k!RfKI5(|{G3Xz(9C;#@
z_&)qT#Yd`{bR2M9e4mD&lHee2qqc-{qB6rT5ez*seiIdfoI}HIwmx6%8y+;ejF3hX
zP8HruRWK*JaKO}EeZ}!#KE!dhW8*4Imv=mKzB@4o?^gsucQo#DCo&U&jrVfjrSMVp
zC{~5+6(E4Vn`|q<L|epbf(=7_e^eVNn|$uQ@P^^c;L9lK-Gpm5`){izAf;l7=0jF9
ztiJmeUp|7;XNNHL-9;D26^36Lez+a{<Bmqx{IA3*#I3!}TtB<(Vb`zJFJAx|x%D`J
ziLchN1j-jl%PPkd_@HuVj`&j`Hd}_h*)0%}L*9SADLaShKE$w57tMg=5UG-*jg3V#
za{L#S1IKM(f3yD~SRc&?^gs9_Tz+K&o~#-5n}ZoYkUkof`$Sxa2s{U&{~phy_dCYv
zeY>t)V@%>=?!gVO9F%JNx#(8=o?=PJgEAl{aM|1>#5N)3k-sR@*nK_x<@eGM<hm|N
zC4LkypMgm2I3&O+1L=SXIn<5;L3{X#p=)B@s3dn77?!AL9a(wzDqey1-n3>G4LuVc
zDJl|zECkJX|9@7%frf#pJiQkJ13Ym9sf7s&RE~S6Kiz|_Eq%jT_+D#Eu9QTOy!UR8
z48A=H<u0@1YD*yHyTaNVG)Ws=6}mG9AlXP^&xCsVXgx|$nyUEVlAX4LVukxjpIZFP
zU`OYBzJ{Q993#4}1mSXRw;M0e6U>h)Uzxio4GDhE(cEBVm?gZ5yuQgwhT+@neOaVZ
zP%Joe8lu`HR%E2jrv_*qHpTua6Z~(>q7r8bGleXlGH3mY)}qfkV&jraYDoQ`{j&sG
zmar_mq=gQW(%=d9ZqdLX{(jQFSy^89vqG~fCr?#Adv|VwUq_U_*1~P`rJ=s&^>c#e
zm$4pnZ#d^yieXPf-ZA?e)DzdBW57}QlTbI|^kvD*=?e?Rdzs*cq_bF6$_CouAR^s`
zg-$0ox{7kh9pTb^u2{a(SOS7Af>p!G>IRsL(Ih-oc}|e#T#)2xD$kvevQuCa8Y!Ow
zu^iX_S3m8timo}cLG4abVmVPE6mTBE%^Y%bF9=9K@OqxAPJUk9E%1%J58Vc4dLqmC
zQH6#7f>)UU%654_cubK)&I7iDW4<bEV{isjqf<hyU9C*jY6^DLDH6LzS#!Vil#j5y
z*5MMS=*T669J^s!rw;IJA)R_H+-L}BOkDHumg8+F(Iu^yc7kI!s|PA-IlJkW21Xzk
zbU@^X8<zS~A1Zy7cjyyHb!~Rn*wYbMnN6b!`zmA87`}5CUJB1*PEY=AGGP1KUS54u
zv;%J5_$g+R2q*`V>h_MAPDE{%)}zDn*KB&?Qe$c+_BJB9k8hYbu%a8vcqb-xi5bFh
zj{$1!2G&mtl^Q0%HGUGrzAS65X~OW@y_;tLx!xAR;g6j+74yJ<Xz2!goxLy$94!!S
zl7O>x3-bCpuSubu?o+mGL7&zoG@JCBn>T6J3!DS^X2lijX8HuVF*#THZIu2=Ykm=@
zXVs{y-WCS8z#<E?eZRK&Cn_7#EUG}M3=(jrvf?yR+#Q&J%}@o7ofT?0(6``yNhzxl
zl}R2Ew@&3gP`Q2E@b&isug>{fYbQZ>2+w&hMe+TLbkHDl*CwX-ss>RX!Z7$lC~R$O
zVK`Ks`VT>g6N6B+HOG!E#fC}RD>vEVUAsH~DJhxc&*Z-iT5`vf3H%THK}UF6>?emC
zxzUSqs}#SN*j{wA9kU<E&S>5$x`D|ct#L=GMecHCmOUhRU;GPGSz|D<FRn>?vappB
z82H(7J+6aqtDB;b{U&#)l~5;Y6Dir9f*-_&d~=!yE`9|ZThjq$LpPR69U?y=#6PM<
zD;%6I$~d$J2O@|Kz98Ij4Wy1!h0O&Mo!S`|HNJi_9C0*`iBLhbsDI?cDhNy1N8ulL
z3#<WKMXk2PC8EwD`n=sCO{J#Mtv@_dTf~z`BEnta9G3ZqV2uG=hHmc0EZ;-ZH#!u|
z^>qF2e^DJd%)D&gJ~%Tfb%lz5em9@2^vxz$EzTTWdf5{~1y>AX?#uR0h&21&UnE$%
z-tAeh&6RR6H9&|ksaNYh<Rxt6%=wI(_7*m*zQbqKGPPhymzsUpxNB2Y^ZDhEitM_r
zAhtDeQ{3G`{;aw0^&@Wpabg67p8Y;n4{@0j*+yEMq+8X_xtnhIDkbZ-htKP@{_KK7
zs&hxF%URy7ERi{Z+RH$x$hm9R!H>J#6_Y)3sBv~{qu2eNkv;63&~oTAGB1H+cA5vD
zubF;9zuN@@f|a_@r@2XEjodTp>jT@qqMVj#rbK@V$-P-ihy${(TSyqfU@6DysBsI(
zS;Gx8>15{VWhT9<9}nKJMc=+jrsJ+N9yV>ttn10RsQ_QiA!?y4aZF)Oh=YQh>y~-Z
zuk#Ns#QOw4QY|hJtqg*TOKc#^lP^^QX4?A~?c@eMa`QjGTqu(+dU`uK@4HHH!RvZm
zMq!b;K9x7HL_wSrf@-evOb=Bn!K;s2ZWL9B;Q1sVY_g)gB3^hT-Sxz@z6?W9Ny^P(
z&kq0LU(gi*iuT^FZ8csJa;YSq<Nj!85{S2i^sNc;l_k$?CUl*tYVk4&X*Bh$;~B9+
zZshae-E7V_=JqH#r3cNEZcn;uY)S8cKlZc>Kz`j)5!J)J`sF64zUpGDS<O<MGS!m!
zhd^uMEYS~t5en8J>86SW98bvtZFl@r$cLHb_9o!9P9Hck_oKZP>^sNwngXU~s(}0e
zHHGdFzqL`S1xYITS_6xpB%U#M7jj<U9g3U`(*29$Q@8||&s;}?7x4C|;vsRKsf1?@
zR|QaBJJe`5o?khz0@Nd1=qvMrvvqRD`sLa@As_X-Tl;Sx?>td3&4)6~+%s(nDTSQj
z+0pUvhfR~WQXgn43*_?LCjmw42tHw1(xg%6L4(6k3#&R|ZR}u87=4g!4=5}hsn<yU
zJH=N3Z}wo0riS%n=#Do34BVI0nc(0_Z;&Fre*}o*!5Zp9$qgXd2Y%<NBum3J%YecX
zhHi32x}8+KAbPqY2$2y-Vw_IS)9QUGBK|%1Sh+<b(G4URz5pbC#m>w=c&D+yB?{)a
zl!fJ>mV8`85KbjK_12l5us~t$tmp?^t@G`<4I$*rCNg>&qsdm<b&DubzVT!y%e`4W
zWxBo0f0@fZ6aqg}ybcF66k2!xjx`3`t(OWq0umIDjucM_!Nr$W?}JI50ZuOa?^NVC
zb<Y7dT8Nd^eMiFXd)V&?bBzXykUlBU3YX`lJ$0+TkPoq?!)e{<3Ln(~a+j5WX@<?6
z+UNM>9cG583i$Jz>pY>;^*-b`AFVzfARJho$<Zz^soARbeu&5$rX0OF=2KFe_90R|
zHd{H+HKD@X`D3`sc`JY4>Hf8#`)gk)#~u&sj-Q&I480S0@zf#FGFf=1@XZ+VrAJct
zXi6Y^KZ1%%sr2axP&*plqJbHQFwHOfth2)p10<>e){u$OwV$gRr?b{OX(Rd+aPOU#
zKLBm`CT`hQJ+9z@yg0Ia1ZteHJ9e3k>|6&mI5thS!Co^`H^eLZQ})oBEi&3$(3LgW
z7fYmh-j5quJmUWfrxW+jHl`9zCOsOm9dFTFGt4qO_~DNHL=tf1WaGFl{2ifu3JV#7
ze-RIK_os}{hX3?0>)PdmZ{*{;Ki%-sD@UBa@<XD?@-dUzpzds*RP8jE1FC_=ApRMk
z>cL0Tf>lNemRT4#7OmE766`aLh4g&do)Cn0)6%k26*-y3U2SDH23xOQWm$%yAB7i<
zuR~&dR;Z;Bjb*YwUOSk_*nrrSgKkn*mbipQsL&yo@1stdEc*OaY(mD9`DV^uLB3eK
zT+Yj~C$1gd?k?@3o+Txy&;qH48rDC4K`6C4Gm4R{**+FPKfVsC^AGG1-ud{!z9+`i
zI3IDI@4NaK4dbvg@EY*R;&S2J>e>C$%$(=sC;oXzj4}>>Xf_>340F{BXZ3^Kn(}Tu
z84A5K6vjqX;jLE=^wd7$c$Y=$)q&xl@(&l(zZb7^P3dAfrKX^>v_tRhQaq(UUD5iq
zsKD4KVaNiIO?y*Z3R?eKE!XGJ;`E!8Y{6s)G7qdU5|}Mt>cqfo*{#HdOWQTtd$c*R
zX}bUAEtUA8OkbQ!=|ZjNqha8~zE<a3IMFh0aNLz+o=-LcEV2H3ZQgdHI<~XkY{8Uf
zODcP6GSNxqzjCJpXKzbl#1YK)c|vLa^*4KN?8rlw#9ZtbjOuU29or_FOcxIv(oT2U
z<o#pf@knpNRjhHI^z%O3jx5V|xxHzH_M#6^b$bv7j5rv3-nv72eAr}=FB%<-EFM*O
z8<dRzCA}PPvq+D-ZReqi2=XAaC8fXBzoh_Uo9L{^lxy)qHX6Ol@}qV;#ovm6b*9dd
zowI(*njljONnBl_J^>w*w_q1xjJ%Y|$YztTofc)>wEE&<9-tU`xc5qbv`ql%mP@xC
z%!67q`=H{lau2NR-#c78JzgtPIc;!KneG{9a-OZiOJzW5koG!ItG6x(VNS56<f(WY
zG9WH5fqc>6cuyy_x~z#Eu8{10>u@P)U>98A<@OQ*p%Rf}=tr7@4YRWQ?SQi2nI8X*
z<i#dvSD-IvJbXVGVE1Jz8uVuq{kf-GY=P)Zv7zwyMx4G1@Ecj{(=>%+()v`K#>wCK
zqR~<)lcq0D^MUN=<xWoD7Mg5-b4R20&0jQ5xV|t5tv!)11K1j1?-<{BI-3~q8@4MW
z-d0Qq(rd4-G&9PQbYfrTC!u&QUnr>%$QtX@ud#zuM5v!M8cWC9@X{reI(coU3Q~lU
zXH(i=Y584>>q{!w&=qU=?FF%ZGTXsGUncg8ueaStE!NRw#Mu3OGjaoj+KjqCzIj_i
zQw1_Rw(kSc^|$jFZ(tB-at`A2Mt}Z8&;ms}d5M2U1bS6}UXRAGF_^=rD}sl;m3$e0
zH^6AI_7En@sfM4g1IX4Zgf^?cXc2Ojtb<<UmI}RkBL>l-H2C!O=PpijElt2;(X7(e
z)<V{f<+>;Tg15Zuj0OBs4!ab48xn(-3}4Z)Z?3Z(leBVvXjI?KRo%c6d=dZCFC3~T
zSpI%~{Wo_9FWgUNIm)5ZERC~2EjFBPEp%huxAL%Cfj5xX+`Qn+!aD=A_?BOfh~i>X
ztIItlFM^gn4Br`eVrCb1(iAk1vX}^7Dcz<|-zZL_mlR%&Mh5|ISgo|&&(;r-%e8r?
z>YhJ0d#yKBzz0jCj=-=Zl5?tJQq<+MyRr*-wl|1KNo1YcN_G}JY%4QL?!tKtUH~56
zZ+DkHr<L+y-E8#)bvMZNV2*HobOn2xjlbDBQMij&8)JSd0U*gcFgMOmT+gB}WR3<|
zw#*&^AyCo4Ja57&^&Y@=YkBMTJQOlzx3^6hOu~GeJ!pB1_|T#ZZ+fjJ^`o*5-?gGw
z?`TI5&dPi~!nFS08kI>W519krqy}3vcgi@6>eC76gR>|&W;MFX8-hnFH#2tUuV1{_
zBs1gkhXFS%r+&MM*S}cbiDU)?j_gxP1xgj7JGrd!@N?LurQ>%e2@DcTF%-I=Wcelt
z?6l)Ar<r=m=jt(gk%Te&sE$e>j=-IL3E{f{13)LKN`c0Vzzd)Fmy|9W=?kIGG5^%O
zmWzA;pKNYq_-ls@c8j}Pdx~cGD}F4^6oYHAe_N88A{zOGV}&?<p?25!G>Qr@!?$nm
z7}u^+<!0`mfS2Oe{+B5i{|yfR(`xnqayc?BmZb<DcN5bxruG2ZtUqe8c>AyGmjhQ3
zm1vJ7?JX@U6@P|~AamV`+AGkSWaL+o9sG?<GoFOAO0jL?UFmj4{ImFsH|sNPGb2_E
zV{IJR=I#}i@=kM2F0m}{2bc3M6LCqBSAjpD1$^`vZ;Meiy(4pbu;aGU0OuLqj(wtm
zM^C@g;l@4mqnWXSRI>d5ojtsz;?TNG^aI#~-M{-tkx_BA?&ATLWYzQ!K_kMt{cI|^
z6L5M#kU+iX>xB?UMOLLNAdsjzWJPki8}LWK-~g8k|8;Pc4&_ihle2u?em0#04Z)aU
z4e&RMBv$7AdaFW0I?r7G5I}e6i7tMTob3O*T#lGG%9~QLH<)z_Dp>X~kj-X1P&SP1
z1&I2~VlZD{J736ZQuf0()M%)}UHs6puop?R0;B)?Ef&9Xo!J8xrw3HadLFFhYDk*9
zcut+&xM1DjDGpLRFOCu*)E-?zf=8EG+R+9(_VOHkX17vZ&ln_AUYF)0qzZ0)*^5(>
z>iWU@!jt?L$$}!hAD0g6Q@o@-J-p&fZv%$7?^Q#7eA&vu&`*V&1O@#-gE~h6?R<L-
z^oE1`yn+9OQrkp9I)a|^wGX*N6j;sNc0+RG<G!5r>P&YIq2jC2`5}x4*2e|ay*AUE
zLm6T-KPul9RMVX_EO8mWeC`p@;!u2t@Jz9H9ox(M4o18BJe?IR{D@&Lqvz@Rc9%SI
zcm?ysZmC9A_~ue9+A1oi_7RR2hPeV_#vpD;Sah%yN^GW10x><#q8ayed3pZ!{{7is
zPV4J6G^S}^P^29M!MOQ~F7v0UuHUu4<*Vw!O*_sbnWV0tFqLc(Arj^em9E;L@-U|h
zhka@omZe95zOK$YdsoB!55az#y<yJ_&CVNj<X(4YN!f@YM-!NYl!bmkhIvRjyw;p7
z(MA|Vb7tQ3>`R69xCwZP$tt(!bv66ttP1fFeS2QnP_w1NIAnMG)ABq}d-E#seLfdO
zjVL<-!K);z%pAfHJ6ISfTW|*Fvqni~&T(UBK6C!vrwi5WGjOAm*^^^+Aq$hP^>aOr
z(}>L^FZ*VciMakLpX^iF_OUl@Ie}xWr@Nl>kEeCqj!)!NF+EoqfT4k7VS4n*q#S9<
z7M>m(RQy8#V-^he@Nx6-yUW7enkWd!Zx_Qpyo}^4cfaY<-|L+-%L3%n<Zc@Wu*abB
zBmFuPYw^qT%N#Tir#r$uc{E~rudbB>o{e8*R~JTP*S>YI63FV$DBS;^xmds=6!RTl
ze=z(|sZYXn4;OG1+indQ`3+Xv_ql!0D?qrXSUaPpSK;EEc#l~eKJS~{QLPer>qf1q
z^7EJYs>BW=HU*%R;eGYCUkE+0?rxzW#4R^6R_KNt_3}f1`v)(1%Y6+Vs<wG!E;XO?
zxNCLh<Sv+Sb!9GL_3T}nFt!ZYmrzi<EROaHZ)|Hyu4KM3`)%8qXY^A-y#Pbb+I3Dt
zMrMF_wUP;*ZYTD!ny13}pkZB<WIHT^I#%#Vvmtkrr$U0R+>KGM_?X^{_RvM@KauY2
z<KJp}K!h4y^~2HZB8~Ibu82Am;UqnF4OqxpMnrQhDm%hM^ckQf2mEaJ9aqW7YgoS}
zqJB~%dBrcCfIAu0R`#7=dvc;{WsKg#{F-5c6)rBnR4IgeB=Wf`2?!_%&F|=vAU6S#
zz$InyL=GI*E6)K&IYi-PzhYIpQ#5a7IfeKH-sthuue(f}ds&+%DSb0H;__PyQ6{$f
zD!hHQ^k<RcT7E7;tOp{<JNUUN=+F)zk^mrf9d{L@Acp@LEQWoDbc<8q9>=MF!*;Pe
z*UVsPZXSwAk-qoIq2bfPGX1?6p<5<NnSicbv33-f5z-rSdFONm_|CUBwFzO{Q85@m
zrQw96B6U)v!AXAgf7XKn&)zF<<4A`zymsSujArUZgn#7b$gyVHWcx<cskoXDa^x@;
zG8>|g*E7sP87oGDn638CilGds-@C9oP-CEos+nJ^eMXCdmS^0B{V0-4q0L^#zU}iB
zfZ*+S59gk(e#4rU>{esrO-{+nj(sSbpO7tHKfi9b&J)+xasm3Was$tV)3_=Qc`ay;
zDZ$RI#p!fq(_nqI(^j)sK(#4@2xFFng~IoC#;ek)Qhx|c2J#X<Iue~Etx3LfX=8*6
z0g90r5#~n}P7-F0FLCzMbdmK_(Vv2b11SG9q4uxf?!WpQ$p{C%%O=(XF)WGvn#dwv
zNR}QFnHNiAH?j0Ke$#OWGomyiqKo7tvU<K?VZLnM>j&W)zP<xv$y+Rs6=9_AyzWV<
z8f5G6kEY!Z{2mZLmR<o@5g1EcIS`UgLkY}jP`($(9rKuC6u(tkp^QvW&9m%hNnV8m
zvxYx*FvFL1m_Fhg0f$!wR3Y^`=mg+91US3qSVOu?HXe=QsWx|l=zyB{kG}samm}T5
z!G5{m{kGP`m-Y23pVS%G^lsaI$?hOb0u!Mm#y5K<%?|s9!S^*2=m)tc68o4bxn`5=
zEjXI&q!X(<2gDBJ>+6HLU1(R^V)#|xARk7yCQ=Q%6)vnD<jBW{Qdj!FP6VIY+BtnS
zHQ%nI7ND<7EYwpeAWQ7KR{Cy>0GJA6rK}DOfeDMj)vNX+E72rm*#^fjV1U348UCNk
z)|CHi;`9IZHQ}GBf1^qNj(5NDyvQ^>Wm(U0mVZ8)(!yTQxk8Hrq3}+MW2f}Ym@mb}
z$({>B1$tYl1dT++U--YGSGrbiLX{>IYoMw&sbm$uRTj$=8@A8`g))*&iM_AzzkErQ
zYR1|gn>;zP#NPM1*YU*j!fu3SUt6(BVnCKM^Nf4OTd@XW?Cvc5f~USAjwdd)fd6gB
z)lF_X+y>AT5@R}e5k392%-p5%q}HRo*~o2uG|hZXv3H**Mu!xt)l^@t6sDyz&T>xh
zhoG|GRuXrUc1Oo-NA3|ye{cv~kM@g$2g2xgF>lXlSFYclPwJGI-n#CQwEKSf^pNHm
zUGosFUF2n<p~jnDD6vya@7UFn`aMAdJw1Knv8BQsWXaU&53Sc?%3<@AYEq0v`EB6e
zATkZJhl|f7#;P_$bp{H!Vq)!=H`9-EqJp_~DExImGZycz(j4SRExc&xiO^iFOiOy2
zNpFcEzjNaCDc!n-{VmmL{F`-a#%+m8)Hf(4Hz-^~$S~h2xM9)7n$4PMRc(67q$HsI
zqob9}l6>_n^rZQ%v19F!EhqPN*<9bzHud3vR-^CXvVm&3kpzj~jEJgOsm9Ackr+hd
zXFlAq$#3G|HiM3P9thqU-;$}~h?BalqRRE{Coul`M{xdsT%H3{3mzQJRKk@QVAOi{
zH)g_|JPk@+0)F>_)-z<4t1a^i)_~<M3seWP-@saz<WEzrsC?935rj7o<(%CJ{Ni-<
z%TIwsJa@-l@BLmN1?}+l?AI<;uxH?+wNZw`fx4M~%3tDM;Cm<l(#8ppf5}L)a1<yf
zL#b+LQ<u<c7&*UmHr)$i3$$}7F=qr~*CU8qbS!`Ij#rY~o{^-_17WX4wLY~ivZ=Y^
z+o`wbb|o_W?Os|q>lgET%cqt4H#il@@oG#7i47&E&?{I4oUt*O)dRSyZv{x+MDK?v
zWvFK+>)VJwdogu?yqKm--Qw6%+^Nr_#ZT_1kdS{sX0n95RZkmpf^OvKHH02mTE2N+
z?PXT*OYnLAuCR06+B+8XK)D;OzpLz)8G^1SW|VI9X>;g?L$K{zBisE4*_vOS{bcOA
zhFNakIf1#4!OH+J=i)M)@CEd4n4)TM?1e;f**v&dAx-L&=+S2SGW?#n_nR-Q&~I&~
zuLD%0<pk~<ys>W=IeKyk*5ML)9ItdtG;jjT1=x`lqk0l<Uun7_Y*`n=PBH}&esIH9
zr5@1nZXr?BB^(g74LM1KY3+H+@>*1kVo|^@xt7gnO<DB$xLUR}g|<XhWqWrpPm=a$
zb8Yo!X2y9T0lX4cUp(;#fpl`u)-K~jytopUl6q}SSF~(Jeh|5IGQn~!1;t}@Z&H-=
z58#y7(!3ifdmEOh^Wz|w-zi*gbY7bA=3_&8Ztql;irN_M$U9@;`3pPK8$4E--r{TY
zpn7^y@))mJAG&=o8~VCTIazFnhD>x<1p~t{Z97qXoZ}^5bGB^hcG9+2Ep5W*lhPDF
zufKxb9v8)|z-4%TXXz88x635NEwYB=2Vx81(aN0c;Y}sRfXX&Cp=0nvV_x;10z3MS
zOeQ~TT$HNW?38zzi}qr#$a|o)1T%6JNILD9pre6lzlDva)TWCYxyKG40>=P~)z{6!
zMz#QKUY{R{@hDvUvcXcoyCH6+Iaw)I_D)Q|cQX-;1{y&xGKn9mBEf9sTW8FcovH>K
z>#H-$WYHcqaxK2Z-VXbBtM|=>YTU}qNmN*>2fo3VZmk&BOIu~$qV&&BD;+J;{@$go
z>lJ;*#sZv$E>mOSI8XkRB1sbOfLXcM{M~b-US0oSuF~={-DM13KROUQHxBfQWmg6~
zT6qgQ?zcfyvzIfGe~S?9x}S-BBwd}cWF8DqLwn3V)J+wmg8UN4ikm#K?+Ja+ml_2X
zzg0q=eQ$y9xIf^CP2s{)V#6U4MJ0X^AXM*GYF=UttYc-s<RXU{l@&=$I9E<hN#klN
z{n7j&`bD$pt()Soe2ABmXk7UVhi@=#G;es`q|KX`7HZOf0N7$d6Y}u=%UT%Sj7okP
zi~J}DQ+PHzbZi!rwpxXj4?pRA?H(8kRw@AwX1yTA?ooWibfshZ<b~m&*OyT}aFKj#
zMAU2O0J<fiUp&@+d+_JZXWOVSfZbY3-fM#HdJy(e0SAf-8@^%?$t`*KWE~XeobJ+>
zA^J?}+^e$`1Nv_IqUNbKXdGUquI0s@L=u}tmXh7y3NaI`t8g9IJ@yq}yQoZ7NR<VI
z*(A@vLqLTMr9MIV?B`p`7Sm#oARr8yL(<m5yR<=8bg}Q{-N*=e(aoO+tms2aP(+KW
zLYho3w`=6-u+2`us|(9+WtptT)oJ(b`sr3um}BK=%7@LTeyU^W*19rC!^^4uW7vIQ
z57|v@K+5z!iyL&eac8{9d?tNgD0wdu(^OHZ!o&)qT#{T567fcR@8P*OW6Xc-{if|&
zVAA1gO?oyX=+kUfV?kgMODEm~h&@GS)m#O`ZRH`KYg^O1^aQTIrxG8NDvjPcaxyLn
zFWK8Dm06*|+G{?fzzkicY;Id9KAYhIH90m_d~LK_S5tyohgvX1wTNJ7SYqs!sMir+
zlOYPG%t&`q7(~;?io!o%Q<{Ey{kLepd|CUHcZQ|wL;%50)xoLN6=7*!;^rI*|Ezr;
z`g)SH;1f`RTfp7-{Uwj=K(;B9wR0ywetK4b;H^#7iS~7#5%M<zQ%Z_}F281E-;u~o
z7~_;!OdJrI_rxQc%DIUy$>RItKI?m$XP+_h5P)%y(2IJRR`*lpaz-=Af$~J~dVw_E
zaTfe%oo7YQ^#kJ8;_hJX7=tj|<oAO&JZHKanhU0fL?28g+|wGB0CGQy#*2hP&$O1S
z1S{=oJOoH6sOV0N_CGVA8SQjE`FnvY*Y-){{BwO9h2&PU9nIuSrWA|qb|=b&=ct(|
z?n#^58X^AtNREXFXMfjmy|WK7q1bdxnR%2zk$OIl*L)k~3I?B=g7Ui12BCIyrt7<Y
zZImV`iv4_pil>p^#E3Qq=7iFJSD)GUBRb-@GM^c+s<y%<n!7=Ua)4r^{WlGx2(ch-
zW&AD`poruDeA@L-@j*K=3{XSPTQ04ixuB!%j@KRL#qJ?Jc$qGJf{$iag(`qid|TUu
zkL<8?Fl8Sw<w;koXM^Gv7%M$6w?v}}t_~*l6*^zK*tY+?lv8Klv-RyIlG@KS8XOq|
z5-i}}8G;55sh9!o3|FuEpSrW7OnnfQ|NnAX09PaeUt-Wk-;W7ey8_>pPx+g!d>8*<
zUBBW)N{+oh9cYobm@XhrD1i#21-=3r=A;-B-(C4cmhuCF6aOlC&z4iz8(3zr01@i2
zAIy%OdM)9!S{VnkEuO8kc*8*Xhrr@KH}5B->hads&1cnrWt6t~dlSDaTU}<?doJUQ
z_S=hbl=$PVori=Jge072MKGR!a9E<^mJBL0F5@%iRrQmcaXm3?J?eb?Z=YDR-o8c3
zwENzfO|m<ieXLN_@xrnqHnv$)>DqIRq)fXfNKOx{G({BX3S>GKV#m*NMTSReH|WsJ
z65XqXk$;8+<{Ey#?XE3_f&E;;@=(RJXq5#|gM8CRU~fY1WV1{Pr!vrJG=G@xVU?xM
zmia|;O7tI$q5ptVT7GI{g^BOEuBr195Kbm(!@kHVmFy_8pI*WUvBqorE#yT*8<2oZ
zo|5+DfZ6#5Jk|LgvYsgP7_(aCTISNM?7U)!cgx@T37K9u<FEhD*^qLGiJ#%nsr3t8
z3r|!Ky05PXU-*)7Wkx+ZXZ!M4_;TGk05(aF!C+F*W@ai?on)n|%mk&81%!sT2#DU^
zFdjc?l~taosExb7Bq&ghG|3AWpO1_bzC$=m)~>@6Ya~eK{40LwG-zQ5ulYReX@cN}
z;Hxuy^IygA{k8wPdH=Vs!4J`8ofmBtg|pa&PC!gY=McIfIZfcxkighb``Xjk|LF16
zs*D$SM%nx2W03+q!vvlFreH0{pS$`7F)`9s*Zteo(1&4SD-4cqO%wW&YPnZi3k7{E
z``p(m4){x9>9y_Hnsx>r)Fpnm%j)*mz!>gvSuI<p6v8><4V86{6&6DuSP=x;P08$~
zUyRZ;+FqEF=g7-uFZ)zmZ>G3A>JD5I-fsOjGCAG}knbPxda&v}bg&0Xq?ve<ei7<}
z-s1eH9-V5k@vd=1{C@1*CX+e;gDYq^NaAtZk=y0j5kbI#)H=wRoNU*~@X+<}yIK8_
zSsJM92Lo45r->c9vKhe<&m4VQ{Os~pe5J6>xC?8TH5LEn07b0A2Y1L;>FBt3GbNQ~
z%~)-Na%<Lyhu0s&p8qY<Qg~||W~_Lp%*ab)=vDK*d@J{=lSa;@6&MUK^6|&c{zruH
zfBXBN>Hi5Y0f-4`t8F1A+h;O9dz$jClP-6v8-U`m`9W28rA}BXo@|F1_Q7r%PYt0t
zXhIcYYy6}kaYCNM&Um~DG53~1PDtsx<rXM0N8|hu(I4vbrA0Frr-!l&-C-VyG@IU;
zzW+RMSY|DC_=y$452kBsop#p&f0XJEj}!xQ+ECA~y3&3Vczf~B6Ja_V80p?00>#~D
z6D@r?BGrrLnd38wCOBslVVfm``6N{Y+<4t|m%1)T*5NWn3gCPV1*j?lUYlhlcSQ*n
ztLud;8D9@h#-)9+t`^%-ELSR#oRT-)50prmXTD?f%#Y!$e^YfHfj`3g{BBU_931jy
zPgaNR|ALN?AdT)#zy1}3%PFSQE8_kBP(NvoIm;=2m*M9g0ZbUp+p9y0H6_AEm{yM`
zNBr1a<dXeE(DWhPE&n}akffgjtMTj^3fZ0B9(&K`>9C8dbv4OVa~kHsSqJZYYk7Nk
zbwf&P^8J~-UsbR-jzNSaJK&d&wr)%D>M-t!6QFHaTS3Z+9#xg9g%Yn#omkxf={B<)
z-dw5|FkgWYB!Kz0S19rF*d2NWk!cq>@~;C@@bMZysNpG%g<2lBLb&jXE@UewVucd0
zv~H>gad%g%T_4@lksEoHjj-3P;Q1~o&_g(rOF(cVc%fsN9n^*3j_wuzIusOmZi4K$
zzmummQFt(d7k*0MU)mJ6C?Vl#sngKU!NVt7zgkMF__pk=wM`md+1Kf9t6Fidjf5D$
zt;^9HEYX<Mr$}Ys7tuoHec$~}jzRkUIX|)<k%8(bugKV*i52;iH7c56y?SI6qrA=8
zAWs|2n_0F#nb^f1s2DRbDr!$5f~B$Q-~2-n#5v`TsiQ@X7oQ&yx25daeA?&a!*qxo
z72?nX$ls5vE#hwi9WMTg-3rt-5@4nY>+w}jrh<CiNE5#fL<_VjT!gN)<#|#lBxQ-N
zPM*SIyFporP5h1?_(#V-EfW7+LgAOzAwQ_6(0>Tz@BTv$qG<h_d{thRm#LBCf&gZE
z1*`r;K&As|YAZhix^<splD*Jx;5n?KuBOAh9B_gn^IKcwq^rgi$i;dt1qNvpwOp;E
z4`}a{eO!hk74D(d(_ejcBz)W++||rMfz6lQ>Ma`U32m$#JQ!zL@S-Si7vJpCrZU*B
zzT<>&I#%`i-PtkU?(bJw)4j}{q5VZw^dR>1>pw<?24ab^J&Q8}WSj9f0@(M)j-m{^
zCx0uvcdLR-tKN7ufGg`iUAkq->|kA#@74eHp*Nc^Qlo*a|1tAv$F$5<JTZ$uPT3P|
zxSYX`#P|<b;#8x6=8p>tgd=0J{1ceV7<@rXpOYx=s`m|XYwmE7#sZ;mQsy)`CqyEL
zZ<O3yE_$m>MVvv*PpZm)Zmno<vwA1{0jdl9u&K@}>rKZYSXn@1VeprFCp-M$g1*_M
z%)GRQ65B}^g9xEe^<%M^j|G4W@ZjH|VC-w_PF>nsP6gCo%f^ZLe7Y~Iw0;ZG+OIra
zaT@5Z#8M6D<c|7zZsdP<u`8RmFZL?>S@V4E`VoJ?i6Qc5f+S%a0Cm34p5)xYTDsCz
z?lWxmbApn7u&8YCtWCGQ{fqLAm$X&zA3%bDjYx1XW9V@>>qprcapn<)y#!T`)V_R7
z?O*xHz0?<<%@^yoGSBwGU4Ul9sgI2nG(tt&x54W2a@W!?yhUB`Lq2K718shd$w!CJ
zH-~B%w2lmC{i5U~C6XUD)!)dMe^Ti@h=DMr1p3aanq5$^Xz9;n0vZ-h0F8W|aDYS-
zZ>1;80KyaS%ePLK&Z-6f4$zwkIoaf$59$F>z3^QGe_RbCu4&2c((`f!?6GwF*#L|N
zT!Yd*Z@tS)$3389vLZNdNcY^-BDz)QMZ@@S$Q#4AR1^V5=KMci|2EB);>7zL$}Gnb
zSGW#>HuoSs;#xvMA{+V1?pbl(W945fxCi^K9iBo_vlyyd*mySWd-3|$3#t#znZKsG
zl`M$qf8#k3Ki<z;zknjtv;qMHrhKd9rV6K80o^b-G_*y>ittNc`5QjhHxktaS_Lok
zCcpex%}ypxEm?H(BNr0@#7W@8zX-jM^3KpFRe&Ne8#@qdPBAvvU=Ob=Hc~guwwEO2
z69vZGnBl+Z+ZtpHP&WWXCtERk_wFAMJtg%Y5M5<X8#otKfOEmz$J;HVp)#O0lWlBg
zwfYzAmPST4-8ZMC?Nnk?C8BEi?F-*xk759a_B;SID+@luw<z_AZ@2?C$OvZ{pT0Er
zUq1^U$T9B}=xKWO^{w*$-TpHzT8sLr{qDPjmoUIH{wREHGEcOp;bVXwjAuezGfrsD
zKCI2+h<~xx#TnpujIRS4s>WRd?~P$V0%LnODgppP*Bk2sohU>e8lQ-l<wH`LUm&l4
zIUa!N0-uJQ%oACtoKuyCF*eqv&l|Wsm>&qZn0dv^Ts`B}+w;;PEJsX2{wrd<yJ!0D
zulHD7*}$n5*QWZHe!i>^A6cr)(&_6ZQhncLoV_{*H~*EOu-p>XyhW8)E?uNyyybV)
z&7f18Kv~n0q1|A*X47&4dyN9b3f5CL)YUx&^#SNBbCt&N;>S{h7;)_p%<rx>hj&dr
z75sWe^6MVfXoGH@#J#|_nt}!ADiN7DWFGAHlsBM38`LNi^1t7j(2eJeFbFe>q#+!r
z5Y$nHPp&%t)-{Qz^z5q5J=cLSd<f^0J2_MEA00aO0&qH1RU%b5-hPSP_oRHuLA7CA
zh{CloHk;DcIx%6el~+U5j6<A3hVIeqg*^L=5q#k8Sg-$CREy&M99bQ*L|XRNQXL9x
zV(pyq^6CZ^-EMqJdMixI+rxr&yg&#XF)pdYpn2IpieWf*njx2O>;$)+?lY^@IQ<Xi
z-a8zw=-(HXNQgAiyOC(oBYKoc(}N(0o<#I$(MFwwAbJqJ1<}hW8NK&}=nR8kL~o-H
z#^f%){=Vlt=e_5>=iGb$@Qmj%_RQLA?Y-CM`zc?<#F3Vn2R$1q31qGeTMt!q)`X2+
z3)t^WzNc};DNWu*JvymYCQR_wb8D}A$t<83$DLy@<j?Xrg(YI7<7~<X#Is>Waddru
zQj<DC2uM(Zw<Q8h#*w4Z_|$Fvp%NfcvkU9l0y;4Ym|1(jP3zcPllw4N1D)n@(f;IJ
z1^TF+q$B)!=Gl!~bxl`ri5o_S#*i4vpT;(HhZug67x9~`Z=CNnMmc>oiZ#Ef;XC?p
z3}XwN<V+Vm<{Ny@xxX|oHi*7&*XC~`P-5l0B5_fPOJrau>*La)g#uJ4R?5r3i#2Pm
zpUQCcX_59FeMNd%+q}AOeg{;{1@vOxlh@kEHp?H5v+dKY%Q0*}b}tJx^bcabdRQb(
z?+!|NLp{5<M@@d@x8q{k-mX+I%xMimh8pjl<`-d1FSfam_PsVDAdfAb?P#Xdu70^&
zrGmS1@N*y{an>q3@)S_KV|91&ilUfAj1!mscLlA$t~}ok_|D@EpDjUn5(?$IL%06S
z8LNdF-iU|(v|U5*ZqIZ??Hw@z%pCLuNH4oRTmFtDOk0FPQI?@%*?SE&kRzJH6EtEL
z(YaR9nRI+?L-*(p(Jdqq-1XOGJHoXA!?D&8;5XqcNvaVdssy%toKu6#BuJY0q+5&r
zH>L6a)s63e<^S{1wR@5zVv32MVt-XYQqA&PIO}_6UWfWUSXX@N#cFF4lBd>@FTeU>
z$fg&Icy~<5<$CXf-EAK_N@K%{0(nLiKTO2%eX{C1a>+RUw;r6zK!9hv1PKQH#O(;T
ztRVEWr@!JoDjuWC4(02&2%&GMgJO8lKT)<se9NnQ6-qpkn491B_u$q(#|W;7H~dNJ
z$-kiS8f&#L0g)Ex3W<YYpFj8RA3vQTc)<MC9DZ7uu9?OFo6bai)8zFFK<!$4J*O%D
z^UP2aa1PCu3>>AG<rMrO+U<EhG`ag3v5)A|z;V3!WxA1^#f{$|a+SwtOrPE+KJGlD
zrT+PIw1%Mz!#}`mQ7B{KbFN)c`81^Zqw$}Iiqmn=4r@L+hNd7)?jdx^$#{ns3^)rN
zUe`6P8OP=56yD}*!o3BFeTv22&$n4-S{;I_94xaZSki8dy@akl+b^%Q4|Hdib_sJ`
z3OS6t4s({r#syi<^<PJG#-+ZbkD&kLNVKZFsw@-j!4d6Iz<LF18H7JK*Q0R-XEU>Y
zpzGfx#GYoL%!Esg<cH^6bk%8;pkv@vi1=jc<uj9RK4?8%zpQD!+mC?<MH7(tklUH{
z^I!if*T}yfYqpUSN7-}MF1%jY^=4Jlea>$+CamaH_F9I|5f5~UC0p3p8(w*{ZclH8
z0|FT4Cv1nYBe59X_wr2^%$Ti)OnrVi5+TJ#6|x_4RE2p4lAgLMp^R^+OTzO$f>zI+
zS?|fD?GQ>VbFU~OxnB~wi>=MV;c9axCtWBot5xxs_{1*Lspx{riDUO8Up=|#%%q6u
z%pNLIMWRCDPY;$K<o-MK>otpKTAL3G!lGeBmyd>LkE<f_rWm1c)C*+x8VmQsYxsM1
zg{eD;Q}+bgeIm1L8@vZfjC%k;n!rZJ&s`<BP3PRlJ>UI?nGk}P_9FNrq<YTZ(<@zO
zWKEt+rEF_M%RFQf5WloBr|~%aVc2oXbq(jAo&%?S3_Tmq2H^n?hYfO1e#bZIPO~3@
zq<_;Sv1O1EtN!<3?|)f@|GFUm)4vn{LH$1f@i}sJo@{50%y&{7mTmVSA76OMx~o-<
z*rgY_Q*aax557lGj5e9i1jG+9g|qf;wZ%|<Ld&lou=!AOQ$(I%8Y44Hivw~s-;RX%
z=IoV;-NY(qEx4SfxNb-(4a#xi0@>u2YrVW?<#J#>kiIM^F+uQ4JA^vB>r`~ej-Fs!
z*;tfWpO5V`6$<&_``b-XvRw#?V_$&ao|;k#`WipNAdfRv1-`A_Rz4QiWyj_Pt!I2S
zY22cM4Y#AmWwnfzF+iu#eCsmb+CAPC#{&|`MS4Uub%pn%6VoV+2}nZ(O+l4E)G7wN
zNpkXEn#x5lb#E;ic|;x)Xx5*iI~?dk=*L7K1n8W*4|$-wj4-*OiPP-R`nI?w@%B!x
ze}s+7?ZP+RJmi3JB}zER{&yJ6vt@tAVoKpS3u(?&^=Bw*CvrWKc?f4ixZNTZQ+1Nr
zSbU1OBX`;6hqMgzn8o|(<Qi|!*O|_FsTjx?gcq53o@&|AfrBD?5pbA36wJ|vJ+&g0
zN^27`JQ%SNfib4I_N*~rC#HdU6j@3<73w~9G74zut<)+Sq-5|Y;>yyravds^;Xg9z
z8g!5QH1lwvw?>x+^Xn#dz4mo)cg@G$E}K30Rb053(&M)&D)oAb9%qH|t397=LquXF
z%zm}MoD0c?ZF-}k_0W}j#`bF}DRyS1Y4Rr9<Uu(@Id>K6GPy$*-f;&abScB;%@!cC
zWX}(mIm=M%&5lg$83?{@y1<2Di@WVjwX!FdGqP;y7$491o0F}W{Jhu^*JS4Ri0`_h
z=dAK@>@n+aP7RtX(2v++xnsL~u1U1)q`L@*0oNWM-6?yAl<N-=Lfeoa&S9>*53|2O
zvtO(ne;5-X`||31n!MdTo6K5C?05(uef!OZ@j7#5jyap73Ul9Sej}LfcRYXDvTXZH
zRKR{lr}A>U196nmQiwNybbfsW1nQ*!7iGT7eEGhX96E8yQ#V&U)}=yW!UWTRQXbjZ
zSADVE91Vzqp3Xr)g8JPXYm6-X`E`mUI5@JpxM1!mcCaIU(WK7^pfb=PTgP6fWaIu-
zDK>Wmcbs^5uex|SY5;9g2;}KxH~f@->#<`ZuN3`2#f9!hDA9y7_6fyVW+%L$&f2g}
z$qlSm6;Hl3IVJv5#)og**{;A~7Qc*Xbc((eX7=fZqRDtk72r)lFp=Hn^KX{#eE1A-
zK2n))7moacHdoh$0PV&V%V%UL_{zSz#Nx+}7l3BYe&n|r10WWo0;P`2nEIghG$!!>
zxm8B(Hn&Hc>Tb?EUKg6w9N%*whlQ|cUDTEQ>{?j+D;!|ha!IClvnYRk;~q0!qscOQ
znGisVtzm6G1(*dB;n#RaQXr!0QzUX?@#Tdz^9E`0PB~8opH!Rt+BX?GLxs-`t!cIl
z`oe)5LlZ?FL7okB%gyf3QGZ#j9hL%siH@3nnl6->S7b4ws|*Hj7q)rI|CU)vQf?nn
zu;RGt*2zOnHIC{Zb9Wwp!Wj_x<1HV$UK(>7Df##<vkG4{l8(%TyExu#)XM8#P>e03
z=<&1lh#K{Fmx5!Hd?017csz4cCgd<&TeWKBi?GU<w9a~I{lT0eORL{nX59Y9&k74d
zhGf>=OaU?j{7{v`n83cYtLw`;<`6{5vg7KfJG@ukw;-s7kka8?u1Q>+ULl79Owavw
zswfp^<fLf6>&5_Vs7)FccuTG?XX(Q#qxbQf4eFkE*G0xhl1y^J+2H(;qK8~dVrDF^
z<9P}xL);kQ2XcTwKXb`-+mbV50&E<AP37)VL|4sn(#XByQgcaPOu4t}Tpp6%!0H*9
zUJ|gWXoJ8c-RFi2{UGiLr7{XU3vo&xrxb71*l0Vt2d~X;JGQq)d!<9CCzY*vsy@F!
z6uW@joeRfCtI^`G?8%Xy62UTJ*E6WpE&~yPh?4{7*Pjk|KgqidC!KMpbTk3^f$5?e
zZq-%g+cXh#{?(2?Yn`q>x8{|qt)|s`v0geG#HQ)W)z5#wdMR5tW?5CXeJxO($#M3O
zrtj;Dv~1*qyjK~y?J)D$jgElkB;v5Q_d&wd;m4PwY|q@<6PCn&-)oGNi<0I@9QS0*
zGIQq)TNAzdfEiO+sH`p#yfjzl+}ac81-ZYPq|=ydKlr4E!_l@4S<Gt3HE%||aEvO1
zxwjA4Slvw6_@uj7m~Cj|wm}_2#_n(AvMQ<4dno)|>D9~rYyGKY9PcAL>j0!m+&iKj
znyX+~dG6U44p0cS<CE7|Tjts5`^SuX+&!Y+qda}#s&9N)ICN`~IrJoYH1lb<fK%pm
z$Gp}n*$#bdSFm|0aONZnS1}(TjFXt`)JO8$*dxfts%uiYfBR794|i(Y*?aH5%<IpY
z3ND^x-Zh!XvK6l#EmdS|lp?8bYd2wyS53?gcUMq*wGzK;U3Clg{QZ>f?$?}}sD+nh
zRBipyUM%rIU@`W4+CWfSN)iEGl3WQn+~C#$76WOju)9gKAR|rNX2ZimgyDCj%8yvL
z)UOVa%{)SON<pmzE-&Sa$YGYCcecZu8~ppB#wEmjE@Hc7x>w!JRZy;TaB8u_V&q`2
z<vTT7lSuSC^NH|3MDE&V+$LB&`f;xr!^bpaUz_MBC9ZdK@!39fvJE-KcF1PemnIJ|
zkZWqWO6Kn@pbIJy?8(zn41q?or^W0@Y=3Z8eYjnTA*IV=quFV70=%{8;l1RKAjv|{
z%YhI5gX`lbOg-Y@%jhkXFCAxU*IkZ~_LH!&Z?_E!oTP*k)8!}~^J~Tl9oz)|;xCZh
zLnr)LV+-)On_X)4W_bVXbaFE4IOKS<TDYm*a_F_n`13QKCaCo9<w_bH4@mB!_=*zS
zP&I%u$XAaDT2$|J1y!x@8Z}OV)-zY<CHqKh4@;WJ{t`f6fy6F-+&3kU^hY?l^wey4
z_itd6@rjr1Cl5$Eol;)UgVYztdg-r!h+e?pPX@x8tO$L`z{%dpDtPpJ3A^uqeNUzB
zmDb~NP}*>br1<FDCuS(^)x_rpf|PB!rpFn;d#)bqZV>(bJO1DL`T|zi=4lxwBasg?
z)Q{{fA7z7avNSt|_bmVL&>nwh+e5g3i_vbx{zUoJYjSN-;CP+0f5nVF3xj7FUEQs;
zDt#cU#MRK)2x2KghyV)X>%VOQnO<Q;#b>NF#6Auu1i4HH#dCM}dh(oa04n;@IGWA<
zNL;+eiHG%?Sq#Odvd$4y14oXn*>eT8Xyq~UwR^0=7(UuznFqO(t8Vs>=<PF=Gx>Ab
zK07KrSm~mP{R(4hk%QD4PLsAByCuJU_g(<`^-eXZAMq`Jzk9o;)F7Wh!_~*(0f-y4
zE5dm_tsWLCwj5H?u;pvv4H~f<eCKjA@X?FiZcGzMPnk_fr>OTRA)pBthQ&b8$f`kX
zaj!wOmAwO3k~m+EQT30y8;*MH5un?U>EJ&kim<K@NHAkWkgN5q(7F3b@!`l0s6{|c
zNFQss$6I(H$2z&-6p=?sm>{idP6j!S%+=vL!)QSUt2H&)+X4bOSwD16qm8lxR`oQ}
zr{g<Q#*hG$zmtUBZ^*RbND5UavHJ{p{kaUhBzE1CB!p4d!n&j+TROL{#`krSrA$Q`
zK9FcuhdeO-y69HWJ<-bV(yIoIS=?wb0R?-@`WlD&b&uAtPoaZ~`5ftrCG{4(mmzu?
z*y5R8IYMf@+M$K0wfJea+8-jJwLDOkSY&zd_p-!)$E!ZNF(%g*t+N<hc)v<qZ(D}y
z@ieQ{IbG7#YgU8mcde(%3YYuS2v=;-k%0&#)Q|OcYR-taU?EqsOuFZ;;wKE5EE=+}
z5pj;l`8y(mueDJeXQ_9>mAVaW88}Mg#F`;{oe(5D-vb4U4O!fCRQ7KMF{hvkaC+@%
z#jtv*Tv+bI_`cGSIsHs~oP9xC1<#Mt^#?Soi^4ju$}~?5RDT%zYPjwiUpEq2um_qT
zz`ZwaE`c+m7wsDGk9Hz@L3sCVu3WRZP}7UBmj}4e&Wdos?uarD|5L8n`P4G`Xr*N(
zvEdJG_eRasW#QMiej`PSbsh>nX~7w$f1J7D{b)NH{>wUU;hP#M)CE1+bgcH{K+dH(
z!2bFu+qS8qE@?nL5N1Q$k{kl|tnhULf|oWhEZq;nyG9dsG~Ox~9}nMYFF+awwSF@R
zb=dWFXD3%~75CaaeF)q|?0~-gPXoID2pAIo8TePQw~auvcO_M|{vmqL3dIF|xp*%<
z=$q<VkMaClGE6|2d5|O1g$Pjfm>?t0@8H@aU=g#09lwOP^&-6=cwi8WtEhXw5Wb7b
zn<Wd@=5A(b`oYb6#P1}DY5Fd{%6=!wqG3ZsAV}mM1~3huv^KpnaMFEBc7b^K*E?ua
z_{!;=!e5R^e_oxGW8i_7PT-~0YeaCkG<fgXUrn0@sL!3AI%sTNK05@Q=-X4$!-Gq*
z*R5@F#i!xEBCwO$Es&-}@(U-SlQuM?JIcTAP^_y!d#HOT!v7??E4BFDgqFesqA<OK
z?EkQN4CJowm|MRy)=W1-INAg<Sh%<~?uWU;#Do(}VJCx;F7vH{sFpF(r#SQcNg<96
znG<HzlE(U)z-VrWL(zqRXKH=W%ZFIGeX_^+KSa`n>&}<dASLk>hBNog99ih~!eH_D
zW1b{@rx##)D|^utI}^f%j9ITL{@iyCp&iGhW-x5s#&;dL)KPnP<d`-eGrLi<J01J`
z;I2SBDZLD;66})i*f<tQpSz6^LgA&IzCIaxEb+LrbREH2o@n_lwo9^jRr>%aweH{&
z=PY{!A~WqbZq)~5e6}YYtJiLqW33)q@VG%69?3eo(#Q(J8H=tkrKms+X6h>fcW47&
zTzYBbn77iSy(}zg084NNoZP27vTF9rp6zIzAEmF@xuf*zAI(hwm6MXf@?^u?RP|w#
z*pa~<t*~Vc?PaT+Z)5AVfqKl5Dm$hWFgLrq7HKyV3<{PF*3nN^8G=Irf_R=ZY*^9K
z7DUteIbY?J+(SjO)(uWEI|j<!yF~}<5B<CM5q1OnJ$5Ejd^b3{Zk_F>n3Gi!vp?7e
zM=m@UXZ(N$d0ZSom+12BgN>k73ca`56VcOHwMdn1y@2{X+rpc>?&s_C2eaf1!;2bh
zf4Qi+P3l!$R+<?IS@PDNGq2Y6vbfU*Oxvxo9`X~Z&(~{d*nwCUp0!4`qIc^tw66bF
zLz~K|9n#Qo`;#(r$kF0sSV~c$pX9B|ZvrN2yt8t?4?T5pAu1}%^F1OA+VK@>T^=A?
zh^);-|Eh$eG%DstAh&S0cr3wn&m=VuC@0BovH6eaF`dzIt;s#|ZP%4(`W5Ol;uJFy
z%vS*$7opuI$C0c7*f?=BxrV}VVuRJn>ba;6?*)Dhri5%JecKWcY->KeXz0;rX1|2A
zGYPRx;ua^q^ZRt915j-X!{)Xh&j~|@YLcZV-dO0*z7kJ5ruK<{hHL?xg9qtHyqI93
zh{l_`OfhPkndvC~2-BXERmDskuz1^)@ru0C97EU|h&2|z`O&jG@Bgcwv2Vwar{iaZ
zU6-Z_3ix9v9u?d#XeT4RpsSNt-Ds6s&FpRa=r44fwo3Ywlnyp&po$!;az0Z<I{BL%
z7A=?B#I0v5;DH-jO!n56a%!A>uSKoZStM<2M9&hSqGbKse%%bx4%R&Lpxfy^sT$en
z)ynIWJmcY}DzyQs7d9E4+oE`s-&$64{^>nEF&ml4RMrw=)`Bh|RsD`kW%S{F8%?~B
z7MPr6Gi<HLyPX08GHU*YB2?<5T7VCIFEpHMF3YvoC)`E5pg^H3HKJMNL&H~c$01ik
zAN6VT@bY%&XZzEX*L0`CUY^=^iu%0r;dO=ef1lE;Ub$D?n0x*^lXq8MiNWV=wW<A5
z*f=VP<4}g_>2Qf?O|M9Vw3kjeM7MgVgl5j+bDGZ@+7&Q*&#GQDJFEi;BOpGnmeR(H
z&&nvN6?-<88ywoAK`v+Y#;Y^7@Ik@-as`D=OqsXxTs87icsuc%!hV*uA1>hr^UA5_
zTHf`5gxd>OXHg$l3F3&5e>;+WTQyCZwU3JK>Juq$a8u~0uPm>3XTLU}r#zSHYb-b`
zFXFpWyV!6AD8_>{KTbUqzP+?&BI0Z(R#Z&Wy79WCdnEk%#3n2uMeK=~x>ee~how1U
zeCb@dq+BfKxHC#F#<^@HcHP#j&4eRfBlcBd1=H~X;#uvta+H8nn>{ndbNL^ik>h*W
z>S=<hguz+2DoV5p_s0#k#fBJAk_gfad&GB+4RL2|k7utiQ0;4{C*yZyO*C4QpCgMK
zYJkq>)O2R=X?w-{GS|X~EPo~LIJHiZ*G~!1mA3c9I-`V@9|*^^Ahdu|^47@B=N6Km
zbPw{gCs*S(sJ~Dul2osZIL77HgtWHNXrwWv-`kgtFZKiv)Td+70;!YULGLtd7WaJ^
zmsF~GpCuf%6v>E7Q2C=9gxoSmj%syyUltrelzv{T%(V+_E4<Fvfmi+_7b}%`PMFo!
zq1A+47&^W=xv-J6S2)RMr!~;QcC|=SY)Jtq`DG)&rto0qdK)=ltce90IaB<D;-i~@
zZ*@sEK^at{$N3d|k-zU9_&a4AQPK&!6)>6<I_IcYv}%~hyNrCzK~Vi@eYFr2&#7Gv
zXtv81n*+2gN(eEw!ebh6e;|n}M6VuvvA_87=zR%a2P<uh1Zdn^U9>!AJ8h{TeU7%F
zm|gk|?@3)O?(q(aupLVj*k|&-0hs!q=Fi1ZOvY;NX>{A7apeNYVeg=t0z}Yo630SK
zT;q?N7L4g-wKt24-7Kj}h?pj;XuTFDr@-#{UBo~KOemwfE$i};#z8DLwG8WW=oCSh
z;_I42OnEe9DRINxv^Ms+?1j@XVITmpp!h?iQDq9quB0RG1F`wJ^Lg`(0pov&x&nOc
zjGoV6x{sNo{t%TngL3C@S)kJT>ox^3dxD8x$0cJH_Qr&|2v20;FfsfsZ$smB8gGln
zq_Irsj)e*l;TM6baw{P1nu9TuI`oJ?c9~`gN}3FB)wm#05|opUkBewv{J&aB`WHdn
zV!hd%olqx%c2tJ5sANr6m-IdEyK&osEAXE)U2UAzQ<XQq7yaRL=K4T3^=KldiC9Lv
zz*derxsCPq8(d5)Rb_16?_KssgaW5Dm7lC**QOR53L2fZXYhv5(0knN%W(HhTzb!-
zSiNID4|G{Vjj(3HW!9`EYYQkak$X;Wb!HnT)|QVEF_Yi3lCN-EsvCCgECb<Al^pOM
z`DHy?1V(zwvQcQ+xG!Tv8eD|{htI|j9YL!U+ql+$79vjfzy7*R2!PM#P<YIg9(G*V
zs~S!w;6{oKkM(weI{3n9a`$OfBOSDObO-bT_4N7ihsa>}de#ZeU*~(*Avm3qUyfzv
zMt9{_{+j34bjxAUaX8AvC@qBawUOT@Omp+T^vh-SqS1Rc8&O)BVMf_yk1&z#S+jZk
zdr)#T{0*$m*o-zlH~(Y<udM?2qd%@=cIi~)ke-9LY0i2XHkcaK5yrPIs$1=}HJy6P
z-9m)%H@Xfr6-cC-XD>spG&0TLJiYpvVT*HOP$t_Dxd}(;=%oCpoxuB(GQ}C@8V1?I
z3EL(b6Y4M6Jr)!i^oQ&@Da>^*T#lFJwbwd`ITD<~!UY;s0Q;3y^skK7f7kDPi-^nc
zj&xkEGxpeF8fVxUDL@GE<V50*N{YJ7f$U13e%4hpTFr;g#A#cvS$UhP<&cqI#3xd_
z%B61DzU!Ku&$;QVU-p@?;{;0E!Jfj-yDkNI%E2QyI5*DNRjN#MQbltbu6vXgDen>4
zYRcNwPJXEip4WCD>!2RB?rNyrW;kP*T3#Yea?-P|=x94!7()>Rls(SVOxk(bG`H7V
zLv9zT{$+t5b<J(zjSwN8haLJ&9$&5GEP^tYVqXPGRPjwN!KVwa7hEc-n1_e#las?F
zPMF$$0!D%^#8Qp@3DIoPp(&qgR5u0JlEA<Xk+C|&MVQ7Dtk8!&#HHo6P&M8Q0qS>*
zBJ}%D)Z5Drxf*PsHEk-n=(Nz`4QLvuH=LK^-Wt(dVKGH$?4Cq`<@PtJ^k2T$e_;dy
z^v~cw0TBqDwSyjsHig0u1XiKPoP{gs-TqKh@*)Dix6rm}oAgQGH~$Vs^Is{$UwY&Z
z5|V`3Nb?^)GHVpR4`~(iZT7x;n)8Rq404Ik=DF31V1b!)<NRfSQJ^n<N!7zy%AvxD
zb8+Z~!ewl4w%ez3-P~>7I^Zg+J}tw`mQ1hQgZrb5D&PO;^00O#jk!zQb~|b?Q1R7W
zK9D{eWKBTB_tY%`x0UQbkiHMOYFMv1rO2^;RK~~ix^MaiIXiofA_HO!F*$kg`81;O
z4xSRL7~o3;a{_cbh4tanpX^*I{7J1p*<8HzIWAx5?d$f{THB$j<FH)n$GN3%<o+Rg
zya>mW0Ug5pH+b7Okc|#K<_2PfS+%M^L@Zy(MNY#BH@&%V#wQP9mYr}W(Ut<3R(CJ=
zBXYDZ53Bg|94klnk5hqc=Y7tV93BvG6<EG`?ykUX)8=aeZ(KNrXRE4H1$;YL7SJMb
zi7#4X&t1;Ze^#dD6h;Lnu;iXtgES<mbTIRFO}GsRb^|)8K?v>z@=z)}@YJy)p5x`)
zocW*nq95`Qb?`YfyfXciDiL^dxhDS*MGS)cvEfrNs^ye^0C&Y_@NVzqEN~2eh&U0=
zkb^tc@M9eoxGN35#rH=#_6a#!j35G{n9^xPb+CvaZ&{y<_#IUlEj8gvr(24YkAL>u
zeW%=fzA5)V)@khYhrNKeUd)R;koSG%+b<Xor*Zg}A&Bx&?!sL3O~Jo<)p&m7(k9?l
zcDQFN%jkl9WgGT3KI~#W=JOD60n-}GB_kcnkX+}z&K<NNLlRF=?^jG6`Bhk&Di7_@
zO0dF8+UVd~62HM>I&GF!wfp^<_Y8o5VqkNo&bpe5XmIA?DON{+N~5*W96uI>2_RLC
z?pz0Z4*Vk!JD!hLLb)iWXFI@D+gl}Q>D0Pj*$&$m3+!KUW_tIdwFWcIW4!Jqb{lNI
z5<%fRcSbpPD!Z3s79=0tW32)F&LuWzwg>cMy{ufUaP-ZDq;i)Hg?Wu?{j66+8^&T*
z1)+(oCUjIXqDSUsdz{lL5~T^bM*icd5L{4Og|)LourmcheLzN@1VKwS$+lq_ALnS&
z`ZD1)Bj!U2OQbVRKyGl5sJooa%NeAr9MkrNq$e1zSA)X%i$Wh|qy-bDRqER{XnF*R
zZX;Km3!=()8VRh~{aMgKvCt>jRZP8CyDv++T1pRP+=tQhE3kld3)+}UGkYn7QS=ob
zg^@yFp`vL;C?7%OzXQ=#@&-iC8g<C%+FboUBnm~dfd=WZg_A_jJyJV7;9!j6i6W}>
zy_QKWrH$$8sh01eR{3(iQDd^HzPDm>1JgOx5?6e=v84%O3rTZb9M|_3?y`RkcuoIu
z996%3Z=(|NhC~5-r}-Eq0Z?PGKR}I=zu)U?79YHJGuy%akQ<9?v+`U&eliyd5vn~v
zI1VFbM~Zcyci#-U)#&W%>daI!)L`rW5Cx2=)PY>L92Liqh#)P!;Ggjpf+;l??k2q0
z>cq2TvNMpo<8cc%)x~{PT5pI}@6#&n8vo-vFS|=19jtW9Ep<rxmnfPD2!+F2MGMP#
z9wBR`1-uAG%H?Qm%uSjM&o}<u&_=hK?XDyu`L|*)zDCluWWG&~Gy4135YSew=zYvg
zZ=kx`B>da=M}}#;FJp{aVs53@AZuogt?l>qk_)B6x~#E#CX==}xffv18VyTtqtsWj
zFIN1n5_l8p_8`2+2=1e_;VprAHj;ItZ~U`UzvtAbOP-jtMTGptI$)ecV=!YcMHOv{
zfr$=5shIazU{UhZGmtj~V5o<i8DrUjj=M~u-eB%fuGMd&5}4S-u^m7?Vo2CYkv<m-
zR-W4EZZL<C0X*hvcWYj`+WdtIRfpZf@}vrxb>H*P%=@oJ8UeEE%gEfNjgyu&19Zum
zB=nnB-jpKgP@`{oZBnO`4F3ZYCjf+JC|U|0vVX$JuYpuD5O}nI7vD;g^<AVJnM&((
zYqpE+ho!&jSDW1xx^siUkI)T0Izz=sB}SfSmduRU4Ksywm1?Ugb7^KhHQs_u@cC{e
z&p6L)o5#Avz!F&$6_xUqH|@-8`H4Aim-Nw!iCESe9pkgr<ug%ekMgM9zO)nn<1<Mn
zw_3|IYYzEevEXb{TDn}a^drYydzcvfAxcm*f8_VaN&h{>OO&WI$Q$!VY!RKQLK$5<
z!Q1W}J!mc|aQ!?Q38C>%WAxr0KPFWl5!k1veV#1E9I}L0o9lMHeYJ9x_QkzJu>~M!
z2GHjAbVBfo$y~0@ja6EV)yKuNZ?MabZhMvSF^IoP&b<~HH>7=`xlm}$STC?%Q84xH
zWN&*rZ0SqMZhIqBkY+&chgX_I^%je0FXbm%VKkuZyXCKwW!8px2vbQ}Gh4orY^Y{2
z%t3lpQZBIG&~Q*tG&%5BO=MXy;wmmpmEmIX1YomlM@owMU6YN(Sqw8ul=_}6*azkF
zI(D=rNvF%Ar<E<)l1SJ>4kE9?q6Hq(1e#So0Nte!Fi#&|3l}5MWj8%=(^mh&AWKp1
zmy+6VW?C}cpiGvOU{D`+4AC4e-sf`*G$&;b*}mrd5b&K)9^oZ_lT@HYl+Sxu+ULYp
z5~?};WuzF*peM!5IGd~4vg(CP5f#3%7`W6&wDDqgHX^VA+Um<`!DsGrv`$t6H5%9y
zEeyP1A=g=|`AdTGCfXK>&XltcSDph9m<9gQ0ockH&b?=5+-5mTPh2wdGwUa*i@Xd=
zQ1=_!E^T{fTQ%Z>6XUZ8ktYRwr(<%?dVdBYC^rP$3uTB^N0x@|X`csQNdtj(#VV7}
zzv*>@N&&2-DsyT@?}_k9g>sfH)rxjumUrr<gOY-8pXYyqJCvDuP<%yx*)$0LEUQhf
zyFhe!z8*O^?-OyS88vWhk!xEp85HIp)m`$ay^&hE&1fP_LW_@AG6>?PXz?;$0hFu4
z$gkj%4E1$~RwDW)5CW$qGAg2xfg~8T#{LfPZ}$s~)6qP|i#z5_&lz!(2Pxa$wPBTM
zBuQG&etf-p%nUc!$OzI(N|L#1VJQi6pmViX`^P&UNwnly$~ZLCKobp)R~sEq6I_Jn
zwgSYHJR>SpK%b5=zUAYc?WT^X1APv=fWIg$e|WzCJC$Mjo&b=lAD^u+|8`&<CTiQ_
z*QjggNnr~e@JxmosSI75K0x+OkDu{_txY%T!8YPz7WUBJ+pGj9-$-q2+!zFReKizr
zd_&1D+bT5RgwM=vYMz_*+qn~g*>rM=58e!4aGFbWYMJ8(6AXUqluTA}vL|odHYd+`
z#9Ge<JO$?UcCOzZIenMC9hLF$hC@4NRYJ#z>g|W)43l*X&HdS~|6$a{e>%@w^B+9b
zf9Y}0{lLw)-m{F9VK2Zv(qll5vRQ?iankQZ3!Nx6-#I*A4NkS-2wrjaV6gs)6UOvP
z-?47a*Wcg9@cdIdy3f#awUp}j^vd;qHj2jy1(?#gAcC)AX4(is&-Z++6E-6FzFwFx
zmRcqep%P}}olV-uLK<`VB}_x)3SD<iy_DwLy`pt|HHHbqcqUl@fCfb!C{|*Y8*i3Y
zjf$RpxloDH<iK`Q2cDaE)G58s&Yt)4ZLLHrB7nfs81xKC!TtAq?(R&*P#@I#)Zfiu
zzfhP-!b~YC%QqW2*>q5dHHpVw=`x|hc@#}e!$Q1nMa@{h{ibZy`j|7|#|_mN%pR|g
zDfzJT2h6yRZBxV3l1AE<Uu@eYRrwRfwiI3bbOzzQgGwb4ce;0IUZ%C{(Q*?TL<%88
z!$(I?n1&E!Gf}^~_7CN0zT+l4LB5&KTn_?-+`_qr#))VYRyd;?e`_MPrPGM;>O@?n
z*(%!6A7~~8wKUZlLLfH?Y|H7_@G{4XC9EE=UHyiJC~7e~3%CgS&u{f3tB7Napl#3~
z^vps13^jr4bM<y$E^GG}?OGPzft|_$w`u>AE(q*5aaddicDKcZZ5#Sgd!Dr8woI|{
zV7$`M_-3RM68_Y4sv9~cephabg>*n?6;;SA!*W@D2Tt{eXi_iUee}qoM_n*Whr3Gt
zxJhoh!42Tv?Y`!}*K__iyb>=qF%x4$F~+$as_<!?L;J?{WXwg#Te6DEA>1*MM*Phc
zKXMM#&^y1od`#^IB(a#{%b+on=hQ7sn^wSVBDsr`zyEl|mwnO;Ad8+7wQqQFr11u>
z)=aQr7E{(C;@U6_A;{X3=3m*76A2{d=4$Xv-=K$EAIxR#MtsLt`s%LtNfI`5g_P~q
zP+K!wvYP;GvaMgfjo<=3vQ@W8V7Dv=f)X*;Y@YA^<h^;AcCftu5IV)+Jh@Pe9rw`5
zXLOvdqtMO#V3htS1dG5M&4e9SMZ7*;448e%6`6ggFZ7#uV;FIgMR8t|ox|BwQI7_@
z*5U>wm!bKJlWX2Gmb+1|{7XN1F;07PQ@@E>&(@eB?v@y@L3$etUFO=ZXOp;jV9q>K
zk9#4Zz7pWy>g(_R8>WT$&(J@Ca1n$Wm;4xO8tCdk4~tuQ^DUKf$ZN7@l0)9XK2VwY
zeY9hNIw?2OL9Z8H8O46^1XmS#OuG*`r5rhTB!ofW1V%?ZH>OOk;Ov;u52a{#OpVL?
zmdUTK(er+da3t$`l7{Suw{3X?$oIHM13=mdcx%&TzP+qDMLd;rC!7Xq9<F#0hurpw
z^?%^t;bHx?p-y>eay*WbLGW?NE$6bzyzt#lC2k_(Re%qDw!)#yiQrf`CLx?A$n|R2
z&ON0P04=kLK|=jyykM1|YT|t5$MZX-^52QfBS^X5n`Sm4XYf?Hose?9)|u<xPsU^n
zEiu%iC7GoSm44G-#N(YG@8ktf%=AZ6R0~y#q<B}$5czogn`1-g4jTcy&NK($dG<}y
zoayJL3ZZ6M%Yy`5S0?`EpqQkKhpQ%kv~gdKd?5Xe@9dXav^KtZ7goPMWU(ziErpw>
zIvgnCikhw=jo*?}Ja9LsIn7=dW^#*WV3=?JL>JTJxZHMboB~_`MC3y=|DQuW%R>a!
z$N$&2QpC$0cBbz=0pJ&ZEgsK@1qxL{EJ*X3!SRiSgGRn?QP_E)%^q%3MfAm0#*d*$
ztcEa;KIm&UOY4_P5VvfYenaB<@K-pz-{5=|A=^*?2A2Q%5Yk)f>V)HXg4SoS>==tG
zY<d^Pnx)YIBXx~<91p)#8g;6hRHE_`hY?n)8!_NXu*VzDrC-B!5w55@%{9?kizh8c
zdF4Iiu4wd=PPTps^DutYar^a~yMYX(7l=nL6P=(@geznx5F-`#BsJd&jqUF_epv)u
zV&sbHOFZ>y(H|nqbTmWS<eWq}|Gv*dF~I{$G6A7jy{$Wy)z25qO*RXDKpT_`eY>IM
zB~|uz2p|I1wmmQLD9hmfEJQIx)CtFkzXmoF9|=A8AnO|2RLxBcO_pA3i0k^RRU)Fa
zYckQwxuz5Ajsrj0MZ>A{epA04M>j{8(A<aSuJZLaQo;ra9NxTG%XTTV=cXNuf~f^}
zx!f`uDkI)z$;{F<gY2?@=!KjbrH4qW=Da4azyAdKj#@Nb@K%=X5Ax-(fm=#?*|s*t
z!XH-MIn6{XX>8|15)f@OXm|_xY=3Z7Id80*f<mH(SxguqcJud;I@WS&$}Y&dwP4w|
z#anRuT6(YyLynQ*59Ux<EY`XEKKYt%y~f<f&4Fn{LDZQausOZVq2qPs%xr^+-LO)7
z=ktT_vTJ*&n_V(~e35hvPxHKL<e$I7=Bw&PCNZ!w{P3B$ae7ZL8)n+!9m>}h(VPSi
zmAQjRo|Hd2d2jMUKQrb6O_au(F)i5C_uA*sRz>Xv{A_5zGcl9s0(~6^_BZ-Xj+bli
z<Hf3a0Ze3_rRU5;+rcHjUj$;NcipYkI?7t!xiwk=GS8&qmij>U&Uhd9`?6KO3DA7f
z%Jp`;h&U(B(k~9|NbQ>qv1%@npKr$wDbdwwB)mPw(b){0OTj7)Px#Nu3$6<(bOWMy
z-#xm#t#JeA=_5Fo{U9MS+dYkG`=Lqur>WF(m!$?*R9vZP>!3=8|8-=?<p|2MP2INP
zj^TQDIlHNI-3TRYdNAW%ej#!bY7`U$xvrYsXF@H&uvp_7g>kx-p1|4|JHyG4wYc&F
zW>6^?Q~k~Fn3%fxUMYeOsG>nYbdnXyTWuI!2O-17Z14&QGA*%)7<Y^oNtBA-4J*`R
z=Kb-x=s+&InBI(M+TMFNca?IbicHiJ<VXu5fKK>aH60+nBilWxYjwUyflT%7bv|j;
zQOjX&%2xHMu#n|^<!45NGDhOOFzX!+vq3Pk^3~JsudAKD6E}D~Df>>G@RdnvZNuab
zQI-uBBt?zBx1S%X>8FMnNPm-XD-2?}zoq}Q2(!Un#S-87)dwjO2r#hakfqM2#q%DB
zHx+gMPv2Vv__JS^_nsEjxLWLRo1HYHBpDdw(p6IwHWHGN*1?(CXP!`JMbh<E7DTYj
z?RZ0k00|_Y=J&2VXMLa)$>sDPjS&^~euQ)UifsD;P7vrK4#aDa^idvc?nPF*6$??Q
zgoPir=wT_4O_pX$rrWn&^>~^*+jHVXF2kYkjN<}ESW5ce7ge@HHtYE?x=1H$nD3*3
zBoxI1s3*6aaf0Y+s@g}8@t(-PAR*p%s5p#tibLH+_i=pKFh^vK8_qoVHaG8NqKI+0
z0<^I;NQSTj>QY?jNjaZLkB2GptD6bq_AMKVOWY2>-XDztb!kh1A^lgPDzg<+P;?Y4
z@_SD95V>x`yv;9xEw10Fe0e;A%J^}Fad{y^KNeY@=iytHWxS$I<H|`2H|Q^~PwI57
zeg`75_OFRwQ<-Yx^#?381xi$EFWK*W48xY8W;+j`NPpKt--nvHveib&SzOea0E6@v
z5~(IQqy4Vq_EH%leSORPOwBP*nsi7`z6QATwK!I*RlZ~j`Li@|nI<O2!QYAV$9>@-
zsq?c_LZ73xsNJh2<rEo9o}@#8GrjW$8dM$15ZA{<^#L2JK-y#0Qj(<ec{Fip9{V;!
z(9?@`I@@Nz#%+zmZr7bg@2vA_ad#)P3xaV-EO@Ujz{Me^8sR*&e;diClO)og{Z_|6
zXHQm!R!|a1m7JShS>yn>Jvk*vB*Qoky4eD?HRYp(qy{tNvjdIOuv$ohO!c^A@l+9c
z$(xFgj6WCf6pD0rzO)R=2NjnL{w=m9u)xZ%z4g6~#hA9+v(dXQfu#$o+pb67dOidy
zoKCtT9IL7WH!1iP9bXzb`)BiIp|cI>YrV^-j>?~B`)M<`S(}VbgMww?m`0f~<P(;x
zB)y$LA8{;RQ)#3^0^17NA!AP(vx^X~MLEdWC`@aR6!RwN@3Jo!7TN+yZ_&HErI>oX
zc2-EdN^0t}goLp_L;-lM?K|J<q)0QwR;t7+Yd_P+KH|H)@ZrpT>LqxmQ)@9|sm~21
zg8ot7?5HTV{)=&&-}A#OvItI^7GOBkS}7TB25k}dN_2-d4K4LErB(I;@XnIlW$$c5
z<p-qmSIT`Haar>L5!8h#AgDf~E@R4Cr1XV>$Y2BC5MB%;xlcdFkU&Oigi_2~IXDjE
zVz|$CSi<YdB9Xs|DJ^YpOSSi2xf)3o%zmT~tm=`iY3zo}v{&L!fwF(zXkclm<npH{
z9^GP*cCG?N7})hGNMBunf*8At_W@%Oc3*7#nCjUu+o(Vi52^h%m~Tbq&#%4Rt55W2
zQAIch)1YVX6n>s`tQi`l#e(9*x3?wA%#3rnIxQ3F4?<hpsIJ2{Vd~*U#@2L~mz^m<
zmY03j^(-5%kA7Yu*aiosWW{RXJ6z&2j5S}@VyyMf=~rBFEvX&(JUaM$c6&HOP9>Qo
zC_*$;X>T(1DFxNTfZaU?L}wG#>MmX$SLPtYQ5`YM)0HFdGk2na_ZZrXyx!=aHAPaF
z=s2hGif@s8f_n}*6M{Du3Km3(f1$k)iJ7OF{t%jb-8x+=z511t3biX#%a?Y%Bz^9R
zs?L%X!LNb0)J2xxn)cR!`2AOk^M<3dsMy7cV+B*?*02|6og<&8{<DVA+SH{pv0aCu
zJcfnpLXIQ^d?$U;AQv^<vh5egs2r_tFU0a%PWJ)Imn)HS!Qi!|YiaN<6)#2Pz5A<E
z>uPnzP3OfLEVZ|3E8qYjIJ@TAxKmCW^)?f83`==12N0d_Rh|V_qN$)}g&C~S+^{Fk
zSqXZ?P2>3!E|gxbho|w!IJD}!z|Y}rgT3`<y&n7Z@qK(5!J?{O8LTV1)BBQgjzW=#
zZI|3yvW1Wc%CyF$ohGcq-uiR4%Sc&>URA{E&?@aT^T3acsFC9vzK!(*Bn$r#H){Te
zvNv!l{*V2g86N2xNo~bS(>Pksl64LKtjc(BBGEf~zJ`?4iNy_T_(iJ2mmjZ#o7h&w
zn6Hn?i8Mx|(F~XFy-|5l6+EzK)!*BjTOW|%iP}W^a>HA+<z&2BaeA(1bJL`1hJT1c
z4hM^NWcVqs7(Qy1#S-6@o<CF)Zyc;i;2MRO&oLj8`RD!ON<C3^YcyRzAT;PCn{|sJ
z(>)7==~Q@2H2@pxpF&qUwU4f%KrmM6)Gx&iA8h!kxBTm-!^sT-a^9B{R|8T&@<kbc
zHM~6-_G7&?`90wCA0jfPgFx0UG1EDXc3JH?q4uULc=bU$OkE?kGRrQn?dnN=z6tsP
zn<Dy=-J2J){?E7F;Hq~JjGr@yRM5xqF$+6w!%oQ!6Q={P<n~%_|2@8bN?gPW|F^XZ
zcUAcgh`$i$zjCC$uFQ7bwiQn`SL}d^{J7yO=q>-vOO@%NX&YL!X=gorXlKroDTtmI
zx{%Pd{US0QYC#@$Ot&$28Lu_+!Hp66fji{pod2Cf%*d0Mgi$xgOr@h+GYdp><>&NB
z_q6H}cFeMJ2I{-fqX!z9yKrlKU8;A)R|Mx~aXcI}894R(8$izd-z(9;Lc)_+^S{a^
zZpXJeG9VF`>?Q7S|7sXYPfj4u*F5Ro9q@mrOtUq*>)r`LJI^h(W~Zy{lGGq>^Br8V
zxS;SW=DT0nNf;e~3e2d&7%ha%V_jC}{({Z4aJla#xm@BdqvES7Jxz(51`Z)E*Yw(S
z2|~!mkJfbJYc5rSE$kF`H>Y~Xue?Xel9SZToWpBi-P?0U4O^-L3D<79R>e7Ho4K1$
zpOic5E2@pRY()L^Wx@Gl$b((iNI{JX{reks$Ee@gA-jEDK%jSrLHt%sx0bK*1bd3B
z)XDGxQQb@~Y^)8snq3+X*&nnpJ&kT`lbroHi`8+un~JvSDYp~wYHAzVF4bQvHWB^&
z25`bo$Lyw(%QM@~1c@0~aFfRu?|bCA6Nk#K)+0Uz57vHjv9~ODv7vmngSx12SDH~t
zISFaL6`tSCvYVx>5hW4b&xlc^OYGI!2BueK$VuCph^>8T!tpB`Su?H@+Oi|L-b0ig
z(kUsHDKFd*pW1wv$a$yDHxZ{br)cjPvx&m3k*CW@c<vEC;ux%mzebt;|K{iUNIUdu
z$CBs5O*OF#pGJ_jhSI@rHuNh)LqCTn-41oTJ}c;D(UcnbAswsN9|0%#_JYrCq21eT
z3$0rhvT6d+1J<=Uan1Pd(#FwG+!}($h&7>C=T2`8nn+;{=l>A3LeW%hS1|n_8riE*
z0@On3lq~VOB{MBf#2BUI5{au4Ivma>UH|U=5b|gEpQRB*YLjg$o%S~Qdc(H1!l2!+
z&EvJUr09;TFDklQNu+fYIU^*AqhW|lt1slU*BkU6;}*7q+I-J7;tapwy0lBNabNXI
zM7!;c?OqEV?!22NA+Sl>A0bv_Fy!lSAO_eS_15z#fUUJPvJ4{&yR7Zm2_rr-6*WD=
ze$pSKlx0%bzJop_I5Tn_m(VG(H%MX%pq{}e-iLgj_Kc746~`Onk~6L4n84aQ)o5ol
z`H=C(4q<O%HG9s@ub?Z><nCLiE)_yb(_9#IHlb<n8g`37tqtEXhhRG)*e9mPBsh0)
z_v2|gy88|qJ41%6>tMaGeK9=*&s1P!Roj_HFmISH3gpSOPt-MHO@SB;Y%jG#nem$2
z90Va;aEUQ4$e>0?UvSIZ+ML(_@|U!btS|J$rHEBk0(~2S3@AJ9&s+x;3VDe?L|mX)
zbM++{bH^W|FAhO)Y-Td>72PI2lFn=@()c$+RKyDh;i>2d?;BabbcQ$(o_rzyy%|C%
zgZ|HqB?&TtQXD~UMZ(EN8@Q%7?XyvPLuFrjZp2?&ca){3v^|MKeDWps{h40Y)#h+R
z6_fs+@%l&CyiXZ*$cB4i*ut<I;T*&CRoBUkzebSL?C<{r&(q*hu*1$q>a!DfF|lDg
zJwi-L)R_E9Q$UG>py6v_KAaD`*3U`)W^!lKp>Vhel-8F4CNdAf(^5Ud*=}F{j)aig
zx({$p*Y<Fb$cH|N&^fP^$l|!18^|I&^bTq%hQQrcTsQlIMouqv81tGxRiD%pn@n*d
zyI?<o=iBZ%h`>e7BXGR%PQ+#JyQk@RX)n_E-h3R5_Jv;LaUW5f7dxiEU)2&-8o2ao
zda=<kyq5;9hJ@fa4%gLu&IL}k>eYIsA6b(Wd-g)N_R57;OfUEXwM1EbNBTIQQv5-{
zX|&u;TMC$$QjIcFjTfV1;U{&uv%I^o@=CS)jfm(+H6&v_MEdukJ~AwGKGH3$6a#p=
ztj!aW_hxpvlbfAeTw|QUB4JlIG*d3G@GU^b>keZ4K`{KaulOf%6K{|S<}qrcvtbm}
zo&n`qO0T|i_e8O9JXPj}SaXD>7v}xl&T#(QaEF}(=g*#x^TDdptmpF>I8M%)#zMbs
zb&*f-VbuLl$J`yz>-`1IU)c<oLs@am$Ea0{{MW9syu0c%3#TOvH>blkcBxC8I-SxD
z@K*uqU^IFWvz-kCy&GNr5bbnUW$6Q?C0T}}e`O6KkFds9=KJ5*a~3NWtg!Nz878|M
zDOFwh;onDIjTmhTXu@iyPb_H<Zfw-+&l`)V*9JeVP?a?9LUEv$P#>FSgF&o+QQDd!
zu8=nO)_L!WOi_;cfm7t#Z#V_KMUuddv%x%fK=QafR@%Mz5$y!zHfuw!HW->3?IYlG
zk~4@PzY^a^K&$?q`5n3Z9d5TZK?$qi?m%1@RD1-7;6M;e`a#)gbhfi=4qhL-R<n9>
z&nUgGDeX4gOmhBHM<K3ZgP!?Dt<@(&m8x-H_z4+IT9>#Nmn~4%CuesRa@tfRmuqqz
z-xM`%DA}{7FqDsj?m*v|og&~ClHIPjj10cWWA8}3?O?qW$P4Yg!HZsnP>Zr<z3V)H
zZX?<NYMV`Iq=>l552dGla&V88oDk3W9g5X(xEgs>&<3vRrqf9S^;G>rN#<|DFvh!!
z;g*Ns6Eb+fNFBxrJ5<awwDppYJZBUMVhfCi8-^#`9a8B}aEQ4H>I1s%KSbfa0u$g&
zNYyhrCNJXJZ^@;P>jTnaTNm6uCVyQ5W!GLP76huyTy7P$Rm_+%WqFT)c*4_<ASK(r
z<IoCGO0rkD^b9`oV;?Y#5pU@eS3-}4FiG~d>I02~q_a`9CO6@@p&yDzzM0aE8No-$
zAt&CpLIjqLxzuKO>lpJP0o<B4(PJ*FKfSqGAuR8+h1@Dmz$XmE_HX2$K#beX;xRKp
zm)Hq#@Q7jDQFA^(oPM55>3O+r);4@|y=pLh%`|Kq%(o2nHh=i`XCB$6Qs+nzv<Gji
zs;BrvB%c7E4f;b=x5n#YD?j~sqkaC4*ysYZA0LUzgT4`(NcyD{Clta+87l=0C_sJN
z*%0*Tv=(m8V;3jA6_Rv8y#ak7d}@n*ct{|dn3L9RH>J~kxhnbuzOk?CPas>G^Dw7q
z>Uj4K45Xj%D+G<?9WrR1Z=J_JGv6G8JO3eKKfc^_`VDHfhGS&#6~H-zZG{6kTb=u+
z=&l3(%IcTaAV6tXK?6IZ05A5H22Y(sKd1iA7v!h!;3tj#V48nn)g^JgKqvMBLf9%=
z(Jp4mbeR`^&iG>|eTksBt{Zb=N%(nBXQ-d9<JzS!GLe<JI8=o`VJf{`21}BR=?XG?
zC3Ve*9z>9w7=h`Q#tRY0YJ@&~@Yhku4HL+w=cEJMXXq}lqfV%xC*C}x8M^S-J)}u5
z@=gkn1Py%TbQ6W|*i0GWOQ07#)R&nuqLm;AH`t{+ErDCmd_v&)PcH`LHGpC5a1&S>
zX2UEAba%i<0h6Hn$XoD>qzq%8fl%1{?sXS__{LGLx>!~&k7WKVuN>UkVQt_v2iw0<
zcXD?{`$!xAbl{0%)1-FDzUXN+{IxRscN}tVwEw9?7MOp6=giqT|NJToQ|*ugo^{j6
zjI-z45;pvo_aCBA%vG?&+zB(6L#k~MdQ@*{9sF}Qd8_up5T>>$31c(moVXMDba0J(
zgpQkb^skxN!)==;LL`oSZ(HfJbgaYYO{0J`ZtKEZ_?+`~=qfSzh<$^30@?T3<rr^M
z`VVPc54#96NwqfRx(mV`8pPZ`Hw0F|Q`UC|W_z%Bnjj$T;Ipmx@Dl8MLnQG&;(pA*
z<mo5w(AVjIy%f6$V))&39CuUTIW})yQpo<rv*ka91eI|o++En?XuKH()#S+)=!q}i
zy#$-8CZ55-pIFC8Ze&vd{I~BIEcBq{G`cr%UL994hw8@`<4xy{K0_<X*MGjjJO_h#
z03cHTKZoIt>-*a!++Pnq!x^VCli({<G;>G{M!|@tK-j)bab0@1c#t;qEBFsl)Je-1
z-|6)7y4IT`ay-ivrJJa-$TdU8$c@w!*3~<rckzbUC3eK**|kXU(I$|s%>_CJVXBG#
zb{+o;C6Kku=HBn${(ST7LIlAu`(dT~4z5(San62Dzg>lPz$iLx(vj}#2y1C3Xvi-}
znha=Kzh`+oau2={e<EsKbsi>n+X}WRHwo^+^Go1i+kDz60xkr{v*n*0iQ~2m$cTC6
zZKzL*IN*XF99M;ujHakxj%j{q^rN^DO!Z8I(820yOo<(815V=&z3QK5yWF+^brkvr
zF~0k(3T6&gRBu$vi8q+-4+d~Nl}4*xNho)x)$FyY<=0?r+=Yb@tg6ttB?z|hW&dgD
z(*I!Zy~CQ^wte9sDhetnO`1^wL1`+W^w<CqktV%FrHc>|=^;@NkS-vgC?FsrQX*Yy
z=v6?9bO^ndgc1TNev`HLD%-ukd+*t2opYb>eCv-q;Z0s<<~!yXV~+BhWBh=`uz$sW
z*DVQL)c%Uk3y@IkO#!04q4EPl%%#R;rCIupCk9N1BrxtsvE3}Zuwk(y_0~J2*0-{}
zUg`y)37Y_L)yK%4jXpdKKSQfz_+`jpARCetA&1l8uwC78zIuOE8cu&s-`+66v?BEu
zay|ntL1I{u#x6CG`CGY5DaQEKiw_Yg(4HJ=+#nNCse1`W6K@Yt`07MU1k@T^2KL?V
zCcMMKQsRWA{zNZ%Ul9-n@GAjEB!)y1_AJo)I$J*=Q-01R?DtkIy0>W@`JywAQSa5s
zCbSlU{Bcs!yDxl<BlYMkmjoW_7m&kp5UVS1uchu!R-_HQMHOr@Nl=d9Dw|l<I2&wD
z!*G4Ofk0=QBS@z(e)qgnCImFrJAmAu>Q&9l62vE%-oG>32A)HRrn(Y|8iMBXe&nhU
zbAN1;gAG9&kC%bpMK!w3TIYc^X_x%ABa`sp5;qDfLzO{B2|DbsN#fOaF+01Gu?20v
z-6;PLi1aj+A_O3&q9O@W_v>cEbv{Ti8FRc`Mx{UpR)`j%pRsIGyy>ICzi4xj8d#C$
zVlmsjUTsp!yALu45W3Jd>`?@4G`51VD5MO=oAeSqgdmzo=>?|#p<et4U@0(#!6-+d
zG>z=Q>ip=pn&(4r^6e)V7;k~?6)6q_yX*Gy-*(r_d@F!oxL3`bfn2`4`>Hh!X@Fn+
zgsU$4Wq(!O*<Z!W4m$6P)C_x3+dx8p-rqpe3<C0gC=bs`<$Q(4C&DP7GwrG~%_8L&
zdaDh>a$!14*aw>ZF`e3?FxLFzm)j{Qpf(obgqC{Ar`sXwAodcsTO3yI1ynleX*#;<
z9Fot%m$Salk#7B45NOv$$o2#p3p-{A;h)&0<SnI1Tgn10-WA6mju8xR9HB|>Y_Ju^
z0lx?}$I@;b2Svsix3n{3k3$(`16ngNH!+8zk6#BL<#}^~pP9tsLCj|Ni~Xdpbg&IN
zptQDk^!i04O9O%;?$l1bgeH&aszlo^u_DbS=*{e5U#U;Jen1{1_P@FL#UvOVxXo#<
zI;cyr@6T@^Oe5a<QlMW<${L%sT;|>e`|DOefphW1SUICEFO-#g{m@*>9-7;SFa2l>
z2bt4kSm<O#IgdIMP$$;e+1&X(pDF0kw_hF%(g$=6!is_3q6*sofE2nddU)Tjh6f)z
z=Biyk*w;t%uMj0AkzFWk{`>Q>4DLm@O00z*G|AK}6_6Hy(spwyWvIJE|Bd==4UDl+
zgm0j*4mKPUD+}sX={cqs@nl5Qooj_wQJ8Y2To9#Mhko4>UT;MzvNB4W;-sm58K&5i
z(Bttakx+}eZFf7%8a2V{XL>@}nyIK<098-MT0;FsSOQdc_RNc-bgmaWY+z3@?cNNu
zeZiP{{c~pbaU3VRQeW({Fgut!m{3bCfJGzFHKF3L*?b8aYXi^`((OSFZT6AZ*K@=8
zQm&Zy9C6r6%n%|DQzQ0OkxIwfDa_%N`v?+%UiCB6f>r`xcqO20nxQ18_<CS6Fr}jL
z@qocnfePRnLU-7~DMFe%qSIR5o(3~Oj}`rZSi-hNDtG}%fCS8+@P8Ug0u0qa<pAmI
z>K!A#I{c^Wr_c;6eh{2gf>POWhtQ)ytEy5i{D3S1vrE~nCXoaMnrVuYBGWcO3kIOG
zF*)?sUDbcQy!6jwzy(o5@S?P;Rv6Ki;FyS4A3qhH<z8wUrg*+zYM~&;{a)#vSXSYy
z(IR{CnP>Ha5|S$netyV0v~4&^K=nCoACiY4QRmGtew2V5;d<&g)fJ_BA&l5OFZ4p4
zSe!FiZ+zv#qfZ`ebfk$L@EaV9#ov$^6ar^7pU~Jypl?=vJC`BJwX0?`$8<J4-Bk3%
zXvHBLpOX#Cb!R+YZM-7Rk@mn-aXB^=R^M7!0q&`E_;WXNi64+>5;s0qa9jx4wyU@p
z_WYPNd_CAZ<JhDrrRvq^(ey@!b+8x*vE&l~nr{ZS1%?Ki6uJgMYecUbAb~~t^cO9n
zjjjn<1}uT0v8Dl*VEgHkZoBlaLH;e8>_^@Qo3a&2eRScV2#xdnLLB+do1;=<2|5XG
z8bX78su7K5so}g3XA>wLdi3QH%ENCPigqYr@la~~qe7Zdhekc+op(R^f%`(po!)fO
zD0be9JyT4&D``{M(MOpsLb`qFUc=$T@SlV#g~o#>UIqTu-v!uyHJHY0;{@d8@8X*B
zkCzzH`9DWipZs?YQ-|A)uHsE2IAX@phejwSW|Ft@b({Skp3SPj&+lhbEU!*1I>lkt
zM9+ICByJu4lUgajTzNdzByB_U#8f`N4RH8>0++K#*vzl|teZN179Qy>Ww1R<0^29K
z6HB_4NHf&_=~|27uVMb8&0l=;i*WoU4FAIwg~2OZI9?69kCf8Tn|O#KOZYC$cU7an
zD<l0betE&Y@Os3SxeYOlYn9^Hc=Y&Nf{9K|cU;sn#~4hLM}%BNuv&ThK>L4k2h3Fe
z@7%eX|93X;zqyZo@wTV!!`ZxZZ@+|hOeF+PMAh0k5lt{8Rn`8lJ)`HIB`%2uSP5jS
z96Ed6om(g6bm?WYdD@g4iB<MvMjp}NC$qs8)WOA3Uw{*r*(4BZq2KXDDak(>!NNaX
zi<}Stj{8rp#yjS}hWOP~`*Ubvf*pKAyjD;Uw?N})513xnPPBCE$SdrK|0LO@2-(0)
zw2xzJ6AvTrkfO#l14l$&wSIDsB-%GUQr~^#V$+eC<ZExV8LYJA4VJL~=vl%2M__mr
zEWWpXd$Z;Tgssw{0C8xf-Qv-+!{kQZB$0$qea#8aSXB2uk=@BGD^Y+!>;QVW;_^Ts
z;oSQXQj|fs8a^QK&Kr#$%P-zBb6hHsBQ`=$EaG*i75r@ISGZ|0|LjF#Ut;@NiEsk*
zk{!Vn>MwU8`LVoAmbe6BL(<VPrgNXczMCfFLzdBzXD?z##M(MVHsJqg@%}kf{fp24
z?oa$h&fk5j|9{a!1b~%&PR}K9bUI4o4kKNCHM^ELALnU|Q9q`D%5DmvD_N5QM8kch
z3LNhcbd4q?nh{PVj$wl}_a?rhCbpEkxm07iHGMfzWNGV?LdE&o7aol6*(HXIU8!<}
z@KQdU^0#{T=PLIP&J$Iav44VZWpE<rPw@2E{_h1v*lS67w0-?{qf4qah1{5Wp>w1#
zk{!WRC_puuZ8@YP^V$5R@Uz+9D-|{xyiaStoNC$QdUHBCyS*RwpWK!+oBt;mNk7LI
z|4m!#uVH?V2LBhCv;Q9?afK_Xi6B8_AQiKf_)-k<BjMu*ka2$Hi$;&+_D?h(2}k<#
zz2P;eL*pmp!?(pmKm-?Lcc=WIKV7?w=6wIW!ESuSDRR-u{Mi}R$osRS%NwwLe2z0J
z`1YXnaJGF)cP~VH@HH!VRC<4M`$)86*y`<r=GxR_{Gkleu*2;H)jE!2oVnlc78(j-
zU*A=;@&kR#hp+1k9g7~5Lr@O$7<Q~Ab+0FeY1p_q4yMFNFz3o8-jimr??jzKSBW6+
zPB8B>p7Wfk?Q<z@Wgl6WGCr3dv(_B)6!FyUWQuyELPzxrnCqkK)V)Pq4SY}1pVf*R
zhl(hL>usV`+jN`w4qUU>bqgW`m`S460=htTacUeIvaMe*p7^{(Jbnz#WW<yumhIRn
z)h&Uc({*C8SZg?N=TqUivdH(nx!{24&tYmUU|;Tzh8@dak{|a@teagQ)X?uau_tKu
zlwR(2gO&?bw4pa;AM|xxvv1wn>!kiuOwFKXdbI!)XS+HK7sIs<Q`)`umbbZ;70}8#
z0{)a}+fLJ(|B_6_pONkOYm7fXgY*|o|Dx${3CDkxVHBZt$`w&q<%ubsaZpfcy6obi
zB3>`Cf(#zgo$fmg!^aROZ$sDGv}Vs=hpfQ`|1rhHZoUH2iZL8{a5x3wKQJ)Nt!5Qf
zLq2?1#pv}LZ3skG;4LGB(n<;#^VTHZAO+h^K>ODw#AC<3TwVk#8r1YI@XbrW#aFwW
zSuz>E!aSG`?3I<b--sm|0)xHI*0_3rbd~r%*X-mb9c!%|QnV-c*z1ylOYMghM~*kE
zkt05~q9jq@&`cFfNa0@W7#9gnxJl70D|%GqcA-SIFMpOWAQI(vE<SIVf0fYqB0;1B
zZ7tDvbpp4f>U=0^%uIsJTK$IDnmvCxIj>UYE~K6uz#F2%=vz}_BSl9IatFnopajQY
zyKzmX`}&{``9~GOqSE|mAs<UcE`ck00biu^;HPL!@LcFqv?XG%sk=?JXLd@K`TYlx
zxMA~K<6PF-q2C5XJXpdX9(Z;~A@pf@=5I*TUlFJDKf3>b`#wnhK(WfAC{h!Y_(`}L
zUGGHwj>mjgraMh-n&Xcn#3~iPf38ui^NL2+?bI@BN~M?p5G?{EXF9|#LF-)8KHWF&
zNpi}t=hPV)87@_qT9b`b;|o)lyr3qqaVq{$)TbdsjZc?tq+;|ZMWZqw+*47cm*Kgr
zG@ZAw(KQ;dG=*0mYhTpOM77h7<8Q_$oJts=^>dvJ&2k*U=cor-3O%&lJb>41KG$%G
zxv>Q6mU=&iWpD^*)ar0>V8w4TG{O>oTL4lsq-SrZ!}L5YQu?)p%e~O}Ou8oBu!o-9
zR5-O1?HKO!1CrlRg=V0@NFJk2Qf9j9W&W#n)<MEO%`&5r{PuL=EBu_h-_kwfwK)o*
zyelgDQW`Iob<gg@OTTN%qF*&HK_=rOiOrk0N+MgdiXwZ)`2&J(3(tEq7Ve|i&q?%c
zPN+UZL69i?O6?B_?`)b`$2v|{&`;0&`qz$J(T)tf@p-ocG~Qk}vL~toMMwQmaS;<v
z<DJz^v5VP8awtz<3-c=Gx3Q24dV7fXc#{xQ(=3Fc?$;I!-iOJ;$V&u+8uS29rRU1C
zmG`+{-WcZQzv5>%x>Nj`Kk_2IzfRV-Ug8|Q8e7@EC58fpGIM;vX5aa7f&B5^t{~yR
zy|D52iCY=~aqu|=y&c9#3$n*!iNVyTKOpv4Hd>z&KQ$G#XJJ6xPq3TVITtHAqQ=)P
zC`HPg6yqw4rjs{4q{*Og><P4leG3>cd&EdBqgX$HLBND4z%avg)Pe~US*dvO#<A1{
zHN3zJA*~l5Op8ZZQdZ9U5&%Lj4@O}p8||tmPguXPV@j~pP%#9^gvzYN-HFlaqX4-L
zeU3DlP*ZRr8&fok3Gpq_cE@w#JgkdFKxv-rhB%hT0};NyHCYhPcFN&5)o~+!Wbp;=
z<#eXY_Tv(VhfVt(cke&pzfWvHJE7iiScW!*`qIPcM*+2W_PD#<!pA;aCq2&Mx&Blv
zOYDwW#MJ{9jGq((#yu14U4J|A!xL_-BU720{DlAXmpkj3iY7JO;>C^*F7nr>LpF9B
zTvpb3V<IW5{Ve)@w!7fUVh7%lX8olEzb?Vg8wC(C^%>|IaU|OhNYbMd>i{>;y?rF8
zcR}w$as6th;!0z9!XVL{bk@@y1tTv3&;JvGa(<@j0lE<jr4m7XLikl})gGH6c>hs*
zTm)1Rj78xDhVVWLdUGg|q6fvdVE15W&BJNrC;&&oB-y4cNG?l9-|g*FZMOj<i=(IE
zfBzCdPyFE|F<cEuwBisn>2*FfZ)@)wvIsNf`PLeZ%WE`!VQlsXWThDP%QRN15Zjy}
zHc>J812Ud5Yb?C|mHcwG84BhMz$39JCiJ&*D0Nc^l)_Y{oZqZ^Fhe`M^X~x30&c&t
zb9)puI)HW!xsJBN`AmYZ0h|3YI-CSPz^zND{(yKl{eaXNe0!<A@p_YaF%!1RKT}1P
zKyt2(k=l0(6_7rG^Cx)Fs-s%*7m85yycv|CMu|?Dn4Njg(f|QU-92ICWlh?dXtdRe
zPYovE_gVikjR2w<^Q3A!dWTqEJNE)g*GKI<aRY+6;kP;D@63U<`STA5c*KUqQoPAg
zrDK05UdqnhMVchllm_xDnxMBX$OdX@H&9~(2EnobBV3%q0oM5MV~6iNUpeKs8ShtS
zX4m}^qqjp0;tnyezdyS!dWV(?70}<-@MFq?w7hTg=aohNnIy6}l6~cuW!a%?I&S9~
z(7!MEyV;!uXA-H&dKaF6-5H69U;i6#Fc8glmj5T-U_Jx9gOf_0fEmn5k_{AH0^tWl
zLttlYFp-J_QBm)NsFc4klkne|>6^*5twmZ3h*D`%Dp_eXHLzkj=o$&+(Y9Mpp}*d2
zoB9j&W);Vgn*h>Pj<+ZZn1B*H!Lk5SyN$L}A^ble*vK8?iLuf0lqP6jlPGEJS9hi<
z=k5(#nfx0=<Mw*l9tJGh1lVw!Bgh_5E;V{=1poIrOM`<o`v4#9+)WQSToPRG{(ayI
zFtCx?9-`(iOj^OT0X)aQkIk?nX}`$BFOTqdrelcFLR)Sv?5uCQ1Kr<dAw)U9QkA$3
z`Hd1_NdT2acjgPY2vEYwcWj55cP4Ry3aB2HNK&2nM_CD+a(63Z{wG-h)H_g$htvFi
z6$bE(N_k3Se-o88@NE%ZS5}GdIn}IvBaOM=Z8VL_1aeC_O(3#>>#V(NS3@L6_H8Yq
zT5x;xd?f--Y<WNd6+%7H{wOHPr25>J@!mwfPh`s<5V<AWRMBe#dDbsi=ULoBbolqF
zBD)IXT-XB#e%(oS-r4tj&nno+?=i>`tShgUdZc>NUsd&}m6Za^<tm1c>9g;cr=i4d
zU=JB1Z;%k<X1Wcyypf2DL6pND{H6!bf0G)Bd0jSH`+0SfCH)6Pzhn7fnH;5ba24Q1
zD=RK`7Cgq&(#Mum+Hb#jQ5a>c!B=y*dtd)mXfw9_3^)YENPUeSeS^!FXrQ77%-pV)
zg5tRr5vblz_j^_l{Hj$adj_;}Z%%smRE9vyM)By3aInK1M4rHVRdNf}XwvmF9b~#x
zWa8z%okK79-j#M*;E~xN=~dK7>A>G=b^o!55T+e7AWzIM!Ea3M<YD}q@%PVi_^)V3
zGafZbQh)q#KVsWfg#qtd!~D&7O(HPyAdQ=}p#0^{ILB**0>{HL|0S%ObeS!aq-aZk
z7Nm)5z{}UX=W0-ONA2nH^y2ImY#Lnst&!iEyblvM^wGUTD5jyIp^+hV4-b)cg++5U
zfqQL>4T7)3)C5-5FkS6^Tx+8s8`Lm|-cK3-0a-9;jX*Vx$P!?_79`(MWs_h&6}9R7
zu543PFQVAwrKv{4;dsbBCG&SroS&|5F3Kk_nDcfa?UL<@l5@R<o35o}UqVwN9)*85
zr1uSD_N1DGNQx>V3o~t7FLGp;WEotY%zYqs!~K<P7C2hQzdSFTjAd4u{j~)2R@XQ)
z#RM0OI!b!OxxC)aVo|eQOk=mZMLs=P)N)Gu)w<3eZ%$K#TKHZg%4NJt&geoXyNfW_
z;dV;iYn1JK0Mon9j%A!dF}b&`)mK1rOMB=v5I60lmUJ$Vo4l=&#cp1O^wgsUS@6v-
zw%-?+UA7UNTbM}M)8uGVPep@;ZCKfcC#X;z^`}&*7I{r@3n`Nv)i{DU?4G9;eCxAs
zMx%%I;>Q%xMXxhH8jrsd!k75S=SczM<(m{iC0@b-jQ1{w@LT1GbuGx`rDoV;6W(S0
zA<xh3b5lnjC>j&|Po)WX(Gtwd51CpSzxXh9<DyM-A}`h+!HT>_Rt-?#oSrr3L#BL|
zcU*qCvBrfOKTKitpq)BC3J{y0ZyS*U$GLt$ic<kfv?49!2jm8+rWVE9Qzn>g?vALv
zP~Wco87*!bsDGx9;Zr2@ZkEd@D@LhLliP!ldazB=J8<&64muUpo-lfrWSWq9wn@0(
zp;s?!JCXHC?d^=vXP?R)QSUmGK`XKC-wN&-L{lvB%D6D(VJG_(SQN(Y5vaVNd+2~$
zPa4ut=)<xW`JD9pOMTLVYw5Q`uRF#!W@y|Jmq@QhN)gJ_YT>)*P@;vJg3A+iwL-po
zzS>xJuz2wB9&Q)7vzfhI@vs9u-iv%tjvqv=)PSr;>y?(=s~J~Pmb4GmwBNig`Q0Ca
zNm)ocUsKO6n@%}mU>=^<Gz_~cDy=F!V3GyhnE3*FH_gP;{aWbokMHovM7$P`B&3j-
zAKFJM#XntIR61@_onvm?RxK>;o_sX?{Nu1Owg>u%=-&Hz!dl<AdzB&R1E>qsM3gK=
zrs7Line!+gLM5{Q>w~VoTPN-vIv=&?Tw_`uKf7We<`PMn%!TR%_84fz!czrm6OZ{!
z>?t^?GGM}|#MUmpDS0NT!7RPFk^ITifLN>yLE4eoQ4I;~)E5=JYVV9qPhrNh93s7K
zZtwrBadH>GKZ}RqiJ>d>El1j%O7Bx+|AXZV4T30lNGqe^zMhEJS*^rYV=FO-v@11j
zQ5|nShDv^agR|Y~7XlYRT2mtxP7p2-S84|YhvI~uI|h0P2!1Gv{{fjxKG&Q8X=Y*A
z)bQ*VJsX)Fb3x;3%f@^xu={kw`OY-IAu_JQq*0<sI|8=;pvlsRVDai=(mjXFyMhj*
z$CA*2gztj_#L7zO9ds2;_q_WOb?++}EFT=ZMV=mq?gF)K(T-nA^E}oEdHNR*CGC>$
zSCcMvxXU|u<%MU+XvCl_{R)gEG(XPF2g|TaS>=RHz;g&@a%Y=9UGcdg64L`ZlPO7_
zemNBy@(F>NZ10Ezx@WHv<yYM!(o!KwlACCN9^44!(QKY~QW0O|Lv5QIM~Dh)-ZOHY
z`4+dqE%HFxLnoa(XIP$EtM?&|lQT~y+<)ZU4#@whl;%;BQMBElK&0?&6m!h&9c9FY
zW?WjBLHj`o$`lnsQT1z-y8bKsZ5<+6j8Hq9l3OQpoSB$08#MRzqe{GW629CZ<vTiR
z?R?GcM?TZTwp1;^pOugQqva!@aujgtDu{F3Ekuc3ebvYuOA(N}v@~f}IQTL4^Wiob
z?fyKtvOzoS*uB^qu`x`DzVOY8gXO!{g`2#^H(7>44y8WImh9Ty`%SBry;e=(5U6{4
zAT#a6%Mc&thsvJCu`B!sZjf)ZQ?xs%^X=c?zCyS(Cpwfv*Lxcy!TEIIg@5~OIzS$r
zMe1c?{maf}x`&C#x^Q-8E{pf{(7jGOtJ1kIg>RTp;N6NojZz|QkZr-i167Kh&=Z9d
zX~RkZ(|c((oo<&u7&nwoMbgF^52+|omN_3%2Tse|Z+B+4N?z;8*Or^@;UMms*N?l4
zIHEj#1LuLe!}Ds>qUjxTBf8&&wx0*zGM3m!ffH!9NVoCp#Kw~Qd%30aHfs1Go7X%W
zIV3@r^FGx#KfmB}fq#8HTVY|5a+q+6*7N5njGs~<5E;nBGj+dLYx_ePQMw=Be~)ow
zi;QbNeH<PL>fDv7;b+XnOWXqU$?<Zo;Q`l*LsLYHX@YI4U$T2Z`8Z<*JrGWRL``2W
zcU^9;-jq94keX7|zZ{1jly69US#~Q?#Ny+gfO2OXepX_ThlX5-QMfRm5<UET9UC1b
z1^5Q<un!PhYu`YDc55s}8Tv2p3n%r`_FIwlkT85q)&zppWcJ&fv0#3zfq2}Lh!|mi
zLqEgSTk?z~`|1jYFNDOvbu`1QT>RUTgi;U0-TR?4$@!Z)qS`+7yuzY20(cR!5;Y4w
z*<W!A-M1H*<H~U~1+)$GmJGrVN0gdP+%`K1@h%0Ce;;ZNcBcI*SjjlhkRBk~|8cHp
z12!#&)$sqr8`o0F66h)clqAV{d?kQlPe|Up*_AJGXt>6E(#Z79o8Z@X?hxKppGjVZ
z#E2zSx?yGu|J<f;zs9rvTi!7VDB0m5QnEM0Xm+@WV0-Yi#78+^DQ=A%=12W}2i~d_
zk4^?{GukB;`l|;A9IiVO<7(ljryZ%L2w`7quadDQBovH8L$@P=v$Ov|;=NAx`UA$w
zDePD1rf#m%^D`&$a&J7UTinXgTy&rb;i&^HlaKC|FX))LtuN5vlCvV}>h?_6A3R7l
zbXbb82$Mc~``S@G`fqekbw_PvrelIu2P-mnG{KAC)E9CN0s31`Oe_{+=hxwZ`qQ>#
z0nhTFv4(eRNj08%LEGYG=!x)W1<dU3jN{()q3BC7iYDrJ&Q~vgUD2b*zABA^E*Ydo
ze-HXNr$Np$#Wa&)QF*dC+Q_nwVSB1)N}q7HW@Uv~7sX?g%3sfIL-Cp~oI7heV{tg(
zinn%^?y^W`He>$Oei=2REUq$v_b+3<0`2bus;vATkNS81E(6|cKv))y&s{`|AlX0+
z{#fbXHe^{)H`HKxPM9~oO~t8EOY{CZ<5mfbR0`)dMr>4YlI&0DEyv1D1~;w4tgeRZ
zInSB<n*@Y>n9&^#!>q$ErcHdCsqMCV)Zhk?e6W~loKFR#J4(WTVJ!T)D~o-Jf0jTT
zc+GRY#};p;x;Xiy$|zeMAA58z&UZ{`5kyE<d{F|uF6aa1tzuyXY{G?IPg>~$Uxx`E
z9ZGY9goHdYE++;R&m4Vy=7lpdZ}{;D`SBJjFT23_mP^<US=J7{`-9&?-;6p>I=R+x
zY=6SR!<2ZmTBM@-jaM#V#O{^w-9(fY`GURMSW)OA?WDVqI>8}%OT&vp=-Gz<xMZ&F
za|NHUeKQ}cR?J$FV@c?`Y*H_J%#Df*pq<!?iw>|1(0j&QP^+jgS?fD=#~{m}N<4NO
z)r}CGBgPJ|AQPR#(u%b;Q#xpgQ){Xn>)Og5LU;b4SAVlK|J~0FLMaZQ-tQQeQ90S&
zbf%VeI{tCF*ySoCo3Uw`+0P$Li!M1O6f8!sp@F|fDuJ>|ql4B^YuE6bZ&GY!r_7$#
zEe!yB8ds{%cl+=_xkB#S+wq=31pf+5@>V$|O4dooRV!>|bsn?}DpW*NAKU#6d1BNX
zR;m9@ur1!o@wiJgy(nl-RPxrx@}5z^&A6n|a6i<3k~2CJ?tZ?~F2%&weEewN)`=us
zetm$vWZ5Kr(FX|TT5_>f=%=l&sLi6ao^492-cb>|!ja3M=jJ)kko315h;9vA-%d)Q
zD39Vo4kKU8x?%gb-#mu)4@4Z6#C{Ai3t>pdBm+Ms&2O>HeoPEr?HLZFrl)f-r{0xQ
zhrOYs@TgbNC~dcU@@6gW;39vId(UH`D7Eg}Z*zwYi(U?v_g?`)M$d9%Y<abc_nk#5
z-vGs<V*QcoaAvQX{hBeXi=Y_vZ`lNr(&fi$YUQMfzMoX5`{&Q9A<m;cWp8INH};01
z+6U^$?n)DtC5vx166uH4QifQoB85E)UmhwoKk`KpZ$F$d17|_kRggAP++U;J-cv3W
zaVw9_W_%p*Av%s^opcOTE%5AP9??k;SRhCku55zhQ&M3!RZE4tw_qSFxEB|=uJ=nX
z-9N@D{>;D8KYD(*2QVQN8xX#xqeg+k)_MAP)nEk#Uszt!P?MbpT~U09?zKU)M>#JZ
zs#?IU4OZjH`Y6DQ1?VuC9V`%a7N1z-t*X;e5b8;r@0^xA)RYvXZ|O38T;}*p#3d+*
z+u_%seMPh&HaLmN8H64|lr-QKtq!}c1yoC=Nh0kcyp4e(-%D%<2zK31w1;TI0Bmdo
zTZpC}i8omD1x;PPF|31{In3v%!RXl}WnkJC!6=U5B#-b#kb6;Pl%VVZY%t+M8AaEW
zqaXZ$YzxX^W*9&>n-m(~0vSA8$La5A85n5^f;Ooc53hk8MxI0jpNA`ZjCz$TVg{zK
zzfSQ|EEes^UFPQtqOlWtpMeZOJ4xt6>3BTPHGCE=XrL#_3xT-D-)Y1<ta0-F36mzC
zTdQXuo%P6C*-sHCJ+%O4(tJKi-7UG5Gk5~;Ww(^ZSMjjqT*Q>iV5t%bQ-yts{T#65
zGKL9FWG++9rkw9yTpt#xmD3pRUcNKP#$r|{5Z3qN?HQk2io*2UUZi%y=9uOpIjN5n
zKHgSXaxC%Vkax^}Zdn1`g=(@BcMkMS6kG;f^A&v$w=JxV9u))R<H4K+VXAE85mE-B
zVT}2i6!WtY-Y*34q`TQXug407xn)qTClT`fDi>K`+!PQ43Gk%#|A4IDaDlfm?{pjL
z0HuQ!8i-<GCHy#PyM};OR012DhUFlrY{FPP#|#Lx^{#>R$e|5t9zcA*oX5U}Qe4AH
zZkVM+P~|yIj{*WZ6QI{J6j**g&CQ&2k!*$n(}Wg~F-(-xge&%*(Qo%o8^&;1h_IY+
zv%aR?-Md=%^Wa!b>}WJDcc%rc51hN~>NqT@f~g!o{l+b&piFn@RZ!UnJ%<#FoVLB5
zS_~`k{}+qh{bp+Xhv%Rpxo6L-(L-vAAL%PA6y{?GQvIXwQI}rUeIm^}+Y1D4X06ZG
zll!qNxJJ5#FB5S@s)%|{hg7KskNR_y{=OPsmiqD|GTmoBZqu35<DWyHACn|N>syja
z+NQ$7lWg8~EtziRNl@KhvCi+BNcHA1FSH_mY+$Tt0|**c+_JuT`ljsJku?{urMVvv
z2GEUIq)D#&Cu4*;Ug;>hjt-n)MenzwjwE_Ez&iqzSxkXjXYl#3M)Sv+0~+3(a2OJq
zTiWs9v1V|If(ppE?Hcy}V5wPt;f)f1SvZY!qDt{Xl=+H<mtDG%$^3;QflJvbYWE^M
z3_>fd?k-+#_3Q_kN8sNX!w6!u4V(G?CjU*-bk{+^nK2&=eroFcYh6Qw#>B$jCHcGL
zGn50}6gTE*SfIq<A~#<q_I!)Cuz>u><FCfFEKw>CS&x5y$DBQjX-g!XYF|<&K#3nn
z+T#c|injg5@9W+UnJE{vyc1w~JhqlMv!`1SHZzK6<qc*FAZ!Lx=p~?0_HdVXpw3_x
z=g4Q=uOT%^A=dV4lh%mE1@)I?LIjuot2*DAi?7+7?kvA}Q3cK*r!}mQ&PXf{j_Q%H
z1bQ{RQqtJ$RG@^|;)&w7eOqluU<w{N7kVDCK2ke=pz?_1C1@d=K|4G*u@1{daRoJ=
zP7o0Fo*ET_pGcAW)4WXdUHvSKCc}i_lA^mKk}LMh40rcV+bpG#Jy5+cAR_LxqqZfQ
z&!n^D;r{YePU@j;lRSGTC$TbZ(|gOuZH5ms+*^`8x(s1hs$-u#wl8YJ6uwWny_Ouh
zi}|^A+q4>Yz5KI|tmS<c5GR395mji*^k=8H7lsZPOkAvN9|UD4en6-xN`fQE3nbk!
z#P0iv{kbxw-$N6U<E+XUr#L)Lk?+b2)LUq!4n4l=`-B-6B=X9TVyVD!(r%Hb&R285
zYIVv?VO~l9;+EIfWaf+Ur7epSt{#{gECXsJu?QEAwQaQ_TH-5wM|r~8W@F=`->#Jx
zCdU|cwq)jd_z+(4vsF(?#z3ApKVcpz5m|+ghu4LZ&ID8=0=8FbL)~g%2Qll|Ljz4-
z?lJt@F)oGR_|K(q=c6ZBI38Shc!&;@g1rL|2N7qiUHDT?g28x}|C_Yo;rSxhp3|u{
zQfJHKbL-#qX-IvAx2@fNQF&LDs}<s1po|iv^<#?=OK#-zNTlzWe!zPY%&?21%4Se<
z%0c3N30b<eHU?k!NO?$o1`#ruyePZdjs6?$6a{Q|J}F36eEeoD>?lPM4+Z_DQdAsW
z=u!&izWDU-wTyZYd$;f%*S(Kq)vqewu0yC!$rU%KVIZW+i0Z{2JVnS3NK;FiFVSo0
zm)5wTrm&Lt)xh)o4R(dbNproz^u{}?TuL(pT~NfVf{DbcM~Wiw=xT^u>6pMtWim-h
z@}=|I%6jlUzpdSL>WLy_5XB7-T?!!E(|Su{Qa+-Zq0H+NjP4xuHbrL6b&oVo#3}RB
zA$^~aZ<+B2-HAW&Hl%edd~jwWtx9u%L7fVcISv@6*=?iVinc;-n*XX`l1c12RfS|b
zUMaET!ix$Yp8FW>n|=bj^D()C3%J&f?E&aqz37Bs={Kab2IK1eqEhlUtAj1peW$*}
z+HYyc>^{!ewzyBP(prnT_#>tfK{5m-SwSVtQ|KUW8(#{~*n;KL>`^?0FvMqU_|QzN
ze)Y?dB^pDdP&*GjG6ke$M&E*Z3(z{vfti|-v)w3xSvl(%g>%x;Wf$e{w{n}dJj~7i
z)S)3zdh`DCN6>ic9*B1eA-LfpYA@coC0Ugi&SHP$L;U-y?j|qi)ugJ$x1}~A;_^N1
zH86T(q#Pdf2QqP6n=ZPtsrxqOOUcWXIDMf=qo#TfdinyC25JbF-(HXNllva9#E$Q2
zx!g@*9}870ldy~{bCXm%m8PK6<m9pIs??cA4%U4R4c&)QQ8iRQnmDQheXN30mEbnv
zk{GaFE(A9l5X_E1xEyQ>IxP^UmVI;WYm({5Ri9OZX`$VW8&2VUonc&vvT{#}NQ%kg
zBW=?)7taS+gEdN|(nvBE?D(Te=t9JjB>A{|L(Q7|m6qzb*k?#1-tj7g14gj>WK7+0
z@};*8E(ffPKI}ao+~q&Bo7zPdcaNRGgjO7}Grs_GaeG58vfX`TFiQ{CZ5>aj+lxHc
zxgI&ObfozvC35W6_c4#-ajRi@vn3!z_7CB;)$ov!{pExrAM5a|2$5QDg`9cgn<<~n
z2jU4&ym_sdA6)P<$mlQ`%Q=#&BYmQzJ1D<<e0=+@YE3wg5%L;dKYDyYaJ6EXWi5H-
zz^tpr;dWWo-Ok<4Bc+~OHNeOu*jGs3KgJ6Bg`mfoU#HJeBgJ%%EA{VNUo$uo?(`I{
z+N)v}5OT&@mt^&6-COC_+*ZmzhS&e&;md!$iR&C;<FI%lEAWjW5a~=%%19%5wpS^!
zM<D{s>|jKPK)$=7{*I2fWCsrz$@2PK#@xim`b%N<kZf+^KLkQ!tx_vrsK~!ai9zUF
z#8?bP+SgWa_!2}K25|MkNm%tFTnfn@TH<gQy&en#*4e8*Y<Smn-8yfmdEs61M^(lm
z;}(i$8nq;Uqqr$xb8>#O!xLRa$pjvOhmheP9Ijv7QG>RDixe$%{-LZS=<r-3%Y*vV
z2XeyQ4=#mGv3Zs$TUso^ul4$%zLmI4VV`AIoR}rNmWJ&bsmoB|Tv0=C4Z3ikOTNX3
z(Uv@4tLuE6Rs2wlLIWH6l=_r&EJxNc7orOY2~^LNcihfzRcSZua*%eAyDXixsHPw;
zC-q3!>h8vF?oxBh<gPq9-HIe-Hl3qC&+vbBZ4iUB!8^2vDe=w6>A$*hzb6Utc#d;L
za4Bi+?inu*en;=4z3G6XGMb~WfA^mo3VI1RifD5fkE_?mu^^d}N!5LOXq`m{5ez$N
zIkhMn-Ek|5ND(F;#f`4pPtdK0GQHmtb-4gi<H2ft&)mdvmjxGh-8}zE{+#r>-ec?A
z{I~KZN#+?H^A$^pasSC+_`l|+U+tE^y+eQW{_czYA?oqp636?m{yhvMX$^B<ZEOJ=
zkiZ?)(o1o6qP}*l$-FRWy*&D~tuLwV`XtA0gOc7h*g^F8B=RPKxvmN8k!t6)F2<yg
zp~_^vJmm$w0FO3wF1Ri|Z}m|7We)2A_ck`Sf(nnc5kFlREnS8c$M(8<VFDiWU928B
zlsMLU40fvJrjNY4!I$gZ!cEJ!&TBfiKIl;P$a@p@DC&FsX@N|iAmQ|%`I1hb*xaj=
z_oWMyY?PIqVw)OTY@oWwNHd3FZy9uyZ>cBHDjRvCN6=29?4S$LovXbSShbdUQ8bd^
zKE4Z2;g=2C64_wmPe7>_&0r_gie~BEclN3z<?=4a!q=sAY(tXA9#$G;#n4tIYhVSR
zKuTzE#lSp^_f?`xJ;s3w-Lh>@o=px~z4iI0RiVpl4l-*5(Nj$b-B9n?<A(r7v1dOu
zO~HX+Jf$%M4o&$OdvEwZdFJS=^?l&f$x-?mtL|IZCr_GWFu&>rc|N=@VgPE2XQ*+2
zjY6xZVm8Mw)}_%}3yShvOzZB7?ECPTsnMflAOBo@TcuC*I6SYY76a_0yoSmp=xF^@
zvY>m|n3x!DsTVz<#cystbYRHzELoP{nO9g~=~8+m2$KVsakpYO1xJt6>sb2%IaU((
zT1ioXWUWa}g}bAxuA*&4aQ(eR%U+7w7&$!8JqrG~<MC^{nmQ-fOv~3!jkb5x_?Rz^
zIrm_tV50$UEB52eA;xUQ25~s$SLyQynB4<@KvbL!V546WgiFZ=)#yF-WCx%7CC@VY
z-=7*02DyyK9<M+w=!ud)pvDziTg<WDq;s%_c+W1kAf@9984gmu5{II8ztJ{O2v@po
zX9$v?&%+(jx~St6CA?c5eD6G(nReVRJ<}a+q#U-~G2CHw+a*F}w%_#bOBTJSjhVP-
z<}CRnZ+u$S$etWcac1UOA_wC+-(cG#3W<*l1U98-U(&U^t5+u+!wdPXC+;ELXnMTF
zd9}d5xw)U|d<|mP?ofJJYZ)!sdusD)veJ}wr0sVpOeh*}FwCUZBXJ_&5?*jRAyU)n
zWW#PJTh|%gx7XXQe4?g(y&C0nOTKp<?&0Q;HlT_2I_^Kx&uzr_h4J}CN$8!u_FF;J
zXB7|<GbsPFMMxWGs8_t;t*ZQ{y+WI>wy^W^M|*>C(eom;Em6Eq&ATp4&P2<w(QT?W
zK*L9rs3k}zFS0PI(V#-r_a2?X-3jRf4*DHU`bC9zL+4I0Qr`3UFs8FGL||`JKxn{q
zKe*FQD8LmCfFXU}ac#^arbA8s#pT7v8NPgZL03F@tT~18oiGH&3UVq66tyf=Bd&-6
z<od1PJVVhr1h!SXh(>_GQuDGYaZnni|7Kdb$mVj&uxbw8DG0H)H!cqdShuHo-HvL`
z?Q)nZ2ASPbHes{&(RXn)57=nLS|6!}=trs{UvjS|j<hW;^|3mgS0yh!A}mi?ji|T=
z-`l^)GlDflk0wD`U}Gk<1~{wBtI5@6X}*i(lf1m=9Q2j*94Z!gGjW$RP<CLFa<EYl
zxX1&IllpT9$3bmfrlzd<lI1kygAbgWF;7JuUOPlzF=^$7;*?JhT~?To+4Tgbo(~;}
z9Zg$eAcTWxMQ&_>*n5Iie1)IWsho5ZHJ&*M#Dx}*EPeO)BW>5l)NauY(Ocb8iX=JU
zdn*BWQGq=TDNk}rJrz7QEO0~2f!{;GkTPd%r{rNY6cf=OXswWVgQQ73N_~#OT1h-l
z<e(_K_jKAR2~>pPYJz!N74UW}Eeb(J2O1O0?hy7?DSU8-r^Lp(4tT%c+|1nv(jlo4
zgHJyCI-es#te?OVpg|TiZXOyF*BFiovwiE$=$lq0(S+NoNrUk>tQ`Buw@8Gcw{Doe
z@Ii_3B0m~4trgVnf(0&HJRi2Z80Y;`!l(CQ@8^7$Yacxxl<p$6bsuPWVvkn^ee`s}
z8KweiGD?JEjW?*}!TFbju(o@jO0~IPq|4bWZvEnN!DPsp#n5fm(07bfnJC(RL^6Qw
zD#rq8wbKl)I8DkNa8-C?lCGTkMdwk+1hOrnLg_A3y{1_=-6Rx$4M%4`AW@z89LnOd
zFM;o3?RI=>Rt)8-aF<1FYXseV=}i9@7fXJU{S1hVpI)g&u+qNa3gEu5omkuu^z)p7
z>xHh9N3=J*bsa5V9AX?aX~Zr&#tL<9v*U~W%H&7G56z7n#)kn+c8cBE)biBSlHEZ^
zU)<HZjY>;bNU-1fP7Ta#s6&&^B-S$XEI>3*1-gxU>$6OpaB?Ody~IEce7I}-j@vut
zS@p4^8XOZ+2!G5EKT)Oc({c^Jk?9)K5n}VeBKFa_;^ExoVWU8yD7X(AZz{W!9yw3a
z*nNqqaZ%bJA^<LyT6CCp6B9&xzOa=*{bU0zyhveN0p{=i$MnQjXicoX=fN80*Soo$
z%SS$u=3bt%-I~`runvA0ahp(%d5U5+r6?2f6K->J1Pvs-tMLu?Ld!j{DXxOJDHx1`
z%92r)CD<h|vH_`=SU@Ue7@WXQHJcmPZ`m5$E*4sh_^_PQf0?UKF2h6PZ5a9{Z1m%Z
za4EiFQF|ik9?i5QZ*Chk_5-3YQx@C`#S4FrC1f+v_A`w!X&yo~xN<L^4lL8lyl=3Y
z!y9$Lr%A;dQaCrSnFT>5^)||3!Bfzo+A8)Xj-`QMX5HA5{kTf{aeo=hm@DEo$|i5B
zt=y~(?`l1Kf95Sq*;}gna!$J23BAh#QBNSt_A^jFTig+fb0$F9?8$GenN#A^pCev>
z8@T*rBjM7Ognin+b)K)SWYR>HmECIyXe$(^NivrG)Y2_^Y)b~MBp-DNU3C|;-o6Xq
z+%J+9NES53tbrAs7$thiOBsmWA+T~0jfZL*?OCX1%8Bj@F623q9tdCt=+jPj?sB)e
zp3{|E)I+i^c*<{0ro>nYBuq|YnPK;rcy3YC(W4pWoFs`)^)3e)l;s?wJs9QR#dP*?
zen&(ht<2Pn1VUe5zoWXF<sd2%U6YNz3)?=0-ZJWeZCxmvj~0}bZ5l4W^}J3XvX9aP
zcC45MPxR7ZvK{3FiFND^sX$ToNOhZ<SgMh>P!GbjeeDGQl#k4-w*->Gy2XKWCe<<c
z<6*)t&wL8mqjwZS_l*wzwSCb7pI2!-Lt$ry=aKAE55lSv4>=Z;X2{<aE!vl3ICIO7
z(m$fc^LRD$T^?)V-KSLP+id?Tr{Hn19=!+d-c_Xoiv1QvkMnUDZYZA8{*Dm4H3@(3
zE9~6R8r4|>3s92IAq9+<i_{TCrh-XNW5n@o0S|JHZK>`-ALw;}%eXt!#L)Gjs#Wde
za!}~iI{gFjdV%m0vL$`jSJNBvuIvkU0s1%~8d|{9<mnCko+6NLi~Of_+dug?|10m|
z|Lr>iUy4g_f$Za~i(>(PQ>y?M%loxQyJVv<SG#0&lq_IGUtwqwVZI=mQ^ndU`FtXT
z!`kA>yGLq5@7UKcRisqX)A20liLiG8i@oIh);+uyEnQ+m%P;A_4c%b!e8M0jJwFwp
z^{BSh?qJy@jeQ#{&}ORZ*d4R7x|6IPMk>CWOW^#LsUVwj?RZYt9d&oz4t_cn%}1V5
zLu)1=(PKG1IrM(R=7yTc@#LU0DnG9ZyYXu0pjLiDHSwHud9#!b|06D52P>soUcI=}
zX%1Ra$R7~0lG)Il=b;=t_V$Z%fCrM8?CQqiBAYcw`kTG!uMMi^_I_hu!v?{|pOFY-
zI1Y*BbsVorVW6j{aJldK{^AWAp7CSf*OfhA=T3jj$oha;8-Q<}M~m>jQnf8XEY7Wh
z+Ja!B+C4wd?SFTTBooF*G?~%W(ge>Y&G^xlDf`wG(QUIamf>s$op%`_>jN5I6rBbI
zJ1Nm)vJfjP+1<x3GkoiDEl%kp1t?>`NlUGXZU_q&zV^0wed8=8)O~Z2nu%)~?WY{Z
zs9}xp%H45_O$uE6zBI)t$Xdaeh%at$xe;n}U!t)ij=1pMyA5m)M`SsRjfVxdFeGTi
zaz1dIRsR&W`ib4>eti2M>&emARmi!g>2@GbK>aD_aRhBriA(3>QD)&af@lM;Uy$Ng
zlbm|{4kX{0gJhKwM<+!vC3{fu%<iW$RSqfBu3*O>6djrD4I)X>#NqXP_TvJHWgW<4
z0v%Fe^P8%Bx5v=eqXP~UFN@61Z{+-dl%yRvj~kE8=tss54a%OSQR3l|>+oq%OLT_~
z)&3<LvNyZWR2!qiC?_&VS8qdSx3fyCO}K<>t$3Ml-vOEA`PqzA9j(Z>W^vuGmDQx$
zkCAxBhp*Nt?eZCf%k)xUqH(uAzMt~@{<_aFfp%{RxxV!Ua~BgYjvgOEBK`5G6=hO1
z#OGGiG0eT<kZoo;-fX!%#%=M^wHr>vpiK4@>91v&k}Y}6)dQl55~4-M=-3h9W@4n~
zehZnc;zF=o3UqkZF=8s=;<(vX*Sf}8Ve9JyMuIU{3uRK2cgIFl=(R!SYlQ_oqXB@b
z3)KM6cY9U=LszLfqRvt5UuUjt*xN0Zov>|OQ?`G!_`=v^S5TFqi4;zj(O=(2&=45g
zm$95Q33ujEgBq&tIHETG(%b+?Bx`Ggg@;*!{(fHD=S-3y7F8rG0J*;23?S$L%I2eu
zbjOF+U<c5~9TXGUt}L3sV5nT>^ATlQXUy`2LchXYw`FWD)!w;q{*o*-8H+bS_op<#
zxKPL3b;k{A;x9PZYvV;@1HCNlxnjmmc)o|mSt_@{Uf@HLeOwz`J2X&L+Lxe_SZ4HS
zHat%bd8TuN`FX5d!kY<s5#e!cCx6#;jGFkEMy|*C@S#Pw-D$5+vg{k8YxP)Jlq3{Q
zAeJo1cibB$Y@YWTd_(cgZSxGy8EeMNbg{pW6L@lXwMJ@icdq=Bkkip>KX5F<o9S9{
z8LgwZYiX(k!Yn(k5=H-RNX7m(WG@3mi=hgK*Jd7&tWKmu+rW>^dHR8FB;(<{c0~jF
z0S|)e)hweqxTX&5?dF)1c@e|^mM-!V#ve8sXf8qWX7(-f8kJdbB~33=?&}!8!il{f
ztUGY7S)jhA&?ElF^3X;45Z>P99q1cCWmMfw!h<v@=n7;qHdBkGzi)3d@u6$HtTagQ
z<aM4~U!eV)A$<czjgNUJ_wBv3o0SYFpQd%2@1lO9aSgf;R;}iHhQ?hzly{F%A|1MR
zYUa7*!Q2y*De1DNHV31j8XcFQAQOu>3J1>;Te3HpEbaaXluP2?h)Lzh$i5a-X`&KS
zJ5alLN&kHCQ*pNVB(}GfHr+65&}U?2(GG7y^u%-4sFyoyn_aEhmd-SYP)!{=OSTt!
z{h0m9fU~^Pp~Yjxm;pw>AY>APtO_6`MOX@(W@W4rU)b6Wk_&#Gr~F1wn`*zP&#)vh
z<C%&jvslwp*GWHR?ag4;Z6Oe&V4<ccoW^q!T?pc_AK_a{!i4%a-l?{(jhU7)YT9=b
zv??7gJ4OZWzb9MCCBR6o4}wtm0W%7@ca7Dh`IaF7`N+z;4RJB4)OS7B7l*d>GFcjU
zlQl~B8Kp*CAC8D<kR}%cyoteD!MKA+9UOlP2eMSAq>b^=y_-5D-HE}_tEf~fx`;ag
z1~1GM6!<a(3#vo-Su6wH#MLTkfp%Pa-6>C+YrvMX_X+G6?IOBL8+0&TIn;{ZBuaG_
zAfU+0y~(y>)<s>}M-*XS%|1A>Jr{_%-n6CCE((49#&%$MlfwFj$n_m-b5K%;ltplg
zSr|tIrJO#)wHp*e?#Y#j7(efGE$Zv2RNK+8UFkB`h%RrKT4(-C+x$|Q2OVwGh8BiZ
zLdA@GHEgvQS`rHbsuXoWE0#C~dwkI)D>G}_h)6sP1+gzZ9XTztd1Tkt2bhS{*wx8(
zO!G>gE^&(FLKa1yDW<-K*^$jOE4Md&SF&3_Cu)9){pvrj^0vN-J3sJb^NP=Hev#7$
zd$8UjoaTjia-SM{{JPjw{%6(rglXx=fm)6>TTkmDO;Vi>{q#0#O9V8rfzYtjLB5Jq
zBAp;BsAZ9yE7dcu#raW7)e%nKtY<kTZ+-sUk6_~=)-SC&wmfnDM4NYSsD~Xw+qC-?
zDV-r$4cICj#>Z!#7AQS-nawNm=*u&EU9Da9AiLDLM^Ss{bll^19Fk8a-f@~o?%}RK
z`3TRQ#h+V!0w0qsS}}aAaJZ);G<(tIq6*w#y1Zy(zQV+NMsdG0#?FDb4tNAD4*RUy
zz)bI+NMjVrq8O4QTptgH^J#n%56TV~mliW$mMSbfb#@T_aD_Xk+V_d3G<6@U3!2aA
z140<#&q^@07%sEtjG{3E4|uo+)^uzwBS-qL`1(vs#ymLlQQ*ZMuMGfxhPI|r4*NDJ
zF?=SqPP7Wu83)3--3vR1rCz!Zw{~7}6vzC4xU+rwyq{<6`4C<G^*XfL<A03q{uTlD
z5UNky11GgqJ%R<a$Bv6J+5)Tk@{UzKwPRIZo|tZ$GcQs`_}AXpiEPidWl76?sYv6*
zuhhptSty*T?pRG8R;_1J5eYdr(;nnNA3rp}x4K5J1^9z=2o#&{G7b<e`KI7CJwIS$
z8LS<`Tv!QPNFLXcp?@I@4kDzStErDy@A^GcqVNv~5&pB85<Rcd40|3U3_=hfGCST!
zs><BH#$_$^8DiOWWBa%QbmBt>I<xLQg%3YjFJ@4mD`jvbZKR-ce0tep)(GwTjyhgT
zA7MWBeomj8Bi1H)PAk|;WS`DH3-dtU`|P*9A(*|S)Ar62VsI1ERHjOk(DU|wspms?
z-*qhYJtryn%KM7!U`Dr3m76w^rFqYg<$pi|S2i715$OOy@aEI@(p=Zd5I`3Gb9D9B
zI6Hk)#YK0Om3sKW0uw$Fk&M3G-BL5~ilP{Y>AIrfAmFw?HP8hbsjeqM0k0oC!6dqG
z!^Cj<49w@sxs%@7HK(@??!x7f0QnLmSx=KDsYx^;>>f#Hoz|pZlnXp{?J~8`<^Wb7
zqaVKVFfYJR$!c~nm9&a2n@lX#Q-7bom1VF%f?fkBSf=>y{_!lx|H<EQxdki%QK2|@
zj2}Kc2V=>qk9PGuGq3-oJSB&=9<dAnXWs1QdW5v9BJ+zRxAeIZ?b8|ki`Xtpctvbs
zK<hJ1(!C2d9ig7GW`^|`0bHqs3uT)UpV&BEclnFCe3rq+OwN2hXlXxFua9L>U`{60
zf7`<yU(z@Wn|fO_6$2yfej1C<?)j3T6D|8i!zj%fu|Hi<Fb`NhdBT9|kU#VFqvL<3
zm5t#CtwzMIRv+6RDZxyko#_1#uHKo#5assRRfN2+S6ovwHlbi4dMymZ!a3z9P)Xy~
z)M;P*qS}W(&<)V2+dEr(h4G%aCu@XxjL{8o$1LULDzhyj{G!#ItMk1NTeta3yC}G(
zW2Ja<RSCLgWv`tQa~H}szmJ`Z;47Lo9dmVg*(kiHlv_BPyTD4exOKSPsO)(1OZ`T$
zdSCwt$o*AhcHRLvSBi9grG5lbk=xOvfw*Pa{kRDv>^73tP7cnR?2(+UFM$RqN#>FK
zMnj?X7w(*#*Ai*;r5Sz2iULEwQs4mA&$VDJ4cJMfA}ptZCcaa1cn)=<{khar%9&1<
z*v}G(n45ARXWz$dd_-*?JY#luMMC2}R%q2mQ1j8JSk)9NOm7pa3<PH~{y!`@JHiE*
zqga;|6Y5J-kW3wumNWo+)9860GWM?XxKr^X*@F*9RnitBe9b4u`Mhr83;odJiubkm
zguP*Em)sVx5TY+uge<#bpd_w$_nrIh!`Uc$`-9<xvJBUbqEkI}Dq>;*ANpw4vuchW
z><d;c{VIm(-tqi2p&}YRHY-*)igl$x%>~y*JA^}93}rbuEM_I;=7rw%8Rn4b*vo!+
zFZ(4v2>q@!pt{~vr0uw^PedwVV;NX0fPL6W%vKNmKis`%R8w8pEgA$tL5Lu|DqX5H
zDFUGgh=>6T9U@IYn)DVDiu4X50@AC}L<lG#p%)QRdWQs&8b|;`lqB!n?>Fvg-#O=w
zbAQ}FcMQgW5y;MB?X}l>p83o<AAH_o*M#&J>T>hiFE^i+Zl8c+g*}IVK(G-QZfczm
z!j70i3IN^1#_qID0gAwjC)3j+tw~PF>Q%N8JXXS>cMkiXyl8T=!+`qs?;Qu4FrfR!
z*x$%yA{VgGG{t-aym0Kz#*J2W!@>gf_0@JU7kYt?;l4yU5`cd*Edh)jp#i>pGUdK4
zUCXr9o96Cj@zr2oeG!S*45wC>n{El+m&i9s!$3e7Mkq>k5O|;0w|c(C^zPBP_XcMO
z*Y`zRoqJj5=dJ9apX0TkroNgO&jhcUq&eSdofIRSpV_~$^Soyc8h9kt)3)3BwOTLu
z1=BI-H-&G04nUoOIpj<V`NIj1q=LO5q~8%_qD6>>zsH=JkxJ!{*Tr0BKU%$RzI4^(
z5Q(`kq}KFHpD0gK0c;+kfFL54Y*KLCZ=nj1OIwY}y0uF?lR6DfPOpylXR{KU--A9J
z8qhMeq&@+Ng$ZPpwf(mM-82O#w~@5o12o5(g?V@oN#b3ok~t}@I`mAp6JMRBxU{<a
z<5}>8qqh<}6Ms9?wKV>GXBzA1TXWNvV=w{86Y#<qFl!8C$5Ik4COxH!RJ~!+Nget4
zp*?xhW!ggA)9&ugsA{vac7ZBmhU5g|Rm#hZzNQ61c_47%gKK&CMPixi&c*{w-}Hyk
zDo_6Lqj!<#W2L+CUdq^F+aI8i>CPi&N?JJIM*3EJ01clcLc+p?^)D%S217+ZjOdjM
z*H^YETm{h^V?Pt}%}o?QG}%xc=|3-l>39IYjt|<xC2bUf**xAqYgkXy_|u9B;vM^G
zuV1TsZdvk)PS%y@7DI+uLl$NP5c>4q)z;jFT%gjRW8mBq^6A==ra*;*nnlMy@nPd)
zkj#^S%yi)g>TGvk1eStZG#Ln<7~jEb@U=^1SY_yYk9dXPz`AXD#5dQK%_Mk2WFhh9
z^2V+E8oV_d=rkBZH<yFW&Kg^nUwP<*U80f<>$8ru&o8rwYCHn1i<l%eUHl5j_Q0_D
z-kN|@w^uB@K|;O0duZU5p%s$zKnJ)V61&KmMBhvRY6k<}HOhV>4uel=dpBiD;Ie}Q
zwH(ItLpRmFoC86ux-Jr$)(;2ymWos{P3g)|4*P{6@nQjK^Y+i#lB0_Pvt0h~jEA5+
z)ug?RkY04$De<r6K#71mg5z^%%C~sthvsb`UfpTuSWQwYb6vhL!aX9~RYx?Y<Y{u8
z$&e){$$VuCOJi7`CuzSM%tZu)es3^OKGjnVlN_iw{_%)5Z7_-a7Z~?E<b^ktF;vVa
zaL<jPb<lMlg-Jt9zOo=r<!@LkpvM$VSg#j->K)QiruoZ+UE_u;Q%bwU5ZV_*=L`u(
zN#tvyyr}$1U)-U?>M!9Tl}tSx>M0{3YMue#<WGv&Foj^bVwIb?Jt|znQ?IRR6Yc_A
za7p0vM--p~_dL^jO+q&lb!?Tst$7mDI;W{$we+k5)i+e<r!}}sDYI~+4G5E#Ow&~}
z>k64DBia57@7h1?IYJ!j66Ol)cI>ld^=@b{`JfL|?=t8pGN}AlfEOJ0zW{ho`8rN<
z>St=9w$@$v!z9G@P}tp>z#SXDLX(E4-+0z@S$IU#HZRqK&2)r6ATf<V6%qPZ#sLg0
zI~;HV3O4nFNs>*`UDpY>sEo4fkT?gfNgPft=wqvitShd<YSA-gZ^6O3dY*pE*5h)^
zn`ZOTtBjNnIYePfmZ)J`H*2UDJ@>6Z(#zv*9XbSXc(~P&gf`H<@<|<C1q}TqLfhJs
z)0ntM!MS_WxF&#SlWU{Tuc$<KX_v_vlzA)p_cL+@B^K!f)SbqWLfVR?IlIY+rug6F
z@fwnO+*eCBlgiN$(SeUfZhCJ8J`TKg3K-`2`$>m~m-@M!WUG%R$S27=O$9bcU6k`_
zta+ZLPbX#nGg$NdW4au>jDBcJ3A47Md!C>O$rgJHa>e6S9<zt+;LBnc4~_B>XNj|3
zd+7IMatp9(^572%mIIWCJCwxk%ch+cv!#)qgICIKc`J{pjejw??ojvw5pca%Ey)nR
zYzYC1V}?MXJ{HOPFK#^Ch`vNRImVeoh`Aud<SuVqe3oOtyWMt$g$3)|$5730BFT~!
z5567XqTao`DEfwGw22ll4(O!hLbjVjfr~M;36aCQqdQQjZdAb+BKybokA~@YewuA>
zZvd*zt1&DWG+AL^0j56Q854p7-g};oROA<dspA9cEQ|bqsTIC8#^+EOd9sHK`x~sz
zPiVyClIdp_hHd~fcu9Q7P!ljxc}NQ&O*qyisH{$|-p_w$vue`ne}BX!xaV*%+#9f<
zT0-OR%fGOJ^`!-D$nXEILPvKwucvqfISQ8ei3XpV*?=|R*PWaS)Mg6A6C16(um0rt
zT|yE|!0BQS7x~t^8%p5@-I109RN9XCN!y+KJB{^?<^_w!g`_Hab=KEMz4{6=R+-=*
z^1J|9t_RKB>WGz3L|mI9D^>AWu!g){F>qrjSkHwjK7G8bqsBAZ+a&fs&(f!frD(E<
z@0mFH0h&-;<o(vhW?OY=Mb6opL*6y643(uy+h$N;u(%ihaOCRTrZ1owCt8q92ukaK
zDS-&w8XsJU4gNeE7neZH{a_bnZrzh1V$j9U5cZ`_<K<RqDR>S>0{RF(q^5Ai0>DrN
zP+l3XTWR%nyF(Dna&00Zh|DJUrpwZ?v%8B11s5^7`bMJu*QB<;=vvUluoxh2BLJ6f
zU;}3&9b>*FNbEP`k4+}wj;`;9<T%Gmrz-O9XY<^yhAL#=ye^s8WYOzIn**zNxQIt3
zM0fF&k|geOf521X8cRS!kRT7XzBkB@@+i%8<l+?37FBHGS&~9!O?J1csPKGsE%)Vm
z%%uf7!E#if{Gv0_pI}(VnS((mBRFT|Yo0VOEqPiz__`k<<9Xc)5rYP48sKX%TSHAG
zY1CH#xQI>*^uprqkI~u%1IDV#k_8)olVH&#ke!L&6_F@yr-5Q)mA~LKe?%Yb1Epqv
zWg|l%)TFmf`!azcE^r4WZ8EN6`rfUb@2jF=%~;S&<~NPHSKkWsK&)$<#^ixcO#_EK
zWCKc`T)n1q$jx$1v4&-jn_NoGA!ocxOW!i{oJ_(DpFW;gF-=x8hrMn6f0Td$GH1Rf
zAF^d+Ir;JrG4})bqapA6cP7StD|&Q`TIRp{u@TiB9gg2VyQ!gF6jb*tK=yOhOQ`as
zDr44ARer{MPyxOqx+CZ`5oSf2!d|eE)gO|p{vvTUyLeC2W=QK&>}gs$-__quwz78%
zUP-~+eATtO4^uXMYQ)8kZL;?OKMu6>s+U)T@{)9<MxR*B?5uLK<afsh$~2F4PC!o{
zzmsgb-nOzZoB3~8DOvsr%nLYM2=zxwoFTDXi6@7bb~@Xb0AN%4PKsc%poN(gk+uM|
zx7}2roUx=tG@J8{FRTW-F-|Qjc|Fc~7;|}iyFo-!9TyX@*qzbZ**Y!jh<=|h=iSKa
zl5F)_<4(F_ef=l8%l;SElR?b}W-}`GO1G!BW>9q_UNYWhqbh>~DeUH@yWbA<Y6UCj
zCfd+#68lvV08`3o32u)Ebb_>JHq(X!_;X)ej^@wk#iO*d%JbQq$9YYel0-7;Egoj}
z99<BpRrwM+hh>P?=5y~KfL$gV)R3I-dRWl>$74#9+bb1goNwvJcn5e)PfA%jl8+$t
za0H2qz-J@KM~WnX`>A3xsos*UQ$Z%Sow2;m0e}4NjHCP&{h}Q{>73`-ELJCN;%zbU
zH7qFvk>LWaI26-sg8_@h>MCzHr9P|LtOp(($($B6QA4@{X+he|gt?e*;q4SG4CF}^
z6rB`U73-Svaq4VWH0qbk7I*zpT%pcRGh_K}jT?}1rV%n?y5$CsY<Es!^MC7D80J;j
zIP51*9Sc3d!3~ii#3D)|S-yTXG-RNJoh)DVtRt}D{CL%Di`ymq-GocohDY%h4}0m(
zNjJ=SYf2LeF}b+nl-i|dixNrob~dYvU-CE)_z?&0KlQ#~?C9y(6s0?52MmkczaW`@
z{M8a#cTB3@q_03jA2)Be0>%s?q*(eYeEQlzu|j9c{gVFo6Q1?sLBd0?raV5GB#8%K
zGxLTjBwYphKZCGPr-WK+Qc#@`=1@y)LcB^E%nT{D_-(?fr5Ni0zU7>*Zlch$O`{So
z4VHQ=cGtGXY3I?y<m}yuAdWaJj6Kx1w}4|Ui41$UxLu$Xlkl<YbG|GN^PpEZ+nVuR
z%)q6b>1YT28pI5wMZCGzW=8`$Si<PA=I|v`mri5lW%ig%JqIhRt62W)C=ie6x&?j0
z=N}Hn8_<jrS_I!71fLGqBgJ6=i=o}_2jfIjlSio5k}vQ$q?`vwTN?|@4L`fQ|2f8=
zra3VH>ZbqmFJ=xpZlWqfGwysKFeDs0PPdNV<vx)0X{fX=E#`ToXw08@w?i@WarD*L
zEFIoJz-H*b7D_Gi{?CKR`cUwOP#-ioz`>TRM5s=~js|WTezKP~Yya%dsi((7CwHdL
zq4rHFHvJ{d4p11=+5j(dt;_f0f?=0JkFlx=@LTmdwMW*w8VwB%eKN^BOa?N^J&KvS
zB3a|02xgA;HX#&rfAHP?w#AUai3`j3ex6TLSvt25ebOBa#W?Kv`kh~9U9lNy(N|0`
z(&MqVa#76crSrc~da?FDfjWQYFnMG%G`prFz7d)|L_uS&O&a-%@3h(9{v4I=m-~Oa
zKEMRa^7>);G_uosy{CBBZPjQ)8&k#O%PVpW4?bD)?8JC(b3aYSvVV*o$hupW`|_va
z`;n`sbe0YIh@%?=O|A6+{w5%_T2HYB1WS9la!cWmou(|Y|7}h1zs~x9e+T{#e@6Z@
z`Tt9xiFS;7gM>xWgmNA~nz}ME>&qh(IASC#`}@ZNV^sKh(a#V@PZLZ+^g1bI-CMpd
z3tgnu8gWp)>-Mh%LJuktkdu0x$}+P_Kn_ljc8`(u|5mvSBtK7jKixq%ZzCqS1mFGY
zPH(d1IV-r_{~K}Ajb!{Ii^Ls@WM`mNAC~_>pfi2~H|BrAUH|V3>Xy-D#N=W9iGUIo
z5yzTiffx8b{n+x*#KmxIK42TanQ?|X%;gxkyrL`C@a3Xo{#}h5Up~C=r3<06v|wV}
zo=G!tSZdsR_ov}f-Q-qm(!;wmGC`l^CakB#t}Lwe^W#S}H2rJ;Wvg4n!H@CcVO{d_
ziQSiW<!pQzR(#&Ose1(0^|`jGLqe;q`S>r<!1NzG<G-X?>)vY2=m@Vl*6W|yipg1P
zYBB@la;fwG?*PtE@&cq`6FkF<ASl-!1BK7@#pru}<#dGA28>uVVt(Lx_feI)q^|vE
zR;BD@{|J#Gs#p#If)&ic`%E7KUYgRD1XiJ-a>Mb4Lgbtq-$M94DEY4r2n2e<NSKI0
zu*_(xWAXu(3kUP6B*AX$;S6{B17o9ub)N0_;+N%hLY!kAM(zLPT2<FR3`te~9SIx9
z{mhz(Pic88ySDiQY47vz?MVO(VAyH&A5ZVMn#vtpPgh=Ew9*$F_!checRj@U1XMtl
z0<w<?xQI||Nl(clY)D%&RcvC&-r``uL_*tchd<9#@*j{tmSC&(CBkxt0Y@Rw!Br?3
z-4dRo^0|HyRc*QSEZn2-Iu^*?yB}KozF*g>D*>+P8_KLnbH+nfZ;|BOux`z>%J1;i
zNS)Ahp<HvH+m@s~9;RNHB3SJ8TOzL@-Jsm+&7USkHGbas`rI+}LhJP7mMKRo7KSs!
z&p>Nvb#KT3loJl8RQ;xtl}OXP?TuSWknG(2oX^lE=g5s~wd`4Iw=YS8xX3Rh3_57z
zA3bG)CfaD1g@G8JU1_v|x&|8y*xV|gqlpZ5oBbDaTYrrNQcw&HCAEun%V=|jl!LRG
zCOd~LiTjG7`2v%pv@3udVS|8gT1RGR3nyuQf@_t-R&~OkV%4nrDpo2NE0*Vu0gevc
z7eK)Ta8MHjg$NS^(C9V#4N{J4(}Z{RXynZX@0!S0o^)ZwV#aSYqX)lw4S=-GXe87q
zK*|-<0oN5|rep?zSqA0CN_d~O@!CWoeC1SCKd|Cbo;Og5x8`b*y~<P}037^GNu>%c
zjdSINH0f)j)Q149%l+PD-x>+L3GR#1HU=(-B%6{bXL>+ma!#r+`DyXi9T@$*Q8^@`
z?3McoPMc^FQ^-l5^>U0G^;+po_P6^wiwrnfI3G461ARf89x?5}Pbu!^CyB2f51~2b
zS<0I1Ja7Wd?ed=nXMV93c-(XH2+ppQWPYQja+(W5Y9aBaYRDGIdO1um5K(N}o|q%_
zd)TfGw&$>iFV;Wvpss04kPcP<y7eQY&5M-!|NJTaG~Elo|G9AMSmKg8$aV{ba0<=X
z5Jce_h%J=bi5DCBT_zjqa3g?F+f&&U!du-=7dPj7ZI&))Y*_p07itR9MSkJ$9MOYP
zcmj@Z;AM8+Ka8xu^HJNUDzL2PPr@oI#!-Jo#0EqLLd_TnPhPi#E?MB7Xlzbedn`WN
zZdX-hdn0PrFIakXOYqCPixQKc9}>j@TfZ|HVn$Gv($VGjY@@$JpnsbRZhPa$op$%)
zxniYD%&&&&!-}FW<^DN;c9XO;wAkL?#E$q<!sHZ8FdAC%G;Gc`&&={@bHdbI>d&m7
zyq=jF&1mxRNiwxv`x0CdKhbj-*UbkgEiVvviuqejg8a|5PDbw3JXc#&j;r)pdcBbh
zI{8ZtL9f@%<-xd-o*6*e*V3JTEwb6BPwyYl*sY@Q-;Q1x=IjbLBbkx6RmeMVX~#2t
z06=jf>tmZpf2TBgB5O^DB}KmDh6-ul?!*Rce$*PB2nSJ<WcG2bXKFGs6_=Nm44Vy8
zdLHSb9z}o@fFe>;Z$U;1oOjNF|Bt2-W+&&-WF>70$`;-S@srxT0AP@lZxKI)c*$C4
zT5x`X>R<+|rmM28rKgoZTVdxMpLfGtw@YS}-w*#4nx<<ck26D3odYF#iTH+;QoZQj
zQA4D!X(+U{r|P7yee<;M_Efqe<H7eNCwrcwn~POSMa1G(g~osA$Vy&7z=&&Pd(s>L
zEASDxhMQh!g8*I6KOn2`2Xco~cV7MFW4AT&^sCYrvAh2z_KW-#NgmPYAw{FvVkr{l
z%nAOC(uQCmGmvU93*Bt<OS`O|{yR3VXLsg^H_x_m4}5SxuPeLCR;5be%uLQPIrArw
zS-rhaCb&Y^2EzB5w@7a-?@t{H9dr>za3Ps)ogYluOAJmq{uZ7+fxDBgpGoiB6l#U0
zX)1U&l2)}kZl<-5WthLZZe8qNQIuPtX3n$n?ZPP2%%IfCvbT7B)w`2USSd#Iq<eS~
zwNWC}tsLr1gp-W0kQ4`*C$j|t&7q|$sDs9mpD`<t#aDWDB^Vy(9+mA?u9+qkAXVf2
zRpGQ~KU?AE8=z9rMr_Y^pIH>1w;#MH1#~)i!$^KesS3)YbVI!5!PF54zV1x8I?4a|
znS<oVHh9?FO_K49ZPx3QhVq-*)?%6KQPOM^E|jQl`p}9;B)<*xVj*_7up|-2SK3j;
zYjCZhHGlfGIn7y$`r>Zs`tA48sjM(HU}Z6*w1^PylVHeh<@Xx%y<bezz7!hI{X}5n
ze2M%}sZg(=nm7rhpO)6IK@1?^%d)2gZ%|kpn2`$MB#UO#c0${-3=u~QE1I@wuo@ze
z<}8N*02vz?SPuaD!425L04Vb|x-05reBgO=oKdGS%IH%Q;Fl__8f9A2f0!i1?jtg`
zr%}|H!_;oyb~*oN?}>BZr&HLoztU939RgjbDp7Y@^A>xj9NgpGyvH+|KV2V}S4WK6
zWc%9B<_{eJke_ajg!~7@cuG_vMR+PB>}NZDZ?-7>$KLsMN^gzC;v^IYiex%7^y~<U
z|F;H{q(QB>+<&FbKU4X9g^x4aQDM2cFM9cn<xe5<<vrbEFf-haaLeb&xA7!GnR>8i
zbx`R$e5D}}iGK`T%w8Mdb*<U=#rx|wky-}1Uj6V?u%iAcf1GQ>L<1BWnhKtz?#-A7
zzo%>om7$we_ji#`g%<X7NS?Lam2;Jf&v*ykzo}STxooeGyqv^wjhU=VbEqQ(9L~K?
z+E<Z%(r1#x7;e!4s`6}o{Q^zzO=4%0KzGa?Ck6@zCJn59)R_<U>soVqo={Bpxy1?0
zxaz%6bCv@k8kJXkTR*#XpV<|_AJmiXxWHa!>XphcTy;hEKKWe-Otld8GGd~DzwqFz
zuujUz+5Jz!ubSy;Nm1=1f*FUfZog1Sf71F-Jl(9q^0xF7<)PMG{XwzUDWeJ+#f-11
z4>VYHgw7#*WnBqW^qCT50G*_PqoV6V*KDVQ*o&!Q;w~|&oMj>`cWxg$X2sOf{#tkD
z_<Q~B?#=N3KuZ)ac*~TB{R;RYl4hbLR7y8D2%Iap>-Y(*(4agY6(D||*OU+}S_fSG
z6htq+T^Qw^H&*&$*6-_+c&_HP_#$Q`GA^p0)}9MT03s7*N+v>r6fJhtD0fmbxqcPX
zwPOBigyYm)!AHXxaAv@(5(Oybfq<m}6>uY9Lwg{3LL~;MHzJ=(6NT^@J9|i?Nty-T
z-dL=^HA}|X#p|8FKNBEQwILf*Dyb^SUg!zVh!{!9*OV#d#=n7jLlT3uo)WpY-02F-
zjFM&dv%(U2Ug%jmm9o`+R0Tc)Z#V%0Gb6?pGtwk7xCC#^$yFN-ueN=7gwiG5%@G>v
zR%l%~Q~38To5mNW-O?o#S2uG{o%)$@CE{{pyt!#C{`At8N=nia*NFC%Vz|ngJeltY
z^$N+~89p0#Am3!I+4i}+gx)&&CyrlA_$SW5%=l^!V6$sR^S|XBaO5_6+Jq!1d*YB*
zuXUYk^hJ;FAmi1hTZ96ldk!CSe^P#h^%e^bg$`N&BFrVWLZS=oQm<Hxn9Z)RT(U83
zNi7q}^bw_@A*yq$oG4$`_oNG+{ZVh$SH{W?2rr(17<3r!0+5%DTvep=JGd1=SzOk4
zn5|)QXt~f^i+)Lsp<3k6QniV{qV($C)YqS7WAW+V*S<lq$nqm2IS$qErl!p)G8HHT
zTfPj61AI6H!DlA$aQxi<4Bi(;LSY|qiQG#ya&s4QUUm2y+<UIr@6#tIn#Jfs25*EK
z0`TE!fh9wHAso*jsCHaLh+mVtY=BsIQe{i4Mcz4a$E&v=Tnc^;8L552Bg*39jOrSJ
zthcUR4)Tr|LSO0zZNK<(4_a^HlOXO{IBN6lJL_(_delE41lo^!8Ll>|eHku?Z|Y~h
zsJB3JyWjrd0c5jcAj<gqKcHtu%li@8rXU0iv5Ll<0%8(fQds#Kb*uz@GA=S?V}Igj
zaz46!%JI|Gswx`~ZL6Ph($&<uk~cB^5}Jrol9K-SZf3aXck-=>0FL5}^)$A{Mcag1
zPU&m++a85+7bkNn4wN*6YazUV<zk7Du!pNtGF3jS-Y*>KBsBbPd{GY`-!$#Uu7lm;
z8PYx%&au<{St)zA#tK=lUu&H$t9TZkb`XnK>Sbw%y3%^BuwXNN1(-Ki=dQiJ5q|@t
zXt_nvCDj2N=Wj|bkaooUor~5~!Jpp!?prqXi#NE&6J)Q)RJ$S0Be-3n@r0jwPvpH{
zX85nJE$T&Cd^$J*_8~4Ir6!g6A@=;wzxCr8`Q97O-rj-{jq_h)sU5s$$c@vq25mkv
zm~fbW$oI@WT(B&#LQPg!hiXH+dk7o=z<2?(5jr3gz#_RwOhae}xJmeFTQ_s|mpx;}
z<}l&5&&L*4>^TGGU3W)r@o)$B2$ceaMkSKr8qt_kh1}56SbEUf_Pxop!*1xqg~RHk
z($@cm$1{}Cqveq63B{}(Ca`3xX1;>A(oVP+b9xhZu}6Gl?BJidDHz@gCSU^KOA9^|
zJ+m?n$HTn1+`Mdb*g9$@cwT@YW0o2YxQ~ngwnFC{-{QxJ>m-<WJz^KazSFKK@6}uD
z(K5y`C-)XMJu!ex)aD{RT-OT0Lek{oUL|4njO7k0cY_Vp9`W!MEnP^Nc^w5v2q}o~
zhzqcV4dMyql`Q6*w5NbjAFth!yy<KnwB~-m+NrIv)-lYCy5Jx@2l0X}Li=Iw^ZE-%
zg#o38OgK7S9{0^cG{N(N>ZKSb3p1J#RW?IzTGk#0Y|TJX02YGtJA=A+UnRhOJt7E}
z4_gxM#ohwoeZOF@h6<f<QAe;S^Sq+a=Nw9UsC2LP6;co;64G0IVY1=Go6980u^rWx
z=A6c1s1!#l6W$_d^)uU8g?t1*kN=fGu%t51)JnwfZ^ZVkU8?MipIp3l_F7g`-Mz!K
zHlvaKzR2^4oZ=c4iZEcn2*^p#+u_?%u)d4KR&98>d~Y{DOvy#tU7Nk7f#&=g&m>U~
z*LnJ#OCgtIaIZvo)Xt%u(d)0f0cV648AMT1;K5S$RE}A5&eHzr@jLL@=?Ap3ra&nK
z$3t)??vvW;h_zniTkp2R;R#t1FNOB2AnUv?ks9=ZsGT+Z{gOrfK48lS!j}?l4ImIn
z`3V+^`F%EzYY6d<c-z>3t89zb+RUH75{uGTU*`pFpx0|4TyTT+LpD-B@fpc6xCxxz
zuuc%~e&5aejn7If8%r;8P?*ICy}J8IYCY*j2xL8Z?YyQ|5U_N3;lXptAANpH{=RS$
zDTQ^PS)JCsP_R=bbI~GaBF%*5c~wA64>^fY0@(1iLg)VhJ*L!mD}Fm9+}dbL#F@VL
zs<YibGEy0ud3gFDDD4h^+zY)59!FR^u%#e@k}19k=?qC|n=;s3*=sxYeE7y0NlYDA
zmIWNOeqAG3-j`~ro&I^SpSMy@W>c(Uc{I61{;l0b0<ww=<s?3bkA#`D?kdcl?eznB
z+yU0OG<%g!@nh)E^H!iwKP``kf#=ViB#%M!11fIx;34bIWd|b+x3}yG>SOBNOo!Ex
zBcAeA7SVV$y}BTCaU;!)IiP?$JOCzH!kXI$(hRR_b{08|D!Us#x7+n^XpM@z7RI;D
z92!DqqXp)MEDZUesV!Nc)k2!G>Yk=$jla=jG0L^gyE2dLf`<Q6(QNab&$FXcp?#5w
zC0r19c^11RvfB6YdR~M2!_DD3RF^SbsN@p$+a+J6)VEIqg#zC<B|$t6V}M8xZUihc
zNxbU*Z+w4W8!t<&hj@bXJL`Ep;q)i_z6U>pgu<w!S06w{CC8D_$K)MqzYqb51nx8&
zLIr)euPi?Mo5>h@Rc10xV?1Dw=)os+Pyjj=A_4fvJ_m+xBEf+TNcNvX;|NQnlC$7j
z(zUJ9H_g0!uI3k5ZzOtO<Zm9*?9;ZNp8(G2^|eb@p%Q((Lb1waDYEoKOVB81?&Mjq
zBp|#FG6;MLoX!CbiiD5^G7U!7ZCG3S(-~(9=1l$Y&~5%G%z`-Ll0`J+Sz@fj=t=-F
zQ6Ccj8#W(8O&A3h0Q4>LNCkvQ`~fRk`_C^6{pT0{{X4tim@a2v_7fd0|A2>JZsmlP
zlVZLxon21`+?^s`uo(`DGVbMG#YBmGY%Gp~a3I&)z!*McOz}nAB8>$yG@^;dJJcE0
zT9x~`^;hWZJ>R3R*#mdoe4hJdGDkL_(ZJd9r@hF9h@RP54ZE8KTZw_4-j)_0t!8{A
zK7NL^N_}1T@fCArt(9QpO8-L!g5j7Z2Ya|9rBNG9{r1--jyULfk?9|h%t6rJOxy>p
z+hzj`Cn}Un)(cA>#OGGlhS%EL(wx$`06pxpS|Z3PN@ni37r508DE!Ld060#AGq%bW
zKuN4?b&+Dz1jD)jKlTr{y>9&JAUB$gm*UvqBQ73wYQo;11pqO{ltI?tBUtfz|A4AI
zRxfo<;zoAkWraCs4$S_7RVq{e7T-z+QRKRSQF<XpHBS3KLwXCgqGfQu`Rp~AjAjC{
zvw78_8;?9Q6fRh1zL&X|yq<G>POWLIWWfyxS;6xe#H~CcgrJS~YY64CnBJJgtrzPN
z41?&{cG{m`8%Z|SoS${McU`6@#{3R7qwY^Tr7W%~1HImiV4GA%7M(-}^q&jP=$tn?
z|FbLOpmq`JT{9U4sZ9PKY+LHV9Ha_;yivT0FHdOkj#pqB%VfmT=-R>H`3@dY=e@WG
z&()P_M&J&F;l4u}(v^qPh#Q`5HVpBH!r7ByzSUN*bQNzX41vEMDQ;beY92m^R_$g5
zi1PqHL!K#Ad$<>IgW$S6$17s&%5f6zy3z0FNt@gL5-k6fC&j&A{6L+9U<ssh%%Lq*
z#<H`Ad$23r^2!9b6kh*&g0Z!=h}ADyqOGV@XqX<4T-C#mxJAbJ4Bwp^9L<>;S^bkD
zTy3gLtJ=eXhm=zR#gJHKv-#{HcI`<ecRO`?$?4z`#!Kt|EcYX2*mA9)EG4IT^$&jp
zcc2@x)$33^QYG?e>c!t{ec-e;CT%T}1C)m>LZH(Y{(&iKa48UdCBna(axHBmpLHgt
z<Bekag~s8*ZUuZv6dV$QMf2@(7O<o_mDT)PnOaZ168&j8I{Q9o*BIn7_Z8ACw7(H~
zCV`kBuCZvEBi+L4n3h&d%sX1#&ZITRQH-r``5d35-xz%PBzFEBQZNW|nN&e#tU3eI
z$39xYDnD1eTd%3g_hbfzg!gTJte<+<msf8|m5C_aUZ!ns534c$8x#gCT{B8zJt||r
zV&iSKfm1^eXD))ct2?}U*~fAFv6W!y+#;H#Ta3hjU5oS9^u^EFqX;Ys5!A+CGpCK1
z8G-ve0s+S&QDfhut-{@U)?ybS{c|MqYLco+Y#*DB_s^;G^+>mD#S6E3c|z1hJK26_
z4{R0uYv>(g?K!u`g!F1kfwc^kM2L3th&;Yi9?-?t!29P(yd6=TK2w2v<!I|56@(y>
z^+?eeSX}X?8SSf~t2_IxTAT{9(?5Du#tc(?X;^i#?<~LnHlxO0OrvrHc;}NOL-rF0
z(4hjO{x#arO%!v4{cGEWrMCRq9<i4(dVg|kMLhvV;FDXH(^Lq-J|SB3A{N58TgoR7
z_Gm9i#dL5tT=RG%<aNDiqhehyr<SZt8pG3K$9InQ$wpXd+sdBBawgNq-fm2|sQ$$$
zNUP1Cxs4he49`UL`Z(!DRU}mf@)h~HW>1QtK6PbHvXw1Y)j#+kX9cnY4PSL*5d47!
ztb;?5J;j_eT^`uZfvFR3mRZ}e&Lr*q=RH*`pP{r->Jri8NPyFVLJnjkLRvEhNZo3r
znAJP7n%)6^ZkTbcbeEKS%`bJ&m2N+-a(gh=f4@Z#V7SbaM9%c!;*|1MrZsl>wVBP?
z*1C(-aoPR_`-PgqcE3kwkIa30b}g?4YR*XzhKZjkC4kh#8T!3jfs}1ZfBYzFd5NZG
z&0b`PyG+})m913$;n6GRbiWwp@Vq`q!lG|qM%*ep$+OZhYmwx657o>^Pur>x7Y44o
zwK@M=G&@Y?Pc*QoqCY~fgkHf&^xCRCtP5Ql{9foBWhcX`Qs@2m^FH!R6y!F79x(}_
zM|%i}Je<>J_S|x4`LSi<S#z`fX1uz6NbOPp`#oKUb=JdzQz`OgV7bVwnqm&w$vz~{
z(BbjsLetzwznQ(oR=S1-e^y0K03XRlsX{?xgf8O97xB2tkEA?;+{23P=eFcI){BYh
zo-fV6{a$SzTpJG(xn>ik!HlFbnx1i!d<Rac;OXwGoHKz-Z)K{}*G#4xEpe>sX|L3;
zwFTz<;y%w48!T$MV2Kc$l!42uruwYjIq8hJiO%|}7?$Fb^`{=5+3mAlap1jHtWYfd
zCjuC%1)M*{p3-{YIx{P)2acaDNZZLpgbLzBZ6&QQ?j7HqG(^r{Qs<zUn=$kN8=V=_
zN&R594=e-~8~d2%WPim{kxPO`FXi5=3GSf)hY3Opv4>KOcJmw;x=-rG#((!g?FDzV
zr0lEa$>GZwt>d~B*?(?;TXTxl)W{aV=ZCxV8V$>nBx?pH(wt_2j$yo8cC+<~X6A0w
zO}x_1>G?;lxzW_4ttOF^D;r$<53%4y5hCUXRfcTY+S&!+!&<yd5w<rABi2^*CT=9V
zgRt@%Pu)iQ>m4s#tEFuNDh$;?ymDd=0|K<gcEElE*s8&%lz7N?Ij|X`e5tpa#=#`%
zn?;qRI>24y*4Zr*muc%%^_e1F`nL;MbL~%|ubRuOdbVY!qvusWBZ?49fbB&QdT?UF
z^C8I>U((mc<#2t<_MV2M@an?U{v505$70iH<PUg{e}Bk*V|JR~bA14}hk-P;ZmNWZ
z^+yna`c!?`n(HTb@ixUUwk|dyIgCgqjqr_8^EWOoPiBYHy8JNUcq$i~(3GJP;mxE!
zIra5ZXGf+H`?LF?(cQ0i9-F^<dR0<1+Kyp=6F&)yMbmVh$A8&XNk8siR4GEu>+vAw
zMVS3{`7b|}(-lOKHVJbBfHoe`EA6yVUItR`dqU!nEH%ZEcDDQ~Ul$P~UAc)HA#bpg
zoaz@pRf1k!jY4EnzoFaKV$sjQi5e5}fM+(;9?7^p`{B;2cvstz@}I`++mG8*UD~#c
z<T}4}vu^?}LBmAgVTy@<24jG@*9k3j_Q9AMy8^HRcUNa^omt*;WEI$!eieS4&BcHI
zY;Y)23#kiNz#v&j()~n1c6@OWeNM&B^Loy<wh@4Jm-$4h_8-vioY7zC3sea5iwlA;
zQaOWi1&H5T;TK4qghH$<wZW4BUB?~vUyyN1!c}+7$f9V1555X;JTZ_o0~u=tz;t&D
zs`JY|<}`*-VJsz%ZhR(M|FUcp3}a;u4)oqdkBY88{!5MpN>*prs6WuHk83i>#%D(4
zd%V!t6T0a}&0ClW<}wp&XOy+z>@U(-(Ko%fuD%NKR?>q&Xra^1gqVWRBi-#y1~o$Z
zWJAv2p?dCDyNlIaP5kGC^?Blr9<#kYdgEi4u6U8|%Hd;@3a|*(XsN7+DY)eo_lhHv
z4$5Zfxo%@p%~=q2bdCOS&4_>=u-6Kb90hwk5u2__OL&~+HR*f(bEP!Q*7BFpzBO<K
z48CT6xM8nYg)p;{kVb~WcRM1-tZ}B=EGB<Uq_xGe(s^}b*u5Xn-qg{u#URP-o<uzW
z{gH-U3=J7(a;}Gs2)D&PM15?&a*JQ8a_VYA0Nc5@&%fRWiFap{&>Ql6B&MEIZBY`?
z7LIz=(`<~<sB&p#&{g!UNL<L3dpscB<I6@`=Mmh<UXN~0@+~~-u)id+n0KlnFoSi^
z{~2dH`l&%&lW^PRQU1oaQ4ZpnZ{a@IdPL*w5X*>fHtmTjhYQD;;!oJNtltg#{Tf<>
zdv}eq8pT?YD&1ti5uHrj-sBX3$P_{inY|M$(KjJLvh9I!X@g*-yQhOW{Ty#g9NG&N
z#uWP|X_!0DaTJzaEjV)~7E;Q&i0=5u85xINeD$H7cRYJp$`>^~MRthYwk`H|`Iz3{
zc>E`yOLi<3gcL)r0}bbbgh1LrRJ}7KMfu}u@t|H2Oegrlj3I%{02qC;A|@TKXv>pK
z8pYqzi9Og|=uJNQX2`?3thc6kB{qJOkFMedPm^C$kI<4x9~T-AZCVWJgP`(y@1*6$
zb-4w}wtcS9>6Eq6MIBsw%x%_gevqv)BvPQbk@gM}rm2Dz5E)$MpX{<My)W1L`PnSf
zl5v9Z)laF$d>N;?(WT7q{)e!&JPPv9)c@CfjC;u-o9l|#nP`Tt+XV|4h+~XDK6DZ=
zFmy4WeP2zuS#o}ELBM5Y_Z*HIH1Uw*zSL1x<@LKZqJhefjHT{G&t)2V^yx(KF0wtC
zVf`}v!wl*t(Dl^l8$-<>jwD}fq{c5~OZf=jblmW9{W~X*-YN-aE5|L-Ws6}00|k4l
za~iz%eQm#NU#FMXu0FeLZRlDk3cly|C%M8I%Os$Kd!dm<S!XyBfB#CZAW!5~^}E!9
z4#Q3M?>(u>OduuO<!}A9^(mBRQ}=m_>{}?`!N<at%`@I8y0r^WAdAB%;-6mK%u|)W
zSzX)*@0$HSRbF7lsLHtGZ>V2e&veK-Z)N)PUZX7~^CRU>gRSRBp9;3Y?-WRt<0X4_
z<3W>0o>EtgjT@LAJ#cyGV31}~9MkS^5^xJ#{%H#9t!bBH|G`HK|B)Kh$v-L_?-2jK
zDy2r%{qC=v3Q6*vSIPILxwsUT3|(^61WSHewA5B~Dw+E_4RU;2B$eFneA&-CQi%+e
z6#C2IE1J9^ZEnH}m}+l+ds#sczI(khUMaaE@~!O-;ZIA9QRxu!fz;*$1xv5jy`u}f
z>=pv?XxCb{YnBfnT_Ec1*;&l+XH%)~wM`6uGc}U8Os#_0^UpP-n1jbmhl}}h7W^o8
z%Bw<k9q#wn+<g$7e6#i)XL#D@6NHO8?e`5xSzYIl(&Rf15wUTuGR4@G&4~2!iet`Z
zIk=ItrytSH8gTmn{z;DJ%hgS)PGyD<CMDO(>-q!uw?#A5RJ1XcjLCO*GN<l;wYh$A
z5cI3wg0uS(r2#M#hk_8JLM+3nnidHUXMS_KD;J6LoHLEkNNtu0_`rR1Df<a-1jOn3
z@V7lunR=a#x`xI-+{7cQ*L?6oF$bG%?*8zcD)&^=;rr!Bds0>bZI5~SQbCc?_=0{a
zqxqQ~(AY7#pnaeY5`*BFWjC$dA=*5$yfW_79~gjp`DctjDy>2EkK?h7<K0)AXxGEk
zwKihXS)d)_3z`@13QlfKW8|y*tY`S4UC_0(_1N1j-W{84{!8<{i~22pOP;2s5y$vN
zZX9mIsys<g_$uSOcQ-(^QJ`&UdLf2T!=-^^((0OibIO3F8Iv_ixh=`prTzS!q=R#R
zQlrX?s+y0|)!1pUFjT|DfT;)(Nk{;itc8w{glzF`B_Z_<hx52Y3#)zEpZN{>a*uyl
z*q8b;T0g%5zDm7A9i(ajM`}EEzE}Vt%%A)N%D9N}6aug4K5bA<XdP>6H4*0FXMS(g
zK4zc4S43%^SOs8?N6<ted^BRnK`EUFUWdM-Rh>ffO^Nt6w;DFIs%`+!0FIDflyU%(
z0n|9ef7?90IK$HCRqb^Ym(}jJ|9zf0j!1VoQ#K)n#@@9qYfpQ5e!B<YiW(6|2}Wdg
zH=-W?eg@&(>Bd*V>ytsIIvyXm1DS8m-jT?bDA264y~AVegz&$i!~F~Gt<7zO9qHyJ
zJ%9+V6asGBayd>aCh=*)ifdsPi3tn5@8ot=1>TjiL|KjreOMc6xB}R?0U`L>Fd7_4
z($oU@Af8o=&!hz_#ci#AWbb6Vw~5A%Uq9NSyU8MbzzCv-YKy@`DIF)iOEJ&|p<X0!
z+IrWt7jC^f5^N&m7JsyOYgqBN?CX-2p)ED!YdQbQOsx%KbT=@k`G_wL7fUuo*Emm*
zNe(<eL=$&!2Dra^l`ZN&(p>jJpYfK_r<m^1nV0<0skwOYycM#K0=%t&e2=sy@gJC1
zQ~f6729st5w8ic(C3lU1k^^%?_F6*R*Jw$!#84nl(0$t<umRzVELe~c&a#QHRgf~3
z9oSYh=Mhn;er{bNo!JltZiF}=E^1E@Ye;;R<VWc}9yYOKvac%K(>m0eyqkZ8c^QkV
zT3Fg0(SrO9p_$ZWp?2SRh|6c;vHnHb<j_K_IGV@%mdP^wqqBt5vc1<WA{U1B`DCV!
z6pbSgjnPez9N&@8Q_}Z+;m9i<T)dluhe>kfMR&DOt<B|zt`A4VFR<w;Wb)Cu@REBd
zNnR>KOE4-U6IOnaVc6o=@g4lsSi|t8{=nxS-nUPBH-G1TbdhVOO!Q|?Cb&zJ2cJM?
z^d)%q`;m1C!$W(}c#WbXrb2nJjeFa1L&wMS!W~W=6_8a6r4J{*g;JVZ#86-gUyvQY
zclmB)EOZi!Tid%yDVVY#`rJs53n^!Yf4Lajjtm$pz4&juy3Tr8`L2Iwq6F~^x`1TR
zo(iDQD4D=P>xwo4lkcJ`=<n0)+m#y~U9u&5(q5Vsyjd@2CZFwf2$%cF8Z4B2m*|7h
zsrFCM%x}*fg)P46JXDd6@qhaHqqfVz_}Zo5Sjr5?AA5p6@egT=u(V-^Zb9zz)hycE
z+q5Pjv4sQHIP9I*qV1O%Rv4ECh6TNnuD#3@N!>J|0D#+heG)Db4<*{pc#$E2-a&`_
z-#R$z%KC>dZBK*<p9+06OueybV<3_RkZRdN);SUY30va?R=mtT1q)5YQ7U8x5QM-J
zF_|)kv#J19fz7Sb-oz#;l-Pra_UARGdQ#FZ@WZovB%n~B0@!X#eI#vi;m!k=Xm;WE
zG6gKgl?$yNtVrZKS_@l?WQpmD)H-es>8SUD=5}iK12)i!Yk)HFX~{XbKB-yRQc#?5
z{!L!aD4n!V27Atkci|Z9C1>oI1n8V`PgCjdaRz;Yc1}PkDer#UOzYU-f>y)wbxpR~
ztC)>UfPTtAC-`hAzuKciuE?`udp66;%4#6fc4=v-8Bo>LK1x^C;V^#$dIthsVjO6}
zLx`u83Zz#_6uR|S3BDf#8&sF8C%gH2M^^8wEoeO56YuUUn3aYqnuH1JT+;V!@lpTj
zmviQeFYI^F#OFl?eg<QGQ(!|>@i^<IAPZE?h^a`k_uKOw<x*F#aiwM|F6Y1|<bgHp
zaE{<h=J>KUfMf-__;K|Ko}2M5RSn5#<A&*>j$^J&$Rg@X!`o-ko)AnI#2Nip+J=it
zhx}bjdj!EkhbNZW4Jhp;L?gWAQ2g}y*&1hW=Hu;x2Y)U*EE$A|XgV#l5Zx=ifa>Lq
z`=xKd+kAZm4$bAEZYGnOy7k6b=KJ3kB^yyZPU#orei_jGaxY`z<??Eq23=aWJl;5?
zGZFd^yL>6Yl6+aHb*BSL{8r(rYR0zf==c;3`_So3nS%ZB{%@q{|3t}!;|PA>XtEy$
zk{bLENUWi&;`Xd<DRrXzxp3~p>5~#qWKZ38!Iq{YrVz|SvVDxNu7><Td3ty+Z-~JM
zuc}Q1sW~2;58LV~Vc*rhikAtuOoWo5WCi5{?aGUzN()6X_lnDJFaFs!R%^0oI(*(-
zV&zT|tUCyS`KyZ@Joej>MR+2C?lA@b@4LtR=^Q{3g0*ifgepQ-NxnU%oE2|Rjeo1s
zE!q|j-2Rj`ETZ;6DH%A(k{xa(VCG_)x{Nm|)p+lip?Uu~t{j2P+ok>?3S0a*I^sLn
z1^7kPC^!#&$=gw4k*`_S;cwg6(SpA}4|9_Q^xg=U7;x;Z{{srRYn9h|>by5Y&N*9*
zWYJh9&&U;`e*p3>(eOxs8m&A3Uue*9*0X1bVL?qwQ|TmGg=_HP`Wl1Bs@;*t_40<(
zMfnZI=m4?dMcmps^>g)BQWs=LMSRhS@sf*OuJ~J+n>l#&kb|<IhQ_(7#*zrin*xv6
z`!SN(c9cS8i|<hk|DB1CF*G|lhsyt&?6foNt5i@II(*~I$$+TnLVO)2tnpq*%rK7X
z{duyQWUYAyhZ8EKeboNMYkOrh!x=CF5DZ|l05~&hi5`5w|0?pR?(u6^u<m<bHmo*c
zKIB;s<N%8QfV?v18HP*R7*ZR8?A<n4ziTQ~WRP;VQ%W1YEOuoLwTzseBXZ{d3|wZq
zI$!hbRJN#$I)Fs2#doRKkW6$bjVgQs62^cp>+A)xf)CwI;<iW{NB2_arU8h5D;@PW
z#Q=n`rvg@orf0xt(5?I>tw!loDLc5)T=6Q7)_$kKTfL*x{ED4c|EgUJD{J6V>+=;I
zZb<D*z~bnY2AF*1AvBiwt()?e{16+eVy|fGv}M=!!=O+^Y-6+3?e&QM1s7r67d);G
z3r*Ac6~|@S{2Sr96V--NHj=bQ8^o)?3E{Pa{t%LZ@=bCOCn#&*nB8nW6D;_#Q26+R
zv9T&RKHGHiPMH~NT3uHFI%7IqvXtct_G$D6l%2$7fd|Og6YTP_n)(sERgI0a#<i5p
z!w37am7z29Lp+u;H?#TPJfYr!D*+z^1$<M~v7U!Ka3xA*<B5Rp!)RQi4+f8IZ84BZ
zk*>>E;rzB`;1vEdXb*;ZWX7<eItV3+p@$CBMm@lT$i>(P1Z7Scml&o7y4S+N+;Yuw
zl_Hmn_}aGkpLTar${;RC4!8s93Z`jcqX)v85v3_nX=S^!_`<WY;cWNjtOw(g5gK<x
zSt?%G?z;9<9SKnUSvcSU^xy|_Js%>Z%@WFDFO7lXSpC>-RF*q7UzLCpgcG~Vg&!?v
zqxMtlx07FQ-lsPT|2hd-FI>GrsrW5V5BDUsoaw<r4;C5PiuRiV?LWp}*SA}^#<ib$
z;Of5cO2+M%)Qa@!x$fuq1hOq)GTh$(2NF^iIyXM6oIWOib;iw({l-3~1zkE-*}?3*
zn|1@E1T1S70ibU5^A+`H#(f?q;Sh(C%~JuuDue;RO@K%ZC4Z5uOeiBE8+K`&?Hy$-
zsCR@VPGi&xtfGP)ICU1FUFaKh2>*ZEh~w`~@FRflT(aHQLp?VFcA0M6c-Cf$If3H%
zRI^;OISWj7QeBHUUL;rb@;|==X?SV*I!Mrsfb2tP5{3asuf8?rE+_c;#<drBP;t$s
zy11$5ie7O)lR`9H^$)(dJ^#r_9-|bX*YmVhDESCk4?ra(MCjeT@uB~%bp}|9*$C>v
zW{k66{cBeIv^VJ-ry)&(F#3sPDflaTNrXs4*uq6`NZVUllLi98m)tj~V&THu(*A8t
zqJH&9T0NiRs>1|S&yC!?zW8}8pbg0R4;R(RN^a|sP~v+6V`y;StTeaG$@ulal~?bt
zrU`>NcD&0#cKkn|2f*G<n=t^=_ZFjl0sIvrtSe^#!P@+BPSa9@BgbZD#Yb*hJ0vmq
zo#?d>{^lX?G5K+kWdQ%2G_~PN5~~?35hA+?32Ew{-R>mKN_R$#Ma+|LB+6E{ED`<K
zoz3R!I0qMRu5ZX@8*7(fq4Oz3G{Gk=2t)BDcF(L1{pP)%4dh>5-_mb<abP-uv-Z+_
z;<wz@Vy6L~mwo*+&K-1fNnDp{xdGOfWD*3v;-K%RayXCZZQ~35VgSzDT6Xi)OzR9i
zBP}ZA<N+k*VFa*=dIzE}=@K51RC|enc1JtcD`W|u(5WNm`<EjdSBQzrQiCz2F$<z;
z=x|_b5JC(iTa40?t{LaX@DsMA^lml$%3Hue4C!25Fw3m`!PGCG6C3i{M6@u<=_dci
z)%8#`E*FSk4`PXpq(aPLat9=%q^Dpg&RHNw)5dqn<{{moCR<%foipFiq$)%~(_aBr
z1?;`WaB2KndY8z$y;A=g8{8I%nkEuu`WuFtiQFes{!BT7-sNE&cgr4&DlF^zC`E7o
z?<|V|{?vK+2ElO&tC|)FiMi>5ip9-z>5P51>e(1=mzWLH8QEobD{Jy27$u&dFNB7e
z6SPqhxz5!($6r>6rQbjYUqj88Go`;E&XWQj#p-vH;;^;E(2SvDX2Tt*mF&o1!}|%f
zWSQq-beZ9n4S9%Nwn44gEFeqT`v>IH5DA>-182AgK+ng2K(Xyr6Mna?rUAE#QV^&I
z6wJOW*(AFEU##^YZ;&L(qSkQ0IkyEP-j4O43zzM|ci}|HwXeSKX3H!%509Z<|2?M!
z`!NVlIJ2h?p_zfS{E*RVM^Nr#iQ$~GzO+X;>RsKK&(oz}qFHTp&Dt|E`42N0KOC35
zL_y|Z#PK;zU~9e<<h$5LgfWH*&(Rv5JFtbHzb>=q-|}AShW`Dfc-{3Z9U*5jCj}rY
z!6Qgj1X@f+|5C)*1j#ak-7>sUSR-;EyQO+5#F}Rb%ojCy?)`&DSuqG;C^2&$ylHd$
z$LlLj%bcz63CbR7v}#HV%U%K7G!H)gesXJW9$2CKju`0tMt?Xpqs+5iPy|hoAs#!}
zFYCS9;2as_6?L~|)Ew4q;cvJ3tAuUuTRRW;AR+6?iljJaN?GY%)`gl>1*7v;8peF-
zk2iuWE%tSG)k?uvDM=`1i3gOd?#s*WA7ozbU>Y<yC3OYim+LKQ)3L74jhrrM&TWN|
zIo612Nt)7C)X{EGwyDXWgX||%$)mPbdTX{BI~CO1M`JubZWnfAi{6e5q?8!o^T=1`
zh?yj%YI~COI-nUqVkYPvCPeETLn;k|WZ#YW!{6Tf$P(Ui`~88s+Gvv(r2w*CEW}6!
zkv_nZ5n?mG+9Ghnk0JS}aXavesT_Rt$%~fUtfLTP(QL@6wXRoGICTHknU?XH67?H`
zpA`1?9W!DJQB$wzEacnS8#uE5N0LooZE$nzGyK|Fz?jhB;nEq=heXG1>QQm8V`X1I
z*CiXNaocb2r<G7C{IqE?_Kn{xT4aKJ1-an`9Q=@0+yw5*FVexquE7p%j+8O0uk_P>
z?+cH4hkq($@P)G>PL*knPsyAu(CI*di1qe?@r$XdM8#b*nO=SN0tVE_wyT$Q`+e0!
z_$}wwnrnLV(Jm7Ub%SUDgmnBzz*E*!8qE=!j@|whIw@J%kv=nj{7Kg>4_&aY&WQRe
z(L^%o>z3lI801xX^<Kv1xPiLhD=?fRNmU~cdN&;0@Z4%zoLJ||fc#&yy=PEUVYn_D
zL_nG-N-sgGbm>ToiZl@rkRmNAB3(qP5C}zj6A(}kA_4+ZLhllKkq**(XwoF1gg}aS
zx##Ygz0a9*&zZS%elTGmuvXSuUwNPRDbC<1Moe!9;wn>!e3@>O%Z7aIuNSELpH=tR
z7w(J}ISAoWY<LPc`kpfVOv3XQzWZ}Ba+PR>pD4Sgu+d&KVd6Ep-k74_+=B46G+Kk!
z!8z3Ym^uJV1jwXLP^IGK96P9`S{%!nqe*64s0MxU6JfzF@0k*=_>bUJTc_M|@c?C-
z78>F6#UVpah5yNOyxZeOHtL<#9s!dA5JeR&L|UVa03{FGsgVkalz=S<BT-j_V)WHO
z_H)7U4C5dzmbH{i#7@swqxrAiRhYmAL;TsFG9^P+QlN~$kc+%G?epU)#|wO1iHng$
z*?@YDQ=O&YNmq=_c_p$RIwOwr#uo0gVC~7*0Va0AN0=<eyhvf>s#PLi`X7+{>bv){
zFA%QUvUe?8rfhgoW8gg>f};Nb&JypV)Uoe{zJeVNcNHcHOYh}R80HA2JSn$$Got!X
zDBWPqlj{=SYyWe{yO@j!n8d4*NO@ODzUBTc8&cwuDqID6(7*Bh;FXbxa0uigWTl#y
zAJGNB63j%rfSEDNewL20E~JA#`XsSWJvJ(xdJ}Xx0a^jCzM0Y4N|CzCLyR~G<{I|C
zV;z|?%tAeE<7@t|2zu&zw2LkzGEbo4z*-s44D-N3_b-f~Uo?aT>X~-lEOC-#SE#xl
zS9Fn{m0AP(aU)AGC3vf10?=*OqkG?Zz|2a@>w)RI;n*E&Z0%5;xNBKqfU)^__0w}X
zsbkB|TXvrg>~b#9<%^lr)is?YmIY0p&1`h(^%x@z5F=#9q+t|ZvcBtTA?y}D5YtNQ
zDct;h!6j8J2Uey67S#-tvwacp0f(Gqnnkt=torSdFh_0F5Gi*y&5Fnsdyd9iB{tmf
zTJhUN;B(**z`SOUKLS$La^GUvdQjX9S42KhXA~l%%<?8m)uvNaU+==f9|xMZ(mu%L
z=u*-_41(GGJ$iz#U|5q@QPCOzHTK;!v?3v|agyAX`L_9Nrl)5~Dfv;U!=v}To+iB)
zSKdY${|p{mzGAUz(FUM?SGrms0-i5Hp08$mUbUoK`;3%4G}f6yiNaT+mnc}ljDV4X
zVI~A&HR)bc^fB?C^XS<~{cPqQ<&MQ%>oKVkAh8@oLuxG|B+0zL|A7drRG9o`s7a*(
zj}J8}UG(DnjE@U#ebGNJw_TE;5D5{d!AX+dt9cP_Yy+uFj`%MCTO?su-|O;6@B0<5
zf!h!77P3KH8hlN;17TGc*8i~I?xR_(0jgbx-AvvDv^yuEvz5Ox%5?lh`9)n*ZDWE%
zq`!j+k~_MsL|l|F?3R{4m?$&7mkWd|26n*l!qxwRE{`LwQyjtnr=NSnJ9&bCf{%4t
zM1bq=3IUQeb&c<ESn)>X`8#S?Vh*C*o=wRAkiA}C3s5tkM_zjV2nY!KBKExq1iD4#
zGG-&vHALByBZ`qK1M0A-oSRT;|45vIzO8L(sxjflQo)S1F1DmHUKTLW5L8lb2N4<Z
z=AF1G;9%YOsBS3s<eR@N;ZauNBOqKLL6OFEf_iJ<ACdEf5J9*PbH$tj^g6GuWmdKO
z*bigwwq;L!=UyGyxYyO&ou%BP=+zqVrbgY;-~cGfB4i0bI;3zK-^xKAw+OggU)+Y9
zR(g&1w0iP2T`O&JFf-24>uaU@8<mqXa4Z6&4^LR;N*M>o0t5`|0<@EaW&cGsE81K4
z_ioufx7F2VPgHUrRvrQvZNUS}tVA<x9PTX!*#nNA3;Gsbw2P~T>QfbadazVv-lY#0
zmjhvd#mNZzfcOIVY&M!oJ*at8^yxkmEK>JtB6&x)ll1s}W7|omjxX^s<-|6$V)=S7
z2w&2*Ts@2+K!`W7{rDgc*TQ+H!yWoUsa(NK8^v#v`{Rn4V9|UoqfBJu9lkg7QSA^~
z_(}$ZQ-gYbCml)$ca9rjnBR4$htfkXYbV_ff1M;Xy{A38A0LnjA^~&>l+yult*hBO
zd34a=M5&2k-9`C*HDxx=h$Ri(=XUuo!uBXGHQG-g`lazgNo^=@;sZPq?J=K<Zn+)w
z++C9(lyCA4jXT%GH8+G3DtZc59=_lirdin9K{5c>Tr!x)#ZE2`O|yS>ZR85keoAuI
zN`7)nX6{PiYl|fB6j{n~nVU)6Ec_@#Z<4CfxP;_!nb@4TxVZAvO}<c8<*y0UllQeK
z%pNm<s6pFz*#4^`R{V&bOt*&R-)%!xN&bm=CKJ2X(^Qu8zT4k}&!ag5p=}+Mu*1c(
zdyGTz0*v}rwn-n4+0G8KU`4E6S&j77j#sz~=E~*n-x3_)cLZlba{kZ+fKDNJAw(ya
zM-;SjIii*l6laW$ueVy9x6e4rm$5$D#`%Bc^S+2MF`9vLv~YN>A)*4lC4XbitZgd$
zlg&?B|52;qCS>&diSO1}!ds?2X|w@NH@FJi5xC4`nA+~VN)YF$<KAnkinm@654e@a
zC4k+IT_G9~Jn+8DxMob!UN%rW=tp&{M3!s;*?7=yzbbXn)kwX;yXH#F50blv`2W~8
znho!_`*vESi6s{^PBgNJ7I$~=4KB~kuQgke+j3;^#d*5!$l5Yab@h9%$82`wgx>8G
z7Rhi3w(lsedqIIBy`3$XWzOGk1sc;TJ_05_RD1S4%W@_$-Rk+iK_RKQAj4N>A8IH8
zs3xyYmbQY3&UlLgO~DHB8UKlgk+%%pwbu2E`6xr)^Gvw&Twz55)j*gY9(i{fWpBjv
zTgB%0DVg(^f~r2g{cJ7WwOA@oLS^;qr&|HsSATJPZ~o6=SW!Qk#?JGO9lNY>pH@AX
zc7jEw3a&VxYn4uC$nwT8{$mg#v`k#j=7Hnf*;Xm+g3cwO{d(r{4|*?Wzjo*qs}Gpm
z8O-w|ydQvC0iVtc?y?WWAu$z@K5B3S&U-HStzJo%0wSy9Q0C7bZPWFtZ${aE$(+6M
zA7^7IMVq%#c#({~b|1nm7^r#-rhh4^n=G6`uy|q<dF#P%R&m=-zGwlEA}z1|?TcaJ
zA-{nuxKaoO!eBsvVE6U2)PZI!d+pfMEw0vC*|S~zd}%Fyjo=28YR2Csh?D!yC-d#J
za2ekg`#pQ;Y@u21k3>(O@Y)cj7vLE4p(ijObW#W~1`YE6f_`9=qVpOW6O0DK^aLvE
z+~75@gnJ3!no)QOkq{{#KnUQ`dCJQ(vEBfz_x#lku}g|?(#Ne9?%XlE7{cCr_J~H5
z@QSE24R;xdwWB3PXfP~QS?{8!t*}1FP}w=>c5}3HelJ+i!O=mPVe=x5gcdA(ZTX_V
zYcCx0csX*JqJ`sSrN8Ma94D3Le&H}|`hLhxJ>6ELGeevJ?~@ooAge+PzLE*8Ht20b
zg`dJXT1DBQJpSh_t*tpHF_{DUTFVz@)ey4P(g)xAFEST(%1n1GWAq1!Zlrp$Bn*x+
z*{Rr3s`#_ZJva2{c~1aU=!-k5lt4(ZS+I2Q=(ti31TQw-?h*MKp=5;jd!E_dx5M9L
zqzHhHz6<=dlnb$>TqMA0wZqM?84<6u;gax}M5+B6m=n%q>&-_&#2!YskW?i9NB!d{
zO(MCMmv2mi26!NJAWlQl-E7I*Ru@@Y1zS^|82*Z-ch?s0^2J&EdiAba!x>I~xUOXY
z(bMquhhzckAN5f!R0S^PITV!*+=A)v`}jXl_N@E%Xg^-izj2X0!ry4$iy-%JE(F>Z
zB3PQv1By<+XZC9&d$Ur=JUyx!MM(#WA1M~>=4MW|b=QtGCU>-gj)3<{Wpp5_QG3@M
zFcxiNQrU$&87i+r9WEqq2Ib7Q&dSGY)3Y5y0{()!#+l!`fDVoRLxG44)et0_HYQ1z
z?3iahlv=zu)8&{!GnVkvaWSam!~*vf4>YCds&U@<q_y>o{)TaH)y+D$H8zv`&+9o(
zKaE<1!`tPE^x#m4JyR6+I=xqUw^zw<Cq7~C4;I|PBnhX(8sQ~$x*lT?d&O+wH$F;E
zC)8%?YqBf9tg9YcPe@#S5qkx`be&=Yj=4VqtQWHYh#ZKO^2ZIJC7<)CC<>%r{zOeg
zRtA0po8gf2oOmRec5y|Q3<gSKhMLh3gYVA07HQ3mlY)UYBHP^2c{6n913kPV<HT#L
z>aINj3t^I~cdHsujc;DFa#_w<+=lEGe_`612V}+Z5x}4yu!Dk+6QtWY<GYet_<4D1
z4zDMb9fqISL&t34Kra`g?M`<92*q1(5#LN<&cijSir*hK*;;MtH-~8?y!v!LeSG5%
zJDGnn;|_*gSl$$6t1{)9LfgiFT{>wTMGXw+m?pQ(gXmT{qV^QcoWkwlG*H8{40|7;
zg;TY^pqhRTjeI)N64w0v5+A0g@=Gyj$J~##E$36FqG3=YvO^lr&ssFa_7}tf<AM{i
z`i7HU-+0B%o_Q$RuzQ#ia(?X&80CYf#}de<0+{*jeE9EAC8s+mis1iF!6I2uV4-9^
zk9hbVV-b8?ZW?aqj!nl+7~nP667G>5>g(!8PecWi`^@fJJJSm0fPmmA4nRT#K9qt1
z)||*6z!_*QP9N|D)56;?OG_H2V&O(d7W@1`tWaqI-;VmYhRY3o?T`ngMts~FK$nI|
zU=-_tO|+bPYs@OavAH=#dCtNzZ|5GLMDNTa8fP11qMFAlG?L6b3G-PCdLSuqZ;a11
ztGPIlS$TRpWzdl2@rA)Iu`pd0V6mb=Ie{bLH5p-BSb%+;we4{n7&z-D2;`yrSx1}P
z=J3^}AXJHt7`kFTa5?y){NVZJ+WX+@`%5Yn7@c<H1)G+psXRZp$4dqAEbUpDh(ezy
z95!c)J4zHs!<q~r3UEjZ)fy9C%wzwyNUt={j8Q)EGUj2&gkeqAhU?6#JJ6i7d2RQS
zv@u_-dcE{PSHv?CjV6O4rr<}Dgz^1c<Lgvr|8i~GK;A4^^G3p>;66yTQo9~M1{&9L
z+cO`pZzQwb#GCZpYQff~#+A_UJn=Tq?1tA-U)$ls#DL6mffYm-!6*SjOO(V~bsA+n
zsK;u3@GEwe6Ypp4|19dzrmhkS(AQW{{{si=9N7lNi!%|kb=sIpA?Kd4sNf>XBS$jb
zz-lw#y(EU!E|3?O$N{6qkzWO0^c?u{<T@OyO0fsgmama%bJ1}q7IGJGv&s)Xx8SbW
zZLg;y7H9277&I|4k1PN?1}f<EvvJ6CDBFxaf8MS|lfmbwpIIGRW7i{2RG*3bW&{Mm
z52cwF@PRl1ydMwxtrxUBFE9xwCB5~}@L&QzO0(?!KeWo=e}DboWkr4C{dNA}A$1b;
z!NVg%kqcF|LHBs%jB*ZF!vr7bX>@!obLx<K^ZW5LQN5d=brQ%ofu7gYzDAic*WI>Z
z6^ou=VNzA$Q9hJmo_1PL8id$_O2Z7WFHu;zUI4Prt4t8S`91&ro#%2;OPC0rXLXtB
zt_S>kk6?D21p5m|EV37?W)$B&<z4i145DA~{@Lr}$GhUyVU?r`HK(rL@7rXnoK?@>
zEn_2sp^e%%y&JbRYER{0!WhMBr|*&i?Z?KM>$OI+Bke|%YOE_t<4xEntd7beoEbV&
zV5I@{nXRha<_~FHYeS9kb?l4FpUu(anYG$FxY%w1UVK&8L1y3*m7&H#!7C>eEsOyW
z2TM-p+_qZjoErR)rexBqEu45^0UNqLm$V;n>brlz>b>>0%>(j;mv(!XmL(_Qo^%K=
zWxD#VTcID!LcI*YshD($1Se{pN36}BXS}W+E;}}zw3!=Yuvo4f%4dXUMi-w6)`@_P
zuw~Z>4w`e91CPs_jKY?fEu7}A$n-7(P2}o>&fUft+jv$r&!k-&OE+^@k-ar_!`S1h
z(}Nz7k3grU7)4j96S`C>iE`0%+g!fF?TakrC#ALW3^)FZw?bHL)S_ms+oztSaDO<5
zpX^{inZH5>3bVV7NWz;oDz~Okb&u}zx@jgA;wMuH4);5GAC(|5BN`0cUS}3hz5=}1
z%LlZPo=3bY_UFG=WjIRH8c!I^xuj#aj7PBv_PENVM<49zt{;DMUarlZSm!n82ohg>
z1+kZo%3zjnpY;oHB)UdU{sq|s1Hw7}!GQ3@9=s=AM0#i&<tpqPIrwHSZuU)j4PqX0
zPaFV)wdRlc%;(9oIW$jScX^Ul?Sc_isF2xT1LA8a8lr2%1l)ck(klLGulO}Ge6BoR
zSWc<<Pd8axxm3f#;7E^K=ycy;H7=_c;k(kCsPkZE4CRVoavrMFUgX$Mw$&&kT*q^`
zf1LSAcH;K@3z|j>HIY8Z$8lud{uEVsHuUCs@yi+KrmDqkOXrP-h`u_V3h=yA`yH=d
zv{>!de(Fl2I|o1fBled?`V4u1mpf<G1bvT2lk8<X2(9#p*t#p|#au`{pSA<b4vUxE
z-zp3H`5WcG0mkKG`cnt>F8>7;m3L~BDu^<!;0*8ikW-fIqTn7*ZW)jI<d2EV>(f_7
z_K<m9n~Klb;Rvgvtf5=wTP{yt30dOcc(-LLUOZ9j`7XE?07|5D4|9VGcf=#c|5>Fn
zEd1opF#-0e2&=tRoH(W{MCE5MWNYdNOTtj)BiGz+HARbi&ef^mI0R<FeN*Q~pT^hb
zGHF~NCg1oSB1L&v>y66Do?pK6ng8dszaWj10r0HXeQ=M?+4*z^x1nQ1T4KNPfG52s
zkaV(I4PzndfTPPzyTG-m2nC6^OcCd?TgQl5xsLk6pE)Mw@R2ef1g2YqtLOeuQsG~a
z-4AJxEVT2SDz{yyc&?=1?KsFBqBGs3w6Y)J7JIOda$Ba6;4?ZUe{ESaC%u<1Q!$wz
zxN$%>cn0s3bb1lmg8c==w%EC=`8q~qNENzOd<y1Q>#a5-yu?d%!Rknx${Z|f=cs*K
zk0QHjt%OhLrXO6myO{KRHo05De?eOci^x6W6|e}C_*o8WeY((`qg9N}n%lTIZMDF@
z*Bdprus!jVMJ!;msh!|>Z#$eis0Y%6C=TvxWtb?KIc!yb4evoZqpAx--F|8cutNWR
zq?R2PuLshpAGeW45=B4qjXz26C$tLdx}Pd4w}IE}G|Pg2wF;$U3+mqSjhKT;0R-#2
zr0iB+txM_b=?0y-JP@lqG<4RnU1hTRI#d+fGxqOcG`*Jga&nts=$aGEBs)-SP<#i2
zhyvG^x(4wS#$4|E9CG=!tn0yF&}Dq;L#$L5Yr(e%f{BkVwVxn+lj6V^6cCg){hp2-
zuJVE<e&`=cI2(NL+uU8s&bfvBc?}jy-m~p9bDP^;lbG7plGr(%iq~LRL;%#XBLGnX
z4ak06=JBj4LMS?{To%IFaM=}i$w1E*ocTb~X%KqN#ng$+J?RtZBQ2SbfAlpp#p>n&
zMdBGh3IWFRYe(@Su_9<xk~Au)=*jjJYmOIpBWFTawLTE~rtm%W82LL>cieJL^s$Qa
zjnMTg0pZY*q>iMhWiVvr6RJij?!X&Be$S`7lHQTU67mvv?}Z|z1nMKrQ>OIpyZ9Q=
zHEVB+q$3-uDnVxaM!!|`1R@pF%`XAjMlx-nf5C0nll8A-OGg`0lt3k-eSF7!iM4o1
zf@Sao01+weKUw)iW`u$89BY!4cc$+cm_GV-Jo}}gAw)5FxRfTD!6S6@ny8fQXQ}<=
zN<{Tm=N8@+Bi#nMEG2MQ4){4)TG@o${R`4dWH}n)_L5rbExQE)PQ0F1CG9vVVwqNg
zeL#{lxrtO0?_Z=VtE~k2NWA>WR1gH{h=7ji?CB#CA`cH$3L!!q(Y_e8Gh#mPVaQT%
zQQX}tKjglaBKfjT-yIC_7G@ITNW~tl%0xd>wVDDppLhvNnht3Jd*-)OW#N6#RZB{^
z=n*v|hwQQ94-fbrS^wEzxVsYk-anO0$AS$|=iF|&K@fxKHB8pss<+<f+~M-P0TxaE
z8mS}3BuJ4uAy5Q5kHZ<^omZA;=T~3F5tN*lZdObKwm$xjjlY;V1QNG14}Cum36-Cw
z$deAm($`)sy=7VaXMh2e)Mi9Vd^na?@UU?7SamnfcNj7bK(3w$T)|BUCvh7n25gCP
z_&%61HXQek^reQ!NDCX4Aicjo=Hn__D&jQleN<y?Sk%Ehem^F(=2Bf!b0{#X+f9j2
zusXJQEs;IoY9UsaW7VDnp{t#J;PCuyC5v=cocSrWk>JP$$hoFI-8Ek2_;tjmyFdUg
znHE7{!fWEf0LSE{7!7$WO>_-|3u@LEHRFfw9Zp<g-}o@_aeYbYVQ%0BrU242yamu*
zog<}^fhLSJyS2Xy{Mv5%;oC9W-D#s>6T@a=Y8~~{w+v&|q8qvjZNQmHLh6Z<1eJN1
zFxD>wrnm9~-s#7t#8$N%@c2CF$1c=nNYKFL==-M!_pb_a-8G^1cNp1@0Kp~*4m+n!
z;JsX|hw((5WCz~SG~tQHVayk&0Vadom=U*^C>8ih3@>+eEnXB$)7?iiS1Wy`*Z#)A
z#>^aWr)*ws@179QG-1a{F}xSCY@Lg6{|PmNLfh>OVOh#(4}K?`+}oX0&+qQJVyba3
znn`((l}xe_HmTDC@ZF&U)&^cY&67s`d0S{FYXU4rjFK%=CgOrqM^vIk!swSazV(pc
z8JG*cFc)?WZwBNS1@k|ZAgVe@4tIEN{-oxQ4(z}27;Hu42JYy6A_NQWHkxDWU9JJt
z@Mc@A^xj`Ldat>h4@N$jwLB4JC9S+s`z3-@ukXqB!hHk&<dc8Z^vX!M+SNcz{c3O2
zR^-v+hUu{{jm|tqX%g5gr8D<>*aa@i@f-*%egq1GU<w!mMrUseQ?CQ0ak4-0CdugQ
zt9_KSUFaX2zIJtT{Z(fKNNn{nMd`Gdv8yfMb9H{iuhNW&g<@=MU!ByV-nDWMNPady
z|1k^h7+0Ow)+o3~=K8UF8ooLmSq4xx37x!56Qf$Lxz4`kGJL-)=kFxn1mCGW1L`6w
z4buA-D8Ue>II4CRGki4=eLy+nC8#K|3!axaU{S-5A?P<tG`X}nLInH?T^0yD8<~y=
z>(PO@EI&d=yhr*>3<|{3Kd4Hadt5jE&04kpnL(JnfX-%*5T6`XM92ER1ZY?b0eG1^
z*Rfp~{h9ODmTb3*dga;dVdEG-Y2av4IVvBx@Ao*hziQ%X`lcVG^Sao7<R1g5Or#nk
zL7!+yDkItxEP}^#uC`(t8^`Q=AB5o+_nDbgEW<P}$~`yJ&DFVBl`yywBhl0PkLMdo
zyocS2)Bx?aUc}q4z^~v3x^grsTgJb*Uo*%di{Es39E-Lt47KcfXj1XcUTS5H!ZL*E
zC&2T`=vbyBkAt~_ZxLVM8&|VcyA|V=vfQo4xpqB+N*DXR4<)?v3O~ltGtTr~*1=lr
z)bEP`!NAsdV?cb#)}<SK1+Pe-&2+ytXR<fyctvaZ!@w(wLuKKYcM$<+5Hc;zSO59d
zq<1a$m`=1vr^j`FqbIGc?#~n?Ep!_yD{?0J>+AJ>GJPHnm)mxL-n@GsY-$Hs5l|Up
zq1`|$Ss-|1nU>7spVytyDyrxg5Sd%x%w~~(<%#w1_$3C6z+X_l{AjMsTJ*5q*@r7k
zK=BnONQ97w@K3PxXt%M|lYOh@hcVGxKPR3YSpslKDcGcSlHdo;1TZk&7R}XvfzYdd
z@oF?^FqP{PTT?>{_T-16y9O8Tmy~1XZAmK!^VET8e!atleCbCWs0U8}H5BE)eUHpm
zkjB?TcuQ+T2|w7-_vsxxXHCtkP26X2)K1mxlqC$A=Ta@rYa(IgYJLEuY&`DWBeR2R
zmiC_2VdOa}KDr?m$gDjc#6F#uHWlyk=5g>|hWOdZnJOfCC^p=4GjZ39^tO!2_-lhv
zWUxX#5Xx!`?jDs+KOJS#(8w|C;7QfKyS0&Q={48fv{t75cyoK`zXtSF{T~MOwB)Uc
zBuc}st>DP*MvyM6U&V#aw@#$rdLHK46Ds4I9pf2zYg@UP#A*c$xvIo|J&H^H{Tfgo
zVts?<f2@)YBFLP5&*PeGcHc-3FGcMYy;hC7&22HR&_PtdsAqH{skU3M*T8S@oBDKZ
zrRQvFwmMtp==ljAjXw1)-)ZvVzVE0&2fyfTmrZ_ku;~!_?U#q-67u};pY!I?aLCtK
zybj=v+yZ07&~)JtbTFY@JEAT=x9A-K5>@l1d+o^LP0&{}JvvtCNA2i?dIqz{k$hl3
zV>?rfei!t*8jy~njb-XFV$@t^VqGdl`W3V*H|YBuLHoHnl?I>9*f>TCdX9QRYNYp{
zVDxeJqwqQn(cONJx3X+C<NKA0d2bUTJ|MpR5nlVWcwYMOJ78^NyW2oB=;av73G$AY
z2j96$(pb~4z;YU5t!+QZ>8u+GHNTQcx3iMfX1b@sD?ao4|9xui-HWemJ3akE^)=RB
zH>N(2YT>o4XG$Pb00<y+0tVFhV(dsa<QmZ#7z_{$YVXJy%hk2Sf_d4PPwQAedLmLK
zE~pZ;IQn9Bl-1wD^X3~_l|zUz`6`hILTf)MprMS_Nr2Qch-e7?iu~$M%qChVa|co$
zoSkpEoIj$eGPcviW~}vgz-IwyXav}?#A)!?kCp~Mqto?UuxW}v^Ti0iNF&`V?ltFo
zG0jGhBv05elS*27mx+29^NgSZ=emHhp7i3POI_pa0<lJNS5=D`s*qe&mjsf-?r5X{
znL!{VFMfVyU%#98GI<;`J%Bc1e3)7OVdX_uoX5xRKSB?4?cOElr2Qh^$7ig7-?g$e
zVF62;fQil~$&aLsp@q=vb+T7!mi*jcMIqI^AmJ8Dz~HKq%tfBcSW-w@Ek_jHEyODZ
z>KZH_J2Njy&U`58=B!o;U9Z1P`LvjiJ9I3f>t}-QWa92Q@!`&dX<Xb+(6to^`*te?
z6P&ijC=wTBNR|5XjeY8$ey+g0u)+lkTOiL^i7Xk_!w6knKsApN9X5AWAP$N9p156y
zbF5g=id10cxkmlq>#;(UV={-!5Ac~AaYBI6_@@SLS7(>x0#I;YbN#cVqGDMGf-}`%
zA|wP+f-H@%MvDj0^=@9tj|%D@C>qJ|xbRXB`b+Gy&vR-6Pk7bxzQU^XT=VKa05l`0
zoc-p^vmC!KIJ;zq#2efQQ_eq<xz-diAck$`3%kuONVzR0K0p>H-h!}ri`!oEukYf$
zOpxqrBv?dAqpJVpcgVgq(W^2T%bt&2I}rPfg{CNRA_2rI9F8$HibPzHUyjv~!it2S
z=u-yzxR$$&_zS1#TTj%sS&kOT2;3BJ=Kz|h%l~21tIK}t=jTKn-UUu8(9L{v21?OB
zwJ_E3Q3@?U<IoGg4l~C%c1oH8C*2~>l%Qtza<oOoW+Kif^D6%t!7^<iy58;48*6sP
zQzO8rt(s<k8OU6WoGx$W^bgl<!TVvA9xh3>+%DO8Y0o}D%F(tQjG&Q7;MAoy?D$d(
z3L5*LEXr60@YCH*&`>qe@BYnJ?sb_qjB*Ssjof0=1j8;dLb8S7=R%=NCH1+oDY5Q*
z{-~}beB&~+yhk`D_(*3Q_QSD@edCFM+nkk>$5O-6&$n|FEXNW4C}7`5>yinMlu|Q7
z7XYknME6m)k%^!e*8_;xE4e;P`;Le`zvn-`{$Lo+H+{@UnsMGaM`ew@74%wtzPF?A
zcjgV9wg&FI-Lqf+$-@5sdSwByULKfaAQ}-l7d=*`kj;@d>AguQQSU3c`EA)3^yM!o
z;73^OGJSL!XL1S8L}Rv<i>GIhp>;d2SQQraP9DzYjKAVCHMT%SqslS8sre@%O#|JO
zdA7V#Pc&W<!6G_ngLUNtNA}ev1DN*qbw4Tc9Y?zF7!@PGio<%DIL!*!VX8=-??euE
zm&8W~2h)@P%z$5K{l}yG@A3WLeR=W9VH_iZZ{V#>F-8eBeLmUrmhamAoL@KRrOOR7
z-Mhrc^7O6=1(1yHef)@KqX0!@&RZ>v+-R-C+hdJ-b1se5-saTLRx+4OSM?S7g610p
zfhcbzS5R9{mjw@lF@_@{kZS4pHGJI4c5RS-SEZ)B=-cm$I-*()Trb4AW$t|v5D>f;
z_I9%s`!z)44e6_VLk&swK0X&`)(oXxyjpaxPtZDnA0L#16V`m+X;0mL5yZrDm<Vtz
zE;i$Z6?PBUiR@SuAW=*3rp{dMZ2A&8wCb5%#PHG}N-#pUiedFJ106|h^0<V@Pw&T=
zf^yeXz&ly%!KgePv9xFSFjs)L<G5&k4xzJysZR^ax{#@wgM>{MI3(B3%7iEhNZLp0
zzL_Tlga!T}=Vtgkl2`yIURt-?@DL4lB~Guur2*<50*E{UsUB{Hx#wEi;<LK<hS#j8
z3)$+U54o%FU(mV!>J8k#^6aA^8{cPA<-g=J$1SFA2wvE+BPkxt@~TzVzZu{NpjHLb
zclXV!?iSB}-EJ3>(_~EFW%GX?n)K(xZSiTLDx=@P+L%5n&!}|IbvN6%X5Ps?VR1L+
zRXM}WYeU%`Mb1#J?645a)X?$T-vCb#h&}K#!XID`Pgm=ZXm!_472o_jO^ADqiBmgH
zid8?FTPhzi$WnL3)o)T>T;n5_5rBqFyRybr@*v{MQ+yO=x+mur+sy=??zG`tCpQm!
zho{UtHzih`S=bMZTb_le%QF227{Bc>BMdt}YsJ92EdjaH%4T3EA9KRPyejF#ZftA&
zPEPI3yQS-SJn!~iQqo)m$eciGt6DHi@PNi`joWzVHEA~8qn<I_?bCW(S>aN7?|s6<
zTTeP($goLsNFLS$$5@sJGT$zd$Coii%aM>;X#5SVN7ph3zD}?@UdQ>{%(9hEp%v_V
zmHe$CM;VI@Cs{?bW#|k@;|~yL!iDq2Q{)B@wNe0`7B;MKGg^|LHa;CSUvF%y2gJ#O
z9qVN@>GJu)+7&T_3u_=4iJ<%M^jHDx=Qe=RZJ|99)a<^oPpKNH43o#?cZDtiCECkK
z*W0li4`|*W2xZOO1P1}Wg+c@fi~%UK9pO>$VRD#*=o1vPv-z8h+92N@)yDm2H>2xD
zYmDy|UvT>=y!@fsE1n{YpcOn~C9*HNl7@$);n(ruodNQRRy*p{f4EEo-r4sz%H37=
z58ZkR5-AU`K#ko2(*V*Aj1ejlT7`-SccU0uT+wF&jVAR04uC*wyZ&RsxMD*jm$H71
zoxQx{>$#;oKGNEMr0veHSqcIBX&>P3Y9)1-SuHuWvcSxgg53wjKZHszIyA)>9k}{3
z+kSEE<C8Mfg5NXSgt7rfySMSXD}l>Vi0krBwPmcQjFpE~nqpfoM*9F4F`Lh_?_cZQ
zHn|Hr7N;jjn)EE2PP`Imu5L~cj&%B{_NJGQAu+y@q4W}8;w5A|Q_}L`CvfDl0kF@%
zKLq^>tdo0jYtUJ*?xvjVuSC;dEe4oY^te_f=1(DAOFEmon5-U8o1oj(D2B@X2ZQag
zDROpTf;PEhnX^@pJjLm_e;0%3X@W!{Yb+(w$0hI0S%+0ym554xFW|6LGDIbSf=i~`
zA>61HMDRr*bjzUBm3$ljY3+BZ&nIT>u`-1s?PQAkX7p60Q`KUk^9}KckE#21Ll}Wh
zc<trzz!KCx{Td^%F|F3QRAIo|zPH3d;UV8=%@xkrz*FJ6O$Q==#f%V{=~qO;YGum&
zmC)cWMw&-vH>KPZ0>z(%eP&kcD`lzB<$l=&p0Dm|V%s|)Tw8>3aQ0N953cyPGU0XP
z{eEq_17__)Id@*Z-F(b7%WofE^J4GLZI<)5Pfq8w)4uCFD;7FXEo8zv(6iqXUN{NU
z^$EsT2yu(c{;}a^mJ4&DTsgo4%Fao&Q7E(u77W7Hq&jQxVcqHj%FeCp2I6R?R}(L4
zc{R{}jl9{f+|i#L9*?*H!DxBRI>)@kTEzFOrFhgFkS#2BPXIqgN&u96OiG9UcE%#e
zG|tP!a^x@Rh~>-2kavj7Ew?cPohBn1X{&MU@&sq8PrQDyRF}%c`S~-H2UxT?epC6S
zZGzd3QE{BTp?}<h>2|H)QN+jN9nYG7?ayt_+FxeK&9l>U=%cCp!UTv?{(H}^1dBi;
z_m~J)Fc`3bL`K8eg9Y)=$x!MM`g`f-Y^?LS`VraF6t6AQRx(Mnq;KRaL__@SN+9GS
zQ30Reh52P;CpszZwsQ1JN<yuk>7pU8QbODZ)wJpO@Z`hyOg{nNI=^@Yk9jU!7{+4H
z6r)?0Pv&V&Ip|{ZB;xAoh3-EbzuF`5%vr57$Ij?xFvcCy&`N^|jsv{T0+>RGw>jb-
zVD=O05H5urSLS*ug+1dx-|YYM7D-J40FW0(@1RwMQGdLbqo%4Bch0|<7Q3<y3bp=l
z5DXavJ&tGAO#t!CdpRWidi+0T4^jM`{J-1_OiiRxNxcqQnmn4`7e$Wb!ek~L>)fkq
z9#U(h9V?Z=o)GL@ygFCwCo=vR(2ndv)w@p8)L1lU`<%Vdxvc&OfHSo;(w%IBM?JC`
zx~3?%us%JLned^`f|0&lV1%WU+#kTdt#R=$sJz#2(+m1wS4E!l9b?)Vwi`C3|GvkP
z-9S3fHrTN-b93Kbh=ZsStn=x2=E9tJuH^<T(yF>yf2J$>bC`Iy^q%m<hK#O?Um4Fe
zn=Hc*+Scm|vuT@Nxex~n`&6E=1k0m|h5Zx22uEoBC7L1%T=q7wSAyB?lVVloskL>3
z)T)JMvq0u1U@HIn&zjtPyfRW#p?}pZ(8~I=KSN+R&PVYU41#70?XK<rnG^X#^r2Vx
zdp~iDFg@<NarOoGXSPvM#QURZwT&JhFmg7thOf}11XH(8sfjsL`Pu`<7%zo}_Ji1?
z4DCo$uCVgLaOfR@UbSaYgWnpKulT<e(e%8q8dBzElOr2frmyXov1tft{uJ{CA5&&&
zJ^Y3#;Mm4`hxJU^;hEi)enBbYo++yxZ>B5i`Cn-*_cUq;(i|_#;1o`jdN!s>8|vND
z$22v*IaELjgE)5*SIo8bIXLI3nX9|@LVOg1_#glfGX2PpL{s$@WI3o+;eOTe+9sNi
zCQb7(r_tj+)~@ND-W=sse}=h!)9F(5txSja9596G4zpVn-~+q#Uw@tQJ&P*yb$I((
zOxoUZt9RoMQ%-X4Zh-tbtdO=zHeiwm@+iwN&5ANKM=Q{F@-tfn`#Q(P*RFj4@6A@_
z`C|vBfVIKH+0l&Jg35`|o{rL>Y}*l|aRq-Lb{YueK_SvfFNiipi1d5g&bn~tn)4B@
zfC$g-^l^d}&w~Y?Wu<`QL!z6^V^X%kF!xJl|F=h-_B~R3nRBMszng^uvOxgLlWeAU
z9vPSrZpse4n}`#T(2v@+GgFhDduaduDN^$od5uN8j=50YE~?}~ftrD;`beOT-b6t5
z&&h88xXxX%+M$Y0pSDsYlYc~>r^o9B&f{9A!X$xBbC%=x#rhluy~V2!u5~`dTo~89
zaq)UGV}Nud@tz>~Ws~x&kj$vA9G=Cdof+?AB*Z+0Ly4gz7y0Q`IbD^J{nAEZY~g0$
z`e?ToZ9?nQ$@L~&g5<k>G0~f@c>od=-7;Et$~fekp;%$pVRE<m^)6H=x`4q!;pQv<
zUxjLt`sztEiO&4*^>{U>zy0RrzxKWT&FjuY*MzC#xANOFU(Ohx>j>O$e^2cEJUwXK
zJ=tMaJ%igFj}&IpX|}WMEV^T2c$b^=kjGIk!|-ER;lQ4jFJQAkx4=Jdqco_z*<`ET
zK~H!SFRQyUJ@NeJMECes<W}6h8qCRUhsrfprNh~WRpKm^XBJ3jmG0JD=G9i1#Rr$U
zhjZRtR}X!^*C|z7J`hfb22GDV^*ni9tNt0M4zr`n;a9^f;MDE)_3<2@M>vJG={h;f
zhhv7HeHC^C6suYDt}HC8LoCNuem&zu4y$mU%HVIJbN5A?c@3F3#F*DJ)#`O7zfCyU
zZruz7j(m!->ncx}uJtcFi9h!q;{HKV!f98gfw<*hUxP!6P-On<e2i0IYYOmRxag`g
zr|DIPMTM8P7#G-Bjj((1zo*#ZV8IjCkhFGyZQT2Kio_*RKgv-*<XoAYarmPU-Le!N
z{#Jm)pmvSrG)nTs`cj7hcf4(sjeEJ&t^VR)-zq=&S!LVEWEy7cM3z*K;vkWBvMPx&
zj&H^P=&{^^7>fT6e4FC*uILSCD>dm8QpyKGXT7Z{IL}NAF@^eW*A2Nky{{aeJMmXy
zGbsc6AK^2Y=zKC`3bo`N<#!13BOd{Y)5rf-biG+p!oJE{F`{*8m7W}y^e*Ck$<gl1
z&Ci6(jyC?I<)d(v)Fq8?gs{jnMI;9w>5eM8HZ9#Yzv=1Vw%F=77+?53#I;$fQ@a2P
zU$sJMkpra_<7E_V?Em~ZwnI%7nqpKttTLk1IDL|s<MFB8*ILVpE7`>rMg}XN9$wU|
zy>NVy+Xw0JHMW-}Ce0<KL~{AWBiXySNK4BbIMv3X3$Zu9{GWU=Wvg8UZ1s-Tq@&5a
z{e&Ol-LZ4zv|00&_Zg$e*8QpoZYtr{I3x|8l($?MSsKj$`|2kJ<ON%)Vmjm#_YdwZ
zQIN$H?$pF)tw5=`QcM4EoyuwN;)_!O@qj_m8a^*gQ<RtxFdKE?+{s)Y05K!Gj0`QT
zcM_`7q%)7<>j(IMv0VR~45I(cBeEE31t`*SWmtP-e6rGkn)=F-RO(m951GHQfxfMI
z`MRBaAx6fwO1(@hE^~I_jw>iyjpgh9!ybFP7gRdp<vibb0!YEY3vVHV07!U?Xn{Yt
z<J|FG&HY)2g0_mn68i&Hdwh1)U|@>tbRHpIwFFn_jq1c9MpmIXY%gT#vGFz!6sdJi
z>eUCV&ENa}dmg~b!BflJXwqk(NLXegTHHx-QE{(`GEBhS&p3T}qn-*LW4550^heyH
z9f5fO4$W~4tu>mPM~my1`k$gD7gr<CF$d|YEFbd|8`ssles5$oiBYwQ`05Z@QFe{h
z06N98Is<jHLd38-gUB~ros~g^myd$KSo}WNEBV^JdN7;1s*%JTL4ZVfyAuL9IERIk
z8&2LBt=-{G!(P+DI!3F}B7f&xoC5d(Tv(R<4`a^f$q^!~84us-h$eK3Q@OpkI#H;A
zXCe5KJA!HPV1mptU^*%iqu{|qG-;eHr6Qw>78;LQN1q7Z52*%a%lydh8H=PpoIW;!
zeuQ8wlFsDZ^~s$oP;$Hr2#E6(ZlJ{R<8719PJp(@M8r_g02C0`wJZDut@pLE!KVuj
z$e*QL|2zP~=v!?_)npm}i4~E(`8B3k1XJmA)U>zLeiyx(hrDrIT=dG@>?>jSbvMpb
zgP~a)Lm+Q(4P+mJf#aTGlCehJlF!`NKUwctd9$aJ&!+KDqxjxmrc`A~c%yWyZ)C$G
z^bf@K;Gg+#(lG?=LLjrjXh(fi-S16}zLNaTbvykrxNX|)2}o9PMnLUrP3+wj6c7u2
zx{BP7Kuc=k5=nV2zKClr?jEnLpo|MZ*{J#W4S&j^F#YDefbQ!LBtO6kJr_BH0C_r<
z0O<=^D0mQBjYE{dxa%W-o|^sQA2-;VC3a7^&(X5$G28#N7<7qgVc}TS>j9}laHXXB
zV8-D7b8#k?ML<jMU%si1vtrCDZq9)CY^ufi>-`0#C(6E^DZk5t&Dfh*Nt&kz^gGk5
z@Hr$d{D%h>UZB%d|Ly7lgP7WL4;8iu!9(`2JhzCJvuc53t*aFRTx8k-f)McvwkN@z
zVC=uu{Tc?vk_&D&HYiC=bm!aE51RWIlGZa^-W~~a=`b>{NF)%R{0FK8j?Pj23;Hlk
z)c6ak5Ja87{3VY2iQ|fkyS-BTd2U3|t#XjXrf2=BviZ-H!p~R3mr&PWet$utNPN&=
z&{IA5@lcV){vs%t4X~uExC{tpXQ$E7UXLU@<;h@SA`lBTx5N0r*$PM`eDU2}JkU(g
ztzEn}v5l#p^J*q;1TUaViPQfTL^K8HoC*a&Mg-u$_Gb|-fs>IyoO4<XKrq^fGx;(d
za!-OL(EBgDNqLe2%ymGoEDnk>YKBG+VXvV__Qlso)@YuM+H%04$nEM-L}IdAWgl)u
z>uTqN5Mgxg)o9hp{vj9u=l+Ke-g4X)Ij06ny6^|(91O6X`X#YRq|jO>l5ha=A6K6n
z-q(l?B)1+zNo;<1z!hMw7I3kDR{L&={|k4lbfk!Zh5l1ntH59@DV5UVM!I9c_~Y{B
zw$@t{u%J~&@g7cqrl38^2Z$Vmm40LE3A!uArz}$z!@P9Bd}fdJv&4H!|2c-Roi$A*
z<gltHC)Ha^uf>>YUno`|3it&Hib|8N{g3$OLp%y2kP^J1C6%PJJ3(w+`<)dR7pVI7
z)t?PZzR)M@$una7HwWZoRzSA}kC7vcMr67S!VOE9ZY|!!5ox!B^zu#Dd0bs1>+JdS
z&o$wfK8|;KKM5pEaEIwA;7+>`Q911R>J@d5RaE?H%G!M_RkhWkph*ie`!XW^{*BO!
zl)nS6Xx}9R<Q)%WB>7@Eu9uVp%zWS|PL^+R`Bv83tgTx4cQ1U){jTO1$n@!>VBqY>
zbfGwAJ>izrQc@$}Mga6n!lBhnkzarYcDC!D_Sq+i(l46o`)k7Vm!7c;N@;IBFKPsy
zJj!sw?chl`J<2tSde`cpL$!IHqo$A`IcR~~=9$c|zHzJXky_;~Wue!Dv?fgV#HM?|
zAQ%lM{YMbNiuhnGw`mGSpKH@opTRI*YM#uRb@k4Amx#n*^r~j|#@%&`Za7BQ=-oN$
z9hurc3O$8#$EhM?nsS@#qi^2D(W_%SRs*Ti^<opV6qDP(FtL-q!JqOdbuL#UyHJVC
zye*#Jfw-;`$HLlQoFB$(YqN9uAD5crzU$70S-A3qfK%iJ6!sAq?e{c$8ASwq;iJEx
zan}du2plk5q$=SnfsyhAax9Nbhp!|+4xO!%NC})#<W#FiG`m8<{6r^U01m(efoGl{
zzAaS%tvAERVe`nQl9*I-TMW=sZAt?LFaFDg!~0-OnC2<Tv`1LYZYYP^^#dTN7!m6e
zxM*)Wo)zrfi^|^0*x;I*r|M(78X1F^<8%Lt(nC4^1<ggROz*p|xMpjvmRHtc=06@B
zHz!o?C{mlv6Z)#&G(seztrXR$`}l%xOBfGvb;{BTyk~KE_Pz~sm!?Po&jd_+w4|(m
zh+k6zVqXSB--9KJV#gYmsiR!>;)+ynG1q>OiIf2`9T<O@mn9aye7(Y2vm6bsjUqDd
zKB>bXyV*tXg&1Bvb1umT+-Fmldg+p@Q`{FWr;k_0V547{HcaoK+7XFRdXy6rb^97J
zLS;{7DodEv%(O1hS+_qH&3cA@A8>2^O@8r3ywRQ`R=*2gtFu>`@87&;2nf@>%ITZA
zW;o|rGccMr;)a}r79t!dH!0UeRPS&z^?~OBkNil0$DRXa^+v`bst{ezR<pgHWGHDc
zIdg8L%xuI}W$#S6X^-&?vnvf<tAqGbkVGujl!z=zD{se$O1b121S3PHQX-5V?!dFL
zkL(+98h5MD#&7D1$b3zm<Suz37J3fHaP|HZCjfH@nHC>|&Q|v>gLVZN6r4<!y8KQy
zP<u9O_Cly*eVtlxt#Q|eZU58PZe(yjimg=mQM;P-_l1x}C98S$j*~x}GD!iT1wfyp
zU==)yq5$k9-Yhb6oD9g|`W_K0mfCu_KJawJB-d@FG^p<`?H<yQFEt`<b|BS2g0OYe
zQj<=sRQgrYOkquJss{;YLsmE^{r4^cY<UfeZ-TPcpdv@fM|UwXah6kr(hQL-adVP`
zgBlBE1JVv3zGk4hdJyho#O`7bv+@>7kvT0$Yqk6e^?P$Y$TbyEnE%k}u)CtvDyZQY
z1Jjb*38;xe&b`v`kO+{_e+PPf%X8`njOmZFKJzKwe&-a9+aX#h?-C9lH@zaM!j@M)
z?fwF`gEUY7bIbR?c%?XU+}9$Qz?4WIf_cG!oJOaqvDu3{>zj2N!Hm?#Ar=}<7kx=q
z*Z*!}>CZBtnN#K01)i4!+Nja5f`wtPFq^3>Mo|F?q2#`?E2=I?!6dFuFS*L+*R^?c
z;Wty-qC+-O%B`%IfN2hn7llT{py(M?EtwZ4aV=Y8>Ym+LURBl}4yajiF$1=;Iqag^
zKND(6mmble5BBd89tQtX1lRjT0g$qEI9Z_<laq|54^kIMcbA&NYbkW-9tgbcv#qXS
z%xxoio!`I+v>|E`;Rh$qt*S($DtxG`*L8gdmhuGZboYF7djUDEfk>b^@-T3E9o2hq
z_7ETxeM|le`uY;N{2hdWB*ANz+mmKXIuV%nL`&>NE3coWQ*~E^&&im?QS0J`PBk`F
zV?!m`>2Puvq7Fq=)SB+%YKG9mI}{514beTS0zxAQPfs57u;0U6Gvla~%hxN;DpTWg
zEV@w@G;Quu1L(r;B%Zr(u}s}6C*R8aSeBzjTu1isbE2F#-5+7pl0yNn8QZ*Pc4^oV
z;*~YB)^gnP$;sEhpx@0+Ad)p605+~eyTBKTmT~KKPlm(4SF8jj63H72ILks15abSc
zNTFK={59r#$<$Ls9-j~eea9H~V?CXrYrt;>>6Rm&!dS2oBMGfs+nnVEX_M|_rL`A5
zS~Jq$bt|sUR7>pz+(MeyAH1$8o?=QnS8ezU+8_9H`^KM1&jaM|zo2_Yad6IHHX=Qy
z6wuO_0sga0&YtT6hO_B@lo~cy%3q{mi8o6<M;>P4Q8*)Dq`un**CKl%*I~*SzX*r%
z7P;JQX&}6rEj6ijp~^<{GVdaV?&P~h%E9M~N2e97*=VL2ofSlqhSDyCJ6OEzAW2&K
zoxXj6>$R)|>4*0d%+l$-I>jp-XExrmDnC4eet=-~3={`+fL^)uwu;+5dVL;g<1qH#
z`-$r2RA#(wAn~6nBfpt?Gd<#Jfwhkl8d4igR7Z=KI3{*JN?&}HSNl0BMLUB0<N{(<
zjg$C@RNV>)522OQk!q@FchfcVY_vC)alI~%TZ5~zR)#(ANQt>$*lU8Fh0q9%hGMKo
z&V-<h@I3`!+m`=};{4fK7Alb}LdxD#fQO!*yVrNA?n4Y(Vr@;-=6-hDXQE}l7d-yi
zoNRbY$;XZzh9cZ1FU{4*Xo#Tp<_RWvvtUl5c}%+URm*Hu6F;uxr!Rp7jLY`CFJeS6
zdJXR&{xGq>pcLo|&`zTS7XNd@v@<}FPW1-Q=7>gxu>y<fZ8vu!6ocNGGpe^v$)GXF
zv`uWzxOgU~<|P0hxWyg+%Ki?xtj1yhQJK`sfpUV+Hn*d$DX^JONl9i-n9}#22W5Q}
zcDu|rBql^z)xdJX^S^X7`>#D;mLp^g3cXD99fet;n#WuGE{%C4X|Z7_g+3(g3^#w}
zojf*s8`T4$8d)2O3Mh{$Ov%jGtq*|3b?OAV!Db%h%sR{&<tqH%@X6zBsSe)zG5!0T
zn2qS$?7rJzr&?w)K*XtQ#I9;^_zyEhYfz5CpjR%PM>KtU@42xc(l2XI`ot2oYP;w;
zl_%!qy;*BGvhG1!tflAH5qq;V_CFm}{{Oy0{!abh#iGB)I;r0T4a-46!Lus)V+!S;
z<I>VEc;S<wa3w3^6scC>8dHq-0Ppx5K<wjHz<%~L&7dC1TlHV&p!_{DyZg9iqJ^H~
zQ)L9pu|Z;)YmpTG@?GS64JPX$z^%-^r8p%vj#x6~y|3-c!RnMWkfZf>me)&6{+Xe^
zX0!Z&*@NoLg%gssPLy#(m4=(ed+7F&C4eS+=7`UDXWKE}qvA`L<VEId7T@n=4>&#I
zu49jd9oMVDc%>eT45%l`jrlaz%!cXC#-C4@Ke6q8dnx&{rbYA)>ov<k`w!fd?PcoM
zY%+{K3Kq(2wtPk^X43|8&htj9QgO!Re3}P(d)Osy$9kIwD(IFv-SztS-69ONf2K0t
zFLepVhcS9-+`#Pld1ig2=C;VobPzN4DLQEE&sfU_!UNegc(L@>x9S=pH+~xgym%?P
z#?VqihY=M>p^<5r+i|S~K;Il1)>DxU^<9P%r47=gy-laIiQV`oBwG4%S({wjt&W!Q
z$Nr07J;Mq!Pmfb>Pxz~*l_X5JDA!vTzI)b$wc4D$mx-&19;lXrzRCUR6tIxaEb&Is
zUSTJ8YA&r#o5Ru~Vu0bj?%2;;1J>uf&5DSdiJBi1-kzDetdJ6d5<mOW8U#Mj%7)(w
z6j8dulu`C3xo=E4<ysWWp8=t|Jm=;}3zkh_Zxgj%{b9j6KDT7>FoSLX<_}7WkBfm~
zQF^P(SK=b915+beel5*v!f6xl0`@}hdIc*r@WYpo4}oTCiZ|;i4TJJ#vuw+xK_K1y
z=NTepIPSwR#Cq)IgoCQKX|3b->EX;n!GsFcSX^_nvh?cBl`A?{hw83cSq2~L7IL?3
z-lkit$oYu6d9PHC6@wigo$v^lhns{x0DlZRD6_{W-PNBNtSIO9vhx5i>+QpsM;MjZ
zlSL8WJt0?u-QF+;uuHhfJi_@XDP!56tQPLys6-!jE41WTWBI4uSC_A{KbTwiJT)Dy
zrdIFtO0tLBB18Xr-4Xlzh7XeS@y^PQty{pO&oYmuy_Q2`{~y}kJDkn_;Tuk?txZw8
z#H^xrsamP3RaMlcq)N>its+*UYP4oi6h-ZtsoFF4tUXejP--Ve1WB&<ynfI99LIJ4
zo^ikTalCK;X&Q~3$$6gN@tNz=oyo3;NG3vXp10pi#r-I!NR<cA?c86({?G^9ld;jx
z;<N~M`-A?`Gk&OI4IrWiDm0>8oDZVgt&RZje|y_2bkX~erV}R_GFsVK4gFRj%lRVW
z9&SwuJ^Uo|5xu*wYQsc?Shno^iQYDq57k4(;XrhP>#WMzn_h|&fB89p2hjD(on2n(
zWt~|3)gDZ(1zPh#B3L2{Vj@-Us067A!2Aye?K|vJ2a<jo*YSu?0PM-7dd<3e6})`+
zw$-iKm%S7+={<3l_WYx(o&`bEU?y`~v!5s8MiDozkIkP*Xg>zf*t`(kO<VPnP4CSl
z+3y3q$$(R?%SEY-UBvBqqs{#e`iB?GF7$0fHKRM9bQ|M8&f~lYA680U>)CggA)P9d
z9p8Vv9Dt84*Z9_PK{2Vt-=n->sOX{AL{*K+kLL7Y({#CbSDdus)@PRklV8V`Fh%ot
z6-F!cZRcYSy_=-vHS+`;t9}>J2)o0$<n3978hRpaQslnTcDj&K%;iZtlH0GJ(o9|L
zCV36N?PR=j)O2_J;b|p67h9qhTz$H^6kmwefYGqk-91cu`xmIy+cwS5MK!-rl%4*}
zydUr-m=$=ttYlDKT~i4IpRc!ygFjE^MPzdNG^&+Sz6*c(NK7M7+x(o%m0HDIA<+Nn
z7xER<z0yMjUNrqiOS8?Ani8T-AN~=4f-GJBpt)>p4cx{zDig1<JT82;o(**jng9m%
zxBtYFIc!C6Y-uZChAlObX@`TI>UyF2PbYI6!<41GA$~$M2dEG-&*ZL(jL&L3i*{9)
znnJx&!LsV}IQ3|^S6RN@Y#_>yx~!47r$G9>3U<Fe+8bqX*{3{^N3HwiYG0kl66!Nu
z+*e6$)+1*i9`(2czCo9RFDeB@=`%r#sGC)ZY9w>XgozFG-rPQLY`{+apQ#c5)#Ese
zyeyFj2WD+Pv4Kwhx67f7hHe|Ew?Fz<cr?0DmyutRR@{<a6{g&kburKHXQ2Ka^T<j;
zwVw4zGiVd{8B9Sa>OgUo_x!qD9Fbg>FuIxg^O|y?x&oSF5?!7G#~IK7mDm{T;IrQK
z*Uww#Om|UvOGL8v*qbL8IW97&@9Wv>PXBXS|KC1FzxlwW%OSuA)OUdx^3#1_l)VyA
zqp8*LRtAEjJsWaW+qpv6pv9%2cWAzM^apuY?j-sugQm~3?-ezg`pSO6iBqV=$$=JI
zodzHng@%bN1VdXA7J~9OH{i)DYj$lv!u!(KC>AmIykPuVO3z#4%NDqGCYmAnmVc}s
z2rLd7g!4tn|EcWBF@fK&F2NBB%<?{&=2q+dutv1+?e%w#uf=AOg6~J&tPu3djk-yJ
z+b7fNuIRNu@$T4>54(nqe|QDojkKMAT(CCaJqTo!)<T)Fo*;JIG0_Gb<N+wP&*0r|
zKqMCiw96z+Zk*r^C8}4qesr~+NA0$%5dl}fDv<{V?T`p=F7;%ZsTNg`TYJjSZ2glG
zA?Bdn8)V-Ce*~bk3h=v7A_%9@a!x}Yb#3KBAGzQ6uhy-|pSiT|OD|mJac=U#T5j$;
z#&Cyns9KtGPXewBw9u*qFAsXoylQ4Uo62)*EUbDqYEjmQzV$KHU+AFy7Sp}<=hD;^
zclpe>g?BS+^PJSO1G3y(Cf%>S*X2&=ndanBc{kfi4a_7@$sLFz;5ZJd$`A+cAV);I
zbddk@t|wj*%NTjI;5hDXuBEr_HYcA+-`$Mz$eh&W^^;ul@#*_*!35PMPk^i0|F!7~
zJ6U3D)-PDtW@Ed<HofcVXwRI|@KLKsR<`1T%AqYM;D>0JMc9!<jB2L-HaIPsPJJrA
z{n#hgrnaB^ig68+=F3$@zIXHH(ZGK+jPF83!LMUIcZ#ri9q8HNhSk9%R66#-pq;x@
zQQgq`JUD?WVQfC>;Op9p(W{It2&bi3CB|Jw?7Pk-4j`3LExVBL!GlXYFtN~isHQ7r
z_<D|bCXP3<Adqgf)0-~kgsH6ZVSx?D6*DsqzIW}Hd{|e3#Dn&2#t_J56+!GfgNAcg
zm`9(6aL+=n+XtS)`j1jC{4;-1^j*5ByWRryz40QP_X#(8igF31WcK|Xjgq>MApfGK
zr#v^PFSjHQ@>*ESobpMH<#@Tz^W<wa45M~7&k+PqO!@K1PA}lqa|Khu&WuTEuRM$A
zUQWoH2i=U)DZHd{D~&_z=M!c+_d_xB?cktepi;+{pp3(xXiO9R^Wt~+>22l~HqXk7
zuP)u29{*q_cY}fOIX?XkU2|fNH5~{dt0n_)%LW|wjtI_?b9H!|QcHJ!rK8?HO;g%~
z(RU5GAv!t@@BadgP#b(M`uwGJ3R((r07M-IArR;DWP;DCo&iCfENbN$wW`%PpRk}u
zrRGxYB0ZPtB0+&MX+K}lL;nd6I>jJo5X(!^a2bNr>hHy<TR>@zf4W5ttt`J=fwL`G
za`&FV3)7&|>q^U@_Sg9of0Tei3kZ|S|B6`y`<Ta5Z(3N$v>MB*##YUd237AKB>l|7
zXhsPw<U_yB@7<3{1bT1oA!mmeyKUKVifPUAWtLkVOU|EWpK3!=QObV)FMka)$f2)<
zs7V1E$rwO`+YaX<CBOwYl@@DU+`hS<A%5-b+B&ez1Mb8e!D!`QaYYp2m%f1XgBk!V
z+8GB_-K>16L0#4>o7F^G65{q&c5EH2;{^iUJSB}d`J-gC4cqL+v|Z2gpuiirlDm0t
zqJ5;8x3d}G6UDA*Ih%!t^1)URS^xQd!Iyg7nu9WmhM+$n)+9g&)IbUYHsxu5fqpvy
zc>3Bb=nTEe*fk`#ywS1G5@a&9vp#t%NXA~`Xw=&M&_O3c=l+@`ys#OCHzIvg5e0NS
z3eAM%6?(~i?dl(s>*H&6Ei!2jzIW4gS8>ZOmkq{w+fx3G3QirPDB(Y^66px~D-s$u
zQ$a!QM2Q0HU!B5TX5R&hJr(XhhP>hy@O+u|H1pd!FvM|@GWGzo?8wZ%4#B7VaVi&S
zetavv>Vf(PPmg2@tr)d~ZZ4rf)caz)kb5BBymO6zeXSIPyQ?<F-DgvU$rqi`TPWu=
zK^LC#c_HUAb-&m5ObzvzL7d3$eS!cqE{H!jJIa=M+9%MO-r6Whr@p$bK20DIqZmG}
z^W2QDwWGg@vu9-+`fZ5`kd`g|km^QqyP}xjd<5Ea^Dd?NXo=q=_`)K}^gq!YYERjX
zdQf6-55665Cp|SFDsA8am?GEdFHmx(J%H{yQ|x6rnZMH--LKg&tB>eev`(yCt}4@c
z8s6WdbKN_NxI(ZwH-S0fH?amEfV{YDb<}9H5w>K#)3}Pg=Z1g5=SLm#2WdZk<TDG3
z@-dr#M>>+edR9YbAovH<w;981Sz4OwDl6St9!%U~#++j6C!;lJb%w_u+FLrzcYjV%
zyyqv22F`Z7EXn~W$cF#Srj+N=z+6JSz#-zCLJ#mGd>P__J}+wD_6@(_wQo8Mm#QmC
z43Mr*Gb-jvSU{K^1wYyv|Cbv7WEqe#XQ^W2k})Jc;4^N0yp`jf7(2G=iBD)Z-V;Cl
z3q;so^`v$NV=Y?5p@fVQ^*oqoN2h^bQ=|LG4#6?<1d|9bCsLkk^SI%?f$0hN5-za~
zp%*4Ce!z^}u^RL4DCi}ktdOG^Q=_&gf$8gHNjLzqi}XU@%K&1qyp;=OZvB_c_W7C{
z>*5?D)u0*InR6QqUnSlJiS~i$53k>LnLJTrFF8W|t~z`aBX555e6AdfJTAsUV^rKR
z*#t4hE<HpzgzkCs7|IDjyV&~*!{e*7xTyacM)jt;jz07n)>LO;O<y2_iJz1-cH2gz
zGeABv@(r!d&g~&ds&aSt6~oHTOJdB5W7?XgpbLM*io%JaE7_Nv72s@G-(<I3=d%ER
zU%anZ{?!MqQSUFtWEot~GLT0-y|U2(!5YPb2~wTVA5vYxBG%L85<c`$gL9tD(x0J$
zAAToa6ME$o$TYd^^))Gk8kq`Nj^$Ox`Vr+)>XwUrGIVOTAxsPNs?k5AU#%IqyZ;^#
z6q3=pxy3>ELT49h;s)3<^`XCjT*|!yjE(oo$gGcq)w)|#u@<sad)+`eP00NN>|2AQ
z2n~n_bnypb1r7P0O=5u%%eKM9jC){2C{-V_3mOYPNb?NK#$PfZ2~U>dm3P(X39nWb
z?&vkN)Qna~Q{`4xvzya0i)rxwT4j`b@m_OJ7x0^4mb&Q!HE`@iHmQ{xIV&WsIpZ2G
z*_@PVhjdj8+DO=sUl90n`@%Vp9So?;dv{*|0|WQC8W$nT;O$aXRti9JSTv=Tg(+0F
zbQgq=@a4U4b=kPjV5bqrcN$ah5G+jsFrwuzY67^TsF7XzbALDbRS5ecYrPG#%Y$0q
zcK8eH+DBR|%GTZQuhQ{s`Nofd0lnTy`%-A@O`LXIGdS;qiqR_l{S%`}dFvllwsN+^
z6U{QMqXKU&zcYdQKn;%ErHeJRipSivnQG6?l)q)&5TB%ck{`2?<xGJ?uL31ya!?%f
zgE9UkDWuwfpciB+M*6hP_ObMrMKAAFQmhV>Y;TW;P<JCprunLN4p89&oDBw|8k(}l
zbJoBR%nTP<dMLS2F;nrfY>!d7H}ml6Fe9<%qq}kJdzwgyJA4GNTbOr%XR<rQSHR&`
zvNN}G0He&Wl(REUFdP$fu{ZI4$hQV%R&}I5(9C5(YHT)gSpm;bV5W=x72itUrfpHR
z_~NLq3GazgohbwbyKU1Dfmrs?NTSUY$`$#ZmxmONaDqy8amCb)ExDmb^;*Y&wQ<~%
z9mq%>eCL<p<v)v2M9X?S1Od)tL4$C~BdHmKC+LdN5<*f}YMmjoG#3?rT}|IHY3B(I
z$ptA*kia6<34++74qyeW0)(Mrhhlt7`8izj!M7)*cg6>-v?yXKy90v%fxbOu?^?P(
zOH{%>F2EE|jHEAIv}yxr(&EQ`&kgS?e~AIA9Rkg&od@!#6vb<IK75&c{#zp9cNQ?%
zL>J@IdpktWM;M3@nJugMHyI`$!9VT=KhR6#u7wG-enj3PC@;GqFA^lVZS2TnNY_N&
zZ?08YkLu7OK@Ec69$&TpvEK5y$y;p9+oZUuhf7LrfBpFA#~-_hce=yYEr|Z0P@q=e
z_U8W;VOv*mFCNK-$=Oc3>#|t5oS0K-8;(5~mLWuKZbQr_o=x9w8WPx6(?60`zoE37
z{O}9>N(cm)1eYU~-XNY4y33n9vs|hb@2-VJ2dr(7ayt)@OElzQfc2|82vQ|<;!2nO
z-uKs`?e(0b?{EaOtz)Lw=uYUpz63D3l0&~yVA)qsh=tmKl2hj|(3qV0{uKNo5g=bb
z^$``$T)<~HTuEnN87MF)V&W3VU!Y&ye-n*P$ZiyYzn2)D&5qjM*92bZ=W`}=ZUCP~
zQ~_nOAlODHu;H9eQPE{c^LHb~U+ysY#+_FFOOwUA$8xmc#qW*~23?ADA~4H_s*}eM
zlxp;PIPQ)m)*u6y6_@6FvoE@1(EDq10}|mKj|v@6nNok=r(mjQiHit<6o{S9bwF_U
zgWljE@2pP(JY#Zf;9YNwd_PAVQ<kc+Y3$m5Q}O%ix_F_U5WYNkZg6!I@jUBb8Z-VT
zWp?d;8C*B-Rz4eWAFgIUB<2$sftBw&{0}U-2IsokVMy>cB1jdx_&utvV|?xLX4k}k
z9`j;M;bVe_DvT3pE*doPhIhj3bRXO;{AZ>=dR#2`T#497rrZffD5J0sJx^8RW1+_@
zC5X*gF48wb(zy|Q1WIKX|9%lNe%m_xM*(J5_jRnlaC69~L}iBsxybfeQ-(nE!%kpn
zHV;&>T_eho%7}ie;166s;oM_EPWIolU3`3Lx{~yRS%12SS3K~KwO;p3<)b?gA9S7N
zaXOayUjX;1bMP_{&A^Q@i%`+W9(J+u3XfZ9y|>v!%Pgp`-?(#wke2#-&A~}fp0EN8
zn#}-qZi+>dJIxVi`Z|oi7{j3ldPKlS`^+5z$REa=oAB)uc2lSqQZZ~vA6bJ$%6?M+
z;iA1O3?=$&2E=zDPld?<SNmN77*F#zp-RBQ;9ihR5rG}AM93?4W$}m3Dm`d45hP^U
zJc`yd1f(BjLT5KcYCu7Oz=t-S^6)@8qS#!FWt?|ZOue3uXj+z)QyT$Y?3YOT@GkUk
zCnD2!J9`!zDPg!JkXwW(+;~jRqqd7_XYO{O!Y_HO1qX{CKMwi7-ev!2m{ap1_yBYf
z;DcZfl1o~fI7Sk_Rp<Po9!d3Q#&f^8kgTmKglUaJW~-^q8GN0EAuxLxoPkJ+#WM7T
zD^~gn+gBI)c*sw#I~9(*ExA`bYp#vjn^wOim)ofHrBs|QlriTzy8JWw;2I9{v+OTW
zHxGo>X=|oG;^b*DekuS$xbxs|{!zr@|G+!`yVU!?`uByu(EtC!?}hdP**aHlUcA%4
z3H=PM1>mcwB`w~R?DM<G$&1p|$e)aJPGs$1ZgL9*?+s<@MeR9FV6)HH42l8OMyW*w
zk%I0?T#0!3^c&0DGsB}nwVO}(ca}y%`6$nGTQ;85Mg+c=r1?fsEEwN4o#tyvL!k1j
z#q`?0(BqUJ#bwancUQ9$(m&Wputnv&jzT-A?3x)gVbi5IV(pdrrzBowH*NHALmsVX
z*i~2o7kFRY_X^xcy6BOK^wmLJjdZf=7j&b0bms(;*SW>Oe){%%A1a->6r@1w#P9E)
zyKnL_B=2ykReBb8l*Lf@dK@i4b)t<v)OVt5(q4>qb<RGSKlFn28)XaY|Bd9Q0Z4w8
zqu`l&#jK4+;KhEHD<f9e^K<Iz)1R`Tl=fDQH)_-}1@da`ks=a5H}1oG3VU<n+Da<%
z)x#5AYGCVbxwg-*Hf`;MUaRxRsYe*wZoBx??_AXBdl|Jx)LdCn%E)+i$dKDq6;!D&
zHW~K_b$ywXslnYz7I5=ptCL7p6`v4Dx%*KGP`+>A&ExcA6qL;Ea$ptX-6?Y>jd47^
zv@KKKr|B`J@~*Z$MSW<wHm${RN?qh1+JM+ww1?+^L(3@#pB;B?Pp*yHXtr{)nRtZj
z2p+Nyx{<+gdxG-yol$>=f5gE8AL<#?HA%0zvi!mvNxarqv%5ajc<XRSd@?TuZBpCT
zDNci<wu4>omhPnaHRe-%v>7VrDC;&jSanDLoT~}04Tn&0o*$h^Zj-@@0~)IJ$_7u(
zC9cO`2h`-80qFW})!JeYnTYwj$UC?zVR%{Y_g75LOdZpl#PQX&A{XKs@uq%CP)1nP
z-BIg#X*$I<v~i#lJ@K;8g|~m)Is_Wnew6p%IE)i5mKldzAf51=6UQ8y^^H-M>=nIc
zWUUsuQdv{`9oH{uDYP?#S!q3P0Py@KKU`VP<TmNPHTAn5FG^SZV3VR}j?92u!gO<_
z^|;W4h{_8_4O?HQl!36*%^ja-uW%(TnHm#EEw(%lufC?>&HYZ){VF^T9P4%OZvW$m
z9DvVA<`z>nFWa<gX)U6f_v(6s)T50ph$`qe*B)I(Mx^itVSnLLv||UdlM|af8DSqV
z0*fo(mAtL8__51hxHDe8n{J*N!+a_}wGr=pv;C~(@Qtd@<18_@t-zH756s`+^C5%@
z=D(X+QT}NcUmT>2x$&X9W(<F&g{L{A&&z9I>d5^`kMV?ecXV-h=^9MvbwA7LAKxG7
zA{c<w`{r^EbG#bzCi7#@=X5;Wd;8~U)}ANotSvFk4!CWIPL_ve=2xqheA>k1{H#-*
zJ{#cv^T>n3!Th7^*@Id4c12<C0zY0bj^^pt(6wE=Uio4_?_AeMc!532&kTk-1(7RX
z(Bsds)wnmOc@3*}IF`<l6l>nQ*9!$39&`Ay{#m?^W3FdIyT2QCY*4k<O7D1bKU-?L
zk~NcI`IlfpP%T%>BVj<>{<@swx#*w3xEy=W;(I0`Fidl_>A2%WA^+Q%Ir(1%zpl$2
zb5FChL1>#mJI`+qOxx~W=Q>l-;>wauRe6)JYKT<1efpvjQ|p&xIZ*Y$OF8N|mfNNd
z6{BTAP3d}=>7<qMDEU3-<Ec~^Z{g}t=g0K0&$nJY5`L_^6Y%+qs?yQv^u~ABS-^mD
z%LIN{i5vmXT^VqPJebH!FgTm$gzTaJ+z7AGL@@XAcZIe}k{ZSs!{4M`3+h>EhhS-f
zjPEDE<SsXOg<TXVxb@Vf3Yg06%OATjvMv&5^o#xisUxS#mGH{H*c=3JpoCEl(f%Gm
zdV$vkMeP0pjk+D{bt<sT%<g6svv#(ziUo>ryLi{diW-|XAd4qL)r-cTr=SefF8>YY
z1GMe`5L{QumqQJ(<b=SAt?~D_stFGD=^A79AM|91;V$UmY|gc$UNu4Ne%tvKHQOJn
zM$=JQ_T%N(nZx3=vu{!{R*qb0lID0}RuYq$*95@MWN!b@7_kHO8kB*t#<FC>H(M8_
z>~09tgXhyheu}L(mjY;6xnF)A$?ZNwv^5|D3$?F%^;AB{VFLY~-N*m}y}6ie9NX16
z^}?tW`eNo~YQMA6wFZG)049H(9{yjsi2wO>J6Lw-tY37Haxu)_Tpu4$(42A*ckb|{
zfj7*F53e%4%W9Yr{Umyd#z@~1xPe%@l;U!hd$C3Dvwd5Z=OV}Uy{E`SU9vF;W;(SW
z7lz&Dwl@rzfGN0<u#rcoMEK<q$ns<RBbqi^Agci_AcOe9!qqeLF`qx{-ygeHvn81y
z1)KLTE}Gr_9(!=0x>|G!zW}JPKl}WXN%{B3tn#$ys$v}*#*>cLfz~>UF8SW!I;)q{
zJ{*CV-P+ZtEo@;x3XBC|1$lpL0ha&%O?^ICzBZnk)N#%kzYnb(NH7X=sL$?&3yi@p
zZ_3IRRz{Ov>kQK=Jz|heyB<;h@e<|4T@LvpiJF?0%x1Hc$};JDB?-APV!1JwL2p1_
zmjm`sINX9uvcru30?nnLr#ij@Fd5`01cX3)cyJ>(O1w|`;{UvGT3t!G2#4&qs2YZ3
z`uJ{r+F?}H{gm{Ayx?r3+9%$%cSDqugt8?y-}Dd9A3`6F-QzXK8mzoQTqbimqv%%9
z$5Jfaxwk5N5vBSYi@Mwc2Lj4i8RqY?Akbw)5bM^b|GjIRR~0a9ZZB(hWxi_G$5F2A
zy~F6+<mtpN<`vE@JhqSDL#Bzzxj+3vhqKORBwq~@BRozWBg$YSl2$Y)e>(ng@im<J
z@Kd?DO5{^%lOujED@}3R7HIGKcOC{d(#uHg3g^du3fPZe=M~15ZI^6@(WRy^*s{bu
z9O7LQAN}G~;MYox^GI7oQE%Exjm;@E=F`f?tmX0YaFg<%nVi3~(GOZ#HXzhO+2oNC
zvgCbDoOVX}pR|=HFaH7+Ss~Ahm`ma=CT-i+fS2qF^ma8CZL?j1TBV3otJw`kdimAx
z7Rcb9T0HQ*_y6mAX8`wR(~)_I#^cMQWMP=oW8C9RH|hGQCF7c?y_@TRHPa;7;tI`A
z*}Lt6Ew6Z4fo>G1cnUXsmKcz#V8GxUFq~yszW=hi$u01`Ua^*_kTa*QnV44qv-sSf
z|75>l<R@%n<Ca#lJ0;9lVmIE)L+Gqs*O}z^67D4U^2eF_3(%=wesRzKSz9PKK$EZT
z1NQY<%4KaL^J*6!dIjNR5Q&HL<AkTaHsG%0Abfj{AB4$Q%MO3DsJbc3@kz+FfJ5?W
zI?0EWL%suZ1MJbN7)Z43P5za!^8UKIg_??ep;L+7iB^Y?Av%<<zvF4#PT!FV0KI>e
z9w|db29VNOI@RO;0`(X$j}$*1zgS4GWbKzYEnTGi;7cE9S?l>D`cD@~?k=fgTLC^5
z1&n7+^@*luIysStC2#>8+q)GWK*`)izB$P^UL7mRUf<Z*@amd$H^-oI(=*WJSE$Q1
zkX__Ez=q)6w0p*o`YIc$FntGbCPqQ9W>T?mNkS}6uLE3Z-g(z1f70<ss!5cB;I8?}
zf!MFv{y1MPnxAcJ%zqXP4JpS5flZMF5I(fT;i|?+idUlt^1?9V!!yU$rO6YwCM)^5
z8Ddz4+C?{XX+JXdxA#JpQ3O$B*STl>Ec?y|4!IoO8{Vu};i_N-lXktY!8qq&V%c05
z>5u@Li_Y(QcAW(ZDA%gcZAeP^FogQZARJB`4j(CeKtD9x_G58T@h4h#wNz)}f{1Il
z`oTBWx2uquz?H~2vKo+i7LQKZAt2k$%3T~12BKXAz{)P^a-6=-vwjZzXi82>4nE#W
z9IXWoa3yk<Y^#B=2QXw8TLNYE_*#?R<;LK)Yv&rJWe7<fVI3j+R=0yXyeF^+&kE8b
z6{?BN21#KJ+K%E(yUvm)v-mn(@S<Yc@}0mU9uwY1#jx@GT0r~+B#u|bAbjZx(G$lx
zF9`G0Lbb+2x^G=o?#f&EA{Orr{Q$=5@GmcggQ;63$>R`apPRSc*_2Cdq?c?IrZlT!
z<{y_%W#+rR57E4w7D7V}6cbHK&FSHDaZ)>}*ptVEqyoYXDGnE78&cv?>$gU4tL6~@
z%hx*P^w)XX!YQ1eW-)>#;XffYjNRb5QVcYbsOf_(BLI5x(BD}Y%<-|&t83}mpO#+S
zjCH4dG*;(;QAu$;FIkc%K4``56R#<oL)cYp?EF^tLu^@^6k0jQxn&k%8K%k2pCF>c
z9BVpTI#JSN4<1G6Qto=TErkadv?C*|?!3KS3M(JVSKm_!r{;dDb0Nvu@XFMRd3<AT
z3)j_TF{s7kp#>>b)s2J4i%9)A*F@v&s=5pk1SvTE2gogo`v_33|BC%V_Qb!3U`-Iw
zPzJK1{<)ef3N(%22(F#&nFXW}rKE!WQ2AmlYv$}0%d4dQRK@31ilkKJhQacEkzIhm
zyc_~x?4N1NA?+vW1*57)x#M;=0#m(ppY454x<Lr_ES6RrThU6Ulo8H1mG?vW(>YDy
z-!bMF_mnMX)L|)J?}e#gi`OV(-bOW*&u{q#$OAaJV`E(2<z}S2>-c*%|77YoK~cJ^
z%658JeK!;p%azIl{oRTzN50wi@z>SH79`Jwynp8{g9kYRIoG#6f#~O+cqZag6oD1M
z5@x1qz}H<;@1!Jcj=>UWZ`E>>M^!o<1jU-T*B2sIUG8%30hinIx5hdE;bZyb3<09$
z+E7=C($$k6n4r`>c`WXVj!)ZP@|Z*Jqzt#&|Gvw4dWTG{Z2t=9hp!~`o<DGvVIxib
z{91>7x_vU_MWvRjC<M(x{_>n-S@DY`OTmZ0SDOU^PhY>jz`<F69EC>k3l;-+u{u)$
z%?p)NdZH__pg>4S5J2Ze*<PJc2?WfSW|7vT^6$f@>%5qa(29Ja6yl<nEdi?Zvc*NJ
ziVhSlaKP`?<frAOD2RsG%kv{QGIO9VsrYYQ3EW#U^V-t3ZQvg{ZF{<VZYTHu6AA&L
zg}8&m5mylop0j?BNUdu0E+VGb<4F|G#G<R{rGYG!B(HwM9P9Y?)6W9RZyQ<<-kkwi
z6|4Ilz(CR=4I5lBLtR0-_5p_7XLV+;6-Sc2sg*IW`qu0!lW*0FperPnn?m)hzfC(k
zK8cH?5HF=;eFg(k6I9(c5Rs4{&>aB3kH&c9;XGGT!<Mm&s8Y*8dvE-m1PLzDf;h(+
zxB5=b1+Kq9rKTKxy+E^(5c!|c=Wvoapeg4@Ju?Vd0>g#lqv49~&l#D3<wugs$@-+g
zoYSBKO;{=2@s$?AW$m4&W$?__i8%`ESdMgk;%3x&z0+dyH|oLF6ft}AwkLkqvxtV2
zmKcK>G(H%YQs;y5WCy1B)`l{uv|IGtE?dv~x}zx#UE(0E^3|^(T@?@z^2@1=w**L`
zJIf<P5g>0s#ukWD2L<Jv>(2s#a{D_&NSGep6)1g;DED(G#TIU+KlPebx99!(NXqMD
z?0Ytz-}rBB5IH-Fg!QHG=p84gbGabuNfnk=YQf1M-PK1!$m&N{tc;u=B%TY=_cO~~
z{B@f7IX=}H9AxxZ)@6aZ^v_5PnT-f0KyZv2*$)VH%V0(rvRmzP<`K20yv>bq{O?@}
zi<%r}1D5)juGMG5a*4`lfcWnefe%8Cw1}L5SOT93%y?oI1%D$>yVONnc_#r*U3!8q
z?*7SpGSNfej4$o5lIQ6|=DJM`<z{MHDeHR&E&c_1lXQChm$vf(qzYJsvfcHhByhJw
z8Q<8gEP-GM1MKjpAGdQy9#uyS%<B;5$tE-(8otZEN?Jq#XLGqO``}?K@Zgv0J^<g9
z;x&4+=q3PN)*TD1T8-*ZO<dhee3hP)OkMqhkIz0A*c!D^Z9*@)A+QgZW{SEhwJF~p
z8?d=nc629r9QQk!JePhLsRdfCN8Z{}17uhwF6koe`?OnUL-Pu33IRMZRr61EDmAXT
zy$sJ>=rc9EEA;U)ToOJ7Wv&_d+ZorRPm4DseUUUfY_sKQ&^LhMxbozS(%<GCvbNgb
z?pF+6?K}MKnYyMf4DTjt6X>yXnBI;sg2ZYQwGSh$fTfllOFvyqEkpcO*)G$bpzj=^
z)R&Hi-azTdEW|s6J1gIaU~E%oEu4E?(0!d&2fy##?*H`n+G|D0ouL@I(JPUiBNt(Q
zD~Pvmz>#p~cRRC?$d@^lHIK`Gx8-Qa?Cr+>T+m}SxX~o`|IW<%_fndMt0L`1xl3w*
zTEW%y@iR`oG)ApBQ?UW~*K{0Y=ES(A4hyWUI%7RFZj>)8*Nv|^o{w80N1P;;#XIhS
z_s}iq;Z|{ge?Z_yIu~W33!AogqR(lFM@E5c4wWCzs$$0&)om-F=L0^{B(&^t{Amxl
zqW6a2!Y9|D>^#8R<k@v5_TTR-{s#p5?@%e^uhIX1F+^bUyHGxkl7_e=PI->(H(h}B
zPde$IT>|toxVB@XS4jY`P!BnoL4H_m@p^OyXZG!RaHhSiR>zjHTncNyqF>q_w0Zs-
zJ^{Z0MA&YO69qzC??jpEh<FWab0F;|ULJ#Kh&S~E)uTrmbXb!E4y(<Vopz0Jy{mU(
zf((8WN_DL*UapBV4wTkY?1*|DZI^gO&U|;0E)pHK@d)<8HsK$Wa@9n8op6j$oWv2e
z-w!+Hy1|G}`{Wa(7a{K)LLPkuo9L|L1vl5b%l1guaSU@rj;I8fi=Xq8r@_@`RVB`9
zR8vHi=&w}CmvW4BOz&Oj<J^TBl1CvmPSI+-MBT9<>LQE$+Ou>IKjqhI!7bgvHz17E
zz4PWy@sTB)9>FrpbFmtlV`Tyj_8Z+?)M{Vp$Tj;)W~G2l{^skB);F!FmMZKgIDaxE
zPy&@1qBuM>g*6BP+#}W*U}iU8HK|zl-Rik`N$C)_XV-Y6<e>7&&&8i)#H2)4#uq#;
zyOy%Cy<VBuS^PjlYGk%K(r{w$_UWT1#l6THxFZZnrlG_&;$8OPJTR|Cmob^n>SxSf
zk2@v&pcIJZuU6V!BoD~tpocX|W)1wa-}=A%Qho$&xlR2%_+=hnUDVM2ws$zD<x4H(
z{*jHVjqHn<N|~B~smwL=?;lt`YQkQ0-M`JE<xN4~x3rTLKoVb*ip>TBBO}zPl%1{I
z<oA#_)t)}2Jy7fgogn3IbWeqml5OHOWI86ksOH~+s0XR9bT?dCpOIeBhfBa0vxITx
zk<IowbAM((;ct4^Yk5&Gs+Rh7g0Y64@#acl0Y&edCHq$n)LqzQn(Xkj>DZ+?<yH1~
zt&-btuF2-R{OpQ9``U`>n|&3LwzZ~@z46~wW;teV9_WzXlhTRiK2n{kjOS+dDv9d6
z4&I5nMo{BkfrlBNe(MLxV>x4>G}XG$6W5fnEZCpiX8Tq4-OZvPg-Pu&qEM01ls`A?
zo!HJ8r%QenPmAQTRf<h!xL3U%>OQ9YLq@F}HOCgceZ{wCo~rLLJ&YZY)-H#eB6p9^
zjc0!P(3`gt#?|n@ABZ@OO1f<W&GNO3Z{ey{&VK$?XnVffx560^{H9+V#=d1*1x7$W
zH+m*&Pg^O}sAY)p-;HfNH!s!}uBdd6Z>B<WG}R_fYehW+Y-oRhY}}k1C(~a>m38&#
z`vb+DV$gbI<x*^WG1A4ryC3CZqXuA91h?`fmkPT#;WIWc!2<Xja(k8(?r{-j2yqTI
zPCvF!{mra!pR`3XAmy&tO}5gx9Xw;gJCT!5<<BW*6>**)9@2fw$R-A~s5oAfF5J?v
zk7kVel%FGqKUc?H@)N5)yfZRhcT7tqPeu2dZq3VWJ^mVDTa(~d2(;C>zPeoVUGlY;
zm-yjH4;cF-o7J`P)9ju0A>kT-e)k5M<yU)yHk^-T%nJJDR61#L)LgYU7mM@ti}X@7
zzJH-9ei0}ilWUQYvk6UWy$0-N!eD#7#<k;Q#Xs6Qp(~-OOc$^5qGZeA?+EtYN{q3$
zomDheil+mW-+ol@CpMx#q`!EQV?6uh*O8aSujzPUjX(N=mXXF`TD`LN2^Lv=Sj<4-
z`T{%vx9i!{2o0$|4bm<dS+lkd-P7GsEnVIRrulZQ8j_Q7{TTeJi+iaawRnB+!P={-
zRG!j_4zxvMP>osdl^YqICM~M*qYVP-?4897kwDj1V3$4%ZD8SQ4P0~!T<5vV{?#_P
z4#OTs?k{?GDEpv@f_$;&#HkH2E7F1DeiPO>?%2Kdv@gt^kEDo{w6OXm>MaqkG26*R
zt2#3Jy3(d|<Y%m{3x<)Q-&15(!kllTz!BL+%Sh{z<jQr_!L8>bRCWCs4RM~(4s0X%
zTHRl-c7iWg_n;;1lr5XfDgu1Ow2f>@IvP9=Nd~-f#Sz78!P_MU@~s)KZryrfV%)by
z4_6GLASADr0zebkdR$)Bcioyb;eN-+C$KWUJCHFPC`U8kUOC#2X_Rx3wZVq-uV&p9
ztKWw55-*}}9V2HqET*ed7d!>EOn_zod^%=O)THz7-JQ7kmn$}sHY1zk);jwVY<IPm
zO?=MGleev|r3c0QX?TAiUNT11_oxk7(h=18_#(bgd^vj-j6cPuhDZrvkzp+723Ai@
z1o%HXecjP^-Rrh<dA@n5?Hw2H`q_VGC)g}j$fHW~wUYT)XSExzJ7)Jo6fdDMRHQnT
z^N{4mIkan$?cj~^p{Iq($JTn<^z)`=gI(d}{aCI5wG8iAb&#yqQWM|NpI3{mzSm?p
zbPtbIKMbVs`)7akQ~2(xaQ@VTPEmesb~sicQ^pJ8Yrs*4xJJ}!!kUNHNIaK6yixff
zT{?jIS^|0#n#~2&7Qc|UQThw?c)INEH2dqhd{^#`5wEX!q;CapibAT2pGu>TQ$$7#
zFqH1@-KhC!z$CVOgh!^MUY47B62bZW5XH0)fTUdf_fjOP2HKm=4C|m*w#5Scy@$~3
z5C3ODW%nre&`t2EM3pSovEK=Bzt;vN9F)FGrZl3n(T4NbU$)4ciRS$fDRNp6Go%5R
zt6l{V?ybaSFYyCqyizg-m;amF*=~YN0j&@Z1+p=D!4DxOZsjB5vCGr4<oi)RxBZID
z7d63r9Z@$6`Tk>Hd$E9YT$pPAs@RpejIB1IdAtuW+xF1PfuCK`he6shxKUT>Jy#X#
zShRyzb>GeOtggR%ST|s$9oOCC@X~AU?e-(WZ$EELMkeKQVS=D=Z*-xot7Ihol_Xb<
zc?InS*)LiR%WF|5+j`b++!iliu3EV7j@idvvopGCXTs2S;jL{Q)(f==P>%UUXZ?t^
zRwt2O^8rZ4Um)Sr6d(q|j8s$oK?=}`dh)s{EQ(F5fc;l8B@ZoYTE{#czSrMTFdJ`{
zQSQ=Ed7{R;+PBcl7vk2hG*aS>TxTIuqt4BO9L5o@2J|rPRmPa(1wVD%@uylg+_qBe
z(3+?Us<}E#I7|CNmPJs=Ao`~ODgfnHer;>1Dmz}vxT_HrRycY)W5HHJLlfYy^HUA#
z65kjLImpDO-FwqFuh^$DN;!Vpe07P)9N3Y4O~oF2u#XQTlmcEzUZIR94UH4kLlC2>
zy^8ANnvmRnuhE}7T*lIGjK}VOc|9M9AYMC_4+dJ+r`3cBZawKI?`lS<hg_$%H76av
z>(#Y1hAv<lEG!?D2s%2PMs%jEIb3BNvl7R8;{{3SZ~&iKy0FtK1v>}A^yBlMy4Il+
ztTgP9^Hk~6Q^d@TA*bg(CLga~f5sq}ez-q7xGb{EjTOg?bQoL?QX}A2fp!2F1d9(-
zAzRb*e$ck=bRcXd4U=GOFWknL%<*eR5r8Bfd;+jWB5SEOA$A!V(J0jmjmTzF(OYpV
zSJ*;pHBB5Xn5~cZxcN7qvUy*Z%tl#C7xXKC41xbaLV>Z|9%kHKMINy-=rQ0WY<Jnp
zpo3l~DQlLwrm|1h8qO~0)46$G|2b#b;gN8d^s)IuALS+wD*=cDx$H^$9%R2_z(qhT
zLpr2bmI%Hl+A*#H3)9Jd5?{zZ9nWW{^4})3S$s$y%`9Kn3MhvUz=s2}^2*^O2s-)L
z=Udk2=YN4{{{Z`&$Gf*C^d({>4|MkQ<f@o~&b_3hAyA+MD-lgVb!79B1%W9*y;=QS
zK8Trs25RiJURF%68npxm;MEJQ-{+;AYNv|vUmfHR6`qy;ZExRhPhy6#cNoGLJGji>
z?bfJjSjImLyD#NqUDVQA-!9azvVW+Y=&!=i1_FI$_z^{RBnxaVaU6pQH-BdTs0&e(
zhiysGFK+pM5JF);+NyR}%UTK_Z}oKCiyScKdsN5{y6UA%5}8IVXD%wa-@w8G@m~lT
zyhXnuGwItl={lF@9*@Wv=CLlsti0`g2qLNGqWDnDA5XG5h(_3R3}YNzf{<r}qs}&~
z8{b)-M(%m4ytAiH@qPbPd3VvnP{y_iv}=l5Mh3)3wekkt28{Lw7l`+8;IQM~spn(i
zDaj@CmX`B#y7WVxgF@1>jwTL<LL&>xI)Cm_?#Qze%CVGqS;8F74G+ggcI{f@lL7M%
zfCmxs^z}9E^`CDADkg47d7f9v>a=wkWt_abs|Z980e*ogaP^h&b7MfSBS-pryoxz3
z6PlEG>BHIQ_Nie)<Ka^4EU$B6xMgp;UIqIlx+oB-E4SGixUzSbvu8S2Y%6iry@?4g
z3cu+{tO^b{Hzf&hJHI90rP>}dkpm~|BKsk48=ZFF0@n^_Lo1<tb>w||Q3oPy`<0NA
zN5)En)wtWptxrC>CZ#$F36bfZ(zioOw7vpS42{+1hll5nE#RXFtiAy&5b9{q368Sm
z!;OUalzzCiSB+q?l|Q&u`BwBpRT%FZyC~gjuNtr26}k>yhzG$&bb%WK(DkX0-if`_
zHS1GY^il|<7;zw+MseXIhd4;v{vMAH>#6@a0=`(cRMp*+jrClf%60pDmiZ?5B;w6P
zUcEBEJ=I9YD{=6A*J~xYP?}QgA{}t^1Q7!WNh@zL$XRoI2ri6QZgO-4&%<pf^J{aw
zejo>W>|surX8mxX&y3IW86$c?94APoE@0dh%!iL<v%|TGX1Jajj3;A|Qk1^jAP|S&
zP@9O?8~XlK10UgQ>RkT&1x;t<dTS2wR@pa@Ipo2!-Yyh9Y{C}n+pu!C+^X+SW6U(Q
z?@67Zb+frRt!VOtmp`+mf2n(Dse{fT7<4FO7Z~K)%Kf&vbVFVK)7M=Y+j|c_Dtas_
zh3M=6DFE8By<JkEO*N6^pwj-l1EfID1na!WU?$BmhmRs<CF?2h&X@9mYiQ(JkW3Oj
z92hhyyT~Gq=o`(I6Sw3gY`69e;)WMBV>b>Qed%S=?_Ry5Y1B5zbvi+&NeS}9a+^nX
zXEOx3V<6N;(Ng1>#U-67$y;T%T5-_2G=cDmH*?eMj58L+l%cH!)MB6g#{+v8p`TLM
z$d7)1Yj72<XoO50L*-7$Q3N0!V+_0B%SGA7!-#=)p}2sa<V8Uo=@VCUVO8-w)Ou#N
z!LP>JdEN1sExUF?Rf-Tplz2U<7UAYjf!85CUKB|bnhY{7uTDv4edqKNE%vqg$MU<i
zHV(Pf#D`z`YFB<|YEP%9)Z{r2xi+?tT0XR<N$hqV<ZHRCDeA1wYi-!K86^hNOd$J~
zW}tX}oJbeFfjX%K^%4l_z-e~{et150dqHg7F?3Fc24n3$+FSRs<bHj)uQsQ$CFk2-
z^imA~cCUEORH(A6liQ|L>{k(N{>3@YRyNJ?5<3Z3xn;v&Xg(Qia`wM_iJy~?V*8=^
z>DNh!i_{!<Pj+2=2a1B|o4(&xsf|%(bHGl8^(>A_cob?ul?M`H+hP3-FC2R;eZLMc
zZo)%kkA^%or@K3y(fAY0u!}^I!a;tk2~J@~AUJII%`*+rHD0Rnhr~cqG30snH6nKl
z8sa+g3u!S)lwY+Lg+7_8*16%bE3c!+>G4qG24+9e!TEZl;w7z;74>s4UYu0=1~NOh
zOyrf1;5gc6+I&qb;n5-cu-%v43s%Rx_-OD@OIPvqW1?Z=h2!0SlF!d!NnKpf@Z0nn
zU5%5i`f+KrBXWMT?-VH-R6%<>taZ>kLE0ji_^x2_<>R{j+cts&Q^fn)3l3&O1sMpm
zIroeK7NqI>oAAP{peWz0{8WM*%$}je5mmu7;g@@?(0T=iFbTe6M99R{H>0i+7EPNI
z71rh~Z*~`aAGw#XoE0fCBG9rJ0^+!42K%X3ZZsJHEqXB)loD=~pTl|$;5xmz{##`F
zKR+9+w--#km3|V2!7+xT$zo9I;l_&ed;R`=>pBc~#c%sRX`$|MoB0EDs@*Vg)ynsS
zPPOp<94?nvtZyxnT1K+Dz?HCtshC~PIxE+YLIZM%Vc5Q<UBQdxd-Oi6hmj!&%uJBk
zG!Wqo6kl{@Io9QDgzExqg?<h6#F|+QAWWg!(=%~gx3>bbX#o-3)W0J0P5&90|8KeD
z<{Lo70_og=;ElH<7!|t&Fceb|b<xXi!2<m}wt;riV(9U&{W=&<nG_CxkRcU=3B_SN
zewCCPB#s-wf5&dLlWcp<ag-g9aI27vF6lpJ5ogvUeG31CPjv5|vz|+0+A1~&Hlo%5
zz_b8WQ`d={WdxQdDx%B#)PM@%giE1`ek84IQ=kLg$Ck>(vHD7!c=|%D9(+?o#e8uI
zs{@Q1Y7-F08#t-R8ogli?pEPR50B;tW~PZ-i_X6jxt&Eg7xM-T<o)75_w6)L%5R{s
zmiu6s*wQjXICjz9Y^K@RA8EP8<T5Cbkz5@`o9`A8!!yXcPQ?*Id!251nc@hHhfD%q
zQNXqW31e@VN32{M%eCJco$2L<m$>05@YZ2OFJR=Yh4uEFRUTrn_yP?5ePPef9A(ii
z(`k^SpDHg^C(XA!i7a<8e&IyKxd2R1dt6>o(g#6fRhwCCB^2dU4ckbzJ2Y1Qq{ke2
zUyH-(dMM>@bm!3XUi?+yS7*R_PB3Q*u`7(+3S}t)8CvTzw`$xzwbZ8a>%NE`d-f^5
ze(uAmmNUiKgItsX$_1c7J$KHrNh`y7e%OibbiY{Qi$IFrf?1a&i8Yzw?SmnoTMj)5
zJvz_B>l(Q4Z4GV%vQh0AwVOl@Qc4gQSWd<${Y>9@-wZUDSE(du(9(KV_wzLFh6_IB
z7?oBW8JZ4JF(%VY;3&vfk-xSr$8wVf>v3@fcKJ6LhpKfvg?lUGW<H%OD5KXH<NgBK
zWqJZ4kI+DZ9zJ?pMZMI<hS=CsoMUh^SV3HQGyP^oIlt*;AtnyGg6O>`L&>HWTQ<nF
znz*LUEHRvUs2V*CYWmJFsT1tpIyJtinf$EjOTKg`|C9TJT>0T2iET=2bm;AoD0y(C
zFOdH7ICFWQQr`vBLfgf~g9?B1raIw9==n(9IgOZXV!l|!ExDd?2733%oPX7(v``fr
z-Isha1C|6<jw)n68(<+$PoyYy#rL}x1%W3fbeyk>^{OG6PmK&Jy`)n@@BEPwOsqLW
zK?gU8EbmtLBZ12TJnPhhxB};cB@U^8kxxeoYD;by7ggjHKE}=2Q2#J`mKM}~C|9>0
z`#Jn+{3d=8vv{y5-lS^=6ETIYX#pwQvSnq8d~xbLt~ib~6Qk%^F`!||&tW1z&u>1x
zRg_dge0A;wQ}d)1*-2iGmFvbWNUThA8#%YvIY^T}-#8zHw$e59`~_-M@;kSRT9=2g
zqgH$n?GC6v(J(ji**hR$?g-Jb1)PF@#26bEO*#g2>k`}eh$s-Tm2erSO{Q_fFh*zb
zj;pBzNsS&cUVN&uYTR1w{0Lhz*Ee=;uJ|$BB~-M_y<Jr)ev<3vR|a-WWUPBDH&Gr3
z?Gpd#uf{o!^tnMl8m+_o6t4U#?wA0$k}m0EZH9;_)>awUnRLvawJH$Py)Tz|V(zb&
zUwx&u0XUp8Af9KV6FK7z#a`U{u8oPm9-Q7Y-KT?cQHYfeOpCd<chFp)1uRh;LWW^T
z3g8tl;bYJr8*SM$db*=TcN{wa=W3Qfx45$MoNmX6L}{h&;35q36Q6}DaO`N^q`(ii
zJ|;D)@gX{@ND1VdupFQ|EtuC`?FuE`jmd!-t--x=X}hB#xC0>x|G5f4B0QJEpbTm(
z&;@X0*2UH&v-C}sL7z#HAJ7_IasFBIW4k!2&JbNc#S7ctfuk8FdSHJ?c4Sg4+a{E>
z-+3<|Y$i_98W&~#9Xc?6!+|CDOHszHgzCV`dVWDZ#}HK@sA&WsI>}6^nG6eDcUPc?
z3bbMv*Q$109^>NiZixjLs+EAr6GO-;A_|g{)dUH-csthaX~0x%NfA5ZU(8<<c5}Zb
ze^L9yH2$93+Wt%tzKax(aPpin|2wN`<oy`}ACZvTF7Z1vQQyz24sF@c5beNJIWLkt
zxk1su=MCi{>P)FABHAtCH=W7cgy7son8vbS_+Ait5;^gFVC_@l+N!9;Nb08us+ll<
z;dx3SP%xm~x@1o9E+zynN5;SfU9X->6HsPx-1h?puY8V)P$!RM+<LD%R*HXJA0M&A
zKor5Iwxx@7A}B1Q>1jLh{cdh-emtf9PM#RQ=Qh6%e(I{a)%_>U%*FpHjQWqi8950j
zE2aBagA`j@#wdx8o0WyEda~LaqBGbIK@<%RbRmcu+Yc*X=3j)~jx+P9>WK_@vsv*^
zoc&N4b+O>dHSjANYETTXIx<U*l4V80z6VTMq->A<jccATIa2b-eKb~bcKU?fOs$@E
zYl5`LY_v^@NE#!Jr0zQjwaoS(rDV&O5G8||0NL3mpa1rB@1NbnczJMjDKfqFt%I+t
zfQ+{tpQ7`=#QT&hl(jbZlYkhI7p%3s&BZ3MIv$y1jF|D0=;)a*i~t$WrHP|$Q<91{
ze3^1~0skHsFS#!J#G%)yR`Z$MY}3{$dgX*@2xTW)V;2n;HW&H8*aR1Qg2uxKew7UK
zIuzkN*OH)`=4MX!rOQtLcFP6K0d_ep3#&N8lR7JiDd{QT@&8wQ)BjLG{0D0EA4N$2
zt>-BI8v7?%b((?iButf(N3yGsF>0cO0IEItU|FiwAC_8wrZE`JaGqYTj5_;PY1r)x
zM?<Vci!DT*)UI18bmZGS(Quks_gAGwA=B597p5SP@&yybN)5zy|4dA2gM29)`;~F`
zbrcz3G5^!Ed1P*5JRs`J&8t8x>jG9K5E*?FiHZOBry>98RsY}rt{1@CB@0o9=p_OB
zG3*9#7T>oDH{cxKVm4#b^f0`7{%N{#7Wr*<eVr5^wObJS*ZwOr!T<5+#xkLzM-!8V
zw?$P;4=M0yMci~W(1Z#EH6bSsV;oTcwB`;E^2z<X$&@_ohJkHA0{=X-Wrpr1sLc{I
zUFerWUh*}l3%S!c@Mga;UlSo-%kHpJNWkdJ>Z=VXcE;3F2KS)s)aVj`OdhrD>{Cqk
z85MG1pCB4lmX1$sSO$!pS}n~bVNPL1i@lkjr(Sg#OrG`P1IBL$dPW9F?ACmGH6NU=
zQh%M)jSNG$w&>WB$80$*K^JA-?w${jgbAWwbs0Ninb#S-U6>#zyKV;)c%)-AJ`9Uj
z^n&0E{1ugIq>q0CsbLRXhNEgXc6k=l81k@*@*Er!lkw+x@zZ&NJ+@!P^Zc=Et@+MK
zQEz}>_Y~v8HgwcH^0+HwMaA%uZ{4p~+4(*IB_iVT$`w(~{vqL$hxG(74_>f3E_o>L
z+%P_WXvcX!*Hi%l3@yu^mtn7mC6p#K>kg9d|JYR&<k(0jB1yHt@aWlrU<*=Rg-}^)
z7Y#5#2RPRHARVaZo@E6;8k`rrDDS%+WZ<!xdFUfY<B2bbw(ZV=S2g_BGeds@IfyDE
z23fTBM@su$L-ywibFd0~auRFQ$A$i1s8wkE(vPLiY=SL>U4DrZhG7b%51$5Dc5{~t
zsL#lWk*iC+h;wk~8sis>uY!Myp-PB$<y$-QZcr9&-lb~czP@Fq1Fn<GU(UmyN{r_Z
zylP%h3#-Pr9HA%)Y_uAA^Ul5_j)PS$#_=1_sO&oSwqWJ9CAQo8fgLlU!?=@XXOQXX
z<a5+(<jcaEFP%5rjN6fe@pH4=15<BI6W;cNp{?Sb19GB0@ZpNyg3orM11d)&O+=Be
z3r_)TE_gA9s?nO2k745(vTJGPq}%oiwyt-CNgEf-rdQNRYOn91<f)1~CQ*=w>)2Ak
zS8iYagiOWjv@gWiKif_xoa2G3D>Rr0Axt3dL<K=$wOl2?Khy>PKdilHRFmPhH5vt^
zND-yCsDN}3kRk$6ktQOb0s=xrq>J<(5{gtQ0s<lkBE3eWw?w*t^xg@*lTZUG-q*A5
zy=R~A>^r`5&i#HcMn*<LlIMNi^{h45Tyy4Rpnq!S22lPudwkhrw#?VV_38VS)We#0
za)8C8_zxW|r#EYrNk09G)VMNmE4o~-6)5sK@$ndY(>`CYua@EcE1gTw_heyG9Kb2g
z3{!eP<0JI6vA(MMw*Ff%CDW^;JxGP-P7_WCGaj>z;()!Xv5Vfmq<w>SA!t0)H2Mcp
zs&>VttzBo{pq$WDV#ho?MNF@USFIS!|1i^f_0ftt>bQy9uxjjZ-SZAR6GKZFG^?b^
z{a)0Wthg1UScpQ`l96PoN?&x1v<ob8;?#I4tXv|$#oTQ+*5E4~9SQ@+xG1NpL-cXR
zQ8o01A2LaFs9w^y(wr*1Wob@v&@%cE8G>F&o2sx!-Nea&>xaOk&)>VnrV{hboMmAx
zaj0B9FH0a%Rc~}HhT_L{@dn>!ZW(OK_%c+Utr5kxGAF|qz=0?(yqF&PbIV-7eGdkK
z1g1|3veR48)IXq_S#+eF)RZg`D&JYs*XNACoGNp<czI&0-OK2&+;(uFslC_gycWcE
zB3D`f;Soe0&-GaRE+2KQ#GlC&Y3z`<wx!w06r4#9@NAVvJSIydEYbUBJ@J~qxp}PQ
zPS*$*i1!+?du>Q&826Z@siPyU{9T^IuD6*<KKLPsb332O(5Gt)<Rc}-yx|P_7otLM
z=VA`b62arM_lWJiY*_q>6u-c++;mtmUHo#fK;N4O=0d%c{S`n^V+sXdQFi?bX7CYb
zc6139u*?Wo4IFdcUcwsx%%mh<djr#Tc9<&YdDMUM!?$ewc#V{URAu&YBv7|T{n(sJ
zV2OD7TKX49{}5WPkqL0<^}|oULEXaTM@UsR=p58NxfA*9<-s72-}smJKb0&F&A)kJ
z%A>wjj^%H%x1*!b6>l<_M#LL+SaZs7GJ!X>1OgoQ!;d*eoRF%jK3OoK8?)DzNmH?(
z=19`e`(V7#+wiaJ<EAL&Vp_v-%th8@`%kXq17-_WU;~f_ONbDHCO+;#U|8^MFcRIj
z*dSt@ADOpt8~VE?S46+CuUhp72~G4xeDirFMPt8Td3n?I(|$hK|9V6J1Z2TBm?*g5
zAK+~<{H<}MiqX{Gc=d=}wF1FDDV3IJ)WM{EM_-F~UsrX9z9v#83E<7Ms~YG-HzBjE
ztBWkyhstHY_Hy6o4y(8?0^L7k`23|t?gEppoO{Q4k&Si1#9yu*w~=cH$DUZ;&Q^e$
zocSD!5nKvWpVA}jky%L`8{}(tZ*ElALnMb}9C4XH9ql~{R$J#mWn~)~sf0a?Ch<qE
zA59}yx<gt=#;vxUr}h>-`&%KQH77=weZ6JOs)rbFdSxW-dlRpq7dpep*MV}-2>+hN
zFJ^Sw=9*$34M6a|fqV;W#}ps0MX7N87bbbjc6GcB<Ezd;o5YS$dbIbXT4Nwe@YVfp
ztw5_d*B2a0dKWJ$jBK?(GhEp%3qLF^fyv^X%j~b%)%Y1!G>fuK*L>w?#k1oaTOtV}
z<iRoTIi6a(TfGhoS3`a7oupNH8tDOOGvlZCK9w!K!>X^CNS_-IIv_tzc1m%!?MkY-
zO93=Aho@~BmdP@HFAv|0*BGcVKOFQ{o_P4o+9qxkIPv`&{Z5)y)Qq0c_1Ksls6kVJ
zk{aBCV8W*@F;<lNWH9^E>(<};VEt@QMeOKeyXyI|MleBs)_&?UB3I3(<zD*2I|qEo
zG0opG?uMYSe#prztb@0Qmebxz&!NOB;-hgqL7hDi#=ETX-TuSZyXQYNsV3o&JD!;K
zYAmT(gfw*fB3>fE6|={@Ee7b2ZG1jmJ8lva3f@We{T+?KO|?ek>o5m@9NU2Wn!j!+
zY{gGq)gJ?N;<!^Kl&u8HZCARM^3S7zt*^6l94W<l)t2?tfN*W&heL)KI{NB0R`ekk
z$#B49$?^?z{df{)MJb9A`ua$5%EhyB+c~IR;ufF%=$V_hDxmfr_44mX04vKus}p^S
z0^{{4LCM`tx}t1>1V50dDV8Zt>C17kRSt}QKv3Et<97N~&-H+<0QqaEeP_bSKFDwP
zs=N7faj{avr%es0E{FLp2WtzY08bQ}@@ra$DLMkKu&H$q$CGI_WY|G(s-Ddn9q9X1
zIq+BOx~A#bjRJd9>)7{srgmqq@6Yvh2n2JCf79d&H3Z+4Hr_19XF3`7ib*7FCr1Xf
z0AftRdT><JeY6~Up#*vff}tVB907J9%Eg%+&<Q)-2jAwz9k-zEL9_ZyD`>79z6RJQ
zau6(l1_9!foyT_JCm$TSYDYXd>i>YUbzNEO>-gTYcx%qp_Qu6PoS}hd{o5q$_^}PX
z3uD(CTa4*t*Bz3wHSA0(nk*P`n)w5&9I9$wOTP-%8-h%ukAsH*ww{n&XB&d);dN-_
zn5kiD0mGMY{nwutuaJjYd49E)QxBn{NsTB*M9Us23Fe96)>0-Jb^P9(vZIhXZn|@_
z8A%=~K(Y_^A{6*&@R@}~U%VRj&aqU|a#AVLQ*uGJN?gj6HE?Z|ZxfpyFiJ5M2+5nD
z=*Rp45yhA$p_uRx3&;)sfXid680nZAh1MPSkX^ylP`E#$*%5UWVFkO4)oYCqm{f>7
zDwGlc?T?+k7LbYGSbfn3FA_V33x5k12xejK<N&Vsxo7ks>aWN(D4FhlFK(VpM}e(a
zpsJHKnUqYlbPLIp)P1tmSLeP?h5Xowq5}EVv_SD9w%a{~JLE3DOIYd<YZQ(;`cQ&S
z7+o>e{rn|YWqGR2flbP*)9WkK?iwZ$EBAWg8SqZTWk6)Y67Yfs<J1;Eo3<nI37org
zcZ5x8jAr_;Ph(7GR<fSCxf2bC;RBG0lVF5h=DV}b7CqJr-@lKd`qW2rTm$kZOINj%
zvSj#06D#Z$2|2Mx&;_O#GW{l;I}xMV+zXd*o5#F1LV+8Y0nT7{Q;rR##)og6{I9Mg
za`N-5v;%xtU~4#35RA7?7H{J+e>j*vLqD1oKoC?6Nl|1`yf=_L6R$v8GFgenH)ds9
zl`KkKuLn~+9CR?&<`LH8UP*joPadY*fh-h^AprAfxWFZu0p9BdK-N0yB>M*xn+W{?
zW<2UOJC4P(5^e#+AliD5kf*gHNBwMiw5xM1yr!p18Y<_WhxAm{O1|7x2l+a8GKG=(
zn@F*Oq!RLt{M04A7(PhwuKde;;SXbn4TKArL=$?tk$R$vuI=!3hfHuKdNQ9(yRv|c
z@($%Ak2im2s7`rHl9UsRQ5CF-;~kNI?Q(m6FwWsLk$jQ=o4qP0DWQ=9(|ci5ys}rU
z?U*h3yT;A<dlypudF-+WpMe0kF;$ML#N#!5Csyy+xAMjo#``DG%e6~E30U6_+cGc{
zX4CQF57wcoZf+H37jF`#*y+dLVBbC{0s^?YFW@Rh*VGw@67QDt@7ld!t0Q8PQ==jD
z;eg$Kc_U%7L?-F%jh4PiEND4VD<b}SC)c|NAkYO61)!qg5By>P_9-QO2Kw<Ug8Of8
zkr;7KnTqYBzisBG|A6?lKAt0PlYb*BPn!1_$a5%VQVv;m^T))7!jPjk*Rygn9j`gh
zotF0VPLU?TrP*2(%(0+;xwANI1({CFpYRYqj$#9Dtn1Cjm`#(pSx4iuq+*F>@`K0S
zP9r*m0%E_&InNoL^n#!L>4;`lRUWlGA{(x=?ftZ;tWTn8Y{&IYTDx1n)Glytzpjgi
z7at<O12H9hz5=>kh1-LYN|c=!A$Uzs=Lp>NI<uMfCHXn8UpfI9Vm_ar3ZSix;$t=3
z)7h3Oc8ka`$U>#6cv{>1W!1|>=HcDTA`fIYFNeP@L>qjOkeKXRpxhT+KDL4m1RxY3
z%tW~?@;G4T!5s&}Cr=ZMTl{$DUp53b6s0+FwdZ8W+jW0u@@`UnLNhxS2zlLTMR*J>
zQiW#gMPa#29(yNiOb?BC$+mb|Rz0fL%<i3mCTpX3pEliv#q&}|);!}Y)Wj=lnEp8U
z9r9>~45^A}lBb%I)#X~GYtsgnbR_Afa&d6h`Rsi4HgcVRxzzwJI0N1>etZ)<d*~PY
z1q*P=o~OC6$G8UY1uWJlKjWV$6Wb!)(H*YzzZf8<RTb6IJ;)~fGKfw1Tg(MkW)><#
zia^lMuS{$1WV+cU<YnRuK)eA=?y+F<O51)llIG$9WPiVdh1G(_d%|so{Ai)$ne&-p
z8RrK8M!710KE^S0@DD31SUOu?U=gtnI`8}v68THKv+$Mn^7z4lT;yNnn?a{W4e8}A
zv0Ik?#8bOhW=~X6FJ8l0Nqhs;i^fE@tu}eDc^Xw7yzcV(ErW5}rUztx-lXCO%l;H@
zb!Snei=-q0Jpd>!N4A=4wqKTORMLDW?p&5iKGZM$TKgvM_|g(@c@)urRCVOIH;p(Z
zVf(jF7dYY5-|(*<4CdAbhHFhgGK*jAF2ADUGdZ$zk$G-=+<J_TY?LMN!k(66M^qme
zSzH;Bu#8nzZg71wc$2S(4RP)+I2!1KlPC;G#So`BUib)~s$LZ`+(P%U;tFZ8-M^rs
z)rzB^+o^QvgXZibJIzPqhmp|tnb-%Ve0@wosw(3HQd4^{Es59sd%j*{F3P^gzxU!g
z&=$(}OUMg=U^bB~jw9FEVrID};{_YhUnCYZ;)AbBU84|h1Kk;*Hvap+O!p$d6Z4df
zSFnq;^16!w4mw>R<tkJvEq#ukZ;CXyD2kL;(NH-eaTWbNRZ^nNz&h&rgpxLQOm}x{
zFwJd1Adk2Q6g-+7L~kG=3?_==Db5{~lo)H5*T<E0j_fvW<?#=go<0f)1^J(BcLEWZ
zj}!~1gZIy!!<z?`IJnNQbLlo3e^ZgM(X0NYJY8C%Xt~y~aKbYV&{Ur|PfcUycMwQ`
zPnyzfQnpuen9^`L?Y(i0uaq2huyDL#ozpkjVZsD*^DgMCX!N<C=h0uxUr6l$cqmm;
zbp`*9l3uVJO(#UAO<Bc$^*h9Dg@1Eo@o3}`=>Tto;)}!dhhng)eeW4lZCO+9syDh6
zY2+}z69&b$y+YHX?QNk`fN4k1f?n`cWrkPK!lbyRo$BF}i;h+$v%xCXp!;isnz`^+
zBD)Qs9|n7hHCo;Y*Z8#QrwD1!otJiczj-yy?aHP)Tmh!&3Diizla4N%YO;F1MKs#m
zW)HkyAf|7sd)aVUKP--h^Nwea!oiWre8uTk{Ev<{5o(^MI%2oWvQWu1bE^|d?P9`G
zTwO7k=h1=F8m{9MDx$rtZEpZAl`1`A?g=K2gut5t#wJnZh~m>(QW0WB3Qdmy+D0w&
zXSa+G)$dXvRDca$jND!U*5)ptw*uLC;tL1PV~3m5(*YxTB9JO^{JN=_yTHpcX*m*&
z@j(}C3ov}4YFEppf72LooA<W`=XqxmRnS+a^|${72Q#X5qGX0u!9HrwaAC;bTpofg
z6k*9~`<=jKMdj}OIQJK}&3YF$;T+h;sqrYdGmFnRuaP5T{-n=upPXC&o_9&oh0(RS
zObwV>d0&o;9d5BF^fSO9c1H}F^)DRCXsZH`ue1J+zRh{(xd$@Gal8$_#8^NooJ8yW
zKp(ID0lhs|+#v5~XR3cY0y-#qjX-w0&-nBI2X6WoYo%yM-S&C<Y>X(v6bX|=<DTF(
zJV!kisby|Kwq7bOmkh2vJW=fR1Bbu>$G@ePdg%K~n_1hUpNUud9wvij6bM?AMkg2Q
z9Zp;Srfp`BD8KoZLbP|bPx$Y#Lvd`uZ^W>ZF{zWZSg@Y+`KW+Qpx+=BI5epaox-4a
z<}Qfaw-jwVk{=>vCIAdT+zI~?;`RkvffPhWd}v7~GoTEFnGaXiEvj^6ZX7v$e`h*`
z%htiSqHV9r%|$k7s>vb>gn=<(8!(xz9FjY5ZXZo8Y`VfW(&e*mXjAa-Uo=J^%)VU^
zr3IxgDH};eqo`oa`1i$emtgns{+RhIo56DL%r`&l=I(TUe3zsr@AKujP>4d2Q?+XI
zqdxVy1?N!kML2uuCh->5D+Y6|&=(j(<_c&Eti8FrPn@slNIQ0RYN&|m<kdCBb+#hH
zGp~4z3<4GdR*!J%(T^+?<?bjt^K0^R$J-duP3+!utO6{my#^t#p_7iSDI)&a#2eT~
zc4pqLYeP=2JyeVOxi7)PP(hWImEWtQx;t2EYJ%=-@;ERvYl1|hLDVlr+gZ*na-o3~
zRl)JBbhQBq6UJub7COjkyLx)MXFb<dKIm>=PB7uS+_&47Y$K4MEhM)#&!jAffnFkN
zrI48=xOz0POs!IoM?>P`5=+%ToE|TyG$kv(GK{7<Va2$ZzYj@p996xAAJ@l*hmd<P
z&8q+(;>wNGoDQY5;>?fQ+vSok5`X@rF7*U6DYNDim9cMAFbuc$bXBh+MF_)>Iz4{W
zG}MX1YmrbULbP&mK%s@$@D7Ajvr6DeQaOv_WkVi9ku$#eL>cdGAZk2tZqCH(0dBFc
zn&yUv##+X>xjCN9P0g|?ev7#;U>5?U@gQLeKwh92@Im_z`-IPO2^tK!pepDP@0iI9
z<bi)ctPVHtODxrmdKBwy3{ly*a&;-cZKk+$Q{OdNi1S7*AR_pBZ_<_=F&_fKW(=e8
z?fxW|b1QHLJUdnsGgbz>hb3V4!eP=yw{&S6h7Qwo#6qroFj1bkt~vEE*jQ1KFX?GJ
zq+<RjglDTpRTx*(sz;9xF=?D!n|I)nOPU=)nbHiyh9C4z8yFf3g#uq12?ac)HFZg;
zXd4orbL9q@PFcuG>SSS{<hpaO<%Onib8{E9_^Ya7EW-d}=s?k;f}g;<D891F{qHe)
z<Gy(o#9|~q6L8@%ASS1{0jkb1)4!VT?0ku{j&<#V%mLG6@9<w1CQw)L)Gx5_J{gZl
zq*_{a^t?O8An^22`Peezk4F2k7eGopc%}lLMHlu*<*iWn)Q|dQH+*aCS=fut#jUl*
zu(z?-ncr<c_8)o6DY+9F<<eShu1zrzbvU)!rk^C5kgqaaGvoO9+s9|gzk&GF_Wi#Z
zo+#Gl<Hl-~Ze(V`%!Zbv{1?nd>r(ZtbB4>L8J4ZcAT@udUjNbD(W;{og=#n2ueIt4
z3Qv<>yC%I1pt)U8rJ~gTe7LOgi^es%+-*I|!HhVbD8rAWd)FHw#{nbG;>6p9FxjzO
z8HWst#sKM5)L}9L-uJ@G=v^RW7HL90p<UAjG)jK}&SHoSO`&G9Zs_MfAh}aM!ha4;
z|4gR&Z#)M78T$8L6|x_J7lja0Z2|OSD>s~+qzTPp-Ot~tz<Rf#`5=IVEl~k$r!6-<
zas6|*(98F?#)eA1N%V$3!8{Ds0>vj>&;=n_M+sDm&KKZ6nGwwpC(j+O{a-{Q0?XsF
z8b(i}Q5`0k+t+4;7-ghuURvDimperk5h?I1S%56PDY|w3lIiU9ZEgMl$#quCPU1l`
z-#Zt-sQy2oP+43!`JK5xa4M!iiEjgiVUpEYbpTGKn}X?N=s45r7MbLgiVH+uZqGBg
zBLe#Hz<2q)roJpR3&>@p=*S&&-1XRdq-2|6@}x3QF*>N{&ZxA1e@98UQ)dHvsO>Vd
z9H>Blgy$x+^ml;Im_7H1Y~~1DJp}WJX!!?}#SWa2&DP_<u<2K(0>nbb853Yl4UTo2
zBo7ap<^_I!)Bh@E|I?dgG-HsFEtL;*3J}%5a~`T{6JFROs63pf*xS#%w@+Lol^IxY
z0TJ1i@nWC!X9OfqZ6a+XFD3XaT)wH74x|jJcmP+tFWCg7EImlFf+kTUGa7PueQO>s
z4xlJY9_LmojdKzI$6mIJ{w_q!fV9LB7}WoOzRDqNtBA$GFO~mG-H7p9+Y!PbBBnY+
zJ$WfwEtqNvp1r$SjuItqN`<uast$$m6B+l{>{iM<5Jgdcv915npGfK07u~m&(ph@v
z|E)*&0@336ZH*j&2Bf+Q=w-wXE*=9MBcLsEe~Et^SRFMvoU#WpL^Uy#x7_tK(-@{Q
zE-*~w&TGEBa4HR~;ZJqADWds-T%vE;hNGL;2MyVAPPwzCZ+5P|3#ELH9#dOR%!<5j
z!KerLHG<SSnEQz1?NLK#_2&^{mPrcA-$?P1`9nsYd4`l_CyRGtBGdjAo6eJSiYs`v
zEHV19%J)c;yD2f2ROK<T4Y30p3r?Z?1D8R6TX^1hJ!_|hIL0ZTM-N|z^~uFNPtc}2
ze*z4O5TBDi5XErronw3uG|DHxoWqcQ0wTXVV?6StSd*CzQ-|r6%@#;yk=(#`TxfoJ
z3?b!1)1l=SU*8k%Ic|uY#$dots~nH!&GG)cnc-LN2UeKnSQru0gKC_|P-=K<f*6o9
z#KlU%obnx*#82FPbG6?xg7yxPX|2Y|m))MI6pa{(iu@!oj~zx-ad;Q-y*l_z1ZG@<
zgG{>|7geqao<8^B#i7uzDw!@v;vD^(w*wrT5q5f$W~~Um-8V-P8XKj#6=2B@%M5p-
z+(x~Ao1jI;S{heHw%^l<gZ}W(_k9u<9)J1PeNnLet9gD_HyyD94_yi{JC?;S6`0|R
z{nkx;n-jg&^>3nD$I#X=SqvqXFWepz@uJbluAs!dZ-5$+>jJ%uqQiq1^D>TAul<Nz
zd8zqXpY6pNk4<Cr1$$9BL9R5u45{-)Po6~P7LZ5L6jgByh?WPRi+rsWKy=IL9$V0N
zh$?U=0Ajp{vUuPtefp2hOVSKuea#mL;~V)vp}Fu0PG$bg!N4bB)$C<6xpz&c0;yZq
zxnY4>LIQ^KtxPN%WAeuj#jVTr6~2o8zSl44q8lLhNJRwcL{+z>$t+w&`^E%sEs69c
zKql>{p6xKSB|Da<6r5^ELn&d@q+*y3R&Q~&0;3n>J^cPoYX9Wi)1NP_qL=EBBmEbB
zB&EWqSTjRkS>2M4FL{~19Lllj*a;UQ_X1K2lC|XNs@OT#pQ+ENDS-_Bf@5<}h3&(V
z!ckMcGO_cUY8j~;N+&xaSc{VfN{bG-(|bA#GRx5cj@YF|)ofdW8hOZ1rL(m`dCGo2
zQ{Ipl?s<EO|0{Cf3&5DR#89ERf_;AMo4HNy>$a^(Z&X%89un?gPPWSd+70IM=j^*b
zB4&kG%|rabg`7x7=CGKiQr6Nq1t#d6et}meJyHnUA6|0HtfhDPdY0An`KB?>?AmCp
z@T*Z+5vyccE(IzRf3D3#rc2s(E!-g=m2HO_ALT20EN_h3=En9sTiOvxXWG%sQFF(}
zS)^+4O3eHLi4wn%0yX;Cd_LS>ey9n?ijtae<L|an*L@xzw0d9O4nC6!4Z7WYX58}!
zM2)tJqbIU7jmViZ;&yMKUTyQHmX8zWO^*-6xxNS~zV-bi{xtMK9*m#hOcWb0t?HFs
zq7J)eFX?fCox@;OmMnKTzr8~6B;LX~zmvEH;V^%%YcWabR{Y`SGpo9OhqLe(1Eq2t
zE5n`zMs_@`)}E9%&$#d*ozU-)RwQ`S+1J|7LrOWJW2RCQ@*HQOVV33w-_2UL`mu|E
zQ<oC0NJuy{QFXA)Q%6GoMc<_#8lhT3*xN`!Kr6>FF5(Y}lc?j?s%7TH#s4m4l`34d
z(Xb!5#?4Zy;Pn~<=;qns*~rU~ANJPqu7_@p+c97aI9!$Ud8Z|&m}4PGLzat*h!uO(
zO2H*IWjUB}@$xDuee%>EI1R54$!WvXF?)P%F@j}j*Ly^dTas^}T1dc5zhhhopAg<U
z-)@{M*lf<Uv--iSZ0@@}?mHIqOH3E+_-+qb4-(bvdD~<P)tc0-AO=u&bKoo81kjog
zQzys!II516+AwJ~@p5Es%LlPy(ck=$A-Trz4&PXY!IVm~E95~$Rm!`pfxSk4?6FnB
zW{T)w-ke)!(1|V_MsBH(Ezf~@jvRq6XPeE={-RZDUiox#Hok)fNFWmpnEcjhL7mzw
zh7AU7`!U;0WiPH+D7X@?;B8wGmsjwiRzBFqICPKE%f`#DL7jfly26&<PA{z+9uFDB
z*AU*oMC<W2*fDcG^=Q??yt{xtfewBA7L=FV4X*MIR~7`$$Vz;g*mDO{cNT7ZzakI_
zM;%RIftL*rF2$vqeQ3o2^e0Jp8-$jubQ_SETb~Nq-@o@M4e|^$@)F0~es8$6&L>*=
z`~GTdXBrH+x<KdHxRqVnuBK&4Kb7X42v7OOz}fh!!nXSouN5FdQQ5v0CD-)pZ7x`3
zBW7C@S_;p=OOa{w7n~`yq@+AW<f`ANzmV-29{zo!1dt|@#oC6bUh7(FlHB;38qs$3
zyFq2*aK2xkY}mO;Pnuz$j{y*ZK2cQf{XDHF@AZM*I)W@s#PXVbJNzN}H}GjfL|Ig>
zJ2rFC*I#QVJt94pMu-<TVZ753QuayO$?M)-`9Mud<5;2{DM6J3=3Jv-oE&dzp#>T5
z$TB-H_<U&J2ME)N{K6>9=`_VbAXR!T{t^%Zl<-pgVFNCy{{Wd@0>sK})6Qts8>T*B
zOkULI(&BFBwSXCl_{@(>RW_S|76XFuxp_c6gk`qNIsH@gFl%R?!YfoVUYnpuRKcsS
zpyI7rQsS3nS-2y4_ca{5W3(28dW!GN@QGLm4WKz}>(O{{iMfL-&02ErWRf4nN=+#o
zN^U+g>q0uZwaCUIaAzcw(VcCgFXsI`^`_*jsQnue-xaUk<gXcPTv|}ruEU^%#*J$}
zt52J!^)*bU@vPyCrwg}nK#O(lUJrwzyeFu>D`@}6!Kra5d8p=K4zEPREo2EfV+b$@
z?4v$fc{)fpFQN?b*i76*nO~}w8R&<^wFu#7t;6X`CYe?rpM^Tar<i4E6PVBa0nx@5
zsl<_k9gmb<q@hXZa`7(q7&-OCFsJ!5TIA@peznhMk0~5CA+o=g#7NG|igcbg`RtF5
zH_X&lxBxYSPr(3kLuvEu$?v<M*NFpkr^A@@HEm2B__!sf0SSArPOX880ehg(>q;Rv
z{J!WHSi505&*wR-<pb};jECjyAMNqJK-f%w-(o1|F58tJXKqc8|0Pa?w7?#R=Ha3D
zhl#hd+m|QpziT?voe4Ow*p8&X&RF|=ltoAvOPMMJcu#b*#JS8HvD*GePD7APy*kGO
zjdm6Tz&VCGD5DCmUJB^?HYytsJnSG<Wi?pY-$Tkus-3pkH4%paIFo?SjxLWDmx+to
zb1=$|rJDR+XhWqw=q~>SG&P{28iyCM1#W{-a19aAc9ViB1L@9y^N|jT@6deeyJu~b
zdPVs5mPqYW+E4VA4`tchgJlWL>L4qhs6U`*Lqtg7rXSy@sj*yp$6I67wBjx*Gq^0f
z1rzJ*ioc`JUvOh}Prgb4?KeuoQj_VJ?Fp}6kSCPT%@+fp1_{TTo4k_Fmo~&$v;~VN
zr#sg!HYPeVKa%fzND(xBCJFdl2&xLf{^mMGK0VD-abYlaEc;_@z;W)yW>PLVqOzy>
zy{Bt1mcpAWCoo|AT6M<VJ{mv{{04e^X-RLg;TTanfV#1f{SfDcE}nHz7~sUz`3%!i
z(pcB{^1sQkcsaGk-RI&)y{^J?4ycuyum|l>fX!g-906e>GUv;emTiu?NaPmD@aqT|
z>-SW$i)OzQN)Q8P@C3uRZ5Q_@_tbEZwz&6GB7;PGWbN=y>1&^rgmK+>#pSbCWI|je
zX*nU{TK@6SG642jbtbZ^Erhr0#X-)&6fn?tev~Nw(Gr-Bv%g%Uj5@bqy~%9bkd5u#
zyS|rR@*E6vA~k^@?oaNCAxOa}D~6QS9KPd++kV$4*WNR-Td{7FZ}|8@z0uabS#0%I
zbUp*rbMP(|{1tExJcL~#7!V!s0Zc#VgTPF&4OyEzj{e0CYtOz{g4g#eaucR!^{yoF
zUQfy))V4%_nMOP=_{!AYKbfb87q;CV#ai9R-^n8PR&$joiPXFM3q{?kwOG_CjuaAK
zuMt1T-9p-pQt~L{Ho!9z{Ncmss+3kp1fnuCaHmmfL5kYp=Bz|+S$_VEscHM$7EA??
zx4W)*ii|qX+h#wjP{XAYHvnBzz2P_~hwTjVbn?cGhfa572vo(u+jAsl<iQT{v-%;f
zE=G!@EGe%ZYdv8XzY7UNl&5Sj5#AD+NkyJavEVE4%Ls?gC2+NwgSS|jz3`j)XN^&d
z{-cKVNz41k)m8>|Nf8z<OovSW5b}d-kf#vkQtk7Xh#mtFNA#qF<I|;C&K-fqVac55
zRNK|hV?~~5b6VZWx=3H%&{4{TosOi$q1(ZL0Ym#9lQ#CCIrBmZoNXQ|HHn0&xt2`7
zpkWQ;-3fd(xa`8o=4DZ&W|?x-9R&h(sjrgWH3|~=?Na>uvVAfH@Ihr7SM*1{SYtVU
za7>$qoxU^cFrQ`+0e#nJHQqt8;i2j{piIl8!Y43QZYYtGIx>CP9-bzj7*swf)8rR!
zdu@DA9Rz2EUBX`@xFMQViRO!?Oc?K=9aR~a()enuPn&79JUgwp@AKtJG3VGP@5Fzq
zUzZ=f)*(i*G~W!!<aF-zEb3mo4-5i2Lc+mJx29|J<b|G9eRwPMCb8QpK|3$W%7!^k
zg7w}{PVvr@p(xPWQKU0W1>?9ul+NKb+I#dPsibluH+E*Gi~e=%+k}S?Tu<Lo(l3jy
z2?R1AAQs%DOoVd-V%i$=hKZHPVy-*=G-Ic-e36&;f!DriQ@V6X$HtE_9Lv<S>Z_2T
z49GWAVTxe<7bJeZg-khGH6O0Zrg{q}QE7iHan<6U)p08CDC1j6x{jzQo$7yFeq<|h
zBJJ3TR1K$vkJe;zsfxfv*pKIA3Fc+R{-mm0idUXGzsiJA&zI`{UVeEi!<p_jigeqv
z^M8R+JccKOX%r@lE9%lCJ~ci+{ESZK^$_xtrpQ&dIh`a=-a0uvj^L)|PLKtvPZTG4
z)F2P0uxMMJyt|_DRQ}g3!ZPJ++ieN%!rkXfS;+Y&ca349<~N`TQwjG>&ZbO05IV_D
zdiecp0hok$M4xYz0`9(ZV?bzSiu!TObS?O8ZxZTj6xZU|bCxvjiP8F!5AtJAG!AEE
zXes@MNXM)?r7Dn}@tPT+DHOyX@1Nu}^bf2^c2CFuy?=vG*^Z#e*Hpu$cn%q*o83RY
zF9ZWUBqR%dX9*eur@^kooc!Di+rWt#)z<CjS0)-)4^dU#;cVQKSzAe5J?AAtoql)$
zeFtF0pt;Fo=pU*L806&prTjptM(2e>XUm~ODYo^Xvh1p`#d|y=ZjaA5b3*n<+HhB|
z(q0k<f0tYSVtZhWQ#*D6!qF$#V^Z!m!r>x1l+BCp>X4KNp@CcLC_r$>lFL#fOnw&8
zH1hFxxQn<+dF4x{X{O1OMZF!BB{RYfWC@5&>#97>j&FY43ve!*a<KQj{gO+Xs?Ixt
zs^_gOe~sx`LKLVtAiz3zV#dMr<A$TXJ$LV|q3>Etu{TX-KVez#3MBqy#RCUA<<9Vt
z)D+}+6Q55oc`^ON&hJf1Ue}~+WEI;@)Aq!X&eySE9spXM5u1nDWwOG@=Bty-%gDVz
zF``TzfZfAvv+r-5twnhbjCCA~X+Lu7Jdd0YnuTv`XnX|mX5U{R$C3LHphjwfJWOg>
zl^q7DnY6c2?nz6b=tniUP}ayYkIsY64L%c<>i()vUGx8_ts8$KKEur*7#msr7g^r#
zDC|^EwM@8;vsZli@Bp;D68re}6zz^hBvio!(LRYEl*~f_m4Ddoz`a>X&pP%K<huF~
z-fZRY+ZUR6s^3{FJjrk7g=ShG_`y{e-{@+jh<p1<9h~w-V&i@$z#v$2R7!!)@fVw;
zIl{9#<;oMlIHFI_g{eEAP$V{N_pMHvb;Zc7P-QM}WTQY`;|?IEAa=RspPEqT|0j<d
zjh8Y*t8}ee27K~cHZm{cRe>H4(epzKB;Z`9piP{paox1VsJe%xv`qFBIsReX?%!Fz
zDnZ5CiZm=D$^*@fhw9+oMiaJ=v@UzB33@Z70@|o=iv2^(1z{NM0a+rmoxvTWJl`;Q
zG%ss5P|=ciKu&dN3j4qNK4+@czi$raKb^r_6c3V%ZC6t{9Lfy-jsfTczwh15zrwP_
zZaSJukM@U$lIlh&A$IZ^4guM}=-GeoSD<YcFKk;0(2oNaFS7)5;{8FG(>L<3%pdFi
zaZz*PK2KJ6ujXtdACw(E6Q|2T^1b$@X}bxeNxn&mdO&AjI|-O-6}qR?5mGeogI<bj
z3njM)c%3b3x}B)=ZE7V##HHU{W>18r1@FG$VT_jKGAz<a_ePA8*tYvh4Qc9RXG&2w
zVS-}-^~*vWHy=}}!r0kDbM`jUsbJG+?1%2HaHo~c&RbFK+E76rz?8D{>iBR5Gd>GD
zyhu4NPd<-(8^5UiX4JxCSZZgFOVI6p%B6-R%8+2!bmM~^Tq{O1_!@A}euLe_>lAH#
zaG2v^^Ha%fFCDR5tb^V#au?;J_3o*uL(XM}0fq>w3^2YrR1@B8p;xM9cvCBW29^2d
z!>uk(LDue|4><{{Rn?Y}F%L7=T6x*Oku3Ilf80Dwx7vGq1V@jBmkdG^&|rvjW)$jr
zN{1>H>3!ol#NrpV=HN{g=eCsOJPC-d|J^x1H5LM8#f`C_AEJ{^Uwz~{0GcQK<Lyk5
zV74nuLXjvze40K^f>`tUPB^O8H(B1JVSa_5H$EhkTVE9O>|7uSqX2Oz_zPDe`<$mJ
zj;C>6@k_vre*h^N1)e8r;Indz-mfN5hwBVQ7w~c|YD(|@vgTilm5q<o?jCPNV|CCm
z^W0<^@)&~InJk0P)E`A=VGp+i)Av7CRe!!ics<Qp^opYz)-5l*Iol;bagzUh%p;D;
z-dkx79dIEv-{e}de_E;$$F&&0#)R8+MRyYJB7q5xumsW<#Cjp#7>F>*5J0F%p$)|~
zpltOOiZ^RFg(;QA7d;p-H=Vhf!1)c%$*V`nw}=Lz7s}8e@<rHHyz2t54#qpU5_!?w
zfvf7b!sU(QE{Yzm=2|gUimQCCcfkWxClQU1Jo}4_3_4G%Du-qs81338+;J1KeqPRh
zDgU>Pemb!&P&VF-uDhG_@x5i{fvD4=y@iuNfU(lYMcoRC^z(NxWy{aD57Qbl4jt3_
z8nYD7Cqwi4C5I;`Pq2*Gelj3``v=5^UPwZ4cu3JZD)nVAIZyVtyU~<>J~=tz(y={>
z<kUZ}b4k@UIm;?TrTv)}?Omoh2hrrTf(b`1&$80o7lN}%+uF)kG@28%a`b;~wg#8v
zT=I`<xJ&h4Y-)h-_;8bjodG#rEI08pB8nNNo*##~B7JH8D!@#vHU7EI7_hbe`E+mT
zPzDblZ_Q-e)~_Vfj$Ag2$re9zn!DO?_YN`FY}#J#kWyCNmF~seMXeS6?rt~E=dUjX
z&>)SaNy{ROcZwm;H}J&}qrOK9^(%VS#e=}XR3`|OQwINgBTj$;`p?49fCu;cKcK}x
z{5%HDEwp=x=IkVe6!1k!4$D0M6<~t0tC%nzG+do$hp~_$c;6Bqw~=kM&%5I%6k)OZ
zGm$S}&Z0a)nfDzBy0<h~eH~yjC(!Jz{rP40#ji6`yko^HWPiRyb>9=fVKg5QE3lgr
z<F{^~IrrA8gWlWV3eUQxK_qK=#su<S*~3HY$8JE&tm2ew`13znX7MJ^FFgI=AN8x;
z?(ZFwBmOn;G3|o?&;X!2uKz#zqy97e?+vFi_x3pn>{=jEx)9&feuCTZlZ>O7nVtFV
z60gqDWi`J}Er7jU7K;Y-zZMGIb=bF!m*TH{Jm6|Kqvm|-38tQo0%3cNfst5(_=Lli
z$q787-S6Yga>Kf??q2?nOpEs<7PZdp)IB>3G69rE&*mo+$)R8l#KH~02&U_Z*ls*w
znz=1axVr(aAVMo+Ruj+TpJ=gd7ktqjGQHi>H|V97e)NlHF%a?w07;L~6+$FB)tf+%
zK^K@;NL&Y4X=CKynTNuEyEf-;0pp8$$kpr?6vw!-<D!#TGnuo>aR+KvAJ#WSNf_$C
z^Daiihx65KWxBH~$MK{Oa9McwzFo-Tm!w7)pCAGG3e(?0(T!%0;uEC9%v(2^Sk4jh
zf&M}%DHXDA0QA4k1ArefQ<JD#bNm|UNojU~@wC7T_5<J`KoF)PzYRU**eSID4r7ad
z0d0PBlGvpjENmIX`K+P*$i@)lrd_79xYy#$4P(NG787sc!)?SpXITer)L*XmTo;e8
zSHvU@hEVKn-31TY{^t(?|BK}_xC<Ue{+C}mf!GG<;8e_{44?tWbOjx(%rli7zQ`LR
zE^pe#eE&o^MAFjdMuxoTZPDlQw?Tor0n^Y9h3#{<zLO`xbkUFXQRQ6eJk};0%!hKM
z^#5f8zIM#GIslW-(=GK$c~U*(L2yld`*v09+P%#oEkn&k#}?z`pQMi&1j23jO`k`<
z5u0+h6=bq+1JDdS|CK4*t|WlE%>s-wN@A?T1Uw#pKKxeWReeRO<kb(1TLRV}$rq~s
zYa@VpnGZc#Zr*2}L*GO=J+0}i=Vty{y+$U;oxyxqPg@B#rW$9*X>P5nI&jEdHk7kt
zixhqK7{CksBai1>#eN+zQQ2GjUGy0t(@-h2S@1H|Z%)8wAB%A>%m7yC!!<k<bcprq
zO|Rd@(_n&-PpR*-Vn4j!c3BjA7<)t4TQxw{L6y3D(-D|8i8x*ybN`j^lXCC2f_%@Z
zF-SpU#$^#@Hs3tzrCELIdTY1;E9a}aaQjxVr~@fxACKws+8R!aM#DHJpNNi@vGt>M
z$3ePQPqyK3Bi5rQG0IL5*%rXUqj1^hd}Rb7CCu~?!iW#|VH>Aj1<=AvcrP7q1^KOg
zf-y%44u$XI)P?2P8dDkd+67Q9>9IcEav$@YWmI{{RH;U;;6#dMuvdTRyp9RK&_vNX
zcm47?Cl}Z0&m-d=ik=)WJo_3&jo%T@N6U(T$9~s$;>82(!E#~wnvzAaYN|_4dKMBo
zET<?(qn6cU6>q_R>#|w*%TI2os{9;>gpCurpBOz;Om~Hd<=S?B`Q)dU{6@;ynZK$Y
z?+rq~Xb7+_r+6hyJ+i9hIF#FEQy7@PFAx*1QY`dhU~%NSjp1pi|Lrnku7Tsq8s)|Y
zo(-MJk%@y@cC)m{sYX_x4lHWyeOb5fKkvJTWN4`T+-F5u{Bz^qjCC?^#>865t*rQ_
zWkIZsts20AhQ^ga(>@`sg+6(Uv#wXyqV`X(`{dfqIK5ULZ#0>0_ocCmxXs#wf8UCm
zyH*$E^{Xk|Z?AX1%D~@L=mzwYlJlgVRs6uw>Go?{>E92=OH5~4y)PxpesF9SjMaKA
z4ahS(tXHbInJZadsb25jcwzGR4e)hGl@92C$XX1g&N@!9c;hM~R9!7}+@0le@)WqW
zkUrJ*QM-Z(vb8sRUph|Fdk=ClyDWGi_2j#=&Hc4_Zo^-0sA{KshkG7ZdWO00^HKS|
z7&O~tBbco+Dk2#^i%8_&{B^T6*OSbLqnJ*rsdxT(D7Ut9J5y@ckvBDrBJE`4_m1}i
zz)1xsX(d$k%4AN*>SnTx3)A(cj^{5&B)+>ehx%I7W%XEIOJZMk=(*LCt6?z}??dlb
z(3GS$P^oLfaG&|t?1pib7>87r@RDlMVlw-W$wxOL(!E)?l;rEE4)2+Skv}1=Bz{|3
z@b%@beTn(m{jn)WUb)k7D1Z3IwGJy42IFDm>i3U2oTu&<{RQ>|^DTqFWHXMIxvCT8
z({BH|BWrQPI_2@ZQLQ(ApTs>JIwyZ0nF|?(Jgwp2_qtu;e96aC(n|I|ux$SMo3i!?
zkyeDd4U2|chq1G0&@NS+fkhb;H@zXm_NjYcyJdcOrn0=UkydWahj!tqrL3}=)-!^s
z*4285$c8z4gtBUio$WhVYlhfw>&S(Voj0$I=lXcA8#WuRhIN+G4YWU9@y|H=<Sg+A
z)L0_+`v@?p)wxpDUU2FkWfO|*vTG3w**DJ96l^-YlR{q#Rp)%tIW+Fx;gZ3YAHUGU
z--byE<1HQpOzfG3*-oe_4Z+MlZ`yi29qOnPs9eQR?A-|^Vrzxnd2|)1&I;k-c1_)W
zgtc~d^RgT)hM>D%%oLha|IX@M#i=oBolo!y+uTO^^ymG!Df4(DwV2eM5QOMq#aSgz
zk+#d(_LL9)lyk7XMXH|I545#jukSh$4G>=86imbzcp?7n5mLM}b%c(%MvC`{IFh)3
zxW*yQwCs3T{OEg}UZ5KI?a`78AJ@Z7h)zZg=PQ2E#wH!W{X{P>qjHlZjt>LUqVsgZ
zNLKvTVvL>!Hrj#{+hf%Rm-^!I1w#GN9-r(Ud%u-$RbpbX{^lopqe3p%EfRF4?u$ba
zvs(b8GbWSx0ugC(4d0}&cdJPO9-d{JWS8}3b_Qv++OuEG=v8<D6<g-q!pA<W%!&z+
zYVlLrsTlgIbtRf@>bBP(kbSI4Q&(9+^>0_{V#8XPnEHD4ACSW8B!|Oe>602i^#6Bt
z_^&F)fAyT$njRp=+1`L3#O#4J2~9#BboGpdlSb>-+cwT_-Vd}FB*oV27f?d@8{h~y
z<(RS{zpvX|i*92Ry|MHM>@S*Sr}$^-UcZoP;z$m|D!njMi01f8{eh;cXxc}W*|FlY
zgNZ#mq%>Y-$-eQgbiD3Z71e&#a|)A9X+AEoX{(jrIbJ;sKmC|3zPzZ7x}5vu*;>7q
zT)x3$Q5_p#^<Vw7>D#&Gc}|#fz(POGr$$wjcck28qVAC8?zlHt6ws)!xt8+EXNkJh
z1H!1xY=zxw{%rfM#H?4|b=5a+E(6oIk^2e|Nl5I!7c|wF)(pmZ!bLZsSMo?};Y4AZ
zA&;xR+HaZIYaF){2|1R{`u<U88ci_oU3*QsnmLOmc2Yf>txt)M_{Abk>hT{Cr0Xy8
z@J~K5{}b5ZpWefC1;2p_cxs4kLced6OvMR>*mC8DDRo~5qig=MOs%ze9}ik2V!$l+
za5-#8>S7b?$>in-0o+*`rn`pl(5>XoC3O$agK%I_xjOTT=lr`w_@3q%tk?NoKV30D
zBF_|Qxzcq|6o(P`d{hYk2g?-QdYsaOAkr*n)*1ds9~Pzm1gT`z)`ktu=@h3hx6@TL
z@SQJ;P6!ArERMs6v$oBFaJS?$x0Z*cjFb_u77W4^L=*sObklaB&iSdOC83==i%)Et
zD(R2AiKkMf{Zc8F85xF64fnGNrLm)DC)hQzB%-a!YH=HgID?hW3L03luko`t7UoFj
zImP|aaBMIG9N4DKqC{g~=Y_baOh)A!)5<1GIy;wJW;>rdS=^bge8J;h&C!}3d+(*=
znF_Wh?C*TFyDql+JvhlK_veQPcRqx0r;UEv@2nFTFV#8Wuzk9tr%vWWt{xsfxh=Ri
zVz9vrMd~#mYKa1P5<qZ^$2%PkK@J~{5{{sOXfS$32Eu^)tVxdijD{BjN|y@wG;3Qc
zEV84}n$l}aGO4h8QI3X7`)d4`K2VSJa$=W?BQB9l<N615eXV`(j4+5eG@peJ!GLNy
z!E6akpl|@6Jv#b3rADa;@QK_PPe=jl=rhUPKnS3c90e+6Ncz%v!fu4sWEr<MwKb$0
zk|{8hyxVi>>$!|Tt6YTg{Qu&e`EPu0VAY=@y0&2se?Ulvr+{eczyS53`oHkI^#4!K
zjhrK#!xodZ5g`Bu!~i7n8%oAq2<#JdST*=E+A5Pbw>z%N=M~4%mL|XIi)x1Y`;fVy
zTs@~rWT`4EqDu;kAO%(a0g;3r9_USNE{;tf8{%6f7B0wQcwJrmD<--N|A69{?}C90
zw^@XIV~(gviu2%>cx<IIAL9JBlFjS36)UQ1XM`YdrIX{>0Gh*!p9B_1FKPkamvJi<
zJpzeZ1-fPdZ=5c|LmiL*>-Lp0RlQuDZKe|Bpdz7E+roPil|5TLMF!!^j=vzby*6h{
zKVvWqPA6M@7wgm1>xGIhK8<({I;hGL37NmpG=%a3$gojN$6>*1yY`vP+prY!`p98>
z_mv6f8bM7rb-!BhoI#-)64<|JvX1w@rXa%0wQwH+!OIi+zX3(+e(Zmj<oR#B^ED`d
z3Aa<>65A0>0;IXLMMGc~{QV<vi+~$HD#HIX=!G!A7(Ww5!SMhn@1A3CD%Bn!Dk})U
z?NUbj>UvE#GUcx~MF&{jshD>1Z~wAVmSsyt`WWo!|7q;`tgo>qcT#vcwcM5sq%l-k
z)6;hAuj}TPdm_Vb_cMY+6PU=I;f;H*hU<@1<#ptOw3cdnG`TH`tBWiE^iLjOf9>~v
zamxa}(^&xKw2*KIKIjKrSQS6LFfhv#pF`m_yHAfwY=>`19Ps8RGAq}|X8QVvk$jLJ
z(e{wZ;)nRoJbCoj5-(NBia6#+@MjI`8}yyyKOopch?HJX|Ne|xy6Y!xf9%F!*%%qQ
zWp&)o;DZzorK{uf)()_!Km(KCf<L_Hdaw<%@^OW4_9WykYB_J;(0T9p&g6QsJY#Gu
zAk`#8!~a3ujeG|;9|q^f+w8Sxh&Qk$vxRK#-zJoIpxbsP;6k9w5HZww_#l}dPhDhA
zRK%y*d)|n&+rJiA_O?WbQ$VBSu5{gIUB}}i<qtD`0F7Lq^aC#3nrrXMZ7wsBNKcvQ
zls|nX?DG@V!<d;Pt5AdJb890@iVuU2rJHQ?rEJ$$NcN?uM5YDF>#<e}aV6P7!E2sx
zONBjj5WYw2HOBR*LsdomAmItoVR#S5sa!9>C64mUiiwNQyO+*s%^x1$Ny&Ub`YG>0
z3aQb~u8F!6sk~wM?9L7#wY2hG>GeVE=o*9$&Vo0?P={W_qQkEDYu44dC~u{fhwuY5
z#aN^|57X0)q@CBd%^xWXDjfjmIn-I51gCDs$9E{c=&KS}HCKPys{i=r@SJ0@bAUy4
zz_edAaQ6Clt~UP<Ko#mgBmWMlAp6mHQ68Bd0xN#KEws()Wp7Zr)KoU7>dg4MpgT$u
zn-Z?<i;2-|MoE5;dpcMZ!8f%zW$-as<N^)kH}fy$SUU>5Ao9B>WIFTs9Z;>?uA^;w
zdW~iqg?KL7y}oqL?>NG(dQaX(|0PpHZR|zkT_YgMP}-3`Njb08{}?6Sv!pCBc^SJZ
zq}5Em^g8lW(5|jN0FwZ&H_$_Ad>k3j<py+8qCjLjn8ad$ce91yP@^U0ef9UzL!AQW
zH@jD;zGcj|#n)0_#RMu|4H>{e@56^6Re(uH+*F?VC8A+tm5;J&f<y_MzArO%id}*c
z_otMABHBL11v=8yzxX5wrf0swm_!ff{{uoF0|3gaKuBih<lb>KK8+xaUm;(GNz{ii
z-1oPw$PoL~xaGUxWh`>tTKinm^GiR2sobFKaB=+nQh1vRbP>^}GZ;{|^*Bbhh-S$!
zhD~uPhMF!SswjKlb%LATp)HWOTaZ4Z*R611;6wvXnk5!QYYN&1dB#E1`~yPl06;Y$
zH+<8>`0(`q{A=O-@Sm4@6n5gV1rI{I9hu92_OTj73QZUTL|Qs>FB+?-7YMEpiUN1?
zF^2)YIO^m<HQ&OAKdR~#TYVo!MdZX@v{GD>J2Cu!!AVvOx)RYD_xH^-a`W$1#rZr;
zUsy^w8CEx~Y@@~5)?HkiPzNt}?*6_<=QvZ0r66B)UYdQlNWdUk7*u9jg&W5tuUb5)
zkd-Jc>@12?W;$7?Xn|iMUL@rp778=uM^q(XR=7t~?13Iz`B7}@Ho*#;WA*06^3CO5
zkvH5PyVm|91d^D+SPkT)EJ5HouUgx@!^IHqW4!Xv#8%BV3Tol{1AU)NNfaM~(-Qfx
z;Vr#f0<lbt_5)^G`sY?>sAgTIJGpZ|HAV+KA1@i8KA^&dETDH7fGt~ukIaER!)q_5
z%FUnOJUKs8`RfU7PP4mp!BjDeV7zwhv#VcnkjbsABo?4)4p5C^0RoM(9H5inpYj;T
z`>l^3ZbAF((`slxr(LdbbbPZ|e1{kk=NwGDwzR|BsInAuxu=cGOq-?G9^uUU`-0YU
z<u_IzWfDrx@feXxOG{%ajg0hjn;PjZD=z6rL}Z^c)Bu58KwoM9<|6;9a`@-xM6v<S
zG_Nqofw)Whfgi2h_wxl4q>+Pct0*Q?`5UW*A+Z*ju5+EMj>|qnjL$i51yIv>Pt@`y
zF7R5YE$k@G&0;A<5&+qYO;uhT{n)-l)%5PunehZ7{qVRUmi{q^Y?0J>kolYMUC!5H
z^*(05Litlgm1=wx?R?g6%dU}R(w#WVcM?&yxZT~-xYef0D-GbsuDSr`L{BeK7S}Ve
z+QcvYLNkNctSKP)`1z*sCTx1GWu!)JZCgo!nlZ0okHIG}K_XxIa5Z%i%-HyPW|~nc
z-Iy*nE71*BR<(~iu6<bJ&v%fdtb4~(HP9n=QKs|&@R^mmgm*1nR*-L9Rw;hkin@Mq
ze)@&yQQ7K)*j0(}B)Oxfq2d5Y_46-CRo2=6vx|FIt?J`=Hr~1I{2S95zJM(NQRDM>
zdwZ4hZ)sfq3tQ`hGB!O`H_D^)O727p(i^HMsMx+3xHfXB=hC^re%`Gf$sOy8kDZFm
ztm|Z+@zAM@{)yo{MzM8S?FDV-pm~c9DQZ1-UBhox%D?4BeS8T@X?(8Pn+F>eAT#OD
zN7D@V#qbZ}GyJ1)ccwYFt@m?HYjQWoxjceutleLj*f=UHHzk?J&Ul@d0|>Iael~UA
z)c>#c-aD@8CfgqmqS8f0Kx$ABl&*pxEm#l{F@jR0MMXpiMWjkeC{hHZ3MdFckPb$=
zA`l=nK}5QMv;fi}p$16eZ+x~q&!c<q-QDlrySu;j4_+a8B{TDxIcMg~Iq&m6XeO8a
zj^^<DNU3LmJm*x|JkKR&<Fl%H*j4K<_Y|M43JCFi?F^z2E!Mq3#p!RpTrVhmL4DSy
z+%Es7xNp1tKqM`8*3~U?s8;06YhL2)TP?})I~n`)?Kq6%b)HB>e{)YgEq=AMCSR(`
z>bgV!TWyqnauA+mejs7cQB<NOBm6u+UbcVMd=}}(M!9Je{N+t68vo9X=d}-=(Aund
zxLs^Rv3I_}C6!&OonEoK&fqu4OF4oqZPTF5l{P$S$+A=T*xdO)>ez|C+u5-GGFP2M
z4}2k*LvWr}N6V+V=?nT+1{U!-q5W5sB6i<lat(Ap$8Q+dy03KUam<9J{Nk%tfm(*J
zg)62(51seD32S4dYgCoMDKuLEpP1*fr>-{%)MsnQDijDiFPfN^3G75xzAg*gWXq%9
zrif*5iQ{3$#CE28Fa%bp!#CyMO_to7xL-)y;be=aYuW18gym0N0lYB<(wBP<<$o@X
zVY+S+)n!<2I)L|NGJphP#d?cR<{gq@+|Zgey8Xs9TYEt7(*Rw#K6g=;Tfbl>C*_8S
zqN8y_c+w7v6n|*fU1XiqOUvTK)_{WWl369eH=L9M{G$OLC(V)kr$L2i#ez>vdhx(J
zG++SA1zTE5JlW#KX3lUJT_`-;C{XXI_B``U)@h5opj<GCYN(Z{^V+iU-E4ow=N9QC
zrY++;i`5nudTJk@&um`G-<8QYZr^yJxz|fsU`Fm^*m;T8V(Mv6rnAB4dA?KzUFafo
z2^m~jwn$icr8spn`(D@Q5#XB&{KYrrehB!cWW^22RT&To4Z7PWk0uAcHS@$zd-Lfq
z0>d}yzG`c6PsjaZteo;=H}7`KI;};0T0PvG84{5GW`PLbF-I3DU}VTfkYQUbFNOx(
zxT7=|cZD(Cwz0p`m?yO&$b$mvJnzfVZM-rOx2EC|2~^O1&i%kpMA%~&`7a0o`Le|7
z!hwtTA-)@i9l&x8(yw`4ib$x^CU5a+jGp8=RT7Af^}2Nb!b`5OQK<y0u8EkygD*tN
z%4J~|EZ2HG`}*#NnP94Wr&1OX7)0UDY|fGwrAv_t98~1Wwv&4r#-|aQHS!}w#}JQX
z8O|%w^>3ruXW<#^^-5J;8xMeW1>szd@WT-%DA#*v2V1sUxofxSaA+=I@7;BHX-KNO
zfDgRvEm1)38<RRytHu<~&hAA!*!v|yyCahS=-YB-ed+^byjW)Q@t*SGAR1dI4N6wf
zBBGuypUF@!h;Lwxh9+pSgX}`@R*x>2Q(!Ej1m@!5ow*^Ccv9SRb)S+Hxa=-(g@b!O
zR%G`3>Q;Zxdo||{G~qMlewUmuU^FJkNo5&_1C(y6?>+w^qtYg=nR7e5xy@xrV|d>1
zw<EWEDpYVJ7%`7D%j-xl(rUdd=guD`;u-I7`h2U0%mWp8rh8}YCL&}dt~DdqL7<j(
z{3R(mlbU|=$^x6mr^TU;Kw)ex)u3$>T7Nt`=<UfX8(0v=iTDy89`e4ZXT|&U=Cbyy
zD!(tw@V>Ptz$Jg)t94*|2$Q&pb+zKOvCBlWl(L+QXfiNxuZDd)$|UMgisVd#&J|@D
zdiM)DRbr$UjqpO@yghpo6Jx?%@m!ZQg(8vt<I##1*6G)SeTt6rLl^){4jn?t>rgm6
zc<5*kO3{W{C+vAKjy)~R?o~ir;$6Bady(z_HOxnw<Yz1&k8w+$?S0GMfUrbi-yM(V
z6rI1MjBClIs$QE%?ID)Nj$l}=t2o+)m*$FJbM0?*D$7;KJ=$_~K}){9UE_YY_=S7-
zV%}O^yct~x)+go0-(i~n#rUYXFsT=>l#xD~h~RNIQ*e)|aeAcJC}3&SxT*05pkG3T
ze7k%k2C`m06Ft<P%^NjMUN?Vq$I3YRnd!AQcX(YtB8(!R;hw93KGt&8S1fFuu2Fm_
zEK?j`u-)(sLec94$bPXVNtlt(z!p{>8G^KDeqt_vJ}us+GALH;L(a+mx`eeh4)R;P
zAWLU>J|X`SoAgJ1hNRjBhlSMD+iREMB@T~j?)8knNYv|5?f3NBgvq_1GOUnM<sI&t
z0_MqgB$*j+)WdEG2{E{OSX5bekKhDcDlaU;JJmSdZ(4A@8GCBn`QE&=hf%@Y6uNG)
zp?NWGEXvGC<r{_3rQX3cld>h_rv|z2xP^(0G^RH1QH(DzorfQxI6lwQ-jntjKg#fR
zIo$UpkAs@p+UW+ZDlw$zUpSztC$V`R+ln4IzP7!Sra<<@n@f=8-IMo{V@4QnglfKJ
zy{R26Wuzk8D!y%s^m>>zWpAF5?13^+vq2Qq4uh&VVh1U_)E8CUHs*UsasJos5!cQa
zrOjxuM%A|Qr#z|4`@m-lKPbyuokE9HS_+LB$BFk-U+T+s^rA8+%NiFqE=J%TGQfQ=
z^)_}mhX(4Y44N;F_EI?cYGGU@-W*q}h+lkn#;A7naOn;14&@ISIL&(0>~q)`+zr%r
zR2OC!`i|$IIlj77sry-i<lUB&-GDTXGwx<{m5COfKf8%Pq^@WZ-5=D5F0;pShoSaU
z*vSX1(Wx_BOP`F%;bV2Y?$$Tn_}fOOKQ62$mB(A^3d=Sx9Pq72dDH5LccMqq5Cx^_
zgcI#mOvdCyEz;@!#J47o&|0NYw~Cfk%0evP-mSPW>U*wD;Aq>*NezhmqqZ=wD`LPS
znCm`9un$&Y%Evz+9-KMB;w><_=6QxS%+YOEmv_$dGHD3qI3gZHJSX5ra0{UvBAo%M
z+~XqPpzS#*-BW9Jnt+Tf!VBO(=h;cfLM2}<u*@fSZ@O%q_uA#Z7E0F5qKH+HM4yj_
zN*N$s%U^ef+%Gbz7rHO?SyAXk4x<`b<e1;1KFVRT{)mGgYFh`2mvXYxQ2S%C`<ll7
zLrHz%lX03V712i}=R9Jjebu3AsE@dPFk2WivTzDk)K-Ip^BJioXbG0wf7#csDbNzf
z#&JzY<k+i=M?Q<t75TW!lQ*`cX&*2|J$PTx7*{sQQ;V!&M_@@p4H0_vO3Hgyp2Ru7
zc`D5lHC9O-cqpv5t7m`HKpV6}ALL_0cY5iQ;0@+1I#y%szVV}z!55br`i*Ta+oZiS
zwT++W8WC%YSz0=GQl)pijl#7|(=x;(w%9;k&9pqK$$hyY0glJ+oE1FTYw<b}{&7Be
z#<@5kGbt_XRxrWbtP(PdXmg|N!>>IeV&=6+5P*<>R5PeTOLgdBHr(Z&j2tr2WzV}^
z_5J5ho}34O9`;)7#vvLz;8QyR01Ypu5v=GMeUx-R<rp>EWpLY(C>IAoon4_w9^v~B
z2U^STR$d6UxFwcagw0}@YTN6jTS10y9h(|b4XRDRhAzqtifIL^id}f{?!Mgei^~V+
zYpy^4<Z$5H<68lWK&&Wg)Hu{h+9w=8@H+Nuu64E_B=!c#9il%?G&$+oAI5{~=K0Wd
zdt-wAq3CtasDsSKbgO{b9XYxK_^EJx&{`$)GI|r6p@YjM1FxUh-9j$0isQ3x*ca?%
zi0orX_Z~i<vu}s4k0Qi1{l8^E{vG150uB(NL5r&nK{2x)ypzVn7bK*C7%uUqTj9t(
zx5i4x&r#-mI+lidp!h87?)%$$r)vmiyahSs0Lfat@w6u+lYzUdp4b>HsbV-fc)YIP
z#J;#&D)mihmt@X<`i0~Eizczljn#n;EN1T5k=1v?v^~mean*vGx1T?qC&JAhl*bJC
z)_XHAMERKc`KgbOMc-v0ATQ!svke{#m(I4&;C2S%yPf=EhOt=PE?o^rzJR|H$Mh$>
z)4o*}79E4yN$swK9L7Uui7kB2?&ErSnV<YL+#Tkq==+&dO5kL^c||mRM7g1J9X1sG
z4qyu{rImLE&x2B)IKvNB0Gbj)KV}uE;);3OsbY#DM$Cw%h9-Y2<ymmOeSBp<)<lLn
zq4WebGus3E^0LzQ-c9embD4I~G*HXaVk&3M%X4g)6>!1S4~ME;bCt5S)1=RfZbHpD
zVoA!b(1+FAACT4~DvlC6@d^NgX!oh4u!MhCq4t5Tg1QQO*E!f;_3aT&R1<x2`qpjA
zWo<U4<JK?wqAkLr?VM+C-n|tW<`7F-b*ionR})rk<Khv&8ZUp%7H2p?^+1)4_69ke
zcuacoZc9=?%1R+)__mq@5ogfh1*ipYlLG+Y()ewcihNq*zSP~p{!9WTdDlMKi#EO=
ze`c=|?V8055x~v$kxFORyhyI;BkaM(j)k2v_NRxGH9`|59`n%`&^y(K=YC-LkaXUm
z3mSl6t~df52_MN8wZ!Xp*A=80lAKP+-inN9_c%Oa7>?=~F1npainw5hRzE*SF|!an
z@OV^jp8LgdC}QE{R;K^b%0?!BfB7Dx8K+9m!I$A%*x3m?_MRJr1??wS<Jk$XC{LX(
z?2fBwM_S_~`qoX}4q~oc8#1=xiX8rQF`lcJu~0+ORzLvYT#W9XVh{=`KtzI4q?mcm
zmtOmN5u@n(?FmvlPxkK>y)tPXv#?QRo^kNLrGVPfI@{*tcB0uSf!5+s$>WEeoe#vu
z2A<k}_Y}WB!X$d~DyjHQ+Kaf^94mq;x>_;MpL@=x%I01Vhlv(CVW!F>BQXw`rnktl
zseh~j{x`hRf9?K_2l6q@Za7R(l*|p>YrO;+f1aDYc0%DSC!d}PK2#1$Ik=XdIvOaM
z;-^3tc}~L{fdFPCC^o)vtc?#)Gi$R`#lwAIaZ>QHvW6rZ8VJ#mK9o4Q+^ZjtTAY-8
ze_w>seTK%(U60x1FNvV+0^43FRsq|K<!}e^E2edYxgE$+JHGR;5TQ3ei0rWCadGLU
zrxz(Szi;8Z{nps~!-mY<!Vvmph40!(`|f=Xj8(dV!;&OiyN=nL|DuBUj5jH5<|7_+
zOq(<I;>>HI@y4hchL8TOC|`7qrWbN+zkAhUjo6yrt4_Ox`IKh>g~G*_IUpy=F*ike
zLSQ?Vw3TRoSN$d&LO+5dn<BW-Q}=pcL?tv$I^y?ltH6Btq1+SKtcch~9zaSP{-I+Q
z-<o+bPA98BabQ0-^tnOu?&zI@Mt9RAed;)7R1(*Ud(@bb!^Pa8B@TUG+HEVC997OW
zC=%`*kUVfo`3wi7y{?ntmfp^NVd7zjA<Nj`clcfZ6+<DAmG3_L?(Mg)P(e`E&mPqc
z<tdiwN7UljOJE!bq&YvyyQZMLurg`#(Y3C}3993doo{qIMn$?~XUcJ5GM_kTaOkKe
zH4vnuedNUz_5az`C9wg@H275%_Mv)VOsmRk(Ca#ab)^fCJvL6o4>0TJThW^GWF&x(
z6_DZHxn%BY1dsD4xBAh6+(#0ZEqNq3$y!o_5x2AsI=8K->kj$A?qy-)aTe(Ce#7}a
zTPp6_gdOS4ZQ1EBT$L)WQ$EhPW@X>q?>gjo&?-kMd3BWyvd{1Xu6TX^=!gs`7*Ix$
z#0b7vk8E+<5nB?Qfp>9{%alC0_ZW6z%rL63`iA4PD6_?ywovmu<Z0rt2044=$~|Wt
zSB2=|`MdJP_?D>DyG=vkFYNW2KQ$NZm!q35{tol`?Lzv)U(zKFDS3~}+Y&Zn)>4Qa
zvw+i(r76axwL+(i{-a^1Rk{;Rq<y4k1=OXRa1&{|N|PU-G(sQ)W7Q^I&4SnT)6^R4
zp#>44dv$hBs(0OP?RX2xd`Zu{MPJ7YsW{`bjd1FNDsl-^V}9T@8Ab{pE!lmuXn9;W
zc_&XW=Vtrp@LuaGkxrp5ThVKKuQS%HVk1Xw&BR|j<iH7!zCuoTE9@Da(Z#MNAO~Y{
z!cA5o=MVJ>i8mu(0hB?os1{d;Q|y#PR!@cMj!m8e`(yI&DLDkm1bmskoRd9k=2%UT
zU5zjD;O}VA#cB_KUOo8GahFmq^KvB`|1$GK3Bt)dV(*4yjtAth<+YtXU#hS?e)`k>
zCKy;?!-dDiYAC^5dh43TD-mqS*1Ii8*igN6*=R(ueZprinqLmtLH$kX8;;K}J1Ql<
z+<krV5^s43+1}IWnT~jIqGz(dq}H*0j*-as6=z0!%N&YLSi@Im)E(Q5L+(6ivbYh6
zoId(#e^21s<P#j+;(FyCf;(8F2bvFEDS5mk(M?g!O*+kb{_eYaCy(BM1(o3w@0dQ{
z&tGJn>NILFb_`U_om_ga>f!PX^={6Bv@b_b$KGb9T#h#kA&cL&I^G`_ua<N`Yv1El
ztSg~#afR$aI9%;yo?#s;Uhu`QYx&hl|BShzpz!JPXPdV|NGGle#?C33Ee%%}`oH7v
zO&lict(~kcozQv-_=q}9;H8X>k{-P~wU~*CnX2LMKcpY2zrYvPy`t=W`j|StHyZIt
z$MQ&^{>G`1-bx<{7K3&GXtRw-EO_~OKw>R<Md4&2#nZnyIVfSu<9!c@<gFMU`PrVO
z&|rg8A48U25cA1znTKb5=WDQfuY3ju@-$!NEkSK#9_fU(9%53vWAC)N=Fd5&BLX<R
zn_o(e0|1|_u)`UIy6pDd60yAi=+w^r5al?1CDBsay7|e{Ts?j;@#6&Lcz(rRsTcW?
zgA!e8hPqLawH3Kq#ECh#sLEzeMvvZ{hUZt0%t?4f^lzydH?_!*J5>q?lemMTuOdSo
zmzkI0Ljx^?W^CR&4(7h>G~J0C&3LlWlcO#8`lV#AxSPw7G^|wPJafe9wt&@!a$N_Q
zh@qLAwZLaPet)6fJ)@PozO+*YeErRR7!OvO7U;B3<V7g&@5pVXZz^eHe|K}pR`^I)
zuQJl*P+qdF$ji<qtVaT4<{ADpq28xRLC$A7RrU9nrp<R*$6n2p_BgzH_u7No&uj$3
z{c|5(prelV6uSs0@sTgy+of~U-RVLMJWS3Xsi13S>CLtCS-OUJ%ax|O*3;?J$pSgk
zhP<}#^WLVavWdoLw`4R4m`sRPqV+mcD+AITpY=xDcu2K|r8~Z1B2-yG<F9_J_-ib<
zz|O<`YCOxMCn-xKOI?63c{M42N_P0H**Si<JS-E)Txw`j7*v&bE98xwmVHM!Y+MZA
zTU;3ncTA@9v{rrGz|_kJH=c49@X%2^#hQ6EVZkMzS@pE2xEiXVB6+ES&~S!-Z2y#}
zVT)mHS8b0|U?c9_i=&qTByGY$QXw)Zf;CKHRA%7xrm7ge6k#Ex(oy(IFcCR5uUrq(
zCH%BjB?7_+=|l>~d=XDTX1ZHl!5Ese&A|eem|2ZF(`Ek-+FY?9);8V7@NVsCAHGjR
zBNTVm13p)BZ{Epq_f3=@Du@T$vB<3BC>5QD_fZtBItr*$IXR~MO`}zqP6;Tja<0eb
z7rV9x6ZUT_C-cc<GpqHO9LI!^9#81k*k5B1jeDZhIlCf<xiWS-M53iimOM08joJYy
z*@~A-62EA(N$+XV_I7qXog(-ec2b}=VVM22zRkI33ifqZvz~K{6)H+G(4^fO<~8ft
zwptlRM`A7(EJV-5_^!Rtq~5!zv3ino#pN!7)oYIfaj|;SFyJ6s32C%$+S=9XbYxiW
zLGq<Zk+9{kUEM>y2A08LGxs{l7O5*{DEq}PmVp^#d@XLdw2D&TLaJC!`E3yA@BM!R
zPC(DQ5!*&r)|J$resK>qD!u(^q;%szxQ3#H$lTGIkvaD8)s3Y4q(*|+n*1;z*U!;;
z?(X6FHt|WG9be1t^!I^hn42My4NNfUIsRuMRC#I&?6w&_p}V3==wn5tM7=JyMeQhO
zPkZep22`#3F(rX&2<)Jj&ZsxKrhKq1$V<mk6qD5t>fuFR-`eeQEUM}HdErRpS~4Sk
zBK9zC+T7#h5u1hb^pcYHbZ-|mG1cslFzWikO2MZ5);5!<6!+TIH^<G4pNm!1IRV=i
zM5evuw|1J?l9AXU3#$Fg_DR~Cfjab>$5tFpWsGO}whJbK618$oyp#*t`wfHl1%CN(
zYPOBiqqwNd&okwZTO6#dI9lbx?`HGcTzj$wIj$o*7<s}S(I{YYxd&9fLa~zVEx2;W
zPTVSwRa?!7<yN=?Jw3Zs+{UT}88>`w&3g%xGHu`?8pBvt_$ojsP<|>3Y)R}XoTKRN
z&RfGAgR@Y+ic>5ao`hQA&YO{5J>@E5Q~`$Pk7=u<n&yN}u1eE)IW~$$)FjII`c~<N
zLf1H6`u0rKTMy^0^=~U5llS+o_Fwv)L?X#BlyY?B(Lo*0`trw0W?@ziPmfzT?LMy$
zz5m4LZVr>;h@qCzkPvYph){WO@)Swnv2h^A^{r)~<>x$Q=w*=G<Hs)KZ`?jUY2HDp
zw5zOmh>^!gPkv!<#Pt_lB%!iXTZkV%m?#gk4VJXN#LDW*ybn}3KYAc2UP#y#fW{y@
zc6f!pbbnh%lkXkt@iNSA%Q08ZS{A!EaBi_YEft%Z1##tUrwys`5;1d+I0H*EY>s4S
z1`p|X7H5mp6ZTh2f4J+k?H2p-#ajV2FnN>&ISAb2>m7D~ey6ZDUT%BwUV#y&D9@t(
z8u~stP85eouX}TD+XF71lgeJbxt_>&@5Y8UiH4ivTHUUQpeEWx7Iq8{yl?x&)@sN|
zPY1^gidI)iqC5X_<5@U0dtZ)HT4K^tfU26Nfj}^Js&|c_S`PB75#)OdwKJ_Mu(8Tr
z@-e!doa>E}A_3e6dBexg8u>KeYcF7~_cd^6Xe(A*|IK}9+mVdGejaIQft$ajZ&&JV
zgY6tmY)lsERXb^O=d5w5^E?~>_4;&^lhhH0Nc%%OnpWufd5cIbdR4uE5tPR2?r}R*
zmy}pIbOGZrpcRyu4S(*qRRV-k068dEd7|-Lr=9boW1MA01rLEtZUN!uyy^)#YF><X
z48-+klQm%7xgKJl$IunI_E8|Aa75;P<u_tD*FX6V{-0j&Yt~^Op?A?ZULeN=&f{H_
zcn*|=oQS)BmH!qXe2qM3l(mjE#LAP?iMh2HE{ePu*cTYyzd<4&(|;&^98nbnD7&uU
zcU1<@w@`yhBYGU(^$a{AsAdYU8GKm=Yc53ViQf#W(;yAwRpq97B{J2Xij-O2wjMpk
zq?>SPgLBMwOp@xYm<RP6k|VX%!~5xL*~X-7CJpW^3{B`6s_F5$C!4;|4(?n4k@=7%
zIAD@s@-hUaRwGi}qXpWv;!57CdnG>c-D>jO(=efuy(WaYMGci3F7t9MDQ`d*&Dl?G
z+Uv5@y0D)~Mi)8xOVe%Tu9${*49?BJoUGByH+O$hn~UBHc-MSTb?q9Q6dLLqKKVzp
z{lEF_UX?rv^>hTrI_!=$3M6={swy;<zAEmRUpO7^<05(f@<|b9N;!FS%XHXFr`?Je
z5#)TfQ|`^75M3wb_=>^pp$AnwWefOU?qYdnwf#2E<f(pFnvZ@UqY40M+S59qg}R~h
z=Bi{}>&F}E6&<Mp%EfWb%5Fz@VQQ%DYo9q0GT{d#O}%Hg@+)PgH!D@y*;N7$bW&S7
zb7s8u5HQ^Cn1<d)U6OsSQ?4oh=z@s#3I9I2QO!ah34oLtiNFu<@=_$bq)n?qi@4gH
z?AYo*2R#*i9W84%Se|?dGPM&zz%d>0(^}Zu$FL}J-N!Q~gcc^1qHS^~|K?U?YASW#
zb;BaUZ3cFp8#Ct;^onEWuy%4QU8Yir1RB<mY2I=!QP1)1#Jz6w0rNqvtke)n^*Ve%
zsjM0r2;1#tnNFUp>o>yab~1k6=gavKv5LI+ggSDjdFlAN$vsNRT=R2v{r&Vl3^v9R
z%tkhMAEz_En7}=qvN&#Qa4<<pe&*!4gyJi9S^0Bs(Pojl8k}z?1O6-Do8!=4^1~5!
zsCOA{H-f`DS(x@dzUeKkwbE~SZs{xJ9^%k|#a)y^O+IYj6xWahu>m`Ze3xG4f34_s
zVYCt7t*rPx#kNg@Pj)sZH{jxA!e9lMd8e%%?)g;`UXtAo@@y>dL!fr+eoOZo49YGn
z@Wh+^UZW2p1?g;`U1nHy(?Ic~num!-2v+y_ITRZ;)3y`8nP~S&e(Uh3PZtO2%6;tJ
z_pdt-3Tla*OU2n1tGb;forto=lASJ>bvw6^>q^%R3iCed@HyWZKdt|G(?0~#{hR&j
z8@}-ujN{jy-}q?~0MmkB0(PEhOW7SiiU?W|F6~~`c8-3Rp?p)}#FAuFI9^%5c}^<)
z_%r^SRq=pFB~$>u#zVzACvL3FMm*@J6sp(rq!isJh`4D9e-2Y+j%EW`uRw8XK5i<C
z91rg5ooJFg^<}#{w4R%C)NtMo++iZ>aAfJkuaJjnwEekjr67KyNkCAzbwK85@7h}p
z2%5c0h8hpMgM*M!v-PMGWXG3x5>z91dcJ*o<Yu63<DJiQ5FRnk2{lfT2(IEpV3A=W
zD{H^*aY@n$F)=o7uuQnkZ1h0moycLa@LJqUP&FZf@-(Q9eRBfzp4NeT28u|)DaqJc
z+!iAo_{?KIGVJ*ZVb$L<LAMK&WN0iIAQkh@|NCPchY{h>Pp~!LPLOp9YG><$GS|p9
zhAF|_PlmX<t~4bO?xtIW98R1Riix|q%|~ex@)dHiOZV3_S4Z?76qIa8!1|Wpg47fW
zc>{w8ELJ7u4~Q3F=dMts!{~)~>HFMhdI`8TXvhT|K%WhS(wN?ogs+m&AdF)Ti%?<6
zI$>$zX;l?M7&>-A`nlyU(GVkFSXC%X*l4vRNV5e?gd&gLx0llabfixyr@7fe6W?*T
z9>o;qr$n-@EyFWBdly~y(NV?$XO$5Z08vMtqxU)E9>Pj)nv%t;d(<~BtH5qXNww^}
zBPn@HO43e-@1+=nINhLV_XS#ziu`CRM-5G|Q$=hvSFUp<Nw8l+S=&8u?|vcmsMIZS
z9|`+ku}&X)WDq(X4let<l#Od7pTke<YC`~3@8lU8^ghXi_V6Xhk@Yo{rwYE~cRELW
z?>lx^ANV&J{1{bFVY$J2A*s*4LZ)KL0EE5W6-v4717pUGu46cHQwdWzGN%*Bn_MQ8
zQ8~=Om$$t{t{c*Luxr5lOf?*ZQ}%p9lM-N~2>|d2+dPEY2O<^%;QZoA0TC9m_hh}p
zrf9hgZHH+)$j7W8=L0$J)c^s6+ypAXNdC}u1o<|uuZ{K)5db4<-T>IeJM;kP{oBWo
zL*p0KB+%{h?P#L-7n}?F$F9?U7$1Zp4q_ccUIt*$NZ>#l(Qkzkx7tF6S9F{a6y`VB
zLBtOo|Ao>0YflV@xP|-nM8$u2B8R{9L^eMzHF|U%%~^yY8~n0N9Z<4VTm9|*Ft$H7
zgC^g`{(eQk#Qd%q80B`1I$HKCWDj~I6(vS~n3bfrSi|cQHa>aO^x}Pr#vPDW&g@9?
zuYMq%ly=SZY^8AAwY#u`5}QEr0<EdfaDS3L&{A&8mJF>m<|`zRd}Z{?O1o{)Qb>g+
z{*wmGn%9PwFIcuVbg1Tvi)wdA6NRS?_&vKRRu4H35d|Mg?>s(f>W3!H0LUwQA-QH?
zbRifvPne`2*U!?LVMW~3y=WFdKnr%2M;&PVVcL7diWWr*G~o%SDVT@J&WOK5NshWW
z^a9%GAc|Vs7(10?o&$)yG`b<42DK*n(;hB71ggXh8$-MqCVtl@5OCJCt)u96F=82w
zX&y!%ypoQ>go-7(QTC9{(IcgZ{p^&^!9O+_0Q&9ox{lb$>=&bLHw9xtO?^Koc}>c(
zh`D;8GML(7vKWXRj$Nh3%##bY;IJBKAOnrXiuB+sq*bjQMm#u40b6fS-#5<PRPR*u
zh(;T^cLDuF1J2)fqM%v0L@}yNT_g(=D}eIaqGX}J4(jkP!@MD&2EBtJ?{T8ZZ-KDE
zcaI7EekSzR)DWT2Vi3CBj@thff}f)S;b>R=ew3bn8l~I+JW6?;D@aRnffMlM`N3FW
zqibL?5kcjDoI0S(GGWjacrl#9_y&|arM3aV(xpDZO~rgGFtB|ML$Qw_TSEInX%Arm
z0M2U-c9v<+U8R6r_Lm38)1X!$P5j~7AD8z6ST6K_^c3b#Po4BXKXs=w#-Tp+m(@o6
zK?1?Tt)B&ZT_}c>MuS>>lb=6zfGGcA)^va9;=*&gctYbmHySLqFpb5U^nevzTlt4+
zv}UJpwT&@Bm*B;xzCs*+5lIjY`c5W)Y}2sFwFJi{?J^9692{bPy<WFq%R+aqqkEAU
zns@}++pWQ2bGI{Wi|Pb!m4*vtf5qBdqh52RTr=-&18u@7YH!CBsEkTbDh(_JAqz${
z29>`Xu|9uOn+iIki{%s}PXrM3fN%NpVYn5cDfIg0B#6hRLqQ3Uu$Ip1KXsD3j-c^q
zt^w|~RQM<eoc95sd=6~%G5WU5rU;D-NVO^uTi&#pmNEjqe}l&O%W?3DavN{~Fq{GC
z_Ffo8AIK=EMRg3b5&7##aX&o$)gScd41U;!{7T>Jo3!s^Crddr=>9sg>|x>-d)QaV
zuY><~)O;t2SwBdtO?-E}Lw!)mGT1uw&?8_+<7uNb8UJxkbHu>Hby03af<D<-PJD%w
zej7h(9;n*ycQtvCA^M%N?yb!P^D5rc2PWZgD2>I06rzHz$9-%Pc(5)EG83}_Tf^G#
zME?hc@BTq_yEWM@Z{fJa^r-0VC>}5enGF!wc=8{Wrv(Y@^Tp83aZ!#DJFa2X4x}I2
z06XmP{WMJdI1L3@p8$;(#X*mv3ySfVOh3A!f@v0DHpqu@^@!a?-nm*O;R+vg55+jZ
zj7R5Tb~1Zw+yq)11M?O*O&rf9sPlbFpylAc2?DT91b-2POu$5*3+#Zx#kpP^C-zzl
zbJ*rospdu<viU1SUsh`9s^L(ZmLr#xXqrB?iNZvTpl}^0F!-&w7n=zKHqQeOu5-9J
z#%vf~g^iS<IfE#jcE6fMpjh>v%_1O!3BaoO{o#q6vetd1n04x!aDBG!2h$EWt8W^!
zNGJu`#{5Ua2=QC9sdoWOIc_)y#QrR{7DE<(1r7mV0?E@ppjR$XjsQVWW~UuD-i_k?
zon7==08L}2k|gSqj}zBJ<>3%(cJ9Es4wGx4i4liCzkjQ;uBv^I=ug&aMW03!ThT=r
z>Ruc(dL$eVl=a(5*1L5Q?Aa2;Od8`HjNFPmSDamSM_JWyIE}*eY+vkCvi|q>9PGCy
zBcdGlSG0Od_aD*>VCVbY!-HMySG)6<2}Jx)6Q~Z*3%@l8!G8T)(|IfR$0>n+|9~GE
zMh$;wDStbVe`j-|W`K%*w{)5S687Eb=zh-1&sq5?E8wpA|2qxB3Xy?Tv;$6JZ_qgc
zO8*jZ=ls?NXsXzh^4BK8p0V$?9}}GE6KG(Ur}F-=%m1hp@>P7CdSTthdd2ZqtqdMp
zar5M+ZG0pj2VLAC2NA7mi^zr-h=Q?M8jfy<2DIhtW(HoIy?DdDdQZse?{4RR-7a}f
zj6<ng!1(2o=d1J!vLO!)g8wo1>Q{2#c^ph->fmHav3mC4Dn18hb27(;!p?<^hcD~6
z4e2KRPVD-)0CO?**&puM=!E!){$U4|H-p`V_LV9>weK7?3^-e~!vOZF^z81Z4Ggiq
zz0nLRRw?;+3}R0nsp-oPezq@Oq7M`B3SDETcG$Q^pri~hwd?SW%fX>e_c*_0mN`S5
zv%wwtS9i!?dA9Xg{X7nUm*qR#;^!d=tf`-~^3$Ml{^q6oX=Z-Az5Ht#-<12bPLRC)
z2xfx_DMRn8u-@mYr?ve=T&e7FIWE_aGJ6_K<2IgEguxA*K3-=}&Yi&wAV=kUYta1>
z1a5!hdRw^-7p+x+6N+hjYUQ@p6}V>iX0a5?qh(mC4;zNvtTIU1Rv9!R)_~)pwZS-7
zprPh0;+ugFk4S9~c%X3ke7dNg*$aWf1Hzw1gM<tt3}4aOhFMDxVHiFYZep9J&u49{
zP29&O$mhME6g?jrp<NaA2P+?cWSANLcfNbb^A8uv%#Av7)X3CgnIA`T3UBSLyX!u4
zpowx=9j&@4L*ZN}7{reyIT6@;edI#t;YJ~RM(dwHZ!azmiegoF3PdNpQz=t1M1OxR
zrFKNDSy7+e)Oe)ENxm!&VW6C!gVWEl!F~u5^psd%b&IKL881G2npwQ*A7k1SO8#To
z`PU9T{O<bwGbZ!rnA^`_)z2v2ZzHS!5#i0rP67jkbFv=C;iUizpqLP`XJ41Zf6+8~
z8xY3>A)LoBAS0T>8HFP64+r9imy5}V9N6oi^ng*?u*XI5Mdw1EOosD`>^Fy`^Y`z-
zAA{ukFn&;1VV^4dVaNUpVP~ufQ<7m?P<BA*x>#pfg5vCT>klt%N^-utVE$bpZLG-L
zKcbnRk@269fuC54e~>}*1yctjUVbYh=sxXbmG1>BB(658d13n2_o^sx?@5}meAp}e
zUWnnA@K(LnJ8TMwZvD-k95=$UQulOi(lxWwYb#c&{E|nS_54cK{}EfkOZt?b=3x+s
zZvKZtcK$(jvoN~GzDoR9tV3YJ0R}&|?hlOE!5`p1NCLXwe~g>LF}r43hPg=M#t$<i
zY0~=djdvxcPIs8?6c)EfH22vC`Nu0aP3)PX-)N(z(B#O%W2g!h!xYN#PBo~_@_F;Q
zspV!V`!XxZo|h`cF^bA*{p`xI51V>G1rA$iI0&q+W!R(kBQv+8t%e=bhIhX1lxDy8
z(Oxgiy``>coYlUObI3i-jEviIrD%rMf`T11E^A)-;$sf}+Qgn%J1e$4yV$)$!;+3M
zjXNe>B4CdDo*B+5%mL)s_CT^5acd4GOHH*uKq?F7unm2Ie{Ib*-@DhIdHpQ9m`g1s
zEsPhk<*=qm&6h$W;XzC8Z&VKCxEp+V7k8xf{l!hMrF;AP%<c4_9DyE-%zH56Cky|?
zsaIRus9or<(<wDpTwJ0Nvj4^@e#ZuX=ByBiKD`gXsyRdcRAK0kuXJB~e**_S8b4-L
z^W>1b7-_+mKPoyeKgW2d0srn(F+%?4NeDbNf+pxrgA0(u&r^<Pm!C*;J;ik;^3>B;
zr~1^P{e~1789&U*WffJBFm3{;DQkZJ0isTmB7q4;tVqmY$U9&FXZ8Jib?5-@`(OQi
z%{11dSt&<A=wJvy(8-0i3lyGgO+M4a#56lw(gGVFPse#8Q_Xh8R<B%Q=9)DKKYNj7
z2wb6rhzF%8XheO#SKg+lF|uRulE~rafdj}l^hp7)54(SP10CSI&@F=-c^0o^_UKtJ
zccyxKd{g*|`)=YjQLnc336Q@<x5YqV1M3V_AA(h8Rf_&{acLm!=28n%(lKjG1TXnM
zWtaCI`ps^VSa`*rkse<!1VKRgjKayIEVHle!hAjEman;4s1V+u$>xY1u&ESx&##c3
zr5K7UjvF^pg5o1_;j$^RN?h?SS;05D+^7jmq62ZEe5LeZTfHC(|NANa$4%)ED`N%^
zq&SUWcz7BgsGQ0~Vs1AkuJOIL_o^IJxPNiLX+WML1L~Q-Ap?lm=_-K7@VNq@1e{wq
zpaA;B$zW$DnwWr_c6n#TMCY1!21Af5>(hY>*0Fvcm<IrY|2ZxAFQvcy{OoU=9}0z9
ziM~<ExAvA8kdgM>v?k3<ow%elUDioI{`qvHld);+j*7zJV~VU6H_vZBPERTEx<$oQ
z9i>2eBZ6pBWaDM^r-L0#6FNQdCbC*(Z!Xp!hWNQ26&AkB5JLMRK}@5ufYa}wLoIsq
zE2JB}qF)I?ad=6Q6-e4+R>6j~!^~bsy$NQT5|wrbrTCf01MW{KhVK)BCZE$^$4+<B
zm==Lh&`PPXdD32J(k`U8A>l+3L*zxMYSmMlPq+QJg&d-q1Z|(t`#fA)up(>I7=ca*
zH`Y6BF<4_Zm27Ascm9NM|95?*XQ($efBw?l!l>Q((W#Zh`O_Z=LqkhP<4fa=`u1A#
z-)g9noy@{k0|qnVIXL$)xnb6XnyzBzAR5DohxM&odyz1!d#H>%?u&cpJ42Oc5>0(7
z&ug$#1|g7TTp*08ijT6NSS-jwHXEIV@0wbpY@EpU7arrAh@6;+^lfQ+-}nZ5_P<cO
zuOELsC9)`4xYxK?Ee(j~ga);qlC_jdBhd5@?W2Rna<6kQr8S3cg>GDZe0dwE-ifHF
zX`MX{nc^wXbhQu&@}R=dWmIb7FTcyVaCjR`TxLOLLi3m3Wgkvq{6o_xb-5R^pr<aS
z`ushlXg`1R-^?2+A`DT~TZ8T2)_Jjjj30gCrL{9`>D`?oZMoB8PY&NxdAd8PM$>c!
zYlVFWYL<S5%<my3u6YwdP5DLtD$#hn)2u?m12?;UvN~U09Id?!RXYjkH(F^lzeB%>
z@W&NFt1&*@3CYii=-SKf_G3ojiZ6$FULHF3;%p)P<oS{71=Hari}K_&pzY78nKTvD
zM{`MXP$uOD>DG`)S$kgIp<=D;WkJpN(_>Bjx9i44roHqqoOk(~60ZK%1g(Ge_t9V5
zf7PzPkh1gdx}p8cj~iPXL6(M69^#n3LS_MG65s?4R=2PSfYUXFZE&DC02vJp0OnHj
zr|4VIBSE+&m2Zg`uUwykG@=abR0b}|fqY<*5&`AJ%?V_nr>1i^kNow#Rlg}kvF+dF
zfA+5(KSlMQp`uuJa_^P`g^QYMyOPTuR>h0hGcXmcEtOEx+FJH_dB?R~cIm;-0-&C%
zirBl@cNnsG+590ANNysw;aks)v_0g*$MX(;dCob;Vq$`oKM>9pc5~*)>5+o1*B|bu
zu)n4;qX23c<eym~2e0Uo<wwsFCmKrlb<N5L%|35rGu=KF`ZS$>N5mjKR(?eQbr3+z
zfo*S#4FgH>x?=;-ewM~a8-oP>q_DVcGkh$NXl;?y(;1A<Wg>GUwHixM_2^nWk%7wE
zZ$;Y)kh%3A8E$Ae0+|0R3f))8nG-;vd;uVs<oqA~wKH~34)+~62VZ2XaAdiUpJNRV
zJH`VT!1(=?y1Kr<x&J%8r~7Ta$A5<U{HOMbZ9tQyp!i2lb-3+bM@YMBk<Oi7JXsfH
zgrlBa1PqSm7mwZ--<^Boas1~N-%eGDwVOCO+(<rp$ub$J_^Y_suaI;Jb?5_V;W~w*
za|||bH6nF}AcL<&s&_iKDqo4e5UpxJm^t#Eh-aN^er5dO?THU5d#lF<W$9pAX#8VP
z<WXjmm%<0syFB76L}GTajeHPGNoWi~&pB0ng><?mA+TL^6yQDk@yj5MBIpRM3$Y?k
zR`?2`cY)FjdskLLdax{xI05Sqr3K=4f(%G|U`#e|!bY3XCEQdt6dTA>8r1v>iCv|t
zg4&etWhf`%YpEbV23vz8^JRe=Dpe8Wdzg8UyLkrTk0vUB)S?M*H2msihGiB|k>Lt8
z3pa%%I?#5`z$n->8h_@NF8X8d$S{Si3%!9rbasPW*#Fz{f^6s<oCWqFx{xb#bY6^b
zF8hVeJ#rl1!}$*}@^#IjwoQ2=%kv{b(PR7Bh83~%;<zO2H^U|z!wj2)=75ygPlxH(
z{MW#&#ORYjI>b#^Uy$~^yZ2+sa_<~i7tvgz6RmEZ{ww7C0qpaC>zg$FZ!4kvr>gxw
z<GHb|GGqw^<*8LLZthSzdip}|v>nPCT?3Nl##>Z?w%w4D_zJmT;G^=E#t4jR(E<Wy
zi+>TfGMH&NyNXf=76m7IyhjE22rZJ<X^Eg1APU&h5(H>Ch^@o>+D2Sv$(AKSBur=@
z<w-G&J*%qxc#JQ9cxLm%vg@2y%c^_IFEb2u?_0*(vBoPLlhi$%KKMC6U!O-LrW$fj
z$IEd`7Ss{Su9BWj7!IvEPEjc%BS*6B(s%`v<N|fBO~}MYPaQSTE%M3VrwOa|=z^AT
z&$W($P12z*fgwPK;^{Pse$cbFu=yoEBPqVTr0vOxvmJK*ueS3qNGqUQj@_N1o5ir8
zt+Bo^K9wt2_v536q4^csIpkYAaoR>-jvg#}%qD<8_v(Fmpu*V&)lI{<y<_ZiVnpB~
zMKFWRM_9k`=%laY&ZjAN43u0d(_g#Aw1nN)0gjnDEs^NDXdP7BWjb>UlEoOTcF{MP
z8_h$xMiRgVuEgHpeRua-@-=qi8P*%=v7`^5+QW}I`sjGLphRgMn1U1O3bn9Mz{_Pd
zFGHA(fRewoT<FU9IByX}=qNr<C%WBFh{H2y3?`m27Y)K56++NgRrI9Z05wrEOpCPc
z3(Bpf%tlJJCN+hhe^8)6S9&39wlnRp@avbQRWPa#ZoIV$+>}1?!l<B584OwieN?WA
zmpXHWnp|87GbZKdl`fg|+1M2h5ddu_X<_*wUB7CLmJ83qVfwx)?0c}wgNkQubY}>R
zG=5r_Aa_?4ll%J{*W}%kiu=Ov3QFXM=<i?RJ-f%Z!(bMX)_<<(g}eX7(w<_LDS0U+
z()LKxfeS@v#0A5m4~SQPqrK?BP9lGCM+#@wMr<+6;5JV%(;gx>`hk;w^ed!k8h9&f
zHnFrvem<}}uv_R2d4xY^P3#VI^Awvm3qlpu1P%!s90P3b(nr{eAMYmDzqKC<_FHDw
zf5y)6pW5gD%8tlhEi({GfHt&mY1jzvq&}ydA>bgW4>9lf4dQ7$uM9#+f{N>h>YHUn
zj&py;eu?crYVY(K6@zL-Gvh3vEaXcvduT1P)4bJ(_j;S3)cBGe&!1mcNTY2Vyl7$p
zonzjT(Cu`dzgg=oV^|Wh**wkabV^CG;QXT+!*e@~1V_RQCl%_3$)cFrS*mx{LDYxx
zg)}0(fi#g;{_%xNfvZYv^hYJTGd|39Q%`0db@;%vvapYEx0ztJt=z`FDlA*N8fmi$
z_D>x+rp-k=`Yb%xt;E~gAWO~VS!|etM+anjDkmEdd^8p>rS2=I$o^peWhYx)i9VEM
z=b~fK(d_#0oqnXIN^m`s9=*kOKV@DBWsDk&o&cpU0jmJja~jx!yi{9k9jJFV1~Oq-
zXv_>-=iFONNMM^;q0*c9)fw3+@aDfTaI@TQ@_?hl@1&!DQkY{1HG;SpQNcdO&Q=zt
z0wu7p@4j>Xkm#1qoA9+y8z+|`(K}rZIW}#NbWhn;T6Kl`20i`}C5`@63BnL5hACcb
z)aNKpRC_X8C274jNq1F>16~;qPq?2yQ8M7js{4M-cIJ^!^z*?mr(S=ABnS)^qvuEj
zhdv8JL{NnSNwc=UG#CBc3~y&`o&TxLQ7-Q_6Tj~J4|ARnCONtp^eb-4)3RFh7CkWG
z(gdrju^(Wcu7J6z_U2nN0WA5g2!du{p4Ta^M7G@N&RH%;bIC=C9l_Nd59y=TS<1wO
zLpD3d*4~mZ_+i$?#VUw9s<STnM6`*!?YzVI9^;%Ap=+X#pB`+kdr+m|=jfaKfZl?z
z=u6v8o~>~!h4IPdOXv|>%jJryUKTJ)HON|WXh(=dY)s|7a6O1icHkffog!<HJfQ68
z8c8oCp>3~?o5G<ID0|<)iQLidO92mxs3VGk7MeoL+AOiv3@c~OgRR)xOOrg9J>ZUC
zn<hW^9D8WtC~3~yK8_UF+lMQ^AZhtpQHtLY#@_^rySR-G1B*Kd!Q=&l2B3Jz_ZsoW
zSKZY#!dMtx>G{Tm?4#P;?isDi(S0P_*x8KX6Ry%k0_;|;rG$`8oqT%Z4Xin`M%UHU
zYhYIpZCDC7J53WF09|7Tfht>0>fYXEkcqtm4=RFo0$yVORRoo92L$!;$8(^{gBk_Q
znQqiB^rxg0^z?T56{&w~*EIUKY*7EH`}9BKx&K$rhHc-x$W>@i)KG%fhT!o!S0zn;
zK4J%}Gp<#SOZ_r_GV%=1?Xw$3tlQpuxM5Qcr?5xBMu&$BGO2sLp|p*7P`J{tiYzvY
z2C5Js$PiOKysJWaSA0sHm`i8AyQXzv$Btz_o_n6J_*b`8@`gajZfm>9>;$+Uj@|{c
z%Y7YBbho-pG7OftyJ@zUC+$rHybRDy@;RK~j#k*lcx8vt$Zq!ci~#>ac3YnVkc+bz
zu$@&|0wRFeHGzF}O9ru9OsFOg(M+p+YXnPiB65H!?X{o&H3dz{ivs&CH*+Bx-bjso
zzj(e3|ANk<&z4Z;(KUC0iaL|Qwf;KQ@GIn8jXJa#S_q>gU~Ag8IEvY+LV;BQ*ks)I
zhTpHWTmKb9+`sVW(BI;C{uu)OpW5gDo+AG_BqY&Pb&TRhh7;*)0hLpz+QHI~wx}D-
z=iN+A%fmKYiK4e+sj-(Bq<mx41>b6*gelVCbj=_at@%*%D>#XXqqxBN6*%22cZ^A!
zbV`QZrHQ>fhuF8u_MBQ*8(C)0eKvyneEF9$RfrG0KM%)0AL!`cq8|QJ<@=xU-2Zzz
zRl&06OU<a-MSGvj1>fgo)DsX~E?Me&8JpzoF?FnEyO5t_)SFK^(&xVL@T~W5wAA4W
z+iDP8UXI1oRFxYqk}T@_&6DF!yz>^r+^|3B>hfCqKApx>x7~connTRc$rN@*z*{+z
zhTaLY!3HZ}*u2DE%xrQMaOTCw;je^4;$>^EDjN7%yEZ*9vs1C#9;jIFJX|6+zd?kq
zU9AkoCrc$ynvpIx6+RNyz8dFl;TY=~6xE@qA0*BseU9;TMekTIWp60FjI=mkIff2)
zy(?825SN%cvpWx2B8=Q>N(+}w^HF&Nr7!KL-XsqaP1d{t9W@(ic<l-1e7M6N_e|}|
zxG$4>4y8B0eBsz`&@*($Vz23?8D@V!BN@h=9J*O_A$r~lxTMy~i6@?q$<X%=PU}sr
zqi<FgR_)nnKY#grIIC@Q`)ioQ-FtbA`zM<gVIxTxMv4V#xehHrJ7$v*RCi5Y8KZo$
zL;f1e^rr3EZ8!Q}Z?xwwETt*mJga=s{@gMFN7O_-=#Tfs-JaKO?5{h=RN<Xn(pp$J
zFWS)R75r=xlK@u?ufGsggY9XC(5|5v-K|a$-6))`UQ(l>hl>Zr06Fy=w){Nty@wAP
zNtZVAhI8(_o1+MUC~{JD43~Eh2WVFgxdAs~@>>wQm(Jbv{zFXuN3XcV=ApmfD}qo{
zel+vFR=0$|Lf++2_yKLRGVoS*Fe0an|E)2KKVc`oFyj87!&Lqkx3|zW9};WT9x^*g
zxc;s{;nWackIe4yU0a?fZ<%^dAbXK*G)Z?}*u$?77Oxw`{%f?RD)IKkm9!HI_Yrnw
z?h0d7gBy({5R@SB#_y3s^6|-psVR5eI=`3hMgPNF*F*Q6m(F-nB)E-Qt2JVgFt4Ua
zQSX6`q@x8^hWp}2O1khP>;5l0w(5;ngm({C*j|;CzQ^N!t4u&7viR*q$3QGUSsNg~
zqNrK(ow`I&NbArwGQ8TOuKh%=b(*=EX=#eo^29>f(Ha)-v66I);^kMMqI)Zuo5($i
znVTMwfCr&jic30I$ZGd9yi{Aq$041cTYPRs74$+5*JkO{sWYUzJK_6f9(chr+zs)r
z4{yAfTKm}7Z_*$eS+k9COk+(S!rY%)1z;2vK$~}LBSAwK(x{0P>rr-A@+Ffyal$zo
z$8EIKIu6-V!)K)4On7dFKqyvZ2gx%umIJO6fx~1S`TDjkbDfScu#si)((H<HWRc!^
zTq>C+6XIc22WQ3;J~@2ID34zYPwm~g`r=se`__!4_aC(E`q-iwg`yBxSW!?Q&c2nQ
z{&+;cXFX~U2^tvi;2~4HaI*5U_ZQ8Hio|@W)Fn!Rkge0}mpcKez@2Yk{ht?}-(Aq4
zKaoiPI=k0>_C~0m;CAZsD#1a@QF7G2<vVUgr&L1ij{51WEeObt?A@uUR!m2sf^9_^
zJ(7ahj<%HXOX$Vp9vY*{+_GoX4!r5MushMi^nACDwe_|@Yx@HS*46v?&NrMK_g%+Q
z)ZEtKz|pD@3L|c715s=w7Pte?&>DtU*m}@JYq75o4o!*@bPZ5Qrq~yO{1Yu0IRP>b
z8(qc~qN#Kh*Ff?C7n+g?vSoj^^lv&(h?rrbo=pGNsN1{)0ZKoEW3^q?KJRrB>B-jA
zH4?J(_G|a2Dh2yGZ{65+Pt(3+>i__A1W_O1rugyzN~8l$6OAA{!{+S1LevMXKtfG4
znj}ZJ+V&&<0U1kF@GnLLp_o6a(2bTjcX%n>KxXviVZWT0nm=fCleKa2L^qFWtIO4Y
fCk)p2WBrNA`rC_K{-2wQ|BT!BKcG+guYLa?M%i-r

literal 0
HcmV?d00001

diff --git a/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug2.png b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug2.png
new file mode 100644
index 0000000000000000000000000000000000000000..9154af6be21e79987b122f611c829d3b71134088
GIT binary patch
literal 237170
zcmeFZ2|Sc-+c<oU8T*z!>&RZV>=H%^AzOtaCfUiJrNYQsgiw@3B`IREubJ$mB1BR4
zeVwrmvwfGkm*=^k`}uzF`+m>!{{Qd$-52M~aUIur9_M+S+p(O-HIy%uF<_sOzM(z<
zfdIfs@DHGj13G#k?k)geVgeij0DumF#JK}75CXFRd|(0qs>f8nV(4WaLw|)~V0n<j
z1Z$6>t}fF2w3)u)DZL-0S>HPN`d+5m2LN8)SNu;K92Y)!-bR>q2Bgjc7EuAD9UKFE
zkC~gF+N1F6_a6NFwKedg1wfzd9<AT;{~?IY$vMCgWWgNFeaR`n(F=sj0RWce=<9z4
z0BH8`qQO^u_h2vqoc>?~LHOn#?D`YV+Ji6sgkS&2bM~|@n5PBoBqj$3e^&rt=>hS=
zL5{8<4Hhg2ANF=~_XYq~VG!2#^73&4;fo+F1?KSu;XV55m;Q#1>)*f*4wrtT>EPh{
z8~l?Ouq0UV3HJcs%MMq6-25v)ye<cV{q^IL06&@B{7;?+zd6Bv`{L<iyazLZ@RIi>
zQ!@}|2VuNB$lXtvioq@Lq$LQ0`KbgP19ZW@1h_%?u#>|HV-OYqVSVq*rhDVPhri_F
zu5Sp!`#?Cv{fgmP5Z({MH=P6Y&is<+vA@shU+SW&bn(|c_6xql!5@Tv)-@97X}O2r
zqrc|nZ1@X(D9bgsv(_M<0RW(4LGD(jAPmkts9b>OnZ5RaZGdWCbJN|!|H$JXczUn>
zVj%vsv$w%<5C(aH2D$j_@A1BuKi(?<gnsZ2eeC9LxK|eJ2WaUPx3haI0qh@Wi=)Gj
z_Jh1Ydz`(G{n97UAm@N{du;>rQ&l=SpU?wgkay^uv$y3Qzk77>zE_U#)diM?G5B8o
zu{J<FOvL%J!5&@&gp~t=&iqmqW_88?>>eI$C(On7iuqn2g6)J|^KdXS2Vt;1usgsh
zKo>Xx2m^s&x&-(D9)SDDrK%<H?&lMIzya_FTmff5_7}{rC9Hou@diK70M~$Jz#GgH
z@LRd#Kb|@RK_H&=8}?^eS-|DT)1V(EJb@Xo1~0%ExD4J0g0M4K=GWS+fGH5;{@eYp
zwL5?`9l`cq2Gid2Kga)y{XOR~kl$0klnwl~Mq$=p%hTx5oS->Lqfc`X#s|}e9fh3&
zKXt&Q2vdh0`IV2~^Ha}If1;kC{!Bea{T1mR>Hmj5G6BXwj(+x`GuXd>(-$xakfsXk
zI7|zq4pN43!}tJMm@-(;F&F}@Sp~%E{=(s2ulzb9f6LQv900$M#xMEk57Sf8^U&+i
zOZ~AV%OMt(U-|vf*MHlSKihigxBmXM1^-z8?@!zTC$OEyzm3K(Er8yHmO<O0jnGbL
zJ+ulChGL-A(D%?cd+;yy>;D*C*WYS8{i8je;JCQ|mgiS~e;x6?`4Moq@bLU$;!i49
zoI|dF^BK_f@xAKr?&@|$_!uY=oP`a&9pz+%6%Q*a0>GYp*~<d}>lQ!c288?l@3^Q@
z0MNovD3rS2aYh&bC{Y8Kf6ebWDRlr~V+4SX8plBYpr7<$dtcPxF2M?}G+sam5Cx<_
zeiQ*!;3%L2=mAE68E_Uj57>kA)eW5I{y;Dg3fur<fdt?Va1Y1?a)4am1yBT(0#!gg
z&<L~vT|f`;85jm<&or<IV1X@w0D(YgA<PgC2rmQ<5r;@a6d~#mZHOM^6y!AIJmez8
z72*vEgoHw(APJCENG9Y7<Rzp8QUhs(bV5EszCy+!^N=;jE)|rDiHeg-kV=9|o=TnS
z7?m;ASt>g!S1LcMYgExxNmTc#o>IM{s-$Y9>Z1BgHAb~awFw2Fj8Jaq0jMlg9jXg8
zgW5n{p#IQsXgo9>`V?9Wtp&%q4>|^2g6_a*U>q=Em@GJhPr@u=jxax1IP5ko6ZQgD
z32TA%!Ny@&7@3-xT7X)bT7%k<`W&?@bue`-bvpHP>I&*sa4k(!Z_&`uaMMWAsDW$o
zJdFp<b(-5Wk7&>|Z)rZ!Oww%9($ezMO4Dl5n$bGYUZIVpeL(w)7DL-hJ57tHW2A%A
zDbnfF+0c2@Mbf3y70@-%_0rAK5$N~Pi_>e+o6$SbU!_l`e@0(R-%USFPhenUkYvze
zILqL{aD(AKLoq`u!#9R?Mn*;v#v_atjP8sPjQ1H|Gj=eJGwv|4GaX{mWxBu=$dtsC
z&-9k*E7LkNGqVJ<4zmsO73L)7m(0z~Bg}Xf4i-5ULl!3%6w5=FN|s)h6;^syan@t3
z_N>=f(^<<{yIGg^(eIPkr@PN#U--U<`)c+L?%QPJU{hc-WAkFW%~rtH$u`GM%PzsL
z$L_=)&7RBN%s$Bh<q+l2<#6PP;&{f<$}!DJ!zsyW$mzkEz*)rkkrT_s&ZW#{#TCN!
zkn0WC7&nw#g4>Y$GIug}Dfa;PE{`D3F&<~0TRg=)y*%6d`S<JWcitbrAHDzc{#{;S
zUOiq<-W1*{-tT-czC(N#e8GI#e64&-{G9wp`5pP=`AhkS1gHcK37i(VE|4qmUSLyD
zNYFsgSMY&gv*3~tw~&sIhtOT22BCR42V5KO4!;Y>z!!wMgpUbd7QQdsB8)vCaNy*D
zzynVXd^|u9krc5Mi4;MLd>3U9RTp&;y(`)ziWP&4nTUmo6^ads(~GN%yNPFrw~KE}
zNJ>~s#7R_1%t`K-G?ct1St$8UidhOF<tO!2s{bI(LG^>42Ok~mIYf0x<&fK<hljeQ
zsiak<-K8H%f0Ch=IU?gN^HgR~mPz)QY>;fB?6@4a+$p(8xhlC8c`<n#`4stfdGcYE
z!<P>~J3Oqwu3)4PsZgu1rg%uvQSqT-zY?>Oz7k5QS_!8tt?aCvt^7rWL&ZcTPNhkO
zq^hRsuUf1+uO_B;Q7ubtP@PlVT>Z9s#}Voy$B&?n)F0W=P}R7iQL3?eRQ9On(SoCM
znv$B%n$I*RwM4WWw4P{<X$xy#)PAfzhB$z5Ks-fE=!oh#={(n&J$CSz$FWz(R*oM&
z?ti@E__nTwZkX=d6VMX|C*n_h)MMAP)XUTx(HGHo)i2b?8mJgtH+XxJ`lRv6l#_#o
zf`*QUFAcFqYDQs3Eyhg7XN)tACr%wY<$tQygv!LoB+cZTsko`PX_XmZW@wgX_T604
z+|Rtug2uw!;-SUNX@%3Fr`ykPoI#!`IJ0&3_}S#M!<JH(ftF2HtX3DSURrHipRi7~
z9y=$0F6>;_dA{@R=c{dKZLDmb+icqE+1|6AzMyg;_QHUjq+N(zr#+wjW&1ZsR-^;6
z>>~9=>x%^!i4JBCPaQTd8D7e|gmu()%y3+E(s8=$H1DkCoa#L5qUDn6GUux0n&vw1
zhHy)FTXNTR&veImob<@?*!DE@%=e^Rw!Vz^qVu}wRpZU>?djd(Bjgj}^T}7*H`aH|
zPs8t?AJ*U4|9Jo;z%HQr3MZ(@zYmlOj0qeM(hhnUgb%g~E(>7`@eX-^_0ZK@S7)#3
zU(34=yY6_sDfB?-jnMJ1V_{FiA>o(8n^2;tXw-CsLBxw23^zP)e26?8nHsqfWgS%;
zEf^gUJsD#VQy9w<>mNH9cQh{NChVsB&5yT~Zaug~j(3WGmvA^CJ%M=J@%Fn!g~a=b
zlq8p=kIAaZ*>`B}c;6XFL8QD$WlO!5I+<pYR(V(WZv5Sid&qm8>B{Lj84MYL8DsZP
z-LHNi_TbI~Vy0W>=ZD81qO%0DZe?vha(dL8t&?4xBbbwrv-{Zn@s}qCPb!~EJWbD~
z$qmY#d1m#jJx@LF<#WF03C~IS-uYuMPQPe*srK?^fj~iWAyr{u;ry!$uX>736jc|?
z7C%9AqZ3{OuLEB%lw2$sC^ar^DpM~jE*CG)s^F-IuY^=yt;ANjRgG1jul`hHRMS*@
zw6>y7t}eg+K>fovTyK&a7#gA*D41)Q&9}a9ml|CgC!3H>!_DWK`&%qpKDHXScC_iY
zHMbvY$8>0Q)OTuh*1S`HSJkE3Rry}!eZ>cr4;3F(KUQ|DbyxQs>8bss`Kh57(c9Q}
zqOYyru)piG>E}-amIGe~FAR=-ar!d%_3~HTP|y%zIN}@ixA^b-zNe1}j65AZIEo%q
z9eXo=V*LHYnTg>^$H~R1fGOg1^bGS%`Ye3*<(%SN{k;Bs&w}m3^rG(~VJUW*Z8>X2
zYNdQtXZ1by9CjM#kE5*JUgurU-%#FY+BDxB+49;VY{%ny@h^7NciMNYcV`K~L|Wo~
z(m_%!*_ix|;zgnOI`}*M&;_92CzT6mE3f4P0P}eO;OGJM2iu?a-;W%SpEfH9Lw-qn
z=s&<eZN$9?pbh~PgZjJ05~$q_0>JBM03ZR<XT1Ob=F9+a_6R_wr1V?*Q3SN9f7q3K
zH#DFP@%S|9lGmkQ9{t_dPn#1&{o3w7euLa7DJk!j`MYn*TY!xYc9LEO3K0RQ*dS0g
z2&DypgM3hfN(y-WS_^~<3Ztf>rK4wH1T$3Z1E?TSC>0D!O$`IJCP*0g9DuP=vma16
zM#Ev@Kr7<Msdyvh37zQil18r6pRi&|m;58?8Mt}&^YV#HNJ<?%q^zQ<rhY_2_k^Cl
z!AV1-GiNQWtU>k6(aG7x)y>@_;7VXnaLCnbQPDB6aW`+pr>5P#m!5I|LFUukXL--_
zU%V_REi136tg5c5ZE9|5ZENr7eAnC8|9N2W%h#dtiOH$ync2Dd1>D;D#^%;GerI=&
zF9-nr$<}Y2{edqwkS{723<{&&;|oF+3??WWjQW5A4f`<*S_eN45ycyHoX1n1lr++d
zDxJo1UGo3Lz%8acE{@w{?FVQ7F~%bQOPu}2*zbG|gQf-5j|)mg1*L{Uq0}_g;6+0R
zYF;!nbPRMqE{0z&rXLr}-o^UcMFELGKpHR@j28Ug$4Jk(?>~J}zJu<fG|CXb1ciW;
z3Cac_021+OycF<P`j7U(4$ox9vd=g&ruKa}fW3FSK>_!Dgj-OeOHrdNY*fv~Xp>fe
z{ZKB=_d5?OX9rJ2D0*f!;F6=SR33b}n67&J&51z;eFM@)69&;YHoJTkH^po)(Vm#x
zyv#ne!e<)KCC6q)Qft=83S{zp(@O!ya*&Wu9Ax(Of{;pc;HrxBPM2Zw>Q(QkwW1>;
zRZi<_rP`Ho6YvN*WLFhV^?~%R_>v4tc(Z@l&SvC<MEL{B+Z#?7yLOVKCyg<9$?c_T
z+@vA4JoD`6`oPHU5`wIy#2S8Yc5t-BI+@7q8<-q{;Z}LXx2)}4(Lcpg870VN(SIW+
z^ivmY8Dm$;uB2Z06*o*pa!Yp<-{+htlqZ}yQIS7m&5L-<Deu*^cB$hb`h}n|1`>6z
zN|+L|PqyL__rlR({uXv!<x_%!{CCbK(Y<)2CfN4uL7pDxSx!z1J>akOvky>|p1;=O
z|Jy$FVkVP6<b7F3$<s|2VF*4G2fqd9D_^DaV8fqj9w;gf$(+5pEYfvZyVPrn)myq-
z9PcoR;cXfb!GD;D>n)!;BYN(9b*$8#fLrkD&CU+=^CsWPEsGXMk3;6yk>`zx3O2(Z
zzFy7Z@*7!?ky=;Tmbbc|UV?KSZ-{JFLGH6@>FTFZyg~td`DR5(Pr{kHh2!NpZPT^1
z4Gq?fcI2(`n*@5I^ur~#??WEjQb9Q-g$sIF*X~?k%KTVOs-OVQP?lwbrhrDT#;Ytz
zI+mLqxA{iDIxXt)m9B3);%$%*a<nDutw$(82MO}2-fx_B-wQ8(>&n`0ol;<QyR(rb
zU4Z`B&5ZBflE-)Ymf$5@{6bJRIX5dm4p^Va?&M7D9;;ZC(N+rOfqM~jLq?nCyQq``
znH(F&yZk<y>e+PohCDiKxvZV?;;!x5X_Hps68u7;na%6I`aq%@vAg(1vFKaWzECwB
zkG`E_a}|}|es=wkR0;B;yoFtjIxjlC)xpE!#k^I*?ezJTYn%)Eey0;^UE2^98SQr0
z8?AQDntWnjZeea}E2VXmTh1=McHB;@dQPLTDOt&CN6-j=Kf;3-&3$xwl`JWw_}Spm
z%Z0SW-cBXr`vTLG=BBi0d!=}6^4DaOsEN^KTAb1(`IUB0W?=W0>g{tY=axU;3bJpE
z?NL0+feZ;LYqRIa>faCa;XoQV`+PFK!^rm4AYe)QoJH2ui{1qPFz)3$Q>g)IJ@a$L
zw2erPdJY`5GX;pYJ#AcbV0w~JDz$m&YWtfjwG`l{GLmsVby0)#ElAaO@=EG!OV|dl
zR=0!R<%TyJ4NbltVXs!VSyaZQ*7NfNT;kVJ)S)(5o)*Rjuj&;F#6P@;2Al{#&#)oG
zxu&CKR$V-M=Cks5?lwC!>zbsGy^vZ%=ZiNV2a92)TBbMWK5wa9oYeksl+<WiE-4gJ
zmn+&j!h-EiR_4br;mgbtPWPeBpQRW*xj|dqeOx07nHA1ojpJE5hVyQITl;+@g96Zn
zI{H<aRo_h`W%!9Yc7<-}TvcBR7>p;>HRbR%@Z<X|H6)^58OY9eoE)A~bS!>PT5YN^
z8wwt`%xQy1Hi%<yzrH1JGi3P6w$|=M-c#XC!dusY@|KH*<M~S^hy8qVt#%ep9cp?y
z^L*v{l)u=E(l%Yuh+~3uS_e1RwwL^HEQ=FnOB7)IgQNM~Zq&u1{O>1Cjk`T#{KIz8
zFFa!{%1TOutr?`AK6B9HG>80^%xNi~{@T?4*`|)B$A7>{p2ohn3TMN5FrqmZU7gDv
za}J(cUgz&&88zA}I=;oM+B9iVqaHt`n$k^>QuLg{#AF1irG=ok5^(iR{Nn2kAH;I}
z8KoU!Qv&+bkDy<Se-oE#dye4XZ+i3!lW8`d{Cs&ww7cCh%`cbMRqjoOl}kuQOAaf>
z2?I5p809f0l}*Yb8B)-za%j06yeRFRngvub1h>jUgyFjhrw!qW7<Vm~Fle(H%*1)T
zke-(=dhL1em^52AFy$yLbjasxcVjTT9NiM8yY(FZ;Id1f@V(`Fm3));<|h)#^)JUN
zfyTLj?8j`o7iiSEre}^M+H5*oy+W(iEl<^n`5cdS<l0}vDvE`_1)U#E%c-M{**v9v
z?~<I(-R)@qd_T!>6K$elbzh%3OAIxrLID^sdRLQ7R<1k?-NZ?6+2G+gQ+nE4nkqhm
zi?d$Sr8m9Jb5^Q((aD=yh{^UPiz~I+j{^O0JmZR4W?m9D1hcpr9e;)wQy14qxpouG
z?QDkahdbS`vYWx)SxlzriXI$`J<~|rGmug+kbG7*Qu{!<3BP&oD~#LdSMt<_^QO=R
zZVTViwyR;CU;8)V$sW72jSX_W#DMXKX6){)wfxm<*0t*6cL`A`$gEBuKLQ`QXRB5W
zmK=lNm=1}S3)XcA{T5L}cv5<nb>gF`UwdyhEZ!^z$r}g<(nU|;G#)MjX75tr4Y_?{
z7a0iJsAU;}Cl(_`;vo&Ckt6bTNsI3mOQ!Rd4&}pRO+N&M!QZdT<0Tzs5OgZv<(5`H
z%WN*LR;UHZQ2>d6s2-t;Z{dBar-$+Rjbw>|SK^;F<@4WZfA!(pc?6d+!m?OH)9ex0
z!E?y3lUsE-*Ji<B5>GP);K*9YJb`YxG)*r{#X;`MBHTbe;}{<PeqvzTLgtftv*-(F
z(QiW19i0KmFC0bVr)R9L*$=6>x_;VnHI-&weyI^$MTCySW8q&L4&m3brSP85Omgu-
zLw#N!=ZJSxYWD$R?53>tpXVq*MNr1ek&uAn{Rc`j%zHNoql)DHwdE(6sA#p4y`>kV
zk1{fA$V-}4CJiVCREnLwK;mR55%YVO$XOt`|6(CiB<m&VFGX#^@7*S!m>Ie2NvsT&
z*>pA3ZS>5<S`u!3@*glIxNip`w1_J5ahjgE+@{QoCNC;4k#1u{KC<J!Bu%cj9iW3h
zsb*Fk9Y%Vo92R^YZyO+Vi~r++%p(%<n&~0^k-oGS0@06U%0H-?Sea<_N?Qh`v+2K}
z7pl|wU?+T7_;!>rZ`*}0OR94Bw4{dKnLT)8JAl+WN-a~|?`nE_!0ujsxxq}{_t9u#
z;KV4+`A{+J_qKZ|2St_shLh2U<QQoVnO(f9zOjmYw%*BkxW4T0$sYC=EFc(QDYNlN
z-Yhu1=_9{u+N!ce0r&1bsLEQ^@)KMDnJc65jlrp2!;F?}X@frHYS9_1OuyH)kj{g3
zD(x*<x&n>8`9>@Xk?!^vK79ZF9rJb&8hM2?Pcn!gEz7D!0V1#Dsx``<UgK0a_sw%C
z%C-#^qk9{-+8VZP&qGipDy5A}Hs&zn<rW_fUk^;3+x>PD60kE^Yu)wv-qhE*W9O+k
zEzaNl%XInGbm{#|%Kf>NV>JTs+pTINNAO(}D0aMc^X|(YqSE+ui1+i`-l-E8II4Jg
z&qR$hnBkiz60h}bSybY^p4(|=kPi-+CP3jk6VAgTV?h_cOD}atok+-u7h_66Ny4%8
z(qm|LkJrdWB<$6SL57zrj^#uxQ@Gu$o@&|U^-CDL50hOH=$L%YCx*Qqo%SoTl_SfQ
z-S?a824W1gobq;-!plQ7v9b5Y<Y8{vte+g$UTqYfdz=_{@A{zY$?751jdsq89e&ro
z7*30mRPj=eS<_LM(Q!CD=#YTl6pc}OITxS#==P(D?5}0jsJD#PAMK(2f#_sVMP;tw
z_wx5r4B6Pf!tTW1QC;DhIQ*i~<@VIz=qP)-8a{C1-d$&wd)IUF?`-bm5n$yxUnu~q
z8gPJ5HFp|5ad2xG{bn_5a0u%yayHNYm9|vhLmSDyZr#og!g-xMWuEIt(ZfL_gKa{p
zcs*>I-Yr+0-BxkNtw0JO>rhc~y3aXIH2m0hYuMr|{BUD71A*qjL|D+ES@z^*^MnVM
zLi+Pr9N)GzttUA`o$(1co~<{yxLex$Lfr5f7b;@P6D6)fJdNor-g@S@QDrevnI4%{
z*`xq5C<j5c)`9I23DUE`I`n>gnU(H3eYUy`BTM=suQ>x*I@=E^d-_n<gY0Ohm8J05
zW@T$OnI4T!{@aBIJA}7kfiI=kuMLmMFS}ypj_1HM{j=qI*h(`^>ngG!Jz<ZRFFW2o
z$n{BbS%F}RcaqUo#k0Ox2#{wP657d?%m??>R>vhYwseP(ySghqW<V+qS4B<?pCmo1
zxAgICkE=^eKd>pHvbuUcIC!)wzqOoO^;-BnEap_sv}YMPC8)scNWA`KzqzN$mv&#z
z+Og(0D3g1TEDf}CiVNWfG3Ntm_`R;o(WNd-oY}T8zta8kZTriKhVytXEP8^ct@~zA
zIOvIj%YMlDY8ravX_ZJX*Ac@DLeR8z*6^^xzVLnIHhUVZL}`OMZh5&qS@UAJBdXxY
z0};ngwiDqxN`1m9Uk1M(dZJ^w9~wdHA<%F6lwPfnJ6`IQF=#48{FQ$80fN%^*CzVs
zo2V3Y3K2Ur^JqMIf2a}mIY#j-((apKfVcQjt8<mr-=2*HbM2Ji<h1PNX%-tqKlOd6
z$7bhq*IcIEc6`X89mXa4A^anLc--JdgRmi2`z__^%o)}iMI{4ap_n_71_KQjaD&Y#
zNT@b$JFdL&CO4chB(`nVxZd#F{V%2$6kHs$lNXV%r)vgS`Quu8A~Pxrsq^lkO|=A9
zS8Y9mwUKPmg+{&)J=0}(hs@AVHfJM<md`^*8*35q8}26tu01Lb(0{wh^mxz~`2b!T
z*K)ssF{I3rlu7h_(e9ULduknzvK(RJc)Lu_M}7ZBb2#@ob9jdBh>cyO*Yop1n?uK1
z!!2$#oqa~aS1csw=36P+D1P7?yG8+)WwB|^nMG}hsFxkv-0v-j_ifHHX(V=~*yoL{
z^5Fy8GZj5Y_Sf=QB^jmNR(wt7wtr0ETWXzB|E48w|Atqe)uqoEsibl4-I=s#v4@))
z1yV1j)73@XpI=OQEPg)=pbfA$><w)uIEHMo0z?Q-ya_`*rQ$YdR+?O2_U*7;E*Vli
zc#}wleUsnR%@G1^zIM0MO@=5ZcIRCqRj04hgZ}jP16lEt#qyG*G78}K;V3~^Ifs$V
zYuab5Cc#hA@x8Cb@{RpjP<K(-=Sg_v2!I<wb5~5*(o|>fZ_$w{)qj52a5&nbU1fua
zNNOI>Q=hQ4$P(vqdT71o74G`zcCN-Pji6fh#p&%wt}*q3W2+3h3fQC!&-~Vqne)u0
z)a*+B=TZh$K7STeGcD_tk=^*9rCI0c#MV|L8zV?_E)~W12B~)XTX%+IPtp)5>dX)S
zllk}m_wx}brT?$J>7UJwVzbt4T5MI4?BfcYevTk9=)Jvy@W(bycI}D*3tI;q*FlrB
zc@obmJ@rqGJ*#mlPQG97MK~0yijznP^nB7ZB=oH7;q@0+*Rrm>+eTVs5^<_FRd3N8
zAI335uFbWH15wopKJ0F#N2(OE6Ez)Ws#i{a42aODCuIy&6iGJM+O<^_+Zi}Jy2VUq
zS~1+reJM6Li%!6JAoz%Wn0hShQs-DlsD;~Yhnj)Fa|!M*%xHmeQ;k@$sClG8?8LWT
z4Ve?mWC`E1UB0VJ^3@;kmc<eeX$onZv{20>;=O^c%mNu_UIp`?6qYuSvi``bY5f^a
z6?()KJK3xeQ(W`vi^@t~u=vuaX2q+%D}WcTC_qh=9`|9S0F8<(n_)I6&d^i1R|B;%
zlRj=&)O$Z%l6+Kf(pP8shJA@7kpnrNrvEPcD9*o(iV@|e_c06=@FCEJXlu)Bbfv&{
zv@Ff|y#I0-O6>OQn#=BnMryrVgPu92q57o!23n$gN$MhK{*_(r4^1CHZ#|gue#b5Q
zMUwQ20lzhCkKZA9eCvEXHxvkN?lJzURXkOqE>BQw<M%{icjz{EPOe@M%fXr@-$c=C
z9uEz~2DEV7i&aOgkh=$qQhkoXNA8Y6H-MRjM7$T_($_Eeq|tHLb_}apGloOz+=RPg
zC6DA|1tmy@nI0@_uxsrZni;v-vmrOy`ef6!86IoThSwV-$iwh*JvQ!Jjtgr?2p?zb
z)B^0IP9>e3(My+LxvfZd1jZNUUlsNt6;y)mfF`BRU+K^L08aV*KW_s<f0V~dVV1){
zKivszMpWQx?2vcL%L^f~yE8-Mfo|RsdM7VgpV=QdK}9c_m8vj=G4RArk{MAHKx}dx
zMT$XFfQ{qkw4HG5E_x`39OFZS8e_?&09|~D@l9j}g2XVwL;>Ck8c=|AmEBbe0Gq)E
zM+eG(DH~7R%6;<X`-Lvg5c~69PlGSXuK-<&sUiE(m6&k=D@kI!=0k>nuC5ky+I2h7
z{wg57qyTePSXVNzfFPFSlHrzwGZdhwXsnwE=|}B2B72jG!a^_#@WjUitWzC@k4OAP
z>Ho%lDpW;cZOn#JXVw^lv6!giT_R6flX9~Z+Tl0_^t>o}A1f8Ar|LOq$qOKedMG&*
z*3wJ<)F%qyB~jMvb)dA0&pvhJ0^2M1v^q(T2t_yOZp}ZFeE%8zE7ZP_D1B^k;?)WG
zzVCTSj~w`oHG2gPi7=(2SdG4*KO_&ap6jOo?x@>ah|<+)?-5p(d77gb&I?Unj<UX&
zZT5#8ynQV#lG#o@K+#!RVB}$5$n4fS?(FWzI?Y|4#zdi6?(_m9!$L#ew?R<2gi`0`
z+YSkgk><g1d6p3P@p9~7j55CbyJ{zu9@8N<9iiqL&9ra*WIpUj!Z<TSS97>vxv{Kv
zlS=&l-2Il8`?+dN^Ni;z>Dn6gIIWziuOeG9QQ820aQs22?BsV9`HL4v&Q?>o3EcL%
zwOhz)VgFK3dAWcl`8_5U!xkD$kO<W&!}H*>C+w^nHC|=g-#|AQwUWL_NZy;g9i*kG
zXfS`<-$2Gw=9HiSjn$bu$ENlfING1Vp~ofT!c{`G`|DXJ=;C&byeqR%ud1r;PoL1b
zsR_U2In(`RbOL?TDcOdU6E4wVkU*q9SY?nFS68ygRIL?$CiyXJpm#e%@mox8$+k16
z#X0VO=A-1on-M}#jru4z`LE4e@t?!FiCR&5VSMl2wM{5pcNOdNsg6E6J>ayzb8;H}
zJ)Ufd7|U-)R4u)w0NsML6hN<ChZ{TzT!UA16L;~R6o9%9wPpgx?ywHclEXs5lZwcB
z%#H-+C31<ty0eu)#v`%01np*W*i#D7z(bUR?s!muxQ_5a#QNemn#cogE1k-y<|%|{
z&dw%wkjw~9(Wy*w9;$2!F*_tr7)LcF|4!;L>vSO*et>WRYz{gWgSArwcTI2-v)&;U
zqh<%2k$Aa>6d=`e_a3?XH3i6V!>q=DhbM^NiA5mN(fH7~<p2tx-M|N`D_2H|X$C}X
z-K`ohKav?WR_jAHL@!wXZKMB=7(lkc{BP?3q-}UJ274MY1mB7yJtL}MbJ}~{Zawwr
zSzuKtElcHH_i~q+uNVr3&K}FTJLQ52rU1WpDdyfPUa|*DX0Y=B-tv$oDL}7hEkG`m
zdKwS>Z%&kf|AER$b246*0ua-Z!F934jiCUa=#kZ%ct3C@gEy&uSPZ#okOJ%;kb<t5
z;U&6>4|tkZcQ@XEgG$IGBsB<tEBrFJW>Z4J(>Ap6C`rBsT|M_tEoJod88X8M3Lset
zR>#nb*zzD3Ebg2IiIkx_mocQs@?=tG1frn!U*HndY@S54NXy6MFcJ+W>jvqR>kLBH
zt}0e_?ia!+aIJSQ9m6)vHldjE@V6#TNVdZF$%%bNpWksZynjEJ>FV%nX~-(l8ei2o
z!iyV8kdF(s%Wr=<Uv^I(Rx{LUsvmSGM5V^j+5P!>+xbd1I<F$plTQ<`iTOno<bHv~
ze=_}4qB<~LAoa9N>eo3hz5Z~k{xvEJj6`82oN@Cj_j9jen;%+DSC~0(gztj%-)Rkx
zu%7#HwJIU>=oo9F(Eb4;bCI$}TV|QcqYaCOQ)k+soR{hgUtA2+^E8@Yw>5ocRx*0d
zet5y^um^XsSnN3W3FjlQ!yT=*uO2b#_Gzl*o}c4WM!1%|zU2_B^`2m%4}5DWA)0tv
zoqGMxg!YdCx(*HyNuK1_gW9+dNU|JU1Jy!m@VG3EoI$RhL+r|F0OW$XAIrJkc2aVg
z18Y4-lR_%N`Lw3nP}OF{ju@=V%K;Q1TlG_HrfG<{`HgS!z*eTTyzYQZz3$WbU2>+e
zjYkmfLen`fM}ZDOdch>R2@Ds?9W{j5s>4r?A#MtZ<7uCN50%588I$r6tHlX^OY|yO
zl)uz!f0QO!R=~MG@l$sDm3M~m5eT0b=yb#-1Y1Z{E2cEAS)M(l@C<0?dg&S(%K6Ak
zTu-=_RhQUne89!=Mt`d3!Zkn&O;5_zR%<07LY1m<6Cptqpfxi(<M286U8}6RVtIM*
z`>zyk(;P5_D_FWfpO#Eu4m_OTS;n{$TtXS@@uZ1^;1M$Mc*DI3Y*NZq8LOalb6=4+
zNvdlzDG9OKjz$K@tyiRISHn21Z@42WXx~0UPGpy1O+xM5ohQ9m#=V~R$?qTPl1WMs
zA!T({NWQC{P<0WQVgR;>_NM)wkj+7@r4oDybRjtuz_566w{UM<=(j1rL3wcHypFpC
z8U>jv|DuKRf3xo$K^gpOSN+pnweUl*r*}sNhnR`vccw<;Fr|TfF-Y25PN4iO_qJ7)
zhs}V~{ez8CjS+|#v!5OX)S(=#mCue=6*z;eQb3Vyy=jenmrvw+NH+7L083oYP)q#~
zlI15oPQc<{oUFSwScw*+<%pZgN^9rvlcsT&QKbo898(uWl2?_ToqY1bn2}nc;k3=4
z@WvCbbUj0kTE!G!2;>U`g^x-P1!%uR=31B*+B7sLUm5HU0ky(Tf%_js3Q*FRF7$Z7
zoXtT9jEd!09$ISgpU&qW>MLdq1)gIK{?uNPpY8T~<;>^~Vji`a6h#4^PCjN`D6S8f
z9Bh||kw2oC0?pznz&`4(xn0{6iGo?j-KSE6+1hTt>ZoxMc7C9<;`wDU4xfk}e4E3g
zc_3^|{uZAy-`0&6G3(3TkfByO=Zo*acp9MaAQP)_JV1QYN0tpAMOKF0Rl`s#8zXO^
zm{n9*xiJNYYd)i8bDpJtS{~E5^Ug|HfLKLabRE-(#!J$^^@-!d5GCRJ8b0G3+m#Nd
zhdH)<^lmo!-utyn{|FFu@LvDMH5^HIiviz9&>rocNdAJHxHk}W`J+o(Q@C)z)n^~g
zWJ+qR=uVFD+{PdlGm1PyJjo35#i8;8MfLOq-%z!FZEjEYstlnrPmYnf;8Pl<n&FO8
zTZyyKLdA{8to{8b61mm;MTEiMQvd`3t~K;>8x^?&&iz>*z%I`Ls2ZfX`}WqgqL|8;
z`KPM5Gg8EQI_eACMPjXlTK4IMHWK_n9pNz%)YD6@fxDQ_V<z+$M)Ik_aRli`8U@hT
z3cG=XliwoOTrl+DOk~R0RajhN0FFb1Q?mTE3fInTbx?r2H^Sc`H*w&Mc#;=hX+4#*
z3{K*MRHVC@#R&oh&@}=`m(dvwTI9CTvhHP3SSry7TQ2)baoOZjJBj0TGL#{7176Rd
zz3@(ucH47-4=*{nO5|i5&u@bBehU@Gn#L4{p29z3V@rhURi@nbuZ^?J4!ccbc|-fO
zQ8Pj@9>4}*eYS|CR79^fbw~puNgG-*6>`1Bq|7psjmW*tG#T`HJm_7nI-~bB>poOz
z+;Y)4d?<d~9(xlzl0P=ehc`6XYDjzWScG<+=@h#~dF3GWIZeN6M01koj1m^PwM!~S
zpm4Ko3dDU_!9mI91_7_#XV{#v>T2tw!SW-_(sBV01Lu)G;oXQ*AJ7E*8f9EviZ^@m
z&~|w0<f;n)1DlE6r2`%7;@&{_QPH!f)~l2u8;N@p+zhj07*<7!)-<C4&jx>$=`gU@
z?q&?5zUa1qtIQ-=2maaaf4Tb+{y#Ck9{q3C(us^cn6Z~RyvoU3L~H!@mm%S-yde{^
zVah(#?y9Q(A_}$%)%n+>IC$<k(gSq+kES(313>L2j|(3&!9R+ZWl4ByhGU!l<Qh*m
zG-1a2b$EV|=TOwlp%)^qDR+I@<aj?GhN>!U<`X#xTSF8ewhrr3<T_EL%?xiB;&ih%
zkNkfBSOC-8=-L>#OhjpEt+!V+v=01fkbZDATv}Wm3Yf5N0s{|hLW&Wr`OU-6vu%UR
z)FkF@CPpqx-*Wtd@;4CPq^$^hIkCFKrGnmF0}c02UdV@|RdLI9xPYxNd?VJi5yet0
zGu{{K6NFtjKJ&$NDRN=xz;ubI!?5&~)p*hYTre>{bC7fu+@R(vAG5Y~<3;3&DXTXz
zTSA~rFtoyWN#o?nbP1q);rfI;Def_7|5&1jjeZ!k(tk8yFa@=HqUP1;+I1faaIr{~
z0=Vo+6)=Q`>R+8|lKJp1!)@XF20{-8-{3BCSE)3^KG+xIQ;@~BBAx%V_>lqq!S*Ys
zo@Tmd>taP)2DPQ|)=w@hoaeh2?Ug@L7`9nc>Ihxg_Iiln+g#Y09iJthM)1~OACuUT
ztw2k*R7x*yC4aMr6NvFBzFoe$bq{yzySe3Wrsrk7*4{Me?>AI4k*w`o=>g50b<;b4
zW>@^@Yzk@CmhAo5(c9&=IV>S{Mim1ag{@z;@|NiRV1;wI4qjUvSB)Ov@<_`|8MRcz
zBpwmVD)B{xRSqbu)Oy+H;TO|(SOIx=M1yn>HI|EFuZI`n8QXHoRpVaF*=*Jg*$;yw
zGSocNEZi*rfa~eW8o|#uw$TH%QqZ;BvC*XxLO2oL7b-pWMs%|6rY6^Tjc_tS<%)5T
zYiW}C+Hr~0FI^dSZxzCtHQDUo%T@3sS&SRF5no$v5|XR$o#@xJ7JRgl=<cV9@F`Dn
zlk=9iC+eH3$7yl*j>a8WREf&2`-N!=5JeO(z{eTmf?hs7H{w~#_r5m#iAwotyRSt}
zOZSf{9ZWqSLM&#B9dGP-%zA+IRPzAgSV()*u2=HX;$)W@;OT2mFSml0aljZBg;voB
zr|C(ZsV{VrQir*g5T|fCOY-0=v&ZmJ<B0fhIXv#kXh`ncWzo59)R)(-TP}AaXWzwt
zzm%p9U*vjIxaA)Y>=<nMV_BCS$G)4{Jlsmc=j0QQmDa{`^-YxZ3BUGqx4hr+zNe7|
zyP(tfQK9Wf_a_arD9r<p7j4kDlug**HCqkZIrYm6S0x=ysM4b=(kyuL?7&$_br!@<
z_NOLky=OuGQQG{Xd;Ps=y7F(*KmXPG?EeRPkpGEq1N=Kh5PB9(rf(k85^X_X%~_L#
zRQs1xCr}J_o-Uma)0jVOJ;U+xkkDdA4>kgjJ$d0=sK&#f`j17qqX~3&sQKQR2t=SK
z)^m&dbzBo1dlo*#(YSloohEZ@cWR!=(E~gf<M1>{Jj((cQ<4&l311r=w_XC>T?akz
zBycYvfnIA<jW7U?wOrj%@BUgyZemBx2i^-G3aKOOnRt@xi%}c4))Pn~*LAX~(iZ5i
zejS~&Yv+ut%m#g4DQ9dz$Cq>tiMt<y2ZI=4dZ61(3&%rl?m^8T8eGl`7YDt{Y^bT^
zQ1Hp?4fw861;PFQyg>#|V90uR8yufk?}sH!c!b^=@?g$Iz8(w9IBR$FBdSi|UH*dS
zoX0vkA$*_qQM}g#oS{w0@2cC(X#a&)LI>-(NRc5nzjd-bhb2^NqU}f~xmO8M(G<So
zfIs<4`ZJpFUPf|2wsjYA4M7P0=6`0}<DJ$f2|jm?nbX4FV&KnCB)EtLs75o?6a~nm
z0L2=t<b<SOL}~utS#5u+r&@F17$?jk8aPAj7u#~!Rff%2=F%OvGt~U)27?sYXh(uC
zhrWm?69Ob6j(SMH(`F>P<54*96f>Oyuxs<$ccC7CH&JH$Aj583rd4+rm1<rTVE{|=
z{QT3K`KJz;Ut0I~-kLe+ZsDJa!T&`#DCK`(sQ15h3ya0L$bTti{n|V++cFy8+`2r$
zt1Wt=({Ib{HKSe`yPdJW_51bdb<_a$$Nu@OfE(MOWVCLE)1fYPG;op!>=C3F?YH^Q
zq6CIVj*-%~AV3Adx%Ew>Px;R3jMtj#<hu(i-TNB}+3^70bL$l;K^TmE5g{t$h}rT!
zEbzEsSzoW1h&sYW_puyr@F+`Onq;a}LEiFfV;veQid@LFo4LQ@Xj|<R{hIfX*y)<~
zN)Hkz1ZTEnOb~1(2!tGMvFAu`jcd(EVvHw`lyD1KbwnRiy}G_KpS2=%e--KZ%PZPH
zR_J-m)Yd4u(Z+!M;TIYHcU~oP+D+?!*Gqp$O(HJ^h)1>wA@CO|fQ(JhQx#jTIqmiW
z`G+N7pyyqUoB*V*b+@)Qm`iuk^+u>aM!dKo4ez~K=bb?k>BcD*vOYmu%WQu(g1;|*
z<A|OPTtA|qy_jg)jlG6S+kxv^=y6R8{^^^Gd%iNxZL--ea(5Cm0OqQH@yjy&t-t(l
z6&Oq7VS=FQSF{TM&E<<`Z^Vk(Xu{6lq)OOou;owh?L8t7^S*fg{xdJRzSl>kE^$^W
z>WHyKY@la`w<btg;aVTCl4nWa`KKo<e;xkQrss7#`DSjJQg@BO@-@Z#J+aO#7QvAZ
z)R7~aNi8pEH*y71y7;;{XbnJTQ-|<|aMI^TSBu?h!=@V^p<dVy+kMZ{Wh#AYcyK=2
zO1Nr_IoyK$whAtgL#8j4#9!FjZczGOm>)ZMI&GgwUY9<P3<EJqT%j<0HT?4>4zchH
z<Pl`4+0AeOulp9op)HDEHOHY^k%A)^1Z_W{6va}dChsJ;v##2{3qISaeuUowXa!LE
z$nw<|WCDhf%=tYeV=V5*a69?X^@rC_%5XhoV~jkrEYBCZ_ROd1TA>7IhO4EO3UN1l
z1YYK|Z2g=l-G_2V3`MoSUeuUg$!E#dM0hjW&imQviN%XtaiF@VKz$`iktLY-LZsP7
z^B7$PUXymbI`sU34BKRrGTUv3$id@W9PC=gGZ<yWSSftXZ2+^S<UYD9F%xkVjTf7U
zA>ATM7~qf|pzCAoa_+A6ykIzJtTjqvraJ3Ek&UdaBBysDpZ%r4{)00Z@^>-nWt%2Q
zqfauU76WL9*A>b9&#O}|B?k1#OhI-A;S_+;a~w%xv5_Y;d13Iizy^bKHyAMB6)FvS
z@wz~bs4)?ANAnmEWzjLHjU#RtyaIT@F);`2kwPQDS1u~BXmXq^4+Wr69VObqv6T&6
zU_jC|7(Fo723m3nk6Cq|)>8m7_h1udSD+k8+&_%MT|qSs;jKZBU^-~9NAdfR<s!7G
z;@2qv-WJIKE?oalD6Avs@oxR}XYGqXf(~CsyGY5~S6p1w0T0y{&_fwE7|dB>#`l5o
zmZ&f9dDCOGPhf$Z5b^)pyk+46s77!WPi2M5gUV(F*fBSaNbP?n`E=m^s76)PR7V33
zYA|n=obhe&TOf9p$l*#pl`tMmx@J!S=EFXOwg2;I#Q&4$348XJbrSJ9_WR&1ZLUSb
z=T08iY~=Et-a4mGv_>yheUH2cx7j+RZy9*#?LK`vExO{{5(hpN@|Ap7CQoXV_fJgh
zX3a(s4Lv7W8Qg^qmA0o9+BEw=4ygK|(`r_m7PTV%44sW}o$;dTZiO>SiXkF5-JevQ
z=_F8(6HE%>FM{APVT?92>VZb}PXuePX<3h7I{aB+{-xIL?k4egyi~EM?;rKO|C}3S
z@6=ctXH91GoG5d|o_Q<8Xgw5|7;fBqwDgNjy;GQyfBs@TsQ}#w$II!b6q@9P3JpGu
z89i10@Iqy}x%P?d@yjFPjth%SF$M&Q2!tud0mIZhhWN5LZuL-mIOO9EpBEkHV(3Ya
znb*@LpEI>&f$v^E(lC}Ma@uaKmE)4Kih{AoF$W9SGC9`*b6&GmA?nVFb&(Q5=6dPs
zgLj})WKMhv!7hB10<aKevCwh(*wJxx6Zm>)N$=+BzLVV|-`m|8^bX0iUK&ZPN^m>o
z(!t&#>X-~J+K5r8CN)8WsMJg53DqoLQzmHzn<(9w9l1~~<n?|@q1KRYwlsoE$I=|o
zO2SBC{(k$$oNSN`HNaw;<bg#bd%dU39k+0J#5cQoiw92UnyGgzt~#cwa}k%ps3vfe
zc#;F2C%B_xHIPln=-TjHvBL`~9@f`lhzGrR&xxcf$M0{hD{+*Yabb*j415*WL6{@P
z(ni;uM%Y2C?z=4oFm^`wGLQqnBUuFYG&~9pXw%yg`SDe*FNaL>M!uVQUU&7bGB;%I
z+sV5?d!Fs{*IH?+!~U#XB<c`&n+CkajC#&q8~Z+4HD%%`znA`pDP8`GH~pS6&Ue<H
z6*5KjMrdUIb?EztXb;5Syl4R3DFUNIx``)oS4Mg3)vzB_=r3VONhyNZ3Il0@3?BB5
zS1Ytk#~(wrj-Xp3*4P2DG-Oc@_I&b=hMgq2wF^NK)Cv_O$c0*9a~ge;!&&i<CKCk~
zYvrPXT&gQ9tpo0V<vwBElyU3+$;T=0lJtNO%|bs|BGdR};8>y4zOcr;7`fv8&luJY
zQ{OZ<e9J4D^fnM(hZ=i=EbnfXAIg~Iel(dJ%g4EE_bBP1;N5L&KLh5^8-=3PSJ_ql
zqOItjm0Y4#2Ox8Btf|>Bbewf5w-8^uI1wHdd~J7$O}t_=TEWb3e}ed95rbs9si-^O
zbvoLWAv=#|5ZlSKr(v~jHe=HF@5abSm2>oP^hwmMCN#+P5W{e~t=cNsfxERr_lg$O
zc!CB_0{aZ4(=D5@tVe|Xva_t`Ga@K}_h>`|A1M-)2riF|8-v;L1=o)jo~fiWNo;Lx
zPB;E4E+=sE0qqLMJwV_JKulPN6WZ5v-=kLHA0Oxeh#x?*0tKi?X*hENIGF-n={p9Y
zgPRc0&EbR3n4kds<ZiMkb}&AWK2R$3;H$9g#+gfNdS06Jl4;dz7D&Gf8{Z6c05Vc~
z7Zml8BH$sQ2tJttICP;%;+znI&%et~_^;AM#=)`RqTi8(GlIvEvMBI8m>uJ{xP~D!
zq!E;fE~Gq7o-q^Av61N7>5+sNcHKdV!Cvmu?J`CM0RdtTrN_n%l_AR*tVzy}qI}Hg
z=KOWgm$9v~Er^oJL=rhh$qZ+np3}>ltJQzv;OtG8#E9ZJug6Yhc)&vb`0Z3PXptML
znP$%iGTUcG0h$W>z@VEKd;SE>Jv02pZv4Sj;;zRi-qHrO76`{S{y4eb_>938l!HQl
zVJ|9YPs;39BJbHG+L={kE~^~kBLm`L*FDQ6OvQ(Is0gv6u@^Y<<J2M+3>}Zm2BRmR
zgR3mYG9L{5v2I6l=WM0p1t;sk!x{`ns9}-2wn!g0Pj!{uCF6($KlTssRpAGdM-0w1
z3%Jr|0_1N}=qc%O$)!F5Dl`Bqo7|EUtF*9N6;~noK)Bk6t=0Q{(UjXWp$pq?lPu5t
zbF~b(=8^xNwp&mDCeS|Ii&e@o0mqS{(2Q)lck;5=ebQ>g>|qM<MfxP@uzvya_9win
z1%gxi6A2Ue!GH8TPAwXFrpDm5^0v*&Bh9*fST(I-RbWm@2R;z?Z&du?nu~CpLHH*P
ziDGSIxZr&1d|wc<a(?z>%$MErQymziUA}tJt@u9g(ebZ1m%9%)<!MH2J=4d63H&qW
zW>2CU46bb@%AYPDxYA{UG(#y4?Czfh<AvS`6!4l&(4npQ3GX-yueA~@iF`=W)VR9S
zzB`~F6bpJdpT<kS(`fqR2^A*I41drpo~Tkp9^os_%U$rbx0(0J8?rOzh&$&k6WQ*^
zk@9IG@X+K7;V9&Q9g01tQd!$z*#Q@$6?*<v6=^$I6lDXD`-xf;%sj1`ERQCVnMVv>
z%xk=<w+_lUTsb!z8OSPd^LpVy7+lwui+G2q0Zz(m;luEKMB2w8vyB#QLo9X9)YG>#
zdXI;9E7BxyJ2#r$P0kRob_JD>W)g-1%-%-gwZV-g>4)=SPcdCWfMZP#X$1{{IZ*MR
zhW`TwKv@Qw5={FxjRV|Y4(kO&gzwMjrO*qq48Z)5U9`lbtXmWSjA2tijqM`HM-2Xm
z0KJe#1y7@OxXxaLyamn_?wtb0IgmkxXuVCI2nXHH?Na}U`E@Y|!I$@_YhD6PpbZq!
zKN<f=%x{bIUrqEM1I)l4`a>ns3-Vud$@J?46Cxeyg{BhDY{Dwd+3U%CiHEeGvQ4xa
zyLU}lCg;w+^drH%M9}3)|3`KAf7w0sZ{9tEuCbCCj0upC?X3rc<;ZwA-HNO;j^>f)
z7GoV_%?YXyu7oz6QS(J-nPXOm=#J28T2I4?8Ub5_pv`O54%)H<;DBS?F+K>q)Cpv%
z7CB`M!!UOkAJ=-VoMx%0KT)uvqG6)oBgagTKMN;Y-;rfxW)7AhpN!lP4FQF@Bmz$Y
zLL~ozWHSEB>@u1H94|^HGr!uK_18y<+Fg@_B)SoPQ1*6{5nyQh-`(p7f%-8^*4|Ik
z%~_U!bFm_a0tn=i1&<KGbCI4xM{xakg0tU#8;q(i#czVd)nX~YS^xz|{`8Ni9@<D$
zb3VcgwaaxGh4lj0=Z`gD8V(-(ZyfppD&#}m;3~C#LjjtX8njS7iQ^bz76q8xK>gt!
zGM0m#?;b{yV{G9>{__+7_YN`Mms5!$F;pV(s%2oAd#k8FbPD_r_n<O|!WyE7Ex%jV
z%U_Jh;?}6hrmbm-CLhOyAugi6YHx2D;Z@Y4!8c&Ib0_Ss;VJ}8jYIE?-f1gohv`Mg
zloYJBFqNt8Zw=Q4mos%4ens$90}MMUtQq0mDEeim9iD<7LVuavdf9{UL`8$U=xgOV
zXzqd)kBQ^Ub4ojrj4^t5I768~)m9(!Wi`Lb3E7PKJIP`FzJZBUigH2R4A-i{JB(p&
za%-S(t>k6WU7kFDBh@(2HN|pB<@UJ6&E|k4rB)zJ<-e-g{JY8_I|hkd?tTQH5O8#_
z4W2~om_=A`b|E`iiCkfR1TXws5Zw);Md=>1ev`+GGrDexVtvWWGsTFta7SeBy`36R
z=4M?cw~#sD-y1&1kxk!uZY2G;{UXF6<d>m^AT>U(jZ3zk)guSZH=OQpT?~Ib7)Sn?
zF=!FOf`Tph^Ym+SpaOG^%&d%q-?PwepE?yGghyXTXJ1B5B$9Fi8AaF55p{Y~R}i|W
zJo1X3#ll7BOV=keH+}6%eC44v8LxuD^=FF`O~uryn@xj@sj*~3<xda7xQJ)NhhOi&
zD@I%UH*pe=N4LM_VTw>5o5Y9Yuc*?TW${VYq5KJ-o5Tay_7;tXl$V}LW?sQw&%4Dq
zL?eO?giT&4ed7bjaTteA&@=XxcAS4VB&Zd&8a+&sUMSd!+LFT#-qI8#NE4N@RS6qk
zHxgY>^*Tn*^v*K{9G`oyTB{~JDZsZI{@*qN|1@6n4`$(iXFkN=yv+gK0izcq-=jKv
z=Mh_S;8rv@zc_~YS~k`d-h<>1mB&VV+<J<>DH$@dqQl>HGWV*jo0#*vCv-<ks4)7d
zv2ty`fg*$(k|m_zy0x9WdC$|T*igYl8IF@qr#3oR@`W~csPh&w({H^PUf5OXuT&dI
zDs9%3b4*n`bLZW=V=$qy9@?*nD#TKXCqbBas<)o^IX;2RF3s#|#)GZDS#qKE7N5j<
z3&Z{5{;w2LQj(a1Ft2@<wDQScg6$8coyQr61a&vx+Q$g<lx->Pu5%x1f$SgdTnRzP
z)LT!&x$vv!(^|BZKCe`~F||DF`LHw7-3a~N?xW$`B@N4N+R$UT?&jgIn{cYd!CK}I
z?_GGEN*|56-UeNyoT8$OI($g(P>5O+=2o}_KEUrfcb;UN&uppMVNz%4^S2Izyn^~6
zn$~l!k(jZETO-n>+r=mkdQI>2-TSX=`p5fPJiMa0-@k1YtNA8=F)rfp{+RY_#H#A*
z?3Jr>#n0TIKS-#nk$L~#|NO0~)T?5HcAhwR`<DH_oVVQBBAB>lYxx=DeDU{@pTA_K
zUZVApOly}+(-HVBh7olVgFS)V5ks<p#@rE5a6WsAd00SxfEtS*;TgP=95JGR<IZ#2
z+R~V*Wqw#KJuCaBR=U=;Al9o!z=>@r0^$7gC5NByErCCKw6%(#1WgPIKsX%I-WFsH
zcO5{Fkvn@&s-voqQG6Px3I-o=m1dG1i~b+p-aH=4_j?#uDpAP3n@VL1Ns_{}Ytw{K
zwn>t#6S8aWN+@fRC1OOf#mJg<Vk{w)HR~9%lNm9FnYsI2)BFAI^Z7jA=li^#=k<Di
z&mX-s*M07DUDvtJIoG+)b<Vl5f&r&l$u%NO30BcP5D(j{Irq}#YjF4DnNB%#t{-Rm
zV(*^Q5$|>j?3kWnid<~;BQ@a$%*bW)(CGE5W*7NVtqWB-v*wjbjdq+R)unqn>|%>L
z36~+qsQ!@C)Tw!!T;^8F{WvsH@=WC&frl?Qw?~N|o<73(sU)7T`jb1AKUWXoLpnu|
z9YymqPg1&5T;s=%ZM%Q6zjDo6{i*QbqX(z9AKP)p3#|X|(>(bX2Y1=WVcXH(JU4<d
z9rCj7xyEcV=$6PhuF<?SB^cOm^31IPTmPq^=SHDWgKnX4!-cuyTV@TWIulXOUG5(`
zGPWA@&z`SZ#}-#sJH_=ftx|oka))z$r8&HAZ>;g9sx6p}T1n32IsbTF-h@tK^4{yL
zyNaue(h_@R1I$oCQ$76fIkZgf=nTk3)s@v|en>65wK75)H#4JkP}Zz(K28}`|HUEM
zKT%>jJsKrEN*d6c7;e-*w52UTMQh=8>e=#hyP9X>kmHs;s|z*HB6<^DiXZz`{^E$Z
z>YmtfBVKs4cZtdWWxmV%)wsx7En?xT4{GsV*lENHuxA?cA)?#)ZiiCbDi!<+i8HYR
ztKG{K`-$b6&Yv}ML%({C9r}qM?p)w!6+_f4h+Lt%9<i?rhLQ9h=vLoI-7gM{f{VUb
zu9+>fT4qywpfb(Y`wObw&>*lNB$HsN$P;~+z-gTj1#52GpXYzgDU71F0I+8}0&vh-
z*_oDoHk~fwj8DMCvHVUbD|>o6A&l62=KiHZld89c(-+5>f(+CT<dqX0j-FUc#2~3b
z$qiJ6U5H*kFHi4`8XRok!qN4e35(y0_oo$2%QqfTn}pofLs2CXda-NZgv+})23|P0
z5YJ-9#luqL4ajBH>--D{@HX81u43c(cCnwx53Eyds;CUC6)@ETd@|vnK{dwOUU{Zg
zM<{aIx)99ZxiQ?F_YK)6{Tur9@Cj#6d@G)g!3n3NNEae$o#tPF{{o}p?#nYWEqWK9
z^&B;O2X4YUeRB#cK!1kEmj~}=;M=3<uJY~3A{F&t999UXqZX_DEvNd7X(qe{5Wr}u
zq8ePsSlmUo(Gls_o6I%PN$IpH0%q;8IYes8mSdG;#F^`7Qh#xjM!|<5J5#I8aM=w)
z5(TOMuub(0)&nsZY4eNYKoXh(4qT0C@wBP(6A8;nMi2?2rZZIWH%TI+zrndvC7HvB
zvNJ!omqs}v7t#U8oWqrA&dj|rkD>$fIRZJKQ~lJ^>Jg0j$U?O3bNZP855+)Vl!ibM
z35n@gi5(Wp`DP{gEy`*UK13+Y6{Z()4YQhN`0fmYa8$~$*!O@$&G+kUR&)idUOG|I
zWoz8E0ERW}h5X#<Yv)=kyT4Xfo4~ou?_Hw$!!4BV1WO$|KH#<;8HS*~dkG}MY0v%l
z*9QyN7cpS)hx2<?sD}kGa*GATBk4!*4}@s_Mf<tFr8Y6zV9oc41zeiQ5al>OqlxKo
zQ6*RA%c-Z7=L7mf69pO<_|7_!eUZ+rZMTiKhWWW7$FD6ioUZ5EIKOVH)YObKxrq}d
z%ca|s7+GxrJh;;8$kBa84>;j2D8eyn5J?=Ddi~h`YZSfH*VDQ||7igmZT;8-4>b1>
zJaBZ6Q^L-t9iUq$d06W9XHcx*1t+|TG>&2%%sx2wYIo<<w1BhG?V7EDwBD}dy7LYk
zvXx0pr*qi;8iekRFytbF`r57peWEG!0A>N<{v+KpK*E#Z=-`GM8aUa%avMleHeloT
zcHyj0&R-lGG1NDOEoCK7<H4A#2%L+ZBd<Dtd~C)C6?Y7tI#K>iWqwCpb^AEWz|S;^
zVHTiLVMwdKtdP`o7k-;|jVF6HV#ZBW(Erjp<hj$`-z=H#KNj_<>dM37hzk-PgFbEE
z1#R1j_by8jr2BMcE=Zo2&674c8cK19(~@3JRhJh}{i5s0`)pRRGP^tY-{YD@){+_L
zfvKmC6~}fVL|4?pYUHV2@86JS?+%`%(VSdu44nk)-bl#ZZsy^h%EKn~0hj7R1~_SG
z(PJ6vOy3?oK_90&$;)_K8z=j_Wm=fKh40HBpZoY^*o@;94+m=>D-q`K@u%6*4KkT>
zl$s3BT!;00s~Q;%qbD?^US4{~AD8oCbHR}r>lL&-wgD<eJV81vJ{Z6>;DsFGD$cML
zCMJq3`r{Ae3|=ricTm(hx_PqZ{r~+S<^R#8^v~~_0M_gD`(kG(pauoQWFKbJZ0YLr
zSP5G@ZH8_qf6fv4ey8c9b=0#D?Z*hbjx`d%(-U>ywAbnSk#^BriqStbq8F{ovAc}$
z+^tS?)5}hi`L<8qPH~A4=DrL>o{rN5^;IG{l{wjo^$sgzq#_!@H$On7Gtbjn(_mBc
z8|&=v?`Yd?jzwjgm?F(-iLGKG_Z(YdrU#TF&Kyz9e|<*SOgr`8BR$Q6=y+NR>lJfb
z{)mrlBU(u3SlXPV|EBVy%I<}<4?&^98^-Lnzj?&Bb=qlInGOQk9z{2NhX*0ynBJu}
z!eZq%FSvLED}at_s1c`<Lf%zbjJ6q(%)feysJZw$>~7oC^6ttD&rdrKMmM=xi3DhX
zt+^+ugY^U}hRn!Y`o%$#3~Kqsae<Ne|G+p;-wF15E%(*kF`vUd-PXQvPG?n3LsMz+
z&6owzao8NsT2|QTsKj4l9<}C-TmABuRrtj-8M*lSxagf6f@`6Ss~pJjZ=!cW#ru&{
zlWL3wsPTcS;Z;I$F)%jN3?Y&ed<Zv?c;gpG{0C?euzm!Gbs9L>mlVJ5T|zMEgz@vN
z_iy;h3LsJska&)-X+_A=Vz*wHpRtYu&&t!H)}B}ZqI9#LcBd5*%8HTeTL&Q$AiN}o
zxkqyAT(-quzc~8R-h;S<-GI~XU+#l}4+V^iEJvZt<$(B2(lQ&vK-zmGc^_qTE@uED
z0c)=@1{Q>Pp)clL03Nt)8m?@a5D5f!5-OO>${P4FHi8L`<vycEH6nv+Hg%Frs9Ok*
zIb6-#5AN@30TGnvE+X;|9DAm0en{Tvf^g5^^iyDRw8`J{a}jBe67#wG;BwKea_|Ay
z@n0OW=`gr)<c_Quj)FG<r)7ib85t3gcBsylEYN2OhW;^uK+nN2_hI=FKV=HQ?=0|}
zW9Cl2JuHOY615g}4H~_QW}0ZhLeS>O3K+O?9vVW_s~frvEz6kldfba+yht!)K>D$4
zB>5OcAKEcPqKonW;t)A5V<OTFt{ePEZTjlXz2VJ7FaRT{4jM(Ri!YOy+e1J!RVrU;
z=yxRf27Rk1RTXSS51#>_%sm{XfXQ)`o^%O}=o<tAJmwYhkHMnyL~>vKIvU<m3orpf
z+cI@!0t|s>8+Ar7tvI~ynTde|gdCZ~;yr2xbDj7L$}T`#Ccq>E8ol=$sM|~c0BMjv
z{Ni|t2YU45G?HF{qF*QR>Z3&+5Of5v=o`Lpxt+P2ITl4!?`s%14$LP81gpltqVYsk
zSoJIL$mo&SVIq7#LPrT?$AAOC1xEyySZxr{C1L>SHVY8!z;{#&-mU^1W)&QZS^1o>
zXj5GWh$g}OjwWfru!B=h;lr2ziY{s4Se8`ofXJ=^iZTHXX@5teL>fb6On|&hfKwVY
z+A{dt6`f{i4Xmwgfn)_RgTYgv*Vr=PU3&wrS{f+f(C5Y1;N_OS->~V1)?hl@V#r(P
z#v{Px(-toR(>(?j)2gNRH60a$w=Y2S2@XF4kx3k-LXV%X=I9rQ;sAVfO^QhJJ*G66
z*H1vk+6+ACA(j79T2(77hOPxYX#98xoOl<}u(ko{c#v`f`phDOoPWsyhzjPiuG|U)
z!<#9(2-pyC!)Pxs+Ss%4VG7G&cl!8)v6SMN?hkY?gf4Z^t)Wfe0Gvu^H}~S0USNnI
z24P*nS_X7plKG26CYAqcT2&@2M)*km#i7YhB+#{hP>&bmC^gtEkpux9Z7>{vBz)|+
zEdGqI7E_Jz&=y~h;e$p;IzZ2zP#uddh@4EP1A1_YLQJm*x{jesNIDvDFBh{r3e@Bn
z`wNhGoC$2iv=~r0MEW{J9pG3QU}giI8wL*{#D8(z!tJ2TU#5GKleP_OScE!-<+3hI
zWCZI!tz$ix6OP_=mvBt*8abZh#?)dI{SNX$Aif?C4DiuOK#<5j<#FUwQX#G$#b@oK
z--JC#@v2TE<@YbBd0ymx?e=ZKflu7iR9wk-lk6SNDO5ii<}swm)1n#j!6g?TjzUr$
zCCI`O3A5(%XSAY<T}GBEPipt*K6{wR62eb9(b&Vh&)gigfYo5d!YV#?-LBD9T3K_n
z6Cw9Y&D;$-3NPPBCHja=B8m{;>TVoAzu+tOux76qpy}gxdk!yPy!94Nem?6J?c)0r
zW6~thTz!}0?1?rG$n=F-JE3TC!Hl9$OZ-A8fko(#j^%#1qTBn@?TMz;B`Rai{rq5x
zPQ8kR4wvS#$)8W}K>wC%&Dm6Qcp!kMoZ^8P*rLnJJY2}X#=ljsZ8GIy0IapXd9p?x
zZU$4h40RBQ_?BLR2JmxWmHRMQq>p`V*KnnS<n5<2-G|ro%-cNnKhhuUa@(4&>xPb`
zd3pN<b(<dEq1*O(Uhqho(U19|%_f%5Q8yGg*DL-5XVg57zGsTbU>;@WIjvpo3(&>W
z(MB<6sfUw1-puY8t*#zY+tm8umh1VA1)pZ3jp_b%SVgL5cbuN^*G0|Tgexu7>lV%K
zbCN5!uk}1J97+K_y!l`BfPAj?bU^WH`s-aU!guIjIgvN5BR5u=yb&X6ai^?sI&N{|
zJT|UVGv_?3H$nB|NIgh9$Wi;ZG2ZzP+=Q4G&>!(X+WvD!I%yA(?~?8-!`vsPnkFom
z+N2LILn`Vi{liUD=rn8Lkh)%2x+{%xVPM~*U8ipCKYTyFSx)KZQjNizdxH(ordXCH
z5INB*^cXK@R4gn&J!iPOEhMC*tyED?bV;uK;U1qZT_GP;uGN=OejKdme=cP5JsM?|
zz6NX~>)JQg?0IG3V7@uIfi;v#-&q>*<{9f`_Q(84!X9X}04)uXt>F$+G*5AEl$t3$
z!uxxRFgf1fy|QNQcy!IF?a+eqk@-8EKlN#Q=nIrb3>uM&TR<@``n)9(`%tvj>Vt~o
zDef3e`8yw@S|Ts)Eh(ipx~;~@@M1^6q4E=S6TPlvil%el2cNrHSt^^40_ILL>y;;}
zf4nwj7o9wso=0!8Dzdup!;C;EQO_VBtmTizxCtsoiXQK`TpW)1b{_$5F9@t4ppp{s
zFz*Tmz67%OP!9=`uo#mYFld~$6NyKY?uiQ4JJS88Yrx0ooK57Qg`(2i{%D@OjKQ7F
z2seHmP+&-TZ4`hf!nNqFdfZIeuQjRxoRlsfKV2z93l}@VA3vsbt4FtO`aW!+h*Gk<
zy0*1B{?(}M$`nnNK0+u)%=ZJ|eZ0og60c(5!PmCQx{jUnvKees+RMqvSKyp={M(l)
z*+VY@_Ps1Cjo?grjFedB=Y!ilX4QTC=7<z4%P?I&k};~ZWVjpi(yruHuCD{)lQ_o#
zw`O@-Y%^!*6!Sd(n~&4k^4=2prO{HO`TIdvZ9lIWiYO_ZX|a%7yHm-k1QnWk6>eAe
zXeQl~F-P%yOGSh^jFl@B=nDEw;lpbN)lFfTPp(_7I4>ImHP_FH2HTNXjS8@~<Rg-Z
zHL|gAOQ-W`qr2m}bJMtBT+tqDk%F?m00S|co9edH<GY|}yt%fwQdNfS*i?f?u9oCg
z-{-R=CMV@6W1O%+9M?{CO3H(bz2=I}nMyPEmMU*vfd+Sb?O*4AA`K!9zHxz^8K?Ev
zUu@q~hFbT<I2LTEy`qjje#ft^Cf8Ns?jFwQYkjn51DBTXs_{R8RTMI(anq1w+dFI@
ztzFh&oAp@`5Pd>!`EU>3X`D2u_Zdo`k^D4H2-%Hc@qFo{Dd$ZWIL1v#+k{-8w3%J}
z(D`HgLHX8{Vxt#tOR^fm)6Yf{%p$7A))1|SV0Bh$$?<K|N57}u>nFcKtZz=px?IF?
zPC<p}oM~cR#Ic&uJ*HvrI^MMJIs5t660d*c%k0|h!FTTko@<LFn;9KD&zk(EKvvH6
zS0H^wG)A<SF>Eh+4NaTF`j~k^LQA)a;e7_WbxAdFOjIxM6g1<4{?_y~K$|ap8*1Z1
z?0w}%yHF>GaQA@cyBb{1v|JpwS3P*>&V>$sDL=I(WNc6vt=;AYh4AzV?aN*y!vzHn
z04`f=ZOM>O*6NqNAmYOjuFz2#i;-1PLltPw?rGA2Moiy1n&yeUBaO5(Ri(Ji#UjAa
zplGI5QpezSX&KIXU~PZn1raWiuZrMrou%EB)u-Yq#FN07TPT67traN+C;NH>@gpLW
z<nPzHEpr?FO}}_NuSjBa9IVRfjNeb8GU5U8INq~LuGs}Bjy=~c<|eF3#sV*f%Qdru
zJ{AoMx|bg+z+OEpZy$7n&Bu~z=N%lI`qC;+`3h{>Vk+`@wkNC?wWxbR+<EV{5#e;`
z46ILmWXCGh=m@F0h+}L3`^u-DJ#N_kpRZ1lal+@I{x5HlEdzvnj1b*q;l=RvTdO<y
z)Gaq*_6RN-8HQxsBc@!SX2Cz3>#wF?FwGA6Yjwqe?dLLfPzN#AiJV6R6Y{%bqy_)r
z&7s>6k59fj+#7g=Jw`t;M&$z*%0(g5+>2HvFb<PFDE>xb=t#c9)oclKW5{>Tu#W6V
zOcYLEm7}*W5uAaQbg(a!pY?GP;PgvTk)!p0kO-->R*7K^Zvi?)*%8h!S>PEz_v!)n
zlhvFG(`>g4%l*;PnQm698jiE+I(V0p8sD=|Dt{+@f=!x2AlDOJwJE?Zt;0?M(a0&T
zz%0Dy9@Glbxfb%ZSn45jA(yfHYf0FB)6LH{e%eNx=$uF;W)BwatbcIVDb_T3L6K0k
zGJB)ohxGEy8D=!oEkBvzAi6m~d92VMst<)={k%`bgu%MgTM%1(s{7u{N`w2>g*?cx
zFHWQX@{NQYSNpD$34+ZwN`sgC!%CfePkL1(=~Re^YvA@wHv~j8-^hs3R&;QieVV`l
zr7{XWlVdah4@DpDuTmWA){7vo)q-SbN4Q1h$L`7}7lm9mne81z^EPGG+da8?Mx=wM
z%e6Cx(P1X=Fg3l6M;+P=>o0A6h8+s`$_xs)R!@^fB(Ql8ZNN#RKf|Cl`LsR!p`+yv
z(RvA4PGP=zw-2<vuv@eu1XW$8<*TTP&rfsbzwAsjGqR5jskbR#Q!)%)1Jd$Bj54)A
zc~F(YMNNw`CRaW~F308UjbG^6#;g&d`q<2o*E)Wd;^$w=N@aQTzcjDvYOoeXYOW+M
zY40@CJzD764tP@9n(u{N+vRX{GZ2}?(-0<vHDoPB^$_~z<9ZWXeqJ0L50p1wG#1TC
z?|HHAV?Dlpy>I#3_Gmrw(x;N?8d2({=z`*E9oY?<CFib|KDXx+5($a<o_*o>VqeJw
zJUN;gH-5kAQGnBq6%4Os7RyB`z8}J9bTD^YA3(0E0>k!G2`hBy1SV@xd~kdI5xj68
z^O#=jv7;W`+F9v}7cbxTv~@6iQ=WcSg{>sw6!t@-sbcajgup60#bq>aI~1D-T(*xf
zFwgFB1m%$ri3`q1!ojEUGc6;NPTFT0%4=nE`>V9Z&Uq@BDxMPz^?ZF~_RZ%4@o-I-
zy_bIv^sGH)l_|_Km;@HR6S2xX=1yqu%~efe_+@{h;KDb6&~k7HU`C+71;5Tbk#*eW
z1!r_Ep0Dqo#PZ8;56pM_9Lm;G3w5sYR4`m+k5g{VBLo~NDOYkcfT==|yr64FECOF8
zFd_s3f}|ORBOeC1>a)Vi<bcfPu0Q^=(!87$bmQV#ztB})HRC{|2NwnAdf(=}@-(`g
zpp;<V(w<02Lq=sYwHVmJ<aj-P>I?m^%gR7hW)FQuV(wy5JU#?@I5h@Z(uL4|v>?7*
zPPeCAr>u8DZ#y!F#O;kZbR;V<F9TdB#d~=8;Kswt`acE49wSH7gz~2YM8@^GDyB7X
z6PSzg4?&x%hWtaOOB7>+B|obSKkG!)+ZTh1|5V-_{))e`I&NT0`NQM)(vOsn=Dd-e
zpRawVd1u(zY+0Y$FCPS9vMgHT>#Pq%gxvm`3AVn|MwuZ<%rn6IRaP;-IIj2-=xvZC
zh@t!}Mm_W;e=iL$T~!d*ZoK)U0`Ya817px&h}`hOFs|4Zb80Or>LZR~DAA|xqt+Oi
z`QfWQpx0>=2PRmM&0EXXegsI29|_65^D~N-j_yGOGtaBy6iSnyhOg@8_NhDM40_$O
zx!yx7@M})KW*?F#)%XfC9W`Eq+JYVNP;H{%!=5a|tqIVA(i_5dr0df`?$JfDN`%4T
zaZvG#klP_hcfWtwG;zo^EYIDodC#T2kLNLt(?N>ot=d>qNftsp?i0!4tfrq*{DH{P
z*8`id_hhB0ZI2x_%AHlmIqsjn`9$v!RC}UoPh&qYTqPXlt3>W42mpUf24ptC|AbtP
zu<6+tyOZCt*DOMh+efOgSMZGH^HY0Lqcp|#Ymj2DAIWz$FSHNXE6*3OUvBjpd}A3I
z2~mvIgf7w`etJk_VmNO2k+uwBXY7#L6T)bI;r4fsz*brjQ2yhd>nErdqx_-p))7Le
zj+E#Axab4!A8&-Gyt-ZUhLwbL@JCBrCz46Rp9*H(9)!iTGG6s2yxL?mnW3B>v$@{g
zQ#Wq6&O4?q44nOsst{{-RN%napo*jqb6#h+$VM~I01t&l6ug^|V`mqAO7W9Upi$^g
zNxkf2xE4IEj4ARR9B1p%%q?IzV+t@hWIw9Hjncz@abN+OL=d|9Mq}+N1NsffUyo+|
zbOT<|ue1)jax;v0LRg(0|HbhX52{FTz$SX&_07JzHM@cDN(@2PPx{wSEd&{4<q2<K
z=72;%(8am}A+{kvp87q&4I$tf1@5hKfgXSTh!aU`Uo7=KhV-a}j(M?2j_}0X8awi?
zJRj*ieCrp7|M|`i_(TJTFYcoWXbvP0D=~C?+i`ySsZBqhK<^U`?WcaQXv42uhgYlT
z`fGsd0z-n?L-Iz9qw|2kp9}7ocgl$RF(;V{^jd1)%mfFB%>%f>xW?F1hg6Y`Q3X(~
zHHykkk0$gXm?n_Py(?Tx*{t7lLN<X^>R%i~z>@{p{f7HZ=ddVP6(rw+@}XB@uq^>}
zYYyxc*_aPpM92c5Rq*n#IUD6iuw!ZeO%Uh?8w0b1-SfkE1Uu+XANmdX8|h#aeC!{{
zI>4fveUVFpV`?xL=zRc57X7Oq7j{2e#1KrszXt%6EehsYf+h%Hb;SYfERwwAFIdcP
zSnvOU1+lpRb{yd41?$d2P#%L*92iv<d$hHAU^a-q7a2(g-VOHDeAxpI^pAqirNcYa
z06zeaDeeh@euQn-gaXb1bx@6A5ulRUOxD^5#vwiQyACTJ$)27ydr?N&`~ym%=7M7<
zh=w&oQp|t?QiB8_iZ9?aP<6Gg<ge}mes>3`apBKEuKy-n&F>+ufFbTRWPgM1_e@s7
zOoRbB;{T8i@E3d3_t|KIc-hcj0d)FrXa*bF48eT)2Rh>~XzXuj834VHjXUf&G>{Yk
zUiR<c;0VD+4*dq#WP`JjgWZk-O)$pfVPPN{OD=!&5O@OoGC!b+)iDHk0xh{9C~p8M
z@|$3^-Y$rY(gN@Ifpk?iTT<R2NAoiQv37z7YJVdJt2GHtEP{UM#(?b2J)k_=aRf*N
zRlw1eqrp1h5fIr>9{7{lqZWgC#-NF*CIbB`k{wF@59U;8G@lE$*6{@dIrTeqyMshA
z{RzHS#Pt5V>CcF_uK><-1)SG}reDRum(yVh5H>ylO_Tv;m;H<5$Lv1~F3|z=e1j(N
z5kS(|57v=nATy(R_OQ9nAQ%l8Uh~R7<JGWdiev%aihw9NXcz^sf(7Y>!WwaO6EIo%
zKUDZkpqK`d8X>v~dscwB+lgR6_Q+*zhzx?sasMnF5fneDy&lElL()wEd7424p9)la
zogX6(k=fqe{mTEanjMC&ECC}x+g}fWH#FD?EaQ8`C=~;XfTPD!-5*&BMu8^<xHbE+
z4yN+XUmO!b2ud@kTgM47GR*+7ZXuWjfB5n_ax`}ezU~89j%N^puYpC_{uB(?8oAWe
zfTWuaLjR8X1VEjSTeBI9Vk)~3)@=2e>WfT~yFg?J;3Y~P;Qxt;zZPOR4{k$Hu4LZ>
z{skY6i-A^MOgCvQZ?oR_K9M7$l_fuqM=rdz_$nO9z4T4&pzWrJ51N46x4VG8&5=uU
zV<@IF2(-6Fe^qN-q`%cUHHr##V`jgeeN?wrvB5Tne^-C?$@2wK>}2KKm;TgD^ja+L
z-96?z*nXeXuzO}d%#UuLVpmPsZU<0aXQM<imEVDb8++7XlK|(q*32gaN`B$rgEo8N
zi35D84(e1`f@ioV5C#AH8G_OPYFilhcGM&2X8q7o<G*OV7Z4;{w$u+qN{jTO*%jZ#
zf#9Y1_0N&$X4n6NcEHi{=xs`=-y$qh3NZ@+qzBCN0zg7^)BgWlK?wl*Mz%Du4;G1o
z0K;$uI8fy4!J<P#p7>47+mUywY%|66M#{v_`zvUikpAkLqP^Gbv+84;b}ngwhpZm6
zCBVL$ce0Z8^n4a+t<<T|fNhk)`jnkt7rV|M7@1i=Gu-y>t;)e(dG14og@=1j<^|Sn
zk_D+d@wKS_Q?w;|GNtt_l~9|YsTd%W#Y(+aEW4|$Fl<#z@YLaNdn%vC2+2(;9K_l@
zbH5LgC6F-B1HS=BAmJthKsK>sP_0(Lu5tbi*e2{&N_^z9MF+prVZqrNmslphi<@}7
z;fL65`a4afVu{-$Pi(1~`mKH0ITwBa4e3vE29jc2)Z1smPUGkUX&iqv?+pxHv3AZW
z2O=9g0l6uLh`@fUH9%Qd0oLb9Lc^E-u=fMx=v(`|{B*$fXYhY%Mm`pxZh~xSMF=b+
zO8S=`CDsr|Gn&{e3=7jp%y<y44%CLJ-yj-jGr*S3py=CQn(J5>%yY$W&>D!N0sFyK
zh*$-Uz5(w}!NR>@6N&vJ;+2HaH}-iYBv`nV-41Z#VV;wIgToN{A_lyw`3EOZCOUqD
zLlF5qyZsPEEC<z>?DMJsRgHkyHH-X#1Ppf2Z?FwaNgBb71}GtzXTRTI>)#E3`Yr>O
zcgQ<Ih<t`0s4WnYTm*PRK=%g3RCo;xx<88Tm<7xu>-UjFzXJ4B6Hsv>4uG7e_^<K9
z!Uw<=)gN^!g98Y-b=iXRNDbBnJ!`={e13HV`W3MAHvL&2FBDUF$4U^A0s)OB13HcX
z?`_nzi30W;6<nG8qkd&V7*I+<1K63T!7SMc2K<A|E5V50q5lnk^y%E<;Pgr;KT{Sc
zNp`|9Uj?hW<60ijH~v7T#Qw||v|x;Tl`%|Npm#;|nMb>5OS(5fq)_b`L^b(`d`FvT
z6y2ME6tx3T1cEZVI9R+A324XV1pir#qj=h^uI+mO(+TcW0Z`On>PjS_4%fv$y=6nL
z#=W{=lj2eaU4_xcb#1!{6nEsm6mbX&9^%Sz09FRDFWI5yBf7@mmaq0BVA4M%&|tWv
zWP=MkVD*4C&mg!2_8h`7r9h<Izea<i_39d*18<gr#4mv96s=3wSpV<ee+HBexd`>#
z!!RYmyTT9=xJSo(?xC5II9Tfs3|M#PqMmywrX&K^0+@to&AMi%046p={EI}Kv_{>t
zfnZ$@gJ!_pILP@__Z<XX0|RUR!IeUA7V7qafGKAHZhG$kw$Z`%!6~u;TMR^Ho8v&N
zEnw+I2HNlUWfuy7DMI9SQpw_K)iHn_EYr9M>#89z2b!4LeY9#AAb}`$pj|u@A|@l9
zI@adM9Zd0NwtJgp#Fjo1Q@ev!36e_K@%Xjj1ZLD_@X`^u5B-xwgy`z=zymb5p2jxO
z7U>=#3!c9?ka~b5wc#XY#6`e77<OU%IZ)VMJqdv3uBQUfI0W6pd%+EWVu9+d4QC(C
z*|07wz*AE{iAcISV13|pO=bfl=^pkAKuD1z;(r5&vB#hZ_mY4?LWY>)me7(4WPBAE
z;cWnmBP$P@-t~9;-ecfOf?*DQxmZV{A1DXr=LI-}O{q*+x`W-0`qS>s)J~!SMorBO
zf+#j%BA+~27XYzZ?U~x~G_W(Jf{g#a9^4~PCQ$=T@FQ3l3@M28i(^;c%3ffUsQ@XN
zL=F()K-oV}OtHD(n!uNpc}PX?zJ)neE%4p`y!d-XsB9~JNwr*!>kpLIQ}GCT6UCMY
zNi1(&zVALZ*6wfA;pDdM)fu_%c4_jqfh4&jjCbYvul6WjcxP*Fpr3mIoCuQb_ll0@
zcT9k~EboW>^vV>dBjpb7%m?)Z4!uok#>spxYS{kJ|He-FEF1I<y2nSf%cDN>>VpNB
zWk!TyTw}BPL|vJfd`o!wl_seKQD-4ijCCy)LzaK4$4AG(0)!psd7F|DILsmb*f_z4
zQzFQN(vP;<^u3l#9ALdV)UkkxwB{>m^g?rkSxZP_y6muP4_YbLbcE+_^z<nQ43=d=
zU8jD|pWR*UI4e?_#}5oAaw`az@MduZ$bs>%5}1MPrBuWA5S9^?D41&mY|Oln;UTl1
zU)L3xfbWR$kYmTXxXvy%IEnd?4Xy(BK+6Z{K#n*U32Pe(S&raX1x$hv6)bq5?gNwr
z=OQpXHpau!MGO<@OY<ld=qj+MG4c3WL2w)eTTCmW1jX83!v_vr3jkB>GJ!Gy4Wz@t
z7;uIe^#TIgvJR)-N#&p9gr)O-e^ut|D2d4jzA9tI=2a6Guyv*#DE2UyBa)eqpIHZZ
zZxF~WxDqu;#76^+p#%Y&8UJoUuz0b&pr>J=MPhqcx<Il%t1-1vG;kUJ8edDGOMz`*
zsU{iVHD+ZYr=2O@@D_j;kDnO>Xm29PE$HG^NR$qywsD0YKAr()tBCDNW?GGcS#9e^
z0y1Q>$q@F}11qK#nV-qSZU;n2XI%28LXVLY<tsn{B;i*;0H(w~A}HsO17@{;UBe?j
z@pVUo<Ndb{kOuC*{l&3L>ts!A>gN#OA#qt>E?>j?7#T_512qz!sLz_gB2@bjmt9?p
z_C;}BhH*>B1|4?YJbXEN;M2qRfwAr&eJBgjJrU4P-8V2!){odt?@z05OCNdij)}sE
z%OBt@l^RXY{dgIXt>EwO)K`mzaXsjUs{4LT@W{;6Z2Qq)9F_4U7HmZlKQWCJ06g#l
z>7WOzQ{v%GXh0?rAkwcH=T@ol;2=r?2gP3;&vMsqmzI}RmxeBNnj~_6y%l+SSM1kd
zlNXU&<(@hEEtwzVpG3jZIEMZz6$jp01U3nf*)9SZsJdbhPJso|N?<cc2)fHe_yKJ9
z*AsgdU&`+%BxVSE(J!;oD(Rqb$105h^po=X9iX3H;^^+)3j(CZ5fOl+jKqA(hBRQk
zuB4OdNUKY1NT+o>He?6g9kT$0<rE=^u*lA-*bVkOVhnT#xh|`t1{_Nywj#R(6xmN*
zfa4M?)t^2^M63=2Zk7X_)Qm$gemC^68_bpoK;s-jQoa+S2+O)Y_CKrH4t}7<)W%6H
zeyjv@5n7WaWPoekHE@Ou*~<hn@_LboUONVK8{qfv_$V2sFNj3|{&lc1r~qBphGc3h
zkC#ERbj%Vkg~o;1P?5>Z`{a%mplrj<mhqrZO*G{@E)u<r^zne#*kFeM7%mdAjHG-2
z)u72zVq*iEQ*PXwCCm@Rj3fpz9oZayjy^~l;}0P$h7rK_))@gjKY;SY=X#o}paSF~
zW7QjMT-hYbcPK&^-sJ<qtYKgkRluMQG5=&MEFDF~!J&u{u!=oE@k+5pK`y{<kt%c?
z&|eD;Qlrktu6Y0xNSsv_fMV>cP4kf_Plkw)o-$DmnxFk5rd1s5d64lhp4hg(c=bw@
zC&8$ec=G{L0X_iLs;bp&^tsNoq1ullgO+)9Tm`soD;<8woDHb-5!wEnz);BKjCmM?
zj(;{ICYk@?5ORBi9$xeF<hIknq8dYSF7FqDybn)}f0xicGD$cO?|_?-C8ULwu@ZVN
z6=_mg@CE-#ZA|8_`oX%(UNbb@zGaDHC%2ADKln&Re?iWFWe9=n#kk^SXv6dvqaG#O
z8sTwe+u_%$XT{}4_p9T6oE8>{7<|&kfjxn3AW<$5!g=vC2vMy1Tp5Y?_4`}pMejTF
zw;vr(AymE8vp6FsA>q4q|GW1oPU~vHyEduUz56V8CAEBi6Q{(UB~-TN-^DK3mGypo
z`BSz2KeI>7A$IZzx<7qfhVT*8Iuxc?dZ*`Ca)soZU*F&VNJ8-3z&?fg9r>@zcF6^A
zB%}k&QUSpf8Ut2QLH9C*@DVaE`^q$aGnk}pTg6NB&%NK!HF^BPQ9-xHtvX`_bprV_
zuDFcFbqE0j1;~I@Dt`h{)`)?Q)2w`0$st9PvKUMv4tPams^Y{3BxHY#uSO~QhC>P*
zHQiS%ID~LXoF7;ZAQuuZ+%ymp+7ud~e3;-cb|kG|GpR9N{o<B|tbos)Qm#|4vZr`E
zt7Bm4X2wP6i^mDTElX_1LjKnge8z<7=>YrwHB|!~0|mAui$2#m1L;l|Kc3hnq<!PT
z=&i^pPI-CG3~ZQ>9L%FZ?%=`JmqCRqO%Hh+OMA_ZI-BM0x!EvQ;pO4B{}x6_b^PO}
z+Z)RGD~<wVMt%WU2`AdPfc4c1IDKwRZ2(2Hq?*l_jOQXkNP?RF^4*Ke(<SHH5}sdU
zKE0hN(&~aZJZ%wm=?d59LuSLsBC~k`Dw38(>CGO)2M@F-#`zhv4189TJeTy@Zsc%8
zh@8lBJX1S{76)vW$w1(=oB%R<Z^Ih*87xo{#Ft11%sSs4<SLA2Tc!UqKy;@XQ$P$p
zFIEpR_$)wS9R+;EI5@|tV>`oV@%TFmZ<a>xWpegyJj$wNg%a#kG-zk(r$;!W3?&<j
za;$1zXOAeoh`bnlCc<d1&Xe)e9QMyIYDs+LSYQ7ql9s@Obm-_ufzS2ifaR9qH=&{*
ztE%YjxMSRZO=US=bi{b3w7k5+MzZA=uZQAu&0`vml7hJq70XvR4FwNf8^4m1%E9rG
z;~s}`R@wudu5o#yE@E7*4lfe0zwhpTra>m^mSy;w(Yef)1pdV{JI&CZB5M$^!}94`
z3<J2s%=#!DLyf8vnjR7D4)==<>arX(*h+ZvWZ#)<8Qv_Wg}7kq2C+SY8(3lg`qr~#
z4@GOCgt~8$m?9oRG_{9Mo^JfMEQjo@S%WIk(dd$^opk&d@7s_M<)PDQk<}aUD5W>a
zmtC7$-EJ#gA-d;hro&C7%`Uwf;|5+k+MDi4h3HHj>8Qp=T3@pm85G}R_z0=AhW;ox
zaz{_J%Q@8p@$7*Jr;O7ynvWhQMSm=WT-3Mhv9-*Q-}{9alC1Fc>UwpDHkB)6vTLtu
zYC?x!b63f+<imC;8}DWwS;40+I_E8p-pRO98)8mr^FIYb3zAy7TIECUx$$7<1JyrX
z2(Ny_kN&DT=wh^)xItB0M71QXHs`p>3$A&m+IdX={<lJd?>GB}(mMEkf_cq3#2@aI
z4xOsE8P@ViiQ6W_L!o(U>7b1|e;ld|4z)YRJ=)VIb^Sx9{r2!nw|>r8cjVoPThA*u
zMI4Zpq%5E=eCU!t@QIJ)H<NC7HA;DCNj*WEoVl>;{i5XUY?ti8r@L)HltPP7I&qs%
zgs1C=XC4i{`SCeJGx5s%RTwp6)kOVXmlFTGt$os=6R-AOHkU2oS*BiHvn&5O|Mbwo
zgzr)^DC?E!6j7>SL__S%c#&j3RX=FFDk9(ItTezS)wH*&#<JYZI`-Qu$Ht~;O=B)&
zgQ$!P4ITp1En`*b4SM4Kx3x-71vYPdM>lTRzO|^z_2@>Yu9v$%gz*NOiqyTzZZ#&k
zWrk*AGut-2wAdMIV;w?9iyU%QQL~ts=6>swUiVf^%PW0C_c&f}t*3nSbw2EAa&7Iy
zPqO2+bz61IhVbCCA`^N_l-!Sv>uv5wpDB)rQZJr9lRW44MaVk)Nq*Y=r=E{%+2__Z
z=c)HrhSsw8#3^#BwGat@D~Rp%_h^@7a;@}6r(@tI_zr2I)Rw#Zp*8m1Cq|@6d}eRu
zy_~3ITI>PO{WQI>nu4<Kg+y(R8^l0sME)J`qo)^wKHFD&>4{R$A1SPMmVFRowXzaa
zn(1u&Y|Hi|noXi)6_jh9lFtXlCXd?XJk#-uFD?qnR5$oXM!d6_jU#tQd~{cCSZM=s
z0w0_=+B)XFneCd1-*ylY^C3T{_(jjxNwQlE5%t_(wt7sB|5SEe=h@e{I7@tzCtmex
zBxHyy`SlU*tT)u;aYUaRjy!Xl9z`s0e5TR(A=bAe&*m&aZX$Zx_O3uqb%{zl7g0|x
zuF(c_xBm4C{#Nj{A98~7yMmo22a_D;rw+7iwbL8~Q4su&b-fFPnGXyc(EN~}yz2FY
zBS`zJa{(90A6CQ@eT2C=Ixd%tYl*IkK2OMyy6$Jz`PD$0$`w9g;4Zs|GGzYP;E<dk
zPY1sh-b>%wKHdZGaOpb;PKhs3cJjMC@*r`g-p7?Z^yXjzKFPi`uG3ifW3J*jyXX4F
zJ7esgA0}2Tt1X_MX!Q^io6kuEp(v&2tBS0L9$McF_(Zz1>0HTj#UZmR!Il8UVX9eB
z2w*O*4<d(@2hUpD$B|ZFw4{hpuRRDm);oHaTXV)+l$My6FU9vxd1{~4JJaK*cz)=p
zjXm8zWNuYzJFQ`E`WnLSyY6+95M*YnQ7<bC1kFC&^>H84$(`oDzd&%SZtnEc(UKmO
z1IO)btast>6wQcTJ{cplOv@qm8n526iE15I^uJ&sn*^dKh}m_!5*A*Voyl^btv^-~
z&f%5|T^kvhwKy+2CR7pxEX81^iO70hN$sG545L?M`a|om?ta3-h-*t%bx4+9?K<;O
zn_kZteD$nMR`tAbK0HO=k=AB*p{z$GQHyiWT_@s-%kKO8yv#Pe^~sy=36I|&bxbNS
zmfQcF?A%+&yN(C;7ZmJS5jkc3CAH^<E5|cFUY{RN^H3R<if2FTXW`wtG!-<JJ>w4Y
z%P2q3Q#6kKI)8&2U4QDif69ieYpBdiwjVYf&@sD6CJ3F+JXbIzXp1plMheieD(2r}
z#bbT9R9*PdYatOXv{Bva#e`&-abvxWeQ<W0OjP<p{!I||v2BZyax&1I<epvob2dG=
z>))5+V_*N=VJWY8YSq5C`Z@cOJnr15oqfVHN8Km&EA<7o8ywT^c(wR0qu^y)f-L`*
z3XmY1=yLRG*{c{SX^(+wIcv&9X*Rc#`p#*m22Al_1n{ztewXF-KKss51+`5mI6D}p
z<E8g-ch}XDT4HV}by3jA-RiK%{%sYUeFIVaK8g1apWv+>3R%WmMa-}GUy?q0WU~DJ
ztSgKE%!L$H(b<6cm*GE*AL%N0=_rrI1Qk{5eN3#QiUrGeO==82ve8NWenNqf{z*4C
z-!S4@iptU012ILqi}jNGlE(~W#|>(p+6Uj0+rB|UE|htR-al%E8ttf8cY9lDkyjsl
zt^eSG)NxLc^%ZiIh_IW3&zkYaeN|kvdWvRb_2_NtY4xYB@4f`ByWgojUuPM0+tl}@
zc&O|MLQq$Z=1j+dvSAws+YTlDa48ac?tb~Rs?&_{v=eolrb)dI$ByUnbIS?vj-Rvg
zx8Kw^uM@zzk{{6cJVM{Lj~woi7ra__3goT+j7tBLFwJabffMoQ%aqNmEO`GA^E!~*
z6&1lBlbr+IgXXo{qk~F~UY8-YwI>M%%G5;~@B%-Irw`Ju(T9<B$y~MO*m5UPoP&?5
ztLyE^lYJYWT4kv}EDPmeOwlY@$%jz=81iWZkB)Bc(45y@t0Akfq&MfjtK2=I{CJ#G
z+U%?6lGZ$man1={qF<{3E6uIz)`WPiNAyIOmPUUMSE>1Ycxp=CTXUuDPb~7kXHotC
z_5ZshAssnHlpbOZ7P!03(d&7WfUf8bt<xlm#710QA<PSs4Wt9qDXUNN&ue*D>^HNh
zp_G^HlPEkII4LJBxjX<qmVjg$;RN7a0f(XIoIZ&w4|GSnLlz%Jwo13?k6Y&>Rujx$
ztT$w<p@Kk&6Tz+7csN(WyK4oV{Xfb57x|u|MrTmu$#4<)*qkp_ikKqZlX}&6|B8%t
zd*_7ciE{2x2a}IC-1)SnLsu$b;ENs2D_Da{BWpm#nZApiNlRthSnL>Q3KYSVqHa4C
zRu6CNa}Ll?|J)uu;?O5BY*E?hRq^h<hN9Bhtz3atXRx<`yG`!)Po%Ak2y!YeF9$!R
zw>XD>+x>t2^H2YtMD>62e>1gll-TqLC#5ERY#57DZN2>D(>F%@u;3w?{%=8svrbv~
zmr1aicY_RWE<k_+Po+?2B|G_2B4o0VVJYL8SaeXtdF`uoxm<7yJxN1jKTXw}xS2*S
zV&*;#gHOwC%WcyzqY~;{6@CPq8o#@zsw8<+^gzGus^|$zTSwJxkF;IO<upIj?P-=2
z+(WFY1ISRWk~wz0e=zT33@V@^y-nz>q?r6JtZl3_W5*GER#x7K_Y<Qmva({XW+(VG
z`}bn2bL$bu&dx44VatF#R>izyS9bhg{ZlHLNX}1p(8Jvq9I~)XKeOLeOF2E_-8=p(
zCu&7*hdK;i<wa-(9H^?G+l<ZBa5;4yO1u}gcPiM`PWxbg;LH8}QP)+P$ICDKaPX|3
zts;&!5oy3*7kpaM8C1LPTh2CJJzpiQS^Zt-wLBwg)zbZd$D`xfdLjYG(ICxCZ1vgw
zK=ZEePAW#tH7h0aI_DDL8RWqf_ctEToO&Da7}T60$pP$VTCD26cGlOX6AW#C`7+dH
zl3MGeAIQA7KJo2;S71fz=}qKJBK}DTN)JgXjUO|9(>ew25*@Ce@}>D+K1lWbG$=mm
z{$W~Ixisy8WKP!W9h*(WIqq@@&;I9!RQUh(MFna{BvMvS8rwd?0}h-Isb^^xyiyAS
zgTBvd_Y!>zr|$HNs{}?CZ<xPlHc4RW;%G|1iGu@vyjla`{SeUquT94h8N&Yuup-QQ
zsP@kMqAJo6y<N9T@IrcRubk2w;FQ1PDD8$W!EJ&tnEo<a5VafP!-_k3dk=gs{b~8m
z_?o3fW-Q0%_BCPEvwrr8r~x@z6Dt9-CrDlQQ5!etBIa8=P-k}pb?vD_*gd~~^VH<-
z0|*_|(o|&iH0KzBzB{kFfl!N)&Z{>NINE)BixFYzqhH^`<^U?=DEtN53<iMVo3-9W
zSJW_gJ5#2NaW`+9f3I#uobWXASwtg!z}4PE#!k9g{d!s83ZMmvm^~fuaouY7O#J0s
z&B}zKEmvzdJp6w54(IajP_~aLqzG<6FKf&q=!%u>n5O^Q!nvIGe*ifZfEde@YO)sm
zs)Hdno4d%@A3i(~@hUR-u)qI@xH}2CH?kEzKJ%5~y?6D$RZvYw%$Xrn(z^bF%ytiE
zGb?Qf>$$$5>K46-jz$QJS_zHMOFmAY@LwXXfGXfPWfz1@1A$i)BqW=rlfBBiRDQhc
zQ+|J*bH?(Gdz;hFM9z{1|FRH!gNsC3;fI!H$zL2wqg7_)m^+P2U+hp<6uas(d<v<)
zwvSA*o$sZHQ+2%G=aqb|4=m5mH0rw1y)dB21+2HJgiN1(f@hWr`||1N`sRQ~1JmTD
zjqmeLEu5bFc$+7O=IO07XZh8>Gk>e{V_lZh!IpJ@?$ckS1<)sE&0R_}TyOr4u;lMu
z)?R+u68rfU#mQL{Yv&*>5o|egF-1zYh`hMtRJKJ<<%XRyN|PmNgR@@_xG_H8b*g=b
z*;nw&V4FZ7-K_YI?4Cfw@I9G=e0n7jj(lo~^63wo8sFWIHEvqbJ$PS<{QBkPA&SF*
zX{K8SYU(t&aP}2h80d|_<O~+<#58TGI%eD@-}ysQJAQ&|V}+ubu_fN4weiN@lh&On
zP36-A)irsJdyKU1?Jg$>)2&p;wM=uLg5p;RGXr^zFAv0t?)3A*JAEk`yl>q%iA1_t
z_9z}Ts?fcpswAG}j`FB|X;+-I$t9ZC4+;t}+Oy5x@9yx1?11a!_exTgr`Ia`VsQt#
z?;gy@1$p|H*m{>w)C8y)9M+4!7df^&@24`)5*l=xmoPHm9`alnRX3t2C}8JPFYskO
zarwMW=;ZDwaOkX+IO?uDb23FKws)$H<Jn;RBV@9lTCmPlo86r&ALboHo-z-t`<DzS
z{xF@@RSscf`r(qQ{girk2ef(~SmA#wl3E?e5uz_LfmNiu57hFqjeNrsNR(CZKQG!l
zJ*n}fFE96mFW*@iakG?hC3n4Oe;q4bZ#@Sia-p87b?i)yDD~O~=S8&M<8Hlul$f&%
z{<q3y&f&EOzN*7w#+{Y-2cq?`D|cfNw$n+2%2wvzavz)mrhH1}Ys(qqm@;+Q;0nw(
zdd6$JqAKUWk9x5)VsTy-CD~_*8;@wVN?dqVqWiKlGc2<W@q`kgX7ZtH-+3EMj7}(x
zg}4Sz5<Stu^Xx<Cf}o4+_bjef+uED~>s-B;cMH!pVL-aEgJRQ5+1p}LIy%*_Xu9b7
z5lMrS8oD3q(>tpi{XrnM`h~+4xC!)e2g&N1?2VryevU_9v))JfY#x4gY;%2Xhs>Ok
z$PjveB-0BmnLB8tjo#*ycF|1KJK{zA2F<x=t<uz|a>pLx6YU>4UBBcW5ni2J0g@ZO
zm&H2&7@W}IG<!-M_Bh?TzfBU`{<@bQPc)nrkVqAe&+}<(C@%F#u#>VvZK;XVzkc=L
z60h6HUP|}T$7g-aR>Q6t;%V2rUfSh24H#?lZ>OhOIEZ#G6o$OUTb|+_(l(M1H*52#
zReAGPF}TmT!CO|0s#991k}((%lHp_>9RIX6Zt}8PzsaF0WAceWf4e64&Au<UBce-s
zYvN6VCwCGj&x%aeC{ap1d~a#bp4op`F8-{kQ>+Je>18ZP#b~|_POnRE#uJwrtrvA~
zcWvj~A}zT#+?~#WH8uaCqdDeX=!WrXvOh6WTyKaPc^b)iu#jfrrS3T_cwfnDG@*H{
zfShRIyQ$!A>qt#td0AoaJe?RUjkrL)j{!a=SMklCPg5MT%ur`-5^h+@FDTCYsRc1n
zGV?bFzK<EsS?$Zs01k!u$PLaw&wR>!K4Ow61P(Rdz+v}s^$8bux1FQ*)gFDs4>kAv
zw7qO3-_tz#)q9r1B9z=CGwt&X(ww}Hn$%UiY8t+uJFsG<M7mmL=ehZPEuOz;`Q>tU
zXkqf>mHbejAVc?0V@>3}CoL)8R$VlV%eqsq+c<ysxK^{9@?G+k!JgyX`r3GfFDtnb
zs-s8WFExKR`!JK3T$91^d|yYNdr#U-WqNPjSo)KYJ*#>FRmF+zw%g|(Wrp{iAukGA
z&J^v}I82Z5Lq1_1+mgw7E>KWSbIi=N)BN+7&xd1m%&a7`8$VOsgzbZ}eQ^5MM~L1#
z;`VXLW!#z@5UI&^t_|M98H`s3rux3F+uP&>Lmu(^n<UR`eR=m@rlp5y6cbpX%T!er
z5A}+hYA@^cnE9EYDxA;1rEHlOJAN_Q=<MgS)mrs>h!Eq4FR%JO@WcyM7pByCU=Hkz
z3@P#IdSx$z!qwYk24{E3M7`df*kMxgsXmmLxI_^0vA(D+Ir;gvM!T-E2C-&W(xn7_
zImG@%T9{Lq%jIuJh`D^RpUbn4<wcomWQIqiOts4^xF6Y#pSzGEPe~?)VA>a^@1nXy
z`h9S9js0yv@tkUwjr}Oo^1OijC^~c@Q&Y_saqLOPQNb6oO;d~WQ+F!77o?mrGdD_1
z8PZ)v7<#ySX5Z1Z3+l^@1CGt##Wf6$VQnI?6`8|X?PfJmrvk-(++sF?k6Mi5ZvA7J
zi7>&XWbF+zM5*)?V}LIKTE2syZ6U-W>H80k(+Kj65kwaX);*BQ-$SCyb=lL9Cs?E%
zj;BC4%;Ub<`&bjGR>lHZC=~UB9%h7C<Ksl<6#ut7^8bms|Gx`s)`1j)#-7tlD8TNJ
z42WBQTu66kRU0k)#+5H`JL-<gyUz<kiiveabRzjSA>-P2G?8myz8_03FW&7_no?ir
z!gTuDlGCU;mPu(H#y;<&RJS`@TD%<?cC0Z^d4I-TkAr$uR*P~uWNa|NrN?Dg@`LI8
z7OhO?=EBSwD^E9*42AP`7J0nny?fqNfRcXKU;K-<>43Iq8*mrm?9>DzJt|}qNY5)k
z(FQnQc@5mIJ;F1E=(Xb=18-G4K4Lfb1)RUJz6B@oq3d32?x)k)d&tkK)GK~)ZVLZ?
z>k8L&2vcAkqe0Vo2+n8K+4!jmtrdKC4if}sJVMdsn`Ajy@v1sVDkpIuD%f+^*tRv(
zzN^KFEgst%Fr_D?XTz^N`*`@kIlW-QrL6z<qwN1AhW@|#TSrAcJru=7$Aakg_2n@V
zs_Ul1TMt&xJeQa4gY@#9JXt52vl^`4UpTK^)QZ*cAzm*m>w;x`c3<)-YxvwtYu9GT
z6d-2Aq9Pw@wvSA_4<8L(MsK1c&r<k<iWj->sLvO5rEleCbgEB$_ZUuodRy;pRoQ4?
z@XGxQ<5%bn<JY$9?W7vv`xi(tnKO<a7-x;I2{+FlwR`euljLg4iu%v1V+93%Dz_M|
z%(&Lc^;aK!%8^d0mA-29V}$q{phRx-e=U*w&n?XV__xNH9^>Lh$!v5BaQS-k_SeNt
zrdavXaG?qgFJeH>(W*^k#tYqY&E;g%s-lu^75M_-R4Oe$8+vVMi<!Q--3_0efsd4n
zIKybhm1bdI!FRxWyu5B}&UiGo>UVW}=CxHX6r07lzx#4IY>)e{?fKyc-@Unef@^2@
z%1>{iR4YCRR!bW7s#exZR%-SoC%xpm6!&1#;;?P+MR%Vc#wi>dYogO-9@8`my~BF+
zX68W|=%NZ95#Mp|^toBU&u&SZ|D#x?;eY=ri2nf&@z3|6@DG5O;tgUG_*PK>D~10d
zR@{MT+zXYcsOr3pzA0;Yrc9>&__*fk1h};h26t)skn`fYkQ|8Z_=cqCAjy5mQg0S_
zG(h6a&J3_-2PH{?OYd@45n=jL6o?AB0W<*cZG~9E{iNl6ARy#n0XtmI7u=V3^f85S
zGz2Rh%Zcsu!tK!8M|V5aCa9viKK#}qA!GOX*ps|j=chz^p;{0JW2-j6MSDVDd+jqw
zMul{lbndUxbjoa1w$vA}c(SOr*KXjutl(AcRs3+G0_RTz%ndPg0!&!RSaBabksx{~
zqZ3o2Yji9@!0x>F>Gv-33g@KzzT-jk?>^Fk+c<xCiZ<06RDzi5@=V5DsVaRoTvtg>
zArDJ!E<E@~S`y9z*YV%AU>OgFJ@n-z;;+gXhW}-%x$8?H^x+wa?%A;bZvRi-g6L9Q
zf5i(<(f&W;-aD+Re$N+0Q4ncL@2GS_5irt0<fV&94L#CJq_+Seh)C}sp!AN^NbevW
z={@vbqz9ygy6<Ao>^XDh+?hKw=REiP!4n=xR?1o{>-VYOK>*7NN?#HC19cs!o!(HK
zBj1nBw38B)7@=jfKSGvt`osvoJxMNL?o}Xx6U>T2qf`N(B*)whrTZUn5@yG!p7a?)
zjheWXlkcDR;rwrxj|Y(Tzar|u*w({T-7A|q?X{{ut0yQk&QNEo&cl>FWvYE-DnjV+
zgRt2B_^O{rgFo+k9mmMJk)ZEP6s;{1It0m-v#dL2H8r#?aFP^Rz>y|%le#J58jWvL
z(uEqe#qyX#u7r5Q^R`EvgG!vr)L6*~GT0csA)~Q!#N%vGqGC{YquTN}o*Y<_$rp(f
z^`H(eJ{_JRUPt6)%p}~bW5=6r)`&rADrwt|S8!3oFEd`IX9p_YDe<E=f&FPT8ilp$
ze7w+AjaChLe&0ghKdLb@r9mJ<_fo7O&8gHnZcFnEH=?wwoVV1nBHq$3m<70?6xd8&
z#Mgz&q(l<Kku_OExpU7g#Kq|r0_-g;9W7~H3sh!g&Bm_4D<V}7{t|jlMglU>8?iev
zaMw|902Dg|*f*XHy==P{<x>X|cq9lLOYozdv$c3f-RUgLW2xf7L{!ChPpX1ELmSOX
zA+G5(Vqvv$t1))H6;@K^GgX+pzjlqqd)!m-@=RW`Q=Xxx&|NK8k<w6bwz|GSn!Plx
zgv52OWE5-!T;yXpjQ6DZd0QQn5)MV$?<Nuh!j@;=Hu)C%uDAQoAr?v4Y^AF0EToD)
zcn<FYctFfKZ@*fS=OuRnH$&_kMs0C+pcV9t?nIgpo1;uMc-U<JG07?vAy}Mu+K-t3
zNeKwx&7a=4gPtYLe;<#S+)S7-<TZLJ6`w>?n#H;5`~$^!C>&@xwhk-Oo+o#PWnfxD
zWecYlge5~zuYvn4b1n&1Ikh?G4SD5onQqP7BL?x_YVCD;7y|%0A(GeLfb;F07ef?q
zTLWt0m+b;+ij<v?qf#IUjlwD^ySI5%?pC9HtPpiPLopH5i$k>l_l?tEK0TDl%P0!T
zFy5+JOQGSUlUl1!r^JWL6G3Vvjv~D&Q8}NtOt+4jhLRMy-%82jHIV}l(fZ-^0+ZNX
z+o4bdZ)I{H+qqXXXn<Cao;V(K0r8NqRp>w8D*URPrZ8NemhMojPw}2)8Av)#R)!ph
z^a{o?d7+J#qbQo1XH_<OkBMNzU_wG(+u<~N7JtL>*<5~av&o{jX?zTabBBx|o#Z#Q
zdRfkzqk!@{u{6Qk4kDgfg9O9qB)byDL8$#dt$8+L08keDMUQCebkK?YUYF&G<#GM3
z7Ms_d2QO-edC(ipmNI&Zpq|Fi(YiOQ52J^@<WY7-26rFuM#?$gaAE2VpEgu5Ki>w?
zfoINGJyy%HgHn?*sml%&yR%mCId}FZ83x77#0?!(60Jp`YRMNjlsu*;)ctuyqeJG4
zLlKKcr9L4QX$!625-Q8zs~&_8^RWV|<3wlUsf(xP-O_x2s7g@?1pcI;RJdb-KI~oa
z5Owd)Z|>*VFz@o0{YT9X3!0))1lW|HZG-2{nr(5$C13NyBm|$MlJ=h_4LWeY)Bb{i
z4PWuDr1OM<D!N~(>aYhit(p8Cf$6XTs-A*y0_YD(2IOnCdgzatoyq3p>$$CIe<XMV
z$%!drL-FEEDrS=gt0<8Q^&VXITH*&bD)1$9ezNRWm}~-OLJt{~v6{4#fHo5#L_O_9
zpdXmU5au`0G9aqpi^;0*MlL@$ep+%NHwwavY#?+-vn*Uk6|Kcnc?ksfev}dAvrry*
zRO{$pC#<&;iAe5rR{5}RD%S}JUZqA=iBWnc@`MXuX*CeXr;_4r3mhuHJDb|=qMZg@
zld9tYmgGw`(JA=P8acSJO*e!{5`=E#U(s#~HZXe0%J6WrNO>rUBR6q%e08@l&8ldN
z+y+7vnQsXPzYHlcv=IuD=cU~S0T7IRQLCDB$^MpafsFFG7RAw{_OD^KU@bIA<gk|e
ziv@rIy{o?!%-ZU#=ze90lyfoW!1Q~4mfx6n;zlP~*N<Olx0N$=&p~Q!lH!~5?aRBI
z71tn=%FaNTalFm6V5Q(l&1KU&%+oGUVDRCO(zy18XX$Thb#v@Sz+R*wjlz^yya4VG
zo1JX5huPQ}wm+Zgg_V+NKZAb_mwdx>p3psV>Je?+#unm71WG?74ayu}VxuPW0-l@c
zX`E`RnfpAg<j%})>2i~wRfr$4p*B~&{qGARsb@5W?%wI53;L=S0)cLzPp_nve@jTO
z5FFPf2-}Us8HcPmkg#VzPUB<rzGE!pWCzaaqSg8Ys!mlL(8UN)aGO{Gl4IsxDQ^|X
zu2&Wm2^&PHFEew~qCNzfDwcW!_$%>EEdh&taN2dz^yCKpEMB~0@6KqQ;jO)4fcwkg
zi|gy5e(2p#(l!w^k1K-`rO(<S+onD<SLGNZOyhMSPdvmbUSbt@>N#qB{4%S$e}2Y_
z^r375xk~K?K;BpE-2KNAuSL)oCXHoJ50tiD3|(ExL#>7lk-mL#=}lVRYQ?Y>=I&0~
zl%pBfk|z$?szRzDXMyoSQIBtawa{c@4RYaB=#F=NxwE#?wn?Wd?s%STual`bXqb#$
z(vI((I_xH13T;8lgWB@32H87t@WA;K!U)+tp|&3)uz(0<J9!ho^^+m53+HC(>tKK|
zpI1Arz>2#Z%IXZ8V0JOKXfcQBjMUOc#gAp5`0RdnM$DNp7VSR#4`qk{NRs$>|M#74
zdxEB@KeYWj&z*b)3BfhFXU)>}G8qKcS=q7HSvbAhACKo=We{){F4_TJ@H9Y(SbQB-
ztp_YM;eg}twkj?wIvP(6=iS{AJsq*rph81co4oCpXqVZ);S@*G#ww_t#VfHKmgwVf
zemAfE#8RzCNw9g(?`@>D<<OUH>`tYBRPRUDtW57@>sj;ItRK6&xN1r)@g9G*c7GS8
zz`5YYtFMyh{`2g|HX)8p%l~){A0-Hvq^~qRkV05Zj$R2+;V<4KcOz+yfq`14TDDeH
zX3?e^nHqk8v^6s!JeHPv7x}y_U9O&6e#FHdIbu5ywc^w)0F^@*C3}xW_--m)ohGg%
zpQn6PeYOQuK-BcPVeeD=d#|8~Y--HZ#@)ii4f3`qY98kV-Q4Xb-7>IYb(SyhYK{5$
z)bDmw;{_1jipnbTsUEuV1~8+~L#bJ-zu`!(0+-nU9KEazl_DD&R_APi-?(>ey>LK-
zS4M}v%fcVQ_eK$(t9In=9-|!`Dn2S2)fMqsrdlFOIr7}fKZwK4A5WpPAb)`M;r+rO
zt38Efy&xqCMssP(aWLsk6^^em6UpJGU-Q$g*d3rGSS}x)toF&WCU)~pL*OaJH*KSA
zn<rN9mW`A&oN;l(9~)U90TW*<Mc(|S0KA%XAKtdta!?}m(^vUA@c+Nc$bX!F|8KX=
zR%q#!Q-mrLS=d=KAx2{B<@b5B<_X9~D0(E8w25=gzAa`LZF3maEtVhjqKKamE<pg)
zCl#oseFK6M35J#i`8%Keq)Z(>yJ-dh$22K|IQL2n6CV}uBFo&sg7?M2P5Fw4c<#3$
z){1I1V?6v<psBXM;Z%%Xv}1E~5Dk6D#vVQ-Vl9p76~Ak)skZ^xl3D^tVxs?PN$eji
zf@e@?RL~v(>z^&Erti|-#B(of3Ht}uGzNVUy;;3RGkhX(RHWo+OAjVIBy3x`I3oQ4
z(|0YgD4Z51w(}+>;}bnsTaX>pigYISG6KBg+>@Kjknk1kY}Q{xImQnF@3<Wehg+?<
zNwYSi@m<GxCE3|H<7R?OFJJA1%WibB@7{hIvUnABS?8@?1O0Q3G!7bd)uO7=L01ni
zO!rpEIQ|pjjQkhGxmIOI@-r)x>%YST{m%m>LplGeOvPPM<T9$$A%rdoitufy?tZk*
zmycm@v1PvuqQrWx0w{`>yoled;MdiF*SXGKI(e5gk)+!AB`MK)GkJMk6|=}IU*!$O
z1On0ftoo-z_qb~Ud7`h{`=IN(3tX6%B)a_p$9YF?DvpH;VN}8&jR<|8;49Ed#FG9(
zHR&r=uNP&qo&*Z*EDz7WhdfPWD9XIi-ddnMRE*}0pLG_wH*U)5^PQ2_*ur;yQlL?N
zx!{9^uuj<5p?9FL(B+ITs=x{gs?^6I>_p*6s|$(3CbtVtE85#Z1j;sN3M0Hr^=K{i
z99T}j3}&}WajA4tp%qBPlXl#Q#Q>^SKsjR#;C)>^LfX47^+-33%a(m9*@g|ovx6AS
z#~~SG8zI$3-?+o3Cq#(<PA5OG;HCWyW1rdf7X52Dg;F}z2fx6k`XaY3@)d~!UZaA+
z2;Yl>DN1pn){^f!8ah@~CLdjM0axLcG2`JI;hrCc)zkPT_Aq@g(AMOPx9bS|$&#eY
zuJ>p;DA(&O5b-uKw7P~kh~cjHr1p2`W^2Z2<oiN}X&s3c?J@SzO>1+_$~0o3TVRt*
z{U{b^Z^wA6*!uJ$g@{%j*j7704ES(cMamq-bvnqG7wq@^DVs)oS4;Y~>qQ-0QWY#w
z_neu*-w+)pAr$SvOP$a9@J|@%*Df11)h4}XcZv7gfYMpm%Qh}W(r`-f=cTRQ-v^nY
zf$U6!d7D86*5(T>pn_}I_!a+3d^B(B4q`r}5U`omeNNtC>ydo5XY5S7l<df+2lM0{
zj|@ts)+E%_+_K3G+$W1Qi3xxogdhaKpG#b9h2=ee?it)r9cn02_3qt*qhnE%(0#I7
zg{hOEH(Baa4%bQn0BeRKkxoOlyAt9ndX-xVw6g+foQG0=e5nF}5oh`e7S)B%xHF<t
zK)!A<6j<Q0rOWZ@;xVha;PWkGr<HU<pPfFr)q=Y}B!pM=T&EKjmP3Nk6*7`dC$+9m
z<GcT$Bs<4qP9CL7Xp5`3Y}8R^|BN<Ctny%@Ied{I$XhjL`SN5>AIXiWQ$<h0Qcfs0
zawzOdj*|8_w6&vBQ*2GF)_iaQyPDTLisl0VY4gf*=C*|IiILMD7?A=y@{}x0CHrd=
zY}8@*!%2fs_{-(iQtMu=`Lu47eu}`mji?TIWL(ie?jT!m>bGB%`}*=F4uu9Fmb<`G
zGsyNrYexH*U!c6#NRDmA7Ub?<rsTCHFilNJNUML>VE8#l*>5B-X0$i(XaH%y1o=V<
zpCx&y7})GTT4i8oJoo++uocD?6yg5B`d2`Zv664$Z(yll{-|j@6M`RbrJ+?4zv?uV
zbV4(4Ve~6d6Dr7vX@0=j>&s#szYL}LVo}y?-{LyjVRADr3mV|PtOv-Y5QGp(Cb{a}
z74-plKSs?$G*X*;8xB5hEAMFtd;so-1B#Qaz_*M$=8W6crc(WbDSdpJfU>#C0(iJo
zVb5k3U&`#m&}52#w=v!#nkPwsjj>QWz<q)GP*z`T#;A-F{;NcQ#ufeItznIz)AhWj
zTBj5xhudCs7tk{FHF`GKb*3GFP~EJMcR?Do43H#%_Fwlfo<=b$Ql`;ATFnN%=p8ej
zOxqw0yi$3Y%o*tNHHumJ_;Qw>7un~vlmPGu?4(TEfs^>TZa0jFtTV0!#I5XtzT68{
z^p_Y>N1B6kH;5Uz&Zzy1zCa~B3MOK!))xs!1R16@kS3_^G;C7u9nFuW3rN^@z1(2D
zqiHlE2N0JgHO}-R%|68o4-rSb!E}eLHisL$or>{J+Hx~uC)SzkS|X1mMw}6q8`Q#+
z&2Up9Pj;l}4$VDms}nh3k%F*?;|$OjY6|@Q*&0&4dEF`77jj*3&Lj03LJN5#RdvT9
z6B8j}wJ6&O*9JSCscf9LBH-nu=5Kt7&KSYe91Kj~EncpVC5+KO{$UCLtyWdX_fEv!
zV%hJ-^prw6jcE<W0iGv_;n3J6Ye$&w&Gu}0(07#M7#IX>P3iHy$33N9(XP2}WjiK2
z?UZV<2I*o0^d0N$s>LLre9S?x)oAXc-q|eh3^u==%dy1Gwnf?z)Uy_<XfDv3BZ$`j
zVj1<Yitejz+J5(_j>iw<Hr5dTyP(8F{=n6ikbFO<C$y_go(DmVvV7k}B6Zk>jL}ve
zl*fcTe^EZGwbgK)AIi)O4rFI2pF3~cm{GBLqsjLYt(gIjRJjM|BM=B+^@iB2q!X8H
z(-)b9;5+Ca5iEPVrEwv39=hxqMHl8(NqJDp!#%}6Abc?^iu=;G1}ec95`WT1icXxQ
zexrJTf)V2M8Ov5uoBSJ9XzAnY8NEt7*2uxf@mosgQMZh=RO3HZ=%8~;KpN;Rm4+Ds
zi#6}I3r`??9aaV%AMoV`refxH?^)!eAHX%$q|d={PTXVE&4d2w>o~Cb^&+J$E?|=S
zFo3LttVLZt4yd@~gvnku^RzIZbC|<U>i>^dPD_6UoFmMw2lrs<HA4YN#w&@kORD_U
z@zIv5e)~bz@hXFJGn-)3S=|mZ%Pwjf5q#F0P=qG%_EeAqAxjYk>R7EA)Mp9J{FwnK
z6K|$$o{_NN=yC!byKWN}BK7#7ckoW6)3!9D6lFS=d%xu{Zk43^1&RQ!qT5)bbTcG5
zENDYjVq*K4H#;6<8LkvvyRAfvYD7x=wklppANsdm0Ct+GzP~0LeO7%b^i?ct+-DGn
zvSxN7M;j?TeinR%Q#$6l!_fe5&NqqUaYcrI8jFnq9+&n4>vYJWU5j4F7)%Z1FB&zd
zx}3rmMfC|R9KLnfk-V$p4FaVWW_SUUlk(eqNlzT6=?xB{p}RUhF70P8VVP=8@k@1$
z4WC4-Kfe9}r#!>M_lx;-hf(2*JnmF-0w}fxtW93Y*agM(t~9|U!c=7u=Kj!0dJ7YW
z4-Ae6%->kV`Fr(F3oPCZ97SDGEw137dbE=Ur4yONk(O@Ph~*TLN*Sj<2$A&`GBWpy
zKg}Sazah8;!W{e9JBRtFuu&;4gxT<Z6)&`dx@PFZ;i92_;q+{;U5xu*+oVGj5wU`@
zBu=55(zo~*Kd4do5W378wR^A}VZ7Ro<QSJr4E{uWkTI62xA(I?)^cuyMUJPT=B2bp
z%pk0y`npNN<WlhF*8(GkG^qJLwp(UGLON@9E2Mbm!ez=veX&x;c+-W&(=XrBEuwnA
z=U(Ww#C34hP>2-wbs_?Pl{Cz&V`ej?QP%n*94*A^R3Ymo^vm{c*Y{eg4XL@44ALwK
zy_IxQIDVTKDjcEan&cjqF{9$?CgfNqV;?ZL<kl96vzCSr#!@fMd#pxXQF^a3HCT9-
zZZqA-5-*3`9kMXvh-d3}CSPmkqL1}1(DtbFIsDn;ro_^JVRl2vduVykx>&IhfEiN#
z+AbaCCSmw~sVOpv%7!{hFOBH*Crgu$Fz`{XW5v?(e9hDEZ`C{su2LgwL&zYVK3R-^
z`t`^`Ud4&X+^Zmi6flLse6j4^KMw-Z?^G>@F;`rPMSYgASRynl>hz?_bpyl)Ymb4(
zo?WwOdD@Z8=|J@~0#s4UQc?>rbxzv)V7i&us@ntatfQHFoP7jkKNWFi%DI|EAB02t
zE&B@#^NP9Ufe{eHq`>W*Oe4IGxZ&RRaQI<tLuT_`yfP`SB*|~5zfNizd^mLV7~1aP
z<*>WD((-t&K=CA<tpCR*HoLm2Mx%Y!Tku+I7(WaEfA$g}%*~K0)?-!1v<y3|U0YXv
z`ObZw@0)p=nf$NRd~@_e?XsBK@Fn!`&0X?KQLM_T&vm+lV7+k)Z==de$;)mHbg6Dx
zf_I&nVDK#K$LbYLy8Afq$z)8G{@&dD^%qCC+HCu>+U~h^mw|!S7?0IE--&@@qk~#|
zu{$50nR+cjjx`ya+UYvUKL2$`TkAcJ2o9;tE9OC~D=O0EME?`!8T{q=nopG{Vco`(
z3PBpt;^|eEDllG=a<bR)v(GGE_27y=Yw?hJa7BS3-Mz-_sA8=!8$Wfo+;LrE`$r88
z1^sxAD#%oN<kd`uad2=CqgL(!r`s8Tp}%0zK`pDRZ?N{&-|P#6l&gGH@~hTbNt=+D
zK*SU<*xi4Im0XH&IlaIDuEwBhY18p5uX@O7YsB>Dq=X`09y<Xd0~k&ChpDzze4MrP
ziEqHH>GU%3>}ObwYXTY~Fl;W$>Dz;=PNd3?FI7I;cd5{r4cmbK8Qc>5(wJ~!f5df>
zR3CgY9i>=vGZ1JV0e@W5mJ<*~D^(2Ig+4+qEHc~(BPW<2Hs3`^V5(~{vAsKxPd=u+
zrt@YK{JZ356<mSVQE`txad~QVMv}<SJt76pslVZv9xx#&upx(wU1)vwY!m$U=@<!+
zj}LA~eMD7h2AWsmjkb>3vA5QoW_XXlWK+Y<L$gagglrizi4-n^aDr_Fb;F@=usF9k
zTNk=E1MNHYR(ux!_IF1lLvLSTTcQ7_pEu)%2CW_ryd}K^PrvCg8btTD-(xlfo$p^)
zNn7xTKp!J$%~nx?kA@1d`Aa1e3jy9%4skww@eF(3CLZ?G8)no=?WXHJPrjeO_0hfg
zgNN1?zsk+NOoDp$T+b}7Ktq9{;(!*oYlMG8Kzhk1v!pO0VF*_B?o8BKGlcu0@<L7A
zw>?xT>sw;+{>1C)$bQ5XVu<@gy_<^h1*)~HF8Pt8Ne2<G5vIiNrj_!3Q}L8HpDE^t
z8yOfBd?@<mL{FtYDl~Wp<#G*l1m@LqbZs4@{L|?_S+_hg<gLoZ-r+g%)Oydw@PIF!
z*=1kcr!A-0?c&^6ebQH2y8P^l9JI_BwYwwS4V_6Cdso+zu39_UQa-w(LQyuh6q2hZ
zY&lIdM0Xxei1RT3R4X7Y2Apa9EoQy}EtP++UZI<x+r%yYzQ8G~E?2a-s2&&?N;*m%
z5sWK)j7Q2W<piy40jR}bW(>;LOgb3y{MY(CtQzxsIDFOjH2fD45Q_Y`p^1fj0XF)q
znHi{~VZ3}Y1rO9cRa=$R{~L}LYgBSyM8FrbtuWK}>)o>q(kN;3p=kw0EP$Ku%N-^L
zUWqz5FVJA^@>Rd<s=6e$+a@GzQAk<hxc}7@jf*CT8}NPg1<;0l1%dpy0ge03i1EYp
z%NxoN--F~Gfb^??9FIVU@UN(ZmxDT>^j9{Rm)T3{54W421oD$s3M%DK4Y_|`+1Gj4
z1*j|ZA`-*+!;6@|rfZNxNMZlWG){Mb1uM2wxaosdfU(!WcdH9VA+ix4<K3-q71=0W
z0C)F}a2L&t(x^-VrmMr~66C&Vm9IO+biq#X{*SL&{v}fJpPfzDKUtM3)IKA((NH{C
zUH$U0#F+B@<45M{eKnfHI;n_})t3(8i;u~d-7@)?)rce@$fwaheaRm^45qAV?|H^X
zdfjP%xcAdUTkmpzM89U*H+kB#f=JF-ajRi=d=x90ZEMUkanLLZub$6nMrS|TqAGVQ
z8<m-->9*mJZgklf2#<lj9_23N1imcgaTsv!^S%|P*wJ#SO8DijVsY(Ir^V$gzc|qr
z%2_J=?!RgPDLhL^s1L|Fr5@oqMRShy(SPjyy-HL}dhd~=oNiW<`^24FA3_5vU;*$U
zAR9nZ$%6mZhv3}Q>+%x^G78?1ro3TJ4`!mJx^TVqsaMwNoGJgaPkl(5#RtuRaS8W(
zi`6{DLA=KNY-;k~rCUe^>Dg8*1Xec%g-|okJ2VER6zu$KoBDC$|Kd{bIqn6BeE%Q+
zSTO%rZvWL-`u{3Lb$kE2T+Pd<cIjZ}7f|M^0_yMMIX9LqE*6)8Ekrj@G80#CD(H@U
zD}g^Y6@N2+yV-VFWc#Sb<wSUSC@jZc_DA5(J_RoL;L!l(9EjD*`8g`?O7!03%>AUE
z+H-kgFNZ*c3h(DnGiw`SL$pDL=#YsxOGMebg0f+Fep{BdaDo{TfI$<P#b`y&&Gj!d
zxU%X$i!H|ocmnNOJZyMJ!_JLMI&g%-bj-vzi<F(2QCa{<?-N?VJ%1CR6cRW~GdX_>
zRv{)Xd)T_Uo-yZoc>pe52HxB)AVO(l`uy}P>#g25ms??N1xlo3!c|vg*x@NP(aDM;
z40#G92%4*oi_6+Q9xJqiLID|o9B!$C4=Zx|TEC>Nj_R*7xB6yL%0Hta1|@<Q@IC&p
zKgh~Jgf{!WReh0K7phGh(|U|bHHle`ewz>D_393|ddH`2$2UmhNKm{p>@>+fjkKag
zS!gY}HBtGnugCZaq($hCC}TttSOS@IeMrA=O<ttjXT<@?vJST<vQ?#&q5=W(qokP#
z^NDZWU)KlYPQRQ=lD9Ll8`MrN{9eAe>y4Hz{(T#`CCWyMfR`Ti@sJTv{%B7Fp%DTr
zZjIr87xjoH-G0|zj)*@O{mj8^q4kGR1&HPHz0ttbtrY1ksG5n?`c*F-!4};l+0hyw
zi@x&!6q~Hx$bMx(Xir^u8nLTJ30=&(cZ$edy_UruOWBSWNt0ditf$~A^0~}`VLGsD
zMg$tm-xRF*&D4sE_eDs#rQvs1dA|%m8Q7k#5cDiY$`o@DXm}_X(^C??5#>fG1eg9c
z?@cYvYf@=j;3f;GXq3R*0V{MGQ(OOPEQfwMdW90#i6s!`C#tIaV%xRj638@0ps_hh
zoe;eU6#1Hi;Vr=k>6eKD2?AfEPD=9ukzDVKzA*z6Kync#Tk~fK^x%R>OPmUnlgswC
z0wfIiYNTMTvsFP%Rg>0I?8z!_p|AB>I)yuonUYmfbAzcOBAkPyJ4c&nx`h1x@Xwg!
zn{A1!6#2+csW1;lic)SaaA5NG(C#YeSe#O5`@+*?<!`2@Z$5Yqcx&fQ09;orJ5jMH
zN=iMR!)42QGB+&0_e{#c75+8bjZw}Wn4%=4r&x_9{u+e~9>!+3Z3%+cGulsnqPWas
zskv8S5BD^*&CJ>Wx{KSBX|K@6y?#Cu{zDhwyP9+J=4{Z!6xr*g>FrEx-lB3%zr+c;
zRK2M3b7yv{y;pH!1s@c%2+JE59~X`Wax;uzqv%K7U=e&4vFzvGQMRY^AV}3jN!J4o
zhEUAB%A4A;{O3J6IPiiOO*(db%jUB22m0Dsd37<JpSqMk*Rgsm03PBs*ev+hKB%wR
zdW!#$!&esiYD>SW8s*SR%W@Aw2#|h)R1M|EVljH^CB5h7Ze|#6r_)L$plRFXXnL_l
zk{Z1IP&<(&9{lIgBE`q+N&ORMz@njeKXtiF<lbn<^3AxabMe@X(Ks03nR^bFh1vw3
zp~D9lhI>q+O}?C<^17zUS?)1+H3D5^Ow=kl!aCVxB#IP2rjotO`GxvKTRh)v0*7}{
zrIU^OwDG4VXW`Io-km=Hvt6jW7O2UP4$4>FzXI-1?N(JU&HpB;@YtdFEuu!i2{~9$
zvEuuXHM6w1i^lmC3KY-uQlRBN9F?0L3;JHe1z2{58nu@lMCta2o$;S&sdtDp2)*eB
zZCtOjBw`kWH^wY<*~PPLkM~};4MEF$-^T(cU1=1(r@5WQPSOrSbVccSdJ>>eh4p8e
z2urOQz7n-c&rRsl)HlaF<-ReEN51VUUyaE!;bx#*gESjYO~XzN0_j<vT%tp_XWm>G
z?vY0&PL@X4TiDQ;Id8r-1b8OWwi|A}wi#o_l3Sxt3Ed*3+QhE~;Mi!^tb1IS6Eg?A
zh5`_Zi4UqhcrROj4!BHYt(<3h(J&yaZclb26_vy{b<g`BFy*0si_O)`^>8bNL_KTr
z*B{}ng1O%#p4u^HDX?+bilbrEpl}6O(S^bi6qtkvBwk$Syp%j`yO>q4A!}=`A%R64
zN(bH_1<z;QU|jqRnfy^hxrThJUnJ;GFX=Dsl&4e(h-jQa3F`4&o=gJ|#}8fic!yFf
zLY7^~Nfdm&wyq>sKoNX$p&D<@Z{lZw;QYv3W?dDH$>4oY)|ft`KrVS&ShY~ZUvSET
z@iwjcsSBymeL^gib+CnrAtbC(h;bt4%zYKME86X~Dj~T->-uYwi{xF>DS>@f!`OoE
zpe$FZs7#wa)7d1~3YYkS*%5T9sVDt3wJO}_w^gdz5)EYM*w?*<QR)G}Hcd2(`IPRQ
zHz7Oo=Sx$j7huCjSXr#b39}ppB-ZESKRmvW4TZfBU^O>8+5(FTO@NXgG<pjM8V@P^
zt6cJUInU!gQhm{E_0=ls-uYD5f<Vfj?yV-IE^^ivqd}~2`Wjo7cO_JbAu{GPl9l(@
zxzyZNwbmMNa>7qs5A$@1ViB)#X`oqU#oZ>I+BwxPzm7ptEg}Se98#pQN1o}VYY7X^
z66$D5JeOVH)nmO!${{+0FpET@P?6H6%rk`tr_EUP!Yh?V%naP<c;42BRlnQSzCGBk
zB>#`_*OgW&<jcJqhRqbxvfuxmmB7FIm{RE#>ag8rW;lLFv*ftbDU^7tCh1F^$bH_Y
zHeZn{Mga)BOFIPjbtX~-!I{3S@Uuyw{X#B3cvKhMS7HgP&8KS3HV+-!9e&%=)Lz`#
zP4Ka?jQh^tn>x&~p7`NzQDMw92&fHJE^qsc&B!k&x?U!OpxEu*Wk1@U&o|(9<k)0F
zOIgho#aOHFqpSOLaF6z8keJ2EG1W&ITf5Rt7_TyKSU~%O{tmM{Q_peyqK1Kn8jf2C
zrGWgUZ&`C|$fi6C0Q2K-*N|<)UM5N&*T+H|9bY{<KOO$-y+CK&l}x?4KnF8MJ$=fd
zE4^x0ieUVP-d5~wd@0-l^|aPUM{hY2W{^qGsq=|os?ve>2_-Jc+-U~sSmBLpi~Rw%
zWf7?S4qUuvc6}WfJj0jj`DpEa?bmJUs3>T8PaX4a=yej7E9YihiUBL&mWeQF#0*v)
z;=ZYlT~x0Bk#x2Tu>`ppc!Kd0C}NB@@CToF$uEABU#&!H|4#owy?2s{9HsWH0=I-B
znGLZs+uQrQ^xsZI?Mz{{#&d;or;lEDlYfcgQT`~XM4Lf6BOS&}C_#Bxw0w%fbg!^w
zL$Tflx(VA9@ynKvl;iSP!;AQsz!FRoYl{^e-BJEf>SI-_Ht0Q#txD#=IN1!IQMu|#
zxoTMks70JNtr-DL`y+z;Z$(kz&Fr@my*`y9-eHj0OA)dw)a~=sY7?2>-ua`0nGQ~@
zf<zLgkg}NQ=OSzmt3`(NFQBJH*I(UG)3QtNupTQ7Mf3-c7HvJe;;$~ef3a0aG&~Dt
z8DQXh705dH&ZNeSCHBs_9RTmT0<Yld%ZwfV*95yK0l|O68Pkp({{_s2DTf@K1(=ML
zTnS{)ZqZ!c({bN%sM$XU(S7c&o`VdeS5xmMFEh{VEQexQj2rEkb;dY^lXP+!Oy#R<
zIo0Ebml_3eLmmmn1-y68YGG;?LwEsi=c8|{^cCeY^iwk%U>d5j<GUC%@F6#<sY=+`
z2f=t_&e`&H#}M3ys|Z2H2BhW2M@iWm!uy9^P)aCV7HGtAA1d5IpAAE|6B05S18wjV
z^Yu-<8Uy9O<f~ui-8_XBx0H9cS_6^Ek4!|^HxDHjBFu@8L(a^bYt1CbaOV-|_c_3v
zT*@QJF6<H)E3|A`LAv)CFj-L4bn*uqKM9An7Qdk_F`*7-9;*4HqQqJb@<ln5j0ODl
zYiJ9wONax#=_M`8X1=Xf2<>7RFj)=mb*UZ8>U7ppv5RbX_~={TVB~Z?47(tm1p5dB
zC+2=ri6L8BdR{BrK>rZ~>$|qxHFwER-&rpq>%M!Gm-nt9_1D?Jet<Dg%XUsO(H&;j
z_jy|shTJb64Gt$06H|Ep4E`hbuaS>$4MjM@TY&vj0Ssn<on~S#5W?7zRc3rFX{(2Q
z`i#=@)c!_8V+0LjY5AJqnt4VNn1kMr;T?XUZ!7nURE3qZJ^I6z)6xmvdEOIHSeSuM
zw7F+}$w*`TqvQU^a%3^n=D3-t*{EP+{&K9(5;Gb0Ouc&=A)L2htFg93Q5leDa?b0N
zey14^PJZf&wa7*AU_I?eY?2)LSx2MC<_&-O^LF&(5VOP#;^5#E-u;f-<!grufL8K%
zlLnAqabl^zV|^7X59w6!>fDM4JSbMCUVMnr_eml^pVhj3tzCXjoxt`=8ekBXLem~K
zPF~3YjbX-B-%2+x`Mxo%xv(Y*O3p8+O}v+mKqlRcCPFKGe>yz2Nw0=>5dvnS<)@f|
z^50^vr~5~5w&0^T8}z1I^v%<jrrpuWgYZs-?4=m;S2{)=HSO{93`%-Kjg4E*+Dfb$
zwG{&I*t+zO^)Wb+8R~KLQnBHfMf$*!uq~JP$c6OE%}5FU0_5<GG$sIuP`j$semlMv
zgiV=+POm{LE1zHc;r1VXqRfet#9P<LxsFd<Ar1V{%uv&*YH2lkC5iXNEjfhG%!I8e
zsr59-hDCLtj^&rdySFm9?9Gl?lS74{&0uUv?v)DGrXT{+x=3~Wt+~(jSpuo}yWu=I
zD`0$N2n%lK@6U*>qoo0FLo0*Y2E11}enwGWv0)+$Nc??QRG5EsyS?~;=_Ic|FI0aZ
z0{7=&6t=>rLHz<M;VSU=x-VJbA~GDo5<(~}s7*L_N9V36pG9qXy&Gqz`jTJs5Z8yH
zN6rEXuW8C0Ae@K^pRgI5?u}F6GG6R#_995^65yiJmtDGim&$w}Tu}pGazP)Fd<dx!
zSD+rGaZ&PO`exH-GUfDua{FGZ-q(KF+E&xTMQ<nR5#Jy_FsOyp#zVg!sgnsVCUx|W
zs1Urniun+FRf_e##7C%O>kg9@ud{)nAN=$-Hv%oAe+k)$F-6cv@UcdO{{TsZJQiSK
zywQDaZf_pbrQM=m)MvdT4UGS*k&?coZU=S<Ffg%Xt#5}eezHW6YmN8wvj;Wa0`&-Q
zR28!FW+)AZ`QZ&79DjLMVO@3knyhWqDco}TDO57}#KuG541CUV3Ay>{TV1oKa2O%Q
z0W*GzkqpR-4uj?Bu`T45(<@roXb#}Dwkxk!JRKxhLS#U87u&0`!3#uVq@ABfvkxu1
zFX1Ch9%D5Jc4@MPg?;`^qaGymPt4zs;#S^rDW&2aK#p398T(B4{b71YWz$`icz&{N
z>L2=*q51c|$B##oYJkd6n`$?N{v?Y`2vGXvg?&!TS^seQb<#)a4AO_#v!4s%p)0<)
z*f7;YBApKf;#=tG`QkV2+@&U#4;5)~PD;yL9=0q6#o1%jI=y}OZRvo4r|$-(PxY@S
z{x6%dxbrf7Epm0|Y`wnp+1c38_q`}}ETALq@An2ecV8sCznb2FQaAc|E}=+UEtaPO
z7DEv-oMofD^#`?a#o^MMDJ+}L@ZSWq10N8A7~=HyC;|hx7p?02Y=t4zs727o_>G6E
zP~0z`d7++n__lxeKc7;!Ji1czIGpWxSNU#Uelm@*I{N+WR^7%@!4})E^NMkH95zK%
zHf*vREKf+tc$SEAP`vRt68X*N=?ytLKKOH04EV1+@!$VriTYo?1+I%^d-h05crSm%
z4C|W<)v3^-j?<A(DhB@5^b_h6OB}@GUqn{pph^?o4JrngO2zzHdVBlo*$Kk*@grTd
zx=atAEQRj=Txt5UKe2KQtG}r-O8pk$Wq4RVa(qHHxjl0+Lq993<L&)fk0s`Tg{xD%
z1<R)gqImhJWF)Q8Jc9S|^CIrawBGTrNtGd@xgKZpDty=KH{HbvYwO-$Hb3H^a=v$)
z_=NAKuAHdV|Nh?({4oD*;$Mmm|J_CHe?TkV<*Haufh-?HNI_>nT9PgWN>>BO<-Rjw
z<TGsH+yZixE{7$2+u2vhxJ#>a{Wn5^X7BCw&?GTOdqE-mb)V^;TlnL12)>6E@0X2*
z_p<yY-cbL?rkInIJAT~$=Nj;^_Tla45;1&iC&e}^bcu}~=svCA1!D`{lt6N~DLYKO
z;s}`4v{Tkc*>8}zDNp&wqJwP4kS6C`PYuZK@~?PQ#Q-GJyA)it$1>plfP@V`(&-5>
zLVH>J3w@v5d3`jfk2Lw-tXdy8dW?`2B4B?THckb2h_?6kCGzwIojg)3IT1o{fQpvJ
zJax=a=#<#>LbW$ggSH@IzcMrBY61m|Bv8-DC_O@FVWFL>^t`#NPCJ^xnWrmn4S?px
zzWM-Wa=57hE#1ZhLHLo=Ol|NQJVor~q;b$>^B1?k3nHM_2=x?zkLKkur9cm|`6h0a
z&FdE71{R(^-gV?;%qY<9#pPUN<38oorRuJqkcyXYKhh7l#(Y4VitF%n1PAQl35pP&
zYX1mm#$shKpVa>C+-z=_X!+3TR9j7Y@>uD(U`i}CHNv!AXtswfINlAF<;M8()_m4;
zr)LQryyL}iA=i$lVP+p#&xr;+V<ggiuDL_Rk(cdKAcIfUi6ue1YF;~4s(g#u)dD?2
zz^tgWXE96f51GFL_QV!|M&zT=H%bxtt!kzpk^bUsBc5p?zm?XX0W0}*g<1=zuS2h4
zQj^;-E*)Ln0;%|8s{FiJ+v;^j8Q{r-V07TFc*noOzU;yfk`~}TmN@2*@uDtcQzxWA
z%O0Z!bA{0l((v~u;6ZqP``u^2Y&#&bzXarZYNAyLO#-}5{ZPQh+9nSUR`DfwxW-)9
z-O5ISI=UZ|C?}_h(5^ny60z85g51^#e6DQ%AOO5bcye30L4&bgc;@EaT5V4=#~#N%
z{Xy=+dXZ%@z(k@jO0Dw)I{S6)PJ95oCb&^lDj6tTWPiC)KST)6032g~kJB8Kmb`EN
z*!=|HMIr^`g)P0So~lu+C5flM*zYMt0fzi!m9KJ7`xVgDHaE{O$MqlfcvQX)fq$V`
zl8)&k6t@u#n(bP{7jH-R7cS;hX@SiI94Z8oxdP6@KP2!{dRcVoaa~)&JZUD%ZtR56
z=k1gdEj~+(A(?;PepFtre%fu)=X_vPaV{IvXVe|osLGb|X<=zYs2e;C5C}Wm;Ps^C
z`WRzvRtLhbv)pa<nSI)@y5)&*Og#B-@9Kg)eON;BYP-PNV`ET(&6rJGrO;hG_<$Q=
zKjTT@t3FfxA_4Iz-lD4COHU;sToo<O=1`s9^#WUKcC-$Pr^)`k@9wVR)ZT&deC~F_
zOlQU#nZmQiXE(ieQf5TGuNaB-0J1HWZ`p`mAZfIO$!&l<?0!@{t+Se0CD22tOx;+a
zImAjbv3Vy=n1^IicEAVsb~6LtZ#Pp*N(FbyaPhHD=WqmxflK!LxB7ob^v$aC1Lv4b
z+w_76eumjX6VC^?o;5I{BeLgQwhE|{_DTniMH=4tRYdzoRUUb|g(ES+{t;i2OovV;
zDwQhXmqkGgOOTkJSed6GU1&|HYM>sq;~L$PgxYfO{+IcgQs&x%_7$FU-9K-tl)M!g
z4g#*!*@{Y1#}N5-D5Fr_(yY19f<N}4FH|U^Rmxf+nnvhA33ay0FdJ8-;R!g8<+gZF
zO7C0cb-b(tU>qaI^{{;2{+)7Nu*1}hA?1<hfDd1+oEz0zI|z~vu=*?J!tTJ{RxHMx
z%o%+vwMqEHZ=<;02vB8}Tc62a{#Ii+MX5HIm7{lS_y}11jUWE*SvRzE+cWYAyix_+
zWuKPzBWg=_)LU9`<8UK^VK%q51QG13Ds=+NIqYz7GSR3kXBuwRWYhLVTOYK1?zs{z
zUL#a%)N+j7)$#SFzqWFH?0Uk6$kn~u@SE1H2BFTl&08|&_vGZjU}iGRp~#>-TKE*a
z^nBn2NqL)N-+(vZ-cw^dHl0~ok?95x>HCM(OEQp1fmwF9(+mo>;<kVTi3^8GNMDSk
z!6|3%9_!a3+mmaUT+KvD&)+*pWHo_;%&mT)if*LHR$FT#$H^2E*FFT4pj_u~Q(Z*-
zh$W)|3}M2ZOf)LF!a4<iA{{~g!&R3N+-^kE!AWO?^gDLS^A^FMXk1J6WJcpByUSiz
zNf=4#*&|lLjX#t}dS8}bpfxkG5xW@)3u`yKPuGr14?5ClLoZ&Y-KmzlhIN%LCoF)1
zH#Bm!LU+Sg!I^(feh(3|4}C`Bi=?0Ckn_to)JYeicMSnbjIJ5S>W0pqS=PzvRteoL
z_nFaaw0q%-F=!%?78t)>ZcP76%GMVs?8WHEckih$`(Gd6O{HIbw*~sxAKsYwE>!{c
z3tHJ_`4f!W*Q+YV*B_<M0YuGJb7i_2iXQ8N<o_9~ytwv5bw^>J#rbv#!s~n_psv1>
zQe7=3|7SU>e|tGcMYq_IP7BFgqX4VpCw~5}u#zpvvoq!KH%RMGcDanKue2&PGTU)v
z?txrt@ONf7aS!u>dE?|`r`ffbjUY_i>SEWb3t*Y>c-)5<lu=m(?tdr!jY!Z~;+-mk
z?axQaxsR6~oJIrS-YFx33jFIK4lP?0Q_fo4zRmHwJ8~5N<3~?_Kgw!_k^J2-m~s(T
zV9;mBc@k;PxtLj^&z;Rdl{BYnq?g8cDFLGfTn|JgFL?DT3gH@_$11H`Z2sr4^UfbP
z;C=9)p+Mi2sOt<MT2yhQ2k&howw-cScl&@Ga?ZZar)LEpgS|u>AvJC+m3#axI?Zo)
z)?D5%*7ct0`z&I>w;f;Y-)~h#(D^2?hgREbI-n0YZmvr!Th97sn6HysGDEKb8UE7*
zmbvqWw+<`L|M?iSXZ^GOqMxTEw@zUH<$d9E<yjBJ)Q};AYsSMxjI3vkwJ**4oAs{1
z#j{ak((8m4FBqoc<^gI6MUNGf4u6d8Zoi29Tod#P=HhDu{+?)c`Z3Nbsi?tzeNZSo
z{Dkr{|397G{+FZi-(<S~*S~9NsNMUEz+8*tvg096LZ}~~U5;H$Z+Q2Q_o`~Z(@k2)
z@vU)3=3ux<tEc}};3r21@~%e~cQ{gx7wG%b)7YtJrQXUN`fkwe%`xwnD+BU*l-hli
zL9EZ2SHaEY@l?x=!|xTzzfQ;ec<`R~t;}yZ9Nyd4NEy%9kR^jmGQ0?A^eFe4qSGR)
z86lYS<-P?#AdnW?RgwgpXfSSfeC%6~CTD$hO&Ifvu2Nft_jSAGM<bgW0i!lJDS2_I
zFD0vXP^?IzYxrXyrJou2=mFoy`N=Cokx#L_xr*(7jUkE-$kk|B&h+N*e>54%V{tit
zijV)j6rem?I*J@{;CiSRONkd7+0UkJ+--kWb*|0H3&b3u7F@b<OBHj0y1737pk^uq
z!r9*kRVA+#nkF0w@1lh(Tv#?QGp-7y>+xyXn-J9dT-P>N1`6onmc4~E_ubnD|Hj1f
z+XjFB^!05o#3NZdBKOIWV)ef=A5+}d1{%@s0L9IeyicBfv=GIQmgDs#PWAiOr^SEc
zcl@tc5G)e;1a7rEgSeIBU2o<1rhlr98#<%kuif+?d!pG)arKJ%QR8!d{)|h!n!Mgg
z{gRmF5|qh`T(>mHXH8;V&CuWY8}#LsN>v>evdW1RwvG|ng1i=&CO42L;Qv4}<)Ezq
zsrhGE^lt+w?)(2{dVvp{oD9s(&Id-kmr^9z)W#Fj^I5Q7q_;e#^&W%2COUSaQv7Zx
zXU_lhrSSjp?(zRN`M-%^6na#VtnkcfX&Yh<IT65To|4{=-s@;_yapXA=+{vDR&He4
zdr9SU`~mNo?{R=mrRXEbo$?Z0j-%Rco;8(KSM#jLSr3git-hIf0<`LwzW4Dd+ROtk
zvOLRwWM;JNu8K6}Cap%TNa>k*PV|Q!%PASrzZdwE%|^THWd&psD6j0C>{}Wc&{1j*
zyp@31GpT<;t_p0cWKuC0XoVdF5+&-3^7bWYK<hgx_0mr9nPv)<zC#x_qdB(@L{vj~
z4fTy;&30A2MpcMAWQK#}QAwMDDta@benesrw`B)%dL09U>T^<D$s*+`?^5fp>)#Uj
z_qTUpK=lFWiLiU$Cs7d;=xH{>)dH0}k<}0u4kUh`18LrV3lt9;Sa3f-x#{<R(dTeE
zBMX$RCdvZ?m%Gi3v$iPb*bImwK^w7pP>JjkFX4d3cRf0Td$qp_a)aBizen-*x2(^<
zjtXfMJms_Jg`8Q%g|3)dg{p}G7E}NL#kmF^F+3+Jma1C2jlfn5(kH85#?6kFMp*E>
z%X>x|Snb)Qas(jW@<r<}yku|`G78MipWSvJpvYhV4DGv7tZ!Mv<J}H+ZeuePxud)#
zv!*gX2jskfZZ!63cgwt{cul{_7fO`{z2(aUOOtepTb!{%fl%cO4)w8;Dis%CJI7M-
zD`E>lPPv04@lp`W66;BgkrdHDeV~^ut=k(&USH?Rr7jYQ+(R1`+9b@B)G6Sk0EwON
zGk?856aY%Wwt?_~vSH!$Jb=A$^;S4voM*T%3Ec<pZZr9mSdZDbr1trxkycq57%IV@
z4baZ~+-UY2Kfd+R=X?ZQ`EX=KHqi4+8L#vj4z7B*4JeFMW*=P_C56VWq*oq*VZIec
z*GJD?3~NHJ1SiAM39xvHXrS7xCJkuGQq&F9OgbgT?RaGSgHYwCa7-kOt4(VizUvUw
zAxlnbrRma@ARitSzW3w=r3HleCHnQ|<6^?e^_Vy@b(Opx)<U$m#smth2!EDG?<Omh
z3+v}r^Toa@Cw=hYa<jXCg(v*aAV~7%Hz5_WjhB)|g+SgMF<hM(bkC8X^kRFG5KH6?
z4E=EejafBmq)Hfxce`v<{CWu3FEV#3wuB!RDgoCoSO=0ZS>;<^I92!sgexT_4K$_^
zp*VGJ^E!{oLt&JPE&zx*GqDrbI)g$E)dKJJ+V4R&7@Z9H{7MFL-ahZhW|H%E3(R&X
zFbE3w2ktafpgNWiG^T-4p;k-qP8U;*q6jcF0fHQ~hoBj;Swk{235e`U6k&0%eF^n#
zdxAQT1K}4(?JsCUHoC%53FXQ{6I+|Iy^F3Wn^Jwx;g3)Ty2IpI+T-(?8H-j%AtQ&t
zM&(lt9%>GOvMwJ`!(^qms{7DD5Pey6TbVYS>d~=yp*j#57@21RkPuqT=qKPQaOpwW
z1C8@WmcvA!bl>|MKlU*LhY#E<lphP9h~Ury657P%WO-EuK^lhhZ{JW!X<6)UmW^Z6
z+xB2j8!8O}kBA{%UBnT|!}Q6f%Qxe8;N&;vWbzMC5{JS83nMcdBhIOBxj9W4&n@jD
z`o@eGzEuDReIUrnYs$Xk7^Otx6w?F#LnaEDBe<_NhS#LocEd?@i&jmBFDBu|{4*iw
zc+2#o{Q_9W4UI|_tU;T;TLKc($55uIAyf4QJqD|m1K^Y+6E~)9p2bL?xKzwfGpIv4
zP|ng*|F)X#fDoHnVosH)dX$C-n_Nv04{m=-R4fF2F~AV5RQ*cluhN~i8;;mX85=lK
zb2x3n&3bV`p4Q#!7ZBe;hf463?>ALKlM8T5Jk7dBn!9LBpvp2%_ty+opMDAb1E@G~
zUBwa))92TU00=XLf`B@LPPRRpuS^t&Ps@GF=W2Sq(b?N#c4<vEX}4(T4yzsg*C|R1
z3AD>{I(bt{5zHAW+ocLKAU$1jw!mIX#+xNgREAU*`O}B<!6l2t2xbT-bt6Ybhf2IR
za`W|I2`M;AwD%yPwli;L47)_NcJcl7HB0)7&jh;GZw7&$wBrLJc&bCR!8~I*Kf_tc
zo&$hl_IiKNAGV_IgxX}pSVsKlGj0WT0^2d{wy15Tu4vfFLjj4)Ocyq-B~ha}W;JH@
zyuX%qX)@BUbk0UI;FmyL&nXHzS!rOWgBwp@)=IfTmzOM+EE@R!)ev4yt_GL|$k9*-
zq%qxA6kMvc0JF1I$*m+|F^7?1))z(-OE}NvH)=^qcWUU~tUC3ZAAv?1Wqt6nm%Zyu
z?1=#PKyQI^O6An?dT4%d#(7QIxy+@sIdbeBDtBP$W&m2gb0&urycvoBz=#ly^q<3j
zLN)!qt`Hr^>yzJ}jdUgQD*ZmUJ+P-T|G4x*zcE+mUy(=h&l0Y<#~d==JV__`8;*tb
zp^dZ!9b~p~h<nBJYEfwKotYGJzCmq%(DUcDFseU&*6ik?0I*W`IAoT``T}$3&ThyK
z_I%jDYL$Ry=HuVDC^77bgiiAboAu5&IPQcy#opQXEraeRGw*t1W_7Wi%%P-VcqK(j
zh1WULK0$qg2JL`9;CyV8>FwTZkfB+4`j4Ge>8ZriTIp(z_9ln!l4bQ}mhA14JfE*n
zpO*gFdzzkURxx;sCk^g<l0s>YQvLr|NOjV*+vs(tu+!3F=*U%eTT-Rde9M{ZwE`9T
z-ZjB%fD;2d8%tuUS|S>$OR&nDciaq=N?Ii;=idTp@{iRtKA<=(<I1-yD5m1o_`wnQ
z!IMkIm6}EBm*%Z}2e0*nk>Kr#>kTr&9ejtl38X|ftIy1U2jskj`M1{quq)LkZ*$3%
zLpwLT7*qfmEkeC`+Iq`TS00`Ccs2+WG5aRGu1nr&3_J{3X1=1PVq74{sz{&ly8&y~
z=B#SzOI{r0G}fbAir^5D_z0`kL5Hki%g_{@ns0YDB~8ukcr)wbAAZtWn%9zw!aiM_
zMOYo0k{(RisQwKH(dQ_AYI_r6{okRN|HH?iIvlXP9-nWRqXL+S4ksp}ft=MuRq*kw
zLB=lg<qH{?7l&U4+p;ui2j_pr_<xeQu0w5V-VlneibEe?*<cMYpH{AUijVuKTk5|>
z?JtX!^!OtH#x~8y)?geDuu&tfQ+$^apcRQ7%+si!3!K;>lY&`nLr2nIViBEtxmVGR
zmdCWqv*bYm%76WS{_aTh*MKJ}Fp5TaCH?2$aAsXPe9IzRR+3Q^SY^=@1A1^n%m&rb
z*2pgxis3-ZBScTk=a_;iy{1>-GvN+?ESK-DC&u9?m)(*tS$?=fWuJM~SY;}=sBUe@
zU3rvvRy!RZ-imIu)V9D%Gw`u~vb-6DQb}kY7IiFEw{*?FG<xRagUTCwlEz+>u(7G_
z^JkvtjbOqKy`WrrQw!+mJ1g!fY$g43BjIX#5TNA;+^|pQWiA`^LBzrZg|aFi-5ke`
zl>eA{_fiHw^v2wG3HT(+`P=ztqPnCc8?o8>bBkD5`^$uad+PrWaqk_}RQUc2qM#sE
z1*8*|rXV6+X;G0TQWWVWA|M^4NraFf2uPQ%AVj3sfOLd}UInB}KzgqUB?MC3<L}Ph
zow@U!-Mzazd;en095Qmwd7t-vKF_Dj^t#QtG^hM@$o){{UfDJu_xXkP2BaBNH`KvK
zG{JnQ2Zm-BwZu}q{PNV&F3_{Ax|G-6M>R%92imEY?1QNna!6M2esC3i%iKjXvH|`{
zs+#0v&1a9?>InVjdc=2iI<INeXMV{GBJX3sZ@YHA?gN=)9#T^^h<T*vJdlV9{Li|h
zkC05=g`1jPtDSqy!zcZG2JAHVFL(6wl_vZYHtK$<0Y8GV5#ND35utE;;%9%4+BCJB
z!*237v#qw{EDJB|T=MBP><AMpY(=#rV->;Ni1`xaWfjS6vM6pad%-hQkSEpD9bxjm
zowK97RV?%Vt?$}VXsbJ2KU-2|WX>ytt<=<r1$vZJus!(l=Iq7u6KrRR-m1#lvs2Q2
zm3gsoOEaahf<aES2U>(eN(ovPK7y=%0;zP|PAk#*W~t>Pl2ubat*jx`>zU+V3#CHK
z+(S~lKfSf$per)`OY;b5xLbjcKL^`+ooW^*7i>Y4$4gJy4sXblx`!*RqQ-S5Bn3tO
zFzC!u$nr}301~Gm^<Gq!s~ZD4vOl=(cXRYXWx@&Kwq%`RY*O!K<%hCcJg7gt4p9tQ
zZ)ddlUCcknoh{@MPWpA`J_wk?0?}FVpv&88H=qZE`^3x=-Ey(erN*QuS#K>gYu#lw
z+;-g)khfpDZ{myY#t6~ec@4IM-z4g`pzjg=QAEh1d%BAtXH$(&VY`r$!~?cH9Z5b3
zmONVfi%`^BKlOr_F!C~xY6J*HIJU>*kRn-ig(tDy14S;ExRc{eOzh$bdhjmz9QY!5
z!GhWYVkbY~&ob_uNIta^=2!e&+&Fa>y(ucW69ce_S`CPzirdk+e!@3ABHj~z(|J;n
z%8MJwD}KP?FJq~QMLGEJ@mv=-D}7xrRPghHfW!pC-SeG42B#0XLIf>#Z#OJbAP)f}
zXR)XtrNG+MYw`tYS52N)8_*SZsCb9B3cz1*jbY}~Fx6Vy-GKA<P{8sWhl;=LH)y=g
zL_uTv_=vNI$pnL4)VckI*x$>M+%G`QHr9AjC;A?+Doe-+T=zTl`SrS53=5fmr1N&w
z+cR-DVn=T_{`egJa5qla5_;i)k8Z*Ljv?E+-9khRc)^w|k3+_j6FdQWib8^I(TUwv
zv1#`a_ojm`vd;iq8c+n)_;-0?jR=v^gj<xvBWF2Xr(OH1iJECgr`)%a`yPZL&=6-?
z#j|oFHi?kn6mihu93cvyhuj__i4m&+=<_d)CWPMUZ2#k#Dd~aATczIvcM_I{%HR-0
zD+l`Gr$dM!88M#pvtg`2?|hfm3c0>^W>&#KSbK+IsPt8^S`wfF2~nr^wYMZW@%|dG
zG2oc#n05THjQ;Eq)*teu#G{Ph=5db^-_U)ow;x0UTx?8+64Pw)>fK179PC(Fd#Qi~
z#?tK%`bOldoYQn2ecWPBeAqorV|6-gxzB{YBPHCbe84`W{9!3pS5~^km{vFu@JTtT
z1HQ^iN2~)g-M?tssVr|-(Cb*Xsb=SO;9~J!Q$%Py<<k-+={^Vru3OvTDue$-R>h%~
zFpPA9LSyAGM&ufV4L4W@e!Y?9RFRImvFt~8(dzcR>2>sF%16vR62zvaMwS@CI2m9I
z495Ymq@eq0^S;Pnw$EkDY2`Z+G8)(WcH57Uu<PLr>?<N@66FWjkwu-5P05l+L}Y<d
z@4_B9s92PztX&ie>^I!J{z^qEgRjXpp3#iGMgD}IbOk<_b(4}*!$C;{y9Dv>=?%*%
zhu7BqNEPL3lukJ2UW+cBXn484k!lPU`xN#tIIyk-@!PTs0^Gs*Z+3<_)qIpEE<&%m
ze(c4ML{pLqN;NyuEiXa);E7S+<8Zo^`<7zD)DP4@Xm%oE5jCZ?s7%(Zw49b?*J>Us
z-QVHUD6*XHkraNI3u`l>p-s8hO6LVJ*+@@CmTuIhcP01;?8F}Gs5ap$pm|Zo%yBUd
z%%!;(wderfLlBwsV5tJP)-pw9b&~ODzzh6I4)_v1ltN?Y#~~aSdo$E){SC9XU~SGr
zBaD=W|2hWM6gi+dxe0p;P(r&XVQ_Zph#DQ<vjZ7(8q}3nfOWZ<w^7mVCtrBE^YVa~
z5O-ASqS^S{?%6$?N)i+(cG58R`S=K45I`w)fH1f!g<~is0(rZct|DEzHX}|Bo?ur`
z-~HuB&mJ&EtbHv8_5jRIY$?1C{QZ2&w^p23S3q^`@Sn{pR~a)M*X)^~?<T1?sZ*7I
zX}qsW$C6&Rdb2Xfp8^YkZkm{ak5~e?DDOpsdE^Vm_h4G(5cC)H^Vgl8w&#1^KfUFG
zxsmBW>m^3Rj5k;G-VRE`wYLJ<aja^5P@{#T?DHVz4HKo8mwrXxz06Nl_OTw|c=msK
zQ28GL_y6?o;^Q}|b%ZLj*^a8|86hoU4_b+w7?}!{i$G??%YT^>^aB{?@?G>5Vw>l?
z)8*1r`>lVG5%$8LB_I5eOp@LbX}D*za&P{H>4@<v1d!qYI<Zz<_muAmwY7XBv1~Ub
z;I6A{&)b+aQrWT9i)F#jXXC>_K*4=MwA)Gh6%=YU>fkDA(u13rtiWGi0xtS^@G)SS
z_o%XDdh~S6A8XSr0+evS1B|cNFUm}F(sV(AXWDXr`@c@%f65*Q@ptn7C13~NIOQc<
z03-RN{HAX1anMORB{yT2>PIXp?x}!}rG4*t9r_%G?3k=fE@^;N;;pOzf6+~Nt0-Xc
zwqBtn9@5H1KN_{K3el<`^@w?rTMj?22^5QvSC$x1_~X9J@*c8c10ks!_!N+(CXQ59
z$r&Y3f#GgLO^H;_89oEMNmSayYM~n*#>4VVJGU3i&)fhq;r^%{d6rGMy-4Umtr)eU
zRVfAV+t4BNVStT))6ndvX>bRPPB%W#6#W2qOu$yo)KYI{2p^k*Nvg({de%%#Jch6u
z;rMk>2bw32!qVBe`1B-wpQ*$(`W_<?0%g;%1&M>;qNy{D=YF`}T;%bS5B882zaz%K
zw8wiG{|;P>{D30csPV%rDuTc!Z|Sb(QAIa44A`Ec-q^n~hq=J_>9_X&xq_5S-p=sm
ze}N1*`glD{1-HJ4wu^IG)?Tf<r)Ahe(R3Y!NiHU4yOmGBYY{DB563jK^Vi83+VqvM
z0|QO*uKfY%rpDVUPaWA~YuAmhKo%USr>&_Dkf+#7`r9|_YjfD*!4BaLz<TM&J_M)>
zl7f<+e86`#KUfMOoGk;q_YZX6ejt;}Yt{h+mIpDCc~eVYMf1_Tvxn-EKTUBZGJuD_
z96?6DvqJQC{kFsh6R2eX(0>;IlBY-E`^<NkV<dWjfo<e1dqtB_Z$;q%Kz`)cFLbM0
zd<8y|q0l6`SVnS}f@IN%HlN)eoPHLZTg-oF5$*Y`ZywdNHQNjZr~o}zOk;cI*^Mk&
zC!5)=en>~#^pzJ#EV8iyJ-Xb73m*>4-R+_F=5}{IpF*^3%%?XM^6$}Hi{M;L2i~N$
z5eLT@&sfakNfsOG*1am`<~Bf#pbWU>=if^JtngXy(jAv$o{#JtSsL*L>i}l*n~DkC
zIy~5|k!Ia?wOcw*-KF#=f!sQ!!&@icd>y8eU8EeIFZh))ZavPpbs@&Tw8ZsuSw4GP
z2j?Lw8?`NYr2I1OpD8_F((@rwH?sol8#s|%d9y?|=}!NO{y&@o(E2K1t3mcnq~#ZD
z&E9AcTtm&PrfMGbUfMjbE0eO*^?;{*esk!3{5f=qC&BWgq8<Nnk?#yh<&8p)4flsY
zrHm}O`0MovfaU#>0Tc17c8Mdj-QRBZyNc05M2(NXeS>=M*?JAfuu#p{i{&2jS2Dg7
z=UItZ9;$t8s0k;~^0&yO<Kr(u-?+;d3BRa*lw_?H1~U}x%mha9F_Q>CR{%=937lrF
zq7GMzcApm*aIyk9g*GeO5<XfJyK)VoLJrDNBLJy5e`HPOVMdP1q{y*1w;$@EY^)hl
z>KS{sksjMOxw2=|#<i^P0mnpd!JD|2OpDDiSo;^ogB_3=kp5<>+2_x>bNZ?PFw~@f
zctI$^2KH@1k}WsehPxP+G;^}DlzQdn)pjX5Q_qF?%QZ<%x}l$jP%i5#PZvC^J$_Vk
zd*m|iH`pa|N%#D)*7MhVTEr(Pul>ATpTg!mDHrJOF|-3n5Mq}7QG5+Gse>jVe%SWr
zH-bC>UqWB9Tz^@`$2zVq8@r{D6;#33GpJ$9Q?F)PIsGAr`H5<-nowVLnMIJyf_-d-
zY!AwH)K5asW0WRDyOneP*u-e+@iV{Hl5~?IuY7$J`^AQ3lN#rnB^|4+OV&3@_qKfj
zymmR&h-b&}li6~xMB=6XD<bzF@B<nq-LhvaM(t^dU0UfC_XIl_$<{c}j=2wM$m&0P
zVdXWVX}Tud(O-gAj|rt4Ca!-H&{C2=2xA1W9RTBhTyWd7WcekH(q{gSdJ+neZrK+W
zpNEkz*%Sb<cO-||Y%RC1-BSn~VbRyY93{UoCX9!Kvvhg7pXYgd)ik;Bd!<R=$G87f
zNs|VK<Ezx0xQYae{ejm3A8)k3lwbLHpi+`?Tz!0Rhy|Kxt@M<$l`_193?R4$e(+eh
z+~p6blFAkn_#-tLcB~PA4X8rq)w+7+9JLy=7<tP2mnjdoMM|c6?ms-ZwS0$b^^kMr
zc07-RSNP*oi&-a+1-5^znP6Z_@je@vQmpcS6nA=Qam+LPdF4w#cJvNVdHrkr>gvJQ
z=Gko$iZ<S0$Md<*YWK*`8*o(WMp&2DtgCV0)!P>P4#@@C@_7MQj^}MtmxM&Ni@$`I
z<XUa`Gk=%rQ!=qKYPx(OTSR+TVqL)KNzH`hhxtSqz;CG}$9m)YcP04VL~-0TgFlY9
zm1&h^)*{*hOv6<Gh6I2JwrJliqj+kBn$%tWZ?dG^#MuXO^sbBqPbO%jAHx;C&`7Sh
zz<+UqYED_H)}J)1gEG~7k0h0X6jri7@xPJJM3m_ktk*sDIN@OvXf*wm-WBay+-5um
zB$BQ{1lNyw^*{T@H5eA0Z*(#-R#f@fEtSbM$fgP7B&k%S5mIZD5&ZvrXbA35ZdB)A
znyGGjLezIS6&MNjmJr^l?dW^rb8Hy>+xsa0A_kU0ul@l={{<G2e*%XxH&d#NP^;e7
zf?32$kUwNp9wGZrBQ6g_UkBr41BkX-D}g@uK`((z+4-o_$K6aDixJ?=lp6TJ<l-^;
zk|buajkpt}qKh2tW29vNFTvi<qTdpo0dzU7bLazz4YFJ}mK)uXDzTXs+V`XTtNE`N
zY!;`yz%@0%H3c1z2+ZZA<zO4NFt}D=kd7DAz3s}MU#aq&D{xXK+p7L-iSaRZPBw|F
zKvI7Q7XUsu0jUFbZbiWMA6N?c*GpRx{bBcr5b&|Q<q?3NeN_j}s*}4K@H@a=aw031
z6QdUt+dF^xPG>%LlJ7khsg{xzuc`8Wc=mqJS2n;>;)AR^F$1r_wzqNRAAU9i{N7Z_
z={?jMgv!vqAjJ)JTs)3n!CwhO<W0}4Kc!3DoG`oe$0KRQB;h%G=od!n|GWX;|K;%&
zwI;|St4k>a&sQ{-<<~j0q82cWvsM~j?kcV-=Oxb%ZLbLMb2_+=^S$FfiG@?iPXLH1
z8OBs1)r!wUw7nQE-dMAA9@RI!osG5gh`)VBweunB7RTi?!f+KTpjW9-+({xS!r)0u
zsszk@CUmPrzPx75dh?k+p{`Ea%3AmQt(TDMS1S3djQS5+?$LnC8`)YRp>WRTcq3eQ
z@S%X<zUWMn`No^teTjgGIQgrj)n=I}fT<ElWwON6lDOt0LeTsVZugQ6%2b!5*rYu3
zAFAIJ%yRG0+WdwtCwc*mGM6<aqDda7-pR|7Tvs>C5h<K*=_@n6>HqrefQ+{03bb7K
zR@oOk(X<;<+r7<6dI_Hda}GtV;^{->_E?;v<+CDQc^q-1+`^i8Nw!>(k;01b!3JUs
z-5DEb#g0Z7o<KOR;sn#^yX1!_I};>C<_JvsSTDv7&6kQd61{`3oV(8q5W+8?A^rfm
z6k}pu`6s}2p8<bvEcQywi*a9)xml8j`7G0lA$)UhU*~Dd%Wj^RuG=W0IFN`nS1A@_
z)AQ<vr(8t+UqFZJ8Ky;jbQ2=K4ygd`KyapnO1#0&1(FIev=!&9G=4;`bjEgeeGSnS
z&@@oeHD9W$esNYOBuwP)jR;i@_z&1aV$i}|)Erw4Dnd}X#&STc!^FVxEw5KcbnI{<
z>x5>z=I_1=dcg8N0z995XJZ)Nk;NK#>+PtG%Z^VR`ZeaWW)Qgo87`3xH1Hqc!|DDl
zps6aG+UjOAnCX(4!|>sU2b8_NNr&;4UAl{v*BUP{+Y!TH{WugsgVKbs7n_9LB*_ye
z+p@%PYGvM&cPxmpw_j$>n%>X1{+K`RU0gi<>c+G>clY(WCIBU)TP8-}9T%%Xd|;1w
z{%PXY(<%prM%GW|jaDwP4cA{KT&J{b{_4KG=V7DOf1U<F73jh#Sx0PP$g@XmQCXrj
zB!x=+btezW;VuEWk{4~izZ@QXUjAqo5-xiPB)8AkU@n3y;S5lTg^tVH$d1#|S?#a;
zgj0KAnS_ninMd$q3BnuhmvxbnJHs!dL>NDO6)!Gqp<$(={fYvh3p)ZMr4sClj9TmT
zfrhrG`-fL+qz|cADF#G6PIZ^Kn>x?L!?klc7X7O0hC-OtyTmicVgU3cLFU61w16U%
zJR{Mdb;VOMuRu&)ooRq^>7=B;ita5^UZTu$q(HFn;aPO&s9dwGMrHJq;nIbQsyaTq
zkXiXCVZo>mG_>myQA8uIP6ieFyjFayuOHt2aj!omWVH6n!^%saV*7-@d_DKhkoNNV
z`*f!wG;lAVNSVGE6Qx9|yd<bgtG~@v?WTB>VB+BYYmW_xBFsv@kV>)8tbRe?$@Cvq
zOQ<hWt51=LTVe}Qq?|=?`yLb71Sj|dx73x2aT`|AaF)y*gPotc+F~y(P#(b?8&g7~
zbsZyy=A`yu>f*QGpYDZ$UtxHOMjcf8@p6k*Cdj3{pGMPt>m2>xIk4r%#+GiKd`@=U
z%ZBu$5Zp61tgJqfmZac1F_Bin7DaYtZd6NP05?-kw;SsPT0*V}D?YdugSd!d{fAh=
zhXNwnhTa84bQ-W*P%_Mj337^8)|Xh*jVo;3^aI}h+}D<FRp&W<j*9@SxfVg4$f#d1
zH%g<5kLOaE=0GxbUFl`xhF7t|a%B3W=wsRvb$;FEhPR+wd`Bby`FVe36C=LG0|6AB
z2o7R@D}?Q6WgJ*T$I-Us_bUvzrf!?B#E72QJxW>&dGP6Ti$w1R@*VJkl_Afe1&Kch
z_7iH7o3#m+P*kgoxqR$tp?O}^=B|XZr2PvSe8NpXqhsp_+~*GF(KM8BgePKZXmRfY
zRT9RDA9{aO)MRvPf71k;@FPxQPRS(WxZ>@tGo~+%M_#uJJG$Oci^nq&9#Mc@&b6dj
z_A#YY#eZS%0+C)X(_>{sMLbD);QD#K&*dD!t!Bkl{nzt#E+u^l_6JqacS@SJVsHi+
z254x9j%fB<&aUhNr_^opye7Lqam)LkmxD<k&tz5>2+*Jg=ZNCx<4du`oCU2`(JwB7
za`;R2lk$;ghLDI7{nXUT7~eRMsP+<V%;oz$o$w(TD^4o>s7y<DLPh#TEr=B@*y0<1
z!8|58<r`(@c)3>h%GF|7`=o|AK4Gda>?tJ#>@gRGtPVo%NR<*J7RUjF1b;if0&_~q
z^FRrQ(a$!ss<E~W$x3@}bw4}fY32jDhX?@(6A1eRBo}Up0jtNw?}_Z#`~eTGjrNaG
z(xMmA!loA<!g!m5hZfquv7FU@Af5J|q&Q`M<{9IvnhdL!3l22ZzUaA4$%W=vQ$AAZ
zE&qIji3I2MiaS(A=4JRMNcR6w?h{RD52sx<<++Q>g6Yf~5G5cV<Xp?H&vj#1s$Vr~
z#{4lW|5|q`oLf{OwM)a~@I`~b1N!uT?!sB1%7Qqs{U5fjV+i|^wX!)L93xe>92l$Q
zyvx2l(X*o1>%+{pDp&Q`a^-4lftLy!|2A0bf5!6UKVDmI*)1rCTWd$sZ>g!^gRsBX
z8_(s|)%hsmG#FFeShu~xp7vj+S)N>`-xdQzrcA^-k|BJwaV;2T>S=4YaI<<x^DoVl
znsAo7J12@4Pc8^g$A2>6deKcI>n%MJ40gHk4b4rd#CQxvAif)?WJSwo5DU63+AiFZ
z({<dR?tk@Lv_8%C<Y_A1RmQ<>2IH1jhHMR6t8<a5bznxa9a|TLRWwL^#jXmkTKyuC
z(6SSL^xQAd`}Lnbua;g^IDnV~MamMUH~$%Z!#V3B&NHGc_56>}_Ji)%e$KY7e(HRE
z^SX6JL2aap8_RzDW1tj3sgodJ1mPCXNc=;UAo@K1UW+4P%}XaP$Y?+(b)>WIT}#*T
zs^pXnZ=D<Yapx|^PPqo!%)5&zGj)7rXOpJlRvn~jFcPR+;<{z#>6QnmelFR^J-P;{
zevFgj7_Kh!RziTeR1I?H97zY>&TCwogu@PLPLTQd2ML}f)7Dm28m_Xi%F>TBZ9m+X
zl^NV>1sG1CkWz##A{trk*o_M7#rrS$6+|2kh(WBeBIOC5ek{FFH-+PL%AXwk%(g1r
z4>_n?6{BO6{%v5VECy{h+HFK6ZSRJJ*+Bp7O^%V^QRKUn9E9f{_Fw_E^RyT~h`4Yl
z#R%=&)cut7q^|Bey1t1C5Qe;-Nok6u>*Zm&Npn5^(?{9(iTHOr_&&&)2R<Zq7FH=P
z0|{*$F-Xkv?o|it1X(K`A(di(PY30DXS~m^E-9$O|C4j~fB1~;@2`J2-@_Jf=+|@K
z8V>QM5xIDFqK;HTjc*;7yPIs&ealzWPhH!r4a)&h>$2%ObGFqJ3mP0o7ynDQrIYaV
z^P)}ZIoijh%fnAD3wg6TA2R&M*ZF_QzKOFjoLrQOYC&Mtjd+$_0Pzu|PBy5`6>nr5
zr5ulqB5<vr=Bxo^J_pu8n}~M&7f)`H845FQHpeG#s#WC2#d@Bz1;n}X>CL(GM>Dmc
z?Lh`|$*be`Q8RPP0h*s~q2Ls#V)xDEIwGX>Q!h>16h&No<XP;nIsAIrg&W%BS>Szh
z+8B0$a5TB{x14vT8g0ZLk)+Eu{FSUnHLe4GsV!cRLC|&;$<PH<RnXyi+1iX4pa+}%
z=`D1Xb0y++kn15m;QAL*;4<VOYYmfaisj%}R{DZiO6k=69$LA#R3Tl)lvi}>mFqJ4
z`>_{N^4-j*`6#jmrTObGH#nGR0KtvivdHYj%4OVj@60Ik04&7L-JNW*7a1l?%x_?-
zh0i^ww~E12u$@F%9M_^_muFP!90ygjg-}a4h)lfT{U&B@5|rm@!4Hh2THpCOiS5*a
zoz%G3{VgzU1AI@DK{eb!1u)u=dDS$u2<bFnB#Vybjj23^rY1hj4f8&87gcoVuCDzH
zCU~xvPT|fWf6(|}nl00VBfRa=9JZbCxe4d+Wl%0t=CJ#^#6`vs*<bM%>Be7x?8z8S
z>&H2S3bk)(RL0~9E{N?f6)Dj&rvgEk%g;Ni?WU8Ev%oMIICgTEn`(^ZMeB^sF#%b_
z6ElG?5?xbp{@dNS?$!VibS&j#{B^NCo~T3}!9_HPQieXe0bxp&iUzUy6zJt6)vU{o
zqY?v{1D=&ckhDt$9k@vO@l!*Wi4L#j1ynq=`06)82VGb9B0*QkLO7IOkXA=s<#c0_
zgXxP4LNzYb9tiK`VnnNDkgHMJ&-$9!_qkub+@LXCMt17>fw7i^^f47q=AT%#B>$S6
zXK$ZYXCW<aOnUx#Wk$~DA{3s!f)K@hoa;cgznUaOQO<l99b?VI)v_xgrZ5&t1DcoY
z@WsiZI>Ff@nv8xF;d(jnMbefT{4ym&jT36A8T~|0z`Uul>C0su&|_i}A%c?XDJR9f
zAt+DOaKTw=i1%La(q5n1iEB&74J~Rc_=xKTD!|*I@$HM_`gslq)Acjjq_2JhFe7{*
zp#n$W=I`p`$1;(_(-N!z0pEB11@pl>LWq8(TeWqIX6dR%JvS8j`HNA+$<?{-43Zk6
zjWkvOM6q=SPP^ti3&lpZkXf~G<D=y(yH&SL%=Ou@9jCPS|GmMp-7?cIvuufcoOij-
zfjm^bEjdp)aR@>*(E)#;4cXQu+U!iOy}xs-V3bFG$@DJ`4V)8@z&Z`&TraY2<^ZCr
z`sP0H3Ko%s$nGOYsB=vT&PpjG65aJFjDy8Njjz6y(bNBoixITDfN>N$8X`pF$LCs5
ztOJYn)e~d$@2@z}d^vM?z3DFv0Zt?pz~10Cp&?y!+un&f(b?9yr%4--N3O3o{?hQP
z(f*P9RazG0{O%*$&-?Pk6O!0g73>aisvIWQc%Iufp^bJlAq%Y3XxvcksGuxi7@e#L
z_6D%>r2Q$IyWKCl(@)re=TPN~3>UmN+H}VGo4~6j!}Pn}#g>kr`WoirGOBD)<(rY;
zoJ=i7>y2w;(60M-^OUm5uD>+cT9V25%z&N49cb_J*<jG>&57KkMnTJH!pG&J?_dZU
zmP=a?e#-97Tqy94n+aJ4&}(!Fi#TxGfKI8eR<!Zh^}G8i-=|J#Z7?K%*mE!ol^w`K
z+b~#}nad8pUO*?%Kuy7+wgX9`zoGxO!>|neb@oENfZe5^ZbxFCvqLo(i?J)OpfQbd
z$eKXGsRcHoxO{$2;JNsiraM@@FYhG`#J`uTdRw3uaerx|$sjzJR(z-6`R2IOS=&UR
z7q0^k4^d3`x$SWrrZbDTVT3g?p{M7OTiyestrk=;!Vz?3Ypx2_y@d={iXBdSR3DU(
z!yk44<?dCh7TNyOzZNHsl&sO(DClJS(2uKYPa<Z1mHqI%b~Z3bqEkf?s9r+2*rAX)
zlf-f1v6qe-byle_-@ohfv7Xzh%L$5~CuA3y!|>J2no7Q?{-NJ&^XTZM=nTw7XcoKA
zSv`gEA)0X2!eUBZWSjct#-QT{SKH7u`e3nY?zau}p`~f<hkBFPaIbiia@Q76%|rs8
zc2RGxeM+vi;14z_i$T~YF89>*H~I{YzP(KFRaC#OZeXO5ole*qI1H{q{iViROB5hI
zn<lnR!H1lSde2_rzxn4K#r1CQ@EhekUTEPx$)SlA9%B_)yV}tThEq+Y6$jEZxTwd5
zRZpaY7vR*6wo+3UkJZ0Vln#CNy!B$2{|MDHG%aC+!LM})C@$<q-|LWR8_W?4zlvP3
z9!+*&Uwd8el3b#UtN>SacOBq|T8kFLM+dWnyL(z<mK_`9H*AD)O^U<voyG4H-rn7V
z+$HmjEED|~1i*S#h94@6t}^?giVxjgrj6^kZ87!b^!kS5f=9QkRh~FJwnWMkGYk>T
z&Zg<fK*84>d2x(YG93bFd<c)fG%PNcA=A(hk<sk$j`yun=(2?x_M%AaOQzwr%{a|U
zADZ^EruP(S$iQ)%LAc;GViLap>96I_X^$<_W^(R=l^roPu1dwuLh)>&r%f4d6b>TL
z|D3y4tyKDvh-hOen(CVQ^G)^!En59$v*Y~QjxFwZaoy5s_gnRt4%Yn`))N2H^*8Js
zPGUhYB3EN!I+Ig4N@Ge$VMIs8PXdxQS1Z=iFE!QOT?=7{^X6Fmw(5JA^GtilXq1*%
zXw1)(TXE<m?H%6%?@%kcjm(=JpuM6QVz2`F2xe_^T`*v!j$4G6E%w*%NOoOtW}sC@
zPGGdvfJX=f-8+r1fSX8C14rVnxM^dY!(;~tTdPMqU?1F**COnotH^Iunw&D6W%SJO
zS(sk@2r>#%m!GhZF%jR=$c;Z&s>O^8e+}MCvVhQIJTT|TI^)+z<e^3yXyKQNCzjxc
zdO>-(X@Uz;ssL&;J1B5XIMu8>-O}~4SLnFwz9N;8ousx7J}<wcyhtBntH31OuFQJ=
z{*YV1*s~6~GNIyHh`w(6XA)|DkE=V#lj9ls=ryBaq5J^sB@w_R59SBsMUJE8Z@l<e
z{!Huz4~Fq1dL9%hRTCffMyaYHaY1qnrAnA=hYJ%`@mz#=lpM+UxW#0s#h+yNSK_&6
z+b0E7i@iADBg`1yljbi&>Uh9n$mXq77KD*_?TASOyp<FC`_k6O@hX6sbA&_0`Z*oO
zU$zj9c-=vRN_lBeDT;Y;h<b;iQvqeG7bqazIc{>(H9Y($aO^f9-oS*w8HhG*(;Z-z
za-rIZgcI!y`m3Pb#r%}FZi6wJ=K2Qd5=I1MYnE*6Vz}9>1NS_dq9JaVZsHJ07p6v3
z&S_r#fw<TpZf^UE2H7sZpSE3u+T=ZMoeuo5DkZ1TPIuG;xbh4d@VjFDBQY-hs$z@d
zQ`R&x<=w)!6+u>UDP>Ng<#8&gOHxi7dh0>5ix}dKBl78IC9&Y;`bv7Rv)N3MU;|6k
z5#l|#77?r_I@g^$+bft>_=Dz}T{s<y9bylFL#8b({_P(vi2;My&9N?eKG~jA)807_
z#C&EJ&sfu2_a$I>=nt8aI?wa%nZC9#aJD*I)jkOfWrkz>Z}#2x8b$^X4LZMmd*CHX
zoN=%^>~=Xo0IJUF__n<;rAHAR>F?S6t5e=r^me=1n|>kIJx>GdD0>~7KYp$zc`G^=
z8FwF|dZmJAc^W7vs*<$}RWW5{*zGo~BCO|G1O21`MI6s@614v1#QLp1Yo=a&00!8i
zV`uX7SEpM`Pi?j@w5k1R*vkBkLa8xOM`xLcg$d}Sw*u&|xwJI4^`Lwo$YTxC9T-nE
zVBPWi(t0JgN^>wdca3{1ifl$Hgfsnt_hHyen*!&H(kGv!)T!9U%{6a)@fA#7U-W3O
zH<6NjYMP6<uf~VJWs&^w=I;w!@nxpOumW|&LdL+ROrbV742A++Vbwd)%p>Fn&Y}*9
z+*5;rDd*8KXgr5SS~yDRbHxHf_rmkSy907Q-2wxe&x-*svpoXz0cc0e{o<N?XE${K
zQWXtwoMqudQ3gBGe5^<(01%xjAvmb5m&tm@^3U*Ne59WK6K;zA4*TyCIk-K1281(U
z!c4O-o)29LL<kgwacPW#t72I4Ge)l+EN8&+UaWJNm=}kGu7|UjyBK#c@rH54w%?K-
zZR;fbd|Ibo`Nj@hR8PaL!`8v6mh+D8kKMI<0s)5fIdI^1eFrFvm6O51JmB2WVjkXh
zQvO=ug^8XihDt__D%*7TIiGtyTQR2CBRpc;nDhcm{f%b9(?^%V#Hk#-ET_Le+2CwG
z`#<`=H*+n*bGGYFkPpP^|IkhTcb@kDA3tq?_@y?fC1g0@w(_T5bT`l>aS{ZzYI#&K
ze*|jMST@ZYwzS>qOVJ*S+bB4`^o;STSD<Vd(Qa`Wzt+A(+u8RZ=<&!sk#3DoELBqE
z^Y`0v<(t6t1t6Djbblbf#nl?5s<Im?g+(2n?S3v8ARh2xd6umK$nz?Y&F1x6&c-#H
z=8VIc`<b5hrF+kziid%RXhnbD<W))8I+laUuWW951NXz-v_9qfv)_Y2&-z-)BohvB
z^IBaO{s5S=5@Hwd+C}V@FpUC_<rn>ye!>!nff&BA?aSib{j4EUr8^3{dNb4Tq9UiJ
zF!M**P1hXMssxoGPhk%0+4&2BXyf`fmf5^Q`<LbwYGdMmjYaXv($aZU5fH9iN#t3$
zhvjSb0E5jN<I7SLS%rCaL|Q3Wwud_0S0@W$kMI+pacga+v*Kf81BBO?8Q3Wf104}=
zhF_Oc-?Ys0GiL=)-o*L0G$O<0qJaje;XU;>{>iuF=gEkE1)*b;-pNZX5ifXz?zMJF
zOtxq|4ed0@Pq1E@8&N);^1q8`%Or^$9R8&Vr8*WmooZ%$bv6kQjX#V1{rl0!_RB$I
zand#S$>*Gb^(K?#vFB4J;S>TW{O<fG4%Gks&u|7<*QKEd%&Vag>UClzYA5CJH|z(W
zi5uUK6SO6i9wxiL>|Myyc=IdUQ2aEiGyQl+7T?|q%$exhmAj*6_nrI@yt5C6rrfS|
z^fD3p@<p*Ta<Lu_z1Pu}l*~f`wgm*4lVnLmEJQyVt&WCDRg;u`7wkeLZ;Hm!mtT?Y
zT|SZzBuL=>cO-G4)XSKd)9&q^MX3+yTf`zI7jM_LU1g0xo|Y`RD8;ZT<3IghE;63H
zxWORt6U_@<>r^@>a{?4!d|j-Hkl(xj#JovDA@;5KfP5YDYt8rF1Y_E_p_kc`U)&MU
zbfP^~!cWHddPZb1PBsND-c%`*YOm!|3hVd3i0v9d%g%(g2n=zOPZ6#6RG3Prlb9Mr
zEW*_wx*`Y-X0^&&DfLVZ^V3a)_wssd2_#?23@xrpp6XdUY^O5DE=FUR;hlm?SEN=3
zO4N`AyP$)?z@DbzzcgoK%@MrwnE8+Bi`BTbZGT(T!%rEV7F~G=iA%lv_E#RuuAi%0
z)uVxDPo~0d5XEqH^KVj$oDhuF3{7CWlG)zEKUy4#y{ms77so9B+|}xfIvc|AhE`0i
zK!XMjK#Hx_Xc@8hHBw;^fa$cUklv9VJ5k~sY+<Q&X<D;n?v~B7rufh2{NNH4)GqoG
zj32O@x=kHG3)D}brT=W;))h=_Oh2=JaWmQ;vC+Lo87qa=Ccs}t$qILfFHp58CDlR7
zggjt#D<wka(Iq@%asnJ1jmFD2c0(+6ogl_&J$#CTh<&1h!?kz(7w^kYkoAd(d}=$W
z1`|?7=HmDTHSwqZ#<irHq~y?3KxV__4YR7qmoM>Yb~U;2BA*xucMJelTxs2`TC*L%
zit|0Fd*d|;u;PlRQ3Z&!Wq2aI3sLzdmZZ2*hrWj|o5w>sksNzS%SlmD6VuG5-m7)~
zC$*j{%XghESKVj|F>j0oWS><`_)hED>1KMkp|azkBKjuUd4@ghQ^_IXM{ijyHQxXN
zZtb)G0ciUlKV$nlOd+YVN~GYScwHw`FfJmm#N~%Uq7<)2=o?l=?ssmE0^m$P-!7|Q
z)tiqM#cvO;tyNp}{5nFgKqDT+9heehU4#5sOY(JV_R3#=(v(VwdMOuoZAIryU)RHL
zF=@S|X&tmuN(|RG9(VFMv)$)6+6~)%0hg?Hk@IY98)(V#CQo+;>iEPnhFuXM;j+e^
z`>J=lf?mu1va2;_yrX2AlI#%AbfI<3yD4KbNdM<6ad}CHip?9P?sk@=)qG54rlwiS
z%6vDl=Bp`f!d`{Fuf&4S1(Z!2MM`AwaM+uEQ0$gs%atq=jV;s3KT~gWJ3~4$iPRVT
zwnOlDJTm)yv*|<p`J_eb+jADbcAxF{?a(FY@yx`<{tC6Kck|<&e4d~ALp9dL@QX3_
zo>Zio9J1Bo?4OO=2*YtdrVnmzl67vE|IF0(v@7Ditp!%ly?=IJEb2g>2r7VJ5w5Vu
zW4D`3OZ&QXco$7{&CE}vr!BLe$H}edhAcBzNw1<{u<@_Bm4eVFBlxU!T*@MoV|`M!
zvlqui@!GKZ&)lr>jd+9zw$NLlg3d0RJ{vXIq_LO|eJp>cDyAV1<X47*Q?;@~v*j5E
z1^w0DPHxu>g|tBX+x-3g(R|f>HL9YE{+TAf`D;3Jw9Ru8@91*;sT_Mj^A=SqN7@R~
zoM0l|qpLl>RGQGZ&tqnP>4<ZFj;rZG9?@rEwz<%yj8t2b$YHauE1s-9=I{85hIM(;
z59gyjuA+*oYO}af&48{LDV_hso{8droaZyg-4!??$nI!XYI7w|<w^P1abz);;^zK&
z#AZ-->m)0)-jS!!V)dMR={(3_q`^P{n#y*bXljI)t7smsc$cd!L^{wNxjXsicbMR6
zlgsqN$BEzx_%(<@nalAD<*wTzaecoMsQFm#DK3{c38Bh@I_vaUFA%%!KK6E*`<r14
zN@La=KBgU|-=|OQHAw|`3(hk1Y(Qkp^@_>jc(o)47V>FCnEX~=)g9}eg8^H=8<gH~
z$6GthaS9yXkE?Dz<C1_pxz<N(%@0Nz{;cTdRCgq*b-cW@pFfiJ^n{~^A^8fHej<-9
zt7hku+&?dZkpHl}7+#SI)?M*-Pn8iax@`fO0Kxe)3LA+TPl7}r^KlVM8=b?Kd2;|a
zNt;0<LNi<R;ud@dy|yiibY+={XEtK#8%9C$U}+?MqKCWeLVlf!kgu99AmQCqW$G|d
zyeaVYgt0i74KDE$<9s*KGn9JOq;;Tb{?xae&H08xU}gI#O7AZ69k@a(!dC#X=pPwZ
z<yLo1Y`t9-i-F4Ry@${@>Ab}H5#G6wsLyx|z-92OK!H^)TQ-PNyS<<0T}r09L+T7?
z`rYrO{~=_3YqZsrjf=>L>go$K{!NYo<}?lix&#>h9H!GV^jC(&jk%v$H%w#fK@Wpm
zH}|I039-O7LsXcMh|oUL&Vk(X3I7x4EwO9B;hb*T2|hOmHMNWtD7SO4ZV|jMPsY{c
z{~!s%M`WCjujLF&?J1P_-hcm>=BR}CneUv0Dzov8mm4=9Y{J)}2hV<tl37aRb2vps
z=Yv=fsvu_gHS%+ue>a4~1;bjc9Q$hDGVS&?O>e#x>JH+8#j9+GC17jnMz}1Rc`jVF
zOE^ZH9-T0K-2woj?-4ta2$ajjbhZ0ST$S?e=Qpo9emOO%*(j383B6giox3rnL@^?~
zr+nX=1E7rew9hoD#|gK+PE2EA`owIK5&0o*U@fc$Mdu=D-Nrp-!J~BP5Vg+LiV>h*
zgbry&7*&kzSO%PTxI3RP<Z?1ih^CZKFTy0NbjwtCYE&OIT+}Q!k5}=P4--etCu}Uf
zPNggh747?PE9OIwTfi4o)NL0tW!&%dGriThp3>SoWP#uNt!+6=9fvDXC$8nW)^+V2
z3!#3+ht081FL}Nf8yif-KJmZtu&9MT{)NQB^;yCm!H!bs0W&JT57>5g&aS2r-((gW
zY#3WaU?aonr3s0?n_b;|27uIlVuw&-P_OmCN?7EWx&e3C*6>5~5Z7>3UA!DhVOe!_
z3B9~k%!f<q<Y`I;kUku!C-nR~4%5b><543K!O(V9hptxnC5kPQBy-P)IlIWG-R>I&
zEl(;^<JPbXFta?XF6CzHI)j+cBBaZb&yI|=KJPH%7F;P=_2hzq@$sGDsab9Elbzdz
z!&lbs4RV}LCR1C0KGr&-^+yBzBKgs$4gB;y?OB^Mhg3iAC_Oc&%(rmS+bW4*Te9v#
zq}z(30+6n03=EWefIgi5H#zpw;1!6p*H-4y>0g>cvLn&@eBx=|V1p;YI(K)-&2-*$
zM|yDs;S7pR733pAEe>=m8lDYtE5C_&X5bkh^ugQYm7n+Q<G5n54Z;p{@dU}>+kE>k
z&Bt~gwG0ioKXrVT7XU@INRKwu6i40htSG<BKi<8I@HK*DBbZ=vR92ixW^U2cEk@ZB
zMm%zwy*+Y?Euy!m>A`MwicHCwLBmvjDyQ)cXJ5yVpJOO}JFqiG;C3kP$)<ugEv1A$
zHOv5Z9>q%uRXL}Yv9N~E&&{2&{_$~OGSLgdri+iZB5o8AwH8DwZRKNEr>cf}S9aF$
zsG0aPuzN`hb0KmR@w>!J*Myn9HC;ALR>h>-1MkAOUcs$^Wp2=<zIefR=d3c#K6iN}
z)7C!k0VW&)kpEo<WLr!Ev?7|A3avNrU#El(d!AFTn*N@vootu*OTz^fSM_}SVaCe&
zecyBDtn=V98w$W(b4Ae25TCI{%ql~Do3#ui1*bU9zSdWMZkks%So-5)f!;%l-zR6+
z0DP!YvNv_DB|X_IVbC@i@fc?&hr#jzV%00vL!6tl>`he?Do^(1^zU#+JcFlDgoqJ~
z$TlWbaortVqiVCWYr?b;q#+!O=ANXA=+3h-I7JsdET_kQd(H^P&)^?ttR0)*Eqt8v
z=SGQOCP`;&{||h?bb_~Sry**f&SUEfVAP1yXAziQa63&_e@!wTqQ<xoP}p59<a~L-
zYq){TR3xOWeuyYip5rXl_PM%ujAc^s?hwV-WxP9K-Djj^XX9?a`mS)Iwu8CQLO1v^
z(UY)^dt@VxbC3V99IvS47V@mc=R=Pwf{}6=FBWcJnY44I!QS&R9vrF07upGD9+zvF
z{K>{t$i4eK3hQhfJ0z2ob;Y%^joJs|mcwvT2Pb*MR$AW55oLRqZG9lDFfLr?T&Dq+
z_Bnng%0rGQZ2#;nO~+4(H8w`FNyfY{wxD%>;NlqV!>>q4D#iiv(%?M-u(`F7XCfZ>
z6b{Husd@={fCigZZkyU|7LUXR_*-V>a@jkTv^<RoFiFiQGRU{OH7uw+G5MiM`F4h^
zm8RmOnRu5KWyi^yfWF6GmAC_=oM$5zS+Pr!E-a=CgSDGlpKh)6kR|qg2y(yNj-)<d
zm%2Et%6@hWP)Vk9YVytXl{k3mHQ24x5qmf%v5F)I|5ZW0P5E}jaFi##F*4XU2wxYO
zmS3C5FZzKreOF%j9GgHw%009E`KvMIHIyuIa18j+PI%!?2M2eK+2oc~<NG0BPwP77
z!jx9y(AR4wubPc3UKv_~L?LS;I-qD(=;G+Y<U0|PmBN0J|ATHT(2C_jQOAMPi?xR+
z+252~lw{v`#qc5aA@WP+(7!ZiT*y;I+kA_7>;!)GgQq6#z9R}4W@Dj5f81B-8?XIn
z^&gYh^x*bn`O(SelyXl!l!^F^|GBJ+0%*Sx`Z1@in1RpH)`Rg^qZU`*FWxz?0f!=5
zpUXpQJi{7&+K9H&bchxWcrb%--85Z}Gi@{65?FGNmwj<8iS`L={A?{I#3-Ha&w?IC
z(XR`Oex9}yjKkfP=Yz^oen0QD#TX3hpd!(V)Cuq<viVX0(G?eR??nT>Ba&uWL3{AE
zmJ11(O97Vf4@kHBZ9NZk2|~e2Yj&n9rY#swsOLh&4o}er^=@Zr;va=xQJy8QBhK^^
zg8BO59mdNkW)fM$3y`TLLKiW)5_t)x-Sj=qrm`s^#<5O%G7LTi{tk*nGZQb*b!LfA
zW>_}LTr{83xeJsG22RoqxFk&Z`*-W-u6J@DE1qR50A#sh1PUc*da))C^PViv2iZvI
zF)lFp@#Uh6#IL8Ok@@DI9(yLbbZ^vcdo7Im;T{g|jyd}3q#SXtHfa&QP@+ny(nFMn
zoIbe${j0CHf~UwnTM&JC`%il!6UUWO<`VbnK!wrx2{Z$~VCMp!egVA0t)jZrI}2jd
zKQVprFxZTg)fUB>bZoD$DD^t22*|_b+oPdkA!n^L=F8qt_a|tBD;D0-uBRM=TS3Gd
z@tvM@TUXFr#JN2Ed=rMznG&h7wRe!5bbxmi!8@4Ad1#SWn$Ytu?mqCRg%WUha62&L
zbGc%}gS!*AWtMP&ra42m{01~pT*jRTO-freN_t%wKe~slwFK<-&(z~R!~3fJ@05@W
zNK0ZTlk<};Y#)$3XhCZiFR}{mXkh<y@2htLXg9XU)OTvUWce}qy(zd9qf6|nmF~+s
z4ELCYmX1*U;Hj-HM}j*MSwa+B6m~vW_GijzB}GO7*Q_5T!TSuIq%6(x+~~DtbHq+4
z>7`}Ybx-=uCk9NPa(9TPF)$b&vg1y=@AT9ueJI%PwxytLi2fIn>5hC_r)T)&o8e6b
zY;2OI=JvMDIp|sk07tU5dqyZ_)<u-MvqPGacbMF3Ui-vtx@?U+ojA{Zt99tuLqUX+
z1mj$iq9@;~{*L#1pX!tA@<ZgD*$dV#bTFQ!BlT2cwBz-(UZ7U6iVj;xJUw<RX``#t
z(~eaLc3F`okS*W<^8w9^d_26HCEY0c5S}vnzBr@0P6f7g+ga%Y(Vt)+cLA-)RCNB;
z!P*+$h2m%M1M(46bw+6EWiVm|7{ij};h5~c;S89=YfsV-8@u&yQTqlJ|9dDG)eSRW
z#{_Io$c3c<BK+xzbuVPZ9ia%qSpw~RGzPcQ?0d6&#dqw?VFCFPPZch3QT){P7ie%C
z(S~u`!gEm>KFr~r(ZW*sb#4e{7fR#*8p=7)MzCeU06{NDM7O~?=ucQ`mS_lqbym?+
z?k`R56vaH#+GmpUP#)U7b7p}w;J@&y%q!2U*a>b^X5ZqFy4d=@-Lt{i0c3HAWF&@+
zcEWi_nhXHeli+DtsiL;*mkWjpZ1sa|%>nhOS=$ZcO%&JuIGlA(C^7AaiQyg!Fb0<D
zm<57m`;^)+*D&+dzfO?f>%!-#Z=r3S7-gm-YR%~ZBzX>JmMQ+1#uO;4zkRoyJyxST
zd0`pXH4`cct~G-k?BwTXPLKds);gn~QsM_-d|BvA7)ak~CngW^RGth>4_ZM$G`2e*
zp{(i0xLiiRvU8Jsq1NgET|)knYSo#BWai9fS;*MA|56nEcV)r<S3jYsZYeDLg4XuR
zLbSmZviSsSid~_#Wajs7<}}$MWx$%Cow2I+Y+?s9tBm*kdzfm+c)z{#@PRBaF=@Ue
zV$?5Iti2AK@_wX6rRP=LpWMi-3%_Ffypj`?aP5VtfxYkwM7u9_cJ?|kyPOt*tD2V!
zX@B_cq_$x^bZMwt>t{mK3IC4n>vn$7FUYhqRZj|F3R9x6b<`wP8ki{wWJR3>&b(_a
zWuQfB5$WNdbw%FH&Sgnwws1L};d7;X4A-#d#9mt+E@CXMn`$QrBc#V@EV*a2jNY{j
zz+VIRRt&t{O9sF)2=JY${SY1asD;>$&?4mAZ)hOFdEyYm>T;U0*;=@15hdH}_@bwC
zwT4FNv-&wh9yXSb&tqH8dd5L&{98PyewwS}O*`*wV8g%l)DkY1SVOeSr(r`?Z9Egw
zLxU|++;p{PPQ@{abJIfvt7w8Vv3dS(d6Qicamfr1yH0vO=J$|!)VkYS$kE0;<a<K!
z?luEhn(hq68JIwD9w2t)zrjb;L~zy-03e&`sf$}h71@;X#^n{}sHDDOj<Inyq%BIm
zV|?Z#Zt9%&42>vpg=7jlPx;cB4CaIxv1S&!+=}+JWvm%LjM}ODNm99%X~$3AK8p|5
zeF6Gbaw16q3Wq}v<`pt}mNsguO9>e#AJ5e$Rimf%{OW-GjQ@27zm-oCH@R7NTS5;m
z-Um&j{I?g*6bXAwMB(P<_aZC-{7ps6VWI4%+12#@r=ZW*crNf#Hb69)g-kElV;H-L
zVEp8QSogr$wT?Lkn6Brdp3<O?yK>uiO}uXKw9UN~VXM%OkAt<I{Gu;=3X$6SOH&)a
zUAGYbp@J+n0l&Uc3C#~osUqEiyY&n7S3KaT>WHT^sNazgj(RY^*c3tN3?)PnqZjAs
z$+Se4#UJ1czoErUMKG;GVg1w0l=p5?!jbRVa^GcYj>K6%jO1Xq7|yx*L*p$uby?p<
ze0vRGP36o(fcyyOcow31CtNh@fn$+I9x+h2POBlX*=FHA#J&DfxY@VZ584(FWpw=J
z6~J00C#GW<$5<wUJphHKl5Y{M7j`W6EUV%za4UOQ&)T;;k{vxG9{X)Eo^)|CXJ`^N
z4UV2#E&+xExhdaL61On}&5+L=&fW$7Z;sViDA_O&NgpcPio8U<4b@#*na#BO>fBgc
z<B$Vrjql|EMl;w4A{}oqPN||P$#fT*zyDrd9s%BCB{g}N4iQh1#gZQpQ6&fu*AW+g
z!p`ejoFzL4b2f*TJHK;_>YL?b`CWiPX-Wn(mR)Ql_NE7aY4SI=mXJhYDe`ADP>5{H
zjQ-N7TP!K44G@J$S}+kxw)@c(oO|=Tjln_&rqacvPGQvikHtXfJ7M<XyL2Tt?sl!%
zj%y39L1K_K0wvTA;Him)0Bw#ZQ;s>5eNnHQAQpQy20m{f26lGf_p}#;c8h8Y3sdn`
zB$>FxZ@ql<S~NxUS3`e=0tS}<&t)}d%Z_&PGaS4M=lZVJ*2J!)YLbe0&;IQGeI}g>
z0a&Sf(*^)#^8x8Gl&PI7tqQoEF}QG)lc&QaZC;9?Jy#uETkusYt6k)qlXw0V)<YGD
zr_T+~vnG_SbIo#p#|tLNA%3S_@%l5}S8Nx*jp9z=zDZNOeRclbJ1iz;2>9Dg+ub2l
zMuU9nFqOSA@t`$8vn<E+hncmYtFHF-y2h02uTj5rDlRh7+~q-SosXh9p(hj*-RXhz
z$8}<8JA!q0WQS~=Z@!7;U*;ZJ_y$FlMeLnT=3>m2X>n&uybD-8{Wc;11QXINm_!5R
z3)q=tZP0Rh9J*JI{cTV%qr0l^C!}v@A8YX_!NI>({8CDC_!b16f-H3AH7PA@%uD79
z5o(|tE`4WEIK#?913yPRAPnHwcFIWlFli!$q}q*gg0T9Q1&rt!8P>>Rhk`Em<onm(
z0sXoEG2&8A-A_xO;5Wt8W%3hZ+B_z7_S`sHn5;f#s)Hj$^7i_9_w2h}R_X{Aw*CBh
z+0U4UKT)DKoIx_@;<RR^W-}*^p<3|s>NDhecq^D6#<qwc-pH!K+byaNk9w&1s1-Jf
zH>%W+)dUufO#Dt}sXM-n|KEsv&#)%Lc3TicK&2_YBVBrtUV?~p=}PE`fC!=2P@^Ed
z2?!`HB3(+P_uhLa^j@SV)KHz*{mr-M+vm)jea>8G&-_ZRBm{W#JWuX>t#z+e$doK`
z_t-pF4rQQ0(0VRcjvE^(8o4pvpt`c}I(Wi~-7s^&**APgIH>xZIgf4m9mSRe{;AKu
z&GD~0U6YZWHC6ygxv8*V5KnDaWA1^v{rW*$MJy9eFtd@$are@*fY<n^eSo;K8Yo;b
z1|aGyhN!<bo+2~<u<@+ilj)kd-33xL|4#BJtSEQjpmEye>?R&x;nnA={lmxeka?v`
z@`CP=c`FF{7+D-`wg{ifY8pG;7P#_7q+eylgdS|{Wh}_`Z(R5=rUL0+pZ{_U|EbX|
z)1R?_4Dfd{Z_7XS0L<(2Vk^~6-^$&^P-(@2(QKvunNwcx_wB!P67aSEEWL<%{+KQ;
zs0S-9(XKR)ii=8<ShMGJaHfZ1W$7Vvr~xJj5Z>%qHKo#frDU}xl&$(IkUJL@j>Zvo
zJ<E&!omc4^n}0iUOTX}QNh=c?&$eky2Z2O`9J1n>zip)(Hj1+x94M+6Uo_LmJpB$F
zF>XR-z##E~6*RM9Kp|k9XfS&0gW3T;?gt5LFbxj=29M2`V_rTxLu=y+_0hazSt%%|
zrkY;0fZJ4dg!toqI!)*qf(7Hd0kvGCtY0Bw544>v4&2$l$7%1yBOb@|anx@_`?KJE
zeS1f?w7ZzbH5@NDU=FG-t!^^h;DC}RQmj(how&LADNf~=K;nTbtGCI^>62aQYt0Xh
zt`*|R(IwS{;)1;PMik?gJrAE7-07k*90;X9)EoI|9tU;%(7AH#?f=%K%yvP%@FIY-
zAT0Oh(*h#zWH{$qYo(E_vx%_@br{B{d#p9V@;*00Gpa<;n?6t~P!d0G5STtN<y?zS
zO3k0f&~;MM#w2IkC11KzUM`e3b_mUy$f$ru2?E#N<8PV-b-9@P2{9Vt#PDnY9%EzC
z3T-|IHIf?Y9d&#8zT{U{5!t?em6uH67(<!bsZT8PqLZ9i<Hs`BKdX7I8c7&|k&^&s
zgJO6GEZpcss^gZbHt<qbY-(CQkL^((-1Z%znX1*pgC_>pQP|qT8vf@H5phBG&U(BU
zMZzMfhmb)(`5dF2ONY+riRT8n(W75Zxcfu!rz4J+X4*S6oPI1_Kbbtp@HcN6BM=-H
zv#R;UDwc4y0aCafOFO-bVI)Q0DSq%(H9KXJJvUu5Z3;B@<z3V8j*mc>ED0D*)jsI<
za^w;Fq()83n7D)?XSIdM`|h|9Yl87cSHKP`as^Jat?He(zy{_zGBxVi;jH=wg=TC1
z?1OIY&VzF?Tb(IhfigUW&_aEOq!iQgp)DHDH$B=?@!bGpvfAVVs36+_X?=2QieoVv
zzkSN9?xy42(W-LTeSJuXZHn-+V_Pz}yu@0LR^)_pNjlA>gXTV82K-|T*b6VGvfqq<
z%D#yiIxY`L^1cNi#lGdw+Rdh+qeo_2Ex3om#z?-X^F~AzARRYv8U1;>GI-E@f3PC>
z0P>jFy<#G_`pWwBxT~BmIE(b>b5b0Qr*~NJH?R%AKFl;GJ97(FszPN{=DnZNo>tD?
zO-V0^A%BHq-7akNo`#u5Ny}c}(r!C5U?k-%5&A+G6RY$qrFWR|O{w>oyWURVYkS|V
z9DfeO2ZoGlg*uTbV_I1gJXfdb98C-%!zllX-o>Ntt^iir()QE>Q7&t`n|-)gJ#6L?
zc1+^5pD22$KHshm{!zvb;E>zovwmuF1dAzn+X(THqXRXGUlm2d6GJm8rWzusd_QXy
zAQ(}d*Nm)~3)!xCnQ1@itU)Jlso2k2z9PcPln23a%<ot+Uc{e}9nPH8mM-2EE1uh$
z2g7D&Q~m^n@>05P#!TA8&qOLFhek6b^1z4P!~d@5`Il4dk;ZKia&=?2{C46ztf6$0
zi3wnDB%4+!Fk3k+>Q`@6;-d;CO)Sx(d)EB(i=iFpPm+nEoBpVB6JrzJILYV{ei-*W
zS|bdTxa_aoy1BN8r271|9X)Xa$w7;U7=AW060rCzTR3Eq<g41y!Oo_jo+L`~dHYpC
zu%|DR$ZbE<udW;vRj1E+m?+<yrQA{uRCZ>|MI+WJqC`gFyH?K7Fsb7wz#rC!B&0!|
z;`%K?Af@7JUEwaZ)3RWHkA=yvgdCoybH$-~;W<!8zYQl3_J&9iL;Vv(YO^hT#u%8%
zt*BwHP8Yc`n)gd^rt^|nzk%#BJ;Vg~bF5^`H;LWwzyrM>d!*pc_K!sDrM((Gp5W0U
z&`aENVJe61t*s(HfrtP?#IjSWAHt~Jp%{_gtnnQzjcz~lLBTufB`Xfe42s4+>r2wO
zM4b;Q`g^RvNjrTXR@X{f>3q=gnV)hu_BWd@g2U(^?V708sEx_?oiK+*6so%i5ZD2l
zs@QNNQ$T6cMzn@Mwl@=g6#oL}?o|OIvx)F;X(%GFZy*Y+ZJ!8C$PNn~aqAImSpv~;
z$|vT}?MB%0F(a>0Id8{H%4(O5sLPvTQi@ys8>0vBR1vr9#Ppt4I}t&<kBkp2ct2^3
z#~RyGz6-0<uNm#TY!h_LYa5$`Noteif5vQOam;ny>EHMR;(1wF(|hNon*oRmRa2|r
zWrdYcK)q|AThMp$&T|!&_Sf%lxRVX2mwo-zLv_V&NzjGcQV{V+_a74FRnchpC!*+X
z?*o%thgjyZk1!LtwLcGt%T*NUV{@e=F1eD_Z3(T&Jx&n{fJyFy#PUY_v%8aT1-Gwy
z((s(uZxSt^b~F*j^xd&%y)(hT#7m5Y_y7_K=ni;*NtNEYv~KV;DwQN7NeuEiMNCnu
zlw{62_pCM~14*y(le0U$uAcz2-UteCJM-Ev*SxD)W2P7*rfag})tt@myrOXW`rjAb
z@zyULPP*oS2Hz4zb@l>dfwFmND6$XYI=zpzBuVqurFRJOov`nMUU1(m8gO|KapXOS
z+1S$paK2qqXUTGS?W<v6U9*?NDvSgUT7dvk@dyz*82Nju6!sRH8l~8bAZOM~B$D`-
zS&MvoR>Tnr8Rnfjm(k9&W7H{@Ugm2#kFT4OFwR3RrWEt?;XQUI)Y2N?c?W~Ku6h^;
zb7m;_Gl!WqEXKquY|-G#g^0Pj!1`xQA6A<@mEGU;9+kNQpoUlQwQf<NwNHR$mue0W
zFwvmldOi9opzo)|Avs3YQ^VGaDjmY_bw}bcaueB!m{w?S5}M3G<A2OGrMy*$|NT7e
zRuVDutvItGs2}#tI0t$db}cEE?mYgiHoOeFuP7B^B<uo}9C6Iyi|t+_0oEZ1#A}Bv
z%)=CRYkA~uG3q1<-#b}R3`p>McoQ8!dCfdN1>plOA%|X_t8hmgQnIAfOc6V-sw{)Z
z$0oSp)r>LEct*>3L5Rx~?#9KB^zBKI=S^l4(GJr?KW6V0b;H|%>PKZfD6HYB2H2S?
zh9LhI$h)}hs+|DM@Tl{C2qYFSb!_oLZYv(7I}`xPGgv_*$nf1+hOPwXCH~*BN+&;}
zzNCK}j%nBY;y?Ip0SYs(ntXgk{9WFqTeJ^T*sftikJKTY`>bx6%kx=Sm6V3Xp+r(w
z7IHLq7KizEWuUyKdi``cj066%;f~<%Jc1faIjGO%Yt7Vi#o#oTM`s@5rdm{(N?;@q
zux<p%Bl7CeEE2wojb2S9oCi0v81wwjm3_SS_OblvHzA@-rr*I^@V$a7K4^QZXEUl4
z#HxBWXon)|2)sAU2_*cSKa{2>mzdKee>Hg-!b&40O0M5?skAyfr~RRmgF$82Omvlm
z$Ygt5<TKa%XeX#~N2f}8gZ-tbkA10vFSb5*T(E1GV_K0<JP=PUnY7i_{4hp_rVt%_
z;tgu#L7$)bV)Ry+!kZsfM$2`G6-axJ?Z4Y0-t2zPb9TN)^@$(ZHk)NT`t9XsiC1RX
zapp-&WlkR(ELH$#_qyVP#++VTf<b1m#mB%wQxBG(jIvMqN$!L4wA=usYY%-;4itV~
zUAhLpkJ3_KxpysT%F7k|JE4Nks8O74>bMiSGyIh~{UZDQWEVHS;QH;$^r>%xDKjyn
z6TaZG-$wgQg;;l2u7V6Eb61MAw1{FuIN)s6GWgnngRzNiQIoMMol@R7E5(slTkK5e
zE0j~$4Csm3&Y~6R{v8(Z2Lh&-=ZH}R8Ro6@bjs?q!)G@$c@f=Kp^!JPgWVOoTx!=R
z^YjQfrn-wEi%dbfmFk6p;`u|$KG&x=1<mjF_12oAi9;d&XIvJatJ$!}=V`CX+iuy9
z?v>TcFk;IJnUVl;MotASPJG13E+ro7YARcXk~E0&obCb>j~@<7@vwCmzkS6w6<)>t
z1T1;?As&g^(cvu4899ondj{Z^Ma$KvE-wm$r5n9Dr<yWqA|N(`Dq@MUSCcoKuWQHo
z@5TwuYOz!ngy@2mIq-!G)HGiE!jq(IuE|1IVIc>sK^=>H{t9ZtLgl$)TX_%U(tWkU
z<SYen=Ari+I9H}ghYp^re(`!Mlok&;<sLff?hpg%0TxO@W~QqGBpNwtV<j(5!}bj<
zHW0iq1AbQU%DmE5cp0pH(0Dm7bOTk=SU@+*V{QES1D>-4&Q!hJEY+Dl3cve?p{v-M
zX5v8{J*HhCPqG-xP*A?x<rJZYLPSLDmp6ev2<3&h-sC4HZ4UM)6<}_D0*8Vyh;O@G
z?wVy$ENQXDJ=E_F?#Wg52|^vCdPM@YY^f`QEDFB@Os-XK*3!FK)6fw&!O!En6E_TC
zQpX5#sELGlQe>dyV=vL@`)sFD<wm;eXJ2&sp?apYQi{2?ETecW(%2&pju5f%GOc#=
z*d!u<7i)T-O#J>DogU66w}_n$)koL0cn>lXr=d0-uC~YCWTc~H7hp|}i1-FAIe~#3
z8lyrvc2O9HL#~TQl8u%mdLyvAf<*;gJ${fdR=@OV>6cfq%>AFawQG;-a&rjoSh>}#
zd#zDivELn8=wgo!;(4$v^LiyQ!DHjcaa7!{3C25npLKL#TcbN8;i=!F;@Rz~k>5Xm
zNMvDK;(W*XcnN;J24${84gPki@pc$qF?&Lobi~jg1@8b`x~y8b0qe#%>o}}uc*RsW
z^N{Ps(e}IWu|%o7EyUh*YJhZ&e6Vq9?B?X<F4F?V1>cn@R)B<73~bC%^4h4`Nbg{5
zV5tFoA2DC=^*3oc$^ZR7<NLsy;Qbk3civ9H?9Hj6mYuXVQTx||8BD*D2D4In52A8a
z{RUf#O4k^K1_M%%Tf_V5SN^|YrO2>r@s)k!RwRf6_Q*)XJzgG~)W%Hs@xkZOCbzV$
z2&|c#Pr#g1y84+U3LYUNS^)haKrSBUWKnO(QUTF<7$G2FOT?C1j+CT0cK{$=s@oYO
z@P0IKkdW?Pf`d0vZ5YQL0{s|BPMz?#(KJCGdS91n>dmH!|KCUlJXKn?Xz~aK`iCu1
zfh5|BegNYlEB!k~E-ZlBr1ZFf?B~4EbLx%g=+-O6LikTfoEgY(sf#UbpaK&=iyC+8
z?zLRI;a8WGCA$6UH$4+u@bTNT!x)~)7T=SfBL}s~MIL{!#=K)*D%U^J8d`!~)BV%@
z=5@)T{T{P8)p)nlLkR)ayC!hAkNS{fg4+j&RNt;>cK|9xrZSzcS&{};j1>?!gGp$w
ziykQ*KUFs_jKBX#QN|I&pgGC5tUn3kgrQV=8=B|Dm9;K*v+W`;6zVU*r{Vu8Eb%`B
zUHpgFc;|J+QkY_>mJegD9p0=;!%5yt<z|sFMzZG=C2(CoK;|GrZ^wPC>X3U2Xk(QR
zlu74pDeF(LdU?;Da-&a0u+hkCQiay34Emes3a5u1dHW!NNe>M*FFEfNuEB_7B%Oo&
zWdgv1-p(u?*}|y)VD0HoHlKXkZEs#q^68*O?8z<PduwegvMma+eGWvS5~*z}-u0Ab
z&{|75XZr6b1psos3)H6xoGADW%x>w@m@gm>ym@#{>UR4Q-Ud6pDTHm?S6(VUV;b7J
zrnI?LhqsYjqLTk$sZ%!pkh*n~TP~k1fm3zI25ZY~Z_d~{$@JV?pm*{<DkuKV5FKkm
zdmFi$#I>rr>=7?XE?oBc^_Qr?d&_}Rv{>;G7ootIV&xyKmcvjuox9e|aVKrgU~|;<
z^D~#(XI1eHyyu4-Erc!hbg3~7UWmMWoQrv&ga#a>dfhMpjB5sr-fzD}o+z6S*<4fl
zz8+u2piw{Z(`DxP__n@b(`7{;g7hsWa7s&egUm<$bUS5KWr)j^Swi%6AC$#?mZyKH
ztniFf$6WB*7np3p4;YkM3<h>#q*Trj+<R5ToA0hz{5+S+f=;B!o8VRp;EU-y$%ke;
z#7xi%RT#V*UV-RL@Bn6dl>Ar&MD`hPO)t$d&ZfqC*-+21ZuV--8#JjMnZ$tbPZ(hT
zOFy_OH-lU~LFAj+3S!E&X@wW2dpAstzw(xiwX6e9gtM*st*tm?&Ci;bf6T7mGTuZq
zahuQ4%hdT%hB7TQ)&~M-6?%rqkM)WyU<`&QXNACU9>lIO(b@g#FM=3_AUqthjC+dn
z%}t8ijeoFNvV-lp>h!V6AH}O`KLfen)B*F7A7OYhIw+De7zUing87(T(}Wb|b)4jP
zApD%4u__<kIp9SYA^0%!9+v1;CkoP9*Od;*_j`t}gLRs&ZW*Um%G|`vlgu0D`tYho
zFBYdIe1II|pRr;@*A8Qs=o%EStO7<nb3}Q<+qN(LK3sU(eHAoj5$EQc;Cd6_Fujl@
z{NSb#p<j{y0Mxy&Zs^T70RtcH4XFs&f&wC)%n&E$PcP>Geo1Z!zzOAmmD#p*DFOcb
z`6}<57TW?6$yPHE!@#-Dr_xCoF2enqw_LQZ-ju*TtxOzG10Qjtx3b}K^Zx|ae?@l&
z{FVfBOzR)4w_ag#CkwKEe+#u>;6ZVqt=tp+3HuFs#t1BPToIIYG60gkJq)|E@e~xw
zP*P|=-K)yy$jS?&PEouR^)=s%T<u??59kN>nx9UA>Xw-q)Jv1BcVQ!hB7FL)oSAbT
zi3_~Z-KobT!1sbc#CbAde%UtOH05^P!TV*MVb?J%*<J7%+1SRIoaNG|s)Rd5m$=0(
zJ>C7Tgnh7wYvkCciT?sU{D;%#|Lx;`b7--#-4&-OX3R?Fi{V_&(iu$3tWW}bzVzG1
z*9=xb_|kkHJ(h+)ySAy(oVn4UwKwUolXEnETn%AKj9_02N*@0%_#HmQo{cAhD$5l4
z`m$tbpsSG|I`jV0C*0Nx0<$GL{Q|@>_5H^<CVigGrI2JW;K*Su-pb&p@6YjD)q5rK
z+kN)^j|-v+LOUq3#2q!a?mJEKSqz`fo|bt<PJ(tXN6)<EpCe=(PyGF#M?5Kc`sP33
zO>q8<{~MZoM|=pn18J8b$X6tZx_$f&ebzboLsw#9!yj<#lGt+6l|5b(J?LukLoc;E
zQRPMc_01M&sH&bUVKERT;MrdtyM1!J5kDF@+Rvzo#EK%l*V=P&%bpXJL~|oQ`(tjn
zXTP<N$|beT=0|^>(%UWR82?}(f{`*D^z>R|{G>{5CR3y~XI3kzdW@}*V{tA@mB!xp
zU2U{NS2O*g2NFe59a3>fymLI8n%z{_B(8s}4dYs*UJVn8ijtr06slE~SS`E8FIl=B
zo=xu#ZDOvO5b^ifC<zTql8xtEuU9BW(Q}L6;bii7ru3V(nF@7<D}x7Nk16QaRbSb;
z@$q3iHIYfbuS8o7VJyyEWs16$4W{0^5{r3$hTs3y1%qt}hzYI<IKx&dCQfXJQcJdl
z{qr;%W9h!v&|3heiJ$$-n0qWHoVlypdb80~;SDZm0$8ebiQRJs*$d{P3QQ8NyX=F8
zCR^&|(?hdi!I&3ZVq$R#8D9}`s{>>1<$ai_r{%ia>+$?iwR{0nkag$_rizS2%jIZK
zIr@$|rYIRXTh`$`6=z3NB~oKy7*d&MnSb$B8e_*fFvr*+4hW09+JLweJImA>K1xW5
z&~1X-w_LfXn8{_v$7AlX(M;rkfPmOwPT6~9=`LW;e2e}f7>|MdEDuMIy3}b)JjRu6
zz1$<Tx?F8aj%;{V7~a1YlqixTQVSp2)sk!JD|wJcd*<&!-|{F35a5=t281Ip${kX$
z&O@BmEjuaU3$Lm$;(dje?-tk|6PGCkK#!MLn|QXl5pEEM0gHQG^NF&ptTasN0S@st
z6oS-YtG2Q_m6FEF<sg@GWQm+DA4CJ`aBc*}d7kdb8r*j=n|`9qZ5>6bOHGZ6?yn*G
z@ZIKjZ!5%*^wE%Dv)SaaQ&<2ICP4vdgHCQ^Fo44J>)A{8t+d278|}B;N1}^LG+lqY
z#SZWW2;St{qpe+*HCVN4w$D=iU$#5KW*_xsygBU#azEx(V+vANK@~r{W{voA`p;)?
z^Ji9mGzUXq#_8s5vPS)FfVj(dMfUmYD%vlfcc*SGutZ#6{F;v&@rzeXIw7tt;p{lC
zTB@*#D(1VEWlL(JLPd?Kh}J7?ESQ)lK4C3O#($*Tn^<c|OqGaNRsy<<nOpU2c0gRe
zo7h{atcp-cemOd2Fgm82la;cnuqh=5a>wF&Y)QYh<3Ob}?oPx%r#$8`Ha0XQL@%UN
zuk*;~31eVWf)JYW)lnbx0r7EVs!<{T!a$);_Rp(VH(TdSBI3ayE++Ed8RQcnR@1@U
zopFu(M|%!G>J3(_<MpntDSDsa`891em7q8Quz~nmdL&sMwWnEn=xv>3NLW5B5-Px3
zCT6%0s|)F}tTAqmUVJn@;wWTfS6w3XS*Dcmf!58f#3gvVPmt%NnGiK<=!$rf!zKPx
zf8_XS-Pl%?l!4BO?x<ow1oYqIYyM>{@~)nLyLn8V1QTjn6Sl+q2WtSi_wo<c4q&rS
zQ2pzssHCLZ;1tYyEV{QL2N}T(@p_&)4cvUiHd=TURiI6>VP*}4N_jMvnMr--K8stE
zu#V$9P!h);c1-+z?`=(FAPsH9DVO~Gxsy7DdZMG>4EfmX5QA_$^X=>1MF#XM@vtN$
zJ}I$ekrO$_;Mn_}l*gTh6|1DhXT3)~A@vg!@8?mhQZ+^y%A@C1o|m8SB(dJKH7Iw0
zn37e}GX#xDAvLJx@Uact;&H6C98akjIB|~sXbnDV#Co32c;dG`a1P;X5C9Wz5w*8I
zjwjXEoZJObp|xx744pPZC3+FEQzz=_9Pj39fvmAu`dAu67JG?9)8kKe$_g!cW>8!B
zGl&si3BukB%bbY|@o-Y4_oR20C-^Z=6fzs|a#ok(OCRlzd1|Uu{$p<EtoyNJH(pJq
zxW=q8;}pv$p;tFKvcrVq9yBL29i{PPqWhN|)j)vkoqG%O;BY%5_e+m<dEqoq*@6_$
z9Kh$6GdN7!o1#(8&hGb-b4~9EoOf6UtrZ-<ud(sHBPbr%o0YYbRcSdp-v`<FK4qb)
z(7uS8QdZFou$gT$RdU<|((p8;r(XT6xhj+8btD$G+<)>dfD*08KPTP3cORi;9ka>n
z+|$<d-a4L3MN(hw1Wte{d^acEwf0>^|NHHexTH<7o58p62tR%xSFI}O@hL@1(612l
z#7=)c76mW7sf)Ny=y|x`Q@&5pZjSYF&1&vKRDeR!Cdu{oD5EPB$hsSev+)EX?h)En
zfk$_U8BAbO7vCL~`Z5%K{@Nc~&Otn9%z{L~?V^V-imIP#_)6sfaOqoPD)FTLufrB5
z&)Dguu1k2fZCL{kSc*fHDAt?UP}x-_NY5alb8?+xe;S%3{k5w;B_P-MmFArE=GJ$P
zMoI|O$%1<s2<S^C#tfZEJVx*EO!;xG8f=8ym!zIYj$DovtM9*<<Lf>KY^673)K?1J
zx1&4jHd$wDDc(d;`;|!fL$=jZ0Rvs39&tR1HAXhnM4ex>%!8L!TZ`$m=lV8cwn=JC
z4Y^KGaOYi$vL;8LJCG59B8N(KJ^BxV7OjYM@*3uem83=iz)G8-s_(SS2S>A!fd75U
z#zlPm*=tP&(~%O9-f0I8dK83Zc5QE*_j5;TeG*m%=tom%)32&YhX_G@Ai;~Z<bA@n
zIIhZo_wo%yjUrL8pEXseMe|Ezj%=*Lh)1F6+v!<Ttk@_^>Jo*HCOY5yM1y4qVaFz4
zsK|`^$~rpLPBt5T6_9)$sTQ_gLCn<oU)VJk>}{Vn2oc2lW{7<2arXSRZI%eY++~lf
zp^GgkJpi=5KE5HYzhlI@ZSppm6ko3*=CmS<wshPrg1>~e_>xJjpI+QKQNr4(s{sah
zu|sIg4u;qt`0V3|=B${LlLKjM7k?L5{1d0gv(r`<CPJIpr=Sp>5Pm9SxJXb?_XgNr
zphRSQ%79pMvkn0AtoKY7jJbrizL&6O-2A~(J9#ttI`e39Me1qkA&3d^<1WV1m-tMq
zXbpw83oR-k^>@R4kzWkWhx1-mKg_^h2Uq`=I-#ws(Ps^iEP3!HN7Dp|1aEu05*}Js
zP`iB8&PM9(S^!pPMLa`whc9vfNOa<!hC7G@)n?W)K3l>Dq)Mt2PK|x}OyMq3l41S&
zy>}wB9)a!+i77ymJDjQn%-NooX7Kd#KTcYh;n2;|<Z1jH@Rvjh&U=jF$pl_x0YJ^K
z;Y(f6Lmf@W)N&~yr~xvzDyMeiQVHRbGr;yK&C1FbTs~tu4GrlCcUC8sN8Hcg40#uh
zgb3W#4@vwvZ<|cOrg0RLRcUJ!k=#g@j2m;N6<;ziiN+7*7pYBA`BI@VK3l8s<zndd
zRO4COZFdKyuO`8x9)uX6z26+)gnSM8-FyA>3E1|i2g&f!<z|CVPYm$hDWWKEa3p!|
zUpU^X3U-$Mf*kl>)+FD`(CGsXZqVD<uK@TLqclyr{TF-vPeqzNUR468cQ}se3}O(7
z1T;cdIFz=Ucp!4IRkN5nig<?nUaxq>866B*G;%v*Qhm!9Z4%ATzYKY`2e2n=eUX=b
z$J#Brr#*<f#{xLN1^dmgh?qz)f80JPLAEuq`qJnxZZ~_*lh_q0-aQQ;PI{*)Ff%!g
z1dcRs$Q<*qE-nxzKk)fC@}+RpPd9VJZZ@#<feEmUDFC}fXA$-Ke)-rh@%Up&jOCj;
z)>|}o&K_KF_)_`Z8O&(N&iL^4Y_lm@PJsOFz)$6_iMz{1$5F7Q*OwT$XT@N0Q&f!<
z`1_6WUlV8en}13yDXsx(ztstO%P-z`b~@(Ny&(lYu{9rxy{5v2tu|o{76At(Ij$ey
zNi2YNovHd7(6>jZZ~wIIJ`Oax8AP-VW0-egog`>Oe^Ca(TjxRZI(MvpqH_OV-+}{g
zM?J-LFb@Q1x8uHvlHi&f?P`CVjGsYECESb?NCMT~;?J0ZJR=CL!(v=OhIR3Yusk=@
zYRqfycJy7O89vz_<T=9Tyrgh5s&ITODAwiD|FopQ!l7WgCTaG7ErpYThD{r2<Lnlo
za(mnP3-C}lDr^VQtc$YV7z%gRa(R#W^zpX^SI|<WZzr!O-SkvC|L~zH(;)7HG?eZE
z#YHjDJH8JcyoqQ4N{ZutoiXF%dPRVV(=$(RM!i;7bp)DIIl3_I9`yV+;hiY>#l1O%
z{Ar1v9%}3MzPNbu6$JBIZmT$?s5vn$`iAFn8nK>yd*340?hICi{K(H)mLWk)WNM@o
z9!R)d&1MxBqk`DA``>Rr5VE>RQ19))pJizA&5(iG+R)%lpmd;ws3<u$W((-OHzpim
zHp5X%R4|KS%G!u6<%w)$1r0sg%Tib=x>|NX&gRP#&IJB|ZA7D-{o#d3b0je4zylyw
zFHhH&Dv^7MYb23oVkm)brw_A@p}|c&P|9tY!v14!qeTPjNaJ~G*0>(ruh<nKs%%Ot
zADOJ7$!)Y+9dbB!jQ21>mJFM4#B^gu9)x_XNS6)0mm-oVQ{b8QncCjot@S%eklb<t
z{K)FB0TyB(SkCI!h)R&awNNCW&iz<&O(Y&(Ieaf?K2F7hgm^KMNKqz_q>_`1g905&
zrwIfDxdE8Ma=LjLUV>efk$K?3-u_5@Y5OXXqsZN~H0~wrUPR@OXy$O{D2s=<IFifG
zk}@Os>x;F(RdKsXZ_p|jEQTg@2gpoT5(Is7bUan3*>sg_WJ~cCy4LXLLgAmWpz`*1
zSJfHZ+RRD)Jc<mqQL0Xq(S^H0^S0PlrXNyOiZe~VZwNZ)rGaO^XyY#{h6b1X!E$iI
za7|-Mmkropq44{TC#N-&i(&>gb)$2GDnHnWhS{e)qyAw1)MH-$37>@nmz(e{rg<6C
zjH9vY;MT_F#iq-k&|dwcT}O+neP6XtHQ3LhYdo>1<Vs^qq?nN_bBy<UY0RoEKbrxo
zLE`4O$X-@lEGkd-Z?U|Zs)O&f@z<OF>;6OK{k#>(@Lc5C1}e10DFmhJm2)i_)Q1M;
zY*f$e`CW8Ws||i2;C&w!Bqvj({f5ip>d^2kMJdt3%QxR(M&7}rK&sb+*X5_G^pAU!
zId8CC^E2h&s%T>^KN$H=B7_-4!P}YWfk`UBbUiAnKN}i9w|6XCkDDS~RHn>k9mJ1W
zf9=s17uUlYaos)AyqqD21+y9SRUB==WjKs%V#frdE&Ypn=||tAln2hybM5pxg-UXO
z*nL_xhz`%_<{jER`~-%JannX?HjB^fiA<;18aLr9>MVR+dF93S;0P83qMqWnngH=(
z7Rji>{R}AL@wWD8U5}mYYJa<gCgd6%2^0C$`b)G4Q0SN{TQ8b|)V+>OHDA6+OUYqa
zyj8y??!U#}F(X1HMK5a++AflfupAY+Pk*w7H*^<DGw$uF3mvE;o?;GB!pODm&>}xc
z?=^EW3<nQgkh2Y{DO+S_tB?FB*Nr@LZA;o2^oAHRpN|mBQPtFR^|IfN($zO+ic4-r
zDap;ibsLj)C;Y6}d<*MCg;hoBVls}T6XFL3^GH=?dk6jDSD@RzS>-)6%-=i9PXV15
zS$xQsG-=<UT3CFOURH=la+m9_JX3V-)<zGa;7R@yl=*Dotp;oj|0aA97)l;@KSd8;
zlTzKjT+#xpIHn5zU}YBjQ>`&gL(VMGXZ1zUgw7_ahNdQDZptcv7C7!cQshm(`%TV`
zV)ez(4tSjQ6MF0zo*5A7H66wc#ncK}X8KeoI4UBMo3z3gFe=+}oV(E*zp|0A`Pl2R
zCpq>-BXA-=M=Rx_S^hfnm)d+tQ(c9Hr&KmhE`lr^a_1xo*nUb*TM==|CN10)o*K6^
zGLHMPt`u{&r3iZ)1w`87Cf30`>E2I?Fa_o#Lgn5K&q#M?kYU!=5VLM);gcdu5B;8_
zc|(@eHH0=(`c=opK5jfmK6>7I797bep~&eX-01%Y>wiCW0f32&HfZA&3?_Ib$l6+N
zTC`E@b>kR9naIJHM5xO9!Wam6-;fo?75_h#p&VP<L3^}k$vlR3RmvgN4WXgbw`)Ma
z`#QbNV`Lt9u$jz(zljRk#uP(K{_@hQp8+0ToOSmbA9e>gBC9BAeWm`(+K2lH^Sd{V
zazFe1*LJ7m&d#-@y=)jf_BQtQ7yPBKn_0KHxf^p9if^*T&xDK4&YzSivM}`hUgPdl
zzWdOX$N<4!_<pG6M+DdZsD!}&Gw}~`Y3{F{)pQlWKWPZgNW0sv+-^?B7kc0)>APW`
zzvI5U|7##1t~rql$oHx@HC7lqy`r%fg+LGXH}&YUBN!O8?h0qzlkM~j;2g1+(fV%3
z$T;~>6;fc_>-0o!K2a^BsjCTwVJ@;0r)2<anF_A=om#8;a!j9+z6^f^deH*^8qPB7
z>gr0YDKCm~iZqea)ys))FLsYfUtC)Eo$=&2xn8@Vce>_sqQZ!6=U^093r?i*0Ns%F
zeD~SDtm@XI>?pQyw+Ysdzi|y}Ffep^XCJQ&u(SMmG&o6fgWpY!52Uwd*uJwGzQO`e
zh#SFXCfRw_;-AK}PZjiTggWuYH=SO@*b)ZZ?~};y)D&A#>^Cda@b}G#5;}k=!s7Zc
z>TR_6fg%PXBt%B+>CrV8I?8MrB?I2?WT)3twnJQ9ZQmo}3v~4o(iY~}>v!5Bp5#BI
zXPo%T5GqokYb)E<I`L*goVfJ)@NaIrwy6@O&I<DeZ#lK8F9IwDZAU6cP9Z-uY|g^a
ziWfAY?XwKg@fmIEGr8$4=X10+C`3`=CTymrq|$cvkO4amvFim=hxyF*>W{I=#(wEW
zBXW7J1cC(v+WE7z5Zu=uGBUGyqTb%`fx^`P{^tL^Oz-^ODPA)b5L*wQ{kd}w=^~W{
zSSpxTklu{>M+Zo4--Wfmk;=F%|AQrlFy~23gU6vwEa<M->ft^n-J%tRbWsvGsMWe=
z63h>OkPdD;RYV>95$3&Vn}9<yDK0(nH8???{IfJ$5aj%<FeqBlk_OQ0q`bcrn>rZR
z4f1<Qqp}W8ha%cKz09T&vMMEV%E*$6a0O-#&}t)GZOZ;M(z#DbWu12Y3%lx7UNxa2
z?<;TXESb9^Rb!4(`-witB8+k8edln9=d_=T;o=ii)dF%Va@d(?Fw6FF0<^Cuq^@x`
zZceXftKd_?x<6TgZPjIZZOk*`l~x4Fl)HK~_i~8&!Wn4tHzO5V*Yrt6orFb~YDv59
zxWlOgkg)D5g=FK{?$?{{7y%?Dva-YJ@iq~P@k<+^%AG|@^z(thA@r~Q7Eomi#OLLu
zM!ypH+$OWg-Rt9&$}nrnUIB%U2}<yED<mVYd6!nS3gPIAckK*m2b6Ye8a0BNH8`24
z2vr~=p3;M|TA5Iyw<ODGw7Amu?LFL<Wh6bvcKy?Z;*byy#xc4KsysWrZMX365;T9i
zQ=drynfd-}DMk^Rl$SeiTi&22fQ7OZS$OWx?~#6gZi!-2KR%^SCXG_~6?-r1s0?@|
zh{JI&`R?hRh6?=ZgiUG>(Zdw}N{7O^H=m8^gG`X&GAs#&riM`xTX#xxz==ma2VKjr
z7559sWq@e1Pex|d_#gav#u=YDF;8RMU8b6x+>`G6RpDCcnT4-7QBYWyHcFguB>FJf
zvGyMeTzDA_panv#$JfOvgM`Qu_Dxiz&3&99+qNtbXLn+7SR>GfWYBl&G(??cn@@W?
zZ51AQ^bM5DR41H&o*o1AA+#*KhjcL?QciglJxJauQ5*wiwLU0iwG$WsC-w8#K%sjY
zHeu~I*|tgVU`Gd;BoQ)v?4^)?iatg|NT3oloAiZe*(G=^ueUC;oHgPomK<tP{B^;I
z|JBj6{nsHs;q}b#yxp{B$Nxr`eX7y1g*vZ&%s5?`H&*Z_Q+_;O#IxD69)JICzKRFJ
z0BFs1HxzT`EV`fjPI>$W#F_Th!n$TdnZ3}2_5|B;k+XIo+VzKt30&>Orze$z72<K^
zpYik&G{7au8P7T1M+zk*7-@Hy193&xNk<?kT@xi*r>DG8V()&*?QIwGRi#i54jw&|
z+QkG}91HzJ$fOMCs&yQ0`nW~t%h9k*Cm*~S$2ZxHiF%<^Co~nlfoT<1C|Hiw+`Ov8
zlN44UMt)>A1`deWE?lwvWeYn*2Z`5IYu>*4+Pe!5MGV!xb9*Q0n|raH5t#|8njNg3
zKImCgk~}o=3cnU-4@ymay+G#4P#9m8VXT_;Uh^KpWaPBp)DF3q3_TW#vDM^HE2-j+
ze!t4xD?7}nQ?a2*<BQA&HlDPL4RpHuIfS#Li8iTC&&^(3X+F)f<jKR>8u~}ZqO|$T
zQ9BkpOzOS#RKND$&`^V8F{$mO20cjqELX;?v5IS+)#z+P(`p86(e1HL+;wSVAX@69
z+N*`w?3BESJdfJrXBVm_Zu76_=(bNTKB2@lCnup<?ZVT2jt<E}88!PR&sroI@QqGh
zE9#1YbQ^&XszWKfM&e?7iXKwSI72f|RGqn!BVPy`W8wy-`0@65WSDA~cc-so5W;w8
zYKI^IMJ!*!{bfNM3Rev3Y$qdDtIwd2aWhumP^&kUqCEuGMo4&Y`mW0enJG#5wGhLJ
zgPXn3<2{}pwh&`mH8ruil%;R4qT@CuqF=IWh$<tXk?m8LX?SNn*iUHI8odco8cxir
z0f27!1u8GR$->5GngI{u)R93OsuQ+o^l=kAF6K0iTLPr-u_{=KV1j4`bbqy#s<<@S
zWmEn*)tK9MJ8V`?hjNwFGb0iap6eM^sW<Q#d~fU1aQSLgrI&SFwAhGSJ%y8lfR0;h
zrr**Rc<cBs{S@4rakrBaQFT0AD9>W!S=a5jY1tgd-*h&oRV@MyYv!5{WK`etGtGv^
z#JjAw5w^;&jDcflBSIdMFQ)fhbXTaCqQhb$RL@-ai1=wm#3Arec~)Ckdj@EJ6O~94
zpA9bor_5YQ<u*si@Ujzmy_ck4Z79m>=3ra-cwM*+aD0)EL-Z-O%(zhb9*}zWc8|wi
z1?_M74tnOE_B%G_Jf&-A<cyz^hj_ZC<9asn$MYZv7p1QIMyrny58tn=iv8l=Haf<9
zZC%-|S5IQ|wz?CLSO}<_SOY`euBpA+4Dh`j7I&c9XJYu_-&OMuuSt+x9S=JB%oiB0
zt*C5>96jI%BG7MA<%4rlc{He64^DC%*YbhM=h)JJpM1U^ylH~H872#uZhDLgDE|&E
z8Ey|>DKxJ4rrcaq9mri-a|T-yT3QSN=J0(@BsXPpj!Ogq-BR%2li^2Dqw@}p)iB50
z=wh3gM-MCCPlOy}5Bar5`Do*r?-5;5LxAFUD0Gd8(+n+I9ZuJAPU)6q{0wz3xJ)Hm
z?9BdPQ7BgJ<}M-vW@$dB)ef%$!B>kF+81f-QL7juW0h><g0-)Gj#K)$p4ib%I>6ts
zZ-@0iW5xep^_q(<6#%J{K8u)g&pI-|9KVdz4lTQ>*95)n%bNUQ?RnbiPh>6|FrqdK
z2rxlhE%y>yeJaT21vi>nJp%^avvx|duO3`JGBj1lBrFoXw+<Y01G1Oyh36)SDJj^t
zOdbc*!k3jTSOVZ{=we&4O`9ASn7^aik_T=xN9jEQWL48%tARf9dEz(dg4ya5#FJgn
zl7^l}ymeK~0p+*j%DWK;YZ-WMV+b%B34j9=sXaH<w^VY)gMfj}l8;B<A1tHW&L{tA
z?ACw6o&PWVJUTWiLu|5wPpZ4MiLfI>0Bsd*n<sFMGI<B7-u?6uWWRQ38Tizc+C-%A
z)vGlm>R>6}s9dV@70ddN_$xqaGl!Oe`pfw)Be3Urle>$&F6-PFnzNLh&a)W^K4(7)
zGJlDrTPC@?Ek`25X|W<pO&Kx>@;1J)Iu=@BEAcHaWxI5z$2LuLe@FdwNR7Pd-tT7p
zzd;GEzimRZSJQIPvOr$wI#3>ZZ$1031{PmY=~p4A#tqG0{P$72vgG4c-~HxLQ#)HL
z;HVr7dvV`zwrRM4%u_dJw#pjm+|qZlW_Mg0RTbtwnyZ4pUF%~4K+I5+8AGizA}7s6
zC-=h9c4M>l0SEX2ylyS6VEZ#y^8?UhrZ7etaoQ-RH^_=wqyE?BGNO&^G7{bAz;NFB
zLzlE5vno+vADB_hl{zxJdH<j(Ab&0Ms@9jYTI=W{z$`THFRsh*@n48c?EmII{-4Qz
z^i6-43?i|Kts{WW&vX>TG234K5-pefW0#PaR5C;(8W6v<l-~!%G<N#ynV84=G2}uI
z+k6n8PW@6%b@7A01)Nw#6=v@BOuzAeh7cF;pW-2rk~JFdJ+U!+P|f~gaZXNt++5Z5
zXN(d)D}{aoNt+xQGpabTI;e?Pog=bjyYG!}eNPIV`U(wqxxDjIox=_e`BDw3l7#4f
zl~l>Mg6I6a{6A`=Yl-Lz@5s77HSaM|R%R?Eg<jS2@n7-9`jCGC*OvxF#16(HPjg5!
zPp)^jQv4&B6h-=}ce~eKFJ2Df8OdM&Ry|Q<TkNS+A2w>KMHatN@?ie3(-Ew5%Fz(p
z31jfXS;;-B<nzIi?4g{>+ZVqJpb4)jH|ftGllbhlTYKy_8EHFQ@T4jbNV?0GT;58*
z565>qGdDsvhX-&aw}Xf$J@TJ&e78Juc#D-3zv-v^;0X;|vc(AvXO2r!h7hKDZJiG_
z*K$r-bwp33+(C5qL<ttocabE2ASinU&VfoVI~LXL$41^hfrd9I{@fn0s;mqYDBqqc
zd-%*FlGiFuz9nu*S)1yEoaPFQ$fc6|d5%Xv!LI)euhiEF321%)qO8^m_!BFN>4Uq#
z{U6t}9!0jSFdtoUm4&9`B)MoGJ|S&RoE%Vd4l^$Kk2)qg$y(LkQyKGBflfMeVj&bV
zgvAunnLL+OSsGoI4;X+Ox-LH=RGo};^?Abf(Xbg;2J9`GTeuA9A4P82Q48(L9<2FV
zm5OqQnKe;X(NV?KF;P*CSeylz%w_1c@e1U3#fiabzdIyaY>TO(x*>KeI59?ru7yxa
zI6nI!&@8o>-}{~pTx6ze`QtovRySQQ8`V?ecDtIMiijsxuLN^7UspRheT$@jw62*U
zYH7)aEG@6w^(UU>Hfwi+USd6LXN^-=!NcQ%%t+k%Z%p{^ZCr&k(^tgE*^3Wr?b`ru
zcBN&1unI*n%_3vQ0h85wo$dVjf0_K!M5XJ+&`z}bg@0PZ@JxP0g&K+Eof<iy;O37j
z*;k@=eRgO-%NbenxYpn>M&|>QCeM_^M#PQ~n?@}?m_Rp3c2+MhBF8ar(1}iI!<xFA
zx-f}0aVT9diK7Ky0-*>nIiJ2S8pbFCu-*)L)|bx~p>`+C5`#>95p5G$(iz)7cB|?t
zYa;aNde&(-faF|@n#Gx@H|rnG{2jbR(+XwqKSO5RNgf*S{JLkuI?(<2yu`M%_4viv
zlU0j|(DH)X)k4-ze$1`1!pXK7Vg*jY-bP?tHQW9{;~gfeZJEs9s^OHIXE1pn#;o4d
zCsysZov7uebDM{thhJ=_hXendekJ#_x5{`8()wcnuQp&$On$ltX#jc#oVP%8sEn1e
z?_tV42d->?6E7j!f4?uaT=u2ny|-)o%(cgRuBv3=+RMm747ig(DpI=qs&yWjwlk~I
zmFPa&b6>NooF)E6vY$g>1JWvsHcp0H^ryv7Q+t2x;`dXtm8Hv0-FOXhdgGkqj<j6z
zGZ|0K5&*iixGz$@Yj*8}hWq7Ev_p|G#bc-LK1f8`g7`b%nlw?FSF-=67^tL+7V}7<
zWPWwTGj}5EIHzAtcyB4{kr``&t(TN_yS(7CJE$VXGYj<1xvayp#JeQr%a_T~jW=kw
zOpu|yPbg6NRfi$<gY1J!q>=G8@m!ug4|<s>4y8CM@d_M;m2OvSfyp65{xwLyP&hu@
zgRXS_#u>&KX?$ArSw++m0W{}JB+oc9Q*=9C5qF)A9v=v)hA8t2@4?~~PZ5g11&k0Z
zZIqR`JNnmbkLH~fP!_!E16rz$@lA1UuJ^GPvo*zY=3WYO6ekV6xO*I8?K}_A!(>o9
zV|+-eHT(U2umaiNjOt-tmw>UjycHPv*KhU*L$6Tx5xO9ad6Sj6V7~z`eg-X`*+!<e
zTkfM7AZ-}`qfS`6@nU$D@wcUO4;4SXm3M*qjTKCsy135jtlf{}pH_}FePQ9r|MhoD
zEUOblC6-gNm(1<`SVyUBCgGd)(Ct`UE$}Ju_3`D*y_N6M@B&kgm_4)n?5Iz1Y~sW#
zu*p2TI|2R+TyVJ;+PY7>v<zz4@%fI5_LsB&O~HkS`-yU-asd@O%@$6jtBVS%#$Ce2
zT-9W*-4{pk$$XKJ+0#{XqQN{hM+c<4&3L8h1LSDhOoqYgP0rIiR9=MsYh#|Nj`Z-7
zCGGM3Q)xH)5A-oaep~d>boW^$tT!7i+nTtjxcLN#>7DQAgl9Pga9ns=<pRy+r>P1_
zk<=tz;_)7dwd0~l-){~ahM5v9O`#JaSEiZ^S&0gG^x)9l6!xJ6=ecAdvhGTU=XEI?
zaou07$Fk%gT9%{ke6Djwl~?SGIBWQ_yPwgV!8v807mT7uGn{!oSJ$SD$;;T>^+LQy
zodM9pOc*~k4L-hTx{8$JuBE*w^sOb(VUp6d&P!MWun4dKC@LC2Et7I&7}I?#NI&z}
zSZ$s_#<#8wkBl{xirgjM{<PqJ@6W?6?~RAVj_dTs5BC#1(-j^3#qqTFPQ^9fYA&ul
zBK8+YqtF;#&#!4KmYOd)s?(Q1B&Vq?h;=iEQ`(pKM~R`iiGe0ZmHk6+iWy+bhm58i
zbp~iIgW*S#T_n$W#`5|l<}Xq(wj=4WJ|m*L{zmg$Z`c^*i_9sYj?($jlXcf?8Mxk_
z>HcD=uH~6+=LnZkk3t8dX$p&G`k2#B{nRX;tfjWq%&@<w&9Z&GJm+wtwdi&R1zJVg
zULdwCK_3Xi_V_|quXs_H22LzfCv0BuDBh=y*gGng0n)x@g8&&uq;A;4?6SmG%<0;3
z+u2ctZUJCG6>-u`0L>Pp1Q*B5h*ksRUB)}kH@OQisFITOlu$kZAC;4RiiTbpNoTyy
z-Z|c`Cg4s0^o9FAo;i@BS&Lul#EMYSjqEAcil@;<Bow}Cla3;VpW=XCQnXP`?MIyi
z3W`)RiJ#uS)>(O1=~-8KH_wbG5V!Y)r73XSgU-}$gkPS`l_waj984%(vIoW~xKoxB
z2APi=|7v{=>~a+VJMyY>vGJL~&lKI&=_MNQeomv|H`rHQvu~Og;-|&;snE%NCOQW6
zrIgyKlJsaEnSB0QGppm4Qax;TXV9}|eXS8Xm1ns*GjIIz!ROFoe|e$~uy*)c=D5Nj
zv`xs5nu?nGYHEj2QEESRjA5>AVrS>jw+rJd+3&GuN!3yAst13Yz$CyCD;kb9nRS!*
zHoC5Ou;&lf$nKdA=#XMO?HV$&zFcWXs#UY|<VS<$Uf@5!2%9ssF#N)QusYRI;f)TW
zaTlr(^N|IZEDU7=2%*CdThC6brn=Y9+_90cR${taHYRGSvE3JPDQ4h9(EwmvwUsFK
zmYs<jIp%-w7UFB(_~m~D!T(o3hdl&sZcoY(K$Rd?AbZ}ll|@qnF6m8n6oj%9X|XP5
z{wR_TuK-pI_(!@PtKQh_lm1DWvU!8jkJY}vw7YlBdd+1p1h-ry(M^&lX~0?QaSREm
zp@72}ENd}<<F)=J?WuEfL;LHTNh5WDebZWZeSL1%WqNW0KHUVmLNZvZQsyzh#K%V1
zZd*7mop-Ji-SF(EV0LdG;FG|wXs*Fp8jq`Q&>{{ufPdETrrYg(q<GwwogWX(RLL3`
z5Z-@hzH2_C2%`o#EbMr>Ii{5tecAa_I;uDy>%{*))%joIclA$E$G_fM?apo{ucT9+
zchJu7LM-w+jx|`_U&$w&f<Cxv;iRAif>Ia@RyEZAV6AyYJ$^5$^{9(woX=|4BD-LL
zFko2xvKN$<$5Pf{pw$%{wu@SwI|t$vzmzUON<bS6zc0R*4nNOVx=@z=vi#9p{R24`
z9@f5Dr`DMrJ=_su{^TIJaN)wZUSjR4_t^jI{^r$n)oD$Ijv{pH&3|<d_s{nS4=#}v
z1I!hsi77@3V6N;7{~wsEY&(KNW5}GX{UM9tayqRft22!$wMF8`<v`+lB?H6)(?k1a
z0!sCHb$_t<|3w~e;|<9-l80Gx4?DO<vgtAdl6v8yY-f4=$CD8k<txR5-EDB1ew4aV
zVya35=_2&)=5x(mXD^Mn13nFRH>Bc2tM4=={FTS+{V&SnasEvGU;SJ*tBmgGGn(^D
z|BOt>DP$FTzU^9A<>QxFXQ=3kPxam?>c=g*l8@(Qa(i_#e94yTsR1KwIymuu?`~Do
zryu2oN@OPG5s-n!7!LP^6^__s{s3%f)2JBKeDz(qeGo=qrE&rb&_~GFGGCjci)cWP
z0!Aqh6yY6wVjK7hpctKIhJ?6_2UmCzsGrUm#&Qv#0@kW%2BD|dj{riKyLndEDM^d|
z_pexklLFQ26m9NxraK@((~mceX#H0T=LuS44$Drh>%#D{rn(=w@OvAdy`t~k0CLg}
zP~m}c|D)SJGu&nu&ZtULw@!`EF8Ow(z}~vIdNis0i(+r_5n$p^a_3pq?IYA_QquP~
z6@riBN^iD>8e?nOkl#nm7Mbp=#aBvXH^fLy&sKsYO=92Q9&T%5S>{MZ{I2c$yI;hy
zP|8NySignT|B-J0uY2h4eMNx<)@kHwRqjA@CB<>fY&LuVx&Pvt8T0|UI(cPzmRo-y
zSIHFH0kjxmsikO{H;BEp&46Gjl>)k+d-HftPfEtyn%Ls|Htb8Nzs5+O6yGSfkJ{0)
zH=qzhVfVVn8tPQmL!K8Om7#2_@4vU%+p&NPPhY;aihx%0(-?r$F?nq}D~KZGCViY?
z1|?cSo@K_AzTmfp&&d1Ds7E3CC3ra+aOL}Yox0U}o9~oDo=3O)=<OfmReaUB&#m7m
z*9oE|b!;p*|LUsfZH%w{q(4v!nHTyqyAlL`6q3PcQwH_waIyP*lkqzm(=D35>hypu
zAE011yELVd-{eK6%6L&?g5C%V)KWOh#E&bHy}Lm%zDNc&N7BvkT?-d&1e1-PTbEkD
z1E(Zd4};7DDn`1h>4j=d?1BcZ73*(CmjeOEH53~P9u>g!KdwX0D>v7PwuvK9;N(f6
zgZ@MTRvN%HiSh|MfR;N2XYqYbNC===o_qpyaV;Em`!<SIQ+%;Zg7maopMciDhXRG}
zRLG#qz^9LiVpFJ0$ZPaD43<$zjw67Cv?J(|$vZ~&mk#ZU!v6<*?;Y3V)~$=8C@57y
zdR0`UORo}HNK+9(0qN3(Pz0o7q97o>DJU&Ukxry{B7}~Jfb<?Z2qx4(LOhf8?X`>F
z-skRf?)vsQci;7o`5E9XbB;OZc*c0fGh&a;3~Ji?`<}ol58dmpUC`2g<Wuc*@4d2t
z|3(F%C|9;HaS+(C>$h$pZl-0t)nc0&&iAoy!A<j4);MXBwKuq|8H+R)xahy4Y^SIZ
z_;P>2!O0(=Dl9H_L}jKP@Dxgun9-qTPz>Lrr8lh_bbj93^S3-#&xeU}N!oV+mrTm)
z*7R?jz>1H-umG6cAMBfdh>Oqs8!!nFOnT`mqJGi*u}~+MO^8*|t2p{iq+g$OwKVkM
zed5Tx0cE(7XwoB>bruFXO{U(P1v-fuFj;c;g0a4dE|7ilI&1HD#4y&5JKylEU>2|r
zM{wPoZSoLrLBmWRlh%_mqvkUH#~p^>?`8<2B+GWCBar}im?>MkIo4&m=v25}f8`Vz
z*s!)@bRlGeA(EUgx?-ODGWK&NLrRM6XZ}>WLBMM6S2s#G22T66C>|>O`%EFI56t}8
za2{-RgRk#(`%t5u9&mKzEX`v8mA3qLWm44U?&VCz(5m_<iTYlW+5HPRNC@}j7!aXU
z?L1z6$@hG$l07sJnSCmJRrLB3OLJYoyR0Zn>6YI2i!)R`m%I>LCR{q*kmcfI*s}H{
z0t%o<yY$4wINJBL#xd}YgN*eO`yWd*D6{>Bffz*6b)(5j&L@}4TJDxDh83H=$pg&h
zd7{>AjnsbRS5Yhe3U}QuTn8|fr2fW)+RE?^KF)VnrRRVs;Y6*|2h5}gqr2m>L1X0N
z=gm&FtpNojH9pJqtb^BMfUUj!LJ$-=F4nIoPPkbpWPOgl^m5%6X#%n&i5ub$UL$dS
zJjUVMPWu_IiFQ=bQGGdD*WVCYY27sK=|X~SoBnL|%N#C>hF|@nQz&wdMSFH!qxFfd
zd*72~D$cuaG&6+v>$;VwaoIZQX3FlX-D^6kL+hReDl{Xa8oa|S7zE9=f|PN!F79`R
zZ1%p_UNtX{R>loAB>grlQc+-W!PK?wl=Q1PL3fmDz%?JM^PTrRT4WW{y1Z(CC*<D_
zcKSg_$$B{-R5JBAEpB$gy?l8M$>Vv>f9y76j?!GISpsqafb9E$Rn3!5&en1VDF{5|
zo-*l$H(lu&Nobg`48d89?mm{*@7<;tZwES)YGx?4LixGBl9^&r@7sN{KzS~;M-IuU
z2e!=<ziE<fUMna8SIDaJYA7{D>Yeo6vS#H=$272hk&MpyY>=tIBpmbZiL>3fVI`})
zl{`fa{G5-OtwDV`*qg2+Wd=MI!HUu%Ka<w#pB_=5QfN%6M{T{x)GDXo`qt?wGk3Z8
z)m@K?{lnKY3AMF|oSWOzRQMbpX78fj>yGW=^}=N#^%bU9S5Nxh5{~V-&k%pUs9#^d
zmoM=HgP)VX{Y#~56nT_myks56cn^jnO~<-zg;XVCRoaBUDG6b0UmLWof1ErfU4nto
zw&u6kJv;f<&wuD_?##Z?ven~{E$Fd(6PspY28dhLMrWhHU>Z=j2AwPX_2p?m;vcJ6
zVC1y$$X4%^wEwNaoPK*+4u+hHC*LwYAi2KK&?(=~?&Pb+$-Wq-^|z7dj1~HvWuQLJ
zJJQ_vqQ3&FZT?N-%$=)h?y!s4RQJ%jGE-T-lhzt%hU@sMc#;I;cFUuoXzq)NZMx2n
zJ<jeRjgm1O4a!=4=U=}X{!*rTQG)eD*X!c48#oRl^rfQC!zpx3k(sH2YcjtKwd5<S
zl|hKS^69HT$wCSfIO!`Up6@rn+BEh~!qkWtOT)#+64@{-(miOHe-Ery{gkoftu3LX
z=39FnP-x7NO007IABh^FEe#SCErHgjeYdR<D?J>nq-FVzo=PJ(t9e)6w0n2J#n3*H
zPG+B9euwG6%z^<nVo^m26cw%CD)I9~)GOvf+gmg6O}l{ThWxnCvA17{^6zDBf8Rsq
z`;&~wxVFoW^ZxDzoy%3y$0+ig;bB%z{(2ZLZ@t;rB1-PMMfT-~oHcg{N_`CjANjF6
zj`d!TRx+Mqz^;>?1CJo=BjeK=3|w}d1Y}%w<;HhCQV${x$Itzv5zGJd`i8v_wx48}
zB%Jp%<tzN%%y09!ME7gyOI9NmTs;m)7EYljhQAI1;w+OAuaYlzt%aMBTw;|uURZwp
zF+zzS8+U&gW@s$6*4jJk2hqqRvh{`sy_W56TpM(Zxt?Wf!12I_yRCk0mL;M$n#7Lx
zZ)HfGFdNI5u+OcD*t-`5*r7}XT`1>s_J{F}qTeq{;H~dH);Qr*Wk-75{W4R~^U@uY
z55p7CJC3?~CXy?u`41UbKIRzW6bbC6wXh-7sY_nMI^j=Vcghp?uAqicm4Y1~|Gc!*
zf1Kh%^5L82Kr(`I*<eg3gpb8s2zL=>*)P&7|2DKoGP<uBr5G>%m75MaP;u=hT796n
z!dcI=vaB?0G1*Y=ezbVa8^m=A=%+>ohbod1j&`ZtmGS!5G<8YnJL3-divFgKSJC|w
zh}87%XLJMM+nWdCS{T8Cwrh%w5j(J3bsC}<TyH*}BvBUtsbtB4Ms_?Mdba&Vk&>+a
z`I=Pb<c*d6_|=VjwGOGN@kX^asbmyB#k=7`Ar%hyQ}SfJcI<EPX1ua41?k(;D}St=
z|BBBoo$zV;VGK)fPZZDscsNwP!n}8@fyZxbm)ja-C7&D)b1rDj@!p4@Ch^L)(9^u#
zxuV>JT+ypYEVA=~`gi!a#cV*PR6Cm5v?v;s8(r{e_MV_;FP7-`)yjS#`@wgjwliyI
z;#W>JpL~T*7oBTeZl6vJBLiVmh(X&%+|C*g!9ORht}Gh0@dxcsEN(lB$@t6W@ZIu2
zQk#DI*aGu|EY%t_P8S0`g+Mx$0_ph*XSR_y0J1&%_lD@_@V@|^4Afg!ykPtKHJle@
z?7~m7S;|l)Rp0k`5421rqPq0$3_-2+^DV_&eCJPo<P;40)O4h>jyJVnhA(>zL9ohj
zlISx?ov{!eAl~3soINS@n)OdIa<KR?%YXk3IiVs0^#b{C|32p5{`VhpIlXfHC@!RJ
zQL$Tx11hdfO`*ZEwea8x-x6|-hje-nkOhI%H{7;|vW@#%wQTKrRL{^`k0(A*L}~S?
zkTt$bBIMc#<Mg>>d(wai`X5!9pS>*+f@0Zu$vwQAQIl+bwnA1Oa?hgtj)V}ddoH->
zOC0Xabo-`nQsJkVwuaRAgx;_CV)6cSON+3YW%nkTB(kU=+Ms<yehh+EczL)olLkoH
zATMDdFDp1iF0{EXpmQf^pHgS7R*n_28JtMZsL5{{K!~r*x=G>g-c4NUt$vg}9#xDA
zJ*vC&d6&oRos&bBjA%7y5=-em9|8`@?l1UxbYQ&56RrFL)h@SmhU}sC0kW*lxPPK+
zw7*TM69)o1`a0D397_;Lo&n)<-IJGY2eKJgo2_&lTmivT$wdtfBdX5L*LfmKiDSCL
zH}W`f=I=2G>eH&`Mo2zTMQ9qR`KB=Qgj@Kw!{9xQE~}4anUdp5vdGpvlT-Ybi*)io
zjDQ$i?SzoIF?}lVQN+t@61zOpDcXca>lHDlDl|{%@l0Jo+Yi+U-h0I(rDIJU9_8aN
zu;KHbLFGJWVXog3q&5f;dmpp+nb@Y$*1;gCgjZb)ljuQ-kzp8b5)GBYu=bp>vOWEe
z#~z#Z4ZpMRoHW}oa?%*~=oICYCpc39@)G24z}r_11_e!^+OBv=3hHb%fu)XXDt>VP
zHGo79BBhmX%dZeM0#&3EH&0)Xd+ay-5pUhnH`P`-EE1-{v|yb0*5kvSuQzj$6nQF=
zO%mOw1wU<>z2;+&tC_QO)4#eSZ}ekqDh$x<Bw}Ts$3oE+*N&)v;<xD(*>`&Be8M@F
z4W<kZS8>L*Um_@qTvV@Yi8mDsdfIA_rjvxIX>QBU*3A03fXYo%;g90u>1zHVVMXJs
ziEAD7e}hD(4)@CSklpc;+D9dzoh>D@-Km(`RlUf;zPTBkJGwj3KG!F+dCjZH`;j>B
zeE6ol7VoP9U;zGYp+!vvCIu86FMr2F!by%U>l7EcuKzIowpzY#<H!1)#t}U>002={
zxC}^TRRchDJ6=xg;n+_y1vz9&RusmA1DPbqEz}nPI<m8YBDn3#X@CHDap7%rdRIvj
z#+9biTFBHSvd!PBI!id`@l5!Ef#$o$7XVQebbt~`-|zF#6t%9MPx<I!R2?5@w{X=D
zhwqO-0VFLOb5c~hm9}5pnF(}Ih#}LKJimNfyYaRwHU52uZF#*D;0FF)V>T@E8G&6r
z>yv|~b?Nc7Ly758I?iOqtuHXBYkEp=zdbYAtb*pFIwAm?6`4*M72n@Eo*(6TsSACz
zTZAxXuQ40Lc<K8sSND-vx}DL9aaHfL(JD0$40}qnFV#0c*o>}Nn_|OBm}iWeR$k;Z
z@cg*$-!U%oxhC`bDyIdII+8(1nqHS=n<p3woa?2Dkh+m)KDeFMT5cHoCY$3`I1a%8
zaG{Jrb(LwGFQ)vxMT)xHq7gJ`_tlqfK!IY3i-5KrSNSA8=*a%GG26xJtxB(|g#udm
zW7ox(uWgYQpu8}C|71~9OGK;sg&>_|N^^@hc}V-aTMgbfYWj1;V~vG(T5ZS7yR9FW
zjhB#FhaWKN4Ltm|KE|f*E+;)ZwixD?b*H;ZoO`E%^EZ&GX?<(kpDpHad#8uPuyV-x
zg!>r_)(h1-=X@-_7Y=(xyi$rYg{9=`e3%gWG}6?0U|6|)&`@0EP=N()O@}02<aNJw
z^0Zu2Wugb6i6#o4PfZrhb)fPEpH{@>>=M)E$2kZF`fjuKdNQ%$6H=b98=h*3Dtc0<
zZ_I5Hbz4MRMmdp!qr(RcD48fQBQqZUHYku<Qv<WmkQL$JHG1!B^3Ll=t^gGAh0iz)
z#Qn&jF}voi>>#(Ga~Eo&Ik?pCaw0CFta_&y*~-lf^@es!b){=EEq!N=&321^H=KRC
zEu&1?s)D`RVUkC6#V@<E$f@`RgT@6w5<7>tyrf=N&T837W|+QwP|=p)Uc?cQ1<=)G
z`5NJ=`lyXMZCpn&d&z47|2iHm^#-N;^87VhA00&Io98t{SIi4Q4zaMKvMOrpNoRh#
z0Jh}hkHVycZ&X`S4!p56&Ynucs*#R-oqBn}dByEDYmMAN`Y*fbm~Y$jHTYB<Mveuv
zolc@rVBZGG&n#2HG4skH&g1?=yAAKgSHC9RRr>xInx3Y0&&&S(%jSU=4Y2lbJwp13
zTW@WC^ID2CpUZL_Iw-3B$Xn%RP7SwJMu-Q_`gF1t7~d&y%lgcH`I2Nuarhfg>CZ8c
zlQFN^Hnku5Azl*2m{z5B=bX|9=c>HQMo(jE^jHNJ8=v<}M?AeVYWBeOnwlLx23<Lp
zR#?cw;H)$(&AuU)sFD4~wxozs;Wn`vuiT1qC}8mO9e`g(4oeX#_AO_e1)ju=`QLg*
z!zes`KyA3{_jGKfXL1n{*V%m5F*1V?4e(8ea`hjMhtNK#!3|tQ{(w<c<>FY0sIr2C
z<H%1Sz2ZnjoaFe5kA%TT%a8F8&vZ7rMnPAV<lx&27N{K}5hPJ)#t((&emlqsjhXkP
zB0bOjU!Y(8$A0kt3tyXj2?5-H+)exs3_Y5E|9mCN%<&U9<*29h)M^l+<a43&hqnZC
z)g@9FoHb#fnSBjD%`8y`I;W@s@|?yT|Fil4)TPRgcG$@+zX-&%Q4E2Y1(VJs=%ROH
zMpH2JTmikOplkapTU0w97EhZ|TiI~^Ou`uI^L+E8Y@IS9cLA|c1Gi7O*fS3s<e{`#
z0T?Ib87j!48BzpyWg^OxK6^Yx>?YuKAUa~LwTv)BY%*!?s42-GiLHOwr%-pJh!07J
z3~!^A)wKKL%<5)Qbb_6{<dk-^4ctw6E1iNu;xtnw54~X7{n@$;*=nb1ZrS)wx3Jj)
zLGO-6I)`HTEO%d|VdJH@bmWmgsy?3Zj*Z&%yE3!Hd&qZASA{{9>eO81Nqya5eNHm6
znPcYOSmdX(L`7_t-~Fw_I)nPSAJU3#3mZuL{p?u8Z7k~h^J(c7rqMT67uMC2nz-tx
zjexs;F)o@r#V~ab9%{Qu+yH@S-yF?9G8_L@pZ8g0hW0A^N2hL-sVGRftItT(UPTL$
zH=TH_rlTgcp35T>AX8I~zc(ijI}Oz<d$gBf(o197p*2bN2N^EyZ)CXP<N$p<40VPm
zI>elC7-T#!Z_*>W;{%0`_(p9V_QMPSGWii6GYe^<z=1$T<UuN6!)@mocN_eT4W~@G
z#{<}K59coadu+JOf6a#L`;XXgls~`zGngRX2g<I2AAkngy3Z1+#sP7lO6yzoT?8XG
zy4E~h&Ye_18eo2G?xQB+!VIZ2Nhy%~@jxu$Qp+)m&yloqCm&D<YJNiYLGS`g-&JtE
zZ3xZ{m=sYMyD%J4jyyANqTxXs=sPS^#oYJu@z<Et%nNxm?`GyX-4LJQcq`=CG%1We
z>?ax42=bGR@j5%CvJr)4X_+n;MHRw&hTM$s5;j2(E1!)UH*{R*_xHJ(7cJuwQBE`e
z?AY<fD)8JeK-$`6z$T%^IE`Qf2X-kQ7@-_x)m1-#3#mky`3bMclFo%&D5b!t)H4${
zN3Div^a-HeweLI*LZapefaehyWWhsFle`>@2hB510xl~~>eyCg-Q@()s@z-e+OR7z
zZUPlrbY>4l11hX117~>r4(;)2IBL>q!czjpGU*)FJkFA*Rdc=QzONTea-m;f+-{hQ
zm{Q5&jcHkKYk`y3btCCt!e_%#Q24<`WpL9bz>Fbk^I%&oDo}?EJdB{2wiHgf{7l(0
zqcQ#8dmcEN2{!bTY+Ew`R0IZgf?fy7WcwlE2mU11f?Y5U8LAjKks17~1t^OD-5ZiG
zvXctIJz}Oe?GwRxaeo8<q`{R95GC~M-u@m;Sr(^=>M=qmDYTUz#4;W(J!aCV;Wgah
zAy5#H;aI+p6J#Gj=!g%OJy$MQe-rDMp^NSD8n1tc4%z%F7%wM$n$zl;a{K>ehdx%+
zkK#o+vJDMjZb;UQ6+F>`q`?{?H;J}~C7UE+VY>b*Vae?tztP|7M{yIj#FMK}yJw*S
z?JuOdzyFAS(9}^}pf$wbzr@fo&8rk+oP(txwYNg33x&0&FP@!21n94uXdtv|Y&`cN
zAr+|uuio`4M|0m_ZZ22ko&?D2pdr_jH(s8p4djnzgUm;d@Xq5g?y}2q?xhrm<J@Zg
zMZpV=IZkCaR4F;bXJ47}fUFZc)A@*;Zjs*9mp&7LRJDe=_<JqO%ZY{>i>z!?AdcK<
zx7IEGJ3bp+3RESEHmnup4jOac)W2Gx6!QUQ#4`B6FcthBNLY!mERx46CdZ&*BBqyK
z&$;`Y7|xE0|DYk*Ty6YX<|$JiW`#$h-sMGR<kg)5X4&|WFQON$vg!GT8iaty#1Q0d
zb9M5LP`5cm@HS+MOU>_ofq)Q?z)SR<7rj1TJ;$F~jR^3{fhP8fAWVK*xA^-ojY9a=
zQ$^jBJGG2$k0s=gPx^K=E1>$X?|6JOJoj#;(Z;{p_-pIHQ3QFrFjlKPFghoBhX=q%
z*tp^_5Kqa*83wn!n=%$XHIJ#!dl7qEHJ~`8_UTycmQumDW_^_Ev~(If2wgAB(%lco
zap~Nt9<YP@CPlY3kT*{W(nbgkEj{~Cd+4fOIk+BexCC-WdEXuflwP~7&dmD8|AC8-
zbj7#I_`=u{J;mWNyer7L>At+=bQ2W<?eG*)p1Ym)uG*Y(QrdWE5h|bf$izD4=33rS
zH{Q75wmUD@`KES?7^d~B9(J90Gcz2r>Sx=QqNsZ16J?M&dKP)+avoW@I>2W;MYOJJ
zLHbqahnL8MewaSVuhlD$@!)t7ec`A$i!H}da>b(%Cr+IXos`lx=Q18N;jNTsnmtHQ
zQGP2QqPzJmS-rq5`%CGKJ5xYtUJoesCIq&1y{NG-Svdm2W(DTPk(%{0h6$SS<27_t
z3dwtid<Nit4Cg!BFMI@G$;UMl8e!WKRAi}+5?Y9xjOre=U3W+w4hb+4rm3uQex*dU
z<2o_beEL{lYrwda<XHE7$JGvK9kxCEV!3BUol~37i9tj3^i){7$y;Odu3X^1)){xW
ztQ!g}3q5DMw@ECl*#5NXYDxR7V{m>-0E-@%uPf&fyLU4fUUuHj$QDtaQvwNA(!1xJ
zHtzP-u0ivqOU4piq|l=K1DV;)k4SZZ69eKa4WnZH7;l{ot!iM{{M-kbynh}rIMYFz
z>MQK~&hctF+r-J15{BZ?<OBU7j@-wOyPE4$jy!n-!0+1R)?|9%x3_1b)Gh*`AQyj#
zk`C7@weL7kZz^tH9OLLn7NAh2+HVxFsf^V+JGN$ynnf^b1VlIk`1V*xaNE=j<B+&0
z2pzpIhdPUQca~949`!gYU#vH_ux`ij>9L0Kf%@W<P;R6|v3`h9TYwgj>FK-;%D1GQ
zHO@X|>wdEk|KTu;j(~<;1cWO!Nh=jI=Jz?qt1{~}Yjuy2X+_1^Wp8v&qec8>Lx@_;
z*$ilbmdx<B3TA}VozE!oC{2Pw=$o}<rnc9QTS0|VXn$Gxy82TYkj>;)AjD)pCC^>K
zI)aO#<vH20haMoMRc#sB;%9h=J3qI^#&<vD_<h@T%aXM*8Ki5GvE|1H(JIAat>&zc
zw!Cc+Vs55)lJX~3ys4$^7kV!=ptS~zq*F`_j<;AQeoVE!Y0ULa2+(p9O%Tc-uMpD;
z8wwggO^@-EetC^NDBH=zSe(k8^tGzFhBJTEG#lH7hSKc}cOR+nwC4gMo$0}SDHgZm
zSG&+_<`y89b56w9rk?xVQ6MOLozvKiGv_*VC|=VAGf`h)m{uhJ;Nap4CJ$P(r6_Q(
zB;-_akjk)Ke~v}!o3MF9een0?{z#{!=o!Q0($|+xHE}^}?%y*|cFY!h<CvrzTUr~c
zSIHniQz*~01Prm}?y%Rbrupziq9O*+QfIB>${0P7PL<Vx2NPOs6UedZ`RqH!JSunY
z<DS&m)@(hL81IaG?J2!x&Vb{sQ?Y+CEjPnx1QWq_s~c~Ab^}2mUz!1vu8S6N!~J#g
z`VW?UaH&{N>5;uCD0(-!@WkuGMY#+0w{!<wq(;XC49U1@{i;F&w7I@pO|6t%nK78E
zcn=`i88m$~t%qKLpv&hSH#uXU{DAE}B^|B7VyV2A5<sL=^Vd%-qj>+Jd^TjJ=0d%R
ze!ok3-rI|&IYn+$S8z6@GuVZp!gyyjJ$kuyGtu~hLLKf9%X_q+^PK`3uv;zKNZ6p)
zYz;wa3lOQFg)kjdBfL-`{%YHBaSg#58tLsqtF(^Ti-1SLYWd+s_Q?e|g*v{^(mwj~
zbmRbV)ymd>`@@w-Nds9_o)V21h|`05a-KlxN!c6949<7Ic=9Oj1>%jrZxY|k6B<=r
zz9>X`Bm0x_bGtQ%<@MwQZWAB#wRYpnIfcmZbeu?A^7+e>b{E7Jefu?rzp%FXan6O4
z;l%L#G2bC`(<7@(?Fsl{ivf_!YZ)*&ma{)yD|30i62ya~2vd*SB)=}Aw1qJ6QI6d?
z{8NJEluvs1rvtjYjH=+w@_3Kjmt?W#Y`=Zqv`NT$<&o;iimd#HAhiD#gh<{2Q^Z>>
zwOUZ^jB6|M>6N^+7?n8OsVTKo@_#z=VY;mjLg5qL-L6d2ucSi-Qm3P>iu`wJa;e`_
z5^@AJDqN?hM;sF4%~zAo8k?v~Y~Ehubi6kDk{pNpd}z4)4DX2@pQ&m=1^2)&zu(m@
zHhEN(^IXc=-kY&r_;Sbfv-1xhkIp@VPBlHu$9yaezEU~!BgYOnSC{bVPyMjj`Zw=%
z7Caq?IUR}w-5L;iDKiw?qM;p^Kex#QLje-v3+3}eCYZhFi#6XwFP$!4iS+JT?_ZUi
z7~WGcKfU}P#i;+R@6VW-nLGe}OML~KTwS6r#>-RXzLfaff+ZurIQ#`g<Lm;vf^VCf
z3#noheM{A8JDcKrj6(7DdNMX|dGCa!-<crJKw3~bQ3u-fidNz|-rwwe$gDWcFwyqd
zs`QI>IgNsry9QtGoyRH{8ef)`R}8H4ek=)lSXrqSedVk3{Tr<McNG9P4rzTj7P`0C
z2vQBHsBMG*C%iT9aD*gAqFh>j0OAnsipT$0CI8i*Ak%}e_r{`IzaC|JfaEl@B81W8
zhJ<Yy<=H90=u(q}UN(VtGDZu{Z%24Av43>3<rh52dDiR=r$q@u(lDa0cx40CT~;QJ
z)JT^Z-QM9iqREXm<v!@DVjjLy+WLp=!(EjQX}d-zysL*BHnT0B$T(zU*N41OmCjln
zoABn?q;$lQifql_XmXJ?HI=1Ri5r{u15e$rkJoI{Wm3N-3DEVbwvr3u=>3I=dh@(J
z9oJ20W-Sxd1g@^H=um69@K8v9prS`++^}DiVWSIoBDROEOEap&_F7XB)!Zv%FT2j^
z`v6&=|JR}eJU{#X1txCw?gG+ZU_^k(;VUH#=nQoI@{d;T%jrxt@%?@M7psD|K6VQ&
z(TsH5&6-Py7Mjz+!{~$H%de*a@aPgFNn3zK9QOXAHNgo#!<ef2;n;WOR@#6Sf+XyV
zx#VFk=}Hr}u1S`8*IV0JdcC!$Q~5sgS0)2@7U6b}{AUXB3N*=NhnYXgLTB)@q%gCe
zWF(plK-atvM`Hsxev;h)@;^VxD0JbteB#~1OqBgkGFH;(X(nm<U~`#7>Vk32_toK;
zk%V)*TgCHnD)UcxgF1M3=LuEc%LvB;^bZRHSdjR+rm?h;B<swZ&KWGhd!`fluHwa?
zyvR;<^O(OncHr@ojJ^r$ddL96r$jao8)^fGz%P%ZPuy8O(BBO%Fkenih3PLMloGct
ztBecZ)@{?EJaN{-3qL?QJ&ud{^pmVi8@Vo&H$9^Dq1*Z7_JO<P(+|`pfim(|GUEG5
z?$K{oACYe(NIXF^(+8Kl0pOE}_(>K86r+E6hJyXEjAxJxi(f`tg9xE)LT%st0S4Wc
z<tG_Ca>+5Aj1=JvnW-X?`@iYmn}ubcJNe8zn#5vjJ}(fZqCCoDeE1wMi}P+m0CjHw
zi_Zm+ySqGbc9g*V;IN763)kX|Ac{s(#jUScG)KV=5Lk^}YXaB!aV_fN)rbBxZI8%z
zF8r}zt1ZHK7>Kmk(5AgcWqe$L#(O;cj<`tcME*wH+xZ8XC)5k4B}<Xy4c_|uz(P)f
z+Q|ei+>b+VfM2(loUe1W6P4_D1pu<m1Db2k_7Fs?x*rszQB)~1X6IBnk~%=|tBaWZ
z!x9zgv9WF;*<;qXVub5>)J_l#7rlv$OS|lciOMpht|?Z0C=T+ev&bh@xB6RV`tmA!
zaE)i+=7UTQkqthTigR@5o^&oHZ=<3iSPjG|0MI0+#*~=^b0683uWEdw?IQD4$pM?s
zUq`#SEq=~#Uzm#7T)Jez`i_2t%%dX%bs9Aj11aZ^*-5+AiYn8HakWE5pqb%g?00LP
zZjQE}SabGpWL=1~T!_qAI=ywQi46Ar>mN0V<PU5N=VR7uX7~Cl#)TGFeB~i;E~8A6
z8_yk9)KiMq&7P`PW927^M@BvWda_Mt$vjbCQNPM#0bfP46kNOP2Km??d16Q*J?1H|
zfq{iE;|RIMyV}Yaiahd*K}+Nd%CGVASd(^dWlCIY$U7SWI}4{EC6KtA{6V|63*+kp
zj2&iL+Ad1UkzsWQwE;xA2BO)gdhp$H?|V#bW5VSm@o3#9CH+Hk^Aydu`kmt9heAW1
z>kPEUqe1kkbhJL6JFmt9dR!G!$)9O!v*%~|8hwzZSCYQt<Mfo$_Ni;0NtpHdAUZWS
z^Gn!LQ@$geiuvcJcb+4AvcIsni8FQ}ok|+3zVR~t21-=I=TdFemi?vjRata^H!QDk
zizfJi(-8;oH*9YN`-RG?oandGMZibB)FnOn4jm16g6RSm61roZJ&UU^>6@ir()`wZ
zXU%%W#;2H%CQG8icN(yuF4FqiDZ6A*wP1(C?aE_~CK>LPTq_v1tPWWvTUHe^JeQIq
zLhqHjf_ZOWvt^PO6)uMsW0kIW50!K<RQa|j0drg@-kZJuN_stGQ{lP!gYJtqZF3G>
zDnHC{$*DTY$dGjA?B2{mq~*7w7k#l^=xjG`P(J^Pqnim$_rPzMAE43BoZBBerfaSD
z4J%cYyzdr9Yza}#B}ogI@o1<Qia*&0uCXP9iWqMJ|EziTtPVriD`PVV-}7YG2qg(F
z?e%wPk2)ZQ5Leg4EA%Rk)>GLyf6b$%;x^Z<C)f5&`b4Dtt*Zk@_O*S|bFxiWJjy-j
zLW9<Tlqa0AsJ|$Cz_Oj~+FIV=w!gFaNG7r;=GCy2%}Uqj9dXu2R<pgdy(h{V(%U@K
z$+zeR*Bg0oH0(vS1y>o5bs#whxAV4B0*g<vt?4_tUM_iKYEnt(4$ZHS>oMatVB}F?
zTu5xMgBo)+7P;tt0#3J2aZwh?Y_iVth*<*|ehA~zW1{<XYsHwoG0r*Pq})Asa)dC<
zq!3N_c^BuSX>}glou<FSzevzhiE^HD(Rh!G?*U+rCf?u!^(igVQ5WX4Y97r~p1}IE
zYx4lAS*_6ph`_2)aS`hmS&g`$wl6RCFO{qU>f$%=66w}_jBYQ}-0+!hD1Xw`^Usm*
zrHb^X?^Q9hd@A7#UsBSZefeV!l$ee47G5!Q3n<){q^Xs*TzA-TC$Zs_Dx)ihwco4_
z{v`A8rSq||+*z}b?Qs>!Y7<Z~Vi~GK(BR*$n>o93i0}3~4pnkN{4TS>?7Ioc&q2Oa
z%W2))t|oGKyO?sxfV5WhR1ir!@Bb?7Y=eSTeRnH2(`JPEnAnVfC632V<;{W?Z1)Xd
zF6%}XWzWvBo*2$S2(EHJ1^~`N+V*wLY^$G6u+nXJVI;@0_8mTYK)Si0R3(Ah$Y%=B
zo%OB~@wJm^&@5(P`%v}TE^;=h;^~#{b2w*S32D%NOi6fX!{vL^m@n@=H0GW`oKd1l
zH=zrpOA+TTtx`i1DplI0M<z_rzGtJavtC7}o=-OMy^*(B4d~3MFy?)=il)Pv!nMBn
zy*OVlt9&uryR%2k(ehF47IJa+Md6Lb(zo_Ok?aQwi(^8$$!yPT9dV$wo1?RgLHgt^
z^~q4jaeAX$>K==}9!I(*akD?pH058<Uk{^n9Q?LD;z?~6a$VL-dTTvxVu<DVBMuHf
zOhY@mcEY$KR~Y@7OU=?eC}JsW@>#p!*Ij*j&Y|*%D8boGq0NNh3XSa5(iKB3DVueG
zp~v<6i*^*fLi9V=*UY&J9}TQXmb>KG-}N`t7hH8KuTm<svk+uh3~8@kseN6U=frhN
zo--T+`uAA!g0jYr`Ebk=GxxchZ@m&0(lZ+Bw7)s;m;japU!3U|iEL5Zl9ky4G!vZ`
zQRB<!B97PO&?0XbEAB>ObY+$OywY(f(Cc7~egaLAMn`Kh&2L_ey<_>xGU?rhP?7s!
zR4@BokVt&;R2a!LA%8;RBl0TXfOauAl(Cs-QDuX`M?*nT(SR*IS@KS~Pw_)qQ2sbG
zl%gE$Znc7t{5UdV%S+0r1L!?aTY1)*A3iDTVNAM$t@&+uDCh{5pZ#bV+Dk0>8kwob
z-*YGJ_O)9@G1-H&b)iZM)ktA*tK`${yI*ZQdG&mBT8hX)HDf@|d+AkzRZYYRP|LV9
zb$|XTe@#R-*zE4>^|)S1<SfXWH~a`1ixuSFsNADu5M%1~DQI4ti~`BvOb{cLN%Ao6
z*?oCu_?}s*ZXP50#p*1-eaSXm(Fc=NgY|Ryk|V=QV(XTeW3y4>^_NQnhTnZ`*ZpQV
zUWGbap2mURax|`Q=40T_VdHhPh(<9hS-^1#nCs!6-+FbIDuW6VsA*$l#>TE(bq>qT
zBDpq>vNgy^&h^BxL22seAr3rj+dZ%(v77tAgIq!<%!<)F@E_x{GKlp{)U~)Sc608t
zqkxX;)NG`1p5^-aZ%3jC{r`-VVALSY?#@EG2&YWxUoz!MHX7deP*Joz#nCUi1G=|O
zt9)=s4$ziv9sC?YbEYLocvEv;Fqcb94!NjGqRJ$g2e2Jxxz=;dioNhoQmFM&c&bwD
zNfFdpmO3dcm@!eqpgeH4n|1Jxir%NiXV(fyryft^bcyB`CfesndS=7hk``S$L`L%6
zQoJ@n3_lG3g>m9$7rO1thzjj`J<p@S(IRs@yJ~$`DS<5tnnz3Dj`hIx8ks<aoRY`v
z8V|FNtbXNCx${kNk&1<^0x602bAqdya!O~vaRzm~qYL@N&-y>~N#Bhar=IDJe9~~!
z;^mM+@J7Y#%Cw}KQvaPNOCEiyj4vOg3h+E3g79M+iBCroJ(dCY8*<x!kDNvVJ80wy
zIEyz#64mes!Q$sR*Sm#J8fet{!fsSX%gj#cc?B!E-#YUyj_5@+Kg<d+!f~`DXAg(y
z68UDw^Rl4M68&~|AuRk(?xvRJx9RAwKNZ@ZNQmLnIJInLHGZ>eXwdh-do`d@k=LVW
zT|kk)q4zT0S$33k0dEXTH!rZ7ezgoGv?FH(hZZqiiyYlrH1|HOU395u@&v5_o7j-c
z7P~Y@88K+1JkI<z)?zn4krFj%CQ^<%lOcjiai7pQ`5pQatqHsT`gqicf%&bN&oQ|W
z@7#>=f0)*b&=;714~ah1oH4~nQ+p%FeZ}F!C{oPRU$*<)O-iM76RvaIJIn4`oVw+u
zA8%YYdK*nf9<Ozc44I;Ik`uwI^i-^MT}2B!^}@CkJ8?(Z$V5?8`Z)bw$0$!m;Nw#i
z4V)-?=1E7?3Gc0^d|O1OY1Ndox&^;+pwM;uFt2O$v;5EavHT$uYxk(9&#viJ>>|Ct
z^>~X3zXQS~;+wpztZZa9!+Cvb?pAIL1+senWsXn2UC88$1!^2&mcIya{Neom7kqY}
ztCgU*^5AT>C)<YP)H7xC!+fQCGh8g6K8X0=C$NMSnYosWyN1+7?{ZtkiecMyy1q|~
zo^CTaj*=k>!9Z)9vyGw}Od)koDveDY-<Fosa*D1}nBR{7qBT!(QS2c-|FT##s#Gjy
z_S=to+gUF4xmMhSc;cgC6R!-EYX3t@?K+cpr=T;06ljEEn1~DJ5r1&Fl1sMPgU71m
z9emZ&1SF;H8y-uxf#kePMbo3MrIXGFMZJMvO7ssiBQv`Yb0quqnD0gTaA?3uY<Z#k
zF0R*QYU=jpg&4v-)d6#(<Y7pKP9>4I{-gDl!$BeL`EtC*xo0G&!L2IdIqTgid^_Rd
z8tL=^iOa{XZSVHbT(W<`;T^W@5RKsG!+5@PaVH+56dAP8qGV0I^QjsdqjPKRgkGGt
zGD-v?!%g4GlV5JQWdHq0uK5a{iJ*BHgElVugoQ*cjUh(;UKGqvbod)ha^;EY+;|wz
z*msHz*{6WJGxM+VfaHI)KnLHE?*saGVE)MD7;LOjJbCeQl<0c-sFfWnU0}b|L}RA=
z$AfTu-K<4x3=feBmzEPlVt3qJuANM-z1TOi5v>xcVbEb~`R(ko-*bzRrS+2peps(X
z`Ay?h9<~4o*W{Pvy7P^<!i1NiPJclQ-_9zA2bW5IwQJM|7~PE2#IsEglDm{;Ai3K`
zMzU<YOw<9%YB9EH;&psfes|$oZS=GZ#*{u$nkqd1DwF<ovSZ=f5I`HL;BU8hHYQp!
z`y&`8fVeTR(?m*O5R{v)a($E1G=iUdj9eZkad{I?z`rWPiQK(E$=a{{d$+u2pYESG
zUsDs8oopw%(UNFq9j~PnuXAzutMSsh5$;C|;#48&<eIWbO%2vLJj-qLqv@Lr`DmF~
z+V5ebTHDBF^nd0qdRLIE(|_(S3LP|nc~c#kG9tCJKdHJ~uH{>}>haqH>j3{gS$f?X
zRv43V8qjX4KMXQBpa@k@#G#L$cXpXY$BpE7o#q}z_Qg=)4bhFKu<M~Oh?jEE*^drP
zZ=I|tq+*cEG=F~mC)wp^3jd<-1p*d<`S8wY{2r+e1PBj2Dv^Cu#J~Uc9i0a0wDTN<
zav4=(5mZ<a<<;DV5lVYd?=h*ym@B&#d$a7gg#1c>L&0v~VFSt@@@(o13Ut5qO2Js1
z5teuws?ooZSyx?MO+K$hL!ok<aW5-@jLa*<Nr3p~Fak33X8Pn$G6%@$9Qr32OT9Jt
zBZsl#BI#{+6-$wf@!X2q_>+Q{D&scwkI7qqaf^Pv29p6#er2Wh>Bk{u+JKwYp(dqq
zb`_zf<<TbIPZVD%eIzrCr3*;n3g5bZ8Vr{Y{`_3<FwvQC*QcxVyGVex(*f*Ff19;z
zAZFI3I46=5wydO^|FOfmntU^rgdN6ce0Lx`CfZ_=?euu-n6Zt1xd0WKcAWuFF#+CJ
zrnwZ<z6MMWvcjLVk1ndQb&=Q0*&bH?bAv^SN_U}Fk|-WID_!~4ZD#tVxk%qON7QfA
zeoeU+<6~VoNhZ2Hp#mo1EE^h|vm?XhGVbCQ@u(^kk+Hpfx}vu=jRnIK9B}W$Bd=QX
zFuFwSRJ&wHzlMjK{9|i9nYgRmH5A1RZUG%#6_@lx8Ak907=!mSV$?qAs{?m%<_W%b
zHj^CV)8if0UtpW^$YO{cVqD|X6!Y@{u{nB%m2StZi=un6!TRg*#*MNF(y1g|vXos6
zhAxQj*j_-vdj!$F(FeCgWMrH}JaeIut*T7w9J}>s(H4>%zB8nd{a{mW0^c5Yx9Qt%
zS6NI4Dd`Cc$PPapv}9<<aiHS@6_k;7p_>vz-Y;Piq~7H0I%oXr+2<Fc#S2G0f0Cgp
zh<VxscAwQR7D9U8){7|Jah>h6;mcCJBOiX;^$geHT-n{22pAeTdtfN_Q6ICBX+7lI
zMwR7juMepwh1=r?u;!=7F5`n{F`1dP#$RI&*~}<{37P?1{U44s^5UOnF2gZU2e2^+
z?c>1)6zBnE>GS;<aI;SXC_m9}=6k@K6zf%~U%9?iP_(WNhhvK@D&iMjiTd{W$lXep
z?p<jc*p0;>^F8H-kDJZzn3pNBgQQk;_#|MazZ3kT+@Lri^aTr$=z!zKNRLI}Gik{?
zpVN)-VVN2mmViV_1;SdPP^iWBy>bWv=SE`sk~<jD&tD*nK5fhyongOGh~R)xw-7im
zl%bmqZAFjZuPTOo{CAV^@;RCxb#RpEMX{#_13$^44Y&5hh>X@|Y7+>CZH?Vc7s~BI
zEyzqdH*Z)M&r1dQ@s)F+7{SCi>vavi1VdB*>pAoGZ5+!w69F>O!b-e}?VypTd{D~s
z#dwx@3+FL&vY#VDEX<s3N|DyC8*(6nO6{h{^NZH`X}Z1~6P6=w%TgW~gc21k0AnX3
z<vq}ZONqf2d;XT;y>QL=&3CRx?p+Ru+R^|QycmZw<c!j_xRv}dIIe4hC`7nPWG=IW
z`s3))<Mh9In%seGUV>kf<-uzAc(HyC!wKC;;CdkoV#b0k5Uh@NfIUf+BHHaI*=-Ox
zrdo|JxUxpxopX;;-CMtRm6F8HvI|RAhF$Wp3Hrum2g-4xhu``jFw>t5ti7#q{Agi#
zZEb5DNpE<o9Zd9z>0wbT2A(j5i@x7~pMVO`!D)C1wftcjzK5A33MHormU!!4Q^0@b
zdStABmXMF&Ql`Cu(If$DG1ECbSp>na`|X9m9b%p*j7RwYc$v->Hc;odYYpa|I0J&;
zO>)u%+X=+kZ7o=wDgBBO6x?)kcyt$Z7;NfmN4<vN4F;_ZpbxlV9E>mC3$>wU;M%pw
zcAn9t`_EeWTaYw1+mLY?3!+!Oy*?g|z1ij-OT2-d&r2^T7)30Iz^FiY`^4DL!rgX^
z-OHNw`3ZQi7I=rDAwZM*r<V{EXf9Xo9EivZEJm)MC7`TvgqejGD@u?v0m@`bG3!tr
zlA`%&7Oa2zn5*-*9vlzaO^%D>K^d5QlKlp1CY8in=?t1;OWAX02*qIY``}GVN-Dz7
z>07wCR5mOTM8W+2yh~Wt8C>;Ex~`)aP^fCBA6>g&<uebKZxnv!Cz;cc$>X9l=6IS+
z<ddcGVY8#>o(L5f9lZiA0)M%(QXCOh%LCbNo+Ao?hV;myXKpxI)r(%6E|BIA@daG+
z+9hR8LwgMw8b4qW1T`XO{{~YMh9z{@KJKvK_a!^}9pb?AOg8p34@M&-HvN4?#8tQv
zbUy~Ht3a={-5=#d)xMM!rgr@ON(=0rG`|g1Hn8y2q8B-0usH@%TF?%4dY<6SoXVQR
zOFp4<^xyaM+H8U_h9S%r1e&AA-;^gw2e1U{g<^O@qv=mL4!wXcj}fmxu-eX#;5~PM
z8~URMT-_Z^x{PPbZ!0)SRd+>SSstRc0&MhA#vPHF{6<e*z5{A(@47hFv03HhaEloI
zo2|$+g8@(s2#0<f-VHrO6kF~$Uh=W09a&=r(~f#$1eUEbZ)7Zt_t6q}oDPZUy)BsX
zxnY+!6O3{M3*jr6ay4UV?)pTTX1h0<qB>4*56}1{VX8hEaTR|*S_uh6p+X~`!va%Q
z`~ucW<|OQQ<F!~f(ILrO1cTGLs4yr7Z*;(OxPP<>6@mQ8iK*dtW-B=U8%Zm)pMH{!
zLXBNY4Hjy8!lF+%dK$EE8_god{Ab=A2WAFFBZ<?++4w7b{pJP&oZ*O^mstpg`m0T-
zRY~xu?a=+Waxe#OKJnOC#F=gV_Pva19)gIMfd%%K7~|w8e#klEHD-S)Z+Rdc1EqQ;
zC=0vS*R&|-@1CEBs3%>*mtnc(jaSiNT2mR*3JQ;m#@ztL4Wk+Tayb;(z_*x#aIl$-
z5p^Nhn{dXM{roAe_Cxm?@N7`YyWrNQKKZTQF<~U0H}Enp;P^3`s0~)6x;(~w#A}Fp
z>a}lcydw=*9N(BZ?TuqW$8|s&3Pxj=M4TrB0uB+b=dX6-#LzVKhw4r!{5o7}1q{zu
zoN5OjD8Pz)PqQaJVf~X#r8q+jf5|?~HWDm9Y7=xpdYdAGbopZ%RZ?wKjCzP=XsYkE
z?A{5~nE(qsn}e760ER#GVpQ$=;P>9m#Io`qW7IQKZ{5q9z$QMcq5DrZjpGHzBp7g;
zZW?b);_N;2`2C&eKu+y+5T<}q5O!&qfl%lTOw5&1ANgWSNUyoslr+@7?F*LkPqJfT
zGqhqYuCy(OXvbYBap4@;S-`^7d!Cs9>{`}3=&<Z>6I6XPL3TbFt13K1;WR3xy+<43
zKgr$=--gV*HowHnh_gUvLbkh>fHqIDxBAhhu4(;v=X}@dW!S_joRvgnbf=rA1wwZ-
zEqry?nV4O~MZO!2m(7}ZHVrlzE9+iRg$H&@7(0Z>P|(s*!^2ds0AEi#nhMi}VIreY
zt4!&eam<}S(i&G2&jIZdq~l->y+D6+KSIfIg!HNi^=SGT%iT~g;t8|a6ACgVHuP&E
zZm^5^8Un;ZAbkL%6LKSHz^D{F;f3L?fgCVwSBW}s{zTa2<uioxqY-lXNrui>(w@ek
zLg7CKf4?;@M~`lWJGJD2W68p+0f=K3eiUmgaCI7-Pp_|4K<~geMZC?~4nM%CjjvYJ
z1HS?LVn?Ck17zD4Mg=Z#q6l|G_bm%1C)9%Lg*Sw#?E(7jN(Jb!IT1C!Mo(*QK=8@S
zNfq&B&li7_bCjqpvOX~9DHr>Gs9+0LxJ`kVLTl1bGA^Vnj=vTDEMC!Ugs6q>yyg{U
z_4~QCg?0t^m>kZYxQI{4P&XXn2tp9O0D}QtQGq-V7~?s_A1&9mH1-m|8$XayO+zul
z`FwkKi7t3yB;YwvqF0ywqKuE+0U&T;xSN8%e0+2|;5Y21^Ngh9&@-5wG0EN270<6+
zlWlyMOH}X6vA7X32gyZBR3Ap}$eCu~+gdw*l6_!2X2zIvbVfO|<8Lb!7mz4-d?D+U
z1c(mfMHEB5ctz+T#nI9T_<^I|4Ld~Ciz0ok=O!ud^7Gp^=0F7w0^-?8PQ?%#o^v-q
zv)t0RPj9%#tlX(QjIMX}YZ9(7F$ujEcaeYp{w%g)7I~?ween&=4d17w7MEek0rwAc
zq{P^JE@kJ030n<x%IVid$gTGk^g(R38X0?#Y8W7dH>WZ%SNiaTw{cqGou!~urDwxU
za9R+HeD#xzlf<XC`%?NTL@S7}=O9N6%tJc!U~eEIU)T^;zpDHsE0(n&szEKpa}$E1
zqHm)@9^G^-&0la8;;DCoeT9%&sjvs!!ZzoU9Rq7+oHX`rh435kSQ8MCeLIUFavq%v
zL}qY7cw{Ka@iN%PVJ;|qxCP!F(gr!Wl1zEH4|4Gsp?3G0U0jS{31Rpr87(cA5_qE_
z5Uj`1>U#ue#36X{pJZy1Xdb*gP=cJRzzcyhTpiyDzGS=(9N(j7<iXCnMk2O#rRWJ;
zz!`4QV<QayX&1Xo`NNPXCHslzKp>qJES{bt!^|YH0}0$iP<sWRS^V83XOKjBjye9r
zbK2x2;v^h*4vvm%lz{i$_zL;a177Xyb<QLrll5*#0;V^5ct!{9Y^R7kj(6=!Jiv6>
zCeq&1wWTMOO6X&%P6$48Tl`_2ma8#0=!IZVqR%5r;)5}+p$Y?qNhFqUNU6@rW2ZKa
zK7TFCb@3`OE%rZaYDUI%5CN71`Vf@691k$5#M{q_+*QSHwUwQ+C)|F{JAj;U4*4z_
zTT*a_?@c^KKUd5~E6mKGGAPsBC&F}~9+D$UXt=Y;@xYMnbAp^2EBE|e$~|Bxf6|Qn
zX@khqV1fNQO$J~7-~)~p$|LtL2LH(Q8D#sO64;l6Qp8A#7J;Z=3_|zsZH5fC14pX{
z90N}I+u4}EnJZ-WeIps*)!)Xpljx3?EsP3mDgSmFHGY}qWB)gr+Fzptme~K}g8XZg
z{u-q}YjgjH+EO@tOma7%GI)a@pEmm<`l?abkW)1|X>53_3<pF6gytZ@e$-Hs7(Vlz
z3R_3Wxsa8dYB%E9%YD@c>E}GHP6i~yt*4o6)`tsUu5aFiWc#zy1hIw1l)u-i-UDG3
zIUHLsyG~+OVejgXW)Lkl{JxIqxdN4eoZ04h#BF4)R`+dPWWkd0)$~IB`@l+x8nRdw
z-Y3Noe|H9MrC@VNr+IKXnD!uNqJ1`gNv*W1I{rb+JvDbz);D<<^Ur<}>W9pBOtV3j
zGam8mEw23}dx?aws0|bdx<@5@Ras|5etVadw(-BYIh!g2H{(PgJ`;&YwwTjea4!!f
zCxx=pOWOs`oX)7$#`T=lmsjn$c8ZUZDfLR%O}+3wM-l<%l&5_;VHJMkPdZxcbpJXN
z{yI7TH%<5->R+7H!3$fgpUw_Y!6iK>G2>ZUWc;Q>$_to5*TR9~%-X8>gGD1=HLtL@
z-sp2To~J$+-$Ay96Eb%j4g(u6lRDV#LqQnuoMR>Ie82Smhe{TM(}LLzEsk7PNj>^a
zak3KD@*{`hz0KQX_u{5xjrgpJv(BhAop{1K;Ls7nSLl{!Z$(CC6YocMg`B{A_zDGe
z4Qae~n5IOIfxm22{<;l7Z|?^Ux=g0sJm|^JnhLwBcq6`eHCu@{#4pzgqnuWaFa8}!
zKqTNzNT+IW-4@uP*Ts%7iM}V$2K6D1Fem%)g%1_JcjZHV%c}~oS$A@aeXO}yh5BU!
zdPhHn{MCol_&b*$*#w}AY@5!%K$k0E@8k;rWsn(R@8HuZNYaI85I@wfJ|xet{wnGu
z{FevFBymRJ5=i0y43fwWSO5M!%m2<_B{Kcp6U6-bjO2R-zwXn0f9KXiv4+1s!mqpZ
zf2Tnz2~Y*cgabZiR{O%7IS4U`(XNa=&EJT3$gI`p4%)Cu_<Af}hs-YjjJu<_p_6u2
zaqlwYe_|B(KjSUHg_Ci6t&?<HE#{2)psb?TY4eF{#m+9)5=xI^8pvq8&dhOCR+;7^
zK{V_a^C@q!T)OF!re;@lV<3;M^`_|ZpJoR_488xqH}d@vEQ-j$h^Y!w(!fAYqoTJ>
zxbC4nvfNvR4f%UQY^P~(v8kDnguts%kS_jZZYqk@?=N&q+vm*X6HmYR_PXy+JmU@2
z{-N&UU$FMqfYE<%@Lw+rFQ@!;D?;mC48}D$NHg+XBhqI1G%H8a7mm=}j^3MFt}h_v
zG0me&7p35=_$qX=2q{?T0ZTNgf2w)?JVw57+^?;#bWRZQc>atW6CT8Ke;q(qb9mEb
z(p4Xh*_g2MNsm@z!<XgndB&}(%A#k?OeR`~9-RnhYP|j9c3{_4Iv?e9^Y^;9=&x~B
zK208l@K+_2ExThlGaVy7kPuk<iQfOj;k&ekMqokXokroWP64;x5pQ7+zaVm3%2atn
z)?QnF1<D9Myql+Zw@l!_gnkUu<m9T@gruIdX%%GtNoQf+|CRB@zxI&7!WsXc2xt6t
z9{swV{`WqQ{tDUu6^#Cqa%g{@asS89IGjaz5~O6QwS!&fj1K|LJoe61Bi95fBR)~A
zK%wk%QFnP}u999Fe^kr->pu5uqSjEIg~i~-;7tiPXuf2Dx@3&-VBbL!K@Nn4Pd8F&
zVbUn|0p0VO>g|T)F@K>q6)Bg*g5zu$)a@>@lBH3Tr_<lPHr{4&4q_|zGM%#?8xvh`
zKeO(yhB7M~Gj~j6{B5petUvYYYN0%3tjZ#a{@1|I-^E=9uC{+`8S-2u-WlE(VhnxH
ze)n!jN9$oed<FqOmO-$O1Tq<}5z1_y99gcktDro0cG~&%M1sfn1jN0?bmn^Wt`%U5
zq!XVUrXeq2#aenu5bWz0A(KTLi<7xVFTeDQASK2J-CEpTP07y2dKg1kAu~xV)5nxV
z_#>5t1MIPl&vT-h&kK7yUqk2iCb?3bk2eIjJU8S1SRUEk@gySZo+&$jNCv_%5#w<(
zLzS9sgIZ=}x4ACG1Gh<&n(AR{*S-sQAFx5l3AjTMHNkq;@FibeZ7})dN)l_RZh0?H
zW7Wm9ni<XDO#WaGiyOmRuL;Z`sVxK(uX-sJ69HkBUi%ReJ1SvnY~*n7O~vpvxUb-X
z^SMYH+j-v7QgvVCax?3TGwrAB+}MLB=F2!~Y!W(^KRmniPlS2$p9B9=ZNL8z3`S+Z
zL)`RBh{L4DY}P>*&c~xUamZ?@OP<YAV&YSomgE&Vd&S-PZF2Gkm?8Dyb*v~z{5Osh
zq1)sns+6B({1tPEgM|<96&mTq>5o;dF+m6l$fIkLZGgY<KiGTksHXllUo;2^h!8qb
zqXL3d8`6ml5D^gt=|rW2fKsG|gd)9n1tB0HQX@zg2tCrI_Zo^wPpFX;&-OPn?|EnL
zJ9Fl)J8R87=iWb9K+4|Vwx9ZWK2IfTOOI8{>D7t48s6vMf9N(@bOo$>-{AA6i<u4(
zrMUqS6(A8>>e8qrS3)*yogu%y0a-o21bc)4xMaE1Ip9wzIY2m5kjyy*tx&z{kxD4o
zrbkcN#hmDQdG^e1d(6O7&X`_W4h8_qh1Z*(3O;;56vFplg@uR&+@N2{x{Gz_;{uuA
zplRoZMvOImAbaK{RLMZ8>scg-oJSqN{05=kA$O{Q%60YmPgYR-G{{a3aWwPwjvi+0
zfO+e}_~vy51&%KICNH1MDv1fJO`~V+rZ6T{aq1|t9LS6StlzUD06UcG1sUqu+fGgl
zDU_`8DggB2Gj6+g=G6t(OC8g%`7}TXt=}MfAoA4Ti#eJ`#z3Zce}ne+<S2*pO9nr)
znNffDzt&+0Q29^p`3>?1hN3KSf^1q=NEdZYAxY~zTX&Dh3C5o{8G>QsK>hjE#hPe!
zIYd|e$-1TDHF-6odtbi}_09BJntZ5wwsI}n$Cj~0NBF@Np9`3H$$!Aj214WwYWx#l
zztJj^%>9^p-wTU5m<I+soLPkkH|jv*AEH9lm5FU6aUuqH)aER9fMHv|vKHg&Ab=IP
zdlnO9!suYa=6uI?`EV&6w1*~&iId;)2K@$YYyi*2@SB6<tFZ6=%{@q>l)~l#e)<8?
z5KqE6qYi~rk2r20mfKvLF0*k!xkrum_pS=Ql&U72i~%Y^J`npp_GLS2GX(DUELCXB
zxK#G3-zW%<C|yn^Fq92330KlABCB3w3dp*^2`=*%?!mz${E;6vgaym%(kHfI)yC!#
zWoJGwU0>Vn3f}$o0(>@-nkKc!aCjd0ybIC&@aed~VqBbOIM8D0r187+??h}WhZ`22
zSh-mLT28!i@7?>0Q};py-lB%r|5k5xJ8LB1@u%#Q&hqy*biXuM)I1bzqvSLE8VljR
zr~ATAQr}nG91rC}^a12}suma1o_tPn7o=`KhU}J|Lt4oNMGdts`%&`uU?ziRB{qhK
zu}sTE2bEfpmCGa{ve3;pHI1<RndEt*6*_o1aqOsoIxmVY{*=4nsgk&R|0;>0TjWrg
zsH$u>7e|68rcuxAEC2@u-vqP}?vh%ck~m&@uux%sWlFr;>QI$<<0KvLJdsZfg2y5m
zzD@((ofphg4s5tmCH-5LYh72=4It(7ErUbMgZmAMNz^kN3rF^H82puc#}$!Cv%(q7
zW;ApcauL}kM27qZW$|Kx(c}XmZ)KuVw13voZ_tTlbg@M4Mv6)jB_@=5dj(3g!UQio
zz3Cr!O#XAhzZ)I2v#In$T<OR*WMTri^JCyLDn#h;w<c`kaxw;wg)t~o{`rzcKmW`(
z?C`q4FK{vj7uy8(WP>3Wtdsv5NdIxv4*7Hv+3BCAyF|sd{RUm!&7s6LvDO&N#Zj8H
zf%5>2QI%Draff<R8}?*SYh2QctHS)x`T?xTC`P8PAQHer|JP(xh^k6|UH;F?s9HQ&
zGEo<jazja=CN>rbO4t9|f_zB%c*`b$b!z;1Z22!2<UN%AGe7`_4vf%BSmOw|7Z5Ez
z?S+SX)cmz0f6X~0x^Tu-{I4;_kuUeR43EtLD@Q9@00wUGbB!MV8&m`AUAKgHeP%nb
zcfc664poS1Q_M@hL9U4aDCW-<qtE=)##BeD*FCPC(+fjd|GJ9+roy}30#{E<e2l@x
zt8+R}iHv{_o6>;Ash2RW&+HJ)V6BeWts!3lx4QIv0`}hnv!n~HU}$}E#(ISDs0kRo
z>2X;k%oO#iM<V+uVi!%meAFt9ECQrr^CYx0p85^Kgsl67{PRVa;h-L{F+pAU4SSR%
zvJFBO6&I5ij5|i8ksb6lk@%Q;>?cU+X4vugsKLW>Po7>^iMB>Ty%YxEy?A7g6k)$H
ziTnpHc7v!(=>sGTEpVFnf%^+z$z8wK^%=OV6te9sTnu~hpT~L^X$3GD*~LkcDXu^Y
zhyS=J5(XU1g5+nvLCL=!Qvs+K?#voD@z}D9dJTgI28*ft=dZ#H^|i(dW^}~cN<YAh
z0PNnIHljS3%nFPZyy=GzKZpbb|FQp{gH(T!;!^O^M_p)#bLAZH971;J|7@lf`SN_r
zZ_qECKhTLS5gFrerXg2qur0UwLSYvrQM2ie_vsw3X?*t6RaE{ACA#U<QF$HN#dv(o
z;PLV7gGHYUd^@zudnA51_r{?Bn#|<8rYcX8BTM4*hb$dT;Z4tl+IrvC_798?ChH$`
zXPCe0df8)0r(aoKQy%iP5~yc9(;5IxF>C3+=g<9pdfit)^4_-_K*Kby$iEdaNdSy2
z89PL&u+6|yqF3i0b(ngx+z$;V26yZFpL;a_tVx5tw1;L$AmkKZJ=4t@_w(b6Vn~En
z>g)87yfOYaOzuu@F@ojya+VSVpQWS((%)4)8_f<&2Q)8mSdx$x(DoS3CF7yWEv*(_
zFInqXIWr|sI^uwAqI(BFz%0XdLj};_UHJ$A*V`hAv1V~vM0e-{bYM}NmSB4C3(Mvv
zsztZf`Aftvm6(vaUJw%|UN!0~^*B@R5S@V}Oavvdff>nKh;At+PT8ASSdEsAn7LSL
zKC6sn>B%Y<Q3OB$k(8^0`_3Y5Qx;`m*(NtXu8mzTxqdh{SaPY2|FonQKd30%0|ewM
z@BLR*D8D-!-`RTM)Ur^1=mPk;rlwZ4)))%V-#Ul^42`;)Hrj&NZ<<MVaGY#Ebo6Rr
zQ(`)_yzi)_80Q;XGATOVkwVHRjCb&7#o^90T*akg0sW%9ri=hf3=^bR1w$g$dd<o^
z+>UoP^YLDm_^Pllv7wNZ&P<nhEu=%Zi}9xxA4Ym>TP1Pd8qp>0<2fCyFcu6h)6)8|
z@?_A{$$5XcUl$yQwN^b4+q7(SogZnXM9q6O_lQwfwk7}>wMTJUKi-uKLNQO{7=i^_
z=BH>M$H@N3Qfk0ltkwyll{HI<efiRtFyOm|aL;;v&W!I#se*Ui^|<`z;be(cj@h&5
zOm%5w2R(td6?NtrWj5hej+0h4NoeT@)7wL~{vbW`>ry}Kf57c<&MKW$u2HyHQS{V$
z_3jNUpM){IOl|OU+svsp+4jy9gH?PZBp1kJrte*AA9f4L1$yWR$#XBkPBc9JM2u=q
zSj#%6I8MHLEnPh?Z#g6C>SuMoUlCP%1BtIJdyE(HL%EL(^6PDeJ{53_jR1_{tJnVi
z<o~0;Rg0HkEf`udoaj_SmL`VSyLiMrSIbX2;pCIN9qDZxTzz-?bOD`k^r=Mf?l9>#
zvgHa;e1{5B?&~3X-KZso;7Z%49hF7FuP)!mi+|A_zO&%J$q+Z#FHi9tya8!*2_q>W
z2AV`iG?Q}RR|#S(bNJ|pyjgNIvg!WQvj@^Qgf<R`|ElUX*=RZmRCN<_4-+HlFhiLx
z9vHAlDK^Ee0jstd^|nV7VI9HDGGXg-3NpL?A939|Nq9=Qhn`u8_t_UoxFO6!$T$qe
zYqj)f)-)xNbSx9RZWr8W>s@|1RC8YRNJN}yuou?_iG-bLa3y#dQHKbItH-MMbsOKC
zm^r;f*1l76ee$CGpc6zAUvk~F@z`}#ze4mcu4+?w=l;r}urE!`WK#D19?--{ug)Eo
z>BW=wqzN{a;|*WtxNsm<Cy*=a8$1y!btKHxQ}J`?aKgvEzt|5gT8~iJhF|cBXs>fK
zcoL^~_2A2)KvWM=-UG04$BpV-$sqtp^B(DZlQt#t`7V|5)}PlOesvu+IyM>`{bk45
z{VN1XxVmwrirS|)0Bkk>0simHdspS68L1$GT^Lo-xR7T|)WP(p{?UF<fq>XqPm*f8
zLLtL|(V+dBq;$e(kC%*Rm)U&ToD|FkD|guKkLp>`Y*{_}p*lXf&<?>!!?0!F@n|^X
zn5Tf+RRf~oqW1mz@jzQ1zv&%wW5roJ#or)bX!0@lYLaCoP}LIph-9#j#JTF#t?gOF
zYHS<UXd{q#qvd`-fIzP6KgFC5e&+!tRzNtAIQFz71QVgEttY>HQH4dH>L8=WqeR`m
zo&DmIkgmVHxoaGmJr8~d50tsSIe1@U<n(q$?;!qun1{Qj-<3;rzWb`2=0+|30_#&N
zF@O<Eb_ypy!)cjW-1KFBBXXqh>Nu}!?{%A9V29rs)L|sd7$)eEhSHE5{55%?xQ5t9
z^yf|=z={BxD?c?ZeM_Z@Kdm<ZJAb%;0VM+Te3XU;eUiAw2X6@OM;P~f1X<5Pe#lWF
zyQ=iP1og?Ib8*Vg-Cp)`U&;>-?Lg!iaV|kZF|1AJh1435IA^)`0`0W^FUl#&yeQk`
zB{|;rG3BugQo+sp+2ECV9C-5;$$~nsE(MFkaLJo}WjRF-MY1^sMx=7M*XULLQpoO_
zV$%XGpJa%n24ZaECQu8|&6<K-B3O%e?!5P*xl?+8NfndZr4|UyGa$6!b~ZcOWk%C!
z!_!cMF+lQDGi?AU|8M25Cjcb`{yp+P-D|uV^%NA)bbCZB!EZ?r!{5X*)lsHZYG&4f
zv>qyX+@@B+m@@1`laOE(;Krz4^{WF2$n;XaV1C|A0t{@xIbYl$odnc;9E$kbZVNaV
zw@#yooD4v%uohY6>f!g_pq!I>WTs#M(U0Eb2bkB?k+?}zwHJl)3Uc8-glqwCB#1AJ
z$Eve?cOErE+0O-Qj#uJ1^_--CTF?<n%9qQudSeUFzSOmiUmU=hDg^l12}BaL_9svi
z{h~S>e3ocI;-C)B^Q%f`T_@V%63Xn+*W#JqmYqLk6D2VI<Ei(zElc1u{@YO>aZ;I>
zfSPMByWgN^jXHps9be}LAt6xwX8*Jb^$i~se*sLDjr+ILf=$SC(U1d7ku8^@FE)zb
zZuJL7t6R~}i;bL$%G&h8OC9S|0Nc&3xPLP0(0`zb*YU`~zZffeRR5;juA5{yylow)
znxb(k;HcC4yVUxBC|my{x%<EKd%KXBtScj`VhitN$ZC7UsCG`R{I$ERXJ%)Gawu<{
z(!>jB)tun6!iGhf$zHaejuIMO`+(e|13H@b5L-&gnrTPra&O>$oLc>oN8%@sSCE2t
zN)&AvYSFpHad?JcK&*#RS%%<{kMM!Dcxf9#uxQwi#M|53IuLh@5D#0$@R33iCRABY
zgX)L5-isfZvD$GtKw$9K0i|8b8t{juVO3X)D$|ess%DJX(I6&(Drz?ii%kkIUEWmv
zSrNdhb2|N4w&ClNcu<+D7vLm49IEWRyndJ=S2?N0B6Lu=cTUoeLvzUg%owH(%0ErM
zjhBsEBywpU;c2fS_quVcUAZl*EAf|Bt9&Oga|0oW;#s6z2xSU6T_7gsmX|ZQj)7re
z?`8q&kmbz(=iDLO86}R#h`_u#r}WC!x$aipEC+!PTKuV2M4AVeohMx`Y!$1@ExF|Q
zEoN*%7D5BBYIrSvuo+p2CXdytiXUxl+CuB^<K0>tIXfVynjqdiZK+f)0&9e;dx6QF
z&(pHAXqWIDgWKnE!yuZL)tql-3=1v^pEjh5$kqhu3o>S%0A=VMKywY>i;KFem19F$
zTH4`Y;^W?@_fwp?^Xc9-iSF+LRpeO<a<ygJ`m2GDMdFW~7RmL<cdIC7s=ylb6kH+;
zJg_ZRR}t#-F{WV3`h@LlWeP~p<NHacfuA25iVjwvxa4aAo%Rfs9WU!g4gv&7COm(y
zJh=DLI+l@Pb8^6Lb#7dGGBi+@gr<l1J*a!N(u>@fdoC~%9GkN5Y~xffo4KgQPr5O>
z$T{hFsmt{WWHDAlvTb4kpkUi-ex4#(^yn{6Q$PeQ_`H37(Y><=k@YcM`EHcx3qIo$
zj7oIEZ}>gE<(mDS^s9%epdn3S$vve+o>$Mm&&YQ~v5a}qPJU=bc>*f@KtHBUS>8tX
z>$Kgh3#!l2kiUWO2sngwy0`vU{z3!o5+uyipXa!3Nh>J(suO}=Q)k0^VO?2Y<zv8c
z19C%T|1ACiy&r{pG`K@qo@)r>Ijc6_3osKX?tbBHL!2K{HOrpxPP_TueC;?|=h_w4
z^|l<Lx58(HZ_){CIFI+%i<3>j5iop24+%p@oWrdQ1O9CB=TXRy#PLBZ)Xp8{lih(M
z<HLp@p{EMF6jfSH3s$I3c0V2n7bjNMm;nT;<`;1PeXKVR{}Hne!|&05QhsP9Vhq6#
zhinyK)_uGf7I_UQE1iOUdlqDI%cDlynz^<pO+=LDy-}{wG6R{17MIoziNG+EnF`2i
z_=BBrmlp>S`ROVWrnWIGUnOi$v7Yqq1Nj4PCQB7b1UYDdAE%xMf&lzbTs6kp^;oJ2
za7SCBp-ZqX82O6pmK;FT+7AR<oB5EfaYXC+DHt^(3kYfi0Oo!O2x*GKPs1t{DBSZb
z$c0V_A(txPbf^hnM8D$D<TGtld2$L+Q*?nk1aO4jKLA2(G-+fBAaJ2e0U{PZ-vOBq
zBCQ<pA;aNS{OZzCi(b@J%v=&4(>Y}nDfi+zXFn^-BdOsP&nclG&cND0l<BXfC5;_2
z=Po3?{ykEtOjQ69bE4&Nu(;vGk!xa>-dn+KY|0lGWEl4^EFgsgh?fagxU>$8kRyx@
zE?(&EJGOT__KZzqjrSvM`tHky(kCCB1X?2_TYz|zU4IN!g;EZ8UW_|QgghDZ$f)(m
z;T|o`OKkn2raTLAl4zOgzInt&L*at6)Dnfn10K0f9_xyc&&pnyn!0@3VKv&Pp+KPC
zrHoZ?8g{51sTm22LI@b$G7KDf_DuxnTMi(L@b|$dh*;cj&}JHMDA_sJ!ru4Os3)I#
zpBJZwES9ONx|)?0;4_<lLP>@?n8@pNi4YyoR~m-cG@@(Imba|kfQ-qJua9p6W`c%S
z8;p24?5{Y`6eR)kvyA8j@abLxIA@V!NPHKj5<}rsL;ePVY=GiWC@u-<fIPn73zQ6l
zdZ@rG9Fc9#h;Q@zMsRtclI#q!Gmhwto)n-)?u26SR$$`zE)aA+ok0Q&j=`(rz|c>^
z@Yx99vQ5b4zuUO=*oyPt!rVU7u@3}4C`$LOFg6p3zS15LJQ2d}67Y{)%l~6v`-Qy;
z7>}8RulfWX#NJJ!ujsI}N?v{5f`0`NeKb#E_kW<_g#rA@R}0V+bB?B_K2xK6Vxeh_
zEBQ_JD(67LUmuvq;&dJ1m+=~yHVo~WC1(hEt<-APUE#5OZy0=t!$;+P;?-|wgo?-7
z5UXIxS(|ONUL|!)-L<^SX#P{qpyO|l-rg^f#((WmHF@BnWV8P0EK#D5`1U@UJ9K<M
zXYh&JE!eFlQuQ~kmt21=1c9Z)1SBN1L|w$5olhQh!a}x?1I;2+6jKwwN<y=0A578v
zzB5Sv_*2KB7*6dW9qqnY>G+uVsU{X9iwWGh_QW=-c)~kat76=v@XnZT^yQgbOT^ri
z+ZV|(4&(16DmT9;?-T)hAK&`F(ii{H`%N#2<sxJ)!p9i=t(J(-Pt(!i7J9SgAuXX3
z33H1#u3TZ%&kAiscM3}mHL&CS^*ZWjvMf^5Xm!Plt+qd`5;H#+sU%AEH8Bv4o(x|T
zm>2M_x=uuOy0d5!g+FVy@f^0PhJ;F=7QQKJRGLOz=jc!yO8{I1B+1ih!zzh=r%Ky%
zewfNSm!?*vI3#NP;bC|H{liNjA&_wLu>@Ll<KH{n>TbmPQv6Y;C4@L_duq}wWk`OZ
zkrm~()SZa|G&-wq{KOheqgd*b$GMcyn*eFM&BoM)j719$QrlGfEk7YmKA9i4XGI?s
z2!}BQPwZJL;UQ)tIYaVtp~7OxU1fmEe!4v)5OrR`WCm;(MLRClZ+cKb+PsoBRgeoP
zj7f49N`7J~uI|aK*e^i9o08w{Tm$GA#h?Bsx^dBT5`nMqYqje!%@g%Z=$|*hX1h@v
zXWyyY|A;=ce#&_8)B8d#DmY7F^x&%i;D>sT{F6IvMi?;f)Y^6#9=-6uKST9&pyi+?
z4I!?rzA48483EPukguwrMMP|?;-#mMMCR}fe@o~=!ZDk-_=(0Bbfd-%(sRchhiSib
z>{jgtmfOV{wycJcfUu$^_ai@)t12wYh;-DmghhDpb$mw^-T}~&+ocn+z2MWzL5!-A
z(`eb3uUxJ?v0sl)GP<e3Wf1)@t@8fg@cZ}J-(1`OJFOJ{5B}^PCbCHh7KWf7Y0wcw
z_^(TZc7v|iHN4*py2KzZd-JS&C8y~?j$~4dqKsL^`Mi<mD>4Z`J|jE&iECnAl+`dQ
z|HTNEys5q+^6CI3OIFSByN17zr4v4>c?VBwu1AEtrXmV1Y?NxcxeZ&+K(2U+V|rf)
zQwF4lioaY%^BF9Eq)ZgcrSAOLrrIhR%L_ZW93WSAO#$oN^3~A4nCIMr<r=Dbbl*f{
zZy2V8-oAL|Z14zwVkGF-{DO4_@g7i(kD*7;q~c5aQ6JNkt~eOwb+Iz7MBg{Pu2##v
zuK`~pBtvM4=vEBBb7zmgtbV?esE4x6UI^>lfNoXu5&A<Q-3iv4XtQgSRar5A0GHq1
zB!|(4f4?vH)fd+D3vd_Z;w%3=x5od8=N9yjKl5^)1OCbeztQ5G7A42|-N|6u6+{}I
z`S$uYM_`xiGOP0GtkHb_D~0k8PHp{+ct7$uX;N4hXbw<6&%M7B`kA`dHphP1aSA7x
zSEH37r3qMdS!D%hKhb_d=M{HRS%|_%EtYIg#^?J9!ZladO)F=0=FH)}b<|BO#_U&}
zTBZk)+r7nF@AQH7wr`j>+Vk@<@wn7>bMm_xW=$?_^(COZ`jr1&r=sZ<v9c7u)7b<e
zPTHTEXgAUt5BT{)*4*c64dvzAAiYNdLQ+51zY$J`d?cc7WANMMyqQ*oH^myd))Oy2
zj=TN+=B7{C%t^6FMfqahjr`kLfMuh)`7AtdRY2z0H@&-io$v11=pbcw9ZN7?#9|~#
za|FRhOov^y#7i%>8o8W4w08MYOFMM;vzl98R@DyonHj0vCkE4v^+y(vKW<Uct4Dye
zF}nEaAFuvDK?MH!J(@k)sNW!-+lxlz^NG}*7IlSM2airwt!G7;J~8wMEOaj1gC&Kw
z5dE<@h5*EruEm9CaboaU6{p&~QKE&^3Z}FlvBv$jnxHt#upp-hqSBHx%(Mc7*NeHU
zcg9<HY>e!|dpUuWQA>Gby?lJ#o9{$pv>r)Au0$?US*QO)+E4Q4@p})97u0TW>li(X
zY*qsz3TVO2e@~75cf1b$SAEnY|91{2{nv~g{oWHo1UxvwEssD_A1$t;bOq~?W?c7p
zSv+S~q-WW!<fYRnRn&W|AGaFh>B>7N_wJBUJ5qM<!K(G;X!kTX2I0CAaIo;H2E0~a
z>DIx=J<lyuZF!j|kB{=2zN##D{RUaR5$>_91|MCs3-`mkR!1))#R^Iiy3FR&3x>Up
z5zvJ7k$)tGXhIf|V23#w{B}Mr#zJ9oJ$2WtTO}mn-m)+Ih;X}Y!`B7za8Dtv7FV1e
zyZV-2OAR=8-mW;q<y^8|VueO!=(fA%EKJ!u>Q6vR7t-NGYJ@D(Ipxl0Mb@X(%Gih?
ztIoTG`%8^AQxB8zJIDy%((yjnXr7zVkqtje{7;yJS}^GGkB0V_Ff>Z2!D51?2x<ss
z$QcJLR{C{};C+@kII8k#_D^^Mh9R?IT!ExVh69n8&0)MzJCsL$HnFFmW5waH<fY32
zQ$;oYw0qF})r9WOlKD1R-|FT{9$Xu5MCKB}K_U^d4|cr^u<ls2g-;y^`f%TfhAv>=
zR_nA8t?ky^U-q=eZ66}ZViW+>;4mKv<7-lM_zn7u+8p%}YaAu7S(RCu-PJEhH<*_x
zOi_xRo04uEe4N^LPC!3608!*!b681vr^;N^ljDtE3=6BIXwH)BoHO)8enemm6WHIy
zldelO;2Any-ypdS``h&Reo`gulN%yF&foMDb!6o8h>4Quf_Ss$jx{|ZssZlt3?&7@
zOJs#GZ6Hp6CVVWAR*|c+u%ypg^f?3HVtWzg$?%5#S+bRMU#dDMi3!mre39}F7&$mf
zU2*K%N+rH>?Lr35!SshzgzfOQEP2;l<Z7;Fd~4n}u5xjqpS1g5u_$ip8Mt)N_tiza
zC=b-B+n=uHe_5{?Fp=&%L*H&|_psw8AMHnt=icH=tIazRrd{}*w*GK_hKMS|h=S|s
zwgt{UiV=*bspeO%I@1S;pW)*s0LZEsvWPQ@pP0DX&hJ_Eqd;aZ(>bs2n&Z&)OqUl|
z;x$>#<qM2?ER`{B!3hcGMr4j8oI-FD52E|}ZxEm7w3!YItiu)g$znb2oJb<em8sjO
zUsZ0!#M1}#YThDG$GrgglNNu2rUVwm+qPZ<t<ZNC6~f>uC1ypc)uy4vPEIeQ&WGL_
z)H(n8bRK)cHzn=?BJ<*S>wILwTo1md<5(+-Q}=S|u!GTnW%%i@(a&!)SI<tHxx9KW
z=z(t835T)%0Oa^5>S%=%hV>dDn|uL(??MK05%q;}TmHJ{3|0T>=|siWRy0cTtmsST
z61yW69778<1mN%@i!lT>aT5{Kw}zh^?wyuU-AL1qyS`|(*LQCFyY}X#OA;s2qM-mg
z3<m5u3BSD5A3i4psJ|1rU3Q<=tE+1mD`b~txGJPT-8boCwa(YY5uN%cA5)`v-$3zx
z06YZiL_krQpSj|S(Ga-g;58XZF!A2b)&Y}CL8O>jMz~Gl9P{1fm$Zs3f;kGDHSx7w
z=ur#<wG~>?6oM1tyfvoIOZ0oxG+g3bS|<DBbHqw*`k54ABey!+*YpvpiS9Rq0j}UF
z=pmdihH=8d=z*%HxyDi$FVEo<<*NL?-p*@Ru7Ar-$gKYGMUXat>8Dg7VYLGp3SmC`
zrH=S+aaO!Fe*N^?i{sLL9-XV2G_UyHja+`Hd1EaB_6|vlc?u}fHxT?oJ$CYQ{83o;
zAeCp*VW=nj?e=;9^pKT?OZ}&AH*|+L*?b@B<~l90#JvW^KT*KP)NDE}>Y&&h#>Ug%
z*Z6u?CtVvX)^T+gn|XA1piUtE?fLlYLkg^{ni?Q~O-$AJ=BIWEV#fj*W#QY5_~>{D
zW+G0vWT_29tI5phHR}1{nir%88J^tBDq)Iy=WNYMwiprU!h1}4STp(zwab?QK)w<=
z?-O{+7mG7C24DGs{KB_Vtz1t@zrRvw3~vE4rNVyW*i?Rc%q9Trpno(#6(Dnbt*yj2
zVLq*0S5Wp!A1a!1x_BmW?$L6Zu?cyihok#MW_!?GhW)R`!WRgz5HfeJ-l80z6OS)X
z%8RQqvy}GN)qwHPC|Xhk<unH}6M7NqXNYR}jdmz!gAH_YAIWOc<)w6HhQ!dtPa9yJ
z(EWjRv)K!%0H5r~jmJS3J^>F-6($x^sWI9Om&Ioe)_fj3`);Y);XQ+y#Jf}RBGI`s
zy_ZEp;!n{00zn<%N+c6RFG6O_3cnMkF6r$;dXzaPQ95i;1HKmfvXD(ywNpI%ev&~M
zW^oJd5ZjJ8Y6YT^c_tsX)0AhTNLBk#o7=TVtS^BxLX>dbOd`p7n;n`G7{bYy7c!+<
zEzb`;Qt~Lyl%15ZO*Ni|C)~GUUX{94!C^gPBoO$Gdkoofjw%i#-=L(G?Z?=pT4=S_
zuZ$)=&~_+0m#$c5m1--R`s&9uAR*``zhfE7@g<kfpt@9^cRCmOI%@peYBB5UTz?)Q
z8+eSe)FE&#jkoB%NfJZ1&kNbl@ztex<u_9HFU=?;eVzfRRKE~;f*zSG_prZ-l13Gp
z^wz_XzX8;K))g}E^Q1DB2QO7vB%cjh&WsNg&~b5rR}_55Sm_bPAwk!6m~Il>5Ay+n
z5G7*VVzb<K=|RJ6ht;YOPAv8h-jdDM!OPh-;YN$y-uK`gKwMKtAYV}J&bMSBEf9_d
zXz}{hijpVs>zDjLYFY(w@H`XY@W$!-_D3}6<1q9;jS%7lM6uHc`@>Vhi@S%`H8mkR
z^e45gC5xEZuIN3YN8IwBrZP3MW{^DL3PdzMuJy1U+NQ!(T4nKE(Kb@T*;9%E;4-<M
zAH128NK-8@Sz?U88aIXthu|aS0uMIg1Sieb)ge_CS&P)UZP9clnT6X@VcIlLK(anu
zG(SwewhT#^H~2%!67t9<`24Md{X#mn+ohA*(iPn;`s_T9Ox}fqShW?o*XHDjfeWzE
z`bz}fb|||8m2W8BFu-EnOW&l~=H<PDcUL91&uP;tDaw-pt=z(|&P;U2LO4|cR7Sh+
z9o__@rhtzBWxMEm@s@MncKJTcv5JN&zApCEzo4ZWH#t9@LKbr+iNPOZ2&tLQg{IT?
z3Lj@>txR}S);`$Fi0U?PCD<msuD}KUyqOKwz+<<>NNV2G7L|BRaMJ~EC-X7a$<(=S
ztWjlc-MbW>1VR08z3q~TFO^R?O%>yNsEjrE$87|-I>89*Y^4+G@3?26Y?<MH&2e{n
z+O)Ow>Wy|A)z$a8Da*gS*T#>o|HFW&`YYn+0^E4)HE_)9T-&TuKaYt*>TNHVx@ujI
zahLhj?o}%r4Q7YZBrgl!<c?buV$daMhJ5mNH;MXQK9Zd{XLF#<RoJqr=?1py^Wkmw
z_j}BLAqPL*zWWQnp9R|S!+U-EonpqkK%VUhPu;sDwKpuQ^yZ%>Q%BVxM9co={a?AU
z>MLd*X{+NqKwxP5FVpTn6Bq&+1(2=qKhU{z69Ah3{z+%AHi<5u7w?6%?pf8_gNqA}
zzfl-fIU|qOrHUCMJsdCQBR1;&3f65*6W{xogyGQa4#Khn(yF@I-(@{0_r%h9g+{-!
zPX^+`9^Pa~pFzL#aQy@Kz~Fe&jw~4o9c|hl%YTE63f9rRsZCLWK$h<Ez;y%Gk4@>N
zmx+cCv|HvlMxk<0`7e9B;$XurQ?t_FAoL}`pL{d(x0nw)5pfAIgZTn!hVkhxfFtLm
z)9#F)jZ{j9Z1&y4-Mg1FQu5iXOW>vE>++U`1%jo+A1SOw33ahC)@l#tvkHLS9W`{{
zMsx)ps6J%)$->=Eh7yw&AdzzdVF2WSg?!UyQCHZ_(B*}#NxUK`*}p(yopC0b_Vh0O
zGx#&&Abxd0AsB_7=c>ARE%TJpQjJsimW%9Rm&Eh0iBn4E;AC>g>)2HQpH!fM@B?xu
z!<c7r#}bLig^VY^LCg0Jciup&^)|Z*^F}Z*T!wHETUxAWC6rt!pE8o8`C}LNHI`3w
zibnkTdyw{GfO`6e$OUy#xB<}}AKaGcT>~(WY&OW}<-XvY>n#t1bBM&~^@+qYF$TU}
zSa`^Q)IfMmBU=nG&jm6cI$-dbdR*2E=3RN~%rt6syUcNg57q9X8_4pDNLKIun-v7D
zH&rUmc3LC39Mcw4_rBb`A{-t2rckI>%{!ZAN~%Zw64@TOu|P}z(oUpla{7Z1LBe!Z
z`|BEBKkMYn7G2JQWenYj=U=tlzo8Q`xHZgYEQJd|v$k9Z_U#+czmHu5K8;5nVkqfU
zwRNpK#K%k1LUsl%HWi-f-?v6@N?X+cv$Z~T()dF>!-b|q06g-ao~%*F*gW1)ZX$Hm
zfZvrY{<work@t#&a!|9L3p{9P-2nVZf_DE_WGj9=f~>Tpb`t0d#WAu~l?izit>f(F
zAlXOv&G(8jN8am&gT+d~qtP3ZmX)_KU6+!Qx;tf3kU6IKA?BpX>_mv+!z<cnX>RaJ
zp!<<rz})nIgPvoU9V;AImVD$Lo;k-|Kt1z(1%ht&iZCwCGJ|hhj^l41Vkz&D_N9+>
zX>oE<OQTic&-@~!t!rwl>Wt$<>?U9FyF4^;Gf4QB4KA=ppC+!5?vjNl@2@o~m=HTk
zyK*KSce_|B3vIl-O9%nR3X{*%>`q_)%D45N|5q_pIFoc5AZi3aF?3UCfF%_;#2Vbc
z@X&=q)aPNgVgl<eJrIk)Ux$rC|AaNC^JSZA5Lg|X4)WyEzwx(jJ^uxNLw*nZ|3Oe7
z-tx~u-4#{$#Vv(q1p6rbSuteaS@z`HvX>TNOh7K%VJ1ZQM_G!}gL~{ou6OR|eaP?=
zR$7cB)?xTPP;^*QAGkS4&Fb-Xg(Jra>1<aIzU0_9Pl3K)4ekrbH=c4V-d9OR?YZhA
z1l65l$7oH)tkoav?gMu+9?IRgi8Vb`-oJV;Vb$O%Wx`?o7?UyGjaBE7{q8nr`Wuu;
z0($5~O7$uS{oAZe!_wk-5V#!za%>W)ah0UR>sd*t+&7AcTw!3DUVX^4f1y!0avE%D
zP{1EQtMWne@uR5dYP(Fb1mQC=WI;&0eOE5U=NiIr`Oec0FQ(nqTaB7R4`{Z6EhAt`
zL>N_O94qA7(hmdxunE;w1+kI!Z_di>>#TqOYNH<16kS&G{mnC@bX1#+QSREV7feK2
zdO9Y*e(*QQ(htbzTlx%e{VPZw41{da_ziNjp`;_|W;JlrXeq4l6%L1b$sEe2N*XV3
zfG4H((iC#FSgVCE8=TVMdJ*u`0;x0AsMA||(?EX+#<VTvui*6gN29^cmpK$|9N1d3
ze}j4?R&Ah)XrTY&Je3_olssxtd%P_+)5P`M7Zg{d^8)+xMEdd71uZfMY@xBB70o(J
zHc2v7zmBPlT{0pGe>g1HdUf4;_r%%NE|!&4(e0;Z(Tf;WsIy)m1Ymcz?w?x438CA%
z&_=qRLscfRIj_gvq(85_oC$-oWms7%TXW6@KtDnv)UQ?ol6I#9!sgoS<a&C|tNwlD
z16rB)a+e{oGe!#qWOi)xIE;;YiTr?)s|w4QeblAVV8n5Hr)f+q(XUR6^vnu`($*_Q
zv?C_#ZF7pLUGu!s9t|16xJ=z<{lp&buXooO+`99?rGJ!C3&(b44Uu{2tAzFALXE}8
zqTd*2K5N^!oO`YuU?K)OYT3U=L%InFZ_-1=2#N)m2attsS;B-rU)<Rm*LJXbX0uW?
zI}(<5xg<8K`dW_)59p=(o&@xU{Zz2yu|{ms*se*&#QFCv*Xa`YxUOTT?#|S;w1}wv
zq{XjNncbJLajlrsO<X2*2?r`0eU|oVNz@4bX*0t7tJ-AnkuKbe(6+dWwK(tk<~OL^
zbqoBV5ATQj`0iwcUD3^Fsz$uLhm0F^X^FGBs#hc=c6}Unr32DfyR-emwrn>@H;^qx
zWEy<w-MV42oO+a%s#UUm>0YrV`2H`qE0?!w81nty0h1t@$fkY{PE$^-$us+vj%h1K
zU3s1>eQdL4Tp;KMue<Zez4cT4(KVW5Km00gKB$SyTTTbh(AFm_1i3MEp54r>Rgtz3
zXeqP3oa*)5<ZYt1xcszHD+K=l8h3lCf3ptvb?e@0KY<~Hm&E*d#%)V1{Zr_Ze$gHm
ztLNC_9ibTi;a9Kd^BZc69!WoJE!p0DSyXgITP;Ayp7vK3rQCC#j|`wTf^ybO!EGqu
zB(=I0d2?7uGOLMiu}|f%9vUF0YA#g{#V3><rkIy+-sn1OR74#|R_bkyFCp2<szipx
z9ojDZ6L2_xM`=}6=exqF;vOug7W3JLsw77(f%~yPL9X@M)A4S|g|wHtgqp)iVioB&
zEGO}d)rjn(G<0;v$?Hw4TKS3l*}nc#htR`(0<s151_lNyO%P<$fz5*q6o{vGP<211
zEHvj;l~v^63`gR<?(B--DucQ+k8eP<&CIY4&fFy?7f(sb{*a!~4@^}OC1vR%c#thF
zWP~$W9N&+#sLY7X_4g?;*941fCX_bN#T~}9*Zu~1jBi4k`y+<n_CyUFEON+x$ey-?
zN84X0xgsJ<B44!gexSki{kGuBm#vsnzd=souqmJfvt<Ds;)ob7AX@tKbb4bY2hCQW
zGzh=jUADHGb^+f59UI|x$Xvk-ajmGpIS!%?(EqsUA|WjtuJB=E?X!v5nk${V#my6%
zo!Z7<Bz$PZ5*0+VxW>UGegqIx6+%c+hrND-s>ipq^SW>wVReZ|Izui4Shph<zMvBW
zN_*#mzMn1T_(m6P$a;y%b!J_Hmf%EXHY6x-w9TJv;KNsRx=It<3{tn3X?vy}?&gUg
zD{QkAj<d11VIGK<-yp^Xq8#ZWk+!wTSckMhH;Vp#sn4qrTv_Y-n7_UQb%*;GV13Yc
z49Rnkt8+ND^L$R6Hmarrr(Dpgc2An9_}sixd2F=l6{mi-6nMf|r{M|-;-he9`qHc*
ztEUEHz4uy|xv7lLRE|6tT)gE6L)z|D-5rkIImUdLeK-0khgW=nXm@x>Xe|4RH(JER
zZKIH3WEtzZGlNM`nK^XPx76_@v@KivW^Q?ljZ)uZ;Cx>8*4(&5d0RElIs0*N5z0Q(
zMT4CS8e=@m06iGB2Kv`{0s{sU;>gl^JaA=70Mc&7-)*Vw=&t8EhTa<f_HIMNNjI86
zOB0tf<WJ_SC$D377@GCoq#HG(f)N}<?OerlFpII4%bw&G=Zs+2tLt-fFM4-kr_0TL
zD83yjbVSm5SVp0Xy<Gd=;R<UzcW2iDk3lA`8OhcPbwUxP(tq-|Qfk@&zao9`1N54c
z1MbtDwuq}i`nCeg#t&2}@?I5r2@r@-=Un^|nQL#cDQeN=gyU1<M@BF5N3)cX+}BfJ
z^Y#iwEPihYlZ_GfUTTA|s0x%2Nu6GW1@`GIC23ynbvUbNI}noda%)knNw|I&ce96(
zGaRsl>CX@Y0r1Yo;dNrdrw;Kn_u|P5F^u1tGandM$Ak0aMEq&c)|3pYIuUvJmS|)}
zaBZ#EJ&enDygJiDXByQ0MX@@*eVb12{FZD9L*M&gSQ->><{B>YfcOl5goAS|>UtU0
zj$U}^vs?KSp3kz`=b5l>G!>u<qcY7GQK#masI)+!xWzTFT3sH$6LlaJb5H2WhFQhu
zRDCwHtB@r5R>eEs5C_StwFwD9fV`nUP5FR%p@RzO!yhf7Th*Wd41IB9!#j0*-n42&
zEVE?B!snKhPu|n7xlg2T(1PqljkeI6;|uKgnnMK9XW?XAH%en*^IYv2?6G!;>B17F
z(4>C}1~k|)qS)>&!nRldcK|+^--k^^SNWV+HUFw(+y>r}sG$RE9c6<@fmSr*Z2+bW
zuwKjO+hjQIlD|e#E;$ZcKZ{x~8xQuX&ns$brh(Z!af!*B_{pyk8<LM*o?IKya6Z8r
z#U;tki+@P(@DJg5G%!W-69!y=>^?Z=dYkS0X%A<lkUI9|(zjZd`P$^@EbS-Fi%qd5
zF!rDPc9E4rx7&PsEj?ok=u-FO{1auF7|MnIN<3mX3Jo9lcKjSqnkSEEMqlQ7zhr~a
zdu+|t%;pC6HN~R?`KceLxB<rx#o6=2JGgl`Mj01pvQ?g;6986Bm3H$H(^hkubyBtE
z8!VP|HS^rAho+Ad$r~)@0Tx=B)x-a3PyUNt`G5IM8%sC}@`wvZ{7EHN{*_8B{<o>b
zu)n1ewPM2mK9v~NexRL{^mB5-`qW`M9ukcJ`VL1;gQMq|0{Y5`Hhiu!Nx`4i?rdk#
zuCGxmpqdOpuPm!iIF?xQxcWaQ>5%ik{8A6Qa8429B%JXJO@#dLJK+8k30V6NBLV*i
z%0UGzk%h{sassR!9gJeSX8*+5?ptG>A@=+HR2rL^S($Hu<s`LW4fbXA(1WOe#CNyh
zj3VG-AD#GRVlz%=R4)!)uo7gKzS*`l6Bk0K9N$vMAR<qsA>AXA3<(%A_dPYITlliv
zrJqfLu(dAMq<l@=uW#)KOM8ooXwK;5o_i7fRPX>@+jIpnFkj=fMT^s!51FS0kc1Sw
z=G(AP9kV_=i+3^~Bd2U8&jx>I6V<Ck&AB9ee$c@Z3WCT2&lSIXjMf7piJ;TM&plHk
z%;7Avo#rkSBVV=oa$39Q<Bw47EB^F|4(fE4Y&l+QGl5`bKEiFPqzd(Wp3^L8GxB&-
z{{)!fC`nFeqX+pEIZ@Gnc!P-iq)|H8R!kgk-{MLy9RX3YM1#GOoLwvoBQG3Ex1ZQ_
z4>%FH2S71->=qfwBFHbAF$+#UuV=j5%mYR5Q#Q;P=N4}hbpb|vA;3j+Bx-%Y;+Z>O
zY@QU^xosq;ld~&RZHQQ38R}F~LWA(>if%^8EIJvvP-@AH*K0w=Az2!n@h;t9W@7d6
zlnyCmSVRYIZfagIvHeCr;KLLDg=%%@V5PI;xo{OqDbjvt0)2Q7?-B*w+>@yZbC#)T
zSrq8Iuj8zm{vPd-*yrlXN_-P)F4>U1Z@zk>5q4-uNr7vVjNms1euG^4r_4I0yds;X
zm*?!KWRvPjWzt9cQ|LPn+MS%vD%DuDccrFkinRqGI*1va%0_{zEQQ{Cox`%31wUVN
zz}CS>sS*p(U9!-|Xg1LDdzvovD*Es>9vuN3tWT&a*+!t!<k?%YJYGe_?B}8;n`AF`
zGgT^haO`^Gx<;E42%a<UI*-B|#f7I?o}wgdt3sb$jCAF9JT!g0g=_jAxFZTcQ8FJM
zhhlFz0j_qC30$g@=uA56?PRcfxUMdrzGVLOxzc&t-O^^Y*HPZNXFYnZD-SRX&-19$
z!leoGEo$yK82~N2PjUr!73i^)uuW@ly?${1{6*(c1IDZir@FgOG71&%>QNbE2qI=p
zg9uUb#Sz&o=d1S;+YCQP)Uh>=XK;@VPh5^Y&->9!&^ifL2B|!1XLb!ieZjWtLClqN
z9h8MOZq_cy_a>Yv9fof8{=~!}w1Kn9rV93S#-Ssj9I|Xt{<n7YhDxUec`CK--qX%U
zg*O4w86T31cRjWRQlZrm<Nnalei={MiVOo4rs?aI-(ggR%-wJBLif)TMO<5j*r7o2
z3Ksw)Yd1A)T%MB{o0{W%b?P4fuwIDa-8t|{6I(hzqi28udG|-*G0txe=6dtbS=0z$
z8b7Pe3H2RoRj7@pa{6%pKz;#lK?u_eC_ruOgk;fB-oh==mTQM{(q6+NQxoPreo`~<
z+J4F2e=)RtI>?Atq!a`Pa5VH+@M$4U^oWUh)`rJ;ExoWd#JR?*icy=I;ds-|@d$s>
zSNAzCov55X)dXUx5#{LB+eZQ=Q1-$geCn5_IIfu}HOP%GS;yN}-@nNWd|PH+r43LL
z59~w8!%tGek@k=nXk|3A3cd9)b;__WrJXmGpN>Pcps#AmnLYJ-s-kmF^E1ALJTHb`
zT4}Rc=mHwTF5AFO5}ENvv_9sVyEeL6Suow^pGiBX-Je5J&N*O-eKWw&jQmm)0@nkE
ze}_`&xf3-na2kt42Tt<OYjIo(d}0f=E;kpBEw4;_B+K`Wc7^pT(hVUEKS?xM!UXxQ
zwweL)$hE^cNYaBW0poMkkrJEl@7#GbUG#}v^*(n>@@X~|qh2V`dnx2KiUng0W^v52
zoYm_5V(ygoLQC}ioMA0P*`O<zHS0TDtm$#oVHPpa8UN+bn;5aQ5oX{le!J0LLGWZ<
zq6l}r9i=Xlmyiwq1}NY23hgm2Bn@H`zTjcKPi3E^4$G6)3(L2TEMFLz={@aK47YqY
z^D0r-3x+qvM5tfHkGCREkd+7RQm5|`LMY4iNt*W}l63Fhf2btLWtY)A<y+~946Q{G
z&ocyWmo~@~v=%j5*<C+btQ{MEwF(-GklqXMBfR1r!rX_xKu+qlA*(R04yp`A766%y
zlQMkXc}QL;zoTm4QQqBvpuxL&#nFT|R)dH1m`SY#R0{xi29eL@lhub_$VyjPoFDq}
zgK}OQ@+k2KSEBYxLZBVT<!_H(7vT)(L0}%rTjVn{xygQ@sZj<YL-%Vrzg!f@-D}Ru
zLkgP1TV*ahKkVPKu}N5K+;~T$skjD9g3<%g8|aiCl_{5S9ukOzR2Ck{(WvH+P1K~9
zn|)jL{E_sk*}kjinmDNXrg5IM(=lv7eiqW9%#*q33bx3nrW8-#_HuZ|-s^7mJ?QT8
z<5?49_Dy@*JuLN9$KnR$G_|8id{{Qc)RhyqmhRky2k+2#&s_!`u}`b3DUSfVyYt4E
z7f2slA(<R~zo$3@_{oSLjiWyta<rVk+#kH<bxHgrW3FpwlM*1Hro5*X@nk6?Q0RN@
z$lcO$_(sDQXqS^i;7sChq}>)n9v~R*0t#+t^1Q!*!5CSnz#H5;WtbJ?23I=_E@Eb2
zpD43j=Qht=7h04gr_y<5gTFu><0ky>Q1aEq;iAO21)poWDth?TTnx;H-g?C2ptdIE
zS$K;;Zav*Q&BKSP-<wc*2fK2c0{9&&ci3hW9^3XvW5s;NL4Vx~6n!bfz_#(}+{P;1
z;dJci!RUW^%_Z{p;QtpxlD}3vFjWPcT?-aZESNixT&ijX>(_TydR|OL%Uye*ToNAL
z8#Y;f19Ds6(rE!4J<mv$EJlT9T^%Gp9K7hmsoNB^es_fJ%9;R=exf>F2&l^ZPp0l~
z2vNBAFl71F%|f7}A*vNZR0A?RO91(|C88U(Z`^PWs7;uLP*rX~?&uo>0ZgM%xKOr*
zcX3C0)yJ3*6WNJ=(_KSzQ=-qguJ)W`%uWP}9-K9b1kC4u@O?|y1ynSOu}Mr1=xK`<
zv`1Xb;+`X{`KDBDd^oOX5s6p-(0D%Jl%&$f&^g}PTF*#{<S$>@ii&bY6TLw|mdUe$
z@)>Dk0ezw@1gsZxhj)p7^7>f5ei)r<;NeAvAihuu+Mnycut4bv!3`nx6UzL7@*@s6
zo4#EWYnb^!x-^5b+8bR^6yP)=4;Au;J-{3Gw~LOPYaGa~bQ-O%POy!%zqS3CGe?p{
zWDat>+u^g*9LMVTTAjC!P!N$jxhTg!BlKinxLh=tB0OW4S*{U4^HZC9!{#@rzCcxH
z)&XKPzFf8YTIsSdIYlmG9|k~8n6q#iuc-3G;00*tvECt|faTcN=J<xaUhpcXj66x;
z+00q7p^tm2gytQBzL=kcnm6&gWDs22bYJ$BKheF%cw6B^Wpt7IG(*<ta;Dudm!Y3Z
zkM6A@0TR>DkEs=&yZI5p*z=0r6&1_eXP4PqxEGSBW0;E3l3g=%vL!zH@vROa0rT?H
zB?WYBHs8)3aMA1waetpAVp`L~LXxmN{2iItFzYIXo<c2EXItl6u2&;kCRg4F)U3KF
zeV6J);?PhVy<=%hHbC-h#Q{N-Z14w(Pq=ic@I-GxZNW%BlLxmi^3k!6us`}&ej7s=
z+<!n`pr1iw3Bvl3;@4tyvBV^BOe2^A7Z==0lxYqe36L5kE1=irB=OYDMT>Lf9+?Mo
zD&cYdi4sr2IeaZbaoiQ%CHcnI!i;K+=*%YOtKQ=6Sr>^?9{1Wl^m@t&LKcU1-hS3N
zV7qU^ba1}W9zi;_G?rCNmeV>?fo3R)Z5!(4RsKTn!4lOY|8+sepHMnR2xAW>iecO1
zrc@Sf=G!q4xPPMAhYo2OY}k!By-FiFF19x#Y@l~5)uFF@6nb?L?SnT2joM0?JLdTC
z4-&G8d+jLvTc^W^zr1{FCYC;vtU^WaI)AXc`+epFckHXIgI^{j4P=W997)oFKg19-
zmgZx7_qyttnV;b*C!am9P>rAJd_=v}s<tX?a5d4SPM*ZB0rJ7N&NC9fwnAC<;~3y~
z30h?F^wDTA{TyIgn+S}`PBTyEe#;Jz%oXZ255lIN$0+KNIrTa)Ow@B55H_eaINAuq
zoI4i4x%SxjW3EF?M^Lb6pb1;jN=d@qu0+~hr-M|0F3f!d=qE_MLd+*H=n*4G+GLLr
zRX_LV_ym`F$LWF;&ag{44$HBM^N=gpQ>&r}O6YMYyUB)fSlEFInAK4#&vE?v7Y#dK
zJackYt%np>AB{Cf_)MsT$!#k>zP=X#zeMz$0HDr{$WQP!oq3d;Yx7e=)7V?b{x^4)
z@eOW#7wV0)k2I$O<DBxMGj1(hYz+*I8%6`Jizg-;#sD|Oqi+&Uct2n2xUN^w^-0^h
zJ|J=mF4h|LI+4xvu1>b|LXPuN3irnTLxvTj%}l^e`T@-1f;Z7Sw-qU9-88T>b-BcT
zeu9ZhIa=RE;-gk$Mz^Q*>u-g%C$u!rH{mEBsJz~LOLDE0+qm%nxElhZSK<<M^w2`h
zlTY+>>P3<CS@w^?Jq`+TJBBq9bTp|mYD2)Py(HcQZq-7Z#j^@Mn#VD0$-TlQkEQc8
z@KAX}8kSrHwQ741t1EL8oyzIKi~VGdjU^=ZrY(vG<3PFH{(0iEpSKHKosM1QG_Ubv
zed9Lv&aFBuUk9Q`|AwFpD!2eY-*#6WLS+5rVN%(6&ZALwYk~Ko{eamop503N_`4$K
zj5~o9cF}Z)C9CrR%WF(F#-lp(DLEeKDZ!dp>a;sze9zld$*cc0T9EX?`3AOXNYf(c
z#;KRJ&DhNjE*dT->6e{J+CRP((W+nHeyXG>bam~~pa#g>Xp57i3Rk3jqzcTCuM^Yg
zVxAAl^i}nJ4c~sT4WO&Dc%F8jk-Bs)x%lGQNOCSwi^M`5Jf=pEWzkY{t60Qa`03Jo
z)kEBl?cRAF3Z}d(71%nL6O$nkBKGLUS!a+8qJ-=|exO}RQNX!|*j#p^Dx{S1Xe>`n
zeCnI+!s?c<80Co7E*qf%>XIR{OpdX)t48=utB<Ymx3VJ6G<R+5J@U(P8a5b}hE^iE
z03piSN1j88FT2$#jjWi-P<;KTDcEoG6*Zd|@pgxgdHKgf6OnA*O%y)asy-d3nPfO`
zEd4{CGZWGASGLG5&8PkIHMoBWX|2j_L4Y0I8)%Xv8-Jl>t8){_j&NS>QFgJ~o&t)9
zVeYmzNOJ5T(>d$-Y{pH&;)2sLiF(oSJHX<5Acp3Jx1{%7<1m#~WB-G^_l{~Re((i@
zfJhVRouGhpkgif9DosQXrI#p0nt*_4fI#TI2nq-&T@WducL_ZpA_5B1Ns!(WY9PgT
z{hir)GjD&hGkebL*|Yopp&bbK-rV~wpW0G5H6Y5RIxX|;=2j6y-=$oMp|H_;H4$+^
zqma(g8$w1ndCb``96LrnnsR~Q5a3n6%RE!BFnr~{Or>a&Oxo2O9Nei>$#j9FWpXL7
z`+ZB%AeVJW*u!=3NHjGK{fhR7^-auA*Mm(KmEXy;*B8($iaRIE&P=Ompzf5(>k`zV
z1Skf@2h;1kt`|)aCX`axjW1a0j?Qj^9gHB`P<5VPGrD_HoQa<V6lNbb(JY2MfK5{9
zALDI+*^-xgX*CYw`XZ;ldVYGL3)aD%WIpe~7Ckc*>n>znVQ;-{*L-!zDb4urO_YQg
zl6AR<JIX92B$)E`1By%<i_D=jGmPbtH)_9KG#$E-+T|G*YrDvvI5Eue?<R$R>$9c%
z2H~V4_$+NxFX=Q5mJHSDPU4Ssigzg~zH=x)Nvafa571R)kv5H!FS7$7vuD~RK?CxU
z;9-?AT=QcwZQg9RQ9E3FOV1?e0&{>`XUYY4-!<+97P#@{KcEW)A;i{9hNepswQ43v
z$VbNV_uiefz{$!7$G@B*4b1<dy6F>0J(g-d$UteKLjHgPcHaDly5)ajB>=1gz;wt3
z`D-263)$@wy4vifJh3j6_X(wFeJb-3{IA-WDs}Wc{g~E8f+;`)1%AK8*n1)dJ$!Ws
zrR-a<HPFd=B1B&WUR+IT2z~;DV02PcFKRr-sM&bzbgx{3_ymAI-F=s*`|ZX6=avIv
zS~B=C+-J<*!}*_Op&0!m3xzYU+`W;HD?O-kqfWLVIgcrm{R^5=;J)Nbhu|~eMy?j|
zq+o)`hmh}iEOJ_W9`j<88cH7)^!av-&aOz?Bz#o8u2MfDqa>|;nbhjZA0K*eHk^u(
z3OpyN4b6la;scTcIbX$T;n}0?TWx8XeB@1AuG6Td)R4%@gImzNg}NpZdnpFG)wL9f
zNB79{6Z)+BXFhAKn$%wp-iz|rX^rNWu-4}FUEdF{+|q~SD}yZd0dR)a@n;UePP*Vy
zjsnKL)B+TyXPO^SKJE5$$DJR8v|oz9e0l}BR)~^S*(HdMbQ!Y~=Am)c$Gs`B+#OOG
zE9yOEgP(ro)cDY!mE?kMk-v;?+r1TWHQ@#^fQWQQc?3rnpcC~mAp-ZUd(_gF5VE1p
z!{Nl3VA(!%gN~?(7Sc*T$pp^PkdPwu0f$B}FnD=sH-B%?_qTy%b$E-IBzy^usQQ_<
zAe&6(L*5|g;i|$Z+_;HM%%F<;uv`6%Yvu4!(WT)4Uq_P?tKViiZeU&qPHpi}I?fX!
zZh=A{gR{VJ_nixoCSAjqCLRdhlSb96GyqdH^SkP-$YB>Lv9z}7#xwO#?xs_(%u<`s
zr69Uo+eOMfpmpBSB;(RsqDK@#Jcn#RHCv6gzqhiX^eL5mCXZGv)qKYYIZDGKpU`u3
zi|_z}IT?dhJm;6a{w(IQdZm_v=k+TaJO;d1HDg7>nS;f!BlHAsv_1b1ICzO!RS>H4
zv%n*$%`lRMV-#Zc2ysPEcrpCkS(IuFiLD5u6{A%|*8}KPuj8~5$_GaLKdc9~ekcmp
z<vuI;^-NOHup0}tC?InJfR6AY%BTgH*Pl#%BuQY&WA_M*E@H~=to9N1_!xJ=(n+u-
z2^D-z^xT)rScYckPoT<LZ}D;-Q3XziLw5&Rabfq3BS${Y${QRqzFx7ty2w_L+&iMq
zslC!N0&MqX3DiXSil#i~dc7RG7Gt?!m;0}`trKGdKfZP^zO&F<bLs5Tv#UI(t)Y<j
zKs={V#R50N0}_d-`<CO=Hkdpy*PVB05hC2Ke<zi^D<zS$){QD4N~_yl|HiEKMS=Nq
zy$6T>XVwdzW<s4z7Rx&TU`3Nfki;VRhw#$&gjD>Q<37__G|c~+iVgb<xr@SmmxjoB
zE!LXlbu^v~XBMfTA96XrL%S(_W29@BOM@!4vOGCkI(|4=A?5D6a|~(3eykK(lDYX&
z6i0Ulw17k}5M;R{{XIR7JaG$g2Ww8b3q2i|qL8X*%q8S1SK^!zH^laq=q7HcPi}Gg
z&CB5OqDlUk&w5>yE8~xU9@trPHMP|@-@qHOADYwc)A*i0CmiZZy|VD@L0=$CBE$(2
zrA7h27mr74*N&H-^L1<;U*Z}sI$sc(`a0rQ_*LP_6+IFs_$a=aFoawK*BE!g2{|@D
zRCt^wXd~jN?QZLb_Xux)^(3wj3hUliyI|H$)&~}hVETh=hdf$*a0C2g*nyqBZcwGX
z;m@D40&G{Buk1YH@D%dUhw+MY9-y~YiCiQqa^{51Nc6PGaMf&SrdHj@!J|su+nNsz
z8cfB!v6iXSKFtD5pr;{U!88ZPQ_!P;?;(PQ&k|3?Dl)Sh7Kyd<hFMh~zES-umCEAX
z`>Flgf|bZg`PC}EowS&Q=u@@kBRBy2%+sve%zJ8uN6@-<15s|7ZiyFh2B~MZuPQWs
z4GM;0^Uk~FD&YE&7(v%-<A-hP3H+(-Z+~Bz?H@I0m}IJKNapcnxr9=XK`f>r=tvhU
zhp>=Hpas`wQS+vm<ceGCyZf~T*Ca&s+3Z@VqhA3@Oj5wDKDjAG3!!Ug#FUprL-`D=
zf=l`pB7Cz0XTD?_eNW~8@`z{252X7-AS5H?ix3;0E)4P{FWUYB-de-DBNIc`;(uFA
z#0^|Dee4aZtNsIOv!}&nQs{edU<@i5Lny^2%z0p;iL%881wS<I!{if{^pesp(df9`
zJrixTY%Cp41@?m_=mRSp#Dnh+Kji8&e^fqcv>D>I+}TbXFfpQTZLO$T_2n|B3KeDT
z10giQLQclh@)U++4ERiU_r4J>cqjA8B7DGMOvKZCn<bx(*U{T2<qjo`<cS5-!wkEv
zk#VG#{@%_Qveev;w@VxPwSWS1Z}qj2duQpzL1%oRSw|?GeqNZlmS|qTIfS)Cc*f&c
z(NMWH()x3n-Jt02EW1)0s*7%ng1wD4;@5_ucoq`d%f;P<O4^usiX=&YqS7ql9MXTt
z=55dUNSQ_%rQLYY5%ibeQ7PVd+ZhAc!m-4jqgL){<s{F8VfMj=)gc<6IOAzG1*1)Y
zRF_ALX}VWAk7Z%rTiZk}0{@W{!O;y@irH$)ylz)<%zZgndns+h%?lc&oW%63ptD=<
z0{j!z;Gov>f2)A*uNV*fXY7AB#0uLXO87R88R<cBz_n3SmF-F&<~MvLuQD}0YwrzF
z_qhR1fHo~`tK$uq)X>b3BX)8&QnaZR^<Kt*XvmF0dH+t%a)V;2!pw|LW~-F%FDDWA
zD~M(a3!+O6;tY+VP{(u!E=0&^xRni^AKJFC2y<!9)dj2H=D#$jjiIr0<{46QPFZRC
zuWG6gw>hXz#Qtv^s5SwDYq7!`!|(lTvNuypc)Sv+a?R^t)AO=hk$J}aieYncYJsoX
z#Vb0(p2c1Q0*UctDP*@dL3T35UY-H2NO<77ykOeVJ|UhIm{P0Th+|XVQDY0Etmm`n
z0b__K1)WDtGA2sEUiJgj42iaw@Y))$^7C+G<m0rS#^BRBewc|;_)X3j7<EdX=0?-D
z3ot2-;{JdVJETcs6BH^K*mx8U;VQg@_np>Ief1%H#A{QrbEj=q*M&y+L(Vc?Lx6WL
zOG;i-%GM}R>=!{t>zoaN{T8l2#jS7<tMqARL&+xkb_2H|ZGBd}o7khS9N+Tl0hLo1
zBHdc9_$bN=6~hJ_dC>mzu+s4!<!5tCN3LPqth=eokBhmc!;#UqO_VwTILV@yg`mUT
zIemyuep-15X0e_!_Ca|2vl-E3;4Y^3poOJ6X-7mF5Z9nM{oN@vW~3j*4%frS^a9|R
z6)Zw$)N^ZVTh_afy|als%|Kd_Ze*D6Cb#%INDJ~;9zg;Pyu1aprU}SzmDFf^Z$GH)
zs{71#!?&_NH27iw{~B|M830XPM?FP^0y(a9ozlC^1f=ogA(+D>@bkAK8S5u+C;6B5
zu+bdJy3chx6W@99$hcC2DGV{dj#rtSp`ndiz#ea%c+H=kXkcvn0DF2lmGwz2s{!X%
z2FsJXZH>*gl3z$Ivo@#H1a0hlJv4+K&c5XNSfd=+XSim26+L^)*yz#by5bYo*`u&%
zfniDP5TJ|#uI7i(<PIS`cbo?QM_^B_iOF{iw=?3CWUj9g3b<&+$uy~Uk<*XwZ6QO!
z+w>tyQ^>Cl^@K(7t*E7i3j`;*chmRcm4}t}(5YfmhWvg!hp}HOP&@m5Kzu9QhtP%>
zr!c4yAEZnfW4IdRQgF!I+0bpnHpdpZ#oA|b@+H%HS=?{U)h!2qeZ4=EaRM<t7$Jyf
zZUvXXHN9gDaSQian$oBlH`G|;RGv7TQ%t~W{D!~pag>VaG|6Z9TX0#5OJ)|qlqPAZ
z*!MH<#v;cJ>P3AsG8jZ(l^tYQJ=3eWiE<_BVVT9dL%=`U?<4QYKA*chZPS)zd^?&$
zZhJSBg=2|p?v*OyDimiN0C)2y-XNflB!4!<bl|ko%k36yZ%JNt`R<i1o-8`Zka_q1
zhx_DCy<2&63)2=$lhLRrc@cp8wGYWA+-#?)AoxE2SyDid!VC>VK>x~eES>w=r-BUx
zE8vlM8x2GYdT*!WMV2^wwQRvt)9Jt8AK7jkkG5V$%(Cro+Z~g*a<Jzss|b^r%uc}z
zSq5>3ah~6Q5Bmj3TTL?seoTG@S*ZME@uq;!+ZlmIY!0&Wxv9xj<Q=Jzvq=w#0R*H8
zxf10uQ=Sy0?U5yWU?ldwu)cXOD>95#Uty{f&~O)CaC&tuHF;uRE0p{hvY0c^MTo-f
z>!8S)THy6;NMe24+ENB1wRg!aztVOu(fwQXKFYCJ#i|frHKup?(=c2Frau+<;2jmh
z<Eqa!(sSMabJ{C~6%Boww7jF@;BV*_2anOsGv7ooc@eT90;FrWrXHdIKZ4oqg|$2D
z_sVzl=OD?mlluu+@5lufiW;KJPF_oJ?NqQ>i>>}ACex%YoHKbsyVz}A1v|(GYR<-9
zPU-|J_!^65Q?gWKbw~8as~S9Y?=ydRW2`YI6er+r^_B>tM=oa`apTptrLpqU(pckd
zLEJ6O2UKtHz1?kuck=%Irt!3IM!s8fGV#Z3=+6V;x4U;b#jg$w&>c#0B^31(A!7=v
z!!;#^iC5|^U)jW}ZtX?hcskXzJd@~{=zz-F{S}1a?iopj;_kD6H_P*<W?|s&$=013
zmq*`=EVqNkX%j>4)2e>V{HoLc-I0d}WU<EGCqJD>VYs*mjse(+m;{8&uz1h3Zl<Gh
z6JIP|FtPvVi*&ZwrDm5GrrHeo8CO9TZ-C)}wH@@dLx`kDDDnZ1RBXIxy(`!As_{bB
z@0qRP=Pk!jcMus3q6+KesQ+IS_V8_d_caahCxXk8S=u|8`=Ygbn4bIx=#^yC8_VsP
zQX5(&9dQ+vFLlOAdW8#XeDxvz86N=6k$8n~nK{^2NV<+H?%}7hLA$4u&ksCy6nafp
zBMd`wKQl}GPPUw|e0%*WQ^k30pfBX0bTSf7HPJwg@feAr2)_<#TC~X+D;1BBIj7`y
zMexPo`C0bCX``Uex=KuIKhsrry*^Ls?OP`&*~27(Wr%Hm!GASB&BV@jX3EAe;N_(r
znsa0NJI_AGD}FUt1M#Y8!twa3)BV2bj1-*u&Ge#XysDRql_Nx@F@-vWuv+sT_55?n
zS7!gkXC2dpQCm&kwbo6?Jd@>v-0~a05obNCG<=XAP(c;g)Y&FVM4_H=k9P5mRgc9z
zKI{#r$Lom#e5Z1se*Kzu%P>Fn%43_Ep4Ls(0iv&Uf%H+KP$q^3W5M{Np8{jGQ*wh(
zQI+!rH#0>&Cy_vq184u!e=jHhkJDZ`_hb6NghpU+e$J8zd}<rpdEweh(OPQ+aN^M_
zo9aDhVI|)e)%T%#6Wnp_>LswIp6QfmmA9lB*?V+N=|S5*i7C2(SnP(%OeWS$s%*p(
zh<^S*#9~Fx9h*PqXjoHqVBVc6tnM#`gg)cw;zbv*^3)^btmo*8?-Ik6opkSO`;v`C
z!;ON{T@wEh+jl^+0N$=l-B0fxz5>qYtLuN|d^i`OJfv&o>uMQbUN}2djy>*+;@pfl
z-Tkp&JGrx`t$w1x&pH>`bb_}3ZF1lEp<<=MJ&lSU+(_&}3ile9(B<#q+}A@sunjXN
zZ_LGReevb-r@7$a+u=M0!J<h(z*yuH<2jfJT8;VgJ9O*;+3F;1X4J8nIGP+*oA0l3
z@Y5}&`;+gz^SF$%lNTW#E~~%)CAkk!`#%P<Ht3uG2|)HAq@Vn|{Eh#v-=X?9MKJ$A
zj_CQHN<t(M1n_iD$ppYroOTm3uG<@R;l7nDN(?&3&lUSqw>X>9O?15dxEwEug^BB=
zUE?U12ARD{yr8`pejQ*k9DxO>*qoa;jvM{LWT4bEp|`}~6>H0*v@f$ad;LMRcc^wF
z);tc>kMhZ7TKtqj3RMIeaiOnoVWui=>|6KHkVjh?3t-|D<bLXw@j?c)7`$Q<A_Ku0
zLAXfbgqRBW4e~231$&ZQiZ#gigONjaQi&QD15+BU(@o=yS{;$g`YeNhRuVW03&IdK
zvsVy;72g)ekDK7PhZDMWTGz|Hav$Ck=#DB)ySfC24+%)Wd;Mc26k=cRsofBK32o*P
zATzwhdhb!r8U4g~e#dQ5FWbe%)Z9Z7o-$DkAe%U|1rSLhg)D81>phi?>UB*2hle1@
z<x6U6if6N?^eHEvGq>&|u!F9~trWKER{D7;o4-VYS`2MsZr0rW&ZRApG~f{RMpYs8
z-Q-foU-<JAp(P(~*-BU~qKvW6z&4Js8!L7uFbCB)L$HdvE9O5K<d$F9(t;$rLnWvW
zhtM7TIK2co_>(JyP3GyLJkv0D7UFFF$BAf(b2-loD0UxBw2Y~Fx1p+(0cZnD6vVBP
zyU&lLh5Opd9ZBN+Sd~yRt5g<$#PeEWwD)6&zGZt|_3O|@m-rI|mTrrRXi750%}qvX
z_!F(&TQd^iZE~`DF=^*Y@2yKjn4|>eZcG6wx783Q`KcTu^6L)f8Iokp1Ojt0Z@bCj
z*g9sa1AP=%bq;i*^>pUN?bOnRYcsh@p;W*|ovRQC-}nQn-HnzpMaUVVxUE*M{8H2t
zjKX`VM|nn`3RtXV{zEg|c7y;l!_?q()r11eThA0y4qh`fbfJl+b>RMvtK?e9Bd}1&
zFCoQ-pZ<A?dN*+W$pBhjC>P!&?Y^hSHzG32_{-WQb^Mu3gv0yt*`|3YqlVg2-Z=ul
z5$?Db!6lz`NW8MCRnbUaLN0g-mRB8ZkN@z1LEo`CeAWd-{k?p@oWf99?0y}&Ww>OZ
zjI*?~U4N-0m6#FbU0}XGWq4M+nr3pX(gF6mCmWoop;<<F&^zI?!KYi}Df@n|zDQD;
zy}*F=bC!XC3Ee6hz$Z+`yde(W^fT*Y(zBKe?%(HWh11{74@pI%Z~Y$R?b^~_kKcn3
zq%*fAJpfOM0E9-Fza5r<mTp}Z@y-=g;b*cue<Qui>~MOn&iwf<K^)OLGPSeYn?16H
zCTc@T8i1CyV`K9kYTV(6Lzu`-D-!zEMW_3rlsf|)AiLPX8scS2XD-(d|8m5%_ff<I
zl5!a~^YGpLufcNWYCXOSvQ<K7#<*X*M<-e9CUI2#7@+b0p18zqCCink7KF%4P1nsa
z2{yg~JXE$J!+fQkEK{V-dHH$|c~1C^Y|T46^cRX7Ct{<XZvUoxg|S+G^z7l6hlyp#
z5o3bHhx$Ny5(g4<xe4n=6DYIPy<d;qE3~=wNx#lH1uQq=xOQ$Bp~txg-hN5sBdL**
z?UIhguvTm^zwIbf<%f-lPe|F89PhVjy1&?Zi4SX?@7<6Z`WC=!jFetRh5rFHAbV0$
zpqy|74u#onSY9Lqj_L%IJBR?aCL;Ago^wtv-r3hc4h5DMrS!WXg6@cF)OJoKL7T#}
zvC!bT)xoi+Q*}0xcD9kgU}`n7?DFX0qv-cdOc7lw2P0d~L~g=^qpP@iRI#h|Av$)K
zWT@Fbnfda<hvvRdt^IL)T-^~Oxpv7ml^|Ej0{DVnkMR^8_GK&^R0_L$Cs^*xdH&&_
zyidcR{_I>!CG^`+31G#@uW{yY$%(s`a;}CgAkA&f0)qpm2id0RFj7V*lkJpgM9o49
z#AC)zzUKnmOp6&89FwWhddGDL?&ZCtNcHR(?9milsK!w9=%a8WU|H}a3WN*`DUs7V
zz_TR93Cblzw_m=t@N0tzqL}h{=}E1j?3Z1u)quz`eI757$8@~Ropd9B?jCRpbS>0!
z?nYxXozY1u9?VxjA&wk(y`3OCe?Uc1-p4ibpB*XmHGqcy59mmV5a1yiB-bz$(2$j^
zfFj;>$rkwo3Sn}@A(em!axo9!6{|H|JjyqrJjoH5Bw<8v`E5H|FZ0pg$tumMrQFr^
zBhn>{R%iRvxm&!efL&N*h!TMpmt#nPF3IyFx?eoMkkRVDdgSX?!hD^lD4y{FpP}j>
zki^B_#F<!Oa9bMHE<mIGpLAjH)g=g_3BjkKxwQ5N^s<=HWug63U22Z$bK>yMy|p+E
z+P+|3TW$aopy|Q0bOxd$i@oJ+1`L`q3*uK4g?On1l4_-1Cr@#{#|8C|!;UeOoJx1b
zW%ugn`X3G&$`+02p)CFF4F1rAOP`<W?LPZnKB2XFFfYFk74>}pkbKVrk&`6K(}N9(
z!uHn{|7u1rjQ`g{tbg{ip^3xy>OHNRJD)4=%5FU;*asAAa$WsV2OfC7YcGvc)BWME
z?+;C&h)4ES5T+(v9T1;AN^}+6KnG%4FZvZNot(^H_UU=Y*<T%{&|4{Zs+@73zv!&N
zc=a8RtifUK4aW25?x*$z^TnnXqWPlCK%lcA>U_@4kz*cbaKi(OWub(X!vn*XepG-d
zS>y!Z24_~#e`CG{!~Vm?zVl`VK)e)g@P)h%nKnE8*<NEaFX|?3b7#%$GV1`twWQcb
z6<2&B`Vd#F(Ik#rM{R^_L|rIBy+4o5rf;4D=MwKc?l0hW{W&AT*%9XOmYTB~HmyGz
zJALxt`#YylgsHOm?J<OxtFc^Eh%n`QqpU~31*@9@Wp7t*OquuJ0>Ly1$X@v=G}dCf
z0dI4J#+P<})?0emWY11;41VsfzC5a2AM~qYCz8>N!zM*?^%~PH!7$r0Q3eqCM`1H6
zHd{PiLvOLtMh6Ftv*|jW`(fGeGi{o`#}yOdy(fNFjpj_Tnq%q!CkeQ#0o+Ugv6zo)
zq)Ti!zy$Lzg~I|Td(1ujWVf=<XZZ`Hh!$R5GUFOeZKr!=u-1&$03meiEwC@Q^-6#z
zTo3gG6>(bHFGenqZ8v^gXz)~Cwg|VA;~}Nvr+B0G;uU><HvQ1#tD>v%r_@FhfOi!I
zIDxy=55V!(#=WXzTH@$pV{8C&#;E3vJ6D*O+~c|{^;&mrwx?xlWrCW7N0@$4ojU4-
z@FTjELewae&<6RWhFx~JKA}u>o*ie<z<u3)-P%{RNOohmR!P|$-);a-Z;5~3n@&xA
zxdZ=?kg7P;6PBr6GrWD6?<-iFjsLi^=9gNI*0*fO`~r&A;lg9^FAtk_9!KZ1G)f@9
zc@r*kqapEm^(<Q_<%AjRQ8Qe-(gv2i)2|-k?fukzTH3~dRn<n1O+Y!>*Ft0O87&+G
z5U*N<L!uGoTZk&os|e?Zb^P^<Fe)Cdc}7#JA8YAcxA*W%+A!0YzPMZHv`<4c_ltYq
zSw`~!i9X)5<B}_cXOTRg9#p3@iSJGb$Rl&Dx3OG)(2!F#0kRl9+|%14<A#=!cDvLo
zxsR&warl&24U4Cheotj8Wktp^EWde<RyrmcUSea^*QHJrr}hhx4H-o>fVa^&^(E)b
z&JjA2QLabXU9OA?qYrKsqxG*FKG({m%?#`ne-!b5>DgN|u*kmgGqbTr7vatax%#<d
z)qmYFjWMmrP7FDMTtLku4BuG1gI~r?rf7&P3d-Lk<X|W9sJH@ik2$l-N44zwTQ=_6
zUZ3J)&zUWWGBp9F>Gq-u3FK-7)&iX}Q>sgDh92qRT>2Z^Z02;o%<~_AKR_M8ygiHB
z{X}p6%236(46y9eetY<irMV$*3P^WmFmfxNw{u0+FJ}}WnC{_hP|?b3TyC5O4;2H9
z>wK18j3+nevy4wm?*W_-6yI|cP0rW2xU|a$e}-4iy;xuU13=PL?7xkT4`%aZ+n@+X
z(U*GT9%JefeSS=C0FqmaWiW}84tTV<J6Y(~Axs@??#9k|>fV#jL9v|no)E)Ev0Rf1
zp0io63e(P=tIa)k_A{XL7{puj=kY?E!OVmaEEiI)1$(ybN9B(9<(U<OWxK)UooNnu
zP5OQG4GHR<K<NZRTp_HeH-zD5J(QM^-VUyu(@C(ik}YUgP38f{`%BLppWTqU_2Qa9
z7<6QJ%OBrEVc;Y}2~E8e{_i1b=zMKV!tIu{Jv+v`E%63onM3hc%H1Qq8Md2Oqt-`2
z;L!$7f(I}@WB{v`$dK;S`J5^^!jl_2658OFG3C82oZJ=JXLzE%jfw10FmuotaMA^B
zU!wyfp=Y(^2#_UIk1QRwDNNk0J~)I$Rpk|xjG{D02Jb^QnpFLYL@E&x;neUOnm6MK
z>J$c%C6+`mBg&=H7<=3W#5<`)c*DhjVkEj>p7PxH4Ts*!nk!B!3@-D0jr#HF{Tz!x
zN&>=Z5VBYZZBXmhr^wzS-qgVa+2m~I7zPEjtCh^wmw7f=n`|;YI<uU~19^FE6-0e}
zKAr+ZeY>Ub0Yij7%7rBkd>&4#*8i*B2;5uV^|*9)X3g4(Df1@mvFrThM#Kprv5a}&
zDUr!y$D&u3rBCZ3PPe>(pwv5p5%gWT(Ae5Ka|<?6D}7cmfSpBhkBa6>|9RbW98@#+
zq2C}|e)u5@11s?nY@|1YYg9`OjUhsrtt!7x*1B3dfA!kCBNDG-)|i;IsD8#+XMH$`
z1r3?zrZCVF>0k*xtw5;(3;Wsv7m2xQR+(y|TTtr;K6HfM!?nQG*=a}@{q0u7t7kw>
z*ygBhUMR_>kfejt10X4wPu2mFZT+Y<z09Y9l+c`Ed3=7jAzII|&;QNeeLNMKaNKoW
zuNT4qB^X=NXb0wrCQxd5E#5BQno127*#jDX<blQ?_tQQAhzV<ddJ~4~_G+A*i~4ap
z1dG=+ck0qgdKdOedb+%`LxJFJIfj%08l5gttD-QG&TWnN&KG^CnbT}Jbov9b0^44>
zN|X9ed~KKH<fqXk6b}mB$+6}U5Fdh$Q%3N>LV9{nX|SutKMJi1e8>}9dQTp_>iH-f
zG1lZU^iIGgF+KZwk?7CwK;9rP%42BZEM-*d9QiGU6XpQngZ1>@wskMqNvh}53F`?M
zzpf`gyd3kY3=~D5m~{bM-f<B&Zb<N1lxHPrPwYJhEFW%@f$5zzXGX1WkJW|;y=oRZ
zJb4W)Y+7(!mDpi+VAg6h?iFqV?&GGiIUZ3Fh|758s<SIrJYDboo$WO?o|<t^5zQtF
z1482nRXx(%vR&+24BdLF$X20LVMQH&ZQcGpkv(JpQHP30xgeuZobB2eNF$+YrGLRB
z?F5O8Q2F7@WyK(a)nZ6iT}svo%p`GgQ|>;%dXu|Q2Y6@u2qHCNFo$#*2tSm8p7MXE
z`^mS`RtR&{Z^P5YsW1jh8&)R{`S|-wb<rpw&C~QQn(39PocMeM?rk$5j5XmX9A^Q*
z-r>_qgxZnb>pyb=t<kWE^^9(ll8jEJh=fzlldYX+@jg+r=N=!HZnF?Y33NyACgGC)
zcqOx+c|8=~fa08+4Q()GvaX(lqenV4M*$P+Bt>vgqngC4EkS#{sYri`_9`ImEU)MN
z`N^JXMR$AdbWfQj)|;YkoL1q<iZj}dKi<7gGY|%k{RDVeUhDtQp8_q1#VUGR9hj2Y
zfvO@655Aa)=SExryTKh_Zy7TB$!gu!X8l<j$YZmzsyfX|_j`q|F1f|76P$lwfd(p=
zJ)wZlgbVeA2v8_cbKH}#!XcltA2ZYFJBC#{7SaVdc-y-!1w1xUQle#Si`a*RLKZ*S
z^Wf0{rA3l#B{)~YUf#xk#osF0y#6MfSI&I-tNA{ovGiF<Co1aVEvmyV4yx0~OL<_J
zG$u3Jiv-L$HuX44oP(0e-0yM@kG1@!`6p|iTApZtj5$w!;u0tfZi@>kfR8T@P&QaZ
zue9Liiv&+z+qJ)%8Q6966zi_%YBON1N%3-W_T?Aj=7HRV+mqud9Pj`FsswIIXz(wC
z#rNpe83sYm8$Dmrv-&xe{kywa>=!3fL3rb6`xPuo2r$E>Fu?q}z&Oh!Xm<zec>dV)
z;Oob>h8~7atUU~>Inqy)&Yt-win-A#a9)D?^cHepVFq<{o1Cj9MEMG3(~^Lxbt9&7
zC2FGi-+G%;PO`*u_c&9-HMYTD1)~|3a@8$1)8P={J-PG;^jehg0f0PT<el1i-{4)S
z_CJn$aKwN+Ux1l`9U8sRymYd)*p^iok6revV!A)5Do|Jl`q22k=$(K=>%uQ!dsbgf
zE+wfWXEymHaWTnoL4<5{Q-PsmhM~EIbMlR^ANy=PE`ABG6_H$WyY@GV;zSV<m3O%0
z_XqT$ZgK!szg-tH2yM#jflPb!EZV?4umB0!eGLnH@H_EK|5eI&LMJg=GIYawE)JrQ
z&oX5V)N1~BCk8|QO)1#_7EtRyH+08iVX}|XHdb`vc^<a42}pfPOanNS&6_viM123s
zQs2vLx-QMjx(4kQ^6$&83n*XLDPy@dKrDF>`{Ur+rH;^shNjxa=x<{x(dSqllQ<rm
zU3mQPd?!^H6ar^$%IoJVjnz_f_o+q26%*y&R9*SL&Xs5`L;WS|9WT#w4OZxFi^?pN
z%TN^55rNmFY>Vt&yV7yE(a{$8oOpclH-E=q;y)u8IQMe_RFi9U>03bocy0~FTHtx}
z$Mc6jJvkWP2<`R7(QE2=B8#N^C>k)w`;!_>(+e?~6mbe?uBPKXVW+H0ttTneX`(5<
z+iM2ANMorou<P0|vCbAbRCl5dF?`qD++pwE?*9h_={$;;eus;RJJ{ueK@IWtX)~27
zHn5!wE@Cee(;?fEU-F)L6d|=fsPSGMv??l5G_nH-EfXL%?tjAF|Lp53$NpTIF+hZ6
zXWTbEvsE{Samy35P3Gh#mpX6;4^-uLcmip)cHRlrh@Jsd0A}GVPlKJ)p#hRVN8S98
zI?Gld{0hsZw!JN7_lKX2qpuH*h9I3+zAA9qI_~To*rO&&@8fQD2UewGh$wDCjRH1>
zXPErqqm$pc$FZ`}0gN;-6PBCSpFhP*GudA@`*f$cl_Ho~XnkpI%q0GAv2Dxnng2Di
z>0iD-@7J$&xf*8?=|95jUdm<7oHR^Yz1nMDql_FOe)2f+8VxzKfnW#ZC-44%SW&JX
zYZ`w*Y{(=VTg9-<jD8NApbGF#oZN@h&xPNDEOyiY<PLC>OE3Hy!P53B2D}VBxZqmN
zw1hZ{9O4)Ps)8tPBx#!?2tmHs4N*N3uEh>ZoAl3&(@@?0*saT(X=l;=o*&Xn+hrf<
zDEN^&2AFsK;X&2-<1MQKpm9yjs+kbr=~L|Pb?=Ve2VJ4d*M0;2LOgNe<xe_*C2u%n
z?U*8pL-#FA)7hl(rKFJVZhW16ee`V7lvBJW10SaOg=n$-vKyL^y|DEj<2{{n<c&A#
zir#%Nw)4FF8Eo!j&vWG|rdyQk8QVcQJ+oM$Zd5*?Re0G0SXnI~HK-mtDN9n@d(+NM
zcD5^)8)+)j>^qlIxz}hxfiJf`@YEE}ms=xvc{IKJYoF4!mvK)|`e(}Ds2;6S{($t;
z2|#lWAmv06wczIn_m_4#NT&FS*O<>9c0VsBY-L(7$Yl>1M?CkHk<Q{#&SVSaG!Qf9
zJj^2jnec!)A6z?^626%El%hB(>p7>CG|_nH*ee(>^Niv@7lK9rp|ZRPXK;)oR;|aA
z&UVtjQb_aW-qEp9Q^w&RP<?{krTVR0R|T|GAtuZupUELq-FvF^s00YP>?((w;-(3T
z6T296w4A4`teih5H)DBRwjQ%s@u;T`RLqHC>T!!AwF}seFnOyw0Tc2WQz<neZ74dr
zQz_gO#dWnX)~4Q#?^5WePt8=o<i>E~awJF2g<m8J5Ont!Ka3>Gs318AF(%CukpYGt
zEuLT97-$;Zgmm>MxQ3FI+DcW9es0&!Ta7&V19}0QRyueL@It_J8qROrrbFoSBo8G4
z!BM;QpTR^~--QO|aSE`x71C00AFXL2xDize>d-w)fgV3(aB^@3%UyDbMz|uctlsg-
ziN(<+a=~BC(KX6wu5?Y#7rbf-T)o&eRtuN`qsBJeMeqLs-DS0h-ZYWikUos*1lRS1
ze1qcdro_&JCmtyf%6o+_Og6mt$s<2%ZyW!8iA(%l7mxnHAb-ylVt=RtWHIseEpNc?
z6OYAANEG6q<bT_``3WGF(+o5~bPw#IxU=2RnUSL{Jj=FHg|3$tFG(y_8CaJWhn`q)
zn`C&r1RY*Xm{-F~D@*xGWB=mQ{Qe`<h%U`l0O?%R97&-l!GOXn-I{P};&NTabT@y7
zP_*gLnN@J`TY&=fff`XBes&b{1bCGA3C2ZR8Nt`VY9=k(DGl!I@M9&vZ;Yg}+}rNu
z)1g|S$dx=SkVj%13kZTN22_GAy#Sat+`m$b_XCJCf+!^MWAGwnWByPxniioy{jJh5
z-}QKUr%e2{OG%gP*BwN(#KX3x#r$l_3&di22u;G$ZohFdf{Wzly{cDkW#pmYrQeLF
zote{LGsc%redGT)tLgDnJ*GaTp5TS_n$s^E{&Mni4WY+jF)%MgF3@1dAu#FFq+mP;
zAMHpuvgmu&ju&-P?$(Ej<=Z+hy|p-J&(o`0rEsnTQB=JT3C=_ajEKF<_O^KRKzgR!
z{F<p36X1}$DqLR?@#6`SJNmi%mv^lpnt4Um1@}Lda*84#d9{FSXE*8;NVwprL!-bQ
zl7v!Y+)jeCYKwn~ox2)6lP|9*7gvqQHBfbZYKq{S$xXT#)M9}UEunyDO0YNzAP9P}
zBtHLqXMQKx!rs6so>9q@DQzq2E~0}NW*E*cm(L!N5`kEJl~<?N!xEdvNb<w;WAh^F
zk(?jqE6?UUQt{yNzJ2Bki|UieyGc!7)ueckcA+njpF4y?1|a7UPoUG@ebD+heBV+q
zkn^zYep#^L=#)rxV{OaZ8&4DrM8g>GPHYYFNp!xTj$cvMS_h(N;TIPZ=#`PQYcH<T
zz8P2PedTsEYTdhkm8#e&&djjdgpu`i*y}zQk`5k-ivVmy+;)V7CFuf}LPFq}%~09(
z_o+<V+Wo73Q92u6ZwO>>OXG+X29>3}SVa9~-+TTeR&pNJ?#}5?NTY`C-9icK?%bzb
z`$MCqV$ve3!UMRECzBjhzwP-6{@9dcRNd~jATbbbSub4y8`t?!30LvBZ1wbc&i!cD
z{a>+>5}jvm>Z3228vlagbjils0F|fmv&xSQm@IW!O4d99@N+tS6~zhUCM(?m6izm{
zT~mVNq9%Xmkq}o$b=Gs@Omz07QS|U=$G1xLGx%P`(1;A`YekfES!E|E5Zu3Lm7)p1
zJH9kNQrl!q{%`{f5QYs%K&NN6PzUKn35a$W_2(7Li`A|2dsUgt%;XWtmn>ExBvxYp
zZak9jT;PN2<Z8Z#71<cx7WF+kbrSKQUSFBLqm@7D4J@=@{Ud?`z18Hn*eo^!No*Lh
zd3krqzcTIfOdi}&0P;Tg0g?Lel03?j2qs;@ky1|{%()qSx_hoCAiKO_oq4D5QO7T|
zJ7^WMSR5#qRY~cCvOD}3)vvE_Y>j$*#?(~~^IXdKrv6OoRP34&d>NP_9=H5hCBJF-
zh)m!QLU1m8s9G8maeK1G@j}S)+UaX62+ndOIol<ogT@NZTGMPksS)JQRM*WiER^+F
zBCGhRuiC7rehVh_HTe1D1O#WC5}^jvB%z$;&%&TKaf=iF`gxY9xc-Uw;2S69?2^mY
zSKI5KA>xe3LbZ&5;ov(7VC^CiK=jE%sOR#O4|dK+NM~fBVZ6{yz;W6obRuSpNPI;3
z@|Tp|vRQo3wTb5QDo47W^0d6x9be(*PII>iLy9#@^LWd)pIGrOFqDeEV>kh@uRK3U
zf8LB52E2tY)pydz)-*gTC7XR~3uL>s9qSkscW`R4Ub;;MT!CW(6&{Mws#)}=f+_WM
z(BPRDriL@>oQt&uCMr1wcJqX9?+B^54#=kDXzG9hEw+}IjMR@l5>ytwlNVSum`i@S
z*A4mwl-yDjBV`Dg_2>xTjFj(;wuf^*Goemu$J=rL=acmhILjEEa}gO6DBf*M=kdb2
z2M(#OANA_17#$RSFx`8}TTA(gg8o)wpUt}!lqPDi7O=cxc*q%BaBiA57koyGhu8W$
zuZCKSHox6C$C&+mmaD+!l_%UX#^rUQ1W5NM#Nvl2Y?{t86ISmXA9#M~<hAj;ps-?l
z2eNp%{UwFL4_|6TE^GH*giKi+y^vmdZ#`}jG&J>mOiq~lX*5rv!K*iyB&IFi@7G?@
zwUNREF3<v)hzwxqn>msng*!E7P9QiMpv=rq_={U#^&k6ndsQx`%?&0>n(ODdGF`hi
z2RLPLI^KLRLmQlYk_MNCddU<lujhfb<j=>Aw>vs&P>QSq`;I}eqOoBER90sd>4m{a
z#MuxqvO6U*gpuHM*(L+mnBrK{K5)*;sUhrA07xTr>qE`1eY(!SDr*318h|$e)-)(d
z#PqK<?HXWBI|8g}<q&z#wVK)BHS~=slk3^1?#;lIPLS3k#9#ms5dEh6ZSJzDRK&zB
zseOTue|x$^^uj%&fFvqAM~iwCaKHmlZi3Oo^l^1-Y|5<t<-m%;!Gov2fnKqGadKg1
z)8Cfv>?y;8kQc%Cu0z}M>ei0P78|HVA>an1m6;G9g*brYj$eEm*tfB?UWSQzH88pg
z1T$Qtn+Ae~u7CGzS0PHmMaC)%FQgE34sv45)>r0iMECN_(sadVCv$;It)rpx5<Bt>
zi7m-=X3f@DUi1EvJi0z<GOxdY<A_SZ*g>~6u|x8FAp?2z{t3JqKO%Z2tb>}!D&r5f
zOd}4`xHy;I$D|{=?jwHpX#x1xEI-iL$7Qw#sa7Lpp}M_^XZnET`Og8z{~2O7*+AL}
z`H9%e9Ek=4YdwrNSwQ+Y2TRu{AHBe!Jm8Ov>yQ|S%R2grzh;^SjQ(XZ1%^)(2Zla3
zhQFw~M~hH`)~9UC<8pczaHif2a4+0SCAnx3#pE6W=Dr@O(4rULf7>I=!IsYdZZ!`y
z$9w3NwlMf7C+F`x<`7L1Cjl*54Wv(Zq+){-V3B)WjxPn8Sa0`A1OTyo+G%I4^fdgD
zi6k{*fJgSi_FMo_$d;fx&v;I}EllNM>&vX9#@xxydYdyzGk3^4TJ=<?#?Wu8+ZKO7
zl5oP~KOiUtK%GXrQ2`yo01V@aE4mwF4e%yOYTXlRiUC)K%j|UA)4p&t4tz~)n{gF)
z|Gj9juR_%S+cHYu4h(3tmvN>2yXV~(rnMMx{iPVZ-^W}0Z(tQpx-A)Eoi85_QAM3J
zl3HlksL1z$ttxJEX`u_6=xa#Vy}-XNB;MQ<Yb?X1<}>8Oarb6S+68zoudwqQKeROg
z$fDa`u7Zn^Ye?Kg`92JP5E;_vxAtANWb$5}4!Qi<qk+ha532Wv{I+j^iw{q_fMa1D
z2NpefKrmMy)|=6_G4Nj9QfW;z1v}3XZ?nGR^(ZXc;(o>@!PQ)1in#+qZ*$L&!YHk|
z1+6vD6a47NF)uMb27k_)5LCi@G+#!*hF;GjTwVZPn0^yntrrcywlvH(X+1`Q`h0X(
zdtp&s@qLJry-x4+Oj}(z>BrGkkyQJe$~oZaA__y8OF6+yC9?}$*Pp}OFx+cN)X1*z
zR_fz$hB3V!48QI$Mb?1<mL~Zb#(s(>feN>Jq)U!}E<LmhW<K*}$ZGOQ?97xaqLtBK
zYC!uWVz;-LRv^H^fFbO3oG24A+`$gWjoE(z+Th>Or>A;qfsMtRao)Sj)L*k&Ulma~
z+P?pI*1+@Y4XqU9svm}hRFc<=0B+sNKcMxhJLC~UI(}$zx9evUgoEVr0cN$!`nxH`
zq%E1=MIR^7$1b?%DN0>0q|ZtE1(zk4XtAxMa1ZVDmUc?ZgHt-QbIU)Wg^EN?X<2Qj
zhCFG$=Dhr*zAY}rQ0^Ss)k$}#_cwPGAVz)<YDpp{-<MJ{Z6?Q2ELyT8IYNV@Um5%g
z{z)db+~e}?=3vzwX{1;&&8IIS4kpz!p})k>b~pf|cq(Er4Gvgnk?O`|xu$%2#Ns=|
z9zX^#LN@zX|9}i#kW9dDb-9|j=hgDNkMJnDT2pfT*$<rLS7y>!nlnC+Q0UP>jk__f
zj?(UhIA{z!AyOFWk(EtbJ;emM@4OAhT(Gq6v1yv+-+O6R$#nV7I;Yk7EWk|-+SnsR
zban_#mO6~NTYJ7A;@YrwH5=4AQJI+3#0c^b{JOK{W0I9VOxakIK0|!?N`+=EZv8)C
zHTsuI;(rE*{J;9Mw{8-GaS|m0eBo}3jYj)dZ>YbH&s0ud&X-uYZC%)&*So+2XUDim
zeuPRoZ(N9`G_0gje&#WWw|ZFa<ULz@v$Q`Pz>`R1zGqwIzFJ@?)oWy@op*l}DzXU?
z)DZc2w<=S_bq#nl_!hn+Tv^Wchfl9;^6a7slkd;V_FR9LNxJvton~y}wHD(NS0p=F
zfJFN)XY>@2q`0(H8k(WX2>+~!>i^8^Lb#3GX6>zQ-JVI!UC@F1`Qz)l$Ly5{ed)~y
z)+s7;uE4IHB|=Cz)55(%D{sk`$4jQ?VWzYj{M#u>-Cn^o9yM^P7>|b%>_ezUo^?RS
zNgg7Wgx$sFZOcAbaq2ek5*CmiT{+v$-K*=%JaOv2b!&XmOF4)n3Rn2jHpG>P{(B(O
zK<MD2TOm|&i<*E)@_Bp}$#{R-NIq*k7DLie39-pN(Sg+v))(b&d<K^iCgrg#$+_oM
z`_+R!I0OSHZ5JZkb5mn94WX2qY;5l}TXCuzf5NX%SjKqpMi@LhQ*#7dsY4_ACGW7q
z%dF_YPv{?EWDfyu_Q#uEV<$NddjdM*xY;9X>5-9MZ+cH!|8oI<K%R*H_WeF68%a~P
zdj=gO)b%48ykxVaw84?TQvAOC>$53f%)h_v@jIAK2aeB&o8y+>gwrF76mp3%gvlcD
z-n?_yBgjSEkZmMkG-9Os&@sfR<8ka4j|b^3HkxPS7g>4{^pTF_0#<5r18{tM!5-Lq
zVLq^}%$juFr4{g!)e<2(ist<|D$CL~yTSZt_6e{pv**VEmA>|T&xD&lC;3pm1An-!
z*PC+Ak#bW3v0zA18ISz-(JbjC?Ig?M%ck~J-}`OOl_mf!BS{L@)xX4ZZK)v%lWE3y
z@NKn9UwM&%Ys4OsM*@Fuy~I#@J>?1EX<CC$kmYGcJpMB~wkfJq$7*-U9K6kfugarv
zK_d41|DKUNVbYUnljUmZ*N**+DjVzb-(+@Ok(Vcdf)aav)jjVez?ctSvUhRAi{ET)
zW+zuEy(VKQDt(DqxTd7<93*QhdSLTm!i%N>;2-Ugm9UwSUW@$5B~!X<k0~l8AtHp^
zWiuapeJImFd2}GhexgQUaY?eI^WmEoTdVm|=v4x0$s%%lupxQdM)R3ArQxe9N>D?(
z^h?2xUPj=-=E>x1n}jRh%LW#{tri%^Y<|hp>@e4AC~UtYpFB_HKk%6WJqca{QUw`D
zI^T*REmDA+s<>`e+Twxv)eMW+&9g!NocL9sy9!BrOKzdw+YHjJME20@g4TOSG+bM%
zwQ8h4e-__#I{BK?j0r9kJJ|L6jN1{JA{v6N?prnTMdg-)TI$lBb$P$M(sA|YJT%Ep
zTS-PoNi?@<qVF3~PrNtty%{f2@^AAWsGtxM><6+T!3c~w8zGtS0RMGmK7f7KX8l#t
zaT-N(4-|5QrBm7c`X%0O!0djSF^CF!og`$AKTc@Z!?$j6HJ}`e*Md+nM)kfzW`96c
z`)B5V9Uv{F@0_>H@?>uRP2oH}z3l6dr&1>0aN-XXcV_KQKgn?{a%*hW&AQN3UmGVJ
zt+JNdUtp$JP0bk?FFoYh^uk}v6F_Z?|5NZ87;ULnjUy3wZ357db++V02J>n&P-0E1
zD{%E&9G!DGJZxcQIG7u%35PZ1^%!Ax6I-30P6{yt?7PuJUbpAv?K;n!1@Ac9`E_=w
z>>f>Cu$$?7>2Ya@=}T2|snnMq;fPt*0i=x*85=DYTnQ!sLW#h-!>7M{f-1+hn~MH`
zWIJyE_^;$uP<4^+;)hFn@@O}-q*{!%Y@XA5f(AVj%I*y~m|PQk7wR*>t69#!xEfYP
zVp;s1VvDGU#aN~v3R;KIryZ@X_@t5~yXCHSjsz|OxNkxO{=;MNXB?`>in{4}%cLmu
zO(3|oVB}NF0kYU*vM&T1=^9*S4NTKB7IWo?cFEW6NptrSbWTy@6aheDw|Bnt|6-z|
z#*I@LMn92U2<@%norov|W4j&Ft(A6fBRiwarO@8i()QlOjOS8gHqV?hYsFqbX(%#^
zSIUP-kBjL&q9_pDFuNC~VL=aZ#Y)qkE@xI+H)IsJR<oZo$oDcKWkJm@#+(I85kM3l
z#9~QaO=&OCEKT`&-6bi61E%+IQh5P9GnGJmuhk#)Q3i>5>>)C%EHT8!6KTrjoBw{b
zMuiN73yZ}>*9)rkWSa(<TbtFZz7jun2%~X@(B8KO(uno}X#?$T0GZe%>XNKSHN+N;
zBkfh&amb$iAot0dHEty5_UyjYtkKia{y|axi^fuSlcq$Oi`kDoQQMnK@2PJzjlorj
z5+oDp(wSneYJ<WNj>nfwVn0ksGK7M78A8%e;{aub2&KD&lbqinPnpWqAOp0#D~fi5
z!j`>YKom;%E?YlVRk(GO#dQ_aK)mZ}_qZup$G1J>b<iUer0K6?c?hwkK;$JH_XDs^
zYAYcHlVl83C`QPCm~f$dug{*JKf+Etv5|N^Y-Xh-;;pHjWQ({kav(`GbDNH?Au7VH
z#-8U`d3z%@BrAJpE{Fh)QiIM?g_k5`zV?QKXkK?B;f0})TogeRwH1LKLI}Epg*xP1
zEn4q}aIiS$TW!49vl;M~<5rrjcp&wvMwe)^MEl#}{MzOz2cX9!I8qqs@QmmV9s+F@
zfgO_)M!K~m&jvf{-@g-9Z=@PTcv_HdDjnyQOY6w0aHpF!+^(ztObs{-Ty5M3PC(SM
z^vDKv3tc2<cU;=c?r$nr*`Kpod+7##RjtEupH=i?ZAGon(h5oXR0ufAY(%p4LjUe`
z8;}qZgoOYo?OC`XZU~c}QCZwqrd3)pkEZSu>=$irZ%#W`aNhAnJY**#)H0h)1*|no
z33b@yHe9?hfQ(}xfEyZCOYD0xwgC_i24h}G8QHDM9j07^TpGkdOa{kg4Ikb?h+@R4
zCw7EsJwy>VQHrs1(-@L9r3=@drQ>1hNGxS4tpQDD!5Q$XWgiLdn_amQuV2P#a9<nS
zjoXycg^cc;4Uks06wWPXw~whgdLw8vf8Py)n;zN;ggo@y-}_<GnBr}ZT0PEt1E`a?
z8S!*Sjs&WFxabeW6GU8VM%iPr<-YBojbYEKM>L0f1{ij4{IdKaE&>!0YF+ez*6(f)
z63s~Bqa+vH%RV70f)%FHfw3v(!PxGls0=RlS)-ReqO83_`q({3`-C<I!)qf4{5k=v
z+WRrv+W1mn=S<VVH|v37X{W6uX#>0@(ewI{UUl}#rDlmc!vVj~x-Qxicpam72AxTt
zfa_<m4(4jVh%d!nF2~PcG7~B^9^h$BF&cWGTqjj0;+ESdxqU`7)_IbuL|wl`G4Z})
z$)tv~zcHcv0%?p%fom_KLbb%l;bM#LU!tuS5@fue+o&5cblV(7+YGr~u(gei;0RM1
z>;ky|Rgt}Y3jIZIe9mH1g2sJZ9oD5A#qApSGI5%*+{koar>&v7KDVDYTc;%hw)Bww
zqFLg8CY8_r83^1ppJf#Q(g3|9<K$5ip`j3F*qL{(-7^3Kjp;x7iFEufZ!bO5vSQYp
zJyjGprmuQ4TvBP@>6Pj$<LM>@&^5p>9+Qt70m}R!{anW{aA=Pw6yc_f?lD@Ob5U=4
z+kQSftMP+}auHe%oY<1f)-e%8GRN=srx4tsGbyGq7Wlh<XdlP?o1-J%jNK5Qqv(_?
zv5OjL8l5-QOgmG~-jhgH4@t}j%SOn>jIm7<Be@BWlE#{-DzDWG7ySe-ln#p`lRhR4
zDS&)Eo&ZCiqo+SK<$C7!iQ2aRl5r?dSaQG^bW$aAum;x*l)HV!Do34prjWH<m~~)L
zfj_KE)8hb)eM#b=K8k9^y(n_TWgbBZF>YA(kM`0wpC8<6C2CeAUb(EG!xU}${w7;~
zZYeL_VHLn74FK=3IY|KD)B_HkUIpL~H;Yr_1d>nHoICgbVD3G`n)=^0Uz8@&M5LEc
zMY<qWN^EoiQRz)ZKtwu7PZXp#K>?)&1O%jn9(sh(6p`Lb3cV+Y5J~Z@-+yNI?Cb2A
zx%RovelaiB8^TIi<-4A8Kc72&yVk@fa_tT`?~kz`l_K&YSvPDVdTuP8lftkQWvt1H
z$a!_#=QONh9Q0g=M<^B^*K<1QRP#Cl@3cH3Q#E1V=y&~_Pcv`tefRaD3&5d1@&eF#
zKHWatb|Dkktmqn>5Kn7-405io%_D3r*T#849<hJx8|`87+8=g(hpU)GGA9KFplp%H
zqLe0bWcfk_Fie`LE4Z!BpZalQvrTdd*OZ)n7WZ?V!Lau}Z_k%n_OI@=>onF!k$N-+
zECqo^3e%?B0-h{a2Y;U1H3-Z2cg<?}S>gb;)5WBtmiP@5&jQ4Bu^d_3a~juEvjzf>
zH>Tcw6yJ$uq{)y)KdY${mL4nroJp$L+J{wSJ~#GTbLV2AauORbjI-AF@h6EdBx3cp
z*6kPjT{6@LL@@QW+iV6F&RJl**#YM^vH@tdfa0BNoqNMGvb%)4V3zpC309={#OFV&
z97l}O^%$Aewa+7`4QXwGaAF-07XvGm;Jbg!+=fv`Wd-S5rwxb4%Sl25%gO&Tx-KOS
zk)(lX^(g{-H{iXS)M<W`5d5l))8_g0J7f04VzLQzJPbCj7jL%*54}dU{1kdU0g8FJ
zny31v$$Y5cmp%C38NXfYM`Fs6hfiRf(0$gwG-XLLzZ7So$L&DNL5HLnAqxnOB5q80
zX+L0%>5SgmAK758kdR5gz$uXMh*4+fx0vBdCX0W0kj_m$Q2G~KPoJSHBAH`Ql#yu7
z)cT!>#==qXge<jF_ujPgTTZeKjqiTOvfA}CZ+^<A5B_A9%GI2q%;4+i<oTC|C7&b*
z6to2J?o`hC;J-AyaOkI3+PNq+lP-6JMDtY8!5e@n*J#RPnK9L!raw`2G<Tp~>nP&k
zV%X33l{R#q>Dz!Ed7Bc4bahV1AOpIBy)x3BE!eEE0^#Y2Pw6w)hRZP4g~!V;0v}(v
z&>OeT)SAa2!afZch$Iq_DCan5PC2imkpy9`@eXTu52<_>{-$J}F+GLz2Y2!XWxXVx
zvS4r>GgLmUV_TrNu8tWYOEn%)m7D-3D@`aO3UEIXA-abKl#|u*YB5-o%E8_T!zEi;
z&B`XcT2Wf|{W0%_eU13mk;+|M5TN7Ft*Zf9Xgk>pAdqhOoZDQ!)T!1bFjkuWv?afh
zuxh`knVh~_!QeahXZ0~ci3PFq`x1?{^oq|};x(K>?0yGmg~C12%P+Y<p_;!dtF2%W
zEh>XauB3VRo9?N#wH}RM*EwP^hCMdt=BTa^(Z>wmpJN|xztx;>cV{Ho$2H;MHIAuN
zqu({(fgt&3hab>!RP5c_Q|OWmk-ANII(`0|_i0zI7i6^Zt*whXN9&E=vp4#EuQ@1^
zm4kPIEBcO4H;icRfhIrcq$bi}JJ|6k;9SdkR)S-fFOF+V`9$nU_J*0pbVl9Xyjm@`
z@QFc0@T~t0_z(EP%D=8IKazZeG0_hTj_3C-!`ZhyLL~NI4!AbNx+^b6bC0E5U#ej0
zbjgx6CP7mT$fAKZSs{DUKWdBrS3N0R+tv?g8w2SiJ=<u9d~sbT(Ve6PYu@JJ_(k83
zSZ6qlW)nCe7zj_iwPK3bcuol=aK}(Ov7IKUtdo=L>c=UK(?h|Jz6nhs@?s)p`Nqbc
z-rc`t@#=*jKjC0*==cTElcYdo0?dx4wLZ%4E0lJ$bs*C(ceWQeshdi8@aKOyd*vJr
zZPAn7SK+^bzzvYa{FiQ^ztjI$qHE5S++WEX%L^(QvCEIWx>AJeVxpAmsyh<h*2ve2
zO{f{))#<g96G?IQo%}C9`n@!xyJCL`A8?&$0;iz4y_4@C-(8dbOB2MKwknHhSy3u4
z5>%C6jSOab^l00-)AUnf!C3%2sF*P0`DHu!qJYr{?nU$4Thm>Y(ZCehUSGyA-8hq>
zVC(_9DO@29>*>R=h2OFw#2;UwOS5p?kA@GqT#0@8UHJDeK3#Kth1sS`oy8H=YI)xU
z@s(Wk9J6HtZ+GCDb(xfE{}4%K`)zAVjU)?rUiI`N*CdYxWAZ+$gL^z#TZ&<O_HieD
zcxxQp<4K)T&L7==PU5*4m0+DC0FL(Q6lWobsE3o!%~*k-I^Mdkw)_oI6U=|=ypekM
zqQ!JOnmr`RgBxM6>G|Wke}qKY?oM&BKn_l<b*lmEWpHdb?e%tu>qngMn;AK%+pwts
z=-FF!Qa|z`#As!}^08Aej-9<tsRbbzX6@$Led$wYsZjD&ZEHtTCi~Acq8p402%oAI
z7Nv!ZG^)*sPvJs_g^_jf-~(t%<a_>SPf2|eT+1QQUMb($-IZF^4c9paw&K<5%OB^G
zhU+dk9PL8<wn6m(d4@*uTK#dqCkNEsoL_WgUJz6PpW(yBQZHVQlKuXB_@XD@-GuM_
zXcbIYVCQM@n)sQ%O!xh%rje0q@Ubf)f9ssWlKJFBkm8&o?!$-3#LYGe?_U}_(kFqB
z@+BAb2YmOON((*5mi0yRUW=3u5yKfB4~H9h7Y{g$eoYt;tgapGb`!k65merkAA?sO
z#_gUEY}p>QJo^UVP-b@Bipo$>rj)kyZn*eV;J3zaiM3i<{I+Qfx02SQU#fm3xEd#A
zc{q^qO_Yxim8E`uotuA7d<Yd%lq`s9iJOt4(D5&_1GVXttMvH{e?-yHzPa)5PAv<>
zB!;czX{uhJD_Q<cP1XAT;}o2nrBsP!T0e7I6q>7Af#ss9SSBEmNYT{25MlN5T=xCc
zNOR)M&Plwss!upa7Vo6SMro-1yktj=G5yn(oL@?dBAez$n_)J(mn|QA%EAhmNMN#i
z&|>xjE}xe`RV>PR?qKDTq2t>7*E2xHYui08sN6+tdCQ<qtn-5Xyn{ZkeyLsOT`7i9
zIIE0f!AtQZS&Pg(6)+cjH!{&elL2QbzC%^@Mq@VmlCqhF7F%_JV&>@(PLa89c(~DJ
zD-lCya_Lpf`JMTW7uL+zx#ZTzbsWGKNj8pp4rBtj;iNx-!D{`9ZZ%a^e+Q%9w;;N1
zs!{?0uQ*qA2~1Uc-&*+bMW8fj=DJtuqQ0h>14lR9JB{7~Zl1&0uAS52X!rh)D>EpG
z76U{yl95AxSHKUbs$mnDfxe-c1+LXXiapu$=)_@^$2{+S@(Ue;&FCdWPzD#Rj~!kT
z<(+9}YczW-3cLPxJ=x;VBGet3ynFS8Q{$f>ksXd##4W{M^l+sG#2NgQkkO!Ut-&|S
zpW?U>&=Onp*L(dX1#w&l3XG*zFdfaM0+p7wMyVkUiL^cfJ`VSZwt3s~)En4yvVkZ>
zh@}M3uc8RvP&<m^RG|6p*7t9`{UNxbiJF+??(~}*Fk^f%Dx*}_uD)*91iT)ns__{T
zc9SGWelltOGjx`Nf*Al;yDdY008i=ar@e<9X)aV%5^X8EJJP%6gVlh@L%W~ZLPv~g
z9|D~9tY2;Z6g*m=!;Y<J-*F$hQVGhq?z6i=IDea(uf=i%oUqMP_1%2jP<?ek81CAp
zIoGl3T1Qqx<Hfa5%yfSe+}!1A%z{$E@0CY~=Q+MqOu0kU)!-Td6Lkc)b`r=F=I&nm
zvGgt5AJszuD@ElcPGFb%6~{)S59`k=ozCn#<}X_N#U;lwv?vM_8I1{6FctL+vJDlh
zsRmp-?%K>IbJttkzi9gZRH{B-@Uv}{d`!uO=xkrtulB(@h6P9jT-9^e9N0L5Pqv$s
zD_~4M*eGkzaU3|ugSaBN$|IBseg#YCMc*ma;*f?^M)D0W`<`hFlglTTXA){4>?0dS
zL+p-wbrI(8^h;b4J|T2J52`fT0d@zf>1H>%+>kc+?^_#eWLUif)RyHp|J_I=<C}=E
z8P&_9z%WMaGJp2aOhm9BC7+q?u3F1ds9$PJs$i-n{c9oFSrt}xQ~Xb0xN1*W@$!&q
zlvc=tG4XrFx@ENQ7JoT$;0LG*>b*W35szReIgY6m_FE$|k6t$f`FEz}Dt@n?dH&XO
zbNhD#Xz3QOW!tnfE>hQcXnNza0NNWK$peUDbSQFw3O7{B=0AzYIAic|;zd)w+JV93
zC(e22J9txpz>wAZRb|^uTsRO-kn930rzO$8#`x(}1Y_U}b@k<}zJ8K)-R4+CF=hT_
z{?7ysM7BRj(&Zt-c=nHmgM~p;Blt9xgZlh-)_PaIG(8dP>TJj%CrY;sPEh=1?bNKP
zq`O;e-JCWCsM`^^NFIRZkr4z4i2wJ2MrbgQ=nFZ7Fn2dNc_>lJ94AXm!Nv%|kMJ6^
z*;w{_9qr-LT-&O@f@8tB9kO#5p%>PHN58gnyk-pQ*8PNGZcm?$?-#p0sQoq|=cs;O
z$v^11;!A#{?$A1rV|T@=UG|bZw+}o6)ep%d7DQ)^Jv7eg`~+D!Bl6SMnVdt+;S5iJ
z&@bcO!(dH~5z!k$m7`ZawNy@L8nwL(_ObFZJFjGsItbJn2W$V=rN%$MR*-w9c-dpG
z30w!U6&J5knOmah<-*_8_xr1$n^s7)?joTxs!*HzU$Fe45P^PvgI*BBGbgQ4y2{VQ
zSYXVinX~`N2fYA(0C}Wc`D*s@>_mj;3Y>uq#1A7$5s}q%M5ulP?Qnb7N0At#&Gx)k
zwrw)WfQvy6&Gu&15|8b8hhFh4G5S_}Do_ue#3XJ{<G9%`joy8|lFsXE`96x>*VFhv
zO7~?Chk9VmaeI6Om*Yg@M?4P}^qPE44#sw%DCSx1e80W<7pA$5q>R{ql)E8Cmwe{H
zxd_IxPrc$qbd(}?mU-AY$KS1Ih|_P)*&n^bzCV}|f{W~p#3E?xRL*RwSXm)zo^|n!
zEBppz$LNKvFxNM3_DPi$R=lDqVI3Ko=fCI}^|=xi`<E{gQ?N-O{tzB3#Ego(p_aXq
zT}uYv9q+NOX`z>G^{`v#3fVq)`4ayjBv0VnVhH}Ar7iw}>`$JvSW5|?BdyQ7+O4|!
zE@X)_&IU7DxC0gshzkB^8P?Q8eeU^N?TcYGSd=2k*!Md?cMf(XW*V1n;Qzt!tRtK}
zc%MjX8Z0e6?=(wH#G|7iik+?al!Mp~SKqpwWrobgJ!2z*XU{MWD1Q?uUF|ENh{8J)
zgi%a@vQwqE)UO|)(k{$}WScg$Wqr5LWtzruwZ4%KIVqAcWGRb|Iwu|_E9b=j@VW7S
zmo<LcoO+O$p_K>-x>JDG0N`=`&$g!hpF7=iV?p_{y>>cj@hY+{2S-b0=W43GMIRAN
z=>~;0IpXMT4Mk2EUa6GBS&2;*)Ujrs(=hUd(FoNl+YU1y0mn&&-BqJt)+k8?;)8PL
zPa~0yrie<CGGq?K*`)xP5Y_^`2PH!u7>y~CnIHT4>HN$N*7@OYPCwj1f8j@Z#+$ol
z#?k5HufPVt?eIS*-QhV@P3km^4j5D92ysWDd4Ag-ITMYuu+=qvRSok4$Nq_TMlRNw
z_TNODzd@5FbJe^vB)GQ#M1Ul?<DAcLTg~^sE7zB7Zg0$#ih8QUCvnR%ZgiC4pDC<=
zQWU|sG;OY8@-2KRAZlxB0=swKl}kFoW`?Fd)cMHE07}Q?V0GC-W^AUa70FC1FPU+G
zn4)dL>6qtUIw`4l#PZ`+^I~@qz~Al*9-Iu}pH>-aXHSNldo_$>XAzg5YV!>el26^*
z8>v)OHke^yJ0oFT{VJ!DCngtd(*<<vrC(6Zi@wF1{kuuP!^Cc25-{-JCIMIe+a%x&
z>m<kA`_-$vHyKNPtg|&VzV#aq3t415-vo|V`u}ki{6DRb|36*>{hj&0GbJl4$gfcP
zDSd>-l}0jz`t&W?s-!VG4sHlPe@~Ic`po{)A4v_0wD-1LeaA?6e!6m;+KH&gi#K(D
zbr*^Bb7CZc&K)~`_oX!vWu(%1{(7<fsldy~q!f8=ufAz0%Q9mJI!JQ1AAN$1Z+iur
z?#Nmn_cXGTj=dV9deHL>7V`+ozY$c;CQD2bL8W?b1-$s8Dn4u;(DT(zxom&LC1zB0
zqb~FDhxO~fJ;UP<M1Q%Es+~B3-Bt7YrEk)Q@oxqSLF}cunNnR;*Vk-|ODHi98iZb@
z7?SMV^>ARegojJ><x6``exyMd`(b^~Nx4+w{?&W24;*~rBh)TiwKegIXUM`ezfU;L
zr)SY#U85}BN5n-Kj8CtUXdVA>jDR#;RWTCU_a8-7HKBof<qn7EOURq)P<@ZTGzvRP
z>zYBx(7VnYApsEYLXi3q9IUkxS&fp9JQI_zfs(a`5tC5Ju=Ux9rDs16A?|w>MXs|X
z>VA>+4T3-qZW*&?8b(*!UEcFBIhG5v`&s?ZVO7)2rmk4dvR>@!8vEJ0p=;q_7spMn
zv>`a@yQ_S_?OgNplK6;^Rp;C@mU`<hUJZo@hE)HS_4d7e{;)IPc218~NVZbWz_lSE
zsXgfz!@hh`ImbcjTF&e{gr$Db59F0n@8|r1{O>Po-uSlZiNfX>N^<rX%FcIMqo^W@
z$C9xwaVKyS`C%73-Ttl(Hn3tKtnu|mTk|`$TqP@z)N{A&FXm-;h0MQ=CLXhzn8n?D
zRT3>F$bTqgZIo;FzOq8LplN-bFAzU*+}NyD8?rf_)==5H)8<ynP)y^xZ6MYPFfc<E
z-Y?!b+ae?z1vqaXZABOTVFD~7w%XqCr?jLSO0~e9Srbc>%67NCLz_0uS#?8RghZD#
zA7cBbA2=SwMchtlZYapJJh=FbN!u-if!F#2&gQ9BeQMlqINQVRM_-n;gxlULJ^a0R
z%D7qp22x@loHIM`?2^4=Yo9G19glc2zq%qA;P|U5U?7#x#(G@UgwMorgh9E0zbqZY
z@lCS*;C9pGFQ?){VuHfG+e&}p!ZtdL3Ul4nt#&f^>HRqj@rDw~nIcE<kHvO1=c@sc
z=HweCm3@TH&*Od}{fnuL;?<#S4aGyB@9JL@4(SWyeqCb_#NRE7dTq~Nkk4IwMxRdu
z*A>n6rYx~^PkKM3CE_mr*IKx+l#icedxDFWl2a*mFVcJE(2cZ`_$%M~F3j{pRig3B
zFZV_y8!IK`qn%Zw`X2U7Ha6>Y=yR)Lf26&bQW<Qza_*7(OVyROtb8??Qp(KQ2t%jr
z&6$inI?iSZu8J=nSGTWT6<;4<=!z41Q<hw|C)&D#RSH0jWP}UrecsOI=9Co|>dM?X
zb*g44J)eoK8-xo_s{9Gu`r$7vyQ809VN&)(SnZEz-%#Du)x*_-fr^yw{>D&j>vr36
z3|kSiGL3|g?BM?1=Z5zv<@9K$v6Ah#&+jqNdGE`_B0m{GnL=jRK6U1y6w2&`$8#os
zUDcSo50f-a(-~K7ZQQyOdKql|J6B+{>D=x9n{@uNDEH<JCKiRO)}7BiuK$>S@hbYm
zH$J$O%#V$@?D{W9IxG-p{;`eEp#yth{PKt+K61S+Jx#Y?dFS;{1JHDrJ0<J)*0R9f
zWn#L7_gS_TK6sa|__kWM6V2p)2}*BO2z3Y_0g$35nh=S_A}uR}7w7*_#d~gPYzIk4
z!ikKC^e66eLWU1XQd@`^{#84#Ji(VEr9lf{&OI?KJ{L{%5GAzpTU%0{-$-X<q;e$3
z%rNqjg`=D3|43GxqzDVWrv;f<jR<LM_CP$@<@%Ny?+#xsC2&J9CQ<%}eO+I;Ys3l$
zN^FJl1dSvpQ-A5>3*X%yYxv$l7TC!=&AU^jA;TIL>Znn1{g>0O>hDON;e*wWLy7O|
z%Y@d-hAK%&0pU5UB8x`>3;yRvtSO(G?Ut_u$LZT>`drFqO*frys$)Qs@>@pJ=)2io
zzEYy`Kf&|sf1ZBA&=qtNh?&ZL+ue_Ft#95uMr_h{e6GoUQ!eXe@>$%qYc;r{Siiid
z?$yF)iFJ4+E>Arh#6or~A=b-lrhD5PcSRlD7(aW@@bSxe8|i+(Ji$Qt8!)Eo;2)|o
zx>x-ls&Wl5k{7t+csbPNUsUDtwSQ5SpNYLy8&_vz)7OIl;=gX?h}$^DxrXDxP9oPz
z@$t=-YMFBd%EpE5YTqhsT1Ns{GW2!q0CdHvJOK?zaAC||@<Hqg5ZUn#X|ITN+0Y>S
z*%ukMm%L?Cu3dS;D8V*m@D<8Oy+D4@(%wk)Sn&eLYqK()y<t{GK4JLc46c$3?Ob$G
zXLS6W0fBJ$16WTMx-KsHAmVn}f)koaPGmwjWNI~b+jH<{h(pRCPGmJxT;`l6UE&TH
zlaHj=2IIqzt?}B^ISy*`Cy9ZZK`CaN`jr8`CtnwDWpt@?T)HnK^Dd@)MPik98!8-O
z4cI}~Gi$*T3gpKlq}d98W{rG7-+bDj@`#7yWBzR}I=}*wYaNZBfz_8$xE0SqF~@+C
zF?D7LiMLY6ryzDcaVD?}9@8^9d5Ex}=65P%l_ov`l8g5ZM_UEne)zXT8G<Bp`W$N$
zK{)8#ZB&;!u?!<G)tfVuPy>fsMe2`huA8`iSm=43ckx1%)>pxZKL<BJMb7`>V_jFE
zsc1SX-?r~FBu7MKA<^Yt+iUMnh{@kto|;cz&!xLQ%+Y%ilm6<_RYP%YesUY73aGB<
z=z<8@eb6^;=&y>jTc?U~xXC+C3ibxE<Ckh}_m<pjgl59ye_-M#8zKsiYoe*l;`o)G
zwt-!&D?!XrnVo3Z0j`|8$wf@j8<<m|E64LGwe&k?9>05q60aC!+=_cey+#%#miYyH
z;79uB6%#jV^}^$is&6g-E;5jiH57d*!~4$(wHMYTrr}B0)J*Pn0;spmC#G?3otv<@
zo$Wi<^GmrQernzI{+ea{y?|HdF3uMK11~ZYR*{)H;B=nA9rxLOVS8E9WGLU5AZ}T(
zeW$Y}6|8pG`!W9&Jvz*puirGuK%+RSk^FL!su<yt`_+k05ggrhX)q^faV)QAe(A9N
zJ8x=L5>vv>Rh0)E-704&+FN!tA8WQ=hOH+Ab5ZllQ9^x9KiKL~+Sjgxtfow6J`EDh
zd@T~4?j#gUvY`%5^90zSBOLIVox=@{{sWg=pVXwru~dC_h&tEJSX7Cu2ga^)4SJkO
zmjXc)b(C|=G8+X(6@<*g@D^y0rxWj(*B;~|QSDGV=%zbw?83d4X1(YkXW$3s1_)+c
z1IisWbIS|yj7M6f#D(rQbPUfxj&7?9kR!g{&wdcKt|^z&VXJs0-)5lhW&Us;i(rB5
z0P;VW#KC>*@%yjKo&o8*`GkCR;Il%KvaQ~E$@*@D&wH_Z7cMWWt?;gJkw>UNErFqn
zhdK(v-%Cpfa0+=2h*GfB1V0?BG1@GH-jnkZ0_N73te5hNJ~!-&fVDgC*FttQJD^yY
zdq7R%c>~;OE`MnTJSWMl1S#x6FGayC0E<j$L|@vPo)8H24s37n5jD!R{P6<caK*Q(
zx-kzEz1*cu+#u0Ve>y1wC>d7TuV9uyQ^h`Yen<4NUSDR1)w|1|>aN-0EE?&RV^~}E
zWDK>f2FRQf#}I<SE}Eq30bw94Wq2%K=|px-23--)(wvgaF_#ftzw;v*GIHq-CQn%F
z9wQR)V~Hg)<4+v3QNr3l!i;9yxgevR6_yHECiy0b?cW+R5vye>xnQ{JFAHm?R3Tj}
zTdkO($-);x1+mtoFqA|A>YBeNA&$!I?1^nhg2*zXM?x~}L=(lmgVnZzD^uRyqFE*(
z^5W@VSuooEZx+p#Z>?NLnv9S+(~ixibosWZ^fM7>$}Sf%<kFY4Rp;b-uD7I0>bG+0
z-}GQk*??dM4$d;s(eB$blUS|3vznN+rXG&3(WRR*SEUaoEAu%Tv7Fny+2;?ybjbql
z1jg>`1JUsKhm(8rDgl3K<kmnc_t^t|tBKZFMluIt03tK4D@QgaUJTL<Qe?K78!BIj
z3ZM&CoAF!V6JylUK6)p|$oNPq-MI{eNZWJqB3&l)zU$3-(ia3|fENs>`Gp!g;4nmB
zwz49@z`H~V)Z2Ffqo)5J7%`m0>`s?|>^9Qq{J0!qeVk78!j8nAdY2J$`%bOj{7zEO
zHtkA#*cm&m-&wEg&~BwqKlDiVk}!WKBX(opAPU4?12YF0&ci&th`M6K<7svLuzz_O
z{XCb?RRzO8i7U%U&c8HI4(4=6`T@HT^Z;^!(^ObxQdhx#$$3lq3wMU(N5c$Fg-<wj
z^$QpA#b;li#|HGk$z1Bk5qPQHEfDHpUKYcU&yJ$_3pvaht32iQ{n$~~g2>S*UJwLW
zrilv=8ChuAG`9y(=;K7S<liRW4}R<0gobxiFIDqV7%ZI3@gSTan!D>fkq75BE)nb`
zHTFVr|DxO<4?k_039${S=YzKT;pfSb{{n-d6P@|GG=S`)7PdPTD%m+j-g2pNvNyCS
z%Xx^FugKI)U7nZg9D9(35*4tB#^=Jm6v$Jm!EWYfx9c~ZWQj%CJ+K7=s$lOn`8f2G
z-_+APZclZG6A!e{5OT4gKFa|7M1L4KkzZ0#%mXp%Xv81I;3)p&yRyMDZTWBb`>y|Q
zUJY-kJ<hcQiGT=c{x)tTRW(J^OI!ZB(PyHaRcj*7wvm*C)XqNlV{@$JYK1broY6oS
z4Mm6m=(3`nnc;g!@C2vpqh#6eU>=}x{<+x4RW99Iw)3L<{h=0)w@PpI%rT0|FeY8;
z;ZPr7>CaJ5T${+`UsL&K=`XZpI`{NKyBEvD6&+u{aikOy)69;Qg+>*ev(LXiM>Y+I
zpYaNDac(Tl>}*^QnZE0D_#>m&*xlRL?=5R&9qCNOC175+J8drf>-6+>2eq7y_`o4A
zYpWKUDQ~HkPUl9MAH>CF<3aIzW|tI&4$tfhD^iNO&PM3YxZ#nhRPm5tR9jzL@sMlz
z^X6v6x%w+l<uBFC(tN+kCm5aX==>UTIpR98sLbIx&}Z(j_#E=3f81Hj<EVYmM=aH`
zsG~W=_LWx^8`IBoszfQE4PD)YUpwe^j<Mr@T?$N+_1HqappugWAhZa$G;ZJRmZ5Pb
zk0JG5Zo<MK@3)cte;_??bT0u@%}8LHo;5=Jv5$*S$^6Yr2Xvl%ZEc2AZmsWMF@KX)
zSa<n$N^^yF+H*}&fI5$EfW3xX*+kPHbeO4v`F5_ybmgc})TBB*J@%h+z~`SPhx&QR
zF;}Yn7ToKL0N$Big;GVfz+3l(Np+{a$+$|4A%FroOqeK?%y%tuKa$2hR(%vMQw6nH
zlq=x=lw{ym`%7~MG9-Mq_TudPHtd3r*e}&czhZVRQ$<Dkj#Tv$rjr{2!7Je`c{J?J
zo>2trK5(2c<4m9;GZER_21&09$-&A84r%4SNyQy{2t2P+;%u$&Rk+cQV*rEzFo4x(
z&H<VB8wSMVXQ)F3LKDLy33ND8@BI6r<4BGtv$O&)A9OCN-P_CFPhS%*#@~KGG$k+s
ztJtLxEbI+cI^?^vFfl3;ikkVg-M~aU=zZB>E<tF}W|r$7o7(Fb=QbMf7p;XB6_Vz`
zeu9lxv4_Jeo0yv|ZyAg*fr2wXpfmuT89ldgoSu0!65Dn8LCvkw(s9KVPo0}*DLB!0
z3Aca(YeJr)zwEXhxef>zVj%se*2!d{aMGO!UW7Aq#6$emceW(&Jl$cnVy-WL>f@f(
zntqo#h&8iGUwaoze?xbZxUj-%eFMLQj3r;0BbX<-^Lu|dv#$OYa*SDdTWgRlKf5==
zwL}E<@LRu%kSrzM)_1VmdRuif9%V>z(g#pwvst?9T_Tjkh)^6Ttq$48p2(BcKpg0K
z$sHy)ZAFgE2rV?)Xbm})%hrlp!aN@JrH8~=!#_aQIeMz6fiQ!|hZN+oJvR_{vbs&q
zE+d1!cLU9Xw=e%G0sgNxkOpKL)Tr=|bd}6DLzUg;kX+mQRN9>TZ1<t#a~{SQN*S8-
zSD!`%)CmaUkh)L|Fz#1>K$bt}4fgVxchcy1yy7hMb0+6*Fd^YdeY1f~_E{-<+UBuU
z8l_9dxmRss4gu>GbW#wXJe8BIQtx(k*|dE7!5wyXl_vt>0crOnK0v=#o``otxF@t(
zF?-D2c5=6bz&GleYY}>zwe!7oA|O4Wb}2QG#!Y^JH%AFs10{cLu>y6%3w_?*qi+iI
zZCa*c{ZHLASn9l&hgy{j$ve}?Ja*!he}=*4lTcxd(NsC=gsv`vz+HhesZ0tSle3&g
z87%M*RxpaGNg7$Z-pwdhHp-u(+_T2<khy<RjjU15BvwaY085ny@`XCQDNf0!a(}|}
z^t6e9Vv<$&xK_Xo+2q`rp1(9Cu10f;Xl!Q=&=!DaA^}y?d@%}EuileR5O5r?Q3Vpc
zrin(92A_+q_iCb%^>AjxT0i$?xo(@IGiD()Cr}XiHr}9T<UBeAjT3J2Dtu<=zhAJu
zbu4mZDdaedFE4BmzQoxFc^n}}L3AlYrqPYDalrjEx6w1h5A7adU2Y&o+qWmsA=2f1
zn$(TnztPH+z381E%a^FICVU2uJa(jf0%MB0M8>Jw)Y<Ek^E{}EvrC%=LiH|;Fs~~t
zvAl=Nca)|1J`S179Elohka&)pDCOicfNJ!J=#GWO!OnMZGH>VnQ0LeT3uIc|n#L^_
zW_U)${YXzTEPM86?L}4)Sc!&oZN+@RCkEND5$#48>GSdz5-_`4bp@@{H(B^p&*$8q
zwSdiH8voua5)n!yN$Qj{=r4^YH05MjbwXQ8F$O~Cp{D-wc-%pZ4}LJzFBbf<HQ18<
zee{XnhG#?bc!VMbx_gFTeH>3n1~sbhQ7RptBN}k_Am)#162KxO-fDxdy>p$CBX==0
z6XA24WL~nxZ}qx#elv$F@A}Jp7k-qFmk)m*i;_rB$+K57Us7pk&fMTv0g$*5F-Q;e
zFdaB=(bTRWFy(q8C4rbw15E$w(#>?-#&j}MFM0)=*5}}cOgNbXLbadSKEBBHsC4iv
z=GQ<cMC(87-CoGPjyfh1ok{K?*%)6UiDVMeJYn2msy{6NrSr(`8hVng71dFb>JmEo
zO1a-9RwEq%3IPH$Oin!Ku?W$DhZ+eV*(hJkIfN5s2go05%Kp+k&Q}D;7ph@EylYRr
z8;1?1grT8ZJ?pP@*S^fuJKlEJp1zlq`z9sl%13gY_$%WIzz)3NT6Ahlr3xT_4<dPl
zupdtm<M4o?a-%`tY;_lZh#Tg%mtsud*0Svy;tgUBegE0Q(>EEHc%)bnCl&-}A80q<
zTgBavUpUB4GLuXI<<|ZtMRpsYQqw7!llUWSjNV^Q5&A$&S<U1#$J`L>G6xn+rRQqF
zp!%PP&jTXrY6Vgq9^xZED&(7L`o+f*YlXKx!!iZOCmuFI9Ci1)Rx}1Ok>DLF)9HrZ
zB`b#44(@SOak37<tva+Y#J-Q;si9(PC1|)hbC-wn>otV3fk1=Ew}Bswsw>Wo=&x{Y
z>S%$$SO;w>as8mXfH&tPIQ~;@GIOVi`7Cs-7zS=*A+n+v?gyV`m?m3N5+Q;iKHX@%
zB|9$>jP)P(z^2hDw9_Q4dE|aWFuM)z_hy~Nb_+BN3IWD!w;)#mV{pZ|X5VdLU4p_#
zY^8ndoZx)^s+wQ>Uz#90_Z#LqXKI*N%+qwmLc*~^2g%g4A<xk`P`sOcz~{N@c>|y8
zi*1E@#%wbwTpc~MHLHwl*JoBY$d^FJ=J=nl@d(_>o;(5GH&dWQ2wGdJ66Q?Eua<Aj
zwXOMNScQG<m}PaxgZUjw=A&8yvl2xRu#uF+vC~oqVayR)xG3OKl`fG)Rh4a|YJC%4
z=grk&@iVSK5dBgo&k!Yn$G!j&OtJ{^xq*lF!RFlu0I2npwo#CucaCIY+w3!vi!ESD
zuHRcBvs;nz(9P&t8?rcUu9FVn7WPa!oh4e|p~ct5B4v;m1nkhbi~ldp?DGRaI$!zQ
z`4~t!-h~mJfk2@dNT^G$jxsh_<D_<>KzGNQ^64+l4$9&$%{Yml(hl!6p9QF^_u(YH
zzce$k#Q-YpSmg{U*mD2Po~QDHP{XB1abtA@J62Z;+4~P(gYXv4d=b|O8PpLNqAQik
zMsO^$DI_r85pQU_|FR@o47~KERnP(T!JKgJI15~c<o53H`$85V=m8Ad^3Mdv>9l~$
z(brWJIhQ&lt3TQ~j@G($(;vnmxke%&KsW9pb$po(%0RXp%Q{tI@lq7)4Q^Jh1(20q
zYD~Ake$Ok$Fj@&(ugL!_CRszfuLRACcIJ0oCeuwSbd+oNUztu3mE*Y9TD5`6FAnPH
zNRN|x#5m(ze?q>LZAb`?M`8`BlR55WS#ZMfMP>u_XVcT_4fwOvlUxtydd(|;7}SSk
z*r)7>ia6NrFOn`0x!&$#2?@t>?Y)_ITt}1{1Q+iZUDT_XD=GFLxJp-57d!auW8&{C
z-_1_RcmPYpK{5wu#boEt5u%jO@~ecCo}uYyN0ClT<e~U#+*hz$#x179sqCPtRj!pG
z-w$$UNTn;txMfBn3|k3jjJQ3zr+xd=GK-04_{AYUoe$n?jsb^lZ@-7q0nm7&4?N@@
zm8p#6){SShohn5V6$#2V`zj-iT309L_aCq*uaYYz?w7}6k{RQxs+2FWFE3p`ML(R_
zYtp)9$J~<f>>ID7#J!>Pg=ptQDBd2*WNVHu#?JJf;Z|&{_V-eC6TF&wI=3NX2!wx=
z99uuH=g?4EK6RvF*pq9z#3ERT;VVNY%8tZn)T!gqZs=vtB%9^Cq=U<y{{Pl#*L58S
zaEk-~vP5|aSfYRitmP%61Jlf>VA+Txn|<9Qm%<mXXuiQeSH2}|L^VR=oh~8qSuJI|
zCjdABLRN+=eUEDpr$KE2X!>qI{9aS{Wgbmr@89L=qjCl{ck0w&#ZPz=3MyqV|I^dg
zBRq&OU=&*Y9%-=QKDkm#Y9;BW`Ak77sb}^AE%ZV*9{nfvBmZDn|Esn$e@FjaClZ;9
zT*#)Lw<p~S@mU#2=;9&sPQU931HDm{m?+88vJX#6YLC~o&0k*Eyj30%^N{v+hFJ)4
zfGX@r@`aAwYXPoANbX;n!O1g}1PkW@AF_7)F(CE&ROAON<`nh6H0kAkY2vaWi=d;2
z3ShkR=f5<Esx;6i53LCce`(kiC@tX4at9~|3D5;rpM$Y$XapmLi#d(VvxOw5+yKpH
za*+WU9BK&Z&3-Dw10pI;K>zTk5krIbfapx`)(Ws%o%;Nx5x>WHEU5<-LgEh(7NV(%
zF#}ZQBQ#aN_<!?F2ZiH+J#SK)k0PxWELw<ff;0+!N4$c{Y<S%)ra-Q3EsRsPhP$4p
z?}5loUTVNRs^9{#R$ecOnA)cx`AV=V;Ou?9`=KJ&^TO{jHvSi$p8xb|j_wq{FWkua
zRb{U_&dWR#>}gW&MFn+l<jFd?06HF3477o3^7zyN&MvTY8uoOinmT_67N_Q-0Wi8i
zr%Z5NO8Sf9&hfRBe#51-X{6||i}d<7$0CJRw$Xpi=tQ>=a8=EfO;gHi<NWD4-8if-
zK&0(QsjgnH$yCeLifYwY@yMw<eepH=P<ZOdM(*cl;j)J6y45GO_o~^RyMNwkldvW<
z6#m&6Jdk&5e2co$&CuCkI{A1~?4s!E@2b7vJF!%?AYNbD$zkP|nY5<TR@CbO<M*9;
z#~MJha>PX>%I$l>dZ!)Vr`GuE`Ck+9NtH&`mz4%Jg;)dmxjW_GeB%4*qO<e!dw{i>
zQ-9ZhlNQYvMGx9f1W=sznz~i=y5L*cpMDZ%ma#&f%a{V$mf)hrD%nH=Pn?yWx>YgT
z^~9aw`Whd!#nrEFtdQ*@XH=JX|AKwiDgTk!{ilMiHr6A=kf*4K8ldkR-m7QW*ap7!
z+&^y)xi}^4k_{dD?$V)$T^iWqMiqp>bzMWyLl9nTWVGPmxmA7~@X~6wx*Cc_dV^0n
zBS>2G(KR(>@HNJp1WwyQk-RnbyECQQFXw^iMY$Hv6chsc{{C@X*!B_Vf{E*uX5jU(
zweJmP=8HHr^#RwDlP&KDGl9~Lb9d{`x?HX;Yzg<^wrLU1Igv_SuxOt3?T!hxYW-wd
z_T4olKsdnSqbp?S<o(dsl|O(X!@YfNFnl1AH`Wc6xG>pB3_8c+tsKseCrX6}bKder
zmBSz6k2{4{pGc?uqz_&T&4GhltY7-O;Mv|Cztujm8ZVppEMxH9+|E0*(zMJ>$X<3)
zICGaj6~<6>CS^dv*K<(SQN~Nnir&Ao^5+lbKiG{u>HH6J4?PX$CUt_%CPgMOEG2@!
zxrRd0P(7~dYD0souN|y1znGTY<+ESa(F@zpFJIVJ!@gflAA~<(jgM7;H56>XoZjFk
zHev_j5FhC}&nwRq5(9d}>%9CIC%Yu@_)OEOS`?e#zq<P1mwIq+@6YGq>DzX^Um)(I
z7Y(>3?ahBw$qq#rU{4xewjt<>Rud=i2l2m}mp6Znw|{#QdnkDIdsC#uiiv<pZUwIY
zLC@rjOZT343F55@NB0A#>OxO~vsj<#nLfWZ>TAjOvEhF2Rfkc&c*BNUFKe|E|NPLE
z`OH=((Z#s{zr~vqL0CNAGrt>mFFuy0puZ#95;$gMqTO?|GsT<N$<}pp_XRboQ%p?b
z?jf$M6!drQI$bPKfN8610}6zY(8D2@Uax)OrIUWM{Z{w`Jhdyk?wsr64nL=$FCOo<
z8Zu?yOI2GSGBMdd;`atre|@<70{^ZtEr2UFCL}<9#AB+lT=m@f+CS|;58l8u*DSO6
zt>1hnBZ?|&UnsxflY<B{m0`Wba9`JDbOxEyjpAYVFeKnxDzIhW9=HsuEE#+0T1c24
zp1_^PgPsNP`ty1V>4mZtm5r2rAFC&q{4O@1bgO-@?Y=f5))B$rs;z2fv>Rsg<C3gF
zfj~hvoCwj{{4ttR&u;d6?ZLt~A6Y#aOls5ayjdk%(K!+FQs4dQ4lwH}pSXYn3&nHt
zM}7HBTytsb2F7o^NQw!jPBxi_nG%Dme8BBj5scfiIPlz0Xd~G)_E{>|QreF5(+K~@
ztQqWb?K=gvUi5g^86s=tw^FjnL=<J<CF3uyKd~<H6)dh`k1<%`qbs*;u4kk@IFSzJ
zyJRUVFu0GiO5T`;Z%EA}gNh$~lvWs6eV3HfAb1_{+NeA8-&?heZ-KcVNEz0dP6rWp
z26}-Q8*-E{Z@{=`9eVH2uK2x?0@#(|AnIBC%X|zwqlYg0_@C&zuU*i|d=jK_!^ov?
zF8iL}RE+EaTLISF&I2C{$y!D#JGZBvPSwz;-)9eT>9x^ez9_r-<#!#jt&|1qoah91
zJ#<cTmt=={mwkgE!^!^`$F1f+{vTgx1+W2#T6d0zC=%&ODzmLG39$HS+}fqXq%PSj
z4x}gRE(HswA?#$X;%+;5H!Kat41R7-+bdtnu+05bz(VoJ)++o7@h?rm+u9q~z2ej0
zt)BM>2yiO1K*?5VOg{{tc4PUwrn##8{5|NhNzxJB>1QqLSs;K$N5k-~$fqzqkLI_b
zr|?)8M+k~mPI4kzyU5`F$P2d{j4wgPG{k?1Hw3nsl{l2o+y)l@x`r7=h_h~-+<SSr
z{4iaQzU7gQ9WWMl@@~?4FE;bD?Xw)mf|Sqwq7AjNS|RrW4RQD4i#KVw$Z+aceq=lq
zOr3N-OBTh^U)usRHV)r<_DwQ%(5<ySX5{nSMwEz_oaYgIyXzI03CJg$bV53$fiYgw
z;_OJ{(_c0Ps@uBX_!qt!9<(ePGm<{nQ$->oC>>C@v^j-=9%=k7^w%6vtV*~kw>d|?
z71|<aQCYIQ%|^cD#{(l-29||P$Jm>|ld#&5QUu0S0#}y>=+p{^O*pb=jvtU2v){1l
zI3CFq7Z+ae4YLMvn6wCWOd2;4{BRT^VKcYw#FwL}Ol7@kQO$CXLv8Cex&2;YL;=G!
z01z2Si9Rw1X#Dlgs03~Iisk30({*Lg=Zg+#bIIO)RcZe13nS8QJ-5ZK@L|pqU_@C~
z*gW!y5BEqiCF8^>dn<Pq$av;<W&j^J#re1%SmSgOu9XT3adTwuft;VT)|>F=o9qi`
zF?#<D_t05F&dGMx=&SFwK0he_K|8paigM<3p}nke)M|jp{$i&|IaA1<qk9%In&sS(
zM!x8S0$o}Syk6Q_Q{h_DOVoW?s#_7t)wTx?5oNFjE$YLgz|Tfr0Uu5en4T6e&1l=C
zQdNlQEB4?Ep4Uv@>AFueF*L{OgVpY<FJlfRGmMjtZ%hQSFVI>N*-2_6v<TE+n&_9O
z+40)?sqC3SL4FmB=9f(8GRF;{(3V^0rDmSe0`FbTOZh++W2CSi!%lsWg{<&2aHH$U
z?q8tFO1DXLals}yge(j=T^c<y<<{_bx6U<t<=`NemaC*cdrR|T2c+pYcvqgJYES(E
zYB)~9EX-O)n16X)u~VOX(WlJfLoi$AS^9XFsE4({e2g;q37q{osM&o0$wam$2sOZB
z0bAjNxFau4y(mk{Qh%MNC$F-X_Qm>22Tl}C^EQf$M7klYM<5NXV4Z<_yKscw#ZZ4@
z_#I@&tE1sw-?|uscB3YPR`>>#%9LF}oj|fhXsx8h!)PI_287EKP6cSwtkX!R88hzs
z+2XqdnY-Pq%L*1BQZ;A<H$Xr|25$`pETE9}3`N+@(z$>YQ!A9oJ@(<X{`KQqI(6P$
z$mM}BKrKzY3<C}((HdC?LlG~h4Yki;VRm^d0sztGvWKV-nei|Vdjli^?FLgXlOdEM
zsApP|GY90_NI(fYgN?x_a9mN=v!gxTW0R=Y+zjdOzei0!`e`JYm-o7nef~KS46qVF
z5H>OkP_ok`=>TSCmYwJnT{*|*BDjM`zwAqdeCzc3uXFt#e023(k~Shsc^dGx8U>L?
zMAr5;K*_euUrOb&)Hjl<rLCrcDkGbreb95;X#7JV0ZT%=xgXX!7GWpf`L!vg=IOIt
zn#s$0389ZSzHg!?R8M&N&56?9l?0xi>}6U?8dV7J80u1(#%9dR8#R6ti~VZcewR=M
zap_3NtHH;YvHZ9p19=7{77l%i{m2Dp+`%3bB-U^xk-9I2`miy55PV0cxm&QDv1}aq
z$&QAM1pf6Iwa-a}lHDOtMI69A?=QGccolQG$-q`W-<`?Lh9%y(G2@!g`wE$>uQ;R3
zH{8jW%p%Q?Gk_i65Vekj8d{}YN`++gv_da@t9akm4nzK^9sCGDNgf3aLyd#TtIORy
zF;GnNJtG`~iGIH(jrQANWz%s&{iw7yXt_;ffWQ(|$i4^|kFe_(;hR)o^k18E;@-q`
z?#HL6{eIx_mDlCw<{-<X@R=2LGB@*zLeh#)G|)M3Op$!;!(kd!{f$@iYSObTv`hG(
zcZRTs&ncwIAOTjfo(;<>Z<mJphLrV!&^!Y{3w?F1_U5x+UKvSX&Ql#ags?)g$G?DI
z@mjSkCOHL<ywR2M+iK+vzfN^`J}!mrs-o1(*$;~qq7o4)PEl~a$CUR7vz;+`_@ViM
zCMDNWb9&hG6x0c2k_0sz>{?>;&7G2EiJ<PQ=w*HMm0w<Rx?{>=6g+AgDGtS?>N2zu
z;|Otp0TUmNyu6)dERSn>>mGSrC--jYJ9vSam+sU!((_pS_{W4QtNpPVvGs8&?Qt|V
z-?XRvzZqN71j!}d0PHk?C6>;lZ5)kJOx-O?H!I~yxcg2-+`n5gvn3{e`^?k#v}nfB
znSwx2<0b21WE10_5grXx#8`y2h_MO^)TO|zte4zQ_Kr)2p@4>ev)$!xL){}r+5_e2
zBZic6HF$~5cD0Y>$Id9}ADoYjIMQ#wh%89~oI);MTYd%32Ug+ZY8*RYv@`?EwimD>
zu79rZdd$CISNX+fQgsL}{X}l}OKH|QBezF|YDR#W(`f^74p_&eC-y{Y>nYhs@m_oB
zPf~dL_<bMV5wJ8kwZ6e1iv`7aBO8IUtJte6BeiGe9_`b_q_1hNc)OYZ1xsh$ahiPh
zzFGLpkx4*+kE@sb+F}w5z}^tA>-hpOO2TOvOlhD>2>ydU&^%y^_!`5?vmzDiMZQ)O
zVt4$VdHC}DmSQ0yTJPd>?-cD9gyvuEFL__t``A$nJpTX_>QS~RMF13P0Ng6f<)Y~q
zWp~O?*j!p>6io(>7FhfXg<;0jglDvWb_fnhglsCaY4K**xIndfkNO44Hn5oDZi;jh
z9hrXJCOn54Bl~9^pE!hNC(1V$yFxyzPI(^~XYC_$I34s2YK+bzi*jgW|144f1jL#m
zj0L;{G&0er8rDY!&OZnCY*lVk&;P*>DKIP<^n3~399G6eni*`|0FCJY<rqgFi>|r}
zK)~YWn1fE0@U(jC?-jVl*U<ttJWR@aiV#dZF==o2WHy4sU2Wv|(n~T7G#=jJbCas2
zc{($Krr%SD@Tm3#3;zD_5d>5hZ;yR?`?&fjo_AM6JK7gBh}yi_4Y!s{1cp#N4ZSv`
z>M70{hzIX3Ei_5a9PUt^uN{J@Oi4A{PHdDGU7ZM#f>7aUmx^}A7wcXE4@oMaCmf3!
zr`AWb&Liq%&RG*2k|>=$pvbdOp%x!u?$;4HcAW1f%1@Os0vS_dJ%8lo<-SL_-#3yK
z`IIQ54~z=^2j9GZ{sz@S;_XQGogf^0_Xuy5Ymt4VzN${gkkQ_n_-wieV8(<j9P*6!
z-uu*!@FLtz+(fn24uUfwK)Iv)KH!hBWU`XBI}uPxd@@x-*2BoA?Ind2-ya`-UVi`Z
z5^Y9Ay(Eo)zew>rM;Mti_c&$@qD>tZ7C?|fV7*k9rfB_X5f{>Gxa;BG`lC?Sf=gED
z(Uzd?&#!cU{e%3K-zg{B<HwctSE`oYYQ2?@g?@m~frXw?FB2G}n^HKtbN=9)+rzyi
ztisBhQjg~DqL|g^)<h-eL+5*Goio6^P)rt#j|zUS7FO2JKJRqU+u-qi=S2h2OFZ_>
zW%WP4edQ9*?4R$;6y~vPoP7npi*(yC0=q+F>h*(VL#*$Jq`nd0_4S0}touPRXhxMC
zQ)e73VK+k29V#8QY`^tJ765N@-4A<PtV&4R{X-IhjG@nXlT}OfNJdVc%jZTVl69lO
zafNfLpP)mH!Pgu|<d{-<+?NEe&~hC@$=m{VX*i*cp0v54uVeW>1J`RRB!QmUY-q8O
zI7wSz0MBH*7!|@Sp!AimkbS{R+<HQla(T#U%=`X{*<@kr`g}<0=31;PyFii9KT|zL
za8XJj)EyoRZ5%*tbpb%y`i%9j-xa(*N8RQcE*-BFGiN@e{nE~&T>sY4RXlMA!a-D9
z!H)E#(UW!BJ~)_TQ+UkAS2K-7m%q<z@Vyqf$aMEmcC?)K4=L7s9!+JkuKE*fqS$Bt
z>e>iO0W-}k9t4V*GkG_<k9c2jF1;S<Ph9wltS=*T$zoXx5JjGBK|-Pqc22kMgcYRt
zY0zWan%q$0mjp8FYj~85#&(XZPWy)*)Wb|Ct5@0^+fqK|@Vzw>Om9JnSDxjw5xk&(
z4nDl6NM%~U9>l;J(XkLPWW;W<fNi|E^&Kf3g<Z8bNwRf`9D4CU<H6<eNAHxPe~FrY
zDWP3~GDd__DxjF0WwAQI>&DdML|BKYrxJxWnW<(rm2AAdU#0vl`mlU`+`p<2vURLD
zOaf$mxNIQANrtf36E;vf{%GgXgMs~h`2{T-8avGk*p>8vU*fNZ7OhSa$&%PKp^z|A
zkCXEFUQ@NegXF#dkKl{LECAKERy=x8=VrHHBJmoAahK1Bbd@@0m)&dr1|roGjs4kK
z=5RY0JM^(MfEAme_PW^H>e*=M>$}K~WI^x9A2%2`OM(72C>~Y|BbPvr3jrQwzWHAo
zvrkCx9RlYupdxyoMx6xx{#5~Vb%DethOBPQt<HUH4SL#=rEc?i9yIilPIgaQZQ>_8
zV<`>97256OXnm|cX&F!dyIPJtpfl}|YX^ikH827{VUPI{=gU2_l4eo97zL(vRwX|L
zmTE8RD729^v*sfKdR){&ppSXq6=7A41s*C{kIpA(=Y|uD6}aMA9=>IwIrJ<giULZv
zF?0hZrYsI3M4jZxauPtaayEZh=8FnB=Z==qSMYJ;2+dn96wH{F07~W(gp*!p+6a04
zYL_B0sm6{NuJ?K+W&c2e;|^SUKGEjH<ttZkch@z1S+63i4RNTOzq$)iv~4`>75W@!
z==#t<*)q;S`E6u3{0E3A$Cwr<f9=@2o@kem1mh%5Sl8P#pNl0Wh&Mr%jjWWiWOyZ9
zXe9xehsG)CSc>=n2a0m8A3>pGyX4KKY$xPObN0m+lCL>Cn7kZ)H=)GWEcnzlL?Yk@
zFA}ly1=5e^<{P{h=)tJ_`3~(b)jvf*Tu{@Qi#_PB1SRZ9Q+p@L=HXb1N5J7NiP&iq
zt>~?K1DPLTvT1gwWh=;C5J{gpdT)E4F$L_=j>78b?`@<Rq@nKV(fR)AdU|zm`lR+_
zuZ;uWnQ!-IheHieXrd&vUopl>Xd3Vm1kK;yFd6-Q$bULO<@m7P^zkc=;gj5ZfwosG
zf0eTy!nIjmVw99h@Bgw+8ao9~d3TH}^*-=VYe$+t_+2@G=7?a$BTyMcBu=5#6T8RF
zn5y31@mB9*N7-{}m!&isOEd#<qz87PL)B$Pk?wi(|3ln+#x?n`YrZHb(nRS!C?G0L
zP<n}qfQWSIB?2N%ng|34i6BL~fPjD!6=_l;N^hYfAiabR2~B!J2?3Hg&wuT`*4q2b
z-ZQh$nK|={m`_Ze<Y~YAy07bdAJ0V>Nyt|&7sp&mGwzW!7xd}5b9ffb0Sv%|@W`I<
zTasxB39H16j<Xoa3M<cKKR@V;VNu0ywxzf4f^J_>4!Tjh3d)-=2Lta(W&;B3LS%V@
zdyq<hrn4l*muto$>lkNK6_Jzqy6@Yfh(wD>Ru_A8+V#Zu)esEM?0T%PiO%R4nS^K&
z_h(UUhg5*JP7%5wb+N;@BA0Vka9W8<xnnZ<^=Uv9-%MvR%<(=guRMhwgHwz`FC?hw
zXT<y0%J0Nx#o(ojp-)q_MoJS(s?FC#bm=T^Rt)gUa&^Me2PEqm7HKs@tjE3phxt4B
zP_RWbOqnAEJ^(tm6S<Nb{M%d#VR8GerqE6!*GP5#y@#9aypFU)H#4)lh0OvqDyM8M
z+ECF#=ScbsTdK|A^ZT!Fsnb75>J6Vd(=0fdnP@eeB)zF8D_SnPQVQMBAt=696D)Df
zVa5zZR!&d5UH&nqRT7xr^OVP`Y2X@z^hp1>Fdq&18L%;PbxDzE77<Y|mA*;Z+S3y*
zN3j$OO7;iQzYH7QyfdX(y9?ne7oIr)NBw*}7_Vmtn4CbB{OYEQ^jk84fX8jwzsicN
zklaR-%1^Fw9A&#DRT;=>WN_9m3~~qPMV4c>1o2!uZPxc76=^Gt3kj$1xBb3J3T8>Q
z7AM#1_{q=gHowCLgbua7lm&qM2c(!2&>xx}0DS0*KE{tC_M1BY<q8A_u0X}qA;bX|
z=%}oPCeXlVhqUfIPwDoQ^wH=R<dF!L6#z94(gViZO4QZ}{uR-1*m}Sk=v=b$*>*Mc
z-mZ8P`l*^VT`%J(vO(wM7n34h<niJjx*733a7*R{0sY>)sI!$_G($3NPFDQzh4gen
zzM+)qIh{|HeubCD{_u9q8y|(TPLM6U2ZA?{IYZ_f*Xcke@I{j)QLz~&*+u^Rt$R~b
zwz4z!XOOGuwtK`FZSqTFC*^?|2rv024oKR=#0ZE8*r~59?Cn|o8UAhs^Sn=9ZDMX}
zn<&G6zPg{S+rM-s+PIGfcJV}uI)kPMJ8jV#0K8<7PF#n*;>hPX{gD?;r}u2!+8r+I
z72F+G%j^_3arQgx@nVMYFI1D+cW_->yo*W*SMc<SWzDGcYI{1I+e)pRLwP3IHt3#I
zgC=Sc+s5W65;a$_1)dZq(vx&fB&P~qUqoQ96DY07N{_=r=GXli{uS}*7cO;o)BT)O
zeII}I<m<~zRn_6ca}s)%<5wNb?rHIuneot^Z$5tpu7YUsIB;E{yl>$D>~ffqb3Mv;
zqiU{m%W&g5W-|ey0j^r!pRbnLs$76fhG0wE*7>-@9~PC_H8W{?NTw8xev#BLUD6cr
zy(S7Lzv~iz!#d$T$$!6g5aEo9$TGw6tVXv^DJR=}{V}DzY*-`CxvynbUS2UGS-L-~
zAr?M9d@J_qpo580vzd`94bACNqrVHAr|jtoNp04h+5QfMxRwjNz%aoV4t`$m1$FeC
z>O!0nOBx#Ne3}>7v_h6S$6j@)$a4&%{b$uj4&+L84b)0n@aVsSm89Ud4n8{Ee;2Ie
zY=p?IAqh@Yz%S4WG^FeB;KVYkO~d>96sw~UgjV9>j<yQ@Pa0-`Mqkl|HB-K38u%Zu
zqyQkNM8wR$OR@gjMC<>d$A5<Y(E_C<eV|l;m$u+CfK6ctC|%a{Fpa<hTdC<Rd;lQ`
z7b8V$l8%a{N`m1zKh~=BUr2V$#4kI0-&nlD*)nn705{7q4kmL*EEu+<Pf<s6)G_i>
z=hr<&I#lvHiycBZr15&3i$V38g~D=NSDW{eb0RF-(D(#s5;e>MafmYn5Jd)*&kbS=
zpwlpKLPmrJw>xrLgKM~w!J)kFyeKQ*qVRnspVG7$rDraU@L1|E<o7=`n;`%J@Fu~q
z102(I-G-IdGXLYSa-*e<VTk{gN%NUKne0g6#~D(UL7Yd*e`wBOUjL!_%^3(xRu=t3
z!wAOm5kQpFWxx=ib|m&TZ+dcz)Qqg1?o#Xar+MC~FS`>vVSVsAIA9lL-HZVU>(B7s
zNgAxs1TV62VdK|Ao8>x{c$2O=H|ED5vRRdRXt#6p;f9D-c^vro4B&a2j{&zPk+d6h
z{?ObmMxPMGNk(VIIII6>+rjhJe4Z>~FY<@xquD%#luEt|cw9Z&5&MjQWd_ZLh@^3}
zAOi16_ZzT~$oxgKw`W7F-Ag0CTC=AkRMi&V$#XqELs?$#jflNknim-0MMEQnc>0G1
zm^77i5q5==sR4r0cO-`*Ek|yRojkI8XwuVnE&ilz6Xbgvr2l`Tg*)TdNB8u@edtOG
z?IP>+BPZ-^1_jPap~LW>2mslKY~nIHv#g6avWgvh0|@Fs!~0_v4&iiUBB-G&szg(L
zfa)nvF&+@{+rb+*8G}u?w+s!#k7sk=I7h<|maOwL<>NQ=bTtQwWzjh94nr2Q2EK7V
z#y_Y^(~}pTDb7g(uo9%JGMziGHH33U7N}vwEsbmTVA)h!#&&;+Er?&{GQPbNKXdeu
zOW_enG6@rU^HJ@Hvq`}ceX@OHf%}E|=CT4n<zGySL%Ss<*fWuQ3!rgkL%fxGMaEAO
zOatW32g_83R^z#G2DQNTpWd33Vfng6ZBa79v&&$Db8$gd-X|#q)f#M>CEG6TDrHzG
z-^a-RJMJ^KD=$cXwxTMPC!gO3it-$(<ncepWd@cNl(=a(h#Pf~e05%;{$|gjy~cR@
z>J@sy>n22h1tm{fNIH-nY=1itd~p9t)VA<iIA6o{^>LeP59Q)H)jd8A`ma56wp>+C
zsI&O+_NiAY(X2}Khd`rl$OG-e*JKR={(9#%4Cg9DPL>8cxQ~KGL8WnLfOecM=rvh^
zK{5RmeGTVOrgPC;CA$Fnuek7SAW+J5qq0Vg*cW`BOKa)LMMw^!qPn9Gu`m#B)1D=8
zXWRUqtpdI6agzHM`U!Z72?D?aceW55pWEbWZ*vQl|5o3CWebgRc)Ymr>qg8#7X1kI
z5`HHq!H=dbm~roE!tmY18@-S_r&FYZi^@Rl8iH0WHB~%b4Ubli<kB`wWu$-2cr&~o
zkH#@PbG~5E{^<bq(81&Dl)yq1Cw74UOSULa#|vwrda;Ob)$oTw9YK@kZoMa2CpUk9
zUanBK)H^-01nOX&mQhafk(_PQ_r+tXaE;|1RmE;$uWBsbka8bpYe(T$Zrs<BRLZ^4
zD`w#SqDq1`$;7_DY_-6Z?^oc^k-@x5*m$Kpi-O=?c7c~(08uXlFTNGI*l4quObU_u
zE*4v#(8k*e=RBUqQi9d*&e9c}*MUn+wm3PN2mvYM)Y!Hf-Tur~l_nr%tbAVMA>OUd
zzF6VIjjIMD7|xBXvTUxrXHE_SPWI}BYd_XTDx@`xf-x~k&5zpjA4PQ)g>`gRsJ}l{
zhqoC4fF^!R*)I7mAb1_Y9_U`Hk=E^27eDplV<+4s2xUDYujgqpomfyPzh=}v($zLO
zI`rPGaDYX_^%=BGEXqK`g7dGKcSzN=ouWvho0=AO#nG!&XLbog6Zj<}DQyIg;(hQh
z-R7Jt8JRmHnrD{ISe~WxwKqk%%B}74F4+B?&+`Nv12*B)wn8CK>x(``?XtzwN-!R)
zymfOba;wFeet39mlc;uiE=Wp@{q}^zcq0%8rwbgCG^rA>;79#tv%K%}5*D3myU)#b
zn+ntMkg+}@OJ9aQAg4?aeK|hG6!ZxWxQ*`r^gs9Dr?NUrkWf)xU%@Xk>NXVh60QWF
zfvb^x38*_H-!GG*>4Dp^oA(EPeK`~wI}ZA!3lJGBq9hL_CYsY%gu8_Do1*zMx;XU>
zRC5%#xv#S=r*~y^h_nd1_G1K=Eb;*m*yZJW+~REKmCIx-hQ&wnMR?=)<&y=5?_zOE
zkApG2*mAQQW6I9u+n7(x_mtCDE7pS_@x_aW)g-b6X%ytyx(&be@5za(Z)9puepu}3
zGXWnPa_73?Zj>hMBEWYnV9u4UfUGE}Q?u2${6f4}J&EsoV@{7*3b!!rPtFZ%g&$m>
zxEPMQjP32du03B%O>4QXZ~mhptKUIXyx>a1Lm`bazJebqg9pCvpcvbs%aq)Gk{HRX
z%+~W%Zne{KEIE^;no6KI5dTrV$9Y^%sJBcqCaI%Th4g=%2492#@a@wJ+#rsM8c05o
z>eyrxuYBEc0XuqZ&+$Bp3kB9BDz@IV&3qsbF@UvCOH^NvOiOG0oFwI&HMkQ?@sMh(
zdz6w2R_Mf-U0I3*Rx-oNf1`*r^x_T^#qjiD-j#85dj}pV>DJF^ob#J%RWBK-ViR%d
z9GHAezc^JI(PfJ$0dgp9TE}0e`i7}Gn*{jvl}3T@@y^Dhg^d%%Xw_#;UcD=Rj`^cO
zPW3|wWVd^;ck4WD2Y#oy4iedRbZB%bWgE6M5GXsZ7LjAHD$cvg1Auc}Ki6yk;GCW>
zbEUJ{rs46A%>N0_DS@zAZCEEoSL%b?f@6OlH};hbS<N+^UX$_?WbC+k+lub9;-y$F
zqlr#!KbuEJ^vi}o_lqPB=`aM0qZJ(U71v?VP!Fr|g5=8I%lIYV4<_R)FKTLE*4zKQ
zw8tku^*b|(*0s3<UN}Ifc%$3Xm#>%OtMSlFfPGGP0V<sMIS;@y1FI6JzupuXjd+q2
zYcEYo%_EgI+-?%COzG?#+SK?p&Xr;-xpGr+N^CDtBq8wG!>xYh=951(?dHM#pRg2z
zwzjO;HNMJ!-Sp-EXww1TGL8t?vgy8(YCpm(>qx7))M55%=sFR%zG7ztbyRrU3oZF^
z!+excdO5)M49&IHmlA^-!tiELrA&tm%Pds03sRY1T;y8a`yDq54HAxhv7Pc-{@h{F
zcIlgtSc=2vmm2nzH|VFHia<|8(Ho!NWd*ERq7YTHkXd)o(-Y9tl^S8%rK2C7lWf{Z
z*s2$_pWfl*0SuJAxYNADMHa3eHNBtFUe$ftuKQx9!;?%gW+S=uWtAruHAA;S7vXKl
z^8C~jK`6V`AjCYW-Cmf$vQX1FYC`M9$7A8#z!>>{D@l4%JUw75w)W&XwZ}SXD-{1j
zhvc6RO_X8o&D*%Ko{#f*T4!NdS|+^PD$#l8%45Hri7t6!0>>%9A12c*a~|FYI{Sh(
zqDk<LouI-^v8|N>DU?jUYQcvL(S*L%)4Gq$Y(LZj;BNr@+e`Tlehd<VPYB6Xj`<_w
zb#CK36Tvu(&(h)567IV?d;=mgOcT~F$s<0JuN*%V&s4H-6U8VfHC5~hE8}lSWz#38
zJhy;yt0|yqw)Ixi`}DcRdzTM=7-MNxfw4xTDpzTDcZjY)RqnkGqD8nWgI$vZ$&YGC
zNhtZosi^u9>p4IFfX`QILZTaLpI*MaR_%(ddwBysNcl|VhVCuOv{E#&n3u5UaFAh%
zSNNfkow`4-=(qH1B3ZK+^I!G4Da!1aRbQn$l|G|B41Av^N)mV>Cr6p`M$In}2V#Xe
z+PT~wkMJm7lfo`lpSVw#pk1b)V}9JaqWHGT%wXX`&c~!tK7bO`#78MZIDi2MVWr(%
zDsE+5n#{Y{c*;ao@OcNU%X0BePmH8ZuC&PWK7Ps9zq>A#cZBu=IRSlAE|G?k*Cg%s
z1}d>wu%%qIL1ljZF{`y#H@4rVB7XVaa7nvtKfheb%uAp9XB&4BlU>+>&2s#7+wp3P
zAp53Hb6`02pnFe7p5JOz6NX`X&+R9~|NW!w<-%rE-Sx`l4`rWR)FU_b<Qso^a+H7T
zsZ*Nj(fLGwwhpg^bTXHhdQojRGK9(+>}iyS0zN?ddkWPm@alZ6K(FpVCj?`ifS0ag
z+Vk_QbaKcZ^mRiryI}{KfqH2Jn8x;mHQoZvlso>Cea+M|Ki4gxBm9+UnAL^U<&xz4
z-6^!Y9^2rT85!1`W%c-17Rg^4@#>gluYR~&MQ?nsi+Iz8w@M41r<=la1*3@a&ibll
zNp-;md)Bd$_Rwnxi*>m2Itc&Z4-GHOg!HO_e2?;ls^TuBURw^mUu`GvInoo;_Rgqc
zS4Y4*Dbp#^FD3XrW<9CBkG3=C8eX~-3wTU(u0qa2f%n$4vnxq8KDjiPH(_(1P+T4_
zS7zxcs;Jbm{ku%lX;*~k2^?S!q#dF=sl|oh-TH?{z<M{pTimQVwXN`cu9M_YpRd<&
zcj&eF9w$&Eqm>Qw&7a_p;0o{70U?+R$*vHljAu<uYFn%PFbHvHDk#eptzzpC^|SeW
zYcNRv$}(lWYMJJx+@#PJu*)5&o%47@Z(eHGoLU1xD29MI32Zwa^$;q}{cuVuaxF}Z
z>z6d&Zoum{(LAczQPd;+bFd*W+#7rrNOKg<vy%1kE{m8p@U(Y}0!ot4ZY-gyc$qe`
z_FKlUYPb7T{&#w}br+s7jddbCngn2)_>2zV+Kax}zyPmHk3`v&_LcOG7W<fWnZ0;y
zJi1%Ln4@J!s1Ao+BY;|i3&I+F^EFFct$#^*2f8W!dagY~Y@xfrYjxlGG4Fk0J~D=6
zcEV2`27OOz-_nqo9Kdmwq40=DqqtNvz)q)GF&;4d^D|D*A|arnm`BXYTCn}9e=5)}
zsivxuHAsyF?zV9i3!rF;8Nk<3nO=$YZ3gQ%m0&J#NGwIvK-&?rER6=xu3++4f;jo&
zP8anCp&iXe)<4mnTNjc@$4TTCb$_g$iWv0V{qThE-BqWldWA(-8tEGnheF@|x4iZ7
z<8h%lmZw1WvEc6BuT_$XYz@Uw;QVTAVMq6uYIZk?AA7mlB;%8Nu0mHTNFW0J;)j6_
zCJ={>WJbB}=jpZYYg5h*FMB0yJ8pgdiJ=Q(<XKD~a6i@oh99nCA(MVY1g62;_m;UL
zSAeI}C+n9t6+RQ>rZo8i&4h0*Zg-Z1m=Cmsvf84D4^VN|qk60{YF_XmI=^u9;SP?t
ztLJ!>n4)2iQ)YH0uzjq=3#2~63GPZZ5JAEd@~U5#?z^c`R9jW9IuCpH-f&F$@pbw9
zpr{%1E)DI&o*SWR{SO3cT-7h3-{<Tsf8VuOe~vXxTW>;V815at1L1XcUaHK$gtL3h
z^Q$>|i>g$&2Yps>^uG+*?Dbr}qFM{2Ez-3S#AGL*`wozAl^hrDc+drm50x0Tf4X?#
z%wN*gsb(4<nj()LmDYc-&;HIp`!|2l5*k+kXGw$S0wm@TDFk-d;nl*gwoipg6}o0T
zFo+B0t*(oF^hP_eO~X|CH_ysVt~2nWq1yuJa7f24RPk;q?zD9mF0i~x<+J7X$>q6s
zqy68!CFd+teeUXtI?0a$T~N-|a+o;DleImDD$|9nzqF_qck5fIP0!ii(^q`LPJDbU
z9b#X8Ni(AzEc{nS+dsFDwLcp)!EOQ!rSlemd666l2pfDr<>GX4cHC0cw~=ilv0s3W
zDl0SfId$2h^ZcpB($Hf3Kr37V?-Dt3kB|{BP4+F4{C*z*Fot+oWeSkX-))&F;XfqK
z<Q)9I^*1GrK4$~C1oA_XU3}c_=nEvTUSonzlvBEtqEU|U-qe?NuHEiMWnL3)Q>luC
zKIGkhRjf!GxYahqDX7Qd4q&DF;CK5+V=^mIs&5Hj+!$ZY!&UvdYdg(h`3JJDAfC-*
z(|SeC4XZEHrNJ?#CQ?$ip>IMT*)L~=tlOXt-(YT9ut36C2=+x~P!q^`=qEHT5C3*6
z&;53e9Ts=36Br!<eLUOmYhU`P*da}epsBOc)O!R2lNh?WyN$bY$ASUwAGm=Cpza!S
zOa894;pgKZ%uQk>A}}bi4lmweXNX<mN><T76PXY>HB*1%(#)Ku#5Ln)#@h!d777yV
z=)oF>;D?zJwgG9vIwKyYx5#v@RA!DiH8pFOpTj$4BsIpN;6O`rDjbTc{pUXVYemeO
zgmB-XgO7tRVh72*C(5LHJ-k9(p;$A<->n@vWmI_evYuS*#2nL7S=SkDQQN(|6LIQK
z5CE5df@ZLDrLw2kIYGvGoyRJRD~<hvF7F$ih1EPtF;S~x5X;QYI&S?p5WIig0ZVFu
z3qWU`J5rvN!6Ozv0DH$KGase3qHIKb@|Y*|2DHxyahB{>;+|ejJx!=T0|?Wzo;$2}
z0vSLx4G#~jEY39YE7J;FRARzmPw@Ta1$LG&2mHOW-WN!AJhnCk^u{AR+c^`9#WFG=
z+Z#%B$@XQZ-M`p#<^Bt+PW;D_M)Z}-(*K54w;kIINU9YGUTBCRK|4&TX5`>%y6b!Y
zmUW&0XJuy93tHZo%>Rq1I?$itf2yL3;3-z(A|(^;g1)G;Fc5QGZ|f1lWl>&Hb@Jq!
zNPN*-pF+#$r<A*tS~&O6Wc3i@rTtMf-Uv;$Lx6$x@7CBKnk|1qKuEW>8+UtF{GE48
z5mBZB9{Z1sat9d~;0*8qG&kB6#b!$~T{w*Xf;nKi%F@@&*5S<|OIvX()qv1hpTx-I
zoOIjAmG<~9aC=9=+cmO)qzX4Ms|W~nG@e{Ic88FzLa5T{3^X@Mv%TpQL8D+{fM;#j
z&3ZgZb=q#~7Y#H|Gs-ml4pI1xjxeq<8>nM|UI#rv1nX5wK(^SQuNftad}h$^!09rU
zTb^BeXjC8Ld@<3cSG#Kg_*kL;@yDjU)lMF}!1Yv^Mp-mxY~Qd0G^t1oC&?~&^5b;c
zQRfVEp&|AYQf1bbV%LYIm#lJQb)Z%mZ$!=ZH<E9I26z75uLi;&>`X+D0Je@6;M)@X
z$;ChgFsAcAf6e&WFu;LiOo@>fv>)$O-RP6b_xZfCs3)t%tL8k*bV1!fV!!_3=sv~6
zplWPC``wNt%1QTQ))f|@+dorMq9pw4jR)x>YV!w`VL8Y@6v$=DWNn+LVf1CgyF^9(
z?!VRuyG;xDSqDG=n@Je|e?9)9e(k*5WQVYZ45d;75^er0#QraNG>zJq9#}QU?)ga8
zlB3p9{gnJVx~iI-T6`lov;^_{N)f!fs(hZT;h~F>{rSX{lp?X)0Oy}t6(}x0tl{hD
zwSl{=&TmzoSi)4i&(D(8Dryh_4UIQYdSujZu9kHokoc97-6TLVU}YlZ%yL^a)TS~A
zEXsj-y8&GhJ-tJGiuZbjEl%Q_YDK$eCK}A-+>u{KmK$!);!irLtgqVZD(iIpynU9O
zPk}`U<l-&-fy1i;H>A9Ybi-KEm|-lM4Sp8t(rT`<8edvEZO|aG<V8zY<r_Z?Rkgy8
zH-79Yh8l<^>G{58N~j@rz)Vj<)zeUIv#h$+G?I$4kvzZ8uAk5n9}nT0NZbY2cpVc)
z5?`8IMbU0NO1m$M^=12H-1*cDwI#E_%1YXxUQjLWtBYN|YWeta*a$HH4#&EciTA)3
zSvF`D7QQKT<Q(<U4#5D=I?i1l2D{NZf4atP5kHhpe@62L=b=n1a-z3wDm}>)McO6m
zozzc^&5B84HJJ%1I>BuWW>~iP$-H1aw&`$<D!k#AC;sN5?Mho4UrK24H^2f#mKZDZ
zoD#V9_~*Rbx3yQ01W0AqW?DXstMVHu8{cJ;HMv+5-{AX0xYGbicYf^H?L>l9wTM$}
zQB`*`4LuBS@A(z{A@+0etsd;_q>3-y%}&l*yQAurYC-v=yF)1d-nZdn9OaU}!ws}R
z&on%mI>7hzI}Gew6!pHUU(h#;{F71$zYIk#%5+|(GD98LZ9;sOeh%G~>50GDlT2AZ
z9>F3ux$y%J2TMN_I7<COR8H^KNVdFQP4UyFW#1GoG9&AC84(AjOd!6cCqB^BRsb>t
zm~R<$BDWWF=5#L$)28^<=SxTs=^T;F45m?XirC?%yObYjmw8SYD}GoXt9~~Gh`RM&
zcNUy@sjEc8<~!FkMG1S6nMb-jRUr{`CqUv44Qy;>LhCwrZs`f{<8s>{6$5psCW+rd
z^uyLC?T32I7k#^1P+9Uxq-!#pi=Wq{?>CJ8koJAE7E5lSd{TqpSmV$Y{^-^a%ANf_
zaminr?^>=}%micRn;0ptH5i*B&*Xe`s{b$uCt)X2ce*Jawr6inYTsJ_)`1PmPP@4_
za2BX+AcPcfCG@7TP6qE35BtVcUFIh!s5>LQAByS|3?ZH)y}~cz(xPLjtnP9jq-=RF
z-;^t3;9aOvd5Si#*kM^Wg*yIRPhK>N<z#z&@K|}J_Q(4){Sa&I$pFX2?E%O9$Wmaw
zLLx9<A#G-($fMX*Q7vkg7bTX?ARG{NCtSjM+QvglVf)(j((cc`piFa@9!g|rVhNln
zGsHRs89C3orH|V3R=W-RY_&mL@5I^MOEe<!^uZNj65;AP#FjLb;)bzf3E-rD00AzE
ztlO3Mo*AsSf_v)yY{j&c`eO&XXyf7?M-SEOJLds|r%Y6Uy?5*ZN7CbN{+DW@9&Ilm
zz?hNeq*t&PAuRWUwgZ;x4p6<`lN-bkg3gwB*$nJ1DYDS^O3v^PQLTwjCS4$D-;pWw
z9T=eb(2+<EI2ndM)+jLrzKE+2)Nbc;ZS}nI82=PoU>w4ixVg7s@)lGPtI-s-(!V>W
zO3`pmpEKfp@E#v*o)+~<19`nCA%b2MFu)3)$dL638Lft~!(?XCtLJ-PhE?u}mRN4x
z4WMiiJK%{hUxFB5qoJMi2=G<g?ty)KS?&D{)8`~tJ5<zX=rq;llxu>NJXBZgLR1(6
z6Kc}WdULE_?ATo@TVOQ|Ce8nKl0?D#EUe#^SEDaK4?up9%>oQlihv#kADWXJg*g%U
zcGsDBTteT}`qT%016>n-(dAAN90fn#3A5gQ?a7+zsql*zYEF+)<0G!s$>WM1xv!>P
z?T@G(9z1}YhMD36+a>N4lI#zhdFUL%sAl^z(Xe|oHa7W7ge+>{EkVUclq|HnstgS&
z#3E$t`mSl(9&=nc18q?U{3q-#VVxw7UCNPsbM*XOHBG1wqO~E$r05mOb#p+spC>EO
zrHcHBG=|^6roTOGx`9sQ@iAbcG0><atVRPok(W*Cm@mU>iiMzCOV2kdfRef!?}A0e
zA)X;(Esj@{DwVN=TjD;iMIT3Ma)Pc3zvzIckfNy!WBAU+HncN-zpr4n9Vt1)W&TuX
z{SFFo@l{@ILh51il4+^hEu_;PJMl+DRUIXtELLdsQ&d+pKD;TL0ri^|%T+Ci347uC
z1>CU9g??ukBg6!ZR|31~v$w&;lUHMhofBtg(#0O#pchw<1n>adm=QpDV0k8A1aY69
z_7Y!9wY7{lZK*N+?LU$$puZH#vWVh@+O!@&#LS7-CC({fd}n-oAs+y)OC!SN1Gil$
z_txgNjhAM=x&+pc6WZH_u5#(zTM!gC%ED+@zVDFG{*~*VZttU$2TyPX;SE5MTpIlP
za(`$jm)BBPGQ(tQ5^I&grNKP!&!|19AA0}7*YD$Ik|mzC!;qeQ?}xr=D@N~fVze-F
zxG7?=;X(M7L_&0r;*<U64M-S-6X4LV5+z7Q&ZW?RU5_M|nTNb>KRY-L4Da6GM~x$C
zNOK@TDC2y)c?pxPO^WXXt|{QfYFJ^dzfL98(W&Q9l^)P{E_&o#YQ%?)rl@XcyUt50
z3FDf)3G`bZ@S1lB4|6y|7KwR2@8uR!At^$#!)m6$iZs@cevO;e^9%*6E0z$OoYKB8
zOhiqf7^%%57N=oP8F_6*>!`7(X)#hcjRqdSWtAR4U+?*=#q!h|XUJ%lkdkox;EOP!
z(F0GhJrCbgKB0FyV4QgC<xT1px4?_LfymKV%0*J{0w+GHHDu@fl=KGl@zrQbax57~
za_uW1Q9E8Pi|$bIsLs79x!m|Tq~8H^qH$4VQSTV2ew-~kPAOmA>P~UvMjF1Xh-Ev?
z%dE-SIN8o<X$9@qVs7T9t&4nv$?H~lw|@0=-LJcU6-HoE?&52>Ac_AGK~Eg%clzAc
zrOt<k&p*7;rdis4elyWGb*hjoj8|)-!Aqql6@rn)v)qlNtKw4f2i@~G+2`rD=!dj|
zsO12*M|CkFDLUgYi@q&Q|L$I$Ua{@96G<0Lcaq$b7f#_4z(9j?aBW*>l2yn6FclaQ
zfR>+F%G(+B`&|J+9l^q5ucAaZfPoAD$jtv&9&5ZH0f`n4)^=dzy<PNS0Q<K=|J*?)
zoBY0tzKL@M>%rJ^h!#d_5y7xVRlz5gVp)t3x$advr=C5@y>TQElIsv%Q^vpG5+~2f
z4n5Bgz98U170l8XF*SJ(AA1_WEslPd4N+$h=iD%-5V_=4+GgQNmgv;Flf?TWX|}<7
z5F})XvReM{a&&+5!9WzrMo&qZi?bpNrJtnoY|b4ZF3Rnn+|tkX(AN0zllI0!#Hnb`
zO{yXxAZ-E6u%06`p6!{R$@HLE;AZu`1jJOpC5xHZ1&wng9kW5QvOf;VB||pTkU^g4
znTY!F`krL_=G<)&;yB+GpoD_RP=1NUhLnm>rT@?n*D>Q=LL&1id3$gq9wCv_|F!Vb
z1)8rnXclO$xqfbV_3iJK`2UW-60592h>q_h)Mv6$++naxOhYNVZ5LxoDmC)O{C1V&
zQ?)afo07^P0OEf{EfA}2(aP7lGV&<wlT-X#@wff}Hj3vg#7ClDy1ny*Ap#o=);TW4
zWNGtcc^MxDTB9HvnuVVmoE8G({M8Yy&w;++)*l*9nTS<S2@|^A-8=1m@w?`(cx)Z}
z`xhve5?`pBanW^?S%k&Ww%zrwz9x3S!CvNf`@c{((5~1iQY8`X1Do6wOc>e!`G8}v
zPQm(4@AR=`ASj6bHW^4pgv#3{C6c*w$#?MipRiKCx>ZdN=^<#2xL?mdZT@V&ar~H&
zwE$-!jaZIJRkG5MW?uqj{^Z}v{8Rs0=JWqcnP2`I_zCj1FkOOTD^(^G&<CVxV#fCB
z=CL~3>=@tyR{@9C;)gIGqDkL|<U&6a!S~`eh0cYZ)xBlIQe32e{kyI1%1g7YJC_~^
zEB7KwmQH^>3w}ZhY_}GVyQK%dNP51jN>QQ8ir&<IUQ%#CCv;9pIQ$%)V*_Gwpc!yx
zc;R;@%c>?lsvgWcpqbJ&F}<k*6%T_GKkhaxf%@hn!JG|<lk3pqofaXbADI<T--cHG
z{4nj;TvsXnDtQ1Tk$C>x8Ms1|=j&!%R!99%_AsP(39vA0{HAP3Ei|BB@47amsJ)xI
zc(_(g)*^Q|RZn}sWDLyV{TAtDTT(3+@+yZjqdiA71BQBAQE^voqv$2}LI7>CELNvT
zSin#ah9LPbBt;v+bW|dO({l2JUi|*(uwt*9RP%AS-tf4!ZRxl6<~4E;zAFlTg$j%@
zSjEUsPEG4pJ(iZ{0R5PlUX}1Zox_wo=r1lkM+q87Y}UFuSjbyF%P>@=1Z_fLr?9AT
zO1|^^Y8`s5rhxtD9#HA(rlit+>#f7X&2GXU8Vk~5-g=kaP*Y1#-h-QJjPp;D#Y8`!
zb-bTUKgX-g<8?FaK<xP(6CM(+0U~(~wB~SD*r;oC2YgMmdPi9eSnuyjcN)c*+K=05
zSE|TH2Kng~YtYB~)<|kQm{-~9Ob&U^ChRx^CY6vEjdcL$%&uS{@;@P-{YMnE|H^Zq
zKO_HCT1ZGrMRF>!iqs^)3C6#5k49?xEP>k1<|hq_^`wlG%cNX$f_U48hoH84z@!vP
z^5EPo_RYPH&pwXOSt}-m8xt+UucnXrC`I6f3<Lw(P3E;Ch(pSMV}O2R>W$$RttX>x
z%ZuNi=<*ewNL(_ay)dEF4a}>R1-i~jFhEVw0<yY)DF}#NpkKiPAd9nch<Nlx|D71B
z9CY52z|w0w6D09n%#nsME;Z7OhDKLO&|@7L@fX-N5qt(t=Z>U-iJi~Bk_@ZXJ+s^{
zjY;=_vcA70ak=xkWtwzCMM|jbaS$+uQ5_GVZ~}NUGA97^>E=NE_aBc?9Y187veokU
znih*p8;X8v`UatL5=R7<^WkA+4@xea{Wtm?%*`X;+AY{dQ*_U&?XqEzSlw1ao{Y%X
z#iDb?>8k~t$B6&M596@d2OR$YOWXBdcqu0(1rTvm(o%^xNRI_B7$7gL4h~%6#FxbZ
zb%GYj&Eu<$tp}Q|QvYtN;#nJLi9>Y|hrjW)6#d$RDG#DwOVb7XA&`b(bkktKfA~D%
zdMs8Ekp4#IJ}xGpuzRC<>G0O6;h}%vV1fbx_f|PfgalqRj2Zs?6DIq`e!h$Uz2uKO
zOt*}Yhf9oTz$xqspPk2>NSQ9I#<4boCs%sZ{cs!!0^EU~7wZx`Ltd&Chd{YCLWgF~
zpSv0nd41E$bQN-*3M9o%cM_`fa6161i5I2Dcewt&45@(%5-6%qt{X9A@?==s4d;2`
zOy~F=ypS}1W(4QbZpaTGMP7Kcew>*4V!Vpo)}hxu<KsZk3qN48xryTK0%}(I`YF&5
z3k^aUe4#-QIP&gOUOy8hr64bq!G%eN21b}fOzMU?UJH2ytwI~$(xt3j!s=L9Q(P#(
zW<2v|hGT%8=7RAoJ)400aAxt9)rjVf<x;Y4B2@P%o^8uByUE$vS-JV?iO}}&ICb2E
z|F;QlYMD>jF<Db2H(u_0&N<<QSECj`!9Tn=Z{ih+Rs`wVMb@aHbvgH`^*-9}pnzc=
zmM<wWS{25^_j@jxG44uqcg-(_pCZctAG#j={o28ze(ioA%W&B6%W^{WRtW+(Yn5~y
z0>D~wiRu7JM+`BKpfIKqN4rV>ZhvSXfP><WydKe@G0qUr*L$t2{|`++TJHUkUwvbW
z1}?&;$J(ynl*-7@;~io0<c0VVAHi^f{b3D=F|y~H#A+Y%WV`Vu@fh>5iDW4GAV^tc
zSDuy3o^qy^q`Lg`)LGz^-B&q@cUE$A)6iVTA2>&UeV=p+I1|Gkw6z64d6iIot!owH
z3-7XS@FVk$EF^#XS=u$qctlHOG|W{`ir(*bT2ZLg{6q7}qK?{gXktyiRGuOd#Xva&
z%^A*TyM7`RUnKc(8bDeL?1zMU6We1MIv?C`XU&y@SFI6Qo$@Sgl%`)hb&a^9y1n_<
zrGieJY`PWa*e(Jod@1;X?&pp|R|UU&vX@)m186xd|CM*(k`}Xkr|^#JY%eB{R!`je
zby}+vqV|~^KqO8tc$*^dKif3irI;Mj%AosemXIn+{WMuFnMbfC3Sr$riCoQupSPdt
z`kA>x=Q0|*+$-DEnIU=dfoD^$=oSuEil=W22tM4hD4f5qI3tei-Wc;BUJeP8Iv3N)
z3*UlEtTkO4g`c8gaKODvQz$ifSUjtZDdXxH_@+)M7FeJEPM?~~45ABn9cy8e@kLs%
z_wD|nDG@VIPNe1Ce7e@_gdLdHe$+?;%a`sRy)KJJ8rO3UB3e{ZuE8%1FwnYXX?0ci
zLIAh<ZH*hGz&0UfZ-%(HS;xBU5tnMZ>GMN9h5@#wkVptP!q2vo>8y*7djH&YxnGZd
z4?iet?Q|H^t$w(No^~RF2o`ZL0Jp@Xij_@Kw`Z?+Kkxg-@V22lDHuac|0})evLgY^
zgiFL+dls<$M#Bd%N)>RSt2J_+2(xew($^tRDX}@aG7j2=8eWm6P!Axm&jt*1$HbSQ
zD^`AdZ@ekJ`7NdkY~(T0)$)MRH=+N*%@kO|1bL3~0qANM<OmVG^1QJ-ukY9SkA4xJ
z@!b=mH{F1sjupxsP;TSLWmz~IkGITUUbLWAZK#YF@grDF_?PlgGT%3A_j&hM7pKp#
z{CXw6gc>uPK(+@@khH#Z;1nD?Ii~sze8V>ST=Z^4xOHXU8Efe=z-!bJ=%dru9uhaA
zcVc&00=TP2%7zWo!ugI>l)0WT7hH<;5mFdr+t6-IzZgB?5qGPHQ)jD4(2}{MYo-v+
z1Y>Qo0Z*T+D7gM4t8swJ*j>_3y-*o7vm(Olv^I$82QwSvD5XyxIt=Tg9~@^>89@sP
zkPbBSFtzih>eSMkvrtBl2TD|{>!z3US$d?uu%<RK!soKY+YITfp~3U|j!p@*oPzfS
z4pGkEfm17YVxk<nIU@vMwXQVfQ{o{D^zEpq^kDVvn0yvJ!vx2S{-_JfqmOrcb3Qkv
zVVcgt_(o`Fs-r7V!q0VMPXYHy*r<~aA=kagp7M${#*Z>n0X_xOBJ^p<Qirox6DmA(
zg|ifIPwUVN)6QV_tx7k9IKGjzoXbc=d5=d`%s4~)P>&_go4A6_a_qdo9c&-?!FNwv
zjj`R*+-DcJiyi?S(44EIkOj#MA)cOlkI03xVHHHq>Bz3T6+xmUeikie1=3IUHB>PO
zPY9p8(B(Qj1~@vfHC|FqX^S(TzWLmzvTx~A$0_w{&lH-{pGi3jR5;#w36LBhWcGnJ
z5R1G_<WA7?)Cc3vH7jCJSobPQ-D4BY<vt}Iw%?mQeNyNUbxZ8FKQHYB-=6H-<)|#8
zPn`>#>-*Q*rvs~ywj4e}K{VQZ_Vjd@U$<YOp71~>S=n?L?TGebk=B!$q)1EI(Dw3*
z{2n{HR0exkL0H|2%v+!GdT3tFuX*vMZ}K?W7wwwF)J>2f26<{Ud)M5j^%U4=vH#-C
zSZ+V9?JIxXb9WQgc0%VyB<7sTTIW1%ekv|dG>f7H*!W(P+lU@*BVk!&UrL0AxLe(e
zV^mwCyIDnJMH<fR?Pfnlq)A=k;QXH1$cvw%O*IXXZ1UoP?`o+2d(hZ1pRwuKp&ytC
zH?z;Fb6v~Gt;UaTBh;ZL?gn9&VQ~>k8{`?;@mu{c*yUoNYx~uzPMx9RT_iDrH0!)L
zFy(h=<W>fIhm(p(wQ;la2FYSu=XHbh+)dKiI!Q*s{K}pr5(7ZDi;lYd-bHGF>qC%n
zsxkOI2pGMQGNN&cG-5Y8ceb`Z$L0B4=JQZ3c!D*e#p)J9QmQix`;rWFq}GoxMEmF#
zjq{{NfFubs8Y<1QlKx_8y&~Eo<j^Hu@C}7wf<&Uv<TLoQMpqQvRcbf7I6ywzu&M2I
z;6C#`W>W9WR?*%SxFU5NT}6!}95xS=-~)!PWiy@$FIUw<vQ8F>d@8d$Ei6+JUPa8J
zEVDu8C<LJ(4(tq$x^Y*{=8GHGw$E3#aRwgb=TGwc;4pc}X(+OJcU|aARidB*)Uxn?
zgyyF%9?msKJicROC8q0cNui-BaP>H-FrkifE9&fM!6yFDG-aVf)NbO=C=jM*6fZrZ
z1t9m;uQu&LQzJ%+mv$+&U7#I#c<bFQzRn(>X2v73xpY3?_lLx*4xj8(UCao1B1r7Y
zxArIJcwUiW$uCI=Z$V7^iH(c0)Ft3{STuj(0IiB0FY=a|m%RbVkD2&TO|t9A*h}I1
zfJ07#nw2$Ayq2^*8qfL_3++i@Ec!!ZgDj&meargA^F2VOG}v-6w$z)$_v-aeeru*D
zm<=d1xICB7mAuFenbQ9WjH55xdn*w~ieA)Xjc#HZYj7xJSu40}C$b~ix7)#U7<fH*
z!!8fDxX4PXMe^SArqMa+V{f^u?qR--f*x@xZ0)a@oWH}fErFJ5>&(*|B{>!ELsq}<
zxoBL;jSroji^EXQuDanZS~93C_<Q2^8ZNKpYoClBSh3D|^!{iZ1yG!_5rR$D2Vbw2
z!OSn4xj!g5^jdjaRH&u(0uYS8-TJSnM*r@$NBw(LsjjZx(A)4GEmA5?RmOLn;z?;o
zr-`7!<=X;3fFO}vL-8Uwd>fcNP6bR0!@5b<-=2)#>gL|j33Y}2e2~-e`WjMO{`a!K
z<Jaep0^&0yjy9<V15196A7_Gc>&6iF9-3pWWg=K~f)xA`6r@9l{K!DbJzY_rbmXi;
zP6fgxG;idnoYNRicas7|1NT1Fn^1k-Yf|rk;y?4w-|$SF%`gMPSalonjJwd)bZ~|3
zz0VSQz9|@PK(cH9_&iXVw@dg5vDDQ#P4}yhh4;OOE4kd)o+U{UEP&2<T$K=Q++mIY
zURCR>`|4Lic$-2%!Km=BGG+RgL8vbty+F!_YqdFtC3e~}bxVa>EV0g4+0r66Z~I~R
zxk?0<Tfo6@uF;_0@A}a5M@8rWJ{gUj72rlL9mV6Ss@xlhI+Dp)0muSD1^53q$5~G8
zMJJ+h6J+b5rYjvMjqDxv<}szjN7+<cuk7D`?6M2j1p7ikwx|TMNIrD0)fyEcAC_%r
zayBxX_iESMWW<#AspuNc7V<>`JP*fuPWLk@uZon~n%b1{^{iS&6<Ksr{U7p?b@k3S
zLNW2vHrntz6~anA?b|j}xHxQ$vPZ8T=JaU=MI{sBu&b|O&)^_Zh?%~rc_OcP#^!uO
zl-TQ+nh!MYPCj$c6={+f*%&B|F4E64ky0#cOnmn!zA~-`*pV>~f7_89|IEq#XaBZm
zAf&dbbRzu<$bUIMfH7}&mbNyie>gv`_I6;H|8jmDYWY7V7$j)PqyCnk(>5!*)|K{7
zh>M_*v?z0aje2!ZoSP4x$JWPw*s@-tD)+wleEUV4gFWeNV2mah=R#zsZZuO>YhAvp
zi;PqTE-wH?(%_H3LH`0IwS{w<rlhGmNSW?#lE(+gF>Pbd&C@p!8@~YIa6yrgG*28F
zYT}xO$%oo>evh*Yo{{^#d-qgrx>u9A(k#QqB{do2y~iLw5}JT$MW1bu5Pwb95zkc1
z)Kk4BtnYsV<R8l6WB0Q)$>cUT-JT1GfB&JG=EprbrZ%eDxGDVN!Y$DfLzHf&Racv~
zJXc{Q@gpHAxM%%pXyXE*;MBG0KB~tK*b|=`Q5<5{uJpA(itkl@PQQNWyThh|komML
zb4ZD`0XO-Bw5m$Ap|xVUnE2bOUF<jZ_-;9JRL$KMJ?)zc8RTvSIvLbt{K@?)(ql&i
ztJ>ZBV)5H@=_dmskJ&GYtj?UG^K9;<Pler~yruG!im|1runH!n{g6gMp0&fTwaLz2
zHUnPYB_m)*t96Ss7R?Ao4GHKW@ezTt8m{K;cGI=*2KTttY_%Fwu?bX}N6q&#-siT&
zUhPvMD=Ghjx9`QBf7NNsA#*5_@Z65fG->tTFW+NRBHdYfC%W?ngi;`LRkPW?Aw}TH
zDGC0zxl2PZi_eol%%nPbehov2xs-J?%^6%MjK9-DFZ@#L8D_0KB}HGIb;-J-z`%>$
z+(SDjL4GKb!}!tD|BMIn|MhvqpV5EHN=E^dhCejkkSR`JJ;M#tAcf-U2hNcKTMl>E
z-n12<Q$>eu1XFq?<MtF*St?vk`E~}OViDL1v<K)|Lg+G3QXPRiGf!L*-BV-;5TeTk
z8i&IfD4>%a?h8c_O$hXW8?NQVSpVrat%6*)i|!^oC12jw?)82X=H*m4di?%z`T7|e
zD448}u>};WT2Ac{5=fjh1a!UfPAvb>3|SJmsr21c`A+yy0EDRm7@1C$`%aQloKoXF
z|LOW#Qc91*;w9eNtNfQ3mdYgdEr?I>$W7WJIN<mlqsq-$>kt^&jrRDgto(VNn1P+R
z?z8sQFL$0|ZjZvf)Btpas9_4=1u207vI{LBh4O*_AK$IX{RdZHAWfrW)iUOnL@(XI
zFP$b8i;aS<QY?5vLWh#ACRhlgsVn#9>mh!EcihzVyLAP;|0?*)`wPKbG*JscXz&7}
z%?&WM?VGCsidNVzA_0V-f>b6^IFl|S7GTIlh^+B#kO5G2{?A`!`5RrWv*q{6J^i?}
zx<lP7Nb0>(;>ywhlhco`E6a~V!X=J}C>c~q2+WssW&sr&T*BmuKuw5NUwtq9fg$lO
zdNbWbrxL+hNlE@oeF87_Qh5-V2;{M`7)|JpzhB`X=MgQs1v%415mKJmx87_$Q6=ie
z{50S{Sp0&S@!w0@3R&PE0A!XQtnCAIZsqbF2h`{QV!3dyp5HU1Yq;$8u68kLkRC8K
z>!|A4ASTaSl{T~4L6eMAY|jV2-Wqh7cSK<!Uk^xt+(Y+}l<N?R-{?Y~-FBfh8kQFw
zFI{w0RIl9B^_FhIJbQk-zL7Z>Sa288e2&Gci4Zig14;fYko$Oxn2IegAU#@}K4Mf|
zQJd&iDjwORqR*G|Q}eVk4g2s*)w=(eeX4)A;`krD$Hh7$6{BE3o#E6Oz*^zyn-tCU
zgpghSR{-<ViQ;dez}9y%Sh4rr;voEW^vN?2shZ1$n$txM_sFNDOkHc@ux@S_(3RF1
zE8epnRnPamdKjlM9BIM)BNHLJH^1eCU+h3!Y+#%MMU;|zTi(AyYOdJ<EV~6H2TT%A
zgU7@_<~n@pW`n+zt-i5=x(J-SZ)PW#g2QYLk)qFoJ_sThcPzh7i1&J)4>Br<Ns^m6
z0vb-sB$>secp=`AXKK7&(n1oEf$LD-{j%zXfi`_aGl+TXh3E5AKoxp!wT!+rR0cb6
zq2%i~TSbwutgXB#rk@XLm`fz)i@FnX{c9KR`n5g6I1z4kLTIR0=BYzIr0t$w6~}Uo
z$MpFNq3Xp4hpj5>-T6~)n0u0hd$E4&XC>(E2J^oKq%*%&JH|++sCfx8Fsn<f<|P$J
z73NAMxvak^9%)ci+ab1)^l^qU=<`b>Fp&%Cq;IO)K^trK;FIfQIf4by6{oF=#%&m%
z8A{iT7m7%-KI!_4Wtw)uR`Hio5lr)Q>Ap5@0@m6n=_RBTEB(lTS<1?!xYxpIVP}e)
z=ryRJ@O!hYbC@bpdnKObBwD1*1M4ZWfY>U+Q!Vg2udZYp4^3?9I!mQNJc|?4PS^+y
zCJt0{)8VR$4*?zwV|IzZsGO_LLG6XTlcN(moy+SUQ>I`+vITHFACi!ZD8}koHT^*O
z)z_J65i&i81J8(@2Zx*4_#Yie1~M}hMDVYk%x7z&p=0*l*hdX}@c;C7WV_e;P3_Ld
zE(E(S&rwH6Z598tN#m6uB|d6D><3sD;f9=)cu1<fPD;I#St9@YzHIL~{v_pfzuyuo
zEQ;8St>uL=At5|aN$AtMW@(2`BTmIqB64`8@^)uD9XdVo2gzFUsc~-8*P$y7B`Bpd
z@y+$kBptzYZM`Xz8FDIKW|N)3)TJTzsuR$0y$jM^d6cT3arEEWKD92fU#&Ixj4V^o
zl52HOBysHC<5TfxP+vZ0@fU_^)+pxr+Kb>9G60@3vkJz`H>0lNXst2vVLflJv~K2{
zAc6I*R%ILPLrmF*v1v&D!#A+L%NHctdF{EcYmeKHO}J`^c{o;Oh)Yb>%DrDrJ5lK}
zcgYYx>2X;G27Ndi##wuBae@JK$6YtE<xBX<wijEFk8>jUj;Pu^jmYBZ7^h?(v*^-L
zdFJvNZNc*kW8DDboiJ0B1GH@Cvlj$y%)j_LPxKqk{vzKYtZupyxSQ>-AluPr{Q2Ly
zy|1l)c<xYk;IW~p6&p;B(nxlu8T9|1Gu~a}_Ne<kTq2ednf&y}+hS)+zD=?^PVuf(
zna#3zqpx#NZ~TYr1@@}a1{%YeN0E4bB8y>^^>-+yGlLDXUZ%HVbbfdy#|IE5Ag__E
z04pBOR)a75tk8BnjYm*U7GgbXZL@Bk$NH;833X-sR?v${U6E^6PbXB~E)|;wvr4t!
zbsH(FB}Mw4T!xQ8&Nb*L<l-M}dld72dAd9C=7z4)k;PnNZyOj;gtkNoX^Vz&bqW2+
z=Rk7WP?4IWakSB`S@TuH%qIzngTX=`m=_<+rL-?-GUrroEKh!s<v0?{RVuH!Hk7uA
zM@E7HaFGL&3kt$rNhpS?m$SEcE+36t2$W@%GdQb)S$7GuG5UtjLFRd!Q)`b9?cPbv
zI#zu&a=9t&ZBlkQN^o@lsNx8i0NV+bUw*p(we>;h#o6@H0;SzvzrAW=7$ssGrdxt;
zN50A!b~|o*n82ZQ3RyHjcW|ZYc?F5#!~>dj6Fb0hG@j-DA<DIPM`EJ~hj!g>H1Ske
zQc>)l2|(G6R5FDc&@6=e{zPfgCKSYkM>L80F5VdVB(V?9VFI8Gs$Fy3gzY%gZ)1gz
zL*M0peNW03_8SbwY=hd=?}o~>@ddp48n4HEheznuc)fZ^TSuF%^|GPu(}ty^<OgQo
z%UG><%b~xtg#yyMK1H_;qgWI*tSN=S&q5K$0ZUzcCRA>Df6M){-9zEieMvxmI!s!F
zg*r3G9KWV=kImjnrbo>2q<m25ti&Mz3BM$JqvAu&f&A}|%k>ecIdjf^4)@^>)0IT3
zOOgqDn_k8z@-dVhxWOg^E2Q)}aZ+!gEl8{_JD|ltBUk>!VSz<L8(;kjhfjYS$99Jy
zf&St9N5Eq8O2wN#t_S`demD9=rGH#%V?0{Uv}hY!&gm-q_Gklm`_(p~bCfKqI3WC2
zgw7}UOK{o=*>t8sSPpeHCQw6Cfo&-FVqY)0vvLw&24VNAuYUVAuT)mKn25VvCYRq7
zo~L5j1MBtcE-=X#G7kYsKymWOHok~wvb#bOdyCk+*I~Zp@dDTD5weg1G{-)zH+Fg>
z&bQ^RKHQpg-s07wR7Ih(t|0(i<_d{U2XPxB(MO;!Pb!^kSWPpkkB~L8$;*WTv2O%?
zZPC#ONn3QgGvwZm7pr9+#2KN>@*ndAlX{AceX`@Dhi-qai#KrU%#i@*HDUEFI;Pqj
zM;?T&`o8DBuJH)8rRtzl%ee~N2Gp(<{nlU&4QcNMtOnw-tD!a~qL05+3w%-Ar8C~T
z-FT{B;vFdg5Y|O-(a}`)wv#?_?a8u@cgt3e&#a~uomO=BzUO>Bg~}}+FFkpG%Z*aB
zPSNN&TK{kDeRo{cOS11EDv~5gMn*wJiHZUe$3PSTK>>-Q<Zu8L5Kx#ON|HDNB8mzq
zA`*v;NEpdUMI>j2sKgoKzyx07Ip^*Pdw0*?w{Q3CyZ*rknECauyQ{0as;j<L1(uv6
zMv!7G8Qr!O7$H>-u2GA+x&Ht*0q84-fAh1Rw)%izUk~jhnvv{ro~h-<`ojD(cX$)#
zdsx;TqGc~6!+q{qRcO*4xOwI1jas8fp28>dvk})h<4(#K-M)Ez8Nu!V->!1d8&eI6
z<?R3LE03WaWtMghVXMt=ylL5=u59+c=7rQrk!|UYP*F)hxfubjPV^gb=3P0^k)xC@
zl}f2ScSoBmN}3VNNIrdR0U1*%OwbEeLZ+)=Mk95{E|o)|;-IkRyIYc|=?xlxMTS*u
zuR{ME0#u)TX(MdW2#s*XvTclFP3x~&FnHg3ly!D8Az;y1e;BLxMCDABmw}=1xr9Qq
zbzm`U23Vnby`pc*)cPB!u8-JWMsW+G@-^KVQhatpjg0QSKrw86p0hT_5|vZVIPz8U
zgafq=GyVBh(#v;8&zF>l{NOA2T>fS&kGWU2Td?JhBBJ|9g<>_nX*Cpg@nC1wM2=*t
z;$&PXz(8G3JoRqQvXXmk&p`{aK{>cflpxB~rbz;xe(M>2T$p7frse&@Yp{m9-~E1F
ze!EWp@c*<^Qjx=j=pZVSf}^n!w`pS0b@&q|hDfG^dNc`M{MQqAzZ)0a#ksCUU>V~M
zuiQrrHzqK5)M!~a3PsKL)r|+!r<82hn35cuj1#b3nuU#Ge<;6=U#dp3FY_uXjxlnU
z7yCYND-)NB5)_%vQhuYnOL*TV>?nlSH?bui99ySu_qI3X{(7+7I6k)FLBdH_X{(|K
zyJ_QSh8=5!MNYj>S+?Z<nEzf-&{KqN&R_;3TcIEUwO*WDGT$v)q{b=bzPO@1HL^BW
zfj_(ILyUIE5M!JNJ=AQK^FlO&L?Bu9GdtI9!o-==PP(HpoFEwJ4q_w^kq?C}wCfQB
z_!a`?a^Vixe68$y-JPZ%O~wV+(X?IIxIVFQ_wvzK3S}7m1FP+MvsbR^KiBK6OB(79
zBwOIz_5#~(9g49t+w%ke1wHAZ#gB%G^u}q;Uo=PX8W+5ky48@4pk{H(Dz<AAX4e|Q
zCCJ;28LSlauACIpF&I)mB&L-rbP_X07wGVD`%Aws1@}!Zx~;TXp6>ZaF3C4k6!4a4
z0$ugnkieq4Lw)N<_oB!KQvX%TrQUhGC8;lmB`A@%93N84=p&;iNW5i~=l!C&&inQA
z7iEt3L^Fk0FW(>)Ec$y7QZmSngoYZv<7)V|^A0CO&~mr3GkINKtXTNdGTiApUDkWQ
zd)&NT`?^@GVqr{U-Q%8zc2+mEL}Ik2omY0V;k-w4$vuxn7zYom=w%OUXLpfYtS1U0
zIzOj7o%=iwNFOkbdQELc@cY^lkoA=yAyHuEtk&D1K4&wB`bLQuInS$ni#|hTk762V
zMed+WXBPQa_jRgN5fZe8uE|J9PqHeXJK+u;{(vg)ZoOW=lgIaV<jFn>v4daTJ}uu6
zT}%(r)t#RulZb63Q6eaZgROrfGc)M*5ue((ZBg;?!|IcSC*D?H`ahmK%F}dkofhg(
zWX8LNDAD5j5e!754?h&n9PGPS{!nB=vBc=6Qh}gW&WkYe8r_2n&y75jE50h5b&r>0
za~i(%E(qAkN3pQ@*XrCB6>SSMGWB$HolD(>8TE_3t5osbj$f-^*zK3-_t2CQmX}-E
z-z->p>Cwas>kiM0OS?x%bDZ5_)$JIa&lwml@5i$4p)G`?^;agx3?#o|W-hHde(9QO
zOv*Q|O1cN9S5nRpiCm%O={WS>)KsBm&kp*XE@Q&J0Rl(rKgrp?LFRmUQP6@vTB9Gy
z;FUk`d0mQi^tid_`5I1FpR!6r+kQ9QHMdM)5;VSw``HcufA!m-yrXdLWVH<A>ugl}
zzA!17PNgRP7m}mW4Y>lHePlGSpCqB`HeoynN6m7%vEjgyrq>q4b6wuZGY^pmK1`mB
z{aAEU2yt>mOe}67<IN9|FKJh*!>AS@5Q}&u1Qc>Q>YRkngdCJ5Np+^O4@QS>TU=1$
zn}5n3ai9S9d56HgsgLU08pDyFLf*OcS&uZ#iQtBbnkWwM;JsQe41tn~aEI*l9OwF{
zEWLM2M`$#^mrrK#`NhFWyV>~*E7B=2UVl_0d~Z2|q(yA6Pv8!e(PQ`as@sUzNKKu8
z;wUjH)z|;t`z34U9-AA+ll7;z8`l5{+X@n<LtmZ{<G1cjNn|H%>BeDN;uT<)frv|+
zFjY`Sjwk{QRAZN*8Uz_&4PLm70vF&AM982{eMx4)1yFgxx2+Toh#feM6G59uW7^l=
z7wh<RW;a|jQ-(~2%;cjk+m*z~3ww@a3Lh5LxTfw*8pMn~Sp|8IV@ru;AjgDc$|fu&
z!Cxs&n|Oo}Z=M@s*yg(fGtFg8>v6IFtCvCDK001w&F1LnC}xM>4+JRSBhR2kTZjRq
z+}bNgjnhFoU7*8PZNiv<M{J53iVcPEdSLMNK%M;U#0)8|AcU*tRX9nS+NQF<Q)1aq
z43~6oy!7q0d;I6#M$#zv4js)%DYb&lJCkTBv6WoT$Q_V9D1~sGz%S<X_E2J|2kV59
zBTwTr%eAapdk_xtYpsKJJr{(wY$IENB|@RvYF5)INk1e)+lB_3u6-47k*J6nxbNyg
z>Ohvc2y={Ao<cs@$u5*fTEd~poNK^<=Xz(ya4qArv+v%%IX%@kVAATx@;FNMxXH`Z
zcBO4!c~|t2=_OpNYd0572WtyXOFxK_yU;jYv*WVhF5$b(zRyO{J&LO;gsA6-(zD5;
zZ9(rpRP=q8%QJEvPtB|?RVGeVI?yf^tO5qOTj{MnRTHnWixQXRRs?Z4eO>kT41Z$H
zB%6Jt|LxG=l6d<j?3#jTCM(L96Jrh<AW?OR2Z?OYr?Gr0QhoexKrXQD;VNM7=Hk1Z
z8&|tdD&c0|;kai!S#5i;WXi&Da8iNBJC=YFY+n*nIqget=t6(N+|AY3uEmKNB7UF!
zZ$}QSVXprrd>DHi;UYymJXkX8M>wuYbeHpo*V!9>7V1QOew&=X>)@M27O585c6&kf
zx&Dx$`jbtR<CxvVC!`bPox~40X2kf>q`M~;IGi3nY;okQ8@C<T_V9|frW2lEnnk_*
zL^rlTMo89B@6{#|FR)NgrBLDVR{_sk>5&i9ZNl~$e;p<twVwr`Th%9LH(^-tSy&2{
z=lH4u*akY!K?b#eO<3Ipx=E4mulY`!?|k!pGkiZN{_Th8ejt`6df@9R(h%+xVtpH$
zh_VQwu!SP<$#C)=WEv7*m6X>7jmJ7bYa>8AxCHM32YLfJ#)XAShEqlT5!@(QsLCu0
zfcIRbSU}R$tXS>E)Ft1VZ2E#Kp8nMXR1aSP(8(J!-@~7RK{x{AcqhzGu|9wQw0rxk
z8+m5gc{Pd>iLk{m5G9q*)(kVBxXl<K$rOF&bUh3F)*ECmZ~^F39?4*K$$*?IDgust
zkqwXcF^eB~y7S!vk~g&B%IitN6}dTyie(aJ1FjuXW0i4bSiJk-Dm8k<0IIs~@%2(B
zndd$bJ{Mu28Y9E#0(K<7&#<H30mZ6C4`M8*lPGzd8}=`$4N%@h?Ib@o@GbjYZ<W*F
zE|K{bXh6)As8sY3e9~E70XCYg4~HrBqH;y8`$^_X*|*{MX8_vwev#JpbbO+kaJxC2
z9Aps}Lgu3KYX%yS;V~B!fx{BCE8dAcQ#9NowQ5{oErG3JhTA6x0*V?oLN#2}W-!ed
z>lEJ#jTnfSL8vSZuKw8k1c@Muyv*$+uwfOT?&k#01~NC}`O=6wsjARjh?S$@Dz(p;
z%^h?f-ERA!iKSXzc>5H*KN%QU?_t_2Xji2vXxBXE;p#}H-1#dAvZ0p*X(zS8K&0gt
zlj(}M*3;;Ia$v-@n9E4FVO$A`H{o}%VQ;{{P!mp+0nVXD!#)$>eY++xH_E1izoq2|
zY!&{%nNEvLR#=<mCy9dufmeuEQy#Ut9UuT0tFZ*oBrQmynf6r9sEF$wJbJ*=WqGb1
zms>D#sc#*;N|Bmr#wKWg0)%p$9eHL(WkkGmGVn>q-_%4>Ynq|ecSc75%ha22_Mtc$
zL3hOso3Q=H)0THgJg5e*WHonu%Gu$CZ)<VZlyV1QQy<=%OGKuqYh0yopaxlZ9wnY@
zTMgsh>g%W>VNX*2jgplwC`(5q-qc~aWQPie=FC^h8#-!F_hrOLDVH*psVRxX^G%EC
zyNIeC&VRq#Ivy7s_0p5l1XetQ8c*U!HR<aLmlKU&Xr`5d=@SftIpk|DqMFn&NTR#B
zx{0ZCpZp<|AE*&zY9V~Fg(V<HwE?@jm_*6Vfv9kP`v`d8q90TOI@xbLlbSYrjKnus
zdmtRA5(v%R*<!2Xm$#-8A6OAzJ;*1wH&6s9P&s5HWN^%C4)?Mf`J)0)UmL15VOV%^
z6Q&6W)cp!%84Qd$pBQ363ozt59!NYneA_O!0BNw}I^KcpT-p8vq$+zTF@Ed=zCmNV
z$G6#J>S<6Su{Iu$G$4GYs%PuPZ-fkIeuf*Npv3@)Yf8trIMaOXJbAVg8Yy_I`&_PX
zKT-Jr*xgqr+`wLm1#!qx1zTF(Aw6jB8;5MnxRDsB^=tZ}!bH92_o1)fW|Y(oT|x9J
zTOaT7m1>KHSMLWr=sB7{AX9-Uz@|Wx)**G>dc8~i9pqMk@-5c?8a`1{t#wH6Yz}B%
ze5j<A%zfxx1U%rU!>RIvTTkYyvHD@aUni~s`|0^D&N54onsp%wg$Bxj@Pa~(iv#b#
z4w|aA_t;Yr6AorG*%OhUY1vlT`f<*f%Bc3zNv8s}yNTl#*p-0G`e`no1tsL{%F%&~
z_IcC+uzQi13)E_4UTxz6y}&-U?NBQqZk@4W4i%K5xLG5EuAbvP)^i4QGF^A&+K1c5
zj2m)Pdlfjh3BoSbddV1IknaxES?>x)21=i&qiAex6%GLU8!0h0T(*<1WYTJd=75EE
zoPp%32j+7*GQtI4qrs$nb&EPff|LlX_1DI`YdGED*7if+`j+IDtLdP$idnwud0Lr;
z@bRFqygvdAT7B;F4per{jN5y!!NIz?1E>7mR<&0xlV|aXXOs~oFwnIq#Xf13k%ATp
zTt_l^s2;ec3OFzfbG!?271`^o^C%kheGK5=IKU(?)?K~U<27d}x9CQ$4!YGDFPyLr
zqQt7f9@x=Xz`#jmZfxi#`9h03?52@;Gi70edkrF0k7<;_i2yKkb3uL|=w_`+M^vX5
z@K|-vd8Th&oo@qmvE6#w^#eKZNoR)9>mz`6!;Fuw611Z+<t=P?Gfyue=Mf@U9O2>q
zP-NieE2|14fIgz1+o6%dV~+Xj(PWY6khIkiILQ{7xrWV^o4s>F^(-Ev8kyI*MKzzB
zDI{iU%Po(3c@)nV;;b*=&^lvTVV2;UN>3d!z#|=Z0x_26InI;V5jZOvNSaWcd|%$^
z3TPAswn?e-MJl7>%W0NL4g4)lvu=`)9<?WovOOONCL5wHGopHs>(as_umLzNpTDBk
z0N}{06qpB5|M|Q!bZu)kED<$U-D2n=dt+uZruA6FK?q0adc;H2+b4`&1@O#q(U}vi
zM2Xs4zE($6*tDe48&Tg_9DA+^+rzS|*JHbNe(e_++2X6ECWIBH*NXcXkP-q%#~y8Q
zxw)rEa8>j46Vle@{lwR<+RRc+8I^``ei(1QSK8x<NLA==Xj%nJzGH4UOy<(oNxUcy
z-}UmIoId3(%hqH>+8}GUUN$>cCpg$8t?u78{bylHAY^^}(V7N0QLE<n0b1T-eaO$h
z*V;Xj<a?s<CPD}Yc&f?l^uC9PAogvDX<5WNLz$TrQIff$@XV1)7A?uYh_|zz3q9~v
z!=jzeh+saI*3<N3z+94Zm|B;VpZ^r9&TA{#UBAU<#z`v!D(t>t-{hNVjZtmQ;}3|L
zPekKd2yZ%wsO8hCe~4nyVo6N(0-JPay<cUu*ti}GRCPw&1Hl95#QK{;k8;CF=OyL8
zmd!S-gL;gaBtcXofoL~>8egIoHhr?mn3eVP3aOJ|U!ByOG$L3+&|i+!d$-~FA*@vJ
zqUt&8C5(uCy=|xSMZ>T1T65WDJ}GU@cw(Q&^ljePsg+NtbYdw$csS0UNI##AzpJGs
z->?b-z4Bz*lZcXrVCfQ$i%|D~&3RvJc@S}BxM#tkwc3RxY2yl5KWOV7?A1y({Ygox
zoMKjIjZDr$$7LEB#Eq{Yj$v`@H{r|bHb7tU2fGQ5Czr8o2($mFgJE?WW_d|_t*KhF
zAt1T=7T0O~?q;3+9^G69CrTIx6@Iv=-?a=Z+=*(`94qJ2c*_e*JjOP*tv&L6<qSZt
z2$|@C+IYa0U;u00$hiTC$^_mIwH^8dlBHJx(X(aeVWLD~zx=G`85%r^Ewj>+K)=`f
zl|rcTtE)Sv9ZS5@+A~89{Tl;K=Uoro$`g_c<i)X{Xa)}O|G}Ux(R_c?A6dNbboygV
z{+&+$pV0|{H!q{DBK~~Jh%GPt&ittV`?HUBeV&*`^7ZDfr|xrO_14DOBy!z;TJ+(q
z(~Q#YDdL#EJ^Z2GHR-fmfk|Wl60gs%7f4mfCzMyx_!-Y$e}9)I{oW0`h=ymt<L7%t
zE)_bRv~_3hrm+8X`sdpM33?mVVBmbzSq$Hxjcy7Zb@o&zDc!lZKS8?I)%=>e!qce;
zKlah5x0CUoGv`gR4Q}16$nnAUUiQ4$_uBb3P!@v`vOmd;1OJW80P#ox2y4v7fj&5e
z2;?~Y*Q2QPSpFv*=E*EAa5z+DIClcNC&)oq3$5g>82nKDaIw!J<ub#Gb;*w^Z3pT<
zEj-i=-sa<+>vdofAYgx#bw7_A^<oHBgUnY+x#qgU67*KNW0v!LOzr&mK8ECiV<%xS
zWmuiz@5E7WR2@h~kkNLo$p?Dk<@Vvxr_{!xL4bL{yd&5CR+xYo?8RBcmk6y*SP;;F
z#~CO<MftUS1MZofs0QS+Rw06f2NHWs7I6&m>v8^8CjTA!`hR}`Fa~`m;&&Qs83n)d
z!FL+`H9kN|quPdfMJUOYvP8@nXMJLyK0%`Td~u{)9~1qaBMcgov*??h5wM#qsgUXL
zuO%23jvaZ8%{2<ack8rQ%KPrb58Sd3niDe9@zTpz?{%m`$KB$NVO#UL5nX*h1b&>A
zhUl{uA%LtD+%iB9G^BV#=RZqP*;*iXYv=9k1AD!XBxv3j(=?uyh#a@)J=uB@<Xg%W
znT^e)c3^q4u6E2OQCShp+MGibH%_yaJ9!;U$gQ_|BkTyfo40^Urlp937>Hkq5!gRP
z7=3@sPrioV2<h*1`H!Rv=OVUFk9at~8Xd|la_KXbSqEofWW3WXT-otJ@cE=i6(v0>
z27|hW_hZ*WF++&IZ&ApZ-D!(tL^z&tmD(6C4HjnB&GK;)OCi_;JfI6sipBy{4>6hn
z%TX)twMe3$kXGHZnwQZh&hv(8`#)cEHS}z(_fy9F4!tmq0;Z6>S^FElB5ix_tE+Cm
zroM|b*s$}-@2(7)Wy-B0=%=C`VFu?u4tlyxl(zc6(_rD=Rl#5S&oWVf;`CGBkrLlg
zBv-#9YyyDE_&aRq>~~1je;C{>Lm_GQG>PL&g6Bs}7Wo){E-2`!i})J%E}`JVpKPBE
z4v4-Mh|%2vLkXciCE@jl{gH)}A(S|R-s&wm?%e0v76$#b^gB}=lh!9rwl|5zCP~z&
z>mAg>wCFJt`)gHT1P{xjMCXiQ?;F&5yW5KQBpEDJALC3fSMO{FSz8VpjdNDjp$bu*
zh(hEn?FhQqTXEHeD34p<c6NL#*OlY))bX0!nJYTYYvPKs1}cFk0>akaSM4eOC>3hw
z+c4sbR$X+pB};i+YOHBRKx47(%@#&}n_YGd`&F-6@$^}E@1X&CsexIi3Yk-+SRsd7
zm^+r*blvL)p}&7-L#Na$dLRf{WO9aHT#wM7-t>-j#fdT(Z1W~qer$kCjY;l^dKE9P
z5kQCU+U|t`0WWq^J=!B8vqf%#DY(7jGlF6c)p|M8mlN=KuU*^}i?;&zRnPGT(-w^I
zk!1fXn=4|o>ql5`*32AItDTqIpyKYQrkEEdT+;76>qn29%8-GxyvlW9A&YE_e`#v2
z1#@P;s3?$gU3@R7!LYVKWydl?pR8Iz$voj7Jt2XZ>fvRc0uU;GZxcq$pfY2NS1<rc
z@CIx^4D|%$GJ{;&gk9f+K}fO#EeZHWf71ei6T_EKc7odhUI;-I#Rj;|RX9_jdBg%h
zibTTuZ*`M5VFS=`HwfQ`QCG7(b&g-$-RCkOcl9VwolsMW^6|o_##1G=5GW)!YewK`
zNLY(1cX1JR?wcF$j<0o=u4b;yGTDUPJV4{43>&Rf1-Bbv%OOi|z0v5hM6Kpw$2UWD
zd8G7Pc32^Viwn{)1f*ds*&|o*LMl{-mDA=5Z0U(VO)|?Y9nRPv<Z?&jiX%r5FzQr|
z0u#&Lbf5P)E6LBtr1K8?+bPA?c_Q#}L^Emt7er)(16LICDHfI^38&I)ug1qExDih)
zo#}63?`0dh0-~bUFHrltuv64ADisR?s@H(ii5{fS`Etx2_@~&m@Iz3wG0ts+2@HQk
z6(So#JBNQo55%u%O+y(6*3MrwP(g4IogBFi7ddNq?Kd>?ZaRR6(Ucy-1|WV(<Xa1~
zq%5aJUmv0?+D}o;J63Z$@8!G9<K}{3#ln993;#{L(?1+X^GDm$q@<@RA6B|?SVr!X
zmx>GJ)$(MA5=}0|^ca+#(ed4ck&f2MroPazq8Hl}v%G4Jv?L=x*>;ondb+UHs4`L?
zVL~Ar1lu}FvQtUsXisj7l%=$n49Y%9Ut1>4FV%LfU~VxCJ<TcaWtwEz9AnnpxW2oB
z*=tCEK>x1jt=lUnH+F|@SGr|WCL4r61mXP>i>#vF!$wtxZ+oWDheV%cr!N$!F?XmT
zcbJxAYgORRj(oST$E{|=S%?oZva@@eR&oe2im$J|lg`DYr0YIZcs5o#TGdhgvDLbY
zZ9Gh0RDg5N@;PpSwZWa|u6wY6yZK~AvP?nI`+alEIl4z|?w%s-%~CY}@Hzb=opIdk
zZO{EoI*Jvoeu=wst{&OP#AEzmrjM!k#)-Bgy>k{CA>=dhhjVqWjfKs)?u(ih=8wo^
z*f3Y;dng^(H5GI&3*RZes<fNll74$zF+-wrXCa(b1LCXNPtzdK4aYdJn`pMzs+{kZ
zcXL0O^}@kh)CcppMz@%~D6yf;@|n_k`PhyXII9EOkg8qaRS<<`rd<9od!l)lP=%Xn
z*I37XwvvsizF5;wqu8JXnVPVbyxt$Kv#u7F*gpxZ{}@>D?ChO3&!)olGsg}(cZs_t
zSBAVlBadM#&rhs3in6U2rJ}R+UbQs6_pFPzGdzs2zcgDva@EBB^T0yU;7+l|mU`^T
zsj$V~x$(Of_asLa&8_l1;0qMe)OGL5^ITv_UF5amft;3?&gaO)7p9h0-Dx=Yv{Y2U
zE&!u_^>DD=An(eYW%`~ri)uk>9zk8P>iKNjg8MZ`tM)Rxec_uemcExJf3ePIUDwv&
zK}DQP)O*y<<Ca}d6r|X^J<Ms{e|U4XgJH?uC^8JY1A2CQnVW4;b+5`5wHpAX9b)}P
zJ#p|FwX-*2d|JETKz@;2S4C0?)(9y-^C`dITyAfHWlTh@x`1!9^E;a`%>w|~Aci?N
z=PNTxFMQR}qj&F4XK~Dl>q+?;j*lkREI&U^8%3~)XSliq^J6$ClUuew_05;?+s2>=
z&xp2!Mx}O-KY3zXFQ0upB4-m;@lxI7(LvJNAT%>EP?xK3gghvpQ@q;D_~qP5I-&9-
zg4&K=Qq5nS+sTTf+spOcj@3jRv6T-|@DPhdzk7pl*0a9X<>6TP)#RNDGS%J$*<vfI
z!*yz2tlw?+YQ?>VeIK2hJR{ltRMb7U*DDxv*~eXaF6F3UU9cl6^77&(Wij=xs~!7c
z(Qnf_JzjhAFudU}<0G{2_s$+-uO0B>oOvr*u=_b|Y7%26^?tu;QhsLX<k&UW2c=(U
zePmN#wZ8hOU)AI1WFd7aUiYc=Q^{M#*-mfG6&@Toy6!*Hecwrz!?C^4{Yc*}K0*Og
z@hd^p=fsBefO_>pA5p=kG^eA}N9kE35?_=quo8VF9}M(I9G%{AZ9^8+3qIM@Y@E}B
ztn=Fyy-S{R4tISI;r_(Ksd&pk{L*A_Lr@FHySjthr4yMw6X@>Q6kT__b|br8rrmi+
zP`gu(H8Mw$VR0RI+vMCihBr!lc;`>q0ofn+qOIagy&svHB`#u^2P__6Hhu<T&}}Vp
zT)a07-F6f2%$c9|xRI86%c@XL-*vlmk>B>c;+}gFBM96oTxrojq(%g!g<!Bj5059T
z3$J>U#C-MM#*A#M`pE28L&&dJhF6)s%6YVnC!B5F802!QlDKhpZ0v-9_`EK}N3Ky!
zQ<9WTk}ZbD{Z<VPWbj1-UilQg-ku)TT~lHA6L96nvb4P(NwT~zXPCeK8EgH{s-j5d
z0=bprbbD;LfC5N&)aMRz&Yb$c3TgURw?FOa?BeGl6E}MVEK#IDbmQ~3wt8L@z3r^m
zPLG5og36s3VhxBZ3Zp!#JUCM#cmSW35by7rli%u+s-%+^FLLl<pTj@{b=LKs;$aM^
z^+slkUA@`nc``@IZ7kcmR@-f#eNpIKme76LwF7<m=V-p%RFHelNzy{r!RK<Q_H)+>
zJ{3wj=`77R_s~#cd=-e-N8mv!90hpe8XflTQ=hUz=CiX|MQv6<5L_9=Q7YaLqm?sS
zX-c^l+d_#}VUxlHFE6dvGW%)&c?gfvgsK4G&JNy(UX8B6+r{CnCfv$JTw@NUzEWN^
zQIA(YWiW3W9cQPeyN7u`kUeuLf#L=VQ65Ctx)BddRZD@(r8U8=J_MAK4;She>Td!?
zEer3vFP<8c+YTRl<f6pJ9-Tn32Sp7+_XlmiUcW8lb#+D*Y^%!PZ;HWfcK@V_k_Ls(
zbu`PS+V1E@??0cH^~AlK|4yBQ{wW>=KFk|Q^<RaEEN~)lMej-r+Jt>!0m_j-0XQq&
z{?H?PekiPvJJ0mi<)!R%{AD%1hNm7MKOMg`g&z*dvAZ4qOtQ<w=HTO@?RHkTW7M^>
zGY)SnylHgZlydj5ur}bN)C(Mr)3Q-V-9P7JaeMGs3e7A~R0R?E?CHa_bW}Dy#!c8K
zL7)%Qi~+<D;_pA=f#SsvNQ>t=%HI2OR!p4j?yfJVX#>n2{QXR1Kj-iHC;r|>`$0nP
zl@9Ny|KVxb%-fC<nak1V639_qmSX@?*dQCW?P}Pht(~y{*<vUgg@x;`;JN1v@s*%z
zY?%TT?P@tGLw5r`A4ar1UafP6C*gM8@VrV%&@r~vnCBNA#o*T*5{jZqUN!hQ?t3WD
zEx$9j2xNYesCSh(#rzfdcz74W!Hv~d-UB~%?|Jmxry%hW0y^8T4Y$xIhpR7Qa_~I-
z`Q~&80;hkc72osr+{q9}j)*1#kLkxto|dXFy1a9YB+|TP<`krxA0C;cOyl&><-0x}
zlDp2OG(`@3t8$1auiobC?+0ykew}#WaCLlQj;#UhnVC9&ygY$t${<Rb*{2?hD>gpf
zC#CB&LVP?j3XShedL{!3BFfkEQ9(Y++4_#EZlecrAI&9{)Z|{8G&tT|)AJ4U&)mt2
zarKvb;J-qfuyn5+8u7UQc2G5~D<>(G%3`@=1LfKJP(7GGVTGeKM}ad_X8w5To070m
zVS$u=-4C4m1RmZvftPA@_M&n@0f3j`1ghsAEE}0uVJ>D-R&cWLy=@Q%9?3|@u>7pU
zBpl~pFE?a$m#e~OPta7XB`A}Lpfy|K9MJU37$%D^0N7~j2Fhb``i-x$4BR2KzCGK>
zcOc@cr;Fea^$?SE=LBC=tb1A>KfP{e4@+p}?m5&`QU`~xDqeMreMr5t<?&T~QN@J5
z`S1=UH3@kWkwBrh`W1IBQ)b%aWv29fHSp$)`Jh<*1}N@VP%em=pdb{MkMbn!Nneyt
ziRTE(HZUKE=<hzEiTRX^d}{n)(8S#I!+4?1(-FP}1kR4AgeFoWs4}|9dxCUvB^BeU
zVT(%)JWl9@;~JLisos*t+}1Dg)p~oAO*Xo9jrUDOTi#4!_Z0}Bzs&<Tec-E$4@NmJ
zlV^Hs#vINh1SFgk!-+PV4`dZ#y!~9G)9zdwE$@|>HyUeVIGbrzHbyvJ)vxO|COl(4
zI8_G)7srm?{t|P>53$iXI)?8t(b2i2xtv>+#~L0UV4wcgS*W)@X60Qr-Kj5z!S0qy
zDksSbr%OmiDk@l<HVD6H#kC<8Ine-9!myG)`NmRLLtoG%e`8=^Afl5X=-+HQy<@~P
z$6fXA$Z)#az5rw77)S?Z>^yxvSEUrRNr%_#1s^S5?yxfO18_nHg0luaD24GFZNOf8
zTgq;v)iFfHG<YWL?)*ow#`iZO0xU16$one5mpIXIH1Q%9=R-aT@=awy7^3l;C3EqV
zCeg5l2f3W>Z^L<W9F9A-pU91Po~g1Ycx+C{@Z-mkPWeh1vdklw*o%=N&s&L?u7i?Z
z&U9=}$3#BC@tAFUu0><!I1O!X<rogCXzaXg?9|X%_{I%q>$!a_!1DUH`8N0&A-c(j
z5du_!WoqZQnXhF`J~|gY@t|#@{oSarq%D_?6Q6IN?+1?b-kz@EAlICjIhXo#tf)A&
z4*|jjC#N3l7^6VdPhOG@i1se~qS_52pOTXBn1mn&*6a_u8JepZx>;Wrn|DvWjfmr&
zER}%HL~SU4NtO->FtHx>3cw!&4Eh-zTFI>Jx$E6V_vg{;-cAqJ51#Pua4=2-{rfC`
z(sn))e7X>G*1|q`W!>c^*OI{Vl^l(FXip`7ubI*sAGoTF@dApkbJrmY>xu%jxkDb9
z-?`6Yjc(<{UoQXrkij{|Sfzv|zJ*)+a?dKZuVqxN5{>gwlIP#)qQh`SP~C?bM?lZw
zaG@(0&N}zqnxUb>)9#jrqZn@QfQF5{(hfeYUUcKj*a)iU21s1xE1XnqdT}NpAzGq`
z>3P|8%N=wVWg3>uRBwAeXDZpzNIm3dk^JSX-XY_OC(Ai6@s4zRCTEbvIDBpz=dNXh
zD8|z8;QI!ktbMZiN75VoS)S!2pGWoTO`^JxJpAo-rf<kOFF7d%-Gsd)<T0qPV2lyI
z!CzFhjy!jmcB7jT-rhoqsbrPH1TCkm_df?YiGkYNGpB^@Jv*|vLDW-2JbP+adH*lL
zx__%a@xSRimd#K96(j#g4IBT8=V*>;6+ctsqS^J~VrgzknL+I9D+8?RPIH{kO!c4o
z*yV&pBzS3rdzXwL1AL7+8pO|ZCS?k3gG_-HlxPJpG<djX`>J`-awI)GFt&mzcEIc|
zVVGFiJE7&bKyEdP@(X{J&5#to4hJxSn*F_=z@P{6wNc3p)DubgMk7D6Eee{8fX0y4
zZTi%7faY78AwZLk)VwihYH9@ANF1Z`GPF=b_<<E?1y20D^_HHbiZMoDCj21<82Lzi
zVQztoYZX!;LBb;_%X@fzohY@a0?xtUGkFVtc@BZQpH+}VJnsfz*&W~d)7VIh2eJ_J
z>xS~6;n{ppf}kD@lcE7^l3>_CYa0V4LQp?-$W1>nL$yFjk!y+JJe#nI{~BlmV(}!%
zd^rp--}PvsjhI9~I>L>bc>Z_&ZNj?5?a5>^Hy{j4FGC~rehflyO#D2-RRYjmDeGvm
z^Q;rVb6)~?!u1s*c4<fL&-43nm>(hBF)T2h9^0~g;u~*Tkgd0dY5gNz5S>buYpcj`
zkQ-(bcA0=(TEZj8eZjfS6auv3v%oC8)rG@1N-6tVgN1nTyMbbVHO^W=rEeW<(LtZI
z|MD0d|7iH9`Bv7y2&wkDy$Or|)}yal#3n2$>Fy>>cr1Xl-vqw?bc^)wp)tcll*kj#
z4~G%qQct4-Yv9E0zDowa2ji8$0*W@9Yk+b6*lzR=iR;V0E8ZDvGvk0?u=u(@7B@~y
z(BC6K-^#8RDHPonXlko^!h2{&R*{NAF_O_BBWbt?M-{<vVQY4dpcM)Zmh;sbl_Emy
z?%$(NO`E`e<1+YP+UU)iB}1Ru!RS%3-zXya3Hst#@e^tNven?zH_b}&$+pz1)cl`W
z69nLwoci(ATl@?{4ZqM*?Vb#8F=}_;@&%%zL{UZjnA8$o?VE)k*%B;fu*4_CUtTRm
zKIVD{EQZdv(K^pL9m!$&c}{Mjgw|W%D7Zxl2Urp@!_8+C_DUbDwgRFDdpdNjVKlQ-
znEF_QDzlos2g=~}B5#n9>oLSwzF)FsBNGeH@EG+C7$jh}TKKwv)Q?L6cAYUbed4EG
z2cJ14_Y)0)$;gVr08HtxyfaqyzgVHkPWLGxN`i>Vs~~C<dxR>p#>x4VC?^qH{+bF_
zEri4RMK<5Jv5sTuP>obJd=zGPCM8{FE#~y%MCi7se$0M`ZjPK;+DtH^eK6S3ouZwb
zUnhE1_;)4L)I6kO)2kxi&x~5koEy7I`W&5LD)#wY0}Q03e)rEPb@s1*#}Qt`V4iKt
zU!945l(hLYu;`D8B?oRu&l6CU-UmE84kfe9Z-*trj_#1~mYdDxh3upP_cw_v!Exl+
zCJ~Yf!&(CDUp?l3q`%F!Kcy`DSIEo%xIQqrlGRw~_-Z&YO=PXyFbDo|!-+bcNwlIo
zhrcJT6D0K(yq}mLp3N50P~uVV(<i7Oh8cvZ3xUh~*Ds&79JZ7rDTu_ARD6%3NtN7f
z8WYycw-3VpEQ;h`8wd1@s`USH%k^*YpZ!~Dl-1;6A$U_lIgtJM4Q<uH7}Sfxne}zx
zb$x*9!xj#|L-wf>S#WZZ{HH%*^Riqk-;0Y&BK(e@+gmbV)=ZugaD6um?g-meHKVN~
z&j`Wx(D=i?z|xEt(}C?M1ccU_18oA$0RjvTI&Z?7rxCbZ;2q6OS|W@><OA8zy2UAY
zrv)cD1F8XNpekd;)EJ0)AZnRz!WQ46i9aBSqElqDcM|ZmiXo}S7wA@u)gaL%d=G>-
zY+WZ35L9*}EIB8I%FjY&DBXl11Vw;X^&D_N$92$94BL>+X=GVAnbVz$Qqlv;ZyW}=
zb%1&pTmz<<1GP4Q_&t0KFmz3L!XQJBKlivZd$Cs+`jbG7!BmpDH>e_9=f?K|6lLX@
zK03|C{x!ibGrl;l^nq}pQC@RIO#Ms$cjH$G(Wl^_CH~d^fZz1@%j${$R&M{_w!8l)
z^TkYnfN|zcn20|#i)@FMk7RCS{_eBav>Ta!>*b)qDu_{fuywn$MusDnlP+MUbFguG
zy&_ZtEH@<*1t27!{m%F!GX7sDhW~pB<PpE9!SJ0qf1R-IPe+g6G2(yEoMS3N#I>4X
zMqhdisHgTrj9QBKjgMyi#i2|wyPjKoD54Yh+X1`jIfdX*kt81@$|TE$sT}c6Xs9uD
zn))F=cDtjAj~J70Ifh#6^kEM9SQcJnJQq!}R{cua=Y5DJgi4p70dg3_+4Ge!d0~0Q
z{`4F-?q3Sj_UF0sRxmLW-$JEN!`HVUk@v8Lt`)DzKM=}rFH5^^Zsw{B1Vw!+n?D`1
zt$F^@m+;U2DtMwBfd$xQxRjVv$m)2*nn4HCWrRcFL(M*}7>T;Gd#>@iM+MSOixI|F
z<0;_w?~IL7p(WlKMf%@z>8@S~QrQ-~sEuJ8Z0zdG$zK&W9LsfBY^%4>9ORw#I{)%f
z=4y*>dm%-ro>@w(D6F};lk4P_J6tDI)OZY4FK}Mk?a#!p4y}&SKsGGlPAM?&o69i7
zKr%gKg<$gzsKe%m)JU;=XI?Dr@^m??r6uVmb?A0@=+m;u&)WO#tU)<==jmHSkjiKq
zNa83%1Y-7z4X74^Mqar<7f5YO;vc0XRq_sa6O<I8(GO>|ABmr!i0N8%bH|sQH{z+M
zWqpZ$lu<wf%8MZHe;_cf4i``gRCZYUq6m8ux!bAxk>?2B8k*$~#T2y<pJcOa;P-LY
ztgC?^OBH@Dw#L2o#$WS*y#U&Y{D6{=nAnHRkEi$|f%V`NJUea#B}_@9?(miyeM{yf
z#D}{mAx2BHuaw<oKJ~=GJ`DHxg2wej`z6n@<-W15r@{DwL`~hK6TU2z=Y`nW;cyg3
zVb^#h!&#rg8b4PB>h!cw{_9pnFBg%8BgrftMn)H!Z?No(3N+{*e}Za87K_ZjZn!`}
zR|+Tbd+YYh3o;X&>9^G@Xt-Q|ptd1q#$r%kfmwB=l>I=J_SJk#q$3=E*Oyd-2{W~k
z)^SfWM=Nx8aT?i0xy5yhR&_|bh^lv^3TZZIfeteZz-C8~;naF87xY!-IkM9NC_(vp
z<W!UtiH~fu346H_w57l3tNmMV2GB1Ok^bq9j=v?Y{x^R2hmX=MkUiGz6d~%)Yj5K^
zS=Q+U^-S7+i@t$<-mijB7e#lhY&RO*L$hu+sz(%&EX9|Zm4eC+2!ikhqFL6tA)5r5
z0nF_e7DvBC<<s*>m8V~$!)J8vRa{*nwv!OZ(>Qd03eKhL&JX5i;o-h2!AqKtVuKvn
zOp4j%_aBgI-3a=M%;MC$&^{~U%)9)-s86g#@#V1=rpA0VA-NqEJgo1ck|Qqcgx@W9
z#6kBeIX;u!N3u`LSTLI2as6RFg(*{9ug(8jmU0d3^hiW^Yf_06If13FmBfvKmKipL
zwej__IEYCD=eE7q%t2Q6!U@?6rq$7A{Wg2cgf6fiwtkjug_R(Cl0?DnM4fuj8)1y+
zjzl=Pu;_m(n(->ED4|vrg?tD;9gLI~Q;oi%m`S^E3T{Y!hg`J7(t{kdOi3HZW@Z`4
zuZeObanvxDZh4r2D5XgxykObk?W!qE{b0d9_;@zufztiZm&MW(-Pf3q*IKt5Yk<3x
z9=d^*Opl*T$CK*16S=yC2(n2oOh()s{pQnBw?Gla$Yf6|W3MNL<E$ZX0Akq@83Pq-
zkY6&c8i45W@C6F9*gUpRxEfx_9pNkWs)zcqQmGKXvt-9e%>49XJ^yk-cgr;^`V$60
zip|Am0{qo)!$0crQh^{UfokFRR5*xfqYG%hy=!4gyFaU-y(r;KNIOSON#EDmT}O`J
zq2`(O`6KMb#@za}S8+sTlC0C}5Pg?Whmy`%w)%mGEj1fz1+8Av%_i33<Gb2S9z@tC
z-8JMZ2Gwe%VAL)Z=8lzgtiwX+22{&0_WG)YikPxA<IdtZlZc29OsosLUor`d30Oa+
zuqQI%15u*!4O%Zur0z|YXlrx?l|w%`d$(}jYb|--!^qBkaw-*uGTX~fWso9S`T{I5
zqQI@DAG?0DSORe`EvQWKZjAci=@v7#Az989Xm*0cLZ+iUp6{=<+}%De<Hj{0oLXOz
z@!r*KV#z1gvATiBy4z}-2Ga*5vhCE4-ygM*p(i;5)r44#BVuQr3HH?3X#hJi{7a4R
zJzJ*JfAtT|&v^0wji=dv+MNIJ>HEux<+vm9P++-<<YPpbhxT4O9j<vr($0$FFkH4I
z@WL2hr-{DYAZkD1QM0@Lt-`MX-~UlJvY+5)znuH`zkj`+e-?WD4;VT9He~&(UuH7p
z`ra)1wU=?#`&u)P!7l80dnCF^ATKNLsK+&i{HJ$W&g_~q=}wpoPa87(+Px7}Q8d_F
zd$dLLKuqEzH7iCG?9<LvD{pjd<z750#Anov%jssHN^Dxa?VGZ)xP5o`z-t%f8B(U5
zBZwcySa^uEIJZzG`w<q#rZGKMN3KZaSJ8|QV&*y`GB}OxL|^8r8MKyIk>88q;j3?m
zJ4nuCBO)Wnl#g6}MzF06a>L==ysSqu4c&x>c&DP+&4t&mH)kFiG5>G`F7{RsMmL}K
zZVL$~GRL3hY}!yQVX>0QymM(*j^l~Xm9w&+##)x*7}E`QT{&hsfegpuRa0q45NLQQ
zK@uT$5>bzJc>PUb{*T(Fe@;Zj_lw70vElrqyL4MB2`LfT;^-(4e^>6P_<IA{c*mZ-
z4~{XI@$O@%J9W!=$%S+s^${UBN#w{twL?WAk%MH1jiQR2cw9J_$%$tQeLlSB9nMOJ
z94@Om|5R#0P{Yc2;}WJ0NtD2ZeLz>~!Mr7qj$JbAQkwHESDgsa%O9GPat_nJrQC5<
zkw=g@Z1nJ@a|^!qWyX5UIjM*CscAoqki5*fE^yA;h%!XUs6C`fE~S)XZIW2YH24sI
z>LFhZ!q9Ud2E!^9%ik!JBv5U%4(K=R=lTpEDtR!U9&_!6><gMOsz3HBmZ@e0(KCZH
zdZN<r{qc_5>&DAL^ps@grH3M~m};LcFCd>OXiJgzn5`}r5~7}Fd*P8ISM|5gQB(A>
zCQ5b30`99W3FYl&E*E=q<o-4qlKjZ7BBBx<?v1a>{&+LAPJ!9l)w|tiI62srwI?et
z09ONg6V?>#dl9JRVn~Wa38ut(6jU?VgpnW1)gd+(fdk@m|1B7CiMk75Vh(ULK&!{$
z6rmDKAH!BD*SiNn^X-ITN<;(5j+;HRdiTd5L8>9bCTaZ~8M!J$EZBr;tuRnCX4WrJ
zVxS2z0@Twz+DZ}W0PdN;X{!Af2ol=w4(mUs@cwIS|HqGt@--^gaCOqg-V;bNPd`Lx
zM&Mk?M*t$HT@BopBTF`60?90AUi`7gFja7(q<VCwPO7h9_luz6^My~$iyvN4QBB1C
zFm%v*dWI=TgLDY%{QEvKyoTASOw$i1+b<G~?s(Dcdo)>D7)`%-ch`-R$t=}a2477|
z4%Q9CfT6gEH2C-$H+(nF?#Zj3uea9j9k7pf9V-kHisQ1%b5rlHE8JILLvO>D*Dwcy
zWZmv0ZlgRy@qUFED+Nt`_)v*uuO7c!T97nnk)6EBGk74-z4sJDvgm968G=1d;jk*<
z;k}F$7_)j0jLvQ4!2;0?Vt~GQv_W`l7l6<|Oq<>9`2@b(AtB_Rr}`1w)czJv#lzyN
z7xsJY+pWdG!b#*OxdY1SR_-KUCDM;d1wiyatmtT8ARu~2V^*gJU0hs7f=A^C{6E@w
zxk)+j!+6Eb{L|LB|G+X#_EYKeNIt&DC~+XhED1(7%<b5nl!MfGZD!e{8oy0``<Wx`
z4!v!6?}r)2UjGQ99FT3pRY?(o48$e;)Hz~0e%>eN1hdUYi6QR<divtWbK?V%jWzW(
z1MbGy-z|H}Z$<=L78PrS{>Wp0<w#5TeM8J7V)gW!l5%h~X7&yCohzt9gee&j8Y6i3
z@(o`QZLYbyYn-jiACW2gH!24IJ;%^L<9oz+EX04%$yYDcUqGcVBY3U8B7Q*~CW_SF
z;)+j$Z2K;+D+I=CBObfji1!2!sr7k9`1Y=1dixI3u0I6liU{y>EGu|lq;A51v|ii`
z$Aj4JzT?yoJqBoa1^`*lV!pl#gHdg<xF%2x)Sj|CaSwp;0h9tcM1w4kSOr+k=k3)=
zYa5#&spI{b4Mz~h_1KMg1DfLn;KZ~b!~%$E0Lk^+HetK<C@F|99{4m06$=tTDo_&~
zl36Crr~*kOb?DPqoF0h+fmFyIPz~@IIJ9o;RRSk61Yi&AyRokl{=5VBTuzz|0wID$
z#7>ejwat=+STl;<<9++W=W?aB$P-)!gGDvr;qr6wS7Q23;8M3wguvEDv7WF0?Wl8>
W&GzqTyuYSMeE;l!bo9|~_WmDMv&T~a

literal 0
HcmV?d00001

diff --git a/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug3.png b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug3.png
new file mode 100644
index 0000000000000000000000000000000000000000..002700df0f01f8efc7ca23576734ea725835e2c1
GIT binary patch
literal 371170
zcmeFZ2Urx_vMAickb~rm3<wB{h>`_iP$Y?ffPjE7l0k9?g&74UNl;Kwkf4Bwh$A^O
zWJDxO7KxI>jHCgEnb)|}IeXu8zx%)cz4QKe|J|^rtE<<lRaGlht*&m;FliECx~!qC
z0YD%CpauQ`q$xmEJ<!<!0CaVMlK=ov1CR)3fE<LtEC3If0Dvr$>^BUpO(yg=m^|h1
zCTW_nM_Ww|an(>?L;H&QPtuI_)}EfOWK00y=I-llsCiM~x|z8E)f`Cu2v|fG5VyAV
z@w{;L>XkzZznu@^KaTCepBw=F5{I<@!2g#ZW;=TyTTq0nU~U^bA6qvNE&%}Y7q*_>
zz5qaZh!+a*^*n^Z1h9F741#dvA?)}I{NfO{`33&)GtV_cH84*zs3dx8Yi~yYIMM^+
z1^jItK^jM}AbiH%&e<IR7zIFB#m&vb4uo%luo#%f6NC@xE7<%49mjuwt*vc-r)h2N
z_&fZIEMQ5n;!Dmxp03tGKQI1Q{<yjNf%^J+90z~toxHUS!804Ew_z6#okN%&gjd{c
z^z=cP1%&a=pme{$WVB9xTE-v@<|pH`^-%+L32=b$89VDsIv~sk!W!<bdWY?Oh_`WY
z*3brFCJ+vE_SL=y!dxI6Y44+M^lP3>Zx6#?>mn<2@K(F<EB>RkHwgVw*Ec^G<3s!*
z{U1*D+P~6=9=Yvw%@oAb0svIl-`PYDgu$K%J?-OSbjT0L1N8iDC$&TT&ph6KhKKwM
zgLp%Gcg>3+49WuacktFYl>IP&w3`nI{gfS=>Ex_^SQgX+w8+=#8aR>;^#g6Twf@OJ
zC=0a5-u=R_I)VDz`&>Wd4a`qgW@mp%9fU#Ip$qoz#)tAA(!qQBUOcP|EK5%7>H2eQ
zfOzs__O6<T_+ua}<Ku7iYguv=U+-&&c#uzW2T$LthdKoLB)@&j`tnr}2Kga>1Y7~s
zfJ=Y?;0Gofzyr7iICrg-uYgy-+|dB60dK$&um>c5#r#&n^yeLS@Ye{q4Xgt0U>={}
z%U%3=*B<Z(@dv+Se<>>gIQ+cp|FeV(FbCG)2Iv5;;I$tJ+k<6(tIY(M1u@RQU;kFS
zHAvGI<kuBUhxh+u{BPJla$W%Cz4B{Wzu#&UVEnB-r8?y$N-ata$`j-~<SOJ!<X6C7
zRWM1BE0CZ2O^!eEQ_NBHQcP0}P)t&cAe=+J|D+>bU=oz*7aiJz`uzu8kRJzW%939s
zR|ctrl*u{Bc>oD=8L*xU<Z!TNSrDuCtAvMI`K?9%QKsJ|0RCu=U-QwNp&_H;q*0|2
z`*X=7Cy&VfCht#O|Dz^<;nn7MegDS6U+e$ljx%5f@~QKCYy8RqG!j}2ZG$#I+o3hk
zazFrzfmT32Lu(J=U+dTS*}9Iu*Jk*W9~ZD)oPW>ro4miZ_+kI>Ig@{8@eJV?D!%rC
zzF>a_)I2<cyqz7Ld<8CmD}ud%w!7`=Qvy<Fq@)1gaD6$<0{|NaKi3Ti$LBwAVG{tL
zj3JRo)qmhFV*sE~9vuFaf8fLv0Dzee06tdQ`g!~RLXZ6LL;=ncjNnM)2KWIXKn#>e
z3XlVo098O8xD4n6*8nrX3hb{=U_bW;0)SxP9uN*Z1ReoTffOJE$O7H~1wau{4%7e*
zKr7Gz^Z*0E7}$Hh1Iqvw*ar3?5C|270m2I5hQJ^q5OIhUL;<1#QHNZC7(&b-HzAG?
zcZeS(7!n3~2uXmXKwd)fAcc@hNCTuD(hC`ZOhFbQKOlQ#P%?TlHnO8+$H^qg6v!@+
z>5yF`vm|pQ^CG)VcAqSc>>1fBvUg-<WDR5;WCLWAWXoh*Pyk8?<$wx8C7=pWHK;z+
z9O?k|h9aTS&?M+9=zC}t*v|dXN$3i6mz<KEm0W;a0_?$B<i_N-<X+@R@)+_I@;BsV
z<jv&$<WuBWav}u-1s{btg(8JE#dQitiU5jmiX@8H6r~g`;8^-ju}w)y$w4VfDG!cC
zGs;_(cPL{h(<srD^_0DoGn89YR8-tl;#A61`c&3bzEt5<&#B%~VW|43zEk0;>8N4U
zQq&sM=G5-gq0~v#Z>j63`>5xs_i31DL}(Og^l9v9f@tDtvT3Slx@o@C?9(#Siqb06
zUZcH5dyn=R?R(l5+OM=5baZsb=+4m@&^goHrF%yAf$k&S6x}X83;juYHToO$e)Mtl
zx%Bn)BlH^#3=GE^R2j?}d>P^x@)(*JzA@mBupT*mMEi){5!8{?BV|YWj;t}#Fp4l<
zV6<Yq&6vbk%-GGi!bHP#oJozznhD92%2dfT#I(iC%6yhtpV^H$hWRaXJM#hy70YoJ
zbrw68`z%>3O)N94P*x#UHC9{JFxG6=7S``<lx(7G+HAMj9<mj%b+KXDS=eRRP1pn3
zQ`u|TCpn-T$2qh)Tsh)7iZ}*2_BfAnUf{InjN*LH*~huV#mlA2WzQAOh2|RI+T#}B
zR_Au%e#~9YJ<dbUbCSn^Cx9oNr-f&QmyK76*OoV$w}^L?kBsjmpCR8JzAV1ad|OBP
zk7^$EJo@}-)6o@v4t`bsTl`P>>-ZO8tS}XrGwcZr16vYc7q}qcD)3C8SpX}@C#WUp
zC-_pZOK|^~=rQACp~uk2#)W8w6oedvo(MGxVTEDBy28Q2`NE?jG$INjP9n)7Z6Z6z
zMUR^vk2qd_d_j~;R9p16XujxIF$OWXn3vcqu`eemPbi#lIgxgv=Oo!l*^^EuQ%`n_
zlZnfTJBz1@_nx9Sb?%h=saL0lB<LkBNcc<SOH7^SIDO@G=;`v)Ym&l}=8}&k+a!r+
zWY4&s$v!i7mgVf_v!Q3J&i;@(DP=2_D)mL0L0Ur^C0!wnlM$D(mr0iymSvUIm5q>X
zls%A>m-Ci;FSjT!EPqq}h5V2Lo5EFv7=@4LD9&9xhdNhtZdXxG(O0oZaa~D5$wld{
z(!zPs^Y-Vn&(A0yQ?^!qsXVD7pmI|sQ)Ln^2)Bm6f={aosoJT&R-M0a;=-*9?=Gxe
zJaf_eV(G;lHAS@$wfalYOPZIWFLkN2s2i)NsDINqrs1fOuYuK+)x4uwuSKDyqxD#8
zNc*U^t#+O^_Okrtkju?F^g2d5DLT_vPG0f8Ql(3#ds#P8_p6?Wp1WSTKA^9ypQt~6
zRrIRY)oKGugR2Iq26KjI4TBBaj985jMsJO_uU)(re{IZI%-GMk(S*_DhDn~uj_D=S
z1k=gulGj77cbM^*Ih$3OQ<<BXzc$~pP`7w$@%@JEjqn?TmZFw{mhDzNR<2gH2u6f8
zqWC7oP1BoiZxXEatzTJh*=XCmu)*4@*(TdA+o{?;v0JoPwokC1cTjdna9D6uc1(0!
zbb>o2IjuOWIj1<|ZfV`hxV7V=?~?06ay4~DyHUH{bgOh{ad&ZV_Tcvj^yu{z_YC)(
z^iuSC>V@^z@qX<C@v-!&@MQxH`Oki0eh>Vn{8ju@{qX@N0mXsLf$o8ygH8rT1<l{q
zxSex{{EqFN#$dtVd%;s77eZblAxIl!BT5K$ANBpN=G`~<Xz#h)>kK^;nh?4fW*Sy?
z|LFa@_h%kxKFAM067C&76rmK65lJ5D9N85m9rZkl7;P8*>EW4&Ne>AzwlSY#&&EEB
zCB-?!b;ZlYr$3^6<o;;zG5qnH1m=X>2{VbhiDgd&o<u*{e2RG5o+Oi$kxZNHmpu9G
z%Cm~+!p|Q)C!{!~45VI6MZe&C5%ppx%`UAkT{ZoE#?g$28GD(|nZqwNUzWW({wgVp
zGRr?}F54u#Ek_|I?={cshp!KE-E$}37`|!Flh4b0%l9@upDf=mfAQUocRdA{3M$@9
zynl)2KtKEdeDM3QRCu#+ut=w<u~?z_eThiPi&ECo=rTxIP#Lz|seH1+tfIH_a%E$c
zQdMd7>FV4X!J5=s_S*P5+PeF7B+PBhR=sEaN`qs=Oe3Oktm%5wmu7?Jt`?n^kF6T5
zO>Gz2Fdvma*0d|OSAJ6XRNf)iQTAE(b7`k+XK9yQS6R1wcSX;+o~qvSy>)%?zJ~rw
z{jFcLzjO@f4fGBg4-OCA7@8cm8(tW39l?$IkM57%{YvpQdYoxI=^Nj-R}&{D(35hL
zwNsa-K2IA>kImT5EYJGP629M`W0*^tht20LNG;SXYAp6FSuA~D_FUdy314MieX%CC
zR<f?T{uz56`yJ<vBmIck;NHmHl-X?Dy1Mmk+iiP)CmPR<f3vHw+qP%AH@_c1pdvgw
zIB`%#)FFN)xsgbo*51}XZ2>6wOXdLj%0F@efWZs^SbISG!QvPH?`ICkFFq>>Lw-$%
z=s&@~_=tx$KpO&h58CerE1-2V1OOkh0pK`DpYa9&Tx9@&Yv%wmY3bk7&my2t{nM{J
zyr2Yqh)lx+8#kL@Z~fEh7oQVE{l@p7&!9BY(lUo-{^?Ar2bihJQ)q3VkYfNDGX%;E
zAvFUqP!0;vNCA)EYJreJ$tftQsA*{Fzzn5K02u@dB_oGYP>_RG6C?z@50Eocun3;L
zK*?%gO?AwRP3qp`m()TR3me!Cd$GdOHr}B$v>cpV+&m)3Ma52>l#!K_S2(Arc1c}B
zQ%n1@(KTZeQ_wuKwX=6{baKAs<Ll=i5Eyhj?EZuBh{&kugv2LLlail3PkEJ<o%1^P
zP2St0;*!#`@`}o;#-`?$*0zuBpZfa03=9qpkBm-D&&+<Gn_pO5!u{CT+}hs3@9rJS
z1p%PHi1oW<f0BzCl#7g<97;}gC>Mk*08CJ3atgt-lq?qvsI0wMk4fF5X1n<KWnlx2
zkhCF|-Nw6@mP1%(N(6T(+E2;;Yl4OTPf7N>V1LLp2D%nxKMyDw8I%GFg;G#bfCnWt
zXn9dmQqxlZJZOJC=zktZ4iCoP4-!ZO0@5HSC#M4cndoTfnEoFhq;YV&D3>$}&_f|$
zXM!>VaNvOODq0NqJN;L6a8Z>!@va!e37tTcL=I2T5jmC|8><3STaaQl%rfILLGg3^
z4~6btbR43r2|91N9~6B3(O0}<Q<Z*GEeE2?k5zbRiBawD$6Vqr``cGLw^`=md(Fi+
zTHuc8G1IFsr<#LI5>RZX@cHWE*^gm3scRnC?(JQy=f);1O3^eX<@Dnv6O;pEyb)iT
zF5C|DobLHH{L&kAHyvV(by~l1EYf#k)MaYCD~hf{e>GOxcks%%l+aDB8#@#A=<*sy
z9JGN1u*ir7Yfly!9yQg^$bR&}6?RdH+2Ewxt=8=4!@cV46clU*s{dz`u}jC8vdZ|{
z`h46db*s7d^<!c?4g$15v3ek9H2fA~WTT;v%Z~)`E%qvOT{=Cad=9?EzI-oi8+VZC
zE@}~2gMtJoaF^5?WaQn2nB;X7p6{sK8fTwHvfy{Hj%|XP4+yrezny<J8txaZ(fvxh
zH2%9)**h*uqensH0eQ{^t<Opf)CC{>AJ@bGx^{q(dj1~j|LHUr>eY^>$CbAs7y~^F
zRCuumC3S*BsSip^XT?!vgqa`j3Dx4wHuEc3tT!q-^^VBgXP0R~T_4@y9Yyi)f>R`5
zl(+49^^ji&igFmPqF#fvs}A8S_6%8;+L)ZbD{;9z26^ljgXeC84t|O}zV^qe$E_Xv
zM>iLpBU?37OIXwDZcA1c$J(Ckn9N?C>mvc7A@|gS@3>$i8v7|#$nZ~t=-+72mwSD^
z`)!6UrQaofRCMYir#yqlOxp3YNp?o;z0e*q)7-*W=as?>UUPDCp6=6Q*pm+=0kieE
z{s`QOlIjA~B#~-h(=;(y8Q(SqkF<EVdi0&FR*^_i#jd@f;>>H!I`Ki5dE7{dtE{Fb
zGZpvgnAI$EcA-uxU-sP*T>gw?Gb{$h;&_k>cO2==8iO2Q-oI@2_bR6p`-<W|dU<0p
z-D}fy)d**$AC^HLtUkSbyfwR*PDemxXY_PrxSYY)tTP^sg%~?@SP}`KL9!0>Zn6f(
zTfs(oayq<!=)yl!>MN-(D0kYDC(POFnA-YGB38PwLz8kToK5~0m(8DRR}Gv7?&OWv
z?Vk2lwM{JHGwm6m`+9+wJVD(=86v=HWa90%^hsNS$-qGSJkw0qV<TmGCh6TTne&e?
zcY8hYlaSUMbam*Lb#YpkIL(&*=+n#IFI)7vp$tgR;425|;C!vHEDz_!I8Y@iUGtE?
zjvX!BSN<%X(9PoeX``Ocf5~O@wb{%2?#~C$+$n_a_FVF5y*4%Dd0~xO)-yG(mgb4k
z`Q*unRs>zJFP0%bF8K7miFMK3IA(B6ujahFVkou37GIqBQ2vI?rT(mg6qM^z>~_k8
zJ=V0v$u3Qh1SI+Ih31KRsM05#238o53B86Vl;x=FrqtO??EkGZGP|0=fN$rq5wxtu
zn*u>AoljGo@!slzN$7nof^`4f9ZR`6H-~8z9wi0gNApY9pm?6mAB0rSXcFL`bK<sy
ziie%G1-o8Gn{a&atGb);lC_K%=+N_*dbhnC<Q^~YRGF+L?_Va!SEsp^MpX68BH66Q
zs_gdc)gbtxT%#}_t@j=`Cvq|-Qypb|t|<A>BOY(EvnOURSDmhPKfP(O;9(=A^wJZ*
zH<LSKKCtoh#3zQ<%b(W`buB5_Oh3U(bKB@h!2NXU(q4i<_;Rb2#Is@NGoq)3T`80K
zqbiWWhA|fYs^d>T$H$R?(vbM3ac{|R1cPrGF20#}Jwco<xX2=joAI2LDl|drh|<vG
z1xyjDl`$qjd^&#Ar7a-zT%B*vW->?5#oV+61@emR^YP|8@gwou9{os~z>uw2zt)18
zG|!;DvK&FF%Ntq&isI!;YRC}X5F_)dXhpSkL5=;4^LYJj!-I_T?Cy`8(rF9nD@5iQ
zl%xY}>>Xx_#tTC*8Y1Vos@rR9T!O82D8&<jnI$%!O<HkLxxHk&;G7x6FnT)(mr_Fl
zu(9tSzR9S(^ZL{FMr(*EIcPuBxy+}oM<7ZiSIWhgGZ_39>qG)iLaQu=uJW$i#CTuv
ze$U;d{6SfKvn#sPY-LNNfu8{@x*dUqwT)A3!RbB@R>i*N*wKG6Jw2+o)D)_!%nOxW
zm)#xOze?aAQsG{1+RnuvWiA=o^k-Q%IYTI1;s`px+4FJGCE0|~EF+u<C-Dzo5w2q?
zV`s)8P3B7<BE-jq`4pLl!}bgm@_jUKK3wQldlfBytT9?FlkC4iVkGtcy}JJE)%6EF
z*6LhhJ&`tjx_<uJ7cTRWT%S`f9Qng){q6BQ&r+~WefaDZd#j>cs&lUKaQwrW31)m-
z^Ex(pDyGiz+u1iubZJS2GpAlg;AY|!VYfFBe8HFT2Kz$JOiqf*S@^`Zl=@~llTQw{
zm5(t|xP-h6L+LK*uH(3f=uOOs(4^0DvR5hz;9j0pCwBxlC=4t2^OuadX5%Jrf5|A?
zS($-{6S`w2IE57_nmw4~Rm>cBlRk-lw~pk$9{^VcW;1fSq!oQ9u?q6H!~+JilYSsA
zliGt`aNS~gQd@wC0+-nQa<ot93X+95h$y-Ex)|rt(npZ*IeiAVuy_7h<=JvUdtU)2
z&8wXiw;ig}#ECQ``|{@b`UQ*SDdU8i4j;cDY3Ym`?gFr!kRkQptb)@i{PD+@f<@k<
z8Wc%@;|ZM4)IRSjB@w<Az)_w^skX%F$^Bl)5FfB_LF~FUI?;q?*T%^=aXfeSt<^0@
zP)9h8Z}j-mj;K7{(^jXgsaoRi^i?6lq8`?969={#-{FmCv8d)Wrnx(2$scRN1NS1V
z=w53`NvSS}wcH^Ajgrwkam7J?lZ;0*i*Y82P0;#^7*Aonwh7pb75BaovO6WK1J;HP
z<?1^hGL^NR$H5%AMSW~HJNnuUcaaPH2Z}ESw1S=OaZOWJvHPlc9?1{*+$L{V%zf`A
zoNZTB{p^eY`pXu&=#$rn)_ybp6APR7)3M3wsM$NR{k}ng(RxqPZo63JSCIf2qXSIZ
z+NnAgC-2$oOW&mWGppSF-yv;Yl)E|(*5T_5`wCs<9|j^-l~%0aPlI{)5e+^##I|iQ
z{^=As>n(o1^ltO$vt5Jbk9j=34q6y?O@|QFH9pw{ZM++3vvE81MHQ6tYK<v-F3DA>
z>{8YlF<-ovQT*oJ^r%ZGf9$zD7tTs-=YwRzsSXcL{7fsqRI=uvjM;mJoR`l8^~E^V
zjU5=iQ0!_hBdm$tb;kz@rr0+9FI(Hr?vK+YWjCs>U9oOg_DQcBpo)S!dW7?f4Nh2L
z3KPVmGJ^BzQ-z)uC)~KXwH_)y?3*U4*Hf|}lXje<tfb8HaceD`={OF-eiQdht2Z-k
zEk##2God)fd|-SzZ`Quj&)oRN-2T?><!Tl3ni9mr38r9MSZs~e9=#PT-Ra#bp<9Bi
zv4y>{5c){UtNr{?526?z?YGVvNbB|fM(u7tTBIy|vFl1<Ca?GH1nDn(Lpn2vyAwxh
z0`iY~TrW=G9RjpPs&|o2e8Ds1{NjBz%2VT<jVV`n`0w2+^Ea8H;X!8aB`)hkD&$f{
zb<Bk4aH9O%v!9$ZPD>fsP?-wtc-#MeNqc8--D1^mHrRGX+y|#NBUd>|0=V!=`bQRd
zWSDD9RGgxOy|W}D1XwPNXXxKrhdVH`xZJ+aFO2OZX6}`SM|eg#`_2~nh1B0|d&8@F
zwAd<tW+Jo>ijNIUNsg4T^tei~F&UB|buWhH0y&a>2(Q+F<innRR3#ej#xXd2w5?i+
z|6N;Umh|+yqc`%b1vxvNM0my3+olulluN2iMRdGvV_voBTeqmLUMZLjKDQs(T6R0P
zAp|+HjTjAVZLo!gKQ<dW(Wao>f()x)6+ZiMhW--`|NUsfGJe-nMUps(qOW6izI4L^
zFXuP3#X3r3O?mxZ+s>2I%3b1{4j7d@YzzOF0Bg{C6ZyCKl7Wcki5LUC`8J#yuQ#;s
z(!v?G<KLc82(5QM+ofEQkKrZ?cTVcE@G`JS`%E)9x75anw|^sesB|nZTZzAOsbe^J
zqH^>`uo`YQV-zVdNFyLN;pgW$X+vE->6KW|y=OXTALPfw#sTN$w;O-SIOpQOukN?D
zxfWCr{o}<!tf>2XIe~>h0_Zb2SOV9#<8Z1@ulQZYWM0uJn7$uulZboX<?_j5yB#l)
z^9>V@qz+`+X&p+M5VKSq7Is@Kvq4wf85F&TaYVt8{X0n+>?GjUo#!w6zN;Wpry|D_
z#Dw6UpD8I<{J7eQr}&}|7_sOug5+c@|50e8xn*5q?pTbl9PXVHoC0vDlvWXFwox7}
z-ZANouV!CJ3V#;NCiu>z_FF*)E2>F{*v~4MG`5ZUGIg)W@Z9m;fjgA^*XQ{Mx)H=-
zE8aqDTinhhF@K8Me%Jg?B*mu}JD*zbGqz$h-{x#RNXm7Vh|40oG1iqM9H&nIF87VV
z7W=GWi-L;N0wGoNTHd%>1`FP&kpwUz1x7M>iJy^YER^2F&6S0FNHL6GKJTh+c$+UV
zdTSyA!@c(2F9WZN6ftMuZ7#eic#i37+})STUCMecO~@0-)~n7{#ld<9DQL_TB`)^0
zJ(C6OWY;>?ae4K6NZZjfcW^1)_#hmo?m_ORrRG$5vjrnw19>v=5&@?$ydR<c65br6
z`I$;jIe*!6_xpJ}WBTrIai37`{ODE9DwNRYbe3xw$_y~~c*65NcEpRMtEk4I1B@TH
z?Af_R4E^RaLoTgdlOI!Q_p_9-XYr=}B!HYKaBJ_Yd>u6oy;h??wf*BY!=Tg9Ju&5t
zR()jY2E2iWvk6r$-&)JD{ynw1Y|n2K@_{Cf;xQNcO}F{(3ewDo%G~#)dsRWo9ogBz
zH>+7zvbNmK`{-7yv%TkOGH(RNH?!=TBuzR(Pc^>)sJyk&Y*>#~`6)?um+d`@fd^er
zc0O~AYFBD&6DZ;4;|DKmpzlCWw_eviQ!HuklU+p|iz>_NQssHy_PM&?go$a#))1e@
z6#o1vhn`aeX#wZ=*SENgcYR_Gx~Dora_MKe-GzW<8(3|SkBT4vrKi(hkVDcvKXCX@
z*n$p<*GYXlLzcI%@5fsW$#gR~bDFOepD8acRuhg3p|W1mS5->c?N>W^OJL4-d9;}9
zZ>kvbw0|Z1hrxcidzcW^X{Ymcaw~%B7QZsy<6R))vb{z16ODMUdWWb%)ygfmildct
zbt)C5_<S6%S`U&{e~LN#{bLz7+2tu)<H#*Th57TV?XrA=kL`zFoO)}MQTw@n=Sz@~
z%Z4yf!ne>YU8+_wT4uW}#cFLo2$s1sR5t4Nv^6VmTIr6{s2SJhwF{N;lN7;CuvPoX
zfPt36{<R?;=kqyr;y+mX*FXo#YIz1m-#*O<U9#dVdlKdD#?Lh#ryWvZ+4gk{{or-j
z^tYTz9sPT{ll{ErADO--$hn$`2HO6ZpWEuxq_hh{o_z5=Y9LSK-IsH=jzP;fiw_%D
zEN^*V&Tt>9UY$jTxAUjHclMyacY4KR>SWVfZMOVS<)#zpyBHgt>UgTa?&*noXTDO*
zeObTiaw@#hRYQNteev&D@wIN61@u%my|W4|;exdD;D@o~qg>7ReDKqCM-EaL3Brid
z@-_^I`OQU~Zmzl7u^&Z6*`STbuFx4QGs8B|rPSg|yv<+a_M^OVPe`53RPc>~Iveoc
zAVEldfBPE$!q<ROH4}yV2tt|P0w0<sekv)txOOK)oqraqygY?s51emRk;7$#1|#0#
z16GhcI)fG>DXKgU!NF_K$9w3#qIWVz<3*?JdSR6!<F7t!QQA!ooyC2+qYJ-+513;Q
zm#Mx#lL;In0kO!OhU>Sly}XPTm07BKT#c!EqG*v{w{91_?RHN4lYCM1!!5V1{dlgS
z5`3Ksa%_9_==SMgdF-oBNgiq9d!0o<%&R}x@C+e;)0N&+d}C(&?1i@kBmDlf(j$g1
zR^pX~RK(|(I!hdhWa69r80muAYW_{R3IlcaDA1U=3PB{-ad)q5?3?0;rp8Nd1|r(_
zEN*Q-N{mcclKRvuwqoIL!9TF~0FjbWR&+cW*FEW92^kUIQOv0sLvFMRMc#{>Wbv`w
zy){?BRhz286)P~R{BYZ{40k+da#d4f$Tu>%G38a)_H2b`yEJ>k(dVKbqU%T0gXC9K
zM#IB!tkd0184Q-n>vx0Uc^bYu$S9fp&-uIoP$zQ#nZfEn<Oy@a(Sulbf`?3<aZ7E^
zXOoEY2X6zMrd05cpJd$HWt`+}lR!0P(5=+55W9JV@LAK8wWq4W^YaulK8$pGdbT|C
z-dCl1(^luQsL-09|9m><Q*zB<y53NLhw0Ggsg7eWFQ(LPVkUYHa$jN2zQm*U{ermz
z2`<@z>0{GsRyLOUS{0G4#$)Reg(kCccd<${rMD>~_CxT;J}o$9a1g}b1;R}9_|LtR
zuBTqQk|_Xtj85=HjC|RweYF&_p&s1eyzhwoEPo~nG0pMZRUfM>s0lL&yD^8^_eXYC
zopK#S3MtNzsanbjd0vm#(=^YpKixEM+5I7Z4lxSfeuQ1GUxm1?qNd$u7%X-a9iCEk
zpHG0(t~^Y5!{{?qu7*%vLX<eJ^5WW2MQ}$Hq$AUL2qrjG`tI$?#~s2qPY*#~>yWt&
z)=?qb%_W;wE$faEG{1buq2t#olMSk1RT1Y`Lr?o3c!v~rn!nC^N1P5y9gf)6!t+i`
z0?wo5%@a|5bZA)MNaw&tVxk9M#O<-LVM%W2-9SFmk!uEKdb-s`eMKL@&Ll)D_Ui8c
z_GFjPM$0X7GdfE+@t!{V2~mUuxPaa}+8!J0VfUd|pm^VH{Yi_tYay?c(oHX`I-RE>
z?)fn}9bCC5lvk4W{6ZdgK5V|DFfLxUlKdQYuM^XZim?*J-^+Wnhj>svGQ0*qR)qZ#
zZv#1pPDipW2Ea=LR$1Q%+u*J^prH68lZ$)o`7uorUmc}B)nm=H5jNB_(FhL9;b0c5
zV{8A^hn}(F>#0rwl@3O}9e`527bbcyYx@fJ3O^JNostj~qVw`{+pbPp7ak%n^xqQk
zgwyU+bQy%7&`8{26Ugf8{jT3_=}s6^C@L9O>hK>!maD`9kbCvu_SSU#b+K2`fcVDp
zb|>B?FVJZ*qh!A6(!OYPFz>NiTqLS(Al!ReRb{&iSvjAH?lJ#3w3%udpoZy1+n8n6
zhHIs9*)e_6Jof&@u4RjeZ?OHe2e)%TQ$4(-JnUm!huL+Z+AHx}@+Tn^>-=6@?2W_$
zx$+4*6;Zs<b~(02W3IK6Q+IGsMd!NKSZ~ElzMOtvof}@#nx4oTF^Mc%S4M}`IC^DQ
zd~K*H57LwOTSVMIj_^E)Z$gax=%0c;5RyU!*7^0FdMWA~%lqQfWO|Og<UGRXMQdsY
z);rNXx29~LrrITBNLLQ28UMh0d%)0YEq>m1b^S<SgeK16f$g*<*?0HN)yr(@G*`b{
zodfKJmKfYjKP3`0@H+d)g2k{yVFb7LE%a5oPitSPaY^0K!(|#y%TU}^=+c6ItBsh#
zw5&(KIZ7h8G9b%Iqc7YmoqBOH$d}WuibNrHY+u;8>m6E4#>=mwPg1fOAQTAB2XE>)
z2pok@Te=tgEN|Z^D0^xXykD8UQf;K<jjGWsy=F63#OnXG{~(Jf=R^X?h}^fVPSiX)
zs^{wxA_sVHSY4KDWxxICT>$K+%l(5GBKs`_1CmAaO<;<0oe<9Qb4uy1>zYYL!}Z;j
zOuG=579uNw7as-gaQx_=*;y5Ia&<e!rSme-ul>X=suQQ)27XnH*+|!8K*qg&`^K0H
zxCvP_*XzCU=GoGk1e?M2BsK$e;J-sck^28ON&b~dGA}ur_#JO1lO6ncd{mmhK4`HW
zefA)4%|HbfcyXJxLi3bfPS8SRAR&Kwf;G_NGR{9DU~1J}Qn3q1tGFrD6Ym+szx6`}
zvo9Ywz1Dh^--F|zT(xiHds%r3Ulju;0J(;&Kz~sXm2Xg6A^~Q39~bou2jD@MPnel0
z8(I1mtDxkXjDrb}F;Y5xpMRi+*DZ8~W`<fMsc)1gi$=C!qJ#`RVXJQwSd=&*yX(t{
zoB@3Qv?z|VN!$a1?B}7E5XWEqzUjfN&ebl*C>RmcX81;x{{_#1KNcOe>A{WnZ))L(
zRag|j4Wk^Q)z48}_uY#Nuak_#!cAKTvddyp_A_?*Uz3$9i*-~f(w<1r=F_r!8Y;GQ
zeUh;?U-Ql4hC&?go3w7#_t_csJh*GTrdrFD-qB)tT&8pStMdNe&K<l%^5LcGqhJlU
zL$*s55R=-Cn(eSPU)ep*85B?8ovHN)r7*6*SBq{kt5TdPnzk_yxM}O&wcS;And}~c
z*Mqx=&10CO#NKabW5$;F6(yZ>PDP`<a$l?3cVj<l%?!9yOC~(f`jXV1MZ1Liu8GJZ
zkYndp>GsdzEgDr$)>Rhwuf9+DKKOOAvq<fSyih!HU@M>r@t}?puRT=}EIz4x@~Bj+
zfIRgVs;3x?ke`D}?(v$5$(_b{Sg>Leouz4uc*v{KtXJ1_>RLKx*Cr}ng!&*Z4HdLJ
zb=HTO=g_|Odh#OCbZM+C&jrtA-<y!dt}v3F{FOa9-zi0<*44GNTFhg$n^2rC`xtec
z+$4v6!_jMc2UZ+kPgiMv2OXgTOVU{CemzzQkGi~21ILC<nLZFUt2sNxAb#2R9D|D^
zy)g5Ff%<J(c0G@Z%B%mjh5t9>VmGv#sF$=%tj{L_FKa{K2oZwn7h$|TuCZxau8=%_
zYE`3c#puSdBqlAs7azElJe!sg7L8~8L?d4^M*GettZn*R-R5_<+r4&t+t5@+_8@=V
z-2vOy24jq^Ub88Fezrlym_V<2fTclyfjvkr8;xi}&{>YWXxy{U<g;CC&LqCVNY@E6
zNKQ*OPq19bxgjx_Hhrn`LsYA=mGdM@cq1;sO?HcFMS2D|9UnSKWcu=*1VpWex*zXD
z+qw%M^s~fWn0JBRy)#`K&*VK~kay9|BISkTY+o@V^qiFW(&bzG^1EO66{E$_UGct$
zEB*;E3h!(^UyAt#JO;regML5)7-UHRuL}!#m|p4QyWOW}ncmiAr-!DP`coo}38%aQ
za7}GhvBeN)`Q|7xitjh(5HDc2hYnuDW-u+V(V5FVb!-c-eX%#FCDu;c+PZl7oD*52
z3z?{5qsO&e$HS*82~^nBsiC+U2V@6oI@Yf=e}s!~*M~DfPJw$rwx1h4uud0<R>h?!
zRLzIKfABrASm2Sk<mXxqF6f@=SI28hr>bep)GKmi?>HkJzu>U3iUR`Qs^ImzN|S9X
zewl$fS3QmfTYiB}Q^mf&CpA6+^jt!`iDrGu=hdZ|$!;;txgv|5w;FK3nKoH!?1LNY
zk-|zbqjot0kN4)Z;(RvAY4`o3@fbJpZ}SBo3v4%v7$Z>S-FI16>iBS7k7ojpO-sME
zI7lmti@xHn^3-oD9)Cilk&Cy9NK?+(_AF7)ETmqVIpu)zRYuv5i?bVW#aukYzHP9!
z!^3I$mg~VvuRDlk-CAYb_U><sl1|mNrR<>YV~XGn>-WoHV{-mdE~EQ5>vG?=Z|5h3
zL_su;cs=N@4N+DXHP=_YdI8*@RsXl`&;A=?ieRKKe=o=XVmSt~?dfwY9tFyjT%~HS
zT3_i7xpPqKn2mpXM^_w?<m^~@lAiv!sJGOncv##W(~m@%h#9ICM|(HxmmNMnliU*$
z0k<-oqFdrEu`fzozCN|Y#3D;g;nS&T2D1gzM0}l2;O0}c`P70sldk=8PnTt(*1(}0
zWA431NnGJv&D-RWs!b0<cQ+#|9zE^Yj1E70Xe*~h#GF@F(imcPW`0ts)ec*>r7dFg
zY+4dO?k3dWcon;dhiAKRSP5A?s~HhyB_C`3p@YRlz;c2|a7ILSR3yPniP(~28YzNP
zc(j|~wElfjII&~Z&y$$@NI8GBhJ8vBf5O|@U~WS#Hj*nu^+6@Vw(wer%hCsafy)ml
zbo(xMR;&L|AGer@HhEg7nQC#|C_`R$d%`r=;akMAUr<{!`XPdm$l_!a7}l23S@)d$
zvYElxpg!9YubAqLOxfMinF2Z@ZD5u3DaE8G{(0n!dgfEbD@z(K?J7sg8wyxkdoZg(
zxh~s8xo_NdL*F-iTU@bA>`a29g~FzD22BO)D76VcMgARzh-S&L{^mjR@M>GHsrWE+
z^~P>KRw&<I^`()Erte$p&n?DjDxmv2#V_}7D$9*&_GMbQC@BnzWnFl1&EPJ;P8sI&
za(q#)oS!#PxIbO?3~xxCNu$D8d5lfz^2x-yG`bj9(B5_c*TDZXTY<(pV{{Ui#|vbs
zS>`yG62$D`_ws#>Vp0Mw-rCO)C-&6Q_ipM_m<Ogd?YWv1Eto$jo%+Efezb^Ub*LcN
zG-xKD@d2#lJe&*39aN6w$GIA4PV36FUd?WA%V1h>Sd6O_JvX!UeMb9g+p%yHE`cA^
z?>&sMi2GaB&Zo94kB=^KU&|72en*?0^%!9pK20xsMdl2C&pY*@|1A^$rzHXUZ`Z$U
zoV@w^?YZ6r)3T)1jq}8&?fdu(C^m0&ltd<rnCs;R>TU&<h|!7z+wH`@Y#bAIzG<8V
z#oZ;e!Tl~9qPiacv^Z|-hetdKaA1r=P@dP7k0sI%kKxywSPB#7n^NA7ScxnlKX2I4
zGhXEVz&Dh!fZ`)^T$o{f^Kfh;bab<DSDu4&+c29V!iYKQhMNk03vGHb>ye(JkI~3j
z+J5=Q?2QSp?#T4BA}${NsHdB7EhKlaO~mvObROP)U!$VOFZM)0hno`B&F6G4R&RJ~
za-p5j;VN9g+IYb!81s^f1dg*siNV8S&_?S@!D+Tj)F;m^_V_JYa>l~lGe&kA8{Tck
zI_R@5eckm}w5%!a5Ip*{>^=!-%b&xC$8j#}-sG&b|29-sHa9plI*+9FQ_ff~-wiHP
zsZS4ddlj_Cr^$D-Seg%@GSo%h1RtV-yB(`JxX_^~#?TSav!?o*(^dIK18GtDCGA6&
zZ~ds(n%=GE9%MhF>@0`*gKW@!=edFkPDn_J-8{FSL-o0G;nVO@m-YAu6Li76SX852
z9UWFVdgQuAaOb^^4naUBZrm)6N_5yC&27$~tFu#kBw@ZWoww#gY2RAOut-VK)kn=A
zX*J%SAq(q=Mh_HyDD1z<Q590---Essby0HmtjR*2-|Lx=v#Vn-Z@k?pdwIAR{#!%M
z{tXM_Z}PxM1Ai}!|7u};6`lKLi6h1ML2C|5AbfOyNBd|T+1r>zReluCWxDOY3Vq=5
z{WcYuDvoXchd%`7v~$i2d!Y?Kdn!{I-AhDJ1-eWHwCInC8$N8C;GL_$t~aGkTS_<e
zo{L($%FjP}f+~Hia&xjjm?6g!If~(N#HUVQL*b3<=qk=S4Z5Wz@0=+kUsGiNDvz3}
z*+TbMSVw;o4kc%9<Dz|=1weWrmJC0f%B9QYUv>t<8~9nVln)srYPfSO7I}gND8ff&
zW3{1qw3OF(L=!D_*-Vuj?%fE8I}e#$kK&>K#)~U^N?DNGMSZsG-gaW^cj4fIwR7)V
zqn(EtJKRtWC{_|+eP?C{7H(u2m_Mb{nWm=kIK{bSVZ6>+uuE^COB-e~a~yL?g^zFv
zo7)1XxsLB|D9^i-ix3dV+kITPAr$wv<14>QVRcDaU0KqnZIN`EFIic4KYeN<XSy9K
zzQJl*H~_an#BuCxCt`@~jB)eKmKL*5`aPauI~LwCLNVuY787Yf&j~6KOGnw+SeyLF
z1LW3(qmAifas{7;U!dxVPO9uA`&W^2HQh6s&0st&;TSHXdEr#DVPa#7`r4bacXJ{y
zMlbe7cHC`Ib8GeVTC{qOkS7jfemH}17^oGaLCj{{Wq<$%(nrh$CKIFBbBRanz-T6O
z_!RydICH&H2Q!8}hwpOKEEB0Wun(skTjH65uZB$r-1kMZx4j-+)V)=e^FrQ+^68q|
zv*x#BIuti%-c#iu=Se`*QRFAsre=*O7|QGdC(5hB;xJf(2MY=4Jyt>j8a`(b9%>Tc
zyv>+RtpYgK2h4YDXvLIpc4*}#3Al8p5rscqOaf+nQGZkV|Dv9Z-=iig($Dykbx+CO
z*H6Ea@~((JgrW+ic#uc}!W9pmz!%~J^}$$yK@`CqBL<&*pFxJC3l_)oPBFMl<=*o}
z&>_b0u@Z9?{ig&<lC*Twns!}r#}cZa@bODQGLOhj5b2_(2O{av_sgWTzrHRwDLLyl
zOe}@}xzAw0&U6Ol=y4ar0=GL5Z-FtX@H_Df4T^l(68pAswcl;c(Jt=BvFE}XHf)}h
zf#@C#-WENgMvUA6*LAF}BME3-fZ~RTu-IwDp0G&<{v0U4V{m);PlMtBjBft3T=9RC
z`oCOPm^3(ET(b!kK?3M7&dQ8U6AXlNxp;(5YU8%4q|56uO&2=7o#Z!tY*EHKPu0n1
z6afEB#-&{KFGmWpuHSl>ZctkuZF6_t<JrB!bbP1tko@GtE}IN|4_5}xbUKzI|LG1t
zd*XYSD$Vec)HENf>bTa%PWpsSaf(aEOWLyTL}Is2Va1nH?xb&ngK|k`d{YKY_Rlg@
zDUdhi2_mTSh-Rf~HQCmuSc@j<UAq%!%L=`7=Vtv>&$drG#=S1drCZuQZdf?5JW-O|
z3Lm91sldjsyv&iPON2gK3)V&Ewj+$(F}@jBW?{E#Gf@r7HM|8&;?tP8Z^yoz516J=
z-H3_%V8J>>CS%!zy}jSmSjUFl36-IP)8S28CFHMsxWISj;!A^TUOmXto&m+dJ|4P+
z{R}bn{UgXvUd`ak3=i%&G;s-c`W%iXm(KGR;8d`PXLx&A7EUg)9_9xIN{M`U@kH||
z4NHXZ9ZL3{0rrz6Lk1P6+ve`zm$$PH62D2~R0MJGdV@zrx01lvp#ob`NZPfcRm4T9
z5DgzhK(I7EYZCo1ovR$@ac_$pQ<M=3;hjb<EE7&Ci`S)ay%)R_)T7P!*7#|-nm9d^
z=1cb744my0=R>$XigO$ZhD2^vCN}K|%SQ$)GaVC+VY$*PFe4;-SBg<6FW)3RRmv~^
z<({*85V)2xMj<)y<&(8aZ7PgaoQlXSF0X@y37Cw#l2khN7FzY4d0BWAxQC?muhwYB
z7Z?}RL;mA<?tR6;p=nImtFjC;>}rX$g~+r_()a9&XrWqz85_CEg{Bv#8@piC*o%XA
zs0GF;eFEn=3HafL90jL2P55j(@dODNiY+H5H6SuFu$R&#uY5UAhto!{3Ra%TbAEZH
zF#i#~)aKVCV$j(MeDM6LEeTLX(V`~n)=5C(;jGq$9E5LDVRMOeYb0P-4wLJF*Qikf
zbLH#r<6w9L5<oo^fm&b(*M6iB3H;g$(FQfOkx?3d03m>NhwfvDx>-cnx&7-Tpa<5N
zftRcXZH7@|8fJ<IyM91c0AFuLO=%K@td5d^Oyk@Gd^|x6x*PS^s^kB{pUa*<_~wR7
z6K0bZv=K1OU@wAUV*>+-_e?T&rs3F3#yQcyRt^6%d+5b6A~X63$lu9+B0-bLhH8|Z
zn%JW-M@>Y6;mvp9&ocf}^?w7^P@?ds%2!>^kSQxQVr}<RLfX5B{Kl>of<4Cp<07nD
zkP~S9ktmcqZg=1nNVSN#jB4=M?3CB*Cm!LY(<-QG_gnpT?N;iCGKH=l>6oDf5<p<x
zxY)CXu|+%x;8gUhDXL4-QEH57-u<y9Y}Z3IjUuS{Y=h)8;Sb<gL;wkBFF`fU!(Cu|
zP`nWdpx8kXQW5>-|J)V++`s_pEF8PrJ=#XROJoCC4VfST$9w-e0#JGr|JW6>{<(!A
zgl2G@{;6)wzwlRjp!CmuA^x8_|5d6D*1y&a`wM$Ro2!2wCh&jk{i?9f`hThW|9aj0
z0K<B*X7JJR?;9L#P1H5PVR{u~ZG#Kx$Wo8Lj>--6*k0e@7?D<e+C|67P>eEXDpN?E
z_U=)|`iv)DT`qgzwDHeF{qLUe$AtO+58XV>_y8xcA!gcE<#BtG;V`Dn1KKgI5UC&7
zx(sJ8dZK+@XO?fW)cc8Nvu*^J?QP6ceY~(fA^jE!80Iu4dJS!v{%?I%9Yz}bd&lTs
z?HHl&!`-@hmrczz!-)|5Nt-$Wd~CqB$*^bd$m{ccTKm=I^e|gQz)&|!Fr>KV;H40L
z>+KRcNaA(cHk}S<{Enx6c~JDo{=@@k?d-Mo1h?y(-Qg(4O-b;{dM|-$>SMFN;w2i|
zM`tYW?xtZzZ4>nK-mgWU<gI&``6~Lv&rn{|XTi33$E;vWyw5v4t3}LtQ*3$CL<`@i
zBW*^*VH4kKRid3o#-W-`m=EjCx&fwGjXZ2}8w&>x-jrG?Q`wP`q9thaSfSgPmMrXB
z-84Ey#^df#I{!g-DI&ItKlkYC)c3;@rNs1O!ks6@Xs4Qhn!9b^&uyb~mX=D!d(Y^K
zp8><Xq(c9reVICsgF@77Kk*FMQ*#SYi+oQv9|TYA+kk6iF2R}v6zZFkfWC8Lhn^?3
z4+#*GY?;{G?8R)_51`bH2|vJv@Ca(w9uH2ERw?qtm@4$btzUxm#N#uj8SfR;*t=lY
z+>kB726yPbs^=WMWSF_Y)uBBbRwF>Q&O}uU#>1~l@9PC}Zr{YZ<wl)1a|y~{G9PFg
zE{PS_e~?r4MUwhc^L>UliuS2QGVTxA&_!Bt9A?}1AP?@!$cr5FN6{gbhMOik>CAfE
zWm8e~Z4}koZZt;Qwz3T-l^aMyOS7T$!rXCK(c!ZcqyrLMvdh}yvv3iSDiGvHB6CJ7
zj7f$otu)PKS|Y{d{@Vv5+0Js=32$fbHfvS`K?Tnipx_IrcpV~5H!f>hvkf!ywqu&J
z#qGL_`Q~WaLG=x~K#5|u(`1s#9(>OA%Ko!E=#pTaX-jCsC<O_K4mLs^NzQimlG!me
zrDqYd(K8#5hiH1=zDoI>J^9sgie!{bzFR<3)q}dc*WUyZ=<>}B14Yz&6SUe*_$Q}J
z#Q=0G3NMjNNF54=uQ-DbEVSJ7w{0-oBw(@(@x#N48f>H2@B_iBOh&M|LN!qB&z&Z=
zIR@aHe#q3JIZXnKH1SG@1_}63mPZ1z@;ATz);!p@W*9VZbi<^d07DNi2k_8$cp%G+
za@t06tt&K7#5_XBT~2)b)wFG*WN7tqUa&Oo2@Ik_fxoys4QoAWGVU0rA180YOKrcO
z%$aDf(J<s>e^rI>IEDqX6U)8}ZjO<U<8iqD8TWXcA}n69#{6~hlyabR<cBc}i#CtK
z>pDECPCbedM&UMXN0&G2?$U~f;<Lbj9?)VT9u172_K4Pr6>pN0p3p12Yv=bshq{La
z{9J}H`Q7VrE<Yls^m0MVjq{-RyvhW331ei6M?*ZtE$?%^GQ%<pXweig%SSpw9o&zy
zm}5Hyj$E*hy82!f?y!LVgc+IGesYji1Krn)A70+BOz5y2^m};Dg8-ivr#2k-u#FW?
zW)XH~yF;rcMt&)#NaN}{Jr^<opFd4?k3e@inK4#&S%RjtI=;w^cd>8W{j^*%vqm2i
z-Ba=hUHYym!16*SlLq+U&h!TkWH1Z#X5L|U4x%|=dzL7~7iE+r3~LVGRqSR&4Zj3i
zEN5sFa&Q(ePgG}MB-XfLHVucgZ%l-tX0P^;faTUP5}+>O`{X})Bf!DMJe%kA<DmSn
zFVr1bKMj*(vy`c1AXxd;fEgGwK?4^L?itwYN0>4&>_m<qA6z>&JLcTJQIw#v=t(L4
z#p_$$C_ZEo!AOwBBA-v9>BkC6!=KZ(MrZNH<IZlK3X;W{uIRi(;AgJk(5q*sANt1|
z;c`}b%xFwqA6-`yq~m84ur~$cxEU>s{dYJo3cf#lHuKAiWEcEgJnpzjq<wWcC4E9u
zgB$#W0d?L&CgbM}S{UATebj(JBj|+W4Zi%OE`{c^zj@e;-J9uT#rAA|^TH_ya^%d9
z5#q?<3>p$Jbt{;Cz*OI|YCeK$yDU{~AJ^@?-&B0?TK%L-=`iv$__dg}miW+bd^pz{
zt7phg|A=)>FRG89zTq3-=A+0TbH@~w_&0uM>_2#z17kt`*>9ylH85gk)$riBv6her
zH+wq~xBu$h{xz2>tm>C=$s5Qt998{j+e2AKGH0HH*qz9dXC`;Xs86$4q+TB{%h%;e
zux+2DY><Hr8-P3B{qU0cd*D}dC`SVmTawCC>T(Khggn&hE5Vyv6kNo{ywg%04SQ{d
znG{T=MZv)rZuLhKx9f4`tL2W^@|oHg75bjiG|CyXa_nbMi;|?Cr*H@98|*F_^4~=U
z(t?(GLV6(kf`@_m|5MZ8axZ4`1qt9$5e~j{kn*lhFxX@uycDgQH!)UPUmiMk_TuER
zU4LBb3+Rx${%v5tEc$zm^-Me!LAe(*bqqIH>YV9((J50tp#K!psp1N)foyN~fU^LL
zYNxNsklaub&T`~aVuNBtoYt_E;)jp+){idmg^H2g2II5fP|Rc{>IWlUngm#aj{y!S
z8!_6L$#l#Q2N*4Cg>7O_#hfq#&VJuXz(@FG_krIK3E1SNJva{Hz$R;d7JLGn0F6)!
zyH3!Rs>6t{lPBiGN4ZbC+g*PdrBhu=`}VDrw&-18Ht|Mx7{PC{JJS3{)%-obYGssO
zc#xa<T&rD0Sl9jOODuvXFQ*@&nY*i4CB7lO9e+@EJ_HtX{sNY6TN4{YJcGZN*}VF0
zshruhuSDe9=}sZ-QsJkj!j#99hoPOWZC0`1v^bCN#R<(!tPI%W=%&lw$rjvp(<6?*
zr>Nl=iROfGc9h4-O!8NI-|3+mFEK#CiC<taU;UAc$=pbl)5~(L2PMr~?^XuNc=J2L
znH#u0rYzfh9w#uJ1s*|wJ+f#*FqSG5GntFw4;FF6fzr<$NyfJOeFVQ{qSGVTXZ`$G
z`E#{PqEeUEUOow@6S`8*T+Q&5zjU7q`31#&-U4UTI#E=<dd}8`vl&gMdU}x9PVRY2
z?oO7G_{mk(W_`BEkCFWH-<k40QZ4GTw=IEh^fF}PvvjZ~mFVHc(d~)^ZEJfkMRn!T
z=8Kp|aTgxtSwE^gzuDsdGn4^Bc#dkgfch??A__K0MmTD7EO%%t715qdVB;hj8cn12
zY4DCDK({IcWmfXbtaoGLVX*y_B*e*-UldnY?3n4y5eCL~=_O%BGbII$+gGF$M+>y4
zB{(FHlt1KOg%`1W`Ih=PA;W=YZZ`}n>^gt%#Z}4ycD&O56>#)wpqxC|0(p(`kM~dD
z{ZR~rGuYLyCjEGfQOSesFOEt2Cv1z$t4#DIy>{c;JkM5tf{P<Zf|Un6wk80)i^YKO
z2HKB7s%tu6lry-fF>bX~6?#g$9ysy^9K-6!AmV67sU#RMqjD0fxw5;j?Cign(V`!@
zHesKzLRJ2ug#2ZNoiN#m>CNkG#<3$$E6AanQqhEmI1lhS(n<Ly6s=XTb}#XqbGqEX
z=0}F_-|mhomw4XD7O&HC`>LAr?C!+}*SV`G4b?+3_W6)~aucQc^|hkYj|(lOjW+B*
zd|9;>Zeic5>mwT2SakT=`O#}b%0N>B*h`9@*+fLDP~u>be(^L;iU+a8%BdaZB@U*p
zSif7J-*(J39@!*6Bk(vZo#D5p0$=MthML_-Ce~M>H{vjFtBA(%$;a>?K^-LErlsj_
z8)CrnKixL|e;YK8A`SiR*8D5C=FfPvB)-=kJrOL4V<a3KN*rDqENfjF)d{eB^gq~p
z^Khu&_iuQF>}z&0gzRK5WT=QFvhPzNTL@WVnnBsKhayxeTa0~YvTqe4vd$vOK7+<E
zOZWTpy}!?M9N*>l{C>aVxu5%Z{<#0}mpNv+uIqhXuk&@j&ez#haq1qU>2RjxC0*|O
z{?qcz?5wrJ`rQ8aw1T{?wRpP<5W)PnKMRVl0W|?$XVOq_6eQ(Ct>m|A$u>}E<7jLO
z)i#@}wI;7Sidr&)r?#YY^MAU(%<=7g`kdv>vgMM-`JCVEeR$++f7lRbg~Kzc7R#%Z
z6cLR++tBxK4>vbw2|)KwYg+IBw*14ukop!9up0|l)G2Qnh!DcQE!W}5zp`B{n69<>
zr_SYB+pC)`h$x=>xJb^>vuk%4J+n_^RU^9xd$2<qpnVIdBVRdR%2j>kUj}Ap0#{P4
zA)UA`GO>Uf-+6(sHlz&}(U%0erm$=MRDmVst*|0p>&Yh>@JVUCtaj7U>mg_Dl5X{-
z;OWShX^W_O?_<^N3m7d@9VXRXbO0`JlQ{fF%(JbTHTC15`Ot|Ue?ZkypyPaEFg2l@
z75;htL$}66Hn|^uzBBFXX1_>RpR2q1TBw|zP#V4XTltXl-hRiU<i2ChiVEN3!Ll-!
zCG<Ln)SRWJnRN4Kg{`dD;S8_6j?AoCPKzt{88Fbk{Q=QIeA##)y(Rn$8-gR?7utn7
z#|EV!aAa5G^N`9LY_B}WO|%Z|K=5nOKcLY&nrJeQ=#e?JI_yXu@dqTIG=<o@611ue
z6j12gBXA{LzjOuTU>@4ZWiH>%D(2B{ON~6z7Qy%N=X|{s=prOQPWAUe<NUvJM@VGa
z6(|poT59hD@Tmy|4@dM!qJDgC+$D4Pl^l!At}~@{Dr0v=NkP{5#8f4z>4ShfEXsk~
zcZJh^yhPnZh0aS&{6qoR3zLc7yE`92O=z;Da`+#NSx+}^i(0mRYl<%aaPQuVuXk~T
z<C_#sVeg1L{I;BC(sYL4yeKr~)B=vFC%}4b5L(;Pzqw22YWmYjU#IHY;k?WkB4Uk~
ze<j8%-Fq$3y>UsD#>zuDg(<EG!0axRVdD>Dy|emnM&_8NAs@Kp(TF^66^EparIF)m
zW!JV0q!B&l24b>FVC?u7(42jBB`D2Bq4rlDkeOaNEttLQ5okOtQ)-eS{3&&&^XnS%
zCbbUb-*}4l9d2NGf~11YzKlV$ZI3C`dYQi%$yT?Ex!qM`D8bEr0HWFeD?!m(*=6_b
z*1(6C3RJ)G=dK=jH!b~qHTn45Fw+JzgE*Jg5kHV!)C1W?6#gnTP3;e8o#Pw47N$jd
zh($bErk|jRl2n*lCiO4g%WJNXPE$;pDtWPxC!K9ZsXdPz`2+f=oU)w$I|7qcvUk^6
zhZ+y8u^9CI@1raLtULuiLVXgorCf>lwL#T+#r4H96@|aKo9He~2$=0f#KJ|t8JvS%
zZpkwbpK6Sh7HHnTvT)imv@V^en~<V&GfsGxf3=htL~TL&gAY*i`9qudjvfcsmM5KZ
zA6>_IHpRXTd%K&ci|q(XQJo#Gt{_RW=rjt;%IDA($d(sD`w)AW(zKbZs>Pvd71XpY
zxYyAb?>X9Lx431PeSw&#r+v5n0J(688~T`Lg6>7MIP`9gvsASvK=^(IH|?a|kJeDo
z*p?2t5~8<Hd#7u~v<yB0Se!g5X$X4q10T_AAxKvEvO42mA?{F&+wgMh_WWvUCMyQ&
zO;33h?2h!uQcn&!bQ2i!ih@p7RD3WC3(q<;uKSU-zuxrZ8sKBgA{i1qJ*$de!Ikxu
zq|#1j43x0Lu6p6z&R!B6uYcjmO!_jy2b*jayV+a2qlkLNHDXDUX`v(_e8$P*JE(&T
z{=aKbG7wB2dQX^I3fYQo2g*UK$eDIfKLMNoyRah0yW3}=^0iv4>kRdhs}tHVUwcYU
zGA3J|UJ7J*USf~#-Nb<^7YSn2hzCkn_W}+cfv?5iZfR~wyVcT?pw|0F4p1i5f>`H)
zhMocRQ?O9CJfg=CF1vvSPS4gzxppGH!#G$lwbL~ww>?9~eSRrH$Asi%Yt2rQ&W%yK
z#fVQ#sz%*|kmRcq`_YLhs&Fuc^Xt31Lfh*{I{Ee0qY}wO%O{<_m*ML#ec=@HKG<Bz
z-vS8uQeqlD25&jg#pf^bK>dig>Xj{AT{drP&X-kRU(1jlQdWB6d=-?Q#st%)7Q@BA
z183K(jEzHOY%SYFvPPvwh)!mp|GDTYj2)P(!}{7*Aw35N2EGBBrSpPnDqJQqVXQCe
zimY#I*NZ#$FkT+I3lS2h&zu;l)ucPhL)=weuq0YR?oo5#k{L<MoK34RN!%cZQgC|K
z{9<;}`CmNS`4{azM>+H&N%Dd*VF>;Om?HHxOtlgwN}zm|X7jGPEal{CE_KiH?2j{<
zr>RqC6dtfih1GzafTSW0XbnYIERrBZeiAf#<)Kt4JK(A#<*zKTgzBV!K6XEZA^Qp?
zSoEMuoEv!gBbXtnXyu|PZg#tlpuIm7MN89Na{Sfq@+il&F3Sz-$DQQJo7yp!&bwgp
zGYSX+$ki1Z+toiHStsl+nNJCF&`v{@N739Nm`222Sg|-j`dk8t5_9A)`eP4#5G6$f
zOpRPX{CZcD-G({|WI?Y1{^hUoYl`#wf9x6i-t2Tpsj)($iI75{M8<vJ11m;<bH$4W
zj7_z1dOi+suDs^+o{&57Ve%jQ|3Y{pJ1&(BTEi~9gb;Jq(et8CkT97Bvmec(`k9M7
z>2&-}r9RF&iT6wjUppD!_7g4~i$9_A^T$ihx5u-IFfV`=a~U)MkxIa00!8ITXOG&s
z>NZkW6GN%rSDE`3XD7ZbrSuJIu1_a?bv`chCOJ_)$=e26KW&FYXMX^g@_yle)CTdt
zHi_rQ=Wo*kQT7B$4}Wz)1ExBu)TEjO;pNYh#uF0*_dYe~CSJ*NduN*~vHjFc0`qL(
z(E{`(^fZ8uFLc@v%x_ZPAiU8@QDuFAQB}-I9QO30?_r^xpy%ZM(Tvsi*!-v4Orz3P
zO!*m!C3q{;{N^F*6y-A4))AhzS+bRO`bE=Nk|qALdab8YoBgM(bhv-$*X~K`OO&T&
z9HRbbNrYe@hkDSqg$2LrZ}ate91$<Ms6VK8)8t0@U{c$Ur~6Q0BeEBK8r8sF@fJRh
zX7~I?xp<0s=qW|+O|-r6$LJ&j+e<^mu!N6CxBaNhq>BVHW^HJReG_2dD0bdB#mL?l
zZ{kN?7j}Nhwqz<zo?3`vCw>M+*&QYxh}l?A{Z6yI(b9qXDsr{H*eBa8pulcU>e3d=
zrLn#2x4h@|9ai0d%Ite73*fNwpq@1y&qA~F0gb@(G#y&M3C((fY10iLV#NRJhypK5
z;T5G_U$_C}jxzu&^ST<I{7(?$pAp6c(=R5V;u_z5g7g^!kkpAN-h-sypXsd^))q{^
zyilw4^opEw6Lvfy?8qHG`*UD+%Zz*#{yBno6IJ^MG$8yX{exG~Nz&`?sj`urwrrN*
zCN^=VF`)Pw6-6~6Tuq^<VbWN42gKFCRcl@pABY%#7_IKo!@CA*%;vwD^Ks+{UUA=J
z00@WH{DdzZ!T3X>3JFmGyG4-p_Sg`&%_~r@5~m;2j1|t85)Ne*uabZDm-R8;+Eo7(
z(uJZ=ZGh2Nz{ClPMX9h!v#>WyJUx-`4L|YaJS}_qnDmbS7?@DtTQTRdp$i)e_74*=
z=PQqp8pNpAXH9b(okX4WpvD_OXj2i*#ZuIE_*t{y_eOGUE%?NQ;g+dwG=p4rK!<tx
zowrXOo-=hiLVlx4U8|dDEL1*qJ!7<C3X{IfpyYDzrrZ_bJ7&Ex>NfydhXVdD(JcP^
z-ZVB~vn2pwCgk@l04pc%DIOHkSb(#2_BJ5u=mAbe>FO)4x<D0)#+JOD4dWCcyP~CZ
zemfI0*;@J>=ySLh@JTuAaK+g*QW#k*QqYDphI@A8yutjod2%}$qu<bK@5xkgo6ozk
z={We2S3rg1qVH_QPnRVVf@zyn$a#f6DF#pRZ$~<iEq=lf(SKT1--gTrvnVvLZ+*77
z7-`;r#dW<!HHLE}JX5Ih31g;N4BbmQ!&63NLHHD+ae8tS+Klc$y7xd{$W&h#YfrwI
z{d9*VSev!Yrf2v?E!-&{o&{4Nnd1*J`Egq`amu;Lm5BpU-p^v4_x5;qLUwkgG&<^j
zG^m|L8FT{t6Qg)1>0ymaBt7vvDWaSrJ^RDJ*)MBA=4bMQzBs~&IMHsLvhO<`=FNX>
ziB%OMSq`-`B2!?eJ~;c&U;MSivHEm9m?0)?o{+81#o#T0fB1?MF<=0mc%aHa8Vopf
zqop>-rm4H5!{>}?0S=3~^>x(t#Ev20(v6`jR>S}WNgc|I<|2U0thV_By6j9nML47+
zbxQ%yQotH5*^dHT+Hsc=BZa<bq6knv(0au+b^N2#9|NWbC<(3vnq*|OB|$se(+NIO
z;XDul%A#Y%U9fwm8+ZSsCtyM1;xs>qd`Ci<b<H+)ly5!Q)@D%&3_N=)>oU87yO~%9
zot=?%af}t?BTJhJnA9uRjrpceA~(|Bx->ReC@NXGEcCYBy>q`Zsq_~JIb8C+eq$G)
z>6>XPv^ibloP|gMQDgi}s%GV6(_&VtmwLREzVXRJj?tsxE~6oE`6ieTf~kaX2U66q
zsfDPMw9oGRT`bX2F#~`^3@aHYcl*HW5^FE(h=ebz1T_QC6$1m~Q9Z}d7#QQbzEU4u
z%`<E+jwbwkA!f2NFOrpZ`Ww`g`m-%Sk?3tf@>v)^wfvyaoGYckwtjit|IBwk?a-#K
z?HBosPj9F{;eEB8B^IL5qCeX|gpHu^i4w0;4}qtc&zP|PQM(gZ@y+U0e{FmQHZJ^L
z_cv^?BG=9W5jhD-MTvEDQ<x^MCef5h@5lP`(nUvH5<eX>8tnC)IGJ}xU0upVstX>u
z2(U_xsBI1X0@*ENe7C<Fr-_=*(@txYcb!quyKU@<gTg~0-$JIJF;+}%6b4`)pTHzZ
zL%3E0eo~diG)<IZmPJXx)7k<F!~3zVZ#4qw(sfw`WG`mUE;k)D;a!Mys7adKI<!$|
zTZ#ZYXoUm~^V>32JKFOBIUL_j?|?PV2;QmGFW)oUtM@<1i-F{*lH^n=Z_9wtN<4)h
zrxiXprZxB<sRJJ!2c(eKV1T0bHiR9>N?I(Do7yqw!O18-eMWp}4-gc%;WC>%K2awN
zTgKa->BYFky{R<$u=A;((azfJm*T$rCUJ%O8pv2HIw53EigIg-xymHuss8m6uc<pd
z^PkzBSXZNB+|cBSaO6ZuI)VYlLB34Unx^qnjMK3PZdUy}GYvwr>87q`qNUgbyO{G{
zUKe}#k3Re2A;f)ZdNnSU2qV~nMc`uVqXH22&F_iUO)W;TVjl*caVMR7Eo1jfVDaD;
zXGbp-Z$Tvd><A(-5vNFxD`4&fKJO^sUMFQub9?<~DRM*&6_fjM3>QT-pzj}F`Fb)%
z{{r!RdY&?Egm@>WkNBt<`pgP%6Ev3o90%9|8UrCfh9tXU5k%t#r#82snDoQgnAg5i
zt|iR#NN(i^md8Xr9Akm>a=;S?lx+HQF5ygn(B(c`b+VL*(|v3RegVeYJyNxpMBMK3
zH=V4OtgWr@p2Ws2FKeX;m6|_eO-edZS&jilb95h*fbc4f>_HJ3r%(q4x+EJKD?kIB
zb;3c&EWXfV+uTEFZ_tqpoCA3JRe+fAc5;I0m4nPf4EThffodJ;ad~8@MH}Hp{wX8h
zDsyi(^g=K8TWQMbv(cn0>8w?t%Q|4Sn&!?L%QO_*84^<P<2vjzD`_LzCaS>6jG;P^
zukHSVKB}E%a0?@T9w<f~4j@Si4qNM3s=)45(uGH%1koXfhs{$Ds@T|?oK$`sN%5K~
znX)Eq)a`~&aE9ms`Kc_^76G?Ahav_v<53xJ1d7iPPL>8&yU(BGAeywM%X!4VFthHJ
z<0(0P@=oW9>;znz){CxB?5CbMy!@?O#HZc1#iu8zF;(ut!my{rcGlTuTbXAsv4`@%
zM*C8Z9@AJ{2uy>=s91wDFiAoJQZ-3}<c93dErWjgv@=tpt7P>3<r~c_uf|7f_+YOM
zK}0A}d&OI#pCCj!opc5)IX84m`cTQ&#}pzHue3(4`et2{`pk)`jtAY<P9BdKh@>MG
z0vpam%|e9|g8I~8a6BUtyx@H1c~e#7Rf6S-nzi}P<~z5ko9VxQ9}fKiEkKFkRKSH!
z970fVCB+)fz4484_Y3@_UO6exCV&Zfe>ctYj{lES1Tc-2pX>%-!$K3!P)oYOOTpBJ
zYI>EHU>2I(Z7=r1{GYBSkI5}e)u2Ze<O{S}2m{LRqVC2DHn2)@!`V*??VDc<1g}@2
zu|Fk8&y9<gMz|7Q5}+0i0P&C7a=}37!q;307xOwQBRdA+3OA|94;wiG(fP}sck0-;
z7k|{Le7$hdb#_jZj`IHlhWP)?3;6GhMWJ6S@~6q|&P!dIxjN#pQmq}J9ymr^pkMpA
zh3K5jGd>2K>ambU`xg<aefb3YXNA92ncNoq^UyA`OL7K-yhmc2a|hKo#+|=z{Vuvl
z8FL|dv?imvPFIRq;+T;RqU2G&s_;(eSWwTqy$f>WCRwf$H1HI_Wsc?Ebe4Yj%XQ$N
z{}g`$XJ3$J0a@XqrbNxsvPPh$4xa&$hAO21F$gB}{YFxyvST1(2uvbmPn`lJ6-W!w
zKOhq~hXXC>xGIHvjb;K(Mg3kcMf@78q$QO9wIKBU2k5ymOnNfmrh(Qk1Md2-op)=;
z0}qMU0-lZpXPo=YXM893ivjsHA_{}>*^VIgP3}IBq2}xBVbj8A9M^P9BNNQBRx<ha
zt{B+$3o`^Qy*v=pquLpR;3A*#5j0j`oo#uhZPR5={CR?1clLv@CczwpcVTG9Pc>@U
z=Y0c@@xlzE|8Fj0*f*4K7qoBw1G<rz`pPG2)Qzz&qi<KSm$*QuET8B5g?dEK5WLX!
zhzoe{2-+Zo8?GB!x`Nmi#*9COOVH*U@bET|lNr29;&yKZO?D9S&O%ec+|TJxD%sZP
zuIaD!i$&8|Q!6$MWG3{rFo?wc$iN+!F@O2@#p{6ugC-A>(Son9B&f5&UIlKa1BQi(
zB`gNw6a@s2Ip(6YZ#}8Owsoe-jD5=0EDRBrp>6+g*+h7V`R$qgCX*YF#A6^lC~vNK
zAokgy<`S_lA*>W8%=n27k?VpsOCQ>E7xxx}S|w_gIi}?sd4@(xto?tJ`<Ge2($2zk
zyYS%tD(Q}T0%PKwmbs5-wsf#Mow{^Vud(ZzFUQLWKqmzPh~Y#qD_oQ!fj^FP!Db|E
z!L;7JXGs|4PyKXDt=k@~pRuvylo9G4`<JF-1ws)RqgibBfQgzw%zUe3M^=LZ6eZq8
z^+*TFfcQQIre!W!F#)+-j}+v`r^X;M8$dMcqAWJ|rD!aGYUZq0DdM|}EztDv?KsGg
z(dwIKwW{k>jb@tP7qLsd+w7q(izfAb3OaTV?%T!gFb_cA#OSADEk6QA4fJ2y4frBM
zxHvB3%yT=t;-*_;-(UI89xNcwy+Bcmhx#3*;?OB5Oz8}mN2>}FN8`Y2zr(ctFnYh}
z*Wg;cmGykO?YYbkKjxhKLPj6K&g6|05Jii`__yOk)?JF6+3j)X#9!Qx+_lef>=KFp
z@s)W;TIpKfs_Q^A<T*xrh4u|z5?OP&(uuAoHk7*=6k-2>QknW@)dd@F6WJ`TU+UKk
zxbG$IEFQ9&c=~7e)0&8ZWxfem1U3NL<1XLg-zDnSR4}^7pJ&S6e8}vPr9bQ>?KWyE
z<0u|A!L%mWSL986PJM;IyqJkfOlW#A4ObwI_U<i0-5SH=UlrQsu?T7UC5xtVUpfbh
zqa!cQ#=*zYY!J+QM1y5tv}FRA1Aur(nhOuTTJxe`{LJ3jcvz^cv?sH88!c+Z{ffcP
z>YO6crDvHNj|RvqR$p-@d{~Nafq1+>e^G9|z->Nmxhrm8oSw&AxGVE~4}jkfp3xnR
z;}-ywiMQz}5&xwPfa*>uj5(Bf<RR}y{de;V9qALz(mt2nT2+{&6drCvp)g01Aii`Z
zw>i~=;L$fh%AV>wED36CY4g>O4PI@0n62gI<lqm^HXMyk`CTbTuVXsdn8CH4H?I=w
zak8*%?o~RQzfYdf9ivHWO*&gHLp5hxV7$%0s&;-;FVFrPg^wY43j9yvo!rm=sP6f1
zDM7^_5nOudhe|kMm$6#H1+=e5OilfW&L=cpg@O#MYU+48O*Ark!20x}`@BReu`Ts5
zG^5wp@4)$J4Rc7bUOrEX#gEV&1GE@tl$eZ&ZZ{+9U(vQgs<<kU_KCaa8WJ6wWPVX+
zfpAM5lCcbL^g>&HgO^QA-!y)B)$u>@AD|=1Qusn?*Gq6Ef02&s_xSM+6mFo@14$_%
z@=hTRu75j3{wJ@PrXvG7AuEQE0X~BMsW&61Q|xkM6h=*$CGbXK#*ye4z*#vC&8F{P
zO)(+`WAz{$o9<^~m3No>HMy^6wPk`EUUOFkUQjA$i#Xc_+$u*7#PnIjy^G?9m!NZ@
zeceK{0bc2$l{!hDFT^j<SxR4Cbv4Q~q0WsPO`(2L&`b!-`yBY!O!#yfW|uyL-(_9)
zs>{uXI>d)9dfgu2c^F#br~XkZU=M%_DSyRP(9Ph7YBFiSjB}fljejkJCt%m=)z{5l
z>1WUzuioD~nzGz~*cnDopXCnZ(+oILJfRS$+JoX>raYKMVWkKHskm)RGnZGjPxkJ;
zZoX9aoLAHH)Wdf!r`KxKpoq`BmZ$p8h7Z5HF{5zbgj3j5g8Vqkm8%yW53r<)m<~u{
z343Gi<O4RQ0@LdL`Y)HqrOc%?8#=Q)H0mxy$O_TNfIuWY9A_7B)f!L#2J`+B7r{gN
zjyiQBlvkUcO<6u@vG9=6y|SA+@#eBHW4Dz~_z?g8_!btAqOnGh&rviIvCtTbFvjh&
zS=>f+Q@(Xau}j(^g8<{}_IT~M^G6yR7VyPMLvcF-Jr?rBK!>8A__0K|F{vq<Eyp`F
z`fm0ZpK|EEF*&-@u#h<8UoH&yL){Xez=W}2&@X$MAl@MLZ>kL*XUC6#YNLWh=w{C1
zifq?|MnH?iXT^kxpa`ncjQ)U5A~tJKfVlj-!@3UT)GY0KAJ&o@2jJ+dW6(kf-W7Gk
zL;+%W4NxPYJ-!Wni^f|*k2JXAAw<?7Dp(oxDF3gwyND}cCOHi0ij610d`sv3+l?^`
zTJH{6f*BrD%YU$!iM8U|pz&a412GCWz5;)>cU$toMfSz<aAj*JFXKFHi>dACmmafU
zueO1OMVbTpBMk$IO*G!t&GIHeB^HaMr$7q(B0`p3oGdgC%^%FDYrMTd>SC2v%XC?#
zkGK~M)u(*{vjIiRGDHJc-+4GciL0lWaa!}aN?C_fm}1*%EBe0CEoaek8y~5R9D}#B
z+n@R92&nBU9P()~D>a*Pb0sLD{eyuxAwAjG|50!lIL}%R`yhHCb=-+B&uTO#?uH?g
ztQHQ@s1u9u4Vu>=a^bn2z(tmfLUAa;^(gjbnY<0pM*mdrx>HNHV_4stXNmu|qO%@L
zdz(TY$7S@QPf)z^K#JIhOm_DDM$xNyUhs3m)$*Rqp0rabJ8|#oS^784I=5CbjU&Q|
zcxRUZUw@H4c7^h!7=_C6k5)_|x{rKxq<wq`uxD{^DPknVYl;S5wr@94z!{vlojt##
zzmT@wl9z2F7^9i3rYdzS@UAT2WQ14jhv2OM`AE`?J*p9$pfCEKB#$fE*7)`HdJykT
z;d5JDp>h%<F=*9GQ4UMfR!mPRSE$9^>@a6SVC+gzGMulGpi+TN`k7%#zVBO&J5{fd
z6F4-Ixk|@4nL-?hX6H8YX9%CE`*5!JH4itVot+S!AqI3FWc&Anwg=Q67#aV7o;@R#
z(0bv(QJM-YfzAXV&O-54&?7U;WS}G_i!GsQum7gro%q|~%!av=xbTRT?qq5#!M``p
zK&shJ@zmng)Fhp-bFPw3Z)9h5TxZ5p?@=7Ehy;=JB7D@~*Oh(|`-0n(%3(~1dQJRL
z^YVr7y4_zu9-XHn#<hOgS~1}O_fPx^jr9@PoTA!AvRFYfl6d<}QN_y<`4%0;ikUNC
zS-2G~!qjhNeX$};@gK~7OuI~D)p|=x?KR*bl>s9P=)aRr-AGr|+pJ>Qfm*rvNPbTf
z4_so)t}0nt$@#c_tok=R`5pBao;<bEvbE`p-|Yv_!FdP{Daws$A(H|pvk7-w<43ck
z10;-2Toca9XG{#?&>#*|GrJ{VHiWe&C?C|^TE7*^1BZ%T*^`KVW8Cz+vZ1|qi@&#4
z-L%z9{*38Oe5=&f_$in)DSAa!EYb#NncSF#z^O8bzMtF?_l<Mb+F)M0eWEpf?iomU
zG6lmgvG1N?2+k=OPeNg8#5E?~<88&+@j;IRgHCPjMaGFv>~i0uS5l+C$CP@=o)wfL
z*`9Wof!3k6n%>ez&@4=`lG8U@sy8C6{dBwE*uHA*c*fYPD4=-Sr?M(1Pok~o4%3XL
z6;m?M71og7BgTabY#`)~^$J)=&bqyjZT%L=x9F;rEYi=;p%%<E`q;qg`r+qjufIf*
zK;+m1iV6(C8OZqpC7;+pebJ>=ZXN+xG42W=B3x6Y#)d)H#1M85{vYJHf0McWzxhAi
z{~6Nr?<<x_0O$L2EkOFf^%9dvSSV&Y)N%56=a4|@`&9cD^Q=~C5oK;A`0T*4f!o^$
z(s4|4xuj6wc@JxEC8ZMBFpw?m+cvU8a+7_5otW*?XO6T6kB$A`2d}uw!oVbXgLo{G
zbDo4A1dc$rl#e)HhpCrH=e)l1-7L$;r!yp4K~g6fPXAbov3N9&N8-w24Kzuo%t={z
zw5<iy=-Wi2hMecE;Q{vxJTaaRZUJaUBICLUUUlIz&Y=$xS5iNecAH>3GvTr!BK9-w
zz3<Lg`%ZLWcuN9vDMW*Dku8(6pE2V^Cz!?}kKY_9;X-*9MrR1PjQPOqKDcdaTYb`Q
zpR?fOzOrB`VS39~@S@#gP7YASA5i1?_7RqA&VQ&`oPjVD(|NUAyFsM8F#1+rMnDwY
zaFdf9pYtFPE9?ZA%@0ewgz~`A?c+}x^?(^G`NVKiZkeyMr)6+hsCMp&0S2|Sap|-*
z>`lWlH4LXEKOthf>Vr?oDFET47`lZvb()Fos*ke=kB@fVnZ9;7Wmf(vedkgP-iZ6h
zeg}OMJa+@#xb_i|3>I)8-uS9oI8czE(ilxdm6&C-6|yNp<-eNl)bP5#t!ZN|PdD;f
zYCI=R-$H%y2jmmPNt*&X+p(l-tOZcqHu<^}xTAb06)>N5GWc|<F?H4K%+}(y^w3;=
z2R5=HZ619R<=quE^s&7SMX*fQvWT1QYiC3)gvqKSs+J3LJ<u=9?=JV{+VfXcl=VTr
zyAU0}$>4u*aU}p_=nrk?`+`-DWLsNbyiGrwL$7@CQxDyiW0b>3G~NvTBm%BH)#*g`
zf?07?k){UcbEgFaTco0|28af<6`X;u=iQkg99k=<#w#&1P0oPvH!V;8GSHdS=OC<L
z*HR34EO7R7Wl;a-x>S}Mmtyu!e!L!&3(BnY6c)a!b-3JBzT|T(P+H}<zVCOaZ9iqn
zpIc{iacVF=Pw44~ti;T;s;=A+6G!#}3a~73Uya{^=c4;^mIf1k!yJ6_J{c}|eAs1=
z5$`a)Sv<#94B+g(4B^E{2+<Oc>W2ttdr#`0@~HHadA|0jxgcjePye_5j|rwPXb=kX
z#+{q`2CiU+FYG~Z>fa2iaC~v&-Nor}-=H#S<<*Wwo)FU$*Ux@q??144?A}4Pr_B^F
zZRNgNH&7&GJP9j`xcp64yE^(k+uf9TOx)yvT!GJ`Fu!93tHY{9rYRE!K>{4-pQx;n
z5CokSgPM+Aic5`5$@8m9N~IdZW3(}|aHHRf+b&?d!}hh^fhcefa&F%gL3$p!KfrQE
zVQ((h{)>KwN%UguA`;MvJ);PcN&?766op2@B8`8V0$hCQXUP}e*VKME)V48Uy&=Hj
zbwb{b=GL!vdVAisBu;|br3s!J@7INH4d8<4NjU>>rKz7emUX&U?Dv6LaSx?h9B0h3
z#<p0`3BG6EgjR|e<lKI>E}$!(&mA{*BTmsrN{m;|_Ke)I+zFJ>tr_@f3P9M$z3_u8
z&g^b$jv?X;UgBQ_dYRtITDWSezVk!Qv%_Iw-0ruuLsjhIuWzNRpSnCyv}+4Tr*o-u
zy$DqljU(d?EC>idLO}`L;w1y!1|&v;py6bIlYsw1m-ez^<kP1-I>Uk5H9sXyOh+Wb
z&UBBH%n1=jq&j@+WztxXzd>xNf8JFq+v%slW{kB;un{M>Qaibh{SG=)+0(P*vnZjz
z=JAU5gSio&)w=#jUf-E0R}H`U_eIjm?=$yJ?3q<ovgY2~_vm@ZY1b~bnN~rX5Pfbo
zX4C|VKOTwYXzXc3u)i<59U!pwV(VU>W;RdD&+urUrE?eV1V4W1@GPwORtf&*ID6!*
z^Eb`$xqWOzDoyG8uX>@HCW|xuXNym>Z>KxCgz{dn8h)3k!2GktfD0gAjJtU$uK4_Z
z1aBX9DY|bTrZgox{kzJ|WSK9_ks)y;E${B9Pj|eSv7FcxJenk(ID~pKe+ZNx-@@3Z
zb|t1@!PvH-ckOkVNvqxI(aEwd<)O4j1>HfCOpdpN<Ry4F;p&zfKB(W|G^y^D?;8Nd
z?ooVN<JS6hnswNS$>J<e(e3+R9akJwu!FtK;lJ)1GJO(&;O&6fCh!woq<6RR{zDBU
zy&C~7BE8>T3YixoGfu8-i@RU0wRzklb-v0P_zl)DRj$7BZj~`Sbf~mP<I$4$mcU>i
z)%Wq);NV&=&3hx~mxkOG$5EJyL*Q$OlDS9`n2fmF0wQ<I%6;1}cC}-`b-u&1*FTx)
zfYpUkTkP*HK0Mn!jBnYREcFKj5ju%LZVBc2to<S=0$ar<x_--U-=j_b^i(?&W5h#p
zhQtI@D~y+fd<P35IbhMLy5dC<Z`Wzku{F1vyO~>9gtD^Cla{8|*xK$7tx5r6i%JJk
z{N~5wt9=kqWDs^H#;Fm_?mJTu&|#p{XrHBYZ9InVE?eHk5v{quL7l(g4&A@HEFE9^
zmxjP+bR?i?&u{^-$H>R+Qlos($LbrX*Ojz~|BjITS8{{D7pO!6a}*Nuoh|ayJ1xq5
z1a*J+Iy)Lihn?niyYWNe?X@komzn2JdwN$#*!~SU{jaC_{-NQ=L2QL9sf3Fr?tB%o
z@&|Ovw^+D2Ur%Ow_f~_+!YqfztMj`lpe-LH10KC?N!E%)*}1XxLHIhg$~V-{r|U&F
z`P(Sf41r9#?|Mq(weNQA{LhZMf1}RYJWl*KO0F2ld&oa&v=j^fQN;D1&O6ZeURfJF
z4?jWCnC_N?Mh00Ew2Mmbn16pzM_0^t>%;i{-iLQip2zD1$Rvb5J#lrQ8>q#`Jzs}%
zQ?yjm^tteW%W#q=vvlO!uBpaW6`VuTiOuIboY&%5#5!gHRKciA*ofpJsu3oyvV`Gy
z{7XM_5kyC(zJL$0UXXYnc&{$!W4s1Y3=b3#Q-hQbT+V(42F7)?XWdTGoPHbK^iV8`
zty!Mu;TCAqP`r$+O`Aajzt}HL>L%c7^e|M6_;k4C`0i`2x!r2mr!AG(B4IOY9jV%3
ziOk4%)N+(>ku1>>Z_(1PdMeV!fgtc?|Dm9Rh-1rb&o6d&G+2Hn;p_t{ZO;w&c_@~A
zf|AY_#qai`7uZ&2w^gzJ!b-rHCG&Epx#8hE={SGtCB4>R>yvJGQeiQV`sA2)S$_lm
z6KfeZ00r6L9*>E1Wh)Wzuib&V_zM;La$)5Y_kmVQd>MuB40*_1tez0@7zL=fj=!Xq
zzs{cDo3&`k6V6n#9v-`YnLY0O0rE2SIV#`}hzULoOl`4@p<KjJ5q-M(k8$Yov^zqQ
zdw2J*LjY$dhp=br&34Z`{ON}WLbRccEg!k&xG<`Hs-O*#9|lt2wm&o$adOBS70(=6
z760n58&S<&ld#>V7Yx6p!+p{*23|r6#tUL+drL$~hdA()0Ix(RQpQ7mB2v13*C7vl
z4w=^~DyZHj^)knhhZ0784NNWh@|XDV$vEyyYk}R{4<602MtK`MR_Y!t@o;Y`sbF#?
zr(^lgZl+FZ(``#3UqqvO6~1)PfFFOcJO5(Q;Oh#<fm6`A;boXIJ3LTB*hYnoLfDbJ
zaSrZB($51DW(Y|xBgH_P^i0efo8RlX@OFNLJa)lZUcXS?it;W{+AMGw5`CxC%S7?_
z0<j!FlZ->m0WMZE?PTfjaNP&9pY|So6Y#rx8<=olCx75~P+ySja1$6}1%2Cy8bbi{
zG*TZdxKzWpEp6~z889ir<(_uSelEI=n;XX`+d!?2?N84+ac6Vd#dvxBg}1$K8G+&e
zXP|ipK*<eQsz>9rP<<t*Bboa1_x;p{REi$n$;);@SH-hSaNMsCG!q^3^0aBa&zdWn
z06ZHOzPg8rh`U`8eIk<{0%^Ey=b7O;{RO4)?bfK1xo`EO*1BMy$)<xPr%{+{2urun
zndA>J#vqS~@WfoFfG6#JyTk|FXSrNsms=HV?&mydaTXoCW~K=ry}V)(0!`=}^6nKW
z@Jr}lN~24wo$mbD5#J2kZAiAf;WZeQ8HvmWt^?JDm0kqU(ydC7!~jt|dr(<e$4@uy
zAUxUE^AmW~EX7r0H#aNS&Mw_ZnvwnL3_^es%+v>oFIFWbhZtJ2uM5uSiI$2wirYa$
z1`O%j&LcnXlBAF^=stA)_8(As5O?9YsDDfTC7Z+I<q74=6VW)wpAc(5R)c)%2gp5O
z79M=~u}K$U{BhG~kE=8Lr=8Oal%1DUOjd{y``&5&g@Tbs;aL;e%;E@ta#SQB^e{>6
z*M>CY_m36n{$y-ViEMoC<{3Y&+rIrWn>Eu!H-)rIV`KWzw*nTSaFFQ5=AHk50{yJr
z+{~mZl@voYwe9ybv`>^TU697B{YFmy0r9|RAs`Cl3K|4EHKBEdaJB<SE<YGkyvXVj
zJ$akAGQI$xoIeupP_`UGr|?AnBR#|uJ-^?BYWf+AB<1&roUC{==OcL2X?Q;SWB0v!
z$;>3m3r})t+T75x(D?ZknhJaw!2!^I=7_jrW<0TtaCr!SBJcr{!#TCoxA8<T&U&=c
zmZw$jQ4!b|`G^F@pTf>={l<QF=tXk`+-<6x2{TV~|6!?GupJgsUUT`@?Ms8N9cuYW
ze+lIYqz<elaK4FEq;dQZF|O5(Y0zEen}D2_B4se!?Q-b-y-WKLW|ht#dD_xS&%tVE
z^<&@(6n)_AB}GC9AflScxy>O6hrS)gQe^W+RX|YrLht0QQnRk_*J`BZpI)w1$3Mi?
zTT=MSdPQ3Lcljxbq=)#b!D78>isYkEkB2IW9*m0@nqR!~4Uruk{F3N#-t8Mvy8|zU
zMJCbINueu0tIITjmV$TBh(If7ZroMI-r*YdTiYJVZ$VjEt+;OZW2|=!;<n{nA}+lH
z<6qU$(ORt)5Vdx5+FiD*W7=I{?@G4uY4g~#(}sL>*->@U^n)-a;I1&nqX&e3`@&Dd
z_z8!}4n}gSgC(~ELIR!^5?KWF;*5fnYt>4g%>w&d@4X$5LCznV62zM@8C)ClGA#)^
z63w|ynz2{vZ+swSjO5+0l3VH!T5KIZe<Vv|p2N^%fwH3wq3cs*D<QotR2_0yeJ@Kn
zGaBbrxQ}c{cyrD5^@1C&CID(dcG9IC91X(b?+~@r-y%t$T$3v}=9W@AX8e>9Y_l9=
zknmSw7-vb6Tcf;y4E#^;v#;M3F-VdmAcaHlL$+kz{{j7aQMC*GPhV3`e|YI%8k!W>
z9@!A9NsRAc9$(>fkW}TJ&d?90_@UcA^{&sou6V00n(;Q?Z)3fm-qU5sAObo*^Y^#l
z`nXF{fl?mRfNOfz4e<wLREzu?M3O~PUL^LGkQsGo8F?se#DCfa3nHuh!<Uk00eRvX
zLCXAl-u=jhGNL)jyxhE$G>fw@6o1WmC2z((@SV~<NP=;FdO#X&3`64|A~DfejmRP}
z<C$A{S_XlWP3+Q!(P^`a1=n>#hj<C9HCa+vALPkUtd=cDzoRS9pF6F~J=!OcZgev5
zZ?NUREe`v~*-jspppIYlA@3Lcb$=g-1eW-```Ox-dpki(%xP)ZPW;Ej$y|PXSt<(i
z4pC?MxMsDslav)yzSuj!y55{0F&x~ZsL9=^bg@72VuO1b9!l(|79xBU_e)_4gn{=J
zRgB(bh7skW6@{mDrYhO8nQ}j#v4b{z=+{&JJ_rKxckh-Epl#{z-YwA4G77IO&GG_b
zi>>kx==|n!)&HmSz`6d<?7aVg0{jS0acBMt@kf&sWrq5IYFr3S1kahC<$CeiZji2W
zQA;s<sL5p$>*H-Bsbc0`XlJ(+f_vzdpCwi<AW*BR<=OY4M^b%$hkBOJWV5BSX4Jng
z+X=^fq0>4tBFn*tAWiu_;Q1h+-YniNxdG>x^&qTwxOvXI`+<GqgH-Id=O?A>ubh9t
z%CpGPx)y5)mLfG^O8Ss<9yC@P{AO>r>=X)n0T0QLY)Tn{nGRWJkNzZjH)Z&b?KNC}
zko2*=St>IFu*9E?s(karkl*$e-A9naPc(&(ji^aVC0n^s^a<X*93IyvV0M`3s$|B&
zG9~=$6dS&}XFd|GGPpc$TYh@>MIy5DC%CZ_Mei9eg>Qrkx-a(Ev<RZU%d6%1JlAt6
ze4NycP#Vb4__5To_KIuBa&8<u9{X1dj~rrXT%2-kGJtXu3*{2t!X&K2hMgVD%thtZ
z)``(htQjyOvP)l-tO5Umu7_+(h7sz=ou?==0fZCt3%$o@V^@W;g4QAnEF0Q#$2zxJ
zIjThBrT6z8K7;GWw-Dq<v=MuEnI;kffgf_nABf;~bzk&56j_|gYvJU%Y!t-2@Z$6y
z%b2+TSKzXP5c^3*WLpY^v`My#EbP_kK8@$gUUc>q7tf<yWmt9*0=y9e@|C=K^wakR
z6k<3}#L&G1uA3**zeTyeADg=<FW-2FTyH)+zy71V;C9Etr(_6FDk!N#ByPhr0MYK5
zDW%>g2=?`S@4MPBRBySw;1Ubj%eD;t9ENJN{D@?Oe+4s#p`XB&v$m_l9+)I-$Z#lE
ze^Qc8c)%pA@X;$oM_w_L1FlYSB#n>(9;ZhSE*7bW39qh-v~k1}%UeXk<8dAV5nA8k
zyV{J|bk!VlUzypJp1hFo@#=UBAKfIP$LzN+$`?6bf>qt}#&l#{*j6$AQYS5om@7W?
zy|eOCtLbHs8Zpyh2_RWYxMll-z5_IFyT}onR&HME3HsiiuuzVMnn(I^xFYfy_#m8<
zTBHRipOWE<1RaWO37>w@PqPT5Yo>k=WOvov`0iavLe~!^r;kjl(7f(c>Khu1526v;
zlW_`mn!q^q-Gvm#;J8z2wHp-7kgCrcFCECD<mVL9k*}Eba)Jo}!95rBd6;4$9;yk=
zYUTS)F7jHw&%?r}??%VVQok<={(94W;V)66;4F=G9Rpzo(A?W~D0AZjR2SR6l7m|5
zQq{5dm)6G1zphpTeO0@FC!!5kTnVQp0C9>rztP0}=CxDO{LB1xAN!r%W3w0<vrm?C
z95dnM0}OBZ^69k>WVarZ!3(s{lcbD6cU1yIu{J4xCAoXDdNWksZSD^3x<Y@g#g@}^
zOk0oSrOI-qIo;w?@6z>_sOD0Mgs-FWvIUnXrP9nbz_;kMC{wf{1Xm;aDGf~eM!rG0
zGPyEyu!$6Kw2bh+-+j+PVBgg|w7h?80^{2I@wZzWKe>f$L(*G;^g|zu?DnB!XGOHq
z8*n}{Q#CbB6+03s%e_Bk)58<DCT<LdFxw5&87aSv;aWp|M9i5JNq`WOV*^UxDF^6U
zesj<}7VP-9A>Yr6@0fI@-O1cdVV;uYxdc{y%Ko!MopSA+GrvrI)bYL9&q6r){hooK
z;{$_d)FL<og_W8~Qz2EEOu%k>a8?oCZ@K@{6&du%ULLYE^YW26Yvz2#QfslBI{-wt
zH@nDzD`A&SKGlP)nnNZ@H<SI=2XShVGp|z~;y9LXr$#EG0vDfpYaKz!vhXipK`qPq
zC;*`5lbUemV*Zx+!NO4NBk>W>XUpqT^AE#+>OAeuQc$|<(dKzKRD~$|qUtqiovcKg
znME{hL7IX-Lii#B+(&yk)WuX?{L8<6m{GD|=)QhK%rm!WP>eO3`2xStC%sa8+Y*yW
zTffjAi!cLUVC!Gfh7Gt$c5gBkm@qIT2F2?uQuLwViMH|&W9b&&C+T~OXZ0&)tUG#d
zyYlv*WQYFVCq5w1>IgPKcD$QJlYDx$l9X||wyT4+gL~1O^@WpQeZ%Ura0Z7SG%xBd
z*McaqBi|Hg)zZOPvPbG+X9~l_R%c#dAx+~E<z@o+rSrBJ4e9hu?^NDc5mm1MmmQyc
z{FY?XcN~$Rf59)$`EG_kM^RC`r?i#Jt8}>`n|M1=SdGVJf+7HefU}-M{7Nl`c=J)I
zZ!9@}A9!T_*bq!<2oxK2nd<;W>vX}_99C>0b?9y6L-O74wC@IzU3mU)+b`p#zUEtf
z(@zQz`Mh-{xNhn&$Z_c{`+fG882VVU;y==4|Hg1jah>%DMH~Q1k(MNYsJK(y1UzgZ
zR!l3%f6+Tu9jyYZ40N3hj}anhU7A5u;V|gLx4%0xK$YP$?)oG^jDQ4vcY=Rj<}#2Y
zAd*!}r|z^ps`h{Tq0(|eg(qpW<{TS*`v&`yr&2MG%#9IB5I%ilvODbysyQN#B8o#j
z)h$b<m_3Xrb^TK7zL<Ja_sIs*o9J+xCuy(air+g^Nj^Np4{}ejWPWpiCWA-zsLs{Q
zb*jB16$qEjz<m1or`{xC7KU0>`97Sx%(%Gv%w(+D#EPq{YTujqnhKyQ9}W%NOH_l-
zRs$Zl>qPjJm+3ZM105{AUf<l#bdRueMjMm>RljS?D`}WrtcX?puH!($;@4=bY`8z5
z7=tqeV(Ch?lzG!McKTgMdusuU$ikS<j=lWb9M3n_bvfB4KivjVuXRB*{mx)4B(0m9
z+5uC>Lg%I23}gr|#ij6M*X2j=cHTtpl*L8PoDH+6s~l;RFt(G37aBm^Zld(S7fSYW
z1Gs2?2HZ6JT&ls}<N<X5sy=ks8h~p6!So*L$8smnACSj&#PQ`YLvdgm|GAqQ`6+`W
z?M-=+mj<*;1lRyN7l-w(|7+ul|A3lg*0ys9V4Qmi{uJ?HvjIK+^S2bV-|~e*PJXc$
z9M!K~pFQ`;RFjwHo-|>rW%^~zPXQLAN1Y}Q3xzaCB+-EWk0EDd>OrKkmd`G2DLVKe
z{m5<g!Tg)aOQUr#P#;4T=4W>UwTz-l4uVe@oFiquTXzPSct$uMMYp-w#pU^r2POR+
z?8-WYYc9HN@o{@PPo8pr$WUmt;+nA(;<!#ScM&-YSh$_?2qgw7QoV~-b@Cgi)!&D@
z5D-*dKIK%y5JH#|goIg9TOVwP_<RtN+rAeT{bFX*rf6?mdS7tA^LYY@wJ%y{nU1w(
z8j8QFngmd?`j7BIgL%vPGpbq(9HLGs$_BXOhbmr{+Dq;}0%mMrWdjqtFLdF*k>7Pe
zl#{^m2TV#J3^ZX1PyR|`&m+D_=e0fufk{8@%n_yLS^L=>nRbIYH%gmS?o{qaFWLLD
z43Er!?MNj}0*XyUL;7nhS{Q9su|$%x)qPam-`|+fYwD3Fw6q}e>7J*R<rU_xszDT{
z7S)*W!V6Ob0m#WhDyknY+uGFi?M~uh8skfK7Ufq8Z3g%DD|O3%D0n{A%^?C3rV^qb
z(06e+V{U%@3gH3#Y6{FUWPY%MWz%opBx~T_jo@~<$%tdqFLV<0hTy2b^mhNdY{UMh
zQ=lVd0DGM}gQPgZ+2P~Pr*^st;mwC<)xJoJyX96$b^mP72k#W%fp!eJ@vQ(%##{q-
zEzUp*cD~ShMzaX)*i?s_Z0cBVVq=lon>Xbg^zzI&_q@n1MsiwZ(UW?afF|lv>$;U`
zGu?n&p>h}(eN73*Wz6QaZ@$ia=I5gLF;`<^b{;#!R}F!XC-LW59pz+qg68`$_I2cI
z@Xy^+q-)akbp+1pAb;h?`py#1INH498o1MO-csqAoXePUQ^r`a9Q|}R>k>)U8klp)
z5riGg@qZoZ@9_1*?$*5zI8(_u(c!!>yYzFF%;+ynu4@I9a4KqBnRXEl2-E2x-g-|2
z=j~rgc1}xdyjL81to6e)s?c2P!hs)^otn}u0G|ZY(@wci&XVRHVwap}`+}83WR^36
zBb3JJe1!(WRg_;_of-XbFDAS5+~{hzOe#^I+PRJL=eSDjNVFmah2o;$Wh+MOEp*-S
z*E4ng?(}9*sv&+%Nh)yryL1EpS`62#ZY6jRq=6}cVu3-V9ou#1<HyWMZWSC6c0Sd^
zamQ@-W*+Hx)hh>iO?#H=Mi|OZ&(4<ccKZ8Q(8djvNQoG|o^qGPNT}8H!Ps+7doOKE
zO<t25>Y}R(j|Si&v`KVBB89JnSb~p&T_7M+;HM)Ieb(crTk?*j+dEBmM{f<E^-uME
z@lA+{S=hFgvEESXcZ3N(FaAxW?$F1)nbBjd_$SVOh8RBWx+{{*eXm7NGQZ*)Mv=}$
zByI;Fymv(-Utgk@SratoF9<EI&ds^BpMbY;#qRF9BZ0H!Nm}y2PZ2#jNC@xyD10W&
zr1+xtGJnu=>iMF(9nVy)JM3;7?4=y-_M=!KzLuo3;CKT`U<wj_#V`0d(#_CNj;(f+
zCjKet`mSd3i4mdLQl}FquVhgs+xXNB9i%F#*);mHZL`W>&=%CT&Wc`;kbCByuZX5R
z@sXmjc4&L$HEI3lo{YK7^bxyatIF*$21C?@fG|L7Kv4!J5vEl$W~4NlG_+6O-T_-T
zq}+0$zUrC&1L}aDg!fM93;=Czv)h7%L@Vkpk)fqMpn2!ohZfY`*u>VB2E_vpXgM6{
za81!8#^ZN74a`+VeW%uS#Gbj$l{C6^AR33=wT>MIBA|6ZfRx39iD`tgA;g@j3x1WD
zPhd5x(Q;$!NBbr7;vQb#x)bfC7x(GQuZXL4uJ310&sG(Zzez!lz9KFHIZw{nkXr|-
zWt1AUN=bY=ARB8Th^x}khTPA5^>}XlXhpF@S$vUxpZjZSGX5g_Io*=Ou7O8JWO>+y
zd?58$!mnU|PeZ&rzc#v9HVr)u=q%DF1C%A=Z4`+%M${wi6ZU~?BcWRvK3{xxQdJXm
z(o{vWgf-Gv1=0YY5IUcY-KqV&uaFNdiL`nb=jC!x)*pluI^Zy)$Z%8-HaG7T3hllH
zpy8VD-V=Z$)E#sY9W6a4{P8T%@<CA`9L7^1WINzqaufYXQ>smM!{_%=C5#>hoI|tM
zxi|}7t37bp{8+vD)M3s*nwkYT;LS~~L?l4`jUK%NTnW*SKddzr42`JGFS;*($isi}
zRL8p6-?ggZQI44t^<N8m46d8qrsB<4fFWLbK0v$uMelyvMV*sJzxC4Yn&Jc<&TJUR
z-fn(UnQtc~6Juwkma<7xgpd3IwFGTztc=r*kPRaXKQ`0o@Pl=}<?cQ-aK4RktLfX5
z_H&{42F;$jlv?aPaT@{!-iv`FH{nY7mV{e%?F5xN@3+Pki^jfwvpGY7vTe^#omM+~
z+Oc|{b6VKraqIx>Dmet+59NUPqUkr_GX6dXh$IoMXZ60vorY58KVEw^1FfOOnRP-8
zl*u)P;5KK~g<YZxse^1u3hl86v%t*DNKyN}y3Yz)DAz?iom8^y0*a&)E?j$#ihOwa
zFtO|YvH~8UgV%s@pfv_Uk*Q9kM_5H=`^C8p-JQHJ;V`C_tnh2MlBdQTvdl*4)Jig6
z_q<|9k)(qFSSd`gq86xXB1D$PD$FolP6t(r70D6)s%PZiBo`$s-BB5BTNfYLb^vf=
zO)&(hBIywgr}ZIxg|dX=s@v~kxIV8A{v=*L7^t<O5%p$g(G99wn;7(51XjBQ0DswL
z5vO@Ce%sy}6>wRYi{ZVop)M$CXJ@2$)7CT7k)jMl1`stJs0aqllLth!3$Ydsfa_E&
zMa463P;X)EpsTGIcfP;g^+UMzU<WII+RgD%Gg;*(LxTlsrU4l6#z#`08wf|rtn39U
z9q5?_+6XO#g_roYf)9@!kfobBcpb`F1U}jKF^<2v$QLJ*DwyTVJEj%aD$OOimM+h_
z-E)-59ddzQ_QT(ZJg#I2rnF?w6KF5^yXmI+EhJ!~mx$hzqyYNA+B_ibeRCJth4`<$
z>=oD2|4nI@36z$NN2ru=Ok2Ad(q+qpsY_gBle+*S&kmL}jmIGTEK?l}1W6uvNWTD$
z6(8OR$e?;HkpuD~MU86Pa~$m_GLns?)N1ea`D^+DjhgX@hQq!WG<HOfO=D0zf-7vS
z>jwJDY|XtN9na&7adXPzE=`4Z`CB<fpYpa1`p_SjXJ1JcadJE(A@ls@U*q0xPH8=o
zb#Bp#(%KTlpOo`#$?~%3D_?x_G#!TmYWzULHW$6JyA36z!FX^b0ww>0ymt?a@$VLg
zCrJ`QDoPECkff;4;dbgks3@sq5K_rFlu9+XQ|H5|B%&rIm1v|BNrO%ZmCi*q4LWP4
z!*ti&bNj9FefEBy=lgxGYwvyS{l4%1UGHCX&-$F#XRY;F$LaXgx<^azn%(~}i=RpR
zV(6{?>{atQn<qYTTjTbr8drxPoe`~va_-}HSnY$J_@_?THp{5ijt@t!C9qGQaI`<O
zVdfG09pX*RR+0^rMT><jpz>j~<=9FtzkxQ(U#Ir8Vq<q%_Rpq^k7nMB8$7l<yK3p2
z3)`M7`MM~#dnM(1$5ZvvtPW5mfL8`2>#HBK+xv{m3dwge`Wd%V`l<)@T#D2E94Bnn
zl|AbslJbS_O(PQAHe%m0uwpwWy?|p|lOaAC0Gj{bVPRZ@|4d#2=10bVsE)s6T=ln3
z#r~+H8{_u)=Dj1C+xTD%)5thy=f5ZWMSRBl7#)MA@0Nphf=xs%nnw*UzF@optMO6j
zM6Y@Fp3Zw=q++esS{&VWI{}glo>jWC@R*V*Db&}M4)IOgZN0^tK_8Gwl`CU3pFPm~
zc(nmNp8tH=t?hz~)0$&uj;Z!;CfD3dd)S+xn?-ROzuw%ol2m0FK5xp!DIYd7XA9Gd
zWxKS(kz5AdP^wdFP4@xb@@U=ss1pY`(ci_XLpxgMM@>{{@T&R6kSIsrhr>q8EnD6B
zxx8HazC#OqQK%L`#I34Mb8HpfTM`^EJ|&=Y=BoETz6Wx&>Cb^U#D;cx3B&RA#FFUt
zb_?OI-jrS6R|l4^sb#Q7uHE-j*^n%=MtB(j?;Ki$>9eak6lk@^3+jLYD<Aq&<mmV%
zBwu>B@ki1O=l!!5CYXNtfGx9g%dTU2f9T*IptR80)JwQJ+cJtQGiqQtt52aQxz=m?
z>ZMVw?cXe>HqG62B+}NuY}m=-^39q0F5={x08}4xsr({EC<4z-6>Rfy=I_D875Ibc
z!CGoj_V-S;ed&wRv((t|c8<O2!d;0v$5l1*uFKSe<e^3PH{pr%^|;5oLw_zSF8-`C
zZs8aj)g9CRncXM`^eC*%fW5IhK|mB!_&%6c3auKQ=C8@Ux+Q*aEk<iPRw!}dPI#t$
z+Ou0x?Z>h|Oxshl^;_3VNH!`;VftT<nE!)<Jd7Xozp1a8cK_U=>0e&OYMZw@r60av
zRc=$Dvo%I?^F^yE?G$_0#zF6lgJ$ki0(zI72{C?DCboa>XB&If!#&__{cX<0IqnmW
zgb>T(g3xpE84ZXltF^S^XS+^-Lwl12_htC%g#C#gh7k|eFS#v#!>RMZ9))qbYEIj@
z*1#+;9<a&II~r%X&mRvJyCgap>J{C%by;pr!rB+N<R%vFJi1@l&V5+6+?*tIdeJ!Q
zVLaSn$zl~26usCGv~bz>n0-BA=9<_Hyc^zVw}}rdc_1+zK_&CJ)o(2P{9e3N-S77z
z<LBx9E&dNKM;}mNhd9?Ub+K-NFYVnSRZN17i1}M!bk4_Z6=XSoZ|^f+6kYsnjJb2v
zR?Yj!OXGcSGiGnzs5F-}g_Xe)Gh>!^Qf6=KdOowL)wRH#_U&+fP2l!2`re6TnRwKN
z+3ek^^%@PlXm(XsOX6hv;>O5FXzOIqJ!gr5rub9IAG|+AY~M1h8gaySb7#R0A^`2Y
zhs*@oMV)BYD@4T?U|uSpOUw3KwdP2tJLNrHVqO%tmFs(X6G^bS?Gj>-oP-)pg>R_W
zl9uqyN~<L?%l$lsa6{by-?Wc>#`5Ytj#(QWB#lqT*gI{@?A-n$m^YKhQy;MBR+q90
zkwIk?(goJ4Z2IiwbWxg7P|2Qd&v_m{@a%xN$zrS3owmEwJXZS4=mt6ZNR9^FcRJYN
zs%KXi?JN6b%c2-FVWpQuJXc*V^^cOV|0_bX>;5r$Cm13@VM5#O5AnNKN@&$0YVMNZ
zV^Dh0IF%!t_MSh|-n#xwYhF%b_EJ}!V^&*~Ud_0esXBFniW_s-h*0*iGx&)liwgY+
z3sazm8he~91;*M$cQPg?iCIHAlxLVFWEt!~@Qd^+19@`^@#tZe(XoKaH|V6gLnR@x
zg_w_){xp__*w0Ok2zQkX)ahxvsKHYu$Y;3>BD4|Y^vhN#@EQUA8YB?jlTXKIT!o@Q
z{Pr;19O6{J_^Sgy@p^=I+K{1g(0^uLdzrX=2YcmVGQ0iBLre8Rt3|X0FshqIH`0>D
zPr)1oHa=@83vk`%H<T7mRcN#`S1roB5pk(cO5(t|?E6>N)m)LRz470PC-}d*tz9)M
zk2%o79pXR0JhV#Dknr_uAN6{<__^7he)QA%?Y!+yPPF4E%=YhHcwltHkx{w%VqBL2
zp<pV8bTUIdEfsxIE83S}(T}jbUk5$OgD(nVs?37658twP_<mEzdBT`yW!#tfqh#bC
z0@EkDU;iTU%y3^`@HP57m#!C%0kqnSD{dpT*{{Y<9F8(e3z$VQ#KArs=3>v)FE=M_
zz#3E#&#aN2WfhRLpK3*aa>);}nDzZQguB}Pd?a*E|L!ufacz5lobe~f>Bj6n1N9i*
zZ+i1jrur4hQ~u(6`9D^SLBxR)C<=7!Aj-AR(pV-OP&5l&y;aL9wX|`E;Z=fgG$3a(
zJBFfI3yYTs5L~0FWEIwWRyinK>}1y`wW8;zmlTG0`%-2YZFCNtO8-H9^NX~oSX-b6
zX)sGvaR)5%NPzG0G#`3-_;-8Ln1j@!n?E+}T+LJ*Jlr|ufPcD?#!r@nj|>OJ=Z|#l
zkLK;;1jRvsv>0|8MRwL$6d6C_q@G?f^YZJqWfgK;Pi$CQVMbDcII*d@m~Iz+09{CH
zBFnNhx~jvQVh^@W+a2gRvD~%YRx-}<_NVWMk`A7I!p<6dlVxvj-&=6TwbftB!`)r6
ze5UmZb57*61{3Q`a+@J$O^!nr@gL+eI_0$HDag6=zN*wtzb22n?Tk~}O*I1xwX<34
zNIsoj$uiwl{4WqEmUR;4FXRRf=P`TvEIPF{o*&D#1W$@+0*tAae(Xpsn_8Cw?}&2E
z4-PwDDVI_6Z<yC=Z^jJFzs&z8(;Lr52Ga%F{vHjZ)ljdG_dO{!+pX_M$DZirg~iT`
zJXVK)-xYE$<k23TwNg`~PKx*K6geT_E<hq%(04C=REdgPK!}3+SSK`i3_|)i#IKKa
z(glh@3qLD8B=O0ARUgxip??Z}@A;h}BHORLeQ_Z-{@NH*&Z+Zts{O(CcS(0NyIhq<
z9eUhfv)rz|jO9CH&s7rAe%^Vri5qFREL=(IQmZ5?O8W&*z$+_!E^-cH<vgUz<j3)(
zQuD%GUzvT&Gd*3L$B<*XlN#`-TPIAeW23Ly=-1lkUnu5{ms@%6)~k>hSz}yvZoB^8
zYm4x=#IAr3F;kwmHsi;HmsuY4S+sXa)3B?l<!tbao{!a)7drTS*7Ud%?t4h?_LS<y
z%dLZAmpDgO#a=GV5IP9y=y9zuPz^Ek2NMNHWzTa4w`@D<usZo#ZSvs@>$aX->bZaE
z3SaHxNxMFkB}+E3a?k+*d7xHch`F=VUhR8)%3XNW<h4x3SM~!^)Pn6(-aP*5Jnflf
z8-riP?H-8cwhitt*$<Y40JZS#b$7pe&sOX^Gkg2oc^f+4HgBQdjvdgF$I`cP^#k+i
ziarV7?0Xew-5qa=)n97hck)Awo}~JW^vmy<-%cQ{9dC>g;gf9C6>XI%Z7R{Iee}aO
zFLB;V)w!>p=ub|aCuO{C{;FM3siDgzZq4~LU9w*tm+jy$=gIwqINn*I0xKymRK+J~
zUq<hKZ;p<`?ULgq&$g0epHxPxkOJ49A)lo4qgb=4XlG%^te8f#x{?KMbq52D9V`N-
zntzNE-;{cN-ItY<b{Xhv4P!&xUU+Yfv5rqi*XbAMGfS6e9_7oQ+ga_Az8W6kH_bhw
zLt7Ti43kXBzGx-cpD%Kk{{JlG9V}U4xF#D2jE{>g*E?(=wLZ_ot<}+>%9Zx*$*wfz
zJ!?(3^i5aISlsl(`!d>jgEiBT>}4E`@?^^ss!QK7<tK3UW#iEg4t@wU7aZLx=OV~@
zd!X$*S(lapG0ZZ8Ej_V?rBb>dXUr)iW+t^cJhfdg!;?R=Q>^V>yY``vscr=q`E=)O
z*Xoic>nj=|j*S~_HZk6Y<$JqRQCHo_R;k0!Ory3NEnIZuGJkQ?HR4mDw>(YyC3kk}
z62FeAZu$<}<OS6;sU=@|!p6{gt<NuQ1s{~04*w!ap|KVq#B3zLaKtTm6fU{bZ*0Ex
zA?wC}l_=eR2izyvi&%9m9g6Gdbxb-+_{#xFGzL$6nXYu<wY(0YtZqR6e+rC5>-o26
ze!CHv#MB`&w*W-@v_qRPFf_e%+}GuFmYhNMD3X6G_KS3`=kkEYq}_D`(>Lq#LpB%(
z=c8mwPVk^4XQ)M^t1x0UxH(JVM>rmCpPXiN?D>##Kr8k6UhmTRRJ9lO(@!?J&(nV9
zMIzS};`3$s_ws~^CDKm4hscR(*kz8-_s^r!j%Wh=*e&04PJv{-#k2JeD}TOm@NkSS
z>oB?HHW*CEEhD?Qjn8MKhwF|L4UKP?gdO~lysX6R<kA_zQ?Ce`&oqpr4=@DE{(E_L
z<zx&fN1JJ<8~9MPPU?lQ9cC#j2=_f*shwIOHGK47NT|-nb&JybjYx9%Yk$ZgapN5b
zq0QadAU=ja6y6Y~usZLta>oa%x&%y;&$z&0s7$Z1)+ylTn-Av7>U(Ru>{T{QR3iFv
zc%#oYeros@VP55+Bbxfc;bWJ<$D>ZhE5+hGs17DR(QPw6MVoI{7rS--k`IZfUcrn&
zPQctMJGBNay29xaxK8Z8-EN;>kF9(>G=N9m<h@(8`?lP-h$p@_hqbFW^io`YTNVF@
zBjSI@w!UW+lEbR6BF8MlH?^{ERwp~PXm~EkC#|lh`+v|LqA*bIcDhtJ`6@D}`1C$t
zpQCyUe^#ZpKDx^NSc{*h97bR78jW;x6owctZ|SLdSysC({ovaWopzJ#R1d?CmB%6%
zHvb}d?WV1yRe<G^JgA<A&tvcp32z#TFHi3pwAlB&80xQojH-~nAE`gz^T3hgE6eK4
zt<LDltCGmc2-jLGB%x_=E>GbN<B7s+U!v}jyIsv8Ea?Z5Agy%3EFt=n*~!YuU01Kn
zC`(=4=029nZUS$6?u%C!B}<u7Zw`Mp+<06f@@bM|)#WKc=fAco-5Nh?d2vF6zd{({
z$$+E~MZqD4mNY|4o__hUkB|HJIG8SL`{3@QVtKcc^~3wrdgjOz(o$v~QO{6%46kL%
zC2*{MsmW^nx!%G`bIIbk82%5F!UDU>?IXwbc0cW21SwM>O2C<4#WRh|+9Fs2{`MDA
zc}nHW4R&w!Q*n73)idknlQ}fU&>P=7RNqH*FS(@?pdpYV%1RarV~VG(8Pg5lhXpgY
z2HVx!oIY@a9hjJ-x^(`AFFrcYzI>T#Lr_^Km~G+*gh>SC7~||uWBXYuW0g+xJXrPJ
z(Z>p7zPJ2L+kNTBj$yIW)1BULxFE-`hU_!>sFGLY6oCb|`^tK!dBjhJFpUnqF81S=
z3d6FkwiemvUOatXVH0shOt_|&5(hdavtBR9>XxnJwvB6kyaZZM)*4ZAY<PY4)>030
z`_Vl*!8~TejNfUSh+VACWY%yD1D;ULmZiv~M_vEqN9MOGFv3Hg_?0|Fcnx3oi}c{D
zG3!z5zh`>FZ9#Zw#U3@|^Px0J13%H35;Gb#P$17-NZ$1&bF!<1FAO$ZCvyojcC0{$
zQ{O!}pm3&jSYOYXAuHId)V<nr*TT?^y_8!l?!ida{daa^MobgwlH0C&&plQr`$t!w
zDWJ~F8S@I-3gvhYQUZ<DXiX5GAQPM<kBM{dlv24(>_c}Rw76az4^eZ8KF!GsRE?8A
znnN{hE6-b;dra!s+?-dEk4_G-xYm@m_jMH)&*gW#MlT0$mo1!(G_$fdEZ4qzef!AL
z9OYTX8ZTV0&k(+6F2ZJU*S(_TGE0p#*xsctELHc^HF@S5&m50mBYEe%0ZD(yl0|&0
zDH$^!N_M;8au3G&!JmtjJ7?K-npB29UYu7{PqDjGO7}@}ICb@{`-8m2*FFi;h=biP
zNwhR9_*K$$p4a^X6%8&w@lo5J1v}&h@7qmh6Wrs`2NsQwF~3(6Ggfj9b_%0VSH^6g
z($0fVeNI=~T`{8W37dxS)|3?7x*slew6f~`qsxwqsVgHd%@D4@jDT4LV+!8f@jaH2
z`&%D`a|{;jSKeyij^sIhsa9k^2#gD=U9xZmd#AR>P4Tl3_-`7=L&4r8*wLE+ZWg#!
z0Gkz5v|hWH*H>73RKtB)-2EhPbnM*0w;wLNR?=IWe0Lh;>Pkhg5n6Y;AcKjd55Egp
zPMO!!df`ED<O_%4mgO2z%~}z5=mA2d#<N=bq@qjE`UAz02Il!epIQyOkLmTOMxO7O
zk-WeBw<83)iorE!Oc;WX%ab)(IEUGn{cqJ3|G`7|pZ#h6DcTD}ng8bB<X`oF*JNZ<
zDrfUBjk0;BJD>KBADdf0SN3p|^}(iy!5>9j+6(tnK|4-7DcWwkaP>!75@~GtCFH7;
zd2EK0>^mJ6am~Gl*%HjR#?l4$K1HDEr_3xVKkb=y_Pn2O#s_ZO7Nvsvna(?ot?pj3
z^<K}8S5uolwWb(4Bz`$J<x#Bpbi+B@7KM!sT}JcF%Bx#g<+2!yEnnd2*Z-DQeeUu6
z^QDINU*yfx_V2s;cEekv>F<(fFqBKCVMBZ`EH(pQjfKyb%Id9JbZ79s&g=F2*7SS}
zeV@6iv|)?#^l2|;`A*<^ra@~gSyDer4q_g0QHh-K(c3q37vx`B#8w!$en0SG%d6=D
zZ<#7sCeN{wrC3Y_k*n*_!^w)5nI0o9UN%Zr9^1EXei)W~c-19|3#b^&)iQ#Tdx+)T
zrFG4ro4>o_-khMmjZ31sq-qvr_<Y}gF!S5oD@G^96R`%aJ1`AWiK-h*x@5_=`I|n)
zR28?q`%$`T!<QISY_Dyw>SC2L@$!q^1Gxf4+)0?7uX(zfo!ZOaU!r2}Fg&s^!Q7+v
zr~ZUBebq*%M7+RoIcZUJg}-{2T^UOWKg3H)<w<re&w!~ueCGR8*>>IKK-=vz!X9pz
zkxbe&W0Z0U&4bV+X3HI$`Z3DY)^YweckTONH=Am=cF)o;&YFwfS3Q^3Yh0kJ<_Q_Q
zrFm2~C89*i-?YhC-iK(>)E%61JdCY+R_)lP)j35Q`eID`;Mp+!tz_6pLO<@usaEi}
z<OOAMhE&}4x-0VY^%>q?YxK>r85^wRY;7cLflQD{B)PZ$9-ApSq>j&>wgX`=#TfFO
z+<^kkLPM7iXA_7ZjS2A2xw6>dU?R0EVEkr>i#%U@sIsc~MdI_ZS0B->p8r=XeEv;H
z{U7*O3@otRyN5P$RbH|eZdSL+y}9CD&(pXMyTR|{Ogi@wa;1HBd_{*eZp3to<u?}0
zaS9T=`O$pq#FtH1oTOflF|C<NG!VGU)p-V8GNr*2ixYkza}KN=nw_loMM61FeJg34
zX(uE2pt&>PXnlM-s6;lfqTlWNnzhioZj8cg513^#A7ZHglC1t;yZhl^;aIc#E|$az
z7Gg00Dttfr1c7DYt=Agcj}<0S*BrQ;sg&w<N+)T-nJvjOmqB*_7wHg7nXjbKlLjm$
z`Yht(WKf}NSHK?i<;t^%Ep~K=Nw|1a=+n=beDO6rA0|KvxglJxo1m2}g}(ZL<;H-y
zFe^nwUF}$0JI2H$77ppVv*^T*)c-c@)<)EYe92gqcb_%ae;c=dbA#dTGuHR(*W~s4
zc6&!i*qw-;?X>lh(h!L>?d3gN>#Z3iu}hMhH6}oI2=oK4<@<}oV1}@;O<>6QmVmGi
zfj_|^w7b7ci<q5_OaPsISTsUk<i7|r;pz1?3c4&Wk0SC1TU5=cYaTyv=qO%MxjHAm
z?6i&SJ8@D10aE#2x}g7M-N`aNxx_*PzCEaY^*gI^^}HcM+etEz<-)o|o7Ut}Y~9HW
zN?OPza$Q(&OX^15H7qiU%d|`0-3xW{R+ZbJ3h}JVS$B}Xbo}4n(5!z^7jz`|ujl0c
ziBKaz+s@tF5#nG{5YIE)%&QDv-|t#h)7EkDW2V}9kK^-JpRm^}_*{Bn(;}AylE_r_
z=Q^UpTRO>?SzH?#ai4RV;_Sva4r|uQjA8Se7rb+uw`X^+c{5k%aL%{H;<4<yzs}*m
zidPxm!&Y|rsBcjNw)aTq5mb#doMVD&khx5>lZlLs@f0B5){czFn&BD{2~v#<{Y?NJ
z8Y&^_agF3?IHa(x>r^k*bSmD$6|jF?We-}1&-Ff@?pS)}Uc~~nhj(ht3Ax37cDZ(<
zgg-OJi5VlmNC;&v%Jn)6iGJ3jZ$JZc1-vt=o60D-@<DWXHwoRh=~HAX7QUmn#&C=C
zwDbpV+D0!wKCZV|FI&2}l~<*7B|AcD=A-GVS2W64>{!-u#-u83Ca`!vs8+y{!+YVs
zf9dtFE80x1b-{JK2XeuZL4D1@EL}VBqc4?SL3Eq3BCb<V^c3@88>zmzF#hT3L9_eK
zj?HSHQfGYDELwb2l63dF#sqkh{-^JYhA6kue;WE<#kYf7#J^}iOjV}6MY&e2(8)5|
zVvOEdJ>MtQCP=Qp;_;quP9L7Au6uOkd)%$XE=LtMNQC|b^yvKO@b@RhS{_F6L7w3T
z_q9JtBo?1efB3W_`ReG>!ju1%Y`4E*nMt5|3Df7(lgQ7Z;NnhuyW0F&>fa9=7yOhG
zrMn#&ADlb0$S!D<8mf2Fq5HLBT0yeF>_cNz`|f(@mQ;Vnapt}i;}46p2GhxRFm(7>
z)UFfPy9p<>n)`fomfWIsCTC}Q&)E>O(nja$-Jtyor;@j>+Bw|%SM5G%`(+^KRqCg3
z!F+$~nXlw?3dGej1;-Z6z{te(07KQ+$o#>Gu;m`x_MEw`6c%!PDkocPu}k|)D5YR6
zb6c?5=fsvqtp&}DSG|*$h!hrs(bCkZ4(58TO8rAqvCT_2HRN9_9G1!sOc5rmTpCH7
zum2fsOsUK#p=WG<WBTk&VG+`u7);EL$4`Pi%ZB($9{E%Xm&t-yFDA6D6$QF&O6T{0
zU(y9Kwu!<^C6xCGJke?c8C+QltC1YDvpHP1zRfXn=&{GrpdZ~Tr!p0@-bLNHHM5XI
zsZ#il8k>lu`94NlD&Y&|rh3r|I_70LSo@1)IDl|HS)9$}1}8blDqZ>zJx!nJJ_76~
z4N8t8>;|OJ3?C6?b^ZK{6iI><T>nE0f_LJ7lvR*6rJu~*NofmhR9zE({9)%^iAK#&
zpY9S9b<6_ytyP4SrQp2geGBEp$P`XURPKV7!C`I6+h|zJ<Nv|6*c7RS)V{qJeR=BK
z>!AI7*tjVm==N#N^=&5~FWze&HUB`3?7Jm4Vjocrp!NT&ws_3$KRotDL;s@uXFeX^
z4hOyxIX$g@M{MZ@yHh)Vd~=t-rXsn~R~&z7{L_bHXlL<@^iNp*ZxYNup_SP`<7Ki;
zUv?POviuWPk^gDiE+LtMK?BPM&5sY#J><Sjz2baZe!H5d!GXEu4z@N{kZL~y5(~~C
zY+3(7HxG+`li7d1Y=6dZ5^<l2Z)6Yd_bjR(ec||y^Zi)D)aV-m`Ke(|+s&h$BeyP%
zAWb8QKas<;{@nJ@>-e9$9iRyQb2dC~Fw}4nh!M4vT*jb`LK!`@Krx^sEWv5;o}c@-
zXR#j{Ctl~6o*llMAZ-7CI7YVN?~n47uy;-Q>r#3yMm>@JAdtwb8~CK}Yff1>UQY6t
z=J^p)k%DEo121qWN;h)NNa<u!rmCgq`aAjgLB4mtf79M%{_umZ$K@>>)sDsZGl@mx
z0u?A&v#kulbb>+I-aqjJD;JpKZrBUXW4rPsE#B$W)lCZX7IcRFFn>JA`EsFhzWHlg
zo5M3_CVfj7uEs3=&qIY3`BZQxIFIsd#DsciDJa&QJ0_?5K!?-7KWW&A%<X11j}uo^
zmH?99KyW(c0|Qqt*$8Eg!mYuD;W-O?h_H=#)xwz$bVA}IJVdM{M_T~j{lEy;v!siR
zFWd$}KcoMmZ&U~6CSlz~kfs^f8-DyEb!C7?ZM+g0)pkQL1^r(nIY?COf^Qt+gGMMh
zI0WS$m-$6f1xoy<-pBBFA{mCmm|T!g#-)MZhous-9blKJDTh8g4|d?TBy>09&x<kp
zOW#c+>R<sGib8vi)}!1tRALqVKetgEkxn`zr}Oac@eoJJd-d#YC@W+)qWY)K;`~ug
z-r?RZqa6p%O)tJR_ZNw7CCUHFwdmA;Q{B@2I<pfERMc@*bUnZR<Fj{0Wo3uot$%#;
zLZ$eVMJvR^_=@;G5c!OV8p=FkIp$YEo?VP)RcE(hCmjzSIOz2D__L^u;qVeWmAhs$
zJoC@DvfTd^qRb*Ar|H<r_z>0!a>QB)81QBft}9#D(#!qQcdo<m)$6n8EGlP&B>K)7
zxE`CNe72^k$84aK_okE|fhn*p!wb%uc^Kz=gje~z)1dl^FUUT+aH1eoF6{KTdyu=p
z=;xoE1^)l?cZn|s7im7D90~52yYE|JQ4(c#$CDvBti$6O-zHIK2Pa`tv6#tm30%%&
zycwEv^5$XTGsio3wz7Pj9HQ47SRQpERo`Qpt;$-^6vlWnN~4>NAL`ayqgm&1I-jCx
zX_NA-BREMTxYBr9O|g>{nWvi<<|3Z*-fo^2F7cZ3=EbV6tesYOL<wEqxb4{C1&(>S
zEB>*FfyT&HV#aF_(B@$v;CILUyxx&GY9VwVrLhd*hCI~vWjtvrgC|SU-k!mUzMEOX
zlj7VgLdr}(UU1q+8|i-h092aS289}vZ00u&Lh87FoZvjZ$#SAE;r%bt_vM4EH1ts3
z|Lba<{rVw!28irQ#rR;|xp$oQwmQ0^UvAG><k!h_TyMMewC0Y}*FL*_;Ayq=A1rR5
zDfCVrdW3elvon|1QtdMB^TxGj3U0m8o@^>;sy3bngahGphZnD)Ss?N)ubB?B!_>ot
zii2iZ+S9vROM;kY`d9cr&$jN5ndqm+7ELT_))O)`zPgU1cCh2cr5XRY<)Z)N;2Ck{
zL+KCVU4kRL)U@PW2PazFwZ@nqIv|Rxoiga2p^lGnOOjb}<*DdSp(%iuZ9XBq9(U<o
zc$tGc&2`f+k^>G#z$?bvyr}}Gtl~8}Rczr7eYqvHQO%}wHxiNg=RyDX{+%NGs!sRm
z+Xu(2%60T545yeKT;!E3b@CtlnnZK|)%bU&nQd2z4y*YD6R(@l$z@p&A8vZUnD+R=
z*IqmOVd|0?g-Xd&VKy8tlzExmhYZho4tckkz?>8X0z#^mN8x)wvO>E9jp)gjYc#U_
zvgE=oik}q-4(i1Qe+W!1J^c2T829WIB&^6Xg2A=0Y%P6F)31MoE3nUVjHd1Q=4T*K
z3ir~I)n2tM$bR1TGsfc*=W8Q<5!@i1-vH_sJK!!I{gwo>c@bmq9*2IFJQqEQ%<;+U
z)Vozg30$+E6c!zjv@v@wDdAW+Cf9cNY|^tIFFAx1i|5BbfthiJ=C~nwrgvsO7_ODw
z{qlJ}%xqx6?fDOsT+c@685}LHCY0+0Zr}^3QI8IdrT-$4;j#0lFUc}S!fgNJ+~CR%
zvcF{)<8teP&;HANmo88}P<+jI%H`FW3S5l>^Fu~{O~BK3(<4|<o8FM;VsAM7@VX^8
zhpewOcxLtAp%j=*F+DEW?zpy1ad++Y=8e)3Q3NpF*}cMiv?s0)8K0~JekJ0*|NNy!
zGMZM`z7n(NQ0a%Xd6uttujna}u3ytIpn1Xfu-LrS**U=9tJeC;A=lO}Sn!JLCUE@A
zBL3B~!cH>tS?sS!0aG~dr5OPi0p(31fBrzi9)$gi4%5L=g~4yUFx^<LZ=rLPORo6H
zx=t&}9!q?#Bw<Po?HKEJhU$JQtb0W`Xw|PACn{*h!uVqCF0HxvzO}6wz1(!ZVCuX_
zU5(RqHpgsVrfBN?cI#&G%)!a{zZ+`~`!LH|^{*6bWnq<N`@)?xw&f*F{@nL@gJ!CZ
zdB>GZT^1!4<=S;bA>3@##R5`q+g8SB;bujGb%7g>*PVL*(X*7?et!OTZ#y><rq5r5
z8E6fD<fU_%l`^3<<R^XnO_32ZIcN(rzriO(TefN7!b4lX$hYpTAaAhdjnSw0v~}4H
z#B#29cxmeOd6+gzB7HvxzS#GzjTl2#?;;IEHTP3eC|pY|P{wjo(BstUJ$8+RX<^s&
zPcJgBtbNmMW$S6GoUmf5_1dv*lsKeNH*$Oc!V)B=am@x1Hl}DKTRyKm!)f)lDLa--
zsk6OoHl9}K1^yo2)fa)Ncid!OUB0w3#WKIa^IhYQPkgncg;w9y!c1mHq(3{nWm>kC
znECnEn+ac6JgGUKaC-L|pO3mxO3k$;m*Tgq>)DZ}{-yCaKPTNa<ny5~YCBWa&x_&x
zAPR<%^T9b;B0k@dk>@m9FXL@>W6{bZeU@yqX{zheb{yK9Gq&K=*`$D8@u+UO2}zz7
zzyIb}`4c|ttCkAnUAxU~Z(Z3MbZUzER1R}m@f1iW(4JrHrCP>cS?#eEMA_UX|8ozB
zm1@;@Gs|nK<DOsQ&yRBpOuhF~2X@nDgBGm7=Db9tq4RxHrHFS~jt`KbOo>A;gilP0
zr<w8!f`m^JK4y{M?${^1%XC@4w<}XOO`g{0d&&E4nvT|E6tQFFm*=-C6MA*~kgpAg
zIm0o}-yv=q(r14#R1Q2Jb=t3r-+zoeJ@Pq4Ctm)e>%c;xto+{dtoeie!al;wY|t-V
zLaF%pN$p=G>lF~yS_JAc_d)FnguO1GJU)*O*$nR;_ZFOFj1_>;5kHd%FD|cK9@#5o
zQ$AS<AA44C2w8XQU!=2Ypwx?7MQbc_Q1SOTiT+#$K}m~J>~~UzdD22EXcadPBdN1s
zP<^@s;l*Mz^Ijp}JmEIHzJcOScCq~8I<>v&6*p6j6T(oQ=eAY5-PhYqenloFqlF86
z!;mn#_PQ#&kt62?yImEiFN=Mr_|4jFM$~60@uO>f+BiLC!m@e@ao7pjCnjp8!y$ma
z#(*d>8_oGqfrPJ5I;s*$`M6e?w*E*{C4}#GzD0TOw+SqIUKR%^5Ho`zvB4gDLrr|U
z)>sKsD9)<H>Alp8=*8=A8SQfTXL{>CV3+p@EqtL2u@T<bvsR|iCm3BY{SeW@HCBOT
zAU*``_o7Tn#&Za>(cB+qLZ0auF@~;p;m6mS;nlThXBn)l8gmVp|BLiNNG4_?f=$TN
z)WW>Y&w%cTSMlJ*F-d8EnQ(b=<#JX+mSyXC(}G*ON{mB82E69Nd#6b>a_IdPB<#}{
z4#8*w86ti4LuumB(s+4Te6lYM`G%S<wf%W=L{`v%4{8m1Jot3mcw>%rv+@pjyw>zR
z7e35;^pmR6LQ_mYd0ym}GgOX=u}0SK^GW&I=l7Yal8^Vvv=*A}d*(9?dh%&IVBm(!
z0{dR|^r(U0roEQLnmbiTOIoM%j!m+^V~kq$TP1lxCIjvhEwTKkpWn8@L*y%+oe8fS
z1zX8M`}_C0D+^qZv3c;I$o*`83Q3&$EStH@klypkoYkJDvzS;#c%}-o@~(6Y8{5;f
z?<b=@UfGQNH3|K3Snz{2$jgTnGDPt1?`Khu*@kvt|ELN@DXNolBeJ=BCqe;@eUAy#
z*SEk!F)%VM0<GVV5NopZ2e+k(=a(#X{pRQ93M+u^IZ--M^Sxa6CgzR7BUU&!Sp4Ne
zNi1ukzYcLX(z3YoiC)?2d266Gf&8PPS*Go1c@T#apqf;<Hv}Dkn!(O^&*w#u@~SEn
zc9}Lzr3@X7{jl)ukuY4UNSKpXbv2grcqJ|2E()cB8Er}yl9H7URPxwdOJY@Eyh;D3
zz%}X*S>MZ8<Y6Q^^3~{ic~U?hE`62X{5eHTGBU69r`J?a?SWJ=D<|Ef5?5E;BO}}n
zd_$3uQF+?aT}3U{&gS^|y75~(FAcwm?1U#PP3$18xz#at3GYYzsA3ozxu4ReWqwcx
z>)!KrkUs`ZSpz+e98;v<#Ib)X<vfgA+B9Fm%6N=6%|t-$eVC%naayPPoMp+&OcNI5
zwaB{iDsCV@7c)5fgbbBj(~f?%K`&Eic(E*O)01@Hu#37VGLP1xxHqP<GQr*D35&ve
zU?w=(yW%yAy`c`aHJweYhht{rJ>|SV1{LA7RJ+m1c1fOHrzct{f5V5O*qiLvp=okn
z;NEK|PUa@MhL4s|c=x{N6jnr{jXNWqtm41GOJ2wyQOLC}RvE)53J34q*Lv@N_HaNs
z++M|8R{_;kPpex-v3W;fVVl@TWT3vOA|igi&C5iofNGrHGsi{wq|%Ef_5}v;m-U}L
zW9IbBue;n)EjekI<6}U~h~uWP<NWQjTG}%E_V3~hJ9OWa7>yBBZ;e8wTvwf=ET<KW
zyx6!Qy>slNzh*M}+LU$7i6V8LCu#Y_xv6^f)sdwywg`NP%3#8+@ftD+$HCKmw;?~(
zsL0Evp?2)S?DGjRC18XJ8Wu)f?(S*~LI>e!yIf@kdj-lMWZBpJA`J;pp6=?#?j}#W
zw+wE3M@|zOzKJaSMWPbR=@=Dl<`7|@LLn|0v<#v5B}HH;w}YHhDU?f;B?uPehXmVg
z(4-KEcF&`etZ_JUEQ~Zc88#tKC=Kz!vo9ql1;oZm7<nbaW}(j1NexAPAs!2CFIncv
z3MQS!X0e=sfa^K~fh+m;2Vf^TCtWBPNhT)aLAzWd*=z%%F_%kju0cQA)xyLxQS7Ta
zZYa%P2SYIL)4=nDS40xXhk=eoMM|&`t+o4%Y-IfgQsC?S1_CoBmC)ZzcCMu;p{1`u
z{X?Ey)oMwY0Ri=7aJls6QX;G%Zo(4$4l=|C9%^tbF(12uBfm%{jyqv)E&yi(aI9t)
zz`?})zo5K_B!NyCR!OKR2^7%U{h$mV3a1mgK(l0K3&UAG4|^Ho<v_(2Cd=gZFo8(3
zyU00Ip`6n?LI^0vOMo%x1NJb69c(4b8^KRpGOkT20WaX-P+B=-)Yh{@Fy;kQaz)r(
zj2wzkZnpt}e?@r-B*ES=EQ?Ul5Xi|)JWTKwPP~8_u4iz0XmbYo(FP>gq4JJjBnWTG
z&tQfjYz{fc5}G3f?gS%;QE@|eKJeU>bXel0aRz?$l5tB)$ubx@k|-A^+`uj&-j4FZ
zV2a%Xuq!5e;2g!6C{|7iC^YeheUniUhO&Axn}MHc4#7wdAoVxE9HmaKx<J9C{Y2U@
zG5(kwPZA0g@uBCGwBs;Vd<RY!?a)$TDAJP&i|<@E4%f6s^2>a?(hlyhWpgYM7RMmO
zVD`gC`h<#w0Ju->-aOF489=2W(`1=vJ<K53%x@hz3PL#zOMFT_GNBkts8|c;qP5of
z0I0kTh-`-VPX`S)1M{^T*oyqfXoaC>--B7zcVNDhfi18m(>8E((It!eELy<~WU;@q
zawLUvN>rRwk50%#mrep1`ou$sQ^2(9SrhV?jQdhb=EEk%6Qv!aHku%6QZmtDO_-*$
zKn6}?4%+!*FCd!(Nl*}mnGq_-1+!uHR#$-#6ah6@`WY?#h#aY&Tq%+R3V|zq+es3X
zgkcDw;x3qt)>;MwWI{SX?gdClM8ld~$wNDHZT^6)2*cJ9DrW_=01^;N;^N;RKe3K5
zCs)Gl=w#ad0r@!$(;!s51z`28-9raZ2j(B0R-;GglPllBQy|gt7wLMB_>h|h6b$ek
zAJB#^*@$rWWue2$aKS*DRDe^v%fePPuqI|-GM-2&k$|-)6K^_3_t`<0ia-UHz=~>E
zN2rr4K}MT8Df&_)+2LvTiozYWY_=o9PJ*0boCEs~_h*#SY=wRVWPh*s`-|B4m>gFU
zH&Wumrl#BmXJ8LtI@dE1b}#u!x^O-VPjx5bft$(6^X<CFaU)f}9KhXx*WDwSBkX#d
zKpL&xfnduUevx2`$mSkqH4D3FHvmUtvV_Im4Z?+JF-BUy*AmqMkgSP$myj(dnbi#J
zqRa0^L#F_V4ljcq?+9k1wcAl#)~y2%-Avx%FAai@`#v7)O{Osvy?!{Zx1+^VxJxO-
zHsC_e8S^2^HoNbhU|yAJF&1zZQRW${a?D=VcGarqH#NH^T=SsL*I9kDZi0H6sr9L1
z-4kuAEsJNn!$Glo!H2F%IDaL=-3{{Mu;#_*g)cWW5uS`{SK3O}?RVE|H=*wbhriM!
zdu-(<09wXM7{uyHu7Z;b0K|!QWpT&I%~T?6DhpF@KqllN!GmyC3d;~>_fej73uQ*o
zPKF4>+$^z+jDd}y1t0Ce)azlV6fYs$dYGR8tuLkzz^&Q_UQB=c<qiyFD-34!_yM|3
z713Z-cumI1O|-xd`$a!od?q^4G|~NLaL3SQlnA~<$7TB{IFu4fi3{waNMkM)3Ck*j
zik<J<_ZOM`s5X92v>Rl(`WMbyj-~B4ZS8yXe9_ve=Op}Ppwk1w5TwWFIdp0YDD-x0
zB!18xkZY|l(cfKQ=u`Cu=0RKBxBrlSNzfP9T>DnHP5ynoUb63=c307>KJ4sF<SdTv
zm@hV&#%5h1OW;abj{Q*8P%?PbXit-Ote10|gQKO&*oro_Fx}%{9@%sbODRh+t(cq<
zzNIjSwiwgkhjLxQOLXx)yk$dIJq4j{)=@*&too%V+gojRHwwOuXsfOicYWQRPa8u^
z8-d1YO)9Se_tXp^kR;*46xK$R-Om7OG}{}+R=^byQR1<VW;zk9!NTWLM6{kHR7zoO
zV6po<a@2*h^%;MM1NYrnB3QZ_07aBtr~+^Zdw`syC7d-5m#^dx-oqz1-ywqfAwMO6
zJtPSir?B)<_5dYEUpOni16%p>Z(v9>g9w6(AM@LP^F^U*3JZ8Kdw`K+CY%Mg7F$^i
zke&=KpVFL41i^U&C<+`@xC|hnM;363S&G5LjMD)86|O|JKn|^`&VVX?K<9yVe-6_a
zaU@h~MV~)r0L}UR{XUR}Jfa*O)d8!<O7N%bS|L9AFboHL3(gmDGwnVKwo3FJ5SPzv
z&IN;r1)Q@Tg6}5LZq`x~5H6q9Tu1~dTmJ1c+}m9K8hHC$1vGwbTMfCWHj~pv?S7!R
zQK9IEWFix8Ll&JYVm@uGqrXU#GHwiP6<{btrs|}y)*<XcDDV(0l+>l*a+bt=26tQr
zc>UFjOkzfQvP|7hjS(P|9Kiy3pt$dcQEcFj_{9$ZtJ)%>j}qstBzs@VO^A4x#4+J@
z-IYXDx|?D{ee;PHm1qOKhK0_Tn`iInk$@Qn7tt!vQ3W7HTstkS?)!yj*|fX0B1h?Q
zN^>1?rL~fn@f`$6DsI%qUk|f?07UT0bF|`mb=`Z75otnYNT3Mwu(XGH9Ax0Ouzrq6
zkV?LpD*{9?ICkR{)>?!;gya+or+P7QIlwl#9dL^-{uacRJVrYo!?6M2<`k9|${s><
zDsf1o0a^A@VhwP#3Be+?nqLV0Rlrg7h>y(<!(YJMONdHjWFi~w%wb_gmYCo8fET#o
zT<j*K;f^j!mZ^8p80HWvzeoaQw7L;mTq*rUsszD~OU~)Q@qQMz8o|$9LiVm;R#7p3
znE_vDt~gFeBLWX~+*q0q{3L1ekH5jE+M03`<zfif-2C9OW13|ALM%a+5|GjA-6(7|
zP=cr$$vzLc31A2^fkHZq)g^<=(+MNdV&QKHlM#JjLUve~+@!`Ziy+Gg7GK0f3^WU-
zmdWB`^cHdA0U4JEE=f+7X;`H(oJ)}B3KmcLgaZ`dPGv8`<{?iN#zj6$R{&Kxqhgbp
zCNx{Lw2O62>!%NlBLSzxn}o<`E&euGgQ%$F>r*HWJ_Qd)?Y<+p@jCu?_-?EQ-#saK
zv}l5n!f2#BI27SJDS#W4m1N&Xxd}janJCDp)7??V!q&h9V&EcRkm5s$2q=ahuk@fI
z&pEpl%=cQDfAB!$FOqS|a#5!U9xLiJS{Mx`jq0)vY|Yi*4uWGB!|-G{yLYsA<dN<!
zDy{%h%{!Y8%%3p;pvK1PqSj<QZZp{f_XIxXV#75nx0$djb$Hlzh;_VfOq=g}`{jk4
ztzsfR#-WyxF%4uOki(klPLp|-!_$d$_<TUFZO>IV^V0FtXFV<7Vy6?c9)pSHoxlha
z-&5zW&JmF3R56?FTOZdK6r8c3uDf+(BIm`y%;Ww)zniHmXEkIAKB%cT%EW&gqtLbA
z$y~^FY9I#5J+!B_B9-9;wMB!t+zz7X>i|H?WpyZf7*dl{gyQ~iqpk?3gava&KVqN3
zd`HLpD+g|avY>iC(43Msh{gi+8$q7B2&WX=ihwD^u4I|UFpXhHf~+fmt*cQlr(jz7
zzyse~V*VWiiO`xZCu&^>tyhST0ey;v4g4fZKr|}JqY%=A$b=qXqJaSRu12Yxfr+`m
zp5}>7wwch(fy#8Vj>}9=!QeuYKu-S+iwIVrHL~Tbe+TWbmJXSjWEE|}V85;YPWi+T
zdDTd$VUmzXt=fV4hDqwBEzWPGYOT&zjkU@v2>PN~eDBLTGcS!}*=L870yIXd_zSTK
zc-KK#dhlms4WHpw{*dX@ypqD3M#dYyKhr!fZF*<F{nEYSbMHRmG^LSHmwLNzF1T?x
zAEeJ@$#52TN)@aS1gTN<DMKhtXn|BLO(rapWtw(s467659fDP8%}Y=s;UvKCZ<Cf-
zfYt!qh^<2r2zN>;GzQuLq4vSBJ)ep9tkE?-@R4*1nK&ZC#dKjDtH*&yCrG`}#S`c@
zL1S2fAX^JG(3)Hh85e^co;b1_TGtcrVRKjez=TMEgv0>|YWyxYApyN)3U4AkcD#7#
zr323qagYXD6?s&{r&<I%L>#D*>>rbx5ChOG;msF5b`>Zlk&X^m-1*}RJUwlowHWy2
z<s{2AD{An@39`KaI73Y)M+=`)$NFQokA(36x(}u+1_Qxtn>T6jhD4xiFL2`{P_B$6
z*!BYT39_R=8?8y>$UveUn7{EQ<VXgy67m*M2LMC1(qV680rdBFQ3qf}TZ6-a+$;S4
zMiPdku#{Qsv5s6sI73AXw%iF3odSzHIn<I$Tmz*P+Ns9?e1eL*3MRCTfKUApS2QUr
zdX-&jB;$#qy=4mT82A_fKFJ*Ujd}tl6WRt5D5#M-CT0B{0hUk3?}#?HiTDVcyBy0U
z@B`?u2Z{F9niAQ;6+kBb!mEbBNNB5(2^~P_BZ7@+O?($iFe2*ohL~WP2@O0U1`rp^
z$$7XP0G>jB13C*f@ws+ktf2-v+{YTpfiyX+MIDzf<oktwIOjtyKUtb_^3;~@wm~m4
zZd}Fp0sgFBj*S1T1e%l~&Oa1}!;J}Up;c2x)qK(kVKYd#z{&vBf3Opsk9No-B8rr|
z-i`xbtN8)Y0lAz!UJhrZ2CoT_MWKVqxy7)l{w*SRPueGIN(6-~KrSJp;DS#~JcT2G
z*K<JnE3L`7{<|ma(P5~sS#3=b9frX25@U3!&z)fr6g*%7iZVIZ(Bf}UHMJDD9s<fG
zVX<TvMRff+qYU`_vQe=_m*uBwu>I6X4l2uGKsIFZF`yP(6+#gMgg``RQ-CdOdu6PO
ziv;E|60Ht~By$DS%dFAGK6GLd$O5MxdZS(z7K?Rh3Hn6cSxF9>$YGD6bs+}K1DHh_
zW&CS8WZe;oErWy<T5HUc5ste8KRPMS&khs0KLoeo^9Q+tGGu%hFfj`D<)`rsc*_~_
zB!wbF4hN3V(S!zs6Mm3}9}M9K;qM<hAkD_>qz)NfVAcXrr;s$`O&GohI{ktx4swSm
zplxVm;ZCsq-JRV+*_VDIqZ4pBPcgx96WVeZizb8CZfar;37LSjB1HS@PafoU1Ddk<
zEbua+wboLAy$P7tkkLK59r$$Etu7!p<CN*Fp1bZ0Y_9unADO|Ia-y`BGA}ULz3m+b
z;ZEG4@<i+YNyuKnsIV)Yy9>dYaj-!S3;hjf34m>Y<FB%)JP}D~_g@K*K6j98Y@rxk
zyEP?*!WC2pI+ZB)Q!oV&=vSr~vu|TRfX%;r0d7`+35^T`4ADR<v#t^4>U7}1D8^Z^
zOFg&y$=E_FF<(q@)r1Dp3_vY_&C_W_xO#tpb<6~?TYYf8N>n(h8p)r43tlit3FZnj
ztAwlasvjkm!<|C8ZH1+?V5;J<3{ZXvD^ggqVI)waiu!Qtz?3CHPbQinOH}=GJIfXt
zV~7a!Z3=4^DgvDipz&@jj0~VkqV;zA8xC?`*Z@boM#fKHLeBLtOA(AFSvoYitSFtB
zxfl-LlflKw!Eo~}bP;^P>)%?dalJ5HThtztEPV43c5&KTIMRny9Fcq#P$CD?x5$Ai
z(n|7Ypd1DVDf5P_E}Zw+;twAvkv58^aGBK;2jcrW0E~c@$H`$pLI4n<25zDgGubfo
z`VNdnzJm7L0J!xcIOy=P90n*WQ_7_X=S6OV4x@joj%X0S+7sJH#&pB~fCFTJdC8P<
zy{XrlV9P|`qkCCg+)@$_VL1!docH?~`N9_eL~BKIWd<*Er8(VU5Esu3O2|&ja=rK<
z^?c@X=KU(wL#{QuzL)2J5!d{-{T6+(;c{Io!TBcvbAJy&7tV7W!j(X(dpjCTNQbhK
zNws(urY{;WLyYyb5SLdsZz!qk>}ZX7=UJ6ou%0K+n5*~c;)$OPI<>N2*)yLbeYK|U
z<I<(H<=mkNPjJ5QvD{bC=oz_X>do;B=k9ZN24i3@HJ?-@wnFB(R&oAe>=#M1I?Qk(
zH*ARA9ihIg{b#9l;G@%b@5Y`zp;_y#GHm*`>~0AW_l=R;1WDaW`OZy9K26?zi0Zs9
zxaf2CdE-0Y^of44#nTo$f7lu$_UiBoae)UsFF{|4z=N@r)mrcanR=*K-*^FU;7s1<
z1K0fSZ2Y`rq)Oubn)$QSPE0qwkV(s*)c$wFE%{f|-+c@o>{z-za`hv*IrGZ6B;_6H
zO&XjOvnz&M&8E7FoDMR?c`tw>%Ll(sn$0V?$3_F&r^c2SoxY>-sx`4;yg4<IV{o8!
zUa7`{VPm@!d(8|?z(D{}f-9Y}4Q|TScp$es@ul_Xw<U00oPfw|)g6l;@D`A<7yMVe
zq{nQ=Y&U+9+=Hub@pkdvt3J!k%Q3H2J!F6D>KBrv`h(5LPI#wct=+<TN+`YvkYTAc
zoMlB5(sR8H$OJr{Cg!o!SgvS`pp2EPUjEpUtsh3!98=0#z)mu_b86!JwoOB(rRUO>
zxAdT!#<ZF{pk^9%@M@Q)`_3A#ET<`zn*)~>J%6@8E_dY;In{&n_RQX~cm_Po;nHy2
z8KdSNz&*}^I1_62*L7VL-Xo^@#PZK!Igk9+dA9WmO$pYfj^RiBpC66$R=xBk+sw*$
z+RIYDjxeOyS>Q~;qCJ(*)j?+Sz|S3n`U)#P=URCG@HLN4R}Z-rV=n%sMzY7{FT;Q#
z`XASC$BC~*uO_Jp8HA=!I9oFOL=eY@J5XDxRxseOa_`9)pTzT5#Lbr8of~~u#l%;c
zL>mQ?#>=msRD)+Dwh<+^rxN7IY_xVsA>6Gh;Ka*l($<^FFA*;8ah?dB#Uf_IK}D~G
zpCl?9w*lRnuKB+Ex^B88netQ-pAV^O@~ABe{MQ&NIOMaczYMB=GfW%uf)C_t>U_Vs
zL-T8eb&ScY7`@l6Z8qQL*qmiN{v!qY;#e@nX_bAiCLhZ|Cg%1}D*oLAm33pN?M|0n
zILj4jiy7aAooC-+l3V-@VvO|a%%2t{ah=Q_Sp1+Ugf%N@zdLix)T@8Np^J8-mI8Z!
zx2yaBVG{1jv-n`csymgSxzSOQcJJJFy;LesOe1S8(U;SsG2BK>f6hJRvtCA#s7+cN
zdH-coI#E&gAbwfvbbFWL__N=y<t}JK+Cwv@ED_Mq*XFNCv=91+WhUdts)<!4J0VN5
z4y~1(S6ylm05!}8#xi_dc5(Ad`?~iBZ)>>cejp{Vk*Z@qZhHNO!F|n3dg9SxM5<d*
z<^$Ks_S@d6ZZ(<>k+_aywRFV&=$&cG3%qCEzq*-xm&M&#4Gt28=<!Ic(uBmyJCAXr
z8$I!2Q3qR7f}i?dps0leXNG2tK49I^YWB9NN1UmU*Cre}Q9bulZBNPaXYr<?X&dI5
z-~ZC9FpH?qL2jltUL;~qlJ2Xn&ui@6Jj>9pDH^wi(pQY2i@V|z%Gk$SFRbxZ&-W&l
zG<p;xDPP?R_slc!R9Bm{>(VMiWU(wxWm#%^+vynXl@X@t-&>wd@#%UwbGB@&v3Jgh
z;kLU~v*R{VWH%uyIF&bEG3)H3_40l`P9YJdd!`$$Yb=tPMts;*7^<}tRjN`udTO2!
z4EYo)t|d%duQe6hzx2uKrs2g$Kj_##GunOnOI!8HA5uDcT!W)8>5rH}k`-0zk6N=r
z{TK_u(UZH|2<hrB4bXo>o5EY<pgCBOCN~hTf97^{ius9%imAu<SeU18tPo>{Fo6_=
z{vyp=eRv%`)ZySgKk0>)L^b6_k^*mC^OM4&qeqQCUK~BQ%}f6Kl7>JZpLlhH4}yW5
z&wS%gS99>UkfcXHDmn})Gukk>NjQy4tjPn8rrH!i{V@kA`=~d~Xx$NQ@}v&y9tuqD
z!~WvD1*$O;z9Ahm1C>_wV*B4muGI2Up{Z+^StmXi9W~>)p|9uQ{(TGl_kHG~eaZ-k
zb&rfF#PmX*^bSjHLe2Ga`orE4u=ooxE;CFo@aaqHJ>A~D<+HvmbDSMzod3Re_{9#D
zhSin@X&?9OcNx(Hksyc{kB0C;FnQu%jDB<I_hev8$HT`wzsi*F-e`HR?nE^a#rz5f
zcyYHLJ3Y{Q`xjp86VI<(1N4p<PUSqyP7l78>XTY#|M;TqMz<HtZM?g1`(<#?X(-#R
zH=SU|qP#xN7zI;xiSi6B&Lq?hJR!JsX_e4xPt%sB<c7yhGYvnS+hqII&LVhk;mP|}
zmd*#mW~}*a_I&^OL}ND{B;hh>Wv}s0i$S2yVzhY^g)nl80uC_s0B=v$oEVvKMIZG-
z{xOhedM1TW8}jZ%t{J$Wd=2ki|9CHFXX5eDr?-2ZsMGH=#Y@xf)?b@&r<rlo7+jDY
zl$Od{h86jdEeD>P5lz_|R`9alfK~6lQGS-U{H-&Ke~N`)WThs`QVJUGk@eJmuKL7G
zZR@-6Ga^}gD9SxS+dA$6-R<#?`e0ot@<({vnQP6<4UF&dNLcxE{W}?=Nv_qE!8JkV
z_C@;^{36K@&=@T`@XDaoyA|!4G<h9myX^dMLhO!)Y|nS46&-7Q<r-G2ITTyYi#qEd
zw^4%}-UPWhEEhPwIc^zNus6EdRYyknJX;<%b0{?VM!8m5mC5l9-4;OpVl*Z#K6|-)
z>}}qmG{rBh+t8ZrGt{-NZKnCguIHKO4%M0EgeBT<OS;BVonSwKWg7N-$4)<nWx7fk
z9_!TsK_+eKiwst0h|01!@$~XG7--8kV6qQ|*KSH_ejmOsp*+jGU7ly~>dhx!$(~D%
z`Db|foxa%2_B{vVEZ-#B5z`a9zUr-8h40HtG<y&Wf@53k!Lu;X7Wen&)KGqlvKik3
zc*1Vfg7v&OI9FrFFjN(B8ccJ4as0i?ZkH`vdeyv6=xV$^Uw4zC$_+MyraFB^Eb*@I
zkF<I`{||BR0oC-j?Tw<SSSTu>^r)aH2q;CQMnt-Zh!~_rqzMs_-pN)3q>G9uD5!u)
zjYzMNt|HP2(gFdbOF|8hWWO2DIrrZ0-TQsx-uK3MZ;#=Y@prPyTyxH~)^C>Oh}`nE
zLetLAHJ)#$No}EN2Vu`XPMBM$`QG<5FF}ZB!Mb$}f3OKF(4eyINKT_oex7ctC;Cpl
zTKm)@oGTwl`laa_$uSPSE^eKbk3ejBVV)z%y26h5CP5hGJvdxW<S?E~yS%G>)O3WM
z4;AZ|)F3;vESTc{B39zS!{R%6^?ok`dnU8qAvspusK-{<KH{sWb#8)Kujx4K+EOKm
z(+(xVxhLvpEMPruDMEt-^uSNmsm-HC+Xi%utp~@5`x|mD^7ijxGrm$Qm~{PgmHb-m
z{EFjpYc8k^zc*dP@G0$DSkhL5Hb7B%OsU8Al(7(bkFu;Yn%x+eaWe>$u7%Z;0!k>c
zI1WG8qIZ@~a-S-H$@<9~$11tT6zwg~aZ5hf-HA=0R)9Lx@fMWWe@F9;-dJJO+d|pv
z-h3o&|DsuxEQMwht}TrJ_`(s&(&etPUa3vF^4cLR-dY<oxFQumH2uq_@W^PC>Aj)K
z{Me65?{X^a=G&+Arx?2zvIj1A7*VbrxBr{vgCusz{y3g?;P<Q^uQ;_(NTUiI7TnO$
zJN(<lgMQ9Z+M=qGk*L)3ZGOW|#m~D+YU&ejVa%^*e|5=jh-)F;X-8#&-(Ga-U^`=X
zm}lVrWJFBoe(Wp@k(Q>lNZY@4z4Xynu4cYpqGfCQxafF=Ed^j=d*=6J36b$?bAzWB
zr4~oIFAgT=rshkd3g>Q7z7^k1&02=T;sMgyhzSp#_nGY9EIn||TJm;sLXx$K3;Yic
z(r#J!z!q>3Zc}be*bD07<nO+nDJk}ip<UJCx>H53(kF$vc2$aAdG-9!5`}NbaL?B7
zIbiCB1fHzv-@gkXz;v=+qX3Q*Yv)WPUy9Yd9NiXA+8o+8^M)5Be;Hj-dzhl_?i4_a
z+qR0+vyUUG3dw#faJn{;R2^>}Co@>TGW?P@kVX}q$hjACnnlNLUWTz)kOFsz2QnJD
zk0Zv<hqZ&-wq6Z5>TwM36=XbSvPbbbCUI8FpQgzD)6$=EmQw|F{Z2hb%eFby_EGw^
zUMs>E=Hu}Z5cqJY5Yj%T0Mp2Q*@qpCLIvo2SC`(HnN>x`)4vGNDP&@#XwQLLum5_y
zcTQT0R2iB6cst+i3Z?6a>Uj4X-ZpJ|vsguVhH)bfe<)rUO9J5@UhSC%TQ<kx2#4da
z4jZiI*wEiBzb~PFb4993Nj(*;(x@;pwzNDfJMdlX;ev#}uw((B-}P8h{H~j+#}W-p
zdjmw5%(2v??MeK8A#yKu7vTK&8;M@vw&W$!4m8Z0$ji~pZt2i3;I}IAZ_+sYo=fSU
zWp69hXy!1Za7Dc7wUO0M|IQlYTX3gK|HjK%)BI~0O4F@N$W$-jn%dyued0~;P1Rr{
z17#LR*<wI{u9V?RmggC=8!_4!U$bx#7JlK;u6db-iTP94_NK17>GwKzi{HF0erHxL
zVFP9N@uM?ECqd_YF26@F_5lbcJVpXlNQ@9vE4$=|CgQ+7ohOz~@73AL1_Ww7KhY!a
z9_?$6C&lv{WS(@%Khk{(lEWvludx;ZH?r&t%xyk4MM!A*A)DbA(SY3V6&)$%Vq01p
z%a^YG*7uyOT#RpK#Or-az2SJdyLGla!384u1dPlQQYh#!jNOBr6u0tW)rD&u)5;Ti
zUSRtZ<WfkL8`Zru4IIwNCLkD_AlJb@A=^L_W3Y}`p|5XeGuv`%#k9pfTn&h!4B%~4
zx53*uEdx7i%QE!E^mrV5L{^_m?i$PK?>^Cf=omRWBZ2x1IT}6yHZZwWhOrwuemX-W
zL%0;a`6ixx5l?%KuKA{MUO2n=bMR3nq{OMvwMDZ_fdNV~!9_fI+(n!bEd*D9qiBX9
zZe-vjE7^!4<dT8yw1t800Hgo4m`Nqbh~{l!?CyphFzW>n#}AqkAvpb-ab^fR8Vktb
zYiL}t19tI`AXtCC-~%9awl1FPUJLrB^#BB#nU?nT88jEq1-JNH;Nq)0hF!7>S%!;7
zD4O}%mx_lg;RC=lCMtbt=f@k;R!{|S*)l*dH;hGLo^4bW=tzl7p!3e*Y1}%{;B{y)
zjeVV3<qyAk2kw3nc)vT)Gfc|8Jq$)vV2vG3MKbiWunlq5aB9->SckCy+hH$XgsvY#
z*SNjD)UrTm;1M)%B8eg74M2b-iby>f4f``@-2<j922&QM>foDl!D-qAJ@YJ5-H9-{
z={zFL`MnH77dM;?986;f`HudEBZCYK-4s?u>>Av*;#K*Hq~^EK#|J!>9x~T?0TG5I
zkGJoHIHVpV83lBROz1+yPn;1|n+|m4SfHC_(xs8diLAi08xXL56PPFRhmb1Bh$?`e
z9(=)4S3_oCDq%z*+>Y%ug{8Il7ahWHA0z607SQ!$sS8k2?gAnlI$mU1r)Fitz$+09
z6<BCaBozzHF#_3S`htA$p1?%_lt8)wQIasvV(bG)!#H#OV3e;JCuh^BGBEo%)Nd<T
z7Z+&Z0u%qz(lG__YB!QPDMM3Y9c!oaGQG(xaHt^7tsetEo`+vQ5~K)lKw2(#lpR5{
z0z$U2GHm2#8G~gIuqf}XSb%ATu?>$y1hAb~dV!6*fW=X;f{#NWZp)DQWiRs!Zb%sz
zzRnN|BeyW3Tnhp52IuTJb2=BPXd=mh`Napmpv&d2vXR(mO8ds#=sY!!Fe0#F&9KrD
z<RV6tbrH}#?*&MZCFCgd!r=9#CIXUpyadL^HD*NT$;UuklS}T}63pNd%-~p%ILzQ_
zJ}^+KjB0`(`;xXNkfz%QBNG^;Nv{0@IuK8w1G#yZ01i`yGAdIJ5<(#QNQZzVix41U
z4mTKZl9eLP5Q-*;GNR5^F(G?A4Z^qJ0~X)t;>(~h0at}BCm0z3t_ih(19oZw;@X4*
z$dEZvZ7SeCTHMwExt_z*v_gKu0!I?b6K<jC6=Ma!c9&u3jm!}O;HE;;gl-pmK^z2e
z1Dnvd4nruOjK(+0?8g#wjTnl|CUvNi(B!^G#QJYg`B=h&3#>5w3a2jh6p_UB2)oFH
zr3IK$C>C^Zk-`e_a})CmZlDsHv|tD&kaZYQY>)7Z(MW~@vq?QF0^&y?E&#unf@H{{
zOL$;CT4+k*qi%Gr5mAVpy9*lI2J99eb;Kh4;+J4a#uc^<Vcwv$4Nq!!Vmr1-M&H`O
zUNZUkq;|)j4}Xw(-Yp%V0|y{k4;==8LiH(<5x<{7Q{}IGf49tGvFE;6hb333pK`JY
zY2Lf@I|{f)SVOyV{CpX^+n~y5(uM9Itt{$tV?HLwLd)~;IkblzCw^&>unX^UB3$x?
zUD@j$a6{)evy=T;w<F+yHQSa-n{?t>zU^4a`11;~cD84h^kVf|%!qeh#Lx5~E_>V!
zWOZFhA1v0XJB(jRBOXYfPmCoRinfa}z8t|2N+NSJBJkWHJ^*7f*<(Q63G5+6;#FiA
zI=G*+P-(cmS%&K2_?c@{B*^G*mSFH*C;)fl)<8?&PBs3`vfi5nyBunM64vG`G+{_j
z!%q8Abm;5$fMymiQa#+}*NM#xfc|UeAxsVL016F`G5EX+ec_|9i<9xpP%~iWQ><hB
zrf@arKK3+|)P5RB)2JT4^NT==124}4lN1#i0;WnI`2fqx*yh(wY6%ZAB}p!rG~BrT
zYq#`7@fj8W4-e1B{S@T8?Pt@5)mU9ZEKs=8wuFLi8W|pRfPwH^Y+hwsa^E^bJKYg-
zjuu2l*Qaq?S@zF_9Ix3ry==~Nv-7g+=eG$~o{7TO35)SGCFGh1Ot`xVyS~`~F<)~O
zxiyZIFA$J(5MNN`ieK-yXOz(2b+C>5GHLHEjw26YiCbI@O|TZvn1viSg{t8aft^Qg
z?8V!{yjl=ckBE7&Gnz@!Sn@GuquJQ8Z-^o^mXBHnsX5>Y14>|43zF&)KM%%6GXh*e
zCzzB@MDip8d~^|9;G(;d28>qN;sw!DfzGfF*iAti8oUeUutrCie0_#@ux3a@F}9sf
zfEV6J7lPD}gVY<W*)Eb6`LLtb%qCzX@kp9)f_~h<aVP_;J+YS_29O#!9>%_5i`cM-
zs4d_<kO!|Q>QA$Ov)C_g3aZ*dU&+3Ivq;XZae}=G27QFMlNuTdoSGcq)I>8y>pJ~8
z>`@r-f9?XOW&y5W;3Vr3D?=!IOA6c3JC3Ar0;Ls`(v<0Db%L73Y~Uy@z!7GFa34b`
zf9o{1qZ69^H$oIW5t?*_CfS(t!r=(tfb=j!sF3N_Z3DM1C)kaDbZ^G=0NaC0^<SjP
zK#E`pm263X`?UpJsGM-8oeT!q#;n24|2DcAK}FaATX;7YfwPwY)0mon|E9<<x``^R
zhX;#3v3G;{e&D>)7Ka~OduR1g64xQW6pPE*ORIv2!g}Juw^F1MV)*j<&S&rt)B=KB
zMG|jpXAh44Tzf2V+rhHe@1GnCU-53ZoPJNOwD4@ITv>jIA~m8RVEy5$(~8W&euFIZ
zppYK>H`9o>B5&42;hF5FkjT1fxzHvY#ym?7ZR51Qx>dV8C70J#g77&|mbQVdQ;L6p
zXQ^iUfZ0UX56gD0Y$3QWKUXX}b7l*pq1Y<9#}2hoe@HS>B8%$Y6b#!2r#1Z<ep-dJ
zNaOkhQxX_M+SMp-8H^Ld%h)q<16gh^&zD?~>z(HG{A|jBi*O9z>vWuNz8VDgD0%!@
z_K%F$gV?tltgwaG2_hY&6b-9-<YP@5*OS&hewC_LRP4*&QFQD{<dL{Gq4YD`9(;P`
zb!6ER-{3|S!_8+>4u4J-kDcfZGIBdtc=u@=&*8oYe7{un6T*ueb{FuSJgv)O_p~jf
z8`Yjx)I!rQM)Uab*24S4`<)Mc%*rfoUwdKH5ot7uM(FP~Gf&1GO8YvDY;Gx1Qn;a(
zj15U68-*dqz9T<H(04JF@BSK=7RHpY+w`X(IC7+R8dot)T7vHKuDUzpPi)0m##iDB
zAB0x0OM(6|&y#lar}$|Z5}w9q4pE#TC9tnOA(DTge=0H_jDYaeh2fZSrJ!an@pkQ-
zd#Smw!5zZWBGCDuW)q-hX=|4u%polbOSW+Vf%00Udg{!B)zpyTfqlCkSeYQX`W!ST
z1vE#V@fE#t0QN(6DG2?9lR@v+acqZX6M}jMtipso-4--b96Q#A{bWRgy$UpU*CCMp
z=qvEc=a`{2bQ1QDlkH2%W*tcGRcu2F)-Ha7Mp0z2--0I0(Ns_0c`&5NkP|Tc7z8aA
zo!fJjZSpWp3BRWOHx$b{2;*voNMkTwuaI_b8ygfE20JLjgfra&x<7>-`+@u<L!<ct
zA9tPo$Cl9gC$5MA=Zv}-*iO*7^3WubrqurDJ9BUS^PS0mFZyE$4a$O3F4-Ody9Z&m
zhG*M`Dg28!{V{}2A!+<Na4ceWLxgCjYAx{BK)d6-5bVSfas%4{>tct1qD!M+k<=zo
z+3~dtf3svqz+m*?_as;KKhpF_R&4bG3hj@A41z_{vIeAQPCOgsy1;g=<;~SS;(y7R
z?p9LZ%Pl>ncibn$u8ej7${EBO;Avueb7b{;p0TiDR~0CZ@km=-|GS2kWSs}<LW3BA
zFUgzxFoQEC$NI+X9*dq96umYt_j==J!smM)>X}sf*7Z3eck+0H$N^a=k;7k6{Dba(
zYWAYP-!AZ}!ZAs8+cGlLZYc=;ww2yG=RnIeLFY~g?RslSXwG-Z2n>L{DB|SO&2X%L
zpt2y?Q_*=G)srwEOmBxkZOFn(hJ_=}gLzdgfdz;3Dg|_QF>0cPfOrl?6o?R=<~Iit
zA&a0ngWPOwiD26~0)Z!3dJg{Dhc{dh>E^l4jC50n$Tk2pwoLB<Ku~uM>yUPcW=aTR
z9XC^O;=KQUX6epSOOWjoEBRdQ`fJ>ro%(y-W;OU{&>t0++nbE284Pg6Q{&RaxQD)u
zZLJB9_3WDSX!(>ey+=(6hmu^UXL9|zGLmb$K0uUv%KLk%XCBG~Wzi4`ly#ai>zXo1
zm=#QKmm?hN;L-CAWFdjJF_%V_L(*LF#&?(zRMN2Jbf62{X&V^$?#4Kl#1Lj<#sbEH
z5`><EQ@kXE0<zF*K<F=qv>=wpm`C6?n0=HlP5JPeA}Cx4a48hzh=f_)4y2!fR5PTR
zxWd_oC*J`E8p_a=5q|;}U5kKH4@pgic*VbvXYga4h(gFRQ%Iu;fIKzA7(0=W=CK_f
z^$;*%@NW8o6mDk>6UkSIKg&iD^Iu8WC@e^|Hqolfp}SAKy!MG-{m_UO>m=VTT7mmC
zW@&DXo2oYI7LP4n3=83<X@_HC_nAc-J3Se3cyO_=&*aJr?}?z!n9VrJO%=EzWorIn
z)PvVRu-Y(PkztzGvWolcMm_$$7PZh#CUin3Bo9Mb>le}zyxA}dxiwjsuR7SFP(6G-
z(`d!gWAM`)aIxufrk{g3$-)$fh4J)l-flF3cBT%-(_@g+Y&pQSz5u#BkU;Qh7Xo5W
zSxV4A!jNC2dd1J9Ap}j>1lFnyF^+x@8V$j$$_9UeS$BcS54DJ=WCCCH7)`_#nOQ7V
zp#u1wyHX4MhEYc7hcw|=WSsx`9nLph_(DhezRDy9hbz=5p-Vx(3eYc+`8D~UU(r-A
z{5%T$v3=>#0|v*C#_NOhwz*NgTIRt>T>SCpJDwp8LLtWt>n((6-+@I)z{GV$on&2h
zWC$y4fobi){quX=HL%X_0a%RR<OL>?T|fs~Bv+Uw7mRO&A)^VgB0&UJ3@pP<l1ZF}
zy^Y=ES;UiFK!JcX4oF9U^a`VqxN-^&-K{gjT$q%2$RXiz!;;-VF<USz4}fwMD2*76
z_?44z9U2|k`X}iJ<ZYu(?nUH3NOM;LfD{f85my<FX)EG@4?qtPfCG1=9&{mszNZXJ
zRm6kY>)n*sy?Qf_Wr9$L056M+mE^_1G_D}2GJ!;zeR|+ln4}vwCsz`GgYM^bm)x|)
zsFkJav;(o(^JEG>q_y`|d9{o3fnOiy{T*ZRqpz@#bsS-?i3yP<(+0dh{%G55eq)yy
zL2eQFesl1r#;PhRiFS}4j<sozP0ot6>rxl8?!Pl|sx)pyujKWGc9phY&mBx(<**#M
z_oi@4X<n7BNnM7b7+d1+O+4gm;_TbC`o!S}+q!AU?1%Xr7U8gv<dC{b#{@Fby7y6C
zRqtiZVVeiC$eSF&rS5er_xQc$t_SrBCp{r#1*_1%kjehvDSU~$b9K-++|$Uj=>7=C
z!xS7%a27!ed4(K(Ml9St#n>O6MiX*I(n9cBA8>8)?~$jfw*i>4N`F>+(vn&LB8Yf6
z)uXDJK9`hycex-lkS&F`mRMAw``(oQ(T6YA?oWRh27unAufgu~R$v^=lRy#xB&aTR
z4!F)^*B(%&A_gbp8xINilx$zyb*ArW0%KX?DO!V&{c6sthhYaoe_xC^?wPbRQ$d7)
z_AF#396&WGNI1|c2b<aq1WaVc8#S*65(}Fb^*p5HoWNhYgF8Ko1RWpi#eQ6*?*`o(
z9f$u-fN}SBWTrh_WG4bG69B?%!aboKLG^a~^L+<=hs22!O#LpPhr<abtrZj`7JmCl
z?usl3(+UU^iqU{xF@o;vnn6LCxYQh1KZX%GpGH;c#R4pK5p=2Djp`jgF9$I`zl~@@
zvv^t(^Ym~tqye$QyiKqvmobs9X*JlDm!Y>JdN^|W6*%9$!K=X3ck>XiPAgXg|D99{
zNI@kyOXy+v>69`c#WF54Ni9Mk|Hd%>A0KcX%AlWH3}Lsey#OF6AgM}y0Na5cyKn8q
zcFIGl%?~(Pe=XVEro|EjYsy(c4?|ABgp;|W88B%8m_(RAiTw4FizYM&L4{~69LIpJ
z0T$f`y?H{Dxs)yN)Cp5Haac(7IRVBlG!_kzq2wZ<0;ABvIy2wq(pON~T!7!~WoRm_
zfAVc^r%@Fl-$u4}<K18CyJ76N7{HLrz~5a1z>pJ6!vL2ANJu(y3L15>_|vE}G>W78
zi2q?{Gm<92WGB<YHq*l+Xx*T&WG67QOIE=%)@l^&xLarl$24d$;n$XSy7E(u%>j|1
z3HP+M{UQZ^D_=jW@mWgg_wq^@SEpTaypd;f_*9ixP!b786;GpakJkwZw>+YmkQswU
z-3!{*dJ0x1Pk&zDS6w9XZJYSV0?E<Ed9|%wG#m25dXyLbVYI#dPFm^Xyvl<2c3zR9
zw|?&&;VJ!_rE*V8Htt1;WRMLdsfm7Xc0{~l(B%NqzUWbcn`_o5oDZ^b>gfs#S0}pv
ziXmX^3YQ>aJYe`UZDFB(6<6L?u6D~~$~w13oA7RFc~$kah{qf$_|@Sm$7R?%e=@Uq
zxOZd8jv#+afU2p;tO2(B&W4M@UIG9pt_rfA+TW@l00uiS8t^LyU@q(8vY5iUNcHh$
zD$J!?E*c-C=p>?jV14&u8;X%O5Kp!SYIFwFNCE^Votf*F`EOrpXJO3_L6c65M#PFi
zKAwy;27$@(rKy;#9f9txTtH<v;nXWe7+Sf?)_^20xPftr^u{sRoS_~lbHxbsNBHR^
zK)ObK-okJc)<LStM4F1@+A(Os!U<XcIiNjdDvL`<BX-5W1xc1=8to^T-x4QT$6)-#
zc|90^X**n$Wk89U2bZd?gV;`~BETc776F|tKMBPgkz<2INSQe}C_~#<3j>WpQ+?Uy
zFC%|FzX_3pi%erQ2xsy}EcrJxlP1z0>UhCsLfHg51T)3)(kBq}?QQ_hLWUzt5Oeqw
z^eE)?b2IFy*3>^yTn}b;q?3IFV}~^q>DY3JVxdAwk9Owf*eTf!2ppaGPfD+lCiIFv
z7!cU3d|@M-TL8HRsq;n6Uq}8*oFT4n!l2@rDo_a<DSq>KfG?d6KaTgVW%6vJxY1O~
z)=mSLOktlT4&oSU%n|*jM<b^bo$%{RFrs+W030BiKpz&l`irq`65Ytf$##H|ajMj`
zt>YjBO11l_=2(FsWAcsAv0)Knyz(sOv0ad(opGc=>rvr@3Jz*vA(4dTs;!Gat%kq*
zH_HHOEsr9dO`>1hLB2#-u1(4t9?9tI3o!XwDToOa^OXIPFm_Y5_{P1P85?Dfxx(NL
zCwwfVUAx7}*pZR*C1i(|hEi_bqgK|FCsM9g-uAig;%e_V#_q?@b@WTi^C46h_7jeF
zP?HqV#8pVej}LYG?Q4*AN$?`4Z#m3xoj*C6|3Upz_+xDQk=@SpH_XWGTe!c7pC*f;
z_K`es0pd}2G*+%<<R0%3vk9xTwf`idEh_kBY<QC}u(E9exvQ3yc7mQpJDs|pYB<*F
zva2Oju6f^(WjRA7k|?V`M7|lvwwL8I&iY-{zdefZcgMd+$-&c1eZB$_VG6nX<YkRK
z?LB#%m5Zt`=O7Pa-ooMPez0rTuLg7cr<%w&<z?m1l|=8ECiFhCKeDu2P0NS4PyGz-
z3iUWile8G7E?PzI%j=ZqQpjc3<KBPSLv)wk;UmHY8Fs8atY`wE5i-9}Yvxou$s(T5
zkMOy#2y-~bnnW5-{h8(2J8^)Qy`}2F6Mt1g3e!wtZMil<!<SqkkLNGs6XuINbIpi@
z)yBc&Xpz}<fnOEbX9A<EvWQ|2S=iK|fI0kkhK08~=p^+g#bVU8MkcbB+wb{YgL!PD
z_2o|%yppH=fBY1^_hnQ>d-A+$6e9;e){lhaD%j}_MI^9Uho-`|b_Vuy1ej_NH^>&+
zI7x|!2{Hv>xQuazQjqPQk1>B0Zjn-zC2Js=Dyuio#=^<+nPu-h;~>q8T0s^^RT0z=
zP~R;!C?-*My9)GY>!q_vh{ZODx`-tn*Ry<e;3>LS{Qut1+$f~Swa+`jE3E)ibW+w~
zZ`}L-bsj{4np^mPGCVyuX;5`<U|#3^+y%sg+T#?NN2>NXA~m-uAZD|)Fy}JiFv?fj
zF4@U)^5xG@dI}L}14gSgg1p{H91tH{Y=F7V_z=vc@wtQMR*l({MGc}hf7vS`jM3d-
zT>sOYS>NGt?NlEwW;*yqB*PFitf>=pv5tA**8#Iu0amn<g#pQ@bIT0j&@Db}M?CCg
zo?u<PCgJj7!)V?OMGAKP;JoKLB?@pLoEMPPW1LSv#A=d!%3X%c`0`vD`&HPhUay7D
zl_fJC<UXW&l3P9_chk<Yg@y=D`wZ-gcQufz`Q&nKp|^k4LG5Rx!tkHhY5qJX)0$S|
zHlIJ{HbAITM*mf9OX4um?DlG<e6YQI2i2Zv>-SjyMBL>t&PH3IRL^ELqtUW@^gh~N
zs>N9Q!x4^U&ZlFoHg4Q)#jTP>{KuagzC{Inl2f_0?a95f)^D}`y!;R(_{TyZYxzPt
zuzX(VIOT{(3i11>X<AX82dz%!cjz6Dd2e>YO_`tT#lx^2h{~L^O~I4!{-ueTUGS-%
zh)k9smn~br94pbWn&H@I?^PnNube-B9=C%YOXE*BH&={Pc%{(nQ?R(U+&*K0E`6V2
zaU)u5?pG56VZMS5OBKX&`pNdOl<OH=WR(Q7t9_R(Gg%gL(K9&vEE9KXEirMpW?o~V
zUwI3qL_%^jeQ4~yRQ@;sm2$`WXqsN)fw<|E{J<-(KMc;E*>m*BX4KMbcj7541STTi
zh<l&hRCJ2}>8Ue6_I^s0#F2?nV%?8QDpW|Sc54OrCUrrpi*lYUjnOmKNO>-|qj485
z#!p#2%i3F5T&B9WXDTe)yKv<hw??q5h^#Ol>Xlz^eN~zD&p4f{lB^BtqDfa?-hz;Y
zSM14a2ACHzV?z%i=0KePTH>b2io~_1hQ!}NKa*m~MA6IuWO%j3<j&$+q|60FGYTp!
zl-1W6e^v53|4j?q*u3y67lFdcAu_t8-n6KHQ$5fkSbvb6RWwersak97>&n-GJ4t5+
zev<J~)+44x)oxD<)pC2p!v{@DCHlSH`zl0FT?<I<$?j^pNEzCIz~t0=@A9&{x0WP_
zyo7y-ruVO0c<e1a_l>4C_OrMm*-ZPkcv+^+Ol8b~_m|{@?x|W{JsCOL6xCNJB;Jc;
ziLI#-Z+0%MTKGf~e$8VVybUGB^<FidQIV^|xp$U4@>a387Y$M3sr(VYE1OmHKEANP
z+%%KTA&`&8BiWG37HZ~vSioz}bDt1r@51IG{I1;XOFPOZP%+K}*9WXxbxx{y)-7B$
zLt8p6M~<mU7I-D<4pGkdeeFmSi}&x74-CFG{4PP8q)Z5(-MqAUxmoG{&s2^;^-!Ef
zj>QM@gPiXQoHx~K^Y31}pvW0sajM5_(jm~VT3Ge6(pbe<r9-~w`^%r|Tih}OePZ)1
zoI6h45Tty;9q9F{ik0@!J3J}OA$PfFs@ru3IaMWUCRfkUT0A<mrRS}>-h4n>Wc69z
zC55(63y;|;)*52h%)i?tot*2cS=Q=XD8YE2yb$Ce$=1l=k6Yzv`$W>1G3(4BZP*2v
z&F^s58R&-l$Uf@Zg`am91tt7;5OQQ2{5kntb$FNW7V2S6>1|`r%J&^POwp{b@1uOG
z*_MOTTxe{82My`HhEa@@<m%@!gd4ffR9~TZF`maWa!+42eYPYyb7((N;|ISGD$Xyf
z!NvA$MVV!DOPRBm<Z|Fsak<tCq`!e}E%_JzQ2O>J(U2AIg6E_G$qzA}ET0KK&Y_CT
zEce{H&6OGG7!jnwna!eoSGPvX{!v4D?VZ;@9c%;=CSFdZijluRKbR8j{oS#v!b0%t
z%1k5q?9MChXq_R8CQtq-(;*H&Vq}owi8M*e&vFQKri;%0jEb8LFYG^M$v9nJL2y!|
zq^|JBX-4W8n-9EC+LgI2&UC6IXv;BBA%=8k&khmHV2~PVx3}cIPiGEpGwVzL_B(C}
zj}Yiw^Hx-iH}8~|fBEgBy0NN2rp*V-nWuScdAh>6#1gf09Qr@sB?Lg|l}}NIQO4!E
zh_C(QB`(^PA#<wVL(mekQ}^dWL?~hc#TsHq^p&IXNoWqu>`M-jKHre$lq!SlJV%R1
zdv?{}8fuS4m^{>y+;&nZJ|L>+xZ(1p-}SamB-{BMSHH}r;<ciZ;s%VAmxu_3qdD=s
z9$&G}O2KlIx`4%WTW@(|Xm^bt?PDveyveB>!m(cU?%Be=s>v%kV-i+(gN5w_chZiT
znVk_$9#=ITE2)Sr$bUK|M6uizhO=_=JTm+ua>Aje%BV+bRT7>pIb-vs;P4(3U$t59
zY|`5=>+0T;V%)r9>Df3#P;brK%`2mE+Z2#ds?wjrD~r)7*-ie&2kTA<N=%0&_P@et
zf1y}9+c-NFt~8wXJ+Q<IVSVvDRJ(!2nj*_wkIz225HqN&a(B^4jfaq4?QYp<{P7zd
z6Sb5nDMxfpl}>xPY@hkP@6(=RxAU?x0~N!o^$w*UtW(;qMaRTabi(b59uEx^m?({x
zxIZVznd_f;H1=#tShDnLm~JYsKv8`USf?v@Y|CRZLXQv<sA&zd7An@}(x`IYK0nV!
zGP?2Ol|lOzh5oNXo^NA6OVpR&p47iF9k_b3yXoTe#=8*`=H{ixXHh0!aE=fXWrGiM
z`E^&n+H<4=$K!Xsu5zi#LnUf?+CI6@`1EO0LcUMy^LHH^)ZXle*^Y$^Bge?|0@cSm
zZfi{(u$J-1NX4{q)XyIw)u0>H#p4zZ4a^iCS)4PkT#v{v@r(YjUE|BKk6FguK7k_P
zl59ek)iTxE1-nXAUQ3S}96;)?wIM7^dTq9$r&^9xBd->gcTb(Uaz^9xyN0XfAIopP
zRXtS@)x(n{t2!j2?q&Z~E&esu1@W-eH&csLBSQ49^Zd1dXoy*+5+L0#$S6s_r+_At
z+xBVbQ{Jsq#ar=H=pesZ10=s6n`xmphvY@=vtLxbaLw_128ezZq_DW;n9j1b7>&x9
z(36ZrLWHZAJ-^7gJBjR;l3hR3YNtJjVFsq7{HCtdCNo^>^QoDRMA8dmE#Bk*Z{Jw@
zfBgGF%ZfB(d~pzWaI4HCbK}?=!K+;%_TqD{6I}34uQltImif?4s%%TkK#=`n(18yF
zv)>Lcsvf9qeb~NkE`FP+zbYFMFw(RjKfWA@o#=Cvmecjb72!4*ht)Qta8BNC!5EI!
z^vGM~T2B;(`GxFt*N*f?Een*!%tBex$Nx5LI}8KSQEi%T4f3|>U5m?fKJdcTMVh3y
zFcn*wkx(x2E%3qa`~Wi7KoP318o4DGWI~`RV%3v!oND=dUGrV@?d~`}xZ`5y^+aiZ
z_>F6_yN`rk5ENjWABUI%6VqZswG0_wKcJpvbL9ERZ2P6cvQ+-V=`CXSa&tKw_hWv}
zQU7M4KgT+?56Cs5iwX6w4>#g@RZVl8lH;S~qcJHK`L3H7e^T;q`8yMlzfOMpJes}Z
zKp+0&KOT1b@0K;Kqv%9>VcGlwuTr$}=gYcR`r*L4TED{L>u`Rr%9EWzU*FL7cdN_Z
z2}p|zIopq4Yl-@1;3QC?=as_4Hs5(EP`!_MLYqJSd&RCw4o8NJTjSUmp!oiy`0Ybt
zl~29nwr*J4maN=aV623`y?aWSBUsLQHeZ!jKD+9AVhYBq%%Jx-EwAbo=icg+C)GDn
zak(3JYaJV~tdORP-cLhN+dK=5JVmnJU>z-`@;mDFp;qU1C0p^MrEV%o67K!4P(#m*
zEnmLJSnwO07A#60Ul+8w_c&cdKX7Nz##kCNF69o9ZyL}U;|!<GO3uLr{=A8niVZy)
zM=%>&oq0iz<Z4EQTT3Ct6g`P|k~rv#rJBDiaCBNsuf6qhw!y|b$RF|#IeSP(i{A%B
z>0VV2g}0ttl^^_f%QaUR@lgfqvHRtHI)ZH9Yi0lBE*JYNT&GSjp(k9sPE<mp$=l1c
zEBB<{70x#AOW!2)yHGllh!*6}i>>v_ePOobK8DrB^~N%zou!HHWo^bn4tioYmvSeY
z&%XY=f453(P?_%-g4b_f)0%)=G#ox8eoMZ1AvS&e3<@EuIP48qYdw+G%_;IALt3$s
zcz|Y}vYu?6Saq>uD_3Wq!|%yJge*GI%(FyS;WuC`;WQ*Eh4sB({FTsaC1Q$6s+c3}
z%Cb}GoQ=2Qn(>!2TNKFE<w5#WpVm{`6uT$#Ua!`ys^9kKP%g_hT$;;rn_*}V^BALF
zAg(c=K;@kz3IvJE#D*NEMqDgrTX^3;WX`))KiePqb|Bz^70Z`-OwXPCkG+%n8O|+U
z-CK{c4X;ScWH$vVQS6xSJcW{`AN|O7<muYhX%F$njO}Ad<bpmZAPpEN&yT|K_%M&4
z?6G0fg88J6AA8vbj+w6Ro~#qC3Ffd;dcC_Fcd}t@I6w_G+L?MNJyCvy9(*GPG-Ff|
zH2trC{SkeB^1UX{7ctFVGdm&Aj!q%tOXnKzv%UKZ9;c?BY<Y#ejgK;9Ep~l=?mNHU
z4wst0$U0s4lz6JR3;ip-q?WgOS@mU)IQnJe*4k4XHlGD++XFNIuO5K?ufFjvi7%*-
zEyf(G#-uDroF%dQZhU-HUQ?z~`OBzE=vvF?#Mh5Zl{lWL-(^P;yq8t6l)&1P8!hX#
zyQx^uhl?U_^N&o{2&i23o3~sSR;!N6*Eg*#+;jee^T5L3uN9h)4yXEoS86FJH@D>t
z#8dTiRIBmDh>LCDp)h*if))769>=OZ7`{;T?6DA6^}}%CrjY!Q76He8^&L)!&)4-x
z%ZRH}U%o?Rc(3?WyqO+3(KXens$qZVt&LZeUAP@*jCw@*EZ0?kp<bCiekNLEorpYm
z>9^moHsuz-P3(&bQ(s3>PrFpJRWU+UDkZvQw0BQ^_cbHKWWe42x_3*~G$L<SYuI9{
zV|w~s6xDNBJ%|EOp02tQNPsf!@oeX;^6}PyjfCiEZ<<{Up~HI_N@SjhcO<V3Ht)}N
zsus<48mPQa*ni~%i0)TG_1?uVGZLp0KHA;eE&5nv8q?Dp*dL&vVvY2~Pl|bTc4drD
zGw4VSSRsGMtN)WH$xu^C&5QkWjU(cHGS!Zwi~IF*iB^SA46KY>l7kPO`n>Ocr*Y!N
zI7QU7i(h*S@{qH&2>DiLwLFnxOnvXw<@K3!Z=2^*aka+|y^3|O9qg+(--sfiD~SEI
zIb9x|M2!E2x8p9`@XTu|Yq^&~gwQhq;V-si@&}IG>@<r>fAJ!H-aYXa-+uiklB*Eo
z^c1;owI5%Vr%PP#t!CXsbtk*k<9C|-u^Cd`KREeprY2-rWE@j@)Z1_dAzw`=I2?~=
z-+x8pLx=$FBsr}<(8}lv*`tl)d6wr|I{PR8XzuwvC498Od+CdZ)K^z6HJiQM`<2Ev
z%oBU7<kLoJc<!&QpY%HN1(GTYXS|HHLhc2h{GTxIe?z<N@6LaR%-%&Yya1cQQctZf
zD3U|hLMiPHMgSw-#@bQ?ji2-p77j^?)tcK14(V5@Q+c-04;eEbw^2u|0Z^MA2&snv
zskBT32He0P5LaceqfA7F{%>z*a7EB@_*npJ>zI%Vltu<8d&xT801BaCp(ZuFQxjyk
z6%_J=p+JAn*og=qVNLBLnlQRbs)l_gMVH2g%k4FVmRoqKTVw;q-lDDRep};Q52_D<
zI|J)5H_#Lt+n#u9M*OL}Z1a}IkMrln*>>Tr0JDCBFFp)Fjsxzm2$Euh+b1jrEVB6k
z_I<r$bZd&w;xk##7B=~98}VD`U~H0568mAA2)uD2*BJ0TRyt{{=Elg{*sXG(XDtW5
z?%vB{G>-0=#GVJNRFTGecrBG$2nzEV%~6e_N7Ca-YUU$9=Drl(nOw@ed#+jb6(UH0
z4p8`mct#iTAl4oqs>~Hvdzc=*Wn@ek>(1Qr+T}-!lyY@Ae|08&_~3Ht%Qsvd&i{Dc
z<bPo!f=tB@Y%wwyX@>#TgE~0>d~oG|VWQ4|T8)1_-V%gd2!_N8sN9nVh%@1L**qI%
zt_52hF~96cQ6wq;#FjetxVc!&yYt;%8okB6`)0+|Qz%e)<G<QulUrEluDn10<?Xf&
z-z|sb@m3^SLK>^Q6*0E<)GddG?C$(5ZDWb3uT`NJ7xy=3a%OM}+iGl}dVy(^D@m!_
zik8z(AJCbxZo6sFe~D^Yde(2VBh5tdM%S<I6L%c0nWzdBzMWGPxb)4m=zwa}nw6Vw
z#Pwo3$>sZXIQE|6x!7}~4QD>Hg_`VTbZfgs*R}7Hb`BKT$Z|fn`E0vxzfhc($A~z&
z-n!Y<1qG=bucs?}n-je9EY7C({ub~_cgwcebNk4Ihvf5oal>Je+Cw#}rs_9cgJ$Fp
zYKUr`lxPTDutJ4b8=QD~^1<!Pj&Yb0xGx>t5ct*O^4QZ_Lta+nXq-lI7A{~ROzYY?
z$A}vb$=#Le31t-z)>vl3ZwL`yQ*-MFi~Q}XSC631jzPRa`}=RA2}S(l$!iuW{R)!z
zW;J&S5rp1KT&wI~o9WAn&T5rve-$@PJXj!%!IR6P1bV~r=Yq1{=5z5-Eqvx$6(+Xp
z;$)6px*d0}l3?fW++tFnz4wKF^4(yB{JF~fY|RKAUJ~Odd1b(EGTpK<5E#9Wnry+p
zv!>OaD?cEyx1_Yt4s|q?b9cdc{p*vi5oN|EO(p<Cy%xV--j#K*vBk~ZdNLhzZu50z
zrDEF<DrT;dw>k0b__}uXjCtOsRlNZ>E&W45@=8xH$^XS^OY-t$YD@W?xms<u>z7%@
z@lb2-4>QX%1VcC3$J<5;)ps_V;9m-26vq>;Vk*T1GOMIJ#O5*2V;$KX0?KJZlA5V6
z$4ZqS4tUqM?rF&nRKHI;UvmC|?!_-Es2H@<vQv>lM(bx)Zew#RBU{;4?)}#ZF6I&$
zuJQYJMn4zHIvtPglYgXO;S<~A3b>Vm%ZYKlinHIdoTh_w3Dqj3^WNugC~=DM7Us;H
z8+f(zxMgZ{xl@nV@XJNpGxr)bQw38w-a97=SbcuNeg9Qjz*_!3bXo6PmX8O0dB-<@
z#H&BO_vPDV$G16$6qjd~^FEfUVG1%8jIG5Z!<vn_kdA8cHz|tY$7*8>T$;srC%Cna
z7l-rTM`_mKygC%Ng3X8Q!^vkf@*wrpN#>~Hjr4<@S0n{YEzzgr4G<4v&9=<7*}_$?
z_f6a!ew96K7!Xr9NF22J%gY_DsQh)`Gn<lUgtvaSO((XO`nn{lvUfLL-MT8<>M0fc
z+A0Rm?dNKB?nZf;Wn&A}WlH)~lU(ney8U|GNXd#_f(3Cf@s_X<R+$pd?dQMpGuiL@
zi*}@bH<y*cZ~}ka&Mx|bRJ<;E{n4$SvEB1KLQA}S&rz%{c6?KmWEa?|{jnCTZl8Kk
zgDt^&?hWSZY-x@r%czHB3b#(eut>Po3yH!t&!J@_Za)u0bxrrX6)~HrQ%?R;&j9(k
zrX01Y{cAw*!vOz<BT<z2gH&f1b>=Xen@iu`G|;K2dokJdo}MY!K~p2~DV#SIyQ?dS
zHt7ba#3$<dj@0nlz@qBpX8Ytrb<q3R*y4W8oC_b?w(6Q}t)E6$s(8%TE2PiQy80g~
zdN<@Gmv|4BC$H7uYo7h#LsO42(}pIOLru!=yf;p5u2wPc%<6Kqmwd5YSMW+*^rgp_
zCCY}^ht>fTHH!wuF`zTcysNuwcaHi=^0$#@!j0BQwoHGi%%MKHJ)?I8*0?zRQl$*l
z+wWa??A{*mEmM)Ljk{=HOqk!6azu<FdxCDq_q~bv!)%smy01g-HU<#h0z7hnc(k&V
z@19&sz|x*~es*W{&wYC3X?5U3j&{pa>)6W*2Kn*tR<`DXuMFw&?>IAoIzUR>8>wma
z6W7*r-%>rIz$jxV`}Ac;mZ-I@eOo|fz`sM$*z(E4Y<-G)R9JxD3y)UMsf$lEqy;7B
zh+Q=*^$dwG7Lt8a@1C0YrPtS+VsbT>y^o+0Z(I0>+|AAR)@sfncs9Cchh<L$%N*14
z-Gkbe5a!PnNt0f?LhwmHo2tv3KZfOXm9+O8TG>@|OqW#kD4pe7!<^-nm5IPlv8twO
zit0{LH>ENTHa)Y)p~-~E@v2y<0>P<Og%)ah!zak#{J`^K@Z*BzGr5|gNYV46T~+TB
zbyIgrte)wWl8S%NfAG3Q|Isjiwx}TKwIzkgceMPk+bfOO{a#9sTUb1A483pFSg7O9
zuOs*@YSgehVa59>yOkPO^0CA*?*w(d{ma%hWAQx42c+^l8*uz;b14*L*hHyMWidkL
znq*k`O_z*iTNN{r#6flQXw507UYM$DL=7fDxD>~B#BIKpl$`p~{r#0&iMlPC*00B~
z+%4XGWfgbNlPaYgbxM2lzsb^uHTO=%>Y4aB=02*|<Tm^vm@1exT$A@eJyM2UO)JDB
zNVhnSuohN`@gC$J8Aw$d_C#lxho`t_TD_ROctKTwsz@q$&4b`wvC;@xN$RVH1jXw(
z+dX0%HC$2OZBJIZKbZ}w8l>=v^r~sF4WToQ(6Z}}vtFojxVvWD`LAvx|6hFLP05=%
z7qAu|{C4)#FZ0<m25z#OEfUXcHn`2No5UphUUc4+Yd|`>m@mzZ<>Mn19EP*0+P}s%
z!K)q8v?e}!yB{+&H<iYPZ4%zPNR8J(9#4ubrYZ!6e3PDU|M~j>cEIkGC_Do>^NV6V
z+!NPbTuVm}{jSwH$FcPa=bbeS**$OvT>A0mUDQ7we8Rz*1j82uh0-wN>{bSTDvf-b
zvFf*x=9}BAjn)z)77#^AO}fe(sXT<k%O77{Wux?NNf@qS2SP__f3plx;v>Fpa$MZY
z7{ySX>90;~As4vFl_9C<C@*aq?yUm-+rRnPn0~hZ;~#4UN_>j|E~2<qW)JoJo**=-
zf+ICKZMo4_&I)NMwr80;^v8Kog<0j1lJ|a|I@N@d?7qGhqsU*$H>N*?ifwIe`>MK^
zyck+3oke<mV{1G<`pq2$uKn6ayIkz%Y%@YDkGD99|IK1HHDt?wtmbm<v)idBa;j}V
zElNjs=Pq^UD7kaH<hTzr_Te`~(#cz&H&G3^J!XC;dM7TGT(gIOpFYbgQ(i?%zkf77
zo$0u@)90D7b+GfNY(=H2vRvh(J9*xfYH0D?u;1x-c;S?rJevJDMeSWuB{`oSUbtJ>
z*ZfCS{FtCZ;DV>MY==pc`hh;0!jT=$rKm&IYjWCOxJIvF%A^}5%%Z$SzUFRvpK0v&
z%sN@{fml`^{(D3+*N2PeTS1I6ugzoZ0Ta|?8Y>~KF^x@C{KI#>WEGy0B(<Q{i!Ma<
zt#l=vbzY&DutZS?qZRYpzAL+Z=kXp`^eOp&UHboze^cV)LL_@uxOT;IH9(*ZFCr?-
zP~4DZG_Oom6)tebzdeSxu`0|%k=ZajX_DsLOLG%nlsDQQDeodzSws6vaE36vtN;GA
zHm3XAOv~%O<n>#)*-e?05?X-=DP#Vv@MP8ozKWujQWwJ09mFwaC|R$3k<_hUrpq(F
z^IQDO_N^;FZGRhjtpIcNpS*fC@%v{dU&a&Q>~)@hX=u>$I2S~XsQDqA(kF^2RvDW+
z2fd6{u`}l$ZWisIR?D4srXUBnE>`z44m+F2Jwd`dPA$<lKe=W)bPpMRUOmaL(^q5A
z5U`LINmG08_tZ$Kv{&kFWjy|?EE~&K%qSr@n*K{9(K?5Ml|qd!EGeDbDml)%$%tQ~
z8Ro$AP3d{S&wq=3pb{B-IUtvZkA^Zb6!)c5<Xz~J8*y;)z_v|<{KW1>5X>M(w3d{B
z&BtEFmj$U~=lv;8YVv~5;p-V<7yh|hzqy;}+GnaRqxMKKdTXH+s)?~My6^mlUjAc`
z|M};Ss-`3tL|v+IkE#joyVMH(+==8Hi}yRP1C(hh{B?WIevc<Hrh_~gPpVYQ#ucMW
zQv8YmG)QGja*Lu_n)BHS(Zf5j<0J~D<Jg4wMKj8iv(|~D?YpN(Sjn}o$E3E)NVHyg
zr2TU1M?g^_C_oY78m2Xbo$6>-l?3%t#_wFV7NwY(@Nj(XUg`Zc((Bog5b^ZA*^(?r
zU|WFy!`}0GQi|_}*ONA+lG;|4?om8K`mB7G&}3h%?*%{<zx{b%mJ><hiin6--ACeL
zUl<yA9oAMEsG9ImbCu(P<SXh?5;rOBVF-8M>$27pY3$e1Zo0HQJqjG`AY>CD%3+<R
zFBN1zdSe4SCP?8}xhKBvBK@f1Aw%63m90apzaGC-%(ybcP|Z5Ml7DzuVH4N0$r*JL
zLLdK+>hK@1vOjbi%xcOM4~D`lLjgN-CzbW4e6U<)?c0;PHtpB78ZWGfo~Xjbq@JrJ
z%iNb<TnStDuF)FrUMbg+I=<TZb3e=KfX9UIUX0^d)&rLiVJbq899!g%v){iwxv0<>
z5!7|iUuEcN`(4i7If#|;j7W6-w2sOez<MXOttm+auJR~Lp=TIaG2iO|;)t95Z?J{`
z>EmkK{_gsBECSbtjz+>0S3jr55sfZbl5doPu&WfR5hdk)uXO!vh6eG2*4cw>BJcl%
zKz~J0J&ooe1Wm(eKV0}N(KLtn|MUfK0Rf)>eahDM?SKZHKsqc&jL3IXd%v4CpPLmy
z)Rfhh-E@6-=X>dIu?wFs?co<%M%ytu(~9s9kWTmrJUPD_t2SJlwDzH3{ibeV>o3jM
z>8JC~wyUCQAYu>f_de`sBEG1s-sn-P2=(PyzK+Gy>*V1H-_lmK?`{X4h&~p+bRmHX
zZ(kJ?=37R&25@x(*uQFz4OtI54Y<BZhSKWCnvN!)&wRN3rkTs2q<dUBF8$8`WMcn)
z7W@~KwKRIFI*Xs&niJKH3xsf+p|^WRou^t?$#~wA#quK`Pv@iyxi<wS^8A;}Z(@<D
zoKR_^;khij*4vxOAjaz&FTJq6OULwvuwo8Z`i31zu#@83*W`y=$PTAuu<YOS;3#eG
zXYB!}r-Obc_T1Cwy@r|LF=@yMxp~8c(edg{aKgK}GtQ-B9kl+5>*l{BcHvx2BYr3g
zP}F2h%e#IbGSllfI#$yHPW@F~-o$X4hh$6cmFq-#qteggHjg5TQm4XZmA#u^DwVym
z4>YB7nWyNzylM7KJi)r5;EvB`e#H(JM#<P_+-o>V+LT*L`zdtqX?|Cvde{2kdx0#~
zb81^xdR$gjyq}+76HTzhMX8=i`r?}3EN0z1WiDOjnf{|(DJFSsLFHQLwX&PGxAcUf
zCbRdLJdY@eXzXt4o_s#_W4S?$-R9*zo#leihE3Xl<!qc@3?Z20#(tcXl4~3x^jPwX
zL%6QkS>5skL!XPz&MgtvVV6%Y3dg5IjgD15)y9oyt2iVCn)rtLJDkxG+dJvS5fUtG
zkGgFuo{+qjV$kZMJ*4`_8|~D5J=42zVQjX$N%Ofy+IiV(yKs^gsmg61_2tUO&irnN
zbH4*`5TdH3ss&p$LVNy_{J!^71!{*Z!LiC*+0{=j_Oh_Sih4v<adF?>wO40s>TtXS
zuRX;tzwCSQb<V<?4{A4+msN;01~}AQoE;c6D-xZ&H6CgiS$VCff6acL;<bo)M6QuE
zP17q!MMhpB)wJsNNv)c(Y7@`19;>#n>~NLOwh%r0v@h4myn54ePVCacxTr#=vxGsi
z`0EEvMjQ~j5vX1BW^lG|elJO*gYbwrvn~*{!11{rr@!ukxLMXK)!SJc<RQV~d$Fw7
zrT-S&JSO$^O|74)?^RgYFZs{>_A|{N>hp{oQ*j@t$!e%Q8eww(c0%FFQ9>Nr%qZ)7
z-#SZ-2!|%dS1sn<ojvSol9ic!Ka@pIa0@CQoP6HW5s><FSC*?yqK4Q#Ohd_QfhqlR
zJBX(EO~|5pHd34q<SDY<4UL-iHk2irl%2gS8z?|xI;I`*kqzBVCR5>4f0?0;vMv{W
z9(3<Pl};-!l;ZC0S{&IH&O2fLBU(LCMKb$TfA2oQnc|I|jXNH29YI;n<m60~@0C}+
z@Lw{r?N&7z^Dfu)yi;!TwaMS)bO%1^$iU1<P1yxzaKuIak76zQEfk%wzA^K)ew&u_
zyonM&kW~r9xH|2O;7o4Gdd8_Uyd~9lvquG1TB9*8SNgLXa-%lBjz8h|L4KRF4uyMC
zNmaB;(b8t}S-!x)&O;V2(CZ49Ij|SXyM9SWzxbM0qj)XN@U=ta$8BGE7YXP30Dsci
zmKd?C+5+8iqATn4uG`|F;8n<|uycGdY9+qlBvSNt?w<2UPWK~o7N~QbmW{Wc*(n4q
zWX<{t+?`Vu8};U0*c7R7%e{bmrLM%=W*r(@sis<WHulcab=CI9TK-^V?TRw~nAHNu
zD?KN=T@U?YeV~Hs^gYyRb*WST?S0|7W>v$n?BWdp(y%B0RMbpEuc_Kkkr12b`YCJA
z+6_Cr`@J#uJR{kRQ6+}b!umrE5)X9etXZ?1Q3AmLKONzGS5u`);V8)7TR=YEB05r$
z)8+1~6T&78VJoJJs=myym6UKx2f2<uOYT+|iB@hGn|9unb6J@h*%z)|-J=FkD`oHC
z0)KAwa&WA-anq^5PpWwh(us!`juy_O@>Ar^pIsc8iewX7&x1!+EiIo0-&MEyvD5z{
zcN^wd>z+Cxign!>4&JS+mn!(O%p{w;dM~K6f2Q8{Xk<iDZpHYOxPoiOB@u{3*E`CS
z&GC?8a_7a8WEsUMtnZea)Zx^Oy-O{q$kOsUk&?>fZ0^?Fi0q5+QxIA+n_;C{u40cK
z?4CgJlG64?_6!fOpP9ICc`me|HDf5|U}xd4n%a8CpmEtjZ2%>s#$Q<}dIhdXf`xcu
zk*31?WRDO2+iU>gy`M$X%|UxVe?FGvlqPjvy?-`jZ5GsTKR^_HTTq^9uI?CnzNfAS
zuQ|g%8otIV_}91kYD{AYf0AKB)?W_CFmIuBTENYbQm)&WPS+#ho7<nTeCuu5qyH?g
z-6!MJ_)+hQWxH#wJP*v`2%1ce@aT983|b;aICr{Ri;<USJmovL+d5CCr<w`dKOBwo
zEBL7`r*mJw=CYJEs&FN*6TpPn=1FG?k=O6uPkq9T@d@!v?~p^3OQ^zVCg4D*@ku&I
z9=T+jsJV-`fnV7}J+5T0-v=w#pr1UreUYLnW~c%`$41Jq#DHblkMjjOjkN;L>rLEu
zGsC6$GM|iSoVLrhP8{fQzO?bpTf!#CqbC0Cs;~s%+QW<-S)E;Y8FeM6w)eDaol<FU
zdZcur=0i3*opG3Q5Pjju>%x;HydwUNo&yy5S<bxlT|c<A<NhH1wn^P7Z9_RrhS#jg
z!}OZ=UJQ2CcE+SP5W9+5$>p6e@|>Fv+6|}er&s@VU;h8$Z`LVX{2Qt-;{aDwVNh1R
zKrz}GYlytsRMO6P7(vFp)!1Q&k{XX^xA5z(8z4OVO&0CVKT$S>4a>O3%gE`s`7Ieu
z<t7ED@zNwa+`NTiwSS1(_~ozn{rVbn&~^QG3SMB<Ib?YczjtWaH*;K*!J?Ar?>@{%
zA_JqdDN?1ygL>v2#$)`Cim1lD@@*;>-O?*Aw+B=P_fhT2${*Ns34Q#QDJ*Qno|o}}
zYllFMrDEe&?i?b#_H<3Rcp#=V_!vXiJ~pb_BeUw6x6K#(Bl`mdSe9RluNl){cu8(q
zp>!b5+`{1hBJMq-n(WuKZx94U1Oe$)L69yTq(tzh3rGz;A|fSpL|Om=0qG(Ff&$Vz
zq4(aA-g^tZC)7Yf?&osP%$|GZ+54GU@61~72UlWNAY3*7^E{5@cg}O`cyh%kRZw>E
z+0!$#{#qz1!Y5=36y{ytL-(QGG3I^~-Z7p2By+oIG>y70w&KOF<NlcIT2AC}cuHgd
z5xHsj=AP%nmI}MSS7!fro%HWj8&Jl5M*w<^6O8_+d@kDYfd>M9?-$>@2+N_pP^MpN
zIIs2=>A0R}E<dKw_A&(%daDh%=8cJ=V#Ql^Dl4$pgQ)Ka9++^YG?r`C_F)5xAg0d!
z9oe1_=>=ZYakTeM$yXw$<pl-7+8-qG-rcBW4e`5Cj&@n)bt0Sp<yaC1jhN5fR4?p{
z-pO(Gdh|WVRpEn3m&e)Ux7X~P`8sI!jFUs0e_;8xRcOwbTN+?=FN6V&E4bv&zf~)8
zzG%SAPU*AEil)ZtrhA5L8tP&a>H~`h0Dm-#-4#hQY`g`LdYxV6BY)h6IJmKNBAdLW
z`K=Ya`|vYswlA@Hj#II|?&Vj=&>T)e>WTOB#0tRSfdqbkW5s`{Z~xg|JZ_0>7H>dG
z1USOqxu3WXs;-S!)`l*9x!T|Vgy(&*(R-?E;(r%LWs5v&W6=8OU@{1$Q%(`|Dq%WG
zR?q@TC&-*58cUXO0!}@)j>AWy<RPCdV(Qh476p&U(=jrJrY!nHioT5I)gl+77NI6B
z-VjhQETQH61SrQ(+@JE(?xAr&TLAp!-%n5AG^OajuiJ@yk-iqIRv!CVFY=ypI`s;u
zqO*L5g=GrIU@j!Va%)n+p30?P>_^nrT-~|NGQli#o9A+K3-@?=PHt)imH@g}nG^8a
zde!`n12bPoFipL?B73E8<K-p@M83{TlsVZKe{dZGxs;WeD+b`OJl^}a!}9y_Vd^b`
zbRVB@Q-)b|Z=C53Svpzn>eP%@MktZnS`zX#2FCKlp0>hCu1gr+T_?y1YB;bf^2t$6
ztt%_&$7hzu2N1g6>M_Qtf!-`rLd$WJti)YQ*>1vpi0j*QGDEGQ&B4yDzS{&CAb|0o
zrndi+|HG52oX|}zR6QYU*GGYkx1Gy(iHkh0>Q9(!GL@Y!vY78!sBA+k(0yyZCeOz0
zVGmXYRDo-QM#cUVaNnoii5z^73%dcE-TL9I1g%5^U@NZG<&Q-&T$vk)3auqIU_1&}
z($Eg4+hR%>*Z9vBlJh6a`=`yNIBqlLKKqR;LFwjDX2_D(?5PPZ;>;hZ`3u-*O#6S|
zXO|}mK*rJM{0mAhX-trMJHhzdsqjqiR5WpOw~lY&_S4G~L>gA5nFlL~idhU-pKqdc
zyFNOgyZw<hD|Q{6AMZ1kBDfg=@n~$J%S@!rh{TAYcP>S?pZ-3V|F2Qo|LlAQ-i$#c
zMn6P*teEL`Nz3fzu~W=Fk4!4rlxB;>?^{^6W?JK_f+|E7Xo{{>IrfIfX-CA(vRIR2
zO_!s`O#j3y8j)jo5GI{fKRAco8o5ptkktp)Dh^(0?W_d-E95r}ZEB9Tb}Nn=Cvv#>
z#m@RpxL*6LMvwU32j_s_S{n=J_i13t3?Tf=gNxV!=TbYFvBh0rUgmn`?`v``>!1JK
zf4!^y*U$eP|Mz15zk3G#^?f-tYVKlJx(Yt5vHsP?>p*y_hQBDF)8Fa?jw2b9yCVBl
z0?2k0BjVlaXfJ_2{rOZYy5G*1ABeoo79MHMF2AhuzcKem5x%~*`N7-kz_QCt{2q)_
zMxxGA-A|3Ifq|dj!iuhW^}ehB(4eAh>hd|b{>bq0?)^+DCh(`dtNT|k_FLbwn@;co
zjZ|5g9)WmzA2lDAjtr>5RdIcNY)ft4*&^9p<HfI$lH1VE$|jw)7qwIh%UmwzYZ-e6
zS49tELr@c7S!018b+NlEWh0%>XNTQ7#F)kRG*W(kWg`1HS<Gl$JN6a~9`ITRmqU}O
zn~NQHmw5rD_0ivyR-)UPEAK8!3iPQJ-+I;#0L!Dzke)_c<1B{k`hNO8_G~xv$H-2P
z*zbi_^K9#g#&MM?fp>);P&J1Q;TLy#^?*vLGxoEq6m{QI#~&pzkUO73IMaY~cv!a`
zDHZ)vp1Lk$Z~Ezra0!~oa{xUn5j=IqusQ0&#?0Hx8L;Yh=WbE%k7;{5C8%ykr^T+t
zR!+~z)%$FRg1JxyMxYXw2#4`OBn+MdD^o<Jnd6#zirSB!odfg5++Fed>{8F6-=F-r
z-nCK7HRNF`4^zd$<vg_KL0C5v7`!@6X=*!u%aK)xYN;M_9}NK%aK$aa9u4JH>Uu<H
zbzoNNlFusAp0AlhlRbL+Xo4nrG10Qt#hklvhnB&tU+I?`RS$LU>M(^yj#{ayI64el
zIB~?!*C=lp-?kvhUgg@Z8CL=1Z_*<|Mg7>j-W418@@%{bYu51sVh?8#KrF$G&gqc1
z(>;o1O}$pA9-EndmUo(Byr*7E`G=qBF|XQ$-n6LZ3mRcVFV|tqIrl}9WrGhJ&py8s
zLp%*hk^Aoa`ZL9lFm&<M_w}-V4dsK&vfiR2ifxMBg#B%yho?o4r(E7!=f<=tHTq_Y
zbh4$Yd;RhG3%wWI0y!L((GulwXn31;sxf493@Y`4>TVXxU1h?t`CpF$s>{Jvb}q?v
zE3e9QJ0<|*;PYK?tL9us%XoR&C{MqtjNxp}UcGq7&?;|82uw3^q==S_5<l8!TDbu5
zBxP49vJu9%mGHPf(wGGzKOG%ZWHyd4jIEp4k3tUqs;^sO2Y@f0y15W9<Tc@kS6fY9
z1^@_kN93zTyexUuTjRxk2jO7?dtS46Ztm_qxAyke)**RovN75~!I`jOd^llog))EH
zCn`)G7pgVXRPo!4ulGUTC4g;ZtH}ag(-HX0v1pum2oS@6K=_9C9Vzr;s<X5KH~b3@
zqa~*3&gm@kITO1n2l@_TCWgz2&@iMQ*!UC#L@hGjRW^XQ*EqvZS-XQ1*MQ*jq*=73
z$w=-Pmu1jKjh0$wuARuvINt~*-mYxn(ovCvn2$~ofg=+Gir-10c5I7xlKi>8QvH{W
z*l3Fn@!USfz}1=#O}MJ$k!S4DUaBr}$f*0&#dD~`yX7FEQ#)>L65$q@yU9{@_>}W^
zZCX?uCSB|X{)sq@F%cZFG?0l~I3cI<d~0%BqpOrtq_4|$3hX*Fz*X~_jw$&{4oGIy
zM(UKv!x>SakgU@9Lx)76xF2Ng^-s{jkA4k<MEVz{eAKLgC3UCsZtSgfHkGGS&AHk0
zyUuhu+QVv>$3urc^nW1bZUOd}79e%Otb<p6kD~}W;^Gmu_@Sq}(l<q8m~-l#dKAw_
zEMUe6DgT*lVg%bZf%5y_{(Z225J^4bQzmLuHy$aeOiFWJq?ch>CjV5w5xenL$}L;a
zR?Bh>CWTO`x}{h(%kpY1_3S$$=FVjRoNpSqW=|NsvZ~w@XgUbYI{^6a^ZaN0j+z_<
z#In0~y1y&a-F8H#x!h3BR+MnLRJ44cw83FeiB`6$>uhLk$#Rz*t?K=y*+`b(WvP<E
zgOJ50`QlZ{2?HQXVI7k1wp|Q*Sv_&^G4}IwGDR0T9%Q*@&f$PXC<n>PJ72p!^>4y8
zhZSQ@EiWed&rDwRDg*Zu-H-VVncGj$-(Fkv$quK{sgr)!)E{s1h6Fe2f3Ef@9)6~p
z>siqu$R_dLlDYRrV<XiaBuV|%wDCqEkl=VzU}5LQs$yo`mN)-x9X~$UGXa?47bU!!
z`s9VZt88I0GA;a0d|8t{OSqQz(NWRL#491mUW=)^2NIeFJ}eu?Pr7tBqql~H)E_k#
z@^O*!PGdz7?)Carb&@U%)5LJJw=d7@Z4vqsZ~E*&c|QISb7=WXUF9H!O5}KjTwGms
z$RQQe&wJ3WMvc|2ajTOI!cHxg$vL!T=cu_7|KWE^G7&T1gDi;=Q5}Jm_F4;W-T0Uc
zxDs753=sXHj7i0gUu;ZBb2*!t&`o*GnW$XV1l<JMsUQIQ_Q)>?n#!7}R!`2b`OtfM
zi@0-ZxI5}WV!-*HX$;0Det%^y&Z!suqWj0ruX~AZ=TDcf4XI_pL5DHfhVUN=``1rH
zTY*J=mfgSUTK|7MQlAWWq@lC?gwUAQyT>MWo2-<E@Vxr#!Bs4${N?n>B*51JyoA{>
zA0!6x8df^LTpi)3j5luwtrmB?p4rp~>6(}5AJvWE-W}{#L41o(q=dX5|BbJc3Gkd^
zPsQ$Qn`=+~+on<XV4sH`u;8IYnPG#%Xa15*U<*S(F5o4G$)9_h#+ofZ>>m@L)sgp?
ztx?0F);k-!;!&3`a$1^5a70*HiP^JjVZT(f0sc!#vFqdix1jv5g7ZyT<(K7S_5$u2
zYVOsQ6;YeXU`f3wqRrR7c=Td`rMBHc4uc>M6TnG(exV5yw1jGr8}~kOs9ZRa(j7C2
zJE5B3#CxOxMu&+m(_r1m+oJgAF?ZCD;V_M-l=v@>YD!5#;jbk?3iq77!><(RENX)J
z4@O^yKO*_`^QOM`2RtS`VtMn<mf1X$gF#;)_A2GS142knAK5|ndr<yJ5J*7{Sl_vo
z{&jr^EO;-lD!2z&0aV`V!^xb{4Y~Y+c5Mlt+Y~AnSAZ3G)xR<%#l;KhZ!*EBeB~JO
zYLd<Auqm=n2z1e2<s%TEH^0YVm0E1$A@4)#*6pjKNZOJP*QGkLu+^#&^=GjH(C8uw
z3Gvn}=l;3dkbh|ECuP0wnc1;Kg51nT9MRa_+c6f8B}|m?(5;?X4H2qKiYeWfk|h?q
ztXfT*FI@9DAkMcd_v>xBx!j4P9^<rO>|{94NY=0FEW|!(@2@MDYIXfZ59^9yV<iTp
z(K46<N-IVNiflL+L^2P@d#pwDn>0PU@yx}=?c9X$bIj%2a=!9j@(YUEF280hKN`9U
z30fw92h`EGt7yChLyL8$2njYF8XKd1`q&dZ9QQjfev(J{zX8qb_WX%gN!z8xfMq~O
zAqUXx5G04d)yI7Q^KVn`DHiwW2Gj#*--3;pjlk@IcYRn7R57n${MYfKyo@olmsc&H
zs>*fMM)vW1=DP_6_F32?h432OWga%Tm@lVeCD1-A%lFaW5j4S>Cbr32;f-Np5$lX^
z>M;+gKmAhe>CHL?Ko*_DGqbwqlh@77Y`BS3_8N&)IwYIQDcvUV8_j`{olbUVdW&eI
z8Gq6t){?t;zWRuxd8+eXw95(@-H#$TcMa)i6aQ7QB+t^qxLf_cq}6L&;Q@yOF<&-5
zWNikY{RkA8Mu(+FU96^tp-fh>N8&NX-9|JoX*@Zi!qrKCWe4^#1{UG7*FI9=ioY&&
zzjIgc+yY(YlOK<H>Zxm@!<Z>Ds}}y_;_U<FI(P_B&I#?RVjkJ?`=)Vf-QT?njSX18
zP99<Mju8c|Jp<AP)zbhpVC`t;s3#c`dML+ihz@;@y4j$W3pk3QjZ~n|_cY5}`P2Fz
zAKqA<5nfqm%EOGWBzAto3BlNqPF<1*iUBBtc-uVL@|I+_FP=fF_h14m(Q1dSLm~lV
zE%*JMd>=GR19dK?j0DN$R11+G^)ADAL4EaUZD%b^H{&;?EUnm?)4ng}IU2mmilvh1
zfY8FM#rK?U8|{kc+-p^Jak+~{8P6-HttATO?Tf^<a(;M9J`YS;6idhT;&?}41nHjd
zL3HTwt3|lrPiTi-g2Dd#wz>pv)h{}92d(WNdP0n^tQFD2YkB_G-~9MtD#)gm5E<os
z6OL+c*`|32tMER)HC0(S`(~NT=EFjVt+=3=Eph~TyA~Z*6@7wqWsUI3MTes1b%Q#e
z4!j`0qKU~{%x;RWef|Z2^mBfO>nnUxvIJ1~hWhAuREHLF!O|}Pxk{zoKyav9u)s|d
zo4Q;VBkVHrgW*(ojv__VE{#-wIb-MKJwzmpN;_{(x{3B|qwdlJpzx94qiE0RQSyKy
z4i6D$nEDBrprOqf$@53e5{LV5;}z3qA6W5#x$u?fL+Ee_+vMQp;+#3VYU_8jr9Gn7
zlN>L9`Lja?JPy*bB)Z|OxG7e83fR0>h=d#i^18wu=qhFNXSeDei1L|?do=l#dB&U<
zSD|?^H(+w;e7nq-DC<v+5}AfJ@1J?axEC$VX5ig(-J=TeU~WHP72$V9@ct@R)k{5C
zm`V}5l~)|Q30TbqvG=dY1D2WMR=^z)!k)DQbMlJ$#g_TOJPoCt59%uI9Re5laW1_b
z;saJ1e&1}aLSsr`1T?wDHd6-XPkcCIPiKzIO~e{!)D#@C@eaYI^qtB~pNj+1HZxap
z_b>AR3<^>k6v9f{XeMIk$2*che&4ftSLwuXkDqFfl>Tx!!F-NV{y`QgfKG#6S)zu+
zi(q$F;P*V2^$^1ybG}QNa+)A_TdEh>>-$rW(!R4+XdRrOBF;n62Zb=Y&{d_hY~@we
zTr;1SxOp$j%IGEkik7c8e^N=ScG{7I;Qjb;n;OfF@xqOy(c-u~_u4>s%|y=;*Q{+%
zv!~KH;o|iPG{<~YGTL>v>9^}&e($syYSYwWnoja>qif{$aYJ4poVuglI8De{!XFi?
zbtKYgCoN9TW;ML>Rl|VifHogY5IKJ?aUI+IXc$@eg5hpdNKyf$oAgABBROT?Pftfx
z^oS#RkUPrNa0QPT7~Oj*xMGdHFLM6<I*VWCxeqdQg*v2yHH76c{ElZbugm5Ori||K
zXN3<Qid?7?M0-)6F7HcY%sjuJ*8!&X2$*~cnp=jMJOqvyAK_m!qtAV8ZuM%UtF%+x
zd&|S#4dIVe9u5Wec^Iw_ipbBL2Stf}-#c@C@`9$zKGrW_B{me(-HbtlkXoxpt;Kir
zkXs!Qw58=!?$Rmd+p4?+W9DYTlyX}f9~2%F{3Hm+I}88qvp@>Y2@Gvcw~439jAsh^
zu0$zKgP*l{tp=Z)a{2=t6#i4VZ_$CJdd0Np_eCmgE#c{xf$Cm~n9*O^bbf5fd#$g1
zqipnixZugV%{Dz0TB&4@BBc8r6o&3#qzD1)LQz@mcJG>N>={wfbg<u0eKyd$xQjpz
z6=BXm#EYgj9*`p=xtZQ`q5FU>x|q+Aab_w-VED>kXryrXrravfYUIxQSH}fD00^p*
z0oh!CYZjEB9zgmvx1^>?!q-~PA>a3bub-B7)hjPQff1AAi3eiWU;IX$uQShK=rm%8
zNc+_o?!5>JP6(LNnBP1M+{Cl4Wm>3g1~1J!Z3r+w{@QB!XU~g@Jxs>1VwvW9R}*_s
zi`>o=4fc0>@?U(1e=^0jZdO4z{b_~JqbPbghIwWj1@cF%8FWZ)V{t{gc;9WLAhub1
z_*pI~k&iQ-zJVX6(xCVpvUzT9-$9|@X4^2z&_eu9L$`A-1prq9q>t7SJHH2!irI60
zQyr?h^&ID3EmJDKJ(`NX#430%sg>|n@YS`Wx}Hul&6Upz^w~EnzRXHzf$aW=9fk)E
z#Erd=t7(ro@b2?4_q5v_1_#X+Z7Ev<&c+LHlL2}7I~8Dwo&xEJTkD_X=c=+l?Hv6I
z8fp;6DrB2ev-IVnzah9!#=rVx8VnuY{e4gkmhTQgA4(L|E|4Sc8o?Q^)5PlBkAlpp
z>*{)It14-9f-XKLym0vL(Q<fV-me|mQLmq?dYv%6@GDa{mBe=hNcs-^11G2{aTnxM
zJ#D*S$kHQp3PQ)f0w!YN;xC+!zkV;>DomvNlJQo{0mU;Wr|#i7<(0(!gKYUi*ejHN
zb)Y~8BlJDF*kbq6?eHaPFVh>(_-Ji<`>0O@fPH!M`SoYVst8|N0~AsA&wh`})~k>h
zA4-)H=g92WZdEZ#Y~(t;>w;)5NV~7rc{(~65i?(S9u($2sJW)?qeV8iz=?qx)Xa6;
zXqStdtUq_Uo-$(EeDUP^;dPe375NR^*j(BNcPAQC+4!ChXP>GhQy<69ZBkp=Ixv5a
zkJgE(jaGX4l6YeB7}5ow4?2gUMG!$NTGXCdOXzeH=#H^Q(N+9{L*zlMLu{u*^!o;0
z%O9_6$<dEn4!C?U;(kNk(Z#Di%K&kx^SC4~vwo$I^h@CQ!eh`$H?>3Yh)Q2-6+kf}
z+`CSwWDNijp2jfj87QnFSfd>*C&i$c;6--^vjEZe0rPwrViudE*yF>uL-!vOH^J^+
zm&oDcMkNyGKpo^%{8Lpq+|Xj-!`t@ojF--X>!uGy3ce5sJL+=~vBjEq0sRN2ZO~mA
z<^s>7E>>Gy-)P23iAHwibR3^gU;;2|BQ|i0ze;oRW;7m$-($b2u{I>&&uc;ocADRb
z*?*cAwl<nEDK~t~7~IrSJD%+&bWvl1jY>@?_Jf`+pGTnvAfz~atO9Dih`^?vCSB&)
zsck3e11<FZU@+<@xhR?*<A@sqReD4U$lOLIcIw(C4;Ft-4(i~Kn#{w<=qNLmdaWsP
zh!!3P{dlv6H$6E%e6xts%(S<(gCx<zm0Dl#O$Ajeo~tT+lNNV-e$@va<X`RIZYF+O
zF3|}g8qTw-B~2_fHS3CTsQyKq4<83=ug5LjzK&)hs@HLTbW6TzUH%lS$quh~g#F85
zVva=@HIyrXgt0wr7f~Dpo7|tt-OyGTKimL_uF>BCIlNl)$w_SR{lTI(+ZcR6-V!q=
z)2!L~$pzE>z>8jHniivi8*L$JW`^mHfL84xW`<}`TeQF-S77_@InmTxty2{%sOO@k
zQ1^?7+Q>3CYhu>aWu%IOpc25>saRt@pe|_p_8@s#wL&oF$#oLx5lJaQQmT);Z23(e
z$iaNN-JIZlE^xC9W(aaZ<#xBw+ZN`%f#G}yLOfdk#LE$2iy(;6tlE3k;;!Tw-9qYX
zeze{~lhg-UPR>2?&s_qzNq$MNTfpeR`+j47)J>?gc4qxE2VSivUpX(1n&ioZRrY9|
z1}?qV;%Zq>=wu?-8FuA(v0x-^o8S#Q5T)Ov-H0q325{n*rgoOYSZx#qd!$H%$P;`$
zs^y=YEnNO9F>5#qC_Kjh_H7;+ZiM8GOs3e{g?Uy06sL$cJ?M|rV~xD3>4`GwGN(kw
z&vSL81&+;k<e5IWp2|c(cVHiDbVt71G_H-u2sj-*fOG7Dpv^aMlPx!apqpC(>qmyD
z&0?~ciUX1UT(i0PLeL*nT9it|k(2>7ueRtm3t(Q?CC$XRL5VBJG*pmo;}}^nMZ%on
z>3sipj}B_?t>;wT9CUpe^B>yS38^*#x+^GD8!K@gg=03Xe8}76I(XI)(oGtb-#bkq
z;`52&(bZ%4Ctw17a`14ZQ}b;s!Kmi7R@c*kieRSr_d-S{sAV5h)tC!lAaDqjwR(9U
z1tg?`ysdkh+)Nrvk#8$tqI<mgr~NbQwJEXd5CNi3YN)SKpFVRx4?20<7y?1_gzlRV
zQkV`R=C@aC7dIMg=01VvFRJ5+$b?0r<G1};fH|8^q%e<|Rj%MFehquz5*a#h6cE*_
z@G8vja=Pz4|LhGVTNnjJJWhF`<k|dGi)_nEhIm2?H9#LEpB+B88c&zco@r{D9BkyF
zkvxDqPChb=XgxkC`c|-pul34?;NUrMBbB?39)DRqmWz^0zqvS{p~#fXnH4#(Ww$~n
z?CJ>s9WRN2g-<*{yRvDa$38+SE~Vd$gxoz_pDbbjLcqIZ5*n^lZ9pncYy)-yARNBF
zf1mdGcL2h_>D~X$N7g?l{%4v>mPM?(O3#gCDiE8$Ljdrl8*&4*HAKESdFs)|SQr7h
zEzhAT|FRK01gg#-?l!U7cVNRgKn!4ykl4Z%Nx=u}4m$okSDz%W%}lZB-A=69tyfMR
zavTvaKgv7Ld<CofTM%VBj=uOAC<#yDFL_iQ|MpY770};=lcED<)oz9xbQbQJ^V<ms
zCUebiT!!aUtEF!~Jr5F(7kOgZ=_|_<l9)f3y}(ymHlM2KbA6shlu4i{9F!W5V88{t
zWN8`-Y$w-b8)>-qt_%pzYA04@`H%rzpxuPk_}`8&+24+^;$N|0#6UiYUr;Yi9YB9r
z)&QS>z-U%A`9P-#n3czyT+Bs0$Q+|Z92M;8s<(i=*3zmiP5GJfK45%gGK$@>Zj93)
zto-9K@9fzi*}VRTz@I8oM2*j1j+cn`hlFhSAfW|6*0haM<wS^OWSX+XW%tx49jc_=
zV;MIADga6=#IotRyM4nOW|yVLX_YDKu|vYV*%!yW^QXlI^LjN#>})@PT%xmc{8UeI
zaMyEctuHxS!*S0!C`EPe7Ll)+FmTq0$4S2O)13fkd8W1Rct?5I)P8ddNA0XYy+~cT
z$(~M|N#z4PEQ*j+hU}@HQ6TSVTQE=jyuo=Ld>7$Q;#D;LUOizi93iUV=*zSIgrghq
zN498A98^6f=xhrE{E0uT)WBf}+MT*xJzsp%WHcBR*_GMmz*X*Yj3|z|cm1S;-@Zpu
zjWv){p$(+J`V`8CNl8+#f8h=r5H4ZXcz>c)AY(jHU}1e|?{jvL67z{qmCio;)-G?i
zSk%L{-*&l6X@+s+Q5fg=BSS0uZVm6?0S5n1`>t6+vgA#!?K;_l>|;MHB7&zoV`#^!
zj86Mw`5ca~z;(7yyQ+aqVdy4c(Q15dG`clr&HXSXX=TFOpwKPb^tN^wL~W{=T5OOi
z?sinlZC7>6X#j&Y<1YCk_AzCEIlqVXqpzFv0S2t`KASN`z<IH|-Qg!iornODb>u6&
z33FjPE%6rfva)4Kkj7^~o_}6IJ<drWqWojtNQ(|`jD&|x9o)=b?F{+={pGm7UY?Zk
z?OuC&xY2714u{I{qhd`l>d_U8viK(_6><?1qI<qN1b|$)4eb(Jyy44Z89eX?spzpp
zhf*+OtE`uFY2|8q53YW>+&Zd~UPE@*3z^U3T6P-04FofPx0<JFbd6tBD9rFcXGK}>
z$rrTpACeD8GEIMnF0rPmB_+uV#dTQ#ij4J>R2sHv`<?EL&0SAVnBohW%SUC~&5x0#
zc#Cs_%$mG|DmF9uze?dyps4x;m@WUHrCW}41C-)$8UBls{psi|lJ+PM<iLLS%9<p`
z&I&^6nZ3em`_8o~%3JXuJ_l~2UHY7iJR7#(mg(A9SnN$3BBP0XI%if5{wZpZex3ms
z{#rtHE#s#uy-phv6hI!S48VZrA9H5E78HDrc^Ad_#m9{*+wj)k09uTta++F7?8Mi7
z--7Ka9n*5*o>#d_=3}WnH8yhtfOJ{^+X9&B24!C0zaR9V3A(iixJ6&o8d+La)B@t1
z`*&Z1#WxBPma(Ss+qKf2=g#yWp~`@C+6z-%y?i$x#0SOXoEF`Y?knP?ny-H14Icfy
zj}=DL>h3NzYIVx7q^W=Fjrdkr5Y3)stQ`N%s^n|k&c3%(Xrnw$_Kl(_%&*0k@s$ZS
zn;g?1h>YQqmerGFA~u3vVD}w;vY32uYl~9QxV@OBY29PR?bc*Wd4AnS{b7)Jq7Y9@
zJy(#S_(>ya#UE-wB60A!R?y3U^dz^~Hu$~iO8UyAXz-J`E{Bj#uEX9FH>PGiNM(+<
zL?}#|ES++0@d<EHmMUPnt8e0sk9%FE*uaVM&Qr&?(>bW&mcI!~6Babnf7}*|WJs?3
z!78d5Db7Q^y1#qq*$0lA<)E|Z<^?NH9=@wfFr10+?Jc?JlB1&}@Os<4PI5f092^cJ
zd|wj$NSnp%g(&i*UM_fCOx?j8Xp?=BqVDj_ZC`(TIOyA3BBBJ`ksR;m57>LbT}zt*
zjV36a46qI|A$A%v7doaw1bz#(3o>QRN449~Nthra_OXd{#qcw`+;ADe!0GCUvm1?r
z#ww2%K4x;4Bt4#tNm}pLcaDd}WFGMWj<`AQXI6k|m=Z-4AfCi4%za$ZMm>iHcc}{(
zr|enO-+<ONR0L_)2=x-&kStMii|2alQ<bON^*mWRP4YQ!E5h(Ql;mvrUlN4S%uptR
zJyWhvGP2@{(rV!^-b_p1KQ`&*2o5hT>Fd&zkRcW4%wfok04RHhQ+Ikv0IMi98ifjG
z7(S0F8*kZ2HlK?{*E3w3B8NXwy$pC2+u}(ibp(kAG2I79omz8c>%Qf{%2z?Hs7bO;
z@S$gPB^QHkjN3Wq@*#P)VICXigOA?Xn)-X+CTbhDjBsv-|F2)%|0_S|)zfu!OClP_
z;2GMEB3)RVYcR3Qs|&p-z31bHGH7B6pC>og+f~Z)&;Zqjf7XeJnEgTAK1>Ubkz+>t
zchwEl2WL5mOKS$b=|ILBg8d;fSX$r~0qIJWLqoXwX%h4O?F`}a=lt5Rkx!rort}F+
z@)bk9o0?Frxf<)8$={5Zfzk@soF6r_SH*NdRonXRZ`&oTGNuPip6y);Bv&BU)&gk6
zZ)&b1THZ7mfJ0YlLkPGDX~y|y0zpg9AsW*tNC9pRKqD?M%u94FQ|5&$YbEL=$?Z{K
z`FJt%W4RK>W-0y5-8Po4z8;T7@%{c0oZzpoHTEESI*HK!t1*>3rM?a3laEZ8IR{*)
zY2%!OSQj9TTLA%)>*1#n-@p4vdpRDi8@>uKTK9OMPoZQKCWA-JF+Jpem;X?X$8*d-
zYOd41UgKv%e~0+-4e|Lc`{`^g<sXrPcpvGug3J>j3QwmBntE}9S$@8-IH@vfmd_za
zNHfUU#A!@0gnW8+D_B>vKJ8#`5F6uFV9sK^d+wAB<{Dv*_n#$bhK}WB)S{?23>>qT
zisn+p=<<5r0Akhazh-Oj<KedASGdr;ZLt5Y7^7`**3t2cVDfEfAJD_mFkaI~ORV-D
zc{Yq8e8sI~_4nUEVXSBp0`zn>5KJNhAyn4{!<L90Z$?*(NrqaG6_X6yzz`W=-OO_s
zm)j>pt?B(-{I7JR>}(Clo2K`!{+V$J`v8^w9m<L{(IS~c2N8`;{gSc|I=&V9Jk{oW
zD@Q<r;!qZPUV$L*WF^A#Am0|E?jXqWS)x`CC<UJ$9=;qX%Tb8rA@X?pnp*pQg%G|x
z2g#-KdFFN4DP)ekn}r@-wF;tM#LA%KRw*Maif3DE*m@X~C^!R>Wij;MZ7Ip<<Ad_?
zJjuHRXUNZEt}}}EE6L}G&!ZE;$g{{m?OfYb)|%32BjOvXGWnxsJ^I4z!5jw!Tx_iF
zSS6HMZdA)#_<i*9>RE@m3ACB2c|tV5v5w7FXR~di+WAX?%J(2{{I5@j*%+`uQ4;vr
zcIqB($Xs~xwexhMIZrbEv)!@|OPkTH-8V4*tG%=3XCtD^chPPd$m;L+%s}duA;0K)
z32(iMR02-idOY~xqQv<PbOh3}+m8b!xF3v)b_%Ii4$q=o+)hkZY=&DihH!`yy~V%b
z_y9k$6!Nu>36D$!N3x9i1-c7kD7{W?<lDUHW~CA+MquvaHMNefeiM2C<`NkyYY$?T
zJi)`{G%sGq%8`KfF91!2chwA$H*wkzlGc9gLE!)Xz{Qn-yfL36`2K}H^%{f#^lF(D
z_7t52>Pd@8<!uJIB?|8slACiG+HPjPDsgb2PO*HTIoV$-AHb09>wwbg0J5;5AKd*(
zv9c%yw20Zn>*H6G$-Q<&6GAMO97Kllu1UALa0U-bT>!*>>2)ObX&Nic2xAU2|8}R)
ziN!9lnRa|#<~Ja`P59<8=4HP_+Jz#F9ca%SqP^B2bE#USST@u<Lf|w7)CbQPo#24k
zyj`%5Vs_R~q{7$O@U?5BuS~Qr{6>H|6y>0>7NARa2kJ+Zh9LA48WEGO@F!%QS<_5d
zI{ZUr!%c9mgfx7I0Wa%r7A3hPJfm_rSdIlr9$3|K2Yat{T!z5C0LTXTm_3!^Uu#af
zaVN<kHl6CpT;0uSXFO|QMq6I0&^XK*sOwD7K`1TluI>n=wMzZHbP#vy(44H81#!-1
zQ@v|u*;W~R1`^8PgynJim>d%+<A|Qv3P0+6x}F=z`9|bdt}LN;-ivpPo_mm_H2mMt
zYYHs?b&&vE(C=|gG+T;N9U?wXnI;f{P)&x~q;xGT%fzutg)C4rlPQ7JLAGfh<;2hj
z$V@%7$;vXLV1TZ<LG^?as3IhjV~P^^x1HnTFF4RkddcOehu^?HQOKoEmTx>{esYQd
z6=I?d1-zquX(FcKm%dx;)~#BhiMZeJ88fUGI;uo@b9b5IQ0$1Zk4tASN4S@`nXCF+
zjGJD|O0qvW%o?M*>vs#CiBe)hQ?1Cx0h4+v?Z1^&d2xuSzL#IAyfqqmx=^~ZDKWg8
zw%>vgw@brozQy_hCxX&wiNS*K>H}vXY9=>Lq^G>NYLa9y0Z%;QhYVxlt3N*jh7fc?
zZgEwjrF@WyE1a2D$WnExHd{CAoJRxVs?rH5=~YIrAVL>H<P95^4TLCjqX|DPAblsL
zf*!;;_>BO)Y)c$&j6SEd?DMhAcTD#a2iafqvpip<C7OH-fnz3y4g%QHfGbuQHQyna
z=z-v<9(}dN*t{rQv<G0W5RhNx0LKV2;|6$`%c|26w_c$WStDd*5gf|Nt=oa!iVdNk
zHceuxHJ$I(m)p1XN-=u1V4%2e7P0FxD#Z~-L?HTkySK=l*zA&U!DJ|sL#t91G|whU
z(cG!=&9tnKzm-_`_j!#Z#`3~vmREBUIeY}fG-URum|m4lazHD&78D-}j*wh#;qFkN
z2yhgTStZb|4uM&$b+M6AIYFSqfrq)YFX87-a!h-Ryc{u_82C%?_|bTJtZqfXR9Pbg
zVX{!>a65{bC`nZ(#|%m8pGI%-zliC-T|S{`AdrNIf$Y;}?({&a$s_m0qM(RfPydc&
z%F?mQPp9~9=WmnPsrnxE%x8$m#L%&QeOVYxQ22y+8o=>zbpX9R{j`ed4mh5SpMG~t
z`b>{&ZO@hNALXV@J_AGk3>Qx~8mV$T;Y!GolpN1BlZejbgGL|6DmuRIH0J(8Nf&#L
zZ_39j_n0CBl|%w2{vNd_9)3!W)n2XyeG(NpHbk#!hUy2ENAy#zYeoRn9s{K-fDmvp
z-LnFdW&McbX&0{vs<JWO=+VwyM$B#dz4#p}z$d&xCJzTcx!4(lFB)C-XkBxCUGKn@
zr^pQfbBKZQ6Npho>J4U#fAv@px;?+!Dd^-J!KafCR>F^u54pvLlxJ3aW#S2HH_$9M
z+D>@#^qyXi1LbFBg<Hmb=+s9*57+p?>o3d?0rismL6C0>Ql2UBu0K^8S)<RIsvJAo
zK)uQTWfIt+jE`m4fbjOXR6heAZtJfuiGTb&-_AHHIwp5vckaiYgS9o|plFG6K9i-J
zklY8-an+hPcT+7<K|M7~WFy6=!=&8;jbMb7Uq_Zns+)97vNdyNu%8E4^oKR6;^mOk
z8)d&e`w%kYUdIyQ@g*~mu$kE}4-JvHKE6d^RXqGu-T^<#o#`bx6!UVA6J_h@9rPeP
z^xzHC+|GwT@k-b$Yq&PK@=Wp6et<{g_bih$Zw5#28Tm)lWW7IYiS3bh>z`{$%=J&(
zcm-H6dZlmtbp-`HCr^_j_V4^|hK^Y=SlMB~*0^w8@K;GrAs(^JE{9){HN$HDW}N=k
z@ClZH6GWc6Sz|7Y?Yo4~&pDynPtQdBy$cGlqY;;L!>AYQZ9B9qgYX`$_BKGuO85`1
z`M<3f{UE@FZw}M&{RvR;LcZH{>2?}VC0WQxcNSfE%FP!~UxIgU!a6V(enTkS1PH(C
zD44>WGbMjP6zuIjP<NcsRP8W&`CVR`$x)e&k~$3U^G!U1>rXIt>y?;U##Mo^H{WR>
z<VJR6pq=WhG>1gMLiJ+uOx8~wAnb<$w-O>WH_}5HE$D`k=|MC(wNG*9*wzo2KPU}v
zH-TCm7pEGkJINXI1UA31UwO07*`#|;fWC|BU(H&k!g2eJ@lv8M5a#(#?#^Wk%C0&~
zldSz_qasS-#UdFQWhCK0op0j(o)>yku{seUco2n=#xk^MNvpLa42U{hFk(#f)NL!~
z51-YY!<V}B6>oju$!jI}0IVch=C{sO(7~u09VAybJfKD#1ye%XzE3oGKkdjKek_@z
z{w>z5S@Db1XX+(=IuRm^E?1l!8o-|2WJLF^ayQd^N~~1D+l$rpBKDJG!UP-Tp&ob3
zRT`|IDhF-xM&<8&GjxJ}E{5W<a(gOSVvK-;VCn>eWW7CU_rLu$FYQPf5P-9uC<B$>
zaGu&2r`++4j&!ke5SBW$D{&68Un)b8X>|trlzf<!Ay1hGC{3P@pIEwn>Vb|dn|!AC
z-7xH)66cC&M;!I2BdDrTzOddD`m~TMVcL!D0R<I*Ib9G1!}{4<nKJm776<>(mMU-;
ze2#V1ym$rl@puo1kJc`lhXNLop?G_DuaDIyDwN!Z+G~bW><pLTx8J%&)p8JQY0Voz
z$bnIRRk{0vC~?pAr{o`Hq{*Uj3Y*GRV=}!)+CF8`djzR#GTH?@I3DEIzAvihd=uTq
z8i%4<^ZhXXuJHZPfrP@uM)cGjPq#pc)+OuwaLK;Q2<tQA^YH7>&5V9iw9DjG!{Po8
z0J-2JkC$WcM{=6};QA+`Q#Jfm#~)h@Uf7d~gsd~5FK{IJD^7D%h}@1Sk=35|v>U#e
zZN~S*itUo?0EC%Jg%eYmB9ystyodW1Q(gP3>aJ%hVt|)lJG|kw!=v{vuRq{euX9(N
z+WkW~1y3JOIWeMxViJrTxBT~O8K>XzGDYTwyp%00yv_z8_WavaK-Os=GcT&;ZdNp+
ztY(-#ZS>19hUR@4;<L`dUci4(<03#uv_bGh)raY}DYyL|O&lPg5!{bLtfQBv9ynQ1
zHfr{jnq=J9X-jk=y&p*2=TCqoz<_HGE)X$uAVgZbRHf5h&kA)1N&qfaUHLs>%pp^}
zo7-H{(QI9Se+b3!h2eQ*p4jrY$*46YR#NI_U&u0=!)^8F*^e6kM6C{#990W?6tO((
ze_nT;izPrJ+I@x@u^JOJ!yToqb-a1Ii3*+@r$my6i<!eW&x4NFqx|Q6Rw_X^<nXaX
z*D*38!poj%-Nx(n%~h^-{9c9iJvQY+Adv??InjJ4<w9xSIdH$`aNWx!>DLABtaFHi
zLpTiV<G>_j^1@QwU|iXO`DbmI0`Up#+xf<ifVxlgZLBHFl@e_LvxgOtc+jwN6qC?G
z^tJ_Q-4W3sd5Y03u|f5F-HhsAVEoLo@8!f>y>38HlE+9ac@iCW4)5?LOIwAI?U>V!
z>Gqe69=xgu@Nb}Qd@afvm<L#|J}skQKr*K+^&Yb4>RM#gA-J)8EnbzMe|<u~Nm#(~
zwSo^t^d!atZf9JbwAyeDQ5kzQCB_Ri;tbLZH_S-bv{LB1(J#WGGBopYs7=XLlNVKU
zE{T4CF+nq)524^aEm07Xx%M6epZ7-{vz{Vb4+1q>u+SpgF`~}PD$0QRqrKT8nNa-)
z5OfdOvyz5|u%dY{I{jH#mv#WdfrG%oD_I?>;)f9`k7Z}qQ+jH}F#ITX2r4v0hN=LX
zijQne6-M2xgr3WC@)r8AyRknpr9Vu0sQ661j6bD7A+VF+62K4=&Y{UMTG-pbs*&6X
zShgb6MNky!b#W$Ux-V+gZGS?OvXw*bB)zq8;ph)6cpuMLyN>5K@V@|z!2fgdf2eiH
zN@eGiwPql!*J%%mKnRraIUu$HtH`(TW}u$lwoF?+C|46Ec`S9sfM!1*X+uxGVN9?3
zmp91W*<)}>`)KbVeE+K{PX7?`3J8aQWcsbCzfJ1SEd7mB^?6}dV0)Oew!s8o(;KC~
zE+T)}9Bmb{OPNa=$=d_dUY+I3fkwO=c(WD0nQp!ppE_ifSgSraHgg2<>mIv5PLR4q
ziEmOLl17y7IPwd>cV&8*CNXYyfa^p2!=^&OSs$eLfg_Sedw!}6t{i{z$3edv-DFHf
z(nc~a$R+!Q5x!6=E<WDEUoK5}kihxr^hnJWj20=XlP3kIn8t!!vNeYyzC}4Hl_zgl
ze~)QZi>zBM+j~mW;8f6>^opZPwPgFHUG<iX3NaxGvPll-`_wA=#xvq<AHN{@^MZE#
zR~*cRseo4EnVN8ikp#J(x)ru-{O-#B;C}yjZf&8l9NZ;)p)mbYI(l+{ZZp`aP(kkl
zD`3XI`&^@Le9MMY=RV6_cikU$N@FsSZ;9S<4d0FN8gqv_7%Zq#FqZX}Sa;&+)GH;#
zGs&dbry9qVr*g&w^fNiSy~8h<dG!HOPUk0Am31&j#?G(pvr=@jXP&E;+g4I~0zIh?
zsRV2)C#J~M)`JB3BTpvCJO$xTs_a8wS7lZ%C<Bfey#KlPb?p0cB($2^Qp~cw%OW=<
zHFN}!5gZEU3m*{1_Lcx>BpUTB34@4Grr14mw=BEy?USNU%MAb*Vl~_Dvt2df569mh
zzw?W1`y4rw_cvF1s#Ua#VGrB<!}F3D`Dv@MLu$jrn32@@1pv^t;~eE>BgD2IV6M)m
zV^XJ@NazB<YYQ3OWsK3@-)v8mEf)_TmZPWx-n4PJ9|Bs5hPZ>k`*3$jt_``#%%6MX
zJGwXfgjgnb!SCO*u$PlPF^vq`F-65??VrouevC+WN3r)*`s(=dSS5(}_Vy0jUGTGl
z0Rlot=H2Tq&$s#6gE^*^l=<^B<CQ?#MPT(!aP-ibyA8L1&5zm_u+o$D)SeP_L`UiF
zOVQX!HQB;0C%!{IYnw-=ug>6pV`ASObQa$z{f@B=-$T1HYqIlM+J6Ack_?dzoVlQH
zO@&tGczzUCCyd~52&~$Zqes0F`B~NAP)<hN<YhJaV@jk_gp>)T-zL=iNH?%a$Sm%o
zojnXkMg5ejLN2<oB2=e_n~m_v%5)fXj`ZryzQQK^5<nXxL1(E(s8>X{CLh7=9nN?y
znLYr_i4tlqO#|!E$xJP3GMhu#5!78QE5qhnAnz<t(9wz6+^j?|kMEhgz-=TLOuOPe
zlr${n7S(}1{tbDiY5V-{-xSF^;R!5`R5Pc*WNN4W!Hwjtsm2*6-MHgYu>)_i7N<hv
z>*PH~6cC)@2TmOsj>TDce`;V^rhaZ8dj;c19kpT#V7iA?aB%j#%S`eqzp_T<l!K<T
z2iYxnD&DIFY)MWNZ9DF<jhTZW;|3RAvS%cSw^2Fq?QPs{e&6nuY<IkK9}jN-dR%+Q
zxOgbhnME#TS_WLbJ7-o>W8*B(0n2HW)*Tn9YzQLkk4>$5$5W8H_oVw(c4%5<NDm-*
z4>lLtvj|H>XTX;YJA7}4>-UPC;NlC0vlnh#a9Pt+A2P^Q02gvOFJ7lB@0TWG;&(nq
zewGYKfHxBB8PPGm<8gD1uzg{(lwXi@e3PoZ6Ay6T=^uOrk5r1_$?ur+A_U2`vKK^S
zqedCFJEnC_0iHp>;J;+tz5|`Hdw^g@(MyJRWa1qS+@J`a^K7vLa*5GmzlHGNomYR8
zOD;a8Pps+z*af;G=<1wD*tXSdq@D8Y#KQ5Sk3yPye0Yha?A=!#GSy>zqbWtQyxR@e
za(5MoLiC4}jZw@V^0i}*<o)&H+faL1pAsXMw-yP%zWx?eX*>KLMreOBUWjd>yP9$W
za%Sb+jTNj<*7J7EA%w?szc_0gig;&XB8XdOkNpOn{hXh;Eyb(3=3K^(2X}T*kX!4z
zb<Hw!2=zWuwlqnmsgsMBd{9B-ML6w*h#@6f^sxb^_54Z&@ejBPjGMIE70A?2Scjy=
zo?1nnRp;9?-+I*%YYH$8`Q#-METaKD+#S=}F#%eRZ!vb~7{)z-sPXi3Tj;~uTw+bI
za)VNnjGok^x|32{{&liCvJ~IKNf<vOK1nfq+-)W`rvT7iW(E&FU$B9bgE%N1O*8XL
zaxx9XcfEM@pTx_=WWs;TCIdQnZ2(`x8iHJydy``rU^DE!*T{>A6^@YZ?jXY#TQZ&R
z@S;$~v$8P#T(F}apStLMAEkGhS$9$#+&Pt~D#~9&ED0Z44x5hg$0!+TNi0F<wMNHU
zG|yT{7YrAZio3V_hR0g?o7qk<3Wi&Og2n!)VsLAsuXSm$$k|FRdfkuJbr=i0OXacL
zyjPf@9bNEX|9iho^;LPr`#OC8xB~vKGob%lKX<v+lZH}(IU*&Zdirb;bX&;9z4yyp
zSBhx}D+ALjhAW0fCxE#wfK^1ojh>n-<!15NCA=Uqa^$1aZ1A1o);@zPAY(oi%b2Y?
zuy=`rcEzBEj(XP8unAH<OunQXqRA9|^kkyo3><--UYWaO`r0&C9^>n;eCfxf_#e;&
ztZl3j4=|u`_is<VJZkP-s<gK>#1IXh$K0}U`x9?io$)Oep$loB?(_sam*idd-W{Kr
zOk#6gAPX@a+|8rN`F6Ln6VdNP*n^P~Vwe9XtB`st?Y@k!19Gd~Z7+n%EAPb)G<Oy*
z=;0$YPpU@D#T6GFe!JM_WxQ&EGuZxjO89HFauQarsR11a0Dl6!2?v=oGt51|Y>EWk
z3~^0J4^<V=qT8kVaZkhdj+K>d&TLz*p+fcfR9TU>QjlE++g!oVcX*`u=C;U~R$4hC
z<a!0P;?6P^^vm}H^S%5pyXI=#KuX(%JQi<_fQ=N<WYADSf*K3v^6Y_oOk&T?RlUBg
zuAJq|F0a%J?g0)~>P_Yc|9Jx;a=<i*`xgg7PFxE$DF4t@(8b~D?1eQlMD2H*0lf^=
zpukKD3Dg+sIu71r#rs~}S4X@iHl|cs#5_m)NH1P+Gcs{#8WOGy%pA#oZwpM+UhyUV
zTchD0i)`RjtOmLaxwbMKoQr~YvEDOAyD5DL7Fm>&s9Wby`Po?VO!5x{%b<W~EWwJN
zL=hNum=KD*)$IBC=drA&xVB{9?1K}P^Docc9yLWsdPLK|FC(LR_h#h@yW|#&EVAYN
z8104%IZ@EMfu`yK*IR#b92;9UU}65YV>c-HWlZ&b<S3uEq@3mY$GO>UMLgd&L%GK&
zmZViyGCOmwDc1h-v6U|f-Gw4cNtU8Tyh9c0`oB#)-i59mQDRk)Tn7|uz7i`J9ZlZj
zo!$m<o=z~WN0AwxmeGCjnH3%{GU?y)&=JJXpHa^zuC5srL@s7j`9*+F4mK@5<*gA-
zUCV0epvhMU)q2`%SVT}f4k+>{M@EAt;v&_@f8r^Buudscti<!CRP+f3#t`y?^d~Ee
z?`Wohr;aSf_Z{>ar)eqqo^)pxO4pHOE+h}rhq)L0%G^W0hdfGuXZu)Dk>Ngg0EC=N
zD_5PI{)3ekChBOqLXodvF|2jA+6c$`H8pglijHHsR~n9(daS+RMzbcq`LD*<B&NYa
zKko5oL~iP|uHTdi-xQT5;a%nD0vLzL5DY>qMD9M+oEjAqjFm@Vz7@aQt{NoMka}aA
z)(^fu37KIGY}4eOlQF^QVoA~dC}Z*<IXM)c9|NGU6@d+MwUw*O>x`1Va)4d&@twgp
z)q}p^_4VShDvYY!VrTzsYlHU}%QL|@6g<SC(R%f+b$jAB3cIN|6H2eSHwx6v1<uN~
zC9Er;uo7S}CtRU!qFjvk*1T4e0cOwbO*ir4;XHw#*xnfsZ5sxnZ6cl*ts2M1d*)hU
z_TcFQ*4jqU#ibsA@LTow3dz?ha(HwJ8U)4mffozuJ;u)<(@Fm+wC1`b2?W$gP&Zq!
zXXA&{xT~;We-f6v-}iBXBU?Kg%O(;VJjpoZ*^J+4hTT2?VRbL?i2^VB@fasYuFwjk
zC15ju40zWt`+wQEzi#N?pTm=zAE*m<4KsHjonE{L+8q8WzjJ27OvI)@&WzCGYt*s#
z<CU$4O|*#Nm~|w1$RBg2td1z6VxE~DamzT_^#xAl3#ucjl~<N*vAS4ZB%wbUmYXHf
z1vFpfGs|+K+vsS%d+wiXbo+GpSId6Dve^EsKk;0&_OuXla!pppJ6qdBPnR1L%T3(>
z#1l;0*!AYqRwPs<yu}_ZMpBSTQb2@<=Zr`F=sr05{Xe>@S><3rvMh`%%8$--!I`fr
zXKX|Eqj4oanaRvk_!`i#Y<zwmHC7@93i5lH+#k`zBYF0iv0gSZLW&)C<0Ej$yg3V<
zO1A6$YHSA>f*ZjU7nhvR_O2Mtgye8EUolcZC(IFYr7LB-V*qVR+qq)b`7a2L1z?7R
z6k9i_m52L%3EF`^C&v21f!^#{OC8rPJsLJ^JgTt|0;A?W#V`}J?rM{!18t|d$mqLb
zrFol#xjpUbK%0xl7WGmb2B!IhZ{D#@n`A)iS;H!8#ahVhXs$|9+!}t>RVHx-YD8*R
z_tEprywY3w-S)<_n;wGDgrS4h((YnuYcBWA5{;)_#`ncbWWF)Zd3_*s$9EfR!st)z
zzcUj)GMw1BXEf7!GRXc;Wld+GXB%G(!HWN`|3FuB62}ik(N#g1P4Co>;!YXfSz3Js
zT^wz3xGxTi?OC<dN20X$cUV!f%^M!OiEeRJM^)<0xCrbyX4nr8KcE#*vj2vO^qMM0
z1+8)h<qc=<HH(j&?qLjO#hQk)9Y{xOOrOdGe8o^aV~J3-nDb2Q0AJlgX+#&>x@CNu
z)AnUTHRVU$CdIjyX%xu!4H4aSDCEt1_aHvxcefso|G#OF{6{CtUteSWbLxNCRB-%S
zIVE|YgA^NbU0LcUGG`5+ebs}Lg=k~tmT5zZ`hHb+;q;F$4glWqqmm9;xj`pDf&ni!
zQzA!dk&00p8Jk+%o><-;X8nB&8b63SIk%-<<@;tDlmWfHlcqG0*p6`5%~M8GA_M9Z
zH@<{phqzGP;VN&5VC+l1;`p^U?+B;Af9lv9q}n-N=+Lry*^3ekSs%|9X>G`G^ei!+
zI)pODCv)<2l)^JMLYB@Kx>ue)finPa+63M-U$Q;y{aC-HfnBCU(AjS+cH55`#pIo(
zz$N{Eh<neVCd0SwGYHZ<g7hFoq<2tSM5Kv;f)r^HkS?OqAtVS=r3eTpND~mLp(8cY
zn@I1yO9>>D5D3J*ectCkyZi3DA9i+U_EQ*OhD^Bb>$=Y4JkH<Y$nCXQufU_ub8qJB
zM`txU*okuh0Lb&V0`d?h09JcP@%_ra&b;s6|A!Ru(@CZT>}cZEcQVN9A-fSK)oa9>
z?GUV<sXWBODEC`z$;U===}AZz|IsvIDsop@p*vAUFzl8QYYS(;+pi;;8Q6FIEQ(4O
z%ahh35LYE1+St93o3oV6;WR84NmBtp-~dJCHfe28L>SU)=fkaqNYeDJGOaP#pA%_|
z>8VJ;Q&scFV=v|BB4U;uC`ji`<G3ucb$>9Iu*II>kWPSl3NZRZA^sHP%{q_93dfvW
zUS4NcWq54!q*(jw_@T`79lMPo(na}}f0j(<P7T2~VxIxvzwtKb4nV-zQF9-Z54I1!
zxvYBs6CnmSDEzc$B8QHJZlUXqA${`j31+&{KOL5$q<Y2QF-BXDe4({AH*e=?JB>#6
z&f!t0*f>mo<q68<wVMpz7HLZW-C#|f7kl}2clwFB2l-C5s;b&-{;msvjk&<B?!2t3
z_uaohi!30}!Z6Oy=?8q-{L40HOLyX%GA8w>ssPMG7|=sJ!n)rC#jItDn54<7HA~)P
zkNT&F)W@Ocd-zu(-TnYfNDs+p+}YwMtn>Kn_JKG5B}Z(ru2<!?KhV8HL9uI7S;QH$
zU_{?SwNmVL|5T;K3K+unOt{*6QPO>)CcE|Uhs#ZClCi~_V~Ic;Q6HO`*etEUl!bzX
zs6D@%G>L8dVp)<;GP8Q}glM1KN$d3APbo3@W|*wK&bJ%`h!GZm7%?#tvA^0Z_GC;_
zejqhsMVe&!eC)WzY)udF_j#tN#x&Mk1F#y_Y|7q3KnkBN_Ijk<c&=<`&V#G|WgGdE
zvY&*=7~Pk=gYD^z0gC=vQ_KLCArgo(aJ6UuXm(BPwu;<D&jz-P!JV{INmjOzC*Qj(
zFd@A8Nx513-qA3Nt*f82!pA`}ARUeFUV@-!%WY4~{VxJ$N;*S!uT46Jde4>5yXXE%
z5ww*5Ek#)G-MuMi;}-!lmKHzY%Icg73UKx)w*2^t9S|!rIUZyHj!hAht`5MUraHSY
z=zJ@kU&F+<E7yJUyamXWZhIpWw%EM;kBhh|o+p#uUfY;DYMRP6+uj6VC6%nQc&NuZ
z`nq*|0Q7<?+2Rasp&9Ge55DzRT0u^4k!__`mw>JYYNKd*lO=)~d7HjJZ7<hHI$4>g
z1b@n7G0*J`cE9fz-fXhLTGb?ow0CcqsA)2IIk(X!_^Q2`k&Ujwe{Qjbrh`}bkjFzZ
zLu8o6i0Q%N@zoGuI@r;~A$I&2h*DX}`@k)wX}oP&+npvmK*R04$rBf(U6w!VZr1dX
zHt~adr;mhku<Um3M?3TVY|GI&)7yu=JzQZa97ki*r@>$gVDU}r&TaPaBW-6igIP4C
zdj-n;=~GJPU6V^IU&-|%J^$G@jTbBxuL8mzx7I&3q5*EliCO==ZhHf>H*1aNkL?WP
zY^!cb?>7DMHi07jT=cx3>klW#6KOXrn8}5Cn>p3!<e`6gj6y@27=Tuk@-Fy?R$K&Q
z$vE>x<CmIwv|hS#!Z>5eMeeFZQjE3+R5hixJEl`~-%&r=gY#llEk7_Bgu@q4QUd9f
z^O_`oty!x7&fQGk4+msQaGH#BnZvBDfx|1|kYy<VJI_mOr_&~naHQ}H#Pa+jUpn9B
zh{_U!so&6h(|c4cUiV~U2w-u-{^?B?WX8*o+)|@!_-DFh0Z#uiUp`wd3^@X%6sG#`
zNY{V1TfT{B7LEk`mV$zavhikoj~SSi_P!cG@Ssn8u30;EHOO2ecemQroaB8n7q9tf
zlhHMQ=r1!s)lf3N8sLx{yZ6DaY3jb^_XN=v5xXt#U=F)r&tfZzd+gHd=0L<=`<$Qc
zQz=_r)?T244r~nMs{s1dcF7Lm4*XJV1nnKxE&#RDs5Yx$7gIQ(Hk8?xy7(|5CGxRt
z(TeA_e0)`tXGV^2%M$=1`^gE{=`~M%^jwOpDQ&|ClHzl_y9PGIPydbiTN7A&iE?pL
z`x!f6xM;z$m%vBr3jF_qi~v&j@FdFo7{U@=x;Tk$efERw6xoN0$_LNNj!fl2=MaC~
zEjLD9ZyHq&bo#8A&lsu=%~8@ju&QZz5=(<c12G#->iY@*|8pq*0U{JqY#!XEEtS?-
zXLR3MnmNhP7`p%rUd!2XZGknIyM?KQt1|?H5^!-7$)4Ds2WMMmK=)e(7c+9A0oWXl
z9;O+kRb4h2s(Xv~OyoLgopc2@AW(*7^t+z}d!U!XpVm8rs@`3oPk|0=<^OcWhc);R
zSm1qrQ>UB-r|p?nHuv|<(_MvX%$<|8#eexZC+Xd6{Zvs=J-X*{JgCfCUsDrzBSMf}
zcP$oRJWPW?S5P08fbqAwY_wx8%mKR<={*z^xKR+FhIC7<&}8k?in%43e_v~sf;xu;
zIsyHOc7BAt-Uf{%@=fgX9uiD2xD=n)s*zp;;**I@O}rbQl8nkgfhqsFUcCZe+i!;2
zVRkz?BSVmT-h+X^NA=%Z#XX?-QLX*X(^K*GdR+fUGY(qCBrXarBLws&d;!V`S$RtA
zUAm@fm=s{rmp4#&_vgyH+0RyjV*B4bI=0h6cp9A1Wg%)g7h2mBp>S~BpBV~rH4CJh
z_kHe`Y8fMbR0DSx{Ur1;q}cqm>O}|ZF$Lg0@_;?SqR=F(Ml(jZI80__MC%Qg$9?kV
zocEIy;zm15L>_Yw36%e_af-WW=kQ9o2U4d3x>dN#9Eg+AOd(EwbOU?PDZ$xcHC}!~
z2YobV->9Fd^*rFA%#GT2&2zJq{CuoD+Wwmr5W6L6|0P_~Wv!|g!Dm-l=y&+?_GFL;
z?ZOS6CJAbbj%roe9(Rr-8@<N@SB+myg9vH3OZ*bn3+IIwRhNW`HI7UXWcRs(=4{MH
zts)w%>UCESIYquwj%5C73wvq%&f~0^Yo(_XiWlkWObD|S?#`wW?kMT49bo!C=W?nz
z8+-jt`;5$YJLxFZ7!vE=l2F<9<|ZNybZu$x;N21fkzG?d#)#Qn&W-sfVSc;f%-<8I
zzaSQDKHD<%<PwE)LcBvz)p$liNKaA$;Rh}DpnlYw=ekx+!;hfP=o||>+5vV`jT$yk
z+FWLF4=@9rFztZr4a2oy)a!$a|Ack4ieWN;nKhPud@;mu(82B$^@BF|*BcS-KI6zF
zN`(pd6rzp+Fqu3@lFzy|Zq%e7MAvq^cn7o1v=936uSudKWZLt;J5%=vUNsX=$U-fr
zEdfrf1R@9!aUij+Vsmxbt4mR7uWXF$@kbtIW%nbP6c^dd1J-?wR<3GvynKA<+z}1M
z4FVpvqTN>MiPh`240!qK9>;5+{NKAKWdzwP$M*Rjc(?YGY~KYx)j|SKm9Y=%iV@bB
zMvC;0IsXFEqgg<$Y`q>yX|qc^8vUxCR+-P|?1z0MUr^7UKEY}mTD#R=)C|4+(kL9|
zZIxZ=Hc7duyY?x^JN4!>h7{5D@2W+#`E?6}C*`#z)BXq@)Ku-$`-+w?nCFLX{7JkQ
zzJR()Hnnna!NfcCI9n6nvl{TRAim(c>*M>75Cdu(y<5;%)jHWP9#M>;Fpm#r->+rw
z<$m=y??%y<%ZnVBxvkWkmDY-hd~3K)ouKq3spmE4SrEv$;0@Q853f*4ZUC8LIVWK`
z3gX`4u8o1lsH!cOxNg}<YXy@PfgZg)$VnKa?iQjgnAHr)F9iY`r2xx^C00066+zIy
zpu^Lw^0>`u52N$-7wq>}{Z~RK=?r&nTk2)qW1@XDrxMrsYOR|3G+|B-H;HF0gk7CL
zIRk{eU9&puRLq5AVSQu`8q#rwilK4OC#dH4k#9I1eomD){{359Th_fi&e4$BeKio4
zd2ou}_7ds%T!KD7R!3i^AY3w8aCvyCe3<1(DOfKFy;0X(<;R@i-sC&SPX)5sdBefw
zB4qKL^n<$BWj;_)8$jC-tbnItCJ*-t(}`e&i|=UNuY9oKjh0qE7#t7~lM{twr{0L(
znE%Z%@QB!-MLCYJLrp(8wZtcQR$GjU*GjRt`D#QM`z649n<9CgdROC`sHi|6NFYkU
znz+$STI>&aND;N!@jsif;JDhSrOORIXE<_#!ET|oV72c1SnT>*!5hx3NNnC3^y1oe
zoH51&+3gv_gqP}pGuQp7fB&>%^jUMwk81r$rlObtdc`zHBbh|ZFBH%*Jb#KouIfap
zOI_T-9CRK~=?>-NllsMam132tC<eLWhqxTs>6J)h@N-1!lvNrY8k_(Y-7@!95qa~o
z<I6()hC5z}FDPmakXu5g9s^s|!e}iI7fuLo<yy3VlwaNS!)5`NQL-Doa-mvp9b_M(
zS^|u{#$o+BQ8h16RpxsMIj(_)@8!SKo-fvyHAfnbJtC7Nd-Y*(<1Dd6X^_x;*!esZ
z2+QDy1p|*#2>ds|h+y|;S>?`Rz?P?Am7YZE*Jt(jZ<5ju$v^IoWY&K4wV%VHr0CHb
zSvuGRHqrv047@4KW%Gp=L3_uRH@g!;uP)TQt<WiW#B<d1TAt>{nLtCROMQ3z-6WY1
zZHqzx*3yoMK~SSy5M-_pmR4R{tKC_X2I*dGg7WAFXo)*&&0FrKwhjdu<AV>n6o8?x
z{s0*Cf1h2Q-S!ykwPG_FkD5t)HMcmsQ<pTa(7({A1O6~#z^EO&??lV>=9mvTxb_!B
zp=txHcLDqWrl|vQ?YPBZWirKiHAudtzOK1q{Ngy~9;}LJU5b)jiJ)2rV#)9l&hf&v
zcoWR&idlA}KI)pg@e+I9)hylPKd=IWyyQmx0zN;no(H2?;frf3hWMbBq3~=F!rAlc
zPGslQkqeQxD!GgEAx@FT1Dxi1sI%E6U-dkP<W(`fKJ%3i3@<NZAT9~B?yINWM(-hX
zaAivuGt7ldl7#wG`S$^N%us##n9?MDvHj@0@M&1gw4*SO*l|_0xVHh<!^Y;;u@@3(
zNuTS?Hu|)BT)&r}$(QC_=ku0Gw)Fn5GzIfm;&7w*>_HpyTAO>Km$N(Wk1k<A=)J^G
zu>(T0d9|t4u1c_W|C&*g4aP<rtK0g0xrCv2%8-F+ujF1aK?2h7d9rYbg8t7Srn{CQ
zT2(0@AG5@3R^)nhbnV+r9z7)UrFj^9FfEN4c5|#oe{&&drEmZE^JUg=KP~X-fk)7w
ztzG1klHchwiYVq+CwI2HZT{g4x?lW<tM#8(g#`iaByH*#D#0%x3S$GfFpPAp3~<Bb
zX4iVg!c}0p-IbX76@!&ARgwG$Z}%jf-gH{)b2(b?X{F!&x$nwv?5k5lEQF7w{~~f<
zW~&SPhmNylKLp;i7rSlKN>$1fI0_k#T28REX^Gr}r@dN(7a(`cnH|bEnC{6P)XCr<
zQA{k=!CrR|_+i!&*QhxCp(duL>>wIn5J;KC7T6-mD*u9#Iq-geK{g86m&yxMwZvJ(
zp)2G%YR_T<a-3Px1zApo96CVg0j%t|>c5~ut42@)t{6{+Em^ZB0<Dq@V?Y^|TAoZR
zXvS<e(rQa+pX;Ire))(+%c`b);MV?Z{*c_%?#D$D@W-^rUaaA@u-7dtdS<t#_}*rt
z(pZbD5`JqdoQn~37w7R`M|+lke_Yo?cB$dM_XoUxP{p<0$DN>jx3cIwY!ao8SdNAq
zYF;3K$!6xiplxo`8FTvW(RUe>=3@hei(`aXJCk$+-wOcH46bFx`k`|P{8H%Pl><t=
z*+J*v${?iU{5z_N>ZP;$_XhzU%-J$z9yOWent<#|7o2C{r#q6L7+M^vCk!GPPqudI
z*~~_l5v1UQ>Rgv`7cc76sYjaC{(>k|Kb&%!qFeGGEol1DtA-QqUNM*Jt5aGW++-VY
ztZ;=aC(Rbd)Iz4`?gJl9%0}wqn8~=uanHxp!PqynSB3Fx4x+cX>3;CYKp_`4*y}Nn
z<!=yntL5wM@B8Er-omf8#Cx*%M}V7(ZMqGoC5%LupPkv5-^qMS!{|Aka22oA0bx)T
z&c}1L)iG_S-;DI&DJZBx_}>1?PAV*zJn<>XB1um$`7ZbaxSru6-x&vtI3nLeFK?Ug
zKzhJ$Q4A0lqsYdzj_j!O7k+i-Bg!4>T}o^wiSK^YCBBvEk0fJi1B+eB4?BBJc=Z?5
zuZ?gVI>*=k1&xKn#~x8^KrdL{uL;MYPZFXam0Mj44|i;Z@tWSabC2<y=<?&Jd}-1?
zp;Up5kHXoKPpmU*&x@eZ>DEga;6C2wu3+&Za$q%>OnfC!a*$s{cKSrIAD(ZH&ip^6
zR09;eZZN)}`87~7u6iQ`71P69PS;<l4-`vwIYSoWO-)V|juir?x=@s0o(n}RL%0LS
zkCqxQ&mBqo%XJD&qFD=Vd5xW|B!Xt-Tn)VZ8}@{|sL8YO#4>Nh1*wiVS;ejmMXK{+
z9Tc5VHL*kJ*Wmq4@Vl7y7V-wMk(4|AU+N8q*4+)=9vfRp16E-EcEJ5h#>W)atI*j2
zKpeVS)rVFLZi*v(yRQ=UY+4Z1$^gn}C_2mnRhQA#*c4TmB0Y6VvERV67y@bB5fkV*
z%E+WJXb`?><pNc2`oKAr^B-?9g8<-VJzCCg4>p|B!e^{yg4<6|UtNA>SKyj1D@bDQ
zQtf)m&fN4d_PAG}-xX5ZvsYWTP!N%Z^=z-U?r$@Opx<jbJKd(v&F6|%i!gxO1D~?<
zW*Br#o&G{{v@9>XQ(a(E(srRPOte_sY$v1ghj@}Ty)tv_#PI>ziy#iHZSKp2X17x~
z%}5OaMdkm}dF(`2{8?SA)ts)3n?a{rl}zfhm>rAAd5u1KlJooVNniW8D0DzY6ntUB
zVNeJ@3|Ddaxmlzf>hIo(x&~AE=GORp$kWIDb&&@5umQ&`wm0_7%owO5InT_ARB}js
ziS1>){Nq*Ef*<b<#*ur+TPg3s6`cc>8j$uR4kn$u*KYk}2Xn);Fn-}gRYaS8%>lLb
zwpsnT65uo2oXGPx)_uu4+ExDcGo_gDL1Dzrd4`9)pK=(cv&o60km`d@H8VAepG(ZD
zYUMl0h?1I`35kLqh*NuW$)yma8?pm}7fWbEzD3ag3(Q)j2!$zq^VjSyLe9<2%)7E-
zEeurEACBrbTfJM@s1l%}6pss`oY%Ot!UwH2wUFXGFg=~9_vSYz_dD8CmCKt{^JtTL
z?2{L&>D8aLMe{a4qR921TBUdk=W;==LZa09Dlm(wk**EnFCA*%zy6b3;CMCR*&Vg;
zfTfOuSx;OLz6<~(wBNz(uJT4B-F~r`W!CN)yjdZ)$iE-?Dlh2?qu3z?r-2VBLbPeN
zO5(F|$jf{?WmH(R8f?}t;zC76s<4O8^aBvoZ641)D|=z@YLV7!Tv!ZTZt5=h@Bx_J
z72!~#{Kf5&7Z(DnXwpvK)YQ}TCrmTC_DNKmk6<Y_fC)@M+eqw)WPF$cJqR0vpi>CK
zbNYfT7dDu7Jr-6+<+4^ykv8_Far18%oY>&4PH-5J9J~J&)P$7`|K{ceYPy?rIC&>y
z13i$XV!lk#4s3dXQfQ!qeN__QBxvbTjn};2(rmT1p8MXhW@IK?+`%O%A{w*s>et2c
z<aFQzugA$%`&xRpySJ?`eeu_^kd=Bg16IrgpP7$GKA5!9dHUj5LUQ(;YQN0GtImC<
zY~)vBOWTUytsA!iX#y=u3;>SQuS*OtQVb356L8aq&MaxyV$xz2xawTd-cggIcT`I<
zT*}xxD5+_?HsgAsi??o6he1o00KEnc{tKdQA*k;n7?0Oj{A0EOZob7guEc|Vui6;E
z;1i(`p!>(yL(To6lgLDpZ`Ff7U;Xo@{r$c?{X{FI$rMo#7K9hW1g}P}M#dc{&<?$7
z`WkwEc&jiG(Ok*0DN6|Na)aH$w*l8;T()`<rl~94ImV;xK`FY>M(35CGsk1mTnP@o
zSL|2ZkMeNjm+{TFi6qsRc_<f^YuKqyR8(Sl>6G#)&6u<68>OF2PPAlI+NKM={h<Oj
z#f5%AJ;+tlLW2Viu+YK_fo8mh>-ESNaDL5ib8fT2AKh7NP_us3u7}w|AT2W*?oXsw
z?k`O?7#J<?oB>V#I;FkJ<pnn=gMadBb|hMX%TH#2vNhf;y65Wi!vQk8c^NW4WHw~E
z2*uRwh*`tkpOS25c`cFhyD8W?f5H0agFd><J}*UfM)O~k{K6x>2kFr1YTV1qv|6JX
zr8Xr_=sS5MX5kol3!#aF^0FHZ4L@4aWpKUgpF5NTOgv-xo(aso4VAsCzJw9(L`5R5
z$$y(t=fY<gV6{RSk%}39tg`}4AIj~WW~Yg4Z8)SnmI7@@kn=aOZUsVE;kWR94=23)
zvKDtH*Nj8&<fO~ht|f9DmgYYL_UTPjrP5xSC*j70I+h{~Qkyp=snFu&p@SA-dhgK?
zb2}#_!bz~3G0CgX0h$3}QoXT)h+o23v?#ULbJ~>Q5>{x~Z~ia#nuV-SYBG1hC1A`f
zxXSzz0Hx3XYj1K6xUVAvFoo}7GHXbNr~cJ#>1B2GUw1@pXAehB)2UJ{a&PVEKI726
zt)_u|58RArf&g7)ZrPI+b_HXYxeO56FErD;xpqCPXP<U`pXUD^E@`RabDfGMaU+$~
zoqX2oi}^T$49;bB!GqUWUJ9=pEnRCrH!XOV%qLoHK&#>Sk+k<na2^j(Hy{6ZTbmSO
zHs*1XDSE2Y#1VSV!S^9Bzt|L|X?usDv}1mKiK0e~YmNB%YjjP+6ancVc8}r`Q)0UX
zRfho&L^L>ocndFxsc^%(VHuuG<T5KRJ^Qm17x>9Dh{lYk!4ZFmx)k9~@h+kAYrI5g
z{tveQ|7}jinHX;Lval552oCi_F|ti4@B|Va$7<Y_AcFN{VzM<MjNP|Vo-T2JAtPfW
z^IzJ_Bk(}~%toXT^x$L4aa*zKif)us+E#NB?!m0i##d`=MCuft$JL>(UQ4PB$@7AZ
z5P}+EnwKbu6QCUBDk*C<Po9_J-VygT)UZoG{N_`&0?=Q46bN>A!S8^NTAjzAbk*;I
zwPVdMk|==pG{kCurhoU+c*>+U=J0AJ%LA<sI<i%f)O(~3d@?+P@J9c-Q|-$vBEym`
zOaXIkHZvj8elQ_YRl$|}jqcH4f7_L-TD;FA^r(yYJcCR9A!$n>$c8jP#zO5`BR2BQ
z_b$6S*(&sWy!g9lMQs-1SxvR|1dl;JxqOfeB)}6~O+Y8FO2uYVH?v?@R~bnC9eOO|
zK34c!X|+gV=D2!S1RkeKt8VMQ%!myjE51QyejG=}IH$o=+erB}`X2wS_Tuk9LG&Ti
z#McOq-4>%RR1NZ{R7`rbcUTvkU%)W@P_;$2pV%+vRdX!Me8@zc)UhNc>{fGWjbwaX
zK%>f1h+Bod-S5U%3qAgVB;P`lPz)$1@NB}`L4xY*RjJvfp2b_3sR$1rDs(gCtBYm6
zGE7M^d^-P#hPn5#!)!5kK<OLnWjmB*$p(1VuM1T>6tQ<ajdIK;{j(^ZwR$IReYSSB
z4d-Y4RVe;u*8H7k7VEvBpS_zu1`~e$1(EvKuMX`c0;dJjFv3Yqspotu0nY2+c$>0v
z@?|=4wO{3vqYT;)(&+!(V9$Y?m*q(0w!j`3e+%++D6|9Tf-l2L`!fKM74MpWyj$=b
zcxLi1XqMM6gYzugb!O9Zt{Xkm!-^T&lUrk;M4}Ur*6=B_z?N*ZP>H^vqVY~2ZJ_s!
z-1ZKaD2g<(xsXI9nP#0A_u0<=f(%j1Ie$TiP7qeq9y8<^=1tN8Z?~n#40VF>!UrL$
zENfzvCk70bqeu^=grhjKMHX&ZHYr~k#|OlfZMHgL)eBb-@Hch3mS{7A9UfsB_Ey$1
z-i;Y#<#|uZ;$I$bM9wT4-oK%wdoB3*DXG(ab5A5{`3v~)`4SCew;Pz()PE`V3E0@b
z`akIDf>s*EZ#KNs_sUhwF0!oLy;f<f#Z_@C-N%2)K1}h4Sy}hJ;0q3mE0lN0c;9jQ
zzzPZU{_O`nh$=|?5Yx_eI-fVQ;%rs@TV5*DskQb!O-_<}>sifH6CeMV`Go%uClg5i
zPW`_#418;q8C3qX#{X6+_l$wy!l<rj;Y<t$O63gmZO`@;y5%y6nrZ>j^emU)8Vhr-
zg73P&e0?^xfTFx`PoSH&w3bSJ&l%UVZHp6?SXqXVKec82C3<wC#?rOO6V-nH4%%eV
zy(KW(Du`u3TVa&iEkCB4)s}yfTz(-NP8JGTzK6Q&(-b9np%x(cT$w#X;i7s8COrla
z>!z>UvW{Ql3W)2F76_{cui1LbNCcIhTb|k6QTHC2JD?{nEmg--;oOl-O|QRvgc3y?
z(=MBU=?Mu9c>kin0xI4Vfp5gmBidA3ua)ZZF0!6!ziIvp5*;4{4vs7^#mmSU%i9tQ
zZ)tAMb7y@C|60Iyxh^iLo{cFFPWcAAhxc1EmW1&X7tHGSay-%weycG4)YiaRbcm`A
z3a`aGV2@UWJ3Xf}x>Dg{nDTlBVwk`c2Q!b5H?PCqLXp`N&9+NSt-RZdLhm=1m^s*e
z?Ul_9I7i%5buvCZy92Iyi(`oN>GjcnLi<`YmUDDMzA4y{^jZ#E4|y|<(YW(iIoWV>
zNB}DkOV{G@eJ&z^)tX*|zhQTH9X6uIP42*n#d+z(yIYE%KiMlS9N3{Vu0UlNes+$+
z+8z~6Ki$E|Ykf>o4ok=KIBNq@hcb<s?=bFP;~W7ll%Wa`72?(7Fx?D6wiR2I>oPl}
zr&*8On2_l0`K@doxjj|S>AkAUV5p1q7(ST`)}H1NH1*k`x&nmKt^4T|z3nmS?3fwk
z75*0jlKkl=w5L|`a}f~xAoT7c=g4;KU$XaL6QAgF9?Cn&YvbPAHFIHP{ZE`@|3!tE
z8Vm_=g?bAOvCP*1ZDO-}Gqbav$4^@YG4q@s4dgYMr4-gJoeExm`(1ta6_9xn5m#op
zqZq2mPrgq>y-~*Cbe6dH4EwmVBS{ydlHux+?;h}^M8egTv*mY+av#%KAd_to;2Z}m
z8J|6V9?5)(KUp)G({mOHb-eMmM`6zJ>lYtYaa*=;yw-otDINe^Ed6JH{+TP%vEXpK
z=D2c+2yU;KBMGG^jU)S{?Ps<-^zO6&-l%yU854@T?6sjJkW}Ku5FLM$J9!?Xmy<;G
z(1fnQ9icH*F5mD|>Qlla_hD6|m0rm;CB~KK+~-csaDUEO2ilI!W7a9^Vj#Bj!F0gN
z4&ZL!%CM4RvN%gz3!>d@_A(hQmv2gqdFGqkRt90%t>=8cQ_vUn<yrbMVb?>hQ&Hfw
zs5!oY$6ejiK};e+Gl~8CkyI4+Qp_|1AQSNmd&1r4z2j`>OhQzhw|e-Sl>qBLKm)5w
zG@Qo-aoPw!`7v5P-aT!7C^BB~yCMD|x#Bn8mtX4Cf;w$^-<!P6*NCQ2Se*i*>Acv5
zuD${c4w<%d#&yhj<#*2_0?l-y<W<znWbJ%d81BhgA6L?6RI6FPyrPhc7Rll-n82&X
z93y~1iS7aCK;SWHTbwa)5Yv(Bf3o(yIPBFOliq`En+eyV?muVq3T_{Tz5dJ%=mQ@0
zy#I2P8$pMKfW*d}PeTv3n<ZA0nXJUd+LoDtbUyTp6WxaoP1|@h$bZ=V3$PqD%>#TL
zYYj&W1>?9k;=}ctgF*CR<#X<AOO8LfFC5a3(1?yS&gW&~ZV!b~Zd+xN>op$@NIk>`
zeV@dnH_l_fPi1k!k}Y}CqG2*ZU&?%3WFwPfR!A9_q{v&U?@yNbyf>=0kzUl6HnLo6
z)?dkWIq-51&EMi6Wz7`D!KxIymcLHb<y!z@A(rH9X^~XJoO>rNKs;d00x&Rim}tvs
znoP!MR0&wQ3!`U+^~Lf!7)jKM%<?<~g_dRdU*k-TvS3<R=atiNn06M+q=J-`abjKZ
zvo{E3V866T>ep(h@fgW^y(4yLj!UknM_qoG_q_3D5W;={El!7LDnw*b8yv!NXg`P+
znHpP{cJPFz@{Z;Qv*fumx>ZmKcxI4_ZJQk&6M`R*hx+vLH*-B0FZceO>S8Usl|tra
zyO8J3He2??|C48rzz>B1+xKC^r_vS^ma56Bp4P+r-c1o#y{<c0R9Ne|-pUd<qE9*2
z&INdRq?)%VfPBes^*Q<lzbu}08&L?bPTXru-$-2BeCquj<*M&60%TFR)KaE${GNFN
z^f3vPKJ2u{vFkp_tekZHr(~E4GTu(}3cP1$#nOGgAJ3|g+^6M%;{iOYfgHYeXotQh
zM>c*M*?J8QHJ=hREhf`UEPhqrSm(Wi{OZF+6MT<6<{2em=*X(gQO^)l{@^fV9WNHh
z`Z48Oz)U<;RCcSNa>o`tS$1M&$5np-Y9ntrxaR*<a3KKTQGO8n{Q~I>BzCS+Y)|vn
zqSJ3Sc$8X&=pM=RpOzMPjlo7#{+Ja;748*cd1<k#&wGUX&FX3-eAo0c-*|EC0@8j|
zvjESqd(%sHub9IIbpG34aw}ZJALzW>Ul;Khan@2#yUu{`O)puwrREMtki8KL0TMBx
zubZo&-&ud*{j8JqzKGS?3$qUf*_17`T>eN>q%9STw;nG5(uy?3x=etvwLw1yg_<|4
zTu-&&FZ{ncWvta@3mn3ifGc4h8_E{uyz)H#cTkf;8@1jQ6yJq*97B%^dp=ki1=P?Z
z?`^y3zkamR>DcnW^SH!N%00V*@v`l>sF;%EaBACR>bJhv38&ElFeLFL^*`G9|6i}H
zK($q4o9PSZO}M_Thcd=EqU-8GJY9L4j>3d*Y_NFzX3J{P4jWrzLHO^_uuv=a-Ykws
z$IlZVR9tA3m(mMQPlnqL9oU!;a+m{61l~38LG3Z~F%JcIiX#tC`*{B^h-+_dIYOfN
zkpN}+ciO4mG6(E>QA4n1oB5Qbc<0IUI@r&j2=Dg3u;JB~oh%i)J$J)2=hO0p&CqZ|
ze-S?*U#x-d-ap>J$^b4sau0aB30?lm0dVmt^F!1pbDSJO3Yesr$y*V;gaM)O5@*|(
zbfP-S-2#>{o40l?nBwB5@)=lr{HDO!)X5rwe{hS~53sJs+Rgzo$PybP@;Ha#>wjiW
z#IPtLjmBDo_t0B79p0g^QfX0o>i#zc!sy&Kmbste(l?9cgq3guN(vtVV~nICz%@&q
zg827Xu5O}K%+3U}3YQAk?yb^NrYq}KIzk`g!)N@Ou8Uio{CosbD_lv~tHh}Mw57##
zNBjjbT&SoQ<!;xRB`qnYxSYxvcu)&GIAX7_t`@QHOw#MSgUoY?<JXE2qKpEWl7dKv
zNwzI`nTLfj^$|4(4A#5XXD{lQDAWIfjQ!V}e+b|=UGk!7vNj&;)OynwjC_>2r@_JA
zd&<$9!_Yo7Ya`LB3W%W=a2A+QirIlaMxwT0Vx69}XY*&(&LM?K8?$!B4U?(d-ABN0
znZSfy3F;U3@CpRui(6xS!wNRSCP||>efG(jm%vudwtXw=mIt=1)3ZrsO~vqueQP^r
z>Vn05r9Qk>y0E7Vvg({5gsq>o+;KmvrBhp6$>$Q(L#$fMapm56^6cu$>$eHt00ynp
zOvg`ftyG5>rejrps;<#(Q3Jt!?wzRRa}7go`rP&FXL8dSt6TmKvAiy%bKb$09k!$5
zK7*o<)l&1w%%yc(ctt)cOXEZ}kR1$o0d%aTa2INp>mHT{7{IA%s*GMmq#9JrFA4Qg
z2b?(`b_6oF)}Es=EX%2x1c?8YrIps`)nKpAbJO=EPUk1TluTyte*d02+$?>U?AG;L
z1$x#W=;ujRz<{dp3>luyq<(V<Ti6cg!!mS8@hs#CO%|;LVV|D{g&2?J354o`6x%b-
zTh|6b0niIpQUE1~H^qpau1H1f(+$NFZ+3f^sE8pJt%W}B2{eBEdNG|y6{@~>a2Qru
zIZ5n;(k@>{BOK6*V_mqvAgu9HwOe|4DPq@Y!n3_p(T!ZsJI+45GV!Amx49$64@U<`
zY}q{qSZA}w3E~a>@rT`VeDM)Md!G#i8i7T{^n<83o{qmNC3nv!_GaK>u(pNe<pn+k
zc>NA{FT1Y`GqU1`ZZE&xsb!}v5)7#SEiscg<v&kBW}ch2lBc+1iWew3+Dps0U|rJ8
zW_p~T2aZM)5dw!`oImF7WiDd*ySfqzk92ljb!i4W21(|61W;SgTo$vhR=9g{za4qU
zVz@#=#vsl#Y<}PuuFeLN!Eg_HEh8vhh&(A%?&_I^bF(tgdv;oa<~@)rz{NikN{axZ
zu*<N}pINHdFO6LzuMs@x%h+Kz5wWxQG>sRJ=jB80+~|18u`mV6G3~RhE>cn&pZs#o
z{%b-kU=d1xSyTcCl7Lt}ynUR17)S^|%Sm3Jo7a-xBCUw#&erHd-T?~7Cw+O4J<VnB
z(SoPK@oQ#Q!<6D_6pu3NDtH(^ItW}QF$7*xw^Y}Rzt|c(p)}r{+)<3N$bYmg_)@W|
zDvP>8@LzzdavG7U2uKVFj3{2BAPV{KuEfWc|8i;`RfUvZW_3k#!L|G|+j=<sVDuE+
zW?I>RTenSH)wKjZiQu`QA~0OAXA|z(0R0hkD__IAfI3_n7p%h3QB8a~!1nRwHXGz5
z%mZF>p^Hz%bl?>6S3Oqg;9MUu*<ljiXwk*R-}0#&AK1}$x+9AU_T(H@9UHU(s_X#c
zVMcQ~d#|ft;VDdVB-Z>q3hXf<B}g#L^9%c;e}|MN%a`xTkc!vf3*rc*8Wn<YU5Z3u
z%G3q=g6WeaS6k=`e@kq#+$;a?C#(E{G`aR;>@qHge$9FWMuJUS8Q5ODSy4B2A-o!N
zEoG&_)ZeKtlPv1;Cm&<~&YMEod`3F>KQ9Gu&2Ai54+QM(Nxd+DSmxp}oTO7;$?*14
zHL=Nma|0~mTu=F2Z2ZL#m-~(i1O8@V<esV&xT6-ofW6Vo7`>j!=q@8vVs#o)JQvQy
z`{x=p!E*)NmK_PX(o6-+v#mINNau}nZ@_iy4+#DS1r#Kn$|u#4KaE}nN#}q_@P9!B
zJtph`k$M1=u<}A@r~*UA=2!pt<VpIxeo4d2Y5&Ou%7dQ=(0p+1?@EmD3M#Z_XqI%%
z>GNfwREJ6>BA4F~`*1dYI{wy*mbV^H6a_uU6Om+gW1XRGpjF#~cW3AX#LXBSf{iFR
z<KOedm2=CicCr+W6g;|1Pg^l9;K4^y!;=F7{k)QcMP4wEt@w5JRC`8ev%!V%E#g+*
zGCSudEj!vqi_=0?9!()_bD_a5q{qT5r!jLqS)`b)xH+S=2Y_x9X;?FUHGf@xa&<@O
zqt*>urJNUvw+DSr=vtcDQn9mh+LfBr#s4jH`GUNQzW--JhjeQw9E#<~7hrYTP`<*b
z+Q}RWd_)20DC%5~gS<5inW5@fvYpL9RNv;6n%sA&7_9{+MHHt@`ser)2qNLT5BB`I
z?4|nl0H|vRfdlxL-u-r2MwG>`{WODfN9qoHb3OH}89*w`?rhGyG$V6Oj2L$^H{<gb
z=1_AV9}M2Uhdk1PG`vA|$t6>L{ivcuL?lBVx_m|5ZblH`14S^)Mm!Bc3{SnbdK&9J
zy8C^IXVhX_@uonXhR|4v*bBSb_{U0&#lQ(K5#apvTty3R=8C8{LNlx|%*wT)s*yd=
zFt$d;yfxQlef<R`^P?530PB+ZTZfs?nXcMzx3D{?QEzQS=ODN^Z1!F)rV$de$b-qu
zjyW!|dKdOsKTf06F~o42n~pikk$K<uM)#BNZJ^j?(%l`gjf5GgH6XuvR$xUQ%%<wF
z+yteV*}apj8>*&JzTQx8-0S#}o&PZ9Gu){8Df|UV+|qRz@Mwod5Qh=maLJv&AS!h*
z?AloE)8;z?5_N^en#hJxbP|W9fYL0yCqhT`p@v2Pg=ju$2*cEW#fbosB6p;~cpFvE
zWg{lMr1ld7ghBJzfRgCdaS0}2o``+-!xAFp*{TYVW*gaQ6tXDrZU+Bv#5!77$#)<A
zT)%*cwWrv~L;6Kvg5_l>a?mI~y9(7MMRwsEhWl~(p(_XL)2<4nqi^hWFAmwh4e8Ta
zVfLNP-*+_Lsd|3fj*ntwsV@5>-Kgt;z@`8IwA?TUc%i{gw(N?85Xt>~i`;j+hWkC#
z#f=3sg2}@qedSxLzgyOZ;<77%-Y(4?6120(fwiq&LEDZInP%1q2AD>zB*sK>zM266
zN&6cbKB8@}v|tnjX_x^v?H?ZFAQD<x-hi3vQ3qq4P~VLlf&;vAtTmj;GZ94t@<*jf
z9`@0+{X+I{AL}!}B2i<1AX=c?)+C9n+97KDI1jLm96QILTx|T>3%lW}V{jJ#rJnTD
z_)<XwY6FJ*=|_h3V|lW3b2@6H&iw&Aw4-11GD~Ag=Ec^acwvf8qnPZf$Z%ED<%Ae8
zNvpsRc|C&lvUW0KC8MuhI_mzmsBR^rbn%n&z4cIXSwxP6oMF|-@ve=qL6nB8BeMpr
z`-ni?z2bytAXeWR0RL2LE?-)wUu7wD$`V=7clA07YFqddig_$GtGUXsH-RD52g1Gj
zt=w&#{(`KkE9MZMTcotOQ|89A=jGh&kz-`$@x%ov3&N$v3a5#IM!?wsj^bpqIac#w
zo$~rDTc(%aW%dh?uc?PO3Cee(%Xy(9nm(})NO}i@gRs>&Q;Z*)1S`<SD}zriTG-*`
z#pq<bW{4na6xu+mMdCNtNQ3qsJ?YjnW9Jr0e10ASD9b-R-!9cc(K5iTPHcq83RAm`
zYc}w7%<qWEMEht8O^lIj&JWca+KlSXXZf?6wtpu*Rv`l3*wvxg>pc+aX46&FtdY@#
zd;-&sx(F)uch8fm)V4D3t<ag(7|O!?$-R1<rm<g+1zz(_E%^NMAM2u8Mp3(Ei6!fg
zE7XoIyAGzNyqNNv;zEQ{UJDb*>SvHAIV1VM8Y;|J5Z!84J-{8`2;GJuT~!KKXT~4g
z2aFHz4m|kBU)B!MFHCn)5}ebYJ9m8TE}8fo!g>lu8?8ZROF9FA-Z2RP@+8xDmaKiA
z?SXC0eN{K>n?cw2{Iy5DtRCRTdJu|D;&8Y_3sP6ROczL7%f4V0TZ438@~RQJFk00v
zed>N<Hu<kzdl`@UH9TJP3Dg19($-d&%a150BMNvwin>gl7w<TT%T)<3F&qD4Z$;R8
z#CuQH_iG57{7`>hl0~)B=<)xoA(I>pwIKlmhXdeD3qLsQDs&Stt+Wl>3;cQ(&WP~6
zqgiwc7&u@@z>o3y0O#>~j~Fl!+6Rd^u&UceA)N7_O(Tbaw8NdvRzf&pOYdSb;lS-L
z=-)1zqCSLKKzsn~R{zbrgSMH+<q{yVCwS$6!0=I`aRu_g3>9_|^XM{r)$@JM_Qvk@
z-81XkISl*eKTU%3elGH4BR>~fDs54x?}`l(S%6w9Jc|zaUY_gV+1w4}-TyXch;elW
z&Z~0{D@ZZUTP{GgzF7^tnZzj``1nXi>t73{3{$OAl#a?ty?rGFLJnZ_Jn<F~Zq)Mk
zR&t>2UQp9LN#wS8y3lr6b<;yptjRIhy5(p6<vzQ-Nchg2#?L-vvHDG7FSPDDTA!yd
z9N}sd)5sRN?D8!>s7#;@XHJTa<05}_xM){J*`IdAWJR};M1o95*dO36m7w(poec3{
zHg#72fezfFTKxH(ZbR#^R9=1c(|tP^vmNIsK`W13rUT)ZZ-B9r#YWJoI`@SdCbHe=
zipvsxGu`vXmv2`HKJ~TlxY1eza&o*+7oz<f24n;e-Or9L<5krN_h9hLudS-^Q7EX{
zBp>f|zIwhoDRT1uW=l*^u;Io&e}t^u#+jZ6qtk4UD>tt@t{(T}Uq()3_7znlpJh*4
zcUv*6Vzu+@Z?370yxHox@_v4gbSsBMf0jB#2pq|Mp$*B~w1ct$XRd&%3^2$HSQwiP
zfMwrfOM$)qu36`1rDUOeV|SvDo#$&$L1|6q4tea?CXu+Ru*9T5PSDv9P90MUsY~lY
zur0!8&NuT`v!kGto)67hc|U4+eg(XV_9^ceMbF}RIyIhKi&h+-e%81F?+1>sTL0gK
zc4%d5b>XzGohQpqx^L=Ue$nCk+OcvSCpLnGpRvYjt5qZBpbIkNMWpsvJ$Rok1(+)R
z3s<({$}-UPf%FM}--{*lxJ@4X?BEhm^{d$TS!lBBCHuhe2Z0_Tr~^y2=3sBB4EV^K
z#Nm7~`oTsIpZ3NHHr5J8*<_HY_Rb8;@QFzahq#a+o`J7SU#MRuz^}XdzM`};9=$QK
z3F$oC`P?Ml)6kj2pat?p4jJLaBV#2m?1C{FxaXL{bElS7x`%EaZm6JNA2VoZ|AMA;
zQeQz9kY;!hg2ROoUJawufuK|k1~$LDD16uoow5Y)A{QOc#@In>8yVZ-Wd%$4b5mwz
z9X<;2rne=3K~?p8X;`mrFmJ8YoC&TeLJV@<x>_+jM=aVzKfyI#G5KoB!^b=oIrcx3
z1>flplkO+*;CnitRXuxq=PkS9skRg&{53Vv@pPT3X6?5fc!(aKZ~w{3n!x{a{S9NJ
z(2;(aqwZ{0A_Ww$+z;je?hnqb4On^eBilZSn9r)ySCRY8EvJU+u%u-Sh~r!bhX*XZ
z4DV44J_Cq|MOrLFtT^)ita_-tjpQbAx>1jP+=nLZEw|{W_f~VHNuAZ@iVDFhz~34j
zLtaP_MDbofIS<~Q3{kmf@g|{tD1BOF*9-#+8yixW^%%0EH^22fZU}rPvThDnq2pAo
zS?X$TMvhHLTr4zlAB#3D+9)GF_g(N@hARAlD|Hbb631<oA<WH)=Z|at*wwSmI%Q$k
zI~_C!&h95O(s1T6Z#>0xtR3J*FVdjQDA$A#NcBZLVBtP5#ndF`u`ZssT=-hWs}#4l
z8F>uGe?tX{9U_R-G6dxd3#?8YksS{7g2?23u}V=yc3Vw_-^pyMgp44okIms<p)EIO
zSSQx38|bNv+R90DE-h+mYAb3Yy8DGf7iZXR=V{bFX0$WC`v=5+1x0$&lz?{~!iy`W
z(Z?>m7*S^tbeA9KO&~DYI&WVtJV1!;4hEaA9n3|pd3G{T87!k_#+HTSJ=FPj5`#a@
z@17gs;Mw^D{3`{n8^Q6|<U=aeT4CDxE0Gh3X9v^6Ktqdm{3L;W>1I8k{?J$Nn)eTi
zYLhrw`RBjl32~AV_&^)~#@{rDp`0juA%}79mLl1O(6#cp?iT$~-n+>ar8m2vDUe5R
zraMic&0PX=Kf_^fCIA%-6%RJ@!Gt%Rn<v`^8#Z{G*-{U<5;Mtc_6WiRl`6ZvxJOnT
zX^!Y}^PuIcm-!G^&ro2vN4Sg5eATZ5!Q-E?qFu{ZJJOwE_xiilQyRufo!1`h{Gc>G
zxn9x|=C&w7ChI~p&9@6E@bo9)OWL4xsv;P`$HYLq?hk|rj!c{^vCIG~()!_?YL$e?
zeA0%4GgVF9<}>JksbC0va(2;jai-(DWv^g;mO=`*_j9`+O2c94L~oS+Q1~K1HU5`v
z6Tbw$P{2}H;NkQIg1%F;ccTVhdlp#_$o{l6wX3>~UfCX6K+Yg$tGmwu$Jf%#X(tm*
z1yf$T8jN^Uk)b;(ek`FLe9z*gaJ_eotJzftZs|3zJ8OKm&OVuM08-P@s%I4HIV$u#
zAr$70p;!faqftH{w!zw~9xCl#`XsSk*QC3V@*gT^1q3(9X?R;)NO!^0LAWRQTnq#_
z@w34f*5gQ39Y3UvrNy7w#k^N(*V7}isS+1meFwyHAq{ttH3?GTG_ml{Q|mfyL!87B
zXblQI^bJVgN(%upoQ75sLXO=x$HaXyRGKJ}lFnC_e7a98@-r{i`0iTpcm5Cz9Xvny
z-@|)gXMn>VV3<f1EP#_3uKUA-tP$`ngHI0`#<gy+9`nHZ2>QFJwxCK(Lf0;^@jGIC
z%d2eV-CHKRcdo}Q7snTJy;3<wn%tT!DZJ>{-|~QPaeo@*E0`(7@8ZD*BhcT@d)e6f
zHAp7{4=_3+V0Kv1%_D<Kd|IKKWmZPMT4%%}olNOIXV?8ZRK((GX^#fjS*9iG>-JXY
zB$Z@&zJ*=5ep3T=ak1>blKPI|RH{$X2sBz5Shw*A%wuFc=P4kG`Xe9VJuq@@zgZql
z%2z!buf1pGR_b-R?ux67BWLA5D=@eJ?)0w~r@L?f{Dec1%2Rulz`cfNzNgro(e)gk
zW|{6=U!O9i^n1s?{VKf>Er-!S$Q?3LTstrXfg}2hL!K}3;uCA*bnZ0|OQ_E|_<e&K
z*vT$#_0^mCbLe-EJ|NYeG3#C9V>&XwV39Kzzfd5^S;I#moUqp=JIuSQIHzo@iE^i^
z%F$9s8FHo}0qxQumWE`mm=EOSejqsVG4yTrRdoi~)5~fi1V6B*{&sDM124Qx+gLj4
z`n_@D*jzc+B${o|R&)L5VT7;BYeqZjEB)P&MG1k2^&|2b5}YF&Ni>uK^>KwMTc4AJ
zD8K1F7eBm1y6G$Q=}=E_m^|)3b8)~cI2v02Az|h8;+g=?72i~}Ii=r}G^L-u9U<`e
zDuGH#i69b`jE2_LVz<yO1c^3+IgIrO#vpDy&@b9MBYeEZs)3?6Em1%!MS$Uxj%=lw
zfQsQ%hX?3vYA=Ie4?H;bvz|YVW;rL<+MrxDy|c5c9gp9l$IJ+~A=_q2OdGw=wHEu!
zLjB}}lF2}@E(|HrgaO!Lx_XF~TJTun2wYHW_=P&R27)(3>3zQcf#iCky}la%3~Y`N
z>3hS}>_)x#U6lk?^G$~K1P*`ApFpgpxo6xtD$ZvB%rLE&!)~_rs3B&QEhSCw+1pJ=
z<4!R~xi43OI4}9|Pu*9L@w3SHa0$0cOCWq=cHPTANH4}Te&_d=UcGPpc1-3-Z<-uA
zEu|_jDINIPCRfB>2&Z8Ch5(62_Q|EO1_&AWTr~a#rTx0_26n0s7p{1bU@T$zYJCU5
z`*EG^PQ>6`3Q)n4-p!$-3op@61!V8p=!?ISxkdF%Cb4(uVCZeD$b}p}(?e*fBZ1A;
z_Erq5&d2Sv3Y#<co4x^|!uFrre!lP)s6+z7c!c3)D&kKZUJj__(ZI<WYyNa)>7P4_
z$m-fSxYdRv`NPXIA>}c&f4s{TEFrlOZqdfmnK~R+p~93@RwKj58~Mwl-q*XpgMl7@
zhv49E0?gr1U}<mxWAZc$N~ZY0m+wx!nmw-e)-+m~$%Ly!JPo5;XxSY=IYIHaPTQs8
z(|~NAzo2-hF(Q}yB5z9)dzlZ9u^cP97}g3id6>FmE&U7&dJtEZMAeN12Gnl(XD`>D
z#=+$;o;8LZttNEQ^m*3mqUk-n@mrtE=}HZfxIcp>J2u!&ABHai-Wh)s;6%(;MIdgL
ztwAGNxhHF>0)k4)L?^9)yJnyX?-4#-6T%6X+pz?rfrH`dUA#Hur`WrxJvg{LS+SvX
z8Z0|v@(`7Zdtvxl`%!GASg5A%9QiA;V<5ng0Z77gz*-U81OPZt5A*?EV5O(yAR^Gg
z1x4R1_YH5~u1$+^P5m&_y$6X-Wqs6>1w__M0sqr?Fk`$u#4$T&k@BBm2_UGvOCa3V
zy!?Eb>xo;E8;q_C&PIH0;$D0CdJqIG0*oQUnXG4c_Q@K6fGMbF9YnMNxnqtii0QnZ
zN^3*@ACtec3oVOw#glFC?dQ$kOHvv!Fd~rQ3p-k=F5d!`TYXn!tg>NT{<dG*bw59P
z=3DmqbD_U}AugX|?jVz3KCjCWZI9tH{$3sGG}TR&mzgk9f2k8Xx6MUe@&*L&qb@f=
z>YjC{IDc}50A7t`PDTb4$__#`j~4@6$)-7rcPGa(*|>V*x+l$0PEB_xJ|Kd6Ri`F>
zxTU*1nKiD6zt+w*eF7@Zc?O~Y`Z-VjKXMxl|F_#H&v}+=HwI(G1@o-K?6;6-=I3Ac
z4fGkTa!;exv$|D2ufrKi300C5eCAartp}D(Z*LXNymj;>C9zDDIiu$B!Lh0Tmbt+h
zdkJd;P*Pq4>R9cex)8yy%?Vv#4pq68me<V^9(0opW!>)uQ!QWIT(w9f?mn2YSf!f_
zDi3lh+Ro-ym3v)m<q~+3c^Ywmv>K?lc|dZ_OIO=huy=?GMt>b{WM^$E$H`Ru{ei3A
zUfd*SUV^M8?}(NbcOSo4Scd~RPT%Gm-T#rk^1u9Aq0ywM{4V#{-JxF3Io)i$4cjx?
z&B=NAx7K2eLQNf!qe?b3r~3ya99BYbP6ev&slvB^LFzzn<=507olpSuVfE9O>+X?i
zJ|B_w*yMW(yY)qT7SlxcguC~1omIV>OWt#;-|L6*K%Zrq(B(r2XfEE#4eybB1&N$Q
zd0dz{D`pq$Fd8;lXx|+QB)(8J%EJ$If@@m3GnPH>8OS|xN_#QFTuQ;QZk`bnicdTV
zFbEK9&%HF+ZM>Q}QDxw)swaxP?bCMY{_C5+xL&H&_cYh_16!F%l#mC)>0s^+!RWdf
zTy=b%gv69Z56TYH4#Sn>9akMkT7~f0k4KLQk(4jLrL@~c@dT*tD&LMs6OVg6V_bT+
z-2?_Sr#5Z4v`d!ga4z0GuV3m!#QJT`%We%G?O?IvJe&YV=peF{dd6Z`BqHn9H0kmG
zM%;S_HQ9yh!XO9;NKu-!sDLP4X;LF9O+`AP2tjGmL0W*2C`d1%2q*{v5$QyF?@dIc
z_ui!^lo&{PzvtcioPFBN`SJZZKb`?5z)U7<t@~creHF~m(99TK6PwT`g6Vem=@wtD
zv#s>>zsISDjMhXn62Mkr55~Zi6SQXd5rL1(R3$wo*uzyuo@q_uwI=i($|RcK7d5l1
zleVE#-<<kXo7?Bi2l~-ctBPm_hXu;F&~2`1R5;FO%Kl90GZ44Jf5w>tIia%y&#~yJ
za__ucgN~trztfPN^2k-sa2q=8Mnr1fPNFb-_q$L9nTH9@#`%!Ug~SSzkYxOaq_c`#
zI3NuLJ4(J<^b{za-ApJ|?YIBYE)YaR+Qmn%AiL2_Bp<A4Yg2w>b#ia%j?#3uFKKrT
zl%Os~FkKs>hHj@fzUP)OjIrPP93s9cO}M4lojIq^?n+^5{E+FF;lm~xU-(-K%xor~
z`-41IcQG1|t9cyaO*DpkRS{^uKCPDQ%~}4KCrV3sF|`>V4vcafaIFE8zE&mibiGE_
z3Rg4)v<<{t$ptl{gbw1XZNZBTo(h8uMp@eDo#Ll?U5i&y9hMg(Qr)>z_zeq}Z9_(^
z#*zz5hh#aQ-*@&g)?U9Ai`&H~k<(A-oYk)fHvUdFza)~FglcCb7Xbk&Kuv<XU}*&<
zs{G=bZ)*3c=osk1w1MH*`*X!!5R2~0zLQIIkWN=pM(;3*)t#sWXP%O*-q-)_b2X}6
zG;V9!#PrMd?$wgZr~>OZCh9ume59+I-6Na|NrB+*OwKF(@yu!%omz!jp=)M+PVgbx
zx)iD!3O4xIL$|n=*MruQY$AdC8JS?SbQK=5iWVT0ORI14?RAbaCo0@o!(pb>9`<hO
zWbTzR1Ejl?vfKHFmfBLcq*)Fx=AOA?!T1qE0k)~v448i-WT(H^rgoN%hd0pB5OWYU
z=eaoXr@(Ga!v0=^VBLpO)p{C|m5i?uo5B(9h{Yuqw^J02Vsz;m+v4n-O6nn>$<}P3
zj38l)hrJ+%G2L-TXPckw?DIaKscMFdSXdX-m~Y*>ALIWC3*F1ZS@ktSd#nT6!E80$
zjmVn)_x<Gd9B)Df`OR3(o$BrG;o5cjZ{9r!P0BceaU8)$84Hq*^&P)!zEI)Jux$T>
z9{d(F*24E9Vyz?5b=3B28u1ta90&bIGLoxQ;RBb&<T;k%;Y5E@2=1QEAIb%+VDUL3
zKS=5B8<-nt3u*@!#~$Q<A#sn%w{b63|E;hTPVT=>RWU6KMV&v@#bx5Zg&6}P_}CC$
zJ3eXXsu^Zne|C3ORq!G?`>?e`bY?x~@@IZq_?PdW`K?EG$3BSl7#B5xl@M}>DTFev
zAkGO$y-nyZcZkjq{iJxgKxmkKvB6538Zq5?5knHWRBrv`hiaE=wwm{6#}+95@~}G3
z+_o|X1=k2++zEIS&CzgH6}G<*%}pV_AOw{Tw_>;llm6CIObxuViP?S#H@ODq?lUL6
z6S?A$<X40SRz9aYU1n+LV{h4%^i!~m%{pWXeRc9!6PuRn?S4Z$p3g2JC}0qwhL{Lw
zWd#7F7WzH}V}0Bc)Td`o$xkuRpKZ4L^0A)LpsF{nE{}ds-uQSbQXBUVl`^Lj_fK~y
zWASW=eh-=&F@ffBBROLT(wf=UTEWq^n*C?@g}$rToT54oBat<FODKt&eWw@oA?lmf
zN8QuZ)U>Ou_T*SqQRhOq4^EH#(<4~C`GU48@UNec$Hr=6v+k`}a^0Z*Ju*yo?qePD
z7yE?zo?I|YdQX^H^NdAaLcSJYeLhj6<S^<-cUJWmafI517BzD2xCDume=7)@r)no_
z!lVD?Xk%ks7ul)^@A7(Dcb|wo9~qKhJ;AsGvK2$tZeV3*7!CE1vnoAp&Zt;iUQc<a
zOT_;2y4(FI<I_8$F6l8e63yaS!{c$eW|BUwt30q=7JmVUOdx4~TY#Z@gR0Zh(%0bB
z#5=v>Them@-LkF}`4I}Q75c6R$hGhvsz79K>mS06<q}V7lFF#u>qJdqwlB-ff){<C
zi{%X;-<e3`Wor0ql4Rw=#_0w)dhy^OksG7U15wm>KYzB%cP2RXT$#OJ-Jp_qa;ruC
zh|k@qW9`0gB1C@Ui8e6JzIW+V`?zZrJPROU%oJG{|Ir<zXQ9s?dCnEB#q9Y}6HO^2
zQ&q0K0(<8d!z%8IU3qk8`|n#omjda`1oKcP{@&cYA<R`rm8hk0)^<KYe7Z9Cnk4Q-
zhyIF5x?E3f3hNciX*kuEfA*wnRuU9{4(dHbA*<5ku4AWqRPIQXO7V*==veU#L7PyM
zZ7-VX*O)+jugwrQ$Lv`JIwLQJ?Dn*IfSF%I*(mJRI}ouvgRx<r>C>Sz&UJv9Q>Jaw
zM(}jcpa0>cAQS#7aQk@{gljwwN3is}Sz@HFOfI4bfq{!e!ntEp)&7;a!PH0dQ#Cv1
zL;Fg^XXa&F5v5;;<+izfjkN}U>~|PK)hOc>LG_#DJm06fxyLsZK{Bdgq2hmomwOfp
z!bze91jPOKGMzES%HD=XnQd~<&tZjyy_~EaEl+#V)opuCtKyEh@v5C5yZV9t&s2!e
zHao-xxLq9~d__;C$Db8dbKS{sPW~5AyB`7SXV)c~8UY(WsPc@W5c>({!@nE}-joHB
zRBfFkT1u65vO3=wz2GFJ9utcHu3k$n2D`;8F1NnBm>tg6HYLy8$6;~(p#5YBlaD}H
z5ft(5<eWX@?osFq7=kIcMaX#igxC%lY2yY^p2LeS2)Rl^%G&-Lm0&#ueR;d2g!{YG
zQ}v*^UHmJoe>7dH!>X$hzL4#4IjqmK=|xS^kxJfZ`>RxQ3v}wDi05np-mxk21@2kZ
z&bf)_ansfKyf&(-9njtyu2wp>m8B9Vl6%SP4|9xK;J?=0VfY$yv#Kmkdu1_q1;u1u
zp67WlX|s^t!}~X^JPcr0aJFL={tl&?B<)Yu<wElA`#ifDuMYbY@)7_ZrwdjblU!GZ
zSRYHB4r*rH9!_T2v-cf3!bI||XzxekzKp2qD^z)Z>68Bb{l<^$N6K$qKa(3(0k>`@
z!j?86-Rad-+IdLFhh=+PR!U2VH<q5l=zv9=43}1;_!l32(Yqkw^h?D{TcFB(_0G)v
zVY`{}mk%}SqCgnzzBEymko~i(Pa(yn(QiETuB?YDi%(|;`5nOucd^-cB~zMnE{x%m
zX%>t2@j1klJ|65eG%Gl&@*3kNe;Rjy0xQwtdLNWx_y~?;D|KO*rAKva7FNAI7npDJ
zh{pWMwb>a}{WW)S;P&rib#HPZ(&Hs|c2SxUrZDcpyRdTiy^$_Gzc1inbq%!w0p6<r
zEnGue{iy2vk3^bY<##^>Q&*Q5<ORfg(KWY<R#^pJuvSd#2;R7}c4OLmssi)J^#Nf6
zn@3b%oSm|$3xB0)o!Mv`BA!vak-9o$mJ+x6;V<}VGZRspWJO?KV?xrAY^#!=21l|p
zMa~BvAP$sSEy;-lKOD=L>DYcvh%!|9=L(IzAe|;$mx$=XqWVBAn>d#A5O?(gyGB!c
zu!1*AKWMGZ76e)#U{<<=Ovlm{Hro65@++);cY-yY1+^3}i5cN5z;?U`Ol0}>hdj!@
zm|p3q+d||o?n3;mb$~fk4`$3=9GdwwdNt+Nz4~*=CU7>Sn3HqMJR~DFxNFzZ&y+Lv
zJB-$i)RC%vT21+jTl<gc?_x&36<+6wGdW!z@;OlkUjPV%Ux)uYzwiI$*R!qX0D(ji
z5BRGc1C~(0r99yX{0R9CBxY*3W9#6rh8qmI3{^)AN1Y3%tSrTF{e&OV?$rJ@=DcQS
z=Y<&Z4cke$gy%eA{7-QU|9=y=oO)BpVy47$$gTkRB-=QJ_28%1aoZ9QgSA%pCFUsM
zJD`B0*=S><0BL#XSXIp;LR~kS`6Nr*d{WAxxw#=jF(6~rUs^amt=A%2H0E5qE1Q3q
zbR)-kkrO-kA;=@?t5u(?vpd5azs$qjD{=y<CRE~QZe&cGJ7~6~eW`k=8-0-gS$$rV
z|7TXK#_wW&wIuIXnG$$Z+bu8pBFrBjygDu*N;Qxu0|3I2F^3xy^6?O@x{QMzyGGq_
z*CYJZ`h_y6&b0uF=YN-hUx-<06@hDG13INI?1I=y$U>>~oYw}|4hn3|-z63o=ZR!Z
zhimdzvC-dZ2Cqr?1rM;!@O3X$gF64Ax;Oj!gnQ!T+qk5q!t8_B*-ryyyna5S3JPTn
zqB{Q;LwJgRJ^_9WC=`(_aC%%xZ`+kUr%}=)m%2Jj33X7!71KKDw7OTz-#e%dj>r{I
zH`k1V=#}`Jhuwn0<B}(3Qk}ArJrm<4v~0aCmb(1mrh;FG>B=})(6q?c{{lwUdUa9q
ztnV{Qb`=EqTZk8Xrc#7u`W4#G-v8iev?cFR1>4(B<-vA)gZ`~Pj4pzbQ#`S*41e9A
zZ4!}Ds~QVgQHBSBtJV2WjFaDU&W&7EDl8DK*l4>3*C=s?WFR|`bkAQ-lAgy+)!muW
zAN{bO?ek}dQVurKzrH+GN$}}9*AJHy2VMSSz~p*aStNp|&%rQ3|4mSGpm1^^COH?t
zznk!0!&3i-Qe{hg$8N<myC7!dWE+A%)Wy9Lf9m?WYv^YCSNiG5P1Tf+a=|VNV;E6j
z!L_zg1R$RrR{OP1yC0lh7CV}qH1!Gh+7~os{kveQZS(;1NT!5GB;wmaUelozX2h+z
zX6Lt?DxXJb9Ws<sgT%592Z_~WZG6jfqRTD#ovu)4SX%M)Dt&^^yoZ_DwTtF#8vN{L
zt^>-Q|FI6l*U(Xb^~=y+33dRQ-f4-67n+nOSd8q+Sp}Y2B&`wuY)%Nr3+UWP{Vdb*
zV|kc<dK~f-O8pO&J91_KkDA!T4s}UiJ)1pYuP*zxXf@#EYp37*qq4X(6B#?;D5i9s
zah@=fOY)0Zg5XeHm}stS-qDj51*>-jdO1CXvICxcKL+uU^>J?rG<+=cPXDn!3DS5`
z@>kMJoF`r{WewBQ%iS3Mel~9&Ah*n9?R&n`y&w*&{7uwof03ppzBBY5&DBhg>uOha
z>TZjeO`MPuFaf7Zjq#Oe^$02nx!qI#e!b}0;c(ak!KD8(Jm=hmUPFij8IJ*7tn6@8
z+~-!C)RkRGy&o-ohJF(V`&Rt1j+q=losEFyunwW;h`o!<fRQhV5uh|XX9z&dL#_7B
zC{vrtW?63r997%zlg|>d-OOTP-LX(G;s=Fq7{Q6`Fhxj`6tO*Dw$J4YBJ{GdDnrI&
zL`K)+f>OTor}X!WX5?YD@vq5wfaq1Fr>&Md8t(0y=K|t#N1L<^Z;Xr{1fG;YWM{0p
zf`xPUlP2%Sy^;st>^8695kwO2LJ5_96vomz#C;quEYBS06xq|AzUwN0%BcD?{G#t#
z=uHE;J3R4G#0{pzOE+7dEK;s~ZcD8>@^{5;D&5F;mf8l7P$IX{B#z*<-?><NycLeF
zW@R_Uc@=bJKrsB<&jMDCx|n^rV(lBri%L&qh?we0QPNc~9x;YsK>R|0COsrMRrS{X
zyqY{!`axdP_R8N|5kBI&eeL<;s9a<N1_fTOt8}6705M9M#yF4e1Vv{x%!-)5WWS<9
zDihs>)@A6$N2Gk6+0J-X>Tl+y&3wbV=2iT|9D(l~%s?{T=h`~#K)bpyt{{?fbGK2T
z<uF?Hb{$jxlFrw`*HS41AGLf?SuiDff$y$IC<>GD8ZMV~5gXYxEj$AR0Cah+fe~|h
z;jwYZDT@_wIN}SCFE@ehTZ>37-fd&7>BiAzec6$9hA6T>lJjO7@Y6~X3N)lG<{Xa}
zl89rN?QOe`bkjru#1)Ri<$w->FNb>AQvbTYi8Ax~?~`2=Z+Cs0s;!Lz86ZATH*xpv
zwxN_g-y>}?(*-s$vtv)N<QhyA>19N;q+HYOFSYf&aL-B$hc_M1-m+M2T<1y!8zX2)
zbOdhzHBhMl20cUiTp1ylA=Sf(hUWU~^!4?L)UDcm-wiGlno_a$>d%QjtRn;a)B_a>
zssV?&aX-hRVwQeRO6~(z5xy6e3=Daxat7RQJ_!TK{Tv#<3T;ye@COp5x$&|hJvBci
zDs<l8Q@%f6`qfK={(1~m#eeMs4ucC<IJoTIDrcOHt+0XFRGnA#;{$|3fRty@qalrg
zS*2q~sPiW6`P=$3G)n#Yco|97d0GFmZdJG7{d!*OB7s-Yy&mNZ{QEKd>j@gyr%GX-
zUFV+Ra+g)QEP*`Bv`@7DIO&k2LIeFGHQj?Zu9F4C&*JFWqA$Riyg*t+-%8L8J~i3~
z4HeASoaK1{PTs=1KqK+?|MsW`tSv<xG(W{+EcIlCj7LZORBq8o)Nx6O>b3516rN9o
zEFWI6By@FVfMZI(-<SX_01R0C&kA{p{u+6O^!U0J|1^!zSPmPGIXlE79ET-HhS<tC
zj|j468RC9whz=NH%%yKfAQA|_125Wc2!0PZd#X(+ByS0~%=QC?uWrz#jS2nme`H_U
zz?K*&9I8jw;LsDT3`eO0-`!Wge!VeAOADv;i<SimAUV<1(midl{$N3MVP^xv+>3<S
zq3*`+yWNecKXgV_`b|wubl>JMQ~gWosV2OPnC02uUo!_})?aP|lR_CPAcOFa*c05+
z%<B1?34t0rWYm;ekbT(2D>16GXR)we8U5)KN;vtA?ygPG|CojTJ0RoSR0jhKAGu;W
zn1$|M;{CJ8fi}=eUQ{!pFe!Xud;2RCV$^<xS}5NcM!%Zg1&v8lR7Q7!IkvOKswxv7
zsm?mgL%e%#@P(>8{>Ay-C+zoanr5KUp~9dMcXt~xQ8j$5p*Ad8ITOvg*HR1{P-PLx
z1#Y86)wZ3rzoG?nE!usH3Zv?RFnt4@N40Kfzq-!U;h?xcMR!<}3LE_<jIJIPhPX6w
zqNn~3Rd2Q&H3_=f&vj@3K0bK+is|u*&ee^+zg7LKEpD`&x0_8SXEg)T&$I)!9LCqX
z6&3gLrjYss@MciLyIf}*9-tVieR)t@%L~_KzKhX(%mXr>Pw7|9cD0ESANcS&^Fwy&
zj;_eR$=*8uS^dPm<s$9!&0p+fWC0E({@$u%gW|LaxATmCAN0K~rWVeo%3<<_ymf}w
zc<%L;@1z9*kRi15?`%Y_oIidN>&lh<RBrUU&RRUzLyJ#Qj8y%i7g{L)>)IvxlN(yW
zn0SQ3pSH@O_au#%`Q|YH(Jd(M+28cL4^o=_f4QA>A76v_+usukbWOHcyN=i|Ih3BQ
z!>40C_ZqM%W;kHx?qQo^Cev)Go^e21_xIObUa_$H-mej<kqZy>UjUqD($zkEAmJ{~
zb=d^XuP(7|sn`t=6o_VR6Y@_N9xgJ??0u8HC&6fK-Z>4Gd&{w@fAGFMP9)$-sTihm
zjQA<b1&;MTfFG|yc?n<u8w)LhU&L{TV%!`nGrQ6hk{`X4@D%tkYPmEgpI2%hl`Z06
z%-(hTI@^8B@DSlnK=<4b08&*<#UGqBJX56H)bYJ<?tQewa%I_je(utPzdgY8?Ab&!
z4Hk)CBk=jHTl`6Zxt!0kvd{PMT9xQzEX+&$z4=ME#YGHga;Por?-f4{qcG+zUv^zZ
z?fDf!Vah_qAl4-d*V5X)U&n5%7D8!{=dyN^e%arra0>gD$?_}b+vLkvdMsvL>N43X
zxTapX+qV1(%D6}2ru4NkC)u*Q2ukV76Z;N@p!{>_oEmfOW&I%HQJV_V0XfHtcc~($
zG*cJ4F0sj3(?OXC!TMu<OyW&Ha+^cfp4aLKo7PBfsjpqTOKT>@FqhKfN$Ek>V4~Yx
z-Cb8Bqw+@G<(8-k0mgOTu_v+oB_VIZg#)wqv&~T6&^r_C+_rDNR`8*&Rjh!p79hao
zqEnVAwM}8HOW_v0HzjH7JG59^Y1Zg-7;Oal-O7l&eAtr(T8(T6O&8$nDo{ZD=c}-1
zQ8TaWm@8Zk+IyJmri2fanyK`8riGZznfH=gA^}bhfL7DNP04kw7vbzplkR+vu#>rt
zexI0s+^EYmYK_uo9?UA<z1Vn#@8IxSpZp1m#6`cNkhKPy8PF#*ILY~+4|UBE93re&
zY^?M&MladLtvfUi-7*Yo*XpyRB3q4AyNh-;>Sc%J%ybnvH~QZ3ba(fN<&f#(VT_8(
zxoAoSu<<$bp+blraCLSV5YoZ`^t<Usp-7Gy%RblgS#b>d@(ImAvUVJQ@pJ8r$ZwOq
zZx}!?{wu4P`rm?N0cqrlF5Kbbt<5W#TYx%0KXmez&^ek@Ewu9wpXQ3IylW<=Ws(S!
zFVUoezXaSh1qpXCT>^P<W$a|p+ENs^_cnG%F-R?|XPNIo_Vy+$F7n4anEMPgT|j(C
znwr4f*>+j=Mm~YNL)ne@d2C+S`rMq=<HX(uk*wMr(*>clfcpcoT&l^geI%g2<rZ4)
zi&7UIAPx$3Wu6FdH&zu5?*GJ}q1j7ViWx9@t`om*7Cqz%cBx4(**-Emn_us$QxwY*
zj2%H{k|cm5CQ#e_-_af<9u|rB0Vcv$r3(a950qI|y3A$jaPx(Y&7WFD#jEO63&NET
zfA>)_C%ewP&S5d?YtN=1B?+t2d?N%rug12A@Asx&{(5&h@ZJ?0aFtk8?cG-v{>$rI
zWxi(q{uv>qW(sT~HPwt)?td|eifO)R`htq;&qa&>dj<W!RoDOhHSj+p|1tKwkh<_y
zF>Q2qUW$-^(L5+@9MWeaja9E%iMOI~I)(0~{nfxV4&C6+8KTRKF!r~)?;k(W5r3^d
zaha{&5Fbr7jxY)A*GSs8LD;3f#Cfe__;%2P0{7jX6*c9B14fVHz!HXeOm)>|^!%<7
z_~6Q6yzu_G_BIv0J&iXHvD;~~>D-p;a*nNWrFe_@>o_OTTXPq@4bzo+d=QejTUje=
zT*uwKrSSs!aluQr^Lswwj}0e2MVZnh>s)9Ku_LsUmAC|z*MTA)qvaI1{BbWnCXz?I
zRXdvdDF0BU73L*gB2KJs1ycB=^Y<(6RqMTexnVd1dbCc2d?s1oOt(T20x(ohMo_er
zZ_~AcXsgtFVx&*_g;3WxEEv_S>%J<F<?aUGs8KT9sA{P-=4{#XPHKSH2E5*UptaG@
ztnQ#@8oU(M$|<OXz16lNNu;ZClK+l8sE&GA2U<{_vSGbj5R+4~lJ6%O;~SEtQ}nTo
zwHa8f;+<TR?Drd5vf#wIZyjj|M;f0TlPc02-Ije#JKs`K83LZ+zEJMh5M{ask2;0)
z*QTkFLL(m%Oe0Ng->@*OL(<@qgc7@A=Oma_Z=LtHpxnsY+HtpX{>S^m@W2Xj_Ex3)
z4h}y$%EMNnz0&j~wc(An#<rNvvk$SZw*~C$v!8be(R<UB2*xPMle&5udcgwm??s;`
zdyQD0HytASS|U52Tp5|4Cj&uFCA+PR^`p&?z_T?VCSWH%u0ppc&#F&<^)!2p=Te)y
z)iSdoKHIFaEE*;cVj!?PPHtM9qS)pKOBSo)IT^U-&ZywxJB+Mw$ChtLo;T?~FsIU@
z+99W0Oj$2i_7URZ=X1uLy|;<Zx7~ey10Rar18i*x*V~F0F0;-3n@r*iyqkWgf=}0>
zX~Lp!NAE?b(j@6&w|X$FyR&U1p*pYmKaCA~+pdL=Z391eS#tL$7!+XAerbD&|E4hM
zbCqHL>f=mDB{I-4Y&+?d%MSSsBBbWixhqM$G=EJW0Blvx6W5TZ?dNeNH)pN4N8~s1
zXK4J&2J4T7QgydOo6pNNmNQ5x0;>g8zw9ClSX=^h4}I}Y@Oyu%^TyA)6s5DXCq(6Y
zVOP89yVWlZll1++EYv(@a;<%cSjiAcEDx#LwLumFIv3`>8tt*0Esf*MkE0#Ge{XKB
zjZ4TasEyI-_=oD9_Yx<Oqok94>vOX8V&sP+-P&Ze(U>i`$|{D1fYH~p>H>%t;a{@^
zxtXa2G`6lMyys_MY`m_qZWjHmJZ{!i3pknX{vV@$`E%o<ve9?4M|}8U5H4u%!l?o<
z!k=t=hT!ZHR%aYDdO$6MIl>IG&dIS7tQ)=gIqT}c=bRxk%S%_Sx6c*Q1dc%;a>B-P
zFu_;p#n`~=0~Ln(s1lzscwo-l4g%Dw^5Em+X?fBpTrGYdzz!_R=CZya^lQb>UB~^z
zL$tf<QXb9-8uoLNreQ3LYLD>S*^}z5=Ndn@duNaG3=0N?_QVatVm~XR+ZK6nwCDC-
zUvuOf9+ZpXQwe-4NEG_=VW|zn?5WT_t!1i?L@rR7Ye<Hxd0wdL#)GYKv(4C2y>EKe
z$NZl;)ns7ub5<<*e0l91j&JgelfU&Xr|&J`jC;UUQ$4$=_XwE)F1qDX$A@0r_XQBC
zM5Jd3OF>@EMire^lzBM|;%I7fh{O?qhr5=T5(bvd8Es}S3~jJHpZ|<I#Tbwy5lVA#
zBkTk0=}A*fEGPTN=(F!{!$>8(rk11Hjt=kQ^%uwHNwa`qZtreyTaB+EPveBuW5s8T
zFW!ww0q73d^-u*$5J`{r<Kro(?<O{InV9j!u}56n5&T57L;RjSXo8{H;H*~#Tm}*=
zQ0O@HrYo8N%yKUZPPOuGC&9E=C)4mo=9u)&!MD#B>3y~>CJXRi{5J?aMuLMUmwhOg
z?ADlQ!8or2;dc=%8-^$#1q_ORLynEy!<7xLa^kr0pO1vYXq<`dTX`VM<E0pYlo%4Q
zdMgevp$gLqd2)2Pp?iZmCS|N1V?$1ZU&T$1=^?L>%o-X&E+Wa7`a4VP*FcXfjj|^4
z8xmeVDFY)uRI7{Pd=FRJ<}$S>F<R64woesl$WARtjgc8kLRc3*rJRM3Sj2y72u%dl
zindDzbRQLTgDyNgES|p5@rwVm{iJ@UC*d|e4}1K$4&ZHuNLHVnoU(g<pt7=^RY5=L
zEfeL2Wtl7Ex<@y%x3;xo9jmeS_jY*qzRdnsFZFK6d~B5@Y;_^j309?j%e%+H8$upb
z-l@C8=qG2QYsh`*8gw>|mJot1c$juDyBkp-uEC?~N59xw3dAd`ynxFR5VP9Rb~o1y
zqtYS#5#A~18Qb~RdVrgZ(1q`#o6$gL_Y^H?p<75mch#+H`lkm!@ce*I3h{<kWh_Q|
zmORkld80ga+_yFaaKNqtFcvr_8Lmz6v6DZ@lKAFq_a5G&ZIcxq;+zYNrHtW<f{AIZ
zH!8UryI*s3PSe)&Y@;nVQk5P;w5znfdb4df{@p(;u_Az1;!op=R7Z*jy@5iszNJWl
z==fBl{yVe@RcQc^Ekhq|7*vAL`wtbskegfEeJwQXREZszq*P1)82G#u8sd7Y4baDU
z0EL&)RF`*8U4Og@?hh3uwdRhGM<CC+KI_H)igj=uIuyKO3zt^EHA=<Zh>+1<JXo^C
z4Y875j=ds(@c7zLf2nZWY?UVEn9I5lhN*$S%tyMzUJ-SL;68U$kj#+d{#BY)Kqv!&
z(j~1ESt|Us(|^x<N{(TRO1SBL18gf|*&3W0&gF?rB(?h!%|3<N4X2mhS5yepuAM^)
z5DSfJn=M#Z<Jx!8X3yB@pPRML5_GZ2eVs_AlPrba8_c^@lJDZOU6Tl?<ya&q!GqYv
zo5B1n?w+<1m{R<wK)lcRN6$l(l3*=_A_BO*f8Q*?p*m$<f{>`qky$!M+c<IlM18&G
zsc~*J_6eAiVb+9@5-6OdWk&-H?J%FJ^<38!_bhNXkB$cP>&I1<0;NB~eqQ7e%v)?7
z2W}~4%YnY=#RqxDbCf(G|HEgF4YwKuMovt2#S%|dS+*#byo(1z_!|!sZ2aGaxu?AT
z<Fl}P*aGg-!{#lYP`E?4_GRX*cm|xxsRRo~+tm7cK(luEY(k1dAwltZ^N24`=3f-s
zY{DgaQCj>UA_j1#9QOr>L;QKyBdqFkZfYT$buKg(71l3g-;$Cq(zUS!p^@0<`|^H=
zF$i^kD)4Lv=x+xGNXPB9Vu}bg&|<YD0pr2YfL;A>aBEzO5WoEN+MF|Hk#9f+bY+G+
zlJ157ZiZpu>Y%rYkmb@Zcm?iJ*Y+yvf=iG%tIV_Tx2oh}*X5yU&(-k0E{q@y(-E|F
zuGZ2#s>$Z_?rj&(AOgK(X<vKqsjL4-BZh0cKQNupIfcF+@TJxpw^~-r7m(Grq<ZM?
zvFMrI%BZ_{@8{in;o8r&$HA<slHk6!S!wgB1EG5wd3waExol)UBGcMj;p67u)N32`
z6D)X|wbNi4#@-AG791d(i#G^m1D!fAF}+(56loHk|3GzQ-me_4W&<gj%UCvjeLS`x
z$T!BnoNzi1*stt6A_iegO=`OdjWuaM%|iWvTp#0fb=~%LpNta`PI-TL53}YIS+I<%
z?5cp+0KTfZw#i{8K%H)t-UnK)E;1}!@o`}eKCBb$^Ns*H4#)X}cop|Kr7D&?B&HN(
z57_(0kI~!EJY{YYhZdCnwe!kQOrys4ad*2J;xe^AC>o<I&+lL#;xEL+{7lGwNQeBr
zh8V)MB9*swUn|LrS{2>dpidAX-8$^Jx3nNNU7mN*r&r@b>s<oCoQ?qlR>(0qW2$Po
zdfX97y=R7qhYh=cJLLrC?IKkjL3f#~_+Tu>&PuD;KhC#oizNi5ET4AmjSgvs{1pJQ
z_W*OcuqU(XTJ=BH@)4NV4hfka-OJ&eXI40jaV&&f;LGE|;1nDO>f$8Qc&`-sE+{j7
zq$AXZ^*!+w@$}aU%op@6Hl9Ay$N$9fmtjS%D(cVP#R8l*fRh^P@TbC>B<xxZlJmX-
z7P3JRT`Eyw%Jnwa@-Tp4J=EM)repc)H){p<6i~jNxustB&H#=vpPsScC%9UxZ4DX+
z<~Lr6PskHVO>LgDH*6Qv6~Jvn-AIb$$kr<aN2b7LO*?YQ9qNx2s_0)+Khd?^UHZ`=
z2K9T=Jxh$vK2YbQ9|Aw6wCHq)^es<VnUEb?)qMMs66O1x@+Jn~uEx(rx;e&}3W+*@
zTJt(}K5DcAX(1*6$nGLRdReN%JNGqqdhsLTnV?UPR~z=J_-#Mdh$BtqtqohX#;G4*
z-ezrF6FwQ>6v>Q9`C4BYRLonubX!y)dVes)6JTi7O-jfuNF8?!-BvVv8%cj?4|tYm
zy_pD$ZB%oUgiRE<WTMUBPp1&910`*t%}`YzeQ^%+uQbVsg4tFBLNt*IE`!_Y_sc09
zV_v#f34*%C1neIZl?a>eKKcX<_TZYwf$y26^Q-sviS)?sDHK5nh~cD<IEj*jMg_sf
z<eB^!24twCZPfJqj4_v_VK^L&_rsF>)vd#5WaU=(;S3Pjp$7-8MsHNrxbO3*+9KOg
zWr%XhZzu-_0Y>~vH*(o=XtmPi7A?B*0<wwe#mp-9fvZ0&EYcH#zYKWW`4jCk*psSJ
zm>NXIzwQsrZWL~kSPi!KYl*;kQ8Z`dVA^jD(k^55+@y-&x2sn+IC-1U?**C3Xb<&U
zB%dkLT~~~Hq>sm&pbNThRFa@h0RNbF9#_rZgX3NH=)Et%N@8gonk~Wm;Qn@EqK@Fs
z1W3VCxX7F1z6)C$*F1s(<Rbw`#E!?+`(hoyS{5*mS2T$Culz}+1iWe2C#4EWgK^;w
zhokcUP_0ZVA4bVd)s44`zG!?RgZp3vK2av>0}W0*@Ru{kU578f?F<$x(QjUtesO+v
z7y4;YnOvhTLo#U$>sq?#yBq5*zPw<C>o`oDI6otbP80A`E2kxJ&GF6FiLckZWv^)Y
z?3&+~J4@?5+1P(MV7T+z#X!$3<<WJqpMc}rP?Ihm?i0uI*X#5jDi~xpAXZhyvv68Z
z!iBc@(vMwe^1V4-XWYSkdqCt4A~Qg0-j^28+pQdzGUZtc7VI;Fy-X%(L0&*4)7ka`
zB1Mx}2n^Cw9{dZq{y%<bXnJfw)i|dJKPWT6TkmTvag{Im>~z6IJn29->CncL2quIc
z+7K+hY82y&Un3k-g1&B~t#-tT1~izOfi3YtXIp@*0jEv!!PSKh0Xfm;*KwQ~_+!>{
zwXKOy6MTZH{}IJn^0c@*eL$O_LP~hjy00_PiY_L#UH#*7`%81)e>lBTWZFD`z)^Fe
ztDQl+_Y}#0c@<AF+d!cuE24?K@Y_f|0SJYVrb$U90krkUD@R~={g~+8!tSNN3#F1|
z*K;7=Bh&{lC+Yz+E{*ADArE8wr_K%N=l*ABC<FvCmZVG6N6dg&!S;cdQaWrd0|)T?
zp`Pzs>rF?~BKcoql*=t>XeONIl{BEw5ew{n+<ShwSGPah6pcJEHPr$jF)ErIz*2s%
zh1V5~H2}}nbwgl^K``vbd(BpCc$qm{!=Hk^Kl&@s$CL&1ky9HNa7t7Ak;18r$nU`G
zgRMZLIL!qnU*1h1=Ys9rrPr3Cfknj)1WVOcl@Zi`_xUHSJPlOuDwuiELnpWjc^}!3
zST7ZhH5Spe?@Z{!(*h9-3Iu(?Rmc1vsuM*_p(^Abs++Aq@`6nO=v=ap1~*4xNCvO=
z5lH_~jd!EZwK)-yv;R=_>=W|HIZMr0{kKw2+LikXU2m&9tMRHBcopROB<c(zz`$M<
zCmEJu+A&<Dd)UVj;H$8<?g)<0ZzSB3e}k$QYL(rL->+ZkOVASkJJvzDI?{Z3B}=6<
zh}K3gA(JiUF6miNRmH*Y?kd6c4E$|m)d+sc17dh&r3A-A6-W5}z=7(|W05wor%0hK
zOgyxbzH<nL=4@udS*`LdSPw4W?48r26ME@u(Vb&0)cb3vJZGOdXN{Rb81fU1HD_Pe
z0RoZI1#c#>?how;a}39dot1bu$(|v*x%UQc?Ro$8`7M5uvdW4giD0Wbg8I6p1$NlC
zEm^`nrW7Gpd`)bq43wN4Zy0Jly~{`~%t%Tk$YY0kmaqngaa`ycr@jycJr%%j$Pq^3
zUMYE(+QP7=2oe8lac%sXa<s+cz`NR!xZhoeplQ3uIQ>YZJv2N+J1#F-(nx@p>-7e$
zF8>u-U5_}{>!r*w8tZnn%&%H8IaG8PIjE08`<z4zxFk7a-(8YqCSB9U?qc}V+bQ?Y
za0tdIn}OQd>F&m3uN*T;p~^UMI}sgzNaxU8-7=~hJ+lTO=Sy!i0G3s7aDaUHNl<7}
zmed#Xg;((}osKO{Gr$tk!nHCouGQo+DOK=t+gl`u`W>LboyA1C!9|MA=XU5gh(=#=
zGBNB5if4}gW_Lb2eRgcs0``g%OtHg;pB(Dj#twg6TM=^Aa9keDZe5$l|Hi6Q!sD5<
z*Q$Z(vxg)0W;^xFEDv&61IVAj9%yRHNZVD?BWyA-hXZzw>Z4qX%g;2*twgF*EV!Z{
zN674rR2;9_mdY50(aFyuhQPqW>};E9>$bUvi+s<!YcvIS4;ERNILKXZ9{!pz$_L}U
zzc#~#m(UhTP`p~>eH^eSy)w5H3*tsdQsymNKBxJk**(&Au|J>W3%j#EpJAwXP@~;s
zsNWlD0Q}k~!0yo5-&@OEk>B8I1P6P#HZHi&O%e{yf86S-<=`p3?<4w`vtCnGC5*&$
z!+`ZSG?rH?3y?c@*pawdI~hz|c!SNYVbS|0w7Op+v|F5?V3{mFj`Z*BS8pVU{}oz|
zB&C3XEj)emAF6+-bQfC<$k9Mt$Q*K}t!ow)2ls)gYT}^1aURVYB|jEj=|443)`rg|
zzx%xnD#aWNUJxTgagQjv=vd?)JMtf@uZIsn)W{AY@cOT6Pa=~G`ds;YE9)G327*7u
zNw;6VA1Fvgm~aq{KH)Q26&EmDc(M417h5b~mlS2#St>>k7;h{mp^qFb70KZ>`eXq^
z$~=2{CeeV>FDOz=?aAE(@xPcJ`Px(cXTl``6Xva*5IrhH*2sToQ2@|->k!B=;el(A
zG3e*RbE_lR$S~j0s(3*)4x39Dj(g-U&XgHyxcJMfj@&8zN}wDQ1Nsy=2O$Jd)FT;H
z!Puo<8zEFLcM#{7>B|~!5dEuG4^`_;%O)+}-eEIwTnu2ZfA<-(!P<!-i2g$re~O7e
zqKw#Z5!!&1ldWiyK*>Np`P0b_K;IU6vC5ZuYJ_qCV_ldzid0QGhU~Y%&#**_Fo=&L
z40}OJ+=(sN^&i;X?6s};?A7TB`UnnYwM4r<J@6-eePcHIRb;1?jMM--qi5>c!8M9q
ze5i<QwPW|StC9<;`?X8e77M-Cj7;Vkgk0}6CPf%&X>_qB9D-jR&H+&`D?23qdUD~0
zKE1YE?e)HuAI65k^3;!|ed}(zx%25BzZvMdQownhqzM@59H;L!5S3noE2lbk!S5G&
z$JZy`b8{>DKwmtr0Fv4-C-=(Tr#2CL*L2@-5bn1ECWxj3*d$^MN14b#_ua37at`=9
zG;3iy`<U@V+%wrT^!QkYDWGw0ihnC2!}?2OXeX6}8i(4iAc`zerqwTusDpY|32-5Y
zd>8Pn(a%{ZKCbd-lB!{`;;cI<hZfaz=<#E_4*iJy5wO?;n5~Lk;^2sEMPQsrlHd!u
zW>+_QV5P_FTU%>*+oTSzuk_)TOq|Y*2R08lPptpdB>ndX_P39fdq<rc`_vrfb%5iJ
zzJ<~q9p?uQdU&g2Fhh#ZR?c;&GT)b8M`cEGc}=n<h7YCmbNfj^orq1sLAya54&=?G
zmHl&;*lg2JES?^ax?hBNb3X&k5WW}ackmkpFs6=k{jif<3M#+7g07btHL<RKuwL<3
ze$s3v;g-A@5zROfBz?SaR;$IE85gp@h?zS7muk48_`gpp{*Rx}wk&{)lL|h1MBW=9
z10Fuh)XS_S*XgUnrTQkmIBK3lh9_1))n=J6K=3iwlVRjJ-pm*1UT*bnY0vYMhI+)6
zGXdgM(FeKRVA1L^)KcC29z|Q~Zt&-UZ*BenAbW6PdRg44deV15%}yVAZ}OaHE4r<P
zzxbN|DnrTX<`YR3*?g59ptraYj%0<_NPwNl-zZW5l&eaDVlW$p&&7%1m{k>gYvd1d
z3F59OCbkBEY+4WVJ$D~~rZ9U&inCyc!?5GONO~9?T{N~l7`y>rA`1NLt_Y$>k97u#
z{p+sijXA-5{U1#t<~N2O{(|s{s70C1n2g5mzR1)hJi^-7q<zQlUZX5d2@CUu?3Kbl
zGP2DvfbaBo7ejW3P&P{S1P82k-x3?J>ehC<GPv@P^v!tu0gkn&o%7g<bk%ibzwRyA
z?vUo!gAnZ=!vW0F^T5E(aeHaL2Guk+hQyR9cPjWU(Xr#=6p4cs52<U2cZ}X_VNRgA
zBlrrdu{^coUsD7FOkgAYkQ~tN3`ELTE4>gH9xKZkF)J&aAQb+zf#K_lNd*vpe&$ZJ
zL;idScF;fH2Ox{wGDJNa!}YkZ2cWlYwN4}sZG5Ua?HEZPYt_*RP|G5N$Q?BmIQ1e%
zsk|Z?<Le5;I#zo)<qM`itL|TeJW7H#E;83QHe(Ut0U>v?H-niVX<EeJ`&ZKJ4)o>E
zE&~W^6%T=C*#P{<5lX&Uk7<Kjtj51W(!o?#6hm(vH9uV)RGzW)+uGxO)BR<2yJC3l
z4(M6M^7^YrFBrt~%eU$SqEy+rkl2KY(60erPm;}2^p-Vpks#U*xh#;lD?s`FS(Oqm
z@Lk2=MC#3@Yd}m?*Dh*q4WEzON?>VOokP6?Bw3TW>ga+#r`+4k<M<}pRN*!{y-=Cb
z(Y*JLZZ}WG&r?>wOn)eh*hTb;^##z)F1_ei(ZPwzRf2ncfNh5`kT+j_xKD#qT=vV(
zK=6_TCMjYIF6_S!$?5fvUfYRrJh6)jycE)1XtI81-K?Hu;-agSotO|i)^r@)b|l2A
z+hb$Z0;DzxEe}P4t0DW6L^Z@*qyAnBZmtIhe}Y|#Ne1mLm_5B;=K0bpYF*)o{X(d2
zDzi~(908>K{Te+!qKz8)63q_d!=uO*r<epZs96IKikpmhU5#RB`CMx-qwRU=?Z-v4
zTNXDW0}h@G=sG`Ny`;ZXyrO&|M*M7*+$y&;i(WxSA^2cj-Dn<pdfZUFAF<HQH-yf)
zv|3Glc2-BTv4hKW1O7AH?&l@<x#tfLY+3*Kw_YdLw~A9nLCnpdm0;<a%r590<t9$6
zP;R?GK^7|c{yAD=U7J|ndqkaVYe%Cb(3go=0<%yg2&fK(9ByH$n~0``D`Gt(q%iw(
zWESn3wsF613ufnFrFMm$_c}>=4l@Z46H7x<@I2#)8~sFnlFF3&Eo&QB#Lb4$&1PpQ
z>u*ijvlbg^KV%yu_T1wha4D%ezE#&H9Ak&@`veiJD}=C?59l~}0Wyc`T_^nhQ@wP}
z?~(dxJlL@)x?Tgj7panLQuNp>7eiu+9F*bof2e9ed$=!vt(U-i1<UTy7t<~V?WK~l
zt1~~-;*><~qfGJ1{%PVVaZ?+j`&C3oxF_JaVoqTt?5_CNVZkehF;ZV@Cg2*yGx{N_
zX+Jw3@!wABViPW0j1{k9QM@e*{tl`Hhf&xFeE2}D|2wR#sdaG2w%h2O%Z)nu^~xr>
zW8Fl?rYBau_B7Y{WE7UE{!Qq(cw@A>MP&`VmoppkS>c;L|D*aI-fw%>({?Hk21E3T
zo~}@Sb$%G@Q^G#h$}}})Wnl;((UOz;$g||n8MHd$Roo7?IF0%1OQt#r4hW#az#1)`
zNi0<ckWuW&Z5uSSbPCU9nIGT#spvtvLb`Xetmbv*WNqMb-Hv^9K|`R2>J6B=^#;Lp
zb*k%-mGlG)?+pQUr+M4V$=WKHmLw-o-}iOPi^H}jOw3Ph0(8Y&u0ssKZ*T3L1&Hgj
zcDC`kScas?Ub*<;_cIsjKg>z}q9oQS`SXDPB25YUt)asHwV4yuclN`Hb|`~lZ+$m=
z8Zc2k=ZX)15jt?KKK^IK^(%C;39e5&fD}eSxZK#*D1sjbeTvPGA8&=%p6h+!x~nTS
z+-mogA!e}V!Mv6i)xLEWP`k|{v5LzD(Ukje-O<(?a4`07v{d#}Nu%E(#!sqSK57QV
zIhh8o`ZJ0$Pt)^#%>Ftx!|R_}@cP`ZJn8FfkHbsABF)qDf`nHWvkRwCJjX>7Q!25y
zR5Ua(STs9uaRU>zVcL*wP>gRdS!Brb-eB5+Dlzc|Yd2)rZ^yCqxBznY1+ccE+*R_*
zxbvtAnb1~r3=r}}5Ce_BOK#N_!$q()gL}U$bwS$Ix3ok>J_o`aMT@Sd*z~QS7+_C3
zcwha=W*U+3y{u&ARXeu-rRKc?)sF-b)8ACr`dt1LVkCA{6^+Rs+Z<awjhZI?(C-(o
zw2ez|Ca-P+%GB>^&fijF`-PKLMY0y6B>>}H;m=dKu&R}<x2nOpnkz_tg3~h`S3J$v
zr0E?q1MAtm?tH_vYe|WmMh_G3QD29=)T9a=dPiX)2@xE8`~tCa9lW6T2hvG)^(nez
z?rwtik5Vmo7v&_Vm8jNfY~uf`efiHe27)4a;t+W&p0q9Lk<Sm=VKJ{y$|R{fh^8ZR
zn@-=O1Jr{q&;?C>hy1o=CA}C*;7yO=`<ubt)e|Ds*Qi_koVxi#aQDa9oj2lRKex5B
zCNi3B%SlA(%(|aj3S#={$to@2K~mD5APqJmYZ*kpt<E~yP&c}4US~(Ay(|1as42N`
ze#%Odv%{>kKvYSku0%1;#OSFl5c75~^nYRG|Ih6F|Nq~!{xkaD#Og7w{03B3*VghK
zvY`4_sa1;X(bL|7xV9tA9YT1~?)gyE$xs9Z)EuHhe0a%Ip6SnTk-Dnri3^XlZ(4k+
zji7L{Xv|;q1`MIsu)2=^>78cW+?DXbKnWX%T_uXF?@XqD;6j`HQL|wW`@kKsiR&AD
zGc$Qjm&1(+3+2AZ>Z__Y7h)~V<0c!Wit=~3pXB*VmL9C8ISJKk8f^_rxz>grh|l>p
zgm+i`q7g6pnW`Gf`pm8cwiSAK3TA?hdWKQN>NCwp{05v4e2WfH89Pa~`cAUwPxwgY
zxEYZ*mxLkWtKf*MFlbMP=zI93RWh`T*QVm~dg$n#8x1j_%D~6MVCNXK_`5f#AK6k}
zcuOaK{9EN`ZszjKjFlY`+L|`cbkm~km2I&%_<KPI=%j|V0_DRVROC5bT&VRUy>UL{
z1_x0Y^FG=Noxz0BYqYk44WfkS>g92@O9<E11>?@f^p4<<l$$W~7p_y@6_ja3DaWSP
z%KMi$vN?2FhJVCxdN(|vjX59cTof6BTjf~5BD?CGgA1Tqm5=WE+N<}`vJZz+(}xX)
zh(?%t9ZH(~d5-s>V9J_!oH%B^(q}4;+hR%d%R_*V&SW);=TB{8xBsj{rko>eBI8!z
z!T3JhgLbWgGeD1U2RqeKq36A#&oXO1q|A|K5+_&2=cR=ouoI{n)L(8oE+;_=`Nah?
z&IM0KlUnRUX}qrkakte3@RQTci{oL?bOKtL;5L+z1#vE!vsQLLQo&At65+`1M`&kL
zhFXQ|+pzFfwuvZSOqhrLsHn{wyD+-hN7=0o4e`;Zw^{(EXl}?G@iosYE-7#jq09lt
z5_nBj9urmF@&d_xj~i^)=;<Kw%5Iu{s&15WA6Fi|jApckwOKZ>Tg>#npwiklj}v|k
zj{clTC7_F$BS2ImRHO@{^c|emr+j|?@=A`k>T`C3H+|ayrnxUy_1R&MIy0DC?_hst
zzPa_dCPTQPB6!%tX32gp_U3gj$mM!E8v2@kX}B}4@sxD=R;+ZmFI(b3Nl4>k*MUq6
zi>dzT>j4bHcPp!^LgwGfh5>H(osxVO)!22)b)4LVDJz`(cw_#$^{Q(e!-}Zr$6S-R
zwYZ}5G}uGj3ISJY-jtR=)TmAaJWYZYcb0X))MDt~HqZ|ndV%gYHvMlFYDyOT_JXQB
z<i1YgG%>N%QZ=k}q+4MM8BS3fSstXcyGaGp9WBe&^<p9-Y|E$=F9Fy|YUSu&sryL_
z*Q`qLQ+xKW-Z_so4c`{$QBmFR3Dn-_uTvKot=5k<V-(43pVIS_Q<>m(6_5I*cso4G
zh^S*v9|{rBDL#kxq2C8Ze3ll%X{I(wU%ve7%cAeg37b0#^|mmfYlFdvJDb<uBWIjD
zPrju;Z33WqLB_Dp9C-~8s~FbEB_P3YwM94+)~pxEm0Hw^-q{NL5bGR+PZBU?Vkw;8
za#`Dn>K9LeUjGwt40pjDq=bCwv<E^H%debaW-RPlT1*`x?%$(Zf1iA?7T@sz9Mswx
zMb+$!smAWI#^k5<@-!{w|E(Cz$p4kRR3yS-2=xzq`9JZ||APvsvv9|`Z1g=dDUw`8
z4dy%95U^RCNB%LzPh=-~zs%i6-Q3{42+qL(2#Z?^DxuLrAg7Mv*k&N-u5ekuvzGl=
zP6{ndlssZXcKKXwJ9GA%_2PboUs<DSm(Ha9*gE_DB^vC{pjXv$pwOjDeNo_*`(wW5
z5Hq*Um+?!AHWTQwKk2-BT^9-l)Gq7hx~4c^Euz1ho%g*wsM=KX7YceQF7*;oxk)f{
z6?A!ShihY%Pe6-KyjQBsp(-^ek<DkE2*jKE=hEeQRCa0%S+?UuBXY-A?sewc^RN4r
z2XUT3B@#$|(($i}I)Xy-wduvPwdt5S$&I*XIrkqo0V|$JBz-Ff?4j8>iTkUzlSIQJ
zWTJ6O+{az=^Ps14s>7OkO+_vclk#}CI_26<OG!|5;Kazr#!Osc>yu0YR4n{<O7~x`
z9X_ECy*^NJ7;0Ix6Us5K3czrYYuRStyQ)5Ckoh3TBG=-Ff?TxOU+RImxs{jeoXA#@
zp}9ek(|}MLUl_b~HcUMP&?fjSAHMTsKS8r<dMw8&oqb2LL#@kd;y03en4LE`+uQlQ
zp~^Z51$ObJ%0%A%X6aQ6345+7=4Vcm)n$>pS2HDlNfI0LS+5WrN(EZ=?=3!W*p9)f
zxh_LGL06YT>beC56AqrOqnpq_AoFi}oJwZ)Z3UGs!j__%)znk&Bwx3@IyRfdSVXMk
zQn@4sZT@m{9k`@ct!RgHI$*y=Uyl1p)lP*T;@snHjdd@Y`?&D%J3squv$+1al-zbt
zH|?@tPq04_l;Sch#S@s-^U@3@z8U>z*&A2hl4U(ai&K2RFKQvT?=s=^?j1;G-{v;b
ziS^yF%blVHnByHsdj9}B(IZS#O&RZ!S>2tR@r32S7}g2jl6bM@j++~@9pxFOCX)r9
z61q%s#XJ54fLW@+bbrj499EhbO8ws|6oP&?33zJMO}NjPzii*N5qOD|5APhfbe-lm
zQ1&h(E}OA2z0w$m$Xh;V`E&B!d>Voh(JWfcNXzv8Hm`b>HE|vCNfVp5Qb!Uofc36D
ziqU(%P<KiH#qp4S(D~mN!~3VNuRTG@R$y4itG7=E!Z>yw(9<k7I-A5zd|J1YnUFc!
zis-8)AdM@Vt8~h|TFrZxp5&Jk-dxt>ech_7ZKFJu<lLCwn<|q`cSE=TLQC7@N%tBn
zKl_)Pc1bUezpWIjxp9eQ-%774X*h<)!kKb+HBSHzi}SW0`?AOXN8EcyHT5liqCr%Y
zDqWDGRHZ6ax`=cE0V&cV(g{^MghW7k6A(}kQ0X;vkQRDx(t8QLC)5B5&hdNazTcg<
zX04g^-kSIRkONCrI5}sZoxMMmFn5x6)pM~zt~t{GnZ4t(cgkxCZn;s~Gr2IR+|7LQ
zHIPapnRg;SYR03jO>!lj%w6ZRb(M6H6>+VPA3|XS#)^fv_;Lo$V68iO6+tfFtpROD
z&~DYNguda&2>H2;1%%LO)$QY+5kn!6bb#5)Pe{^C(fvU2l{iEFtfl>GnU`WbcfUN;
za)%~=$MK>K0ucKp4KmrB(c_~|iCsF1zDd!=CUyqb6eS{S5o#Fm5VkRPak@5#!Xf6J
zuIvc)H;fX=4w17Hb$PwQ;j8a9$1`=mAXkPWk;KQwE&!0GY~ix4LKcNNVM8*(o?s`H
z@jqZ9TPzG{=L`SfER;kRNwaobI;yD>{{wEBg+2FyNc+~Dz6m>=?qaxpD!K=+K<t_>
z$psnl_Smc~Y{v@@yuWE!LnP5$0(sgyGIjFc;p<RoS#~7WD>s&KQxcYHamZf>GWb43
zdt4n_(o*oO;lt8<nVoizd$)JF9>2Ur_#?X%sK>H-lgVLGA~kW6_ecpNy~`!*Zey4J
z8-aCN)Q_r*E+;T!FEZ51agK3ukz_n`Br&ZS|E@#MM6RfeVx^efp)2`v?YZn(wwrd*
z%6|6==F3Bai2RpV&`KupJvsN1ALBU;tkJLvRkZWcS)^e50`Ks<UtecAXJe4T&~3QI
zxwI6<+Br-sKj{bzYlUBopLFWgS{#dx6F=JaJ}Iln)_#91qtyy0Z6H{NP&+P13-KC$
zu~;KKNBshj0bhTy<r4m`{iC>8wbV8kXG*8Gvr9)pj#jqsEPqZRBp_6owm&tO-&4l!
z;k#x0%F3^+d){<M#*ytcGw;;%p3f#Jj4@s~KOZZqN|SKNCQyrdR|}`|ws#b=;3IUm
z+}JWXNyJ@17ogXpSe_l2(z4|iX>ldmEpH!cy#t4V$wi9IMvR%?4VxKioPEA9AX;X<
z=B?a3ku%w<&ub1^y78AGOBwNi@cZ`lrryIuF&-UIdA~Om(-l$wGFxMxqDMC(+W*)q
zR)+hBCgl%o%J8NcUzK{j&0T^qmZp<VFsvI)us)cdgLR^<8(eBW5&aQZ+tNb238Tj-
zyx6hvoHqNAV)#vNCcK33v5sb<Ml4rCOC49@y9;7N4*epryQfia{ZJJR^h>cs-h{dd
zdgzk$YTbS}c0tVKNXlt|bD?o+<lF06mXr$(PTLd4szwX0)rvA?c1qguYc_NOiE4t%
zKlVK7>uka+kDNUt*}BEbAKz^7YL_d|1=v>_%`?WDkmV%(D*=LyO&%F3?F_YV8YFjw
zyJ`0s>1u8kUi&naz!b6CZvI!p#9(bTM0?u_inK%XHiOCbNw5$lb;GWC^FiLcKp%b%
z>gTg!hoDo$Pf=#s#aAENcmlOvPKHD3Xf8}!K-R+PkW4Z?2OowQ;w-N9^iYqi?K*fk
z->k+s(1~1Y_4by;#pKtW#d3Ia2IZXSLjH1|Rnp7&c?r2-{hHeN8NGBa-kQ-yKkkqQ
zb-Eu^EmH5acNR+9&3Dh^Hm!W3EE~TKecQVt^d?*$=#gdmZBebY{8l)2q~4TQr*_l^
z$loAjAk5)i6y?3;af?(ZPd0HmWj$6l@x8*M!$B8_J?-mc-lxJ$99vp5@|%9NIfdl8
zIU;4BH0LM}zzK|VO5mBt7yNSoIl*Fdd7w4HJ+hKu!O9oogZSVipnrB6K+oeX{>tX+
zf_5?_vp3tKd*I2{%<F`C;Zrt>S{~mJ%3xYiZ{0aOam3jxATydP;QzkD`Tyf*ur$sA
zz``xs(+ROz8GOD1IU<+qn>S+eq?5c(D0@m{-M|V4w=r_9kARx;8Gy4hympb871xm-
z=pz1n5zTNdqqY997nA!R1?PI=JdVo#lLh0<^R(+30OWinfwfvbpfaIy%B?cocN;Tl
zeyMBe!P=m-W0q_(6+xA)^Lnk$(Z92DJ)4%Z0zm7__|Cn$Sj%j7YcSj$7qPKW5A<Q%
zo5>TKHv%Q=K4-n%k&N+l&l-3Fnwfd$8_1Txx1l2FoQx&-HM=<58M@C!N!6ch`oc|T
zlt^k5`ku)6O&$Tz*$qN`g`7Pr;1jQ^iIru+$zcQhetP?<OPW_zhDg1SBZ(H9@M;rL
zjIoT1<v2M;ObcSUyV{)@poaK3>DwzqVUk64i(#VF1tf(%r|0osM5XdF2ZxFJ7<r<|
z13$<P{)ZTY@NlQOhJ9HON6U(04XLue^9E{-9tbJSsc_+}ABi*fes#=W&KrJf8^rRn
zDFI(Ew>kvl2YAA3JLkl!aL0oWECSfVWi1NmORRJ&MZ_YBU`W~WI_GOsM;@E<_w54H
zi8LSDA6XH%^FBeCU~Ga;;4|u{PDr#?bdi(v?E>#v<x75iWuVm8%B?k!TBgPBCtkwJ
z{d>vRfkfk{T2s_lFK3tK@BtQoK*I|F#R@@0!7C}+z+@0lBykgUZp3lENU{**jBzbG
zxG}ALU8VY-#8;cI39E1K<h@^hy~;QNXkaCQunOi(tZ|Fj9}vKCR!iSo4(q71i~Vk_
zz%fiVrQptGN3-v+-y;34E?VJA(7A))XYPSC^%8HQU)zL?f}xoXg;LBE^PnXC)B913
z`_1NhsuHg~KYBR#l^;1PUMby;DB<}%zlZl>O;{|IYdx3+pQ@El=4PDw%JNoWjApfH
zn=vd2x%0DZ`J7_vA|H#s>h!kUrDYg=Ec*#ys1u+L*wG~ldMF7R+#-0#bTj<{CMMH^
zb|CnND$DZAB-i$MvLdz6xG~C>^SYJTi2@Aar8Ja3W94&3rDkR>pxYfbRLnIR@(|V_
zi+bXGqxb=|Nbvr9=48av79WyBO~(q$A{ZRrq6wpfO=PfIqhs5UfiO~*`)H-KXx-PI
zV?{+H`#32M{gE!2frf0hDEeM>r*<I2P3idtU|V_Pa}Bx|YtROuicsP2M)LOj{2CuG
zj6}0k(oNpo@Yh>0jkr1dDj=W(HmChc_-J%lGZmwC3h+^Z9`;Xg29349abC-Ca%{}L
zUu0zWflc66c0>Ab_=IYvCjn}Tuyl|fK`V!&mg-uhhjCx^>n}XT_7s>xjM8%p!S{IU
zORvXIb**)NG=EJ?RrLLil)<<h;}x;@y%pdO+*@93x2($mWX}`(w){?()kgzGfr=5j
z3^#thd)(_Ek?5h%68&S-S3JZWB1n$)>}3{LA2nC^Gd6ZN{1I~ZGY=cv5>MV;&?}<B
z#cHoMFdYtzPriBpSh6^-9e~GoX^ftkS{!AC*sdQ2{URp$$U|~RNJ)ihaznfsF?|on
zZU-XDT9DU}cHGrKdOf_Q_eN)Uj%K`l`h8wu%}6g1s@}M^UrleBHI<-^vzA)3z7Gk7
z6@OP|klWFju?{<+Mvv#k?(P*Af0t)^)kgJE<+n0%!FLdmJa}llrWLRzo<?83^e#M2
z8-Y=58HI+6E{ZL5+s~vYd!|^0KVT0T<I2ACyfiPWNl0lwby04(gN6VbQ3pKA#w!#Z
z8Ntz*gqG9vyFhV-w08FPOzf#xW^OYJiQQPQ4dphq2G6aUSpN6-<UC@YToU|`<h|)Q
z^b7-84(()Rom-dzMESm0t!HC=DI*YyT`9;Zm!f4{`(ba4IIqRs6{c52JsD_~p>tvW
zdsnS9xmPg-@X8y_*a~3eP+@PQ5vsE8V6vhULE7yB)`3-@-h790PaVsU2SZOkv!I$1
z@##%B#CQEKW#(|Q==L)+=?q2ji|7VB8vSJY1of}_^MooE`ql&r!U2PtyhHGJ$N)1L
zbdYx+aR0l)=maAGV~e2dXr6J1fvHgIHT{uJF`YKz4|HuT*X`fyau6Q;i&D+0&$1m+
zY0;MFNcaHSR{c&PhfT#;EO)hJkZ7%dBV_Maq1U4ch;8bi&Tic*aq>PUA6&wUx`?jT
z^3$ItVJ%RsAL>H)9%QTfaR-T9s?V;+?Qw*xtNYQp954y(y<_6q>}h_h<T@xPbVaZ=
z0T2VPhGuF2w^0*^g(21$orB&=ry1dVc1kZS@lJp<y1c}bZQ%Y}FOj%MQtUJE7XT1|
zT?svXf&E4LkV*vIl=Ig$O}7gIxnKJLKs3wny*2d43fcO{^c!gI7=-)Ko%!tSrXp#n
zCnMu2V9u=gJ%*o#KV6_*J-4eWh9gdf?#3-I&QLTr-5>03P{_5H6xsI%wN)S9ffd~)
zK0g3l6hIcMF#6!C4kCBqQD35UI)+upAW+xMILC3?sQP=XA5ZBfPA4R-(;V7#?VPKP
z=jKi3dOqc_?X$n`6%rr(p3lE+IWzhC59sSt{8l!0YPEAqE43;ENV({~Tx?;bfiXkX
z6AXY%<FKLz1$>a(snmMeR~r=pvHd3%Ij>8JzEQ`7rW`<kIM`e9-=TM~ALfU`KEd?k
z4E8htF+xVc_KbdTu2$iWSLxQNSb-TNGMw(Nh4y&bT(I`O1{ApYWcimIX{PS-01>IQ
zHb}tunTrY7+L_(!1;)ir6uwf<QW1}6kXdFWp2vP|kjTZt_2|#c`TO@gZfo)X)Lp+H
zU7b+X?ZCQ>V8d4-tq!Jh+u&u$=%lU|Bk@q=GSvvnidth$WyHNar{%6sNL!HFx{p}r
z<#a>qv_mx+$RCdyVzj%WL7Se%SX4Aj7VQ={jg{KnxwljJW$+f=ZzZ=!Z{J@_SA+&<
z0U{jvraOyJRdiQtG^DlZ2^twD4R)g~Nu&GqqbHXyTKL=^;LKfS30({yb@&|MsEl7@
z^m8xo*=C^Q8_H*A?0ut~z8uC+m&M3`0AB4{zm+0kKn<`yY?X6jJy#jp{q+X~rbAx1
ze5V*;rMnsf>cM4Mar!|^L$M9&tRW4GJ`mdR{4wplq7r>;tJ}15AD)@ew&*Oaeh_+3
zH2fh@NaAKg=t^w!VrWJsciX)B@=&|KnA9xqW}11%yVS@>-K{3ZD$QTk6asH8#U=*m
z$YXi0Zg*f3I!`aU+F7TLQ2RL^g4DPNb$<S0+pk_s`o7S)ORyT>M|s#wJ(SENpg9A=
zzy7=CKzwTeR2B5XE3jNt4SqcsePTIMB$bttwREpXxj{9oDVMGOAc{piqgnQP(|G0B
zQB`DllB6YjQqsldxl0~V$?Z91mz+u%J(h(c6n1l@;nBVG(OKoDZKoVazUFxr$Dx<R
z)1jx$duG-5&Yt?{?+AMM`sbd#fi7CaBaqq(KgX{!HV&n>0X1gAKWfbXRn8MnHa@x}
z*TOYtp_8+wJ{pxsp`=QnPqa;D{4>Q->boskYkK5joAsL3QnaQ5kbD#9ykBXj?qR#P
z`1mR7{1c%MeyGO%CLdto0t7lmBg^GDW829d31l9NU%WY7)nh>mmHiXvWR~ufP`sx<
zss@Jr0lAknDGQLzFvad}ojGC+fpa_@{EiTA!t$ftbjO@LqSc#I$ma2@(IRKmcAn)L
zd@=6__kSl@TLA2ohOZU;KD>IP(>bb+Vh@Z_mLGxoAf~n^Qs!Ib9dG7)&^%Fcd7cHi
zucw_3y8E4Cr%h|L63^91CahK+(K|R!_w;Qr(2t;aSMS9u+SlYD!fPc4y^Ez+75RV<
zSPd{B?a;e{7fm)x8FJH=lHM@U0a*j;PoAzOq+I0uU&#TomiS7M*=XZab!@$jJwp}?
z!`K>ulIor2k+@iwoJ@R#2SfvMs*F|evF!cbwVWn2mAJKT)Lg0}`(x$)<$6=hgh(ox
zpK9aqiQ&gnqbMq4Erw0Z%WP(?aaG#$R6u=wGI>JrQL+YTi!evBXzChc9pSEiKcq9w
z$J|M_UiOGsWID!c9K@vCn&nM_R^blL=PJs(`F}vB2)ScX#3Uom6<-fDJulvb&4VlG
zBcN~c<+E%rAZC4TULI^6*Pn#b(0MuBU^)@KNLZqXK$6M|0%@?JZCW&T3p{0&3A<-h
zTQ!ed;=23lEkrE$-sL{si2&gef!jZ8e_;u~DNXQQX3Ro60}T0GGbh~{!mFyiO7d-w
zj4jYL>J#s=+^I1dm)vxH^ooBcq06t>ySH`3(tA#ox%yj~;Iw0=dFM6r3}%y~cwz88
zJ7A^kJWYYJ=_q~%M8qasQOXe$RW_wnMH^X<RdF%3maBUAvsbfv|Ijg6NkkxEcVXR&
z6^py$KKb4UOErN`4jx~21=#M$7l7wdKT26X&N8TR2Kg|G68F;+VLxy+G8W{p2qaXk
zCSGPYW|TxDv_#yLlQMPp;8^(ZCX5L-hP-vfgEPT|wy@q>FjYro5Hd{aL_lmJI4`A9
z3kpopZ2{~Aabrvqg1eKKW;kwqURStd!;RBMIbC$|iqZU(y*jCZA`yuzqaxprAJ(Kl
z%5PcS&+FY-M^3SyIslwMD<e)BpAQqZ12z>bf>?x)tLx3kdiNB^=z%s<nr|!N%n@X1
z+OM3>rwV+5#|XZZ1}{5{IGM(2h<`{{8y8R)Nw71RtaIT!sz37_%~FuqxIN(0rFvd}
zsXM)8CIsA+GTi-2to+&>HdG@)F}Ypnjd??Ld3};`Y$ffLNU0u0!kO5Emb-{a)>vef
zV5{780hqJ{qjR`DjIH)@+|_8Tn0w?cU3%GzZ<Zcky}ZyH3d|^9Y}T4yGF3%Kw$jaT
z&L8g9HrOO>AHE($6}!0{s+Xp#-6Z)${*)Gj*t5En#;M|q;r6VdvgF9&)!$8YI8pGP
zqq5Q01gBj7oz4L}+Ye=YH)@smZVn9gKUupClGA};fW$%iBHJ@~P4aHvGO%q~l+U$g
z6z!<amp;?s6Wc7#D^y*V`c#l*l*bX*0b4W}SY(1*!l(a$PGcwBP5oBrgFEZ}zISnm
z4GNSv!adlD9s<U_B$=IB%bSBju4Ai&C}bE+2q=NbXg78a$RJ*L1H0+1b8!!O7aLB<
z!PtM=&k?F#_WtJa0-<!!^yHdhKN5U346c%Eg-?rL-EkD|I!*SRv5DCK1FGP+E(55_
zDGnB$uL6WU3@R3H2=Ft%h;vDri8d*Su)?iiiUtXrWmdw?(>l7y+>$;&si#SIEtoZF
zK@8kU+yIpxuUf*5I%|f1WMw%vhEw3o(2a<2hob3)Iju&HfGm(igzZ<3s8T}CyEcR}
z4+;C=4tTfaI#`b!m2-oKhn+xh-X?vx{fMNbmKPtN12m}Hj`Yg-g~8LecU^?RfHl8`
z`IwbvbFuv8B<w+qO3?}Y&f@&myJt!cxKwZT9C&bUjEUds8NzB*ZYf2sEd8rL#2ZS&
zd8|)Xw=i+0H|A8#E-`dR-KD#2?D1Q_h)WAbqL0$Do}5jwKQ|}Z_Y@8Jiyezcr60Ct
zx&A!93!+d1;c|h2m-GkJV~tNh?s`W8k+R1ZcvnQ*&}{As9MI22BJasr^}&M|ghm?l
z1ir37Z0bzK_N5Yt`@G)Wsf~^q?$8vTyor2;v}cXE5C_<6_4W)J4`rqL@((RJ#&X7u
zYA*T{H?({Da6>WAdBvaE60SN=J($$TZd@9A=M3+cHDLOTUhG^Ir}vc5_NIqQjb-G?
z>>O`5J;n!I-GYD#<!qSmsbRcbQA0FZ;$a?T58EUC^Y$$6#SAg2Gs<1sPobKI{*|=X
zB!w?TLW)UFU22AL{6Ds+yoXR)QP#$eByAHVbZ-`v4kzrsT+?Cx1A6$hulhNfIbl}~
z_ZlBM1sg%uumW<x8Nc?pEHqY4arpS|D#6tdQ#1!<537}{vx5TV*dYErpxupy($(WL
zi<=lBvJdc?n&Ctd+;#{24(_i%&2F8x(oQ>b#2l>G)l~@JG#?~<OvsuB1hyEoF9M>L
z7OZmtP6-^9ViRmJQWY+eQzc7R)hOiiN?ziV>V`rMn`6D_Hw%dk!c)QyxkEl+rFF95
z`UmuL2FWS66ahYTXc7Qkt7+#CNaIw5;B*6Mi35{B<wkL|s6B{I;KZfMWbyv@YN3a9
z_0=z2y_g$bgnSAMw<abBZA4&zIcw(>U4<`&v151S(Hp^w3h2e);$rKH+PW_?dp+sO
z&qq4H#t2Y9(92+5kZEjN8QMJnYK$3y)1W?)BR5|3-g!Cf<RCKtTw{Ra)=$+qi|3v<
z1^UH<7ihmKy!`|R&TT27V-^sk{j~P}$O6T@yaT#cR8yn*ouK)i;k!n)rYmx)t2d(m
z%0)B(cP`q&4R5VI*2`yD<x?xHK_1i)Q=GQ`BX?SztTwPiJ0~6zGJTiD;%D&C0tZ_1
znm59;M60uj5Utf7O{_(Ndp2Cupq$ye#Xh}FhnZ_0V(5Jm^Q>1bUA~KUElqjjIsl<4
z?<M-6=b-P0fmsEMT)s(HoEMfmxpFn0tVPmb!bft;<A$t%ld;&sGxqCvh0DjVF&26}
z0(QsL`)K(>eHpJgzc#wR=agvUM}ncMWxuCy+vH*CAb|Pwy!1YF<5B~7WEBB@e@2KI
zC5E*P9_ribo!YhV`a(1**@7_A&$yG!sR??>He2L^T+p+25?dmT12&x3`|-&Q>X)K8
z^7@1>s#d7-igDIhZs5Y}bSYzxFwO=u2Z!I?Q+&JKYPd^zDX%*eX>dqJB(fT@8<l=z
zOq3#W#yN5c<CN#X!h!B64hXlH>Yr_xK64_A31W5w!(k(`9QZsOvHK!3?)va?EW>8X
zOX_MMbuK5KOl?n|wA^s;mpmI!=~S<}O|a(-5zzJchT{AhjuseTG0u2EB%kx0B3;fJ
zK4Y+awx^6nQLthem1@$t4n_IJJX!5WOPbGrekT8ZqD)BMfL7qaQ-C9?1>~$Lu)M-p
z=jYM<I6=&;ntFcmPXhLcefcL;!FO*A%ol}DX^vm&{g(vH0t4?n@+N9dp6UFS?umG>
z)2H!~v~qG%xi9#cjEg2pDp(Z0>=m$#^;$CJZ7sO+=&1DD&)K%F`+Sh{T#MT+A?hfK
ze0*IHSgDJzly_WJJj2=s%+{$F%_DkcD5g;x<0g~8t9IV~0l7V=kwp4}f&PRf<SC{{
zc`<L>-AHf}GrIaWL5BOE1eyO5V*gu^{r~z%@MrX2>Y$vb9IjeFKgc>^!;51Hp@u*+
zO1KA~LgtRAke$xFM7!si`u(IiDferpgTJJmW_U-9+}+lN16|{_vfVELI#~ovW0$ZA
znAIa+mDZV-w+InMPY&lVO?H84VYj^nn~gY=kh$O;F&Jy$)r^eNfG7l6!T)*poi(W2
zl$K#U6+)4yg6PIx1{7G>oP2p*sW)pD>9Ou-$auWgciXvacxwh98w<Bp2jb+;C{2y9
zR5K{ZS%l&{fs)DYm^%bRy@VA@cW!~cMH&3S?r)1@tCmt<NPOk1vQxX@zK{g)`M11-
z4f1FM<<ino54jKms9@1%sDE@v0Vd=@R*WT({8H9~GY{`MuSkas;$$$QMNPa~#W)X=
zWm7}Lw(PCeXN%LLO63eT>Aaa?ZT)M?NnP&?K&qlg-T<g@3+r1#LYyH}Y*Rn!Cy+Lz
z>21IhQ7NiwG_Qql-jkhndbg>}z60imY_w;9SPd~lAEoP&q&=x=T1vk@x0ls3G3;8k
z+}ed5J06w|J_ba3j2Z0|*S8prA-*xcteoEkaoN;9`)DD}bm$KngtTZMAZ@j%rodTL
zGdQW=*7THLKXrPfez{scoF&@bgqhbe?@GGd!m`lyKk+7BGzxN!SinOY_93_Y8WQR2
z*L|Iv2e`EX&b0$x*s^AS#r-S8a7^fNE2KssKL%MJ#pZ@zG?^?T4bc9{V=lvEk3QNx
zZ88t@j(SmYYNoOVS#bW<jjd>t^a?*V9^lrmHm--{r9Wba#l$>T2KQw{O-Yb#2nIVw
z)-FfQ6&-X)l#U$5!XW*wwuzJMn}*iaA;u4J_3__HKad+W;n~?~g9@=;Y7>BDVyt)s
zb-Qy?l}70CF;8>Qxq+ERyN63@erWw_N=5Y_5PLziZFZj=_T5@crXAdoc0B6$oblj~
zm3T4InA}gVqXKVjDnchQe(jzaBvA0OR(Qf<mox3R!)epz{_DwN1_97Te%Mi^4x4I~
zkW1FewUW6j0OBA^vf~`i8f%c{;>?QGK&C8kaVK0h_6J>EyWz1wi6un0wVV|ePH%yo
z#%V$>9dWT<uD^Wm945`c=daZZMRnc&(5_6al$FgnnzZPLM42!@T{O-eUKP27--UWi
z?m@Ltd$Oh^Ep;ZXj#8?%D8DWGeUk<5X9YegF+QLSKe>B2@#P+oM+X9xeX0lh8x>Wm
ztAXO5MLXJE(EYbJJDVaRL}NJ&LUGzeuO@KJKX3j4eF_a1nM0Ul7mCha-3>iKXpy9$
zDjXIP)k-Ggf4dv7laD$5EQ*)SuC9rh5e=c4DtHnQ5Zhb)aOR2H%}0=n7FMR!g=K(u
zy8j>K#XqjnoEkL`(GW$EM-H$TSJQk%T{6OQN3DzJDR^~s6uM`5UWSn3gz{K!Hv(6N
zulNk;r1nc)T=Zvv-?+4Co$35x^V2RS-aYuej5qE6J9FPVW#{`ujCmIJ6`RG%FN1Vy
zY;8=wxj@=Q8|hY5(*hWxQcg^XI_T;m_;jkL{dXX`qmETiN!=bwFfkrw0{oD*zpNmI
z7Bz((+0dQeC$q%@&-5zjv;C|S3gz=>3p<ruyAjkA$HviI@3U2-jz#HWi?p&e5e)s7
zN2VTV%x9mUK2Kj-qK{V7y9%+XZDsb4MShoXXs2M*!)&S(zr*e_UeK$K7gwo!#0w{N
zvHi-R#v1XqLsG5UgVK2!?<TW)D#Oe_L@VyS^+}2=)XFyDi+gf-8F9wUt5-d~7xdtI
zTsI<pEyUQy*4pHb>wvwTWbt64WTlNg^?<v<_ncopeY}}k-MM@CV~#px=}8$+`=RqH
zELCf}G11{dB~`~<afL?P6SIjyEFTSMQ5hsoT!-C$pLo-wZGgY*X`Za~^K>i<Oo~n0
z&7!NZS(T=+Kk;F!9C!3AB`@OL5LZ&-X}j)mDmsI;XdjtY;TITub!=ZZCV23oO`!jm
ze{U*HgTnIkacYo=!ehp^(lM^lT<X>-hAr?jb>@;{d+pNA)&_%i$?G$wJ#XdS`)aEp
z#Ooidpam#qb!BXxPdc6$d-M_9XBv;TQLY)=`$~+%M|;br<pBYmw~L1q%$9#ZO6@;A
zoWC5FpbfScph)5V@u5qBlEOyUt=)rJ7NGZwvxpd$M)?HSM>nXSPjwlcF}o>LkDHqZ
ztj9!~vF6zw*`1MH->D=Iov5=N)1w7sDlTq6WW62yoB|ND+n;z6!a?iVlOj_7`tzR=
z2TxiMq-Dt3QK#!=8QFfYAmCR@dG^~2Bxr|>B7^E=qUgkES9)GyG?X<nUZ#Cd)H2J`
z&e_)8^15bwccm8LJ|UuRYD86z7>J>0^o}Xc9>|^(5q_k1MOVC~r=xF^5ZSk(1VvAs
z&QlnM8dOsWE-)+VO&*i@>tB10diGRwWk#&bH47MBtzKscS3nrxuQP8IUhdirXu;-~
zQGR!&Uq89Cn!fR2VR|TcaJXCcpjb86Uf8apxSiBBUC~byxr`N6QNPjt9e4l^9IQq+
zAb!D}6h_;bqWnW73<2pZxze68LoX)ws%#0aI}^qkE^wn8yf&Sd?#B7^_PXz>`3o(n
zJGn?r*4p~cF&5XJH$mU?rdKjcxV<=i>|OiLe0ST)o3o>#6i~{un=`qW1j$dXj+B6`
z`RRO!s(gvUagURKr>5#%Q{13k8GV6P8}22p^Pru)tyBaZqHAKwq4SFAs$86U;~n2M
z5P1(17lFB)y?s1A!!Y)Zg$%MOiMx1N@bL<e+%<B)8r^MBx7v8tEWtoDJi+7it>{!L
z`_{Ysc{}!Q2M>nh+2E9$UD6S!^VDWF;}1ZO7l_yw8lL|FX=Z5FKAwxR_#v}7dU7vX
zY)Oj<#G+_tOrG;At}mcdi$XxTY;R^E_+~zdC3Fe6P#$EGD;i&aeDx**0q<LKuc^@K
zmfX|rM;-&@fYq@HoWaDnmTUG3TJ%@Fq8}>5KXi@#>Bh}^Rx<B+Q(3D(&wk~I^(qqJ
zZS+%@JQ*H;64HAt6YWct$<Wz-UZ7X-Ds3opp1;c2tiOb}3#zc(b3C15t7IW67y?xn
z$Y7hD7qgHyC=r^mKmGP;6V-6?NIUt_aj|ZvZXGr@gU>m;G|eU~E~pz}IpSfg0UPSc
zxDnPR0~vxU15<jBk@xHKmwuilURq7HqwB`0*1#p%N)#1!_c62|X&V^LFB|cWZF_H5
zF53R=%WMvB3?6l7x)U;2nPxNut~lgsad;bK=7-WE8_LzR4p29)(XxMJP_g#OLg*59
znD9F#ogO1!!#1+JuiMO3*XZ}GdcyH)^rm#b4O@e{lp*N~?WQa}M!mIlWUoApAg}oO
zPzqNqle@k0)Wj6Z*}-~r{c$%r>@!|U``0Mfn|Bs18(U@r#hXbf9c3we&g?vj-c|T0
zpt~W&iZ^zmD)Wu%`|h>&W$x!DeHL@aGVd4l0}PquvTf}p-5EcU(KJ&j8==Xh0L_Ip
z_3Ss_$!gmad`b4T=%rrCnDY|JV<uJ+EiZyE&l~*HG=?}P-6bmXhpu;OG3j$Q_E#T<
z|9omCQ@EM-yp{R+{EtL=4p%ewl1*JZYFUDZTC}4Ice09xc%SrHsUD3^9V1Aw@iI!H
zHQ!L$JEnkK!+6`}ZuTq9r=myW*<;nhe8U;v4642T+Mn3JDtiBklev(1%mgeX!-QmI
zj63xZmkw$-5}8r?_LNJAoDAmL!mf<zrMo(rW4*Y8m_pvM`(!WafKid)ae-hCbX6*c
zVt==Avu=GN_yh7U_PtA-{ILXzyz{m(+TKY@3^t^2rl|2s{_KX98O@oTVkY|g&j=ok
zYySs?{Qpm0lOi2P1@Cx-p+-@(8JyoY9-DL^SP{GU)L#%(-X#=w@=pmmhWF|bP#Xfm
ze$3!(%I0Xg*W|3%z~Y$W4@x6<+X0jyg(-gfz{cw<??o}|A_O=1QsCRzrCiH4vhSbG
ziSip<IK1Wc@*xmQEypT{I|)^G?t57c-U8Qy(Q4rhLsRf(05O&>5e>$j@P=GfVch^i
z(;~DFUoEZw2Xr*irRv<<%XyV}X$9;%zoz!%BcP8nj{07WCm+?vA&Wt<gn!$S|Fr|M
z^bRr`X%PGg_Kr09W^8EpTY6Mwu{BJ{bzAEh5eHhL;G;=Olzx#$R>=@Qwr9l@tW;Wx
z)(Q-BrpHz*RhIq%<=Qs)pE+-q<^r;JKPDzh)1eOyv{_IYbb7`zKMnPb2=gpwq)73R
zDsTGkt~zT85y&7JdT-bRe8-;t59pq>1))MAHjxf+p=s8^;&a`f_(>yoI8HcR$QAtw
z&2nVzKkL&mizXZh9>(+y9_06hYC6yKl`LeS;oW~J2+h9*5&tZ>{%1!7BR*5~D^B84
z7OIK4k;gClbvfF8{c)pLn-y<~9Hm*GNpdVsAYB~I9fqT4=ix%;EZD83CSKd73rmP;
z^AaIAZv-x*@5tV+oW*f{=)DtuxK3>Xv)982$_#%XMz*O8U-<{LIsy}fPn8wGx1<c(
zz-Z+m$~ikZQdu_WO$-y)Q2QbUPF145#_fpB^kG<ujE<jOkj0qq<Q%d(1DB%Jad1f|
zs)gsa2VsDmqFCIQp*G~jR?#2O*2I2OGqxj>J4}`aTd(S|U_G+mOL1WvC)^1KX7Db6
z%~fYTf07XjKN$twxTD4Mz6N`um&*2w#C%n9MBb2PgJ`IKu|4DKc%y;uwiRYuk$fnX
zc!~Yd2MlWa9=G~w@>>QV&nt4Dj>T*(?z3gl{6t-3Z~zbo`!N`+45i2TDUww2L&5i>
z;G@Eh)ZAB+K%bt$^3W~>Q_-;qqHj+TjDnG4kBptE;MUvX!kfM~I(7`VZ`)R%(bdGU
z^8fsFE3SDh%psBRIzHhq?T*iqy?-?T28kfU7D=<Kt0tUJ>ZQnPPOn@Z4>`N?B9hdW
zTf+PwD|%R0>Pc&;bV2HUWek?AKBgu<tZ9sGnjaCd<9J)}JzljL<iRnCO72*s^v=8@
zw!j285kMa{BxqvkmyD;@f$D8@KpQ=0xfeKgSaOphaop|e)Sa@MCls@VDCa%;LRdG9
z1U=NccoR}L8FBT{E~(2T_4#Ot6Mz}-MOW%9yjZkRej?h|xAxGfEc}@S1L7-;2sRF{
z?ApCVBb2dv=(AHXjA&z00y(2s)i`Og!Aqi4H`#d!FID#UK1=2X#NWw*a_<o|I0!0?
zK5F&V3TU`z&hquAt>^C<BV*+=i--pR#i=UuCY&=Iz?enP2`*j!fO?hSRznxqD&STI
z`+EVy4#;(}*&|uW2sY!vfcLm_w^NkEPFQIc`)n)<-l)HwsB>#^z$jkV{i(Xj5zW)7
z=}TGr39_m+8+xS!gdxKxI}lgj9ul6WAgM)uA(!s~$nS)G=`=-h`^Bv{t;eP*FLbQR
zwjDp?RS>h1xL5cT_GBQKpOzQsm&UWmT-`$}R@nB)dhwcOx!QH#IcAf0biL1BEn`b~
z+7!VXgiT%Xg9BveIP{H>&&Z5oq_^+a5=*HEQ3O46tAsJG2{Tncl=QgrTTE*#U#@4;
zbC*m1LZa4jo+SSOH(zB&Os)64PvvYPF$SW?jy_&3i`PxODVmdft@ExtD}0CG1uuQ<
zoJ(TA3R6igrF}Rf<{g7n2p2QFe!YeCB<>rkKd(oA4WT1bPBCr-pF@)XF`&UW_u#+j
z?Ef48Sb?INvYwxtDMal%dR*}9_SI+ci44}|X-)sVsK)5xngn}_Xc8BB3?VP!CwU<3
zg1&?CMn*(~c!9UgE7r}K;-ZOi*Kd5?ul^O)V{<77IZIh=o#z?Vdpa&cEfD9MwOVxH
zcUMy@|8G>!iOpp{qyO8z!=%D}JNyRQ8AKG<hXJGc&sau*Q~&G{3}*nNUl{@+JmRQ2
z-|boCL9K=J4tTm4es2-2{WqM)0+r&sXbgn&SP{aFfJ{N;QhEj8;VuhpO+Fs^3O@*6
z13o9LCfixj8e0tj2AsSMxp-rWz+?PfkRwft|5Z@a;M{>EfH8WHqGE$#A`nJs8Mdn>
zpF^MibdqYeXH`87-Ov7(D{S96u7%Lg;(+l~?cue`Q_tiV_r6f+G>Ydrz&ub$`UYM2
zk7+}wEEbkeA1Q6N=WMI}jIK1`^0I68_dBgRzv{>2w-AOH?lAX^+neH7oRc<m6O8T}
zB7=TBF(16RzcZ`eCx>*&l6m{-PY9e)L@kJXXe;slLF=%$n2@`r<|Pk0w)q2k!(B-E
z>6YlW)p6!^j417xr|H^nU;f3UH0{2y1V^2i12lLd@`_*^@OeAM0!UkH9sFY@2QS2&
zWq#mn&8@F{qh5-tYwp6}jUw%aUg4vjL8ra#!LSZRj%q-I^Bq`X{MW}vmX*Fvkr2go
zmXA8WpV1hok5UF@XYusDzZETi9Y(vBLDh5}DuS&?fr+rWsGDhAg>Flb&M}d0Ba~j1
zdS+!&`E22>HOq&@^tv_QTvTM+6hZ%vKYGw}{ZR`raSC7Es%05!h2Ir1RY=qCGpnM1
z=^OtpP6Eh0$ei5EhH>EpZRN}lun$9{8fZ~z7Y1z^F;jKFoh`2$MXP2X>Cm|yB9i$=
zn{U3q{;9&;ScKq`7nN~NCknqfs{I4{?Ff#~Kr0HKi-GCkQ;QydKslF;cnC%d7s-gk
z`v7L2YDA9~mMs~VDj12}b*=;E8vkeztgXE8kv;=aAjNZDOxM-zgXLOj(aYD+_aRdu
zA=_>09=zRL_aakmx^Tqo8E)X8V5TM(+<VMPQ<@{%8C8dSY^dYW2;b%Pw^m08+azh1
zaK-jK`2Z*esAelVe`gGWgMmRB+qnoF=(5m2xpJ(|CJX1Nh?}chLEkbKG5MylvEJua
z$_#2Rk@0o_!I_j8N?ud`<T31&rAl@pd2a7q^;=bC{%v1GBluYET@|ys<_KT*SQR9%
zsQ3Y>M`XXO^TRi?{&s>M!UU6ya2WSLrt@V?awJqQ+qUjTdnAof@Y?QUBk9<*yb6_N
z66RbG(>GQ%EI?;IL8&8eUv-q@xG|aq&^H*uF7B7V9c~n7B*+%SY5S?Q`1D;F#K`hA
z$N6Z#-k~zo!?T|<$Wh9@1==%V{a_kVzceD<-#-Jd?22%|Qb<OQG*(Mpt48E1X&$Kb
znB8NBR^(ks0aocCpp^uIo+!-37B<hk@G>e;Y16By2wZ#>Vn@K{y>FrSsnnt&<Xs62
z`&I=p$ckl~jFq-3^cF^e+cc~%G?bsAgZDGIzU+3age~B+w3rlsQ6^k_s@=@j1u7dF
zrUS0<<Q|-&ZL^8IW>4+`I?$MekPYi}W9+J(hWnGiK%bhdRx%9V?E1|WYy=ySt59x(
zPunby!6{^!75T#Xa@H>{HVaM7=E{SGR9*xAXX3E$JOOh_?+DK8fzR$w08%E{0=~Sv
z4k%vP5Ht2TV962K4ezF3Lg1s^;G2{NyC-Y&IT>~`cwCR8qeC=bd3Oud(_trT>!$?I
z7&y>3K(I%!8D4=Oz^h5&Q{3nIcAEmFNWu+0#8$LxtywkVfKWi7;H5)rx^5m2p2=Y!
zaz`Q|ytX+R%ZqKP@LgweQ<bQ=xw#^xI~Mb2$y9SDl;fmjPM{Qg;lF0KTDkCa@oIoR
za5V0y$W7(^W>^!NpR%q{ez%z^ZSdLC4F;LQ20-hh4loFUE7plitN8WMCE8enF~7oX
zp+LSLvX~O9<6X#bp9>~UeGF?+cx)=`)Z<f;L9N{>7IUD8_i^%q6G>CMEoohQvo%xb
zGc$fEbCv&OExV~sYMmpdUiB7*%g;u&2;OAsutcNye3{u_#XR<u+Q#<*M>19G|DlZx
z#h<Z%yOJM*N(?%#m`gF>kSamaZS8PJ4|N~@Ro30^Y*m&OX#>4iUuN&#3`x*<tdWx<
zYmeneNzJ>pw5d<ZYdE*L^<{xWwnwLHk~mm?z9wD*WZrvb0fksUg~{TXS^bKLefs4j
zmGLpW!ZnH&vp1-20YFXXS~~gVBQWj8zBA^Hff=3{TgfUg9Se6HQs}>;aKJNKR9)WI
z>mq3xlHom17F&`m>q7abDc)*v<2^yX@MkLX)c)q1PHm1BT;}=;6Xlh=Z5KBeqY$a$
zcET#i8tmJCN0C&W$u_Ux@wF%r(K8+!J68KL)`uM=pCk|iM|=w3b_*o3l1eV|8w!OI
z(3g*ezqzR^(yo7^d8@6W`Dl)ia3s2LOSLZ9rPH?Fmo&nfQfW~0TGZs=(boorO9d>u
zS}Z?#v{k<S5&3svhpJGyv)L6{EW&X@@F^XJMfJQXac%L&iYXiw8Vfc0u6iSAdNXNI
z^4&D)5pZ=T?bI^P6k$J>t<AQrT@t{=4kL(Pq2KB=^nm8^k?R~R<M<ad#u*%{if$>&
z5tWW^uf{3|#LPuI<0NP2^6sC%7lAw^V%@F9d2f@syLXNn|6RNU{^ub1g1;e~(#DoT
zc*uL&C(qr*EPA_H>~!hM5&S+UfIl?!xX0o~-1p}yd(DUtxxb#x6dSzDU(covRK|{M
zBe)WqZ4y!w`v)XXyRTQYqDHjwg^8lNWAYb@QiHQ0Z@7%KVZBkkEnV=9+RP#o%ZJHF
zC_(bR?B0<V!qi^JB`>LJ-@5p{?tPqx7~9M=Dq+-@jU40SuY$ab4k7x1pqe;VJ@$#R
za$}Hzz}sLv=>x%4J62MblUZ}KZy=sFAhG3^l7|wy$#J`yA{dtjS@w33=y(2XR^C02
z01z)Jv0!#PX?s)todhk)cOlX>b8vR-ORR6C>iB+T{={pGwS<v6h>jk;kTi}?%+NP|
zu%s);JGG5+A^%s6$<tL-Lx?wL_{{B)k({O=05bB|pSFB{8-Sj{v{*~iPN!leCXZ{S
znPINbqTPO>6Ky{u<<u?4#?Azn@)w#5E24WB`uTwKC-4?Wj3V@m?QVFCe28w4(S=g6
zYxW#3J1(@!UH?aaNvs^<7fBre_Vz#_i1+9HEq}?VMI3I?{*Dm84of^1NGLS6KW)yx
z9(P2HYS0FB@r@N`egTHs2%A1(<l|-~*VD?ETBP17>I`%ft7{a#C%pB>8umkWZ8w=1
z&zF8gSBv+e>YYik>FV6Ze%0radJ{iRf0_sM8=$uxEFpEI7cY19Zbzm6tPt5bKR*A6
zE~7m-l(#FGHUBJGyJIE=+^~V{e#<axx?HvLcmU6OOciwc*;7VYe)8@3Tis6_%*w@b
zro+W2#-60#pE5C`FG;qJx8m2Q2j>oXXOEfRFX{zoF0Ti47x9d^K)Vl`SIo_1dvi9z
z>>2$#(}Wd-mdHa=&EaAhk^>}^J7y~-o3HFk#d`@aCc^-*YR0i8WZA_n;JBnf@AY4A
zWU1~CS=(Jd>i~p&!81Z86`u97%vt;DJ*L8*O~1(?L$JwKMN!$4r48D>x|@yUg&<Pb
zhuggIRX}L9-(6C7NL##3^md9~XR?$64=(e^Y4-1v$Y{1@GcL~Cs|GbYjM9wR6-wLU
zo}$Y$P06xx5+PPn6bh!Vw>w=c<_^ogFbrqN$i#a59Sxc{;>FHGwcn&aK;sy*NIjRk
z6wKtaAoP-Yt=&a0ZSnxzS=3fk-Ied<-!a3j(K64{L{CrpQiA)}68(hm*3lPhogW$+
zx!b~96_H_vD<h4WU^Gs$h%C4*CZs|0V$f02v!+(($w>Xf2_5}76o9v9{(b8up+#+l
z#$>tVM53Xn4ASgXemDE?Y7J<~$uFB1Rh`N2S-3bUw9S^Y>`yO>2!6gb2ApAqM7IIp
zx%3MFJom^9W#opa+eHaQJw7SkBLQcq)xLK7GDNgx7L0<ED*G|i)|jYBpc*`FSr&A!
z_bTvv>82Fk^N^O-XYscG)@LyzN<zX)Ipq^)(cdXgyDDBy&*+}RkbL)G$7qJU(KTC>
zChfQQE650d26wf4$~rt1jQRO%MO<S#Eg_fbrNob4tBkNr*;IFq@E9U(v)S)E!`r2#
z-&Ba$8WdiYXJ~$F6N-xo$;jO{kaXCQ)@a`5wIBODj&ghJI@+c=I(3ToQV7zkk$XrH
zL*^ZlnQLNK@x}TsVWS`Huk*4wi*ntI1~Nm+SXF=R?`T}fe$z6YJ}6Gah(7&1M9}>Q
zv@>b7oI%->`;tG`p%aoi=6)G1=|<LihhS-(wV~0)&)~<?N4ynlTVrXrH~m@q><VVw
zLiK4^nmEvNbq+bU1Wz*5GTO{IQ#C&sn^eD(8L~equTH7TwNa*R&f4nhzVO<`xbL0D
zrtb=FjBdPHdfKIJHjurYlyU;B_edxMc?WR--0c3#$Xn^1^aT0WyrG<VK6IJv&pIou
zG&lC{w#jrBXre6jcfftVI?6OaoE#l4r?yJ-X^x4~>?CJf%<O*o43<ynmTc8J?C&{Q
zhS-L@<(Br$&jjywk1_|S`Wg8#HUYlHXNqYnR$2;Mrs-8bjUi&4wxwW(>job~tk%fM
zd|88WniFdd`?L3txgy3Gp~EaBOxdh9#@4Pt`JCO+-Hq!YyCj47sX3B7!|29F$egGn
z)u>U;5e>y-;JR1m=W6Ach`2p!-a0VSF39=C5F<q>sWqcJb?Qvv9m1@ChY2M=xlrwV
zyeWF?ABxamNZ+8sa4`9C852+d4t$)4eIGY}%}oUijVClr%)fW7rlah;rpM+EqrDVT
z)obCO&n?jqwuw{7qX`t<{h0A%*&n$rdB$IIOj0oX&TW&7ud_e&b4yPu@@zwrl)rvi
zVrKADNsr6+4&m3*j59@g)2HBquwnhkN~=5~(BeOJxxWn&0(@;fPFk8o#V|)~=bK#Y
znFU`Px$_?K_}!#6Rq(ImIFvPZLwEX-v)k$6;yy*T)~mKN`Ym09A=T}nk%xuyz}8=7
z?0==6{{QO#51nJo=xQ-utpjk4((W<-<x9s@!A0X#G3t(*;Uo=Yv`0E21~@d(|Mae&
zCGap-aUzb1*w6HZHyiW75+^2y<OtxX)QnCrvE{k)#}hl2-*WZ2+Y-NO2shufTo@Fp
zpM6nPE@HmYQpO&Bi$8;K&l|5-f%A_=X|&C>C!lQ@sZ(M6SC|mC70!y&K=W5OBIdei
zbWGJ<-Gk$4r-CeX*`Nha&R|tLNYW-+z|JSS{1i%t?o*1CA1+>vx7{<haeu?*I5-{m
zwaH@02nQ$@1Cy_&fJX3UKs~38BSY7B9&Iw-{=MszG{Xx~1tsa;_gv%?!0j<Pb!Eds
z;4MN|k8z6F#Y+)jUv7s{Hckdl(i=5Zi3?@fF1%K!W<zl*HqZIJBHGmWPs|27go+2s
z%~ZglfKZ_U4G&t2*)VoJ6BO(kxRK;5)OEJT6t%2*i*_Drjsa@8`Kcxq(FG(Kbl4Pd
z>DFTwS6+&AFDBGenuB*rl7uZKvCGI0#|NP-lojZK$kcFM_ZkDitMct_-8#E(K;cWH
zYI8FXbYLzwz2$F((^9!AKX+(2x#VUBFKA648(&4@aE+RqpqoS>o!^Sy8*l$NltTpP
z`IymD18nwEM$9m5lC}J9C5u3<a%6itQ{$J}>7C)n3=eT^nzOId`U_0;Uxt!$oH$2H
zp2f<F!P@?S?g%<H5Egpdbofq&R{3dRm2G18#9O!MRGz;m4IJf*`V|&@W32E-3+-t!
z4Z%5(A9fvwtwG6sgcCNgTn#NqVC6B?T9fY@e^sZP;Dp^%Op&KCnIdI<qW!62FT#bs
znv~Golnwxw0GFIq)?5AR5pXkEyBH}^a+F(jo)uK5H_0a4DEC!#AcQM6yM;>!GlVGR
zKxqpMw{HEIw9Hbh7?99`3(~AZTI(_oblyCh`ko&ZU-bB?E?W;0Lk(nzG6MGUJm{xw
z@C+kopYJ*5cJbuZl@dUEo(RkN=oI39gU|U_F4&Vva;2rju{#&Q!q@E0m>Y`-=DD|E
zYf5g!>c|P1qkAo*n^m^4==@3N;!@y^``sJmK?5*esKs~#{PM-s94knc-CK8AFy>f`
z0;_pC!mqSrg5H~tdKFvklcNNc<g;&l^MwFhNArrP6;KFA{Q=n{D7PzcH}NSAl>Fc7
z#^e2KIxm7-XYFPj#5v<Ss^@w*Tk|A%NIF%lqE;WDI8Upe0vRkoiEqK^@<E8nqCIuZ
zOqHW*CnvJWgJ6}N+x{Ve#Y<d)1ZSkMzn~(B_9!{*4+ymmbsWLn&uAFNfyw}Tn@57q
z7fP$!XVG5j7mTNJOx`sbXjZ_aNx$8Nzo%B?6R~k)$|X!@9w<&$bXg>9;LP`iv?%Ce
z?hl3GG^A6ibK2iVMk2l_2MxbS)pdR*-(_@CDp!{+t-iP%TR4wPM*Z#qFQ()k!E+Y?
z^OPSma4A(M{tY|*?;L?N?LgqPW3hWHazx@iHmFE%X$9*>8a27!2%>u7kMAW>O(BSM
zm^i%S2?9%v`UdB*HTquG==8yGJE+^!`Bg07aW*T_J?MQcmnM2-gy`Trl6d0Fsat^)
zg9rTg$%uBXZln1iFr9nC395_&hhDLaS3z2fW!4rF?PS`sU-Kj<seGLZ29c(N2(x_?
z;k>M9os4MYJ!$4kYuq#RWH9VLHdN_%@uaFPUr`mL-p{sSKwx~)QoA>={#ykTK@vwg
z;GWx7Rv2~{B(>AOpbx3sapcyhysiMTBbL8z{-x|Tleyme_Jn}31fy|uERI^egXKOZ
zb{D+F?A2kEJyB7hc2Pdy<tH^~qFSL_N7D3$M9R_RVb2l>Agt!c{)gb!PC;gS82tzz
zPGXss8e88%mCDb<{`+q1!W_~>`5JWBMahMNp(ILxQLli<1;8>4VCtSW`T&#mwcR`P
zN)X&$w)6$=vov%=GhusIc5OckDIx}o`h-7MX7{A|-~!o-K*=(D)4#;JE%OSJ*hN_%
z68P-1;;jbyL)|MRR+Bt?R=<&we=u-1WeDLCwoelbloXWRJ4d#>aTjhIwUf|7`TYSU
z|E0%{20#2KzWG1<9`OJ>jphcdd}K@c(l;>1N~U0SyX%-cdo-t`c@L}uUq6Uz=5TS5
z=V{Kre{lljX&<yW2LQoatf4bCZP5x{b;#(-^R=(;JtxHprc-ZJi93@zt%yfIzU^nI
zUb++TT2PJ=c;W)#wp!DO*2#1dtm@?pKm*7ad}L3pC>T^+qHZGX+TPCs*?3F*A_%k+
zb;5<z1tQv-pqMV4E)W%P#p)dmGpy<}Ren(mTl8@H4(|9J>`w$VLXYsc1D>+2CebM9
z)tw3V`PVD?(Oi@&vcVh@rwCoH$vXg3Dg=nCn-kPAwribR8hwBhaNjR_Jt5nkUd$``
z^wr#)-3UXmWs;~@ppsHl!^`H+@1lCumi9Q@xhfyg27!9tQ{0a^u3Afz*Au<vw9hB-
zwzQTmS?9$LO~>`XN5r2HrJwHEwY0Fy@XP~Ku>~gi^cwcy^0{2d3by4^zO8r$`|fOS
zqD*m_1R}&C<z@A~N#{Kcxm!#vA|Gi-F&z$cVcWSoQnaVbOdM0(Fyceb__BQ3a!RQX
zekAWIOLA^ca8sy=T>hS+C0<(*<oXw^!}2aG2URYDpwc7ezeUK{<OF6WK%RLV6;%D|
zQoxs8bzv%1j`e!Af5qI98+Tsuk3w%R^BZ(r{OTx4B<yc{D$w>({%W+0Sf;y#ddc}?
zl^_|G&whb}0mB;p--vq;pr+n^{TD<*rKyPYBA_UdDxpJEqzfp$M@4Gry+=h*dQm_@
zKzb+Ad+)sy2)*~-LW}q1x9>fBpMCDk+55~r_dg>ui^+1WWU=0r_kF&f=lL#q>Z-ow
zd42@v2_On(QOqd$#XOf|H+2&^J9nnCy;c9c#x=z>2D)KQpLI3nj#Jmj*4HH?aWw+C
zG&)E3NXT^HRP`u6Z4@pJ$6d0MoXTA27vVOjSvb0Q#Q%HGrGMqw^^f}?{|x<I1_O6G
zL5CMN_73@%>T82y{CW*;?FFMRk_kU<67Dfa$Stea_7o%hv6^$zJ3ZbTjtc2P#VHnB
zCh590lfJv7l^FoYtF2=l@rFMW8o!E)KiKlYLHf_s)3F^h-8t6gnCdp}!m-u>j50ss
z_lw{_)a~pK>M<nL91BX5NU<H_PnpIJtdC$jtV@X8mW&Tg(!7WEm?LpWaA6tcj36i^
z+;!1eTF3EWUDNsT<~GX3{L;t5)_%L%bAy@Ia00B*y8iq9Q-KUn2R71k4tV(yAxJbp
zk*K+sEBfj2BhexqQZLAsOdhRDc%|e1;88oIbwh&RgTETiH_+(j;XSC|1d=N?Vmw}M
zKV$!nnfMNe7dC~QU$1mEa`8z@#my;as;#>zNkOxkpyVM;B>dCObB!l&Eql(Yni~xV
zArx3m8v9dO7sfw$JlHpzXL5ETQpuyrHcQK=&yg|yYYjG=0tNE1_i-;ur<Vp#-pVC@
zF_vz6JAt_A!#lRC>~_4_0LQM($?R4NZl5jpRtrobjudXCAMi+)tL{^upd}4YCC;Ag
zur<T|nQm|`79y+CmecvMSH)kYz^C})z*!{@4v*nJ+Cj!C8e&;J$kJ|goBfF;(fpD?
z9EXd0eZakM6r_gwVOqLok)ONDOQV=LEMG*>taiN@M__QISXyN~ER|9p_x!C@I~p$3
zI|jCjGW$o#b}l4iGU9kylLVmM)!s~{B9k{iouz<`K1w8YWuC!iw^-lTbsnAip!QOY
z?F<)bO2jk0{Kao2$oUW^zRn1vjw|mtU13e`@n1r*UMpUVlK7P)#Io~+tv`-Cd2i%Z
z#&}J;-nMFfO3$Q~o~&}L=ZHdOC`WS%<}D1wKl&<hb6dJ15zF4>cBgE6f%{Cs1Z7r>
zuxSq0Hz)Rc7cP1lLBIkRkV^`qCSt#<cKnWeLcp1D@pjA=$@JIMlyBl++B`jE0c9RS
z7lMY#E0)@Ybg!&1lL@vN`aG*gRP0>JC2y7?<tV}X9Y&virMD-=#tdy`iSR}Y$?dU$
zk>Zxd{Eu^26+uY_*_KNm#6wz<W84IDanUWmK2E`Ypa!Oh5O?^NMJygNkG~Gte+B;z
zD@LA0cHp^rMqkjWtPRe$beB&owuQ-9;Jw$6*7_C`2)*n-wTK9<q7n`$C$g#X_$ks~
zOSwdSad_yE6%{7E+%^qTNlhC2%y}PCvEM?W+*Y~QnFn8+roMbiulYmC>SvKe4dt`A
z`}Doz$2EODI%}1%S?xl!R!T>+=ZU(a`_s~XlY6%dO;YS*y`*!`?}tPL#L=4cQb-x0
zMsL~FeMVExxh)1cCXZ7(b}IJgEHmDXk&SpY=Ab?Au9?|dEWw;V{dpY5u@C|kh9_*a
z^Y5r_9fr{K7X^UCF%e$KiosA4!U<DV+Du>=W+0klN~NRLxXyXUZHPfoEk?1F;+ZVX
zyvC53bmF34%cthShK|u5!+s$5IsTws9eh0(7MxlcCyTkmE6dX`Ty-i1z(a&p67m`3
z`;M~D@Pgt(;!F!WWe~k&z(N>0sAEP&qCZNt$062WPQFz8X7w|#HwH5)=EazzbR*_)
zVamPEyh`O_qvpx0Ir^*`7imHi9-o3C9#WL|99)l`B-D%m2Yb{cafgd`x64k(d>4I%
zI%``KHC*l6Uxe_~84&?-c^4S$^{maRe7&1(1XXXO3zQ=-K-gvkrl04Gd)CY%`3~BI
zHx3`A6)vi%fhPT|Nx2u0#rnOKMJjiy!GPWUp$29pKc_`JbFJ_66<^055!1xrNXjgr
zh?Bef8_PZoGsdPXrggLXd|_ByrZFrU;*=L)pw|q<1~e3y?*1^;@6AiO;9!|MdB~Wm
zligCiFC-uyo4NE9bRjiV>l)~gUWX$8T>~z#Zh$efGv&s~9iRzbnx3hh*HF(8k}!?)
zC8E2&eZiSYz8cu%U+Gi{mhl=KqdQ)|uRZ&g2QgkWK}f1WIDHKOtv3ewR|;1!laA94
z&;jYp^z0rcnvX!O*%3!QK_?C|zihn5+n>8eD^;C=FNZe)bP~pRq;1-Z{Q4H}6U~xk
zk$u|a>%{mE==~RRr0VuqM{4Il`=D<3IB2GsvxsGb6h~}q5KJ1R7Uimk70>`8^W0Dt
zXkEM_AifUmyBhuc<i!R_(!+~Dw#?LQ*YD#bzb|s)%2z}RX=6*nA9o8=#-o;Rn1|lF
zeT~RNGuZT`syo6aH_)ScwyHyJ$nrqcF<gLV6B3=nt~kM%OHN1f{6dV>ELL6FqfS++
z9ExSvDC^I?{9CXiPA12l`->QiFw3gN^cI<KrSxI_oKozsSY-xM$G%Je_)$?^eD+@P
zJ-MM@L!86US)Bme3)FLnTk2x(727uIH3N9k>cEQNC9RQl_ArCF<kfBS$Tc?0Ht_i~
zl++fw7(xt*{nPx?01E4IYD*F-|K_`;EvDoQhU!Y`rtDtsd9`BjVHQc;;t}L%Rr*~s
zq{r%T7l@|xw)%ZP&2yZ^#H9bm!4^$wnc?o`@3FM}2rin}iHib(QN7(l-T3PW!v+cF
zuL|*PG3UCPX>fqc`ggcZ=P^CZb!k^y$ZbjBaM-aa$A-;DTb?(^!eWRm>rmFc2P2NU
zM$8}BZ4DrqX7(%g-xpO&#ApMQY5=Ni{GpU6x<BV?n>}j?QD7XSQ)EjiBASghnTVNa
z9U!ord`pU@yxlciF3^qWJ7w0HPtt6r#?^C7WI>o<r`-c^TiEqyJ&^AoIkeS!@RoJs
zt;fEdlBlN1O#Cf{w9ev!*gi%=MEnqcOc2*hLWEMk3-mi45D_P<grCJe_ZSlS+R%9-
zU<%}RF&p(3%2~{zw?u?ZXV&+&>Di*n$FqJG^SZhX-wZ!&7$i9&EVFbhgkCpz8(5fd
z*e$p-$*Ax&tJbL2@lUACDU@j^yd`v{+yHW{;ViLu`0G4sW^@Dsa~bn)euI++`Xklc
zens<=mK=thr94wLaA?+5OHUU(nTB-eaID)yO`n=w2$w_N=s9VV%{2HQO>nCgpe>5a
zu6(zH^oS|We9pJGH?0UgI75g)F&^0iG*P4OIy#AHU$K{cltpF2L}j^K8vQxYEd6%E
zbsI#j*9wLZt+Njp`d_sjW=?jZ6zT^4C1TEu@bB!WnV;!0%&0{4*1tX+jU&~_uZ*sD
zjGp-Ieu}O(7x9cMFn!wa?gBv$qFs`U4VSw2xb9>iL0i$TvxhFKJ+LZ8Fk#J$X$M-J
zoJI24A}J5rJ30E)omh(FBeiC?z+RWhgXlYT2Pot1DZe*^i8s1OLLG8Fq=<-I;^Oqb
zHy3(>%t_dArKrFU=Q2%)=jcVEkovR@qSwC+sfsI+wf!|_n>lYQJ|+JWq{L3_xOJNS
z!7Hpv0rW%923R7r^jFarS9qY;J*I9>Qwk6KbSgWA5{)y-NB?@i$h)7hRu{Rn%pW`b
z(f>gP|KD<3{=aJk{y#q6@ls>Wjts8XfO?1e_)(?F8;Jlrw+H1#Fw<h=0~5MA%6+Jd
z^9Fg+B;13q0__mdoiQUfJ-k7l97(<?xO8U+i%$C{=kBPatF&{vuRQ-({|yNxqjK~n
zU{Mk_`870rvbC|FpAQ_I3zuM4HFoqGJq>>lpq3FDl`B$Bg-0T)<>jzQZtSCP67UUM
zV*sC`8$|5AR42IiQ3EI}tJ<W=dPF+=+3t??ubSAZB&5#S2oMl^8y0Xw<;39H!>^7A
zF1UNt^w&HGcG3V<*ZBOjFJE!4F7?MqQDQ<|5i3l8Inf{QLa*iU&B!!6xgX=0ZC;R*
z6Y))%zrPIFnu9u9M({P)7Ew%c>|n;rB(?3W{MJJ_;XBGhj*lr)qx;lT?B+!46nkRu
zuaD$b1lKcrCY}6;syoh3xCH_sL-WBgRaFYetA$mPEh6VjE%4h<dfPIkEej#qL;}$-
zg|)A4+-o}qZ`&D<o?f$0t#vM#dKh#gW4;dJgYj$e$lj~2+Los2q(QTb74mht*PPRr
zRpx`r4-UZJwTu+pF@J}y{+n%byz>;6aP&;27iWnIn(@}){`p%Tkw17z-I;&zj!DNP
zhPG@K=y%w9f4j`%M|^%p&g{P^<~(z-1OHgGMG|^#=#iCWlz6n(s2c9_M@Tr9YL*a$
z&XHd;-(~2Jx%%r{T&k}1xU6#ZzA#F~3wNFS_#GN|Ik#p%(k=%Ao$!KhFCX}W0Fr`>
z-gw}W=T%Cf%&PD7I+EX9yXC5(^X``3i-~&alwcw|+xMbz90^4ClPI$&%pe8zI2L46
z3pQ<L%g5GhPp-EZfthl&=FBs(m<T?Wa8ez50{A``c&$E>N<f2i%?&XHrYID4ae6h1
z!<DDD;ZEdqoKq7S4>@xl<z~c+@z+=34RtG|;&2SoE1-=v=4y;m(xlE=Ia0sg{{aZY
z|F;Ir4DKFQ9>#zrfNux9*HtZy6!KdxFmwPuUi{F9XOPmw!Xyo~#Y`E8&Fbgf*X5el
zd-$->*-<fDKq*bKl(9`JSmfywp4Kmpe>ZMjCI9|u8l4Jc`D;Kg`-TnMA(|;T3#BVP
zSi^I#OAnd4!VoFk8`50uo7*}3?Tvw6Jn;|!SSQ@6-`t;oc9r*?<Xox=i^p<wf&o)A
z2N2J=VvMAhjw5&w$>Ykhjyb{bC~R2p!o;y5kJr-7IFEG_!ApDHUk|5n*JK2LoZiIp
z!j>W?b8BMHHqH_IRyF*v>2Q13_&n>+12|W6w@jS#qp9H<h2{T;h$ax#8rt6=kgpg%
z@Eaa(u4j)ngKu7p8|B{X+wq@hl~U#y%#Y^c{ijX2iqdgCiI`U5{Qjry^iJW^xSgH^
zJo;M@SPR)7JZc<s%XVU0fD61Kh;r#mit6sTV(j6GmyBLm^{ZvP);DnZL^jjB<^=U8
zc=+$}mhn(;k?VuPUgN{y<tn3!-4Z8T)MPjCWy1o%1LpXI3?MNrqL==gQSqN%FAecC
zU;qh<B{N%oV*FI@t0JDAydfv1eesWQq~7{flqs~i6so~1<3H-;gsRhioYCx1o!vuT
z_jrhUY#lzQ^ub6XzcEo5wsQboiP&3O-}{4iE0(Fr;EMG(7u`l$pTdVLh{xxt6#Fcy
z@TX{Fgq$SBD;dPZ1%zz)HwYOFXq4FUf82sCJ7g89SopI+F_~<+`BAgqa<-4%*vz%&
z27kULTk;=4{lxJUxEwW2(qZqJE9gw|3>9@E$zn{WlffORzliTye4=Ru_f<Df?~u*W
zU5`ZJh<^C8WPPI3-9LchE-mYXyVxDgQu(p&9&9n_A<f1gu8~%d=;(T*End#y?GoQW
zOqfxs-)6z1l*XgSyTWM_*jPSf^ePLUX4K~q>GLW%f$}z3_}SB5kR_lt_P_GO^k?`#
z=`Q%Zitk9ST0KqcldqMW4>S~0r<<U9G5AK{#3x&mS5Q5S05xw1QSqm(o(qf~*^QN)
zcCHtHb=I*(w8B?&6cosedxK!d(R57Pc+S;{$V${0!GVOjVlXPDTo7XD=$~2q^|Xg?
zz>DPUVL!D*><q(wBE1_OMr2PJ$efm-lVdB9kzevK&qG-PuSi}0<&Lj&Tm3;w-p|ao
z&DKxAvw4cYrj+<2KD4*Ar%D8{pUEx4DT(hXsyJ`I{3|8>A2UQ>*ndz?t&vCASX^YL
zgQAzu=xgP(Q(e$ga_F$+Grw*;R?>pIc3doZ+7mL19FxQ;D8<JgAC=&WPF`&{UoPK<
zeo_haz8=zFb=*}Ss5^4DMDR&HFXF3M|D<b9YOraH;lstMhKB09pH<&Wx7_;R9leLV
ziS^PKm`Q&1U291qq8p<>uB`_u(3cr)_456*=#qL9zQoa{Jt~&?QuF&GZoGkS{^oF{
zq(N^ke@3<XeLgpIwhL1Kvuepp-J_%;1bpNv65rSMr~lli@q307O*3!&(s~$rV!m`)
zFYByh6l=#v1EaqJumPjjS?jfwm+P=W{CTlT^Pb8b2^HWQZRx!_EOHR_mRd6m>-{83
z{%3@KU*2@^$Hd-)mHiAf+xPOD22HmkMGiu!jcj}JaxcdU&bzlYP!hwwY)=TPmJV>;
zkqyQZJE1)yWz{Jj%Bj6<)xuKw6||Nv?Z0OdviN0JBI05qYgR(cFGEn8lP0BT&l*7P
z7e{N*?GDDezXxwPx;UUm1=2CXC+nPhb&hfi!&QXH)(w7Y;Za{kej5w7MT|k~R;7&o
zTH#8+iE3)W3<$+i=)}mDk&qdROS#9zr|YanCd}O}A(Qf0mXvN5q%j}sJ*Wucn2~*}
zD&{{~%=AN_zRb#a`q(57gH5Zi^ES}Vy*lr|i<XhT+dQlamo~!$<z`v21^QmLgZO|o
zeTnf&mn(ys20uioT8?2f81A_7klKrShd)v!Cw9Ois5kl`gS8N>h>IDtG`q<@F`ydA
z`vK<T5~uJ`Dre02ac^`v7Fk3=LTK1=ni+H3LkhS{%P?BL%Q|_F0GeQRXZDVmBjrAE
z6CzW`Qpmy906NP=)|0G9^M)?regtjF(L3tSs=8BinG92r^XeQt(HhraDcVgRLX?%X
zK<P4~aUEDiH!lw_nf9<$6-WXHs_AX3M(^~43(m*cZ{mH+vr2K`9=kQ@u(H4AO;Y<_
zgh|K9H$fuSrr^2k(l*K#?EvxA8DBuUh|umZNY{Ic7?+gMQ#66)Whz)&(|wG+w)gz7
zi^$-!>ZeN$ozz{r!~6(K6+$_xr53`<JM|}sYr|T9!3kr93>S&)$+J&{bLGFq3LCH&
zMa?A{&_@W0*=zJ~@|R&As%`WTMoABw^lf?*-hYg#s?qG*IMB7H_g)0Y5>@ZF;;-=a
zH)?kRn9-1wv8zibNxA|?(r|*mN@Gl|7<3O_eXJeF4Dg)fE8pHe?XUEf8Rp{8ig5Y<
zeXkYeFaUi3g&0NOr(q4#i+ETnnlxNDJLC76?MMPylNVh-lkh{9AxIA>C*X!K(hwC5
zd1X*HOHK~N3R&t<2k5Nkupq6&B5_!t0~9Tv8J#yXXQSHC6USb?B9a13lx%??fpgWl
z5l8F4LAyALbRl|bV3vrWSU!TV#82eSyP->0q9ck^@S^Vnm-BwE&bM(UKJjcW7V2n^
z@bTkGQ?`<CEqoD1&><K5M!S`-k0^dNw(L@lgVp-0DQUDoho5GDrI+cu4{?zAh^X}3
z5qYSgRhr+I24zy!Xi>%$<Qv0TI?mRoZ-rPY;cDQ5{=m@Gjg6cPqkYe$xPEXn2;aXW
zzBX_`D$&s>a5svGmH9+d?A=O*c*wI?z8q8`jUhLG53&y!%gtJl04A)E!Hra7-0re>
zE~2SOpKD2>l&3xZ!Lp}0G2}FcisFg<^nT82pE?!4GK@4Rj@IMr$Wav#Lexqgv<m_y
z;_<~h$ny197nPev|He8uzA}G#bwTJG8A3*@Z=*=pN$$2)3t?&cppBDBSzukmO)@w4
zc(Gg==EaIBVr-&<v91E3;4UGeh8$vI?>qUcACpUJ8@bZY=eXUHPwYJ|r%ZX~Y|>XE
zFdSW!dzCC(2s(?wdD|v;DhW!D`%i91`RPnF#m=0ME-SiOF2ok6A@XX$5?fEKKZVQS
zbDvrgi9VN6*)**|23VN02L(^gR+T6W=0MjT30z|hGf+U8Qqk(I*V$jobd$)Dh_cCl
z=A|@;DL3y^66+JIynkPfeSImf7aQN8qE(@f32dJ5%=%3Cp>^i7+X=Z+O~LR6Z^I=C
zBb49{w@-3mSS}~gW(Z8a-3K8mJHS(GwqY9S!9D9u!I?5<+e^ET=z!?!4Eo}G2a|fN
zD`e0KK_;t+>v0cFua8a&sQ!X#`NOR48I53z)>r8#OA_=}RDY}Af82YRjX?b1yid{G
zBoBhZtvGWW6)bZJvdADUVozr(g7{P)DU?5+^oI^sjnXXASo}IqVXXm6XV$@AH(%H?
z&oLGqE9|rjQys<^{`lN(&B+VgnD;#Qj2t<0+7<DSzb%6P@MR9%5`rt5DtoL37*IJM
zd!F0LNh}N<+1Y#Ho^jn_p{fTx20wV4J$M8EH)yQAZBlk}?}{nloH-Pq{X28I|IK|9
z%8EbkVssUfZ%K;qi3r|}@VzS0s5Yqj0<5)StxN{aSTj7tYV3~Ut`2S%R+db<J6a21
zl#`xMbLXRL&^@fU2U8fakTRnka=D&UjPF;Rz}ATu@NlNZ<eFEHTJoptfja9vTA0U8
z^6N1uMRM1-bTQGu45vn04&U!6qJlsHN&t3aO+&*ht-<CfD%7$lSni(Ip>7W?y;!cD
zT8U6M9zhLOd|Pw|Udv6YhlS1D`M~tq!M&rTI(kw#^}BdS3%%l9v-z-m6*g)jdWUYr
zE(CY|$EhB!4_VODv~}IZ1auP^YrrU_B@ma*=t3YtM@;6?e5aeQBU)NBd8o-A2hPVQ
z!KNdbm~fn4y~wL)`m;=djLgWJ=FwIahg$btnBON84pUvdGbuC})D$e+BaY}0=^3Pb
zaG`Ky9yvP|-}wqRX#cG{#wzzH*eR2Rq<~ip4_GextG|%*V@u|aD~V>3an0}HE+N_x
z77hVQsfaQc6`3PeCeg1SJ_H8(S8SKm-Z&H4PSz3awssUvbFY%$DRa*ntu`}y>)Pz1
zxBpTU9qqwYSdNXIU5gLanST-OmK|w8TO4}hZGQK?3Jy0p8yTW>CBCPG)nO=I`g0#x
zW{c;-+8A!)Y-^O>0p`kWez>wSwR8+7xCT#0{;?$ZuWVE9E!A>kzmd~nDRIE|SSjf`
z&wgadZEH`yRF$<Xa=a%4W+Co}-*(92kKXK9`Iw~>jHV6DBa8{AIvm-@Rt!=JCX;mH
z!x2N!69Kzf{-5`jtgDc*A-{lh0Rl1;|H>D|@$l{(1&Rr7D}g($>P^<#_htSu8A72L
zjO%;&tCIfe_k)ha;_S+0Lyj~W#0o-jX318d7oEamrq}q;894s_X_q-#8(WwA+;Gst
zRw!<QY3pgK<gRwp#<$}(dSLyBt{K&o2j(fSFV{34o<>Y%>UY0Tt{mbzJ>lLPIl)&~
zf0kZLk0*i;;Q0C2H~%=t{TH{1dSDdD*>G$DfCFb~JtB{GJ7zi#4;1<qb><I=MeLO6
z(Y-?pOmt@uSfIomthZcVYmGm7(P;kpj=kyg9ZPY)cf?rqt7&q|r*k2fm%X@3nkO{+
zX-3EbSRVj0FI78^a&;Ez>XW9LZB2EI>OzIJDNkfQI706Ou*LCU!GHrxu`Su+HinG?
z(QV{nqO%Nd)nq4+UiDjYZECYpOYwD42wxW>5Msz0LL6s-m2{4WEp}>q>oA#-VVkLu
z`=$#*_Up6XKebn)izZ@gzHjjr9KUS!D=QBC`EIr{DH|79$qAtTYc6!M04HL9p0|yQ
zqI;Z^8gEINQVtlCt262^<yLLG9Mq3v0dn<gXDYDzu2+Z3TAT<PbtaQ3GfRvm9ZqrN
zoX6?35OBDDeJs#dI&DG#Ju&>-vddMuX^KhTg{dJ=clky@4+SDWfPn>#`r*h<H-hXD
z`rJLg^B$j781<sMx?tc@E|lS!QAtrzP)ekXkXjJFu`&BEym#mx<n?ST(4jeXZ4UM2
zuIYx6Ou_a<p*JBZOvpVvEjfz)=fSlP;mMk5QN6)Mt0*UN(dvK$FS%p-QopK)4bE6D
z)LCVZ0`|=`9sIMzE$?UAK?`TOXdRz1yCcm4hJhE2yLK)#^A9dnk@-V>t6bG$G6bEv
zR_dfVct^qT(!TSrjHrLy$K!aW2AlQ=&vc4v`J8n}I^<0j^G0=7boUGQ(3kPG=w8RY
zrN$m?=ouV@S<mcBI@-D?>IoiIkCOkmguC_pFJz1xAY+q|KX~^lk!-<wT){T$fAGYS
zFM)p0Ap#cUe<^I&-F(jDBHq|%n)7AfDYgYB_Hhmw+DK!G+DnLfFM<&RMC1v&nZfFQ
z$jhC|S;RYJ6=4*iN;k~1?X+How3M-ksYNs^<o5V7(-nsd8ulHFN#n$2o8A?HWbuY~
zo&ygrL3@bUG;1)Ju~A(~BQx5DE9H-D69YLCNjN@?;PF6)k!AIuXIUC9JbsP)oV{}%
zyLv3Mhn%nBa|5E<zn1FzH{tDXdgs5p{RjQ`HF)|$<O3GhC0lyikDZ-1nMvVt;&>U5
zrFcyD?rOuK3HFDx5k!*TjdByM`tdOh5z(?K!J;xfvQDGMu;;Q%@Lq$Y-XL_vLO(Hb
zP9e`Mr?OG#b$Dx^A0DhR=G)<0;ao`^6Zt8#8}>7Ba)E)?vUaSx)`m)`zU&1Opy-ii
z!cZtya%Om#wXZ%VBhEBuM*2;JGM}+J*OS(l_D`7l1kWUx4xb$CkmHCofpMr04Cl}1
zq2eBrV9*YM7Rd)^6)rXP60F-yens3wF6GUNkG1;mySrzZNiz!HnD)kj7C@J3-fe|2
z75WrsxNiqESY~0CN2nf)_31X|Hryp>Z>MRc!SI<9oB)2|a|5oGvHC8swS#cOofFs$
zc!1>-p}ruub!yJMY9hC8VXgJHy=u~d1T?H-hAEB^9n;rs7ihbk7n_|e{uJeoy?c7s
zs~1+N;g{(WG9&0Sr8&U=nOE6nK<cvb%Y@EXKeU}oRj#SG(J&U`pA#b+X8z#4BZuDr
znsyNqd(O0tMUE1n8(~;ZI1UEyxQ|L+)gjArPgoP^F-bQYkh8SC?2TyRfAp&F!*YA=
zM{$J6dst=<)&sWwVQrS_><$X(+DZTQk|+Mxy)trYrhmio=J%5MdQiGap(G)xMrv-c
z;RUbVFL`DiD}w)03I7bgB}Te~sK3J~j<wIO%Uu?U-u$>a9-c--lATN_quRiV*Y3hh
zyRo+8j=P%R>d0NYMK>x3;lFdT%5SRNo~qzD{$wLI2_}D@@c*uDM^8K)4C?<xv_Q0x
zl#0J2(xYbRBYXG!G2GgNVW&9Oenx@VV$Q<6><qGi8q-vMKXq^KeC8I(IV2s+v5LFq
z6H#{T%8<1@etUaIW)X3F``AZ;$#GnF%>3nT50T%ql?sit49yWXJte$fK{b+l*0<QG
zu)_N5ulrSeo5KT|MVM*6-_z(Qn)a_Hl56*_zFnEHav}9OD|cA4C7^fHEWRl8X5-zu
z{N4d|4_!#JAMmmL+LxmZZ6}dWCmtPQmjfMhmZTK*89_@<F{qN9h36II8^WY(AB~8h
zvtG=-p!`d`(J7PSHtd}%m8DAv^B_a0oHP?-b!fiP2Sb8mO^6I9o8G+n@|j;y!m8Qz
zU_+n#^T9EH)(5(u&CNehST9R1C!@>FE#8>2x&fkaNS~P^6Z_W746C%>nq{4dcw<eb
z2p2%$^V976bx2nv7^3@QXSQy%r7GpMkA8|i6bK&B&O3hZXsZ`@Km$+MN^hW1?%cL~
ztnyd+Gq~4Hv&0nBRGeoad?l|Hd_>UjEkac6_4k67R0!n75Ep;P2mVLTmZB%KDW$q7
zdg^D>KF1ei<SjEk+|HG&&S&D8|6uU8eYG?B&1apX4LWU*gya3rN?fzbPJ(0mw<Wq*
z!F&9AbC3yDd-u-<e2@Y&SS(aUp%*U~tF82wJ^F}L0!OMcWc2Lnn^x3MjG&64m?iMH
zxe<N2KX6~YZ8wClsIgyVh<;S#%>xNJ3rEmuGW|6;XphPjR|IR;w>L$R)ggIR#e<fO
zVWI5}VR}^ll^pcYh3H+k4_dvs0}Eke-;GuQ#K0@|c-9Ow#VcWpSm|=B48yDz$7m4(
zh~aCJ^cdV%XTyVc*7eav+Lwc6Z`@EZO9;l#7ye!QRCrx=hw5``zcF7UxVl=AR7bQ9
z^|P03M9{r_GQdz`$t=Qyq6NF;^8e`UyVMIBR6*4WLyd*qKSk)sq%YI%(-xKQUj9C>
zdayx8szR|F!b4UxgYn!y@mPZvye2E!h$jESStRu2(dBC2-#JoEd(XG(3}*~3Sb~S?
zD|;&ig{lvmUHHd<6KizX<@*N8et4hGQimdJZ_e9*J=08+_W2?W{#e|#+;Zr*Ib&Dq
z@oKeuU8Et#y^bLE>h_&WPlPG$!D9MAi^LAUA`eCQyE?AkmY*#bGA0HC#;a!p0&EOY
zcIv4s)uwUPL=3b$AWJJ~6{FuAB@EWn%90v|isqgyj`QE!7OP^k`=*C1e=tbnnkz*$
z`Y%4Sig!s~ZnQl}5nG)5t<umD7uQm`g84}sRNiruXgD7vRFH$but+>2djDNT@RyhW
zd84se8M-NAoMN5vB)_qCsmN|9b)|}2m)PHzh5qaK@$N~x`!&opG_{yUuwPDB@;K4u
z2=*{cm2)HQmFf(F8>OLSq%J`VpN1(4A7A?A3}lwX@WJgJE$x{!z#;r{=#rmODY?~H
z3)q-Wm!yV=NSd<Zm$|}1TL!iXh{r3=@{~0WZvIE2#8@b?W269)O&eoGo65Hgg&&NQ
zR5yXC>t5O3&)$yPzBJPPKQ-UXAa99(`Zzp|+Zsf_nYAWPIiU+M8e?7xKA1z_P_%sD
zYs4{^E{-UE9Heg8kn=giCj-0-_d$m>MW-IS>2L{EgNK=Bf;xI#^lQ6I-umpm9!kS}
z#E7KtJ(4R1QJ!y1a<%8*1dx%wp^^VuFtWd-6vq|M@5Ne|!)=`Z!|46bkm0H{P+$72
z>SGu>`)ZJO7sTq6^{3qZFcwE{o`7(Ne#;PJ%OWc(l9#t#l!@|b>>-y>oq`52P66Dc
zJ;_N3*xz!a>{Ij#`M6t^39FD72U7tD`@o#TX($b#lm~N*>xl3O6Cz`Gmr8nGp2N`b
z<8>pORT~-kePv>o>}IKmmAPN{%Sd&lO8ZlJJFmT%r){0^E)!~UBackB96TO}>U=kk
zj+dFhjF~$%Q4?wc>)?jFbi91U!;&M#a8jqZ+dI$ra)QQQ2jfG>S4A9)vn*7ekj>Pg
zBuED$e(Y0bNKz_9!*0&#NTY01x*7SL$P%k6lm;!KF+56SGR)`zgb4kKe#2d&jvm6q
zekcI3<`w9S+;be%latHB7GLk=Cvh8z2bX}fKX)fVCxr;HP)H9?>j)9z`U$z>;D%#>
zUh0KlgPcWPFSI~waM-xkrYGo3t_KG?5w2nS$cbH&>+8GMcSfQQ9<me<a&A9yd~<+`
z9^n)0yk3fu+^+FgEW6`u!n}PgvvFo)>p5R%2Tos|8GXh9Tr-)yM&xYQ&(PQeYY~rk
z{rAIcYOIRrf#+8WHS(g)k<7)x{H)<TA;;3Pn$t8)my*mnM~)!<d{yJv)A;!7x@)Cm
z)H5<l!|`*N_k~SKeFHarqVB(wR(8bibs0>M<$nDmiuZqb8y^(HHYltGVrLY&XF2_;
zDz>H55E-F0t{Ww;n!M+<f^4Up?n70Lf=)a7x<cVJ5&AT)B-wmd4_OKhHfVbq-53*Q
z&ZV4nR-Jao<i%CqJ(x;B-8+wi#&k)}1Vsj92{<YfD@ypeh~N8-<U|S`GBsCed+ia%
zYl(WKWS&MNU0bU#Q?qb?&^H<I+}odV#I|HpK}_T(I52%%fS)dIf~jGF<^Xd0xmk$^
z12%x@2)ay%J1KevrgG>WrfuC3r!yt25$tH+9ZVprt!`fwXg0y_*GfDDvGHJc1PDl|
z{sma@eDpWR_|knqQ&a9aH=bt2`!n*CU>OqS+fp0zCb7}8d{2W1g#9~tmX9tQmEZ6d
z`zYn6*#u*10_=0Rd2ij}hQ{u5us%aal~=_t`1246^>8l#I%-nKDokJVxH1!|Xn-tn
z`K%d%Dnb;r#qC;Y5u7)kei5Rkscl2SFIV}%auht1*3PC5x0FSlOc;=p3ZtCmCr-yW
znG_w&m=>nN$mCX?wN(JU?XT<UUwATq+29f2sqMcqP;eex2bIUrf4h$7alB)QV}nyv
zQ@QkPwwx!~Cw3w$p+Z-`FeQh56vq|qGq}iXup8M5)+;J&<>^gg-4OaZ1n21dA8dwy
z@H_}n%J-2QJOLQZ5ZvW5q-qpxjl-0s*M_olVy4;A@JXysaf<2KbVbm;z>{Qu8s&NO
z3D+F{_3q?)e-7bP|4H^Z=bJ5HDQ5USlTeOrA5Vo~sV7)dkddRJSK_*v3ZLR^TjhjQ
z?@U6!rL1eW%miO3t7`AO|H&l`X0jav5tSXLW|j)(f90e0$_LL0&jzwI_0d*gP7%=v
zr#raJ?BWa0GrK-V$a%lZKLKyI+T%m=n|)Sq_;Ym5j~e47AGir}M;y1ox+~06eXv?x
z;pT99bnNp#rqO|0rWT1!MTwbhrz(T8v3fXyf4$r*CFVQcK^+&FC{RK6di;^VP6PTQ
z!70eYJDLR^FGtBF2E^DO#%M@n&v_VPs`M(Rd~_Iw(Akb>Wl^2;ji>oRO5IcJX-kI7
z<~SYXbis{dWKrt(3#O(X<L;#?h&YFwM4}dsaKy^wQKxDy=E}!w(`yvifb%Cv`Q6}x
zeK_uF8vq2@%~wD=T%~3@_mY`0AOUpNb_sA-vjqO&jaoPHGUj2Mk9I}8;?M2jsD0pR
zaZPKo{z3rAjhL4O-W!<V1Qu;GC&S1xaBBzgp7(kg!zPHTAr|7-)T7g`WU-`3QI{#a
zbFFF2^22dphsi&>i3OI6hx#8iqHl)t5;{M9OYPv=I(~ljX;_?;C!MwRm6S@2$h>Tx
z`phq1E@fs0Ucs}$qsKR}-j1I+#v*5s`Kyo5EA$5!5EB~PyJ)Hc`@20ynw!7oKKy(a
zy}!EN32DLvv2V)kcpB}k%!dUt#thp};25F~E<B!lN}(6x+Q0cj0IIlV3a&|5eL+8q
z-l{1dRJNnbleO}G$4AJk9hw!odXmo8loJ(1{zjV84A+0R!oFm4Q!hW9jlYI4p#4hc
zs0#@&aChy?C%~FO>&`BrlXsZvdakWfP%KHki_Blza*cd9R_%EtZEuiVb#@Ec!TtyD
zD<=$KHk^<e=rKq&IXJn%Z2s!=!y#<se>Kkarwsk;g2(irZ30`|d$ovZBx4ccbb?(0
zt2wjsLZ>BolQj6?v{#FH${p7C_82*>r>Q|qvZfv+iaD+BaKb65avZoa&%eSxyj=}N
zi^=TNynIIVh3%9ql>T)~@@SsgYjVg^E3GusGa=}{x{2wDqOW)IsA;s?Gh$8&>S<rz
zK107}>1TL3wAo(w)H9bTjq>%w`?yQB-1I`_w$SKw&}*~V;vZF=|BY?rpWeSq7^t5$
zh(=eKF_T{#ZKPp>fsHT@I825ZR9_4n<Or<E4CR0<yc711F7N2VWs_BMvqe8%BYY40
zKzk~B`0~6I_XyXThloag;N(BoeSvOQfaWIA2WHsPZfF~t#!}PU)P{quzl$}-m1aQ7
z)5B7suphTHwp#)mL&&xDDnv$E8f@uxgPoE}Ckma2gc#Pof-fQ#4=&K3Aq+S&rlB?1
zmqg%8a|bpH^OxWPLtPL1bxt_k)1;A#+tIEswY8yUJMmDR8t)zO{SQp#$8XH+xF5>)
zJJyh6X*(2$3ahN7N)evY!ZdG7)iG?+{<33X@7tBgh$Oqb@{kQ-5>&`O*<s{1?bI1)
zkn&$oy#!*43|O(TbC%Y#<N;|^BHcBP_Z9~I6K=OXY`dQHKIs?3d&+~B^%5Y_T*3~V
zK5&6)ZL@#m<nPjy8RDWn6e^-lwzqUz&MOQnRFRf7k{S;Ri@0prVRE2~qxajc!1+rT
zfN$er@C=hV6Q-DPKEEAg0-&iJ;NyJ{i{qxm#%S-LK$td-OE9v?9J8^|bUr^qyr`!y
z+ux3*C+%*W*0_R{iQk@A_L<sOfySQ^g12%VHq#nUT(g{vfMH3kakuf$X8PcLOaFX=
z5Ud@0{np7t+8!JMKrMXmkU|cc`>ucR$ev^M|KLfng6N@I1adnAyqoDSQ`h<(fFGlL
zFzgcXgOU;znN-^*JTqh+#jBP&Yerc$A4@xC^0!i@J$opO|4z*Zrb`lxUfuEJk8reS
z{P_aWMg@iaa;(;Ii?c7Rqcw5t7Wm6}cqG>k<^SRi|5=B7NPa0Ydg1}WUew_Pl54OF
zZGq5-try%jc!*Uq@k4sjaj!%#!Yo^Vj<(NxRLk#;L48iiu$9tm+rit!A5T5MArID;
zYZhtvy-d`l7K0zJdOqg28|yawX8CT8atf>2h`Ri-eS4k}KL>RiYs95CsgwJTJ`~b6
zVN?>DG1I%FXLc$ZS0p=FKU6+)a{sU!RKIy;2_R%evu=l=2&#7nuTZ*z`<hF9=Tjp$
zuQ#>O$tkU|RgFbqyo(y>PD~1?^4nrY>P(Nm@oi2B;4`cU>Zk6C`5%$eX_pMW){t%p
zPOL=gZ!drZ4w1m75&w?ggSmyHmm@dc1IpOEFA&WqR>{TZVz#SbxGZ`~%{{~WqRLJ4
z%NmB{L~Xs6g3cMG)mwDxsdA;`?F)OIlEWMD+TPAz-u<N+U3GE8+{DT^$y_!)Mnfw<
zgz2L|4>*BX5Qg)!c|ttXx8_$*%8M~oUPr>Ry04#mpv!HUVG`;}F0S!X<C11sI&Xe=
zFi)cc5je(p`S1CGjjlOc*IWWxZ4F(f9!^sj#JHMRX6RDS<9m~l+CCI{aU$IB%M~%R
z!-$^-K<Tg9eT<J=QC58iG5W?M_ItqQA%|L~Ftd+RKkwVZ6!1?dfl9abv=~8uIYebi
zuTLzSi^IkBlp}`m!$t55srx$~8Mf=YhccJ5NI*k-0A?cYV5-uWmRgw646`U=ikP)~
z$DdzvJU|Z*i0qME3P1d&r1=EB)W3OC4>u3;Zj53#ij%AtpG!i>5R0=Z5*kc`9*4PE
z4bl7M>a8*sjU%(URafqHQIMc`=A#P223*qWD@qJT$?YJWG&Iyn9@&r;QP=6}_i{H$
zatvHS#QCO1Wr2YVJ7pvj#o;@LMQx)$c&;znx6}M|`kHdaJd&q1GkYkDldRN%Rs<K?
zFdf-y&qsqVU5Xe`V;?>ye`bbGLAu=+A_3$qVM5d_IjM50?7%bP=i}(dM$Y2j5>0i@
zR9jI=M!}P~k)$_$EtGR{Y}=iY6#Uz$&7Kqy>VVUHk_OI0WM#4&)n^Y$!W6t<>BfMT
z;X=n8+9|d7S>zy5dRsv^!y<*^StDOu#D)R=&TWxz#PnT$GSuR0f8`h}b=L3%nYwdS
z#68Vi(WF(|pl?{{A<P<q>zNJs&A>R_n+uXaOwghLUWuUrL#7#6?30ot5d)LO%WS}*
za5H^~WYhym<CX+)Z}s;ivrjR(2wEthGTK<qfGxvYYpN&hMZuF1kn=J13(*S#hlstl
zZ4i+lai%i_evzRpeBY%x<F5pBRqnQtp;!t%;5AaA<JBxg(29ct^|k)r3+@Q8j(r>9
zrMK;_sm_s^Y~kuMPXBvv>BAPSRSIF!rH*Tt=fbpgz~ee$2$1_s^k7*}p$lX&EdfLJ
z%bKNTCxNtq#E%r)K;Df_gdoVf(R<Fz1C*H_=V8G+f`pTfnA_V3`zPqd{xo%`PU$M;
zMiCO)oU*&N%mC-H&Nc=q=dQkZLS2r}5~Bxqc(u%cI6@kdux>pAZVKW{S94VxCuxGu
zX&1-ezUp#4`dqZKU)HEJ8W?x5aTxV-vOd4j8FGF8Cxc*Th&A~aUk-WzpH#aTl|&?c
zvowN^xo9?qYqu6hDSi_pL95RqN&hl-{E{u2>#sfB<yVX_5=T@Csr#J7QR>*&4GkDB
zGe{~G4qIOT$<V-z_FJQcc1H;NeJgyujYtEF>vu(t1r?&9+oWzr8xgrEQ}x=rp9#zE
zs;Es?FcvNkG&Mwv#!HOq>y38b_sR1=tRZ*tXHdCISIowc)qb#X-IL?38WT78TlViF
zM14x%M>IKVB+;})vxj&$sWqrAM7H$0<wjU%)b_~>uOk|Yf@nQCrjy7+<4E0lK37WK
zNx9X+`t}LLP`y9rK*8AmrQprFTv|sx#<Z${dPxd0QzlW?O3NxCNH01YtJ;{?9bo1#
z1$&F=0S5w}tOs*Po<W8!tPLz}OeAE8ycP`W((i*M-wZRR=c{g()frZALkYrwd1-jx
zY(MK`wuDl16?Z-Ep2A2|QQa8JPLJF2fhWh5dNFV5l`qq1PLbf40`YYv+BgpSo$(z~
za?N=8ayiNi6A{p?PW4p=#oqA%xs-6I(62DSo5CCTS;`U-11nSnM7$+B%Q=9Gd%nk`
zwbB=#pI#_3bsMXB1!d7f6n@1uK}H7SC8Kk~RgVMT1!SMVVR9jj)f93Oxf_Jk_8+uW
z8ih`?S32#QV3V)-JfO1)rZvXZ)=}vG8h#wl8Xuyj(C3?z<>FI@1r%%Al>8~I$vH{7
z7fKi4yF2g8BJCpF<pJ524WajV74@nD&O2N7?Ap>M_%he2vJk(Gg0U_<Ch<sKnOW$I
zFXXX#@2+-0q90PE2<JaCS>+!}3<c7L|9|kZe^CYhhrJWWOQ2A9VVnSZcONiL7#b3m
zScp6*D}fo8zgq1UkVPz;A1}=T@42QI2{wnRy_#}J1=4b{#tSfOJGu4AxJoZ=@@G0y
z1hG_!ybV@w&1RIU$ND&3SgrS5$a>T%4A)N^{5A8;WV_~!O;ChQMbdQ2s;Y2z?uWNf
zQ}(uR+pD93;Gwc@nL|q~<WyM8Jldo#o{XGq451>$i6PF)LP2Lp((N4|CBNo9O*X0W
zGC|h8L|RM*!0@3cd^04NnFVb)EDa_Oc4yHG9Ex~n)ehH_f*Py8Ax%RyUbFi?<uJ1D
zVU0O?5b(J~#5ayg@MEKJw;p<k-w%BhGP1!b7EwXvW!jX?<2(KqUiH&3(B9zP^z6nx
z!wmidnYAK5ZNra((Iz)rs2_E<;6IrUSAO#FU@xtyN*+}E;_en;DQA9QC^DqEicZse
z1fsQscnL7NUw83G?PM|b`a+K&IjWI|x+SBWQwJ5j?NtV{Qz&Htbu98W$c%O6ZswFC
zKV!x4Ms_s3EUo<-8$~tGxO+1nCdKgB8!kV@@L2J8U*VcQtHKA%?Da(1H-3batbvy5
z1ikqFRqDY_90ir?iG>RJfAAzw6&7j_?PT;PaS0$n_h#w;L`Ku#_Tx7NEe0l38_+_#
zMGD#*aB+c7AM#~{xqrH1QwC>mw4!z#_o)~{6@etI<i0m4)fJTY`-k$R_9OkAR*64&
z6@*oZ)gIV;049guI+NdiY<nJs65m%CwLH*@oVo2zNDg4~gr83zy}*oCpybSJ2<@lG
z91`OdB{nWqlFtoiA(1I&@avVZhXI;96LtAqHEzV0>9&kd9>KY*Hz8AyC2k+sj?Ebo
zbhj(O?I}OQ-1mtux7dh3XPI%o$zMBtP(MAiVEfXpvBMOx#+_e%?n%LZdou!hSi@Db
zu-fC%&!0s~EML&apZ@8N(~XwPyup6-@{}^uS4{h)T<yMEt*^>s0J!y#<ew+I|H|)>
zMwqE3?cOV_p?i)QBv!S4;AzfiyqpD7r**gZ+z!e*-HLOj;-iA@w_8$t-yE$ZAtX0E
zzvTX8yw{gSo0asUy-31E$ocU;squx57&}WUTmp2&3$u~RJF=Pt6l|xbHvVHgMbQ_J
zr#q~*ZdCq`qNaB+;7m#-l@ZJuCO5M>1D_E(y-o_u6JLusk4=kF+|JF~UOn!Zz_O~A
z58zu@9#&M2nMnlEy%&$H0TtnC6pRkXfA$F5GF`<zg9<LHxxR9Q!H+iO?|SAgH2=dY
zRe$|=`NuIEKG#}GmovT;9f#qzm6g7;-ronp)5$#(+?PE>u%6pJ3Q^CowllGh>&qP*
zn`ad)Ioj!{4UE+#S=p}ocdM%_-2936_&p>a)w+dcqiQ1mQgd5^+-2$|_UmkrYLn)$
z&Tb3INzOVtzlB1laqQ-z2}eb~Q!t+#=ma|_z!K+TnGn7>E9L*-TSdi<%*-UVa2GtX
z)M^{7{pG1U9=3wbLF&||Zq_k|GvC>$J6*?Yz105T-EOp0`oui%0EIOLJv*9Z^2?F9
zjI}fNhm;O)HEO>4NoOf2rt8aauMGBp;n}-TwdfNf<$?9WEMiY?MIXx?PS(GTx2HvF
zWVQGo48Wt(I00D#J(4+F_=A^x^3(dLi1W}8TZ3haPp|`K2>J_2@;^H4{#)C}d(+Bi
zawr_L%T1hW0@ioYRP{8n+&`z26@-46pO961{Qir)iW;(%X(I}#gjqYsZ|SWJP|Kct
zNhYj%K~yDQ1cRWoiv9_^O6TIr$+;ot$norx&y|q}Y}<s&_NwR~h8M=BCm^Gzz6M*0
zydfsH6ONoT>$}s(&*HUGSd82c@LBg*$;V$Sl7;qqIPY+!rMk#7UBj9kVgs5riIYbR
zv%QcfE8W7xw{^dl82ax|U3Wpe*mm|U>>)N?$?s7p37&+h+<0B!RzM#q-gdvr9A4HS
ze4epfQ(uA<G};XpzPB~>YK6he6V|gS0<P5m4^+s-0RGeW53-5?wrQ>ztG|tELf&L8
zp|W#vS1hZP^{cOF{FM3A{^Lkbk(;8&%qcKjw4u(F{^0$lT*7^L!qm<k1hax;vRWjV
zD|X0IcBs?}-J^`P9xVzSZf6Kzqqm*D!jJ_t65pcpROE6hVhT&gjz#xSo+JTzW$gF4
zpH)jB(_yM5&l+SQ2ntOzDmdjDSp0r`)p+83>pO|X))OY$KX?r~xB=L{Ds=0N^y``F
zKOc>AXP3$65Ezlpbjj;XT*Ypc>;^q5GsK0&2}B+HFNr$a2O8Hrt(pEwi(G%~oZwQe
zj0q|%n8jxyh7QMuk7!#QcT(SdQ31SG)YM~>?<H9N=>z~nAw`_N03q5h&^6lv$~(El
zbM$bsX>7)9y4NkSa2F_)?n826N&ubWQpW<$j`v8xW2AZ09-a!{R@x9fyi|@w%(fxT
zjt1zOrVx%&!|%da^#$7%eFxqUbn&^y_~Z6AH)h{UT>tORi(<!qjJp}oQq2}pOa3U1
zT2X%6Oc8c6{F_2>G++rEsB6Ea=Y!`-{?G3>2}g@Q`~f7YA1LIsMf@CG4CH%(!pVQS
ztmX(L=IAi4D3*&E8=IRAD(qfkck39NtL*?Bk_*QIrT_6<JVtfea^nwPqu-saMn>uy
z5s#A01kyo8+BS;TB!W)7h_`s%_^XOu0q9xO+0Dl|*_IIGx*$33tN(fC-<gn_STmT#
z6!rnK5#)=h&QjHJzjqe#%7OVF=o?vXuoVvcdiVQxmB8u?v^4bXuV2D%TZCJ5aQ=wn
z;q&*%g$MDpu&EtuTpY_Ua@oP^hsZiJkDJ7+<>(I<2LbN3i~KgaW>MMgm7%Nyn_`O+
z?ShO$Yc=_rXOsdk|EU}6xNBg7N2Poj+kAq|)72aEGc1h677rCgPI~r_$#(7LF4=VL
z#-`Dne?l#W;I3~ZtkBAASWYXd*8Xm?p6$|9$d6lU#W&DR-(vIc*B01)clVN&*oG7X
z-Y@bMJAaA7m-rxF*es|2L(&{_?6IW6l&@gPc1yX-w_R~U2oQ&Ccd`u#uwjUd31O{N
zLVA;mY0V8-Bb)?-&8m0v{c2b7sV`Irz_#0vCR$FQaf!XMH*xX3W|_+6op#+0vSQbq
zsbXWYP^tP%%~n2t6)9P+51jMySJqt~@)4eq+DbsSr(H0cU0znn*N;JWWp!*5Vvd_c
zDq+<b&-~6WjszI*tM`!gX8|mhR!=GChE<bPznyw;>bP`@m>$QHgz<97%NMOm+}V-&
zekFG8qK2!`WI*k}?P)4vU#R&rJA`7hdstQfXI>VAvly*ihELYK=Uqp{m9zW8YJ9)f
z47foIgknl}f8wTJR@QcjzlIdR_UE^+L8tV_bf?C?U#Kt;AElQOaV-@pL66jglgjpr
zBK8mY{BlMDolvIRM}EwMvs&{)-<(iFJ4Bz^2kx8QRq0!TcIl3HAo#|gG+mEF<fjO=
zi!k1!J>V%4Hp$yJI`^qgA^@K7t7`^#QOlaNFXl5BS^KLf8sZ-Kp74@%Qnt_^<)$9C
zlRhK3{fp;KU9O0#ja%G;2UP5@^MB-Rwb&RlK+SO9^b6IV6zmkDY+kFTFCDmNhBrY2
z?P_`yDt|BN_tV_Pq*taM3)cr4)bjRyHhiiREM9*n)L1cK2c{6fF5G#kLotA<qNtx_
z33>TRw{zs1reeBQL%MF^t#r}PI<sjSY7=oSedvaPrhz5hxN9J0!7Pf!i0zj+WW2CS
zWlE!nB>9#MOQoh>AD2T+B+>V=6shFZy%qbcETe1lPPx(F)X@COR3P*h2$dHmD8EXM
ze2Bp)7hTqaEdx~+ek;S!8&6S*{5cw9>P5F2?LmGm(`^?uy)1og5<wLR2jwyRQE;c1
zUJ4W9`MihltZ-pjQ)Ny$#W=cPY+QG;mXU>q?kg7E)pI+PH`oZ%p%3>xli`Ya;A{AO
zY#4P@8n?^SVJ}FuzRF<jcgFEm+R9>pM3|*AcFy!2uR>_UJ}QNCleOZ5QAoraJ$8SO
zM<oxe)_s|>$aQ+azepJaqp15;Ijj`*)$H!Zx{%@V&znVV$zi~VCXL_M<T1u(P4LY+
zA{3qEqS-_!UhHfkuzxwaQi`dF;!z2c$@=OK#(NiGu0fpTivqv`*N)NeFyZK;V5r@L
zOLyF+8eU)`3x>1;$CPU}8zSJ<_Z~LYgfBG}ERP>mgd1SOCa~^}JfK^Z3ePRnnvO_w
zkY#4A$`e6=_U@wyiz>pKjiPT!a=J5pu2i(nX#U;#tR1G~zpn@9SE?kGfF`Z4#;Im4
zqiGfE<ZgdE$i#RaG{=hc5YRvDhD<psasdv-bo^4I4Whv@mT^h;XI5Z>80}<`BecCo
zkm-HIHTwp`5eHHy1{M6s^XXNN#T=ks6|aYLca5O`FZSL8s>y9z8;&BPQi2H5jY<~~
zL=jLR3er_X1*Aqmq=|?~4+&D0Dj=XBpj43(kX}Pa1?doql+ZhgKnNtnZ@JI8_wMb!
z=fB@M_x|IK@r^x(3`}_6mG#cdHP>9vob#Chb_rp_t_|O=pl*0_ta_a;0qh<5VRTa&
zk8$Y>Ux<U71g=lGNWo6l{wJ@CvxmiAE_d$FvrXvR(QhcQ>`v}qxzG{?2rIfP!^c3n
zQE4nl>ry+JR1;b9q&J%<G&b4b;z32l-SqQH<JbD$_1!hHJU*9aP4;gb*vVzOZK>CV
zi<!UBS83Mc*V?A!@GTef78`g!@M))PtNa(Xu1&(7SC%K*Bs-JV9@rEly{*`HxC^I&
z$Fk{Uv>$)9`fLNEL)`DbKkH$88XL=Gwf0Vn$wBJ#m%cU3ZVl-+yl0!6EEX+3xM*0-
z=QzA~vS4dc-Oq=E0+ceZN4Ed%aAP!s*G#qeq)2ZjMX7t6Z{mJUf>>&Km}Y=XLB4`o
zZ|p#8#q}G_y<26<wo!tC?GFygBy6M{@<_4IOPadNvL_EHxW#G16@xUEvr&LWBtLpY
ztEATOmRW>e&XKvr77y)s6PVghtUIomZ$A?#3Njw^cg?&yE+&mb;NeG(T3CC~8fsWp
zd&X#Ve7+nOrrn9@%Os`B;&-7Lpdd0yVm0IA>-$fiSq#@;8f#Am>jh{CSnAbdWQnlg
zhv$acyRvPI1}Z2zpK~*e@Pc<|D|2oF#tn}_Q?;w-wyg^{Sh6#I!juXxj|}319gHPA
z;vWGv<0k-)!U1TMB@ObtW9ZUsNr{roPYuerp~VODn$FS#sWK~8(gjVb3A`!Fmz{-*
zKc5p^Q;i8BjkA#b_^(64oR4Ef2A(+N3EvM7{?h8dVnmW#w<|h`7xDk<svnZgo7Py5
zi{r^i_nyV1n=HmHN2H;CW(U>A0H){e_N+D$fAjvg4mTF#zSM&rho@SKz*TPT5kDc#
z&)PZuMM~f9ACiCO(&*B>!EEm+Jb!x9Qg-zy?hyjyagF%1#IDocWt!UIbeTT5&H0;V
zJ*$-(M9TK$^Q=C)f5`2G;vAo$DS_5KCK4X_)ttM$-|N^d%6)QAn@aa&?~}5<iv}kz
zK?ze-hp*^+x`#e9MNVp^wY$rJIQbmM_pQ)sL@v^rxU746HsZVEQ-vu7SqhBcg0D>h
z+=zBNCRY@jZ_F)v<}a=d_Rhr3bxu6$<PLL9Ext-B-`O+HA*r5jL)VjzNsOCYbPkUN
zso?3-|70}ypN$^>GuP7vk;9N)$*kCTe0B+KJlwq@-quWz?!#$rl?oc$kSRf(MPo9)
zNjC(X=B!;^(?Jx`xF+WFi}V30TI3-uUY~)oOV2AbS1a~;;nrkPS|Ee@s-h7=11}tt
z<<X{Jb=ZS)t6^lp?F&<7*a5fK_gC0jyR^r>c_Eg{i1LZ{E#|<S&(Hmeh7I~rrL-DF
ziM2fjxlY=;y%ppXinRzeMCu0wG4%s-#c&=+W$k!yjhG2tlM23rV$fsQ#!WFa>xS{H
zHQOzB<k&gcIAxv796iBw=b+o1cj3jzPYQcbv71uM^c4FcTC4dP+#HU2QMd*qK66UG
zG5qQ%s#9fgzvpE%2Rd4J^Xtp|SBb$~3dHg>>5P!p+ZYYJ8<h?5ZY0)XMmxZ+(-qxL
zD^M2l_}++b4aleJcyd>~)^4=3fAiVZU2KF&ltHk_wN9Q}ezM{R#GgioC7^;`a>%Kd
zT_-!)bVw`a&Yf$okOl8n_!z&7GVp8G$zyoPm!~A@NbiaKS*^_bCq~JPjWh4M4)?uF
zCO;*GW?MegPwk8gX*@ntetd43XSV5@Uh4bHOX3RfFL256<RoUh<_=W%axnrVw@XR=
ztTXt0q2XVxQ>(Qi=TUBvMexcs@W2vB@talsC)FMmHa%w)2+KLh-*S87OZN2PKAxS&
zwO+fa$_#_ldxR(*HBF>irnr`c!j$u3mnOQLyhN4s?>)XVB+_qw@=S}!C(1>W&fbdF
z2vY6WO88-dc?JdH5rmsORyftU-_~H*+u^(cDMr;}?J?tU5qsj9ZTR_tk+K&`*Sv7c
zQ^c$(&K7v+iy^ZA9XhpM$E@n|k}^Me%LjYd#O_vgcAhL{gjH=~I#x8U*Y-%Qo~yae
zP*PPKm6{;7AE(8Nk9|6S8Ph8@DBh4_P3U~CXeWal4s3VRJA$+Rxb|4-bvlHShpK4W
zc4K6W@5mL)cM#30TFxCMX?(KwNZ52f9FV@^U7L)4y%F4sX0!Kl3YZ`S2O*rERogtO
zycThxMHuL%LhA|3P-lq?d^{T<Y)p2#N<ar~jQ{PN?RU|m^)aiJ^X7fUm~YVzO~}JQ
z?L?;bR}p!1$85*g*lfMvuHF&Mn+-Ji=XV}`VfNugL;*#2z0PG_xs|a<LI`c0?<{Df
ze0N3ZbfXig5+I%7ztI)mFxjJXvb8ZXxIQ>cQPnQ%YMT3t&e{n-nFE1xnwK{j&4UrA
zXniocYB?fjgJG?d-9(RU&E5f%$g-<f9@P{dy63UV`w?=G1vS?dWgelg1HC{DI(1#z
z$8fXoYiN>Y@5AUSWecLziVq&WA9;f)5<xwfRYHr;TNo%DEm_))fR_x#>zB_@zYPdH
zQOf26;ig{R#R4?g6KjiomcZ~_sJ3?%<h^ZdmFV|Ygb1BI8z^DacI3^RGgW*}Hw?j5
zf_ZM-*JaWvgbki}ESdN86rb3n)+I`ZmoIAV^0yRrj1#<_aI=O<Qhc~Asm83hH?`ZO
z3*Sa4!C?)|M&pK4y2q)9S$0NgoK)@JeeZ2T?-ajkEq6L7RNK|;HSzK|%zpPN=oYsG
z4?f0LL1ZHGR+U<p6&7E=S6TgPC5W9a+Ng5s#aqypsBydz`&{`V`PyWg6dzK4VD$;}
z!+L);7yB7r?tN*PQI8R>dyn*knGRqUZAc<yyfekYco=C(^fMVYBQqblPWuvAc5*Sg
zg~#E0@QY|ER=Omt^uCWrmG|#uf3uwfcXfD3)4>r8eW0qWGi|mHK^F7b6{!H_z10Ns
zr%GGTW;jt|M5auNVZ~A<e&<RS&9eb}a!>0`NQd}<ZE9iDq>w>cw$k|K*6F~W%y%4I
zAcyP@&p(}v_jeKwm?)|j#)T54!b(2&D~hEXnb~foR7QVyjZ^oVdLw>P2Ez3?S8Jc&
zfrXT>=%Z9Lxo}G9ack3sxGJGM(yJH^2chV^G?jSBK@Rid`Kt6V&xnhbSSLj-{8!%Q
zVUD$+>dOzxyio7BLu^MXlP5NrSPn&fI)3;Qrg1Gi<$!C7f3i$s<JL%4?_7H+=asv<
z`@N@p7rI-mI#mwt+W4N~I`zCe>D-5$B}bgu&er$s6wtY4sd+tHS%ZAGXgBHHuEV5Z
zs}sw4tfzB!xUxZ?aP+L<Yu}P%miH<|UhjprVC@~&9Y_p>%%v1|kI8#KAO=x(U2>Gx
zj#nsNOX|`_T&;T~(LNJCq+u(FMf7cWctxIuC9R2|yMDrAQ-)z{RQ?IiAU`>>ze${u
zly(^GHRg0jlLg4LX+iYPU?LmvGY08)s&32Pvi72CpEu;k>Cw$!$c=y$EM_Y~E?{56
zv8Yk=>4|Yusi|kNL8_w4u^W!gSSXU)f<USF((vDys#H2puZ{{b()}tCJo>E&mglD5
z{c2L+W=1ykOt+WR`sjA4O;F|(%-cO@lU5Ayx^foZ|7q{y!@&;=(Tg&6hsRX52ydfS
znnLbtj`+5}{>Dxcw8Y@nbt(3=mhlqzdTfNb=x%oH;YH&h&;h_Jwj;MPC`uyjcF%zO
zX^RB*?coD2w=H74Jhk^dWnka4E1`$*P5D?xJt}FkjAGjTAW@nUcaA8W1U;6BaTI{P
zc>%pV<7&S<Kmc9lM1X088j*|Yd1~^j(h&LN)626)_!sVt?*xt$G;V-WAjpF4-&weR
z!xMXchbNvTcTOnOiXugbPK|AL0|RK*g|hR`U&dVpV-Khd&hZw$al>5w5Wht-HVbdb
z%Dx^q5EoTlq;q08s>QeH?2#^r%ryx5$e8@@3y_tE4jvPzCUibi=3NS!>`~V}KMWdx
zcwUl+vUlaQEPDCn`fN{DK*=_kNW{i<q#CFe%fZm(5ZyN6=!uW$BDp~7W%qaU38%4>
zcO?1KD30kzi6ftGPrRaTcYoPo^F5XpGL6NPeumF>4~&7dyxIrYZDC(H1ddOxRYG?w
z5IJdw^0DMm7@-q!3_JgZ9160h3=!0aSTx9k`t`<0vQG*qMEn6!k$e6FvX&@C0|exC
zf0~{K^(?Lxvm^2oZ>-nHfsVJB@gI;s-wP_dKnF?CTrGSOO_^=`0g1MyBhb;fm!@#L
zM^X->Cq68Jupa;^nKp?_wCA1AumpYAACQ)%tsjs--wKithG?BXAR7W6DYR`6E1OP$
zP{CY-yvUot<(q3lkWT?5bm|GZQ3>e<FhiF~DJq8<npnB}^O62^GyG4F|DVY1niEBy
z)+OhXQG#i7I@~4^a0+B}T#5GHGlN^}q$+okfEeHL0yJ>zYy1z0U?0dXBbY#kX0>`Q
zM$(g0xdweZ1U@>Z;b3;NzDk|6gU>1Fflo|&Lgw&xBAy?i$e9zbf!F?bjv7SwaD)l!
zh~2yt<ty>!;P3$krUS5a*BSVJ<#SX;^6rGV6ky_KDmjsDyA}8%IzuSvUJE%x^~;6n
zd&im%zqpJs_#I3clM<A|gA$+~*sW2P_Q2uYpPp7evBb7mD_rDwen4S5>Tdk)v0lqD
z1=t}yb+@V6=?%;h4>rkZkb!pdIWY|g>?ml~J9!E+PdkCG*M&PSF$+6e5svB}D2^)N
z^a^^N{dESm_TKfW%!Tl}u+4qW=8}}XodlaH?20%;3uYKSdAA=W+U8MaY#!yar_|4T
zQ1cGow^$Q5TSDg8u+pm&k61=ycja)C8dQ!Ek|p_pG8+JOuaK>@{I3uV!qJZO)PbmU
zMzoU$&3vIBGA^TeBR9p{?(T@M*;`oYhG8qb0M?9VrP}VsDAG@%In88OOYfE!RwvP@
zJ$Fn$KlrGyy2fYQ;aw<P+wyjALgVpU*|{>J(903;UItAcMkJ$4QtG%j%S~EPyk+aB
zZ}@h<o%Zje#qRKUPNtUoU3}Jl<oFW{Kd5ZCN>%1+<k@p=c9VABJ6*P?fOCkvM!+>W
zyf>;E8dFiJEcFt@^sf1VzH-7*ld&PKO@@2>`>b42s-4Z`n%9PO8fxJ-*dA<`)T@{Z
z$TUs3mV<~{&YnW=zk0tnyyI;*pFbN&LcEN57ch?tOy7iGjNs(;&88F&EBEde!XNO9
zkc`Q?>Bwuvgh_Ibq={j$HbrLKC)g&*$r+wF>v?4EnEGgyy1R|yUD`E!1mRAb_(){&
zWrEM!PNx+@;}3`?y;tNjMbPHGg+~Y*sOW$fL#n0?UoSgjf-vSz)rvAYdI^-;aSYmk
zn6UT+;^{k6dj#FN?du8vqBDYhcIZgne<KzzFdyfwoy&$%8{b)11g5FrQy9PUkrx`f
z8fZ#Tm5&sS(Ooh?MU2ME>kD6mm;Hb^&sK(Z`eK>Wkt0-SaimgE!Z=<(l}u0A7NoB|
zFf7d<kuXlZCT8*Bnu8#_%Nt3#)tm8~>t|Qt6Xgc+daq{4qMGo{Gf<kLVag~lGM17e
zuQUAdM^t#p=rVuwiZ8|q;fH06RY~zJ-4_88!5smz4-CnnTX+XQXr0NPACO0-ps3$L
z9{)kZPT)hSQ_y?N1#pphR-h`dfWfSqf}wa-ap(@Xd5hVd1S6OpEe=qF*EgQw2Zr%D
z;}1yrx(N;jspZ$)4xaEyrTYQ70T%Zm6S!{*%S1eKoNjsMSnxGV_y$il{)3i-pbLKe
zjgp+l&1hQ9RUIr@ayNEaU5s|<C<86?1Zaf3IB^<?Z6NwfC$vF0T-Rx30!^wjtdOfm
z1P;lQ4_W}r|8v52;e=awm;7<^jZy*S1QY0jcJk5GVa<i6`-Ao&>zU)5iylcS)T0-d
z&q@%GA}4}(HGrj?4)@vz9>AI1LWnGL?>I1_0Rhn6R-Rf=VFH#F$<lBlJT+2x`RDv=
zEC}NGn#z=7B-6*2Kx;G40O{HFH}u7QzuL&0gkQiuei^^H_;@FhdUUMuW<aA{y=o_#
ztogK+b}PppO_mU<a1$rQ`X!H#yag3D;ojL~NswFnOemOkXawlYdmHizLWAuWOr1Bo
za@tk!Tpzo2nGG&#@mRW;N?x<k!Y=iF59g&ZD(;*cy9YmL)C+93lND%=DP9bW^o)w3
z1M(<%>B9O0GUICOG(@SRFO#Ylzv_j)5A^DY@xVCPLF(QKkq=v)*t}o`+l_l!a4Rlf
z^A2(+Olhzu8i9K~d!dth)J3;H5sBU(UbPd+y8j2{n@7Gk4Mxu*jXDCJxO@#L2(CKC
zZ=A6Txvv0dm<gIFs}7>KjS4LmWKJ7yQZE-;`@O|to<bA{k*ww25rf8M*Ue)I#@kN<
z4#OLSlNc_!?qVr-9a7;0)Azaz6GeA_K>C{C+hztDU=Jlw6yW<-KtVQ8b0?8{cwl$a
z`|&-w+`%pxKOaL+k$t2p`h24^GgrR;b)B6}#Y97(0_}FgZ<3!N_79InBFOLQ(5s3D
zT;T17)B<br^~<nLP_4Dfv*k}P#JfZOW8N{I1YUeomNb&NC~_gQjI7@hjtG9uW!Q?B
zYF_{XZ=X4rLY8b#cw&BgoZ)L7KYS9!`E!YufMcoO<nXr>5eUCPpbWpw-uUPb2&5LK
zA@f<Jo>4=u4}HH7w!`cM1<TC~-4IYPMSJ&iu?@J?b!^RQs2w|=8h<KF9BpnBVh{Ui
zek$65njPSQc%z+w*hlv0uYl}?LbUa(YtRO_oAAYp;Jc7r6`8;^%<lU+9!OpodH^RG
zH>FI#8nYf-l26$BciH99IC3BLI}+2P^Q{6xXGt>H&Dnd#=z3@6PSyw~|NA$=Fb%3e
zlFqYl``{C$JE)8!VD+j-pGhHW2E(?m=SQ?nz#CujJ^|HNxidQpVH)4_TnHw3w3DwJ
zj4bX%6E56IUvm|7YlNqXey@C7wmIuznnJka;1-nt4+sR>cMx|O%>PhDCeRM+^j=}M
zdO}jcMKm~LZ83WbV)voAv;#Hj9N3j}GNoy;plvWGKJ{89`sqMea2d$~#J?PuPmLI*
zJ)ga!sZC6iTAID50W8mFwM(#xdaG|>`YH^xsT?VN@Er`@vG017Nj{}t7(PyT;fLNB
zHLuE`@{v#2he^S0M#MUE?4n@{#{PKSIvIuCqz8LI6x%cff5+##!|m=RiODcLDA1nq
z2g3&h3q}UyGB}ZwBWaiN{nf$Xy;^Byu!B6eX=@}BoK%OaHAfyNA9g-`2W^uhn%Mtj
zh+!k&fyVCC!1h>~ZrG}qazU4nR}-k7*B&WHQDwYt7$|}UDg?)GOHTnUN8_&m9XA~S
z$Q6A?;Xr(fza%5eR1@&9Ruv5^jgf+6&V46Dc9SKnExs*8AEAEeMV=xv`f4mM{Iqcu
z@P>k&^vMmIG>L(LDLb_k2^d*I(1wA=p)i$2)ddndjx$OH5`Q4vW7rmh=QS0{B9X>-
z3uIS#BI~hFw@&f&l6;DMDRv*B3wOGx%;ZZS8Db`s(nMEw6M*41sTNW%iB=@v_b_(Z
zveVhweiH>gb>>nd!$gi1t>wf|OFZQoNtUQh`k*!2N^pFOrf~gSXNKK}ks@SfJ_{Jh
zt>8YtR<9s1mY!ri0((Bg^3u<#e}*>{MzE!NovqEc3(n@f&YU7CLOsfD<t&IkIArAg
z1M-_@xF@(%kM1txSvv_HonUhzyr2gP?}-6hf*8Sgrpy?*rzm*P?jt(zvK>KpV*1EI
z5i*0#$%wZLAFZ|xiW+Zwf9AXGq9`lo{W2Ykx#eF4K6%1u?22XLL>kB6w?sN%;pv|h
zC0Gf<4kQS{8(b&GDR;#ep=5pd9teyWQ3@11hANgvNSP4#!xB0M=oIhSMMD>idf(~U
zrn?%pOZOXM_jkU^gHIH$SW72B1DOu|fV^KrP^0o`<21&wlVO76`>%%mTw_0#^sCzz
zjE=@qo!dpFFTS!2F9N6ELmiP5HVx!i8L7IQ^N7{bSFPJ2Jsw(Zo&s?}&cUfGhi)Qp
z*`I((FbQSW765jOo<$dIBf&o);yD5FG)CqJ-;YM(1y25b9|`o%qKY{MVmB^7fD;UW
z%`~V6`$&toVFc{y(KFhprPFbZF!BmJp<f_1`j~)hL;t{&L|TpRiC*}`$Igsz2j7ve
zH*4tA##+$d)vKC;(59Opo%L=afB()WG1&Xw;?G~_p^g|gbI<QjjNFYYe2Bg`Vv>)*
zCxGism+zpDi*?e8QEzD|DGQ|Oj0SR}5oevip9sd>RE>KB!{`RRtS>{mc-+2ns&ZXQ
zN39$Yu`-iOZdq8}jATAr#OEtThHdYyt>}hZF7X=^j6M^nCMV?AdAftwIkw~)bjiXt
z_2M!KS&@ozHt%!7o*g^R?&J2tK}$V@Ye5f<5I9FDUreSQGhBB>U8RPSRe{j<5Woh0
z&3W@H0{<E}!*xcAR9<$VZgaNdDlL|TL=#LMJfieahf3M+qMNT=fKq}D7q1`+BA0!5
z_5llY?QQAB#2dQn*$m5K6qpT+ko^QorH4(KTR*rmyC&kYNKkO(Ib0$-NG%8cL%9aE
z+W>s!&(Pm1lfVJ`YcTCu&fk_h;yn;U1G<oe1}*ep<U{b5cp8^331kYUYQ05Ii2i`^
z)U8%*JN@x44J!ORZ0BSin8|OuIVv69c#zgQzM*yQw`pilrBjxDz}YS45~zOBqn+FH
z*9iZb9L!yaQY4#Qf8`_dlKJE^d~on2a}<50agM2}JdLYYKzSOk@mSoLUBtjXN!E>|
z84@eNJ|l83vU8k_dH~;0GXV?wH`@rTJn)9PIh?4Xzb(~y%uvw;e7TjF(~LS((O=8z
z;nsGwFrst$yz{Wwcl}|<=5&102xCm$l&=B?gT@E^fLN{V2qrMl_C^x(bK6d52jtEh
zkYh3HhB6J4R>p_Y&%;mu@*zOCf@d3n8t8)pGZ-}=Q%Yk+wWfR=?H_+mrJIrp+~HWQ
z!JCi}O3U5mvn@+9!&g-tO=E>L^`4du)Rg_Ih>e^<u{;rPu=w77ctT%KtiJrZ!1r+)
zED^eU_}|n!@|VZn)dV=gk=;n_{NL3(l57DVq|lxVKLsUYX;g<dT~y#~{9&2^-T3{G
z*qiV_K7HD+6NCIU#J^jMzhv<rmh&%J{3Q!uE&q4yg`UuE5ZWr#BiWO7gzP0hb+i5J
zgS{Ujv;^Nk7`(`gQxX0YF56i&6IFn$iyv9)|DyFl7PJ~Y7X0Z}Q#fsiSBcI)YSG&0
zya4a5p{{UBZD{|S@@mHmhiBh+%Kv{G%-UVD9EB70WlVr<g!l1of-yc3|Ef-F;Ld!V
z#|}>59h?y7dGQ|L)c<i)k+{ZrJw3au$YE73L)kXl9WDtj`NOXDrwygcDFjh~U0!2&
zS|Yv{3}@Ofk$n7Ft=+lR{?KT;2r{lmtYaqjvMJh|Z=ll;eGfL6(~3IMQ;kTY3U@JQ
zX76oJTdsR))tKh874`JiDzj+;X7I!3QS;8v8<ZU{8GVFL{SJVZg69~1ad=<^>L7YP
zq>RQ6e7V^E9dH(55~0A*-GW_k0y{b!_S2`@+GV>&2kMYD$T+d=zZ{@{%>nwaT}eb3
zwpgSU#sO$%kAiqXsIru0{Dr30Wl~jp)R3_VtBJa%X|A2`_3nx?1#T-u|5h0GE_w)|
zM+mCO0!>Tr``hK1-TBsRBQrv8n}1CB&Ko|0{wD>@RM7X1rR&uxy4b+HRmXJOjPQCx
z4b_s^r_-$J2i_j)1EefI>y*Q&G4oTq5vQv!TkHmnNfA0~p9|Q9dp!u?EPQcvR)OiP
zud!l!2rD>)j~{2)5dX!qIE$W0K^%P284fE!`zyjGB~MB^T?!i=vyWTPBs1sL6bEnl
zcYU$aqxBx5C1d}%T;4+4(7!l4zqnsHn*zUjD!+I#e~s~%O#g7!`%6Fmc=r8&S{{u~
zJhbszy4_UTNxLn>V|$e8`lRANC9F|yAk<ur*9EuhejHhTfUMf$qrMGeioDc?oya?%
zazOF0Hv!#<U>aLAlNcLr%{^Uw(oWb@@CQVT)#o|U@9~FwihI7IngG0U2=x;Z_!}~D
zc{dPkMG{KHpZ3+7j<JWg)BwcA>y@U3@M`L6%5*J)z;eKPW6D@RZsiU&m;j|7b<iYx
zPppX74;$9Id7S%n<-Y19Yo0{#Y_tJvXpa6{oPbD-S@19W@_z+H$WHa=h<)yOxU$$W
zsHP^G7xm9>%SJro%hsT?k;Aq4J49$BoY}5anyDJcDrl?pv56_UF?;0}SH(p&v+&~B
zp`X;tzsFht7UDO1<*`P+!4!si`!~m70nQFEcS}jRjvm@k<k2o!lc%v1pV8M5qq@1y
z*7wjk4~{kIrwkn-xsl<-i_OUb{>@_tdZf->bhzSPWFq>mOio5yF;k4^y^y{s(+;i=
z{ekPfg-vLaca%2CyLR}=_HJwJZlSimm3ngCZfhL)PSye9nR;rRtOr7HdVicBBKsG&
zrTZ7J2ARDC17rNb_vu47u3P@ckcNxDZrHL@W750P@cWUBpe3{0Ycyd>J-&YIM8uq~
zjz-yjMzdSbQ)AD5DPGK!Vc7Rx&?aHA!NMo!<*j~UTvAEdDEiZv67wr5DYM8kf1K<;
z3qi?#u}1+g<iGX&kpG1d0NuRG?i=hx3YsyGxit*MPkuOX->iE$<9+n3?zKX(QU6}&
zhMg#r8;yNALWi6kYeR3Ix*f)OE-8w@`OD$}PU|OM1{!<Lzs0j|(}avsUw6JmS`kJj
z01*NFK9uw9P^;2N<d(@3y}9zn6m?7)_Wt-FNM!ILmNhWLno?L%#};_LuJnHMggQT{
z2pLu|J{JzDyZxmI!azJSRvUZ<Z>oNTar2Fi_KIK`S~=9|Y)9k$z9oIq?UHq6;L!i~
zkd|%#zW<9;LEkSRkL@oQkndk(`~egDPvnsU;Bi|tS-g3x73w!8PS#0B$~rNA^GNM8
zDt#-9De=5f{p>zM&`7mhht;;T<4l#}6a%U8S9cSS0)fbS5N)u=av_z7oI#4>1d2Lg
zwj}#bCv!xGlha2XolMo~F9#GFY8hFUqQ-pT5sTv4M66%+HNsr;4)&>{jfL>*ym><z
zW3!P@(w`-47#QB&>IaFkm-qQGKkkDVeuDv6b0zIPswG*Rc)GHd*NJ0cOz30Cu*nG@
z5~RrFbFEnD_Sx0Jypt=#$~2c2XyfMYK6Jel+5)=IBM1L5ix@n$72xRlsrn{S81zeM
zx}#yee`V|P^)sa42PfcliNRkcy7qydQ@=a!{j_<%GoydDdFTEJhhO?nt>#}NKw|%r
z<lhj4zvS@$k{tSH#*c#Bi2P(uax-2*Q3`|P^fsb9DCu+r!KURPI^~t!i+dyxq*5on
z%5q@$^)I{AFPoPG^1Sd9d-XgyJIPxo^W-~D%NSmzJ|+X}LH~d-SGUG2_Y|o_sHbW@
zjHzj}XU_F`_D!+=`qlkkZYHwtqpT!VOvxV${iE-MFr{@N=&_c%{>D;+%QQB!8>MOM
z)3v<pQhKXftx4xuROq@MnTE0KIT^p4Mv<bmryQa2jxLU!A=|yPzmO4^CR-Sl+pQb>
zQGu2I(g${@<9FRK4&3pUIX9B+^o_I;J`_*M2p+D48*d&Jj7qg_D&P8L-_I8}1HN#B
zZRL0vC^R^<g%5~_zEgAM<Iy0s4C2cZ8A(MhBpE?r#njdr=76K4pE!0Xzxbja`LPs!
zTAP<)%ZgRq@K(d_ejhobUVPt%56FKP*z-OAEtB+}xd*;{FAiehQggf0*)_Kjqp5D|
zMQHIPdC&q+2V`<IqTtVo&_BCLzq9rKHMaNW$zSIEx2W%5+uYxx-+#&BFFE`^8{#j0
z_+Qiq*_jkhxD6;`5JA+XFltRnh0quXWx>ULpTasHGWAx5Z9h_}hz1u}v%h)lG3yIY
zfepuylE`}~8aghMW&#tT9*ixwqSvw)DkslzvUnxtzza@lw?>;8D;%VB)LB;ROo*%~
z5VJ@QL?{X5*q~Y4vNXi^R~E!?4RHE8KVKPKv5KGz&re(Zh^wacq!csM>xLw}CP0_5
z1YIpcexj?WpZL_>q9ym-)<Xp?RXxmezS*^^E&QIwJ2@l+uuZB^FB5-22B{Vlb<?(q
z8hX;Fge$z)F^_7T#ZE-`>!$6Gc`q6a_=K+kASse8+UoxUV!u>EI9-URU|GnEV|3@b
zFSC~!KltQ78+DpP_XT_?#dcqyk)RbKy<`@4u$BoaMdrrespckRHI~*M>zS&ze(EBz
zx?l10tYyztGEIRyLcT*Dqx<hw2+$wBzpJWAf;(j23kIqFiGmV(ErH&CEYLGi2sK;>
z$U&|tX&zs0Bg%{ooR2f;!aVvQb6r4?xbYS`dAhc8_Z8d{8-^|kFz#P#3@9$^-8fm;
z>FO;Oa`tR^8{6G8k`cOGkdW=8wTZjQa0hHSNI2f^Pb2H)s5v_1(aW93-H>dOJjo>S
z^!oX725yF^KE6W`BIX%zb&z_5tX7`RMl6pBqmskra&L!Mjr(sbjNW;4JL2-H_&i8V
zjU>SU)3AY^S4S0LL1LwNl%q+;6miv3BPsq-xHMNx7@PCcD1;1os%1=s9632^*s3g3
z>!V>jkma426I>@H@FwPI9ltN22VbWsp$5nK(f4^JO|Ft}<up24<*}}hj9w}`eDJm-
z+uH|@Nav{fspFHrioC7n2Z^voG}qEGI-)CPuq5fwtd7q6kGv0}-tZl+XLzqvzrQx?
zXS(CvwTP4wsX$pLUZi5smvN1rIfu)#8?+nc6<3USMC%Mh>_5&#?APR5kBq4{nZ&Ys
zEHw?Mgdq*Rb|MOMziGL;I*W`&8?hKgNHY}h?Wvor4F?KskLrRIX#|%b4k0B5CQEx<
z?XESBe5)%v$kBLQJwbBZ^~(qUKK`^2$aYy1jc)+SKY7ihLHT6ad9VEE?n>d`BtM5t
z4y&@icOEs<%)QW$bFDFK8XkK$spK`Y=Bi{cX;PIvt>9^s)E<5D*vzYFpRd;c-lUpg
zBL|QxU5isEi%pdqJ->oGd8%UKXc_l$Z$LGpgaWuw{gIV?0kXhUVpez@cgd%Iz6h?2
z%2f#Ep3M@X_$6R}XaDWTa9x%nfV@HWBmg2D9b$Yl{D|UZ8+_hL9SnzwWdE|CXjqT^
zr!P+<iLAMoNV2;!xH@HVu!yW^t*CQE^};C_EBX4WkD+;WIkqawRi_W?>?)umPH&|0
z{&dp>gyHff{@FYVn%0sa0kf+n7p8qmj{7RviyoI2C|f{;{eYC|u2e{^VBFuKzG92i
z1K-;Zn+>G#eQYODPRm|=`2{fYM0by5PA-365u7McQ!&|;(gh!HKx;ZGC+;lrRJdxS
zTe!c3?e*q~hn#TL))F5pLe>Oleah1Tmm#Du0hNN!s08iSg>qFpU$OXUjX%j}xZ8ed
z<q}`~@@oQE;x>^(OZDi350ixY&UveBt??dJudR&AKkaq~^3v#@wd&JYx~Dz0p`Zp%
z?7&w^c8D+FF##>Zd5dpd)%IGysdp(sS4HY1TwC!KG3<7+zKe{~OK(=6WQjTU+AHR<
zvg|H}-dt`cz6)$*fS+vJw4}(v)<S3$EJI$EYvrb%##wr8rDyGDlKYacpkgK2U8G5R
z%WBgt7xkt!7H)QHoP}B+Yf`>q{?haC&h0+Ejz(}dSIC*+$Ww6b=n#chyKlT%K??Ck
zmgkv>ej#?3GpF>HuiOnIW$q?RX(xjVz^9-5Zq;%|1AL^88ecn@-eEA-&27D%Lq7-b
z7A2jKR`=E;dDNV;7oD|Owi*om97!qWvQqkB{PT6%VDP8N9)G99E4TDCE^-zITSAMP
z7j(e%e!hlUu{6PKLVM!DHJPaqZnEn9&#qN#l<YmwYM&6IF!=X}Pp2rF$143z7{|f?
zU#9-Y-%kR;{Py>s!lL|5Siisir|{A~h5j}?-0G(^P%jUh<o{qVI%lzLF&GLyIZ_y|
z9ryQ#VLhI;?GWac)vZ;!#p7pkqDoDaD<d`PAGN(?XovBG@<S{mRlv{ei1tvf$GiBM
z5`*3TS`Fq$ZM}WRw<9UXgD{`Qxyj?rFjm(Es@CMl7PdAey#3MpnrK<RlPq8MU)=nP
z8lY;E83}EZ=}v%DG9&bcMIg4MNlvx*^d4wLedC@%!<qa%P}A14U9Fl!Js(KD_SUvC
zU_eYJQ0I9&#50`FNZB%n&G((qvrp!4Q8jgg-%682oZPYurIep9*T`)uUsQhg{AE>Z
zD&m9E8fh=mA^A+?z;HWF7jUgDB%$un>Ir6dJla}#e3qr06y07hM5u`_wu$fMzJ5SJ
zi5Zn>_=z}94O@hZ(lkjj(5*YvACR+ix*;&)C8RbXtGOKOo;6y~C7VV)Ikr${+&=0X
z@{l`H{;v3Z<&2^WUJ~Alg7#BSe1LBF7>wd2!<H>&A{ahMGbuGYBj}JO?>(~WZkRaC
z@qmNrOpI1P`<sHQqKn+m*Je-SIw_`xp(a~{clwr~t~*K~xFNg6-?eqBd?OC4j7_6-
z-u>^9Ec~9Fp|DytPYwT-ZOb%yc#<fQX2*0s>fHM0NPL9s%yVj0^!{rPy7l+RT+7?H
z<_K-ZM8Jy6!fPc=byJ(Ms)WTedRDxw-&d3#BK%t6^$n3K>WkZ{SW~n;A}E=js8$<g
zWu4xl=sxK%m?t6Pzx7aG)8TpkUZSA$m4lXb1)u6Uh|p&A5GapsgkIE(fUfMaDW;ST
zy%S=0PdH`_e=H|T+eB?O8qMzM%DSF#d!#0HXXJyAYp<D!Zs9h~&bP^1OItT#6rC5@
zAL)0-6V8BSORkg+MUUSQM;mYQOeh~|o<>R#9>CW-)qCT=mtHp8Me)AU-du#sZKt>g
z8)U(*aI6PEg-;G4?+ny(=}>BpG#|TPmTD8I1^7d*mms!G*giz;jafoy;KGp3gyige
z@^#P})eJqEL3p|JVIiHxY+_cEMM3<W=gpdfEe>fC*_<LOPNT`mk!jmX)WoyRYD2dp
zh}25VQeLD@Y6U3VEYcz30?%PNZNFCb-hL{q_vWQY5U8cF<Kl37<dB6?&QMUf&Sqdc
z9~Pta7PN;x^e2)?nj3l|6Hd_8<;)7()E$OR7=)fK%vidLGbY8}57J3ADQYi!)Rgul
z>MF`p#qSd(k@w)x?h!z4S0|pP-pt2gEeO&_1Pb#b8<d%eHjz|SJ3M@!9jEbX5o+Xk
zaZzAag6i_KgLR9#mlOmK(Y{qXQZ7*Uk)x2Vy2q#&2{bIKRd{y&T4~(G)~vy`Y43;m
zMfGqd6fae_*Z~@h;^?V9^8mE=RFe6^DC@KpAX=deTv}Q9#4BtOOA_UR5&0vo)vW~@
zD(CP}_Q0Do$^68Vxqw9O<WV-U7-9EY;fp!l`iYy-)r?ab!JB5M94}6Z_`f~tP<zCH
za`oWA4~ULcVyMgF7q}<PR9b#tlzA(DoYhWQyen5x>s`m`2eMo@JxtvVxu@L(-tk}F
zcg&%?8K1U{H;-@FK;1OirC<`~U3%VczY)PMfbtzDvWq>S<&>ZQla&7znocTqH&^)p
z^45je&PdDte5&EwcXmwIT}~%wMeozx>#0hafBST+l{a#c-UHg4!r|aGkmo?K!Bc1X
zy^X^@qdne$Gr&ScQw-meINd7NrI<Gn%s!lqvm6D385guX$M02Et=5_+EPGbuALFol
z+&S}bZju?5iK_R44k<ED!r5f-CH$8q>o;}o_|t8)x1UM@A(X)^mD=vfJ`~$*+pUj*
zddqV!irtfqryjY%1@j_wzggj&glhwK6OjDxJzx_9fvFBhF*eypoMqc@p2isoz5c|c
zq~Zt*^y%avs`GNj83&X+*2=0}+BwE@D^@=(WOs5%$;(Y?63Fl~wBXQpsR(oSYEazn
zc%2_6o@=KjtEA9p9k=?qdXPjZJ%p~y!P({!%AeoN<|!P#__{wci<7f&n#wp?1?MAQ
zR44ib?YmHt>$1Xdkw3U2c$D{)PqS<6I<_7|PD7eZ=?2J9U)aT?hlh<fU_(34PwO#k
zStLGAaY0-$*p54PZb@63Y@XA-h}|pQ&-XTQ9P{BDsKCd|{rqmFtFNVvI_xl$!mYDS
zZP!Oz^iHp6KYu5ZcH*waW~&NRfOvMwrhe@ij1j3Skt}T|d(nHFtMP+%x=svk?*3<^
zGyQkwvgw0mDR0`}XM79P=N2SDIKCHqxt6VnOvd+Z+5*Rn8F^76%1A{^zkjWdYiuIQ
z?{2V=RsD9Nh|+DJtOGW#(l_4>n|H3bf7jabDIMLYn6#1S!s&&OD^X?N;k-Fp>v;92
zpuVlF5za{ViN6<T?D|m?zK|VuE+sMAVVyF`xorJm-u!%zlp-taHlb#Bx7zUVnNeqJ
z_KzPboVFL({I28IMJbJbt(y#4dutwE?6kF<@4Dk@cCl>cBaWyb!?bU{BdgfJ>p0jw
z)^9EN{eBzx-T$G1aEFvZhKaS6dufRN1YIWbz=41pOKzI^JtxCXnl)(W&ezmhKaywR
z450?&0Ll#N`HPwJ-xrXrTE@8hif12qZe8=V5j~d4UiJoc6Sjot<!9eRb|;w74wOw`
zpgO1Xh(#^XNs|<@fTI_l2oLv&g}nHvBT%Fze^YfIBbOj@<Yg?T-|1<sSXG~*0sxoQ
z*xix^2|B{Bz4zH4=8?x8U2k~{5lE0eG_mK!BS^EiD{_H|YFV#KKHgh<(F1ifh9X9v
zT;s&`xuPfO<Gs2?(%1D!l1t1}^GpO+|IJ3F83K0AZNuAZXiLGFx&A|_H8u+!KjSiA
zc`74tGdbJJDcf#cvN`XYoy5%(U#cI{iPL>!eSB)vGyHFDx<u3W{9kqf|I>8{Q1Oo_
zJ{n4JP^a)Gx2+u+KXJY^edagJTj2ooa(^csouCgt0*=()eO=2z)vYZba7|RmE%AQi
zR8#yqTK)Llhlb<abr7HSsW4nljLt#6E7oDylPf#hUVN|mje6|^E2=x2$63k2#zcb>
z_emJ*XbtHda#kzz#mwu-c?cgwo({BY*=64KE%6yhmgzFX_SYnRfo?TDoBII)l|@M!
zBwgae?8(lfwg?s}i-A0(qy%eq{5}({bG;g~=k#{x+tlhFx2Fj@FD$`7iUcUS6GkRU
z8SluQSE_pAZ}tk^wzE>c)y7m<J|y}@t_{0dh#B;V=M8L{DY4T_sMN|R(oruSx0;gq
z!eKX=CYDuYNEx7IEhHhgDVIh%Q|%HMnthZQN6EZ5bh1^LiWauG{Jx*rRA*i(t@Y1c
zvC=NY6(^1!xfS`fsPB06*ge|D<7{=<Gg)#z-H~Mn^|XH1bzSvZ`*}*3+G!7Y%)*A`
z$hXU&Lsfs#bBovd-F?$C1)q-Z9KK~3fa>%rArh{R9T-R-&+$09>d5ohLy8}i9%{UR
zt`-YD@}9s|^-Vn*Yst+vC!xLOX%2c_Ii2*U@qjyB4D@*V+iCEB>bK!KjyOU)h@lwK
zx)CLa5Jjyi_~GH^i5$xIY{9_khqb*Vvoq6@^cgkJERK8J2t0MgxoGd0g^0)wd#bPU
zrQO$9OQ<ivC;G!&$O4+Q9-_GL(B|kR3EWz_MS#toyI~tctfpa366y|1JAZ2dzW47-
z9{Qv2Kd_Yd4;}N?Bxj1N!teXJ-izYfZ=lX~>hgr2{K-r}czcFw2hPwjyHV8^lZ;qa
zlOg-cJ=JbeE5%D)arLjJm$j^7?sgKgA#Qss;A9t@<&+-~_!vmbsw1Pfk712O-$FlQ
z|MY(3pWgXLS7PO{6KSwQcs+Uu)}YLStL0->y-`l2-~3v<l>Ke{eKwQ!;tiF87mqzZ
z%kEyn&BRkV1V|3#DvBmqq^=U)a7{?oA&*n9GI_z=13$!9@FBZBz(&yREwmmpm^d*G
z#AmxU%&11zpYqm{*ho@m%)S@hU=#7E>x!9MagbWQz?*E$x3xb_w^joX@PdSvVUr2>
zl{0Uts^my~`Nj&%m*MXU_f5*JPh>p%!2G`HO$?%I27&?y=*C3&y&sTm8c~GC(D(!L
zX#@T1JDWS7)&A2<H)XNZ!>uHppeJ!ADXbkKm(SEtE$(=+6^L5_ma+atQMyhPCul&y
zSszJ1NQILf)74Vvy*!jn58sP(n@Ji3|Gu|3#h3^F53BG0)H3*GoITSp-fFA&<XiQ+
zcKFW3Ce(=pC2{Rbk5K(j+@321=u~{3mp(gC1>NIu@j8LQzc__q0a>4UsW85UDcWa2
zP<eH_a7%Xj7^njeO(d4xBs$R6Rmdp8o?_a9aF#Ue!7J~kSD{4EvnOYu6}9+Mx(yv-
zj<NoZ2(_JlxAwJvTMD;^jusV;&(wHdTM!o|NiBSqJaO{5vGilsS~(7e7YFNdK&Q!D
zG2Tg9^vDGlKy5NNH7)1A<t5ehejl5g=B77CyG@s8*Nk)j8^dluxWa?v_MCEpAdGCM
zGs`lIy&_(p+?}p1R=#KA!+1B-hYR;Ewm&3$d3JXw-*A11nw0WsuK9BLx`yiqTJ=D1
zj-IJuV+!{WRfV7)ImIh|*j1Ec`tlEm#4IB24%mp<_9Ggqj3@K7Z_nao?<c*k7EXT|
z*A9H3c5ssTr(6F)et%D9Rl04DX1)Gp!5Cl2qE?onFZJ<&EB{S?aXdqi@EHeXS+^j&
zTWiL4QS0ss8$!xzoi|$<PF5D&F*HuiOscB=Y(M_l-r5`^Xd1Q_2(qErs-1I@jx{%j
z?VWm%in;Pfos~r@AzR6pE-A96F@za*Z^ozE4!Z|G@s?!J2rwC3Af&UlT##^nuMc~%
zG*)toNX{_Gn9SoyHH#jhL6ZgxHYx;cun4{P&v|}cbOQpp3%Ri8dTPkz`Je8e@*|MX
zX(AOejB6Oex~Gz3+6Ok2zeFFQCE8<GO9l1$=!I(|F-OTWc(Yq3gmh&gLgidj?cpR>
zGx?|O;n1DIzaQ~B&YA~LjB_lY<O%ullPlb1MvDc4pUy^S1h<FNdd}<D)MHFwlws#)
z$+7576F9{aCHCeO`tkMnuU_anbYMgRaFhj?{?TEBrJ83us{u{CUn{IbSVWJKb(_EI
zc)ly7#Fb&aX4{lF5WDwOpZ2S3$!?T*Zh`#PJ;qdZLLe?U{pGN^faKTk9s;TCMN(IL
z`s4Fu41BSI?idZJCUwc49D<I<%n%hTo}YDIIMGg<HxJu3>&47513!TDcAZLLR`l9X
z>20dy`)ZLh^5o2DbG<9<+e_rU2ABN4$r|GdXL-+??-x3sIBKW9xt&%7=3gN3liccG
z|M}=T>Y`2P2=|<1emvtSA#u_!Gj`{c=;xi}Iu@-77k#b@S@sf3M<F+7G&|}<Jz=de
z$CJLI&oxh7t+;3T$gcJ1w>KyE3~3lXZ2abH2g>U`;eO{5^E8?`>GX&OSdrmP@A2&g
z1wQrUs4L31&G*Y(;;x%g=A8G!L@Hhx=R-O?82E0g-bF?=n3wW+|A4gJ=ij$Q7pJ81
z;;jGE4Slcj&!<>-a*tu{wgIVS>eA@8;A6e(={32f3p6ymt^a33)XRha*4GiaM)anM
zcJh-&Ci@UVH8u6!vIcz6LVJe8RVk~D@*srr)UcbQ1uWY@OeFGfo`>@K9$6E+69!6b
zSMSS#Do}X?s(1ppn}Xq{%JsPN8;a)`<=nA9FzzEIG4dte{hehMElj*WkMd1IWB?kw
zbFrMJ*tV*0Vzu9Sesdd8f~fY-r-powC`b(<u7x64U15yFLmr0p-I8lz)!JX3GDngP
zB%otv*Kmhbl&zApB3`$ub24A(y^XJ;<x}I9JM#1oRA^2s3)=6*H;uE))x!>$Djs!C
z)tNL?5%71krRKeH`~gwQXJDXYCqs{W)1uPtD)-0RrP>ZG*jZWeG%{&QgXX)Cd{ul_
z<H|*RYmim9qqRfZ&}hEX+PztmwhGTU8xaw~4ekku!jkz@vpdUId2ZWM4^t6FaPy@2
z_BN>2k^)ti@SRrqQ?zzH|0ddh^qYgZxti1M`|zlGk*dtc3-V04xze}&>-RlUyQX&V
z={mXrv|Q!!XaGj>Ax1#f*GLx1{Pl$3XUq1hrB#uJWtNZ5Mh7cG#23JkH4H`Hr-;B0
z%EFoC%ZP?Svphjja=UVoYbv8MF;buE-W)qPVW>rzYBfeTIWY`+e5hw)ew1-qa%64f
zTZ>y8qrcxFX@M6q(q24(YHZ}P<-nR2IuyHGgZ+TgI0pL`{}C;9eO&5Gs|#=(U%36N
z42bkr9-*cm2`x{vJtA*9mR6b-m&v4%PN>Wsn`RNeUyIy*I}>BtQ>{e!*!?V}mFLa*
zB1d`af>O9`mGg!ggd*!^O|~{DwrhJ>8)`t)o|O-YV0~;tt6@eAt*h4b(0Gg;E;LLT
z5U=(+xM#gPizs_leN0_ouzV$iv=||p<|i1$aggussrOtE76@I}?O3jMoje15gyG}&
zz0-an^WbZ8;elNQRBg=+6qO-+)h#cZCX*v}XXevx^#;uwMP4%Bs|U)&=R=6-$Yj1+
z9Exvr@xpOH>Vpf)2sP>*WQuaOM7Hnw_R-1I8<$4bZE{nVCbYy(CP~kZ=$D4f?0<Y)
z^Id6*t0K(VJpb(0OEKJH4etBM4~S4NZB#*&QX&LR*j^(qtzX~)oQP?;|GH)Rzqe{X
z`v1dm#>_>wVhKi(p~{Det<Mz29VVFBJf8TdEPfUA%vZfoFRspAK>kc8!m-O@I0+BK
zPK4GTC89%1FdS{f>!hL0#F5ZO)}AyA?((SgQ(WJersO*m-a->W`Qa9v3q7A?3*XvV
z0&Wbb40j<0)1D827%LjE?^TjI$<DZdACUPx1bQMBu<E7J_+0Vu9dSd@OCt0)UOcc-
z{11%cK)MOSNFR_oyKk|!&;!(CI3!29otv@%VDWzFm{D$L#cKTZ(V<|=>Q{9N{LDUp
ze1RUaTc~JAfq57<m>(zP`&(mlCdEfWjo3D))xs^pO*y`QQV^V&t-eKi42IV8a3^_^
zyYZMXH^kxml8S0M!S9l95}rJgsP(BXo#x)RYPk2>_>+xhA32IGs%03l5{@5d_VB(%
zyfVg#U@_}_@=?{kO#Rk5i}NpfG|IR-9^2AQt_{x74*3vyNwMUWbfgdw>R+69vhAkd
ztU-B6oLlVG!|@OX%j&4FJ_o^c>2^!2Ehzl06J>;~;0Ll(lP+FD6o)U#hC|4_D&)rt
z+rbJO`6489Fj-SFnslGsn29tkAp5&wzGgN%vlhqe>bRnn4zZcte|+Z62Ij#opq;YV
z6(N1rJ(QU}IYgBL=uSnI`1G(OE{TMZQWzEVcH2g6e}$m*(2c7oX~2$fp$omX2|yK2
z4XX0o6m<7U9s>;o<IqIcl@!7h2F$YCxE91JuOO%~8dUkE2K0sj220T61Pp;)3;>Dw
z|7#pXC89{GIZ1aat1gm(YCQ13qSpzjWs74Q8Huw^6Blm{l!|NNRK!hp{xU1v(p;TX
zK-~CV(9FpS&!3#W)1=H(>fl-xeS+~Sk4B7h*jaiCxn-)ySLq)iQvY^T{a^oGT{Hy?
zUqv3AFsa%VQe1Jm;jyuM`f!_$&l9&R5GA)a75ohen-{iQaJ19tRxOO~nj)OgZ+xIC
zefaAa8nFgCG}$omJ^!(IPn&4-*S_~PgW_1_w%KLukwlL3X>I&tDFl?}COimrpp@)B
z;UnH~1D+)G#;80oJ7HF}*6yHUQim4z92b9174U2GjP->VuZ@<uIUNvfR(k+sm-}1i
zK;<W7Kpc5=YjO_kfLfFqsixy(e@$3J-iaaay`=4XjUOUHv@oelbu_r0`+yhAYa(3b
z+2<UOL-Y2ha<(!)3Ro{IEFa@5`~h*RDbnhfaIHDrY1AupWN5sRkMQY&;^X($7MuGF
z^IoC8vo_^d!iiGr2B<OxY1(pzPH7G(*onbT*n$?=(@Fm*fcPg=>>r?M^d?J7*JN6z
zZuSY8c$;XB8QpUU)SRM!{d@y*5BC(wURXtR%g9AK<1B4g6|aT*oDyUB>X=qHUct3&
z<1|)g^*!n;xy{9SDhaJl=1kZ8B#Yfxd8paJ!z|3e8zb-n$F_$j<?8fZT$fwv0Lh@+
zXjr|Vey@acD$}WxVW)gAK=#vnt!;5Rt=*=cOrd?leXBYfNsdLP0gtc_krJi!2Nw{8
zk-$-&T#9Dj#0K6%t*H~CplHAdulMQ)By$);iKH~^bpyZM#{<&}XS7df4SY+~4eSL6
z4I~I7k(W*cpmyjYw7(v^jd3ZhQT&*0nsgBB=H&(dNYh0NcbMKbi`86%wSAyf4w62I
zClcI4o?v;&2p!_XFv{|#Cfk!aA$RC&-re*EIo|$eLY|vqU)Y?Zi!`p@OQ;0y`rAKz
z7v>s7#;Lh_c)(6lX(&;y^#VL_Z52<sB5f~MXrd!16yh23QCi4djC<jQ0}j+n&=}$8
zcxbN)?s&IYM?TsK;<3WVq?KZBeLc&v+oR$2_o649yJAUip}lz`r1IT3K!0A)Lz5&M
zIJ~}dN@KUsHg~yo&+T*m&LRb$G4J$xZW{^QouA-1KF#XI>agxks@RQ#-%nvdwT{Vp
zW9jFIeZ~W-<<2hbq#u<wK}fEobCn2B${KOCNvpX^sIDHLPQU;d>NSq4k3qHah!W5B
zd{fI@G$eVsd})pxw6q?4n}XM3dY1O~5c^#w2o!^Kpy;4FQ&<#L;Q`e?L{1d~t;GI)
z&(OF%YrUewsbH1vs{On#{bUsO@ucC`hA|`?qInieIKDF^nH!6(xEp2Cnq&O>o>jLV
z(`&2cJ+j*%or9j6K#L@XlD-4p$(y{InQ^Wq@wZ&nPLtdXn?6PJS(jdR6rfk4^Tu_7
zYPFkdL!f@?aTogD_)(7@=ziN|e%waT#|vhwN!IkSpDW@PMX7mRsoWe>Hca6!_M1X(
zv+g0Gn<$<%PI5=@R8SNzzl>`{V^cxP!ExK`gHC%RFb`XqJcU@~Aqkt~oJdWw&jbuA
z6^eA8yms+Yx2c#(+tT~I37;wPlIgo#1@rs0RuC{+ORZcvtboCv>O^dq$t*7HlA7rg
zu4;?#`9IvfcTkgW`{o^rB7#Pcjt~_P6_8$}1(hmdM5PN+>C&VJ2nnL}4gz06nt+J(
z-V=Heq!;NS2uM#rLLedT{e9;5KKneozukA=*`0Z3_CF@TOp^P$ulu}?<8vNoiAcTa
zheMC)D$UKrj)w23=cx8f#t|ss;>9S3b-K-*)z7f*5aiU8pk7&;zcb?mzNN@Ye1Xy9
zno)@Jpo=i8Q<@2Z6+AAh%jL9NgLJE-mu5%jV@*4zzi;LOra6v=D%fG_*qw1B1&~XM
z0YdFIVG}PHQTA$przE3h%fMslv}vAZ*z4THrx(QLHi`T|+#})b(ppE^yG$1H7-3nf
ziVzo74Q87$w^(p|q+@#}QdjiDojoI8xyKqYysBjbOi$pYkkid@KOz$jIBYcsd<nWm
z)z5KE``CJGSh%?+*6t|4V=Z=KRY2#10mT;8N7`3w1|G6VsYJ~#vxh~lXKa-&Q%_?2
z72l{UQ2EKZswr9Lnmu#KpH?~cg~JTSU3OMA*Bh22rpE)~#fbVO8?qk`9fu}7DT`H?
znyBVK_oSW1;c{1`E_3Eai6GG~w(U~q#-m-+f_McPi`C8V*1#iMyO{w814PE^#a1*2
zZOC7(>>bs%a6x6x!jVlR&%@6|VPvKv_`+A#ZoOO&?!!o_>9%a}FXQH2Jfv$e1k3Dv
zb(|)OsCqzXss0(BZrBt#_f5x;uj#ahN(kd5c$<#+R-4R3aO%q9mT#@Rw=^r7cHMNF
zn;RCs4Ft9-*l7+quhpQ;QLXT*!jrsHK+94Q<!NW8!W7leTiL<KKhh6C<Wlyk?Vi>q
zT?fT0YrNx(F+rUA$O$@uk)4PXTvqq(f*P{La*R;tp+e!Rft#)Gr8>5rjHZPP$gXF^
z`cm127Jn=~6jxv+NWgA&5zBCK+YE#NgE~T8xNvhbcT~aM6ym(dTML=pNU5(~qmEaT
zgx0jrBIvQkSYWY15M@hYTQx+X9(AS!+?3q>jjn3oaZ>!Iz&oS>rXBLE7yPmz`yB9x
zs0nCQSo^je>^y>kR}ag5HT+TEUgD>VJDXZw1dB4dHK??IX|X%*9h&<}8ah-^W)%5Y
zBFHiIVRIy2_m0wO-I1uzFoRY*tQ;Dbvd9P^O^Y0;0UziEH!3tAQP!<Izna~+y^!z5
zc`)!KzcVuaqEvkMXYj4NrxkY>rh9wFAeD7n7E1uchsMLZ;QS7Xuk{PadwaZc{XAD3
zLQ`!oCEa&<Bkp@{^b1ex*(eRcwPpB>1qn%Z$MaG}mUqJ&xx)^MjI>h*DUU*#m(89k
zbH)6Sn#*GYLg%M$07haCMFc$pCtzvkT!0dv3M8!tM?3IAyTP+VIB=V3$<;Koki5q9
zuQz<F8Zp;2<Ci5WSsZz8;7%WwjqXNf(V=bQE;<~CwWVjB``cE9MOQbGtD8J+txsnU
zTzT&5l51o(6p!*C?lpNPM1qblwxZdn3`CuK>eqm`$O2(s7n5yutv(vXv)u%lDdq^h
zW@Q${H{Cx<C25>wWdQ>%nSc-f&cwHT!$0)nq342SYjMJm+V_tBhI^hNcO!-loz}np
zFNs59E0jtUl)O^ic|;Q+-~AbwA9maVe-i#vQ$@a+=~R=7dv6>6A}7_L1d(L^7FQ7D
z%F2f+;!gj%s53;eOGEe$Ip#yet;<yEmx_K+C6_X|+c1y{LQhypS7}y(=G6$M><zu0
z0T0tmJ>fJGpgUHM8NrDngd@q-g8-dX%B3eKTMg>p7QX}FEVQYi8N|R4bi?6Ovvu{q
z9w5cm(7+hNE@t9lXC|B5{5nRV&eEsX%g~SOO3NK!2J-#DqF<3m6w=%3hS6#@etgOY
z-hf?tcn`8oo${lflHS`>r9B&0IaTx?<JbsxEJ7Z};Zwh@U6a)P8nv~#w@HR*j2La-
z+AiCEfvJkuKh-Xt(74BY$yS$ic{OEYW9Hk8MSq|1nakRVdY3|;YVq2=M1bfL4g8R$
zB;`_%1yv#@g0SCyn0a&RW4MF{GoPpMz9L%}-=VK7hzbLx?eD(BoS9r|Y$4|mndyk=
z@QHg`6JE2IJvl#`t=AR53tZd$XtTF)zP5opzkD5aW7ALup>ro;sv{+lUVTg^qwGs>
z!Q4xb4#R4zYTcO8)=T(AVY4bqk*K~ne`32<VBmLyMzR{&ss+BoJ<9Rl0*>@QwXy$P
zz_D^6hDtn!g<!4+a(9{tvbWThXX4e2CzWhd#%IgYo{6-pI-j{)%!^uAx{M0~>wUtW
zfxalQ2GTmqs7!dM;38_+WZ`1n$N}eAiO(-{m%SmG_Nx1)GFt7-LOAd50a;rOlqa-d
zW!Sbm9{mGLdOz-rG%9i&?o-GrHMh{Q7tVjK-^s3ZHcv~q_Vw}^ULH=7{dl_LX)R;{
z#ToIoi*^n`BJ7uk=*g99Z8Jk5+ZKkw8#7{l&1>PD7LHu_+uSzA-<TiqT)N;Mk77Pa
zY=%<YQ9zy$y*Nt75;anX;cl2Hl@zM1bpx+Y#aA0w@~HN_tjJ2!bPrNuPzCVgnVUyN
zz<D}Ko@gsSelqozcI9FD!uf>hO{Gpx!Ebe!T|7^S4RQC6ASCXSVw4P-vJB~jPkWL=
zoYY|5>L7|{#m1zxII}Nj#y9h!RqZzyQxX+pk}uxulnE9Cs-xgA)OZ@C4X9J5k^Cca
z()d51a5!5~?PxXjukd$?e(sh^un*}&?d_3we3{}orcm&RnA`Q^WRcw8yBnEB!yRmT
zeO4+ZCI@R3$7)(A6$Hal-1f>c<SaS*)!%Oa>RaNI_OCf|be~Q23Z8cgPMg2XyI)0D
zJz!KmEeth2hR~Q7DbJi1Yuws19<KEmk60jj+7%sb3*{UAUe5`CF=q+-pu$UPY>ay^
zlbB7<=~pzIeA}ZB4Kq5-z3=(hMCTVL=Mk{SoVrDhB1+;8w~p1XQzeKsQ}4W8uF)3e
z?lE#zb)h5$9_3{@L~1`_FH(LlRR0_ywhU##@B`0U4fQLiA&daICmS^)Yk|n><h%Q-
z_E>&5?Dw?9vuBd&jM}&yu~qG-yL++B>#<JkLsRBr`&b%tAH|AXK&l|aODvHZHFa;h
z)Y+ROCwD9~r8~Siep&H0S3c}fv3$l*CzcEn$OV&HPpX@3agq_r+*>Ua`SlBkB>Zl~
z!1J2cd8hmynO*G!4+dT9(@*N(#Yzcu(4PXKQViiqXigeCYJTwy4ZI2G-GVw4Qt#oh
zEYtc$@O4<O*|lU<u5Whrkr$o_Ilr2<c$wM_x_bxmjMfdU_NB^8wi@u`V^%);qbgRv
zzxZm=ktHJO629<q&a75hMmIb0slw<(84dNKPgr4$FbWtl58h^`SU5o{p<CbaEN-B6
z_4995iQov~YW>;fc5A)Fg&W#!m3ogw3~Q#}D*koBM4G4qsHSysfT&DNTGCFyVWW<*
zz$8w@vPl?hf^T1^_PwcO#)UM!@K}umxrYO#yl1ywBz0>*ZLgOBInOR}7ZBJsY!xh;
z>W71KJtM1_5n75~Nm*KGxhZ}m(igd0o$I-}mHgq(O$LVG^D^LXi*%TasA)8}Ix889
z4{f68Z=?yVMOOcim#pYnI+5{;R7qI97j}ikHM+=4z=7ewIFj0W5?WI>(@0tN?S`MB
zqKF}Dk#bOa*!k1~1GRTtj~4XBN6Q<dzC|#fjO!;ae8bquAmoqH8vn1-E0UOl?sB5s
zb!sFY{RVDkQ=NQ^%&%@`=s=GRbaO&T45ns#L1;?6SvvcbmC$&)OKGZ$#6ZDG_@joN
z28PJJvj5Oh%{KpAE!CSR?&b1K%QMK%FQbwPO3_*ol@q(YoLJZLSnB9x7Nty$a|NiJ
zZ~qva#dulja`f9741&xDdv^fiMhbr1hOsX4mnaDy+kJX4a`X7e)zXxt#Q9qba2`}>
z*Rvw6n8{g?K6~W$(s#oqKgF=XqPkB#N<TBdM;>@AF5LVJy=nr-#}@6Hz-5y-ck0Kt
zkD%+&gx^}gR&6->pKsAxp#PJvqyJ3)SF!Zd|E3xF|MUMd45GxyKar}0TlsjUCqvk?
z<)*Et9~>rS#A`D>Nxd8oeaGk4?#2KK!<-tULOp1xPi>{%%zga^0k4sLb9LyyaFCrh
zR-S-B$_-u4!2AXE19rO5uXRrj^=i_SPre;Ps=88pSDxXfMkY32Vm<H5Dfcg=(q=H*
z=<Qvh#8j-|_^)bs*>XWIP^9cV1WccQc)RpBaG@K_5~YvyIldW=gc>D>o)N0Qib0Vt
zsxEM+cfwD5b4w_`-KjH`{aD>-v?McoDXZDKU&#71s4S;w4F+h%#Jh;8b}TRMNJ2uG
zPoY`|wndo|d{&BXVkEnfIsK>YcR2_{+b%Sby2WCY{WY=qS7k0IfVuAT2PE{X@$Xqg
z|697d7=NcZEp^HAG>`$GHvWl4K!H2c{<m)TLnaS@x;dQjcjO{bI4csuCYSX#r3V$0
ze`Jmg52uvyDY%Hw(i-a*`lp^Vnz+J4jb53%j+oa?OV9$j)3tdbOWDSJKOHEjpLXEO
zn?dChb-E0BsCSnAjET9f1|^Zv<`%5KX9am1FV(3=9!6?_crMZDn=MN}tkE%CM`fgH
z?U{3GC%$`nH}ZO^H89`qpH4c%8aOPA=uErrly&yn$wFM|QQAUCCZ}T7?|!50J?Ji{
zj+XG$$N?TLpep(G6^6Tx=mtnW!UX5#r{z6n$Q%mA6Oeqko_^WznaU&I>*9mQAf-Pe
zs<Z=1{&~!*sG@q0658m;qVt`62UXyOvDh1~zf;MnaEhPP#)rPJL*aGgQ~{NVZ2IeO
z_wSzz;UC6*S*zsCER74?BT2p~`3571yx}5UgAL>2@_mhVjz~9%+?j@(NWPZ%0}2Q|
zclL#U?eJ?Er^BR9|2cKOVR^|5bLR7Kt<M(y9+M=6U2kux2z`#=GjCNZ6{NzmQ<Uhj
zEa;cJWOGG$-EJp17Q&^@iRkYjEvUsF&+0Z{h9z_Bs?2s?I2do(hYMS{<go3Ex_Zd=
zW`pxF*J!=)TJCLqfr1dUBP_C!D-7rGIX0j~sEuU8upPsH`qAFPi^?<KQuo;`&aEWU
zl>ukK&_AH_R1rdYYolaG9KC62M)ohRO&2GSNcbZ?J3G~?Cib14l$Uxxr(B*fbwLEM
z9Wc6AG=-=;6RI$U^a~Ev^L(R#mRM*REbM;oY}KU-{&XI#enrqQ)6%Kf1fn%58mO2)
zBlU^swir~0#yE{%ORc45C*Q%X<R#^jUS8jYaJK#4y$86pXzAZY7^Y!W7m5+;N80XI
zAH|Q{erVJ{;M&|4(;n4S;8VyZ-fWURa!9QE;BvE%w>7C>1}rUI(;`V@zO%F&p?;S9
zmUw@6S+rx31L515sgklllDPMHL{dWB>}5cN>xDT3zOO2MQdjhj%B6dY;5BP+)WxVG
z!21iKs+<(6^O2e0#Lv;BN9Ue9n7edQqgIM*6|W=T+n%5FxDtKaazHx%v<B1P4uMe(
znZ{4+^j+X2bn1OJ-Q=Dz4&yLh{-#@EeGPqs^EJJ5?R2$!b;2l6w%ftqc&tM!!0i@s
zjGDDplB3l>koqsAA#!!*@roWDSC((6dYtJM<v9yxu}YxWAUVgePQdB+{%!|~tuD)8
zN|JrZe6++{$^4tU=Y<7{9qYfu?g(}7@`7VxQLc1le__s|fCQh5G%%8lu-FcUpoXv)
zBx#q)_Z~*+)P;8F_<2!Q%I}<N#yT@DnQ>~yCiK$v-@-ZNvP2~FMdm5OCt3st21`Vg
z>Z{g(<qYrsOI;aA=EAlD1jLPWE8@f4lN|Q~$U*I4NNk1^>sww{yObpz0dA!>PKt$}
zdmi#MnOnZ^O7&1!<|VuS*Q|U7S?I4_@I(j*Z66mw6FkXxMmu9?Ht*Gp?y8!7dDc^~
zUfx*g;Ol$OrMT{9Q^K9cy;-+!_I!_z5ZjU@-;j(_^>d>rJHc5|JY?BU^;<;lxT}=2
zwNd$Vi@+ex#O^5x4}wrQwKpPGUbW(-MthB8RIc6EJLc>yjq8CeCP(UdBN-=?2NqfB
zP=W!Np7z5R4OVp`TH}E5{kO$A#LO~Mz-AVE7g~NR@ke3OK#)0Yw|~)Vd9Cjj7(|yf
z40($!*KPrKld+CjGf_P{c$2uTNQDem1^n!Tu?5w?q8<Fu*ArjTSwDUGtVo^5JBwf-
zp$zD5i<M<zs&u7f*fT;(!_xY#sYhWJW4Gki(gKP;xH85c{mOjh?9HG0nLbkscsM<?
z>%oUnxrVw;j@{b9VKj!Cgha>%Cq-`0Q^J049|qmbVfeb!a4yb>=?mxa1R<<-62gk%
zB<n1#rk@F3>}WK~2nT4<D^Kmziw9Vwcl6{5hg6PPk{PjJTa4hT*Fd&E(?Wy??^=;&
zhWxvyeD<&P;bZ2$u%G*~!Aw`1yrJdUM?q1|8wnz%VY#TmOx1dFDXF4MBx5p00uv{&
z#BXljD6CXBzaQP*0J&jH`AxUyOXc8Nrt!&=j>xhUIR^t$Z?h^v;ZqTSNEuKIef>V7
zJ-QceLob=^a$&Q7E!-GB0G~rd4oc|UpLm`!xiMoqe`)wZzOc@d2{XOZSVi;;w;yBO
zSe9lOUUEi<6xnQGfnSSxP<B(SxbJhv>$Vkx%{|_aK_x4R37^7;lO-}0m$BWuGoHA^
z?G6|GES!$q(Uo=DMb5!%Hp=DvWI(@}?FZIfze|RzLaL9IqCcEv|N2x4H_X(H7R1mY
zZGfBn1!5IC!%cFTT4^D>7cOYI1%9@yNO-xRr|&e5Ghp$kcy_K*`{C%l3%itELJ^)T
zm1w_|6@t0;t3r;;>c*Ih_w`R6ym)SD@lZvf;9foB9^TVfQJ@=FGJKH-m?E*rWR4nw
zGN`kYvpQxTmIXMeSCx^gU@lijXISj_>2(^?{myfyJ4%Mke3`9;>Rt_loumNjn2VzB
zaJ7p?*D(2_ZgqKW<*4(|=5e>5Z`e7f8Ly<vKnK=#vc)^Mfev8aYAhqLGt|^kImPg(
z{3R^+E5UQHuyTV_n4-^TX7CI8j8XayxiY5>SDOZVV$&<&)~KOBpo+z=#V~m7VK_>X
zs!voXSY8C1A`s>dX{#0P9H|E0UL!~4XHv8sMmhI`Ivv6WzD2J=`BAMXIdU9DegmM%
zsP@D#9ISKOqH{sLxi0JbC{@f;&LMoP|JG_o&ht@y1zk||^;OKfDb!6Mq_qaU4JX8P
zq}g{s_^C4FCrd6c3j9&Sq}ObV+@gUa|HC4mZ>q`Be|1WCttu=FaSdub0#Ez@uXKd$
zOGaj~U0fo)xs;*+5TWL@lIzu@&fL3m^VqX$39=2dK}^U5%dGI`dwGZ__gaX8SdZE?
zRMtg(xtI~7Kqe0u=)B(L^9G32b}aZ6O=jvRd2u=2uC4_W-j(x1?+-|7`*s7X&K=d|
zRnPGov+>M^>o_SwRj0AlPk*%RFRaP5U$v*nmz}~6U-B(r$kD1#)>(A{Y|w9uh=ZuO
zZOMyHi6><y7&ZF_w<WmlCnjg7R)&wPfMt2TRQ2IiZ@UeHjqinHk0PUe{yW6$W^Cc-
z=}l$Zg@iBN*Qzn0y4UWF<R;&*%=#j1v~i=`KqW^$5Pa$+vj!M7f5ngR2V@rC_Z7iK
zvb=hC-X>V6aq<zgaX6WUwq6Y8vz$jd5u+E+%H1}Ho^?nRLL~0V=ww}1NqQL3;~71m
zb7$|TAb&8qsmO_Tjy&&{k5p}`t(!z$bFBDbu&M;H$((sqVO4o}l`BC=U>Y$fg~}sv
zzxfRhLvdFTYTxB`xU%Sp?MrkH4J7H#&(9{J>00SA1zgKo#jnU;#kzce?le&p9Qzq#
z#If2Eru&OZk!(WOZ<I(#I7_^!sEl}CSEm)LG<-@^lgH?h5{NG7W*3J^zha=-CUAn(
zrT>>!iU00r4B+7hhafe8u@vr<OVkIGLP`A%<JG%c;jdp0%;ZHm%mz;0w!{QYO&^d8
z0eK^jIIBY#T3TzHS9n4C1LD{;KoUbie>uOD%0_EBx;_o|f4`iQeO`>jcT$P9cbo1Y
z!G@bJifzy?69+1-Hn`IsCg)k{i`SXRmWOcJM_h(Bn7%KMk9+XD40aNxPEWNZu5C*%
z!)B9~2j3{ZyQQj8)%D4d`@VIf?&{MJn?wb=kt?;)cbg{6@9J-#J-s^#r$apKZ?!s2
z*nLwy7ns!1=>0k4{As3C$FuFtfgC1gK#&BKU;>Cq5JCj1kDYAAt1z@|@UjPX^E^+7
ztNFp~FTQz>KcHqNe`4IbMZzP=5J**7D<llU(5!+hyZCBBE$n_(WzCrV7%)HVMdO4k
zNCtJhl-yj<;6pd6C@K_tFo<q@C|RO@i#C~6wYD{W&7?Mw#1eCdu9vyUN{eX_+FU-{
zL^lQA5nI6G$`{XHC7NuNF~w|ecfb++rqzuXuOBVfG+!G99!kcEx~7!u-`VHik{C{s
z)I|aP$UYWeyccIq<wW5XJ0olz#a(`y8GmDmpiRg$<=89==SYPQd<j2|*JIf;+3J_*
z*|r6)5tMk?o$)#<hGi*o{$9TJL-M%B_6zGEe^){8q3VxuZc~tH7~Y?1bMg@*NYx6c
z2=M#rK>Bp7apxM1@xuJuSiBcXY%h$)d|M!{0~Uv^W@?A<>WVj8lbQ@!xfzAWx(bF6
zb*w=ry9X7}{*OhcFR>0YZNPfE>dEdas1fr^65^N(wW*X>jJWw<*}OoU-J3gc^31sB
zYeA<_w&*st-)dUTB1F#~UqG8TpOBl?a$Ax$>rx%Xd9C|o<@>KuIi^VOqY-Lo8}!@K
zg)8JFBD-ldC0#=8U6t8%@3-%l-k`Qpg_tWU!lRm8`1J$qw+snmk5AsK-Y!6W$4DXa
znkRr$LhZKOOP*Lf$#jfz_lF`;jy3ni#t5kA(%Iin3d29=PBI_Y1U7FM{l;o~s+)UY
z_n|#B@G24@5l)p5+a=!u(~gDovxJ?}O1cYQYuNoraW83h{uWe4@A@%_PPmLgsmzS{
z2SnunFO5Uank<=Yp|dytfG#wfdQFVVy{{T6dl}qsbM?$>>R_az`XjpFuNQRbBBRrY
z(5ORF)+JymWSys8s4SlG?Fex4ji=}3+URDkagH<Iw-R={TMxAJZccsl%1X~7z~IwW
z#wT%T`wS;za^B;yPV-qz)z|jeN{N`7Vrb)=3_WA7M>{KemV-~(x!sSzG-iv>8;b%M
zHR_9#@@Cgh2KV<ot?lx5FSP9Yjefm2e24LMdsu0=&?ZHZi0+t)i^5z)%(nY$qZUgX
z(vp)gQs4|v7h%0<V#a{-)C!c!=43f6fnh=HE^X~e)J6WrvVZsWvlZ=oUAs3kdyk)I
zkmpni?<3+~`5NOJ4M;Y+)-B4pnT>LtYC5&M_!8ZI`-{0Y45m)I=m?_PCTk%9<cHCl
zFuxN*xuQ_$m8XT5WP4>oxVRt}%OaywOR?v~LkNah(dMb!63dYDC_vk*DvrWS*c*-u
zH4smA746p4a&>OkrD=WJen+DL?kSz772G4P5hFz2Yy$#9Ak*A>nLQ5zQ9W((j>iTy
zUy@yfG4*L$X10=*8qq)dRbD)NsL|~Kg31GB285pKa}ol5bz)B%BOB&RMyP`Eb)Ll?
zp<-v6ZJg2rK7DXV)Jw1peSNlQ+n9;p=ENUpTycyGgVsPh!ZBBn>M6R-h3Z4-7w&I7
zt-Uy;BQ=;=&s@$e`_})fEjgeCiU)UO@gc9h#jBBWUWf)CWQbeA+&zU|Y)QA52ZHU;
zNe+xfp}X<g9%6g^v@<75K2bmiq(HMTj^gKn64*$~<MNkIFct52lOInAnUi@SrO)HM
zPif2a)DYYSRw|nO1|YOjw-O{nmXe%la+Bg-d)Z6T3M*xnm^UROFiNX$Sy~NbrhrsJ
zknGr<-Xu8zi6t5OOR+^IU@*d4Rp$$fQ=3;x#T_T9x;lrv7>3|VSzX_oHm8OL>Hs7B
zb5aj6om6v@g|)M=zu10gX!%OIu-EiJr5^th=Nrr72odn9^=E_Uplefm;P22?WgQOc
zqU2@0(StuAPKU}ALQBYu=9G?Myz{<9znJR%sFW1VZVs2h)khlYeV^*Fp~s{qd{!8S
zmk5m%f1*DrA1E`pw>NrCJmrx4LUE#I@eg4k>1UbsrK3UrBL@Bdd0qYAiPG-l|BfgP
zpc?8h>apHrS86qSBn5PqF=dx!$w9~^Xa|D;E2w%F&f-jUk@bYZ_U>+}CG0R!s-kWZ
z6INy-b$DYmXWA2L22_f9djKEr|G04PNRs?_qvn60n_|J_TwE{hG8H<ddi95y+xA}?
zJu#`w`|SXHW2g1Ra+|Z{>}Y|~c<A~(GU6l0Cp^hM4GAHB%v2+Lej-QiilGQc++Pqj
zO?B69v<YCmg~4~lMmN{o=+Ry0h`C)f5IPA)l#vYoy+plga+Uul(|9jus{q|KOhoCx
zX!HxSdZf&RznaV5>`&{E^w-sO=Frrm9Y7ED>(TgcT2%g-3-W*Hb-F)O|91$brTlnU
zOo_SxS;&~^J$h7P%eMD&SH2@7z8kc*=D{RT8DQcGS0bm<Zn<^0NVXMHzO%GmRf9j?
zseC09ES{rIEVWgOyJr<@5f;5+RnQ>-|FpjEqyPOQIW1PY+Sgxlv){9UERRdaGLZRZ
z#?0JQEXRK)8BW+i{q;9<G0zgF+|GbMMIM-6FLi!+)#%mzyhGR3>cTHtT3-KF+lplp
z-9oE(c@g$c38lqNCGr-25<hpID&v4k&JlK*blK#dmgVjGzWcYnpEWcv%M>H<cQ(dW
z;oJeumQ4XTurtH1#eJdobCf_mP0G|wR4Zv}_#R+{TrWX)HIR2dlOxc+xk$|jul}l$
zCr@i0PsRqW#Cd7>N2eX%YGIvBBSltoH_4-QCXg94<J;wl$mTf2It?BK5Ok{ocm8uS
zu1`3YXU6fbtCz(GdO&o2!kIyjnED{KS=%h06m{gKOiKGm`l0~2)N4dl+9qmMU%kM0
zPbeIy+U}m;lMbGJw2UZwhsMQaUL}5?MY<4tJI}q`HJLyveqASin=*N9$&rki=E$+q
zR^<-bQ$ENi!-;WAlH2kW8>g&l(M~kKLmKoAiv5F}+bL6ExOz>I<pPw7d=-2n@A1=E
z!`kRoae?79pqmtz%7@7SXa+sXBgZtYIg?t&#)^izOlB@qyHEk`gU7n_ddAvjcZ?Z>
z&)?|+p=zm~<o+cHfJ!Y{VTtzLgB=FLIg2aWI_d7R@$qdJRJjv=T;Gzd$I(0OO_2i0
z-jutv#S{~WAk;xpa1+B!Mt}K!(?O7jFfqGcC?{PzCN~N)!}r=6zqU!Jlc{#BR+I$x
z_z>c)x@AdrD(}e$s@e@R)hC64l{Q;r-*1{uLtgWl?Wt!bQw(vtXB{#b2`N#ytaEK7
z7g3F>y7KBMO1y=(P;@}XSDAoerj@!@>~zxd5THTLMmn7n>RPxtsm?t6YyZ`Sj3<UE
ztE2jbNxc@gpO)(+-njHFte^2_sov$JHgwxd<ef4yKL87!r)uFOIW`-aBIN_7w-}Y}
z3ca0JNw0GfqAWVD=IV;1NJ03^eG;|jP!lFN7?nd|6L^>boUdEiTli^pfgiI@X=NcU
zIpfO}E$=&=B>EprjdjU>5iu+&UY^q!JO>IqS#~jLMOPGTxvPI5T6fNLSNOSqt|_jB
z6+P=K+VJn1<F^u1d3z=866U_2=9x#_TY5)W68%X6P0hl59nOz-bPE?0QydtXcSP~0
zo3$|Wfj@|h8|JBesJ}W#U}FE781)lg@dp&?4Flj7Jn>^z?I~<J@#4~eIP!MRrE{VW
z0vrc?T^NPS6CL^@@bOJ4jD1O!3a|xp5Ec0N!Q~sN>KrE@mWh}!yo5zZ=9RGn3kyqS
zOG(4}3ig^=JDU%ez1icgT@$Nk&$HF-w@*9CK)<vj9=2xDlh^Q)U2)+=a#W|kR%yOh
zEk?9HR9G?mn$}ZWk0xtxMs`1@b*sNGcl@M$9PbA7G}Io=Lg)UKoNJV_{#>G(Kg?mv
zxr(+AlNxe<ime96LS4zKcL;EtdQ<*7`kd-*{7C?8OsJWVS@8PsGrx9>O~ej^P!D_i
zY_Dd&bDOiRF4Hi!e5!RQ7JC+@h_ppV3SJ>zt6S1%UK(qbR%k-Y&n%d$j((duTe_n7
zRrvnk*9P$)Aa^)$C~wo7>V^|0vzXNdskexA;my#mR4s+t<CvDv3g2^;!c&IRZE~-L
zgOy?@;u{_@aL#G_UZixuhag?Bh|x_n!8j_8r)}w60RD6q;ZvW))I-9`U)Yw@EO$TO
zWAkFUq&OAk>56+ZhYwO4BXyl*(XODrK~GE4)Tv<d`f{%uQqt3Aii>Zub|yJv+}DI{
zCi>pho7^VJrV*SI@7bzN)^)Z@h}K5r6^bgE8(-Q&Z?WM|%dE64e)U+^{bIFD<&9sZ
zzs$5B(lLmZpqx-6<+Lei-8SX}!L1$2av%wGBAh?>Q_;M(1RtDo_#`~yI@Z?smJ#y;
zo8nIVt+kjt@`tINn=!H^=t*?V1mT8s58<#w!s)Z#b=L1b72(fQ?hIEAZtVU@^nb+E
ziRQpMz+xda*zMb2Xnoi!?r;$T>|L|)sAQz-lUK67v{>5Hb+_x6v)LgxFNav^u+DaB
zOxkZdQe??hBtx>8H{}lCjx;RmB6V=n#j6-g6Vm`npf+!TzK=}n##K9$1PiAd(O;fF
z{m3?fZsW)Bc4VW5W)8d3N9`x50Y&{7`#ztVu_}(|6+e??2Z4av9kDTB0)?P*6(M!Y
zsqEL|dW$md4L;WoprP-7?QoIqGP$qJN<rcIpulqkH&S9bacwJqX>mrjQ>vs2zK#kU
zXM-e{<s_8kMT)P{>%Y4hv<3?DzX(sBgm43!*o^G5Pd-H!HI%kbzOPq$Z5-)~-}JtQ
zzwvY{ab`y2POO-7NwYq`m}*;OV<(FswiQ632)iVX;pY#!fDxyJk2I0`-Xoi-gU>0O
z_v_r}?jGt1znxlneqL-Gjf=suY&XkORGc6jJD=vilJ||%54Zc}Q!@S%dX|a!IL99F
z)8C{Fe#qmkv;FY<abPk40YE9f6+N)S<V(jA++`-mfouGf$EY?mJ4OI0{k8{E#ndSo
zuDllKHCunG^YLa9Ozk&&M%>jSl%Af@%aXS4@2$bFb=KiA&2r*cJIi|=ix&>QYpTaB
zWqV5)Pm(Mw_HSi53#a_F)cm$Ijlb2S<QzZ!_|7ps1`rT}-~U5H383&&?>2_QZf#oD
zg=xLB2hfgcTT?qYl}RS6z4>i9xrfHgv;?GfT<`*4MEa1Emtky9tAi)ifwv|p#?5IX
zJ{pzJz7h1U=;`ezJSx9(zXGBtBuYCwfnJsXFrsz?l_hA@!8S{mx?<uQEM*EdQM$ct
zqnWZGW~@N$Wqa1A67!Aj`S~rJi4KLsA*&AE0iG^uo6+e2Gm>xacFdGCIdM(#ea`Xa
z+*&V`uGjf+m7n9t^(%;WLH0Ys5JT>w+(EZJRTo6)ET??PTc4@xP|B&VuNx6b!FS77
zg&dgLEJ_a8INFBrXEV~pGGB%?qgkkQj)bOGf9M<W1A}|!1~(;Q0=`=I2l%-QRrm>~
zIDYt%;v;;^=S%ySvmk*3j(_Ic(ZQ9Fw*jEYk*M;FtgpE9JJ1Q}alJ(NTB&$!`;{d4
zEKB*zue>B6$S4BoMd&UpM7*5sR_8WY5GL3xKdtC7GnS?$xVrb5efk!!9RI21L8)Wk
zaQdNr0T92uJ94Dpf&VmWB-D()Rdl>*J?l{F+ioQ~O0{3gknQppJ4!MC+po-4TCo^;
zzhdfhIr3N0V4*?xLm6X-_2?uMppJRU`maRYb>OhV1#rv0IPTi09;+Lp%}R$k11yE`
zJ9f5g%kFn%OShXs-9Oscmw<fUn}{w!AqeiC_-B>~{!V|l@SN)BN$MGX=Vm$wWH<-J
z+w?94ITimS9P+$d7mag->b8`j)9z2T@{TQF(Ym}N`>io^Ae!OEmWKQ)<W#d!u_|9&
z2ZXPG6_MMvRjx1QPMTGK{F-vgeE7Q+l_#~96nUsjfW+{fF3KA!K-v<#PP=%vzgm3t
zMtO1lfv3A`pc&Jy(BSJ<9J`kPG;%_>S$rXJQnDJ`w?%{H^o2i^Fp4ucf#Tc_57mw%
zy9qnkd_>XR3Zh_`QbYOp3%#XyUmadvf$(2Ck37KgRaVb%_&J;6k@2)wzku&30pRBV
zRAtgu>(<YkU;0FYKs!#oIVU;lbaUSYTCkmEto`D}Y;5xB*X-;7aq^a)Xm&Oj{x7cd
zzx8eZ`|C%W_=517IPT36<OPC6hsELs8?$#2`44E7zd(_ZVaBhgpJ#(^zV%9&G5E|T
zELlZj_E)OOiCgWeQPFiEq-snWOtoQ(^#Ly+l?fq3YRi-IN=^RqEe${qYttVP!s|G=
zLiP62Jfz*6GcNQui+A<d?_Vj`t*ySb^z8scclv~r`brw71fq=iV&olkG_fYDhiIR^
zi+7VET`gMvfJ*-+8gRfluuO~`N5n2kw)3~}b>QKV&dn;GcwRmMb+JN)mi`>A=aF=x
zr^YW1a|u?{ZM-)$aw{vY?!R3la38OtuWuuxFE=O@D`%KEFrWcCpZD?6sjp%yMRBvf
zB(0k9!6e15q4R+`7LH<Qe$Dglv<AJnKOn)fz)E7zTX{)l#W=6;KHY~M`fd`_<G6-c
z3(2Zhp1$iDJl%#0wX5geyv=-1H*RP}w=^_UMRFvDHd!ylu^?fDouZ<R$HfY@DKqcc
z4dhA=4cSantbd$0a79o^A!KesnMGU&njIPNiEM9_a;ib!^6oLeUmCZaQM^#OioOsi
z@J=?^x|9JA>pZ6jG|<{ixd}Nn6<WG%IWMm|^*10Qd0P8K;vUnr_O*52gs>tl$?#?P
z87l;(jdo+K27BId)u<j@*`ObVNaF-wt?Jfg{o0x^m9QZ;K)d8<9@hooDCl0~nr-Go
z-XtRIVeg-}IaB4gqJXyE0*EiAFt(ZP7w+|l<75dzhZuOZ#h+wO!pi%X>E6Sm!?F&>
z@in_|1usKb4u<%gWF!_l`&PoNDEDL97x1k|<uiBI`7S%OGOdc<7UBW8V~l78u^>b)
zi_5X+1Y%qpxuoq`-5A^(IKBd_FHOPtk^w`TBNV#~dApBHa8UgG2lU`cEA9KZUb2yz
z=HuPRfx4yN>OZ{vVlae%3uIBUR66>J_S=p;>*h$lnP51*zHd%b&e8;qNJ|1s|M?N=
zU-m^|q%ko0$+j$pCf7s`A;Q{5H)l>Zx)Y!26>TJd;<GiMM)Frj%7eT#A3Zdsb|xLP
zaL^5s_1hao-%#ZX5IP+R{ahdNH80oc?Obb0u(o>hx!zC2b7!Y#q46dVX%ek!2uN_`
zlLV^cG9YM#)2<PWx^^RK#A-2V)XlW^2d=zzyLVH+3eBK!8efAz*`QN_V$0yrOlCmv
z?4az1EJ%-GYgA<m%_Wk%imM*5#$V?-ZR@VER4uS{_|x9UuXH04L_h~asubH`)7^_t
ztH`q1dP|f*+fM;sVsirh_^T~yEA!{}#a;FVy697ueSAu9!($*7aa*%QiUo`lsZa1S
z@uxZn@g?W&|FEq5(tea^-UmsqW|jPl-vRgBWc=wPra|;6s7=}Q8p*#t{Sg_4>$eno
zT>m%`-n%!yP+7NN=<czn`}GH}(er}QCRnr;sDZc^0`!NIU~IoeOK3?R=f?!*R6`_A
z`c4}*Jzry@Z+RKHcrHBoCg9#{8UZn1yxve{brxC|yaF2`G^Q@;Ab6^AOx4WEW61l)
zR86k8Q(^m$3}JhWcn``Gt1?b)4ZVuh+FZ?ILw9{77lLD6o=m-K_7wL?E2ps-!17y0
zwu+>VgjHFW{#xVwUE^)1gy_DXFBxoJc5Cw|uwc|boBGET@VWx38}u)e9-xo}1}?&u
z!I8I`U6#R&I)W`o-)9TJ%rWzTId+fkr?n|c^I7DK_f5X9DD08@u>kma4mFs?2$-Mq
zGJ#@%Ec&iQRXJ6Ic{L7M_atORvrbla0LQM&`jhn|oy8)T`Z=mBd2PuMmlb);s(xie
zbKRqMUo{~lgEPU#BqCuVxCwOc{O1;hND!3<@D{;vT35>G=S9Z3mQPCY=IT|2Efp_%
zMa~UDBW~})-N>+ZK`sI$%(+<v*K%!EbHr<WZ@YL4Z~7v_f5}jTS5!DNFY%$?HDLWQ
z;Ny6KGldG;dNCX&KB4Nl45RP=y4g6<nQG$uc+<Sz?^;3~JN?3`N6I(9oXtI(4FauQ
zq%or@tit_Js+iQ^JE_HDr}Hw(HuCF?0c?>JV6kb?2Yr=d0-ZJg_n@GEH@n34d}(Lz
zQT!0OB>VKc<N(6!S=h2zHEnb}zdmeR+H`$dT2nv<<hP>Ajxw^!QceS%yexKO+pM+X
zA<**iYI?OZ>pr7%-vYKmSmM=sFPX>^a=W;#l*ksiT|PLc6VS9bcEEi9+*hlOc@dY~
z^8VLiEAUy$vRw=z3Rg^6C~U5uu!*jD@3zvfRxKl@%tTk~SIL7P1TP9R1dCNkcHFGV
zeQ4qR+q`biM7s0o&$o$-2kYd_BZ|6%Nux=JzM8cu&qVVRxtaO(Uk|3XS6O3o*|weq
znAA?Ka4Y~OOK|S1MOI0a#EdyYtgX+<R^+5CM7X9Q^^wBJ6?cx(f!?I|kehB+4=48q
zp9Tt1n2<=oi@r|<Rg;T|iU#Fl-Ynnm?##?N7K*?A?()hQDpy>2{~oVq<m(?t+MqAp
zFD+kHem!nV*3J^<FuAw&O^g`V4hMYc4E)fnh4D#J_2%xGA(!lD`Vyq#Mx%xCicq=a
z^lub9WXGzo>HM23o3T#wXj~4q1_tD3R?fEiES_2$^@g$|N{=n1bLM{x1q68I-RjG}
zV8Baf)2Veoar^2vRP5}k98~XDSq9Xu5bGEKY+D&lq>su1pPRmf=hux@JBUR8=)NN%
zFi<8}BwQetAjo+}$a4)q`~K0(akRO-^%&s;K8LidylY1=&Q7#+;k6rclRh;Qq>STy
zv0j~aeEP=AOyNv!cAd+t#RXU1@10Q(t@7UH>ge>pma}wXsM@b~f5E~rb@KMpT$Gah
zPjuBzO`tbUlB{`9H(!j9S#@FGRkPR%yHGzQtSWLwZO~~Vb@z3|!P~l%CJB={K%;*n
zln_vpwl4V{-Aaw~_$M;^?`!jawr>Bw{|@|T`2Pw;mLZ9_81;J*M1~p@LyOTPzw7xP
zH?$=j3tP|6g$S<Jmjw%67;l!uReT}GyAmN0*OH7Tc%s=nz4!f4?ZPu}{OQjtPl+rK
zksIJ#)smrxsC^wmPipC=<-`gTm%?}2zMb)twnt*WHV%qtYv=gjuTcBHDPn6yK)dWi
z-GGBjjXGMJQ&bEAxM+R<;GF;UqJd?}SlkC>AOH?L87{W?Ha=p!344D@&ZM?y;LV%u
z6n?$m*Gd5gw;Fzd%9MvFmP}TgQ*nLS&1zzJ@e(oKkKg7=G^wqWhVdeVQ7y1B{=ia!
zANuRWu+_{<c^Nf75cw^(vnXDFi7xG+e6gkDVVo(Yf6P&`ap>pZ{md0D^*Ehlbn3wI
zt^aXA4>b|k74m3PeDDr<7?{A+dOXfXp6a=54sX0Ko4@{;C_7+sP2nR%;tua#KbGei
zt#&E~5k>Mm$)p191mx5%EUT(y$;RQ9AbyXcRngG!A?Pfho^41*EC@)Gyw1>t;imx#
zACRes;rYeIj$mnD5UCyW`hooJdib!aF<>|$G;v2iOnXlFHgac%uJuTx44A(w3e+_`
z2z%PuE5w2h^@}ZITdMMS*`hnyB~?0{9~ZRq`R|;|esJXpn@_mtDejeJPRcs?ovJ9n
ze~|CE{MP4bR**OsMlzq(tc6<J?0v^hw;!Pl?^XBIxh_aY?ptz`98W$rD;7;}0{vM=
zO9qlp$5!;VOSipL&fL13BKtn^wor(f0PM>9VDNnq^%L+7WvnZr&tqRfrw>UVCQC%J
z+Gv8~a)9cB81F4t$odjBcR^V$q3J!1cvr<_0S?3;yOmAXEkWBi7a@*TiX+WNU;3Pf
z^4I-cew&ymrk>C1jE=8THQWJ!5}_|=WYkF<CvQrB@qr_~qO!o`EQ8vK-%S(KYWY8J
zxVy>NtJuV9eCrU(Io+)C@FW3in{ksu(SZR>nrZ1hHxpWSl}pS<Q1@MmOZRnpFpxWp
zjYf&11_2(bjc6_a)tRW-yj{cczS2x$E2nnfX78Eb-nVb8bOKSgfh#1oXF<{?_PnDh
zquY$sZy=2VjTf8(#Kg#6*JR3$AJ58T(m7IaSs%=&EooM-r+ds#=359;Ve$~L!4g22
zRW}arNX!gcFh7sk7Ou7ZF<dRqYA1ueakoi#nWs#Fu(q{MQAem))DR`#p?DDRdlOrx
zEiK!zQPwV=ESxtVcyyg@Ow0?ubBX;r12L6$mhJLM64n(O0?<~ep}cpUaA>C)%~pM>
z3T7uCpP%k(AHPQGcK;UlE1QpFLJYNMT|mmeScWie)E-Yp6?Rrx%$xTL$Bcyf$G-Er
z`T7nn$ms*IuFdUj7W=^&dAD#H<1o@B(1|;N^|&_GDNx+qRbnM~h`+KF|8Uqn5$6Ak
zdIN_BVr=gLogw@k$LKIGTYGog0`q&0&V2V$uksi@5l0bw)P6A#?D5bpcqp6`iYv+F
zn?&m2zhCQUL$j9T2E9^D9k!U3{~ppjb?338rS+}4s&`7aRnE&sQVK{wdv0(9m5;1Q
z_)McLNk+>-dC5EEGjc_i$~yx0uM4AF+&x_8liB6_&JM8DPB8FCp1^<sO&Jt%AR>dG
zU{AX^<NF81Q_w}ZLF+H?O}a-2XshVsWi7@)#@;->&B(^Y_=w49X_0FI@dURJw+xHn
zOD_F@w$3%5->id0IXRRfL!1)nl#JN9&Nd9)=_~62lZ8=r`A9wTEOCEXyUdrJ{I=6K
zLH|@$FV<mCo+UlKDfr^;>%1>7y_Sx<e}W~N0Jqt4%lYLFLB$bq<h@+W_p)ZM6h<s(
zb*-NRtwhNQwUwdIV$U#oh(!YMq}v-T*gKgB2|@{wJv+=Rg)}AQzF!?2!~w@{Kh5&a
zxSFPD++jA@q%0Nd0t-Dp?7~i4<Do%FNe0V}<IulsYu=m}bSx3k&yNT+zsEJKk`#Fy
z3Y43``UrMJjV;ovicv&<Wr3-l%K}2}z-<@oDlZmzcg(mswEfB2f`M1!)rY;$IN#rx
zO%%8vuQb%NSX~$A4I^KNcb6!`7)|H(2|7!83mRC&&k*lG?e%y$sWnHLIZj>t1Gm`A
z`%?V1COh^~Si89C<(|f6a(Z_bprV&->|u^vcYZfH+JC5s?ibQFe+b1Gyr%IEdqH`r
zPh)#J{Jm>4aPSakm*Q=gE4mUklh06uJolg=^PCwFgVV>z-yU<Swu;JGjNYig)bH!$
z-?xeKe9tQ8e_@Ay`kC~=rk5=mPC}af2)P|VUF}MISoFCzN4XsoP;!^ox(P8X$)x@$
zQVPU)N&tvT!KFc}r&_bXsNMw#K{Og^pNBAcMtC+8%@<Ny6mTv&2o@kedOu1f$6HK_
zvGg^ru&oQ#U=l(uBfS7NLC=zYJe&t9O;{}}dUiX}sVU>ujNYo}M82osI=Ct6*<X=+
zMURa{o5m+I<j;I5N!S<Nnx{C=)5amyJ+aL!gw?@8bVw$6G&fPgC?~_M%$xa|rt#y^
zn<7n;=@kzw23xyAw{w@>$P%JmYJ$6em(&p0#B=UL|MZQS=(~5)O_!p2YaLr}8=<Rp
zJJjylk76B>yoBYY-Hs^HF^nMDTA$EW+~nK!+3cQOT%FQf`KPzhAMMAduHfCKmvKxn
z-u-140fQ|yRDRozTv*?N9Vsp?wY#3f(I;14RXg!0R~QFUKHFJUOxP!@v_Zjg71o93
zZA&pM2Ej^hd=8Tn&fA}!>ajNbxN!AtlTwdARSQ@|E{Lj*f1ssq09wWGD!HWSpEg&T
z#8}EWYG!4%V;sZJiu@w+$@ubX{*MgsdReMEfphAuPDfGJImaY~;dA{Ld1@ae3eE^!
z&V$?DSaE(#$5O|@K;IzAOa+m_I0;wCMFjs6Hndr#*rKS|q|r6b-q9oKYVzyK4t6Eh
zykNSYmjtgfO#QpI2+R-ZSi({*U=jYi?La@ZZ{Di~ySnVPkf#aQ(QT9Ry`L%*Ix41r
zi=p92Z^B^V7sRWnZVY#vZ-go*l$0MYV5`YfU#GO@JYsV}IsTMCIz&}JpWNSJ?iT4~
zrrIy@m@!j!j*0i?LUh5Eu$O1bETm4hgd#0kL}(&Yv<36yx#bQ@q8G+#jK;KLo&9&g
zqw-&i9kD))8e(;MDYXp(LEZy;yW`5vJDA5%1@~uXn>wM~phrx-sPp6oqAV%qq(Z*r
z;?iV;LKGnk*XJbhVtZ2dq@`3>SAjBZdL+ehrS<~qNm9hqvMAajUtnkn5RBAk?po-=
zxspFvf=KL;5l`riako#ld47*!jt#C092FHXg0lz)k~%@PlW81jbgA*=_gZSEi}qb&
zQ&QgxPz1A@&(sjSPKTPgy9K~SFVe9m*Q<bN53_9)gepwH)Zi^FZ;fe;{GN3z+ns42
z5Zx)Uw)d5`xOQ|lTZv9zFi0?&{DxwOZqr0NKEWA4I{_E2ng0t_ne1CO$8Q0-xDo$p
zLpkY`41)_}2xjPFw#c(0**D2vw>c@lH7*CsoI^>Y+nj+OS273qm^bwgNVoJl!@*ix
zDz`}{c(`;oUv_Tj#jCyEMZft^j|T$#RvXP%npysUuEN6pfVKo2fl1KDjcFii8BoGP
zU58@P)qg<I>KDjjM$j`DUWC>g!7B#bLs^C~$v%1P3#Vhvc%zWR@1Gj=+u#%jvp8r<
zs7Xk<$u<~=J_qdev5TCTONfan(MOe`3oAkwg-tHYy~wZ)(k;!?wSN8jk<ZC^V`FVa
zZ5oMWQ&(39bZ84d4-bF)w=oYot*1%{58;bV2Toe2q)(~<){Bf1g#(PyX*<){yl+PG
z`tK9$6Rz~GZQlwnfcVTaWRz~?F&qfB3j-MxsgfN5aeqfZj_L>GNCOd&S^ld%YV@_p
z-Y|y5T;a51^X5Z*SWpQ@2%){E;b@Tm+qq7G+o@w_q22eMOhWI>+$E2v2@6%gM<=cI
zSn+yKUFAXvk6d#)XEl`*xg*FMMEm)6?XFT=tLW*LXgEbnvbZe5QF0WnmX+D^P#M~k
zTDjhMV$xrbnzK=Dvfo8PI$~>}06%ttsz3~jP?vfIUe4m%Jbd)y*D>punS*~|O?7;f
zcd&TTx1(g$p7-ptwI4&~7X4|9(DO8La$FlQ{bqi#laj@VR3x~C-YVOcJ2|gYgB|zo
zG-GuPxZSGI^-eb-*LFJgZhSG)v;3Hw)Je`IdIH)@>pZL*&OlW{KEZd^*VfflbNO=r
z6yB}XLq@$Uo#jp#9QJ#z!%3V!Yy~pUTx$q#Frpji>T}(x%Lf%M2C6D<d1hTN`2A2X
ze>6vCe*hinS3Bp>o=F`IO=OkZ4t4VHPG4O5oKL(<TYEx0Man#s^z;+bcNZx>Wbd=H
zN$9hK+B!6dDs?+0oHS!!sX(T8mmVw#5Ei!e@j9{AfwCPlF7-0ccuS#PuE?5x&hWZk
zDc}AY&`M;`>qUYAd}gW}T4T~4^BVcURFnvP=ZddsXbhE)ki6Uw-7M35pI-cfj`11#
zkMy8EPTV5F2u_a>Y6oxzJ-;P1*l|X!b3vgp=4VxP==`+mhli666MDQL95L+}O=F&-
z+}MCt4z=zVkel47*965g0BcSDO3L^<=2O`(I(Sk=dVBYITSe|BEx`#U(4!0L7tlY5
zw!kf7n+^U9b=h`W4(o`cTSp6ESYB0DB2^k_!&BAlUtA6XA!4NX0mBR{&c|)<qp$d^
z1V<jfT}thQo<o|G0|E9W!V3J?P%b%fP;A!DnaL>G!?0EKe9U|IOdhtG#!U)~#N+Pe
z2jkiL>H75xyr1Gv>j}kk+CE2Id2=}ykCg@BkPos}fVK(;Mx*sNm?Kb}<k`n#TOa<4
z7ys;G{RpgK6RQWsp&EdV2WTw(pU`T>k{8LT+62^_Ks@@w9E&CNVR*k>Sh)a5U^<rm
zO`kB`_otVCj=wDZkuRJ)-GwwJhcD2NT#nMKrHvA=)kyyMoz8Yx(BOu5(_LorifLtt
zj*djPW5cYMXm78NyP~Us*)!i<51dGpDMeUc+cuy5-^_fu@Dw*d{+SO&95m1r5Tv=;
zjmA7H<0NZQ=yaOniiyDIzmTJX*#gZTHNORbEYYu0$0dqoK(3MPPb_!o<n8NSgI1Gp
z$%nMEy(7Tx`Hv`3!|?+(sMeV4L5w+GMTP%NUMAkpRM=gMJ=NDo^^_4~qW@Xi6R3+M
zH)3)5BWbbrbKbrgS$VVbZ3pIjWy1ZGF}bcpvs=AttYbGsfetWfy><!I7XYV5-QL(Y
zb3j*`bVLQho=&NHuFNAs<WzLV<yqk1o@*j(vt9eL-)mw=HKcRJE>tqWF945;d+Oq3
z(ayz6z}ZpfAcL2DW15-s5sJpuv6JxsLfxB(L;3%G|0F5fWZz99DqCd9Hq&NLLI^QM
z_K+=uF@v)2gd$W(vP|{}lbwiU%Q|MrzRXz0nHlrB&(HUFUB`7@-}}C<>;B!x@At?3
zM~9>3$mu-KdB5MU=j-`;Jh@g(-`nIO%PY@v$!%=523_$x*-!ZO`dKPuRat}ku8osc
z=GQaH^LyBKA22J1>_g)fq4Z-W)!Unz4_({gF+cm%V;5`vqW^3>y4xtHXIZ7ePddh0
zI;$oU4!>W}lk^5XSVHu3)EjBO7#Q)TQ1CH&c&MriZ3|u&FYOE#1kPJ`l~L4%OJY@j
z?M>vE=3KA8Bj2CbQ;@f<JXfp-S_h_~g7AlsaQYR1xePocsXq%aWw%%TU@v>eSc+$A
zw(A-1_LIUPKO>@*tK8Z>B@NY03<He!9_<)#iU5yN54tqdMF>-R*!<aYn!QHs=d2Nv
zA6Jp9cc{4MjOTCMv=fnqCJUXsL5xXAH<b<;_LkekUy=3wKpf;3CmOy;DP};MV%lU?
zu*d9y<%Nb#C*tRgJujZyjcIa~m6m5CyG0sZnwu`#vGMnIUQ~+Yi%;f+l-koSfjzXy
zB9!+C>>?0j0;;M^^O8FG8FH~++cZO2gZG3V^V&}bhCgNvTHgKWXqDRYr@s>2U%*of
z1!NSW$o;xxm!di7n5y;YK8AhSE51u=se6v<k+uYLjFISIs1)Rz3PP`-6o6GP^1^&d
zM*$m+JDx+B+9j+aW2R;x*+4of#vQ8u)GG@wKc^qhEO?~@g}YE$F3xXR(p$TRzuDAq
z6f9)*@vR7mac>zx$rEs~O)a=~{4w{eLwLK-v2SU!9nRbxULWu`BJ0yWGO%BItx^Ky
zG7XolFWyYzzcPC90|Ub)1~CS{A*6A8j!dMs#zO*v(=NdaZknhsyf5?RviL@iTu-Ca
zgud-Um09lH)zy=mhYd@Iw5;BE-q$`CP^Orjy=w?9lqG09k|pX#qA&LB*!Eu_(Ldt%
z)=@!rU&Q-)=eaRc*ms^WK<4}k><kiepM(Nf%<BW<Qf}s<kqA1|87tcPe%bE4N6VxZ
zXyNeD^kKAg?hB~Gy5(9jF@6V}!h<Ol^uRgxynOC_TQd}@!|74`f<10ooDhq1mQT4Z
zJ1U#YbN%i|qt^|$@xB$B@xJEv*FgZE@xQuf|Ff^!K?@T-5N7lso-ME-eoi|xI<NQ)
zR~tVbwne;AFN?H{WnT38%3jr8Dj5k>EP#_uAa0{-D48y8`wIcc+7+~E4wm>FPyb^Z
zU2th+DT~{If52awuhm>gBw5h94=1n*y61|))%C3dJ0Mo-h+(D)jIbmG+Bxm&`+pp`
zW2=82e&J;G^|g~4H_mqpw~icv^4#J$T?q_|$t6OM)J?BK&(Oa@Ik)NO{zj(3G>{8K
zuyjb_wr`moSoI|)-8L4Q8o84%IBuu+x^u<+9D8Dsx`t>Db%7Yug^dOeIy70|1w=gT
zOdV+}#iu9F4^W0FOU5f@XI*DGC0rxk-g*ao$(=BLNhr`^S!r8B&r?{h1S+UvC@vss
z0l`gk0WwQwfDX&tTW)e2b#~c}BPwI@9Ep!NIl0wRKRlHQ8p^s;Zg@rnS3R-mJfAW(
zWI)!Br9)S<>orYd0wqd{8rrzFYJ~fi%H6(K8F({^9)=^KcddyaIbViufB~DmAi?HH
zG9Kq~o~aGv2A{GfC~kBSv@n7w+tK3cy4K8!O^JqvbYkeMG2@pDcSWvEo$9Z~mRa{Y
zNPw4~z1qt0V^ceH!88JYS_RI82u54g1eRQli%Z#>Oe<mi_(#MrV`->AUv?9k2xn*o
zeJKf7P2&&GkG~<c?5tTC?Dn&}KY6yT*|{QhpPd&~DyECFq+-ycP!=fwLc~VSag0B1
z_Fuq@v>m0Dtb}M)miS4(8WoaCo@oRp9RoO`U0Hd>4H&4Ht6-Aj-&fCTyB+OgVNZ%l
zsJO4Id8{bBOXT+xp>y%N;Ay(D^<5R66<KKQ>7`FdN&LO5Z8|@07kti}<97yR&$DjG
zel?tyE{K|WZ4C}Vx9OlyA^YbAHW~@I<H#e9))s&H!D4?m1m@TG#oV9ld+epPy)4JB
zf8`lH9O}*!u=t^{hfhNDM!X+uzF6KsAs?-8N(_3Rg;hWgf9?Kw)^-JJr<h(U5LGZW
z4l`ff3592@_&Ey5T3Y{$KLQr<uGJa%PQA5)XQwF<z=JXifVl%ifQX-}l#V7?)^nY8
zDM#yI*9T4w@hT5~YV8!txHHz%HmM4jwrlcqRnVi>lh}F=(4`5&xF6@58M`Cy;F-!7
zKYmCO>=$YXe4xyEcaeRe|AnoW&S24qwf?FY8U?!O%uJ)RTd$0vMNoVspLnz!@a%?i
z#m<Um(4lHg`;t2M_b0=tOp$LRd1bb$7PK+#KGS%jKoU5sz(!*QB1qBeU+ZDoBQ9eB
zS_%Da=g2kjLQBb>xq-LzmlA^Pqn_#g8l1m|EkP;G7ffbTZq$<b>)eBj0Zym@9#;He
zW-TW>%ezuTDyI3x>kCeGJinQfPnZ}CDFGbRFw_NLl6-M_{(Z^2bq59@$^)vY9xI<U
zXOl0b+?%GX<(#h6T%I7p_vgi><0-*F9_fZYkoi#`>mh!DY!xG4@uA^ffZ}QVs@ecw
zUPrT9dUuk9eB`3{MP641>qXaR0WCKuJ>YAc`3pS^KeZu~LWl|HKj}<nj5c-)6e@ok
zILUV9gmt=&8duwC1v?>2_?I9kd0UZMLHoe8Q$s%$LAE1W$N$Cf2*L|&cWXvhks*km
z``;}#$g^`gv-{tsC#U+v%FSmrx|gKR$njq00l}HL8tf+1JQjRai%UAO$K$--1sB&g
zS2eLVSgAh|H9Wpn6#kX(;n2lzp~Tjc;I%1Z`bxlckD|H;Jv4N+3lYQ7F00dclQC@W
zR~ksJn|$w0J{%Qn>7Kxq$fX<gO)H;w@!8g%$FRmT9Q}Jf!#_J=n7*Sg(e9EO+7zQ5
z&H|+i8qF0l9ralMGsjsn=^J-?^4ZgStyG|M4-t_FK{^+JH9vZWmZ6V>wp)pzPG~~T
z`;?EFPy9<(a9(k8UQV;$O7*O}gRh<TdBqWCO1(1!-yEUdb;nd8qU+o@KuYYD;&GHy
z*rUEB)fo@T_$lSKAGPuqrB9yGPBzNm@COZc>Kkzw(k>XdGZg<Gm>@HCsU2#oDKuF%
zly&*PAArqz$5*%4ujaj)dHFELQm5)Fv=CR-U2;@Gm7$$!9wfH%4HIPM*zOVGAFaQ(
zo{qqHz^6eK%z}JUAYY7RIXkw;zr!&s;&lx1>7KMEU(TT+HZ}jt6XaKH3H$+0XqAHa
zWZkhXfbYvS5z%YjHGp@N%*^P0(*YHeh;76<a6ORMHZJkR2)1fZnkp#n75yleU&x3<
zC8)I;M>FiE=v31;TI<%p3N7e*g*SE<p@W#O00n)~%$BvZn4zs{^28!~xVo%VpAm$S
zXh(9mtTs6$5L%Q}HpPG9jYleOD0dupKduyMT*VrGG1Abf$J_+z+6|fVCxBA47zmvz
zi5=fHBP(`>8OdvzRF5pg+c<IeR)xJ^7|4Pv%-V;`sVgme)Q@*TrlG{sfE`tyW<q|~
zzi8_9&fabs=3Bq^2i@nb|2fMNdwv~WfSa7Ad?Vr8a0yT-+@mG5qbWN!5F=o3;`#RE
zLs>_T{h4eNzVDMnKHX&Y^XwaiQ45m${S+BM6y+g@@k&V&9uQXtG8X!;Y}Nj8I{s@#
z6ZP$>&7>aQ@21rS*+7d%MycK%q|b&3Re1%^1#ZGQheHvnztYu!QnfNvdT-+;Q=SAn
zjTTJcxpzi|G!uQW0UH6}O8@3SQssb|x`tS^7=B2nqPFB9&Qq>i>+{vW7)nB$vkqQz
zjxthp{?+M%&@u+?Gtf;4FMe$g7sn5?!vuKbIQ}-=P@jIyxzW)Q#^Z2~deu$fu%x4}
zZj-~m0(l!5_=N}my;^G)xwxGWve0<8Mf<(y6!n6a>Nh&LD%boG{apJ;W1Ktz0z26X
zr`^g;IXo%i7fF;{qP={Btw$F5erM=r<_(6h?k8dE-p#9RU7z~{0=f;$KzZw;-v5`V
zpnv|qFn<mI-`{_&#B`z0jcAJzT8z6i`~N((y${ijX*_wkHl#+BK`Wg(fNwXYOA+{t
zKMiIqdPC;i>$?J5LPbmK8!&sGPd8AjpKL-l@8|~oP4WL|0a#&&edxx6-GVulN=<m@
zwE*ZbZPn7%R=&@mG?U>I+w7|4(J;9#_ySF2%)j2n|ATSGkZ*I;%*K(dP-k;D8_`ky
zN1m<F@cKpBH=vDb!0n%JIv)W6tu?uBdTI*T?ik*l(1!Rm)qN6kj#p54E9GBr5cG(%
zh|yu)B*2iXFztrqF;KvLHp*pxMccU0N|n0>$2W!=kG3rJ@9O;aL$w9o*(4Sd8}Led
zTHfg7mW0pU%o_?}oDj*XijY6k^9eYRpw2_%Yj))6m^g7@I1?Op@lV3L#2wTtHc9Ax
zM#RmrB|&GSvgd(zSe1Q5_^18gc`)4%3oiAtiNF3?`u*>Izk^9^z0yLme$KjbY8gnm
z|4L<6T6{a$cc+Z&=vTLW+(M#w9gc+mN<nZo3%mzzf2S?gnv4vh_YSzlMvOXlj2mV0
zpE1>ec_TRD8qI1HeeOGT2m%;<FIsu9lRlHL=sht33iM|_$b7&Sc~118mtH*S5Bt47
zjF~PYKVEpd-8Z&cy|+fkq=T;5|0)myMIepP<*}VfK?Kl;^yO!u{NY?gKA&Ue|D$0S
zX=VP4h8;tD3i@F}313V_0S6trB<U829(ej7Fh@nO@n1x24Jk&4_tq+lq}>oxQ+)~o
zU%2!5cb9I_M|~vS-g<w$=d;;8aelIN_5y^{z4iR?qg}Z=18!u>6H!;s5aoP9(9w&>
zsy*?|NX*R9bdnnT0lqYn|0r_)WKe#Lc&qwMDiSyIKDeYJT`gWP3rXEzGSbs&&pGt2
zsY{aXaQNvHpkpPWlT~;;Yot3w+v0-0#lE>N18RZFyEdLPv5`WG-s#IMOzF^cu96)Y
zsEc@z8g`@m+QD~}9W?;cw?*$Qpa_B0@y`U!b=-V@6a6hI#)^#JP+#c#=856JZYc)H
zym+jc91(Wmm2_f&SG8dadE`6Wn22~7SduV~2Vgkqlkn=NUx;igD&N(5ESs~4YipL#
zC!OpPl!v5}uYXKlOl4+3w_E>>Jejs0kpz_HIT*JJg%b~{_lsKzODamXMk#0RFT1((
z@+3ZrKwurXfhf{8(IjtX?id-CO$_yPJo`CJ;ZUS2?lm{x6pL3;V(KZDpRKUJi+V?T
z$H8vh_k)g71s89ubYq1Uv{b$G2g?MGJ<uLBZ2J(r5C)COJKwgAYtk>gd$6+dqm=pH
zBQ6I!(gLLz&?j3HmlI(p0ll3y1TP>s*!04}PTNdza+!ZeaM4@zlpuTZo2AC>XlS+i
z#sO8;!NWldke|=Z6?4&Ii+z6DBl|#_z&Xi&fp2sAtGHg$^%~|j`k7PM*SH5MlQl%h
zbCAaX1;5Yt5-|83i6gfB?&=g)*!<~UuddD!VD6tR_4K@2pzgIV%Z?uyLGh1t2QsDB
z4>opZ6)BR#C?BVJMNa!*e<Z$BAV_JtNNwPq*@MK5H#Pcod5nK1hfke6hYcLXJTCYJ
z0%QT9hXnj{P0A}`sQu|1Ue51Uf>LMZ?l&hNuQ6IPn7igKm43@xo6~@A9R^mVk^boJ
zRv6i(Y9U1c1=Eafz|IbZg+2)kvxTb>2?Ob{-mNhKIYZWuya8aW;WBt_kqC4<Wmk%f
zy4=y-_9D;qp7yh}wwAUx5Fg-xYJrkE%E5PV(JY&qs$mNGcA?O-la(y5AlbM9*>=Vy
ztPB>GDbTqh1K2MZn<gFJdK^%e#upR!Fp;NeH1CsxmzcwBvfz%9C_8%&$mXm*%12Al
z$8mL#jsh0Mik};v4K0kN)E8FV>T9sb+Fx*~t-X3L>)4DWKa<O{i{Q@lf|3aee@I1A
z_p1->4gA@@%@#KoE|NcA{HFipT3h7+r|jh2FV+dem8;uy&zc$~tZ}}Y-QGT&3pf8J
zg#PR!eHK&0nL#u$ni}c|c{JYCoNdir^z@yE>hU0#wAibO^&d~k2&%6CEz&;%ACnn8
zwjR#}<7=*_v6G7T)X_?0?h^*8uQp#Aa%MX&a;!F=2xh6leye&FCVBTLv-JeZj64e_
zP)+f4lyq97A(1xC@=p(f)Vi1TUUi7L3(wu7b=UhQs_Sap5zwIG+vx11?2c_t8$kc-
zp-yGgyVdpTxxvA6(Skh|QCCkG{*GG&`yuJ>PM=!4OD+c4mCWiC?AQD_Z@HXwxW9h|
zl2pKt5}{r}iA=zxk&)+O3`i|6cjP6eg>r76t*?6?U?G{QyTHn6$}q90zu~ihj}Vt3
z4;E5g=wo<3Z50qG6?l*qkR-iq-f)+66qz1d%BG?8&02zG?xs|gvH@@u4h)lI35ZQL
z!WC@@8KbL7iSr5)+p$Y1%e{5~W{R*zsLezFsI=&xUBP`q3@O=g!UX(N!4VIfR=y6U
z<=&6(sX#FtRlr2(KS5(+3;_{+-S|kIK+8etTeEXi{J|L}d-ZVCt3`}f33>}5&rEb<
z{z+xWw!m2E0|m!$F1cauAmQ>c(nB8k^<Z&scJ>d>nLGGqZsYqYUa&0}#IXE&-g?QD
z#>YckZcmAI-~>$GBU!q0Wa6;$&F;=BpH_2{>Ncvnej9w5lt}wlX&@vibmk7rW**v+
z-p1L~&;y_9=u(RbOj=I1{V9Xke@roXQh9ezW3K4v+BV`oeH1RX=QG(epB)D~zm}X7
z<jnZ&Rz12Q<i&hNIcs4?_MZaL=T_d~6EEps!DFc^Hlm;=IjI=ge1+^9FO%D;`Rj$F
zZtLjNs-zy*<a0^Tqq@hwSD~)M|3!`<H$xvbd$aB6jkcd+!7>m;V9Quc`Quu)<|`_s
zBRn@lYRPNSyE*|BV?E|H$gC(%l5U6HP@wR4EWT^J!xZ!9QOTS9dDKVEsB=}%(za|*
zJSzeay455~)Z@RIIouuWhQnt1ONMKPi?1`jhl20Jq<g47%}`!D8)H3EJyCO|m^$fq
zl!?pT+*v;eQe6SVv66qh1Mz)Wb)b&SX&RM(Y)sqBhtPuPYT!Swou_!CChPEU&05Qh
z`+R2X{i9{clZ`U(Aw^(xb^?xc`zBC^rT+k<HRy8mA9&7Y6L7H+MUG#2R5hxqBfd3a
z+VClE=#?|?0oNOIhK9R0()&&?Uz}XS%~x^(+eDW3AqY(n@Fg8|&MA($j&9bKR_^7A
zuTi?E=1y)s*qK9eea(B-#<hQHS55f~&H;3mr{Y{*1u7=MtJR|Bu~4L^4Jr9eKGc-m
zBP*vXv0gyh;BnTt`@7^o^I-$d#m5hJN-|adOj9L*GU5b{huGhZIM%96J5P3v-7~BU
zR@ITQBXz%=Dz57{=6zC~Wo2o0_Ih%>T}ah~HO+~wFkZ$#mq|fH(@hJiK7BF-o)TEV
z0)RmFHY}_A1d&6_!Y&D>b30g4N&no2jN^9+ccyoaHxv3r?&S@D6T2iUduw7!B3*E`
zfRWCNf`j~l$~wD#FH`g8pS7W1`UN-TX|t(9^GTxvBgg&nEbsCp^&=|BqKH1+ZgY?y
zip?fOk<7n`MG|WaX2Vw)wg#T?{)2?{@0vFxhq!X2?KFjrG|>@;X&3G)9<L(2q$%W!
zjjH_F3^c@YkJ=6D*2v^seeyGo5ABng4Z?O6!6Nobvp?C1Fq9NH^c<}LC=#)3fQ4N;
z<J&cJ0KIe43pS8go;}jXy=kK-s>RLM&vdYhD8{kU)XRYy`|Jgu6t5h-`RG|Cw{dR&
zqgN&Bl9IK%kenN%Obrp4(CgM^i8*f}A4futN@ghz#^jKVv_3rrKT7o<OhFk<U;sRh
z?r?qu-#Vsc3^NE3XCvdf&@3QCd`><Nb>o5N`Om%4e^|;cGiQiJg>fNZ=pUy|-mcQ2
zKuyV8Pb|~gDgR4mSz(&Xryb557M`F?=NzoaM6aFP@_KE^`%O&j_6=F~NXT2hwIz6S
zl(v4L>$(`6&vo5DgJbL4U8+Y5lqQlstjqUX?BTywkN?S6mL>I#^0FW*3O#NcwJng^
zNBH2xg3X}VoIt-!f*T!fQ?OvPiyZ)JM~*(Rn7vsYl)EdaVX$h^S>wtSKAF@<k#{?u
zh+N2xEx7lSPjV+noGI8$spsh{hQ$bkGkxqYh8<8z0L51mGK8L6@&>{R?$!UK18<u0
zfqAIda?C_t4?V#Hz|v18{ly@yO6s6DdK4T6e5u@}qz+>qr|=YSM`K(Q3Ygt<_)Fi{
z)gCm_a$+d2)p>&BB(G+X`cDiCT~8z=Z%*E4yb5K(v~gn=W56*ddN(L){Jc^|d57c2
zJ=&gx&{>(N62Clcp%HZ{F~WlxSW~e9%3<bUWtVi)Q=d3OO>C+2*9X%vObntqdy0Up
zb&~3=>^vf}nT;TJduh4{c7ZIPV`J;?-zPTqt><{(`9wX-S?x*3TR|=km#;$0)KjPI
z?F^kl_}(>HC8Z^+mnCum&kz}4KbXejPYL>oh5#i*{WdRYpBVaO5;`xi+{VHEpg}^)
zQ!vLR{$`f7<=lsFSn+NviMTU-un4LNx*IRhs*REaE;|ztg44*L9z5HFy3bV0`LuB_
zJ+06{<zRAfVq(UPFHd{=;Q7{_h-eJSJS7PM@owb=zT5+Qw_%dD4QjTnHN~((`OU7f
zqztJ$eS*5X))GB^sRriZ#BePLAkETKAcjI6y^6+?g?CIWY)OL^zVGU2Gv9-FFSYrK
zrsK%H{7({R?c7}YxlLCJFE+h+!uqL=CG{FMd><2qhrk`-zu-OMoWrWt4GkkI9F~it
z#SfXgmMX%$hxI`#x>UN+a1VFsxvSUG^%lTqe7tU$F1ZT2U%j)-P{xhTjbF%|g+Zk@
zs<af)(D&elUh3;!V=sRZgI8<iC+8!t>crfdAb_+n92Zj7>JLg$HIMRzaNyG@FuCB4
zm1EqjIdKy@D<hQ=4}huTtM0CE(L+!!v^?_Tmh6>%pVNZ}K|!2V-SrgyDx+P4%_vI_
zm7??~mrT&v^kL{pM_`gvc%O7jIl;s#G&ngg0J)=(_&C;3bn`(M^eFwdGBX-Z?}LAe
z=`IkasiY9HyG>(<LF37(y%tBJ*Nyg^3jxi|tx2PXJ|FH2zI&9&tM^OzRwU~NO8M~R
zWGJ%yy6vW-L(1~Rci6H#^9H_Vb!4QWe+O21l%)dR0(Z=mPdBE4`KUY%dHdTaVEvUC
zaDI1k`b*eH8dD_SqOu(Nr@?b)*$qS@u15W<&(ww5KOm;b7QzEdPw(=SH1%a`ui;Z>
z_6&BCJZG)F98a-lx;l)KeftaP+40oOy~!&3_|x(FA7>2SMxSGijlaTp^(!B^_#-HH
zj~d~RDuTM6p!mo#&rr?;MV`4n^tdpgwI*FQyLZ>=9#^~4oezI8v^;3jX9)M~*G$Rr
zR!RB0U95wde*=Zkd1+D;+gq)|G?QEt8x`ZmDdby|+nXEqPt%o2-?V=fGr&fw5@^41
zZ>Cd#gY2Vmy5*lt(h%h$fL(x2=?ziJk1A2d#hx&!AHzJl!z#SFRJEQyg@-WbuQn&+
z@`^0mq%E2oyGIT^eZi4Euus>7{}v9H#?2=d?6^<izyOyRdb-VoGu8iN8`TKiJM~<2
zP9|aN!5z&%myc3!p~D$-7BK(xkB!OZ3v_`P8gC)Nr(;tpw?cM4D>IZR_HbmYE%d{?
zisoB*d~ZFN30~t=_<(6&_&>wHfisYNE0>Xl9kvBAUi+T2tR{La;fU2C(V(p9ZtY(2
zyJ`HobZ)ax!Ce8ocUYFUznTIvrtL$MBSa)nH4hg>b}v}Haxwnpv%RrYKgx}Hm9=U9
zO+!kAd`7En?#=QC*evxHeZWERsFWt-I`1P4lynMnMjfw^?|L5-=;I}}>nyAkAk$DV
zaPO76UZER%&}jp6oDq0-dEKPG(L=yY_7LdVR1KOI8HTHH$DFSFz&q_JaObvM`DR=r
zE)-ESJ-xxnu*=vhwdf?H6Vr+P#X_)7q)QKx3%<^sB@47~3p+>{mu<5l<X<)oG6@yB
z%{WIUwXvR%^gr=9V<UuxW`(O2$6*_WN&x<LdFfyK7NMb3YPQAE;?@5S`~!#6g)nWJ
zXl@i7XnaVXK#&pf&0z~(YNnbZ_|t0_g5r+5oO7z@efq0nC;BN{L_}Apz@`>e7O<d{
zla}&80a^@M(y1vO<0NZxE<eHF%ZFpJ;6hU6P09o_?Ojnf;~h5cYgz_}Az(&oO&i?R
zbn@WpQ4Sg^(*ZvPB-l>u8N27(>5i8~5;pm7G`@S@cAP=)e$9MjkWyPW!=Ho>49Nr@
zH3zyU6?-ZmM44py=7;_mwYUC$IZ=`Fo!QDlGRc-EIzhS@q%>XAR-Sn7IsRLU<b}$(
zvnqb)ogZ8~{^)ebv)f=8F%sY$A_UVcN$B6nC`t5?qu|bzGu^eJP3I~1TG%D#FbG2H
zZ+B(9B=O)GOiHHDxx$+?_de8d{!hJkC`Zk);*_htIfrLk?oZ%f__A%5;mBT!J%}8Q
zOF1&8e=rIK(FJGze;<v3{PpwyCRvu0GKC>p4z+<*!a7l)GnZutTdO0yWv8~$kQ}Y$
z7}mUe>j%p+q-$tOYawXUiE1>5?t@onwbD<M@X-T>opiZ+^AT+7w2WOaZ)AKm7jGzQ
zbNXV;y$Gj_|MyS?XK=&w0uWvV?Bw)4pd^rg)4C_87LW6`DX-mV6JFfyT$<0oOa8<;
zxG^nni-J7`c#U`=SZ~B?E)_1V%n7lWk9qkx*Wui2sb*3Q$JV5+IfuAhG&&wdGaIsy
z7wD&YNQzzHWB?TO>v5xWfhw|f&!-;uGK|YFg#w~h*^_ob$t)Kyy359^yT_Cgxe$do
z@RR^j9kCcEc&zoEzTdN+^`w<gi3=D?Vi|is=mJ`@0IZiV9X{OXX-o}xd|4B7`YO&%
z+K-8H8F>Vr?&`lUrhBaVl=ZcEXH8!a?iclY-){Wiyko`Ba9Can#Rv@Y!c)cpCvd9P
zcOeNwxZWmRSZ-40X)W-iEy$xr*{=7-*`{0Vr@2!1AE#e|+S2hu%rP6e3wUm|st+sH
zIm{)~kG=Q$SIedCX8x$H4KYa|rwotPdSyONR%R5BqMloIkQ)Z+VAyC1U31JQ5PSN*
zTYW?JgzfX4`?D$sWt1$#b1!PDQU-Rq4Zq%DVE~iVNj6Yu0Xx0F2@_ed*wvF**MCnO
zzHMhCJF9WfSqfRcDsD;TMSp9R2bCk$6+C})C^?s?kVI5GZ4yH9Tb+~q9Dn6Oq-#T5
zq92QVR?<sahhJKx<^<TqK0Xf|k+W?<6R#`fA%G*=puA){$`W2wk8Qz1qxsd7oRyn<
z<j;Qb3Q)d$<xe#668{j0#F>&=DCod}<y1Qe_+g=cZ&l0f0;8ea-|Giqf9bz>Pk5U8
zvEOg-XZ^nNR#>^yV6ZdR20TQE(tBWXN3T^dJhbaTOPF{e7@@T*cNp`6XjvPp_03T^
zktNGew0Qt0eLYG_VTs|}Q8UI9+&@wBWJnaw6*9Rtrr0Wnq;-F~)mvRz;NvS1t#M4v
z;(L(Qna>x5CAA{e#td-td2=$Os8e8XFrKc7BvOgRU0;k;U#gbHKCak~|7|YfyUP~n
z^CGD&e&@>-GZ3G7)fqGs%@-p0ac(}R`zU1?mZOh47YvB!a`Zk`cOyj}FQkeFKAoLV
zr9LA=yK^udDKT^BfM;c=<!I{fXV;Xst}x3xx*H6YPDgBmn;4X2f|*+GDiENb1lr+A
zwh=AkbirGtK_B`WzUOz}n<ctmk7&AksW+<WGwW@HFU*9zOsN23NbhviK|$lB%Kj)!
zi}tiJo^q+T2J^^0qw3l1L|N2(^JnL!MDBP8Gcx+`%FwvKw1<==)<XG^h$S_&>iFZ5
zacJu8+_!}T-%N`;4?G1Wn?CJhEsvr%Ehq`#olgLvkZ<;%3#d6jJYNP>UWpk@U8P(R
zJ25SI?mp+T>bmK{6-#KHg*Babk2;4tH?!z)WVe^H3_=#sj}ILV=%<E=v#x}!!jDKW
zAuLH1AHO@<uN_2M=k6-GfvK(5<){*APWp8t%Uu7WBtajCX@hCYk~`W9YN89gsMqiw
z6KJ{SQAJlJPiu&Ou;=4)iD>Sf%b)Jwe01mDJiI0Bi*B%t4cO45g^&&sP~anHh7Y5U
zAw`Ig_*yJv-4Sm#;pG+BKbp+6*dG><%BXNgKjO~Wh&mzqofFLHPxP@StF&VDw|pI&
zeJ@jkn2vmCQ&U}Y^{9gUb~>?rrlpE%^f_~~=q5)??tl#Bbq>uHfP6%S0ac)j!55&C
zSZ@BH8T!AQy}$alZv9oo=0aT#qI$|u<T{&>Fx%NT0j#EVAtf|kMIsnRR|>9$Uo1!m
z-6<SM_)XG5B33>i>+`TrWl77N;GEapY__Vb$;=^bHLay^okIF4NdiIyl;o_6$;(9j
zggOw$=Ak+EdoZ`8?ZaAjkX72f>6Zt+pNu6XGMBCG7r8&aG*?%{IIJ&0e|-VhQJO4d
z(t;54Yz{7s3^4XAd*01Dv&JxYyJW`jG84k|-{=AVQZ2I#;)KVV1+XA<!T!xzofDXi
zBZM3E&~o><%VR&(tEWvV=3u5OU*@Rh>2DoplCQCRE-yH}VjC2<Cw8MFry1>)RdPIQ
zSJ5xM)FS2j<y6o|*au_uY)a~R?yb#56jEPrJ=qv`b|t@BA3_Vg#kl-9b+b*!K)S`9
zPGv0~&o7{?Pj3YwRQ&X3K28{-J!xRfuK)jXj`G-lc0B$2&zp@GV&d!U)vs5R^q((I
z6EVWK0@k@T+k}J~8?P+NDLq>BJ9VPvqoHKHT9(zxShmYbUm5%iWj<kF(|NkVJ4|ye
zr}^N_AB(~=35yR89!vP0Yh>6{=Vp2qemybZY|E|c*N(qqbDAFl{qK$t>8=VFO{QK4
zVItQ+qgOcv#{$?Hk@TZghEA=d{oMg&V@FpsY-@$o)Z3)^nFPEra|kp_fBm{>YjQ-e
zs5~<M{0G7R0;<ReCax+1^>{82Oi@GMHp1a6R)h#vr*e-jj)g)lS~T8$wCQLP26Yf2
zPj}?xO~gE=1rv}5KtdZ2SYu5wj=SA;T$@?QtL{p@3if_Nu+iH3?~z|Rn!tx<12!se
zAO9SCFtu<6mZ-_~D^hlR03Ldhm<49L#|47UjjYy&E2Ozaa0Ccz3P3ZHrv6Sp`Sh>7
zM>39|#tgVGn8w5SfZ=lYot_2giK4W7i0S*rJ~C+vK^>Qp!gC}WTlJ4~Y^F4O4hLdc
zk%-PD9w0%#X3TcxQsV4%kH*zsgLtLemm^*WcKHln6>L%jr(g)5f5(7m{rB0Tohk{Q
z$DgoBhTqdWVQ^6K@jnhWL&Sl;c`ws0O|eQGLG3iq(7tnoGkO8~2IAqt-e9nONpHs)
zSD|@pYtnX)rfVnS<S!)lmc{8t^BT}}ur9xKdNWHv^mOmn<g2}HE4oj|cJ)d@=@UWx
z2t>dG=kd@PIrWaBr?zc^$^Mh(iyW1hR&|~q)>Tm;V7YKVh^)5-FUMFe2aYb3Q5&hZ
zQ!vBy6guNx3ut!M_$9#@VI{;8$>GaIQv$qr%Bzs3hWgi8KYeOA&h;abry>X}kWx@a
z02gTljMG9vi3PF30XY>z5m=EsBNCo*R$~guKdbw_%Ox{Y-<-F<J?GnYhRX5pSV;e@
zaXDC$ort1yCw|J82Y@zRpu{0#BS$wo*j4fs^ym4Q?~+d#zDl{OP9bZ$G-V=DS{Pyh
z*L^lG`0d0#+5D1EmY|oMPv7q<Rst|3c=_BP+d^NaU2V9u-ZX%A$a@5?u+FPRzt1x4
zWtp~ISRcFud+3mV;yJIw+3EwU{yzmix3T@-3$t4E@HNrfBzsWd+Jy1bv=a!+F*)OF
z^J|(*B@$o8eDK?|_I>^Jp=Xaq9Xjd_vBqG?bEkElO;bkD<GH^_%6cAvA9?Qfe|*A$
zb;|J3#|n%yK8C*`M<-$e6-ewG%p<hO$-<`;Ie$C~ymeWhE8rV;V59e$NP~jFMgvtF
zWk-7d5vEQbhM%s(@S$!_$O#M84%G&SC}i;UOJTj3%P~y~iSa@cY-u~C)D6Z1K0feg
zLxTs&<JwGAL-Y@PZA(M9>S*2PW>uoH%D#y$ec-x+PaW6!zZi7$<-f*eFxDjcCgvPr
zKnQ|0VSD2(Dc7(WH&UlHtK6{>!k_Yf^^@rby#4L77d#(FC0y2$LgHl;)A|L@oQAyl
zfNlRSL+LrHXm+Ir(Nq9qGUP@E!8N*0qjgkU`@M#@_v7CUVAHTa+2-ZTL9?3=4LYO=
zIY%RJj!T`Fdd)c3il}9wM3Af3{5U`cU9*fIdZ1*>Q}~7c35&^!d2K~k?_i;0ipk=#
zWJm(yE?`JnMrEtjE8DL(T#B@v`=w_iFDaX`JnQ7fBqbrkA_F}|AEdJ!HG}UnmeG_5
z7oc4)nCE=<_`7o<fVuU9`@-0R`R`|%W&NtQ=2<dxt_xKcGPmSlHfoOw=~7t*v!>Xx
z)k)7WQFAb068(3;<eoixYk4D+516Ei(?=1tusEtMP)JceDy;i}LIjt{4^hzNpY)GY
zHw*2a4`s!QYg7!qRF7QyB@(;ZgK4{kaY=cOJ3(jkK=7kQr`Bvu;}uo=Ez{SjuI8_d
zW^0o!o$mJ|GxWSa?ewM#+2c-)(?t~)(G(hhS*kQrpe>{zRuuy=4kjG2F6o%+fAO>f
z6du$^-&?fN^N(Rj^)GOWgt-B-ATiGY5TIT!*?2~^T<hs9aX5xJ0n~o|BxWRcy8htW
zm0iDLKR@ENx>ucPEez;)U;~ITw|rGilb#m#cFp%seMlm=-9W)yvgP>>@`+|J@^=hd
z(8di~mow1V`Gm$=yGW!$R?m_6Rn1K|qX!3V*r(XMZ4B|*(Oa;D-P#+99hV+QY$chR
zh`e(Q;UIB`2Z3cSWc$M1x8pPY<659wxq+J2hnRisfhriHbELfcTVPNA1Pbg7|HUt+
zMeH;W<w?`gJDA8+7eVCrFzgHf+tG1qKYZ(0;5>RpBC_U#qhz)l`&F%blJgsF6b^WY
z?RKZ>GnqDosGNM^C{4Gp|Gg*WFkowZ%loaH0xIrFa@pA`+2M>UeUdU`Zf_tjT1C;|
zE_tez$FNW)d>_ucnuC6JDSyNS!Q)Y4VlJhe>3P|AQCTb9o|Vt>HaJmS<^~S7%<um_
z!VOWyim$?X12K>(2V~9l`mDhov#d)a)7La+)`hg$UlXc6pLlSR^XtKje;iF%ILIu7
zf^eAZ$`inosQ1j1D1VXdgQEEqS-Ur?tHwKta?sX$hV;$o(?tWFTHhXCPhKOg)6AA;
z;SBQ(ELSh=-C;ziB75j^2c6THxI5_W_BnZEx$1Axb9MOHx)z;qjh)}xoYyp@TQkc|
zxsjnpWS3_cLWLif@59pTq+2mfpS!PZ=-&y6WaOI-@49GlFh<<-?5B;df0ty}l{ruS
zQelnVf7_solxZ_Py*3V=LYzcBRLVw>(4+A#^LY1^uDaeKbAiPSp$^8342J`og-ex5
z`X*l}VIz~Y;kzECU53m^Y-d3POb{q6Z>#hS*^Ucn^x7Q%rCW%MG5_f`$v1hRt>)h)
zqM>ljkL@&r3<KllUF!>_yZ8>p2yxz{92oC9n9G?T@F;H4vqEoh=uY!1Lbh2t-%aj8
z`lC1z!BjO6q{XDVjIY9PEMQR_q@Gx93$i9%-k+G=Df>s&l-omzd$=|#x3A%OCSvw_
z`4hE>##|=1JFu?*d>To3E3ME_^6yEV+YC&l(ygi_>&*smTBV^omVO!~I=t^AGHu&;
z)?@DMrv~V+kf*(~*@69+cG)zai<}rATy$mP+r`oNWEP+aDyGMgaLN<FDNssW0q81~
z&Ov2e1f`4LKLt{rfT;j-Row<_k-94;Vf!Sl`JPCSQv{}D3CpzO7^hFF%!;3>kYM`W
z^x50x^UIVLsfsL}7}n2s7#RLQJ24He@o++6vmI51rT|>SEMQLqdVGy}gt77szRiIr
zmkpSISTfoYctrZeKX?051Y(*)vCya(P%|lD@1Jkc8y{a=J21>yW1E!Enk{g<Je|Sw
zO48D|_O&-_@Cn?-RtC(shjb0hug`xm^c!G@p;In8rk!-5pWqxK`d~x2Bt_9`z_e!I
zlI=9Mz*lXck`!SroAz0ho3U~L$Nq6VNyBSm*aP2pzlX~rozoaIQ9?u>MC07>&)_xq
zC~c*8w7X={J0Jj7_i&Blz1@Y+Eul${cN~KyZoMo#+54qviu2_Cw0P<`E~j8xgyH}M
zQB^@nzorw$(KuRXV%pi%dD-JIxeRnQSWlcrOfjlNefrol@HmRWNvLn}F9xGA!2#n6
zD@%m6?{G;UGxHDG1#B$70k?rAjdb!LZ&;9X)-{hB1JgTh))!d55{HS2RhTX4n_v1i
zC@8wfE==Wby?0aqe^d~KskvRXV9JlYZJfJl*PUIBaKL*=^JfW8=G^e%=@AW;;2h`_
zO@DGPuTZqR2n?J2i{Wtr=ub@;-O`4Wa9zfMl{Vdva&LW!^px$o*1?w?V0uZB{IWl4
z;i<ChV5>HItUwUP+(k^`M$lMCRT0Ml*MpSGp32o>eHG~WUEL~|&t{EPwQs$FE_9%-
z=X;trSg(F@r>h(lI3+LNB!%2ikFCptd)oBLS^d;~^8F$$(Pgf_(cCz7K$-F3p%Yjv
zvVaXgB>*(^K1lnEp>W|1=Llh96QbTZG?_m{i6;#`+ukk)(H^<$VJF6K=2Ki6Kzjen
z>67IfPQ44Q3^I{81~};Aeh#hmTNB1aY%4t0)_=!%RPxrNe$)Bmy}W6IEP>t!6+1P0
zgC7mpubr{Z#k5_4FZQ+aV<wU&=vgz?{dkfE<hVxxOCaPVdIo=TY!5F8z|HEa#vPcd
zwKkPe@7Ug)5cQd6lu1ty_pee5N8`-yr-W;JzC#(1;4$<wNbeg8nM5r%uj`X39KY{(
zSD$}48UFavhM#QZKX8!{El_$N0`5T}sza>ZPiO6~+K%l;X5UGZVuw67D9c#QF?~J<
z4l71QkhX7-ZxwotjWQ}^2wn(0r8HRdv@`yf_)DxVHjgd_Hg+N8&~6MTbg^oj0%Y70
z!~KM0BA<PlzQoQOz;Xp^4WZ7ctOlkux2R>W9Pwye46SogI7FB2Q-}WdcCi0ycl+=D
zj_I$F|9hlbY!=)L7n5_)g#cq!Oe2~Vy$?d_wqCl_N5XL`S$@So;#i(yWZlI2z)YWa
z;c&_S6RJZf^#1_Ou!`fO55Q}(lLH%3#vs5CCOWq78KZ0x<X=2(s67}`Tj?|_ap33q
z<9~<B@Ph>uJ!t$vMDL8!RX8V_!9Az$qla+x$3T;7!jG=GrS(ukT^prR<e{6~m*gX!
z%OM#iR-P78ZRx!j=2n3lyl|doty1?^{t?IehUyVjE#vjRpFbr;&2IP{uN)ZQJwJbb
zt&=@%11)`&4`V=1+;1Yo6T$I!Cx>yL_}ql)BjImrOOEkew=#^`w7e`?mBAhBO}Qcf
zHpN}(vEX7$${)c2T@1lK8xrIOqR%ED$$S~S<j$8~6$1Ci>lh2Cr@DR@X+GjSn<Nw`
zt!HCpso?vXQ+C&a&MLcrXF*vXHPD$+kj8O&k(;FPw{C%P?7b2Vxn`}grtIan#{wf~
zl||l@AQp%(bYT+6cMy6z1-P~yn!JxH{1t5%Dtl70uKxLDfrp}I7vDt=+?!`lH??rE
zETs=1Y8)C$?bkJj+I>zT)&zD9ef|A?-~2LG88PYt?PlWKgIk?o7Nk`AZ8xUrg>(%k
z8^;GL^UBq)BOzxZHJ_P&q-15)^MCsFt38V{zEai2>%k=n20d8{GF}yAc*1<|4dg2V
zkSU4RmY_<~f5OFJEGXa6O_W5bN48q^>O@FUzo(Z!b7F(8(abGNco<*1p}4^e6Qo(m
z{$P_zwU|c#2=Soz;;Xx6(3e^!gk;F#6%Xj%dCnzv%HJ$23kT5m9$>ZKyts)_lpD0f
z+;2TY69Np$56_s!&9M*D?t0xVS1i5P7ASSGM@nx;R{7EXlr9pUgce1?NUNax$aUzs
zgU|@-0!zYss@10^lOn6ofU@htE*X86=iWcoE1w)XGvUI-w)ydcy7QN?^fBD$9xiKe
zBSq)8a9Yz(9g%oUfeR$PcHQd}Ip5?W_0222B3$&^WPDz4?97Wke1YLW2ZOCRZEFH#
z(v%VhY?8DVyvw`@VhFS5+EBJ6^G9`&OR_@V<hb7#W4<RZX`Eg3vH!K`h(m2w%-1x;
z{~TA17vwYJ(&Mw#V_^Ek6ye}SW|=Q&+fLwMFW^D(6e8c-IZv`TWhM$JcfRVox0uHE
zMkbv%+{5>Cfv4r*xV^xmTI0o9G1mKOW-us_0q#T0Kd^8&Tr{R;Xk#I$2>EljGpF{_
z`eCeMkgMwh19x+9p3O|^GZ%~Bbe`lCUuK*HtPjNH%DLf=quGHkM5~%Gj<n&u^-_85
zWy{^|o435?ui}FjGdw;f<8F;@9|zMRB}wDtKrpYD;Ri}Rq_L~J;JuxlX>Z%nh8r~1
zccM68P7MeoQHc(@oJnMn4q-%mE!91$(`u^jg}{%VOIFv;_GoIxunwp*zUICh>G@)m
z_7dD|FRp5e;l5&pfhfg?pC<w_r>kdgN^xjErHl^;pU@p7H2!`OiPUNQ9xOoPYal|R
zn#0Hm^Z1S3qZ%Kva^djC36VkjtOB2W5x2wvPDwYSP2RHyQ4e|;A~BDfA*5#n^$wxR
zEie#N<|gTN!&;o*p<b@ngOTz_FStdJKR%n^W^xs}vVMQCk*WrUC(4W~YTqCtz;xQN
zI{WK-IZIpHH>$w-a=WbHbLsp+PBT?fKUhB9%f0OE9Y9QSb263cyq4G#(cmuX)vc7Q
zWc4vWuf+XOufVHlRc+Yj-sH{HYsXK5A0D$0cav4_@LAqv_{abna2x;UkZsf|5eGCN
zL~0d9WVZHFM9;2-q^*>NiQ9Ht?YoG)8@ejH(zJ_@&p%}vi#|3+lN0&Y_&Fi0sIe`6
zO>*h#{JvnCp6~S87WV4qhgM@SA-5waBBN$sA9gYKg^$>H+2QW5y^FHn(Ok$$aKC3V
zCNod{v5mFx!Egz>VdaOiH8VGNBd_kAZMoR!%X`kKsB|b`!}GR>nYrDie^XQbqjq-e
zf6`Dd<`;gjaaR-2d|#|QJ!R9mYa;pjqQ0QqKv=lY`wZ`15pBhVtcnkw#ziy{(rCB5
zb$9ac%(sG&5u=3M#+0|tM^mob+*dXDHV<JLB`cbi`Ef<<@*Cw61`<gjQobK7q2YW4
z%<)<(o_B5?DzXpQ$`0|R@#peBTdEr-z(1QhDIKjZJj+zwlMiXkxI6l!imLUeZ~MS&
z$EUO}`u_K^u%~;g2mi>Yk-7I@NT&bDstKH*7=*L^#Xy{<-I!?Qm_ctFe*v?qgb2FL
zL-dTtEja%Ra%B^q+@33IByjLpd~}&~l-&to>%nz8uoO^@#`JC8m?f0?>1#PBXmc7e
zu<k22mTEj)+RM*R*}&oS7bpAU6AbU#_3W%41sNP@%0fC|5+mAngiWo^DV6-cmGB@g
z^{{I8`NK;q`i>_nzU{iQ@GqSE_#fvA{#Ve4CE7!R3A9ICXcQ%b?OMLK=Br}Pxt?!1
zN_q4^$kdUsGCjU2@Z6~jx|45>E|gvFK(hhZds%ohP>Hn(0!rF8>URy0RIl8B48BTf
zK7dO_i_X8cZnO?Zx%~*V7hb*%49x@VQ}`&psM)4K+|SobM5eV~c(8cL=_jYowt%6T
zluTkCXHTcCC~>L7EJ`N&+N|iKM^7c+vZR72?^PGx1(hn5@$}iJ*_JB@h@czU5E=ee
z<G_X-dM)T7i2p~vQL>F=q)dL$y@e#>%Sw!vSHb)iuv)~%fW6CtX&j+vQ<rSr4d>8i
zF1GIyh&r22)G>0s!Av{#<P3Lb!tTYY2mN32iXJg_`NA8PJ3&F$<0)F`D7BUAz8Co~
zhHgWX*FU8VM`|Ss>Sqm;uQ$n-G<zz*ocYKx8yfSb5E=wrnO>o+0UbhsTWy$Z`_j)}
z8vTv2tLeeXp<jN_rucP-!$UlYrr<PiLv}m#IbA1(0EyW<LJ;*kg*eB5G%I;1R!Tfz
z<9pR`vG8J~4Wp}B|9R2zgUw;;)%)o0xEi0h)-&$ha_BQnr;1moRb59*mX8=nx0K?f
z8AzyRaSqfUP)=+(%9Do)(;yAN2=S%uHVEkDUCXv^fH!|OKJ~Jt)={tD(fKU##_KOv
zX7dulIfg*5V4H!qMi4po8o)sYdp`-NQ$!s1jGf)2F2;vRf@-mmYz^~J&rJ1OsXQ^h
zr@DvO)TQ29g;)1PdbLU*bK7%pv9&U}y-lBgc70)!_ABFhX{w^nUE^i`Hd;?a=>9%k
z31B2m_h9&&1<2S=E5GkV4CA?P?$vU+j>lG68**O$p?J%^PAd0D<l#s*L*gZWKd%<H
zucXfcFu93`Gp+UGO4>i6?G|9$82Xg{9Z~C?y{SYxG>t<;NzpZgS#BF4xkqDGlN>-|
zwbs|OIXCL;jku}TbWXMPd_({JRPvA(Jq5g#pi3M<kV)K!@c)|q?i%FEZpAHPBmZcp
z#68cOR%<Zx@b#x#2aDEB81l9iX}M#Y5#3Qx^<unL8Ytk5a&`K!M)@h%<Qnrfnm2ii
z5<KE3)KDd%w^`Y7rqKYuiJ7#cSddsYu=7q}7mQ>1E}8R#RhXyUXT)BM-g3H4oK(4y
z;m$%ITe_jEiwnbH{J$=Rsi|*jL>c>}vs(Ruyz;ez(=;O(3sRX-F>WyK!-ek*uBk$2
zt;`-jU<%igzI{?g3@ImB0kfNwx7z^cU+h}gJ;(1P9q#SAwqZmt-Z+MoDM$yDbH9LX
zJ^#X|_+?F4c2Uo9+|<O<?@g~Q`{FEBw}isr^TpNI6s$9`6FO>Zp_`iH6fjliROMMi
z@j1t61DjDEk(ZM{sxzL|z4E&v<&TIGXZR6-iHDM`*Qs8dV*(vGmfAv&W+RvZz0ED_
zC2TeL>3~L`Y{sDHK{^&h&`T9Eg9!TOFF1AZ3T0WN1o(nI=Kf-sa9Z-2N}#;@iE&Oj
zK8?CgR*zD}aJiYPrv>^JCp_i9_1jAFQodXAIhU#88|;Z{%8h>_r|GPL1dI7;pE%o;
zHlNsfI(t*%K+|Z*O`dxvZ}2Ir^!st$Ijv{>bU}3)e0d7QFc0b9r&z)_Z+p}1u~*+K
z^?7;<&bfZwy7?YDh%-d9qF~PmC2bgH)aCSZk{yTVk_(hmS({V8mR@-HWBW<x;o`)p
zM&tSHo}nmst^RX3K@Bjh?5S|?lgYR;MK<+P`_X;jU8-y$gT7g$hPl4#h9xNJ3ftP!
zM8Maq5aj^C=Tm<mEzBB5eO=k0HD8^O3WPr)=mk`2Ng$`bKce-;-#Y~(P)yd;``hr#
zj3&uM1oo(FDt73|D-s%@z6x1m*q;{ki9D&}`2^n3iA^uG)bo@!49T|CrR5<ja^kwh
zDKrz`PfG^#Fx!EM?Jo569Tw1*&b>>&eVI}VGA)uJM~Y*fl++JbdIvT501(uD9Msw~
z5|1k28&1#uVldvfJt}?!=}1Yz?Yta%hNqkYd%VLTQRq694G<MdU}J+r04qKmIVN^y
z+TE%o6$;hqY)!ikbI}3Bl=T-B!Q9h4CSC9ct^-&)^Mj_nXtG6D6|<(fo6V&Js)KJb
z?KE<iut1Tn73emUG|8n=et#Lv6!K*zBVtd>JzdTmk-OX^Yp^?vi?`^uTQS_fq#_~M
zY~qZp$lis`B?N~}*ZNK5f|0C2fa31vUknTzFhQD5HQ-OEDlXr|l+GDU*e2~2totaQ
zTQa=2-;Ff;<<x43B_|NKBk0UDt#OzP>P9QSCM<>P>56lXMdy?2MM*oozwRO&3>mn!
z59Vbytw}+Yv|6(Kc83-<?jh+#RmTU_-(PJ1=w1D7IyB}h@`%!fzK%zE1FF;~^pS~>
zgB~BKySN|#CABYm$GlxrAGXaylel4Ha^7ESO&a{UuOyZmDUYZ=vBqlF1WIpBwrF}N
znI-ogfczL-TY)&r5*Q+G1Ls+~rg@5Hkl!l>I+{XV{iaOo;kBaSsJaOLlZH#WbBhn&
z`rH9;>{m=*-V6v13Hp29Fmvlrf3u6k(+L+vaeygga-*9xL@@EC&&%0W?w)hWxnfZ@
zGiQ7IcfdI7K+Ee-=Uo}%NhyFF3+>hH&{0gl&{3%kf7k>S_7_7RGvEcf%*Ru}ctA7j
zB^-@k{aVH?uw%2maQm60Ei$`J{CvdYt&Hd>g?GUTOlvh$?fMIdVrb1aEfo=sr^vhg
z#c-(0hklA_bJ<__(xO-o*SZ8!^{~WHDTCcz-sq_%>jyf#QOChF867vKeVI1cSyKVz
z<*VdJNVW=hN<*Q~Y}bJC`JRUF_Bz2sZFopO0c5hCB$dyX=cvWJpS<MLEIc=UrB`D+
z6RQWd)$JCxV-)v?Vytc7$HIw$ggD3X+MN>y`JI2BGvWh6C&c=&?nP%VUF<kRx>lJe
zeQvl+xN2p~)i&q#eS`%|d;Zx^<e=zU9ItzfT2n=>wbE|-@sA?z2lwZx;M8RvojHSG
z@;|71&!{H1eqR(sM5QCW1qDQ<qkwc#X(Av<Zvp8bO#}jj1VMTekRmEk0ck=+dJP=`
z>C!?EO?pBJfs}Qhwa(c4o_CM;w0p<>a6dRQ<WtI=&z%2X)#*mjRWMCpTX6N`?fYLn
zmGW3xTWzw<)lz7~S*_Rax;(1>EKp~kYDSQgnc)9Vdu-g?e^Ao@C$CteWEg1T<>6Nn
z7z@2_2X80lSz1Jef7MV_==~i%(EDNeRa+m@5xWt02g&hAK~Q95or{zA?M+oFm9nIz
zl&+V;#X?awb`bePizp+~O&~0+4#cph5xflNRINLs7i2?k@7r0?jL;zDWZT+>oO6!>
z*>m+1JluyDd3SGWAaD&XoC0nt862}YJA$jVu54NZH>aroq}Tu5XCdj6zl(-Hpj<`}
z@BTT9n054WaSEUpj0p&bObZgfq@cXTaj}%k8GpyRw~9d-$rVR`80S-89p^|K-}vo(
z>ZLs2`IEwRNtw-$`j&DHtY?$A^&N6k!Fn$~P+$*H+$k_vjgx__#h5XrB;CE$4@f*d
zG54S%KnFSS6fj;&<6unuC=B4v6Q=M{Q^$vgo0JRRftWEh(}e{XWo?RF@V5#UCELp8
zRcp@$?4ByvNUO;2lvz9Jj$kgivz_QW*+O9-9KxnHksV$dR|q;wfxQVkM?q60tMcv;
z4Bhyo`>s76kLCFiHIx&Fk!ZCI`>^}8Z^@!8io78BKa5{+1a3}GQLF24S7stTh<w-5
zVowc5{dcAXaHm@OgsPtE_N9SpkHcuSmfyo;hpH^C`!H(PaBClo_;(I|N;z_07oj$T
zP?367VNFmj!aE$YyH>e;xECA^#+LTHV=yTguCUx1v0YWliSi6!>tbhf-r|e&GYHYK
zI+BN$0HWoeAV#?7fVb2zMxngI1M6{9PD?N&w02bEgK1Wl(zPr_muZD8d%1A0)nS4t
z5dV;j;w9b0fw~bKfy7}}k0)D`_(rvEba78t+8*oW(nu<Z-gczdM*_e)1J$-O`L;Ow
z*cCXnEz}3wQywO|7L9>q(FC{-_Ga^e8*(~+a-F!!U!1uGdv=j-7|s~z8xO`B0Ihv|
z9f%)W+bHZ?C{Q-z?>d>N%G#?cS!y_$)^Eope&=?D2-VwkRe|EJ=VX9(j0Dc4z8sSI
zUsT_9frAJ))vwM*&d~tkgEa7UBO0Cvw6A70mMMNIx{lI;T~(~y;&Rzp4cYxQu9@?_
zs^Q)2)tu;iuR=f;KyD2{V*Y}O!>2{ye+YkQq$!u$0h5aXwu;j1gF33kyaP_$Yc(}Z
z<aqU)T9A9m&v!+5D5T)YeGo<c3j#POmw<!vIsuUW*(-w2Z2bR@C8G5qyve288D;JW
zm!L<oKp#&$uimzKsPu8U=ABf*OXEKBs$Umm`vyDpJ_u{rM4Z>bixVvTi*M>ZHOysU
zCLKm@xqs0}@+`1GXRaWsraJXnnE*$gVh6E=(+0`7$(fbSgz&F0k#TbYvR{5$rh4L)
z|7isf-$10^pm4wMKygc&?qQ?P3O9|@0X4Hw{Zb(Mk<3xM`tgzcGf1}PcbrjdjWnZY
zV&k}JT^8DS@p-9f+TQK7eY*yjs7X1`fHxw4l){*UxvA9N?K=+eKF{+D;(lniXGRD`
zz0v%mS!5AM89qCv6k+iKG`7#T)!FjA*$BaMRswNz2M@X{tL8H7=K&^hDA~#+9CSo+
zF)l5l75xo7EY|P*kMg+w-~L_WuiyXwLDv5bKYotyeVoMZT2o`%vlv>pV5ev^<8-|p
zs@17s6wPiCF6c9o<TK&qlHDywM(FEsyT42{7r#h#@YVH#wgB^mBEo*L{kEU`B3<=O
zYe}7+!yF$GqZZ%7&cg-$-3E=IPuSTw{;5U}ba+-;5qi`5xjt>-TRjF@<h<_6lhXWY
zD%#M2le;$LQpDLK__u7zBjN{y0Qd&Qmz2G3_rE1?WBv#f4%cZ2)PNc4_Ktkxj1|h9
zm2YhYwMnizEm-3FjcUTV?8R`~ow+GxOKBJ|(^o*eb<tMmo265k8gfv=_Qk_AAG?+z
z@o}g)Mop!g!Z)sJT%bTyGg(lHBi~EYM2G*z>O5l%o!(y<ixEb4kj;lT_@LuTH^Qni
zHFAMbww*MJ0&*PE1OHoX*WcA$|C4{v4O{{SE=b7GB5)Pz4hWVdKd?(<Vo)|^(g;rb
z=@n0<xx=K*7#17ftW`+R?>vi*uW5k37m%aNbKS4G;71pvMzyEQvARg3s#Xej+0tMm
zS#V`zr1|>ms)S#7ms52YejmP@qIzXfB<d&9M#{clu3Mw301m(ervhZ}xz#S>u8Cdn
z5fE@!w-6TI(#-ir$IFYio8cDge*<i(UQ+qp^1Oi*t@`#KhwMPC?Wm6!XYE;ZbCqnH
zRwhrpKm?t9(E1j7=!$=coF?0fv@or4-UU4jDs4Eq7KzQqm*RSNxv;)^v5&BbPNO(Z
zYiDzOr?ZB4yi2<KZzj&0ykk!~zlu=#`GZH@b{)Tw6mfMsb}Pd?URkwgi!u8oN%b<v
zjbi5zm)gVUBH%q#?&w>G7fcsFF@KXdR#SW;AtANga5H(qG=VVucvp;rW2h#7=8^Zl
z^irg8q=}xfrCZVYC~zJatB-n>$49UtN)p_9j5pIBU{VF|1*+Z0BKHgH(k&GH_f+F1
z&n2<@H@s__>HxS#qZkS!A&uxmx<c?S@OaZ*LFnA^Dz|;u<WgT<-)!TaXVL=Aamc1C
zHcp9fpgBQN*uYGGQH_|7Q~sjrrN}Ey9y$6*Gm`6Hy?4kMG>DG9%lN?!jnbe91Iy$#
z+&SE<&Hn0`ssQ$2N*~8KiFldo{W~~20lUEc{^uLtcW<LJJg&Yi;b+l;&SEsCC&!nO
zB(~Wu4d&Jx9zj0{s7_8aBL4CB`s^L_>lf8=qmSx`yp6BHx_~|ay#4Ug@xXH(9eaG~
zIrD3}$fTp8F@KZ6FgM>j=7+=lFNXYiZ&MBFoM^66I8L7eM@R%vy*EgYw~N9Ee*D^z
zCybLPAAlFVe~oE*$tG~u2|o1X@-u!_pYeNY!=f9WqKw+51r8Yzg4IeQ<NlJJSWm87
zEJ^LIMnk=w0%dM~5Tttg;}<AMNn2~Rq>b)qDlo*&i3<^?8id>6D{x56m=!zsxq9Md
zi{?8C>8lOSJlAe={1hzmkUs^s5UtKstKc8N`zIaut=Ye*yL5}U8IKQTY)a~v_t0Y<
zWKv>eu=h$=jxgN_V#+36Im9bt0Uv2Q7GXGX{833`*%^{P>M~iec-@lIM8t-Dr-X@J
zU7ZwBDf0X>^@;btTOAgk^Z0VI!a_JL=Ul8Vx(NSfZAWe_0#iJ8xC3+r<qeMnx&&U@
zsf*jed-Od7tAfw%=6cz@@2*ME)7^4R;PEq3(N?AsKPhUbFk?{>s<(?Ex7$OVdDY_!
zx~|q#*V(0MaVvGCzR(jn0GKGfJJfZ7As+wr3#mdai(>c5wB8!~B=`!LAKtFx-OMAl
z<Anp_`FnDqystyUbM>4yq#pAojY-yg8_g@b);z~L{RSdp(T&0yp{5n_!9dow1i=Xd
z>XAM_yWMyax7N~hxRJMhUEi!8;$W+FOX{*tGr!yV>ImH~ZEa2dLciqB{!-r4bT%d9
zoE0QhhPCrK8LxwZC8HhMA`&CHu4X?8#xVA2jKX(4&S|uKa;+#!;L)06iXW%R*hPGN
zoJ8+_#9eMsNj3Gs{ww(wzNOwIk|wsSYYKm69(7xx^3!18tp}H9=TK)_rA==>b<2uc
zDBbFs8Xp;C?7Hdivn^p#>>PMCGc!i>yq~53BV17fYYLA;pX^@3fUamReM-d=m+ri=
z+~WG=;&Z%f?h>Qx<U_gt`6+qQVwfqDSVz3QEenao2N3MaJB8lb6TsSU-UJ-Jzfl*J
zvi#%XjwZ)Uau?BqsPE+hS6tj^I&4V3Y@3)}Wb|NK>ex=&C@_U`z~}1tMl|h7+7=C~
zzDKD?_G)?ZoT5k|>rZ4VaW$8u1YGte{<LzV#$fETRvu3VSG;|V>uYKo%>JU%3%kLg
zSvNn=aB`zfFv(E)16dp(MG2xhJ1fP63k$<-oEGZzxV`soEY(v-#O?2kJ~1+!R?k8N
z)sR91J7!Q&=BsZ1_n@NV`}<~NM<<s1`&VmSdCpmJToU{w%W-N0?93YSS9MXSHFiH4
z#te0C&M?L4bb94HvmwSaWLqd4Hjn;z+?x#n&=#2wKN_R@(-(kYg0_5=Bps4Z5|12y
z6ywY1WgR_OUejMp)StOm%GkR1$E`t|>gbvO?^PQ7{(pIBg$^5!A5#rF25|g*d_h*Z
z_4c@mUN=-A|L;c@%1Iy0Fzt?B>>RKe__KShuD*#YyRz@j0Jp_kjt^A7+UlqrjyT=}
zZ+esbR@Inz3#yJwNnUyR+Vc$GBr<wO?%QnjEF@jUZs!x@>O0Gn*=VZpLj}}loBk17
zpb0}amZ4luoaT?F5{J+DlkX@KyrS$}>9K5MJt$3{bO7}Rc)5WUAQGd=h+xAMO^3f4
z$+yqe$@C|EJ+LaB;`X-3Eb6f!dyvT`$@CX`6~mOvqC_c@Fgd*ysL)v1-<g)8@Iz{c
zZEGtpbWm0c`wiH~$TI~mco>A1b<OSCC+dZ0PKFW=!BK+ZlYr|YtgTfM$9`?m4967x
z)l<>G7+vBY?8QG;ED#YS#5A#K`VW2bAM^^##r9R+)1vlOAgVo6y3+=TYJb|DD!CWg
zyJtO5-hR)2bb03R8b8ycq;#)M&%@yaLFzg}@-koY`Cs1B80UuZy{XummWaI=7vZ#+
zrIqvopz4D3@Y(z=)cI<d9b(|1aVy~2&Dyssjg;KeyjWXA3eakbidkTo1dNgNHI<_;
z>Ggc2)_s=~I3$8nF-}RhQmo==GHg*D(jZ&Nb|-^;y%r+w$jZ9YqUO)Drq~z<jRv99
zkrWxfOYKO&y8^WCOaXS=;+J0F7!7)P6vH3&bH6MUJD)VRB%GbCUze!-d9^xM_Pm={
zX^iNH3wP098vO5um=tdgzw|cz^1(E}O8p7>eX|<zImw(5i_w@xv|DpU*@NTaMe|a*
z5-I{|5k{lCYd86WM$y`4CYrpFt84gds!NxAjFuRCyU4<n%lpVqT#CT;sqV&w)N2bm
zpPToK;6J5+jG3&4b5C<HCdAmq`4m}j6{u?XH7RUKI+DVQmF~(p$~hipvV8Crg%|#X
zmt@S1b9BDldnLwwLO(g;f(S#B#kvTp60zIuPjq=ebkr+@T$VIfi3ZK|g_rXAJ4>p!
zIre>@vux9oFgok3r;^D(H{?d44=&ky&<46pQn_>u&~Tcg>fdI(J}h5OxmyQ1am^5%
zL8A8=0i=TyyO+6~eDi#ewN?SA-;F<&Ha)_cgj)%x!GIh)<H!iTzbu25pZs*k&P%_6
z3vG6q)c<|%yt8u}_4)2wmFDd~RV>e0&~5M`fz!0z%tu{7tfR@71*-ldSH-LnkcBCH
z2^5Pr70Xq;H~MW2;&u>vQ2$(>3YHG>>d9lmeF66^?FMz)+1=XG=j(I~<QS=KiWPKe
z?z!$OW%_e2IfjRagYcOcj-G{v01vTOP#W?_DPb<OVeZwI-$JToTETv9&B?JXg}E6!
z6K9G<4%lF5>`ob04iuAHQRw?^J7Cdn%VNrWd5p(LN}+VAe&Jrq9g{BSmAlA9pgxA5
zG6SSb);5CxBsTGw`P}@lWP3`uI^XW&Z=7t_<XD#mFWO&eZ7&Mrm`>*-dZ|E4P&;fz
zH1K%X{(F7~qFUim5<Ril-rmvh+`R=kt(Iz&AG3=+a(XlLIX)d5Ko=)1mBo?VMF$>3
z%~e(~LIZ0I*mN*ryB+}1VSkD60xj@yJ)=~fRM*(u{fn9HqV-kwa|`Gdzc;PU^VN)r
zNqKqOfGOB$<s<^ezS&Ak{)9X-0Gne;PiCyZ?&G$<d?c3d#Z76ia~pm5L@V(rhQ|Li
z{u6US*@`b3jQ1t<;i|eqwX3k>D|waJufvAbULiY2vmw{@OBkZNhD`S6E>P|EjJIv0
zTl)az5dc3d1Cg8iXR4_j@FjLY&Qq07;pW0u0AjhHI13835ukunCfinc^$1Fikm#42
z0Eajs0bVujfy)k<$T>3Aoc|bSCeT+_WcW1wwb?9tL3)#_;a^nNIO%rZ=sb2pAh}X8
zg>uzyR_m*ko!w2V8v6Q?OTIqr&CyOq$LValDbzkMR2Hcrih2aCrLvMhmEr37G^u=`
zs+~-HpIo^9F4gW6O?8m*c6vza>jkzcc}c_l73QuRsz}!D%D7!gzO=&4nR$W6je_Kp
zLREoYZvOSyU8ALafcs;GF?gYvVRW|clgh*KpRx@b8z+nEBgMn$bMlnXpejujo}X7O
zglNy#zMxXiQz-CwuvI<(7uCCy@D?u29?>T2we8xj%Yj|?DT*L4{413pBKR?6WuKE2
zKrWEa8Abyo%#zJMAy+rjZMJKMVXjdJ$jP$(WCRny4J29nwt3WW!g)P&pXXKw`F9GJ
zT513Ks^{{=MD@p;&v7D0{7Dpd$`Gi^h{Udgw<UOqbpYzuDb!`R@vqH!<URRI@_jzJ
zArq`Q)qdSP9X+L}rawx9p~E}LL@_9w;EP+tFz<2@A3?IUaYl(y3rCLV54pB=Olc3D
znI&9YYa_IH;~aE5E-Wed!A{Zx5i+p(UJ925iCqOBPM`yw8KlHbo@K5+c*BWVotwWZ
zh;sSy6rqhogZLriod_nVz&FBS_mr1YzPm#Dg5Bd)s>=I?DYug<dpJU?Sm;D7R@q>^
zh`O4(UAq$4lma@n(<_zTuHenA)xx~j6)WrelO3a+vH}HCR#*9gecDBHkgB1mWDO@H
zbT<A&Yt=Z)OFB_G5E<!xJtag{X=&Tap{~(csVkdH#d(FQB+UgK@}wx2>U4v0$!!^E
z9Cjd_;^6pUoMgtdH6#+VH(+%CQgR`x!KP$VK?7nV;;)kz8zP{IocCOX(k*FRB*|i7
znM)w*%{2Ejro@YpW0U;5$<!jNl@h<YvRt28<pAoc>y2Cgpg$zwi;s*Wox@R3flIz<
z#8PtZBIIzH@n>`TpjlF5%twYqrR4hu>(`l}m64kwuU^cWl0ArbVdE$Oee@VUZw*1V
z@qUvmz9<~7qZeYai+=e_1~<sXSgmmX=Y`%LQ#=skK5(=jiMUh^kH1X<kEz~tbX*ZH
zvwFVqdv}>-SoOBDN_>!`^RrRpP+L6>b%Y2Db3c+Gx<UHjw(Id1l@mYc3|u<3E!_=@
zh0zj9083Omh^^dUBUbw13%eevq96UUjlT+py+urf%<mcUpS!@Md9BrB0>1Qdu@YZ}
zVYKO1T%gS+KDBMkI>5Wvl-n~ahs+nG^>;%O<o@n>x!rcI(ZJ$S6|QhCc4q^7@~aZ7
z5w%<HE#LGyOOM-T_LJ_NpX+J4IzbNw1FASL%lxwOQ_JBOtIewzwXU0iTZ>Noak8(w
zHg1mB832$84F^Ev9oCJWifewlynn7XV~J6lbG+P<H>JRB;(p~Ju&SjV<L=w6nI?}z
zc>H^qCu`vhq?<%h5<5_{aJ%T$zPxxM<m+$AYD-@qq)Sr^>o@n}sjB|1db7E>P?}1f
zA-+u&K0Y<Menu6eXvtk~C(ADhG90Wdj%N3ks4h^Inc}8VUZVZw9AAK~+cLX%i#>$1
zv93u&0cZkZp03?q%5IZpC)li9D_=+9bam0>g4=T66sqoH6OGi_%Gb|l-QVX+y8R~k
zAl4_FA`n2l1Yo6rfVO|A5`a%@PRJZxKG1k<8J>mww)GMO(}~gP1knJ$6D0MqRTg@i
zsBhA6(A{OgfM}|3NWa~v=(1*bJ1uGux&~ZwBLLV_r2zn7_uc{4cJbqDt=Dl}q$^0g
z8qW1|SScj6Z5(XtdAl!ADcsj``tVWrOfCILVwOlmDb*h;cIq7jovP+1ATr`PmN~B3
zsCagh*DN-=I^IWWZ%tPyn)a=gTiQ=E!PTjC&JxjH5_<-|2|HP`9Ok6hhKRJ#_6WS0
zmL=e3?3$vJAnKr4R&88y@zjxFHR{$)vK`PW%^Yp7NC<Gmrgkp~Mww$%a<lwrH&2*_
zdrFFSiFYMYVb3p8&-MEKd>$Dv4+-eB7r?^eJ(iJ|HiH_a(j4;aT0VZb>Fawr5S`Y;
zVd|DgOXUrCYyRP359_*y3148h2;!KRaM8RkyUT;dO(7O;zp8_F&KW9+RXHV`U9V?O
zuxBue(_lUxzL-(#wH-uM+2E6M>UyId=AC9bVf0$?HXH<18dcQ`JXq9Y&VamjOy4{A
z>;voUhRNUZC|jL<zwafJg4;*I{s1_h-N*lyjQ)|Tg9HY1qvoU1f21q_feHPeyowJ}
zZV_nJuR-pI3tnpNEwyg6_o#D<sci-BzW2fcI^jQzLXQ%}Jvr7Mc@_xd{!V!N`^$>t
zyLF9AP$-aNsCqrSF-gN|>duUPuUWOKe9I0<A~AKZZo$5pbx0Fwh|DEH%dx2#No4oH
zy{Daxr?G}OUgoANZZ73G(9V^$pYTSV^B<<hJo~qJbcK>4m09iHC13nnW@5iuV{h~g
zW~Z7P{@8Cq@O#!aZifQ@*bU&0gUa{+L-+7sUYVpZVx7Z)x)p0)jy>r`KM!q<D(`S;
zsC(<zAHq=Zq9Tb#xP;*w&AE#lIE|eZtPwtsoULkH2o)JWPFBHy+Id79i1LFgHDBvK
zb(yWD$f528v+~G9NExoro!7mH9O=J7gU!GMw+*MZ@{j>wob+%U%8l-c#woXXpdb5f
znLjZqkt`ms@DVmR*o$~JnwICH1w;o%z};cIUN8w9SLB^RaIYY{FU@v<L}WM*QV69G
zsbnP#a<3(i?<bq}EH?6atnwa81B#PwFQO(Ss*7%8oW$tFnf5%iq@|fm9zYUxUpe`f
zhcnw(IPN_yeDGr(_G1bdeb<y^C`W})hZaSF0;^?Pv9A5tT&`|J?Ab}D@0Ec-AeK_x
zqN>5`CK|n@CAKhg?P&P^#ao@X+De2@URt~j`~dD8js+B1#!K_J+d#}Ob6(of>8AGA
z)<!s*x=H*pw3?sJ3I<M>^saP+ptk^q3iG2(*THL~yN#%z_Xr$I(yszMa}67)s;Y2w
zB#}^4*8cbDMv6Nby6MF~#cSf!wvR#+s0dYfSFBNw#w%2%P7DcX>th`5@@3o%j+7L{
z;Mo)OYwL3@f!_37-3W*N7kvCnnX9R{3Ac$tP#v6fPaMkAXqMh;oTRt%o_kX5iq^Ps
zO4{cy=|4x`DW#iAJX&R`(BDtP|A3{A{tL_tQtAG0f!reCfX9S1rxtjlyn(D=TM*yw
zkWrB1LTen7k^Je%hKQnucUXM>y6e;qm`8(hwt7bP-Z3d%#YkP;^S5vKv~3PhsQ@_3
zvgx~SwPlX8?O3Sn|2(BmP@O7EA+PZUo{^*{Rp6_&;Oj4*oVeYB%O5V{NQ0jLkN4*P
z&OZKY;{PLt<IVBc)scvB_Fp)?@sdLS>GXuY-+>=B^k2_`4ZruOR3cScfXtAs9!-v(
zx^uF3+np#Jy>Y*8j1g9S^)H#g8H}vIG+USwnwFKy1ByJ|iH&kfpmG;?6z840u9w0}
zV$CVUEK1<IDdw@N>*w&Hi3|(>7i(&igry9O^y{^I1I4|=L^DN_7=?Yd-cuGq;0To+
zl-UJ;<WHruIJKG`wdcVY#h-~hjVlk7iJGuYT{9eMm4rakXy*yfG~z!XHta(&s*2V4
zU=?_!SD5<CRR1sa&V=Y?9ove}AoB6!Yz!!Rf}Wm0I6-Qyn<}pB@U~61G*~SdgH^T=
z9Mv&R>e@w>PmZiEf(iqbrMuzub3L5lT8hl(@*Bn&Rn?-O^C|rel91ka`BQ%?grE<w
zX;gq26<BHEW-6$-1<r))fxm_C3gk9z<URqCb5~+6lm!{PeI5nht?Txdu+Qer2yr+%
zWYV~GWOp0m8!attO#Uo*xHZukjp5}GSqT$>B;~f;EwMbx6~8Ra;&EH-ok0J0Vd32F
zDX5jB)3Y&=CD|p1L;K{%;Wx_WFfnWe9~%r860j{Qy<X=r`iU#o6rb3BfVsBZAMQHS
zn!9hg_atiH7Q(-m9GG7@p3uKF7UaHp<C}5C<~y3*OQ%x;7+)^5HEjZV+e<O<nMUTz
zXNStB4(kg&ccF}rGM?xjHH!CC8wsL&F!TdIR!@S(PNxdAFpSqtnWUc5E#%X_AFZek
z5@*ex__{ONq~#<K_UJDv#9Pw#pz4Da_bm9W$(<fx2BS|y{2Wal{4-*a!Jq&(2Ttjo
zw-#^R?UjFIv&_vqr|fi1K^pPtKlyg`PRBdee|z@6lk?~1eLJ74@aG#(vu0s0A5f|C
zDz9cuIW>iSK`|q=KOvM(2$sqHYdu+Drh-ed#B4@zQ!9iLy<#VIAd_LoNLG42WlU};
zOi>^EK%68zA4;|i(AMp!WhxNuAFb5#JKIQpX>e<%Ab0l(euHC87HTmzw(|@9&UtwL
z?_USg<4=28&NxH)`;38ge06GmF;cmb@NSv!XXa2oxBC0iS*RxV`*VT&GU_!mM)IF;
zlxVxJLwHN7F+*Dk2Ow6c8MgMLyYBBaL**EuDVi@N2sY8~l+6?4l=nc_P(%5!Qq>^3
zNZruu<I5k`hpBQp<8RHcr<PA|2gL_F-bmwnqdE9I_0h?V$z<IU&3QqWM?O+xqbXnB
z4|z-!_5u88PUPQbVD7(K8$a4J;<l}SyN=%3kFn=_+gkzITiV1mlK)7w&4;L~u}P%b
ze(!y>)$aJwv-0al<kXKXivH7E6Cu}DU7`FsxQ&En9b79;ukQEsW~h+k$(<&hs|B`4
z#D{GSf}J(tJXY46iA4}!tx7B<jU{rxFj58b1kL~mrO!Sv83kC^gv5xNm9BBP?_@hy
zgJUSqI>%O{^T^@Asa+xL@Na0&e=$f2u||QFp#oxUtui=^_7IA`*CoTse43HXx*`3Z
zsIf~Y(xl6+iO4*4<xc5npJqi|zR`VWZ02xg@p&FO4~qgVzl$J9&!fha>FX`F<%bQ9
zh}l_^{xXpQde@h5;%yd=7(kwqQa}GG{+!E~<5XYgF9KlRE=mmF<SweUb4Z35{4c{e
zskJzIApi#u>f5<Ux0NS70ds%(C-IvDX{>)y!e5$bxO(Gk@@>hZ7f&LaLa({Wv#;WH
zQb`X1Sf&ss_K5JnmpFLk;Xw_YC9S{y>3bF6@?Mdo+WVA51yq0@Em@=jr8oA4%f9pg
zIF`SG(~1A;ZDjUB>B?Y#hZ-k)2kj6woq*T07fP;-uatd$g;5P`aTpdN60rPiXG3yv
zsZn~nyaVV-m)ZJ<KHpGv#CS2&67+3wDW(1{pQh&)hXRtcyskVV0Reqq8<k0`z>tUl
z*5y<Ocn03p%7iesgc_|7Eyj*!H8Vs;ba90{u>!0@LFe=6<&dFNghhNXIWG{DjKV$!
z$1CQ(1$p8$x{{xo;|$*Kl2@}Ep`}-~_EcxQosA00x528?yH|=KM9L+rLK1h)hdD@|
z5&JYm_SrmfM)ENNtx%rQS1Vr!+H*o_0PxlKiu|QAV8{|)ehE9@nn39pcu-YW4|zo`
ze?Hk@OGb!gz|U3@g|sHAVS9IG!k3u|w`#K6!ypS9^batmxWHx_iW;TQiy=3&ZeS!X
z=e=L}3zZSNqxV4j%rt?k-5yX^WCNF?YNDMo0|RVpOf>rL*$renW0*bxLDU9NKMPey
zI5y0-a#UVAhVyw=U1M@dOKpT@yFk*<XSBhx4GnLRs;qfmP(kW9NQPK&JBr#9$nb()
z^`tNSqbzdYYTZF^K<42?;{nx_{<!=y7V%R+JQe9jnLtpfb3$fU=(>kfDUt>>U9Bpp
z1RKa;=I$)_T5j0;tVQqhr8N527}%KmJ^&4QKrT2F<u?}s`$X*l0C`qtl~Qhe$127Y
z*j=%x`5q>DW1#r$1KJ-umZWYS#Ng>ig559e5p@E&Y=^Q4!0g~^8cDI&^1J!u&yKR-
z-<L@nQ*d8bAo2-#x3A$eaF>>#17><gBjSTD-Y>H?mA@s+g}ve>jip#!bfLv_Dsm-m
zftN3g*c>yjlq2w|?Vvbo*lj$LX=~JJD!ibK>`sI2U5f1)3;<ZrD_mMw>4;#X6+lTw
zx%wL_{YjIxYr$n_+3lSQ;E?nDPW++jTGOgR;vPl00a`>p{8fVHXYX{ibCjR9kMlw9
z0E<$az7?=|lAh(jtkrSE0nFO%S1BxBi&vWM=(-WyQHs&(S40Q1W0zgXqZ7yXT^e$j
zG$EfI>yHQS>)f<kByo%z<FYb{_W`f1x<ElHrua)erJq%56E-(xEQ!ieLFHKZw%(xm
zlc)kGcq3-}?d-uvsA!F<j8hq!U%avL0zZDK$Ry|<=>F`wNxB_ywgOg!^&zS#?*JP%
z1Hfi>ia*QP^8eg4v6qdg@eCG{?|R?({rts|JZQD;p?x7v2NN6#kkj-QgbW=06FX_m
z(Q9nOx6c_`MP9p>VznA%swH6g>K-UX5D+ycZUDn_Do!Jg?o9g~w#q2)ZdHH&%&cgX
z^jEEk-xYMl!%pCa3DOww9Vo%Qq-Ove6EK*`Ky3+tD+IYC%|<vlQz~EKRGdn3O1Ikc
zu?hdiR=g+?C({MWxZ54>y=;UY{fo*QG~2m+@>-p7OF0u@`C}*R&U!vytFDEke|&Rf
zU4PAS{rtO65B0PSH$=6UZqR%N7U>Y=z<>)MitX)e;=F#?qkQC&Z~r)JlJ!ms6@SKt
zD#r@AT4!g27!J|F1N>J9BXbWYOcYyhcl$o#!N{H9l#`vp`!RVht?a(&Xl{JJ!OaG~
zrHhmyx1!uNUV~XtKB>_#p2=oSZme|2>>mreCRPJgW4pvrQPS0GI>8+_-B;MnJ6GYC
zkhK&*(A91QcSSHj<tKfBp(L4Pv!b*Fsh$lS-<MoYz}zzv`?$9h&)^TrDNP@YsHe)J
z0u`w<V+Ug+NupmMD!|<%Rq}EVx`W{_s$p@<ED=BeU~2Ib^mj2r0%#^|>H6n#53b93
zvN$QS;(bGUkv&vPWABOgoBg4S3r<fvEuIo(3BzD4Y6rf|9FMAIj?Y^^K6+ZQg)Tg$
z&aZ2d3>3sB$gZ{h$)V4aO`2LeY4b%(FE8%K1HY`O5jUZKzi)&jTV!WVU^Zyfo>l8-
zZ47?QaYfbDqwP8CYo6;@-!KakN^m-OZ7i^T(t$25D8Xxm=*tE<z=x}t{=RH&pTD@3
z8gf26J*4Vh!bAVaVyjoOJuQ}pe>=a=FXQa?-eaG(Bbbg$^xMNfp|{TNB*92xCl-Dw
zGYNqbTov3I-GGcBvV?H5JQay@MzRqU?dxM^?QumjyGLPWsd96D9wFYUJB8XD&omp}
z#qmdPwSj2KDL~LaxC`{XH@ewnnXG+-WJA=bnI9_Rf8Dz_T@Cc@@-=YF4!a#XyRF~P
zPqWXmUcRX;uaH|qR8QR>Jyi&J_EgVMO+yMb6@Va@Fq5SA3AgIn;jhyul+HFR+LOyT
z&&>7pK<Pl!cV>nsQp~n1^~l-q0PC@4#V=ce*QR_-1`Nh_*BTr19=uMt$kLqB``zq3
z!Vx@(0Q|r<B)U{Q9%v#og4*L~{+yYY&`#98YVF_K^2l6^p%3_hzWGQFtyvw@c8a~!
z9qv!OM;QSF<f~5$CwS%%_@?cV-ph6&lLEor=)rHf;Sn|Fb0b~93SRqB!%sc8-&%g}
zLfqNBn@SL_cvk{x0(ABKt%~zD)j_!vt1J(0a$DrChwN==?!EdVM#fn#*3lLvwrarJ
z^<bPN4nlab&GZ(GrLwL$#j8HKyQXH<)y{aq{T1JvPIjsa?Y(#FC`&+94kGvx`AF1J
z9p)!}UilCow70(Hgpa!Bon^&&yMZasWtiE9=dB7uIXIJs8#B6hNd#VZ((Q}(0$6Nd
zZB@SX*5(`VKBxD5Z%@$F!?CU|ycXO4Q|rUss}V$k03%g+atVo@{Jr@p(HF`WwXztO
z-P3vz+lz*33an>*RZGcs3GwDT^^i41yM?4nzF&2!u5G)p1a~RJN#nDD_439Y!5QdF
z3#B6`k@SPb;-D_&(^hs~qt^P*C9meXBx#+S?@F<oc@;cUW31aZ7eq;hO)d&R<%!B9
z8k}PC@u05N7Mqo=m3x2JJE=e`hm4)k3Tmafrko=)bEmNg4Gy@gBpe?}NG3ibg^&w1
zfYaderl4FdePYvj1N-A|qmoD;z3KyQ2h}{SoCjG?XkKV*g$B2Ki**As1aQ1{G>}Ah
z8*}5On&Pq~K?f_C?Il?s{3cUwSoMdB!0;8V>-2Xo-#=Ap_XW6}$XlMR=Tn!ENq6`d
zAKiq46>3kiCqKmJSF$|dsCuJw1N^I<uH;%XSeFpB44>|#T&~1jUg<rF(#FEOxUXmK
z3s|<ZPCT?2xE*~ynoCbav@&{5uVXcW`Oo!*g@vI7aedvai$Z3)D_THCvrK8}T`DFj
zfm@!=FGPxe^aP7XXbQA%8vT=EaPGeYshHoxuD2_84D+I)K4bY#1@jjHLWQl9duaPv
zP<vQ)pgZ@jQ{N3g89A>%(_%5}+<V>yR?jjY<d@J|Svs@m0Qp<Ld1DYRrPH>Xp>M_g
zJ%af<?-<G<`69m+03JB6Hg#4{u2vcxBT&kXV0{c6A+A@OMx>mT6qRih&OgliVFP-T
zy0`SI+O;K?GI}4_9Q6CCr@aRUI=tk0{g>H*a&?IUD;j-itOeO{_=iik4|Kr=FT;v(
z=it%GZVA=f!`#-heSzwkwEg;l490T#@0{*GVzGmncRH*xob&1>!HHg!0Wf{DT`_^V
zcah~=bvRtlS-(tAxIQ?(Kr2mCwre0gsVHi3GD5xZOZ{*xiiO03vuQtrr&0vB(zfkE
z6Axo1_e2Br9?IR3es!(P@6W(b0X6YLpv6H^FT&2V&Tpn;s4_NJD;dbIE~RIY>sn$e
zz}`4_3<&!egDrnIy(#^auGdBtEPp7Nkc`{!WhK=9;l$EKOL2SnE6z>GUyL_zawI+J
zcu^TzYZzK?OZZq02Jj_e5(l<s+<Ll`cNi0{eY<X_*5GH2&L7bafs`%hrKDGT3%pUC
z_yy4TZu1QXWmTCk*5U6mmk&%GgXGdLwrywR;vFdi`Ur}>o(FllwG~<9f;1hv3B#Kc
z#c=@Z2G)4jpam^j@tuvrKP3cUTJ+l}3WRu<La$uaR)hI(X|`3}*QwEu9uAD8yq>B6
zE{(kEoLdNb)N<eqBxR<V8Sf#jQDgJc@8UIAoq!gz2!?`}eQM%8Dn>?MzLOL&a7My_
zRt-)JXyLN+(rdB9+RZ%9W_i?FBI1%6J2JUO^{*9T06qwqQNT>9(i(9!B3|+O5}a9;
zhw}5ko3+k6IA=NiVY*;=x7>X+Q?Jy|!uJ_4!>mcBs9+XTj+13~V1f|(=L>SU8!okC
zZ!2s0^}`gu^xUq}2q91{CG56>AXjt%pG_E;!F{%X)m3j#WZmX{yi&S{O-Zn79)z1F
zLOg|_w<KVpss9%hA7OcNy9ah%T=Fo*Wb!JdbV#s1<!Xc<%yl&*!fR%Gq-Qee>anNP
zCJ>MU@CxZO&_z3?V$D9H)&6J@c>Rn#59}|XKJcGe=Wkc4_@NEHhg<{1H&6ARG4G5L
zl{Q%j2;c#lU@c;n<6Aq<26OVT5W17}E`y<6I4LCEMVGFRatF#qZUyQ_*(cSdXDFk}
zF)b@<m#4w=?)Xrx>L9smOM@KsrlM#W%Q9}A94<aCRVrB9C|I5{n5TdnoZ3MxGspc!
z1q$Ra2=(Tv@wVS{XZxi??^|z?bz_1}Lu#&qbYt~O0zs?|QOyN7AE8jqsd6AJAlzS_
zjU<R2?45DJ(ah+Cm3qn@Ut%*<$d_YTv+#)5UD&a_N<~iig5p*efj%b}pd5x%7MYJU
z5&#eqj6rq`$H~=H8Ni)rYd<^S^mq-ounv_;27Jk@Wfg0ezbRVmkg0&oq6icwhA_Co
z96Nkq2}!o-3iaC&c@u|x0s_m3M+;C7w*ct{56RyFboDi=))ep^Ucn>-S;kPhWuRHp
zqtSbOZpLGC!)8FjSFJjkqtPMyP*_v}kuB`e4O^y+{1AIBK~lpN8fB?o3ccP6KZ~||
z#kdZiH$e{5c*t+L7(6ohgwL%ThEQ%TB!8%HVJmJOUYo+ICw)PE05el&;nn-QV4~YJ
z^bSFOB@F1bz0zg<I?b{`K_R_QFw=>zPkvO9r77e`FMTU_riH^tI*sN<j^{NwKsQ4S
z<L&Nj82|6*clxf|y|_`nS|440WzZv6Nmxc;nF+V{Dn=#f1MAvHol;})@D%Ba4gM#&
z0450=#S*TpSR_`+&+}Q0NLM`nl!u;V-RP8fUUf6(#`Lmqrk^2`Uhe~NCA_+~7s&)0
zL|lMs;+(o{T)ma0rFwqX@*Ys0m$x*YoW9Q%7JYKt>9RY`0uYb~CtOGN45O#;`Gj(e
zK`_RmD{*w$h*m;wZgbRfx+~kl0x6U*|9*!!CTdwASrdiL_Z#xsK@e^RcY)*KbSSq`
zoX)auaz(RnnTH}CkKq=o$rHyxwxUId4^8B9GOd1p7U-mDf5JR+CVtS{4rgz@3zY^=
zx*$j*K7~-T@*c?o>9hsL75vxSDbC3^-Cz5PnZ*oPC7u-JSPn9zuKS!PeWL!jC<|G6
zN^Yibz<PgB#t~Q4)$KMzC%VjU&k#b@xQv2k;i?{N27aR@R?s3j<%>gu1#E`*sL0!2
zP?w~U8a|0e(<vbIV5`QWPRU1k`QTBo)_8Nimt;@ZtpD2H`L+RRpjJ1VTuQbizYR13
zZ7){Eb`G<WjDIg$;<RfDY_=4$<$C!I*N?)#$UDayQ|rz@jRpnhy>O@bqx_$?a^z3o
z?uhI`09uEtzo=rN94o%BHCUuomHfZi^%WU>)$w+_b49}aknhd-{R27^<BN>dkuubM
z4$M=$;yn~<h%ZJXn!^6aT!WKj9DrHmoYNE-`WzU*z!DPhD`D7|*QS^E)L+3&|6Fgn
z(LDu<On0dswyv8wACj=rVNpAIWlpCQ-OKO;{XXze|8>1i@~ewxQPT5b=lNNvH}6<1
zo$P3qQRYxJC%`8oP{3%W!w$Xttp^4*Ls3QGUe%Jz1~>f%n9juu^ShNCb%#lJEY8va
z_a0%Qp$Fne@a~&Q-dRH0X9MQ0vvAZ*>xAgaX;7=Pf2p>K9`)<pcwQwK&iS;BZhP(D
zh}C(l*Au@&QgvEJ<a0RJd!Ixv0oZ7tP`hC7$T3}-y%^TU`u7oEx&Bg7qS$TE1$Hwp
zp2dBz2a~_A%(44lR1<nBubK1)!)fd}aLA6chPv@qF@l`*?XCqz*ZLIErG*(8fJ~}+
z{v!D6BR^foUNQNtwF&m|j=@bygvU!*s@pa!_WE@xg))IjiWl+}Nf2uswLN)FGAaPX
z6`{ci)jZH`MnjI=>w7eT<^t~w&0?QjtcYozY40(VGk4!g%CG=>6-^ob9kn5Tr7QP1
zJDQ|cLdY;t@qXFl;p1{VbD8TO-__(i^n|FXcfF|y60mHR&kEc&?|N@s_Uq{QotRh$
z(t5&NW#I~rG4s;?P`mx7#&@;CDXw&xP8790GEGLj<eL{;{+LzvjhXPCkY`m>wvu#3
zo*0rZT*<m)qE<G0Gp(0j_M7pIhxa&48K~%}sEvwyp4oZ+C_QV+)Xsg)&UFvq9dkzh
z-MhZ=<vY|ElgbPc@663kY_=+XQ0R_+$Ywh~Z#e4|!`-v)s^0m1^@xAu!tY8QRU?Le
zK_zN)bDr~p7llWrh8L*{GdjN$vX?owuP8>=(CORtN}#>h-Kw7%*`DhUS9k>$BDmqV
zfRsqhE$eTHAJXl?IF0C+@wpdp7g~zHW_tVI0;JF~KlYxd`0@XU0n0l5r27S&EQ_-m
zJ&SCAQF(5c(_o}K^Oq#S+Hr&c`<r3-V%WGy?~dodTCw?|*;`$Ki8rJo?%}fRR)}dQ
zs=A`Z35ls_b(0dFf9n}EdZs~8aN7yzILO}BBRW7O$(eV=`BJ$~&roqSKb}4s*`W%X
z?Kv;CBPg6COVt#pdacPHEJtX<caeXn^Fuf&a-@6Y51+qd4Ssw(d832uIV=BI_FeGh
zNSq#@=D^K+76d$%?m<fav0%ahDiXm>;=r9O=f&e}mPz{xspUOZoKH9*BFPE*4E=?X
zeZV!BTDV?RS8NS5`ySteo7xHa+b4g;62d#st<FCsqTq@#FesP0)<V5{KuYr!lFb>v
z+Ijr*)?EqeGg>X^6j1~=0>+Lno;xy1V)MB9+14|_{(*dgp${ilO?^7c`Dm8fRWo>_
zY!m;A{3@ajwA;D7KfTe3rq?MDizgXjZoc0+b8H~W=<Dk2`-u3Zb5JLIVMNJ_(XDz?
z5nB^Zv++iRQ5-Y=6~V{}i1b%yuEly+G!S>C7Wmd%vb+rM<vwwY(`ionL|b>0!M_K_
zN-l#h6@ge#E~!bOsU0oB%YiXPyxMhHivC`PjNNa4Z8M~c%`j(QoesWkI6j)=@P>Ih
z;a1AKVw)|r_t!GlV9hXw0PS!SEry~4`BP(}34ogzeIf|p`qXKm^4P~P^@$~-TFWfC
z8U6aVPtN)3Bni2FKORN?q}$JXOh@RpB{{m?&tg+6pfsFC<?fT__A+7D(~hS1?QP_n
zryt$-A!T|;f9L7a;eS*93Nd6fQ-nVybQ2$tf+kuS9$@p0#`3WR;}tE%aPQ_yw2rUF
z%wqq!kxL&7F!Hnys0{C&k6@kvE@Yq{aGhe0%`n=x8&MV8rV&*Fj9MMyml{#tR?n{)
zV0%Sk%(JfWJBkEwUoaRl-K8rG8SWe=+|b#T#~ERe2^0p1*pkA>a14T$FLUCm`t_8%
zj$T&X)d^x={(K;rCEDj7u1o`;=9uGjlPE%&fwKak_K7exKx&ALsU!&QFCT@;)7k0o
ze#>r!rwa+)kJF?Vrn3-=UJ+V_MUPPb*F56?ga6b0HTnMu|4Pkx{ce$ov%d*3VzNzs
z9n9Vw;Ju{5I9O&Y!%fF?cbH={Nt?;*&=>y`_jc+m8S$#z<|OsdA#^q2bm8WpJ>TUu
zftg)rp5RGY*~ID7!!8sDMF?s%W#6flWptx~PxEe%*LbrMV7*D~HrFfm1a4e&>X&Sf
z$X=sB%cQU`!ynxCSv8-}b*e}mpNV6s%x?xok1r$UUv|U5SuPa?r<K|2MA={L!hO;D
z4={YFnb_V&4;d@4o`lm^VD`3eutB^+vFxnM4hCPtpsZe!wHGMVw`7L>t*qCR1@kXK
z>iq}9wZ&c)8wyS)rP4EY*Q|(ME+$n*0TXDKc?YAm8OOK|QG@g-@9H&A6B)pDP7Wn%
zV|aF5WPsFERo*{Gl0o`P=Pkru2p(e`URVoG&6q#m?{=LC2`{{p8nK6R(}?$M%EfCt
z4udHz0VYs(LNtA5`ks~xa_X*Y0!H@Qi*Mo?fRY>^;T8d%HwZmVJvX+7e=Fj*e7Chu
zQSxExfOu*&h;4Ue-Zw-X^f(s^r&E{v)s(JxQDc{vNHNP>Fp`Yvs2TgyDwK8UJeO+J
zLi1zJ2ainF%8m2Kknc^`HeMT_BK)yWG33TON&Hd2S91XrKiUOnsJL8UqBaQor6a=S
z2d#JL0Adxol-VmY0;o>IratHRi8wNaK7GE{j(fQ#^{7&3?Hh=(Rl<<S8KQ&nTm$y^
zUsTEdHX+}6M2Ee5P@0o^&z?tBC+s(?VK`n$0@~JdUa_>DN1pPAX1uP1xplvj&2~^)
zHi)71uFdt6>I^y{5g^(Wh=Sm`Dm)Nl<^oXGQ@dRw4+1$a(pon+*^jzbzU^=RT=A_l
zvL$`JNI{!Eao#AX!1&bH1$fe;IUQ>k2dUuIo^yE&<a}4VDv^qo290HK0cURVM8W4T
z8aKA>%fD=!qmwi*QTJMZK*cQE%zt#v!8L1|WVc*?)Vm^pkH$4UhD+@!nNf;B{qF&k
zuvl9--38x=oGB0J4C1Z!-ncJ7<hMuxLtqO%0qox+!u-+Se?ipCFWFxi*&HC`eso9s
z|0YexOs(wni$-q<g?nVUFABPOA709#0Pm$Zmt*kb+X043#+Vk9h2BSvNqX#$biP-7
z;JQSFY}?rPs*A_BysrKVyV+L+b$f*q%Crpk98>IBey!)aGB>r2Z(5pH-@2ZA(E>i!
z++oK%iGIL$pS8Ef&k15)D`;)>ppL$)x=hlc0_G=)=$+wuac31KZ(_%_QpGIilC!c+
z;W(>W-cIEHU^D+vEjd)h{mdD+)K+L28ah=Nz04ICi}M*`(BTN<v3gob_%w;)VaK|d
zgRJY*p?=SV6ZBBG!DV^E*ucy(`ClxNEq=8A@kMCu;JBFOvF0Ql#;MQhh5@6W5#!~8
zJ`Z6p-ZP`Ad#w@>NP;;OE!{(SU~tV~*dDbEE{6#;kK1_H%;`5ag;X2d+GG35;UYZN
z5~|8`92Y>esTwTrw(qxX?f*%7n!ucdV;QY3g?&Zdhp9YXyO#BAzCr#hvx1<F?zxX^
zJMZ=Z^WD4L8vvu&gg(J)R)%A}MoR{6S_u~1?l-&o>(hG;MG<UW@1Wbs?Se7T3x85+
zW^bo&a&2O*mlE~yoY4_-dYEy+(pIa|>5@=I0=`GQ{;^NKTG_lU<8H}eX`Nd#rQuPg
zA=vdB?4}g~v~uO=_v#lttqt<C(?FMA6BHh(`Z<i$gVL5y<as$8S+tjT%=x}-&f`bf
z-rVb{R3-tunbIx8-p^p=Ol#=TQff2+7Px`pEfiobgL5feZa(m{<K;Y2f*p>oedvVC
z{6Io~;vmdoxAk4ggW`ujq;79o<=w*8zQ@=p>)Q|>#<gL!!loB!ij-}S+)CCR>O0DB
z7Mmqho?gWUuMEdEUn%eODxJGiE72ZQ_Z$bVSm3}3AQJ9)h1>Uaifr*kZHXTw;$IWw
zD9kO&74I+EJYS8t%Rf~E>jz!&0U2cIwdA~g?X4yDUC1K4qhaE?XmE7JkxG4{L}5by
zaVh=NBd==-1LOPVc-Cu^g|N=Q?Hp;R<+^v9{*FYu{|}tl>Q4a7NL+jvuDDh?BjTXK
zbZz{njZB5feM*L3OX^33`*n7uniWwisQ5rNm5y4#1~;&a<4W4FyVWb;#Fn}^<p0z1
z%bcD7P$;3&k;gl(DzMz5*nyS{0g4|kop)-uC|iG4#h)IQZV>t#6%Z3Zd^!q`_M!M1
zy-n+rhLxu3ZUYGlaR0xH##cZ7ugWX`Ibf~OJ(-Rbn~IIsOIUJ;pTy{gyg71TGx?^$
zV&Fb%DCaSMsqD`%ErF(Vah4DUWP%|dIZvw6y?i<4N*qHwg@2f)Y<EUz%p*gQA5}yC
zqT)PRp^Jfu=nz|^yV@Xdb2Sd<7xq0tC(JoBsair7qk)_2l_t4eIv!;t${6wZ$bG#-
zMa+QwQQb}hkk|vE<U^mn{7*v3k?(6zgeDM=Bvb~`j2-TrOgRJCa$C<ahS~dJtmoDN
zs@Q$kajZoeQ<pNeycmg;Cww8A=U=t4Q=fh@#Z^b=%=+s0T8b|J?u9P|{Usej_)?Si
zwKH&y=ZVir<Hx?WqSgkL^%r4Fq)&fQy}W#kh1cgx=+6@?$>2T}X+>D9s4vVDp;boa
z8a_HylL8<vq5m7=`p+pDfV;f@?snv{bcp&Xguk<O<6L=RX69>qt?1^U(G3-+dx;r~
zm#GFt&cdUA;p}W@wIoLPd-f83#UlH4f0Ay^I}xI~08TtFIT)kC;ThDZkl~Q$(!I9R
z2S{C=8OQXmni{8H&^s5Qa03a#F7DD}>3gi_kul9zanha2>qw}T_s+M#_u}v0C6olQ
zcC&xmxnJTG;YY1T8%F!DfaB{6KwrAxm#hS;)81u04JK$HlEl%datC8$HF9YaFCI%K
zHv-{Km*U&D%zi+S`DGpIDu0x7M(+T`hdOuSuPG9}((kKUOT!+?by=&&U1`p^Ayewf
z7I-Im?>#2@a%WfQoz}pV!t=o_s8XOgQRmt1NEN_1_6rWwf@Ir?QbeaH3)W|gmAx@1
ze1)^VMg+c4%V}U4Ai1DHgsV%8F3l>y)`kgS7fR!P$mbQ7S<TFyhnXckeU!ox`yfeh
zV)bKe>8R~Sw5roGNZ=1JvbCMfr^Zz$#ssDu8a5>C&7c)-ExSa&yJUWzh55Y0l+M3s
z5dXz?4ms&DqS=CpjY_IMSiW`@=Nnx}49XNcnb+Buoc(I@@|4?|VMUb&xU9W&^q0#w
zHjUXnt2zj~tz7*UgBcQE-blGK9M{VF9cQ1#p#QSKfFAy>?jzHTqklU?(#6#mGNG(?
z<<QX*cy~6Tv~dfz-Hu|B;uIepQxR}T(oxzed2wM%W05buhc;Z=jwgm!CjFyyq&0Fv
z<IWKg@l;jKd_1WRc)B2di681vF7psI3B-0BK^pHxxcWj8b`1({<Ycug`_WfqrFX4u
zT>Qp$g|rXFZ=Ju0B+0Z}!m=$e&gnWUsRT)#nf+L_FjgV5>~i1XdC9_f?GXrf*jVRi
z!?u0M2rLmc2>Jo<NS#US$T|Z@9sR6;>Zo3BtZ0(+LH!ofxRY`q>#93*YMEJ!6tIzi
zt5VKsu`gmR!72K3;;)u_?>bx@x|3>6E<tu9|NEGi8#KpJn6H&Mx=t{&e6q!|Sj-a6
zD4{&xxM(wDUh?g2-T#ZW_YP{ZZTCfksB{pK-UUIVNmp7>q=|qay+uKK6X_5V0qIRZ
zKtTyrq((Z@A|2_y*HA=i0vG}b@jUO^Ypwn5@2oRt=FFTwGMNdGkf+@DbzQ%9P^$ZQ
z<<46p>x9bvW_1z1<X;F}2PSzR0C49eS2YU=T7gF^T@AK(rYj`u#$~%wxka_zLKb|T
zb2a(2ANP}`zgM!S9eQJM(hP~_#TXx+-ABwtkU9XsP@m-n86nwL1M7ySJALa8j78V(
znG$+<1bsY;ta#Mip{Li+HK>V$AsEG%NfSM7Qlmujwd_M?e3aLn{%(b9_k*}FDY*v+
zvnD*n6IsW+Z`<f+BqR@2#i0+Qo#LQsVK3^H6J-o2d`(Mo5@09A<l;Tj^r27aC^aRS
zENn#`h$9X8OJ^?4TH-<V7oQa1;Us`j^9FX4G=rc4yL(XJUSNfjVYdR~X4-8zA`IjA
zRXHZM6cn0jmKP~4cb~N-hW8B)mVXN$drN+&k_!B7<=gxnSRa^jN|OxpCx!U<<xCX3
z-3+it`KkQkF9?#QMaopS-6hZi+JQW%0Dw>W0|!APZWU>3BDABoR1^HlFfPGg3lJDw
zp{Q>FG(d9r3WfJMPPnH^^}t{cncNDzO}mP0tBln}B#h%X$55dHjy20~<JrQZW_72S
zSI8@NZZ4o~38&<n(fH?G{!h#Eaui+|FsK6Xv~w)5dW<i`_0<4_{^T64Y!X!kHl!2a
z%?P(U>lJrMa;|6;1(tQ*ww`ZSit=l!duXoNBkQkrm+^fMIDpUOBL7=k&6JqO9~H%y
z-)ox_g`&)dH&X9|9RB08BOtUu!UqxThGv+}L_aj(XvttSU+x%`whsx}W~)BGo}Ibf
z6;RoWyMz^77QIMpyWv{Xtc`Wvb@(1D%yPXom+PGJ+imhaj(=IWMO-b@qmqjkcjgO!
zyE!>=>dIDge@)39kWzg^eYU=a%Z6j!x>JbG*hdWXi7$D;wC0cR8VRi-HvwE<T<9+-
z1HSZx5s_YsjJcJzK9lHx(THGLm87*6nRa>>If*Rb&-lsa7bg()A*q-=iR#?*c0rVE
z)D6a7HtNy>GC)j1p(Z+)Nf4KSoCV!Np4y!U4<H?i%{*@r<{*2>ZUAT@UQhtZ)a%@N
z|J4lx8+e(0o{K`$R<UrJQ}KgaUBmFG+s4g^AD7%TTYjyxgp~v$*LV|&k_DIi=<L-e
z%lE_o99N3JOj34g+XDRRegf2m;xR8^XzdFO5g_<!8Tpa`-)a9_B)=%V2Y?`q>i5RO
zZyg_gb26`*9n!&M;q5Gb7u4V|TX_uA;J3icCs^gv0Dn*aMM0){%TCVs_ns^Fy;Sd|
zEmqDV+*!vBVv_O*7Tb_&M40S0Q7=TLVsp5mv^}`&>bvPN<#@70`?TTr)mKsidN(tl
z>dJ3EWgr8F=ii|(CsjFM1HBy_f^C5DP?zY*c;WL`11~saPc=dV_O(C2{WXy#U^~QH
zfT(vF?8pGZv)dcDDMABIH|Q;KKx-=GjzG_jY?hFA#9{ux744xcQtk?-g>mAC=c$Cp
zYgJ5-<}tZvPggY9V?QPAU;fe0@Z=k}HpQRxHYw=saaE=T=!+&Sb9!>ve2-G!AJ%kJ
zhMK1EFzsRUi_r)%t4&Y?aP)?N>p$i@z~0(L_x^x~H{F*kTQTtCe{hOIyZN}ecqF`*
z#`KAvCXvo3o>VnXA~&urSZW^i?~e&2usEvzpq*I*?;+RVOt3|8{csJzH85L0r*~~7
zVv7Kdw*St%yH%&oTzVUPJm6#V*!W#d^;bbB-Xh+H<SyqnR#+b}WmDF4x@Nuf+vvA{
z@jV~aFB(~Ue;kf=v7;g?WVsB#lF?q#eg@2>o-EY9fgh(vSzsr6Y4fNLhN;V%b~GI!
zDDcm4E1K=j>?dNCY%lWu@RI$LTtrbhs94-Zu(Gl5I<10s>SBJ=$ao4A=*_qYyrPbd
z4MR%d(=h_i8i5l94zzF2xjz1DsxC&hf(a5eKFpF6Bs}RQ(ERD9Ci{m{8*P2E)nGFh
z0zXl78tfoB=LB@zb;3Q*`0<Gq&IWKP6kB7>#0kNs$s>%OOzU~dfj<2c@01VSASfXH
zyxfJkp}4YNgjMQJDSZ7KMR(GfJJ+J-PMdlwvi42Vp@)lza2bo3z7Jv&g1-&#V!)e$
zt9rXyEk%@@KN}cuDD!avm-Ef}dl2s%Nh@k@$C)I`W0vC8ec`8Ao+`c&$vD<ie{XGl
z^QG;o!jjhHhiJ4r`A>n?P+(2FqA|Iz>{0^IF0uw!6}lwZEmY>ok7=}R#PzWk({3%v
zM$z1Kes*8`#q}XBHda%}_Adz~dP?2Cqh}OrD`5~^$VD^Qfs@LP0LG2H+2d=qe$Khu
zth?=`ejxM`oE|*0PXTcA@GhvhWmWvU>Yx=0u*1G0X=nDA{P{?HD$CIgIBiPz-KVOU
z`2xJBD4axHjDfFHBmfjgdMx-ytMJn%?4_TfUn-Unv~SI|9qQ%Bb)`kjnWVL$J$$!~
ze7XUCHI#b|GJ8m(`dI`UX=C|Fw-PJ4S6*3cSZ}ou32(4nVmz&{`B5_LUmzItgSp=|
zIFrcO{6iR!7m*6qLp}hDH`J-pMn9FO!sBI`YlI3`T5qH^XoSdO0GU*NP(b9vQ{>4L
z{({)tkiG)k0Uaeyo^14kryj|EI3&P!n>}v7235SsAh8AlPWcaVEv)q#isvN-Sf8yX
z6%3_+KZIoRvPtd%!6)r6RJjAWp47MiDOBS7%W9OjCCZ;?n+gUue839W=h+5xfG(Ob
zzoKPFXak)dV{)?DIAF;xSKd>q{fL`mk!Ab+!w`}T!B`wJFOOhW02|N>PH9)3yE8eP
zcF&Hr#q6);^EzhiQ~nX%ht&Gv^$0o;3*sx_>a79DKPEQ@RFcE4kE7Ab;rTmLLemZu
z4MR6xmGI2Uk`Z)QSID<XjQEgTqGA%|f$R{CUhTwn1+~60%ZJ~--g!;gK~Lu|rNJdt
zcsDoc-VeYLpPB*$QY16Tf1^ADWY{o7{RNQ|Z$rJY&#aQwM!T>JoF4@;Opc3&yBDaH
zd}?vsP+$pR5V`<>>g^Is_$u>X&|i?i%nVEdqZLl#bD`)YDUSm6_H`FWjm*8Q^m4Nd
zlAV*=*)!3~&7bW(nr;KAwRC_{!f-Cg18n&naA454euE5+!W?<cCX?dQi%DdVzn~+P
zP&!P=`bY;Pd0zZ5rtKO&PLlEWykGB}r%;?oKI2H$%h^Z2*}<aZ?<lvv0p!O2+j}zq
z=App{05IlS>)Ug)P86*RjHUW}=5Pkxoqig&!c1qIgLgMY<wvigW!_M@g7(}n10-q&
zpdBv29bM$0oC^Pfw5umJBA&J;yuKWe`QpGh+0etGIVY@j2(~q|X0~_e&Cr{S7d7kV
zjk}Fr*Tq~Z+N>zdJxI`XPjR8XcGC4`gij#iC$}^Csc9R4hJ{B$)qts)H-U@zWLh9?
z;QM6l;a<$ESA+9~@y-jO)Aw!K-pue4Okp#b2)Z_Yq8yNn=X$6=rOF@p%eK0<DeeXC
z{Y35DODe${LC+$a_)B5QOJ;WW*v|lCgZt}Bu_SKdJ^ZbF)W=dh%31;TkoWU?O>$qN
zxxZP)Z||I<d)v<BJ4n0`7$|4(YG8ZGOXXu{0kE5_ii1S^fCWc;8kqbpGZY9pxuTLu
zaKcSqd?JeGAw;c@_qbo`TZfjJYOme{GVsu^MgPQiftlK<Nk37PwV_JAB;o2YSroO4
ze?1GPCC<}H_qM5^ZpbU>PwPlFlV>}xq_s9z_JRN&1*&dk->HnW3}=%4ev(Y-G9evk
z+P|;wM8)~Q-JT+XyZZY6O=88X*M(~sGQ#KoDj5FlnPNzl3t+$A#~OKE9w4Bo0=FzA
zWz)vQ<s@6ZUAD_^pRIGzZW=RXom&DUQ8fI`K1?7`^{})0v4>~7RXk_W+P)XRQr<`H
z4Q9{AjS_)YV_>}R0`*$ET`8w_bH=xX*I+7_ZO{z2BG^fuSPt{+<uo@#Ccu_cyCh>>
zB*!6g1;=JPuMKU7JrQ~{JE(zy(UYcsd@KLkO6y<IJ<(suz!mkM5<KDmL4qgXRT1J8
z>$fXO6BzOgD^cj}R<xk&BW!1SLqhHJ-j7qH#DAcU0&Aa>{uk<)1)z>w+fQcpw-S=N
zG!3<JNHYpT6SJEiZ0BqTICoxzz>SJS;{;W>|4Q;khyxJCXgK|Ul6ExyyQgNx19ZSE
zcKAp%f+uihEnp9_s)V?6*vp#H5d7xy8#MaYUOg2*@6pgp3x{{S2Lj%47tP2HUJi?T
zK<Im=7E^(Yx$7bBUXalT=8N&Yzm@D6Y`5;svp)R>><ok-%3+Z0htW+8o#4y!@hYsH
z(<N?~$d2WgZM9T3QU;V7{Ov+!vWV(<s#VTb8uV4vS|Z27V=N>-FMQ|FFu^@5r1dUq
zZNTeS&6GWw_k`~wP4N-H<PAmL!d?nwAV-vH6$FMniXU!nelH{D@~(h7?DO1*NMjAL
zLA9qkms$vDg}8lX4}x4^F|dO(RB{|G*kC^6@{05}f094WlxGmHd7EzZXpvo;HZLj&
zG(8)9RAeN_-xNTIDbaf@A?XN{Cv`d*Uetp<8Q5WyBycUOqFGo)#l+*t_Pg!AtDO#2
zR>`UNwmyZOIzA_Iaa=@Sl=;!nNdi&Obs;6`1jWE-Rz{o!GINjPKAk%9Ykfx!@ZxVm
zVtlt@y!hh|WSv)~pImFgsWUq2_9E}8ZVB%p$Db9vD7^PJaO7M&0Sa|Z_6i&HNmE1o
z-qTB`<OWgCyCSVWjVSg~(?Zt=$q%wb$KTs*RD{Bwi2Rf*ez-zp{Gy@*ep#V`tl9X9
z{`{cg^<8B|jU{=q;Z`)!jRr>;H|XV^Z(dc{o1#3nXK5OV@e<f66uch#@q>S-WnaN$
zz32fTnqXQjAdSFlio@HOm+vGRJgGUZyB_^Y;nZ`6mG3U0KULe%z|RoE4rLSoyq=jU
z)(yI(VPnNm>Cru+f@|=Z87rsqNZxe~-^Nq9SSLE5CQ8F2fT=$<tjAV%TG<|&1<PDb
z3@~hL%24kzMcCIjiYFCjNP`Me1G%z@O&67wL?>*g9>6+uG2pZups&J4Tc>um&s#@J
zx~vTe2C36b_#Q86M6vy};DT1q<U+6D?Xd#r=w60c-fz=U<1WjWGJ66z5OJ0Hw`_cu
zu5X!ZG^$V_gfm!6mKm$+IKj5CF%J1OtPF`d3?sQJ9PMG>fI00{5?6&(bxF})8hSZ7
z7!rJkGtgs{A@=~VT|=$SMC_4xpkU0%8((5*W@oTNPBzO`GF@#`W^jxp$sOf>!QUnq
z2oPqz;rrsZ=AlyGF*DKo*<X_{L_8!eAzbq8ma|)TfdRfesu=&QGZ-1?=XA8^>!x$)
z$w>g*WnTK=?_?2$@l=>2Ko9hfrCl<Zv96D}WQA7gX+>KI?%4SDSb$Eua1)FN&gA=E
zjHIc0)D`%1gXk4zabs5=KoT5v;zmc`#~^i3mz^!Ec8T7`?$z*mqfNn<1M(+BIHG1N
zuNdel9+B9f(pcZ25<K#uxw0X8p@ehDzP#3;{I1h4Rf`a3oy$@0fJU1USpZ(mf-^v!
z2s%43N_+uUlMBzZs*>iy!&>Y9p|UPWP)5i9!D=n#Si;HTx796$5dZ_ayeY7*uwO?|
zCygZ&2-=QW9X;xOM_z|)?X{<(UN1|v_m)q93S}L^Z2pgkh7a3T@*g6aR!!(9Ktv<-
z@$6g#*$2i8utrLH!gz>!K&o!yd31u`MxBfKYjnSiQWHTo)19FN;(A^~qISblkbvrA
z&tbhG3L<gXrQ?y`KCBSh<X|xaWN&w&(tQya{X-DEqv;}%#NqN<t9spdVz^4Ghlblo
zv-x3Ym(k4&P%eYZD2Wp)gs0&J7I+fRc+^L4^!-Zc12j#2mPO(B4CYibJI8?8IGXfC
z`TUK2!z>~&4GEXu=7^3tIZOca`c1CD(fhBJAix$sq8+hpy?RP}>Vg28K7es_g$*AD
zT=}~=d3?&(ZploavN?%F%3+$%`X=@77z!l?LdnXL@j~!__GGh_s?0YpvcM9Dkhpb=
zPwSj*D>6DX@Kx}8Fg57h>j&gAiH9hM%}i_wT@z)kpKjx~Q4cDAa@3OJTfa7~Qrh*_
za7%%vM@Me=f1vyPAA`gHm!I?go%#O<jAkg3^`1uPdA_%%l(5#goT{K<1n18pX5#CT
znW3Q*FB8sU1lf5O%Kk){J#TUt^ZbXbe!>Jv&tj}=!>`cfT`&Cv)QVGQE8NCg#=li6
zLlKl^ifKD3=N?}93yaRC8SR($!|zIwwvn=vCnYCy_4m${IB*MM;-5fpZ+QB%DcL?h
z%8%yIF0--q>PC~oPXSfv7c%V6vJLF}YCoIWC_aC1i@_2I1%29pihZIbn4}SSP*wy$
z)+X(9vlAzwwjR<?AM~3=XE-u-8q7`2o?t(i&m`9tfB&tBi(tuPOu0eD(vlM>RQEA2
zUArCWF;Pe9m3Lj>WeNaSNATpar}D>2bqAk)v7jEs)lL^*rQrGvc6w%?I4XBq{qBK`
z16^=}Ot&A;hEjT2hlEE_?T600clv{8baHo(EVTJQS4V$GDv1o;qSz~Kr7wrserc_c
zDVu2lb8l#@vAG_d<z|cx8YSF4v^~B&w%EmUle+FTi4Svb+vAY<s-xMbJkK<_wlK*Z
z#e=^1te2#qG2{5nPltYEDER%eg&mgFlEq5VPT?qR!MpwP=@k{cHjNX7=EqHn$JL9=
z##u#H_6^*bC6&P;**pT6-G^ISORpJR(I$nOi>ju!E00fgt;#};Rs^;#n_WTk($_U-
zXFIIV*9}S6BI*mO?!#19no6wzFY%gqw=cNLoxta<(e|MJjuu*(0tfn;XSUI6D8`cR
zim?svG%E*-4!7B9>A}}qs1R}nn^D1u4VM?}n)k~&b-$NyGBEZq$Q`7$)9qbh^E74N
z<k*T7e_J8={KJsX)<@$Ku$z{>`&GLyt)HK@js9u$qwJ76yAbhPy3YOhx(Pf`X(naf
zR?q2fD$8bY+@Dq^%Xp&%5pWB6Q7{{A2U|>t;=(8ML9VYO^Ur3FbO-Lc7dbl^NsZ2E
ztzCGRf6@>+(+l8Oj%6l__1*omp<p^bH~b<qyp=8xpCE=w4=t2edCV4Lmp33j5)>YI
zU{4>-HzR;HV5pdM3^b!v5&Z;oBQb)t=^nq_OOQrM<_C7PZ>3Wp8V@U!9V9Fc0{!@v
zRdg$oK`&F;<s0wp+8jnhHH~T9YWD7|#44)_J@fHwd@;hjg%4awPM`b>x^tFM`n=4>
zJ!C9h*+fZYBqW8e^=(O~s9B~Pi8rH1-J5z-&kgTpyK1%AARK11)WvA4X85f=n)$@1
z*nra@M=9r)Vp^whgZhtkxOjw+I`s*dAuxW6Wkw5O`KxZ}x*L_{Bgj&kHTwP&9j50I
z5OK{4YjG=ImAUaKAy$=xon=lut-FFK^^v%bMyA1sZ$|cV6Zn8GjW-QVD#1)P=}UzQ
znD?(J1tK5@F~A2t#x7!So8)j5<@83+L-ZW@QiYJ_qkp!&@)-NQZv|~N<PUrqwDPnU
zs`jXSS@&L##;z@ZBChOhNgqz-lRghyjE|Pje4Waj6~ng$$sbPSHWYKR<+G)9ST_M4
zOA~!FOWw64_1G&eu36R!7-_}CS#(=8YgkcibZyeF_{eVkw`aGiHaI+s<v-s}mA@4#
zI$c{~$NiA+!P$jqU!AzBE=^R@Q?-3f1YG6q?oFxPJ{*!la`4Uz*L%jW-+Oi#<K5n@
zoL?qbr61EdGMJ^Qw<+OABJE&x2+(;l2qS*1uqH?Gid-7Dw+m#u3^aPMHkbJp%c2xM
z;_7SBqXKlfKQQ>?VBEtb;!>@XZQTaemE}ZU+m$#kXrBZcwQ7t+mDE+jQUV{I`zV&C
zj@@P6B`b@>+<MQ5hYdS)%JAJMihgH9w)U0$d@&=1J^M6S_P8@_NSv?N)e<LA_3O$F
zK=JE^g%z#AuY6YObP9+e>c|G0X5_BMXCpHQag0L0gmd|vDty;o9aR{~7BtJ089tOS
z$om<{K$0-)t_VQ8qguv@GF#5U5<zC~xmK)^grS(J=qnEZ7%dGW{8n}aga_+jV5#7-
zlSUT4+4hw4mguF$4Arfs{uQY%%_4};nx&)$DFh|o*ZIslxwUx;06Q&#oyYp>+J822
z6dNN%W+rrRuUB{z{7s8GMxi%gUZNPSyEP83^4Rx~5ctk-X`n(o`jhXSjG%+M2VW)V
zzWCt^Mt^0V*YctOm>X0`cB|e+k;bsLi9jaf&M~w0yaoD&n9&WjQiXP4Dg^rGZWaZF
zI{Xu9dPN$~jA?)KeFDbo!b-Z;Vq2P~FUT0hlefP=qLR}VdJ*oBiL<|GhTVnzw2Wty
zO$^#-8B0lCCP;WzJWMwG_BlRfnNR5z*>2kntnj}0KdBi&D|p!j#rj7bxRu+VKB%<S
z!ig&l&b`Vw7WyPeP*@Uw#p<sR<l3o3awR;&&0;CyiJSyk{77%k6|BQZL>+==zP{kf
zRITZ8(8#qr_2c4$uO)t3yuY4%_a5ImA2A!Kq82F73S9>CGPsn?)2hJE?s1pt>pa>u
z6Q_M)2CwWJ-!hHv@ucSg-wysyaY326mm(RtmgY{9ofh*w%3Vv4-$dH9g;k6h5Pk&Y
zGRR#d6IBS#un92v$w-3b={{=--ictlb)e+tTq`cWX-Q-8gvSx5J^UnQoo#=*8S#b*
zHrvK~@m=mP0(Ao>0Kw1vP~{w5Ft+;X+w68*(sJ{Kw!P5pHVc6u^EHS2M?aOh>yCL)
z1Y^?JN;PWFW%V!`#)y|J!%Lqp_mAjCbTu4$d3$m1_Z}8zh??k-D<8a+DsKe6)3%dG
zEG1J|1%?lFC~_m>B><E~u20OP0QG%7_SaJRW1%$n7lr|CR@9dgFhH5s1&&8B!rg|*
zNz@btq(MdD9uLitPF0D<aNIn6@8W)OT~(uwQ0lFrHui#}LhZTcD`Hf`a6PaafaJU)
z4f57x#;EfD^ur~-7WJDriMXqG%2CwuKJufQvBw9O!l$4+2_P<N;{L@Ke$og~;I$H|
zo5?R7YgP*qKGxksy<=V?I=&}OBkFL)YufPfHg4F^yv=mcSNjj1L_Osv&tq_^4<590
zu@%`StMLH%)#Voa0#<8%W)EA2??o>+k@%-Qpjtup++8W^G~%`X^{IC}!UUd0r3`D2
z+#3cVKf-R|CvYv;%>BQh5<n_&Syjq*9`ApzU`kF$AMrxk*>wDChBn!ej8J!As`yZ2
zZCvG|j2RgCpf&tRE^GvWF<^*UVIgYOt&X<nd~LbLGVkfR+~1)T$lCTYJza;JOnj6B
z$hxGOz^HfeP~sg*h+g;{4mdEzW2@9}E!Dk))~+ZPzg5eojHGvPSa*5#7Pj}4Vuts6
z?UMh%YFmSY1DY_zYBJ%Q0pCA~n>$F=)$U4uHP)iJ_)(sFM}P(pNno@9KUVQF()>z2
zMHp0Lz14o5RJ7)%!fR+FPevdAWhv-LOjNcoBT1$Ca>~iD4<rxJr6Xf_F_mC@L~K^q
z>!1L|jL#P-^z`i6#wi}0UQNBC4Wk@HBruM1h9|<So%RGXRoU<YW!4%#+|#AX2FjR3
zDJ#P?hq?u|yiMOk<&?Vcs9v#BA2r^mz4inTqWnc&8yitziX`ExdLP3Z!<S}^Y7XTX
z9+!<9at!itbk2X(Oe~~spGy7!0wo~4fD@ky)xc+BLU5tHH()II`P~l1`ZTzgCx1AN
z1scVg^wr3qRzpA}*5vbJ#>KnJ%;)MjvuRa+d>YOdABu*@&8JMYm{hv3oG0!Ns53W9
zwemn+?ZX5TA3xfDd*vT}g4@w9iN<REErfz7iPy|j)t-^FN;F!1GgKwEZWTC}PUd)d
z=|1R^j_p-%H68?}c@0IpL5^nKBdo0?1XJuY$u-0h9~26ec@@~=;d-f4-5qD&9(ht<
zZ+q#W{}*(7HRr=tYbG#2C)nbPaaDLog$-1#t|6jZ^?FO(^nukQsZPHe+qUd2)%v|k
zHrC_~qUj*+f}hH8U_Bwn`%!eH<4p*>+ll~!CCS1q=bLy-?8I$0w|b5;{C?4Ke&Wb`
z(DTx_*Fkm#Lao5nv`dh8U8y?UJFakDxe;d>7;hCY?PqQ{tx;897k&CvrsU3W9QR_0
z==c8chX;II@cngyk?StnLjfm;2QWc2GIm+!=<*l4M;u1?nKT5RC-gHunRBGM@mwj2
zf_aOT#B<Ro3!Xc)!v6*3!$uXdih<>nd%veD*T#kAW*6L%#jVWYOrP7%sDFXX`^_b$
zly-Q#sPB^1dP6TN0bI|TIH^-&tMBeU`5DdH=A~%zFqo1riS6m1*{)Dn>je^O;)daD
zN3kI#8PfBJ+L$k2#2e29W?+LJ^6R<B8OE;-#5ymviV3Pzh>W+DEkh*ZF*Bs4`=xC<
zJvKbaCq&<~oI?T|u<~IhQDm}SaS9pUzt4NK<)TWw=%Mdh>ji@1y&Y$_f8Gq&dAgu;
z?<a;Ah%2ALnsq{Wx4|`l48Bku4UZ>@IH#DtXj^!qbCy_S{bpR+@rlgkB&jW(bUq#i
z5*6ojWf}tW4v*x_hxTGu#pQ~!SkBz~`Y28pwvelJ@ctIycMS4Zps(=1vGF(*w%pOf
z=-_wxo-T2hHY-B*xRhz4FY-mC)VRFp52WmGm56n%cKE`twT5;*d-MeY@YQfzmKm*x
zyqHdQDzwtFzbQdGW)=C+rr=6k)!U#j?<$|(6~MPWrxh#H4XJ5(Lo~$3tu6(kEGCR_
z=b8<=reGJxjBBGkU%w8}@IAlrnt>geTUxijS^3#XH7|rOYI$Bh!_4#2O}fF}S+Xn;
zQ5GM7Wx`cr4~aJzx>jmT)3L?Ih;|r5M##bf@|z37MZSKQ(OFvD-;?lYfXt&+dUk~Q
z6iK`x*<-7McOXayMx&!Uli6(ol`Jq_^{GA6m<9a?giB-6OkaxU%{21U<}kfN=F6Kv
z)uoOj!vg^qym1INfN6!iO5~kV6#^&vi3qsGi!Qin)VRgRN;<|SoGqH`P>}^bZ9_L5
z0y?UF1#DU`gpvrxMEAfc>I|X|(H^!+9~@dy4K0M%<|1^L1j+egog%9Zo`deMlAj<+
zRBI*BS6Ji^8!-A;uOz1pzQ7RsL4n2J$I7yuIkH@OfXm^@wVvVQH-dJ9YBp~`0ZeAN
z*^4q|3ry5{Czzac)n&JWXorv6Wl1B?O%)aOf1Ma`r=dT{l#+9U(`MuBX<29}CL2Jf
zWbrmYQltNmAQ=0&nD3}r0jK%(o6DPVsRploAgS=0mPBkCiMkmZ-<!kd<By`-^Yk4O
zgVWV?VP{{2N~2tar#>gwfkG!R3abE)vj=2eF+=t7-B<xD>}d?LJQCOX)%K?>?wiK*
z)F(gf9mD1X5@c3yi>-8&bubJjF91U`0m5U%B^Qz~UVL>)Yi*{p6}CD*i$@qovKmf)
z5P8SxEGUi({7iOd)8Z3tSzaG<C7<jv<2yHOJc-6p3PbTD7d|=&_{Mvy@gh}e8=G1%
zu*iT=k({j%8nX;d!tnm}4EqBExwA;@FKzrOf!>vgG|Ed2eO4AoSbN!&W)q0$2=2;1
z(q;495Wh7PIS?V}9qn_J#2Djr%;aq_fw=S+)RzW~8wnJa@a^;>Eb6T<oEI-+gOQ98
zIQAX6HoN%yRCkwd(t~Mz#f>Xu^eVg)5|hJ>uUi$TK^ufiByL5cIgOj^QZn84V5Pf6
zi3I8<+;c7015xZDiE?UP+!0VW2LLJCyD}f)Yg98!;-i0}IJ=g|l5x<JbW*t+?)n?*
z+ektD$a)9>Ob2RP1^Ph`ukRiUWfyiYE?GnK)wio8Y+~6~$)_7SUu>Edx^((GndZN>
zMySV50FcEV(J9;9YZ-69*4bLu;QM{L5VE4Ptx<igK!t0A<6N^55p7HP?Vn@^nGVH}
zp!|OD@*wQw`1_JrMb7I3onOWJQwwJL_Av=t1qQ20@e`=B0I$grI=vo+j6<`FAa?)^
z2>PY=PxRj}fX*+BH(2fM{0v7YCrNNDJi_ePST9P`jVtgQ-J21R6sXR>q$c*`I)&WX
zcY<=@v-QLMyfPP5?MTlE^Ug9gfOW?~0?pdbmG_;PyI87Y`M#slUrmTgCwQ`_UCA6s
zC~Xi0_LU^8<~KkOO5z~$jaNRQT1Q>8TQe&!as2u<dg@UFC7yJIEP^%StvZ7ZBA`-*
zf$D0}d*_bPPG0tIY$QtY0`me$yD>HBEDaZPQ6d3Uml1$fJZAmJIkL+uHf#T5>$h?D
z7tR&-4a;K}`3KnE^cxQ*Bf|AxaXxo&#m|ta1_)1Jqr9~YJ%{l)IA<Lh6W(9c{N`A0
zEPw4pu~lqA#=WTkDZVe`!w0>*fmp~lE6o7=oR7#(1YU@h__=r=;0(QRfuH;eQsZqr
zG1LIWu)X_C1Vbp##Rp{}r~y{p?3#gM!))yWRQD?c*g0vhZM<Tj6JSn!t#G%GVoP#<
z0ymF!>RgHON7P8}{aU-<@&X%S9m~Og)2_ec{=2^FdUU?2dAm<))lK5?uPdUlcryYg
z-fI;|BOut2=7R}DZG2?myl$DTwSI-4Ly?wil#%%JdF43)(4G?WwN(ucdvDOiEx-={
zD)zJ!L4zl)8>DG^G5$8S%%0Qtxs}%vCVaO~8<M56V7||l6j1~{TOC<YT4U`RnZIf<
zM_7A59+-b@Q2o7Svd&FeHQRZ5FOHvyHr6Koc{TJ6hCQ1ft~%4rTYE~pfjbCcxGLA%
z0iN4<f?0%Ir!TH3bT`#*e|8)ZULFU1s}#{PnCJG#U=^}Qz!c+NV_w=);-BUB7R?bW
zyp>=_2S+As$DWRSvdJ^t%nv&5R9*pv=s|(H>t9G&hzlflXbOZAXs{mqSBRGIUyxg`
z8pA~tQF84o$^r5=crsWo-<6^hXMjubV$1f?3SV|qco_~Xf=Z-GNJBsulKwYLc?{*q
z8{I&<*@zFt#k4#?+dQ1h9rrB}Z~XW|=ZS}(Y^e6-+ib6HsY8rNohwJq5K3T4v<9%P
zF}rfud>kuI8;=T0z&kwypOJkfAB3-d;$>=qV<T`@W5iIbjAgd%OdXxpv+Dqd%Dg;)
zHYU&B#KeRg1Ojo39_$c-DRlS~_|Nn}CsK!E11Y@~_WmiwFmJ8aK7T$DR5j+F*_qXl
z&|-%EF4Qo3qIYv{D+}j*>7&Bq8@<$geiB0&G#SRvE0TvL=j?H17hg%@q~)gG4nVk(
zBKg+cSLNo}N+(Oc%$3@*4Ou<0AI*9~Kgm{5Uf?@l?;+<~bKiBnR^%Yw$4mYNiDcr-
z{(_!=M4hB|ya9V}=f{C=BLSS>edRLL83-km3)NM_Ckl72M5}UOa7Cp%UImBA)~#)|
zaXR+#`&?qCVK-#<p6>;ST)t+u$vaEGi_63p5w7e^lbErnIVfP!5VbY)WZJJj<7}^X
z<iw#-ie-7|CU31Qe|2*oh4Tgo)>j?%4{?`LWf#kdPToggC09SeZ@{jRhHM$qy8KC3
zn^509+@2<`){Ir;^DV32U<&ehJw5(?p)PLquq)OkdQUHx_z>f?{}bD=*4@y>4e!ml
zipfZKqMI773qE!DQ&#06v7RwoS>#!;dWqS;UVA811-PgfF-m}Nm?2Twq!1xsf>}<7
z-)a0I>Ec795x|IZ9zHBhwmfV%F->Q0)`VoWqPSH!@9%cH6qOR25`mNV3aXC<@EC?U
zFD>k8*O046i0z~t_Y+;eyBc;?i_$kE6HQD2ohJz7i_C?o20}V5lRFG}cCw<<T>Jua
zcqefq;w@gc=Ujvql`bv%|B5?fB2h^JA#f&Z2m<BK%DL$uTyHPK+0A93jjMv20PGbV
z(Kp+wz!?iSfd5Pj)CK&uy)MKvP}-u$a1s^pg@p9hB+oCVfc!Yi3%*>2lol<56OkVy
zyiW(-+r{2=Q5G%L^KkL`;%e5Y2P{PUq6l%vdyGxr?kErwG|4?X5Fz-Y^%Ts=8Zwr2
zGg02-WuTW{(<H3d(_8#UePW?hUgz^~Y!p`;k;#af%nr!>vv%YvDy~Ty($SnXeW0ur
zVlPS?lri!Ay)tb{zdXqAMK{b^Ykg%tfJBuBcgrI_Rp4boIh_gVhKO5&&#0WYd#RYb
z>>J1<6KA^?DGL)eZ<C)8aG^l>$u-i1EhB^l;8>X+_ft!X33ZuGODkZkAEcT!($fe$
z-*aq7dQXbwPnJvg{{A?w^fgDw`BN{SnNeX`CG|Io@cR@gkaQF?%5Gm2tu_XCL(B$r
z(P4h|Hg&(}=q?G<tN&d7AcSK$Kad*D`q4r+N}V(3R<dB@iNPEzuoyFRdvWc6YchLL
zR3ob+396it%LkVqx*x2^@Vh+AIQmdl7WTcskAMAL6g5cMsaN$De&nA{8|xHZS7G1H
z(a^Orw{G4@xH9gV?OEqVKfr%6ru&H^LyX~_{Ixgs^GSw?KPa6k-~9mHn(32}x6R)s
z`IFGg&cjCL4o|mtLZXZ)amY_74~9!FD~u=ya2$+%GXGd@RMP7?clR`cy`@3mx0nvX
z{U4&NxH7y1e~gpEWbK?@-TBq&v+UeHvV3j+XVVhHg-_%d1>p{GP#^w_JIp`Q4tlp9
zRi-hb&sw5ZNAQWQM^Z7<qjmiI|4vcA5`<`nv$!!WxPs|`=x`vjAW$V^If#MRz4iqu
z(f|8KEEC!JyUtHcai<&@hC~kfvV0qt6%J)yvTRFCY4x&IvDL+`Bu_roa>TB{$U}z9
z=vMc($K|#xUg&AbTGY=y5-?ee(HA$dQ8@Vv3PY_do}L4EUK|SZ6~0=<LyJvnjGEEG
zrx$5C(e+|<UgNx;r~D!;``#_#2Ex0#VMBPh?Rbk}zBxYr(I@L!*Sm$7K2%qdw6qfA
zXhfefkK2a9f)mb&xAyRj?C%ztub*kq4B?fWMwsP7w%nv`4}01K>HgFYqldPJQ(P}E
z0TfON@g7}cKcTE9)$xC$dW-Ij%thedV}B*dv5{z?FpPY~Dl#rhHOJF4%gtlnwwSqD
z&}eDiMx*IEP1AvzfB3AXXT))ICxQdUMg(?@@NYynY-V?bKbXOJ#!_LnpfN+F$h0w4
zMM5L_T47>p)%RhkUfXm5us_rUok-EH$}t7CM`w3WoOoQHc3T*TrX8SbZDJREeS?MH
znCT7G2{Uo-Kk_4i(N#Dwo&h=+hKL+N{Ie20w4UhNMgNlRqK1d8s6gxD^$&R#(+d7H
z6gGJ}&&ib6&t>sGSl)KvzG5$iKEwx<3e~LbTMfxKIHzh>pIvW}e&Jy3UH`~oQ%nC|
zJ5Zy>mq3UnSSunEruL9N)4fD8_AvjRlvRU>JtxDN+dY6OxAf%CS)~8-Z%MU#OQ}<B
z1E@2J%D$dfPmRzOjinqX%nD#x2X^&}pHHag$Xaw>q3f>bZcE)6kXc$PV?#=$yrHQT
zr7RGBCE#;qn4Wb{lwc3IOf=SGH-Oo2)P4)F@=-?a*OlwJ$qc5Iqm6W&$kUH{^#?_F
z0BHgfFfr}0achTD$k9M(+^SthoC=rpm{eM`_h%EU?sJ+Qe3GB;WOip(^&*JC232V;
z-ouy|h>Dm(<X4*!k><%iBF2IZ4M}+x{Rw*-ATgJ;I;~qDYGiutrYvqTJ6BxaLk%6Q
zct0)ZtD9;Ch~$05Dd33b!)Ae;=N1c$Oc(GB<wi^HBiKLNE>9m!bGk+9%1=~AjBE`F
zy0G8D-sq6IuJ4`Xwgj{UIjDNc9}G93-1rw5o|P_yBlaTcQ<ls4m-<GtR4eVJj|JHS
zcdKiitzpOaR^J37Crd?R7V$u)I0LY(+heUr?E-&6TD=x<j6TDev{xkJ&${1VP*DT(
z8Zab-&!ccq08;=gj#dqbLe~J^TmVkW=^_&sf{@wgd1>T+tc(;@3K}Mc%;b|gN%Es4
z4xoHeZedtoVfvW)cvLoIcK}h-aXhf85%g-P`d+&u_`$&|X|*f7fVWzb>>&lIn<PHr
zS#)$jH1R2RF?G8*qwBZs10Qx>&pIc^$zmi5Fbg<yy#4CF-QwKJ+;+zJVn-+4jZ?Kn
z?F1$1+P4aAZmW1zZX&RYg-1i(F~7PHam%cePznt1k7}9<0nMqW55Br(ex&<lKymBl
zE0EwOw5nQ2NXzdc_J7-3wXmXl<Npk48Q0;#m?OAkSJtAVZgbs+i>1H!txkI&z{HN7
zLij$H(>H*TK+g~j<FRTKA1<hHHKNgzXa`T*EdA`@<9_ewzo*i7HMs*G?SmKAZJJV6
ze<jDuj1Pa{S7!Sc1hZ2$FF1)~Jj(q&x#~nd-9C|cJJdBFbyRuSd<2P~X#Fm#Gi=)r
zR+xillbX1bBcS|wc!o|>)f<>S9*xAeAvbs|W{-w{H8(qaI2CFNzKxVF($Uv{9pJu`
zU}XB>-)$-I3uv>wD}>un6Rgcj5>#(By<w*As<@xumt~vZJ!^==k4E$6>yEHWf`ZgW
zmE0_p`63Ag^q6zM%+k6bRLbo1@nu8g3$5#m)=P_Qg?9$S4jkTny`}kZy(m;h1LU(T
zhRKXl4p>__qzW8)Tt9tcqb~y}R~L0<rHiel?+S#IQGDfN3>QVmg8}m2o}ojTR;h63
z@tudHm;Pz4!3p(oXFpYS7nz@jlsOm_g<>^84$i?Wv1^GuBc02f-y(F!Pw>EnZ)Kjr
z#-DhVSs)Q)VmM0{heajv)=0J+%&V^G*5Ze9b<s4T%!MK5nt7p4*Ol|srF3=H%-nC2
zeUdVKS9r<iQ1&TB4lwYvSoMlfrLDn-VzxT;WYi`GI73_{D!pi53_mW<G}09s4VKuu
zy$ZTlZji8Y31Ezms<K75BUny8`n9sKPj6Tj?Qf>aex)?p8h6$W`xN=wn2YP>B^7_b
z5*}iBkwUsgyoC2E-&v_SjD9&PCoZuyW22pv7aGKs=2G-wP2$%Fk-#hsk2kDm>Q1g<
z-_gmlySQf;`E>)}BwJ}r`T2B1g%z;Qhg{T@{us;e`NGIywbaXH1>({yiy8<;>kvf7
z1T~X1Xv-;qi~)wH8qiY=`%35az~a@53GQVElw&pRYpW-yL0qqJ<zhAB37Ks<IOMJO
zE(JVo>|%H&<UVh+g=#7hP@!G)qAcdsU$|UJ{C1Pm*L+k)rhbx*-SO6kRX@SB#hD>E
z2i!h+ZUh&NWk$xeN#QLajIO3nX`I>X^d8UO%cr%XqN^J;yrgsXL1=4TaMk{Izi7YW
zFvHqNC-^FmbFUZOi3H6J6bHg}&2-&@Bq}|#1XJSEnXG?`HC{;?g;3vR1%XtZM!~B&
z;A-9|WqT(qg*ryByCG)JGjb2m<}73l4B_4^G}Nf<dWrcos;Xa7zeGi`|M)f;+f}3D
zy!D8Pvp9TGFNtb|!1KFJD7h!YmZ~Y<HV$43z-~BFy(e^U<NLc67O{|2{h(pD{rTJf
z>ds8g*%f^CBf6E`2-8zrt%@kK8gP5{ZAiQ}k+$EkV~AX^Dz$JeB|ZA-gRM3WFh&<S
zYZB{-cS;RL>{mDe;vKico!jK=h$z%IhP`B9Mt2VBf=9PqvXSgk6m7}K6fbc#yD6M1
zADf)+?I-xe|2z3>E*?$F%eH{+BQ<FN!bx-qz|x=*5e_qTgsDWq#x%33n@>~t9vR1R
z*2c+!d>=j4H&5(J`_p}c3=4nz&*IKo1rPtj=4ZpX=J{E!i>_65MQ*w<yY)#x&67lY
z39`DPqN031zosUZFZ{CkdXn6Kx%rX3p?I7Hv|InQT>ryEbPLH9fr&<IG<3TeZsOg#
z66q0WX5QCSHTBc@bC5wM{|Vn}8szb`W^3MWn9!J4i%Nx>gu5J@EmeURT8j;=zQ~h%
zB-%h0XIy+(*1bLBM{@JqN{PCe_Q`k2wN>xAI_N>4%5T8Yk9s%jOQL)c#=d*vV;z#}
z3PJGj6j@t*ui;a0HN(=+gw?QA9l66lY=fc&hV9L`(1|(Xn6Ya~?+4)D-jw@qTeSa_
z9;t?0<QAsc0^Sdp(y5s2p7T%g$C3A56wjx4`>zu2d_9*7CFk<)<mkTs_7Rzh+7Hkx
zU}&-ujY8L5<hH1znE=%<MOD1^Ke_2kr2mzhp3*Sg7L7E!dnz)XH|GPk0E(Z&qfZ~;
z!A2#&yi$QI+gE^WxnHs4-wNG-irxQs0FdR^zaYC%R$K%&ItnHpXwV%1XHXTyKgyqV
z^M57YC)Km{NGI1Z8P?-C|0p8L;rWgl?<+$!-uK`esOSF#e8<&PkAj_f=M`-rozv1(
znxDS_)&U*&Uvg0i9u;c@a2xj}-AJpY{Y1)l=D3=@hN5?AW0|m{DgN#MZcd#Y6h_M!
zGp7CfRE@b#0|b*HYFtD?4GDMg^@R20y&9|{oXo}SbgT%M?enF*WWfcq0!|kjJuAP_
z%kDtKscB9NJKkjeL-7MOtJJZ=pn7Wvdx)NimuwRw8Z;`cPs`n#W)s)B@}REP)Gr}Y
z$vE?Q#3i}M1pDqBt|}}%$`3;0YA@eZQCmOG_3~@V;{%=@eXT~M0-ge`bP=#N^d-9j
zf&U!nXyNOj#*``{W{{a0lA)KFbB5HJc-B!;f!@2|DZ{p27!DQ<m}M3~;#N)w$@<t^
zU%tcFE*|%GawG(6BE7xD{4>+6E-IB==CqScBcL#6&32L20DE?34011xz#0hL`v9AG
z9n9&9VxH+44Lmof+hsZ0c5{$D?LX?vytHcj#Eee1=$#N}fIIcY<@}b3!ZlgmsGKVp
zSQ(m^5ihDXaiZtdEgf{8zTa9Z*pLaTvXEf+uPv0R+HB6z^nrYakpl%rFw_(S-&X{?
zhU%^-SdPS29%R`(RKWCia}Sl5-prT-qn~&1Z-jBVGsnHq=VSwyoIIrf8o1gKfV)ie
z#~YSH#W7xqnLkR9qE@a7h`CO~R5vQ%;rmPlmAUouDm1O(4rnRmCu{)l4Rb8P(5!~x
z8P>r!7Vv<FGlu4?c=}1vH<OxHr__+3w2?+8iXiLFm@_Mv%hc!faUd)&Gn6l9Vs-Pd
z1M(&-F|(sx%-~AVP|k<UyK{mEmi|#w4q?#V#V*yu^rSteZfHB<I;k^9_#&~6;hH){
zS0mA4?U3=N@-)RG7HRQCWi9E&&}yGIkyB}o^bh(LMz%d}kYO11kp#BD8C;hhtD09F
z%^CyM_Mn7jM$_#!7vzr=)iFU}y7OjLlfWqd;&rcJ1Mf2;1BM}%#6lFq9CnVd;8VdY
zw)o&_r5lq1RUEHUmzN&B5>=}nBo}lo9YSph_+Rz5MQVVctOQq5FYNxsH?dj-b#eD)
zOu$>&Uftq}XBw>I){x??@E{4*IkI_yG}kUB&}OV)B1#iBvO)*I8UbsX5txDQHj()5
zBfz1SlSXN_cI}H@&$M9FvhZ7jdrlfp*cIrOdL9VR|K|<-UpMmqhi8VrqyL++_;o8w
zG%zP<$v#dF$TGWA3M_2OAc|*3W*xj3BP64nD*HuZOHfGOlFFx3#s$mTlq%Ds;?LJL
zF27a~;Txq0EhjC3tA)Z!3<_NlH%^=nDn1m()yTfNyPDWnUW}0g+#?w-T_nP{%UpO*
zClN#qINP7!Fe<zZ)(fqlRs!Vd5jo57$@*hGUJ_zrU%toD(#`rOYEy8nSKjZrO@0pG
z`_W;r9@L3RZ8BlUfOIn%AIQ1~tach!+J8Z9g#ZE|itlrHX_rJ@{pngDU)%|T3d#Z4
z@~zPC02&*E2*1#fM`P-o3k#egm3$5J&DqeD62m%}oy?C7EMTf)vx31$&d!kH>QjIa
z5gh=>HT<9c;~Xx$6xOGk#5k!Ox(2!GdX9=Z`P^}6R9BVdru~?1q{-L_#mCnGzRmZE
zT#a|eiKtA2lLJ85ibD8`5gdC1-uVM%4>`XxuXXVU7|t?6dQ@(ZU3~iYm$m-w@0f}9
zV`{u}z5o7lUJ+~wRn1cORsD<03bU-!_r~Wj6{4CnJP|%$4e?nd@$FoO!)2<~rf{Wf
z7Z!8Jr`y}=qN23nl&j(QuNEPPSMaysv3?^=FyI@7`XA}e$?ksE>}O4nZ(8VlO)?Hi
z7QFenROvSLJ&@UU`hV*m{-1Oa|N1)r&TZv5217lH3Lw8MtbRLS<AeoZX>VUe36OZK
zkwkHRWeWfMBkPa~9uY8Be+O6t5f%V%l^l|cx@<gxWfyq&E5sh~lnUT%_>*OLtokcb
zfY3D3cOjqLrO^2^#X8ail8He+9+Uf8NBKjTVbLtdb)Kufs#96?{p@#Q+0EetE0Gqw
zsx=qjl+Am$A}Y(o|6b{u$aLh|_kGJR+4Om2rsM(kw%}5iG(b@!P5hh~>>ppz{k5yq
zie6ORc!GbD@AmF-@XYt*AJ4icaPLo*2Ze+JgN}3o(rYL{dVTd8S{-cm?f3axGfXUF
zlv~dqn>!w=b_vpNu?FLHK__$Sm!K_2qTK^NcRmE?^jG#4B((Rm1g!>}w&wMIee^QH
z?t!hIO3QTh2S-lrdq~d-KQ^y5v)C}9>biYu@rUv$R|UCd%Ca0%Dws{fI>UM&r{VnM
z?+uaLruICzJoNq)X&i+X{i>d~NEawK1ngfQz8F!TR%Sk!*{JfS9r`fjy%|(nf^smk
zFXMgl%y#_awA(qg?ZfeoyB#g{fw$`3_1@g?Wj?%Sz&&X9=sv9|Vn&wID_0_d{(j})
z%<V*zeUXFLt3D#nPKAPS$>l>|`pNDm{9)c@nK7L&YTN9*q-Ykiw9xvgM`Uu<^h-*)
zZqZ=z{TLilSah&RgTS%CJv&JKwY5+|L0M~Uj^EzTU0UUeH}zm*3$(KCAfw@_t3RRr
zin%@WkHGlOA#%CyQerXS5!5RhfAL2=0dqeB(o_loXs?|fwT<A|$}MO9=C=iJ0NyK=
zj%h!!vToa!8_WJ&{J=oveuea>WxyPyT=PZ7!s+`#l>l{s!YO8d+l_h{7b0S6zTiTU
zb*i%#esnz*)IYUxeh?v^P$6djnxj*?e^ZC>Sn~td>#wb!)lp-9jdhga4fINmc{9GZ
zk@?b^Qhdyt@&RcUgF<i9dkt;B=kFT2N_qH`b^AZB`qrgBXR^4}y>{y%Y&@g)owe0~
z3xAxNIx=_%s)DAdd-p)e!NAAHzco+e>!XotUEwV`=y@xbC(?;UAv2jV1<xp+<tXt)
za(wHW*v$CVrXgl#=w-wv_X;L}*;@7VxT=(5!NZHaoKY$M%N_Z^wt#EQrh}ThJu>u)
zVy$;=`Khu?#}|$OE1s*Bn4e)sO*o_`<}}9iiIw#y-ry3nBt6LTVA5w2-Kb`%(03+i
zdDhood9@;=w{Z%fyjF|^H`PU*(<P9T+Zt4E8_jCl$_+YYZ39Ne;yd-HddI%(mD7Rz
zt#1nwfe)m!G_I<xY*4oJyYr&hscJQ)ukT0H59aM0E-Z_7{de#~w@)*^_hrv4&1ZZa
zzfXFUR}0fYq%@13aO)WaS11N%L3>+lEFXMTQ-9MQeYGXcV(iw$FNp%FtnCxt>x$`h
zO<wL<`v(<#lOC8K%rB<f;u#<3$Y;G*P<|}u6#2QRY7I9dZTaL@>^CjfKcO_XN#}A&
z>d{EmX<rN9xq;G6x|fzqIv%&Pm})Bm1Kk~-+|t+C3&tm?C_lPi@O>|<CxyO<YMow@
z<A{?$wI?jq&%n)45e$n&YK5@ruu(AQmHocvYRHwGU4``G&YbA(oS#@c`u5@D+AlyY
z%3p=bG)T#j>6u7@d_Y|PV~oO=c*}|(i~k(iasvjmCgWQZ#O=>MM-AXen0nyR`W`Q%
zA7}bT(Eu+o7$t?~sC!<ZA0iY=dhnQ;Yo|Aaw;n-ffoRWq;rWH%W)3NWS1Hr_8px!Z
z36_d6D|1RXpV_le@q0$6uUmB%rAp6S3`18azO%0r56-;T(dLbrAzH5_1{WtFPP16w
zJj&9{UJ{&i04)!ytXn@);>mADB(%vlW58jRo+l2+bxZo%C;N98PYc_cly3e|@jv=C
zr{@Wk$LJMzqAt6rGS+#?mD}<7wr(~0w7F0z69EvsfqD1EUyx69x>uc~UvOygsU=up
zcBABQ^67RRy!ecmvIw{m{Hx^<b3DM)c7cgu0LEIVhhUoiRK;dpqq$SYyk?xk?KQ`+
zar2*-*HWf{o-~)C|8SOISdDKbz(^Ck>}wxA`7o<hnAWrs+9+oG8;R_sUHKeNfe4g9
z1@r<yp&T)%v8uGhmv|e3HJ<!}^=UjT&F@Y)>qrBGAX(qW$K2GwpS$&UMgPdG&g?l6
z6i6d&LWmw-N@Wq@=s#8;ESD{=mXuf*rc@2{aAtqBvtxMpOmvv?CsGgJi7{JC?j4~}
zcmosPjz@0mc{9(<&AaUP<#6r!r7mk18j&-0(uP0i6MRZBxPsC1ivA12AmR4l=;;Zq
z&86LMdKFK+0jO)9N%mU<iTp$K8iWRz8|n!s1414*0vI+}KP()1kl!?E|Lk4WPJnk;
z_m4v^mT^_ZefN`_C@*D|TxZgaQP~liz~EVn-<B%n^8W8c9L+2CN42hB>Z+oSyQ(9c
zqz4UK2jhjk_Cf&QC960I>auF#XA=N;mF*nt*tnT72#(96)vSJ$QfQcv8NV<F5H+3>
zf?gou|KjXD!<y>WwNVfR>5B9gq=-@lq&Gq7Vr&#?QR!WzLr9P+T|ht(2ndKuiS$mS
zD@gAhLQ`r&34xUNO!wLA+H0@%?z6w|{K%CMLYT=MbBt%)&s~<MIzf@yC5df{Ph4j6
z5<hsf)K;RBt|tx<K?*hgBYj-lKi^&W=AiOiCtNpqCI(=W0j>~q7(_RM(;4$iH6}Jc
zb$jQ9njzl{?%bzO2Prk}jgVvbN{E&gk@XPA`DOzgU7XxjTZSODBI}7#E4d8qw%ntD
z20cXg>&TIWfuwu+L{_BY<jCs}w+4;*Kjk~bihULtrd_Tlva_Js_uIj9`YTF3{Bq+q
zOU`-xDZ6%BeicG_JGYxB?xcQxHlDDWO`-$j<kYU9b8vem%en4X>)87EG6jBk*Q0@-
z`=21+2JPPD1?aqg(Ab07(ZnJH@udVQC@X$yb%+7z`lsdRLaZ=8!Y+eTm-ShLeCWmv
z>6MdA7b&ldhbybIN-P|ksE%2TNgu@@$+(3wzA?&AzpC=Mlrc$98$d`-J%GJZC|=B#
zR8pZXMNoI;DAVK#ylm5mMaCL#NNmSGkDl!r>AkCzy2{6zczr9*?F>P2jlK}rts@!m
zOaw)u04dv-Nxu_Ldj#GIF|k~;vEj_K%5q4#FSM887%-a;EzQl(5Oj#u+`a{h*TOtm
z;;}ZyY_IgTo3OVmJnEiZX*sw^+~?1M-Er;w8swSDz4a(58fBu8$hjiZ0S~(v2u7#5
zEMZ>Zt?tx)ZLzthyjGn$*~69~(JknZrbaV9Yph5?y=<OCG$Td99gvCSo6YzrAcnPS
zdzQ4-lWJ{Px|MRx;Ej;DF4L?oPnfFEH8Dv&wBaG(5)*Dq?qs$5iFdW)moIk%N>ndr
zs$l>i*q;R$Lb$hhlOQZF`O-V6M1g*(&F@*!8cB<`_l}o@QhLr6dP+t;TIW?p4uaxO
za0ous@>c{i@nTikY(Qs-Tfm!h+#FjybhYluW{0*SUOEjLOt7B-F$;j^BNnO0+PH~I
zqdoB}t)dQAZjZBFpq1*$H)95}7R{uDs~vK3@>(S}LOIEF3j{%YKz9aNZ3KGR#{<o4
zm0VklnW`<+LgaSO%pPS(8ZI<nd3B|VE}x}#dyp&x*qLDiI=pxT!3INf$K{tFR@L`V
z9#(i1#meT%H^x{V8C|2oCX+AJR{Y{vI^Pn2!3A;5bq7OY9h+OK($*TRf;>D55)+&l
z&-F8Y3Ou#&3BQE|+ArbR(5Gp*B&<@5mYr4@$7=WN5ohnC$&Xb+7Q2>{Dr{CY@#&;#
z$5a?h=TlDGI;ao?z$Ne*@G483bc@F-3$?yLD>T4*(dES4GGw0hWzXZf4CMs?Y<Sxo
z;ChURfK->XYt5Y8MHu0=RwTg8#lz=<3YVnDSArf${rq{TOr1)lLM29Fs$&Ll;?z68
zEwS7*Ks{I1<bp~`N!5@U8^_$=Qy7Yl<6i3REWZ$Oi++w@4bmt@%ix6uQ3d)KiJrxC
zK^ZKpzw^ZM_Vxw_=OV*Hj4kY5#xT-mF}@C5dApeg@Qmq!ZPhD$JQ@`#N8amjRK>-q
zF<8}g|CE@%P%=nst?2d&pH83zto7KT<^ijS%YmXE$Gh6`Ha0HxnZe!-PK1p=A8Q6t
z+BWbrNYcdLQ8{q*%eW@zm!n|h0nAa^HR=9I{mj`1HGm@5p&GO6Q~>LPQI8d36?Sm-
znW~GW=eNpuZd=_skfc#a0;@j!&Y`;m%COOvoJ$9~Jf1_ZM*vggRM^$Pw}XO>jiZiZ
zQuki;tUl__W&_+&0{+7trF<zIRXMe@L{Q&42#jA5i?}l47nC0o&=L~=zBz&|>d708
zpH=MCpT1lBR>Z8v><nSdamjU~J8kmLa`^B$T^HNQOP?T5x{`0)|M|m3U3@o+f|K#F
z{dL~=>Q^`WP#7Z?YVBpf1EaUoGMhpSYlAB+HA&v*9{6B?c53$f=r=?JHe-$hfN8*L
zm`anLE+d46P9c3^?M?#SqS?4pY>WqP5<|#cG9rcG<uRZYCxEj2nFzup8>HPCsStC^
zs0*2Eo?!h-8OPiB@fx$7>4k?cy;DsBZ=x^&ae0OY&RL)Q5o6LHn7G$A>owS19-2ST
zv9RGq@bp1+)*Dd}Y*DQ6=YZ+x66PUl)~;R2T?k<oLV73)<IXVAmZq6MfEnk*a;A1`
zVRy)LKqiGZMi>_kBqOo0ta!fhYX-C2s<V|Dd-^@wjVY0`i6V4aFf;*t=^gqdJ*_z9
z*)Ajwgt78~+)ZBY4ZBI(l;A4Az56nQ5c6)h+eKXcl}~O#(fxa}spnx8&};Z!Oy}xQ
zL;*IrlPP%4cC_L?oq85+uIFB(ELb3*Q;^>@Orw`e;b46Uh&983P`MReZTyBl@_s=I
z11{4f!?vqonyq-dFTZCuJK+qjXSzQFGR%W*a#Bn#)9UL*8HjfZ#_f3S?Yc`{ZEH<`
zT3@G^YRI?p;G)C3v|$Q46X+Di38z8=)R0a?myFTKNKN*%TjM45sS`^C@Pnp=P6>&x
z2c8uU@gg6Ha{-J``7R^gp}b^f<0iEj7h!#Xy=xJegJ_A52HjEQV5NiHt!sRk$vQ8`
zcZdAs%5Ax~)P2*BPs7wD$QL^86bn~m5<nLh=zGyD7p=O~q_+c$a>I60a0Q4Clw0Y>
z{*1&j6Jlos!`Z1tx0))EtJ9;@FkbPT)}fo!AC%T0a?aH7Qh^}<>&A0!Df#ExJTWpv
z8*rRuX159|C_nJ&K#{ZHLFzz`?V=2!E6AWTJpY7!nD`Q_S?cm(8c*Bt&>e^ba#Rg1
zWUj;5DVgi@p}DGFs!)fknwQ|gojm3d>Ixt6=690&Do2+Mg!#We=vOM0?U&sHbg-kO
z9{zE{qbA!2TVyy3nc92kBwZy~-+X&)Z)r~zu+eIX`1%i2o@fG0h22)U9Gif3PCd01
zU~=AU$aPQ%^v<a?nk?(LA+;mMY*-PDa;gfOTvbl#b#CfQ<Ch?^<Y`p(0BTnQ!_cM0
zz-mxl>jG^a5Z`#}ul>o2e}qGjm3_SC-YpT~N{Z~$O&mMvb6G8l@d<fAi&q3p4}FS<
zef|Lcxb$5p^FiFmx!W3zcCopIRDpWWrw`4qEr+p;UU!JQkmr)4&-b)io=^PKS}K@=
zo+tnutR)`Nd6v2BM9_OLrNfP?+jnZIniE3QSXC6h>@mQ=9M0WQ;pTekc3i#cwetfA
zsg5_1mPvqt(rlCUE=zrpE(o=MEv?9{B$b1Sm0zz=itbVFxd(&Akm=wA#<{-gIijL-
z(d~4H$>a2=q1v2{Y?Mb%y-Tw!E2y1`<<~Gl;=_i9x{=M+xOU4)ng+P0eX8zx&NqrZ
z^CS(o@fKOMluS37XB28x@ZDj|uh~GRJU4oD*t(~x$3TP5jF$a0m*7DjglXYN0J3hB
zR+UT#3yX0vp1B7tb^8JK{LfvDwp^!=J(HDIp6QE0CD&ygm|w2R{JfQ(cGTIi$TtQB
zt>g-KSjxQ}J2F-a;dOXUcX3XyQjd;;G3vo=n5HDD4E_v4Lmsh=LUkeOw(13_@uh`d
z6cK0!PG8Ak_!r}Joua5;Rac%|PI{u(d8ifsM=8WXR2g?9r2`$GqBeneu<Afd1_xP8
zHfE&u{S(@ZB^P^2il@^q_pezeD+mczl3pW~@t-ltD*zpq)&|dlj*jv|I!{60l|ZtU
z+Rqu-TdO~mzQ=#z*><=y)j_;1DI2Cq?#iC%?Ez2wJV@&SII+j9G74JM^L<lR1y6Yg
zs-7CYU+d`wFNLvzG+s*V13{X&ZoDqxu`^gHqT;<VRv{eT)qkt?ip(w-f0+(;ql@>I
z5aUa#NV}R)x@9ez-yr4|mX)QLMUWi7Oec@u$4qC(r+}GFAA7je4h7@fMf+uY9Qy_q
zHmG%>jI5|j(EhC|<dUaAkm}AInD{7UJiVv5USUV&_Ptq8WQ8F66ez?u|AvSOu{Q?}
z9-t+h%7fyTaCE>10y|8rO<;llr-R?i-aih0NP_RynPWWR3e*B&+LSb@mUs>~D=$pV
zqR{22Txgw=5%3g<1hjP`&=Y;|QXvF&q6pr}X?1`e&M6(`;_2%<UjF|6W!+0I!h{=e
zrQk2A{q=(9z(zoD4dg3grxIJ*qeRxk=Pv(H0KB<nYYr95zub!K=ILsF7QUyPb|Fsl
z4tLKzLy@pRS|Y2G=@=4aXT#Gmx}j3xyZh)-5?bM@tys{{I6mgbZ=ZH*Xd_F3vonqY
z2tAIUq4J#F#{H$Y(KGAym5R8b7sbm5o%<3e6o=+%`@d}=D>8U7tsU=W@FkZ&{r9k<
zF+Uq|G;e88;iR8Woim>yxA;^PAI*LLuj0WM_1V!{wV6AISTS5J=@X0(4>0p?r|AI{
z<_UOhEx)UyNmEWel2@Vl!?~`n94lO3d6m>|^u86LAQ>Xt;jhS&n29MO$8EI9LR+zy
zh-y^sdSY|g7c;AO9_8$49cJ$FPC-GR1B4MN3Ez!TT8ZghVzR>DMz^J1tuC^hFQ0$W
z8x-I`Sl3Tr#rf#$0OCwHSzDikF#UdDz*9GoqJT(}PW4OQg)JvvvXE(pY3CLtv5M)-
zNcwF}xv3{(Cd2L(GJDwy(r5;Y*(da$)?b?{Qz4BG!C?pxnGZH<O9Ow6V5o3v8d+`5
z=*~uS)V~4K7v8uwzsg($3dYJL0Tx-cph&GMt=BLX*w00}=1EV5(x4+_2I`j7<=I4+
zyz3Rkc{r!E{`dhW6@Pl~+{$Q&E!6X&nQoK=D$G);lVQ6CHEC(+$Mn$IXRUU3P^s(*
z#oI(vVKYIFxn?S53T_DIKGVz9&ZWwd?hwMm+x>;L1-&OS4oNeAQDA47U@-C^s8&A;
zMh)viFt)Klg)E3ZSVZ^z#YCA~Uxk8%T3T8g(uPpe-i-H4&zbgBivyMoo+(-mQ24S8
zJ@h`twh}|=RTO?W?6)0I+fwgnzr=f{%I@&=mUy2w^*LtUApLfh8GRfKumv7d>HyJN
zIoH?6SGi3Ec_R6l>A*GCEve$Hl-J5G3-URJ-9XvHXMO`KcXHHj5kCCLO;Zu8FyAy4
zTMKUSQn0FSdRTVrsxo=&g?#@qr_g8ef@)jV2l96ahuDN?VQtdtt=77P@9k6r-rPyo
zrbHZarzvPfrY6}Bl)7c6!2m;NVih1xgP`{?_SuV#pSfm(-kVJb>O4<;Zu7N0fX^^e
z7bL{EDkhS8OB0}?hN~0x>l*PFVO+L@i9Sw#L7~o6=b-iP-A8Whe4n$YI54|=gdBq>
zfev(A;K1gITncn$Q_VZ`l!3nuArFA)Y6zfs5G|DHDgw=N9%ALjd)ahClyH~hC7tN&
zSkIi$kp}O<g%ZIO+e7RWkS@gFgvsm<)-1)+YL6+{xOFO}Sz6e-noXXhmao5mCrh15
zCwEGzCkLj=-tQW1Ri2EinmH?K+ulEU_b|6;d9j&@I28c=NvQJx7Qj_ZCJ6@6Xsx7R
zZ_GFTq9C${kng_lfE*J_;lJH$&$O*+Hov24#ddQsnYbsTb}?N(ij8QJu0GBwrtCt<
zc8O0d!z;v9p?R-oY2S7IdEHi$Sz!GrKDfJ$D@&4AecP8sRv;X(>CgmY($X_}P4K?O
z59oSKsv^A1(MvrceE1Usq<EMN%%z#Dwgm(o+h4Jt@Ms)ENFY+W@>+G$qLyT6`h_{(
z8-$_$gIiCF$^(EtNeeB&lErYo*5t##{n-SLb$1%u`^m@(xw=BH*>fe#{c=P^90l<+
zwthEcbw44y2wu%Xyd0sOWM#r}p@sm&-owmNiY)JZ5V6wfyDu)ZYe-*t1)Rc5tk5hb
zrNN&e&yfcnEd=gcjC-oPVbv`4$zxb1g1o`quA86FHOrbhg5)b*_zo=2v4xso`d6Gf
z_ak5zt1)7oQp`)YhIjOTczHI=cTw1<4B8s<g5(<|7k*UyMNx7!OkEB4eyY4hmY@Q?
zKebn6G1}kB(;41NftnGy&~oB*<<_17I~GD@rR_ZUg{qwRSSa+>Cd7Jt|B(iLLDH1)
zoZ=>SAn0Uw09ys0bv^6H@shHnpJFwe(IM{;UD@e1c@9Zwb}r(5KW<{zeKrK;mU9cB
zWj9mLgFeCOV7$K|v}A6)(+WH~lP4hBU9c*#vZn9(eE~Bn{Ceo%(ynYi%k2;U;=^48
zM1X(4S#uvS3}Y5s-t5Y1<F<zFceF_adHK?4y`0_Nx1Qe2r$)$K`L^~d<7!(5QVn0Y
z%%v$DsJE(fn3z|<AUcWg2M8BCw7znm`4R+}Rb~yofG)Izdat4wWhV<bU_v9sZcMgQ
z1#t%gT(3w!G|w)jM1<XA3dRpDjasB*r9{t+H>&}=Fz*r4d}}6P7uIH@-pcamL)==6
z&#KAgm6ND_s5$cc!^wd_-3>!~Pu6R_0sh~pu*wwKhu0szT`M^6k5erc1%khoQStDL
z3Lr*H3%q%IW%*`8i_xyv$8SLvVW5_#%nG3>m|e<`Z$0u!@hiwqlG;jdw9s(bnp^W{
zn+h2u5S-WC7?j~c_d_)KZdw?{5PLUK1Y=uQZ@$Dv7VM#oZ_$fW&nx{n9nmDAd^nuk
zdS%t;c+H-W8>~EAS;F#VG{6`gx^ya?dmL)o_(>NC&4Xq-kiEzhfNlHwzsH<gEMCFV
zq^#I5pL7Ku_szPTK}{q_>vc_!_JBsLib$A>LN!E&kvwdxI1huzXtFl0l7qHYbMz0~
zoLPwH=Lns9C(AG53SWNO1xWJ0S{D2FXXNRRa~?ie*d_Vv4R!3ZY>}0)41n3eM77oY
zg5HR;Din3dGPXpvyzxt{0VJPSaBqHjIrNe)d!9VUHaM$P^n(rSFI4$r@q-TqyrE=w
zpy*%wH%`mHaa??Wq&%1X=%s4fNRJl%)y%w;`xC{AP4`lshg*^KHj@`R1@!yqc;_*V
zR2dFtr`sI});8H(FC9|8rW8>V5@TFp=$#KZ=Cy9lR%muh>V#@qwFq5UC+K`HqyPL^
zoc{CnA!uj%D{LBsxsQll5>N-T;9{aRFP;X2W281kKSZw?VQ;^9eNPVhKK7K`JcT#B
zG<gD?)OHEX2Nl9XVuHa^k)v~pFCK23KYaEy1iB@^o4w!f*28YD)v<>t9K$S4@ZqyP
z@1F!%B2!Lh2r__ty$-c&x7_?^fl$Sigt^~rReBgI?J&M~Y*2Do7<WA@{h8t0iXWNO
zUsY(6BFTk#RFCatJbYyipbRXT*ACZsXebQ@1c`St+SNVz&Mg+En)Zzv3rRy@bY)Hz
zA)N5(B>>L&NZ=t1p?h}<Fv+W#T^cOCOYHeASUydGx*L|iGL`Q6LT)xI&D#EaX6vrl
zVX^B#A(vaoN2}dK9)#CTbqviWqXE|hZcN1_ZWWA4xOjKAxa&EWC-KBy;O<@MaG|Gm
z%45VHP*&IhX0$|BfWhL+G7HD057)Ta1J115haMi(cCNaNs!_8-*LJ?-Q)rwAr0kRs
zIwIgv6&?+xz#C&}^?+=pVDb&DfBC05m(f|5yQ#X*Pgu*IG&YFnl@&K88XH{b6hB6O
zfk_aR$H>x9%}E&FR#Qdshna2fvPU*9N>@jZFWJ~+sN8a=WvFbYmXp8ErGS?w_(3W0
zw=q<!n>#;N_9OFn>M*3*o)Vt<8mnx#!t<oO-aK>3gNDT=dDfubyA+fpW>@|DJboji
zW>?!TY0Y$Xy-sMp_ibJKX>(=6s~lhC59BNe_l;Do<uHW5Q_*$}|L9w$f1c#HW;+Yc
zWU@s4b$?Bxx2g_Br+0YJE~LT~|HpLd&0iF6WZEGFE?`j{7RqNqp<Gy!;B1;yidkq9
z%S!Q3vN|ob{12qHO8^6@q=Z_qY-CoMbY%1@ekEG9T09(F2IT_~4!~<^sFS3GcIq@S
zaJ7{FSaeQr=4rZeD&6Xj>*503;7aPx)Mr7Iugth<!<k^>#H$A=dl3G59ttC&_j(#n
zwJH_9)#Q<2|60n6-cYFO>Wk8ib|3mLucDlL0r4Th{9lY6DgQryrj3NUVJ4AmmI2)m
zn$8V;TKmtjAmjGduU`1mT6e!bhqMZ=7jkZsP#Lt1aE~Vc81X^=z~;2;i?R_VsM7t;
z>g(U1O@~Vax4B|a#3w^>kMJ~J3;0Jpsm39N0<mtNLbu<`&X|FZQ<!O9=ChgvAE9Qi
zg=p0?)Nb<6o<fcL-+y04>}~n@W{_J!LtYJMW`B|tcK+Lp(S?<6by)ENNE)K!Nm74O
z=j@LqSpR$KTx$v5YsIt_NS&)yE(cQQI>9wU=-rqRQ~i<BYMD;)+Cn;ysS($uAJ)B>
z9&|7p!>0-=37Wr@n)Ex>_#at-u!`85)o$j!1@cSv*?<&+TUU6twJM9xyZfJ+c5G(}
zj-r#L;>gm*$1b0=wS9r(Y)t$QlHC8ut+`(Do9AZgjmP&5MV2X4Q=O@X$XAILcyEkT
z#~6MJo%~t~s#17MCu<MEJAc3`a^KcmkWWZLw*4D22`WP{hRP1_9S_Y?8K)i*m9ce+
zA!R)WmWGV`0V^cz{JW=_E<(<121ToI?q227N6P}aUce}2B$Yz#uybfVh2$s{y%%%V
ziiyx;mS;Zl8A51_Iq}WslA|=VK8CDmRT?EbfIr$bc*JE0DOKGkwB%FterK>>_dG9!
z_3ibW@+JIi9XkMd#@@Uj(=5T^8h9nuh3vNH!iRsS__nYKD7&;e)(}8r%S$Fki_7b#
z2u9|Wx?jl0!025mspDrWGf5d`qo-0Lna%^O-IpUaG!0D3^CHdX*-!U@QnL~$HM#M?
zo7gBINU94{C9n|?t)?c?9m|YZVPSykLt>T~i>tL}_lxgzc5!BkPIC!0crA2NCVTyC
zfbKC?l)u`{rEPQ8Vk7h6OL};Q!qgSe!0GJL<i8VY)HmypVWoXV{KM163tbThX$=AF
zOXkZlL{|BZ$wfL+K9G7(GkfpkJ|5<Lgx|;%u#a^M@w*t%%ll4HjDP#2ElmE{17bMr
z`};WYC5}n8W5RgA+efIA(OI<`h%napfy~V(Rio_Z5}!K1AlhI$Z3HOE<MkKQa-QC`
z>Jyt*@P^bm?Zkt20VwWv$H}6o7mG`qz(jOGV63N;TZ55%;M-W?OO+4(8=1mkyMgfC
z-xyBZQw-;h3;G03<J<=FVD7s)B34@)y|}AzZY!go?;D+UGrau#yCyHkL7;UpBEyAm
z8*5)=8HYMfayBj0<x(~f6w^JY>N6R7&bP=O3iGW|PPS=|!k6=xE_k(x0J>+r+7$>F
z9?~Ts(-=2(FW!21Z7f4Ci&zU^QucV&AjyXQidxQOSdAhjKzY=?HhrXik7*9`4v+`r
zD<jlSuiaba^pbE~%49zTlJ@}hBR45iYa2ZU1S_yno|$7IxGVslR_nIq2O5Q;0pv@K
z(EF*i>FeWiQqjMjXd8Nlzx!a<EF45dk*d#q!oWb_f7rA1XiQqTrMfxMA==s6kgc*|
zz9Ok88i?r7Zs(WC!A^y>@M4uZrpR<yT#849b9RmgAFlpE?4?&+^YVR7o8sHikNV!|
zxg8YZq_OZ=xZ}`lOb_I%SVC>AADC&j>#QU~S{leLVF=KEIoY?=#dvS$7Ui8ceUF)@
z^I4`X|H<$FzfC#+7td?`HS%8!IpmNRUR<A;<&}uqE{-9;Ervx-WkH|gAFM!<Kums1
zQH%2W9ul@;ox*o?e(?GkUVL-Q{^^D9y=;`kYvx;8J0ZZ;D>1J1M}-^H(Th>n6f$eb
z+w1#f6Z)=Ka@qb~o7HLDh41Z;lH`By2Tu_%T}Jx`=XL}JpzkGnmqcqCFIZXMmc2JO
zDk~I`)L;iFUe@4=T1WT)h=E{xz?Hs00aFS@*fwI#V-+BmZS~#^mD-pD2;EWq(6VP8
z#UCaXM^YlCX)Tvn*6*}p^dOP4cpfI0@smBzn}nfS-WSO)=e{>2==Iz$3%v4n_tfVb
z(h?xu2@_oa{#w)@Yk(8rYVP^<ch6B_;g3+6rsEaI#!+`N4qUGKCF<n6a8=S5hEb|B
zPn;DH)Zp#+kCVet)%C<{6ByCDN*_D^aWhW9t@PlzX_KQ5?zMW|A$@gTQge*$+F1-y
z1+)q#vB>}`pQUCLSxNt2pST5zJGrbd&{fY&;qoNs)wg~=?ER_TfPa12-~HW9^Z);^
zvs4BDIWalek#rSAgOTzbV-|(o@(RbdGNGT)3SwJ;Q1~`#ITdo?un78#;%gqT@h_Hw
z6d$iGQNbATw{dX1RRJJ0kTbYhPJi`*NY~A=eqnCWY@HiQKZND^C}>_#P|zP||1IhL
zACUXM-rt^mlWgS27PhHwR!F|o`iR`>1k^7~Fij%Ry-Q8xtWMs9eASc$NOrF9<83W+
zm>U)VY9Yk87QlB48bsY#^^koG$vVjqLHSq>lai8Vq|1bop1rYytlK`Ta7I46k}COj
zNZq_x8}4-et)mOOzh2SW5gMfdcLoFxOYLwvzaVv)4^|(Wzg$y^(zJWyop4TKxAGlN
zV4OtbL4&pRCzB<+Ei1LgGQbGuJMzi!@%Lk{$10t#z9aj<(WttZ*TfJea$#wprpZ+X
zgKX_q?f?q9Rmo5Zz}3M?YqnfdZmXWd-yighAbc@USh=?mNkyx!$Ls;N$g6b#U*_%g
zIdXe6x{QiSj~Pf}3gRgFI8<U}Iwi4fTliu7{??@+_i4Y<*}N>80xDtTPkowJsQ<Y<
zX@SYS&D^M-dy$P|m1_V=TQN)Z&C-=^+tz2Fv_I+a^QNkrC%IZ$pV{{)ao@$bnn;)<
zOtSnD3n$3SQa{CF5Y?rX+jd`NOF=GRpOIq{y~On06loFm^~<+KTRvW=8C5l}2dIIZ
zm{?&I5g!Z9E0~>tk*pQ2H|8Z-4wat?TVga+0>6!C#;4a>w2(g>(R6d`1HomFM7y-d
z*LY5cAkAsF#`e5Ql7nh>@W<WI9~d#*JOKE|U^(D1L&fhnuD%czTwUu$wLVL8WR3UT
zYGwF|sZ4wH5f-r>%w~?wNPMx{8l*8%R+sutluHE}6mFj<E8--0X0BE7>;6)gy>4gR
z-oU}@Nz$&oWV4*_`VWm{rP12hqehB_cSEknfX$1?!=(g8-N4%Qn#oiyN515B^P1L&
z9&!$|aR1<`sEiHIx2@@3F$Wraj&y)SX7r{uz&fiDtti)T?Dl@zbi?7)#w5fcakrwx
z;~;m2Z;A@df6h3FX`rDauXZGB-5((OW#v)vjp0m95KP<Tr&b}EYdQ40o*o6wiG^=G
z&G^hW#Cnrwo3vi3uGeMw4%Mj-oP>#S4>cSi8#FnfdSISF|9-PvXrUiZ+tS^Hse+6R
z&gAMYzCfZ>$<W<Q+hK>wH~p*|@)l;94`+<3db*ys4x%q0ugIc)mI20vt*jo3c0!Cj
zZi7D$W=1mWiYq5FSJQQOwgh4d-Mn3IgzZqBnX+8`#Sp@sEx;9Qo;7P@>>@s|=bbdM
zbtcfvM0|cdd0#^UNtav_7xVS=Ne;eD5_5oii&IZ>wvWOY6dPe}z%j(zqNT5;dDj)j
z@$uSL-+yLoAL6=$+%Z3>P9HH<Nc<?*`$$uaKGG0ZxDs39;u$gyK0mJllB*3mdEKH?
zn>g`lwc(3^z|>lex7Ujq>k}k6$)I9oUem$#?3!xetl3szg~E;MF}rq3zZctY9W*3H
zpeksvJc(y*IVs(|%a&IhU;)}qn=_VuU&Y(FZKi#GRrX;qrdAYu8Ei7--&hxoW38Z~
z;dkp(C}(z~dxGY^4G=5$aRp!i0{&JNn6dYL>D_nATSInxz<X;s4JF`~YB*m#!x~m9
z#;ZouBwL3dEYFPau7Q2lzg+|0mJYFKnpe8BmhoyxGy@x<*9!(UO`d8zgHyhAk{11*
zjjwS>6;`76_WRl%vb(N`zuXBqj8ebL;@enTKko6}{f1BrFh6XLt;>mTsLo^dU$=af
z+MA;)QCPg2ae`ZC=C(E;H7(ZXy@$o8taKFLRX?@ujkcOMaVNWrxzQhyXuBBv;~94e
z?bfj70^?^_vSkm<wHSvOBu8?~026Y3PIFq|_;#LOzkP{%wQ-lH4dE5)pty4Ap$zc%
z*r1Oh=ZN}~<-K<ry#e<-AfPY}8Q-rWwV|By7;p_GKER`r@lR%FAm}DIiMb_7HCMG}
z<)K<0>ip-9vfuq~pidwgFULB}$2XOmG^%H*9CCVP3*CW;b{pme==mb+hW;R()~;ud
z&;N$Fbxa41b+rHZZMSx~g~<)NR#A3dHSQ1|uc@rX0%iCV7(Sy;(hUdXE|eMBxaHFq
zg0_EA$o>E=(6m*v=$Jb3ys)gd4`jbuz<J$0Sp_Jy;}O`w)kj(_z?a@>>Sm!<G&|5o
zK5b>0L3cbosCX&yYwHjZB|rmWQD^vwf9Z6%-%)cimX?us;L{ew;HUEPmKgpPQm>+=
zuf^d}Dx#C!;a3xJVd-Z-6HQ@|=P`ULqg|KHJkR(4#t-?=YeAaOkm|-^j~bZ-p1U5R
z`>*y|wxhHUO+H#bm-vodqQ4y;$ZLoUu5PXyml8x(r8w3%>SicCO850{v;gTa>nf6a
z#vWHTjwxJ-#MOJZ$n`Awt)>`NA)eE*uV_&qD~=M?Eb)eAefHz(bbdI4Eb>v4?@VeR
zgm7~3)OYrL@KR4l5U`Al0;+ppA?8Dzhg^rb5vSHdseq4@>KFCL()r4NZpEe8C^rP?
z@lqJXN^flKK35=ZN1Xs@qUGKd8zVQaJLfic)@K;>-X$p7KmYlKAuU6UN&unDMq!=?
zRmWe(gsf;5m%723TZBt~S>`q0tmmA1qoX<Y;_$n}i$lfVie4g-3zhJwTgWFsY+%xp
z=iy>`PCy=%<j-Ep$1e@V^4Ue91Z?MH)YOt8US{P-wv=&?WC!jsVY2D2^@33-W5kJJ
z9#^XBlo<p4_T&4lndUQ6R;R+^$3a4CkMR0zh>Jv<GNSkReNyT##jKSh@5F3hX6TP^
z8a(J*;7<<{mZwH0ZX1p6+%%CJ(;F?Y3Q^-qy<i7vO6e&u)gPuunI?CO*YbTRXa8W6
zI!9*7o&I{%DC~rS+y~TS3Df^5IVAdtL6}D?N?p6=dQ;HQ6=Np1$C%@B&g{@NOmfYf
ziHBf@T$;29J-_z#W;<U8;kaY^|0ZDk4>98>X^(QGV2IWC)IfVK`;^-fEIKSSB_G0M
zrJxEc{k)M)Riouno5_1W_%0Pz=qU@HQ!a1%d#wviRq1Da%Jk?9>fub#MhxoKa0_TP
z`685e>gKlFYpKI8zaE0=)f97IZ2k<BKL;P#5TVRjsUB@BMxMv-f7nuNGRwjmcRt|u
zL!JBSr6Xe%&%x^@s5!v-Q)4R0B)HM~?flo#*^nSZsLT<}B<Eex#Fz5bQvj&bO4;M^
zSG4qHa4VVX^`Kvij6HX4NR0A@N~vjj!M0_<>mxUQxWQYn!>3OEE@`befcb#1i}=24
zS-W8*EmhJup6&Vz_)1fvOxvnz#>*;hZsRjT+&(Q{w|kZzIM42&*~P~Lh~a`_I)=iR
z=r!q_Jyw>Y1UM=&0|`-gOI<ELx$3}Wmi;J8^r<qFuq?1D{EbBN&nc7GSc-i!fI;@)
zP`thk)4w^xrL?++^9MbC%$?t(HG7pbsh%1`#g~0%^m$7)G^6~PPqFL$@`2(tFUAq&
zzLuBg%8G(7dfU9?Gq3s_Bmu}IeNX<PP?(u{H&r~uD|Hr}OmIL<1Nt!aBZ5rk#%Xg*
z=K88XX+d!{=cpSxvtr?h-&}QW6W(&}Y`5jj%Dh$o;#O;uj_EP&qlw4s&uAAKRE84&
z)R1SJanf4$$X#DAmS1B(q`J=r$myC%;VPH!S;PBv<$_*b4AkwpaX~A@!s3aGnc|t_
z`*T*7mU@-CY<8|9&Nsf~`%*B{A6MSwIIqANG~i6oK0Zz*q!WJsFe<4JE)_)~Pi1=7
ztbmcc3BL1>q5NO>E$`92U24haT{5x(0J*0SJ#_KAhwpo>{r==^7Y(6E=wPrfH~04?
zrkLC(UtR#71(26p|6x2<1gsKl3M5FcrV!*6nWoV#XwUA6A4x~%H0C#efJnYQx;)R!
z=0_i3M=LxJ)yj7f;24o?QOlo``iLm$s=UqWYYG`p8&CV8B9>+y05}xIWB@&1qWa{+
zd4ByT<MwW?4*?qVA9a3zqlQjIhs?7*LruWRZRd_8Anp;KIz^b1Z8G0GKEB@El(s--
zs6Ra=h64!O&ENm)cK3D;e`|;%kOxXM2C!YJYE%SSMzi=YiYxw8<%x^In|*2Afc?lm
zat6)@_`+2JyO^omUUIxE(Up{*Ei)rQrl$h{fgr3px>p-tSZ#sXIV67emdO$s*5<uP
zsV0`k8n_^GMPG!Tl#T@x<9Se|pn3SOx_p*y2wo^4AzhO<aPAwY*7Y>=P^0P9{S+?`
zwpES3<ZG+**`!|NCLoYb1=7-HYRNaO&ap%Sts{Oc|Ixs0@YnEFLBDCE8%OO51Q50z
z<?_4Scbt@sT47m`1LJ<TJQBrE-y6D8p3%*x#M{3w7&?DW-Zok~(p1&&S+yCg6y7nk
z;WP4n<E`k}0UV%mqllLo$oIx@AAr4D4eHFN1vwu~R43)apC{w5iS5i_L0wC%L<uw`
zCcFDDiiCh%Gk&Ah$Ieax?*{D!bQA6-@xSNtXn0PaCwmMbvT^p3g)w3~*O5c3HuvUq
zv4fS&nf9n@fP;K_%gc{3t@v$n)$>=ZX1rl`Jh`2<L7UoVvj3i9$$oZ;AQ2d{${C5W
z1JgRse*DoU)LSrc6X=U5Wk~N?8t&S)`Yzpg%p5CC=|_=Z{~V<WSe-0Q7Xl{*fD~_I
zrn<a1@R=(cDM8Dm5~B!{h6z?KeupP5otqYYgX<$c8FNt-*ER(~4Ss(Edm~5TuTYqA
z7mfm!U7<D>$3#I6IlSpHjhxoNCU0bG;yG-!XGhS&8ybm2J2JzSzbFJD;V7K!z+V*k
zy0<_z696C7r3M%;=T%7A%qfEf)nHa&@KlcfNi<0cswKEVVo^-9GP9dx`owam?eHe&
zA`Sj}$w!1s2<O20fzhJM4-!dSys>)@X4KIZZ#Nl%B$2-V5r6%gb)n@Dog7w92GWbR
zZ^^wk{x#$2E}a=u+ZwhPZ7Q4+y}X)Qlyv;d*Q`dOFK5C)P2n@UU@<4R`;Zh~cXcjV
zAkh5h<TC>3wQsC#r&;Z<XDtyif^cv0pB8084$rapX*F6-s{;<2g*sF|Y~m<i`@JZd
zs81icTh}HS5S!Gi;eU~0%k4LtZwiOOw5l@o#g`W}E-1{s8%~^XHJ;C0KI>f{`%%bu
zbMb55HWt8VE9&`yQY72=KT455<p>nJvX3u^JA*FbUlVZxfZkjGKlR?fr$|M&0KIo>
zb=T~1W>kyXXME;E<=WBR;>NVfe_-ZQndG4+roCj$AizeZC7KXTBxffMeWf%AL50GV
zm)<_qD4l30@3WZIo9`j>kQlSSDC(1p7LN@&H%~n9Wc^w|;PE%j$$xD!*eVe8+~n~-
zI4C|B&2Zl`RKAmE;^(vA{pdb(YnV`LMxzV}Z=>!7P<`;ydXG)uCM{$AO5*3or7nr_
zM+0Fjhauz($HjBgu-@MR%t~99<YMous(TOEgf$6vpr}wg0)RUGC?W!7Z>1ejeUJJh
zqfyJrdBP2&FfQmFJQG^k1QFW?!l(KKcy4aoX?k$UI=BcoM$`N07}*H-&^o<|h+o1<
zx+2c*jZ+?+5LvalF>a75fy5QFj(Pmc1CsyA4I5jqoXS~a3Vd1NEEJLm*rn@088BkY
z$%&b3V=dMSC>BUwoU~qfkU~7d%#leTgr3BPU&n5f*%I4wutW_kJlSc2)jvs#{?~zP
z_+^?wY5pg7)cT28gUjWw4yItLk<Sa1J+2{JfklpOsZd{oKJie`ssy+=V6^MVznOZ-
zF9EU$L;&i6r^HU71G?a`APUVZ{l!p&Y~$3MOU$-I3Pl5cq8*=~*hQ*7H#;9;fAL0%
zIxLaAfU0#$Zo2^cDZqmt!nDoQNI|-IilZ88rpk<LZZl2PcI~rG4u0#Ed)Kpk&z#zv
zav1j7_O?`a5e|3A8|0w(IQ^C=cQh46pooAQ#tPR+ibOd>=<&f`v*$L^KLP*!%inZN
zEIk;y70X4x*1ZZC#NKjBUFgV{#=0lSeQvjl(t?o35SO()n1olv+TpQF6gSn%ArG>7
zZS=dFY|@K3rBs1XYuS2PRYTR%#&mg4rB50@fOaeqRA-(H^a}Z>+PI-&cm^zW;8G8d
z`<a#Q7w4Bx{_uS~VhgejJ)hL&zIxv;BAyoB9mGa?EVgr-U^opMM^O6igF1_E7r64c
zAGoMSCDwBc+gKKP#J?~Ux*BIN^Z1}~E@Q5Nc%AU#FN!`rxWmvHzV<JQv8Yght4K{I
zWgVktoN&-uj8?pTBGIr6Vp8Vn!aye+jz%k^E!caR*1PFxgx6)7U4*HLZvXlw6tFRK
zw9{^)5>Xg}c?_9p?y9p>;)!ZaLI^@ytE{#^F@QYknbLkq;094_>Y;on0RVSH!dORr
zFA#UtmiH1Fn~ECeV?`vSz6%~LY}#sH;(x6f9j4{>>wl={{;OvBds~cu{{3I0{{&pq
zkUqi`XUT)WhbEd}T{ngZ+D8_Y;Y(_Fs{7i7%rr8+xi!=G6;5}7p=kj0ZKSYBlJ8gG
zs(YKy(rM#FrXL_UZw0?SsS^<WI_k0h{Ne19ac$u0qmkQpQ&oCD|G}b<;d24x7&k8>
z+cX>-N8CcrfTm?|H%J*U4JgYL)CcR;wNHaO{}Xdlc1bjU>_eiqVHWTH-Ve{fZ`~Au
zAfg5Y2b5L?vva^9D1wN<`WuYe1v>7xYwOAM?ppY6C_B1U>F!9&gVNtTQoqJ)2ojAe
z^-X+q=)}IF2+}&m)b<H5D%b!m0w3H-$`~!v4d>KAypBBazQ=l|W;$vY@p@qu26~CU
zTi+j%)Dx!Z4-{Ob<T=!lniYKcBhc|kcmOEA%}Mp}U;cG})Lb!ui5PMy*KBsQ|8Yz8
z*GA5|VG|MWdz23(UArX0f+%B@HERh<1aWegR+V|T*Noyex*muRRY1mOt4%dzc|E*v
zR1)^}P9TfSL6lwdzSBC8*LZ0DzkgC#pmi^wIcqn=X-eT&GctxY0zZC}@=W62kFJm`
zfFyVVXz#8EP{zGyA<IH?AK$0_h5WaFQsaxjONi~3lx$sGv<>{w`zTuReEH_+E{6*3
ziyp33Z-gTaO3^u=Ww#S|A5U;2+=bF(_PeLu;nmU#3K_i3)_WEe<wefL7Z!%o=NmU&
zxHlD!9AM7yb`jKC|DO)TGY#{<D2yyo#=rjAv4-M9n;`xeIHk;_Oq5f(*=naPVE>gp
z_1c5(vP-t44i0^lk1f4l<Wj?4vUtN@12TOFwOk9YRzHd69iqcm&CVk-Ak`L)XI1fo
zTIa?o2`swMV+=3u6P}%5<Z@_36vnEn77rA;iB2TM;Z7#|dbv~Sbn51@tpQg983U08
z&j0;r{+a9aX6-)9AJqKGP>cfj>=^ME#VrLq38Tr7MT9NcTh~CzA5c$;W^nZT2^Ny-
zp8|)6SVDUDLi6g~hCyxebJWe%Yd+{-GV;54TmJ%^QxKSFif>=hipk?|0)m38O*!OS
zsHL^H>*I*lc>Yy*_@W@G&=14`H9_f*%?0VFZ9MABi%~c`Av_`Xoq@VZG@E9v6r?;>
zyylliaytGAFcAYraY<z9MZDsv@I~!rilgOZEb?>zZ%L^Ivp|c_UnZ-x3L$g=Z=$=6
z{k=H`IkPz$#};(yG1HeDA?7)Ow7PiE$1QUvOl6@<6?9037SYkLL=U}!S^Bmgp4}Vm
z>u~3FyS$=WCiT<+2y-t~leZOa$(SGZQ-4ju-R9crwZ=!m+z)epJvQ8dMQ%eb64jQe
z_%~3nI@!KCZO=_&_R+7l8-W~i+BQD-$5-RVU&TnO48S1pb|ZJk5p|G<@0TafGK0_3
z(v{f{IlsYUv@ZWCR9QM^qe~SL`L}C=7+;jhrnJ*8wFWgp#h;mO49?p{Uzt@y0Bj7*
zD4ddL96(C(LMsdW%Ax$Wc~~BMCH`p>020-u6@I2g8WD@|nZS&;RWqip;Ef(S=lZ<Y
z?Cb68&fl4h63%$`w3ZPdPND<ayczGbI`>1ybEjUsB}QZi6jScM!FAzz!4TLdjW#xy
z?qJC72(X<L9kZXel8s19OS(=LCFR4|0&kYVu1;O4N&7geO|He3>}FvL+UNrB8Aui#
z95b{O1uCnrf(F}Y0Q!n(;N0qgQX={KHmmiVb?y(gpUP&NqYYJ``x$dwcl;f1B>D}Q
zxWf9j+tl!(*xT*d#Y5r81{L!<e^K~_?LrbkRqinGF8k+_h3T>6bz8zJd`77kaSkdQ
zgoZ~p&Br@_MaYeEa0&W-?+H1Z8qoSGyrn6D9}AK$O317{{b16WI&WSa->LK1K{cf2
z#c-FA+=DE_W<lWV->1fzUAO$i^2=mc$)j)@;#IOO3Vp%j9pA-!LB#Fl<hl2&(bbrk
z4hg#t8R2KUKaIBAx%u5Ty&|+KfwGIM=30vt*4R|_UE4X`CkAQ(hrd+K1;DZCJT7Lz
z@};~n3F|{lLzD3=i4a;%A*J+{)?m6#7$-F|Ty?CmHg(}(+8Nu)9HVfmiv^SE4p+5e
zcq{`;m-R{|mCSZim@4^JF;`K*m*8j&k5%pM?5@NYdZ@Z)tUOl#7VYko=LVg-mgr0{
z3dwT7pK2fU+f5#|-V0TAm<DHn6}J5Y{F}-v#v)Q|)k5tw5;jz{ziALAT7`jNvIbj2
z9ewu0Q-23>R-7s9@>tK)3FpIa#BgAmeB+|i+uP)pe+mH+6kxH?OQ{Ax&J7TcH7&eJ
zJ}0pZ$6uQmS0djWwUy)IFQg)$hZHQaNEQxjvbr>lmt53!tdiY5_~<q{fT{afqHB%r
z$8x0MVp?Vb=Zr@snR@Dd-{|E&dCf<Es9}Z6!(WgFG61|<j42Sxb9sMJ<if<E5PUOM
z9~XoF1PB>mJdh!~=g9Sb5wZ2{q(FtEl1Lyyu#IoxD5?d^bO5esavFTjKr4&{LtOX2
zp~oU!Cg<0?$4+uBoqkJIloq&Qa*aEcVnf`Cdk@tJrlldD%hwO{z22FxT0w|bq&S$E
zm9wqz_{Z@U(VJn!-fNu7y%hfJXD5YQbxoU5<t<Mfzs(L&yiW>aU$A9%N>_b^dt0Yr
zO`~y7y_Utg77JJfmxPvBG#GGPIph#D4-Xu|CE{sI1~FR#qS1?fJ1UzPg;Q-Tpb{MF
z0_ts!XZQ!0{rm61)hTsGSUzSef#_Dia}j|tL0$;V)J=l$SeNgW2!)SoGI$DOkdK(I
znST6i7F<10e(&+dCR1`X5Y%V2vYC)06Mg);BL1kIo9wp-^gk9Sh@a<Vama7TSz!Qm
z=-sjV^aMZGo;@F5yhr<8kJ3A>{TmKB$?^)O1_Tf=-`u~r2wHsao2nC%8<u@2Yhk$j
z<+}E-;G5gMml-sMYWEdFr6;?QUXBLKRHE;~D2Q%r`|LzGp1Z^qHB-{{wKvd;msUM(
z$L;Vou7Fg~CW=2npRaHCiq5QlBD!doY5)em=TZk*9w(oNx8FD#(7zL7i`6W_4fvxK
z(ty(?k&@TIPltp(zK;GZD)ai_a)v<h*f0REoTr(nX$9=CPqIxq=5-7_`hqbN`w)!D
z!n4aOOyxzr6naH4Wn{nCoWu&G8}&+)8&2<fmNQ!y>pPe7qpv4IB8lQ`>R0j(O^;R-
z$3FMBiv?uUZfSQW(JjA4<<Hh6>qdfP-Fk_jev+Xw`vJU5D*=81N*DZmO8qudO_pGZ
zHB7JV7O4v5mgv@A_Z6ywap;sr!W0V<h<z{3&!#en07@Pn8i+t|B!UvjvaUm)j6YvX
zfBr6_M(L*-i{*Z4Oi6rr$`78gP7_4FCOf_nv)Z%9!nl2Dk#p_5vckSCXlij`lp*5X
z5ci-PR(LgYCk6|`*%-7562-?ic>IuZRvm#oJ`t~eX}IkIrT1z!)EeV%0zYsy`^51S
zJkaozkF0Q5i}AZ5w;9o-@!C9ENHJrFkl78n)IzuNd-n)=X-jr?z+axHksEMror=XD
zq7j`SDnqujjYjsS1s{+K^`(^Isr3>fn^#wGMKYR+gZxc?K3_s$e$AoVA3_a4Dy-yT
z0h%%5BdnTf$m@@~fx>ShzFw3a59T>p*UOX6em{R;>hi3l4~P`g?<I3%qslVL>?o`5
z3o{Z&$bLlZ-~nJ&W0rD8Dvkwwhf0s^R>XFeyf89`&6Q);176~(vP5NS^G&aA2K{>M
z;>TS?p1(Sw7WSZf+GRB7(KHDZ<=RpBHUp>i97erFYF=4<CmX@{)V%62?z9u<Gx0q0
z8}5bdg?4>`+9TLblEkqmf5n%lE1ta@r`-Z~ACvT_29+RKAF}Fgd#xaVlo9<!EVId^
zY#zBcHB8ErtkW0Yq-h1Cof3E3`0*f9to!dxLnjWYl`Y4{H#^ZcXvKWqFst-{U3>8=
z%khYFfgGcqW^gsDasFebhj#tOp}qlqhW!3Hf*Kuh1a;7!Gx*X3q4E?NM9e_o4t4_B
zTTj1)av+b0aN%)an{sgP>%a2H|4)8K=4xJrccbvRE0Fk0u>E`E7ck^1c;xMubLCe(
zzv(M6_U4wI59PGZOjf`0Y;}odi_9|K5Mf#$7+|Mqm1p;c<?#!ykhs16%1b4tDnuFm
zUq^8N?Ezs%6Qye*&E@7_RA(i=!!8820U6SHlyxQ{>r*w??MG|xh)LFGIN7C<&vxN>
z_Tb}Zah-kXh7U7-PdAyep^KUT490@zPuuDrH#R>Fqh7tSirUb74)xVlu^ZWXD-V^&
zt7UN%jxA!#(eFdiYKf3lr`OM%kwj}#ccHX>%ik9fN6x(knIyN>a03n3`tH+@_y}|^
z@3P~&9jX0}Ez6_V2C~23D9<tL>ovSNe@t;Xf#>Wh*R#54wGdwmbga&YYaL%ceWPFw
zV@}`hKjCr<{ep-DYHN|>Bjd&%RFD}-_!MZ)LJ%pUKuERr^go*}{a-(xx|6~KbSJ(F
zhRa>h&}IY74>n~Yffb9T1p*jDb0(OL{;Vs{&(I1nY4q99VIisgG&+0ZGi*LmyNuvJ
z0+Ph;j*`Xkp2E_#%TE$Fx(QPp%!-S*;ETx{0#Si$Q`Nt+2XoO<0{yn5qL*h}Z}fUI
zMilA`ML#+fNZ)pZv?h2P@4CofrO3xl+pylNyz`!!9<5r-9w$6+fwT=V3m|O+Aj|*#
z%{&omjm4F&;N78|%aK+{ZhTfY?}Z@=FRs5Rtb&xR_376RG#!_zB5X>Mq23>eYM9#1
zxZ0kpyiYll)3Thh@JU=#&CM@p(Sg)cRG8#%XA?zJ0M-jDXt6_^J`(q{(H!<+e{1`S
zhA}d9b34cW>>ZD6r0vx&O;$1+@U?ol==eHPNo=P81ra5Cl`IXf`R%{D-MPf#+le9T
zkmUep=r3~+<Dd0Y74p8-l`7ACX-4T**SWtTUGO2Rp)zQ(NMArW>2j+l(<Szq*Kx*S
z!JMSDYP24;?<P`5q6V3*z=E#=48}7pAq#;@Xr_*Ce^q_EvXsboxW|oDZixMaRGRa?
zIyIGV(p8fV&Amg<8px%C+n;mtKm9P$Vjenz7yd;N7Agavi_ro97|{Rk{o|MYY?su>
zl#>8IV@GAv2R}seDA*_m@IyU3pfI9BC>nLiWNpUc>PD~RPN2nbK!Ce=(%MueR15=a
zgnwQjLh!LHnP`ufH!|uHzmFd6>?O_kjOr0abIw_;Qso@l^2b4vH5FodgTs}Gf-vsf
z=y<9G>B0~|+&5TK=ABa}c+&6vT?=ep{TiV8fBYqr1mR32L&(N^zxKPqCsnxQ6{{d%
zjAt(WX*^<+hW}5d6yP;f8^~EJoFzVp01kBRG{U-Ps_NC}&oi`wtj4mQkKf!*7mSY6
zVSW(z*<Qndn%&Qg2Sh_;!1i{6nEepvfk=nk%%ob;)R0hl)41UouvENGDR=9wC(z~f
z_Uk#HsH<g_&p3dNi8Coz%bsN}2KN%Li`I(ZVMH<2wqEY$%;XGs2w8Ny>gV=8usrL2
zw{skYMZ|S+15ck(lo85_1Oxnn@If>&6^edHda!gXRPD4*?0Fqn3~I%z@k3#^_OJzn
z)g}**S&;_h(HhCwhy|XH?;2jHG2zxOFT4vtnx7~1DO~fjJvaq;z^Mzwlpm0V9H#@g
z1`71^OsGMN3o3&T!cv)HaP_NREVFLri<g^}W*-BDN~Yp|=`kUy9&g|>XZ+H+VJh76
zp{20w4_@^7Q)r8Yb?&u0UeJ;Q>h4He&#~$t>$-*ML6u%3VhjnWS{!8NGI6B>%r*E|
zewa;z8cfCqui@VT!M#~mNw3md2>P^9t6ZC(k<+TzsMhvpy#P0aUU*`POWp;*Rh<JA
z)5h2u7f94rXe~7<oi9vhU}}j<w@Vy*;m=scta+AN`+Mn}CN)%*ltbpXAj;#No_pNv
z*BLdIEYcWQ=v;-Kuu?Ryxl`r<%(#5<FpZ@D9sBxc9PH2I!HJ_>HNb7)$i()1V-+fP
zIr}OBFpzblI;LrnU+yXY1h^oNx6$H1_`ko88Kv`Wj@3NgOWM4MYSw}K;+LQLtxXN5
z18Xf$i&&YB1prE3f^q{`9($n5?A8n|$gNJ8Q!z2gAYHz`ZCN%U&9=hkp*)!B!EY&q
zi!UtMX>EUay{o&_G-(@a10N7r(e<%q{(sne&#)%Dv~3hb1*rmpfD{!JX(9;Hi46gf
zB1kV0X#xTwEkZ~H6{HJNqzEbk0zw2SQX{=d@12C+B%y>rihKFYH}A~*%rnO^&;IuJ
z?%BtlpWH_h?t86uuXSDLbzbL*cZ`|MV0NyR>apK?;G<}Ahr0QyLD*mRf_OvG;Yy1w
z7o&I)%o)e%*KP9NU{}9f4@w|xAb+?oCS>y&H(j4<a@ymBi{}+ZqY%EpcgK%EP!G>j
zkAhxq;kzDj>?ZqBnzzg}^q`oqi<$ndn7|HuLEc9Ot=;Qg*Ed#3LZT~uw(YHBO9R<#
z3T=NFWnC*?Kok%Eq|u&Nx<K8|GO8+XL)Lx$<3^?5*8;%b^b0vH`hXad6pT>0Lb5`%
z-s^!?Vg#i*V2=oP9!{vs-|RDSVJdEhezLhf=Cb@3UJcetu1={EM@ejCP!z_o7GN^C
zR&4|a*C7~zbV$iG(+BfYM>y)4ZWYTeoIZBk@YC^wremNh4YRw}f<<w`ya+ddcxneW
z<Cze<_cV{i#KZ}=%S6W&HRYkrKt0QR^ADA;oRav$j@_JB*O+)rmob70nUX0d2F>Vl
zHggk&#(djE!j(ljHos@!c<H1u)-~`ATn_ad>IL-@(OA08WsB{o^G*N2L?YJv_UOH|
zqx2->l^)6uZtwlNEon^$X-X+Mxeel*m!z4qf;L(T-}9SwTFal=7^A~#2CLfPMUAQk
zRMlo;E@6dO$WQeu(T+v}oy~`LN8aW}#(lb=Xmq-5hwFcpTIgkF^^b`Llg092g}TxP
zL&G{jIhQPqzgSOOxltKT8Zt)*oKqdfmN%<ewt#xO{(2pb4y*87orAb>9WZ{LZMdBt
za4+p<og8UmAUUPjJ2kv-&L2#E!bN%q)JWfu^xy`Rw`5V)<e8Y!4ou^e6kZ|hRN8rz
zr=)>1-{q_M3lkSVPoJEu5I*Baqct5I`i2q-+5!SRMpGO33X8A>`cw{N7~<mVDOiMs
zqtjNlqtns)KAI_uFBiG*@&RuE+ESx+<$q*){EPec-$QhCKl}d<w~mH*ph9fKi4`Pq
z;&5FpW2wRz@B#H=seH5*m|~m|OYeJ1kKPMvHz=if8yJnNFB%UP+I=bh5|x$m7)U?d
ze%qn)<tW!>UXe6L8Y=ycnzT``^kQFWs`dj9x7Qy&cSZ5PX!z)GmjQCyIP+^dmv_hw
zjd-_*AD%Sy%zi|zS~d#djHE}PdV__MPWY39B0=qPgnj$|>y7*Zg}qS?YAy61MNAaP
zsz4Zt9l(QWXrkyVKze)2Hn*9jy%;5UZq8m?(c$2eZ~oCc6ezNx8^EMO`$sxJlJyuu
z42NJALD@Nma&Z2a=KzpIr9p}&i0i9*R?D<@@V}mT`|^Z<tjh3CAc)5xlxN5#QEBRt
zIgo3g1ITp-wH~s~`3wKr1hS&E<n-InA)$Y`6#x(;NeloW)`OBc+kmL40sZD<4Wt<o
zw*@3?G^xR$;53u|o0{rl;Nc|vlje#N5~nW;wz$heZSz+B+w0d%szdeq3bLxJzTS;(
zV3dnf5ezcEB0{2t4x<0z{}s5gQ5juHOg1YIEv{ju*M^gW!xsA%!a?td`Ow9ZfNg;#
zIuMlyKO&#Q$JBL?D%2y6;pbDG$2uF6Ql6EesKp1X-h7A>5y)`tYba7weF}Xv$Rc6f
zFFz^UZ_(?Ht?l2yYOnt|=_z8QaXLg((<;Qokm2M^IQqXr_Cp9OWSt?>)!LN+BkJ4E
zAVYTx>}DZ?yzj$T&W_7RJv)KuRc3E*ogY#h50+i~Aj?S6L@mq`R*Ile5ZoPoTC&*C
z9o;O84ov4+vlwwVr_}W%niv!9kpTQ<A#Fq*6nCpTbjapVU#$$acTAa>+BkJ8OuE23
zV#cDcdFrm<Mb9Ik<>ldupK@Emt@Y7rZqz`O9l@FMW`}ZSTMCLv3dt$*76UVGKX$$c
z`PJlt!9Lf?=;oTwG;hTtX}=vvd;$UbG-F-_KA^fTK@PxqGz*Qy=nSIPeI)wloe4Tp
zz5VWX4JDlFI`RpP0YO`-H1wu$F4U3^fK|Wb!<@7S;Tl<GVR=&)SL7$3-h3sW)fgL+
zNGIYD``!KK55qgN!r@bZg7(jvAnq^gWi!$&l1*DeN&zaK`U@4`GXg>qZF;H86b(ck
zu>@pQ3VF!kPt*IfsP>G}(0O9Ak}3_`7S~=mH=3{_m^1#c4?udTCB!?}Ivq^Hh-YT}
z7wsHqsW=ophByb_y<8o<xMM--#ZT4TuVo*=P95R?0m1h}BOt}BXDA;_pWK)SNJPr;
zq%px~`D=lGLX5mvt`_AKvDpR^3YxopYP&#uSgQ+{2kU=qU`U#CrEHVmT@rEy3WDB}
z^TDQ=t^&UY6{jb+qS4;N^P#_-T5Qe?vfW@szC@*E@_jWc@7Y=Hyk}9g4SZtzcnZn%
zIU3C(ubBZQUVa$SCdjKxhmn8#{6gW;R~t`lGy!yTXefQ7&fogeY*q_B-h#wNxZUrz
zBOSaCe{kWJb4($Nzv9QhN5Sz5O6T-fN-bimu;%GPEG}kBEKG}=sPEDv-z-t<qPd@h
zs=Cv(z`eWf2)B%Rmnk34;!kr6!|$2Sd8}o6Nukz-16A#Vvv0Q`OscEXzr5?_eX|!O
zZ+zqS#5!c=JvR~;OE&70bIqZ&!nABAhL^e<V%Sij)$Cbg*Mo#Njo!Ankip^#4r$0+
zPCwnJ8hG%qR%Qa%XV%NNoFH!y>F|SiU!VksF-b;dSIWhLBwtTUQGR8?%pv@JmKLVo
z6y}m>pE8dTJTXw<cw0o5iJ3ixoKJ}=A*m@4QU~1D1|&Tei&{_}(3}je9UUP$n2{lR
z=!2P5<1Mb&vuDwO5OVJ)4X?#2vc!Rax{G-~DNC;2X?p0umDg)%WFesR{G730$l~(x
z^+A$sH@@W?>THPbif`2$8vZz%Cd3t(#O&fa7fEgdw;L%Zkvh(FvB;9=glUe|@VY)w
z(b?4`o=|)5GISPp-t7D)D=p*&N)yULR-(Lx3%H?doN<%a{CMs$&cPcLQC^&SZ*Hpg
zMs;6`&(Ym1x7$jc*&uUC)bkCl@kxhoFZ3(C{A7PJD1*p?D2K7Nq;un`5rSVZt{;D#
ze0b!XCNHWT#L$E@L}{lP$~Ei0?SR1ZKMpyX(~P%n#JP4rW|9yPyjsFg7AE(H$k)F0
zd2gFXneH<Z8HXaDIhSk~`QSER^_w6TRxMPOBhNh9`-VDGRg}_oFD~*f-e%U#OW=C|
z_GEbbkQ}V^U{?>1mzm>ZD^GS~XLr{pEtMXl-F7%5!d|)-*)59$VbB0zzr}F*UI)@y
zsm@F|w#hVxklBRrLe^cAoN8&YfO7=X3JVnkws0l<s30jK?XNPqe{L1Ts!Q;nmFa!v
z{C%7~gixHICG-+f?9_rfNEXHWR(yh$D%hN87PnkboE;fnsusfCMu%{3h248prJn;V
z=xenoFVxxLOnAR2pPw{G$oG2IH%i0YN3Ncy?dpFb6RftnbKD%PH3ap0QA~*i@qF*g
z$QfZI-ndMK>EIhgh~fhyDt}DJ#<(e=93&?F-<YzTq31JC9F04)S1ELv1@Q(^Z_xoO
zpLuX8rA}7!p!l=$-OF{W>oz)AkI@K%EbfG4x_FPI+|<lX#w}uLpdBU^6^h^`>V9N<
zhQD^`y``3c<+kFr{#TYWUVO&K&qR8fDHp-<>f*#L{L>lJwJq%Od9q5@*?jEr4maJb
zr%sgqWt$_OBp<Rn{`iKf=#0eIL88foOpKLVAw9tu7ZXyeNbOA-Tx`70u^C`lAKN0W
z#4qGwLHR1gS^{ObC&kyU=$6UvW^;@Y^Zi2a+d-|Cltmj(j>R9k8C{y|I<ws|>54e=
z@#&*8aV`2z^zEMG=@JA#!u>uSYUfLvapns}vjVV4(|Rb*Na)3sV4yhLk#W5!Z+-C(
z_CCK@Uni`xQ6#nTWv6-H;<1Vi(r1aX=l6%R6O7$k)XbDGBEFNmDXHE~Lm&;9G~6<x
ztd;FL+)39WWutxNSOPzpKgfcdoH50C1W6}>9Bloz-v{Co%4-+Dv)3JGg~dxr+7IeC
z$4-1zzduj=l<it4EIB?WBrk_WU!Ng&5Og2FL40zErw5q5!jFCZ>TTjpJ$+b{#VTX%
z%G)+)obz0%3gJpi8BHP6FZQ3;P26yU7+l`-A<E|w;!d~d$7LHpA2>*gQ`4Er)8Z8L
zzRtdLpk@hF5pA4eJ9qrkmx&$tj^<0s&~;5`6!E?8P^I^$DuynEkNVDjECvGngX^s&
zw9ERk56ifRM+7w=vnw911H1WfLktTnfRNSS-?DEpaeplJ%a@z1)3uoc0mDmvp+HT2
z)U}aMzAV=kb3!}w4V^pVWHYkH3ijz{{i9q_yX*w|7gZH)zv+}cCm+Y>JoRB?(<U`|
zouG|<sVH1Y8g4@4^pV^)P~gveC_AHK&Arh6elr6t^Rt*f^sRT4Xo$T4U%gHNvMvQ~
zfI6#f9Q=e{No93FogS`2N%R)DX|B#{?p$Pj{o%B|TjNpWl-g?F$K}~`q!j*#i|>qV
zLKkAzw;an65Zum(Hw<m`lpWLna<s!pR}|9~dhas(i=)iQN{KBrl~E`w3)MKys>=~L
zgOrwW{gLsE7O?oDG7_qvL5NGJjHWxe&kQt+LY{f@f8VFhzpE;S+a?SQV?A148?wDn
zz@yr01CSS?1^#C%dv6f7%G;04Zlc;eVm3u;)oWfdhoohY{cG)_WL~1KN_lt((lgvn
z;M>%96?!{;poA0wVP1aJILex^Q+@KqK)J;xTku%mXJTMx+vmgVtgfZ_-AL~Z8kmX+
z9+C5%&z|M%_n9`)$!M7$Kd#1jK|Sluz2AjAJ6SmI3h$1?GFv1#m-l{Yt-kh?=D5nN
zdoo6jvhW;7*34TG=+o7^tC6NTCGs5|%@QbJ1Hoz5jm11yJ(h$xy;rS)<^3?|V=7F)
zZVHu&8M$6%!1|P4z;#4o{i1Tw;+@>8X2y>0s=cc5_Q{yE`nt`E4nM%|jRWCKb^piT
z=l%cc-+O&fV!4ozp~sHDXk$K7s!GJaCY+qp^SB4U(j~D}xrvNIu+-plo=8h=8yZ>l
zrK{=a#3D9rMl)okYBz#2aN^4dL0EeSmOj`U$usgKH+TF~<Ws77ySllZ`VuCdA~DpA
zAUu=Uv02@NOD})`s$B1;`rN#J<{$zcjlTE=P?OvKX3_Fl)d(2Y)lKmaz;73H%#AF+
zRNX9xpX?eG7>zy<Jr`uTv*i~9(tu^MULTdSj?~H2P-}w19#Asp=N}y{C#|Wr7!6+j
zAyM_KHC~N!x)c$y6CiylQijXQ?#GX9o9x|h(=0BZmv%vvuWHWS%>f&;MLr5Gs40_i
zeQ>esbOgWPBP}(FiKX|&&G)QbqBB?fi<fFRdMf4OPrnZiKUZjX`Ts^{_xD*IZDE+W
z+@o{e53d}wKk6SWu?T(ogGz&UdZEr>Q^Y-VaHW#nZg;yQM+JLuhostw%B2U8bHY~4
z`Y~HvZPI(P)t7XMK+C#vS8>TWNyp8;S@ubb+<OWabG~Q3N|>=9E=WM&t0hPQ$guxK
z-ADU~=dV$%k==8F0vZTkxE`fa>a@08_j6_E^s6!i(!6-Y20zUl>9{a`UM%!J`Rq_B
zgq<vlt3?;+6H+OfdS&U4wT!1lUhqaAqmk9WOj963hJ@GmM!~N?zVjw-b=RBR+OQy(
z*IA!hQ#;%95x|yuGk-KlAKlMOt*y^jRmIu{A99MFcz#EN*YO^VhE+Q^e<4O-%9?DC
zk3=)b9Z83<EKA10QZ`R(CU?#CXL^$LBfo1-+FVS_U8}QI`?TX54r~R<`)3AU4;QqS
z4A#8trnj7cyWu}TkCna{RTX}Fa~acNPJ3X*M+JI2R{yI6gBpG3lgAKUV^<XwUFAL|
zCI-W)u~BZt%*$NtM{SKS&(IvE$(O^Apk2?j|LOxt+S~ES=VDZiu(q6h?xik^ON^OC
zF|DX`3}*t!>RhCLOm$9PW%~C>I<d9Og(>0lIfe#tY1S#1;*Ct4LgB~p?nPd%AK{Al
zPgP{&nO#fQFkq8eDohbv_iE!ftKi4X`cO||!WHDek^9`a@2r=n`QWE$Q_XP2#nYBK
zQ|Lak1(<%mCbd{~`y@{9kWcz)Vn1%Yp2|{;A3}X<OmWO&?7V+`A!X)5s~J{E#{J=B
zJOwK;)MRVz$2S6-&d@m@w^A_rqq=0tvo9|<hcU(-RlWn#gJAzGt~ux-s^loy0ar5}
zzD+vbzmBO*=@pJ`Xf=_)!A#^i^mH!hrLz4F${MA>8S;iNIzhu3<XtyEIdLi0@BmaS
z=<TnvglQ-AsQihIh;+%MnU)Yyn758V94wtG94zc^svp)uE=dxq7XDFqrTcs75ZMw>
zD0o*869i|@_nL)pa!0qZi8+JR{I^=g(KcS8iw|k*xQ2ni4C^c0Y&{O<rQ?{c+bKUd
zkk;wvBP!c{YA(@hMei{E6`N)*NqPCOq(&+i*h%1(e*W9T(fNcpf~y0151EmaJG4CJ
z6CG>omgW5NOu?Hp*JCm_F1^3;lrc|*=8!cg+MRHld=myr0a^$C6tP;G@U$0I2tTZ9
z`Ti`$uFlV3)%UHBM=}5RQ2uq8POu8zX4$}+$+0ZK<I>(C9&PlAOYB?j-8?N;plOL?
zX)x+K%4v5GPLM6oPiK|R)x0|NKvna-8SJSJQnuSLSmL$ikkTDxYDlT;jK?8FFEDdr
zg!!2g9~aoPeS(C_pGXb7V1}L1zq`Ire{1~N-R#Xsg*iJO#U_9KZ;&xjGa?2{ac}d6
zdA~WKQ>uN`!#T%U<dw@0WWwdK6Z1^N6(~F22E{zjT=Q$Yo-5mx0SG59=C1g(yVKSC
zk9X8T854AeX#J}v#vgrdFXsm6!&AWD(`VKup@BWS)7SoPt+gGvqpRnr$qXDHv%!+5
zoU(5L94%}P77?RnNYl*Lt!@i1kGQ#;Zj4)B_q!&`-YP!Q#UNtulu}1jnXTI31wz~q
z_GYQ-+nBvn{lS^#vW4@iO+pjN2p{2SE#4-7B8m_$akTc_sLpm$x6{I_70*7(1SLZ=
zk7Bxlo)Ik7cvueQfO9#|>ac}I<!Ok%@S#1Wqt&&m5q>El@^!0zf*##becNc)N?^yx
zTR*WfY-;0LG02+}pa%R|by4Op(}v27Fdxnc>+@rl$x3w+9NZ@Z((VQf&BJ#|ms|ID
zLPMy>#)`J8-Ex}_V)S^N3D2yoKkxtYGV^vI`k0j1N>%QIRyB!atc&86Hjn*nvTnxc
z?&X?ZD(}dO|F@qsVdyaXREydNcT0BH7b2q@Z`{@*pj@*x|2vYcp2_>dC$Bw!<%cn!
z%TWVsuyp^#IfQycy@YH!g#`tlyP<OtS8MnX*^~4H_Yc=^{RnuGHS*0rW&d<V1~1X3
zqq&xIkSzKU)G%rb+@z}booszhSq0=auz6aK`kpc@;MK>B?yCvS*oI{<9!{jFnY8F?
zz~9Xv$3(wPaTA?#n()$=;T??@(#hFSivy083fz*mQuA-6ww|+meNrKs&f<qYT&uJM
zstJq3SvYE{r$f$Cr+b)u$GOL2wx=Lfx1KQ`MY4<fU5WOWQ4$o7cQQ197x{W*6Z+Au
z?TO0qY4@`7mjV(%?N|GMul9Re<G&gDAb$@09rF4F;DR~I3Djg@m-Rze-8U$Q`=!#g
z;NFgh;VXeJW`?H|eu=ys(lned@`x&n#OeTQ-z%}pLao*T8}-wp9<x9x0>!eTex3-O
z$)7}O_C-kU9$mXLktrFrAe+q3nimvP3gbeAAv%yaK)Vf}E*@@>(!?M`<peHTeok?A
ze~?wZWvHXQK=)YPl2+WFu4G+_D(QJyC_U-YFt@4f=wx$GH(jw7aC=ft<2t#?pvrE8
z$4wK=C~v9KFo*$uqrro2dUcF7#oD1V$mmceuTPly)0^$epKM>Cj^htke1v6K55P6^
z72`;Ez9z2t-Yx;>@Y-d8!`fK%6^J8>C<blX7)`|-0_JDT_bqG+ocWVDorg_>Z=Xp^
z5~=!OHhMk3I+123SW6_5hIa4!6240Fbb^D((HjiHALX~{gMrS+*m10818F)O!GM#e
z7GMHsPsI_=T>b<w5;MCScQ>EaP1u<<v-+DpTRFb#UqI=~MNr*3=TLH}Ckooa+;%}N
zA_P?LuXY?GXe9Cg;*d5Da<yl><|>o@*9g6V^9O?iu2)EY=j964DSaI;%0rcE0OiR^
z2k|DeyU`4C36fjdo^nYXY1N<1V{+|Y-8T5ER22PAImp!B4(zb#5F~JU(5|friAlpL
zfw>~B#N|-~&Jk`!fl#_|$|+Q*5K$y0mc&hj#XcEJ&(lQj>o8Kz|IK+8ohCizXpb``
zbDyZIJw33+QkIiPv~DP$9F;Q|_4rBSEt{4;B2N(<2G9$)>r6=HG%f_upMEUddjCLS
zY@RObHA~SnKyHk_bL2xTldof>A5gez(tu}@1P}x2K=qjl%td7T&%f7aA8it-t;)%5
zOiXJ3>h%ScAa)4r{#<Y3hY8)v3e7oG+r~IB1wQo=(N!yh>#m;;emDY4Z7#N!tZe$Q
ze5U@2`)b(<!&Bb2o+^qCv=OI2p3#c++7Fmn1u?KoEl019{_*9arLp<RH`T*KGP;Ck
zr4?}(`s$0<tuZ_alR;?)^xA(=_WEr=b!|#k?qgrsX{urCGFV+Qc2*St*tyw3u<V;3
zR6hlk^aw600?27L5ishT<bNTjKWPAT`h9u?AB#A%qV(<iEy!(Xy61K2n0G6Ih%0A5
zmyWFk+RjF(WMbC!dL&dkIrD-hX2Qw!lvmYEv(rpKojIf&D{xlFmDkVh<@Ov(o@9=d
zqIG|Nv2M5NF+8^9mR-VuR+ZV56|elD)IerCo_p`ybByusU8|Nv&%ANx&y@GhZWExW
zUx2WpHVGX8KDcULMm6~J2~sIlMTaWAx%Ly@!k)kPbX9Ti_p(VkTAB`-%)^8#9;g{p
zd~J8XbYRng7n5g24yRPWd9kQtF!%QHh9S1cB1S({RG13_T}i^7xiBwGR(dR!fu&^T
zByD9R9rOw@w88es*OJ>Mo2I;6-!9lc`gDnFO=5B7p3BVo3Bl@fMvYA!xyuNZ-eD_T
zC)s4V*7SLqT}2Z@mP|vm23ra<89pHI=BJf7))|@Vu#}_XN;uI_d+I)6Z1NJOhtt|O
zE8D`wq$*QmI+}q_ex>sor*>CHWA`Q1ZI^T1c5~C=)6Cl*;etFFR|eiQ+nbDZb{*M(
zCTPz{106iup?Q6pj`QW2RUA^YEZ@5M6I+&{rAdje%)5G8FU9s{IDM3lf3N#?e~!-P
zEHt^BMcPR!#`1V@)GuDCe+@2aU6*8F-kC#8<Smgna}{18>xZ0{l#nLepk%<2xCrca
z?5c%T(O6zP^Wt;6W)=i-shr^VIXCLIRU|*HkxQjo&9*4RJA56DV=e0VA&Us_^u^~_
zKja#hbU#Dhj|oaKZQh{Q&a}pyKgu1gw=zOlKr5)KPnQm_%>W@Qw?({Q5+_%f@IhOD
zw(4f|gHje{U3HUigU3rQT?x5w)D0XoU~NBWQE44sN|@>5+@e+NCUG#P<mmv}eE0#x
zRe#J)xMxR4iLBx*Gk(%Doef&45x7TEMsy`YXyLMzu0dzEN1Pq#4wfsecKcHf^`DnS
zo#edw;sb%k#IfdW%g4+1F_e4TC=c0s%Dq<!qP026Pn(pz=9BA}{AWjQa<$2n+u3|^
z^%0o3r`2_Z3!}i@Z}HtO;o)rfc(44j-14Qi@0yW(_(#=4cO2GS*8D3%pnS1}mlI^r
zv=ST)7sD?`ksY$FVWygK6wVXLGA$M)QA|?kMhTi`dEch|Nce5{k4uxqUr*OomwYW5
zIBot?f^u2@ntAU@^phu-J}(B@EI2<k3wOCwuKDUoQ>Bq-`ggK5<sH%<v}UznZSe{i
zu03GER_m5`VnJAxcyl;u6wxD8rXT8t#t3?_Ou7VUCZ0d6q;|3GEZR}JK(siuBkBEi
zr_24ycJub44n8@j!aJt1Nee&XDG6>dI$TLNJ_Kf|bvH~Z5F9D*fj=q-&_@aLd*!_E
z|I%g>xQuN-KqTxp&7f#TV37JF7?nr94Df8xH1b#Zoi{}#HRY3hg~R+$B)S0f$|j##
z(!-o%F|JVGiE`6evQ4@t+_|<Q6bg`bP-yXp6k?{H?8IN38Cd)A!}0z-!y`)FAG!L0
zauj+!3eVUH7Y=+k;cTSNUT9@6I6Cume|R<RxS^$Xtt#ilQHcRL0h_KJ8ky5tiZhHW
z?OtXBp~bnC!WX`E#n)u1B?G_13<3}F1)N<WQuVgV>ey=8_MM4Kk=}KpHGwG7@j5J;
z1$N9i{d7@)(n(rlD*``KoFZRU9J0xIERR=fNt0{NV(P`1ch(@pSD!~ff_W;ztm)C3
ziKPiA{ENCcB^T+ygHRfmj!+d=Ual1>HY)n2BzguNDzG|}547J#k*rYa(Xj1+H^!$a
zeO4$M+Hb0H0jBG3vL=QeN%oX6%%tqN2^kg*3LC@vJ6lwl2j@rjecr9*x$~@v<f_9S
zATJ>~k&YfQLL90P>Bwpa;B0@tF0-`Z@a<sFHsJ!qM{4~TqGkpXTC}Wwx-{VI*x{Br
z0;;C8o2|h&-JX%_$=adEZUY=+?Y3!d!r6x<QUzY1LVR^5FV!1n*(m>bj9iD1E-s-<
zj)&YDdXP9)%>d8!Y*kGkQ43t%^eO2c+ae&ozPeIWT7f?lRn8vYx~ECEA+sj2t9gCc
zp*Y#lv0YGU*(Q^IWaB-@n&yPk4ByUYvv9LY{~wQcmh_pV{p|Lt2hUPIQPpILh#yQD
zY-3uUXUUr?lp(=VAggtPe6WOg;+@-Ip~aSAC2!mfkxe~hgxcyVnw{ulC*|eDhw7oF
zNCdH+E}KYjKyj2QmvN)SO*At#S@hYNcGLwZ6}5t}@n*=;Y6T>wKwO7(KR(o3^}M|i
zIe&eFmUwBi0W%eItoL={sUW&{D-5@-sX?eyOm4o%X5Xo~_6px$h?%F!<=PPIYwjQR
z`c7F8bZ>cb!T!5P!d(`G9ofH}n=0kobt?{(6DSD$@lX?ufK<;``fzd-<sJL0CI=B7
zkBj@m^H%0TZw{kMyL(_xoP5Q;Q!OhSb?)i{_xBceuYUD70nW{KV%0mcLd0&0!gJLc
zFY_NL$m!<M+8kgh5n><#!Jr!jF4hY%*bVz+kGp1%R&R8Fzskym9J70(rp+}<X2dn;
zWWjEFaKVygu+ltwW2IF8X2+j2Ml{{0?nSsfU-N>N;-b$o9Vn9Ut}rF043d*3#vroY
zOC783@s(xMSwCq^iB^Oav3$M!q9^~1lK3xNr|p1!X{NH{&ZmQjV`XUHxLoDd53aQ6
zcbpqa1Or`!qtIBLIzMnM?WJ;!WWRgAQW*hV-m(dea!c_(j4`1NHfT${Z0@^jl(G*Y
z#8X}$$GYmydK_-G#Y=hyovDt7r<Pv%X4t~s79IK=(iE&?I!DOKc2U0c&NItpsLy=L
zq9WSN!7w_y=9<_XAH^xSSoM&<Y<yO?sQdjIjxUw{eyaf%E8`i$>2~;I3vnjaLdeyk
z{WGL9a2;Y0UIn{Qng{DQ&oIylJPke1an-W1+mn^?`fClvgHF7{xv1WDavdeet(=(O
zl=K?V-5fjwk*gn`0cJr0Xs{J)Ifh}bzq8yV64&e8vr{Z~)67RqrECP?DVw67e{okm
zkw>dtbKt5t-yAGO%R`4DEc(=Lc5?K{d#K-|V}V{{70_TR;{aS3a|w+X+k)$2l`@P5
zKWq?^_clY{*MGfC`>js6z%vC!w$6wg+CM<u1>C+j($Xqf%|$2GuiHGce0ScnH+qO`
zJIbFJGhuKCF;F1p|En3a9AZ2&o3k<CwNwJlr>Nrq9MG!rr{Ix)0;Mp&@troU>fMkk
zVQTz5U>}t@g*B_5i@vI8CusUmFd0bZlQn@D2^`uBw-Z4gFFY@e67nps@RfFxd^|V)
z@__huyLhh63JYS<RBBfG5X`P+9|&UN-JbbBk0h^qZVCH(+inT7e*Yj;Uz_us80E0z
zaZXHQgWS<e4NXXyN1Hv5|1><g1xatGEE2(KA>vvGB`|;nt6m-GYoq{R_jPlU#U7VZ
z=)MnCOUJ=+73l+l!5GtWj|(h0Ukxuqa?o_hxhSG2^&0`Yf5vr{xFwSrUUxhHs;M3{
z$EGE!f#}?aQoLj0t7ZtaC)&CT|B+fyD1l{*E&-a=+?9CsFO?b*>~#m>9bTTI><t_{
z=NE%o=tOWV&Nt)pw68L*uiaXBpO#e&l)KYa2e&<KXM_$M%4kNMofLShT98H;=5coQ
zS)`LYV(S-NHVW2?U@UI2eyEnWk4b0#)tRQov<@FH0GEmV1umnRVZ>6|iJWGApo6bb
zTF@=2+2-unuG##9f)*KbjbSF9=C#0uxmQnI$5wk=jH47O7OyHT(SYJx22~i=b2<75
zF%+;3z|dOs!~deg(brE4LLM+d58F(`q`zIdv1(B!#nLo5@!;h+`YOj++7GrX58p6M
zNo@9ESFr25U8JHk*6??)fgB?34Q)jlR@YruY)l=525$A41POm|xhBfDA@HzpWkf&Q
z(+cG1UDI(@Kw4;)9(~#Z76|j$hud$w8kXav-CiyLUPLzjk=;+4fHRP>ZZ48E-NNVt
zXA+}pT;|jU7NNi0L;SRRB<#^*Vv%(v9Bs6kF(PWPrAm+0m4@IqawSKA<Ur4RP#shz
z)uS&V?=n%!ZRGpF)lWLS@yM@^CV(vT9P!Gu4qtHoR#)*h(qFU3KCYHq2=X0(UVC<f
zj9B$kuq{oZ7bYNs(*={Y*&04IrS4E!@#@9fu*YX6@ZS`Hz_sfqbnTbEwL*ER8}?<T
zrBPXl<_veVdK{9&mS}j-)_UOtq86K_k89u~8Vyu!1p1kBLLN9Abf*s;aJWW(WXDdo
zYZ}|dv#-c3>EJ(zVAxpL*LaMsvrZdaDZPIUiwsR3f{Wk;i?ZZ*8-)ZDQkxNH7{Q!M
z{+iQk!$<x$r%UfEip-KtQgfw=N4#~~`1(G)6TAbq8n2Z9PKo{-=l`ExM>tbQ04OQZ
zAW4;eYE?5-eR920M{V4&?o0DhCS#P)uD!UKHxL)uE(X$wGg*+5rj50ElIlbZbE`1k
zG|C}RSnm<-r6qh~MFk@aSXCHr$M(Fue7YtwMj?^uXnwQUuKxBKxl7fT#WZ_nGNvi!
z1++vcNR`&_Y~04#{M^QeIE(eu!pkDh){RyUYyCLn1N{<1=Hh6X@y-8KmV=w$v6Ol+
zE}_kxEu3<&d`sz$>!U(T<kgNyA5?3LU+kDR&leeyxJTM*+Hzw%7Yk*YX6?icT`mN2
z>=pQtqi?b5+<0ne(dGmB;xYP)utYpUx)ah5XUf&dh9w@8)p_sY^4Vq$T8(#einbTf
zjvDz`=VKL4;zI{}Fc8Zd(+}X)lV&0GD;&!fLs6argINQjY{!by@>v^wPtLKwymBy{
z+7I>`p=biKB<UNJk!&6=S6(wPBja*ZbTWiG8fnV-cJBH4tbWxshfa9%YKF$YaG3tH
z-T>NmVnZ|a7>+gOYz>xjQ%bf|k>%9ho67a5!{+0ZgoDF#(@kig4s3=0kqP=Mn^zme
zK8_YVpTorK`p1?T-Y{T`Ur{%9aKpeRl(_bz@Ddn>V0B4nI&J*(7jNFP%vm-2T3LSa
zk!c%O<TXlA<OQxw=J-^C8Gg9FLA@wj!j&p;t9<P3wS{l!?Wt37Z;^qIYTB%@Xw4a|
z`H6K?WVOFJS?aMLqQ+OV(`kd#!!sa1Z+d@QNqV#&8mdX0#}ovZR+-&1Uv!NKn-I_I
zI2gVmT=b3So_W}={F)Fi@Kr>9K{XV(tTs&1_IprIS&eZN_&D~CEq|Yx$+OZ)ddNUp
z<~+rpe*x9RHueQ;J^$$?T&Z_KMzSbuW0aLi!l~mK>8QemjfC|yvb>f0NxR&kmPh?0
z#_pkY>Tw0k3deJ%j{FJ=FHC{T6o?~G*EB%x9m1C$;chAD{szhV{_3lN4@G0%8zJ($
z8{aY_)DKW{)J0d2#}R@q5&1CJ24#oZRQo0i1<R_9>4`5*C)rNCe;)aRPB=EU6UoQ5
z<FV#J(u2hS*OmS(*h2kdp@!W!P3OW<u`}mC3DkO(zf0ubixqqqGO_MRKZ_$K>FRZu
z6f6foas3Mc@?u^V6oKw__3#3x$F3ho>pq$R&n@7O)pVLaKQpTR+wMXB@Gn-)@BSHF
z^GDaA3Dc#bQONtizBAZb2s${{(NLaM+jKs$!0jMtZuFVpJdab~mwV>NYxHVA)2by>
zRRA+BNJOkQ2#S5NoK#=4jjhaQjgA_$_7C9?--QKS%6Zx-p5UCT+38X}oLu)BbH*Y=
z@{AM39jO-iea*Vf(JoG3<P|gz@IT#C=iqX~K36Ze@0dgee7bO5b7i6SEO7%z-v~Xl
z^JX3Nk~fq`Yh>Y|E$ylNl1~uKN;Vjz2HMU|VGVLXE<eqVbai19S$Ot7n(zjZ(L9<U
zK5CeI!!$C50$qX^YJ{Z8xL-7JzPRFY?me1QeeRD+7yrsNiOtML2+kxUh{{4FVcDMA
z$oBZCUDU!6-l->Cs=n08H#ydN?{!Tco7~mHPjtDyC+X&&z$m6DkiU-sJ*O(14k0yh
zx2fzVoOib4iP_4K7N0~e%{P)mnX$vJkC^DKFErdw)R%F7QL4gtriL<v6z)=yEARzd
zt!1iGO1y97NBc51w&!W9>QNT&9dfJ-^(dtrGLvkhpgi<Oj-Y&IpbjzWTDjY>|C(RC
zEAl{o?8}1@{NL=~fwqtl<ftW;5ruP|bs7QGC(Cx?<Jlv=&DmIeVuE!mjMCXL+wQ0)
zoGNhjQ}lhh9gA?6;>ysgyk_?7ttb0G{<U&V_jB-X2zj9p*0ce|2)Dpp`hr_+CS<tv
z`i%RQe~nSGboI9Pz&I$12e4Z=9Rs!o0Pd?hN|rvKrCQ0>*ijX5{NBCj0MMqduOV4T
zXE#izo&adPtPrq2F6HU~v||T22qci^HE0lr!Q97e1GG@w5a97ONaDN@Zk7U}hR36c
z(om`rv=*p6%y^I$f70j!k>)IED$_8KS^DMbvyLL2x(~#2b|cAZ7~X14$cwJ3yTkRy
zL8mqe?Y(Ywb{SP^!-O-??nN>;{mgJvOc;`z%#;gP!-eExRV;N`wXzfI`z)VDUwgF1
z6@GxWu8YluhCD}!0L<0S6NF0q0&3<p{F*0bHp`4s-gTb?C{QTser1*!Rzmf46FsRw
zPeJ1*lzbfZlZL<0j(X%c&Jw%W;1QKBHV6!&)=eAA{P+|S_=gE`<IS6o+kNwupXezy
zA+O2N5<$NAyWxmO{%#x)dq7+gAme{O8Wzf?WOk+o&y}OKrT9xLu4nGrYf0V~ari-Z
z@#V$Ur{NUL`zNZq82$Q<!{p<{fcJ12+@YiqIjO^JXBpZizMDt12^W#Ng}<nzuj%V0
zEZzCLn7|g6(I6;@M}?LO9U*?v4>jrCxi2{NV+cdnBxlGhTbu#?E~qJA1*VLid<9IQ
z5%~d8bGD*Z7|{ehI;};2Rz)Sh;sNTN=7SO@FOCvF_J```!4EHtx3)<m*ue5|B0D)!
zPYkR29Zs@evb)$4m}8-2GDF?3XDgwL-s`SG5W(Zd3l;rxYuc@!K2UAS)`W`mA3&(#
zzq6i~dJ;u#u=CcNRZiB9!`_|vP%Q2SxuA<NL!f&9dyxkLxa4)3R31bRl8efCUtNfj
znpu<7m^gK+yt0B@Io`r5!`4#g1H3~LCn5bBPYwzbrRV2>a6>R)-e>ZKwwAHdWC^gK
z_Z*;u)_``Nhio_we$oW8*xv{xngTlDW_t_~P(X>|E#!R|_!c9OoHjSzF$L^)@eEuO
zP<Akm+1th+r*aJ;$;Fve9>9D8&!wJz8gz<RcK@VFG^QB$UKVQ4A<H1iTz1qzRSh6~
z>;u-5B&f=TNQ2@1gzV0FfyNbrG-f^lX{;Hf13quOvE~d)QhFgn<{oaU*XG1!;KZ`d
zkRGL0YOfNu+Oi(<C1<@QcNLWdQ=c}~HDG&v4Q2TaM85FJj}%uD9iB~D>L(55A$S=9
z<vA30Wk@>WOY7tTe!vO7TB`}^%CpVydv-4+a0o4>|E_Iw#5Bjy&`qvVC_$KT0o+tx
zaj=x?bujz6zdeP#A@Y|b+sn6Yo;j|I0^Q+jG1NI-q(0LukKLP-5(zVoRa&CK1gWKK
z5~ekpyo|lO@=md)Y|8r6JycyNK@0q1;&qbXu#Jh(j+_N@GtexQa0gsWb!V?nKV=xe
z#x;hb&PnWt15~A)&g;Qf^}$7V6z4J95ELC(D)yXyqCr%R&|Z2Cb8Xc9DOu!jE7j)}
zK@R*vuGQJOQan@c-|lpg0KD6R-+#-tj8cKNpvY%@HTPT&qqC)1iNQMNhe{jl1(Q+w
znjtIvxOV^H(x)vA>}<ZnsuOw~cg}1)K%R9X+yviG$h<qYS{F*u<<1~ym;f@MgEUdB
zG4gbf>a`4g;>~r_y%jFX6<AEeGsl&lyFMpPGv2gMUiysU1h@NeN6CR<y!R(f@^Vkd
z($Mo+QRHeX)jMVltf)gbE1)u;<oD=v@eZ*+X(poXO;B4QI3p&_QBMcdscrRhfKfHK
zPt72!U{61@v`SZ7%^lnhaI=_b<DtdB8C=mkvF^OpuiepuO+P-WpP1>p2}uCs>%c}7
zgIhHnuFcRtHWouc7v$@Y(o-2<!7n<qy|5P|C|Iy9ejMKR@pF)m4^g_pv$1L-*J<c>
z$=E^E!+-O>CyUmdxq^c=5KQ;gY~3T*QsPs0AZgmjdl^J=@23~dU_sPcsbUBz_LB-~
zghXX@a`d$tS#3qGIhR1%spxz+={unY&t%IxqZ3#QJ^<12Z-qibwIS6Lxulz75TmB-
zc&9ew5~P?XwH=8wVn7dSU=QxY@&=IW6t^*I%QWsz)!?Kn{R?}+sq<fix^JVFHo-BF
z(rk1r;`vU#vL5Pul5$?0!EkpkR;)hf%>575XiT?Fp%Fc+i`$pI+9bkRFlX6qTe>-}
z8!=FBb0JFW&_N(pAw)h_I~nQ6?Z5eX4SpNEQf;7l#mwabw7xJ@l<QUD66nECwxhXO
zy--8Go{d>Q_knVI-XPp)K5uLrlJElU0H~btW=ET_2fK5^3pA<IL-XZpkHIwRR$nII
zV9y7B(hN*GQGEEQkw2v7zr;5v&kSY96zF8%q7`ZOk12pDx}Q!-d44}@$$xMYrnqJJ
z3X!wrBfWO}*H653bb~aq?cm*hTL`ujh*lw-k;IMP76Lf!vcVzxYIPr7R2xFzin~~)
z<|=C4n>lbwG9r{~1M4Kp>My3S00Shx`Hy3eg!{kU>-(cGTfn{Ef)x(1Q4~$qkVQFU
zF7;*E#M)D_`V`$E<S-c8=7k|0G1c4<#&j0%T7lsYCGpo(;GtQt*SDy8ImHFXYS>J<
z;+w9G8M<YBpB!GZ2KRco<iro}^~Yex#fX1_bQs9Tql^8>$I67`%ZGbn{<7pyt0I*2
z{i9mU1vXGD%K;tDi{I3(77tWyG4AAM8O9sgWZ?8v1;oAJr6+Dt9oK<KDp6cu5lBtH
zupFmyj9($|&{{~7xRG^tK0v3;VbAOSIx<L&#9i5OtuxOO92U7&)P?W|{a&0(uJv3s
zci5YARoBkHc+1^vIiSZ+b92~_#D}cYTf4DZ0I>nvmz{1h)#AB93_%~PkHnl#e!l(L
zuXtUs_m1yVi#DWA*F0-E*{UYdx>LYmt^BC{B5(e8Pp+k^{z!{$@C`l21o8BBZ8?hm
zLUBLg2DtKm+SB#;3n+Er*ZndUDXf7XKBQw?>!t#I;HNJ6>lHyQ4Rvk0iVc}*^Pnty
zeZKmf3s$jhu^N~ktw;Un6lsa-aL}2GsDvblf$#&YufQ*B>D@Lr1Z)5D>cgSM8RTQV
z3|g7^1A(fhE|A?*(8046@2&;1!@hC&qQojnQ@ZSq%`z+VEw(K1q^TCZJK+!6QoaBa
zmmjQnLqX06bv=L<wUD`#*A+C}u)N3qx<-SMBRN#Y2##c@ejhSx4wa)ym|V(8jrR`p
zbv=?`9TOj5`f1F%E|9@n<tgL#1>SfWnNcr(vror9cC=FUEPvY<6K~90{B0YzE~mt!
zXL4i}k`BP03F#Acq<-5MHC(B@=5*E;kqR~vUFP;7x&@n+!wC_cc%H{&1}59c1wTyj
zzC3oqeuMH@sO#;o2ECa)!?So-EVmKBv41-rUF+abk_vUKQt-1JXo*~TYT)>dW3_Cn
zY-2ZZJ#-a1l>HPdc6!py8%7s7ys)^=bh-n7elmV171C94aZ1GdW3%`BR5y3j{u`wm
zH*?JEGo3B7L+85Qka&JY4P=e1CV}YK0&C|jn%gHD6Yt3$n}f%|Y3k<eO~Ed~3<a}l
zN=H>w)rcXT_)Cb;ui0?y%1ozRP@jy=^R#=l`BDXj-gaUi3Q_O2Mn-PP+h_Jykn>_j
z8bEM9_Fn-+bJ8CM1$R*XK7MH}o8a8~?SGm5q{+}{M`Em<e$sS^|9eL$-k|U9KllAV
z7ZLv3k9U5?0QxQnk9><BdH5h%T*`+J9@-McUwR`k<9#C4K=c6mQ>8e@@U~yX=QN`U
zs+Oue=~tYsRp1k4sex+_EnMCmgN3d~9Dm^^b;aC|=Y<zMLi|lZ@bf1pBZ1<@KZefv
z`}r;YVuKlSC{*W!K~zG_ywM-LWq1A{oJZ$XO3424$BnZxsZAgdxiR=@*s2UK>%3r3
zx)Rz{rh78t;dF_B7W1qkYQ-`9V|%BJypP?UA0D|D1a=9vL9%YHiw!@HTAJzH|NYh_
z!j#zO=U3Sh%<ElfczI~7qqRl0tQP<9A>NlXnkJaHf0#lUI``iWkM!02Q!f@*nA4y7
z{J%?z^KZYP|4C~0pZorwO@;rDkGB&6$O8rEe-<A?oIZ)Wg7*RGvScnNK>}RO1KJap
z)K5korO8W|DmFGyraAncM(8Fr|9;N*bz95aKZ6#W%J>ri!2j{5{@(>I@)RiH$eBEj
zgp12#+gYpzZP=>g=e{jI;vUc&+T~IE@)SB4$aVWwMCCnaHQqlnOj_N4W*<LCw|D1{
zAQYj0z-3S?h2b<*<3EV1u23S-Gx-Paj{ODPk^U>VBdJXSNJ*XHz23~;^=hS$V<m=<
zgIA^-{U02^_4Q<nNbd?`-+4U*{H3Nv<{w6I)V!sFe5|PP)}4f@u~<gW@Dk%cK6U=t
zA;r<X0BL~!%3m|IafH(IMQ>fly1sZvcsQ{vhHdYyVKv+0e6{7d*-p<KJoNBLx7t?`
zN(7jd-jCP6;5qUlX;iK4Y3Kk+GYnu#C8ioycd{7z12lIg_o-pL&2fg0R{qprOQiMu
z;Q(s>@wxT{lA!;Oz!^w-{~*`}L-m&Je|qBobKn1Z!1Vvbi}t6++w?oMr2HFtY!-7S
z<mpF5|E0<_-;`%b?9M1;enZ~JSS~&X=-GwYb`dvG6+gSkbwz5Q#Ju#l3gLb~+9e~%
zzq}zNPQ}`Na@e4^@B`_y%TbAgtT(ixjUB^U=^4kLoB`-9_c2rR*^C23G$to}N1Bef
zaWmukuw3#jg-hi}ih4smM-xKD+iw=XY}YzDEPDA+U?+}=;7X}d7a^-fG-Z6Dq<@B=
z@$`}v9$g*Ux0hD6m;7)|YK~d!<bm-ETFrWjIJPHf+S*gp-VF8<;2zHUKyYOfKQLjH
z0C6fR>k`CbzSZA&inn`iVD<!A;t>phWmS2c0>&w%mXoNVPjCuZ=N=V!!Y21DDaDB{
zYO}pl*e<f@m-l8bD5Ctok5T{IA5s4a;QlRY8UOM+LI1S`bDr!@^ufDgoEj~E($JIL
zOTHH4AF$V*X}6kac`PhaByoKTZg?{$zU5RG8~w}6n-<iRU$q>7mKIjvV;X!Rg6h1^
z8y{gg^@+{nhQ&clx&he|yj)o0`T253yAtL~nU-^T$YeuCpjxGQknhne_cd+H>t~Lc
zE&)xUX@dMP+Ic#>OnKvl+@3Je6BF^`hrDI((HDhNrv)TWi-tPusZIp8wuywC<7HkY
zLw*Yq3{WKkmv%1~;hFudn@VIY#EE%*G@q5}c-Sw!{q#gkNX)?W9UV^r@*mGb)15ms
z23$92W@vwvd~*KrDE-ee{{Pl8{+}u(dXTxalbQG3s~){*pR%Hge@;0o{)kTV?A!JR
z;miYU{=I`}yKbU5BJ-n8fYZBGzFUSf5tc&7M(W&nY3SygQ(hP!oSX4Gi_XoH@c5)Z
zN|GRz*Hl6)1iMrxh6esjoL40IXFmO(sPOmIWdKM0k4IPkKaawJko*_)%qKpldXJ;7
zXa?#*XPr;5e9d&r6YCax`XdhtZSTdkFrN%b*BaqE6W;tuS?e6#rsb^PH;?fuK%M&`
z?-5<TADw_%{e16!DI2%B-uX&Se&6?0ZBe!M(=sh0_i6?DOC~kV(B*w45#}B!_c^n7
z!3Uik5;Ya?TsJU(olZmZ3Ysm%0BTd+W4i=0-hzCG_$F_1WXW{yIG*(@&)&;dZ&Cu^
zj@BI3>*a~2ZDnQSq8y-p2S=RfH{_^$y%L-$6HpO2WFLGT_M!O#ZHo<IFFOF#<>#(k
z;h8Xt?4fU+#_0+L3za3+cOE{Xei0TylKAF!Sh89=SFC#ARO=qE&_fa<D_gudDJ1;T
zUj9zk-<(9~eh&Q?Er{--<)Cn{oGZoAUiQp0j;{7<Zg#PIhXc|~vE5|#Rg40KGs@#9
z%>gMiF^`gtKc9TQ6w_&>85FD?=&H)t*(3My4(IwSXy-6lNq-haVf7cHY(aj~a9$Py
zMV^KqwVcRaMIir!J3S71W;3ZmKDbnBSaUh>>f@d!8^enLamI+a3S4v2L2uA6J)cGp
z{r>(^4?QTs;z+1x)7yITXfi_?&=LX1X6PgwRD|Dq7J%qL1N<ZxR1(<`PgMql;Kg@<
z199;u4PNdauh8zlB8h;P^oA-6$r64OO?1Vej<_gu4TdCK%Ilx(U}|n-?zw8f(54cW
zCUlF=QmAwnPy=SrqjXJ`$DdW}W8ALUq*@ob&c$_^#ojhCiEur_pwzw?zDFW}YIHD+
ze3SC3_M%G$hpH`>MZvhZwx`g$H2k}k2uG)v+XcI7+7bpW^*PgP09QUt306Oi7*<!u
zp(9jzQO^6iwV~N+@wqS&$*z96s-(NZJP!=$^Qf)h@eNQ1sl$TugK$m^ig88x*uHhf
zIG<&Ot+&Gz=Y94#uTBk;C9>|iDmzJpxS@v=3WJM%TrKB|iktd06j%QuudA&jj6rG7
zwG{$je9?_YVAz2*shHL0S>5-|cgu60w$oZ`3>qYV+f(_*^9>OF%7@9Evsle_TfB}I
ze)uW*N{+Kh3L>RUUts2Cg->jTFt|GxnyqeP;BdXiz9`=`^`IpZ53r8k%{nR(f@wzz
zAeX#)e$s3t19&mzA1=`BXZ(I`2>out^XFrTk1|@I`~2Gw(gKot_IH0iQP26KB~e_<
zf)^2##f5}oNoE#P0*{)<_JkiXot|hcetu7}mE~zT^&u#D|Lz8<5w!xaN2_(yY}GQD
z6QkU&QJgx(MG5^Xyz6hZl9N<t5?bG~{u!6QgK8R5XD{A(Bxc1N<;k3)vB`>Sg~-eA
z8RN+MAK+Gr<JE6Lp&^iwVp|*8;jF4NIC~eu9!}22b2Sh-XKOwvv~6{bYxa~P{94#c
za*fxzi!qu=XVxWB+(MV-<>1>5AC>kahcz(kzB;_uIntW-Byy|!uz*zJ`i!*BaRGum
z>iQj!7s?W_@op#k3qlK?r{wA`i5uI7MLZkIscMomH3+dW&JP9LoNHng<@}4K_h86I
z*-^!inFZx-;`x)+k#c4Z^4p(tbxz!zzK>hf%jU~Y6=XWC>Q<haTe#SOIJp@!>aGv9
zsK83Ig&j#B^-U+DR2*O*#9=<D)CA?P;<cJpN3L<{ecz|y`5`<D2m}FG2%BvRcEGMi
z1JljU(^^(B+cTV*uj$FH2^`Ot)0}6WT`OkfRpoUrsUsR%&MIF(UBNBBxI^pYjc{*H
z2JY<w%?l%5LtlkbM7t+_Anmo5akZ>@#Xb9Mli1vqZl^)HkMb&y+7GWibZwLVBwCc5
z`4V0_Mf7Nt5NC3I8p6-Gv?Cxpe*48d;-2zwMR;AqaW-fA+<Ak>I}Q4YmV%nuE02~p
z^Yh^qD676wm^@E2>xr7j>RDM<&V32uH-S4;5jwruCsBBFF=g{1&&pS4l5)hgo@QII
z;TTl~HKb{uEjp^4)ze1vqx0s-&3m>9-CU~{H%dJ|UO$Y4DTgBpJ~ZTBg#oF&ikNTL
zxODYSq?;V)Qs$gbo>w->^~~1e)ie5vg7%{@=yHx5{^9tVYq!4kFGyTy_a8_x$yd*~
zQ1{(F9ACT^_&|=5pz&^b_JRRQ5T>TDH7uuC%3$`kF|+2eMrX-TT#0PVYtwS)u}B46
z=+z^iCS9*Sy?yPRm6pmdD#hV8O2}1f>$BprVUh>|NW)$p%FugxL(gEiU~E#;?`Yh`
zm#z)cl3B$GZ(rYaDtNGDv9|ABFRB!k-__y8+nbVe`@WwYPW(L~ephAP>uRXMi`J*C
z5^e5M^QCDm(uef9Hn@jnCa()#d^z|X_VlvO2+-b3^Eb^*bqN0ySRmCUS<b)QF*-1^
zP_2UH4r(fG+Y2zwQhhj8*TrjQ`n3CCS^wilkrxWb8`4j0ww6|?4>rUv7)B7}6GLy<
z2B9~^j#Xd5>`B>Qv}9#@6nl%X=@FUWvud*|;%R;Pnr*`K$A}utveXCJ@$+{!UA!J-
z-<d9ZYXgljwCQ@+4-06NnYvMQ3-Q2I*UyP%?X1$_JK?w&4vAA&M4%F4%Qjh<pEO4`
zec$s&^Ltt+n>gkOIaqq73I)v}`qEq23zoh(_aBdhhZKL>5GhG^cma^&-4h*V9tC5^
zd0A{U3zmwPixZh%$7DU;%QjW^80%HW@yr{lcfI?+*n97|rn+ryG>C!-h$2l|R6vv>
zN|hSK0*Hu!f)t5}G$R5cMM@Te6sdv=3QCkBN{e(U5_%EoND0zGq$hx3K?>jW-Q}FU
z_u2d0_nv+3J-_qqKm3_2R+(#L&N0V$#u(4|K|EZ{m$oYnIl^?VH1+hmT8neyBJ(Xd
zc=3W)4&k)SVqZpFb{)hW6+JLzo{>0d_Xt$DmNi7xevSeauCd69!i08Hj<krLF3+-i
zv(GFF1vL88=Pec0p5E43eC&-sT-Eda!_$W2)jxmY#YBR#AHK^pvg@h4@qXf9tJ3>L
zFYh?Cwz$qtP0TZ}-c6=2P$n@y^H68|-uBE~v3uTvw<@j(-Q<lwBp_P61ab%)yWLWv
z$a7sOf|-h58d6U7fkk&o69kl&<c<nB&3;GM=M9hnjLyOy=oBjpnF&W!??cBC_WgVw
z*1(;mqM1H*eDkLHjI~AZ`!IJSOxlu<_uh*YUL#-Vo+NSi)8l>u<J458yry^fov_`6
z1^RT)Sn`ryFl+axuRA@zsR`0m4mD==9_mZbt#){RUni$5Z1>vSsqTbNh3$V^y7dp3
zV*eh4?Ej+U8j_Rfg$|MeCA??+0{}jyuiei*cc4sttn#6wx?S0Wv=^6C&a)Ezg3<N7
z3+@f~HH<k9>D6EZ$>`Bn(4Iu7fUu~2M<T9@3$ABz(10Q1C1^eb0o_EiXmQcxVY#tn
zId+;HX&M)Hj}jsI%;gEU;o+{;HfaZaH2wYlWMN0%c_p(34l^_IhZ?=ky|aN*U;l!$
z<yXz*@BPQS!3j(y4f-=I6W1VMxxp3fz&&&+S{8ARyfOREqHyRw-W_t?9;<Pppia6#
zue#z57N@d}V1t?9f{(0+`JbKW7$8ijgjGsr49{EU5@&A+83>4%eN1$C@3dHOBv{?$
ztc=@9#FJ`8CR!V|7O=DKC%aPeVTeSX*qu~P2>WReS?B4rM9xVa`Rw<QqpP4qr7=Cw
zO}nO9+?--M-ofePU9%~H3$2uVYvn||m=dJ!XK>PF=fP97qk@Pmtsp`I5|)&!K}L=6
z(2KN$F(c9>K0@lOSNtspOvUiACE|!C(Y`xxLp=J5_laHd_r-U=C1fWd{-4x1{Pj5v
zWY7pWmhFf6h(!O=j=WcI>wAn2ZeKjRUxOpw4*{rRsvuZ`YV0F7sg(<jQ+<%<z8>(#
zSowvSVY2Oi{Lp6h5w7$fyUUKy+cf!399bE$GWeL_BWb2D=E)Hgb^P;Zp93*KZLFXv
zkLk%uu@5aj!WpCwZK7cut?DuyBVI3#sB+|Jxk{rv%kk$Xx6{5u(GBBe?mXs-{PpES
zgjNR9kZ^_6f3QWt-b%Kqt*8Ft$Y<|$S6Z$&)^8zaoqi{^>NNcY<eZC|_>Mz{RGN^9
zK2_aXx;qn_gJ0YbVSdp1dJAzMYaNnLHDGjay4KK@Xe#5SF{=&hanpOo<68vWWzs4{
z--Y2#SH@J(lqLQ-g4OqRln|v9605@sI{>PadWzf-dfN3nVP%6>+Bpo5gYFwDW4ZL0
zNAAoRwNG_vMi}O-;^KUb=BXf+xX%Y0m(t(WXl;xW_RQMIb}9nr#_8^hHTp%K6jrIr
z1t*(7f7p(+Lnn+Dx-N`o)2#Z88t{=UR?(u)QRF5!{Y2Ab)nikuQ^EaII%{hZ{d%ZC
z?u6cfvoS|{rLqEfFLNLeV+gffQ_b$rD~*&76-)=i=2qT7pIW*u`ozWEEHg<<xb84_
z;~<1lr<O7<S2VS{yc+2Sm7Qyj(+~cm+Ms`Q3@xfp-GOc8M+p>j#aPA$UGLS<fB#Ks
zs>M_M$v|?8kjJ-xxR&td#RT=Ic@tNU+`%lU9bwAKir9;|VjRedU>Y!e_m>J5wblP;
zU-D07C;yE9nb;a+56&G`=!--|$)7+cqe}Qg(z}%wQB7`n92Z!YPsd}{UdHwI2Vy%J
zoUx5sJCnXNeVUX=WR}eEFXfwFs^T^q7G2+M$18l<y5umtW73CaKc+5SHq9l!?V)$=
z*sh-<9;YHNMW>v2B)uXzj<5gKBZG&$Z*b0O{)TX1*vUrUHGH?+4jPuE5+Td&ESFk*
zpXGc-$P8I&^5(bGy88?UZ(K{#)R>e2w)EnWxzLfT))snQpEI;)K`L!<`p28Zje#A8
zz*`o%w!LwQjlUO^ya-lc^59!t+fI3MKVSf7NN|m$>VLG45{E0l4_8{x^-MigQcJwz
zNj!Hd4{1Z1@;I2p6iUg(!{-(EHGhg_Y$7N1MkG7+h^~iFq=O8l#R&%9Qlrpmg|t+x
zdhM_eEzZdGNW@vGY7(ZuQqhsoZiHIi+hG6gmgv5ZkM$+$&xTP?(=aA-dtu+5wGva>
zyNANy{%48TZFRB})$&K9@lqd*ryX^g^OQf1^}mE8>#Fy8+$t0Mke9~b&P9+Zp!8t*
z4MVYsEEkq;679Voxy(hz8wkHMi!O_63c2EZepaD*k@mIxtoG^PX1rTZWn)QHOF!@D
z+?j`bt{O&ruw~y+jV1gIqR1<|O5+eHB68AN)lBr&_MxP2b6=#}i$C=_k2;e^>P=4B
z7-j!3y{gx?N9Ng&rUpSa&|K#S3}}R*=+i3U8mel~;+GC_{dybg4mO=~f?8S1u3}50
zaW9Qgop{eGV}xpl(&7mPfkaLBw!6wiT!@Qx3vaLX7NQc>SQHj<54k~$jRhSIds@bK
zow#LsD(30D`bxpb`?oa^vlw2hc*^o^;;~l;Id*qg{sff(_x5ce<l=Df9`Ku`dFH@3
zez+vei2+!IH^wnI&ElHAbq=p@QIWgjiE%c`Rhaej0_N)p>wvuc@kp(MW#LeD7~B^~
zz8JEFK*h!Wc9(@#iHpx9_Uj8wimAnaH?~vyBq*Yz@L;t+eq^xC&V8ym-B<AE<U}+p
zicICFub~?Am1HqB1#uG7-^4^(AJ8$uO4Y{M%SXlAD|bufY6@HFz^Y4zg>0vqZY^nd
zuzZwu74(sB*L*x@Hm;eDCTByW4;o^z8@o<zAs~JlrnBaTQ%`2g(X_~YVJ~OeQyYC^
zPg@ns*Ah_0_k+*MsIUti<>2&<rAb!pv0c68291I;7{R6|^;o8OwBqQ{(mW#{YOIXH
z@<mN$?24F4dsu(@p|u2`=O+94+r|!atiF9o;?K^XY;(_tmuvUFyWG22ja=)38sCa)
zk$|83JRP}Ch8jPW3zVM-dieImbO)Dd@{6<2MGpeLOvAQ!V=rHtAGM{#mK=$cnsYnr
ztC6Bcy7%r%vB6y~x+0pK^N=hVn3~vbFdr~d1xk0K{Tb47sdMjjQuF6J>w7OvKNZqs
zsn0Lb0Y&G+J+8MWDjqgTg|>MdogCdMwaDl#MN+_6Kz$C|`a{GP;_)9wQx!S?R9IEG
zYpR_0a@kXhI*gjaY$3n)1&4Rer9BqbVNtKrBbM&a9LKVYPPDwY0!<G}2$R;|)MA4U
zmaSgQWnwJ>b#Q_kx6kc<dF#E&yI8LTsf##Sy~4iR)6TEWZF|k`<Y%0Mm|2XT$8cp_
zE+LzTUC?d_;2T{JgMYzWPn{$)7OXcvfO~Alx}3kf;V9n0Y5IQu>N%MeD=OQ)!7nDv
zMQgd7LY6qASC?PDS-gfV&GEVD=irz8!(3z?5BIk+PQahWk?a*Y{KmtJ9lNS=o&9x_
zb9Jo8e7<bH<Pbe}Og<*FhjE<jnGiN^m3v2L+nF#ik`kPmWnCJ{5FbVl;9&a80y^7a
z(2p;6ku%%pb6b(&@#0UBZmk`tSEs0|G=;Ak7L!7n7CiKrZtbg+!7<X)3NQQazw$A8
z8z5?$AhUz*Yjy=nm$Bc+W)8_UOK@u5`?}5V+byxE17o`~Gl{zP7?GmWyCQa=H6rN2
zQmtZPX#!%a)^)=3y?1%;9(88Tko9f)dsWi^*B<9awBUE5iHVe(P#M{~W@Z*YJF|tr
z^p_5ov|8Y(@0wP4X{_}X(`OiD=2b-|I_<wuivDLIo5_Xy>yMA_oZSZpH~41cMP?8e
zR`Zq}V~8WD6G6u|Zc0U#JwMVi^_cZ=N%ra}W7o?e$Tl`SnA+`Bw}p`E3k}q&A^}oG
zD0oEn>+4Q`>B(GHi{7Qu`^qJjuX4Yv+%{P(I639ul9ds|is1I)oxMT}hH7NZy%&2(
z-#`ho=aVhO)5schf7|c&7=C#eygZ~+p4$^jPvmrd$q*4{F*6eY`{F6#J+~}3kd){2
zxA&GGs(HYUb#fvzk;`Hmm;Y!yzPYP<Miaa0|B<sPw#lT<#1o?~LBG20;~M7vB2QjG
zhC?+|uIyND)gy1ZQ809iD{O=xmLs3*o*B=}r&xfW#gHm|tky;T(&@wfBD||*EZ#?i
zX&L&F6bF)IC_~BL{3C9{p^)-ovTb=#(o5l1{8Yk@jw{x8++Wq-6W}oKMmcf~;;+KR
z*-&jC{J|ml+{dTi#61#Li&gboyd~py`=;PK-P;r>3G`%7^utX8O%@%Ja$8NtRAxn&
z>CiR#>w~)=dQ2_-fC5QAHTV`A3&4*-v}szm?w?v&cAf8Tq7?ZQ?r3FX(F5q-gDZZ1
zaxowXue?4xN*(E>+XwBGy&ls?R0<WieCQA&D=UrZ@@@ok;0^=yLB<zcQCnC;n;MGU
z=k1vya==UI_&E2*9uJw*uiaGdA(!P^9}{fM=dW^j${0$RMV3QfV<++?#=kgRiArG?
z*=^CZgh?~X0_8=Q09nlklFr{Dp!q!{He6es|1IVx;_YIlu{I}jM9@T^`g2-YpuOfP
z;VVf}jyuFBKASiXi^@(cKN#U4yWN+QNnIUE;}ym}TNN#(@}RHT>|eWfcjU9i)KOi)
zX5VQkJ##`>;z8E(k$|?e{yIlE>wH(@2z~>{Ld3Qr_sQh;5l0&+k%DXVZ-hy+*o79d
zDI-ki0@SYxHCFvdEwmPTaJ~<MfdQhBMt5u&Sx3XWwh&_DXxIT2fm=ICghtCCP=K;O
zcH+f&r5&hi!A^rMg!(qZHJGGajAMY9#256umK-R{uQuO6vO{$zXr>|>c9=h&$+ge~
zT3v?;p{eU~aR0F4rH`oX&p<T{Ns?j9D7-<%mqBr)Qknv?K?_HE{^!R%nRq=rDP;7A
zi+D_|MIKy3{`M^7z8knJ>tf?}RC)i)08Xs^^OH_fPtYz)KbRB(M#$~o2ALHB&0$#!
z!N_nMk#ze8Z}eR)K2#yHL1W6Nv4=r#WhfFzUm%_exE5@YLw^uS;^wOd3%`xeZVO?N
zAJEU(Mrel7jQvk0-lC@5i?$GiyTB$ulD^=0Q9u6tJ)rBXN)0RuLQLDB@5p)O-vna(
zhc`Rb)2NJFUqX}9e%%FxvHtK4U+$Dfzf@yG`Az;Opq!6+^Gmw5zlOxiI!unn)2WFx
z=h0seQs{_s(F061cl(EVF2N|~KMEezXKn7eF1Mn^2eMf0;CE_&d@UuDd5RhQ!Vme(
zeS)e(_}Pvo<3Alqht;>OgIY5%K&ASD;;+z{G%dEnohk~i2}8A3x3m|hTMa;dWx(WQ
ze?tNouqB-}6-duS9+VaTHb(HFFUJuu@CBx=PBH`lS~9w(Yzd}_Gip56-w(vuT)?0c
z2s%gJxLsu4Kr?p8t#bX$-aibD9iajHI#iSV9W`~k81(y*0F}<vCIYw|gwo0|YoZaT
z-j@V$$*&1z6yg3$?y()Qu-!7~EZ8~t+jRQv67WRgpDw`!xgkG;-|8sze3WNW9Z%Z<
z#r@*p1+Or=DdYkze=CCOkUr~-&{i=2WU&v8_1(_dJS+QcV93q>sNy^ViI<@}Q$`2F
ze+-Swf}s)ac0zWeqEmY(hHl4FB=DUPM?q!qNv=PN0LgP>^a_vweno3<808xL=1$Pb
zN?Ru$s0YlSbnuQh;P>&+_=!JFlz^{ioj$5>EBeDU4BPC8Tq2No{P*7n-K-3%9@eNt
zE}l;zR3y?ckDpM4$ig`{6YERzn#y9%(+{N<WY_HXXB;8WfQRzp^2hA`>?_6VVyiLz
z6rsL1W%>^N3sc&s#6CX}Hy=WBRf){nAi8e!D8iH6M?~$iCf$GH&!kq!xAWCppXt!y
z!@3Z@eE)JXm^UIK#QB=<)$67gn*=gatAdE%$Y+>&ii|J(9^LqV!@0Wzvu}4VBdH&n
zAqgeg?tx>}`J0TjaFo0>b-1tZT$ksLM+Rl3Po>_qNZM8-yzvvd2J~c<Q}|CS1(n)S
z-gBu=D^_Q!5S(@5PdE{f+vWck@Z?{^nY<eyXt2Z7h45h}R(JhvR}<s%Vl+0azZw*P
z<GFw>h04#2DnhZ(CR#S8xw~iZloW<69d=73sq@Ah|Ki3Z$sDKvm?Chb^FN2FcWIia
z;mE6~jq~Nabf5lTl|b8@U_-J&E$}{|AW!^0Slyyqk?N!5DnGGmR8|_oKHI<ZO?n*f
zIeo;<m5b7w+5g6U{5$sB-5w1jIBBwWGhK@#Maac{af<Kmx1&z+H?&Nu{iu7m#P`<F
zh%hfz(kHv2O16^R-{g0{Ti{r_o%6k+w}g*o8|hD{7&Dr?q5DHq(*%<vc(LOxP7}9k
zGcd)XuaH?<lc68C5F$^<$O0EQQ|E}QrB(66lHFi!&UKiaw2c@M588fpB3dWw2-6j9
z&{-P6{QB)TtD)hc7L2E0+xE}KUDfuUwm~^u+xOP6yiNUtxu+%hVuWt=IW~H<0E(*Q
zo%G}4_vbAAn9@yI<TyTb0uW(K6r?NrglU9HvUSBAH<~4c93+dBh88tzpxrq~N<}I$
z_hrkUKKjl)BgJ)_%JCDioAuP$`}@80b=l1_&a0firY3hLpozyPIHvu$&+TKXN7c;F
zd#z8Ud^Tz&4-e0QS>VT78}jd3asORfuK(m5<W|>zk4cmIZy6x}4214q_xQ*1WQuPU
z-dp*np4Gcp#p8XMY*1XFSDe;2y?iU$MN(znlvLKd*#&(K1R^;eQ$<d@P4WU}+VF>R
z)Kf!rt<l3oC}Qn0<LBZB+LR@NLHPk%1OGMR|9ihnBW*y;k0$%JB?rct7I!Pc5!v5H
zE+mlNdla9F*U4g&WR`ql#k&Fa*&R1s2>H4Zy6gD0IKWa6mxQ2Z>j1pJwLvh-S2xuE
zTH4(DO6XBnN66J(VTaK3htY#E2=OsD=?eVR69$_`1;GW!hFluF)dW}^Gmw3R-17hO
z@PF^?{=M_Jy8pGv{ud|&<{<ce_ACPl+fLB^%wM_OzBi1#RQB;%)q?x!J4*}hPeLx~
z<Hv(*y_Ng0N4xNH;(M)X{9MIje5GU}uHs(f7hNg9?0aGkgDHB$H5|1ztO*IAcQb_G
z(h0|K*&-u$r}fRGB9g9$M09#7+9Af9?Yo{BtCKM9d7#_<*Ie_X3{iIKeyGd58(LA>
zLI{EWwSVy)-;RRaJHk*u@E|NOmV{y$q%nj&#yd8p`yu#nENF}VgL%#4uP*x6P5vjz
zL}#6`OOnbvaON;>BJbsAt2>7x<{Vn~Q}b(^ggqON_TfmzTmvPPz3yBM*OV^DpOEoB
zp@Lj!*;P7=euyjOqV0>-r$5H-n?-TwXn3O@P4yOkR19`GmQwOydtbkbsKd{c3vrZy
z3U``Chwvh{5h7h^LsD{Jc^vPuKZFXM3ecHrT8Nu%z4x(naCIZpr=zXn?Z^@4b-91d
zn*ZBY5<cI!?~KKs>8sng-YL;+utca(0=JM%4wVZj(K_&?KEEYn=oac${D9>L6)vgU
z1LBX}r)Sj5I?glNfwv2jK;mqkK4|<MfhheIB}PBTk<71|8}<C+&@pRY@eFk_GVfko
zjEmtY$a#A=a_)?~dH_%V>@XGu)nHIl{Tjg0wtJSyNG{%mpm~F2*W3PQNGi1*#JW0$
z0vwrZ<pZ55F6fOns3;xet}JN}XZv}>O?ne}<DpCRSk#YPC)6(_s}Db20lG{)p`E3g
z_+RXy?UiVo3B6}U^(!NkguYx)_)K|c)k-D3kvTW|^95`EEE>2yq)B!3rYsle9S=a|
z=@10=4OHiiZNjaY6(N5)-}4~lopYEf3Uyg_LL|v8L@qiJu<iZDMSzR&FTVflCetDR
zAIZebewoI@Pm%xd^fam=Kw=<op<(92#}=gT$pPl33*QNfsPRTG!kQ%#1m%GL+`5Za
zK`(*qPlEXd633Iw>-1<B{jVx%@^PXU&vh)QYs@DnL(;9QneAE~6<*`72AcLCK=w*8
zMv(bKM{LO$otpjMCs|hxB{GC6ekC=g7K6l*F@UXE5+o{lffs$HgbW4WL-HY`<eWS!
z*sYc&sR-0F%JYP4$yFm2B}<KN3jN#4A=v#Dp3WBrU`!uqr8W?Ci7;LP>TWirExCRH
zVLw3{`d>}$*3rMbCiXAC{_7V1&Em}F0X?P(HzvJqL*ut*Q*Pv6SSVXrQJXN5wiOLK
zsTqw0NM&8rBJ`sO#n=ZTRSCQsM_)7A$rxmDJ+5GNzKzEn&RVY1y~0-=FMB7wgsMA8
zYgf5FT=-@3<Tu|=)}OjS(fp(W%FnK=UC{D8C^F!I>H@HhTZlC?MKpC2P+p$JIze^O
zMYv5F4>0Q<K^w|o7L+^z1fww!ZLi!G;&3PHEJRc3UvLG-?9KvA6AwxseyOm(yfg2{
z8&D3R+ztK6?*Qsn0?-B$!Ac<-(fL$?PCP@PC2J!yz^74kK7q~~&Cg&EKqias-`v{#
zdl>EH5YYXpO(@3BL}2qefoyppXVlu&8Bhzs4QMc35Lj^huipguSGPtd0gd4z$%qsN
z8_FRx!w}fBE&x^SvIFt-?Esx_DPr10|ILg1Zx)d+9_)b9V_}W+Lv;0VRMc&MBae*6
z_-{>43ytEBpPAi$H}?1}R+I)JaY0J65GR)3r*1+K;yc_cR9mk6CM(h|HAlz8?#^m>
zD?Pttd9c*0Cu)W@!yKG`0BSi0gDG%5n~RQ=KtSj2{SJf@+Uoh2ll#BH$(>myb^wai
zNhJMI)qyQU&%K{8P#4=Zw-9kNAX*h%)Ik?f!uDeOpp{!&2oUvIFeI}wk~8rQ5PWc%
z7K`GA7DV1cKW5)CZyx=#K(a>B7S3L#bC%EQy%G}giwX@D!Y5-C_d9yu*p~GmUcZ``
zTnb?3p-B+_>L7oH0!KNP@WpKxcS^pz<yIYh{;?I}=H4&ekI?(8ZTFs=%Q0sO)av=|
z?v?1t#6?yTj^aV`Pf>*Nc?}tsBCW0n`t<Nrmcq1^wwANdTlbZ`y9?QECiGV*C!-zM
z9vr7FoH@pBK$Si0_hOMx^Zb$2kE^oH9OoNkT8n04leKCCHT(VuVRJPjVOcaSsUw82
z;E@j`;+1v{N87u~xIjTtx#pnHQj@5$VrT{PEAE!x-UOoZ#Aq*wq}#EfFaRx}fIWHS
z9rMp)e@4W|uo5&AIDq6`tCFGyzsMT`hHL>+v!T__V~-w?$$jzL{_h^Vs9?5Hr=Gy}
z5jY4KStPn2D?q&E)t4etVW6695_E(k_7J~WxUORQd*lc);2rbat|M>t51omY$=SPy
z`^!ZH^LxqeK;&7hqYt2Hd`8mgX;2Fb(c<^9YC!Vb?6%@JPZ8;9XoyGX-6+tASYX*L
zpgUb6pQo#|yoD$<UrYmp<ZlCXFTjw;{Y;-QT{FKnezQO;be-VGsFq?Iy<z6Z>1p{U
z+HUDlfdTe^%mQUysR2OVW1#QL0HT+Vxd=3MzY_htGuXDqUA7R`U{gB9O9Owaxrv%u
za)A~sdkAZuZIDS4MDwwN`o%$T?<~UV*YApNT83pEX-P97sD--)zoh;K{Xq$)g9m_k
z@e^xOCOyUsy?Lki2y-85EFNqr_E<qc7#{-)^fFx08A==A!}ec$k2I;D{?OBvF6~P{
z`p5W$^aD7NY%soFGrDucXMVz=!eyM!-R!^4FB|>k)S;7|_ET~BE2%6F3!Dh=Uh`HU
z5&lICsg+XD^^@*B9{o1c#d&<FsPIMckwbyaD+fKD9(tTVA4gxzBv!o!kC2|k5ltxz
zbR5b)J2?P3!SY@!1OLs%bs_qoSb0^<;r-lS@Z!exnNjy+a)z&5-KNbt&})VYE6z6J
z{vqfZp2OQcbfqM8N#ZeLLbX%xO`tdnVm0WTU(&!IhEI4d_iIAFQUMe4!mkM#lZNhD
zgpQ+0mV^y8S9WON1+Zf?Ma~7H(&U0hS9CRi%W_>rZVRDrhd010!m<D&^{B>Cm_QI@
zEkSMVPe^H%6FrT9fr3y4eUJFwlMSv)2Y4wsXIMyeyuZdVR^*nTy~pE)_{|GZcZLJC
zwGvY+XU6&KK?63L6DVs0mNS+&^!t!LS>i)^Ner1=JtX>(K%Cuu9#M5w(Vsth5ysX=
z_2}>sHrQ}%*l2>Q-q2EZpLVwxxAm}Ld=}fTEZ$R&UN?BJoN^FHu;JSVQDeF2oi-z`
zdz~Rp4exib&fu$?edFEZRLN#Nnf-a&7RTr_W+J_!N0@)!h*)tA8Wmy)VmobEO5jH%
zy!kb>?kgg{x~1y%R|q+du8$n?N3QE>>^Xf@>XcTY_HXeL=&;sKkoHq(y@ePw{YqGy
z(S$6%(w@U&43josO4%EMJ+$ZL8WY{|-%_0XPm^OAyEv&Q0Y`fDTYt%~p3?X|a0+8i
zS~a)m>O?so_m>GpeiM!SL&}q%r4=JoZ|>iZp!)u{_BUcF@$@__2ln&kmFSuJ`HiVw
zPnXf_-9<3A2lD<9*dQhop2fy|FDAkW@ub1O^etE?SFoHG7-d242Dxo;>v&tt`@^j+
z2A16qy+V9L@5U>Fz*e4nOHBG?5`wOs`hJ!e9g5E+&JnNFdwZGZi<1oZvBq3YztsGr
z?%=bhK|9AH%6@xw(Y;hts3o6f16C;t*iSwFKVjf@Y}W=5VKn(Pqs9!msdb)SNq<k6
z8eqsl130h+%vSl*PXE`<gn!pZ_s_e-KMrpEEBNz2Pd?25R5RgS-mwG4K?d3H`2=iD
zmX>s~vZCVaNeJQiTb8t6mT4UA06m@NNLDyUzLFQ02QQC#hU6fLDMBPl2E{5fMfq{_
z@*T0b^!7`kS2GTtLeyUzV_NHI7=@3j)Nt*<K%@u$5+$GDhRGMtn^>NWr>mUUuj^QT
z_MTXOi^X$qW6ROPI_$6w3XbKkA0_T|*4jqWv20JM+FMZHA1nTP=iBn+^@lvdlWoF3
zA91?l@>QB}16l#{sBQi`3kqP*iK8bt8>6%8Wq#hzFpZ9NS5U2RJ5{|;uTD4%r1gJB
zY(!FC&|j=A6QK*FnTP&YCa&q~l2Vd=`+f6XWtN4{ea_l`$?&jSem1RX+KxV)8;ZoG
z?1nwYTtiT#E5occ$ldo0&|E*fM44@Qb5pl#>peNvl;C~a{?#J~jeN-@`fGd(aD_H5
zoJ$6A1u^I-=+Th}6b@IQ|267ff5l!JL}sRh!nvOAlc2)z+R$)I8gUM)>{+wA`JnP$
z?&9Dpi^tQ!DxU?GE}OL?wSc@&LoLb9qZGlfs5K>g7YYeAM^2!qEF;j51bll3EUrR(
zQSxdFVVi3Tl6))?^zAS%)u*l=$E9)lHBGB8EKI{7z+TbPE4AgjY;KR-(zMj6X0y5D
zJ`29)-=m-s{zWV5vF7q$Rz@4`)c8j|BlrUCa4P2RCymzUT9<W<)~njxw5}2fmY6tl
zQ*<R4K;h~VZN%Y6xmSOviA$MbqII0cf*)gbZXP&s=fOFHdx%a}Hj*pl5iCvKLg+CD
zVEu_!*#P6yZLUHa-U(w{hz^YNwl<{3wq~XULq9`E87FEw7Q2WfbAW28*g6rcQMi|i
zRJRYlE@yLhEc2ZfZ?j#2A3EBxpX(nFr6Z5hNib(BO`o(})3NghB;d*W)!)(Hmd7`v
zyXE^vDYNQf!|cijfmXtgFB+LJZIl5cB^y{C7Nk;oj28+RDVRbaRV}C`1z-TSbfb;4
z){ZnjJj2kjc9fzz0Ca1Gab5>wC#b|Z?8ik9`-z(7MPM`fl_o%od);b5-lhl*_gsq~
zf@fcUDfRBjsAT)W-mKlSpzwrPZpm=ND$tb3>vhXSNsxd<_47f3O_>)fz&<<OEvNYE
zY@TA9eAjn}C_{{BZTP<H1Kn16r*9gT2WqX6(KH_H<OE-Z2aqu3D186DzcqQgV{3rn
zgr6q&*I1^h1j8tE4J@fTGpiXh*D)AYhb!ufdyTQ|SUfwSseYBrQtBa0DN(bwmAzNt
zc_HA{)kCf>-|{y$7|Qczpig)dp-{3O$7<z_E5yD}Kb&YM;JT2!GrrMJ+l}kRO*7Sf
zDJoBiO=+UVYsCnE44I!I4f~OkCo9qWvGTY0ZDhLFlAR8AYbf2VcUF!+@TE|nZ{o1C
z)%HBzodWI$8b_Z2z~fm$NuOodBB!Gx_bFG_m}7P^CwmVa5<Aa(MHhiM4jSCi@8VmG
zV2M&%DCE>Z6<s2%ss36amD!WAb-AV!GqrMj{>Qt1_Kauac&-{`g1QeGr1NpzlY_?&
zai6WYXP>y7r;sv$zmgiL6+nNEavbGkd?BzZ8iiOgpY>J>QcUch<$Aon9xu{;alWkG
zXxHmP7wxRw2z)#KkuNq9SYkUuV6f5do{SK&T-N@WTpzT1Zz0B?*?I@SgQ5|U``5xZ
z1vj%P4fLWlXmDhtV|+O<2Q_{Iu9yh;@Po)(Ui2mQ#E|g1H1f+n)ZG(dPop@q_V;s9
z#OU$<MkH(iG>L1vX29U)ih}k)_p_||Ecj|!uLCCdNBu$i?B99l0|Rl5$_E?}>nNf}
z9aNN1HhxXgnEu?~!1j$#^0`mc3l!o@+eIa5SJ`K|FP}bfmN~`B-b|hCtI{QP(0E+0
zz>c{?KJ1iX*yA1TXy3G}tdgHk%KGVY+pnO|sqqRhL0nFXSR@ckvuBKmDwA9bL!^$H
zQe||JLvH%9IA}j=&^OB2Pj(`vYtSWL|C~>=4$n`qT!bH2u)oJxM|k-TLWKX0JPV&N
zJ&=!J?rp1Pt<&^zc>jUpOPP;-4hYU=Z<N4xq{&9YKFEnvXu^@UufMuV61EuQDmk;6
zm-+sdtaJJt-@H`fUMv0Y{Du`_2?f?%FWll>W;XQ!5o9of{ooct(gOpuV;|63X?d8<
zr#+yCxORw9Cdmkr-T;3IYKB_A5w{Qn#hK8L`6Nb$;(rvvh#e(ac5Enh?1BcS?Ln)-
zMIFL*44KMcw*U*bY}|+{oI_X}es_sA2deo6pM9n&f%Pt8wS_o8LO73EwPLUVEBvte
zIG(z5ZgkV^=ccK)aDQZ_<2VxGWG;Gy+*s`R+L<p{et7g^0!i|<+(Bl^5A8;`XvE*Q
zQpX5U02K2NAW<og`msl_BO|P2R0BG6+vfdyk!_O3m}rFyMfYE%?Xzt9kh*<9SutV$
z@!-BYcw+2e_M{w03zn?uBRVdOW;wHE3^WQ+57&z4r*sN4f4AU`IWrSIt(^a(DHmZ5
z=8!7Y&{>eBIET?|Bi2(Ky9eWaq61@>(a7CzP<pv(@N3Xv%5W<Zhnu`p+(J7`k6?(>
z9N=aCMs!qCNPnc_r^CdZ_hLD%^92pl!xdz@&whNAWL6^`qQfGrccOG53ozxVFxV_G
zF81%Roqb;J;(R2ZiSH*Tqje4)QhamevKxXKBy8dPrD#vVZ)gQIJ5s=#=P%8JeJO!p
z`GXl*uNFYbeSOQ<=7lfOWqP`(v+iE7?Dm3#m!Bd|Nw9IKil{}<<mtsIJLE&)<~c4H
zPvm-Eu&6Ye%r!FUL7I@Yvi#}izU$w4+M55oG(JXO;&Q?rji$Ry_z_E5FL-7#)RN#6
z%c!+9XFQWY1oQ*S8GUpxw7{MT%_@3Mql#uiw-C;<9<}8c)2PScggPCva<m`i#bWWv
zI^r#}5i4mc)uV^IuLkYrk6Z7_^)0P+-H^a?0#EiBn5*es{jV>vPRE8qV`;wlI?X#n
z)##Gtx>vg67fYq@J7*8oua}GT?8XZ<eV516J)EoOz7%ijkBth$3KPd3xK7}hFbOsX
zyN?mR4i8*R+>^hga!!v!{r!~aPL@hPN;F(YRi-JBT-p*B_h&n^r=uH<C^l(=HmyEs
zMP61n<Be0~_k?Kb&7;Fn99UtW{t4GbrZoQx;I)0>U!EVk1{0+jccu5I?Act!S31M?
zCKJ-m8nv^fZYzBT4_1$H%T@+L`bxAKs0Ls~Q?r%8^Sogn%XkUeo8T}TLEuJT0f^h<
zW5uX%Mbb~sfqIht{s2aaR~<8=B4(jY0}<bA_cLo;H^fr51DWgw4t;ulkCx&rYLC+L
z!>VIlRXn44iIeQZ%HL(BW=C813>WMbawSsTd_^)@lMt<N4ON>a2(zU@cl@o$_K9I{
zJY{)IwW#mO{mms&irv(O(=jl<;|1aNC^4Aw>ctxHb;chiIXsXS=!l}3rH-_nbF&!{
zHU6C9qfo-twi6#x#YUtZq`$<9eFDl6Gaei6Kpv*|C~C>{rw2f1pD#(APh~kL^|94q
z_JI(=OUszP8)k08GQp3=v(bC~mHHNx7CC#x6=r*M6{UE%o~++|D0T9PoB5k<fk*r$
zJN-SzW5Yy|omh$a><L$%!6B(RwfF;%j@@CC7{0WF>3%h6ko|fV{hT05xFHvcV<$K+
z$DsH7qdncptP|((>2uz?R(&YnKHC)&^^>n&o)Nonz`t<J*5c9v5?{Q6TWkgDCz$NP
zXqX?RZwpjFT}N#wxPqBaVTs*BoYM?|&<C*9(2Bz-fD9Hmk&GzcO-7)W8a*Fn&qlzY
zxnP4@l`3ght{;}W@uHcKQ_0&&>RDs|d_J<`xkG!?nLf};+#3SWZ=KW*N2Xf&VDvu(
z_2?HqaCuV{p>$R30soE0cPyQ6d>T(g^x<2$h~AWJ&^fuI$sEdWTDTT%P;dTVk)}K0
z^es|Tv|nBF>Wp>Ze0;%q`OA!@13k#c%t>Iz*b$x0kVxp36*A10f1FMTzaDFNHFi_&
z*~h9~vgD=&F~m(zv>dT2jh^;|GEFk7mw=P0s#Q-WjaYM^p0I&+FR^pBBpvn;rxYS(
zmTn%fYZrb%EydrWClVaxSQ)Ljook~ZBitTdWCiOv{`NN#RaH-!WWKO?MIpk=)Qzv`
zi}RsQce2hH)w;q*jcOp?c^oOw-zmQeR+xOQ7vrK*AKq!T5k^hC^X^RmM=PJ7V=gv~
zIBaDzboRczytP&Po5^_P-7!(}`>(p45)P7H&7}0ftJGc2M2)H)^w%yq{sDQq&tG>b
z{s>vZ^W--6CLBIjc-MXXZFKB)U-K^n(nZ(cEku#`Lx${}&GEu6rRA{EZE`M4oUvgV
zXWs|Boosu2^wDIg)8x&Kf+6C`788E|kKeRWF7q2FNV>F)q#4HN6o8Fos?Kk=<ENTx
zkShro997D<l<{%~BpIniNRQ#*Bd&F$M7s%84aP-?V&8j5R!I-fk@V`*s~;cAEAv-g
z3Zy-K+R=Ww;C|#s_tk)IrV*My{UeayU~lVNxTpU8JNS{-l`h4{a-MwH=B_tvY?_rb
zv6_Wwc^|(CR~ip1C9Qw0O}9prrxfNTbsc+?WcA7EK5>|yb<$C9{NAv@Ggf4I)OA{+
zlK&Qh%I|MP4`Hy*fAEo;;0j#U+UsvoTKmlg{>oY3ef}GN<fVj@-NROS{@M5LG?e4M
zWlImqp6?bpeeq+=T;KHeID>s*F=uQae+JaMF%N|W5o1+yK4MqlC#0TwE#^**v+m>S
zi+6j8O<9&KDtvF6N63pl?TclIP=R(2bOf@5uuw?ypxhwwS1)pnCp;GWR8DRSuljl?
zJlVMFdiwYKq}|_E#I*B+n=k20t`i9os9)@%D=feI^w|w3G6MhPjztSmw0o3{hWH?2
zM??AMd}zNxOr36*Lq3yYi`^Mxw?r0)5s#S<q9%*ZcZH<ba1<Ik%$0hOcERWo*X;yH
zy)tE_lN8(61Z51<?)&n|fzR376>y14Yg>q@HA92?Dz1Ki)wEj$KP*GDZ9Sb`-c_?3
zI4Y7A-M<~+cvy6yrkBM=*SL?c>sNY(7QvZ|g@|vAcAYpvPtDcXPcTWYV@UCn(;wGX
zq_5an4Vvj>u?ws>3Uj#lFI?y9Hi9M3V8tRSQt;K3qq+ulneBGm+k_UPy;TcQD(Z&$
zQFxb+O}yhavT!7@cel}BXk5vew>d=mgl{qm-8b^hx_VQ4#j{PhTYrD|;plz$g2YdP
z2I$9hqCN*_4&Vw(n_Sr$T?FPzbuy~f*R9KC$qr*tG#*r<!k5_^ze6f(*D<E3ko`K9
zN1Kt_*RBx<h79}y<gJFPGp6Ft?F^5Qw|G8=U=>e!%CsU^jT*|PxYOUHN9vI>!y98K
z9MzGh`w;oPe5Y#8oV)SlxaOH-Q{LOEYVmcrA@d3Rf*2WRkz6CXkEGPmh>Yl0jUi6f
zINd1IHxInoYa4Usm3iq>-W9))dGvLtMomkY0fGlrdv6JvFG@omN?+EEt74r4{N<Jw
zavu7eXgMHPv@iPor;?cCpN=s90M&5G48z!ob^4>tEd(QZ249bY53$mox<()=yFLJT
ze8qfmX3-ER<tDNpqn-|d;K6GD1d_IwnQ>mFfs4B1D)eLH2=k`G@4(9bq7&!uxb9y#
z+y5+_?VpRWfr-F8y@iMcvHJxwRkubQ$6a}pd7h)f)EtCY&h(}our<O7e0ks}^QIH>
zs?4N#(_cbPql3#6GQQ$CzMJIbnn{dWlWp!n7t2QX*uorBmjH6isrtBgB8NmU%eRg&
z&){N^#g5ge!K!(^0=R1;ZhWw~H_1Rk**p<@tNOB@2WESXS0egT)J)VWI%XYL61LDI
zN8?Fpnw;=yMlv;wE4)?CpyQy1K`tsmY=Hr}uip0ym|xGfA-O)(xJ+u92-w|p72{Sb
zcHf1!CQ4alhrG1i$^A{%<|x2-9tP+m*(@a)>@Ea&7~z53PH@5n<BA-j-@(CS{o%Ud
z_vlh%mft?h-pTbZd%+ws<jHdZYqI<D-sPlmf@24<q6S^$7*!?Vqfnc4@lB?+zkIJ<
z58nRM-t8ab_3zx^<VqBKRaR`big42vabG(ZG9Jt6V>4o4#4)R!bY`FOdQAJy#V(w{
zw^o5m7g^*n-(v@x#v~sxcxl>j3t6nu)R{m;a{pYbEGg|SeSV-vX7a>f&Re}yl+(d)
zZAHAY%{TO`Srhz?fPoXqXe>8OjPz%J=dZIDlVChLTQCH|5x1gCmX4E({Q5fI)CH-q
zNROWUUbP>b?#>t*Em*IP9ZYQnL6`<t!Dx1Lm?_~S#xC;~|H%kPlj!eORtCre_lD!X
znJ;>F)Z#+c6S+rhd{F07?hmKO>nl>dyuDN%9FE58Pd({-1KNq6242j=+<icmmyFWx
z1nz6{fII5Z?8ScgVDG+!5sBWS{wHV3tIViU)&`<K0QrLIP_sCX);zIlI|;bw7(?<M
z0&Bg|5Py>;t`W^6*<SMGJf&Rey~fjs?NSX)B0LTImwB<cL*jb*XWr~Z?0S72p@ulx
z%M?70XZLZeNs=uMr5#KsIwct<Ee3Ue-d-A{w5B(?D~-ha=`0V^2J=4&U+b~B(wi3e
zxo*4YDVA4f5&oQ@B$KU;it;!93XLn0{P|HF8m{awUiVeX1HZ*Hxv-Kg{83A*{LZO6
zE9QBOFE-ohsaRpy58!-@Op}r5aHM_tsnj|5Gqx3e2VO=NA3@zGypcQDWUjO}&BH|Q
zuZM=#DSEK}q>Jfzf4!V2r)0gFbh@_}VKC__!&FTsLZeysW^_SJ=CobE$X)4`Aqp$K
z2<3na+Qc;`$3DW!3o2q|$o7qyZ;=aBYHX3Ex}KTQn%{k8N4E_$#?O4IJ(JWw-d748
zd!GZFpC^3!c%VhIA&UF+6avr~%D5qfQ=Xk>@NxkLP3|Hi8s88^E=PP<BE+UJ^)Q%k
zA;DsiAud03QGDe2E`@kF29tdCF`-4I`q8sw0VWEyKYR{XQVML(@yKQ9wxO7QdDsPv
zL1_MmO7<B|;z-r2?RPgW%<Wy;wsgH|r$_INs%PZ&ke@=MAyo%RP@qiFfZWo(ieyb?
z_TIs_O^R{yI*0Wp{dICq*<aS+V6t(is?m0QfHkSAKBzHtgk4d8=%X9?qbyN|&Pu)U
z#a|luE(@jYtKg9d9NVT1+8~!vcVoLzApBWpHS9=vNKeBaXvy)vO^#Y^@l+(*q<PR^
z+*!DMmc8jVc{xt|TeDmKV#x8VA;M)1b})VR(_^c|;U--YS8(Os_44nZJVahS<;<8n
z{>bs^;+a*6lFQa9@?Tg#1pol&FI9_GJ`7r|8&rlF_h?9@TV5MF?(;UZc0^Uob4tG8
z^?{grLBtB0=nAxnN<A0btc?IYh34oyre0AoTwd~C;~XY@ZB=NAFFT*$i*{8{J8;ia
zX#&LpfXtUD1Vd;Jq*o=w^gC73J`)by9XUQP7=z_^mJ-@6kKbitF;ePX^QAMT2JRPj
z=9V!&az=aGI|0P*Kqev%tP9!)=pV(^Az6rI!L^~DjHdDxEz?Cj(7kVQTL@9U(Vs1-
zwY}PWKS0Hg^xvXc<_ny^Y{tJ%$^97%ixX%s(4m9{v21A8s(;oHi}{aWFDIs)tU2Rq
zd)pwc1HtI+{va1D$OGFk%HxTK4K<KEI_kKDYQH-v;W-EcuN)SZx7|2&_wJV<RiVmf
z>uo$ttH_0hF(abnct=<<jvd=6da@XPK(R^}JeJ9GPN=kit+~P^cs+TOdqvpO!@Bf$
zuCWEniDFbJVRv!Gh9^Md%dgNEYgqJ`WUeQeA3(6Hzp)EMOs%~JD`o&m>7*xN+2<g^
zJ6aNOvr`vb*pMig@*FB$UefAvT0Cfh>ROx{d{s9ckh_R3@*QpJK+J9-n2NcG3g;4B
zylcTWQQm9hvQJm3Ek_SM6*G3`b6XUG8ZZwa=fBdpu}B}Z@h8}7f{PX2)@m5Um@z0T
z?79BQFzL33{yy<TH)B-lrRw>voUX3sVfsGG0eTFCL3<%bb%^LYeaByYoVB>>6K*ko
z<H^ve%x?y+(v@B#&Ub7bm{hoTPHLD>Lo}Y#lqq^bl`7+l;AmY(NQ$!HX!x<^dmE|6
zjP_pHQt^G+&Hk;CPH6(hFZo&)ljv9J$ynA?BvXnfDXfOme+a{w=KLM7^Ce?68|o_8
z51O4d>DqtOt)i3rqd0S%4Nww)xoQypPpF#M;n4zI%xxMQDHbdk{wmpu{KEW*R;r3|
ztmhZyI^X*RRx+oBgyP|oV{3Rv`db<=^|Ze>DdpLC?BH^vR|<1Q#iya{TTkj8KE@iI
zs2aajA+(-BSuK}m)it&G^wwVq_DCH)o#iyb+npol(sH81)o#1V8?o)#sVu_6ZkXcN
zTpi275a}W^5aRp^!G<(!DVn#^U4hN9PXmBjw}(}{4IE_!R1v|FNprrM0rbCJWeDDX
zHkj3)(a8eXPgKU2`JL9aM9DUZn4DSj>;gZ7W|Ijv^RCIq@*g%MXv1UzZ68{jv>Yx8
zM^X>M{id+oMB_%3a(s(>y7l9`+*aN<YS<XUl^CK}H^B&m|CC`TtpiSI_BA_l+NHuO
zvVF*7wT9uKIE;8#kd0oixZ`$?u|umbkIbT9K*f$U9u<lv{DgYa|11d^RCRz;_geow
zOtyiv>%ymta>~y9yDFxO&RB02GA*O=cOD&5ynDp{`l;<V_xJ`$cR=HpXot5DZ=}zF
zlm(YkP@43b>kED$nX*KGN|PY5j(gXD$Rj*u=~GVZ9yN?_0zY{`>D|v)#8yoP->Ay4
zj8X4T^%Duju8Y^k@PlGC<)|o{OZuE(Lsjv+yjMJyZsFz4H|~3@yb`y&vnPg4Ra1H}
zm%&3jR`@Yusi%ghxUc#%xj8AIyj<;Nw)FPq11mdcZFs4+{@cl@MI?xAoq}Cox4k7g
zFXLxRlNuTrTL?|XRtt@mgl2IQt|HZ4EE5stZnDAJNEPq`rUYlY)flSglX^9l^V1Up
zGOGTOWMKqd<!C|AB8^aTAusU5<3}b+L>0tB>*^8wLHaWYgM@(q7II1D9o076<az5`
zrc#F4b1td3f?RY~?+Bhl**8buJ!3qxvnt0T`R5h_O$vKRGoONLjZ?4ABkhN$0}6=J
zv2s|I+pD}KOGJg3kD|}oK_>Vc7<h*|W{-f<9CBr-Xp0(=R6wW*V8hOwewRR?Wt2y`
z?7g$s=<Sb>a$IGVPkpi*5&SODOZ&pYB$@IYFAGw79C5_clOW|+U`<4NqK>8opOJaP
zZ&t3hH+y8557HF9{=VQ)vNnDG=*+!yRgImMTw{3lZ~ETjIIh{vGb?#b@$KEx-Z$I5
z5~451J>Jdf$-}f#T5U8?LGhx$6pNS{9}P(jaA84O^q#o?UR8rz(mlM?`>L4|Y8ap8
z1Q`4n7yS2bA&xqLuxLRh*ecq68HL$@4MzQ7-faKnqI}UhO5=k~$)%^X1mWCqKP30S
z^#y)oW*Ld{B86iTAp~OdQ)+)TQ5X2_-V}ebeM}h@>2F@yRe5|pU;mwtX+4Ll;`dT#
zCS3CqyM=%kyDr$+p8WE4Gwv+nep3S!32|Xr;lryFat$I@)O~e*TpS+P?(h3{+xeTW
zz{=ue{OPiR-8_@;tG^R=qsHE#e)%Y5!UfpWl|*PfZS|xMD^uM26QM|@LWjGR4yJ=>
zb7`y>sysQl(|maZpXxMn@I!zc`a@}NPP&vO`}26G=kJ>(gn3VjiN$cbkCNVD_d%V{
zQlYUDVA4l-vPRL6^b&%DTrBpu=r-7J@>Je@o2zVR38SM|mf*2lrG%R7ls4%$>1AYV
ziWx2T4l3dzrq$sJTpFLeGnhbeJ9pnYfj$tqVB93EqVVkQ%~ciN65HCn@v3vW6+fz&
z01XfxRphTa-llTCLdvwgs4$dGSy{d!?UI|DyaHMSP6R#*?F!WvR-as4Bf1bmHMm}*
zEr_~&tM9+v@_leZuLt`>mvXOETyoifwWBpu9N`Zr+9~1iE2<Edm{dg|ms2giGPc8v
zZl&%e{x4-E-N%9&t!2(1-=$Z;5{>oPmz_6}fhmVqfzhQ-f3Z*{FfZs@i{7I@i4(w-
z#1A_AdPYARIQ)H<!@V+B(Ks;c3)`s|LaBIF<lD`Xxb%6VKk;IjJxiLM8zP?ld7slu
z=EwVmc{QR|q$5c)K&w2g;_79|9hckw!&ibN9vLa3Oe9*TWcnLtdpsEl)B=IIAa@!!
z*$DVY=(-UB@~7<CO-in2JKo#*@R@{0QmmAuX;9w5Gb7JGm)UCs+n7$E2OKB)7xzwH
zGdHK_U}Z+ou&ff>=mk<{*mI&qK(zhgp+yrO?d3ut!o7AjbqC(fU@*1JYhxdbvT3pW
zI9*3zqe<J1SI8qC59v~8Kd&jYQ!`$Kt*3iw{hTW@*8cx9_v+tTG5ibb`JaXL{GQ+A
zpN<Rty@xZeurk;|{?*~aaaXGF0t7<a{f;0_5Mc68G{YEmo4A#Tj~)L>ax{W&@DDIZ
z<_(ak@Sg<V8J561DnPDyD-$TP&ZC=Z-wE#xQ49@P!hAgR<4~Y%*I6Ef`Q$o{uaIHr
zQH!IfT0pZEm+%9EG%UDzAJmfPW6EffmZPiO;$fOclJubsc>*UipbHW_yG!xiNwhw2
zo&ktNK7%ogTD4NfvrpKkolJj^+!p<X|5x_T#bl7ZbNDLA-f1$%&r<$_v|MduSK?pA
zF8ee3ll~^c`FBa@c>g9H^(WoYe8p}ocEdoagZ@ktq!wKC0ChsI{@z%@an^^}-qDrY
z5I<qTs2^nfj%s2L0yAe1YAVhD5(uhZ31h^@6I@ZZTsM?ak)ssJ`7OkzYYJfx5PLXs
z#klGSG$2*Ch0tvQ@AK+EVHElIOeDzvCcfUkH(&pC{J%%3{WmF`%E(FACR8Y{us?8#
zafoK})%-&DVoY-<=Q_XX2Z;lv;U41A!4Iktd^fV#xjt)(G1&Pjqmi3jLB)8`#*!;c
zsWtnm$=u3X23+#V^XeVO7nfQdshX0UsGZaT(J^GHqInCh*nIH;X_;cyxkl;F&C@tN
zksA=@d+vel>a~%R2fg=&u1s*~EKAitd1!v%!OG}D2(VHP_CZcijAd9gAsoeJ^q@GT
zq%3Jb=*7)v4n;NbL?8Rm!{&RJT)qW#?^@Z3pn6aCFP<PdQZS?$nmC$I;}l<#y_s^!
z2?m8h!jo$5WO{hicsw*Y_uaS+%LhMU>?$UgPU<${xBFO)TS^AfL_G1ceYt$id3d~S
z(zKYZhj>JD#OJ1U_alvZ$7q7|*JRX!6;;b;a<T|lq!L|;q7x>}OG+MGuY%Ms>J|&x
zy|g+`>|P)eRBsBMmSSy1)*^>c7eDlX&b^k3mH|axT`jrrsX@C-5m$3xOENQ`+!ly>
zm-WXk1gHbhe^$AY4f1JzOVY@Jtr$(}NT5TN27&fKqNX}*f%0Hv(o$b@^_KssuYvRw
z7cr930ozlLH`u1$GF#V@A~%+>QXIn+^S|4CyCZRBs@hdb*|z9}nS<&;Y;pdo?t%-D
z`Y~5x*d*sNu;{pbcEW&6ccGNuEM8*%ntiU`>VX$F0_Q)P=-CeINvU<R&K29ik>(&7
z0W$4R5tE-SDYSlGL$uZjp#--pL^%-Dp<57qq(79w>Qg`+_pa?=8>U?(S3P0=cFT)$
zw&86e_px;q?grr;3!YHVE4zZ1%TuHY^hX3tt_o!UcAU^WZ9$rIQVWgspyS?MO<#29
z_+Z^oCT=bjwLRGPnX1?w@4LsDHik*7lnHvp7Q$s2Y2$O6V&7fl8diSsd8E=b{mTv5
zqT!$v&Z+EU#2LrCTnTYQEVoZIe!WpPT7<5bgQZv(u86*vTo&*@*F*ChchMQQO}M&7
zy)T=JTb5DT>2f_m;_)`#RJYwbKbLeuw;9|tHux+_@*<%dyBEIEU#DE2o~_w!<$Bm+
zuh)AAF9&tqQ!hDERFz2UG~TAh6hYGRf_Dy#xq43x7x7a>t;aAbj?h+GW>9vMS(TWt
z^V#b4vDfr*ZBQQ6h$`NlOtql#7Q=D8;oZf4>Ms<BE!)_f#y^Fa=-hCaY9u$ulug}y
zFaBO~UXb<x%m#Uwt6o%){?c;`!H?Oi`6)9}spaqo^JZ=<V*O*q&;N(L_W*0ETk}Ul
zQBaz6qy?oaAc_<z5>Tp$h=NFwsDOwx5vhhmLAnr%fP#PpMWlq@A#_BfOG{`00i`CO
zA&~Oj<u_;Uo$ovUd(QdKow@&+d5(`hU?6+%?7h~z*89G{!gK4Xwp&yGTO{`4uNCya
z4=Lz>bL5sV{iF--T&9YlTFf)auPAK~h^Y2#X1xPgs&dCjZcNCSoyR5Jk8-w=e8mFE
zB7v9oCsd9i0cMP7h2f%clU%o3HzKn6>nU0Dp>k|BU)EOR;w+BITwC{+jn%qZc7${J
zgCN_CzwSl0?=}co>SZwL&gii+dIlZ8rEljDQ-g-ob<|F48@Wp(e95&<E>%v?xt<?4
zxH|4<i@JfrOY-1_n?Y5txI&OPT}kK}si?0^@bl%DDUCVwTq22`E9z3NxIo_pk0Qzu
zDlelC#Z=h{Z)b23KRJ11bo91wpz@O*__79afA(6N7~?g3RTcl{!7<$~zg`H^lhKk>
zZQC^iRD$cVgEaT|`0orpFK+Up1YaNf=(JFzsiD_mjr+7g!}?8%F2VXb&r}8j4rp3;
z&w5b3gCcQLtiESod$7lz+F#)B4UufN{mJ$hPR?Jmn6P;`#&ztkICXy-K*LH^yTG1D
zJ09>;;d`)O6N2~|&DwBAa+g!OlRMFYVY>7Pw#xDr?8=n<zu*6h!Z7kWau^FF@gNAk
zv7bIHv=hXUvGy6>pkR&_F1JH*7DKHi#=^o!#M|pmFtxrLk@qka7lc6be%Q7{OD)%O
zav6Yy_j5yR+5Tvd@mA}Y@yx}T^~a+<2cyrG7k(~XJ5yi17kX^yo<T3d74(qygW?RK
z=p1=zHm~ggMuc+qT)og`O2WEXk&;}EmY$>7jk}tVa|aLFMd>+dNkL!z2C3Xw<CkBp
zCc>;KwR<CV&z^ok9xb(3`wepI%(mr1q}#qjxJFYJ`FAE(JE=tYTp&$ggFHG|%s52h
zXvYb+V)mFTCE9=T<ZT)nlqgoFQM?!L#&0%c4hAw8d~}88O^aj_;A?qQ-5`&4q$+VW
zBpnE9d3e1ydpD({+TqKO7)-ZRDvh*p<vcESu(?kW-yk+S!$CVuY|5O)>~Sx37nMvp
z5H>UfG4wUwcj}<brkPAK`0J++?T3T)!OIdqLzbd+dCkIbM;Sd`xRXaOL=?SBP{hl7
zs#OKvZS#>zGCgYe0q+p@SWtfV08tZY5=Lip3?M=YG4@{4?ExCN_&0THetW)nC_PB0
zICyX-bREX#0Gb=-iLOo&!kpqh%cW4bOOCh^>K7ut^W6E1ON7^JPq#&|D-FOI-(3zl
zj={qxOqy{^ZSaY50_IV}`FNqC+;3N`rrLL=IM+l1qn8?7W03+(KLmg6VE-N5FT0G<
z%G@9y(?$|ow91X)ie7Eun%deL|5%Y5PrL*Fg~w`nj&_{_w#s{w1`sOw&-M5a8Vw}d
zh~$N}%TCyA3+<ux+a)gMuA8#*3sPaL#Z0W73M}MLu{+8A<PwUV4^_<_Rw?}Cm_r*w
z<jaq5KIbnn$i8Y=l?i8?u1u9@`;S5TG$jg>VVX+V*^-P*+9hIN6b5m)p12*>VCm<b
zhKrzoPMT^=ZGU|zBx#3P-stO7lk0b_&9ZN^eDk3wn5@muVJG-dToi}qY2k{|N{j&B
z(a|U{R4H<L{LG3ZSA&DorH(RK$g{4q*}CBt6cFL}1X0klc$C-_?a~14U})fhy6OS@
zzUhPWob_p1Q=V_fzh3urhx(Wty~p;ws~!FjzL%lwu`3*llnJ`j4<A9O;eUKzKPyzN
zGkO7Xoqam?Zgaxv-Vn`bgwe|&bHhfGO02(FsJz+mo0E=HQ|C%rI6X$PCL^qVf)1Z0
zRT0%<s(1P}6uO4Jg~d&eiq+#A&)>d9bLj90cFWhzwl+Ur&B0pIeaL3|eZ%p@lPZGL
zd3cX-gqj6tZ-A95&5342fji674hJ|%m5dZ`*m3%Hy>pinNptJl-+f<7(jJ=Ww|TtK
z<fqR6abDbilD72U$i4rWF8#-+OaCdU5=$>gkEAHBB(M9{lvF~GC9g`9Pl{EEL&bE-
zlrcNklZVaWThgv#Ecae;qE5prJv{)zcmD(d&3ZVd=zb%-O&jr$oAW@SW;F|gStc>m
z2xVSL8)EdMh2uerU#cfJT4{SJ!z3DEy;4KG(kWJO6%CtWa=;5P(b<B~1axcT+0I=!
z0CL>Eq8gOhnwHYxUNEV^hjTcktkQRZ`Mr{X=jtT&+=eGZ7i>~=8cxf1<=~<7mTS?8
zADcuS@OUmsGhv@h*{`wIzd;%WGo*aSKUa<;$7U+!8mSj3MX;N&3FZa=0?;EWjcU)J
zm!~*;+|1)|Eq`Z#hOR7JvPMt7BPTxEMG-k>(;uVU(2sX{T2XuQc7@`(WwV~{JGP#)
zm_2viZ7HeyRG+{NlTQFMUplt6hw6>`WK#j7a#GIj*xUY~!h3SoTJpz@KvcUhT%3KM
z_v(rs-xgk)ch%g)tE)=jD=4HK{7WH)?JLjUV`%y2{32Yd=K#X>lJhS%h;coPBE3X=
zz6v8l!9MS)HPdeTzaH+{HH19H#)~9rnGl#QSq2xue_!mV3_RbL=AI_SzZu3PRU<}5
zWLA;j{a6~G@en*3TLo+9iLFkem3$A0U-#Yi_BS7o1+<lHFC>{UWdD_Mke<a*pu~<;
z^}h=OR+wNR9yTp}>q^(hbofxDjf-acqng+$BP7c%(aPeucN2PO*6qN1N>&B}9`~1&
zx+oK0m`0)@%t0@ChEcd%D&e3#1H{p1z;Q(HpXTm29HZTER=wtk?-cSnYh52-R1_G(
zAX}^p@a(uB+7rh=4+Dj?usU>W{{&J+aAiQf=`CqLsnXv>#I=;Y)ZQgTyWo5twQT=R
z_O>+%N)v>WAC&?=mq*b_@;!=MkX&8HwSlVg0By*rLksX!+l{jvCrj;QtT9t!Iyx5G
zeO!920#%ij@i$`?z8p3Y<pTBq4_`tc;!OJDdF__bNFIt6Ac)UF(Ul56ve*nC<<-`t
zytHbzVMz<TDR{v3dGy77Qnp(o1PnXvJXi`U7(<t6XGw;ddJ>cqv)_?D`<M23ZL?98
zWL)hxzus6%bTNDzeCXztA$lG|`3{PB5sGW-BD)duVy+XHS}|->=f-v)SMzpoZrq-}
zHnM&#?4yB?+@Pv~GWO85D#kcMcLaN@{}GJ)em`@NPW$fO2m*%3VfBe#-kq0BTe@W*
zhq(Hdj;&9Y^I1S1_(bVyy$U+pwi_6MIN>amnd>e@!r|;&>zyOnffE8+A0k)@7iWCJ
zR%u3{Jh=SkWYfdd+zTr(EN}z&J+zd4!j}>V#mpCy9$ywseW)=iL+HF~fGK_dE1>_E
zFQ_`*@F(UFY^vLX^|YpgLb?&oK6#l!BU2}}?cQB|X!(hqHEh;rV$&Pn5fU1NS(7cc
zB;-uY%%P);96Wd3B7PP;>!+*5e!2qx0%YO%z>_t_nFHcr7vK?G*@UG@s8}`j>8<tU
zKj4Ma{CY8C*nh{+-bn&g?%N{`2Z`G)P|>C%l=&-_gZJ_BgR|M|>qfB(hvU6pEIb2k
zZtaKKr4Wdv;N<jjwluhw0>*%bwo{6i|2t$KoO6S9?6P^C(5QEpJ{zlU!R810w;Q(t
z6lG$cGX3bH@xf<{-w?~m@VJhUA6!29h%*gd*Q`1ZdY)0b@?0|E!|)NtY8dw7hsvz1
zcUf+Gb8hT+u*Y?l8VTItm5$##Vq?{O5dz3h`4g!E^@$(e$Yeu6Y3G?GMP`PUBOHTT
z<thX@(6vUCWhJc+gk?E@F*$nm&wL?Q#n3k^hgoudKAt=)g<sjshZ(@X*!*6C{?7n6
z{9Z+eXUtS>gy{)0`eCI$oq)d773E2T!Jfp1R^a7E>*~I&&xIMwB;PHNE_>N3)z@)Q
zi+%*t?L$%OtJO=V%6|{Jul%Sm=yfa3U`5p7+9c|muQJ3hhiGCMh4aLgrN^oGQxz~?
zy3WPZ4!xY;WMbz&DPFyPqOR(!;>mM`>@949J*bw8N)7zPe)0oKAOO`14a}7`k&v})
z<N#oMC&zxU{6%udVqJz*VSBnxxBT8lMe=0|i5NvT15Y&oahep>e(lOBNiyE5zN$1P
z72_}V+^1OFh}Ev=!2UN{tx_!k%(WZi<ph;>81C}?>7}(D>e;KA2KU~n?76+UkUaF+
z+q%Z)x}Kr&4UPl4U4c2bKf63cKBuu!T-jQ3!u2>PcAR0(gsfwueRjgRDX)374OTaW
zZv4b3&`V$*&^^d*6sH_1vhET94t!y0dHvm>RCaAZ!a=-{*F_C8e&EfLE8BFF49$Sp
z-->4PnBmiP_9b5vYpc39?T8hNHLPWSm{dDSutLQ|v!uZLZCBS`gU)D+0oGl@hnz~!
z^RMU9X=aGlUR9goUMDNeKkY<(R7#a`m1DPgoX+)VNyk~lZ9mg0sziA8(Y$4R4zCNn
z26acq1K;bkLcMHQT6<pXdG}t$@6x(5ypY$UdXJCRFbQfhe%SV+L{N9oplZa56kXBN
z`hu{`oj!)Xv*Ga$2ghf|b*K7rRqz&^m|Tnac<F#E`cv+h1<=;GT}^-0#1Z5%FZ(V@
zE`ld|h%nS=XSi`7Y|#PfVskMt_(2^f3pxZsUj9{f{NKSB{2n4RNl}k=PtF7W+MVqE
zq_ixdqE{<dHavnoj_b(A8bn?WV?W)-y#K`k1IQSlj?;wB@$9FaqTC=l&sIPBu@VY3
zuFSEj4eOg=HetQu+s29T?>RV`rln+{WG0jIjSri#K~akM(sY=f4}84^zfO49?a61O
zVo>iL+m{$SF%}SHH%*eB(<DK8LpGt<5%cEIQOXG5cwTobK2Wv@=WU2hU`@@HU_Wef
zH+U!Yxx>-VJRs3sQ+bVJi~wPOSQK=x?y+oS46$kmH}4qqCHSIp!;Dw9ZUW?}*BU)H
z6d3AF%v8CpVF}QQytW=<Kj9_19VJ+4ozP`ASj2`C?OtFyl(xX{EAnaQE`8_10OZWo
z+l=O%vd9AJX^QYA5~h9P!dueiIaVxA^yegI$()<4s*K6(Tjcz_b)1kZpJshlABq~A
zjq3VEtX^{?@t;duxkTAfY4^yqQEhQ9s$6K0?IN~|dOUmMJica?oy%?VU3iU+>W7d7
zAUXw#B>~><aqavyO7ST-^Oc}k53y5nH5v@po^I7s)~>fgqsOhXEd|N;+NN<bo(Dyk
z*|k_DAB#d5zCg&PAAiz`{+uCWKs}7`B}V2D@R#$sj+w7`TwPP~^5;Xm$L+ipJC<yW
zYYN^8OQcSnK!01tKHZ=wSX5SbKq(4uyCRUHSX^aheG!joV6_gK{LJ*V^l28Or^bx$
zXL!z{mpdQ+vijAPCcguXPG?FZ0RJMfV1u`_LgHbtgTX8-HWx(?D}?<(q*8<b5h)c2
z<H;{{<^P*N_@7_@rz*d~|Agf9-=7RF<d9|P72YW4YknQtz1YW>JEGc0$)gLBl!;*2
zt-#QU1HJVDG-no(4Snc%uOMv)z@RrPVY||xpF6vQ-Pwz#Ag=&iso@<c?H8s^YJly>
zK_iqNibyN6WJG^~QS^Km25%V9)O<if5{&|`T)n?RJ_7pfUfa1SAe<t-hV9@<m_AB*
z<wiPEA;I5aAK#a!p5fm4;Qd0Qv+QRNmF$?xsmU<gh(qV9R1tB1btKduuje7`2FwjM
z;RoXBYAr#Nh;8jvYLlI~()7jqss$?K+wmf`8Ykhb_p$G5WfWvme*7cXx?4asL$Fe2
zNGX?wmMFHQwu=-iXLm0d%`2nYLG_xKPP)2o8THn8S|e%>{``pf+z1C^l!ZazHg#i_
z8)&~}`>Y@F>K!9}4~H$)3h(vHp!3si$%DG)*lD0?^$8?!-{Q{#dsPs6zly>LJN7wr
z-uEaXVul8Ag0EoZ+p9@bLxd>lT~t93hMY1&3nqBU-ZHzdGj;rfV?i^?@ZF*VKIVYo
zY8iy7uepIGgU*6k>i_#U>g6ZJ9e|dKTDXJyVGL@+EnBEfF6bW~+)JJ}zZb;+mgHQ)
z=1Fop*u2Cn&s3q>vV;k0Fz&7>x5_c)N`-e(RvtTYNm4acSA|r{&-P?K2@`qo<oc4d
zIT<9!Vb5n6-81ZC1SJ%AN_&_NHFNm>?yGXoNv}P+n6jSjfS*(SFW(}=%Paer%VHS-
z4f2PZV?u)|f@Z~Qbsh#!CNR8ok7k4`{6n8Sut_RN^E@Sf7RHCr8-1Q)Nz%&<emkj#
z3cb-7@#<dfx?tbw6_PEX3&@(b)j2h!!v&DClO7@Bm!iC27Nt}UN7lX>)nK_yw@d6-
zyIXV|`7`GJ&c)qk+4gIO@z4$u>s##uAL&8AAGjUDogxy88=VSx&7GTk@AK+CyYaMJ
zvd@yu-XV;MqnLRZBq*g-bZ-Si{7Yq{_VTBh%ds$R^CRAeZ;#%$=&pUET*I~Uaante
zp!uge@k<5u4^I^WbU~s-euIp70u^E(;Dcq2YI}lOu0kzT15>M`Z~p!`%*`p;UbTg;
zy1k?nm`JMp!oykePvS4QGWr?)n?_~Ytax%<{KWKydndlb@7r!I{ry7@xc)=&q&Mep
zu?gTE*tH1i1q-S@!ai;;t1HU3jY~4qCoeR~JAU@?)YnkPjabR1TPLcY_%C8B;{QX@
zJPb#eOAh6z8oX?&#p2{F6``gltL@)A)rB`MC4;$r=V?#%C#v{3{)Jm`zmwv39}3bF
z_QME3Y4#ub4f1IjLf?6fWx^76N<eHB^r0z$@TmA6JgLPt5K(Qg#Me+-@k^eWjIYRl
zV7wBC8PH4~IxoN)wML^h>p*1w<JrC;#ZfJMG@Z9A-Tow#xoe%(uR0V0hJWCpC6&$R
z*S6%7-K+eiBA&e9uWZo*5*-j4jOf<7vCn;)m4eDOc=b*D{7pp<2Y+0&cCuN|$<l7O
zn|9CAZkowqx&DFA0GyS!sRE3F88KaxIWsSqdltM+k8dm&rD9M$6cfo2c#*5#T=2(U
zYu&G^4-H!OHYxt;Mu0`+-+sJ@8i<o%w{J&M3HynM2?W8&kLm{1<4<qnr|oX5`1o>M
z54&XgQ{DBWjJTwM^jl;OqZhkJPZc47z7{vv->I_^r}#e3%9T8I+A|)Vw764q!&k@j
z*7Wmkk#X&>^P4$;JlkL0%zyOJ{jWNTq5Ht(=#64T7oZ4+u$^l_WuXeaW&~SHB^h_k
zMdUrsCAQuU5fF8$>Iv{?Dif<+*uq({iV0K>z1vUJ-)Zt>9Up4y`Z@ULCZs=&7^KMH
zu;F>EEB2CNN|W%wu9|Z=Ky?^=Owdg7?KEX7vKb%f)u-w^ELZpE(RdSvyp3u8^Q&Mz
z`orjC*<NfqN3TG+*28g2v*Q#OTt7{Ed(=L@Dc?0{fc}avh|e^(Tf{}y{zz8PjWB~H
z5m-9d42+|`#a1%}z%rNm1=Y571BC6PGZZTxhV4bRMr1#nXbOFd<*dZR1ZmgD7AQ%<
zd8rQ^*s7><>HLbq^i^Xsr@LZ_g*^wmXT)w{;nE4GoUgvV82#|*hbIs=2t=C+{s{KB
zPqGYKOQD{;13I8lt<idd?hJL*9{Vg~4t)2ep0(C>1zvJ9X@^XKpGZEx4pZgULH7WQ
z6EyuwKdlM~11x}i_zzcY^~Wcu&-;gXN>8O{HSw4b*=DOFkUT~oP+lsLUKu=9JJ4HO
zJ)btyH>-Qf({+7(ijZK-^f!+S#j4rPg7B^Z-920c=sN%^x8M)f=zn`ZnW$UvZgd!I
zL1_#|w*Kiu*XoCZ5Bi7W+J4QBqZ*=|k)!t*U(8<yPrJny)6T1<_*X;k)Fm&if=2Qt
zdTOQ`mD+c*!VT2p%Ld{78{oV?yN5x!JObeAe?RX8_FF85Az<?BIWp0itp1T-vR#y4
z1Dih9@6akXG(wBSW=4t)vb{J|L3%r-G<s`It{U_WpELIejTxt%4^M1Puob6){EMeI
zlM(#^EUSj7ooisN|HGv~km1Nra3T<X4TqKeq>y5JG@mrw|1`T|AA591(v64gaM$jJ
z(kVBk&Fe`Gih>xd;tu^+JOS5XXoDiYhS7liJ2X?1&TI24Tml`1x`!|WlqZ}bKLdg<
zp2cn$;ZQ_LxkQ|aR*M5H$Y8JJBWvgNoImM~OV~_=Yc055IJJ$*Rzp$bLB^a!fb$s4
zLOGBlb*Y$0<yRWSmnF~TBE_%En5=nz`*7-F*~2#x%^0S?cL{nF`cu^Giy3y%kcS<B
zMh9v~jK$LeT3VNJVbMdApV(82X7`YFA13x~NY5sUFypaj3jTo)_VVaI^6_ti73=RJ
zGi~&apjuoPDCxj3YlfSrRd6^ew&DR@ehrTA^pRd0-C)aHpg+=FovHU;=sS@#3I^?;
z0H8oDR{LK;T>rpV*gs9J{%7Q<DvpC{X#U&P3~|z)7xoG1AMiaMfnM5Cu@8a=a+5yh
zMcQ7nc{CdyyEDcRDIlAI72+%bO%pNze4?@8FBjQ9!-yU5G7~x<loK^u#>0?9Q*HtZ
z7bAuz5=OLR`whYmx3toS9tV+65ZMj=VTw2bQjCu<N(PJ&i*-To%IJX|aEl9+W)XTC
zkg&lt=d_{9pau^SyBHi&zd`111KW$E^kmq#M2a(L-6f((>OX!0Vki&ogzah)h#XOE
zP>NFcZ;%*Z3Hx8@5)J(Qd|bVh7be3Lq>PhIyqRA=Ne+FOJ5}jyR_%iHMTAf|fNimQ
z)zD3%ZJQ;}cRlH}8-83PMUSm4yu{(1g)a}-)m&b+yvTJ2!A{RYx%xymiPomH!#EIH
z4={Fpoty3z6el~{+%?ym)|->z>$%&QBb20hMYLp4*F};*?SW5J<pB`j_qFmAYw3L*
z9c$^AfI=vX{g<-H-?!o4#+<8D4?#6)OeHh=CLy$QXi?29?KQ@CDwe!qvc2;C6}1t$
z*IfGQeQXFQfl(iPpjP}W*DL<3r=f=W^ON1Zf1p|QMfk_VX;^O<n;zI!{OJMyFWwRo
z3)zYKtLHcPSEIq>`?3PdBJ|IL%;c{I119hNOP*(_KMykKpN4BwHV}6F|Kkeb7mj{V
zFch&7fdnuEwSiw&u7XQBd<=es2Bqs&3n3>~PokWpk?L`;I?2JQYtcBJ9WDBiZ9B|#
zUhj#=z_*t?DJa5YASyJoE0e(n{Ez|COvLh6Li5_}C9qTmZQI>X;3jJR`Bm5---Rgz
z_vL@op(tbXJS{#GW37^^SmI1u4&=M&wY&+Vw09+EAJ=o@al!|w1<g8l1N~t~=YR6d
z!JZV+*k;$xw%?oW<@2mQOY_6>Vup2du6t}Emlx;Aiw-@toaKFMG6|Du0a`ahyVZA4
z(K}mjE{L4FFqDSrR&Ltfffi6)+m<WM<`oq?wN*4mvG-{GB@IwOitAt;Blcy@DeDl9
zg@2uHFRH+ME3`$O@$0_A3VnMYOKe4zZqWHGSO7KLgfe!BszljXt=>j5VN<pPgKNvX
zzaK?UgQyp5JPVu9tK8-a&EZ<&kO+@J*28SDJG&?6PUXl3ae5MegSh#BBmV|bu||L@
z3#U9)5@f3~12CchDjxc$vy58X)**H_eQ3vXRv&<XnW7IG{Z<Sx3->XA>$aI14{Z;0
z9&QKXv>b@j|Mo?bKfOo&XDXn7{+~UP^-cOitn=++1}<mc4`->H<1R^Wx<P&3bK%6=
zll@d?FbUuckq6|nU}~5U`e{sP8kilClJrDS(@UcG{Ra7E^t68$ROJ8pi@)C<#UX|$
zjfJ8@ytfI46u~WAt)F9Z*{aZ1^{PXm^3g*|9~MF$njLNo_{Vz~zj_+~^o02zu}A!y
zy_jN^IkpI&1`mP<hI4!wH39d+m3=<E6%#F9#?*MC{^5lX7w3#Mg+gBe=_@bt`)?KQ
zx^HT<-IO=Zy)!(eQ(T9+#?z+)a81l6Z9Lp~Kt02wa898^4#B8fo4$<_+umF7cb}al
zc1NQCvUe46mY6Fk&zPaIWy!=Wgr@g)rQ!YRdoN(mZL8qw8D`T!(d5Qe)DOd-1IS*~
z<~dK)%G?rAwiKmh=WxtA`7251Q7buc8=>0MORMTZnB#T=zOi{5;%g5~yh7|}9xXEt
z45~C}5(>E3tgwvXwAK>`YBp)Fzct9&`fUocXe}KqPL5Ul`9bXsyMl@9E6T#1p?u9t
z4nUL}rT;os@$7K`!TFoF>u>y=r9)2zab!df#40zuNl|g8vvcidCxdiEQRgP2<68q$
z!qRAy5G9|uXc?(@sCvK!D;iT%X`XZ3Xu;X9&Z~2gvFMlmb2lHJlT#T;dwN=j(P9PE
z<5o5Su5R<Z+TEef_Y6{H(agKC>RBX)Q1u`-P41Mi%2e)DVPjxr-&h;0ToUtc@_V-I
zFv2?Vn*PmNH2pwU;qhkZ48UW5v7LBxN~~_X<JLFq=H8OuAebQR4<>tm^3E}{$QFY_
zHLqTe<(b6^;`7A^v0c`d{EC}X%6zm$D<i?xY?1%RK||m#ko^DfuS~!F(^}%+JM{iL
zy^m$l@^8*`Fx~HL?8t|p=n-IBKgd63Kvf6S-Xo=8$j0T+MLcFfLfLHs+uh!M^TU2-
z^L!hl3Hf9jFxZ+Xv~PcI#sBaAUvX=T3{s@zs60TLRiQ&qBOi?|&8%GmpaFhR7Avua
z?dpY4;Jm1>SLs%}Y>}u<H8{a-T3dzos1UX?twM)f$+~s>k2CBGk`*EAli>8qNZ?AO
z!Cw%izvHU@lfGyBZRDS3Zhs?E|96@$f9qQRt52nk-=|W{uc-w6HI>3_{~J!Fe~NDW
zts(f|>}RxJ#mkKExGl!u%wAnV;#kMD)L`XCjBuP=zQe@wwy(Vs*Xg3S6-oHQuv6%h
zLJANabBzlC^0#DVVZ<IA_d)^Uk{q<Ho8kW#%?G#=B9vaxAVK8mLU958zl>|swV(y`
zCEc>Dy6pD0zUb9gTW|SP37VfFKig3E2iU&+u!5&TD^%9fNzNTWzHg462y=GuFwYS+
zcJy$PYA{fLmn?no*-=3kWp?S$fwoK^W2|y@A;^M3cx+Ck{6nk{bfTK@1S(A9CsD7G
zrr)>)vT7$}-*>Q*oapOFV`uJrYeOzL<aE~iV<*ol+rzGys7EwyU3Z0?cIgWMMW1xh
z81vvOCc8y=|I6;0*}K~NA<N%DuGdV0Ml`_YRs@C-W-jUE!H=@mh*?vni<7()(X=~W
zY;C)mk!oLu)WmGc%j2J?sr4~ACkM-HdfbZbxRFn_^!QX;)mT}bU*BOvM)o}4-0=90
zvIvV+D0;&DyLp;o8`k|GL%oIQ&>m0K#>@7%Ynt+(<5MqtebQ1S?Tq)w$E%O)0U#XG
z0eKKFI1eiysqPemhwBN)&HuzX(eyRecPpZ+zP)yr4K!`8VCI?Xv{DUc^S);$v$Guu
zyR*R-geAWr$*)$v{2mx+kBv|pd=FnfH<+o=zkZTudZt0_@#QYAr14pn<&dL|Q&U9|
zg=1r7g+k<SLuS&6@1w(&K3hT{s%DrBn5z#C-3G0U3a`XU1Zf&I4c#x2wn;x{rh;gg
ztgz}jl6?G$>9sNpSJ=s)&1}Oze)m|tIH{kmv57aeyJF)aEAj@?#v18(Ae3E8fJt4D
z;!owf8Wav7HDQkt&O<-YLMyx2M|$EWq0SyY`FF+wza7gaD5pC1OZ#vvOnND&Y=$Qr
zdu$8+4r2TTWc>Y~A}O7~(~iXnZ87%WD5f!`&n3K_>t~{9j6R@#EG{a1qpCPz6#W9<
z0^Q9l$aRd*UF|AD_WsV`{+FFbkarf<2%$XEq_d1FkIX`;F*FAYg)h}tI|OqcZ|>pe
z8fGfd04ahzB`Sox<C-8c?f$|<{CfFG@jWcbW~U)9*#_ZHQy6%ZC}?W(#ED{orlL<<
zoy~d*p%eds($>EB%J9X7hnvz5Bd;%*MrW<baj=gtg)EH$ZO=N!0mjG-H}KwxlWuKN
z970Ncj+cCuH!-Q-IwU7Y%-i618R&dl@^RVVa`puX%<0#7RE#9S+ALWppBSet+v_gD
zuNfVPxRz~nSp8<p-6w2U<VnSgv0c28c~^8(Z|2skqdw2@#1<Gk{>Yu9=DAUL+XMng
zG6#ys=P!OZ4H03^eH}X?Ez}Bz;=k;_5LQ$;!kwPmBm@uQH>SU6g7Sz?1*NSARVqGT
zRZ&q^`*yK4siDYS#>r_*QDe!|%XoJT*B-%I+ALuKQ5Gc3Favqwh?$Cjm_op?viN~Z
z%Y1!@=Uu;U+NOTIuc%T~&oPKUZuy=L@3LYM1w#Tp1AFwK9#DS9Atx~|ma~Qrp4)If
z(VY;Iu`ybBo;9K`(F+NY75qqH>)hpO$FP1w9Y82;n!TaK_K8t7Gvp$T!w4*$9pZZ(
z^Vu?1-v3L~ZSW&MvT#Ro1yx@f(6#lSE$EfEtob5rT^_qHH^TFc`?x?&f}ujoaT-g-
zi{rXuolv4VJO(AoP(^T$HOU}ulhnJSml{VGDu?6SeN7hdxHcg&{0RS{w*i-5%;pI&
z?f$DV=zqjsmF=HmGXL(%!hg9%7SrBq!cd8#37z>g%+R~v|JYvS7RysE!O}$N&Gf)!
zp1PY@&y^iIJ&bV@p+dxVpmFBpx0J3qF)uEE3vWe5s}m}BFEKXfoCPi#i@NK5J<6<j
z{g8Zw+(SK37Y}=c9F<g}>?3S&($pzB`==3Bl$85Q_a9ohQjeZ2H1-u^E|NAoY_h)w
zceVV$89|>HNEqWYu;OK*0{?>fclo5Y&h!~U+G!t;P#{QNeYeifvD=UDbYVbVIMddC
zDepXYsbkK?C&@2HeiZmn6x~|PHzX#z+z8arqaAB<wO)z)4q`rYrMKp58X1TBW-Os*
zi*qWuljbn24m2)`Ymj=pUeD#Kl=iy#%otBX&4f}~h~K%~f^(gk&%Z!ZK3xo+gs{y3
zod}Do2w#7ye9(hVD6e`w{ec51V)0c$x856H+0QL<S+Aq_CYG{yA4pV~KXyUY0&$XP
z+Ytz_Lam)9d9*+!7)Jq2@lufArHuZzCf*_SD}%4oaMQu_iFNI4IQfT%g_eS4pDpYa
z-Z;%qeg^uBZt$>ervsJ;j#cRGrvw_JZL5c@9UDB3C-m*HQ!UXgGYjipTo)@F??p^d
z1CXC#%#0H>!7o@(G}9e3f~C;+j59%z!*=DVH!Lh}Mq9A@d3uUPL1a|l>|>3vPKQ94
zHfG9%SGP$kvw`i<7&4r<AsFCho43q;prEN$Q7QjL&LP0v$u>#mV}iA$y*Q*e@c6|O
z@U&g@>XI)him~4-ka*80rs?>|Eb&T4b-L4`Osgj=8fd|?^KtIlXG)t(Cmq{su2N)4
zTjJ<3G(~<1pkJW~I6b9-e;yTc*(|vDLUllYphA1Puf1b8>t)#X^CZYEhTNXI3>v`r
zh9M9p#Qlt6SS7R*w2~QzN(WSgeztp|v>kQ=PC8AQ9hbbpT8K2<_b6HKVz4xjZRnk)
z0A>LCA&S3A3Mxr?)3r73UcP+1d#?BVvZX{v#W7{V<EQ#DGKH^7RLu^4+k*ftYE~c0
zO;BOyKsb{?1Kntyc6Pqe-oe*jvtJrFku{{Z)#qB9Y<coaXYS^yT}^T}De^hh5*T(g
zpyr{E2c0IzJwzR=uY`HnDKBM6Xso%UrX7LYEKbxqbF$X7OZSQ`jW4IeNn{juGl$(>
z)aa{aFk#}SdFVN**~W&UnMp^?GwpcNxrBZ5Y!dMhBzkNKC;=;yOGxn5wb>c&ppyip
z6H^E?N=$&KTH<n9rpq4QC0-4iuPTR4_-b%=aS|>2bBrh!R2RzSd7m{|0Iq!m=f3}C
z<Ogi8d)WF)d&#sS-aL4*i?=dN@JW<aBQ|t#_SyIzX-*`BUhLU1MiYE6yN`7L_3&A9
zWmWSdE;=_nqE%F6jX06;<CE-T62Sl|AhFSjnK(HIZOxg;X-A2wqY|<;YAF~(mU`ub
zxF4fS7FxxJ+LLh|caF2N-ctMOGMgyyY-OrxFU^Af3UvqUDOwpviNeu9JA)fxIQqO|
z?d;Y1>SLuH9s%Sr%>a^dz1|Q>D#`ji`m?NYOIU*sP0(##FN@$a!LSSy<)>piXZVYi
zJw1P{AiDj@)>$%XR(uO3t6_UYcAobQ1XSsj($kT`nAI`r@gNuh3>10OMPgIBY+s%f
zHEHtvrqi|Agb&H4vzm8LcAbOJ+$j$8KDd+?cvV#U27td~(La5}&EI#BWk+?*{bXq&
zhNYod>pyK{;^ZhyY3u_K37o9w?2%Wblq>W%u$wdZ%PmL&iWf<^9VV;}7jm!K=6Snf
zTh?Hk9=PRb&+hX0q;Y9fyz80c&f?w>Z<sNv<#0tlEp(120a`I#xz~qwqqws0lIHYT
z=|=hx%eT%s&fg$)N3pH0QS*5;!HqfLCyQ3T?`TTHw<;=?x0C`k20QXpcinn37P?+Z
z0uGEOc?yWz>rhoutyPq+U{c$)F@|(d&gG!>ik0ALF1aH~m#nx_Ukje~E^L*vJ#We`
zYix=cRlyYymO4?<0UAUKYEFlyK?%<NUOl!;?@M$#eJ^;{V$g`IliA2y;G_<-NKzQP
zPx>qt54Rph9tKDdQ<NJ(wn@r1ME0~z3q+{*#2m}L`f_HmCs4Isi=%SBBu3Rzt0VL@
z^(L@Q=J^Rc`_9gpw4);Ga2}!o7;%PZb#07HyleLI?A1y3&$0DSjfal=e=2*Duf{}#
zukvDmbA4rCt2yRzUKb7%sVhvFIur1PW}Tvon`-y#fKL3#6pJxC5gi@unj)JjsU~tc
z@+-_0G}jqpy`&A`7xRFK>8h?9c`W*N>P3^nsBAL5LPuF+*;KB++RPlSM+kWR(yQqP
z=ZWycj7&yr26rk|kI_6WM!HhO9$_5+V6NAI@jdC7;D%u4cTZ`@T?I@Q;B3TC3)I#F
zhQHW+KuzXPv=}8~F8CQ@$mDj|t?Li=W-RK5p4%F@$d-YSsG?L7`5F5I-y)dGC^>UH
z&>)X105&>eYu}jsEq?d@*wG=ylZQW+%eYGD>o^`cC9eZk5}ROM*F3~U%ITK~WfC^J
z0?J1_Q=ej<+}C!cF6?7xxkDRk&aGG@qomv#>AMH7bBFAoL*3el%i&grc|(CqS1zRm
zgTI{te{6s4@I-N@>a+O%i9^R*Ym?1%Gxt~|6+m-D7J+6nLy-ss*eOT1+k{C%MLstO
zmdv*g+<84m>S&Pa^6<^?I&#u$zq#2ytxo29s$39cJK_w{mL>z|!stqP%{AJ#kd%0j
zjH-1Hoj$`}^!(a$w`?tarTohAd|C5*`+89@pxx~=aTAWywv54w9MhAbjJ2B63zd{B
zx%h3UvUCQ0Ompw9pIAkI)FbrNP8=V%G0X`GqXiMG<FGe*qJM*kF!+~EY=$suT$eZ$
z+hebmtu=M$+N4@_cFBYpbE~RqVbFkKrjh_<hTWPO*J*Q-Cq+fSOrYA2__O6$Rvw<e
zl+AGHtV$3mI<QmBIPa@DMKIOs+y~jf`d}l`z#(3y!J3jY&!f^RB-hOLWpHt9;mi8X
z=wtbchAvqbPa@ub)NTA^Aky^=*^VmlxW?!QcuE>7kmTGoEmSi`u(;y|H5_efd#l<n
z|D0!C=<rNqHSbOo(m|e;lPQqFVK#@ahfh#j^n@!^xT>Rd^~?J{7h>xxsuDi{fnj9@
zuUt39;cz&TVmn{mjAo~x3EQg+1PP?F$5rgmkh0#4In>Kk$x}J9+uMn&ht)fpS-9DG
ztrvorq257$LGkJ8koa4G3;?ix1j^LClyFA%#dL192bwbb!meYUS;;1*vGv4jvflh;
z(mGR>^SHs5dc>SK)x?YNC8fvese5QApY?b1E9edwD>bd%;(Dkg9iKOz)JjbqiQf6d
zCpPC31?NTr1bK@c@-XEx`4KkLv?S9a=0{}g&W~ZWZdaGYF7a<4#~=8eI9jxI{KnYf
zrfG`rTd@A2+^`AL!W1uJ`q^+NO8T7HJHz@CcZ7j|9+TKc#`3b=Esa?Hqxj>^5`C{v
z_v=gcQ@xQR%2avUK9s15&z_~YpE3NFLtb!Yrp6==GsQ=dC(gWjmY^w-pE{MaX_!-n
z?ufy<@$k}uDO;qR&P2o|^qEEya~zkG0~gFBP3%@}!lZq>;PFiT7jhka3l=rg2r6TL
zufK<Im&!!GuHzgJd)J44*{{hj&hW3LLETldkC!|QUbP6xqX|&SCB*d@qE0(NLLGz~
zVJK1ULP=Rp=KF+#DzYTq-^6^a3F@}-NKcZA=aF?$ZpPQJKpE`)vs4O$i?TJhUbEr*
zA!w$Z6YYCMS%x&;Ro{C{H+gu{B4wEi*=4)rwz_8?{n&|}a*&87qlR^jJpAWRUv4vL
zN8j*1KO_@a7Fv8+r}N-pSC9BtF0RfM4^LqRwf}D>BJg|>KT$DMVyJKTJOKg{^&bMe
zJLTkd(igxUaK*+jj#v3f^cF`1bJZv0`v&CPionjQp35V?1Wj9ttjj&bB}xbN401Ry
z_G(bdRgJU@CR4F<!9KF+>`#&7Oy3lzVeT`y`njezq!nX&JaDn$b%&z;1?+xi-P=^p
zo-wR)*}5Qo{iEyEQfc8Uj;e<XbZ7vi(V~2RW<TvDJq5w>?#}Mpw~<)V;cc6dqQZse
z(lzzBU$i2gjYp=qHa2+U4RAc_Tm3Zth<TFRS~XA;S!q|Uhlep1M+FnnCzRiP$=f=>
zv))Axx;ze1U=b#dk-FBhs0VL531;e3<^$*5Ncd~tx0DyrH#kSPt)eGf%h{h8&#t~Q
zJH)M>yq|%gnNh+qh`sa-e{?ib1{k(%ha<Geago;roM!O&hjz4=%!MiU7WDV$CPD-$
zD^vrT<=}4+4>aWntYzbIwn&|5dN_^ieL-;kmcz6oPRD6kg`ZpUbXDA5LZ|b++%PWW
zr=U0U!p&UwB&3_24wEF)3vo1~TI_(bvQ^WB&wESncRD@Bx5GQ%8jKSrf)9lxDzI!t
z&9+0qKHr>rx`%2I^ne`3_(bA<oxbVbBso+O$8^KvbYb#QJI8agpX@CPB2$z_>rxiE
zEyu9T()2=_8&!TB+rGiuHTxSRE+hPNFAA00a-u9!v8-Tm!f@bBzYM#n7Q~0sKw5Ce
zk7`VlA}!JQW;#Vpy80)oJNT;~>Y9C!jR1I>jjyVmE+@LRn|Jy%`Ax(h$x2ypL#FXD
zuu^CxPrF%z81)G4EF~&0vbq-CW_u6sO?Z>N%pxvBE%=y=z5}5d&>t}b7~pO}^$yXl
zQno?rHm?(8Zuej?&vC`?b^z{0M%koR_IV?n4-Oxq3D;v1S&lwA`h>m(K%i`t^!eW)
z6HDZSaQ2|Mj{Z56cu?I{8ceUEYVc~euSC~#^~u-M&}4OuZ`WIYOmqA70zi4#?PWMO
zgN4ze4R7C&@CeA@PAOi_NO<!g&`-*A2wnmD?wyY}%>}E@D|9dA*^^)t<;KdXr8dB-
z+HL1_8BDp1O>mdqdD=iU97r@_Q%Dy4xuy>d1>+T_$L<aw3}Ad?_I_LOEcMVkREc&N
zalyw(u3R)Y`i9!ZYZ|I|ep{W))fe~1>CTmq-l>R&-N<Zl2S+nLwSj%cW1C;4?|F-B
z45^+{cfwl_DABZpDt$m{Rz@T4Zo1fr*XW4zw9NE{fk#?XFPt+-GZQo91R``zi=gb#
z1>;()WdCtZ<x1_)l?N2($JZLmIu{@Ko5?tH?Atp;fNJew0-!C}ni2IX!WIVAg;B*B
zJ$G^P=$}u`ep=kwJ#o4T?fLE2$LRIThg)?=j}>Z^9R)M7=@8W%VM;GRU60FQrdf<J
zl+8%ats&EI$y{#cUn&Z8<dw^NmG6+}5f9$jX&~@ct?PVyrTkz-OT0sl5V$QsUmyn>
zl(;_fqrTC&Rqg3|vckg1LFVG%b}L-&^@O-b14F15%Y}4uIQ=D(gYi+1J@MKK-&A+#
zhoc%sg@Fdlx|#Q^JG{iVj<1yDvm_<*44`qBFVXYVKdKc;lS8n>y3z!Eyxz*Ckp_5(
zbVKssA&Wsge&Uo)HqZ!o^7c&l_EoN#7x2>UH9P8U<VX$|oM0Q~uj64U@ZHu=uXH}k
zc<6|9$*@ekUKi(;k8$GLWgq1Zx;DqNXxLS&d;<i6srm6H0RWNX`&n-+v}u;Bk#a{k
z43l3r{;vN%-@3>*;nM{lQL~v0&cP-&Mq7q(T;=VKf)$PJX@xHf&8+Rz47ptn)7L8-
zEBa7Q1T%0^^}5Yark$ZDXV2m1Y|(3#it(D}qbi4E#UxZ#`MbH+)&?W2vZt)s46i#N
z`I8O3R%Y0mRFR_~W5mwB#96LlNttu3Fy8xU-f@dSwHW6;9}F1b>XY{jOAo6VIYE{3
zZx$B4@KyxVGwgKGO*sE|ln~aPE93yKKVE%DnYE~AkL3@1{Nt@EGjChpb!W-ce#YnN
zLjz3!aoA!6tj{qxSSKJ2<q&3~G&aAR1qU8&^YP>}DoJn#Rql6UT4<Tj&5!}MH^^zM
z02bH<FvLjc4md|pxFyA7)`xv&-0r)^K!?x!Wj!g6m;>sclg}kok@B6RtHRD4ziuqD
zxr^@X#|M%VfO;qo8qQhS1B-AHAm&76&=-?OwJ<azRG$5FfBDBB3)8CNRL#U?IBOkC
zad*qW<z1)Q!eVuWiE*>2h+@9QmASnQ)fb;V)Bc!v7~k@VX!W&$vu1Yf<9E0bawg+l
zJQc=hMjj@*MKo7bX?y1oytGd|dUosf+Ema6+2(1^Wqs&TWDh7jVAsm2w`j^0M9a3R
zbN#I$IZ@|JDN$X4Rlep+Iww3FJamlU3VqI6S!BpdW{s1_KyU{)_a<P>iR&GQb@)JN
zo}<F;)j2%=9OfROrbgnPj0e|Dlw4n1+uC?s|JV_DBjJL^qi^tXjT|?sGO9&OZAQ2Y
z61#0lESiZe*5t`>sIQSEtE0#dZ_ge4CcrY(0B7tw^p4^KlFQW@o;Y3G0{aOMlpxI{
z#8YoX+eCePJiYtsP42Vj2y<B<9bfQwKyC%O%~h{KftMb@Uriw8oje$O1}|N^!Wdcg
zys`N*x!v(?x$bdAL9<&Cn%<n&n}KdHGoY;J?-QHNPtT;8&7&YeWRSvVTzgt_=i;&K
zbX$8gej##H<VJ0<0PaOS^S3ACo?&kdFi*hd7{(VA*bb}M21%h!(27mPkXok0);ojH
z2igX#SH`N#1g@l=5%4nixPMSu=HY3@A=qqrlSZZ){YArxS^Pl=h@}Pa$Di;`SE|b+
z%}o2x2N&_X;U1oXj*F4u^!Gnz!1flT5zwwfvzFXJuWyaM8%SwOv+cWLr`tH=kyV|R
z&7K%u&CU)HciDmxZEKoTE#6a9nt3VTRS=pawkubE^mE|9fA=Q!+)gxFbadJ$Y5t`D
z)X@k*1MkN#)u}853pWC$rAU#`-yGK%(${k(^L&)WU}3g?xszPF=Z8g^WqrdwOQ&%8
zSXwFl%|hH<HBB&Q7TxBsZIu_K*C$~poy|4L;g|oFWvU@sSn>-Kd1>`0ur?Y(vHNH7
z4R^sLqMpzMUygIItBKIGT;IJneRTkjuISu2Hm=XgUGykrOiz=fL(ZXekP67LP4pC$
zOF>-d{`od7lmMl5owXtEf^};*S0Oj2&(Zo|6iivlmB~i*9CZ#Bi{u!oL<t3%x7IZl
zm(HQ~;&baFGg)8dRlCo-J(6L0mEu1Ce&b0jjSGxV7e?RiSeGR;g*vBR-Lb(R1hvMF
zGP?8I2rJKu^6IQ3yrr|<vn2KH*5x>!aE1k+hUgU#p&c7IO#%;1Kun*W+F(vnW++nJ
z+O;1{PpePG7d4LN9IB{!!8`!5dfFOaQ8g?czF#C9u8+jcRBprpJ+AOp6q6pSdx-~D
zSWoI>jI%^n@7^3A#T|3sqhDRK!aXMg6ifnltQFT8VBYORxmZ4i2{hc8-FOVRiZZ`J
z1eLBQzz@tUYl7%8r}ZLCw&v*JE2=y*G6oI-{c53~DCLAUlX<}O*iOLco}XzVb|y&;
z%_pK0-$oQdjA6Kh;9O9T;@1~}R|iIdS&Ds#Eq9q#AVqcM(_Eo(ve($0hH^~HDl2aP
zWS3P9O*S1ceHGwIu&yihN#Dcs-DFjQNM#77uf`DD+U}VwI9ld*<zHZL+vjiWG0L^x
z1RQppE0NbhAiAul;+`Ycq=ZnTqZ{}G$*&OxcQPtS5`!lBQ+4(Ro+5W$!*n9uO>_|L
zY@8xIlN+2KO<YY>pU4K;e7mXYNXgTB>$p*u)It~2k>rD^W+zIX<nJFp^^*JD@10JC
zm;ci7{Qvfq=eK_fO8%E?d%XU4f<rMWx+kez$R0^v${T-DiV0DonkH+jiGHu#zGdkv
zAbjaWK$=*v%WY?`uVty0iS*tY!Jk=xA=Tf7p0J%YSySZB$PsBcp78}|yiw*Tvt>VN
zSZr{g58vSVaeP4}wO@***ZB^tG-tIxp9YPaRcqQ?8P#&p@$Ir*n+(ZRh4)-sWUU$N
zhQ^R}{l}}APiBBLzYF|cxfIEU^voad2u&>O{Tb$~ZL_`S3^UfdR8#!aTvW}}7Cx^p
zTYKF~OnS%!v3)XuYB`B=HrKj-g=o_;694A;^^%%Vb*;j=#20A?D!VUd6Uume;UR<i
z2XV&eTnfs(V&I3E!u>VvR@umD98Nt}<fcJ{>Ab$6jR}P55nM7Tj<Ii^Diws8Q=aLN
zKoMxd_9OHjC&yQHbq-qV*Q(W$?F(P?+10w@D`RAzCVQ-%Q(%5u6cHc)MB6pBA%Gk}
zDm>99${KUnpwj9h&`vuJ5n+j?M0LQ37MO8-N5;Y;)_)eZx)N{peErR^&xWVhJEeOD
z)nP6%wz>pClgiLxBS?@*3v42N7QVW&hX&hAJHi%q;eBb*mjb12{tG2(3X%>nGWP^Z
zrQF0v`r~uTt6Oq#@<tT{O~)y>xR6|@apq<mJ$rh~n>0ndrEV|i<8ALn;_$|^cTcR{
z|3$3Z4|DbbF0$C@;ZEcpVwimN;6dTbO|`XOd=8vynNXfAd)5t4KT<K9H1LAHZw}7=
zT~dX(SU`Xs(D%OIcxUK=V$EYTZ}RlwNr4YC@u>r4C&W_2xnG8dJ6K<2OGQXfWQo{W
z9?+B^FjGukbFrM!<hz#XtGg}JfBfRQOKq~<zC+gc#vzasSFs!*HG+mi_aZLOVZ;!c
zz)|5s?Yui<xL`_sYGioooJ;b}@!AX<w2ERWZv>mPbVOJ6pg!~@&7F?My7}OQJG3pI
zFjRuf)Ylx0!&ghrc^7+aLHrJP9d1#&X=Hory4b172YftcB!03xMFJ>%R6Qr6I-3L|
z=UeL3N_ySi+4uV9wQ%6ybV<&XnsIp9BsE<MNWNzv#k>CWA{$#F;sjBzk%&V**3N#8
zZPnDiJtWy7mm%fJdIl<EE>`$5*xCDRWLHQ&5FUiK^*>^;ms9+R)uy7*s6t8iLsk41
zcWsuE-X=cxmNdJXb`yE)ln4t1a#|A5L$qKwuoKP<p^lBt9yF8v6r~D4s1M55WCXvY
zI#-diyZ}x{9NV9x61fw}qmG)}SaqgqAOcCf>FqwTP26b5G0*Gfu1}{No0E<BPaf_O
zSAA_(QQA3cCNBP-x#{)mhgu#pEEJd((Q}4-{fCD!v7;l!z5iWwsxq>(d*K=DIpz<Z
zJNhEc-{Gn>dHN%eVDf}ztDw8GnTSdkJ<@ucaC7U6ixgb-_DhH7F4i|Dnx}QtL!*Er
z6|^(w5o|y9wk10c3&L^W&Di~?S>89#$|QDke%oJ|WX>TIJ${p0jFpdFD#>xI89U)K
zYqC1!9_T|vwU*p2Uxq06;&rPv{S>tJ5BK%UH3yHgpWk{iHlTKqtrseRb>W$qCnwdH
zk06gx&MDhkm!P}Db`R!N)LkvRYCME*xMj$iTp%}_oBWc`!kflNe}-g5_ElAD0Hq<C
zw8zVykXPQvs?B@@Rl~C|emZ7H&TsMu42108{-D6prKf>lqL@()gY02!2sn`zLeBCz
zUK6fr#yW7G=^DubT)OEgDGiak&9SpI73x9cX9hRLp_nE*pv&dK7J<0%zAjf;X45iw
zp(N;YwZ)+tIZd%Q?cp~TG{%O106QGS0s8YMHe_E&=u}k8%zpeg`HOgRep`>Pzg~Zx
zOm<-MnU~3Dym9+vm@>9Q{>?Jnuszq+roxH1Me&`3MogbHgBp`$-{2fYt}4A3+v5`d
z>^P4Y<lDJK5zeqvm@|M@C_~T0UPp)Jlsgsq%!TsJTazrKm6WGPJE@K}4r#+Llb+`$
ze3CJpf2ieL6QOjk?Jj3C5z7nO0nf3_j6;ZPBMcS%N|Q9PXd~tz{%ZN4&(J82^7-s}
z@n;!EcH_5Pc_MWm=4H?YUq6Jwkn*S&4VW7`x(*xuGxVqhyg9EW<nEA{G;!@qz)f?h
zp{8z$xwJE@!)8tTEt5JvN*9dt+A$P)pH(`Er4`9WOi0F6he=WV7OP@39tBhlJM`*w
z$)uF`h`(KQixK&R3Qo$Jz|;fo;KL%=Y&L^wOxNZOrF<TaMqDGgH^3A!I@{VqVlCda
z&x<+YjRYQKK6FryYUVCHg(=sQqVTlA1$23e5jv#!()vN&v+l~NlXp5qI#kzWuih)v
zF5rI5axETsJC_pCjD0>-J(?1UJEw42w77BJTv_Prw0qr!>Og@y*UIj%7UbJEV`LIT
zsy{u*pKBVWbP+uWOI;WyIOsFwyp6Xt#NrkL)$VnuA-dEq9Xlv<b^v|X;F7^lQBXOP
zTVd>rCxDj7ejv>c9Qa_o>$)8K3w^(N6}EZ_$w(C%ah0AGP1Gp<tl}MvschPV;3f*M
zt`X<D2!U-uZgIvX$?lJ8)BCc`-0rP!>IuuFBtXEQxyG<q2xxVwtV$C%I(~x)VUVXN
zVjbDC6z6$mr;|c&0|}X5D$N(Jzj`v*EfDVKc_|?EQnStxR7NAqtR>iTM$PW6ETD9?
z#emkGh{viuwOxCyAOF*??RwesPcLn5s^SF$#l8DRy1ocpWb4OPRId_d`*E3sPl)5B
z_52U+A?Ie!BKvcD|F7{FpZK7?YVnp2=a$**d&JbdGvo<_<IAu0z=d#E?b!W)+aE5j
zTwalv%TiI`o%M0)oie2xQGfa_Zest`W|XY_ch=Wk8qC1)uJrx}ISybZk%;)C{-fUX
z>9wh;rbmy@U*Rb;J?Lby;>4a_o`QwPoYo1{tYSQQ(q7jaIJ14^@0|B_Iu-4Y>ed&o
zjgP9B9b~okefzAB$`{ji8qNIAP|Z@Pd|K+%nbXoILQ;A}AMJO|SinDJpIY5<;I+P5
ze=<L?1LxfZ@4cG#Yx?2RZBk*gGj;b=MVL*V`8ZQCyKJ)JslO)!5(O9xir4=R_;=cl
z890<Fy6gw{Bek`wU(Sk~zCv%w{F}m#+$XJERkWW;KA0oQt)0NiuD-Tb*Oj55PVGnT
zLwm6rlPh&XS>KNCv0VAGDC5(i_H5lH6Mjm#9lUjFf9b}94A)QAZ$AD<_&6|5-mj0S
zSna*@>Ym8eFAjxXdU`!C=#j4RdCRG59`so(>b&#m{FZH=3O%!aAL?TG^W?+*KSIC1
z<z1*#$%?bvH9hj`m%r{oRvSOOy?ZC!MO^Xjg}qw}6{jZY)oh)3gZ0$52Yz*Jf0yr1
z&2IzFMK-*(VgJax?#-ghdSRbVz4xD}v}5}eMd$5jJOvhOCr+Kxd{9C`@XK1@4dVCT
zy#6itN9pgJubnpWOJiQu>3%Gk_UK~i+PWukvA1unIM8&PtCOeV@zdBFKfQAw?VNwh
z{Tt{UeUCq`m;UKw&3d=<p}y$L3GTVy?(#jekc(K9rV)Ln%W0EBlIVq%$5~`}YOey@
zH2uK45??=T2hJR6+9-dx>|Y`DF1WC^x>S9BZGA!2*<wqE-9-fqTsy5pQm!B0rvvP5
zM*R`IW&^xP<nX~bosaQ{U+nQ#_FS2Hi*2#&);UK{rg5$3-n25w@6eg<IZ7)ItiQ|!
zOk;J-z!P#gfwOE}Cm;H^S{Yn^w5w3}>6LY9d-qOB=P$IbIp^kgRU-7{t;Ong%pbr1
z<NWxc{_*{z*7-fxrJn77a9`}WkaJ=6!{0mJrtI{%d@3wiB}jCFd&l>Ml8$ZcJ+%*A
z8S3gPe*fcK3%pPK@&VwrCU#Ry{W<wrV$WBnugDbFlv`|i^kT<()1yZ&dZkRgC2_;^
zuwp2eQ}5QV><8r={xk6IPe0ENJcC5~!)^cU4E34o^7YoK7~i`e>-qipuDSa%Rr2E)
RWHgw&zFARqRTlIAn*emh!M6Ya

literal 0
HcmV?d00001

diff --git a/zookeeper-specifications/protocol-spec/verification-statistics.md b/zookeeper-specifications/protocol-spec/verification-statistics.md
new file mode 100644
index 00000000000..b7cc0274629
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/verification-statistics.md
@@ -0,0 +1,44 @@
+# Verification Statistics 
+##### Experiment configuration
+
+Our statistical results include: diameter of the system states that have been traversed, the number of states that have been traversed, the number of different states that have been discovered, and the time spent in the experiment.
+
+The machine configuration used in the experiment is 2.40 GHz, 10-core CPU, 64GB memory. The TLC version number is 1.7.0.
+
+
+
+##### State space constraints in model checking
+
+Due to the state space explosion in model checking and the complex actions of Zab protocol, as well as unlimited number of rounds and unlimited length of history, it is impossible to traverse all states.  
+We try to let models can tap into larger state space. See CONSTANT *Parameters* for details.
+
+
+
+##### Verification statistics of model checking  
+|  Mode  |     TLC model         |    Diameter   |     num of states  | time of checking(hh:mm:ss) |
+| ----- | ---------------------- | ------------- | ------------------ | ------------------ |
+| BFS   | (2 servers,3 rounds,2 transactions)    |     59   |  7758091583 |  17:28:17|
+| Simulation | (2 servers,3 rounds,2 transactions)   |   -|  6412825222| 17:07:20  |
+| BFS   | (3 servers,2 rounds,2 transactions)    |     19   |  4275801206 |  09:40:08|
+| Simulation | (3 servers,2 rounds,2 transactions)   |   -|  10899460942| 20:15:11  |
+| BFS   | (3 servers,2 rounds,3 transactions)   |    22    |  8740566213  | 17:49:09 |
+| Simulation | (3 servers,2 rounds,3 transactions)  |  -    | 9639135842  |   20:10:00 |
+| BFS    |  (3 servers,3 rounds,2 transactions)    |    21    | 7079744342    |14:17:45 |
+| Simulation | (3 servers,3 rounds,2 transactions)    |  -  |  6254964039   | 15:08:42 |
+| BFS    |  (4 servers,3 rounds,2 transactions)    |    16    | 5634112480  |15:42:09 |
+| Simulation | (4 servers,3 rounds,2 transactions)    |  -  |  3883461291   | 15:52:03 |
+
+
+
+##### Verification statistics with parameters (count of servers, MaxTotalRestartNum, MaxElectionNum, MaxTransactionNum)
+
+|  Mode  |     TLC model         |    Diameter   |     num of states  | time of checking(hh:mm:ss) |
+| ----- | ---------------------- | ------------- | ------------------ | ------------------ |
+| BFS   | (2,2,3,2,termination) |     55   |  10772649   |  00:02:21|
+| BFS   | (3,1,1,2)             |     45   |  9602018536 |  31:01:57|
+
+
+
+##### Issues
+
+Besides, we have found several issues related to the ambiguous description of the Zab protocol. Details can be found at [issues.md](issues.md).
diff --git a/zookeeper-specifications/system-spec/doc.md b/zookeeper-specifications/system-spec/doc.md
new file mode 100644
index 00000000000..c30ec1d548b
--- /dev/null
+++ b/zookeeper-specifications/system-spec/doc.md
@@ -0,0 +1,17 @@
+# ZooKeeper's System Specification of TLA+
+
+## Overview
+
+ZooKeeper's system specification of TLA+ focuses on the implementation of the Zookeeper Atomic Broadcast(ZAB) consensus protocol (or, [ZAB1.0](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zab1.0)). 
+
+As is shown by the informal description of [ZAB1.0](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zab1.0), the implementation of ZAB that used in ZooKeeper production differs a lot from its original design.
+
+We make this system specification to grasp the core logic of the ZAB's implementation especially. 
+
+The [sysetm specification](zk-3.7/ZkV3_7_0.tla) written in TLA+ is precise without ambiguity, and testable with existed tools like the TLC model checker. (We have done a certain scale of model checking to verify its correctness!) 
+
+The system specification can serve as the super-doc supplementing detailed system documentation for the ZooKeeper developers. It can evolve incrementally without high cost as the system develops over time, continually ensuring correctness for both the design and the implementation.
+
+We have also made a formal [specification](zk-3.7/FastLeaderElection.tla) for Fast Leader Election in Zab since ZAB 1.0 depends on FLE to complete the election phase.
+
+If you have any question or find any problem of the specification, please contact us.
diff --git a/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
new file mode 100644
index 00000000000..753ba96efc8
--- /dev/null
+++ b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
@@ -0,0 +1,535 @@
+------------------------- MODULE FastLeaderElection -------------------------
+\* This is the formal specification for Fast Leader Election in Zab protocol.
+(* Reference:
+   FastLeaderElection.java, Vote.java, QuorumPeer.java in https://github.com/apache/zookeeper.
+   Medeiros A. ZooKeeper's atomic broadcast protocol: Theory and practice[J]. Aalto University School of Science, 2012.
+*)
+EXTENDS Integers, FiniteSets, Sequences, Naturals, TLC
+
+-----------------------------------------------------------------------------
+\* The set of server identifiers
+CONSTANT Server
+
+\* Server states
+CONSTANTS LOOKING, FOLLOWING, LEADING
+(* NOTE: In spec, we do not discuss servers whose ServerState is OBSERVING.
+*)
+
+\* Message types
+CONSTANTS NOTIFICATION
+
+\* Timeout signal
+CONSTANT NONE
+-----------------------------------------------------------------------------
+Quorums == {Q \in SUBSET Server: Cardinality(Q)*2 > Cardinality(Server)}
+
+NullPoint == CHOOSE p: p \notin Server
+
+-----------------------------------------------------------------------------
+\* Server's state(LOOKING, FOLLOWING, LEADING).
+VARIABLE state
+
+VARIABLE history
+
+\* The epoch number of the last NEWLEADER packet accepted, used for comparing.
+VARIABLE currentEpoch
+
+\* The index and zxid of the last processed transaction in history.
+VARIABLE lastProcessed
+
+\* currentVote[i]: The server who i thinks is the current leader(id,zxid,peerEpoch,...).
+VARIABLE currentVote
+
+\* Election instance.(logicalClock in code)
+VARIABLE logicalClock
+
+\* The votes from the current leader election are stored in ReceiveVotes.
+VARIABLE receiveVotes
+
+(* The votes from previous leader elections, as well as the votes from the current leader election are
+   stored in outofelection. Note that notifications in a LOOKING state are not stored in outofelection.
+   Only FOLLOWING or LEADING notifications are stored in outofelection.  *)
+VARIABLE outOfElection
+
+\* recvQueue[i]: The queue of received notifications or timeout signals in server i.
+VARIABLE recvQueue
+
+\* A veriable to wait for new notifications, corresponding to line 1050 in FastLeaderElection.java.
+VARIABLE waitNotmsg
+
+\* leadingVoteSet[i]: The set of voters that follow i.
+VARIABLE leadingVoteSet
+
+(* The messages about election sent from one server to another.
+   electionMsgs[i][j] means the input buffer of server j from server i. *)
+VARIABLE electionMsgs
+
+\* Set used for mapping Server to Integers, to compare ids from different servers.
+\* VARIABLE idTable
+
+serverVarsL == <<state, currentEpoch, lastProcessed, history>>
+
+electionVarsL == <<currentVote, logicalClock, receiveVotes, outOfElection, recvQueue, waitNotmsg>>
+
+leaderVarsL == <<leadingVoteSet>>
+
+varsL == <<serverVarsL, electionVarsL, leaderVarsL, electionMsgs>>
+-----------------------------------------------------------------------------
+\* Processing of electionMsgs
+BroadcastNotmsg(i, m) == electionMsgs' = [electionMsgs EXCEPT ![i] = [v \in Server |-> IF v /= i
+                                                                                       THEN Append(electionMsgs[i][v], m)
+                                                                                       ELSE electionMsgs[i][v]]]
+
+DiscardNotmsg(i, j) == electionMsgs' = [electionMsgs EXCEPT ![i][j] = IF electionMsgs[i][j] /= << >>
+                                                                      THEN Tail(electionMsgs[i][j])
+                                                                      ELSE << >>]
+
+ReplyNotmsg(i, j, m) == electionMsgs' = [electionMsgs EXCEPT ![i][j] = Append(electionMsgs[i][j], m),
+                                                             ![j][i] = Tail(electionMsgs[j][i])]
+                                               
+-----------------------------------------------------------------------------
+\* Processing of recvQueue
+RECURSIVE RemoveNone(_)
+RemoveNone(seq) == CASE seq =  << >> -> << >>
+                   []   seq /= << >> -> IF Head(seq).mtype = NONE THEN RemoveNone(Tail(seq))
+                                                                  ELSE <<Head(seq)>> \o RemoveNone(Tail(seq)) 
+
+\* Processing of idTable and order comparing
+RECURSIVE InitializeIdTable(_)
+InitializeIdTable(Remaining) == IF Remaining = {} THEN {}
+                                ELSE LET chosen == CHOOSE i \in Remaining: TRUE
+                                         re     == Remaining \ {chosen}
+                                     IN {<<chosen, Cardinality(Remaining)>>} \union InitializeIdTable(re)
+
+IdTable == InitializeIdTable(Server) 
+
+\* FALSE: id1 < id2; TRUE: id1 > id2
+IdCompare(id1,id2) == LET item1 == CHOOSE item \in IdTable: item[1] = id1
+                          item2 == CHOOSE item \in IdTable: item[1] = id2
+                      IN item1[2] > item2[2]
+
+\* FALSE: zxid1 <= zxid2; TRUE: zxid1 > zxid2
+ZxidCompare(zxid1, zxid2) == \/ zxid1[1] > zxid2[1]
+                             \/ /\ zxid1[1] = zxid2[1]
+                                /\ zxid1[2] > zxid2[2]
+
+ZxidEqual(zxid1, zxid2) == zxid1[1] = zxid2[1] /\ zxid1[2] = zxid2[2]
+
+\* FALSE: vote1 <= vote2; TRUE: vote1 > vote2
+TotalOrderPredicate(vote1, vote2) == \/ vote1.proposedEpoch > vote2.proposedEpoch
+                                     \/ /\ vote1.proposedEpoch = vote2.proposedEpoch
+                                        /\ \/ ZxidCompare(vote1.proposedZxid, vote2.proposedZxid)
+                                           \/ /\ ZxidEqual(vote1.proposedZxid, vote2.proposedZxid)
+                                              /\ IdCompare(vote1.proposedLeader, vote2.proposedLeader)
+
+VoteEqual(vote1, round1, vote2, round2) == /\ vote1.proposedLeader = vote2.proposedLeader
+                                           /\ ZxidEqual(vote1.proposedZxid, vote2.proposedZxid)
+                                           /\ vote1.proposedEpoch  = vote2.proposedEpoch
+                                           /\ round1 = round2
+
+InitLastProcessed(i) == IF Len(history[i]) = 0 THEN [ index |-> 0, 
+                                                 zxid |-> <<0, 0>> ]
+                        ELSE
+                        LET lastIndex == Len(history[i])
+                            entry     == history[i][lastIndex]
+                        IN [ index |-> lastIndex,
+                             zxid  |-> entry.zxid ]
+
+RECURSIVE InitAcksidInTxns(_,_)
+InitAcksidInTxns(txns, src) == IF Len(txns) = 0 THEN << >>
+                               ELSE LET newTxn == [ zxid   |-> txns[1].zxid,
+                                                    value  |-> txns[1].value,
+                                                    ackSid |-> {src},
+                                                    epoch  |-> txns[1].epoch ]
+                                    IN <<newTxn>> \o InitAcksidInTxns( Tail(txns), src)
+
+InitHistory(i) == LET newState == state'[i] IN 
+                    IF newState = LEADING THEN InitAcksidInTxns(history[i], i)
+                    ELSE history[i]
+-----------------------------------------------------------------------------
+\* Processing of currentVote
+InitialVote == [proposedLeader |-> NullPoint,
+                proposedZxid   |-> <<0, 0>>,
+                proposedEpoch  |-> 0]
+
+SelfVote(i) == [proposedLeader |-> i,
+                proposedZxid   |-> lastProcessed[i].zxid,
+                proposedEpoch  |-> currentEpoch[i]]
+
+UpdateProposal(i, nid, nzxid, nepoch) == currentVote' = [currentVote EXCEPT ![i].proposedLeader = nid, \* no need to record state in LOOKING
+                                                                            ![i].proposedZxid   = nzxid,
+                                                                            ![i].proposedEpoch  = nepoch]  
+                                                                            
+-----------------------------------------------------------------------------
+\* Processing of receiveVotes and outOfElection
+RvClear(i) == receiveVotes'  = [receiveVotes  EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                               round   |-> 0,
+                                                                               state   |-> LOOKING,
+                                                                               version |-> 0]]]
+
+RvPut(i, id, mvote, mround, mstate) == receiveVotes' = CASE receiveVotes[i][id].round < mround -> [receiveVotes EXCEPT ![i][id].vote    = mvote,
+                                                                                                                       ![i][id].round   = mround,
+                                                                                                                       ![i][id].state   = mstate,
+                                                                                                                       ![i][id].version = 1]
+                                                       []   receiveVotes[i][id].round = mround -> [receiveVotes EXCEPT ![i][id].vote    = mvote,
+                                                                                                                       ![i][id].state   = mstate,
+                                                                                                                       ![i][id].version = @ + 1]
+                                                       []   receiveVotes[i][id].round > mround -> receiveVotes
+
+Put(i, id, rcvset, mvote, mround, mstate) == CASE rcvset[id].round < mround -> [rcvset EXCEPT ![id].vote    = mvote,
+                                                                                              ![id].round   = mround,
+                                                                                              ![id].state   = mstate,
+                                                                                              ![id].version = 1]
+                                             []   rcvset[id].round = mround -> [rcvset EXCEPT ![id].vote    = mvote,
+                                                                                              ![id].state   = mstate,
+                                                                                              ![id].version = @ + 1]
+                                             []   rcvset[id].round > mround -> rcvset
+
+RvClearAndPut(i, id, vote, round) == receiveVotes' = LET oneVote == [vote    |-> vote, 
+                                                                     round   |-> round, 
+                                                                     state   |-> LOOKING,
+                                                                     version |-> 1]
+                                                     IN [receiveVotes EXCEPT ![i] = [v \in Server |-> IF v = id THEN oneVote
+                                                                                                                ELSE [vote    |-> InitialVote,
+                                                                                                                      round   |-> 0,
+                                                                                                                      state   |-> LOOKING,
+                                                                                                                      version |-> 0]]]                     
+
+VoteSet(i, msource, rcvset, thisvote, thisround) == {msource} \union {s \in (Server \ {msource}): VoteEqual(rcvset[s].vote, 
+                                                                                                            rcvset[s].round,
+                                                                                                            thisvote,
+                                                                                                            thisround)}
+
+HasQuorums(i, msource, rcvset, thisvote, thisround) == LET Q == VoteSet(i, msource, rcvset, thisvote, thisround)
+                                                       IN IF Q \in Quorums THEN TRUE ELSE FALSE
+
+CheckLeader(i, votes, thisleader, thisround) == IF thisleader = i THEN (IF thisround = logicalClock[i] THEN TRUE ELSE FALSE)
+                                                ELSE (IF votes[thisleader].vote.proposedLeader = NullPoint THEN FALSE
+                                                      ELSE (IF votes[thisleader].state = LEADING THEN TRUE 
+                                                                                                 ELSE FALSE))
+
+OoeClear(i) == outOfElection' = [outOfElection EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                                round   |-> 0,
+                                                                                state   |-> LOOKING,
+                                                                                version |-> 0]]]  
+
+OoePut(i, id, mvote, mround, mstate) == outOfElection' = CASE outOfElection[i][id].round < mround -> [outOfElection EXCEPT ![i][id].vote    = mvote,
+                                                                                                                           ![i][id].round   = mround,
+                                                                                                                           ![i][id].state   = mstate,
+                                                                                                                           ![i][id].version = 1]
+                                                         []   outOfElection[i][id].round = mround -> [outOfElection EXCEPT ![i][id].vote    = mvote,
+                                                                                                                           ![i][id].state   = mstate,
+                                                                                                                           ![i][id].version = @ + 1]
+                                                         []   outOfElection[i][id].round > mround -> outOfElection
+                                                                                                                             
+-----------------------------------------------------------------------------    
+InitServerVarsL == /\ state         = [s \in Server |-> LOOKING]
+                   /\ currentEpoch  = [s \in Server |-> 0]
+                   /\ lastProcessed = [s \in Server |-> [index |-> 0,
+                                                         zxid  |-> <<0, 0>>] ]
+                   /\ history       = [s \in Server |-> << >>]
+
+InitElectionVarsL == /\ currentVote   = [s \in Server |-> SelfVote(s)]
+                     /\ logicalClock  = [s \in Server |-> 0]
+                     /\ receiveVotes  = [s \in Server |-> [v \in Server |-> [vote    |-> InitialVote,
+                                                                             round   |-> 0,
+                                                                             state   |-> LOOKING,
+                                                                             version |-> 0]]]
+                     /\ outOfElection = [s \in Server |-> [v \in Server |-> [vote    |-> InitialVote,
+                                                                             round   |-> 0,
+                                                                             state   |-> LOOKING,
+                                                                             version |-> 0]]]
+                     /\ recvQueue     = [s \in Server |-> << >>]
+                     /\ waitNotmsg    = [s \in Server |-> FALSE]
+
+InitLeaderVarsL == leadingVoteSet = [s \in Server |-> {}]
+
+InitL == /\ InitServerVarsL
+        /\ InitElectionVarsL
+        /\ InitLeaderVarsL
+        /\ electionMsgs = [s \in Server |-> [v \in Server |-> << >>]]
+        \* /\ idTable = InitializeIdTable(Server)
+        
+-----------------------------------------------------------------------------
+(* The beginning part of FLE's main function lookForLeader() *)
+ZabTimeout(i) ==
+        /\ state[i] \in {LEADING, FOLLOWING}
+        /\ state'          = [state          EXCEPT ![i] = LOOKING]
+        /\ lastProcessed'  = [lastProcessed  EXCEPT ![i] = InitLastProcessed(i)]
+        /\ logicalClock'   = [logicalClock   EXCEPT ![i] = logicalClock[i] + 1]
+        /\ currentVote'    = [currentVote    EXCEPT ![i] = [proposedLeader |-> i,
+                                                            proposedZxid   |-> lastProcessed'[i].zxid,
+                                                            proposedEpoch  |-> currentEpoch[i]]]
+        /\ receiveVotes'   = [receiveVotes   EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                              round   |-> 0,
+                                                                              state   |-> LOOKING,
+                                                                              version |-> 0]]]
+        /\ outOfElection'  = [outOfElection  EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                              round   |-> 0,
+                                                                              state   |-> LOOKING,
+                                                                              version |-> 0]]]
+        /\ recvQueue'      = [recvQueue      EXCEPT ![i] = << >>]  
+        /\ waitNotmsg'     = [waitNotmsg     EXCEPT ![i] = FALSE]
+        /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = {}]
+        /\ BroadcastNotmsg(i, [mtype   |-> NOTIFICATION,
+                               msource |-> i,
+                               mstate  |-> LOOKING,
+                               mround  |-> logicalClock'[i],
+                               mvote   |-> currentVote'[i]])
+        /\ UNCHANGED <<currentEpoch, history>>
+        
+(* Abstraction of WorkerReceiver.run() *)
+ReceiveNotmsg(i, j) ==
+        /\ electionMsgs[j][i] /= << >>
+        /\ LET notmsg == electionMsgs[j][i][1]
+               toSend == [mtype   |-> NOTIFICATION,
+                          msource |-> i,
+                          mstate  |-> state[i],
+                          mround  |-> logicalClock[i],
+                          mvote   |-> currentVote[i]]
+           IN \/ /\ state[i] = LOOKING
+                 /\ recvQueue' = [recvQueue EXCEPT ![i] = Append(RemoveNone(recvQueue[i]), notmsg)]
+                 /\ LET replyOk == /\ notmsg.mstate = LOOKING
+                                   /\ notmsg.mround < logicalClock[i]
+                    IN 
+                    \/ /\ replyOk
+                       /\ ReplyNotmsg(i, j, toSend)
+                    \/ /\ ~replyOk
+                       /\ DiscardNotmsg(j, i)
+              \/ /\ state[i] \in {LEADING, FOLLOWING}
+                 /\ \/ \* Only reply when sender's state is LOOKING
+                       /\ notmsg.mstate = LOOKING
+                       /\ ReplyNotmsg(i, j, toSend)
+                    \/ \* sender's state and mine are both not LOOKING, just discard
+                       /\ notmsg.mstate /= LOOKING
+                       /\ DiscardNotmsg(j, i)
+                 /\ UNCHANGED recvQueue
+        /\ UNCHANGED <<serverVarsL, currentVote, logicalClock, receiveVotes, outOfElection, waitNotmsg, leaderVarsL>>
+        
+NotmsgTimeout(i) == 
+        /\ state[i] = LOOKING
+        /\ \A j \in Server: electionMsgs[j][i] = << >>
+        /\ recvQueue[i] = << >>
+        /\ recvQueue' = [recvQueue EXCEPT ![i] = Append(recvQueue[i], [mtype |-> NONE])]
+        /\ UNCHANGED <<serverVarsL, currentVote, logicalClock, receiveVotes, outOfElection, waitNotmsg, leaderVarsL, electionMsgs>>
+
+-----------------------------------------------------------------------------
+\* Sub-action in HandleNotmsg
+ReceivedFollowingAndLeadingNotification(i, n) ==
+        LET newVotes    == Put(i, n.msource, receiveVotes[i], n.mvote, n.mround, n.mstate)
+            voteSet1    == VoteSet(i, n.msource, newVotes, n.mvote, n.mround)
+            hasQuorums1 == voteSet1 \in Quorums
+            check1      == CheckLeader(i, newVotes, n.mvote.proposedLeader, n.mround)
+            leaveOk1    == /\ n.mround = logicalClock[i]
+                           /\ hasQuorums1
+                           /\ check1    \* state and leadingVoteSet cannot be changed twice in the first '/\' and second '/\'.
+        IN
+        /\ \/ /\ n.mround = logicalClock[i]
+              /\ receiveVotes' = [receiveVotes EXCEPT ![i] = newVotes]
+           \/ /\ n.mround /= logicalClock[i]
+              /\ UNCHANGED receiveVotes
+        /\ \/ /\ leaveOk1
+              \* /\ PrintT("leave with condition 1")
+              /\ state' = [state EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN LEADING ELSE FOLLOWING]
+              /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN voteSet1 ELSE @]
+              /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+              /\ UNCHANGED <<logicalClock, outOfElection>>
+           \/ /\ ~leaveOk1
+              /\ outOfElection' = [outOfElection EXCEPT ![i] = Put(i, n.msource, outOfElection[i], n.mvote,n.mround, n.mstate)]
+              /\ LET voteSet2    == VoteSet(i, n.msource, outOfElection'[i], n.mvote, n.mround)
+                     hasQuorums2 == voteSet2 \in Quorums
+                     check2      == CheckLeader(i, outOfElection'[i], n.mvote.proposedLeader, n.mround)
+                     leaveOk2    == /\ hasQuorums2
+                                    /\ check2
+                 IN
+                 \/ /\ leaveOk2
+                    \* /\ PrintT("leave with condition 2")
+                    /\ logicalClock' = [logicalClock EXCEPT ![i] = n.mround]
+                    /\ state' = [state EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN LEADING ELSE FOLLOWING]
+                    /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN voteSet2 ELSE @]
+                    /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                 \/ /\ ~leaveOk2
+                    /\ LET leaveOk3 == /\ n.mstate = LEADING
+                                       /\ n.mround = logicalClock[i]
+                       IN
+                       \/ /\ leaveOk3
+                          \* /\ PrintT("leave with condition 3")
+                          /\ state' = [state EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN LEADING ELSE FOLLOWING]
+                          /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                       \/ /\ ~leaveOk3
+                          /\ UNCHANGED <<state, currentVote>>
+                    /\ UNCHANGED <<logicalClock, leadingVoteSet>>
+
+(* Main part of lookForLeader() *)
+HandleNotmsg(i) ==
+        /\ state[i] = LOOKING
+        /\ \lnot waitNotmsg[i]
+        /\ recvQueue[i] /= << >>
+        /\ LET n         == recvQueue[i][1]
+               rawToSend == [mtype   |-> NOTIFICATION,
+                             msource |-> i,
+                             mstate  |-> LOOKING,
+                             mround  |-> logicalClock[i],
+                             mvote   |-> currentVote[i]]
+           IN \/ /\ n.mtype = NONE
+                 /\ BroadcastNotmsg(i, rawToSend)
+                 /\ UNCHANGED <<history, logicalClock, currentVote, receiveVotes, waitNotmsg, outOfElection, state, leadingVoteSet>>
+              \/ /\ n.mtype = NOTIFICATION
+                 /\ \/ /\ n.mstate = LOOKING
+                       /\ \/ \* n.round >= my round, then update data and receiveVotes.
+                             /\ n.mround >= logicalClock[i]
+                             /\ \/ \* n.round > my round, update round and decide new proposed leader.
+                                   /\ n.mround > logicalClock[i]
+                                   /\ logicalClock' = [logicalClock EXCEPT ![i] = n.mround] \* There should be RvClear, we will handle it in the following.
+                                   /\ LET selfinfo == [proposedLeader |-> i,
+                                                       proposedZxid   |-> lastProcessed[i].zxid,
+                                                       proposedEpoch  |-> currentEpoch[i]]
+                                          peerOk   == TotalOrderPredicate(n.mvote, selfinfo)
+                                      IN \/ /\ peerOk
+                                            /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                                         \/ /\ ~peerOk
+                                            /\ UpdateProposal(i, i, lastProcessed[i].zxid, currentEpoch[i])
+                                   /\ BroadcastNotmsg(i, [mtype   |-> NOTIFICATION,
+                                                          msource |-> i,
+                                                          mstate  |-> LOOKING,
+                                                          mround  |-> n.mround,
+                                                          mvote   |-> currentVote'[i]])
+                                \/ \* n.round = my round & n.vote > my vote
+                                   /\ n.mround = logicalClock[i]
+                                   /\ LET peerOk == TotalOrderPredicate(n.mvote, currentVote[i])
+                                      IN \/ /\ peerOk
+                                            /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                                            /\ BroadcastNotmsg(i, [mtype   |-> NOTIFICATION,
+                                                                   msource |-> i,
+                                                                   mstate  |-> LOOKING,
+                                                                   mround  |-> logicalClock[i],
+                                                                   mvote   |-> n.mvote])
+                                         \/ /\ ~peerOk
+                                            /\ UNCHANGED <<currentVote, electionMsgs>>
+                                   /\ UNCHANGED logicalClock
+                             /\ LET rcvsetModifiedTwice == n.mround > logicalClock[i]
+                                IN \/ /\ rcvsetModifiedTwice   \* Since a variable cannot be changed more than once in one action, we handle receiveVotes here.
+                                      /\ RvClearAndPut(i, n.msource, n.mvote, n.mround)  \* clear + put
+                                   \/ /\ ~rcvsetModifiedTwice
+                                      /\ RvPut(i, n.msource, n.mvote, n.mround, n.mstate)          \* put
+                             /\ LET hasQuorums == HasQuorums(i, i, receiveVotes'[i], currentVote'[i], n.mround)
+                                IN \/ /\ hasQuorums \* If hasQuorums, see action WaitNewNotmsg and WaitNewNotmsgEnd.
+                                      /\ waitNotmsg' = [waitNotmsg EXCEPT ![i] = TRUE] 
+                                   \/ /\ ~hasQuorums                            
+                                      /\ UNCHANGED waitNotmsg
+                          \/ \* n.round < my round, just discard it.
+                             /\ n.mround < logicalClock[i]
+                             /\ UNCHANGED <<logicalClock, currentVote, electionMsgs, receiveVotes, waitNotmsg>>
+                       /\ UNCHANGED <<state, history, outOfElection, leadingVoteSet>>
+                    \/ \* mainly contains receivedFollowingNotification(line 1146), receivedLeadingNotification(line 1185).
+                       /\ n.mstate \in {LEADING, FOLLOWING}
+                       /\ ReceivedFollowingAndLeadingNotification(i, n)
+                       /\ history' = [history EXCEPT ![i] = InitHistory(i) ]
+                       /\ UNCHANGED <<electionMsgs, waitNotmsg>>
+        /\ recvQueue' = [recvQueue EXCEPT ![i] = Tail(recvQueue[i])]
+        /\ UNCHANGED <<currentEpoch, lastProcessed>>
+
+\* On the premise that ReceiveVotes.HasQuorums = TRUE, corresponding to logic in LFE.java.
+WaitNewNotmsg(i) ==
+        /\ state[i] = LOOKING
+        /\ waitNotmsg[i] = TRUE
+        /\ \/ /\ recvQueue[i] /= << >>
+              /\ recvQueue[i][1].mtype = NOTIFICATION
+              /\ LET n == recvQueue[i][1]
+                     peerOk == TotalOrderPredicate(n.mvote, currentVote[i])
+                 IN \/ /\ peerOk
+                       /\ waitNotmsg' = [waitNotmsg EXCEPT ![i] = FALSE]
+                       /\ recvQueue'  = [recvQueue  EXCEPT ![i] = Append(Tail(@), n)]
+                    \/ /\ ~peerOk
+                       /\ recvQueue' = [recvQueue EXCEPT ![i] = Tail(@)]
+                       /\ UNCHANGED waitNotmsg
+              /\ UNCHANGED <<serverVarsL, currentVote, logicalClock, receiveVotes, outOfElection, 
+                             leaderVarsL, electionMsgs>>
+           \/ /\ \/ recvQueue[i] = << >>
+                 \/ /\ recvQueue[i] /= << >>
+                    /\ recvQueue[i][1].mtype = NONE
+              /\ state' = [state EXCEPT ![i] = IF currentVote[i].proposedLeader = i THEN LEADING
+                                               ELSE FOLLOWING ]
+              /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = 
+                                                           IF currentVote[i].proposedLeader = i 
+                                                           THEN VoteSet(i, i, receiveVotes[i], currentVote[i],
+                                                                        logicalClock[i])
+                                                           ELSE @]
+              /\ history' = [history EXCEPT ![i] = InitHistory(i)]
+              /\ UNCHANGED <<currentEpoch, lastProcessed, electionVarsL, electionMsgs>>
+-----------------------------------------------------------------------------
+(*Test - simulate modifying currentEpoch and lastProcessed.
+  We want to reach violations to achieve some traces and see whether the whole state of system is advancing.
+  The actions below are completely not equal to implementation in real, 
+  just simulate a process of leader updates state and followers get it. *)
+
+LeaderAdvanceEpoch(i) ==
+        /\ state[i] = LEADING
+        /\ currentEpoch' = [currentEpoch EXCEPT ![i] = @ + 1]
+        /\ UNCHANGED <<state, lastProcessed, history, electionVarsL, leaderVarsL, electionMsgs>>
+
+FollowerUpdateEpoch(i, j) ==
+        /\ state[i] = FOLLOWING
+        /\ currentVote[i].proposedLeader = j
+        /\ state[j] = LEADING
+        /\ currentEpoch[i] < currentEpoch[j]
+        /\ currentEpoch' = [currentEpoch EXCEPT ![i] = currentEpoch[j]]
+        /\ UNCHANGED <<state, lastProcessed, history, electionVarsL, leaderVarsL, electionMsgs>>
+
+LeaderAdvanceZxid(i) ==
+        /\ state[i] = LEADING
+        /\ lastProcessed' = [lastProcessed EXCEPT ![i] = IF lastProcessed[i].zxid[1] = currentEpoch[i] 
+                                               THEN [  index |-> lastProcessed[i].index + 1,
+                                                       zxid  |-> <<currentEpoch[i], lastProcessed[i].zxid[2] + 1>> ]
+                                               ELSE [  index |-> lastProcessed[i].index + 1,
+                                                       zxid  |-> <<currentEpoch[i], 1>> ] ]
+        /\ history' = [history EXCEPT ![i] = Append(@, [zxid   |-> lastProcessed'[i].zxid,
+                                                        value  |-> NONE,
+                                                        ackSid |-> {},
+                                                        epoch  |-> 0])]
+        /\ UNCHANGED <<state, currentEpoch, electionVarsL, leaderVarsL, electionMsgs>>
+
+FollowerUpdateZxid(i, j) ==
+        /\ state[i] = FOLLOWING
+        /\ currentVote[i].proposedLeader = j
+        /\ state[j] = LEADING
+        /\ LET precede == \/ lastProcessed[i].zxid[1] < lastProcessed[j].zxid[1]
+                          \/ /\ lastProcessed[i].zxid[1] = lastProcessed[j].zxid[1]
+                             /\ lastProcessed[i].zxid[2] < lastProcessed[j].zxid[2]
+           IN /\ precede
+              /\ lastProcessed' = [lastProcessed EXCEPT ![i] = lastProcessed[j]]
+              /\ history' = [history EXCEPT ![i] = history[j]]
+        /\ UNCHANGED <<state, currentEpoch, electionVarsL, leaderVarsL, electionMsgs>>
+
+NextL == 
+        \/ \E i \in Server:     ZabTimeout(i)
+        \/ \E i, j \in Server:  ReceiveNotmsg(i, j)
+        \/ \E i \in Server:     NotmsgTimeout(i)
+        \/ \E i \in Server:     HandleNotmsg(i)
+        \/ \E i \in Server:     WaitNewNotmsg(i)
+       
+        \/ \E i \in Server:     LeaderAdvanceEpoch(i)
+        \/ \E i, j \in Server:  FollowerUpdateEpoch(i, j)
+        \/ \E i \in Server:     LeaderAdvanceZxid(i)
+        \/ \E i, j \in Server:  FollowerUpdateZxid(i, j)
+
+SpecL == InitL /\ [][NextL]_varsL
+       
+\* These invariants should be violated after running for minutes.
+
+ShouldBeTriggered1 == ~\E Q \in Quorums: /\ \A i \in Q: /\ state[i] \in {FOLLOWING, LEADING}
+                                                        /\ currentEpoch[i] > 3
+                                                        /\ logicalClock[i] > 2
+                                                        /\ currentVote[i].proposedLeader \in Q
+                                         /\ \A i, j \in Q: currentVote[i].proposedLeader = currentVote[j].proposedLeader
+
+(*
+ShouldBeTriggered2 == ~\E Q \in Quorums: /\ \A i \in Q: /\ state[i] \in {FOLLOWING, LEADING}
+                                                        /\ currentEpoch[i] > 3
+                                                        /\ currentVote[i].proposedLeader \in Q
+                                         /\ \A i, j \in Q: currentVote[i].proposedLeader = currentVote[j].proposedLeader*)
+=============================================================================
+\* Modification History
+\* Last modified Sat Jan 14 15:19:45 CST 2023 by huangbinyu
+\* Last modified Sun Nov 14 15:18:32 CST 2021 by Dell
+\* Created Fri Jun 18 20:23:47 CST 2021 by Dell
diff --git a/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
new file mode 100644
index 00000000000..060ed3d0abb
--- /dev/null
+++ b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
@@ -0,0 +1,2032 @@
+------------------------------ MODULE ZkV3_7_0 ------------------------------
+(* This is the system specification for Zab in apache/zookeeper with version 3.7.0 *)
+
+(* Reference:
+   FLE: FastLeaderElection.java, Vote.java, QuorumPeer.java, e.g. in 
+        https://github.com/apache/zookeeper.
+   ZAB: QuorumPeer.java, Learner.java, Follower.java, LearnerHandler.java,
+        Leader.java, e.g. in https://github.com/apache/zookeeper.
+        https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zab1.0.
+ *)
+EXTENDS FastLeaderElection
+-----------------------------------------------------------------------------
+\* The set of requests that can go into history
+\* CONSTANT Value \* Replaced by recorder.nClientRequest
+Value == Nat
+ 
+\* Zab states
+CONSTANTS ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST
+
+\* Sync modes & message types
+CONSTANTS DIFF, TRUNC, SNAP
+
+\* Message types
+CONSTANTS FOLLOWERINFO, LEADERINFO, ACKEPOCH, NEWLEADER, ACKLD, 
+          UPTODATE, PROPOSAL, ACK, COMMIT
+(* NOTE: In production, there is no message type ACKLD. Server judges if counter 
+         of ACK is 0 to distinguish one ACK represents ACKLD or not. Here we
+         divide ACK into ACKLD and ACK, to enhance readability of spec.*)
+
+\* Node status
+CONSTANTS ONLINE, OFFLINE
+
+\* [MaxTimeoutFailures, MaxTransactionNum, MaxEpoch, MaxCrashes, MaxPartitions]
+CONSTANT Parameters
+
+MAXEPOCH == 10
+-----------------------------------------------------------------------------
+\* Variables in annotations mean variables defined in FastLeaderElection.
+\* Variables that all servers use.
+VARIABLES zabState,      \* Current phase of server, in
+                         \* {ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST}.
+          acceptedEpoch, \* Epoch of the last LEADERINFO packet accepted,
+                         \* namely f.p in paper.
+          lastCommitted, \* Maximum index and zxid known to be committed,
+                         \* namely 'lastCommitted' in Leader. Starts from 0,
+                         \* and increases monotonically before restarting.
+          lastSnapshot,  \* Index and zxid corresponding to latest snapshot
+                         \* from data tree.
+          initialHistory \* history that server initially has before election.
+          \* state,        \* State of server, in {LOOKING, FOLLOWING, LEADING}.
+          \* currentEpoch, \* Epoch of the last NEWLEADER packet accepted,
+                           \* namely f.a in paper.
+          \* lastProcessed,\* Index and zxid of the last processed txn.
+          \* history       \* History of servers: sequence of transactions,
+                           \* containing: zxid, value, ackSid, epoch.
+           \* leader  : [committedRequests + toBeApplied] [outstandingProposals]
+           \* follower: [committedRequests] [pendingTxns] 
+
+\* Variables only used for leader.
+VARIABLES learners,       \* Set of servers leader connects, 
+                          \* namely 'learners' in Leader.
+          connecting,     \* Set of learners leader has received 
+                          \* FOLLOWERINFO from, namely  
+                          \* 'connectingFollowers' in Leader.
+                          \* Set of record [sid, connected].
+          electing,       \* Set of learners leader has received
+                          \* ACKEPOCH from, namely 'electingFollowers'
+                          \* in Leader. Set of record 
+                          \* [sid, peerLastZxid, inQuorum].
+                          \* And peerLastZxid = <<-1,-1>> means has done
+                          \* syncFollower with this sid.
+                          \* inQuorum = TRUE means in code it is one
+                          \* element in 'electingFollowers'.
+          ackldRecv,      \* Set of learners leader has received
+                          \* ACK of NEWLEADER from, namely
+                          \* 'newLeaderProposal' in Leader.
+                          \* Set of record [sid, connected].         
+          forwarding,     \* Set of learners that are synced with
+                          \* leader, namely 'forwardingFollowers'
+                          \* in Leader.
+          tempMaxEpoch    \* ({Maximum epoch in FOLLOWEINFO} + 1) that 
+                          \* leader has received from learners,
+                          \* namely 'epoch' in Leader.
+          \* leadingVoteSet \* Set of voters that follow leader.
+
+\* Variables only used for follower.
+VARIABLES connectInfo, \* Record [sid, syncMode, nlRcv].
+                       \* sid: Leader id that follower has connected with.
+                       \* syncMode: Sync mode according to reveiced Sync Message.
+                       \* nlRcv: If follower has received NEWLEADER.
+          packetsSync  \* packets of PROPOSAL and COMMIT from leader,
+                       \* namely 'packetsNotCommitted' and
+                       \* 'packetsCommitted' in SyncWithLeader
+                       \* in Learner.
+
+\* Variables about network channel.
+VARIABLE msgs       \* Simulates network channel.
+                    \* msgs[i][j] means the input buffer of server j 
+                    \* from server i.
+         \* electionMsgs \* Network channel in FLE module.
+
+\* Variables about status of cluster network and node presence.
+VARIABLES status,    \* Whether the server is online or offline.
+          partition  \* network partion.
+
+\* Variables only used in verifying properties.
+VARIABLES epochLeader,       \* Set of leaders in every epoch.
+          proposalMsgsLog,   \* Set of all broadcast messages.
+          violatedInvariants \* Check whether there are conditions 
+                             \* contrary to the facts.
+\* Variables only used for looking.                             
+\*VARIABLE currentVote,   \* Info of current vote, namely 'currentVote'
+\*                        \* in QuorumPeer.
+\*         logicalClock,  \* Election instance, namely 'logicalClock'
+\*                        \* in FastLeaderElection.
+\*         receiveVotes,  \* Votes from current FLE round, namely
+\*                        \* 'recvset' in FastLeaderElection.
+\*         outOfElection, \* Votes from previous and current FLE round,
+\*                        \* namely 'outofelection' in FastLeaderElection.
+\*         recvQueue,     \* Queue of received notifications or timeout
+\*                        \* signals.
+\*         waitNotmsg     \* Whether waiting for new not.See line 1050
+\*                        \* in FastLeaderElection for details.
+\*VARIABLE idTable \* For mapping Server to Integers,
+                   \* to compare ids between servers.
+    \* Update: we have transformed idTable from variable to function.
+
+\*VARIABLE clientReuqest \* Start from 0, and increases monotonically
+                         \* when LeaderProcessRequest performed. To
+                         \* avoid existing two requests with same value. 
+    \* Update: Remove it to recorder.nClientRequest.
+
+\* Variable used for recording critical data,
+\* to constrain state space or update values.
+VARIABLE recorder \* Consists: members of Parameters and pc, values.
+                  \* Form is record: 
+                  \* [pc, nTransaction, maxEpoch, nTimeout, nClientRequest,
+                  \*  nPartition, nCrash]
+
+serverVars == <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch,
+                history, lastCommitted, lastSnapshot, initialHistory>>       
+electionVars == electionVarsL  
+leaderVars == <<leadingVoteSet, learners, connecting, electing, 
+                 ackldRecv, forwarding, tempMaxEpoch>>                                           
+followerVars == <<connectInfo, packetsSync>>                
+verifyVars == <<proposalMsgsLog, epochLeader, violatedInvariants>>   
+msgVars == <<msgs, electionMsgs>>
+envVars == <<status, partition>>                        
+
+vars == <<serverVars, electionVars, leaderVars, followerVars,
+          verifyVars, msgVars, envVars, recorder>> 
+-----------------------------------------------------------------------------
+ServersIncNullPoint == Server \union {NullPoint} 
+
+Zxid ==
+    Seq(Nat \union {-1}) 
+    
+HistoryItem ==
+     [ zxid: Zxid,
+       value: Value,
+       ackSid: SUBSET Server,
+       epoch: Nat ]    
+    
+Proposal ==
+    [ source: Server, 
+      epoch: Nat,
+      zxid: Zxid,
+      data: Value ]   
+
+LastItem ==
+    [ index: Nat, zxid: Zxid ]
+
+SyncPackets == 
+    [ notCommitted: Seq(HistoryItem),
+      committed: Seq(Zxid) ]
+
+Message ==
+    [ mtype: {FOLLOWERINFO}, mzxid: Zxid ] \union
+    [ mtype: {LEADERINFO}, mzxid: Zxid ] \union
+    [ mtype: {ACKEPOCH}, mzxid: Zxid, mepoch: Nat \union {-1} ] \union
+    [ mtype: {DIFF}, mzxid: Zxid ] \union 
+    [ mtype: {TRUNC}, mtruncZxid: Zxid ] \union 
+    [ mtype: {SNAP}, msnapZxid: Zxid, msnapshot: Seq(HistoryItem)] \union
+    [ mtype: {PROPOSAL}, mzxid: Zxid, mdata: Value ] \union 
+    [ mtype: {COMMIT}, mzxid: Zxid ] \union 
+    [ mtype: {NEWLEADER}, mzxid: Zxid ] \union 
+    [ mtype: {ACKLD}, mzxid: Zxid ] \union 
+    [ mtype: {ACK}, mzxid: Zxid ] \union 
+    [ mtype: {UPTODATE}, mzxid: Zxid ]
+ 
+ElectionState == {LOOKING, FOLLOWING, LEADING}
+
+ZabState == {ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST}
+
+ViolationSet == {"stateInconsistent", "proposalInconsistent", 
+                 "commitInconsistent", "ackInconsistent", 
+                 "messageIllegal" }
+
+SyncMode == {DIFF, TRUNC, SNAP, NONE}
+
+Connecting == [ sid : Server,
+                connected: BOOLEAN ]
+
+AckldRecv  == Connecting
+
+Electing == [ sid: Server,
+              peerLastZxid: Zxid,
+              inQuorum: BOOLEAN  ]
+
+ConnectInfo == [ sid : ServersIncNullPoint,
+                 syncMode: SyncMode,
+                 nlRcv: BOOLEAN ]
+
+Vote ==
+    [proposedLeader: ServersIncNullPoint,
+     proposedZxid: Zxid,
+     proposedEpoch: Nat ]
+     
+ElectionVote ==
+    [vote: Vote, round: Nat, state: ElectionState, version: Nat]
+
+ElectionMsg ==
+    [ mtype: {NOTIFICATION}, 
+      msource: Server, 
+      mstate: ElectionState, 
+      mround: Nat, 
+      mvote: Vote ] \union
+    [ mtype: {NONE} ]
+            
+TypeOK ==
+    /\ zabState \in [Server -> ZabState]
+    /\ acceptedEpoch \in [Server -> Nat]
+    /\ lastCommitted \in [Server -> LastItem]
+    /\ lastSnapshot \in [Server -> LastItem]
+    /\ learners \in [Server -> SUBSET Server]
+    /\ connecting \in [Server -> SUBSET Connecting]
+    /\ electing \in [Server -> SUBSET Electing]
+    /\ ackldRecv \in [Server -> SUBSET AckldRecv]
+    /\ forwarding \in [Server -> SUBSET Server]
+    /\ initialHistory \in [Server -> Seq(HistoryItem)] 
+    /\ tempMaxEpoch \in [Server -> Nat]
+    /\ connectInfo \in [Server -> ConnectInfo]
+    /\ packetsSync \in [Server -> SyncPackets]
+    /\ status \in [Server -> {ONLINE, OFFLINE}]
+    /\ partition \in [Server -> [Server -> BOOLEAN ]]
+    /\ proposalMsgsLog \in SUBSET Proposal
+    /\ epochLeader \in [1..MAXEPOCH -> SUBSET Server]
+    /\ violatedInvariants \in [ViolationSet -> BOOLEAN]
+    /\ msgs \in [Server -> [Server -> Seq(Message)]]
+    \* Fast Leader Election
+    /\ electionMsgs \in [Server -> [Server -> Seq(ElectionMsg)]]
+    /\ recvQueue \in [Server -> Seq(ElectionMsg)]
+    /\ leadingVoteSet \in [Server -> SUBSET Server]
+    /\ receiveVotes \in [Server -> [Server -> ElectionVote]]
+    /\ currentVote \in [Server -> Vote]
+    /\ outOfElection \in [Server -> [Server -> ElectionVote]]
+    /\ lastProcessed \in [Server -> LastItem]
+    /\ history \in [Server -> Seq(HistoryItem)]
+    /\ state \in [Server -> ElectionState]
+    /\ waitNotmsg \in [Server -> BOOLEAN]
+    /\ currentEpoch \in [Server -> Nat]
+    /\ logicalClock \in [Server -> Nat]
+-----------------------------------------------------------------------------
+\* Return the maximum value from the set S
+Maximum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n >= m
+
+\* Return the minimum value from the set S
+Minimum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n <= m
+
+\* Check server state
+IsON(s)  == status[s] = ONLINE 
+IsOFF(s) == status[s] = OFFLINE
+
+IsLeader(s)   == state[s] = LEADING
+IsFollower(s) == state[s] = FOLLOWING
+IsLooking(s)  == state[s] = LOOKING
+
+IsMyLearner(i, j) == j \in learners[i]
+IsMyLeader(i, j)  == connectInfo[i].sid = j
+HasNoLeader(i)    == connectInfo[i].sid = NullPoint
+HasLeader(i)      == connectInfo[i].sid /= NullPoint
+MyVote(i)         == currentVote[i].proposedLeader 
+
+\* Check if s is a quorum
+IsQuorum(s) == s \in Quorums
+
+HasPartitioned(i, j) == /\ partition[i][j] = TRUE 
+                        /\ partition[j][i] = TRUE
+-----------------------------------------------------------------------------
+\* Check zxid state
+ToZxid(z) == [epoch |-> z[1], counter |-> z[2]]
+
+TxnZxidEqual(txn, z) == txn.zxid[1] = z[1] /\ txn.zxid[2] = z[2]
+
+TxnEqual(txn1, txn2) == /\ ZxidEqual(txn1.zxid, txn2.zxid)
+                        /\ txn1.value = txn2.value
+
+EpochPrecedeInTxn(txn1, txn2) == txn1.zxid[1] < txn2.zxid[1]
+-----------------------------------------------------------------------------
+\* Actions about recorder
+GetParameter(p) == IF p \in DOMAIN Parameters THEN Parameters[p] ELSE 0
+GetRecorder(p)  == IF p \in DOMAIN recorder   THEN recorder[p]   ELSE 0
+
+RecorderGetHelper(m) == (m :> recorder[m])
+RecorderIncHelper(m) == (m :> recorder[m] + 1)
+
+RecorderIncTimeout == RecorderIncHelper("nTimeout")
+RecorderGetTimeout == RecorderGetHelper("nTimeout")
+RecorderIncCrash   == RecorderIncHelper("nCrash")
+RecorderGetCrash   == RecorderGetHelper("nCrash")
+
+RecorderSetTransactionNum(pc) == ("nTransaction" :> 
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    LET s == CHOOSE i \in Server: 
+                                        \A j \in Server: Len(history'[i]) >= Len(history'[j])                       
+                                    IN Len(history'[s])
+                                ELSE recorder["nTransaction"])
+RecorderSetMaxEpoch(pc)       == ("maxEpoch" :> 
+                                IF pc[1] = "LeaderProcessFOLLOWERINFO" THEN
+                                    LET s == CHOOSE i \in Server:
+                                        \A j \in Server: acceptedEpoch'[i] >= acceptedEpoch'[j]
+                                    IN acceptedEpoch'[s]
+                                ELSE recorder["maxEpoch"])
+RecorderSetRequests(pc)       == ("nClientRequest" :>
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    recorder["nClientRequest"] + 1
+                                ELSE recorder["nClientRequest"] )
+RecorderSetPartition(pc)      == ("nPartition" :> 
+                                IF pc[1] = "PartitionStart" THEN recorder["nPartition"] + 1
+                                                            ELSE recorder["nPartition"] )  
+RecorderSetPc(pc)      == ("pc" :> pc)
+RecorderSetFailure(pc) == CASE pc[1] = "Timeout"         -> RecorderIncTimeout @@ RecorderGetCrash
+                          []   pc[1] = "LeaderTimeout"   -> RecorderIncTimeout @@ RecorderGetCrash 
+                          []   pc[1] = "FollowerTimeout" -> RecorderIncTimeout @@ RecorderGetCrash 
+                          []   pc[1] = "PartitionStart"  -> IF IsLooking(pc[2]) 
+                                                            THEN RecorderGetTimeout @@ RecorderGetCrash
+                                                            ELSE RecorderIncTimeout @@ RecorderGetCrash
+                          []   pc[1] = "NodeCrash"       -> IF IsLooking(pc[2]) 
+                                                            THEN RecorderGetTimeout @@ RecorderIncCrash 
+                                                            ELSE RecorderIncTimeout @@ RecorderIncCrash 
+                          []   OTHER                     -> RecorderGetTimeout @@ RecorderGetCrash
+
+UpdateRecorder(pc) == recorder' = RecorderSetPartition(pc)
+                                  @@  RecorderSetFailure(pc)  @@ RecorderSetTransactionNum(pc)
+                                  @@ RecorderSetMaxEpoch(pc)  @@ RecorderSetPc(pc) 
+                                  @@ RecorderSetRequests(pc)  @@ recorder
+UnchangeRecorder   == UNCHANGED recorder
+
+CheckParameterHelper(n, p, Comp(_,_)) == IF p \in DOMAIN Parameters 
+                                         THEN Comp(n, Parameters[p])
+                                         ELSE TRUE
+CheckParameterLimit(n, p) == CheckParameterHelper(n, p, LAMBDA i, j: i < j)
+
+CheckTimeout        == CheckParameterLimit(recorder.nTimeout,     "MaxTimeoutFailures")
+CheckTransactionNum == CheckParameterLimit(recorder.nTransaction, "MaxTransactionNum")
+CheckEpoch          == CheckParameterLimit(recorder.maxEpoch,     "MaxEpoch")
+CheckPartition      == /\ CheckTimeout
+                       /\ CheckParameterLimit(recorder.nPartition,   "MaxPartitions")
+CheckCrash(i)       == /\ \/ IsLooking(i)
+                          \/ /\ ~IsLooking(i)
+                             /\ CheckTimeout
+                       /\ CheckParameterLimit(recorder.nCrash,    "MaxCrashes")
+
+CheckStateConstraints == CheckTimeout /\ CheckTransactionNum /\ CheckEpoch
+-----------------------------------------------------------------------------
+\* Actions about network
+PendingFOLLOWERINFO(i, j) == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = FOLLOWERINFO
+PendingLEADERINFO(i, j)   == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = LEADERINFO
+PendingACKEPOCH(i, j)     == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = ACKEPOCH
+PendingNEWLEADER(i, j)    == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = NEWLEADER
+PendingACKLD(i, j)        == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = ACKLD
+PendingUPTODATE(i, j)     == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = UPTODATE
+PendingPROPOSAL(i, j)     == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = PROPOSAL
+PendingACK(i, j)          == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = ACK
+PendingCOMMIT(i, j)       == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = COMMIT
+\* Add a message to msgs - add a message m to msgs.
+Send(i, j, m) == msgs' = [msgs EXCEPT ![i][j] = Append(msgs[i][j], m)]
+SendPackets(i, j, ms) == msgs' = [msgs EXCEPT ![i][j] = msgs[i][j] \o ms ]
+DiscardAndSendPackets(i, j, ms) == msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]), 
+                                                ![i][j] = msgs[i][j] \o ms ]
+\* Remove a message from msgs - discard head of msgs.
+Discard(i, j) == msgs' = IF msgs[i][j] /= << >> THEN [msgs EXCEPT ![i][j] = Tail(msgs[i][j])]
+                                                ELSE msgs
+\* Leader broadcasts a message(PROPOSAL/COMMIT) to all other servers in forwardingFollowers.
+Broadcast(i, m) == msgs' = [msgs EXCEPT ![i] = [v \in Server |-> IF /\ v \in forwarding[i]
+                                                                    /\ v /= i
+                                                                 THEN Append(msgs[i][v], m)
+                                                                 ELSE msgs[i][v]]]                                                           
+DiscardAndBroadcast(i, j, m) ==
+        msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                             ![i] = [v \in Server |-> IF /\ v \in forwarding[i]
+                                                         /\ v /= i
+                                                      THEN Append(msgs[i][v], m)
+                                                      ELSE msgs[i][v]]]            
+\* Leader broadcasts LEADERINFO to all other servers in connectingFollowers.
+DiscardAndBroadcastLEADERINFO(i, j, m) ==
+        LET new_connecting_quorum == {c \in connecting'[i]: c.connected = TRUE }
+            new_sid_connecting == {c.sid: c \in new_connecting_quorum }
+        IN 
+        msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                             ![i] = [v \in Server |-> IF /\ v \in new_sid_connecting
+                                                         /\ v \in learners[i] 
+                                                         /\ v /= i
+                                                      THEN Append(msgs[i][v], m)
+                                                      ELSE msgs[i][v] ] ]
+\* Leader broadcasts UPTODATE to all other servers in newLeaderProposal.
+DiscardAndBroadcastUPTODATE(i, j, m) ==
+        LET new_ackldRecv_quorum == {a \in ackldRecv'[i]: a.connected = TRUE }
+            new_sid_ackldRecv == {a.sid: a \in new_ackldRecv_quorum}
+        IN
+        msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                             ![i] = [v \in Server |-> IF /\ v \in new_sid_ackldRecv
+                                                         /\ v \in learners[i] 
+                                                         /\ v /= i
+                                                      THEN Append(msgs[i][v], m)
+                                                      ELSE msgs[i][v] ] ]
+\* Combination of Send and Discard - discard head of msgs[j][i] and add m into msgs.
+Reply(i, j, m) == msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                       ![i][j] = Append(msgs[i][j], m)]
+
+\* Shuffle input buffer.
+Clean(i, j) == msgs' = [msgs EXCEPT ![j][i] = << >>, ![i][j] = << >>]     
+CleanInputBuffer(i) == msgs' = [s \in Server |-> [v \in Server |-> IF v = i THEN << >>
+                                                                   ELSE msgs[s][v]]]  
+CleanInputBufferInCluster(S) == msgs' = [s \in Server |-> 
+                                            [v \in Server |-> IF v \in S THEN << >>
+                                                              ELSE msgs[s][v] ] ]                      
+-----------------------------------------------------------------------------
+\* Define initial values for all variables 
+InitServerVars == /\ InitServerVarsL
+                  /\ zabState      = [s \in Server |-> ELECTION]
+                  /\ acceptedEpoch = [s \in Server |-> 0]
+                  /\ lastCommitted = [s \in Server |-> [ index |-> 0,
+                                                         zxid  |-> <<0, 0>> ] ]
+                  /\ lastSnapshot  = [s \in Server |-> [ index |-> 0,
+                                                         zxid  |-> <<0, 0>> ] ]
+                  /\ initialHistory = [s \in Server |-> << >>]
+
+InitLeaderVars == /\ InitLeaderVarsL
+                  /\ learners         = [s \in Server |-> {}]
+                  /\ connecting       = [s \in Server |-> {}]
+                  /\ electing         = [s \in Server |-> {}]
+                  /\ ackldRecv        = [s \in Server |-> {}]
+                  /\ forwarding       = [s \in Server |-> {}]
+                  /\ tempMaxEpoch     = [s \in Server |-> 0]
+
+InitElectionVars == InitElectionVarsL
+
+InitFollowerVars == /\ connectInfo = [s \in Server |-> [sid |-> NullPoint,
+                                                        syncMode |-> NONE,
+                                                        nlRcv |-> FALSE ] ]
+                    /\ packetsSync = [s \in Server |->
+                                        [ notCommitted |-> << >>,
+                                          committed    |-> << >> ] ]
+
+InitVerifyVars == /\ proposalMsgsLog    = {}
+                  /\ epochLeader        = [e \in 1..MAXEPOCH |-> {} ]
+                  /\ violatedInvariants = [stateInconsistent    |-> FALSE,
+                                           proposalInconsistent |-> FALSE,
+                                           commitInconsistent   |-> FALSE,
+                                           ackInconsistent      |-> FALSE,
+                                           messageIllegal       |-> FALSE ]
+                   
+InitMsgVars == /\ msgs         = [s \in Server |-> [v \in Server |-> << >>] ]
+               /\ electionMsgs = [s \in Server |-> [v \in Server |-> << >>] ]
+
+InitEnvVars == /\ status    = [s \in Server |-> ONLINE ]
+               /\ partition = [s \in Server |-> [v \in Server |-> FALSE] ]
+                
+InitRecorder == recorder = [nTimeout       |-> 0,
+                            nTransaction   |-> 0,
+                            nPartition     |-> 0,
+                            maxEpoch       |-> 0,
+                            nCrash         |-> 0,
+                            pc             |-> <<"Init">>,
+                            nClientRequest |-> 0]
+
+Init == /\ InitServerVars
+        /\ InitLeaderVars
+        /\ InitElectionVars
+        /\ InitFollowerVars
+        /\ InitVerifyVars
+        /\ InitMsgVars
+        /\ InitEnvVars
+        /\ InitRecorder
+-----------------------------------------------------------------------------
+ZabTurnToLeading(i) ==
+        /\ zabState'       = [zabState   EXCEPT ![i] = DISCOVERY]
+        /\ learners'       = [learners   EXCEPT ![i] = {i}]
+        /\ connecting'     = [connecting EXCEPT ![i] = { [ sid       |-> i,
+                                                           connected |-> TRUE ] }]
+        /\ electing'       = [electing   EXCEPT ![i] = { [ sid          |-> i,
+                                                           peerLastZxid |-> <<-1,-1>>,
+                                                           inQuorum     |-> TRUE ] }]
+        /\ ackldRecv'      = [ackldRecv  EXCEPT ![i] = { [ sid       |-> i,
+                                                           connected |-> TRUE ] }]
+        /\ forwarding'     = [forwarding EXCEPT ![i] = {}]
+        /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+        /\ tempMaxEpoch'   = [tempMaxEpoch   EXCEPT ![i] = acceptedEpoch[i] + 1]
+
+ZabTurnToFollowing(i) ==
+        /\ zabState' = [zabState EXCEPT ![i] = DISCOVERY]
+        /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+        /\ packetsSync' = [packetsSync EXCEPT ![i].notCommitted = << >>, 
+                                              ![i].committed = << >> ]
+          
+(* Fast Leader Election *)
+FLEReceiveNotmsg(i, j) ==
+        /\ IsON(i)
+        /\ ReceiveNotmsg(i, j)
+        /\ UNCHANGED <<zabState, acceptedEpoch, lastCommitted, learners, connecting, 
+                      initialHistory, electing, ackldRecv, forwarding, tempMaxEpoch,
+                      lastSnapshot, followerVars, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLEReceiveNotmsg", i, j>>)
+
+FLENotmsgTimeout(i) ==
+        /\ IsON(i)
+        /\ NotmsgTimeout(i)
+        /\ UNCHANGED <<zabState, acceptedEpoch, lastCommitted, learners, connecting, 
+                       initialHistory, electing, ackldRecv, forwarding, tempMaxEpoch, 
+                       lastSnapshot, followerVars, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLENotmsgTimeout", i>>)
+
+FLEHandleNotmsg(i) ==
+        /\ IsON(i)
+        /\ HandleNotmsg(i)
+        /\ LET newState == state'[i]
+           IN
+           \/ /\ newState = LEADING
+              /\ ZabTurnToLeading(i)
+              /\ UNCHANGED packetsSync
+           \/ /\ newState = FOLLOWING
+              /\ ZabTurnToFollowing(i)
+              /\ UNCHANGED <<learners, connecting, electing, ackldRecv, 
+                            forwarding, tempMaxEpoch>>
+           \/ /\ newState = LOOKING
+              /\ UNCHANGED <<zabState, learners, connecting, electing, ackldRecv,
+                             forwarding, tempMaxEpoch, packetsSync, initialHistory>>
+        /\ UNCHANGED <<lastCommitted, lastSnapshot, acceptedEpoch,
+                       connectInfo, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLEHandleNotmsg", i>>)
+
+\* On the premise that ReceiveVotes.HasQuorums = TRUE, 
+\* corresponding to logic in FastLeaderElection.
+FLEWaitNewNotmsg(i) ==
+        /\ IsON(i)
+        /\ WaitNewNotmsg(i)
+        /\ LET newState == state'[i]
+           IN
+           \/ /\ newState = LEADING
+              /\ ZabTurnToLeading(i)
+              /\ UNCHANGED packetsSync
+           \/ /\ newState = FOLLOWING
+              /\ ZabTurnToFollowing(i)
+              /\ UNCHANGED <<learners, connecting, electing, ackldRecv, forwarding,
+                             tempMaxEpoch>>
+           \/ /\ newState = LOOKING
+              /\ PrintT("Note: New state is LOOKING in FLEWaitNewNotmsgEnd," \o 
+                    " which should not happen.")
+              /\ UNCHANGED <<zabState, learners, connecting, electing, ackldRecv,
+                             forwarding, tempMaxEpoch, initialHistory, packetsSync>>
+        /\ UNCHANGED <<lastCommitted, lastSnapshot, acceptedEpoch,
+                       connectInfo, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLEWaitNewNotmsg", i>>)
+-----------------------------------------------------------------------------
+InitialVotes == [ vote    |-> InitialVote,
+                  round   |-> 0,
+                  state   |-> LOOKING,
+                  version |-> 0 ]
+
+InitialConnectInfo == [sid        |-> NullPoint,
+                       syncMode   |-> NONE,
+                       nlRcv      |-> FALSE ]
+
+\* Equals to for every server in S, performing action ZabTimeout.
+ZabTimeoutInCluster(S) ==
+        /\ state' = [s \in Server |-> IF s \in S THEN LOOKING ELSE state[s] ]
+        /\ lastProcessed' = [s \in Server |-> IF s \in S THEN InitLastProcessed(s)
+                                                         ELSE lastProcessed[s] ]
+        /\ logicalClock' = [s \in Server |-> IF s \in S THEN logicalClock[s] + 1 
+                                                        ELSE logicalClock[s] ]
+        /\ currentVote' = [s \in Server |-> IF s \in S THEN
+                                                       [proposedLeader |-> s,
+                                                        proposedZxid   |-> lastProcessed'[s].zxid,
+                                                        proposedEpoch  |-> currentEpoch[s] ]
+                                                       ELSE currentVote[s] ]
+        /\ receiveVotes' = [s \in Server |-> IF s \in S THEN [v \in Server |-> InitialVotes]
+                                                        ELSE receiveVotes[s] ]
+        /\ outOfElection' = [s \in Server |-> IF s \in S THEN [v \in Server |-> InitialVotes]
+                                                         ELSE outOfElection[s] ]
+        /\ recvQueue' = [s \in Server |-> IF s \in S THEN << [mtype |-> NONE] >> 
+                                                     ELSE recvQueue[s] ]
+        /\ waitNotmsg' = [s \in Server |-> IF s \in S THEN FALSE ELSE waitNotmsg[s] ]
+        /\ leadingVoteSet' = [s \in Server |-> IF s \in S THEN {} ELSE leadingVoteSet[s] ]
+        /\ UNCHANGED <<electionMsgs, currentEpoch, history>>
+        /\ zabState' = [s \in Server |-> IF s \in S THEN ELECTION ELSE zabState[s] ]
+        /\ connectInfo' = [s \in Server |-> IF s \in S THEN InitialConnectInfo
+                                                       ELSE connectInfo[s] ]
+        /\ CleanInputBufferInCluster(S)
+
+(* Describe how a server transitions from LEADING/FOLLOWING to LOOKING.*)
+FollowerShutdown(i) ==
+        /\ ZabTimeout(i)
+        /\ zabState'    = [zabState    EXCEPT ![i] = ELECTION]
+        /\ connectInfo' = [connectInfo EXCEPT ![i] = InitialConnectInfo]
+
+LeaderShutdown(i) ==
+        /\ LET cluster == {i} \union learners[i]
+           IN ZabTimeoutInCluster(cluster)
+        /\ learners'   = [learners   EXCEPT ![i] = {}]
+        /\ forwarding' = [forwarding EXCEPT ![i] = {}]
+
+RemoveElecting(set, sid) ==
+        LET sid_electing == {s.sid: s \in set }
+        IN IF sid \notin sid_electing THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid          |-> sid,
+                                  peerLastZxid |-> <<-1, -1>>,
+                                  inQuorum     |-> info.inQuorum ]
+                IN (set \ {info}) \union {new_info}
+RemoveConnectingOrAckldRecv(set, sid) ==
+        LET sid_set == {s.sid: s \in set}
+        IN IF sid \notin sid_set THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid       |-> sid,
+                                  connected |-> FALSE ]
+                IN (set \ {info}) \union {new_info}
+
+\* See removeLearnerHandler for details.
+RemoveLearner(i, j) ==
+        /\ learners'   = [learners   EXCEPT ![i] = @ \ {j}] 
+        /\ forwarding' = [forwarding EXCEPT ![i] = IF j \in forwarding[i] 
+                                                   THEN @ \ {j} ELSE @ ]
+        /\ electing'   = [electing   EXCEPT ![i] = RemoveElecting(@, j) ]
+        /\ connecting' = [connecting EXCEPT ![i] = RemoveConnectingOrAckldRecv(@, j) ]
+        /\ ackldRecv'  = [ackldRecv  EXCEPT ![i] = RemoveConnectingOrAckldRecv(@, j) ]
+-----------------------------------------------------------------------------
+\* Actions of situation error. 
+PartitionStart(i, j) ==
+        /\ CheckPartition \* test restrictions of partition
+        /\ i /= j
+        /\ IsON(i)
+        /\ IsON(j)
+        /\ \lnot HasPartitioned(i, j)
+        /\ \/ /\ IsLeader(i)   /\ IsMyLearner(i, j)
+              /\ IsFollower(j) /\ IsMyLeader(j, i)
+              /\ LET newLearners == learners[i] \ {j}
+                 IN \/ /\ IsQuorum(newLearners)   \* just remove this learner
+                       /\ RemoveLearner(i, j)
+                       /\ FollowerShutdown(j)
+                       /\ Clean(i ,j)
+                    \/ /\ ~IsQuorum(newLearners)  \* leader switches to looking
+                       /\ LeaderShutdown(i)
+                       /\ UNCHANGED <<connecting, electing, ackldRecv>>
+           \/ /\ IsLooking(i)
+              /\ IsLooking(j)
+              /\ IdCompare(i, j)
+              /\ UNCHANGED <<varsL, zabState, connectInfo, msgs, learners,
+                             forwarding, connecting, electing, ackldRecv>>
+        /\ partition' = [partition EXCEPT ![i][j] = TRUE, ![j][i] = TRUE ]
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, lastSnapshot, tempMaxEpoch,
+                       initialHistory, verifyVars, packetsSync, status>>
+        /\ UpdateRecorder(<<"PartitionStart", i, j>>)
+
+PartitionRecover(i, j) ==
+        /\ IsON(i)
+        /\ IsON(j)
+        /\ IdCompare(i, j)
+        /\ HasPartitioned(i, j)
+        /\ partition' = [partition EXCEPT ![i][j] = FALSE, ![j][i] = FALSE ]
+        /\ UNCHANGED <<serverVars, leaderVars, electionVars, followerVars,
+                       verifyVars, msgVars, status>>
+        /\ UpdateRecorder(<<"PartitionRecover", i, j>>)
+
+NodeCrash(i) ==
+        /\ CheckCrash(i)
+        /\ IsON(i)
+        /\ status' = [status EXCEPT ![i] = OFFLINE ]
+        /\ \/ /\ IsLooking(i)
+              /\ UNCHANGED <<varsL, zabState, connectInfo, msgs, learners,
+                             forwarding, connecting, electing, ackldRecv>>
+           \/ /\ IsFollower(i)
+              /\ LET connectedWithLeader == HasLeader(i)
+                 IN \/ /\ connectedWithLeader
+                       /\ LET leader == connectInfo[i].sid
+                              newCluster == learners[leader] \ {i}
+                          IN 
+                          \/ /\ IsQuorum(newCluster)
+                             /\ RemoveLearner(leader, i) 
+                             /\ FollowerShutdown(i)
+                             /\ Clean(leader, i)
+                          \/ /\ ~IsQuorum(newCluster)
+                             /\ LeaderShutdown(leader)
+                             /\ UNCHANGED <<electing, connecting, ackldRecv>>
+                    \/ /\ ~connectedWithLeader
+                       /\ FollowerShutdown(i)
+                       /\ CleanInputBuffer({i})
+                       /\ UNCHANGED <<learners, forwarding, connecting, electing, ackldRecv>>
+           \/ /\ IsLeader(i)
+              /\ LeaderShutdown(i)
+              /\ UNCHANGED <<electing, connecting, ackldRecv>>
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, lastSnapshot, tempMaxEpoch,
+                       initialHistory, verifyVars, packetsSync, partition>>
+        /\ UpdateRecorder(<<"NodeCrash", i>>)
+
+NodeStart(i) ==
+        /\ IsOFF(i)
+        /\ status' = [status EXCEPT ![i] = ONLINE ]
+        /\ lastProcessed' = [lastProcessed  EXCEPT ![i] = InitLastProcessed(i)]
+        /\ lastCommitted' = [lastCommitted  EXCEPT ![i] = lastSnapshot[i]]
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, history, 
+                       lastSnapshot, initialHistory, leaderVars, electionVars, 
+                       followerVars, verifyVars, msgVars, partition>>
+        /\ UpdateRecorder(<<"NodeStart", i>>)
+-----------------------------------------------------------------------------
+(* Establish connection between leader and follower, containing actions like 
+   addLearnerHandler, findLeader, connectToLeader.*)
+ConnectAndFollowerSendFOLLOWERINFO(i, j) ==
+        /\ IsON(i)     /\ IsON(j)
+        /\ IsLeader(i) /\ \lnot IsMyLearner(i, j)
+        /\ IsFollower(j) /\ HasNoLeader(j) /\ MyVote(j) = i
+        /\ learners'   = [learners   EXCEPT ![i] = learners[i] \union {j}] 
+        /\ connectInfo' = [connectInfo EXCEPT ![j].sid = i]
+        /\ Send(j, i, [ mtype |-> FOLLOWERINFO,
+                        mzxid |-> <<acceptedEpoch[j], 0>> ])  
+        /\ UNCHANGED <<serverVars, electionVars, leadingVoteSet, connecting, 
+                       electing, ackldRecv, forwarding, tempMaxEpoch,
+                       verifyVars, envVars, electionMsgs, packetsSync>>
+        /\ UpdateRecorder(<<"ConnectAndFollowerSendFOLLOWERINFO", i, j>>)
+
+\* waitingForNewEpoch in Leader
+WaitingForNewEpoch(i, set) == (i \in set /\ IsQuorum(set)) = FALSE
+WaitingForNewEpochTurnToFalse(i, set) == /\ i \in set
+                                         /\ IsQuorum(set) 
+
+\* There may exists some follower in connecting but shuts down and
+\* connects again. So when leader broadcasts LEADERINFO, the
+\* follower will receive LEADERINFO, and receive it again after
+\* sending FOLLOWERINFO. So connected makes sure each follower
+\* will only receive LEADERINFO at most once before timeout. 
+UpdateConnectingOrAckldRecv(oldSet, sid) ==
+        LET sid_set == {s.sid: s \in oldSet}
+        IN IF sid \in sid_set
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                    follower_info == [ sid       |-> sid,
+                                       connected |-> TRUE ]
+                IN (oldSet \ {old_info} ) \union {follower_info}
+           ELSE LET follower_info == [ sid       |-> sid,
+                                       connected |-> TRUE ]
+                IN oldSet \union {follower_info}
+
+(* Leader waits for receiving FOLLOWERINFO from a quorum including itself,
+   and chooses a new epoch e' as its own epoch and broadcasts LEADERINFO.
+   See getEpochToPropose in Leader for details. *)
+LeaderProcessFOLLOWERINFO(i, j) ==
+        /\ CheckEpoch  \* test restrictions of max epoch
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingFOLLOWERINFO(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               lastAcceptedEpoch == msg.mzxid[1]
+               sid_connecting == {c.sid: c \in connecting[i]}
+           IN 
+           /\ infoOk
+           /\ \/ \* 1. has not broadcast LEADERINFO 
+                 /\ WaitingForNewEpoch(i, sid_connecting)
+                 /\ \/ /\ zabState[i] = DISCOVERY
+                       /\ UNCHANGED violatedInvariants
+                    \/ /\ zabState[i] /= DISCOVERY
+                       /\ PrintT("Exception: waitingFotNewEpoch true," \o
+                          " while zabState not DISCOVERY.")
+                       /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
+                 /\ tempMaxEpoch' = [tempMaxEpoch EXCEPT ![i] = IF lastAcceptedEpoch >= tempMaxEpoch[i] 
+                                                                THEN lastAcceptedEpoch + 1
+                                                                ELSE @]
+                 /\ connecting'   = [connecting   EXCEPT ![i] = UpdateConnectingOrAckldRecv(@, j) ]
+                 /\ LET new_sid_connecting == {c.sid: c \in connecting'[i]}
+                    IN
+                    \/ /\ WaitingForNewEpochTurnToFalse(i, new_sid_connecting)
+                       /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = tempMaxEpoch'[i]]
+                       /\ LET newLeaderZxid == <<acceptedEpoch'[i], 0>>
+                              m == [ mtype |-> LEADERINFO,
+                                     mzxid |-> newLeaderZxid ]
+                          IN DiscardAndBroadcastLEADERINFO(i, j, m)
+                    \/ /\ ~WaitingForNewEpochTurnToFalse(i, new_sid_connecting)
+                       /\ Discard(j, i)
+                       /\ UNCHANGED acceptedEpoch
+              \/  \* 2. has broadcast LEADERINFO 
+                 /\ ~WaitingForNewEpoch(i, sid_connecting)
+                 /\ Reply(i, j, [ mtype |-> LEADERINFO,
+                                  mzxid |-> <<acceptedEpoch[i], 0>> ] )
+                 /\ UNCHANGED <<tempMaxEpoch, connecting, acceptedEpoch, violatedInvariants>>
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, history, lastCommitted, 
+                       followerVars, electionVars, initialHistory, leadingVoteSet, learners, 
+                       electing, ackldRecv, forwarding, proposalMsgsLog, epochLeader, 
+                       lastSnapshot, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessFOLLOWERINFO", i, j>>)
+        
+(* Follower receives LEADERINFO. If newEpoch >= acceptedEpoch, then follower 
+   updates acceptedEpoch and sends ACKEPOCH back, containing currentEpoch and
+   lastProcessedZxid. After this, zabState turns to SYNC. 
+   See registerWithLeader in Learner for details.*)
+FollowerProcessLEADERINFO(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingLEADERINFO(i, j)
+        /\ LET msg      == msgs[j][i][1]
+               newEpoch == msg.mzxid[1]
+               infoOk   == IsMyLeader(i, j)
+               epochOk  == newEpoch >= acceptedEpoch[i]
+               stateOk  == zabState[i] = DISCOVERY
+           IN /\ infoOk
+              /\ \/ \* 1. Normal case
+                    /\ epochOk   
+                    /\ \/ /\ stateOk
+                          /\ \/ /\ newEpoch > acceptedEpoch[i]
+                                /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = newEpoch]
+                                /\ LET epochBytes == currentEpoch[i]
+                                       m == [ mtype  |-> ACKEPOCH,
+                                              mzxid  |-> lastProcessed[i].zxid, 
+                                              mepoch |-> epochBytes ] 
+                                   IN Reply(i, j, m)
+                             \/ /\ newEpoch = acceptedEpoch[i]
+                                /\ LET m == [ mtype  |-> ACKEPOCH,
+                                              mzxid  |-> lastProcessed[i].zxid,
+                                              mepoch |-> -1 ]
+                                   IN Reply(i, j, m)
+                                /\ UNCHANGED acceptedEpoch
+                          /\ zabState' = [zabState EXCEPT ![i] = SYNCHRONIZATION]
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~stateOk
+                          /\ PrintT("Exception: Follower receives LEADERINFO," \o
+                             " whileZabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<acceptedEpoch, zabState>>
+                    /\ UNCHANGED <<varsL, connectInfo, learners, forwarding, electing,
+                                   connecting, ackldRecv>>
+                 \/ \* 2. Abnormal case - go back to election
+                    /\ ~epochOk 
+                    /\ FollowerShutdown(i)
+                    /\ Clean(i, connectInfo[i].sid)
+                    /\ RemoveLearner(connectInfo[i].sid, i)
+                    /\ UNCHANGED <<acceptedEpoch, violatedInvariants>>
+        /\ UNCHANGED <<history, lastCommitted, tempMaxEpoch, initialHistory, lastSnapshot,
+                       proposalMsgsLog, epochLeader, packetsSync, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessLEADERINFO", i, j>>)
+-----------------------------------------------------------------------------    
+RECURSIVE UpdateAckSidHelper(_,_,_,_)
+UpdateAckSidHelper(his, cur, end, target) ==
+        IF cur > end THEN his
+        ELSE LET curTxn == [ zxid   |-> his[1].zxid,
+                             value  |-> his[1].value,
+                             ackSid |-> IF target \in his[1].ackSid THEN his[1].ackSid
+                                        ELSE his[1].ackSid \union {target},
+                             epoch  |-> his[1].epoch ]
+             IN <<curTxn>> \o UpdateAckSidHelper(Tail(his), cur + 1, end, target)
+
+\* There originally existed one bug in LeaderProcessACK when 
+\* monotonicallyInc = FALSE, and it is we did not add ackSid of 
+\* history in SYNC. So we update ackSid in syncFollower.
+UpdateAckSid(his, lastSeenIndex, target) ==
+        IF Len(his) = 0 \/ lastSeenIndex = 0 THEN his
+        ELSE UpdateAckSidHelper(his, 1, Minimum( { Len(his), lastSeenIndex} ), target)
+
+\* return -1: this zxid appears at least twice; Len(his) + 1: does not exist;
+\* 1 ~ Len(his): exists and appears just once.
+RECURSIVE ZxidToIndexHepler(_,_,_,_)
+ZxidToIndexHepler(his, zxid, cur, appeared) == 
+        IF cur > Len(his) THEN cur  
+        ELSE IF TxnZxidEqual(his[cur], zxid) 
+             THEN CASE appeared = TRUE -> -1
+                  []   OTHER           -> Minimum( { cur, 
+                            ZxidToIndexHepler(his, zxid, cur + 1, TRUE) } ) 
+             ELSE ZxidToIndexHepler(his, zxid, cur + 1, appeared)
+
+ZxidToIndex(his, zxid) == IF ZxidEqual( zxid, <<0, 0>> ) THEN 0
+                          ELSE IF Len(his) = 0 THEN 1
+                               ELSE LET len == Len(his) IN
+                                    IF \E idx \in 1..len: TxnZxidEqual(his[idx], zxid)
+                                    THEN ZxidToIndexHepler(his, zxid, 1, FALSE)
+                                    ELSE len + 1
+
+\* Find index idx which meets: 
+\* history[idx].zxid <= zxid < history[idx + 1].zxid
+RECURSIVE IndexOfZxidHelper(_,_,_,_)
+IndexOfZxidHelper(his, zxid, cur, end) ==
+        IF cur > end THEN end
+        ELSE IF ZxidCompare(his[cur].zxid, zxid) THEN cur - 1
+             ELSE IndexOfZxidHelper(his, zxid, cur + 1, end)
+
+IndexOfZxid(his, zxid) == IF Len(his) = 0 THEN 0
+                          ELSE LET idx == ZxidToIndex(his, zxid)
+                                   len == Len(his)
+                               IN 
+                               IF idx <= len THEN idx
+                               ELSE IndexOfZxidHelper(his, zxid, 1, len)
+
+RECURSIVE queuePackets(_,_,_,_,_)
+queuePackets(queue, his, cur, committed, end) == 
+        IF cur > end THEN queue
+        ELSE CASE cur > committed ->
+                LET m_proposal == [ mtype |-> PROPOSAL, 
+                                    mzxid |-> his[cur].zxid,
+                                    mdata |-> his[cur].value ]
+                IN queuePackets(Append(queue, m_proposal), his, cur + 1, committed, end)
+             []   cur <= committed ->
+                LET m_proposal == [ mtype |-> PROPOSAL, 
+                                    mzxid |-> his[cur].zxid,
+                                    mdata |-> his[cur].value ]
+                    m_commit   == [ mtype |-> COMMIT,
+                                    mzxid |-> his[cur].zxid ]
+                    newQueue   == queue \o <<m_proposal, m_commit>>
+                IN queuePackets(newQueue, his, cur + 1, committed, end)
+
+RECURSIVE setPacketsForChecking(_,_,_,_,_,_)
+setPacketsForChecking(set, src, ep, his, cur, end) ==
+        IF cur > end THEN set
+        ELSE LET m_proposal == [ source |-> src,
+                                 epoch  |-> ep,
+                                 zxid   |-> his[cur].zxid,
+                                 data   |-> his[cur].value ]
+             IN setPacketsForChecking((set \union {m_proposal}), src, ep, his, cur + 1, end)
+
+\* Func lead() calls zk.loadData(), which will call takeSnapshot().
+LastSnapshot(i) == IF zabState[i] = BROADCAST THEN lastSnapshot[i]
+                   ELSE CASE IsLeader(i) -> 
+                            LET lastIndex == Len(history[i])
+                            IN IF lastIndex = 0 THEN [ index |-> 0,
+                                                       zxid  |-> <<0, 0>> ]
+                               ELSE [ index |-> lastIndex,
+                                      zxid  |-> history[i][lastIndex].zxid ]
+                        []   OTHER -> lastSnapshot[i]
+
+\* To compress state space, 
+\* 1. we merge sending SNAP and outputing snapshot buffer into sending SNAP, and
+\* 2. substitute sub sequence of history for snapshot of data tree.
+SerializeSnapshot(i, idx) == IF idx <= 0 THEN << >>
+                             ELSE SubSeq(history[i], 1, idx)
+
+(* See queueCommittedProposals in LearnerHandler and startForwarding in Leader
+   for details. For proposals in committedLog and toBeApplied, send <PROPOSAL,
+   COMMIT>. For proposals in outstandingProposals, send PROPOSAL only. *)
+SendSyncMsgs(i, j, lastSeenZxid, lastSeenIndex, mode, needRemoveHead) ==
+        /\ LET lastCommittedIndex == IF zabState[i] = BROADCAST 
+                                     THEN lastCommitted[i].index
+                                     ELSE Len(history[i])
+               lastProposedIndex  == Len(history[i])
+               queue_origin == IF lastSeenIndex >= lastProposedIndex 
+                               THEN << >>
+                               ELSE queuePackets(<< >>, history[i], 
+                                    lastSeenIndex + 1, lastCommittedIndex,
+                                    lastProposedIndex)
+               set_forChecking == IF lastSeenIndex >= lastProposedIndex 
+                                  THEN {}
+                                  ELSE setPacketsForChecking( { }, i, 
+                                        acceptedEpoch[i], history[i],
+                                        lastSeenIndex + 1, lastProposedIndex)
+               m_trunc == [ mtype |-> TRUNC, mtruncZxid |-> lastSeenZxid ]
+               m_diff  == [ mtype |-> DIFF,  mzxid |-> lastSeenZxid ]
+               m_snap  == [ mtype |-> SNAP,  msnapZxid |-> lastSeenZxid,
+                                             msnapshot |-> SerializeSnapshot(i, lastSeenIndex) ]
+               newLeaderZxid == <<acceptedEpoch[i], 0>>
+               m_newleader == [ mtype |-> NEWLEADER,
+                                mzxid |-> newLeaderZxid ]
+               queue_toSend == CASE mode = TRUNC -> (<<m_trunc>> \o queue_origin) \o <<m_newleader>>
+                               []   mode = DIFF  -> (<<m_diff>>  \o queue_origin) \o <<m_newleader>>
+                               []   mode = SNAP  -> (<<m_snap>>  \o queue_origin) \o <<m_newleader>>
+           IN /\ \/ /\ needRemoveHead
+                    /\ DiscardAndSendPackets(i, j, queue_toSend)
+                 \/ /\ ~needRemoveHead
+                    /\ SendPackets(i, j, queue_toSend)
+              /\ proposalMsgsLog' = proposalMsgsLog \union set_forChecking
+        /\ forwarding' = [forwarding EXCEPT ![i] = @ \union {j} ]
+        /\ \/ /\ mode = TRUNC \/ mode = DIFF 
+              /\ history' = [history EXCEPT ![i] = UpdateAckSid(@, lastSeenIndex, j) ]
+           \/ /\ mode = SNAP
+              /\ UNCHANGED history \* txns before minCommitted don't need to be committed again
+
+(* Leader syncs with follower by sending DIFF/TRUNC/SNAP/PROPOSAL/COMMIT/NEWLEADER.
+   See syncFollower in LearnerHandler for details. *)
+SyncFollower(i, j, peerLastZxid, needRemoveHead) ==
+        LET \* IsPeerNewEpochZxid == peerLastZxid[2] = 0
+            lastProcessedZxid == lastProcessed[i].zxid
+            minCommittedIdx   == lastSnapshot[i].index + 1
+            maxCommittedIdx   == IF zabState[i] = BROADCAST THEN lastCommitted[i].index
+                                 ELSE Len(history[i])
+            committedLogEmpty == minCommittedIdx > maxCommittedIdx
+            minCommittedLog   == IF committedLogEmpty THEN lastProcessedZxid
+                                 ELSE history[i][minCommittedIdx].zxid
+            maxCommittedLog   == IF committedLogEmpty THEN lastProcessedZxid
+                                 ELSE IF maxCommittedIdx = 0 THEN << 0, 0>>
+                                      ELSE history[i][maxCommittedIdx].zxid
+
+            \* Hypothesis: 1. minCommittedLog : txn with index of lastSnapshot + 1
+            \*             2. maxCommittedLog : LastCommitted, to compress state space.
+            \*             3. merge queueCommittedProposals,startForwarding and 
+            \*                sending NEWLEADER into SendSyncMsgs.
+
+        IN \/ \* case1. peerLastZxid = lastProcessedZxid,
+              \*        sned DIFF & StartForwarding(lastProcessedZxid)
+              /\ ZxidEqual(peerLastZxid, lastProcessedZxid)
+              /\ SendSyncMsgs(i, j, peerLastZxid, lastProcessed[i].index, 
+                                    DIFF, needRemoveHead)
+           \/ /\ ~ZxidEqual(peerLastZxid, lastProcessedZxid)
+              /\ \/ \* case2. peerLastZxid > maxCommittedLog,
+                    \*        send TRUNC(maxCommittedLog) & StartForwarding
+                    /\ ZxidCompare(peerLastZxid, maxCommittedLog)
+                    /\ SendSyncMsgs(i, j, maxCommittedLog, maxCommittedIdx, 
+                                          TRUNC, needRemoveHead)
+                 \/ \* case3. minCommittedLog <= peerLastZxid <= maxCommittedLog
+                    /\ ~ZxidCompare(peerLastZxid, maxCommittedLog)
+                    /\ ~ZxidCompare(minCommittedLog, peerLastZxid)
+                    /\ LET lastSeenIndex == ZxidToIndex(history[i], peerLastZxid)
+                           exist == /\ lastSeenIndex >= minCommittedIdx
+                                    /\ lastSeenIndex <= Len(history[i])
+                           lastIndex == IF exist THEN lastSeenIndex
+                                        ELSE IndexOfZxid(history[i], peerLastZxid)
+                           \* Maximum zxid that < peerLastZxid
+                           lastZxid  == IF exist THEN peerLastZxid
+                                        ELSE IF lastIndex = 0 THEN <<0, 0>>
+                                             ELSE history[i][lastIndex].zxid
+                       IN 
+                       \/ \* case 3.1. peerLastZxid exists in committedLog,
+                          \*           DIFF + queueCommittedProposals(peerLastZxid + 1)
+                          \*                + StartForwarding
+                          /\ exist
+                          /\ SendSyncMsgs(i, j, peerLastZxid, lastSeenIndex, 
+                                                DIFF, needRemoveHead)
+                       \/ \* case 3.2. peerLastZxid does not exist in committedLog,
+                          \*           TRUNC(lastZxid) + queueCommittedProposals(lastZxid + 1)
+                          \*                           + StartForwarding
+                          /\ ~exist
+                          /\ SendSyncMsgs(i, j, lastZxid, lastIndex, 
+                                                TRUNC, needRemoveHead)
+                 \/ \* case4. peerLastZxid < minCommittedLog,
+                    \*        send SNAP(lastProcessed) + StartForwarding
+                    /\ ZxidCompare(minCommittedLog, peerLastZxid)
+                    /\ SendSyncMsgs(i, j, lastProcessedZxid, maxCommittedIdx,
+                                          SNAP, needRemoveHead)
+
+\* compare state summary of two servers
+IsMoreRecentThan(ss1, ss2) == \/ ss1.currentEpoch > ss2.currentEpoch
+                              \/ /\ ss1.currentEpoch = ss2.currentEpoch
+                                 /\ ZxidCompare(ss1.lastZxid, ss2.lastZxid)
+
+\* electionFinished in Leader
+ElectionFinished(i, set) == /\ i \in set
+                            /\ IsQuorum(set)
+
+\* There may exist some follower shuts down and connects again, while
+\* it has sent ACKEPOCH or updated currentEpoch last time. This means
+\* sid of this follower has existed in elecingFollower but its info 
+\* is old. So we need to make sure each sid in electingFollower is 
+\* unique and latest(newest).
+UpdateElecting(oldSet, sid, peerLastZxid, inQuorum) ==
+        LET sid_electing == {s.sid: s \in oldSet }
+        IN IF sid \in sid_electing 
+           THEN LET old_info == CHOOSE info \in oldSet : info.sid = sid
+                    follower_info == 
+                             [ sid          |-> sid,
+                               peerLastZxid |-> peerLastZxid,
+                               inQuorum     |-> (inQuorum \/ old_info.inQuorum) ]
+                IN (oldSet \ {old_info} ) \union {follower_info}
+           ELSE LET follower_info == 
+                             [ sid          |-> sid,
+                               peerLastZxid |-> peerLastZxid,
+                               inQuorum     |-> inQuorum ]
+                IN oldSet \union {follower_info}
+
+LeaderTurnToSynchronization(i) ==
+        /\ currentEpoch' = [currentEpoch EXCEPT ![i] = acceptedEpoch[i]]
+        /\ zabState'     = [zabState     EXCEPT ![i] = SYNCHRONIZATION]
+
+(* Leader waits for receiving ACKEPOPCH from a quorum, and check whether it has most recent
+   state summary from them. After this, leader's zabState turns to SYNCHRONIZATION.
+   See waitForEpochAck in Leader for details. *)
+LeaderProcessACKEPOCH(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingACKEPOCH(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)           
+               leaderStateSummary   == [ currentEpoch |-> currentEpoch[i], 
+                                         lastZxid     |-> lastProcessed[i].zxid ]
+               followerStateSummary == [ currentEpoch |-> msg.mepoch,  
+                                         lastZxid     |-> msg.mzxid ]
+               logOk == \* whether follower is no more up-to-date than leader
+                        ~IsMoreRecentThan(followerStateSummary, leaderStateSummary)
+               electing_quorum == {e \in electing[i]: e.inQuorum = TRUE }
+               sid_electing == {s.sid: s \in electing_quorum }
+           IN /\ infoOk
+              /\ \/ \* electionFinished = true, jump ouf of waitForEpochAck. 
+                    \* Different from code, here we still need to record info
+                    \* into electing, to help us perform syncFollower afterwards.
+                    \* Since electing already meets quorum, it does not break
+                    \* consistency between code and spec.
+                    /\ ElectionFinished(i, sid_electing)
+                    /\ electing' = [electing EXCEPT ![i] = UpdateElecting(@, j, msg.mzxid, FALSE) ]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED <<varsL, zabState, forwarding, connectInfo, 
+                                   learners, epochLeader, violatedInvariants>>
+                 \/ /\ ~ElectionFinished(i, sid_electing)
+                    /\ \/ /\ zabState[i] = DISCOVERY
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= DISCOVERY
+                          /\ PrintT("Exception: electionFinished false," \o
+                             " while zabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                    !.stateInconsistent = TRUE]
+                    /\ \/ /\ followerStateSummary.currentEpoch = -1
+                          /\ electing' = [electing EXCEPT ![i] = UpdateElecting(@, j, 
+                                                                msg.mzxid, FALSE) ]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<varsL, zabState, forwarding, connectInfo, 
+                                         learners, epochLeader>>
+                       \/ /\ followerStateSummary.currentEpoch > -1
+                          /\ \/ \* normal follower 
+                                /\ logOk
+                                /\ electing' = [electing EXCEPT ![i] = 
+                                            UpdateElecting(@, j, msg.mzxid, TRUE) ]
+                                /\ LET new_electing_quorum == {e \in electing'[i]: e.inQuorum = TRUE }
+                                       new_sid_electing == {s.sid: s \in new_electing_quorum }
+                                   IN 
+                                   \/ \* electionFinished = true, jump out of waitForEpochAck,
+                                      \* update currentEpoch and zabState.
+                                      /\ ElectionFinished(i, new_sid_electing) 
+                                      /\ LeaderTurnToSynchronization(i)
+                                      /\ LET newLeaderEpoch == acceptedEpoch[i]
+                                         IN epochLeader' = [epochLeader EXCEPT ![newLeaderEpoch]
+                                                = @ \union {i} ] \* for checking invariants
+                                   \/ \* there still exists electionFinished = false.
+                                      /\ ~ElectionFinished(i, new_sid_electing)
+                                      /\ UNCHANGED <<currentEpoch, zabState, epochLeader>>
+                                /\ Discard(j, i)
+                                /\ UNCHANGED <<state, lastProcessed, electionVars, leadingVoteSet,
+                                               electionMsgs, connectInfo, learners, history, forwarding>>
+                             \/ \* Exists follower more recent than leader
+                                /\ ~logOk 
+                                /\ LeaderShutdown(i)
+                                /\ UNCHANGED <<electing, epochLeader>>
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, lastSnapshot, connecting, ackldRecv,
+                       tempMaxEpoch, initialHistory, packetsSync, proposalMsgsLog, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACKEPOCH", i, j>>)
+
+\* Strip syncFollower from LeaderProcessACKEPOCH.
+\* Only when electionFinished = true and there exists some
+\* learnerHandler has not perform syncFollower, this 
+\* action will be called.
+LeaderSyncFollower(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ LET electing_quorum == {e \in electing[i]: e.inQuorum = TRUE }
+               electionFinished == ElectionFinished(i, {s.sid: s \in electing_quorum } )
+               toSync == {s \in electing[i] : /\ ~ZxidEqual( s.peerLastZxid, <<-1, -1>>)
+                                              /\ s.sid \in learners[i] }
+               canSync == toSync /= {}
+           IN
+           /\ electionFinished
+           /\ canSync
+           /\ \E s \in toSync: s.sid = j
+           /\ LET chosen == CHOOSE s \in toSync: s.sid = j
+                  newChosen == [ sid          |-> chosen.sid,
+                                 peerLastZxid |-> <<-1, -1>>, \* <<-1,-1>> means has handled.
+                                 inQuorum     |-> chosen.inQuorum ] 
+              IN /\ SyncFollower(i, chosen.sid, chosen.peerLastZxid, FALSE)
+                 /\ electing' = [electing EXCEPT ![i] = (@ \ {chosen}) \union {newChosen} ]
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch, 
+                    lastCommitted, initialHistory, electionVars, leadingVoteSet,
+                    learners, connecting, ackldRecv, tempMaxEpoch, followerVars, 
+                    lastSnapshot, epochLeader, violatedInvariants, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderSyncFollower", i, j>>)
+
+TruncateLog(his, index) == IF index <= 0 THEN << >>
+                           ELSE SubSeq(his, 1, index)
+
+(* Follower receives DIFF/TRUNC, and then may receives PROPOSAL,COMMIT,NEWLEADER,
+   and UPTODATE. See syncWithLeader in Learner for details. *)
+FollowerProcessSyncMessage(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ msgs[j][i] /= << >>
+        /\ \/ msgs[j][i][1].mtype = DIFF 
+           \/ msgs[j][i][1].mtype = TRUNC
+           \/ msgs[j][i][1].mtype = SNAP
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               stateOk == zabState[i] = SYNCHRONIZATION
+           IN /\ infoOk
+              /\ \/ \* Follower should receive packets in SYNC.
+                    /\ ~stateOk
+                    /\ PrintT("Exception: Follower receives DIFF/TRUNC/SNAP," \o
+                             " whileZabState not SYNCHRONIZATION.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
+                    /\ UNCHANGED <<history, initialHistory, lastProcessed, lastCommitted, connectInfo>>
+                 \/ /\ stateOk
+                    /\ \/ /\ msg.mtype = DIFF
+                          /\ connectInfo' = [connectInfo EXCEPT ![i].syncMode = DIFF]         
+                          /\ UNCHANGED <<history, initialHistory, lastProcessed, lastCommitted,
+                                    violatedInvariants>>
+                       \/ /\ msg.mtype = TRUNC
+                          /\ connectInfo' = [connectInfo EXCEPT ![i].syncMode = TRUNC]
+                          /\ LET truncZxid  == msg.mtruncZxid
+                                 truncIndex == ZxidToIndex(history[i], truncZxid)
+                                 truncOk    == /\ truncIndex >= lastCommitted[i].index
+                                               /\ truncIndex <= Len(history[i])
+                             IN
+                             \/ /\ ~truncOk
+                                /\ PrintT("Exception: TRUNC error.")
+                                /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                !.proposalInconsistent = TRUE]
+                                /\ UNCHANGED <<history, initialHistory, lastProcessed, lastCommitted>>
+                             \/ /\ truncOk
+                                /\ history' = [history EXCEPT 
+                                                    ![i] = TruncateLog(history[i], truncIndex)]
+                                /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+                                /\ lastProcessed' = [lastProcessed EXCEPT 
+                                                    ![i] = [ index |-> truncIndex,
+                                                             zxid  |-> truncZxid] ]
+                                /\ lastCommitted' = [lastCommitted EXCEPT 
+                                                    ![i] = [ index |-> truncIndex,
+                                                             zxid  |-> truncZxid] ]
+                                /\ UNCHANGED violatedInvariants
+                       \/ /\ msg.mtype = SNAP
+                          /\ connectInfo' = [connectInfo EXCEPT ![i].syncMode = SNAP]
+                          /\ history' = [history EXCEPT ![i] = msg.msnapshot]
+                          /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+                          /\ lastProcessed' = [lastProcessed EXCEPT 
+                                                    ![i] = [ index |-> Len(history'[i]),
+                                                             zxid  |-> msg.msnapZxid] ]
+                          /\ lastCommitted' = [lastCommitted EXCEPT 
+                                                    ![i] = [ index |-> Len(history'[i]),
+                                                             zxid  |-> msg.msnapZxid] ]
+                          /\ UNCHANGED violatedInvariants
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, electionVars,
+                       leaderVars, tempMaxEpoch, packetsSync, lastSnapshot,
+                       proposalMsgsLog, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessSyncMessage", i, j>>)
+
+\* See variable snapshotNeeded in Learner for details.
+SnapshotNeeded(i) == \/ connectInfo[i].syncMode = TRUNC
+                     \/ connectInfo[i].syncMode = SNAP
+
+\* See variable writeToTxnLog in Learner for details.
+WriteToTxnLog(i) == IF \/ connectInfo[i].syncMode = DIFF
+                       \/ connectInfo[i].nlRcv = TRUE
+                    THEN TRUE ELSE FALSE
+
+\* See lastProposed in Leader for details.
+LastProposed(i) == IF Len(history[i]) = 0 THEN [ index |-> 0, 
+                                                 zxid  |-> <<0, 0>> ]
+                   ELSE
+                   LET lastIndex == Len(history[i])
+                       entry     == history[i][lastIndex]
+                   IN [ index |-> lastIndex,
+                        zxid  |-> entry.zxid ]
+
+\* See lastQueued in Learner for details.
+LastQueued(i) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                 THEN LastProposed(i)
+                 ELSE \* condition: IsFollower(i) /\ zabState = SYNCHRONIZATION
+                      LET packetsInSync == packetsSync[i].notCommitted
+                          lenSync  == Len(packetsInSync)
+                          totalLen == Len(history[i]) + lenSync
+                      IN IF lenSync = 0 THEN LastProposed(i)
+                         ELSE [ index |-> totalLen,
+                                zxid  |-> packetsInSync[lenSync].zxid ]
+
+IsNextZxid(curZxid, nextZxid) ==
+            \/ \* first PROPOSAL in this epoch
+               /\ nextZxid[2] = 1
+               /\ curZxid[1] < nextZxid[1]
+            \/ \* not first PROPOSAL in this epoch
+               /\ nextZxid[2] > 1
+               /\ curZxid[1] = nextZxid[1]
+               /\ curZxid[2] + 1 = nextZxid[2]
+
+FollowerProcessPROPOSALInSync(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingPROPOSAL(i, j)
+        /\ zabState[i] = SYNCHRONIZATION
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               isNext == IsNextZxid(LastQueued(i).zxid, msg.mzxid)
+               newTxn == [ zxid   |-> msg.mzxid,
+                           value  |-> msg.mdata,
+                           ackSid |-> {},    \* follower do not consider ackSid
+                           epoch  |-> acceptedEpoch[i] ] \* epoch of this round
+           IN /\ infoOk
+              /\ \/ /\ isNext
+                    /\ packetsSync' = [packetsSync EXCEPT ![i].notCommitted 
+                                = Append(packetsSync[i].notCommitted, newTxn) ]
+                 \/ /\ ~isNext
+                    /\ PrintT("Warn: Follower receives PROPOSAL," \o
+                        " while zxid != lastQueued + 1.")
+                    /\ UNCHANGED packetsSync
+        \* logRequest -> SyncRequestProcessor -> SendAckRequestProcessor -> reply ack
+        \* So here we do not need to send ack to leader.
+        /\ Discard(j, i)
+        /\ UNCHANGED <<serverVars, electionVars, leaderVars, connectInfo,
+                       verifyVars, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessPROPOSALInSync", i, j>>)
+
+RECURSIVE IndexOfFirstTxnWithEpoch(_,_,_,_)
+IndexOfFirstTxnWithEpoch(his, epoch, cur, end) == 
+            IF cur > end THEN cur 
+            ELSE IF his[cur].epoch = epoch THEN cur
+                 ELSE IndexOfFirstTxnWithEpoch(his, epoch, cur + 1, end)
+
+LastCommitted(i) == IF zabState[i] = BROADCAST THEN lastCommitted[i]
+                    ELSE CASE IsLeader(i)   -> 
+                            LET lastInitialIndex == Len(initialHistory[i])
+                            IN IF lastInitialIndex = 0 THEN [ index |-> 0,
+                                                              zxid  |-> <<0, 0>> ]
+                               ELSE [ index |-> lastInitialIndex,
+                                      zxid  |-> history[i][lastInitialIndex].zxid ]
+                         []   IsFollower(i) ->
+                            LET completeHis == history[i] \o packetsSync[i].notCommitted
+                                packetsCommitted == packetsSync[i].committed
+                                lenCommitted == Len(packetsCommitted)
+                            IN IF lenCommitted = 0 \* return last one in history
+                               THEN LET lastIndex == Len(history[i])
+                                        lastInitialIndex == Len(initialHistory[i])
+                                    IN IF lastIndex = lastInitialIndex
+                                       THEN IF lastIndex = 0
+                                            THEN [ index |-> 0,
+                                                   zxid  |-> <<0, 0>> ]
+                                            ELSE [ index |-> lastIndex ,
+                                                   zxid  |-> history[lastIndex].zxid ]
+                                       ELSE IF lastInitialIndex < lastCommitted[i].index
+                                            THEN lastCommitted[i]
+                                            ELSE IF lastInitialIndex = 0
+                                                 THEN [ index |-> 0,
+                                                        zxid  |-> <<0, 0>> ]
+                                                 ELSE [ index |-> lastInitialIndex,
+                                                        zxid  |-> history[lastInitialIndex].zxid ]
+                               ELSE                \* return tail of packetsCommitted
+                                    LET committedIndex == ZxidToIndex(completeHis, 
+                                                     packetsCommitted[lenCommitted] )
+                                    IN [ index |-> committedIndex, 
+                                         zxid  |-> packetsCommitted[lenCommitted] ]
+                         []   OTHER -> lastCommitted[i]
+
+TxnWithIndex(i, idx) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                        THEN history[i][idx]
+                        ELSE LET completeHis == history[i] \o packetsSync[i].notCommitted
+                             IN completeHis[idx]
+
+(* To simplify specification, we assume snapshotNeeded = false and 
+   writeToTxnLog = true. So here we just call packetsCommitted.add. *)
+FollowerProcessCOMMITInSync(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingCOMMIT(i, j)
+        /\ zabState[i] = SYNCHRONIZATION
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               committedIndex == LastCommitted(i).index + 1
+               exist == /\ committedIndex <= LastQueued(i).index
+                        /\ IsNextZxid(LastCommitted(i).zxid, msg.mzxid)
+               match == ZxidEqual(msg.mzxid, TxnWithIndex(i, committedIndex).zxid )
+           IN /\ infoOk 
+              /\ \/ /\ exist
+                    /\ \/ /\ match
+                          /\ LET writeToTxnLog == WriteToTxnLog(i)
+                             IN
+                             \/ /\ ~writeToTxnLog \* zk.processTxn() & packetsNotCommitted.remove()
+                                /\ LET committedTxn == packetsSync[i].notCommitted[1]
+                                   IN 
+                                   /\ history' = [ history EXCEPT ![i] 
+                                               = Append(@, committedTxn)]
+                                   /\ lastCommitted' = [ lastCommitted EXCEPT ![i]
+                                                     = [index |-> Len(history'[i]),
+                                                        zxid  |-> committedTxn.zxid ] ]
+                                   /\ lastProcessed' = [ lastProcessed EXCEPT ![i]
+                                                     = lastCommitted'[i] ]
+                                   /\ packetsSync' = [ packetsSync EXCEPT ![i].notCommitted
+                                                   = Tail(@) ]
+                             \/ /\ writeToTxnLog  \* packetsCommitted.add()
+                                /\ packetsSync' = [ packetsSync EXCEPT ![i].committed
+                                                = Append(packetsSync[i].committed, msg.mzxid) ]
+                                /\ UNCHANGED <<history, lastCommitted, lastProcessed>>
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~match
+                          /\ PrintT("Warn: Follower receives COMMIT," \o
+                               " but zxid not the next committed zxid in COMMIT.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                    !.commitInconsistent = TRUE ]
+                          /\ UNCHANGED <<history, lastCommitted, lastProcessed, packetsSync>>
+                 \/ /\ ~exist
+                    /\ PrintT("Warn: Follower receives COMMIT," \o
+                         " but no packets with its zxid exists.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                !.commitInconsistent = TRUE ]
+                    /\ UNCHANGED <<history, lastCommitted, lastProcessed, packetsSync>>
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch,
+                       lastSnapshot, initialHistory, electionVars, leaderVars,
+                       connectInfo, epochLeader, proposalMsgsLog, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMITInSync", i, j>>)
+
+\* Assuming that everytime committing two txns, node takes snapshot.
+ShouldSnapshot(i) == lastCommitted[i].index - lastSnapshot[i].index >= 2
+
+(* There are mainly three places where calling takeSnapshot():
+   1. zk.loadData() in lead() when node becomes leader;
+   2. syncRequestProcessor.run() tells when to snapshot;
+   3. node processing NEWLEADER in learner.syncWithLeader();
+ *)
+ TakeSnapshot(i) == LET snapOk == lastSnapshot[i].index <= lastCommitted[i].index
+                    IN \/ /\ snapOk
+                          /\ lastSnapshot' = [ lastSnapshot EXCEPT ![i] = lastCommitted[i] ]
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~snapOk
+                          /\ PrintT("Exception: index of snapshot greater than" \o
+                                    "index of committed.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                    !.commitInconsistent = TRUE ]
+                          /\ UNCHANGED lastSnapshot
+
+RECURSIVE ACKInBatches(_,_)
+ACKInBatches(queue, packets) ==
+        IF packets = << >> THEN queue
+        ELSE LET head == packets[1]
+                 newPackets == Tail(packets)
+                 m_ack == [ mtype |-> ACK,
+                            mzxid |-> head.zxid ]
+             IN ACKInBatches( Append(queue, m_ack), newPackets )
+
+(* Update currentEpoch, and logRequest every packets in
+   packetsNotCommitted and clear it. As syncProcessor will 
+   be called in logRequest, we have to reply acks here. *)
+FollowerProcessNEWLEADER(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingNEWLEADER(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               packetsInSync == packetsSync[i].notCommitted
+               m_ackld == [ mtype |-> ACKLD,
+                            mzxid |-> msg.mzxid ]
+               ms_ack  == ACKInBatches( << >>, packetsInSync )
+               queue_toSend == <<m_ackld>> \o ms_ack \* send ACK-NEWLEADER first.
+           IN /\ infoOk
+              /\ currentEpoch' = [currentEpoch EXCEPT ![i] = acceptedEpoch[i] ]
+              /\ history'      = [history      EXCEPT ![i] = @ \o packetsInSync ]
+              /\ packetsSync'  = [packetsSync  EXCEPT ![i].notCommitted = << >> ]
+              /\ connectInfo'  = [connectInfo  EXCEPT ![i].nlRcv = TRUE,
+                                                      ![i].syncMode = NONE ]
+              /\ \/ /\ SnapshotNeeded(i)
+                    /\ TakeSnapshot(i)
+                 \/ /\ ~SnapshotNeeded(i)
+                    /\ UNCHANGED <<lastSnapshot, violatedInvariants>>
+              /\ DiscardAndSendPackets(i, j, queue_toSend)
+        /\ UNCHANGED <<state, lastProcessed, zabState, acceptedEpoch, lastCommitted, 
+                       electionVars, leaderVars, initialHistory,
+                       proposalMsgsLog, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessNEWLEADER", i, j>>)
+
+\* quorumFormed in Leader
+QuorumFormed(i, set) == i \in set /\ IsQuorum(set)
+
+UpdateElectionVote(i, epoch) == UpdateProposal(i, currentVote[i].proposedLeader,
+                                    currentVote[i].proposedZxid, epoch)
+
+\* See startZkServer in Leader for details.
+StartZkServer(i) ==
+        LET latest == LastProposed(i)
+        IN /\ lastCommitted' = [lastCommitted EXCEPT ![i] = latest]
+           /\ lastProcessed' = [lastProcessed EXCEPT ![i] = latest]
+           /\ lastSnapshot'  = [lastSnapshot  EXCEPT ![i] = latest]
+           /\ UpdateElectionVote(i, acceptedEpoch[i])
+
+LeaderTurnToBroadcast(i) ==
+        /\ StartZkServer(i)
+        /\ zabState' = [zabState EXCEPT ![i] = BROADCAST]
+
+(* Leader waits for receiving quorum of ACK whose lower bits of zxid is 0, and
+   broadcasts UPTODATE. See waitForNewLeaderAck for details.  *)
+LeaderProcessACKLD(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingACKLD(i, j)
+        /\ LET msg    == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               match  == ZxidEqual(msg.mzxid, <<acceptedEpoch[i], 0>>)
+               currentZxid == <<acceptedEpoch[i], 0>>
+               m_uptodate == [ mtype |-> UPTODATE,
+                               mzxid |-> currentZxid ] \* not important
+               sid_ackldRecv == {a.sid: a \in ackldRecv[i]}
+           IN /\ infoOk
+              /\ \/ \* just reply UPTODATE.
+                    /\ QuorumFormed(i, sid_ackldRecv)
+                    /\ Reply(i, j, m_uptodate)
+                    /\ UNCHANGED <<ackldRecv, zabState, lastCommitted, lastProcessed,
+                                   lastSnapshot, currentVote, violatedInvariants>>
+                 \/ /\ ~QuorumFormed(i, sid_ackldRecv)
+                    /\ \/ /\ match
+                          /\ ackldRecv' = [ackldRecv EXCEPT ![i] = UpdateConnectingOrAckldRecv(@, j) ]
+                          /\ LET new_sid_ackldRecv == {a.sid: a \in ackldRecv'[i]}
+                             IN
+                             \/ \* jump out of waitForNewLeaderAck, and do startZkServer,
+                                \* setZabState, and reply UPTODATE.
+                                /\ QuorumFormed(i, new_sid_ackldRecv)
+                                /\ LeaderTurnToBroadcast(i)
+                                /\ DiscardAndBroadcastUPTODATE(i, j, m_uptodate)
+                             \/ \* still wait in waitForNewLeaderAck.
+                                /\ ~QuorumFormed(i, new_sid_ackldRecv)
+                                /\ Discard(j, i)
+                                /\ UNCHANGED <<zabState, lastCommitted, lastProcessed,
+                                               lastSnapshot, currentVote>>
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~match
+                          /\ PrintT("Exception: NEWLEADER ACK is from a different epoch. ")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                        !.ackInconsistent = TRUE]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<ackldRecv, zabState, lastCommitted, 
+                                         lastSnapshot, lastProcessed, currentVote>>
+        /\ UNCHANGED <<state, currentEpoch, acceptedEpoch, history, logicalClock, receiveVotes, 
+                    outOfElection, recvQueue, waitNotmsg, leadingVoteSet, learners, connecting, 
+                    electing, forwarding, tempMaxEpoch, initialHistory, followerVars, 
+                    proposalMsgsLog, epochLeader, electionMsgs ,envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACKLD", i, j>>)
+
+TxnsWithPreviousEpoch(i) ==
+            LET completeHis == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                               THEN history[i] 
+                               ELSE history[i] \o packetsSync[i].notCommitted
+                end   == Len(completeHis)
+                first == IndexOfFirstTxnWithEpoch(completeHis, acceptedEpoch[i], 1, end)
+            IN IF first > end THEN completeHis
+               ELSE SubSeq(completeHis, 1, first - 1)
+
+TxnsRcvWithCurEpoch(i) ==
+            LET completeHis == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                               THEN history[i] 
+                               ELSE history[i] \o packetsSync[i].notCommitted
+                end   == Len(completeHis)
+                first == IndexOfFirstTxnWithEpoch(completeHis, acceptedEpoch[i], 1, end)
+            IN IF first > end THEN << >>
+               ELSE SubSeq(completeHis, first, end) \* completeHis[first : end]
+
+\* Txns received in current epoch but not committed.
+\* See pendingTxns in FollowerZooKeeper for details.
+PendingTxns(i) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                  THEN SubSeq(history[i], lastCommitted[i].index + 1, Len(history[i]))
+                  ELSE LET packetsCommitted == packetsSync[i].committed
+                           completeHis == history[i] \o packetsSync[i].notCommitted
+                       IN IF Len(packetsCommitted) = 0 
+                          THEN SubSeq(completeHis, Len(history[i]) + 1, Len(completeHis))
+                          ELSE SubSeq(completeHis, LastCommitted(i).index + 1, Len(completeHis))
+
+CommittedTxns(i) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                    THEN SubSeq(history[i], 1, lastCommitted[i].index)
+                    ELSE LET packetsCommitted == packetsSync[i].committed
+                             completeHis == history[i] \o packetsSync[i].notCommitted
+                         IN IF Len(packetsCommitted) = 0 THEN history[i]
+                            ELSE SubSeq( completeHis, 1, LastCommitted(i).index )
+
+\* Each zxid of packetsCommitted equals to zxid of 
+\* corresponding txn in txns.
+RECURSIVE TxnsAndCommittedMatch(_,_)
+TxnsAndCommittedMatch(txns, packetsCommitted) ==
+        LET len1 == Len(txns)
+            len2 == Len(packetsCommitted)
+        IN IF len2 = 0 THEN TRUE 
+           ELSE IF len1 < len2 THEN FALSE 
+                ELSE /\ ZxidEqual(txns[len1].zxid, packetsCommitted[len2])
+                     /\ TxnsAndCommittedMatch( SubSeq(txns, 1, len1 - 1), 
+                                               SubSeq(packetsCommitted, 1, len2 - 1) )
+
+FollowerLogRequestInBatches(i, leader, ms_ack, packetsNotCommitted) ==
+        /\ history' = [history EXCEPT ![i] = @ \o packetsNotCommitted ]
+        /\ DiscardAndSendPackets(i, leader, ms_ack)
+
+\* Since commit will call commitProcessor.commit, which will finally 
+\* update lastProcessed, we update it here atomically.
+FollowerCommitInBatches(i) ==
+        LET committedTxns == CommittedTxns(i)
+            packetsCommitted == packetsSync[i].committed
+            match == TxnsAndCommittedMatch(committedTxns, packetsCommitted)
+        IN 
+        \/ /\ match 
+           /\ lastCommitted' = [lastCommitted EXCEPT ![i] = LastCommitted(i)]
+           /\ lastProcessed' = [lastProcessed EXCEPT ![i] = lastCommitted'[i]]
+           /\ UNCHANGED violatedInvariants
+        \/ /\ ~match
+           /\ PrintT("Warn: Committing zxid withou see txn. /" \o 
+                "Committing zxid != pending txn zxid.")
+           /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                        !.commitInconsistent = TRUE ]
+           /\ UNCHANGED <<lastCommitted, lastProcessed>>
+
+(* Follower jump out of outerLoop here, and log the stuff that came in
+   between snapshot and uptodate, which means calling logRequest and 
+   commit to clear packetsNotCommitted and packetsCommitted. *)
+FollowerProcessUPTODATE(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingUPTODATE(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               packetsNotCommitted == packetsSync[i].notCommitted
+               ms_ack == ACKInBatches(<< >>, packetsNotCommitted)
+           IN /\ infoOk
+              \* Here we ignore ack of UPTODATE.
+              /\ UpdateElectionVote(i, acceptedEpoch[i])
+              /\ FollowerLogRequestInBatches(i, j, ms_ack, packetsNotCommitted)
+              /\ FollowerCommitInBatches(i)
+              /\ packetsSync' = [packetsSync EXCEPT ![i].notCommitted = << >>,
+                                                    ![i].committed = << >> ]
+              /\ zabState' = [zabState EXCEPT ![i] = BROADCAST ]
+        /\ UNCHANGED <<state, currentEpoch, acceptedEpoch, logicalClock, lastSnapshot,
+                receiveVotes, outOfElection, recvQueue, waitNotmsg, leaderVars, envVars,
+                initialHistory, connectInfo, epochLeader, proposalMsgsLog, electionMsgs>>
+        /\ UpdateRecorder(<<"FollowerProcessUPTODATE", i, j>>)
+-----------------------------------------------------------------------------
+IncZxid(s, zxid) == IF currentEpoch[s] = zxid[1] THEN <<zxid[1], zxid[2] + 1>>
+                    ELSE <<currentEpoch[s], 1>>
+
+(* Leader receives client propose and broadcasts PROPOSAL. See processRequest
+   in ProposalRequestProcessor and propose in Leader for details. Since 
+   prosalProcessor.processRequest -> syncProcessor.processRequest ->
+   ackProcessor.processRequest -> leader.processAck, we initially set 
+   txn.ackSid = {i}, assuming we have done leader.processAck.
+   Note: In production, any server in traffic can receive requests and 
+         forward it to leader if necessary. We choose to let leader be
+         the sole one who can receive write requests, to simplify spec 
+         and keep correctness at the same time.
+*)
+LeaderProcessRequest(i) ==
+        /\ CheckTransactionNum \* test restrictions of transaction num
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ zabState[i] = BROADCAST
+        /\ LET inBroadcast == {s \in forwarding[i]: zabState[s] = BROADCAST}
+           IN IsQuorum(inBroadcast)
+        /\ LET request_value == GetRecorder("nClientRequest") \* unique value
+               newTxn == [ zxid   |-> IncZxid(i, LastProposed(i).zxid),
+                           value  |-> request_value, 
+                           ackSid |-> {i}, \* assume we have done leader.processAck
+                           epoch  |-> acceptedEpoch[i] ]
+               m_proposal == [ mtype |-> PROPOSAL,
+                               mzxid |-> newTxn.zxid,
+                               mdata |-> request_value ]
+               m_proposal_for_checking == [ source |-> i,
+                                            epoch  |-> acceptedEpoch[i],
+                                            zxid   |-> newTxn.zxid,
+                                            data   |-> request_value ]
+           IN /\ history' = [history EXCEPT ![i] = Append(@, newTxn) ]
+              /\ \/ /\ ShouldSnapshot(i)
+                    /\ TakeSnapshot(i)
+                 \/ /\ ~ShouldSnapshot(i)
+                    /\ UNCHANGED <<lastSnapshot, violatedInvariants>>
+              /\ Broadcast(i, m_proposal)
+              /\ proposalMsgsLog' = proposalMsgsLog \union {m_proposal_for_checking}
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch,
+                       lastCommitted, electionVars, leaderVars, followerVars,
+                       initialHistory, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessRequest", i>>)
+
+(* Follower processes PROPOSAL in BROADCAST. See processPacket
+   in Follower for details. *)
+FollowerProcessPROPOSAL(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingPROPOSAL(i, j)
+        /\ zabState[i] = BROADCAST
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               isNext == IsNextZxid( LastQueued(i).zxid, msg.mzxid)
+               newTxn == [ zxid   |-> msg.mzxid,
+                           value  |-> msg.mdata,
+                           ackSid |-> {},
+                           epoch  |-> acceptedEpoch[i] ]
+               m_ack  == [ mtype |-> ACK,
+                           mzxid |-> msg.mzxid ]
+          IN /\ infoOk
+             /\ \/ /\ isNext
+                   /\ history' = [history EXCEPT ![i] = Append(@, newTxn)]
+                   /\ \/ /\ ShouldSnapshot(i)
+                         /\ TakeSnapshot(i)
+                      \/ /\ ~ShouldSnapshot(i)
+                         /\ UNCHANGED <<lastSnapshot, violatedInvariants>>
+                   /\ Reply(i, j, m_ack)
+                \/ /\ ~isNext
+                   /\ PrintT("Exception: Follower receives PROPOSAL, while" \o 
+                        " the transaction is not the next.")
+                   /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                !.proposalInconsistent = TRUE]
+                   /\ UNCHANGED <<history, lastSnapshot, msgs>>
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch,
+                 lastCommitted, electionVars, leaderVars, followerVars, initialHistory,
+                 epochLeader, proposalMsgsLog, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessPROPOSAL", i, j>>)
+
+\* See outstandingProposals in Leader
+OutstandingProposals(i) == IF zabState[i] /= BROADCAST THEN << >>
+                           ELSE SubSeq( history[i], lastCommitted[i].index + 1,
+                                 Len(history[i]) )
+
+LastAckIndexFromFollower(i, j) == 
+        LET set_index == {idx \in 1..Len(history[i]): j \in history[i][idx].ackSid }
+        IN Maximum(set_index)
+
+\* See commit in Leader for details.
+LeaderCommit(s, follower, index, zxid) ==
+        /\ lastCommitted' = [lastCommitted EXCEPT ![s] = [ index |-> index,
+                                                           zxid  |-> zxid ] ]
+        /\ LET m_commit == [ mtype |-> COMMIT,
+                             mzxid |-> zxid ]
+           IN DiscardAndBroadcast(s, follower, m_commit)
+
+\* Try to commit one operation, called by LeaderProcessAck.
+\* See tryToCommit in Leader for details.
+\* commitProcessor.commit -> processWrite -> toBeApplied.processRequest
+\* -> finalProcessor.processRequest, finally processTxn will be implemented
+\* and lastProcessed will be updated. So we update it here.
+LeaderTryToCommit(s, index, zxid, newTxn, follower) ==
+        LET allTxnsBeforeCommitted == lastCommitted[s].index >= index - 1
+                    \* Only when all proposals before zxid has been committed,
+                    \* this proposal can be permitted to be committed.
+            hasAllQuorums == IsQuorum(newTxn.ackSid)
+                    \* In order to be committed, a proposal must be accepted
+                    \* by a quorum.
+            ordered == lastCommitted[s].index + 1 = index
+                    \* Commit proposals in order.
+        IN \/ /\ \* Current conditions do not satisfy committing the proposal.
+                 \/ ~allTxnsBeforeCommitted
+                 \/ ~hasAllQuorums
+              /\ Discard(follower, s)
+              /\ UNCHANGED <<violatedInvariants, lastCommitted, lastProcessed>>
+           \/ /\ allTxnsBeforeCommitted
+              /\ hasAllQuorums
+              /\ \/ /\ ~ordered
+                    /\ PrintT("Warn: Committing zxid " \o ToString(zxid) \o " not first.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                            !.commitInconsistent = TRUE]
+                 \/ /\ ordered
+                    /\ UNCHANGED violatedInvariants
+              /\ LeaderCommit(s, follower, index, zxid)
+              /\ lastProcessed' = [lastProcessed EXCEPT ![s] = [ index |-> index,
+                                                                 zxid  |-> zxid ] ]
+
+(* Leader Keeps a count of acks for a particular proposal, and try to
+   commit the proposal. See case Leader.ACK in LearnerHandler,
+   processRequest in AckRequestProcessor, and processAck in Leader for
+   details. *)
+LeaderProcessACK(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingACK(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               outstanding == LastCommitted(i).index < LastProposed(i).index
+                        \* outstandingProposals not null
+               hasCommitted == ~ZxidCompare( msg.mzxid, LastCommitted(i).zxid)
+                        \* namely, lastCommitted >= zxid
+               index == ZxidToIndex(history[i], msg.mzxid)
+               exist == index >= 1 /\ index <= LastProposed(i).index
+                        \* the proposal exists in history
+               ackIndex == LastAckIndexFromFollower(i, j)
+               monotonicallyInc == \/ ackIndex = -1
+                                   \/ ackIndex + 1 = index
+                        \* TCP makes everytime ackIndex should just increase by 1
+           IN /\ infoOk 
+              /\ \/ /\ exist
+                    /\ monotonicallyInc
+                    /\ LET txn == history[i][index]
+                           txnAfterAddAck == [ zxid   |-> txn.zxid,
+                                               value  |-> txn.value,
+                                               ackSid |-> txn.ackSid \union {j} ,
+                                               epoch  |-> txn.epoch ]   
+                       IN \* p.addAck(sid)
+                       /\ history' = [history EXCEPT ![i][index] = txnAfterAddAck ] 
+                       /\ \/ /\ \* Note: outstanding is 0. 
+                                \* / proposal has already been committed.
+                                \/ ~outstanding
+                                \/ hasCommitted
+                             /\ Discard(j, i)
+                             /\ UNCHANGED <<violatedInvariants, lastCommitted, lastProcessed>>
+                          \/ /\ outstanding
+                             /\ ~hasCommitted
+                             /\ LeaderTryToCommit(i, index, msg.mzxid, txnAfterAddAck, j)
+                 \/ /\ \/ ~exist
+                       \/ ~monotonicallyInc
+                    /\ PrintT("Exception: No such zxid. " \o 
+                           " / ackIndex doesn't inc monotonically.")
+                    /\ violatedInvariants' = [violatedInvariants 
+                            EXCEPT !.ackInconsistent = TRUE]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED <<history, lastCommitted, lastProcessed>>
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, electionVars,
+                    leaderVars, initialHistory, followerVars, proposalMsgsLog, epochLeader, 
+                    lastSnapshot, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACK", i, j>>)
+
+(* Follower processes COMMIT in BROADCAST. See processPacket
+   in Follower for details. *)
+FollowerProcessCOMMIT(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingCOMMIT(i, j)
+        /\ zabState[i] = BROADCAST
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               pendingTxns == PendingTxns(i)
+               noPending == Len(pendingTxns) = 0
+           IN
+           /\ infoOk 
+           /\ \/ /\ noPending
+                 /\ PrintT("Warn: Committing zxid without seeing txn.")
+                 /\ UNCHANGED <<lastCommitted, lastProcessed, violatedInvariants>>
+              \/ /\ ~noPending
+                 /\ LET firstElementZxid == pendingTxns[1].zxid
+                        match == ZxidEqual(firstElementZxid, msg.mzxid)
+                    IN 
+                    \/ /\ ~match
+                       /\ PrintT("Exception: Committing zxid not equals" \o
+                                " next pending txn zxid.")
+                       /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                               !.commitInconsistent = TRUE]
+                       /\ UNCHANGED <<lastCommitted, lastProcessed>>
+                    \/ /\ match
+                       /\ lastCommitted' = [lastCommitted EXCEPT 
+                                ![i] = [ index |-> lastCommitted[i].index + 1,
+                                         zxid  |-> firstElementZxid ] ]
+                       /\ lastProcessed' = [lastProcessed EXCEPT 
+                                ![i] = [ index |-> lastCommitted[i].index + 1,
+                                         zxid  |-> firstElementZxid ] ]
+                       /\ UNCHANGED violatedInvariants
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, history,
+                    electionVars, leaderVars, initialHistory, followerVars,
+                    lastSnapshot, proposalMsgsLog, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMIT", i, j>>)
+-----------------------------------------------------------------------------
+(* Used to discard some messages which should not exist in network channel.
+   This action should not be triggered. *)
+FilterNonexistentMessage(i) ==
+        /\ \E j \in Server \ {i}: /\ msgs[j][i] /= << >>
+                                  /\ LET msg == msgs[j][i][1]
+                                     IN 
+                                        \/ /\ IsLeader(i)
+                                           /\ LET infoOk == IsMyLearner(i, j)
+                                              IN
+                                              \/ msg.mtype = LEADERINFO
+                                              \/ msg.mtype = NEWLEADER
+                                              \/ msg.mtype = UPTODATE
+                                              \/ msg.mtype = PROPOSAL
+                                              \/ msg.mtype = COMMIT
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = FOLLOWERINFO
+                                                    \/ msg.mtype = ACKEPOCH
+                                                    \/ msg.mtype = ACKLD
+                                                    \/ msg.mtype = ACK
+                                        \/ /\ IsFollower(i)
+                                           /\ LET infoOk == IsMyLeader(i, j) 
+                                              IN
+                                              \/ msg.mtype = FOLLOWERINFO
+                                              \/ msg.mtype = ACKEPOCH
+                                              \/ msg.mtype = ACKLD
+                                              \/ msg.mtype = ACK
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = LEADERINFO
+                                                    \/ msg.mtype = NEWLEADER
+                                                    \/ msg.mtype = UPTODATE
+                                                    \/ msg.mtype = PROPOSAL
+                                                    \/ msg.mtype = COMMIT   
+                                        \/ IsLooking(i)
+                                  /\ Discard(j, i)
+        /\ violatedInvariants' = [violatedInvariants EXCEPT !.messageIllegal = TRUE]
+        /\ UNCHANGED <<serverVars, electionVars, leaderVars, envVars,
+                       followerVars, proposalMsgsLog, epochLeader, electionMsgs>>
+        /\ UnchangeRecorder        
+-----------------------------------------------------------------------------
+\* Defines how the variables may transition.
+Next == 
+        (* FLE module *)
+            \/ \E i, j \in Server: FLEReceiveNotmsg(i, j)
+            \/ \E i \in Server:    FLENotmsgTimeout(i)
+            \/ \E i \in Server:    FLEHandleNotmsg(i)
+            \/ \E i \in Server:    FLEWaitNewNotmsg(i)
+        (* situation errors like failure, network partition *)
+            \/ \E i, j \in Server: PartitionStart(i, j)
+            \/ \E i, j \in Server: PartitionRecover(i, j)
+            \/ \E i \in Server:    NodeCrash(i)
+            \/ \E i \in Server:    NodeStart(i)
+        (* Zab module - Discovery and Synchronization part *)
+            \/ \E i, j \in Server: ConnectAndFollowerSendFOLLOWERINFO(i, j)
+            \/ \E i, j \in Server: LeaderProcessFOLLOWERINFO(i, j)
+            \/ \E i, j \in Server: FollowerProcessLEADERINFO(i, j)
+            \/ \E i, j \in Server: LeaderProcessACKEPOCH(i, j)
+            \/ \E i, j \in Server: LeaderSyncFollower(i, j)
+            \/ \E i, j \in Server: FollowerProcessSyncMessage(i, j)
+            \/ \E i, j \in Server: FollowerProcessPROPOSALInSync(i, j)
+            \/ \E i, j \in Server: FollowerProcessCOMMITInSync(i, j)
+            \/ \E i, j \in Server: FollowerProcessNEWLEADER(i, j)
+            \/ \E i, j \in Server: LeaderProcessACKLD(i, j)
+            \/ \E i, j \in Server: FollowerProcessUPTODATE(i, j)
+        (* Zab module - Broadcast part *)
+            \/ \E i \in Server:    LeaderProcessRequest(i)
+            \/ \E i, j \in Server: FollowerProcessPROPOSAL(i, j)
+            \/ \E i, j \in Server: LeaderProcessACK(i, j)
+            \/ \E i, j \in Server: FollowerProcessCOMMIT(i, j)
+        (* An action used to judge whether there are redundant messages in network *)
+            \/ \E i \in Server:    FilterNonexistentMessage(i)
+
+Spec == Init /\ [][Next]_vars
+-----------------------------------------------------------------------------
+\* Define safety properties of Zab 1.0 protocol.
+
+CheckDuringAction == \A p \in DOMAIN violatedInvariants: violatedInvariants[p] = FALSE
+
+\* There is most one established leader for a certain epoch.
+Leadership1 == \A i, j \in Server:
+                   /\ IsLeader(i) /\ zabState[i] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ IsLeader(j) /\ zabState[j] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ acceptedEpoch[i] = acceptedEpoch[j]
+                  => i = j
+
+Leadership2 == \A epoch \in 1..MAXEPOCH: Cardinality(epochLeader[epoch]) <= 1
+
+\* PrefixConsistency: The prefix that have been committed 
+\* in history in any process is the same.
+PrefixConsistency == \A i, j \in Server:
+                        LET smaller == Minimum({lastCommitted[i].index, lastCommitted[j].index})
+                        IN \/ smaller = 0
+                           \/ /\ smaller > 0
+                              /\ \A index \in 1..smaller:
+                                   TxnEqual(history[i][index], history[j][index])
+
+\* Integrity: If some follower delivers one transaction, then some primary has broadcast it.
+Integrity == \A i \in Server:
+                /\ IsFollower(i)
+                /\ lastCommitted[i].index > 0
+                => \A idx \in 1..lastCommitted[i].index: \E proposal \in proposalMsgsLog:
+                    LET txn_proposal == [ zxid  |-> proposal.zxid,
+                                          value |-> proposal.data ]
+                    IN  TxnEqual(history[i][idx], txn_proposal)
+
+\* Agreement: If some follower f delivers transaction a and some follower f' delivers transaction b,
+\*            then f' delivers a or f delivers b.
+Agreement == \A i, j \in Server:
+                /\ IsFollower(i) /\ lastCommitted[i].index > 0
+                /\ IsFollower(j) /\ lastCommitted[j].index > 0
+                =>
+                \A idx1 \in 1..lastCommitted[i].index, idx2 \in 1..lastCommitted[j].index :
+                    \/ \E idx_j \in 1..lastCommitted[j].index:
+                        TxnEqual(history[j][idx_j], history[i][idx1])
+                    \/ \E idx_i \in 1..lastCommitted[i].index:
+                        TxnEqual(history[i][idx_i], history[j][idx2])
+
+\* Total order: If some follower delivers a before b, then any process that delivers b
+\*              must also deliver a and deliver a before b.
+TotalOrder == \A i, j \in Server: 
+                LET committed1 == lastCommitted[i].index 
+                    committed2 == lastCommitted[j].index  
+                IN committed1 >= 2 /\ committed2 >= 2
+                    => \A idx_i1 \in 1..(committed1 - 1) : \A idx_i2 \in (idx_i1 + 1)..committed1 :
+                    LET logOk == \E idx \in 1..committed2 :
+                                     TxnEqual(history[i][idx_i2], history[j][idx])
+                    IN \/ ~logOk 
+                       \/ /\ logOk 
+                          /\ \E idx_j2 \in 1..committed2 : 
+                                /\ TxnEqual(history[i][idx_i2], history[j][idx_j2])
+                                /\ \E idx_j1 \in 1..(idx_j2 - 1):
+                                       TxnEqual(history[i][idx_i1], history[j][idx_j1])
+
+\* Local primary order: If a primary broadcasts a before it broadcasts b, then a follower that
+\*                      delivers b must also deliver a before b.
+LocalPrimaryOrder == LET p_set(i, e) == {p \in proposalMsgsLog: /\ p.source = i 
+                                                                /\ p.epoch  = e }
+                         txn_set(i, e) == { [ zxid  |-> p.zxid, 
+                                              value |-> p.data ] : p \in p_set(i, e) }
+                     IN \A i \in Server: \A e \in 1..currentEpoch[i]:
+                         \/ Cardinality(txn_set(i, e)) < 2
+                         \/ /\ Cardinality(txn_set(i, e)) >= 2
+                            /\ \E txn1, txn2 \in txn_set(i, e):
+                             \/ TxnEqual(txn1, txn2)
+                             \/ /\ ~TxnEqual(txn1, txn2)
+                                /\ LET TxnPre  == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn2 ELSE txn1
+                                       TxnNext == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn1 ELSE txn2
+                                   IN \A j \in Server: /\ lastCommitted[j].index >= 2
+                                                       /\ \E idx \in 1..lastCommitted[j].index: 
+                                                            TxnEqual(history[j][idx], TxnNext)
+                                        => \E idx2 \in 1..lastCommitted[j].index: 
+                                            /\ TxnEqual(history[j][idx2], TxnNext)
+                                            /\ idx2 > 1
+                                            /\ \E idx1 \in 1..(idx2 - 1): 
+                                                TxnEqual(history[j][idx1], TxnPre)
+
+\* Global primary order: A follower f delivers both a with epoch e and b with epoch e', and e < e',
+\*                       then f must deliver a before b.
+GlobalPrimaryOrder == \A i \in Server: lastCommitted[i].index >= 2
+                         => \A idx1, idx2 \in 1..lastCommitted[i].index:
+                                \/ ~EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                \/ /\ EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                   /\ idx1 < idx2
+
+\* Primary integrity: If primary p broadcasts a and some follower f delivers b such that b has epoch
+\*                    smaller than epoch of p, then p must deliver b before it broadcasts a.
+PrimaryIntegrity == \A i, j \in Server: /\ IsLeader(i)   /\ IsMyLearner(i, j)
+                                        /\ IsFollower(j) /\ IsMyLeader(j, i)
+                                        /\ zabState[i] = BROADCAST
+                                        /\ zabState[j] = BROADCAST
+                                        /\ lastCommitted[j].index >= 1
+                        => \A idx_j \in 1..lastCommitted[j].index:
+                                \/ history[j][idx_j].zxid[1] >= currentEpoch[i]
+                                \/ /\ history[j][idx_j].zxid[1] < currentEpoch[i]
+                                   /\ \E idx_i \in 1..lastCommitted[i].index: 
+                                        TxnEqual(history[i][idx_i], history[j][idx_j])
+=============================================================================
+\* Modification History
+\* Last modified Tue Jan 17 21:21:28 CST 2023 by huangbinyu
+\* Last modified Mon Nov 22 22:25:23 CST 2021 by Dell
+\* Created Sat Oct 23 16:05:04 CST 2021 by Dell

From de6762c1f0e1a0d7b0dec0c79b67378df44f738d Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Sat, 17 Jun 2023 13:31:45 +0800
Subject: [PATCH 375/591] ZOOKEEPER-3615: [ADDENDUM] fix rat error (#2013)

---
 .../protocol-spec/Zab.tla                     | 20 ++++++++++++++++++-
 zookeeper-specifications/protocol-spec/doc.md | 18 +++++++++++++++++
 .../protocol-spec/issues.md                   | 18 +++++++++++++++++
 .../protocol-spec/verification-statistics.md  | 18 +++++++++++++++++
 zookeeper-specifications/system-spec/doc.md   | 18 +++++++++++++++++
 .../system-spec/zk-3.7/FastLeaderElection.tla | 18 +++++++++++++++++
 .../system-spec/zk-3.7/ZkV3_7_0.tla           | 18 +++++++++++++++++
 7 files changed, 127 insertions(+), 1 deletion(-)

diff --git a/zookeeper-specifications/protocol-spec/Zab.tla b/zookeeper-specifications/protocol-spec/Zab.tla
index 4016f08e1e5..25379f55080 100644
--- a/zookeeper-specifications/protocol-spec/Zab.tla
+++ b/zookeeper-specifications/protocol-spec/Zab.tla
@@ -1,3 +1,21 @@
+(*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *)
+
 -------------------------------- MODULE Zab ---------------------------------
 (* This is the formal specification for the Zab consensus algorithm,
    in DSN'2011, which represents protocol specification in our work.*)
@@ -1230,4 +1248,4 @@ PrimaryIntegrity == \A i, j \in Server: /\ IsLeader(i)   /\ IsMyLearner(i, j)
 \* Modification History
 \* Last modified Tue Jan 31 20:40:11 CST 2023 by huangbinyu
 \* Last modified Sat Dec 11 22:31:08 CST 2021 by Dell
-\* Created Thu Dec 02 20:49:23 CST 2021 by Dell
\ No newline at end of file
+\* Created Thu Dec 02 20:49:23 CST 2021 by Dell
diff --git a/zookeeper-specifications/protocol-spec/doc.md b/zookeeper-specifications/protocol-spec/doc.md
index 1c351de1d53..f4bb09b3494 100644
--- a/zookeeper-specifications/protocol-spec/doc.md
+++ b/zookeeper-specifications/protocol-spec/doc.md
@@ -1,3 +1,21 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
 # ZooKeeper's Protocol Specification of TLA+
 
 ## Overview
diff --git a/zookeeper-specifications/protocol-spec/issues.md b/zookeeper-specifications/protocol-spec/issues.md
index 6d7b41c93d7..559434dd974 100644
--- a/zookeeper-specifications/protocol-spec/issues.md
+++ b/zookeeper-specifications/protocol-spec/issues.md
@@ -1,3 +1,21 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
 # Issues
 
 >This document describes issues related to the ambiguous description of the Zab protocol. 
diff --git a/zookeeper-specifications/protocol-spec/verification-statistics.md b/zookeeper-specifications/protocol-spec/verification-statistics.md
index b7cc0274629..df7d0f1b9bd 100644
--- a/zookeeper-specifications/protocol-spec/verification-statistics.md
+++ b/zookeeper-specifications/protocol-spec/verification-statistics.md
@@ -1,3 +1,21 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
 # Verification Statistics 
 ##### Experiment configuration
 
diff --git a/zookeeper-specifications/system-spec/doc.md b/zookeeper-specifications/system-spec/doc.md
index c30ec1d548b..1a7d33b72a1 100644
--- a/zookeeper-specifications/system-spec/doc.md
+++ b/zookeeper-specifications/system-spec/doc.md
@@ -1,3 +1,21 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
 # ZooKeeper's System Specification of TLA+
 
 ## Overview
diff --git a/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
index 753ba96efc8..a5a44ba2ca0 100644
--- a/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
+++ b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
@@ -1,3 +1,21 @@
+(*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *)
+
 ------------------------- MODULE FastLeaderElection -------------------------
 \* This is the formal specification for Fast Leader Election in Zab protocol.
 (* Reference:
diff --git a/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
index 060ed3d0abb..cf8ca8fa180 100644
--- a/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
+++ b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
@@ -1,3 +1,21 @@
+(*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *)
+
 ------------------------------ MODULE ZkV3_7_0 ------------------------------
 (* This is the system specification for Zab in apache/zookeeper with version 3.7.0 *)
 

From 618b676bf16c2a68fa3c215fdba3fe6049359493 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Mon, 19 Jun 2023 17:07:28 +0800
Subject: [PATCH 376/591] ZOOKEEPER-3996: Fix flaky
 ReadOnlyModeTest.testConnectionEvents (#1896)

The same watcher was resued across different clients. It is hard to
know which event will last during verification, disconnected from old
client or connected from new client.

A brand new watcher solves this.
---
 .../org/apache/zookeeper/test/ClientBase.java | 24 ++++++++++++-------
 .../zookeeper/test/ReadOnlyModeTest.java      |  1 +
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index e2257c1563c..cf35fdc54bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -124,6 +124,12 @@ public synchronized void process(WatchedEvent event) {
         public synchronized boolean isConnected() {
             return connected;
         }
+
+        protected synchronized String connectionDescription() {
+            return String.format("connected(%s), syncConnected(%s), readOnlyConnected(%s)",
+                    connected, syncConnected, readOnlyConnected);
+        }
+
         public synchronized void waitForConnected(long timeout) throws InterruptedException, TimeoutException {
             long expire = Time.currentElapsedTime() + timeout;
             long left = timeout;
@@ -132,8 +138,7 @@ public synchronized void waitForConnected(long timeout) throws InterruptedExcept
                 left = expire - Time.currentElapsedTime();
             }
             if (!connected) {
-                throw new TimeoutException("Failed to connect to ZooKeeper server.");
-
+                throw new TimeoutException("Failed to connect to ZooKeeper server: " + connectionDescription());
             }
         }
         public synchronized void waitForSyncConnected(long timeout) throws InterruptedException, TimeoutException {
@@ -144,18 +149,22 @@ public synchronized void waitForSyncConnected(long timeout) throws InterruptedEx
                 left = expire - Time.currentElapsedTime();
             }
             if (!syncConnected) {
-                throw new TimeoutException("Failed to connect to read-write ZooKeeper server.");
+                throw new TimeoutException(
+                    "Failed to connect to read-write ZooKeeper server: "
+                    + connectionDescription());
             }
         }
         public synchronized void waitForReadOnlyConnected(long timeout) throws InterruptedException, TimeoutException {
-            long expire = System.currentTimeMillis() + timeout;
+            long expire = Time.currentElapsedTime() + timeout;
             long left = timeout;
             while (!readOnlyConnected && left > 0) {
                 wait(left);
-                left = expire - System.currentTimeMillis();
+                left = expire - Time.currentElapsedTime();
             }
             if (!readOnlyConnected) {
-                throw new TimeoutException("Failed to connect in read-only mode to ZooKeeper server.");
+                throw new TimeoutException(
+                    "Failed to connect in read-only mode to ZooKeeper server: "
+                    + connectionDescription());
             }
         }
         public synchronized void waitForDisconnected(long timeout) throws InterruptedException, TimeoutException {
@@ -166,8 +175,7 @@ public synchronized void waitForDisconnected(long timeout) throws InterruptedExc
                 left = expire - Time.currentElapsedTime();
             }
             if (connected) {
-                throw new TimeoutException("Did not disconnect");
-
+                throw new TimeoutException("Did not disconnect: " + connectionDescription());
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 49f871c1ce4..521a1247d16 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -191,6 +191,7 @@ public void testConnectionEvents() throws Exception {
 
         // Re-connect the client (in case we were connected to the shut down
         // server and the local session was not persisted).
+        watcher = new CountdownWatcher();
         zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         long start = Time.currentElapsedTime();
         while (!(zk.getState() == States.CONNECTEDREADONLY)) {

From 58eed9f5280be1c6a9ccacc47dd6afa65e916ae8 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Wed, 21 Jun 2023 12:30:51 +0000
Subject: [PATCH 377/591] ZOOKEEPER-4026: Support `OpCode.create2` in
 `OpCode.multi`

Currently, nesting `OpCode.create2` in `OpCode.multi` will not get `stat`(ZOOKEEPER-1297). The cause is multifold:
* `MultiOperationRecord.deserialize` decays `OpCode.create2` to  `OpCode.create`.
* `DataTree.processTxn` ignores `OpCode.create2`.

This commit complements ZOOKEEPER-1297 to add `stat` for `OpCode.create2` in `OpCode.multi`.

It also adds `CreateOptions` to cover create mode, acl and ttl to avoid massive overloading methods.

Author: Kezhu Wang <kezhuw@gmail.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #1978 from kezhuw/ZOOKEEPER-4667-nest-create2-in-multi
---
 .../org/apache/zookeeper/CreateOptions.java   | 88 +++++++++++++++++++
 .../zookeeper/MultiOperationRecord.java       |  7 +-
 .../main/java/org/apache/zookeeper/Op.java    | 52 ++++++++++-
 .../org/apache/zookeeper/server/DataTree.java |  1 +
 .../zookeeper/MultiOperationRecordTest.java   |  2 +-
 .../zookeeper/server/CreateTTLTest.java       | 26 +++++-
 .../zookeeper/test/MultiOperationTest.java    | 24 +++++
 7 files changed, 190 insertions(+), 10 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java
new file mode 100644
index 00000000000..227124d89ee
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import java.util.List;
+import java.util.Objects;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.server.EphemeralType;
+
+/**
+ * Options for creating znode in ZooKeeper data tree.
+ */
+public class CreateOptions {
+    private final CreateMode createMode;
+    private final List<ACL> acl;
+    private final long ttl;
+
+    public CreateMode getCreateMode() {
+        return createMode;
+    }
+
+    public List<ACL> getAcl() {
+        return acl;
+    }
+
+    public long getTtl() {
+        return ttl;
+    }
+
+    /**
+     * Constructs a builder for {@link CreateOptions}.
+     *
+     * @param acl
+     *                the acl for the node
+     * @param createMode
+     *                specifying whether the node to be created is ephemeral
+     *                and/or sequential
+     */
+    public static Builder newBuilder(List<ACL> acl, CreateMode createMode) {
+        return new Builder(createMode, acl);
+    }
+
+    private CreateOptions(CreateMode createMode, List<ACL> acl, long ttl) {
+        this.createMode = createMode;
+        this.acl = acl;
+        this.ttl = ttl;
+        EphemeralType.validateTTL(createMode, ttl);
+    }
+
+    /**
+     * Builder for {@link CreateOptions}.
+     */
+    public static class Builder {
+        private final CreateMode createMode;
+        private final List<ACL> acl;
+        private long ttl = -1;
+
+        private Builder(CreateMode createMode, List<ACL> acl) {
+            this.createMode = Objects.requireNonNull(createMode, "create mode is mandatory for create options");
+            this.acl = Objects.requireNonNull(acl, "acl is mandatory for create options");
+        }
+
+        public Builder withTtl(long ttl) {
+            this.ttl = ttl;
+            return this;
+        }
+
+        public CreateOptions build() {
+            return new CreateOptions(createMode, acl, ttl);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
index 4ddacaceae8..72e9f197c34 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
@@ -126,7 +126,12 @@ public void deserialize(InputArchive archive, String tag) throws IOException {
                 case ZooDefs.OpCode.createContainer:
                     CreateRequest cr = new CreateRequest();
                     cr.deserialize(archive, tag);
-                    add(Op.create(cr.getPath(), cr.getData(), cr.getAcl(), cr.getFlags()));
+                    CreateMode createMode = CreateMode.fromFlag(cr.getFlags(), null);
+                    if (createMode == null) {
+                        throw new IOException("invalid flag " + cr.getFlags() + " for create mode");
+                    }
+                    CreateOptions options = CreateOptions.newBuilder(cr.getAcl(), createMode).build();
+                    add(Op.create(cr.getPath(), cr.getData(), options, h.getType()));
                     break;
                 case ZooDefs.OpCode.createTTL:
                     CreateTTLRequest crTtl = new CreateTTLRequest();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java
index 8597ea846f8..ca0c0859d14 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java
@@ -152,6 +152,42 @@ public static Op create(String path, byte[] data, List<ACL> acl, CreateMode crea
         return new Create(path, data, acl, createMode);
     }
 
+    /**
+     * Constructs a create operation which uses given op code if no one is inferred from create mode.
+     *
+     * @param path
+     *                the path for the node
+     * @param data
+     *                the initial data for the node
+     * @param options
+     *                options for creating znode
+     * @param defaultOpCode
+     *                op code to be used if no one is inferred from create mode
+     */
+    static Op create(String path, byte[] data, CreateOptions options, int defaultOpCode) {
+        if (options.getCreateMode().isTTL()) {
+            return new CreateTTL(path, data, options.getAcl(), options.getCreateMode(), options.getTtl());
+        }
+        return new Create(path, data, options.getAcl(), options.getCreateMode(), defaultOpCode);
+    }
+
+    /**
+     * Constructs a create operation which uses {@link ZooDefs.OpCode#create2} if no one is inferred from create mode.
+     *
+     * <p>The corresponding {@link OpResult.CreateResult#getStat()} could be null if connected to server without this
+     * patch.
+     *
+     * @param path
+     *                the path for the node
+     * @param data
+     *                the initial data for the node
+     * @param options
+     *                options for creating znode
+     */
+    public static Op create(String path, byte[] data, CreateOptions options) {
+        return create(path, data, options, ZooDefs.OpCode.create2);
+    }
+
     /**
      * Constructs a delete operation.  Arguments are as for the ZooKeeper method of the same name.
      * @see ZooKeeper#delete(String, int)
@@ -263,21 +299,29 @@ public static class Create extends Op {
         protected int flags;
 
         private Create(String path, byte[] data, List<ACL> acl, int flags) {
-            super(getOpcode(CreateMode.fromFlag(flags, CreateMode.PERSISTENT)), path, OpKind.TRANSACTION);
+            this(path, data, acl, flags, ZooDefs.OpCode.create);
+        }
+
+        private Create(String path, byte[] data, List<ACL> acl, int flags, int defaultOpCode) {
+            super(getOpcode(CreateMode.fromFlag(flags, CreateMode.PERSISTENT), defaultOpCode), path, OpKind.TRANSACTION);
             this.data = data;
             this.acl = acl;
             this.flags = flags;
         }
 
-        private static int getOpcode(CreateMode createMode) {
+        private static int getOpcode(CreateMode createMode, int defaultOpCode) {
             if (createMode.isTTL()) {
                 return ZooDefs.OpCode.createTTL;
             }
-            return createMode.isContainer() ? ZooDefs.OpCode.createContainer : ZooDefs.OpCode.create;
+            return createMode.isContainer() ? ZooDefs.OpCode.createContainer : defaultOpCode;
         }
 
         private Create(String path, byte[] data, List<ACL> acl, CreateMode createMode) {
-            super(getOpcode(createMode), path, OpKind.TRANSACTION);
+            this(path, data, acl, createMode, ZooDefs.OpCode.create);
+        }
+
+        private Create(String path, byte[] data, List<ACL> acl, CreateMode createMode, int defaultOpCode) {
+            super(getOpcode(createMode, defaultOpCode), path, OpKind.TRANSACTION);
             this.data = data;
             this.acl = acl;
             this.flags = createMode.toFlag();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index be1c7538593..b99bf632da6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -973,6 +973,7 @@ public ProcessTxnResult processTxn(TxnHeader header, Record txn, boolean isSubTx
                     Record record;
                     switch (subtxn.getType()) {
                     case OpCode.create:
+                    case OpCode.create2:
                         record = new CreateTxn();
                         break;
                     case OpCode.createTTL:
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
index 54bf12f4e9c..df8d8b91642 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
@@ -33,7 +33,7 @@ public class MultiOperationRecordTest extends ZKTestCase {
     public void testRoundTrip() throws IOException {
         MultiOperationRecord request = new MultiOperationRecord();
         request.add(Op.check("check", 1));
-        request.add(Op.create("create", "create data".getBytes(), ZooDefs.Ids.CREATOR_ALL_ACL, ZooDefs.Perms.ALL));
+        request.add(Op.create("create", "create data".getBytes(), ZooDefs.Ids.CREATOR_ALL_ACL, CreateMode.EPHEMERAL.toFlag()));
         request.add(Op.delete("delete", 17));
         request.add(Op.setData("setData", "set data".getBytes(), 19));
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
index 2cf5db4a592..ba13a0be573 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
@@ -30,6 +30,7 @@
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.CreateOptions;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.Op;
@@ -182,29 +183,46 @@ public void testModifying() throws KeeperException, InterruptedException {
 
     @Test
     public void testMulti() throws KeeperException, InterruptedException {
-        Op createTtl = Op.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, 100);
-        Op createTtlSequential = Op.create("/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL_WITH_TTL, 200);
+        CreateOptions options = CreateOptions
+                .newBuilder(ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL)
+                .withTtl(100)
+                .build();
+        CreateOptions sequentialOptions = CreateOptions
+                .newBuilder(ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL_WITH_TTL)
+                .withTtl(200)
+                .build();
+        Op createTtl = Op.create("/a", new byte[0], options.getAcl(), options.getCreateMode(), options.getTtl());
+        Op createTtl2 = Op.create("/a2", new byte[0], options);
+        Op createTtlSequential = Op.create("/b", new byte[0], sequentialOptions.getAcl(), sequentialOptions.getCreateMode(), sequentialOptions.getTtl());
+        Op createTtlSequential2 = Op.create("/b2", new byte[0], sequentialOptions);
         Op createNonTtl = Op.create("/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        List<OpResult> results = zk.multi(Arrays.asList(createTtl, createTtlSequential, createNonTtl));
-        String sequentialPath = ((OpResult.CreateResult) results.get(1)).getPath();
+        List<OpResult> results = zk.multi(Arrays.asList(createTtl, createTtl2, createTtlSequential, createTtlSequential2, createNonTtl));
+        String sequentialPath = ((OpResult.CreateResult) results.get(2)).getPath();
+        String sequentialPath2 = ((OpResult.CreateResult) results.get(3)).getPath();
 
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
         assertNotNull(zk.exists("/a", false), "node should not have been deleted yet");
+        assertNotNull(zk.exists("/a2", false), "node should not have been deleted yet");
         assertNotNull(zk.exists(sequentialPath, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists(sequentialPath2, false), "node should not have been deleted yet");
         assertNotNull(zk.exists("/c", false), "node should never be deleted");
 
         fakeElapsed.set(110);
         containerManager.checkContainers();
         assertNull(zk.exists("/a", false), "node should have been deleted");
+        assertNull(zk.exists("/a2", false), "node should have been deleted");
         assertNotNull(zk.exists(sequentialPath, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists(sequentialPath2, false), "node should not have been deleted yet");
         assertNotNull(zk.exists("/c", false), "node should never be deleted");
 
         fakeElapsed.set(210);
         containerManager.checkContainers();
         assertNull(zk.exists("/a", false), "node should have been deleted");
+        assertNull(zk.exists("/a2", false), "node should have been deleted");
         assertNull(zk.exists(sequentialPath, false), "node should have been deleted");
+        assertNull(zk.exists(sequentialPath2, false), "node should have been deleted");
         assertNotNull(zk.exists("/c", false), "node should never be deleted");
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index 0fdf02ca7aa..fd7b8a02fc7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -21,6 +21,7 @@
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertSame;
@@ -40,6 +41,7 @@
 import org.apache.zookeeper.AsyncCallback.MultiCallback;
 import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.CreateOptions;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.OpResult;
@@ -443,6 +445,28 @@ public void testCreate(boolean useAsync) throws Exception {
         zk.getData("/multi2", false, null);
     }
 
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testCreate2(boolean useAsync) throws Exception {
+        CreateOptions options = CreateOptions.newBuilder(Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT).build();
+        List<Op> ops = Arrays.asList(
+            Op.create("/multi0", new byte[0], options),
+            Op.create("/multi1", new byte[0], options),
+            Op.create("/multi2", new byte[0], options));
+        List<OpResult> results = multi(zk, ops, useAsync);
+        for (int i = 0; i < ops.size(); i++) {
+            CreateResult createResult = (CreateResult) results.get(i);
+            assertEquals(ops.get(i).getPath(), createResult.getPath());
+            assertEquals(ZooDefs.OpCode.create2, createResult.getType(), createResult.getPath());
+            assertNotNull(createResult.getStat(), createResult.getPath());
+            assertNotEquals(0, createResult.getStat().getCzxid(), createResult.getPath());
+        }
+
+        zk.getData("/multi0", false, null);
+        zk.getData("/multi1", false, null);
+        zk.getData("/multi2", false, null);
+    }
+
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     public void testEmpty(boolean useAsync) throws Exception {

From 77c1e4c872e7ff09b71345edc67f176ed5e68380 Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Fri, 23 Jun 2023 19:42:24 +0800
Subject: [PATCH 378/591]  ZOOKEEPER-4710 Fix ZkUtil deleteInBatch() by
 releasing semaphore after set flag (#2020)

---
 zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index ae0f3b8a2f6..e149408dc20 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -109,10 +109,10 @@ private static boolean deleteInBatch(ZooKeeper zk, List<String> tree, int batchS
         List<Op> ops = new ArrayList<>();
         BatchedDeleteCbContext context = new BatchedDeleteCbContext(rateLimit);
         MultiCallback cb = (rc, path, ctx, opResults) -> {
-            ((BatchedDeleteCbContext) ctx).sem.release();
             if (rc != Code.OK.intValue()) {
                 ((BatchedDeleteCbContext) ctx).success.set(false);
             }
+            ((BatchedDeleteCbContext) ctx).sem.release();
         };
 
         // Delete the leaves first and eventually get rid of the root

From bc7baf2a8336db487f09c8278eb3af2545d7dfb8 Mon Sep 17 00:00:00 2001
From: Fabio Buso <dev.siroibaf@gmail.com>
Date: Sun, 2 Jul 2023 06:39:07 -0700
Subject: [PATCH 379/591] ZOOKEEPER-4709: Upgrade Netty to 4.1.94.Final

---
 pom.xml                                                         | 2 +-
 ....Final.LICENSE.txt => netty-buffer-4.1.94.Final.LICENSE.txt} | 0
 ...6.Final.LICENSE.txt => netty-codec-4.1.94.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-common-4.1.94.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-handler-4.1.94.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-resolver-4.1.94.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-transport-4.1.94.Final.LICENSE.txt} | 0
 ...xt => netty-transport-native-epoll-4.1.94.Final.LICENSE.txt} | 0
 ...netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.86.Final.LICENSE.txt => netty-buffer-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.86.Final.LICENSE.txt => netty-codec-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.86.Final.LICENSE.txt => netty-common-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.86.Final.LICENSE.txt => netty-handler-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.86.Final.LICENSE.txt => netty-resolver-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.86.Final.LICENSE.txt => netty-transport-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-epoll-4.1.86.Final.LICENSE.txt => netty-transport-native-epoll-4.1.94.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.86.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index a7b7ebae82d..df2a403076b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -558,7 +558,7 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.86.Final</netty.version>
+    <netty.version>4.1.94.Final</netty.version>
     <jetty.version>9.4.51.v20230217</jetty.version>
     <jackson.version>2.13.4.2</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.94.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.86.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.86.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt

From 17be70412d847fcbb0491dfb0d5b4a48533193f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Sun, 2 Jul 2023 15:54:17 +0200
Subject: [PATCH 380/591] ZOOKEEPER-4393: [ADDENDUM] Add docs of fips-mode to
 ZooKeeper Admin Guide (#2015)

* ZOOKEEPER-4393: [ADDENDUM] Add docs of fips-mode to ZooKeeper Admin Guide

* ZOOKEEPER-4393: Some cosmetics
---
 .../src/main/resources/markdown/zookeeperAdmin.md         | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 83a749d0a08..b5744262925 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1834,6 +1834,14 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 
     This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.
 
+* *fips-mode* :
+    (Java system property: **zookeeper.fips-mode**)
+    **New in 3.8.2:**
+    Enable FIPS compatibility mode in ZooKeeper. If enabled, the custom trust manager (`ZKTrustManager`) that is used for 
+    hostname verification will be disabled in order to comply with FIPS requirements. As a consequence, hostname verification is not
+    available in the Quorum protocol, but still can be set in client-server communication. Default: **true** (3.9.0+), 
+    **false** (3.8.x)
+
 <a name="Experimental+Options%2FFeatures"></a>
 
 #### Experimental Options/Features

From f91a1fc08b61f00f3726d6595db45835b4cfea62 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <symat@apache.org>
Date: Sun, 2 Jul 2023 16:19:03 +0200
Subject: [PATCH 381/591] ZOOKEEPER-4716: upgrade jackson to 2.15.2, suppress
 two false positive CVE errors (#2026)

Our jackson is quite old, I want to upgrade it before release 3.8.2.

Also we have a few false positive CVEs reported by OWASP:

- CVE-2023-35116: according to jackson community, this is not a security issue,
  see https://github.com/FasterXML/jackson-databind/issues/3972#issuecomment-1596193098
- CVE-2022-45688: the following CVE is not even jackson related, but a
  vulnerability in json-java which we don't use in ZooKeeper
---
 owaspSuppressions.xml | 12 ++++++++++++
 pom.xml               |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 70203213232..0c09a096f70 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -54,4 +54,16 @@
       <cve>CVE-2021-34429</cve>
    </suppress>
 
+   <suppress>
+      <!-- ZOOKEEPER-4716: jackson related false positives -->
+
+      <!-- according to jackson community, this is not a security issue,
+           see: https://github.com/FasterXML/jackson-databind/issues/3972#issuecomment-1596193098 -->
+      <cve>CVE-2023-35116</cve>
+
+      <!-- the following CVE is not even jackson related, but a vulnerability
+           in json-java which we don't use in ZooKeeper -->
+      <cve>CVE-2022-45688</cve>
+   </suppress>
+
 </suppressions>
diff --git a/pom.xml b/pom.xml
index df2a403076b..ce01ee71d7c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -560,7 +560,7 @@
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.94.Final</netty.version>
     <jetty.version>9.4.51.v20230217</jetty.version>
-    <jackson.version>2.13.4.2</jackson.version>
+    <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.9.1</snappy.version>
     <kerby.version>2.0.0</kerby.version>

From 4661437a16c5307a041f3a8e14d34d186388aafd Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@users.noreply.github.com>
Date: Tue, 4 Jul 2023 13:51:41 +0300
Subject: [PATCH 382/591] ZOOKEEPER-4707: Upgrade snappy-java to address
 multiple CVEs (#2014)

Address multiple CVEs:
CVE-2023-34453
CVE-2023-34454
CVE-2023-34455

See https://github.com/xerial/snappy-java/releases/tag/v1.1.10.1
---
 pom.xml                                                         | 2 +-
 ...9.1.jar_LICENSE.txt => snappy-java-1.1.10.1.jar_LICENSE.txt} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{snappy-java-1.1.9.1.jar_LICENSE.txt => snappy-java-1.1.10.1.jar_LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index ce01ee71d7c..50801abd464 100644
--- a/pom.xml
+++ b/pom.xml
@@ -562,7 +562,7 @@
     <jetty.version>9.4.51.v20230217</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
-    <snappy.version>1.1.9.1</snappy.version>
+    <snappy.version>1.1.10.1</snappy.version>
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.60</bouncycastle.version>
     <commons-collections.version>4.4</commons-collections.version>
diff --git a/zookeeper-server/src/main/resources/lib/snappy-java-1.1.9.1.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.1.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/snappy-java-1.1.9.1.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.1.jar_LICENSE.txt

From 4a794276d3d371071c31f86c14da824fdd2e53c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 4 Jul 2023 17:49:51 +0300
Subject: [PATCH 383/591] ZOOKEEPER-4622 Add Netty-TcNative OpenSSL Support
 (#2009)

---
 pom.xml                                       |   9 +-
 .../main/resources/markdown/zookeeperAdmin.md |   7 +
 zookeeper-server/pom.xml                      |   5 +
 .../zookeeper/ClientCnxnSocketNetty.java      |  42 ++--
 .../zookeeper/common/ClientX509Util.java      | 164 ++++++++++++++
 .../zookeeper/common/QuorumX509Util.java      |   3 +
 .../common/SSLContextAndOptions.java          |  42 +---
 .../org/apache/zookeeper/common/ZKConfig.java |   1 +
 .../server/NettyServerCnxnFactory.java        |  19 +-
 .../auth/X509AuthenticationProvider.java      |   5 +-
 .../lib/netty-bom-4.1.94.Final.LICENSE.txt    | 202 ++++++++++++++++++
 .../apache/zookeeper/test/ClientSSLTest.java  |  44 +++-
 12 files changed, 447 insertions(+), 96 deletions(-)
 create mode 100644 zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index 50801abd464..a538c1bb9a8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -704,13 +704,10 @@
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
-        <artifactId>netty-handler</artifactId>
-        <version>${netty.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>io.netty</groupId>
-        <artifactId>netty-transport-native-epoll</artifactId>
+        <artifactId>netty-bom</artifactId>
         <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
       </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index b5744262925..e6e7eb1c867 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1767,6 +1767,13 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     **New in 3.5.5:**
     TBD
 
+* *ssl.sslProvider* :
+    (Java system property: **zookeeper.ssl.sslProvider**)
+    **New in 3.9.0:**
+    Allows to select SSL provider in the client-server communication when TLS is enabled. Netty-tcnative native library
+    has been added to ZooKeeper in version 3.9.0 which allows us to use native SSL libraries like OpenSSL on supported
+    platforms. See the available options in Netty-tcnative documentation. Default value is "JDK".
+
 * *sslQuorumReloadCertFiles* :
     (No Java system property)
     **New in  3.5.5, 3.6.0:**
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 1d8d5ba722a..3d6da76788e 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -69,6 +69,11 @@
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty-transport-native-epoll</artifactId>
+      <classifier>linux-x86_64</classifier>
+    </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-tcnative-boringssl-static</artifactId>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
index f82ead06aba..5b82c37f9da 100755
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper;
 
-import static org.apache.zookeeper.common.X509Exception.SSLContextException;
 import io.netty.bootstrap.Bootstrap;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.ByteBufAllocator;
@@ -33,7 +32,7 @@
 import io.netty.channel.EventLoopGroup;
 import io.netty.channel.SimpleChannelInboundHandler;
 import io.netty.channel.socket.SocketChannel;
-import io.netty.handler.ssl.SslHandler;
+import io.netty.handler.ssl.SslContext;
 import io.netty.util.concurrent.Future;
 import io.netty.util.concurrent.GenericFutureListener;
 import java.io.IOException;
@@ -48,15 +47,13 @@
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLEngine;
-import javax.net.ssl.SSLParameters;
+import javax.net.ssl.SSLException;
 import org.apache.zookeeper.ClientCnxn.EndOfStreamException;
 import org.apache.zookeeper.ClientCnxn.Packet;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.NettyUtils;
-import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.X509Exception;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -425,13 +422,11 @@ public static Packet getInstance() {
      * connection implementation.
      */
     private class ZKClientPipelineFactory extends ChannelInitializer<SocketChannel> {
+        private SslContext sslContext = null;
+        private final String host;
+        private final int port;
 
-        private SSLContext sslContext = null;
-        private SSLEngine sslEngine = null;
-        private String host;
-        private int port;
-
-        public ZKClientPipelineFactory(String host, int port) {
+        private ZKClientPipelineFactory(String host, int port) {
             this.host = host;
             this.port = port;
         }
@@ -445,25 +440,16 @@ protected void initChannel(SocketChannel ch) throws Exception {
             pipeline.addLast("handler", new ZKClientHandler());
         }
 
-        // The synchronized is to prevent the race on shared variable "sslEngine".
+        // The synchronized is to prevent the race on shared variable "sslContext".
         // Basically we only need to create it once.
-        private synchronized void initSSL(ChannelPipeline pipeline) throws SSLContextException {
-            if (sslContext == null || sslEngine == null) {
-                try (X509Util x509Util = new ClientX509Util()) {
-                    sslContext = x509Util.createSSLContext(clientConfig);
-                    sslEngine = sslContext.createSSLEngine(host, port);
-                    sslEngine.setUseClientMode(true);
-                    if (x509Util.getFipsMode(clientConfig) && x509Util.isServerHostnameVerificationEnabled(clientConfig)) {
-                        SSLParameters sslParameters = sslEngine.getSSLParameters();
-                        sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
-                        sslEngine.setSSLParameters(sslParameters);
-                        if (LOG.isDebugEnabled()) {
-                            LOG.debug("Server hostname verification: enabled HTTPS style endpoint identification algorithm");
-                        }
-                    }
+        private synchronized void initSSL(ChannelPipeline pipeline)
+            throws X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
+            if (sslContext == null) {
+                try (ClientX509Util x509Util = new ClientX509Util()) {
+                    sslContext = x509Util.createNettySslContextForClient(clientConfig);
                 }
             }
-            pipeline.addLast("ssl", new SslHandler(sslEngine));
+            pipeline.addLast("ssl", sslContext.newHandler(pipeline.channel().alloc(), host, port));
             LOG.info("SSL handler added for channel: {}", pipeline.channel());
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 34be0beceb3..7bb45390382 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -18,9 +18,28 @@
 
 package org.apache.zookeeper.common;
 
+import io.netty.handler.ssl.DelegatingSslContext;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslProvider;
+import java.util.Arrays;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.TrustManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * X509 utilities specific for client-server communication framework.
+ */
 public class ClientX509Util extends X509Util {
 
+    private static final Logger LOG = LoggerFactory.getLogger(ClientX509Util.class);
+
     private final String sslAuthProviderProperty = getConfigPrefix() + "authProvider";
+    private final String sslProviderProperty = getConfigPrefix() + "sslProvider";
 
     @Override
     protected String getConfigPrefix() {
@@ -36,4 +55,149 @@ public String getSslAuthProviderProperty() {
         return sslAuthProviderProperty;
     }
 
+    public String getSslProviderProperty() {
+        return sslProviderProperty;
+    }
+
+    public SslContext createNettySslContextForClient(ZKConfig config)
+        throws X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
+        String keyStoreLocation = config.getProperty(getSslKeystoreLocationProperty(), "");
+        String keyStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslKeystorePasswdProperty(),
+            getSslKeystorePasswdPathProperty());
+        String keyStoreType = config.getProperty(getSslKeystoreTypeProperty());
+
+        SslContextBuilder sslContextBuilder = SslContextBuilder.forClient();
+
+        if (keyStoreLocation.isEmpty()) {
+            LOG.warn("{} not specified", getSslKeystoreLocationProperty());
+        } else {
+            sslContextBuilder.keyManager(createKeyManager(keyStoreLocation, keyStorePassword, keyStoreType));
+        }
+
+        TrustManager tm = getTrustManager(config);
+        if (tm != null) {
+            sslContextBuilder.trustManager(tm);
+        }
+
+        sslContextBuilder.enableOcsp(config.getBoolean(getSslOcspEnabledProperty()));
+        sslContextBuilder.protocols(getEnabledProtocols(config));
+        Iterable<String> enabledCiphers = getCipherSuites(config);
+        if (enabledCiphers != null) {
+            sslContextBuilder.ciphers(enabledCiphers);
+        }
+        sslContextBuilder.sslProvider(getSslProvider(config));
+
+        SslContext sslContext1 = sslContextBuilder.build();
+
+        if (getFipsMode(config) && isServerHostnameVerificationEnabled(config)) {
+            return addHostnameVerification(sslContext1, "Server");
+        } else {
+            return sslContext1;
+        }
+    }
+
+    public SslContext createNettySslContextForServer(ZKConfig config)
+        throws X509Exception.SSLContextException, X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
+        String keyStoreLocation = config.getProperty(getSslKeystoreLocationProperty(), "");
+        String keyStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslKeystorePasswdProperty(),
+            getSslKeystorePasswdPathProperty());
+        String keyStoreType = config.getProperty(getSslKeystoreTypeProperty());
+
+        if (keyStoreLocation.isEmpty()) {
+            throw new X509Exception.SSLContextException(
+                "Keystore is required for SSL server: " + getSslKeystoreLocationProperty());
+        }
+
+        KeyManager km = createKeyManager(keyStoreLocation, keyStorePassword, keyStoreType);
+
+        return createNettySslContextForServer(config, km, getTrustManager(config));
+    }
+
+    public SslContext createNettySslContextForServer(ZKConfig config, KeyManager keyManager, TrustManager trustManager) throws SSLException {
+        SslContextBuilder sslContextBuilder = SslContextBuilder.forServer(keyManager);
+
+        if (trustManager != null) {
+            sslContextBuilder.trustManager(trustManager);
+        }
+
+        sslContextBuilder.enableOcsp(config.getBoolean(getSslOcspEnabledProperty()));
+        sslContextBuilder.protocols(getEnabledProtocols(config));
+        sslContextBuilder.clientAuth(getClientAuth(config).toNettyClientAuth());
+        Iterable<String> enabledCiphers = getCipherSuites(config);
+        if (enabledCiphers != null) {
+            sslContextBuilder.ciphers(enabledCiphers);
+        }
+        sslContextBuilder.sslProvider(getSslProvider(config));
+
+        SslContext sslContext1 = sslContextBuilder.build();
+
+        if (getFipsMode(config) && isClientHostnameVerificationEnabled(config)) {
+            return addHostnameVerification(sslContext1, "Client");
+        } else {
+            return sslContext1;
+        }
+    }
+
+    private SslContext addHostnameVerification(SslContext sslContext, String clientOrServer) {
+        return new DelegatingSslContext(sslContext) {
+            @Override
+            protected void initEngine(SSLEngine sslEngine) {
+                SSLParameters sslParameters = sslEngine.getSSLParameters();
+                sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+                sslEngine.setSSLParameters(sslParameters);
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug("{} hostname verification: enabled HTTPS style endpoint identification algorithm", clientOrServer);
+                }
+            }
+        };
+    }
+
+    private String[] getEnabledProtocols(final ZKConfig config) {
+        String enabledProtocolsInput = config.getProperty(getSslEnabledProtocolsProperty());
+        if (enabledProtocolsInput == null) {
+            return new String[]{ config.getProperty(getSslProtocolProperty(), DEFAULT_PROTOCOL) };
+        }
+        return enabledProtocolsInput.split(",");
+    }
+
+    private X509Util.ClientAuth getClientAuth(final ZKConfig config) {
+        return X509Util.ClientAuth.fromPropertyValue(config.getProperty(getSslClientAuthProperty()));
+    }
+
+    private Iterable<String> getCipherSuites(final ZKConfig config) {
+        String cipherSuitesInput = config.getProperty(getSslCipherSuitesProperty());
+        if (cipherSuitesInput == null) {
+            if (getSslProvider(config) != SslProvider.JDK) {
+                return null;
+            }
+            return Arrays.asList(X509Util.getDefaultCipherSuites());
+        } else {
+            return Arrays.asList(cipherSuitesInput.split(","));
+        }
+    }
+
+    public SslProvider getSslProvider(ZKConfig config) {
+        return SslProvider.valueOf(config.getProperty(getSslProviderProperty(), "JDK"));
+    }
+
+    private TrustManager getTrustManager(ZKConfig config) throws X509Exception.TrustManagerException {
+        String trustStoreLocation = config.getProperty(getSslTruststoreLocationProperty(), "");
+        String trustStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslTruststorePasswdProperty(),
+            getSslTruststorePasswdPathProperty());
+        String trustStoreType = config.getProperty(getSslTruststoreTypeProperty());
+
+        boolean sslCrlEnabled = config.getBoolean(getSslCrlEnabledProperty());
+        boolean sslOcspEnabled = config.getBoolean(getSslOcspEnabledProperty());
+        boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
+        boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
+
+        if (trustStoreLocation.isEmpty()) {
+            LOG.warn("{} not specified", getSslTruststoreLocationProperty());
+            return null;
+        } else {
+            return createTrustManager(trustStoreLocation, trustStorePassword, trustStoreType,
+                sslCrlEnabled, sslOcspEnabled, sslServerHostnameVerificationEnabled,
+                sslClientHostnameVerificationEnabled, getFipsMode(config));
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java
index d4cf19f5306..af3ee1bdeab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper.common;
 
+/**
+ * X509 utilities specific for server-server (quorum) communication framework.
+ */
 public class QuorumX509Util extends X509Util {
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
index 4e61d7b9b42..f5ce023c653 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
@@ -19,18 +19,11 @@
 package org.apache.zookeeper.common;
 
 import static java.util.Objects.requireNonNull;
-import io.netty.handler.ssl.DelegatingSslContext;
-import io.netty.handler.ssl.IdentityCipherSuiteFilter;
-import io.netty.handler.ssl.JdkSslContext;
-import io.netty.handler.ssl.SslContext;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.net.Socket;
 import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLServerSocket;
 import javax.net.ssl.SSLSocket;
@@ -51,11 +44,9 @@ public class SSLContextAndOptions {
     private final X509Util x509Util;
     private final String[] enabledProtocols;
     private final String[] cipherSuites;
-    private final List<String> cipherSuitesAsList;
     private final X509Util.ClientAuth clientAuth;
     private final SSLContext sslContext;
     private final int handshakeDetectionTimeoutMillis;
-    private final ZKConfig config;
 
 
     /**
@@ -69,12 +60,9 @@ public class SSLContextAndOptions {
         this.x509Util = requireNonNull(x509Util);
         this.sslContext = requireNonNull(sslContext);
         this.enabledProtocols = getEnabledProtocols(requireNonNull(config), sslContext);
-        String[] ciphers = getCipherSuites(config);
-        this.cipherSuites = ciphers;
-        this.cipherSuitesAsList = Collections.unmodifiableList(Arrays.asList(ciphers));
+        this.cipherSuites = getCipherSuites(config);
         this.clientAuth = getClientAuth(config);
         this.handshakeDetectionTimeoutMillis = getHandshakeDetectionTimeoutMillis(config);
-        this.config = config;
     }
 
     public SSLContext getSSLContext() {
@@ -106,34 +94,6 @@ public SSLServerSocket createSSLServerSocket(int port) throws IOException {
         return configureSSLServerSocket(sslServerSocket);
     }
 
-    public SslContext createNettyJdkSslContext(SSLContext sslContext) {
-        SslContext sslContext1 = new JdkSslContext(
-                sslContext,
-                false,
-                cipherSuitesAsList,
-                IdentityCipherSuiteFilter.INSTANCE,
-                null,
-                clientAuth.toNettyClientAuth(),
-                enabledProtocols,
-                false);
-
-        if (x509Util.getFipsMode(config) && x509Util.isClientHostnameVerificationEnabled(config)) {
-            return new DelegatingSslContext(sslContext1) {
-                @Override
-                protected void initEngine(SSLEngine sslEngine) {
-                    SSLParameters sslParameters = sslEngine.getSSLParameters();
-                    sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
-                    sslEngine.setSSLParameters(sslParameters);
-                    if (LOG.isDebugEnabled()) {
-                        LOG.debug("Client hostname verification: enabled HTTPS style endpoint identification algorithm");
-                    }
-                }
-            };
-        } else {
-            return sslContext1;
-        }
-    }
-
     public int getHandshakeDetectionTimeoutMillis() {
         return handshakeDetectionTimeoutMillis;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index f4670102946..de062e74754 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -106,6 +106,7 @@ protected void handleBackwardCompatibility() {
         try (ClientX509Util clientX509Util = new ClientX509Util()) {
             putSSLProperties(clientX509Util);
             properties.put(clientX509Util.getSslAuthProviderProperty(), System.getProperty(clientX509Util.getSslAuthProviderProperty()));
+            properties.put(clientX509Util.getSslProviderProperty(), System.getProperty(clientX509Util.getSslProviderProperty()));
         }
 
         try (X509Util x509Util = new QuorumX509Util()) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 13c8560cdf6..e6b0fac2a6e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -48,8 +48,6 @@
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.SocketAddress;
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -58,18 +56,16 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
-import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
-import javax.net.ssl.X509KeyManager;
-import javax.net.ssl.X509TrustManager;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.NettyUtils;
-import org.apache.zookeeper.common.SSLContextAndOptions;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.NettyServerCnxn.HandshakeState;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
@@ -573,14 +569,13 @@ protected void initChannel(SocketChannel ch) throws Exception {
         this.bootstrap.validate();
     }
 
-    private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext) throws X509Exception, KeyManagementException, NoSuchAlgorithmException {
+    private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext)
+        throws X509Exception, SSLException {
         String authProviderProp = System.getProperty(x509Util.getSslAuthProviderProperty());
         SslContext nettySslContext;
         if (authProviderProp == null) {
-            SSLContextAndOptions sslContextAndOptions = x509Util.getDefaultSSLContextAndOptions();
-            nettySslContext = sslContextAndOptions.createNettyJdkSslContext(sslContextAndOptions.getSSLContext());
+            nettySslContext = x509Util.createNettySslContextForServer(new ZKConfig());
         } else {
-            SSLContext sslContext = SSLContext.getInstance(ClientX509Util.DEFAULT_PROTOCOL);
             X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider(
                 System.getProperty(x509Util.getSslAuthProviderProperty(), "x509"));
 
@@ -589,8 +584,8 @@ private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext) t
                 throw new SSLContextException("Could not create SSLContext with specified auth provider: " + authProviderProp);
             }
 
-            sslContext.init(new X509KeyManager[]{authProvider.getKeyManager()}, new X509TrustManager[]{authProvider.getTrustManager()}, null);
-            nettySslContext = x509Util.getDefaultSSLContextAndOptions().createNettyJdkSslContext(sslContext);
+            nettySslContext = x509Util.createNettySslContextForServer(
+                new ZKConfig(), authProvider.getKeyManager(), authProvider.getTrustManager());
         }
 
         if (supportPlaintext) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index e3f5b2c76a5..26c083c3c9e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -18,9 +18,11 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
@@ -149,7 +151,8 @@ public String getScheme() {
 
     @Override
     public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
-        X509Certificate[] certChain = (X509Certificate[]) cnxn.getClientCertificateChain();
+        List<Certificate> certs = Arrays.asList(cnxn.getClientCertificateChain());
+        X509Certificate[] certChain = certs.toArray(new X509Certificate[certs.size()]);
 
         final Collection<Id> ids = handleAuthentication(certChain);
         if (ids.isEmpty()) {
diff --git a/zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt
new file mode 100644
index 00000000000..6279e5206de
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index 392c636dea8..b77283da772 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -27,9 +27,12 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import io.netty.handler.ssl.SslProvider;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
@@ -45,13 +48,35 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.CsvSource;
-import org.junit.jupiter.params.provider.ValueSource;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
 public class ClientSSLTest extends QuorumPeerTestBase {
 
     private ClientX509Util clientX509Util;
 
+    public static Stream<Arguments> positiveTestData() {
+        ArrayList<Arguments> result = new ArrayList<>();
+        for (SslProvider sslProvider : SslProvider.values()) {
+            for (String fipsEnabled : new String[] { "true", "false" }) {
+                for (String hostnameverification : new String[] { "true", "false" }) {
+                    result.add(Arguments.of(sslProvider, fipsEnabled, hostnameverification));
+                }
+            }
+        }
+        return result.stream();
+    }
+
+    public static Stream<Arguments> negativeTestData() {
+        ArrayList<Arguments> result = new ArrayList<>();
+        for (SslProvider sslProvider : SslProvider.values()) {
+            for (String fipsEnabled : new String[] { "true", "false" }) {
+                result.add(Arguments.of(sslProvider, fipsEnabled));
+            }
+        }
+        return result.stream();
+    }
+
     @BeforeEach
     public void setup() {
         System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
@@ -80,6 +105,7 @@ public void teardown() {
         System.clearProperty(clientX509Util.getSslTruststorePasswdPathProperty());
         System.clearProperty(clientX509Util.getFipsModeProperty());
         System.clearProperty(clientX509Util.getSslHostnameVerificationEnabledProperty());
+        System.clearProperty(clientX509Util.getSslProviderProperty());
         clientX509Util.close();
     }
 
@@ -118,10 +144,11 @@ public void testClientServerSSLWithCnxnClassName() throws Exception {
      * <p/>
      * This test covers the positive scenarios for hostname verification.
      */
-    @ParameterizedTest(name = "fipsEnabled={0}, hostnameVerification={1}")
-    @CsvSource({"true,true", "true,false", "false,true", "false,false"})
-    public void testClientServerSSL_positive(String fipsEnabled, String hostnameVerification) throws Exception {
+    @ParameterizedTest(name = "sslProvider={0}, fipsEnabled={1}, hostnameVerification={2}")
+    @MethodSource("positiveTestData")
+    public void testClientServerSSL_positive(SslProvider sslProvider, String fipsEnabled, String hostnameVerification) throws Exception {
         // Arrange
+        System.setProperty(clientX509Util.getSslProviderProperty(), sslProvider.toString());
         System.setProperty(clientX509Util.getFipsModeProperty(), fipsEnabled);
         System.setProperty(clientX509Util.getSslHostnameVerificationEnabledProperty(), hostnameVerification);
 
@@ -133,10 +160,11 @@ public void testClientServerSSL_positive(String fipsEnabled, String hostnameVeri
     /**
      * This test covers the negative scenarios for hostname verification.
      */
-    @ParameterizedTest(name = "fipsEnabled={0}")
-    @ValueSource(booleans = { true, false })
-    public void testClientServerSSL_negative(boolean fipsEnabled) {
+    @ParameterizedTest(name = "sslProvider={0}, fipsEnabled={1}")
+    @MethodSource("negativeTestData")
+    public void testClientServerSSL_negative(SslProvider sslProvider, boolean fipsEnabled) {
         // Arrange
+        System.setProperty(clientX509Util.getSslProviderProperty(), sslProvider.toString());
         System.setProperty(clientX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         System.setProperty(clientX509Util.getSslHostnameVerificationEnabledProperty(), "true");
 

From 2edb73a943928e0716b91e8a1d06a9c226fa393c Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Wed, 5 Jul 2023 21:46:05 +0800
Subject: [PATCH 384/591] ZOOKEEPER-4715: Verify file size and position in
 testGetCurrentLogSize (#2025)

---
 .../server/persistence/FileTxnLogTest.java    | 40 +++++++++++++++++--
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index adcc5f9fd7a..5c35618b730 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -30,6 +30,7 @@
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Random;
+import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.DummyWatcher;
 import org.apache.zookeeper.PortAssignment;
@@ -171,20 +172,43 @@ public void testGetCurrentLogSize() throws Exception {
         FileTxnLog log = new FileTxnLog(tmpDir);
         FileTxnLog.setPreallocSize(PREALLOCATE);
         CreateRequest record = new CreateRequest(null, new byte[NODE_SIZE], ZooDefs.Ids.OPEN_ACL_UNSAFE, 0);
+        long logSize = 0;
+        long position = 0;
+        int fileHeaderSize = 16;
         int zxid = 1;
         for (int i = 0; i < 4; i++) {
+            if (i == 0) {
+                logSize += fileHeaderSize;
+                position += fileHeaderSize;
+            }
             log.append(new TxnHeader(0, 0, zxid++, 0, 0), record);
-            LOG.debug("Current log size: {}", log.getCurrentLogSize());
+            logSize += PREALLOCATE;
+            assertEquals(logSize, log.getCurrentLogSize());
+            assertEquals(position, log.fos.getChannel().position());
         }
         log.commit();
-        LOG.info("Current log size: {}", log.getCurrentLogSize());
+        TxnHeader mockHeader = new TxnHeader(0, 0, 0, 0, 0);
+        int totalSize =  fileHeaderSize + calculateSingleRecordLength(mockHeader, record) * 4;
+        assertEquals(totalSize, log.getCurrentLogSize());
+        assertEquals(totalSize, log.fos.getChannel().position());
         assertTrue(log.getCurrentLogSize() > (zxid - 1) * NODE_SIZE);
+        logSize = FilePadding.calculateFileSizeWithPadding(log.fos.getChannel().position(), PREALLOCATE * 4, PREALLOCATE);
+        position = totalSize;
+        boolean recalculate = true;
         for (int i = 0; i < 4; i++) {
             log.append(new TxnHeader(0, 0, zxid++, 0, 0), record);
-            LOG.debug("Current log size: {}", log.getCurrentLogSize());
+            if (recalculate) {
+                recalculate = false;
+            } else {
+                logSize += PREALLOCATE;
+            }
+            assertEquals(logSize, log.getCurrentLogSize());
+            assertEquals(position, log.fos.getChannel().position());
         }
         log.commit();
-        LOG.info("Current log size: " + log.getCurrentLogSize());
+        totalSize += calculateSingleRecordLength(mockHeader, record) * 4;
+        assertEquals(totalSize, log.getCurrentLogSize());
+        assertEquals(totalSize, log.fos.getChannel().position());
         assertTrue(log.getCurrentLogSize() > (zxid - 1) * NODE_SIZE);
     }
 
@@ -263,4 +287,12 @@ public void testLogSizeLimit() throws Exception {
         }
     }
 
+    private int calculateSingleRecordLength(TxnHeader txnHeader, Record record) throws IOException {
+        int crcLength = 8;
+        int dataLength = 4;
+        int recordLength = Util.marshallTxnEntry(txnHeader, record).length;
+        int endFlagLength = 1;
+        return crcLength + dataLength + recordLength + endFlagLength;
+    }
+
 }

From e08cc2a782982964a57651f179a468b19e2e6010 Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Fri, 7 Jul 2023 09:55:30 +0800
Subject: [PATCH 385/591] ZOOKEEPER-4718: Removing unnecessary heap memory
 allocation in serialization to help reduce GC pressure (#2031)

---
 .../java/org/apache/zookeeper/server/util/SerializeUtils.java  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
index ba91faaf87c..e38772f009e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
@@ -175,11 +175,12 @@ public static byte[] serializeRequest(Request request) {
         if (request == null || request.getHdr() == null) {
             return null;
         }
-        byte[] data = new byte[32];
+        byte[] data;
         try {
             data = Util.marshallTxnEntry(request.getHdr(), request.getTxn(), request.getTxnDigest());
         } catch (IOException e) {
             LOG.error("This really should be impossible", e);
+            data = new byte[32];
         }
         return data;
     }

From f8459b816eb2c7c153ae9461b761434b993b2135 Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Thu, 13 Jul 2023 14:18:13 +0800
Subject: [PATCH 386/591] ZOOKEEPER-4717: Cache serialize data in the request
 to avoid repeat serialize. (#2030)

---
 .../org/apache/zookeeper/server/Request.java  | 25 +++++++++++++
 .../apache/zookeeper/server/ZKDatabase.java   |  3 +-
 .../server/persistence/FileTxnLog.java        | 15 ++------
 .../server/persistence/FileTxnSnapLog.java    |  2 +-
 .../zookeeper/server/persistence/TxnLog.java  | 15 ++------
 .../zookeeper/server/persistence/Util.java    | 12 +++----
 .../zookeeper/server/quorum/Leader.java       |  3 +-
 .../zookeeper/server/util/SerializeUtils.java | 17 ---------
 .../zookeeper/server/TxnLogDigestTest.java    |  7 ++--
 .../server/persistence/FileTxnLogTest.java    | 35 ++++++++++++-------
 .../server/quorum/LeaderBeanTest.java         |  3 +-
 .../server/util/SerializeUtilsTest.java       | 12 ++-----
 .../test/LoadFromLogNoServerTest.java         |  3 +-
 .../apache/zookeeper/test/LogChopperTest.java |  5 +--
 14 files changed, 73 insertions(+), 84 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 86a50fc5516..221f12d268d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.List;
@@ -30,11 +31,14 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * This is the structure that represents a request moving through a chain of
@@ -42,6 +46,7 @@
  * onto the request as it is processed.
  */
 public class Request {
+    private static final Logger LOG = LoggerFactory.getLogger(Request.class);
 
     public static final Request requestOfDeath = new Request(null, 0, 0, 0, null, null);
 
@@ -164,6 +169,26 @@ public boolean isThrottlable() {
                 && this.type != OpCode.createSession;
     }
 
+    private transient byte[] serializeData;
+
+    @SuppressFBWarnings(value = "EI_EXPOSE_REP")
+    public byte[] getSerializeData() {
+        if (this.hdr == null) {
+            return null;
+        }
+
+        if (this.serializeData == null) {
+            try {
+                this.serializeData = Util.marshallTxnEntry(this.hdr, this.txn, this.txnDigest);
+            } catch (IOException e) {
+                LOG.error("This really should be impossible.", e);
+                this.serializeData = new byte[32];
+            }
+        }
+
+        return this.serializeData;
+    }
+
     /**
      * If this is a create or close request for a local-only session.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index b50d00babdb..eaad05cd295 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -329,8 +329,7 @@ public void addCommittedProposal(Request request) {
                 minCommittedLog = request.zxid;
                 maxCommittedLog = request.zxid;
             }
-
-            byte[] data = SerializeUtils.serializeRequest(request);
+            byte[] data = request.getSerializeData();
             QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
             Proposal p = new Proposal();
             p.packet = pp;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index e095d2faa4d..51c70371676 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -257,18 +257,9 @@ public synchronized void close() throws IOException {
         }
     }
 
-    /**
-     * append an entry to the transaction log
-     * @param hdr the header of the transaction
-     * @param txn the transaction part of the entry
-     * returns true iff something appended, otw false
-     */
-    public synchronized boolean append(TxnHeader hdr, Record txn) throws IOException {
-              return append(hdr, txn, null);
-    }
-
     @Override
-    public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest) throws IOException {
+    public synchronized boolean append(Request request) throws IOException {
+        TxnHeader hdr = request.getHdr();
         if (hdr == null) {
             return false;
         }
@@ -296,7 +287,7 @@ public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest)
             streamsToFlush.add(fos);
         }
         filePadding.padFile(fos.getChannel());
-        byte[] buf = Util.marshallTxnEntry(hdr, txn, digest);
+        byte[] buf = request.getSerializeData();
         if (buf == null || buf.length == 0) {
             throw new IOException("Faulty serialization for header " + "and txn");
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index 16f9cf71ed5..fa6b4099ad6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -589,7 +589,7 @@ public File[] getSnapshotLogs(long zxid) {
      * @throws IOException
      */
     public boolean append(Request si) throws IOException {
-        return txnLog.append(si.getHdr(), si.getTxn(), si.getTxnDigest());
+        return txnLog.append(si);
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
index b5572087fb0..2c736dd0e46 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
@@ -21,6 +21,7 @@
 import java.io.Closeable;
 import java.io.IOException;
 import org.apache.jute.Record;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
@@ -43,24 +44,14 @@ public interface TxnLog extends Closeable {
      * @throws IOException
      */
     void rollLog() throws IOException;
-    /**
-     * Append a request to the transaction log
-     * @param hdr the transaction header
-     * @param r the transaction itself
-     * @return true iff something appended, otw false
-     * @throws IOException
-     */
-    boolean append(TxnHeader hdr, Record r) throws IOException;
 
     /**
      * Append a request to the transaction log with a digset
-     * @param hdr the transaction header
-     * @param r the transaction itself
-     * @param digest transaction digest
+     * @param request the request to be appended
      * returns true iff something appended, otw false
      * @throws IOException
      */
-    boolean append(TxnHeader hdr, Record r, TxnDigest digest) throws IOException;
+    boolean append(Request request) throws IOException;
 
     /**
      * Start reading the transaction logs
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
index 2aedf1dbf67..31c5ab5b6ef 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
@@ -172,23 +172,19 @@ public static byte[] readTxnBytes(InputArchive ia) throws IOException {
         return null;
     }
 
+
     /**
      * Serializes transaction header and transaction data into a byte buffer.
      *
      * @param hdr transaction header
      * @param txn transaction data
+     * @param digest transaction digest
+     *
      * @return serialized transaction record
-     * @throws IOException
      */
-    public static byte[] marshallTxnEntry(TxnHeader hdr, Record txn) throws IOException {
-        return marshallTxnEntry(hdr, txn, null);
-    }
-
-    public static byte[] marshallTxnEntry(TxnHeader hdr, Record txn, TxnDigest digest)
-            throws IOException {
+    public static byte[] marshallTxnEntry(TxnHeader hdr, Record txn, TxnDigest digest) throws IOException {
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         OutputArchive boa = BinaryOutputArchive.getArchive(baos);
-
         hdr.serialize(boa, "hdr");
         if (txn != null) {
             txn.serialize(boa, "txn");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index b15f5f555cc..0cb4d50de66 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -68,7 +68,6 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
@@ -1251,7 +1250,7 @@ public Proposal propose(Request request) throws XidRolloverException {
             throw new XidRolloverException(msg);
         }
 
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
         proposalStats.setLastBufferSize(data.length);
         QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
index e38772f009e..96440eeeb7f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
@@ -30,11 +30,9 @@
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.DataTree;
-import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.TxnLogEntry;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooTrace;
-import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.txn.CloseSessionTxn;
 import org.apache.zookeeper.txn.CreateContainerTxn;
 import org.apache.zookeeper.txn.CreateSessionTxn;
@@ -170,19 +168,4 @@ public static void serializeSnapshot(DataTree dt, OutputArchive oa, Map<Long, In
         }
         dt.serialize(oa, "tree");
     }
-
-    public static byte[] serializeRequest(Request request) {
-        if (request == null || request.getHdr() == null) {
-            return null;
-        }
-        byte[] data;
-        try {
-            data = Util.marshallTxnEntry(request.getHdr(), request.getTxn(), request.getTxnDigest());
-        } catch (IOException e) {
-            LOG.error("This really should be impossible", e);
-            data = new byte[32];
-        }
-        return data;
-    }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
index c6af1724ab8..75d6fe68000 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
@@ -31,7 +31,6 @@
 import mockit.Invocation;
 import mockit.Mock;
 import mockit.MockUp;
-import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.ZooDefs;
@@ -265,13 +264,13 @@ public static final class MockedFileTxnLog extends MockUp<FileTxnLog> {
         static long skipAppendZxid = -1;
 
         @Mock
-        public synchronized boolean append(Invocation invocation, TxnHeader hdr,
-                Record txn, TxnDigest digest) throws IOException {
+        public synchronized boolean append(Invocation invocation, Request request) throws IOException {
+            TxnHeader hdr = request.getHdr();
             if (hdr != null && hdr.getZxid() == skipAppendZxid) {
                 LOG.info("skipping txn {}", skipAppendZxid);
                 return true;
             }
-            return invocation.proceed(hdr, txn, digest);
+            return invocation.proceed(request);
         }
 
         public static void reset() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index 5c35618b730..7fa2ba1131e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -39,6 +39,7 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CreateRequest;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.server.ZKDatabase;
@@ -98,13 +99,19 @@ public void testPreAllocSizeSmallerThanTxnData() throws IOException {
 
         // Append and commit 2 transactions to the log
         // Prior to ZOOKEEPER-2249, attempting to pad in association with the second transaction will corrupt the first
-        fileTxnLog.append(
-            new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
-            new CreateTxn("/testPreAllocSizeSmallerThanTxnData1", data, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0));
+
+
+        fileTxnLog.append(new Request(0, 0, 0,
+                new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
+                new CreateTxn("/testPreAllocSizeSmallerThanTxnData1", data, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0),
+                0));
         fileTxnLog.commit();
-        fileTxnLog.append(
-            new TxnHeader(1, 1, 2, 2, ZooDefs.OpCode.create),
-            new CreateTxn("/testPreAllocSizeSmallerThanTxnData2", new byte[]{}, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0));
+
+        fileTxnLog.append(new Request(0, 0, 0,
+                new TxnHeader(1, 1, 2, 2, ZooDefs.OpCode.create),
+                new CreateTxn("/testPreAllocSizeSmallerThanTxnData2", new byte[]{},
+                        ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0),
+                0));
         fileTxnLog.commit();
         fileTxnLog.close();
 
@@ -143,11 +150,14 @@ public void testSyncThresholdExceedCount() throws IOException {
         // Verify serverStats is 0 before any commit
         assertEquals(0L, serverStats.getFsyncThresholdExceedCount());
 
+
         // When ...
         for (int i = 0; i < 50; i++) {
-            fileTxnLog.append(
-                new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
-                new CreateTxn("/testFsyncThresholdCountIncreased", new byte[]{}, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0));
+            fileTxnLog.append(new Request(0, 0, 0,
+                    new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
+                    new CreateTxn("/testFsyncThresholdCountIncreased", new byte[]{},
+                            ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0),
+                    0));
             fileTxnLog.commit(); // only 1 commit, otherwise it will be flaky
             // Then ... verify serverStats is updated to the number of commits (as threshold is set to 0)
             assertEquals((long) i + 1, serverStats.getFsyncThresholdExceedCount());
@@ -181,7 +191,8 @@ public void testGetCurrentLogSize() throws Exception {
                 logSize += fileHeaderSize;
                 position += fileHeaderSize;
             }
-            log.append(new TxnHeader(0, 0, zxid++, 0, 0), record);
+
+            log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid++, 0, 0), record, 0));
             logSize += PREALLOCATE;
             assertEquals(logSize, log.getCurrentLogSize());
             assertEquals(position, log.fos.getChannel().position());
@@ -196,7 +207,7 @@ public void testGetCurrentLogSize() throws Exception {
         position = totalSize;
         boolean recalculate = true;
         for (int i = 0; i < 4; i++) {
-            log.append(new TxnHeader(0, 0, zxid++, 0, 0), record);
+            log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid++, 0, 0), record, 0));
             if (recalculate) {
                 recalculate = false;
             } else {
@@ -290,7 +301,7 @@ public void testLogSizeLimit() throws Exception {
     private int calculateSingleRecordLength(TxnHeader txnHeader, Record record) throws IOException {
         int crcLength = 8;
         int dataLength = 4;
-        int recordLength = Util.marshallTxnEntry(txnHeader, record).length;
+        int recordLength = Util.marshallTxnEntry(txnHeader, record, null).length;
         int endFlagLength = 1;
         return crcLength + dataLength + recordLength + endFlagLength;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 82084e13ce1..6a914fbc603 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -42,7 +42,6 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.junit.jupiter.api.AfterEach;
@@ -125,7 +124,7 @@ public void testGetProposalSize() throws IOException, Leader.XidRolloverExceptio
         leader.propose(req);
 
         // Assert
-        byte[] data = SerializeUtils.serializeRequest(req);
+        byte[] data = req.getSerializeData();
         assertEquals(data.length, leaderBean.getLastProposalSize());
         assertEquals(data.length, leaderBean.getMinProposalSize());
         assertEquals(data.length, leaderBean.getMaxProposalSize());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
index 2df30cadb93..4e2421d13de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
@@ -42,16 +42,10 @@
 
 public class SerializeUtilsTest {
 
-    @Test
-    public void testSerializeRequestRequestIsNull() {
-        byte[] data = SerializeUtils.serializeRequest(null);
-        assertNull(data);
-    }
-
     @Test
     public void testSerializeRequestRequestHeaderIsNull() {
         Request request = new Request(0, 0, 0, null, null, 0);
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
         assertNull(data);
     }
 
@@ -71,7 +65,7 @@ public Object answer(InvocationOnMock invocation) throws Throwable {
         Request request = new Request(1, 2, 3, header, null, 4);
 
         // Act
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
 
         // Assert
         assertNotNull(data);
@@ -109,7 +103,7 @@ public Object answer(InvocationOnMock invocation) throws Throwable {
         Request request = new Request(1, 2, 3, header, txn, 4);
 
         // Act
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
 
         // Assert
         assertNotNull(data);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
index bec029d2c24..1f7fc0d7e76 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
@@ -34,6 +34,7 @@
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.DataNode;
 import org.apache.zookeeper.server.DataTree;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileHeader;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
@@ -166,7 +167,7 @@ public void testPad() throws Exception {
         FileTxnLog txnLog = new FileTxnLog(tmpDir);
         TxnHeader txnHeader = new TxnHeader(0xabcd, 0x123, 0x123, Time.currentElapsedTime(), ZooDefs.OpCode.create);
         Record txn = new CreateTxn("/Test", new byte[0], null, false, 1);
-        txnLog.append(txnHeader, txn);
+        txnLog.append(new Request(0, 0, 0, txnHeader, txn, 0));
         FileInputStream in = new FileInputStream(tmpDir.getPath() + "/log." + Long.toHexString(txnHeader.getZxid()));
         BinaryInputArchive ia = BinaryInputArchive.getArchive(in);
         FileHeader header = new FileHeader();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
index 9bdefc05177..fbe96d9f6f7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
@@ -31,6 +31,7 @@
 import java.nio.file.SimpleFileVisitor;
 import java.nio.file.attribute.BasicFileAttributes;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
 import org.apache.zookeeper.server.persistence.TxnLog;
 import org.apache.zookeeper.server.util.LogChopper;
@@ -101,12 +102,12 @@ public void testChopper() throws IOException {
 
         for (int i = 0; i < 100; i++) {
             TxnHeader hdr = new TxnHeader(clientId, cxid, ++zxid, ++time, type);
-            txnLog.append(hdr, txn);
+            txnLog.append(new Request(0, 0, 0, hdr, txn, 0));
         }
 
         // append a txn with gap
         TxnHeader hdr = new TxnHeader(clientId, cxid, zxid + 10, ++time, type);
-        txnLog.append(hdr, txn);
+        txnLog.append(new Request(0, 0, 0, hdr, txn, 0));
 
         txnLog.commit();
 

From e2e8ec661f8d50e5341bdefa0ccd8c5116f5ce4b Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Mon, 17 Jul 2023 18:16:16 +0800
Subject: [PATCH 387/591] ZOOKEEPER-4714: Improve syncRequestProcessor
 performance (#2024)

---
 .../org/apache/jute/BinaryOutputArchive.java  |  23 +++-
 .../java/org/apache/jute/OutputArchive.java   |   2 +
 .../apache/jute/ToStringOutputArchive.java    |  31 ++++-
 .../apache/jute/BinaryOutputArchiveTest.java  | 104 ++++++++++++++++
 .../jute/ToStringOutputArchiveTest.java       | 117 ++++++++++++++++++
 .../server/persistence/FilePadding.java       |   7 +-
 .../server/persistence/FileTxnLog.java        |  37 +++++-
 .../server/persistence/FileTxnLogTest.java    |  10 +-
 8 files changed, 313 insertions(+), 18 deletions(-)
 create mode 100644 zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java
 create mode 100644 zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java
index 4752d8461ab..52db1bc3c45 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java
@@ -34,6 +34,8 @@ public class BinaryOutputArchive implements OutputArchive {
 
     private DataOutput out;
 
+    private long dataSize;
+
     public static BinaryOutputArchive getArchive(OutputStream strm) {
         return new BinaryOutputArchive(new DataOutputStream(strm));
     }
@@ -47,26 +49,32 @@ public BinaryOutputArchive(DataOutput out) {
 
     public void writeByte(byte b, String tag) throws IOException {
         out.writeByte(b);
+        dataSize += 1;
     }
 
     public void writeBool(boolean b, String tag) throws IOException {
         out.writeBoolean(b);
+        dataSize += 1;
     }
 
     public void writeInt(int i, String tag) throws IOException {
         out.writeInt(i);
+        dataSize += 4;
     }
 
     public void writeLong(long l, String tag) throws IOException {
         out.writeLong(l);
+        dataSize += 8;
     }
 
     public void writeFloat(float f, String tag) throws IOException {
         out.writeFloat(f);
+        dataSize += 4;
     }
 
     public void writeDouble(double d, String tag) throws IOException {
         out.writeDouble(d);
+        dataSize += 8;
     }
 
     /**
@@ -108,18 +116,22 @@ public void writeString(String s, String tag) throws IOException {
             return;
         }
         ByteBuffer bb = stringToByteBuffer(s);
-        writeInt(bb.remaining(), "len");
+        int strLen = bb.remaining();
+        writeInt(strLen, "len");
         out.write(bb.array(), bb.position(), bb.limit());
+        dataSize += strLen;
     }
 
     public void writeBuffer(byte[] barr, String tag)
             throws IOException {
         if (barr == null) {
-            out.writeInt(-1);
+            writeInt(-1, "len");
             return;
         }
-        out.writeInt(barr.length);
+        int len = barr.length;
+        writeInt(len, "len");
         out.write(barr);
+        dataSize += len;
     }
 
     public void writeRecord(Record r, String tag) throws IOException {
@@ -150,4 +162,9 @@ public void startMap(TreeMap<?, ?> v, String tag) throws IOException {
     public void endMap(TreeMap<?, ?> v, String tag) throws IOException {
     }
 
+    @Override
+    public long getDataSize() {
+        return dataSize;
+    }
+
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java
index b076ca18b2e..6a37d67cdfc 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java
@@ -59,4 +59,6 @@ void writeBuffer(byte[] buf, String tag)
 
     void endMap(TreeMap<?, ?> v, String tag) throws IOException;
 
+    long getDataSize();
+
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java
index a144011d8df..91139727bd9 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java
@@ -32,6 +32,7 @@ public class ToStringOutputArchive implements OutputArchive {
 
     private PrintStream stream;
     private boolean isFirst = true;
+    private long dataSize;
 
     private void throwExceptionOnError(String tag) throws IOException {
         if (stream.checkError()) {
@@ -42,6 +43,7 @@ private void throwExceptionOnError(String tag) throws IOException {
     private void printCommaUnlessFirst() {
         if (!isFirst) {
             stream.print(",");
+            dataSize += 1;
         }
         isFirst = false;
     }
@@ -61,6 +63,7 @@ public void writeBool(boolean b, String tag) throws IOException {
         printCommaUnlessFirst();
         String val = b ? "T" : "F";
         stream.print(val);
+        dataSize += 1;
         throwExceptionOnError(tag);
     }
 
@@ -70,7 +73,9 @@ public void writeInt(int i, String tag) throws IOException {
 
     public void writeLong(long l, String tag) throws IOException {
         printCommaUnlessFirst();
-        stream.print(l);
+        String strValue = String.valueOf(l);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
@@ -80,20 +85,26 @@ public void writeFloat(float f, String tag) throws IOException {
 
     public void writeDouble(double d, String tag) throws IOException {
         printCommaUnlessFirst();
-        stream.print(d);
+        String strValue = String.valueOf(d);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
     public void writeString(String s, String tag) throws IOException {
         printCommaUnlessFirst();
-        stream.print(escapeString(s));
+        String strValue = escapeString(s);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
     public void writeBuffer(byte[] buf, String tag)
             throws IOException {
         printCommaUnlessFirst();
-        stream.print(escapeBuffer(buf));
+        String strValue = escapeBuffer(buf);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
@@ -108,6 +119,7 @@ public void startRecord(Record r, String tag) throws IOException {
         if (tag != null && !"".equals(tag)) {
             printCommaUnlessFirst();
             stream.print("s{");
+            dataSize += 2;
             isFirst = true;
         }
     }
@@ -115,9 +127,11 @@ public void startRecord(Record r, String tag) throws IOException {
     public void endRecord(Record r, String tag) throws IOException {
         if (tag == null || "".equals(tag)) {
             stream.print("\n");
+            dataSize += 1;
             isFirst = true;
         } else {
             stream.print("}");
+            dataSize += 1;
             isFirst = false;
         }
     }
@@ -125,25 +139,34 @@ public void endRecord(Record r, String tag) throws IOException {
     public void startVector(List<?> v, String tag) throws IOException {
         printCommaUnlessFirst();
         stream.print("v{");
+        dataSize += 2;
         isFirst = true;
     }
 
     public void endVector(List<?> v, String tag) throws IOException {
         stream.print("}");
+        dataSize += 1;
         isFirst = false;
     }
 
     public void startMap(TreeMap<?, ?> v, String tag) throws IOException {
         printCommaUnlessFirst();
         stream.print("m{");
+        dataSize += 2;
         isFirst = true;
     }
 
     public void endMap(TreeMap<?, ?> v, String tag) throws IOException {
         stream.print("}");
+        dataSize += 1;
         isFirst = false;
     }
 
+    @Override
+    public long getDataSize() {
+        return dataSize;
+    }
+
     private static String escapeString(String s) {
         if (s == null) {
             return "";
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java
new file mode 100644
index 00000000000..ed920652ef5
--- /dev/null
+++ b/zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jute;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.zookeeper.data.ClientInfo;
+import org.apache.zookeeper.proto.WhoAmIResponse;
+import org.junit.jupiter.api.Test;
+
+public class BinaryOutputArchiveTest {
+
+    @Test
+    public void testDataSize() throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream(32);
+        BinaryOutputArchive outputArchive = BinaryOutputArchive.getArchive(baos);
+        int dataSize = 0;
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int boolSize = 1;
+        dataSize += boolSize;
+        outputArchive.writeBool(true, "bool");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int byteSize = 1;
+        dataSize += byteSize;
+        outputArchive.writeByte(Byte.MAX_VALUE, "byte");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int intSize = 4;
+        dataSize += intSize;
+        outputArchive.writeInt(1, "int");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int longSize = 8;
+        dataSize += longSize;
+        outputArchive.writeLong(8L, "long");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int stringLengthSize = 4;
+        String str = "ab";
+        dataSize += stringLengthSize + str.length();
+        outputArchive.writeString(str, "string");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int floatSize = 4;
+        dataSize += floatSize;
+        outputArchive.writeFloat(12.0f, "float");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int doubleSize = 8;
+        dataSize += doubleSize;
+        outputArchive.writeDouble(12.44d, "double");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int bytesLengthSize = 4;
+        byte[] bytes = new byte[4];
+        bytes[0] = 'a';
+        bytes[1] = 'b';
+        bytes[2] = 'c';
+        bytes[3] = 'd';
+        dataSize += bytesLengthSize + bytes.length;
+        outputArchive.writeBuffer(bytes, "bytes");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String schema = "custom";
+        String user1 = "horizon";
+        String user2 = "zhao";
+        WhoAmIResponse whoAmIResponse = new WhoAmIResponse();
+        whoAmIResponse.setClientInfo(Arrays.asList(
+                new ClientInfo(schema, user1),
+                new ClientInfo(schema, user2)));
+
+        int listSizeLength = 4;
+        int clientInfo1Length = stringLengthSize + schema.length() + stringLengthSize + user1.length();
+        int clientInfo2Length = stringLengthSize + schema.length() + stringLengthSize + user2.length();
+        dataSize += listSizeLength + clientInfo1Length + clientInfo2Length;
+        outputArchive.writeRecord(whoAmIResponse, "record");
+        checkDataSize(dataSize, baos, outputArchive);
+    }
+
+    private void checkDataSize(int dataSize, ByteArrayOutputStream baos, OutputArchive outputArchive) {
+        assertEquals(dataSize, outputArchive.getDataSize());
+        assertEquals(baos.size(), outputArchive.getDataSize());
+    }
+
+}
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java
new file mode 100644
index 00000000000..8000fc948c8
--- /dev/null
+++ b/zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jute;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.zookeeper.data.ClientInfo;
+import org.apache.zookeeper.proto.WhoAmIResponse;
+import org.junit.jupiter.api.Test;
+
+public class ToStringOutputArchiveTest {
+
+    @Test
+    public void testDataSize() throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream(32);
+        ToStringOutputArchive outputArchive = new ToStringOutputArchive(baos);
+        int dataSize = 0;
+        assertEquals(dataSize, outputArchive.getDataSize());
+        assertEquals(dataSize, baos.size());
+
+        int boolSize = 1;
+        dataSize += boolSize;
+        outputArchive.writeBool(true, "bool");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String comma = ",";
+        byte b = Byte.MAX_VALUE;
+        int byteSize = String.valueOf(b).length();
+        dataSize += comma.length() + byteSize;
+        outputArchive.writeByte(b, "byte");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int i = 1;
+        int intSize = String.valueOf(i).length();
+        dataSize += comma.length() + intSize;
+        outputArchive.writeInt(i, "int");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        long l = 8L;
+        int longSize = String.valueOf(l).length();
+        dataSize += comma.length() + longSize;
+        outputArchive.writeLong(l, "long");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String apostrophe = "'";
+        String str = "ab";
+        int strSize = str.length();
+        dataSize += comma.length() + apostrophe.length() + strSize;
+        outputArchive.writeString(str, "string");
+        checkDataSize(dataSize, baos, outputArchive);
+
+
+        float f = 12.0f;
+        int floatSize = String.valueOf(f).length();
+        dataSize += comma.length() + floatSize;
+        outputArchive.writeFloat(f, "float");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        double d = 12.44d;
+        int doubleSize = String.valueOf(d).length();
+        dataSize += comma.length() + doubleSize;
+        outputArchive.writeDouble(d, "double");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        byte[] bytes = new byte[4];
+        bytes[0] = 'a';
+        bytes[1] = 'b';
+        bytes[2] = 'c';
+        bytes[3] = 'd';
+        String poundSign = "#";
+        int bytesSize = Integer.toHexString(bytes[0]).length()
+                + Integer.toHexString(bytes[1]).length()
+                + Integer.toHexString(bytes[2]).length()
+                + Integer.toHexString(bytes[3]).length();
+        dataSize += comma.length() + poundSign.length() + bytesSize;
+        outputArchive.writeBuffer(bytes, "bytes");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String schema = "custom";
+        String user1 = "horizon";
+        String user2 = "zhao";
+        WhoAmIResponse whoAmIResponse = new WhoAmIResponse();
+        whoAmIResponse.setClientInfo(Arrays.asList(
+                new ClientInfo(schema, user1),
+                new ClientInfo(schema, user2)));
+        String whoAmIResponseStr = whoAmIResponse.toString().replace("\n", "");
+
+        String startRecordSign = "s{";
+        String endRecordSign = "}";
+        dataSize += comma.length() + startRecordSign.length() + whoAmIResponseStr.length() + endRecordSign.length();
+        outputArchive.writeRecord(whoAmIResponse, "record");
+        checkDataSize(dataSize, baos, outputArchive);
+
+    }
+
+    private void checkDataSize(int dataSize, ByteArrayOutputStream baos, OutputArchive outputArchive) {
+        assertEquals(dataSize, outputArchive.getDataSize());
+        assertEquals(baos.size(), outputArchive.getDataSize());
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java
index b25855959e6..87e669f26c4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java
@@ -73,7 +73,11 @@ public void setCurrentSize(long currentSize) {
      * @throws IOException
      */
     long padFile(FileChannel fileChannel) throws IOException {
-        long newFileSize = calculateFileSizeWithPadding(fileChannel.position(), currentSize, preAllocSize);
+        return this.padFile(fileChannel, fileChannel.position());
+    }
+
+    long padFile(FileChannel fileChannel, long position) throws IOException {
+        long newFileSize = calculateFileSizeWithPadding(position, currentSize, preAllocSize);
         if (currentSize != newFileSize) {
             fileChannel.write((ByteBuffer) fill.position(0), newFileSize - fill.remaining());
             currentSize = newFileSize;
@@ -81,6 +85,7 @@ long padFile(FileChannel fileChannel) throws IOException {
         return currentSize;
     }
 
+
     /**
      * Calculates a new file size with padding. We only return a new size if
      * the current file position is sufficiently close (less than 4K) to end of
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index 51c70371676..e90a19e2c9c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -168,6 +168,12 @@ public class FileTxnLog implements TxnLog, Closeable {
      */
     private long prevLogsRunningTotal;
 
+    long filePosition = 0;
+
+    private long unFlushedSize = 0;
+
+    private long fileSize = 0;
+
     /**
      * constructor for FileTxnLog. Take the directory
      * where the txnlogs are stored
@@ -208,7 +214,7 @@ public static void setTxnLogSizeLimit(long size) {
      */
     public synchronized long getCurrentLogSize() {
         if (logFileWrite != null) {
-            return logFileWrite.length();
+            return fileSize;
         }
         return 0;
     }
@@ -239,7 +245,9 @@ public synchronized void rollLog() throws IOException {
             prevLogsRunningTotal += getCurrentLogSize();
             this.logStream = null;
             oa = null;
-
+            fileSize = 0;
+            filePosition = 0;
+            unFlushedSize = 0;
             // Roll over the current log file into the running total
         }
     }
@@ -280,22 +288,34 @@ public synchronized boolean append(Request request) throws IOException {
             logStream = new BufferedOutputStream(fos);
             oa = BinaryOutputArchive.getArchive(logStream);
             FileHeader fhdr = new FileHeader(TXNLOG_MAGIC, VERSION, dbId);
+            long dataSize = oa.getDataSize();
             fhdr.serialize(oa, "fileheader");
             // Make sure that the magic number is written before padding.
             logStream.flush();
-            filePadding.setCurrentSize(fos.getChannel().position());
+            // Before writing data, first obtain the size of the OutputArchive.
+            // After writing the data, obtain the size of the OutputArchive again,
+            // so we can obtain the size of the data written this time.
+            // In this case, the data already flush into the channel, so add the size to filePosition.
+            filePosition += oa.getDataSize() - dataSize;
+            filePadding.setCurrentSize(filePosition);
             streamsToFlush.add(fos);
         }
-        filePadding.padFile(fos.getChannel());
+        fileSize = filePadding.padFile(fos.getChannel(), filePosition);
         byte[] buf = request.getSerializeData();
         if (buf == null || buf.length == 0) {
             throw new IOException("Faulty serialization for header " + "and txn");
         }
+        long dataSize = oa.getDataSize();
         Checksum crc = makeChecksumAlgorithm();
         crc.update(buf, 0, buf.length);
         oa.writeLong(crc.getValue(), "txnEntryCRC");
         Util.writeTxnBytes(oa, buf);
-
+        // Before writing data, first obtain the size of the OutputArchive.
+        // After writing the data, obtain the size of the OutputArchive again,
+        // so we can obtain the size of the data written this time.
+        // In this case, the data just write to the cache, not flushed, so add the size to unFlushedSize.
+        // After flushed, the unFlushedSize will add to the filePosition.
+        unFlushedSize += oa.getDataSize() - dataSize;
         return true;
     }
 
@@ -367,6 +387,13 @@ public long getLastLoggedZxid() {
     public synchronized void commit() throws IOException {
         if (logStream != null) {
             logStream.flush();
+            filePosition += unFlushedSize;
+            // If we have written more than we have previously preallocated,
+            // we should override the fileSize by filePosition.
+            if (filePosition > fileSize) {
+                fileSize = filePosition;
+            }
+            unFlushedSize = 0;
         }
         for (FileOutputStream log : streamsToFlush) {
             log.flush();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index 7fa2ba1131e..3d44af73f7b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -195,15 +195,15 @@ public void testGetCurrentLogSize() throws Exception {
             log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid++, 0, 0), record, 0));
             logSize += PREALLOCATE;
             assertEquals(logSize, log.getCurrentLogSize());
-            assertEquals(position, log.fos.getChannel().position());
+            assertEquals(position, log.filePosition);
         }
         log.commit();
         TxnHeader mockHeader = new TxnHeader(0, 0, 0, 0, 0);
         int totalSize =  fileHeaderSize + calculateSingleRecordLength(mockHeader, record) * 4;
         assertEquals(totalSize, log.getCurrentLogSize());
-        assertEquals(totalSize, log.fos.getChannel().position());
+        assertEquals(totalSize, log.filePosition);
         assertTrue(log.getCurrentLogSize() > (zxid - 1) * NODE_SIZE);
-        logSize = FilePadding.calculateFileSizeWithPadding(log.fos.getChannel().position(), PREALLOCATE * 4, PREALLOCATE);
+        logSize = FilePadding.calculateFileSizeWithPadding(log.filePosition, PREALLOCATE * 4, PREALLOCATE);
         position = totalSize;
         boolean recalculate = true;
         for (int i = 0; i < 4; i++) {
@@ -214,12 +214,12 @@ public void testGetCurrentLogSize() throws Exception {
                 logSize += PREALLOCATE;
             }
             assertEquals(logSize, log.getCurrentLogSize());
-            assertEquals(position, log.fos.getChannel().position());
+            assertEquals(position, log.filePosition);
         }
         log.commit();
         totalSize += calculateSingleRecordLength(mockHeader, record) * 4;
         assertEquals(totalSize, log.getCurrentLogSize());
-        assertEquals(totalSize, log.fos.getChannel().position());
+        assertEquals(totalSize, log.filePosition);
         assertTrue(log.getCurrentLogSize() > (zxid - 1) * NODE_SIZE);
     }
 

From 4882f7b63490971e44a669e98428615ef7bf472f Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Mon, 17 Jul 2023 18:21:45 +0800
Subject: [PATCH 388/591] ZOOKEEPER-4719. Upgrade Bouncycastle from jdk15on to
 jdk18on (#2033)

---
 pom.xml                                                     | 6 +++---
 .../src/main/resources/markdown/zookeeperAdmin.md           | 2 +-
 zookeeper-server/pom.xml                                    | 4 ++--
 .../java/org/apache/zookeeper/common/X509TestHelpers.java   | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index a538c1bb9a8..1622c638eee 100644
--- a/pom.xml
+++ b/pom.xml
@@ -564,7 +564,7 @@
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.10.1</snappy.version>
     <kerby.version>2.0.0</kerby.version>
-    <bouncycastle.version>1.60</bouncycastle.version>
+    <bouncycastle.version>1.75</bouncycastle.version>
     <commons-collections.version>4.4</commons-collections.version>
     <dropwizard.version>4.1.12.1</dropwizard.version>
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
@@ -642,12 +642,12 @@
       </dependency>
       <dependency>
         <groupId>org.bouncycastle</groupId>
-        <artifactId>bcprov-jdk15on</artifactId>
+        <artifactId>bcprov-jdk18on</artifactId>
         <version>${bouncycastle.version}</version>
       </dependency>
       <dependency>
         <groupId>org.bouncycastle</groupId>
-        <artifactId>bcpkix-jdk15on</artifactId>
+        <artifactId>bcpkix-jdk18on</artifactId>
         <version>${bouncycastle.version}</version>
       </dependency>
       <dependency>
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index e6e7eb1c867..7a99cd346c6 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1565,7 +1565,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 
              ```
              For example:
-             copy bcprov-jdk15on-1.60.jar to $JAVA_HOME/jre/lib/ext/
+             copy bcprov-jdk18on-1.60.jar to $JAVA_HOME/jre/lib/ext/
              ```
 
     - How to migrate from one digest algorithm to another?
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 3d6da76788e..2fc653817db 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -109,12 +109,12 @@
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-jdk15on</artifactId>
+      <artifactId>bcprov-jdk18on</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcpkix-jdk15on</artifactId>
+      <artifactId>bcpkix-jdk18on</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
index fb1371a3da7..b9f2f6db946 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
@@ -270,7 +270,7 @@ public static String pemEncodePrivateKey(
         JcaPEMWriter pemWriter = new JcaPEMWriter(stringWriter);
         OutputEncryptor encryptor = null;
         if (password != null && password.length() > 0) {
-            encryptor = new JceOpenSSLPKCS8EncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd3_KeyTripleDES_CBC).setProvider(BouncyCastleProvider.PROVIDER_NAME).setRandom(PRNG).setPasssword(password.toCharArray()).build();
+            encryptor = new JceOpenSSLPKCS8EncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd3_KeyTripleDES_CBC).setProvider(BouncyCastleProvider.PROVIDER_NAME).setRandom(PRNG).setPassword(password.toCharArray()).build();
         }
         pemWriter.writeObject(new JcaPKCS8Generator(key, encryptor));
         pemWriter.close();

From f252116226cd28897f6d95d6faa74a89fb3d00ab Mon Sep 17 00:00:00 2001
From: Jeremy Richards <jrichards@trumidtech.com>
Date: Mon, 17 Jul 2023 04:33:53 -0600
Subject: [PATCH 389/591] Fix Grafana dashboard URL (#2034)

Signed-off-by: Jeremy Richards <jrichards@trumidtech.com>
---
 zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index eb50a04f342..d57645b31a8 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -204,7 +204,7 @@ All the metrics are included in the `ServerMetrics.java`.
     Url:    http://localhost:9090
     Access: proxy
     ```
-- Then download and import the default ZooKeeper dashboard [template](https://grafana.com/dashboards/10465) and customize.
+- Then download and import the default ZooKeeper dashboard [template](https://grafana.com/grafana/dashboards/10465) and customize.
 - Users can ask for Grafana dashboard account if having any good improvements by writing a email to **dev@zookeeper.apache.org**.
 
 <a name="influxdb"></a>

From 31117ce0280b1893eb8969b25f949b9c7709ca2e Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Mon, 17 Jul 2023 11:25:30 +0000
Subject: [PATCH 390/591] [maven-release-plugin] prepare branch @{releaseLabel}

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 1622c638eee..be5e18386da 100644
--- a/pom.xml
+++ b/pom.xml
@@ -71,7 +71,7 @@
     <connection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf/zookeeper.git</url>
-    <tag>HEAD</tag>
+    <tag>branch-3.9</tag>
   </scm>
   <issueManagement>
     <system>JIRA</system>

From b02497fd3be0abf96e5ec6b257a3e3977d74c7f7 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Mon, 17 Jul 2023 11:25:30 +0000
Subject: [PATCH 391/591] [maven-release-plugin] prepare for next development
 iteration

---
 pom.xml                                                       | 4 ++--
 zookeeper-assembly/pom.xml                                    | 2 +-
 zookeeper-client/pom.xml                                      | 2 +-
 zookeeper-client/zookeeper-client-c/CMakeLists.txt            | 2 +-
 zookeeper-client/zookeeper-client-c/configure.ac              | 2 +-
 .../zookeeper-client-c/include/zookeeper_version.h            | 2 +-
 zookeeper-client/zookeeper-client-c/pom.xml                   | 2 +-
 zookeeper-compatibility-tests/pom.xml                         | 2 +-
 .../zookeeper-compatibility-tests-curator/pom.xml             | 2 +-
 zookeeper-contrib/pom.xml                                     | 2 +-
 zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml            | 2 +-
 zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml          | 2 +-
 zookeeper-contrib/zookeeper-contrib-rest/pom.xml              | 2 +-
 zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml      | 2 +-
 zookeeper-docs/pom.xml                                        | 2 +-
 zookeeper-it/pom.xml                                          | 2 +-
 zookeeper-jute/pom.xml                                        | 2 +-
 zookeeper-metrics-providers/pom.xml                           | 2 +-
 .../zookeeper-prometheus-metrics/pom.xml                      | 2 +-
 zookeeper-recipes/pom.xml                                     | 2 +-
 zookeeper-recipes/zookeeper-recipes-election/pom.xml          | 2 +-
 zookeeper-recipes/zookeeper-recipes-lock/pom.xml              | 2 +-
 zookeeper-recipes/zookeeper-recipes-queue/pom.xml             | 2 +-
 zookeeper-server/pom.xml                                      | 2 +-
 24 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/pom.xml b/pom.xml
index be5e18386da..07a6460c091 100644
--- a/pom.xml
+++ b/pom.xml
@@ -31,7 +31,7 @@
   <artifactId>parent</artifactId>
   <packaging>pom</packaging>
   <!-- to change version: mvn -B release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
-  <version>3.9.0-SNAPSHOT</version>
+  <version>3.10.0-SNAPSHOT</version>
   <name>Apache ZooKeeper</name>
   <description>
     ZooKeeper is a centralized service for maintaining configuration information, naming,
@@ -71,7 +71,7 @@
     <connection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/zookeeper.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf/zookeeper.git</url>
-    <tag>branch-3.9</tag>
+    <tag>HEAD</tag>
   </scm>
   <issueManagement>
     <system>JIRA</system>
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index 4bdfc740cd4..37fb0eae0df 100755
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-assembly</artifactId>
diff --git a/zookeeper-client/pom.xml b/zookeeper-client/pom.xml
index 9d484e614dd..16f6419f6d2 100755
--- a/zookeeper-client/pom.xml
+++ b/zookeeper-client/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client</artifactId>
diff --git a/zookeeper-client/zookeeper-client-c/CMakeLists.txt b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
index ccfd7576caa..64fff2c6669 100644
--- a/zookeeper-client/zookeeper-client-c/CMakeLists.txt
+++ b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
@@ -16,7 +16,7 @@
 
 cmake_minimum_required(VERSION 3.5)
 
-project(zookeeper VERSION 3.8.0)
+project(zookeeper VERSION 3.10.0)
 set(email user@zookeeper.apache.org)
 set(description "zookeeper C client")
 
diff --git a/zookeeper-client/zookeeper-client-c/configure.ac b/zookeeper-client/zookeeper-client-c/configure.ac
index fe10af9f36a..0de8427e5bb 100644
--- a/zookeeper-client/zookeeper-client-c/configure.ac
+++ b/zookeeper-client/zookeeper-client-c/configure.ac
@@ -3,7 +3,7 @@
 
 AC_PREREQ(2.59)
 
-AC_INIT([zookeeper C client],3.8.0,[user@zookeeper.apache.org],[zookeeper])
+AC_INIT([zookeeper C client],3.10.0,[user@zookeeper.apache.org],[zookeeper])
 AC_CONFIG_SRCDIR([src/zookeeper.c])
 
 # Save initial CFLAGS and CXXFLAGS values before AC_PROG_CC and AC_PROG_CXX
diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h b/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
index 03d5928b388..639eaf5fe28 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
@@ -22,7 +22,7 @@
 extern "C" {
 #endif
 
-#define ZOO_VERSION "3.8.0"
+#define ZOO_VERSION "3.10.0"
 
 #ifdef __cplusplus
 }
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
index da130c97010..4550be26501 100755
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-client</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client-c</artifactId>
diff --git a/zookeeper-compatibility-tests/pom.xml b/zookeeper-compatibility-tests/pom.xml
index ad73b939031..2d85a16ad7d 100644
--- a/zookeeper-compatibility-tests/pom.xml
+++ b/zookeeper-compatibility-tests/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>parent</artifactId>
-        <version>3.9.0-SNAPSHOT</version>
+        <version>3.10.0-SNAPSHOT</version>
     </parent>
     <packaging>pom</packaging>
     <modelVersion>4.0.0</modelVersion>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
index 02544b3fb14..44aa201a7e8 100644
--- a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>zookeeper-compatibility-tests</artifactId>
-        <version>3.9.0-SNAPSHOT</version>
+        <version>3.10.0-SNAPSHOT</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index e0dabd917bf..0dc8e867da4 100755
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
index 172f9c8e6a9..f78a8fdce09 100755
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <groupId>org.apache.zookeeper</groupId>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
index 2a47599a9b5..3e129cadf96 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-loggraph</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
index 6067e196cdd..94dc093c12b 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-rest</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index 52ac31a1da4..ee209828f26 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-zooinspector</artifactId>
diff --git a/zookeeper-docs/pom.xml b/zookeeper-docs/pom.xml
index 8878ba96713..9fd096092b5 100644
--- a/zookeeper-docs/pom.xml
+++ b/zookeeper-docs/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-docs</artifactId>
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
index 21ae34381d2..0346bd90d64 100755
--- a/zookeeper-it/pom.xml
+++ b/zookeeper-it/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-it</artifactId>
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
index 55d18874b6d..2be9787d530 100755
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-jute</artifactId>
diff --git a/zookeeper-metrics-providers/pom.xml b/zookeeper-metrics-providers/pom.xml
index 9b876a61f56..054763d003a 100755
--- a/zookeeper-metrics-providers/pom.xml
+++ b/zookeeper-metrics-providers/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-metrics-providers</artifactId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index 2af310ce50e..2d8e48656b6 100755
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-metrics-providers</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-prometheus-metrics</artifactId>
diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
index 9de29b6319f..65a63d64156 100755
--- a/zookeeper-recipes/pom.xml
+++ b/zookeeper-recipes/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-election/pom.xml b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
index 9767a94865d..21f5388bc21 100755
--- a/zookeeper-recipes/zookeeper-recipes-election/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-election</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
index 4f23724c46e..b8c04fa73a3 100755
--- a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-lock</artifactId>
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
index 76169c221c0..e8f6e1c3704 100755
--- a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-queue</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 2fc653817db..00a3b533949 100755
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.9.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper</artifactId>

From 6e746f8e881bfeb99cf0f74fa50a3d9c9d679229 Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Tue, 18 Jul 2023 20:04:24 +0800
Subject: [PATCH 392/591] ZOOKEEPER-4607. Fix decode problem when sub tnx type
 is error (#1915)

Co-authored-by: tison <wander4096@gmail.com>
---
 .../server/persistence/TxnLogToolkit.java     | 21 ++++++++----
 .../server/persistence/TxnLogToolkitTest.java | 34 +++++++++++++++++++
 2 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
index 8e5b24bbcb2..767d640770c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
@@ -30,6 +30,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.text.DateFormat;
 import java.util.Date;
@@ -47,6 +48,7 @@
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.TxnLogEntry;
@@ -307,11 +309,13 @@ private void printTxn(byte[] bytes, String prefix) throws IOException {
     }
 
     /**
-     * get the formatted string from the txn.
+     * Get the formatted string from the txn.
+     *
      * @param txn transaction log data
      * @return the formatted string
      */
-    private static String getFormattedTxnStr(Record txn) throws IOException {
+    // @VisibleForTesting
+    static String getFormattedTxnStr(Record txn) {
         StringBuilder txnData = new StringBuilder();
         if (txn == null) {
             return txnData.toString();
@@ -340,19 +344,24 @@ private static String getFormattedTxnStr(Record txn) throws IOException {
             for (int i = 0; i < txnList.size(); i++) {
                 Txn t = txnList.get(i);
                 if (i == 0) {
-                    txnData.append(Request.op2String(t.getType()) + ":" + checkNullToEmpty(t.getData()));
+                    txnData.append(Request.op2String(t.getType())).append(":");
                 } else {
-                    txnData.append(";" + Request.op2String(t.getType()) + ":" + checkNullToEmpty(t.getData()));
+                    txnData.append(";").append(Request.op2String(t.getType())).append(":");
+                }
+                if (t.getType() == ZooDefs.OpCode.error) {
+                    txnData.append(ByteBuffer.wrap(t.getData()).getInt());
+                } else {
+                    txnData.append(checkNullToEmpty(t.getData()));
                 }
             }
         } else {
-            txnData.append(txn.toString());
+            txnData.append(txn);
         }
 
         return txnData.toString();
     }
 
-    private static String checkNullToEmpty(byte[] data) throws IOException {
+    private static String checkNullToEmpty(byte[] data) {
         if (data == null || data.length == 0) {
             return "";
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
index c65113469f9..ec02c75b31e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
@@ -21,6 +21,7 @@
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.IsNot.not;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
@@ -28,11 +29,19 @@
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.PrintStream;
+import java.nio.ByteBuffer;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Scanner;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import org.apache.commons.io.FileUtils;
+import org.apache.jute.BinaryOutputArchive;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.txn.ErrorTxn;
+import org.apache.zookeeper.txn.MultiTxn;
+import org.apache.zookeeper.txn.Txn;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -84,6 +93,31 @@ public void testInitMissingFile() throws FileNotFoundException, TxnLogToolkit.Tx
         });
     }
 
+    @Test
+    public void testMultiTxnDecode() throws IOException {
+        //MultiTxn with four ops, and the first op error.
+        List<Txn> txns = new ArrayList<>();
+        int type = -1;
+        for (int i = 0; i < 4; i++) {
+            ErrorTxn txn;
+            if (i == 0) {
+                txn = new ErrorTxn(KeeperException.Code.NONODE.intValue());
+            } else {
+                txn = new ErrorTxn(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
+            }
+            try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+                BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
+                txn.serialize(boa, "request");
+                ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
+                txns.add(new Txn(type, bb.array()));
+            }
+        }
+        MultiTxn multiTxn = new MultiTxn(txns);
+
+        String formattedTxnStr = TxnLogToolkit.getFormattedTxnStr(multiTxn);
+        assertEquals("error:-101;error:-2;error:-2;error:-2", formattedTxnStr);
+    }
+
     @Test
     public void testInitWithRecoveryFileExists() {
         assertThrows(TxnLogToolkit.TxnLogToolkitException.class, () -> {

From 688c69c19dc64836e91dc9ae97aeaeaf462f0556 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 18 Jul 2023 15:34:22 +0200
Subject: [PATCH 393/591] ZOOKEEPER-4721: Upgrade OWASP Dependency Check to
 8.3.1

Author: Andor Molnar <andor@apache.org>

Reviewers: symat@apache.org

Closes #2035 from anmolnar/ZOOKEEPER-4721
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 07a6460c091..01cf9bc927f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -882,7 +882,7 @@
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>7.1.0</version>
+          <version>8.3.1</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From 15f29b51a22bc51b9d6074cb7f3e72bb00a9753a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20Boutemy?= <herve.boutemy@free.fr>
Date: Fri, 4 Aug 2023 12:39:57 +0200
Subject: [PATCH 394/591] ZOOKEEPER-4732: upgrade plugins, fix Reproducible
 Builds issues (#2042)

---
 pom.xml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 01cf9bc927f..68717b1a95a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -542,6 +542,7 @@
     <!-- maven properties -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
+    <project.build.outputTimestamp>1691130453</project.build.outputTimestamp>
     <dependency.locations.enabled>false</dependency.locations.enabled>
     <surefire.version>2.22.1</surefire.version>
 
@@ -816,7 +817,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-assembly-plugin</artifactId>
-          <version>3.1.0</version>
+          <version>3.6.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -919,12 +920,12 @@
         <plugin>
           <groupId>org.apache.felix</groupId>
           <artifactId>maven-bundle-plugin</artifactId>
-          <version>5.1.1</version>
+          <version>5.1.9</version>
         </plugin>
         <plugin>
           <groupId>org.cyclonedx</groupId>
           <artifactId>cyclonedx-maven-plugin</artifactId>
-          <version>2.7.6</version>
+          <version>2.7.9</version>
        </plugin>
       </plugins>
     </pluginManagement>

From 31b0b87203eafb1d24cf428e6df7b3d1791e763b Mon Sep 17 00:00:00 2001
From: knguyen100000010 <63071572+knguyen100000010@users.noreply.github.com>
Date: Wed, 23 Aug 2023 09:21:47 -0400
Subject: [PATCH 395/591] Fix leader election recipe doc (#2048)

---
 zookeeper-docs/src/main/resources/markdown/recipes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/recipes.md b/zookeeper-docs/src/main/resources/markdown/recipes.md
index 2fd6c957887..9d3dec55c62 100644
--- a/zookeeper-docs/src/main/resources/markdown/recipes.md
+++ b/zookeeper-docs/src/main/resources/markdown/recipes.md
@@ -391,7 +391,7 @@ be a leader:
 
 1. Create znode z with path "ELECTION/guid-n_" with both SEQUENCE and
   EPHEMERAL flags;
-1. Let C be the children of "ELECTION", and I am the sequence
+1. Let C be the children of "ELECTION", and i is the sequence
   number of z;
 1. Watch for changes on "ELECTION/guid-n_j", where j is the largest
   sequence number such that j < i and n_j is a znode in C;

From bc0e61854ca362261d899295422ac14dd5d82e59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20Boutemy?= <hboutemy@apache.org>
Date: Wed, 23 Aug 2023 16:16:22 +0200
Subject: [PATCH 396/591] GH autolink to ZOOKEEPER Jira issues (#2050)

---
 .asf.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.asf.yaml b/.asf.yaml
index 90b1339d2c2..ebadb92540f 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -45,6 +45,8 @@ github:
     squash:  true
     merge:   false
     rebase:  false
+  autolink_jira:
+    - ZOOKEEPER
 
 notifications:
   jira_options: link label worklog

From 40aed41793e9bc4493d89e7c831d9da3258212fc Mon Sep 17 00:00:00 2001
From: Luke Chen <showuon@gmail.com>
Date: Tue, 29 Aug 2023 18:45:37 +0800
Subject: [PATCH 397/591] ZOOKEEPER-4728: force to re-resolve hostname into IP
 when binding. (#2040)

* ZOOKEEPER-4728: force to re-resolve hostname into IP when binding

* ZOOKEEPER-4708: add test
---
 .../org/apache/zookeeper/server/quorum/Leader.java    |  6 +++++-
 .../zookeeper/server/quorum/LeaderBeanTest.java       | 11 +++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 0cb4d50de66..3b9c827c340 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -309,6 +309,10 @@ public Leader(QuorumPeer self, LeaderZooKeeperServer zk) throws IOException {
         this.zk = zk;
     }
 
+    InetSocketAddress recreateInetSocketAddr(String hostString, int port) {
+        return new InetSocketAddress(hostString, port);
+    }
+
     Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean portUnification, boolean sslQuorum) {
         ServerSocket serverSocket;
         try {
@@ -318,7 +322,7 @@ Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean por
                 serverSocket = new ServerSocket();
             }
             serverSocket.setReuseAddress(true);
-            serverSocket.bind(address);
+            serverSocket.bind(recreateInetSocketAddr(address.getHostString(), address.getPort()));
             return Optional.of(serverSocket);
         } catch (IOException e) {
             LOG.error("Couldn't bind to {}", address.toString(), e);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 6a914fbc603..4d3c6fba752 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -25,6 +25,7 @@
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.when;
 import java.io.File;
 import java.io.IOException;
@@ -47,6 +48,7 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
@@ -92,6 +94,15 @@ public void tearDown() throws IOException {
         fileTxnSnapLog.close();
     }
 
+    @Test
+    public void testCreateServerSocketWillRecreateInetSocketAddr() {
+        Leader spyLeader = Mockito.spy(leader);
+        InetSocketAddress addr = new InetSocketAddress("localhost", PortAssignment.unique());
+        spyLeader.createServerSocket(addr, false, false);
+        // make sure the address to be bound will be recreated with expected hostString and port
+        Mockito.verify(spyLeader, times(1)).recreateInetSocketAddr(addr.getHostString(), addr.getPort());
+    }
+
     @Test
     public void testGetName() {
         assertEquals("Leader", leaderBean.getName());

From 03a36d08e257c43e8377e5549d5524805fc6b8bb Mon Sep 17 00:00:00 2001
From: Taher Ghaleb <taher.a.ghaleb@gmail.com>
Date: Tue, 29 Aug 2023 23:25:41 -0400
Subject: [PATCH 398/591] ZOOKEEPER-4738: Refactor assertFalse(equals()) with
 assertNotEquals (#2055)

---
 .../server/ReferenceCountedACLCacheTest.java       | 14 +++++++-------
 .../apache/zookeeper/server/util/AdHashTest.java   |  4 ++--
 .../java/org/apache/zookeeper/test/CreateTest.java |  4 ++--
 .../apache/zookeeper/test/MultiOperationTest.java  |  6 +++---
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
index e7bb38da9c1..83b1a154230 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -61,7 +61,7 @@ public void testWhetherOrderingMatters() {
         testACL2.add(new ACL(ZooDefs.Perms.WRITE, new Id("scheme", "rw")));
         testACL2.add(new ACL(ZooDefs.Perms.READ, new Id("scheme", "ro")));
 
-        assertFalse(aclId.equals(cache.convertAcls(testACL2)));
+        assertNotEquals(aclId, cache.convertAcls(testACL2));
     }
 
     @Test
@@ -90,7 +90,7 @@ public void testCacheSize() {
         List<ACL> testACL3 = createACL("differentId");
 
         Long aclId3 = cache.convertAcls(testACL3);
-        assertFalse(aclId3.equals(aclId));
+        assertNotEquals(aclId3, aclId);
         assertEquals(2, cache.size());
     }
 
@@ -126,7 +126,7 @@ public void testMultipleAddsAndRemove() {
         assertEquals(1, cache.size());
 
         Long newId = cache.convertAcls(testACL);
-        assertFalse(aclId.equals(newId));
+        assertNotEquals(aclId, newId);
     }
 
     @Test
@@ -255,9 +255,9 @@ public void testPurgeUnused() throws IOException {
         assertEquals(2, deserializedCache.size());
         assertEquals(aclId1, deserializedCache.convertAcls(acl1));
         assertEquals(aclId2, deserializedCache.convertAcls(acl2));
-        assertFalse(acl3.equals(deserializedCache.convertAcls(acl3)));
-        assertFalse(acl4.equals(deserializedCache.convertAcls(acl4)));
-        assertFalse(acl5.equals(deserializedCache.convertAcls(acl5)));
+        assertNotEquals(acl3, deserializedCache.convertAcls(acl3));
+        assertNotEquals(acl4, deserializedCache.convertAcls(acl4));
+        assertNotEquals(acl5, deserializedCache.convertAcls(acl5));
     }
 
     private void callAddUsageNTimes(ReferenceCountedACLCache deserializedCache, Long aclId, int num) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
index 9a1a0cad515..866cf9546de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server.util;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Random;
@@ -78,7 +78,7 @@ public void testAdHash() throws Exception {
         addListOfDigests(hashall, bucket3);
         addListOfDigests(hashall, bucket4);
         addListOfDigests(hashall, bucket5);
-        assertFalse(hashall.equals(hash21), "digest of different set not different");
+        assertNotEquals(hashall, hash21, "digest of different set not different");
         removeListOfDigests(hashall, bucket4);
         removeListOfDigests(hashall, bucket5);
         addListOfDigests(hash21, bucket3);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
index eddcd1de09b..953c174434c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.IOException;
@@ -65,7 +65,7 @@ public void testCreateWithStat() throws IOException, KeeperException, Interrupte
         Stat stat = createWithStatVerifyResult("/foo");
         Stat childStat = createWithStatVerifyResult("/foo/child");
         // Don't expect to get the same stats for different creates.
-        assertFalse(stat.equals(childStat));
+        assertNotEquals(stat, childStat);
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index fd7b8a02fc7..53b75ec32b2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -667,9 +667,9 @@ public void testOpResultEquals(boolean useAsync) {
 
     private void opEquals(OpResult expected, OpResult value, OpResult near) {
         assertEquals(value, value);
-        assertFalse(value.equals(new Object()));
-        assertFalse(value.equals(near));
-        assertFalse(value.equals(value instanceof CreateResult ? new ErrorResult(1) : new CreateResult("nope2")));
+        assertNotEquals(value, new Object());
+        assertNotEquals(value, near);
+        assertNotEquals(value, (value instanceof CreateResult ? new ErrorResult(1) : new CreateResult("nope2")));
         assertTrue(value.equals(expected));
     }
 

From e0890d0a79372be9c74b6d3f9314d693a89d255c Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Sat, 2 Sep 2023 23:49:21 +0800
Subject: [PATCH 399/591] ZOOKEEPER-4697: Add Builder to construct ZooKeeper
 and ZooKeeperAdmin (#2001)

* ZOOKEEPER-4697: Add Builder to construct ZooKeeper and its derivations

Currently, there are 10 constructor variants for `ZooKeeper` and 4 for
`ZooKeeperAdmin`. It is enough for us to resort to a builder.

The `build` method throws `IOException` to make it a drop-in replacement
of existing constructors of `ZooKeeper`.

This pr also unify body of `ZooKeeper` constructor to one. Previously,
there are diverged to two. One has `sessionId` and `sessionPasswd`, and
another doesn't have. This pr uses `sessionId == 0` to differentiate the
two as it is used in server side to differentiate session create and
reconnect.

* Restrict Builder to only ZooKeeper and ZooKeeperAdmin
---
 .../java/org/apache/zookeeper/ZooKeeper.java  | 173 +++++++++++------
 .../zookeeper/admin/ZooKeeperAdmin.java       |   6 +
 .../zookeeper/client/ZooKeeperBuilder.java    | 181 ++++++++++++++++++
 .../zookeeper/client/ZooKeeperOptions.java    |  92 +++++++++
 .../ClientCnxnSocketFragilityTest.java        |   9 +
 .../zookeeper/ClientRequestTimeoutTest.java   |   8 +
 .../client/ZooKeeperBuilderTest.java          |  86 +++++++++
 7 files changed, 492 insertions(+), 63 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 09006ed103e..475430b89ec 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -46,6 +46,8 @@
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.client.ZooKeeperBuilder;
+import org.apache.zookeeper.client.ZooKeeperOptions;
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.data.ACL;
@@ -445,7 +447,9 @@ public boolean isConnected() {
      *             if an invalid chroot path is specified
      */
     public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) throws IOException {
-        this(connectString, sessionTimeout, watcher, false);
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .toOptions());
     }
 
     /**
@@ -498,7 +502,10 @@ public ZooKeeper(
         int sessionTimeout,
         Watcher watcher,
         ZKClientConfig conf) throws IOException {
-        this(connectString, sessionTimeout, watcher, false, conf);
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withClientConfig(conf)
+            .toOptions());
     }
 
     /**
@@ -564,7 +571,11 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(connectString, sessionTimeout, watcher, canBeReadOnly, aHostProvider, null);
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> aHostProvider)
+            .toOptions());
     }
 
     /**
@@ -634,25 +645,12 @@ public ZooKeeper(
         HostProvider hostProvider,
         ZKClientConfig clientConfig
     ) throws IOException {
-        LOG.info(
-            "Initiating client connection, connectString={} sessionTimeout={} watcher={}",
-            connectString,
-            sessionTimeout,
-            watcher);
-
-        this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
-        this.hostProvider = hostProvider;
-        ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
-
-        cnxn = createConnection(
-            connectStringParser.getChrootPath(),
-            hostProvider,
-            sessionTimeout,
-            this.clientConfig,
-            watcher,
-            getClientCnxnSocket(),
-            canBeReadOnly);
-        cnxn.start();
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> hostProvider)
+            .withClientConfig(clientConfig)
+            .toOptions());
     }
 
     ClientCnxn createConnection(
@@ -662,6 +660,8 @@ ClientCnxn createConnection(
         ZKClientConfig clientConfig,
         Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
+        long sessionId,
+        byte[] sessionPasswd,
         boolean canBeReadOnly
     ) throws IOException {
         return new ClientCnxn(
@@ -671,6 +671,8 @@ ClientCnxn createConnection(
             clientConfig,
             defaultWatcher,
             clientCnxnSocket,
+            sessionId,
+            sessionPasswd,
             canBeReadOnly);
     }
 
@@ -731,7 +733,10 @@ public ZooKeeper(
         int sessionTimeout,
         Watcher watcher,
         boolean canBeReadOnly) throws IOException {
-        this(connectString, sessionTimeout, watcher, canBeReadOnly, createDefaultHostProvider(connectString));
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .toOptions());
     }
 
     /**
@@ -794,13 +799,11 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         ZKClientConfig conf) throws IOException {
-        this(
-            connectString,
-            sessionTimeout,
-            watcher,
-            canBeReadOnly,
-            createDefaultHostProvider(connectString),
-            conf);
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withClientConfig(conf)
+            .toOptions());
     }
 
     /**
@@ -861,7 +864,10 @@ public ZooKeeper(
         Watcher watcher,
         long sessionId,
         byte[] sessionPasswd) throws IOException {
-        this(connectString, sessionTimeout, watcher, sessionId, sessionPasswd, false);
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withSession(sessionId, sessionPasswd)
+            .toOptions());
     }
 
     /**
@@ -936,15 +942,12 @@ public ZooKeeper(
         byte[] sessionPasswd,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(
-            connectString,
-            sessionTimeout,
-            watcher,
-            sessionId,
-            sessionPasswd,
-            canBeReadOnly,
-            aHostProvider,
-            null);
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withSession(sessionId, sessionPasswd)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> aHostProvider)
+            .toOptions());
     }
 
     /**
@@ -1025,20 +1028,72 @@ public ZooKeeper(
         boolean canBeReadOnly,
         HostProvider hostProvider,
         ZKClientConfig clientConfig) throws IOException {
-        LOG.info(
-            "Initiating client connection, connectString={} "
-                + "sessionTimeout={} watcher={} sessionId=0x{} sessionPasswd={}",
-            connectString,
-            sessionTimeout,
-            watcher,
-            Long.toHexString(sessionId),
-            (sessionPasswd == null ? "<null>" : "<hidden>"));
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withSession(sessionId, sessionPasswd)
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> hostProvider)
+            .withClientConfig(clientConfig)
+            .toOptions());
+    }
 
+    /**
+     * Create a ZooKeeper client and establish session asynchronously.
+     *
+     * <p>This constructor will initiate connection to the server and return
+     * immediately - potentially (usually) before the session is fully established.
+     * The watcher from options will be notified of any changes in state. This
+     * notification can come at any point before or after the constructor call
+     * has returned.
+     *
+     * <p>The instantiated ZooKeeper client object will pick an arbitrary server
+     * from the connect string and attempt to connect to it. If establishment of
+     * the connection fails, another server in the connect string will be tried
+     * (the order is non-deterministic, as we random shuffle the list), until a
+     * connection is established. The client will continue attempts until the
+     * session is explicitly closed (or the session is expired by the server).
+     *
+     * @param options options for ZooKeeper client
+     * @throws IOException in cases of IO failure
+     */
+    @InterfaceAudience.Private
+    public ZooKeeper(ZooKeeperOptions options) throws IOException {
+        String connectString = options.getConnectString();
+        int sessionTimeout = options.getSessionTimeout();
+        long sessionId = options.getSessionId();
+        byte[] sessionPasswd = sessionId == 0 ? new byte[16] : options.getSessionPasswd();
+        Watcher watcher = options.getDefaultWatcher();
+        boolean canBeReadOnly = options.isCanBeReadOnly();
+
+        if (sessionId == 0) {
+            LOG.info(
+                "Initiating client connection, connectString={} sessionTimeout={} watcher={}",
+                connectString,
+                sessionTimeout,
+                watcher);
+        } else {
+            LOG.info(
+                "Initiating client connection, connectString={} "
+                    + "sessionTimeout={} watcher={} sessionId=0x{} sessionPasswd={}",
+                connectString,
+                sessionTimeout,
+                watcher,
+                Long.toHexString(sessionId),
+                (sessionPasswd == null ? "<null>" : "<hidden>"));
+        }
+
+        ZKClientConfig clientConfig = options.getClientConfig();
         this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
+        HostProvider hostProvider;
+        if (options.getHostProvider() != null) {
+            hostProvider = options.getHostProvider().apply(connectStringParser.getServerAddresses());
+        } else {
+            hostProvider = new StaticHostProvider(connectStringParser.getServerAddresses());
+        }
         this.hostProvider = hostProvider;
 
-        cnxn = new ClientCnxn(
+        cnxn = createConnection(
             connectStringParser.getChrootPath(),
             hostProvider,
             sessionTimeout,
@@ -1048,7 +1103,7 @@ public ZooKeeper(
             sessionId,
             sessionPasswd,
             canBeReadOnly);
-        cnxn.seenRwServerBefore = true; // since user has provided sessionId
+        cnxn.seenRwServerBefore = sessionId != 0; // since user has provided sessionId
         cnxn.start();
     }
 
@@ -1120,19 +1175,11 @@ public ZooKeeper(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly) throws IOException {
-        this(
-            connectString,
-            sessionTimeout,
-            watcher,
-            sessionId,
-            sessionPasswd,
-            canBeReadOnly,
-            createDefaultHostProvider(connectString));
-    }
-
-    // default hostprovider
-    private static HostProvider createDefaultHostProvider(String connectString) {
-        return new StaticHostProvider(new ConnectStringParser(connectString).getServerAddresses());
+        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+            .withDefaultWatcher(watcher)
+            .withSession(sessionId, sessionPasswd)
+            .withCanBeReadOnly(canBeReadOnly)
+            .toOptions());
     }
 
     // VisibleForTesting
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
index 8240526a513..4d5dc6fd263 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
@@ -27,6 +27,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.client.ZooKeeperOptions;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.GetDataResponse;
@@ -53,6 +54,11 @@ public class ZooKeeperAdmin extends ZooKeeper {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperAdmin.class);
 
+    @InterfaceAudience.Private
+    public ZooKeeperAdmin(ZooKeeperOptions options) throws IOException {
+        super(options);
+    }
+
     /**
      * Create a ZooKeeperAdmin object which is used to perform dynamic reconfiguration
      * operations.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
new file mode 100644
index 00000000000..796ed24ea08
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
@@ -0,0 +1,181 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.Collection;
+import java.util.function.Function;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.yetus.audience.InterfaceStability;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.admin.ZooKeeperAdmin;
+
+/**
+ * Builder to construct {@link ZooKeeper} and {@link ZooKeeperAdmin}.
+ */
+@InterfaceAudience.Public
+@InterfaceStability.Evolving
+public class ZooKeeperBuilder {
+    private final String connectString;
+    private final int sessionTimeout;
+    private Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
+    private Watcher defaultWatcher;
+    private boolean canBeReadOnly = false;
+    private long sessionId = 0;
+    private byte[] sessionPasswd;
+    private ZKClientConfig clientConfig;
+
+    /**
+     * Creates a builder with given connect string and session timeout.
+     *
+     * @param connectString
+     *            comma separated host:port pairs, each corresponding to a zk
+     *            server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002"
+     *            If the optional chroot suffix is used the example would look
+     *            like: "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002/app/a"
+     *            where the client would be rooted at "/app/a" and all paths
+     *            would be relative to this root - ie getting/setting/etc...
+     *            "/foo/bar" would result in operations being run on
+     *            "/app/a/foo/bar" (from the server perspective).
+     * @param sessionTimeoutMs
+     *            session timeout in milliseconds
+     */
+    public ZooKeeperBuilder(String connectString, int sessionTimeoutMs) {
+        this.connectString = connectString;
+        this.sessionTimeout = sessionTimeoutMs;
+    }
+
+    /**
+     * Specified watcher to receive state changes, and node events if attached later.
+     *
+     * @param watcher
+     *            a watcher object which will be notified of state changes, may
+     *            also be notified for node events
+     * @return this
+     */
+    public ZooKeeperBuilder withDefaultWatcher(Watcher watcher) {
+        this.defaultWatcher = watcher;
+        return this;
+    }
+
+    /**
+     * Specifies a function to construct a {@link HostProvider} with initial server addresses from connect string.
+     *
+     * @param hostProvider
+     *            use this as HostProvider to enable custom behaviour.
+     * @return this
+     */
+    public ZooKeeperBuilder withHostProvider(Function<Collection<InetSocketAddress>, HostProvider> hostProvider) {
+        this.hostProvider = hostProvider;
+        return this;
+    }
+
+    /**
+     * Specifies whether the created client is allowed to go to read-only mode in case of partitioning.
+     *
+     * @param canBeReadOnly
+     *            whether the created client is allowed to go to
+     *            read-only mode in case of partitioning. Read-only mode
+     *            basically means that if the client can't find any majority
+     *            servers but there's partitioned server it could reach, it
+     *            connects to one in read-only mode, i.e. read requests are
+     *            allowed while write requests are not. It continues seeking for
+     *            majority in the background.
+     * @return this
+     * @since 3.4
+     */
+    public ZooKeeperBuilder withCanBeReadOnly(boolean canBeReadOnly) {
+        this.canBeReadOnly = canBeReadOnly;
+        return this;
+    }
+
+    /**
+     * Specifies session id and password in session reestablishment.
+     *
+     * @param sessionId
+     *            session id to use if reconnecting, otherwise 0 to open new session
+     * @param sessionPasswd
+     *            password for this session
+     * @return this
+     * @see ZooKeeper#getSessionId()
+     * @see ZooKeeper#getSessionPasswd()
+     */
+    @SuppressFBWarnings({"EI_EXPOSE_REP", "EI_EXPOSE_REP2"})
+    public ZooKeeperBuilder withSession(long sessionId, byte[] sessionPasswd) {
+        this.sessionId = sessionId;
+        this.sessionPasswd = sessionPasswd;
+        return this;
+    }
+
+    /**
+     * Specifies the client config used to construct ZooKeeper instances.
+     *
+     * @param clientConfig
+     *            passing this conf object gives each client the flexibility of
+     *            configuring properties differently compared to other instances
+     * @return this
+     * @since 3.5.2
+     */
+    public ZooKeeperBuilder withClientConfig(ZKClientConfig clientConfig) {
+        this.clientConfig = clientConfig;
+        return this;
+    }
+
+    /**
+     * Creates a {@link ZooKeeperOptions} with configured options.
+     *
+     * @apiNote helper to delegate existing constructors to {@link ZooKeeper#ZooKeeper(ZooKeeperOptions)}
+     */
+    @InterfaceAudience.Private
+    public ZooKeeperOptions toOptions() {
+        return new ZooKeeperOptions(
+            connectString,
+            sessionTimeout,
+            defaultWatcher,
+            hostProvider,
+            canBeReadOnly,
+            sessionId,
+            sessionPasswd,
+            clientConfig
+        );
+    }
+
+    /**
+     * Constructs an instance of {@link ZooKeeper}.
+     *
+     * @return an instance of {@link ZooKeeper}
+     * @throws IOException from constructor of {@link ZooKeeper}
+     */
+    public ZooKeeper build() throws IOException {
+        return new ZooKeeper(toOptions());
+    }
+
+    /**
+     * Constructs an instance of {@link ZooKeeperAdmin}.
+     *
+     * @return an instance of {@link ZooKeeperAdmin}
+     * @throws IOException from constructor of {@link ZooKeeperAdmin}
+     */
+    public ZooKeeperAdmin buildAdmin() throws IOException {
+        return new ZooKeeperAdmin(toOptions());
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
new file mode 100644
index 00000000000..27e5244ba87
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.net.InetSocketAddress;
+import java.util.Collection;
+import java.util.function.Function;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.Watcher;
+
+/**
+ * Options to construct {@link org.apache.zookeeper.ZooKeeper} and {@link org.apache.zookeeper.admin.ZooKeeperAdmin}.
+ */
+@InterfaceAudience.Private
+public class ZooKeeperOptions {
+    private final String connectString;
+    private final int sessionTimeout;
+    private final Watcher defaultWatcher;
+    private final Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
+    private final boolean canBeReadOnly;
+    private final long sessionId;
+    private final byte[] sessionPasswd;
+    private final ZKClientConfig clientConfig;
+
+    ZooKeeperOptions(String connectString,
+                     int sessionTimeout,
+                     Watcher defaultWatcher,
+                     Function<Collection<InetSocketAddress>, HostProvider> hostProvider,
+                     boolean canBeReadOnly,
+                     long sessionId,
+                     byte[] sessionPasswd,
+                     ZKClientConfig clientConfig) {
+        this.connectString = connectString;
+        this.sessionTimeout = sessionTimeout;
+        this.hostProvider = hostProvider;
+        this.defaultWatcher = defaultWatcher;
+        this.canBeReadOnly = canBeReadOnly;
+        this.sessionId = sessionId;
+        this.sessionPasswd = sessionPasswd;
+        this.clientConfig = clientConfig;
+    }
+
+    public String getConnectString() {
+        return connectString;
+    }
+
+    public int getSessionTimeout() {
+        return sessionTimeout;
+    }
+
+    public Watcher getDefaultWatcher() {
+        return defaultWatcher;
+    }
+
+    public Function<Collection<InetSocketAddress>, HostProvider> getHostProvider() {
+        return hostProvider;
+    }
+
+    public boolean isCanBeReadOnly() {
+        return canBeReadOnly;
+    }
+
+    public long getSessionId() {
+        return sessionId;
+    }
+
+    @SuppressFBWarnings({"EI_EXPOSE_REP", "EI_EXPOSE_REP2"})
+    public byte[] getSessionPasswd() {
+        return sessionPasswd;
+    }
+
+    public ZKClientConfig getClientConfig() {
+        return clientConfig;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 953414468f3..bd2f1c287a0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -286,6 +286,8 @@ public CustomClientCnxn(
             ZKClientConfig zkClientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
+            long sessionId,
+            byte[] sessionPasswd,
             boolean canBeReadOnly
         ) throws IOException {
             super(
@@ -295,6 +297,8 @@ public CustomClientCnxn(
                 zkClientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
                 canBeReadOnly);
         }
 
@@ -351,6 +355,7 @@ public boolean isAlive() {
             return cnxn.getState().isAlive();
         }
 
+        @Override
         ClientCnxn createConnection(
             String chrootPath,
             HostProvider hostProvider,
@@ -358,6 +363,8 @@ ClientCnxn createConnection(
             ZKClientConfig clientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
+            long sessionId,
+            byte[] sessionPasswd,
             boolean canBeReadOnly
         ) throws IOException {
             assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
@@ -369,6 +376,8 @@ ClientCnxn createConnection(
                 clientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
                 canBeReadOnly);
             return ClientCnxnSocketFragilityTest.this.cnxn;
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index ecf39273e65..d6b6da94b56 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -119,6 +119,8 @@ class CustomClientCnxn extends ClientCnxn {
             ZKClientConfig clientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
+            long sessionId,
+            byte[] sessionPasswd,
             boolean canBeReadOnly
         ) throws IOException {
             super(
@@ -128,6 +130,8 @@ class CustomClientCnxn extends ClientCnxn {
                 clientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
                 canBeReadOnly);
         }
 
@@ -157,6 +161,8 @@ ClientCnxn createConnection(
             ZKClientConfig clientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
+            long sessionId,
+            byte[] sessionPasswd,
             boolean canBeReadOnly
         ) throws IOException {
             return new CustomClientCnxn(
@@ -166,6 +172,8 @@ ClientCnxn createConnection(
                 clientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
                 canBeReadOnly);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
new file mode 100644
index 00000000000..32d30052a66
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
@@ -0,0 +1,86 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class ZooKeeperBuilderTest extends ClientBase {
+    private void testClient(BlockingQueue<WatchedEvent> events, ZooKeeper zk) throws Exception {
+        zk.exists("/test", true);
+        zk.create("/test", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        Thread.sleep(100);
+        zk.close();
+
+        WatchedEvent connected = events.poll(10, TimeUnit.SECONDS);
+        assertNotNull(connected);
+        assertEquals(Watcher.Event.EventType.None, connected.getType());
+        assertEquals(Watcher.Event.KeeperState.SyncConnected, connected.getState());
+
+        WatchedEvent created = events.poll(10, TimeUnit.SECONDS);
+        assertNotNull(created);
+        assertEquals(Watcher.Event.EventType.NodeCreated, created.getType());
+        assertEquals("/test", created.getPath());
+
+        // A sleep(100) before disconnect approve that events receiving in closing is indeterminate,
+        // but the last should be closed. See ZOOKEEPER-4702.
+        WatchedEvent closed = null;
+        long timeoutMs = TimeUnit.SECONDS.toMillis(10);
+        long deadlineMs = Time.currentElapsedTime() + timeoutMs;
+        while (timeoutMs > 0 && (closed == null || closed.getState() != Watcher.Event.KeeperState.Closed)) {
+            WatchedEvent event = events.poll(10, TimeUnit.SECONDS);
+            if (event != null) {
+                closed = event;
+            }
+            timeoutMs = deadlineMs - Time.currentElapsedTime();
+        }
+        assertNotNull(closed);
+        assertEquals(Watcher.Event.EventType.None, closed.getType());
+        assertEquals(Watcher.Event.KeeperState.Closed, closed.getState());
+    }
+
+    @Test
+    public void testBuildClient() throws Exception {
+        BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+        ZooKeeper zk = new ZooKeeperBuilder(hostPort, 1000)
+            .withDefaultWatcher(events::offer)
+            .build();
+        testClient(events, zk);
+    }
+
+    @Test
+    public void testBuildAdminClient() throws Exception {
+        BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+        ZooKeeper zk = new ZooKeeperBuilder(hostPort, 1000)
+            .withDefaultWatcher(events::offer)
+            .buildAdmin();
+        testClient(events, zk);
+    }
+}

From b31f776471fef79ab161f416d58367bdffaf37a9 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Sun, 10 Sep 2023 22:36:37 +0800
Subject: [PATCH 400/591] ZOOKEEPER-2623: Fix database corruption caused by
 quorum check (#1988)

---
 .../server/FinalRequestProcessor.java         |  20 ++-
 .../server/PrepRequestProcessor.java          |   4 -
 .../org/apache/zookeeper/server/Request.java  |   1 -
 .../server/quorum/CommitProcessor.java        |   1 -
 .../quorum/FollowerRequestProcessor.java      |   1 -
 .../quorum/ObserverRequestProcessor.java      |   1 -
 .../quorum/ReadOnlyRequestProcessor.java      |   1 -
 .../util/RequestPathMetricsCollector.java     |   1 -
 .../org/apache/zookeeper/test/CheckTest.java  | 114 ++++++++++++++++++
 .../org/apache/zookeeper/test/ClientBase.java |   4 +
 10 files changed, 136 insertions(+), 12 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 6f61cdd5dba..1edde5d572c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -50,6 +50,7 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.AddWatchRequest;
+import org.apache.zookeeper.proto.CheckVersionRequest;
 import org.apache.zookeeper.proto.CheckWatchesRequest;
 import org.apache.zookeeper.proto.Create2Response;
 import org.apache.zookeeper.proto.CreateResponse;
@@ -354,8 +355,10 @@ public void processRequest(Request request) {
             }
             case OpCode.check: {
                 lastOp = "CHEC";
-                rsp = new SetDataResponse(rc.stat);
-                err = Code.get(rc.err);
+                CheckVersionRequest checkVersionRequest = request.readRequestRecord(CheckVersionRequest::new);
+                path = checkVersionRequest.getPath();
+                handleCheckVersionRequest(checkVersionRequest, cnxn, request.authInfo);
+                requestPathMetricsCollector.registerRequest(request.type, path);
                 break;
             }
             case OpCode.exists: {
@@ -643,6 +646,19 @@ private Record handleGetDataRequest(Record request, ServerCnxn cnxn, List<Id> au
         return new GetDataResponse(b, stat);
     }
 
+    private void handleCheckVersionRequest(CheckVersionRequest request, ServerCnxn cnxn, List<Id> authInfo) throws KeeperException {
+        String path = request.getPath();
+        DataNode n = zks.getZKDatabase().getNode(path);
+        if (n == null) {
+            throw new KeeperException.NoNodeException();
+        }
+        zks.checkACL(cnxn, zks.getZKDatabase().aclForNode(n), ZooDefs.Perms.READ, authInfo, path, null);
+        int version = request.getVersion();
+        if (version != -1 && version != n.stat.getVersion()) {
+            throw new KeeperException.BadVersionException(path);
+        }
+    }
+
     private boolean closeSession(ServerCnxnFactory serverCnxnFactory, long sessionId) {
         if (serverCnxnFactory == null) {
             return false;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 8404ed9b82e..28d1cc97b55 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -798,10 +798,6 @@ private void pRequestHelper(Request request) {
                 SetACLRequest setAclRequest = request.readRequestRecord(SetACLRequest::new);
                 pRequest2Txn(request.type, zks.getNextZxid(), request, setAclRequest);
                 break;
-            case OpCode.check:
-                CheckVersionRequest checkRequest = request.readRequestRecord(CheckVersionRequest::new);
-                pRequest2Txn(request.type, zks.getNextZxid(), request, checkRequest);
-                break;
             case OpCode.multi:
                 MultiOperationRecord multiRequest;
                 try {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 221f12d268d..10111c8a64f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -361,7 +361,6 @@ public boolean isQuorum() {
         case OpCode.deleteContainer:
         case OpCode.setACL:
         case OpCode.setData:
-        case OpCode.check:
         case OpCode.multi:
         case OpCode.reconfig:
             return true;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
index 3be43c37e30..0445bbdefff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
@@ -181,7 +181,6 @@ protected boolean needCommit(Request request) {
         case OpCode.reconfig:
         case OpCode.multi:
         case OpCode.setACL:
-        case OpCode.check:
             return true;
         case OpCode.sync:
             return matchSyncs;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index ef01ab32242..2798dd789d2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -108,7 +108,6 @@ public void run() {
                 case OpCode.reconfig:
                 case OpCode.setACL:
                 case OpCode.multi:
-                case OpCode.check:
                     zks.getFollower().request(request);
                     break;
                 case OpCode.createSession:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
index 1d7e5c5c37e..565f2778b1d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
@@ -109,7 +109,6 @@ public void run() {
                 case OpCode.reconfig:
                 case OpCode.setACL:
                 case OpCode.multi:
-                case OpCode.check:
                     zks.getObserver().request(request);
                     break;
                 case OpCode.createSession:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index 671d328ff43..7824af5cb54 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -85,7 +85,6 @@ public void run() {
                 case OpCode.reconfig:
                 case OpCode.setACL:
                 case OpCode.multi:
-                case OpCode.check:
                     sendErrorResponse(request);
                     continue;
                 case OpCode.closeSession:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
index db6f8c56645..6163872510f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
@@ -147,7 +147,6 @@ static boolean isWriteOp(int requestType) {
         case ZooDefs.OpCode.reconfig:
         case ZooDefs.OpCode.setACL:
         case ZooDefs.OpCode.multi:
-        case ZooDefs.OpCode.check:
             return true;
         }
         return false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
new file mode 100644
index 00000000000..4b7e33204c7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.TestableZooKeeper;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.proto.CheckVersionRequest;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInfo;
+
+public class CheckTest extends ClientBase {
+
+    @BeforeEach
+    public void setUp(TestInfo testInfo) throws Exception {
+        if (testInfo.getDisplayName().contains("Cluster")) {
+            return;
+        }
+        super.setUp();
+    }
+
+    @AfterEach
+    public void tearDown(TestInfo testInfo) throws Exception {
+        if (testInfo.getDisplayName().contains("Cluster")) {
+            return;
+        }
+        super.tearDown();
+    }
+
+    @Override
+    public void setUp() throws Exception {
+    }
+
+    @Override
+    public void tearDown() throws Exception {
+    }
+
+    private static void checkVersion(TestableZooKeeper zk, String path, int version) throws Exception {
+        RequestHeader header = new RequestHeader();
+        header.setType(ZooDefs.OpCode.check);
+        CheckVersionRequest request = new CheckVersionRequest(path, version);
+        ReplyHeader replyHeader = zk.submitRequest(header, request, null, null);
+        if (replyHeader.getErr() != 0) {
+            throw KeeperException.create(KeeperException.Code.get(replyHeader.getErr()), path);
+        }
+    }
+
+    private void testOperations(TestableZooKeeper zk) throws Exception {
+        Stat stat = new Stat();
+        zk.getData("/", false, stat);
+        checkVersion(zk, "/", -1);
+        checkVersion(zk, "/", stat.getVersion());
+        assertThrows(KeeperException.BadVersionException.class, () -> {
+            checkVersion(zk, "/", stat.getVersion() + 1);
+        });
+        assertThrows(KeeperException.NoNodeException.class, () -> {
+            checkVersion(zk, "/no-node", Integer.MAX_VALUE);
+        });
+    }
+
+    @Test
+    public void testStandalone() throws Exception {
+        TestableZooKeeper zk = createClient();
+        testOperations(zk);
+        stopServer();
+        startServer();
+        createClient();
+    }
+
+    @Test
+    public void testCluster() throws Exception {
+        QuorumBase qb = new QuorumBase();
+        try {
+            qb.setUp(true, true);
+            testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.OBSERVING));
+            testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.FOLLOWING));
+            testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.LEADING));
+            int leaderIndex = qb.getLeaderIndex();
+            int leaderPort = qb.getLeaderClientPort();
+            qb.shutdown(qb.getLeaderQuorumPeer());
+            qb.setupServer(leaderIndex + 1);
+            QuorumPeer quorumPeer = qb.getPeerList().get(leaderIndex);
+            quorumPeer.start();
+            qb.createClient("localhost:" + leaderPort, 2 * CONNECTION_TIMEOUT);
+        } finally {
+            try {
+                qb.tearDown();
+            } catch (Exception ignored) {}
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index cf35fdc54bd..b8b8e48321c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -197,6 +197,10 @@ protected TestableZooKeeper createClient(CountdownWatcher watcher) throws IOExce
     private List<ZooKeeper> allClients;
     private boolean allClientsSetup = false;
 
+    protected TestableZooKeeper createClient(String hp, int timeout) throws IOException, InterruptedException {
+        return createClient(new CountdownWatcher(), hp, timeout);
+    }
+
     protected TestableZooKeeper createClient(CountdownWatcher watcher, String hp) throws IOException, InterruptedException {
         return createClient(watcher, hp, CONNECTION_TIMEOUT);
     }

From f42c01de73867ffbc12707b3e9f9cd7f847fe462 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Sun, 24 Sep 2023 11:04:45 +0800
Subject: [PATCH 401/591] ZOOKEEPER-838: Move chroot from ClientCnxn to
 ZooKeeper (#2065)

This enables possibility for future that multiple `ZooKeeper` instances root at different paths and share same session.

This also fix bugs due to eager chroot stripping in `ClientCnxn`:

* Previously, in chroot "/zoo", client could lose connection due to delivering events for abnormal path "keeper/config". This path is constructed by eager chroot striping for path "/zookeeper/config" from events for `getConfig`. See ZOOKEEPER-4742.
* Previously, in chroot "/zookeeper" or "/zookeeper/config", watching through `getConfig` receive no event as `getConfig` register watcher in path "/zookeeper/config". But the path get stripped to "/config" or "/" before event delivery. See ZOOKEEPER-4601.

Co-authored-by: tison <wander4096@gmail.com>
---
 .../java/org/apache/zookeeper/ClientCnxn.java |  73 +-----
 .../apache/zookeeper/WatchDeregistration.java |  18 +-
 .../org/apache/zookeeper/ZKWatchManager.java  |   2 +-
 .../java/org/apache/zookeeper/ZooKeeper.java  |  73 +++---
 .../org/apache/zookeeper/client/Chroot.java   | 157 ++++++++++++
 .../client/ChrootCreateCallback.java          |  51 ++++
 .../zookeeper/client/ChrootWatcher.java       |  58 +++++
 .../zookeeper/BlockingQueueWatcher.java       |  69 ++++++
 .../ClientCnxnSocketFragilityTest.java        |   4 -
 .../apache/zookeeper/ClientReconnectTest.java |   1 -
 .../zookeeper/ClientRequestTimeoutTest.java   |   4 -
 .../zookeeper/ConfigWatcherPathTest.java      | 231 ++++++++++++++++++
 .../org/apache/zookeeper/test/ChrootTest.java |  22 --
 13 files changed, 622 insertions(+), 141 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 727d97daa6a..a5d4877d608 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -180,8 +180,6 @@ static class AuthData {
      */
     private boolean readOnly;
 
-    final String chrootPath;
-
     final SendThread sendThread;
 
     final EventThread eventThread;
@@ -346,9 +344,8 @@ public String toString() {
     /**
      * Creates a connection object. The actual network connect doesn't get
      * established until needed. The start() instance method must be called
-     * subsequent to construction.
+     * after construction.
      *
-     * @param chrootPath the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
      * @param hostProvider the list of ZooKeeper servers to connect to
      * @param sessionTimeout the timeout for connections.
      * @param clientConfig the client configuration.
@@ -357,7 +354,6 @@ public String toString() {
      * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
      */
     public ClientCnxn(
-        String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
         ZKClientConfig clientConfig,
@@ -366,7 +362,6 @@ public ClientCnxn(
         boolean canBeReadOnly
     ) throws IOException {
         this(
-            chrootPath,
             hostProvider,
             sessionTimeout,
             clientConfig,
@@ -380,9 +375,8 @@ public ClientCnxn(
     /**
      * Creates a connection object. The actual network connect doesn't get
      * established until needed. The start() instance method must be called
-     * subsequent to construction.
+     * after construction.
      *
-     * @param chrootPath the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
      * @param hostProvider the list of ZooKeeper servers to connect to
      * @param sessionTimeout the timeout for connections.
      * @param clientConfig the client configuration.
@@ -394,7 +388,6 @@ public ClientCnxn(
      * @throws IOException in cases of broken network
      */
     public ClientCnxn(
-        String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
         ZKClientConfig clientConfig,
@@ -404,7 +397,6 @@ public ClientCnxn(
         byte[] sessionPasswd,
         boolean canBeReadOnly
     ) throws IOException {
-        this.chrootPath = chrootPath;
         this.hostProvider = hostProvider;
         this.sessionTimeout = sessionTimeout;
         this.clientConfig = clientConfig;
@@ -660,9 +652,7 @@ private void processEvent(Object event) {
                                 rc,
                                 clientPath,
                                 p.ctx,
-                                (chrootPath == null
-                                    ? rsp.getPath()
-                                    : rsp.getPath().substring(chrootPath.length())));
+                                rsp.getPath());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null);
                         }
@@ -674,9 +664,7 @@ private void processEvent(Object event) {
                                     rc,
                                     clientPath,
                                     p.ctx,
-                                    (chrootPath == null
-                                            ? rsp.getPath()
-                                            : rsp.getPath().substring(chrootPath.length())),
+                                    rsp.getPath(),
                                     rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -733,7 +721,7 @@ protected void finishPacket(Packet p) {
                 for (Entry<EventType, Set<Watcher>> entry : materializedWatchers.entrySet()) {
                     Set<Watcher> watchers = entry.getValue();
                     if (watchers.size() > 0) {
-                        queueEvent(p.watchDeregistration.getClientPath(), err, watchers, entry.getKey());
+                        queueEvent(p.watchDeregistration.getServerPath(), err, watchers, entry.getKey());
                         // ignore connectionloss when removing from local
                         // session
                         p.replyHeader.setErr(Code.OK.intValue());
@@ -757,13 +745,13 @@ protected void finishPacket(Packet p) {
         }
     }
 
-    void queueEvent(String clientPath, int err, Set<Watcher> materializedWatchers, EventType eventType) {
+    void queueEvent(String serverPath, int err, Set<Watcher> materializedWatchers, EventType eventType) {
         KeeperState sessionState = KeeperState.SyncConnected;
         if (KeeperException.Code.SESSIONEXPIRED.intValue() == err
             || KeeperException.Code.CONNECTIONLOSS.intValue() == err) {
             sessionState = Event.KeeperState.Disconnected;
         }
-        WatchedEvent event = new WatchedEvent(eventType, sessionState, clientPath);
+        WatchedEvent event = new WatchedEvent(eventType, sessionState, serverPath);
         eventThread.queueEvent(event, materializedWatchers);
     }
 
@@ -855,19 +843,6 @@ class SendThread extends ZooKeeperThread {
         private boolean isFirstConnect = true;
         private volatile ZooKeeperSaslClient zooKeeperSaslClient;
 
-        private String stripChroot(String serverPath) {
-            if (serverPath.startsWith(chrootPath)) {
-                if (serverPath.length() == chrootPath.length()) {
-                    return "/";
-                }
-                return serverPath.substring(chrootPath.length());
-            } else if (serverPath.startsWith(ZooDefs.ZOOKEEPER_NODE_SUBTREE)) {
-                return serverPath;
-            }
-            LOG.warn("Got server path {} which is not descendant of chroot path {}.", serverPath, chrootPath);
-            return serverPath;
-        }
-
         void readResponse(ByteBuffer incomingBuffer) throws IOException {
             ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
             BinaryInputArchive bbia = BinaryInputArchive.getArchive(bbis);
@@ -895,13 +870,6 @@ void readResponse(ByteBuffer incomingBuffer) throws IOException {
                 WatcherEvent event = new WatcherEvent();
                 event.deserialize(bbia, "response");
 
-                // convert from a server path to a client path
-                if (chrootPath != null) {
-                    String serverPath = event.getPath();
-                    String clientPath = stripChroot(serverPath);
-                    event.setPath(clientPath);
-                }
-
                 WatchedEvent we = new WatchedEvent(event, replyHdr.getZxid());
                 LOG.debug("Got {} for session id 0x{}", we, Long.toHexString(sessionId));
                 eventThread.queueEvent(we);
@@ -1010,11 +978,11 @@ void primeConnection() throws IOException {
                 List<String> persistentRecursiveWatches = watchManager.getPersistentRecursiveWatchList();
                 if (!dataWatches.isEmpty() || !existWatches.isEmpty() || !childWatches.isEmpty()
                         || !persistentWatches.isEmpty() || !persistentRecursiveWatches.isEmpty()) {
-                    Iterator<String> dataWatchesIter = prependChroot(dataWatches).iterator();
-                    Iterator<String> existWatchesIter = prependChroot(existWatches).iterator();
-                    Iterator<String> childWatchesIter = prependChroot(childWatches).iterator();
-                    Iterator<String> persistentWatchesIter = prependChroot(persistentWatches).iterator();
-                    Iterator<String> persistentRecursiveWatchesIter = prependChroot(persistentRecursiveWatches).iterator();
+                    Iterator<String> dataWatchesIter = dataWatches.iterator();
+                    Iterator<String> existWatchesIter = existWatches.iterator();
+                    Iterator<String> childWatchesIter = childWatches.iterator();
+                    Iterator<String> persistentWatchesIter = persistentWatches.iterator();
+                    Iterator<String> persistentRecursiveWatchesIter = persistentRecursiveWatches.iterator();
                     long setWatchesLastZxid = lastZxid;
 
                     while (dataWatchesIter.hasNext() || existWatchesIter.hasNext() || childWatchesIter.hasNext()
@@ -1084,23 +1052,6 @@ record = new SetWatches2(setWatchesLastZxid, dataWatchesBatch, existWatchesBatch
             LOG.debug("Session establishment request sent on {}", clientCnxnSocket.getRemoteSocketAddress());
         }
 
-        private List<String> prependChroot(List<String> paths) {
-            if (chrootPath != null && !paths.isEmpty()) {
-                for (int i = 0; i < paths.size(); ++i) {
-                    String clientPath = paths.get(i);
-                    String serverPath;
-                    // handle clientPath = "/"
-                    if (clientPath.length() == 1) {
-                        serverPath = chrootPath;
-                    } else {
-                        serverPath = chrootPath + clientPath;
-                    }
-                    paths.set(i, serverPath);
-                }
-            }
-            return paths;
-        }
-
         private void sendPing() {
             lastPingSentNs = System.nanoTime();
             RequestHeader h = new RequestHeader(ClientCnxn.PING_XID, OpCode.ping);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
index 710f47b34c3..7d3b5f13517 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
@@ -25,23 +25,23 @@
 
 /**
  * Handles the special case of removing watches which has registered for a
- * client path
+ * server path
  */
 public class WatchDeregistration {
 
-    private final String clientPath;
+    private final String serverPath;
     private final Watcher watcher;
     private final WatcherType watcherType;
     private final boolean local;
     private final ZKWatchManager zkManager;
 
     public WatchDeregistration(
-        String clientPath,
+        String serverPath,
         Watcher watcher,
         WatcherType watcherType,
         boolean local,
         ZKWatchManager zkManager) {
-        this.clientPath = clientPath;
+        this.serverPath = serverPath;
         this.watcher = watcher;
         this.watcherType = watcherType;
         this.local = local;
@@ -56,16 +56,16 @@ public WatchDeregistration(
      *            watch on the path.
      */
     public Map<EventType, Set<Watcher>> unregister(int rc) throws KeeperException {
-        return zkManager.removeWatcher(clientPath, watcher, watcherType, local, rc);
+        return zkManager.removeWatcher(serverPath, watcher, watcherType, local, rc);
     }
 
     /**
-     * Returns client path which has specified for unregistering its watcher
+     * Returns server path which has specified for unregistering its watcher
      *
-     * @return client path
+     * @return server path
      */
-    public String getClientPath() {
-        return clientPath;
+    public String getServerPath() {
+        return serverPath;
     }
 
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
index 514da01cf24..ce0df4e9a12 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
@@ -30,7 +30,7 @@
 
 /**
  * Manage watchers and handle events generated by the {@link ClientCnxn} object.
- *
+ * <p>
  * This class is intended to be packaged-private so that it doesn't serve
  * as part of ZooKeeper client API.
  */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 475430b89ec..e04984fa918 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -42,6 +42,7 @@
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
 import org.apache.zookeeper.OpResult.ErrorResult;
 import org.apache.zookeeper.Watcher.WatcherType;
+import org.apache.zookeeper.client.Chroot;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
@@ -173,6 +174,8 @@ public class ZooKeeper implements AutoCloseable {
 
     protected final HostProvider hostProvider;
 
+    private final Chroot chroot;
+
     /**
      * This function allows a client to update the connection string by providing
      * a new comma separated list of host:port pairs, each corresponding to a
@@ -267,11 +270,11 @@ ZKWatchManager getWatchManager() {
     public abstract static class WatchRegistration {
 
         private Watcher watcher;
-        private String clientPath;
+        private String serverPath;
 
-        public WatchRegistration(Watcher watcher, String clientPath) {
+        public WatchRegistration(Watcher watcher, String serverPath) {
             this.watcher = watcher;
-            this.clientPath = clientPath;
+            this.serverPath = serverPath;
         }
 
         protected abstract Map<String, Set<Watcher>> getWatches(int rc);
@@ -285,10 +288,10 @@ public void register(int rc) {
             if (shouldAddWatch(rc)) {
                 Map<String, Set<Watcher>> watches = getWatches(rc);
                 synchronized (watches) {
-                    Set<Watcher> watchers = watches.get(clientPath);
+                    Set<Watcher> watchers = watches.get(serverPath);
                     if (watchers == null) {
                         watchers = new HashSet<>();
-                        watches.put(clientPath, watchers);
+                        watches.put(serverPath, watchers);
                     }
                     watchers.add(watcher);
                 }
@@ -312,7 +315,7 @@ protected boolean shouldAddWatch(int rc) {
     class ExistsWatchRegistration extends WatchRegistration {
 
         public ExistsWatchRegistration(Watcher watcher, String clientPath) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
         }
 
         @Override
@@ -328,10 +331,22 @@ protected boolean shouldAddWatch(int rc) {
 
     }
 
+    class ServerDataWatchRegistration extends WatchRegistration {
+        public ServerDataWatchRegistration(Watcher watcher, String serverPath) {
+            super(watcher, serverPath);
+        }
+
+        @Override
+        protected Map<String, Set<Watcher>> getWatches(int rc) {
+            return getWatchManager().getDataWatches();
+        }
+
+    }
+
     class DataWatchRegistration extends WatchRegistration {
 
         public DataWatchRegistration(Watcher watcher, String clientPath) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
         }
 
         @Override
@@ -344,7 +359,7 @@ protected Map<String, Set<Watcher>> getWatches(int rc) {
     class ChildWatchRegistration extends WatchRegistration {
 
         public ChildWatchRegistration(Watcher watcher, String clientPath) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
         }
 
         @Override
@@ -358,7 +373,7 @@ class AddWatchRegistration extends WatchRegistration {
         private final AddWatchMode mode;
 
         public AddWatchRegistration(Watcher watcher, String clientPath, AddWatchMode mode) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
             this.mode = mode;
         }
 
@@ -654,7 +669,6 @@ public ZooKeeper(
     }
 
     ClientCnxn createConnection(
-        String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
         ZKClientConfig clientConfig,
@@ -665,7 +679,6 @@ ClientCnxn createConnection(
         boolean canBeReadOnly
     ) throws IOException {
         return new ClientCnxn(
-            chrootPath,
             hostProvider,
             sessionTimeout,
             clientConfig,
@@ -1093,8 +1106,8 @@ public ZooKeeper(ZooKeeperOptions options) throws IOException {
         }
         this.hostProvider = hostProvider;
 
+        chroot = Chroot.ofNullable(connectStringParser.getChrootPath());
         cnxn = createConnection(
-            connectStringParser.getChrootPath(),
             hostProvider,
             sessionTimeout,
             this.clientConfig,
@@ -1303,15 +1316,7 @@ public boolean close(int waitForShutdownTimeoutMs) throws InterruptedException {
      * @return server view of the path (chroot prepended to client path)
      */
     private String prependChroot(String clientPath) {
-        if (cnxn.chrootPath != null) {
-            // handle clientPath = "/"
-            if (clientPath.length() == 1) {
-                return cnxn.chrootPath;
-            }
-            return cnxn.chrootPath + clientPath;
-        } else {
-            return clientPath;
-        }
+        return chroot.prepend(clientPath);
     }
 
     /**
@@ -1393,11 +1398,7 @@ public String create(
         if (r.getErr() != 0) {
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
-        if (cnxn.chrootPath == null) {
-            return response.getPath();
-        } else {
-            return response.getPath().substring(cnxn.chrootPath.length());
-        }
+        return chroot.strip(response.getPath());
     }
 
     /**
@@ -1499,11 +1500,7 @@ public String create(
         if (stat != null) {
             DataTree.copyStat(response.getStat(), stat);
         }
-        if (cnxn.chrootPath == null) {
-            return response.getPath();
-        } else {
-            return response.getPath().substring(cnxn.chrootPath.length());
-        }
+        return chroot.strip(response.getPath());
     }
 
     private void setCreateHeader(CreateMode createMode, RequestHeader h) {
@@ -1552,6 +1549,7 @@ public void create(
         EphemeralType.validateTTL(createMode, -1);
 
         final String serverPath = prependChroot(clientPath);
+        cb = chroot.interceptCallback(cb);
 
         RequestHeader h = new RequestHeader();
         h.setType(createMode.isContainer() ? ZooDefs.OpCode.createContainer : ZooDefs.OpCode.create);
@@ -1598,6 +1596,7 @@ public void create(
         EphemeralType.validateTTL(createMode, ttl);
 
         final String serverPath = prependChroot(clientPath);
+        cb = chroot.interceptCallback(cb);
 
         RequestHeader h = new RequestHeader();
         setCreateHeader(createMode, h);
@@ -1894,7 +1893,6 @@ public Stat exists(final String path, Watcher watcher) throws KeeperException, I
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new ExistsWatchRegistration(watcher, clientPath);
@@ -1949,7 +1947,6 @@ public void exists(final String path, Watcher watcher, StatCallback cb, Object c
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new ExistsWatchRegistration(watcher, clientPath);
@@ -2000,7 +1997,6 @@ public byte[] getData(final String path, Watcher watcher, Stat stat) throws Keep
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new DataWatchRegistration(watcher, clientPath);
@@ -2056,7 +2052,6 @@ public void getData(final String path, Watcher watcher, DataCallback cb, Object
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new DataWatchRegistration(watcher, clientPath);
@@ -2107,7 +2102,7 @@ public byte[] getConfig(Watcher watcher, Stat stat) throws KeeperException, Inte
         // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
-            wcb = new DataWatchRegistration(watcher, configZnode);
+            wcb = new ServerDataWatchRegistration(watcher, configZnode);
         }
 
         RequestHeader h = new RequestHeader();
@@ -2137,7 +2132,7 @@ public void getConfig(Watcher watcher, DataCallback cb, Object ctx) {
         // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
-            wcb = new DataWatchRegistration(watcher, configZnode);
+            wcb = new ServerDataWatchRegistration(watcher, configZnode);
         }
 
         RequestHeader h = new RequestHeader();
@@ -2944,7 +2939,7 @@ private void removeWatches(
         PathUtils.validatePath(path);
         final String clientPath = path;
         final String serverPath = prependChroot(clientPath);
-        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, getWatchManager());
+        WatchDeregistration wcb = new WatchDeregistration(serverPath, chroot.interceptWatcher(watcher), watcherType, local, getWatchManager());
 
         RequestHeader h = new RequestHeader();
         h.setType(opCode);
@@ -2967,7 +2962,7 @@ private void removeWatches(
         PathUtils.validatePath(path);
         final String clientPath = path;
         final String serverPath = prependChroot(clientPath);
-        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, getWatchManager());
+        WatchDeregistration wcb = new WatchDeregistration(serverPath, chroot.interceptWatcher(watcher), watcherType, local, getWatchManager());
 
         RequestHeader h = new RequestHeader();
         h.setType(opCode);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java
new file mode 100644
index 00000000000..64b909ba1f2
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java
@@ -0,0 +1,157 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.util.Objects;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.AsyncCallback;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+
+@InterfaceAudience.Private
+public interface Chroot {
+    static Chroot ofNullable(String chroot) {
+        if (chroot == null) {
+            return new Root();
+        }
+        return new NotRoot(chroot);
+    }
+
+    /**
+     * Creates server path by prepending chroot to given client path.
+     *
+     * @param clientPath client path
+     * @return sever path with chroot prepended
+     */
+    String prepend(String clientPath);
+
+    /**
+     * Creates client path by stripping chroot from given sever path.
+     *
+     * @param serverPath sever path with chroot prepended
+     * @return client path with chroot stripped
+     * @throws IllegalArgumentException if given server path contains no chroot
+     */
+    String strip(String serverPath);
+
+    /**
+     * Creates a delegating callback to strip chroot from created node name.
+     */
+    AsyncCallback.StringCallback interceptCallback(AsyncCallback.StringCallback callback);
+
+    /**
+     * Creates a delegating callback to strip chroot from created node name.
+     */
+    AsyncCallback.Create2Callback interceptCallback(AsyncCallback.Create2Callback callback);
+
+    /**
+     * Creates a delegating watcher to strip chroot from {@link WatchedEvent#getPath()} for given watcher.
+     */
+    Watcher interceptWatcher(Watcher watcher);
+
+    final class Root implements Chroot {
+        @Override
+        public String prepend(String clientPath) {
+            return clientPath;
+        }
+
+        @Override
+        public String strip(String serverPath) {
+            return serverPath;
+        }
+
+        @Override
+        public AsyncCallback.StringCallback interceptCallback(AsyncCallback.StringCallback callback) {
+            return callback;
+        }
+
+        @Override
+        public AsyncCallback.Create2Callback interceptCallback(AsyncCallback.Create2Callback callback) {
+            return callback;
+        }
+
+        @Override
+        public Watcher interceptWatcher(Watcher watcher) {
+            return watcher;
+        }
+    }
+
+    final class NotRoot implements Chroot {
+        private final String chroot;
+
+        public NotRoot(String chroot) {
+            this.chroot = Objects.requireNonNull(chroot);
+        }
+
+        @Override
+        public String prepend(String clientPath) {
+            // handle clientPath = "/"
+            if (clientPath.length() == 1) {
+                return chroot;
+            }
+            return chroot + clientPath;
+        }
+
+        @Override
+        public String strip(String serverPath) {
+            if (!serverPath.startsWith(chroot)) {
+                String msg = String.format("server path %s does no start with chroot %s", serverPath, chroot);
+                throw new IllegalArgumentException(msg);
+            }
+            if (chroot.length() == serverPath.length()) {
+                return "/";
+            } else {
+                return serverPath.substring(chroot.length());
+            }
+        }
+
+        @Override
+        public AsyncCallback.StringCallback interceptCallback(AsyncCallback.StringCallback callback) {
+            return new ChrootCreateCallback(this, callback);
+        }
+
+        @Override
+        public AsyncCallback.Create2Callback interceptCallback(AsyncCallback.Create2Callback callback) {
+            return new ChrootCreateCallback(this, callback);
+        }
+
+        @Override
+        public Watcher interceptWatcher(Watcher watcher) {
+            return new ChrootWatcher(this, watcher);
+        }
+
+        @Override
+        public boolean equals(Object other) {
+            if (other instanceof NotRoot) {
+                return Objects.equals(chroot, ((NotRoot) other).chroot);
+            }
+            return false;
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(chroot);
+        }
+
+        @Override
+        public String toString() {
+            return chroot;
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java
new file mode 100644
index 00000000000..cf4aee7dc61
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.AsyncCallback;
+import org.apache.zookeeper.data.Stat;
+
+@InterfaceAudience.Private
+class ChrootCreateCallback implements AsyncCallback.StringCallback, AsyncCallback.Create2Callback {
+    private final Chroot.NotRoot chroot;
+    private final AsyncCallback callback;
+
+    public ChrootCreateCallback(Chroot.NotRoot chroot, StringCallback callback) {
+        this.chroot = chroot;
+        this.callback = callback;
+    }
+
+    public ChrootCreateCallback(Chroot.NotRoot chroot, Create2Callback callback) {
+        this.chroot = chroot;
+        this.callback = callback;
+    }
+
+    @Override
+    public void processResult(int rc, String path, Object ctx, String name) {
+        StringCallback cb = (StringCallback) callback;
+        cb.processResult(rc, path, ctx, name == null ? null : chroot.strip(name));
+    }
+
+    @Override
+    public void processResult(int rc, String path, Object ctx, String name, Stat stat) {
+        Create2Callback cb = (Create2Callback) callback;
+        cb.processResult(rc, path, ctx, name == null ? null : chroot.strip(name), stat);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java
new file mode 100644
index 00000000000..47a61328617
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.util.Objects;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+
+@InterfaceAudience.Private
+class ChrootWatcher implements Watcher {
+    private final Chroot.NotRoot chroot;
+    private final Watcher watcher;
+
+    public ChrootWatcher(Chroot.NotRoot chroot, Watcher watcher) {
+        this.chroot = chroot;
+        this.watcher = watcher;
+    }
+
+    @Override
+    public boolean equals(Object other) {
+        if (other instanceof ChrootWatcher) {
+            return chroot.equals(((ChrootWatcher) other).chroot) && watcher.equals(((ChrootWatcher) other).watcher);
+        }
+        return false;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(chroot, watcher);
+    }
+
+    @Override
+    public void process(WatchedEvent event) {
+        String path = event.getPath();
+        if (path != null) {
+            path = chroot.strip(path);
+            event = new WatchedEvent(event.getType(), event.getState(), path, event.getZxid());
+        }
+        watcher.process(event);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java b/zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java
new file mode 100644
index 00000000000..caafb06eb48
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.time.Duration;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import java.util.function.Supplier;
+
+public class BlockingQueueWatcher implements Watcher {
+    private final BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+
+    @Override
+    public void process(WatchedEvent event) {
+        assertTrue(events.add(event));
+    }
+
+    public WatchedEvent pollEvent(Duration timeout) throws InterruptedException {
+        return events.poll(timeout.toMillis(), TimeUnit.MILLISECONDS);
+    }
+
+    /**
+     * Format {@link Duration} with suffix "ms" or "s".
+     *
+     * <p>I guess {@link Duration#toString()} is verbose and not intuitive.
+     */
+    private String formatTimeout(Duration timeout) {
+        long millis = timeout.toMillis();
+        if (millis < TimeUnit.SECONDS.toMillis(1)) {
+            return millis + "ms";
+        }
+        long secs = millis / TimeUnit.SECONDS.toMillis(1);
+        millis %= TimeUnit.SECONDS.toMillis(1);
+        // We are test code, second unit is large enough.
+        if (millis == 0) {
+            return secs + "s";
+        }
+        return secs + "s" + millis + "ms";
+    }
+
+    private Supplier<String> noEventMessage(Duration timeout) {
+        return () -> String.format("no event after %s", formatTimeout(timeout));
+    }
+
+    public WatchedEvent takeEvent(Duration timeout) throws InterruptedException {
+        WatchedEvent event = pollEvent(timeout);
+        assertNotNull(event, noEventMessage(timeout));
+        return event;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index bd2f1c287a0..608bc01c4c8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -280,7 +280,6 @@ class CustomClientCnxn extends ClientCnxn {
         private volatile boolean hitUnsafeRegion = false;
 
         public CustomClientCnxn(
-            String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
             ZKClientConfig zkClientConfig,
@@ -291,7 +290,6 @@ public CustomClientCnxn(
             boolean canBeReadOnly
         ) throws IOException {
             super(
-                chrootPath,
                 hostProvider,
                 sessionTimeout,
                 zkClientConfig,
@@ -357,7 +355,6 @@ public boolean isAlive() {
 
         @Override
         ClientCnxn createConnection(
-            String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
             ZKClientConfig clientConfig,
@@ -370,7 +367,6 @@ ClientCnxn createConnection(
             assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
             socket = (FragileClientCnxnSocketNIO) clientCnxnSocket;
             ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(
-                chrootPath,
                 hostProvider,
                 sessionTimeout,
                 clientConfig,
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
index 6d1db27a276..b7d6af387e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
@@ -67,7 +67,6 @@ public void testClientReconnect() throws IOException, InterruptedException {
 
         ClientCnxnSocketNIO nioCnxn = new MockCnxn();
         ClientCnxn clientCnxn = new ClientCnxn(
-            "tmp",
             hostProvider,
             5000,
             zk.getClientConfig(),
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index d6b6da94b56..27bc02df785 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -113,7 +113,6 @@ private String getCxnString(int[] clientPorts) {
     class CustomClientCnxn extends ClientCnxn {
 
         CustomClientCnxn(
-            String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
             ZKClientConfig clientConfig,
@@ -124,7 +123,6 @@ class CustomClientCnxn extends ClientCnxn {
             boolean canBeReadOnly
         ) throws IOException {
             super(
-                chrootPath,
                 hostProvider,
                 sessionTimeout,
                 clientConfig,
@@ -155,7 +153,6 @@ public CustomZooKeeper(String connectString, int sessionTimeout, Watcher watcher
 
         @Override
         ClientCnxn createConnection(
-            String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
             ZKClientConfig clientConfig,
@@ -166,7 +163,6 @@ ClientCnxn createConnection(
             boolean canBeReadOnly
         ) throws IOException {
             return new CustomClientCnxn(
-                chrootPath,
                 hostProvider,
                 sessionTimeout,
                 clientConfig,
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java
new file mode 100644
index 00000000000..db56ad47407
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java
@@ -0,0 +1,231 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.hamcrest.CoreMatchers.hasItem;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.time.Duration;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.function.Consumer;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class ConfigWatcherPathTest extends ClientBase {
+    private void join(Consumer<CompletableFuture<Void>> task) {
+        CompletableFuture<Void> future = new CompletableFuture<>();
+        task.accept(future);
+        future.join();
+    }
+
+    private AsyncCallback.DataCallback complete(CompletableFuture<Void> future) {
+        return (rc, path, ctx, data, stat) -> {
+            if (rc == 0) {
+                future.complete(null);
+            } else {
+                future.completeExceptionally(KeeperException.create(KeeperException.Code.get(rc), path));
+            }
+        };
+    }
+
+    private void testConfigWatcherPathWithChroot(String chroot) throws Exception {
+        ZooKeeper zk1 = createClient(hostPort + chroot);
+
+        BlockingQueueWatcher configWatcher = new BlockingQueueWatcher();
+
+        // given|>config watcher: attach to config node multiple times
+        byte[] configData = zk1.getConfig(configWatcher, null);
+        join(future -> zk1.getConfig(configWatcher, complete(future), null));
+
+        // given|>default watcher: attach to config node multiple times
+        BlockingQueueWatcher defaultWatcher = new BlockingQueueWatcher();
+        zk1.getWatchManager().setDefaultWatcher(defaultWatcher);
+        zk1.getConfig(true, null);
+        zk1.getConfig(defaultWatcher, null);
+
+        // when: make change to config node
+        ZooKeeper zk2 = createClient();
+        zk2.addAuthInfo("digest", "super:test".getBytes());
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then|>config watcher: only one event with path "/zookeeper/config"
+        WatchedEvent configEvent = configWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals("/zookeeper/config", configEvent.getPath());
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // then|>default watcher: only one event with path "/zookeeper/config"
+        WatchedEvent defaultWatcherEvent = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals("/zookeeper/config", defaultWatcherEvent.getPath());
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // given: all watchers fired
+        // when: make change to config node
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then: no more events
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+    }
+
+    @Test
+    public void testConfigWatcherPathWithNoChroot() throws Exception {
+        testConfigWatcherPathWithChroot("");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithShortChroot() throws Exception {
+        testConfigWatcherPathWithChroot("/short");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithLongChroot() throws Exception {
+        testConfigWatcherPathWithChroot("/pretty-long-chroot-path");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithChrootZooKeeperTree() throws Exception {
+        testConfigWatcherPathWithChroot("/zookeeper");
+        testConfigWatcherPathWithChroot("/zookeeper/a");
+        testConfigWatcherPathWithChroot("/zookeeper/config");
+        testConfigWatcherPathWithChroot("/zookeeper/config/a");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithChrootZoo() throws Exception {
+        // "/zoo" is prefix of "/zookeeper/config"
+        testConfigWatcherPathWithChroot("/zoo");
+    }
+
+    private void testDataWatcherPathWithChroot(String chroot) throws Exception {
+        assertTrue("/zookeeper/config".startsWith(chroot));
+        String leafPath = "/zookeeper/config".substring(chroot.length());
+        String dataPath = leafPath.isEmpty() ? "/" : leafPath;
+        PathUtils.validatePath(dataPath);
+
+        ZooKeeper zk1 = createClient(hostPort + chroot);
+
+        BlockingQueueWatcher dataWatcher = new BlockingQueueWatcher();
+        BlockingQueueWatcher configWatcher = new BlockingQueueWatcher();
+
+        // given|>config watcher: attach to config node multiple times
+        byte[] configData = zk1.getConfig(configWatcher, null);
+        zk1.getConfig(configWatcher, null);
+
+        // given|>data watcher: attach to config node through getData multiple times
+        zk1.getData(dataPath, dataWatcher, null);
+        join(future -> zk1.getData(dataPath, dataWatcher, complete(future), null));
+
+        // given|>default watcher: attach to config node through getData and getConfig multiple times
+        BlockingQueueWatcher defaultWatcher = new BlockingQueueWatcher();
+        zk1.getWatchManager().setDefaultWatcher(defaultWatcher);
+        zk1.getData(dataPath, true, null);
+        zk1.getData(dataPath, defaultWatcher, null);
+        zk1.getConfig(true, null);
+        zk1.getConfig(defaultWatcher, null);
+
+        // when: make change to config node
+        ZooKeeper zk2 = createClient();
+        zk2.addAuthInfo("digest", "super:test".getBytes());
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then|>data watcher: only one event with path dataPath
+        WatchedEvent dataEvent = dataWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals(dataPath, dataEvent.getPath());
+        assertNull(dataWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // then|>config watcher: only one event with path "/zookeeper/config"
+        WatchedEvent configEvent = configWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals("/zookeeper/config", configEvent.getPath());
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+
+        if (dataPath.equals("/zookeeper/config")) {
+            // then|>default watcher: only one event with path "/zookeeper/config"
+            WatchedEvent defaultWatcherEvent = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+            assertEquals("/zookeeper/config", defaultWatcherEvent.getPath());
+        } else {
+            // then|>default watcher: two events with path dataPath and "/zookeeper/config"
+            Set<String> defaultWatcherPaths = new HashSet<>();
+            defaultWatcherPaths.add(dataPath);
+            defaultWatcherPaths.add("/zookeeper/config");
+
+            WatchedEvent defaultWatcherEvent1 = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+            assertThat(defaultWatcherPaths, hasItem(defaultWatcherEvent1.getPath()));
+            defaultWatcherPaths.remove(defaultWatcherEvent1.getPath());
+
+            WatchedEvent defaultWatcherEvent2 = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+            assertNotNull(defaultWatcherEvent2);
+            assertThat(defaultWatcherPaths, hasItem(defaultWatcherEvent2.getPath()));
+        }
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // given: all watchers fired
+        // when: make change to config node
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then: no more events
+        assertNull(dataWatcher.pollEvent(Duration.ofMillis(10)));
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+    }
+
+    @Test
+    public void testDataWatcherPathWithNoChroot() throws Exception {
+        testDataWatcherPathWithChroot("");
+    }
+
+    @Test
+    public void testDataWatcherPathWithChrootZooKeeper() throws Exception {
+        testDataWatcherPathWithChroot("/zookeeper");
+    }
+
+    @Test
+    public void testDataWatcherPathWithChrootZooKeeperConfig() throws Exception {
+        testDataWatcherPathWithChroot("/zookeeper/config");
+    }
+
+    @Test
+    public void testDataWatcherPathWithChrootAndConfigPath() throws Exception {
+        try (ZooKeeper zk1 = createClient(hostPort + "/root1"); ZooKeeper zk2 = createClient()) {
+            // given: watcher client path "/zookeeper/config" in chroot "/root1"
+            BlockingQueueWatcher dataWatcher = new BlockingQueueWatcher();
+            zk1.addWatch("/zookeeper/config", dataWatcher, AddWatchMode.PERSISTENT);
+
+            // and: watch for "/zookeeper/config" in server
+            BlockingQueueWatcher configWatcher = new BlockingQueueWatcher();
+            byte[] configData = zk1.getConfig(configWatcher, null);
+
+            // when: make change to config node
+            zk2.addAuthInfo("digest", "super:test".getBytes());
+            zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+            // then: config watcher works normally
+            WatchedEvent configEvent = configWatcher.takeEvent(Duration.ofSeconds(10));
+            assertEquals("/zookeeper/config", configEvent.getPath());
+
+            // and: no data watcher for "/zookeeper/config" in chroot "/root1"
+            assertNull(dataWatcher.pollEvent(Duration.ofSeconds(1)));
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
index fca48c751f1..0b156156d0d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
@@ -25,15 +25,12 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Arrays;
-import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
-import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.junit.jupiter.api.Test;
@@ -63,25 +60,6 @@ public boolean matches() throws InterruptedException {
 
     }
 
-    @Test
-    public void testChrootWithZooKeeperPathWatcher() throws Exception {
-        ZooKeeper zk1 = createClient(hostPort + "/chroot");
-        BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
-        byte[] config = zk1.getConfig(events::add, null);
-
-        ZooKeeper zk2 = createClient();
-        zk2.addAuthInfo("digest", "super:test".getBytes());
-        zk2.setData(ZooDefs.CONFIG_NODE, config, -1);
-
-        waitFor("config watcher receive no event", () -> !events.isEmpty(), 10);
-
-        WatchedEvent event = events.poll();
-        assertNotNull(event);
-        assertEquals(Watcher.Event.KeeperState.SyncConnected, event.getState());
-        assertEquals(Watcher.Event.EventType.NodeDataChanged, event.getType());
-        assertEquals(ZooDefs.CONFIG_NODE, event.getPath());
-    }
-
     @Test
     public void testChrootSynchronous() throws IOException, InterruptedException, KeeperException {
         ZooKeeper zk1 = createClient();

From 5823a3f78b3ae032385a8b6f7b7594b44cf3a25a Mon Sep 17 00:00:00 2001
From: zhaohaidao <zhaohaidao2008@hotmail.com>
Date: Sat, 30 Sep 2023 18:22:21 +0800
Subject: [PATCH 402/591] ZOOKEEPER-4743: Increase data version once more when
 going back to -1 from Integer.MIN_VALUE (#2064)

Co-authored-by: zhaohaiyuan <zhaohaiyuan@meituan.com>
Co-authored-by: tison <wander4096@gmail.com>
---
 .../org/apache/zookeeper/server/DataTree.java |  14 +++
 .../server/PrepRequestProcessor.java          |  13 ++-
 .../server/PrepRequestProcessorTest.java      | 108 ++++++++++++++++++
 3 files changed, 134 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index b99bf632da6..6dbe94332c1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -1962,4 +1962,18 @@ public static StatPersisted createStat(long zxid, long time, long ephemeralOwner
         stat.setEphemeralOwner(ephemeralOwner);
         return stat;
     }
+
+    // for test only
+    static StatPersisted createStat(int version) {
+        StatPersisted stat = new StatPersisted();
+        stat.setCtime(0);
+        stat.setMtime(0);
+        stat.setCzxid(0);
+        stat.setMzxid(0);
+        stat.setPzxid(0);
+        stat.setVersion(version);
+        stat.setAversion(0);
+        stat.setEphemeralOwner(0);
+        return stat;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 28d1cc97b55..274862ee31f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -738,7 +738,18 @@ private static int checkAndIncVersion(int currentVersion, int expectedVersion, S
         if (expectedVersion != -1 && expectedVersion != currentVersion) {
             throw new KeeperException.BadVersionException(path);
         }
-        return currentVersion + 1;
+        // Increase once more when going back to -1 from Integer.MIN_VALUE. Otherwise, the client will
+        // receive a new data version -1. And Now, if the client wants to check the data version, it can
+        // only pass -1 as the next expected version, but -1 as the expected version means do not check
+        // the data version. So the client is unable to express the expected manner.
+        //
+        // See also https://issues.apache.org/jira/browse/ZOOKEEPER-4743.
+        int nextVersion = currentVersion + 1;
+        if (nextVersion == -1) {
+            return 0;
+        } else {
+            return nextVersion;
+        }
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index b10258fb5b3..e2416415807 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -45,6 +45,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.proto.ReconfigRequest;
 import org.apache.zookeeper.proto.RequestHeader;
@@ -59,6 +60,7 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.ErrorTxn;
+import org.apache.zookeeper.txn.SetDataTxn;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -391,4 +393,110 @@ public Set<Long> localSessions() {
             return Collections.emptySet();
         }
     }
+
+    @Test
+    public void testCheckAndIncVersion() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], 0);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(1, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncVersionOverflow() throws Exception {
+        Stat customStat = new Stat();
+        customStat.setVersion(Integer.MAX_VALUE);
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+        node.stat = DataTree.createStat(Integer.MAX_VALUE);
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], Integer.MAX_VALUE);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(Integer.MIN_VALUE, setDataTxn.getVersion());
+    }
+    @Test
+    public void testCheckAndIncVersionWithNegativeNumber() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+        node.stat = DataTree.createStat(Integer.MIN_VALUE);
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], Integer.MIN_VALUE);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(Integer.MIN_VALUE + 1, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncToZeroFromNegativeTwo() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+        node.stat = DataTree.createStat(-2);
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], -2);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(0, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncSkipEqualityCheck() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], -1);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(1, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncWithBadVersion() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], 1);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.error, outcome.getHdr().getType());
+        assertEquals(KeeperException.Code.BADVERSION, outcome.getException().code());
+    }
 }

From 6cae2cded2a6feeeea886a0f31f4f98450353340 Mon Sep 17 00:00:00 2001
From: Tero Saarni <tero.saarni@est.tech>
Date: Mon, 2 Oct 2023 07:49:19 +0300
Subject: [PATCH 403/591] ZOOKEEPER-4415: Added TLSv1.3 support to server
 (#1919)

* ZOOKEEPER-4415: Added TLSv1.3 support to server

Enable TLSv1.3 when server is running on JDK that supports it.

 - Select TLSv1.3 as default protocol.
 - Include both TLSv1.2 and TLSv1.3 as default enabled protocols.
 - Include TLSv1.3 ciphers in default ciphers.

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* Fixed checkstyle errors

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

---------

Signed-off-by: Tero Saarni <tero.saarni@est.tech>
---
 .../main/resources/markdown/zookeeperAdmin.md |  4 +-
 .../common/SSLContextAndOptions.java          |  5 +-
 .../org/apache/zookeeper/common/X509Util.java | 53 ++++++++++++++++---
 .../apache/zookeeper/common/X509UtilTest.java | 22 +++++++-
 4 files changed, 71 insertions(+), 13 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 7a99cd346c6..59b995e2f15 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1709,13 +1709,13 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (Java system properties: **zookeeper.ssl.protocol** and **zookeeper.ssl.quorum.protocol**)
     **New in 3.5.5:**
     Specifies to protocol to be used in client and quorum TLS negotiation.
-    Default: TLSv1.2
+    Default: TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
 
 * *ssl.enabledProtocols* and *ssl.quorum.enabledProtocols* :
     (Java system properties: **zookeeper.ssl.enabledProtocols** and **zookeeper.ssl.quorum.enabledProtocols**)
     **New in 3.5.5:**
     Specifies the enabled protocols in client and quorum TLS negotiation.
-    Default: value of `protocol` property
+    Default: TLSv1.3, TLSv1.2 if value of `protocol` property is TLSv1.3. TLSv1.2 if `protocol` is TLSv1.2.
 
 * *ssl.ciphersuites* and *ssl.quorum.ciphersuites* :
     (Java system properties: **zookeeper.ssl.ciphersuites** and **zookeeper.ssl.quorum.ciphersuites**)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
index f5ce023c653..3a254255292 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
@@ -149,7 +149,10 @@ private void configureSslParameters(SSLParameters sslParameters, boolean isClien
     private String[] getEnabledProtocols(final ZKConfig config, final SSLContext sslContext) {
         String enabledProtocolsInput = config.getProperty(x509Util.getSslEnabledProtocolsProperty());
         if (enabledProtocolsInput == null) {
-            return new String[]{sslContext.getProtocol()};
+            // Use JDK defaults for enabled protocols:
+            // Protocol TLSv1.3 -> enabled protocols TLSv1.3 and TLSv1.2
+            // Protocol TLSv1.2 -> enabled protocols TLSv1.2
+            return sslContext.getDefaultSSLParameters().getProtocols();
         }
         return enabledProtocolsInput.split(",");
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 56b9f8ed1c6..a7a9fb7a3d5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -33,14 +33,19 @@
 import java.security.Security;
 import java.security.cert.PKIXBuilderParameters;
 import java.security.cert.X509CertSelector;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
 import java.util.Objects;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
+import java.util.stream.Collectors;
 import javax.net.ssl.CertPathTrustManagerParameters;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLServerSocket;
+import javax.net.ssl.SSLServerSocketFactory;
 import javax.net.ssl.SSLSocket;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
@@ -69,6 +74,9 @@ public abstract class X509Util implements Closeable, AutoCloseable {
 
     private static final String REJECT_CLIENT_RENEGOTIATION_PROPERTY = "jdk.tls.rejectClientInitiatedRenegotiation";
     private static final String FIPS_MODE_PROPERTY = "zookeeper.fips-mode";
+    public static final String TLS_1_1 = "TLSv1.1";
+    public static final String TLS_1_2 = "TLSv1.2";
+    public static final String TLS_1_3 = "TLSv1.3";
 
     static {
         // Client-initiated renegotiation in TLS is unsafe and
@@ -82,7 +90,32 @@ public abstract class X509Util implements Closeable, AutoCloseable {
         }
     }
 
-    public static final String DEFAULT_PROTOCOL = "TLSv1.2";
+    public static final String DEFAULT_PROTOCOL = defaultTlsProtocol();
+
+    /**
+     * Return TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
+     * TLSv1.3 was first introduced in JDK11 and back-ported to OpenJDK 8u272.
+     */
+    private static String defaultTlsProtocol() {
+        String defaultProtocol = TLS_1_2;
+        List<String> supported = new ArrayList<>();
+        try {
+            supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
+            if (supported.contains(TLS_1_3)) {
+                defaultProtocol = TLS_1_3;
+            }
+        } catch (NoSuchAlgorithmException e) {
+            // Ignore.
+        }
+        LOG.info("Default TLS protocol is {}, supported TLS protocols are {}", defaultProtocol, supported);
+        return defaultProtocol;
+    }
+
+    // ChaCha20 was introduced in OpenJDK 11.0.15 and it is not supported by JDK8.
+    private static String[] getTLSv13Ciphers() {
+        return new String[]{"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256"};
+    }
+
     private static String[] getGCMCiphers() {
         return new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"};
     }
@@ -91,18 +124,22 @@ private static String[] getCBCCiphers() {
         return new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"};
     }
 
-    private static String[] concatArrays(String[] left, String[] right) {
-        String[] result = new String[left.length + right.length];
-        System.arraycopy(left, 0, result, 0, left.length);
-        System.arraycopy(right, 0, result, left.length, right.length);
-        return result;
+    /**
+     * Returns a filtered set of ciphers, where ciphers not supported by the JDK are removed.
+     */
+    private static String[] getSupportedCiphers(String[]... cipherLists) {
+        List<String> supported = Arrays.asList(
+            ((SSLServerSocketFactory) SSLServerSocketFactory.getDefault()).getSupportedCipherSuites());
+
+        return Arrays.stream(cipherLists).flatMap(Arrays::stream).filter(supported::contains).collect(Collectors.toList()).toArray(new String[0]);
     }
 
     // On Java 8, prefer CBC ciphers since AES-NI support is lacking and GCM is slower than CBC.
-    private static final String[] DEFAULT_CIPHERS_JAVA8 = concatArrays(getCBCCiphers(), getGCMCiphers());
+    private static final String[] DEFAULT_CIPHERS_JAVA8 = getSupportedCiphers(getCBCCiphers(), getGCMCiphers(), getTLSv13Ciphers());
     // On Java 9 and later, prefer GCM ciphers due to improved AES-NI support.
     // Note that this performance assumption might not hold true for architectures other than x86_64.
-    private static final String[] DEFAULT_CIPHERS_JAVA9 = concatArrays(getGCMCiphers(), getCBCCiphers());
+    // TLSv1.3 ciphers can be added at the end of the list without impacting the priority of TLSv1.3 vs TLSv1.2.
+    private static final String[] DEFAULT_CIPHERS_JAVA9 = getSupportedCiphers(getGCMCiphers(), getCBCCiphers(), getTLSv13Ciphers());
 
     public static final int DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS = 5000;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index ddffd426dd8..1218a00de30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -31,6 +31,8 @@
 import java.nio.file.Path;
 import java.security.NoSuchAlgorithmException;
 import java.security.Security;
+import java.util.Arrays;
+import java.util.List;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
@@ -102,6 +104,20 @@ public void testCreateSSLContextWithoutCustomProtocol(
         init(caKeyType, certKeyType, keyPassword, paramIndex);
         SSLContext sslContext = x509Util.getDefaultSSLContext();
         assertEquals(X509Util.DEFAULT_PROTOCOL, sslContext.getProtocol());
+
+        // Check that TLSv1.3 is selected in JDKs that support it (OpenJDK 8u272 and later).
+        List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
+        if (supported.contains(X509Util.TLS_1_3)) {
+            // SSLContext protocol.
+            assertEquals(X509Util.TLS_1_3, sslContext.getProtocol());
+            // Enabled protocols.
+            List<String> protos = Arrays.asList(sslContext.getDefaultSSLParameters().getProtocols());
+            assertTrue(protos.contains(X509Util.TLS_1_2));
+            assertTrue(protos.contains(X509Util.TLS_1_3));
+        } else {
+            assertEquals(X509Util.TLS_1_2, sslContext.getProtocol());
+            assertArrayEquals(new String[]{X509Util.TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
+        }
     }
 
     @ParameterizedTest
@@ -110,7 +126,7 @@ public void testCreateSSLContextWithoutCustomProtocol(
     public void testCreateSSLContextWithCustomProtocol(
             X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
             throws Exception {
-        final String protocol = "TLSv1.1";
+        final String protocol = X509Util.TLS_1_1;
         init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.setProperty(x509Util.getSslProtocolProperty(), protocol);
         SSLContext sslContext = x509Util.getDefaultSSLContext();
@@ -745,7 +761,8 @@ private static void forceClose(ServerSocket s) {
     }
 
     // This test makes sure that client-initiated TLS renegotiation does not
-    // succeed. We explicitly disable it at the top of X509Util.java.
+    // succeed when using TLSv1.2. We explicitly disable it at the top of X509Util.java.
+    // Force TLSv1.2 since the renegotiation feature is not supported anymore in TLSv1.3 and the test becomes invalid.
     @ParameterizedTest
     @MethodSource("data")
     public void testClientRenegotiationFails(
@@ -768,6 +785,7 @@ public void testClientRenegotiationFails(
                     @Override
                     public SSLSocket call() throws Exception {
                         SSLSocket sslSocket = (SSLSocket) listeningSocket.accept();
+                        sslSocket.setEnabledProtocols(new String[]{X509Util.TLS_1_2});
                         sslSocket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
                             @Override
                             public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent) {

From e2070bed85d8b0c98a5a0045bf92421f473c412e Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Sun, 24 Sep 2023 14:28:56 +0200
Subject: [PATCH 404/591] ZOOKEEPER-4753: zookeeper-server: Improvement:
 Explicit handling of DIGEST-MD5 vs GSSAPI in quorum auth

Before this, the SASL-based quorum authorizer did not explicitly
distinguish between the DIGEST-MD5 and GSSAPI mechanisms: it was
simply relying on NameCallback and PasswordCallback for authentication
with the former and examining Kerberos principals in AuthorizeCallback
for the latter.

It turns out that some SASL/DIGEST-MD5 configurations cause
authentication and authorization IDs not to match the expected format,
and the DIGEST-MD5-based portions of the quorum test suite to fail
with obscure errors.  (They can be traced to failures to join the
quorum, but only by looking into detailed logs.)

This patch uses the login module name to determine whether DIGEST-MD5
or GSSAPI is used, and relaxes the authentication ID check for the
former.  As a cleanup, it keeps the password-based credential map
empty when Kerberos principals are expected.  It finally adapts a
test, and adds a new one, ensuring "weirdly-shaped" credentials only
cause authentication failures in the GSSAPI case.
---
 .../auth/SaslQuorumServerCallbackHandler.java | 44 ++++++++----
 .../quorum/auth/QuorumKerberosAuthTest.java   | 12 ++--
 .../auth/QuorumKerberosHostBasedAuthTest.java | 72 ++++++++++++++++++-
 3 files changed, 107 insertions(+), 21 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
index 4b711a6b5f7..b182ee13a1c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.quorum.auth;
 
 import java.io.IOException;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
@@ -31,6 +32,7 @@
 import javax.security.auth.login.Configuration;
 import javax.security.sasl.AuthorizeCallback;
 import javax.security.sasl.RealmCallback;
+import org.apache.zookeeper.server.auth.DigestLoginModule;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -46,7 +48,8 @@ public class SaslQuorumServerCallbackHandler implements CallbackHandler {
     private static final Logger LOG = LoggerFactory.getLogger(SaslQuorumServerCallbackHandler.class);
 
     private String userName;
-    private final Map<String, String> credentials = new HashMap<>();
+    private final boolean isDigestAuthn;
+    private final Map<String, String> credentials;
     private final Set<String> authzHosts;
 
     public SaslQuorumServerCallbackHandler(
@@ -60,20 +63,35 @@ public SaslQuorumServerCallbackHandler(
             LOG.error(errorMessage);
             throw new IOException(errorMessage);
         }
-        credentials.clear();
+
+        Map<String, String> credentials = new HashMap<>();
+        boolean isDigestAuthn = true;
+
         for (AppConfigurationEntry entry : configurationEntries) {
-            Map<String, ?> options = entry.getOptions();
-            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "QuorumServer" section.
-            // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
-            for (Map.Entry<String, ?> pair : options.entrySet()) {
-                String key = pair.getKey();
-                if (key.startsWith(USER_PREFIX)) {
-                    String userName = key.substring(USER_PREFIX.length());
-                    credentials.put(userName, (String) pair.getValue());
+            if (entry.getLoginModuleName().equals(DigestLoginModule.class.getName())) {
+                Map<String, ?> options = entry.getOptions();
+                // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "QuorumServer" section.
+                // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
+                for (Map.Entry<String, ?> pair : options.entrySet()) {
+                    String key = pair.getKey();
+                    if (key.startsWith(USER_PREFIX)) {
+                        String userName = key.substring(USER_PREFIX.length());
+                        credentials.put(userName, (String) pair.getValue());
+                    }
                 }
+            } else {
+                isDigestAuthn = false;
             }
         }
 
+        this.isDigestAuthn = isDigestAuthn;
+        if (isDigestAuthn) {
+            this.credentials = Collections.unmodifiableMap(credentials);
+            LOG.warn("Using DIGEST-MD5 for quorum authorization");
+        } else {
+            this.credentials = Collections.emptyMap();
+        }
+
         // authorized host lists
         this.authzHosts = authzHosts;
     }
@@ -126,13 +144,15 @@ private void handleAuthorizeCallback(AuthorizeCallback ac) {
         // 2. Verify whether the connecting host is present in authorized hosts.
         // If not exists, then connecting peer is not authorized to join the
         // ensemble and will reject it.
-        if (authzFlag) {
+        if (!isDigestAuthn && authzFlag) {
             String[] components = authorizationID.split("[/@]");
             if (components.length == 3) {
                 authzFlag = authzHosts.contains(components[1]);
+            } else {
+                authzFlag = false;
             }
             if (!authzFlag) {
-                LOG.error("SASL authorization completed, {} is not authorized to connect", components[1]);
+                LOG.error("SASL authorization completed, {} is not authorized to connect", authorizationID);
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
index 475c899732a..4a8458054b7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
@@ -57,7 +57,7 @@ public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
                                      + "       debug=false\n"
                                      + "       refreshKrb5Config=true\n"
                                      + "       principal=\""
-                                     + KerberosTestUtils.getServerPrincipal()
+                                     + KerberosTestUtils.replaceHostPattern(KerberosTestUtils.getHostServerPrincipal())
                                      + "\";\n"
                                      + "};\n"
                                      + "QuorumLearner {\n"
@@ -71,7 +71,7 @@ public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
                                      + "       debug=false\n"
                                      + "       refreshKrb5Config=true\n"
                                      + "       principal=\""
-                                     + KerberosTestUtils.getLearnerPrincipal()
+                                     + KerberosTestUtils.replaceHostPattern(KerberosTestUtils.getHostLearnerPrincipal())
                                      + "\";\n"
                                      + "};\n";
         setupJaasConfig(jaasEntries);
@@ -81,10 +81,10 @@ public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
     public static void setUp() throws Exception {
         // create keytab
         keytabFile = new File(KerberosTestUtils.getKeytabFile());
-        String learnerPrincipal = KerberosTestUtils.getLearnerPrincipal();
-        String serverPrincipal = KerberosTestUtils.getServerPrincipal();
-        learnerPrincipal = learnerPrincipal.substring(0, learnerPrincipal.lastIndexOf("@"));
-        serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
+        String learnerPrincipal = KerberosTestUtils.getHostLearnerPrincipal();
+        String serverPrincipal = KerberosTestUtils.getHostServerPrincipal();
+        learnerPrincipal = KerberosTestUtils.replaceHostPattern(learnerPrincipal.substring(0, learnerPrincipal.lastIndexOf("@")));
+        serverPrincipal = KerberosTestUtils.replaceHostPattern(serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@")));
         getKdc().createPrincipal(keytabFile, learnerPrincipal, serverPrincipal);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
index 287761ac322..55a6d74804c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
@@ -44,15 +44,17 @@ public class QuorumKerberosHostBasedAuthTest extends KerberosSecurityTestcase {
     private static String hostServerPrincipal = KerberosTestUtils.getHostServerPrincipal();
     private static String hostLearnerPrincipal = KerberosTestUtils.getHostLearnerPrincipal();
     private static String hostNamedLearnerPrincipal = KerberosTestUtils.getHostNamedLearnerPrincipal("myHost");
+    private static String hostlessLearnerPrincipal = KerberosTestUtils.getLearnerPrincipal();
 
     static {
-        setupJaasConfigEntries(hostServerPrincipal, hostLearnerPrincipal, hostNamedLearnerPrincipal);
+        setupJaasConfigEntries(hostServerPrincipal, hostLearnerPrincipal, hostNamedLearnerPrincipal, hostlessLearnerPrincipal);
     }
 
     private static void setupJaasConfigEntries(
         String hostServerPrincipal,
         String hostLearnerPrincipal,
-        String hostNamedLearnerPrincipal) {
+        String hostNamedLearnerPrincipal,
+        String hostlessLearnerPrincipal) {
         String keytabFilePath = FilenameUtils.normalize(KerberosTestUtils.getKeytabFile(), true);
 
         // note: we use "refreshKrb5Config=true" to refresh the kerberos config in the JVM,
@@ -93,6 +95,18 @@ private static void setupJaasConfigEntries(
                              + "       refreshKrb5Config=true\n"
                              + "       principal=\"" + hostNamedLearnerPrincipal
                              + "\";\n"
+                             + "};\n"
+                             + "QuorumLearnerMissingHost {\n"
+                             + "       com.sun.security.auth.module.Krb5LoginModule required\n"
+                             + "       useKeyTab=true\n"
+                             + "       keyTab=\"" + keytabFilePath
+                             + "\"\n"
+                             + "       storeKey=true\n"
+                             + "       useTicketCache=false\n"
+                             + "       debug=false\n"
+                             + "       refreshKrb5Config=true\n"
+                             + "       principal=\"" + hostlessLearnerPrincipal
+                             + "\";\n"
                              + "};\n";
         setupJaasConfig(jaasEntries);
     }
@@ -110,7 +124,11 @@ public static void setUp() throws Exception {
 
         // learner with ipaddress in principal
         String learnerPrincipal2 = hostNamedLearnerPrincipal.substring(0, hostNamedLearnerPrincipal.lastIndexOf("@"));
-        getKdc().createPrincipal(keytabFile, learnerPrincipal, learnerPrincipal2, serverPrincipal);
+
+        // learner without host in principal
+        String learnerPrincipal3 = hostlessLearnerPrincipal.substring(0, hostlessLearnerPrincipal.lastIndexOf("@"));
+
+        getKdc().createPrincipal(keytabFile, learnerPrincipal, learnerPrincipal2, learnerPrincipal3, serverPrincipal);
     }
 
     @AfterEach
@@ -224,4 +242,52 @@ public void testConnectBadServer() throws Exception {
         }
     }
 
+    /**
+     * Test to verify that the bad server connection to the quorum should be rejected.
+     */
+    @Test
+    @Timeout(value = 120)
+    public void testConnectHostlessPrincipalBadServer() throws Exception {
+        String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
+        Map<String, String> authConfigs = new HashMap<>();
+        authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_KERBEROS_SERVICE_PRINCIPAL, serverPrincipal);
+        String connectStr = startQuorum(3, authConfigs, 3);
+        CountdownWatcher watcher = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(connectStr, ClientBase.CONNECTION_TIMEOUT, watcher);
+        watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+        for (int i = 0; i < 10; i++) {
+            zk.create("/" + i, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        }
+        zk.close();
+
+        String quorumCfgSection = mt.get(0).getQuorumCfgSection();
+        StringBuilder sb = new StringBuilder();
+        sb.append(quorumCfgSection);
+
+        int myid = mt.size() + 1;
+        final int clientPort = PortAssignment.unique();
+        String server = String.format("server.%d=localhost:%d:%d:participant", myid, PortAssignment.unique(), PortAssignment.unique());
+        sb.append(server + "\n");
+        quorumCfgSection = sb.toString();
+        authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerMissingHost");
+        MainThread badServer = new MainThread(myid, clientPort, quorumCfgSection, authConfigs);
+        badServer.start();
+        watcher = new CountdownWatcher();
+        connectStr = "127.0.0.1:" + clientPort;
+        zk = new ZooKeeper(connectStr, ClientBase.CONNECTION_TIMEOUT, watcher);
+        try {
+            watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT / 3);
+            fail("Must throw exception as the principal does not include an authorized host!");
+        } catch (TimeoutException e) {
+            // expected
+        } finally {
+            zk.close();
+            badServer.shutdown();
+            badServer.deleteBaseDir();
+        }
+    }
+
 }

From 35a9441f31ba533c6de97f8b12fbe7a1c0c7481b Mon Sep 17 00:00:00 2001
From: Lari Hotari <lari@hotari.net>
Date: Tue, 3 Oct 2023 13:57:46 +0000
Subject: [PATCH 405/591] ZOOKEEPER-4751: Update snappy-java to 1.1.10.5 to
 address CVE-2023-43642

snappy-java 1.1.10.1 contains CVE-2023-43642 . Upgrade the dependency to 1.1.10.5 to get rid of the CVE.

see https://issues.apache.org/jira/browse/ZOOKEEPER-4751

Author: Lari Hotari <lari@hotari.net>

Reviewers: Andor Molnar <andor@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #2072 from lhotari/ZOOKEEPER-4751
---
 pom.xml                                                         | 2 +-
 ...0.1.jar_LICENSE.txt => snappy-java-1.1.10.5.jar_LICENSE.txt} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{snappy-java-1.1.10.1.jar_LICENSE.txt => snappy-java-1.1.10.5.jar_LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 68717b1a95a..da7fbe57a83 100644
--- a/pom.xml
+++ b/pom.xml
@@ -563,7 +563,7 @@
     <jetty.version>9.4.51.v20230217</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
-    <snappy.version>1.1.10.1</snappy.version>
+    <snappy.version>1.1.10.5</snappy.version>
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.75</bouncycastle.version>
     <commons-collections.version>4.4</commons-collections.version>
diff --git a/zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.1.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.5.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.1.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.5.jar_LICENSE.txt

From a0aced950c24776403b942e95bf972f14c511348 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Tue, 3 Oct 2023 15:57:58 +0000
Subject: [PATCH 406/591] ZOOKEEPER-4754: Update Jetty to avoid CVE-2023-36479,
 CVE-2023-40167, and CVE-2023-41900

The release notes of the newly referenced release:

https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823

explicitly mention the three CVEs.

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: tison <wander4096@gmail.com>, Andor Molnar <andor@apache.org>

Closes #2074 from ztzg/ZOOKEEPER-4754-jetty-cves
---
 pom.xml                                       |   2 +-
 ...jetty-client-9.4.52.v20230823.LICENSE.txt} |   0
 ...> jetty-http-9.4.52.v20230823.LICENSE.txt} |   0
 ... => jetty-io-9.4.52.v20230823.LICENSE.txt} |   0
 ...tty-security-9.4.52.v20230823.LICENSE.txt} |   0
 ...jetty-server-9.4.52.v20230823.LICENSE.txt} |   0
 ...etty-servlet-9.4.52.v20230823.LICENSE.txt} |   0
 ...> jetty-util-9.4.52.v20230823.LICENSE.txt} |   0
 ...tty-util-ajax-9.4.52.v20230823.LICENSE.txt | 414 ++++++++++++++++++
 9 files changed, 415 insertions(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.51.v20230217.LICENSE.txt => jetty-client-9.4.52.v20230823.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.51.v20230217.LICENSE.txt => jetty-http-9.4.52.v20230823.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.51.v20230217.LICENSE.txt => jetty-io-9.4.52.v20230823.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.51.v20230217.LICENSE.txt => jetty-security-9.4.52.v20230823.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.51.v20230217.LICENSE.txt => jetty-server-9.4.52.v20230823.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.51.v20230217.LICENSE.txt => jetty-servlet-9.4.52.v20230823.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.51.v20230217.LICENSE.txt => jetty-util-9.4.52.v20230823.LICENSE.txt} (100%)
 create mode 100644 zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.52.v20230823.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index da7fbe57a83..6158b7f4ece 100644
--- a/pom.xml
+++ b/pom.xml
@@ -560,7 +560,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.94.Final</netty.version>
-    <jetty.version>9.4.51.v20230217</jetty.version>
+    <jetty.version>9.4.52.v20230823</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-client-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.51.v20230217.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.52.v20230823.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.51.v20230217.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.52.v20230823.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.52.v20230823.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.52.v20230823.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

From 5f3b3d673891b32742bd9895f320181c8487ab53 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Tue, 3 Oct 2023 18:05:42 +0000
Subject: [PATCH 407/591] ZOOKEEPER-4755: owaspSuppressions.xml: Temporarily
 suppress CVE-2023-4586

CVE-2023-4586 looks like a real vulnerability in Netty, but no report or patch has been published so far.  This has to be monitored and will probably have to be remediated.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4586

Relevant discussion and pointers:

https://github.com/jeremylong/DependencyCheck/issues/5912#issuecomment-1699387994

Author: Damien Diederen <ddiederen@apache.org>

Reviewers: Andor Molnar <andor@apache.org>, Damien Diederen <ddiederen@apache.org>

Closes #2075 from ztzg/ZOOKEEPER-4755-netty-CVE-2023-4586
---
 owaspSuppressions.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 0c09a096f70..9a18c5fb2bc 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -38,6 +38,13 @@
       <!-- https://github.com/jeremylong/DependencyCheck/issues/1653
            False positive on Netty 4.x-->
       <cve>CVE-2018-12056</cve>
+      <!-- ZOOKEEPER-4755: looks like a real vulnerability in Netty,
+           but no report or patch has been published so far.  This has
+           to be monitored and will probably have to be remediated.
+
+           https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4586
+      -->
+      <cve>CVE-2023-4586</cve>
    </suppress>
    <suppress>
       <!-- Seems like false positive - we are not using Prometheus

From ce5b0b88834a0afaabebeb332ee486cb4dddef04 Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@stoty.hu>
Date: Tue, 3 Oct 2023 23:49:00 +0200
Subject: [PATCH 408/591] ZOOKEEPER-4752: Remove version files in
 zookeeper-server/src/main from .gitignore (#2073)

---
 .gitignore | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index e9119332f36..5b7d5dcac48 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,8 +69,6 @@ tags
 obj
 zookeeper-server/src/main/resources/lib/ant-eclipse-*
 zookeeper-server/src/main/resources/lib/ivy-*
-zookeeper-server/src/main/java/org/apache/zookeeper/version/Info.java
-zookeeper-server/src/main/java/org/apache/zookeeper/version/VersionInfoMain.java
 zookeeper-client/zookeeper-client-c/Makefile.in
 zookeeper-client/zookeeper-client-c/aclocal.m4
 zookeeper-client/zookeeper-client-c/autom4te.cache/

From ddb4e941381eb68f375ba7baef545e61d300569f Mon Sep 17 00:00:00 2001
From: vibhutisawant <41043754+vibhutisawant@users.noreply.github.com>
Date: Thu, 5 Oct 2023 15:06:35 +0530
Subject: [PATCH 409/591] Disable ClientSSLTest for s390x only (#2057)

---
 .../src/test/java/org/apache/zookeeper/test/ClientSSLTest.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index b77283da772..f23f7c7d4da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -27,6 +27,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeFalse;
 import io.netty.handler.ssl.SslProvider;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -147,6 +148,8 @@ public void testClientServerSSLWithCnxnClassName() throws Exception {
     @ParameterizedTest(name = "sslProvider={0}, fipsEnabled={1}, hostnameVerification={2}")
     @MethodSource("positiveTestData")
     public void testClientServerSSL_positive(SslProvider sslProvider, String fipsEnabled, String hostnameVerification) throws Exception {
+        //Skipping this test for s390x arch as netty-tc-native is not supported
+        assumeFalse(System.getProperty("os.arch").contains("s390x"), " Skipping for s390x arch as netty-tcnative is not yet supported.");
         // Arrange
         System.setProperty(clientX509Util.getSslProviderProperty(), sslProvider.toString());
         System.setProperty(clientX509Util.getFipsModeProperty(), fipsEnabled);

From b114447bd208153f6035bf4cfe498994cea093f7 Mon Sep 17 00:00:00 2001
From: maoling <maoling199210191@sina.com>
Date: Wed, 11 Oct 2023 15:15:59 +0200
Subject: [PATCH 410/591] ZOOKEEPER-3486: add the document about how to
 configure SSL/TLS for the admin server

- Link to the [PR-924](https://github.com/apache/zookeeper/pull/924)
- more details in the [ZOOKEEPER-3486](https://issues.apache.org/jira/browse/ZOOKEEPER-3486)

Author: maoling <maoling199210191@sina.com>

Reviewers: andor@apache.org

Closes #1036 from maoling/ZOOKEEPER-3486
---
 .../main/resources/markdown/zookeeperAdmin.md | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 59b995e2f15..80aebcfa61c 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2595,6 +2595,26 @@ The AdminServer is enabled by default, but can be disabled by either:
 Note that the TCP four-letter word interface is still available if
 the AdminServer is disabled.
 
+##### Configuring AdminServer for SSL/TLS
+- Generating the **keystore.jks** and **truststore.jks** which can be found in the [Quorum TLS](http://zookeeper.apache.org/doc/current/zookeeperAdmin.html#Quorum+TLS).
+- Add the following configuration settings to the `zoo.cfg` config file:
+
+```
+admin.portUnification=true
+ssl.quorum.keyStore.location=/path/to/keystore.jks
+ssl.quorum.keyStore.password=password
+ssl.quorum.trustStore.location=/path/to/truststore.jks
+ssl.quorum.trustStore.password=password
+```
+- Verify that the following entries in the logs can be seen:
+
+```
+2019-08-03 15:44:55,213 [myid:] - INFO  [main:JettyAdminServer@123] - Successfully loaded private key from /data/software/cert/keystore.jks
+2019-08-03 15:44:55,213 [myid:] - INFO  [main:JettyAdminServer@124] - Successfully loaded certificate authority from /data/software/cert/truststore.jks
+
+2019-08-03 15:44:55,403 [myid:] - INFO  [main:JettyAdminServer@170] - Started AdminServer on address 0.0.0.0, port 8080 and command URL /commands
+```
+
 Available commands include:
 
 * *connection_stat_reset/crst*:

From dc99bd75fe495c9ef2718fb1a10e175a23fb38d4 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Tue, 17 Oct 2023 13:06:10 +0800
Subject: [PATCH 411/591] ZOOKEEPER-2623: [ADDENDUM] Fix flaky
 CheckTest::testCluster (#2067)

---
 .../org/apache/zookeeper/test/CheckTest.java  | 54 +++++++++++++++----
 .../org/apache/zookeeper/test/QuorumBase.java | 15 ++++++
 2 files changed, 59 insertions(+), 10 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
index 4b7e33204c7..e813132739a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
@@ -19,13 +19,17 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.File;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CheckVersionRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
+import org.apache.zookeeper.server.ZKDatabase;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -36,6 +40,7 @@ public class CheckTest extends ClientBase {
 
     @BeforeEach
     public void setUp(TestInfo testInfo) throws Exception {
+        System.setProperty(ZKClientConfig.ZOOKEEPER_REQUEST_TIMEOUT, "2000");
         if (testInfo.getDisplayName().contains("Cluster")) {
             return;
         }
@@ -44,6 +49,7 @@ public void setUp(TestInfo testInfo) throws Exception {
 
     @AfterEach
     public void tearDown(TestInfo testInfo) throws Exception {
+        System.clearProperty(ZKClientConfig.ZOOKEEPER_REQUEST_TIMEOUT);
         if (testInfo.getDisplayName().contains("Cluster")) {
             return;
         }
@@ -83,11 +89,18 @@ private void testOperations(TestableZooKeeper zk) throws Exception {
 
     @Test
     public void testStandalone() throws Exception {
-        TestableZooKeeper zk = createClient();
-        testOperations(zk);
+        testOperations(createClient());
+    }
+
+    @Test
+    public void testStandaloneDatabaseReloadAfterCheck() throws Exception {
+        try {
+            testOperations(createClient());
+        } catch (Exception ignored) {
+            // Ignore to test database reload after check
+        }
         stopServer();
         startServer();
-        createClient();
     }
 
     @Test
@@ -98,13 +111,34 @@ public void testCluster() throws Exception {
             testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.OBSERVING));
             testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.FOLLOWING));
             testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.LEADING));
-            int leaderIndex = qb.getLeaderIndex();
-            int leaderPort = qb.getLeaderClientPort();
-            qb.shutdown(qb.getLeaderQuorumPeer());
-            qb.setupServer(leaderIndex + 1);
-            QuorumPeer quorumPeer = qb.getPeerList().get(leaderIndex);
-            quorumPeer.start();
-            qb.createClient("localhost:" + leaderPort, 2 * CONNECTION_TIMEOUT);
+        } finally {
+            try {
+                qb.tearDown();
+            } catch (Exception ignored) {}
+        }
+    }
+
+    @Test
+    public void testClusterDatabaseReloadAfterCheck() throws Exception {
+        QuorumBase qb = new QuorumBase();
+        try {
+            qb.setUp(true, true);
+
+            // Get leader before possible damaging operations to
+            // reduce chance of leader migration and log truncation.
+            File dataDir = qb.getLeaderDataDir();
+            QuorumPeer leader = qb.getLeaderQuorumPeer();
+
+            try {
+                testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.LEADING));
+            } catch (Exception ignored) {
+                // Ignore to test database reload after check
+            }
+            qb.shutdown(leader);
+
+            FileTxnSnapLog txnSnapLog = new FileTxnSnapLog(dataDir, dataDir);
+            ZKDatabase database = new ZKDatabase(txnSnapLog);
+            database.loadDataBase();
         } finally {
             try {
                 qb.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index 42740f897e3..46f14d74939 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -342,6 +342,21 @@ public QuorumPeer getLeaderQuorumPeer() {
       return null;
     }
 
+    public File getLeaderDataDir() {
+        if (s1.getPeerState() == ServerState.LEADING) {
+            return s1dir;
+        } else if (s2.getPeerState() == ServerState.LEADING) {
+            return s2dir;
+        } else if (s3.getPeerState() == ServerState.LEADING) {
+            return s3dir;
+        } else if (s4.getPeerState() == ServerState.LEADING) {
+            return s4dir;
+        } else if (s5.getPeerState() == ServerState.LEADING) {
+            return s5dir;
+        }
+        return null;
+    }
+
     public QuorumPeer getFirstObserver() {
       if (s1.getLearnerType() == LearnerType.OBSERVER) {
         return s1;

From 248cc091d440659a819bdd44fe5b41a38321a929 Mon Sep 17 00:00:00 2001
From: gycherish <gy_mydream@163.com>
Date: Tue, 17 Oct 2023 22:20:17 +0800
Subject: [PATCH 412/591] ZOOKEEPER-4761: CLI tool read saved clientid fail
 (#2079)

Co-authored-by: gycherish <g.wangker@gmail.com>
Co-authored-by: tison <wander4096@gmail.com>
---
 zookeeper-client/zookeeper-client-c/src/cli.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/cli.c b/zookeeper-client/zookeeper-client-c/src/cli.c
index 823ed72a5a0..c34be8d5961 100644
--- a/zookeeper-client/zookeeper-client-c/src/cli.c
+++ b/zookeeper-client/zookeeper-client-c/src/cli.c
@@ -924,7 +924,7 @@ int main(int argc, char **argv) {
     if (clientIdFile) {
         fh = fopen(clientIdFile, "r");
         if (fh) {
-            if (fread(&myid, sizeof(myid), 1, fh) != sizeof(myid)) {
+            if (fread(&myid, sizeof(myid), 1, fh) != 1) {
                 memset(&myid, 0, sizeof(myid));
             }
             fclose(fh);

From 75d0a0a850352743e584f78321cf7c51417f46f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=A7=E6=98=93=E5=AE=A2?= <kmter@live.com>
Date: Thu, 2 Nov 2023 19:09:44 +0800
Subject: [PATCH 413/591] ZOOKEEPER-4768: Fix flaky test
 org.apache.zookeeper.metrics.prometheus.ExportJvmInfoTest#exportInfo (#2087)

---
 .../metrics/prometheus/ExportJvmInfoTest.java |  4 +-
 .../PrometheusMetricsProviderConfigTest.java  | 14 ++----
 .../PrometheusMetricsProviderTest.java        |  8 +--
 .../prometheus/PrometheusMetricsTestBase.java | 49 +++++++++++++++++++
 4 files changed, 57 insertions(+), 18 deletions(-)
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
index 82dc5aa1614..5d51f9c1e54 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
@@ -19,7 +19,6 @@
 package org.apache.zookeeper.metrics.prometheus;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import io.prometheus.client.CollectorRegistry;
 import java.util.Properties;
 import org.junit.jupiter.api.Test;
 
@@ -27,7 +26,7 @@
  * Tests about Prometheus Metrics Provider. Please note that we are not testing
  * Prometheus but our integration.
  */
-public class ExportJvmInfoTest {
+public class ExportJvmInfoTest extends PrometheusMetricsTestBase {
 
     @Test
     public void exportInfo() throws Exception {
@@ -40,7 +39,6 @@ public void doNotExportInfo() throws Exception {
     }
 
     private void runTest(boolean exportJvmInfo) throws Exception {
-        CollectorRegistry.defaultRegistry.clear();
         PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
         try {
             Properties configuration = new Properties();
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
index 54c320d69c7..64989889b78 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -18,19 +18,17 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
-import io.prometheus.client.CollectorRegistry;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.util.Properties;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 
-public class PrometheusMetricsProviderConfigTest {
+public class PrometheusMetricsProviderConfigTest extends PrometheusMetricsTestBase {
 
     @Test
     public void testInvalidPort() {
-        Assert.assertThrows(MetricsProviderLifeCycleException.class, () -> {
-            CollectorRegistry.defaultRegistry.clear();
+        assertThrows(MetricsProviderLifeCycleException.class, () -> {
             PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
             Properties configuration = new Properties();
             configuration.setProperty("httpPort", "65536");
@@ -42,8 +40,7 @@ public void testInvalidPort() {
 
     @Test
     public void testInvalidAddr() {
-        Assert.assertThrows(MetricsProviderLifeCycleException.class, () -> {
-            CollectorRegistry.defaultRegistry.clear();
+        assertThrows(MetricsProviderLifeCycleException.class, () -> {
             PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
             Properties configuration = new Properties();
             configuration.setProperty("httpHost", "master");
@@ -54,7 +51,6 @@ public void testInvalidAddr() {
 
     @Test
     public void testValidConfig() throws MetricsProviderLifeCycleException {
-        CollectorRegistry.defaultRegistry.clear();
         PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
         configuration.setProperty("httpHost", "0.0.0.0");
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index eb9cf8bd2aa..59115e31d90 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -27,7 +27,6 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import io.prometheus.client.CollectorRegistry;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
@@ -56,7 +55,6 @@
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
 import org.hamcrest.CoreMatchers;
-import org.junit.Assert;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -65,14 +63,13 @@
  * Tests about Prometheus Metrics Provider. Please note that we are not testing
  * Prometheus but only our integration.
  */
-public class PrometheusMetricsProviderTest {
+public class PrometheusMetricsProviderTest extends PrometheusMetricsTestBase {
 
     private static final String URL_FORMAT = "http://localhost:%d/metrics";
     private PrometheusMetricsProvider provider;
 
     @BeforeEach
     public void setup() throws Exception {
-        CollectorRegistry.defaultRegistry.clear();
         provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
         configuration.setProperty("numWorkerThreads", "0"); // sync behavior for test
@@ -88,7 +85,6 @@ public void tearDown() {
         if (provider != null) {
             provider.stop();
         }
-        CollectorRegistry.defaultRegistry.clear();
     }
 
     @Test
@@ -416,7 +412,7 @@ public void testTraceCall() throws IOException, IllegalAccessException, NoSuchFi
         HttpURLConnection conn = (HttpURLConnection) new URL(metricsUrl).openConnection();
         conn.setRequestMethod("TRACE");
         conn.connect();
-        Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+        assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
     }
 
     @Test
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
new file mode 100644
index 00000000000..9ed4995fbd0
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import io.prometheus.client.CollectorRegistry;
+import io.prometheus.client.hotspot.DefaultExports;
+import java.lang.reflect.Field;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+
+/**
+ * The base test for prometheus metrics unit tests.
+ */
+public abstract class PrometheusMetricsTestBase {
+
+    @BeforeEach
+    void setUp() throws Exception {
+        CollectorRegistry.defaultRegistry.clear();
+        resetDefaultExportsInitializedFlag();
+    }
+
+    @AfterEach
+    void tearDown() throws Exception {
+        CollectorRegistry.defaultRegistry.clear();
+        resetDefaultExportsInitializedFlag();
+    }
+
+    protected void resetDefaultExportsInitializedFlag() throws Exception {
+        Field initializedField = DefaultExports.class.getDeclaredField("initialized");
+        initializedField.setAccessible(true);
+        initializedField.set(null, false);
+    }
+}

From 6c2d94d04954224f29479529d8790eb1b3fd6489 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Fri, 1 Dec 2023 00:30:13 +0800
Subject: [PATCH 414/591] ZOOKEEPER-910: Use SelectionKey.isXYZ() methods
 instead of complicated binary logic

ZOOKEEPER-910: Use SelectionKey.isXYZ() methods instead of complicated binary logic

Signed-off-by: tison <wander4096@gmail.com>
Co-authored-by: Michi Mutsuzaki <michim@apache.org>
Reviewers: kezhuw, anmolnar
Author: tisonkun
Closes #2063 from tisonkun/ZOOKEEPER-910
---
 .../main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
index 6cb125dc763..3ecce4c8844 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
@@ -335,18 +335,18 @@ void doTransport(
             selected = selector.selectedKeys();
         }
         // Everything below and until we get back to the select is
-        // non blocking, so time is effectively a constant. That is
+        // non-blocking, so time is effectively a constant. That is
         // Why we just have to do this once, here
         updateNow();
         for (SelectionKey k : selected) {
             SocketChannel sc = ((SocketChannel) k.channel());
-            if ((k.readyOps() & SelectionKey.OP_CONNECT) != 0) {
+            if (k.isConnectable()) {
                 if (sc.finishConnect()) {
                     updateLastSendAndHeard();
                     updateSocketAddresses();
                     sendThread.primeConnection();
                 }
-            } else if ((k.readyOps() & (SelectionKey.OP_READ | SelectionKey.OP_WRITE)) != 0) {
+            } else if (k.isReadable() || k.isWritable()) {
                 doIO(pendingQueue, cnxn);
             }
         }

From 32fb89c9f74c6e6d46148a16c422b9440f681970 Mon Sep 17 00:00:00 2001
From: szucsvillo <81696283+szucsvillo@users.noreply.github.com>
Date: Fri, 1 Dec 2023 14:05:56 +0100
Subject: [PATCH 415/591] =?UTF-8?q?ZOOKEEPER-4756:=20Merge=20script=20shou?=
 =?UTF-8?q?ld=20use=20GitHub=20api=20to=20merge=20pull=20requ=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ZOOKEEPER-4756: Merge script should use GitHub api to merge pull requests

Change-Id: I22ee835617fd96b540edd65191f6c83aae5365a9
Fix check status handling in merge_pr function

Change-Id: I99844bfac98c90e9bb525cb8d3eae5a465a56629
Refactor JIRA ID extraction pattern

Change-Id: I85a458eaac03b2a76edbc2ec923d56467503f900
Reviewers: tisonkun
Author: szucsvillo
Closes #2092 from szucsvillo/ZOOKEEPER-4756
---
 zk-merge-pr.py | 216 ++++++++++++++++++++++---------------------------
 1 file changed, 98 insertions(+), 118 deletions(-)
 mode change 100644 => 100755 zk-merge-pr.py

diff --git a/zk-merge-pr.py b/zk-merge-pr.py
old mode 100644
new mode 100755
index 0118cba2c64..debc36e318e
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -34,6 +34,7 @@
 import sys
 import urllib.request, urllib.error, urllib.parse
 import getpass
+import requests
 
 try:
     import jira.client
@@ -123,96 +124,72 @@ def get_current_branch():
     return run_cmd("git rev-parse --abbrev-ref HEAD").replace("\n", "")
 
 # merge the requested PR and return the merge hash
-def merge_pr(pr_num, target_ref, title, body, pr_repo_desc):
-    pr_branch_name = "%s_MERGE_PR_%s" % (TEMP_BRANCH_PREFIX, pr_num)
-    target_branch_name = "%s_MERGE_PR_%s_%s" % (TEMP_BRANCH_PREFIX, pr_num, target_ref.upper())
-    run_cmd("git fetch %s pull/%s/head:%s" % (PR_REMOTE_NAME, pr_num, pr_branch_name))
-    run_cmd("git fetch %s %s:%s" % (PUSH_REMOTE_NAME, target_ref, target_branch_name))
-    run_cmd("git checkout %s" % target_branch_name)
-
-    had_conflicts = False
-    try:
-        run_cmd(['git', 'merge', pr_branch_name, '--squash'])
-    except Exception as e:
-        msg = "Error merging: %s\nWould you like to manually fix-up this merge?" % e
-        continue_maybe(msg)
-        msg = "Okay, please fix any conflicts and 'git add' conflicting files... Finished?"
-        continue_maybe(msg)
-        had_conflicts = True
-
-    commit_authors = run_cmd(['git', 'log', 'HEAD..%s' % pr_branch_name,
-                             '--pretty=format:%an <%ae>']).split("\n")
-    distinct_authors = sorted(set(commit_authors),
-                              key=lambda x: commit_authors.count(x), reverse=True)
-    primary_author = input(
-        "Enter primary author in the format of \"name <email>\" [%s]: " %
-        distinct_authors[0])
-    if primary_author == "":
-        primary_author = distinct_authors[0]
-
-    reviewers = input(
-        "Enter reviewers in the format of \"name1 <email1>, name2 <email2>\": ").strip()
-
-    commits = run_cmd(['git', 'log', 'HEAD..%s' % pr_branch_name,
-                      '--pretty=format:%h [%an] %s']).split("\n")
-
-    if len(commits) > 1:
-        result = input("List pull request commits in squashed commit message? (y/n): ")
-        if result.lower().strip() == "y":
-          should_list_commits = True
-        else:
-          should_list_commits = False
+def merge_pr(pr_num, title, pr_repo_desc):
+
+    # Retrieve the commits separately.
+    json_commits = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/commits")
+    merge_message = []
+    if json_commits and isinstance(json_commits, list):
+        for commit in json_commits:
+            commit_message = commit['commit']['message']
+            merge_message += [commit_message]
+
+    # Check for disapproval reviews.
+    json_reviewers = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/reviews")
+    disapproval_reviews = [review['user']['login'] for review in json_reviewers if review['state'] == 'CHANGES_REQUESTED']
+    if disapproval_reviews:
+        continue_maybe("Warning: There are requested changes. Proceed with merging pull request #%s?" % pr_num)
+    # Verify if there are no approved reviews.
+    approved_reviewers = [review['user']['login'] for review in json_reviewers if review['state'] == 'APPROVED']
+    if not approved_reviewers:
+        continue_maybe("Warning: Pull Request does not have an approved review. Proceed with merging pull request #%s?" % pr_num)
     else:
-        should_list_commits = False
-
-    merge_message_flags = []
-
-    merge_message_flags += ["-m", title]
-    if body is not None:
-        # We remove @ symbols from the body to avoid triggering e-mails
-        # to people every time someone creates a public fork of the project.
-        merge_message_flags += ["-m", body.replace("@", "")]
-
-    authors = "\n".join(["Author: %s" % a for a in distinct_authors])
-
-    merge_message_flags += ["-m", authors]
-
-    if (reviewers != ""):
-        merge_message_flags += ["-m", "Reviewers: %s" % reviewers]
-
-    if had_conflicts:
-        committer_name = run_cmd("git config --get user.name").strip()
-        committer_email = run_cmd("git config --get user.email").strip()
-        message = "This patch had conflicts when merged, resolved by\nCommitter: %s <%s>" % (
-            committer_name, committer_email)
-        merge_message_flags += ["-m", message]
-
-    # The string "Closes #%s" string is required for GitHub to correctly close the PR
+        reviewers_string = ', '.join(approved_reviewers)
+        merge_message += [f"Reviewers: {reviewers_string}"]
+    # Check the author and the closing line.
+    json_pr = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}")
+    primary_author = json_pr["user"]["login"]
+    if primary_author != "":
+        merge_message += [f"Author: {primary_author}"]
     close_line = "Closes #%s from %s" % (pr_num, pr_repo_desc)
-    if should_list_commits:
-        close_line += " and squashes the following commits:"
-    merge_message_flags += ["-m", close_line]
-
-    if should_list_commits:
-        merge_message_flags += ["-m", "\n".join(commits)]
-
-    run_cmd(['git', 'commit', '--author="%s"' % primary_author] + merge_message_flags)
-
-    continue_maybe("Merge complete (local ref %s). Push to %s?" % (
-        target_branch_name, PUSH_REMOTE_NAME))
-
-    try:
-        run_cmd('git push %s %s:%s' % (PUSH_REMOTE_NAME, target_branch_name, target_ref))
-    except Exception as e:
-        clean_up()
-        fail("Exception while pushing: %s" % e)
-
-    merge_hash = run_cmd("git rev-parse %s" % target_branch_name)[:8]
-    clean_up()
-    print(("Pull request #%s merged!" % pr_num))
-    print(("Merge hash: %s" % merge_hash))
-    return merge_hash
-
+    merge_message += [close_line]
+    merged_string = '\n'.join(merge_message)
+
+    # Get the latest commit SHA.
+    latest_commit_sha = json_pr["head"]["sha"]
+    json_status = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/commits/{latest_commit_sha}/check-runs")
+    # Check if all checks have passed on GitHub.
+    all_checks_passed = all(status["conclusion"] == "success" for status in json_status["check_runs"])
+    if all_checks_passed:
+        print("All checks have passed on the github.")
+    else:
+        any_in_progress = any(run["status"] == "in_progress" for run in json_status["check_runs"])
+        if any_in_progress:
+            continue_maybe("Warning: There are pending checks. Would you like to continue the merge?")
+        else:
+            continue_maybe("Warning: Not all checks have passed on GitHub. Would you like to continue the merge?")
+
+    headers = {
+        "Authorization": f"token {GITHUB_OAUTH_KEY}",
+        "Accept": "application/vnd.github.v3+json"
+    }
+    data = {
+        "commit_title": title,
+        "commit_message": merged_string,
+        "merge_method": "squash"
+    }
+
+    response = requests.put(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/merge", headers=headers, json=data)
+
+    if response.status_code == 200:
+        merge_response_json = response.json()
+        merge_commit_sha = merge_response_json.get("sha")
+        print(f"Pull request #{pr_num} merged. Sha: #{merge_commit_sha}")
+        return merge_commit_sha
+    else:
+        print(f"Failed to merge pull request #{pr_num}. Status code: {response.status_code}")
+        print(response.text)
+        exit()
 
 def cherry_pick(pr_num, merge_hash, default_branch):
     pick_ref = input("Enter a branch name [%s]: " % default_branch)
@@ -221,8 +198,8 @@ def cherry_pick(pr_num, merge_hash, default_branch):
 
     pick_branch_name = "%s_PICK_PR_%s_%s" % (TEMP_BRANCH_PREFIX, pr_num, pick_ref.upper())
 
-    run_cmd("git fetch %s %s:%s" % (PUSH_REMOTE_NAME, pick_ref, pick_branch_name))
-    run_cmd("git checkout %s" % pick_branch_name)
+    run_cmd("git fetch %s" % PUSH_REMOTE_NAME)
+    run_cmd("git checkout -b %s %s/%s" % (pick_branch_name, PUSH_REMOTE_NAME, pick_ref))
 
     try:
         run_cmd("git cherry-pick -sx %s" % merge_hash)
@@ -321,7 +298,7 @@ def get_version_json(version_str):
 
 
 def resolve_jira_issues(title, merge_branches, comment):
-    jira_ids = re.findall("%s-[0-9]{4,5}" % CAPITALIZED_PROJECT_NAME, title)
+    jira_ids = re.findall("%s-[0-9]+" % CAPITALIZED_PROJECT_NAME, title)
 
     if len(jira_ids) == 0:
         resolve_jira_issue(merge_branches, comment)
@@ -446,7 +423,35 @@ def main():
 
     pr_num = input("Which pull request would you like to merge? (e.g. 34): ")
     pr = get_json("%s/pulls/%s" % (GITHUB_API_BASE, pr_num))
-    pr_events = get_json("%s/issues/%s/events" % (GITHUB_API_BASE, pr_num))
+
+    # Check if the pull request has already been closed or merged.
+    pull_request_state = pr.get("state", "")
+    if pull_request_state == "closed":
+        merge_hash = pr.get("merge_commit_sha", "")
+        merged = pr.get("merged")
+        # Verify if the pull request has been merged by the GitHub API.
+        if merged is True:
+            print(f"Pull request #{pr['number']} has already been merged, assuming you want to backport")
+            cherry_pick(pr_num, merge_hash, latest_branch)
+            sys.exit(0)
+        # Some merged pull requests may not appear as merged in the GitHub API,
+        # for example, those closed by an older version of this script.
+        else:
+            pr_events = get_json("%s/issues/%s/events" % (GITHUB_API_BASE, pr_num))
+            for event in pr_events:
+                if event.get("event") == "closed":
+                    commit_id = event.get("commit_id")
+                    if commit_id is not None:
+                        print(f"Pull request #{pr['number']} has already been merged, assuming you want to backport")
+                        cherry_pick(pr_num, merge_hash, latest_branch)
+                        sys.exit(0)
+                    else:
+                        print(f"Pull request #{pr['number']} has already been closed, but not merged, exiting.")
+                        exit()
+
+    if not bool(pr["mergeable"]):
+        print(f"Pull request %s is not mergeable in its current form.\n" % pr_num)
+        exit()
 
     url = pr["url"]
 
@@ -469,36 +474,11 @@ def main():
             print("Using original title:")
         print(commit_title)
 
-    body = pr["body"]
     target_ref = pr["base"]["ref"]
     user_login = pr["user"]["login"]
     base_ref = pr["head"]["ref"]
     pr_repo_desc = "%s/%s" % (user_login, base_ref)
 
-    # Merged pull requests don't appear as merged in the GitHub API;
-    # Instead, they're closed by asfgit.
-    merge_commits = \
-        [e for e in pr_events if e["actor"]["login"] == "asfgit" and e["event"] == "closed"]
-
-    if merge_commits:
-        merge_hash = merge_commits[0]["commit_id"]
-        message = get_json("%s/commits/%s" % (GITHUB_API_BASE, merge_hash))["commit"]["message"]
-
-        print("Pull request %s has already been merged, assuming you want to backport" % pr_num)
-        commit_is_downloaded = run_cmd(['git', 'rev-parse', '--quiet', '--verify',
-                                    "%s^{commit}" % merge_hash]).strip() != ""
-        if not commit_is_downloaded:
-            fail("Couldn't find any merge commit for #%s, you may need to update HEAD." % pr_num)
-
-        print("Found commit %s:\n%s" % (merge_hash, message))
-        cherry_pick(pr_num, merge_hash, latest_branch)
-        sys.exit(0)
-
-    if not bool(pr["mergeable"]):
-        msg = "Pull request %s is not mergeable in its current form.\n" % pr_num + \
-            "Continue? (experts only!)"
-        continue_maybe(msg)
-
     print(("\n=== Pull Request #%s ===" % pr_num))
     print(("PR title\t%s\nCommit title\t%s\nSource\t\t%s\nTarget\t\t%s\nURL\t\t%s" % (
         pr_title, commit_title, pr_repo_desc, target_ref, url)))
@@ -506,7 +486,7 @@ def main():
 
     merged_refs = [target_ref]
 
-    merge_hash = merge_pr(pr_num, target_ref, commit_title, body, pr_repo_desc)
+    merge_hash = merge_pr(pr_num, commit_title, pr_repo_desc)
 
     pick_prompt = "Would you like to pick %s into another branch?" % merge_hash
     while input("\n%s (y/n): " % pick_prompt).lower().strip() == "y":

From 2445fe6fa87a2971cb05fe8da82926c17d82051f Mon Sep 17 00:00:00 2001
From: szucsvillo <81696283+szucsvillo@users.noreply.github.com>
Date: Mon, 4 Dec 2023 11:13:36 +0100
Subject: [PATCH 416/591] Zookeeper 4756: [Addendum] Refactor commit message
 handling in merge_pr function (#2095)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I7c738b31b8f5991bc5f93118285c561c2a4719af

Co-authored-by: Villő Szűcs <szucsvillo@cloudera.com>
---
 zk-merge-pr.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/zk-merge-pr.py b/zk-merge-pr.py
index debc36e318e..5358cbd97c8 100755
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -126,13 +126,19 @@ def get_current_branch():
 # merge the requested PR and return the merge hash
 def merge_pr(pr_num, title, pr_repo_desc):
 
-    # Retrieve the commits separately.
-    json_commits = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/commits")
     merge_message = []
-    if json_commits and isinstance(json_commits, list):
-        for commit in json_commits:
-            commit_message = commit['commit']['message']
-            merge_message += [commit_message]
+    result = input("Would you like to squash the commit messages? (y/n): ")
+    if result.lower().strip() == "y":
+        # Retrieve the commits separately.
+        json_commits = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/commits")
+        if json_commits and isinstance(json_commits, list):
+            for commit in json_commits:
+                commit_message = commit['commit']['message']
+                # Remove empty lines and lines containing "Change-Id:"
+                filtered_lines = [line for line in commit_message.split('\n') if 'Change-Id:' not in line and line.strip()]
+                modified_commit_message = '\n'.join(filtered_lines)
+                if modified_commit_message.strip() != title.strip():
+                    merge_message += [modified_commit_message]
 
     # Check for disapproval reviews.
     json_reviewers = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/reviews")

From ceebda9493bd2e406973e1f4a7f77f9e0121ba16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Mon, 4 Dec 2023 13:30:16 +0100
Subject: [PATCH 417/591] ZOOKEEPER-2590: exists() should check read ACL
 permission

ZOOKEEPER-2590:exists() should check read ACL permission
ZOOKEEPER-2590. Skip ACL check if znode is missing
Reviewers: eolivelli
Author: anmolnar
Closes #2093 from anmolnar/ZOOKEEPER-2590
---
 .../server/FinalRequestProcessor.java         | 11 ++-
 .../org/apache/zookeeper/test/ACLTest.java    | 93 +++++++++++++++++++
 2 files changed, 103 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 1edde5d572c..d3e20eca205 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -363,12 +363,21 @@ public void processRequest(Request request) {
             }
             case OpCode.exists: {
                 lastOp = "EXIS";
-                // TODO we need to figure out the security requirement for this!
                 ExistsRequest existsRequest = request.readRequestRecord(ExistsRequest::new);
                 path = existsRequest.getPath();
                 if (path.indexOf('\0') != -1) {
                     throw new KeeperException.BadArgumentsException();
                 }
+                DataNode n = zks.getZKDatabase().getNode(path);
+                if (n != null) {
+                    zks.checkACL(
+                        request.cnxn,
+                        zks.getZKDatabase().aclForNode(n),
+                        ZooDefs.Perms.READ,
+                        request.authInfo,
+                        path,
+                        null);
+                }
                 Stat stat = zks.getZKDatabase().statNode(path, existsRequest.getWatch() ? cnxn : null);
                 rsp = new ExistsResponse(stat);
                 requestPathMetricsCollector.registerRequest(request.type, path);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
index 2f0d408fccd..965d99c4ca7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
@@ -19,7 +19,10 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
@@ -27,16 +30,19 @@
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.InvalidACLException;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.SyncRequestProcessor;
@@ -302,4 +308,91 @@ public void testNullValueACL() throws Exception {
         }
     }
 
+    @Test
+    public void testExistACLCheck() throws Exception {
+        File tmpDir = ClientBase.createTmpDir();
+        ClientBase.setupTestEnv();
+        ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
+        final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
+        ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
+        f.startup(zks);
+        String path = "/testExistACLCheck";
+        String data = "/testExistACLCheck-data";
+        try {
+            LOG.info("starting up the zookeeper server .. waiting");
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
+            ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
+            try {
+                Stat stat = zk.exists(path, false);
+                assertNull(stat);
+                zk.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                stat = zk.exists(path, false);
+                assertNotNull(stat);
+                assertEquals(data.length(), stat.getDataLength());
+
+                zk.delete(path, -1);
+                ArrayList<ACL> acls = new ArrayList<>();
+                acls.add(new ACL(ZooDefs.Perms.WRITE, Ids.ANYONE_ID_UNSAFE));
+                zk.create(path, data.getBytes(), acls, CreateMode.PERSISTENT);
+                try {
+                    stat = zk.exists(path, false);
+                    fail("exists should throw NoAuthException when don't have read permission");
+                } catch (KeeperException.NoAuthException e) {
+                    //expected
+                }
+
+                zk.delete(path, -1);
+                acls = new ArrayList<>();
+                acls.add(new ACL(ZooDefs.Perms.READ, Ids.ANYONE_ID_UNSAFE));
+                zk.create(path, data.getBytes(), acls, CreateMode.PERSISTENT);
+                stat = zk.exists(path, false);
+                assertNotNull(stat);
+                assertEquals(data.length(), stat.getDataLength());
+            } finally {
+                zk.close();
+            }
+        } finally {
+            f.shutdown();
+            zks.shutdown();
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+        }
+    }
+
+    @Test
+    public void testExistACLCheckAtRootPath() throws Exception {
+        File tmpDir = ClientBase.createTmpDir();
+        ClientBase.setupTestEnv();
+        ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
+        final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
+        ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
+        f.startup(zks);
+        try {
+            LOG.info("starting up the zookeeper server .. waiting");
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
+            ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
+            try {
+                String data = "/testExistACLCheckAtRootPath-data";
+                zk.create("/a", data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                ArrayList<ACL> acls = new ArrayList<>();
+                acls.add(new ACL(0, Ids.ANYONE_ID_UNSAFE));
+                zk.setACL("/", acls, -1);
+
+                Stat stat = zk.exists("/a", false);
+                assertNotNull(stat);
+                assertEquals(data.length(), stat.getDataLength());
+                try {
+                    stat = zk.exists("/", false);
+                    fail("exists should throw NoAuthException when removing root path's ACL permission");
+                } catch (KeeperException.NoAuthException e) {
+                    //expected
+                }
+            } finally {
+                zk.close();
+            }
+        } finally {
+            f.shutdown();
+            zks.shutdown();
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+        }
+    }
 }

From 9e40464d98319b4553d93b12c6d7db4d240bbce9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Thu, 21 Dec 2023 15:08:53 +0100
Subject: [PATCH 418/591] ZOOKEEPER-2590: [ADDENDUM] exists() should check read
 ACL permission - doc update

ZOOKEEPER-2590. Add docs to mention the new behavior
Author: anmolnar
Closes #2096 from anmolnar/ZOOKEEPER-2590_doc
---
 .../src/main/resources/markdown/zookeeperProgrammers.md       | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index ddd722b9000..79aa0123a61 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -829,6 +829,10 @@ in order to retrieve ACLs of a znode user has to have _READ_ or _ADMIN_
  permission, but without _ADMIN_ permission, digest hash values will be 
 masked out.
 
+As of versions **3.9.2 / 3.8.4 / 3.7.3** the exists() call will now verify ACLs 
+on nodes that exist and the client must have READ permission otherwise
+'Insufficient permission' error will be raised.
+
 <a name="sc_BuiltinACLSchemes"></a>
 
 #### Builtin ACL Schemes

From 315abde35eb827652f91aed06a4de3dacf9a0f07 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Thu, 25 Jan 2024 22:22:32 -0800
Subject: [PATCH 419/591] ZOOKEEPER-4785: Txn loss due to race condition in
 Learner.syncWithLeader() during DIFF sync (#2111)

Author: Li Wang <liwang@apple.com>

Co-authored-by: liwang <liwang@apple.com>
---
 .../server/quorum/FastLeaderElection.java     |  15 +-
 .../quorum/FollowerZooKeeperServer.java       |  34 +-
 .../zookeeper/server/quorum/Learner.java      |  31 +-
 .../zookeeper/server/quorum/DIFFSyncTest.java | 316 ++++++++++++++++++
 .../server/quorum/QuorumPeerTestBase.java     |  12 +
 5 files changed, 394 insertions(+), 14 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index f4a5f9882c7..83555a61644 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -702,14 +702,14 @@ private void sendNotifications() {
                 qv.toString().getBytes(UTF_8));
 
             LOG.debug(
-                "Sending Notification: {} (n.leader), 0x{} (n.zxid), 0x{} (n.round), {} (recipient),"
-                    + " {} (myid), 0x{} (n.peerEpoch) ",
+                "Sending Notification: {} (n.leader), 0x{} (n.peerEpoch), 0x{} (n.zxid), 0x{} (n.round), {} (recipient),"
+                    + " {} (myid) ",
                 proposedLeader,
                 Long.toHexString(proposedZxid),
+                Long.toHexString(proposedEpoch),
                 Long.toHexString(logicalclock.get()),
                 sid,
-                self.getMyId(),
-                Long.toHexString(proposedEpoch));
+                self.getMyId());
 
             sendqueue.offer(notmsg);
         }
@@ -722,12 +722,13 @@ private void sendNotifications() {
      */
     protected boolean totalOrderPredicate(long newId, long newZxid, long newEpoch, long curId, long curZxid, long curEpoch) {
         LOG.debug(
-            "id: {}, proposed id: {}, zxid: 0x{}, proposed zxid: 0x{}",
+            "id: {}, proposed id: {}, zxid: 0x{}, proposed zxid: 0x{}, epoch: 0x{}, proposed epoch: 0x{}",
             newId,
             curId,
             Long.toHexString(newZxid),
-            Long.toHexString(curZxid));
-
+            Long.toHexString(curZxid),
+            Long.toHexString(newEpoch),
+            Long.toHexString(curEpoch));
         if (self.getQuorumVerifier().getWeight(newId) == 0) {
             return false;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
index 82e56c390d8..5af114dccd1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
@@ -80,14 +80,23 @@ protected void setupRequestProcessors() {
     LinkedBlockingQueue<Request> pendingTxns = new LinkedBlockingQueue<>();
 
     public void logRequest(TxnHeader hdr, Record txn, TxnDigest digest) {
-        Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
-        request.setTxnDigest(digest);
-        if ((request.zxid & 0xffffffffL) != 0) {
-            pendingTxns.add(request);
-        }
+        final Request request = buildRequestToProcess(hdr, txn, digest);
         syncProcessor.processRequest(request);
     }
 
+    /**
+     * Build a request for the txn and append it to the transaction log
+     * @param hdr the txn header
+     * @param txn the txn
+     * @param digest the digest of txn
+     * @return a request moving through a chain of RequestProcessors
+     */
+    public Request appendRequest(final TxnHeader hdr, final Record txn, final TxnDigest digest) throws IOException {
+        final Request request = buildRequestToProcess(hdr, txn, digest);
+        getZKDatabase().append(request);
+        return request;
+    }
+
     /**
      * When a COMMIT message is received, eventually this method is called,
      * which matches up the zxid from the COMMIT with (hopefully) the head of
@@ -181,4 +190,19 @@ protected void unregisterMetrics() {
 
     }
 
+    /**
+     * Build a request for the txn
+     * @param hdr the txn header
+     * @param txn the txn
+     * @param digest the digest of txn
+     * @return a request moving through a chain of RequestProcessors
+     */
+    private Request buildRequestToProcess(final TxnHeader hdr, final Record txn, final TxnDigest digest) {
+        final Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
+        request.setTxnDigest(digest);
+        if ((request.zxid & 0xffffffffL) != 0) {
+            pendingTxns.add(request);
+        }
+        return request;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index d534b8f45e9..e3bd13d1165 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -556,6 +556,8 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         readPacket(qp);
         Deque<Long> packetsCommitted = new ArrayDeque<>();
         Deque<PacketInFlight> packetsNotCommitted = new ArrayDeque<>();
+        Deque<Request> requestsToAck = new ArrayDeque<>();
+
         synchronized (zk) {
             if (qp.getType() == Leader.DIFF) {
                 LOG.info("Getting a diff from the leader 0x{}", Long.toHexString(qp.getZxid()));
@@ -745,7 +747,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         zk.takeSnapshot(syncSnapshot);
                     }
 
-                    self.setCurrentEpoch(newEpoch);
+
                     writeToTxnLog = true;
                     //Anything after this needs to go to the transaction log, not applied directly in memory
                     isPreZAB1_0 = false;
@@ -755,14 +757,27 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     self.setSyncMode(QuorumPeer.SyncMode.NONE);
                     zk.startupWithoutServing();
                     if (zk instanceof FollowerZooKeeperServer) {
+                        long startTime = Time.currentElapsedTime();
                         FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
                         for (PacketInFlight p : packetsNotCommitted) {
-                            fzk.logRequest(p.hdr, p.rec, p.digest);
+                            final Request request = fzk.appendRequest(p.hdr, p.rec, p.digest);
+                            requestsToAck.add(request);
                         }
+
+                        // persist the txns to disk
+                        fzk.getZKDatabase().commit();
+                        LOG.info("{} txns have been persisted and it took {}ms",
+                        packetsNotCommitted.size(), Time.currentElapsedTime() - startTime);
                         packetsNotCommitted.clear();
                     }
 
+                    // set the current epoch after all the tnxs are persisted
+                    self.setCurrentEpoch(newEpoch);
+                    LOG.info("Set the current epoch to {}", newEpoch);
+
+                    // send NEWLEADER ack after all the tnxs are persisted
                     writePacket(new QuorumPacket(Leader.ACK, newLeaderZxid, null, null), true);
+                    LOG.info("Sent NEWLEADER ack to leader with zxid {}", Long.toHexString(newLeaderZxid));
                     break;
                 }
             }
@@ -781,13 +796,25 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
 
         // We need to log the stuff that came in between the snapshot and the uptodate
         if (zk instanceof FollowerZooKeeperServer) {
+            // reply ACK of PROPOSAL after ACK of NEWLEADER to avoid leader shutdown due to timeout
+            // on waiting for a quorum of followers
+            for (final Request request : requestsToAck) {
+                final QuorumPacket ackPacket = new QuorumPacket(Leader.ACK, request.getHdr().getZxid(), null, null);
+                writePacket(ackPacket, false);
+            }
+            writePacket(null, true);
+            requestsToAck.clear();
+
             FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
             for (PacketInFlight p : packetsNotCommitted) {
                 fzk.logRequest(p.hdr, p.rec, p.digest);
             }
+            LOG.info("{} txns have been logged asynchronously", packetsNotCommitted.size());
+
             for (Long zxid : packetsCommitted) {
                 fzk.commit(zxid);
             }
+            LOG.info("{} txns have been committed", packetsCommitted.size());
         } else if (zk instanceof ObserverZooKeeperServer) {
             // Similar to follower, we need to log requests between the snapshot
             // and UPTODATE
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java
new file mode 100644
index 00000000000..a9be09f3973
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java
@@ -0,0 +1,316 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import javax.security.sasl.SaslException;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.FinalRequestProcessor;
+import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.SyncRequestProcessor;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.ZooKeeperServerListener;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+
+public class DIFFSyncTest extends QuorumPeerTestBase {
+    private static final int SERVER_COUNT = 3;
+    private static final String PATH_PREFIX = "/test_";
+
+    private int[] clientPorts;
+    private MainThread[] mt;
+    private ZooKeeper[] zkClients;
+
+    @BeforeEach
+    public void start() throws Exception {
+        clientPorts = new int[SERVER_COUNT];
+        mt = startQuorum(clientPorts);
+        zkClients = new ZooKeeper[SERVER_COUNT];
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception{
+        for (final ZooKeeper zk : zkClients) {
+            try {
+                if (zk != null) {
+                    zk.close();
+                }
+            } catch (final InterruptedException e) {
+                LOG.warn("ZooKeeper interrupted while shutting it down", e);
+            }
+        }
+
+        for (final MainThread mainThread : mt) {
+            try {
+                mainThread.shutdown();
+            } catch (final InterruptedException e) {
+                LOG.warn("Quorum Peer interrupted while shutting it down", e);
+            }
+        }
+    }
+
+    @Test
+    @Timeout(value = 120)
+    public void testTxnLoss_FailToPersistAndCommitTxns() throws Exception {
+        final List<String> paths = new ArrayList<>();
+        assertEquals(2, mt[2].getQuorumPeer().getLeaderId());
+
+        // create a ZK client to the leader (currentEpoch=1, lastLoggedZxid=<1, 1>)
+        createZKClient(2);
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 2>)
+        paths.add(createNode(zkClients[2], PATH_PREFIX + "0"));
+
+        // shut down S0
+        mt[0].shutdown();
+        LOG.info("S0 shutdown.");
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 3>), so S0 is 1 txn behind
+        paths.add(createNode(zkClients[2], PATH_PREFIX + "1"));
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // shut down S1
+        mt[1].shutdown();
+        LOG.info("S1 shutdown.");
+
+        // restart S0 and trigger a new leader election (currentEpoch=2)
+        // S0 starts with MockSyncRequestProcessor and MockCommitProcessor to simulate it writes the
+        // currentEpoch and sends NEWLEADER ACK but fails to persist and commit txns afterwards
+        // in DIFF sync
+        mt[0].start(new MockTestQPMain());
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT),
+                "waiting for server 0 being up");
+        LOG.info("S0 restarted.");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // validate S2 is still the leader
+        assertEquals(2, mt[2].getQuorumPeer().getLeaderId());
+
+        // shut down the leader (i.e. S2). This causes S0 disconnects from leader, performs partial
+        // shutdown, fast forwards its database to the latest persisted tnx (i.e. <1, 3>) and change
+        // its state to LOOKING
+        mt[2].shutdown();
+        LOG.info("S2 shutdown.");
+
+        // start S1 and trigger a leader election (currentEpoch=3)
+        mt[1].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[1], CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        LOG.info("S1 restarted.");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // validate S0 is the new leader because of it has higher epoch
+        assertEquals(0, mt[0].getQuorumPeer().getLeaderId());
+
+        // connect to the new leader (i.e. S0) (currentEpoch=3, lastLoggedZxid=<3, 1>
+        createZKClient(0);
+
+        // create a znode (currentEpoch=3, lastLoggedZxid=<3, 2>)
+        paths.add(createNode(zkClients[0], PATH_PREFIX + "3"));
+
+        // start S2 which is the old leader
+        mt[2].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT),
+                "waiting for server " + 2 + " being up");
+        LOG.info("S2 restarted.");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // validate all the znodes exist from all the clients
+        validateDataFromAllClients(paths);
+    }
+
+    @Test
+    @Timeout(value = 120)
+    public void testLeaderShutdown_AckProposalBeforeAckNewLeader() throws Exception {
+        assertEquals(2, mt[2].getQuorumPeer().getLeaderId());
+
+        // create a ZK client to the leader (currentEpoch=1, lastLoggedZxid=<1, 1>)
+        createZKClient(2);
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 2>)
+        createNode(zkClients[2], PATH_PREFIX + "0");
+
+        // shut down S0
+        mt[0].shutdown();
+        LOG.info("S0 shutdown.");
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 3>), so S0 is 1 txn behind
+        createNode(zkClients[2], PATH_PREFIX + "1");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // shut down S1
+        mt[1].shutdown();
+        LOG.info("S1 shutdown.");
+
+        // restart S0 and trigger a new leader election and DIFF sync (currentEpoch=2)
+        mt[0].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT),
+                "waiting for server 0 being up");
+        LOG.info("S0 restarted.");
+
+        // create a znode (currentEpoch=2, lastLoggedZxid=<2, 1>)
+        createNode(zkClients[2], PATH_PREFIX + "2");
+
+        // validate quorum is up without additional round of leader election
+        for (int  i = 0; i < SERVER_COUNT; i++) {
+            if (i != 1) {
+                final QuorumPeer qp = mt[i].getQuorumPeer();
+                assertNotNull(qp);
+                assertEquals(2, qp.getCurrentEpoch());
+                assertEquals(2, qp.getAcceptedEpoch());
+                assertEquals("200000001", Long.toHexString(qp.getLastLoggedZxid()));
+            }
+        }
+    }
+
+    private MainThread[] startQuorum(final int[] clientPorts) throws IOException {
+        final StringBuilder sb = new StringBuilder();
+        String server;
+
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            clientPorts[i] = PortAssignment.unique();
+            server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
+                    + ":participant;127.0.0.1:" + clientPorts[i];
+            sb.append(server);
+            sb.append("\n");
+        }
+
+        final MainThread[] mt = new MainThread[SERVER_COUNT];
+
+        // start all the servers
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            mt[i] = new MainThread(i, clientPorts[i], sb.toString(), false);
+            mt[i].start();
+        }
+
+        // ensure all servers started
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            assertTrue(
+                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
+        }
+        return mt;
+    }
+
+    private void createZKClient(final int idx) throws Exception {
+        zkClients[idx] = null;
+        final ClientBase.CountdownWatcher watch = new ClientBase.CountdownWatcher();
+        zkClients[idx] = new ZooKeeper("127.0.0.1:" + clientPorts[idx], ClientBase.CONNECTION_TIMEOUT, watch);
+        watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+    }
+
+    private String createNode(final ZooKeeper zk, final String path) throws Exception {
+        final String fullPath = zk.create(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        assertNotNull(zk.exists(path, false));
+        return fullPath;
+    }
+
+    private static class MockTestQPMain extends TestQPMain {
+        @Override
+        protected QuorumPeer getQuorumPeer() throws SaslException {
+            return new TestQuorumPeer();
+        }
+    }
+
+    private static class TestQuorumPeer extends QuorumPeer {
+        public TestQuorumPeer() throws SaslException {
+        }
+
+        @Override
+        protected Follower makeFollower(FileTxnSnapLog logFactory) throws IOException {
+            final FollowerZooKeeperServer followerZookeeperServer = new FollowerZooKeeperServer(logFactory, this, this.getZkDb()) {
+                @Override
+                protected void setupRequestProcessors() {
+                    RequestProcessor finalProcessor = new FinalRequestProcessor(this);
+                    commitProcessor = new MockCommitProcessor(finalProcessor, Long.toString(getServerId()), true, getZooKeeperServerListener());
+                    commitProcessor.start();
+
+                    firstProcessor = new FollowerRequestProcessor(this, commitProcessor);
+                    ((FollowerRequestProcessor) firstProcessor).start();
+                    syncProcessor = new MockSyncRequestProcessor(this, new SendAckRequestProcessor(getFollower()));
+
+                    syncProcessor.start();
+                }
+            };
+            return new Follower(this, followerZookeeperServer);
+        }
+    }
+
+    private static class MockSyncRequestProcessor extends SyncRequestProcessor {
+        public MockSyncRequestProcessor(final ZooKeeperServer zks, final RequestProcessor nextProcessor) {
+            super(zks, nextProcessor);
+        }
+
+        @Override
+        public void processRequest(final Request request) {
+            LOG.info("Sync request for zxid {} is dropped", Long.toHexString(request.getHdr().getZxid()));
+        }
+    }
+
+    private static class MockCommitProcessor extends CommitProcessor {
+        public MockCommitProcessor(final RequestProcessor nextProcessor, final String id,
+                                   final boolean matchSyncs, final ZooKeeperServerListener listener) {
+
+            super(nextProcessor, id, matchSyncs, listener);
+        }
+
+        @Override
+        public void commit(final Request request) {
+            LOG.info("Commit request for zxid {} is dropped", Long.toHexString(request.getHdr().getZxid()));
+        }
+    }
+
+    private void logEpochsAndLastLoggedTxnForAllServers() throws Exception {
+        for (int  i = 0; i < SERVER_COUNT; i++) {
+            final QuorumPeer qp = mt[i].getQuorumPeer();
+            if (qp != null) {
+                LOG.info(String.format("server id=%d, acceptedEpoch=%d, currentEpoch=%d, lastLoggedTxn=%s",
+                        qp.getMyId(), qp.getAcceptedEpoch(),
+                        qp.getCurrentEpoch(), Long.toHexString(qp.getLastLoggedZxid())));
+            }
+        }
+    }
+
+    private void validateDataFromAllClients(final List<String> paths) throws Exception{
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (zkClients[i] == null) {
+                createZKClient(i);
+            }
+
+            for (final String path : paths) {
+                assertNotNull(zkClients[i].exists(path, false), "znode " + path + " is missing");
+            }
+            assertEquals(3, paths.size());
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index 2a7b692589f..9318909593d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -318,6 +318,18 @@ public synchronized void start() {
             currentThread.start();
         }
 
+        /**
+         * start the QuorumPeer with the passed TestQPMain
+         *
+         * @param testQPMain the TestQPMain to use
+         */
+
+        public synchronized void start(final TestQPMain testQPMain) {
+            main = testQPMain;
+            currentThread = new Thread(this);
+            currentThread.start();
+        }
+
         public TestQPMain getTestQPMain() {
             return new TestQPMain();
         }

From 3913303677935a60f05aa0cfc0787d5809961c3b Mon Sep 17 00:00:00 2001
From: Maximilian Wittich <56642549+Maleware@users.noreply.github.com>
Date: Tue, 30 Jan 2024 19:09:08 +0100
Subject: [PATCH 420/591] =?UTF-8?q?ZOOKEEPER-4791:=20Improve=20logging=20w?=
 =?UTF-8?q?hen=20the=20connection=20to=20a=20remote=20serve=E2=80=A6=20(#2?=
 =?UTF-8?q?114)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/org/apache/zookeeper/server/NettyServerCnxn.java     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 3ed77183434..45d5484096b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -527,8 +527,8 @@ private void receiveMessage(ByteBuf message) {
                         }
                         ZooKeeperServer zks = this.zkServer;
                         if (zks == null || !zks.isRunning()) {
-                            LOG.info("Closing connection to {} because the server is not ready",
-                                    getRemoteSocketAddress());
+                            LOG.info("Closing connection to {} because the server is not ready (server state is: {})",
+                                getRemoteSocketAddress(), zks == null ? "unknown" : zks.getState());
                             close(DisconnectReason.IO_EXCEPTION);
                             return;
                         }

From 5894dc88cce1f4675809fb347cc60d3e0ebf08d4 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Wed, 31 Jan 2024 09:42:24 +0100
Subject: [PATCH 421/591] ZOOKEEPER-4778: Update Netty, Jetty and Logback
 (multiple CVEs) (#2118)

---
 pom.xml                                       |   6 +-
 ...jetty-client-9.4.53.v20231009.LICENSE.txt} |   0
 ...> jetty-http-9.4.53.v20231009.LICENSE.txt} |   0
 ... => jetty-io-9.4.53.v20231009.LICENSE.txt} |   0
 ...tty-security-9.4.53.v20231009.LICENSE.txt} |   0
 ...jetty-server-9.4.53.v20231009.LICENSE.txt} |   0
 ...etty-servlet-9.4.53.v20231009.LICENSE.txt} |   0
 ...> jetty-util-9.4.53.v20231009.LICENSE.txt} |   0
 ...ty-util-ajax-9.4.53.v20231009.LICENSE.txt} |   0
 .../lib/logback-classic-1.2.10.LICENSE.txt    | 414 -----------
 .../lib/logback-classic-1.2.13.LICENSE.txt    | 688 ++++++++++++++++++
 .../lib/logback-core-1.2.10.LICENSE.txt       | 414 -----------
 .../lib/logback-core-1.2.13.LICENSE.txt       | 688 ++++++++++++++++++
 ...=> netty-buffer-4.1.105.Final.LICENSE.txt} |   4 +-
 ... => netty-codec-4.1.105.Final.LICENSE.txt} |   4 +-
 ...=> netty-common-4.1.105.Final.LICENSE.txt} |   4 +-
 ...> netty-handler-4.1.105.Final.LICENSE.txt} |   4 +-
 .../netty-handler-4.1.94.Final.LICENSE.txt    | 202 -----
 .../netty-resolver-4.1.105.Final.LICENSE.txt  | 202 +++++
 .../netty-resolver-4.1.94.Final.LICENSE.txt   | 202 -----
 .../netty-transport-4.1.105.Final.LICENSE.txt | 202 +++++
 .../netty-transport-4.1.94.Final.LICENSE.txt  | 202 -----
 ...rt-classes-epoll-4.1.105.Final.LICENSE.txt | 202 +++++
 ...port-native-epoll-4.1.94.Final.LICENSE.txt | 202 -----
 ...tive-unix-common-4.1.105.Final.LICENSE.txt | 202 +++++
 ...ative-unix-common-4.1.94.Final.LICENSE.txt | 202 -----
 26 files changed, 2195 insertions(+), 1849 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-client-9.4.52.v20230823.LICENSE.txt => jetty-client-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.52.v20230823.LICENSE.txt => jetty-http-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.52.v20230823.LICENSE.txt => jetty-io-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.52.v20230823.LICENSE.txt => jetty-security-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.52.v20230823.LICENSE.txt => jetty-server-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.52.v20230823.LICENSE.txt => jetty-servlet-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.52.v20230823.LICENSE.txt => jetty-util-9.4.53.v20231009.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.52.v20230823.LICENSE.txt => jetty-util-ajax-9.4.53.v20231009.LICENSE.txt} (100%)
 delete mode 100644 zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/logback-classic-1.2.13.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/logback-core-1.2.13.LICENSE.txt
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.94.Final.LICENSE.txt => netty-buffer-4.1.105.Final.LICENSE.txt} (99%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.94.Final.LICENSE.txt => netty-codec-4.1.105.Final.LICENSE.txt} (99%)
 rename zookeeper-server/src/main/resources/lib/{netty-bom-4.1.94.Final.LICENSE.txt => netty-common-4.1.105.Final.LICENSE.txt} (99%)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.94.Final.LICENSE.txt => netty-handler-4.1.105.Final.LICENSE.txt} (99%)
 delete mode 100644 zookeeper-server/src/main/resources/lib/netty-handler-4.1.94.Final.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/netty-resolver-4.1.105.Final.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/netty-resolver-4.1.94.Final.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/netty-transport-4.1.105.Final.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/netty-transport-4.1.94.Final.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.94.Final.LICENSE.txt
 create mode 100644 zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt
 delete mode 100644 zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt

diff --git a/pom.xml b/pom.xml
index 6158b7f4ece..a9fb31db5b6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -551,7 +551,7 @@
 
     <!-- dependency versions -->
     <slf4j.version>1.7.30</slf4j.version>
-    <logback-version>1.2.10</logback-version>
+    <logback-version>1.2.13</logback-version>
     <audience-annotations.version>0.12.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
@@ -559,8 +559,8 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.94.Final</netty.version>
-    <jetty.version>9.4.52.v20230823</jetty.version>
+    <netty.version>4.1.105.Final</netty.version>
+    <jetty.version>9.4.53.v20231009</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-client-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-client-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.52.v20230823.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.53.v20231009.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.52.v20230823.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.53.v20231009.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt
deleted file mode 100644
index 46f4f252464..00000000000
--- a/zookeeper-server/src/main/resources/lib/logback-classic-1.2.10.LICENSE.txt
+++ /dev/null
@@ -1,414 +0,0 @@
-This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 2.0 which is available at
-http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
-2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
-
-
-
-Eclipse Public License - v 1.0
-
-THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
-LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
-CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
-
-1. DEFINITIONS
-
-"Contribution" means:
-
-a) in the case of the initial Contributor, the initial code and documentation
-   distributed under this Agreement, and
-b) in the case of each subsequent Contributor:
-    i) changes to the Program, and
-   ii) additions to the Program;
-
-   where such changes and/or additions to the Program originate from and are
-   distributed by that particular Contributor. A Contribution 'originates'
-   from a Contributor if it was added to the Program by such Contributor
-   itself or anyone acting on such Contributor's behalf. Contributions do not
-   include additions to the Program which: (i) are separate modules of
-   software distributed in conjunction with the Program under their own
-   license agreement, and (ii) are not derivative works of the Program.
-
-"Contributor" means any person or entity that distributes the Program.
-
-"Licensed Patents" mean patent claims licensable by a Contributor which are
-necessarily infringed by the use or sale of its Contribution alone or when
-combined with the Program.
-
-"Program" means the Contributions distributed in accordance with this
-Agreement.
-
-"Recipient" means anyone who receives the Program under this Agreement,
-including all Contributors.
-
-2. GRANT OF RIGHTS
-  a) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free copyright license to
-     reproduce, prepare derivative works of, publicly display, publicly
-     perform, distribute and sublicense the Contribution of such Contributor,
-     if any, and such derivative works, in source code and object code form.
-  b) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free patent license under
-     Licensed Patents to make, use, sell, offer to sell, import and otherwise
-     transfer the Contribution of such Contributor, if any, in source code and
-     object code form. This patent license shall apply to the combination of
-     the Contribution and the Program if, at the time the Contribution is
-     added by the Contributor, such addition of the Contribution causes such
-     combination to be covered by the Licensed Patents. The patent license
-     shall not apply to any other combinations which include the Contribution.
-     No hardware per se is licensed hereunder.
-  c) Recipient understands that although each Contributor grants the licenses
-     to its Contributions set forth herein, no assurances are provided by any
-     Contributor that the Program does not infringe the patent or other
-     intellectual property rights of any other entity. Each Contributor
-     disclaims any liability to Recipient for claims brought by any other
-     entity based on infringement of intellectual property rights or
-     otherwise. As a condition to exercising the rights and licenses granted
-     hereunder, each Recipient hereby assumes sole responsibility to secure
-     any other intellectual property rights needed, if any. For example, if a
-     third party patent license is required to allow Recipient to distribute
-     the Program, it is Recipient's responsibility to acquire that license
-     before distributing the Program.
-  d) Each Contributor represents that to its knowledge it has sufficient
-     copyright rights in its Contribution, if any, to grant the copyright
-     license set forth in this Agreement.
-
-3. REQUIREMENTS
-
-A Contributor may choose to distribute the Program in object code form under
-its own license agreement, provided that:
-
-  a) it complies with the terms and conditions of this Agreement; and
-  b) its license agreement:
-      i) effectively disclaims on behalf of all Contributors all warranties
-         and conditions, express and implied, including warranties or
-         conditions of title and non-infringement, and implied warranties or
-         conditions of merchantability and fitness for a particular purpose;
-     ii) effectively excludes on behalf of all Contributors all liability for
-         damages, including direct, indirect, special, incidental and
-         consequential damages, such as lost profits;
-    iii) states that any provisions which differ from this Agreement are
-         offered by that Contributor alone and not by any other party; and
-     iv) states that source code for the Program is available from such
-         Contributor, and informs licensees how to obtain it in a reasonable
-         manner on or through a medium customarily used for software exchange.
-
-When the Program is made available in source code form:
-
-  a) it must be made available under this Agreement; and
-  b) a copy of this Agreement must be included with each copy of the Program.
-     Contributors may not remove or alter any copyright notices contained
-     within the Program.
-
-Each Contributor must identify itself as the originator of its Contribution,
-if
-any, in a manner that reasonably allows subsequent Recipients to identify the
-originator of the Contribution.
-
-4. COMMERCIAL DISTRIBUTION
-
-Commercial distributors of software may accept certain responsibilities with
-respect to end users, business partners and the like. While this license is
-intended to facilitate the commercial use of the Program, the Contributor who
-includes the Program in a commercial product offering should do so in a manner
-which does not create potential liability for other Contributors. Therefore,
-if a Contributor includes the Program in a commercial product offering, such
-Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
-every other Contributor ("Indemnified Contributor") against any losses,
-damages and costs (collectively "Losses") arising from claims, lawsuits and
-other legal actions brought by a third party against the Indemnified
-Contributor to the extent caused by the acts or omissions of such Commercial
-Contributor in connection with its distribution of the Program in a commercial
-product offering. The obligations in this section do not apply to any claims
-or Losses relating to any actual or alleged intellectual property
-infringement. In order to qualify, an Indemnified Contributor must:
-a) promptly notify the Commercial Contributor in writing of such claim, and
-b) allow the Commercial Contributor to control, and cooperate with the
-Commercial Contributor in, the defense and any related settlement
-negotiations. The Indemnified Contributor may participate in any such claim at
-its own expense.
-
-For example, a Contributor might include the Program in a commercial product
-offering, Product X. That Contributor is then a Commercial Contributor. If
-that Commercial Contributor then makes performance claims, or offers
-warranties related to Product X, those performance claims and warranties are
-such Commercial Contributor's responsibility alone. Under this section, the
-Commercial Contributor would have to defend claims against the other
-Contributors related to those performance claims and warranties, and if a
-court requires any other Contributor to pay any damages as a result, the
-Commercial Contributor must pay those damages.
-
-5. NO WARRANTY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
-IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
-Recipient is solely responsible for determining the appropriateness of using
-and distributing the Program and assumes all risks associated with its
-exercise of rights under this Agreement , including but not limited to the
-risks and costs of program errors, compliance with applicable laws, damage to
-or loss of data, programs or equipment, and unavailability or interruption of
-operations.
-
-6. DISCLAIMER OF LIABILITY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
-CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
-LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
-EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
-OF SUCH DAMAGES.
-
-7. GENERAL
-
-If any provision of this Agreement is invalid or unenforceable under
-applicable law, it shall not affect the validity or enforceability of the
-remainder of the terms of this Agreement, and without further action by the
-parties hereto, such provision shall be reformed to the minimum extent
-necessary to make such provision valid and enforceable.
-
-If Recipient institutes patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Program itself
-(excluding combinations of the Program with other software or hardware)
-infringes such Recipient's patent(s), then such Recipient's rights granted
-under Section 2(b) shall terminate as of the date such litigation is filed.
-
-All Recipient's rights under this Agreement shall terminate if it fails to
-comply with any of the material terms or conditions of this Agreement and does
-not cure such failure in a reasonable period of time after becoming aware of
-such noncompliance. If all Recipient's rights under this Agreement terminate,
-Recipient agrees to cease use and distribution of the Program as soon as
-reasonably practicable. However, Recipient's obligations under this Agreement
-and any licenses granted by Recipient relating to the Program shall continue
-and survive.
-
-Everyone is permitted to copy and distribute copies of this Agreement, but in
-order to avoid inconsistency the Agreement is copyrighted and may only be
-modified in the following manner. The Agreement Steward reserves the right to
-publish new versions (including revisions) of this Agreement from time to
-time. No one other than the Agreement Steward has the right to modify this
-Agreement. The Eclipse Foundation is the initial Agreement Steward. The
-Eclipse Foundation may assign the responsibility to serve as the Agreement
-Steward to a suitable separate entity. Each new version of the Agreement will
-be given a distinguishing version number. The Program (including
-Contributions) may always be distributed subject to the version of the
-Agreement under which it was received. In addition, after a new version of the
-Agreement is published, Contributor may elect to distribute the Program
-(including its Contributions) under the new version. Except as expressly
-stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
-licenses to the intellectual property of any Contributor under this Agreement,
-whether expressly, by implication, estoppel or otherwise. All rights in the
-Program not expressly granted under this Agreement are reserved.
-
-This Agreement is governed by the laws of the State of New York and the
-intellectual property laws of the United States of America. No party to this
-Agreement will bring a legal action under this Agreement more than one year
-after the cause of action arose. Each party waives its rights to a jury trial in
-any resulting litigation.
-
-
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/logback-classic-1.2.13.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-classic-1.2.13.LICENSE.txt
new file mode 100644
index 00000000000..7e7bfbfc96e
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/logback-classic-1.2.13.LICENSE.txt
@@ -0,0 +1,688 @@
+Logback LICENSE
+---------------
+
+Logback: the reliable, generic, fast and flexible logging framework.
+Copyright (C) 1999-2015, QOS.ch. All rights reserved.
+
+This program and the accompanying materials are dual-licensed under
+either the terms of the Eclipse Public License v1.0 as published by
+the Eclipse Foundation
+ 
+  or (per the licensee's choosing)
+ 
+under the terms of the GNU Lesser General Public License version 2.1
+as published by the Free Software Foundation.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+   1. DEFINITIONS
+
+   "Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+distributed under this Agreement, and
+
+      b) in the case of each subsequent Contributor:
+
+         i) changes to the Program, and
+
+         ii) additions to the Program;
+
+where such changes and/or additions to the Program originate from and are
+distributed by that particular Contributor. A Contribution 'originates' from
+a Contributor if it was added to the Program by such Contributor itself or
+anyone acting on such Contributor's behalf. Contributions do not include additions
+to the Program which: (i) are separate modules of software distributed in
+conjunction with the Program under their own license agreement, and (ii) are
+not derivative works of the Program.
+
+   "Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement, including
+all Contributors.
+
+   2. GRANT OF RIGHTS
+
+a) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce,
+prepare derivative works of, publicly display, publicly perform, distribute
+and sublicense the Contribution of such Contributor, if any, and such derivative
+works, in source code and object code form.
+
+b) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed
+Patents to make, use, sell, offer to sell, import and otherwise transfer the
+Contribution of such Contributor, if any, in source code and object code form.
+This patent license shall apply to the combination of the Contribution and
+the Program if, at the time the Contribution is added by the Contributor,
+such addition of the Contribution causes such combination to be covered by
+the Licensed Patents. The patent license shall not apply to any other combinations
+which include the Contribution. No hardware per se is licensed hereunder.
+
+c) Recipient understands that although each Contributor grants the licenses
+to its Contributions set forth herein, no assurances are provided by any Contributor
+that the Program does not infringe the patent or other intellectual property
+rights of any other entity. Each Contributor disclaims any liability to Recipient
+for claims brought by any other entity based on infringement of intellectual
+property rights or otherwise. As a condition to exercising the rights and
+licenses granted hereunder, each Recipient hereby assumes sole responsibility
+to secure any other intellectual property rights needed, if any. For example,
+if a third party patent license is required to allow Recipient to distribute
+the Program, it is Recipient's responsibility to acquire that license before
+distributing the Program.
+
+d) Each Contributor represents that to its knowledge it has sufficient copyright
+rights in its Contribution, if any, to grant the copyright license set forth
+in this Agreement.
+
+   3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+      a) it complies with the terms and conditions of this Agreement; and
+
+      b) its license agreement:
+
+i) effectively disclaims on behalf of all Contributors all warranties and
+conditions, express and implied, including warranties or conditions of title
+and non-infringement, and implied warranties or conditions of merchantability
+and fitness for a particular purpose;
+
+ii) effectively excludes on behalf of all Contributors all liability for damages,
+including direct, indirect, special, incidental and consequential damages,
+such as lost profits;
+
+iii) states that any provisions which differ from this Agreement are offered
+by that Contributor alone and not by any other party; and
+
+iv) states that source code for the Program is available from such Contributor,
+and informs licensees how to obtain it in a reasonable manner on or through
+a medium customarily used for software exchange.
+
+   When the Program is made available in source code form:
+
+      a) it must be made available under this Agreement; and
+
+b) a copy of this Agreement must be included with each copy of the Program.
+
+Contributors may not remove or alter any copyright notices contained within
+the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if any, in a manner that reasonably allows subsequent Recipients to identify
+the originator of the Contribution.
+
+   4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor
+who includes the Program in a commercial product offering should do so in
+a manner which does not create potential liability for other Contributors.
+Therefore, if a Contributor includes the Program in a commercial product offering,
+such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses, damages
+and costs (collectively "Losses") arising from claims, lawsuits and other
+legal actions brought by a third party against the Indemnified Contributor
+to the extent caused by the acts or omissions of such Commercial Contributor
+in connection with its distribution of the Program in a commercial product
+offering. The obligations in this section do not apply to any claims or Losses
+relating to any actual or alleged intellectual property infringement. In order
+to qualify, an Indemnified Contributor must: a) promptly notify the Commercial
+Contributor in writing of such claim, and b) allow the Commercial Contributor
+to control, and cooperate with the Commercial Contributor in, the defense
+and any related settlement negotiations. The Indemnified Contributor may participate
+in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers warranties
+related to Product X, those performance claims and warranties are such Commercial
+Contributor's responsibility alone. Under this section, the Commercial Contributor
+would have to defend claims against the other Contributors related to those
+performance claims and warranties, and if a court requires any other Contributor
+to pay any damages as a result, the Commercial Contributor must pay those
+damages.
+
+   5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON
+AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS
+OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+Each Recipient is solely responsible for determining the appropriateness of
+using and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement, including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage
+to or loss of data, programs or equipment, and unavailability or interruption
+of operations.
+
+   6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS
+GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+   7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under applicable
+law, it shall not affect the validity or enforceability of the remainder of
+the terms of this Agreement, and without further action by the parties hereto,
+such provision shall be reformed to the minimum extent necessary to make such
+provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware) infringes
+such Recipient's patent(s), then such Recipient's rights granted under Section
+2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and
+does not cure such failure in a reasonable period of time after becoming aware
+of such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as reasonably
+practicable. However, Recipient's obligations under this Agreement and any
+licenses granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but
+in order to avoid inconsistency the Agreement is copyrighted and may only
+be modified in the following manner. The Agreement Steward reserves the right
+to publish new versions (including revisions) of this Agreement from time
+to time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse
+Foundation may assign the responsibility to serve as the Agreement Steward
+to a suitable separate entity. Each new version of the Agreement will be given
+a distinguishing version number. The Program (including Contributions) may
+always be distributed subject to the version of the Agreement under which
+it was received. In addition, after a new version of the Agreement is published,
+Contributor may elect to distribute the Program (including its Contributions)
+under the new version. Except as expressly stated in Sections 2(a) and 2(b)
+above, Recipient receives no rights or licenses to the intellectual property
+of any Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted under
+this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the intellectual
+property laws of the United States of America. No party to this Agreement
+will bring a legal action under this Agreement more than one year after the
+cause of action arose. Each party waives its rights to a jury trial in any
+resulting litigation.
+
+
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
diff --git a/zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt
deleted file mode 100644
index 46f4f252464..00000000000
--- a/zookeeper-server/src/main/resources/lib/logback-core-1.2.10.LICENSE.txt
+++ /dev/null
@@ -1,414 +0,0 @@
-This program and the accompanying materials are made available under the
-terms of the Eclipse Public License 2.0 which is available at
-http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
-2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
-
-
-
-Eclipse Public License - v 1.0
-
-THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
-LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
-CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
-
-1. DEFINITIONS
-
-"Contribution" means:
-
-a) in the case of the initial Contributor, the initial code and documentation
-   distributed under this Agreement, and
-b) in the case of each subsequent Contributor:
-    i) changes to the Program, and
-   ii) additions to the Program;
-
-   where such changes and/or additions to the Program originate from and are
-   distributed by that particular Contributor. A Contribution 'originates'
-   from a Contributor if it was added to the Program by such Contributor
-   itself or anyone acting on such Contributor's behalf. Contributions do not
-   include additions to the Program which: (i) are separate modules of
-   software distributed in conjunction with the Program under their own
-   license agreement, and (ii) are not derivative works of the Program.
-
-"Contributor" means any person or entity that distributes the Program.
-
-"Licensed Patents" mean patent claims licensable by a Contributor which are
-necessarily infringed by the use or sale of its Contribution alone or when
-combined with the Program.
-
-"Program" means the Contributions distributed in accordance with this
-Agreement.
-
-"Recipient" means anyone who receives the Program under this Agreement,
-including all Contributors.
-
-2. GRANT OF RIGHTS
-  a) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free copyright license to
-     reproduce, prepare derivative works of, publicly display, publicly
-     perform, distribute and sublicense the Contribution of such Contributor,
-     if any, and such derivative works, in source code and object code form.
-  b) Subject to the terms of this Agreement, each Contributor hereby grants
-     Recipient a non-exclusive, worldwide, royalty-free patent license under
-     Licensed Patents to make, use, sell, offer to sell, import and otherwise
-     transfer the Contribution of such Contributor, if any, in source code and
-     object code form. This patent license shall apply to the combination of
-     the Contribution and the Program if, at the time the Contribution is
-     added by the Contributor, such addition of the Contribution causes such
-     combination to be covered by the Licensed Patents. The patent license
-     shall not apply to any other combinations which include the Contribution.
-     No hardware per se is licensed hereunder.
-  c) Recipient understands that although each Contributor grants the licenses
-     to its Contributions set forth herein, no assurances are provided by any
-     Contributor that the Program does not infringe the patent or other
-     intellectual property rights of any other entity. Each Contributor
-     disclaims any liability to Recipient for claims brought by any other
-     entity based on infringement of intellectual property rights or
-     otherwise. As a condition to exercising the rights and licenses granted
-     hereunder, each Recipient hereby assumes sole responsibility to secure
-     any other intellectual property rights needed, if any. For example, if a
-     third party patent license is required to allow Recipient to distribute
-     the Program, it is Recipient's responsibility to acquire that license
-     before distributing the Program.
-  d) Each Contributor represents that to its knowledge it has sufficient
-     copyright rights in its Contribution, if any, to grant the copyright
-     license set forth in this Agreement.
-
-3. REQUIREMENTS
-
-A Contributor may choose to distribute the Program in object code form under
-its own license agreement, provided that:
-
-  a) it complies with the terms and conditions of this Agreement; and
-  b) its license agreement:
-      i) effectively disclaims on behalf of all Contributors all warranties
-         and conditions, express and implied, including warranties or
-         conditions of title and non-infringement, and implied warranties or
-         conditions of merchantability and fitness for a particular purpose;
-     ii) effectively excludes on behalf of all Contributors all liability for
-         damages, including direct, indirect, special, incidental and
-         consequential damages, such as lost profits;
-    iii) states that any provisions which differ from this Agreement are
-         offered by that Contributor alone and not by any other party; and
-     iv) states that source code for the Program is available from such
-         Contributor, and informs licensees how to obtain it in a reasonable
-         manner on or through a medium customarily used for software exchange.
-
-When the Program is made available in source code form:
-
-  a) it must be made available under this Agreement; and
-  b) a copy of this Agreement must be included with each copy of the Program.
-     Contributors may not remove or alter any copyright notices contained
-     within the Program.
-
-Each Contributor must identify itself as the originator of its Contribution,
-if
-any, in a manner that reasonably allows subsequent Recipients to identify the
-originator of the Contribution.
-
-4. COMMERCIAL DISTRIBUTION
-
-Commercial distributors of software may accept certain responsibilities with
-respect to end users, business partners and the like. While this license is
-intended to facilitate the commercial use of the Program, the Contributor who
-includes the Program in a commercial product offering should do so in a manner
-which does not create potential liability for other Contributors. Therefore,
-if a Contributor includes the Program in a commercial product offering, such
-Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
-every other Contributor ("Indemnified Contributor") against any losses,
-damages and costs (collectively "Losses") arising from claims, lawsuits and
-other legal actions brought by a third party against the Indemnified
-Contributor to the extent caused by the acts or omissions of such Commercial
-Contributor in connection with its distribution of the Program in a commercial
-product offering. The obligations in this section do not apply to any claims
-or Losses relating to any actual or alleged intellectual property
-infringement. In order to qualify, an Indemnified Contributor must:
-a) promptly notify the Commercial Contributor in writing of such claim, and
-b) allow the Commercial Contributor to control, and cooperate with the
-Commercial Contributor in, the defense and any related settlement
-negotiations. The Indemnified Contributor may participate in any such claim at
-its own expense.
-
-For example, a Contributor might include the Program in a commercial product
-offering, Product X. That Contributor is then a Commercial Contributor. If
-that Commercial Contributor then makes performance claims, or offers
-warranties related to Product X, those performance claims and warranties are
-such Commercial Contributor's responsibility alone. Under this section, the
-Commercial Contributor would have to defend claims against the other
-Contributors related to those performance claims and warranties, and if a
-court requires any other Contributor to pay any damages as a result, the
-Commercial Contributor must pay those damages.
-
-5. NO WARRANTY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
-IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
-Recipient is solely responsible for determining the appropriateness of using
-and distributing the Program and assumes all risks associated with its
-exercise of rights under this Agreement , including but not limited to the
-risks and costs of program errors, compliance with applicable laws, damage to
-or loss of data, programs or equipment, and unavailability or interruption of
-operations.
-
-6. DISCLAIMER OF LIABILITY
-
-EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
-CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
-LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
-EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
-OF SUCH DAMAGES.
-
-7. GENERAL
-
-If any provision of this Agreement is invalid or unenforceable under
-applicable law, it shall not affect the validity or enforceability of the
-remainder of the terms of this Agreement, and without further action by the
-parties hereto, such provision shall be reformed to the minimum extent
-necessary to make such provision valid and enforceable.
-
-If Recipient institutes patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Program itself
-(excluding combinations of the Program with other software or hardware)
-infringes such Recipient's patent(s), then such Recipient's rights granted
-under Section 2(b) shall terminate as of the date such litigation is filed.
-
-All Recipient's rights under this Agreement shall terminate if it fails to
-comply with any of the material terms or conditions of this Agreement and does
-not cure such failure in a reasonable period of time after becoming aware of
-such noncompliance. If all Recipient's rights under this Agreement terminate,
-Recipient agrees to cease use and distribution of the Program as soon as
-reasonably practicable. However, Recipient's obligations under this Agreement
-and any licenses granted by Recipient relating to the Program shall continue
-and survive.
-
-Everyone is permitted to copy and distribute copies of this Agreement, but in
-order to avoid inconsistency the Agreement is copyrighted and may only be
-modified in the following manner. The Agreement Steward reserves the right to
-publish new versions (including revisions) of this Agreement from time to
-time. No one other than the Agreement Steward has the right to modify this
-Agreement. The Eclipse Foundation is the initial Agreement Steward. The
-Eclipse Foundation may assign the responsibility to serve as the Agreement
-Steward to a suitable separate entity. Each new version of the Agreement will
-be given a distinguishing version number. The Program (including
-Contributions) may always be distributed subject to the version of the
-Agreement under which it was received. In addition, after a new version of the
-Agreement is published, Contributor may elect to distribute the Program
-(including its Contributions) under the new version. Except as expressly
-stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
-licenses to the intellectual property of any Contributor under this Agreement,
-whether expressly, by implication, estoppel or otherwise. All rights in the
-Program not expressly granted under this Agreement are reserved.
-
-This Agreement is governed by the laws of the State of New York and the
-intellectual property laws of the United States of America. No party to this
-Agreement will bring a legal action under this Agreement more than one year
-after the cause of action arose. Each party waives its rights to a jury trial in
-any resulting litigation.
-
-
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/logback-core-1.2.13.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-core-1.2.13.LICENSE.txt
new file mode 100644
index 00000000000..7e7bfbfc96e
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/logback-core-1.2.13.LICENSE.txt
@@ -0,0 +1,688 @@
+Logback LICENSE
+---------------
+
+Logback: the reliable, generic, fast and flexible logging framework.
+Copyright (C) 1999-2015, QOS.ch. All rights reserved.
+
+This program and the accompanying materials are dual-licensed under
+either the terms of the Eclipse Public License v1.0 as published by
+the Eclipse Foundation
+ 
+  or (per the licensee's choosing)
+ 
+under the terms of the GNU Lesser General Public License version 2.1
+as published by the Free Software Foundation.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+   1. DEFINITIONS
+
+   "Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+distributed under this Agreement, and
+
+      b) in the case of each subsequent Contributor:
+
+         i) changes to the Program, and
+
+         ii) additions to the Program;
+
+where such changes and/or additions to the Program originate from and are
+distributed by that particular Contributor. A Contribution 'originates' from
+a Contributor if it was added to the Program by such Contributor itself or
+anyone acting on such Contributor's behalf. Contributions do not include additions
+to the Program which: (i) are separate modules of software distributed in
+conjunction with the Program under their own license agreement, and (ii) are
+not derivative works of the Program.
+
+   "Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement, including
+all Contributors.
+
+   2. GRANT OF RIGHTS
+
+a) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce,
+prepare derivative works of, publicly display, publicly perform, distribute
+and sublicense the Contribution of such Contributor, if any, and such derivative
+works, in source code and object code form.
+
+b) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed
+Patents to make, use, sell, offer to sell, import and otherwise transfer the
+Contribution of such Contributor, if any, in source code and object code form.
+This patent license shall apply to the combination of the Contribution and
+the Program if, at the time the Contribution is added by the Contributor,
+such addition of the Contribution causes such combination to be covered by
+the Licensed Patents. The patent license shall not apply to any other combinations
+which include the Contribution. No hardware per se is licensed hereunder.
+
+c) Recipient understands that although each Contributor grants the licenses
+to its Contributions set forth herein, no assurances are provided by any Contributor
+that the Program does not infringe the patent or other intellectual property
+rights of any other entity. Each Contributor disclaims any liability to Recipient
+for claims brought by any other entity based on infringement of intellectual
+property rights or otherwise. As a condition to exercising the rights and
+licenses granted hereunder, each Recipient hereby assumes sole responsibility
+to secure any other intellectual property rights needed, if any. For example,
+if a third party patent license is required to allow Recipient to distribute
+the Program, it is Recipient's responsibility to acquire that license before
+distributing the Program.
+
+d) Each Contributor represents that to its knowledge it has sufficient copyright
+rights in its Contribution, if any, to grant the copyright license set forth
+in this Agreement.
+
+   3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+      a) it complies with the terms and conditions of this Agreement; and
+
+      b) its license agreement:
+
+i) effectively disclaims on behalf of all Contributors all warranties and
+conditions, express and implied, including warranties or conditions of title
+and non-infringement, and implied warranties or conditions of merchantability
+and fitness for a particular purpose;
+
+ii) effectively excludes on behalf of all Contributors all liability for damages,
+including direct, indirect, special, incidental and consequential damages,
+such as lost profits;
+
+iii) states that any provisions which differ from this Agreement are offered
+by that Contributor alone and not by any other party; and
+
+iv) states that source code for the Program is available from such Contributor,
+and informs licensees how to obtain it in a reasonable manner on or through
+a medium customarily used for software exchange.
+
+   When the Program is made available in source code form:
+
+      a) it must be made available under this Agreement; and
+
+b) a copy of this Agreement must be included with each copy of the Program.
+
+Contributors may not remove or alter any copyright notices contained within
+the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if any, in a manner that reasonably allows subsequent Recipients to identify
+the originator of the Contribution.
+
+   4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor
+who includes the Program in a commercial product offering should do so in
+a manner which does not create potential liability for other Contributors.
+Therefore, if a Contributor includes the Program in a commercial product offering,
+such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses, damages
+and costs (collectively "Losses") arising from claims, lawsuits and other
+legal actions brought by a third party against the Indemnified Contributor
+to the extent caused by the acts or omissions of such Commercial Contributor
+in connection with its distribution of the Program in a commercial product
+offering. The obligations in this section do not apply to any claims or Losses
+relating to any actual or alleged intellectual property infringement. In order
+to qualify, an Indemnified Contributor must: a) promptly notify the Commercial
+Contributor in writing of such claim, and b) allow the Commercial Contributor
+to control, and cooperate with the Commercial Contributor in, the defense
+and any related settlement negotiations. The Indemnified Contributor may participate
+in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers warranties
+related to Product X, those performance claims and warranties are such Commercial
+Contributor's responsibility alone. Under this section, the Commercial Contributor
+would have to defend claims against the other Contributors related to those
+performance claims and warranties, and if a court requires any other Contributor
+to pay any damages as a result, the Commercial Contributor must pay those
+damages.
+
+   5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON
+AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS
+OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+Each Recipient is solely responsible for determining the appropriateness of
+using and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement, including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage
+to or loss of data, programs or equipment, and unavailability or interruption
+of operations.
+
+   6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS
+GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+   7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under applicable
+law, it shall not affect the validity or enforceability of the remainder of
+the terms of this Agreement, and without further action by the parties hereto,
+such provision shall be reformed to the minimum extent necessary to make such
+provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware) infringes
+such Recipient's patent(s), then such Recipient's rights granted under Section
+2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and
+does not cure such failure in a reasonable period of time after becoming aware
+of such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as reasonably
+practicable. However, Recipient's obligations under this Agreement and any
+licenses granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but
+in order to avoid inconsistency the Agreement is copyrighted and may only
+be modified in the following manner. The Agreement Steward reserves the right
+to publish new versions (including revisions) of this Agreement from time
+to time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse
+Foundation may assign the responsibility to serve as the Agreement Steward
+to a suitable separate entity. Each new version of the Agreement will be given
+a distinguishing version number. The Program (including Contributions) may
+always be distributed subject to the version of the Agreement under which
+it was received. In addition, after a new version of the Agreement is published,
+Contributor may elect to distribute the Program (including its Contributions)
+under the new version. Except as expressly stated in Sections 2(a) and 2(b)
+above, Recipient receives no rights or licenses to the intellectual property
+of any Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted under
+this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the intellectual
+property laws of the United States of America. No party to this Agreement
+will bring a legal action under this Agreement more than one year after the
+cause of action arose. Each party waives its rights to a jury trial in any
+resulting litigation.
+
+
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.105.Final.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.94.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.105.Final.LICENSE.txt
index 6279e5206de..2e16f8158c9 100644
--- a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.94.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.105.Final.LICENSE.txt
@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                        https://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -193,7 +193,7 @@
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       https://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.105.Final.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.94.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.105.Final.LICENSE.txt
index 6279e5206de..2e16f8158c9 100644
--- a/zookeeper-server/src/main/resources/lib/netty-common-4.1.94.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.105.Final.LICENSE.txt
@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                        https://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -193,7 +193,7 @@
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       https://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.105.Final.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.105.Final.LICENSE.txt
index 6279e5206de..2e16f8158c9 100644
--- a/zookeeper-server/src/main/resources/lib/netty-bom-4.1.94.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/netty-common-4.1.105.Final.LICENSE.txt
@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                        https://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -193,7 +193,7 @@
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       https://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.105.Final.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.94.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.105.Final.LICENSE.txt
index 6279e5206de..2e16f8158c9 100644
--- a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.94.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.105.Final.LICENSE.txt
@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                        https://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -193,7 +193,7 @@
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       https://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.94.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.94.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.105.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.105.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.94.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.94.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.105.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.105.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.94.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.94.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.94.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.94.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.94.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

From 89a26b0a6b8852b1e6e968e98ca18eb4b1f11560 Mon Sep 17 00:00:00 2001
From: Fabrice TIERCELIN <fabrice.tiercelin@gmail.com>
Date: Mon, 5 Feb 2024 09:38:10 +0100
Subject: [PATCH 422/591] ZOOKEEPER-725: Add unit tests for
 ConfigUtils.getClientConfigStr

Reviewers: maoling
Author: Fabrice-TIERCELIN
Closes #2056 from Fabrice-TIERCELIN/unit-tests
---
 .../server/util/ConfigUtilsTest.java          | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
index e70c45ce40e..937d812fee0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
@@ -23,6 +23,8 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 public class ConfigUtilsTest {
 
@@ -112,6 +114,36 @@ public void testGetPropertyBackwardCompatibleWay() throws ConfigException {
         clearProp(newProp, oldProp);
     }
 
+    /**
+     * Tests the ConfigUtils.getClientConfigStr(String) method with version.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "version=1.2.3\n",
+            "version = 1.2.3\n",
+            "version=1.2.3\nfoo=bar\n",
+            "foo=bar\nversion=1.2.3\n"
+    })
+    public void testGetClientConfigStrWithVersion(String configData) {
+        String result = ConfigUtils.getClientConfigStr(configData);
+        assertEquals("1.2.3 ", result);
+    }
+
+    /**
+     * Tests the ConfigUtils.getClientConfigStr(String) method without version.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "versions=1.2.3\n",
+            "versions = 1.2.3\n",
+            "foo=bar\n",
+            "version=\n"
+    })
+    public void testGetClientConfigStrWithoutVersion(String configData) {
+        String result = ConfigUtils.getClientConfigStr(configData);
+        assertEquals(" ", result);
+    }
+
     private void clearProp(String newProp, String oldProp) {
         System.clearProperty(newProp);
         System.clearProperty(oldProp);

From b5264dabebc32db3e9279a640a48e84742b24344 Mon Sep 17 00:00:00 2001
From: vuittont60 <81072379+vuittont60@users.noreply.github.com>
Date: Mon, 5 Feb 2024 16:58:12 +0800
Subject: [PATCH 423/591] Fix typos in docs & comments

Author: vuittont60
Closes #2107 from vuittont60/master
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c           | 4 ++--
 zookeeper-contrib/zookeeper-contrib-loggraph/README.md        | 2 +-
 .../src/main/resources/markdown/zookeeperUseCases.md          | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 74b04717195..3c64efbb658 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -2873,7 +2873,7 @@ static void finalize_session_establishment(zhandle_t *zh) {
     PROCESS_SESSION_EVENT(zh, zh->state);
 
     if (has_sasl_client(zh)) {
-        /* some packets might have been delayed during SASL negotiaton. */
+        /* some packets might have been delayed during SASL negotiation. */
         adaptor_send_queue(zh, 0);
     }
 }
@@ -3830,7 +3830,7 @@ int zookeeper_close(zhandle_t *zh)
          * completions from calling zookeeper_close before we have
          * completed the adaptor_finish call below. */
 
-    /* Signal any syncronous completions before joining the threads */
+    /* Signal any synchronous completions before joining the threads */
         enter_critical(zh);
         free_completions(zh,1,ZCLOSING);
         leave_critical(zh);
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/README.md b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
index a15ea0fca2a..aa845fc4b3b 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
@@ -44,7 +44,7 @@ To filter by time simply move the slider to the desired start time. The time win
 Content filtering uses a adhoc filtering language, using prefix notation. The language looks somewhat similar to lisp. A statement in the language takes the form (op arg arg ....). A statement resolves to a boolean value. Statements can be nested. 
 
 ### 4.1 - Filter arguments
-An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpretted as hexidecimal. Otherwise it is interpretted as decimal. If the argument begins with a double-quote, (") it is interpretted as a string. Anything else is interpretted as a symbol.
+An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpretted as hexadecimal. Otherwise it is interpretted as decimal. If the argument begins with a double-quote, (") it is interpretted as a string. Anything else is interpretted as a symbol.
 
 ### 4.2 - Filter symbols
 The possible filter symbols are: 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
index 24f991c3a4e..98045444457 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
@@ -37,7 +37,7 @@ limitations under the License.
 
 ### [Eclipse Communication Framework](http://www.eclipse.org/ecf)
   - The Eclipse ECF project provides an implementation of its Abstract Discovery services using Zookeeper. ECF itself
-  is used in many projects providing base functionallity for communication, all based on OSGi [1].
+  is used in many projects providing base functionality for communication, all based on OSGi [1].
 
 ### [Eclipse Gyrex](http://www.eclipse.org/gyrex)
   - The Eclipse Gyrex project provides a platform for building your own Java OSGi based clouds. 
@@ -60,7 +60,7 @@ limitations under the License.
 
 ### [Neo4j](https://neo4j.com/)
   - Neo4j is a Graph Database. It's a disk based, ACID compliant transactional storage engine for big graphs and fast graph traversals,
-    using external indicies like Lucene/Solr for global searches.
+    using external indices like Lucene/Solr for global searches.
   - We use ZooKeeper in the Neo4j High Availability components for write-master election,
     read slave coordination and other cool stuff. ZooKeeper is a great and focused project - we like! [1].
 

From 14343545c44d3b36709ba425d13ec80a627ba519 Mon Sep 17 00:00:00 2001
From: caption <101684156+chncaption@users.noreply.github.com>
Date: Tue, 6 Feb 2024 15:03:40 +0800
Subject: [PATCH 424/591] [ZOOINSPECTOR] fix(sec): upgrade
 com.google.guava:guava to 30.0-jre

Reviewers: maoling
Author: chncaption
Closes #1932 from chncaption/oscs_fix_ccul1g8au51ofid2l2pg
---
 zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index ee209828f26..778d0386977 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -35,7 +35,7 @@
 
   <properties>
     <rat.version>0.6</rat.version>
-    <guava.version>18.0</guava.version>
+    <guava.version>30.0-jre</guava.version>
   </properties>
 
   <build>

From d6c1cb56e2d5b11b4c1dd6ec03515d95fadde452 Mon Sep 17 00:00:00 2001
From: Hinterwaeldlers <mguethle@xunit.de>
Date: Tue, 6 Feb 2024 08:21:44 +0100
Subject: [PATCH 425/591] document the need for local sessions within the
 readonly mode

Reviewers: eolivelli, maoling
Author: Hinterwaeldlers
Closes #1922 from Hinterwaeldlers/readOnlyDocu
---
 .../src/main/resources/markdown/zookeeperAdmin.md           | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 80aebcfa61c..f9cb0341b30 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1859,8 +1859,10 @@ New features that are currently considered experimental.
     (Java system property: **readonlymode.enabled**)
     **New in 3.4.0:**
     Setting this value to true enables Read Only Mode server
-    support (disabled by default). ROM allows clients
-    sessions which requested ROM support to connect to the
+    support (disabled by default).
+    *localSessionsEnabled* has to be activated to serve clients.
+    A downgrade of an existing connections is currently not supported.
+    ROM allows clients sessions which requested ROM support to connect to the
     server even when the server might be partitioned from
     the quorum. In this mode ROM clients can still read
     values from the ZK service, but will be unable to write

From 8a86359b7a814c352c729a63407f604d6241e19f Mon Sep 17 00:00:00 2001
From: nailcui <nailcui@foxmail.com>
Date: Tue, 6 Feb 2024 15:47:20 +0800
Subject: [PATCH 426/591] ZOOKEEPER-4770: zkSnapshotRecursiveSummaryToolkit.sh
 Error: Could not find or load main class

Reviewers: tisonkun, eolivelli, maoling
Author: nailcui
Closes #2091 from nailcui/ZOOKEEPER-4770
---
 bin/zkSnapshotRecursiveSummaryToolkit.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/zkSnapshotRecursiveSummaryToolkit.sh b/bin/zkSnapshotRecursiveSummaryToolkit.sh
index f7659971b1b..888fdc01138 100755
--- a/bin/zkSnapshotRecursiveSummaryToolkit.sh
+++ b/bin/zkSnapshotRecursiveSummaryToolkit.sh
@@ -33,7 +33,7 @@ else
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" "$JVMFLAGS" \
+"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
      org.apache.zookeeper.server.SnapshotRecursiveSummary "$@"
 
 

From 16abb9cfad03f6b420747a002f0e7de420d474d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 6 Feb 2024 11:56:09 +0100
Subject: [PATCH 427/591] ZOOKEEPER-4236 Java Client SendThread create many
 unnecessary Login objects (#2128)

---
 .../java/org/apache/zookeeper/ClientCnxn.java | 18 +++++---
 .../zookeeper/client/ZooKeeperSaslClient.java | 43 +++++++------------
 .../org/apache/zookeeper/SaslAuthTest.java    | 39 +++++++++++++++--
 3 files changed, 63 insertions(+), 37 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index a5d4877d608..75fd8744823 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -42,6 +42,7 @@
 import java.util.concurrent.LinkedBlockingDeque;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.ThreadLocalRandom;
+import java.util.concurrent.atomic.AtomicReference;
 import javax.security.auth.login.LoginException;
 import javax.security.sasl.SaslException;
 import org.apache.jute.BinaryInputArchive;
@@ -842,6 +843,7 @@ class SendThread extends ZooKeeperThread {
         private final ClientCnxnSocket clientCnxnSocket;
         private boolean isFirstConnect = true;
         private volatile ZooKeeperSaslClient zooKeeperSaslClient;
+        private final AtomicReference<Login> loginRef = new AtomicReference<>();
 
         void readResponse(ByteBuffer incomingBuffer) throws IOException {
             ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
@@ -1087,10 +1089,8 @@ private void startConnect(InetSocketAddress addr) throws IOException {
             setName(getName().replaceAll("\\(.*\\)", "(" + hostPort + ")"));
             if (clientConfig.isSaslClientEnabled()) {
                 try {
-                    if (zooKeeperSaslClient != null) {
-                        zooKeeperSaslClient.shutdown();
-                    }
-                    zooKeeperSaslClient = new ZooKeeperSaslClient(SaslServerPrincipal.getServerPrincipal(addr, clientConfig), clientConfig);
+                    zooKeeperSaslClient = new ZooKeeperSaslClient(
+                        SaslServerPrincipal.getServerPrincipal(addr, clientConfig), clientConfig, loginRef);
                 } catch (LoginException e) {
                     // An authentication error occurred when the SASL client tried to initialize:
                     // for Kerberos this means that the client failed to authenticate with the KDC.
@@ -1258,8 +1258,9 @@ public void run() {
             }
             eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Closed, null));
 
-            if (zooKeeperSaslClient != null) {
-                zooKeeperSaslClient.shutdown();
+            Login l = loginRef.getAndSet(null);
+            if (l != null) {
+                l.shutdown();
             }
             ZooTrace.logTraceMessage(
                 LOG,
@@ -1431,6 +1432,11 @@ public void sendPacket(Packet p) throws IOException {
         public ZooKeeperSaslClient getZooKeeperSaslClient() {
             return zooKeeperSaslClient;
         }
+
+        // VisibleForTesting
+        Login getLogin() {
+            return loginRef.get();
+        }
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
index 940bcfe228b..cafa66610df 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
@@ -21,6 +21,7 @@
 import java.io.IOException;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
+import java.util.concurrent.atomic.AtomicReference;
 import javax.security.auth.Subject;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
@@ -64,7 +65,6 @@ public class ZooKeeperSaslClient {
      */
     @Deprecated
     public static final String ENABLE_CLIENT_SASL_DEFAULT = "true";
-    private volatile boolean initializedLogin = false;
 
     /**
      * Returns true if the SASL client is enabled. By default, the client
@@ -112,7 +112,7 @@ public String getLoginContext() {
         return null;
     }
 
-    public ZooKeeperSaslClient(final String serverPrincipal, ZKClientConfig clientConfig) throws LoginException {
+    public ZooKeeperSaslClient(final String serverPrincipal, ZKClientConfig clientConfig, AtomicReference<Login> loginRef) throws LoginException {
         /**
          * ZOOKEEPER-1373: allow system property to specify the JAAS
          * configuration section that the zookeeper client should use.
@@ -136,7 +136,8 @@ public ZooKeeperSaslClient(final String serverPrincipal, ZKClientConfig clientCo
         }
         if (entries != null) {
             this.configStatus = "Will attempt to SASL-authenticate using Login Context section '" + clientSection + "'";
-            this.saslClient = createSaslClient(serverPrincipal, clientSection);
+            this.saslClient = createSaslClient(serverPrincipal, clientSection, loginRef);
+            this.login = loginRef.get();
         } else {
             // Handle situation of clientSection's being null: it might simply because the client does not intend to
             // use SASL, so not necessarily an error.
@@ -234,26 +235,25 @@ public void processResult(int rc, String path, Object ctx, byte[] data, Stat sta
 
     private SaslClient createSaslClient(
         final String servicePrincipal,
-        final String loginContext) throws LoginException {
+        final String loginContext,
+        final AtomicReference<Login> loginRef) throws LoginException {
         try {
-            if (!initializedLogin) {
-                synchronized (this) {
-                    if (login == null) {
-                        LOG.debug("JAAS loginContext is: {}", loginContext);
-                        // note that the login object is static: it's shared amongst all zookeeper-related connections.
-                        // in order to ensure the login is initialized only once, it must be synchronized the code snippet.
-                        login = new Login(loginContext, new SaslClientCallbackHandler(null, "Client"), clientConfig);
-                        login.startThreadIfNeeded();
-                        initializedLogin = true;
-                    }
+            if (loginRef.get() == null) {
+                LOG.debug("JAAS loginContext is: {}", loginContext);
+                // note that the login object is static: it's shared amongst all zookeeper-related connections.
+                // in order to ensure the login is initialized only once, it must be synchronized the code snippet.
+                Login l = new Login(loginContext, new SaslClientCallbackHandler(null, "Client"), clientConfig);
+                if (loginRef.compareAndSet(null, l)) {
+                    l.startThreadIfNeeded();
                 }
             }
-            return SecurityUtils.createSaslClient(login.getSubject(), servicePrincipal, "zookeeper", "zk-sasl-md5", LOG, "Client");
+            return SecurityUtils.createSaslClient(loginRef.get().getSubject(),
+                servicePrincipal, "zookeeper", "zk-sasl-md5", LOG, "Client");
         } catch (LoginException e) {
             // We throw LoginExceptions...
             throw e;
         } catch (Exception e) {
-            // ..but consume (with a log message) all other types of exceptions.
+            // ...but consume (with a log message) all other types of exceptions.
             LOG.error("Exception while trying to create SASL client.", e);
             return null;
         }
@@ -451,15 +451,4 @@ public boolean clientTunneledAuthenticationInProgress() {
             return false;
         }
     }
-
-    /**
-     * close login thread if running
-     */
-    public void shutdown() {
-        if (null != login) {
-            login.shutdown();
-            login = null;
-        }
-    }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
index be9194f59e7..8e713e37c94 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
@@ -20,6 +20,7 @@
 
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
@@ -239,12 +240,9 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             assertNotNull(zooKeeperSaslClient);
             sendThread.join(CONNECTION_TIMEOUT);
             eventThread.join(CONNECTION_TIMEOUT);
-            Field loginField = zooKeeperSaslClient.getClass().getDeclaredField("login");
-            loginField.setAccessible(true);
-            Login login = (Login) loginField.get(zooKeeperSaslClient);
             // If login is null, this means ZooKeeperSaslClient#shutdown method has been called which in turns
             // means that Login#shutdown has been called.
-            assertNull(login);
+            assertNull(sendThread.getLogin());
             assertFalse(sendThread.isAlive(), "SendThread did not shutdown after authFail");
             assertFalse(eventThread.isAlive(), "EventThread did not shutdown after authFail");
         } finally {
@@ -253,4 +251,37 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             }
         }
     }
+
+    @Test
+    public void testDisconnectNotCreatingLoginThread() throws Exception {
+        MyWatcher watcher = new MyWatcher();
+        ZooKeeper zk = null;
+        try {
+            zk = new ZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            zk.getData("/", false, null);
+
+            Field cnxnField = zk.getClass().getDeclaredField("cnxn");
+            cnxnField.setAccessible(true);
+            ClientCnxn clientCnxn = (ClientCnxn) cnxnField.get(zk);
+            Field sendThreadField = clientCnxn.getClass().getDeclaredField("sendThread");
+            sendThreadField.setAccessible(true);
+            SendThread sendThread = (SendThread) sendThreadField.get(clientCnxn);
+
+            Login l1 = sendThread.getLogin();
+            assertNotNull(l1);
+
+            stopServer();
+            watcher.waitForDisconnected(CONNECTION_TIMEOUT);
+            startServer();
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            zk.getData("/", false, null);
+
+            assertSame("Login thread should not been recreated on disconnect", l1, sendThread.getLogin());
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
 }

From 5f66da130118869a3b73b19dada8c5de628ad189 Mon Sep 17 00:00:00 2001
From: "Siyao (Jane) He" <siyaoh4@uci.edu>
Date: Tue, 6 Feb 2024 19:10:50 -0800
Subject: [PATCH 428/591] ZOOKEEPER-4703: Datadir and DatalogDir size are
 incorrect

Author: SiyaoIsHiding
Closes #2060 from SiyaoIsHiding/ZOOKEEPER-4703
---
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java     | 4 ++--
 .../apache/zookeeper/server/persistence/FileTxnSnapLog.java   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index f460b2d5bb4..453a2b6daa2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -655,7 +655,7 @@ public long getDataDirSize() {
         if (zkDb == null) {
             return 0L;
         }
-        File path = zkDb.snapLog.getDataDir();
+        File path = zkDb.snapLog.getSnapDir();
         return getDirSize(path);
     }
 
@@ -664,7 +664,7 @@ public long getLogDirSize() {
         if (zkDb == null) {
             return 0L;
         }
-        File path = zkDb.snapLog.getSnapDir();
+        File path = zkDb.snapLog.getDataDir();
         return getDirSize(path);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index fa6b4099ad6..bfe53205347 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -51,10 +51,10 @@
  */
 public class FileTxnSnapLog {
 
-    //the directory containing the
+    //the directory containing
     //the transaction logs
     final File dataDir;
-    //the directory containing the
+    //the directory containing
     //the snapshot directory
     final File snapDir;
     TxnLog txnLog;

From 71b7515926bccf00209fc373e43794d13e90c300 Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Wed, 7 Feb 2024 11:21:25 +0800
Subject: [PATCH 429/591] ZOOKEEPER-4764: Tune the log info of refusing session
 request

Reviewers: tisonkun, maoling
Author: horizonzy
Closes #2083 from horizonzy/tune-log-info
---
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 453a2b6daa2..0a730f26ec6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1513,7 +1513,9 @@ public void processConnectRequest(ServerCnxn cnxn, ConnectRequest request) throw
             throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
         }
         if (request.getLastZxidSeen() > zkDb.dataTree.lastProcessedZxid) {
-            String msg = "Refusing session request for client "
+            String msg = "Refusing session(0x"
+                         + Long.toHexString(sessionId)
+                         + ") request for client "
                          + cnxn.getRemoteSocketAddress()
                          + " as it has seen zxid 0x"
                          + Long.toHexString(request.getLastZxidSeen())

From 07f5cc6ea59e1a54f3ffac17bde5eb8af5f6491d Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Wed, 7 Feb 2024 15:35:30 +0800
Subject: [PATCH 430/591] ZOOKEEPER-4792: Use jvm as the prefix for the memory
 env log.

Reviewers: maoling
Author: horizonzy
Closes #2112 from horizonzy/tune-the-jvm-env-log
---
 .../src/main/java/org/apache/zookeeper/Environment.java     | 6 +++---
 .../org/apache/zookeeper/server/admin/CommandsTest.java     | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
index 42588201008..090f7e36c3b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
@@ -85,9 +85,9 @@ public static List<Entry> list() {
         // Get memory information.
         Runtime runtime = Runtime.getRuntime();
         int mb = 1024 * 1024;
-        put(l, "os.memory.free", runtime.freeMemory() / mb + "MB");
-        put(l, "os.memory.max", runtime.maxMemory() / mb + "MB");
-        put(l, "os.memory.total", runtime.totalMemory() / mb + "MB");
+        put(l, "jvm.memory.free", runtime.freeMemory() / mb + "MB");
+        put(l, "jvm.memory.max", runtime.maxMemory() / mb + "MB");
+        put(l, "jvm.memory.total", runtime.totalMemory() / mb + "MB");
 
         return l;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index 93c318787a1..ef8448dd418 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -155,7 +155,7 @@ public void testDump() throws IOException, InterruptedException {
 
     @Test
     public void testEnvironment() throws IOException, InterruptedException {
-        testCommand("environment", new Field("zookeeper.version", String.class), new Field("host.name", String.class), new Field("java.version", String.class), new Field("java.vendor", String.class), new Field("java.home", String.class), new Field("java.class.path", String.class), new Field("java.library.path", String.class), new Field("java.io.tmpdir", String.class), new Field("java.compiler", String.class), new Field("os.name", String.class), new Field("os.arch", String.class), new Field("os.version", String.class), new Field("user.name", String.class), new Field("user.home", String.class), new Field("user.dir", String.class), new Field("os.memory.free", String.class), new Field("os.memory.max", String.class), new Field("os.memory.total", String.class));
+        testCommand("environment", new Field("zookeeper.version", String.class), new Field("host.name", String.class), new Field("java.version", String.class), new Field("java.vendor", String.class), new Field("java.home", String.class), new Field("java.class.path", String.class), new Field("java.library.path", String.class), new Field("java.io.tmpdir", String.class), new Field("java.compiler", String.class), new Field("os.name", String.class), new Field("os.arch", String.class), new Field("os.version", String.class), new Field("user.name", String.class), new Field("user.home", String.class), new Field("user.dir", String.class), new Field("jvm.memory.free", String.class), new Field("jvm.memory.max", String.class), new Field("jvm.memory.total", String.class));
     }
 
     @Test

From e2ea0381f4b41ff05d86d6fbd0ed58a5d9dc9915 Mon Sep 17 00:00:00 2001
From: Muthuraj Ramalingakumar <muthu90tech@gmail.com>
Date: Wed, 7 Feb 2024 01:30:23 -0800
Subject: [PATCH 431/591] ZOOKEEPER-4779: Fix ZKUtilTest which fails to run on
 WSL

Reviewers: maoling
Author: muthu90tech
Closes #2099 from muthu90tech/ZOOKEEPER-4779
---
 .../main/java/org/apache/zookeeper/Shell.java | 20 +++++++++++++++++++
 .../java/org/apache/zookeeper/ZKUtilTest.java |  5 +++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java
index d59079f5fc7..f780ff98556 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java
@@ -33,10 +33,12 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.Timer;
 import java.util.TimerTask;
 import java.util.concurrent.atomic.AtomicBoolean;
+import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.ExitCode;
 import org.slf4j.Logger;
@@ -105,6 +107,24 @@ public static String[] getUlimitMemoryCommand(int memoryLimit) {
         return new String[]{ULIMIT_COMMAND, "-v", String.valueOf(memoryLimit)};
     }
 
+    /**
+     * Check if running in Windows Subsystem for Linux
+     * @return
+     * @throws IOException
+     */
+    public static boolean isWsl() throws IOException {
+        if (WINDOWS) {
+            return false;
+        }
+        final File f = new File("/proc/version");
+        if (!f.exists()) {
+            return false;
+        }
+        final String output = FileUtils.readFileToString(f, StandardCharsets.UTF_8.name());
+        return (output != null)
+                && System.getProperty("os.name").startsWith("Linux") && output.toLowerCase().contains("microsoft");
+    }
+
     /** Set to true on Windows platforms */
     public static final boolean WINDOWS /* borrowed from Path.WINDOWS */ = System.getProperty("os.name").startsWith("Windows");
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
index a73ff2fa7e0..21dad4c50b4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
@@ -80,8 +80,9 @@ public void testValidateFileInputDirectory() throws Exception {
 
     @Test
     public void testUnreadableFileInput() throws Exception {
-        //skip this test on Windows, coverage on Linux
-        assumeTrue(!org.apache.zookeeper.Shell.WINDOWS);
+        //skip this test on Windows and WSL, coverage on Linux
+        assumeTrue("Skipping this test on Windows and WSL",
+                !(org.apache.zookeeper.Shell.WINDOWS || org.apache.zookeeper.Shell.isWsl()));
         File file = File.createTempFile("test", ".junit", testData);
         file.setReadable(false, false);
         file.deleteOnExit();

From 72e3d9ce9cf1bdabf306eb53223e0953ee40748a Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Wed, 7 Feb 2024 23:31:43 -0800
Subject: [PATCH 432/591] ZOOKEEPER-4730: Incorrect datadir and logdir size
 reported from admin and and 4lw dirs command

Reviewers: kezhuw, eolivelli, maoling
Author: li4wang
Closes #2043 from li4wang/ZOOKEEPER-4730
---
 .../apache/zookeeper/server/PurgeTxnLog.java  |  2 +-
 .../zookeeper/server/ZooKeeperServer.java     | 10 ++---
 .../server/persistence/FileTxnSnapLog.java    |  6 +--
 .../server/ZooKeeperServerMainTest.java       |  2 +-
 .../zookeeper/server/ZooKeeperServerTest.java | 40 +++++++++++++++++++
 .../persistence/FileTxnSnapLogTest.java       |  2 +-
 .../server/quorum/QuorumPeerMainTest.java     |  2 +-
 .../server/quorum/QuorumPeerTestBase.java     |  2 +-
 .../server/quorum/WatchLeakTest.java          |  2 +-
 .../zookeeper/server/quorum/Zab1_0Test.java   |  6 +--
 .../test/NonRecoverableErrorTest.java         |  2 +-
 .../zookeeper/test/RepeatStartupTest.java     |  2 +-
 .../apache/zookeeper/test/TruncateTest.java   |  2 +-
 13 files changed, 60 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
index d2fa93f5a83..299071348be 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
@@ -135,7 +135,7 @@ public boolean accept(File f) {
 
         }
         // add all non-excluded log files
-        File[] logs = txnLog.getDataDir().listFiles(new MyFileFilter(PREFIX_LOG));
+        File[] logs = txnLog.getDataLogDir().listFiles(new MyFileFilter(PREFIX_LOG));
         List<File> files = new ArrayList<>();
         if (logs != null) {
             files.addAll(Arrays.asList(logs));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 0a730f26ec6..19f1fac4536 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -388,13 +388,13 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
                 + " minSessionTimeout {} ms"
                 + " maxSessionTimeout {} ms"
                 + " clientPortListenBacklog {}"
-                + " datadir {}"
+                + " dataLogdir {}"
                 + " snapdir {}",
             tickTime,
             getMinSessionTimeout(),
             getMaxSessionTimeout(),
             getClientPortListenBacklog(),
-            txnLogFactory.getDataDir(),
+            txnLogFactory.getDataLogDir(),
             txnLogFactory.getSnapDir());
     }
 
@@ -447,7 +447,7 @@ public void dumpConf(PrintWriter pwriter) {
         pwriter.print("dataDirSize=");
         pwriter.println(getDataDirSize());
         pwriter.print("dataLogDir=");
-        pwriter.println(zkDb.snapLog.getDataDir().getAbsolutePath());
+        pwriter.println(zkDb.snapLog.getDataLogDir().getAbsolutePath());
         pwriter.print("dataLogSize=");
         pwriter.println(getLogDirSize());
         pwriter.print("tickTime=");
@@ -469,7 +469,7 @@ public ZooKeeperServerConf getConf() {
         return new ZooKeeperServerConf(
             getClientPort(),
             zkDb.snapLog.getSnapDir().getAbsolutePath(),
-            zkDb.snapLog.getDataDir().getAbsolutePath(),
+            zkDb.snapLog.getDataLogDir().getAbsolutePath(),
             getTickTime(),
             getMaxClientCnxnsPerHost(),
             getMinSessionTimeout(),
@@ -664,7 +664,7 @@ public long getLogDirSize() {
         if (zkDb == null) {
             return 0L;
         }
-        File path = zkDb.snapLog.getDataDir();
+        File path = zkDb.snapLog.getDataLogDir();
         return getDirSize(path);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index bfe53205347..29b4c0a616d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -204,11 +204,11 @@ public boolean accept(File dir, String name) {
     }
 
     /**
-     * get the datadir used by this filetxn
+     * get the data log dir used by this filetxn
      * snap log
-     * @return the data dir
+     * @return the data log dir
      */
-    public File getDataDir() {
+    public File getDataLogDir() {
         return this.dataDir;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
index 920fdf406bf..0a76cb363c0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
@@ -198,7 +198,7 @@ public void testNonRecoverableError() throws Exception {
         // inject problem in server
         ZooKeeperServer zooKeeperServer = main.getCnxnFactory().getZooKeeperServer();
         FileTxnSnapLog snapLog = zooKeeperServer.getTxnLogFactory();
-        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataDir(), snapLog.getSnapDir()) {
+        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataLogDir(), snapLog.getSnapDir()) {
             @Override
             public void commit() throws IOException {
                 throw new IOException("Input/output error");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index e9f9b7db544..6a6cfd7ab59 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -29,6 +29,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
+import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.proto.ConnectRequest;
@@ -42,6 +43,45 @@
 
 public class ZooKeeperServerTest extends ZKTestCase {
 
+    @Test
+    public void testDirSize() throws Exception {
+        ZooKeeperServer zks = null;
+        ServerCnxnFactory cnxnFactory = null;
+
+        try {
+            final File dataDir = ClientBase.createTmpDir();
+            final File logDir = ClientBase.createTmpDir();
+
+            zks = new ZooKeeperServer(dataDir, logDir, 3000);
+
+            // validate dir size before server starts
+            assertEquals(0, zks.getDataDirSize());
+            assertEquals(0, zks.getLogDirSize());
+
+            // start server
+            final String hostPort = "127.0.0.1:" + PortAssignment.unique();
+            final int port = Integer.parseInt(hostPort.split(":")[1]);
+            cnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+            cnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(hostPort, 120000));
+
+            // validate data size is greater than 0 as snapshot has been taken when server starts
+            assertTrue(zks.getDataDirSize() > 0);
+
+            // validate log size is 0 as no txn yet
+            assertEquals(0, zks.getLogDirSize());
+        } finally {
+            if (cnxnFactory != null) {
+                cnxnFactory.shutdown();
+            }
+
+            if (zks != null) {
+                zks.shutdown();
+            }
+        }
+    }
+
+
     @Test
     public void testSortDataDirAscending() {
         File[] files = new File[5];
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
index 466cf3f4b07..656eeb8a0aa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
@@ -177,7 +177,7 @@ public void testWithAutoCreateDataDir() throws IOException {
 
         assertTrue(logDir.exists());
         assertTrue(snapDir.exists());
-        assertTrue(fileTxnSnapLog.getDataDir().exists());
+        assertTrue(fileTxnSnapLog.getDataLogDir().exists());
         assertTrue(fileTxnSnapLog.getSnapDir().exists());
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index be81aa6c5b3..1cb2a2b8efa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -935,7 +935,7 @@ public void testDataDirAndDataLogDir() throws Exception {
 
             // Assert
             FileTxnSnapLog txnFactory = qpMain.getQuorumPeer().getTxnFactory();
-            assertEquals(Paths.get(dataLogDir.getAbsolutePath(), "version-2").toString(), txnFactory.getDataDir().getAbsolutePath());
+            assertEquals(Paths.get(dataLogDir.getAbsolutePath(), "version-2").toString(), txnFactory.getDataLogDir().getAbsolutePath());
             assertEquals(Paths.get(dataDir.getAbsolutePath(), "version-2").toString(), txnFactory.getSnapDir().getAbsolutePath());
         } finally {
             FileUtils.deleteDirectory(dataDir);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index 9318909593d..c3842808adc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -368,7 +368,7 @@ public boolean isAlive() {
         }
 
         public void reinitialize() throws IOException {
-            File dataDir = main.quorumPeer.getTxnFactory().getDataDir();
+            File dataDir = main.quorumPeer.getTxnFactory().getDataLogDir();
             ClientBase.recursiveDelete(dataDir);
             ClientBase.createInitializeFile(dataDir.getParentFile());
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index 93d3b845c41..b51cfbe3ba2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -102,7 +102,7 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
         QuorumPeer quorumPeer = mock(QuorumPeer.class);
         FileTxnSnapLog logfactory = mock(FileTxnSnapLog.class);
         // Directories are not used but we need it to avoid NPE
-        when(logfactory.getDataDir()).thenReturn(new File(""));
+        when(logfactory.getDataLogDir()).thenReturn(new File(""));
         when(logfactory.getSnapDir()).thenReturn(new File(""));
         FollowerZooKeeperServer fzks = null;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index dcf7819b12b..f0db38e2675 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -575,7 +575,7 @@ public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f)
                 File tmpDir = File.createTempFile("test", "dir", testData);
                 tmpDir.delete();
                 tmpDir.mkdir();
-                File logDir = f.fzk.getTxnLogFactory().getDataDir().getParentFile();
+                File logDir = f.fzk.getTxnLogFactory().getDataLogDir().getParentFile();
                 File snapDir = f.fzk.getTxnLogFactory().getSnapDir().getParentFile();
                 //Spy on ZK so we can check if a snapshot happened or not.
                 f.zk = spy(f.zk);
@@ -709,7 +709,7 @@ public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f)
                 File tmpDir = File.createTempFile("test", "dir", testData);
                 tmpDir.delete();
                 tmpDir.mkdir();
-                File logDir = f.fzk.getTxnLogFactory().getDataDir().getParentFile();
+                File logDir = f.fzk.getTxnLogFactory().getDataLogDir().getParentFile();
                 File snapDir = f.fzk.getTxnLogFactory().getSnapDir().getParentFile();
                 //Spy on ZK so we can check if a snapshot happened or not.
                 f.zk = spy(f.zk);
@@ -940,7 +940,7 @@ public void converseWithObserver(InputArchive ia, OutputArchive oa, Observer o)
                 File tmpDir = File.createTempFile("test", "dir", testData);
                 tmpDir.delete();
                 tmpDir.mkdir();
-                File logDir = o.zk.getTxnLogFactory().getDataDir().getParentFile();
+                File logDir = o.zk.getTxnLogFactory().getDataLogDir().getParentFile();
                 File snapDir = o.zk.getTxnLogFactory().getSnapDir().getParentFile();
                 try {
                     assertEquals(0, o.self.getAcceptedEpoch());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
index 3eaa1d3ffcf..ed592df6f7c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
@@ -93,7 +93,7 @@ public void testZooKeeperServiceAvailableOnLeader() throws Exception {
 
         // inject problem in leader
         FileTxnSnapLog snapLog = leader.getActiveServer().getTxnLogFactory();
-        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataDir(), snapLog.getSnapDir()) {
+        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataLogDir(), snapLog.getSnapDir()) {
             @Override
             public void commit() throws IOException {
                 throw new IOException("Input/output error");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
index 4dff8e27621..8c79af34104 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
@@ -49,7 +49,7 @@ public void testFail() throws Exception {
         QuorumBase.shutdown(qb.s4);
         QuorumBase.shutdown(qb.s5);
         String hp = qb.hostPort.split(",")[0];
-        ZooKeeperServer zks = new ZooKeeperServer(qb.s1.getTxnFactory().getSnapDir(), qb.s1.getTxnFactory().getDataDir(), 3000);
+        ZooKeeperServer zks = new ZooKeeperServer(qb.s1.getTxnFactory().getSnapDir(), qb.s1.getTxnFactory().getDataLogDir(), 3000);
         final int PORT = Integer.parseInt(hp.split(":")[1]);
         ServerCnxnFactory factory = ServerCnxnFactory.createFactory(PORT, -1);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
index f81afc86708..c7654003f30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
@@ -121,7 +121,7 @@ public void testTruncationNullLog() throws Exception {
             append(zkdb, i);
         }
         zkdb.close();
-        File[] logs = snaplog.getDataDir().listFiles();
+        File[] logs = snaplog.getDataLogDir().listFiles();
         for (int i = 0; i < logs.length; i++) {
             LOG.debug("Deleting: {}", logs[i].getName());
             assertTrue(logs[i].delete(), "Failed to delete log file: " + logs[i].getName());

From e10bf869eae8cd205d7a0a43395e4cf14c498587 Mon Sep 17 00:00:00 2001
From: Muthuraj Ramalingakumar <muthu90tech@gmail.com>
Date: Fri, 9 Feb 2024 03:11:32 -0800
Subject: [PATCH 433/591] ZOOKEEPER-4780: Delegate temp directory creation to
 Junit in tests.

ZOOKEEPER-4780: Delegate temp directory creation to Junit in tests.
Use Junit @TempDir annotation to manage temp directory for tests.
Use TempDir annotation for few more tests.
Remove unusedimports
There is a test which fails on the CI, but when I reran it local it passes. test=TruncateTest
Revert TruncateTest
Address comments
Make sure the temp directory scope is not affected.
fix for ZKClientConfigTest
Reviewers: ctubbsii, eolivelli
Author: muthu90tech
Closes #2100 from muthu90tech/ZOOKEEPER-4780
---
 .../zookeeper/client/ZKClientConfigTest.java  |  20 +--
 .../common/BaseX509ParameterizedTestCase.java |  11 +-
 .../common/FileChangeWatcherTest.java         |  19 +--
 .../zookeeper/common/SecretUtilsTest.java     |  10 +-
 .../org/apache/zookeeper/server/CRCTest.java  |   4 +-
 .../zookeeper/server/ClientSSLReloadTest.java |  16 +--
 .../server/DatadirCleanupManagerTest.java     |   9 +-
 .../server/PrepRequestProcessorTest.java      |   4 +-
 .../server/ZooKeeperServerBeanTest.java       |   5 +-
 .../server/ZooKeeperServerCreationTest.java   |   5 +-
 .../server/admin/JettyAdminServerTest.java    |   7 +-
 .../controller/ControllerConfigTest.java      |   6 +-
 .../server/controller/ControllerTestBase.java |  16 +--
 .../server/persistence/EmptySnapshotTest.java |   6 +-
 .../server/persistence/FileTxnLogTest.java    |  10 +-
 .../server/persistence/SnapStreamTest.java    |  44 +++---
 .../quorum/CommitProcessorMetricsTest.java    |  14 +-
 .../server/quorum/CommitProcessorTest.java    |  36 +++--
 .../server/quorum/LeaderBeanTest.java         |   5 +-
 .../server/quorum/LeaderWithObserverTest.java |   5 +-
 .../zookeeper/server/quorum/LearnerTest.java  | 134 ++++++++----------
 .../server/quorum/QuorumPeerTest.java         |   5 +-
 .../UnifiedServerSocketModeDetectionTest.java |  13 +-
 .../zookeeper/server/quorum/Zab1_0Test.java   |  51 ++++---
 .../quorum/auth/KerberosSecurityTestcase.java |  32 +----
 .../apache/zookeeper/test/ACLCountTest.java   |   4 +-
 .../org/apache/zookeeper/test/ACLTest.java    |  22 ++-
 .../zookeeper/test/ClientPortBindTest.java    |   5 +-
 .../apache/zookeeper/test/RecoveryTest.java   |   4 +-
 29 files changed, 215 insertions(+), 307 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
index d98ecba255a..588a91939e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
@@ -38,21 +38,12 @@
 import java.util.Properties;
 import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ZKClientConfigTest {
 
-    private static final File testData = new File(System.getProperty("test.data.dir", "src/test/resources/data"));
-
-    @BeforeAll
-    public static void init() {
-        if (!testData.exists()) {
-            testData.mkdirs();
-        }
-    }
-
     @Test
     @Timeout(value = 10)
     public void testDefaultConfiguration() {
@@ -109,9 +100,8 @@ public void testSystemPropertyValue() {
 
     @Test
     @Timeout(value = 10)
-    public void testReadConfigurationFile() throws IOException, ConfigException {
-        File file = File.createTempFile("clientConfig", ".conf", testData);
-        file.deleteOnExit();
+    public void testReadConfigurationFile(@TempDir File testDataDir) throws IOException, ConfigException {
+        File file = File.createTempFile("clientConfig", ".conf", testDataDir);
         Properties clientConfProp = new Properties();
         clientConfProp.setProperty(ENABLE_CLIENT_SASL_KEY, "true");
         clientConfProp.setProperty(ZK_SASL_CLIENT_USERNAME, "ZK");
@@ -132,10 +122,6 @@ public void testReadConfigurationFile() throws IOException, ConfigException {
         assertEquals(conf.getProperty(LOGIN_CONTEXT_NAME_KEY), "MyClient");
         assertEquals(conf.getProperty(ZOOKEEPER_SERVER_REALM), "HADOOP.COM");
         assertEquals(conf.getProperty("dummyProperty"), "dummyValue");
-
-        // try to delete it now as we have done with the created file, why to
-        // wait for deleteOnExit() deletion
-        file.delete();
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
index 344faef566d..b5ece888505 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
@@ -19,18 +19,16 @@
 package org.apache.zookeeper.common;
 
 import java.io.File;
-import java.io.IOException;
 import java.security.Security;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.stream.Stream;
-import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.provider.Arguments;
 
 /**
@@ -70,6 +68,7 @@ public static Stream<Arguments> data() {
      * caching makes all test cases after the first one for a given parameter combination complete almost instantly.
      */
     protected static Map<Integer, X509TestContext> cachedTestContexts;
+    @TempDir
     protected static File tempDir;
 
     protected X509TestContext x509TestContext;
@@ -78,7 +77,6 @@ public static Stream<Arguments> data() {
     public static void setUpBaseClass() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
         cachedTestContexts = new HashMap<>();
-        tempDir = ClientBase.createEmptyTestDir();
     }
 
     @AfterAll
@@ -86,11 +84,6 @@ public static void cleanUpBaseClass() {
         Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
         cachedTestContexts.clear();
         cachedTestContexts = null;
-        try {
-            FileUtils.deleteDirectory(tempDir);
-        } catch (IOException e) {
-            // ignore
-        }
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
index 4ae5ab68f93..4a062560edb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
@@ -31,17 +31,17 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 public class FileChangeWatcherTest extends ZKTestCase {
 
-    private static File tempDir;
-    private static File tempFile;
+    @TempDir
+    static File tempDir;
+    static File tempFile;
 
     private static final Logger LOG = LoggerFactory.getLogger(FileChangeWatcherTest.class);
 
@@ -49,18 +49,7 @@ public class FileChangeWatcherTest extends ZKTestCase {
 
     @BeforeAll
     public static void createTempFile() throws IOException {
-        tempDir = ClientBase.createEmptyTestDir();
         tempFile = File.createTempFile("zk_test_", "", tempDir);
-        tempFile.deleteOnExit();
-    }
-
-    @AfterAll
-    public static void cleanupTempDir() {
-        try {
-            FileUtils.deleteDirectory(tempDir);
-        } catch (IOException e) {
-            // ignore
-        }
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
index 796cf5f9036..9c05a7725e6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
@@ -21,16 +21,20 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.BufferedWriter;
+import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
-import java.nio.file.Files;
 import java.nio.file.Path;
 import org.junit.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
 
 public class SecretUtilsTest {
 
+    @TempDir
+    static File tempDir;
+
     @ParameterizedTest
     @ValueSource (strings = {"test secret", ""})
     public void testReadSecret(final String secretTxt) throws Exception {
@@ -58,13 +62,13 @@ public void testReadSecret_fileNotExist() {
     }
 
     public static Path createSecretFile(final String secretTxt) throws IOException {
-        final Path path = Files.createTempFile("test_", ".secrete");
+        final File tempFile = File.createTempFile("test_", ".secrete", tempDir);
+        final Path path = tempFile.toPath();
 
         final BufferedWriter writer = new BufferedWriter(new FileWriter(path.toString()));
         writer.append(secretTxt);
         writer.close();
 
-        path.toFile().deleteOnExit();
         return path;
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
index 37e9b78ab9f..26e7b051a75 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
@@ -44,6 +44,7 @@
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -102,8 +103,7 @@ private boolean getCheckSum(File snapFile) throws IOException {
      * @throws Exception
      */
     @Test
-    public void testChecksums() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testChecksums(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(150);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
index f9996c827bd..c0c35c69579 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
@@ -43,6 +43,7 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -52,8 +53,10 @@ public class ClientSSLReloadTest extends ZKTestCase {
     private X509TestContext x509TestContext1;
     private X509TestContext x509TestContext2;
 
-    private File dir1;
-    private File dir2;
+    @TempDir
+    File dir1;
+    @TempDir
+    File dir2;
 
     private File keyStoreFile1;
     private File trustStoreFile1;
@@ -64,9 +67,6 @@ public class ClientSSLReloadTest extends ZKTestCase {
     @BeforeEach
     public void setup() throws Exception {
 
-        dir1 = ClientBase.createEmptyTestDir();
-        dir2 = ClientBase.createEmptyTestDir();
-
         Security.addProvider(new BouncyCastleProvider());
 
         x509TestContext1 = X509TestContext.newBuilder()
@@ -92,12 +92,6 @@ public void setup() throws Exception {
 
     @AfterEach
     public void teardown() throws Exception {
-        try {
-            FileUtils.deleteDirectory(dir1);
-            FileUtils.deleteDirectory(dir2);
-        } catch (IOException e) {
-            // ignore
-        }
         Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
index 0e85cf97834..566e540be2a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
@@ -24,22 +24,23 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.File;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class DatadirCleanupManagerTest extends ZKTestCase {
 
     private DatadirCleanupManager purgeMgr;
+    @TempDir
+    File tmpDir;
     private File snapDir;
     private File dataLogDir;
 
     @BeforeEach
     public void setUp() throws Exception {
-        File dataDir = ClientBase.createTmpDir();
-        snapDir = dataDir;
-        dataLogDir = dataDir;
+        snapDir = tmpDir;
+        dataLogDir = tmpDir;
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index e2416415807..3cf993abbb3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -64,6 +64,7 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 
 public class PrepRequestProcessorTest extends ClientBase {
@@ -81,8 +82,7 @@ public class PrepRequestProcessorTest extends ClientBase {
     private boolean isStandaloneEnabledPreviously;
 
     @BeforeEach
-    public void setup() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void setup(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(100);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
index 90220371629..769111bce41 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
@@ -27,12 +27,12 @@
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ZooKeeperServerBeanTest {
 
@@ -47,9 +47,8 @@ public void teardown() throws Exception {
     }
 
     @Test
-    public void testTxnLogElapsedSyncTime() throws IOException {
+    public void testTxnLogElapsedSyncTime(@TempDir File tmpDir) throws IOException {
 
-        File tmpDir = ClientBase.createEmptyTestDir();
         FileTxnSnapLog fileTxnSnapLog = new FileTxnSnapLog(new File(tmpDir, "data"), new File(tmpDir, "data_txnlog"));
 
         ZooKeeperServer zks = new ZooKeeperServer();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
index 6c22091f426..6dd27d49438 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
@@ -21,8 +21,8 @@
 import java.io.File;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ZooKeeperServerCreationTest {
 
@@ -31,8 +31,7 @@ public class ZooKeeperServerCreationTest {
      * that all needed fields are initialized properly, etc.
      */
     @Test
-    public void testDefaultConstructor() throws Exception {
-        File tmpDir = ClientBase.createEmptyTestDir();
+    public void testDefaultConstructor(@TempDir File tmpDir) throws Exception {
         FileTxnSnapLog fileTxnSnapLog = new FileTxnSnapLog(new File(tmpDir, "data"), new File(tmpDir, "data_txnlog"));
 
         ZooKeeperServer zks = new ZooKeeperServer() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 41f00751a7e..8ef7e8b5f96 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -54,6 +54,7 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -73,14 +74,12 @@ public void enableServer() {
     }
 
     @BeforeEach
-    public void setupEncryption() {
+    public void setupEncryption(@TempDir File tempDir) {
         Security.addProvider(new BouncyCastleProvider());
-        File tmpDir = null;
         X509TestContext x509TestContext = null;
         try {
-            tmpDir = ClientBase.createEmptyTestDir();
             x509TestContext = X509TestContext.newBuilder()
-                                             .setTempDir(tmpDir)
+                                             .setTempDir(tempDir)
                                              .setKeyStorePassword("")
                                              .setKeyStoreKeyType(X509KeyType.EC)
                                              .setTrustStorePassword("")
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
index 2a8ec822d48..5d2c47e9d36 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
@@ -30,8 +30,12 @@
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ControllerConfigTest {
+
+    @TempDir
+    static File configDir;
     File configFile;
 
     private static final int AnyTickTime = 1234;
@@ -39,7 +43,7 @@ public class ControllerConfigTest {
     private static final String AnyDataDir = "temp";
 
     public static File createTempFile() throws IOException {
-        return File.createTempFile("temp", "cfg", new File(System.getProperty("user.dir")));
+        return File.createTempFile("temp", "cfg", configDir);
     }
 
     public static List<Integer> findNAvailablePorts(int n) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
index 70067c77a7f..7035d54184e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
@@ -18,31 +18,25 @@
 
 package org.apache.zookeeper.server.controller;
 
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.List;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.ZKTestCase;
 import org.junit.After;
 import org.junit.Before;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ControllerTestBase extends ZKTestCase {
 
     protected ControllerService controllerService;
     protected CommandClient commandClient;
-    private File tempDirectory;
     protected ControllerServerConfig config;
 
     @Before
-    public void init() throws Exception {
+    public void init(@TempDir File tempDir) throws Exception {
         List<Integer> openPorts = ControllerConfigTest.findNAvailablePorts(2);
-        File tmpFile = File.createTempFile("test", ".junit", testBaseDir);
-        tempDirectory = new File(tmpFile + ".dir");
-        assertFalse(tempDirectory.exists());
-        assertTrue(tempDirectory.mkdirs());
 
-        config = new ControllerServerConfig(openPorts.get(0), openPorts.get(1), tempDirectory.getAbsolutePath());
+        config = new ControllerServerConfig(openPorts.get(0), openPorts.get(1), tempDir.getAbsolutePath());
         controllerService = new ControllerService();
         controllerService.start(config);
 
@@ -70,9 +64,5 @@ public void cleanup() throws InterruptedException {
         if (commandClient != null) {
             commandClient.close();
         }
-
-        if (tempDirectory != null) {
-            tempDirectory.delete();
-        }
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
index e636b23dd3f..8d2dba45180 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
@@ -28,6 +28,7 @@
 import java.util.concurrent.ConcurrentHashMap;
 import org.apache.zookeeper.server.DataTree;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 /**
  * This test checks that the server does not create empty snapshot files if the
@@ -35,6 +36,9 @@
  */
 public class EmptySnapshotTest {
 
+    @TempDir
+    public static File testDir;
+
     static class MockFileSnap extends FileSnap {
 
         MockFileSnap(File snapDir) {
@@ -51,7 +55,7 @@ public synchronized void serialize(DataTree dt, Map<Long, Integer> sessions, Fil
 
     @Test
     public void testNoEmptySnapshot() throws Exception {
-        File tmpFile = File.createTempFile("empty-snapshot-test", ".junit", new File(System.getProperty("build.test.dir", "build")));
+        File tmpFile = File.createTempFile("empty-snapshot-test", ".junit", testDir);
         File tmpDataDir = new File(tmpFile + ".dir");
         assertFalse(tmpDataDir.exists());
         assertTrue(tmpDataDir.mkdirs());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index 3d44af73f7b..f3c2dfee2a0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -48,6 +48,7 @@
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -84,8 +85,7 @@ public void testFileSizeGreaterThanPosition() {
     }
 
     @Test
-    public void testPreAllocSizeSmallerThanTxnData() throws IOException {
-        File logDir = ClientBase.createTmpDir();
+    public void testPreAllocSizeSmallerThanTxnData(@TempDir File logDir) throws IOException {
         FileTxnLog fileTxnLog = new FileTxnLog(logDir);
 
         // Set a small preAllocSize (.5 MB)
@@ -176,9 +176,8 @@ public void testSyncThresholdExceedCount() throws IOException {
      * Test that log size get update correctly
      */
     @Test
-    public void testGetCurrentLogSize() throws Exception {
+    public void testGetCurrentLogSize(@TempDir File tmpDir) throws Exception {
         FileTxnLog.setTxnLogSizeLimit(-1);
-        File tmpDir = ClientBase.createTmpDir();
         FileTxnLog log = new FileTxnLog(tmpDir);
         FileTxnLog.setPreallocSize(PREALLOCATE);
         CreateRequest record = new CreateRequest(null, new byte[NODE_SIZE], ZooDefs.Ids.OPEN_ACL_UNSAFE, 0);
@@ -228,8 +227,7 @@ public void testGetCurrentLogSize() throws Exception {
      * txnlogs per snapshot
      */
     @Test
-    public void testLogSizeLimit() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testLogSizeLimit(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
 
         // Need to override preallocate set by setupTestEnv()
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
index 9292c38b3b4..f56dcfab296 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server.persistence;
 
-import static org.apache.zookeeper.test.ClientBase.createTmpDir;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -34,6 +33,7 @@
 import org.apache.zookeeper.server.persistence.SnapStream.StreamMode;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class SnapStreamTest {
 
@@ -64,30 +64,29 @@ public void testGetStreamMode() {
     }
 
     @Test
-    public void testSerializeDeserializeWithChecked() throws IOException {
-        testSerializeDeserialize(StreamMode.CHECKED, "");
+    public void testSerializeDeserializeWithChecked(@TempDir File tmpDir) throws IOException {
+        testSerializeDeserialize(StreamMode.CHECKED, "", tmpDir);
     }
 
     @Test
-    public void testSerializeDeserializeWithSNAPPY() throws IOException {
-        testSerializeDeserialize(StreamMode.SNAPPY, ".snappy");
+    public void testSerializeDeserializeWithSNAPPY(@TempDir File tmpDir) throws IOException {
+        testSerializeDeserialize(StreamMode.SNAPPY, ".snappy", tmpDir);
     }
 
     @Test
-    public void testSerializeDeserializeWithGZIP() throws IOException {
-        testSerializeDeserialize(StreamMode.GZIP, ".gz");
+    public void testSerializeDeserializeWithGZIP(@TempDir File tmpDir) throws IOException {
+        testSerializeDeserialize(StreamMode.GZIP, ".gz", tmpDir);
     }
 
-    private void testSerializeDeserialize(StreamMode mode, String fileSuffix) throws IOException {
-        testSerializeDeserialize(mode, fileSuffix, false);
-        testSerializeDeserialize(mode, fileSuffix, true);
+    private void testSerializeDeserialize(StreamMode mode, String fileSuffix, File tmpDir) throws IOException {
+        testSerializeDeserialize(mode, fileSuffix, false, tmpDir);
+        testSerializeDeserialize(mode, fileSuffix, true, tmpDir);
     }
 
-    private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolean fsync) throws IOException {
+    private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolean fsync, File tmpDir) throws IOException {
         SnapStream.setStreamMode(mode);
 
         // serialize with gzip stream
-        File tmpDir = createTmpDir();
         File file = new File(tmpDir, "snapshot.180000e3a2" + fileSuffix);
         CheckedOutputStream os = SnapStream.getOutputStream(file, fsync);
         OutputArchive oa = BinaryOutputArchive.getArchive(os);
@@ -108,12 +107,11 @@ private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolea
         SnapStream.checkSealIntegrity(is, ia);
     }
 
-    private void checkInvalidSnapshot(String filename, boolean fsync) throws IOException {
+    private void checkInvalidSnapshot(String filename, boolean fsync, File tmpDir) throws IOException {
         // set the output stream mode to CHECKED
         SnapStream.setStreamMode(StreamMode.CHECKED);
 
         // serialize to CHECKED file without magic header
-        File tmpDir = createTmpDir();
         File file = new File(tmpDir, filename);
         OutputStream os = SnapStream.getOutputStream(file, fsync);
         os.write(1);
@@ -122,18 +120,22 @@ private void checkInvalidSnapshot(String filename, boolean fsync) throws IOExcep
         assertFalse(SnapStream.isValidSnapshot(file));
     }
 
-    private void checkInvalidSnapshot(String filename) throws IOException {
-        checkInvalidSnapshot(filename, false);
-        checkInvalidSnapshot(filename, true);
+    private void checkInvalidSnapshot(String filename, File tmpDir) throws IOException {
+        checkInvalidSnapshot(filename, false, tmpDir);
+        checkInvalidSnapshot(filename, true, tmpDir);
     }
 
+    /*
+        For this test a single tempDirectory will be created but the checkInvalidsnapshot will create
+        multiple files within the directory for the tests.
+     */
     @Test
-    public void testInvalidSnapshot() throws IOException {
+    public void testInvalidSnapshot(@TempDir File tmpDir) throws IOException {
         assertFalse(SnapStream.isValidSnapshot(null));
 
-        checkInvalidSnapshot("snapshot.180000e3a2");
-        checkInvalidSnapshot("snapshot.180000e3a2.gz");
-        checkInvalidSnapshot("snapshot.180000e3a2.snappy");
+        checkInvalidSnapshot("snapshot.180000e3a2", tmpDir);
+        checkInvalidSnapshot("snapshot.180000e3a2.gz", tmpDir);
+        checkInvalidSnapshot("snapshot.180000e3a2.snappy", tmpDir);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
index 4a45983555a..bfa3fb78613 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
@@ -48,7 +48,7 @@ public class CommitProcessorMetricsTest extends ZKTestCase {
     CountDownLatch requestScheduled = null;
     CountDownLatch requestProcessed = null;
     CountDownLatch commitSeen = null;
-    CountDownLatch poolEmpytied = null;
+    CountDownLatch poolEmptied = null;
 
     @BeforeEach
     public void setup() {
@@ -126,8 +126,8 @@ protected void waitForEmptyPool() throws InterruptedException {
                 commitSeen.countDown();
             }
             super.waitForEmptyPool();
-            if (poolEmpytied != null) {
-                poolEmpytied.countDown();
+            if (poolEmptied != null) {
+                poolEmptied.countDown();
             }
         }
 
@@ -365,9 +365,9 @@ public void testTimeWaitingEmptyPoolInCommitProcessorRead() throws Exception {
         requestScheduled.await(5, TimeUnit.SECONDS);
 
         //add a commit request to trigger waitForEmptyPool
-        poolEmpytied = new CountDownLatch(1);
+        poolEmptied = new CountDownLatch(1);
         commitProcessor.commit(createWriteRequest(1L, 1));
-        poolEmpytied.await(5, TimeUnit.SECONDS);
+        poolEmptied.await(5, TimeUnit.SECONDS);
 
         long actual = (long) MetricsUtils.currentServerMetrics().get("max_time_waiting_empty_pool_in_commit_processor_read_ms");
         //since each request takes 1000ms to process, so the waiting shouldn't be more than three times of that
@@ -387,9 +387,9 @@ public void testConcurrentRequestProcessingInCommitProcessor() throws Exception
         requestScheduled.await(5, TimeUnit.SECONDS);
 
         //add a commit request to trigger waitForEmptyPool, which will record number of requests being proccessed
-        poolEmpytied = new CountDownLatch(1);
+        poolEmptied = new CountDownLatch(1);
         commitProcessor.commit(createWriteRequest(1L, 1));
-        poolEmpytied.await(5, TimeUnit.SECONDS);
+        poolEmptied.await(5, TimeUnit.SECONDS);
 
         //this will change after we upstream batch write in CommitProcessor
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
index 2de0987afed..2377dc77fae 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
@@ -47,6 +47,7 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -80,14 +81,12 @@ public class CommitProcessorTest extends ZKTestCase {
 
     boolean stopped;
     TestZooKeeperServer zks;
-    File tmpDir;
     ArrayList<TestClientThread> testClients = new ArrayList<>();
     CommitProcessor commitProcessor;
 
-    public void setUp(int numCommitThreads, int numClientThreads, int writePercent) throws Exception {
+    public void setUp(int numCommitThreads, int numClientThreads, int writePercent, File tmpDir) throws Exception {
         stopped = false;
         System.setProperty(CommitProcessor.ZOOKEEPER_COMMIT_PROC_NUM_WORKER_THREADS, Integer.toString(numCommitThreads));
-        tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
         zks = new TestZooKeeperServer(tmpDir, tmpDir, 4000);
         zks.startup();
@@ -102,10 +101,10 @@ public void setUp(
         int numCommitThreads,
         int numReadOnlyClientThreads,
         int mixWorkloadClientThreads,
-        int writePercent) throws Exception {
+        int writePercent,
+        File tmpDir) throws Exception {
         stopped = false;
         System.setProperty(CommitProcessor.ZOOKEEPER_COMMIT_PROC_NUM_WORKER_THREADS, Integer.toString(numCommitThreads));
-        tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
         zks = new TestZooKeeperServer(tmpDir, tmpDir, 4000);
         zks.startup();
@@ -131,9 +130,6 @@ public void tearDown() throws Exception {
             client.interrupt();
             client.join();
         }
-        if (tmpDir != null) {
-            assertTrue(ClientBase.recursiveDelete(tmpDir), "delete " + tmpDir.toString());
-        }
         processedReadRequests.set(0);
         processedWriteRequests.set(0);
         testClients.clear();
@@ -199,10 +195,10 @@ public void run() {
     }
 
     @Test
-    public void testNoCommitWorkersReadOnlyWorkload() throws Exception {
+    public void testNoCommitWorkersReadOnlyWorkload(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testNoCommitWorkersReadOnlyWorkload");
-        setUp(0, numClients, 0);
+        setUp(0, numClients, 0, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
@@ -213,10 +209,10 @@ public void testNoCommitWorkersReadOnlyWorkload() throws Exception {
     }
 
     @Test
-    public void testNoCommitWorkersMixedWorkload() throws Exception {
+    public void testNoCommitWorkersMixedWorkload(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testNoCommitWorkersMixedWorkload 25w/75r workload test");
-        setUp(0, numClients, 25);
+        setUp(0, numClients, 25, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
@@ -225,10 +221,10 @@ public void testNoCommitWorkersMixedWorkload() throws Exception {
     }
 
     @Test
-    public void testOneCommitWorkerReadOnlyWorkload() throws Exception {
+    public void testOneCommitWorkerReadOnlyWorkload(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testOneCommitWorkerReadOnlyWorkload");
-        setUp(1, numClients, 0);
+        setUp(1, numClients, 0, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
@@ -239,8 +235,8 @@ public void testOneCommitWorkerReadOnlyWorkload() throws Exception {
     }
 
     @Test
-    public void testOneCommitWorkerMixedWorkload() throws Exception {
-        setUp(1, 10, 25);
+    public void testOneCommitWorkerMixedWorkload(@TempDir File tmpDir) throws Exception {
+        setUp(1, 10, 25, tmpDir);
         LOG.info("testOneCommitWorkerMixedWorkload 25w/75r workload test");
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
@@ -250,10 +246,10 @@ public void testOneCommitWorkerMixedWorkload() throws Exception {
     }
 
     @Test
-    public void testManyCommitWorkersReadOnly() throws Exception {
+    public void testManyCommitWorkersReadOnly(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testManyCommitWorkersReadOnly");
-        setUp(10, numClients, 0);
+        setUp(10, numClients, 0, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
@@ -264,8 +260,8 @@ public void testManyCommitWorkersReadOnly() throws Exception {
     }
 
     @Test
-    public void testManyCommitWorkersMixedWorkload() throws Exception {
-        setUp(16, 8, 8, 25);
+    public void testManyCommitWorkersMixedWorkload(@TempDir File tmpDir) throws Exception {
+        setUp(16, 8, 8, 25, tmpDir);
         LOG.info("testManyCommitWorkersMixedWorkload 8X0w/100r + 8X25w/75r workload test");
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 4d3c6fba752..12fe04166f8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -43,11 +43,11 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
@@ -60,6 +60,8 @@ public class LeaderBeanTest {
     private LeaderZooKeeperServer zks;
     private QuorumPeer qp;
     private QuorumVerifier quorumVerifierMock;
+    @TempDir
+    File tmpDir;
 
     public static Map<Long, QuorumServer> getMockedPeerViews(long myId) {
         int clientPort = PortAssignment.unique();
@@ -80,7 +82,6 @@ public void setUp() throws IOException, X509Exception {
         when(quorumVerifierMock.getAllMembers()).thenReturn(getMockedPeerViews(qp.getMyId()));
 
         qp.setQuorumVerifier(quorumVerifierMock, false);
-        File tmpDir = ClientBase.createEmptyTestDir();
         fileTxnSnapLog = new FileTxnSnapLog(new File(tmpDir, "data"), new File(tmpDir, "data_txnlog"));
         ZKDatabase zkDb = new ZKDatabase(fileTxnSnapLog);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
index 7ac563698b5..f9de4518344 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
@@ -29,22 +29,22 @@
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.PortAssignment;
-import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class LeaderWithObserverTest {
 
     QuorumPeer peer;
     Leader leader;
+    @TempDir
     File tmpDir;
     long participantId;
     long observerId;
 
     @BeforeEach
     public void setUp() throws Exception {
-        tmpDir = ClientBase.createTmpDir();
         peer = createQuorumPeer(tmpDir);
         participantId = 1;
         Map<Long, QuorumPeer.QuorumServer> peers = peer.getQuorumVerifier().getAllMembers();
@@ -60,7 +60,6 @@ public void setUp() throws Exception {
     @AfterEach
     public void tearDown() {
         leader.shutdown("end of test");
-        tmpDir.delete();
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
index d876c167f94..d64d051b093 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
@@ -50,12 +50,12 @@
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.test.TestUtils;
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class LearnerTest extends ZKTestCase {
 
@@ -269,56 +269,52 @@ public void connectToLearnerMasterLimitTest() throws Exception {
     }
 
     @Test
-    public void syncTest() throws Exception {
-        File tmpFile = File.createTempFile("test", ".dir", testData);
+    public void syncTest(@TempDir File tmpDir) throws Exception {
+        File tmpFile = File.createTempFile("test", ".dir", tmpDir);
         tmpFile.delete();
-        try {
-            FileTxnSnapLog ftsl = new FileTxnSnapLog(tmpFile, tmpFile);
-            SimpleLearner sl = new SimpleLearner(ftsl);
-            long startZxid = sl.zk.getLastProcessedZxid();
-
-            // Set up bogus streams
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
-            sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
-
-            // make streams and socket do something innocuous
-            sl.bufferedOutput = new BufferedOutputStream(System.out);
-            sl.sock = new Socket();
-
-            // fake messages from the server
-            QuorumPacket qp = new QuorumPacket(Leader.SNAP, 0, null, null);
-            oa.writeRecord(qp, null);
-            sl.zk.getZKDatabase().serializeSnapshot(oa);
-            oa.writeString("BenWasHere", "signature");
-            TxnHeader hdr = new TxnHeader(0, 0, 0, 0, ZooDefs.OpCode.create);
-            CreateTxn txn = new CreateTxn("/foo", new byte[0], new ArrayList<ACL>(), false, sl.zk.getZKDatabase().getNode("/").stat.getCversion());
-            ByteArrayOutputStream tbaos = new ByteArrayOutputStream();
-            BinaryOutputArchive boa = BinaryOutputArchive.getArchive(tbaos);
-            hdr.serialize(boa, "hdr");
-            txn.serialize(boa, "txn");
-            tbaos.close();
-            qp = new QuorumPacket(Leader.PROPOSAL, 1, tbaos.toByteArray(), null);
-            oa.writeRecord(qp, null);
-
-            // setup the messages to be streamed to follower
-            sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
-
-            try {
-                sl.syncWithLeader(3);
-            } catch (EOFException e) {
-            }
+        FileTxnSnapLog ftsl = new FileTxnSnapLog(tmpFile, tmpFile);
+        SimpleLearner sl = new SimpleLearner(ftsl);
+        long startZxid = sl.zk.getLastProcessedZxid();
+
+        // Set up bogus streams
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
+        sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
+
+        // make streams and socket do something innocuous
+        sl.bufferedOutput = new BufferedOutputStream(System.out);
+        sl.sock = new Socket();
+
+        // fake messages from the server
+        QuorumPacket qp = new QuorumPacket(Leader.SNAP, 0, null, null);
+        oa.writeRecord(qp, null);
+        sl.zk.getZKDatabase().serializeSnapshot(oa);
+        oa.writeString("BenWasHere", "signature");
+        TxnHeader hdr = new TxnHeader(0, 0, 0, 0, ZooDefs.OpCode.create);
+        CreateTxn txn = new CreateTxn("/foo", new byte[0], new ArrayList<ACL>(), false, sl.zk.getZKDatabase().getNode("/").stat.getCversion());
+        ByteArrayOutputStream tbaos = new ByteArrayOutputStream();
+        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(tbaos);
+        hdr.serialize(boa, "hdr");
+        txn.serialize(boa, "txn");
+        tbaos.close();
+        qp = new QuorumPacket(Leader.PROPOSAL, 1, tbaos.toByteArray(), null);
+        oa.writeRecord(qp, null);
+
+        // setup the messages to be streamed to follower
+        sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
 
-            sl.zk.shutdown();
-            sl = new SimpleLearner(ftsl);
-            assertEquals(startZxid, sl.zk.getLastProcessedZxid());
-        } finally {
-            TestUtils.deleteFileRecursively(tmpFile);
+        try {
+            sl.syncWithLeader(3);
+        } catch (EOFException e) {
         }
+
+        sl.zk.shutdown();
+        sl = new SimpleLearner(ftsl);
+        assertEquals(startZxid, sl.zk.getLastProcessedZxid());
     }
 
     @Test
-    public void truncFailTest() throws Exception {
+    public void truncFailTest(@TempDir File tmpDir) throws Exception {
         final boolean[] exitProcCalled = {false};
 
         ServiceUtils.setSystemExitProcedure(new Consumer<Integer>() {
@@ -329,39 +325,35 @@ public void accept(Integer exitCode) {
             }
         });
 
-        File tmpFile = File.createTempFile("test", ".dir", testData);
+        File tmpFile = File.createTempFile("test", ".dir", tmpDir);
         tmpFile.delete();
-        try {
-            FileTxnSnapLog txnSnapLog = new FileTxnSnapLog(tmpFile, tmpFile);
-            SimpleLearner sl = new SimpleLearner(txnSnapLog);
-            long startZxid = sl.zk.getLastProcessedZxid();
+        FileTxnSnapLog txnSnapLog = new FileTxnSnapLog(tmpFile, tmpFile);
+        SimpleLearner sl = new SimpleLearner(txnSnapLog);
+        long startZxid = sl.zk.getLastProcessedZxid();
 
-            // Set up bogus streams
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
-            sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
+        // Set up bogus streams
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
+        sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
 
-            // make streams and socket do something innocuous
-            sl.bufferedOutput = new BufferedOutputStream(System.out);
-            sl.sock = new Socket();
+        // make streams and socket do something innocuous
+        sl.bufferedOutput = new BufferedOutputStream(System.out);
+        sl.sock = new Socket();
 
-            // fake messages from the server
-            QuorumPacket qp = new QuorumPacket(Leader.TRUNC, 0, null, null);
-            oa.writeRecord(qp, null);
+        // fake messages from the server
+        QuorumPacket qp = new QuorumPacket(Leader.TRUNC, 0, null, null);
+        oa.writeRecord(qp, null);
 
-            // setup the messages to be streamed to follower
-            sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
+        // setup the messages to be streamed to follower
+        sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
 
-            try {
-                sl.syncWithLeader(3);
-            } catch (EOFException e) {
-            }
+        try {
+            sl.syncWithLeader(3);
+        } catch (EOFException e) {
+        }
 
-            sl.zk.shutdown();
+        sl.zk.shutdown();
 
-            assertThat("System.exit() should have been called", exitProcCalled[0], is(true));
-        } finally {
-            TestUtils.deleteFileRecursively(tmpFile);
-        }
+        assertThat("System.exit() should have been called", exitProcCalled[0], is(true));
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
index b832f4f9679..65e5fa59037 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
@@ -30,8 +30,8 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class QuorumPeerTest {
 
@@ -45,9 +45,8 @@ public class QuorumPeerTest {
      * Test case for https://issues.apache.org/jira/browse/ZOOKEEPER-2301
      */
     @Test
-    public void testQuorumPeerListendOnSpecifiedClientIP() throws IOException {
+    public void testQuorumPeerListendOnSpecifiedClientIP(@TempDir File dataDir) throws IOException {
         long myId = 1;
-        File dataDir = ClientBase.createTmpDir();
         int clientPort = PortAssignment.unique();
         Map<Long, QuorumServer> peersView = new HashMap<>();
         InetAddress clientIP = InetAddress.getLoopbackAddress();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
index 3400a288301..05b67debcda 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
@@ -34,7 +34,6 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
-import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.ClientX509Util;
@@ -42,11 +41,11 @@
 import org.apache.zookeeper.common.X509KeyType;
 import org.apache.zookeeper.common.X509TestContext;
 import org.apache.zookeeper.common.X509Util;
-import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
@@ -60,8 +59,8 @@
 public class UnifiedServerSocketModeDetectionTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(UnifiedServerSocketModeDetectionTest.class);
-
-    private static File tempDir;
+    @TempDir
+    static File tempDir;
     private static X509TestContext x509TestContext;
 
     private X509Util x509Util;
@@ -75,17 +74,11 @@ public class UnifiedServerSocketModeDetectionTest extends ZKTestCase {
     @BeforeAll
     public static void setUpClass() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
-        tempDir = ClientBase.createEmptyTestDir();
         x509TestContext = X509TestContext.newBuilder().setTempDir(tempDir).setKeyStoreKeyType(X509KeyType.EC).setTrustStoreKeyType(X509KeyType.EC).build();
     }
 
     @AfterAll
     public static void tearDownClass() {
-        try {
-            FileUtils.deleteDirectory(tempDir);
-        } catch (IOException e) {
-            // ignore
-        }
         Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index f0db38e2675..2a4ebaa509c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -69,6 +69,7 @@
 import org.apache.zookeeper.txn.TxnHeader;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -76,8 +77,6 @@ public class Zab1_0Test extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(Zab1_0Test.class);
 
-    private static final File testData = new File(System.getProperty("test.data.dir", "src/test/resources/data"));
-
     @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.admin.enableServer", "false");
@@ -136,7 +135,7 @@ public void run() {
 
     }
     @Test
-    public void testLeaderInConnectingFollowers() throws Exception {
+    public void testLeaderInConnectingFollowers(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -190,7 +189,7 @@ public void testLeaderInConnectingFollowers() throws Exception {
      */
 
     @Test
-    public void testLastAcceptedEpoch() throws Exception {
+    public void testLastAcceptedEpoch(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -228,7 +227,7 @@ public void testLastAcceptedEpoch() throws Exception {
     }
 
     @Test
-    public void testLeaderInElectingFollowers() throws Exception {
+    public void testLeaderInElectingFollowers(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -302,7 +301,7 @@ public interface ObserverConversation {
 
     }
 
-    public void testLeaderConversation(LeaderConversation conversation) throws Exception {
+    public void testLeaderConversation(LeaderConversation conversation, File testData) throws Exception {
         Socket[] pair = getSocketPair();
         Socket leaderSocket = pair[0];
         Socket followerSocket = pair[1];
@@ -342,7 +341,7 @@ public void testLeaderConversation(LeaderConversation conversation) throws Excep
         }
     }
 
-    public void testPopulatedLeaderConversation(PopulatedLeaderConversation conversation, int ops) throws Exception {
+    public void testPopulatedLeaderConversation(PopulatedLeaderConversation conversation, int ops, File testData) throws Exception {
         Socket[] pair = getSocketPair();
         Socket leaderSocket = pair[0];
         Socket followerSocket = pair[1];
@@ -408,7 +407,7 @@ public void testPopulatedLeaderConversation(PopulatedLeaderConversation conversa
         }
     }
 
-    public void testFollowerConversation(FollowerConversation conversation) throws Exception {
+    public void testFollowerConversation(FollowerConversation conversation, File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -458,7 +457,7 @@ public void run() {
         }
     }
 
-    public void testObserverConversation(ObserverConversation conversation) throws Exception {
+    public void testObserverConversation(ObserverConversation conversation, File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -508,7 +507,7 @@ public void run() {
     }
 
     @Test
-    public void testUnnecessarySnap() throws Exception {
+    public void testUnnecessarySnap(@TempDir File testData) throws Exception {
         testPopulatedLeaderConversation(new PopulatedLeaderConversation() {
             @Override
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l, long zxid) throws Exception {
@@ -540,7 +539,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l, long
                 assertEquals(Leader.DIFF, qp.getType());
 
             }
-        }, 2);
+        }, 2, testData);
     }
 
     // We want to track the change with a callback rather than depending on timing
@@ -568,7 +567,7 @@ public synchronized boolean changed() {
     }
 
     @Test
-    public void testNormalFollowerRun() throws Exception {
+    public void testNormalFollowerRun(@TempDir File testData) throws Exception {
         testFollowerConversation(new FollowerConversation() {
             @Override
             public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f) throws Exception {
@@ -698,11 +697,11 @@ private void proposeSetData(QuorumPacket qp, long zxid, String data, int version
                 boa.writeRecord(sdt, null);
                 qp.setData(baos.toByteArray());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testNormalFollowerRunWithDiff() throws Exception {
+    public void testNormalFollowerRunWithDiff(@TempDir File testData) throws Exception {
         testFollowerConversation(new FollowerConversation() {
             @Override
             public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f) throws Exception {
@@ -819,11 +818,11 @@ private void proposeNewSession(QuorumPacket qp, long zxid, long sessionId) throw
                 boa.writeRecord(cst, null);
                 qp.setData(baos.toByteArray());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testNormalRun() throws Exception {
+    public void testNormalRun(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException {
                 assertEquals(0, l.self.getAcceptedEpoch());
@@ -861,11 +860,11 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 readPacketSkippingPing(ia, qp);
                 assertEquals(Leader.UPTODATE, qp.getType());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testTxnTimeout() throws Exception {
+    public void testTxnTimeout(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException, InterruptedException, org.apache.zookeeper.server.quorum.Leader.XidRolloverException {
                 assertEquals(0, l.self.getAcceptedEpoch());
@@ -922,7 +921,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 }
                 fail("Connection hasn't been closed by leader after transaction times out.");
             }
-        });
+        }, testData);
     }
 
     private void deserializeSnapshot(InputArchive ia) throws IOException {
@@ -933,7 +932,7 @@ private void deserializeSnapshot(InputArchive ia) throws IOException {
     }
 
     @Test
-    public void testNormalObserverRun() throws Exception {
+    public void testNormalObserverRun(@TempDir File testData) throws Exception {
         testObserverConversation(new ObserverConversation() {
             @Override
             public void converseWithObserver(InputArchive ia, OutputArchive oa, Observer o) throws Exception {
@@ -1066,11 +1065,11 @@ private void proposeSetData(QuorumPacket qp, String path, long zxid, String data
                 boa.writeRecord(sdt, null);
                 qp.setData(baos.toByteArray());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testLeaderBehind() throws Exception {
+    public void testLeaderBehind(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException {
                 /* we test a normal run. everything should work out well. */
@@ -1098,7 +1097,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 readPacketSkippingPing(ia, qp);
                 assertEquals(Leader.UPTODATE, qp.getType());
             }
-        });
+        }, testData);
     }
 
     /**
@@ -1108,7 +1107,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
      * @throws Exception
      */
     @Test
-    public void testAbandonBeforeACKEpoch() throws Exception {
+    public void testAbandonBeforeACKEpoch(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException, InterruptedException {
                 /* we test a normal run. everything should work out well. */
@@ -1126,7 +1125,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 // The leader didn't get a quorum of acks - make sure that leader's current epoch is not advanced
                 assertEquals(0, l.self.getCurrentEpoch());
             }
-        });
+        }, testData);
     }
 
     static class ConversableFollower extends Follower {
@@ -1187,7 +1186,7 @@ private String readContentsOfFile(File f) throws IOException {
     }
 
     @Test
-    public void testInitialAcceptedCurrent() throws Exception {
+    public void testInitialAcceptedCurrent(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", ".dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
index aa1b43400ce..8ab6644ddbf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
@@ -18,14 +18,11 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
-import java.io.IOException;
 import java.util.Properties;
-import org.apache.commons.io.FileUtils;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.io.TempDir;
 
 /*
  * This code is originally from HDFS, see the similarly named file there
@@ -48,7 +45,8 @@
 public class KerberosSecurityTestcase extends QuorumAuthTestBase {
 
     private static MiniKdc kdc;
-    private static File workDir;
+    @TempDir
+    static File workDir;
     private static Properties conf;
 
     @BeforeAll
@@ -59,39 +57,15 @@ public static void setUpSasl() throws Exception {
     @AfterAll
     public static void tearDownSasl() throws Exception {
         stopMiniKdc();
-        FileUtils.deleteQuietly(workDir);
     }
 
     public static void startMiniKdc() throws Exception {
-        createTestDir();
         createMiniKdcConf();
 
         kdc = new MiniKdc(conf, workDir);
         kdc.start();
     }
 
-    /**
-     * Create a working directory, it should be the build directory. Under this
-     * directory an ApacheDS working directory will be created, this directory
-     * will be deleted when the MiniKdc stops.
-     *
-     * @throws IOException
-     */
-    public static void createTestDir() throws IOException {
-        workDir = createTmpDir(new File(System.getProperty("build.test.dir", "build")));
-    }
-
-    static File createTmpDir(File parentDir) throws IOException {
-        File tmpFile = File.createTempFile("test", ".junit", parentDir);
-        // don't delete tmpFile - this ensures we don't attempt to create
-        // a tmpDir with a duplicate name
-        File tmpDir = new File(tmpFile + ".dir");
-        // never true if tmpfile does it's job
-        assertFalse(tmpDir.exists());
-        assertTrue(tmpDir.mkdirs());
-        return tmpDir;
-    }
-
     /**
      * Create a Kdc configuration
      */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
index 2b9cc9c7b36..a81f4f1bb00 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
@@ -36,6 +36,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,8 +59,7 @@ public class ACLCountTest extends ZKTestCase {
      * since there are only 2 *unique* ACL values.
      */
     @Test
-    public void testAclCount() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testAclCount(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
index 965d99c4ca7..e66592e49e9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
@@ -49,6 +49,7 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -69,11 +70,10 @@ public void testIPAuthenticationIsValidCIDR() throws Exception {
     }
 
     @Test
-    public void testNettyIpAuthDefault() throws Exception {
+    public void testNettyIpAuthDefault(@TempDir File tmpDir) throws Exception {
         String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
         ClientBase.setupTestEnv();
-        File tmpDir = ClientBase.createTmpDir();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -102,8 +102,7 @@ public void testNettyIpAuthDefault() throws Exception {
     }
 
     @Test
-    public void testDisconnectedAddAuth() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testDisconnectedAddAuth(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
@@ -133,8 +132,7 @@ public void testDisconnectedAddAuth() throws Exception {
      * node is actually working.
      */
     @Test
-    public void testAcls() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testAcls(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
@@ -223,8 +221,7 @@ public void process(WatchedEvent event) {
     }
 
     @Test
-    public void testNullACL() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testNullACL(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -264,8 +261,7 @@ public void testNullACL() throws Exception {
     }
 
     @Test
-    public void testNullValueACL() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testNullValueACL(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -309,8 +305,7 @@ public void testNullValueACL() throws Exception {
     }
 
     @Test
-    public void testExistACLCheck() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testExistACLCheck(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -359,8 +354,7 @@ public void testExistACLCheck() throws Exception {
     }
 
     @Test
-    public void testExistACLCheckAtRootPath() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testExistACLCheckAtRootPath(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
index 767a24481ce..5061c5f4df3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
@@ -33,6 +33,7 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +45,7 @@ public class ClientPortBindTest extends ZKTestCase {
      * Verify that the server binds to the specified address
      */
     @Test
-    public void testBindByAddress() throws Exception {
+    public void testBindByAddress(@TempDir File tmpDir) throws Exception {
         String bindAddress = null;
         Enumeration<NetworkInterface> intfs = NetworkInterface.getNetworkInterfaces();
         // if we have a loopback and it has an address use it
@@ -78,8 +79,6 @@ public void testBindByAddress() throws Exception {
         final String HOSTPORT = bindAddress + ":" + PORT;
         LOG.info("Using {} as the host/port", HOSTPORT);
 
-        File tmpDir = ClientBase.createTmpDir();
-
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
index 2f9c1e58d18..46ff5880bbb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
@@ -37,6 +37,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -61,8 +62,7 @@ public class RecoveryTest extends ZKTestCase implements Watcher {
      * that the server is down (ping) then the op will throw connectionloss.
      */
     @Test
-    public void testRecovery() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testRecovery(@TempDir File tmpDir) throws Exception {
 
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);

From 4f35790b30dd5918bcc02558716d124648966571 Mon Sep 17 00:00:00 2001
From: yzx1983 <yzx_1983@outlook.com>
Date: Fri, 9 Feb 2024 19:22:18 +0800
Subject: [PATCH 434/591] =?UTF-8?q?ZOOKEEPER-4782:=20The=20installation=20?=
 =?UTF-8?q?guide=20in=20zookeeper-client/zookeeper-=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ZOOKEEPER-4782: The installation guide in zookeeper-client/zookeeper-client-c/README is outdated.
Reviewers: anmolnar
Author: yzx1983
Closes #2101 from yzx1983/master-fixcclientdoc
---
 zookeeper-client/zookeeper-client-c/README | 66 +---------------------
 1 file changed, 2 insertions(+), 64 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/README b/zookeeper-client/zookeeper-client-c/README
index ade5ad98fa1..24869756b63 100644
--- a/zookeeper-client/zookeeper-client-c/README
+++ b/zookeeper-client/zookeeper-client-c/README
@@ -34,70 +34,8 @@ Sync and Async API.
 
 INSTALLATION
 
-If you're building the client from a source checkout you need to
-follow the steps outlined below. If you're building from a release
-tar downloaded from Apache please skip to step 2.
-
-1) do a "ant compile_jute" from the zookeeper top level directory (.../trunk).
-   This will create a directory named "generated" under zookeeper-client/zookeeper-client-c.
-   Skip to step 3.
-2) unzip/untar the source tarball and cd to the zookeeper-x.x.x/zookeeper-client/zookeeper-client-c directory
-3) change directory to zookeeper-client/zookeeper-client-c and do a "autoreconf -if" to bootstrap
-   autoconf, automake and libtool. Please make sure you have autoconf
-   version 2.59 or greater installed. If cppunit is installed in a non-standard
-   directory, you need to specify where to find cppunit.m4. For example, if
-   cppunit is installed under /usr/local, run:
-   
-       ACLOCAL="aclocal -I /usr/local/share/aclocal" autoreconf -if
-
-4) do a "./configure [OPTIONS]" to generate the makefile. See INSTALL
-   for general information about running configure. Additionally, the
-   configure supports the following options:
-   --enable-debug     enables optimization and enables debug info compiler
-                      options, disabled by default
-   --without-syncapi  disables Sync API support; zookeeper_mt library won't
-                      be built, enabled by default
-   --disable-static   do not build static libraries, enabled by default
-   --disable-shared   do not build shared libraries, enabled by default
-   --without-cppunit  do not build the test library, enabled by default.
-
-5) do a "make" or "make install" to build the libraries and install them. 
-   Alternatively, you can also build and run a unit test suite (and
-   you probably should).  Please make sure you have cppunit-1.10.x or
-   higher installed before you execute step 4.  Once ./configure has
-   finished, do a "make check". It will build the libraries, build
-   the tests and run them.
-6) to generate doxygen documentation do a "make doxygen-doc". All
-   documentations will be placed to a new subfolder named docs. By
-   default only HTML documentation is generated.  For information on
-   other document formats please use "./configure --help"
-
-Alternatively you can use the CMake build system. On Windows, this is required.
-Follow steps 1 and 2 above, and then continue here.
-
-1) do a "cmake [OPTIONS]" to generate the makefile or msbuild files (the correct
-   build system will be generated based on your platform). Some options from above
-   are supported:
-   -DCMAKE_BUILD_TYPE  Debug by default, Release enables optimzation etc.
-   -DWANT_SYNCAPI      ON by default, OFF disables the Sync API support
-   -DWANT_CPPUNIT      ON except on Windows, OFF disables the tests
-   -DWITH_OPENSSL      ON by default, OFF disables the SSL support. You can also
-                       specify a custom path by -DWITH_OPENSSL=/path/to/openssl/
-   -DWITH_CYRUS_SASL   ON by default, OFF disables SASL support. You can also
-                       specify a custom path by -DWITH_CYRUS_SASL=/path/to/cyrus-sasl/
-   -DBUILD_SHARED_LIBS not yet supported, only static libraries are built
-   other CMake options see "cmake --help" for generic options, such as generator
-
-2) do a "cmake --build ." to build the default targets. Alternatively you can
-   invoke "make" or "msbuild" manually. If the tests were enabled, use "ctest -V"
-   to run them.
-
-Current limitations of the CMake build system include lack of Solaris support,
-no shared library option, no explicitly exported symbols (all are exported by
-default), no versions on the libraries, and no documentation generation.
-Features of CMake include a single, easily consumed cross-platform build system
-to generate the ZooKeeper C Client libraries for any project, with little to no
-configuration.
+Please refer to the "Installation" item under "C Binding" section in file
+".../trunk/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md"
 
 EXAMPLE/SAMPLE C CLIENT SHELL
 

From e571dd81464802766191e2040602846ae1aa3f77 Mon Sep 17 00:00:00 2001
From: szucsvillo <81696283+szucsvillo@users.noreply.github.com>
Date: Fri, 9 Feb 2024 12:23:51 +0100
Subject: [PATCH 435/591] ZOOKEEPER-4784: Token based ASF JIRA authentication

Reviewers: anmolnar, anmolnar
Author: szucsvillo
Closes #2106 from szucsvillo/ZOOKEEPER-4784
---
 zk-merge-pr.py | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/zk-merge-pr.py b/zk-merge-pr.py
index 5358cbd97c8..932582b926b 100755
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -54,6 +54,11 @@
 JIRA_USERNAME = os.environ.get("JIRA_USERNAME", "")
 # ASF JIRA password
 JIRA_PASSWORD = os.environ.get("JIRA_PASSWORD", "")
+# ASF JIRA access token
+# If it is configured, username and password are dismissed
+# Go to https://issues.apache.org/jira/secure/ViewProfile.jspa -> Personal Access Tokens for
+# your own token management.
+JIRA_ACCESS_TOKEN = os.environ.get("JIRA_ACCESS_TOKEN")
 # OAuth key used for issuing requests against the GitHub API. If this is not defined, then requests
 # will be unauthenticated. You should only need to configure this if you find yourself regularly
 # exceeding your IP's unauthenticated request rate limit. You can create an OAuth key at
@@ -249,8 +254,12 @@ def fix_version_from_branch(branch, versions):
 
 
 def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
-    asf_jira = jira.client.JIRA({'server': JIRA_API_BASE},
-                                basic_auth=(JIRA_USERNAME, JIRA_PASSWORD))
+    jira_server = {"server": JIRA_API_BASE}
+
+    if JIRA_ACCESS_TOKEN is not None:
+        asf_jira = jira.client.JIRA(jira_server, token_auth=JIRA_ACCESS_TOKEN)
+    else:
+        asf_jira = jira.client.JIRA(jira_server, basic_auth=(JIRA_USERNAME, JIRA_PASSWORD))
 
     jira_id = input("Enter a JIRA id [%s]: " % default_jira_id)
     if jira_id == "":
@@ -400,15 +409,15 @@ def check_jira_env():
     global JIRA_PASSWORD
 
     if JIRA_IMPORTED:
-
-       if JIRA_USERNAME.strip() != "" and JIRA_PASSWORD.strip() == "":
-           inform_pwd = input("JIRA_USERNAME set but JIRA_PASSWORD is not. Want to inform it? ")
-           if inform_pwd.strip() == "y":
-               JIRA_PASSWORD = getpass.getpass('JIRA PASSWORD: ')
-
-       if JIRA_USERNAME.strip() == "" or JIRA_PASSWORD.strip() == "":
-           msg ="JIRA_USERNAME and/or JIRA_PASSWORD are not set. Want to continue? "
-           continue_maybe(msg)
+        if JIRA_ACCESS_TOKEN is None:
+            if JIRA_USERNAME.strip() != "" and JIRA_PASSWORD.strip() == "":
+                inform_pwd = input("JIRA_USERNAME set but JIRA_PASSWORD is not. Want to inform it? ")
+                if inform_pwd.strip() == "y":
+                    JIRA_PASSWORD = getpass.getpass('JIRA PASSWORD: ')
+
+            if JIRA_USERNAME.strip() == "" or JIRA_PASSWORD.strip() == "":
+                msg ="Neither JIRA_ACCESS_TOKEN nor JIRA_USERNAME and/or JIRA_PASSWORD are set. Want to continue? "
+                continue_maybe(msg)
     else:
         msg = "JIRA lib not installed. Want to continue? "
         continue_maybe(msg)
@@ -499,12 +508,12 @@ def main():
         merged_refs = merged_refs + [cherry_pick(pr_num, merge_hash, latest_branch)]
 
     if JIRA_IMPORTED:
-        if JIRA_USERNAME and JIRA_PASSWORD:
+        if (JIRA_ACCESS_TOKEN is not None) or (JIRA_USERNAME and JIRA_PASSWORD):
             continue_maybe("Would you like to update an associated JIRA?")
             jira_comment = "Issue resolved by pull request %s\n[%s/%s]" % (pr_num, GITHUB_BASE, pr_num)
             resolve_jira_issues(commit_title, merged_refs, jira_comment)
         else:
-            print("JIRA_USERNAME and JIRA_PASSWORD not set")
+            print("Neither JIRA_ACCESS_TOKEN nor JIRA_USERNAME and/or JIRA_PASSWORD are set.")
             print("Exiting without trying to close the associated JIRA.")
     else:
         print("Could not find jira-python library. Run 'sudo pip install jira' to install.")

From 18c78cd10bc02d764a46ac1659b263cf69f2671d Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Sat, 10 Feb 2024 00:32:53 +0800
Subject: [PATCH 436/591] ZOOKEEPER-4794: Reduce the ZKDatabase#committedLog
 memory usage.

Reduce the committed log memory usage.
Fix ci.
Reviewers: eolivelli, hangc0276, anmolnar
Author: horizonzy
Closes #2115 from horizonzy/reduce-committed-log-memory-usage
---
 .../org/apache/zookeeper/server/Request.java  | 19 ++-----
 .../server/TxnLogProposalIterator.java        |  7 ++-
 .../apache/zookeeper/server/ZKDatabase.java   | 13 ++---
 .../zookeeper/server/quorum/Leader.java       | 54 +++++++++++++++++--
 .../server/quorum/LearnerHandler.java         |  4 +-
 .../quorum/flexible/QuorumOracleMaj.java      | 10 ++--
 .../server/quorum/LeaderWithObserverTest.java |  5 +-
 .../server/quorum/LearnerHandlerTest.java     | 14 ++---
 .../test/GetProposalFromTxnTest.java          |  2 +-
 .../test/LocalSessionRequestTest.java         |  4 +-
 10 files changed, 82 insertions(+), 50 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 10111c8a64f..27fa4e2dff7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -19,7 +19,6 @@
 package org.apache.zookeeper.server;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.List;
@@ -169,24 +168,16 @@ public boolean isThrottlable() {
                 && this.type != OpCode.createSession;
     }
 
-    private transient byte[] serializeData;
-
-    @SuppressFBWarnings(value = "EI_EXPOSE_REP")
     public byte[] getSerializeData() {
         if (this.hdr == null) {
             return null;
         }
-
-        if (this.serializeData == null) {
-            try {
-                this.serializeData = Util.marshallTxnEntry(this.hdr, this.txn, this.txnDigest);
-            } catch (IOException e) {
-                LOG.error("This really should be impossible.", e);
-                this.serializeData = new byte[32];
-            }
+        try {
+            return Util.marshallTxnEntry(this.hdr, this.txn, this.txnDigest);
+        } catch (IOException e) {
+            LOG.error("This really should be impossible.", e);
+            return new byte[32];
         }
-
-        return this.serializeData;
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java
index 847e3b2fabe..2d6ecb631fe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java
@@ -58,20 +58,19 @@ public boolean hasNext() {
     @Override
     public Proposal next() {
 
-        Proposal p = new Proposal();
+        Proposal p;
         try {
             byte[] serializedData = Util.marshallTxnEntry(itr.getHeader(), itr.getTxn(), itr.getDigest());
 
             QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, itr.getHeader().getZxid(), serializedData, null);
-            p.packet = pp;
-            p.request = null;
-
+            p = new Proposal(pp);
             // This is the only place that can throw IO exception
             hasNext = itr.next();
 
         } catch (IOException e) {
             LOG.error("Unable to read txnlog from disk", e);
             hasNext = false;
+            p = new Proposal();
         }
 
         return p;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index eaad05cd295..d98c97f2c07 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -54,9 +54,8 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.PlayBackListener;
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
-import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
-import org.apache.zookeeper.server.quorum.QuorumPacket;
+import org.apache.zookeeper.server.quorum.Leader.PureRequestProposal;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.txn.TxnDigest;
@@ -323,19 +322,15 @@ public void addCommittedProposal(Request request) {
             wl.lock();
             if (committedLog.size() > commitLogCount) {
                 committedLog.remove();
-                minCommittedLog = committedLog.peek().packet.getZxid();
+                minCommittedLog = committedLog.peek().getZxid();
             }
             if (committedLog.isEmpty()) {
                 minCommittedLog = request.zxid;
                 maxCommittedLog = request.zxid;
             }
-            byte[] data = request.getSerializeData();
-            QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
-            Proposal p = new Proposal();
-            p.packet = pp;
-            p.request = request;
+            PureRequestProposal p = new PureRequestProposal(request);
             committedLog.add(p);
-            maxCommittedLog = p.packet.getZxid();
+            maxCommittedLog = p.getZxid();
         } finally {
             wl.unlock();
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 3b9c827c340..0b57bb1824a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -88,14 +88,60 @@ public class Leader extends LearnerMaster {
 
     public static class Proposal extends SyncedLearnerTracker {
 
-        public QuorumPacket packet;
-        public Request request;
+        private QuorumPacket packet;
+        protected Request request;
+
+        public Proposal() {
+        }
+
+        public Proposal(QuorumPacket packet) {
+            this.packet = packet;
+        }
+
+        public Proposal(Request request, QuorumPacket packet) {
+            this.request = request;
+            this.packet = packet;
+        }
+
+        public QuorumPacket getQuorumPacket() {
+            return packet;
+        }
+
+        public Request getRequest() {
+            return request;
+        }
+
+        public long getZxid() {
+            return packet.getZxid();
+        }
 
         @Override
         public String toString() {
             return packet.getType() + ", " + packet.getZxid() + ", " + request;
         }
+    }
 
+    public static class PureRequestProposal extends Proposal {
+
+        public PureRequestProposal(Request request) {
+            this.request = request;
+        }
+
+        @Override
+        public QuorumPacket getQuorumPacket() {
+            byte[] data = request.getSerializeData();
+            return new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
+        }
+
+        @Override
+        public long getZxid() {
+            return request.zxid;
+        }
+
+        @Override
+        public String toString() {
+            return request.toString();
+        }
     }
 
     // log ack latency if zxid is a multiple of ackLoggingFrequency. If <=0, disable logging.
@@ -1258,9 +1304,7 @@ public Proposal propose(Request request) throws XidRolloverException {
         proposalStats.setLastBufferSize(data.length);
         QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
 
-        Proposal p = new Proposal();
-        p.packet = pp;
-        p.request = request;
+        Proposal p = new Proposal(request, pp);
 
         synchronized (this) {
             p.addQuorumVerifier(self.getQuorumVerifier());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index e9d5cd4e5e8..049336a16ee 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -957,7 +957,7 @@ protected long queueCommittedProposals(Iterator<Proposal> itr, long peerLastZxid
         while (itr.hasNext()) {
             Proposal propose = itr.next();
 
-            long packetZxid = propose.packet.getZxid();
+            long packetZxid = propose.getZxid();
             // abort if we hit the limit
             if ((maxZxid != null) && (packetZxid > maxZxid)) {
                 break;
@@ -1020,7 +1020,7 @@ protected long queueCommittedProposals(Iterator<Proposal> itr, long peerLastZxid
 
             // Since this is already a committed proposal, we need to follow
             // it by a commit packet
-            queuePacket(propose.packet);
+            queuePacket(propose.getQuorumPacket());
             queueOpPacket(Leader.COMMIT, packetZxid);
             queuedZxid = packetZxid;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
index 01f3a8240be..b3e7fa24926 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
@@ -123,18 +123,18 @@ public boolean revalidateOutstandingProp(Leader self, ArrayList<Leader.Proposal>
         LOG.debug("Start Revalidation outstandingProposals");
         try {
             while (outstandingProposal.size() >= 1) {
-                outstandingProposal.sort((o1, o2) -> (int) (o1.packet.getZxid() - o2.packet.getZxid()));
+                outstandingProposal.sort((o1, o2) -> (int) (o1.getZxid() - o2.getZxid()));
 
                 Leader.Proposal p;
                 int i = 0;
                 while (i < outstandingProposal.size()) {
                     p = outstandingProposal.get(i);
-                    if (p.request.zxid > lastCommitted) {
-                        LOG.debug("Re-validate outstanding proposal: 0x{} size:{} lastCommitted:{}", Long.toHexString(p.request.zxid), outstandingProposal.size(), Long.toHexString(lastCommitted));
-                        if (!self.tryToCommit(p, p.request.zxid, null)) {
+                    if (p.getZxid() > lastCommitted) {
+                        LOG.debug("Re-validate outstanding proposal: 0x{} size:{} lastCommitted:{}", Long.toHexString(p.getZxid()), outstandingProposal.size(), Long.toHexString(lastCommitted));
+                        if (!self.tryToCommit(p, p.getZxid(), null)) {
                             break;
                         } else {
-                            lastCommitted = p.request.zxid;
+                            lastCommitted = p.getZxid();
                             outstandingProposal.remove(p);
                         }
                     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
index f9de4518344..518dcef0f6c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
@@ -25,6 +25,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.lang.reflect.Field;
 import java.net.InetSocketAddress;
 import java.util.Map;
 import java.util.Set;
@@ -143,7 +144,9 @@ public void testWaitForNewLeaderAck() throws Exception {
         long zxid = leader.zk.getZxid();
 
         // things needed for waitForNewLeaderAck to run (usually in leader.lead(), but we're not running leader here)
-        leader.newLeaderProposal.packet = new QuorumPacket(0, zxid, null, null);
+        Field field = Leader.Proposal.class.getDeclaredField("packet");
+        field.setAccessible(true);
+        field.set(leader.newLeaderProposal, new QuorumPacket(0, zxid, null, null));
         leader.newLeaderProposal.addQuorumVerifier(peer.getQuorumVerifier());
 
         Set<Long> ackSet = leader.newLeaderProposal.qvAcksetPairs.get(0).getAckset();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
index bbf36367ef0..43202716d2b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
@@ -86,14 +86,14 @@ public long getDataTreeLastProcessedZxid() {
 
         public long getmaxCommittedLog() {
             if (!committedLog.isEmpty()) {
-                return committedLog.getLast().packet.getZxid();
+                return committedLog.getLast().getZxid();
             }
             return 0;
         }
 
         public long getminCommittedLog() {
             if (!committedLog.isEmpty()) {
-                return committedLog.getFirst().packet.getZxid();
+                return committedLog.getFirst().getZxid();
             }
             return 0;
         }
@@ -107,7 +107,7 @@ public ReentrantReadWriteLock getLogLock() {
         }
 
         public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
-            if (peerZxid >= txnLog.peekFirst().packet.getZxid()) {
+            if (peerZxid >= txnLog.peekFirst().getZxid()) {
                 return txnLog.iterator();
             } else {
                 return Collections.emptyIterator();
@@ -150,10 +150,10 @@ public Long answer(InvocationOnMock invocation) {
     }
 
     Proposal createProposal(long zxid) {
-        Proposal p = new Proposal();
-        p.packet = new QuorumPacket();
-        p.packet.setZxid(zxid);
-        p.packet.setType(Leader.PROPOSAL);
+        QuorumPacket packet = new QuorumPacket();
+        packet.setZxid(zxid);
+        packet.setType(Leader.PROPOSAL);
+        Proposal p = new Proposal(packet);
         return p;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
index 010d69b3365..a85e76d01ec 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
@@ -107,7 +107,7 @@ public void testGetProposalFromTxn() throws Exception {
         while (itr.hasNext()) {
             Proposal proposal = itr.next();
             TxnLogEntry logEntry = SerializeUtils.deserializeTxn(
-                    proposal.packet.getData());
+                    proposal.getQuorumPacket().getData());
             TxnHeader hdr = logEntry.getHeader();
             Record rec = logEntry.getTxn();
             if (hdr.getType() == OpCode.create) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
index 1c1c72e1a82..16a470c31d8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
@@ -82,8 +82,8 @@ private void validateRequestLog(long sessionId, int peerId) {
         QuorumPeer peer = qb.getPeerList().get(peerId);
         ZKDatabase db = peer.getActiveServer().getZKDatabase();
         for (Proposal p : db.getCommittedLog()) {
-            assertFalse(p.request.sessionId == sessionId,
-                    "Should not see " + Request.op2String(p.request.type)
+            assertFalse(p.getRequest().sessionId == sessionId,
+                    "Should not see " + Request.op2String(p.getRequest().type)
                             + " request from local session 0x" + session + " on the " + peerType);
         }
     }

From 7074448f2ded4885d8940f71d5ae90f065e5fdeb Mon Sep 17 00:00:00 2001
From: szucsvillo <81696283+szucsvillo@users.noreply.github.com>
Date: Thu, 15 Feb 2024 14:40:32 +0100
Subject: [PATCH 437/591] ZOOKEEPER-4806: Commits have to be refreshed after
 merging

Reviewers: anmolnar
Author: szucsvillo
Closes #2137 from szucsvillo/ZOOKEEPER-4806
---
 zk-merge-pr.py | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/zk-merge-pr.py b/zk-merge-pr.py
index 932582b926b..100244bfc16 100755
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -209,9 +209,21 @@ def cherry_pick(pr_num, merge_hash, default_branch):
 
     pick_branch_name = "%s_PICK_PR_%s_%s" % (TEMP_BRANCH_PREFIX, pr_num, pick_ref.upper())
 
-    run_cmd("git fetch %s" % PUSH_REMOTE_NAME)
+    run_cmd("git fetch %s" % PR_REMOTE_NAME)
     run_cmd("git checkout -b %s %s/%s" % (pick_branch_name, PUSH_REMOTE_NAME, pick_ref))
 
+    current_attempt = 0
+    max_attempts = 6
+    # Check if the merge hash exists
+    while not run_cmd("git rev-parse --verify %s" % merge_hash):
+        if current_attempt >= max_attempts:
+            print("Error: The commit hash does not exist in the local repository.")
+            exit()
+        current_attempt += 1
+        print("Waiting for the merge hash to become available...(10 sec)")
+        time.sleep(10)
+        run_cmd("git fetch %s" % PR_REMOTE_NAME)
+
     try:
         run_cmd("git cherry-pick -sx %s" % merge_hash)
     except Exception as e:

From 31c7a7e4c2b3b71549a06f442f8a4c5e9f03a6df Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Tue, 5 Mar 2024 16:37:54 +0800
Subject: [PATCH 438/591] ZOOKEEPER-4723. Cleanup more in-place bytebuffer
 manipulations (#2036)

Signed-off-by: tison <wander4096@gmail.com>
---
 .../java/org/apache/jute/RecordReader.java    | 83 -------------------
 .../java/org/apache/jute/RecordWriter.java    | 81 ------------------
 .../server/ByteBufferOutputStream.java        | 57 -------------
 .../org/apache/zookeeper/server/DataTree.java | 27 +++---
 .../zookeeper/server/NIOServerCnxn.java       |  2 +-
 .../zookeeper/server/NettyServerCnxn.java     |  2 +-
 .../server/PrepRequestProcessor.java          | 11 +--
 .../apache/zookeeper/server/ServerCnxn.java   | 32 ++++---
 .../zookeeper/server/SimpleRequestRecord.java |  3 +-
 .../zookeeper/server/quorum/Zab1_0Test.java   | 17 ++--
 10 files changed, 38 insertions(+), 277 deletions(-)
 delete mode 100644 zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java
 delete mode 100644 zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
 delete mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java b/zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java
deleted file mode 100644
index 2c91d2e0a5b..00000000000
--- a/zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.jute;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-
-/**
- * Front-end interface to deserializers. Also acts as a factory
- * for deserializers.
- */
-public class RecordReader {
-
-    private static  HashMap<String, Method> archiveFactory;
-
-    private InputArchive archive;
-
-    static {
-        archiveFactory = new HashMap<>();
-
-        try {
-            archiveFactory.put(
-                    "binary",
-                    BinaryInputArchive.class.getDeclaredMethod("getArchive", InputStream.class));
-        } catch (SecurityException | NoSuchMethodException ex) {
-            ex.printStackTrace();
-        }
-    }
-
-    private static InputArchive createArchive(InputStream in, String format) {
-        Method factory = archiveFactory.get(format);
-
-        if (factory != null) {
-            Object[] params = {in};
-            try {
-                return (InputArchive) factory.invoke(null, params);
-            } catch (IllegalArgumentException | InvocationTargetException | IllegalAccessException ex) {
-                ex.printStackTrace();
-            }
-        }
-
-        return null;
-    }
-
-    /**
-     * Creates a new instance of RecordReader.
-     *
-     * @param in     Stream from which to deserialize a record
-     * @param format Deserialization format ("binary", "xml", or "csv")
-     */
-    public RecordReader(InputStream in, String format) {
-        archive = createArchive(in, format);
-    }
-
-    /**
-     * Deserialize a record.
-     *
-     * @param r Record to be deserialized
-     */
-    public void read(Record r) throws IOException {
-        r.deserialize(archive, "");
-    }
-
-}
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java b/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
deleted file mode 100644
index a6d74a97883..00000000000
--- a/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.jute;
-
-import java.io.IOException;
-import java.io.OutputStream;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-
-/**
- * Front-end for serializers. Also serves as a factory for serializers.
- */
-public class RecordWriter {
-
-    private OutputArchive archive;
-
-    static HashMap<String, Method> constructFactory() {
-        HashMap<String, Method> factory = new HashMap<>();
-
-        try {
-            factory.put(
-                    "binary",
-                    BinaryOutputArchive.class.getDeclaredMethod("getArchive", OutputStream.class));
-        } catch (SecurityException | NoSuchMethodException ex) {
-            ex.printStackTrace();
-        }
-
-        return factory;
-    }
-
-    private static HashMap<String, Method> archiveFactory = constructFactory();
-
-    private static OutputArchive createArchive(OutputStream out, String format) {
-        Method factory = archiveFactory.get(format);
-        if (factory != null) {
-            Object[] params = {out};
-            try {
-                return (OutputArchive) factory.invoke(null, params);
-            } catch (IllegalArgumentException | InvocationTargetException | IllegalAccessException ex) {
-                ex.printStackTrace();
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Creates a new instance of RecordWriter.
-     *
-     * @param out    Output stream where the records will be serialized
-     * @param format Serialization format ("binary", "xml", or "csv")
-     */
-    public RecordWriter(OutputStream out, String format) {
-        archive = createArchive(out, format);
-    }
-
-    /**
-     * Serialize a record.
-     *
-     * @param r record to be serialized
-     */
-    public void write(Record r) throws IOException {
-        r.serialize(archive, "");
-    }
-}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
deleted file mode 100644
index 35a528cdb86..00000000000
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper.server;
-
-import java.io.IOException;
-import java.io.OutputStream;
-import java.nio.ByteBuffer;
-import javax.annotation.Nonnull;
-import org.apache.jute.BinaryOutputArchive;
-import org.apache.jute.Record;
-
-public class ByteBufferOutputStream extends OutputStream {
-
-    private final ByteBuffer bb;
-
-    public ByteBufferOutputStream(ByteBuffer bb) {
-        this.bb = bb;
-    }
-
-    @Override
-    public void write(int b) throws IOException {
-        bb.put((byte) b);
-    }
-
-    @Override
-    public void write(@Nonnull byte[] b) throws IOException {
-        bb.put(b);
-    }
-
-    @Override
-    public void write(@Nonnull byte[] b, int off, int len) throws IOException {
-        bb.put(b, off, len);
-    }
-
-    public static void record2ByteBuffer(Record record, ByteBuffer bb) throws IOException {
-        BinaryOutputArchive oa;
-        oa = BinaryOutputArchive.getArchive(new ByteBufferOutputStream(bb));
-        record.serialize(oa, "request");
-    }
-
-}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 6dbe94332c1..4a3de64c7af 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -21,7 +21,6 @@
 import java.io.EOFException;
 import java.io.IOException;
 import java.io.PrintWriter;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -34,6 +33,7 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Supplier;
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
@@ -969,46 +969,43 @@ public ProcessTxnResult processTxn(TxnHeader header, Record txn, boolean isSubTx
 
                 boolean post_failed = false;
                 for (Txn subtxn : txns) {
-                    ByteBuffer bb = ByteBuffer.wrap(subtxn.getData());
-                    Record record;
+                    final Supplier<Record> supplier;
                     switch (subtxn.getType()) {
                     case OpCode.create:
                     case OpCode.create2:
-                        record = new CreateTxn();
+                        supplier = CreateTxn::new;
                         break;
                     case OpCode.createTTL:
-                        record = new CreateTTLTxn();
+                        supplier = CreateTTLTxn::new;
                         break;
                     case OpCode.createContainer:
-                        record = new CreateContainerTxn();
+                        supplier = CreateContainerTxn::new;
                         break;
                     case OpCode.delete:
                     case OpCode.deleteContainer:
-                        record = new DeleteTxn();
+                        supplier = DeleteTxn::new;
                         break;
                     case OpCode.setData:
-                        record = new SetDataTxn();
+                        supplier = SetDataTxn::new;
                         break;
                     case OpCode.error:
-                        record = new ErrorTxn();
+                        supplier = ErrorTxn::new;
                         post_failed = true;
                         break;
                     case OpCode.check:
-                        record = new CheckVersionTxn();
+                        supplier = CheckVersionTxn::new;
                         break;
                     default:
                         throw new IOException("Invalid type of op: " + subtxn.getType());
                     }
 
-                    assert record != null;
-
-                    ByteBufferInputStream.byteBuffer2Record(bb, record);
-
+                    final Record record;
                     if (failed && subtxn.getType() != OpCode.error) {
                         int ec = post_failed ? Code.RUNTIMEINCONSISTENCY.intValue() : Code.OK.intValue();
-
                         subtxn.setType(OpCode.error);
                         record = new ErrorTxn(ec);
+                    } else {
+                        record = RequestRecord.fromBytes(subtxn.getData()).readRecord(supplier);
                     }
 
                     assert !failed || (subtxn.getType() == OpCode.error);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 61cbe71bad2..cfd04fcf620 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -687,7 +687,7 @@ public static void closeSock(SocketChannel sock) {
     public int sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, Stat stat, int opCode) {
         int responseSize = 0;
         try {
-            ByteBuffer[] bb = serialize(h, r, tag, cacheKey, stat, opCode);
+            ByteBuffer[] bb = serialize(h, r, cacheKey, stat, opCode);
             responseSize = bb[0].getInt();
             bb[0].rewind();
             sendBuffer(bb);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 45d5484096b..8a7de2e9228 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -190,7 +190,7 @@ public int sendResponse(ReplyHeader h, Record r, String tag,
         if (closingChannel || !channel.isOpen()) {
             return 0;
         }
-        ByteBuffer[] bb = serialize(h, r, tag, cacheKey, stat, opCode);
+        ByteBuffer[] bb = serialize(h, r, cacheKey, stat, opCode);
         int responseSize = bb[0].getInt();
         bb[0].rewind();
         sendBuffer(bb);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 274862ee31f..075f8d7c8e8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -18,10 +18,8 @@
 
 package org.apache.zookeeper.server;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.StringReader;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -32,7 +30,6 @@
 import java.util.Properties;
 import java.util.Set;
 import java.util.concurrent.LinkedBlockingQueue;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.DeleteContainerRequest;
@@ -868,12 +865,8 @@ private void pRequestHelper(Request request) {
                     // TODO: I don't want to have to serialize it here and then
                     //       immediately deserialize in next processor. But I'm
                     //       not sure how else to get the txn stored into our list.
-                    try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-                        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-                        txn.serialize(boa, "request");
-                        ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
-                        txns.add(new Txn(type, bb.array()));
-                    }
+                    byte[] bb = RequestRecord.fromRecord(txn).readBytes();
+                    txns.add(new Txn(type, bb));
                 }
 
                 request.setTxn(new MultiTxn(txns));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index 331f38d7f27..652823e1a51 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
@@ -35,7 +34,6 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.WatchedEvent;
@@ -173,29 +171,27 @@ public void decrOutstandingAndCheckThrottle(ReplyHeader h) {
      * @param r reply payload, can be null
      * @param tag Jute serialization tag, can be null
      * @param cacheKey Key for caching the serialized payload. A null value prevents caching.
-     * @param stat Stat information for the the reply payload, used for cache invalidation.
+     * @param stat Stat information for the reply payload, used for cache invalidation.
      *             A value of 0 prevents caching.
      * @param opCode The op code appertains to the corresponding request of the response,
      *               used to decide which cache (e.g. read response cache,
      *               list of children response cache, ...) object to look up to when applicable.
      */
-    public abstract int sendResponse(ReplyHeader h, Record r, String tag,
-                                      String cacheKey, Stat stat, int opCode) throws IOException;
+    public abstract int sendResponse(
+            ReplyHeader h,
+            Record r,
+            String tag,
+            String cacheKey,
+            Stat stat,
+            int opCode
+    ) throws IOException;
 
     public int sendResponse(ReplyHeader h, Record r, String tag) throws IOException {
         return sendResponse(h, r, tag, null, null, -1);
     }
 
-    protected byte[] serializeRecord(Record record) throws IOException {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream(ZooKeeperServer.intBufferStartingSizeBytes);
-        BinaryOutputArchive bos = BinaryOutputArchive.getArchive(baos);
-        bos.writeRecord(record, null);
-        return baos.toByteArray();
-    }
-
-    protected ByteBuffer[] serialize(ReplyHeader h, Record r, String tag,
-                                     String cacheKey, Stat stat, int opCode) throws IOException {
-        byte[] header = serializeRecord(h);
+    protected ByteBuffer[] serialize(ReplyHeader h, Record r, String cacheKey, Stat stat, int opCode) throws IOException {
+        byte[] header = RequestRecord.fromRecord(h).readBytes();
         byte[] data = null;
         if (r != null) {
             ResponseCache cache = null;
@@ -221,18 +217,18 @@ protected ByteBuffer[] serialize(ReplyHeader h, Record r, String tag,
                 // Use cache to get serialized data.
                 //
                 // NB: Tag is ignored both during cache lookup and serialization,
-                // since is is not used in read responses, which are being cached.
+                // since it is not used in read responses, which are being cached.
                 data = cache.get(cacheKey, stat);
                 if (data == null) {
                     // Cache miss, serialize the response and put it in cache.
-                    data = serializeRecord(r);
+                    data = RequestRecord.fromRecord(r).readBytes();
                     cache.put(cacheKey, data, stat);
                     cacheMiss.add(1);
                 } else {
                     cacheHit.add(1);
                 }
             } else {
-                data = serializeRecord(r);
+                data = RequestRecord.fromRecord(r).readBytes();
             }
         }
         int dataLength = data == null ? 0 : data.length;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
index a1c78ddad6a..a97cd19ae1c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
@@ -50,7 +50,8 @@ public byte[] readBytes() {
             return bytes;
         }
 
-        try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream(
+                ZooKeeperServer.intBufferStartingSizeBytes)) {
             BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
             record.serialize(boa, "request");
             bytes = baos.toByteArray();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index 2a4ebaa509c..76a678f501c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -53,9 +53,9 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ByteBufferInputStream;
-import org.apache.zookeeper.server.ByteBufferOutputStream;
 import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
@@ -517,8 +517,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l, long
 
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 1, liBytes, null);
                 oa.writeRecord(qp, null);
 
@@ -830,8 +829,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
 
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 0, liBytes, null);
                 oa.writeRecord(qp, null);
 
@@ -871,8 +869,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 assertEquals(0, l.self.getCurrentEpoch());
 
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 0, liBytes, null);
                 oa.writeRecord(qp, null);
 
@@ -1074,8 +1071,7 @@ public void testLeaderBehind(@TempDir File testData) throws Exception {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException {
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 /* we are going to say we last acked epoch 20 */
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, ZxidUtils.makeZxid(20, 0), liBytes, null);
                 oa.writeRecord(qp, null);
@@ -1112,8 +1108,7 @@ public void testAbandonBeforeACKEpoch(@TempDir File testData) throws Exception {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException, InterruptedException {
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 0, liBytes, null);
                 oa.writeRecord(qp, null);
                 readPacketSkippingPing(ia, qp);

From bc1fc6d36435d3fad7b31642b647dc7680d7866e Mon Sep 17 00:00:00 2001
From: Abhilash Kishore <abkishore@linkedin.com>
Date: Fri, 8 Mar 2024 21:46:21 -0600
Subject: [PATCH 439/591] ZOOKEEPER-4276. Serving only with secureClientPort
 fails (#2117)

* Support TLS-only ZK server

* Cleanup

* Update documentation according to review comments
---
 .../resources/markdown/zookeeperReconfig.md   |  44 ++-
 .../zookeeper/client/FourLetterWordMain.java  |  40 ++-
 .../server/PrepRequestProcessor.java          |   4 +-
 .../zookeeper/server/quorum/QuorumPeer.java   | 174 +++++++++--
 .../server/quorum/QuorumPeerConfig.java       |  33 +-
 .../server/quorum/QuorumPeerMain.java         |   1 +
 .../server/quorum/QuorumPeerMainTLSTest.java  | 293 ++++++++++++++++++
 .../server/quorum/QuorumPeerTestBase.java     |  19 +-
 .../server/quorum/QuorumServerTest.java       |  43 +++
 .../server/quorum/ReconfigLegacyTest.java     |  98 +++++-
 .../org/apache/zookeeper/test/ClientBase.java |  55 +++-
 .../apache/zookeeper/test/ReconfigTest.java   |  15 +-
 12 files changed, 734 insertions(+), 85 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md b/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md
index afb85df0ad9..8b3e3dad799 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md
@@ -88,27 +88,41 @@ feature is disabled by default, and has to be explicitly turned on via
 
 ### Specifying the client port
 
-A client port of a server is the port on which the server accepts
-client connection requests. Starting with 3.5.0 the
-_clientPort_ and _clientPortAddress_ configuration parameters should no longer be used. Instead,
-this information is now part of the server keyword specification, which
+A client port of a server is the port on which the server accepts plaintext (non-TLS) client connection requests 
+and secure client port is the port on which the server accepts TLS client connection requests. 
+
+Starting with 3.5.0 the
+_clientPort_ and _clientPortAddress_ configuration parameters should no longer be used in zoo.cfg. 
+
+Starting with 3.10.0 the
+_secureClientPort_ and _secureClientPortAddress_ configuration parameters should no longer be used in zoo.cfg.
+
+Instead, this information is now part of the server keyword specification, which
 becomes as follows:
 
-    server.<positive id> = <address1>:<port1>:<port2>[:role];[<client port address>:]<client port>**
+    server.<positive id> = <address1>:<quorum port>:<leader election port>[:role];[[<client port address>:]<client port>][;[<secure client port address>:]<secure client port>]
 
-The client port specification is to the right of the semicolon. The
-client port address is optional, and if not specified it defaults to
-"0.0.0.0". As usual, role is also optional, it can be
-_participant_ or _observer_
-(_participant_ by default).
+- [New in ZK 3.10.0] The client port specification is optional and is to the right of the
+  first semicolon. The secure client port specification is also optional and is to the right
+  of the second semicolon. However, both the client port and secure client port specification
+  cannot be omitted, at least one of them should be present. If the user intends to omit client
+  port specification and provide only secure client port specification (TLS-only server), a second
+  semicolon should still be specified to indicate an empty client port specification (see last 
+  example below). In either spec, the port address is optional, and if not specified it defaults 
+  to "0.0.0.0".
+- As usual, role is also optional, it can be _participant_ or _observer_ (_participant_ by default).
 
 Examples of legal server statements:
 
-    server.5 = 125.23.63.23:1234:1235;1236
-    server.5 = 125.23.63.23:1234:1235:participant;1236
-    server.5 = 125.23.63.23:1234:1235:observer;1236
-    server.5 = 125.23.63.23:1234:1235;125.23.63.24:1236
-    server.5 = 125.23.63.23:1234:1235:participant;125.23.63.23:1236
+    server.5 = 125.23.63.23:1234:1235;1236                                             (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235;1236;1237                                        (non-TLS + TLS server)
+    server.5 = 125.23.63.23:1234:1235;;1237                                            (TLS-only server)
+    server.5 = 125.23.63.23:1234:1235:participant;1236                                 (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235:observer;1236                                    (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235;125.23.63.24:1236                                (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235:participant;125.23.63.23:1236                    (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235:participant;125.23.63.23:1236;125.23.63.23:1237  (non-TLS + TLS server)
+    server.5 = 125.23.63.23:1234:1235:participant;;125.23.63.23:1237                   (TLS-only server)
 
 
 <a name="sc_multiaddress"></a>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
index de2f79dcf1d..39988c39bf9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
@@ -91,7 +91,29 @@ public static String send4LetterWord(
         String cmd,
         boolean secure,
         int timeout) throws IOException, SSLContextException {
-        LOG.info("connecting to {} {}", host, port);
+        return send4LetterWord(host, port, cmd, secure, timeout, null);
+    }
+
+    /**
+     * Send the 4letterword
+     * @param host the destination host
+     * @param port the destination port
+     * @param cmd the 4letterword
+     * @param secure whether to use SSL
+     * @param timeout in milliseconds, maximum time to wait while connecting/reading data
+     * @param sslContext SSL context
+     * @return server response
+     * @throws java.io.IOException
+     * @throws SSLContextException
+     */
+    public static String send4LetterWord(
+        String host,
+        int port,
+        String cmd,
+        boolean secure,
+        int timeout,
+        SSLContext sslContext) throws IOException, SSLContextException {
+        LOG.info("connecting to {}:{} (secure={})", host, port, secure);
 
         Socket sock = null;
         BufferedReader reader = null;
@@ -101,14 +123,16 @@ public static String send4LetterWord(
                 : new InetSocketAddress(InetAddress.getByName(null), port);
             if (secure) {
                 LOG.info("using secure socket");
-                try (X509Util x509Util = new ClientX509Util()) {
-                    SSLContext sslContext = x509Util.getDefaultSSLContext();
-                    SSLSocketFactory socketFactory = sslContext.getSocketFactory();
-                    SSLSocket sslSock = (SSLSocket) socketFactory.createSocket();
-                    sslSock.connect(hostaddress, timeout);
-                    sslSock.startHandshake();
-                    sock = sslSock;
+                if (sslContext == null) {
+                    try (X509Util x509Util = new ClientX509Util()) {
+                        sslContext = x509Util.getDefaultSSLContext();
+                    }
                 }
+                SSLSocketFactory socketFactory = sslContext.getSocketFactory();
+                SSLSocket sslSock = (SSLSocket) socketFactory.createSocket();
+                sslSock.connect(hostaddress, timeout);
+                sslSock.startHandshake();
+                sock = sslSock;
             } else {
                 sock = new Socket();
                 sock.connect(hostaddress, timeout);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 075f8d7c8e8..bcbfbaad73c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -482,8 +482,8 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record)
                             // extract server id x from first part of joiner: server.x
                             Long sid = Long.parseLong(parts[0].substring(parts[0].lastIndexOf('.') + 1));
                             QuorumServer qs = new QuorumServer(sid, parts[1]);
-                            if (qs.clientAddr == null || qs.electionAddr == null || qs.addr == null) {
-                                throw new KeeperException.BadArgumentsException("Wrong format of server string - each server should have 3 ports specified");
+                            if ((qs.clientAddr == null && qs.secureClientAddr == null) || qs.electionAddr == null || qs.addr == null) {
+                                throw new KeeperException.BadArgumentsException("Wrong format of server string - each server should have at least 3 ports specified");
                             }
 
                             // check duplication of addresses and ports
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 6fc3ee2009a..aba7a294630 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.common.NetUtils.formatInetAddr;
+import static org.apache.zookeeper.server.quorum.QuorumPeerConfig.configureSSLAuth;
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -152,15 +153,20 @@ public static final class AddressTuple {
         public final MultipleAddresses quorumAddr;
         public final MultipleAddresses electionAddr;
         public final InetSocketAddress clientAddr;
+        public final InetSocketAddress secureClientAddr;
 
-        public AddressTuple(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr) {
+        public AddressTuple(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr, InetSocketAddress secureClientAddr) {
             this.quorumAddr = quorumAddr;
             this.electionAddr = electionAddr;
             this.clientAddr = clientAddr;
+            this.secureClientAddr = secureClientAddr;
         }
 
     }
 
+    private Boolean isClientAddrFromStatic = null;
+    private Boolean isSecureClientAddrFromStatic = null;
+
     private int observerMasterPort;
 
     public int getObserverMasterPort() {
@@ -216,6 +222,7 @@ public static class QuorumServer {
         public MultipleAddresses electionAddr = new MultipleAddresses();
 
         public InetSocketAddress clientAddr = null;
+        public InetSocketAddress secureClientAddr = null;
 
         public long id;
 
@@ -224,20 +231,31 @@ public static class QuorumServer {
         public LearnerType type = LearnerType.PARTICIPANT;
 
         public boolean isClientAddrFromStatic = false;
+        public boolean isSecureClientAddrFromStatic = false;
 
         private List<InetSocketAddress> myAddrs;
 
         public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr) {
-            this(id, addr, electionAddr, clientAddr, LearnerType.PARTICIPANT);
+            this(id, addr, electionAddr, clientAddr, null, LearnerType.PARTICIPANT);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr,
+            InetSocketAddress secureClientAddr) {
+            this(id, addr, electionAddr, clientAddr, secureClientAddr, LearnerType.PARTICIPANT);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr,
+            LearnerType learnerType) {
+            this(id, addr, electionAddr, clientAddr, null, learnerType);
         }
 
         public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr) {
-            this(id, addr, electionAddr, null, LearnerType.PARTICIPANT);
+            this(id, addr, electionAddr, null, null, LearnerType.PARTICIPANT);
         }
 
         // VisibleForTesting
         public QuorumServer(long id, InetSocketAddress addr) {
-            this(id, addr, null, null, LearnerType.PARTICIPANT);
+            this(id, addr, null, null, null, LearnerType.PARTICIPANT);
         }
 
         public long getId() {
@@ -284,10 +302,10 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
         }
 
         public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, LearnerType type) {
-            this(id, addr, electionAddr, null, type);
+            this(id, addr, electionAddr, null, null, type);
         }
 
-        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr, LearnerType type) {
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr, InetSocketAddress secureClientAddr, LearnerType type) {
             this.id = id;
             if (addr != null) {
                 this.addr.addAddress(addr);
@@ -297,6 +315,7 @@ public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionA
             }
             this.type = type;
             this.clientAddr = clientAddr;
+            this.secureClientAddr = secureClientAddr;
 
             setMyAddrs();
         }
@@ -304,14 +323,15 @@ public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionA
         private static final String wrongFormat =
             " does not have the form server_config or server_config;client_config"
             + " where server_config is the pipe separated list of host:port:port or host:port:port:type"
-            + " and client_config is port or host:port";
+            + " and client_config is host:clientPort;host:secureClientPort or clientPort or host:clientPort"
+            + " or ';secureClientPort' or ';host:secureClientPort'";
 
         private void initializeWithAddressString(String addressStr, Function<InetSocketAddress, InetAddress> getInetAddress) throws ConfigException {
             LearnerType newType = null;
             String[] serverClientParts = addressStr.split(";");
             String[] serverAddresses = serverClientParts[0].split("\\|");
 
-            if (serverClientParts.length == 2) {
+            if (serverClientParts.length >= 2 && !serverClientParts[1].isEmpty()) {
                 String[] clientParts = ConfigUtils.getHostAndPort(serverClientParts[1]);
                 if (clientParts.length > 2) {
                     throw new ConfigException(addressStr + wrongFormat);
@@ -322,8 +342,25 @@ private void initializeWithAddressString(String addressStr, Function<InetSocketA
                 try {
                     clientAddr = new InetSocketAddress(clientHostName, Integer.parseInt(clientParts[clientParts.length - 1]));
                 } catch (NumberFormatException e) {
-                    throw new ConfigException("Address unresolved: " + hostname + ":" + clientParts[clientParts.length - 1]);
+                    throw new ConfigException("Address unresolved: " + clientHostName + ":" + clientParts[clientParts.length - 1]);
+                }
+            }
+
+            if (serverClientParts.length == 3 && !serverClientParts[2].isEmpty()) {
+                String[] secureClientParts = ConfigUtils.getHostAndPort(serverClientParts[2]);
+                if (secureClientParts.length > 2) {
+                    throw new ConfigException(addressStr + wrongFormat);
+                }
+
+                // is secure client config a host:port or just a port
+                String secureClientHostName = (secureClientParts.length == 2) ? secureClientParts[0] : "0.0.0.0";
+                try {
+                    secureClientAddr = new InetSocketAddress(secureClientHostName, Integer.parseInt(secureClientParts[secureClientParts.length - 1]));
+                } catch (NumberFormatException e) {
+                    throw new ConfigException("Address unresolved: " + secureClientHostName + ":" + secureClientParts[secureClientParts.length - 1]);
                 }
+                // set x509 auth provider if not already set
+                configureSSLAuth();
             }
 
             boolean multiAddressEnabled = Boolean.parseBoolean(
@@ -338,9 +375,8 @@ private void initializeWithAddressString(String addressStr, Function<InetSocketA
                     CONFIG_DEFAULT_KERBEROS_CANONICALIZE_HOST_NAMES));
 
             for (String serverAddress : serverAddresses) {
-                String serverParts[] = ConfigUtils.getHostAndPort(serverAddress);
-                if ((serverClientParts.length > 2) || (serverParts.length < 3)
-                        || (serverParts.length > 4)) {
+                String[] serverParts = ConfigUtils.getHostAndPort(serverAddress);
+                if ((serverParts.length < 3) || (serverParts.length > 4)) {
                     throw new ConfigException(addressStr + wrongFormat);
                 }
 
@@ -415,6 +451,7 @@ private void setMyAddrs() {
             this.myAddrs = new ArrayList<>();
             this.myAddrs.addAll(this.addr.getAllAddresses());
             this.myAddrs.add(this.clientAddr);
+            this.myAddrs.add(this.secureClientAddr);
             this.myAddrs.addAll(this.electionAddr.getAllAddresses());
             this.myAddrs = excludedSpecialAddresses(this.myAddrs);
         }
@@ -448,13 +485,24 @@ public String toString() {
                 sw.append(":participant");
             }
 
+            boolean clientPortSpecAdded = false;
             if (clientAddr != null && !isClientAddrFromStatic) {
+                clientPortSpecAdded = true;
                 sw.append(";");
                 sw.append(delimitedHostString(clientAddr));
                 sw.append(":");
                 sw.append(String.valueOf(clientAddr.getPort()));
             }
 
+            if (secureClientAddr != null & !isSecureClientAddrFromStatic) {
+                if (!clientPortSpecAdded) {
+                    sw.append(";");
+                }
+                sw.append(";");
+                sw.append(delimitedHostString(secureClientAddr));
+                sw.append(":");
+                sw.append(String.valueOf(secureClientAddr.getPort()));
+            }
             return sw.toString();
         }
 
@@ -463,7 +511,7 @@ public int hashCode() {
             return 42; // any arbitrary constant will do
         }
 
-        private boolean checkAddressesEqual(InetSocketAddress addr1, InetSocketAddress addr2) {
+        private static boolean checkAddressesEqual(InetSocketAddress addr1, InetSocketAddress addr2) {
             return (addr1 != null || addr2 == null)
                    && (addr1 == null || addr2 != null)
                    && (addr1 == null || addr2 == null || addr1.equals(addr2));
@@ -483,12 +531,16 @@ public boolean equals(Object o) {
             if (!electionAddr.equals(qs.electionAddr)) {
                 return false;
             }
-            return checkAddressesEqual(clientAddr, qs.clientAddr);
+            if (!checkAddressesEqual(clientAddr, qs.clientAddr)) {
+                return false;
+            }
+            return checkAddressesEqual(secureClientAddr, qs.secureClientAddr);
         }
 
         public void checkAddressDuplicate(QuorumServer s) throws BadArgumentsException {
             List<InetSocketAddress> otherAddrs = new ArrayList<>(s.addr.getAllAddresses());
             otherAddrs.add(s.clientAddr);
+            otherAddrs.add(s.secureClientAddr);
             otherAddrs.addAll(s.electionAddr.getAllAddresses());
             otherAddrs = excludedSpecialAddresses(otherAddrs);
 
@@ -709,6 +761,7 @@ public synchronized void setCurrentVote(Vote v) {
      * value of one indicates the default backlog will be used.
      */
     protected int clientPortListenBacklog = -1;
+    protected int maxClientCnxns = -1;
 
     /**
      * The number of ticks that the initial synchronization phase can take
@@ -994,7 +1047,7 @@ public void recreateSocketAddresses(long id) {
             if (qs != null) {
                 qs.recreateSocketAddresses();
                 if (id == getMyId()) {
-                    setAddrs(qs.addr, qs.electionAddr, qs.clientAddr);
+                    setAddrs(qs.addr, qs.electionAddr, qs.clientAddr, qs.secureClientAddr);
                 }
             }
         }
@@ -1040,9 +1093,15 @@ public InetSocketAddress getClientAddress() {
         return (addrs == null) ? null : addrs.clientAddr;
     }
 
-    private void setAddrs(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr) {
+    public InetSocketAddress getSecureClientAddress() {
+        final AddressTuple addrs = myAddrs.get();
+        return (addrs == null) ? null : addrs.secureClientAddr;
+    }
+
+    private void setAddrs(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr,
+        InetSocketAddress secureClientAddr) {
         synchronized (QV_LOCK) {
-            myAddrs.set(new AddressTuple(quorumAddr, electionAddr, clientAddr));
+            myAddrs.set(new AddressTuple(quorumAddr, electionAddr, clientAddr, secureClientAddr));
             QV_LOCK.notifyAll();
         }
     }
@@ -1305,7 +1364,7 @@ public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File snapDir, File logDir
     private static InetSocketAddress getClientAddress(Map<Long, QuorumServer> quorumPeers, long myid, int clientPort) throws IOException {
         QuorumServer quorumServer = quorumPeers.get(myid);
         if (null == quorumServer) {
-            throw new IOException("No QuorumServer correspoding to myid " + myid);
+            throw new IOException("No QuorumServer corresponding to myid " + myid);
         }
         if (null == quorumServer.clientAddr) {
             return new InetSocketAddress(clientPort);
@@ -1825,6 +1884,16 @@ public void setClientPortListenBacklog(int backlog) {
         this.clientPortListenBacklog = backlog;
     }
 
+    /** The server max client connections */
+    public int getMaxClientCnxns() {
+        return maxClientCnxns;
+    }
+
+    /** Sets the server's max client connections */
+    public void setMaxClientCnxns(int maxClientCnxns) {
+        this.maxClientCnxns = maxClientCnxns;
+    }
+
     /**
      * Get the number of ticks that the initial synchronization phase can take
      */
@@ -1975,7 +2044,7 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
                     try {
                         String dynamicConfigFilename = makeDynamicConfigFilename(qv.getVersion());
                         QuorumPeerConfig.writeDynamicConfig(dynamicConfigFilename, qv, false);
-                        QuorumPeerConfig.editStaticConfig(configFilename, dynamicConfigFilename, needEraseClientInfoFromStaticConfig());
+                        QuorumPeerConfig.editStaticConfig(configFilename, dynamicConfigFilename, needEraseClientInfoFromStaticConfig(), needEraseSecureClientInfoFromStaticConfig());
                     } catch (IOException e) {
                         LOG.error("Error closing file", e);
                     }
@@ -1989,7 +2058,16 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
             }
             QuorumServer qs = qv.getAllMembers().get(getMyId());
             if (qs != null) {
-                setAddrs(qs.addr, qs.electionAddr, qs.clientAddr);
+                setAddrs(qs.addr, qs.electionAddr, qs.clientAddr, qs.secureClientAddr);
+
+                // we only set this once, because quorum verifier can change based on dynamic reconfig
+                if (isClientAddrFromStatic == null) {
+                    isClientAddrFromStatic = qs.isClientAddrFromStatic;
+                }
+
+                if (isSecureClientAddrFromStatic == null) {
+                    isSecureClientAddrFromStatic = qs.isSecureClientAddrFromStatic;
+                }
             }
             updateObserverMasterList();
             return prevQV;
@@ -2005,6 +2083,11 @@ private boolean needEraseClientInfoFromStaticConfig() {
         return (server != null && server.clientAddr != null && !server.isClientAddrFromStatic);
     }
 
+    private boolean needEraseSecureClientInfoFromStaticConfig() {
+        QuorumServer server = quorumVerifier.getAllMembers().get(getMyId());
+        return (server != null && server.secureClientAddr != null && !server.isSecureClientAddrFromStatic);
+    }
+
     /**
      * Get an instance of LeaderElection
      */
@@ -2270,6 +2353,7 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
         }
 
         InetSocketAddress oldClientAddr = getClientAddress();
+        InetSocketAddress oldSecureClientAddr = getSecureClientAddress();
 
         // update last committed quorum verifier, write the new config to disk
         // and restart leader election if config changed.
@@ -2293,8 +2377,53 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
             }
 
             QuorumServer myNewQS = newMembers.get(getMyId());
-            if (myNewQS != null && myNewQS.clientAddr != null && !myNewQS.clientAddr.equals(oldClientAddr)) {
-                cnxnFactory.reconfigure(myNewQS.clientAddr);
+            if (myNewQS != null) {
+                if (myNewQS.clientAddr == null) {
+                    if (!isClientAddrFromStatic && oldClientAddr != null && cnxnFactory != null) {
+                        // clientAddr omitted in new config, shutdown cnxnFactory
+                         cnxnFactory.shutdown();
+                         cnxnFactory = null;
+                    }
+                } else if (!myNewQS.clientAddr.equals(oldClientAddr)) {
+                    // clientAddr has changed
+                    if (cnxnFactory == null) {
+                        // start cnxnFactory first
+                        try {
+                            cnxnFactory = ServerCnxnFactory.createFactory();
+                            cnxnFactory.configure(myNewQS.clientAddr, getMaxClientCnxns(), getClientPortListenBacklog(), false);
+                            cnxnFactory.start();
+                        } catch (IOException e) {
+                            throw new RuntimeException(e);
+                        }
+                    } else {
+                        cnxnFactory.reconfigure(myNewQS.clientAddr);
+                    }
+                }
+
+                if (myNewQS.secureClientAddr == null) {
+                    if (!isSecureClientAddrFromStatic && oldSecureClientAddr != null && secureCnxnFactory != null) {
+                        // secureClientAddr omitted in new config, shutdown secureCnxnFactory
+                         secureCnxnFactory.shutdown();
+                         secureCnxnFactory = null;
+                    }
+                } else if (!myNewQS.secureClientAddr.equals(oldSecureClientAddr)) {
+                    // secureClientAddr has changed
+                    if (secureCnxnFactory == null) {
+                        // start secureCnxnFactory first
+                        try {
+                            configureSSLAuth();
+                            secureCnxnFactory = ServerCnxnFactory.createFactory();
+                            secureCnxnFactory.configure(myNewQS.secureClientAddr, getMaxClientCnxns(), getClientPortListenBacklog(), true);
+                            secureCnxnFactory.start();
+
+                        } catch (IOException | ConfigException e) {
+                            throw new RuntimeException(e);
+                        }
+                    } else {
+                        secureCnxnFactory.reconfigure(myNewQS.secureClientAddr);
+                    }
+                }
+
                 updateThreadName();
             }
 
@@ -2673,6 +2802,7 @@ public static QuorumPeer createFromConfig(QuorumPeerConfig config) throws IOExce
         quorumPeer.setObserverMasterPort(config.getObserverMasterPort());
         quorumPeer.setConfigFileName(config.getConfigFilename());
         quorumPeer.setClientPortListenBacklog(config.getClientPortListenBacklog());
+        quorumPeer.setMaxClientCnxns(config.getMaxClientCnxns());
         quorumPeer.setZKDatabase(new ZKDatabase(quorumPeer.getTxnFactory()));
         quorumPeer.setQuorumVerifier(config.getQuorumVerifier(), false);
         if (config.getLastSeenQuorumVerifier() != null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index 05246baba7e..d72d8444341 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -570,9 +570,11 @@ public void write(Writer out) throws IOException {
      * it will remove them.
      * If it needs to erase client port information left by the old config,
      * "eraseClientPortAddress" should be set true.
+     * If it needs to erase secure client port information left by the old config,
+     * "eraseSecureClientPortAddress" should be set true.
      * It should also updates dynamic file pointer on reconfig.
      */
-    public static void editStaticConfig(final String configFileStr, final String dynamicFileStr, final boolean eraseClientPortAddress) throws IOException {
+    public static void editStaticConfig(final String configFileStr, final String dynamicFileStr, final boolean eraseClientPortAddress, final boolean eraseSecureClientPortAddress) throws IOException {
         // Some tests may not have a static config file.
         if (configFileStr == null) {
             return;
@@ -604,7 +606,10 @@ public void write(Writer out) throws IOException {
                         || key.startsWith("peerType")
                         || (eraseClientPortAddress
                             && (key.startsWith("clientPort")
-                                || key.startsWith("clientPortAddress")))) {
+                                || key.startsWith("clientPortAddress")))
+                        || (eraseSecureClientPortAddress
+                            && (key.startsWith("secureClientPort")
+                                || key.startsWith("secureClientPortAddress")))) {
                         // not writing them back to static file
                         continue;
                     }
@@ -659,6 +664,7 @@ void setupQuorumPeerConfig(Properties prop, boolean configBackwardCompatibilityM
         quorumVerifier = parseDynamicConfig(prop, electionAlg, true, configBackwardCompatibilityMode, oraclePath);
         setupMyId();
         setupClientPort();
+        setupSecureClientPort();
         setupPeerType();
         checkValidity();
     }
@@ -765,6 +771,29 @@ private void setupClientPort() throws ConfigException {
         }
     }
 
+    private void setupSecureClientPort() throws ConfigException {
+        if (serverId == UNSET_SERVERID) {
+            return;
+        }
+        QuorumServer qs = quorumVerifier.getAllMembers().get(serverId);
+        if (secureClientPortAddress != null && qs != null && qs.secureClientAddr != null) {
+            if ((!secureClientPortAddress.getAddress().isAnyLocalAddress() && !secureClientPortAddress.equals(qs.secureClientAddr)) || (
+                secureClientPortAddress.getAddress().isAnyLocalAddress()
+                    && secureClientPortAddress.getPort() != qs.secureClientAddr.getPort())) {
+                throw new ConfigException("secure client address for this server (id = " + serverId
+                    + ") in static config file is " + secureClientPortAddress
+                    + " is different from secure client address found in dynamic file: " + qs.secureClientAddr);
+            }
+        }
+        if (qs != null && qs.secureClientAddr != null) {
+            secureClientPortAddress = qs.secureClientAddr;
+        }
+        if (qs != null && qs.secureClientAddr == null) {
+            qs.secureClientAddr = secureClientPortAddress;
+            qs.isSecureClientAddrFromStatic = true;
+        }
+    }
+
     private void setupPeerType() {
         // Warn about inconsistent peer type
         LearnerType roleByServersList = quorumVerifier.getObservingMembers().containsKey(serverId)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 5ed2d42863a..0cad9ae8fda 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -190,6 +190,7 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
             quorumPeer.setObserverMasterPort(config.getObserverMasterPort());
             quorumPeer.setConfigFileName(config.getConfigFilename());
             quorumPeer.setClientPortListenBacklog(config.getClientPortListenBacklog());
+            quorumPeer.setMaxClientCnxns(config.getMaxClientCnxns());
             quorumPeer.setZKDatabase(new ZKDatabase(quorumPeer.getTxnFactory()));
             quorumPeer.setQuorumVerifier(config.getQuorumVerifier(), false);
             if (config.getLastSeenQuorumVerifier() != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java
new file mode 100644
index 00000000000..79baeabb7a0
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java
@@ -0,0 +1,293 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread.UNSET_STATIC_CLIENTPORT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.security.Security;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.apache.commons.io.FileUtils;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.admin.ZooKeeperAdmin;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.KeyStoreFileType;
+import org.apache.zookeeper.common.X509KeyType;
+import org.apache.zookeeper.common.X509TestContext;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ReconfigTest;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class QuorumPeerMainTLSTest extends QuorumPeerTestBase {
+
+  protected static final Logger LOG = LoggerFactory.getLogger(QuorumPeerMainTLSTest.class);
+  private static File tempDir;
+  private static X509TestContext x509TestContext = null;
+
+  @BeforeAll
+  public static void beforeAll() throws Exception {
+    Security.addProvider(new BouncyCastleProvider());
+    tempDir = ClientBase.createEmptyTestDir();
+    x509TestContext = X509TestContext.newBuilder()
+        .setTempDir(tempDir)
+        .setKeyStoreKeyType(X509KeyType.EC)
+        .setTrustStoreKeyType(X509KeyType.EC)
+        .build();
+  }
+
+  @AfterAll
+  public static void afterAll() {
+    Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+    try {
+      FileUtils.deleteDirectory(tempDir);
+    } catch (IOException e) {
+      // ignore
+    }
+  }
+
+
+  // TODO - test reconfig - NIO cnxn factory initially, reconfig to listen on TLS port, should fail coz Netty cnxn factory is needed
+  // TODO - equivalent of testReconfigRemoveClientFromStatic, but for secureClientPort
+  interface QuorumConfigBuilder {
+    String build(int id, String role, int quorumPort, int leaderPort, int clientPort, int secureClientPort);
+  }
+
+  static class MaybeSecureServers extends Servers {
+    public int[] quorumPorts;
+    public int[] leaderPorts;
+    public boolean[] isSecureClient;
+    public int[] secureClientPorts;
+    int numParticipants;
+    int numObservers;
+    String quorumCfg;
+
+    String otherCfg;
+
+    public MaybeSecureServers(int numParticipants, int numObservers, String otherCfg, QuorumConfigBuilder quorumConfigBuilder) throws IOException {
+      this.numParticipants = numParticipants;
+      this.numObservers = numObservers;
+      this.otherCfg = otherCfg;
+      int SIZE = numParticipants + numObservers;
+
+      this.mt = new MainThread[SIZE];
+      this.zk = new ZooKeeper[SIZE];
+      this.quorumPorts = new int[SIZE];
+      this.leaderPorts = new int[SIZE];
+      this.clientPorts = new int[SIZE];
+      this.adminPorts = new int[SIZE];
+      this.secureClientPorts = new int[SIZE];
+      this.isSecureClient = new boolean[SIZE];
+
+      StringBuilder quorumCfg = new StringBuilder();
+
+
+      for (int i = 0; i < SIZE; i++){
+        this.quorumPorts[i] = PortAssignment.unique();
+        this.leaderPorts[i] = PortAssignment.unique();
+        this.clientPorts[i] = PortAssignment.unique();
+        this.adminPorts[i] = PortAssignment.unique();
+        this.secureClientPorts[i] = PortAssignment.unique();
+        String role = i < numParticipants ? "participant" : "observer";
+        String serverEntry = quorumConfigBuilder.build(i, role, this.quorumPorts[i], this.leaderPorts[i], this.clientPorts[i], this.secureClientPorts[i]);
+        quorumCfg.append(serverEntry).append("\n");
+        if (serverEntry.endsWith("" + this.secureClientPorts[i])) {
+          this.isSecureClient[i] = true;
+        }
+      }
+
+      this.quorumCfg = quorumCfg.toString();
+      for (int i = 0; i < SIZE; i++){
+        this.mt[i] = new MainThread(i, UNSET_STATIC_CLIENTPORT, this.adminPorts[i], null, this.quorumCfg, this.otherCfg, null, true, null);
+      }
+    }
+
+    public void restartSecureClient(int clientIndex, Watcher watcher) throws IOException, InterruptedException {
+      if (zk[clientIndex] != null) {
+        zk[clientIndex].close();
+      }
+
+      isSecureClient[clientIndex] = true;
+      zk[clientIndex] = new ZooKeeper(
+          "127.0.0.1:" + secureClientPorts[clientIndex],
+          ClientBase.CONNECTION_TIMEOUT,
+          watcher, getClientTLSConfigs(x509TestContext));
+
+
+    }
+
+    public void restartAllServersAndClients(Watcher watcher) throws IOException, InterruptedException {
+      int index = 0;
+      for (MainThread t : mt) {
+        if (!t.isAlive()) {
+          t.start();
+          index++;
+        }
+      }
+      for (int i = 0; i < zk.length; i++) {
+        if (isSecureClient[i]) {
+          restartSecureClient(i, watcher);
+        } else {
+          restartClient(i, watcher);
+        }
+      }
+    }
+  }
+
+  static Map<String, String> getServerTLSConfigs(X509TestContext x509TestContext) throws IOException {
+    Map<String, String> sslConfigs = new HashMap<>();
+    sslConfigs.put("ssl.keyStore.location", x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath());
+    sslConfigs.put("ssl.trustStore.location", x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath());
+    sslConfigs.put("ssl.keyStore.type", "PEM");
+    sslConfigs.put("ssl.trustStore.type", "PEM");
+    // Netty is required for TLS
+    sslConfigs.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+    return sslConfigs;
+  }
+
+  static ZKClientConfig getClientTLSConfigs(X509TestContext x509TestContext) throws IOException {
+    if (x509TestContext == null) {
+      throw new RuntimeException("x509TestContext cannot be null");
+    }
+    File clientKeyStore = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM);
+    File clientTrustStore = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM);
+
+    ZKClientConfig zKClientConfig = new ZKClientConfig();
+    zKClientConfig.setProperty("zookeeper.client.secure", "true");
+    zKClientConfig.setProperty("zookeeper.ssl.keyStore.location", clientKeyStore.getAbsolutePath());
+    zKClientConfig.setProperty("zookeeper.ssl.trustStore.location", clientTrustStore.getAbsolutePath());
+    zKClientConfig.setProperty("zookeeper.ssl.keyStore.type", "PEM");
+    zKClientConfig.setProperty("zookeeper.ssl.trustStore.type", "PEM");
+    // only netty supports TLS
+    zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+    return zKClientConfig;
+  }
+
+  /**
+   * Starts a single server in replicated mode
+   */
+  @Test
+  public void testTLSQuorumPeers() throws IOException, InterruptedException {
+    Map<String, String> configMap = new HashMap<>();
+    configMap.put("standaloneEnabled", "false");
+    configMap.put("authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+    configMap.putAll(getServerTLSConfigs(x509TestContext));
+
+    StringBuilder configBuilder = new StringBuilder();
+    for (Map.Entry<String, String> entry : configMap.entrySet()) {
+      configBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("\n");
+    }
+
+    MaybeSecureServers maybeSecureServers = new MaybeSecureServers(3, 2, configBuilder.toString(),
+        (id, role, quorumPort, leaderPort, clientPort, secureClientPort) -> String.format("server.%d=127.0.0.1:%d:%d:%s;;127.0.0.1:%d", id, quorumPort, leaderPort, role, secureClientPort));
+
+    // wire to "servers" of QuorumPeerTestBase, so it can be destroyed in QuorumPeerTestBase.tearDown()
+    servers = maybeSecureServers;
+
+    // start servers and clients
+    maybeSecureServers.restartAllServersAndClients(this);
+
+    // wait for clients to connect
+    waitForAll(maybeSecureServers, ZooKeeper.States.CONNECTED);
+
+    // Find and log leader
+    maybeSecureServers.findLeader();
+
+    QuorumPeer qp0 = maybeSecureServers.mt[0].getQuorumPeer();
+
+    assertNotNull(qp0);
+
+    // verify no listener on client port
+    assertNull(qp0.cnxnFactory);
+    assertNull(qp0.getClientAddress());
+    assertEquals(-1, qp0.getClientPort());
+
+    // verify valid secure client port listener exists
+    assertNotNull(qp0.secureCnxnFactory);
+    assertNotNull(qp0.getSecureClientAddress());
+    assertEquals(maybeSecureServers.secureClientPorts[0], qp0.getSecureClientPort());
+    assertEquals(maybeSecureServers.secureClientPorts[0], qp0.getSecureClientAddress().getPort());
+  }
+
+  @Test
+  public void reconfigFromClientPortToSecureClientPort() throws IOException, InterruptedException, KeeperException {
+    Map<String, String> configMap = new HashMap<>();
+    configMap.put("reconfigEnabled", "true");
+    configMap.put("authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+    configMap.put("DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
+    configMap.putAll(getServerTLSConfigs(x509TestContext));
+
+    StringBuilder configBuilder = new StringBuilder();
+    for (Map.Entry<String, String> entry : configMap.entrySet()) {
+      configBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("\n");
+    }
+
+    MaybeSecureServers maybeSecureServers = new MaybeSecureServers(3, 0, configBuilder.toString(),
+        (id, role, quorumPort, leaderPort, clientPort, secureClientPort) -> String.format("server.%d=127.0.0.1:%d:%d:%s;127.0.0.1:%d", id, quorumPort, leaderPort, role, clientPort));
+
+    servers = maybeSecureServers;
+
+    maybeSecureServers.restartAllServersAndClients(this);
+
+    waitForAll(maybeSecureServers, ZooKeeper.States.CONNECTED);
+
+    ZooKeeperAdmin zkAdmin = new ZooKeeperAdmin("127.0.0.1:" + maybeSecureServers.clientPorts[0], ClientBase.CONNECTION_TIMEOUT, this);
+    zkAdmin.addAuthInfo("digest", "super:test".getBytes());
+
+    List<String> joiningServers = new ArrayList<>();
+    List<String> leavingServers = new ArrayList<>();
+
+    int reconfigIndex = 1;
+    leavingServers.add(Integer.toString(reconfigIndex));
+    joiningServers.add(String.format("server.%d=127.0.0.1:%d:%d:%s;;127.0.0.1:%d", reconfigIndex,
+        maybeSecureServers.quorumPorts[reconfigIndex], maybeSecureServers.leaderPorts[reconfigIndex],
+        "participant", maybeSecureServers.secureClientPorts[reconfigIndex]));
+
+    ReconfigTest.reconfig(zkAdmin, null, leavingServers, null, -1);
+    LOG.info("Reconfig REMOVE done with leavingServers={}!", leavingServers);
+    ReconfigTest.testServerHasConfig(maybeSecureServers.zk[0], null, leavingServers);
+
+    ReconfigTest.reconfig(zkAdmin, joiningServers, null, null, -1);
+    LOG.info("Reconfig ADD done with joiningServers={}!", joiningServers);
+
+    ReconfigTest.testServerHasConfig(maybeSecureServers.zk[0], joiningServers, null);
+
+    assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + maybeSecureServers.clientPorts[reconfigIndex], 5000, false));
+
+    maybeSecureServers.restartSecureClient(reconfigIndex, this);
+    waitForOne(maybeSecureServers.zk[reconfigIndex], ZooKeeper.States.CONNECTED);
+    ReconfigTest.testNormalOperation(maybeSecureServers.zk[0], maybeSecureServers.zk[reconfigIndex]);
+  }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index c3842808adc..27e2e320100 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -60,14 +60,17 @@ public class QuorumPeerTestBase extends ZKTestCase implements Watcher {
 
     @AfterEach
     public void tearDown() throws Exception {
-        if (servers == null || servers.mt == null) {
+        if (servers == null) {
             LOG.info("No servers to shutdown!");
             return;
         }
-        for (int i = 0; i < numServers; i++) {
-            if (i < servers.mt.length) {
-                servers.mt[i].shutdown();
-            }
+
+        if (servers.zk != null) {
+            servers.shutdownAllClients();
+        }
+
+        if (servers.mt != null) {
+            servers.shutDownAllServers();
         }
     }
 
@@ -427,6 +430,12 @@ public void shutDownAllServers() throws InterruptedException {
             }
         }
 
+        public void shutdownAllClients() throws InterruptedException {
+            for (ZooKeeper zk : zk) {
+                zk.close(5000);
+            }
+        }
+
         public void restartAllServersAndClients(Watcher watcher) throws IOException, InterruptedException {
             int index = 0;
             for (MainThread t : mt) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
index 71630913b7c..f8831fc84a2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
@@ -18,6 +18,8 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.KeeperException;
@@ -69,6 +71,17 @@ public void testToString() throws ConfigException {
         expected = "example.com:1234:1236:participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
         assertEquals(expected, qs.toString(), "Use hostname");
+
+        provided = "example.com:1234:1236:participant;1237;1238";
+        expected = "example.com:1234:1236:participant;0.0.0.0:1237;0.0.0.0:1238";
+        qs = new QuorumServer(0, provided);
+        assertEquals(expected, qs.toString(), "clientPort and secureClientPort");
+
+        provided = ipv4config + ":participant;;1.2.3.4:1237";
+        expected = ipv4config + ":participant;;1.2.3.4:1237";
+        qs = new QuorumServer(0, provided);
+        assertEquals(expected, qs.toString(), "Only secureClientPort");
+
     }
 
     @Test
@@ -112,6 +125,9 @@ public void shouldAllowMultipleAddressesWhenMultiAddressFeatureIsEnabled() throw
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         QuorumServer qs = new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
         assertEquals("127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant", qs.toString(), "MultiAddress parse error");
+
+        qs = new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236;1237;1238");
+        assertEquals("127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant;0.0.0.0:1237;0.0.0.0:1238", qs.toString(), "MultiAddress parse with clientPort and secureClientPort");
     }
 
     @Test
@@ -147,4 +163,31 @@ public void testDuplicate() {
         });
     }
 
+    @Test
+    public void testClientAddrAndSecureClientAddr() throws ConfigException {
+        QuorumPeer.QuorumServer qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;1237;1238");
+        assertNotNull(qs.clientAddr, "clientPort specified");
+        assertNotNull(qs.secureClientAddr, "secureClientPort specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;;1238");
+        assertNull(qs.clientAddr, "clientPort not specified");
+        assertNotNull(qs.secureClientAddr, "secureClientPort specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;1237;");
+        assertNotNull(qs.clientAddr, "clientPort specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;1237");
+        assertNotNull(qs.clientAddr, "clientPort specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant");
+        assertNull(qs.clientAddr, "clientPort not specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;;");
+        assertNull(qs.clientAddr, "clientPort not specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
index 2f9a5303e22..6f956899522 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.apache.zookeeper.server.quorum.QuorumPeerMainTLSTest.getClientTLSConfigs;
+import static org.apache.zookeeper.server.quorum.QuorumPeerMainTLSTest.getServerTLSConfigs;
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -25,22 +27,57 @@
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.security.Security;
 import java.util.ArrayList;
+import java.util.Map;
 import java.util.Properties;
+import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.X509KeyType;
+import org.apache.zookeeper.common.X509TestContext;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
 
 public class ReconfigLegacyTest extends QuorumPeerTestBase {
 
     private static final int SERVER_COUNT = 3;
+    private static File tempDir;
+    private static X509TestContext x509TestContext = null;
+
+    @BeforeAll
+    public static void beforeAll() throws Exception {
+        Security.addProvider(new BouncyCastleProvider());
+        tempDir = ClientBase.createEmptyTestDir();
+        x509TestContext = X509TestContext.newBuilder()
+            .setTempDir(tempDir)
+            .setKeyStoreKeyType(X509KeyType.EC)
+            .setTrustStoreKeyType(X509KeyType.EC)
+            .build();
+    }
+
+    @AfterAll
+    public static void afterAll() {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+        try {
+            FileUtils.deleteDirectory(tempDir);
+        } catch (IOException e) {
+            // ignore
+        }
+    }
 
     @BeforeEach
     public void setup() {
@@ -65,7 +102,7 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=localhost:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                     + ":participant;localhost:" + clientPorts[i];
+                + ":participant;localhost:" + clientPorts[i];
             allServers.add(server);
             sb.append(server + "\n");
         }
@@ -144,14 +181,17 @@ public void testConfigFileBackwardCompatibility() throws Exception {
      *    and new port added to dynamic file.
      * @throws Exception
      */
-    @Test
-    public void testReconfigRemoveClientFromStatic() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {false, true})
+    public void testReconfigRemoveClientFromStatic(boolean isSecure) throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
+        final int[] secureClientPorts = new int[SERVER_COUNT];
+        final int[] adminServerPorts = new int[SERVER_COUNT];
         final int[] quorumPorts = new int[SERVER_COUNT];
         final int[] electionPorts = new int[SERVER_COUNT];
 
         final int changedServerId = 0;
-        final int newClientPort = PortAssignment.unique();
+        final int newClientPortOrSecureClientPort = PortAssignment.unique();
 
         StringBuilder sb = new StringBuilder();
         ArrayList<String> allServers = new ArrayList<>();
@@ -159,6 +199,8 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
+            secureClientPorts[i] = PortAssignment.unique();
+            adminServerPorts[i] = PortAssignment.unique();
             quorumPorts[i] = PortAssignment.unique();
             electionPorts[i] = PortAssignment.unique();
 
@@ -167,7 +209,12 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
             sb.append(server + "\n");
 
             if (i == changedServerId) {
-                newServers.add(server + ";0.0.0.0:" + newClientPort);
+                if (isSecure) {
+                    newServers.add(server + ";;0.0.0.0:" + newClientPortOrSecureClientPort);
+                } else {
+                    newServers.add(server + ";0.0.0.0:" + newClientPortOrSecureClientPort);
+                }
+
             } else {
                 newServers.add(server);
             }
@@ -178,27 +225,51 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
         ZooKeeper[] zk = new ZooKeeper[SERVER_COUNT];
         ZooKeeperAdmin[] zkAdmin = new ZooKeeperAdmin[SERVER_COUNT];
 
+        Map<String, String> configMap = getServerTLSConfigs(x509TestContext);
+        StringBuilder configBuilder = new StringBuilder();
+        for (Map.Entry<String, String> entry : configMap.entrySet()) {
+            configBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("\n");
+        }
+
         // Start the servers with a static config file, without a dynamic config file.
         for (int i = 0; i < SERVER_COUNT; i++) {
-            mt[i] = new MainThread(i, clientPorts[i], quorumCfgSection, false);
+            if (isSecure) {
+                mt[i] = new MainThread(i, MainThread.UNSET_STATIC_CLIENTPORT, adminServerPorts[i], secureClientPorts[i], quorumCfgSection, configBuilder.toString(), null, false, null);
+            } else {
+                mt[i] = new MainThread(i, clientPorts[i], adminServerPorts[i], quorumCfgSection, null, null, false);
+            }
             mt[i].start();
         }
 
+
+        ZKClientConfig clientConfig;
+        if (isSecure) {
+            clientConfig = getClientTLSConfigs(x509TestContext);
+        } else {
+            clientConfig = null;
+        }
+
         // Check that when a server starts from old style config, it should keep the client
         // port in static config file.
         for (int i = 0; i < SERVER_COUNT; i++) {
+            String cnxnString = "127.0.0.1:" + (isSecure ? secureClientPorts[i] : clientPorts[i]);
             assertTrue(
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                ClientBase.waitForServerUp(cnxnString, CONNECTION_TIMEOUT, isSecure, clientConfig),
                 "waiting for server " + i + " being up");
-            zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
-            zkAdmin[i] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
+            zk[i] = ClientBase.createZKClient(cnxnString, CONNECTION_TIMEOUT, CONNECTION_TIMEOUT, clientConfig);
+            zkAdmin[i] = new ZooKeeperAdmin(cnxnString, ClientBase.CONNECTION_TIMEOUT, this, clientConfig);
             zkAdmin[i].addAuthInfo("digest", "super:test".getBytes());
 
             ReconfigTest.testServerHasConfig(zk[i], allServers, null);
             Properties cfg = readPropertiesFromFile(mt[i].confFile);
 
             assertTrue(cfg.containsKey("dynamicConfigFile"));
-            assertTrue(cfg.containsKey("clientPort"));
+            if (isSecure) {
+                assertTrue(cfg.containsKey("secureClientPort"));
+            } else {
+                assertTrue(cfg.containsKey("clientPort"));
+            }
+
         }
         ReconfigTest.testNormalOperation(zk[0], zk[1]);
 
@@ -215,10 +286,11 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             ReconfigTest.testServerHasConfig(zk[i], newServers, null);
             Properties staticCfg = readPropertiesFromFile(mt[i].confFile);
+            String configKey = isSecure ? "secureClientPort" : "clientPort";
             if (i == changedServerId) {
-                assertFalse(staticCfg.containsKey("clientPort"));
+                assertFalse(staticCfg.containsKey(configKey));
             } else {
-                assertTrue(staticCfg.containsKey("clientPort"));
+                assertTrue(staticCfg.containsKey(configKey));
             }
         }
 
@@ -255,7 +327,7 @@ public void testRestartZooKeeperServer() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                    + ":participant;127.0.0.1:" + clientPorts[i];
+                + ":participant;127.0.0.1:" + clientPorts[i];
             sb.append(server + "\n");
         }
         String currentQuorumCfgSection = sb.toString();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index b8b8e48321c..843b804deca 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -40,6 +40,7 @@
 import java.util.concurrent.TimeoutException;
 import javax.management.MBeanServerConnection;
 import javax.management.ObjectName;
+import javax.net.ssl.SSLContext;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.TestableZooKeeper;
@@ -49,8 +50,11 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
@@ -127,7 +131,7 @@ public synchronized boolean isConnected() {
 
         protected synchronized String connectionDescription() {
             return String.format("connected(%s), syncConnected(%s), readOnlyConnected(%s)",
-                    connected, syncConnected, readOnlyConnected);
+                connected, syncConnected, readOnlyConnected);
         }
 
         public synchronized void waitForConnected(long timeout) throws InterruptedException, TimeoutException {
@@ -151,7 +155,7 @@ public synchronized void waitForSyncConnected(long timeout) throws InterruptedEx
             if (!syncConnected) {
                 throw new TimeoutException(
                     "Failed to connect to read-write ZooKeeper server: "
-                    + connectionDescription());
+                        + connectionDescription());
             }
         }
         public synchronized void waitForReadOnlyConnected(long timeout) throws InterruptedException, TimeoutException {
@@ -164,7 +168,7 @@ public synchronized void waitForReadOnlyConnected(long timeout) throws Interrupt
             if (!readOnlyConnected) {
                 throw new TimeoutException(
                     "Failed to connect in read-only mode to ZooKeeper server: "
-                    + connectionDescription());
+                        + connectionDescription());
             }
         }
         public synchronized void waitForDisconnected(long timeout) throws InterruptedException, TimeoutException {
@@ -258,16 +262,27 @@ public static List<HostPort> parseHostPortList(String hplist) {
     }
 
     public static boolean waitForServerUp(String hp, long timeout) {
-        return waitForServerUp(hp, timeout, false);
+        return waitForServerUp(hp, timeout, false, null);
     }
 
     public static boolean waitForServerUp(String hp, long timeout, boolean secure) {
+        return waitForServerUp(hp, timeout, secure, null);
+    }
+
+    public static boolean waitForServerUp(String hp, long timeout, boolean secure, ZKConfig zkConfig) {
         long start = Time.currentElapsedTime();
         while (true) {
             try {
                 // if there are multiple hostports, just take the first one
                 HostPort hpobj = parseHostPortList(hp).get(0);
-                String result = send4LetterWord(hpobj.host, hpobj.port, "stat", secure);
+                SSLContext sslContext = null;
+                String result;
+                if (zkConfig != null) {
+                    try (X509Util x509Util = new ClientX509Util()) {
+                        sslContext = x509Util.createSSLContext(zkConfig);
+                    }
+                }
+                result = send4LetterWord(hpobj.host, hpobj.port, "stat", secure, 5000, sslContext);
                 if (result.startsWith("Zookeeper version:") && !result.contains("READ-ONLY")) {
                     return true;
                 }
@@ -290,6 +305,7 @@ public static boolean waitForServerUp(String hp, long timeout, boolean secure) {
                 // ignore
             }
         }
+        LOG.error("server failed to come up: {}", hp);
         return false;
     }
 
@@ -395,22 +411,29 @@ private static int getPort(String hostPort) {
         return Integer.parseInt(portstr);
     }
 
+    public static void startServerInstance(File dataDir,
+        ServerCnxnFactory factory,
+        String hostPort,
+        int serverId) throws IOException, InterruptedException {
+        startServerInstance(dataDir, factory, hostPort, serverId, null);
+    }
+
     /**
      * Starting the given server instance
      */
     public static void startServerInstance(
-            File dataDir,
-            ServerCnxnFactory factory,
-            String hostPort,
-            int serverId) throws IOException, InterruptedException {
+        File dataDir,
+        ServerCnxnFactory factory,
+        String hostPort,
+        int serverId, ZKConfig zkConfig) throws IOException, InterruptedException {
         final int port = getPort(hostPort);
         LOG.info("STARTING server instance 127.0.0.1:{}", port);
         ZooKeeperServer zks = new ZooKeeperServer(dataDir, dataDir, 3000);
         zks.setCreateSessionTrackerServerId(serverId);
         factory.startup(zks);
         assertTrue(
-                ClientBase.waitForServerUp("127.0.0.1:" + port, CONNECTION_TIMEOUT, factory.isSecure()),
-                "waiting for server up");
+            ClientBase.waitForServerUp("127.0.0.1:" + port, CONNECTION_TIMEOUT, factory.isSecure(), zkConfig),
+            "waiting for server up");
     }
 
     /**
@@ -428,9 +451,9 @@ public static void startServerInstance(
      *      for more information.
      */
     public static ServerCnxnFactory createNewServerInstance(
-            ServerCnxnFactory factory,
-            String hostPort,
-            int maxCnxns) throws IOException, InterruptedException {
+        ServerCnxnFactory factory,
+        String hostPort,
+        int maxCnxns) throws IOException, InterruptedException {
         final int port = getPort(hostPort);
         LOG.info("CREATING server instance 127.0.0.1:{}", port);
         if (factory == null) {
@@ -459,8 +482,8 @@ static void shutdownServerInstance(ServerCnxnFactory factory, String hostPort) {
             final int PORT = getPort(hostPort);
 
             assertTrue(
-                    ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT, factory.isSecure()),
-                    "waiting for server down");
+                ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT, factory.isSecure()),
+                "waiting for server down");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index 20ec82d0989..02b8ff6ef15 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -1217,6 +1217,7 @@ private void assertRemotePeerMXBeanAttributes(QuorumServer qs, String beanName)
     private static class ServerConfigLine {
         private final int serverId;
         private Integer clientPort;
+        private Integer secureClientPort;
 
         // hostName -> <quorumPort1, quorumPort2>
         private final Map<String, Set<Integer>> quorumPorts = new HashMap<>();
@@ -1229,7 +1230,7 @@ private ServerConfigLine(String configLine) {
             serverId = parseInt(parts[0].split("\\.")[1]);
             String[] serverConfig = parts[1].split(";");
             String[] serverAddresses = serverConfig[0].split("\\|");
-            if (serverConfig.length > 1) {
+            if (serverConfig.length > 1 && !serverConfig[1].isEmpty()) {
                 String[] clientParts = serverConfig[1].split(":");
                 if (clientParts.length > 1) {
                     clientPort = parseInt(clientParts[1]);
@@ -1238,6 +1239,15 @@ private ServerConfigLine(String configLine) {
                 }
             }
 
+            if (serverConfig.length > 2 && !serverConfig[2].isEmpty()) {
+                String[] secureClientParts = serverConfig[2].split(":");
+                if (secureClientParts.length > 1) {
+                    secureClientPort = parseInt(secureClientParts[1]);
+                } else {
+                    secureClientPort = parseInt(secureClientParts[0]);
+                }
+            }
+
             for (String addr : serverAddresses) {
                 // addr like: 127.0.0.1:11230:11229:participant or [0:0:0:0:0:0:0:1]:11346:11347
                 String serverHost;
@@ -1268,13 +1278,14 @@ public boolean equals(Object o) {
             ServerConfigLine that = (ServerConfigLine) o;
             return serverId == that.serverId
               && Objects.equals(clientPort, that.clientPort)
+              && Objects.equals(secureClientPort, that.secureClientPort)
               && quorumPorts.equals(that.quorumPorts)
               && electionPorts.equals(that.electionPorts);
         }
 
         @Override
         public int hashCode() {
-            return Objects.hash(serverId, clientPort, quorumPorts, electionPorts);
+            return Objects.hash(serverId, clientPort, secureClientPort, quorumPorts, electionPorts);
         }
     }
 

From 803c485db99134d8f41c2ea90ca9305e6b806d52 Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Sat, 9 Mar 2024 06:31:41 +0100
Subject: [PATCH 440/591] ZOOKEEPER-4804. Use daemon threads for Netty client
 (#2142)

Co-authored-by: tison <wander4096@gmail.com>
---
 .../apache/zookeeper/common/NettyUtils.java   | 32 +++++++++++-----
 .../zookeeper/server/NettyServerCnxnTest.java | 37 ++++++++++++++++++-
 .../org/apache/zookeeper/test/TestUtils.java  | 27 ++++++++++++++
 3 files changed, 86 insertions(+), 10 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java
index dc1fe78f2fa..297cb377e10 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java
@@ -28,6 +28,7 @@
 import io.netty.channel.socket.SocketChannel;
 import io.netty.channel.socket.nio.NioServerSocketChannel;
 import io.netty.channel.socket.nio.NioSocketChannel;
+import io.netty.util.concurrent.DefaultThreadFactory;
 import java.net.InetAddress;
 import java.net.NetworkInterface;
 import java.net.SocketException;
@@ -35,6 +36,7 @@
 import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.Set;
+import java.util.concurrent.ThreadFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,10 +45,22 @@
  */
 public class NettyUtils {
 
+    public static final String THREAD_POOL_NAME_PREFIX = "zkNetty-";
     private static final Logger LOG = LoggerFactory.getLogger(NettyUtils.class);
-
     private static final int DEFAULT_INET_ADDRESS_COUNT = 1;
 
+    /**
+     * Returns a ThreadFactory which generates daemon threads, and uses
+     * the passed class's name to generate the thread names.
+     *
+     * @param clazz Class name to use for generating thread names
+     * @return Netty DefaultThreadFactory configured to create daemon threads
+     */
+    private static ThreadFactory createThreadFactory(String clazz) {
+        final String poolName = THREAD_POOL_NAME_PREFIX + clazz;
+        return new DefaultThreadFactory(poolName, true);
+    }
+
     /**
      * If {@link Epoll#isAvailable()} <code>== true</code>, returns a new
      * {@link EpollEventLoopGroup}, otherwise returns a new
@@ -55,11 +69,7 @@ public class NettyUtils {
      * @return a new {@link EventLoopGroup}.
      */
     public static EventLoopGroup newNioOrEpollEventLoopGroup() {
-        if (Epoll.isAvailable()) {
-            return new EpollEventLoopGroup();
-        } else {
-            return new NioEventLoopGroup();
-        }
+        return newNioOrEpollEventLoopGroup(0);
     }
 
     /**
@@ -72,9 +82,13 @@ public static EventLoopGroup newNioOrEpollEventLoopGroup() {
      */
     public static EventLoopGroup newNioOrEpollEventLoopGroup(int nThreads) {
         if (Epoll.isAvailable()) {
-            return new EpollEventLoopGroup(nThreads);
+            final String clazz = EpollEventLoopGroup.class.getSimpleName();
+            final ThreadFactory factory = createThreadFactory(clazz);
+            return new EpollEventLoopGroup(nThreads, factory);
         } else {
-            return new NioEventLoopGroup(nThreads);
+            final String clazz = NioEventLoopGroup.class.getSimpleName();
+            final ThreadFactory factory = createThreadFactory(clazz);
+            return new NioEventLoopGroup(nThreads, factory);
         }
     }
 
@@ -145,7 +159,7 @@ public static int getClientReachableLocalInetAddressCount() {
                 }
             }
             LOG.debug("Detected {} local network addresses: {}", validInetAddresses.size(), validInetAddresses);
-            return validInetAddresses.size() > 0 ? validInetAddresses.size() : DEFAULT_INET_ADDRESS_COUNT;
+            return !validInetAddresses.isEmpty() ? validInetAddresses.size() : DEFAULT_INET_ADDRESS_COUNT;
         } catch (SocketException ex) {
             LOG.warn("Failed to list all network interfaces, assuming 1", ex);
             return DEFAULT_INET_ADDRESS_COUNT;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index e27361c3790..d7cf9765fe6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -41,23 +41,28 @@
 import java.net.InetSocketAddress;
 import java.net.ProtocolException;
 import java.nio.charset.StandardCharsets;
+import java.util.List;
 import java.util.Random;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.AsyncCallback.DataCallback;
+import org.apache.zookeeper.ClientCnxnSocketNetty;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.NettyUtils;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.BufferStats;
 import org.apache.zookeeper.server.quorum.LeaderZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.SSLAuthTest;
 import org.apache.zookeeper.test.TestByteBufAllocator;
+import org.apache.zookeeper.test.TestUtils;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -323,6 +328,37 @@ public void testEnableDisableThrottling_nonSecure_sequentially() throws Exceptio
         runEnableDisableThrottling(false, false);
     }
 
+    @Test
+    public void testNettyUsesDaemonThreads() throws Exception {
+        assertTrue(serverFactory instanceof NettyServerCnxnFactory,
+                "Didn't instantiate ServerCnxnFactory with NettyServerCnxnFactory!");
+
+        // Use Netty in the client to check the threads on both the client and server side
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, ClientCnxnSocketNetty.class.getName());
+        try {
+            final ZooKeeperServer zkServer = serverFactory.getZooKeeperServer();
+            try (ZooKeeper zk = createClient()) {
+                final String path = "/a";
+                // make sure connection is established
+                zk.create(path, "test".getBytes(StandardCharsets.UTF_8), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+                List<Thread> threads = TestUtils.getAllThreads();
+                boolean foundThread = false;
+                for (Thread t : threads) {
+                    if (t.getName().startsWith(NettyUtils.THREAD_POOL_NAME_PREFIX)) {
+                        foundThread = true;
+                        assertTrue(t.isDaemon(), "All Netty threads started by ZK must daemon threads");
+                    }
+                }
+                assertTrue(foundThread, "Did not find any Netty ZK Threads");
+            } finally {
+                zkServer.shutdown();
+            }
+        } finally {
+            System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        }
+    }
+
     private void runEnableDisableThrottling(boolean secure, boolean randomDisableEnable) throws Exception {
         ClientX509Util x509Util = null;
         if (secure) {
@@ -432,5 +468,4 @@ public void processResult(int rc, String path, Object ctx, byte[] data, Stat sta
             }
         }
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
index e3306c1fe76..8941c05de0e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
@@ -21,6 +21,10 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import org.apache.zookeeper.WatchedEvent;
 
 /**
@@ -71,4 +75,27 @@ public static void assertWatchedEventEquals(WatchedEvent expected, WatchedEvent
         assertEquals(expected.getPath(), actual.getPath());
         assertEquals(expected.getZxid(), actual.getZxid());
     }
+
+    /**
+     * Return all threads
+     *
+     * Code based on commons-lang3 ThreadUtils
+     *
+     * @return all active threads
+     */
+    public static List<Thread> getAllThreads() {
+        ThreadGroup threadGroup = Thread.currentThread().getThreadGroup();
+        while (threadGroup != null && threadGroup.getParent() != null) {
+            threadGroup = threadGroup.getParent();
+        }
+
+        int count = threadGroup.activeCount();
+        Thread[] threads;
+        do {
+            threads = new Thread[count + count / 2 + 1]; //slightly grow the array size
+            count = threadGroup.enumerate(threads, true);
+            //return value of enumerate() must be strictly less than the array size according to javadoc
+        } while (count >= threads.length);
+        return Collections.unmodifiableList(Stream.of(threads).limit(count).collect(Collectors.toList()));
+    }
 }

From d12aba599233b0fcba0b9b945ed3d2f45d4016f0 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@apache.org>
Date: Tue, 28 Nov 2023 21:25:00 +0100
Subject: [PATCH 441/591] ZOOKEEPER-4799: Refactor ACL check in 'addWatch'
 command

As of today, it is impossible to diagnose which watch events are dropped
because of ACLs.  Let's centralize, systematize, and log the checks at
the 'process()' site in the Netty and NIO connections.

(These 'process()' methods contain some duplicated code, and should also
be refactored at some point.  This series does not change them.)

This patch also adds a substantial number of tests in order to avoid
unexpected regressions.

Co-authored-by: Patrick Hunt <phunt@apache.org>
Co-authored-by: Damien Diederen <ddiederen@apache.org>
---
 .../zookeeper/server/watch/WatchBench.java    |   6 +-
 .../org/apache/zookeeper/server/DataTree.java |  23 +-
 .../apache/zookeeper/server/DumbWatcher.java  |   4 +-
 .../zookeeper/server/NIOServerCnxn.java       |  16 +-
 .../zookeeper/server/NettyServerCnxn.java     |  17 +-
 .../apache/zookeeper/server/ServerCnxn.java   |  10 +-
 .../zookeeper/server/ServerWatcher.java       |  29 +
 .../zookeeper/server/watch/IWatchManager.java |   7 +-
 .../zookeeper/server/watch/WatchManager.java  |  15 +-
 .../server/watch/WatchManagerOptimized.java   |  15 +-
 .../zookeeper/server/MockServerCnxn.java      |   4 +-
 .../server/watch/WatchManagerTest.java        |  14 +-
 .../test/PersistentWatcherACLTest.java        | 629 ++++++++++++++++++
 .../test/UnsupportedAddWatcherTest.java       |   9 +-
 14 files changed, 763 insertions(+), 35 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java

diff --git a/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
index 7de1be0370b..9dea3ca3486 100644
--- a/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
@@ -191,7 +191,7 @@ void prepare() {
     @Measurement(iterations = 3, time = 10, timeUnit = TimeUnit.SECONDS)
     public void testTriggerConcentrateWatch(InvocationState state) throws Exception {
         for (String path : state.paths) {
-            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID);
+            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID, null);
         }
     }
 
@@ -225,7 +225,7 @@ public void tearDown() {
 
             // clear all the watches
             for (String path : paths) {
-                watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID);
+                watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID, null);
             }
         }
     }
@@ -294,7 +294,7 @@ public void prepare() {
     @Measurement(iterations = 3, time = 10, timeUnit = TimeUnit.SECONDS)
     public void testTriggerSparseWatch(TriggerSparseWatchState state) throws Exception {
         for (String path : state.paths) {
-            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID);
+            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID, null);
         }
     }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 4a3de64c7af..012a10e5469 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -445,7 +445,10 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
         if (parent == null) {
             throw new NoNodeException();
         }
+        List<ACL> parentAcl;
         synchronized (parent) {
+            parentAcl = getACL(parent);
+
             // Add the ACL to ACL cache first, to avoid the ACL not being
             // created race condition during fuzzy snapshot sync.
             //
@@ -518,8 +521,9 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
             updateQuotaStat(lastPrefix, bytes, 1);
         }
         updateWriteStat(path, bytes);
-        dataWatches.triggerWatch(path, Event.EventType.NodeCreated, zxid);
-        childWatches.triggerWatch(parentName.equals("") ? "/" : parentName, Event.EventType.NodeChildrenChanged, zxid);
+        dataWatches.triggerWatch(path, Event.EventType.NodeCreated, zxid, acl);
+        childWatches.triggerWatch(parentName.equals("") ? "/" : parentName,
+            Event.EventType.NodeChildrenChanged, zxid, parentAcl);
     }
 
     /**
@@ -559,8 +563,10 @@ public void deleteNode(String path, long zxid) throws NoNodeException {
         if (node == null) {
             throw new NoNodeException();
         }
+        List<ACL> acl;
         nodes.remove(path);
         synchronized (node) {
+            acl = getACL(node);
             aclCache.removeUsage(node.acl);
             nodeDataSize.addAndGet(-getNodeSize(path, node.data));
         }
@@ -568,7 +574,9 @@ public void deleteNode(String path, long zxid) throws NoNodeException {
         // Synchronized to sync the containers and ttls change, probably
         // only need to sync on containers and ttls, will update it in a
         // separate patch.
+        List<ACL> parentAcl;
         synchronized (parent) {
+            parentAcl = getACL(parent);
             long owner = node.stat.getEphemeralOwner();
             EphemeralType ephemeralType = EphemeralType.get(owner);
             if (ephemeralType == EphemeralType.CONTAINER) {
@@ -615,9 +623,10 @@ public void deleteNode(String path, long zxid) throws NoNodeException {
                 "childWatches.triggerWatch " + parentName);
         }
 
-        WatcherOrBitSet processed = dataWatches.triggerWatch(path, EventType.NodeDeleted, zxid);
-        childWatches.triggerWatch(path, EventType.NodeDeleted, zxid, processed);
-        childWatches.triggerWatch("".equals(parentName) ? "/" : parentName, EventType.NodeChildrenChanged, zxid);
+        WatcherOrBitSet processed = dataWatches.triggerWatch(path, EventType.NodeDeleted, zxid, acl);
+        childWatches.triggerWatch(path, EventType.NodeDeleted, zxid, acl, processed);
+        childWatches.triggerWatch("".equals(parentName) ? "/" : parentName,
+            EventType.NodeChildrenChanged, zxid, parentAcl);
     }
 
     public Stat setData(String path, byte[] data, int version, long zxid, long time) throws NoNodeException {
@@ -626,8 +635,10 @@ public Stat setData(String path, byte[] data, int version, long zxid, long time)
         if (n == null) {
             throw new NoNodeException();
         }
+        List<ACL> acl;
         byte[] lastData;
         synchronized (n) {
+            acl = getACL(n);
             lastData = n.data;
             nodes.preChange(path, n);
             n.data = data;
@@ -649,7 +660,7 @@ public Stat setData(String path, byte[] data, int version, long zxid, long time)
         nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastData));
 
         updateWriteStat(path, dataBytes);
-        dataWatches.triggerWatch(path, EventType.NodeDataChanged, zxid);
+        dataWatches.triggerWatch(path, EventType.NodeDataChanged, zxid, acl);
         return s;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
index 231a063fe12..fc4648758cf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
@@ -22,8 +22,10 @@
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
 import java.security.cert.Certificate;
+import java.util.List;
 import org.apache.jute.Record;
 import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ReplyHeader;
 
@@ -51,7 +53,7 @@ void setSessionTimeout(int sessionTimeout) {
     }
 
     @Override
-    public void process(WatchedEvent event) {
+    public void process(WatchedEvent event, List<ACL> znodeAcl) {
         mostRecentEventType = event.getType();
         mostRecentZxid = event.getZxid();
         mostRecentPath = event.getPath();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index cfd04fcf620..d35cf97edad 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -30,14 +30,17 @@
 import java.nio.channels.SelectionKey;
 import java.nio.channels.SocketChannel;
 import java.security.cert.Certificate;
+import java.util.List;
 import java.util.Queue;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.atomic.AtomicBoolean;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ClientCnxn;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ConnectRequest;
@@ -704,7 +707,18 @@ public int sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, St
      * @see org.apache.zookeeper.server.ServerCnxnIface#process(org.apache.zookeeper.proto.WatcherEvent)
      */
     @Override
-    public void process(WatchedEvent event) {
+    public void process(WatchedEvent event, List<ACL> znodeAcl) {
+        try {
+            zkServer.checkACL(this, znodeAcl, ZooDefs.Perms.READ, getAuthInfo(), event.getPath(), null);
+        } catch (KeeperException.NoAuthException e) {
+            if (LOG.isTraceEnabled()) {
+                ZooTrace.logTraceMessage(
+                    LOG,
+                    ZooTrace.EVENT_DELIVERY_TRACE_MASK,
+                    "Not delivering event " + event + " to 0x" + Long.toHexString(this.sessionId) + " (filtered by ACL)");
+            }
+            return;
+        }
         ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, event.getZxid(), 0);
         if (LOG.isTraceEnabled()) {
             ZooTrace.logTraceMessage(
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 8a7de2e9228..fe0380db182 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -38,11 +38,15 @@
 import java.nio.channels.SelectionKey;
 import java.security.cert.Certificate;
 import java.util.Arrays;
+import java.util.List;
 import java.util.concurrent.atomic.AtomicBoolean;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ClientCnxn;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ConnectRequest;
@@ -161,7 +165,18 @@ public int getSessionTimeout() {
     }
 
     @Override
-    public void process(WatchedEvent event) {
+    public void process(WatchedEvent event, List<ACL> znodeAcl) {
+        try {
+            zkServer.checkACL(this, znodeAcl, ZooDefs.Perms.READ, getAuthInfo(), event.getPath(), null);
+        } catch (KeeperException.NoAuthException e) {
+            if (LOG.isTraceEnabled()) {
+                ZooTrace.logTraceMessage(
+                    LOG,
+                    ZooTrace.EVENT_DELIVERY_TRACE_MASK,
+                    "Not delivering event " + event + " to 0x" + Long.toHexString(this.sessionId) + " (filtered by ACL)");
+            }
+            return;
+        }
         ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, event.getZxid(), 0);
         if (LOG.isTraceEnabled()) {
             ZooTrace.logTraceMessage(
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index 652823e1a51..ebfd32afa4a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -37,9 +37,9 @@
 import org.apache.jute.Record;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.WatchedEvent;
-import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.compat.ProtocolManager;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.metrics.Counter;
@@ -52,7 +52,7 @@
  * Interface to a Server connection - represents a connection from a client
  * to the server.
  */
-public abstract class ServerCnxn implements Stats, Watcher {
+public abstract class ServerCnxn implements Stats, ServerWatcher {
 
     // This is just an arbitrary object to represent requests issued by
     // (aka owned by) this class
@@ -254,7 +254,11 @@ protected ByteBuffer[] serialize(ReplyHeader h, Record r, String cacheKey, Stat
     /* notify the client the session is closing and close/cleanup socket */
     public abstract void sendCloseSession();
 
-    public abstract void process(WatchedEvent event);
+    public void process(WatchedEvent event) {
+        process(event, null);
+    }
+
+    public abstract void process(WatchedEvent event, List<ACL> znodeAcl);
 
     public abstract long getSessionId();
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java
new file mode 100644
index 00000000000..bfd4b2501dc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import java.util.List;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.data.ACL;
+
+public interface ServerWatcher extends Watcher {
+
+  void process(WatchedEvent event, List<ACL> znodeAcl);
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
index 0d537b4ec67..3e27698555d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
@@ -19,9 +19,11 @@
 package org.apache.zookeeper.server.watch;
 
 import java.io.PrintWriter;
+import java.util.List;
 import javax.annotation.Nullable;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
+import org.apache.zookeeper.data.ACL;
 
 public interface IWatchManager {
 
@@ -114,10 +116,11 @@ default boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherM
      * @param path znode path
      * @param type the watch event type
      * @param zxid the zxid for the corresponding change that triggered this event
+     * @param acl ACL of the znode in path
      *
      * @return the watchers have been notified
      */
-    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid);
+    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl);
 
     /**
      * Distribute the watch event for the given path, but ignore those
@@ -130,7 +133,7 @@ default boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherM
      *
      * @return the watchers have been notified
      */
-    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, WatcherOrBitSet suppress);
+    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress);
 
     /**
      * Get the size of watchers.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
index 568de2a82d0..d1c743104b1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
@@ -23,6 +23,7 @@
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
@@ -30,8 +31,10 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.ServerWatcher;
 import org.apache.zookeeper.server.ZooTrace;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -129,12 +132,12 @@ public synchronized void removeWatcher(Watcher watcher) {
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid) {
-        return triggerWatch(path, type, zxid, null);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl) {
+        return triggerWatch(path, type, zxid, acl, null);
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, WatcherOrBitSet supress) {
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet supress) {
         WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
         Set<Watcher> watchers = new HashSet<>();
         synchronized (this) {
@@ -182,7 +185,11 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, Watc
             if (supress != null && supress.contains(w)) {
                 continue;
             }
-            w.process(e);
+            if (w instanceof ServerWatcher) {
+                ((ServerWatcher) w).process(e, acl);
+            } else {
+                w.process(e);
+            }
         }
 
         switch (type) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
index 0a6b4279fdb..84cf2c73d13 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
@@ -22,6 +22,7 @@
 import java.util.BitSet;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
@@ -31,8 +32,10 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.ServerWatcher;
 import org.apache.zookeeper.server.util.BitHashSet;
 import org.apache.zookeeper.server.util.BitMap;
 import org.slf4j.Logger;
@@ -202,12 +205,12 @@ public void processDeadWatchers(Set<Integer> deadWatchers) {
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid) {
-        return triggerWatch(path, type, zxid, null);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl) {
+        return triggerWatch(path, type, zxid, acl, null);
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, WatcherOrBitSet suppress) {
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress) {
         WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
 
         BitHashSet watchers = remove(path);
@@ -232,7 +235,11 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, Watc
                     continue;
                 }
 
-                w.process(e);
+                if (w instanceof ServerWatcher) {
+                    ((ServerWatcher) w).process(e, acl);
+                } else {
+                    w.process(e);
+                }
                 triggeredWatches++;
             }
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
index 4dfcebd84ec..af095921dad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
@@ -22,8 +22,10 @@
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
 import java.security.cert.Certificate;
+import java.util.List;
 import org.apache.jute.Record;
 import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ReplyHeader;
 
@@ -56,7 +58,7 @@ public void sendCloseSession() {
     }
 
     @Override
-    public void process(WatchedEvent event) {
+    public void process(WatchedEvent event, List<ACL> acl) {
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
index ba97b887e6d..51bbb94d88a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
@@ -133,7 +133,7 @@ public WatcherTriggerWorker(
         public void run() {
             while (!stopped) {
                 String path = PATH_PREFIX + r.nextInt(paths);
-                WatcherOrBitSet s = manager.triggerWatch(path, EventType.NodeDeleted, -1);
+                WatcherOrBitSet s = manager.triggerWatch(path, EventType.NodeDeleted, -1, null);
                 if (s != null) {
                     triggeredCount.addAndGet(s.size());
                 }
@@ -756,7 +756,7 @@ public void testWatcherMetrics(String className) throws IOException {
         //path2 is watched by watcher1
         manager.addWatch(path2, watcher1);
 
-        manager.triggerWatch(path3, EventType.NodeCreated, 1);
+        manager.triggerWatch(path3, EventType.NodeCreated, 1, null);
         //path3 is not being watched so metric is 0
         checkMetrics("node_created_watch_count", 0L, 0L, 0D, 0L, 0L);
         // Watchers shouldn't have received any events yet so the zxid should be -1.
@@ -764,19 +764,19 @@ public void testWatcherMetrics(String className) throws IOException {
         checkMostRecentWatchedEvent(watcher2, null, null, -1);
 
         //path1 is watched by two watchers so two fired
-        manager.triggerWatch(path1, EventType.NodeCreated, 2);
+        manager.triggerWatch(path1, EventType.NodeCreated, 2, null);
         checkMetrics("node_created_watch_count", 2L, 2L, 2D, 1L, 2L);
         checkMostRecentWatchedEvent(watcher1, path1, EventType.NodeCreated, 2);
         checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
         //path2 is watched by one watcher so one fired now total is 3
-        manager.triggerWatch(path2, EventType.NodeCreated, 3);
+        manager.triggerWatch(path2, EventType.NodeCreated, 3, null);
         checkMetrics("node_created_watch_count", 1L, 2L, 1.5D, 2L, 3L);
         checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeCreated, 3);
         checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
         //watches on path1 are no longer there so zero fired
-        manager.triggerWatch(path1, EventType.NodeDataChanged, 4);
+        manager.triggerWatch(path1, EventType.NodeDataChanged, 4, null);
         checkMetrics("node_changed_watch_count", 0L, 0L, 0D, 0L, 0L);
         checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeCreated, 3);
         checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
@@ -788,12 +788,12 @@ public void testWatcherMetrics(String className) throws IOException {
         //path2 is watched by watcher1
         manager.addWatch(path2, watcher1);
 
-        manager.triggerWatch(path1, EventType.NodeDataChanged, 5);
+        manager.triggerWatch(path1, EventType.NodeDataChanged, 5, null);
         checkMetrics("node_changed_watch_count", 2L, 2L, 2D, 1L, 2L);
         checkMostRecentWatchedEvent(watcher1, path1, EventType.NodeDataChanged, 5);
         checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeDataChanged, 5);
 
-        manager.triggerWatch(path2, EventType.NodeDeleted, 6);
+        manager.triggerWatch(path2, EventType.NodeDeleted, 6, null);
         checkMetrics("node_deleted_watch_count", 1L, 1L, 1D, 1L, 1L);
         checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeDeleted, 6);
         checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeDataChanged, 5);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java
new file mode 100644
index 00000000000..1597a4850e9
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java
@@ -0,0 +1,629 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
+import static org.apache.zookeeper.AddWatchMode.PERSISTENT_RECURSIVE;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.AddWatchMode;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.Watcher.Event.EventType;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * This class encodes a set of tests corresponding to a "truth table"
+ * of interactions between persistent watchers and znode ACLs:
+ *
+ * <a href="https://docs.google.com/spreadsheets/d/1eMH2aimrrMc_b6McU8CHm2yCj2X-w30Fy4fCBOHn7NA/edit#gid=0">https://docs.google.com/spreadsheets/d/1eMH2aimrrMc_b6McU8CHm2yCj2X-w30Fy4fCBOHn7NA/edit#gid=0</a>
+ */
+public class PersistentWatcherACLTest extends ClientBase {
+    private static final Logger LOG = LoggerFactory.getLogger(PersistentWatcherACLTest.class);
+    /** An ACL denying READ. */
+    private static final List<ACL> ACL_NO_READ = Collections.singletonList(new ACL(ZooDefs.Perms.ALL & ~ZooDefs.Perms.READ, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+    private BlockingQueue<WatchedEvent> events;
+    private Watcher persistentWatcher;
+
+    @Override
+    @BeforeEach
+    public void setUp() throws Exception {
+        super.setUp();
+
+        events = new LinkedBlockingQueue<>();
+        persistentWatcher = event -> {
+            events.add(event);
+            LOG.info("Added event: {}; total: {}", event, events.size());
+        };
+    }
+
+    /**
+     * This Step class, with the Round class below, is used to encode
+     * the contents of the truth table.
+     *
+     * (These should become Records once we target JDK 14+.)
+     */
+    private static class Step {
+        Step(int opCode, String target) {
+            this(opCode, target, null, null);
+        }
+        Step(int opCode, String target, EventType eventType, String eventPath) {
+            this.opCode = opCode;
+            this.target = target;
+            this.eventType = eventType;
+            this.eventPath = eventPath;
+        }
+        /** Action: create, setData or delete */
+        final int opCode;
+        /** Target path */
+        final String target;
+        /** Expected event type, {@code null} if no event is expected */
+        final EventType eventType;
+        /** Expected event path, {@code null} if no event is expected */
+        final String eventPath;
+    }
+
+    /**
+     * This Round class, with the Step class above, is used to encode
+     * the contents of the truth table.
+     *
+     * (These should become Records once we target JDK 14+.)
+     */
+    private static class Round {
+        Round(String summary, Boolean allowA, Boolean allowB, Boolean allowC, String watchTarget, AddWatchMode watchMode, Step[] steps) {
+            this.summary = summary;
+            this.allowA = allowA;
+            this.allowB = allowB;
+            this.allowC = allowC;
+            this.watchTarget = watchTarget;
+            this.watchMode = watchMode;
+            this.steps = steps;
+        }
+        /** Notes/summary */
+        final String summary;
+        /** Should /a's ACL leave it readable? */
+        final Boolean allowA;
+        /** Should /a/b's ACL leave it readable? */
+        final Boolean allowB;
+        /** Should /a/b/c's ACL leave it readable? */
+        final Boolean allowC;
+        /** Watch path */
+        final String watchTarget;
+        /** Watch mode */
+        final AddWatchMode watchMode;
+        /** Actions and expected events */
+        final Step[] steps;
+    }
+
+    /**
+     * A "round" of tests from the table encoded as Java objects.
+     *
+     * Note that the set of rounds is collected in a {@code ROUNDS}
+     * array below, and that this test class includes a {@code main}
+     * method which produces a "CSV" rendition of the table, for ease
+     * of comparison with the original.
+     *
+     * @see #ROUNDS
+     */
+    private static final Round roundNothingAsAIsWatchedButDeniedBIsNotWatched =
+        new Round(
+            "Nothing as a is watched but denied. b is not watched",
+            false, true, null, "/a", PERSISTENT, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingAsBothAAndBDenied =
+        new Round(
+            "Nothing as both a and b denied",
+            false, false, null, "/a", PERSISTENT, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundAChangesInclChildrenAreSeen =
+        new Round(
+            "a changes, incl children, are seen",
+            true, false, null, "/a", PERSISTENT, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a", EventType.NodeCreated, "/a"),
+                new Step(ZooDefs.OpCode.setData, "/a", EventType.NodeDataChanged, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeChildrenChanged, "/a"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeChildrenChanged, "/a"),
+                new Step(ZooDefs.OpCode.delete, "/a", EventType.NodeDeleted, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingForAAsItSDeniedBChangesSeen =
+        new Round(
+            "Nothing for a as it's denied, b changes allowed/seen",
+            false, true, null, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeCreated, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b", EventType.NodeDataChanged, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeDeleted, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingBothDenied =
+        new Round(
+            "Nothing - both denied",
+            false, false, null, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingAllDenied =
+        new Round(
+            "Nothing - all denied",
+            false, false, false, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundADeniesSeeAllChangesForBAndCIncludingBChildren =
+        new Round(
+            "a denies, see all changes for b and c, including b's children",
+            false, true, true, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeCreated, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b", EventType.NodeDataChanged, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c", EventType.NodeCreated, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c", EventType.NodeDataChanged, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c", EventType.NodeDeleted, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeDeleted, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundADeniesSeeAllBChangesAndBChildrenNothingForC =
+        new Round(
+            "a denies, see all b changes and b's children, nothing for c",
+            false, true, false, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeCreated, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b", EventType.NodeDataChanged, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeDeleted, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingTheWatchIsOnC =
+        new Round(
+            "Nothing - the watch is on c",
+            false, true, false, "/a/b/c", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundTheWatchIsOnlyOnCBAndCAllowed =
+        new Round(
+            "The watch is only on c (b and c allowed)",
+            false, true, true, "/a/b/c", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c", EventType.NodeCreated, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c", EventType.NodeDataChanged, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c", EventType.NodeDeleted, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+            }
+        );
+
+    /**
+     * Transform the "tristate" {@code allow} property to a concrete
+     * ACL which can be passed to the ZooKeeper API.
+     *
+     * @param allow "tristate" value: {@code null}/don't care, {@code
+     * true}, {@code false}
+     * @return the ACL
+     */
+    private static List<ACL> selectAcl(Boolean allow) {
+        if (allow == null) {
+            return null;
+        } else if (!allow) {
+            return ACL_NO_READ;
+        } else {
+            return ZooDefs.Ids.OPEN_ACL_UNSAFE;
+        }
+    }
+
+    /**
+     * Executes one "round" of tests from the Java object encoding of
+     * the table.
+     *
+     * @param round the "round"
+     *
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see PersistentWatcherACLTest.Round
+     * @see PersistentWatcherACLTest.Step
+     */
+    private void execRound(Round round)
+        throws IOException, InterruptedException, KeeperException {
+        try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
+            List<ACL> aclForA = selectAcl(round.allowA);
+            List<ACL> aclForB = selectAcl(round.allowB);
+            List<ACL> aclForC = selectAcl(round.allowC);
+
+            boolean firstStepCreatesA = round.steps.length > 0
+                && round.steps[0].opCode == ZooDefs.OpCode.create
+                && round.steps[0].target.equals("/a");
+
+            // Assume /a always exists (except if it's about to be created)
+            if (!firstStepCreatesA) {
+                zk.create("/a", new byte[0], aclForA, CreateMode.PERSISTENT);
+            }
+
+            zk.addWatch(round.watchTarget, persistentWatcher, round.watchMode);
+
+            for (int i = 0; i < round.steps.length; i++) {
+                Step step = round.steps[i];
+
+                switch (step.opCode) {
+                case ZooDefs.OpCode.create:
+                    List<ACL> acl = step.target.endsWith("/c")
+                        ? aclForC
+                        : step.target.endsWith("/b")
+                        ? aclForB
+                        : aclForA;
+                    zk.create(step.target, new byte[0], acl, CreateMode.PERSISTENT);
+                    break;
+                case ZooDefs.OpCode.delete:
+                    zk.delete(step.target, -1);
+                    break;
+                case ZooDefs.OpCode.setData:
+                    zk.setData(step.target, new byte[0], -1);
+                    break;
+                default:
+                    fail("Unexpected opCode " + step.opCode + " in step " + i);
+                    break;
+                }
+
+                WatchedEvent actualEvent = events.poll(500, TimeUnit.MILLISECONDS);
+                if (step.eventType == null) {
+                    assertNull(actualEvent, "Unexpected event " + actualEvent + " at step " + i);
+                } else {
+                    String m = "In event " + actualEvent + " at step " + i;
+                    assertNotNull(actualEvent, m);
+                    assertEquals(step.eventType,  actualEvent.getType(), m);
+                    assertEquals(step.eventPath, actualEvent.getPath(), m);
+                }
+            }
+        }
+    }
+
+    /**
+     * A test method, wrapping the definition of a "round."  This
+     * should really use JUnit 5's runtime test case generation
+     * facilities, but that would prevent backporting this suite to
+     * JUnit 4.
+     *
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see <a href="https://junit.org/junit5/docs/5.0.2/api/org/junit/jupiter/api/DynamicTest.html">JUnit 5 runtime test case generation</a>
+     */
+    @Test
+    public void testNothingAsAIsWatchedButDeniedBIsNotWatched()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingAsAIsWatchedButDeniedBIsNotWatched);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingAsBothAAndBDenied
+     */
+    @Test
+    public void testNothingAsBothAAndBDenied()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingAsBothAAndBDenied);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundAChangesInclChildrenAreSeen
+     */
+    @Test
+    public void testAChangesInclChildrenAreSeen()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundAChangesInclChildrenAreSeen);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingForAAsItSDeniedBChangesSeen
+     */
+    @Test
+    public void testNothingForAAsItSDeniedBChangesSeen()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingForAAsItSDeniedBChangesSeen);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingBothDenied
+     */
+    @Test
+    public void testNothingBothDenied()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingBothDenied);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingAllDenied
+     */
+    @Test
+    public void testNothingAllDenied()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingAllDenied);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundADeniesSeeAllChangesForBAndCIncludingBChildren
+     */
+    @Test
+    public void testADeniesSeeAllChangesForBAndCIncludingBChildren()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundADeniesSeeAllChangesForBAndCIncludingBChildren);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundADeniesSeeAllBChangesAndBChildrenNothingForC
+     */
+    @Test
+    public void testADeniesSeeAllBChangesAndBChildrenNothingForC()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundADeniesSeeAllBChangesAndBChildrenNothingForC);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingTheWatchIsOnC
+     */
+    @Test
+    public void testNothingTheWatchIsOnC()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingTheWatchIsOnC);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundTheWatchIsOnlyOnCBAndCAllowed
+     */
+    @Test
+    public void testTheWatchIsOnlyOnCBAndCAllowed()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundTheWatchIsOnlyOnCBAndCAllowed);
+    }
+
+    // The rest of this class is the world's lamest "CSV" encoder.
+
+    /**
+     * The set of rounds.  This array includes one entry for each
+     * {@code private static final Round round*} member variable
+     * defined above.
+     *
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round[] ROUNDS = new Round[] {
+        roundNothingAsAIsWatchedButDeniedBIsNotWatched,
+        roundNothingAsBothAAndBDenied,
+        roundAChangesInclChildrenAreSeen,
+        roundNothingForAAsItSDeniedBChangesSeen,
+        roundNothingBothDenied,
+        roundNothingAllDenied,
+        roundADeniesSeeAllChangesForBAndCIncludingBChildren,
+        roundADeniesSeeAllBChangesAndBChildrenNothingForC,
+        roundNothingTheWatchIsOnC,
+        roundTheWatchIsOnlyOnCBAndCAllowed,
+    };
+
+    private static String allowString(String prefix, Boolean allow) {
+        if (allow == null) {
+            return "";
+        } else {
+            return prefix + (allow ? "allow" : "deny");
+        }
+    }
+
+    private static String watchModeString(AddWatchMode watchMode) {
+        switch (watchMode) {
+        case PERSISTENT:
+            return "PERSISTENT";
+        case PERSISTENT_RECURSIVE:
+            return "PRECURSIVE";
+        default:
+            return "?";
+        }
+    }
+
+    private static String actionString(int opCode) {
+        switch (opCode) {
+        case ZooDefs.OpCode.create:
+            return "create";
+        case ZooDefs.OpCode.delete:
+            return "delete";
+        case ZooDefs.OpCode.setData:
+            return "modify";
+        default:
+            return "?";
+        }
+    }
+
+    private static String eventPathString(String eventPath) {
+        if (eventPath == null) {
+            return "?";
+        } else if (eventPath.length() <= 1) {
+            return eventPath;
+        } else {
+            return eventPath.substring(eventPath.lastIndexOf('/') + 1);
+        }
+    }
+
+    /**
+     * Generates a "CSV" rendition of the table in sb.
+     *
+     * @param sb the target string builder
+     */
+    private static void genCsv(StringBuilder sb) {
+        sb.append("Initial State,")
+            .append("Action,")
+            .append("NodeCreated,")
+            .append("NodeDeleted,")
+            .append("NodeDataChanged,")
+            .append("NodeChildrenChanged,")
+            .append("Notes/summary\n");
+        sb.append("Assume /a always exists\n\n");
+
+        for (Round round : ROUNDS) {
+            sb.append("\"ACL")
+                .append(allowString(": a ", round.allowA))
+                .append(allowString(", b ", round.allowB))
+                .append(allowString(", c ", round.allowC))
+                .append("\"")
+                .append(",,,,,,\"")
+                .append(round.summary)
+                .append("\"\n");
+            for (int i = 0; i < round.steps.length; i++) {
+                Step step = round.steps[i];
+
+                if (i == 0) {
+                    sb.append("\"addWatch(")
+                        .append(round.watchTarget)
+                        .append(", ")
+                        .append(watchModeString(round.watchMode))
+                        .append(")\"");
+                }
+
+                sb.append(",")
+                    .append(actionString(step.opCode))
+                    .append(" ")
+                    .append(step.target)
+                    .append(",");
+
+                if (step.eventType == EventType.NodeCreated) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append(",");
+
+                if (step.eventType == EventType.NodeDeleted) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append(",");
+
+                if (step.eventType == EventType.NodeDataChanged) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append(",");
+
+                if (round.watchMode == PERSISTENT_RECURSIVE) {
+                    sb.append("n");
+                } else if (step.eventType == EventType.NodeChildrenChanged) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append("\n");
+            }
+
+            sb.append("\n");
+        }
+    }
+
+    /**
+     * Generates a "CSV" rendition of the table to standard output.
+     *
+     * @see #ROUNDS
+     */
+    public static void main(String[] args) {
+        StringBuilder sb = new StringBuilder();
+        genCsv(sb);
+        System.out.println(sb);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
index cce26276cdd..a49640184d9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
@@ -21,10 +21,14 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.Collections;
+import java.util.List;
 import org.apache.zookeeper.AddWatchMode;
+import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.watch.IWatchManager;
 import org.apache.zookeeper.server.watch.WatchManagerFactory;
 import org.apache.zookeeper.server.watch.WatcherOrBitSet;
@@ -59,12 +63,12 @@ public void removeWatcher(Watcher watcher) {
         }
 
         @Override
-        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid) {
+        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid, List<ACL> acl) {
             return new WatcherOrBitSet(Collections.emptySet());
         }
 
         @Override
-        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid, WatcherOrBitSet suppress) {
+        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress) {
             return new WatcherOrBitSet(Collections.emptySet());
         }
 
@@ -120,6 +124,7 @@ public void testBehavior() throws IOException, InterruptedException, KeeperExcep
             try (ZooKeeper zk = createClient(hostPort)) {
                 // the server will generate an exception as our custom watch manager doesn't implement
                 // the new version of addWatch()
+                zk.create("/foo", null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
                 zk.addWatch("/foo", event -> {
                 }, AddWatchMode.PERSISTENT_RECURSIVE);
             }

From ee994fbca51f826e4b26d6a105866975d0007f6e Mon Sep 17 00:00:00 2001
From: Nicholas Feinberg <pleasingfung@gmail.com>
Date: Tue, 23 Apr 2024 21:10:20 -0700
Subject: [PATCH 442/591] ZOOKEEPER-4830. Replace references to zk_followers
 (#2160)

It was renamed to zk_learners in 290f1fc4b907c7d51ec / ZOOKEEPER-3117, but many references weren't updated.
---
 .../zkui/src/zkui/templates/view.mako                           | 2 +-
 .../zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf       | 2 +-
 .../zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py   | 2 +-
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako b/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako
index e046afc4fe5..9dd7fe7a2fe 100644
--- a/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako
+++ b/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako
@@ -96,7 +96,7 @@ ${shared.info_button(url('zkui.views.tree', id=cluster['id'], path='/'), 'View Z
     ${show_stats(leader)}
     
     <tr><td>Followers</td>
-      <td>${leader.get('zk_followers', '')}</td>
+      <td>${leader.get('zk_learners', '')}</td>
     </tr>
 
     <tr><td>Synced Followers</td>
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf
index 44acd93e162..861028010a9 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf
@@ -43,7 +43,7 @@ collection_group {
   metric { name = "zk_approximate_data_size" }
   metric { name = "zk_open_file_descriptor_count" }
   metric { name = "zk_max_file_descriptor_count" }
-  metric { name = "zk_followers" }
+  metric { name = "zk_learners" }
   metric { name = "zk_synced_followers" }
   metric { name = "zk_pending_syncs" }
   metric { name = "zk_last_proposal_size" }
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py
index bbb7a8e68e0..eb0e92052bb 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py
@@ -212,7 +212,7 @@ def metric_init(params=None):
         'zk_approximate_data_size': {'units': 'bytes'},
         'zk_open_file_descriptor_count': {'units': 'descriptors'},
         'zk_max_file_descriptor_count': {'units': 'descriptors'},
-        'zk_followers': {'units': 'nodes'},
+        'zk_learners': {'units': 'nodes'},
         'zk_synced_followers': {'units': 'nodes'},
         'zk_pending_syncs': {'units': 'syncs'},
         'zk_last_proposal_size': {'units': 'bytes'},
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index f9cb0341b30..cfd8bb3d829 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2490,7 +2490,7 @@ Moving forward, Four Letter Words will be deprecated, please use
                   zk_watch_count  0
                   zk_ephemerals_count 0
                   zk_approximate_data_size    27
-                  zk_followers    4                   - only exposed by the Leader
+                  zk_learners    4                    - only exposed by the Leader
                   zk_synced_followers 4               - only exposed by the Leader
                   zk_pending_syncs    0               - only exposed by the Leader
                   zk_open_file_descriptor_count 23    - only available on Unix platforms

From 499d1b031fd679db6a4b139901afdb9e6c21109a Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Tue, 30 Apr 2024 16:12:34 +0800
Subject: [PATCH 443/591] ZOOKEEPER-4826 Reduce unnecessary executable
 permissions on files (#2157)

Signed-off-by: ZhangJian He <shoothzj@gmail.com>
---
 zookeeper-assembly/pom.xml                          |   0
 zookeeper-client/pom.xml                            |   0
 zookeeper-client/zookeeper-client-c/pom.xml         |   0
 zookeeper-contrib/pom.xml                           |   0
 zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml  |   0
 .../zookeeper-contrib-loggraph/pom.xml              |   0
 zookeeper-contrib/zookeeper-contrib-rest/pom.xml    |   0
 .../zookeeper-contrib-zooinspector/pom.xml          |   0
 .../src/main/resources/markdown/images/2pc.jpg      | Bin
 .../main/resources/markdown/images/state_dia.dia    | Bin
 .../main/resources/markdown/images/state_dia.jpg    | Bin
 zookeeper-it/pom.xml                                |   0
 zookeeper-jute/pom.xml                              |   0
 zookeeper-metrics-providers/pom.xml                 |   0
 .../zookeeper-prometheus-metrics/pom.xml            |   0
 zookeeper-recipes/pom.xml                           |   0
 .../zookeeper-recipes-election/pom.xml              |   0
 zookeeper-recipes/zookeeper-recipes-lock/pom.xml    |   0
 zookeeper-recipes/zookeeper-recipes-queue/pom.xml   |   0
 zookeeper-server/pom.xml                            |   0
 .../org/apache/zookeeper/ClientCnxnSocketNetty.java |   0
 21 files changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 zookeeper-assembly/pom.xml
 mode change 100755 => 100644 zookeeper-client/pom.xml
 mode change 100755 => 100644 zookeeper-client/zookeeper-client-c/pom.xml
 mode change 100755 => 100644 zookeeper-contrib/pom.xml
 mode change 100755 => 100644 zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
 mode change 100755 => 100644 zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
 mode change 100755 => 100644 zookeeper-contrib/zookeeper-contrib-rest/pom.xml
 mode change 100755 => 100644 zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
 mode change 100755 => 100644 zookeeper-docs/src/main/resources/markdown/images/2pc.jpg
 mode change 100755 => 100644 zookeeper-docs/src/main/resources/markdown/images/state_dia.dia
 mode change 100755 => 100644 zookeeper-docs/src/main/resources/markdown/images/state_dia.jpg
 mode change 100755 => 100644 zookeeper-it/pom.xml
 mode change 100755 => 100644 zookeeper-jute/pom.xml
 mode change 100755 => 100644 zookeeper-metrics-providers/pom.xml
 mode change 100755 => 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
 mode change 100755 => 100644 zookeeper-recipes/pom.xml
 mode change 100755 => 100644 zookeeper-recipes/zookeeper-recipes-election/pom.xml
 mode change 100755 => 100644 zookeeper-recipes/zookeeper-recipes-lock/pom.xml
 mode change 100755 => 100644 zookeeper-recipes/zookeeper-recipes-queue/pom.xml
 mode change 100755 => 100644 zookeeper-server/pom.xml
 mode change 100755 => 100644 zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java

diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-client/pom.xml b/zookeeper-client/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg b/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg
old mode 100755
new mode 100644
diff --git a/zookeeper-docs/src/main/resources/markdown/images/state_dia.dia b/zookeeper-docs/src/main/resources/markdown/images/state_dia.dia
old mode 100755
new mode 100644
diff --git a/zookeeper-docs/src/main/resources/markdown/images/state_dia.jpg b/zookeeper-docs/src/main/resources/markdown/images/state_dia.jpg
old mode 100755
new mode 100644
diff --git a/zookeeper-it/pom.xml b/zookeeper-it/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-metrics-providers/pom.xml b/zookeeper-metrics-providers/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-recipes/zookeeper-recipes-election/pom.xml b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
old mode 100755
new mode 100644
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
old mode 100755
new mode 100644

From 6ac8edaabbb9b04529b7438ff226d19ec0e40ec9 Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Tue, 30 Apr 2024 16:34:36 +0800
Subject: [PATCH 444/591] ZOOKEEPER-4827 Bump bouncycastl version from 1.75 to
 1.78 (#2158)

Signed-off-by: ZhangJian He <shoothzj@gmail.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a9fb31db5b6..d2522206c96 100644
--- a/pom.xml
+++ b/pom.xml
@@ -565,7 +565,7 @@
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
     <kerby.version>2.0.0</kerby.version>
-    <bouncycastle.version>1.75</bouncycastle.version>
+    <bouncycastle.version>1.78</bouncycastle.version>
     <commons-collections.version>4.4</commons-collections.version>
     <dropwizard.version>4.1.12.1</dropwizard.version>
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>

From 9b81d1012c283635f97c705e1bdce40b098313e5 Mon Sep 17 00:00:00 2001
From: Yonghao Zou <yonghao.zou@epfl.ch>
Date: Thu, 2 May 2024 10:10:21 +0200
Subject: [PATCH 445/591] ZOOKEEPER-4409 NullPointerException in
 SendAckRequestProcessor (#2163)

---
 .../quorum/SendAckRequestProcessor.java       | 18 +-------
 .../quorum/SendAckRequestProcessorTest.java   | 46 +++++++++++++++++++
 2 files changed, 48 insertions(+), 16 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
index 8218ddae4ae..78c9dbd39f7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
@@ -46,14 +46,7 @@ public void processRequest(Request si) {
                 learner.writePacket(qp, false);
             } catch (IOException e) {
                 LOG.warn("Closing connection to leader, exception during packet send", e);
-                try {
-                    if (!learner.sock.isClosed()) {
-                        learner.sock.close();
-                    }
-                } catch (IOException e1) {
-                    // Nothing to do, we are shutting things down, so an exception here is irrelevant
-                    LOG.debug("Ignoring error closing the connection", e1);
-                }
+                learner.closeSockSync();
             }
         }
     }
@@ -63,14 +56,7 @@ public void flush() throws IOException {
             learner.writePacket(null, true);
         } catch (IOException e) {
             LOG.warn("Closing connection to leader, exception during packet send", e);
-            try {
-                if (!learner.sock.isClosed()) {
-                    learner.sock.close();
-                }
-            } catch (IOException e1) {
-                // Nothing to do, we are shutting things down, so an exception here is irrelevant
-                LOG.debug("Ignoring error closing the connection", e1);
-            }
+            learner.closeSockSync();
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java
new file mode 100644
index 00000000000..74cdd0bc558
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.txn.TxnHeader;
+import org.junit.jupiter.api.Test;
+
+class SendAckRequestProcessorTest extends ZKTestCase {
+    static class FakeLearner extends Learner {
+        public FakeLearner() {
+            sock = null;
+        }
+
+        void writePacket(QuorumPacket pp, boolean flush) throws IOException {
+            throw new IOException();
+        }
+    }
+
+    @Test
+    public void learnerSocketCloseTest() {
+        SendAckRequestProcessor processor = new SendAckRequestProcessor(new FakeLearner());
+        processor.processRequest(new Request(0L, 0, ZooDefs.OpCode.sync, new TxnHeader(), new LearnerInfo(), 0L));
+        assertTrue(true, "should get here without exception");
+    }
+}
\ No newline at end of file

From 66202cb764c203f64b954a917e421be57d2ae67a Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Sat, 11 May 2024 15:46:37 +0800
Subject: [PATCH 446/591] [ZOOKEEPER-4831] update slf4j from 1.x to 2.0.13,
 logback to 1.3.14 (#2162)

---
 pom.xml                                                       | 4 ++--
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md  | 2 +-
 zookeeper-server/src/main/resources/LICENSE.txt               | 4 ++--
 .../java/org/apache/zookeeper/test/ReconfigExceptionTest.java | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pom.xml b/pom.xml
index d2522206c96..30a5ed03d70 100644
--- a/pom.xml
+++ b/pom.xml
@@ -550,8 +550,8 @@
     <redirectTestOutputToFile>true</redirectTestOutputToFile>
 
     <!-- dependency versions -->
-    <slf4j.version>1.7.30</slf4j.version>
-    <logback-version>1.2.13</logback-version>
+    <slf4j.version>2.0.13</slf4j.version>
+    <logback-version>1.3.14</logback-version>
     <audience-annotations.version>0.12.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index cfd8bb3d829..e571652e497 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -436,7 +436,7 @@ in the unlikely event a recent log has become corrupted). This
 can be run as a cron job on the ZooKeeper server machines to
 clean up the logs daily.
 
-    java -cp zookeeper.jar:lib/slf4j-api-1.7.30.jar:lib/logback-classic-1.2.10.jar:lib/logback-core-1.2.10.jar:conf org.apache.zookeeper.server.PurgeTxnLog <dataDir> <snapDir> -n <count>
+    CLASSPATH='lib/*:conf' java org.apache.zookeeper.server.PurgeTxnLog <dataDir> <snapDir> -n <count>
 
 
 Automatic purging of the snapshots and corresponding
diff --git a/zookeeper-server/src/main/resources/LICENSE.txt b/zookeeper-server/src/main/resources/LICENSE.txt
index 384713a645f..47ddded77d5 100644
--- a/zookeeper-server/src/main/resources/LICENSE.txt
+++ b/zookeeper-server/src/main/resources/LICENSE.txt
@@ -210,6 +210,6 @@ This distribution bundles jline 2.14.6, which is available under the
 2-clause BSD License. For details, see a copy of the license in
 lib/jline-2.14.6.LICENSE.txt
 
-This distribution bundles SLF4J 1.7.30, which is available under the MIT
+This distribution bundles SLF4J 2.0.13, which is available under the MIT
 License. For details, see a copy of the license in
-lib/slf4j-1.7.30.LICENSE.txt
+lib/slf4j-2.0.13.LICENSE.txt
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
index 5afcb0d34a3..0d247a99a05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
@@ -48,7 +48,7 @@ public class ReconfigExceptionTest extends ZKTestCase {
     // Use DigestAuthenticationProvider.base64Encode or
     // run ZooKeeper jar with org.apache.zookeeper.server.auth.DigestAuthenticationProvider to generate password.
     // An example:
-    // java -cp zookeeper.jar:lib/slf4j-api-1.7.30.jar:lib/logback-classic-1.2.10.jar:lib/logback-core-1.2.10.jar:conf
+    // CLASSPATH='lib/*:conf' java
     // org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:test
     // The password here is 'test'.
     private static String superDigest = "super:D/InIHSb7yEEbrWz8b9l71RjZJU=";

From bccc654e09d9e85fe3495487b9619173a2c54151 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Sat, 15 Jun 2024 02:43:24 -0700
Subject: [PATCH 447/591] ZOOKEEPER-4808: Fix the log statement in
 FastLeaderElection

Reviewers: maoling
Author: li4wang
Closes #2136 from li4wang/ZOOKEEPER-4808
---
 .../org/apache/zookeeper/server/quorum/FastLeaderElection.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 83555a61644..5a6b18fd19a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -702,7 +702,7 @@ private void sendNotifications() {
                 qv.toString().getBytes(UTF_8));
 
             LOG.debug(
-                "Sending Notification: {} (n.leader), 0x{} (n.peerEpoch), 0x{} (n.zxid), 0x{} (n.round), {} (recipient),"
+                "Sending Notification: {} (n.leader), 0x{} (n.zxid), 0x{} (n.peerEpoch), 0x{} (n.round), {} (recipient),"
                     + " {} (myid) ",
                 proposedLeader,
                 Long.toHexString(proposedZxid),

From 39973dc5fddf778733e4f0370980629c07a16d67 Mon Sep 17 00:00:00 2001
From: Yan Zhao <horizonzy@apache.org>
Date: Sat, 15 Jun 2024 17:49:40 +0800
Subject: [PATCH 448/591] ZOOKEEPER-4807: Add sid in the leader goodbyte log.

Reviewers: maoling
Author: horizonzy
Closes #2131 from horizonzy/tune-leader-goodbye-follower-log
---
 .../java/org/apache/zookeeper/server/quorum/LearnerHandler.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 049336a16ee..57947daa86c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -733,7 +733,7 @@ public void run() {
                 syncThrottler = null;
             }
             String remoteAddr = getRemoteAddress();
-            LOG.warn("******* GOODBYE {} ********", remoteAddr);
+            LOG.warn("******* GOODBYE sid:{} {} ********", getSid(), remoteAddr);
             messageTracker.dumpToLog(remoteAddr);
             shutdown();
         }

From 9a2dc253caf5e94ec64bd65a72a35c6bc5e2042c Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Tue, 16 Jul 2024 16:06:34 +0800
Subject: [PATCH 449/591] ZOOKEEPER-4834. fix typos in Apache ZooKeeper (#2167)

Signed-off-by: ZhangJian He <shoothzj@gmail.com>
---
 .typos.toml                                   | 52 +++++++++++++++++++
 owaspSuppressions.xml                         |  2 +-
 zookeeper-client/zookeeper-client-c/ChangeLog |  8 +--
 zookeeper-client/zookeeper-client-c/LICENSE   |  6 +--
 .../zookeeper-client-c/acinclude.m4           |  6 +--
 .../zookeeper-client-c/include/zookeeper.h    | 16 +++---
 .../zookeeper-client-c/src/addrvec.h          |  2 +-
 .../src/hashtable/hashtable.c                 |  2 +-
 .../zookeeper-client-c/src/mt_adaptor.c       |  2 +-
 .../zookeeper-client-c/src/recordio.c         |  2 +-
 .../zookeeper-client-c/src/winport.c          |  2 +-
 .../zookeeper-client-c/src/winport.h          |  2 +-
 .../zookeeper-client-c/src/zookeeper.c        |  6 +--
 .../zookeeper-client-c/tests/TestClient.cc    |  2 +-
 .../tests/TestOperations.cc                   |  4 +-
 .../zookeeper-client-c/tests/TestWatchers.cc  |  2 +-
 .../zookeeper-client-c/tests/ThreadingUtil.h  |  2 +-
 .../zookeeper-client-c/tests/ZKMocks.h        |  2 +-
 .../zookeeper-contrib-loggraph/README.md      |  2 +-
 .../apache/zookeeper/graph/Log4JSource.java   |  2 +-
 .../zookeeper/graph/resources/g.raphael.js    |  2 +-
 .../zookeeper/graph/resources/loggraph.js     |  2 +-
 .../graph/resources/loggraph.server.js        |  4 +-
 .../zookeeper/graph/resources/raphael.js      |  6 +--
 .../zookeeper-contrib-monitoring/cacti/README |  2 +-
 .../check_zookeeper.py                        |  2 +-
 .../nagios/README.txt                         |  2 +-
 .../zookeeper-contrib-rest/SPEC.txt           | 10 ++--
 .../jersey/resources/ZNodeResource.java       |  4 +-
 .../src/blockingqueue.h                       |  2 +-
 .../zookeeper-contrib-zkfuse/src/doxygen.cfg  |  2 +-
 .../zookeeper-contrib-zkfuse/src/event.h      |  2 +-
 .../zookeeper-contrib-zkfuse/src/thread.h     |  2 +-
 .../zookeeper-contrib-zkfuse/src/zkadapter.cc |  2 +-
 .../zookeeper-contrib-zkfuse/src/zkadapter.h  |  4 +-
 .../zookeeper-contrib-zkfuse/src/zkfuse.cc    | 20 +++----
 .../src/test/close_deadlock_test.py           |  2 +-
 .../src/test/create_test.py                   |  2 +-
 .../src/test/get_set_test.py                  |  2 +-
 .../zookeeper-contrib-zktreeutil/README.txt   |  2 +-
 .../src/ZkAdaptor.cc                          |  2 +-
 .../src/ZkAdaptor.h                           |  2 +-
 .../src/ZkTreeUtil.h                          |  2 +-
 .../zookeeper-contrib-zooinspector/TODO       |  2 +-
 .../com/nitido/utils/toaster/Toaster.java     |  2 +-
 .../gui/nodeviewer/NodeSelectionListener.java |  2 +-
 .../gui/nodeviewer/NodeViewerMetaData.java    |  6 +--
 .../main/resources/markdown/releasenotes.md   |  4 +-
 .../main/resources/markdown/zookeeperAdmin.md |  2 +-
 .../java/org/apache/jute/compiler/JFile.java  |  2 +-
 .../org/apache/jute/compiler/JRecord.java     |  4 +-
 .../org/apache/jute/compiler/package.html     |  2 +-
 .../main/java/org/apache/jute/package.html    |  6 +--
 .../prometheus/PrometheusMetricsProvider.java |  2 +-
 zookeeper-recipes/README.txt                  |  2 +-
 .../zookeeper-recipes-lock/README.txt         |  2 +-
 .../src/main/c/acinclude.m4                   |  6 +--
 .../src/main/c/include/zoo_lock.h             |  4 +-
 .../zookeeper/recipes/lock/WriteLock.java     | 10 ++--
 .../src/main/c/acinclude.m4                   |  6 +--
 .../src/main/c/src/zoo_queue.c                |  2 +-
 .../apache/zookeeper/ClientCnxnSocketNIO.java |  4 +-
 .../org/apache/zookeeper/KeeperException.java |  2 +-
 .../java/org/apache/zookeeper/ZooKeeper.java  |  6 +--
 .../org/apache/zookeeper/ZooKeeperMain.java   |  8 +--
 .../zookeeper/cli/CliWrapperException.java    |  2 +-
 .../zookeeper/client/ConnectStringParser.java |  2 +-
 .../org/apache/zookeeper/common/IOUtils.java  |  4 +-
 .../org/apache/zookeeper/metrics/Summary.java |  2 +-
 .../apache/zookeeper/metrics/SummarySet.java  |  2 +-
 .../apache/zookeeper/server/BlueThrottle.java |  2 +-
 .../zookeeper/server/ConnectionMXBean.java    |  4 +-
 .../zookeeper/server/ContainerManager.java    |  4 +-
 .../apache/zookeeper/server/ExpiryQueue.java  |  2 +-
 .../server/NIOServerCnxnFactory.java          |  8 +--
 .../server/PrepRequestProcessor.java          |  4 +-
 .../server/ReferenceCountedACLCache.java      |  2 +-
 .../zookeeper/server/RequestThrottler.java    |  2 +-
 .../zookeeper/server/ServerCnxnFactory.java   |  2 +-
 .../server/SyncRequestProcessor.java          |  2 +-
 .../apache/zookeeper/server/ZKDatabase.java   |  4 +-
 .../zookeeper/server/ZooKeeperServer.java     |  4 +-
 .../server/embedded/ExitHandler.java          |  2 +-
 .../embedded/ZooKeeperServerEmbedded.java     |  2 +-
 .../embedded/ZooKeeperServerEmbeddedImpl.java |  2 +-
 .../server/persistence/SnapStream.java        |  2 +-
 .../server/quorum/FastLeaderElection.java     |  2 +-
 .../zookeeper/server/quorum/Leader.java       |  8 +--
 .../zookeeper/server/quorum/Learner.java      |  2 +-
 .../quorum/ObserverZooKeeperServer.java       |  2 +-
 .../zookeeper/server/quorum/QuorumPeer.java   |  4 +-
 .../zookeeper/server/util/OSMXBean.java       |  2 +-
 .../util/RequestPathMetricsCollector.java     |  6 +--
 .../zookeeper/server/watch/WatchManager.java  |  4 +-
 .../ClientCnxnSocketFragilityTest.java        |  2 +-
 .../zookeeper/GetAllChildrenNumberTest.java   |  4 +-
 .../apache/zookeeper/GetEphemeralsTest.java   |  6 +--
 .../apache/zookeeper/JaasConfiguration.java   |  2 +-
 .../org/apache/zookeeper/PortAssignment.java  |  2 +-
 .../org/apache/zookeeper/ZooKeeperTest.java   | 10 ++--
 .../zookeeper/client/ZKClientConfigTest.java  |  2 +-
 .../zookeeper/common/ZKTrustManagerTest.java  | 18 +++----
 .../zookeeper/server/ClientSSLReloadTest.java |  6 +--
 .../apache/zookeeper/server/DataNodeTest.java |  2 +-
 .../apache/zookeeper/server/DataTreeTest.java |  2 +-
 .../apache/zookeeper/server/PurgeTxnTest.java |  2 +-
 .../server/ZooKeeperServerMainTest.java       |  2 +-
 .../server/ZooKeeperServerStartupTest.java    |  4 +-
 .../zookeeper/server/ZooKeeperThreadTest.java |  2 +-
 .../server/persistence/FileTxnLogTest.java    |  2 +-
 .../server/quorum/CnxManagerTest.java         |  6 +--
 .../CommitProcessorConcurrencyTest.java       |  4 +-
 .../quorum/CommitProcessorMetricsTest.java    |  8 +--
 .../quorum/FuzzySnapshotRelatedTest.java      |  2 +-
 .../server/quorum/LearnerHandlerTest.java     |  8 +--
 .../server/quorum/QuorumDigestTest.java       |  6 +--
 .../server/quorum/QuorumPeerConfigTest.java   |  2 +-
 .../server/quorum/QuorumPeerMainTest.java     |  2 +-
 .../server/quorum/QuorumPeerTestBase.java     |  2 +-
 .../server/quorum/QuorumSSLTest.java          |  4 +-
 .../SyncRequestProcessorMetricTest.java       |  4 +-
 .../zookeeper/server/util/AdHashTest.java     |  2 +-
 .../util/RequestPathMetricsCollectorTest.java | 28 +++++-----
 .../org/apache/zookeeper/test/ClientBase.java |  2 +-
 .../org/apache/zookeeper/test/ClientTest.java |  2 +-
 .../test/FollowerResyncConcurrencyTest.java   |  8 +--
 .../test/GetProposalFromTxnTest.java          |  4 +-
 .../test/LoadFromLogNoServerTest.java         |  2 +-
 .../test/LocalSessionRequestTest.java         |  2 +-
 .../zookeeper/test/MultiOperationTest.java    |  4 +-
 .../apache/zookeeper/test/ObserverTest.java   |  2 +-
 .../zookeeper/test/QuorumOracleMajTest.java   |  4 +-
 .../org/apache/zookeeper/test/QuorumTest.java |  4 +-
 .../apache/zookeeper/test/QuorumUtilTest.java | 10 ++--
 .../apache/zookeeper/test/ReconfigTest.java   |  2 +-
 .../apache/zookeeper/test/RecoveryTest.java   |  2 +-
 .../apache/zookeeper/test/ServerCnxnTest.java |  2 +-
 .../test/SessionInvalidationTest.java         |  2 +-
 .../apache/zookeeper/test/SessionTest.java    |  4 +-
 .../zookeeper/test/SessionUpgradeTest.java    |  2 +-
 .../apache/zookeeper/test/SledgeHammer.java   |  6 +--
 .../test/StaticHostProviderTest.java          |  2 +-
 .../apache/zookeeper/test/StatsTrackTest.java |  4 +-
 .../zookeeper/test/ZooKeeperTestClient.java   |  8 +--
 .../src/test/resources/test-scripts.sh        |  2 +-
 .../protocol-spec/Zab.tla                     | 12 ++---
 .../protocol-spec/issues.md                   |  2 +-
 .../system-spec/zk-3.7/FastLeaderElection.tla |  2 +-
 .../system-spec/zk-3.7/ZkV3_7_0.tla           | 20 +++----
 149 files changed, 348 insertions(+), 296 deletions(-)
 create mode 100644 .typos.toml

diff --git a/.typos.toml b/.typos.toml
new file mode 100644
index 00000000000..b3cd78c734f
--- /dev/null
+++ b/.typos.toml
@@ -0,0 +1,52 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+[default.extend-words]
+# abbr
+"aroun" = "aroun"
+"delet" = "delet"
+"dout" = "dout"
+"fied" = "fied"
+"fle" = "fle"
+"fo" = "fo"
+"hte" = "hte"
+"nd" = "nd"
+"nwe" = "nwe"
+"pn" = "pn"
+"strack" = "strack"
+"thr" = "thr"
+"ths" = "ths"
+"wew" = "wew"
+# keep for comptability
+"pathes" = "pathes"
+"shapshot" = "shapshot"
+# keyword fp
+"atend" = "atend"
+"chec" = "chec"
+"clos" = "clos"
+"erro" = "erro"
+"infor" = "infor"
+"locahost" = "locahost"
+"leafs" = "leafs"
+"sceen" = "sceen"
+
+[files]
+extend-exclude = [
+    "zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java",
+]
diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 9a18c5fb2bc..873f38df370 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -48,7 +48,7 @@
    </suppress>
    <suppress>
       <!-- Seems like false positive - we are not using Prometheus
-           2.x, rather the client which lastest is 0.6. at the time of
+           2.x, rather the client which latest is 0.6. at the time of
            this writing  -->
       <cve>CVE-2019-3826</cve>
    </suppress>
diff --git a/zookeeper-client/zookeeper-client-c/ChangeLog b/zookeeper-client/zookeeper-client-c/ChangeLog
index c85a6c0ad86..040e1d32a44 100644
--- a/zookeeper-client/zookeeper-client-c/ChangeLog
+++ b/zookeeper-client/zookeeper-client-c/ChangeLog
@@ -1,13 +1,13 @@
 Release 2.1.1
 2008-04-30 Andrew Kornev <akornev@users.sourceforge.net>
 
-    * changed the distributino package name to "c-client-src"
+    * changed the distributions package name to "c-client-src"
     
 Release 2.1.0
 2008-04-30 Andrew Kornev <akornev@users.sourceforge.net>
 
     * added the client latency diagnostics; the client prints a warning when the
-      reponse latency exceeds 20ms
+      response latency exceeds 20ms
 
     * modified logging format to report the znode path for which the zookeeper 
       operation is called
@@ -31,12 +31,12 @@ Release 1.1.3
     * get_xid() is not thread-safe (xid initialization race condition 
       in the multi-threaded mode).
     
-    * the I/O thread doesn’t automatically terminate on AUTH_FAILURE and 
+    * the I/O thread doesn't automatically terminate on AUTH_FAILURE and
       SESSION_EXPIRED events.
       
     * all session events should be processed on the completion thread. 
     
-    * PING operation doesn’t atomically enqueue the completion and 
+    * PING operation doesn't atomically enqueue the completion and
       send buffers like other operations do.
       
     * corrected zookeeper_init() doxygen docs.
diff --git a/zookeeper-client/zookeeper-client-c/LICENSE b/zookeeper-client/zookeeper-client-c/LICENSE
index 7df01ad5534..c3e546da36c 100644
--- a/zookeeper-client/zookeeper-client-c/LICENSE
+++ b/zookeeper-client/zookeeper-client-c/LICENSE
@@ -285,7 +285,7 @@
  * The implementation was written so as to conform with Netscapes SSL.
  *
  * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
+ * the following conditions are adhered to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
@@ -310,7 +310,7 @@
  *    must display the following acknowledgement:
  *    "This product includes cryptographic software written by
  *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
+ *    The word 'cryptographic' can be left out if the routines from the library
  *    being used are not cryptographic related :-).
  * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
@@ -328,7 +328,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * The licence and distribution terms for any publically available version or
+ * The licence and distribution terms for any publicly available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
diff --git a/zookeeper-client/zookeeper-client-c/acinclude.m4 b/zookeeper-client/zookeeper-client-c/acinclude.m4
index 9734f215649..55061709180 100644
--- a/zookeeper-client/zookeeper-client-c/acinclude.m4
+++ b/zookeeper-client/zookeeper-client-c/acinclude.m4
@@ -10,7 +10,7 @@
 # DX_???_FEATURE(ON|OFF) - control the default setting of a Doxygen feature.
 # Supported features are 'DOXYGEN' itself, 'DOT' for generating graphics,
 # 'HTML' for plain HTML, 'CHM' for compressed HTML help (for MS users), 'CHI'
-# for generating a seperate .chi file by the .chm file, and 'MAN', 'RTF',
+# for generating a separate .chi file by the .chm file, and 'MAN', 'RTF',
 # 'XML', 'PDF' and 'PS' for the appropriate output formats. The environment
 # variable DOXYGEN_PAPER_SIZE may be specified to override the default 'a4wide'
 # paper size.
@@ -239,8 +239,8 @@ DX_ARG_ABLE(chm, [generate doxygen compressed HTML help documentation],
              DX_ENV_APPEND(GENERATE_HTMLHELP, YES)],
             [DX_ENV_APPEND(GENERATE_HTMLHELP, NO)])
 
-# Seperate CHI file generation.
-DX_ARG_ABLE(chi, [generate doxygen seperate compressed HTML help index file],
+# Separate CHI file generation.
+DX_ARG_ABLE(chi, [generate doxygen separate compressed HTML help index file],
             [DX_CHECK_DEPEND(chm, 1)],
             [DX_CLEAR_DEPEND(chm, 1)],
             [],
diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 7d889f60557..044250a3098 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -108,7 +108,7 @@ enum ZOO_ERRORS {
   ZBADARGUMENTS = -8, /*!< Invalid arguments */
   ZINVALIDSTATE = -9, /*!< Invliad zhandle state */
   ZNEWCONFIGNOQUORUM = -13, /*!< No quorum of new config is connected and
-                                 up-to-date with the leader of last commmitted
+                                 up-to-date with the leader of last committed
                                  config - try invoking reconfiguration after new
                                  servers are connected and synced */
   ZRECONFIGINPROGRESS = -14, /*!< Reconfiguration requested while another
@@ -697,7 +697,7 @@ ZOOAPI sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
  * \return ZOK on success or one of the following errcodes on failure:
  * ZBADARGUMENTS - invalid input parameters
  * ZINVALIDSTATE - zhandle state is either ZOO_SESSION_EXPIRED_STATE or ZOO_AUTH_FAILED_STATE
- * ZSYSTEMERROR -- a system (OS) error occured; it's worth checking errno to get details
+ * ZSYSTEMERROR -- a system (OS) error occurred; it's worth checking errno to get details
  */
 ZOOAPI int zoo_set_servers(zhandle_t *zh, const char *hosts);
 
@@ -1779,7 +1779,7 @@ typedef enum {
  * \param wtype the watcher type to be removed
  * \param watcher the watcher to be removed, if null all watches for that
  * path (and watcher type) will be removed
- * \param watcherCtx the contex associated with the watcher to be removed
+ * \param watcherCtx the context associated with the watcher to be removed
  * \param local whether the watches will be removed locally even if there is
  * no server connection
  * \return the return code for the function call.
@@ -1789,7 +1789,7 @@ typedef enum {
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
  */
 ZOOAPI int zoo_aremove_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, watcher_fn watcher, void *watcherCtx, int local,
@@ -1810,7 +1810,7 @@ ZOOAPI int zoo_aremove_watches(zhandle_t *zh, const char *path,
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
  */
 ZOOAPI int zoo_remove_all_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, int local);
@@ -1830,7 +1830,7 @@ ZOOAPI int zoo_remove_all_watches(zhandle_t *zh, const char *path,
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
 */
 ZOOAPI int zoo_aremove_all_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, int local, void_completion_t *completion,
@@ -2434,7 +2434,7 @@ ZOOAPI int zoo_multi(zhandle_t *zh, int count, const zoo_op_t *ops, zoo_op_resul
  * \param wtype the watcher type to be removed
  * \param watcher the watcher to be removed, if null all watches for that
  * path (and watcher type) will be removed
- * \param watcherCtx the contex associated with the watcher to be removed
+ * \param watcherCtx the context associated with the watcher to be removed
  * \param local whether the watches will be removed locally even if there is
  * no server connection
  * \return the return code for the function call.
@@ -2444,7 +2444,7 @@ ZOOAPI int zoo_multi(zhandle_t *zh, int count, const zoo_op_t *ops, zoo_op_resul
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
  */
 ZOOAPI int zoo_remove_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, watcher_fn watcher, void *watcherCtx, int local);
diff --git a/zookeeper-client/zookeeper-client-c/src/addrvec.h b/zookeeper-client/zookeeper-client-c/src/addrvec.h
index a12642908bb..2a9a8ad9117 100644
--- a/zookeeper-client/zookeeper-client-c/src/addrvec.h
+++ b/zookeeper-client/zookeeper-client-c/src/addrvec.h
@@ -74,7 +74,7 @@ int addrvec_grow(addrvec_t *avec, uint32_t grow_amount);
 int addrvec_grow_default(addrvec_t *avec);
 
 /**
- * Check if an addrvec contains the specificed sockaddr_storage value.
+ * Check if an addrvec contains the specified sockaddr_storage value.
  * \returns 1 if it contains the value and 0 otherwise.
  */
 int addrvec_contains(const addrvec_t *avec, const struct sockaddr_storage *addr);
diff --git a/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c b/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
index caa5f6ccc03..bc94a59599b 100644
--- a/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
+++ b/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
@@ -70,7 +70,7 @@ hash(struct hashtable *h, void *k)
 static int
 hashtable_expand(struct hashtable *h)
 {
-    /* Double the size of the table to accomodate more entries */
+    /* Double the size of the table to accommodate more entries */
     struct entry **newtable;
     struct entry *e;
     struct entry **pE;
diff --git a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
index 7292843c326..4e6e1b6bf29 100644
--- a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
@@ -121,7 +121,7 @@ int handle_error(zhandle_t* zh, SOCKET sock, char* message)
        return -1;
 }
 
-//--create socket pair for interupting selects.
+//--create socket pair for interrupting selects.
 int create_socket_pair(zhandle_t* zh, SOCKET fds[2]) 
 { 
     struct sockaddr_in inaddr; 
diff --git a/zookeeper-client/zookeeper-client-c/src/recordio.c b/zookeeper-client/zookeeper-client-c/src/recordio.c
index 77fae28785f..52036f94e7a 100644
--- a/zookeeper-client/zookeeper-client-c/src/recordio.c
+++ b/zookeeper-client/zookeeper-client-c/src/recordio.c
@@ -145,7 +145,7 @@ int oa_serialize_buffer(struct oarchive *oa, const char *name,
         return rc;
     // this means a buffer of NUll 
     // with size of -1. This is 
-    // waht we use in java serialization for NULL
+    // what we use in java serialization for NULL
     if (b->len == -1) {
       return rc;
     }
diff --git a/zookeeper-client/zookeeper-client-c/src/winport.c b/zookeeper-client/zookeeper-client-c/src/winport.c
index d40614c9131..8d8698ee6c5 100644
--- a/zookeeper-client/zookeeper-client-c/src/winport.c
+++ b/zookeeper-client/zookeeper-client-c/src/winport.c
@@ -83,7 +83,7 @@ int pthread_detach(pthread_t _thread)
 }
 
 void pthread_mutexattr_init(pthread_mutexattr_t* ignore){}
-void pthread_mutexattr_settype(pthread_mutexattr_t* ingore_attr, int ignore){}
+void pthread_mutexattr_settype(pthread_mutexattr_t* ignore_attr, int ignore){}
 void pthread_mutexattr_destroy(pthread_mutexattr_t* ignore_attr){}
        
 int 
diff --git a/zookeeper-client/zookeeper-client-c/src/winport.h b/zookeeper-client/zookeeper-client-c/src/winport.h
index d216f7fd30d..e8f10ba046b 100644
--- a/zookeeper-client/zookeeper-client-c/src/winport.h
+++ b/zookeeper-client/zookeeper-client-c/src/winport.h
@@ -80,7 +80,7 @@ int pthread_join(pthread_t _thread, void** ignore);
 int pthread_detach(pthread_t _thread);
 
 void pthread_mutexattr_init(pthread_mutexattr_t* ignore);
-void pthread_mutexattr_settype(pthread_mutexattr_t* ingore_attr, int ignore);
+void pthread_mutexattr_settype(pthread_mutexattr_t* ignore_attr, int ignore);
 void pthread_mutexattr_destroy(pthread_mutexattr_t* ignore_attr);
 
 
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 3c64efbb658..a19144b5028 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -1571,7 +1571,7 @@ static int get_next_server_in_reconfig(zhandle_t *zh)
 /**
  * Cycle through our server list to the correct 'next' server. The 'next' server
  * to connect to depends upon whether we're in a 'reconfig' mode or not. Reconfig
- * mode means we've upated the server list and are now trying to find a server
+ * mode means we've updated the server list and are now trying to find a server
  * to connect to. Once we get connected, we are no longer in the reconfig mode.
  * Similarly, if we try to connect to all the servers in the new configuration
  * and failed, reconfig mode is set to false.
@@ -1622,7 +1622,7 @@ const char* zoo_get_current_server(zhandle_t* zh)
 }
 
 /**
- * deallocated the free_path only its beeen allocated
+ * deallocated the free_path only its been allocated
  * and not equal to path
  */
 void free_duplicate_path(const char *free_path, const char* path) {
@@ -5008,7 +5008,7 @@ const char* zerror(int c)
     case ZINVALIDSTATE:
       return "invalid zhandle state";
     case ZNEWCONFIGNOQUORUM:
-      return "no quorum of new config is connected and up-to-date with the leader of last commmitted config - try invoking reconfiguration after new servers are connected and synced";
+      return "no quorum of new config is connected and up-to-date with the leader of last committed config - try invoking reconfiguration after new servers are connected and synced";
     case ZRECONFIGINPROGRESS:
       return "Another reconfiguration is in progress -- concurrent reconfigs not supported (yet)";
     case ZAPIERROR:
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
index 80e4c928a51..8c79c01b038 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
@@ -1005,7 +1005,7 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     void testChroot() {
         // the c client async callbacks do
         // not callback with the path, so
-        // we dont need to test taht for now
+        // we dont need to test that for now
         // we should fix that though soon!
         watchctx_t ctx, ctx_ch;
         zhandle_t *zk, *zk_ch;
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
index a36af8417e4..534c7599c1f 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
@@ -582,7 +582,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL((int)ZCLOSING,res2.rc_);
     }
 
-    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for mutli-request
+    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for multi-request
     // while there is a multi request waiting for being processed
     // call zookeeper_close() from the main event loop
     // assert the completion callback is called with status ZCLOSING
@@ -626,7 +626,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL((int)ZCLOSING,res1.rc_);
     }
 
-    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for mutli-request
+    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for multi-request
     // send some request #1 (not a multi request)
     // then, while there is a multi request #2 waiting for being processed
     // call zookeeper_close() from the completion callback of request #1
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc b/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc
index 0a269341c57..7947d6f1396 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc
@@ -456,7 +456,7 @@ class Zookeeper_watchers : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",activeWatcher,10000,TEST_CLIENT_ID,
                 &watcher,0);
         CPPUNIT_ASSERT(zh!=0);
-        // wait till watcher proccessing has completed (the connection 
+        // wait till watcher processing has completed (the connection
         // established event)
         CPPUNIT_ASSERT(ensureCondition(
                 deliveryTracker.isWatcherProcessingCompleted(),1000)<1000);
diff --git a/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h b/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h
index 9165412bc8b..45791fd2f59 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h
+++ b/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h
@@ -38,7 +38,7 @@ class AtomicInt{
 public:
     explicit AtomicInt(int32_t init=0):v_(init){}
     AtomicInt(const AtomicInt& other):v_(other){}
-    // assigment
+    // assignment
     AtomicInt& operator=(const AtomicInt& lhs){
         atomic_fetch_store(&v_,lhs);
         return *this;
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
index a091f2fe8ca..d53a41628e7 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
@@ -443,7 +443,7 @@ class ZookeeperServer: public Mock_socket
     void returnSessionExpired(){ sessionExpired=true; }
     
     // this is a one shot trigger that gets reset back to false
-    // next recv call will return 0 length, thus simulating a connecton loss
+    // next recv call will return 0 length, thus simulating a connection loss
     volatile bool connectionLost;
     void setConnectionLost() {connectionLost=true;}
     
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/README.md b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
index aa845fc4b3b..a1b849a3349 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
@@ -44,7 +44,7 @@ To filter by time simply move the slider to the desired start time. The time win
 Content filtering uses a adhoc filtering language, using prefix notation. The language looks somewhat similar to lisp. A statement in the language takes the form (op arg arg ....). A statement resolves to a boolean value. Statements can be nested. 
 
 ### 4.1 - Filter arguments
-An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpretted as hexadecimal. Otherwise it is interpretted as decimal. If the argument begins with a double-quote, (") it is interpretted as a string. Anything else is interpretted as a symbol.
+An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpreted as hexadecimal. Otherwise it is interpreted as decimal. If the argument begins with a double-quote, (") it is interpreted as a string. Anything else is interpreted as a symbol.
 
 ### 4.2 - Filter symbols
 The possible filter symbols are: 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
index cbb65ea937a..b0071253d50 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
@@ -289,7 +289,7 @@ private void init() throws IOException {
 	String line = in.readLine();
 	Matcher m = null;
 
-	// if we have read data from the file, and it matchs the timep pattern
+	// if we have read data from the file, and it matches the timep pattern
 	if ((line != null) && (m = timep.matcher(line)).lookingAt()) {
 	    starttime = timestampFromText(dateformat, m.group(1));
 	} else {
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
index 8e94c36cc07..6957da63053 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
@@ -58,7 +58,7 @@
     };
 
     Raphael.fn.g.finger = function (x, y, width, height, dir, ending, isPath) {
-        // dir 0 for horisontal and 1 for vertical
+        // dir 0 for horizontal and 1 for vertical
         if ((dir && !height) || (!dir && !width)) {
             return isPath ? "" : this.path();
         }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
index 87bb7d89da2..51d47795a8a 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
@@ -99,7 +99,7 @@ LogGraph = function(canvas, status) {
 
 
     /***
-     * TODO: refactor these to load the data first, before handing to a draw funciton. 
+     * TODO: refactor these to load the data first, before handing to a draw function.
      *       We shouldn't pass the async q into the drawing function
      */
     this.showLogs = function() {
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
index 0a74b5c24b8..0b63be7ac48 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
@@ -250,8 +250,8 @@ LogGraph.ServerGraph.message = function(graph, src, srctime, dst, zxid) {
 	var ty = (this.src.y + this.dst.y)/2;
 	var t = paper.text(tx, ty, this.name);
 	
-	var gradiant = (this.dst.y - this.src.y)/(dstx - srcx);
-	var angle = Math.atan(gradiant) * 57.2958;
+	var gradient = (this.dst.y - this.src.y)/(dstx - srcx);
+	var angle = Math.atan(gradient) * 57.2958;
 	t.rotate(angle, true);
 	
 	var arrowl = paper.path("M" + dstx + " " + this.dst.y + " L" + (dstx - 10) +" " + this.dst.y);
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
index 3740d0f02ad..1c5c48050b1 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
@@ -3018,9 +3018,9 @@ Raphael = (function () {
                         };
                         break;
                     case "path":
-                        var pathes = path2curve(from[attr], to[attr]);
-                        from[attr] = pathes[0];
-                        var toPath = pathes[1];
+                        var paths = path2curve(from[attr], to[attr]);
+                        from[attr] = paths[0];
+                        var toPath = paths[1];
                         diff[attr] = [];
                         for (var i = 0, ii = from[attr][length]; i < ii; i++) {
                             diff[attr][i] = [0];
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README b/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README
index 8188723e5e2..3beddb36e1a 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README
@@ -29,7 +29,7 @@ WARNING: I have wrote these instructions while installing and configuring the pl
 
 WARNING: I'm going to make the assumption that you know how to work with Cacti and how to setup Data Input Methods for custom scripts. I'm also going to assume that you have already installed Cacti and everything works as expected.
 
-You can extend the Cacti's data gathering functionality through external scripts. Cacti comes with a number of scripts out of the box wich are localted in the scripts/ directory. 
+You can extend the Cacti's data gathering functionality through external scripts. Cacti comes with a number of scripts out of the box which are located in the scripts/ directory.
 
 
 The check_zookeeper.py script can be used a  custom data input method for Cacti.
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py b/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
index 0a08e84a7cc..6badf190c11 100755
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
@@ -19,7 +19,7 @@
 Generic monitoring script that could be used with multiple platforms (Ganglia, Nagios, Cacti).
 
 It requires ZooKeeper 3.4.0 or greater. The script needs the 'mntr' 4letter word 
-command (patch ZOOKEEPER-744) that was now commited to the trunk.
+command (patch ZOOKEEPER-744) that was now committed to the trunk.
 The script also works with ZooKeeper 3.3.x but in a limited way.
 """
 
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt b/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt
index 317ae14869b..27a12566ffa 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt
@@ -39,7 +39,7 @@ $ cp zookeeper.cfg /etc/nagios-plugins/config
 
 4. Create a virtual host in Nagios used for monitoring the cluster as a whole -OR-  Create a hostgroup named 'zookeeper-servers' and add all the zookeeper cluster nodes. 
 
-5. Define service checks like I have ilustrated bellow or just use the provided definitions.
+5. Define service checks like I have illustrated bellow or just use the provided definitions.
 
 define service {
     use         generic-service
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt b/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt
index 8c5f70175a6..3b25bb2df9a 100644
--- a/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt
+++ b/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt
@@ -39,7 +39,7 @@ that are easy and familiar to program against, and deployed as part of
 the language runtime. Thus, for simple CRUD clients, an HTTP gateway
 would be a less cumbersome interface than the ZooKeeper library.
 
-This document describes a gatway for using HTTP to interact with a
+This document describes a gateway for using HTTP to interact with a
 ZooKeeper repository.
 
 Binding ZooKeeper to HTTP
@@ -72,7 +72,7 @@ best practice.
 Root
 ----
 
-The following examples assume that the ZooKeeper znode heirarchy is
+The following examples assume that the ZooKeeper znode hierarchy is
 bound to the root of the HTTP servers namespace. This may not be the
 case in practice however, the gateway may bind to some prefix, for
 example the URL for accessing /a/b/c may be:
@@ -128,14 +128,14 @@ a new session.
 
 If the session creation is successful, then a 201 code will be returned.
 
-A session is just an UUID that you can pass around as a parameter and
-the REST server will foward your request on the attached persistent 
+A session is just a UUID that you can pass around as a parameter and
+the REST server will forward your request on the attached persistent
 connection.
 
 Keeping a session alive
 -----------------------
 
-To keep a session alive you must send hearbeat requests:
+To keep a session alive you must send heartbeat requests:
 
   PUT /sessions/v1/<SESSION-UUID> HTTP/1.1
 
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java
index 77371eab53d..84eaca819e2 100644
--- a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java
+++ b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java
@@ -307,7 +307,7 @@ public Response createZNode(
             throw new WebApplicationException(Response.status(
                     Response.Status.BAD_REQUEST).entity(
                     new ZError(ui.getRequestUri().toString(), path
-                            + " bad operaton " + op)).build());
+                            + " bad operation " + op)).build());
         }
 
         if (setNull.equals("true")) {
@@ -358,7 +358,7 @@ public Response createZNodeAsOctet(@PathParam("path") String path,
             throw new WebApplicationException(Response.status(
                     Response.Status.BAD_REQUEST).entity(
                     new ZError(ui.getRequestUri().toString(), path
-                            + " bad operaton " + op)).build());
+                            + " bad operation " + op)).build());
         }
 
         if (setNull.equals("true")) {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h
index 4677290d7b6..aad10c29839 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h
@@ -50,7 +50,7 @@ class BlockingQueue {
          * \brief Retrieves and removes the head of this queue, waiting if 
          * \brief no elements are present in this queue.
          * 
-         * @param timeout how long to wait until an element becomes availabe, 
+         * @param timeout how long to wait until an element becomes available,
          *                in milliseconds; if <code>0</code> then wait forever
          * @param timedOut if not NULL then set to true whether this function timed out
          * @return the element from the queue
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg
index 308b09450a4..da384f1b33a 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg
@@ -401,7 +401,7 @@ SHOW_DIRECTORIES       = YES
 # version control system). Doxygen will invoke the program by executing (via 
 # popen()) the command <command> <input-file>, where <command> is the value of 
 # the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file 
-# provided by doxygen. Whatever the progam writes to standard output 
+# provided by doxygen. Whatever the program writes to standard output
 # is used as the file version. See the manual for examples.
 
 FILE_VERSION_FILTER    = 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h
index 936ecc60453..f218be6e7b6 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h
@@ -183,7 +183,7 @@ class GenericEvent {
          * \brief Constructor.
          * 
          * @param type the type of this event
-         * @param eventWarpper the wrapper around event's data
+         * @param eventWrapper the wrapper around event's data
          */
         GenericEvent(int type, AbstractEventWrapper *eventWrapper) : 
             m_type(type), m_eventWrapper(eventWrapper) {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h
index 0ed12d7f645..91321cd6873 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h
@@ -41,7 +41,7 @@ class Thread {
 
     void Create(void* ctx, ThreadFunc func);
     void Join() {
-        //avoid SEGFAULT because of unitialized mThread
+        //avoid SEGFAULT because of uninitialized mThread
         //in case Create(...) was never called
         if (_func != NULL) {
             pthread_join(mThread, 0);
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc
index 7f02fa33b72..55f72396829 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc
@@ -505,7 +505,7 @@ ZooKeeperAdapter::verifyConnection() throw(ZooKeeperException)
             if (m_state != AS_CONNECTING) {
                 LOG_TRACE( LOG, 
                            "yes. Checking if allowed to auto-reconnect..." );
-                //...not in progres, so check if we can reconnect
+                //...not in progress, so check if we can reconnect
                 if (!m_zkConfig.getAutoReconnect()) {
                     //...too bad, disallowed :(
                     LOG_TRACE( LOG, "no. Sorry." );
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h
index 8d4d1d57f0a..66312d5c4fd 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h
@@ -160,7 +160,7 @@ class ZooKeeperConfig
         const int m_leaseTimeout;
         
         /**
-         * True if this adapater should attempt to autoreconnect in case 
+         * True if this adapter should attempt to autoreconnect in case
          * the current session has been dropped.
          */
         const bool m_autoReconnect;
@@ -616,7 +616,7 @@ class ZooKeeperAdapter
 
         /**
          * Returns the remaining connect timeout. The timeout resets
-         * to {@link #m_connectTimeout} on a successfull connection to the ZK.
+         * to {@link #m_connectTimeout} on a successful connection to the ZK.
          * 
          * @return the remaining connect timeout, in milliseconds
          */
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc
index 6a8216885fa..cfe552c349c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc
@@ -320,7 +320,7 @@ enum ZkFuseNameType {
      */
     ZkFuseNameRegType = 1,
     /**
-      ZkFuse path is synthesized and identifies the chidlren part of a
+      ZkFuse path is synthesized and identifies the children part of a
       ZooKeeper node, i.e.  Posix directory semantics is expected.
      */
     ZkFuseNameDirType = 2
@@ -707,7 +707,7 @@ class ZkFuseHandleManager : boost::noncopyable
   ZkFuseHandleManagerFactory - factory for ZkFuseHandleManager.
   
   This is the only way to create a ZkFuseHandleManager instance. 
-  to make sure that _thisWeakPtr of the instance is intialized 
+  to make sure that _thisWeakPtr of the instance is initialized
   after the instance is created.
  */
 class ZkFuseHandleManagerFactory
@@ -1354,7 +1354,7 @@ class ZkFuseFile : boost::noncopyable
          */
         uint32_t version;
         /**
-          Acces time in milliseconds.
+          Access time in milliseconds.
          */
         uint64_t atime;
         /**
@@ -1535,7 +1535,7 @@ class ZkFuseFile : boost::noncopyable
     /**
       Remove a ZkFuse directory.
 
-      If force is true, then the ZooKeeper node and its decendants
+      If force is true, then the ZooKeeper node and its descendants
       will be deleted.
 
       If force is false, then this method implements the semantics
@@ -1614,7 +1614,7 @@ class ZkFuseFile : boost::noncopyable
         the ZooKeeper node has no data.
       - If the ZkFuse regular file represents the data part of the 
         ZooKeeper node which is presented as a ZkFuse regular file,
-        the ZooKeeper node and its decendants are deleted.
+        the ZooKeeper node and its descendants are deleted.
 
       Returns -EISDIR if the ZkFuse regular file cannot be deleted
       because ZkFuse consider it to be a directory.
@@ -1711,7 +1711,7 @@ class ZkFuseFile : boost::noncopyable
       Get attributes without accessing metadata.
       
       The atime and mtime returned does not take into consideration
-      overrides present in a matadata file.
+      overrides present in a metadata file.
 
       \return 0 if successful, otherwise negative errno.
       \param stbuf return attributes here.
@@ -1836,7 +1836,7 @@ class ZkFuseFile : boost::noncopyable
       a client is trying to open the path. \see _refCount.
       Sets deleted to true. \see _deleted.
       Sets number of currently directory opens to zero. \see _openDirCount.
-      Invalidate cach for children information and data. 
+      Invalidate cache for children information and data.
 
       \param manager the ZkFuseHandleManager instance who is creating this 
                      ZkFuseFile instance.
@@ -2909,7 +2909,7 @@ class ZkFuseFile : boost::noncopyable
     /**
       Remove a ZkFuse directory.
 
-      If force is true, then the ZooKeeper node and its decendants
+      If force is true, then the ZooKeeper node and its descendants
       will be deleted.
 
       If force is false, then this method implements the semantics
@@ -2956,7 +2956,7 @@ class ZkFuseFile : boost::noncopyable
         the ZooKeeper node has no data.
       - If the ZkFuse regular file represents the data part of the 
         ZooKeeper node which is presented as a ZkFuse regular file,
-        the ZooKeeper node and its decendants are deleted.
+        the ZooKeeper node and its descendants are deleted.
 
       Returns -EISDIR if the ZkFuse regular file cannot be deleted
       because ZkFuse consider it to be a directory.
@@ -3043,7 +3043,7 @@ ZkFuseHandleManager::allocate(const std::string & path, bool & newFile)
             /* Not really supposed to invoke the new ZkFuseFile instance 
              * because this method is not supposed to invoke ZkFuseFile
              * methods that while holding _mutex. However, it is safe
-             * to do without casuing deadlock because these methods
+             * to do without causing deadlock because these methods
              * are known not to invoke other methods, especially one
              * that invoke this ZkFuseHandleManager instance.
              */
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py
index 921d2cc4b05..b56d44eecce 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py
@@ -26,7 +26,7 @@ class CloseDeadlockTest(zktestbase.TestBase):
   https://issues.apache.org/jira/browse/ZOOKEEPER-763
 
   zookeeper.close blocks on waiting for all completions to
-  finish. Previously it was doing so while holding teh GIL, stopping
+  finish. Previously it was doing so while holding the GIL, stopping
   any completions from actually continuing.
 
   This test is a failure if it does not exit within a few seconds.
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py
index 8ab80f9565a..29f63a9ffb4 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py
@@ -59,7 +59,7 @@ def test_sync_create_existing(self):
 
     def test_exception_paths(self):
         """
-        Make sure common exceptions due to API misuse are correctly propogated
+        Make sure common exceptions due to API misuse are correctly propagated
         """
         self.assertRaises(zookeeper.BadArgumentsException,
                           zookeeper.create,
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py
index b77b3b22165..226e8c183ff 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py
@@ -70,7 +70,7 @@ def test_sync_getset(self):
     def test_stat_deleted_node(self):
         """
         Test for a bug that surfaced when trying to build a
-        stat object from a non-existant node.
+        stat object from a non-existent node.
 
         """
         self.ensureDeleted("/zk-python-test-deleteme")
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt b/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
index 8250498bf57..6a7ef63dacb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
@@ -26,7 +26,7 @@ UPDATE: Make the incremental changes into the live ZK-tree from saved XML, essen
 lly after running the diff.
 
 DUMP: Dumps the ZK-tree on the standard output device reading either from live ZK
-server or XML file. Like export, ZK-subtree can be dumped with optionaly
+server or XML file. Like export, ZK-subtree can be dumped with optionally
 providing the path to the ZK-subtree, and till a certain depth of the (sub)tree.
 
 The exported ZK data into XML file can be shortened by only keeping the static ZK
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
index 199b1ed6976..c1f65916a37 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
@@ -500,7 +500,7 @@ namespace zktreeutil
                     0,
                     buffer, &len, stat );
         } while (rc != ZOK && rh.handleRC(rc));
-        if (rc != ZOK) // checl return code
+        if (rc != ZOK) // check return code
         {
             std::cerr << "[zktreeutil] Error in fetching value of " << path << std::endl;
             throw ZooKeeperException( string("Unable to get data of node ") + path, rc );
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
index 91e63e0ac8f..ffefb28a7da 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
@@ -164,7 +164,7 @@ namespace zktreeutil
             const int m_leaseTimeout;
 
             /**
-             * True if this adapater should attempt to autoreconnect in case 
+             * True if this adapter should attempt to autoreconnect in case
              * the current session has been dropped.
              */
             const bool m_autoReconnect;
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
index 2fac401f785..872bebecbdf 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
@@ -271,7 +271,7 @@ namespace zktreeutil
         private:
 
             ZkTreeNodeSptr zkRootSptr_;     // ZK tree root node
-            bool loaded_;                        // Falg indicating whether ZK tree loaded into memory
+            bool loaded_;                        // Flag indicating whether ZK tree loaded into memory
             string sslParams_;              // Comma separated parameters to initiate SSL connection
     };
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO b/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO
index 404d5c9c699..eb6e1a15042 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO
@@ -10,7 +10,7 @@
   http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html
   http://standards.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html
 
-- Rename classes to avoid redundand "ZooInspector" prefix.
+- Rename classes to avoid redundant "ZooInspector" prefix.
 
 - Ant build file has hard coded log4j dependency. (ZK will move to maven anyways...)
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
index 2888caff998..126fd65c64c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
@@ -142,7 +142,7 @@ class SingleToaster extends javax.swing.JWindow
 
 
 		/***
-		 * Simple costructor that initialized components...
+		 * Simple constructor that initialized components...
 		 */
 		public SingleToaster()
 		{
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
index a39edd55dc9..8a3a8dcb735 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
@@ -18,7 +18,7 @@
 package org.apache.zookeeper.inspector.gui.nodeviewer;
 
 /**
- * An interface to be implented by any component that needs notification when a new element
+ * An interface to be implemented by any component that needs notification when a new element
  * is selected in the UI JTree representing the set of available ZNodes.
  */
 public interface NodeSelectionListener {
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
index 6a369c51d0e..4523740daf5 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
@@ -167,17 +167,17 @@ protected void done() {
 
                 private String formatValByKeyType(String key, String value) {
                     if(key==null) return value;
-                    String formatedVal=value;
+                    String formattedVal=value;
                     switch (key){
                         case "Ephemeral Owner":
                             try{
-                                formatedVal = String.format("0x%x", Long.parseLong(value));
+                                formattedVal = String.format("0x%x", Long.parseLong(value));
                             }catch (NumberFormatException e){
                                 LoggerFactory.getLogger().warn("parse {}'s value {} to hex fail",key,value,e);
                             }
                             break;
                     }
-                    return formatedVal;
+                    return formattedVal;
                 }
             };
             worker.execute();
diff --git a/zookeeper-docs/src/main/resources/markdown/releasenotes.md b/zookeeper-docs/src/main/resources/markdown/releasenotes.md
index e32614df065..a27b6ffdd12 100644
--- a/zookeeper-docs/src/main/resources/markdown/releasenotes.md
+++ b/zookeeper-docs/src/main/resources/markdown/releasenotes.md
@@ -184,7 +184,7 @@ Version 2.2.1 code, documentation, binaries, etc... are still accessible on [Sou
 |[ZOOKEEPER-189](https://issues.apache.org/jira/browse/ZOOKEEPER-189)|forrest build not validated xml of input documents|
 |[ZOOKEEPER-188](https://issues.apache.org/jira/browse/ZOOKEEPER-188)|Check that election port is present for all servers|
 |[ZOOKEEPER-185](https://issues.apache.org/jira/browse/ZOOKEEPER-185)|Improved version of FLETest|
-|[ZOOKEEPER-184](https://issues.apache.org/jira/browse/ZOOKEEPER-184)|tests: An explicit include derective is needed for the usage of memcpy functions|
+|[ZOOKEEPER-184](https://issues.apache.org/jira/browse/ZOOKEEPER-184)|tests: An explicit include directive is needed for the usage of memcpy functions|
 |[ZOOKEEPER-183](https://issues.apache.org/jira/browse/ZOOKEEPER-183)|Array subscript is above array bounds in od_completion, src/cli.c.|
 |[ZOOKEEPER-182](https://issues.apache.org/jira/browse/ZOOKEEPER-182)|zookeeper_init accepts empty host-port string and returns valid pointer to zhandle_t.|
 |[ZOOKEEPER-17](https://issues.apache.org/jira/browse/ZOOKEEPER-17)|zookeeper_init doc needs clarification|
@@ -228,7 +228,7 @@ Version 2.2.1 code, documentation, binaries, etc... are still accessible on [Sou
 |[ZOOKEEPER-56](https://issues.apache.org/jira/browse/ZOOKEEPER-56)|Add clover support to build.xml.|
 |[ZOOKEEPER-75](https://issues.apache.org/jira/browse/ZOOKEEPER-75)|register the ZooKeeper mailing lists with nabble.com|
 |[ZOOKEEPER-54](https://issues.apache.org/jira/browse/ZOOKEEPER-54)|remove sleeps in the tests.|
-|[ZOOKEEPER-55](https://issues.apache.org/jira/browse/ZOOKEEPER-55)|build.xml failes to retrieve a release number from SVN and the ant target "dist" fails|
+|[ZOOKEEPER-55](https://issues.apache.org/jira/browse/ZOOKEEPER-55)|build.xml fails to retrieve a release number from SVN and the ant target "dist" fails|
 |[ZOOKEEPER-89](https://issues.apache.org/jira/browse/ZOOKEEPER-89)|invoke WhenOwnerListener.whenNotOwner when the ZK connection fails|
 |[ZOOKEEPER-90](https://issues.apache.org/jira/browse/ZOOKEEPER-90)|invoke WhenOwnerListener.whenNotOwner when the ZK session expires and the znode is the leader|
 |[ZOOKEEPER-82](https://issues.apache.org/jira/browse/ZOOKEEPER-82)|Make the ZooKeeperServer more DI friendly.|
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index e571652e497..4b7fd0954f3 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1211,7 +1211,7 @@ property, when available, is noted below.
     The default value is false.
 
 * *serializeLastProcessedZxid.enabled*
-  (Jave system property: **zookeeper.serializeLastProcessedZxid.enabled**)
+  (Java system property: **zookeeper.serializeLastProcessedZxid.enabled**)
   **New in 3.9.0:**
   If enabled, ZooKeeper serializes the lastProcessedZxid when snapshot and deserializes it
   when restore. Defaults to true. Needs to be enabled for performing snapshot and restore
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java
index 1d5ed4144fc..d5fb051dd3e 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java
@@ -81,7 +81,7 @@ public void genCode(String language, File outputDirectory)
                     outputDirectory);
             gen.genCode();
         } else {
-            throw new IOException("Cannnot recognize language:" + language);
+            throw new IOException("Cannot recognize language:" + language);
         }
     }
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index c26e249102f..618b4c50bb0 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -407,7 +407,7 @@ public void genJavaCode(File outputDirectory) throws IOException {
         if (!pkgdir.exists()) {
             // create the pkg directory
             if (!pkgdir.mkdirs()) {
-                throw new IOException("Cannnot create directory: " + pkgpath);
+                throw new IOException("Cannot create directory: " + pkgpath);
             }
         } else if (!pkgdir.isDirectory()) {
             throw new IOException(pkgpath + " is not a directory.");
@@ -580,7 +580,7 @@ public void genCsharpCode(File outputDirectory) throws IOException {
         if (!outputDirectory.exists()) {
             // create the pkg directory
             if (!outputDirectory.mkdirs()) {
-                throw new IOException("Cannnot create directory: " + outputDirectory);
+                throw new IOException("Cannot create directory: " + outputDirectory);
             }
         } else if (!outputDirectory.isDirectory()) {
             throw new IOException(outputDirectory + " is not a directory.");
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html b/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html
index 03bdb1bbb01..7eb07105851 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html
@@ -24,7 +24,7 @@
   This package contains classes needed for code generation
   from the hadoop record compiler. CppGenerator and JavaGenerator
   are the main entry points from the parser. There are classes
-  corrsponding to every primitive type and compound type
+  corresponding to every primitive type and compound type
   included in Hadoop record I/O syntax.
   </body>
 </html>
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/package.html b/zookeeper-jute/src/main/java/org/apache/jute/package.html
index f769b74c111..b00d97b18e5 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/package.html
+++ b/zookeeper-jute/src/main/java/org/apache/jute/package.html
@@ -29,7 +29,7 @@ <h2>Introduction</h2>
   
   Software systems of any significant complexity require mechanisms for data 
 interchange with the outside world. These interchanges typically involve the
-marshaling and unmarshaling of logical units of data to and from data streams
+marshaling and unmarshalling of logical units of data to and from data streams
 (files, network connections, memory buffers etc.). Applications usually have
 some code for serializing and deserializing the data types that they manipulate
 embedded in them. The work of serialization has several features that make
@@ -49,7 +49,7 @@ <h2>Introduction</h2>
 <ul> 
 <li> enabling the specification of simple serializable data types (records) 
 <li> enabling the generation of code in multiple target languages for
-marshaling and unmarshaling such types
+marshaling and unmarshalling such types
 <li> providing target language specific support that will enable application 
 programmers to incorporate generated code into their applications
 </ul>
@@ -397,7 +397,7 @@ <h3>C++</h3>
 
 Each field within the record will cause the generation of a private member
 declaration of the appropriate type in the class declaration, and one or more
-acccessor methods. The generated class will implement the serialize and
+accessor methods. The generated class will implement the serialize and
 deserialize methods defined in hadoop::Record+. It will also 
 implement the inspection methods type and signature from
 hadoop::Record. A default constructor and virtual destructor will also
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index af4bff9d218..574eaa2ce3b 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -437,7 +437,7 @@ public PrometheusGaugeWrapper(String name, Gauge gauge, io.prometheus.client.Gau
         }
 
         /**
-         * Call the callack and update Prometheus Gauge. This method is called
+         * Call the callback and update Prometheus Gauge. This method is called
          * when the server is polling for a value.
          */
         private void sample() {
diff --git a/zookeeper-recipes/README.txt b/zookeeper-recipes/README.txt
index 856dae0417b..bc788741d63 100644
--- a/zookeeper-recipes/README.txt
+++ b/zookeeper-recipes/README.txt
@@ -19,7 +19,7 @@ Zookeeper is used (and can be used) for more than what we have listed in the doc
 
 7) To run the c tests in all the recipes, 
 - make sure the main zookeeper c libraries in
-{top}/src/c/ are compiled. Run autoreconf -if;./configure; make. The libaries
+{top}/src/c/ are compiled. Run autoreconf -if;./configure; make. The libraries
 will be installed in {top}/src/c/.libs. 
 - run autoreconf if;./configure;make run-check 
   in zookeeper-recipes/$recipename/src/c
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/README.txt b/zookeeper-recipes/zookeeper-recipes-lock/README.txt
index 4ce629ee1e1..438de1bdbb9 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/README.txt
+++ b/zookeeper-recipes/zookeeper-recipes-lock/README.txt
@@ -19,7 +19,7 @@
 mentioned in ../../docs/recipes.[html,pdf].
 
 2) To compile the lock java recipe you can just run ant jar from 
-this directory. For compiling the c libarary go to zookeeper-client/zookeeper-client-c and read
+this directory. For compiling the c library go to zookeeper-client/zookeeper-client-c and read
 the INSTALLATION instructions. 
 Please report any bugs on the jira 
 
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4 b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4
index a4d405a8044..13cacbf81e1 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4
@@ -10,7 +10,7 @@
 # DX_???_FEATURE(ON|OFF) - control the default setting of a Doxygen feature.
 # Supported features are 'DOXYGEN' itself, 'DOT' for generating graphics,
 # 'HTML' for plain HTML, 'CHM' for compressed HTML help (for MS users), 'CHI'
-# for generating a seperate .chi file by the .chm file, and 'MAN', 'RTF',
+# for generating a separate .chi file by the .chm file, and 'MAN', 'RTF',
 # 'XML', 'PDF' and 'PS' for the appropriate output formats. The environment
 # variable DOXYGEN_PAPER_SIZE may be specified to override the default 'a4wide'
 # paper size.
@@ -239,8 +239,8 @@ DX_ARG_ABLE(chm, [generate doxygen compressed HTML help documentation],
              DX_ENV_APPEND(GENERATE_HTMLHELP, YES)],
             [DX_ENV_APPEND(GENERATE_HTMLHELP, NO)])
 
-# Seperate CHI file generation.
-DX_ARG_ABLE(chi, [generate doxygen seperate compressed HTML help index file],
+# Separate CHI file generation.
+DX_ARG_ABLE(chi, [generate doxygen separate compressed HTML help index file],
             [DX_CHECK_DEPEND(chm, 1)],
             [DX_CLEAR_DEPEND(chm, 1)],
             [],
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h
index 5c06bbf2ff2..a3c81123786 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h
@@ -27,7 +27,7 @@ extern "C" {
 /**
  * \brief the call back function called on status change of lock
  * 
- * the call back funtion is called with a rc of 0 if lock is acquired and 
+ * the call back function is called with a rc of 0 if lock is acquired and
  * with an rc of 1 if the lock is released
  * \param rc the value to let us know if its locked or unlocked
  * \param cbdata the callback data that we passed when initializing 
@@ -124,7 +124,7 @@ ZOOAPI void zkr_lock_setcallback(zkr_lock_mutex_t *mutex,
 /**
  * \brief get the callback function for zookeeper mutex
  *
- * this method gets the callback funtion for zookeeper mutex
+ * this method gets the callback function for zookeeper mutex
  * \param mutex the zookeeper mutex
  * \return the lock completion function
  */
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java
index bcaaba30b34..aeba7eff295 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java
@@ -57,7 +57,7 @@ public class WriteLock extends ProtocolSupport {
     private LockZooKeeperOperation zop;
 
     /**
-     * zookeeper contructor for writelock.
+     * zookeeper constructor for writelock.
      *
      * @param zookeeper zookeeper client instance
      * @param dir the parent path you want to use for locking
@@ -73,7 +73,7 @@ public WriteLock(ZooKeeper zookeeper, String dir, List<ACL> acl) {
     }
 
     /**
-     * zookeeper contructor for writelock with callback.
+     * zookeeper constructor for writelock with callback.
      *
      * @param zookeeper the zookeeper client instance
      * @param dir the parent path you want to use for locking
@@ -174,10 +174,10 @@ public void process(WatchedEvent event) {
     private class LockZooKeeperOperation implements ZooKeeperOperation {
 
         /**
-         * find if we have been created earler if not create our node.
+         * find if we have been created earlier if not create our node.
          *
          * @param prefix the prefix node
-         * @param zookeeper teh zookeeper client
+         * @param zookeeper the zookeeper client
          * @param dir the dir paretn
          * @throws KeeperException
          * @throws InterruptedException
@@ -225,7 +225,7 @@ public boolean execute() throws KeeperException, InterruptedException {
                     // lets force the recreation of the id
                     id = null;
                 } else {
-                    // lets sort them explicitly (though they do seem to come back in order ususally :)
+                    // lets sort them explicitly (though they do seem to come back in order usually :)
                     SortedSet<ZNodeName> sortedNames = new TreeSet<>();
                     for (String name : names) {
                         sortedNames.add(new ZNodeName(dir + "/" + name));
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4 b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4
index a4d405a8044..13cacbf81e1 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4
@@ -10,7 +10,7 @@
 # DX_???_FEATURE(ON|OFF) - control the default setting of a Doxygen feature.
 # Supported features are 'DOXYGEN' itself, 'DOT' for generating graphics,
 # 'HTML' for plain HTML, 'CHM' for compressed HTML help (for MS users), 'CHI'
-# for generating a seperate .chi file by the .chm file, and 'MAN', 'RTF',
+# for generating a separate .chi file by the .chm file, and 'MAN', 'RTF',
 # 'XML', 'PDF' and 'PS' for the appropriate output formats. The environment
 # variable DOXYGEN_PAPER_SIZE may be specified to override the default 'a4wide'
 # paper size.
@@ -239,8 +239,8 @@ DX_ARG_ABLE(chm, [generate doxygen compressed HTML help documentation],
              DX_ENV_APPEND(GENERATE_HTMLHELP, YES)],
             [DX_ENV_APPEND(GENERATE_HTMLHELP, NO)])
 
-# Seperate CHI file generation.
-DX_ARG_ABLE(chi, [generate doxygen seperate compressed HTML help index file],
+# Separate CHI file generation.
+DX_ARG_ABLE(chi, [generate doxygen separate compressed HTML help index file],
             [DX_CHECK_DEPEND(chm, 1)],
             [DX_CLEAR_DEPEND(chm, 1)],
             [],
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c
index d7cc5707ec0..8bf3415291b 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c
@@ -249,7 +249,7 @@ ZOOAPI int zkr_queue_remove(zkr_queue_t *queue, char *buffer, int *buffer_len){
  *
  * Whichever thread is last to call their required function disposes of the latch.
  *
- * The latch may disposed if no threads will call the waiting, marking, or triggering functions using take_latch_destroy_syncrhonized().
+ * The latch may disposed if no threads will call the waiting, marking, or triggering functions using take_latch_destroy_synchronized().
  */
 
 struct take_latch {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
index 3ecce4c8844..ea58b857e7d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
@@ -154,12 +154,12 @@ void doIO(Queue<Packet> pendingQueue, ClientCnxn cnxn) throws InterruptedExcepti
         }
     }
 
-    private Packet findSendablePacket(LinkedBlockingDeque<Packet> outgoingQueue, boolean tunneledAuthInProgres) {
+    private Packet findSendablePacket(LinkedBlockingDeque<Packet> outgoingQueue, boolean tunneledAuthInProgress) {
         if (outgoingQueue.isEmpty()) {
             return null;
         }
         // If we've already starting sending the first packet, we better finish
-        if (outgoingQueue.getFirst().bb != null || !tunneledAuthInProgres) {
+        if (outgoingQueue.getFirst().bb != null || !tunneledAuthInProgress) {
             return outgoingQueue.getFirst();
         }
         // Since client's authentication with server is in progress,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index 06826a672ed..0516892abfa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -356,7 +356,7 @@ public enum Code implements CodeDeprecated {
         OPERATIONTIMEOUT(OperationTimeout),
         /** Invalid arguments */
         BADARGUMENTS(BadArguments),
-        /** No quorum of new config is connected and up-to-date with the leader of last commmitted config - try
+        /** No quorum of new config is connected and up-to-date with the leader of last committed config - try
          *  invoking reconfiguration after new servers are connected and synced */
         NEWCONFIGNOQUORUM(NewConfigNoQuorum),
         /** Another reconfiguration is in progress -- concurrent reconfigs not supported (yet) */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index e04984fa918..4096ec3a7e5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -1357,7 +1357,7 @@ private String prependChroot(String clientPath) {
      * of the node by getChildren calls.
      * <p>
      * The maximum allowable size of the data array is 1 MB (1,048,576 bytes).
-     * Arrays larger than this will cause a KeeperExecption to be thrown.
+     * Arrays larger than this will cause a KeeperException to be thrown.
      *
      * @param path
      *                the path for the node
@@ -1439,7 +1439,7 @@ public String create(
      * of the node by getChildren calls.
      * <p>
      * The maximum allowable size of the data array is 1 MB (1,048,576 bytes).
-     * Arrays larger than this will cause a KeeperExecption to be thrown.
+     * Arrays larger than this will cause a KeeperException to be thrown.
      *
      * @param path
      *                the path for the node
@@ -2319,7 +2319,7 @@ public void getACL(final String path, Stat stat, ACLCallback cb, Object ctx) {
      * @return the stat of the node.
      * @throws InterruptedException If the server transaction is interrupted.
      * @throws KeeperException If the server signals an error with a non-zero error code.
-     * @throws org.apache.zookeeper.KeeperException.InvalidACLException If the acl is invalide.
+     * @throws org.apache.zookeeper.KeeperException.InvalidACLException If the acl is invalid.
      * @throws IllegalArgumentException if an invalid path is specified
      */
     public Stat setACL(final String path, List<ACL> acl, int aclVersion) throws KeeperException, InterruptedException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index ebe81001228..f78a6d47ce8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -311,15 +311,15 @@ void run() throws IOException, InterruptedException {
             // only use jline if it's in the classpath
             try {
                 Class<?> consoleC = Class.forName("jline.console.ConsoleReader");
-                Class<?> completorC = Class.forName("org.apache.zookeeper.JLineZNodeCompleter");
+                Class<?> completerC = Class.forName("org.apache.zookeeper.JLineZNodeCompleter");
 
                 System.out.println("JLine support is enabled");
 
                 Object console = consoleC.getConstructor().newInstance();
 
-                Object completor = completorC.getConstructor(ZooKeeper.class).newInstance(zk);
-                Method addCompletor = consoleC.getMethod("addCompleter", Class.forName("jline.console.completer.Completer"));
-                addCompletor.invoke(console, completor);
+                Object completer = completerC.getConstructor(ZooKeeper.class).newInstance(zk);
+                Method addCompleter = consoleC.getMethod("addCompleter", Class.forName("jline.console.completer.Completer"));
+                addCompleter.invoke(console, completer);
 
                 String line;
                 Method readLine = consoleC.getMethod("readLine", String.class);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
index 8095a40c2e0..aa1bf44a54c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
@@ -52,7 +52,7 @@ private static String getMessage(Throwable cause) {
                 return "Another reconfiguration is in progress -- concurrent " + "reconfigs not supported (yet)";
             } else if (keeperException instanceof KeeperException.NewConfigNoQuorum) {
                 return "No quorum of new config is connected and "
-                       + "up-to-date with the leader of last commmitted config - try invoking reconfiguration after "
+                       + "up-to-date with the leader of last committed config - try invoking reconfiguration after "
                        + "new servers are connected and synced";
             } else if (keeperException instanceof KeeperException.QuotaExceededException) {
                 return "Quota has exceeded : " + keeperException.getPath();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
index e2409921fa8..5d292819622 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
@@ -44,7 +44,7 @@ public final class ConnectStringParser {
     private final ArrayList<InetSocketAddress> serverAddresses = new ArrayList<>();
 
     /**
-     * Parse host and port by spliting client connectString
+     * Parse host and port by splitting client connectString
      * with support for IPv6 literals
      * @throws IllegalArgumentException
      *             for an invalid chroot path.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java
index 6dc1ee90364..7267d5420df 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java
@@ -70,7 +70,7 @@ public static void cleanup(Logger log, Closeable... closeables) {
      * Copies from one stream to another.
      *
      * @param in
-     *            InputStrem to read from
+     *            InputStream to read from
      * @param out
      *            OutputStream to write to
      * @param buffSize
@@ -100,7 +100,7 @@ public static void copyBytes(InputStream in, OutputStream out, int buffSize, boo
      * Copies from one stream to another.
      *
      * @param in
-     *            InputStrem to read from
+     *            InputStream to read from
      * @param out
      *            OutputStream to write to
      * @param buffSize
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java
index f8280dabd22..0dddfd3d623 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java
@@ -20,7 +20,7 @@
 
 /**
  * Summaries track the size and number of events.
- * They are able to publish minumum, maximum, average values, depending on the capabilities of the MetricsProvider.
+ * They are able to publish minimum, maximum, average values, depending on the capabilities of the MetricsProvider.
  */
 public interface Summary {
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java
index 8386d185fa0..905402b318e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java
@@ -20,7 +20,7 @@
 
 /**
  * Summaries track the size and number of events.
- * They are able to publish minumum, maximum, average values, depending on the capabilities of the MetricsProvider.
+ * They are able to publish minimum, maximum, average values, depending on the capabilities of the MetricsProvider.
  * A SummarySet is a set of {@link Summary}.
  */
 public interface SummarySet {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
index 90be270e8e9..68b7279cc20 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
@@ -204,7 +204,7 @@ private static void logWeighedThrottlingSetting() {
         logWeighedThrottlingSetting();
     }
 
-    /* Varation of Integer.getInteger for real number properties */
+    /* Variation of Integer.getInteger for real number properties */
     private static double getDoubleProp(String name, double def) {
         String val = System.getProperty(name);
         if (val != null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java
index 7d4831311a7..817eb92e1d1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java
@@ -48,7 +48,7 @@ public interface ConnectionMXBean {
      */
     long getPacketsSent();
     /**
-     * @return number of requets being processed
+     * @return number of requests being processed
      */
     long getOutstandingRequests();
     /**
@@ -62,7 +62,7 @@ public interface ConnectionMXBean {
      */
     void terminateSession();
     /**
-     * Terminate thei client connection. The client will immediately attempt to
+     * Terminate the client connection. The client will immediately attempt to
      * reconnect with the same session id.
      */
     void terminateConnection();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 5362b9790bc..2b8371fcc78 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -52,7 +52,7 @@ public class ContainerManager {
 
     /**
      * @param zkDb the ZK database
-     * @param requestProcessor request processer - used to inject delete
+     * @param requestProcessor request processor - used to inject delete
      *                         container requests
      * @param checkIntervalMs how often to check containers in milliseconds
      * @param maxPerMinute the max containers to delete per second - avoids
@@ -64,7 +64,7 @@ public ContainerManager(ZKDatabase zkDb, RequestProcessor requestProcessor, int
 
     /**
      * @param zkDb the ZK database
-     * @param requestProcessor request processer - used to inject delete
+     * @param requestProcessor request processor - used to inject delete
      *                         container requests
      * @param checkIntervalMs how often to check containers in milliseconds
      * @param maxPerMinute the max containers to delete per second - avoids
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
index a147f3b7d30..cf176dc2cc1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
@@ -77,7 +77,7 @@ public Long remove(E elem) {
      * Adds or updates expiration time for element in queue, rounding the
      * timeout to the expiry interval bucketed used by this queue.
      * @param elem     element to add/update
-     * @param timeout  timout in milliseconds
+     * @param timeout  timeout in milliseconds
      * @return time at which the element is now set to expire if
      *                 changed, or null if unchanged
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index 0372f46675a..800b76f2ac9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -192,7 +192,7 @@ public void run() {
                 if (!reconfiguring) {
                     NIOServerCnxnFactory.this.stop();
                 }
-                LOG.info("accept thread exitted run method");
+                LOG.info("accept thread exited run method");
             }
         }
 
@@ -394,7 +394,7 @@ public void run() {
                 // This will wake up the accept thread and the other selector
                 // threads, and tell the worker thread pool to begin shutdown.
                 NIOServerCnxnFactory.this.stop();
-                LOG.info("selector thread exitted run method");
+                LOG.info("selector thread exited run method");
             }
         }
 
@@ -543,7 +543,7 @@ public void cleanup() {
     private class ConnectionExpirerThread extends ZooKeeperThread {
 
         ConnectionExpirerThread() {
-            super("ConnnectionExpirer");
+            super("ConnectionExpirer");
         }
 
         public void run() {
@@ -561,7 +561,7 @@ public void run() {
                 }
 
             } catch (InterruptedException e) {
-                LOG.info("ConnnectionExpirerThread interrupted");
+                LOG.info("ConnectionExpirerThread interrupted");
             }
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index bcbfbaad73c..4666db53ff3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -976,7 +976,7 @@ private void validateCreateRequest(String path, CreateMode createMode, Request r
     /**
      * This method checks out the acl making sure it isn't null or empty,
      * it has valid schemes and ids, and expanding any relative ids that
-     * depend on the requestor's authentication information.
+     * depend on the requester's authentication information.
      *
      * @param authInfo list of ACL IDs associated with the client connection
      * @param acls list of ACLs being assigned to the node (create or setACL operation)
@@ -1004,7 +1004,7 @@ public static List<ACL> fixupACL(String path, List<Id> authInfo, List<ACL> acls)
                 rv.add(a);
             } else if (id.getScheme().equals("auth")) {
                 // This is the "auth" id, so we have to expand it to the
-                // authenticated ids of the requestor
+                // authenticated ids of the requester
                 boolean authIdValid = false;
                 for (Id cid : authInfo) {
                     ServerAuthenticationProvider ap = ProviderRegistry.getServerProvider(cid.getScheme());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
index 91b9ca5dfc6..78977000ca2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
@@ -110,7 +110,7 @@ public void deserialize(InputArchive ia) throws IOException {
             List<ACL> aclList = new ArrayList<>();
             Index j = ia.startVector("acls");
             if (j == null) {
-                throw new RuntimeException("Incorrent format of InputArchive when deserialize DataTree - missing acls");
+                throw new RuntimeException("Incorrect format of InputArchive when deserialize DataTree - missing acls");
             }
             while (!j.done()) {
                 ACL acl = new ACL();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index 5fb84d5842e..c76767bfd55 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -36,7 +36,7 @@
  * the connection layer always allows a connection to send at least one request
  * before disabling selection on that connection. Thus, in a scenario with 40000
  * client connections, the total number of requests inflight may be as high as
- * 40000 even if the <code>globalOustandingLimit</code> was set lower.
+ * 40000 even if the <code>globalOutstandingLimit</code> was set lower.
  *
  * The RequestThrottler addresses this issue by adding additional queueing. When
  * enabled, client connections no longer submit requests directly to the request
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index 88bf0cc1cbc..f9384a615a6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -130,7 +130,7 @@ public void startup(ZooKeeperServer zkServer) throws IOException, InterruptedExc
         startup(zkServer, true);
     }
 
-    // This method is to maintain compatiblity of startup(zks) and enable sharing of zks
+    // This method is to maintain compatibility of startup(zks) and enable sharing of zks
     // when we add secureCnxnFactory.
     public abstract void startup(ZooKeeperServer zkServer, boolean startServer) throws IOException, InterruptedException;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
index 8468b522747..0dc1a86860e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
@@ -258,7 +258,7 @@ public void shutdown() {
             this.join();
             this.flush();
         } catch (InterruptedException e) {
-            LOG.warn("Interrupted while wating for {} to finish", this);
+            LOG.warn("Interrupted while waiting for {} to finish", this);
             Thread.currentThread().interrupt();
         } catch (IOException e) {
             LOG.warn("Got IO exception during shutdown");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index d98c97f2c07..c1e0b4834a3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -468,7 +468,7 @@ public void setlastProcessedZxid(long zxid) {
     }
 
     /**
-     * the process txn on the data and perform digest comparision.
+     * the process txn on the data and perform digest comparison.
      * @param hdr the txnheader for the txn
      * @param txn the transaction that needs to be processed
      * @param digest the expected digest. A null value would skip the check
@@ -666,7 +666,7 @@ public void serializeSnapshot(OutputArchive oa) throws IOException, InterruptedE
     /**
      * append to the underlying transaction log
      * @param si the request to append
-     * @return true if the append was succesfull and false if not
+     * @return true if the append was successful and false if not
      */
     public boolean append(Request si) throws IOException {
         if (this.snapLog.append(si)) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 19f1fac4536..61c7d4ac318 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -259,7 +259,7 @@ protected enum State {
     private static volatile int maxBatchSize;
 
     /**
-     * Starting size of read and write ByteArroyOuputBuffers. Default is 32 bytes.
+     * Starting size of read and write ByteArrayOutputBuffers. Default is 32 bytes.
      * Flag not used for small transfers like connectResponses.
      */
     public static final String INT_BUFFER_STARTING_SIZE_BYTES = "zookeeper.intBufferStartingSizeBytes";
@@ -1829,7 +1829,7 @@ private void processSasl(RequestRecord request, ServerCnxn cnxn, RequestHeader r
                     int error;
                     if (authHelper.isSaslAuthRequired()) {
                         LOG.warn(
-                            "Closing client connection due to server requires client SASL authenticaiton,"
+                            "Closing client connection due to server requires client SASL authentication,"
                                 + "but client SASL authentication has failed, or client is not configured with SASL "
                                 + "authentication.");
                         error = Code.SESSIONCLOSEDREQUIRESASLAUTH.intValue();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
index e7f7ee37a2d..56b26488ed0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
@@ -21,7 +21,7 @@
 /**
  * Behaviour of the server in case of internal error.
  * When you are running tests you will use {@link #LOG_ONLY},
- * but please take care of using {@link #EXIT} when runnning in production.
+ * but please take care of using {@link #EXIT} when running in production.
  */
 public enum ExitHandler {
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
index a99bdb4e7ae..6fcd7038504 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
@@ -51,7 +51,7 @@ class ZookKeeperServerEmbeddedBuilder {
         /**
          * Base directory of the server.
          * The system will create a temporary configuration file inside this directory.
-         * Please remember that dynamic configuration files wil be saved into this directory by default.
+         * Please remember that dynamic configuration files will be saved into this directory by default.
          * <p>
          * If you do not set a 'dataDir' configuration entry the system will use a subdirectory of baseDir.
          * @param baseDir
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
index ad41a3228e7..189c3b45a74 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -128,7 +128,7 @@ public void run() {
                     try {
                         maincluster.runFromConfig(config);
                         maincluster.close();
-                        LOG.info("ZK server died. Requsting stop on JVM");
+                        LOG.info("ZK server died. Requesting stop on JVM");
                         if (!stopping) {
                             ServiceUtils.requestSystemExit(ExitCode.EXECUTION_FINISHED.getValue());
                         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
index 847b12c28ff..2f8fe7b4023 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
@@ -182,7 +182,7 @@ public static void checkSealIntegrity(CheckedInputStream is, InputArchive ia) th
     /**
      * Verifies that the file is a valid snapshot. Snapshot may be invalid if
      * it's incomplete as in a situation when the server dies while in the
-     * process of storing a snapshot. Any files that are improperly formated
+     * process of storing a snapshot. Any files that are improperly formatted
      * or corrupted are invalid. Any file that is not a snapshot is also an
      * invalid snapshot.
      *
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 5a6b18fd19a..8d2b8263ca7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -1074,7 +1074,7 @@ public Vote lookForLeader() throws InterruptedException {
                         * In ZOOKEEPER-3922, we separate the behaviors of FOLLOWING and LEADING.
                         * To avoid the duplication of codes, we create a method called followingBehavior which was used to
                         * shared by FOLLOWING and LEADING. This method returns a Vote. When the returned Vote is null, it follows
-                        * the original idea to break swtich statement; otherwise, a valid returned Vote indicates, a leader
+                        * the original idea to break switch statement; otherwise, a valid returned Vote indicates, a leader
                         * is generated.
                         *
                         * The reason why we need to separate these behaviors is to make the algorithm runnable for 2-node
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 0b57bb1824a..23e60b6b8c0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -873,7 +873,7 @@ void shutdown(String reason) {
             closeSockets();
         }
 
-        // NIO should not accept conenctions
+        // NIO should not accept connections
         self.setZooKeeperServer(null);
         self.adminServer.setZooKeeperServer(null);
         self.closeAllConnections();
@@ -904,8 +904,8 @@ synchronized void closeSockets() {
     }
 
     /** In a reconfig operation, this method attempts to find the best leader for next configuration.
-     *  If the current leader is a voter in the next configuartion, then it remains the leader.
-     *  Otherwise, choose one of the new voters that acked the reconfiguartion, such that it is as
+     *  If the current leader is a voter in the next configuration, then it remains the leader.
+     *  Otherwise, choose one of the new voters that acked the reconfiguration, such that it is as
      * up-to-date as possible, i.e., acked as many outstanding proposals as possible.
      *
      * @param reconfigProposal
@@ -982,7 +982,7 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
         // commit proposals in order
         if (zxid != lastCommitted + 1) {
             LOG.warn(
-                "Commiting zxid 0x{} from {} not first!",
+                "Committing zxid 0x{} from {} not first!",
                 Long.toHexString(zxid),
                 followerAddr);
             LOG.warn("First is 0x{}", Long.toHexString(lastCommitted + 1));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index e3bd13d1165..3fe981ccef6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -295,7 +295,7 @@ protected long nanoTime() {
 
     /**
      * Overridable helper method to simply call sock.connect(). This can be
-     * overriden in tests to fake connection success/failure for connectToLeader.
+     * overridden in tests to fake connection success/failure for connectToLeader.
      */
     protected void sockConnect(Socket sock, InetSocketAddress addr, int timeout) throws IOException {
         sock.connect(addr, timeout);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
index 30f759fb897..79aa10ca9de 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
@@ -82,7 +82,7 @@ public void commitRequest(Request request) {
 
     /**
      * Set up the request processors for an Observer:
-     * firstProcesor-&gt;commitProcessor-&gt;finalProcessor
+     * firstProcessor-&gt;commitProcessor-&gt;finalProcessor
      */
     @Override
     protected void setupRequestProcessors() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index aba7a294630..6c089465b18 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -862,7 +862,7 @@ public synchronized void setCurrentVote(Vote v) {
      * This class simply responds to requests for the current leader of this
      * node.
      * <p>
-     * The request contains just an xid generated by the requestor.
+     * The request contains just an xid generated by the requester.
      * <p>
      * The response has the xid, the id of this server, the id of the leader,
      * and the zxid of the leader.
@@ -1036,7 +1036,7 @@ public synchronized ServerState getPeerState() {
     /**
      * Resolves hostname for a given server ID.
      *
-     * This method resolves hostname for a given server ID in both quorumVerifer
+     * This method resolves hostname for a given server ID in both quorumVerifier
      * and lastSeenQuorumVerifier. If the server ID matches the local server ID,
      * it also updates myAddrs.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java
index 0ea41442235..49633046673 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java
@@ -84,7 +84,7 @@ private Long getOSUnixMXBeanMethod(String mBeanMethodName) {
                 return (Long) mBeanMethod.invoke(unixos);
             }
         } catch (Exception e) {
-            LOG.warn("Not able to load class or method for com.sun.managment.UnixOperatingSystemMXBean.", e);
+            LOG.warn("Not able to load class or method for com.sun.management.UnixOperatingSystemMXBean.", e);
         }
         return null;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
index 6163872510f..e8f41e02384 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
@@ -83,7 +83,7 @@ public class RequestPathMetricsCollector {
     public static final String PATH_STATS_COLLECTOR_DELAY = "zookeeper.pathStats.delay";
     public static final String PATH_STATS_TOP_PATH_MAX = "zookeeper.pathStats.topPathMax";
     public static final String PATH_STATS_ENABLED = "zookeeper.pathStats.enabled";
-    private static final String PATH_SEPERATOR = "/";
+    private static final String PATH_SEPARATOR = "/";
 
     private final Map<String, PathStatsQueue> immutableRequestsMap;
     private final ScheduledThreadPoolExecutor scheduledExecutor;
@@ -155,9 +155,9 @@ static boolean isWriteOp(int requestType) {
     static String trimPathDepth(String path, int maxDepth) {
         int count = 0;
         StringBuilder sb = new StringBuilder();
-        StringTokenizer pathTokenizer = new StringTokenizer(path, PATH_SEPERATOR);
+        StringTokenizer pathTokenizer = new StringTokenizer(path, PATH_SEPARATOR);
         while (pathTokenizer.hasMoreElements() && count++ < maxDepth) {
-            sb.append(PATH_SEPERATOR);
+            sb.append(PATH_SEPARATOR);
             sb.append(pathTokenizer.nextToken());
         }
         path = sb.toString();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
index d1c743104b1..014c944fc84 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
@@ -137,7 +137,7 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet supress) {
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress) {
         WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
         Set<Watcher> watchers = new HashSet<>();
         synchronized (this) {
@@ -182,7 +182,7 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List
         }
 
         for (Watcher w : watchers) {
-            if (supress != null && supress.contains(w)) {
+            if (suppress != null && suppress.contains(w)) {
                 continue;
             }
             if (w instanceof ServerWatcher) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 608bc01c4c8..54426f0b6e2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -316,7 +316,7 @@ void waitUntilHitUnsafeRegion() {
         @Override
         protected void onConnecting(InetSocketAddress addr) {
             if (closing) {
-                LOG.info("Attempt to connnecting {} {} {}", addr, closing, state);
+                LOG.info("Attempt to connecting {} {} {}", addr, closing, state);
                 ///////// Unsafe Region ////////
                 // Slow down and zoom out the unsafe point to make risk
                 // The unsafe point is that startConnect happens after sendThread.close
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
index f84ded0b5e8..39b0c5c348b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
@@ -91,12 +91,12 @@ public void testGetAllChildrenNumberAsync() throws IOException, KeeperException,
         }
     }
 
-    private void generatePaths(int persistantCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
+    private void generatePaths(int persistentCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
 
         zk.create(BASE, BASE.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create(BASE_EXT, BASE_EXT.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        for (int p = 0; p < persistantCnt; p++) {
+        for (int p = 0; p < persistentCnt; p++) {
             String base = BASE + "/" + p;
             zk.create(base, base.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             for (int e = 0; e < ephemeralCnt; e++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
index 6591cf3ce05..aefa0bba55b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
@@ -174,10 +174,10 @@ public void testGetEphemeralsErrors() throws KeeperException {
         }
     }
 
-    private String[] generatePaths(int persistantCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
+    private String[] generatePaths(int persistentCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
 
-        final String[] expected = new String[persistantCnt * ephemeralCnt];
-        for (int p = 0; p < persistantCnt; p++) {
+        final String[] expected = new String[persistentCnt * ephemeralCnt];
+        for (int p = 0; p < persistentCnt; p++) {
             String base = BASE + p;
             zk.create(base, base.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             for (int e = 0; e < ephemeralCnt; e++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java b/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
index 22d8d6efdeb..199a83150da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
@@ -31,7 +31,7 @@
  * Example:
  *   jaas = new JaasConfiguration();
  *   jaas.addSection("Server", "org.apache.zookeeper.server.auth.DigestLoginModule",
- *                   "username", "passowrd");
+ *                   "username", "password");
  */
 public class JaasConfiguration extends javax.security.auth.login.Configuration {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java
index 87c0562d5c7..fb28344c1d5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java
@@ -107,7 +107,7 @@ public static synchronized int unique() {
      * uses these 2 pieces of information to split the available ports into
      * disjoint ranges.  Each JUnit process only assigns ports from its own range
      * in order to prevent bind errors during concurrent test runs.  If any of
-     * this information is unavailable or unparseable, then the default behavior
+     * this information is unavailable or unparsable, then the default behavior
      * is for this process to use the entire available port range.  This is
      * expected when running tests outside of Ant.
      *
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 186d7b6eb22..10b11688404 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -292,7 +292,7 @@ public void testParseWithMultipleQuotes() throws Exception {
     }
 
     @Test
-    public void testNonexistantCommand() throws Exception {
+    public void testNonexistentCommand() throws Exception {
         testInvalidCommand("cret -s /node1", 127);
     }
 
@@ -363,7 +363,7 @@ public void testCreateNodeWithoutData() throws Exception {
     }
 
     @Test
-    public void testACLWithExtraAgruments() throws Exception {
+    public void testACLWithExtraArguments() throws Exception {
         final ZooKeeper zk = createClient();
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         // create persistent sequential node
@@ -397,7 +397,7 @@ public void testDelete() throws Exception {
     }
 
     @Test
-    public void testDeleteNonexistantNode() throws Exception {
+    public void testDeleteNonexistentNode() throws Exception {
         testInvalidCommand("delete /blahblahblah", 1);
     }
 
@@ -614,7 +614,7 @@ public void testLsrLeafCommand() throws Exception {
     }
 
     @Test
-    public void testLsrNonexistantZnodeCommand() throws Exception {
+    public void testLsrNonexistentZnodeCommand() throws Exception {
         final ZooKeeper zk = createClient();
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
 
@@ -678,7 +678,7 @@ public void testClientReconnectWithZKClientConfig() throws Exception {
                 aHostProvider,
                 clientConfig);
             watcher.waitForConnected(CONNECTION_TIMEOUT);
-            assertEquals(zk.getSessionId(), newZKClient.getSessionId(), "Old client session id and new clinet session id must be same");
+            assertEquals(zk.getSessionId(), newZKClient.getSessionId(), "Old client session id and new client session id must be same");
         } finally {
             zk.close();
             newZKClient.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
index 588a91939e4..e88be706316 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
@@ -149,7 +149,7 @@ public void testIntegerRetrievalFromProperty() {
 
         // property is set but can not be parsed to int, we should get the
         // NumberFormatException
-        conf.setProperty(ZKConfig.JUTE_MAXBUFFER, "InvlaidIntValue123");
+        conf.setProperty(ZKConfig.JUTE_MAXBUFFER, "InvalidIntValue123");
         try {
             result = conf.getInt(ZKConfig.JUTE_MAXBUFFER, defaultValue);
             fail("NumberFormatException is expected");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
index 7b4e8783ee3..138e45e2e1d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
@@ -125,7 +125,7 @@ public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
         });
     }
 
-    private X509Certificate[] createSelfSignedCertifcateChain(String ipAddress, String hostname) throws Exception {
+    private X509Certificate[] createSelfSignedCertificateChain(String ipAddress, String hostname) throws Exception {
         X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         nameBuilder.addRDN(BCStyle.CN, "NOT_LOCALHOST");
         Date notBefore = new Date();
@@ -163,7 +163,7 @@ public void testServerHostnameVerificationWithHostnameVerificationDisabled() thr
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(0)).getInetAddress();
         assertTrue(hostnameVerifier.hosts.isEmpty());
@@ -177,7 +177,7 @@ public void testServerHostnameVerificationWithHostnameVerificationDisabledAndCli
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(0)).getInetAddress();
 
@@ -192,7 +192,7 @@ public void testServerHostnameVerificationWithIPAddress() throws Exception {
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(1)).getInetAddress();
 
@@ -207,7 +207,7 @@ public void testServerHostnameVerificationWithHostname() throws Exception {
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(1)).getInetAddress();
 
@@ -222,7 +222,7 @@ public void testClientHostnameVerificationWithHostnameVerificationDisabled() thr
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(1)).getInetAddress();
 
@@ -237,7 +237,7 @@ public void testClientHostnameVerificationWithClientHostnameVerificationDisabled
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true,
                 false, hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(0)).getInetAddress();
 
@@ -252,7 +252,7 @@ public void testClientHostnameVerificationWithIPAddress() throws Exception {
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(1)).getInetAddress();
 
@@ -267,7 +267,7 @@ public void testClientHostnameVerificationWithHostname() throws Exception {
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
                 hostnameVerifier);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
         verify(mockSocket, times(1)).getInetAddress();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
index c0c35c69579..c7e3c8d22e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
@@ -102,13 +102,13 @@ public void teardown() throws Exception {
      * 3) ZK client will connect to the server on the secure client port using keyStoreFile1 and trustStoreFile1.
      * 4) Update the keyStoreFile1 and trustStoreFile1 files in the filesystem with keyStoreFile2 and trustStoreFile2.
      * 5) Till FileChangeWatcher thread is triggered & SSLContext options are reset, ZK client should continue to connect.
-     *    In Junit tests, FileChangeWatcher thread is not triggered immediately upon certifcate update in the filesystem.
-     * 6) Once the certficates are reloaded by the server, ZK client connect will fail.
+     *    In Junit tests, FileChangeWatcher thread is not triggered immediately upon certificate update in the filesystem.
+     * 6) Once the certificates are reloaded by the server, ZK client connect will fail.
      * 7) Next, create a new ZK client with updated keystore & truststore paths (keyStoreFile2 and trustStoreFile2).
      * 8) Server should accept the connection on the secure client port.
      */
     @Test
-    public void certficateReloadTest() throws Exception {
+    public void certificateReloadTest() throws Exception {
 
         final Properties configZookeeper = getServerConfig();
         try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
index c123f69f007..ceb9efa25de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
@@ -27,7 +27,7 @@
 public class DataNodeTest {
 
     @Test
-    public void testGetChildrenShouldReturnEmptySetWhenThereAreNoChidren() {
+    public void testGetChildrenShouldReturnEmptySetWhenThereAreNoChildren() {
         // create DataNode and call getChildren
         DataNode dataNode = new DataNode();
         Set<String> children = dataNode.getChildren();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
index 07a69f14f01..13276d855c5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
@@ -260,7 +260,7 @@ public void testPathTrieClearOnDeserialize() throws Exception {
 
     /* ZOOKEEPER-3531 - org.apache.zookeeper.server.DataTree#serialize calls the aclCache.serialize when doing
      * dataree serialization, however, org.apache.zookeeper.server.ReferenceCountedACLCache#serialize
-     * could get stuck at OutputArchieve.writeInt due to potential network/disk issues.
+     * could get stuck at OutputArchive.writeInt due to potential network/disk issues.
      * This can cause the system experiences hanging issues similar to ZooKeeper-2201.
      * This test verifies the fix that we should not hold ACL cache during dumping aclcache to snapshots
     */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
index 299cdaa6495..1e02adab86c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
@@ -116,7 +116,7 @@ public void testPurge() throws Exception {
 
     /**
      * Tests purge when logs are rolling or a new snapshot is created, then
-     * these newer files should alse be excluded in the current cycle.
+     * these newer files should also be excluded in the current cycle.
      *
      * For frequent snapshotting, configured SnapCount to 30. There are three
      * threads which will create 1000 znodes each and simultaneously do purge
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
index 0a76cb363c0..5655e8b677d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
@@ -210,7 +210,7 @@ public void commit() throws IOException {
         try {
             // do create operation, so that injected IOException is thrown
             zk.create("/foo2", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            fail("IOException is expected as error is injected in transaction log commit funtionality");
+            fail("IOException is expected as error is injected in transaction log commit functionality");
         } catch (Exception e) {
             // do nothing
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
index 91e5e903ce2..e80c4a3166a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
@@ -186,11 +186,11 @@ public void run() {
                 try {
                     servcnxnf.startup(zks);
                 } catch (IOException e) {
-                    LOG.error("Unexcepted exception during server startup", e);
+                    LOG.error("Unexpected exception during server startup", e);
                     // Ignoring exception. If there is an ioexception
                     // then one of the following assertion will fail
                 } catch (InterruptedException e) {
-                    LOG.error("Unexcepted exception during server startup", e);
+                    LOG.error("Unexpected exception during server startup", e);
                     // Ignoring exception. If there is an interrupted exception
                     // then one of the following assertion will fail
                 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
index 6cf1e2147b9..fea351f45f1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
@@ -52,7 +52,7 @@ public MyCriticalThread(String threadName) {
             super(threadName, new ZooKeeperServerListener() {
 
                 @Override
-                public void notifyStopping(String threadName, int erroCode) {
+                public void notifyStopping(String threadName, int errorCode) {
 
                 }
             });
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index f3c2dfee2a0..d547e34f439 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -291,7 +291,7 @@ public void testLogSizeLimit(@TempDir File tmpDir) throws Exception {
         for (long i = 0; i < txnCount; i++) {
             Stat stat = new Stat();
             byte[] data = db.getData("/node-" + i, stat, null);
-            assertArrayEquals(bytes, data, "Missmatch data");
+            assertArrayEquals(bytes, data, "Mismatch data");
             assertTrue(zxids.contains(stat.getMzxid()), "Unknown zxid ");
         }
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
index 920c1391cc7..f4160b3c28f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
@@ -309,14 +309,14 @@ public void testCnxManagerListenerThreadConfigurableRetry() throws Exception {
         final QuorumPeer peer = new QuorumPeer(unresolvablePeers, ClientBase.createTmpDir(), ClientBase.createTmpDir(), 2181, 3, myid, 1000, 2, 2, 2);
         final QuorumCnxManager cnxManager = peer.createCnxnManager();
         final QuorumCnxManager.Listener listener = cnxManager.listener;
-        final AtomicBoolean errorHappend = new AtomicBoolean(false);
-        listener.setSocketBindErrorHandler(() -> errorHappend.set(true));
+        final AtomicBoolean errorHappened = new AtomicBoolean(false);
+        listener.setSocketBindErrorHandler(() -> errorHappened.set(true));
         listener.start();
         // listener thread should stop and throws error which notify QuorumPeer about error.
         // QuorumPeer should start shutdown process
         listener.join(15000); // set wait time, if listener contains bug and thread not stops.
         assertFalse(listener.isAlive());
-        assertTrue(errorHappend.get());
+        assertTrue(errorHappened.get());
         assertFalse(listener.isAlive(), QuorumPeer.class.getSimpleName() + " not stopped after " + "listener thread death");
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
index 21970f3ea4d..5f5449d240e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
@@ -169,7 +169,7 @@ public void committedAndUncommittedOfTheSameSessionRaceTest() throws Exception {
      * i.e., 5 sessions, each has different amount or read requests, followed by
      * single write and afterwards single read. The idea is to check that all of
      * the reads that can be processed concurrently do so, and that none of the
-     * uncommited requests, followed by the reads are processed.
+     * uncommitted requests, followed by the reads are processed.
      */
     @Test
     public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
@@ -224,7 +224,7 @@ public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
      */
     @Test
     public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exception {
-        final String path = "/testUncommittedFollowingCommited";
+        final String path = "/testUncommittedFollowingCommitted";
         Set<Request> shouldBeInPending = new HashSet<>();
         Set<Request> shouldBeProcessedAfterPending = new HashSet<>();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
index bfa3fb78613..f4ba976de3a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
@@ -186,9 +186,9 @@ private void checkMetrics(String metricName, long min, long max, double avg, lon
         assertEquals(sum, values.get("sum_" + metricName), "expected sum is: " + sum);
     }
 
-    private void checkTimeMetric(long actual, long lBoundrary, long hBoundrary) {
-        assertThat(actual, greaterThanOrEqualTo(lBoundrary));
-        assertThat(actual, lessThanOrEqualTo(hBoundrary));
+    private void checkTimeMetric(long actual, long lBoundary, long hBoundary) {
+        assertThat(actual, greaterThanOrEqualTo(lBoundary));
+        assertThat(actual, lessThanOrEqualTo(hBoundary));
     }
 
     private Request createReadRequest(long sessionId, int xid) {
@@ -386,7 +386,7 @@ public void testConcurrentRequestProcessingInCommitProcessor() throws Exception
         commitProcessor.processRequest(createReadRequest(1L, 4));
         requestScheduled.await(5, TimeUnit.SECONDS);
 
-        //add a commit request to trigger waitForEmptyPool, which will record number of requests being proccessed
+        //add a commit request to trigger waitForEmptyPool, which will record number of requests being processed
         poolEmptied = new CountDownLatch(1);
         commitProcessor.commit(createWriteRequest(1L, 1));
         poolEmptied.await(5, TimeUnit.SECONDS);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
index 73ad201c109..d7bb1a0679d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
@@ -177,7 +177,7 @@ public void process(String path) {
     }
 
     /**
-     * It's possibel during SNAP sync, the parent is serialized before the
+     * It's possible during SNAP sync, the parent is serialized before the
      * child get deleted during sending the snapshot over.
      *
      * In which case, we need to make sure the pzxid get correctly updated
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
index 43202716d2b..e38c82ea9f7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
@@ -198,7 +198,7 @@ void assertZxidEquals(long expected, long value) {
     }
 
     /**
-     * Test cases when leader has empty commitedLog
+     * Test cases when leader has empty committedLog
      */
     @Test
     public void testEmptyCommittedLog() throws Exception {
@@ -327,7 +327,7 @@ public void testTxnLog() throws Exception {
     public void testTxnLogProposalIteratorClosure() throws Exception {
         long peerZxid;
 
-        // CommmitedLog is empty, we will use txnlog up to lastProcessZxid
+        // CommittedLog is empty, we will use txnlog up to lastProcessZxid
         db = new MockZKDatabase(null) {
             @Override
             public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
@@ -346,13 +346,13 @@ public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
     }
 
     /**
-     * Test cases when txnlog is enabled and commitedLog is empty
+     * Test cases when txnlog is enabled and committedLog is empty
      */
     @Test
     public void testTxnLogOnly() throws Exception {
         long peerZxid;
 
-        // CommmitedLog is empty, we will use txnlog up to lastProcessZxid
+        // CommittedLog is empty, we will use txnlog up to lastProcessZxid
         db.lastProcessedZxid = 7;
         db.txnLog.add(createProposal(2));
         db.txnLog.add(createProposal(3));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
index 1ffc74f0d46..dd219e1643b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
@@ -179,11 +179,11 @@ public void testDigestMismatchesWhenTxnLost() throws Exception {
         // start the follower and observer to have a diff sync
         startServers(targets);
 
-        long misMatchCount = getMismatchDigestCount();
-        assertNotEquals(0L, misMatchCount);
+        long mismatchCount = getMismatchDigestCount();
+        assertNotEquals(0L, mismatchCount);
 
         triggerOps(leader, "/p2");
-        assertNotEquals(misMatchCount, getMismatchDigestCount());
+        assertNotEquals(mismatchCount, getMismatchDigestCount());
     }
 
     private void stopServers(List<Integer> sids) throws InterruptedException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
index 407a9d1a58b..6ad5a4b93e8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
@@ -194,7 +194,7 @@ public void testParseBoolean() throws IOException, ConfigException {
         zkProp.setProperty("localSessionsEnabled", "yes");
         try {
             quorumPeerConfig.parseProperties(zkProp);
-            fail("Must throw exception as 'yes' is not accpetable for parseBoolean!");
+            fail("Must throw exception as 'yes' is not acceptable for parseBoolean!");
         } catch (ConfigException e) {
             // expected
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index 1cb2a2b8efa..6c0f4f926dd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -309,7 +309,7 @@ public void testHighestZxidJoinLate() throws Exception {
 
         assertEquals(output[0], 1, "Expecting old value 1 since 2 isn't committed yet");
 
-        // Do some other update, so we bump the maxCommttedZxid
+        // Do some other update, so we bump the maxCommittedZxid
         // by setting the value to 2
         servers.zk[nonleader].setData(path + nonleader, input, -1);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index 27e2e320100..e7649cdbdfc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -95,7 +95,7 @@ public static class MainThread implements Runnable {
         final File tmpDir;
 
         public static final int UNSET_STATIC_CLIENTPORT = -1;
-        // standalone mode doens't need myid
+        // standalone mode doesn't need myid
         public static final int UNSET_MYID = -1;
 
         volatile TestQPMain main;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index 820394bf868..e2e1227e9b3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -195,7 +195,7 @@ public void setup() throws Exception {
 
         rootKeyPair = createKeyPair();
         contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(rootKeyPair.getPrivate());
-        rootCertificate = createSelfSignedCertifcate(rootKeyPair);
+        rootCertificate = createSelfSignedCertificate(rootKeyPair);
 
         // Write the truststore
         KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
@@ -304,7 +304,7 @@ public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOEx
 
     }
 
-    private X509Certificate createSelfSignedCertifcate(KeyPair keyPair) throws Exception {
+    private X509Certificate createSelfSignedCertificate(KeyPair keyPair) throws Exception {
         X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         nameBuilder.addRDN(BCStyle.CN, HOSTNAME);
         BigInteger serialNumber = new BigInteger(128, new Random());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
index 17ccdae6ea6..8ca33f798c7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
@@ -64,7 +64,7 @@ public void setup() throws Exception {
         }).when(nextProcessor).processRequest(any(Request.class));
     }
 
-    private Request createRquest(long sessionId, int xid) {
+    private Request createRequest(long sessionId, int xid) {
         return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
@@ -72,7 +72,7 @@ private Request createRquest(long sessionId, int xid) {
     public void testSyncProcessorMetrics() throws Exception {
         SyncRequestProcessor syncProcessor = new SyncRequestProcessor(zks, nextProcessor);
         for (int i = 0; i < 500; i++) {
-            syncProcessor.processRequest(createRquest(1, i));
+            syncProcessor.processRequest(createRequest(1, i));
         }
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
index 866cf9546de..f30de6404ba 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
@@ -52,7 +52,7 @@ private static void removeListOfDigests(AdHash hash, List<Long> digests) {
     }
 
     /**
-     * Test thhe add and remove digest from AdHash is working as expected.
+     * Test the add and remove digest from AdHash is working as expected.
      */
     @Test
     public void testAdHash() throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
index 1c8c882c5dc..7fc406b5263 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
@@ -61,21 +61,21 @@ public void tearDown() {
     @Test
     public void testTrimPath() {
         //normal cases
-        String trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 1);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 2);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1/p2"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 3);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1/p2/p3"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 4);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1/p2/p3"));
+        String trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 1);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 2);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1/p2"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 3);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1/p2/p3"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 4);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1/p2/p3"));
         //some extra symbols
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 3);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 2);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1 next/p2.index"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 6);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 3);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 2);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1 next/p2.index"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 6);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index 843b804deca..3021421b5e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -553,7 +553,7 @@ private void startServer(int serverId) throws Exception {
         Set<ObjectName> children = JMXEnv.ensureParent("InMemoryDataTree", "StandaloneServer_port");
         // Remove beans which are related to zk client sessions. Strong
         // assertions cannot be done for these client sessions because
-        // registeration of these beans with server will happen only on their
+        // registration of these beans with server will happen only on their
         // respective reconnection interval
         verifyUnexpectedBeans(children);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
index 96db26f804d..faf5c260ea7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
@@ -262,7 +262,7 @@ public void process(WatchedEvent event) {
      * in the right order.
      */
     @Test
-    public void testMutipleWatcherObjs() throws IOException, InterruptedException, KeeperException {
+    public void testMultipleWatcherObjs() throws IOException, InterruptedException, KeeperException {
         ZooKeeper zk = createClient(new CountdownWatcher(), hostPort);
         try {
             MyWatcher[] watchers = new MyWatcher[100];
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
index d9d67c4023b..40cd03bd972 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
@@ -76,7 +76,7 @@ public void tearDown() throws Exception {
     }
 
     /**
-     * See ZOOKEEPER-1319 - verify that a lagging follwer resyncs correctly
+     * See ZOOKEEPER-1319 - verify that a lagging follower resyncs correctly
      *
      * 1) start with down quorum
      * 2) start leader/follower1, add some data
@@ -314,7 +314,7 @@ public void run() {
 
         // Wait until all updates return
         if (!sem.tryAcquire(ClientBase.CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS)) {
-            LOG.warn("Did not aquire semaphore fast enough");
+            LOG.warn("Did not acquire semaphore fast enough");
         }
         mytestfooThread.join(ClientBase.CONNECTION_TIMEOUT);
         if (mytestfooThread.isAlive()) {
@@ -471,7 +471,7 @@ public void run() {
 
         // Wait until all updates return
         if (!sem.tryAcquire(ClientBase.CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS)) {
-            LOG.warn("Did not aquire semaphore fast enough");
+            LOG.warn("Did not acquire semaphore fast enough");
         }
         mytestfooThread.join(ClientBase.CONNECTION_TIMEOUT);
         if (mytestfooThread.isAlive()) {
@@ -518,7 +518,7 @@ private boolean waitForPendingRequests(int timeout) throws InterruptedException
     }
 
     /**
-     * Wait for all server to have the same lastProccessedZxid. Timeout in seconds
+     * Wait for all server to have the same lastProcessedZxid. Timeout in seconds
      */
     private boolean waitForSync(QuorumUtil qu, int index, int timeout) throws InterruptedException {
         LOG.info("Wait for server to sync");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
index a85e76d01ec..e9e5b184241 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Iterator;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
@@ -117,7 +117,7 @@ public void testGetProposalFromTxn() throws Exception {
         }
 
         // All zxid should match what we created
-        assertTrue(Arrays.equals(zxids, retrievedZxids.toArray(new Long[0])), "Zxids missmatches");
+        assertArrayEquals(zxids, retrievedZxids.toArray(new Long[0]), "Zxids mismatches");
 
         // There should be 2000 create requests
         assertTrue((createCount == MSG_COUNT), "create proposal count == " + MSG_COUNT);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
index 1f7fc0d7e76..32a99fa38fb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
@@ -104,7 +104,7 @@ public void testTxnFailure() throws Exception {
 
     /*
      * Does create/delete depending on the type and verifies
-     * if cversion before the operation is 1 less than cversion afer.
+     * if cversion before the operation is 1 less than cversion after.
      */
     private void doOp(FileTxnSnapLog logFile, int type, String path, DataTree dt, DataNode parent, int cversion) throws Exception {
         int lastSlash = path.lastIndexOf('/');
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
index 16a470c31d8..45b5da4a11f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
@@ -71,7 +71,7 @@ public void testLocalSessionsOnLeader() throws Exception {
     }
 
     /**
-     * Walk through the target peer commmittedLog.
+     * Walk through the target peer committedLog.
      * @param sessionId
      * @param peerId
      */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index 53b75ec32b2..7157966c977 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -571,7 +571,7 @@ public void testUpdateConflict(boolean useAsync) throws Exception {
     @ValueSource(booleans = {true, false})
     public void testDeleteUpdateConflict(boolean useAsync) throws Exception {
 
-        /* Delete of a node folowed by an update of the (now) deleted node */
+        /* Delete of a node followed by an update of the (now) deleted node */
         try {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
@@ -590,7 +590,7 @@ public void testDeleteUpdateConflict(boolean useAsync) throws Exception {
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     public void testGetResults(boolean useAsync) throws Exception {
-        /* Delete of a node folowed by an update of the (now) deleted node */
+        /* Delete of a node followed by an update of the (now) deleted node */
         Iterable<Op> ops = Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.delete("/multi", 0),
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
index deaad43b6ee..0eed28e7742 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
@@ -56,7 +56,7 @@ public void testObserverOnly() throws Exception {
      * (and will not come up with standalone server).
      */
     @Test
-    public void testObserverWithStandlone() throws Exception {
+    public void testObserverWithStandalone() throws Exception {
         ClientBase.setupTestEnv();
         final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
index 2a079e2c33a..8cf63900707 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
@@ -69,13 +69,13 @@ public void testMajQuorums() throws Throwable {
             s = s2;
         }
 
-        noDropConectionTest(s);
+        noDropConnectionTest(s);
 
         dropConnectionTest(s, leader);
 
     }
 
-    private void noDropConectionTest(QuorumPeer s) {
+    private void noDropConnectionTest(QuorumPeer s) {
         Leader.Proposal p = new Leader.Proposal();
 
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
index ff53b0fe932..1f2029b9a7e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
@@ -120,7 +120,7 @@ public void testViewContains() {
         // Test view contains other servers
         assertTrue(qb.s1.viewContains(qb.s2.getMyId()));
 
-        // Test view does not contain non-existant servers
+        // Test view does not contain non-existent servers
         assertFalse(qb.s1.viewContains(-1L));
     }
 
@@ -178,7 +178,7 @@ public void testLeaderShutdown() throws IOException, InterruptedException, Keepe
 
     @Test
     public void testMultipleWatcherObjs() throws IOException, InterruptedException, KeeperException {
-        ct.testMutipleWatcherObjs();
+        ct.testMultipleWatcherObjs();
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
index 76513dc44c9..b8ce7f2a6e3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
@@ -31,7 +31,7 @@
 import org.slf4j.LoggerFactory;
 
 /**
- * This class is intented to ensure the correct functionality of
+ * This class is intended to ensure the correct functionality of
  * {@link QuorumUtil} helper.
  */
 public class QuorumUtilTest extends ZKTestCase {
@@ -41,8 +41,8 @@ public class QuorumUtilTest extends ZKTestCase {
     /**
      * <p>
      * This test ensures that all JXM beans associated to a {@link QuorumPeer}
-     * are unregistered when shuted down ({@link QuorumUtil#shutdown(int)}). It
-     * allows a successfull restarting of several zookeeper servers (
+     * are unregistered when shut down ({@link QuorumUtil#shutdown(int)}). It
+     * allows a successful restarting of several zookeeper servers (
      * {@link QuorumPeer}) running on the same JVM.
      * <p>
      * See ZOOKEEPER-1214 for details.
@@ -77,9 +77,9 @@ public void validateAllMXBeanAreUnregistered() throws IOException {
             break;
         }
 
-        LOG.info(">-->> Shuting down server [{}]", firstFollowerIndex);
+        LOG.info(">-->> Shutting down server [{}]", firstFollowerIndex);
         qU.shutdown(firstFollowerIndex);
-        LOG.info(">-->> Shuting down server [{}]", secondFollowerIndex);
+        LOG.info(">-->> Shutting down server [{}]", secondFollowerIndex);
         qU.shutdown(secondFollowerIndex);
         LOG.info(">-->> Restarting server [{}]", firstFollowerIndex);
         qU.restart(firstFollowerIndex);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index 02b8ff6ef15..e6e3c7b361c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -553,7 +553,7 @@ public void testRoleChange() throws Exception {
 
         // during first and second iteration, leavingIndex will correspond to a
         // follower
-        // during third and fouth iteration leavingIndex will be the index of
+        // during third and fourth iteration leavingIndex will be the index of
         // the leader
         int changingIndex = (leaderIndex == 1) ? 2 : 1;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
index 46ff5880bbb..3f8fa9add1c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
@@ -55,7 +55,7 @@ public class RecoveryTest extends ZKTestCase implements Watcher {
      * server to restart within the connection timeout period.
      *
      * Also note that the client latches are used to eliminate any chance
-     * of spurrious connectionloss exceptions on the read ops. Specifically
+     * of spurious connectionloss exceptions on the read ops. Specifically
      * a sync operation will throw this exception if the server goes down
      * (as recognized by the client) during the operation. If the operation
      * occurs after the server is down, but before the client recognizes
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
index 5fb772d58a2..93a35449ceb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
@@ -114,7 +114,7 @@ private static StringBuilder readLine(BufferedReader reader) {
             // After the socket is closed, when the client tries to read a
             // line of text it will throw java.net.SocketException.
             // @see jira issue ZOOKEEPER-1862
-            LOG.info("Connnection is expired", ioe);
+            LOG.info("Connection is expired", ioe);
         }
         return sb;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
index 1e7870bd293..f3d794f759a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
@@ -41,7 +41,7 @@ public class SessionInvalidationTest extends ClientBase {
      *
      * We're using our own marshalling here in order to force an operation
      * after the session is closed (ZooKeeper.class will not allow this). Also
-     * by filling the pipe with operations it increases the likelyhood that
+     * by filling the pipe with operations it increases the likelihood that
      * the server will process the create before FinalRequestProcessor
      * removes the session from the tracker.
      */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
index 85f76c21381..ff3bb4e9c7c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
@@ -121,8 +121,8 @@ private DisconnectableZooKeeper createClient(int timeout, CountdownWatcher watch
     // TODO this test is failing due to client close race condition fixing in separate patch for ZOOKEEPER-63
     //    /**
     //     * this test checks to see if the sessionid that was created for the
-    //     * first zookeeper client can be reused for the second one immidiately
-    //     * after the first client closes and the new client resues them.
+    //     * first zookeeper client can be reused for the second one immediately
+    //     * after the first client closes and the new client reuses them.
     //     * @throws IOException
     //     * @throws InterruptedException
     //     * @throws KeeperException
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
index 114667f01dd..f01e891fb5f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
@@ -94,7 +94,7 @@ private void testLocalSessionsWithoutEphemeral(boolean testLeader) throws Except
         byte[] localSessionPwd = zk.getSessionPasswd().clone();
 
         // Try connecting with the same session id on a different
-        // server.  This should fail since it is a local sesion.
+        // server.  This should fail since it is a local session.
         try {
             watcher.reset();
             DisconnectableZooKeeper zknew = new DisconnectableZooKeeper(hostPorts[otherFollowerIdx], CONNECTION_TIMEOUT, watcher, localSessionId, localSessionPwd);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java
index 8190797e4f1..867a092a293 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java
@@ -58,9 +58,9 @@ public void run() {
             for (int i = 0; i < count; i++) {
                 try {
                     System.out.print(i + "\r");
-                    List<String> childs = zk.getChildren("/hammers", false);
-                    Collections.shuffle(childs);
-                    for (String s : childs) {
+                    List<String> children = zk.getChildren("/hammers", false);
+                    Collections.shuffle(children);
+                    for (String s : children) {
                         if (s.startsWith("hammer-")) {
                             s = "/hammers/" + s;
                             zk.setData(s, tag, -1);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
index 9ee7dabe3e2..2289847d4e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
@@ -827,7 +827,7 @@ public InetAddress[] getAllByName(String name) {
         assertFalse(resolvedThird.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedThird.getAddress().getHostAddress()));
 
-        verify(spyResolver, times(3)).getAllByName("www.apache.org");  // resolution occured every time
+        verify(spyResolver, times(3)).getAllByName("www.apache.org");  // resolution occurred every time
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
index 978e629dae2..4bf69befa33 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
@@ -41,7 +41,7 @@ public OldStatsTrack() {
          * the stat string should be of the form count=int,bytes=long
          * if stats is called with null the count and bytes are initialized
          * to -1.
-         * @param stats the stat string to be intialized with
+         * @param stats the stat string to be initialized with
          */
         public OldStatsTrack(String stats) {
             if (stats == null) {
@@ -85,7 +85,7 @@ public long getBytes() {
         }
 
         /**
-         * set teh bytes for this stat tracker.
+         * set the bytes for this stat tracker.
          *
          * @param bytes
          *            the bytes to set with
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
index 389104b9aef..3bd0ff569d8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
@@ -131,7 +131,7 @@ private void enode_test_1() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NODEEXISTS;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + ke.getMessage());
+                fail("Unexpected exception code for create: " + ke.getMessage());
             }
         }
 
@@ -207,7 +207,7 @@ private void enode_test_2() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NODEEXISTS;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + ke.getMessage());
+                fail("Unexpected exception code for create: " + ke.getMessage());
             }
         }
 
@@ -243,7 +243,7 @@ private void enode_test_2() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NOCHILDRENFOREPHEMERALS;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + code);
+                fail("Unexpected exception code for create: " + code);
             }
         }
 
@@ -262,7 +262,7 @@ private void enode_test_2() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NONODE;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + code);
+                fail("Unexpected exception code for create: " + code);
             }
         }
         firstGen1 = zk_1.getChildren(parentName, true);
diff --git a/zookeeper-server/src/test/resources/test-scripts.sh b/zookeeper-server/src/test/resources/test-scripts.sh
index 25854b815ae..531c282611a 100755
--- a/zookeeper-server/src/test/resources/test-scripts.sh
+++ b/zookeeper-server/src/test/resources/test-scripts.sh
@@ -115,7 +115,7 @@ ls $DATALOGDIR || fail $LINENO
 stop
 
 #
-# verify autocreate diabled
+# verify autocreate disabled
 #
 export ZOO_DATADIR_AUTOCREATE_DISABLE=1
 
diff --git a/zookeeper-specifications/protocol-spec/Zab.tla b/zookeeper-specifications/protocol-spec/Zab.tla
index 25379f55080..4913f0012eb 100644
--- a/zookeeper-specifications/protocol-spec/Zab.tla
+++ b/zookeeper-specifications/protocol-spec/Zab.tla
@@ -683,7 +683,7 @@ LeaderProcessACKEPOCH(i, j) ==
                     /\ ackeRecv' = [ackeRecv EXCEPT ![i] = UpdateAckeRecv(@, j, 
                                             msg.mepoch, msg.mhistory) ]
                     /\ \/ \* 2.1. ackeRecv becomes quorum, determine Ie'
-                          \* and broacasts NEWLEADER in Q. (l.1.2 + l.2.1)
+                          \* and broadcasts NEWLEADER in Q. (l.1.2 + l.2.1)
                           /\ AckeRecvBecomeQuorum(i)
                           /\ \* Update f.a
                              LET newLeaderEpoch == acceptedEpoch[i] IN 
@@ -833,14 +833,14 @@ LeaderProcessACKLD(i, j) ==
                     sendCounter, followerVars, electionVars, proposalMsgsLog, epochLeader>>
         /\ UpdateRecorder(<<"LeaderProcessACKLD", i, j>>)
 
-RECURSIVE ZxidToIndexHepler(_,_,_,_)
-ZxidToIndexHepler(his, zxid, cur, appeared) == 
+RECURSIVE ZxidToIndexHelper(_,_,_,_)
+ZxidToIndexHelper(his, zxid, cur, appeared) ==
         IF cur > Len(his) THEN cur  
         ELSE IF TxnZxidEqual(his[cur], zxid) 
              THEN CASE appeared = TRUE -> -1
                   []   OTHER           -> Minimum( { cur, 
-                            ZxidToIndexHepler(his, zxid, cur + 1, TRUE) } ) 
-             ELSE ZxidToIndexHepler(his, zxid, cur + 1, appeared)
+                            ZxidToIndexHelper(his, zxid, cur + 1, TRUE) } )
+             ELSE ZxidToIndexHelper(his, zxid, cur + 1, appeared)
 
 \* return -1: this zxid appears at least twice. Len(his) + 1: does not exist.
 \* 1 - Len(his): exists and appears just once.
@@ -848,7 +848,7 @@ ZxidToIndex(his, zxid) == IF ZxidEqual( zxid, <<0, 0>> ) THEN 0
                           ELSE IF Len(his) = 0 THEN 1
                                ELSE LET len == Len(his) IN
                                     IF \E idx \in 1..len: TxnZxidEqual(his[idx], zxid)
-                                    THEN ZxidToIndexHepler(his, zxid, 1, FALSE)
+                                    THEN ZxidToIndexHelper(his, zxid, 1, FALSE)
                                     ELSE len + 1
 
 (* Follower receives COMMITLD. Commit all txns. *)
diff --git a/zookeeper-specifications/protocol-spec/issues.md b/zookeeper-specifications/protocol-spec/issues.md
index 559434dd974..c6d2bcd857f 100644
--- a/zookeeper-specifications/protocol-spec/issues.md
+++ b/zookeeper-specifications/protocol-spec/issues.md
@@ -34,7 +34,7 @@ We found that because the set of objects when the Leader broadcast *PROPOSE* is
 Therefore, we have made amendments in the spec. When the Leader broadcasts *PROPOSE*, the set of sending objects has been changed from *ackldRecv* to *ackeRecv*. We successfully discovered errors introduced by the vague description of **Q** in the protocol through model checking, and fixed them in the specification.
 
 ## (Issue 2) Issue introduced by lack of client request logic
-Since there is not discriptions about client request, we need to add a process that describes the Leader receives a client request and encapsulates the request as a new log entry and appends it to the local log. This process are represented as action *LeaderProcessRequest* in the spec.
+Since there is no descriptions about client request, we need to add a process that describes the Leader receives a client request and encapsulates the request as a new log entry and appends it to the local log. This process are represented as action *LeaderProcessRequest* in the spec.
 
 In our original specification, when Follower receives the message *PROPOSE*, the *zxid* of the proposed log entry should be the successor *zxid* of the latest local log entry‘s *zxid*, otherwise it will be regarded as an illegal *PROPOSE*.
 
diff --git a/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
index a5a44ba2ca0..cdff66ad225 100644
--- a/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
+++ b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
@@ -72,7 +72,7 @@ VARIABLE outOfElection
 \* recvQueue[i]: The queue of received notifications or timeout signals in server i.
 VARIABLE recvQueue
 
-\* A veriable to wait for new notifications, corresponding to line 1050 in FastLeaderElection.java.
+\* A variable to wait for new notifications, corresponding to line 1050 in FastLeaderElection.java.
 VARIABLE waitNotmsg
 
 \* leadingVoteSet[i]: The set of voters that follow i.
diff --git a/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
index cf8ca8fa180..2f3efd6ec6e 100644
--- a/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
+++ b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
@@ -119,7 +119,7 @@ VARIABLE msgs       \* Simulates network channel.
 
 \* Variables about status of cluster network and node presence.
 VARIABLES status,    \* Whether the server is online or offline.
-          partition  \* network partion.
+          partition  \* network partition.
 
 \* Variables only used in verifying properties.
 VARIABLES epochLeader,       \* Set of leaders in every epoch.
@@ -143,7 +143,7 @@ VARIABLES epochLeader,       \* Set of leaders in every epoch.
                    \* to compare ids between servers.
     \* Update: we have transformed idTable from variable to function.
 
-\*VARIABLE clientReuqest \* Start from 0, and increases monotonically
+\*VARIABLE clientRequest \* Start from 0, and increases monotonically
                          \* when LeaderProcessRequest performed. To
                          \* avoid existing two requests with same value. 
     \* Update: Remove it to recorder.nClientRequest.
@@ -797,7 +797,7 @@ LeaderProcessFOLLOWERINFO(i, j) ==
                  /\ \/ /\ zabState[i] = DISCOVERY
                        /\ UNCHANGED violatedInvariants
                     \/ /\ zabState[i] /= DISCOVERY
-                       /\ PrintT("Exception: waitingFotNewEpoch true," \o
+                       /\ PrintT("Exception: waitingForNewEpoch true," \o
                           " while zabState not DISCOVERY.")
                        /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
                  /\ tempMaxEpoch' = [tempMaxEpoch EXCEPT ![i] = IF lastAcceptedEpoch >= tempMaxEpoch[i] 
@@ -895,20 +895,20 @@ UpdateAckSid(his, lastSeenIndex, target) ==
 
 \* return -1: this zxid appears at least twice; Len(his) + 1: does not exist;
 \* 1 ~ Len(his): exists and appears just once.
-RECURSIVE ZxidToIndexHepler(_,_,_,_)
-ZxidToIndexHepler(his, zxid, cur, appeared) == 
+RECURSIVE ZxidToIndexHelper(_,_,_,_)
+ZxidToIndexHelper(his, zxid, cur, appeared) ==
         IF cur > Len(his) THEN cur  
         ELSE IF TxnZxidEqual(his[cur], zxid) 
              THEN CASE appeared = TRUE -> -1
                   []   OTHER           -> Minimum( { cur, 
-                            ZxidToIndexHepler(his, zxid, cur + 1, TRUE) } ) 
-             ELSE ZxidToIndexHepler(his, zxid, cur + 1, appeared)
+                            ZxidToIndexHelper(his, zxid, cur + 1, TRUE) } )
+             ELSE ZxidToIndexHelper(his, zxid, cur + 1, appeared)
 
 ZxidToIndex(his, zxid) == IF ZxidEqual( zxid, <<0, 0>> ) THEN 0
                           ELSE IF Len(his) = 0 THEN 1
                                ELSE LET len == Len(his) IN
                                     IF \E idx \in 1..len: TxnZxidEqual(his[idx], zxid)
-                                    THEN ZxidToIndexHepler(his, zxid, 1, FALSE)
+                                    THEN ZxidToIndexHelper(his, zxid, 1, FALSE)
                                     ELSE len + 1
 
 \* Find index idx which meets: 
@@ -963,7 +963,7 @@ LastSnapshot(i) == IF zabState[i] = BROADCAST THEN lastSnapshot[i]
                         []   OTHER -> lastSnapshot[i]
 
 \* To compress state space, 
-\* 1. we merge sending SNAP and outputing snapshot buffer into sending SNAP, and
+\* 1. we merge sending SNAP and outputting snapshot buffer into sending SNAP, and
 \* 2. substitute sub sequence of history for snapshot of data tree.
 SerializeSnapshot(i, idx) == IF idx <= 0 THEN << >>
                              ELSE SubSeq(history[i], 1, idx)
@@ -1618,7 +1618,7 @@ FollowerCommitInBatches(i) ==
            /\ lastProcessed' = [lastProcessed EXCEPT ![i] = lastCommitted'[i]]
            /\ UNCHANGED violatedInvariants
         \/ /\ ~match
-           /\ PrintT("Warn: Committing zxid withou see txn. /" \o 
+           /\ PrintT("Warn: Committing zxid without see txn. /" \o
                 "Committing zxid != pending txn zxid.")
            /\ violatedInvariants' = [violatedInvariants EXCEPT 
                         !.commitInconsistent = TRUE ]

From c44cb3798245bd3de0157be7997d7125fde19193 Mon Sep 17 00:00:00 2001
From: puru <purushah@oath.com>
Date: Thu, 1 Aug 2024 20:47:46 -0700
Subject: [PATCH 450/591] ZOOKEEPER-4798: Secure prometheus support (#2127)

Co-authored-by: purshotam shah <purushah@yahooinc.com>
Co-authored-by: tison <wander4096@gmail.com>
---
 .../prometheus/PrometheusMetricsProvider.java | 106 +++++++++++-
 .../PrometheusHttpsMetricsProviderTest.java   | 161 ++++++++++++++++++
 .../PrometheusMetricsProviderConfigTest.java  |  47 ++++-
 .../src/test/resources/data/ssl/README.md     |   5 +
 .../resources/data/ssl/client_keystore.jks    | Bin 0 -> 2246 bytes
 .../resources/data/ssl/client_truststore.jks  | Bin 0 -> 986 bytes
 .../resources/data/ssl/server_keystore.jks    | Bin 0 -> 2276 bytes
 .../resources/data/ssl/server_truststore.jks  | Bin 0 -> 958 bytes
 8 files changed, 313 insertions(+), 6 deletions(-)
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index 574eaa2ce3b..cae081f2697 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -55,9 +55,12 @@
 import org.eclipse.jetty.security.ConstraintMapping;
 import org.eclipse.jetty.security.ConstraintSecurityHandler;
 import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
 import org.eclipse.jetty.util.security.Constraint;
+import org.eclipse.jetty.util.ssl.KeyStoreScanner;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -101,7 +104,8 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     private final CollectorRegistry collectorRegistry = CollectorRegistry.defaultRegistry;
     private final RateLogger rateLogger = new RateLogger(LOG, 60 * 1000);
     private String host = "0.0.0.0";
-    private int port = 7000;
+    private int httpPort = -1;
+    private int httpsPort = -1;
     private boolean exportJvmInfo = true;
     private Server server;
     private final MetricsServletImpl servlet = new MetricsServletImpl();
@@ -111,11 +115,48 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     private long workerShutdownTimeoutMs = 1000;
     private Optional<ExecutorService> executorOptional = Optional.empty();
 
+    // Constants for SSL configuration
+    public static final int SCAN_INTERVAL = 60 * 10; // 10 minutes
+    public static final String SSL_KEYSTORE_LOCATION = "ssl.keyStore.location";
+    public static final String SSL_KEYSTORE_PASSWORD = "ssl.keyStore.password";
+    public static final String SSL_KEYSTORE_TYPE = "ssl.keyStore.type";
+    public static final String SSL_TRUSTSTORE_LOCATION = "ssl.trustStore.location";
+    public static final String SSL_TRUSTSTORE_PASSWORD = "ssl.trustStore.password";
+    public static final String SSL_TRUSTSTORE_TYPE = "ssl.trustStore.type";
+    public static final String SSL_X509_CN = "ssl.x509.cn";
+    public static final String SSL_X509_REGEX_CN = "ssl.x509.cn.regex";
+    public static final String SSL_NEED_CLIENT_AUTH = "ssl.need.client.auth";
+    public static final String SSL_WANT_CLIENT_AUTH = "ssl.want.client.auth";
+
+    private String keyStorePath;
+    private String keyStorePassword;
+    private String keyStoreType;
+    private String trustStorePath;
+    private String trustStorePassword;
+    private String trustStoreType;
+    private boolean needClientAuth = true;
+    private boolean wantClientAuth = true;
+
     @Override
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
         LOG.info("Initializing metrics, configuration: {}", configuration);
         this.host = configuration.getProperty("httpHost", "0.0.0.0");
-        this.port = Integer.parseInt(configuration.getProperty("httpPort", "7000"));
+        if (configuration.containsKey("httpsPort")) {
+            this.httpsPort = Integer.parseInt(configuration.getProperty("httpsPort"));
+            this.keyStorePath = configuration.getProperty(SSL_KEYSTORE_LOCATION);
+            this.keyStorePassword = configuration.getProperty(SSL_KEYSTORE_PASSWORD);
+            this.keyStoreType = configuration.getProperty(SSL_KEYSTORE_TYPE);
+            this.trustStorePath = configuration.getProperty(SSL_TRUSTSTORE_LOCATION);
+            this.trustStorePassword = configuration.getProperty(SSL_TRUSTSTORE_PASSWORD);
+            this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE);
+            this.needClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_NEED_CLIENT_AUTH, "true"));
+            this.wantClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_WANT_CLIENT_AUTH, "true"));
+            //check if httpPort is also configured
+            this.httpPort = Integer.parseInt(configuration.getProperty("httpPort", "-1"));
+        } else {
+            // Use the default HTTP port (7000) or the configured port if HTTPS is not set.
+            this.httpPort = Integer.parseInt(configuration.getProperty("httpPort", "7000"));
+        }
         this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
         this.numWorkerThreads = Integer.parseInt(
                 configuration.getProperty(NUM_WORKER_THREADS, "1"));
@@ -129,12 +170,29 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
     public void start() throws MetricsProviderLifeCycleException {
         this.executorOptional = createExecutor();
         try {
-            LOG.info("Starting /metrics HTTP endpoint at host: {}, port: {}, exportJvmInfo: {}",
-                    host, port, exportJvmInfo);
+            LOG.info("Starting /metrics {} endpoint at HTTP port: {}, HTTPS port: {}, exportJvmInfo: {}",
+                    httpPort > 0 ? httpPort : "disabled",
+                    httpsPort > 0 ? httpsPort : "disabled",
+                    exportJvmInfo);
             if (exportJvmInfo) {
                 DefaultExports.initialize();
             }
-            server = new Server(new InetSocketAddress(host, port));
+            if (httpPort == -1) {
+                server = new Server();
+            } else {
+                server = new Server(new InetSocketAddress(host, httpPort));
+            }
+            if (httpsPort != -1) {
+                SslContextFactory sslServerContextFactory = new SslContextFactory.Server();
+                configureSslContextFactory(sslServerContextFactory);
+                KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslServerContextFactory);
+                keystoreScanner.setScanInterval(SCAN_INTERVAL);
+                server.addBean(keystoreScanner);
+                ServerConnector connector = new ServerConnector(server, sslServerContextFactory);
+                connector.setPort(httpsPort);
+                connector.setHost(host);
+                server.addConnector(connector);
+            }
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
             constrainTraceMethod(context);
@@ -156,6 +214,44 @@ public void start() throws MetricsProviderLifeCycleException {
         }
     }
 
+    @SuppressWarnings("deprecation")
+    private void configureSslContextFactory(SslContextFactory sslServerContextFactory) {
+        if (keyStorePath != null) {
+            sslServerContextFactory.setKeyStorePath(keyStorePath);
+        } else {
+            LOG.error("KeyStore configuration is incomplete keyStorePath: {}", keyStorePath);
+            throw new IllegalStateException("KeyStore configuration is incomplete keyStorePath: " + keyStorePath);
+        }
+        if (keyStorePassword != null) {
+            sslServerContextFactory.setKeyStorePassword(keyStorePassword);
+        } else {
+            LOG.error("keyStorePassword configuration is incomplete ");
+            throw new IllegalStateException("keyStorePassword configuration is incomplete ");
+        }
+        if (keyStoreType != null) {
+            sslServerContextFactory.setKeyStoreType(keyStoreType);
+        }
+        if (trustStorePath != null) {
+            sslServerContextFactory.setTrustStorePath(trustStorePath);
+        } else {
+            LOG.error("TrustStore configuration is incomplete trustStorePath: {}", trustStorePath);
+            throw new IllegalStateException("TrustStore configuration is incomplete trustStorePath: " + trustStorePath);
+        }
+        if (trustStorePassword != null) {
+            sslServerContextFactory.setTrustStorePassword(trustStorePassword);
+        } else {
+            LOG.error("trustStorePassword configuration is incomplete");
+            throw new IllegalStateException("trustStorePassword configuration is incomplete");
+        }
+        if (trustStoreType != null) {
+            sslServerContextFactory.setTrustStoreType(trustStoreType);
+        }
+        sslServerContextFactory
+                .setNeedClientAuth(needClientAuth);
+        sslServerContextFactory
+                .setWantClientAuth(wantClientAuth);
+    }
+
     // for tests
     MetricsServletImpl getServlet() {
         return servlet;
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
new file mode 100644
index 00000000000..a27e9084d1c
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
@@ -0,0 +1,161 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
+import java.io.BufferedReader;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.security.KeyStore;
+import java.util.Properties;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
+import org.apache.zookeeper.metrics.Counter;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing
+ * Prometheus but only our integration.
+ */
+public class PrometheusHttpsMetricsProviderTest extends PrometheusMetricsTestBase {
+
+    private PrometheusMetricsProvider provider;
+    private String httpHost = "127.0.0.1";
+    private int httpsPort = 4443;
+    private int httpPort = 4000;
+    private String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+
+    public void initializeProviderWithCustomConfig(Properties inputConfiguration) throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty("httpHost", httpHost);
+        configuration.setProperty("exportJvmInfo", "false");
+        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+        configuration.setProperty("ssl.keyStore.password", "testpass");
+        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+        configuration.setProperty("ssl.trustStore.password", "testpass");
+        configuration.putAll(inputConfiguration);
+        provider.configure(configuration);
+        provider.start();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        if (provider != null) {
+            provider.stop();
+        }
+    }
+
+    @Test
+    void testHttpResponce() throws Exception {
+        Properties configuration = new Properties();
+        configuration.setProperty("httpPort", String.valueOf(httpPort));
+        initializeProviderWithCustomConfig(configuration);
+        simulateMetricIncrement();
+        validateMetricResponse(callHttpServlet("http://" + httpHost + ":" + httpPort + "/metrics"));
+    }
+
+    @Test
+    void testHttpsResponse() throws Exception {
+        Properties configuration = new Properties();
+        configuration.setProperty("httpsPort", String.valueOf(httpsPort));
+        initializeProviderWithCustomConfig(configuration);
+        simulateMetricIncrement();
+        validateMetricResponse(callHttpsServlet("https://" + httpHost + ":" + httpsPort + "/metrics"));
+    }
+
+    @Test
+    void testHttpAndHttpsResponce() throws Exception {
+        Properties configuration = new Properties();
+        configuration.setProperty("httpsPort", String.valueOf(httpsPort));
+        configuration.setProperty("httpPort", String.valueOf(httpPort));
+        initializeProviderWithCustomConfig(configuration);
+        simulateMetricIncrement();
+        validateMetricResponse(callHttpServlet("http://" + httpHost + ":" + httpPort + "/metrics"));
+        validateMetricResponse(callHttpsServlet("https://" + httpHost + ":" + httpsPort + "/metrics"));
+    }
+
+    private String callHttpsServlet(String urlString) throws Exception {
+        // Load and configure the SSL context from the keystore and truststore
+        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+        try (FileInputStream keystoreStream = new FileInputStream(testDataPath + "/ssl/client_keystore.jks")) {
+            keyStore.load(keystoreStream, "testpass".toCharArray());
+        }
+
+        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
+        try (FileInputStream trustStoreStream = new FileInputStream(testDataPath + "/ssl/client_truststore.jks")) {
+            trustStore.load(trustStoreStream, "testpass".toCharArray());
+        }
+
+        SSLContext sslContext = SSLContext.getInstance("TLS");
+        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        keyManagerFactory.init(keyStore, "testpass".toCharArray());
+        TrustManagerFactory trustManagerFactory = TrustManagerFactory
+                .getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        trustManagerFactory.init(trustStore);
+        sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(),
+                new java.security.SecureRandom());
+
+        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
+        URL url = new URL(urlString);
+        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
+        connection.setRequestMethod("GET");
+
+        return readResponse(connection);
+    }
+
+    private String callHttpServlet(String urlString) throws IOException {
+        URL url = new URL(urlString);
+        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
+        connection.setRequestMethod("GET");
+        return readResponse(connection);
+    }
+
+    private String readResponse(HttpURLConnection connection) throws IOException {
+        int status = connection.getResponseCode();
+        try (BufferedReader reader = new BufferedReader(
+                new InputStreamReader(status > 299 ? connection.getErrorStream() : connection.getInputStream()))) {
+            StringBuilder content = new StringBuilder();
+            String inputLine;
+            while ((inputLine = reader.readLine()) != null) {
+                content.append(inputLine).append("\n");
+            }
+            return content.toString().trim();
+        } finally {
+            connection.disconnect();
+        }
+    }
+
+    public void simulateMetricIncrement() {
+        Counter counter = provider.getRootContext().getCounter("cc");
+        counter.add(10);
+    }
+
+    private void validateMetricResponse(String response) throws IOException {
+        assertThat(response, containsString("# TYPE cc counter"));
+        assertThat(response, containsString("cc 10.0"));
+    }
+}
\ No newline at end of file
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
index 64989889b78..6ff0da5e204 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -23,7 +23,6 @@
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
 import org.junit.jupiter.api.Test;
 
-
 public class PrometheusMetricsProviderConfigTest extends PrometheusMetricsTestBase {
 
     @Test
@@ -59,4 +58,50 @@ public void testValidConfig() throws MetricsProviderLifeCycleException {
         provider.start();
     }
 
+    @Test
+    public void testValidSslConfig() throws MetricsProviderLifeCycleException {
+        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        configuration.setProperty("httpHost", "127.0.0.1");
+        configuration.setProperty("httpsPort", "50511");
+        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+        configuration.setProperty("ssl.keyStore.password", "testpass");
+        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+        configuration.setProperty("ssl.trustStore.password", "testpass");
+        provider.configure(configuration);
+        provider.start();
+    }
+
+    @Test
+    public void testValidHttpsAndHttpConfig() throws MetricsProviderLifeCycleException {
+        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        configuration.setProperty("httpPort", "50512");
+        configuration.setProperty("httpsPort", "50513");
+        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+        configuration.setProperty("ssl.keyStore.password", "testpass");
+        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+        configuration.setProperty("ssl.trustStore.password", "testpass");
+        provider.configure(configuration);
+        provider.start();
+    }
+
+
+    @Test
+    public void testInvalidSslConfig() throws MetricsProviderLifeCycleException {
+        assertThrows(MetricsProviderLifeCycleException.class, () -> {
+            PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+            Properties configuration = new Properties();
+            String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+            configuration.setProperty("httpsPort", "50514");
+            //keystore missing
+            configuration.setProperty("ssl.keyStore.password", "testpass");
+            configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+            configuration.setProperty("ssl.trustStore.password", "testpass");
+            provider.configure(configuration);
+            provider.start();
+        });
+    }
 }
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md
new file mode 100644
index 00000000000..4e1aa7484d1
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md
@@ -0,0 +1,5 @@
+SSL test data
+===================
+
+Testing client/server keystore, password is "testpass".
+Testing client/server truststore, password is "testpass".
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks
new file mode 100644
index 0000000000000000000000000000000000000000..8636f41dd088b564573843725f639cc0bd01e400
GIT binary patch
literal 2246
zcmchY`8N~{7sqGDm|>7*EJ?-KnJ{BlmLxmPFk}yn8T-zYrNW@>FC|+UYnHK_>_j5j
zo+Q%9lC4KFRAdeB)Omk+{(|?1`@{X5d(OS*d++()WBM^2004j(0sIpXypJcrFNBe%
zJ<Ah0005W)C=&P=>J$WqgaE-nSr9i6$P56Jz^eh=eaZM?tLR1@vYi&FxLAuS8oA+V
zvDW@YZhTxW#c~$_^g1gQCwV9U{hBK{^cEW%m$dGfRNAbtbBZkUC{m`bDOfdrBl4YJ
zHo^lQi%}EO-U_7}1t+2{{l17dtwRUJ>h=t0l1+*ZpL<PaT)@)O`AjM%aGSMJpKb<5
z`5MJ6n?KPhNmw42+%J2v-|IZ4U1BQqEn>yV;$%*I^!t!nn_IWd(doR8WXm1H^0jFQ
z7gBf5PO<-d?J3EQ@S;%tXZ5)*T)7!MPYfiF2AsR#_3K^6$%57SMZFF(<KGQdJ{qND
z__NfR9a-k^IqwIAtMn~=gbrbzXOJ=5Al8{NrB@Hma*dZk$<vbouLE563tF@yV)2>T
z$66%_dNR~?N;;jJuK(I0@iLr_u2i<~`Y`o9bk}&;pvQ!mLsq$atGDyG!~(x_W4^_%
z3Q=w7L7B{wn3KtF2^9jWW@<`>8N<^xaqf$}8yu}Za;&Z6MQYzo8icz(Yk<B+3cW$A
z=NqwyC&(eZzzSrMx@uTFW|IrvpDu4%e5WveHlOF)2OY;y87Uop@|k9L4uVan;uenW
zQ01~;T+0f!W?^rxS#aKtpysf96=UUuU8U_w%!3@{L3R9ZS29B&TznWC7;(d7-o|@1
z`JVJu*J%~W3QjDK53~!MO<G`<aC{*yyzu!S__dm^y0VE?DUe$n`TB;gASJ6Lnevst
zv+dkx%I=<=SDThX7O|U*Q6kr2gq<l$e23e0()&ZU&pN(KNS2&cR|(tqRURv=2cfe9
z>fQp)2t$v;uZG8L$dimPKbF3(8n4VA0iSN{Lun_4cKdI-&AYNHQE8~t-s#e=*0J$f
zy@1S7F}+R>Ssp^Bw77Ot#1)vCh2wToru-sau6{CNDR;O2zAp`*qOV(agX>jRVlhax
zJT9YDA4Cos+3hS-w<OLA_gmfsU}9<<U_Y^KYt@_~>bF~lCQg+($BSG2vX(<$(4JkQ
z?6-1{^0d<Y5arg^yfpEPTiSg$4`%{wYCVIF>+Vi8)+*POP_&^xmivFIg2vlEvM0|P
zEY@`>=`h`PY);{xYG7ua*k(Ci3Y|KJhK<w*Q+A~F8x8sMC~~&6F=}?{{MP}j?Mqo3
zb2(}}c`VTbrOlgK@k6u{8%lh1=Sr=QQv+svh7ZZCm<PzJKmWuQG~{P8|2ggeZ`@ZM
ztnmV7Rn?!XZ@HJZ-HAFUs*h_63Vx#)e%RQ;R#gz2_Vkgs?mK-CLCX8%^uNrbH5Q@N
z`v+e23QF9ZaOBPW=$&<`>8?^_4y#i-IZ=;bYPu>4&D=4sj(lj1f3KV>vTUMxP4u+c
zUt^onK_n)VatkQ?`Wwr@Wf&d#rLYwoj<~+U=h12`QL(K=3wNcTIsdCdHLyuGviBlw
z?l{Sd*(|l83<lXtzzpZx1B2Tl8@+7OY!n(voyMD;?>g*VBn?t|H4@eui4!$V(SJkX
zBRYY51N1b1jta4BFNZ5v=O8f$m^~FBi{gi?vAng|1N<cwohk=4Yn+wlYCy_v!OMKE
zr5`xl!UxjGgm<Z%+@u8g+R${M)BTuM7o1A5yWGINEaIAlDo~Tnu(rH+h%DElv+nX!
z)09Y2y>Zg#+HEv*H#H+VPvG<G?bjmW#qziT5p(Z$4)#C3$ZRXGg3<s0n4(Z5rbrYC
zgfC<Q0YM;el-sQ<C=Lj#>^-A<yBt6u8^bVt(Yz=g2$MA!0%x=H4-L}u5A_QP3P<yx
zxPDU>IO}hU3vmr0pt(_;zZn$H@~6@>Bpl7fa9aj~!J)qqCdeJlhGP9q*x(>zD>Nsg
z9V20aL-hW5HA+N)Ls1!}j8a9bqcoHi?N4(mq8UI5t@J<e{~m}06#cg(jDNvI0&+4Q
z2@nP%0fB&o2;S(CfJbf3qQvv$5!zcS#p&e7k8`qYmp|bfMBWG>4tCEBdl@to#1fDy
zkz#W6;MMXdjmrIiKKZx(S=2P)s@o!(-=yf1*+g-F;U014!OEal{NO@qD(u6kMdS96
zS;e&@Ybv`R<#M2)sLG1RiSP9$!nd>>`jZC~sFI*rGSpM?#R;|NM$m{v3hUF?N&&v6
zNz*yJYw9-P+`hyA2#!QY7j(FzDougfD{Hx|G5E=$n;Epbznt&1<gGIy%)yJJn^&Qp
z4YyABb5ytpzY$C0P`KO5GZ@R)J|6uvj*Z$gX)US)bbi^<IbM7{SZZhO+|vhr?^YdJ
zic*7RKukaYumph;MxA49^4uvfKbZIEp_tm3P^l(HWo)$I!tAC0B+eB6TSUfPF+>Cc
z_^8~^cX=t*uBi)^Z{u+;4yi(VRZBR*qqsZhZ61y40VOdfcXAuP0k*Lm`15jN)KJIM
z?#cL(qA73d1n~_wO5Jh{u>)asAJ<mp@bO+!zoaeLML1}1$loR=*EG9*<;j#IHqgPE
zu6HTS3z50r?(<0@&L+Zsinc>(N2<ccMOjn8{LlFCXM?vEEyBW$29+AmG%QT(<+;3!
zk=N*=t6MBZ5FeY)6;cIy=$i@`7h8y1XQgzf?qIjJiH~P54r{rEapuF$mQZi49*)kn
zZM3gMct3kgtF%O;GfK8wy1O?EJKd3lL4MX2Lx6Cila_C0iRQDVWJtb62HE}5bYX?o
T!3(H}7J^_vU?vUBOk@8GlfT%S

literal 0
HcmV?d00001

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks
new file mode 100644
index 0000000000000000000000000000000000000000..3e5893d0b6b70f14b3facfa5b2d660832b33fe8d
GIT binary patch
literal 986
zcmezO_TO6u1_mY|W(3o0#i>PQsYO6;-<Dad%nYm%dZq@J3=GV(4Vsvz8#FQ1FJNY3
zWMX15xR(0IfR~L^tIebBJ1-+6H!FiduAzv55F2wS3!5-^WPWLpbAD-FNl~StkbwY5
zltY*kBpO_jSdwZeXuuB=V;ANCtIRB^G!!u40|{{nvx9{Ei_#6b4LCs}+`>$rA%^@w
z>wp|)VYXnf8x0i1d5ugAObpBnEetFTO`|0EjSPVT#)igF0eU;AiBSnTNElfen41{+
z84Q{jxtN+585vH*N~^M%?llXT-CLNzom_PEw*7B@)gAI$r%r5WU=Iyj$sKIK^YrJr
z&GTxXAD<fbA}p4ztn>fB!Y@fS=5r>$+Wgr_v~2Mk75<YeEl-E*&G@nF&I7C0M@w0+
z`e!nw&2ydNEHADfx_s`tLy7zD%M0ww{9=FlsnRR9J14_lKD3KrZYfqwTyjrsfzU7c
ztmB#A+S}Tn&t9dWG~;#HNj<Ni^XYqB+*%AwZW!!2*S_)cw(}XU0_>hd&0SQ`H1|%+
ziT?>g{dMc-tUeykKJP;Hv7dKX)s)ZvzS8^bO_aL%i9NZm?^^5Mdh>mK5uf<f7`@#R
zkKT%Q1Zr%aFK#%${kQ1p#m2=ltC^S?85kGa8dw|10%KB^k420{L?q|gpA}k)2ixaG
z{omzrAnQ*3iFF22AZbAsVFSS?&Yb+@#GH)$;*xfjdSJ3d4q#xK0|qc7gA7Ma^qtH%
zMhgBHtex7vetEE)>vWS$pYOYM5p$f)5-qh)XeG{i>>BlKWjNP%g};LC+yB1V$i1?5
zcEsmR)w~a_1ON5UyqCqQVAyA`98;yL>oV`6jskD5eUIGcd9U8h4vSRnu8>&yPewPn
zX0?NCO%&Jeh_GK*PAoL$xgBTtcgnk65i5(ft(tR1+t=pIP7h5jd6}NIQ+6<z+Lm?6
zi>-Dxe|M<y@T{)11vey<T-jU8Yr2^iEizx{x@nJ___6RyCze^deY*L#;yZ80F%R1v
z;X=Ztyi;Zs=CyD9ssB8&eaAM&%6O%?mwbXQC4K#3T?<TB`j$BumU*|#@Ala6<kH)w
b_@5KLnI1p%>(Q>)os+h26m@47HFW?0s{U>i

literal 0
HcmV?d00001

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks
new file mode 100644
index 0000000000000000000000000000000000000000..d524c6268a563a3a371d26812554b7ecf92a3458
GIT binary patch
literal 2276
zcmchY={wZz8^&idmcdwtq10HiZ{J~%UD?T=!K5;T6ejzUbsmu=OH>}qV6;5bSVDG5
zgs~^G6h(!?NFhW#bo^dCf5Gp?_2T?o_i^0!abEXvUVF?vCI|$A92EFZ!Gk;lLp=iz
zWct&;$Lv8M76?Fw?E&0y4tY2j29|^Hg25~x7#X&RrRO^0R<cSo@P)&(+vSM)pmC;n
zdC0h2+KB%4c;kLY`c$j-Rq3#GsZS2v)pyIxGn?#*<KDFh8wgvHsq3iu_hy2Wuf4y8
z|HG+5X7zUD<V1k5@>BjBOV!euWf-06fi<@VW;!n3%0wLLTE)O+?z*e$ZjGB*dVl-D
z#eBd-HjTh?z!$wPU=}w|vcP0VaRs?fzo?JD$Hae&d~_k0X*dZobhoEhZnS0g=TWm&
zN)(FevHh56Xl+7(pS%=&*|jzT&dYx-%f(xH@^YQ5B?4;IN{yZ~T<|mg4))ibXB~UY
z(K_hN=@OLspi~z{gnyjLSpCNq=nq!f&7=Bl8S{~&=0bZ1x@yAO7#1Gpx&-R@oG@}C
zKHXYeiHOq(-T7e4jEv7-dfxs}YMxx^^cEE*|6!{-;rvG_t`*ALcpJ9y`)$5rZ+zCC
zk4B6YWvkt%?XEV4^TCo)(6Hkb7P~5ZxEKC;e^p&Iv(tHtdbHY3JrTyL>vQFGIU|*d
zD{j>nznX&ffE@W15Jcd2IJJRu5U#70-?inGVHJcZRq8D~=QS{ieTFFu5gF2onJKVc
zsYjivJJlg@Dd+kSWn+IYO*MVxy;$8@h1oa=Pn7!YnCud#H-rwo4C-mRT5NCKa>%vv
zBt80YaaZwUszY+@XZ1O<eqq*BhqXn!`ms4J!<tSq8ry?M0A{Q^8?q#?P5o&)vX;g@
zA@Ydgl30q8GU|)(uOtn1gzW<zcG)d;TR(YEkIe+0S#Yd?{P4kyTD|t1@ZQP1l=q4C
zr|LFLb5-VcN!s>gu;ACu+ya-77MHj_w}uj&9>>fL5;moivE@E2*hTidch*k6M3D}9
z`J-@{#kH+xM$eRcuyW}A0)Ke8!xyJ!BmE!TKk=_Lca_zB1MlhAK2_lRhGRETZ~}J{
z8p=H^v!NzzrqkhdT1Tp@p9tPej-JsL{zc)8C^_9P{~W#NxQxy4%Mv@InvsT*#FLQl
zPl-dd0&*rKM6&*L9w(;A{@R`9FZUl%%?*s&ltl1x5?~3IRr{AE_uYm<To&^{Y8I6*
z71y{23HYFX%l*6@qO_M~X#vrjC#~*<hP4KZtbm)SclJ#W^dm<UanX>@C7s$hED=ZR
z$bxS6Tk6<lGNeP~dtF+7$EvTfKaqA<D|=Wap!!m_KDsC4YHSx;K3oD@?{@D}Krtxt
z<ho;`Vl6hjBE)(~T%Z_fw}0CiIiHm|HnIEFGm_#m87t%1=h~Y_KJ#<q8Y!a8KxAX1
zZnY0GSXN?*t68sDr$(JPQPZJwK`TqPn&TypkSrJ4Xt(ddwB^l6E2#ogyN1?jKJnRr
z+&-p;D_o$Ew2>CnB-|~8xtE-F+dX7NP;*d9KFU<|BWIk~6pf?t!49WFQT6mW>%X25
z4fD6APEFMJe57@IcJ!Opo9G>v+!7oxju3@AC!mB4Xt@?u$q3t7&<MTZ>ku@!H)~s&
z=}cfNCfzU+N39BWMZZpoAtYmI+8pN3ta~{qQ#L1=3*W{x*4LjmHtKwsKDjjF(4^>o
zH`VN&X2zCH^xJcq?6Fj&F737qqCAXjE*I*p6{KH#BMLTZRPlK`BU{socvOg4Xpr2(
zn;CP*veIz9yHr7NV0{ODI$F#WbmrY%2AOJ_Luosa+m2qK4iNt&Ba5?=8lVXRLGuAJ
z^d3Nl#1=y#U<d>TjCt+?TyS=|M6<+AE-)Cu0s{Q7D1Z+Rb%eqB5iX>VKtoc9e{f&~
zmJi@Lq-^}`htwgM80?AV1(1h~m7nd;NuS^dEYCsS9v}{W)<a|y=#51H?1u!w4>3QB
zMIKytAfWtkhd*fzh@!bvZ~zWa$DRZ<v1$Y%qzd)`sA5(B2map=B7?>MYstaJfRe#T
z5I_cVK*(S)h;ja?Buwp@x^4cg05^n3VCOsi9i(IfMy{9fB#zY)PeV8WoO9cQHI(Ru
z?mPG|`1A14<o&&Xb$1<&g6zebH5Gx-(&ZD#9-3yKlTz+h)6|UCQfCOu8yg>p7sWWo
z5QA2Bd{ns7PHg>v;c4|**YBGXUxZKf;J?o5xk3|y#EAFbOBM6|!d&V0`I(fMw2=Q;
zMm%>3-=kz<KjhtFWRd{jCV-Z~q^gm+q05W5dY=h})NACzsRYKp8(&6DWdXhWA}i(9
z^{(wH7Ac8=ozYwK%LHi+MvLFlw6^lw<;}`KZuA{jrDmazOo5wrGBrhLY*EsVKwqh9
zkO&<D1%tq)x_~xt>|m0|xM6}Y6v}sg_a8a27fBStev?_-m8n=p1#slB%?slPc**R(
zBoCtRWl~UZ5-j#$LI2m_gFkm*Fc>7l7IkjQXIVwm=9Tv8#EtctW{y6xNV?TZg>!+S
zI#E-eAxF&nWK5W+IdRmB{^m8U|Giv=phf39uT@{?n$@=3%lP~K6&6u!y1s;Kq@<z|
zWmrL!>z01n@fynFN<Q92GBsR?wkM+K5k)sR7DeD_cE<l2Wt6CLzPo_^owL&9Obe`g
zTretcrPJSNCM$;#Nh{B30IBJQreFl=h8ipF@f~?7Ud0o_?#8S)!lF{4RH{aWadnFc
zy36S`<DsU>kICQRn_M@$%yb)^`1nJ(a`FQFld86r7l=s>b>N7L;upSh^BM)GX9%Vg
r<7if)2G~%`grZclC!b$4$rl%iYqB47iW08)7YV`TvW{*o%WnP)0leK{

literal 0
HcmV?d00001

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks
new file mode 100644
index 0000000000000000000000000000000000000000..faa3228368eafcfea74aa091b4b164d26d1852a9
GIT binary patch
literal 958
zcmezO_TO6u1_mY|W(3o0$vK&+c_lz@-<Da`y$q}odZq@J3=GWm22IS>22D)K3z(T0
znV4AWQ_7tTc-c6$+C196^D;7WvoaXu8j2VQu`!3TunBWV=9d;Z=a=S{6jd4u83=$x
zIfOYuqQNDJC8>sj2K*o~c3}>%%FL2VLjeOmkPw$JJ4ndCDBY0TfD<IbEzIN@V#p7)
z4#;5^W^)F+(Lh0**T}@c#K6qZ!obqRC`y9g$Pg%CY-kJ>ptpmX7?qHNgprkjxrvdV
z!Jvtei>Zl`k)fkXq~T1#)ScUu(&Xlyxp{H(s@VUZKFMlvJ3L6<sBm6f@z-~$(^+mC
z=QpQnn^r69zAb*Syxwx<&w?X*7mrTc+$X=fM#1KT`rE71(^T^152(bSTv>EXjAenw
zX097&12=s+<+H-?Z|G*8yj2c`l1ipeGydm>ZB6~qH{<P`Nvqh6C4IWtGmQ@Z-+Umh
z=!|L)=h73#1-af`w`PdEvIwsf%su^F@=Qa+{N3pWE4>-*p1zvN*_eFwRMNzob${Y(
zx6gXRtmw<~=<ItJ_RNjt5=VJgB*>pv?&H<3+aYwaS#;N>hNUgsn-5$KRkCM{KfHU-
zrA1-I>fc_;E}eAb@{8#03ww(-nV1<F7#AxV$Q#H4V^WrnMT|w{?__233(`w${7o;M
zov(A(y1(<z0^~phrYm3|GBSv67Tot;WYwC)-iIqMwgx9e_ewjjejF_Mx24wbi;(4-
z<HpLd>GO6bZ{&LSr0}alXZ@+&OZQ)GJ+tt7c4&vnyOdSypERcJRt#wm-nlyZc3am`
zwFs63`J$7j^1~ZvdQac=bk6mdfWqj|x6alTS&CEM?8<qd-x6LGb^YeIRlBs!xGpJi
z_OOU;5lxmU{`@GgqSE7}@g}K_4{tfoN;ur8XSw&SMd0JAwAtSG7Hk$j@b<mF)uZic
zpJmh?uh#~A{*pHPuGMMVlnVa2Tr!I{m%sRZ_TJ8SyPj5MZ<&2_Wssra#Km8>@8AD^
z!Jc&O)RSVI+ua%DJ7aBgr!2PF^0=FAZs5du>ARj^7s^f!&z#Mr&Bpd@%h@>o^49=P
CnQXTJ

literal 0
HcmV?d00001


From 4e999c8708656ab18ea466607ee9859b517b680a Mon Sep 17 00:00:00 2001
From: fanyang <fanyang89@outlook.com>
Date: Fri, 2 Aug 2024 12:58:40 +0800
Subject: [PATCH 451/591] ZOOKEEPER-4809: Fix adaptor threads use-after-free
 when log level is debug (#2139)

The log callback needs to be obtained from freed zhandle when the log level
is debug, resulting in used-after-free.
---
 zookeeper-client/zookeeper-client-c/src/mt_adaptor.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
index 4e6e1b6bf29..174701c7358 100644
--- a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
@@ -359,6 +359,7 @@ unsigned __stdcall do_io( void * v)
 void *do_io(void *v)
 #endif
 {
+    log_callback_fn log_fn;
     zhandle_t *zh = (zhandle_t*)v;
 #ifndef WIN32
     struct pollfd fds[2];
@@ -456,8 +457,9 @@ void *do_io(void *v)
         if(is_unrecoverable(zh))
             break;
     }
-    api_epilog(zh, 0);    
-    LOG_DEBUG(LOGCALLBACK(zh), "IO thread terminated");
+    log_fn = LOGCALLBACK(zh);
+    api_epilog(zh, 0);
+    LOG_DEBUG(log_fn, "IO thread terminated");
     return 0;
 }
 
@@ -468,6 +470,7 @@ void *do_completion(void *v)
 #endif
 {
     zhandle_t *zh = v;
+    log_callback_fn fn;
     api_prolog(zh);
     notify_thread_ready(zh);
     LOG_DEBUG(LOGCALLBACK(zh), "started completion thread");
@@ -479,8 +482,9 @@ void *do_completion(void *v)
         pthread_mutex_unlock(&zh->completions_to_process.lock);
         process_completions(zh);
     }
-    api_epilog(zh, 0);    
-    LOG_DEBUG(LOGCALLBACK(zh), "completion thread terminated");
+    fn = LOGCALLBACK(zh);
+    api_epilog(zh, 0);
+    LOG_DEBUG(fn, "completion thread terminated");
     return 0;
 }
 

From 66f9cc3941f09ca00464760c78e30b97bd7c1faa Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@gmail.com>
Date: Mon, 5 Aug 2024 21:49:33 +0800
Subject: [PATCH 452/591] ZOOKEEPER-2623: [ADDENDUM] Forbid OpCode.check
 outside OpCode.multi

ZOOKEEPER-2623: [ADDENDUM] Forbid OpCode.check outside OpCode.multi
Individual `OpCode.check` will get `UnimplementedException`.
Reviewers: anmolnar, shoothzj, tisonkun
Author: kezhuw
Closes #2104 from kezhuw/ZOOKEEPER-2623-addendum-forbid-opcode-check-outside-multi
---
 .../server/FinalRequestProcessor.java         | 20 ++-----------------
 .../server/PrepRequestProcessor.java          |  4 ++++
 .../org/apache/zookeeper/server/Request.java  |  3 ++-
 .../server/quorum/CommitProcessor.java        |  1 +
 .../quorum/FollowerRequestProcessor.java      |  1 +
 .../quorum/ObserverRequestProcessor.java      |  1 +
 .../quorum/ReadOnlyRequestProcessor.java      |  1 +
 .../util/RequestPathMetricsCollector.java     |  1 +
 .../org/apache/zookeeper/test/CheckTest.java  | 13 +++---------
 9 files changed, 16 insertions(+), 29 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index d3e20eca205..911583f9fc2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -50,7 +50,6 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.AddWatchRequest;
-import org.apache.zookeeper.proto.CheckVersionRequest;
 import org.apache.zookeeper.proto.CheckWatchesRequest;
 import org.apache.zookeeper.proto.Create2Response;
 import org.apache.zookeeper.proto.CreateResponse;
@@ -355,10 +354,8 @@ public void processRequest(Request request) {
             }
             case OpCode.check: {
                 lastOp = "CHEC";
-                CheckVersionRequest checkVersionRequest = request.readRequestRecord(CheckVersionRequest::new);
-                path = checkVersionRequest.getPath();
-                handleCheckVersionRequest(checkVersionRequest, cnxn, request.authInfo);
-                requestPathMetricsCollector.registerRequest(request.type, path);
+                rsp = new SetDataResponse(rc.stat);
+                err = Code.get(rc.err);
                 break;
             }
             case OpCode.exists: {
@@ -655,19 +652,6 @@ private Record handleGetDataRequest(Record request, ServerCnxn cnxn, List<Id> au
         return new GetDataResponse(b, stat);
     }
 
-    private void handleCheckVersionRequest(CheckVersionRequest request, ServerCnxn cnxn, List<Id> authInfo) throws KeeperException {
-        String path = request.getPath();
-        DataNode n = zks.getZKDatabase().getNode(path);
-        if (n == null) {
-            throw new KeeperException.NoNodeException();
-        }
-        zks.checkACL(cnxn, zks.getZKDatabase().aclForNode(n), ZooDefs.Perms.READ, authInfo, path, null);
-        int version = request.getVersion();
-        if (version != -1 && version != n.stat.getVersion()) {
-            throw new KeeperException.BadVersionException(path);
-        }
-    }
-
     private boolean closeSession(ServerCnxnFactory serverCnxnFactory, long sessionId) {
         if (serverCnxnFactory == null) {
             return false;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 4666db53ff3..961948a9ca6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -806,6 +806,10 @@ private void pRequestHelper(Request request) {
                 SetACLRequest setAclRequest = request.readRequestRecord(SetACLRequest::new);
                 pRequest2Txn(request.type, zks.getNextZxid(), request, setAclRequest);
                 break;
+            case OpCode.check:
+                CheckVersionRequest checkRequest = request.readRequestRecord(CheckVersionRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, checkRequest);
+                break;
             case OpCode.multi:
                 MultiOperationRecord multiRequest;
                 try {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index 27fa4e2dff7..c174fdd1e2f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -295,8 +295,8 @@ static boolean isValid(int type) {
         // make sure this is always synchronized with Zoodefs!!
         switch (type) {
         case OpCode.notification:
-            return false;
         case OpCode.check:
+            return false;
         case OpCode.closeSession:
         case OpCode.create:
         case OpCode.create2:
@@ -352,6 +352,7 @@ public boolean isQuorum() {
         case OpCode.deleteContainer:
         case OpCode.setACL:
         case OpCode.setData:
+        case OpCode.check:
         case OpCode.multi:
         case OpCode.reconfig:
             return true;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
index 0445bbdefff..3be43c37e30 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
@@ -181,6 +181,7 @@ protected boolean needCommit(Request request) {
         case OpCode.reconfig:
         case OpCode.multi:
         case OpCode.setACL:
+        case OpCode.check:
             return true;
         case OpCode.sync:
             return matchSyncs;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index 2798dd789d2..ef01ab32242 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -108,6 +108,7 @@ public void run() {
                 case OpCode.reconfig:
                 case OpCode.setACL:
                 case OpCode.multi:
+                case OpCode.check:
                     zks.getFollower().request(request);
                     break;
                 case OpCode.createSession:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
index 565f2778b1d..1d7e5c5c37e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
@@ -109,6 +109,7 @@ public void run() {
                 case OpCode.reconfig:
                 case OpCode.setACL:
                 case OpCode.multi:
+                case OpCode.check:
                     zks.getObserver().request(request);
                     break;
                 case OpCode.createSession:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index 7824af5cb54..671d328ff43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -85,6 +85,7 @@ public void run() {
                 case OpCode.reconfig:
                 case OpCode.setACL:
                 case OpCode.multi:
+                case OpCode.check:
                     sendErrorResponse(request);
                     continue;
                 case OpCode.closeSession:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
index e8f41e02384..5332b1aaea8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
@@ -147,6 +147,7 @@ static boolean isWriteOp(int requestType) {
         case ZooDefs.OpCode.reconfig:
         case ZooDefs.OpCode.setACL:
         case ZooDefs.OpCode.multi:
+        case ZooDefs.OpCode.check:
             return true;
         }
         return false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
index e813132739a..0e2a1a4eca4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
@@ -77,14 +77,7 @@ private static void checkVersion(TestableZooKeeper zk, String path, int version)
     private void testOperations(TestableZooKeeper zk) throws Exception {
         Stat stat = new Stat();
         zk.getData("/", false, stat);
-        checkVersion(zk, "/", -1);
-        checkVersion(zk, "/", stat.getVersion());
-        assertThrows(KeeperException.BadVersionException.class, () -> {
-            checkVersion(zk, "/", stat.getVersion() + 1);
-        });
-        assertThrows(KeeperException.NoNodeException.class, () -> {
-            checkVersion(zk, "/no-node", Integer.MAX_VALUE);
-        });
+        assertThrows(KeeperException.UnimplementedException.class, () -> checkVersion(zk, "/", -1));
     }
 
     @Test
@@ -96,7 +89,7 @@ public void testStandalone() throws Exception {
     public void testStandaloneDatabaseReloadAfterCheck() throws Exception {
         try {
             testOperations(createClient());
-        } catch (Exception ignored) {
+        } catch (Throwable ignored) {
             // Ignore to test database reload after check
         }
         stopServer();
@@ -131,7 +124,7 @@ public void testClusterDatabaseReloadAfterCheck() throws Exception {
 
             try {
                 testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.LEADING));
-            } catch (Exception ignored) {
+            } catch (Throwable ignored) {
                 // Ignore to test database reload after check
             }
             qb.shutdown(leader);

From b2ed7cdfa93b4a829225391806db919ca546a5e8 Mon Sep 17 00:00:00 2001
From: Jason Deng <jasonwjdeng@qq.com>
Date: Tue, 6 Aug 2024 11:36:12 +0800
Subject: [PATCH 453/591] ZOOKEEPER-1944: Fix incorrect 2PC diagram in
 ZooKeeper Internals doc (#2177)

---
 .../main/resources/markdown/images/2pc.jpg    | Bin 15174 -> 15775 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg b/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg
index fe4488fd9d8dffe0d17046690ecf46c8f45fd690..fcf341699bd028cf5f04b28102ac3a1a3915c42d 100644
GIT binary patch
literal 15775
zcmeHudpuNq*Y|dakmQ`>RER>Z<WR^IIVDY{2r-r9Fqnjl!Y)FNlXGz~<(MRAa-5ti
zl^i0(FwP<~j>F9CdAIJv^Ld`<x<Bu8-`D$j-hb}j%pUt=&;ISb_HV8AUEj6Vu)eWI
zfnBGK&5QvyHUKb%UjS<ixNL-Ty$Jvo7QjIO0Ja0{Y(fAByvGK=fN)oU^VdEA?1%pX
z0LL@7|2X=L{clIv0-tgGZ69dg`XXxqIC{<n>x1=n!QR?)<j`-xQ3Epz&aK(t@oQh<
z*Y2)fndkvLP|7)bpXbRu%^-;N77*MHw6g_ru<Zlb1=%<R*;p+A0=}bdY`?~@)8G#_
zb`H*MT-@7vc=_NjRP2Ipor8m&lVjVqt;?_l!p8wl!EHi&51-@`K7WmSpO=XGgShA0
z<qS$1MK5$w<d0mx9n8ZkCcaxjQenTM(t(2-np)aNkLehmGBP$XH9Kv2@sgGGWgA<^
z8%{T!U0mI~eSGiu;r#E0JPZvBe-sfJpOBc8obu#pYGzh;PHx_d{FkL=<rS4xZ>npW
znp;}i+TXqZ(B0GfwXgr%z~C5pd}4BHdS-Txy0pBqy0%W+*xZr}ex8333;z6zWdB7j
zL0B$!PEHO^?k&04*!{Ky7v$Ww_b`{x$@ARTyoC3uKiDo}5cj;Kkw@;x1&ZkP+g-e3
z@)~0b)Gg6|N%lVzEcjoN?C*m8hg?H|A*^IugB^Zzu(QKU#Q_gaF3zpN#m)6=aQ}5|
z|225F2H)QY3!a2+>r4)gZSb3KJJ<HVANwEgu!do^+|3#Uc5tx4%ETcEAOQ$c%8Ug5
z`HhJ0r1@hPPG-?G7{+C^_Hp{6%oT=RJtdS7wu)xA8DbpAC{W!8PyJ?A6eINY93Q8B
zcg(d(aUkF7mg6&l`JIsrF-jFfyl2h5A9Q^h#6M@2X^V4Zn7qbW@t;PDT)u+o8leR#
zS06fr)!<|S<`q5JT9zhQpU?9XEuA8+2P^c|Xex^>MFKWM7=*Y!=LpWW*`DUF*iy)D
z(*LYFe$iYqIpvy6eT%Cnf5p`Bg=4vR_3W#hLZ%-_E^{wxiqdB3*I7X0)gUS89bs49
zNeZFG);KkFIJWBfjE;R<ebEpOG<id~TwLAjU^hg6GN`*-b*$o+oqMNBjO0GCTguZ5
zb`am>sBULi0~@udnaDkRH*`As234UvDxX%_ex_TN-Yi}+fO5+D!7p7YnKV3PHa$z-
zNS^ib)J};`f5x%7Ba^5LUMCG&kFU35@nAXffxapZM0KqQgv+XzcIoLVRP?9&tX1h~
z5nhN^qYj9eMO8d0z5{%`HesNUvU2)9uTthe+>op<|JvFrk9wFuJpB~Mb4<J@>07qj
z=7hdvf5j)07Ik!XU;BmN^$UFy{oh&^+`nv#Tr$`vz(H0x*P3=HXe0AJ@^HXj7Qk6a
za~u<Rq!XLPjn{MZrfkwL_WM@Q?yM(w;qEB203km70@r>im&K_tlbVc+6&XwBxSYo|
z#=Pxi6E?)rXlrY<Od$hFW&w{H4pG6T_YJ!+#GQKsZ8uweRk!W$^}(d8s~#_Wb@k9S
z^8;6g?U}iEaAcwK``3wq%J*q0RFk&^ZicQ0x${vKX<#sLq#%1H&V15L>j(4pCcjpj
zYKe03^6Q`1qP*CI?@T+L_y{1?vROc|9*!%}`T{LIkm^m|Hr>iM44$DLC&qg2?@qHU
z=`F9<_fXv-_9J&cVZz+eOJ3OSy$iJ_{hLt0bRG>43!O(<Zy|(Af=x20aYTzz&ty-9
zhjL5lcL&$a1X}Wt?UV0Un3bvqO;dvsV#e373W-{uJfwD$zdc}wUUi*7s06Sx<Lmh7
z+Kf}w>DV9{x54~UDr3-MxG&0AUj5s^u&a)5Lvop&cKo3b3s+b7_*Xq2(lU2Mh7$aG
zSI(c<Ci0Ir1gq;`Q-v+Jpgbx-Q%V3`7{_VY(ZnfxZ*tN7hnQhv>1u(!4GU13w`mA&
zU;#y)=-5(xB(aLvhz+^p_^FDrt)YY}XC?QuRdFEa%gVcn)#agc^~r~OwA^tA%h@(X
zjYQ6|{a-e2R`<Vf<1Y@qE_~&YU0)w}ElgBRKGxvn%jkHsQQ(+-|64x<<s6Bf)&~X3
zt(~JdN9t>tVdV@JSU_muvv32OU60>lB$HZ`)3uuPy)b$|>$N=h>=O8*qddw+B|yBo
zF9ph7(Cm5#oCPQLSB&>p{tnhv-c?w+%2bdW$&6oyc%P0Z(Z$!WO^ac!id+k7t7wT2
zk@sGyx{j?3$39I;l&uZt<e2TmlMs+Z&?m%>Mg4;TR`nPRpI__<JdPZnWKK-GizPqa
zf8$McIwj8Fep$)Nd)WhY8OB~($k<GPCEbwWS80xVL=bsB)~hKc;-%D8-f{8pY>mM?
zq6*=9M0&38#*Nz4vHl6CyZ{6<s!n^9_~<dikJd%Dw<f2w*x@py?6K&>Dv~#D-_UWr
z8(3rFd|l#fd-BmwAM-;~{k_mGU;b~)vUQxB)$`9TO~Y+wanKQa=rf@dY$4)p-LGRh
zxp8Q#KGo}Terev$9`eO)Y;z7qmpH05*p^P!$RjA{7b8aYf2ngXM7~9_yOqs=18$@l
z=t#fH?)CsI@9*z(X8U>jGJ6>*)?OcP@{61=fYN4bJkzsWzqm@C5*!?~ZF}6vsU&oC
z{DkPGODA|=!jaH@9qUI>2XdPV(HSw&+=yVG&ptxno9Rmy7vJG`{8O(NzWj==tgYFU
znsUixdc<+e$PADfsq{bHI9R<~&xIH>1j7@^5c69rr7@}6O~_(IQ|C@hkPHnhs7zP6
z(A+S$+rf3b%6}qtbDOJz*pl$%i%Ub%K8m(Jzb|?|JewKw8oY7QddZLl@O!fWZga4U
zmom+yRk47{90a8wN%5&-?kd^|lA=J!){0=2vaD8zcdtdhfvR2<O@u>|)6mXj7LX}A
z)=8&gSwP2W<k)L)bQZh0*Fl;E5XD#kqdaS_8**9?ue2w82km;Tmtp73`3`o4#n1=~
z5M=?Q&umEy;pH_3<!sd0qTuCOA-AJFaxR{#`!8RsK9wS_EodfPxfCw7-RZhIY7b~}
zDe1K5&W~>_%<N%*WRonqyuX5uf!Z>pY42IUjvr)1R1jY=Eo9org9U7F{ao)TRyKV$
zO2vyAkt;4WqGf$)Y3ak;*zKAt!$I4Jphi%f1-N#`kSfH3Avs*+k0vA^15H&nCEgR5
zSD<?qZA%HSLqZ9T`QHx<wm4V*=3o4FLHhCgQlrNK_Yw85JdOo8=e1x;c!&m!C1APp
zqoBhqph<xYMm8X2_v4#OF$r^ncM|g4Qd=A(!#?+$#}qy5QH=VK*x^oS`1G>2qVg*`
zWmO;=QQ1n0tUz<)vM$mJys05)XqQGk4Bu`ZO4^yn%+ND>LHh9s(c<ca__i+|<DzOr
z>(zU6Sb9F|V+=0<+V@&7G4pZwwQeF+Ev9^NyBkq_g%lwK-^n|)gwCvOC={AIYpQ11
zoPfK{*BWmAruu@rY_~4Y!*xL(sE5w*Sc)-kBUV`zQY?+jQXsMY>6E#S*1^;{$*=j;
z#LcA1>TVSh3Uj%kDMKZ!eF5*I5Ig$)MXeE9-~6Uv8ynO8Jo+%ynl~=Nj1Q7V3<^!H
zt+%x|_aTO~C6mhU_;n9&nAiWj8ZmM-&$Db_3E%$F!(RfA{S{HHskKflU>gi@!JnZ%
zG@@ZY&18*(W;6B)+e{Q#z0;EudD(B+knfY;okhI_^oc_G%n^ft3f@|;*oQyPCZsQX
ziRe9F(K#PUOhnOi_|}S;Z;0244{a4&&=0#@8{}z+$D<s_P$Dzyl}@?Ey$^He27f9)
zd3xi#x1^pB58tWG-`E!uf1CaT-7Vs0X6u>5rXd9NgWQ_f0T!?p%S;VWCKI@Sgbf#!
z4?P->QP3(=XfX+}tuf7UijkVU_WRWdA!Ss7`9{i!$uF%x1yalqj|i2{ZJpnun$hLr
z3tzo&G-%SomT<BB%BWH?t3myQyCMTNFXOvQc0D*E@pRHEG3)R*<&{ce+&2&d3uQ2(
zP!%$25*Dw)cFAhwJHQP9nrDIhKe*+8o7=z5?SIMKA|X@o5B&Wfz(UV242WAuab8FC
zt%@=pvw-F+Ff-~Vtr*lDV*x>`EMUXcgrV8Vkb!qkDK`_=$s`t#oET_}{@6fS>nNk+
zf833PoWRki2#OVAh(snbMELArmk|_1%HZh=I8IiU*=J!QdBcOhHM?Vnwo*KKihMvW
zdF0&qwH>dF%_an9UzX-uG!CTj<SS>fzCw`l#vT?B0(+hbGU$$^?_L3!2l@&&NktPO
z5Pu2_NQht-vw(TWE*7woXZt!5-ITw?_~=Y+p5Bm5oo*q~bmsWomiYO`Na499W)pV)
zvVojOT6WJnvH)SW_g949Zt`}(L0=B+KAc%Vmlh1IEZ_@r!^yfrjTX61Hy)=W=p6GI
zjvKOm3^~X-C7~*4MB7oKU1Ihkas1WdW(smC#2!Io!$X{k3{^FnE)t5U3P&zN4`8T0
zNI$a1N$q4v^A`p6Y|0Yo_h{NCUHTHc)uhhXl%|;apUUK>>yZ1FT#IiGr01{hx!C{%
zRBRb>4u0?-_yeQpFyn1GiKg^AAXq@y3IwBPsN*Dz$*#;0I^yH9{wKwO<uxp6VR_BD
zWBO=kM@=rsN7FYl@uec98SpA4l|k|>;9E5}^h9G2s`|09hX${QvNOYs1(e(tVE*P>
z!Nm3*#h1;*C^3ty0%GX5Y3*z8D2Vy~A{t?hj}jI!j*m#5*_oDuS<n5@ee&}Zr-+TT
zSEXXcu$}x<Ye0JmRt-)|<}2iA2~q+%`kW}yvsTkxxY`-5g9u+Bmr(rhdS)+h2Rkgf
z4jo$d^~!TizAKxD)p>foEP6O8VlA=xqry$}&)a1a-9Gugmn#N5GBGpz;<x|g<v3_`
zz}UySZS?iK&_rpWm#C9hrrMhjloB`|$tSKDL!#hV$5&V>qq86}BtujidPHg}VjR0m
zWC4eh)|nz~6mEtJNIQsS3KB!nwA-s7<fxojTn8&;%&db(FSKu##I7%RvIt{UnXKJE
zOGQ|Ti;MN~9~m-{gF#s$+0>SN{XQkvxZM(+bMYMa+dp}2C3y8<0NrK*hhy550v52-
zp@;>1bP8kvMnJ$A#jq7oF+zMvGNhZ*5RH&<Nvwj_Z5pQ4x?yj!tJy~K<)7uM3fIro
zh1tl<Q_FpevSwh~51ArI2f&S^gdqW_?KrF^r+r`kTIfHpo6Ho-%K+jL3C67r$T+u}
zstxU|39+pUF`)U4&Az(eFE(OAIJtw$rMnweySKNkIVt+Vr7U2~6>Nl2b;V-K4S*{G
zkj<q9b7)^Z)b$2xhu+c^pFk$*a3IG5o=#3Ikg8(7wRyGOy`)C_p$p}7GM@FDKmcrT
z4|rGrpE<O%6BgeCjz(F)GjQoc!$;-=y{*WW14Al@!t<aJh`(zE6=uxW*6aByr(5>C
z(gW!8n~J(rcZo`8w?I>gq8Q}gEDwDhYD7|ZSu-@n!{Pg^N0x$PmpA-~gWy%DeOa%w
z%xo=ynYK<3U_M>i_<UsPXFj0`5{NrL9AMIp<O3(&SwIAG?a)aUkjt+{EZl@l_2GE<
z11zi%IDaLC1)P!e0PR*|<>oi#P9rg2Gxk!6Xl8af|G_rwKy6cyB-LppzPK)`rD1Ok
zW#wE8_lGVsO!nL-WwFr$lieKY?KuIkhvY**ylJq<#Ew}*()DN-@Z<v>ik#Nc2mXOV
z{E?m&5oewW+((YV53<n`oQYu^g#B|0tVGKaS8_t986w!z)Z9F(_*t4DC6fQ1ZAE!W
z0}=ITv-r)M%3{}y!D9$$*T+(Weqj;rP<1VxROZ3V`~R<Q0R5SpA+1Tb02?m`?Q|t_
z=v|}ao$k>`Fwki&DSi54#We46Rm)b%uqs#0n);O^E(tX6vsHD$$K=YdJNegDIq~uN
zN55whtO9DzCh6yMRUI!!-Sd!s+<fcZj*|AnhWiS}Zx=lIQp~;MlJ}Q$+*9ogp%ijB
zL!^M*KHtS1fgH_i;Ox@l8@HILjB~Zt&8w{#YU#i8(kZsju~Dh4L_WRCu<9C9dn=3a
zZ#?<m#1oL!_h&J@Sq;YUK)0npKC)u?^Ai6F3~q#<v-H&Ec}v(zm)~9Cc)yvth2b!+
z{lajwEqV+?xSeh4G($K6+G$F#ts@vP^Yo7MM|H~CwQW{x+;~*-Ee}%Q|NGhDSlFyO
zh$}v_Feh%TV8NDo;72BP5%H$2v%G=wN7JKk2EEPTg1zj6a>O8L*o(x15-yvh=Dpj<
zb6S<>U3m^9zGVT<?t=r(TAV{iDxhc4{cRv+fd$Zx`9ZNE%><ejj8v1y1E12_gIWm`
zJ4DEq2c&YWb<<|EXrwV_qIlH3Y#TT2gbt0;x3e7nw`cp_HOf0V)|`yK!G0n?4X@mX
z^g4g`hgsls8~87{vrv)qSEd@bvN)d!6?qGMj&x<HQ+7XX+B;XP);FtB+V*Cgbkm51
z<)!*0RUf)YQd02o;qS#m1)?5>dvwnpMjxjML%h~><Q!Pq-n=;INX~M=IiO^W<P{An
z%WC^I`Ho*`F|A2|8ilG#b>$+c2)BD34Rt&z=%=LIgTxR9IGR~Nr7}&R87Wv{^PJ)r
zs%Ma~@2dvJOGVvndC=}-vXbZXi~}CsgL9{9x3S$!-rjbRgAh@7d@IdLCA}p`5@Wy{
z$cW?y5gqW6<^t+ONq;#eCaC{RG1a~>ey%U?P99dZCEiWU@O<#t1ebQQX}Xii{`>lw
zG&t3_Z5K_PN+2iKQeJ-898{jEGp$h!3r*~Np<nCF49&sByvQ^Z*gXEy<fXiY%EPAZ
z(N7J}#NitXmX3^)7(%a+4@ecEoeOEBECBIIEmpJef*@I{HbxWZtJ6!}pO#aZ?k#=9
zXnUfAYyOKyUlFfIvSxdCJsGG9s)iG5qT`Sr^H~FTfGRC?3>}IPs<X>+k(Hx1)}RGk
zH$!{x^vvO%CjF^HJlmIVp!C%p&s6h2-p+Yn;ObTm>W`z}q8~xTcmbLg8ak`E20z#m
zya@~FPIs$00P^N_EFUJc3lJvUFoYe%(I5G%1@BkX9%aaewNA$sj^i|h-U~XGpcv+z
zdv6IS&SBIbQ7l7-00$<DaF{=S0@hOx_*BYS6z$l)U)H$xJ7q;nO)my3HP=5Gzpwo|
zftINKx07XH#pXT)2h?A1Ftl^^!#SqB*HP_tLE}>T-Sp-^n0(6!a8l4tt}mb~Q{Wu4
zp5c`B1KjaYJnF^ZfKj%5t|bREy$s{L<D0Pi=l;#$BWMX2|KKdx=p<=VM_?y7I=E%D
ziK}bQ^E`Ahu+cq80FJp4EdoR4<GJ{8FnsNtgX+&XrxznAmF^CXZ2rlPJUcngxTM%w
zuEURc*mFJgiY_x-jdTkY)(H~-LhLMJ<yrP>29oLa^ko6N?3*30ISF@qd3)_^-Er7h
z`$%mG@5^UGW_#HBh{usP(X@kA^Iml4pzaI>W-8K2^)`sOLesW@zVtCpW;ajGh{bki
zpSO!5Us6o<_()CjQaKY>O-kBV{R!VS2v>XbPcmzXuE!16&NH6`oTNH73x4}f%djr%
z3ed#lA5qQuT>t93iDRCLew+1@evh8VF{=y31(g@sP2h|tarA|l>|y2;eF?^?{<^*S
zv??+(nkzqdE=Zhm=GGN6u7a^}jE5JQ?(wyT&)n|GJA>u&c$LR5d1Q^a7f^5jTUynG
z9rU)PSS+^L`SocKIp(^5+}V`>v18DFb$k%zEalLsf|^$0@sfZ1dh${V=5ebyLf!%P
zt4jKOE)J?hYWrK17%gqgD$n;d8e<hRhMj-+yvN$Aq^zX()%>%Xo}bqv`_|{R*41CP
zIn|<c6r<zI*-X~l;J7`FW-?A#I5v(Nh?*A{58B(a`VA~C{~>iibrEJxJ35}ZY(DAL
z%&tkYD8YO(Hos_}FIT+%aY>{f`l~HthJs)S3$F#zoT;hpYatY?oT5QoTc@35*<7ce
zXzTEBN!KeMGoPXS+y|4@B^fe0gHuLNN3fNOzn2|&i^yC7&KrsR+N_u0h>;5ho%b!!
zH*oFn3=7z_EVN!FqTh2fq|{h|qA>j$OuO2%SitPr3VRV^sO99wlg{z*&LvIF&M-8^
zw|DdF#HM%)O2F{?^1D82og~j+F=_ho8}5WvO_<yAR{bSbPT0!a!l80yg=QyBQIR1X
zr(fZ(A4)%qyDKH0VO$lnidp)L^`4gc`^h^=FfyfpGc$T{%pQVa0gz?C(fA0`D~8}2
zIQ9pV|BA!;x8iUYB#c5Yf<_?qu2o`~0bgschkItXkmUh54j-r}3v=hGbjC1GN)$!I
zA@>jqpxj<$%5aAxDIOpkJKx>nyv!)%XeE-H2%9pQdm)F~V?rf1)0Nc3)=f)$v5LvA
zP7k`dmL_`&<AO~;wEKkYe#iO1Qd`#gRS-Edy)T~L84dkW9L{(g@CTe$+GJqGI5DWd
z0LkkAQ_%*ZkNI~%Tsldqf~-1e2`u3H1Y+}Q59U|WVGPSCBv2Kh)_2I2#@zl@qWx}|
zJ4d^~+!+_%#sVHfdbFaP%d-#%Escy0v$Q?kZSFf(5GYHw%enSII_q+erczV>#O`>l
zPAj>{4I;Fgv=+$%vPx)hBp*!T1ecZ3U>D4DVXg^JS8mOe!MCCrVl+9JT-hSWVpxDn
z(WWjUl1Njf!0uhW;;%gSFmVCS)0;R_tzlqmfT`G&6`tk@4k|;j?c^eeFF+7xnuUL1
znryJ8VChC+*Ehx`*ebEX$c?0|KfaR_2moxBg1XQvcaWkW#cmW2IbkS<5MMhC!BNb5
zq{m`7OmJAhO;Rvnm!3WK`qVP|%~z~1UZN<pd|0?Sx$l<0!eokBmj?4>b~Pr6M_N_A
zv}JPa`iu8Wzw;*$aHi-q`kVJSX`Y|1agyS=7DDSOWZe83k{x$t?xkLg`fqROs#&Ht
zs$Hy~9XZnxDtqNtbpD?W<^SA52c*#5pcZsl9z#TY)SfiIKtJcQjM0~@eiOSYS5=$(
z*~N2o$G)fX556Sh{r94MZZIdVwFd118;>JL2Z>>XVv_~Y@f&r0qqI26z1Et5+XHrP
zo!*W`v$jdE?w`svSBxE*lh_-NRyQavzV*P7!wcD)F8bL$fCEk#R5L@7Gsdu)Wju$y
zj|SNM8oY+u6eKR?y#SXi0-10g;s49m8Y$LmN0@0yXHfJCu77kf3=Th5bqh>NlChQc
zS3DmK%R3F}bt`ok=k0NheY3xT@aMSLpIbn1t0m%3Fu^}}brDOOB$3+3fQ0-CJ6uJ9
z-Sak4CLZZR7)04K6CpO-hoQC%WlCl8=IioJ_2W}%*CZ{Z*(I>!mYB5^|DAhmBu~gC
z+_JA*PD6O~Pb;>OVv*(RF(4+Fi3gpI8#e2U)l$|U&NCc~el#d`|MV?)@ip%#(3R4)
z)5R<t{pnXy?LY1RE{6SJ+edoBif4l|^BH*k2O^pvra{D$1oQ&Q=+F$^o|SwJo(kd)
zetjFY@(3qkX7ZHGg%8j`-vK`}&R~UPMZduz``-Jw&M4w&CX4}{I+{h{NH+nlIS+D?
z0L?4FVtke%ALk~i9p;mpK_1qWdg`1Z0d?H+P)ybcJ1}jU8JB&cq|90Z_Iq&ijnELo
zpqhpqLxv#)^-wrX(k>k4Ea7yIdusp1uX=|%nOXehW#|?lQfbgB8Qd=+B4Xmo0(>oT
z1ZX>*B6oo@;lNEnMKNr~kOFfVQc+C~zxAxl&gaM;>UONDsl%<By`KN6sNQ*ebvEOk
ztLkK&=hU_arvoeahu~EhA0a;Kp$Kw}EDNwYGNZqbij64D^1r(Di4>ikVcvVSm}Byk
zr?lORy@}gKy01=fOvX4ud}eg*6B-MKjnGbNdt`ac+5RTK!)~d@PdSsHGrV}spT7<G
z@gnDlgGR*mOEC{GsBe6d+%??^{RWGRhH+DxVnYj|5E}1R7W#TP230i(6U(bAzZPoB
zD7PeMAnMFs6U&3%HJs`(%{<DOOiYY(77Uh}MTLPBbL7DKn02$g_!u_40>A51-i#%V
z>z@CiL#nAavEgQJsV=uGUuK_Cm7`mUU=`|!%5oC=aIPr$TmU;&vno<l&yZ}#S0o~^
z>xjKwr^}6UxZi0)e{Zr2XL4-XvxZ>gp3|j@iM;Ph6Kd`wEnelt&wW<Te}2y|PBis^
zR!VeSd|`R%gpcm!=oR@(sfA9Qm6f*!zn@uGH;ydScwqSMMB~lvqPOp+zvQ|L94*lJ
z)8P`ba8oI>`crVE(lddHkpBk1aKP0>+OR{CQOu~v;B1HmOoD0-Bb>W-chMbQ!F?;!
zTD*)2+7PvUErVLL;6o}|oX>lKb8hMnlBJ{*qJ5cut&;YiD`R%%`};aOI%AwY0`p`(
zuW764EglnmW^{Rga62fbzZEPOn74PNCXm}wsPwUEe4RO^to?3K(*6fpRbvnGIuzF8
zR5HQR@69i5&_g<{hi3OYK2_TClWvEpc`P77^<#*jA&F_@3d;1t$<bkpx=U~fwo@&l
zE)e-JUe(Z;@;R~RyIpRUx5{!ea=?>6d#UYltKO{01&v2yT5jW-AWcP}$qsyEjpS!2
zQkuz%5sO^4WC4EHo>^Ou1lzgPyiho2S$?fD8AH1-Xe4!}v~!|)U+|*^<j<E_VOZr5
zL7Z+5(ot_A9x526r#Qy6Z1%#Lw@C)2A5Y9`9X#V_ZH<@B*Bnl7nX;K~s6W!_p-@+<
z`u%Oy#~l4Q3Vt3z0ULu9y7bOxk>=V0xmz4mshZ_j6<M2FYGT6syU}7mz>ApXC|^$X
z`?Z5-r0)lmyaF3tkvC_!(qG_^jUz{?R&n`*w6jyHmZm*>;(L*?d(C`~3Z(mr<YL<5
z_VSh#M;fD#Wf@3suz)rMO&KPPav6NcT|vS$HLI_19}l)~y~%Gad2O&FH!BAh-_yJv
zq1nHN9}s_+>MCM__`NhfUWNRdVc-EuC&c4S*Jm80VKN!2l(iDFL^+ce3v^-?T3gG`
ze4@;%T3YP1`g$=UG#hklikYZNnY`hs*ovl{7P#-QzmjT@_b9;pnlJeQnF~|kzpx`Y
zffjWoyhZ&J5Z~3~BmTu?g2(FA(gPc@3x4OgXDbqy>}^_oHPk$p_LUj!@21A9U#d*L
z5*v;Y%y<}CcInl#<i5{Rb`cp<rd^kEA1nE9->uTf{u*Ujaia4Cx9CRmRvrSj&gTI;
z;LmFWHeA^nq1*R`9?!VF!L(^L^=!K5q4^ceOqW8H`MacsFIH2Bb@v7zyX?P%*ZVQs
zCdvr6__k<Jcoe&!OZnMD?w?;Ke^PD>l4>BU8k$y{zwo=yXFSPsVBfTWRH%>MZ`_e<
z2meeK^v_`*xYdEC%%CGjGhocHB!&|xrij6UwI>w9g4F2ZE;q@PC_M`iuc6uZz`Z*#
zc*#J{1Qq|ChaNw-czge>S1|bHZ1pG0Mo6gtP{UB6>m9#@t7=d6c;v47NL)Ru>~=}S
zGCHZ}NIv)e)H^Pa1Cp$=_^la=fU`u4X$Z(H3)=UY8I7DtqxC}@a2aVL6-p<L*)eqC
zQUn)V!MI-nQZ>M)Dw-b)IKdD9mkn+WCA)3F{7#XKQb0{H1f~@K+Z_M(Dn+wHkSMX4
zxCywDXnf*urO||;42FX%Ko5~3rUvbgy^DNL3;#9UxH7~ONI!KMY&?M+9Rnqy0W_}$
zKMF-@dp?#R|2`;xYEZR-;FO2g%yN#F*#BsrE#jbetQ2C%;>N7b&hTdjeVd|*V&|*B
zcW`2ME9RP>Q^(kr6`Z%oO^UZV`1>)dR~vF`WM*`Oco2zL=2=fy3%K6vTd#bQ%Koy`
zYm9kvg<hfjdq79cF-t<~f${kLqoqP3_~{ggXDe+pPRoOMCg~;&Bg$e_fJXtXXiPi0
zeCS@iwl!rsO7G-oy<7kJ;-?SqR8^*GuD;SfU#G2}^u|9&sY@n*SJDHh+~rlwR>@+J
zP*%j;0mA%Y9tYFXlti$(0_lw2+zr9FH1>^3WC3c*i<?RuaEsxcy!jt2zz_kG9$i^&
zIPElvpe&#U`k^o+%z5tU!Fk$_t?CIt<A7xH={j(=wtb89>}-dr(T2YXL)UT*&c8gz
z!=y(BFU10umKxxC)2~uTxLeR?;>zJI($icr4nhv+;q!W#>EMjx7X1o$gc%p3?pLAZ
zcm3@_A7Gk9bRM>%U#7_BkMnI*Y)_W3ZfQ{OXIKcmOn=)dR`SBZgwMI4<z>q)GimFt
zt?o;Z;LH#vLA-vHWr&A^ekrI&R+yO;AVcOiyg+r1$c)tuJhn%`bI|^C7V+cqBz|ve
zx5$AvyLdkThT7!mKlT!bY_gr~AM!0c^m)mB+p^*VdH0<mDm<+or!ynH;%jdD?wRO0
z`w7v}&M-=+?*_ZHsYT3X$6r*S#fDT8&J+eESpZ23$w)x=RQ+eQ!_%x_d0D^=TOK&7
zf@WBtk0T}+W)t}g(gQ{dT=Dxa6Ts{KpRb|G)ctS9;R2_|v6MyVzN8<--U?6B)oHSU
z-1V19oxnylqDvIqI11N?)W*?6%45b4@@Jvly?W|5o~nJ-8#1cunJ=eKmAg|z<hx|<
zA67W))$B-jeU+|w^2^G0TarO(@CR+(r&nVfIal8Ea#>)keBBO|cbA@SwG2P_s~op>
zgP8`p79MOjU}gu&(lBKH*r&=UXDr!%f4^1ah_#dr+5AQJ#p`uq=Xj*8Kf!Kic9Eu#
z!jwY6wPHCRJY)nf_+Rw2heR<~+teb!wPNF01S86Xp>q%7ftwGEd$y{z+lS>?Kpf_;
zit4k@5bA(p^5B}DU=7T~_jSP!7xrqwHegrzR&lOL+Z6UNwtv&rt(-MnOU-hn!Rq(W
zGmZtkD+inNh@;8q6%QmYkrLC5+z|T@T}6S7D#V$=Ah^gal?^Vb2DyWchH$#`JMkN7
zZCIb3f@l`lLDL>3gsgZNOkbetK|3fJ>DS0I7a#TM+F|a^WJcRHaeQ9J#`^jRB2<#z
zK@l&W2}BaF710z4^RTgSPS9)=n~(!?P3LG>RGkmuT(zq#dHq~E8@pXvgt=~9@?f=K
zE?MxRwDn;5zg7ExS+xmUEzimujZ6a36+LJ^?!4eMPS{S%BNN(mrR;^tudBv7_yh!S
z!e+IUhj(wL-<xdS)>gDXMDJ0<<pD2chlpL$i&j&_tT_t)KC!Gn7_LO!6A*PB;jO8!
zL5btCtf)?74Y=<)Kg$kh+=%Lk)iZeIC0RMeQE+(bK2k^@2{ztnP({wCkV(-Qd=!xp
zt}hJlQBY=%z!Px8SIXlwdHEcr4}ULz2<4Y+hMgQNY!Qnew&RMQwBI+RzV~WgFJl`V
z*~l`V7d9M%69NKZbs7Yb0RMc(DPp&tYR>nO#%Gtmxk#FXt?(PKVG7<YI0wcJyW!B^
zEtKn<at)M*epDeS#znz3#Lx=3^+i^h$^xQS(VPx54oZ~u@H$<M!P~YthyGT|du+g<
zPsG(K{(XkZt!`L_YE!xEk=eoo6RI^sXnkz5KSE7kK0t-K9u>enZpOIeMSiDuGP@!D
z_@`I>HJ4)XzAkYN-@XqW&tBUMtgZ7ll;i2udBb)Q2(Tn0Xh-?Rz=uH+Bsj;8Zmvh2
zO>JE{u^CWR^0d<4VQx*QC)spBYbM^sHsSNd()S_<N1p|0H|T(kesFGGzJHVwOL*pT
zeonjwA9dj~R+QGz-c;lJ`RN$HA^o8LSZzJtJw@9uU*pc57q8?^9ZXU+HVS6b&7tkn
zbOZ)7D%vl8xd9=-P$VO_pPc><d+0$e=s=jM+Uue+fkn>`-|b6HGi(d&I}@*ts#t=J
z3Ju~kzqdsGIyH(mSusXm27}<QJB$puP8Eysx~7%?(q$bl(r*@kb@#mLKb5i9Ywgjq
z$jejCE(3<5&-k$eh7d0bxj>+n4mFZEA=we)1A&Kd%NCs|h9((#?g?*M!}>Y7RbG=d
zI|Sb8_|1A?msC{zCA(Fz1}B;*{Xl>YGlOAYgzIS39;_JdeB@KlZT3boXP|zcfPh_n
zMVWu;febTy>8IJLHj*YAr8~V>z5*iWjs9>GrJxt8sCi^`6G9s5Ohq==o744&+7Tk|
zjAMm)2_i(d9))gAyWDW~tS8Hw<!TM;_@%2_-EWz*XgR2#R4NuiN7MY8B&~ADEI<$^
zeu1JLv4?7fe}%g?AHOC=zh_rq#EBjto#=Y<dh&a&^t3DI)nK-z6o!Zz#9KjGUlXLI
zjNwDH#TpRxRK-W-F@`OwEP%%(@>RgzJi|QKB_qL$wGBJVMy{A08p7N_5jx_s<K^w!
zTY{9qMsIyVhJMr-KBl~$?`&ElQOF0q15?@K)*x5bqq*V1K<S){%A3i#nXxgSd@7!@
z@wn|iSvxL-ZAC2-_U})uA*Egoth9DJDdHS%*{rPB=O*>8{zFZ>Lg9-z`7~6LxQX3i
zNpsKAMs?eqkLpK6Q@BOnGi+ewITj#COY?edm>qDMIvu*wDeNlAl~OP;yPhnr8mJih
z)%r|z>f*VQ+6LFXO7W%y*CkJR`yOL@_6XZ3C<tHrC0fE46;0yvCGz3)vAh9-U-kFn
z5}K_u)RWix=6_h}i*;A@+zo4g=jw4SejRnh_LFq3nPbKECe2%={&~%dw4?2CF*FuJ
z;0WznvVuLUx`oKb+qiY(uDWC7dR>R!>7Hvf<(2m=&hni&o0JbX-8B7h-TTyT8m%4R
znYB=;3-NGM+yo+Rt)qPjvbc6jO2z}Sy?1L3`oVM>3N0`=7o-rpCSwuYem%uQw6XV)
zlb~kbHwWXTN;!4mCM3m_6rQTsRBt(&5)J>J;sn(?^af=`R=CTDc^Z0u?aRtN*U|L7
zRd)B3tjJeA$oK{84)0t0?1N8Mciazp%#fohwjjkBN4x7RU|TnbCD}D{>PB5x{Hi9R
zq{OlEh___+ZLLo^k^IjifMO|p)<4kQEu9u+j6$8H@}dO=YS~&Twew+sB^5O;6Z1NP
zYHdfE3=I#j<H;VT85}=ywti_Wc-%VSWX379iu;?SqEnA{`W1MiyH;@~Z_xuk8o{#q
z@W}GTZT1esicxjv3vi_rlAh;<b(<%h>PD08vU{zL#@KnYeSNZg0ug~g5JyYVVuUqw
zDz*)^jmC@Ra0xm_LB_749yX}!#8l>Z`M<znOzL|V@@jkJtCkk5$b4p=g&}6QU&nbo
z-BoNk7sL*05<cilA4yyfL*Z_AkVHl5>%qNp=vi5@?w{DJUsT*R_~n}Ka%J7q{5o-`
ztl{0y3O%)-`;$h-Ecc3dtPbI6a@LLZ=q9)z+bkeTg9-iJqF^;2H4)ss<`J1xk7KHO
zY8W!@Mpc7{&Z%O%u(-WR<O=Qh@7aPSMi+QGvuFhn&ppc0kCqgIkiHm>-rB%H&4v!X
zq27?)(~UlxG1Z3|KG<$jQ*K)1?&*=yeJ@adc;wjgxQBBxSAds*{sF20LwXy9*o54%
z*supCEhBk(7S}iT1nS#;`#5x{$oHO%Ylpmhnva==s@e2Gn;Vg$x6UD@NHWOLTEY%U
z2t&b{puT7*t?~_<wB|c&M>5ckWA-}JXDDIMnMrz-;gR-A^R(LDR9)SRRzmV>a-Spv
zzOH=EfkP^9CcdJA!uuoY6<Q!15~d;^?pgkM9bAwCMVjTs`>hAU*Q=a74-LqpR4=`r
z{_xu^u>-`>coH8&cN85qB2JT{3bzq<R^Y=%b`u&)a8br@iqkHB)wtIliOFuzuGIcb
zZyB}g4gJ(PBNgu><?hcTzi?H}!<B$-iiEXJ+JMLCVlXIxMZXPi(wC(MlA_cWGplwP
zlJ9BPmR8vPhL=x4);c{=o`1yO`u<?yW)xbT!OKi+kO}GxI@Dk1G@7<x`*XTQ#~~#9
wJO73GkvQ(~!jZv&x&e_+`PZ>$x-C><<QN0o$2Q&WBmeoI{rvO4E@ch;AK0J*q5uE@

literal 15174
zcmeHu1z42b*7iepHzGp{f`D{0pi(L#NJ)wyDXlaPf`lU_2r4QdEh$P!$RH&l-2>7c
z(lEd<^FO=^p7Wje{l5SFb$$PM?Q7V~Gn>8Fy4Ss8FR_Ezae(@=nx-0ngM$Oy0{;Qn
z2|z>D+ujBMG&KbPVgLYe0Z|-WfCl{O3^;J`2ml=LT?QOSFBNN-+jlrLoh)td=-#ok
z_5mKHgyH~${oqQ&z(s(VkdTOwfS8Dgh=hcgl$@S|oQ#Z|g_e$r{xmCu{WL2Z8wZat
z9|zYtZZ<Z4>9gm~i%LjHK=@=8WyBPO#U;d!7QrDQAt5ItXQrTF7UN{&6#GxVur&Y;
zF@VPTfrrBd;L_mW(coa~0SI^)0`S~NNB`}GgNuhxKuAPPLP`ccP(lsh;^5)o;^Pqz
z;Nyc&2Y{ag_%sBxoT4g(bUKzqTyFGY51+mz=Dtw$g+aG#jYs^pdk_gJBNH<VEAJUT
z{<8uSl2Xz#vT_$Msj8`KXkNadr*B|rbko?%`i_mQoxOv{z5AYC-afv;k3vGj!XLw9
z<DSJQJb&>rF*PkcBQq=eUCxJ(#U-U>pUNw0>*^aCzcw|ubocc3^$!dVAtxrMre|j7
z<`)*%H#WDncXm;G`$y-(0q}l3)*mPP>0C76xp49E@$iX`&V_^P1r9tKd;(5ULRu9a
zB1<<qF0qHi^cSAKE&4*jEv~!9aNE6$l#xebf_MGsXuq87?;R}YzjU%c4)*7{kN`Oz
z4yZgl8UPAx!6;A`S9`a}99!Ss+ia~WV$$WGXqu-a!Yx5e5O+b#y|BQ;SS+xv&liLR
zrge+JDHfP_GU>%>#{#u9sWA6dEP%(01tznxz$5NUn3*vQ;T0^<V5q7Jcp%mu*(Hxu
zVu6}w7%B&Pa>XtkWwuo`CoA8sFcw%7v%m;Mqb^8j|1iS><JJhY{yn|xMDkdGSncs)
zD*{da91FnHFw~KB2hU+B77;AKV8%fI|9A0!y)1I2>y;R~x5g+Op6|4}^OY7S*tMFq
zDBroDruM^!0jXzb&^d~1bM#<s#c#5DdMfQKGY5tqXQn?v&NC^o3Yq30Ewy9tenfba
zhmO&G%Fb+1FrHbd{B+K=!T!}rVy-SpaoD-;OF~G@C1zCv8}e^r=NIMf%PebobuSpu
zRkcZ`>#~e9Zv0@OV&)0q{<If8r+=z;UvNm>4(YGPJS~>Z^Mg{2<ooOCC@O_0e!R!w
zD0eg7LM-sHgjfGVX%)XqvdqgN+{0ySdfENnPL+v+NSnz<MG*t<w?3(K8NKNePs!gm
z{*a@l^x-a5z1Lq&)^)ol&q>&cyF$v9w?dQSi$InDF`KIodsv2DK}bfyTgkPeuoZD!
zo`CZ2F*sA18UWoGJ<eQA<|{vj;9+}1{>?=adx;wky3UctQvNZg1nN!`@7v~kLQj}d
zIaTOA6K_W5VpKfioi}c;!*oJq+r8PSoCS>oWyemK5#+=d=d)8Ny-rw>`Uw-P5a7pq
zbJCJ^PTF7r91hIEPMESD>;x0!rl$Tsxe3#;NPk(&bi2+Gqt7F{CADu|N;JHYU)ho^
z%_B`=^{_prd@QiE0^1@=p%5X!0!<lKAopQ`PGngw(HGdpStF3>u)vm7{vyDi3ja5Z
zTnDBdr1>k4Y;(<-VUtTemr;BU{LM0KNd&;n)Rd2v!Pkq*K9>gU?9${Fl@gESiBVD&
zy_*M8;rxGV6hJ4T=qLSHV0#C#k2hfXf8vmW5vW}MyO`4sF^$ru7CD18!MRoGXNbl%
z(Sil#<w5PpE3aP0GIQy6@I)}^QKrXrSM6%~JmB`O9x&VZt{{?D?gag&i*PDmn7f4q
za5u}w)&acFJ$D<EGj0yyJ$1poL{-p-x38bWpMnejo8uD}2*&~&A|_a1010|KDzgwb
zEI<SLKl3syP*?(LoIOyYiU|vF#Ydy5u)sx!(LBgWKxF?d1^jbG<!3uE`szO#7}ymZ
zM%GlOCtM8CQD(GTF!zDL6-=fm{rNH)G8eRV?>pVRwxGV7`p8}Vtuw`CCFX*xO;lEW
zVq@vo)eE*#JD?f6P3?6O&K6B|kk0cIq!r#&<yfL^p4G$x{=(V|Mz)ibxp|n?+6Oef
zg%@2#M7|CQef=b~d431CLXrCmhOHC8w050yGJ>^UdgOuys-vO#PMt(JkiczinvT;0
zQQLQ_Bbnvwr7l~2yddY?(RN00sS3_N{+R1AqfFO@9FCgna)3N(06n0i`uB$+WF3N0
zU4rc&SRCRky+4W3PQvFW<B-1Kal{^d9&8-8f68DRpx06T4~7xuTzO*am;JuJ;(YqG
zp{wgnSp-I$9MQhOVCtv09tHCTo8K5UZ<m*slodbGDW?^ytRA@CMAh0dZv8sAM^YNi
zyL+Xe`SzOep1ndsC4N{tWem&J5ZK(y#<6;~O*pVLUqIRV^|{A_wi}O}-{sDm-=fK<
z>zI%b8{WHa#Tx<Y8A4-G1uMnFCdph)ctZ6a-|n0d<8-Zzp?Z;PD<3HD7DQzX{FpD$
zrDFK5J-OSh`ug^eFzet)4g8lhKCjl33`<2<lluBPaa8HAA0Grht1CjzLgSyx;b)zh
z^8}XZo78!PeUlwFS8SI@&!L_uhQ5=qpBSUKc)G3E{k_plc?|8V=JA|D8O07o$JBK!
z5OSkYiSlzdib>vo*ihl_OP?D_L-PTT3tv4rg@Wm?7e+H(>$9y)XhEvDWv6$GQp`-~
z8?mRyFeSMqUk3L3Np2^N%BI}vk_%Nc578Kh#|8q-cz}*F0sXPTP`d~n_8JxH<LD7~
z?pvvDxm~~bUcHic_wCFFoO!AVgN${Xl&9YjPpw!f^cG4tt_TvC+KO<l^Z=C89&Lap
zy<xJ}I_U~W*&C-kh6i;!&D^o>tfrT(1gRiWZt;p6)g?I!CbH{-3mDb17~!N&&S#J7
z&MCRPP&>~pGmHubJ#4>@DL%VWRh))BvcL2Ds~5M3V`-oIz>OGPD(WI|^MjvuSFDif
z#2Iusxnw-%iq+?hXOmmgXyVS6>6lVxmG}>Fr3x^7MXO_hr@mvD>H#dE?7J)&jfw`j
zVH<H6P>2cK!pS%e(OW1HjH)061;K>&Rb3<0z6_86)~`ux%LkfX<QLnmM@g4Huv%Hs
z-_|l&@k=R#&QFDc<Rhe%G}iu6@T~UxWk*=8iU$@@xP52`8hFqg#=Bv^UyDKE+qr-K
z3BAYpBG7M<5Oko|pKPaLXvvcIrkIv)O6Yv6Z7f6cFhMsPMf#&r8p5!-2#b8{0qMde
z%(VkSzQZ|9UP#@tA{L0}lM4E3o8?`(g5i$VG)i-Mny5*i{On=RXhq`sYS`F@^cO5(
znvT(5mducq6?|{0bx+gE`l)_bD2tIb&AdHtq70``=2Py+gtK0^aHDm#FKh6@XNl*6
zRAbN5%gMbCC5lnm%Ey<T(gY~sHPkgUuW34a#RiA3c2|CZygX-fCWfC<Z|C~}!)-W_
zaVLFnVc&Of7+GIBflH61TmvA|?`l?cOCr<M$(<Z=G&DrdMpzOr6nmlt8t8GDhEkZ$
z%r!@M2$r=CN;_?JnCcZD1Ex-I3H|$Uw`$vi$A{V}8NK(Jm${aEq(`(D19B4*Zk~zH
zh<~E-U3+gu=d8&k@f*KNk7`N%ce#DA%iDWl1iH}QHK7*AQ1IlPLq$mBGtm);IFcVG
zNk-&uE3cDtS&jK;Ev-y`SHQ6)(q4u{y8NyH$Xbjk7U*C`7&qsX?XKDPXZj3B!P9af
zD(doNtjMq@!`Dje=c3Nt(`RXgsF)xnHy3>+Gq%Eus@B5<vN&w2<gfSg^%h*+OunPi
zMU+x#yOxE9C)ysm8sD3p{*rbZ&Y%BCLJhvW2tQp^9ymRfX&>$A!XtK(hekq|twIbp
zFW{?h0vt#|N(L|5XG?yNtam#nngBe~=ZQ=!YF2<33xNWizR3K#phvjtQ(>m>WJYSB
z;1e>*ve@rV9Mnzj>*0<4O6gXFS^9dam#*ie;V9SOCZt?xwHKZ#z7n1|%fYG<OtDCH
zLERK$3?%*Tl%KxTxgv_A+{{-(-U7cFPD-e$nERr4TdLYcSWNXjba$+LXXo9sJc4&s
z${5FhBpy-9h`m<7Uf7?~O8qcr^`Am|m%2C^>)0O)KqolLu|SgOgOWH^w&T|1_+;JX
z3AAJdQ^%(BEcA|tKwQwE<-@)09AgXu5fC4T{>&S%ZLy<{8jwLOnjFqxik}U~s#qZv
znB67>X#*ff0YaETpVGi9Z{~0!$~ug(UjX!thp%?{EencaqjOQIVoSo@R&k#{HJujF
zUbzC@o5upXGhlvQ;4%M@i9ZL1On_~6VS&|FkgXxdCpKa;4B7{}9T;Ee;T~))?av=m
z$e!s#kFOPdd=e<EqlX1b&S8PMG%PR%=GLT*1O6&AUw0h2zKq<N5zx!tVp(0)tOP1B
zi0Rc2A7G<fu{vn>y0JY&UR4H)5nG+L1B@C9y7Vl$<ug?Svh-t`ox9n*?<t2}D~wUz
zTdC+(tK0x0$+=`I#I#E=rd$)9JLs4iU3*1IskiFRWFf0}MN6F-ZF}en(*c|2j?v%`
zNTqxQU5`*)o8LaFa1xhaA7#U!cMB(98GyvQppt7wA?x?74s;u|TChNF<)h_9@xd^*
z^?7&2TwkPgD3U+@W#&EQd_jOLM((v+oN@R#7MKu1g<ye8Jy<~S`jP0?63`d0K&m}R
zY1y#a&xCMba}{;v0Vk|W0t>YCLMPPGya;N<d?IYd0kT%8k{YORfT0}=x7gBxZj?}=
zbU+?;sTbKlle}jfh8FC!OCg7nFDCwY=OVvU&5mh|XCt0ExNYha%=S8avW!19kTfHE
zQFKssDAVOra__;7`vJPAxms7~Y-ewU1AOOv@9ncr@%B5-#%Cnhv#KrngL<Hhr;RUW
zaldJuXpmqa#C;z+S0eQe3pm^aIRSJt2oVfD?AU}My!Ah+XXpv71LdkWFufl^+=DLb
zfdyJXcKekKhtCy_VKrAS%j9pj1J583!PiQ}+ehx{pElYj9WSA{5O8_ELv}~+G_^0O
z*~RP0x)tKz+=i&{smu#x*nF=M98ox@v6hgi+<YK6?mG}R@CkJTqpBs2`6T41?rJOS
zZ?aAX-Oz#^2~-zW3(hc)voHp4K@4uO3Z}$$ApYHIGmJ-D^!r~Gz8B!UTlc}+MK>go
z-+7|9+c4gDrS{f1yGPF~_vZjX)AsyvEhdX~HskgZGK<eux8)t}qb#4ijw?ewR`f^;
z2Fn8-7+SRQI^r?8!G31=0MdK!T8=2?Sb=vO1~1sWO)E+QE*T}Er^>9a6G)UozX+UV
ziKqWaO-~-H4d@P>&O=2ZCnrr*xbt*m)p4cdU$A>T>|}j;xrvN5A$wri>WQEO75fLj
zWEY3GKU?QXtu<6WGfn*$sGtx0Nv-_Hb<B_ZACpFWiz9|()V!q`V;<X*Rd~R?pD20g
z|H)BatR?-y#s$*2q&kJ@d=EtdUg1FcZ7iS*vXaPl=8b_vu;^EX=nwbTVCg~mL5B*l
zfCVj>Jn84Qc_bP<b@8*?RGiHs^XbMd-Q}bURhY7$EdUu#9<)UjMKHO*1HnzF*Pkj`
zo|f1Qx>L^{Ob{4S5k_OqM5EN5p!0lS5Hk*jJd^fDHf0hXH=%1$NLZ&fn55N!)L0J=
z;+3pJ{A~o90)p0J#4|~h%}YM{&7*+n*t$<}^4r`;Ik7;@3oKAzwU-F;#PQFIBpqdz
z3-LueJkAfE3i$SF_}!EYo30;@8l3+fORv8Y81z+B?a%OS6j~OtqXMu1w?AaNMSI4)
z&P?I~t&xr@Lv|26wEqWkf5g<-RMm}yhlI<uMT3Xt>AVUgM1F<(Fl%|#!RJ7sL&Wua
znM}K)_-G){v6K++&3ZICI3Idca$qd5NSsICcYf|GSuApHUC``|Inm(MjB^+fLmliV
zDH`daLL;5+W<S6tP8VZ=l%z7SY75f*<1`G-u=YO55)8!(MJ2Y^{k5#^-m{K$wORjz
zqSVpcrO8`#VBE7N0b7?aqHuOd$WLB=mAnhhH#jN9+_CwDoqqAF&-aTXp2WnN5vuJ+
zrg1&N=>X+}N4g6kg*Cm)gbffBQWm=X5vm}gCT$w%b<FTX7|5S{c9~st<gM3qld+<|
zIxg|h?Nj!m+tb(g+LY|m%0gxnRipTOKUTgbz>C#f=EvF66(qdgqJnQtGnx=cdc?s;
zWAmo?&hXg&!7I=iOD^b74<IE=Mss2E=8Nw?nq7GoG%tY597Q-PDDau^3Hq;3EEyT<
z=%FqdcM^1vpCEbb-zQ*lGe^vYO%Us_EgC(6{<OOZ&o^pfI|K@pe8&8eaHhxgjYH38
z74Cx`#0QoymV{We00WVd>!_HQJ>D>k%Ae+Fw9ixYC9OlEotA(0<@adS>zaHU4B8k*
zqDP4NBSU;J4ceGPqEjXD0)K(aPrnB(DCFUU$UYTlc4Orrh-57+-|#YAyxhM9nv&*L
zWqk$w%-}M-j)>(ehdvpC6=hSq;dmwAhPZ&!J(g3G#Nf0#+2wB(i-MpcPOb!<xaEBX
z6AVIX_lGv-OtRoIk)|mk95&4ZU3!7BDVFG9u#@YX8<P00EBGoh1YM#|g!gVnIS&g^
zgQYkP*nlXy?P`2rb1Gaw?LOpq)bX_%0&5y0I&_cQGkiaw1$mUfkX&$BHShH}BXemk
zJe}p1)JNA-$yevr@<|1C*ch_H?tiA!?3KvnrLdnH?qC{%G}}ba+?>)i5vb?9J8j+M
zs&3Pky7X25J)$IZQQli<r_DvOyQ+sT`IDOU_m~Ul?;0|sMjP6&leGwsYEh7C?q?lk
zg+YC-hBu}ldql>tUrJ0u=CB;^tP5Sj4Fy^68k}TRIMfXJ?AxhG)g5Y6t3o4v|59FQ
z@jEQtI!27u(rXPXBT}WvURrJO@G0fkJ1<`2wCwjs<>oC^oc>_C==Io<43Utx_*E!k
zD$tMA;Ffu6IRa(G4w7{Wn6e&#m<EaBBpmEFs%!4WYlD^@qt$Vc++PHSRwuMoA~FY`
zQ;D4<!H;PrZ9Ww-@oYS}qbR*c*&WQBm1{qLtxet#uutCp;#ikE;(r#*jx%3^DI;TP
z+NYOAs`Q2`d^Gv<zTa0LLrhEIr;+~eg<fmzPDfa`m6Ta}h25Ek0hx=w24(k!E9q2x
z#77$36E>dIl+K<ByX&@ReYo;{P5#Z`WMv{h9#tJ<VtiyoKQgy?fb1;SbXlud3~}xB
z^6;+b)}BYZqx-SaXrW{r2I>M^`r&d&K9FIUu*g)3^xAndGrdGmEG<?Xd!C1XQ*@B7
z7v2I!f`6@n4>JLw_nsL_V*xU}T8k}qkaZF6uyx6gmhT1^OK~x^GtNSqw|JD5Teimo
z?Qf<Cb(s#WgIw7gbAQ-X9p49hRsvRAv-bRu2y}I;BgtqjCBs3=SorME(k@&u=k1bg
zo({Xxn_7_|v3Xj@l)4;G;o%5e)`+=c039-i1p-0e%ayHvc#Jj#MMD%}y@-R>L;Gic
zxbB>=`bTZv50xnT0$Jq2i?}Vu!Z#0^J+Oe%2591h)ro8C+}GSmh*oGfpriRPDeb-a
zv6uOJdnPm+UPEBXVASGZyldx5^4{)q3`%l4`V}8~%jH|wEa<}(Pi;yZ7RDHDS_Hc_
zL&79Qxy0x^5#ClP!8U(;7kSjM@tx2MnHyKB!w&kk;>4v#Z$HR<{w?lcWv}<$P${F5
z_5p7P`T)#%{8^Qb?WkxI^hZgNdx;7|(7Ch+Ho3?>f@o5dDt;Gg@MHa=QnSdpbWer_
z^CQO|^Q&WDjEGVrD`I~%AUFxxBca-#g}%(26LwOINaRob_%B`g<4Gr?>jPY6SE#7X
z=V#B{UUA5|`mzzHBNJ-8khT`vh7{}owPS&Lf`Lnc+2eyLFp7o#H1AbU(J_aCAAn(s
z#g<M<$H6Y-D3v%dzfSbG9&!ti*y*S1aB_CGi4t1?oH8#EdIk?B#kYIkn3N7h-%3?f
z+EVvbI*kANWA?^~lOl|~U#KHUvQ_?OfwK~?qmBwG3y-HpjXoYvlA>Up1SC}H?0RXr
zQkM0{VWTUq-I*Ew3Z<?_F%#;%(dIH8zQFz@ym77ZiC2nU%%J&_v~O{9|K!}M>R`61
zMa|v(L}1R}3JY*7X&+T<336v)5!9_B5tE|zKa?7nTiz)mt6v<CVQy)R-;&3fr?5Kf
z-ZJ%f^&9Ot&8TF%7E-)4rAS>&8z}O&nIBdy*!w`Val_mAi<O$k&d7usEN~#r=L0MN
zA+C|vx@#2u_T7Eq9x@1jK<peQ0L-PUDInIMf|7k;tHBmVdmmsOYUnohyUCkf2yy)t
z|DdnUV}E|GaWkkIrwE@~?G2&I%7)NArC*=ZlXSlpe@~NVdGSGNrpK)E)5b1UhQ})A
zQxn>I3=$pt<0TV)Ka}XfxbVhR5O`!JIwMyrvll((RO3b+q+O9Fe4`1rq-pDlOH{Sh
z((l*bv~Ak0wViomS1azvwS3cBAzs;sgPiu7T$Etz13omzx<Q%GncS=;4@UtpgZ7nL
z1*>iaOR8x^q{>=aopHm?W3LP<`XxDvon%?Mg;vsn&XF*jP*+#=iLHVl?G*k(DClEh
zlOp^4$hpIVXf*#%Q@qZ9(<23}tu@H){KL=n)k^)&+;DxbkZ#2ffV<v$=T^aNAn7_J
z{IbcH(KGt^af0JG$$QQvD}A$h4K9TmJdl#MPApLBC=k_erQY(ViqwDSmVy4?gs=W9
zvvluNt5|^*iK7}>6=L^Gp)blNDw#6HP|aYIZ#;s%WcWATN_-S;rPVIa5P044#cJlt
zlPgc}^Gj{wRbc^~?QG0H@JTcl2w?q<QIbnG$RK=wBF9(z%ZoeF^{g*r`BZj<^U}fl
zkV3oPS?I!#I)cII3-)r)4anF$!OI~|A23mY?i1%Qz>Gl(0{`F|<Pcw<v?k?m#b-Co
z!GckYBY5{zkJx8$=)2+xmizSrf4@R86#0X~3R25qf5txK<RF=)pQy`(R{2frq9fN}
z181S}eiZk*P@0yi^aiQFN5w4XbUNr%B^-I~o^P7sh<4M)!^6w?^?HFw{&;j^T5@0M
zWbmS>9c~BSaef2W`}I0PZ`)-Le*_DZA3Dt3=tE4?d0^(YQz)gtT#4E6&kBI|eZS}s
z=(JuBbSbF6*NaZ-Y?9ssuQxMUugaVc5mItfO3(HMQ(}%~LBCw2{p6~TGDJujVtZE_
z6Y3~X$@v!CO3fcz0k=fNnGb6+hoPu2K>{Hb{fKE1D4Gb&G#M_WTWVWui(o+KW_;&2
zZ|LxLol`t>4GW-yEil!*;Pqav!G|i)csK^Y>%PaZErGtAgk@atB!67$6<E|mH)tW-
z-(ccqs_vL$u7;TfjCeHK(~b+?d$(?N?-W>%D$s=q?64j=j@ldt-w4)gFWq1smCX;O
z&#NRT1yWAG#@Wuje?zY)rEjbC3E7*`s|zJ?HnDwbKWbO??h+c^4x>+Z%AE|g;;w3N
z)3I2`n~S}kn`6TjZQ6G~%59TXF&#`}NSc5bEgTf>{&h`Ptz?y6{18a<wlQgyM@c%F
z&u)DmK77S#z#Hi^%|GRNO;ah*ivFp$p7YIu!kMJyv9AH=s*STfFAe4vyApOPZYndT
zteXelcl7X}eCNDoa_LN>^2j+`sB}+|_#$!EP48sYUJ-(f%(wK<DLxT5s<dpVb7$kT
z-T%^Yxy1s{MEH$l^03XY(8D63Vr$`@fH8|#kPwULIvw@g$crmtOiZz6%QcPWG>l4t
z<ehlMtF%K7O#S_5D_6va@)wu)rUtLcxP6&6=)1L`#G=Ku*l6d%bHDUGqbdtgJDxK|
z(${>KU$FPT4XYr^=6PzX*2%jZn56oRwc0jrt{mt+l?w_9bjnGe89a;sa8WKvU<*0=
zlJFhlE1_jgA7QC_Z9dtW9X=vp`%8oEn76aZtKsr|Nyk^rg+Wg~P3rSDo$}&l*MSF;
zum>|Mbenk_$Va-YOzv2R%!c~p2fd@!WEzo==5Q@Py}sRqAB*~0*Qv#$yZBzP@mm3<
zx4^JT*;*1+mcL$E5`UM(LI1~!UQ76dE4eLCkeZ&WTnr`AjVM7S7@>+{-rA|5z(g{X
zCaDaQE(tT3O1eE<8qI5)@V4nQMvpYH6r@xP(p!mgDl3J_rVyEX=W2cY;J7Mj^U;I}
zL3?5NWtwR~-|B8f|2J{odYU#CUY_eM8r;E6;~RpB?4+fvw~D0W?y}z9_gqPnx8_LL
zk1*84Rq$L-|KJlV5ZF=XJQa0K{yP3M@FI-?tW11eSv?GB!vb#;w{kXbLZ^0iG1Xw4
z+u3%<&{~3*UdM?1cn8I_WZ@ne7-->uPpDqc-9H}U>P4Jg!en59QH!Oke-Nym63>}?
zqbG>8-!Kfk!Dj`V9o9uKA;u-T-$71g;GqBQW{;s26^6NR5mO#L>zIAayf5ONfuGgC
za$cX{#cP02Q<7T_cH+XT(Oa;VNJA%kjB0Dnl*eb1SE)K36W{INI~t#w?vk@;;3>$-
zN%3uo`L^7Y8%sfsj)Pom>y{zNE+k`*p!0TJh&4Hpqt>@;XpluNszrjenl9M7eo9mj
z91P<p<k!LuDOja3M5<s@9T+s8_*S4CsbDf__^Y*$EeX3Z)M+NLElwTH_W*PYZ`0I3
z9nT|BIlw%Bf%!pW5<|uNBw~N7^x-Q!cXaJmQ@@|G3T2TQA9&&IF@^eA9d~*C9*u@&
zOv7PDR?Iv~W<>8kQGww`3YAxCwmobA%fdmSowxvknUAhKAsaYbN@0VWhVv(DRK^v_
zAh4R`dVaYIRdJZfP0Fg507Yzb{&z;t@hw9KIm1RUCGPJQ$2Lg7n9O6pljs!a<01r)
zr-oIzbxN$C)){_uRmf{}tY&`I-cd(v6xx)O2GzC;+R^izPtj+YCvZ^{alfg^0D_~|
zYXY**D&c~r1bsQ!DoBSQhIMwO!N%`dp!J=(Q&Pb{^^=sr#wD)_s$akK1pHD8<$qP^
z=3Y}{@aPFMht?aNl93`N-9Lz)-_Ocuk-s#R_D=V5D4WOA_=PsWkC&kqB|q5_s&Lz?
zENE%j_sRN>d@93>{j>99VM=}9uj80I@}VD$g5G~*Y@em@@^Q!4ukU&B0*Kkb+TSnD
zz<0`vCxQ&bF~6r#`&${PSd~7m<>{qJo~R2s{LNPLg86+_{1On-I=A~_)k!mWf!>jx
z<w(VVHv4NrEtA&l|H^KP{~{j2MWzOloRI`@nx{K!T7V(|S5pR{)GWNQW*cmHRS&#w
zrSPp2ZS=hWMHS9yfxjetO?RU==2WdXy?VOR++pF2*=MI~Z%S_86$s5rwKwioODuS0
z>t7Um-L&Qd0bhYM9vq>1m-`6ybRg;l=f_ZZAnNJV(Hu!fsJA#mJu?E8I1kDOhN0F5
zK~M;SfZPJD1z8L7zK974IE4j(+hCQ;F$HW?13{sp0Gi%~YS8ooMSn@cNkC9AY`LIu
zKu|m`2!aDMtNwHo-sfx+2EOb|Hq@$Jz5Ybzxu4a;*z;n314-Ui;{<RssjSKJsftfe
zzlAn_^Ks?mlWF?G;Y&`H?`KAjW2oJeSDY(R+_S=2QmPUHrzcKZV{m|jy>`dbqyGu>
zF{x%*YwHLvJTHFwwe4;Xn3SDn&)U<ONG2aa!8h?lhZ<o4Qqc9TMOeHaZ)9ZYE8Ei<
z=@(?InDrsw_7f}a?Unf9Sz1{+We$C{x2KL`Ze&p3RLabwCgz9;M#2Tt<9-!5^jCp{
z0Qp}m@FVKO2dR&AUm626fQj<}-jw#Evy=J0?E_ce_ecn__IYV}xZDkL40D+vO>qSl
zHKvm&1qZ<P#w)cj3bgq6VDCaH>FzE6f#=LV+MQT{s`GXQ66^r0>eogceg*@(a>SOn
zdHe}`%gb2~eUu6p#0fdpyuucGJg9e5<=IHr;nw7i$$^W3_hFxN)ixbt8)(IwX7u&d
zuFw+Ueir|Np^m=v$lP3@I%R5+i#>R(w<m(_g{cDP1o4(k$oIjUl0*<4>MeFmX4>&i
zk?p~gy-)9W;-8+e2=y0HY!6}hW?01aZ9{3`Q7q-8Tqt{dAy|5j97AJ)FCc1HK;O`Z
z1qe>`B)*fmB<yan7XBT~l+X|q<rvxwa$*K;pz=9`NE<TI^qXmAXl*{7QCs`Xu=NYi
z&Z%hjtyToRsr^3M*tmi0A|0}3(kD9k?28rh;533p&DGF_D8rB8rqBtRN-(EJLDx<r
zP!%U<&1LI~+Yx6r?5!(|?z+s1GS=8c&2z=N)sQv%k@r<bvyLGbx?6V~<zJ>%Ns;bs
z#L<70P?<mmkiEY+Kp1UHUG9RRIfdB60>Pl)AI1Vtz}t%x^Bmi+hBxN>%li9uaC|(S
z-uj#(uH-&9^Fdv{uai6~ImBTe!%^K=Vsz_3s7h+?TF}Og*;Uu>mw^6P{0FPDyJ<u9
z!bevXYO5F+7@F63f`qWx9zVf+x8%k<v!>_Lq;D<j{S2V~wC({1hMKC9#3^9jlntf<
z|Fn~kyv^lufN{Hw?w!YJ&oo%#TxIaBSlCNI0y(Ls0Tb0LaKDGmuv%^}EC5}DjmyK<
z@12<4FP|itDP0?V=SChXd%HNk>#P2)N5MCll+G}kQ<d~`co#a84mZ|o5F5ng{BWnj
z<5NVCnzwVhi=Zw!gBSW3Dm0M`MmYM!>|=>G`{)7^AEe4VA2&-)n|W+>FXr*!UXOVA
zIx36fwPlW(V}o>-QB-@sqrA6O@AAqEi7~_r4V}mOjil7W0c#@>I?Izx!Y4NR)3#L=
zynNRjb|FJ+#4AF=1zc*+hzJ>nOBy{keaEe`6dj8{I6nXIxS*f+)1B7v#{yJE3SHom
zvdJeln)Yc;zu_Ade&QoeNa!$5yZG>IK_gu8wI4ytj+7MA>9uFVQ{ssTOFfwQqC*3{
z{vV0)?+Nnn?}mcXj|x~9CpA`6NzN5=P~h-5%QkxX4d|=#(eL8L{-pW&pXN*X1s6>n
zhm%=`jV=m-1)Uwjmubc2My{i`PDS~y-vIZ0`e)5{{rrob;Rf+6IAH=;*?F>}JH<^8
zI*saP_bPqwuI#<u$ukpaU=1lv5S~q55ju>|lGz+{I2WgN&WSrl268WMzSvJDqz!gL
zG$%Eh{oQ*JGj<hjlqd8<m^aZ+rmCFkxy1VW#-77|70w-gbwzt;w2!+)F4>a&70)Ov
zutGcBeD2ltI+j!Jnh^2eWXmK<{v9{6=dgca#E7&duf)s}zq>n~b&gKtLc6UR=9j2~
zqt45+teW(KTWt4IU3*jgJX<TfeaX!mMLZ!D-Y8nrJiR}ls>-0rn+lxl-~749IP)L+
zIX5@ZdIMET-S$#3Mv|Y43&OkW8^TAldCs3cJPVufL?vSa?ja7q^c`&m_^n5h<v!D0
zBsSoFn)C@BBATD#_vn+Im3<6#ECaza_D_nc-h61`F*=X|3!WeKH~c~)OfHW>Ga0yY
z)J*{rXD89;{3^0t%LrF>QaQR<C|w(mXF`{9jJgZ$rAK0o*|_i8-HDui3PE-a8J>jg
zZFm3LiF0JNE9+47{sQc%SqD`C>}Gu|Nf;S!b|R~}cJ*#xfk)CCxlP@3Zn@9(uGbUr
zP`b)dW$|qmf?3R8EVPdc2Z;~!(?&snk(JeBfz721urv>zXL25Io>UNYl_;}nK9Gma
zL@;Os7GP5U`OGO)U^Ni*;3wq=S*!Hd1`GWa7GUoXMmSI@Ftr-?-(+uNL;9U**>^01
zh?}@_FJ>B<H1J#>99Cybqvg7kBC`v4n1i7CS=#>~8=O@tOPh6dI;3(}116vR)}tvl
z%8~1LomlmrA#1E72-HO*ve^QuEX}F@)?!er5(;rLJFjb^X9vYO7B+n`l8XLV;O~5Q
zi-2Jhw28mQdMCYM2Uw9jq50^a@S_Y-*0F$s8Py4RLr<ay2*6SOZ??HHA%za{+j}pD
zE7_)cB*&qDAw~Ax9XpB+r2h-_VWq<NV9&9u+YNj}PPJmhT!YOs@q_0Llb<g%PmNYF
z{T)jm?MLEA@plvVamhwr0O-o_%5G@+$=~GAU`H~Bijk^y1?5J)I9+5;@ps^|+R7^U
zF^Au_aTYHw>Sfly4-zN;3rQi!uP3SQ{>uV?y@8TSp3;h-FFMw=cx+cGmANayPEhR7
F{{WCi5DNeR


From 90f8d835e065ea12dddd8ed9ca20872a4412c78a Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Sun, 11 Aug 2024 17:55:00 +0200
Subject: [PATCH 454/591] ZOOKEEPER-4814: Re-introduce support for clients
 incompatible with the 3.5+ `readOnly` extension

Reviewers: tisonkun, kezhuw
Author: ztzg
Closes #2146 from ztzg/ZOOKEEPER-4814-clients-without-read-only
---
 .../zookeeper/compat/ProtocolManager.java     |  35 ++++
 .../zookeeper/server/ZooKeeperServer.java     |   2 +-
 .../zookeeper/compat/ProtocolManagerTest.java | 149 ++++++++++++++++++
 3 files changed, 185 insertions(+), 1 deletion(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
index 5633b81c17d..50038e5cbb2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
@@ -20,6 +20,7 @@
 
 import java.io.IOException;
 import org.apache.jute.InputArchive;
+import org.apache.jute.OutputArchive;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ConnectResponse;
 
@@ -118,4 +119,38 @@ private ConnectResponse deserializeConnectResponseWithoutReadonly(InputArchive i
         inputArchive.endRecord("connect");
         return response;
     }
+
+    /**
+     * The serialization of {@link ConnectResponse} has to be handled
+     * specially as clients earlier than 3.5 might not expect the
+     * {@code readOnly} flag.
+     *
+     * @param response the response to serialize
+     * @param outputArchive the serialization destination
+     * @see #deserializeConnectRequest(InputArchive)
+     */
+    public void serializeConnectResponse(final ConnectResponse response, OutputArchive outputArchive) throws IOException {
+        serializeConnectResponse(response, outputArchive, isReadonlyAvailable());
+    }
+
+    private static void serializeConnectResponse(final ConnectResponse response, OutputArchive outputArchive, boolean withReadonly) throws IOException {
+        if (withReadonly) {
+            serializeConnectResponseWithReadonly(response, outputArchive);
+        } else {
+            serializeConnectResponseWithoutReadonly(response, outputArchive);
+        }
+    }
+
+    private static void serializeConnectResponseWithReadonly(ConnectResponse response, OutputArchive outputArchive) throws IOException {
+        response.serialize(outputArchive, "connect");
+    }
+
+    private static void serializeConnectResponseWithoutReadonly(ConnectResponse response, OutputArchive outputArchive) throws IOException {
+        outputArchive.startRecord(response, "connect");
+        outputArchive.writeInt(response.getProtocolVersion(), "protocolVersion");
+        outputArchive.writeInt(response.getTimeOut(), "timeOut");
+        outputArchive.writeLong(response.getSessionId(), "sessionId");
+        outputArchive.writeBuffer(response.getPasswd(), "passwd");
+        outputArchive.endRecord(response, "connect");
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 61c7d4ac318..598a6976876 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1170,7 +1170,7 @@ public void finishSessionInit(ServerCnxn cnxn, boolean valid) {
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             BinaryOutputArchive bos = BinaryOutputArchive.getArchive(baos);
             bos.writeInt(-1, "len");
-            rsp.serialize(bos, "connect");
+            cnxn.protocolManager.serializeConnectResponse(rsp, bos);
             baos.close();
             ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
             bb.putInt(bb.remaining() - 4).rewind();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java
new file mode 100644
index 00000000000..5a87274e0e7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java
@@ -0,0 +1,149 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.compat;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.jute.BinaryInputArchive;
+import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.InputArchive;
+import org.apache.jute.OutputArchive;
+import org.apache.zookeeper.proto.ConnectRequest;
+import org.apache.zookeeper.proto.ConnectResponse;
+import org.junit.jupiter.api.Test;
+
+public class ProtocolManagerTest {
+
+    private static byte[] serializeConnectRequest(ConnectRequest request, boolean withReadOnly) throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        OutputArchive oa = BinaryOutputArchive.getArchive(baos);
+        request.serialize(oa, "connect");
+        baos.close();
+        byte[] bytes = baos.toByteArray();
+
+        if (withReadOnly) {
+            return bytes;
+        } else {
+            return Arrays.copyOf(bytes, bytes.length - 1);
+        }
+    }
+
+    @Test
+    public void testDeserializeConnectRequestWithReadonly() throws IOException {
+        ProtocolManager protocolManager = new ProtocolManager();
+
+        ConnectRequest req1 = new ConnectRequest();
+        req1.setPasswd(new byte[16]);
+        req1.setReadOnly(true);
+
+        byte[] bytes = serializeConnectRequest(req1, true);
+
+        // Current protocol.
+        assertEquals(45, bytes.length);
+
+        InputArchive ia = BinaryInputArchive.getArchive(new ByteArrayInputStream(bytes));
+        ConnectRequest req2 = protocolManager.deserializeConnectRequest(ia);
+
+        assertEquals(true, protocolManager.isReadonlyAvailable());
+        assertEquals(true, req2.getReadOnly());
+    }
+
+    @Test
+    public void testDeserializeConnectRequestWithoutReadonly() throws IOException {
+        ProtocolManager protocolManager = new ProtocolManager();
+
+        ConnectRequest req1 = new ConnectRequest();
+        req1.setPasswd(new byte[16]);
+        // Should get truncated.
+        req1.setReadOnly(true);
+
+        byte[] bytes = serializeConnectRequest(req1, false);
+
+        // 3.4 protocol.
+        assertEquals(44, bytes.length);
+
+        InputArchive ia = BinaryInputArchive.getArchive(new ByteArrayInputStream(bytes));
+        ConnectRequest req2 = protocolManager.deserializeConnectRequest(ia);
+
+        assertEquals(false, protocolManager.isReadonlyAvailable());
+        assertEquals(false, req2.getReadOnly());
+    }
+
+    private static ProtocolManager prepareProtocolManager(boolean withReadOnly) throws IOException {
+        ProtocolManager protocolManager = new ProtocolManager();
+
+        ConnectRequest req1 = new ConnectRequest();
+        req1.setPasswd(new byte[16]);
+        req1.setReadOnly(true);
+
+        byte[] bytes = serializeConnectRequest(req1, withReadOnly);
+
+        InputArchive ia = BinaryInputArchive.getArchive(new ByteArrayInputStream(bytes));
+        // Detects the current protocol.
+        ConnectRequest req2 = protocolManager.deserializeConnectRequest(ia);
+
+        return protocolManager;
+    }
+
+    @Test
+    public void testSerializeConnectResponseWithReadonly() throws IOException {
+        ProtocolManager protocolManager = prepareProtocolManager(true);
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive os = BinaryOutputArchive.getArchive(baos);
+
+        ConnectResponse rsp = new ConnectResponse();
+        rsp.setPasswd(new byte[16]);
+        rsp.setReadOnly(true);
+
+        // Should use the current protocol.
+        protocolManager.serializeConnectResponse(rsp, os);
+
+        baos.close();
+
+        byte[] bytes = baos.toByteArray();
+
+        assertEquals(37, bytes.length);
+        assertEquals(1, bytes[bytes.length - 1]);
+    }
+
+    @Test
+    public void testSerializeConnectResponseWithoutReadonly() throws IOException {
+        ProtocolManager protocolManager = prepareProtocolManager(false);
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive os = BinaryOutputArchive.getArchive(baos);
+
+        ConnectResponse rsp = new ConnectResponse();
+        rsp.setPasswd(new byte[16]);
+        rsp.setReadOnly(true);
+
+        // Should use the 3.4 protocol.
+        protocolManager.serializeConnectResponse(rsp, os);
+
+        baos.close();
+
+        byte[] bytes = baos.toByteArray();
+
+        assertEquals(36, bytes.length);
+    }
+}

From b64146d3d337e830f8fd4f5ce6a960a50b9e363c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=A7=E6=98=93=E5=AE=A2?= <kmter@live.com>
Date: Mon, 19 Aug 2024 19:08:27 +0800
Subject: [PATCH 455/591] ZOOKEEPER-4850: Enhance zkCli Tool to Support Reading
 and Writing Binary Data

Add license header
Fix Checkstyle violation
Improve get set command usage
Remove redundant characters in set command usage
Separate command syntax and detailed usage, prevent break overall usage message.
Reviewers: eolivelli, shoothzj, ztzg
Author: Shawyeok
Closes #2180 from Shawyeok/enhanced-get-set-command
---
 .../zookeeper/cli/Base64OutputFormatter.java  | 31 ++++++++++++++
 .../org/apache/zookeeper/cli/CliCommand.java  | 18 +++++++-
 .../zookeeper/cli/CommandUsageHelper.java     | 42 +++++++++++++++++++
 .../org/apache/zookeeper/cli/GetCommand.java  | 18 +++++---
 .../zookeeper/cli/HexDumpOutputFormatter.java | 34 +++++++++++++++
 .../apache/zookeeper/cli/OutputFormatter.java | 24 +++++++++++
 .../zookeeper/cli/PlainOutputFormatter.java   | 31 ++++++++++++++
 .../org/apache/zookeeper/cli/SetCommand.java  | 15 +++++--
 8 files changed, 203 insertions(+), 10 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java
new file mode 100644
index 00000000000..a2224beacc1
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.util.Base64;
+
+public class Base64OutputFormatter implements OutputFormatter {
+
+    public static final Base64OutputFormatter INSTANCE = new Base64OutputFormatter();
+
+    @Override
+    public String format(byte[] data) {
+        return Base64.getEncoder().encodeToString(data);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
index 6386bb9b47e..192841f84fb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
@@ -20,6 +20,8 @@
 
 import java.io.PrintStream;
 import java.util.Map;
+import javax.annotation.Nullable;
+import org.apache.commons.cli.Options;
 import org.apache.zookeeper.ZooKeeper;
 
 /**
@@ -32,6 +34,8 @@ public abstract class CliCommand {
     protected PrintStream err;
     private String cmdStr;
     private String optionStr;
+    @Nullable
+    private Options options;
 
     /**
      * a CLI command with command string and options.
@@ -40,10 +44,22 @@ public abstract class CliCommand {
      * @param optionStr the string used to call this command
      */
     public CliCommand(String cmdStr, String optionStr) {
+        this(cmdStr, optionStr, null);
+    }
+
+    /**
+     * a CLI command with command string and options.
+     * Using System.out and System.err for printing
+     * @param cmdStr the string used to call this command
+     * @param optionStr the string used to call this command
+     * @param options the command options
+     */
+    public CliCommand(String cmdStr, String optionStr, Options options) {
         this.out = System.out;
         this.err = System.err;
         this.cmdStr = cmdStr;
         this.optionStr = optionStr;
+        this.options = options;
     }
 
     /**
@@ -88,7 +104,7 @@ public String getOptionStr() {
      * get a usage string, contains the command and the options
      */
     public String getUsageStr() {
-        return cmdStr + " " + optionStr;
+        return CommandUsageHelper.getUsage(cmdStr + " " + optionStr, options);
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java
new file mode 100644
index 00000000000..95eb135695d
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import javax.annotation.Nullable;
+import org.apache.commons.cli.HelpFormatter;
+import org.apache.commons.cli.Options;
+
+public class CommandUsageHelper {
+
+    public static String getUsage(String commandSyntax, @Nullable Options options) {
+        StringBuilder buffer = new StringBuilder();
+        buffer.append(commandSyntax);
+        if (options != null && !options.getOptions().isEmpty()) {
+            buffer.append(System.lineSeparator());
+            StringWriter out = new StringWriter();
+            HelpFormatter formatter = new HelpFormatter();
+            formatter.printOptions(new PrintWriter(out), formatter.getWidth(), options, formatter.getLeftPadding(),
+                    formatter.getDescPadding());
+            buffer.append(out);
+        }
+        return buffer.toString();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
index a10272e6b3a..2de0a0bde6e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.cli;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -36,12 +35,14 @@ public class GetCommand extends CliCommand {
     private CommandLine cl;
 
     static {
-        options.addOption("s", false, "stats");
-        options.addOption("w", false, "watch");
+        options.addOption("s", false, "Print znode stats additionally");
+        options.addOption("w", false, "Watch for changes on the znode");
+        options.addOption("b", false, "Output data in base64 format");
+        options.addOption("x", false, "Output data in hexdump format");
     }
 
     public GetCommand() {
-        super("get", "[-s] [-w] path");
+        super("get", "[-s] [-w] [-b] [-x] path", options);
     }
 
     @Override
@@ -92,8 +93,15 @@ public boolean exec() throws CliException {
         } catch (KeeperException | InterruptedException ex) {
             throw new CliWrapperException(ex);
         }
+        OutputFormatter formatter = PlainOutputFormatter.INSTANCE;
+        if (cl.hasOption("b")) {
+            formatter = Base64OutputFormatter.INSTANCE;
+        }
+        if (cl.hasOption("x")) {
+            formatter = HexDumpOutputFormatter.INSTANCE;
+        }
         data = (data == null) ? "null".getBytes() : data;
-        out.println(new String(data, UTF_8));
+        out.println(formatter.format(data));
         if (cl.hasOption("s")) {
             new StatPrinter(out).print(stat);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java
new file mode 100644
index 00000000000..d545a422efc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java
@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import io.netty.buffer.ByteBuf;
+import io.netty.buffer.ByteBufUtil;
+import io.netty.buffer.Unpooled;
+
+public class HexDumpOutputFormatter implements OutputFormatter {
+
+    public static final HexDumpOutputFormatter INSTANCE = new HexDumpOutputFormatter();
+
+    @Override
+    public String format(byte[] data) {
+        ByteBuf buf = Unpooled.wrappedBuffer(data);
+        return ByteBufUtil.prettyHexDump(buf);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java
new file mode 100644
index 00000000000..d306ac42fdf
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java
@@ -0,0 +1,24 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+public interface OutputFormatter {
+
+    String format(byte[] data);
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java
new file mode 100644
index 00000000000..c536f2ba9e5
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+public class PlainOutputFormatter implements OutputFormatter {
+
+    public static final PlainOutputFormatter INSTANCE = new PlainOutputFormatter();
+
+    @Override
+    public String format(byte[] data) {
+        return new String(data, UTF_8);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
index 035d82aadf8..34ac14e7422 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.cli;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
+import java.util.Base64;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
@@ -36,12 +37,13 @@ public class SetCommand extends CliCommand {
     private CommandLine cl;
 
     static {
-        options.addOption("s", false, "stats");
-        options.addOption("v", true, "version");
+        options.addOption("s", false, "Print znode stats additionally");
+        options.addOption("v", true, "Set with an expected version");
+        options.addOption("b", false, "Supply data in base64 format");
     }
 
     public SetCommand() {
-        super("set", "[-s] [-v version] path data");
+        super("set", "path data [-s] [-v version] [-b]", options);
     }
 
     @Override
@@ -63,7 +65,12 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     @Override
     public boolean exec() throws CliException {
         String path = args[1];
-        byte[] data = args[2].getBytes(UTF_8);
+        byte[] data;
+        if (cl.hasOption("b")) {
+            data = Base64.getDecoder().decode(args[2]);
+        } else {
+            data = args[2].getBytes(UTF_8);
+        }
         int version;
         if (cl.hasOption("v")) {
             version = Integer.parseInt(cl.getOptionValue("v"));

From 6b70544bddadae8b40ede0f52abe30021ff47bb7 Mon Sep 17 00:00:00 2001
From: hwanning <66072633+1neverknow@users.noreply.github.com>
Date: Mon, 26 Aug 2024 00:13:18 -0400
Subject: [PATCH 456/591] ZOOKEEPER-4853: Fix assert in
 ZooKeeperQuotaTest#testQuota

Reviewers: maoling, shoothzj
Author: 1neverknow
Closes #2169 from 1neverknow/master
---
 .../test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
index bbc81c758d6..211f91a476f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
@@ -116,7 +116,7 @@ public void testQuota() throws Exception {
         stopServer();
         startServer();
         ZooKeeperServer server = serverFactory.getZooKeeperServer();
-        assertNotNull(server.getZKDatabase().getDataTree().getMaxPrefixWithQuota(path) != null, "Quota is still set");
+        assertNotNull(server.getZKDatabase().getDataTree().getMaxPrefixWithQuota(path), "Quota is still set");
     }
 
     @Test

From 0cf36616dffe3164bf46b3b8c627f6cc5e37e8c8 Mon Sep 17 00:00:00 2001
From: puru <purushah@oath.com>
Date: Tue, 27 Aug 2024 15:32:16 -0700
Subject: [PATCH 457/591] ZOOKEEPER-4829: Support DatadirCleanup in minutes

Reviewers: anmolnar
Author: purushah
Closes #2178 from purushah/ZOOKEEPER-4829
---
 .../org/apache/zookeeper/common/Time.java     | 44 +++++++++++++++++++
 .../server/DatadirCleanupManager.java         | 21 +++++----
 .../embedded/ZooKeeperServerEmbeddedImpl.java |  4 +-
 .../server/quorum/QuorumPeerConfig.java       | 13 ++++--
 .../server/quorum/QuorumPeerMain.java         |  2 +-
 .../org/apache/zookeeper/common/TimeTest.java | 28 ++++++++++++
 6 files changed, 94 insertions(+), 18 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
index 08891f73a80..9abe4d6a831 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
@@ -22,6 +22,12 @@
 
 public class Time {
 
+    public static final int MILLISECOND = 1;
+    public static final int SECOND = 1000 * MILLISECOND;
+    public static final int MINUTE = 60 * SECOND;
+    public static final int HOUR = 60 * MINUTE;
+    public static final int DAY = 24 * HOUR;
+
     /**
      * Returns time in milliseconds as does System.currentTimeMillis(),
      * but uses elapsed time from an arbitrary epoch more like System.nanoTime().
@@ -51,4 +57,42 @@ public static Date elapsedTimeToDate(long elapsedTime) {
         return new Date(wallTime);
     }
 
+    /** Parse a string as a time interval.  An interval is specified as an
+     * integer with an optional suffix.  No suffix means milliseconds, s, m,
+     * h, d indicates seconds, minutes, hours, and days respectively.
+     * As a special case, "ms" means milliseconds.
+     * @param str the interval string
+     * @return interval in milliseconds
+     */
+
+    public static int parseTimeInterval(String str) {
+        try {
+            int len = str.length();
+            char suffix = str.charAt(len - 1);
+            if (Character.isDigit(suffix)) {
+                return Integer.parseInt(str);
+            } else {
+                if (str.endsWith("ms") || str.endsWith("MS")) {
+                    return Integer.parseInt(str.substring(0, len - 2));
+                } else {
+                    String numstr = str.substring(0, len - 1);
+                    switch (Character.toUpperCase(suffix)) {
+                    case 'S':
+                        return Integer.parseInt(numstr) * SECOND;
+                    case 'M':
+                        return Integer.parseInt(numstr) * MINUTE;
+                    case 'H':
+                        return Integer.parseInt(numstr) * HOUR;
+                    case 'D':
+                        return Integer.parseInt(numstr) * DAY;
+                    default:
+                        throw new NumberFormatException("Illegal time interval suffix: " + str);
+                    }
+                }
+            }
+        } catch (IndexOutOfBoundsException e) {
+            throw new NumberFormatException("empty string");
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
index 2f9e7578392..5504519afab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
@@ -21,7 +21,6 @@
 import java.io.File;
 import java.util.Timer;
 import java.util.TimerTask;
-import java.util.concurrent.TimeUnit;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,7 +52,7 @@ public enum PurgeTaskStatus {
 
     private final int snapRetainCount;
 
-    private final int purgeInterval;
+    private final int purgeIntervalInMs;
 
     private Timer timer;
 
@@ -70,13 +69,13 @@ public enum PurgeTaskStatus {
      * @param purgeInterval
      *            purge interval in hours
      */
-    public DatadirCleanupManager(File snapDir, File dataLogDir, int snapRetainCount, int purgeInterval) {
+    public DatadirCleanupManager(File snapDir, File dataLogDir, int snapRetainCount, int purgeIntervalInMs) {
         this.snapDir = snapDir;
         this.dataLogDir = dataLogDir;
         this.snapRetainCount = snapRetainCount;
-        this.purgeInterval = purgeInterval;
+        this.purgeIntervalInMs = purgeIntervalInMs;
         LOG.info("autopurge.snapRetainCount set to {}", snapRetainCount);
-        LOG.info("autopurge.purgeInterval set to {}", purgeInterval);
+        LOG.info("autopurge.purgeInterval set to {}", purgeIntervalInMs);
     }
 
     /**
@@ -97,14 +96,14 @@ public void start() {
             return;
         }
         // Don't schedule the purge task with zero or negative purge interval.
-        if (purgeInterval <= 0) {
+        if (purgeIntervalInMs <= 0) {
             LOG.info("Purge task is not scheduled.");
             return;
         }
 
         timer = new Timer("PurgeTask", true);
         TimerTask task = new PurgeTask(dataLogDir, snapDir, snapRetainCount);
-        timer.scheduleAtFixedRate(task, 0, TimeUnit.HOURS.toMillis(purgeInterval));
+        timer.scheduleAtFixedRate(task, 0, purgeIntervalInMs);
 
         purgeTaskStatus = PurgeTaskStatus.STARTED;
     }
@@ -175,12 +174,12 @@ public File getDataLogDir() {
     }
 
     /**
-     * Returns purge interval in hours.
+     * Returns purge interval in milliseconds.
      *
-     * @return the purge interval in hours.
+     * @return the purge interval in milliseconds.
      */
-    public int getPurgeInterval() {
-        return purgeInterval;
+    public int getPurgeIntervalInMs() {
+        return purgeIntervalInMs;
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
index 189c3b45a74..60070e66ff5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -119,7 +119,7 @@ public void start() {
             // Start and schedule the the purge task
             purgeMgr = new DatadirCleanupManager(config
                     .getDataDir(), config.getDataLogDir(), config
-                    .getSnapRetainCount(), config.getPurgeInterval());
+                    .getSnapRetainCount(), config.getPurgeIntervalInMs());
             purgeMgr.start();
 
             thread = new Thread("zkservermainrunner") {
@@ -155,7 +155,7 @@ public void serverStarted() {
             };
             purgeMgr = new DatadirCleanupManager(config
                     .getDataDir(), config.getDataLogDir(), config
-                    .getSnapRetainCount(), config.getPurgeInterval());
+                    .getSnapRetainCount(), config.getPurgeIntervalInMs());
             purgeMgr.start();
             thread = new Thread("zkservermainrunner") {
                 @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index d72d8444341..0e9c82d4de7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -44,6 +44,7 @@
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.common.StringUtils;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
@@ -104,7 +105,7 @@ public class QuorumPeerConfig {
 
     protected QuorumVerifier quorumVerifier = null, lastSeenQuorumVerifier = null;
     protected int snapRetainCount = 3;
-    protected int purgeInterval = 0;
+    protected int purgeIntervalInMs = 0;
     protected boolean syncEnabled = true;
 
     protected String initialConfig;
@@ -336,7 +337,11 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             } else if (key.equals("autopurge.snapRetainCount")) {
                 snapRetainCount = Integer.parseInt(value);
             } else if (key.equals("autopurge.purgeInterval")) {
-                purgeInterval = Integer.parseInt(value);
+                if (Character.isDigit(value.charAt(value.length() - 1))) {
+                    purgeIntervalInMs = Time.parseTimeInterval(value) * Time.HOUR; // default is hours for backward compatibility
+                } else {
+                    purgeIntervalInMs = Time.parseTimeInterval(value);
+                }
             } else if (key.equals("standaloneEnabled")) {
                 setStandaloneEnabled(parseBoolean(key, value));
             } else if (key.equals("reconfigEnabled")) {
@@ -898,8 +903,8 @@ public int getSnapRetainCount() {
         return snapRetainCount;
     }
 
-    public int getPurgeInterval() {
-        return purgeInterval;
+    public int getPurgeIntervalInMs() {
+        return purgeIntervalInMs;
     }
 
     public boolean getSyncEnabled() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 0cad9ae8fda..8a5bb9ccd54 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -130,7 +130,7 @@ protected void initializeAndRun(String[] args) throws ConfigException, IOExcepti
             config.getDataDir(),
             config.getDataLogDir(),
             config.getSnapRetainCount(),
-            config.getPurgeInterval());
+            config.getPurgeIntervalInMs());
         purgeMgr.start();
 
         if (args.length == 1 && config.isDistributed()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
index bd8ace79be9..cc60055a553 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.Assert.fail;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Calendar;
 import java.util.Date;
@@ -101,4 +102,31 @@ public void testElapsedTimeToDate() throws Exception {
         assertEquals(calculatedDate, realDate);
     }
 
+    @Test
+    public void testParseTimeInterval() throws Exception {
+        assertEquals(0, Time.parseTimeInterval("0"));
+        assertEquals(0, Time.parseTimeInterval("0s"));
+        assertEquals(0, Time.parseTimeInterval("0m"));
+        assertEquals(0, Time.parseTimeInterval("0h"));
+        assertEquals(0, Time.parseTimeInterval("0d"));
+        assertEquals(1000, Time.parseTimeInterval("1000"));
+        assertEquals(Time.SECOND, Time.parseTimeInterval("1s"));
+        assertEquals(Time.MINUTE, Time.parseTimeInterval("1m"));
+        assertEquals(Time.HOUR, Time.parseTimeInterval("1h"));
+        assertEquals(Time.DAY, Time.parseTimeInterval("1d"));
+        assertEquals(1234, Time.parseTimeInterval("1234ms"));
+        assertEquals(Time.parseTimeInterval("60s"), Time.parseTimeInterval("1m"));
+        assertEquals(Time.parseTimeInterval("120m"), Time.parseTimeInterval("2h"));
+        assertEquals(Time.parseTimeInterval("72h"), Time.parseTimeInterval("3d"));
+        try {
+            Time.parseTimeInterval("2x");
+            fail("should have thrown NumberFormatException");
+        } catch (NumberFormatException e) {
+        }
+        try {
+            Time.parseTimeInterval("");
+            fail("should have thrown NumberFormatException");
+        } catch (NumberFormatException e) {
+        }
+    }
 }

From 2c2b74c1c11b6531aabb1bf06782e859048d5983 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 3 Sep 2024 15:04:07 -0500
Subject: [PATCH 458/591] ZOOKEEPER-4851: Honor X-Forwarded-For optionally in
 IPAuthenticationProvider

Reviewers: kezhuw, purushah
Author: anmolnar
Closes #2181 from anmolnar/ZOOKEEPER-4851
---
 .../main/resources/markdown/zookeeperAdmin.md | 10 +++
 .../server/auth/IPAuthenticationProvider.java |  6 ++
 .../auth/IPAuthenticationProviderTest.java    | 85 +++++++++++++++++++
 3 files changed, 101 insertions(+)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 4b7fd0954f3..4096a1fdecf 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1572,6 +1572,16 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
         - 1. Regenerate `superDigest` when migrating to new algorithm.
         - 2. `SetAcl` for a znode which already had a digest auth of old algorithm.
 
+* *IPAuthenticationProvider.skipxforwardedfor* :
+    (Java system property: **zookeeper.IPAuthenticationProvider.skipxforwardedfor**)
+    **New in 3.9.3:**
+    IPAuthenticationProvider needs the client IP address to authenticate the user.
+    By default, it tries to read **X-Forwarded-For** HTTP header first and if it's not
+    found, reads the **Host** header. Some proxy configuration requires this to
+    properly identify the client IP, but we can disable it relying only on the **Host**
+    header by setting this config option to **true**.
+    Default value is **false**.
+
 * *X509AuthenticationProvider.superUser* :
     (Java system property: **zookeeper.X509AuthenticationProvider.superUser**)
     The SSL-backed way to enable a ZooKeeper ensemble
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
index 9334f7c5e72..c73d12f78c2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
@@ -30,6 +30,8 @@
 public class IPAuthenticationProvider implements AuthenticationProvider {
     public static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
 
+    static final String SKIP_X_FORWARDED_FOR_KEY = "zookeeper.IPAuthenticationProvider.skipxforwardedfor";
+
     public String getScheme() {
         return "ip";
     }
@@ -150,6 +152,10 @@ public boolean isValid(String id) {
      * @return IP address
      */
     public static String getClientIPAddress(final HttpServletRequest request) {
+        if (Boolean.getBoolean(SKIP_X_FORWARDED_FOR_KEY)) {
+            return request.getRemoteAddr();
+        }
+
         // to handle the case that a HTTP(s) client connects via a proxy or load balancer
         final String xForwardedForHeader = request.getHeader(X_FORWARDED_FOR_HEADER_NAME);
         if (xForwardedForHeader == null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
new file mode 100644
index 00000000000..fc814f7ea5b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.auth;
+
+import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.SKIP_X_FORWARDED_FOR_KEY;
+import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME;
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import javax.servlet.http.HttpServletRequest;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+public class IPAuthenticationProviderTest {
+
+  private HttpServletRequest request;
+
+  @Before
+  public void setUp() throws Exception {
+    System.clearProperty(SKIP_X_FORWARDED_FOR_KEY);
+    request = mock(HttpServletRequest.class);
+  }
+
+  @After
+  public void tearDown() {
+    System.clearProperty(SKIP_X_FORWARDED_FOR_KEY);
+  }
+
+  @Test
+  public void testGetClientIPAddressSkipXForwardedFor() {
+    // Arrange
+    System.setProperty(SKIP_X_FORWARDED_FOR_KEY, "true");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+    doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.1", clientIp);
+  }
+
+  @Test
+  public void testGetClientIPAddressWithXForwardedFor() {
+    // Arrange
+    System.setProperty(SKIP_X_FORWARDED_FOR_KEY, "false");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+    doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.2", clientIp);
+  }
+
+  @Test
+  public void testGetClientIPAddressMissingXForwardedFor() {
+    // Arrange
+    System.setProperty(SKIP_X_FORWARDED_FOR_KEY, "false");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.1", clientIp);
+  }
+}

From fa3c504fada6a5cbbb929d0558f09c0eac6e1c8e Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Tue, 10 Sep 2024 12:34:38 +0800
Subject: [PATCH 459/591] ZOOKEEPER-4834: add typos check in ci workflow
 (#2184)

Signed-off-by: ZhangJian He <shoothzj@gmail.com>
---
 .github/workflows/ci.yaml                      | 18 ++++++++++++++++++
 .../PrometheusHttpsMetricsProviderTest.java    |  4 ++--
 .../zookeeper/server/persistence/TxnLog.java   |  2 +-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index cafc94729b8..6586848701c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -86,3 +86,21 @@ jobs:
         name: failsafe-reports-${{ matrix.profile.name }}
         path: ./**/target/failsafe-reports/
         if-no-files-found: ignore
+  typo-check:
+    name: Typo Check
+    # only run on pull requests because of security reasons
+    # we shouldn't trust external actions for builds within the repository
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check typos
+        uses: crate-ci/typos@v1.22.4
+        # To run the typo check locally, you can follow these steps:
+        # 1. Install typos locally using cargo:
+        #    cargo install typos-cli
+        # 2. Run the typo check with the following command:
+        #    typos
+        # FP is configured in the project root directory in the `.typos.toml` file.
+        # You can refer to the `.typos.toml` documentation here:
+        # https://github.com/crate-ci/typos/blob/master/docs/reference.md
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
index a27e9084d1c..26cdb4c23c5 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
@@ -70,7 +70,7 @@ public void tearDown() {
     }
 
     @Test
-    void testHttpResponce() throws Exception {
+    void testHttpResponse() throws Exception {
         Properties configuration = new Properties();
         configuration.setProperty("httpPort", String.valueOf(httpPort));
         initializeProviderWithCustomConfig(configuration);
@@ -88,7 +88,7 @@ void testHttpsResponse() throws Exception {
     }
 
     @Test
-    void testHttpAndHttpsResponce() throws Exception {
+    void testHttpAndHttpsResponse() throws Exception {
         Properties configuration = new Properties();
         configuration.setProperty("httpsPort", String.valueOf(httpsPort));
         configuration.setProperty("httpPort", String.valueOf(httpPort));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
index 2c736dd0e46..e29bec2a1c4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
@@ -46,7 +46,7 @@ public interface TxnLog extends Closeable {
     void rollLog() throws IOException;
 
     /**
-     * Append a request to the transaction log with a digset
+     * Append a request to the transaction log with a digest
      * @param request the request to be appended
      * returns true iff something appended, otw false
      * @throws IOException

From 3e2d6f3436962cd4a0445bc6c22f583e425d7ced Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Tue, 10 Sep 2024 14:30:13 +0800
Subject: [PATCH 460/591] ZOOKEEPER-4747: Add synchronous sync to ease
 synchronous call chains (#2068)

Previously, there is no synchronous `sync` so client has to convert
asynchronous `sync` a bit to fit synchronous call chains. This is
apparently unfriendly.

Besides above, in absent of ZOOKEEPER-22, we can't issue a fire and
forget asynchronous `sync` to gain strong consistent. So it becomes
crucial for client to have a convenient synchronous `sync`.

Refs: ZOOKEEPER-1167, ZOOKEEPER-4747
---
 .../java/org/apache/zookeeper/ZooKeeper.java  | 25 +++++++++++
 .../java/org/apache/zookeeper/ZKTestCase.java | 20 +++++++++
 .../server/quorum/EagerACLFilterTest.java     | 18 +-------
 .../quorum/QuorumRequestPipelineTest.java     | 13 ++++++
 .../org/apache/zookeeper/test/QuorumTest.java | 41 +++++++++----------
 .../apache/zookeeper/test/SessionTest.java    | 18 ++------
 6 files changed, 82 insertions(+), 53 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 4096ec3a7e5..5d85623d9b6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -2708,6 +2708,31 @@ public void getEphemerals(AsyncCallback.EphemeralsCallback cb, Object ctx) {
         getEphemerals("/", cb, ctx);
     }
 
+    /**
+     * Synchronous sync. Flushes channel between process and leader.
+     *
+     * @param path the given path
+     * @throws KeeperException If the server signals an error with a non-zero error code
+     * @throws InterruptedException If the server transaction is interrupted.
+     * @throws IllegalArgumentException if an invalid path is specified
+     */
+    public void sync(final String path) throws KeeperException, InterruptedException {
+        final String clientPath = path;
+        PathUtils.validatePath(clientPath);
+
+        final String serverPath = prependChroot(clientPath);
+
+        RequestHeader h = new RequestHeader();
+        h.setType(ZooDefs.OpCode.sync);
+        SyncRequest request = new SyncRequest();
+        SyncResponse response = new SyncResponse();
+        request.setPath(serverPath);
+        ReplyHeader r = cnxn.submitRequest(h, request, response, null);
+        if (r.getErr() != 0) {
+            throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
+        }
+    }
+
     /**
      * Asynchronous sync. Flushes channel between process and leader.
      * @param path
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index b29deedb0bc..db24797180b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -22,6 +22,7 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.time.Instant;
+import java.util.concurrent.CompletableFuture;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.hamcrest.CustomMatcher;
@@ -58,6 +59,25 @@ protected String getTestName() {
         return testName;
     }
 
+    public void syncClient(ZooKeeper zk, boolean synchronous) throws KeeperException {
+        if (synchronous) {
+            try {
+                zk.sync("/");
+            } catch (InterruptedException ex) {
+                throw new RuntimeException(ex);
+            }
+            return;
+        }
+        final CompletableFuture<KeeperException.Code> synced = new CompletableFuture<>();
+        zk.sync("/", (rc, path, ctx) -> {
+            synced.complete(KeeperException.Code.get(rc));
+        }, null);
+        KeeperException.Code code = synced.join();
+        if (code != KeeperException.Code.OK) {
+            throw KeeperException.create(code);
+        }
+    }
+
     @BeforeAll
     public static void before() {
         if (!testBaseDir.exists()) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
index 4141c586ff8..1af669fb511 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
@@ -22,13 +22,11 @@
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
-import java.util.concurrent.CompletableFuture;
 import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs.Ids;
-import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
@@ -95,18 +93,6 @@ public void setUp(ServerState serverState, boolean checkEnabled) throws Exceptio
         clientWatchB.waitForConnected(CONNECTION_TIMEOUT);
     }
 
-    void syncClient(ZooKeeper zk) {
-        CompletableFuture<Void> synced = new CompletableFuture<>();
-        zk.sync("/", (rc, path, ctx) -> {
-            if (rc == 0) {
-                synced.complete(null);
-            } else {
-                synced.completeExceptionally(KeeperException.create(KeeperException.Code.get(rc)));
-            }
-        }, null);
-        synced.join();
-    }
-
     @AfterEach
     public void tearDown() throws Exception {
         if (zkClient != null) {
@@ -124,7 +110,7 @@ private void ensureCheck(boolean enabled) {
         ZooKeeperServer.setEnableEagerACLCheck(enabled);
     }
 
-    private void assertTransactionState(String operation, QuorumPeer peer, long lastxid) {
+    private void assertTransactionState(String operation, QuorumPeer peer, long lastxid) throws Exception {
         if (peer == zkLeader && peer != zkConnected) {
             // The operation is performed on no leader, but we are asserting on leader.
             // There is no happen-before between `zkLeader.getLastLoggedZxid()` and
@@ -133,7 +119,7 @@ private void assertTransactionState(String operation, QuorumPeer peer, long last
             // to sync leader client to go through commit and response path in leader to
             // build happen-before between `zkLeader.getLastLoggedZxid()` and side effect
             // of previous operation.
-            syncClient(zkLeaderClient);
+            syncClient(zkLeaderClient, false);
         }
         assertTrue(peer == zkLeader || peer == zkConnected);
         boolean eagerACL = ZooKeeperServer.isEnableEagerACLCheck();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
index 624661044b6..f848b02895f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
@@ -26,6 +26,8 @@
 import java.util.HashSet;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ForkJoinPool;
+import java.util.concurrent.ForkJoinTask;
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Stream;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
@@ -179,4 +181,15 @@ public void processResult(int rc, String path, Object ctx) {
         assertTrue(complete, String.format("%s Sync completed", serverState));
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSynchronousSync(ServerState serverState) throws Exception {
+        setUp(serverState);
+        create2EmptyNode(zkClient, PARENT_PATH);
+        ForkJoinTask<Void> task = ForkJoinPool.commonPool().submit(() -> {
+            zkClient.sync(PARENT_PATH);
+            return null;
+        });
+        task.get(30, TimeUnit.SECONDS);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
index 1f2029b9a7e..e7e7f99a7bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
@@ -27,6 +27,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.DummyWatcher;
 import org.apache.zookeeper.KeeperException;
@@ -182,15 +183,24 @@ public void testMultipleWatcherObjs() throws IOException, InterruptedException,
     }
 
     /**
-     * Make sure that we can change sessions
-     *  from follower to leader.
-     *
-     * @throws IOException
-     * @throws InterruptedException
-     * @throws KeeperException
+     * Make sure that we can change sessions among servers and maintain consistent view
+     * using {@link ZooKeeper#sync(String)}.
      */
     @Test
-    public void testSessionMoved() throws Exception {
+    public void testSessionMovedWithSynchronousSync() throws Exception {
+        testSessionMoved(true);
+    }
+
+    /**
+     * Make sure that we can change sessions among servers and maintain consistent view
+     * using {@link ZooKeeper#sync(String, AsyncCallback.VoidCallback, Object)}.
+     */
+    @Test
+    public void testSessionMovedWithAsynchronousSync() throws Exception {
+        testSessionMoved(false);
+    }
+
+    public void testSessionMoved(boolean synchronous_sync) throws Exception {
         String[] hostPorts = qb.hostPort.split(",");
         DisconnectableZooKeeper zk = new DisconnectableZooKeeper(
             hostPorts[0],
@@ -208,21 +218,8 @@ public void testSessionMoved() throws Exception {
                 zk.getSessionId(),
                 zk.getSessionPasswd());
             zknew.setData("/", new byte[1], -1);
-            final int[] result = new int[1];
-            result[0] = Integer.MAX_VALUE;
-            zknew.sync("/", (rc, path, ctx) -> {
-                synchronized (result) {
-                    result[0] = rc;
-                    result.notify();
-                }
-            }, null);
-            synchronized (result) {
-                if (result[0] == Integer.MAX_VALUE) {
-                    result.wait(5000);
-                }
-            }
-            LOG.info("{} Sync returned {}", hostPorts[(i + 1) % hostPorts.length], result[0]);
-            assertTrue(result[0] == KeeperException.Code.OK.intValue());
+            syncClient(zknew, synchronous_sync);
+            LOG.info("{} Sync succeed", hostPorts[(i + 1) % hostPorts.length]);
             try {
                 zk.setData("/", new byte[1], -1);
                 fail("Should have lost the connection");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
index ff3bb4e9c7c..ce8c1e7714f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
@@ -243,21 +243,8 @@ public void testSessionMove() throws Exception {
                                                                                           % hostPorts.length], CONNECTION_TIMEOUT, new MyWatcher(Integer.toString(
                     i
                             + 1)), zk.getSessionId(), zk.getSessionPasswd());
-            final int[] result = new int[1];
-            result[0] = Integer.MAX_VALUE;
-            zknew.sync("/", (rc, path, ctx) -> {
-                synchronized (result) {
-                    result[0] = rc;
-                    result.notify();
-                }
-            }, null);
-            synchronized (result) {
-                if (result[0] == Integer.MAX_VALUE) {
-                    result.wait(5000);
-                }
-            }
-            LOG.info("{} Sync returned {}", hostPorts[(i + 1) % hostPorts.length], result[0]);
-            assertTrue(result[0] == KeeperException.Code.OK.intValue());
+            zknew.sync("/");
+            LOG.info("{} Sync succeed", hostPorts[(i + 1) % hostPorts.length]);
             zknew.setData("/", new byte[1], -1);
             try {
                 zk.setData("/", new byte[1], -1);
@@ -270,6 +257,7 @@ public void testSessionMove() throws Exception {
         }
         zk.close();
     }
+
     /**
      * This test makes sure that duplicate state changes are not communicated
      * to the client watcher. For example we should not notify state as

From 3c4e15ef8d1f9969bd69c545f2e88eefeec5cb93 Mon Sep 17 00:00:00 2001
From: whyer6 <134471301+whyer6@users.noreply.github.com>
Date: Tue, 10 Sep 2024 03:55:24 -0700
Subject: [PATCH 461/591] ZOOKEEPER-4733: non-return function error and asan
 error in CPPUNIT TESTs (#2045)

---
 zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc     | 4 ++--
 .../zookeeper-client-c/tests/ZooKeeperQuorumServer.cc         | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc b/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
index 22f87e94491..5ae9606b5f5 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
@@ -499,7 +499,7 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
             found = seen.find(next.str());
             CPPUNIT_ASSERT_MESSAGE(next.str() + " in seen list",
                                    found == string::npos);
-            seen += found + ", ";
+            seen += next.str() + ", ";
         }
 
         // Now it should start connecting to the old servers
@@ -516,7 +516,7 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
             // Assert not in seen list then append
             found = seen.find(next.str());
             CPPUNIT_ASSERT(found == string::npos);
-            seen += found + ", ";
+            seen += next.str() + ", ";
         }
 
         // NOW it goes back to normal as we've tried all the new and old
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc b/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc
index db79919c3c7..73548685712 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc
@@ -197,6 +197,7 @@ getCluster(uint32_t numServers) {
         }
     }
     assert(!"The cluster didn't start for 10 seconds");
+    return {};
 }
 
 std::vector<ZooKeeperQuorumServer*> ZooKeeperQuorumServer::

From 34c6d9fc1dd7e38d99173d13d22f960f7cf70b7e Mon Sep 17 00:00:00 2001
From: Luke Chen <showuon@gmail.com>
Date: Fri, 13 Sep 2024 00:11:10 +0900
Subject: [PATCH 462/591] ZOOKEEPER-4708: recreateSocketAddresses before
 comparing addresses

Reviewers: ppatierno, anmolnar, see-quick
Author: showuon
Closes #2041 from showuon/ZOOKEEPER-4708_2
---
 pom.xml                                       |  6 ++
 zookeeper-server/pom.xml                      |  5 ++
 .../zookeeper/server/quorum/Leader.java       | 11 ++-
 .../zookeeper/server/quorum/QuorumPeer.java   |  9 +++
 .../server/quorum/LeaderBeanTest.java         | 67 +++++++++++++++++++
 .../server/quorum/QuorumPeerTest.java         | 26 +++++++
 6 files changed, 122 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 30a5ed03d70..2fbab352667 100644
--- a/pom.xml
+++ b/pom.xml
@@ -703,6 +703,12 @@
         <artifactId>mockito-core</artifactId>
         <version>${mockito.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.mockito</groupId>
+        <artifactId>mockito-inline</artifactId>
+        <version>${mockito.version}</version>
+        <scope>test</scope>
+      </dependency>
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-bom</artifactId>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 00a3b533949..615527d6095 100644
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -147,6 +147,11 @@
       <artifactId>mockito-core</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-inline</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.jmockit</groupId>
       <artifactId>jmockit</artifactId>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 23e60b6b8c0..d4281871135 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -903,6 +903,12 @@ synchronized void closeSockets() {
        }
     }
 
+    MultipleAddresses recreateSocketAddresses(MultipleAddresses addr) {
+        return new MultipleAddresses(addr.getAllAddresses().stream()
+                .map(address -> new InetSocketAddress(address.getHostString(), address.getPort()))
+                .collect(Collectors.toSet()));
+    }
+
     /** In a reconfig operation, this method attempts to find the best leader for next configuration.
      *  If the current leader is a voter in the next configuration, then it remains the leader.
      *  Otherwise, choose one of the new voters that acked the reconfiguration, such that it is as
@@ -913,14 +919,15 @@ synchronized void closeSockets() {
      * @return server if of the designated leader
      */
 
-    private long getDesignatedLeader(Proposal reconfigProposal, long zxid) {
+    long getDesignatedLeader(Proposal reconfigProposal, long zxid) {
         //new configuration
         Proposal.QuorumVerifierAcksetPair newQVAcksetPair = reconfigProposal.qvAcksetPairs.get(reconfigProposal.qvAcksetPairs.size() - 1);
 
         //check if I'm in the new configuration with the same quorum address -
         // if so, I'll remain the leader
         if (newQVAcksetPair.getQuorumVerifier().getVotingMembers().containsKey(self.getMyId())
-            && newQVAcksetPair.getQuorumVerifier().getVotingMembers().get(self.getMyId()).addr.equals(self.getQuorumAddress())) {
+            && recreateSocketAddresses(newQVAcksetPair.getQuorumVerifier().getVotingMembers().get(self.getMyId()).addr)
+                .equals(recreateSocketAddresses(self.getQuorumAddress()))) {
             return self.getMyId();
         }
         // start with an initial set of candidates that are voters from new config that
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 6c089465b18..876a297f9aa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -2346,6 +2346,12 @@ public void setAcceptedEpoch(long e) throws IOException {
         acceptedEpoch = e;
     }
 
+    private void recreateSocketAddressesFromQV(QuorumVerifier qv) {
+        for (QuorumServer qs : qv.getAllMembers().values()) {
+            qs.recreateSocketAddresses();
+        }
+    }
+
     public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long zxid, boolean restartLE) {
         if (!isReconfigEnabled()) {
             LOG.debug("Reconfig feature is disabled, skip reconfig processing.");
@@ -2369,6 +2375,9 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
         // for Learner):
         initConfigInZKDatabase();
 
+        recreateSocketAddressesFromQV(prevQV);
+        recreateSocketAddressesFromQV(qv);
+
         if (prevQV.getVersion() < qv.getVersion() && !prevQV.equals(qv)) {
             Map<Long, QuorumServer> newMembers = qv.getAllMembers();
             updateRemotePeerMXBeans(newMembers);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 12fe04166f8..9c4e5214d4c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -24,14 +24,20 @@
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
@@ -42,6 +48,7 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.junit.jupiter.api.AfterEach;
@@ -222,4 +229,64 @@ public void testFollowerInfo() throws IOException {
         assertEquals("5\n", leaderBean.nonVotingFollowerInfo());
     }
 
+    @Test
+    public void testGetDesignatedLeaderShouldRecreateSocketAddresses() {
+        Leader.Proposal p = new Leader.Proposal();
+        Map<Long, QuorumServer> peersView = new HashMap<>();
+        QuorumServer qs = Mockito.mock(QuorumServer.class);
+        MultipleAddresses multipleAddresses = new MultipleAddresses();
+        qs.type = LearnerType.PARTICIPANT;
+        qs.addr = multipleAddresses;
+        peersView.put(0L, qs);
+        QuorumVerifier qv = new QuorumMaj(peersView);
+        HashSet<Long> ackset = new HashSet<>();
+        ackset.add(0L);
+        ArrayList<Leader.Proposal.QuorumVerifierAcksetPair> qvAcksetPairs = new ArrayList<>();
+        qvAcksetPairs.add(new Leader.Proposal.QuorumVerifierAcksetPair(qv, ackset));
+        p.qvAcksetPairs = qvAcksetPairs;
+        Leader spyLeader = spy(leader);
+        doReturn(multipleAddresses, multipleAddresses).when(spyLeader).recreateSocketAddresses(any(MultipleAddresses.class));
+
+        spyLeader.getDesignatedLeader(p, 0L);
+        // Verify `recreateSocketAddresses` method should be invoked twice for the address in proposal and self one
+        verify(spyLeader, times(2)).recreateSocketAddresses(any(MultipleAddresses.class));
+    }
+
+    @Test
+    public void testRecreateSocketAddresses() {
+        InetAddress loopback = InetAddress.getLoopbackAddress();
+        String oldIP = loopback.getHostAddress();
+        String newIP = "1.1.1.1";
+
+        // test case 1: empty MultipleAddresses instance will still be empty after recreateSocketAddresses
+        MultipleAddresses multipleAddresses = new MultipleAddresses();
+        assertEquals(multipleAddresses, leader.recreateSocketAddresses(multipleAddresses));
+
+        // test case 2: The content of MultipleAddresses instance will still be the same after recreateSocketAddresses if address no change
+        InetSocketAddress addr1 = new InetSocketAddress(loopback, PortAssignment.unique());
+        InetSocketAddress addr2 = new InetSocketAddress(loopback, PortAssignment.unique());
+        multipleAddresses = new MultipleAddresses(Arrays.asList(addr1, addr2));
+        // Verify after recreateSocketAddresses, the multipleAddresses should be the same (i.e. under no DNS's interaction)
+        assertEquals(multipleAddresses, leader.recreateSocketAddresses(multipleAddresses));
+
+        // test case 3: Simulating the DNS returning different IP address for the same hostname during recreation.
+        // After recreateSocketAddresses, the MultipleAddresses should contain the updated IP address instance while other fields unchanged.
+        InetAddress spyInetAddr = Mockito.spy(loopback);
+        InetSocketAddress addr3 = new InetSocketAddress(spyInetAddr, PortAssignment.unique());
+        // Verify the address is the old IP before recreateSocketAddresses.
+        assertEquals(oldIP, addr3.getAddress().getHostAddress());
+        multipleAddresses = new MultipleAddresses(Arrays.asList(addr3));
+        // simulating the DNS returning different IP address
+        when(spyInetAddr.getHostAddress()).thenReturn(newIP);
+
+        // Verify after recreateSocketAddresses, the multipleAddresses should have different IP address result
+        MultipleAddresses newMultipleAddress = leader.recreateSocketAddresses(multipleAddresses);
+        assertNotEquals(multipleAddresses, newMultipleAddress);
+        assertEquals(1, multipleAddresses.getAllAddresses().size());
+        InetSocketAddress newAddr = multipleAddresses.getAllAddresses().iterator().next();
+        // Verify the hostName should still be the same
+        assertEquals(loopback.getHostName(), newAddr.getAddress().getHostName());
+        // Verify the IP address has changed.
+        assertEquals(newIP, newAddr.getAddress().getHostAddress());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
index 65e5fa59037..3a7e88955b5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
@@ -25,13 +25,17 @@
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mockito;
 
 public class QuorumPeerTest {
 
@@ -76,6 +80,28 @@ public void testQuorumPeerListendOnSpecifiedClientIP(@TempDir File dataDir) thro
         peer2.shutdown();
     }
 
+    @Test
+    public void testProcessReconfigWillRecreateSocketAddresses() throws IOException {
+        QuorumPeerConfig.setReconfigEnabled(true);
+        QuorumPeer peer = new QuorumPeer();
+
+        File file = Files.createTempFile("", ".tmp").toFile();
+        file.deleteOnExit();
+
+        peer.setConfigFileName(file.getAbsoluteFile().toString());
+
+        Map<Long, QuorumServer> peersView = new HashMap<>();
+        QuorumServer qs = Mockito.mock(QuorumServer.class);
+        peersView.put(0L, qs);
+
+        QuorumVerifier qv = new QuorumMaj(peersView);
+        peer.setQuorumVerifier(qv, false);
+        peer.processReconfig(qv, 0L, 0L, false);
+
+        // verify the qs will recreateSocketAddresses twice for both the old qv and the new qv
+        Mockito.verify(qs, Mockito.times(2)).recreateSocketAddresses();
+    }
+
     @Test
     public void testLocalPeerIsLeader() throws Exception {
         long localPeerId = 7;

From 978d431f6e241dd7f58c5b105afcf4443f5bcbcb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 17 Sep 2024 10:34:39 -0500
Subject: [PATCH 463/591] ZOOKEEPER-4860: Disable X-Forwarded-For by default

Reviewers: eolivelli, purushah
Author: anmolnar
Closes #2187 from anmolnar/ZOOKEEPER-4860
---
 .../main/resources/markdown/zookeeperAdmin.md | 15 ++++++-----
 .../server/auth/IPAuthenticationProvider.java |  4 +--
 .../auth/IPAuthenticationProviderTest.java    | 26 ++++++++++++++-----
 .../org/apache/zookeeper/test/IPAuthTest.java | 17 +++++++++---
 4 files changed, 44 insertions(+), 18 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 4096a1fdecf..5ad9fb45bca 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1572,14 +1572,15 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
         - 1. Regenerate `superDigest` when migrating to new algorithm.
         - 2. `SetAcl` for a znode which already had a digest auth of old algorithm.
 
-* *IPAuthenticationProvider.skipxforwardedfor* :
-    (Java system property: **zookeeper.IPAuthenticationProvider.skipxforwardedfor**)
+* *IPAuthenticationProvider.usexforwardedfor* :
+    (Java system property: **zookeeper.IPAuthenticationProvider.usexforwardedfor**)
     **New in 3.9.3:**
-    IPAuthenticationProvider needs the client IP address to authenticate the user.
-    By default, it tries to read **X-Forwarded-For** HTTP header first and if it's not
-    found, reads the **Host** header. Some proxy configuration requires this to
-    properly identify the client IP, but we can disable it relying only on the **Host**
-    header by setting this config option to **true**.
+    IPAuthenticationProvider uses the client IP address to authenticate the user. By 
+    default it reads the **Host** HTTP header to detect client IP address. In some 
+    proxy configurations the proxy server adds the **X-Forwarded-For** header to
+    the request in order to provide the IP address of the original client request. 
+    By enabling **usexforwardedfor** ZooKeeper setting, **X-Forwarded-For** will be preferred
+    over the standard **Host** header.
     Default value is **false**.
 
 * *X509AuthenticationProvider.superUser* :
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
index c73d12f78c2..26c14a4e81e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
@@ -30,7 +30,7 @@
 public class IPAuthenticationProvider implements AuthenticationProvider {
     public static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
 
-    static final String SKIP_X_FORWARDED_FOR_KEY = "zookeeper.IPAuthenticationProvider.skipxforwardedfor";
+    public static final String USE_X_FORWARDED_FOR_KEY = "zookeeper.IPAuthenticationProvider.usexforwardedfor";
 
     public String getScheme() {
         return "ip";
@@ -152,7 +152,7 @@ public boolean isValid(String id) {
      * @return IP address
      */
     public static String getClientIPAddress(final HttpServletRequest request) {
-        if (Boolean.getBoolean(SKIP_X_FORWARDED_FOR_KEY)) {
+        if (!Boolean.getBoolean(USE_X_FORWARDED_FOR_KEY)) {
             return request.getRemoteAddr();
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
index fc814f7ea5b..c1a1d1f520e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
@@ -17,7 +17,7 @@
  */
 package org.apache.zookeeper.server.auth;
 
-import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.SKIP_X_FORWARDED_FOR_KEY;
+import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY;
 import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME;
 import static org.junit.Assert.assertEquals;
 import static org.mockito.Mockito.doReturn;
@@ -33,19 +33,33 @@ public class IPAuthenticationProviderTest {
 
   @Before
   public void setUp() throws Exception {
-    System.clearProperty(SKIP_X_FORWARDED_FOR_KEY);
+    System.clearProperty(USE_X_FORWARDED_FOR_KEY);
     request = mock(HttpServletRequest.class);
   }
 
   @After
   public void tearDown() {
-    System.clearProperty(SKIP_X_FORWARDED_FOR_KEY);
+    System.clearProperty(USE_X_FORWARDED_FOR_KEY);
   }
 
   @Test
   public void testGetClientIPAddressSkipXForwardedFor() {
     // Arrange
-    System.setProperty(SKIP_X_FORWARDED_FOR_KEY, "true");
+    System.setProperty(USE_X_FORWARDED_FOR_KEY, "false");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+    doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.1", clientIp);
+  }
+
+  @Test
+  public void testGetClientIPAddressDefaultBehaviour() {
+    // Arrange
+    System.clearProperty(USE_X_FORWARDED_FOR_KEY);
     doReturn("192.168.1.1").when(request).getRemoteAddr();
     doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
 
@@ -59,7 +73,7 @@ public void testGetClientIPAddressSkipXForwardedFor() {
   @Test
   public void testGetClientIPAddressWithXForwardedFor() {
     // Arrange
-    System.setProperty(SKIP_X_FORWARDED_FOR_KEY, "false");
+    System.setProperty(USE_X_FORWARDED_FOR_KEY, "true");
     doReturn("192.168.1.1").when(request).getRemoteAddr();
     doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
 
@@ -73,7 +87,7 @@ public void testGetClientIPAddressWithXForwardedFor() {
   @Test
   public void testGetClientIPAddressMissingXForwardedFor() {
     // Arrange
-    System.setProperty(SKIP_X_FORWARDED_FOR_KEY, "false");
+    System.setProperty(USE_X_FORWARDED_FOR_KEY, "false");
     doReturn("192.168.1.1").when(request).getRemoteAddr();
 
     // Act
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
index 45ce447fe30..b50b8ed76be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
@@ -23,13 +23,24 @@
 import java.util.Arrays;
 import java.util.List;
 import javax.servlet.http.HttpServletRequest;
-import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
-import org.junit.jupiter.api.Test;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
 import org.mockito.Mockito;
 
-public class IPAuthTest extends ZKTestCase {
+public class IPAuthTest {
+    @Before
+    public void setUp() {
+        System.setProperty(IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY, "true");
+    }
+
+    @After
+    public void tearDown() {
+        System.clearProperty(IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY);
+    }
+
     @Test
     public void testHandleAuthentication_Forwarded() {
         final IPAuthenticationProvider provider = new IPAuthenticationProvider();

From 52f7af54c9f25992f71fc51acd165c01ab6781c5 Mon Sep 17 00:00:00 2001
From: fanyang <fanyang@smartx.com>
Date: Thu, 19 Sep 2024 04:34:23 +0800
Subject: [PATCH 464/591] ZOOKEEPER-2332: Fix server failed to start for empty
 txn log

Reviewers: kezhuw, anmolnar, kezhuw
Author: fanyang89
Closes #2141 from fanyang89/ZOOKEEPER-2332
---
 .../server/persistence/FileTxnLog.java        | 28 ++++++-
 .../server/persistence/FileTxnLogTest.java    | 84 +++++++++++++++++++
 2 files changed, 109 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index e90a19e2c9c..e14e510c2be 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -227,6 +227,13 @@ public synchronized long getTotalLogSize() {
         return prevLogsRunningTotal + getCurrentLogSize();
     }
 
+    /**
+     * Get log size limit
+     */
+    public static long getTxnLogSizeLimit() {
+        return txnLogSizeLimit;
+    }
+
     /**
      * creates a checksum algorithm to be used
      * @return the checksum used for this txnlog
@@ -701,14 +708,29 @@ public long getStorageSize() {
 
         /**
          * go to the next logfile
+         *
          * @return true if there is one and false if there is no
          * new file to be read
-         * @throws IOException
          */
         private boolean goToNextLog() throws IOException {
-            if (storedFiles.size() > 0) {
+            if (!storedFiles.isEmpty()) {
                 this.logFile = storedFiles.remove(storedFiles.size() - 1);
-                ia = createInputArchive(this.logFile);
+                try {
+                    ia = createInputArchive(this.logFile);
+                } catch (EOFException ex) {
+                    // If this file is the last log file in the database and is empty,
+                    // it means that the last time the file was created
+                    // before the header was written.
+                    if (storedFiles.isEmpty() && this.logFile.length() == 0) {
+                        boolean deleted = this.logFile.delete();
+                        if (!deleted) {
+                            throw new IOException("Failed to delete empty tail log file: " + this.logFile.getName());
+                        }
+                        LOG.warn("Delete empty tail log file to recover from corruption file: {}", this.logFile.getName());
+                        return false;
+                    }
+                    throw ex;
+                }
                 return true;
             }
             return false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index d547e34f439..5a8cb02f10a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -25,11 +25,17 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
+import java.io.EOFException;
 import java.io.File;
 import java.io.IOException;
+import java.io.PrintWriter;
 import java.util.Arrays;
+import java.util.Comparator;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
 import java.util.Random;
+import java.util.stream.Collectors;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.DummyWatcher;
@@ -296,6 +302,84 @@ public void testLogSizeLimit(@TempDir File tmpDir) throws Exception {
         }
     }
 
+    private void prepareTxnLogs(File dir, int n) throws IOException {
+        FileTxnLog.setTxnLogSizeLimit(1);
+        FileTxnLog log = new FileTxnLog(dir);
+        CreateRequest record = new CreateRequest(null, new byte[NODE_SIZE],
+                ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT.toFlag());
+        int zxid = 1;
+        for (int i = 0; i < n; i++) {
+            log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid, 0, -1), record, zxid));
+            zxid++;
+            log.commit();
+        }
+        log.close();
+    }
+
+    @Test
+    public void testEmptyTailTxnLog() throws IOException {
+        long limit = FileTxnLog.getTxnLogSizeLimit();
+
+        // prepare a database with logs
+        File tmpDir = ClientBase.createTmpDir();
+        ClientBase.setupTestEnv();
+        prepareTxnLogs(tmpDir, 4);
+
+        // find the tail log and clear
+        List<File> files = Arrays.
+                stream(Objects.requireNonNull(tmpDir.listFiles((File f, String name) -> name.startsWith("log.")))).
+                sorted(Comparator.comparing(File::getName)).
+                collect(Collectors.toList());
+        File toClear = files.get(files.size() - 1);
+        PrintWriter writer = new PrintWriter(toClear);
+        writer.close();
+        LOG.info("Clear the tail log file {}", toClear.getName());
+
+        // open txn log and iterate
+        try {
+            FileTxnLog.FileTxnIterator itr = new FileTxnLog.FileTxnIterator(tmpDir, 0x0, false);
+            while (itr.next()) {}
+        } catch (EOFException ex) {}
+
+        FileTxnLog.FileTxnIterator itr = new FileTxnLog.FileTxnIterator(tmpDir, 0x0, false);
+        while (itr.next()) {}
+
+        FileTxnLog.setTxnLogSizeLimit(limit);
+    }
+
+    @Test
+    public void testEmptyMedianTxnLog() throws IOException {
+        long limit = FileTxnLog.getTxnLogSizeLimit();
+
+        // prepare a database with logs
+        File tmpDir = ClientBase.createTmpDir();
+        ClientBase.setupTestEnv();
+        prepareTxnLogs(tmpDir, 4);
+
+        // find the median log and clear
+        List<File> files = Arrays.
+                stream(Objects.requireNonNull(tmpDir.listFiles((File f, String name) -> name.startsWith("log.")))).
+                sorted(Comparator.comparing(File::getName)).
+                collect(Collectors.toList());
+        File toClear = files.get(files.size() - 2);
+
+        PrintWriter writer = new PrintWriter(toClear);
+        writer.close();
+        LOG.info("Clear the median log file {}", toClear.getName());
+
+        // open txn log and iterate, should throw EOFException
+        boolean isEof = false;
+        try {
+            FileTxnLog.FileTxnIterator itr = new FileTxnLog.FileTxnIterator(tmpDir, 0x0, false);
+            while (itr.next()) {}
+        } catch (EOFException ex) {
+            isEof = true;
+        }
+        assertTrue(isEof, "Median txn log file empty should throw Exception");
+
+        FileTxnLog.setTxnLogSizeLimit(limit);
+    }
+
     private int calculateSingleRecordLength(TxnHeader txnHeader, Record record) throws IOException {
         int crcLength = 8;
         int dataLength = 4;

From ff2406d23990b9612f6c36a72863e5e339aca988 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr@github.copernik.eu>
Date: Thu, 19 Sep 2024 05:06:52 +0200
Subject: [PATCH 465/591] ZOOKEEPER-4820: Fix propagation of Logback
 dependencies

Reviewers: ctubbsii, shoothzj, ctubbsii, kezhuw
Author: ppkarwasz
Closes #2155 from ppkarwasz/fix/4820_change_logback_scope
---
 zookeeper-assembly/pom.xml                           |  4 ++++
 .../zookeeper-contrib-zooinspector/pom.xml           | 12 ++++--------
 zookeeper-server/pom.xml                             |  6 ++----
 3 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index 37fb0eae0df..160f9e1b9d0 100644
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -103,6 +103,10 @@
       <groupId>jline</groupId>
       <artifactId>jline</artifactId>
     </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+    </dependency>
     <dependency>
        <groupId>io.dropwizard.metrics</groupId>
        <artifactId>metrics-core</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index 778d0386977..d8f75e55129 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -91,13 +91,9 @@
     </dependency>
     <dependency>
       <groupId>ch.qos.logback</groupId>
-      <artifactId>logback-core</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
+      <artifactId>logback-classic</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.junit.vintage</groupId>
@@ -121,4 +117,4 @@
       <scope>test</scope>
     </dependency>
   </dependencies>
-</project>
\ No newline at end of file
+</project>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 615527d6095..495e4847919 100644
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -79,13 +79,11 @@
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
     </dependency>
-    <dependency>
-      <groupId>ch.qos.logback</groupId>
-      <artifactId>logback-core</artifactId>
-    </dependency>
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>

From 9fcb805fa1bb37b1f64ceb3bc5d7ccf349971bb7 Mon Sep 17 00:00:00 2001
From: AlphaCanisMajoris <120192701+AlphaCanisMajoris@users.noreply.github.com>
Date: Thu, 19 Sep 2024 23:28:02 +0800
Subject: [PATCH 466/591] ZOOKEEPER-4394: Apply only committed requests in sync
 with leader before NEWLEADER ACK

Reviewers: kezhuw, anmolnar, kezhuw
Author: AlphaCanisMajoris
Closes #2152 from AlphaCanisMajoris/ZK-4643
---
 .../zookeeper/server/ZooKeeperServer.java     |  15 +-
 .../quorum/FollowerZooKeeperServer.java       |   7 +-
 .../zookeeper/server/quorum/Learner.java      |  80 +++++----
 .../zookeeper/server/quorum/Zab1_0Test.java   | 165 +++++++++++++++---
 4 files changed, 196 insertions(+), 71 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 598a6976876..af4147afd9e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -793,19 +793,6 @@ public void startdata() throws IOException, InterruptedException {
     }
 
     public synchronized void startup() {
-        startupWithServerState(State.RUNNING);
-    }
-
-    public synchronized void startupWithoutServing() {
-        startupWithServerState(State.INITIAL);
-    }
-
-    public synchronized void startServing() {
-        setState(State.RUNNING);
-        notifyAll();
-    }
-
-    private void startupWithServerState(State state) {
         if (sessionTracker == null) {
             createSessionTracker();
         }
@@ -820,7 +807,7 @@ private void startupWithServerState(State state) {
 
         registerMetrics();
 
-        setState(state);
+        setState(State.RUNNING);
 
         requestPathMetricsCollector.start();
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
index 5af114dccd1..b6766199988 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
@@ -89,12 +89,11 @@ public void logRequest(TxnHeader hdr, Record txn, TxnDigest digest) {
      * @param hdr the txn header
      * @param txn the txn
      * @param digest the digest of txn
-     * @return a request moving through a chain of RequestProcessors
      */
-    public Request appendRequest(final TxnHeader hdr, final Record txn, final TxnDigest digest) throws IOException {
-        final Request request = buildRequestToProcess(hdr, txn, digest);
+    public void appendRequest(final TxnHeader hdr, final Record txn, final TxnDigest digest) throws IOException {
+        final Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
+        request.setTxnDigest(digest);
         getZKDatabase().append(request);
-        return request;
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 3fe981ccef6..bb7be70dda2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -555,8 +555,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         boolean syncSnapshot = false;
         readPacket(qp);
         Deque<Long> packetsCommitted = new ArrayDeque<>();
-        Deque<PacketInFlight> packetsNotCommitted = new ArrayDeque<>();
-        Deque<Request> requestsToAck = new ArrayDeque<>();
+        Deque<PacketInFlight> packetsNotLogged = new ArrayDeque<>();
 
         synchronized (zk) {
             if (qp.getType() == Leader.DIFF) {
@@ -645,11 +644,11 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         self.setLastSeenQuorumVerifier(qv, true);
                     }
 
-                    packetsNotCommitted.add(pif);
+                    packetsNotLogged.add(pif);
                     break;
                 case Leader.COMMIT:
                 case Leader.COMMITANDACTIVATE:
-                    pif = packetsNotCommitted.peekFirst();
+                    pif = packetsNotLogged.peekFirst();
                     if (pif.hdr.getZxid() == qp.getZxid() && qp.getType() == Leader.COMMITANDACTIVATE) {
                         QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) pif.rec).getData(), UTF_8));
                         boolean majorChange = self.processReconfig(
@@ -668,7 +667,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                                 Long.toHexString(pif.hdr.getZxid()));
                         } else {
                             zk.processTxn(pif.hdr, pif.rec);
-                            packetsNotCommitted.remove();
+                            packetsNotLogged.remove();
                         }
                     } else {
                         packetsCommitted.add(qp.getZxid());
@@ -710,7 +709,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         // Apply to db directly if we haven't taken the snapshot
                         zk.processTxn(packet.hdr, packet.rec);
                     } else {
-                        packetsNotCommitted.add(packet);
+                        packetsNotLogged.add(packet);
                         packetsCommitted.add(qp.getZxid());
                     }
 
@@ -753,29 +752,55 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     isPreZAB1_0 = false;
 
                     // ZOOKEEPER-3911: make sure sync the uncommitted logs before commit them (ACK NEWLEADER).
-                    sock.setSoTimeout(self.tickTime * self.syncLimit);
-                    self.setSyncMode(QuorumPeer.SyncMode.NONE);
-                    zk.startupWithoutServing();
-                    if (zk instanceof FollowerZooKeeperServer) {
+                    if (zk instanceof FollowerZooKeeperServer && !packetsCommitted.isEmpty()) {
                         long startTime = Time.currentElapsedTime();
                         FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
-                        for (PacketInFlight p : packetsNotCommitted) {
-                            final Request request = fzk.appendRequest(p.hdr, p.rec, p.digest);
-                            requestsToAck.add(request);
+
+                        /*
+                         * @see https://github.com/apache/zookeeper/pull/1848
+                         * Persist and process the committed txns in "packetsNotLogged"
+                         * according to "packetsCommitted", which have been committed by
+                         * the leader. For these committed proposals, there is no need to
+                         * reply ack.
+                         *
+                         * @see https://issues.apache.org/jira/browse/ZOOKEEPER-4394
+                         * Keep the outstanding proposals in "packetsNotLogged" to avoid
+                         * NullPointerException when the follower receives COMMIT packet(s)
+                         * right after replying NEWLEADER ack.
+                         */
+                        while (!packetsCommitted.isEmpty()) {
+                            long zxid = packetsCommitted.removeFirst();
+                            pif = packetsNotLogged.peekFirst();
+                            if (pif == null) {
+                                LOG.warn("Committing 0x{}, but got no proposal", Long.toHexString(zxid));
+                                continue;
+                            } else if (pif.hdr.getZxid() != zxid) {
+                                LOG.warn("Committing 0x{}, but next proposal is 0x{}",
+                                        Long.toHexString(zxid), Long.toHexString(pif.hdr.getZxid()));
+                                continue;
+                            }
+                            packetsNotLogged.removeFirst();
+                            fzk.appendRequest(pif.hdr, pif.rec, pif.digest);
+                            fzk.processTxn(pif.hdr, pif.rec);
                         }
 
-                        // persist the txns to disk
+                        // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4646
+                        // Make sure to persist the txns to disk before replying NEWLEADER ack.
                         fzk.getZKDatabase().commit();
-                        LOG.info("{} txns have been persisted and it took {}ms",
-                        packetsNotCommitted.size(), Time.currentElapsedTime() - startTime);
-                        packetsNotCommitted.clear();
+                        LOG.info("It took {}ms to persist and commit txns in packetsCommitted. "
+                                        + "{} outstanding txns left in packetsNotLogged",
+                                Time.currentElapsedTime() - startTime, packetsNotLogged.size());
                     }
 
-                    // set the current epoch after all the tnxs are persisted
+                    // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4643
+                    // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4785
+                    // Update current epoch after the committed txns are persisted
                     self.setCurrentEpoch(newEpoch);
                     LOG.info("Set the current epoch to {}", newEpoch);
+                    sock.setSoTimeout(self.tickTime * self.syncLimit);
+                    self.setSyncMode(QuorumPeer.SyncMode.NONE);
 
-                    // send NEWLEADER ack after all the tnxs are persisted
+                    // send NEWLEADER ack after the committed txns are persisted
                     writePacket(new QuorumPacket(Leader.ACK, newLeaderZxid, null, null), true);
                     LOG.info("Sent NEWLEADER ack to leader with zxid {}", Long.toHexString(newLeaderZxid));
                     break;
@@ -784,7 +809,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         }
         ack.setZxid(ZxidUtils.makeZxid(newEpoch, 0));
         writePacket(ack, true);
-        zk.startServing();
+        zk.startup();
         /*
          * Update the election vote here to ensure that all members of the
          * ensemble report the same vote to new servers that start up and
@@ -796,20 +821,11 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
 
         // We need to log the stuff that came in between the snapshot and the uptodate
         if (zk instanceof FollowerZooKeeperServer) {
-            // reply ACK of PROPOSAL after ACK of NEWLEADER to avoid leader shutdown due to timeout
-            // on waiting for a quorum of followers
-            for (final Request request : requestsToAck) {
-                final QuorumPacket ackPacket = new QuorumPacket(Leader.ACK, request.getHdr().getZxid(), null, null);
-                writePacket(ackPacket, false);
-            }
-            writePacket(null, true);
-            requestsToAck.clear();
-
             FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
-            for (PacketInFlight p : packetsNotCommitted) {
+            for (PacketInFlight p : packetsNotLogged) {
                 fzk.logRequest(p.hdr, p.rec, p.digest);
             }
-            LOG.info("{} txns have been logged asynchronously", packetsNotCommitted.size());
+            LOG.info("{} txns have been logged asynchronously", packetsNotLogged.size());
 
             for (Long zxid : packetsCommitted) {
                 fzk.commit(zxid);
@@ -819,7 +835,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
             // Similar to follower, we need to log requests between the snapshot
             // and UPTODATE
             ObserverZooKeeperServer ozk = (ObserverZooKeeperServer) zk;
-            for (PacketInFlight p : packetsNotCommitted) {
+            for (PacketInFlight p : packetsNotLogged) {
                 Long zxid = packetsCommitted.peekFirst();
                 if (p.hdr.getZxid() != zxid) {
                     // log warning message if there is no matching commit
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index 76a678f501c..d374062e293 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -741,8 +741,8 @@ public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f)
 
                     readPacketSkippingPing(ia, qp);
                     assertEquals(Leader.ACKEPOCH, qp.getType());
-                    assertEquals(0, qp.getZxid());
-                    assertEquals(ZxidUtils.makeZxid(0, 0), ByteBuffer.wrap(qp.getData()).getInt());
+                    assertEquals(ZxidUtils.makeZxid(0, 0), qp.getZxid());
+                    assertEquals(0, ByteBuffer.wrap(qp.getData()).getInt());
                     assertEquals(1, f.self.getAcceptedEpoch());
                     assertEquals(0, f.self.getCurrentEpoch());
 
@@ -765,36 +765,22 @@ public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f)
                     qp.setZxid(0);
                     oa.writeRecord(qp, null);
 
-                    // Read the uptodate ack
-                    readPacketSkippingPing(ia, qp);
-                    assertEquals(Leader.ACK, qp.getType());
-                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
-
                     // Get the ack of the new leader
                     readPacketSkippingPing(ia, qp);
                     assertEquals(Leader.ACK, qp.getType());
                     assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
                     assertEquals(1, f.self.getAcceptedEpoch());
                     assertEquals(1, f.self.getCurrentEpoch());
-
-                    //Wait for the transactions to be written out. The thread that writes them out
-                    // does not send anything back when it is done.
-                    long start = System.currentTimeMillis();
-                    while (createSessionZxid != f.fzk.getLastProcessedZxid()
-                                   && (System.currentTimeMillis() - start) < 50) {
-                        Thread.sleep(1);
-                    }
-
                     assertEquals(createSessionZxid, f.fzk.getLastProcessedZxid());
 
+                    // Read the uptodate ack
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
+
                     // Make sure the data was recorded in the filesystem ok
                     ZKDatabase zkDb2 = new ZKDatabase(new FileTxnSnapLog(logDir, snapDir));
-                    start = System.currentTimeMillis();
                     zkDb2.loadDataBase();
-                    while (zkDb2.getSessionWithTimeOuts().isEmpty() && (System.currentTimeMillis() - start) < 50) {
-                        Thread.sleep(1);
-                        zkDb2.loadDataBase();
-                    }
                     LOG.info("zkdb2 sessions:{}", zkDb2.getSessions());
                     LOG.info("zkdb2 with timeouts:{}", zkDb2.getSessionWithTimeOuts());
                     assertNotNull(zkDb2.getSessionWithTimeOuts().get(4L));
@@ -820,6 +806,143 @@ private void proposeNewSession(QuorumPacket qp, long zxid, long sessionId) throw
         }, testData);
     }
 
+    @Test
+    public void testNormalFollowerRun_ProcessCommitInSyncAfterAckNewLeader(@TempDir File testData) throws Exception {
+        testFollowerConversation(new FollowerConversation() {
+            @Override
+            public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f) throws Exception {
+                File tmpDir = File.createTempFile("test", "dir", testData);
+                tmpDir.delete();
+                tmpDir.mkdir();
+                File logDir = f.fzk.getTxnLogFactory().getDataLogDir().getParentFile();
+                File snapDir = f.fzk.getTxnLogFactory().getSnapDir().getParentFile();
+                //Spy on ZK so we can check if a snapshot happened or not.
+                f.zk = spy(f.zk);
+                try {
+                    assertEquals(0, f.self.getAcceptedEpoch());
+                    assertEquals(0, f.self.getCurrentEpoch());
+
+                    // Setup a database with a single /foo node
+                    ZKDatabase zkDb = new ZKDatabase(new FileTxnSnapLog(tmpDir, tmpDir));
+                    final long firstZxid = ZxidUtils.makeZxid(1, 1);
+                    zkDb.processTxn(new TxnHeader(13, 1313, firstZxid, 33, ZooDefs.OpCode.create), new CreateTxn("/foo", "data1".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 1), null);
+                    Stat stat = new Stat();
+                    assertEquals("data1", new String(zkDb.getData("/foo", stat, null)));
+
+                    QuorumPacket qp = new QuorumPacket();
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.FOLLOWERINFO, qp.getType());
+                    assertEquals(qp.getZxid(), 0);
+                    LearnerInfo learnInfo = new LearnerInfo();
+                    ByteBufferInputStream.byteBuffer2Record(ByteBuffer.wrap(qp.getData()), learnInfo);
+                    assertEquals(learnInfo.getProtocolVersion(), 0x10000);
+                    assertEquals(learnInfo.getServerid(), 0);
+
+                    // We are simulating an established leader, so the epoch is 1
+                    qp.setType(Leader.LEADERINFO);
+                    qp.setZxid(ZxidUtils.makeZxid(1, 0));
+                    byte[] protoBytes = new byte[4];
+                    ByteBuffer.wrap(protoBytes).putInt(0x10000);
+                    qp.setData(protoBytes);
+                    oa.writeRecord(qp, null);
+
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACKEPOCH, qp.getType());
+                    assertEquals(0, qp.getZxid());
+                    assertEquals(ZxidUtils.makeZxid(0, 0), ByteBuffer.wrap(qp.getData()).getInt());
+                    assertEquals(1, f.self.getAcceptedEpoch());
+                    assertEquals(0, f.self.getCurrentEpoch());
+
+                    // Send the snapshot we created earlier
+                    qp.setType(Leader.SNAP);
+                    qp.setData(new byte[0]);
+                    qp.setZxid(zkDb.getDataTreeLastProcessedZxid());
+                    oa.writeRecord(qp, null);
+                    zkDb.serializeSnapshot(oa);
+                    oa.writeString("BenWasHere", null);
+                    Thread.sleep(10); //Give it some time to process the snap
+                    //No Snapshot taken yet, the SNAP was applied in memory
+                    verify(f.zk, never()).takeSnapshot();
+
+                    // Leader sends an outstanding proposal
+                    long proposalZxid = ZxidUtils.makeZxid(1, 1001);
+                    proposeSetData(qp, proposalZxid, "data2", 2);
+                    oa.writeRecord(qp, null);
+
+                    qp.setType(Leader.NEWLEADER);
+                    qp.setZxid(ZxidUtils.makeZxid(1, 0));
+                    qp.setData(null);
+                    oa.writeRecord(qp, null);
+
+                    // Get the ack of the new leader
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
+                    assertEquals(1, f.self.getAcceptedEpoch());
+                    assertEquals(1, f.self.getCurrentEpoch());
+                    //Make sure that we did take the snapshot now
+                    verify(f.zk).takeSnapshot(true);
+                    assertEquals(firstZxid, f.fzk.getLastProcessedZxid());
+
+                    // The outstanding proposal has not been persisted yet
+                    ZKDatabase zkDb2 = new ZKDatabase(new FileTxnSnapLog(logDir, snapDir));
+                    long lastZxid = zkDb2.loadDataBase();
+                    assertEquals("data1", new String(zkDb2.getData("/foo", stat, null)));
+                    assertEquals(firstZxid, lastZxid);
+
+                    TrackerWatcher watcher = new TrackerWatcher();
+
+                    // The change should not have happened yet
+                    assertEquals("data1", new String(f.fzk.getZKDatabase().getData("/foo", stat, watcher)));
+
+                    // Leader commits proposalZxid right after it sends NEWLEADER to follower
+                    qp.setType(Leader.COMMIT);
+                    qp.setZxid(proposalZxid);
+                    qp.setData(null);
+                    oa.writeRecord(qp, null);
+
+                    qp.setType(Leader.UPTODATE);
+                    qp.setZxid(0);
+                    qp.setData(null);
+                    oa.writeRecord(qp, null);
+
+                    // Read the uptodate ack
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
+
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(proposalZxid, qp.getZxid());
+
+                    // The change should happen now
+                    watcher.waitForChange();
+                    assertEquals("data2", new String(f.fzk.getZKDatabase().getData("/foo", stat, null)));
+
+                    // check and make sure the change is persisted
+                    zkDb2 = new ZKDatabase(new FileTxnSnapLog(logDir, snapDir));
+                    lastZxid = zkDb2.loadDataBase();
+                    assertEquals("data2", new String(zkDb2.getData("/foo", stat, null)));
+                    assertEquals(proposalZxid, lastZxid);
+                } finally {
+                    TestUtils.deleteFileRecursively(tmpDir);
+                }
+            }
+
+            private void proposeSetData(QuorumPacket qp, long zxid, String data, int version) throws IOException {
+                qp.setType(Leader.PROPOSAL);
+                qp.setZxid(zxid);
+                TxnHeader hdr = new TxnHeader(4, 1414, qp.getZxid(), 55, ZooDefs.OpCode.setData);
+                SetDataTxn sdt = new SetDataTxn("/foo", data.getBytes(), version);
+                ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                OutputArchive boa = BinaryOutputArchive.getArchive(baos);
+                boa.writeRecord(hdr, null);
+                boa.writeRecord(sdt, null);
+                qp.setData(baos.toByteArray());
+            }
+        }, testData);
+    }
+
     @Test
     public void testNormalRun(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {

From f13bd714903e06fb045930bfbeffa5b5f18e0528 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Fri, 20 Sep 2024 00:00:55 +0800
Subject: [PATCH 467/591] ZOOKEEPER-4859: Fix openssl gencerts failure due to
 too long hostname in github ci (#2186)

Reviewers: anmolnar
Author: kezhuw
Closes #2186 from kezhuw/ZOOKEEPER-4859
---
 .github/workflows/ci.yaml                             | 7 +++++++
 zookeeper-client/zookeeper-client-c/tests/zkServer.sh | 5 ++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6586848701c..5d220e69392 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -86,6 +86,13 @@ jobs:
         name: failsafe-reports-${{ matrix.profile.name }}
         path: ./**/target/failsafe-reports/
         if-no-files-found: ignore
+    - name: Upload cppunit test logs
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v3
+      with:
+        name: cppunit-logs-${{ matrix.profile.name }}
+        path: ./zookeeper-client/zookeeper-client-c/target/c/TEST-*.txt
+        if-no-files-found: ignore
   typo-check:
     name: Typo Check
     # only run on pull requests because of security reasons
diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index f98b4058c97..7505bf3a8f7 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -183,7 +183,10 @@ start|startClean|startRequireSASLAuth|startCleanReadOnly)
     mkdir -p "${certs_dir}"
     cp ${tests_dir}/../ssl/gencerts.sh "${certs_dir}/"  > /dev/null
     cd ${certs_dir} > /dev/null
-    ./gencerts.sh > ./gencerts.stdout 2> ./gencerts.stderr
+    # GitHub is providing us hostnames with more than 64 characters now.
+    # And there are no cppunit tests do hostname verification currently,
+    # so we could set CN to arbitrary hostname for now.
+    ./gencerts.sh tests.zookeeper.apache.org > ./gencerts.stdout 2> ./gencerts.stderr
     cd - > /dev/null
 
 

From 9df310a9df6e03ca24d7671f10e78fff7b618084 Mon Sep 17 00:00:00 2001
From: Michael Edgar <michael@xlate.io>
Date: Thu, 19 Sep 2024 15:31:51 -0400
Subject: [PATCH 468/591] ZOOKEEPER-4293: Bump netty to 4.1.113.Final, remove
 syncUninterruptibly (#1917)

Reviewers: anmolnar, kezhuw
Author: MikeEdgar
Closes #1917 from MikeEdgar/ZOOKEEPER-4293
---
 pom.xml                                                         | 2 +-
 .../main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java   | 2 +-
 .../org/apache/zookeeper/server/quorum/UnifiedServerSocket.java | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 2fbab352667..ecc6eecc183 100644
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.105.Final</netty.version>
+    <netty.version>4.1.113.Final</netty.version>
     <jetty.version>9.4.53.v20231009</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
index 5b82c37f9da..32379e74c30 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -203,7 +203,7 @@ void cleanup() {
                 connectFuture = null;
             }
             if (channel != null) {
-                channel.close().syncUninterruptibly();
+                channel.close();
                 channel = null;
             }
         } finally {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java
index 387a6c7d765..c101e9e2dc5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java
@@ -255,7 +255,7 @@ private void detectMode() throws IOException {
                 bytesRead = 0;
             }
 
-            if (bytesRead == litmus.length && SslHandler.isEncrypted(Unpooled.wrappedBuffer(litmus))) {
+            if (bytesRead == litmus.length && SslHandler.isEncrypted(Unpooled.wrappedBuffer(litmus), false)) {
                 try {
                     sslSocket = x509Util.createSSLSocket(prependableSocket, litmus);
                 } catch (X509Exception e) {

From dcaf74c369222a82000ea07a1e5953ca91782084 Mon Sep 17 00:00:00 2001
From: Mohammad Arshad <arshad@apache.org>
Date: Fri, 20 Sep 2024 23:45:11 +0530
Subject: [PATCH 469/591] ZOOKEEPER-4843: Encountering an 'Unreasonable Length'
 error when configuring jute.maxbuffer to 1GB or more

Reviewers: anmolnar, kezhuw
Author: arshadmohammad
Closes #2175 from arshadmohammad/totalBuffer
---
 .../java/org/apache/jute/BinaryInputArchive.java    | 12 +++++++-----
 .../org/apache/jute/BinaryInputArchiveTest.java     | 13 +++++++++++++
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
index ae1310af03d..277faf489bd 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
@@ -48,8 +48,7 @@ public class BinaryInputArchive implements InputArchive {
     }
 
     private final DataInput in;
-    private final int maxBufferSize;
-    private final int extraMaxBufferSize;
+    private final int totalBufferSize;
 
     public static BinaryInputArchive getArchive(InputStream stream) {
         return new BinaryInputArchive(new DataInputStream(stream));
@@ -80,8 +79,11 @@ public BinaryInputArchive(DataInput in) {
 
     public BinaryInputArchive(DataInput in, int maxBufferSize, int extraMaxBufferSize) {
         this.in = in;
-        this.maxBufferSize = maxBufferSize;
-        this.extraMaxBufferSize = extraMaxBufferSize;
+        if ((long) maxBufferSize + extraMaxBufferSize > Integer.MAX_VALUE) {
+            this.totalBufferSize = Integer.MAX_VALUE;
+        } else {
+            this.totalBufferSize = maxBufferSize + extraMaxBufferSize;
+        }
     }
 
     public byte readByte(String tag) throws IOException {
@@ -162,7 +164,7 @@ public void endMap(String tag) throws IOException {
     // make up for extra fields, etc. (otherwise e.g. clients may be able to
     // write buffers larger than we can read from disk!)
     private void checkLength(int len) throws IOException {
-        if (len < 0 || len > maxBufferSize + extraMaxBufferSize) {
+        if (len < 0 || len > totalBufferSize) {
             throw new IOException(UNREASONBLE_LENGTH + len);
         }
     }
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
index 9a1c70eeb5a..294a8b129ba 100644
--- a/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
+++ b/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
@@ -195,4 +195,17 @@ private byte[] getData(int recordSize) {
     return buf.array();
   }
 
+    @Test
+    public void testTotalBufferSizeShouldNotBeMoreThanIntegerMaxValue()
+            throws IOException {
+        int maxBufferSize = 1 * 1024 * 1024 * 1024; // buffer size 1GB
+        int extraMaxBufferSize = maxBufferSize;
+        int recordSize = 1000;
+        BinaryInputArchive ia =
+                getBinaryInputArchive(recordSize, maxBufferSize, extraMaxBufferSize);
+        String s = ia.readString("");
+        assertNotNull(s);
+        assertEquals(recordSize, s.getBytes().length);
+    }
+
 }

From bc9afbf8ef1bc6156643d3d05c87fcf8411e9d8f Mon Sep 17 00:00:00 2001
From: Jon Marius Venstad <jonmv@users.noreply.github.com>
Date: Fri, 20 Sep 2024 21:10:08 +0200
Subject: [PATCH 470/591] ZOOKEEPER-4712: Fix partially shutdown of
 ZooKeeperServer and its processors

Reviewers: anmolnar, kezhuw, kezhuw, kezhuw
Author: jonmv
Closes #2154 from jonmv/jonmv/ZOOKEEPER-4541-take-2
---
 .../apache/zookeeper/server/ZKDatabase.java   |  2 +-
 .../zookeeper/server/ZooKeeperServer.java     | 70 +++++++--------
 .../zookeeper/server/ZooKeeperServerMain.java |  4 +-
 .../server/persistence/FileTxnSnapLog.java    |  2 +-
 .../server/quorum/LeaderZooKeeperServer.java  |  4 +-
 .../zookeeper/server/quorum/Learner.java      | 28 +++---
 .../server/quorum/LearnerZooKeeperServer.java | 17 ++--
 .../quorum/ObserverZooKeeperServer.java       | 14 +--
 .../quorum/ReadOnlyZooKeeperServer.java       |  8 +-
 .../quorum/SendAckRequestProcessor.java       |  4 +-
 .../server/ZooKeeperServerShutdownTest.java   | 85 +++++++++++++++++++
 .../server/quorum/WatchLeakTest.java          |  2 +-
 12 files changed, 152 insertions(+), 88 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index c1e0b4834a3..c27ac6aa83b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -294,7 +294,7 @@ public long loadDataBase() throws IOException {
     }
 
     /**
-     * Fast forward the database adding transactions from the committed log into memory.
+     * Fast-forward the database adding transactions from the committed log into memory.
      * @return the last valid zxid.
      * @throws IOException
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index af4147afd9e..6740f6d524b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -900,7 +900,7 @@ protected void setState(State state) {
      * @return true if the server is running or server hits an error, false
      *         otherwise.
      */
-    protected boolean canShutdown() {
+    private boolean canShutdown() {
         return state == State.RUNNING || state == State.ERROR;
     }
 
@@ -911,27 +911,49 @@ public boolean isRunning() {
         return state == State.RUNNING;
     }
 
-    public void shutdown() {
+    public final void shutdown() {
         shutdown(false);
     }
 
     /**
      * Shut down the server instance
-     * @param fullyShutDown true if another server using the same database will not replace this one in the same process
+     * @param fullyShutDown true when no other server will use the same database to replace this one
      */
-    public synchronized void shutdown(boolean fullyShutDown) {
-        if (!canShutdown()) {
-            if (fullyShutDown && zkDb != null) {
-                zkDb.clear();
+    public final synchronized void shutdown(boolean fullyShutDown) {
+        if (canShutdown()) {
+            LOG.info("Shutting down");
+
+            shutdownComponents();
+
+            if (zkDb != null && !fullyShutDown) {
+                // There is no need to clear the database if we are going to reuse it:
+                //  * When a new quorum is established we can still apply the diff
+                //    on top of the same zkDb data
+                //  * If we fetch a new snapshot from leader, the zkDb will be
+                //    cleared anyway before loading the snapshot
+                try {
+                    // This will fast-forward the database to the last recorded transaction
+                    zkDb.fastForwardDataBase();
+                } catch (IOException e) {
+                    LOG.error("Error updating DB", e);
+                    fullyShutDown = true;
+                }
             }
+            setState(State.SHUTDOWN);
+        } else {
             LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
         }
-        LOG.info("shutting down");
-
-        // new RuntimeException("Calling shutdown").printStackTrace();
-        setState(State.SHUTDOWN);
+        if (zkDb != null && fullyShutDown) {
+            zkDb.clear();
+        }
+    }
 
+    /**
+     * @implNote
+     * Shuts down components owned by this class;
+     * remember to call super.shutdownComponents() when overriding!
+     */
+    protected void shutdownComponents() {
         // unregister all metrics that are keeping a strong reference to this object
         // subclasses will do their specific clean up
         unregisterMetrics();
@@ -940,9 +962,8 @@ public synchronized void shutdown(boolean fullyShutDown) {
             requestThrottler.shutdown();
         }
 
-        // Since sessionTracker and syncThreads poll we just have to
-        // set running to false and they will detect it during the poll
-        // interval.
+        // Since sessionTracker and syncThreads poll we just have to set running to false,
+        // and they will detect it during the poll interval.
         if (sessionTracker != null) {
             sessionTracker.shutdown();
         }
@@ -953,25 +974,6 @@ public synchronized void shutdown(boolean fullyShutDown) {
             jvmPauseMonitor.serviceStop();
         }
 
-        if (zkDb != null) {
-            if (fullyShutDown) {
-                zkDb.clear();
-            } else {
-                // else there is no need to clear the database
-                //  * When a new quorum is established we can still apply the diff
-                //    on top of the same zkDb data
-                //  * If we fetch a new snapshot from leader, the zkDb will be
-                //    cleared anyway before loading the snapshot
-                try {
-                    //This will fast forward the database to the latest recorded transactions
-                    zkDb.fastForwardDataBase();
-                } catch (IOException e) {
-                    LOG.error("Error updating DB", e);
-                    zkDb.clear();
-                }
-            }
-        }
-
         requestPathMetricsCollector.shutdown();
         unregisterJMX();
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index d6cbbe4a1ee..24e7f5b180e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -192,9 +192,7 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
             if (secureCnxnFactory != null) {
                 secureCnxnFactory.join();
             }
-            if (zkServer.canShutdown()) {
-                zkServer.shutdown(true);
-            }
+            zkServer.shutdown(true);
         } catch (InterruptedException e) {
             // warn, but generally this is ok
             LOG.warn("Server interrupted", e);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index 29b4c0a616d..2816826046e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -313,7 +313,7 @@ public long restore(DataTree dt, Map<Long, Integer> sessions, PlayBackListener l
     }
 
     /**
-     * This function will fast forward the server database to have the latest
+     * This function will fast-forward the server database to have the latest
      * transactions in it.  This is the same as restore, but only reads from
      * the transaction logs and not restores from a snapshot.
      * @param dt the datatree to write transactions to.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
index 2de080bd380..799b8f96148 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
@@ -155,11 +155,11 @@ protected void unregisterMetrics() {
     }
 
     @Override
-    public synchronized void shutdown() {
+    protected synchronized void shutdownComponents() {
         if (containerManager != null) {
             containerManager.stop();
         }
-        super.shutdown();
+        super.shutdownComponents();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index bb7be70dda2..1ef99e50aae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -916,26 +916,26 @@ boolean isRunning() {
     }
 
     void closeSocket() {
-        if (sock != null) {
-            if (sockBeingClosed.compareAndSet(false, true)) {
-                if (closeSocketAsync) {
-                    final Thread closingThread = new Thread(() -> closeSockSync(), "CloseSocketThread(sid:" + zk.getServerId());
-                    closingThread.setDaemon(true);
-                    closingThread.start();
-                } else {
-                    closeSockSync();
-                }
+        if (sockBeingClosed.compareAndSet(false, true)) {
+            if (sock == null) { // Closing before establishing the connection is a noop
+                return;
+            }
+            Socket socket = sock;
+            sock = null;
+            if (closeSocketAsync) {
+                final Thread closingThread = new Thread(() -> closeSockSync(socket), "CloseSocketThread(sid:" + zk.getServerId());
+                closingThread.setDaemon(true);
+                closingThread.start();
+            } else {
+                closeSockSync(socket);
             }
         }
     }
 
-    void closeSockSync() {
+    private static void closeSockSync(Socket socket) {
         try {
             long startTime = Time.currentElapsedTime();
-            if (sock != null) {
-                sock.close();
-                sock = null;
-            }
+            socket.close();
             ServerMetrics.getMetrics().SOCKET_CLOSING_TIME.add(Time.currentElapsedTime() - startTime);
         } catch (IOException e) {
             LOG.warn("Ignoring error closing connection to leader", e);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
index efd2e376208..a7c345d0757 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
@@ -152,17 +152,7 @@ protected void unregisterJMX(Learner peer) {
     }
 
     @Override
-    public synchronized void shutdown() {
-        if (!canShutdown()) {
-            LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
-        }
-        LOG.info("Shutting down");
-        try {
-            super.shutdown();
-        } catch (Exception e) {
-            LOG.warn("Ignoring unexpected exception during shutdown", e);
-        }
+    protected void shutdownComponents() {
         try {
             if (syncProcessor != null) {
                 syncProcessor.shutdown();
@@ -170,6 +160,11 @@ public synchronized void shutdown() {
         } catch (Exception e) {
             LOG.warn("Ignoring unexpected exception in syncprocessor shutdown", e);
         }
+        try {
+            super.shutdownComponents();
+        } catch (Exception e) {
+            LOG.warn("Ignoring unexpected exception during shutdown", e);
+        }
     }
 
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
index 79aa10ca9de..74663a9c136 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
@@ -44,7 +44,7 @@ public class ObserverZooKeeperServer extends LearnerZooKeeperServer {
      * take periodic snapshot. Default is ON.
      */
 
-    private boolean syncRequestProcessorEnabled = this.self.getSyncEnabled();
+    private final boolean syncRequestProcessorEnabled = this.self.getSyncEnabled();
 
     /*
      * Pending sync requests
@@ -127,18 +127,6 @@ public String getState() {
         return "observer";
     }
 
-    @Override
-    public synchronized void shutdown() {
-        if (!canShutdown()) {
-            LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
-        }
-        super.shutdown();
-        if (syncRequestProcessorEnabled && syncProcessor != null) {
-            syncProcessor.shutdown();
-        }
-    }
-
     @Override
     public void dumpMonitorValues(BiConsumer<String, Object> response) {
         super.dumpMonitorValues(response);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
index 0efa4677053..7e9ff925251 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
@@ -190,11 +190,7 @@ public long getServerId() {
     }
 
     @Override
-    public synchronized void shutdown() {
-        if (!canShutdown()) {
-            LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
-        }
+    protected void shutdownComponents() {
         shutdown = true;
         unregisterJMX(this);
 
@@ -206,7 +202,7 @@ public synchronized void shutdown() {
         self.adminServer.setZooKeeperServer(null);
 
         // shutdown the server itself
-        super.shutdown();
+        super.shutdownComponents();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
index 78c9dbd39f7..3f42c2bd30f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
@@ -46,7 +46,7 @@ public void processRequest(Request si) {
                 learner.writePacket(qp, false);
             } catch (IOException e) {
                 LOG.warn("Closing connection to leader, exception during packet send", e);
-                learner.closeSockSync();
+                learner.closeSocket();
             }
         }
     }
@@ -56,7 +56,7 @@ public void flush() throws IOException {
             learner.writePacket(null, true);
         } catch (IOException e) {
             LOG.warn("Closing connection to leader, exception during packet send", e);
-            learner.closeSockSync();
+            learner.closeSocket();
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java
new file mode 100644
index 00000000000..b0dd19cb77c
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.Learner;
+import org.apache.zookeeper.server.quorum.LearnerZooKeeperServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZooKeeperServerShutdownTest extends ZKTestCase  {
+
+    static class ShutdownTrackRequestProcessor implements RequestProcessor {
+        boolean shutdown = false;
+
+        @Override
+        public void processRequest(Request request) throws RequestProcessorException {
+        }
+
+        @Override
+        public void shutdown() {
+            shutdown = true;
+        }
+    }
+
+    public static class ShutdownTrackLearnerZooKeeperServer extends LearnerZooKeeperServer {
+        public ShutdownTrackLearnerZooKeeperServer(FileTxnSnapLog logFactory, QuorumPeer self) throws IOException {
+            super(logFactory, 2000, 2000, 2000, -1, new ZKDatabase(logFactory), self);
+        }
+
+        @Override
+        protected void setupRequestProcessors() {
+            firstProcessor = new ShutdownTrackRequestProcessor();
+            syncProcessor = new SyncRequestProcessor(this, null);
+            syncProcessor.start();
+        }
+
+        ShutdownTrackRequestProcessor getFirstProcessor() {
+            return (ShutdownTrackRequestProcessor) firstProcessor;
+        }
+
+        SyncRequestProcessor getSyncRequestProcessor() {
+            return syncProcessor;
+        }
+
+        @Override
+        public Learner getLearner() {
+            return null;
+        }
+    }
+
+    @Test
+    void testLearnerZooKeeperServerShutdown(@TempDir File tmpDir) throws Exception {
+        File tmpFile = File.createTempFile("test", ".dir", tmpDir);
+        tmpFile.delete();
+        FileTxnSnapLog logFactory = new FileTxnSnapLog(tmpFile, tmpFile);
+        ShutdownTrackLearnerZooKeeperServer zooKeeperServer = new ShutdownTrackLearnerZooKeeperServer(logFactory, new QuorumPeer());
+        zooKeeperServer.startup();
+        zooKeeperServer.shutdown(false);
+        assertTrue(zooKeeperServer.getFirstProcessor().shutdown);
+        assertFalse(zooKeeperServer.getSyncRequestProcessor().isAlive());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index b51cfbe3ba2..8db90a2482e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -97,7 +97,7 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
             }
         });
 
-        ZKDatabase database = new ZKDatabase(null);
+        ZKDatabase database = new ZKDatabase(mock(FileTxnSnapLog.class));
         database.setlastProcessedZxid(2L);
         QuorumPeer quorumPeer = mock(QuorumPeer.class);
         FileTxnSnapLog logfactory = mock(FileTxnSnapLog.class);

From 95efcc97f66ff8bb6d0b338dc6285180a7a258fe Mon Sep 17 00:00:00 2001
From: Siva Kumar Edupuganti <161360372+esivakumar26@users.noreply.github.com>
Date: Sun, 22 Sep 2024 05:52:53 -0700
Subject: [PATCH 471/591] Update Year in NOTICE.txt (#2149)

---
 NOTICE.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/NOTICE.txt b/NOTICE.txt
index 8fb1daca87d..a4e8d36bf5e 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2022 The Apache Software Foundation
+Copyright 2009-2024 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

From 890061841f7ca1848f28fc77c071ae4233b6303e Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Tue, 24 Sep 2024 06:26:20 +0800
Subject: [PATCH 472/591] ZOOKEEPER-4508: Expire session in client side to
 avoid endless connection loss

Reviewers: anmolnar
Author: kezhuw
Closes #2058 from kezhuw/ZOOKEEPER-4508-client-side-session-expiration
---
 .../java/org/apache/zookeeper/ClientCnxn.java |  34 +++++-
 .../apache/zookeeper/ClientCnxnSocket.java    |   2 +
 .../apache/zookeeper/test/ReconfigTest.java   |   2 +-
 .../apache/zookeeper/test/SessionTest.java    |  35 +++---
 .../zookeeper/test/SessionTimeoutTest.java    | 104 ++++++++++++++++++
 5 files changed, 156 insertions(+), 21 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 75fd8744823..b23ce82dc4f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -165,6 +165,8 @@ static class AuthData {
 
     private int readTimeout;
 
+    private int expirationTimeout;
+
     private final int sessionTimeout;
 
     private final ZKWatchManager watchManager;
@@ -411,6 +413,7 @@ public ClientCnxn(
 
         this.connectTimeout = sessionTimeout / hostProvider.size();
         this.readTimeout = sessionTimeout * 2 / 3;
+        this.expirationTimeout = sessionTimeout * 4 / 3;
 
         this.sendThread = new SendThread(clientCnxnSocket);
         this.eventThread = new EventThread();
@@ -803,6 +806,12 @@ public String toString() {
 
     }
 
+    private static class ConnectionTimeoutException extends IOException {
+        public ConnectionTimeoutException(String message) {
+            super(message);
+        }
+    }
+
     private static class SessionTimeoutException extends IOException {
 
         private static final long serialVersionUID = 824482094072071178L;
@@ -1143,7 +1152,7 @@ public void run() {
                         startConnect(serverAddress);
                         // Update now to start the connection timer right after we make a connection attempt
                         clientCnxnSocket.updateNow();
-                        clientCnxnSocket.updateLastSendAndHeard();
+                        clientCnxnSocket.updateLastSend();
                     }
 
                     if (state.isConnected()) {
@@ -1181,16 +1190,24 @@ public void run() {
                         }
                         to = readTimeout - clientCnxnSocket.getIdleRecv();
                     } else {
-                        to = connectTimeout - clientCnxnSocket.getIdleRecv();
+                        to = connectTimeout - clientCnxnSocket.getIdleSend();
                     }
 
-                    if (to <= 0) {
+                    int expiration = expirationTimeout - clientCnxnSocket.getIdleRecv();
+                    if (expiration <= 0) {
                         String warnInfo = String.format(
                             "Client session timed out, have not heard from server in %dms for session id 0x%s",
                             clientCnxnSocket.getIdleRecv(),
                             Long.toHexString(sessionId));
                         LOG.warn(warnInfo);
+                        changeZkState(States.CLOSED);
                         throw new SessionTimeoutException(warnInfo);
+                    } else if (to <= 0) {
+                        String warnInfo = String.format(
+                            "Client connection timed out, have not heard from server in %dms for session id 0x%s",
+                            clientCnxnSocket.getIdleRecv(),
+                            Long.toHexString(sessionId));
+                        throw new ConnectionTimeoutException(warnInfo);
                     }
                     if (state.isConnected()) {
                         //1000(1 second) is to prevent race condition missing to send the second ping
@@ -1235,7 +1252,7 @@ public void run() {
                     } else {
                         LOG.warn(
                             "Session 0x{} for server {}, Closing socket connection. "
-                                + "Attempting reconnect except it is a SessionExpiredException.",
+                                + "Attempting reconnect except it is a SessionExpiredException or SessionTimeoutException.",
                             Long.toHexString(getSessionId()),
                             serverAddress,
                             e);
@@ -1256,7 +1273,12 @@ public void run() {
             if (state.isAlive()) {
                 eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Disconnected, null));
             }
-            eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Closed, null));
+            if (closing) {
+                eventThread.queueEvent(new WatchedEvent(Event.EventType.None, KeeperState.Closed, null));
+            } else if (state == States.CLOSED) {
+                eventThread.queueEvent(new WatchedEvent(Event.EventType.None, KeeperState.Expired, null));
+            }
+            eventThread.queueEventOfDeath();
 
             Login l = loginRef.getAndSet(null);
             if (l != null) {
@@ -1274,7 +1296,6 @@ private void cleanAndNotifyState() {
                 eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Disconnected, null));
             }
             clientCnxnSocket.updateNow();
-            clientCnxnSocket.updateLastSendAndHeard();
         }
 
         private void pingRwServer() throws RWServerFoundException {
@@ -1374,6 +1395,7 @@ void onConnected(
             }
 
             readTimeout = negotiatedSessionTimeout * 2 / 3;
+            expirationTimeout = negotiatedSessionTimeout * 4 / 3;
             connectTimeout = negotiatedSessionTimeout / hostProvider.size();
             hostProvider.onConnected();
             sessionId = _sessionId;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
index 17c0ad27925..0437d73178c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
@@ -65,7 +65,9 @@ abstract class ClientCnxnSocket {
     protected ByteBuffer incomingBuffer = lenBuffer;
     protected final AtomicLong sentCount = new AtomicLong(0L);
     protected final AtomicLong recvCount = new AtomicLong(0L);
+    // Used for reactive timeout detection, say connection read timeout and session expiration timeout.
     protected long lastHeard;
+    // Used for proactive timeout detection, say ping timeout and connection establishment timeout.
     protected long lastSend;
     protected long now;
     protected ClientCnxn.SendThread sendThread;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index e6e3c7b361c..1615be17242 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -804,7 +804,7 @@ private void testPortChangeToBlockedPort(boolean testLeader) throws Exception {
                 Thread.sleep(1000);
                 zkArr[serverIndex].setData("/test", "teststr".getBytes(), -1);
                 fail("New client connected to new client port!");
-            } catch (KeeperException.ConnectionLossException e) {
+            } catch (KeeperException.ConnectionLossException | KeeperException.SessionExpiredException e) {
                 // Exception is expected
             }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
index ce8c1e7714f..3675e0eb019 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
@@ -25,6 +25,7 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
@@ -90,10 +91,18 @@ public void tearDown() throws Exception {
     private static class CountdownWatcher implements Watcher {
 
         volatile CountDownLatch clientConnected = new CountDownLatch(1);
+        final CountDownLatch sessionTerminated = new CountDownLatch(1);
 
         public void process(WatchedEvent event) {
-            if (event.getState() == KeeperState.SyncConnected) {
-                clientConnected.countDown();
+            switch (event.getState()) {
+                case SyncConnected:
+                    clientConnected.countDown();
+                    break;
+                case AuthFailed:
+                case Expired:
+                case Closed:
+                    sessionTerminated.countDown();
+                    break;
             }
         }
 
@@ -274,17 +283,15 @@ public void testSessionStateNoDupStateReporting() throws IOException, Interrupte
         // shutdown the server
         serverFactory.shutdown();
 
-        try {
-            Thread.sleep(10000);
-        } catch (InterruptedException e) {
-            // ignore
-        }
+        watcher.sessionTerminated.await();
 
-        // verify that the size is just 2 - ie connect then disconnect
-        // if the client attempts reconnect and we are not handling current
-        // state correctly (ie eventing on duplicate disconnects) then we'll
-        // see a disconnect for each failed connection attempt
-        assertEquals(2, watcher.states.size());
+        // verify that there is no duplicated disconnected event.
+        List<KeeperState> states = Arrays.asList(
+                KeeperState.SyncConnected,
+                KeeperState.Disconnected,
+                KeeperState.Expired
+        );
+        assertEquals(states, watcher.states);
 
         zk.close();
     }
@@ -319,11 +326,11 @@ public void testSessionTimeoutAccess() throws Exception {
 
     private class DupWatcher extends CountdownWatcher {
 
-        public List<WatchedEvent> states = new LinkedList<>();
+        public List<KeeperState> states = new LinkedList<>();
         public void process(WatchedEvent event) {
             super.process(event);
             if (event.getType() == EventType.None) {
-                states.add(event);
+                states.add(event.getState());
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
index 0585ce6fadf..7a59f5eb958 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
@@ -20,9 +20,15 @@
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.util.Arrays;
+import java.util.List;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
@@ -48,6 +54,30 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    private static class BusyServer implements AutoCloseable {
+        private final ServerSocket server;
+        private final Socket client;
+
+        public BusyServer() throws IOException {
+            this.server = new ServerSocket(0, 1);
+            this.client = new Socket("127.0.0.1", server.getLocalPort());
+        }
+
+        public int getLocalPort() {
+            return server.getLocalPort();
+        }
+
+        public String getHostPort() {
+            return String.format("127.0.0.1:%d", getLocalPort());
+        }
+
+        @Override
+        public void close() throws Exception {
+            client.close();
+            server.close();
+        }
+    }
+
     @Test
     public void testSessionExpiration() throws InterruptedException, KeeperException {
         final CountDownLatch expirationLatch = new CountDownLatch(1);
@@ -72,6 +102,80 @@ public void testSessionExpiration() throws InterruptedException, KeeperException
         assertTrue(gotException);
     }
 
+    @Test
+    public void testSessionRecoveredAfterMultipleFailedAttempts() throws Exception {
+        // stop client also to gain less distraction
+        zk.close();
+
+        try (BusyServer busyServer = new BusyServer()) {
+            List<String> servers = Arrays.asList(
+                    busyServer.getHostPort(),
+                    busyServer.getHostPort(),
+                    hostPort,
+                    busyServer.getHostPort(),
+                    busyServer.getHostPort(),
+                    busyServer.getHostPort()
+                    );
+            String connectString = String.join(",", servers);
+
+            zk = createClient(new CountdownWatcher(), connectString);
+            stopServer();
+
+            // Wait beyond connectTimeout but not sessionTimeout.
+            Thread.sleep(zk.getSessionTimeout() / 2);
+
+            CompletableFuture<Void> connected = new CompletableFuture<>();
+            zk.register(event -> {
+                if (event.getState() == Watcher.Event.KeeperState.SyncConnected) {
+                    connected.complete(null);
+                } else {
+                    connected.completeExceptionally(new KeeperException.SessionExpiredException());
+                }
+            });
+
+            startServer();
+            connected.join();
+        }
+    }
+
+    @Test
+    public void testSessionExpirationAfterAllServerDown() throws Exception {
+        // stop client also to gain less distraction
+        zk.close();
+
+        // small connection timeout to gain quick ci feedback
+        int sessionTimeout = 3000;
+        CompletableFuture<Void> expired = new CompletableFuture<>();
+        zk = createClient(new CountdownWatcher(), hostPort, sessionTimeout);
+        zk.register(event -> {
+            if (event.getState() == Watcher.Event.KeeperState.Expired) {
+                expired.complete(null);
+            }
+        });
+        stopServer();
+        expired.join();
+        assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+    }
+
+    @Test
+    public void testSessionExpirationWhenNoServerUp() throws Exception {
+        // stop client also to gain less distraction
+        zk.close();
+
+        stopServer();
+
+        // small connection timeout to gain quick ci feedback
+        int sessionTimeout = 3000;
+        CompletableFuture<Void> expired = new CompletableFuture<>();
+        new TestableZooKeeper(hostPort, sessionTimeout, event -> {
+            if (event.getState() == Watcher.Event.KeeperState.Expired) {
+                expired.complete(null);
+            }
+        });
+        expired.join();
+        assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+    }
+
     @Test
     public void testQueueEvent() throws InterruptedException, KeeperException {
         final CountDownLatch eventLatch = new CountDownLatch(1);

From 5a3c6a98f8714e46d3637b93e63d69632e411ba5 Mon Sep 17 00:00:00 2001
From: Xin Luo <65529035+luoxiner@users.noreply.github.com>
Date: Wed, 25 Sep 2024 08:46:23 +0800
Subject: [PATCH 473/591] ZOOKEEPER-4839: Fix SASL DIGEST-MD5 authenticated
 with last successfully logined username

Reviewers: kezhuw, kezhuw, kezhuw, anmolnar
Author: luoxiner
Closes #2176 from luoxiner/master
---
 .../main/java/org/apache/zookeeper/Login.java | 26 ++++--
 .../zookeeper/client/ZooKeeperSaslClient.java |  9 +-
 .../zookeeper/server/ServerCnxnFactory.java   | 34 ++++++-
 .../zookeeper/server/ZooKeeperSaslServer.java |  2 +-
 .../auth/SaslServerCallbackHandler.java       | 34 +------
 .../quorum/auth/SaslQuorumAuthLearner.java    |  8 +-
 .../quorum/auth/SaslQuorumAuthServer.java     | 11 ++-
 .../auth/SaslQuorumServerCallbackHandler.java | 14 +--
 .../zookeeper/KerberosTicketRenewalTest.java  |  4 +-
 .../test/SaslAuthRequiredMultiClientTest.java | 88 +++++++++++++++++++
 .../apache/zookeeper/test/SaslTestUtil.java   |  7 +-
 11 files changed, 173 insertions(+), 64 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
index ab2bf636ef1..2c483a5f74b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
@@ -28,6 +28,7 @@
 import java.util.Date;
 import java.util.Set;
 import java.util.concurrent.ThreadLocalRandom;
+import java.util.function.Supplier;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.kerberos.KerberosPrincipal;
@@ -48,7 +49,7 @@ public class Login {
     private static final String KINIT_COMMAND_DEFAULT = "/usr/bin/kinit";
     private static final Logger LOG = LoggerFactory.getLogger(Login.class);
     public static final String SYSTEM_USER = System.getProperty("user.name", "<NA>");
-    public CallbackHandler callbackHandler;
+    private final Supplier<CallbackHandler> callbackHandlerSupplier;
 
     // LoginThread will sleep until 80% of time from last refresh to
     // ticket's expiry has been reached, at which time it will wake
@@ -89,17 +90,17 @@ public class Login {
      *            name of section in JAAS file that will be use to login. Passed
      *            as first param to javax.security.auth.login.LoginContext().
      *
-     * @param callbackHandler
-     *            Passed as second param to
-     *            javax.security.auth.login.LoginContext().
+     * @param callbackHandlerSupplier
+     *            Per connection callbackhandler supplier.
+     *
      * @param zkConfig
      *            client or server configurations
      * @throws javax.security.auth.login.LoginException
      *             Thrown if authentication fails.
      */
-    public Login(final String loginContextName, CallbackHandler callbackHandler, final ZKConfig zkConfig) throws LoginException {
+    public Login(final String loginContextName, Supplier<CallbackHandler> callbackHandlerSupplier, final ZKConfig zkConfig) throws LoginException {
         this.zkConfig = zkConfig;
-        this.callbackHandler = callbackHandler;
+        this.callbackHandlerSupplier = callbackHandlerSupplier;
         login = login(loginContextName);
         this.loginContextName = loginContextName;
         subject = login.getSubject();
@@ -274,6 +275,17 @@ public void run() {
         t.setDaemon(true);
     }
 
+    /**
+     * Return a new CallbackHandler for connections
+     * to avoid race conditions and state sharing in
+     * connection login processing.
+     *
+     * @return connection dependent CallbackHandler
+     */
+    public CallbackHandler newCallbackHandler() {
+        return callbackHandlerSupplier.get();
+    }
+
     public void startThreadIfNeeded() {
         // thread object 't' will be null if a refresh thread is not needed.
         if (t != null) {
@@ -315,7 +327,7 @@ private synchronized LoginContext login(final String loginContextName) throws Lo
                                      + ") and your "
                                      + getLoginContextMessage());
         }
-        LoginContext loginContext = new LoginContext(loginContextName, callbackHandler);
+        LoginContext loginContext = new LoginContext(loginContextName, newCallbackHandler());
         loginContext.login();
         LOG.info("{} successfully logged in.", loginContextName);
         return loginContext;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
index cafa66610df..f86c41db743 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
@@ -22,7 +22,9 @@
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
 import javax.security.auth.Subject;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -240,9 +242,10 @@ private SaslClient createSaslClient(
         try {
             if (loginRef.get() == null) {
                 LOG.debug("JAAS loginContext is: {}", loginContext);
-                // note that the login object is static: it's shared amongst all zookeeper-related connections.
-                // in order to ensure the login is initialized only once, it must be synchronized the code snippet.
-                Login l = new Login(loginContext, new SaslClientCallbackHandler(null, "Client"), clientConfig);
+                Supplier<CallbackHandler> callbackHandlerSupplier = () -> {
+                    return new SaslClientCallbackHandler(null, "Client");
+                };
+                Login l = new Login(loginContext, callbackHandlerSupplier, clientConfig);
                 if (loginRef.compareAndSet(null, l)) {
                     l.startThreadIfNeeded();
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index f9384a615a6..aad369cc0c9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -22,10 +22,13 @@
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Supplier;
 import javax.management.JMException;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -41,6 +44,7 @@ public abstract class ServerCnxnFactory {
 
     public static final String ZOOKEEPER_SERVER_CNXN_FACTORY = "zookeeper.serverCnxnFactory";
     private static final String ZOOKEEPER_MAX_CONNECTION = "zookeeper.maxCnxns";
+    private static final String DIGEST_MD5_USER_PREFIX = "user_";
     public static final int ZOOKEEPER_MAX_CONNECTION_DEFAULT = 0;
 
     private static final Logger LOG = LoggerFactory.getLogger(ServerCnxnFactory.class);
@@ -113,7 +117,6 @@ public void configure(InetSocketAddress addr, int maxcc, int backlog) throws IOE
 
     public abstract void reconfigure(InetSocketAddress addr);
 
-    protected SaslServerCallbackHandler saslServerCallbackHandler;
     public Login login;
 
     /** Maximum number of connections allowed from particular host (ip) */
@@ -269,8 +272,11 @@ protected void configureSaslLogin() throws IOException {
 
         // jaas.conf entry available
         try {
-            saslServerCallbackHandler = new SaslServerCallbackHandler(Configuration.getConfiguration());
-            login = new Login(serverSection, saslServerCallbackHandler, new ZKConfig());
+            Map<String, String> credentials = getDigestMd5Credentials(entries);
+            Supplier<CallbackHandler> callbackHandlerSupplier = () -> {
+                return new SaslServerCallbackHandler(credentials);
+            };
+            login = new Login(serverSection, callbackHandlerSupplier, new ZKConfig());
             setLoginUser(login.getUserName());
             login.startThreadIfNeeded();
         } catch (LoginException e) {
@@ -280,6 +286,28 @@ protected void configureSaslLogin() throws IOException {
         }
     }
 
+    /**
+     * make server credentials map from configuration's server section.
+     * @param appConfigurationEntries AppConfigurationEntry List
+     * @return Server credentials map
+     */
+    private static Map<String, String> getDigestMd5Credentials(final  AppConfigurationEntry[] appConfigurationEntries) {
+        Map<String, String> credentials = new HashMap<>();
+        for (AppConfigurationEntry entry : appConfigurationEntries) {
+            Map<String, ?> options = entry.getOptions();
+            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "Server" section.
+            // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
+            for (Map.Entry<String, ?> pair : options.entrySet()) {
+                String key = pair.getKey();
+                if (key.startsWith(DIGEST_MD5_USER_PREFIX)) {
+                    String userName = key.substring(DIGEST_MD5_USER_PREFIX.length());
+                    credentials.put(userName, (String) pair.getValue());
+                }
+            }
+        }
+        return credentials;
+    }
+
     private static void setLoginUser(String name) {
         //Created this method to avoid ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD find bug issue
         loginUser = name;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
index 5bdabfeda8b..bf5089d792b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
@@ -41,7 +41,7 @@ public class ZooKeeperSaslServer {
     private SaslServer createSaslServer(final Login login) {
         synchronized (login) {
             Subject subject = login.getSubject();
-            return SecurityUtils.createSaslServer(subject, "zookeeper", "zk-sasl-md5", login.callbackHandler, LOG);
+            return SecurityUtils.createSaslServer(subject, "zookeeper", "zk-sasl-md5", login.newCallbackHandler(), LOG);
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
index 4fca508df1d..79c57e462e7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
@@ -19,57 +19,29 @@
 package org.apache.zookeeper.server.auth;
 
 import java.io.IOException;
-import java.util.HashMap;
 import java.util.Map;
 import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.callback.NameCallback;
 import javax.security.auth.callback.PasswordCallback;
 import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
 import javax.security.sasl.AuthorizeCallback;
 import javax.security.sasl.RealmCallback;
-import org.apache.zookeeper.server.ZooKeeperSaslServer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 public class SaslServerCallbackHandler implements CallbackHandler {
 
-    private static final String USER_PREFIX = "user_";
     private static final Logger LOG = LoggerFactory.getLogger(SaslServerCallbackHandler.class);
     private static final String SYSPROP_SUPER_PASSWORD = "zookeeper.SASLAuthenticationProvider.superPassword";
     private static final String SYSPROP_REMOVE_HOST = "zookeeper.kerberos.removeHostFromPrincipal";
     private static final String SYSPROP_REMOVE_REALM = "zookeeper.kerberos.removeRealmFromPrincipal";
 
     private String userName;
-    private final Map<String, String> credentials = new HashMap<>();
+    private final Map<String, String> credentials;
 
-    public SaslServerCallbackHandler(Configuration configuration) throws IOException {
-        String serverSection = System.getProperty(
-            ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY,
-            ZooKeeperSaslServer.DEFAULT_LOGIN_CONTEXT_NAME);
-
-        AppConfigurationEntry[] configurationEntries = configuration.getAppConfigurationEntry(serverSection);
-
-        if (configurationEntries == null) {
-            String errorMessage = "Could not find a '" + serverSection + "' entry in this configuration: Server cannot start.";
-            LOG.error(errorMessage);
-            throw new IOException(errorMessage);
-        }
-        credentials.clear();
-        for (AppConfigurationEntry entry : configurationEntries) {
-            Map<String, ?> options = entry.getOptions();
-            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "Server" section.
-            // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
-            for (Map.Entry<String, ?> pair : options.entrySet()) {
-                String key = pair.getKey();
-                if (key.startsWith(USER_PREFIX)) {
-                    String userName = key.substring(USER_PREFIX.length());
-                    credentials.put(userName, (String) pair.getValue());
-                }
-            }
-        }
+    public SaslServerCallbackHandler(Map<String, String> credentials) {
+        this.credentials = credentials;
     }
 
     public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
index 12cec788a65..0b5ac551d3d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
@@ -25,7 +25,9 @@
 import java.net.Socket;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
+import java.util.function.Supplier;
 import javax.security.auth.Subject;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -62,9 +64,13 @@ public SaslQuorumAuthLearner(
                     "SASL-authentication failed because the specified JAAS configuration section '%s' could not be found.",
                     loginContext));
             }
+
+            Supplier<CallbackHandler> callbackSupplier = () -> {
+                return new SaslClientCallbackHandler(null, "QuorumLearner");
+            };
             this.learnerLogin = new Login(
                 loginContext,
-                new SaslClientCallbackHandler(null, "QuorumLearner"),
+                callbackSupplier,
                 new ZKConfig());
             this.learnerLogin.startThreadIfNeeded();
         } catch (LoginException e) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
index 9b5f48c3b88..a1425833b7f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
@@ -24,6 +24,8 @@
 import java.io.IOException;
 import java.net.Socket;
 import java.util.Set;
+import java.util.function.Supplier;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -55,9 +57,10 @@ public SaslQuorumAuthServer(boolean quorumRequireSasl, String loginContext, Set<
                     "SASL-authentication failed because the specified JAAS configuration section '%s' could not be found.",
                     loginContext));
             }
-            SaslQuorumServerCallbackHandler saslServerCallbackHandler = new SaslQuorumServerCallbackHandler(
-                Configuration.getConfiguration(), loginContext, authzHosts);
-            serverLogin = new Login(loginContext, saslServerCallbackHandler, new ZKConfig());
+            Supplier<CallbackHandler> callbackSupplier = () -> {
+                return new SaslQuorumServerCallbackHandler(entries, authzHosts);
+            };
+            serverLogin = new Login(loginContext, callbackSupplier, new ZKConfig());
             serverLogin.startThreadIfNeeded();
         } catch (Throwable e) {
             throw new SaslException("Failed to initialize authentication mechanism using SASL", e);
@@ -86,7 +89,7 @@ public void authenticate(Socket sock, DataInputStream din) throws SaslException
                 serverLogin.getSubject(),
                 QuorumAuth.QUORUM_SERVER_PROTOCOL_NAME,
                 QuorumAuth.QUORUM_SERVER_SASL_DIGEST,
-                serverLogin.callbackHandler,
+                serverLogin.newCallbackHandler(),
                 LOG);
             while (!ss.isComplete()) {
                 challenge = ss.evaluateResponse(token);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
index b182ee13a1c..e17c16f89cb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import java.io.IOException;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
@@ -29,7 +28,6 @@
 import javax.security.auth.callback.PasswordCallback;
 import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
 import javax.security.sasl.AuthorizeCallback;
 import javax.security.sasl.RealmCallback;
 import org.apache.zookeeper.server.auth.DigestLoginModule;
@@ -53,16 +51,8 @@ public class SaslQuorumServerCallbackHandler implements CallbackHandler {
     private final Set<String> authzHosts;
 
     public SaslQuorumServerCallbackHandler(
-        Configuration configuration,
-        String serverSection,
-        Set<String> authzHosts) throws IOException {
-        AppConfigurationEntry[] configurationEntries = configuration.getAppConfigurationEntry(serverSection);
-
-        if (configurationEntries == null) {
-            String errorMessage = "Could not find a '" + serverSection + "' entry in this configuration: Server cannot start.";
-            LOG.error(errorMessage);
-            throw new IOException(errorMessage);
-        }
+        AppConfigurationEntry[] configurationEntries,
+        Set<String> authzHosts) {
 
         Map<String, String> credentials = new HashMap<>();
         boolean isDigestAuthn = true;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
index 84b214049f0..d0f52b152af 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
@@ -127,7 +127,9 @@ private static class TestableKerberosLogin extends Login {
     private CountDownLatch continueRefreshThread = new CountDownLatch(1);
 
     public TestableKerberosLogin() throws LoginException {
-      super(JAAS_CONFIG_SECTION, (callbacks) -> {}, new ZKConfig());
+      super(JAAS_CONFIG_SECTION, () -> {
+        return (callbacks) -> {};
+      }, new ZKConfig());
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
new file mode 100644
index 00000000000..9757eaccaaa
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+import javax.security.auth.login.Configuration;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class SaslAuthRequiredMultiClientTest extends ClientBase {
+
+    @BeforeAll
+    public static void setUpBeforeClass() {
+        System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
+        System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
+        System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas.conf", "test"));
+    }
+
+    @AfterAll
+    public static void tearDownAfterClass() {
+        System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
+        System.clearProperty(SaslTestUtil.authProviderProperty);
+        System.clearProperty(SaslTestUtil.jaasConfig);
+    }
+
+    @Test
+    public void testClientOpWithInvalidSASLUserAuthAfterSuccessLogin() throws Exception {
+        resetJaasConfiguration("jaas.conf", "super", "test");
+        try  (ZooKeeper zk = createClient()) {
+            zk.create("/foobar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+        } catch (KeeperException e) {
+            fail("Client operation should succeed with valid SASL configuration.");
+        }
+
+        resetJaasConfiguration("jaas.conf", "super_wrong", "test");
+        try  (ZooKeeper wrongUserZk = createClient()) {
+            wrongUserZk.create("/bar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            fail("Client with wrong SASL config should not pass SASL authentication.");
+        } catch (KeeperException e) {
+            assertEquals(KeeperException.Code.AUTHFAILED, e.code());
+        }
+    }
+
+    @Test
+    public void testClientOpWithInvalidSASLPasswordAuthAfterSuccessLogin() throws Exception {
+        resetJaasConfiguration("jaas.conf", "super", "test");
+        try (ZooKeeper zk = createClient()) {
+            zk.create("/foobar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+        } catch (KeeperException e) {
+            fail("Client operation should succeed with valid SASL configuration.");
+        }
+
+        resetJaasConfiguration("jaas.conf", "super", "test_wrongong");
+        try (ZooKeeper wrongPasswordZk = createClient()) {
+            wrongPasswordZk.create("/bar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            fail("Client with wrong SASL config should not pass SASL authentication.");
+        } catch (KeeperException e) {
+            assertEquals(KeeperException.Code.AUTHFAILED, e.code());
+        }
+    }
+
+    protected static void resetJaasConfiguration(String fileName, String userName, String password) {
+        Configuration.setConfiguration(null);
+        System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile(fileName, userName, password));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
index 54d17f59790..d982fb695bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
@@ -28,6 +28,7 @@ public class SaslTestUtil extends ClientBase {
     // The maximum time (in milliseconds) a client should take to observe
     // a disconnect event of the same client from server.
     static Integer CLIENT_DISCONNECT_TIMEOUT = 3000;
+    static String SUPER_USER_NAME = "super";
     static String requireSASLAuthProperty = "zookeeper.sessionRequireClientSASLAuth";
     static String authProviderProperty = "zookeeper.authProvider.1";
     static String authProvider = "org.apache.zookeeper.server.auth.SASLAuthenticationProvider";
@@ -35,6 +36,10 @@ public class SaslTestUtil extends ClientBase {
     static String jaasConfig = "java.security.auth.login.config";
 
     static String createJAASConfigFile(String fileName, String password) {
+        return createJAASConfigFile(fileName, SUPER_USER_NAME, password);
+    }
+
+    static String createJAASConfigFile(String fileName, String userName, String password) {
         String ret = null;
         try {
             File tmpDir = createTmpDir();
@@ -47,7 +52,7 @@ static String createJAASConfigFile(String fileName, String password) {
                     + "};\n"
                     + "Client {\n"
                     + "       " + digestLoginModule + " required\n"
-                    + "       username=\"super\"\n"
+                    + "       username=\"" + userName + "\"\n"
                     + "       password=\"" + password + "\";\n"
                     + "};" + "\n");
             fwriter.close();

From 1880fc0d0a092b2c4e518bc45d5c4e8a77ca4abc Mon Sep 17 00:00:00 2001
From: puru <purushah@oath.com>
Date: Sat, 28 Sep 2024 19:02:21 -0700
Subject: [PATCH 474/591] ZOOKEEPER-4862. Add doc to secure prometheus support
 (#2190)

Co-authored-by: purshotam shah <purushah@yahooinc.com>
---
 .../resources/markdown/zookeeperMonitor.md    | 44 +++++++++++++++++--
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index d57645b31a8..180f1273c19 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -41,11 +41,49 @@ All the metrics are included in the `ServerMetrics.java`.
 
 <a name="Prometheus"></a>
 
+
+### Pre-requisites:
+- Enable the `Prometheus MetricsProvider` by setting the following in `zoo.cfg`:
+  ```conf
+  metricsProvider.className=org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider
+  ```
+
+- The port for Prometheus metrics can be configured using:
+  ```conf
+  metricsProvider.httpPort=7000  # Default port is 7000
+  ```
+
+#### Enabling HTTPS for Prometheus Metrics:
+
+ZooKeeper also supports SSL for Prometheus metrics, which provides secure data transmission. To enable this, configure an HTTPS port and set up SSL certificates as follows:
+
+- Define the HTTPS port:
+  ```conf
+  metricsProvider.httpsPort=4443
+  ```
+
+- Configure the SSL key store (holds the server’s private key and certificates):
+  ```conf
+  metricsProvider.ssl.keyStore.location=/path/to/keystore.jks
+  metricsProvider.ssl.keyStore.password=your_keystore_password
+  metricsProvider.ssl.keyStore.type=jks  # Default is JKS
+  ```
+
+- Configure the SSL trust store (used to verify client certificates):
+  ```conf
+  metricsProvider.ssl.trustStore.location=/path/to/truststore.jks
+  metricsProvider.ssl.trustStore.password=your_truststore_password
+  metricsProvider.ssl.trustStore.type=jks  # Default is JKS
+  ```
+
+- **Note**: You can enable both HTTP and HTTPS simultaneously by defining both ports:
+  ```conf
+  metricsProvider.httpPort=7000
+  metricsProvider.httpsPort=4443
+  ```
 ### Prometheus
 - Running a [Prometheus](https://prometheus.io/) monitoring service is the easiest way to ingest and record ZooKeeper's metrics.
-- Pre-requisites:
-  - enable the `Prometheus MetricsProvider` by setting `metricsProvider.className=org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider` in the zoo.cfg.
-  - the Port is also configurable by setting `metricsProvider.httpPort`（the default value:7000）
+
 - Install Prometheus:
   Go to the official website download [page](https://prometheus.io/download/), download the latest release.
   

From 75884ec1f4a680f46bcc0a6257df413955eda4e8 Mon Sep 17 00:00:00 2001
From: tison <wander4096@gmail.com>
Date: Tue, 8 Oct 2024 10:37:38 -0600
Subject: [PATCH 475/591] ZOOKEEPER-4868. Bump commons-io to resolve CVE
 (#2196)

Signed-off-by: tison <wander4096@gmail.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index ecc6eecc183..9f8c3d23eba 100644
--- a/pom.xml
+++ b/pom.xml
@@ -571,7 +571,7 @@
     <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
     <checkstyle.version>8.39</checkstyle.version>
     <enforcer.version>3.0.0-M3</enforcer.version>
-    <commons-io.version>2.11.0</commons-io.version>
+    <commons-io.version>2.17.0</commons-io.version>
     <burningwave.mockdns.version>0.25.4</burningwave.mockdns.version>
     <clover-maven-plugin.version>4.4.1</clover-maven-plugin.version>
     <sonar-maven-plugin.version>3.7.0.1746</sonar-maven-plugin.version>

From 935b5f43ba156fff9fa4bf10babf586aadf740cc Mon Sep 17 00:00:00 2001
From: puru <purushah@oath.com>
Date: Mon, 14 Oct 2024 23:44:37 -0700
Subject: [PATCH 476/591] ZOOKEEPER-4869: Document more time units supported in
 autopurge.purgeInterval (#2195)

The functionality was added in ZOOKEEPER-4829(#2178).

Co-authored-by: purushah <purushah@yahooinc.com>
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 5ad9fb45bca..ea63e780dfa 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -772,6 +772,10 @@ property, when available, is noted below.
     time interval in hours for which the purge task has to
     be triggered. Set to a positive integer (1 and above)
     to enable the auto purging. Defaults to 0.
+    **Suffix support added in 3.10.0:** The interval is specified as an integer with an optional suffix to indicate the time unit.
+    Supported suffixes are: `ms` for milliseconds, `s` for seconds, `m` for minutes, `h` for hours, and `d` for days.
+    For example, "10m" represents 10 minutes, and "5h" represents 5 hours.
+    If no suffix is provided, the default unit is hours.
 
 * *syncEnabled* :
     (Java system property: **zookeeper.observer.syncEnabled**)

From b99714543db86ca081a5d648c565f0d9cb4c82c2 Mon Sep 17 00:00:00 2001
From: Xin Luo <65529035+luoxiner@users.noreply.github.com>
Date: Tue, 15 Oct 2024 15:03:54 +0800
Subject: [PATCH 477/591] ZOOKEEPER-4864: Fix bad format when dump MultiTxn in
 TxnLogToolkit (#2192)

Decode Txn to record and format the output with the record for better format.
---
 .../server/persistence/TxnLogToolkit.java     | 48 +++++++++++++++++-
 .../server/persistence/TxnLogToolkitTest.java | 49 ++++++++++++-------
 2 files changed, 77 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
index 767d640770c..8cd08212254 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
@@ -49,14 +49,18 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.TxnLogEntry;
 import org.apache.zookeeper.server.util.LogChopper;
 import org.apache.zookeeper.server.util.SerializeUtils;
+import org.apache.zookeeper.txn.CheckVersionTxn;
 import org.apache.zookeeper.txn.CreateContainerTxn;
 import org.apache.zookeeper.txn.CreateTTLTxn;
 import org.apache.zookeeper.txn.CreateTxn;
+import org.apache.zookeeper.txn.DeleteTxn;
+import org.apache.zookeeper.txn.ErrorTxn;
 import org.apache.zookeeper.txn.MultiTxn;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.Txn;
@@ -315,7 +319,7 @@ private void printTxn(byte[] bytes, String prefix) throws IOException {
      * @return the formatted string
      */
     // @VisibleForTesting
-    static String getFormattedTxnStr(Record txn) {
+    static String getFormattedTxnStr(Record txn) throws IOException {
         StringBuilder txnData = new StringBuilder();
         if (txn == null) {
             return txnData.toString();
@@ -338,6 +342,12 @@ static String getFormattedTxnStr(Record txn) {
             txnData.append(createTTLTxn.getPath() + "," + checkNullToEmpty(createTTLTxn.getData()))
                    .append("," + createTTLTxn.getAcl() + "," + createTTLTxn.getParentCVersion())
                    .append("," + createTTLTxn.getTtl());
+        } else if (txn instanceof DeleteTxn) {
+            DeleteTxn deleteTxn = ((DeleteTxn) txn);
+            txnData.append(deleteTxn.getPath());
+        } else if (txn instanceof CheckVersionTxn) {
+            CheckVersionTxn checkVersionTxn = ((CheckVersionTxn) txn);
+            txnData.append(checkVersionTxn.getPath()).append(",").append(checkVersionTxn.getVersion());
         } else if (txn instanceof MultiTxn) {
             MultiTxn multiTxn = ((MultiTxn) txn);
             List<Txn> txnList = multiTxn.getTxns();
@@ -351,7 +361,7 @@ static String getFormattedTxnStr(Record txn) {
                 if (t.getType() == ZooDefs.OpCode.error) {
                     txnData.append(ByteBuffer.wrap(t.getData()).getInt());
                 } else {
-                    txnData.append(checkNullToEmpty(t.getData()));
+                    txnData.append(getFormattedTxnStr(deserializeSubTxn(t)));
                 }
             }
         } else {
@@ -361,6 +371,40 @@ static String getFormattedTxnStr(Record txn) {
         return txnData.toString();
     }
 
+    private static Record deserializeSubTxn(Txn txn) throws IOException {
+        Record record;
+        switch (txn.getType()) {
+            case ZooDefs.OpCode.create:
+            case ZooDefs.OpCode.create2:
+                record = new CreateTxn();
+                break;
+            case ZooDefs.OpCode.createTTL:
+                record = new CreateTTLTxn();
+                break;
+            case ZooDefs.OpCode.createContainer:
+                record = new CreateContainerTxn();
+                break;
+            case ZooDefs.OpCode.delete:
+            case ZooDefs.OpCode.deleteContainer:
+                record = new DeleteTxn();
+                break;
+            case ZooDefs.OpCode.setData:
+                record = new SetDataTxn();
+                break;
+            case ZooDefs.OpCode.error:
+                record = new ErrorTxn();
+                break;
+            case ZooDefs.OpCode.check:
+                record = new CheckVersionTxn();
+                break;
+            default:
+                throw new IOException("Unsupported Txn with type=" + txn.getType());
+        }
+        ByteBuffer bb = ByteBuffer.wrap(txn.getData());
+        ByteBufferInputStream.byteBuffer2Record(bb, record);
+        return record;
+    }
+
     private static String checkNullToEmpty(byte[] data) {
         if (data == null || data.length == 0) {
             return "";
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
index ec02c75b31e..361666709f4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
@@ -30,6 +30,7 @@
 import java.io.IOException;
 import java.io.PrintStream;
 import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Scanner;
@@ -37,10 +38,18 @@
 import java.util.regex.Pattern;
 import org.apache.commons.io.FileUtils;
 import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.Record;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.txn.CheckVersionTxn;
+import org.apache.zookeeper.txn.CreateContainerTxn;
+import org.apache.zookeeper.txn.CreateTTLTxn;
+import org.apache.zookeeper.txn.CreateTxn;
+import org.apache.zookeeper.txn.DeleteTxn;
 import org.apache.zookeeper.txn.ErrorTxn;
 import org.apache.zookeeper.txn.MultiTxn;
+import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.Txn;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -95,27 +104,31 @@ public void testInitMissingFile() throws FileNotFoundException, TxnLogToolkit.Tx
 
     @Test
     public void testMultiTxnDecode() throws IOException {
-        //MultiTxn with four ops, and the first op error.
+        // MultiTxn with multi ops including errors
         List<Txn> txns = new ArrayList<>();
-        int type = -1;
-        for (int i = 0; i < 4; i++) {
-            ErrorTxn txn;
-            if (i == 0) {
-                txn = new ErrorTxn(KeeperException.Code.NONODE.intValue());
-            } else {
-                txn = new ErrorTxn(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
-            }
-            try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-                BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-                txn.serialize(boa, "request");
-                ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
-                txns.add(new Txn(type, bb.array()));
-            }
-        }
+        txns.add(newSubTxn(ZooDefs.OpCode.error, new ErrorTxn(KeeperException.Code.NONODE.intValue())));
+        txns.add(newSubTxn(ZooDefs.OpCode.error, new ErrorTxn(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue())));
+        txns.add(newSubTxn(ZooDefs.OpCode.create, new CreateTxn("/test", "test-data".getBytes(StandardCharsets.UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, true, 1)));
+        txns.add(newSubTxn(ZooDefs.OpCode.createContainer, new CreateContainerTxn("/test_container", "test-data".getBytes(StandardCharsets.UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, 2)));
+        txns.add(newSubTxn(ZooDefs.OpCode.createTTL, new CreateTTLTxn("/test_container", "test-data".getBytes(StandardCharsets.UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, 2, 20)));
+        txns.add(newSubTxn(ZooDefs.OpCode.setData, new SetDataTxn("/test_set_data", "test-data".getBytes(StandardCharsets.UTF_8), 4)));
+        txns.add(newSubTxn(ZooDefs.OpCode.delete, new DeleteTxn("/test_delete")));
+        txns.add(newSubTxn(ZooDefs.OpCode.check, new CheckVersionTxn("/test_check_version", 5)));
         MultiTxn multiTxn = new MultiTxn(txns);
-
         String formattedTxnStr = TxnLogToolkit.getFormattedTxnStr(multiTxn);
-        assertEquals("error:-101;error:-2;error:-2;error:-2", formattedTxnStr);
+        assertEquals("error:-101;error:-2;create:/test,test-data,[31,s{'world,'anyone}\n"
+                    + "],true,1;createContainer:/test_container,test-data,[31,s{'world,'anyone}\n"
+                    + "],2;createTTL:/test_container,test-data,[31,s{'world,'anyone}\n"
+                    + "],2,20;setData:/test_set_data,test-data,4;delete:/test_delete;check:/test_check_version,5", formattedTxnStr);
+    }
+
+    private static Txn newSubTxn(int type, Record record) throws IOException {
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
+            record.serialize(boa, "request");
+            ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
+            return new Txn(type, bb.array());
+        }
     }
 
     @Test

From 858b7874326fc22c0889b07eec980c6c5c7cb1bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Thu, 17 Oct 2024 13:42:23 -0500
Subject: [PATCH 478/591] ZOOKEEPER-4876: jetty-http-9.4.53.v20231009.jar:
 CVE-2024-6763(3.7)

Reviewers: ztzg
Author: anmolnar
Closes #2202 from anmolnar/ZOOKEEPER-4876
---
 owaspSuppressions.xml | 6 +++++-
 pom.xml               | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 873f38df370..56003dc5b4b 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -18,6 +18,11 @@
 -->
 
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
+   <suppress>
+      <!-- ZooKeeper is not affected, because HttpURI is not used in our code.
+           see: ZOOKEEPER-4876 -->
+      <cve>CVE-2024-6763</cve>
+   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>
@@ -72,5 +77,4 @@
            in json-java which we don't use in ZooKeeper -->
       <cve>CVE-2022-45688</cve>
    </suppress>
-
 </suppressions>
diff --git a/pom.xml b/pom.xml
index 9f8c3d23eba..9cecb4d92f0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -560,7 +560,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.113.Final</netty.version>
-    <jetty.version>9.4.53.v20231009</jetty.version>
+    <jetty.version>9.4.56.v20240826</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.10.5</snappy.version>

From fe4854a72a1557a588c25f8251b0681c6be835b3 Mon Sep 17 00:00:00 2001
From: yarthur1 <30923528+yarthur1@users.noreply.github.com>
Date: Fri, 18 Oct 2024 09:44:30 +0800
Subject: [PATCH 479/591] ZOOKEEPER-4848: Fix potential stack overflow in
 setup_random

Reviewers: kezhuw, ztzg
Author: yarthur1
Closes #2097 from yarthur1/master
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index a19144b5028..97b92dd3452 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -730,7 +730,7 @@ static void setup_random()
             /* Assert we either read something or we were interrupted due to a
              * signal (errno == EINTR) in which case we need to retry.
              */
-            int rc = read(fd, &seed + seed_len, sizeof(seed) - seed_len);
+            int rc = read(fd, (char *)&seed + seed_len, sizeof(seed) - seed_len);
             assert(rc > 0 || errno == EINTR);
             if (rc > 0) {
                 seed_len += rc;

From e72f80aa38f47ac84db1bd0dadbb85f87595511e Mon Sep 17 00:00:00 2001
From: fanyang <fanyang@smartx.com>
Date: Fri, 18 Oct 2024 09:52:41 +0800
Subject: [PATCH 480/591] ZOOKEEPER-4699: Fix hostname use-after-free in the C
 client

Reviewers: kezhuw, ztzg
Author: fanyang89
Closes #2138 from fanyang89/fix-c-client-hostname-uaf
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 97b92dd3452..84a2245b2d6 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -2558,8 +2558,9 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
             *tv = get_timeval(zh->recv_timeout/60);
             zh->delay = 0;
 
-            LOG_WARN(LOGCALLBACK(zh), "Delaying connection after exhaustively trying all servers [%s]",
-                     zh->hostname);
+            lock_reconfig(zh);
+            LOG_WARN(LOGCALLBACK(zh), "Delaying connection after exhaustively trying all servers [%s]", zh->hostname);
+            unlock_reconfig(zh);
         } else {
             if (addr_rw_server) {
                 zh->addr_cur = *addr_rw_server;

From 837f86cc713a5e4ce56e1f75eeb335093ca18821 Mon Sep 17 00:00:00 2001
From: luozongle01 <luozongle@hotmail.com>
Date: Fri, 18 Oct 2024 23:35:47 +0800
Subject: [PATCH 481/591] ZOOKEEPER-4877: Fix typos in comments

Reviewers: kezhuw, shoothzj
Author: luozongle01
Closes #2203 from luozongle01/ZOOKEEPER-4877
---
 .../zookeeper/recipes/leader/LeaderElectionSupport.java       | 2 +-
 .../main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java | 2 +-
 .../zookeeper/metrics/MetricsProviderLifeCycleException.java  | 2 +-
 .../org/apache/zookeeper/server/DatadirCleanupManager.java    | 4 ++--
 .../main/java/org/apache/zookeeper/server/quorum/Leader.java  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java b/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java
index 17419a878d5..45a53dd7e45 100644
--- a/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java
+++ b/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java
@@ -278,7 +278,7 @@ private void becomeFailed(Exception e) {
      * Fetch the (user supplied) hostname of the current leader. Note that by the
      * time this method returns, state could have changed so do not depend on this
      * to be strongly consistent. This method has to read all leader offers from
-     * ZooKeeper to deterime who the leader is (i.e. there is no caching) so
+     * ZooKeeper to determine who the leader is (i.e. there is no caching) so
      * consider the performance implications of frequent invocation. If there are
      * no leader offers this method returns null.
      *
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
index 32379e74c30..82364dcb55b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -402,7 +402,7 @@ void testableCloseSocket() throws IOException {
         }
     }
 
-    // *************** <END> CientCnxnSocketNetty </END> ******************
+    // *************** <END> ClientCnxnSocketNetty </END> ******************
     private static class WakeupPacket {
 
         private static final Packet instance = new Packet(null, null, null, null, null);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java
index 24a88ef0fd3..f79bdccd6e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.metrics;
 
 /**
- * A generic exception thrown during the licecycle of a MetricsProvider.
+ * A generic exception thrown during the lifecycle of a MetricsProvider.
  * <p>These exception will prevent the system from booting.</p>
  * <p>Normally these exception will be ignored during shutdown.</p>
  */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
index 5504519afab..ac714ee0773 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
@@ -66,8 +66,8 @@ public enum PurgeTaskStatus {
      *            transaction log directory
      * @param snapRetainCount
      *            number of snapshots to be retained after purge
-     * @param purgeInterval
-     *            purge interval in hours
+     * @param purgeIntervalInMs
+     *            purge interval in milliseconds
      */
     public DatadirCleanupManager(File snapDir, File dataLogDir, int snapRetainCount, int purgeIntervalInMs) {
         this.snapDir = snapDir;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index d4281871135..1561a7dae18 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -410,7 +410,7 @@ Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean por
 
     /**
      * This message type is sent by the leader to indicate that the follower is
-     * now uptodate andt can start responding to clients.
+     * now uptodate and can start responding to clients.
      */
     static final int UPTODATE = 12;
 

From 9d522642a9c78dafb7084952f9807beb205478c3 Mon Sep 17 00:00:00 2001
From: Aditya Yadav <166515021+aditya0yadav@users.noreply.github.com>
Date: Tue, 29 Oct 2024 07:47:04 +0530
Subject: [PATCH 482/591] ZOOKEEPER-4852: Fix the bad "*uuuuu" mark in the ASF
 license

Reviewers: tisonkun, kezhuw
Author: aditya0yadav
Closes #2207 from aditya0yadav/master
---
 .../org/apache/zookeeper/server/ByteBufferRequestRecord.java  | 4 ++--
 .../src/main/java/org/apache/zookeeper/server/Request.java    | 4 ++--
 .../main/java/org/apache/zookeeper/server/RequestRecord.java  | 4 ++--
 .../java/org/apache/zookeeper/server/SimpleRequestRecord.java | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
index 5ddae2460ac..73f068d995a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
@@ -8,9 +8,9 @@
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
- *uuuuu
+ *
  * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index c174fdd1e2f..c8b404e7928 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -8,9 +8,9 @@
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
- *uuuuu
+ *
  * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
index 6265f168e4e..c18e4ce2a6b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
@@ -8,9 +8,9 @@
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
- *uuuuu
+ *
  * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
index a97cd19ae1c..9a49fad8470 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
@@ -8,9 +8,9 @@
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
- *uuuuu
+ *
  * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.

From 91ab3f5274658a457f205065233db038ba7e622f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Natalie=20Klestrup=20R=C3=B6ijezon?= <nat@nullable.se>
Date: Fri, 22 Nov 2024 23:32:10 +0100
Subject: [PATCH 483/591] ZOOKEEPER-4790: Make client hostname verification
 configurable

Reviewers: anmolnar
Author: nightkr
Closes #2173 from nightkr/feature/config-client-hostname-verification
---
 .../src/main/resources/markdown/zookeeperAdmin.md         | 7 +++++++
 .../main/java/org/apache/zookeeper/common/X509Util.java   | 8 +++++++-
 .../main/java/org/apache/zookeeper/common/ZKConfig.java   | 1 +
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index ea63e780dfa..562d067d5c6 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1754,6 +1754,13 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Disabling it only recommended for testing purposes.
     Default: true
 
+* *ssl.clientHostnameVerification* and *ssl.quorum.clientHostnameVerification* :
+    (Java system properties: **zookeeper.ssl.clientHostnameVerification** and **zookeeper.ssl.quorum.clientHostnameVerification**)
+    **New in 3.9.4:**
+    Specifies whether the client's hostname verification is enabled in client and quorum TLS negotiation process.
+    This option requires the corresponding *hostnameVerification* option to be `true`, or it will be ignored.
+    Default: true for quorum, false for clients
+
 * *ssl.crl* and *ssl.quorum.crl* :
     (Java system properties: **zookeeper.ssl.crl** and **zookeeper.ssl.quorum.crl**)
     **New in 3.5.5:**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index a7a9fb7a3d5..dfb3f11916e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -196,6 +196,7 @@ public io.netty.handler.ssl.ClientAuth toNettyClientAuth() {
     private final String sslTruststoreTypeProperty = getConfigPrefix() + "trustStore.type";
     private final String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
     private final String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
+    private final String sslClientHostnameVerificationEnabledProperty = getConfigPrefix() + "clientHostnameVerification";
     private final String sslCrlEnabledProperty = getConfigPrefix() + "crl";
     private final String sslOcspEnabledProperty = getConfigPrefix() + "ocsp";
     private final String sslClientAuthProperty = getConfigPrefix() + "clientAuth";
@@ -270,6 +271,10 @@ public String getSslHostnameVerificationEnabledProperty() {
         return sslHostnameVerificationEnabledProperty;
     }
 
+    public String getSslClientHostnameVerificationEnabledProperty() {
+        return sslClientHostnameVerificationEnabledProperty;
+    }
+
     public String getSslCrlEnabledProperty() {
         return sslCrlEnabledProperty;
     }
@@ -305,7 +310,8 @@ public boolean isServerHostnameVerificationEnabled(ZKConfig config) {
     }
 
     public boolean isClientHostnameVerificationEnabled(ZKConfig config) {
-        return isServerHostnameVerificationEnabled(config) && shouldVerifyClientHostname();
+        return isServerHostnameVerificationEnabled(config)
+            && config.getBoolean(this.getSslClientHostnameVerificationEnabledProperty(), shouldVerifyClientHostname());
     }
 
     public SSLContext getDefaultSSLContext() throws X509Exception.SSLContextException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index de062e74754..846a5632e06 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -127,6 +127,7 @@ private void putSSLProperties(X509Util x509Util) {
         properties.put(x509Util.getSslTruststorePasswdPathProperty(), System.getProperty(x509Util.getSslTruststorePasswdPathProperty()));
         properties.put(x509Util.getSslTruststoreTypeProperty(), System.getProperty(x509Util.getSslTruststoreTypeProperty()));
         properties.put(x509Util.getSslContextSupplierClassProperty(), System.getProperty(x509Util.getSslContextSupplierClassProperty()));
+        properties.put(x509Util.getSslClientHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslClientHostnameVerificationEnabledProperty()));
         properties.put(x509Util.getSslHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
         properties.put(x509Util.getSslCrlEnabledProperty(), System.getProperty(x509Util.getSslCrlEnabledProperty()));
         properties.put(x509Util.getSslOcspEnabledProperty(), System.getProperty(x509Util.getSslOcspEnabledProperty()));

From fe64596e8d58839b98366861a628a3e1d16a7014 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Mon, 25 Nov 2024 00:28:26 -0600
Subject: [PATCH 484/591] ZOOKEEPER-4889: Fallback to DIGEST-MD5 auth mech
 should be disabled in Fips mode (#2213)

---
 .../zookeeper/client/ZooKeeperSaslClient.java |  2 +-
 .../org/apache/zookeeper/common/X509Util.java |  7 +--
 .../auth/X509AuthenticationProvider.java      |  2 +-
 .../quorum/auth/SaslQuorumAuthLearner.java    |  1 +
 .../apache/zookeeper/util/SecurityUtils.java  |  8 ++++
 .../org/apache/zookeeper/SaslAuthTest.java    |  4 +-
 .../ZookeeperServerClusterMutualAuthTest.java |  4 ++
 .../quorum/auth/DigestSecurityTestcase.java   | 44 +++++++++++++++++++
 .../quorum/auth/QuorumAuthUpgradeTest.java    |  2 +-
 .../quorum/auth/QuorumDigestAuthTest.java     |  2 +-
 .../test/SaslAuthDesignatedClientTest.java    |  2 +-
 .../test/SaslAuthDesignatedServerTest.java    |  2 +-
 .../test/SaslAuthDigestTestBase.java          | 44 +++++++++++++++++++
 .../SaslAuthFailDesignatedClientTest.java     |  2 +-
 .../zookeeper/test/SaslAuthFailTest.java      |  2 +-
 .../test/SaslAuthMissingClientConfigTest.java |  2 +-
 .../test/SaslAuthRequiredFailNoSASLTest.java  |  2 +-
 .../SaslAuthRequiredFailWrongSASLTest.java    |  2 +-
 .../test/SaslAuthRequiredMultiClientTest.java |  2 +-
 .../zookeeper/test/SaslAuthRequiredTest.java  |  2 +-
 .../test/SaslDigestAuthOverSSLTest.java       |  2 +-
 .../zookeeper/test/SaslSuperUserTest.java     |  2 +-
 22 files changed, 122 insertions(+), 20 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
index f86c41db743..4ec85625d78 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
@@ -250,7 +250,7 @@ private SaslClient createSaslClient(
                     l.startThreadIfNeeded();
                 }
             }
-            return SecurityUtils.createSaslClient(loginRef.get().getSubject(),
+            return SecurityUtils.createSaslClient(clientConfig, loginRef.get().getSubject(),
                 servicePrincipal, "zookeeper", "zk-sasl-md5", LOG, "Client");
         } catch (LoginException e) {
             // We throw LoginExceptions...
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index dfb3f11916e..17818207e9e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -73,7 +73,8 @@ public abstract class X509Util implements Closeable, AutoCloseable {
     private static final Logger LOG = LoggerFactory.getLogger(X509Util.class);
 
     private static final String REJECT_CLIENT_RENEGOTIATION_PROPERTY = "jdk.tls.rejectClientInitiatedRenegotiation";
-    private static final String FIPS_MODE_PROPERTY = "zookeeper.fips-mode";
+    public static final String FIPS_MODE_PROPERTY = "zookeeper.fips-mode";
+    private static final boolean FIPS_MODE_DEFAULT = true;
     public static final String TLS_1_1 = "TLSv1.1";
     public static final String TLS_1_2 = "TLSv1.2";
     public static final String TLS_1_3 = "TLSv1.3";
@@ -301,8 +302,8 @@ public String getFipsModeProperty() {
         return FIPS_MODE_PROPERTY;
     }
 
-    public boolean getFipsMode(ZKConfig config) {
-        return config.getBoolean(FIPS_MODE_PROPERTY, true);
+    public static boolean getFipsMode(ZKConfig config) {
+        return config.getBoolean(FIPS_MODE_PROPERTY, FIPS_MODE_DEFAULT);
     }
 
     public boolean isServerHostnameVerificationEnabled(ZKConfig config) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 26c083c3c9e..4ea925320f6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -106,7 +106,7 @@ public X509AuthenticationProvider() throws X509Exception {
                     x509Util.getSslTruststorePasswdProperty(),
                     x509Util.getSslTruststorePasswdPathProperty());
             String trustStoreTypeProp = config.getProperty(x509Util.getSslTruststoreTypeProperty());
-            boolean fipsMode = x509Util.getFipsMode(config);
+            boolean fipsMode = X509Util.getFipsMode(config);
 
             if (trustStoreLocation.isEmpty()) {
                 LOG.warn("Truststore not specified for client connection");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
index 0b5ac551d3d..3151a57567d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
@@ -94,6 +94,7 @@ public void authenticate(Socket sock, String hostName) throws IOException {
             DataInputStream din = new DataInputStream(sock.getInputStream());
             byte[] responseToken = new byte[0];
             sc = SecurityUtils.createSaslClient(
+                new ZKConfig(),
                 learnerLogin.getSubject(),
                 principalConfig,
                 QuorumAuth.QUORUM_SERVER_PROTOCOL_NAME,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
index 6ac3fff2a40..5c44f21161f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
@@ -28,6 +28,8 @@
 import javax.security.sasl.SaslException;
 import javax.security.sasl.SaslServer;
 import org.apache.zookeeper.SaslClientCallbackHandler;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.auth.KerberosName;
 import org.ietf.jgss.GSSContext;
 import org.ietf.jgss.GSSCredential;
@@ -55,6 +57,7 @@ public final class SecurityUtils {
      * @throws SaslException
      */
     public static SaslClient createSaslClient(
+        ZKConfig config,
         final Subject subject,
         final String servicePrincipal,
         final String protocol,
@@ -67,6 +70,11 @@ public static SaslClient createSaslClient(
         if (subject.getPrincipals().isEmpty()) {
             // no principals: must not be GSSAPI: use DIGEST-MD5 mechanism
             // instead.
+            // FIPS-mode: don't try DIGEST-MD5, just return error
+            if (X509Util.getFipsMode(config)) {
+                LOG.warn("{} will not use DIGEST-MD5 as SASL mechanism, because FIPS mode is enabled.", entity);
+                return null;
+            }
             LOG.info("{} will use DIGEST-MD5 as SASL mechanism.", entity);
             String[] mechs = {"DIGEST-MD5"};
             String username = (String) (subject.getPublicCredentials().toArray()[0]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
index 8e713e37c94..fe9b41dc625 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
@@ -39,12 +39,12 @@
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
-import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.SaslAuthDigestTestBase;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthTest extends ClientBase {
+public class SaslAuthTest extends SaslAuthDigestTestBase {
 
     @BeforeAll
     public static void init() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
index 1022c25c127..a66e476ce54 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
@@ -26,6 +26,7 @@
 import java.util.Properties;
 import javax.security.auth.login.Configuration;
 import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
@@ -39,6 +40,8 @@ public class ZookeeperServerClusterMutualAuthTest {
 
     @BeforeAll
     public static void setUpEnvironment() {
+        // Need to disable Fips-mode, because we use DIGEST-MD5 mech for Sasl
+        System.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
         System.setProperty("java.security.auth.login.config", new File("src/test/resources/embedded/test_jaas_server_auth.conf")
                 .getAbsolutePath());
         Configuration.getConfiguration().refresh();
@@ -52,6 +55,7 @@ public static void cleanUpEnvironment() throws InterruptedException, IOException
         System.clearProperty("zookeeper.4lw.commands.whitelist");
         System.clearProperty("java.security.auth.login.config");
         Configuration.getConfiguration().refresh();
+        System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
     }
 
     @TempDir
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java
new file mode 100644
index 00000000000..a3a206be4c4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum.auth;
+
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.test.SaslAuthDigestTestBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+/**
+ * Created for test cases which use Digest Auth mech for SASL.
+ * Primary reason is that we have to disable FIPS mode, otherwise DIGEST-MD5 cannot be used.
+ *
+ * @see SaslAuthDigestTestBase
+ */
+public class DigestSecurityTestcase extends QuorumAuthTestBase {
+
+  @BeforeAll
+  public static void setUpClass() throws Exception {
+    // Need to disable Fips-mode, because we use DIGEST-MD5 mech for Sasl
+    System.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
+  }
+
+  @AfterAll
+  public static void tearDownClass() throws Exception {
+    System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
index fb03f23d6b2..aed0c9fe9a2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
@@ -52,7 +52,7 @@
  * quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true and quorum.auth.serverRequireSasl=true
  * Now, all the servers are fully upgraded and running in secured mode.
  */
-public class QuorumAuthUpgradeTest extends QuorumAuthTestBase {
+public class QuorumAuthUpgradeTest extends DigestSecurityTestcase {
 
     static {
         String jaasEntries = "QuorumServer {\n"
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
index c70c5c9c3ad..ecc27772e3a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
@@ -39,7 +39,7 @@
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
 
-public class QuorumDigestAuthTest extends QuorumAuthTestBase {
+public class QuorumDigestAuthTest extends DigestSecurityTestcase {
 
     static {
         String jaasEntries = "QuorumServer {\n"
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
index e5cd89d43e5..57c57d0b0d6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
@@ -40,7 +40,7 @@
 import org.apache.zookeeper.data.Id;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthDesignatedClientTest extends ClientBase {
+public class SaslAuthDesignatedClientTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
index c534b6ff660..8b85e13bb14 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
@@ -33,7 +33,7 @@
 import org.apache.zookeeper.server.ZooKeeperSaslServer;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthDesignatedServerTest extends ClientBase {
+public class SaslAuthDesignatedServerTest extends SaslAuthDigestTestBase {
 
     public static int AUTHENTICATION_TIMEOUT = 30000;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java
new file mode 100644
index 00000000000..2e3b4a2ba69
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import org.apache.zookeeper.common.X509Util;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+/**
+ * Created as a base class for Digest Auth based SASL authentication tests.
+ * We need to disable Fips mode, otherwise DIGEST-MD5 cannot be used.
+ *
+ * @see org.apache.zookeeper.server.quorum.auth.DigestSecurityTestcase
+ */
+public class SaslAuthDigestTestBase extends ClientBase {
+
+  @BeforeAll
+  public static void beforeClass() throws Exception {
+    // Need to disable Fips-mode, because we use DIGEST-MD5 mech for Sasl
+    System.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
+  }
+
+  @AfterAll
+  public static void afterClass() throws Exception {
+    System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+  }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
index 84579a90968..0d2c32a3ad8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
@@ -30,7 +30,7 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthFailDesignatedClientTest extends ClientBase {
+public class SaslAuthFailDesignatedClientTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
index 93204b4ebe9..2384cd612ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
@@ -30,7 +30,7 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthFailTest extends ClientBase {
+public class SaslAuthFailTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
index aa944525340..1bfd0ab34f1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
@@ -29,7 +29,7 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthMissingClientConfigTest extends ClientBase {
+public class SaslAuthMissingClientConfigTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
index f5b99b90d49..2d8c48c0605 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
@@ -28,7 +28,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredFailNoSASLTest extends ClientBase {
+public class SaslAuthRequiredFailNoSASLTest extends SaslAuthDigestTestBase {
 
     @BeforeAll
     public static void setup() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
index 4d119a01359..670706df232 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
@@ -28,7 +28,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredFailWrongSASLTest extends ClientBase {
+public class SaslAuthRequiredFailWrongSASLTest extends SaslAuthDigestTestBase {
 
     @BeforeAll
     public static void setUpBeforeClass() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
index 9757eaccaaa..f21d634558b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
@@ -29,7 +29,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredMultiClientTest extends ClientBase {
+public class SaslAuthRequiredMultiClientTest extends SaslAuthDigestTestBase {
 
     @BeforeAll
     public static void setUpBeforeClass() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
index 8333eb05b51..657e7fe15ab 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
@@ -27,7 +27,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredTest extends ClientBase {
+public class SaslAuthRequiredTest extends SaslAuthDigestTestBase {
 
     @BeforeAll
     public static void setUpBeforeClass() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
index a21e4a5a1f7..9f675e60940 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
@@ -41,7 +41,7 @@
 import org.junit.jupiter.api.Test;
 
 
-public class SaslDigestAuthOverSSLTest extends ClientBase {
+public class SaslDigestAuthOverSSLTest extends SaslAuthDigestTestBase {
 
     private ClientX509Util clientX509Util;
     private File saslConfFile;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
index 8676fbe1456..6bab78a77b1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
@@ -39,7 +39,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-public class SaslSuperUserTest extends ClientBase {
+public class SaslSuperUserTest extends SaslAuthDigestTestBase {
 
     private static Id otherSaslUser = new Id("sasl", "joe");
     private static Id otherDigestUser;

From 2ac76016ecb229b1057a9e3e0a15806a5b57057f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 26 Nov 2024 09:54:18 -0600
Subject: [PATCH 485/591] ZOOKEEPER-4889: Fallback to DIGEST-MD5 auth mech
 should be disabled in Fips mode - doc change (ADDENDUM)

Reviewers: kezhuw, symat
Author: anmolnar
Closes #2214 from anmolnar/ZOOKEEPER-4889_doc
---
 .../src/main/resources/markdown/zookeeperAdmin.md    | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 562d067d5c6..5f42bea59b8 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1866,10 +1866,14 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *fips-mode* :
     (Java system property: **zookeeper.fips-mode**)
     **New in 3.8.2:**
-    Enable FIPS compatibility mode in ZooKeeper. If enabled, the custom trust manager (`ZKTrustManager`) that is used for 
-    hostname verification will be disabled in order to comply with FIPS requirements. As a consequence, hostname verification is not
-    available in the Quorum protocol, but still can be set in client-server communication. Default: **true** (3.9.0+), 
-    **false** (3.8.x)
+    Enable FIPS compatibility mode in ZooKeeper. If enabled, the following things will be changed in order to comply 
+    with FIPS requirements:
+    * Custom trust manager (`ZKTrustManager`) that is used for hostname verification will be disabled. As a consequence, 
+      hostname verification is not available in the Quorum protocol, but still can be set in client-server communication. 
+    * DIGEST-MD5 Sasl auth mechanism will be disabled in Quorum and ZooKeeper Sasl clients. Only GSSAPI (Kerberos)
+      can be used.
+    
+    Default: **true** (3.9.0+), **false** (3.8.x)
 
 <a name="Experimental+Options%2FFeatures"></a>
 

From 333c8b89b3f5d30b57e3f21335258181608d0bbc Mon Sep 17 00:00:00 2001
From: Robson Braga <robsonselzelin@gmail.com>
Date: Tue, 26 Nov 2024 15:32:25 -0500
Subject: [PATCH 486/591] ZOOKEEPER-4890: Update Netty to fix CVE-2024-47535

Reviewers: anmolnar
Author: robsonselzelin
Closes #2212 from robsonselzelin/fix-CVE-2024-47535
---
 pom.xml                                                         | 2 +-
 ...Final.LICENSE.txt => netty-buffer-4.1.115.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-codec-4.1.115.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-common-4.1.115.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-handler-4.1.115.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-resolver-4.1.115.Final.LICENSE.txt} | 0
 ...al.LICENSE.txt => netty-transport-4.1.115.Final.LICENSE.txt} | 0
 ... => netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt} | 0
 ...etty-transport-native-unix-common-4.1.115.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.105.Final.LICENSE.txt => netty-buffer-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.105.Final.LICENSE.txt => netty-codec-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.105.Final.LICENSE.txt => netty-common-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.105.Final.LICENSE.txt => netty-handler-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.105.Final.LICENSE.txt => netty-resolver-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.105.Final.LICENSE.txt => netty-transport-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt => netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.115.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 9cecb4d92f0..38dd41ba483 100644
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.113.Final</netty.version>
+    <netty.version>4.1.115.Final</netty.version>
     <jetty.version>9.4.56.v20240826</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.115.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.105.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.115.Final.LICENSE.txt

From aba99cfa323757d14893eb1a7d813c5fbdec7500 Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Tue, 26 Nov 2024 15:38:02 -0500
Subject: [PATCH 487/591] [CI] (Trivial) Update GitHub Actions

Reviewers: anmolnar
Author: ctubbsii
Closes #2216 from ctubbsii/update-ga-v4
---
 .github/workflows/ci.yaml     | 19 ++++++-------------
 .github/workflows/e2e.yaml    | 13 +++----------
 .github/workflows/manual.yaml | 17 +++++------------
 3 files changed, 14 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 5d220e69392..f0b212765f1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -48,20 +48,13 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Set up JDK ${{ matrix.profile.jdk }}
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: ${{ matrix.profile.jdk }}
         distribution: temurin
-    - name: Cache local maven repository
-      uses: actions/cache@v3
-      with:
-        path: |
-          ~/.m2/repository/
-          !~/.m2/repository/org/apache/zookeeper
-        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-        restore-keys: ${{ runner.os }}-m2
+        cache: 'maven'
     - name: Show the first log message
       run: git log -n1
     - name: Install C Dependencies
@@ -74,21 +67,21 @@ jobs:
         MAVEN_OPTS: -Djansi.force=true
     - name: Upload unit test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: surefire-reports-${{ matrix.profile.name }}
         path: ./**/target/surefire-reports/
         if-no-files-found: ignore
     - name: Upload integration test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: failsafe-reports-${{ matrix.profile.name }}
         path: ./**/target/failsafe-reports/
         if-no-files-found: ignore
     - name: Upload cppunit test logs
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: cppunit-logs-${{ matrix.profile.name }}
         path: ./zookeeper-client/zookeeper-client-c/target/c/TEST-*.txt
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index e497c3f0396..b47c300d43e 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -31,20 +31,13 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Set up JDK ${{ matrix.jdk }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ matrix.jdk }}
           distribution: temurin
-      - name: Cache local maven repository
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.m2/repository/
-            !~/.m2/repository/org/apache/zookeeper
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
+          cache: 'maven'
       - name: Show the first log message
         run: git log -n1
       - name: Install C Dependencies
diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml
index 905ba49f33d..898fd283b9c 100644
--- a/.github/workflows/manual.yaml
+++ b/.github/workflows/manual.yaml
@@ -43,22 +43,15 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         ref: ${{ github.event.inputs.buildRef }}
     - name: Set up JDK 11
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: 11
         distribution: temurin
-    - name: Cache local maven repository
-      uses: actions/cache@v3
-      with:
-        path: |
-          ~/.m2/repository/
-          !~/.m2/repository/org/apache/zookeeper
-        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-        restore-keys: ${{ runner.os }}-m2
+        cache: 'maven'
     - name: Show the first log message
       run: git log -n1
     - name: Install C Dependencies
@@ -71,14 +64,14 @@ jobs:
         MAVEN_OPTS: -Djansi.force=true
     - name: Upload unit test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: surefire-reports
         path: ./**/target/surefire-reports/
         if-no-files-found: ignore
     - name: Upload integration test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: failsafe-reports
         path: ./**/target/failsafe-reports/

From 3e02328048a9c753624d44aba51ac70cab60619a Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Tue, 26 Nov 2024 17:13:02 -0800
Subject: [PATCH 488/591] ZOOKEEPER-4872: SnapshotCommand should not perform
 fastForwardFromEdits

Reviewers: kezhuw
Author: li4wang
Closes #2210 from li4wang/ZOOKEEPER-4872
---
 .../org/apache/zookeeper/server/ZooKeeperServer.java     | 9 ++-------
 .../java/org/apache/zookeeper/server/admin/Commands.java | 2 +-
 .../zookeeper/server/ZookeeperServerRestoreTest.java     | 2 +-
 .../zookeeper/server/ZookeeperServerSnapshotTest.java    | 2 +-
 .../apache/zookeeper/server/admin/RestoreQuorumTest.java | 2 +-
 5 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 6740f6d524b..8e291f86939 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -554,7 +554,7 @@ public File takeSnapshot() throws IOException {
     }
 
     public File takeSnapshot(boolean syncSnap) throws IOException {
-        return takeSnapshot(syncSnap, true, false);
+        return takeSnapshot(syncSnap, true);
     }
 
     /**
@@ -562,18 +562,13 @@ public File takeSnapshot(boolean syncSnap) throws IOException {
      *
      * @param syncSnap syncSnap sync the snapshot immediately after write
      * @param isSevere if true system exist, otherwise throw IOException
-     * @param fastForwardFromEdits whether fast forward database to the latest recorded transactions
-     *
      * @return file snapshot file object
      * @throws IOException
      */
-    public synchronized File takeSnapshot(boolean syncSnap, boolean isSevere, boolean fastForwardFromEdits) throws IOException {
+    public synchronized File takeSnapshot(boolean syncSnap, boolean isSevere) throws IOException {
         long start = Time.currentElapsedTime();
         File snapFile = null;
         try {
-            if (fastForwardFromEdits) {
-                zkDb.fastForwardDataBase();
-            }
             snapFile = txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
         } catch (IOException e) {
             if (isSevere) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 74dfdc3c113..cd5adc76ac6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -783,7 +783,7 @@ public CommandResponse runGet(final ZooKeeperServer zkServer, final Map<String,
 
             // take snapshot and stream out data if needed
             try {
-                final File snapshotFile = zkServer.takeSnapshot(false, false, true);
+                final File snapshotFile = zkServer.takeSnapshot(false, false);
                 final long lastZxid = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
                 response.addHeader(RESPONSE_HEADER_LAST_ZXID, "0x" + ZxidUtils.zxidToString(lastZxid));
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
index 85f514dd72d..ac7a008f18d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
@@ -74,7 +74,7 @@ public void testRestoreFromSnapshot() throws Exception {
             }
 
             // take Snapshot
-            final File snapshotFile = zks.takeSnapshot(false, false, true);
+            final File snapshotFile = zks.takeSnapshot(false, false);
             final long lastZxidFromSnapshot = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
 
             // zk2 create more test data after snapshotting
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
index c9d74a4cb05..890cbd2bece 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
@@ -62,7 +62,7 @@ public void testTakeSnapshot() throws Exception {
             }
 
             // takeSnapshot
-            zks.takeSnapshot(false, false, true);
+            zks.takeSnapshot(false, false);
 
             // clean up
             zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
index 38ca7f89766..e5d43f7c695 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
@@ -85,7 +85,7 @@ public void testRestoreAfterQuorumLost() throws Exception {
 
             // create more data after restore
             for (int i = NODE_COUNT * 2; i < NODE_COUNT * 3; i++) {
-                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL);
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             }
 
             // validate all servers have expected data

From 75f9781ecc3cde9fa5a032fa8cfa8c79b69ef879 Mon Sep 17 00:00:00 2001
From: Xin Luo <65529035+luoxiner@users.noreply.github.com>
Date: Wed, 27 Nov 2024 09:21:45 +0800
Subject: [PATCH 489/591] ZOOKEEPER-4819: Fix can't seek for writable tls
 server if connected to readonly server

Reviewers: kezhuw
Author: luoxiner
Closes #2200 from luoxiner/ZOOKEEPER-4819
---
 .../java/org/apache/zookeeper/ClientCnxn.java |  37 +----
 .../zookeeper/client/FourLetterWordMain.java  |  29 ++++
 .../test/ReadOnlyModeWithSSLTest.java         | 137 ++++++++++++++++++
 3 files changed, 171 insertions(+), 32 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index b23ce82dc4f..c24308fb67e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -19,13 +19,10 @@
 package org.apache.zookeeper;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStreamReader;
 import java.net.ConnectException;
 import java.net.InetSocketAddress;
-import java.net.Socket;
 import java.net.SocketAddress;
 import java.nio.ByteBuffer;
 import java.util.ArrayDeque;
@@ -67,10 +64,12 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.ZooKeeper.WatchRegistration;
+import org.apache.zookeeper.client.FourLetterWordMain;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.proto.AuthPacket;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.Create2Response;
@@ -1303,42 +1302,16 @@ private void pingRwServer() throws RWServerFoundException {
             InetSocketAddress addr = hostProvider.next(0);
 
             LOG.info("Checking server {} for being r/w. Timeout {}", addr, pingRwTimeout);
-
-            Socket sock = null;
-            BufferedReader br = null;
             try {
-                sock = new Socket(addr.getHostString(), addr.getPort());
-                sock.setSoLinger(false, -1);
-                sock.setSoTimeout(1000);
-                sock.setTcpNoDelay(true);
-                sock.getOutputStream().write("isro".getBytes());
-                sock.getOutputStream().flush();
-                sock.shutdownOutput();
-                br = new BufferedReader(new InputStreamReader(sock.getInputStream()));
-                result = br.readLine();
+                result = FourLetterWordMain.send4LetterWord(addr.getHostString(), addr.getPort(), "isro", clientConfig, 1000);
             } catch (ConnectException e) {
                 // ignore, this just means server is not up
-            } catch (IOException e) {
+            } catch (IOException | X509Exception.SSLContextException e) {
                 // some unexpected error, warn about it
                 LOG.warn("Exception while seeking for r/w server.", e);
-            } finally {
-                if (sock != null) {
-                    try {
-                        sock.close();
-                    } catch (IOException e) {
-                        LOG.warn("Unexpected exception", e);
-                    }
-                }
-                if (br != null) {
-                    try {
-                        br.close();
-                    } catch (IOException e) {
-                        LOG.warn("Unexpected exception", e);
-                    }
-                }
             }
 
-            if ("rw".equals(result)) {
+            if ("rw\n".equals(result)) {
                 pingRwTimeout = minPingRwTimeout;
                 // save the found address so that it's used during the next
                 // connection attempt
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
index 39988c39bf9..b4e6602879b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
@@ -94,6 +94,33 @@ public static String send4LetterWord(
         return send4LetterWord(host, port, cmd, secure, timeout, null);
     }
 
+    /**
+     * Send the 4letterword
+     * @param host the destination host
+     * @param port the destination port
+     * @param cmd the 4letterword
+     * @param clientConfig client config
+     * @param timeout in milliseconds, maximum time to wait while connecting/reading data
+     * @return server response
+     * @throws SSLContextException
+     * @throws IOException
+     */
+    public static String send4LetterWord(
+            String host,
+            int port,
+            String cmd,
+            ZKClientConfig clientConfig,
+            int timeout) throws SSLContextException, IOException {
+        boolean useSecure = clientConfig.getBoolean(ZKClientConfig.SECURE_CLIENT);
+        SSLContext sslContext = null;
+        if (useSecure) {
+            try (X509Util x509Util = new ClientX509Util()) {
+                sslContext = x509Util.createSSLContext(clientConfig);
+            }
+        }
+        return send4LetterWord(host, port, cmd, useSecure, timeout, sslContext);
+    }
+
     /**
      * Send the 4letterword
      * @param host the destination host
@@ -137,7 +164,9 @@ public static String send4LetterWord(
                 sock = new Socket();
                 sock.connect(hostaddress, timeout);
             }
+            sock.setSoLinger(false, -1);
             sock.setSoTimeout(timeout);
+            sock.setTcpNoDelay(true);
             OutputStream outstream = sock.getOutputStream();
             outstream.write(cmd.getBytes(UTF_8));
             outstream.flush();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java
new file mode 100644
index 00000000000..701cd0f6d72
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java
@@ -0,0 +1,137 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.ByteArrayOutputStream;
+import java.io.LineNumberReader;
+import java.io.StringReader;
+import java.util.regex.Pattern;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.StringUtils;
+import org.apache.zookeeper.server.NettyServerCnxnFactory;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+
+public class ReadOnlyModeWithSSLTest extends ZKTestCase {
+
+    private static int CONNECTION_TIMEOUT = QuorumBase.CONNECTION_TIMEOUT;
+    private QuorumUtil qu = new QuorumUtil(1);
+    private ClientX509Util clientX509Util;
+    private ZKClientConfig clientConfig;
+
+    @BeforeEach
+    public void setUp() throws Exception {
+        clientX509Util = new ClientX509Util();
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        clientConfig = new ZKClientConfig();
+        clientConfig.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
+        clientConfig.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
+        clientConfig.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        clientConfig.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        clientConfig.setProperty(clientX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        clientConfig.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
+        System.setProperty("readonlymode.enabled", "true");
+        System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
+        System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty(clientX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        System.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        System.clearProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY);
+        System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
+        System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdPathProperty());
+        System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdPathProperty());
+        System.clearProperty(clientX509Util.getFipsModeProperty());
+        System.clearProperty(clientX509Util.getSslHostnameVerificationEnabledProperty());
+        System.clearProperty(clientX509Util.getSslProviderProperty());
+        clientX509Util.close();
+        System.setProperty("readonlymode.enabled", "false");
+        qu.tearDown();
+    }
+
+    /**
+     * Ensures that client seeks for r/w servers while it's connected to r/o
+     * server.
+     */
+    @Test
+    @Timeout(value = 90)
+    public void testSeekForRwServerWithSSL() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
+
+            qu.shutdown(2);
+            ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
+            ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true, clientConfig);
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+
+            // if we don't suspend a peer it will rejoin a quorum
+            qu.getPeer(1).peer
+                    .setSuspended(true);
+
+            // start two servers to form a quorum; client should detect this and
+            // connect to one of them
+            watcher.reset();
+            qu.start(2);
+            qu.start(3);
+            ClientBase.waitForServerUp(qu.getConnString(), 2000);
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            zk.create("/test", "test".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // resume poor fellow
+            qu.getPeer(1).peer
+                    .setSuspended(false);
+
+            String log = os.toString();
+            assertFalse(StringUtils.isEmpty(log), "OutputStream doesn't have any log messages");
+
+            LineNumberReader r = new LineNumberReader(new StringReader(log));
+            String line;
+            Pattern p = Pattern.compile(".*Majority server found.*");
+            boolean found = false;
+            while ((line = r.readLine()) != null) {
+                if (p.matcher(line).matches()) {
+                    found = true;
+                    break;
+                }
+            }
+            assertTrue(found, "Majority server wasn't found while connected to r/o server");
+        }
+    }
+}

From 5664ce11c98cfdd9348b2e32f74307582b7a1dda Mon Sep 17 00:00:00 2001
From: luozongle01 <luozongle@hotmail.com>
Date: Wed, 27 Nov 2024 10:06:51 +0800
Subject: [PATCH 490/591] ZOOKEEPER-4879: Fix log of exception (#2205)

---
 .../java/org/apache/zookeeper/server/ZooKeeperServer.java     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 8e291f86939..94ccc33b29b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1806,7 +1806,7 @@ private void processSasl(RequestRecord request, ServerCnxn cnxn, RequestHeader r
                     }
                 }
             } catch (SaslException e) {
-                LOG.warn("Client {} failed to SASL authenticate: {}", cnxn.getRemoteSocketAddress(), e);
+                LOG.warn("Client {} failed to SASL authenticate", cnxn.getRemoteSocketAddress(), e);
                 if (shouldAllowSaslFailedClientsConnect() && !authHelper.isSaslAuthRequired()) {
                     LOG.warn("Maintaining client connection despite SASL authentication failure.");
                 } else {
@@ -2370,7 +2370,7 @@ public boolean authWriteRequest(Request request) {
                 try {
                     request.cnxn.sendResponse(rh, null, null);
                 } catch (IOException e) {
-                    LOG.error("IOException : {}", e);
+                    LOG.warn("IOException", e);
                 }
             }
         }

From d1d57c4af37cebb9a2dd10d372e30c90f85bf000 Mon Sep 17 00:00:00 2001
From: luozongle01 <luozongle@hotmail.com>
Date: Sat, 7 Dec 2024 13:54:43 +0800
Subject: [PATCH 491/591] ZOOKEEPER-4880: Generate comments from zookeeper.jute
 into code

Reviewers: kezhuw, tisonkun
Author: luozongle01
Closes #2206 from luozongle01/ZOOKEEPER-4880
---
 .../java/org/apache/jute/compiler/JField.java |  42 +++
 .../org/apache/jute/compiler/JRecord.java     | 146 +++++++-
 .../org/apache/jute/compiler/generated/rcc.jj |  45 +--
 .../org/apache/jute/compiler/JRecordTest.java | 344 ++++++++++++++++++
 4 files changed, 547 insertions(+), 30 deletions(-)
 create mode 100644 zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java
index 395c0b6a966..0d8f35bd0e5 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java
@@ -18,6 +18,9 @@
 
 package org.apache.jute.compiler;
 
+import org.apache.jute.compiler.generated.RccConstants;
+import org.apache.jute.compiler.generated.Token;
+
 /**
  *
  */
@@ -25,6 +28,21 @@ public class JField {
     private JType mType;
     private String mName;
 
+    /**
+     * {@link #mType} of token.
+     */
+    private Token mTypeToken;
+
+    private Token previousToken;
+
+    /**
+     * Since we can only get the comments before the token through the {@link Token#specialToken},
+     * we need to save the next token to get the end-of-line comment.
+     *
+     * <p>It may be the type of the next field, or it may be {@link RccConstants#RBRACE_TKN} of the class.
+     */
+    private Token nextToken;
+
     /**
      * Creates a new instance of JField.
      */
@@ -33,6 +51,30 @@ public JField(JType type, String name) {
         mName = name;
     }
 
+    public Token getTypeToken() {
+        return mTypeToken;
+    }
+
+    public void setTypeToken(Token typeToken) {
+        this.mTypeToken = typeToken;
+    }
+
+    public Token getNextToken() {
+        return nextToken;
+    }
+
+    public void setNextToken(Token nextToken) {
+        this.nextToken = nextToken;
+    }
+
+    public Token getPreviousToken() {
+        return previousToken;
+    }
+
+    public void setPreviousToken(Token previousToken) {
+        this.previousToken = previousToken;
+    }
+
     public String getSignature() {
         return mType.getSignature();
     }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index 618b4c50bb0..76ebc1731e4 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -22,10 +22,13 @@
 import java.io.FileWriter;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
+import org.apache.jute.compiler.generated.RccConstants;
+import org.apache.jute.compiler.generated.Token;
 
 /**
  *
@@ -36,11 +39,12 @@ public class JRecord extends JCompType {
     private String mName;
     private String mModule;
     private List<JField> mFields;
+    private Token mRecordToken;
 
     /**
      * Creates a new instance of JRecord.
      */
-    public JRecord(String name, ArrayList<JField> flist) {
+    public JRecord(String name, ArrayList<JField> flist, Token recordToken) {
         super("struct " + name.substring(name.lastIndexOf('.') + 1),
                 name.replaceAll("\\.", "::"), getCsharpFQName(name), name, "Record", name, getCsharpFQName("IRecord"));
         mFQName = name;
@@ -48,12 +52,17 @@ public JRecord(String name, ArrayList<JField> flist) {
         mName = name.substring(idx + 1);
         mModule = name.substring(0, idx);
         mFields = flist;
+        mRecordToken = recordToken;
     }
 
     public String getName() {
         return mName;
     }
 
+    public Token getRecordToken() {
+        return mRecordToken;
+    }
+
     public String getCsharpName() {
         return "Id".equals(mName) ? "ZKId" : mName;
     }
@@ -208,8 +217,17 @@ public void genCCode(FileWriter h, FileWriter c) throws IOException {
             }
         }
         String recName = getName();
+
+        String recordComments = getRecordComments();
+        if (recordComments != null && !recordComments.isEmpty()) {
+            h.write(recordComments);
+        }
         h.write("struct " + recName + " {\n");
         for (JField f : mFields) {
+            String fieldComments = getCFieldComments(f);
+            if (fieldComments != null && !fieldComments.isEmpty()) {
+                h.write(fieldComments);
+            }
             h.write(f.genCDecl());
         }
         h.write("};\n");
@@ -436,10 +454,18 @@ public void genJavaCode(File outputDirectory) throws IOException {
             jj.write("import org.apache.jute.*;\n");
             jj.write("import org.apache.jute.Record; // JDK14 needs explicit import due to clash with java.lang.Record\n");
             jj.write("import org.apache.yetus.audience.InterfaceAudience;\n");
+            String recordComments = getRecordComments();
+            if (recordComments != null && !recordComments.isEmpty()) {
+                jj.write(recordComments);
+            }
             jj.write("@InterfaceAudience.Public\n");
             jj.write("public class " + getName() + " implements Record {\n");
             for (Iterator<JField> i = mFields.iterator(); i.hasNext(); ) {
                 JField jf = i.next();
+                String fieldComments = getJavaFieldComments(jf);
+                if (fieldComments != null && !fieldComments.isEmpty()) {
+                    jj.write(fieldComments);
+                }
                 jj.write(jf.genJavaDecl());
             }
             jj.write("  public " + getName() + "() {\n");
@@ -767,4 +793,122 @@ public static String getCsharpFQName(String name) {
         }
         return fQName.toString();
     }
+
+    public String getJavaFieldComments(JField jField) {
+        return getFieldComments(jField, "  ");
+    }
+
+    public String getCFieldComments(JField jField) {
+        return getFieldComments(jField, "    ");
+    }
+
+    private String getFieldComments(JField jField, String indent) {
+        if (jField == null || jField.getTypeToken() == null || jField.getNextToken() == null) {
+            return "";
+        }
+
+        // get the comment before the line
+        Token beforeTheLineCommentToken = getCommentToken(jField.getTypeToken(), jField.getPreviousToken());
+        List<String> comments = extractComments(beforeTheLineCommentToken, Integer.MAX_VALUE);
+
+        Token endOfLineCommentToken = getCommentToken(jField.getNextToken(), null);
+        if (endOfLineCommentToken != null && jField.getTypeToken().beginLine == endOfLineCommentToken.beginLine) {
+
+            comments.addAll(extractComments(endOfLineCommentToken, endOfLineCommentToken.beginLine));
+        }
+
+        return formatComments(indent, comments);
+    }
+
+    private Token getCommentToken(Token token, Token previousToken) {
+        if (token == null || token.specialToken == null) {
+            return null;
+        }
+
+        Token commentToken = token.specialToken;
+        while (commentToken.specialToken != null) {
+            commentToken = commentToken.specialToken;
+        }
+        // Skip end of line comment belong to previous token.
+        while (previousToken != null && commentToken != null && commentToken.beginLine == previousToken.endLine) {
+            commentToken = commentToken.next;
+        }
+        return commentToken;
+    }
+
+    public String getRecordComments() {
+        if (getRecordToken() == null || getRecordToken().specialToken == null) {
+            return "";
+        }
+
+        // get the comments before the class
+        Token commentToken = getCommentToken(getRecordToken(), null);
+        return formatComments("", extractComments(commentToken, Integer.MAX_VALUE));
+    }
+
+    private static String formatComments(String indent, List<String> commentLines) {
+        if (commentLines == null || commentLines.isEmpty()) {
+            return "";
+        }
+
+        StringBuilder builder = new StringBuilder();
+        for (String line : commentLines) {
+            if (!line.isEmpty()) {
+                builder.append(indent).append(line);
+            }
+            builder.append(System.lineSeparator());
+        }
+
+        return builder.toString();
+    }
+
+    /**
+     * Extracts comments with indentation and line separator trimmed.
+     *
+     * <p>Empty line is represented as empty string.
+     */
+    private static List<String> extractComments(Token token, int endLine) {
+        List<String> comments = new ArrayList<>();
+
+        if (token == null) {
+            return comments;
+        }
+
+        int nextLine = token.beginLine;
+        while (token != null && token.beginLine <= endLine) {
+            while (nextLine < token.beginLine) {
+                comments.add("");
+                nextLine++;
+            }
+            nextLine = token.endLine + 1;
+            switch (token.kind) {
+                case RccConstants.ONE_LINE_COMMENT:
+                    comments.add(token.image);
+                    break;
+                case RccConstants.MULTI_LINE_COMMENT: {
+                    List<String> lines = Arrays.asList(token.image.split("\r|\n|\r\n"));
+                    // First line captures no indentation.
+                    comments.add(lines.get(0));
+                    int indentSpaces = token.beginColumn - 1;
+                    for (int i = 1; i < lines.size(); i++) {
+                        String line = lines.get(i);
+                        int j = 0;
+                        while (j < indentSpaces && j < line.length()) {
+                            if (line.charAt(j) != ' ') {
+                                break;
+                            }
+                            j++;
+                        }
+                        comments.add(line.substring(j));
+                    }
+                }
+                break;
+                default:
+                    throw new IllegalStateException("expect comment token, but get token kind " + token.kind);
+            }
+            token = token.next;
+        }
+
+        return comments;
+    }
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj b/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj
index 94d4f42f6b3..f97ebc3c6c4 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj
@@ -111,32 +111,8 @@ SKIP :
 
 SPECIAL_TOKEN :
 {
-  "//" : WithinOneLineComment
-}
-
-<WithinOneLineComment> SPECIAL_TOKEN :
-{
-  <("\n" | "\r" | "\r\n" )> : DEFAULT
-}
-
-<WithinOneLineComment> MORE :
-{
-  <~[]>
-}
-
-SPECIAL_TOKEN :
-{
-  "/*" : WithinMultiLineComment
-}
-
-<WithinMultiLineComment> SPECIAL_TOKEN :
-{
-  "*/" : DEFAULT
-}
-
-<WithinMultiLineComment> MORE :
-{
-  <~[]>
+    <ONE_LINE_COMMENT: "//" (~["\n","\r"])*>
+|   <MULTI_LINE_COMMENT: "/*" (~["*"])* "*" (~["*","/"] (~["*"])* "*" | "*")* "/">
 }
 
 TOKEN :
@@ -274,21 +250,32 @@ JRecord Record() :
     ArrayList<JField> flist = new ArrayList<JField>();
     Token t;
     JField f;
+    // Get the comments on the class token
+    Token recordTkn;
+    Token typeTkn;
+    Token previousToken = null;
 }
 {
-    <RECORD_TKN>
+    recordTkn = <RECORD_TKN>
     t = <IDENT_TKN>
     { rname = t.image; }
-    <LBRACE_TKN>
+    previousToken = <LBRACE_TKN>
     (
+        {typeTkn = getToken(1);}
         f = Field()
         { flist.add(f); }
         <SEMICOLON_TKN>
+        {
+            f.setTypeToken(typeTkn);
+            f.setPreviousToken(previousToken);
+            f.setNextToken(getToken(1));
+            previousToken = typeTkn;
+        }
     )+
     <RBRACE_TKN>
     {
         String fqn = curModuleName + "." + rname;
-        JRecord r = new JRecord(fqn, flist);
+        JRecord r = new JRecord(fqn, flist, recordTkn);
         recTab.put(fqn, r);
         return r;
     }
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java b/zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java
new file mode 100644
index 00000000000..91eece84e17
--- /dev/null
+++ b/zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java
@@ -0,0 +1,344 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jute.compiler;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.StringReader;
+import java.lang.reflect.Field;
+import java.util.List;
+import org.apache.jute.compiler.generated.ParseException;
+import org.apache.jute.compiler.generated.Rcc;
+import org.junit.jupiter.api.Test;
+
+@SuppressWarnings({"unchecked", "SameParameterValue"})
+public class JRecordTest {
+
+    @Test
+    public void testEndOfLineComments() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    // information explicitly stored by the server persistently\n"
+                + "    class StatPersisted {\n"
+                + "        long czxid;      // created zxid\n"
+                + "        long mzxid;      // last modified zxid\n"
+                + "        long ctime;      /* created */\n"
+                + "        long mtime;      /** last modified */\n"
+                + "        int version;     /* version */ /* testComment1 */\n"
+                + "        int cversion;    /* child version */ /* child versionComment2 */ /* child versionComment3 */\n"
+                + "        int aversion;    /** acl version */ /** acl versionComment2 */ /** acl version */\n"
+                + "        long ephemeralOwner;  /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "        long pzxid;     /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "    }\n"
+                + "}";
+
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals("// information explicitly stored by the server persistently\n", jRecord.getRecordComments());
+            assertEquals("  // created zxid\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  // last modified zxid\n", jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /* created */\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /** last modified */\n", jRecord.getJavaFieldComments(fields.get(3)));
+            assertEquals("  /* version */\n  /* testComment1 */\n", jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  /* child version */\n  /* child versionComment2 */\n  /* child versionComment3 */\n", jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  /** acl version */\n  /** acl versionComment2 */\n  /** acl version */\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals(
+                    "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals(
+                    "  /* Comment belong to new field */\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    @Test
+    public void testCommentBeforeLineAndEndOfLine() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    /**\n"
+                + "      * information explicitly stored by the server persistently\n"
+                + "      */ \n"
+                + "    class StatPersisted {\n"
+                + "        // created zxid\n"
+                + "        long czxid; // created zxid comment2\n"
+                + "        /* last modified zxid */\n"
+                + "        long mzxid; // last modified zxid comment2\n"
+                + "        /* created */\n"
+                + "        long ctime; // created comment2\n"
+                + "        /* last modified */\n"
+                + "        /* last modified */\n"
+                + "        long mtime; // last modified comment2\n"
+                + "        // version comment\n "
+                + "        int version;     /* version comment1 */ /* version\n comment2 */\n"
+                + "        /** child version */\n"
+                + "        /** child version */\n"
+                + "        int cversion;  /** child version */  // child version\n"
+                + "        // acl version\n"
+                + "        // acl version\n"
+                + "        // acl version\n"
+                + "        int aversion;    // acl version\n"
+                + "        // ephemeralOwner comment\n"
+                + "        long ephemeralOwner;  /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "        // pzxid comment\n"
+                + "        long pzxid;     /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "    }\n"
+                + "}";
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals("/**\n  * information explicitly stored by the server persistently\n  */\n", jRecord.getRecordComments());
+            assertEquals("  // created zxid\n  // created zxid comment2\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  /* last modified zxid */\n  // last modified zxid comment2\n", jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /* created */\n  // created comment2\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /* last modified */\n  /* last modified */\n  // last modified comment2\n", jRecord.getJavaFieldComments(fields.get(3)));
+
+            assertEquals("  // version comment\n  /* version comment1 */\n  /* version\n  comment2 */\n", jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  /** child version */\n  /** child version */\n  /** child version */\n  // child version\n", jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  // acl version\n  // acl version\n  // acl version\n  // acl version\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals(
+                    "  // ephemeralOwner comment\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals(
+                    "  /* Comment belong to new field */\n"
+                            + "  // pzxid comment\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    @Test
+    public void testCommentBeforeLine() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    // information explicitly stored by the server persistently\n"
+                + "    // StatPersisted Comment1\n"
+                + "    // StatPersisted Comment2\n"
+                + "    class StatPersisted {\n"
+                + "        // created zxid comment1\n"
+                + "        // created zxid comment2\n"
+                + "        // created zxid comment3\n"
+                + "        long czxid;\n"
+                + "        // last modified zxid\n"
+                + "     // last modified zxid\n"
+                + "             // last modified zxid\n"
+                + "        long mzxid;\n"
+                + "        /* created */\n"
+                + "           /* created */\n"
+                + "      /* created */\n"
+                + "        long ctime;\n"
+                + "        /** last modified */\n"
+                + "        /** last modified */\n"
+                + "        long mtime;\n"
+                + "        /** version */\n"
+                + "             /** version */\n"
+                + "        int version;\n"
+                + "        // child version\n"
+                + "        /** child version */\n"
+                + "        /** child version */\n"
+                + "        int cversion;\n"
+                + "        /* acl version */\n"
+                + "        // acl version\n"
+                + "        /* acl version */\n"
+                + "        int aversion;\n"
+                + "        // owner id if ephemeral, 0 otw\n"
+                + "        long ephemeralOwner;\n"
+                + "        // last modified children\n"
+                + "        long pzxid;\n"
+                + "    }\n"
+                + "}";
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals("// information explicitly stored by the server persistently\n// StatPersisted Comment1\n// StatPersisted Comment2\n", jRecord.getRecordComments());
+            assertEquals("  // created zxid comment1\n  // created zxid comment2\n  // created zxid comment3\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  // last modified zxid\n  // last modified zxid\n  // last modified zxid\n", jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /* created */\n  /* created */\n  /* created */\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /** last modified */\n  /** last modified */\n", jRecord.getJavaFieldComments(fields.get(3)));
+            assertEquals("  /** version */\n  /** version */\n", jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  // child version\n  /** child version */\n  /** child version */\n", jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  /* acl version */\n  // acl version\n  /* acl version */\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals("  // owner id if ephemeral, 0 otw\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals("  // last modified children\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    @Test
+    public void testMultiLineComments() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    /**\n"
+                + "      * information explicitly stored by the server persistently\n"
+                + "      */\n"
+                + "     // StatPersisted Comment\n"
+                + "     /* StatPersisted Comment */\n"
+                + "    class StatPersisted {\n"
+                + "        /**\n"
+                + "         * created zxid\n"
+                + "         */\n"
+                + "        long czxid;\n"
+                + "        /**\n"
+                + "         * last modified zxid comment1\n"
+                + "         */\n"
+                + "        /**\n"
+                + "         * last modified zxid comment2\n"
+                + "         */\n"
+                + "        long mzxid;\n"
+                + "        /*\n"
+                + "         * created\n"
+                + "         */\n"
+                + "        long ctime; /* multi-line\n"
+                + "end of line */\n"
+                + "        /*\n"
+                + "         last modified\n"
+                + "         */"
+                + "        long mtime; /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "        /* version comment */\n"
+                + "        int version;     // version\n"
+                + "        /**\n"
+                + "         * child version\n"
+                + "         */\n"
+                + "        /**\n"
+                + "         * child version comment2\n"
+                + "         */\n"
+                + "        int cversion;    // child version\n"
+                + "        /* acl version */\n"
+                + "        int aversion;  /* acl version */ /* acl version */  // acl version\n"
+                + "        /*\n"
+                + "        ephemeralOwner comment\n"
+                + "        */\n"
+                + "        // ephemeralOwner comment\n"
+                + "        /*\n"
+                + "        ephemeralOwner comment\n"
+                + "        */\n"
+                + "        long ephemeralOwner;  // owner id if ephemeral, 0 otw\n"
+                + "        /*\n"
+                + "        pzxid comment\n"
+                + "        */\n"
+                + "        long pzxid;      // last modified children\n"
+                + "    }\n"
+                + "}";
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals(
+                    "/**\n"
+                            + "  * information explicitly stored by the server persistently\n"
+                            + "  */\n"
+                            + "// StatPersisted Comment\n"
+                            + "/* StatPersisted Comment */\n", jRecord.getRecordComments());
+            assertEquals("  /**\n   * created zxid\n   */\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  /**\n   * last modified zxid comment1\n   */\n  /**\n   * last modified zxid comment2\n   */\n",
+                    jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /*\n   * created\n   */\n  /* multi-line\n  end of line */\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /*\n   last modified\n   */\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(3)));
+            assertEquals("  /* Comment belong to new field */\n  /* version comment */\n  // version\n",
+                    jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  /**\n   * child version\n   */\n  /**\n   * child version comment2\n   */\n  // child version\n",
+                    jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  /* acl version */\n  /* acl version */\n  /* acl version */\n  // acl version\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals("  /*\n"
+                    + "  ephemeralOwner comment\n"
+                    + "  */\n"
+                    + "  // ephemeralOwner comment\n"
+                    + "  /*\n"
+                    + "  ephemeralOwner comment\n"
+                    + "  */\n"
+                    + "  // owner id if ephemeral, 0 otw\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals("  /*\n  pzxid comment\n  */\n  // last modified children\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    private void assertFiled(List<JField> fields) {
+        assertEquals(9, fields.size());
+        assertEquals("long", fields.get(0).getType().getJavaType());
+        assertEquals("czxid", fields.get(0).getName());
+        assertEquals("long", fields.get(1).getType().getJavaType());
+        assertEquals("mzxid", fields.get(1).getName());
+        assertEquals("long", fields.get(2).getType().getJavaType());
+        assertEquals("ctime", fields.get(2).getName());
+        assertEquals("long", fields.get(3).getType().getJavaType());
+        assertEquals("mtime", fields.get(3).getName());
+        assertEquals("int", fields.get(4).getType().getJavaType());
+        assertEquals("version", fields.get(4).getName());
+        assertEquals("int", fields.get(5).getType().getJavaType());
+        assertEquals("cversion", fields.get(5).getName());
+        assertEquals("int", fields.get(6).getType().getJavaType());
+        assertEquals("aversion", fields.get(6).getName());
+        assertEquals("long", fields.get(7).getType().getJavaType());
+        assertEquals("ephemeralOwner", fields.get(7).getName());
+        assertEquals("long", fields.get(8).getType().getJavaType());
+        assertEquals("pzxid", fields.get(8).getName());
+    }
+
+    private <T> T getField(final Object target,
+                           final String fieldName,
+                           final Class<T> fieldClassType) throws NoSuchFieldException, IllegalAccessException {
+        Class<?> targetClazz = target.getClass();
+        Field field = targetClazz.getDeclaredField(fieldName);
+        field.setAccessible(true);
+        return fieldClassType.cast(field.get(target));
+    }
+}

From f7af2acd7f92868507e66780bf6818f47d068a77 Mon Sep 17 00:00:00 2001
From: Gowrima <kj.gowrima@gmail.com>
Date: Fri, 6 Dec 2024 21:58:18 -0800
Subject: [PATCH 492/591] ZOOKEEPER-4020: Fix memory leak from ssl cert in c
 client

Reviewers: kezhuw
Author: Gowrima
Closes #2209 from Gowrima/ZOOKEEPER-4020
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 84a2245b2d6..972215bf009 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -1454,7 +1454,7 @@ zhandle_t *zookeeper_init_ssl(const char *host, const char *cert, watcher_fn wat
 {
     zcert_t zcert;
     zcert.certstr = strdup(cert);
-    zcert.ca = strtok(strdup(cert), ",");
+    zcert.ca = strtok(zcert.certstr, ",");
     zcert.cert = strtok(NULL, ",");
     zcert.key = strtok(NULL, ",");
     zcert.passwd = strtok(NULL, ",");       

From c0e92411fbb38025d4cd257835cf5e4afeea4956 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Fri, 20 Dec 2024 20:14:33 -0800
Subject: [PATCH 493/591] ZOOKEEPER-4858: Remove the lock contention between
 snapshotting and the sync operation

Reviewers: anmolnar, kezhuw
Author: li4wang
Closes #2185 from li4wang/ZOOKEEPER-4858
---
 .../zookeeper/server/ZooKeeperServer.java       | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 94ccc33b29b..1667efd3fbe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -135,6 +135,8 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
     public static final String CLOSE_SESSION_TXN_ENABLED = "zookeeper.closeSessionTxn.enabled";
     private static boolean closeSessionTxnEnabled = true;
     private volatile CountDownLatch restoreLatch;
+    // exclusive lock for taking snapshot and restore
+    private final Object snapshotAndRestoreLock = new Object();
 
     static {
         LOG = LoggerFactory.getLogger(ZooKeeperServer.class);
@@ -565,11 +567,13 @@ public File takeSnapshot(boolean syncSnap) throws IOException {
      * @return file snapshot file object
      * @throws IOException
      */
-    public synchronized File takeSnapshot(boolean syncSnap, boolean isSevere) throws IOException {
+    public File takeSnapshot(boolean syncSnap, boolean isSevere) throws IOException {
         long start = Time.currentElapsedTime();
         File snapFile = null;
         try {
-            snapFile = txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
+            synchronized (snapshotAndRestoreLock) {
+                snapFile = txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
+            }
         } catch (IOException e) {
             if (isSevere) {
                 LOG.error("Severe unrecoverable error, exiting", e);
@@ -593,7 +597,7 @@ public synchronized File takeSnapshot(boolean syncSnap, boolean isSevere) throws
      * @Return last processed zxid
      * @throws IOException
      */
-    public synchronized long restoreFromSnapshot(final InputStream inputStream) throws IOException {
+    public long restoreFromSnapshot(final InputStream inputStream) throws IOException {
         if (inputStream == null) {
             throw new IllegalArgumentException("InputStream can not be null when restoring from snapshot");
         }
@@ -618,9 +622,10 @@ public synchronized long restoreFromSnapshot(final InputStream inputStream) thro
         restoreLatch = new CountDownLatch(1);
 
         try {
-            // set to the new zkDatabase
-            setZKDatabase(newZKDatabase);
-
+            synchronized (snapshotAndRestoreLock) {
+                // set to the new zkDatabase
+                setZKDatabase(newZKDatabase);
+            }
             // re-create SessionTrack
             createSessionTracker();
         } finally {

From a8eb7faa34e90c748f5f49f211a6dbad78c16f0b Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sat, 4 Jan 2025 06:16:55 +0800
Subject: [PATCH 494/591] ZOOKEEPER-3624: Fix flaky
 `QuorumPeerMainTest::testFailedTxnAsPartOfQuorumLoss`

Reviewers: anmolnar
Author: kezhuw
Closes #2204 from kezhuw/ZOOKEEPER-3624-fix-flaky-testFailedTxnAsPartOfQuorumLoss
---
 .../zookeeper/server/quorum/QuorumPeer.java   |   1 +
 .../server/quorum/QuorumPeerMainTest.java     | 102 +++++++++++-------
 2 files changed, 65 insertions(+), 38 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 876a297f9aa..786450d35a5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1578,6 +1578,7 @@ public void run() {
                     } else {
                         try {
                             reconfigFlagClear();
+                            checkSuspended();
                             if (shuttingDownLE) {
                                 shuttingDownLE = false;
                                 startLeaderElection();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index 6c0f4f926dd..eb4966e7512 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -706,6 +706,9 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         assertEquals(maxSessionTimeOut, quorumPeer.getMaxSessionTimeout(), "maximumSessionTimeOut is wrong");
     }
 
+    /**
+     * Verify that failed txn in isolated leader got truncated after rejoining quorum.
+     */
     @Test
     public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
         final int LEADER_TIMEOUT_MS = 10_000;
@@ -729,6 +732,8 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
         // increase the tick time to delay the leader going to looking
         int previousTick = servers.mt[leader].main.quorumPeer.tickTime;
         servers.mt[leader].main.quorumPeer.tickTime = LEADER_TIMEOUT_MS;
+        // isolate it from other quorum members by prevent it from rejoining
+        servers.mt[leader].getQuorumPeer().setSuspended(true);
         // let the previous tick on the leader exhaust itself so the new tick time takes effect
         Thread.sleep(previousTick);
         LOG.warn("LEADER {}", leader);
@@ -739,34 +744,18 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
             }
         }
 
-        // 3. start up the followers to form a new quorum
-        for (int i = 0; i < SERVER_COUNT; i++) {
-            if (i != leader) {
-                servers.mt[i].start();
-            }
-        }
-
-        // 4. wait one of the follower to be the new leader
-        for (int i = 0; i < SERVER_COUNT; i++) {
-            if (i != leader) {
-                // Recreate a client session since the previous session was not persisted.
-                servers.restartClient(i, this);
-                waitForOne(servers.zk[i], States.CONNECTED);
-            }
-        }
-
-        // 5. send a create request to old leader and make sure it's synced to disk,
+        // 3. send a create request to old leader and make sure it's synced to disk,
         //    which means it acked from itself
         try {
             servers.zk[leader].create("/zk" + leader, "zk".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             fail("create /zk" + leader + " should have failed");
-        } catch (KeeperException e) {
+        } catch (KeeperException ignored) {
         }
 
-        // just make sure that we actually did get it in process at the
-        // leader
+        // just make sure that we actually did get it in process at the leader
+        //
         // there can be extra sessionClose proposals
-        assertTrue(outstanding.size() > 0);
+        assertFalse(outstanding.isEmpty());
         Proposal p = findProposalOfType(outstanding, OpCode.create);
         LOG.info("Old leader id: {}. All proposals: {}", leader, outstanding);
         assertNotNull(p, "Old leader doesn't have 'create' proposal");
@@ -782,36 +771,73 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
             sleepTime += 100;
         }
 
-        // 6. wait for the leader to quit due to not enough followers and come back up as a part of the new quorum
-        LOG.info("Waiting for leader {} to timeout followers", leader);
+        // 4. start up the followers to form a new quorum
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != leader) {
+                servers.mt[i].start();
+            }
+        }
+
+        // 5. wait one of the follower to be the new leader
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != leader) {
+                // Recreate a new client session to avoid ConnectionLoss as connecting server is restarted.
+                servers.restartClient(i, this);
+                waitForOne(servers.zk[i], States.CONNECTED);
+            }
+        }
+
+        // 6. make sure new quorum does not replicate the failed txn
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i == leader) {
+                continue;
+            }
+            assertNull(servers.zk[i].exists("/zk" + leader, false),
+                    "server " + i + " should not have /zk" + leader);
+        }
+
+        // resume election to rejoin the cluster
+        servers.mt[leader].getQuorumPeer().setSuspended(false);
+
+        // 7. wait for the leader to quit due to not enough followers and come back up as a part of the new quorum
+        LOG.info("Waiting for leader {} to timeout and rejoin as follower", leader);
         sleepTime = 0;
-        Follower f = servers.mt[leader].main.quorumPeer.follower;
-        while (f == null || !f.isRunning()) {
-            if (sleepTime > LEADER_TIMEOUT_MS * 2) {
-                fail("Took too long for old leader to time out "
+        while (servers.mt[leader].getQuorumPeer().getPeerState() != QuorumPeer.ServerState.FOLLOWING) {
+            if (sleepTime > LEADER_TIMEOUT_MS * 10 * 2) {
+                fail("Took too long for old leader to time out and rejoin "
                                     + servers.mt[leader].main.quorumPeer.getPeerState());
             }
             Thread.sleep(100);
             sleepTime += 100;
-            f = servers.mt[leader].main.quorumPeer.follower;
         }
 
         int newLeader = servers.findLeader();
         // make sure a different leader was elected
         assertNotEquals(leader, newLeader);
 
-        // 7. restart the previous leader to force it to replay the edits and possibly come up in a bad state
-        servers.mt[leader].shutdown();
-        servers.mt[leader].start();
-        // old client session can expire, restart it
+        // Now, all preconditions meet. Let's verify that the failed txn got truncated in whole cluster.
+
+        boolean restarted = false;
         servers.restartClient(leader, this);
-        waitForAll(servers, States.CONNECTED);
+        waitForOne(servers.zk[leader], States.CONNECTED);
+        while (true) {
+            // 7. make sure everything is consistent, that is the failed txn got truncated in old leader.
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                assertNull(servers.zk[i].exists("/zk" + leader, false),
+                        "server " + i + " should not have /zk" + leader);
+            }
 
-        // 8. check the node exist in previous leader but not others
-        //    make sure everything is consistent
-        for (int i = 0; i < SERVER_COUNT; i++) {
-            assertNull(servers.zk[i].exists("/zk" + leader, false),
-                    "server " + i + " should not have /zk" + leader);
+            if (restarted) {
+                break;
+            }
+
+            // 8. make sure above holds after restart
+            servers.mt[leader].shutdown();
+            servers.mt[leader].start();
+            // old client session can expire, restart it
+            servers.restartClient(leader, this);
+            waitForAll(servers, States.CONNECTED);
+            restarted = true;
         }
     }
 

From 8532163df198466913f26141c0278dc11dbf53ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 11 Feb 2025 10:43:20 -0600
Subject: [PATCH 495/591] ZOOKEEPER-4846: Failure to reload database due to
 missing ACL

ZOOKEEPER-4846. Fix ACL reference on existing znode when trying to create
Reviewers: cnauroth, eolivelli, ztzg
Author: anmolnar
Closes #2222 from anmolnar/ZOOKEEPER-4846
---
 .../org/apache/zookeeper/server/DataTree.java    |  5 +++--
 .../apache/zookeeper/server/DataTreeTest.java    | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 012a10e5469..45bbde4f048 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -462,8 +462,9 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
             // we did for the global sessions.
             Long acls = aclCache.convertAcls(acl);
 
-            Set<String> children = parent.getChildren();
-            if (children.contains(childName)) {
+            DataNode existingChild = nodes.get(path);
+            if (existingChild != null) {
+                existingChild.acl = acls;
                 throw new NodeExistsException();
             }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
index 13276d855c5..89a2f17b75f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
@@ -23,6 +23,7 @@
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -631,6 +632,21 @@ public void testDigest() throws Exception {
         }
     }
 
+    @Test
+    public void testCreateNodeFixMissingACL() throws Exception {
+        DataTree dt = new DataTree();
+        ReferenceCountedACLCache aclCache = dt.getReferenceCountedAclCache();
+
+        dt.createNode("/the_parent", new byte[0], ZooDefs.Ids.CREATOR_ALL_ACL, -1, 1, 1, 0);
+        Long aclId = dt.getNode("/the_parent").acl;
+        aclCache.removeUsage(aclId);
+        aclCache.purgeUnused();
+        // try to re-create the parent -> throws NodeExistsException, but fixes the deleted ACL
+        assertThrows(NodeExistsException.class, () ->
+            dt.createNode("/the_parent", new byte[0], ZooDefs.Ids.CREATOR_ALL_ACL, -1, 1, 1, 0));
+        dt.createNode("/the_parent/the_child", new byte[0], ZooDefs.Ids.CREATOR_ALL_ACL, -1, 2, 2, 2);
+    }
+
     private DataTree buildDataTreeForTest() {
         final DataTree dt = new DataTree();
         assertEquals(dt.lastProcessedZxid, 0);

From a39c8d8ab68aa4a1469855795d9a241a74f963f1 Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Fri, 14 Feb 2025 17:53:12 +0000
Subject: [PATCH 496/591] ZOOKEEPER-4891: Update logback to 1.3.15 to fix
 CVE-2024-12798.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #2221

Signed-off-by: Andor MolnĂ¡r <andor@apache.org>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 38dd41ba483..c00c88b8250 100644
--- a/pom.xml
+++ b/pom.xml
@@ -551,7 +551,7 @@
 
     <!-- dependency versions -->
     <slf4j.version>2.0.13</slf4j.version>
-    <logback-version>1.3.14</logback-version>
+    <logback-version>1.3.15</logback-version>
     <audience-annotations.version>0.12.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
     <junit.version>5.6.2</junit.version>

From 1a9bcbd1facfa435a1b1718d44d264420ff1a021 Mon Sep 17 00:00:00 2001
From: ZLATAN628 <107628611+ZLATAN628@users.noreply.github.com>
Date: Sat, 1 Mar 2025 00:01:31 +0800
Subject: [PATCH 497/591] ZOOKEEPER-4898: FastLeaderElection
 WorkerSender/WorkerReceiver don't need to be Thread (#2228)

---
 .../server/quorum/FastLeaderElection.java     | 30 ++++++++-----------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 8d2b8263ca7..86bb4e732a9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -223,8 +223,8 @@ class WorkerReceiver extends ZooKeeperThread {
             volatile boolean stop;
             QuorumCnxManager manager;
 
-            WorkerReceiver(QuorumCnxManager manager) {
-                super("WorkerReceiver");
+            WorkerReceiver(QuorumCnxManager manager, String threadName) {
+                super(threadName);
                 this.stop = false;
                 this.manager = manager;
             }
@@ -470,7 +470,7 @@ public void run() {
                         LOG.warn("Interrupted Exception while waiting for new message", e);
                     }
                 }
-                LOG.info("WorkerReceiver is down");
+                LOG.info("{} is down", getName());
             }
 
         }
@@ -485,8 +485,8 @@ class WorkerSender extends ZooKeeperThread {
             volatile boolean stop;
             QuorumCnxManager manager;
 
-            WorkerSender(QuorumCnxManager manager) {
-                super("WorkerSender");
+            WorkerSender(QuorumCnxManager manager, String threadName) {
+                super(threadName);
                 this.stop = false;
                 this.manager = manager;
             }
@@ -504,7 +504,7 @@ public void run() {
                         break;
                     }
                 }
-                LOG.info("WorkerSender is down");
+                LOG.info("{} is down", getName());
             }
 
             /**
@@ -523,8 +523,6 @@ void process(ToSend m) {
 
         WorkerSender ws;
         WorkerReceiver wr;
-        Thread wsThread = null;
-        Thread wrThread = null;
 
         /**
          * Constructor of class Messenger.
@@ -533,23 +531,19 @@ void process(ToSend m) {
          */
         Messenger(QuorumCnxManager manager) {
 
-            this.ws = new WorkerSender(manager);
+            this.ws = new WorkerSender(manager, "WorkerSender[myid=" + self.getMyId() + "]");
+            this.ws.setDaemon(true);
 
-            this.wsThread = new Thread(this.ws, "WorkerSender[myid=" + self.getMyId() + "]");
-            this.wsThread.setDaemon(true);
-
-            this.wr = new WorkerReceiver(manager);
-
-            this.wrThread = new Thread(this.wr, "WorkerReceiver[myid=" + self.getMyId() + "]");
-            this.wrThread.setDaemon(true);
+            this.wr = new WorkerReceiver(manager, "WorkerReceiver[myid=" + self.getMyId() + "]");
+            this.wr.setDaemon(true);
         }
 
         /**
          * Starts instances of WorkerSender and WorkerReceiver
          */
         void start() {
-            this.wsThread.start();
-            this.wrThread.start();
+            this.ws.start();
+            this.wr.start();
         }
 
         /**

From be133f99d1f40d38c370cf5c4d0003c122039c04 Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Fri, 28 Feb 2025 17:24:46 -0800
Subject: [PATCH 498/591] ZOOKEEPER-4901: Correct logback license information
 on master branch. (#2229)

---
 ...ssic-1.2.13.LICENSE.txt => logback-classic-1.3.15.LICENSE.txt} | 0
 ...ck-core-1.2.13.LICENSE.txt => logback-core-1.3.15.LICENSE.txt} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{logback-classic-1.2.13.LICENSE.txt => logback-classic-1.3.15.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{logback-core-1.2.13.LICENSE.txt => logback-core-1.3.15.LICENSE.txt} (100%)

diff --git a/zookeeper-server/src/main/resources/lib/logback-classic-1.2.13.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-classic-1.3.15.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/logback-classic-1.2.13.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/logback-classic-1.3.15.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/logback-core-1.2.13.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-core-1.3.15.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/logback-core-1.2.13.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/logback-core-1.3.15.LICENSE.txt

From 160297d50dedbd49744df52247f4540e4af20a04 Mon Sep 17 00:00:00 2001
From: helloworld28 <ohyeah28@yeah.net>
Date: Sun, 2 Mar 2025 08:30:53 +0800
Subject: [PATCH 499/591] ZOOKEEPER-4897 Upgrade Netty to 4.1.119.Final for fix
 CVE-2025-24970 (#2227)

Co-authored-by: tison <wander4096@gmail.com>
---
 pom.xml                                                         | 2 +-
 ...Final.LICENSE.txt => netty-buffer-4.1.119.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-codec-4.1.119.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-common-4.1.119.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-handler-4.1.119.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-resolver-4.1.119.Final.LICENSE.txt} | 0
 ...al.LICENSE.txt => netty-transport-4.1.119.Final.LICENSE.txt} | 0
 ... => netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt} | 0
 ...etty-transport-native-unix-common-4.1.119.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.115.Final.LICENSE.txt => netty-buffer-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.115.Final.LICENSE.txt => netty-codec-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.115.Final.LICENSE.txt => netty-common-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.115.Final.LICENSE.txt => netty-handler-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.115.Final.LICENSE.txt => netty-resolver-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.115.Final.LICENSE.txt => netty-transport-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt => netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.115.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.119.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index c00c88b8250..128295182bf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.115.Final</netty.version>
+    <netty.version>4.1.119.Final</netty.version>
     <jetty.version>9.4.56.v20240826</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.115.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.119.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.115.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.119.Final.LICENSE.txt

From 2d2820e989d77300279de0f661ebf80702a7149d Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Wed, 12 Mar 2025 21:20:15 +0000
Subject: [PATCH 500/591] ZOOKEEPER-4902: Document that read-only mode also
 enables isro 4lw

Closes #2231

Signed-off-by: Zili Chen <tison@apache.org>
Signed-off-by: Kezhu Wang <kezhuw@apache.org>
---
 zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 5f42bea59b8..70ce27b7212 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1425,7 +1425,9 @@ of servers -- that is, when deploying clusters of servers.
     command must be put in this list else ZooKeeper server will
     not enable the command.
     By default the whitelist only contains "srvr" command
-    which zkServer.sh uses. The rest of four-letter word commands are disabled
+    which zkServer.sh uses. Additionally, if Read Only Mode is enabled by setting
+    Java system property **readonlymode.enabled**, then the "isro" command is
+    added to the whitelist. The rest of four-letter word commands are disabled
     by default: attempting to use them will gain a response
     ".... is not executed because it is not in the whitelist."
     Here's an example of the configuration that enables stat, ruok, conf, and isro

From 10328b3ab538d819b538b0bb09e299dd70b71b81 Mon Sep 17 00:00:00 2001
From: Damien Diederen <ddiederen@apache.org>
Date: Mon, 24 Mar 2025 17:28:21 +0100
Subject: [PATCH 501/591] ZOOKEEPER-4725: Record TTL node creations in audit
 log

Reviewers: kezhuw
Author: ztzg
Closes #2039 from ztzg/ZOOKEEPER-4725-audit-create-ttl
---
 .../apache/zookeeper/audit/AuditHelper.java   | 17 ++++++++---
 .../zookeeper/audit/Slf4JAuditLoggerTest.java | 28 +++++++++++++++++++
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
index d6df7d92438..d6f1178c609 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
@@ -28,6 +28,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.audit.AuditEvent.Result;
 import org.apache.zookeeper.proto.CreateRequest;
+import org.apache.zookeeper.proto.CreateTTLRequest;
 import org.apache.zookeeper.proto.DeleteRequest;
 import org.apache.zookeeper.proto.SetACLRequest;
 import org.apache.zookeeper.proto.SetDataRequest;
@@ -69,11 +70,19 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
                 case ZooDefs.OpCode.createContainer:
                     op = AuditConstants.OP_CREATE;
                     CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
-                    createMode = getCreateMode(createRequest);
+                    createMode = getCreateMode(createRequest.getFlags());
                     if (failedTxn) {
                         path = createRequest.getPath();
                     }
                     break;
+                case ZooDefs.OpCode.createTTL:
+                    op = AuditConstants.OP_CREATE;
+                    CreateTTLRequest createTtlRequest = request.readRequestRecord(CreateTTLRequest::new);
+                    createMode = getCreateMode(createTtlRequest.getFlags());
+                    if (failedTxn) {
+                        path = createTtlRequest.getPath();
+                    }
+                    break;
                 case ZooDefs.OpCode.delete:
                 case ZooDefs.OpCode.deleteContainer:
                     op = AuditConstants.OP_DELETE;
@@ -172,8 +181,8 @@ private static void log(String user, String operation, String znode, String acl,
         ZKAuditProvider.log(user, operation, znode, acl, createMode, session, ip, result);
     }
 
-    private static String getCreateMode(CreateRequest createRequest) throws KeeperException {
-        return CreateMode.fromFlag(createRequest.getFlags()).toString().toLowerCase();
+    private static String getCreateMode(int createFlags) throws KeeperException {
+        return CreateMode.fromFlag(createFlags).toString().toLowerCase();
     }
 
     private static Map<String, String> getCreateModes(Request request)
@@ -188,7 +197,7 @@ private static Map<String, String> getCreateModes(Request request)
                     || op.getType() == ZooDefs.OpCode.createContainer) {
                 CreateRequest requestRecord = (CreateRequest) op.toRequestRecord();
                 createModes.put(requestRecord.getPath(),
-                        getCreateMode(requestRecord));
+                        getCreateMode(requestRecord.getFlags()));
             }
         }
         return createModes;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
index 8a700bbdf4f..caad6ad3bcb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
@@ -63,6 +63,7 @@ public class Slf4JAuditLoggerTest extends QuorumPeerTestBase {
     @BeforeAll
     public static void setUpBeforeClass() throws Exception {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
+        System.setProperty("zookeeper.extendedTypesEnabled", "true");
         // setup the logger to capture all logs
         LoggerTestTool loggerTestTool = new LoggerTestTool(Slf4jAuditLogger.class);
         os = loggerTestTool.getOutputStream();
@@ -103,6 +104,32 @@ public void testCreateAuditLogs()
                         null, createMode), readAuditLog(os));
     }
 
+    @Test
+    public void testCreateWithTtlAuditLogs()
+            throws KeeperException, InterruptedException, IOException {
+        final CreateMode createMode = CreateMode.PERSISTENT_WITH_TTL;
+        final String path = "/createTtlPath";
+        zk.create(path, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                createMode, null, 3600);
+        // success log
+        verifyLog(
+                getAuditLog(AuditConstants.OP_CREATE, path, Result.SUCCESS,
+                        null, createMode.toString().toLowerCase()), readAuditLog(os));
+    }
+
+    @Test
+    public void testCreateSeqWithTtlAuditLogs()
+            throws KeeperException, InterruptedException, IOException {
+        final CreateMode createMode = CreateMode.PERSISTENT_SEQUENTIAL_WITH_TTL;
+        String path = "/createTtlPath";
+        path = zk.create(path, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                createMode, null, 3600);
+        // success log
+        verifyLog(
+                getAuditLog(AuditConstants.OP_CREATE, path, Result.SUCCESS,
+                        null, createMode.toString().toLowerCase()), readAuditLog(os));
+    }
+
     @Test
     public void testDeleteAuditLogs()
             throws InterruptedException, IOException, KeeperException {
@@ -406,6 +433,7 @@ private void waitForDeletion(ZooKeeper zooKeeper, String path)
 
     @AfterAll
     public static void tearDownAfterClass() {
+        System.clearProperty("zookeeper.extendedTypesEnabled");
         System.clearProperty(ZKAuditProvider.AUDIT_ENABLE);
         for (int i = 0; i < SERVER_COUNT; i++) {
             try {

From 9cc30438a4d4f8e55042b064edc95eeb1c8ac9a6 Mon Sep 17 00:00:00 2001
From: luozongle01 <luozongle@hotmail.com>
Date: Tue, 25 Mar 2025 00:38:10 +0000
Subject: [PATCH 502/591] ZOOKEEPER-4909: Fix exceeded request timeout in case
 of spurious wakeup

Closes #2237

Co-authored-by: Kezhu Wang <kezhuw@apache.org>
Signed-off-by: Kezhu Wang <kezhuw@apache.org>
Signed-off-by: Chris Nauroth <cnauroth@apache.org>
---
 .../java/org/apache/zookeeper/ClientCnxn.java |  18 +--
 .../zookeeper/ClientRequestTimeoutTest.java   | 131 ++++++++++++++++++
 2 files changed, 141 insertions(+), 8 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index c24308fb67e..215df45f2de 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1540,14 +1540,16 @@ public ReplyHeader submitRequest(
      * Wait for request completion with timeout.
      */
     private void waitForPacketFinish(ReplyHeader r, Packet packet) throws InterruptedException {
-        long waitStartTime = Time.currentElapsedTime();
-        while (!packet.finished) {
-            packet.wait(requestTimeout);
-            if (!packet.finished && ((Time.currentElapsedTime() - waitStartTime) >= requestTimeout)) {
-                LOG.error("Timeout error occurred for the packet '{}'.", packet);
-                r.setErr(Code.REQUESTTIMEOUT.intValue());
-                break;
-            }
+        long remainingTime = requestTimeout;
+        while (!packet.finished && remainingTime > 0) {
+            long waitStartTime = Time.currentElapsedTime();
+            packet.wait(remainingTime);
+            remainingTime -= (Time.currentElapsedTime() - waitStartTime);
+        }
+
+        if (!packet.finished) {
+            LOG.error("Timeout error occurred for the packet '{}'.", packet);
+            r.setErr(Code.REQUESTTIMEOUT.intValue());
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index 27bc02df785..93f801cabc2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -19,13 +19,21 @@
 package org.apache.zookeeper;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.lessThan;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.util.concurrent.TimeUnit;
+import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
@@ -37,6 +45,9 @@ public class ClientRequestTimeoutTest extends QuorumPeerTestBase {
     private static final int SERVER_COUNT = 3;
     private boolean dropPacket = false;
     private int dropPacketType = ZooDefs.OpCode.create;
+    private boolean capturePacket = false;
+    private int capturePacketType = ZooDefs.OpCode.create;
+    private ClientCnxn.Packet capturedPacket = null;
 
     @Test
     @Timeout(value = 120)
@@ -94,6 +105,105 @@ public void testClientRequestTimeout() throws Exception {
         }
     }
 
+    @Test
+    void testClientRequestTimeoutTime() throws Exception {
+        long requestTimeout = TimeUnit.SECONDS.toMillis(5);
+        System.setProperty("zookeeper.request.timeout", Long.toString(requestTimeout));
+
+        CustomZooKeeper zk = null;
+        int clientPort = PortAssignment.unique();
+        MainThread mainThread = new MainThread(0, clientPort, "", false);
+        mainThread.start();
+        try {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                    "waiting for server 0 being up");
+
+            CountdownWatcher watch = new CountdownWatcher();
+            zk = new CustomZooKeeper(getCxnString(new int[]{clientPort}), ClientBase.CONNECTION_TIMEOUT, watch);
+            watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+            dropPacket = true;
+            dropPacketType = ZooDefs.OpCode.create;
+
+            String data = "originalData";
+            long startTime = Time.currentElapsedTime();
+            try {
+                zk.create("/testClientRequestTimeout", data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
+                fail("KeeperException is expected.");
+            } catch (KeeperException exception) {
+                long cost = Time.currentElapsedTime() - startTime;
+                assertEquals(KeeperException.Code.REQUESTTIMEOUT, exception.code());
+                LOG.info("testClientRequestTimeoutTime cost:{}", cost);
+                assertThat(cost, greaterThanOrEqualTo(requestTimeout));
+                assertThat(cost, lessThan(requestTimeout + 500));
+            }
+        } finally {
+            mainThread.shutdown();
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+
+    @Test
+    void testClientRequestTimeoutTimeSimulatingSpuriousWakeup() throws Exception {
+        long requestTimeout = TimeUnit.SECONDS.toMillis(5);
+        System.setProperty("zookeeper.request.timeout", Long.toString(requestTimeout));
+
+        CustomZooKeeper zk = null;
+        int clientPort = PortAssignment.unique();
+        MainThread mainThread = new MainThread(0, clientPort, "", false);
+        mainThread.start();
+        try {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                    "waiting for server 0 being up");
+
+            CountdownWatcher watch = new CountdownWatcher();
+            zk = new CustomZooKeeper(getCxnString(new int[]{clientPort}), ClientBase.CONNECTION_TIMEOUT, watch);
+            watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+            dropPacket = true;
+            dropPacketType = ZooDefs.OpCode.create;
+            capturePacket = true;
+            capturePacketType = ZooDefs.OpCode.create;
+
+            // Simulating spurious wakeup
+            new Thread(() -> {
+                try {
+                    TimeUnit.MILLISECONDS.sleep(requestTimeout / 2);
+                    if (capturedPacket != null) {
+                        synchronized (capturedPacket) {
+                            capturedPacket.notifyAll();
+                        }
+                    }
+                } catch (InterruptedException e) {
+                    throw new RuntimeException(e);
+                }
+            }).start();
+
+            String data = "originalData";
+            long startTime = Time.currentElapsedTime();
+            try {
+                zk.create("/testClientRequestTimeout", data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
+                fail("KeeperException is expected.");
+            } catch (KeeperException exception) {
+                long cost = Time.currentElapsedTime() - startTime;
+                assertEquals(KeeperException.Code.REQUESTTIMEOUT, exception.code());
+                LOG.info("testClientRequestTimeoutTimeSimulatingSpuriousWakeup cost:{}", cost);
+                assertThat(cost, greaterThanOrEqualTo(requestTimeout));
+                assertThat(cost, lessThan(requestTimeout + 500));
+            }
+        } finally {
+            capturePacket = false;
+            capturedPacket = null;
+            mainThread.shutdown();
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
     /**
      * @return connection string in the form of
      *         127.0.0.1:port1,127.0.0.1:port2,127.0.0.1:port3
@@ -143,6 +253,27 @@ public void finishPacket(Packet p) {
             super.finishPacket(p);
         }
 
+        @Override
+        public Packet queuePacket(
+                RequestHeader h,
+                ReplyHeader r,
+                Record request,
+                Record response,
+                AsyncCallback cb,
+                String clientPath,
+                String serverPath,
+                Object ctx,
+                ZooKeeper.WatchRegistration watchRegistration,
+                WatchDeregistration watchDeregistration) {
+            Packet packet = super.queuePacket(h, r, request, response, cb, clientPath, serverPath,
+                    ctx, watchRegistration, watchDeregistration);
+
+            if (capturePacket && h != null && h.getType() == capturePacketType) {
+                capturedPacket = packet;
+            }
+            return packet;
+        }
+
     }
 
     class CustomZooKeeper extends ZooKeeper {

From 7316c495af36ed242abce3f1691a67028739eada Mon Sep 17 00:00:00 2001
From: Dan Wang <wangdan@apache.org>
Date: Tue, 25 Mar 2025 18:12:46 +0800
Subject: [PATCH 503/591] ZOOKEEPER-4895: Support encrypted password file
 during SASL authentication for C client

Reviewers: cnauroth, kezhuw
Author: empiredan
Closes #2223 from empiredan/zk-c-client-sasl-passwd-cb
---
 .../zookeeper-client-c/CMakeLists.txt         |   1 +
 .../zookeeper-client-c/include/zookeeper.h    |  64 ++++++++++
 .../zookeeper-client-c/src/zk_sasl.c          | 108 +++++++++++++---
 .../zookeeper-client-c/tests/TestSASLAuth.cc  | 115 +++++++++++++++++-
 4 files changed, 266 insertions(+), 22 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/CMakeLists.txt b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
index 64fff2c6669..da1351e20f5 100644
--- a/zookeeper-client/zookeeper-client-c/CMakeLists.txt
+++ b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
@@ -249,6 +249,7 @@ set(test_sources
   tests/ThreadingUtil.cc
   tests/TestZookeeperInit.cc
   tests/TestZookeeperClose.cc
+  tests/TestSASLAuth.cc
   tests/TestReconfig.cc
   tests/TestReconfigServer.cc
   tests/TestClientRetry.cc
diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 044250a3098..2fa6a7b5065 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -667,6 +667,70 @@ ZOOAPI zhandle_t *zookeeper_init_sasl(const char *host, watcher_fn fn,
 ZOOAPI sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
   const char *realm, const char* password_file);
 
+/**
+ * \brief signature of the callback function for SASL password.
+ *
+ * This callback is defined by user to decrypt the content of password file with
+ * context into the actual password.
+ *
+ * \param content the string read from the password file.
+ * \param content_len the size of the content in bytes.
+ * \param context the handback object that will be associated with the password
+ *   file. The object is not used by zookeeper internally and can be null.
+ * \param buf the buffer where the resulting actual password is saved.
+ * \param buf_len the size of buf in bytes, which is also the max allowed
+ *   password length.
+ * \param passwd_len as an output parameter of the callback function, passwd_len
+ *   points to the actual length of the password stored in buf. Its size must not
+ *   exceed buf_len; otherwise, SASL_BUFOVER will be returned.
+ * \return SASL_OK, or the possible errors defined by the SASL library.
+ */
+typedef int (*zoo_sasl_password_callback_t)(const char *content, size_t content_len,
+        void *context, char *buf, size_t buf_len, size_t *passwd_len);
+
+/**
+ * \brief zoo_sasl_password structure.
+ *
+ * This structure holds the parameters for getting the actual SASL password. The
+ * user-defined callback is a processor that decrypts the content of password_file
+ * with context as a handback object helping the decryption into the actual password
+ * as is described above for zoo_sasl_password_callback_t.
+ *
+ * All of password_file, context and callback are allowed to be null; however, once
+ * callback is defined, password_file should not be null since the content processed
+ * by callback is from password_file. If callback is null and password_file is given,
+ * the first line of the file is just the actual password. While both password_file
+ * and callback are null, the password would be read from terminal with prompt.
+ *
+ * zoo_sasl_password is defined by user and used to generate the actual password in
+ * response to \c SASL_CB_PASS.
+ */
+typedef struct zoo_sasl_password {
+  const char *password_file;                /*!< The path of the password file */
+  void *context;                            /*!< The handback object used by callback */
+  zoo_sasl_password_callback_t callback;    /*!< Callback over the content of password file */
+} zoo_sasl_password_t;
+
+/**
+ * \brief allocates and initializes a basic array of Cyrus SASL callbacks.
+ *
+ * This helper function is similar to zoo_sasl_make_basic_callbacks, except that
+ * the actual password is generated by zoo_sasl_password object rather than just
+ * read from the password file.
+ *
+ * \param user the "canned" response to \c SASL_CB_USER and \c SASL_CB_AUTHNAME,
+ *   or NULL for none.
+ * \param realm the "canned" response to \c SASL_CB_GETREALM, or NULL for none.
+ * \param password the object defined by user to specify how the actual password
+ *   is generated in response to \c SASL_CB_PASS, should never be NULL (otherwise
+ *   the behaviour is undefined), see struct zoo_sasl_password for details.
+ * \return the freshly-malloc()ed callbacks array, or NULL if allocation
+ *   failed. Deallocate with free(), but only after the corresponding
+ *   ZooKeeper handle is closed.
+ */
+ZOOAPI sasl_callback_t *zoo_sasl_make_password_callbacks(const char *user,
+  const char *realm, zoo_sasl_password_t *password);
+
 #endif /* HAVE_CYRUS_SASL_H */
 
 /**
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
index 6ae7e123733..587b93b511b 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
+++ b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
@@ -442,6 +442,8 @@ getpassphrase(const char *prompt) {
 
 struct zsasl_secret_ctx {
     const char *password_file;
+    void *context;
+    zoo_sasl_password_callback_t callback;
     sasl_secret_t *secret;
 };
 
@@ -451,53 +453,111 @@ struct zsasl_secret_ctx {
 static int _zsasl_getsecret(sasl_conn_t *conn, void *context, int id,
                             sasl_secret_t **psecret)
 {
+    /* Max allowed length of a password */
+    const size_t MAX_PASSWORD_LEN = 1023; 
     struct zsasl_secret_ctx *secret_ctx = (struct zsasl_secret_ctx *)context;
-    char buf[1024];
-    char *password;
-    size_t len;
+    /* The extra 1 byte is reserved for storing the null terminator. */
+    char buf[MAX_PASSWORD_LEN + 1]; 
+    char *password = NULL;
+    size_t len = 0;
+    int res = 0;
+    /* The extra 1 byte is reserved for storing the null terminator. */
+    char new_passwd[MAX_PASSWORD_LEN + 1];
+    char *p = NULL;
     sasl_secret_t *x;
 
     /* paranoia check */
-    if (!conn || !psecret || id != SASL_CB_PASS)
+    if (!conn || !psecret || id != SASL_CB_PASS) {
         return SASL_BADPARAM;
+    }
 
     if (secret_ctx->password_file) {
-        char *p;
         FILE *fh = fopen(secret_ctx->password_file, "rt");
-        if (!fh)
+        if (!fh) {
             return SASL_FAIL;
+        }
 
-        if (!fgets(buf, sizeof(buf), fh)) {
+        /*
+         * The file's content may be the encrypted password with binary characters,
+         * thus use fread().
+         */
+        len = fread(buf, sizeof(buf[0]), MAX_PASSWORD_LEN, fh);
+        if (ferror(fh)) {
             fclose(fh);
+            fh = NULL;
+
             return SASL_FAIL;
         }
 
         fclose(fh);
+        fh = NULL;
+
+        /*
+         * Write the null terminator immediately after the last character of the
+         * content since it would be used as a null-terminated string once it is
+         * the actual password.
+         */
+        buf[len] = '\0';
+        password = buf;
+    }
 
-        p = strrchr(buf, '\n');
-        if (p)
-            *p = '\0';
+    if (secret_ctx->callback) {
+        if (!password) {
+            /*
+             * The callback takes effect only when password_file is provided.
+             */
+            return SASL_BADPARAM;
+        }
 
-        password = buf;
+        res = secret_ctx->callback(password, len, secret_ctx->context,
+            new_passwd, MAX_PASSWORD_LEN, &len);
+        if (res != SASL_OK) {
+            return res;
+        }
+
+        if (len > MAX_PASSWORD_LEN) {
+            return SASL_BUFOVER;
+        }
+
+        /* 
+         * Append the null terminator  to the end of the password obtained from
+         * the callback function.
+         */
+        new_passwd[len] = '\0';
+        password = new_passwd;
+    } else if (secret_ctx->password_file) {
+        /*
+         * The file's content is the actual password, which must consist only of
+         * text characters (i.e., without null terminator). The first line would
+         * be read as the password once there are multiple lines in the file.
+         */
+        p = strchr(password, '\n');
+        if (p) {
+            *p = '\0';
+        }
     } else {
         password = getpassphrase("Password: ");
-
-        if (!password)
+        if (!password) {
             return SASL_FAIL;
+        }
     }
 
+    /*
+     * Any password, regardless of its source, is always null-terminated.
+     */
     len = strlen(password);
 
     x = secret_ctx->secret = (sasl_secret_t *)realloc(
         secret_ctx->secret, sizeof(sasl_secret_t) + len);
-
     if (!x) {
         memset(password, 0, len);
         return SASL_NOMEM;
     }
 
     x->len = len;
-    strcpy((char *) x->data, password);
+
+    /* The extra 1 byte is the null terminator. */
+    memcpy(x->data, password, len + 1);
     memset(password, 0, len);
 
     *psecret = x;
@@ -506,9 +566,9 @@ static int _zsasl_getsecret(sasl_conn_t *conn, void *context, int id,
 
 typedef int (* sasl_callback_fn_t)(void);
 
-sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
-                                               const char *realm,
-                                               const char* password_file)
+sasl_callback_t *zoo_sasl_make_password_callbacks(const char *user,
+                                                  const char *realm,
+                                                  zoo_sasl_password_t *password)
 {
     struct zsasl_secret_ctx *secret_ctx;
     const char *user_ctx = NULL;
@@ -521,7 +581,9 @@ sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
 
     rc = rc < 0 ? rc : _zsasl_strdup(&user_ctx, user);
     rc = rc < 0 ? rc : _zsasl_strdup(&realm_ctx, realm);
-    rc = rc < 0 ? rc : _zsasl_strdup(&secret_ctx->password_file, password_file);
+    rc = rc < 0 ? rc : _zsasl_strdup(&secret_ctx->password_file, password->password_file);
+    secret_ctx->context = password->context;
+    secret_ctx->callback = password->callback;
 
     {
         sasl_callback_t callbacks[] = {
@@ -551,6 +613,14 @@ sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
     }
 }
 
+sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
+                                               const char *realm,
+                                               const char* password_file)
+{
+    zoo_sasl_password_t password = {password_file, NULL, NULL};
+    return zoo_sasl_make_password_callbacks(user, realm, &password);
+}
+
 #ifdef __APPLE__
 #pragma GCC diagnostic pop
 #endif
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
index c98d4bffc81..fcac2be1393 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
@@ -34,6 +34,10 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
     CPPUNIT_TEST(testServerRequireClientSASL);
 #ifdef HAVE_CYRUS_SASL_H
     CPPUNIT_TEST(testClientSASL);
+    CPPUNIT_TEST(testClientSASLWithPasswordFileNewline);
+    CPPUNIT_TEST(testClientSASLWithPasswordFileFirstLine);
+    CPPUNIT_TEST(testClientSASLWithPasswordEncryptedText);
+    CPPUNIT_TEST(testClientSASLWithPasswordEncryptedBinary);
 #ifdef ZOO_IPV6_ENABLED
     CPPUNIT_TEST(testClientSASLOverIPv6);
 #endif/* ZOO_IPV6_ENABLED */
@@ -140,7 +144,8 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 #endif
 
-    void testClientSASLHelper(const char *hostPorts, const char *path) {
+    void testClientSASLHelper(const char *hostPorts, const char *path,
+                              const sasl_callback_t *callbacks) {
         startServer();
 
         // Initialize Cyrus SASL.
@@ -152,8 +157,7 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         sasl_params.service = "zookeeper";
         sasl_params.host = "zk-sasl-md5";
         sasl_params.mechlist = "DIGEST-MD5";
-        sasl_params.callbacks = zoo_sasl_make_basic_callbacks(
-            "myuser", NULL, "Zookeeper_SASLAuth.password");
+        sasl_params.callbacks = callbacks;
 
         // Connect.
         watchctx_t ctx;
@@ -188,10 +192,115 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         stopServer();
     }
 
+    void testClientSASLHelper(const char *hostPorts, const char *path,
+                              const char *password_file) {
+        const sasl_callback_t *callbacks = zoo_sasl_make_basic_callbacks(
+            "myuser", NULL, password_file);
+        testClientSASLHelper(hostPorts, path, callbacks);
+    }
+
+    void testClientSASLHelper(const char *hostPorts, const char *path) {
+        testClientSASLHelper(hostPorts, path, "Zookeeper_SASLAuth.password");
+    }
+
+    void testClientSASLHelper(const char *hostPorts, const char *path,
+                              zoo_sasl_password_t *password) {
+        const sasl_callback_t *callbacks = zoo_sasl_make_password_callbacks(
+            "myuser", NULL, password);
+        testClientSASLHelper(hostPorts, path, callbacks);
+    }
+
     void testClientSASL() {
         testClientSASLHelper(hostPorts, "/clientSASL");
     }
 
+    void testClientSASL(const char *password_file, const char *content, size_t content_len,
+                        const char *path, zoo_sasl_password_callback_t callback) {
+        // Create password file for client.
+        FILE *passf = fopen(password_file, "wt");
+        CPPUNIT_ASSERT(passf);
+
+        // Write the specified content into the file.
+        size_t len = fwrite(content, sizeof(content[0]), content_len, passf);
+        CPPUNIT_ASSERT_EQUAL(len, content_len);
+        CPPUNIT_ASSERT_EQUAL(fclose(passf), 0);
+        passf = NULL;
+
+        zoo_sasl_password_t passwd = {password_file, this, callback};
+        testClientSASLHelper(hostPorts, path, &passwd);
+    }
+
+    void testClientSASLWithPasswordFileNewline() {
+        // Insert a newline immediately after the correct password.
+        const char content[] = "mypassword\nabc";
+        testClientSASL("Zookeeper_SASLAuth.password.newline",
+                       content,
+                       sizeof(content) - 1,
+                       "/clientSASLWithPasswordFileNewline",
+                       NULL);
+    }
+
+    void testClientSASLWithPasswordFileFirstLine() {
+        // Insert multiple newlines and check if only the first line is accepted as the
+        // actual password.
+        const char content[] = "mypassword\nabc\nxyz";
+        testClientSASL("Zookeeper_SASLAuth.password.firstline",
+                       content,
+                       sizeof(content) - 1,
+                       "/clientSASLWithPasswordFileFirstLine",
+                       NULL);
+    }
+
+    int decryptPassword(const char *content, size_t content_len,
+                        char incr, char *buf, size_t buf_len,
+                        size_t *passwd_len) {
+        CPPUNIT_ASSERT(content_len <= buf_len);
+
+        // A simple decryption that only increases each character by a fixed value.
+        for (size_t i = 0; i < content_len; ++i) {
+            buf[i] = content[i] + incr;
+        }
+        *passwd_len = content_len;
+
+        // Since null terminator has not been appended to buf, use memcmp.  
+        CPPUNIT_ASSERT_EQUAL(memcmp(buf, "mypassword", *passwd_len), 0);
+        return SASL_OK;
+    }
+
+    static int textPasswordCallback(const char *content, size_t content_len,
+                                    void *context, char *buf, size_t buf_len,
+                                    size_t *passwd_len) {
+        Zookeeper_SASLAuth *auth = static_cast<Zookeeper_SASLAuth *>(context);
+        return auth->decryptPassword(content, content_len, 1, buf, buf_len, passwd_len);
+    }
+
+    void testClientSASLWithPasswordEncryptedText() {
+        // Encrypt "mypassword" by subtracting 1 from each character in it as plain text.
+        const char content[] = {0x6C, 0x78, 0x6F, 0x60, 0x72, 0x72, 0x76, 0x6E, 0x71, 0x63};
+        testClientSASL("Zookeeper_SASLAuth.password.encrypted.text",
+                       content,
+                       sizeof(content),
+                       "/clientSASLWithPasswordEncryptedText",
+                       textPasswordCallback);
+    }
+
+    static int binaryPasswordCallback(const char *content, size_t content_len,
+                                      void *context, char *buf, size_t buf_len,
+                                      size_t *passwd_len) {
+        Zookeeper_SASLAuth *auth = static_cast<Zookeeper_SASLAuth *>(context);
+        return auth->decryptPassword(content, content_len, 'a', buf, buf_len, passwd_len);
+    }
+
+    void testClientSASLWithPasswordEncryptedBinary() {
+        // Encrypt "mypassword" by subtracting 'a' from each character in it as binary format.
+        const char content[] = {0x0C, 0x18, 0x0F, 0x00, 0x12, 0x12, 0x16, 0x0E, 0x11, 0x03};
+        testClientSASL("Zookeeper_SASLAuth.password.encrypted.binary",
+                       content,
+                       sizeof(content),
+                       "/clientSASLWithPasswordEncryptedBinary",
+                       binaryPasswordCallback);
+    }
+
     void testClientSASLOverIPv6() {
         const char *ipAndPort = "::1:22181";
 

From 6e4ec270ceff046151c740783e7249d57b98e521 Mon Sep 17 00:00:00 2001
From: stroller <fujian1115@gmail.com>
Date: Tue, 25 Mar 2025 18:39:53 +0800
Subject: [PATCH 504/591] ZOOKEEPER-4907: Stop client packets processing after
 server channel closed

Reviewers: kezhuw, tisonkun
Author: jiafu1115
Closes #2236 from jiafu1115/jiafu1115-patch-1
---
 .../java/org/apache/zookeeper/server/NettyServerCnxn.java    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index fe0380db182..d6acb90fb1f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -367,6 +367,11 @@ void processMessage(ByteBuf buf) {
         checkIsInEventLoop("processMessage");
         LOG.debug("0x{} queuedBuffer: {}", Long.toHexString(sessionId), queuedBuffer);
 
+        if (closingChannel) {
+            LOG.debug("Drop incoming message during connection closing for session 0x{}", Long.toHexString(sessionId));
+            return;
+        }
+
         if (LOG.isTraceEnabled()) {
             LOG.trace("0x{} buf {}", Long.toHexString(sessionId), ByteBufUtil.hexDump(buf));
         }

From 69d95a256dd93a94fa211aeaa08b9e4f8d59beaf Mon Sep 17 00:00:00 2001
From: Christopher Tubbs <ctubbsii@apache.org>
Date: Tue, 25 Mar 2025 16:16:50 -0400
Subject: [PATCH 505/591] ZOOKEEPER-3766: Clean up bash scripts

ZOOKEEPER-3766: Clean up bash scripts
For ZOOKEEPER-3766:
* Export CLASSPATH in scripts and remove `-cp $CLASSPATH` uses, so that
  java picks up the classpath from the environment, to avoid absurdly
  long command lines in process listings (this should also fix an issue
  with older versions of pgrep/pkill, such as that installed on RHEL8;
  see https://bugzilla.redhat.com/show_bug.cgi?id=1782309 for details)
* Add a new `classpath` command to print the CLASSPATH environment
  variable in the form `CLASSPATH=$CLASSPATH` from the script, so that
  the script's view of the CLASSPATH environment can easily be inspected
  when troubleshooting java processes
Also fix other code quality issues in all bash scripts:
* Add CI checks for shfmt and shellcheck for all bash scripts
* Standardize "shebang" lines
* Standardize license header formatting
* Format using shfmt tool and address all shellcheck problems
* Remove unnecessary quoting and use of curly braces
* Standardize on double square braces to avoid unpredictable use of
  /usr/bin/\[ instead of built-in bash braces
* Remove a useless check of `$?` in bin/zkServer-initialize.sh
* Remove an impossible to reach exit from bin/zkServer-initialize.sh
* Remove an impossible to fail check of `$?` after nohup is executed in
  bin/zkServer.sh (nohup with a trailing `&` always returns a zero exit
  code for success, even if the command fails; if it fails it fails
  undetectibly in the background)
* Avoid using sed for regex, and use built-in bash regex instead
* Delete some old scripts (some of which are broken anyway) that don't
  appear to be used anywhere, and don't seem to have any current need
* Bump rat plugin version for https in license and add license to
  .gitattributes to make rat plugin happy again
Reviewers: tisonkun, anmolnar
Author: ctubbsii
Closes #2224 from ctubbsii/cleanup-scripts
---
 .gitattributes                                |  19 +
 .github/workflows/scripts.yaml                |  58 ++
 bin/zkCleanup.sh                              |  58 +-
 bin/zkCli.sh                                  |  53 +-
 bin/zkEnv.sh                                  | 132 ++--
 bin/zkServer-initialize.sh                    | 162 ++---
 bin/zkServer.sh                               | 332 +++++----
 bin/zkSnapShotToolkit.sh                      |  47 +-
 bin/zkSnapshotComparer.sh                     |  45 +-
 bin/zkSnapshotRecursiveSummaryToolkit.sh      |  48 +-
 bin/zkTxnLogToolkit.sh                        |  47 +-
 dev/docker/run.sh                             |  72 +-
 pom.xml                                       |   1 +
 tools/ci/install-shfmt.sh                     |  29 +
 tools/ci/run-shellcheck.sh                    |  28 +
 tools/ci/run-shfmt.sh                         |  26 +
 tools/sonar/code-coverage.sh                  |  45 +-
 .../zookeeper-client-c/ssl/gencerts.sh        |  41 +-
 .../zookeeper-client-c/tests/zkServer.sh      | 289 ++++----
 .../src/main/resources/loggraph-dev.sh        |  64 +-
 .../src/main/resources/loggraph.sh            |  68 +-
 .../zookeeper-contrib-rest/rest.sh            | 101 +--
 .../src/test/zkServer.sh                      | 104 ++-
 .../src/test/run_tests.sh                     |  44 +-
 .../src/test/zkServer.sh                      | 109 ++-
 .../zooInspector-dev.sh                       |  36 +-
 .../zooInspector.sh                           |  35 +-
 .../src/main/c/tests/zkServer.sh              |  86 ++-
 .../src/main/c/tests/zkServer.sh              |  86 ++-
 .../src/main/resources/lastRevision.bat       |  22 -
 .../src/main/resources/lastRevision.sh        |  22 -
 .../src/test/resources/test-github-pr.sh      | 614 -----------------
 .../src/test/resources/test-patch.sh          | 647 ------------------
 .../src/test/resources/test-scripts.sh        | 221 ------
 34 files changed, 1208 insertions(+), 2583 deletions(-)
 create mode 100644 .github/workflows/scripts.yaml
 create mode 100755 tools/ci/install-shfmt.sh
 create mode 100755 tools/ci/run-shellcheck.sh
 create mode 100755 tools/ci/run-shfmt.sh
 mode change 100644 => 100755 zookeeper-contrib/zookeeper-contrib-rest/rest.sh
 delete mode 100644 zookeeper-server/src/main/resources/lastRevision.bat
 delete mode 100755 zookeeper-server/src/main/resources/lastRevision.sh
 delete mode 100755 zookeeper-server/src/test/resources/test-github-pr.sh
 delete mode 100755 zookeeper-server/src/test/resources/test-patch.sh
 delete mode 100755 zookeeper-server/src/test/resources/test-scripts.sh

diff --git a/.gitattributes b/.gitattributes
index c3cc5e082bc..3d68ac6cc74 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,22 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
 # Auto detect text files and perform LF normalization
 *        text=auto
 
diff --git a/.github/workflows/scripts.yaml b/.github/workflows/scripts.yaml
new file mode 100644
index 00000000000..723aff7313c
--- /dev/null
+++ b/.github/workflows/scripts.yaml
@@ -0,0 +1,58 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# This workflow enforces quality checks on bash scripts in the project
+
+name: ScriptQA
+
+on:
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ '*' ]
+
+permissions:
+  contents: read
+
+jobs:
+  shfmt:
+    name: shfmt
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install shfmt
+      run: tools/ci/install-shfmt.sh
+    - name: Checking formatting of all scripts
+      run: tools/ci/run-shfmt.sh
+
+  shellcheck:
+    name: ShellCheck
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install shfmt
+      run: tools/ci/install-shfmt.sh
+    - name: Running shellcheck on all scripts
+      run: tools/ci/run-shellcheck.sh
diff --git a/bin/zkCleanup.sh b/bin/zkCleanup.sh
index b6fe0e75841..f3e54de03d8 100755
--- a/bin/zkCleanup.sh
+++ b/bin/zkCleanup.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
 
 #
 # This script cleans up old transaction logs and snapshots
@@ -27,12 +30,14 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
@@ -41,13 +46,12 @@ ZOODATALOGDIR="$(grep "^[[:space:]]*dataLogDir=" "$ZOOCFG" | sed -e 's/.*=//')"
 
 ZOO_LOG_FILE=zookeeper-$USER-cleanup-$HOSTNAME.log
 
-if [ "x$ZOODATALOGDIR" = "x" ]
-then
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-     -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.PurgeTxnLog "$ZOODATADIR" $*
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+if [[ -z $ZOODATALOGDIR ]]; then
+  "$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" "${flags[@]}" \
+    org.apache.zookeeper.server.PurgeTxnLog "$ZOODATADIR" "$@"
 else
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-     -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.PurgeTxnLog "$ZOODATALOGDIR" "$ZOODATADIR" $*
+  "$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" "${flags[@]}" \
+    org.apache.zookeeper.server.PurgeTxnLog "$ZOODATALOGDIR" "$ZOODATADIR" "$@"
 fi
diff --git a/bin/zkCli.sh b/bin/zkCli.sh
index 3810e7f6880..7ae9637766b 100755
--- a/bin/zkCli.sh
+++ b/bin/zkCli.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
 
 #
 # This script cleans up old transaction logs and snapshots
@@ -27,17 +30,23 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
 ZOO_LOG_FILE=zookeeper-$USER-cli-$HOSTNAME.log
 
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-     -cp "$CLASSPATH" $CLIENT_JVMFLAGS $JVMFLAGS \
-     org.apache.zookeeper.ZooKeeperMain "$@"
+# shellcheck disable=SC2206
+clientflags=($CLIENT_JVMFLAGS)
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+  "${clientflags[@]}" "${flags[@]}" \
+  org.apache.zookeeper.ZooKeeperMain "$@"
diff --git a/bin/zkEnv.sh b/bin/zkEnv.sh
index 46a4621c42b..40889874818 100755
--- a/bin/zkEnv.sh
+++ b/bin/zkEnv.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 # This script should be sourced into other zookeeper
 # scripts to setup the env variables
@@ -26,101 +29,88 @@
 # '--config' option in the command line.
 
 ZOOBINDIR="${ZOOBINDIR:-/usr/bin}"
-ZOOKEEPER_PREFIX="${ZOOBINDIR}/.."
+ZOOKEEPER_PREFIX="$ZOOBINDIR/.."
 
 #check to see if the conf dir is given as an optional argument
-if [ $# -gt 1 ]
-then
-    if [ "--config" = "$1" ]
-	  then
-	      shift
-	      confdir=$1
-	      shift
-	      ZOOCFGDIR=$confdir
-    fi
+if [[ $# -gt 1 ]]; then
+  if [[ "--config" == "$1" ]]; then
+    shift
+    ZOOCFGDIR=$1
+    shift
+  fi
 fi
 
-if [ "x$ZOOCFGDIR" = "x" ]
-then
-  if [ -e "${ZOOKEEPER_PREFIX}/conf" ]; then
+if [[ -z $ZOOCFGDIR ]]; then
+  if [[ -e "$ZOOKEEPER_PREFIX/conf" ]]; then
     ZOOCFGDIR="$ZOOBINDIR/../conf"
   else
     ZOOCFGDIR="$ZOOBINDIR/../etc/zookeeper"
   fi
 fi
 
-if [ -f "${ZOOCFGDIR}/zookeeper-env.sh" ]; then
-  . "${ZOOCFGDIR}/zookeeper-env.sh"
+if [[ -f "$ZOOCFGDIR/zookeeper-env.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOCFGDIR/zookeeper-env.sh"
 fi
 
-if [ "x$ZOOCFG" = "x" ]
-then
-    ZOOCFG="zoo.cfg"
-fi
+ZOOCFG=${ZOOCFG:-zoo.cfg}
 
 ZOOCFG="$ZOOCFGDIR/$ZOOCFG"
 
-if [ -f "$ZOOCFGDIR/java.env" ]
-then
-    . "$ZOOCFGDIR/java.env"
+if [[ -f "$ZOOCFGDIR/java.env" ]]; then
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOCFGDIR/java.env"
 fi
 
-if [ "x${ZOO_LOG_DIR}" = "x" ]
-then
-    ZOO_LOG_DIR="$ZOOKEEPER_PREFIX/logs"
-fi
+ZOO_LOG_DIR=${ZOO_LOG_DIR:-$ZOOKEEPER_PREFIX/logs}
 
-if [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]];  then
-    JAVA="$JAVA_HOME/bin/java"
+if [[ -n $JAVA_HOME ]] && [[ -x "$JAVA_HOME/bin/java" ]]; then
+  JAVA="$JAVA_HOME/bin/java"
 elif type -p java; then
-    JAVA=java
+  # ignore unused; used this file is sourced
+  # shellcheck disable=SC2034
+  JAVA=java
 else
-    echo "Error: JAVA_HOME is not set and java could not be found in PATH." 1>&2
-    exit 1
+  echo "Error: JAVA_HOME is not set and java could not be found in PATH." 1>&2
+  exit 1
 fi
 
 #add the zoocfg dir to classpath
 CLASSPATH="$ZOOCFGDIR:$CLASSPATH"
 
-for i in "$ZOOBINDIR"/../zookeeper-server/src/main/resources/lib/*.jar
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "$ZOOBINDIR"/../zookeeper-server/src/main/resources/lib/*.jar; do
+  CLASSPATH="$i:$CLASSPATH"
 done
 
 #make it work in the binary package
 #(use array for LIBPATH to account for spaces within wildcard expansion)
-if ls "${ZOOKEEPER_PREFIX}"/share/zookeeper/zookeeper-*.jar > /dev/null 2>&1; then 
-  LIBPATH=("${ZOOKEEPER_PREFIX}"/share/zookeeper/*.jar)
+if ls "$ZOOKEEPER_PREFIX"/share/zookeeper/zookeeper-*.jar &>/dev/null; then
+  LIBPATH=("$ZOOKEEPER_PREFIX"/share/zookeeper/*.jar)
 else
   #release tarball format
-  for i in "$ZOOBINDIR"/../zookeeper-*.jar
-  do
+  for i in "$ZOOBINDIR"/../zookeeper-*.jar; do
     CLASSPATH="$i:$CLASSPATH"
   done
-  LIBPATH=("${ZOOBINDIR}"/../lib/*.jar)
+  LIBPATH=("$ZOOBINDIR"/../lib/*.jar)
 fi
 
-for i in "${LIBPATH[@]}"
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "${LIBPATH[@]}"; do
+  CLASSPATH="$i:$CLASSPATH"
 done
 
 #make it work for developers
-for d in "$ZOOBINDIR"/../build/lib/*.jar
-do
-   CLASSPATH="$d:$CLASSPATH"
+for d in "$ZOOBINDIR"/../build/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
 #make it work for developers
-for d in "$ZOOBINDIR"/../zookeeper-server/target/lib/*.jar
-do
-   CLASSPATH="$d:$CLASSPATH"
+for d in "$ZOOBINDIR"/../zookeeper-server/target/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
 #make it work for developers
-for d in "$ZOOBINDIR"/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/lib/*.jar
-do
-   CLASSPATH="$d:$CLASSPATH"
+for d in "$ZOOBINDIR"/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
 #make it work for developers
@@ -132,17 +122,17 @@ CLASSPATH="$ZOOBINDIR/../zookeeper-server/target/classes:$CLASSPATH"
 #make it work for developers
 CLASSPATH="$ZOOBINDIR/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/classes:$CLASSPATH"
 
-case "`uname`" in
-    CYGWIN*|MINGW*) cygwin=true ;;
-    *) cygwin=false ;;
+case "$(uname)" in
+  CYGWIN* | MINGW*) cygwin=true ;;
+  *) cygwin=false ;;
 esac
 
-if $cygwin
-then
-    CLASSPATH=`cygpath -wp "$CLASSPATH"`
+if $cygwin; then
+  CLASSPATH=$(cygpath -wp "$CLASSPATH")
 fi
 
 #echo "CLASSPATH=$CLASSPATH"
+export CLASSPATH
 
 # default heap for zookeeper server
 ZK_SERVER_HEAP="${ZK_SERVER_HEAP:-1000}"
diff --git a/bin/zkServer-initialize.sh b/bin/zkServer-initialize.sh
index 062e265915c..d41befcd470 100755
--- a/bin/zkServer-initialize.sh
+++ b/bin/zkServer-initialize.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,12 +26,14 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
@@ -47,94 +52,93 @@ usage() {
   exit 1
 }
 
-if [ $? != 0 ] ; then
-    usage
-    exit 1
-fi
-
 initialize() {
-    if [ ! -e "$ZOOCFG" ]; then
-        echo "Unable to find config file at $ZOOCFG"
-        exit 1
-    fi
-
-    ZOO_DATADIR="$(grep "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')"
-    ZOO_DATALOGDIR="$(grep "^[[:space:]]*dataLogDir" "$ZOOCFG" | sed -e 's/.*=//')"
-
-    if [ -z "$ZOO_DATADIR" ]; then
-        echo "Unable to determine dataDir from $ZOOCFG"
-        exit 1
-    fi
-
-    if [ $FORCE ]; then
-        echo "Force enabled, data/txnlog directories will be re-initialized"
-    else
-        # we create if version-2 exists (ie real data), not the
-        # parent. See comments in following section for more insight
-        if [ -d "$ZOO_DATADIR/version-2" ]; then
-            echo "ZooKeeper data directory already exists at $ZOO_DATADIR (or use --force to force re-initialization)"
-            exit 1
-        fi
-
-        if [ -n "$ZOO_DATALOGDIR" ] && [ -d "$ZOO_DATALOGDIR/version-2" ]; then
-            echo "ZooKeeper txnlog directory already exists at $ZOO_DATALOGDIR (or use --force to force re-initialization)"
-            exit 1
-        fi
-    fi
+  if [[ ! -e $ZOOCFG ]]; then
+    echo "Unable to find config file at $ZOOCFG"
+    exit 1
+  fi
 
-    # remove the child files that we're (not) interested in, not the
-    # parent. this allows for parent to be installed separately, and
-    # permissions to be set based on overarching requirements. by
-    # default we'll use the permissions of the user running this
-    # script for the files contained by the parent. note also by using
-    # -p the parent(s) will be created if it doesn't already exist
-    rm -rf "$ZOO_DATADIR/myid" 2>/dev/null >/dev/null
-    rm -rf "$ZOO_DATADIR/version-2" 2>/dev/null >/dev/null
-    mkdir -p "$ZOO_DATADIR/version-2"
+  ZOO_DATADIR="$(grep "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')"
+  ZOO_DATALOGDIR="$(grep "^[[:space:]]*dataLogDir" "$ZOOCFG" | sed -e 's/.*=//')"
 
-    if [ -n "$ZOO_DATALOGDIR" ]; then
-        rm -rf "$ZOO_DATALOGDIR/myid" 2>/dev/null >/dev/null
-        rm -rf "$ZOO_DATALOGDIR/version-2" 2>/dev/null >/dev/null
-        mkdir -p "$ZOO_DATALOGDIR/version-2"
+  if [[ -z $ZOO_DATADIR ]]; then
+    echo "Unable to determine dataDir from $ZOOCFG"
+    exit 1
+  fi
+
+  if [[ $FORCE -eq 1 ]]; then
+    echo "Force enabled, data/txnlog directories will be re-initialized"
+  else
+    # we create if version-2 exists (ie real data), not the
+    # parent. See comments in following section for more insight
+    if [[ -d "$ZOO_DATADIR/version-2" ]]; then
+      echo "ZooKeeper data directory already exists at $ZOO_DATADIR (or use --force to force re-initialization)"
+      exit 1
     fi
 
-    if [ $MYID ]; then
-        echo "Using myid of $MYID"
-        echo $MYID > "$ZOO_DATADIR/myid"
-    else
-        echo "No myid provided, be sure to specify it in $ZOO_DATADIR/myid if using non-standalone"
+    if [[ -n $ZOO_DATALOGDIR ]] && [[ -d "$ZOO_DATALOGDIR/version-2" ]]; then
+      echo "ZooKeeper txnlog directory already exists at $ZOO_DATALOGDIR (or use --force to force re-initialization)"
+      exit 1
     fi
-
-    touch "$ZOO_DATADIR/initialize"
+  fi
+
+  # remove the child files that we're (not) interested in, not the
+  # parent. this allows for parent to be installed separately, and
+  # permissions to be set based on overarching requirements. by
+  # default we'll use the permissions of the user running this
+  # script for the files contained by the parent. note also by using
+  # -p the parent(s) will be created if it doesn't already exist
+  rm -rf "$ZOO_DATADIR/myid" 2>/dev/null >/dev/null
+  rm -rf "$ZOO_DATADIR/version-2" 2>/dev/null >/dev/null
+  mkdir -p "$ZOO_DATADIR/version-2"
+
+  if [[ -n $ZOO_DATALOGDIR ]]; then
+    rm -rf "$ZOO_DATALOGDIR/myid" 2>/dev/null >/dev/null
+    rm -rf "$ZOO_DATALOGDIR/version-2" 2>/dev/null >/dev/null
+    mkdir -p "$ZOO_DATALOGDIR/version-2"
+  fi
+
+  if [[ -n $MYID ]]; then
+    echo "Using myid of $MYID"
+    echo "$MYID" >"$ZOO_DATADIR/myid"
+  else
+    echo "No myid provided, be sure to specify it in $ZOO_DATADIR/myid if using non-standalone"
+  fi
+
+  touch "$ZOO_DATADIR/initialize"
 }
 
-while [ ! -z "$1" ]; do
+while [[ -n $1 ]]; do
   case "$1" in
     --configfile)
-      ZOOCFG=$2; shift 2
+      ZOOCFG=$2
+      shift 2
       ;;
     --configfile=?*)
-      ZOOCFG=${1#*=}; shift 1
+      ZOOCFG=${1#*=}
+      shift 1
       ;;
     --myid)
-      MYID=$2; shift 2
+      MYID=$2
+      shift 2
       ;;
     --myid=?*)
-      MYID=${1#*=}; shift 1
+      MYID=${1#*=}
+      shift 1
       ;;
     --force)
-      FORCE=1; shift 1
+      FORCE=1
+      shift 1
       ;;
     -h)
       usage
-      ;; 
+      ;;
     --help)
       usage
-      ;; 
+      ;;
     *)
       echo "Unknown option: $1"
       usage
-      exit 1 
       ;;
   esac
 done
diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index 91d335c00ad..b2fd120544e 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -21,15 +24,16 @@
 # relative to the canonical path of this script.
 #
 
-
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
@@ -37,252 +41,240 @@ fi
 # up the JVM to accept JMX remote management:
 # http://java.sun.com/javase/6/docs/technotes/guides/management/agent.html
 # by default we allow local JMX connections
-if [ "x$JMXLOCALONLY" = "x" ]
-then
-    JMXLOCALONLY=false
+if [[ -z $JMXLOCALONLY ]]; then
+  JMXLOCALONLY=false
 fi
 
-if [ "x$JMXDISABLE" = "x" ] || [ "$JMXDISABLE" = 'false' ]
-then
+if [[ -z $JMXDISABLE ]] || [[ $JMXDISABLE == 'false' ]]; then
   echo "ZooKeeper JMX enabled by default" >&2
-  if [ "x$JMXPORT" = "x" ]
-  then
+  if [[ -z $JMXPORT ]]; then
     # for some reason these two options are necessary on jdk6 on Ubuntu
     #   accord to the docs they are not necessary, but otw jconsole cannot
     #   do a local attach
-    ZOOMAIN="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=$JMXLOCALONLY org.apache.zookeeper.server.quorum.QuorumPeerMain"
+    ZOOMAIN=("-Dcom.sun.management.jmxremote" "-Dcom.sun.management.jmxremote.local.only=$JMXLOCALONLY" "org.apache.zookeeper.server.quorum.QuorumPeerMain")
   else
-    if [ "x$JMXAUTH" = "x" ]
-    then
+    if [[ -z $JMXAUTH ]]; then
       JMXAUTH=false
     fi
-    if [ "x$JMXSSL" = "x" ]
-    then
+    if [[ -z $JMXSSL ]]; then
       JMXSSL=false
     fi
-    if [ "x$JMXLOG4J" = "x" ]
-    then
+    if [[ -z $JMXLOG4J ]]; then
       JMXLOG4J=true
     fi
     echo "ZooKeeper remote JMX Port set to $JMXPORT" >&2
     echo "ZooKeeper remote JMX authenticate set to $JMXAUTH" >&2
     echo "ZooKeeper remote JMX ssl set to $JMXSSL" >&2
     echo "ZooKeeper remote JMX log4j set to $JMXLOG4J" >&2
-    if [ "x$JMXHOSTNAME" = "x" ]
-    then
-      ZOOMAIN="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=$JMXPORT -Dcom.sun.management.jmxremote.authenticate=$JMXAUTH -Dcom.sun.management.jmxremote.ssl=$JMXSSL -Dzookeeper.jmx.log4j.disable=$JMXLOG4J org.apache.zookeeper.server.quorum.QuorumPeerMain"
+    if [[ -z $JMXHOSTNAME ]]; then
+      ZOOMAIN=("-Dcom.sun.management.jmxremote" "-Dcom.sun.management.jmxremote.port=$JMXPORT" "-Dcom.sun.management.jmxremote.authenticate=$JMXAUTH" "-Dcom.sun.management.jmxremote.ssl=$JMXSSL" "-Dzookeeper.jmx.log4j.disable=$JMXLOG4J" "org.apache.zookeeper.server.quorum.QuorumPeerMain")
     else
       echo "ZooKeeper remote JMX Hostname set to $JMXHOSTNAME" >&2
-      ZOOMAIN="-Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=$JMXHOSTNAME -Dcom.sun.management.jmxremote.port=$JMXPORT -Dcom.sun.management.jmxremote.authenticate=$JMXAUTH -Dcom.sun.management.jmxremote.ssl=$JMXSSL -Dzookeeper.jmx.log4j.disable=$JMXLOG4J org.apache.zookeeper.server.quorum.QuorumPeerMain"
+      ZOOMAIN=("-Dcom.sun.management.jmxremote" "-Djava.rmi.server.hostname=$JMXHOSTNAME" "-Dcom.sun.management.jmxremote.port=$JMXPORT" "-Dcom.sun.management.jmxremote.authenticate=$JMXAUTH" "-Dcom.sun.management.jmxremote.ssl=$JMXSSL" "-Dzookeeper.jmx.log4j.disable=$JMXLOG4J" "org.apache.zookeeper.server.quorum.QuorumPeerMain")
     fi
   fi
 else
-    echo "JMX disabled by user request" >&2
-    ZOOMAIN="org.apache.zookeeper.server.quorum.QuorumPeerMain"
+  echo "JMX disabled by user request" >&2
+  ZOOMAIN=("org.apache.zookeeper.server.quorum.QuorumPeerMain")
 fi
 
-if [ "x$SERVER_JVMFLAGS" != "x" ]
-then
-    JVMFLAGS="$SERVER_JVMFLAGS $JVMFLAGS"
+if [[ -n $SERVER_JVMFLAGS ]]; then
+  JVMFLAGS="$SERVER_JVMFLAGS $JVMFLAGS"
 fi
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+# shellcheck disable=SC2206
+clientflags=($CLIENT_JVMFLAGS)
 
-if [ "x$2" != "x" ]
-then
-    ZOOCFG="$ZOOCFGDIR/$2"
+if [[ -n $2 ]]; then
+  ZOOCFG="$ZOOCFGDIR/$2"
 fi
 
 # if we give a more complicated path to the config, don't screw around in $ZOOCFGDIR
-if [ "x$(dirname "$ZOOCFG")" != "x$ZOOCFGDIR" ]
-then
-    ZOOCFG="$2"
+if [[ "$(dirname "$ZOOCFG")" != "$ZOOCFGDIR" ]]; then
+  ZOOCFG="$2"
 fi
 
-if $cygwin
-then
-    ZOOCFG=`cygpath -wp "$ZOOCFG"`
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
+if $cygwin; then
+  ZOOCFG=$(cygpath -wp "$ZOOCFG")
+  # cygwin has a "kill" in the shell itself, gets confused
+  KILL='/bin/kill'
 else
-    KILL=kill
+  KILL='kill'
 fi
 
 echo "Using config: $ZOOCFG" >&2
 
 case "$OSTYPE" in
-*solaris*)
-  GREP=/usr/xpg4/bin/grep
-  ;;
-*)
-  GREP=grep
-  ;;
+  *solaris*)
+    GREP='/usr/xpg4/bin/grep'
+    ;;
+  *)
+    GREP='grep'
+    ;;
 esac
 ZOO_DATADIR="$($GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')"
-ZOO_DATADIR="$(echo -e "${ZOO_DATADIR}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+ZOO_DATADIR="$(echo -e "$ZOO_DATADIR" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
 ZOO_DATALOGDIR="$($GREP "^[[:space:]]*dataLogDir" "$ZOOCFG" | sed -e 's/.*=//')"
 
 # iff autocreate is turned off and the datadirs don't exist fail
 # immediately as we can't create the PID file, etc..., anyway.
-if [ -n "$ZOO_DATADIR_AUTOCREATE_DISABLE" ]; then
-    if [ ! -d "$ZOO_DATADIR/version-2" ]; then
-        echo "ZooKeeper data directory is missing at $ZOO_DATADIR fix the path or run initialize"
-        exit 1
-    fi
+if [[ -n $ZOO_DATADIR_AUTOCREATE_DISABLE ]]; then
+  if [[ ! -d "$ZOO_DATADIR/version-2" ]]; then
+    echo "ZooKeeper data directory is missing at $ZOO_DATADIR fix the path or run initialize"
+    exit 1
+  fi
 
-    if [ -n "$ZOO_DATALOGDIR" ] && [ ! -d "$ZOO_DATALOGDIR/version-2" ]; then
-        echo "ZooKeeper txnlog directory is missing at $ZOO_DATALOGDIR fix the path or run initialize"
-        exit 1
-    fi
-    ZOO_DATADIR_AUTOCREATE="-Dzookeeper.datadir.autocreate=false"
+  if [[ -n $ZOO_DATALOGDIR ]] && [[ ! -d "$ZOO_DATALOGDIR/version-2" ]]; then
+    echo "ZooKeeper txnlog directory is missing at $ZOO_DATALOGDIR fix the path or run initialize"
+    exit 1
+  fi
+  flags=("-Dzookeeper.datadir.autocreate=false" "${flags[@]}")
 fi
 
-if [ -z "$ZOOPIDFILE" ]; then
-    if [ ! -d "$ZOO_DATADIR" ]; then
-        mkdir -p "$ZOO_DATADIR"
-    fi
-    ZOOPIDFILE="$ZOO_DATADIR/zookeeper_server.pid"
+if [[ -z $ZOOPIDFILE ]]; then
+  if [[ ! -d $ZOO_DATADIR ]]; then
+    mkdir -p "$ZOO_DATADIR"
+  fi
+  ZOOPIDFILE="$ZOO_DATADIR/zookeeper_server.pid"
 else
-    # ensure it exists, otw stop will fail
-    mkdir -p "$(dirname "$ZOOPIDFILE")"
+  # ensure it exists, otw stop will fail
+  mkdir -p "$(dirname "$ZOOPIDFILE")"
 fi
 
-if [ ! -w "$ZOO_LOG_DIR" ] ; then
-mkdir -p "$ZOO_LOG_DIR"
+if [[ ! -w $ZOO_LOG_DIR ]]; then
+  mkdir -p "$ZOO_LOG_DIR"
 fi
 
 ZOO_LOG_FILE=${ZOO_LOG_FILE:-zookeeper-$USER-server-$HOSTNAME.log}
 _ZOO_DAEMON_OUT="$ZOO_LOG_DIR/zookeeper-$USER-server-$HOSTNAME.out"
 
 case $1 in
-start)
-    echo  -n "Starting zookeeper ... "
-    if [ -f "$ZOOPIDFILE" ]; then
-      if kill -0 `cat "$ZOOPIDFILE"` > /dev/null 2>&1; then
-         echo $command already running as process `cat "$ZOOPIDFILE"`.
-         exit 1
+  start)
+    echo -n "Starting zookeeper ... "
+    if [[ -f $ZOOPIDFILE ]]; then
+      if kill -0 "$(cat "$ZOOPIDFILE")" &>/dev/null; then
+        echo "already running as process $(cat "$ZOOPIDFILE")."
+        exit 1
       fi
     fi
-    nohup "$JAVA" $ZOO_DATADIR_AUTOCREATE "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" \
-    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-    -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
-    -cp "$CLASSPATH" $JVMFLAGS $ZOOMAIN "$ZOOCFG" > "$_ZOO_DAEMON_OUT" 2>&1 < /dev/null &
-    if [ $? -eq 0 ]
-    then
-      case "$OSTYPE" in
+    nohup "$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" \
+      "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+      -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
+      "${flags[@]}" "${ZOOMAIN[@]}" "$ZOOCFG" &>"$_ZOO_DAEMON_OUT" </dev/null &
+    case "$OSTYPE" in
       *solaris*)
-        /bin/echo "${!}\\c" > "$ZOOPIDFILE"
+        /bin/echo "${!}\\c" >"$ZOOPIDFILE"
         ;;
       aix*)
-        /bin/echo "$!\c" > "$ZOOPIDFILE"
+        /bin/echo "$!\c" >"$ZOOPIDFILE"
         ;;
       *)
-        /bin/echo -n $! > "$ZOOPIDFILE"
+        echo -n $! >"$ZOOPIDFILE"
         ;;
-      esac
-      if [ $? -eq 0 ];
-      then
-        sleep 1
-        pid=$(cat "${ZOOPIDFILE}")
-        if ps -p "${pid}" > /dev/null 2>&1; then
-          echo STARTED
-        else
-          echo FAILED TO START
-          exit 1
-        fi
+    esac
+    # this checks the exit code of the echo statements to verify the PID was written
+    # shellcheck disable=SC2320,SC2181
+    if [[ $? -eq 0 ]]; then
+      sleep 1
+      pid=$(cat "$ZOOPIDFILE")
+      if ps -p "$pid" &>/dev/null; then
+        echo STARTED
       else
-        echo FAILED TO WRITE PID
+        echo FAILED TO START
         exit 1
       fi
     else
-      echo SERVER DID NOT START
+      echo FAILED TO WRITE PID
       exit 1
     fi
     ;;
-start-foreground)
+  start-foreground)
     ZOO_CMD=(exec "$JAVA")
-    if [ "${ZOO_NOEXEC}" != "" ]; then
+    if [[ -n $ZOO_NOEXEC ]]; then
       ZOO_CMD=("$JAVA")
     fi
-    "${ZOO_CMD[@]}" $ZOO_DATADIR_AUTOCREATE "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" \
-    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-    -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
-    -cp "$CLASSPATH" $JVMFLAGS $ZOOMAIN "$ZOOCFG"
+    "${ZOO_CMD[@]}" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" \
+      "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+      -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
+      "${flags[@]}" "${ZOOMAIN[@]}" "$ZOOCFG"
     ;;
-print-cmd)
-    echo "\"$JAVA\" $ZOO_DATADIR_AUTOCREATE -Dzookeeper.log.dir=\"${ZOO_LOG_DIR}\" \
-    -Dzookeeper.log.file=\"${ZOO_LOG_FILE}\" \
+  print-classpath)
+    echo "CLASSPATH=$CLASSPATH"
+    ;;
+  print-cmd)
+    echo "\"$JAVA\" -Dzookeeper.log.dir=\"$ZOO_LOG_DIR\" \
+    -Dzookeeper.log.file=\"$ZOO_LOG_FILE\" \
     -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
-    -cp \"$CLASSPATH\" $JVMFLAGS $ZOOMAIN \"$ZOOCFG\" > \"$_ZOO_DAEMON_OUT\" 2>&1 < /dev/null"
+    $(for x in "${flags[@]}"; do echo "\"$x\""; done | paste -sd' ') \
+    $(for x in "${ZOOMAIN[@]}"; do echo "\"$x\""; done | paste -sd' ') \
+    \"$ZOOCFG\" &>\"$_ZOO_DAEMON_OUT\" </dev/null"
     ;;
-stop)
+  stop)
     echo -n "Stopping zookeeper ... "
-    if [ ! -f "$ZOOPIDFILE" ]
-    then
+    if [[ ! -f $ZOOPIDFILE ]]; then
       echo "no zookeeper to stop (could not find file $ZOOPIDFILE)"
     else
-      $KILL $(cat "$ZOOPIDFILE")
+      $KILL "$(cat "$ZOOPIDFILE")"
       rm "$ZOOPIDFILE"
       sleep 1
       echo STOPPED
     fi
     exit 0
     ;;
-version)
-    ZOOMAIN=org.apache.zookeeper.version.VersionInfoMain
-    $JAVA -cp "$CLASSPATH" $ZOOMAIN 2> /dev/null
+  version)
+    ZOOMAIN=("org.apache.zookeeper.version.VersionInfoMain")
+    $JAVA "${ZOOMAIN[@]}" 2>/dev/null
     ;;
-restart)
+  restart)
     shift
-    "$0" stop ${@}
+    "$0" stop "$@"
     sleep 3
-    "$0" start ${@}
+    "$0" start "$@"
     ;;
-status)
+  status)
     # -q is necessary on some versions of linux where nc returns too quickly, and no stat result is output
     isSSL="false"
-    clientPortAddress=`$GREP "^[[:space:]]*clientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
-    if ! [ $clientPortAddress ]
-    then
-	      clientPortAddress="localhost"
+    clientPortAddress=$($GREP "^[[:space:]]*clientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+    if [[ -z $clientPortAddress ]]; then
+      clientPortAddress="localhost"
     fi
-    clientPort=`$GREP "^[[:space:]]*clientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
-    if ! [[ "$clientPort"  =~ ^[0-9]+$ ]]
-    then
-      dataDir=`$GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//'`
-      myid=`cat "$dataDir/myid" 2> /dev/null`
-      if ! [[ "$myid" =~ ^[0-9]+$ ]] ; then
+    clientPort=$($GREP "^[[:space:]]*clientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+    if ! [[ $clientPort =~ ^[0-9]+$ ]]; then
+      dataDir=$($GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')
+      myid=$(cat "$dataDir/myid" 2>/dev/null)
+      if ! [[ $myid =~ ^[0-9]+$ ]]; then
         echo "myid could not be determined, will not able to locate clientPort in the server configs."
       else
-        clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$ZOOCFG" | sed -e 's/.*=//' | sed -e 's/.*;//'`
-        if [ ! "$clientPortAndAddress" ] ; then
+        clientPortAndAddress=$($GREP "^[[:space:]]*server.$myid=.*;.*" "$ZOOCFG" | sed -e 's/.*=//' | sed -e 's/.*;//')
+        if [[ -z $clientPortAndAddress ]]; then
           echo "Client port not found in static config file. Looking in dynamic config file."
-          dynamicConfigFile=`$GREP "^[[:space:]]*dynamicConfigFile" "$ZOOCFG" | sed -e 's/.*=//'`
-          clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$dynamicConfigFile" | sed -e 's/.*=//' | sed -e 's/.*;//'`
+          dynamicConfigFile=$($GREP "^[[:space:]]*dynamicConfigFile" "$ZOOCFG" | sed -e 's/.*=//')
+          clientPortAndAddress=$($GREP "^[[:space:]]*server.$myid=.*;.*" "$dynamicConfigFile" | sed -e 's/.*=//' | sed -e 's/.*;//')
         fi
-        if [ ! "$clientPortAndAddress" ] ; then
+        if [[ -z $clientPortAndAddress ]]; then
           echo "Client port not found in the server configs"
         else
-          if [[ "$clientPortAndAddress" =~ ^.*:[0-9]+ ]] ; then
-            if [[ "$clientPortAndAddress" =~ \[.*\]:[0-9]+ ]] ; then
-              # Extracts address from address:port for example extracts 127::1 from "[127::1]:2181"
-              clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's|\[||' | sed -e 's|\]:.*||'`
-            else
-              clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's/:.*//'`
-            fi
+          # Extracts address and port from address:port, even if address contains optional square braces
+          # For example, this extracts the address 127::1 and the port 2181 from "[127::1]:2181"
+          if [[ $clientPortAndAddress =~ ^\[?([^\]]*)\]?:([0-9]+) ]]; then
+            clientPortAddress=${BASH_REMATCH[1]}
+            clientPort=${BASH_REMATCH[2]}
+          elif [[ $clientPortAndAddress =~ ^[0-9]+$ ]]; then
+            clientPort=$clientPortAndAddress
           fi
-          clientPort=`echo "$clientPortAndAddress" | sed -e 's/.*://'`
         fi
       fi
     fi
-    if [ ! "$clientPort" ] ; then
+    if [[ -z $clientPort ]]; then
       echo "Client port not found. Looking for secureClientPort in the static config."
-      secureClientPort=`$GREP "^[[:space:]]*secureClientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
-      if [ "$secureClientPort" ] ; then
+      secureClientPort=$($GREP "^[[:space:]]*secureClientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+      if [[ -n $secureClientPort ]]; then
         isSSL="true"
         clientPort=$secureClientPort
-        clientPortAddress=`$GREP "^[[:space:]]*secureClientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
-        if ! [ $clientPortAddress ]
-        then
-            clientPortAddress="localhost"
+        clientPortAddress=$($GREP "^[[:space:]]*secureClientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+        if [[ -z $clientPortAddress ]]; then
+          clientPortAddress="localhost"
         fi
       else
         echo "Unable to find either secure or unsecure client port in any configs. Terminating."
@@ -290,31 +282,31 @@ status)
       fi
     fi
     echo "Client port found: $clientPort. Client address: $clientPortAddress. Client SSL: $isSSL."
-    STAT=`"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-          -cp "$CLASSPATH" $CLIENT_JVMFLAGS $JVMFLAGS org.apache.zookeeper.client.FourLetterWordMain \
-          $clientPortAddress $clientPort srvr $isSSL 2> /dev/null    \
-          | $GREP Mode`
-    if [ "x$STAT" = "x" ]
-    then
-      if [ "$isSSL" = "true" ] ; then
+    STAT=$("$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+      "${clientflags[@]}" "${flags[@]}" org.apache.zookeeper.client.FourLetterWordMain \
+      "$clientPortAddress" "$clientPort" srvr "$isSSL" 2>/dev/null |
+      $GREP Mode)
+    if [[ -z $STAT ]]; then
+      if [[ $isSSL == "true" ]]; then
         echo " "
         echo "Note: We used secureClientPort ($secureClientPort) to establish connection, but we failed. The 'status'"
         echo "  command establishes a client connection to the server to execute diagnostic commands. Please make sure you"
         echo "  provided all the Client SSL connection related parameters in the CLIENT_JVMFLAGS environment variable! E.g.:"
-        echo "  CLIENT_JVMFLAGS=\"-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty"
+        echo '  CLIENT_JVMFLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty'
         echo "  -Dzookeeper.ssl.trustStore.location=/tmp/clienttrust.jks -Dzookeeper.ssl.trustStore.password=password"
         echo "  -Dzookeeper.ssl.keyStore.location=/tmp/client.jks -Dzookeeper.ssl.keyStore.password=password"
-        echo "  -Dzookeeper.client.secure=true\" ./zkServer.sh status"
+        echo '  -Dzookeeper.client.secure=true" ./zkServer.sh status'
         echo " "
       fi
       echo "Error contacting service. It is probably not running."
       exit 1
     else
-      echo $STAT
+      echo "$STAT"
       exit 0
     fi
     ;;
-*)
+  *)
     echo "Usage: $0 [--config <conf-dir>] {start|start-foreground|stop|version|restart|status|print-cmd}" >&2
+    ;;
 
 esac
diff --git a/bin/zkSnapShotToolkit.sh b/bin/zkSnapShotToolkit.sh
index 1664d596f37..dd256c366f3 100755
--- a/bin/zkSnapShotToolkit.sh
+++ b/bin/zkSnapShotToolkit.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,16 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.SnapshotFormatter "$@"
-
-
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.SnapshotFormatter "$@"
diff --git a/bin/zkSnapshotComparer.sh b/bin/zkSnapshotComparer.sh
index b284c902d39..0167fdb116a 100755
--- a/bin/zkSnapshotComparer.sh
+++ b/bin/zkSnapshotComparer.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,14 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.SnapshotComparer "$@"
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.SnapshotComparer "$@"
diff --git a/bin/zkSnapshotRecursiveSummaryToolkit.sh b/bin/zkSnapshotRecursiveSummaryToolkit.sh
index 888fdc01138..8b5ee45aab2 100755
--- a/bin/zkSnapshotRecursiveSummaryToolkit.sh
+++ b/bin/zkSnapshotRecursiveSummaryToolkit.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,17 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
-  # shellcheck source=/bin/zkEnv.sh
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.SnapshotRecursiveSummary "$@"
-
-
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.SnapshotRecursiveSummary "$@"
diff --git a/bin/zkTxnLogToolkit.sh b/bin/zkTxnLogToolkit.sh
index 8beed20ddd7..0381ffa0227 100755
--- a/bin/zkTxnLogToolkit.sh
+++ b/bin/zkTxnLogToolkit.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,16 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.persistence.TxnLogToolkit "$@"
-
-
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.persistence.TxnLogToolkit "$@"
diff --git a/dev/docker/run.sh b/dev/docker/run.sh
index 901131046ff..10c40c5ff8e 100755
--- a/dev/docker/run.sh
+++ b/dev/docker/run.sh
@@ -1,52 +1,55 @@
-#!/bin/bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 set -e -x -u
 
-SCRIPT_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 
 export IMAGE_NAME="zookeeper/dev"
 
-pushd ${SCRIPT_DIR}
+pushd "$SCRIPT_DIR"
 
-docker build --rm=true -t ${IMAGE_NAME} .
+docker build --rm=true -t "$IMAGE_NAME" .
 
 popd
 
-if [ "$(uname -s)" == "Linux" ]; then
+if [[ "$(uname -s)" == "Linux" ]]; then
   USER_NAME=${SUDO_USER:=$USER}
-  USER_ID=$(id -u "${USER_NAME}")
-  GROUP_ID=$(id -g "${USER_NAME}")
+  USER_ID=$(id -u "$USER_NAME")
+  GROUP_ID=$(id -g "$USER_NAME")
   LOCAL_HOME=$(realpath ~)
 else # boot2docker uid and gid
   USER_NAME=$USER
   USER_ID=1000
   GROUP_ID=50
-  LOCAL_HOME="/Users/${USER_NAME}"
+  LOCAL_HOME="/Users/$USER_NAME"
 fi
 
-docker build -t "${IMAGE_NAME}-${USER_NAME}" - <<UserSpecificDocker
-FROM ${IMAGE_NAME}
-RUN groupadd --non-unique -g ${GROUP_ID} ${USER_NAME} && \
-  useradd -g ${GROUP_ID} -u ${USER_ID} -k /root -m ${USER_NAME}
-ENV  HOME /home/${USER_NAME}
+docker build -t "$IMAGE_NAME-$USER_NAME" - <<UserSpecificDocker
+FROM $IMAGE_NAME
+RUN groupadd --non-unique -g $GROUP_ID $USER_NAME && \
+  useradd -g $GROUP_ID -u $USER_ID -k /root -m $USER_NAME
+ENV  HOME /home/$USER_NAME
 UserSpecificDocker
 
-ZOOKEEPER_ROOT=${SCRIPT_DIR}/../..
+ZOOKEEPER_ROOT="$SCRIPT_DIR/../.."
 
 CMD="
 echo
@@ -57,16 +60,15 @@ echo
 bash
 "
 
-pushd ${ZOOKEEPER_ROOT}
+pushd "$ZOOKEEPER_ROOT"
 
 docker run -i -t \
   --rm=true \
-  -w ${ZOOKEEPER_ROOT} \
-  -u "${USER}" \
-  -v "$(realpath $ZOOKEEPER_ROOT):${ZOOKEEPER_ROOT}" \
-  -v "${LOCAL_HOME}:/home/${USER_NAME}" \
-  ${IMAGE_NAME}-${USER_NAME} \
-  bash -c "${CMD}"
+  -w "$ZOOKEEPER_ROOT" \
+  -u "$USER" \
+  -v "$(realpath "$ZOOKEEPER_ROOT"):$ZOOKEEPER_ROOT" \
+  -v "$LOCAL_HOME:/home/$USER_NAME" \
+  "$IMAGE_NAME-$USER_NAME" \
+  bash -c "$CMD"
 
 popd
-
diff --git a/pom.xml b/pom.xml
index 128295182bf..fde5aa9e098 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1063,6 +1063,7 @@
       <plugin>
         <groupId>org.apache.rat</groupId>
         <artifactId>apache-rat-plugin</artifactId>
+        <version>0.15</version>
         <configuration>
           <excludes>
             <exclude>**/README.md</exclude>
diff --git a/tools/ci/install-shfmt.sh b/tools/ci/install-shfmt.sh
new file mode 100755
index 00000000000..fd73efc3c6c
--- /dev/null
+++ b/tools/ci/install-shfmt.sh
@@ -0,0 +1,29 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Install shfmt tool to search for and optionally format bash scripts
+# This is useful for other CI tools to run ShellCheck and shfmt to format
+
+set -e
+set -x
+
+shfmt_version=3.4.3
+sudo wget "https://github.com/mvdan/sh/releases/download/v${shfmt_version}/shfmt_v${shfmt_version}_linux_amd64" -O /usr/local/bin/shfmt &&
+  sudo chmod +x /usr/local/bin/shfmt
diff --git a/tools/ci/run-shellcheck.sh b/tools/ci/run-shellcheck.sh
new file mode 100755
index 00000000000..5d6ca75d2d7
--- /dev/null
+++ b/tools/ci/run-shellcheck.sh
@@ -0,0 +1,28 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Run ShellCheck on all bash scripts
+
+set -e
+
+mapfile -t filestocheck < <(shfmt -f .)
+
+set -x
+shellcheck -P SCRIPTDIR -x "${filestocheck[@]}"
diff --git a/tools/ci/run-shfmt.sh b/tools/ci/run-shfmt.sh
new file mode 100755
index 00000000000..233df9aff49
--- /dev/null
+++ b/tools/ci/run-shfmt.sh
@@ -0,0 +1,26 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Check formatting of all bash scripts
+
+set -e
+set -x
+
+shfmt -ln bash -l -d -i 2 -ci -s .
diff --git a/tools/sonar/code-coverage.sh b/tools/sonar/code-coverage.sh
index 3ff55c77795..4dfe4eea11a 100755
--- a/tools/sonar/code-coverage.sh
+++ b/tools/sonar/code-coverage.sh
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#! /usr/bin/env bash
+#
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -7,13 +8,15 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 usage() {
   echo
@@ -34,7 +37,7 @@ usage() {
 
 execute() {
   SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
-  MAIN_POM="${SCRIPT_DIR}/../../pom.xml"
+  MAIN_POM="$SCRIPT_DIR/../../pom.xml"
 
   mvn -B -e -Pclover -f "$MAIN_POM" clean install -DskipTests -DskipShade
 
@@ -43,7 +46,7 @@ execute() {
   mvn -B -e -Pclover -f "$MAIN_POM" clover:aggregate clover:clover
 
   # If the required parameters are given, the code coverage results are uploaded to the SonarQube Server
-  if [ -n "$SONAR_LOGIN" ] && [ -n "$SONAR_PROJECT_KEY" ] && [ -n "$SONAR_URL" ]; then
+  if [[ -n $SONAR_LOGIN ]] && [[ -n $SONAR_PROJECT_KEY ]] && [[ -n $SONAR_URL ]]; then
     mvn -B -e -Pclover -f "$MAIN_POM" sonar:sonar -Dsonar.clover.reportPath=./target/clover/clover.xml \
       -Dsonar.host.url="$SONAR_URL" -Dsonar.login="$SONAR_LOGIN" -Dsonar.projectKey="$SONAR_PROJECT_KEY" -Dsonar.projectName="$SONAR_PROJECT_NAME"
   fi
@@ -51,18 +54,18 @@ execute() {
 
 while getopts ":u:l:k:n:h" option; do
   case $option in
-  u) SONAR_URL=${OPTARG:-} ;;
-  l) SONAR_LOGIN=${OPTARG:-} ;;
-  k) SONAR_PROJECT_KEY=${OPTARG:-} ;;
-  n) SONAR_PROJECT_NAME=${OPTARG:-} ;;
-  h) # Display usage
-    usage
-    exit
-    ;;
-  \?) # Invalid option
-    echo "Error: Invalid option"
-    exit
-    ;;
+    u) SONAR_URL=${OPTARG:-} ;;
+    l) SONAR_LOGIN=${OPTARG:-} ;;
+    k) SONAR_PROJECT_KEY=${OPTARG:-} ;;
+    n) SONAR_PROJECT_NAME=${OPTARG:-} ;;
+    h) # Display usage
+      usage
+      exit
+      ;;
+    \?) # Invalid option
+      echo "Error: Invalid option"
+      exit
+      ;;
   esac
 done
 
diff --git a/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh b/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh
index f32cf5895bd..cbe8199ea59 100755
--- a/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh
+++ b/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # This script cleans up old transaction logs and snapshots
@@ -25,12 +28,11 @@
 # relative to the canonical path of this script.
 #
 
-
 # determining the domain name in the certificates:
 # - use the first commandline argument, if present
 # - if not, then use the fully qualified domain name
 # - if `hostname` command fails, fall back to zookeeper.apache.org
-FQDN=`hostname -f`
+FQDN=$(hostname -f)
 FQDN=${1:-$FQDN}
 FQDN=${FQDN:-"zookeeper.apache.org"}
 
@@ -39,7 +41,7 @@ openssl genrsa -out rootkey.pem 2048
 
 #Generate the root Cert
 openssl req -x509 -new -key rootkey.pem -out root.crt -config <(
-cat <<-EOF
+  cat <<-EOF
 [ req ]
 default_bits = 2048
 prompt = no
@@ -61,7 +63,7 @@ openssl genrsa -out clientkey.pem 2048
 
 #Generate Client Cert
 openssl req -new -key clientkey.pem -out client.csr -config <(
-cat <<-EOF
+  cat <<-EOF
 [ req ]
 default_bits = 2048
 prompt = no
@@ -92,7 +94,7 @@ openssl genrsa -out serverkey.pem 2048
 
 #Generate Server Cert
 openssl req -new -key serverkey.pem -out server.csr -config <(
-cat <<-EOF
+  cat <<-EOF
 [ req ]
 default_bits = 2048
 prompt = no
@@ -116,7 +118,6 @@ openssl pkcs12 -export -in server.crt -inkey serverkey.pem -out server.pkcs12 -p
 # Import Keystore in JKS
 keytool -importkeystore -srckeystore server.pkcs12 -destkeystore server.jks -srcstoretype pkcs12 -srcstorepass password -deststorepass password
 
-
 keytool -importcert -keystore server.jks -file root.crt -storepass password -noprompt
 
 keytool -importcert -alias ca -file root.crt -keystore clienttrust.jks -storepass password -noprompt
diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index 7505bf3a8f7..5fb6d99ae1e 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,13 +8,15 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 # This is the port where zookeeper server runs on.
 ZOOPORT=${ZOOPORT:-"22181"}
@@ -24,239 +26,202 @@ ZKMAXCNXNS=${ZKMAXCNXNS:-"100"}
 
 EXTRA_JVM_ARGS=${EXTRA_JVM_ARGS:-""}
 
-if [ "x$1" == "x" ]
-then
-    echo "USAGE: $0 startClean|start|startCleanReadOnly|startRequireSASLAuth [jaasConf] [readOnly]|stop"
-    exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|startCleanReadOnly|startRequireSASLAuth [jaasConf] [readOnly]|stop"
+  exit 2
 fi
 
-
-
-
 # =====
 # ===== cleanup old executions
 # =====
 
-case "`uname`" in
-    CYGWIN*) cygwin=true ;;
-    *) cygwin=false ;;
+case "$(uname)" in
+  CYGWIN* | MINGW*) cygwin=true ;;
+  *) cygwin=false ;;
 esac
 
-
-if $cygwin
-then
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
+if $cygwin; then
+  # cygwin has a "kill" in the shell itself, gets confused
+  KILL='/bin/kill'
 else
-    KILL=kill
+  KILL='kill'
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-$KILL -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  $KILL -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
-if [ -r "${base_dir}/build/tmp/zk.pid" ]
-then
-pid=`cat "${base_dir}/build/tmp/zk.pid"`
-$KILL -9 $pid
-rm -f "${base_dir}/build/tmp/zk.pid"
+if [[ -r "$base_dir/build/tmp/zk.pid" ]]; then
+  pid=$(cat "$base_dir/build/tmp/zk.pid")
+  $KILL -9 "$pid"
+  rm -f "$base_dir/build/tmp/zk.pid"
 fi
 
 # [ZOOKEEPER-820] If lsof command is present, look for a process listening
-# on ZOOPORT and kill it. 
-which lsof &> /dev/null
-if [ $? -eq 0  ]
-then
-    pid=`lsof -i :$ZOOPORT | grep LISTEN | awk '{print $2}'`
-    if [ -n "$pid" ]
-    then
-        $KILL -9 $pid
-    fi
+# on ZOOPORT and kill it.
+if which lsof &>/dev/null; then
+  pid=$(lsof -i ":$ZOOPORT" | grep LISTEN | awk '{print $2}')
+  if [[ -n $pid ]]; then
+    $KILL -9 "$pid"
+  fi
 fi
 
-
-
 # =====
 # ===== build classpath
 # =====
 
-if [ "x${base_dir}" == "x" ]
-then
-zk_base="../../../"
+if [[ -z $base_dir ]]; then
+  zk_base="../../../"
 else
-zk_base="${base_dir}"
+  zk_base="$base_dir"
 fi
 
-CLASSPATH="$CLASSPATH:${zk_base}/build/classes"
-CLASSPATH="$CLASSPATH:${zk_base}/conf"
-CLASSPATH="$CLASSPATH:${zk_base}/zookeeper-server/target/classes"
+CLASSPATH="$CLASSPATH:$zk_base/build/classes"
+CLASSPATH="$CLASSPATH:$zk_base/conf"
+CLASSPATH="$CLASSPATH:$zk_base/zookeeper-server/target/classes"
 
-for i in "${zk_base}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for d in "${zk_base}"/zookeeper-server/target/lib/*.jar
-do
-    CLASSPATH="$d:$CLASSPATH"
+for d in "$zk_base"/zookeeper-server/target/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
-for i in "${zk_base}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-CLASSPATH="$CLASSPATH:${CLOVER_HOME}/lib/clover*.jar"
+CLASSPATH="$CLASSPATH:$CLOVER_HOME/lib/clover*.jar"
 
-if $cygwin
-then
-    CLASSPATH=`cygpath -wp "$CLASSPATH"`
+if $cygwin; then
+  CLASSPATH=$(cygpath -wp "$CLASSPATH")
 fi
-
-
+export CLASSPATH
 
 # =====
 # ===== initialize JVM arguments
 # =====
 
 read_only=
-PROPERTIES="$EXTRA_JVM_ARGS -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100"
-if [ "x$1" == "xstartRequireSASLAuth" ]
-then
-    PROPERTIES="-Dzookeeper.sessionRequireClientSASLAuth=true $PROPERTIES"
-    PROPERTIES="$PROPERTIES -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
-    if [ "x$2" != "x" ]
-    then
-        PROPERTIES="$PROPERTIES -Djava.security.auth.login.config=$2"
-    fi
-    if [ "x$3" != "x" ]
-    then
-        PROPERTIES="-Dreadonlymode.enabled=true $PROPERTIES"
-        read_only=true
-    fi
-fi
-if [ "x$1" == "xstartCleanReadOnly" ]
-then
-    PROPERTIES="-Dreadonlymode.enabled=true $PROPERTIES"
+# shellcheck disable=SC2206
+PROPERTIES=($EXTRA_JVM_ARGS "-Dzookeeper.extendedTypesEnabled=true" "-Dznode.container.checkIntervalMs=100")
+if [[ $1 == "xstartRequireSASLAuth" ]]; then
+  PROPERTIES=("-Dzookeeper.sessionRequireClientSASLAuth=true" "${PROPERTIES[@]}"
+    "-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider")
+  if [[ -n $2 ]]; then
+    PROPERTIES=("${PROPERTIES[@]}" "-Djava.security.auth.login.config=$2")
+  fi
+  if [[ -n $3 ]]; then
+    PROPERTIES=("-Dreadonlymode.enabled=true" "${PROPERTIES[@]}")
     read_only=true
+  fi
+fi
+if [[ $1 == "startCleanReadOnly" ]]; then
+  PROPERTIES=("-Dreadonlymode.enabled=true" "${PROPERTIES[@]}")
+  read_only=true
 fi
-
-
 
 # =====
 # ===== initialize data and test directories
 # =====
 
-if [ "x${base_dir}" == "x" ]
-then
-    tmp_dir="/tmp"
-    tests_dir="tests"
+if [[ -z $base_dir ]]; then
+  tmp_dir="/tmp"
+  tests_dir="tests"
 else
-    tmp_dir="${base_dir}/build/tmp"
-    tests_dir=${base_dir}/zookeeper-client/zookeeper-client-c/tests
+  tmp_dir="$base_dir/build/tmp"
+  tests_dir=$base_dir/zookeeper-client/zookeeper-client-c/tests
 fi
 
-
-
-
 # =====
 # ===== start the ZooKeeper server
 # =====
 
 case $1 in
-start|startClean|startRequireSASLAuth|startCleanReadOnly)
+  start | startClean | startRequireSASLAuth | startCleanReadOnly)
 
-    if [ "x$1" == "xstartClean" ] || [ "x$1" == "xstartCleanReadOnly" ]
-    then
-        rm -rf "${tmp_dir}/zkdata"
+    if [[ $1 == "startClean" ]] || [[ $1 == "startCleanReadOnly" ]]; then
+      rm -rf "$tmp_dir/zkdata"
     fi
-    mkdir -p "${tmp_dir}/zkdata"
-
+    mkdir -p "$tmp_dir/zkdata"
 
     # ===== initialize certificates
     certs_dir="/tmp/certs"
-    rm -rf "${certs_dir}"
-    mkdir -p "${certs_dir}"
-    cp ${tests_dir}/../ssl/gencerts.sh "${certs_dir}/"  > /dev/null
-    cd ${certs_dir} > /dev/null
-    # GitHub is providing us hostnames with more than 64 characters now.
-    # And there are no cppunit tests do hostname verification currently,
-    # so we could set CN to arbitrary hostname for now.
-    ./gencerts.sh tests.zookeeper.apache.org > ./gencerts.stdout 2> ./gencerts.stderr
-    cd - > /dev/null
-
+    rm -rf "$certs_dir"
+    mkdir -p "$certs_dir"
+    cp "$tests_dir"/../ssl/gencerts.sh "$certs_dir/" >/dev/null
+    (
+      cd "$certs_dir" >/dev/null &&
+        # GitHub is providing us hostnames with more than 64 characters now.
+        # And there are no cppunit tests do hostname verification currently,
+        # so we could set CN to arbitrary hostname for now.
+        ./gencerts.sh tests.zookeeper.apache.org >./gencerts.stdout 2>./gencerts.stderr
+    )
 
     # ===== prepare the configs
-    sed "s#TMPDIR#${tmp_dir}#g;s#CERTDIR#${certs_dir}#g;s#MAXCLIENTCONNECTIONS#${ZKMAXCNXNS}#g;s#CLIENTPORT#${ZOOPORT}#g" ${tests_dir}/zoo.cfg > "${tmp_dir}/zoo.cfg"
-    if [ "x$read_only" != "x" ]
-    then
-        # we can put the new server to read-only mode by starting only a single instance of a three node server
-        echo "server.1=localhost:22881:33881" >> ${tmp_dir}/zoo.cfg
-        echo "server.2=localhost:22882:33882" >> ${tmp_dir}/zoo.cfg
-        echo "server.3=localhost:22883:33883" >> ${tmp_dir}/zoo.cfg
-        echo "1" > ${tmp_dir}/zkdata/myid
-        main_class="org.apache.zookeeper.server.quorum.QuorumPeerMain"
+    sed "s#TMPDIR#$tmp_dir#g;s#CERTDIR#$certs_dir#g;s#MAXCLIENTCONNECTIONS#$ZKMAXCNXNS#g;s#CLIENTPORT#$ZOOPORT#g" "$tests_dir/zoo.cfg" >"$tmp_dir/zoo.cfg"
+    if [[ -n $read_only ]]; then
+      # we can put the new server to read-only mode by starting only a single instance of a three node server
+      {
+        echo "server.1=localhost:22881:33881"
+        echo "server.2=localhost:22882:33882"
+        echo "server.3=localhost:22883:33883"
+      } >>"$tmp_dir/zoo.cfg"
+      echo "1" >"$tmp_dir/zkdata/myid"
+      main_class="org.apache.zookeeper.server.quorum.QuorumPeerMain"
     else
-        main_class="org.apache.zookeeper.server.ZooKeeperServerMain"
+      main_class="org.apache.zookeeper.server.ZooKeeperServerMain"
     fi
 
-
     # ===== start the server
-    java -cp "$CLASSPATH" $PROPERTIES ${main_class} ${tmp_dir}/zoo.cfg &> "${tmp_dir}/zk.log" &
+    java "${PROPERTIES[@]}" "$main_class" "$tmp_dir/zoo.cfg" &>"$tmp_dir/zk.log" &
     pid=$!
-    echo -n $! > /tmp/zk.pid
-
+    echo -n $! >/tmp/zk.pid
 
     # ===== wait for the server to start
-    if [ "x$1" == "xstartRequireSASLAuth" ] || [ "x$1" == "xstartCleanReadOnly" ]
-    then
-       # ===== in these cases we can not connect simply with the java client, so we are just waiting...
-       sleep 4
-       success=true
+    if [[ $1 == "startRequireSASLAuth" ]] || [[ $1 == "startCleanReadOnly" ]]; then
+      # ===== in these cases we can not connect simply with the java client, so we are just waiting...
+      sleep 4
+      success=true
     else
-        # ===== wait max 120 seconds for server to be ready to server clients (this handles testing on slow hosts)
-        success=false
-        for i in {1..120}
-        do
-            if ps -p $pid > /dev/null
-            then
-                java -cp "$CLASSPATH" $PROPERTIES org.apache.zookeeper.ZooKeeperMain -server localhost:$ZOOPORT ls / > /dev/null 2>&1
-                if [ $? -ne 0  ]
-                then
-                    # server not up yet - wait
-                    sleep 1
-                else
-                    # server is up and serving client connections
-                    success=true
-                    break
-                fi
-            else
-                # server died - exit now
-                echo -n " ZooKeeper server process failed"
-                break
-            fi
-        done
+      # ===== wait max 120 seconds for server to be ready to server clients (this handles testing on slow hosts)
+      success=false
+      for i in {1..120}; do
+        if ps -p $pid >/dev/null; then
+          if ! java "${PROPERTIES[@]}" org.apache.zookeeper.ZooKeeperMain -server "localhost:$ZOOPORT" ls / &>/dev/null; then
+            # server not up yet - wait
+            sleep 1
+          else
+            # server is up and serving client connections
+            success=true
+            break
+          fi
+        else
+          # server died - exit now
+          echo -n " ZooKeeper server process failed"
+          break
+        fi
+      done
     fi
 
-    if $success
-    then
-        ## in case for debug, but generally don't use as it messes up the
-        ## console test output
-        echo -n " ZooKeeper server started"
+    if $success; then
+      ## in case for debug, but generally don't use as it messes up the
+      ## console test output
+      echo -n " ZooKeeper server started"
     else
-        echo -n " ZooKeeper server NOT started"
+      echo -n " ZooKeeper server NOT started"
     fi
 
     ;;
-stop)
+  stop)
     # Already killed above
     ;;
-*)
-    echo "Unknown command " + $1
+  *)
+    echo "Unknown command $1"
     exit 2
+    ;;
 esac
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
index cc1d16c6d22..de5b8770987 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
@@ -1,38 +1,48 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
-make_canonical () {
-    cd $1; pwd;
+make_canonical() {
+  cd "$1" && pwd
 }
 
-SCRIPTDIR=`dirname $0`
-BUILDDIR=`make_canonical $SCRIPTDIR/../../../target/`
-LIBDIR=`make_canonical $BUILDDIR/../lib`
-WEBDIR=`make_canonical $SCRIPTDIR/../web`
+SCRIPTDIR=$(dirname "$0")
+BUILDDIR=$(make_canonical "$SCRIPTDIR"/../../../target/)
+LIBDIR=$(make_canonical "$BUILDDIR"/../lib)
+WEBDIR=$(make_canonical "$SCRIPTDIR"/../web)
 
-if [ ! -x $BUILDDIR ]; then
-    echo "\n\n*** You need to build loggraph before running it ***\n\n";
-    exit;
+if [[ ! -x $BUILDDIR ]]; then
+  echo
+  echo
+  echo "*** You need to build loggraph before running it ***"
+  echo
+  echo
+  exit
 fi
 
-for i in `ls $LIBDIR`; do 
-    CLASSPATH=$LIBDIR/$i:$CLASSPATH
+for i in "$LIBDIR"/*; do
+  CLASSPATH=$i:$CLASSPATH
 done
 
 CLASSPATH=$BUILDDIR/classes:$WEBDIR:$CLASSPATH
-echo $CLASSPATH
-java -Dlogback.configurationFile=org/apache/zookeeper/graph/logback.xml -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
+export CLASSPATH
+
+java -Dlogback.configurationFile=org/apache/zookeeper/graph/logback.xml \
+  -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n \
+  org.apache.zookeeper.graph.LogServer "$@"
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
index 9b327432bd1..868fb7cc30e 100755
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
+++ b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
@@ -1,43 +1,43 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
-make_canonical () {
-    cd $1; pwd;
+make_canonical() {
+  cd "$1" && pwd
 }
 
-SCRIPTDIR=`dirname $0`
-BUILDDIR=`make_canonical $SCRIPTDIR/../../../target/`
-LIBDIR=`make_canonical $BUILDDIR/../lib`
-
-if [ ! -x $BUILDDIR ]; then
-    echo "\n\n*** You need to build loggraph before running it ***\n\n";
-    exit;
+SCRIPTDIR=$(dirname "$0")
+BUILDDIR=$(make_canonical "$SCRIPTDIR"/../../../target/)
+LIBDIR=$(make_canonical "$BUILDDIR"/../lib)
+
+if [[ ! -x $BUILDDIR ]]; then
+  echo
+  echo
+  echo "*** You need to build loggraph before running it ***"
+  echo
+  echo
+  exit
 fi
 
-for i in `ls $LIBDIR`; do 
-    CLASSPATH=$LIBDIR/$i:$CLASSPATH
-done
-
-for i in `ls $BUILDDIR/*.jar`; do 
-    CLASSPATH=$i:$CLASSPATH
+for i in "$LIBDIR"/* "$BUILDDIR"/*.jar; do
+  CLASSPATH=$i:$CLASSPATH
 done
+export CLASSPATH
 
-java -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
-
-
-
-
+java org.apache.zookeeper.graph.LogServer "$@"
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/rest.sh b/zookeeper-contrib/zookeeper-contrib-rest/rest.sh
old mode 100644
new mode 100755
index daa819836e2..efbf0126ef1
--- a/zookeeper-contrib/zookeeper-contrib-rest/rest.sh
+++ b/zookeeper-contrib/zookeeper-contrib-rest/rest.sh
@@ -1,19 +1,22 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -22,24 +25,27 @@
 #
 
 # Only follow symlinks if readlink supports it
-if readlink -f "$0" > /dev/null 2>&1
-then
-  ZKREST=`readlink -f "$0"`
+if readlink -f "$0" &>/dev/null; then
+  ZKREST=$(readlink -f "$0")
 else
   ZKREST="$0"
 fi
-ZKREST_HOME=`dirname "$ZKREST"`
+ZKREST_HOME=$(dirname "$ZKREST")
 
-if $cygwin
-then
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
+case "$(uname)" in
+  CYGWIN* | MINGW*) cygwin=true ;;
+  *) cygwin=false ;;
+esac
+
+if $cygwin; then
+  # cygwin has a "kill" in the shell itself, gets confused
+  KILL='/bin/kill'
 else
-    KILL=kill
+  KILL='kill'
 fi
 
-if [ -z $ZKREST_PIDFILE ]
-    then ZKREST_PIDFILE=$ZKREST_HOME/server.pid
+if [[ -z $ZKREST_PIDFILE ]]; then
+  ZKREST_PIDFILE=$ZKREST_HOME/server.pid
 fi
 
 ZKREST_MAIN=org.apache.zookeeper.server.jersey.RestMain
@@ -49,42 +55,43 @@ ZKREST_LOG=$ZKREST_HOME/zkrest.log
 
 CLASSPATH="$ZKREST_CONF:$CLASSPATH"
 
-for i in "$ZKREST_HOME"/lib/*.jar
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "$ZKREST_HOME"/lib/*.jar; do
+  CLASSPATH="$i:$CLASSPATH"
 done
 
-for i in "$ZKREST_HOME"/zookeeper-*.jar
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "$ZKREST_HOME"/zookeeper-*.jar; do
+  CLASSPATH="$i:$CLASSPATH"
 done
+export CLASSPATH
 
 case $1 in
-start)
-    echo  "Starting ZooKeeper REST Gateway ... "
-    java  -cp "$CLASSPATH" $JVMFLAGS $ZKREST_MAIN >$ZKREST_LOG 2>&1 &
-    /bin/echo -n $! > "$ZKREST_PIDFILE"
+  start)
+    echo "Starting ZooKeeper REST Gateway ... "
+    # shellcheck disable=SC2206
+    flags=($JVMFLAGS)
+    java "${flags[@]}" "$ZKREST_MAIN" &>"$ZKREST_LOG" &
+    echo -n $! >"$ZKREST_PIDFILE"
     echo STARTED
     ;;
-stop)
+  stop)
     echo "Stopping ZooKeeper REST Gateway ... "
-    if [ ! -f "$ZKREST_PIDFILE" ]
-    then
-    echo "error: could not find file $ZKREST_PIDFILE"
-    exit 1
+    if [[ ! -f $ZKREST_PIDFILE ]]; then
+      echo "error: could not find file $ZKREST_PIDFILE"
+      exit 1
     else
-    $KILL -9 $(cat "$ZKREST_PIDFILE")
-    rm "$ZKREST_PIDFILE"
-    echo STOPPED
+      $KILL -9 "$(cat "$ZKREST_PIDFILE")"
+      rm "$ZKREST_PIDFILE"
+      echo STOPPED
     fi
     ;;
-restart)
+  restart)
     shift
-    "$0" stop ${@}
+    "$0" stop "$@"
     sleep 3
-    "$0" start ${@}
+    "$0" start "$@"
     ;;
-*)
+  *)
     echo "Usage: $0 {start|stop|restart}" >&2
+    ;;
 
 esac
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh b/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh
index 4279d34265f..4272130173a 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh
+++ b/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,84 +8,78 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
-if [ "x$1" == "x" ]
-then
-    echo "USAGE: $0 startClean|start|stop hostPorts"
-    exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop hostPorts"
+  exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
-then
-    if [ "x${base_dir}" == "x" ]
-    then
+if [[ $1 == "startClean" ]]; then
+  if [[ -z $base_dir ]]; then
     rm -rf /tmp/zkdata
-    else
-    rm -rf ${base_dir}/build/tmp
-    fi
+  else
+    rm -rf "$base_dir/build/tmp"
+  fi
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-kill -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  kill -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
-if [ -r "${base_dir}/build/tmp/zk.pid" ]
-then
-pid=`cat ${base_dir}/build/tmp/zk.pid`
-kill -9 $pid
-rm -f ${base_dir}/build/tmp/zk.pid
+if [[ -r "$base_dir/build/tmp/zk.pid" ]]; then
+  pid=$(cat "$base_dir/build/tmp/zk.pid")
+  kill -9 "$pid"
+  rm -f "$base_dir/build/tmp/zk.pid"
 fi
 
-if [ "x${base_dir}" == "x" ]	
-then
-zk_base="../../../"
+if [[ -z $base_dir ]]; then
+  zk_base="../../../"
 else
-zk_base="${base_dir}"
+  zk_base="$base_dir"
 fi
 
-CLASSPATH="$CLASSPATH:${zk_base}/build/classes"
-CLASSPATH="$CLASSPATH:${zk_base}/conf"
+CLASSPATH="$CLASSPATH:$zk_base/build/classes"
+CLASSPATH="$CLASSPATH:$zk_base/conf"
 
-for i in "${zk_base}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${zk_base}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
+export CLASSPATH
 
 case $1 in
-start|startClean)
-    if [ "x${base_dir}" == "x" ]
-        then
-        mkdir -p /tmp/zkdata
-        java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22182 /tmp/zkdata &> /tmp/zk.log &
-        echo $! > /tmp/zk.pid
-        else
-        mkdir -p ${base_dir}/build/tmp/zkdata
-        java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22182 ${base_dir}/build/tmp/zkdata &> ${base_dir}/build/tmp/zk.log &
-        echo $! > ${base_dir}/build/tmp/zk.pid
+  start | startClean)
+    if [[ -z $base_dir ]]; then
+      mkdir -p /tmp/zkdata
+      java org.apache.zookeeper.server.ZooKeeperServerMain 22182 /tmp/zkdata &>/tmp/zk.log &
+      echo $! >/tmp/zk.pid
+    else
+      mkdir -p "$base_dir/build/tmp/zkdata"
+      java org.apache.zookeeper.server.ZooKeeperServerMain 22182 "$base_dir/build/tmp/zkdata" &>"$base_dir/build/tmp/zk.log" &
+      echo $! >"$base_dir/build/tmp/zk.pid"
     fi
-        sleep 5
+    sleep 5
     ;;
-stop)
+  stop)
     # Already killed above
     ;;
-*)
-    echo "Unknown command " + $1
+  *)
+    echo "Unknown command $1"
     exit 2
+    ;;
 esac
-
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
index 232359b16e0..c7c0fdbdb04 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
@@ -1,20 +1,22 @@
-#!/bin/sh
+#! /usr/bin/env bash
 #
-#  Licensed to the Apache Software Foundation (ASF) under one
+# Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
 # regarding copyright ownership.  The ASF licenses this file
 # to you under the Apache License, Version 2.0 (the
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
-
-#     http://www.apache.org/licenses/LICENSE-2.0
-
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
 
 # Usage: run_tests.sh testdir [logdir]
 # logdir is optional, defaults to cwd
@@ -25,19 +27,21 @@ set -e
 ARGC=$#
 
 # check to make sure enough arguments were given or exit
-if [ $ARGC -lt 2 ]; then
-    export ZKPY_LOG_DIR="."
+if [[ $ARGC -eq 1 ]]; then
+  export ZKPY_LOG_DIR="."
+elif [[ $ARGC -eq 2 ]]; then
+  export ZKPY_LOG_DIR=$2
 else
-    export ZKPY_LOG_DIR=$2
+  echo "Usage: $0 testdir [logdir]" 1>&2
+  exit 1
 fi
 
 # Find the build directory containing zookeeper.so
-SO_PATH=`find ./target/ -name 'zookeeper*.so' | head -1`
-PYTHONPATH=`dirname $SO_PATH`
+SO_PATH=$(find ./target/ -name 'zookeeper*.so' | head -1)
+PYTHONPATH=$(dirname "$SO_PATH")
 LIB_PATH=../../zookeeper-client/zookeeper-client-c/target/c/.libs
-for test in `ls $1/*_test.py`; 
-do
-    echo "Running $test"
-    echo "Running LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test"
-    LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test
+for test in "$1"/*_test.py; do
+  echo "Running $test"
+  echo "Running LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test"
+  LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python "$test"
 done
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
index 3b6ed37fc12..a8049fd6794 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,95 +8,82 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
-if [ "x$1" == "x" ]
-then
-    echo "USAGE: $0 startClean|start|stop"
-    exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop"
+  exit 2
 fi
 
-if [ "x${base_dir}" == "x" ]
-then
+if [[ -n $base_dir ]]; then
   PROJECT_ROOT="../../"
 else
-  PROJECT_ROOT=${base_dir}
+  PROJECT_ROOT=$base_dir
 fi
-WORK_DIR=${PROJECT_ROOT}/zookeeper-contrib/zookeeper-contrib-zkpython/target/zkpython_tests
-TEST_DIR=${PROJECT_ROOT}/zookeeper-contrib/zookeeper-contrib-zkpython/src/test
-
+WORK_DIR=$PROJECT_ROOT/zookeeper-contrib/zookeeper-contrib-zkpython/target/zkpython_tests
+TEST_DIR=$PROJECT_ROOT/zookeeper-contrib/zookeeper-contrib-zkpython/src/test
 
-if [ -r "${WORK_DIR}/../zk.pid" ]
-then
-  pid=`cat "${WORK_DIR}/../zk.pid"`
-  kill -9 $pid
-  rm -f "${WORK_DIR}/../zk.pid"
+if [[ -r "$WORK_DIR/../zk.pid" ]]; then
+  pid=$(cat "$WORK_DIR/../zk.pid")
+  kill -9 "$pid"
+  rm -f "$WORK_DIR/../zk.pid"
 fi
 
-which lsof &> /dev/null
-if [ $? -eq 0  ]
-then
-    pid=`lsof -i :22182 | grep LISTEN | awk '{print $2}'`
-    if [ -n "$pid" ]
-    then
-        kill -9 $pid
-    fi
+if which lsof &>/dev/null; then
+  pid=$(lsof -i :22182 | grep LISTEN | awk '{print $2}')
+  if [[ -n $pid ]]; then
+    kill -9 "$pid"
+  fi
 fi
 
-
-
-
-if [ "x$1" == "xstartClean" ]
-then
-    rm -rf ${WORK_DIR}
+if [[ $1 == "startClean" ]]; then
+  rm -rf "$WORK_DIR"
 fi
 
+CLASSPATH="$CLASSPATH:$PROJECT_ROOT/zookeeper-server/target/classes"
+CLASSPATH="$CLASSPATH:$PROJECT_ROOT/conf"
 
-
-CLASSPATH="$CLASSPATH:${PROJECT_ROOT}/zookeeper-server/target/classes"
-CLASSPATH="$CLASSPATH:${zk_base}/conf"
-
-for i in "${PROJECT_ROOT}"/zookeeper-server/target/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$PROJECT_ROOT"/zookeeper-server/target/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${PROJECT_ROOT}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$PROJECT_ROOT"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
+export CLASSPATH
 
 # Make sure nothing is left over from before
 #fuser -skn tcp 22182/tcp
 
 case $1 in
-start|startClean)
-    mkdir -p ${WORK_DIR}/zkdata
+  start | startClean)
+    mkdir -p "$WORK_DIR/zkdata"
 
-    rm -rf ${WORK_DIR}/ssl
-    mkdir -p ${WORK_DIR}/ssl
-    cp ${PROJECT_ROOT}/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh ${WORK_DIR}/ssl/
-    cd ${WORK_DIR}/ssl/
-    ./gencerts.sh
-    cd -
+    rm -rf "$WORK_DIR/ssl"
+    mkdir -p "$WORK_DIR/ssl"
+    cp "$PROJECT_ROOT/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh" "$WORK_DIR/ssl/"
+    (cd "$WORK_DIR/ssl/" && ./gencerts.sh)
 
-    sed "s#WORKDIR#${WORK_DIR}#g" ${TEST_DIR}/zoo.cfg > "${WORK_DIR}/zoo.cfg"
-    java  -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100 -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain "${WORK_DIR}/zoo.cfg" &> "${WORK_DIR}/zoo.log" &
+    sed "s#WORKDIR#$WORK_DIR#g" "$TEST_DIR/zoo.cfg" >"$WORK_DIR/zoo.cfg"
+    java -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100 \
+      org.apache.zookeeper.server.ZooKeeperServerMain "$WORK_DIR/zoo.cfg" &>"$WORK_DIR/zoo.log" &
     pid=$!
-    echo -n $! > ${WORK_DIR}/../zk.pid
+    echo -n $! >"$WORK_DIR"/../zk.pid
     sleep 5
     ;;
-stop)
+  stop)
     # Already killed above
     ;;
-*)
-    echo "Unknown command " + $1
+  *)
+    echo "Unknown command $1"
     exit 2
+    ;;
 esac
-
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh
index 9be0b0a238b..4b947bdfa45 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh
@@ -1,18 +1,22 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-         
-java -cp ../../build/contrib/ZooInspector/*:../../../build/*:../../../build/lib/*:lib org.apache.zookeeper.inspector.ZooInspector
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+export CLASSPATH="../../build/contrib/ZooInspector/*:../../../build/*:../../../build/lib/*:lib"
+java org.apache.zookeeper.inspector.ZooInspector
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
index 07ff697e7f8..a009d91b617 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
@@ -1,25 +1,26 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 # Get the path to the directory containing this script
 SCRIPT_DIR=$(dirname "$0")
 
 # Get the path to the uber jar for this tool
 # (Requires "mvn install" or "mvn package" be run first)
-JAVA_LIB=`ls ${SCRIPT_DIR}/target/zookeeper-contrib-zooinspector-*-jar-with-dependencies.jar`
-
-java -jar "${JAVA_LIB}"
+java -jar "$SCRIPT_DIR"/target/zookeeper-contrib-zooinspector-*-jar-with-dependencies.jar
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh
index 4836612d68a..e6201e9bd28 100755
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,68 +8,64 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 
-if [ "x$1" == "x" ]
-then
-	echo "USAGE: $0 startClean|start|stop hostPorts"
-	exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop hostPorts"
+  exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
-then
-	rm -rf /tmp/zkdata
+if [[ $1 == "startClean" ]]; then
+  rm -rf /tmp/zkdata
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-kill -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  kill -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
 base_dir="../../../../.."
 
-CLASSPATH="$CLASSPATH:${base_dir}/build/classes"
-CLASSPATH="$CLASSPATH:${base_dir}/conf"
+CLASSPATH="$CLASSPATH:$base_dir/build/classes"
+CLASSPATH="$CLASSPATH:$base_dir/conf"
 
-for f in "${base_dir}"/zookeeper-*.jar
-do
-    CLASSPATH="$CLASSPATH:$f"
+for f in "$base_dir"/zookeeper-*.jar; do
+  CLASSPATH="$CLASSPATH:$f"
 done
 
-for i in "${base_dir}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${base_dir}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-CLASSPATH="$CLASSPATH:${CLOVER_HOME}/lib/clover.jar"
+CLASSPATH="$CLASSPATH:$CLOVER_HOME/lib/clover.jar"
+export CLASSPATH
 
 case $1 in
-start|startClean)
-	mkdir -p /tmp/zkdata
-	java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &> /tmp/zk.log &
-        echo $! > /tmp/zk.pid
-        sleep 5
-	;;
-stop)
-	# Already killed above
-	;;
-*)
-	echo "Unknown command " + $1
-	exit 2
+  start | startClean)
+    mkdir -p /tmp/zkdata
+    java org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &>/tmp/zk.log &
+    echo $! >/tmp/zk.pid
+    sleep 5
+    ;;
+  stop)
+    # Already killed above
+    ;;
+  *)
+    echo "Unknown command $1"
+    exit 2
+    ;;
 esac
-
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh
index 4836612d68a..e6201e9bd28 100755
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,68 +8,64 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 
-if [ "x$1" == "x" ]
-then
-	echo "USAGE: $0 startClean|start|stop hostPorts"
-	exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop hostPorts"
+  exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
-then
-	rm -rf /tmp/zkdata
+if [[ $1 == "startClean" ]]; then
+  rm -rf /tmp/zkdata
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-kill -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  kill -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
 base_dir="../../../../.."
 
-CLASSPATH="$CLASSPATH:${base_dir}/build/classes"
-CLASSPATH="$CLASSPATH:${base_dir}/conf"
+CLASSPATH="$CLASSPATH:$base_dir/build/classes"
+CLASSPATH="$CLASSPATH:$base_dir/conf"
 
-for f in "${base_dir}"/zookeeper-*.jar
-do
-    CLASSPATH="$CLASSPATH:$f"
+for f in "$base_dir"/zookeeper-*.jar; do
+  CLASSPATH="$CLASSPATH:$f"
 done
 
-for i in "${base_dir}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${base_dir}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-CLASSPATH="$CLASSPATH:${CLOVER_HOME}/lib/clover.jar"
+CLASSPATH="$CLASSPATH:$CLOVER_HOME/lib/clover.jar"
+export CLASSPATH
 
 case $1 in
-start|startClean)
-	mkdir -p /tmp/zkdata
-	java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &> /tmp/zk.log &
-        echo $! > /tmp/zk.pid
-        sleep 5
-	;;
-stop)
-	# Already killed above
-	;;
-*)
-	echo "Unknown command " + $1
-	exit 2
+  start | startClean)
+    mkdir -p /tmp/zkdata
+    java org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &>/tmp/zk.log &
+    echo $! >/tmp/zk.pid
+    sleep 5
+    ;;
+  stop)
+    # Already killed above
+    ;;
+  *)
+    echo "Unknown command $1"
+    exit 2
+    ;;
 esac
-
diff --git a/zookeeper-server/src/main/resources/lastRevision.bat b/zookeeper-server/src/main/resources/lastRevision.bat
deleted file mode 100644
index 68999471db6..00000000000
--- a/zookeeper-server/src/main/resources/lastRevision.bat
+++ /dev/null
@@ -1,22 +0,0 @@
-echo off
-rem Licensed to the Apache Software Foundation (ASF) under one
-rem or more contributor license agreements.  See the NOTICE file
-rem distributed with this work for additional information
-rem regarding copyright ownership.  The ASF licenses this file
-rem to you under the Apache License, Version 2.0 (the
-rem "License"); you may not use this file except in compliance
-rem with the License.  You may obtain a copy of the License at
-rem
-rem     http://www.apache.org/licenses/LICENSE-2.0
-rem
-rem Unless required by applicable law or agreed to in writing, software
-rem distributed under the License is distributed on an "AS IS" BASIS,
-rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-rem See the License for the specific language governing permissions and
-rem limitations under the License.
-
-rem Find the current revision, store it in a file, for DOS
-
-for /f "delims=" %%i in ('git rev-parse HEAD') do set rev=%%i
-       echo lastRevision=%rev% > %1
-)
diff --git a/zookeeper-server/src/main/resources/lastRevision.sh b/zookeeper-server/src/main/resources/lastRevision.sh
deleted file mode 100755
index ec1678498f5..00000000000
--- a/zookeeper-server/src/main/resources/lastRevision.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/sh
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Find the current revision, store it in a file
-FILE=$1
-LASTREV=$(git rev-parse HEAD)
-
-echo "lastRevision=${LASTREV}" > "$FILE"
diff --git a/zookeeper-server/src/test/resources/test-github-pr.sh b/zookeeper-server/src/test/resources/test-github-pr.sh
deleted file mode 100755
index 3acccc38bd6..00000000000
--- a/zookeeper-server/src/test/resources/test-github-pr.sh
+++ /dev/null
@@ -1,614 +0,0 @@
-#!/usr/bin/env bash
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-
-#set -x
-
-### Setup some variables.
-### GIT_COMMIT and BUILD_URL are set by Hudson if it is run by patch process
-### Read variables from properties file
-. `dirname $0`/test-patch.properties
-
-###############################################################################
-parseArgs() {
-  case "$1" in
-    QABUILD)
-      ### Set QABUILD to true to indicate that this script is being run by Hudson
-      QABUILD=true
-      if [[ $# != 13 ]] ; then
-        echo "ERROR: usage $0 QABUILD <PATCH_DIR> <PS_CMD> <WGET_CMD> <JIRACLI> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JIRA_PASSWD> <JAVA5_HOME> <CURL_CMD>"
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$2
-      PS=$3
-      WGET=$4
-      JIRACLI=$5
-      GIT=$6
-      GREP=$7
-      PATCH=$8
-      FINDBUGS_HOME=$9
-      BASEDIR=${10}
-      JIRA_PASSWD=${11}
-      JAVA5_HOME=${12}
-      CURL=${13}
-      if [ ! -e "$PATCH_DIR" ] ; then
-        mkdir -p $PATCH_DIR
-      fi
-
-      ## Obtain PR number and title
-      PULLREQUEST_ID=${GIT_PR_NUMBER}
-      PULLREQUEST_TITLE="${GIT_PR_TITLE}"
-
-      ## Extract jira number from PR title
-      local prefix=${PULLREQUEST_TITLE%ZOOKEEPER\-[0-9]*}
-      local noprefix=${PULLREQUEST_TITLE#$prefix}
-      local regex='\(ZOOKEEPER-.[0-9]*\)'
-      defect=$(expr "$noprefix" : ${regex})
-
-      echo "Pull request id: ${PULLREQUEST_ID}"
-      echo "Pull request title: ${PULLREQUEST_TITLE}"
-      echo "Defect number: ${defect}"
-
-      JIRA_COMMENT="GitHub Pull Request ${PULLREQUEST_NUMBER} Build
-      "
-      ;;
-    DEVELOPER)
-      ### Set QABUILD to false to indicate that this script is being run by a developer
-      QABUILD=false
-      if [[ $# != 9 ]] ; then
-        echo "ERROR: usage $0 DEVELOPER <GIT_PR_URL> <SCRATCH_DIR> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JAVA5_HOME>"
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$3
-      PATCH_FILE=${PATCH_DIR}/patch
-      curl -L $2.diff > ${PATCH_FILE}
-      ### PATCH_FILE contains the location of the patchfile
-      if [[ ! -e "$PATCH_FILE" ]] ; then
-        echo "Unable to locate the patch file $PATCH_FILE"
-        cleanupAndExit 0
-      fi
-      ### Check if $PATCH_DIR exists. If it does not exist, create a new directory
-      if [[ ! -e "$PATCH_DIR" ]] ; then
-	mkdir "$PATCH_DIR"
-	if [[ $? == 0 ]] ; then
-	  echo "$PATCH_DIR has been created"
-	else
-	  echo "Unable to create $PATCH_DIR"
-	  cleanupAndExit 0
-	fi
-      fi
-      GIT=$4
-      GREP=$5
-      PATCH=$6
-      FINDBUGS_HOME=$7
-      BASEDIR=$8
-      JAVA5_HOME=${9}
-      ### Obtain the patch filename to append it to the version number
-      local subject=`grep "Subject:" ${PATCH_FILE}`
-      local length=`expr match ${subject} ZOOKEEPER-[0-9]*`
-      local position=`expr index ${subject} ZOOKEEPER-`
-      defect=${${subject:$position:$length}#ZOOKEEPER-}
-      ;;
-    *)
-      echo "ERROR: usage $0 QABUILD [args] | DEVELOPER [args]"
-      cleanupAndExit 0
-      ;;
-  esac
-}
-
-###############################################################################
-checkout () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Testing patch for pull request ${PULLREQUEST_ID}."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  ### When run by a developer, if the workspace contains modifications, do not continue
-  # Ref http://stackoverflow.com/a/2659808 for details on checking dirty status
-  ${GIT} diff-index --quiet HEAD
-  if [[ $? -ne 0 ]] ; then
-    uncommitted=`${GIT} diff --name-only HEAD`
-    uncommitted="You have the following files with uncommitted changes:${NEWLINE}${uncommitted}"
-  fi
-  untracked="$(${GIT} ls-files --exclude-standard --others)" && test -z "${untracked}"
-  if [[ $? -ne 0 ]] ; then
-    untracked="You have untracked and unignored files:${NEWLINE}${untracked}"
-  fi
-
-  if [[ $QABUILD == "false" ]] ; then
-    if [[ $uncommitted || $untracked ]] ; then
-      echo "ERROR: can't run in a workspace that contains the following modifications"
-      echo ""
-      echo "${uncommitted}"
-      echo ""
-      echo "${untracked}"
-      cleanupAndExit 1
-    fi
-  else
-    # I don't believe we need to do anything here - the jenkins job will
-    # cleanup the environment for us ("cleanup before checkout" action)
-    # on the precommit jenkins job
-    echo
-  fi
-  return $?
-}
-
-###############################################################################
-setup () {
-  ### exit if warnings are NOT defined in the properties file
-  if [ -z "$OK_FINDBUGS_WARNINGS" ] || [[ -z "$OK_JAVADOC_WARNINGS" ]] || [[ -z $OK_RELEASEAUDIT_WARNINGS ]]; then
-    echo "Please define the following properties in test-patch.properties file"
-	 echo  "OK_FINDBUGS_WARNINGS"
-	 echo  "OK_RELEASEAUDIT_WARNINGS"
-	 echo  "OK_JAVADOC_WARNINGS"
-    cleanupAndExit 1
-  fi
-  ### get pull request diff
-  ${CURL} -L ${GIT_PR_URL}.diff > $PATCH_DIR/patch
-
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo " Pre-build trunk to verify trunk stability and javac warnings"
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant  -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1"
- $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    echo "Trunk compilation is broken?"
-    cleanupAndExit 1
-  fi
-}
-
-###############################################################################
-### Check for @author tags in the patch
-checkAuthor () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are no @author tags in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  authorTags=`$GREP -c -i '@author' $PATCH_DIR/patch`
-  echo "There appear to be $authorTags @author tags in the patch."
-  if [[ $authorTags != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 @author.  The patch appears to contain $authorTags @author tags which the Zookeeper community has agreed to not allow in code contributions."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 @author.  The patch does not contain any @author tags."
-  return 0
-}
-
-###############################################################################
-### Check for tests in the patch
-checkTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are new or changed tests in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  testReferences=`$GREP -c -i '/test' $PATCH_DIR/patch`
-  echo "There appear to be $testReferences test files referenced in the patch."
-  if [[ $testReferences == 0 ]] ; then
-    if [[ $QABUILD == "true" ]] ; then
-      patchIsDoc=`$GREP -c -i 'title="documentation' $PATCH_DIR/jira`
-      if [[ $patchIsDoc != 0 ]] ; then
-        echo "The patch appears to be a documentation patch that doesn't require tests."
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    +0 tests included.  The patch appears to be a documentation patch that doesn't require tests."
-        return 0
-      fi
-    fi
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 tests included.  The patch doesn't appear to include any new or modified tests.
-                        Please justify why no new tests are needed for this patch.
-                        Also please list what manual steps were performed to verify this patch."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 tests included.  The patch appears to include $testReferences new or modified tests."
-  return 0
-}
-
-###############################################################################
-### Check there are no javadoc warnings
-checkJavadocWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javadoc warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt
-  javadocWarnings=`$GREP -o '\[javadoc\] [0-9]* warning' $PATCH_DIR/patchJavadocWarnings.txt | awk '{total += $2} END {print total}'`
-  echo ""
-  echo ""
-  echo "There appear to be $javadocWarnings javadoc warnings generated by the patched build."
-
-  ### if current warnings greater than OK_JAVADOC_WARNINGS
-  if [[ $javadocWarnings > $OK_JAVADOC_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javadoc.  The javadoc tool appears to have generated `expr $(($javadocWarnings-$OK_JAVADOC_WARNINGS))` warning messages."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javadoc.  The javadoc tool did not generate any warning messages."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Javac warnings
-checkJavacWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javac warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The patch appears to cause tar ant target to fail."
-    return 1
-  fi
-  ### Compare trunk and patch javac warning numbers
-  if [[ -f $PATCH_DIR/patchJavacWarnings.txt ]] ; then
-    trunkJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/trunkJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    patchJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/patchJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    echo "There appear to be $trunkJavacWarnings javac compiler warnings before the patch and $patchJavacWarnings javac compiler warnings after applying the patch."
-    if [[ $patchJavacWarnings != "" && $trunkJavacWarnings != "" ]] ; then
-      if [[ $patchJavacWarnings -gt $trunkJavacWarnings ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The applied patch generated $patchJavacWarnings javac compiler warnings (more than the trunk's current $trunkJavacWarnings warnings)."
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javac.  The applied patch does not increase the total number of javac compiler warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of release audit (RAT) warnings
-checkReleaseAuditWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched release audit warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1
-
-  ### Compare trunk and patch release audit warning numbers
-  if [[ -f $PATCH_DIR/patchReleaseAuditWarnings.txt ]] ; then
-    patchReleaseAuditWarnings=`$GREP -c '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt`
-    echo ""
-    echo ""
-    echo "There appear to be $OK_RELEASEAUDIT_WARNINGS release audit warnings before the patch and $patchReleaseAuditWarnings release audit warnings after applying the patch."
-    if [[ $patchReleaseAuditWarnings != "" && $OK_RELEASEAUDIT_WARNINGS != "" ]] ; then
-      if [[ $patchReleaseAuditWarnings -gt $OK_RELEASEAUDIT_WARNINGS ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 release audit.  The applied patch generated $patchReleaseAuditWarnings release audit warnings (more than the trunk's current $OK_RELEASEAUDIT_WARNINGS warnings)."
-        $GREP '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt > $PATCH_DIR/patchReleaseAuditProblems.txt
-        echo "Lines that start with ????? in the release audit report indicate files that do not have an Apache license header." >> $PATCH_DIR/patchReleaseAuditProblems.txt
-        JIRA_COMMENT_FOOTER="Release audit warnings: $BUILD_URL/artifact/trunk/patchprocess/patchReleaseAuditProblems.txt
-$JIRA_COMMENT_FOOTER"
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 release audit.  The applied patch does not increase the total number of release audit warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Checkstyle warnings
-checkStyle () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched checkstyle warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "THIS IS NOT IMPLEMENTED YET"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle
-  JIRA_COMMENT_FOOTER="Checkstyle results: $BUILD_URL/artifact/trunk/build/test/checkstyle-errors.html
-$JIRA_COMMENT_FOOTER"
-  ### TODO: calculate actual patchStyleErrors
-#  patchStyleErrors=0
-#  if [[ $patchStyleErrors != 0 ]] ; then
-#    JIRA_COMMENT="$JIRA_COMMENT
-#
-#    -1 checkstyle.  The patch generated $patchStyleErrors code style errors."
-#    return 1
-#  fi
-#  JIRA_COMMENT="$JIRA_COMMENT
-#
-#    +1 checkstyle.  The patch generated 0 code style errors."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Findbugs warnings
-checkFindbugsWarnings () {
-  findbugs_version=`${FINDBUGS_HOME}/bin/findbugs -version`
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched Findbugs warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs"
-  $ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs
-  if [ $? != 0 ] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to cause Findbugs (version ${findbugs_version}) to fail."
-    return 1
-  fi
-JIRA_COMMENT_FOOTER="Findbugs warnings: $BUILD_URL/artifact/trunk/build/test/findbugs/newPatchFindbugsWarnings.html
-$JIRA_COMMENT_FOOTER"
-  cp $BASEDIR/build/test/findbugs/*.xml $PATCH_DIR/patchFindbugsWarnings.xml
-  $FINDBUGS_HOME/bin/setBugDatabaseInfo -timestamp "01/01/2000" \
-    $PATCH_DIR/patchFindbugsWarnings.xml \
-    $PATCH_DIR/patchFindbugsWarnings.xml
-  findbugsWarnings=`$FINDBUGS_HOME/bin/filterBugs -first "01/01/2000" $PATCH_DIR/patchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml | /usr/bin/awk '{print $1}'`
-  $FINDBUGS_HOME/bin/convertXmlToText -html \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html $PATCH_DIR/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml $PATCH_DIR/newPatchFindbugsWarnings.xml
-
-  ### if current warnings greater than OK_FINDBUGS_WARNINGS
-  if [[ $findbugsWarnings > $OK_FINDBUGS_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to introduce `expr $(($findbugsWarnings-$OK_FINDBUGS_WARNINGS))` new Findbugs (version ${findbugs_version}) warnings."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 findbugs.  The patch does not introduce any new Findbugs (version ${findbugs_version}) warnings."
-  return 0
-}
-
-###############################################################################
-### Run the test-core target
-runCoreTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running core tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no -Dtest.junit.threads=4 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no -Dtest.junit.threads=4 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 core tests.  The patch failed core unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 core tests.  The patch passed core unit tests."
-  return 0
-}
-
-###############################################################################
-### Run the test-contrib target
-runContribTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running contrib tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no test-contrib"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no test-contrib
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 contrib tests.  The patch failed contrib unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 contrib tests.  The patch passed contrib unit tests."
-  return 0
-}
-
-###############################################################################
-### Submit a comment to the defect's Jira
-submitJiraComment () {
-  local result=$1
-  ### Do not output the value of JIRA_COMMENT_FOOTER when run by a developer
-  if [[  $QABUILD == "false" ]] ; then
-    JIRA_COMMENT_FOOTER=""
-  fi
-  if [[ $result == 0 ]] ; then
-    comment="+1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  else
-    comment="-1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  fi
-  ### Output the test result to the console
-  echo "
-
-
-
-$comment"
-
-  if [[ $QABUILD == "true" ]] ; then
-    echo ""
-    echo ""
-    echo "======================================================================"
-    echo "======================================================================"
-    echo "    Adding comment to Jira."
-    echo "======================================================================"
-    echo "======================================================================"
-    echo ""
-    echo ""
-    ### Update Jira with a comment
-    export USER=jenkins
-    $JIRACLI -s https://issues.apache.org/jira -a addcomment -u hadoopqa -p $JIRA_PASSWD --comment "$comment" --issue $defect
-    $JIRACLI -s https://issues.apache.org/jira -a logout -u hadoopqa -p $JIRA_PASSWD
-  fi
-}
-
-###############################################################################
-### Cleanup files
-cleanupAndExit () {
-  local result=$1
-  if [[ $QABUILD == "true" ]] ; then
-    if [ -e "$PATCH_DIR" ] ; then
-      mv $PATCH_DIR $BASEDIR
-    fi
-  fi
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Finished build."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  exit $result
-}
-
-###############################################################################
-###############################################################################
-###############################################################################
-
-JIRA_COMMENT=""
-JIRA_COMMENT_FOOTER="Console output: $BUILD_URL/console
-
-This message is automatically generated."
-
-### Check if arguments to the script have been specified properly or not
-echo "----- Going to parser args -----"
-parseArgs $@
-cd $BASEDIR
-
-echo "----- Parsed args, going to checkout -----"
-checkout
-RESULT=$?
-if [[ $QABUILD == "true" ]] ; then
-  if [[ $RESULT != 0 ]] ; then
-    exit 100
-  fi
-fi
-setup
-checkAuthor
-(( RESULT = RESULT + $? ))
-
-checkTests
-checkTestsResult=$?
-(( RESULT = RESULT + $checkTestsResult ))
-if [[ $checkTestsResult != 0 ]] ; then
-  submitJiraComment 1
-  cleanupAndExit 1
-fi
-checkJavadocWarnings
-(( RESULT = RESULT + $? ))
-checkJavacWarnings
-(( RESULT = RESULT + $? ))
-### Checkstyle not implemented yet
-#checkStyle
-#(( RESULT = RESULT + $? ))
-checkFindbugsWarnings
-(( RESULT = RESULT + $? ))
-checkReleaseAuditWarnings
-(( RESULT = RESULT + $? ))
-### Do not call these when run by a developer
-if [[ $QABUILD == "true" ]] ; then
-  runCoreTests
-  (( RESULT = RESULT + $? ))
-  runContribTests
-  (( RESULT = RESULT + $? ))
-fi
-JIRA_COMMENT_FOOTER="Test results: $BUILD_URL/testReport/
-$JIRA_COMMENT_FOOTER"
-
-submitJiraComment $RESULT
-cleanupAndExit $RESULT
diff --git a/zookeeper-server/src/test/resources/test-patch.sh b/zookeeper-server/src/test/resources/test-patch.sh
deleted file mode 100755
index 90b0a0bb23a..00000000000
--- a/zookeeper-server/src/test/resources/test-patch.sh
+++ /dev/null
@@ -1,647 +0,0 @@
-#!/usr/bin/env bash
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-
-#set -x
-
-### Setup some variables.  
-### GIT_COMMIT and BUILD_URL are set by Hudson if it is run by patch process
-### Read variables from properties file
-. `dirname $0`/test-patch.properties
-
-###############################################################################
-parseArgs() {
-  case "$1" in
-    HUDSON)
-      ### Set HUDSON to true to indicate that this script is being run by Hudson
-      HUDSON=true
-      if [[ $# != 14 ]] ; then
-        echo "ERROR: usage $0 HUDSON <PATCH_DIR> <PS_CMD> <WGET_CMD> <JIRACLI> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JIRA_PASSWD> <JAVA5_HOME> <CURL_CMD> <DEFECT> "
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$2
-      PS=$3
-      WGET=$4
-      JIRACLI=$5
-      GIT=$6
-      GREP=$7
-      PATCH=$8
-      FINDBUGS_HOME=$9
-      BASEDIR=${10}
-      JIRA_PASSWD=${11}
-      JAVA5_HOME=${12}
-      CURL=${13}
-      defect=${14}
-		
-      ### Retrieve the defect number
-      if [ -z "$defect" ] ; then
-        echo "Could not determine the patch to test.  Exiting."
-        cleanupAndExit 0
-      fi
-
-      if [ ! -e "$PATCH_DIR" ] ; then
-        mkdir -p $PATCH_DIR 
-      fi
-
-      ;;
-    DEVELOPER)
-      ### Set HUDSON to false to indicate that this script is being run by a developer
-      HUDSON=false
-      if [[ $# != 9 ]] ; then
-        echo "ERROR: usage $0 DEVELOPER <PATCH_FILE> <SCRATCH_DIR> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JAVA5_HOME>"
-        cleanupAndExit 0
-      fi
-      ### PATCH_FILE contains the location of the patchfile
-      PATCH_FILE=$2 
-      if [[ ! -e "$PATCH_FILE" ]] ; then
-        echo "Unable to locate the patch file $PATCH_FILE"
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$3
-      ### Check if $PATCH_DIR exists. If it does not exist, create a new directory
-      if [[ ! -e "$PATCH_DIR" ]] ; then
-	mkdir "$PATCH_DIR"
-	if [[ $? == 0 ]] ; then 
-	  echo "$PATCH_DIR has been created"
-	else
-	  echo "Unable to create $PATCH_DIR"
-	  cleanupAndExit 0
-	fi
-      fi
-      GIT=$4
-      GREP=$5
-      PATCH=$6
-      FINDBUGS_HOME=$7
-      BASEDIR=$8
-      JAVA5_HOME=${9}
-      ### Obtain the patch filename to append it to the version number
-      defect=`basename $PATCH_FILE` 
-      ;;
-    *)
-      echo "ERROR: usage $0 HUDSON [args] | DEVELOPER [args]"
-      cleanupAndExit 0
-      ;;
-  esac
-}
-
-###############################################################################
-checkout () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Testing patch for ${defect}."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  ### When run by a developer, if the workspace contains modifications, do not continue
-  # Ref http://stackoverflow.com/a/2659808 for details on checking dirty status
-  ${GIT} diff-index --quiet HEAD
-  if [[ $? -ne 0 ]] ; then
-    uncommitted=`${GIT} diff --name-only HEAD`
-    uncommitted="You have the following files with uncommitted changes:${NEWLINE}${uncommitted}"
-  fi
-  untracked="$(${GIT} ls-files --exclude-standard --others)" && test -z "${untracked}"
-  if [[ $? -ne 0 ]] ; then
-    untracked="You have untracked and unignored files:${NEWLINE}${untracked}"
-  fi
-
-  if [[ $HUDSON == "false" ]] ; then
-    if [[ $uncommitted || $untracked ]] ; then
-      echo "ERROR: can't run in a workspace that contains the following modifications"
-      echo ""
-      echo "${uncommitted}"
-      echo ""
-      echo "${untracked}"
-      cleanupAndExit 1
-    fi
-  else   
-    # I don't believe we need to do anything here - the jenkins job will
-    # cleanup the environment for us ("cleanup before checkout" action)
-    # on the precommit jenkins job
-    echo
-  fi
-  return $?
-}
-
-###############################################################################
-setup () {
-  ### Download latest patch file (ignoring .htm and .html) when run from patch process
-  if [[ $HUDSON == "true" ]] ; then
-    $WGET -q -O $PATCH_DIR/jira http://issues.apache.org/jira/browse/$defect
-    if [[ `$GREP -c 'Patch Available' $PATCH_DIR/jira` == 0 ]] ; then
-      echo "$defect is not \"Patch Available\".  Exiting."
-      cleanupAndExit 0
-    fi
-    relativePatchURL=`$GREP -o '"/jira/secure/attachment/[0-9]*/[^"]*' $PATCH_DIR/jira | $GREP -v -e 'htm[l]*$' | sort | tail -1 | $GREP -o '/jira/secure/attachment/[0-9]*/[^"]*'`
-    patchURL="http://issues.apache.org${relativePatchURL}"
-    patchNum=`echo $patchURL | $GREP -o '[0-9]*/' | $GREP -o '[0-9]*'`
-    echo "$defect patch is being downloaded at `date` from"
-    echo "$patchURL"
-    $WGET -q -O $PATCH_DIR/patch $patchURL
-    JIRA_COMMENT="Here are the results of testing the latest attachment 
-  $patchURL
-  against trunk revision ${GIT_COMMIT}."
-
-  ### Copy the patch file to $PATCH_DIR
-  else
-    cp $PATCH_FILE $PATCH_DIR/patch
-    if [[ $? == 0 ]] ; then
-      echo "Patch file $PATCH_FILE copied to $PATCH_DIR"
-    else
-      echo "Could not copy $PATCH_FILE to $PATCH_DIR"
-      cleanupAndExit 0
-    fi
-  fi
-  ### exit if warnings are NOT defined in the properties file
-  if [ -z "$OK_FINDBUGS_WARNINGS" ] || [[ -z "$OK_JAVADOC_WARNINGS" ]] || [[ -z $OK_RELEASEAUDIT_WARNINGS ]]; then
-    echo "Please define the following properties in test-patch.properties file"
-	 echo  "OK_FINDBUGS_WARNINGS"
-	 echo  "OK_RELEASEAUDIT_WARNINGS"
-	 echo  "OK_JAVADOC_WARNINGS"
-    cleanupAndExit 1
-  fi
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo " Pre-build trunk to verify trunk stability and javac warnings" 
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant  -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1"
- $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    echo "Trunk compilation is broken?"
-    cleanupAndExit 1
-  fi
-}
-
-###############################################################################
-### Check for @author tags in the patch
-checkAuthor () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are no @author tags in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  authorTags=`$GREP -c -i '@author' $PATCH_DIR/patch`
-  echo "There appear to be $authorTags @author tags in the patch."
-  if [[ $authorTags != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 @author.  The patch appears to contain $authorTags @author tags which the Zookeeper community has agreed to not allow in code contributions."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 @author.  The patch does not contain any @author tags."
-  return 0
-}
-
-###############################################################################
-### Check for tests in the patch
-checkTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are new or changed tests in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  testReferences=`$GREP -c -i '/test' $PATCH_DIR/patch`
-  echo "There appear to be $testReferences test files referenced in the patch."
-  if [[ $testReferences == 0 ]] ; then
-    if [[ $HUDSON == "true" ]] ; then
-      patchIsDoc=`$GREP -c -i 'title="documentation' $PATCH_DIR/jira`
-      if [[ $patchIsDoc != 0 ]] ; then
-        echo "The patch appears to be a documentation patch that doesn't require tests."
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    +0 tests included.  The patch appears to be a documentation patch that doesn't require tests."
-        return 0
-      fi
-    fi
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 tests included.  The patch doesn't appear to include any new or modified tests.
-                        Please justify why no new tests are needed for this patch.
-                        Also please list what manual steps were performed to verify this patch."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 tests included.  The patch appears to include $testReferences new or modified tests."
-  return 0
-}
-
-###############################################################################
-### Attempt to apply the patch
-applyPatch () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Applying patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  $PATCH -E -p0 < $PATCH_DIR/patch
-  if [[ $? != 0 ]] ; then
-    echo "PATCH APPLICATION FAILED"
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 patch.  The patch command could not apply the patch."
-    return 1
-  fi
-  return 0
-}
-
-###############################################################################
-### Check there are no javadoc warnings
-checkJavadocWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javadoc warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt
-  javadocWarnings=`$GREP -o '\[javadoc\] [0-9]* warning' $PATCH_DIR/patchJavadocWarnings.txt | awk '{total += $2} END {print total}'`
-  echo ""
-  echo ""
-  echo "There appear to be $javadocWarnings javadoc warnings generated by the patched build."
-
-  ### if current warnings greater than OK_JAVADOC_WARNINGS
-  if [[ $javadocWarnings > $OK_JAVADOC_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javadoc.  The javadoc tool appears to have generated `expr $(($javadocWarnings-$OK_JAVADOC_WARNINGS))` warning messages."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javadoc.  The javadoc tool did not generate any warning messages."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Javac warnings
-checkJavacWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javac warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The patch appears to cause tar ant target to fail."
-    return 1
-  fi
-  ### Compare trunk and patch javac warning numbers
-  if [[ -f $PATCH_DIR/patchJavacWarnings.txt ]] ; then
-    trunkJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/trunkJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    patchJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/patchJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    echo "There appear to be $trunkJavacWarnings javac compiler warnings before the patch and $patchJavacWarnings javac compiler warnings after applying the patch."
-    if [[ $patchJavacWarnings != "" && $trunkJavacWarnings != "" ]] ; then
-      if [[ $patchJavacWarnings -gt $trunkJavacWarnings ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The applied patch generated $patchJavacWarnings javac compiler warnings (more than the trunk's current $trunkJavacWarnings warnings)."
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javac.  The applied patch does not increase the total number of javac compiler warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of release audit (RAT) warnings
-checkReleaseAuditWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched release audit warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1
-
-  ### Compare trunk and patch release audit warning numbers
-  if [[ -f $PATCH_DIR/patchReleaseAuditWarnings.txt ]] ; then
-    patchReleaseAuditWarnings=`$GREP -c '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt`
-    echo ""
-    echo ""
-    echo "There appear to be $OK_RELEASEAUDIT_WARNINGS release audit warnings before the patch and $patchReleaseAuditWarnings release audit warnings after applying the patch."
-    if [[ $patchReleaseAuditWarnings != "" && $OK_RELEASEAUDIT_WARNINGS != "" ]] ; then
-      if [[ $patchReleaseAuditWarnings -gt $OK_RELEASEAUDIT_WARNINGS ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 release audit.  The applied patch generated $patchReleaseAuditWarnings release audit warnings (more than the trunk's current $OK_RELEASEAUDIT_WARNINGS warnings)."
-        $GREP '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt > $PATCH_DIR/patchReleaseAuditProblems.txt
-        echo "Lines that start with ????? in the release audit report indicate files that do not have an Apache license header." >> $PATCH_DIR/patchReleaseAuditProblems.txt
-        JIRA_COMMENT_FOOTER="Release audit warnings: $BUILD_URL/artifact/trunk/patchprocess/patchReleaseAuditProblems.txt
-$JIRA_COMMENT_FOOTER"
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 release audit.  The applied patch does not increase the total number of release audit warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Checkstyle warnings
-checkStyle () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched checkstyle warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "THIS IS NOT IMPLEMENTED YET"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle
-  JIRA_COMMENT_FOOTER="Checkstyle results: $BUILD_URL/artifact/trunk/build/test/checkstyle-errors.html
-$JIRA_COMMENT_FOOTER"
-  ### TODO: calculate actual patchStyleErrors
-#  patchStyleErrors=0
-#  if [[ $patchStyleErrors != 0 ]] ; then
-#    JIRA_COMMENT="$JIRA_COMMENT
-#
-#    -1 checkstyle.  The patch generated $patchStyleErrors code style errors."
-#    return 1
-#  fi
-#  JIRA_COMMENT="$JIRA_COMMENT
-#
-#    +1 checkstyle.  The patch generated 0 code style errors."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Findbugs warnings
-checkFindbugsWarnings () {
-  findbugs_version=`${FINDBUGS_HOME}/bin/findbugs -version`
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched Findbugs warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs"
-  $ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs
-  if [ $? != 0 ] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to cause Findbugs (version ${findbugs_version}) to fail."
-    return 1
-  fi
-JIRA_COMMENT_FOOTER="Findbugs warnings: $BUILD_URL/artifact/trunk/build/test/findbugs/newPatchFindbugsWarnings.html
-$JIRA_COMMENT_FOOTER"
-  cp $BASEDIR/build/test/findbugs/*.xml $PATCH_DIR/patchFindbugsWarnings.xml
-  $FINDBUGS_HOME/bin/setBugDatabaseInfo -timestamp "01/01/2000" \
-    $PATCH_DIR/patchFindbugsWarnings.xml \
-    $PATCH_DIR/patchFindbugsWarnings.xml
-  findbugsWarnings=`$FINDBUGS_HOME/bin/filterBugs -first "01/01/2000" $PATCH_DIR/patchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml | /usr/bin/awk '{print $1}'`
-  $FINDBUGS_HOME/bin/convertXmlToText -html \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html $PATCH_DIR/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml $PATCH_DIR/newPatchFindbugsWarnings.xml
-
-  ### if current warnings greater than OK_FINDBUGS_WARNINGS
-  if [[ $findbugsWarnings > $OK_FINDBUGS_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to introduce `expr $(($findbugsWarnings-$OK_FINDBUGS_WARNINGS))` new Findbugs (version ${findbugs_version}) warnings."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 findbugs.  The patch does not introduce any new Findbugs (version ${findbugs_version}) warnings."
-  return 0
-}
-
-###############################################################################
-### Run the test-core target
-runCoreTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running core tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes -Dtest.junit.threads=8 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes -Dtest.junit.threads=8 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 core tests.  The patch failed core unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 core tests.  The patch passed core unit tests."
-  return 0
-}
-
-###############################################################################
-### Run the test-contrib target
-runContribTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running contrib tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes test-contrib"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes test-contrib
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 contrib tests.  The patch failed contrib unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 contrib tests.  The patch passed contrib unit tests."
-  return 0
-}
-
-###############################################################################
-### Submit a comment to the defect's Jira
-submitJiraComment () {
-  local result=$1
-  ### Do not output the value of JIRA_COMMENT_FOOTER when run by a developer
-  if [[  $HUDSON == "false" ]] ; then
-    JIRA_COMMENT_FOOTER=""
-  fi
-  if [[ $result == 0 ]] ; then
-    comment="+1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  else
-    comment="-1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  fi
-  ### Output the test result to the console
-  echo "
-
-
-
-$comment"  
-
-  if [[ $HUDSON == "true" ]] ; then
-    echo ""
-    echo ""
-    echo "======================================================================"
-    echo "======================================================================"
-    echo "    Adding comment to Jira."
-    echo "======================================================================"
-    echo "======================================================================"
-    echo ""
-    echo ""
-    ### Update Jira with a comment
-    export USER=jenkins
-    $JIRACLI -s https://issues.apache.org/jira -a addcomment -u hadoopqa -p $JIRA_PASSWD --comment "$comment" --issue $defect
-    $JIRACLI -s https://issues.apache.org/jira -a logout -u hadoopqa -p $JIRA_PASSWD
-  fi
-}
-
-###############################################################################
-### Cleanup files
-cleanupAndExit () {
-  local result=$1
-  if [[ $HUDSON == "true" ]] ; then
-    if [ -e "$PATCH_DIR" ] ; then
-      mv $PATCH_DIR $BASEDIR
-    fi
-  fi
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Finished build."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  exit $result
-}
-
-###############################################################################
-###############################################################################
-###############################################################################
-
-JIRA_COMMENT=""
-JIRA_COMMENT_FOOTER="Console output: $BUILD_URL/console
-
-This message is automatically generated."
-
-### Check if arguments to the script have been specified properly or not
-parseArgs $@
-cd $BASEDIR
-
-checkout
-RESULT=$?
-if [[ $HUDSON == "true" ]] ; then
-  if [[ $RESULT != 0 ]] ; then
-    exit 100
-  fi
-fi
-setup
-checkAuthor
-RESULT=$?
-
-checkTests
-(( RESULT = RESULT + $? ))
-applyPatch
-if [[ $? != 0 ]] ; then
-  submitJiraComment 1
-  cleanupAndExit 1
-fi
-checkJavadocWarnings
-(( RESULT = RESULT + $? ))
-checkJavacWarnings
-(( RESULT = RESULT + $? ))
-### Checkstyle not implemented yet
-#checkStyle
-#(( RESULT = RESULT + $? ))
-checkFindbugsWarnings
-(( RESULT = RESULT + $? ))
-checkReleaseAuditWarnings
-(( RESULT = RESULT + $? ))
-### Do not call these when run by a developer 
-if [[ $HUDSON == "true" ]] ; then
-  runCoreTests
-  (( RESULT = RESULT + $? ))
-  runContribTests
-  (( RESULT = RESULT + $? ))
-fi
-JIRA_COMMENT_FOOTER="Test results: $BUILD_URL/testReport/
-$JIRA_COMMENT_FOOTER"
-
-submitJiraComment $RESULT
-cleanupAndExit $RESULT
diff --git a/zookeeper-server/src/test/resources/test-scripts.sh b/zookeeper-server/src/test/resources/test-scripts.sh
deleted file mode 100755
index 531c282611a..00000000000
--- a/zookeeper-server/src/test/resources/test-scripts.sh
+++ /dev/null
@@ -1,221 +0,0 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-ZKS=bin/zkServer.sh
-ZKSI=bin/zkServer-initialize.sh
-
-if [ ! -d "conf" ]; then
-    echo "run this from the toplevel directory"
-    exit 1
-fi
-
-DATADIR=test-scripts_datadir
-DATALOGDIR=test-scripts_datalogdir
-
-case "`uname`" in
-    CYGWIN*) cygwin=true ;;
-    *) cygwin=false ;;
-esac
-
-if $cygwin
-then
-    ZOOCFG=`cygpath -wp "$ZOOCFG"`
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
-else
-    KILL=kill
-fi
-
-fail() {
-    # don't run clear_tmp to allow debugging
-    echo "FAIL $1"
-    $KILL -9 $(cat "$ZOOPIDFILE")
-    $KILL -9 $$
-}
-
-#generate a minimal config
-genconfig1() {
-    cat > test-scripts.cfg <<EOF
-tickTime=2000
-initLimit=10
-syncLimit=5
-dataDir=$DATADIR
-clientPort=19181
-EOF
-}
-
-genconfig2() {
-    genconfig1
-    cat >> test-scripts.cfg <<EOF
-dataLogDir=$DATALOGDIR
-EOF
-}
-
-export ZOOCFGDIR=`pwd`
-export ZOOCFG="test-scripts.cfg"
-export CLASSPATH=$ZOOCFGDIR/conf
-
-#clear out the clutter generated by scripts
-clear_tmp() {
-    rm -f test-scripts.cfg
-    rm -fr $DATADIR
-    rm -fr $DATALOGDIR
-    rm -f zookeeper.out
-}
-
-start() {
-    $CONFIG
-    #ensure not already running
-    $ZKS status && (echo "already running"; fail $LINENO)
-    export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-    $ZKS start
-}
-
-stop() {
-    $ZKS stop
-}
-
-CONFIG=genconfig1
-
-clear_tmp
-start
-ls $DATADIR || fail $LINENO
-ls $DATALOGDIR && fail $LINENO
-stop
-
-CONFIG=genconfig2
-
-clear_tmp
-start
-ls $DATADIR || fail $LINENO
-
-# zk actually checks for this to exist, but doesn't create
-ls $DATALOGDIR && fail $LINENO
-
-clear_tmp
-mkdir -p "$DATALOGDIR"
-start
-ls $DATADIR || fail $LINENO
-ls $DATALOGDIR || fail $LINENO
-stop
-
-#
-# verify autocreate disabled
-#
-export ZOO_DATADIR_AUTOCREATE_DISABLE=1
-
-CONFIG=genconfig1
-
-clear_tmp
-start
-[ $? -eq 1 ] || fail $LINENO
-ls $DATADIR && fail $LINENO
-ls $DATALOGDIR && fail $LINENO
-
-CONFIG=genconfig2
-
-clear_tmp
-mkdir -p "$DATADIR/version-2"
-start
-[ $? -eq 1 ] || fail $LINENO
-ls $DATALOGDIR && fail $LINENO
-
-CONFIG=genconfig1
-
-clear_tmp
-mkdir -p "$DATADIR/version-2"
-start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-CONFIG=genconfig2
-
-clear_tmp
-mkdir -p "$DATADIR/version-2"
-mkdir -p "$DATALOGDIR/version-2"
-start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-#
-# validate the initialize script
-#
-
-CONFIG=genconfig1
-
-clear_tmp
-$CONFIG
-
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG"
-ls $DATADIR || fail $LINENO
-
-#ensure not already running
-$ZKS status && (echo "already running"; fail $LINENO)
-export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-$ZKS start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-
-CONFIG=genconfig2
-
-clear_tmp
-$CONFIG
-
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG"
-ls $DATADIR || fail $LINENO
-ls $DATALOGDIR || fail $LINENO
-
-#ensure not already running
-$ZKS status && (echo "already running"; fail $LINENO)
-export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-$ZKS start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-
-## validate force
-CONFIG=genconfig1
-
-clear_tmp
-$CONFIG
-
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG" || fail $LINENO
-ls $DATADIR || fail $LINENO
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG" && fail $LINENO
-$ZKSI --force --configfile "$ZOOCFGDIR/$ZOOCFG" || fail $LINENO
-
-#ensure not already running
-$ZKS status && (echo "already running"; fail $LINENO)
-export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-$ZKS start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-$ZKSI --force --myid=1 --configfile "$ZOOCFGDIR/$ZOOCFG" || fail $LINENO
-
-#test version script
-TEST_PRINT_VERSION=`$ZKS version 2>/dev/null`
-[ "$TEST_PRINT_VERSION" != "" ] || fail $LINENO
-
-#done, cleanup and exit
-clear_tmp
-echo "SUCCESS"

From 327ac03436d75618971afe333bf1e7631a3c1238 Mon Sep 17 00:00:00 2001
From: Chris Nauroth <cnauroth@apache.org>
Date: Wed, 26 Mar 2025 19:53:07 +0000
Subject: [PATCH 506/591] ZOOKEEPER-4906: Log full exception details for server
 JAAS config failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #2234

Signed-off-by: Zili Chen <tison@apache.org>
Signed-off-by: Andor MolnĂ¡r <andor@apache.org>
Signed-off-by: Kezhu Wang <kezhuw@apache.org>
---
 .../java/org/apache/zookeeper/server/ServerCnxnFactory.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index aad369cc0c9..85ad981e6ca 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -264,7 +264,7 @@ protected void configureSaslLogin() throws IOException {
                 if (loginContextName != null) {
                     errorMessage += " But " + ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY + " was set.";
                 }
-                LOG.error(errorMessage);
+                LOG.error(errorMessage, securityException);
                 throw new IOException(errorMessage);
             }
             return;

From b86ccf19cf6c32f7e58e36754b6f3534be567727 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Tue, 1 Apr 2025 03:53:57 +0800
Subject: [PATCH 507/591] ZOOKEEPER-3766: [ADDENDUM] Fix TestSASLAuth failure

Reviewers: ctubbsii
Author: kezhuw
Closes #2240 from kezhuw/ZOOKEEPER-3766-hotfix-fix-TestSASLAuth-failure
---
 zookeeper-client/zookeeper-client-c/tests/zkServer.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index 5fb6d99ae1e..4e090a3cdf1 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -109,7 +109,7 @@ export CLASSPATH
 read_only=
 # shellcheck disable=SC2206
 PROPERTIES=($EXTRA_JVM_ARGS "-Dzookeeper.extendedTypesEnabled=true" "-Dznode.container.checkIntervalMs=100")
-if [[ $1 == "xstartRequireSASLAuth" ]]; then
+if [[ $1 == "startRequireSASLAuth" ]]; then
   PROPERTIES=("-Dzookeeper.sessionRequireClientSASLAuth=true" "${PROPERTIES[@]}"
     "-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider")
   if [[ -n $2 ]]; then

From 97a29de5c786fe717644d1b0c2f3579f5fc02af5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20Francisco=20P=C3=A9rez=20Hidalgo?=
 <contact@pablofranciscoperez.info>
Date: Wed, 9 Apr 2025 09:57:16 +0200
Subject: [PATCH 508/591] ZOOKEEPER-4900: Bump patch release of jetty to
 include CVE fix for CVE-2024-6763

Reviewers: cnauroth, kezhuw, tisonkun
Author: pfcoperez
Closes #2220 from pfcoperez/ZOOKEEPER-4876/CVE-2024-6763
---
 owaspSuppressions.xml                                        | 5 -----
 pom.xml                                                      | 2 +-
 ...LICENSE.txt => jetty-client-9.4.57.v20241219.LICENSE.txt} | 0
 ...9.LICENSE.txt => jetty-http-9.4.57.v20241219.LICENSE.txt} | 0
 ...009.LICENSE.txt => jetty-io-9.4.57.v20241219.LICENSE.txt} | 0
 ...CENSE.txt => jetty-security-9.4.57.v20241219.LICENSE.txt} | 0
 ...LICENSE.txt => jetty-server-9.4.57.v20241219.LICENSE.txt} | 0
 ...ICENSE.txt => jetty-servlet-9.4.57.v20241219.LICENSE.txt} | 0
 ...9.LICENSE.txt => jetty-util-9.4.57.v20241219.LICENSE.txt} | 0
 ...ENSE.txt => jetty-util-ajax-9.4.57.v20241219.LICENSE.txt} | 0
 10 files changed, 1 insertion(+), 6 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-client-9.4.53.v20231009.LICENSE.txt => jetty-client-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.53.v20231009.LICENSE.txt => jetty-http-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.53.v20231009.LICENSE.txt => jetty-io-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.53.v20231009.LICENSE.txt => jetty-security-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.53.v20231009.LICENSE.txt => jetty-server-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.53.v20231009.LICENSE.txt => jetty-servlet-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.53.v20231009.LICENSE.txt => jetty-util-9.4.57.v20241219.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.53.v20231009.LICENSE.txt => jetty-util-ajax-9.4.57.v20241219.LICENSE.txt} (100%)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 56003dc5b4b..5b9719067a9 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -18,11 +18,6 @@
 -->
 
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
-   <suppress>
-      <!-- ZooKeeper is not affected, because HttpURI is not used in our code.
-           see: ZOOKEEPER-4876 -->
-      <cve>CVE-2024-6763</cve>
-   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>
diff --git a/pom.xml b/pom.xml
index fde5aa9e098..0629d1b7c41 100644
--- a/pom.xml
+++ b/pom.xml
@@ -560,7 +560,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.119.Final</netty.version>
-    <jetty.version>9.4.56.v20240826</jetty.version>
+    <jetty.version>9.4.57.v20241219</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-client-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-client-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.57.v20241219.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.53.v20231009.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.57.v20241219.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.53.v20231009.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.57.v20241219.LICENSE.txt

From db8fe9c241942e2222271acc8bbb9321c7a4957d Mon Sep 17 00:00:00 2001
From: mikkosc <ext-mtiihonen@supercell.com>
Date: Sat, 19 Apr 2025 19:58:31 +0300
Subject: [PATCH 509/591] ZOOKEEPER-4919: Make ResponseCache a LRU as it
 supposed to be

Reviewers: tisonkun, kezhuw
Author: mikkosc
Closes #2243 from mikkosc/fix-lru-cache
---
 .../zookeeper/server/ResponseCache.java       | 18 +++++++-------
 .../FollowerRequestProcessorTest.java         |  0
 .../zookeeper/test/ResponseCacheTest.java     | 24 +++++++++++++++++--
 3 files changed, 32 insertions(+), 10 deletions(-)
 rename zookeeper-server/src/test/java/org/apache/zookeeper/server/{ => quorum}/FollowerRequestProcessorTest.java (100%)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
index 5c74caa122b..4a1f87d4939 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
@@ -33,8 +33,13 @@ public class ResponseCache {
     public static final int DEFAULT_RESPONSE_CACHE_SIZE = 400;
     private final int cacheSize;
     private static class Entry {
-        public Stat stat;
-        public byte[] data;
+        public final Stat stat;
+        public final byte[] data;
+
+        Entry(Stat stat, byte[] data) {
+            this.stat = stat;
+            this.data = data;
+        }
     }
 
     private final Map<String, Entry> cache;
@@ -50,10 +55,7 @@ public int getCacheSize() {
     }
 
     public void put(String path, byte[] data, Stat stat) {
-        Entry entry = new Entry();
-        entry.data = data;
-        entry.stat = stat;
-        cache.put(path, entry);
+        cache.put(path, new Entry(stat, data));
     }
 
     public byte[] get(String key, Stat stat) {
@@ -76,10 +78,10 @@ public boolean isEnabled() {
 
     private static class LRUCache<K, V> extends LinkedHashMap<K, V> {
 
-        private int cacheSize;
+        private final int cacheSize;
 
         LRUCache(int cacheSize) {
-            super(cacheSize / 4);
+            super(cacheSize / 4, 0.75f, true);
             this.cacheSize = cacheSize;
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessorTest.java
similarity index 100%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/server/FollowerRequestProcessorTest.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessorTest.java
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
index 4b16394057f..32af00ae841 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
@@ -79,6 +79,7 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
         Stat writeStat = new Stat();
         Stat readStat = new Stat();
         byte[] readData = null;
+        int cacheSize = Integer.getInteger(ZooKeeperServer.GET_DATA_RESPONSE_CACHE_SIZE);
         int reads = 10;
         long expectedHits = 0;
         long expectedMisses = 0;
@@ -88,7 +89,7 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
         LOG.info("caching: {}", useCache);
 
         if (useCache) {
-            assertEquals(zks.getReadResponseCache().getCacheSize(), 32);
+            assertEquals(zks.getReadResponseCache().getCacheSize(), cacheSize);
             assertEquals(zks.getGetChildrenResponseCache().getCacheSize(), 64);
         }
 
@@ -146,15 +147,21 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
         createPath(path + "/a/b/e/g", zk);
         createPath(path + "/a/b/e/h", zk);
 
+        createPath(path + "/x", zk);
+        for (int i = 0; i < cacheSize * 2; ++i) {
+            createPath(path + "/x/y" + i, zk);
+        }
+
         checkPath(path + "/a", zk, 2);
         checkPath(path + "/a/b", zk, 2);
         checkPath(path + "/a/c", zk, 0);
         checkPath(path + "/a/b/d", zk, 0);
         checkPath(path + "/a/b/e", zk, 3);
         checkPath(path + "/a/b/e/h", zk, 0);
+        checkPath(path + "/x", zk, cacheSize * 2);
 
         if (useCache) {
-            expectedMisses += 6;
+            expectedMisses += 7;
         }
 
         checkCacheStatus(expectedHits, expectedMisses, "response_packet_get_children_cache_hits",
@@ -170,6 +177,19 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
 
         checkCacheStatus(expectedHits, expectedMisses, "response_packet_get_children_cache_hits",
                 "response_packet_get_children_cache_misses");
+
+        for (int i = 0; i < cacheSize * 2; ++i) {
+            checkPath(path + "/a", zk, 2);
+            checkPath(path + "/x/y" + i, zk, 0);
+
+            if (useCache) {
+                expectedHits += 1;
+                expectedMisses += 1;
+            }
+
+            checkCacheStatus(expectedHits, expectedMisses, "response_packet_get_children_cache_hits",
+                    "response_packet_get_children_cache_misses");
+        }
     }
 
     private void createPath(String path, ZooKeeper zk) throws Exception {

From ac19f22511ad0c1350df57e53044aae8aeb31406 Mon Sep 17 00:00:00 2001
From: zichen-gan <41944748+zichen-gan@users.noreply.github.com>
Date: Mon, 21 Apr 2025 00:40:42 +0800
Subject: [PATCH 510/591] ZOOKEEPER-4886: Fix observer with small myid can't
 join SASL quorum

Reviewers: kezhuw, anmolnar
Author: zichen-gan
Closes #2211 from zichen-gan/SASLSmallObserverCanotJion
---
 .../server/quorum/QuorumCnxManager.java       |  2 +-
 .../quorum/auth/QuorumAuthObserverTest.java   | 87 +++++++++++++++++++
 .../quorum/auth/QuorumAuthTestBase.java       | 37 ++++++--
 3 files changed, 118 insertions(+), 8 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index eb5346af4bf..a4faeb1333f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -503,7 +503,7 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
         }
 
         // authenticate learner
-        QuorumPeer.QuorumServer qps = self.getVotingView().get(sid);
+        QuorumPeer.QuorumServer qps = self.getView().get(sid);
         if (qps != null) {
             // TODO - investigate why reconfig makes qps null.
             authLearner.authenticate(sock, qps.hostname);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java
new file mode 100644
index 00000000000..8660558adf5
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum.auth;
+
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+public class QuorumAuthObserverTest extends DigestSecurityTestcase {
+
+    static {
+        String jaasEntries = "QuorumServer {\n"
+                             + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
+                             + "       user_test=\"mypassword\";\n"
+                             + "};\n"
+                             + "QuorumLearner {\n"
+                             + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
+                             + "       username=\"test\"\n"
+                             + "       password=\"mypassword\";\n"
+                             + "};\n";
+        setupJaasConfig(jaasEntries);
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        shutdownAll();
+        super.tearDown();
+    }
+
+    @AfterAll
+    public static void cleanup() {
+        cleanupJaasConfig();
+    }
+
+    /**
+     * Test to ensure observer with small myid can join SASL quorum.
+     * peer0 myid�11 participant
+     * peer1 myid�21 participant
+     * peer2 myid�1 observer
+     */
+    @Test
+    public void testSmallObserverJoinSASLQuorum() throws Exception {
+        Map<String, String> authConfigs = new HashMap<>();
+        authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
+
+        // create quorum
+        StringBuilder connectStringBuilder = new StringBuilder();
+        int[] myidList = {11, 21, 1};
+        String[] roleList = {"participant", "participant", "observer"};
+        int[] clientPorts = startQuorum(3, connectStringBuilder, authConfigs, 3, false, myidList, roleList);
+
+        // observer with small myid should have joined the quorum
+        String connectStr = "127.0.0.1:" + clientPorts[2];
+        CountdownWatcher watcher = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(connectStr, ClientBase.CONNECTION_TIMEOUT, watcher);
+        watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+        zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.close();
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
index f1a9bcac8d6..dfc12d8f1f4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
@@ -103,16 +103,28 @@ protected String startQuorum(
     }
 
     protected int[] startQuorum(final int serverCount, StringBuilder connectStr, Map<String, String> authConfigs,
-        int authServerCount, boolean multiAddress) throws IOException {
+                                int authServerCount, boolean multiAddress) throws IOException {
+        int[] defaultMyidList = new int[serverCount];
+        String[] defaultRoleList = new String[serverCount];
+        for (int i = 0; i < serverCount; i++) {
+            defaultMyidList[i] = i;
+            defaultRoleList[i] = "participant";
+        }
+        return startQuorum(serverCount, connectStr, authConfigs, authServerCount, multiAddress, defaultMyidList, defaultRoleList);
+    }
+
+    protected int[] startQuorum(final int serverCount, StringBuilder connectStr, Map<String, String> authConfigs,
+        int authServerCount, boolean multiAddress, int[] myidList, String[] roleList) throws IOException {
         final int[] clientPorts = new int[serverCount];
         StringBuilder sb = new StringBuilder();
         for (int i = 0; i < serverCount; i++) {
             clientPorts[i] = PortAssignment.unique();
-            String server = String.format("server.%d=localhost:%d:%d", i, PortAssignment.unique(), PortAssignment.unique());
+            String server = String.format("server.%d=localhost:%d:%d", myidList[i], PortAssignment.unique(), PortAssignment.unique());
             if (multiAddress) {
                 server = server + String.format("|localhost:%d:%d", PortAssignment.unique(), PortAssignment.unique());
             }
-            sb.append(server + ":participant\n");
+
+            sb.append(server + ":" + roleList[i] + "\n");
             connectStr.append("127.0.0.1:" + clientPorts[i]);
             if (i < serverCount - 1) {
                 connectStr.append(",");
@@ -122,11 +134,11 @@ protected int[] startQuorum(final int serverCount, StringBuilder connectStr, Map
         // servers with authentication interfaces configured
         int i = 0;
         for (; i < authServerCount; i++) {
-            startServer(authConfigs, clientPorts, quorumCfg, i);
+            startServer(authConfigs, clientPorts, quorumCfg, i, myidList);
         }
         // servers without any authentication configured
         for (int j = 0; j < serverCount - authServerCount; j++, i++) {
-            MainThread mthread = new MainThread(i, clientPorts[i], quorumCfg);
+            MainThread mthread = new MainThread(myidList[i], clientPorts[i], quorumCfg);
             mt.add(mthread);
             mthread.start();
         }
@@ -137,8 +149,9 @@ private void startServer(
         Map<String, String> authConfigs,
         final int[] clientPorts,
         String quorumCfg,
-        int i) throws IOException {
-        MainThread mthread = new MainThread(i, clientPorts[i], quorumCfg, authConfigs);
+        int i,
+        int[] myidList) throws IOException {
+        MainThread mthread = new MainThread(myidList[i], clientPorts[i], quorumCfg, authConfigs);
         mt.add(mthread);
         mthread.start();
     }
@@ -149,6 +162,16 @@ protected void startServer(MainThread restartPeer, Map<String, String> authConfi
         mthread.start();
     }
 
+    protected void startServer(
+            Map<String, String> authConfigs,
+            final int clientPort,
+            String quorumCfg,
+            int myid) throws IOException {
+        MainThread mthread = new MainThread(myid, clientPort, quorumCfg, authConfigs);
+        mt.add(mthread);
+        mthread.start();
+    }
+
     void shutdownAll() {
         for (int i = 0; i < mt.size(); i++) {
             shutdown(i);

From 840a666cea95bb0c1e3cf59a83d9a112ae1c3dbe Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Fri, 25 Apr 2025 09:59:12 +0800
Subject: [PATCH 511/591] ZOOKEEPER-4920: Fix flaky test
 ZooKeeperServerMaxCnxnsTest

Reviewers: cnauroth
Author: kezhuw
Closes #2249 from kezhuw/ZOOKEEPER-4920-fix-flaky-ZooKeeperServerMaxCnxnsTest
---
 .../server/ZooKeeperServerMaxCnxnsTest.java          | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
index fdb0b381f15..35fe62bdc30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
@@ -67,7 +67,7 @@ public void testMaxZooKeeperClientsWithNettyServerCnxnFactory() throws Exception
 
     private void testMaxZooKeeperClients(String serverCnxnFactory) throws Exception {
         final int clientPorts[] = new int[SERVER_COUNT];
-        int maxCnxns = 2;
+        final int maxCnxns = 2;
         StringBuilder sb = new StringBuilder();
         sb.append("maxCnxns=" + maxCnxns + "\n");
         sb.append("serverCnxnFactory=" + serverCnxnFactory + "\n");
@@ -108,9 +108,13 @@ public void process(WatchedEvent event) {
                 }
             }
         };
-        for (int i = 0; i < maxAllowedConnection; i++) {
-            clients[i] = new ZooKeeper(cxnString, ClientBase.CONNECTION_TIMEOUT, watcher);
-            Thread.sleep(100);
+        // There are could be concurrent races to make maxCnxns restriction not accurate.
+        // So we connect to each server with maxCnxns connections to overcome this.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            String addr = "127.0.0.1:" + clientPorts[i];
+            for (int j = 0; j < maxCnxns; j++) {
+                clients[i * maxCnxns + j] = new ZooKeeper(addr, ClientBase.CONNECTION_TIMEOUT, watcher);
+            }
         }
         countDownLatch.await();
         // reaching this point indicates that all maxAllowedConnection connected

From bf71704249f447601926d96592075809dcb1e8e9 Mon Sep 17 00:00:00 2001
From: SSSDNSY <736259020@qq.com>
Date: Wed, 30 Apr 2025 11:13:58 +0800
Subject: [PATCH 512/591] ZOOKEEPER-4924: Fix double "the" word typos (#2251)

---
 .../zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java  | 2 +-
 .../java/org/apache/zookeeper/server/quorum/QuorumPeer.java     | 2 +-
 .../java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java | 2 +-
 .../test/java/org/apache/zookeeper/server/ZxidRolloverTest.java | 2 +-
 .../java/org/apache/zookeeper/server/quorum/WatchLeakTest.java  | 2 +-
 .../test/java/org/apache/zookeeper/test/ClientPortBindTest.java | 2 +-
 .../src/test/java/org/apache/zookeeper/test/RecoveryTest.java   | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
index 60070e66ff5..fb9e5eb6c9f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -116,7 +116,7 @@ public void start() {
                 }
             };
 
-            // Start and schedule the the purge task
+            // Start and schedule the purge task
             purgeMgr = new DatadirCleanupManager(config
                     .getDataDir(), config.getDataLogDir(), config
                     .getSnapRetainCount(), config.getPurgeIntervalInMs());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 786450d35a5..9a18d59d401 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1570,7 +1570,7 @@ public void run() {
                             LOG.warn("Unexpected exception", e);
                             setPeerState(ServerState.LOOKING);
                         } finally {
-                            // If the thread is in the the grace period, interrupt
+                            // If the thread is in the grace period, interrupt
                             // to come out of waiting.
                             roZkMgr.interrupt();
                             roZk.shutdown();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 8a5bb9ccd54..59b7481ad51 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -125,7 +125,7 @@ protected void initializeAndRun(String[] args) throws ConfigException, IOExcepti
             config.parse(args[0]);
         }
 
-        // Start and schedule the the purge task
+        // Start and schedule the purge task
         DatadirCleanupManager purgeMgr = new DatadirCleanupManager(
             config.getDataDir(),
             config.getDataLogDir(),
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
index 031ccc2f7da..0081b1331b8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
@@ -192,7 +192,7 @@ private void shutdown(int idx) throws Exception {
         assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT),
                 "Waiting for server down");
 
-        // if idx is the the leader then everyone will get disconnected,
+        // if idx is the leader then everyone will get disconnected,
         // otherwise if idx is a follower then just that client will get
         // disconnected
         if (idx == idxLeader) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index 8db90a2482e..228527980da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -128,7 +128,7 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
             // OK, now the follower knows that the session is valid or invalid, let's try
             // to send the watches
             nioCnxn.doIO(sk);
-            // wait for the the request processor to do his job
+            // wait for the request processor to do his job
             Thread.sleep(1000L);
             LOG.info("Watches processed");
             // If session has not been validated, there must be NO watches
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
index 5061c5f4df3..99f195b3606 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
@@ -84,7 +84,7 @@ public void testBindByAddress(@TempDir File tmpDir) throws Exception {
 
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(new InetSocketAddress(bindAddress, PORT), -1);
         f.startup(zks);
-        LOG.info("starting up the the server, waiting");
+        LOG.info("starting up the server, waiting");
 
         assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
index 3f8fa9add1c..fb38dd4b9ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
@@ -73,7 +73,7 @@ public void testRecovery(@TempDir File tmpDir) throws Exception {
             final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
             ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
             f.startup(zks);
-            LOG.info("starting up the the server, waiting");
+            LOG.info("starting up the server, waiting");
 
             assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 

From 6e4d69006298a21896835dcdce678f37acc191b5 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Fri, 9 May 2025 22:45:15 +0800
Subject: [PATCH 513/591] ZOOKEEPER-4829: [ADDENDUM] Improve backward
 compatibility for QuorumPeerConfig::getPurgeInterval with 3.9

Reviewers: li4wang, tisonkun
Author: kezhuw
Closes #2258 from kezhuw/ZOOKEEPER-4829-addendum-improve-backward-compatibility
---
 .../org/apache/zookeeper/common/Time.java     | 24 ++++++++++++++++++-
 .../server/DatadirCleanupManager.java         |  3 ++-
 .../server/quorum/QuorumPeerConfig.java       | 10 ++++++++
 .../org/apache/zookeeper/common/TimeTest.java | 23 ++++++++++++++++++
 4 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
index 9abe4d6a831..5916cd22926 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
@@ -64,7 +64,6 @@ public static Date elapsedTimeToDate(long elapsedTime) {
      * @param str the interval string
      * @return interval in milliseconds
      */
-
     public static int parseTimeInterval(String str) {
         try {
             int len = str.length();
@@ -95,4 +94,27 @@ public static int parseTimeInterval(String str) {
         }
     }
 
+    /**
+     * Format milliseconds time interval with the highest time unit suffix.
+     *
+     * <p>See {@link #parseTimeInterval(String)} for supported suffixes.
+     *
+     * @param ms milliseconds
+     * @return string formatted with the highest time unit suffix or "0" if {@code ms} is 0
+     */
+    public static String formatTimeIntervalMs(long ms) {
+        if (ms == 0) {
+            return "0";
+        } else if (ms % DAY == 0) {
+            return ms / DAY + "d";
+        } else if (ms % HOUR == 0) {
+            return ms / HOUR + "h";
+        } else if (ms % MINUTE == 0) {
+            return ms / MINUTE + "m";
+        } else if (ms % SECOND == 0) {
+            return ms / SECOND + "s";
+        } else {
+            return ms + "ms";
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
index ac714ee0773..acb6e6ad60e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
@@ -21,6 +21,7 @@
 import java.io.File;
 import java.util.Timer;
 import java.util.TimerTask;
+import org.apache.zookeeper.common.Time;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -75,7 +76,7 @@ public DatadirCleanupManager(File snapDir, File dataLogDir, int snapRetainCount,
         this.snapRetainCount = snapRetainCount;
         this.purgeIntervalInMs = purgeIntervalInMs;
         LOG.info("autopurge.snapRetainCount set to {}", snapRetainCount);
-        LOG.info("autopurge.purgeInterval set to {}", purgeIntervalInMs);
+        LOG.info("autopurge.purgeInterval set to {}", Time.formatTimeIntervalMs(purgeIntervalInMs));
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index 0e9c82d4de7..fe548519d1a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -903,6 +903,16 @@ public int getSnapRetainCount() {
         return snapRetainCount;
     }
 
+    /**
+     * Use {@link #getPurgeIntervalInMs()} instead.
+     *
+     * @return purge interval in hour unit or 0 if less than one hour.
+     */
+    @Deprecated
+    public int getPurgeInterval() {
+        return purgeIntervalInMs / Time.HOUR;
+    }
+
     public int getPurgeIntervalInMs() {
         return purgeIntervalInMs;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
index cc60055a553..c760e3269ea 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
@@ -129,4 +129,27 @@ public void testParseTimeInterval() throws Exception {
         } catch (NumberFormatException e) {
         }
     }
+
+    @Test
+    public void testFormatTimeInterval() throws Exception {
+        assertEquals("0", Time.formatTimeIntervalMs(0));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0ms")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0s")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0m")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0h")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0d")));
+        assertEquals("500ms", Time.formatTimeIntervalMs(Time.parseTimeInterval("500ms")));
+        assertEquals("1m", Time.formatTimeIntervalMs(Time.parseTimeInterval("60s")));
+        assertEquals("61s", Time.formatTimeIntervalMs(Time.parseTimeInterval("61s")));
+        assertEquals("59m", Time.formatTimeIntervalMs(Time.parseTimeInterval("59m")));
+        assertEquals("1h", Time.formatTimeIntervalMs(Time.parseTimeInterval("60m")));
+        assertEquals("2h", Time.formatTimeIntervalMs(Time.parseTimeInterval("120m")));
+        assertEquals("61m", Time.formatTimeIntervalMs(Time.parseTimeInterval("61m")));
+        assertEquals("23h", Time.formatTimeIntervalMs(Time.parseTimeInterval("23h")));
+        assertEquals("1d", Time.formatTimeIntervalMs(Time.parseTimeInterval("24h")));
+        assertEquals("2d", Time.formatTimeIntervalMs(Time.parseTimeInterval("48h")));
+        assertEquals("25h", Time.formatTimeIntervalMs(Time.parseTimeInterval("25h")));
+        assertEquals("2d", Time.formatTimeIntervalMs(Time.parseTimeInterval("2d")));
+    }
 }

From 2aaeff840e8e5b61a30530b261b8c05c181d078f Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Sun, 11 May 2025 04:16:38 +0200
Subject: [PATCH 514/591] ZOOKEEPER-4912: Remove default TLS cipher overrides

Reviewers: cnauroth, anmolnar, kezhuw
Author: stoty
Closes #2239 from stoty/ZOOKEEPER-4912
---
 .../main/resources/markdown/zookeeperAdmin.md | 16 ++++-
 .../zookeeper/common/ClientX509Util.java      | 17 +++--
 .../common/SSLContextAndOptions.java          |  2 +-
 .../org/apache/zookeeper/common/X509Util.java | 60 +----------------
 .../apache/zookeeper/common/X509UtilTest.java | 66 -------------------
 5 files changed, 28 insertions(+), 133 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 70ce27b7212..a4fccf1f94e 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -43,6 +43,7 @@ limitations under the License.
         * [Advanced Configuration](#sc_advancedConfiguration)
         * [Cluster Options](#sc_clusterOptions)
         * [Encryption, Authentication, Authorization Options](#sc_authOptions)
+            * [TLS Cipher Suites](#sc_tls_cipher_suites)
         * [Experimental Options/Features](#Experimental+Options%2FFeatures)
         * [Unsafe Options](#Unsafe+Options)
         * [Disabling data directory autocreation](#Disabling+data+directory+autocreation)
@@ -1738,7 +1739,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (Java system properties: **zookeeper.ssl.ciphersuites** and **zookeeper.ssl.quorum.ciphersuites**)
     **New in 3.5.5:**
     Specifies the enabled cipher suites to be used in client and quorum TLS negotiation.
-    Default: Enabled cipher suites depend on the Java runtime version being used.
+    Default: JDK defaults since 3.10.0, and hard coded cipher suites for 3.9 and earlier versions. See [TLS Cipher Suites](#sc_tls_cipher_suites).
 
 * *ssl.context.supplier.class* and *ssl.quorum.context.supplier.class* :
     (Java system properties: **zookeeper.ssl.context.supplier.class** and **zookeeper.ssl.quorum.context.supplier.class**)
@@ -1877,6 +1878,19 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     
     Default: **true** (3.9.0+), **false** (3.8.x)
 
+<a name="sc_tls_cipher_suites"></a>
+
+##### TLS Cipher Suites
+
+From 3.5.5 to 3.9 a hard coded default cipher list was used, with the ordering
+dependent on whether it is run Java 8 or a later version.
+
+The list on Java 8 includes TLSv1.2 CBC, GCM and TLSv1.3 ciphers in ordering: *TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256*
+
+The list on Java 9+ includes TLSv1.2 GCM, CBC and TLSv1.3 ciphers in ordering: *TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256*
+
+Since 3.10 there is no hardcoded list, and the JDK defaults are used.
+
 <a name="Experimental+Options%2FFeatures"></a>
 
 #### Experimental Options/Features
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 7bb45390382..9aa03ae491a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -80,7 +80,10 @@ public SslContext createNettySslContextForClient(ZKConfig config)
         }
 
         sslContextBuilder.enableOcsp(config.getBoolean(getSslOcspEnabledProperty()));
-        sslContextBuilder.protocols(getEnabledProtocols(config));
+        String[] enabledProtocols = getEnabledProtocols(config);
+        if (enabledProtocols != null) {
+            sslContextBuilder.protocols(enabledProtocols);
+        }
         Iterable<String> enabledCiphers = getCipherSuites(config);
         if (enabledCiphers != null) {
             sslContextBuilder.ciphers(enabledCiphers);
@@ -121,7 +124,10 @@ public SslContext createNettySslContextForServer(ZKConfig config, KeyManager key
         }
 
         sslContextBuilder.enableOcsp(config.getBoolean(getSslOcspEnabledProperty()));
-        sslContextBuilder.protocols(getEnabledProtocols(config));
+        String[] enabledProtocols = getEnabledProtocols(config);
+        if (enabledProtocols != null) {
+            sslContextBuilder.protocols(enabledProtocols);
+        }
         sslContextBuilder.clientAuth(getClientAuth(config).toNettyClientAuth());
         Iterable<String> enabledCiphers = getCipherSuites(config);
         if (enabledCiphers != null) {
@@ -155,7 +161,7 @@ protected void initEngine(SSLEngine sslEngine) {
     private String[] getEnabledProtocols(final ZKConfig config) {
         String enabledProtocolsInput = config.getProperty(getSslEnabledProtocolsProperty());
         if (enabledProtocolsInput == null) {
-            return new String[]{ config.getProperty(getSslProtocolProperty(), DEFAULT_PROTOCOL) };
+            return null;
         }
         return enabledProtocolsInput.split(",");
     }
@@ -167,10 +173,7 @@ private X509Util.ClientAuth getClientAuth(final ZKConfig config) {
     private Iterable<String> getCipherSuites(final ZKConfig config) {
         String cipherSuitesInput = config.getProperty(getSslCipherSuitesProperty());
         if (cipherSuitesInput == null) {
-            if (getSslProvider(config) != SslProvider.JDK) {
-                return null;
-            }
-            return Arrays.asList(X509Util.getDefaultCipherSuites());
+            return null;
         } else {
             return Arrays.asList(cipherSuitesInput.split(","));
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
index 3a254255292..c712f6acb6c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
@@ -160,7 +160,7 @@ private String[] getEnabledProtocols(final ZKConfig config, final SSLContext ssl
     private String[] getCipherSuites(final ZKConfig config) {
         String cipherSuitesInput = config.getProperty(x509Util.getSslCipherSuitesProperty());
         if (cipherSuitesInput == null) {
-            return X509Util.getDefaultCipherSuites();
+            return null;
         } else {
             return cipherSuitesInput.split(",");
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 17818207e9e..153a826ba4f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -36,16 +36,13 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
-import java.util.Objects;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
-import java.util.stream.Collectors;
 import javax.net.ssl.CertPathTrustManagerParameters;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLServerSocket;
-import javax.net.ssl.SSLServerSocketFactory;
 import javax.net.ssl.SSLSocket;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
@@ -62,11 +59,6 @@
 
 /**
  * Utility code for X509 handling
- *
- * Default cipher suites:
- *
- *   Performance testing done by Facebook engineers shows that on Intel x86_64 machines, Java9 performs better with
- *   GCM and Java8 performs better with CBC, so these seem like reasonable defaults.
  */
 public abstract class X509Util implements Closeable, AutoCloseable {
 
@@ -102,6 +94,8 @@ private static String defaultTlsProtocol() {
         List<String> supported = new ArrayList<>();
         try {
             supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
+            // We cannot use the default protocols directly, because the SSLContext factory methods
+            // only accept a single protocol
             if (supported.contains(TLS_1_3)) {
                 defaultProtocol = TLS_1_3;
             }
@@ -112,36 +106,6 @@ private static String defaultTlsProtocol() {
         return defaultProtocol;
     }
 
-    // ChaCha20 was introduced in OpenJDK 11.0.15 and it is not supported by JDK8.
-    private static String[] getTLSv13Ciphers() {
-        return new String[]{"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256"};
-    }
-
-    private static String[] getGCMCiphers() {
-        return new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"};
-    }
-
-    private static String[] getCBCCiphers() {
-        return new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"};
-    }
-
-    /**
-     * Returns a filtered set of ciphers, where ciphers not supported by the JDK are removed.
-     */
-    private static String[] getSupportedCiphers(String[]... cipherLists) {
-        List<String> supported = Arrays.asList(
-            ((SSLServerSocketFactory) SSLServerSocketFactory.getDefault()).getSupportedCipherSuites());
-
-        return Arrays.stream(cipherLists).flatMap(Arrays::stream).filter(supported::contains).collect(Collectors.toList()).toArray(new String[0]);
-    }
-
-    // On Java 8, prefer CBC ciphers since AES-NI support is lacking and GCM is slower than CBC.
-    private static final String[] DEFAULT_CIPHERS_JAVA8 = getSupportedCiphers(getCBCCiphers(), getGCMCiphers(), getTLSv13Ciphers());
-    // On Java 9 and later, prefer GCM ciphers due to improved AES-NI support.
-    // Note that this performance assumption might not hold true for architectures other than x86_64.
-    // TLSv1.3 ciphers can be added at the end of the list without impacting the priority of TLSv1.3 vs TLSv1.2.
-    private static final String[] DEFAULT_CIPHERS_JAVA9 = getSupportedCiphers(getGCMCiphers(), getCBCCiphers(), getTLSv13Ciphers());
-
     public static final int DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS = 5000;
 
     /**
@@ -636,26 +600,6 @@ public SSLServerSocket createSSLServerSocket(int port) throws X509Exception, IOE
         return getDefaultSSLContextAndOptions().createSSLServerSocket(port);
     }
 
-    static String[] getDefaultCipherSuites() {
-        return getDefaultCipherSuitesForJavaVersion(System.getProperty("java.specification.version"));
-    }
-
-    static String[] getDefaultCipherSuitesForJavaVersion(String javaVersion) {
-        Objects.requireNonNull(javaVersion);
-        if (javaVersion.matches("\\d+")) {
-            // Must be Java 9 or later
-            LOG.debug("Using Java9+ optimized cipher suites for Java version {}", javaVersion);
-            return DEFAULT_CIPHERS_JAVA9;
-        } else if (javaVersion.startsWith("1.")) {
-            // Must be Java 1.8 or earlier
-            LOG.debug("Using Java8 optimized cipher suites for Java version {}", javaVersion);
-            return DEFAULT_CIPHERS_JAVA8;
-        } else {
-            LOG.debug("Could not parse java version {}, using Java8 optimized cipher suites", javaVersion);
-            return DEFAULT_CIPHERS_JAVA8;
-        }
-    }
-
     private FileChangeWatcher newFileChangeWatcher(String fileLocation) throws IOException {
         if (fileLocation == null || fileLocation.isEmpty()) {
             return null;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index 1218a00de30..e4f19d77fd1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -829,72 +829,6 @@ public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent)
         });
     }
 
-    @ParameterizedTest
-    @MethodSource("data")
-    public void testGetDefaultCipherSuitesJava8(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("1.8");
-        // Java 8 default should have the CBC suites first
-        assertTrue(cipherSuites[0].contains("CBC"));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    public void testGetDefaultCipherSuitesJava9(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("9");
-        // Java 9+ default should have the GCM suites first
-        assertTrue(cipherSuites[0].contains("GCM"));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    public void testGetDefaultCipherSuitesJava10(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("10");
-        // Java 9+ default should have the GCM suites first
-        assertTrue(cipherSuites[0].contains("GCM"));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    public void testGetDefaultCipherSuitesJava11(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("11");
-        // Java 9+ default should have the GCM suites first
-        assertTrue(cipherSuites[0].contains("GCM"));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    public void testGetDefaultCipherSuitesUnknownVersion(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("notaversion");
-        // If version can't be parsed, use the more conservative Java 8 default
-        assertTrue(cipherSuites[0].contains("CBC"));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    public void testGetDefaultCipherSuitesNullVersion(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        assertThrows(NullPointerException.class, () -> {
-            X509Util.getDefaultCipherSuitesForJavaVersion(null);
-        });
-    }
-
     // Warning: this will reset the x509Util
     private void setCustomCipherSuites() {
         System.setProperty(x509Util.getCipherSuitesProperty(), customCipherSuites[0] + "," + customCipherSuites[1]);

From aeadf574c0463e7e3db092b588033d8347989d4c Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Mon, 12 May 2025 09:23:19 +0800
Subject: [PATCH 515/591] ZOOKEEPER-4928: Fix ZOO_VERSION not updated during
 mvn release:prepare

Reviewers: eolivelli, tisonkun
Author: kezhuw
Closes #2259 from kezhuw/ZOOKEEPER-4928-fix-ZOO_VERSION-not-updated-during-release
---
 zookeeper-client/zookeeper-client-c/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
index 4550be26501..91e45cff3e8 100644
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -124,7 +124,7 @@
             </goals>
             <configuration>
                <target>
-                  <replaceregexp file="include/zookeeper_version.h" match="project.*" replace="project(zookeeper VERSION ${project.version})" byline="true" />
+                  <replaceregexp file="include/zookeeper_version.h" match="\#define ZOO_VERSION.*" replace="#define ZOO_VERSION &quot;${project.version}&quot;" byline="true" />
                   <replace file="include/zookeeper_version.h" value="">
                       <replaceToken>-SNAPSHOT</replaceToken>
                   </replace>

From 524f1d750c62920f5fafdb3ee5abf9f69ff54e41 Mon Sep 17 00:00:00 2001
From: Yongming Zhang <99642933+damumu0625@users.noreply.github.com>
Date: Thu, 5 Jun 2025 09:03:13 +0800
Subject: [PATCH 516/591] Fix client connection rejected due to throttler token
 overflow

Reviewers: kezhuw, tisonkun, li4wang
Author: damumu0625
Closes #2264 from damumu0625/ZOOKEEPER-4933
---
 .../java/org/apache/zookeeper/server/BlueThrottle.java   | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
index 68b7279cc20..f2d249fc895 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
@@ -325,8 +325,13 @@ public synchronized boolean checkLimit(int need) {
         long diff = now - lastTime;
 
         if (diff > fillTime) {
-            int refill = (int) (diff * fillCount / fillTime);
-            tokens = Math.min(tokens + refill, maxTokens);
+            long refill = diff * fillCount / fillTime;
+            tokens = (int) Math.min(tokens + refill, maxTokens);
+            if (tokens < 0) {
+                tokens = maxTokens;
+                LOG.error("Throttle config values {}({}) and {}({}) are insane and cause long integer overflow after {}ms",
+                        CONNECTION_THROTTLE_FILL_TIME, fillTime, CONNECTION_THROTTLE_FILL_COUNT, fillCount, diff);
+            }
             lastTime = now;
         }
 

From e5dd60bf0512ccc1e090d99410a8da48623219da Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Wed, 11 Jun 2025 01:36:56 +0800
Subject: [PATCH 517/591] ZOOKEEPER-4925: Fix data loss due to propagation of
 discontinuous committedLog (#2254)

There are two variants of `ZooKeeperServer::processTxn`. Those two
variants diverge significantly since ZOOKEEPER-3484.
`processTxn(Request request)` pops outstanding change from
`outstandingChanges` and adds txn to `committedLog` for follower to sync
in addition to what `processTxn(TxnHeader hdr, Record txn)` does. The
`Learner` uses `processTxn(TxnHeader hdr, Record txn)` to commit txn to
memory after ZOOKEEPER-4394, which means it leaves `committedLog`
untouched in `SYNCHRONIZATION` phase.

This way, a stale follower will have hole in its `committedLog` after
joining cluster. The stale follower will propagate the in memory hole
to other stale nodes after becoming leader. This causes data loss.

The test case fails on master and 3.9.3, and passes on 3.9.2. So only
3.9.3 is affected.

This commit drops `processTxn(TxnHeader hdr, Record txn)` as
`processTxn(Request request)` is capable in `SYNCHRONIZATION` phase too.

Also, this commit rejects discontinuous proposals in `syncWithLeader`
and `committedLog`, so to avoid possible data loss.

Refs: ZOOKEEPER-4925, ZOOKEEPER-4394, ZOOKEEPER-3484

Reviewers: li4wang
Author: kezhuw
Closes #2254 from kezhuw/ZOOKEEPER-4925-fix-data-loss
---
 .../org/apache/zookeeper/server/Request.java  |  13 +++
 .../apache/zookeeper/server/TxnLogEntry.java  |   4 +
 .../apache/zookeeper/server/ZKDatabase.java   |  28 +++--
 .../zookeeper/server/ZooKeeperServer.java     |  21 ++--
 .../zookeeper/server/quorum/Follower.java     |   4 +-
 .../quorum/FollowerZooKeeperServer.java       |  34 ++----
 .../zookeeper/server/quorum/Learner.java      |  58 ++++++----
 .../zookeeper/server/quorum/Observer.java     |  11 +-
 .../zookeeper/server/TxnLogDigestTest.java    |   2 +
 .../zookeeper/server/ZxidRolloverTest.java    |   2 +
 .../server/quorum/QuorumSyncTest.java         | 100 ++++++++++++++++++
 11 files changed, 196 insertions(+), 81 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index c8b404e7928..8b61091719d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -78,6 +78,19 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
         this.authInfo = null;
     }
 
+    public Request(TxnHeader hdr, Record txn, TxnDigest digest) {
+        this.sessionId = hdr.getClientId();
+        this.cxid = hdr.getCxid();
+        this.type = hdr.getType();
+        this.hdr = hdr;
+        this.txn = txn;
+        this.zxid = hdr.getZxid();
+        this.request = null;
+        this.cnxn = null;
+        this.authInfo = null;
+        this.txnDigest = digest;
+    }
+
     public final long sessionId;
 
     public final int cxid;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java
index 352eb81da90..409fd21fa91 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java
@@ -47,4 +47,8 @@ public TxnHeader getHeader() {
     public TxnDigest getDigest() {
         return digest;
     }
+
+    public Request toRequest() {
+        return new Request(header, txn, digest);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index c27ac6aa83b..2fd67da5063 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -58,6 +58,7 @@
 import org.apache.zookeeper.server.quorum.Leader.PureRequestProposal;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.SerializeUtils;
+import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.slf4j.Logger;
@@ -82,6 +83,8 @@ public class ZKDatabase {
     protected FileTxnSnapLog snapLog;
     protected long minCommittedLog, maxCommittedLog;
 
+    private final boolean allowDiscontinuousProposals = Boolean.getBoolean("zookeeper.test.allowDiscontinuousProposals");
+
     /**
      * Default value is to use snapshot if txnlog size exceeds 1/3 the size of snapshot
      */
@@ -170,8 +173,6 @@ public boolean isInitialized() {
      * data structures in zkdatabase.
      */
     public void clear() {
-        minCommittedLog = 0;
-        maxCommittedLog = 0;
         /* to be safe we just create a new
          * datatree.
          */
@@ -182,6 +183,8 @@ public void clear() {
         try {
             lock.lock();
             committedLog.clear();
+            minCommittedLog = 0;
+            maxCommittedLog = 0;
         } finally {
             lock.unlock();
         }
@@ -320,17 +323,30 @@ public void addCommittedProposal(Request request) {
         WriteLock wl = logLock.writeLock();
         try {
             wl.lock();
-            if (committedLog.size() > commitLogCount) {
-                committedLog.remove();
-                minCommittedLog = committedLog.peek().getZxid();
-            }
             if (committedLog.isEmpty()) {
                 minCommittedLog = request.zxid;
                 maxCommittedLog = request.zxid;
+            } else if (request.zxid <= maxCommittedLog) {
+                // This could happen if lastProcessedZxid is rewinded and database is re-synced.
+                // Currently, it only happens in test codes, but it should also be safe for production path.
+                return;
+            } else if (!allowDiscontinuousProposals
+                    && request.zxid != maxCommittedLog + 1
+                    && ZxidUtils.getEpochFromZxid(request.zxid) <= ZxidUtils.getEpochFromZxid(maxCommittedLog)) {
+                String msg = String.format(
+                    "Committed proposal cached out of order: 0x%s is not the next proposal of 0x%s",
+                    ZxidUtils.zxidToString(request.zxid),
+                    ZxidUtils.zxidToString(maxCommittedLog));
+                LOG.error(msg);
+                throw new IllegalStateException(msg);
             }
             PureRequestProposal p = new PureRequestProposal(request);
             committedLog.add(p);
             maxCommittedLog = p.getZxid();
+            if (committedLog.size() > commitLogCount) {
+                committedLog.remove();
+                minCommittedLog = committedLog.peek().getZxid();
+            }
         } finally {
             wl.unlock();
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 1667efd3fbe..11ec1fb7413 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1846,13 +1846,6 @@ private void processSasl(RequestRecord request, ServerCnxn cnxn, RequestHeader r
         cnxn.sendResponse(replyHeader, record, "response");
     }
 
-    // entry point for quorum/Learner.java
-    public ProcessTxnResult processTxn(TxnHeader hdr, Record txn) {
-        processTxnForSessionEvents(null, hdr, txn);
-        return processTxnInDB(hdr, txn, null);
-    }
-
-    // entry point for FinalRequestProcessor.java
     public ProcessTxnResult processTxn(Request request) {
         TxnHeader hdr = request.getHdr();
         processTxnForSessionEvents(request, hdr, request.getTxn());
@@ -1864,8 +1857,10 @@ public ProcessTxnResult processTxn(Request request) {
         if (!writeRequest && !quorumRequest) {
             return new ProcessTxnResult();
         }
+
+        ProcessTxnResult rc;
         synchronized (outstandingChanges) {
-            ProcessTxnResult rc = processTxnInDB(hdr, request.getTxn(), request.getTxnDigest());
+            rc = processTxnInDB(hdr, request.getTxn(), request.getTxnDigest());
 
             // request.hdr is set for write requests, which are the only ones
             // that add to outstandingChanges.
@@ -1886,13 +1881,13 @@ public ProcessTxnResult processTxn(Request request) {
                     }
                 }
             }
+        }
 
-            // do not add non quorum packets to the queue.
-            if (quorumRequest) {
-                getZKDatabase().addCommittedProposal(request);
-            }
-            return rc;
+        // do not add non quorum packets to the queue.
+        if (quorumRequest) {
+            getZKDatabase().addCommittedProposal(request);
         }
+        return rc;
     }
 
     private void processTxnForSessionEvents(Request request, TxnHeader hdr, Record txn) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
index 0eff9d24837..ca99974cb52 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
@@ -35,7 +35,6 @@
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.txn.SetDataTxn;
-import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
 
 /**
@@ -164,7 +163,6 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             TxnLogEntry logEntry = SerializeUtils.deserializeTxn(qp.getData());
             TxnHeader hdr = logEntry.getHeader();
             Record txn = logEntry.getTxn();
-            TxnDigest digest = logEntry.getDigest();
             if (hdr.getZxid() != lastQueued + 1) {
                 LOG.warn(
                     "Got zxid 0x{} expected 0x{}",
@@ -179,7 +177,7 @@ protected void processPacket(QuorumPacket qp) throws Exception {
                 self.setLastSeenQuorumVerifier(qv, true);
             }
 
-            fzk.logRequest(hdr, txn, digest);
+            fzk.logRequest(logEntry.toRequest());
             if (hdr != null) {
                 /*
                  * Request header is created only by the leader, so this is only set
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
index b6766199988..1b0b5cd9276 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
@@ -22,7 +22,6 @@
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.concurrent.LinkedBlockingQueue;
 import javax.management.JMException;
-import org.apache.jute.Record;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.server.ExitCode;
@@ -33,8 +32,6 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.txn.TxnDigest;
-import org.apache.zookeeper.txn.TxnHeader;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -79,20 +76,17 @@ protected void setupRequestProcessors() {
 
     LinkedBlockingQueue<Request> pendingTxns = new LinkedBlockingQueue<>();
 
-    public void logRequest(TxnHeader hdr, Record txn, TxnDigest digest) {
-        final Request request = buildRequestToProcess(hdr, txn, digest);
+    public void logRequest(Request request) {
+        if ((request.zxid & 0xffffffffL) != 0) {
+            pendingTxns.add(request);
+        }
         syncProcessor.processRequest(request);
     }
 
     /**
-     * Build a request for the txn and append it to the transaction log
-     * @param hdr the txn header
-     * @param txn the txn
-     * @param digest the digest of txn
+     * Append txn request to the transaction log directly without go through request processors.
      */
-    public void appendRequest(final TxnHeader hdr, final Record txn, final TxnDigest digest) throws IOException {
-        final Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
-        request.setTxnDigest(digest);
+    public void appendRequest(Request request) throws IOException {
         getZKDatabase().append(request);
     }
 
@@ -188,20 +182,4 @@ protected void unregisterMetrics() {
         rootContext.unregisterGauge("synced_observers");
 
     }
-
-    /**
-     * Build a request for the txn
-     * @param hdr the txn header
-     * @param txn the txn
-     * @param digest the digest of txn
-     * @return a request moving through a chain of RequestProcessors
-     */
-    private Request buildRequestToProcess(final TxnHeader hdr, final Record txn, final TxnDigest digest) {
-        final Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
-        request.setTxnDigest(digest);
-        if ((request.zxid & 0xffffffffL) != 0) {
-            pendingTxns.add(request);
-        }
-        return request;
-    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 1ef99e50aae..adf0ef6e510 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -82,6 +82,10 @@ static class PacketInFlight {
         Record rec;
         TxnDigest digest;
 
+        Request toRequest() {
+            return new Request(hdr, rec, digest);
+        }
+
     }
 
     QuorumPeer self;
@@ -535,6 +539,27 @@ protected long registerWithLeader(int pktType) throws IOException {
         }
     }
 
+    long enforceContinuousProposal(long lastQueued, PacketInFlight pif) throws Exception {
+        if (lastQueued == 0) {
+            LOG.info("DIFF sync got first proposal 0x{}", Long.toHexString(pif.hdr.getZxid()));
+        } else if (pif.hdr.getZxid() != lastQueued + 1) {
+            if (ZxidUtils.getEpochFromZxid(pif.hdr.getZxid()) <= ZxidUtils.getEpochFromZxid(lastQueued)) {
+                String msg = String.format(
+                    "DIFF sync got proposal 0x%s, last queued 0x%s, expected 0x%s",
+                    Long.toHexString(pif.hdr.getZxid()), Long.toHexString(lastQueued),
+                    Long.toHexString(lastQueued + 1));
+                LOG.error(msg);
+                throw new Exception(msg);
+            }
+            // We can't tell whether it is a data loss. Given that new epoch is rare,
+            // log at warn should not be too verbose.
+            LOG.warn("DIFF sync got new epoch proposal 0x{}, last queued 0x{}, expected 0x{}",
+                Long.toHexString(pif.hdr.getZxid()), Long.toHexString(lastQueued),
+                Long.toHexString(lastQueued + 1));
+        }
+        return pif.hdr.getZxid();
+    }
+
     /**
      * Finally, synchronize our history with the Leader (if Follower)
      * or the LearnerMaster (if Observer).
@@ -609,6 +634,8 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
             zk.getZKDatabase().initConfigInZKDatabase(self.getQuorumVerifier());
             zk.createSessionTracker();
 
+            // TODO: Ideally, this should be lastProcessZxid(a.k.a. QuorumPacket::zxid from above), but currently
+            // LearnerHandler does not guarantee this. So, let's be conservative and keep it unchange for now.
             long lastQueued = 0;
 
             // in Zab V1.0 (ZK 3.4+) we might take a snapshot when we get the NEWLEADER message, but in pre V1.0
@@ -630,13 +657,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     pif.hdr = logEntry.getHeader();
                     pif.rec = logEntry.getTxn();
                     pif.digest = logEntry.getDigest();
-                    if (pif.hdr.getZxid() != lastQueued + 1) {
-                        LOG.warn(
-                            "Got zxid 0x{} expected 0x{}",
-                            Long.toHexString(pif.hdr.getZxid()),
-                            Long.toHexString(lastQueued + 1));
-                    }
-                    lastQueued = pif.hdr.getZxid();
+                    lastQueued = enforceContinuousProposal(lastQueued, pif);
 
                     if (pif.hdr.getType() == OpCode.reconfig) {
                         SetDataTxn setDataTxn = (SetDataTxn) pif.rec;
@@ -666,7 +687,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                                 Long.toHexString(qp.getZxid()),
                                 Long.toHexString(pif.hdr.getZxid()));
                         } else {
-                            zk.processTxn(pif.hdr, pif.rec);
+                            zk.processTxn(pif.toRequest());
                             packetsNotLogged.remove();
                         }
                     } else {
@@ -696,18 +717,11 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         packet.rec = logEntry.getTxn();
                         packet.hdr = logEntry.getHeader();
                         packet.digest = logEntry.getDigest();
-                        // Log warning message if txn comes out-of-order
-                        if (packet.hdr.getZxid() != lastQueued + 1) {
-                            LOG.warn(
-                                "Got zxid 0x{} expected 0x{}",
-                                Long.toHexString(packet.hdr.getZxid()),
-                                Long.toHexString(lastQueued + 1));
-                        }
-                        lastQueued = packet.hdr.getZxid();
+                        lastQueued = enforceContinuousProposal(lastQueued, packet);
                     }
                     if (!writeToTxnLog) {
                         // Apply to db directly if we haven't taken the snapshot
-                        zk.processTxn(packet.hdr, packet.rec);
+                        zk.processTxn(packet.toRequest());
                     } else {
                         packetsNotLogged.add(packet);
                         packetsCommitted.add(qp.getZxid());
@@ -780,8 +794,9 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                                 continue;
                             }
                             packetsNotLogged.removeFirst();
-                            fzk.appendRequest(pif.hdr, pif.rec, pif.digest);
-                            fzk.processTxn(pif.hdr, pif.rec);
+                            Request request = pif.toRequest();
+                            fzk.appendRequest(request);
+                            fzk.processTxn(request);
                         }
 
                         // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4646
@@ -823,7 +838,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         if (zk instanceof FollowerZooKeeperServer) {
             FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
             for (PacketInFlight p : packetsNotLogged) {
-                fzk.logRequest(p.hdr, p.rec, p.digest);
+                fzk.logRequest(p.toRequest());
             }
             LOG.info("{} txns have been logged asynchronously", packetsNotLogged.size());
 
@@ -847,8 +862,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     continue;
                 }
                 packetsCommitted.remove();
-                Request request = new Request(p.hdr.getClientId(), p.hdr.getCxid(), p.hdr.getType(), p.hdr, p.rec, -1);
-                request.setTxnDigest(p.digest);
+                Request request = p.toRequest();
                 ozk.commitRequest(request);
             }
         } else {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
index d3aa41b5fc7..334fa54c1bc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
@@ -202,12 +202,8 @@ protected void processPacket(QuorumPacket qp) throws Exception {
         case Leader.INFORM:
             ServerMetrics.getMetrics().LEARNER_COMMIT_RECEIVED_COUNT.add(1);
             logEntry = SerializeUtils.deserializeTxn(qp.getData());
-            hdr = logEntry.getHeader();
-            txn = logEntry.getTxn();
-            digest = logEntry.getDigest();
-            Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, 0);
+            Request request = logEntry.toRequest();
             request.logLatency(ServerMetrics.getMetrics().COMMIT_PROPAGATION_LATENCY);
-            request.setTxnDigest(digest);
             ObserverZooKeeperServer obs = (ObserverZooKeeperServer) zk;
             obs.commitRequest(request);
             break;
@@ -219,13 +215,10 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             byte[] remainingdata = new byte[buffer.remaining()];
             buffer.get(remainingdata);
             logEntry = SerializeUtils.deserializeTxn(remainingdata);
-            hdr = logEntry.getHeader();
             txn = logEntry.getTxn();
-            digest = logEntry.getDigest();
             QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) txn).getData(), UTF_8));
 
-            request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, 0);
-            request.setTxnDigest(digest);
+            request = logEntry.toRequest();
             obs = (ObserverZooKeeperServer) zk;
 
             boolean majorChange = self.processReconfig(qv, suggestedLeaderId, qp.getZxid(), true);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
index 75d6fe68000..b52ea34182a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
@@ -60,6 +60,7 @@ public class TxnLogDigestTest extends ClientBase {
 
     @BeforeEach
     public void setUp() throws Exception {
+        System.setProperty("zookeeper.test.allowDiscontinuousProposals", "true");
         super.setUp();
         server = serverFactory.getZooKeeperServer();
         zk = createClient();
@@ -67,6 +68,7 @@ public void setUp() throws Exception {
 
     @AfterEach
     public void tearDown() throws Exception {
+        System.clearProperty("zookeeper.test.allowDiscontinuousProposals");
         // server will be closed in super.tearDown
         super.tearDown();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
index 0081b1331b8..495c1507e43 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
@@ -60,6 +60,7 @@ private ZooKeeper getClient(int idx) {
     @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.test.allowDiscontinuousProposals", "true");
 
         // set the snap count to something low so that we force log rollover
         // and verify that is working as part of the epoch rollover.
@@ -215,6 +216,7 @@ private void adjustEpochNearEnd() {
 
     @AfterEach
     public void tearDown() throws Exception {
+        System.clearProperty("zookeeper.test.allowDiscontinuousProposals");
         LOG.info("tearDown starting");
         for (int i = 0; i < zkClients.length; i++) {
             zkClients[i].close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java
new file mode 100644
index 00000000000..c4b7720cf92
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java
@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import java.util.Comparator;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.QuorumUtil;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+public class QuorumSyncTest extends ZKTestCase {
+    private QuorumUtil qu;
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        if (qu != null) {
+            qu.shutdownAll();
+        }
+    }
+
+    @Test
+    public void testStaleDiffSync() throws Exception {
+        qu = new QuorumUtil(2);
+        qu.startAll();
+
+        int[] followerIds = qu.getFollowerQuorumPeers()
+            .stream()
+            .sorted(Comparator.comparingLong(QuorumPeer::getMyId).reversed())
+            .mapToInt(peer -> (int) peer.getMyId()).toArray();
+
+        int follower1 = followerIds[0];
+        int follower2 = followerIds[1];
+
+        String leaderConnectString = qu.getConnectString(qu.getLeaderQuorumPeer());
+        try (ZooKeeper zk = ClientBase.createZKClient(leaderConnectString)) {
+            qu.shutdown(follower2);
+
+            for (int i = 0; i < 10; i++) {
+                zk.create("/foo" + i, null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            qu.shutdown(follower1);
+
+            for (int i = 0; i < 10; i++) {
+                zk.create("/bar" + i, null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            qu.restart(follower1);
+        }
+
+        try (ZooKeeper zk = ClientBase.createZKClient(qu.getConnectionStringForServer(follower1))) {
+            for (int i = 0; i < 10; i++) {
+                String path = "/foo" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+
+            for (int i = 0; i < 10; i++) {
+                String path = "/bar" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+        }
+
+        qu.shutdown(qu.getLeaderServer());
+
+        qu.restart(follower2);
+
+        try (ZooKeeper zk = ClientBase.createZKClient(qu.getConnectionStringForServer(follower2))) {
+            for (int i = 0; i < 10; i++) {
+                String path = "/foo" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+
+            for (int i = 0; i < 10; i++) {
+                String path = "/bar" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+        }
+    }
+}

From 4e7b8a3d81a797b986ae3b7759f9c582e5d55691 Mon Sep 17 00:00:00 2001
From: Adam Yi <i@adamyi.com>
Date: Wed, 18 Jun 2025 20:53:59 +0800
Subject: [PATCH 518/591] ZOOKEEPER-4604: Fix missing break in switch branch
 COMPLETION_STRING_STAT

ZOOKEEPER-4604: Creating a COMPLETION_STRING_STAT overrides acl_result completion
c->c is a union so setting c.acl_result would override c.string_stat_result.
However, since they're all function pointers pointing to the same function, this won't
cause any issue as c.string_stat_result is still correct. This might cause issue if we
change the type of these completions in the future.
Reviewers: kezhuw
Author: adamyi
Closes #1912 from adamyi/ZOOKEEPER-4604
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 972215bf009..387608fa406 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -3624,6 +3624,7 @@ static completion_list_t* do_create_completion_entry(zhandle_t *zh, int xid,
         break;
     case COMPLETION_STRING_STAT:
         c->c.string_stat_result = (string_stat_completion_t)dc;
+        break;
     case COMPLETION_ACLLIST:
         c->c.acl_result = (acl_completion_t)dc;
         break;

From 35744f3aa8985d3146afe00a912863614dfcc729 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Wed, 18 Jun 2025 14:51:30 -0700
Subject: [PATCH 519/591] ZOOKEEPER-4930: Add metrics for TTL node deletion
 (#2261)

Author: Li Wang <liwang@apple.com>

Co-authored-by: liwang <liwang@apple.com>
---
 .../main/java/org/apache/zookeeper/server/DataTree.java    | 1 +
 .../java/org/apache/zookeeper/server/ServerMetrics.java    | 7 +++++++
 .../java/org/apache/zookeeper/server/CreateTTLTest.java    | 7 +++++++
 3 files changed, 15 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index 45bbde4f048..d017427a422 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -584,6 +584,7 @@ public void deleteNode(String path, long zxid) throws NoNodeException {
                 containers.remove(path);
             } else if (ephemeralType == EphemeralType.TTL) {
                 ttls.remove(path);
+                ServerMetrics.getMetrics().TTL_NODE_DELETED_COUNT.add(1);
             } else if (owner != 0) {
                 Set<String> nodes = ephemerals.get(owner);
                 if (nodes != null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index e3476ff6dd7..f9b56f5f084 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -269,6 +269,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         JVM_PAUSE_TIME = metricsContext.getSummary("jvm_pause_time_ms", DetailLevel.ADVANCED);
 
         QUOTA_EXCEEDED_ERROR_PER_NAMESPACE = metricsContext.getCounterSet(QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE);
+
+        TTL_NODE_DELETED_COUNT = metricsContext.getCounter("ttl_node_deleted_count");
     }
 
     /**
@@ -547,6 +549,11 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
     public final CounterSet QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
 
+    /**
+     * Count of deleted TTL nodes
+     */
+    public final Counter TTL_NODE_DELETED_COUNT;
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
index ba13a0be573..94045662681 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
@@ -22,11 +22,13 @@
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
@@ -38,6 +40,7 @@
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.proto.CreateResponse;
 import org.apache.zookeeper.proto.CreateTTLRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
@@ -91,6 +94,10 @@ public void testCreate() throws KeeperException, InterruptedException {
         fakeElapsed.set(1000);
         containerManager.checkContainers();
         assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
+
+        // validate deleted TTL nodes count
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertTrue((long) metrics.get("ttl_node_deleted_count") >= 1);
     }
 
     @Test

From 1ebd57b270a0e9be637d9b637591a505e2b0438d Mon Sep 17 00:00:00 2001
From: "George J. Carrette" <gjc@alum.mit.edu>
Date: Mon, 23 Jun 2025 03:18:13 -0400
Subject: [PATCH 520/591] ZOOKEEPER-4556: Add zoo_version_str to return
 ZOO_VERSION for runtime library

ZOOKEEPER-4556: Add zoo_version_str to return ZOO_VERSION for runtime library
This method allows a calling program to determine at runtime whether the
version of the dynamically loaded zookeeper library (a.k.a. zoo_version_str())
is same as the version of the library the calling program was compiled against
(a.k.a. ZOO_VERSION).
Reviewers: eolivelli, kezhuw
Author: gjcarrette
Closes #1893 from gjcarrette/fix/ZOOKEEPER-4556
---
 .../zookeeper-client-c/include/zookeeper.h          | 13 +++++++++++++
 zookeeper-client/zookeeper-client-c/src/zookeeper.c |  8 ++++++++
 .../zookeeper-client-c/tests/TestZookeeperInit.cc   |  6 ++++++
 3 files changed, 27 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 2fa6a7b5065..6d73ccd090d 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -733,6 +733,19 @@ ZOOAPI sasl_callback_t *zoo_sasl_make_password_callbacks(const char *user,
 
 #endif /* HAVE_CYRUS_SASL_H */
 
+
+/**
+ * \brief return ZOO_VERSION from loaded library as a string.
+ *
+ * This method allows a calling program to determine at runtime whether the
+ * version of the dynamically loaded zookeeper library (a.k.a. zoo_version_str())
+ * is same as the version of the library the calling program was compiled against
+ * (a.k.a. ZOO_VERSION).
+ *
+ * \return a string in shape "MAJOR.MINOR.PATCH", say "3.10.0"
+ */
+ZOOAPI const char* zoo_version_str();
+
 /**
  * \brief update the list of servers this client will connect to.
  *
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 387608fa406..701e3992b39 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -1295,6 +1295,14 @@ static void log_env(zhandle_t *zh) {
 #endif
 }
 
+/**
+ * Return string of "MAJOR.MINOR.PATCH"
+ */
+const char *zoo_version_str()
+{
+    return ZOO_VERSION;
+}
+
 /**
  * Create a zookeeper handle associated with the given host and port.
  */
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc b/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc
index 61da41dd547..d5fc12c5ded 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc
@@ -36,6 +36,7 @@ using namespace std;
 class Zookeeper_init : public CPPUNIT_NS::TestFixture
 {
     CPPUNIT_TEST_SUITE(Zookeeper_init);
+    CPPUNIT_TEST(testVersion);
     CPPUNIT_TEST(testBasic);
     CPPUNIT_TEST(testAddressResolution);
     CPPUNIT_TEST(testMultipleAddressResolution);
@@ -90,6 +91,11 @@ class Zookeeper_init : public CPPUNIT_NS::TestFixture
 #endif
     }
 
+    void testVersion()
+    {
+        CPPUNIT_ASSERT_EQUAL(string(ZOO_VERSION), string(zoo_version_str()));
+    }
+
     void testBasic()
     {
         const string EXPECTED_HOST("127.0.0.1:2121");

From f6766eca95b318e6e675a97be029b2eb2397dd0d Mon Sep 17 00:00:00 2001
From: fanyang <fanyang@smartx.com>
Date: Mon, 23 Jun 2025 15:32:29 +0800
Subject: [PATCH 521/591] ZOOKEEPER-4810: Fix buf data race at
 format_endpoint_info

ZOOKEEPER-4810: Fix buf data race at format_endpoint_info()
format_endpoint_info() is widely called in the IO thread. And the
some ZOOAPIs will call this method too: zoo_cycle_next_server()
and zoo_get_current_server(). These APIs return the same static buffer
read/write by IO thread causes data race.
Reviewers: kezhuw
Author: fanyang89
Closes #2140 from fanyang89/fix-c-client-format-endpoint-race
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 701e3992b39..c59da18a516 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -5121,11 +5121,11 @@ int zoo_add_auth(zhandle_t *zh,const char* scheme,const char* cert,
 
 static const char* format_endpoint_info(const struct sockaddr_storage* ep)
 {
-    static char buf[134] = { 0 };
+    static __thread char buf[134] = { 0 };
     char addrstr[INET6_ADDRSTRLEN] = { 0 };
     const char *fmtstring;
     void *inaddr;
-    char is_inet6 = 0;  // poor man's boolean
+    char is_inet6 = 0; // poor man's boolean
 #ifdef _WIN32
     char * addrstring;
 #endif

From 5b4be58c30d9b4e6bab6e1ae828b324e419e6226 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sun, 11 May 2025 10:18:16 +0800
Subject: [PATCH 522/591] ZOOKEEPER-4921: Retry endlessly to establish a
 brand-new session

Reviewers: tisonkun
Author: kezhuw
Closes #2252 from kezhuw/ZOOKEEPER-4921-retry-brand-new-session-endlessly

This is cherry picked from commit 0971e5e2133f535bb39c5a363dcf0046b64d4a36
which is already merged to branch-3.9, this way we make ZOOKEEPER-4923 a
pure feature request.

Signed-off-by: Kezhu Wang <kezhuw@apache.org>
---
 .../java/org/apache/zookeeper/ClientCnxn.java |  2 +-
 .../zookeeper/test/SessionTimeoutTest.java    | 65 +++++++++++++------
 2 files changed, 47 insertions(+), 20 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 215df45f2de..ed03359f7fe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1192,7 +1192,7 @@ public void run() {
                         to = connectTimeout - clientCnxnSocket.getIdleSend();
                     }
 
-                    int expiration = expirationTimeout - clientCnxnSocket.getIdleRecv();
+                    int expiration = sessionId == 0 ? Integer.MAX_VALUE : expirationTimeout - clientCnxnSocket.getIdleRecv();
                     if (expiration <= 0) {
                         String warnInfo = String.format(
                             "Client session timed out, have not heard from server in %dms for session id 0x%s",
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
index 7a59f5eb958..9f5943f6821 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper.test;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.lessThan;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -31,12 +34,15 @@
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.Time;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
@@ -54,6 +60,21 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    private static class ExpiredWatcher implements Watcher {
+        public volatile CompletableFuture<Void> expired = new CompletableFuture<>();
+
+        synchronized void reset() {
+            expired = new CompletableFuture<>();
+        }
+
+        @Override
+        public synchronized void process(WatchedEvent event) {
+            if (event.getState() == Event.KeeperState.Expired) {
+                expired.complete(null);
+            }
+        }
+    }
+
     private static class BusyServer implements AutoCloseable {
         private final ServerSocket server;
         private final Socket client;
@@ -143,17 +164,24 @@ public void testSessionExpirationAfterAllServerDown() throws Exception {
         // stop client also to gain less distraction
         zk.close();
 
-        // small connection timeout to gain quick ci feedback
-        int sessionTimeout = 3000;
-        CompletableFuture<Void> expired = new CompletableFuture<>();
+        // given: established session
+        int sessionTimeout = 3000; // small connection timeout to gain quick ci feedback
+        ExpiredWatcher watcher = new ExpiredWatcher();
         zk = createClient(new CountdownWatcher(), hostPort, sessionTimeout);
-        zk.register(event -> {
-            if (event.getState() == Watcher.Event.KeeperState.Expired) {
-                expired.complete(null);
-            }
-        });
+        zk.register(watcher);
+
+        // when: all server down
+        long start = Time.currentElapsedTime();
+        zk.sync("/"); // touch timeout counts
         stopServer();
-        expired.join();
+
+        // then: get Expired after session timeout
+        watcher.expired.join();
+        long elapsed = Time.currentElapsedTime() - start;
+        assertThat(elapsed, greaterThanOrEqualTo((long) zk.getSessionTimeout()));
+        assertThat(elapsed, lessThan(zk.getSessionTimeout() * 10L));
+
+        // then: future request will get SessionExpiredException
         assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
     }
 
@@ -162,18 +190,17 @@ public void testSessionExpirationWhenNoServerUp() throws Exception {
         // stop client also to gain less distraction
         zk.close();
 
+        // given: unavailable cluster
         stopServer();
 
-        // small connection timeout to gain quick ci feedback
-        int sessionTimeout = 3000;
-        CompletableFuture<Void> expired = new CompletableFuture<>();
-        new TestableZooKeeper(hostPort, sessionTimeout, event -> {
-            if (event.getState() == Watcher.Event.KeeperState.Expired) {
-                expired.complete(null);
-            }
-        });
-        expired.join();
-        assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+        // when: try to establish a brand-new session
+        int sessionTimeout = 300; // small connection timeout to gain quick ci feedback
+        ExpiredWatcher watcher = new ExpiredWatcher();
+        try (ZooKeeper zk = new ZooKeeper(hostPort, sessionTimeout, watcher)) {
+            // then: never Expired
+            assertThrows(TimeoutException.class, () -> watcher.expired.get(3 * sessionTimeout, TimeUnit.MILLISECONDS));
+            assertThrows(KeeperException.ConnectionLossException.class, () -> zk.exists("/", null));
+        }
     }
 
     @Test

From 02e93c2554317683bb2bdd6fc242f881937d90d6 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Thu, 26 Jun 2025 07:21:16 +0800
Subject: [PATCH 523/591] ZOOKEEPER-4944: Cache zookeeper dists in
 compatibility tests

Reviewers: cnauroth
Author: kezhuw
Closes #2273 from kezhuw/ZOOKEEPER-4944-cache-zookeeper-dists
---
 .github/workflows/e2e.yaml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index b47c300d43e..ec3aed65ff7 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -48,11 +48,20 @@ jobs:
         run: mvn -B -V -e -ntp "-Dstyle.color=always" package -DskipTests
         env:
           MAVEN_OPTS: -Djansi.force=true
-      - name: Download ZooKeeper ${{ matrix.zk }}
+      - name: Cache ZooKeeper ${{ matrix.zk }}
+        id: dist-cache
         if: matrix.zk != 'nightly'
+        uses: actions/cache@v4
+        with:
+          key: apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+          path: apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+      - name: Download ZooKeeper ${{ matrix.zk }}
+        if: matrix.zk != 'nightly' && steps.dist-cache.outputs.cache-hit != 'true'
         run: |
           curl -O https://archive.apache.org/dist/zookeeper/zookeeper-${{ matrix.zk }}/apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
-          tar -xzvf apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+      - name: Extract ZooKeeper ${{ matrix.zk }}
+        if: matrix.zk != 'nightly'
+        run: tar -xzvf apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
       - name: Test ZooKeeper nightly server and ${{ matrix.zk }} client
         if: matrix.zk != 'nightly'
         run: tools/ci/test-connectivity.py --server . --client apache-zookeeper-${{ matrix.zk }}-bin

From 6c5f788ee3e58e09d369339a8128bc07cbbc6d03 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Thu, 26 Jun 2025 09:01:13 +0800
Subject: [PATCH 524/591] ZOOKEEPER-4943: Use Duration for session timeout in
 ZooKeeperBuilder

ZOOKEEPER-4943: Use Duration for session timeout in ZooKeeperBuilder
`ZooKeeperBuilder` is introduced in ZOOKEEPER-4697 which targets 3.10.0,
so this api change breaks nothing.
Refs: ZOOKEEPER-4697, ZOOKEEPER-4943
Author: kezhuw
Closes #2274 from kezhuw/ZOOKEEPER-4943-ZooKeeperBuilder-Duration-timeout
---
 .../java/org/apache/zookeeper/ZooKeeper.java  | 23 ++++++++++---------
 .../zookeeper/client/ZooKeeperBuilder.java    | 12 ++++++----
 .../zookeeper/client/ZooKeeperOptions.java    |  9 ++++----
 .../client/ZooKeeperBuilderTest.java          |  5 ++--
 4 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 5d85623d9b6..c6ca3bef0a7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -22,6 +22,7 @@
 import java.lang.reflect.Constructor;
 import java.net.InetSocketAddress;
 import java.net.SocketAddress;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -462,7 +463,7 @@ public boolean isConnected() {
      *             if an invalid chroot path is specified
      */
     public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .toOptions());
     }
@@ -517,7 +518,7 @@ public ZooKeeper(
         int sessionTimeout,
         Watcher watcher,
         ZKClientConfig conf) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withClientConfig(conf)
             .toOptions());
@@ -586,7 +587,7 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .withHostProvider(ignored -> aHostProvider)
@@ -660,7 +661,7 @@ public ZooKeeper(
         HostProvider hostProvider,
         ZKClientConfig clientConfig
     ) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .withHostProvider(ignored -> hostProvider)
@@ -746,7 +747,7 @@ public ZooKeeper(
         int sessionTimeout,
         Watcher watcher,
         boolean canBeReadOnly) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .toOptions());
@@ -812,7 +813,7 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         ZKClientConfig conf) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .withClientConfig(conf)
@@ -877,7 +878,7 @@ public ZooKeeper(
         Watcher watcher,
         long sessionId,
         byte[] sessionPasswd) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withSession(sessionId, sessionPasswd)
             .toOptions());
@@ -955,7 +956,7 @@ public ZooKeeper(
         byte[] sessionPasswd,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withSession(sessionId, sessionPasswd)
             .withCanBeReadOnly(canBeReadOnly)
@@ -1041,7 +1042,7 @@ public ZooKeeper(
         boolean canBeReadOnly,
         HostProvider hostProvider,
         ZKClientConfig clientConfig) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withSession(sessionId, sessionPasswd)
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
@@ -1072,7 +1073,7 @@ public ZooKeeper(
     @InterfaceAudience.Private
     public ZooKeeper(ZooKeeperOptions options) throws IOException {
         String connectString = options.getConnectString();
-        int sessionTimeout = options.getSessionTimeout();
+        int sessionTimeout = options.getSessionTimeoutMs();
         long sessionId = options.getSessionId();
         byte[] sessionPasswd = sessionId == 0 ? new byte[16] : options.getSessionPasswd();
         Watcher watcher = options.getDefaultWatcher();
@@ -1188,7 +1189,7 @@ public ZooKeeper(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly) throws IOException {
-        this(new ZooKeeperBuilder(connectString, sessionTimeout)
+        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withSession(sessionId, sessionPasswd)
             .withCanBeReadOnly(canBeReadOnly)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
index 796ed24ea08..36f815ab2da 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
@@ -21,7 +21,9 @@
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.IOException;
 import java.net.InetSocketAddress;
+import java.time.Duration;
 import java.util.Collection;
+import java.util.Objects;
 import java.util.function.Function;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.yetus.audience.InterfaceStability;
@@ -36,7 +38,7 @@
 @InterfaceStability.Evolving
 public class ZooKeeperBuilder {
     private final String connectString;
-    private final int sessionTimeout;
+    private final Duration sessionTimeout;
     private Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
     private Watcher defaultWatcher;
     private boolean canBeReadOnly = false;
@@ -56,12 +58,12 @@ public class ZooKeeperBuilder {
      *            would be relative to this root - ie getting/setting/etc...
      *            "/foo/bar" would result in operations being run on
      *            "/app/a/foo/bar" (from the server perspective).
-     * @param sessionTimeoutMs
-     *            session timeout in milliseconds
+     * @param sessionTimeout
+     *            session timeout
      */
-    public ZooKeeperBuilder(String connectString, int sessionTimeoutMs) {
+    public ZooKeeperBuilder(String connectString, Duration sessionTimeout) {
         this.connectString = connectString;
-        this.sessionTimeout = sessionTimeoutMs;
+        this.sessionTimeout = Objects.requireNonNull(sessionTimeout, "session timeout must not be null");
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
index 27e5244ba87..52a173ebfff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
@@ -20,6 +20,7 @@
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.net.InetSocketAddress;
+import java.time.Duration;
 import java.util.Collection;
 import java.util.function.Function;
 import org.apache.yetus.audience.InterfaceAudience;
@@ -31,7 +32,7 @@
 @InterfaceAudience.Private
 public class ZooKeeperOptions {
     private final String connectString;
-    private final int sessionTimeout;
+    private final Duration sessionTimeout;
     private final Watcher defaultWatcher;
     private final Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
     private final boolean canBeReadOnly;
@@ -40,7 +41,7 @@ public class ZooKeeperOptions {
     private final ZKClientConfig clientConfig;
 
     ZooKeeperOptions(String connectString,
-                     int sessionTimeout,
+                     Duration sessionTimeout,
                      Watcher defaultWatcher,
                      Function<Collection<InetSocketAddress>, HostProvider> hostProvider,
                      boolean canBeReadOnly,
@@ -61,8 +62,8 @@ public String getConnectString() {
         return connectString;
     }
 
-    public int getSessionTimeout() {
-        return sessionTimeout;
+    public int getSessionTimeoutMs() {
+        return (int) Long.min(Integer.MAX_VALUE, sessionTimeout.toMillis());
     }
 
     public Watcher getDefaultWatcher() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
index 32d30052a66..250982e74cb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
@@ -20,6 +20,7 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import java.time.Duration;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
@@ -69,7 +70,7 @@ private void testClient(BlockingQueue<WatchedEvent> events, ZooKeeper zk) throws
     @Test
     public void testBuildClient() throws Exception {
         BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
-        ZooKeeper zk = new ZooKeeperBuilder(hostPort, 1000)
+        ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(1000))
             .withDefaultWatcher(events::offer)
             .build();
         testClient(events, zk);
@@ -78,7 +79,7 @@ public void testBuildClient() throws Exception {
     @Test
     public void testBuildAdminClient() throws Exception {
         BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
-        ZooKeeper zk = new ZooKeeperBuilder(hostPort, 1000)
+        ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(1000))
             .withDefaultWatcher(events::offer)
             .buildAdmin();
         testClient(events, zk);

From 9d1d25cd75295b4529ce5348ba0cfce9ef4fefd7 Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Fri, 18 Jul 2025 16:15:50 +0200
Subject: [PATCH 525/591] ZOOKEEPER-4940: Enabling zookeeper.ssl.ocsp with JRE
 TLS provider errors out

add docs
add new property for tcnative OCSP setting
rename property
factor out the stapling handling code to a new method
use and honor OpenSSL.isOcspSupported()
Add more log messages
Remove comments about BoringSSL not supporting OCSP stapling
rearrange code to make patch smaller
add comment for clarification
remove new property
Reviewers: anmolnar
Author: stoty
Closes #2270 from stoty/ZOOKEEPER-4940
---
 .../apache/zookeeper/common/ClientX509Util.java  | 16 ++++++++++++++--
 .../apache/zookeeper/common/X509UtilTest.java    | 14 ++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 9aa03ae491a..561b865e1fa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.common;
 
 import io.netty.handler.ssl.DelegatingSslContext;
+import io.netty.handler.ssl.OpenSsl;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslProvider;
@@ -79,7 +80,7 @@ public SslContext createNettySslContextForClient(ZKConfig config)
             sslContextBuilder.trustManager(tm);
         }
 
-        sslContextBuilder.enableOcsp(config.getBoolean(getSslOcspEnabledProperty()));
+        handleTcnativeOcspStapling(sslContextBuilder, config);
         String[] enabledProtocols = getEnabledProtocols(config);
         if (enabledProtocols != null) {
             sslContextBuilder.protocols(enabledProtocols);
@@ -123,7 +124,7 @@ public SslContext createNettySslContextForServer(ZKConfig config, KeyManager key
             sslContextBuilder.trustManager(trustManager);
         }
 
-        sslContextBuilder.enableOcsp(config.getBoolean(getSslOcspEnabledProperty()));
+        handleTcnativeOcspStapling(sslContextBuilder, config);
         String[] enabledProtocols = getEnabledProtocols(config);
         if (enabledProtocols != null) {
             sslContextBuilder.protocols(enabledProtocols);
@@ -144,6 +145,17 @@ public SslContext createNettySslContextForServer(ZKConfig config, KeyManager key
         }
     }
 
+    private SslContextBuilder handleTcnativeOcspStapling(SslContextBuilder builder, ZKConfig config) {
+        SslProvider sslProvider = getSslProvider(config);
+        boolean tcnative = sslProvider == SslProvider.OPENSSL || sslProvider == SslProvider.OPENSSL_REFCNT;
+        boolean ocspEnabled = config.getBoolean(getSslOcspEnabledProperty());
+
+        if (tcnative && ocspEnabled && OpenSsl.isOcspSupported()) {
+            builder.enableOcsp(ocspEnabled);
+        }
+        return builder;
+    }
+
     private SslContext addHostnameVerification(SslContext sslContext, String clientOrServer) {
         return new DelegatingSslContext(sslContext) {
             @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index e4f19d77fd1..71d14f45c6a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -740,6 +740,20 @@ public void testCreateSSLContext_validCustomSSLContextClass(
         assertEquals(SSLContext.getDefault(), sslContext);
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_ocspWithJreProvider(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        ZKConfig zkConfig = new ZKConfig();
+        try (ClientX509Util clientX509Util = new ClientX509Util();) {
+            zkConfig.setProperty(clientX509Util.getSslOcspEnabledProperty(), "true");
+            // Must not throw IllegalArgumentException
+            clientX509Util.createSSLContext(zkConfig);
+        }
+    }
+
     private static void forceClose(Socket s) {
         if (s == null || s.isClosed()) {
             return;

From 3d6c0d1164dc9ec96a02de383e410b1b0ef64565 Mon Sep 17 00:00:00 2001
From: Softrock <41425369+Softrock@users.noreply.github.com>
Date: Fri, 25 Jul 2025 01:58:50 +0800
Subject: [PATCH 526/591] ZOOKEEPER-4787: Fix quorum join failure due to
 inconsistent wire message charset during leader election

Reviewers: kezhuw
Author: Softrock
Closes #2143 from Softrock/ZOOKEEPER-4787-master
---
 .../apache/zookeeper/server/quorum/FastLeaderElection.java    | 4 ++--
 .../org/apache/zookeeper/server/quorum/QuorumCnxManager.java  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 86bb4e732a9..8bc963a383e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -425,7 +425,7 @@ public void run() {
                                         self.getPeerState(),
                                         response.sid,
                                         v.getPeerEpoch(),
-                                        qv.toString().getBytes());
+                                        qv.toString().getBytes(UTF_8));
                                     sendqueue.offer(notmsg);
                                 }
                             } else {
@@ -461,7 +461,7 @@ public void run() {
                                         self.getPeerState(),
                                         response.sid,
                                         current.getPeerEpoch(),
-                                        qv.toString().getBytes());
+                                        qv.toString().getBytes(UTF_8));
                                     sendqueue.offer(notmsg);
                                 }
                             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index a4faeb1333f..db7f0090d7f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -490,7 +490,7 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
 
             String addr = addressesToSend.stream()
                     .map(NetUtils::formatInetAddr).collect(Collectors.joining("|"));
-            byte[] addr_bytes = addr.getBytes();
+            byte[] addr_bytes = addr.getBytes(UTF_8);
             dout.writeInt(addr_bytes.length);
             dout.write(addr_bytes);
             dout.flush();

From 030b7f25d00e536b6a94e175ef0f0700e80b0cde Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Wed, 30 Jul 2025 20:35:50 +0200
Subject: [PATCH 527/591] =?UTF-8?q?ZOOKEEPER-4954:=20Use=20FIPS=20style=20?=
 =?UTF-8?q?hostname=20verification=20when=20no=20custom=20t=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ZOOKEEPER-4954: Use FIPS style hostname verification when no custom truststore is specified
Reviewers: anmolnar
Author: stoty
Closes #2283 from stoty/ZOOKEEPER-4954
---
 .../zookeeper/common/ClientX509Util.java      |  4 +--
 .../apache/zookeeper/common/X509UtilTest.java | 26 +++++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 561b865e1fa..6034b9e9485 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -93,7 +93,7 @@ public SslContext createNettySslContextForClient(ZKConfig config)
 
         SslContext sslContext1 = sslContextBuilder.build();
 
-        if (getFipsMode(config) && isServerHostnameVerificationEnabled(config)) {
+        if ((getFipsMode(config) || tm == null) && isServerHostnameVerificationEnabled(config)) {
             return addHostnameVerification(sslContext1, "Server");
         } else {
             return sslContext1;
@@ -138,7 +138,7 @@ public SslContext createNettySslContextForServer(ZKConfig config, KeyManager key
 
         SslContext sslContext1 = sslContextBuilder.build();
 
-        if (getFipsMode(config) && isClientHostnameVerificationEnabled(config)) {
+        if ((getFipsMode(config) || trustManager == null) && isClientHostnameVerificationEnabled(config)) {
             return addHostnameVerification(sslContext1, "Client");
         } else {
             return sslContext1;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index 71d14f45c6a..dd803c49f31 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -23,6 +23,8 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import io.netty.buffer.UnpooledByteBufAllocator;
+import io.netty.handler.ssl.SslContext;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
@@ -45,6 +47,7 @@
 import javax.net.ssl.HandshakeCompletedEvent;
 import javax.net.ssl.HandshakeCompletedListener;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLHandshakeException;
 import javax.net.ssl.SSLServerSocket;
 import javax.net.ssl.SSLSocket;
@@ -58,6 +61,7 @@
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
+
 public class X509UtilTest extends BaseX509ParameterizedTestCase {
 
     private X509Util x509Util;
@@ -754,6 +758,28 @@ public void testCreateSSLContext_ocspWithJreProvider(
         }
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_hostnameVerificationNoCustomTrustStore(X509KeyType caKeyType,
+            X509KeyType certKeyType, String keyPassword, Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        // No truststore
+        System.clearProperty(x509Util.getSslTruststoreLocationProperty());
+        // Verify client hostname too
+        System.setProperty(x509Util.getSslClientHostnameVerificationEnabledProperty(), "true");
+        ZKConfig zkConfig = new ZKConfig();
+        try (ClientX509Util clientX509Util = new ClientX509Util();) {
+            UnpooledByteBufAllocator byteBufAllocator = new UnpooledByteBufAllocator(false);
+            SslContext clientContext = clientX509Util.createNettySslContextForClient(zkConfig);
+            SSLEngine clientEngine = clientContext.newEngine(byteBufAllocator);
+            assertEquals(clientEngine.getSSLParameters().getEndpointIdentificationAlgorithm(), "HTTPS");
+
+            SslContext serverContext = clientX509Util.createNettySslContextForServer(zkConfig);
+            SSLEngine serverEngine = serverContext.newEngine(byteBufAllocator);
+            assertEquals(serverEngine.getSSLParameters().getEndpointIdentificationAlgorithm(), "HTTPS");
+        }
+    }
+
     private static void forceClose(Socket s) {
         if (s == null || s.isClosed()) {
             return;

From 06b418b62d281c2259dee3eccb9885393532a204 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Fri, 1 Aug 2025 16:35:51 -0500
Subject: [PATCH 528/591] ZOOKEEPER-4932: The newest version of zookeeper
 includes Jetty versiob 9.4.57.x which has CVE-2024-6763 issue

ZOOKEEPER-4932: Put back accidentally removed owasp suppression
Update owaspSuppressions.xml
Co-authored-by: Kezhu Wang <kezhuw@gmail.com>
Reviewers: kezhuw
Author: anmolnar
Closes #2288 from anmolnar/ZOOKEEPER-4932
---
 owaspSuppressions.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 5b9719067a9..2db9d7c1515 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -18,6 +18,23 @@
 -->
 
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
+   <suppress>
+      <!--
+         We have updated jetty[1] to 9.4.57.v20241219[2] which includes a fix[3] for CVE-2024-6763[4].
+         But it is not listed as fixed version since 9.x is EOL[5]. So we still have to suppress this
+         to pass vulnerabilities check. Besides above, ZooKeeper does not use HttpURI[6] thus should
+         not be affected by this CVE anyway.
+
+         Refs:
+         [1]: https://github.com/apache/zookeeper/pull/2220
+         [2]: https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.57.v20241219
+         [3]: https://github.com/jetty/jetty.project/pull/12532
+         [4]: https://github.com/advisories/GHSA-qh8g-58pp-2wxh
+         [5]: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25#note_2968611
+         [6]: https://issues.apache.org/jira/browse/ZOOKEEPER-4876
+      -->
+      <cve>CVE-2024-6763</cve>
+   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>

From bec08dfa0e63ffe7b72bc01a3ea9b0b69a50e3d2 Mon Sep 17 00:00:00 2001
From: Rahul Kumar <39871812+rahulonGH@users.noreply.github.com>
Date: Wed, 6 Aug 2025 13:30:14 +0530
Subject: [PATCH 529/591] ZOOKEEPER-4953: Fix typos for word ZooKeeper from
 ZooKeeeper

Reviewers: kezhuw
Author: rahulonGH
Closes #2281 from rahulonGH/rahulkumar/fixing-typo
---
 .../zookeeper/inspector/manager/ZooInspectorManager.java    | 4 ++--
 .../src/main/resources/markdown/zookeeperProgrammers.md     | 6 +++---
 .../src/test/java/org/apache/zookeeper/ZooKeeperTest.java   | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
index 030b7d2ee74..9e89adf3499 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
@@ -118,13 +118,13 @@ public void setDefaultNodeViewerConfiguration(
     /**
      * @param connectionProps
      *            - the connection properties last used to connect to the
-     *            zookeeeper instance
+     *            zookeeper instance
      */
     public void setLastConnectionProps(Properties connectionProps);
 
     /**
      * @return last connection Properties - the connection properties last used
-     *         to connect to the zookeeeper instance
+     *         to connect to the zookeeper instance
      */
     public Properties getLastConnectionProps();
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 79aa0123a61..92fbe40cf72 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -837,7 +837,7 @@ on nodes that exist and the client must have READ permission otherwise
 
 #### Builtin ACL Schemes
 
-ZooKeeeper has the following built in schemes:
+ZooKeeper has the following built in schemes:
 
 * **world** has a
   single id, _anyone_, that represents
@@ -1106,7 +1106,7 @@ _digest_. Additional plugins can adding using system properties. At
 startup the ZooKeeper server will look for system properties that start with
 "zookeeper.authProvider." and interpret the value of those properties as the class name
 of an authentication plugin. These properties can be set using the
-_-Dzookeeeper.authProvider.X=com.f.MyAuth_ or adding entries such as
+_-Dzookeeper.authProvider.X=com.f.MyAuth_ or adding entries such as
 the following in the server configuration file:
 
 
@@ -1115,7 +1115,7 @@ the following in the server configuration file:
 
 
 Care should be taking to ensure that the suffix on the property is unique. If there are
-duplicates such as _-Dzookeeeper.authProvider.X=com.f.MyAuth -Dzookeeper.authProvider.X=com.f.MyAuth2_,
+duplicates such as _-Dzookeeper.authProvider.X=com.f.MyAuth -Dzookeeper.authProvider.X=com.f.MyAuth2_,
 only one will be used. Also all servers must have the same plugins defined, otherwise clients using
 the authentication schemes provided by the plugins will have problems connecting to some servers.
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 10b11688404..973e8b75f03 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -801,7 +801,7 @@ public void testWaitForConnection() throws Exception {
         }
         long endTime = System.currentTimeMillis();
         assertTrue(endTime - startTime >= timeout,
-                "ZooKeeeperMain does not wait until the specified timeout");
+                "ZooKeeperMain does not wait until the specified timeout");
 
     }
 

From 770804bef861bbfc9e150b63774f8557f1f8d995 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Thu, 14 Aug 2025 08:24:38 +0800
Subject: [PATCH 530/591] ZOOKEEPER-4955: Fix intererence with jvm wide ssl
 properties for ssl.crl and ssl.ocsp

ZOOKEEPER-4955: Fix intererence with jvm wide ssl properties for ssl.crl and ssl.ocsp
Refs: ZOOKEEPER-4955, apache/zookeeper#2289, stoty/zookeeper#2
Add more comments about PKIXRevocationChecker options
Rename test methods to reflect where revocation happens
Refactor tests to reflect that revocation checking affects is only enforced in enabled side
Fix missing fallback property for ssl.ocsp
Reviewers: anmolnar, stoty
Author: kezhuw
Closes #2292 from kezhuw/ZOOKEEPER-4955-fix-interference-with-jvm-properties
---
 .../main/resources/markdown/zookeeperAdmin.md |   8 +-
 .../zookeeper/common/ClientX509Util.java      |   7 +-
 .../org/apache/zookeeper/common/X509Util.java |  45 +-
 .../auth/X509AuthenticationProvider.java      |   5 +-
 .../zookeeper/common/X509TestContext.java     |   4 +-
 .../zookeeper/common/X509TestHelpers.java     |  42 +-
 .../apache/zookeeper/common/X509UtilTest.java |  49 --
 .../server/ClientSSLRevocationTest.java       | 610 ++++++++++++++++++
 .../server/quorum/QuorumSSLTest.java          |   1 +
 9 files changed, 703 insertions(+), 68 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index a4fccf1f94e..5bac829cf25 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1768,13 +1768,17 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     (Java system properties: **zookeeper.ssl.crl** and **zookeeper.ssl.quorum.crl**)
     **New in 3.5.5:**
     Specifies whether Certificate Revocation List is enabled in client and quorum TLS protocols.
-    Default: false
+    Default: jvm property "com.sun.net.ssl.checkRevocation" since 3.10.0, false otherwise
 
 * *ssl.ocsp* and *ssl.quorum.ocsp* :
     (Java system properties: **zookeeper.ssl.ocsp** and **zookeeper.ssl.quorum.ocsp**)
     **New in 3.5.5:**
     Specifies whether Online Certificate Status Protocol is enabled in client and quorum TLS protocols.
-    Default: false
+    **Changed in 3.10.0:**
+    Before 3.10.0, *ssl.ocsp* and *ssl.quorum.ocsp* implies *ssl.crl* and *ssl.quorum.crl* correspondingly.
+    After 3.10.0, one has to setup both *ssl.crl* and *ssl.ocsp* (or *ssl.quorum.crl* and *ssl.quorum.ocsp*)
+    to enable OCSP. This is consistent with jdk's method of [Setting up a Java Client to use Client-Driven OCSP](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html#setting-up-a-java-client-to-use-client-driven-ocsp).
+    Default: jvm security property "ocsp.enable" since 3.10.0, false otherwise
 
 * *ssl.clientAuth* and *ssl.quorum.clientAuth* :
     (Java system properties: **zookeeper.ssl.clientAuth** and **zookeeper.ssl.quorum.clientAuth**)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 6034b9e9485..16d7f27a5ca 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -23,6 +23,7 @@
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslProvider;
+import java.security.Security;
 import java.util.Arrays;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.SSLEngine;
@@ -148,7 +149,7 @@ public SslContext createNettySslContextForServer(ZKConfig config, KeyManager key
     private SslContextBuilder handleTcnativeOcspStapling(SslContextBuilder builder, ZKConfig config) {
         SslProvider sslProvider = getSslProvider(config);
         boolean tcnative = sslProvider == SslProvider.OPENSSL || sslProvider == SslProvider.OPENSSL_REFCNT;
-        boolean ocspEnabled = config.getBoolean(getSslOcspEnabledProperty());
+        boolean ocspEnabled = config.getBoolean(getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
 
         if (tcnative && ocspEnabled && OpenSsl.isOcspSupported()) {
             builder.enableOcsp(ocspEnabled);
@@ -201,8 +202,8 @@ private TrustManager getTrustManager(ZKConfig config) throws X509Exception.Trust
             getSslTruststorePasswdPathProperty());
         String trustStoreType = config.getProperty(getSslTruststoreTypeProperty());
 
-        boolean sslCrlEnabled = config.getBoolean(getSslCrlEnabledProperty());
-        boolean sslOcspEnabled = config.getBoolean(getSslOcspEnabledProperty());
+        boolean sslCrlEnabled = config.getBoolean(getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
+        boolean sslOcspEnabled = config.getBoolean(getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
         boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
         boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 153a826ba4f..2584fecd89d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -31,11 +31,15 @@
 import java.security.KeyStore;
 import java.security.NoSuchAlgorithmException;
 import java.security.Security;
+import java.security.cert.CertPathValidator;
 import java.security.cert.PKIXBuilderParameters;
+import java.security.cert.PKIXRevocationChecker;
 import java.security.cert.X509CertSelector;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 import javax.net.ssl.CertPathTrustManagerParameters;
@@ -392,8 +396,9 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
         String trustStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslTruststorePasswdProperty, sslTruststorePasswdPathProperty);
         String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
 
-        boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty);
-        boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty);
+        boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty, Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
+        boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty, Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
+
         boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
         boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
         boolean fipsMode = getFipsMode(config);
@@ -548,13 +553,37 @@ public static X509TrustManager createTrustManager(
         try {
             KeyStore ts = loadTrustStore(trustStoreLocation, trustStorePassword, trustStoreTypeProp);
             PKIXBuilderParameters pbParams = new PKIXBuilderParameters(ts, new X509CertSelector());
-            if (crlEnabled || ocspEnabled) {
-                pbParams.setRevocationEnabled(true);
-                System.setProperty("com.sun.net.ssl.checkRevocation", "true");
-                System.setProperty("com.sun.security.enableCRLDP", "true");
-                if (ocspEnabled) {
-                    Security.setProperty("ocsp.enable", "true");
+            if (crlEnabled) {
+                // See [RevocationChecker][1] for details. Basically, we are mimicking the legacy path,
+                // which relies significantly on jvm wide properties[2], as that is the path we are routing
+                // before (i.e. no explicit `PKIXRevocationChecker`).
+                //
+                // By reading but not writing these properties, we conform to but not interfere with what
+                // admin set while still keep backward compatibility.
+                // 1. Default "zookeeper.ssl.crl" to jvm property "com.sun.net.ssl.checkRevocation" if it is unset.
+                // 2. Default "zookeeper.ssl.ocsp" to jvm security property "ocsp.enable" if it is unset.
+                // 3. Set `Option.ONLY_END_ENTITY` for jvm security property "com.sun.security.onlyCheckRevocationOfEECert".
+                // 4. Don't set "com.sun.security.enableCRLDP" as it is always enabled in no legacy path.
+                //
+                // See also:
+                // * https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html
+                // * https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html
+                // * https://docs.oracle.com/javase/8/docs/technotes/guides/security/certpath/CertPathProgGuide.html#PKIXRevocationChecker
+                //
+                // [1]: https://github.com/openjdk/jdk/blob/jdk-11%2B28/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java#L124
+                // [2]: https://github.com/openjdk/jdk/blob/jdk-11%2B28/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java#L179
+                Set<PKIXRevocationChecker.Option> options = new HashSet<>();
+                if (!ocspEnabled) {
+                    options.add(PKIXRevocationChecker.Option.NO_FALLBACK);
+                    options.add(PKIXRevocationChecker.Option.PREFER_CRLS);
+                }
+                if (Boolean.parseBoolean(Security.getProperty("com.sun.security.onlyCheckRevocationOfEECert")))  {
+                    options.add(PKIXRevocationChecker.Option.ONLY_END_ENTITY);
                 }
+
+                PKIXRevocationChecker revocationChecker = (PKIXRevocationChecker) CertPathValidator.getInstance("PKIX").getRevocationChecker();
+                revocationChecker.setOptions(options);
+                pbParams.addCertPathChecker(revocationChecker);
             } else {
                 pbParams.setRevocationEnabled(false);
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 4ea925320f6..8286c061c9c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.security.Security;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
@@ -85,8 +86,8 @@ public X509AuthenticationProvider() throws X509Exception {
                     x509Util.getSslKeystorePasswdPathProperty());
             String keyStoreTypeProp = config.getProperty(x509Util.getSslKeystoreTypeProperty());
 
-            boolean crlEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslCrlEnabledProperty()));
-            boolean ocspEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslOcspEnabledProperty()));
+            boolean crlEnabled = config.getBoolean(x509Util.getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
+            boolean ocspEnabled = config.getBoolean(x509Util.getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
             boolean hostnameVerificationEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
 
             X509KeyManager km = null;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
index f672bf4686f..2bb759e639f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
@@ -80,7 +80,7 @@ public class X509TestContext {
      * @throws GeneralSecurityException
      * @throws OperatorCreationException
      */
-    private X509TestContext(File tempDir, KeyPair trustStoreKeyPair, long trustStoreCertExpirationMillis, String trustStorePassword, KeyPair keyStoreKeyPair, long keyStoreCertExpirationMillis, String keyStorePassword, Boolean hostnameVerification) throws IOException, GeneralSecurityException, OperatorCreationException {
+    private X509TestContext(File tempDir, KeyPair trustStoreKeyPair, long trustStoreCertExpirationMillis, String trustStorePassword, KeyPair keyStoreKeyPair, long keyStoreCertExpirationMillis, String keyStorePassword, Boolean hostnameVerification) throws Exception {
         if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
             throw new IllegalStateException("BC Security provider was not found");
         }
@@ -425,7 +425,7 @@ public Builder() {
          * @throws GeneralSecurityException
          * @throws OperatorCreationException
          */
-        public X509TestContext build() throws IOException, GeneralSecurityException, OperatorCreationException {
+        public X509TestContext build() throws Exception {
             KeyPair trustStoreKeyPair = X509TestHelpers.generateKeyPair(trustStoreKeyType);
             KeyPair keyStoreKeyPair = X509TestHelpers.generateKeyPair(keyStoreKeyType);
             return new X509TestContext(tempDir, trustStoreKeyPair, trustStoreCertExpirationMillis, trustStorePassword, keyStoreKeyPair, keyStoreCertExpirationMillis, keyStorePassword, hostnameVerification);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
index b9f2f6db946..89907e078e2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
@@ -36,11 +36,14 @@
 import java.security.cert.X509Certificate;
 import java.security.spec.ECGenParameterSpec;
 import java.security.spec.RSAKeyGenParameterSpec;
+import java.time.Duration;
 import java.util.Date;
 import org.bouncycastle.asn1.DERIA5String;
 import org.bouncycastle.asn1.DEROctetString;
 import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
 import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x500.X500NameBuilder;
+import org.bouncycastle.asn1.x500.style.BCStyle;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 import org.bouncycastle.asn1.x509.BasicConstraints;
 import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
@@ -53,6 +56,7 @@
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
 import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
 import org.bouncycastle.crypto.util.PrivateKeyFactory;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
@@ -85,6 +89,27 @@ public class X509TestHelpers {
     // Per RFC 5280 section 4.1.2.2, X509 certificates can use up to 20 bytes == 160 bits for serial numbers.
     private static final int SERIAL_NUMBER_MAX_BITS = 20 * Byte.SIZE;
 
+    public static X509Certificate newSelfSignedCert(String name, KeyPair keyPair) throws IOException, OperatorCreationException, GeneralSecurityException {
+        X500NameBuilder caNameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
+        caNameBuilder.addRDN(BCStyle.CN, name);
+        return newSelfSignedCACert(caNameBuilder.build(), keyPair, Duration.ofDays(1).toMillis());
+    }
+
+    @FunctionalInterface
+    public interface CertificateCustomization {
+        void customize(X509v3CertificateBuilder builder) throws Exception;
+    }
+
+    public static X509Certificate newCert(X509Certificate caCert, KeyPair caKeyPair, String name, PublicKey certPublicKey, CertificateCustomization customization) throws Exception {
+        X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
+        nameBuilder.addRDN(BCStyle.CN, name);
+        return newCert(caCert, caKeyPair, nameBuilder.build(), certPublicKey, Duration.ofDays(1).toMillis(), customization);
+    }
+
+    public static X509Certificate newCert(X509Certificate caCert, KeyPair caKeyPair, String name, PublicKey certPublicKey) throws Exception {
+        return newCert(caCert, caKeyPair, name, certPublicKey, null);
+    }
+
     /**
      * Uses the private key of the given key pair to create a self-signed CA certificate with the public half of the
      * key pair and the given subject and expiration. The issuer of the new cert will be equal to the subject.
@@ -102,6 +127,11 @@ public class X509TestHelpers {
      */
     public static X509Certificate newSelfSignedCACert(
             X500Name subject, KeyPair keyPair, long expirationMillis) throws IOException, OperatorCreationException, GeneralSecurityException {
+        return newSelfSignedCACert(subject, keyPair, expirationMillis, null);
+    }
+
+    public static X509Certificate newSelfSignedCACert(
+            X500Name subject, KeyPair keyPair, long expirationMillis, CertificateCustomization customization) throws IOException, OperatorCreationException, GeneralSecurityException {
         Date now = new Date();
         X509v3CertificateBuilder builder = initCertBuilder(subject, // for self-signed certs, issuer == subject
                                                            now, new Date(now.getTime()
@@ -129,7 +159,12 @@ now, new Date(now.getTime()
      * @throws GeneralSecurityException
      */
     public static X509Certificate newCert(
-            X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject, PublicKey certPublicKey, long expirationMillis) throws IOException, OperatorCreationException, GeneralSecurityException {
+            X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject, PublicKey certPublicKey, long expirationMillis) throws Exception {
+        return newCert(caCert, caKeyPair, certSubject, certPublicKey, expirationMillis, null);
+    }
+
+    public static X509Certificate newCert(
+            X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject, PublicKey certPublicKey, long expirationMillis, CertificateCustomization customization) throws Exception {
         if (!caKeyPair.getPublic().equals(caCert.getPublicKey())) {
             throw new IllegalArgumentException("CA private key does not match the public key in the CA cert");
         }
@@ -143,6 +178,9 @@ public static X509Certificate newCert(
         builder.addExtension(Extension.extendedKeyUsage, true, new ExtendedKeyUsage(new KeyPurposeId[]{KeyPurposeId.id_kp_serverAuth, KeyPurposeId.id_kp_clientAuth}));
 
         builder.addExtension(Extension.subjectAlternativeName, false, getLocalhostSubjectAltNames());
+        if (customization != null) {
+            customization.customize(builder);
+        }
         return buildAndSignCertificate(caKeyPair.getPrivate(), builder);
     }
 
@@ -172,7 +210,7 @@ private static GeneralNames getLocalhostSubjectAltNames() throws UnknownHostExce
      */
     private static X509v3CertificateBuilder initCertBuilder(
             X500Name issuer, Date notBefore, Date notAfter, X500Name subject, PublicKey subjectPublicKey) {
-        return new X509v3CertificateBuilder(issuer, new BigInteger(SERIAL_NUMBER_MAX_BITS, PRNG), notBefore, notAfter, subject, SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded()));
+        return new JcaX509v3CertificateBuilder(issuer, new BigInteger(SERIAL_NUMBER_MAX_BITS, PRNG), notBefore, notAfter, subject, SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded()));
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index dd803c49f31..ff054c1d634 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -20,7 +20,6 @@
 
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import io.netty.buffer.UnpooledByteBufAllocator;
@@ -32,7 +31,6 @@
 import java.net.Socket;
 import java.nio.file.Path;
 import java.security.NoSuchAlgorithmException;
-import java.security.Security;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.Callable;
@@ -90,10 +88,6 @@ public void cleanUp() {
         System.clearProperty(x509Util.getCipherSuitesProperty());
         System.clearProperty(x509Util.getSslProtocolProperty());
         System.clearProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty());
-        System.clearProperty("com.sun.net.ssl.checkRevocation");
-        System.clearProperty("com.sun.security.enableCRLDP");
-        Security.setProperty("ocsp.enable", Boolean.FALSE.toString());
-        Security.setProperty("com.sun.security.enableCRLDP", Boolean.FALSE.toString());
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
         x509Util.close();
@@ -227,49 +221,6 @@ public void testCreateSSLContextWithCustomCipherSuites(
         assertArrayEquals(customCipherSuites, sslSocket.getEnabledCipherSuites());
     }
 
-    // It would be great to test the value of PKIXBuilderParameters#setRevocationEnabled but it does not appear to be
-    // possible
-    @ParameterizedTest
-    @MethodSource("data")
-    @Timeout(value = 5)
-    public void testCRLEnabled(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        System.setProperty(x509Util.getSslCrlEnabledProperty(), "true");
-        x509Util.getDefaultSSLContext();
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
-        assertFalse(Boolean.valueOf(Security.getProperty("ocsp.enable")));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    @Timeout(value = 5)
-    public void testCRLDisabled(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        x509Util.getDefaultSSLContext();
-        assertFalse(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
-        assertFalse(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
-        assertFalse(Boolean.valueOf(Security.getProperty("ocsp.enable")));
-    }
-
-    @ParameterizedTest
-    @MethodSource("data")
-    @Timeout(value = 5)
-    public void testOCSPEnabled(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
-            throws Exception {
-        init(caKeyType, certKeyType, keyPassword, paramIndex);
-        System.setProperty(x509Util.getSslOcspEnabledProperty(), "true");
-        x509Util.getDefaultSSLContext();
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
-        assertTrue(Boolean.valueOf(Security.getProperty("ocsp.enable")));
-    }
-
     @ParameterizedTest
     @MethodSource("data")
     @Timeout(value = 5)
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
new file mode 100644
index 00000000000..6e1fd2708d0
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
@@ -0,0 +1,610 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import com.sun.net.httpserver.Headers;
+import com.sun.net.httpserver.HttpHandler;
+import com.sun.net.httpserver.HttpServer;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.math.BigInteger;
+import java.net.InetSocketAddress;
+import java.net.URLDecoder;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.security.KeyPair;
+import java.security.Security;
+import java.security.cert.X509Certificate;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Calendar;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.UUID;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.stream.Collectors;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.X509TestHelpers;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.apache.zookeeper.test.ClientBase;
+import org.bouncycastle.asn1.ASN1GeneralizedTime;
+import org.bouncycastle.asn1.ocsp.OCSPResponse;
+import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
+import org.bouncycastle.asn1.ocsp.RevokedInfo;
+import org.bouncycastle.asn1.x509.AuthorityInformationAccess;
+import org.bouncycastle.asn1.x509.CRLDistPoint;
+import org.bouncycastle.asn1.x509.CRLNumber;
+import org.bouncycastle.asn1.x509.CRLReason;
+import org.bouncycastle.asn1.x509.DistributionPoint;
+import org.bouncycastle.asn1.x509.DistributionPointName;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.GeneralNames;
+import org.bouncycastle.asn1.x509.X509ObjectIdentifiers;
+import org.bouncycastle.cert.X509CRLHolder;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v2CRLBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
+import org.bouncycastle.cert.jcajce.JcaX509v2CRLBuilder;
+import org.bouncycastle.cert.ocsp.BasicOCSPResp;
+import org.bouncycastle.cert.ocsp.BasicOCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.CertificateID;
+import org.bouncycastle.cert.ocsp.CertificateStatus;
+import org.bouncycastle.cert.ocsp.OCSPReq;
+import org.bouncycastle.cert.ocsp.OCSPResp;
+import org.bouncycastle.cert.ocsp.OCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.Req;
+import org.bouncycastle.cert.ocsp.RevokedStatus;
+import org.bouncycastle.cert.ocsp.jcajce.JcaBasicOCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.jcajce.JcaCertificateID;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.openssl.MiscPEMGenerator;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.bouncycastle.util.io.pem.PemWriter;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ClientSSLRevocationTest {
+    private static final Logger LOG = LoggerFactory.getLogger(ClientSSLRevocationTest.class);
+
+    static {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    private static class OCSPHandler implements HttpHandler {
+        private final Ca ca;
+
+        public OCSPHandler(Ca ca) {
+            this.ca = ca;
+        }
+
+        @Override
+        public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOException {
+            byte[] responseBytes;
+            try {
+                String uri = httpExchange.getRequestURI().toString();
+                LOG.info("OCSP request: {} {}", httpExchange.getRequestMethod(), uri);
+                httpExchange.getRequestHeaders().entrySet().forEach((e) -> {
+                    LOG.info("OCSP request header: {} {}", e.getKey(), e.getValue());
+                });
+                InputStream request = httpExchange.getRequestBody();
+                byte[] requestBytes = new byte[10000];
+                int len = request.read(requestBytes);
+                LOG.info("OCSP request size {}", len);
+
+                if (len < 0) {
+                    String removedUriEncoding = URLDecoder.decode(uri.substring(1), "utf-8");
+                    LOG.info("OCSP request from URI no encoding {}", removedUriEncoding);
+                    requestBytes = Base64.getDecoder().decode(removedUriEncoding);
+                }
+                OCSPReq ocspRequest = new OCSPReq(requestBytes);
+                Req[] requestList = ocspRequest.getRequestList();
+                LOG.info("requestList {}", Arrays.toString(requestList));
+
+                DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
+
+                Map<CertificateID, RevokedInfo> revokedCerts = ca.ocspRevokedCerts.entrySet().stream().collect(Collectors.toMap(entry -> {
+                        try {
+                            return new JcaCertificateID(digestCalculator, ca.cert,  entry.getKey().getSerialNumber());
+                        } catch (Exception ex) {
+                            throw new RuntimeException(ex);
+                        }
+                    }, Map.Entry::getValue));
+
+                BasicOCSPRespBuilder responseBuilder = new JcaBasicOCSPRespBuilder(ca.key.getPublic(), digestCalculator);
+                for (Req req : requestList) {
+                    CertificateID certId = req.getCertID();
+                    CertificateStatus certificateStatus = CertificateStatus.GOOD;
+                    RevokedInfo revokedInfo = revokedCerts.get(certId);
+                    if (revokedInfo != null) {
+                        certificateStatus = new RevokedStatus(revokedInfo);
+                    }
+                    responseBuilder.addResponse(certId, certificateStatus, null);
+                }
+
+                X509CertificateHolder[] chain = new X509CertificateHolder[]{new JcaX509CertificateHolder(ca.cert)};
+                ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(ca.key.getPrivate());
+                BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
+                LOG.info("response {}", ocspResponse);
+                responseBytes = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, ocspResponse).getEncoded();
+                LOG.error("OCSP server response OK");
+            } catch (Throwable exception) {
+                LOG.error("Internal OCSP server error", exception);
+                responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
+            }
+
+            Headers rh = httpExchange.getResponseHeaders();
+            rh.set("Content-Type", "application/ocsp-response");
+            httpExchange.sendResponseHeaders(200, responseBytes.length);
+
+            OutputStream os = httpExchange.getResponseBody();
+            os.write(responseBytes);
+            os.close();
+        }
+
+    }
+
+    private static class PemFile {
+        private final Path file;
+        private final String password;
+
+        public PemFile(Path file, String password) {
+            this.file = file;
+            this.password = password;
+        }
+    }
+
+    private static class CertWithCrl extends Cert {
+        public final Path crl;
+
+        public CertWithCrl(String name, KeyPair key, X509Certificate cert, Path crl) {
+            super(name, key, cert, crl.getParent());
+            this.crl = crl;
+        }
+    }
+
+    private static class Cert {
+        public final String name;
+        public final KeyPair key;
+        public final X509Certificate cert;
+        public final Path dir;
+
+        public Cert(String name, KeyPair key, X509Certificate cert, Path dir) {
+            this.name = name;
+            this.key = key;
+            this.cert = cert;
+            this.dir = dir;
+        }
+
+        public PemFile writePem() throws Exception {
+            String password = UUID.randomUUID().toString();
+            String pem = X509TestHelpers.pemEncodeCertAndPrivateKey(cert, key.getPrivate(), password);
+            Path file = Files.createTempFile(dir, name, ".pem");
+            Files.write(file, pem.getBytes());
+            return new PemFile(file, password);
+        }
+    }
+
+    private static class Ca implements AutoCloseable {
+        private final String name;
+        private final KeyPair key;
+        private final X509Certificate cert;
+        private final Path dir;
+        private final Map<X509Certificate, RevokedInfo> crlRevokedCerts = Collections.synchronizedMap(new HashMap<>());
+        private final Map<X509Certificate, RevokedInfo> ocspRevokedCerts = Collections.synchronizedMap(new HashMap<>());
+        private final HttpServer ocspServer;
+        private final AtomicLong crlNumber = new AtomicLong(1);
+
+        private Ca(String name, KeyPair key, X509Certificate cert, Path dir, HttpServer ocspServer) throws Exception {
+            this.name = name;
+            this.key = key;
+            this.cert = cert;
+            this.dir = dir;
+            this.ocspServer = ocspServer;
+        }
+
+        public PemFile writePem() throws Exception {
+            String pem = X509TestHelpers.pemEncodeX509Certificate(cert);
+            Path file = Files.createTempFile(dir, name, ".pem");
+            Files.write(file, pem.getBytes());
+            return new PemFile(file, "");
+        }
+
+        // Check result of crldp could be cached, so use per-cert crl file.
+        public void flush_crl(Path crl) throws Exception {
+            Instant now = Instant.now();
+
+            X509v2CRLBuilder builder = new JcaX509v2CRLBuilder(cert.getIssuerX500Principal(), Date.from(now));
+            builder.setNextUpdate(Date.from(now.plusSeconds(2)));
+
+            builder.addExtension(Extension.authorityKeyIdentifier, false, new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(this.cert));
+            builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(crlNumber.getAndAdd(1L))));
+
+            for (Map.Entry<X509Certificate, RevokedInfo> entry : crlRevokedCerts.entrySet()) {
+                builder.addCRLEntry(entry.getKey().getSerialNumber(), entry.getValue().getRevocationTime().getDate(), CRLReason.cACompromise);
+            }
+
+            ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(this.key.getPrivate());
+            X509CRLHolder crlHolder = builder.build(contentSigner);
+
+            Path tmpFile = Files.createTempFile(dir, "crldp-", ".pem.tmp");
+            PemWriter pemWriter = new PemWriter(new FileWriter(tmpFile.toFile()));
+            pemWriter.writeObject(new MiscPEMGenerator(crlHolder));
+            pemWriter.flush();
+            pemWriter.close();
+
+            Files.move(tmpFile, crl, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+        }
+
+        public void revoke_through_crldp(CertWithCrl cert) throws Exception {
+            Date now = new Date();
+            RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
+            this.crlRevokedCerts.put(cert.cert, revokedInfo);
+            flush_crl(cert.crl);
+        }
+
+        public void revoke_through_ocsp(X509Certificate cert) throws Exception {
+            Date now = new Date();
+            RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
+            this.ocspRevokedCerts.put(cert, revokedInfo);
+        }
+
+        public Cert sign(String name) throws Exception {
+            KeyPair key = X509TestHelpers.generateRSAKeyPair();
+            X509Certificate cert = X509TestHelpers.newCert(this.cert, this.key, name, key.getPublic());
+            return new Cert(name, key, cert, dir);
+        }
+
+        public CertWithCrl sign_with_crl(String name) throws Exception {
+            KeyPair key = X509TestHelpers.generateRSAKeyPair();
+            Path crl = Files.createTempFile(dir, String.format("%s-crldp-", name), ".pem");
+            X509Certificate cert = X509TestHelpers.newCert(this.cert, this.key, name, key.getPublic(), builder -> {
+                DistributionPointName distPointOne = new DistributionPointName(
+                        new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, "file://" + crl)));
+                builder.addExtension(
+                        Extension.cRLDistributionPoints,
+                        false,
+                        new CRLDistPoint(new DistributionPoint[]{new DistributionPoint(distPointOne, null, null)}));
+
+            });
+            flush_crl(crl);
+            return new CertWithCrl(name, key, cert, crl);
+        }
+
+        public Cert sign_with_ocsp(String name) throws Exception {
+            KeyPair key = X509TestHelpers.generateRSAKeyPair();
+            X509Certificate cert = X509TestHelpers.newCert(this.cert, this.key, name, key.getPublic(), builder -> {
+                String addr = "http://127.0.0.1:" + ocspServer.getAddress().getPort();
+                builder.addExtension(
+                        Extension.authorityInfoAccess,
+                        false,
+                        new AuthorityInformationAccess(
+                                X509ObjectIdentifiers.ocspAccessMethod,
+                                new GeneralName(GeneralName.uniformResourceIdentifier, addr)));
+            });
+            return new Cert(name, key, cert, dir);
+        }
+
+        public static Ca create(Path dir) throws Exception {
+            return create(dir, "CA");
+        }
+
+        public static Ca create(Path dir, String name) throws Exception {
+            KeyPair caKey = X509TestHelpers.generateRSAKeyPair();
+            X509Certificate caCert = X509TestHelpers.newSelfSignedCert(name, caKey);
+            HttpServer ocspServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+            Ca ca = new Ca(name, caKey, caCert, dir, ocspServer);
+            ca.ocspServer.createContext("/", new OCSPHandler(ca));
+            ca.ocspServer.start();
+            return ca;
+        }
+
+        @Override
+        public void close() throws Exception {
+            ocspServer.stop(0);
+        }
+    }
+
+    @AfterEach
+    public void cleanup() throws Exception {
+        Security.setProperty("ocsp.enable", "false");
+        System.clearProperty("com.sun.net.ssl.checkRevocation");
+        System.clearProperty("zookeeper.ssl.crl");
+        System.clearProperty("zookeeper.ssl.ocsp");
+    }
+
+    @Test
+    public void testRevocationDisabled(@TempDir Path tmpDir) throws Exception {
+        // given: crl not enabled
+        try (Ca ca = Ca.create(tmpDir)) {
+            PemFile caPem = ca.writePem();
+
+            Cert serverCert = ca.sign_with_ocsp("server");
+            final Properties config = getServerConfig(caPem, serverCert);
+            // given: revoked server cert
+            ca.revoke_through_ocsp(serverCert.cert);
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                CertWithCrl client1Cert = ca.sign_with_crl("client1");
+                ca.revoke_through_crldp(client1Cert);
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // when: connect with revoked cert.
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, getZKClientConfig(caPem, client1Cert)));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            PemFile caPem = ca.writePem();
+            // given: server cert with crldp
+            CertWithCrl server1Cert = ca.sign_with_crl("server1");
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(getServerConfig(caPem, server1Cert))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                CertWithCrl clientCert = ca.sign_with_crl("client1");
+                if (clientRevoked) {
+                    // crl in server side is disabled, so it does not matter whether
+                    // client cert is revoked or not.
+                    ca.revoke_through_crldp(clientCert);
+                }
+
+                // then: ssl authentication succeed when crl is disabled
+                ZKClientConfig clientConfig = getZKClientConfig(caPem, clientCert);
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // when: valid server cert
+                // then: ssl authentication succeed when crl is enabled
+                clientConfig.setProperty("zookeeper.ssl.crl", "true");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+            }
+
+            // crldp check is not realtime, so we have to start a new server with revoked cert
+
+            // given: revoked server cert with crldp
+            CertWithCrl server2Cert = ca.sign_with_crl("server2");
+            ca.revoke_through_crldp(server2Cert);
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server2.data"))
+                    .configuration(getServerConfig(caPem, server2Cert))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                CertWithCrl clientCert = ca.sign_with_crl("client1");
+                if (clientRevoked) {
+                    // crl in server side is disabled, so it does not matter whether
+                    // client cert is revoked or not.
+                    ca.revoke_through_crldp(clientCert);
+                }
+
+                // then: ssl authentication succeed when crl is disabled
+                ZKClientConfig clientConfig = getZKClientConfig(caPem, clientCert);
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // then: ssl authentication failed when crl is enabled
+                clientConfig.setProperty("zookeeper.ssl.crl", "true");
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInClientUsingOCSP(boolean clientRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            PemFile caPem = ca.writePem();
+            // given: server cert with ocsp
+            Cert serverCert = ca.sign_with_ocsp("server1");
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(getServerConfig(caPem, serverCert))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign_with_ocsp("client");
+                if (clientRevoked) {
+                    // crl in server side is disabled, so it does not matter whether
+                    // client cert is revoked or not.
+                    ca.revoke_through_ocsp(clientCert.cert);
+                }
+
+                ZKClientConfig clientConfig = getZKClientConfig(caPem, clientCert);
+
+                // when: connect to serve with valid cert
+                // then: connected
+                //
+                // we can't config crl using jvm properties as server will access them also
+                // see: https://issues.apache.org/jira/browse/ZOOKEEPER-4875
+                clientConfig.setProperty("zookeeper.ssl.crl", "true");
+                clientConfig.setProperty("zookeeper.ssl.ocsp", "true");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // when: server cert get revoked
+                ca.revoke_through_ocsp(serverCert.cert);
+
+                // then: ssl authentication failed when crl is enabled
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // then: ssl authentication succeed when crl is disabled
+                clientConfig.setProperty("zookeeper.ssl.crl", "false");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+            }
+        }
+    }
+
+
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInServerUsingCrldp(boolean serverRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            PemFile caPem = ca.writePem();
+            // given: server with crl enabled
+            System.setProperty("zookeeper.ssl.crl", "true");
+            CertWithCrl serverCert = ca.sign_with_crl("server1");
+            if (serverRevoked) {
+                // crl in client side will be disabled, so it does not matter whether
+                // server cert is revoked or not.
+                ca.revoke_through_crldp(serverCert);
+            }
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(getServerConfig(caPem, serverCert))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // when: valid client cert with crldp
+                // then: ssl authentication failed when crl is enabled
+                Cert client1Cert = ca.sign_with_crl("client1");
+                ZKClientConfig client1Config = getZKClientConfig(caPem, client1Cert);
+                client1Config.setProperty("zookeeper.ssl.crl", "false");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+
+                CertWithCrl client2Cert = ca.sign_with_crl("client2");
+                ca.revoke_through_crldp(client2Cert);
+
+                // when: revoked client cert with crldp
+                // then: ssl authentication failed when crl is enabled
+                ZKClientConfig client2Config = getZKClientConfig(caPem, client2Cert);
+                client2Config.setProperty("zookeeper.ssl.crl", "false");
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client2Config));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInServerUsingOCSP(boolean serverRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            PemFile caPem = ca.writePem();
+            // given: server with crl and ocsp enabled
+            System.setProperty("com.sun.net.ssl.checkRevocation", "true");
+            System.setProperty("zookeeper.ssl.ocsp", "true");
+            Cert serverCert = ca.sign("server1");
+            if (serverRevoked) {
+                // crl in client side will be disabled, so it does not matter whether
+                // server cert is revoked or not.
+                ca.revoke_through_ocsp(serverCert.cert);
+            }
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(getServerConfig(caPem, serverCert))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // when: valid client cert with crldp
+                // then: ssl authentication failed when crl is enabled
+                Cert client1Cert = ca.sign_with_ocsp("client1");
+                ZKClientConfig client1Config = getZKClientConfig(caPem, client1Cert);
+                client1Config.setProperty("zookeeper.ssl.crl", "false");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+
+                // ocsp is realtime, so we can reuse this client.
+                ca.revoke_through_ocsp(client1Cert.cert);
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+            }
+        }
+    }
+
+    private Properties getServerConfig(PemFile ca, Cert identity) throws Exception {
+        final Properties config = new Properties();
+        config.put("clientPort", "0");
+        config.put("secureClientPort", "0");
+        config.put("host", "localhost");
+        config.put("ticktime", "4000");
+
+        PemFile serverPem = identity.writePem();
+
+        // TLS config fields
+        //config.put("ssl.clientAuth", "need");
+        config.put("ssl.keyStore.location", serverPem.file.toString());
+        config.put("ssl.keyStore.password", serverPem.password);
+        config.put("ssl.trustStore.location", ca.file.toString());
+
+        // Netty is required for TLS
+        config.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+        config.put("4lw.commands.whitelist", "*");
+        return config;
+    }
+
+    private ZKClientConfig getZKClientConfig(PemFile ca, Cert cert) throws Exception {
+        PemFile pemFile = cert.writePem();
+
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty("zookeeper.client.secure", "true");
+        config.setProperty("zookeeper.ssl.keyStore.password", pemFile.password);
+        config.setProperty("zookeeper.ssl.keyStore.location", pemFile.file.toString());
+        config.setProperty("zookeeper.ssl.trustStore.location", ca.file.toString());
+        // only netty supports TLS
+        config.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+        return config;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index e2e1227e9b3..c843efd0054 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -901,6 +901,7 @@ public void testOCSP(boolean fipsEnabled) throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
 
             setSSLSystemProperties();
+            System.setProperty(quorumX509Util.getSslCrlEnabledProperty(), "true");
             System.setProperty(quorumX509Util.getSslOcspEnabledProperty(), "true");
 
             X509Certificate validCertificate = buildEndEntityCert(

From 82edaa7464a0fb03d85b953206c1023ccd1396c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Sun, 17 Aug 2025 07:57:14 -0500
Subject: [PATCH 531/591] ZOOKEEPER-4959. Update license of slf4j-2.0.13
 (#2295)

---
 .../lib/{slf4j-1.7.30.LICENSE.txt => slf4j-2.0.13.LICENSE.txt}  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{slf4j-1.7.30.LICENSE.txt => slf4j-2.0.13.LICENSE.txt} (97%)

diff --git a/zookeeper-server/src/main/resources/lib/slf4j-1.7.30.LICENSE.txt b/zookeeper-server/src/main/resources/lib/slf4j-2.0.13.LICENSE.txt
similarity index 97%
rename from zookeeper-server/src/main/resources/lib/slf4j-1.7.30.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/slf4j-2.0.13.LICENSE.txt
index a502dd93a86..b5b7c9e665d 100644
--- a/zookeeper-server/src/main/resources/lib/slf4j-1.7.30.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/slf4j-2.0.13.LICENSE.txt
@@ -1,4 +1,4 @@
-Copyright (c) 2004-2017 QOS.ch
+Copyright (c) 2004-2025 QOS.ch
 All rights reserved.
 
 Permission is hereby granted, free  of charge, to any person obtaining

From 178076a979cc8218c919f320a90b6cd4188b907f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Sun, 17 Aug 2025 08:00:44 -0500
Subject: [PATCH 532/591] ZOOKEEPER-4960: Upgrade OWASP plugin to 12.1.3 due to
 recent parsing errors

Reviewers: ctubbsii, kezhuw
Author: anmolnar
Closes #2297 from anmolnar/ZOOKEEPER-4960
---
 Jenkinsfile-owasp | 2 +-
 pom.xml           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Jenkinsfile-owasp b/Jenkinsfile-owasp
index 03ba497ac6d..2831dd4d6df 100644
--- a/Jenkinsfile-owasp
+++ b/Jenkinsfile-owasp
@@ -29,7 +29,7 @@ pipeline {
 
     tools {
         maven "maven_latest"
-        jdk "jdk_1.8_latest"
+        jdk "jdk_11_latest"
     }
 
     stages {
diff --git a/pom.xml b/pom.xml
index 0629d1b7c41..94c05b66590 100644
--- a/pom.xml
+++ b/pom.xml
@@ -889,7 +889,7 @@
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>8.3.1</version>
+          <version>12.1.3</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From d7f9717adf46addb582c0e0d90bf03a6ac6666af Mon Sep 17 00:00:00 2001
From: Edward Seabrook <eseabrook1@bloomberg.net>
Date: Mon, 18 Aug 2025 19:41:16 +0100
Subject: [PATCH 533/591] ZOOKEEPER-4929: Make c client side cert optional in
 connecting to tls server

Reviewers: kezhuw
Author: eseabrook1
Closes #2257 from eseabrook1/relax_client_certificate_requirements
---
 .../zookeeper-client-c/include/zookeeper.h    | 32 +++++++++++++
 .../zookeeper-client-c/src/zookeeper.c        | 45 ++++++++++---------
 .../zookeeper-client-c/tests/TestClient.cc    | 33 +++++++++++---
 .../zookeeper-client-c/tests/zkServer.sh      |  4 +-
 .../zookeeper-client-c/tests/zoo.cfg          |  1 +
 5 files changed, 88 insertions(+), 27 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 6d73ccd090d..ead328a94a0 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -537,6 +537,38 @@ ZOOAPI zhandle_t *zookeeper_init(const char *host, watcher_fn fn,
   int recv_timeout, const clientid_t *clientid, void *context, int flags);
 
 #ifdef HAVE_OPENSSL_H
+/**
+ * \brief create a handle to communicate with zookeeper using SSL.
+ *
+ * This method creates a new handle and a zookeeper session that corresponds
+ * to that handle. Session establishment is asynchronous, meaning that the
+ * session should not be considered established until (and unless) an
+ * event of state ZOO_CONNECTED_STATE is received.
+ * \param host comma separated host:port pairs, each corresponding to a zk
+ *   server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002"
+ * \param cert SSL certificate string. Two formats are supported: server CA
+ *   only e.g. "/path/to/server_ca.cer" and server CA with client certificate e.g.
+ *   "/path/to/server_ca.cer,/path/to/client_cert.pem,/path/to/client_cert.key,client_cert_password".
+ * \param fn the global watcher callback function. When notifications are
+ *   triggered this function will be invoked.
+ * \param recv_timeout the timeout for the zookeeper session.
+ * \param clientid the id of a previously established session that this
+ *   client will be reconnecting to. Pass 0 if not reconnecting to a previous
+ *   session. Clients can access the session id of an established, valid,
+ *   connection by calling \ref zoo_client_id. If the session corresponding to
+ *   the specified clientid has expired, or if the clientid is invalid for
+ *   any reason, the returned zhandle_t will be invalid -- the zhandle_t
+ *   state will indicate the reason for failure (typically
+ *   ZOO_EXPIRED_SESSION_STATE).
+ * \param context the handback object that will be associated with this instance
+ *   of zhandle_t. Application can access it (for example, in the watcher
+ *   callback) using \ref zoo_get_context. The object is not used by zookeeper
+ *   internally and can be null.
+ * \param flags reserved for future use. Should be set to zero.
+ * \return a pointer to the opaque zhandle structure. If it fails to create
+ * a new zhandle the function returns NULL and the errno variable
+ * indicates the reason.
+ */
 ZOOAPI zhandle_t *zookeeper_init_ssl(const char *host, const char *cert, watcher_fn fn,
   int recv_timeout, const clientid_t *clientid, void *context, int flags);
 #endif
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index c59da18a516..ce7deb5e2c6 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -2777,27 +2777,30 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
             errno = EINVAL;
             return ZBADARGUMENTS;
         }
-        /*CLIENT CA FILE (With Certificate Chain)*/
-        if (SSL_CTX_use_certificate_chain_file(*ctx, fd->cert->cert) != 1) {
-            SSL_CTX_free(*ctx);
-            LOG_ERROR(LOGCALLBACK(zh), "Failed to load client certificate chain from %s", fd->cert->cert);
-            errno = EINVAL;
-            return ZBADARGUMENTS;
-        }
-        /*CLIENT PRIVATE KEY*/
-        SSL_CTX_set_default_passwd_cb_userdata(*ctx, fd->cert->passwd);
-        if (SSL_CTX_use_PrivateKey_file(*ctx, fd->cert->key, SSL_FILETYPE_PEM) != 1) {
-            SSL_CTX_free(*ctx);
-            LOG_ERROR(LOGCALLBACK(zh), "Failed to load client private key from %s", fd->cert->key);
-            errno = EINVAL;
-            return ZBADARGUMENTS;
-        }
-        /*CHECK*/
-        if (SSL_CTX_check_private_key(*ctx) != 1) {
-            SSL_CTX_free(*ctx);
-            LOG_ERROR(LOGCALLBACK(zh), "SSL_CTX_check_private_key failed");
-            errno = EINVAL;
-            return ZBADARGUMENTS;
+        if (fd->cert->cert != NULL && fd->cert->passwd != NULL && fd->cert->key != NULL)
+        {
+            /*CLIENT CA FILE (With Certificate Chain)*/
+            if (SSL_CTX_use_certificate_chain_file(*ctx, fd->cert->cert) != 1) {
+                SSL_CTX_free(*ctx);
+                LOG_ERROR(LOGCALLBACK(zh), "Failed to load client certificate chain from %s", fd->cert->cert);
+                errno = EINVAL;
+                return ZBADARGUMENTS;
+            }
+            /*CLIENT PRIVATE KEY*/
+            SSL_CTX_set_default_passwd_cb_userdata(*ctx, fd->cert->passwd);
+            if (SSL_CTX_use_PrivateKey_file(*ctx, fd->cert->key, SSL_FILETYPE_PEM) != 1) {
+                SSL_CTX_free(*ctx);
+                LOG_ERROR(LOGCALLBACK(zh), "Failed to load client private key from %s", fd->cert->key);
+                errno = EINVAL;
+                return ZBADARGUMENTS;
+            }
+            /*CHECK*/
+            if (SSL_CTX_check_private_key(*ctx) != 1) {
+                SSL_CTX_free(*ctx);
+                LOG_ERROR(LOGCALLBACK(zh), "SSL_CTX_check_private_key failed");
+                errno = EINVAL;
+                return ZBADARGUMENTS;
+            }
         }
         /*MULTIPLE HANDSHAKE*/
         SSL_CTX_set_mode(*ctx, SSL_MODE_AUTO_RETRY);
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
index 8c79c01b038..83a7203d7b8 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
@@ -212,6 +212,10 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
 #endif
 #ifdef HAVE_OPENSSL_H
     CPPUNIT_TEST(testSSL);
+    CPPUNIT_TEST(testSSLNoClientCert);
+
+    // Order after above two tests as it changes ssl.clientAuth
+    CPPUNIT_TEST(testSSLServerOnly);
 #endif
     CPPUNIT_TEST(testCreate);
     CPPUNIT_TEST(testCreateContainer);
@@ -314,6 +318,12 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT(system(cmd) == 0);
     }
 
+    void startServer(const char *envs) {
+        char cmd[1024];
+        sprintf(cmd, "%s %s start %s", envs, ZKSERVER_CMD, getHostPorts());
+        CPPUNIT_ASSERT(system(cmd) == 0);
+    }
+
     void stopServer() {
         char cmd[1024];
         sprintf(cmd, "%s stop %s", ZKSERVER_CMD, getHostPorts());
@@ -879,15 +889,28 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     }
 
 #ifdef HAVE_OPENSSL_H
-    void testSSL() {
+    int checkSSL(const char *path, const char *certs) {
         watchctx_t ctx;
         zoo_set_debug_level(ZOO_LOG_LEVEL_DEBUG);
-        zhandle_t *zk = createSSLClient("127.0.0.1:22281", "/tmp/certs/server.crt,/tmp/certs/client.crt,/tmp/certs/clientkey.pem,password", &ctx);
+        zhandle_t *zk = createSSLClient("127.0.0.1:22281", certs, &ctx);
         CPPUNIT_ASSERT(zk);
         int rc = 0;
-        rc = zoo_create(zk, "/ssl", NULL, -1,
-                        &ZOO_OPEN_ACL_UNSAFE, 0, 0, 0);
-        CPPUNIT_ASSERT_EQUAL((int) ZOK, rc);
+        return zoo_create(zk, path, NULL, -1, &ZOO_OPEN_ACL_UNSAFE, 0, 0, 0);
+    }
+
+    void testSSL() {
+        CPPUNIT_ASSERT_EQUAL((int) ZOK, checkSSL("/ssl", "/tmp/certs/server.crt,/tmp/certs/client.crt,/tmp/certs/clientkey.pem,password"));
+    }
+
+    void testSSLNoClientCert() {
+        CPPUNIT_ASSERT(ZOK != checkSSL("/ssl-no-client-cert", "/tmp/certs/server.crt"));
+    }
+
+    void testSSLServerOnly() {
+        stopServer();
+        startServer("CLIENT_AUTH=none");
+
+        CPPUNIT_ASSERT_EQUAL((int) ZOK, checkSSL("/ssl-server-only", "/tmp/certs/server.crt"));
     }
 #endif
 
diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index 4e090a3cdf1..e1b850dd194 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -24,6 +24,8 @@ ZOOPORT=${ZOOPORT:-"22181"}
 # Some tests are setting the maxClientConnections. When it is not set, we fallback to default 100
 ZKMAXCNXNS=${ZKMAXCNXNS:-"100"}
 
+CLIENT_AUTH=${CLIENT_AUTH:-"need"}
+
 EXTRA_JVM_ARGS=${EXTRA_JVM_ARGS:-""}
 
 if [[ -z $1 ]]; then
@@ -163,7 +165,7 @@ case $1 in
     )
 
     # ===== prepare the configs
-    sed "s#TMPDIR#$tmp_dir#g;s#CERTDIR#$certs_dir#g;s#MAXCLIENTCONNECTIONS#$ZKMAXCNXNS#g;s#CLIENTPORT#$ZOOPORT#g" "$tests_dir/zoo.cfg" >"$tmp_dir/zoo.cfg"
+    sed "s#TMPDIR#$tmp_dir#g;s#CERTDIR#$certs_dir#g;s#MAXCLIENTCONNECTIONS#$ZKMAXCNXNS#g;s#CLIENTPORT#$ZOOPORT#g;s#CLIENT_AUTH#$CLIENT_AUTH#g" "$tests_dir/zoo.cfg" >"$tmp_dir/zoo.cfg"
     if [[ -n $read_only ]]; then
       # we can put the new server to read-only mode by starting only a single instance of a three node server
       {
diff --git a/zookeeper-client/zookeeper-client-c/tests/zoo.cfg b/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
index d7444238e73..5e3df626436 100644
--- a/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
+++ b/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
@@ -8,6 +8,7 @@ localSessionsEnabled=true
 clientPort=CLIENTPORT
 secureClientPort=22281
 serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
+ssl.clientAuth=CLIENT_AUTH
 ssl.keyStore.location=CERTDIR/server.jks
 ssl.keyStore.password=password
 ssl.trustStore.location=CERTDIR/servertrust.jks

From c21d37f281983d62ee60ee2efc109563f3691da2 Mon Sep 17 00:00:00 2001
From: Gowrima <kj.gowrima@gmail.com>
Date: Mon, 18 Aug 2025 11:49:59 -0700
Subject: [PATCH 534/591] ZOOKEEPER-4299: Use non lock completion list in
 zoo_amulti since it is not multithreaded

Reviewers: kezhuw
Author: Gowrima
Closes #2256 from Gowrima/ZOOKEEPER-4299
---
 .../zookeeper-client-c/src/zookeeper.c        | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index ce7deb5e2c6..645510b14a4 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -3150,10 +3150,9 @@ static int queue_session_event(zhandle_t *zh, int state)
 }
 //#endif
 
-completion_list_t *dequeue_completion(completion_head_t *list)
-{
+completion_list_t *dequeue_completion_nolock(completion_head_t *list) {
+
     completion_list_t *cptr;
-    lock_completion_list(list);
     cptr = list->head;
     if (cptr) {
         list->head = cptr->next;
@@ -3162,6 +3161,14 @@ completion_list_t *dequeue_completion(completion_head_t *list)
             list->last = 0;
         }
     }
+    return cptr;
+}
+
+completion_list_t *dequeue_completion(completion_head_t *list)
+{
+    completion_list_t *cptr;
+    lock_completion_list(list);
+    cptr = dequeue_completion_nolock(list);
     unlock_completion_list(list);
     return cptr;
 }
@@ -3170,7 +3177,7 @@ completion_list_t *dequeue_completion(completion_head_t *list)
 static void cleanup_failed_multi(zhandle_t *zh, int xid, int rc, completion_list_t *cptr) {
     completion_list_t *entry;
     completion_head_t *clist = &cptr->c.clist;
-    while ((entry = dequeue_completion(clist)) != NULL) {
+    while ((entry = dequeue_completion_nolock(clist)) != NULL) {
         // Fake failed response for all sub-requests
         deserialize_response(zh, entry->c.type, xid, 1, rc, entry, NULL);
         destroy_completion_entry(entry);
@@ -3185,7 +3192,7 @@ static int deserialize_multi(zhandle_t *zh, int xid, completion_list_t *cptr, st
     assert(clist);
     deserialize_MultiHeader(ia, "multiheader", &mhdr);
     while (!mhdr.done) {
-        completion_list_t *entry = dequeue_completion(clist);
+        completion_list_t *entry = dequeue_completion_nolock(clist);
         assert(entry);
 
         if (mhdr.type == -1) {
@@ -4740,7 +4747,7 @@ int zoo_amulti(zhandle_t *zh, int count, const zoo_op_t *ops,
                 return ZUNIMPLEMENTED;
         }
 
-        queue_completion(&clist, entry, 0);
+        queue_completion_nolock(&clist, entry, 0);
     }
 
     rc = rc < 0 ? rc : serialize_MultiHeader(oa, "multiheader", &mh);

From 641cf0085d0bb84ed8f23214d1c2ce201c8f7f11 Mon Sep 17 00:00:00 2001
From: Abhishek Kothalikar <99398985+kabhishek4@users.noreply.github.com>
Date: Tue, 19 Aug 2025 23:29:36 +0530
Subject: [PATCH 535/591] ZOOKEEPER-4240: Add IPV6 support for ZooKeeper ACL

Reviewers: anmolnar, anmolnar, kezhuw
Author: kabhishek4
Closes #2280 from kabhishek4/ZOOKEEPER-4240
---
 .../server/auth/IPAuthenticationProvider.java | 104 ++++++++++-
 .../auth/IPAuthenticationProviderTest.java    |  90 ++++++++++
 .../org/apache/zookeeper/test/ACLTest.java    | 164 ++++++++++++++++++
 3 files changed, 355 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
index 26c14a4e81e..0b4ef9a703e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
@@ -22,15 +22,26 @@
 import java.util.Collections;
 import java.util.List;
 import java.util.StringTokenizer;
+import java.util.regex.Pattern;
 import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 public class IPAuthenticationProvider implements AuthenticationProvider {
+    private static final Logger LOG = LoggerFactory.getLogger(IPAuthenticationProvider.class);
     public static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
 
     public static final String USE_X_FORWARDED_FOR_KEY = "zookeeper.IPAuthenticationProvider.usexforwardedfor";
+    private static final int IPV6_BYTE_LENGTH = 16; // IPv6 address is 128 bits = 16 bytes
+    private static final int IPV6_SEGMENT_COUNT = 8; // IPv6 address has 8 segments
+    private static final int IPV6_SEGMENT_BYTE_LENGTH = 2; // Each segment has up to two bytes
+    private static final int IPV6_SEGMENT_HEX_LENGTH = 4; // Each segment has up to 4 hex digits
+
+    private static final Pattern IPV6_PATTERN = Pattern.compile(":");
+    private static final Pattern IPV4_PATTERN = Pattern.compile("\\.");
 
     public String getScheme() {
         return "ip";
@@ -55,9 +66,14 @@ public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData
     // This is a bit weird but we need to return the address and the number of
     // bytes (to distinguish between IPv4 and IPv6
     private byte[] addr2Bytes(String addr) {
-        byte[] b = v4addr2Bytes(addr);
-        // TODO Write the v6addr2Bytes
-        return b;
+        if (IPV6_PATTERN.matcher(addr).find()) {
+            return v6addr2Bytes(addr);
+        } else if (IPV4_PATTERN.matcher(addr).find()) {
+            return v4addr2Bytes(addr);
+        } else {
+            LOG.warn("Input string does not resemble an IPv4 or IPv6 address: {}", addr);
+            return null;
+        }
     }
 
     private byte[] v4addr2Bytes(String addr) {
@@ -81,6 +97,83 @@ private byte[] v4addr2Bytes(String addr) {
         return b;
     }
 
+    /**
+     * Validates an IPv6 address string and converts it into a byte array.
+     *
+     * @param ipv6Addr The IPv6 address string to validate.
+     * @return A byte array representing the IPv6 address if valid, or null if the address
+     * is invalid or cannot be parsed.
+     */
+    static byte[] v6addr2Bytes(String ipv6Addr) {
+        try {
+            return parseV6addr(ipv6Addr);
+        } catch (IllegalArgumentException e) {
+            LOG.warn("Fail to parse {} as IPv6 address: {}", ipv6Addr, e.getMessage());
+            return null;
+        }
+    }
+
+    static byte[] parseV6addr(String ipv6Addr) {
+        // Split the address by "::" to handle zero compression, -1 to keep trailing empty strings
+        String[] parts = ipv6Addr.split("::", -1);
+
+        String[] segments1 = new String[0];
+        String[] segments2 = new String[0];
+
+        // Case 1: No "::" (full address)
+        if (parts.length == 1) {
+            segments1 = parts[0].split(":", -1);
+            if (segments1.length != IPV6_SEGMENT_COUNT) {
+                String reason = "wrong number of segments";
+                throw new IllegalArgumentException(reason);
+            }
+        } else if (parts.length == 2) {
+            // Case 2: "::" is present
+            // Handle cases like "::1" or "1::"
+            if (!parts[0].isEmpty()) {
+                segments1 = parts[0].split(":", -1);
+            }
+            if (!parts[1].isEmpty()) {
+                segments2 = parts[1].split(":", -1);
+            }
+
+            // Check if the total number of explicit segments exceeds 8
+            if (segments1.length + segments2.length >= IPV6_SEGMENT_COUNT) {
+                String reason = "too many segments";
+                throw new IllegalArgumentException(reason);
+            }
+        } else {
+            // Case 3: Invalid number of parts after splitting by "::" (should be 1 or 2)
+            String reason = "too many '::'";
+            throw new IllegalArgumentException(reason);
+        }
+
+        byte[] result = new byte[IPV6_BYTE_LENGTH];
+        // Process segments before "::"
+        parseV6Segment(result, 0, segments1);
+        // Process segments after "::"
+        parseV6Segment(result, IPV6_BYTE_LENGTH - segments2.length * IPV6_SEGMENT_BYTE_LENGTH, segments2);
+
+        return result;
+    }
+
+    private static void parseV6Segment(byte[] addr, int i, String[] segments) {
+        for (String segment : segments) {
+            if (segment.isEmpty()) {
+                throw new IllegalArgumentException("empty segment");
+            } else if (segment.length() > IPV6_SEGMENT_HEX_LENGTH) {
+                throw new IllegalArgumentException("segment too long");
+            }
+            try {
+                int value = Integer.parseInt(segment, 16);
+                addr[i++] = (byte) ((value >> 8) & 0xFF);
+                addr[i++] = (byte) (value & 0xFF);
+            } catch (NumberFormatException e) {
+                throw new IllegalArgumentException("invalid hexadecimal characters in segment: " + segment);
+            }
+        }
+    }
+
     private void mask(byte[] b, int bits) {
         int start = bits / 8;
         int startMask = (1 << (8 - (bits % 8))) - 1;
@@ -93,6 +186,7 @@ private void mask(byte[] b, int bits) {
     }
 
     public boolean matches(String id, String aclExpr) {
+        LOG.trace("id: '{}' aclExpr:  {}", id, aclExpr);
         String[] parts = aclExpr.split("/", 2);
         byte[] aclAddr = addr2Bytes(parts[0]);
         if (aclAddr == null) {
@@ -115,6 +209,10 @@ public boolean matches(String id, String aclExpr) {
             return false;
         }
         mask(remoteAddr, bits);
+        // Check if id and acl expression are of different formats (ipv6 or iv4) return false
+        if (remoteAddr.length != aclAddr.length) {
+            return false;
+        }
         for (int i = 0; i < remoteAddr.length; i++) {
             if (remoteAddr[i] != aclAddr[i]) {
                 return false;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
index c1a1d1f520e..1586cac39a3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
@@ -19,13 +19,23 @@
 
 import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY;
 import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
+import java.util.stream.Stream;
 import javax.servlet.http.HttpServletRequest;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
 public class IPAuthenticationProviderTest {
 
@@ -96,4 +106,84 @@ public void testGetClientIPAddressMissingXForwardedFor() {
     // Assert
     assertEquals("192.168.1.1", clientIp);
   }
+
+  @Test
+  public void testParsingOfIPv6Address() {
+    //Full IPv6 address
+    String ipv6Full = "2001:0db8:85a3:0000:0000:8a2e:0370:7334";
+    byte[] expectedFull = {
+            (byte) 0x20, (byte) 0x01, (byte) 0x0d, (byte) 0xb8,
+            (byte) 0x85, (byte) 0xa3, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x8a, (byte) 0x2e,
+            (byte) 0x03, (byte) 0x70, (byte) 0x73, (byte) 0x34
+    };
+    byte[] actualFull = IPAuthenticationProvider.v6addr2Bytes(ipv6Full);
+    assertNotNull(actualFull, "Full IPv6 address should not return null");
+    assertArrayEquals(expectedFull, actualFull, "Full IPv6 address conversion mismatch");
+
+    //Compressed IPv6 address (double colon)
+    String ipv6Compressed = "2001:db8::8a2e:370:7334";
+    byte[] expectedCompressed = {
+            (byte) 0x20, (byte) 0x01, (byte) 0x0d, (byte) 0xb8,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x8a, (byte) 0x2e,
+            (byte) 0x03, (byte) 0x70, (byte) 0x73, (byte) 0x34
+    };
+    byte[] actualCompressed = IPAuthenticationProvider.v6addr2Bytes(ipv6Compressed);
+    assertNotNull(actualCompressed, "Compressed IPv6 address should not return null");
+    assertArrayEquals(expectedCompressed, actualCompressed, "Compressed IPv6 address conversion mismatch");
+
+    //Shortened IPv6 address
+    String ipv6Shortened = "2001:db8::1";
+    byte[] expectedShortened = {
+            (byte) 0x20, (byte) 0x01, (byte) 0x0d, (byte) 0xb8,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x01
+    };
+    byte[] actualShortened = IPAuthenticationProvider.v6addr2Bytes(ipv6Shortened);
+    assertNotNull(actualShortened, "Shortened IPv6 address should not return null");
+    assertArrayEquals(expectedShortened, actualShortened, "Shortened IPv6 address conversion mismatch");
+
+    //Loopback address
+    String ipv6Loopback = "::1";
+    byte[] expectedLoopback = {
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x01
+    };
+    byte[] actualLoopback = IPAuthenticationProvider.v6addr2Bytes(ipv6Loopback);
+    assertNotNull(actualLoopback, "Loopback IPv6 address should not return null");
+    assertArrayEquals(expectedLoopback, actualLoopback, "Loopback IPv6 address conversion mismatch");
+  }
+
+  private static Stream<Arguments> invalidIPv6Addresses() {
+    return Stream.of(
+      Arguments.of("1", "wrong number of segments"),
+      Arguments.of("1:2", "wrong number of segments"),
+      Arguments.of("1::2:", "empty segment"),
+      Arguments.of(":1::2:", "empty segment"),
+      Arguments.of("1:2:3:4:5:6:7:8:", "wrong number of segments"),
+      Arguments.of("1:2:3:4:5:6:7:8:9", "wrong number of segments"),
+      Arguments.of("1:2::3:4:5:6:7:8", "too many segments"),
+      Arguments.of("1::2::", "too many '::'"),
+      Arguments.of("1:abcdf::", "segment too long"),
+      Arguments.of("efgh::", "invalid hexadecimal characters in segment"),
+      Arguments.of("1:: ", "invalid hexadecimal characters in segment"),
+      Arguments.of(" 1::", "invalid hexadecimal characters in segment")
+    );
+  }
+
+  @ParameterizedTest(name = "address = \"{0}\"")
+  @MethodSource("invalidIPv6Addresses")
+  public void testParsingOfInvalidIPv6Address(String ipv6Address, String expectedMessage) {
+    try {
+      IPAuthenticationProvider.parseV6addr(ipv6Address);
+      fail("expect failure");
+    } catch (IllegalArgumentException e) {
+      assertThat(e.getMessage(), containsString(expectedMessage));
+    }
+    assertNull(IPAuthenticationProvider.v6addr2Bytes(ipv6Address));
+  }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
index e66592e49e9..d1f7c00de2c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
@@ -23,11 +23,15 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
+import java.util.Properties;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -39,6 +43,7 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooDefs.Perms;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
@@ -48,6 +53,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
@@ -69,6 +75,38 @@ public void testIPAuthenticationIsValidCIDR() throws Exception {
         assertFalse(prov.isValid("10.0.0.1/-1"), "testing netmask too low");
     }
 
+    @Test
+    public void testIPAuthenticationIsValidIpv6CIDR() throws Exception {
+        IPAuthenticationProvider prov = new IPAuthenticationProvider();
+        assertTrue(prov.isValid("2001:0db8:85a3:0000:0000:8a2e:0370:7334"), "full address no netmask");
+        assertTrue(prov.isValid("2001:db8:85a3::8a2e:370:7334"), "compressed zeros");
+        assertTrue(prov.isValid("::1"), "loopback with compression");
+        assertTrue(prov.isValid("1::"), "Start with compression");
+        assertTrue(prov.isValid("2001:db8::/4"), "end with compression");
+        assertTrue(prov.isValid("0:0:0:0:0:0:0::/8"), "all zeros");
+        assertTrue(prov.isValid("2001:db8:85a3:0:0:0:0::/32"), "Explicit zeros");
+        assertTrue(prov.isValid("1234:5678:9abc:def0:1234:5678:9abc:def0"), "max hex value");
+        assertFalse(prov.isValid("2001:db8:85a3:0000:0000:8a2e:0370:7334:extra"), "too many address segments");
+        assertFalse(prov.isValid("2001:db8:85a3:0000:0000:8a2e:0370"), "too few address segments");
+        assertFalse(prov.isValid("2001:db8:85a3::8a2e::0370:7334"), "multiple '::' not valid");
+        assertFalse(prov.isValid("2001:db8:85a3:G::8a2e:0370:7334"), "Invalid hex character");
+        assertFalse(prov.isValid(""), "empty string");
+        assertFalse(prov.isValid("2001:db8:85a3:0:0:0:0:1:2"), "too many segments post compression");
+        assertFalse(prov.isValid("2001:db8:85a3::8a2e:0370:7334:"), "trailing colon");
+        assertFalse(prov.isValid(":2001:db8:85a3::8a2e:0370:7334"), "Leading colon");
+        assertFalse(prov.isValid("::FFFF:192.168.1.1"), "IPv4-mapped");
+        assertTrue(prov.isValid("2001:db8:1234::/64"), "IPv6 address for multiple clients");
+    }
+
+    @Test
+    public void testIPAuthenticationIsValidIpv6Mask() throws Exception {
+        IPAuthenticationProvider prov = new IPAuthenticationProvider();
+        assertTrue(prov.matches("2001:db8:1234::", "2001:db8:1234::/64"));
+        assertTrue(prov.matches("2001:0db8:85a3:0000:0000:8a2e:0370:7334", "2001:0db8:85a3:0000:0000:8a2e:0370::/2"));
+        assertFalse(prov.matches("22001:db8:85a3:0:0:0:0::0", "2001:db8:85a3:0:0:0:0::/32"));
+        assertFalse(prov.matches("2001:db8::/4", "2001:db8::/4"));
+    }
+
     @Test
     public void testNettyIpAuthDefault(@TempDir File tmpDir) throws Exception {
         String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
@@ -101,6 +139,132 @@ public void testNettyIpAuthDefault(@TempDir File tmpDir) throws Exception {
         }
     }
 
+    @Test
+    public void testAuthWithIPV6Server(@TempDir File tmpDir) throws Exception {
+        Properties properties = new Properties();
+        properties.setProperty("clientPortAddress", "::1");
+        properties.setProperty("clientPort", "0");
+
+        ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded.builder()
+            .baseDir(tmpDir.toPath())
+            .configuration(properties)
+            .build();
+        server.start();
+
+        String connectionString = server.getConnectionString();
+        String port = connectionString.substring(connectionString.lastIndexOf(':') + 1);
+
+        String hostport = String.format("[::1]:%s", port);
+        assertTrue(ClientBase.waitForServerUp(hostport, CONNECTION_TIMEOUT), "waiting for server being up");
+
+        // given: ipv6 client
+        ZooKeeper zk = ClientBase.createZKClient(hostport);
+
+        // when: invalid ipv6 network acl
+        // then: InvalidACL
+        assertThrows(KeeperException.InvalidACLException.class, () ->
+            zk.create("/invalid-ipv6-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::1/256"))), CreateMode.PERSISTENT));
+
+        // given: ipv4 network acl
+        zk.create("/unmatched-ipv4-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1/16"))), CreateMode.PERSISTENT);
+        // when: access with v6 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/unmatched-ipv4-network-acl", null, -1));
+
+        // given: prefix matched ipv4 acl
+        zk.create("/prefix-matched-ipv4-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "0.0.0.1/16"))), CreateMode.PERSISTENT);
+        // when: access with v6 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/prefix-matched-ipv4-acl", null, -1));
+
+        // given: ipv6 with network acl
+        zk.create("/ipv6-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::1/64"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/ipv6-network-acl", null, -1);
+
+        // given: ipv6 acl
+        zk.create("/ipv6-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::1"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/ipv6-acl", null, -1);
+
+        // given: mismatched ipv6 with network acl
+        zk.create("/mismatched-ipv6-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "0000:0001::/32"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv6-network-acl", null, -1));
+
+        // given: mismatched ipv6 acl
+        zk.create("/mismatched-ipv6-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::2"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv6-acl", null, -1));
+
+        server.close();
+    }
+
+    @Test
+    public void testAuthWithIPV4Server(@TempDir File tmpDir) throws Exception {
+        Properties properties = new Properties();
+        properties.setProperty("clientPortAddress", "127.0.0.1");
+        properties.setProperty("clientPort", "0");
+
+        ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded.builder()
+            .baseDir(tmpDir.toPath())
+            .configuration(properties)
+            .build();
+        server.start();
+
+        assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), CONNECTION_TIMEOUT), "waiting for server being up");
+
+        // given: ipv4 client
+        ZooKeeper zk = ClientBase.createZKClient(server.getConnectionString());
+
+        // when: invalid ipv4 network acl
+        // then: InvalidACL
+        assertThrows(KeeperException.InvalidACLException.class, () ->
+            zk.create("/invalid-ipv4-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1/64"))), CreateMode.PERSISTENT));
+
+        // given: ipv6 acl
+        zk.create("/mismatched-ipv6-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "::1"))), CreateMode.PERSISTENT);
+        // when: access with v4 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv6-acl", null, -1));
+
+        // given: prefix matched ipv6 network acl
+        zk.create("/prefix-matched-ipv6-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "7f::/16"))), CreateMode.PERSISTENT);
+        // when: access with v4 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/prefix-matched-ipv6-network-acl", null, -1));
+
+        // given: ipv4 with network acl
+        zk.create("/matched-ipv4-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1/16"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/matched-ipv4-network-acl", null, -1);
+
+        // given: matched ipv4 acl
+        zk.create("/matched-ipv4-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/matched-ipv4-acl", null, -1);
+
+        // given: mismatched ipv4 network acl
+        zk.create("/mismatched-ipv4-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "192.168.0.2/16"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv4-network-acl", null, -1));
+
+        // given: mismatched ipv4 acl
+        zk.create("/mismatched-ipv4-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.2"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv4-acl", null, -1));
+
+        server.close();
+    }
+
     @Test
     public void testDisconnectedAddAuth(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();

From 71e173fcbcc9deb784081cf867bd045df3c32635 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Tue, 19 Aug 2025 13:32:52 -0500
Subject: [PATCH 536/591] ZOOKEEPER-4964. Check permissions individually during
 admin server auth

Reviewers: andor, phunt
Author: ztzg
---
 .../zookeeper/server/admin/Commands.java      | 21 ++++++++-
 .../server/admin/CommandAuthTest.java         | 46 +++++++++++++++----
 .../admin/SnapshotAndRestoreCommandTest.java  |  4 +-
 3 files changed, 59 insertions(+), 12 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index cd5adc76ac6..ae7c4369137 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -227,6 +227,18 @@ private static List<Id> handleAuthentication(final HttpServletRequest request, f
         }
     }
 
+    /**
+     * Grant or deny authorization for a command by matching
+     * request-provided credentials with the ACLs present on a node.
+     *
+     * @param zkServer the ZooKeeper server object.
+     * @param ids the credentials extracted from the Authorization header.
+     * @param perm the set of permission bits required by the command.
+     * @param path the ZooKeeper node path whose ACLs should be used
+     * to satisfy the perm bits.
+     * @throws KeeperException.NoAuthException if one or more perm
+     * bits could not be satisfied.
+     */
     private static void handleAuthorization(final ZooKeeperServer zkServer,
                                             final List<Id> ids,
                                             final int perm,
@@ -237,7 +249,14 @@ private static void handleAuthorization(final ZooKeeperServer zkServer,
             throw new KeeperException.NoNodeException(path);
         }
         final List<ACL> acls = zkServer.getZKDatabase().aclForNode(dataNode);
-        zkServer.checkACL(null, acls, perm, ids, path, null);
+        // Check the individual bits of perm.
+        final int bitWidth = Integer.SIZE - Integer.numberOfLeadingZeros(perm);
+        for (int b = 0; b < bitWidth; b++) {
+            final int permBit = 1 << b;
+            if ((perm & permBit) != 0) {
+                zkServer.checkACL(null, acls, permBit, ids, path, null);
+            }
+        }
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
index a6f200a1024..ed5dea56cf2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
@@ -29,9 +29,11 @@
 import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import javax.net.ssl.HttpsURLConnection;
 import javax.net.ssl.SSLContext;
@@ -185,6 +187,22 @@ public void testAuthCheck_noACL(final AuthSchema authSchema) throws Exception {
         assertEquals(HttpURLConnection.HTTP_OK, authTestConn.getResponseCode());
     }
 
+    @ParameterizedTest
+    @EnumSource(value = AuthSchema.class, names = {"DIGEST"})
+    public void testAuthCheck_noPerms(final AuthSchema authSchema) throws Exception {
+        // The extra ACL entry gives Perms.READ perms to the "invalid"
+        // DIGEST authInfo---but that should not permit access, as
+        // AuthTestCommand requires Perms.ADMIN.
+        setupRootACL(authSchema, ZooDefs.Ids.READ_ACL_UNSAFE);
+        try {
+            final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, false);
+            assertEquals(HttpURLConnection.HTTP_FORBIDDEN, authTestConn.getResponseCode());
+        } finally {
+            addAuthInfo(zk, authSchema);
+            resetRootACL(zk);
+        }
+    }
+
     @Test
     public void testAuthCheck_invalidServerRequiredConfig() {
         assertThrows("An active server is required for auth check",
@@ -300,19 +318,29 @@ public void clearTLS() {
     }
 
     private void setupRootACL(final AuthSchema authSchema) throws Exception {
+        setupRootACL(authSchema, Collections.<ACL>emptyList());
+    }
+
+    private void setupRootACL(final AuthSchema authSchema, final List<ACL> extraEntries) throws Exception {
+        final List<ACL> aclEntries = new ArrayList<>();
+
         switch (authSchema) {
             case DIGEST:
-                setupRootACLForDigest(zk);
+                aclEntries.addAll(genACLForDigest());
                 break;
             case X509:
-                setupRootACLForX509(zk);
+                aclEntries.addAll(genACLForX509());
                 break;
             case IP:
-                setupRootACLForIP(zk);
+                aclEntries.addAll(genACLForIP());
                 break;
             default:
                 throw new IllegalArgumentException("Unknown auth schema");
         }
+
+        aclEntries.addAll(extraEntries);
+
+        zk.setACL(Commands.ROOT_PATH, aclEntries, -1);
     }
 
     private HttpURLConnection sendAuthTestCommandRequest(final AuthSchema authSchema, final boolean validAuthInfo) throws Exception  {
@@ -343,22 +371,22 @@ public static void resetRootACL(final ZooKeeper zk) throws Exception {
         zk.setACL(Commands.ROOT_PATH, OPEN_ACL_UNSAFE, -1);
     }
 
-    public static void setupRootACLForDigest(final ZooKeeper zk) throws Exception  {
+    public static List<ACL> genACLForDigest() throws Exception  {
         final String idPassword = String.format("%s:%s", ROOT_USER, ROOT_PASSWORD);
         final String digest = DigestAuthenticationProvider.generateDigest(idPassword);
 
         final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(DIGEST_SCHEMA, digest));
-        zk.setACL(Commands.ROOT_PATH, Collections.singletonList(acl), -1);
+        return Collections.singletonList(acl);
     }
 
-    private static void setupRootACLForX509(final ZooKeeper zk) throws Exception  {
+    private static List<ACL> genACLForX509() throws Exception  {
         final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(X509_SCHEMA, X509_SUBJECT_PRINCIPAL));
-        zk.setACL(Commands.ROOT_PATH, Collections.singletonList(acl), -1);
+        return Collections.singletonList(acl);
     }
 
-    private static void setupRootACLForIP(final ZooKeeper zk) throws Exception  {
+    private static List<ACL> genACLForIP() throws Exception  {
         final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(IP_SCHEMA, "127.0.0.1"));
-        zk.setACL(Commands.ROOT_PATH, Collections.singletonList(acl), -1);
+        return Collections.singletonList(acl);
     }
 
     public static void addAuthInfoForDigest(final ZooKeeper zk) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
index a2f31fe866a..03da02db82e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
@@ -21,7 +21,7 @@
 import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
 import static org.apache.zookeeper.server.admin.CommandAuthTest.addAuthInfoForDigest;
 import static org.apache.zookeeper.server.admin.CommandAuthTest.resetRootACL;
-import static org.apache.zookeeper.server.admin.CommandAuthTest.setupRootACLForDigest;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.genACLForDigest;
 import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
 import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
@@ -119,7 +119,7 @@ public void setup() throws Exception {
         zk = ClientBase.createZKClient(hostPort);
 
         // setup root ACL
-        setupRootACLForDigest(zk);
+        zk.setACL(Commands.ROOT_PATH, genACLForDigest(), -1);
 
         // add auth
         addAuthInfoForDigest(zk);

From a46eecfff01bbbdcc433c7684b2e666d35f26e3d Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Tue, 19 Aug 2025 14:41:22 -0500
Subject: [PATCH 537/591] ZOOKEEPER-4964. Check permissions individually during
 admin server auth [ADDENDUM] - build fix

---
 .../zookeeper/server/admin/SnapshotAndRestoreCommandTest.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
index 03da02db82e..8e189188f78 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
@@ -20,8 +20,8 @@
 
 import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
 import static org.apache.zookeeper.server.admin.CommandAuthTest.addAuthInfoForDigest;
-import static org.apache.zookeeper.server.admin.CommandAuthTest.resetRootACL;
 import static org.apache.zookeeper.server.admin.CommandAuthTest.genACLForDigest;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.resetRootACL;
 import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
 import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
 import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;

From 8b1361514e6c3ea853780de2f00a74654e8ea8dc Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Thu, 21 Aug 2025 03:16:31 +0800
Subject: [PATCH 538/591] ZOOKEEPER-4965: Drop unnecessary deprecation warning
 suppressions

Reviewers: tisonkun
Author: kezhuw
Closes #2304 from kezhuw/ZOOKEEPER-4965-drop-unnecessary-deprecation-suppress
---
 .../java/org/apache/zookeeper/ZooKeeper.java     |  5 ++---
 .../apache/zookeeper/client/ZKClientConfig.java  | 16 +++++-----------
 .../zookeeper/client/ZooKeeperSaslClient.java    |  6 +++---
 .../zookeeper/server/quorum/QuorumPeer.java      |  1 -
 .../apache/zookeeper/test/ReadOnlyModeTest.java  |  1 -
 5 files changed, 10 insertions(+), 19 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index c6ca3bef0a7..20421600a53 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -154,15 +154,14 @@ public class ZooKeeper implements AutoCloseable {
      *             instead.
      */
     @Deprecated
-    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = "zookeeper.clientCnxnSocket";
-    // Setting this to "true" will enable encrypted client-server communication.
+    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET;
 
     /**
      * @deprecated Use {@link ZKClientConfig#SECURE_CLIENT}
      *             instead.
      */
     @Deprecated
-    public static final String SECURE_CLIENT = "zookeeper.client.secure";
+    public static final String SECURE_CLIENT = ZKClientConfig.SECURE_CLIENT;
 
     protected final ClientCnxn cnxn;
     private static final Logger LOG;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index 10c61375d1d..7aa9c740841 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -20,7 +20,6 @@
 
 import java.io.File;
 import org.apache.yetus.audience.InterfaceAudience;
-import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 
@@ -35,13 +34,10 @@ public class ZKClientConfig extends ZKConfig {
     public static final String ZK_SASL_CLIENT_USERNAME_DEFAULT = "zookeeper";
     public static final String ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME = "zookeeper.sasl.client.canonicalize.hostname";
     public static final String ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME_DEFAULT = "true";
-    @SuppressWarnings("deprecation")
-    public static final String LOGIN_CONTEXT_NAME_KEY = ZooKeeperSaslClient.LOGIN_CONTEXT_NAME_KEY;
+    public static final String LOGIN_CONTEXT_NAME_KEY = "zookeeper.sasl.clientconfig";
     public static final String LOGIN_CONTEXT_NAME_KEY_DEFAULT = "Client";
-    @SuppressWarnings("deprecation")
-    public static final String ENABLE_CLIENT_SASL_KEY = ZooKeeperSaslClient.ENABLE_CLIENT_SASL_KEY;
-    @SuppressWarnings("deprecation")
-    public static final String ENABLE_CLIENT_SASL_DEFAULT = ZooKeeperSaslClient.ENABLE_CLIENT_SASL_DEFAULT;
+    public static final String ENABLE_CLIENT_SASL_KEY = "zookeeper.sasl.client";
+    public static final String ENABLE_CLIENT_SASL_DEFAULT = "true";
     public static final String ZOOKEEPER_SERVER_REALM = "zookeeper.server.realm";
     /**
      * This controls whether automatic watch resetting is enabled. Clients
@@ -50,13 +46,11 @@ public class ZKClientConfig extends ZKConfig {
      * "zookeeper.disableAutoWatchReset" to "true"
      */
     public static final String DISABLE_AUTO_WATCH_RESET = "zookeeper.disableAutoWatchReset";
-    @SuppressWarnings("deprecation")
-    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = ZooKeeper.ZOOKEEPER_CLIENT_CNXN_SOCKET;
+    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = "zookeeper.clientCnxnSocket";
     /**
      * Setting this to "true" will enable encrypted client-server communication.
      */
-    @SuppressWarnings("deprecation")
-    public static final String SECURE_CLIENT = ZooKeeper.SECURE_CLIENT;
+    public static final String SECURE_CLIENT = "zookeeper.client.secure";
     public static final int CLIENT_MAX_PACKET_LENGTH_DEFAULT = 0xfffff; /* 1 MB */
     public static final String ZOOKEEPER_REQUEST_TIMEOUT = "zookeeper.request.timeout";
     public static final String ZOOKEEPER_SERVER_PRINCIPAL = "zookeeper.server.principal";
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
index 4ec85625d78..7bccbe80ec6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
@@ -54,19 +54,19 @@ public class ZooKeeperSaslClient {
      *             instead.
      */
     @Deprecated
-    public static final String LOGIN_CONTEXT_NAME_KEY = "zookeeper.sasl.clientconfig";
+    public static final String LOGIN_CONTEXT_NAME_KEY = ZKClientConfig.LOGIN_CONTEXT_NAME_KEY;
     /**
      * @deprecated Use {@link ZKClientConfig#ENABLE_CLIENT_SASL_KEY}
      *             instead.
      */
     @Deprecated
-    public static final String ENABLE_CLIENT_SASL_KEY = "zookeeper.sasl.client";
+    public static final String ENABLE_CLIENT_SASL_KEY = ZKClientConfig.ENABLE_CLIENT_SASL_KEY;
     /**
      * @deprecated Use {@link ZKClientConfig#ENABLE_CLIENT_SASL_DEFAULT}
      *             instead.
      */
     @Deprecated
-    public static final String ENABLE_CLIENT_SASL_DEFAULT = "true";
+    public static final String ENABLE_CLIENT_SASL_DEFAULT = ZKClientConfig.ENABLE_CLIENT_SASL_DEFAULT;
 
     /**
      * Returns true if the SASL client is enabled. By default, the client
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 9a18d59d401..286d2d320f1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1439,7 +1439,6 @@ protected Election createElectionAlgorithm(int electionAlgorithm) {
         return le;
     }
 
-    @SuppressWarnings("deprecation")
     protected Election makeLEStrategy() {
         LOG.debug("Initializing leader election protocol...");
         return electionAlg;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 521a1247d16..1a95372c42a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -285,7 +285,6 @@ public void testGlobalSessionInRO() throws Exception {
      * Ensures that client seeks for r/w servers while it's connected to r/o
      * server.
      */
-    @SuppressWarnings("deprecation")
     @Test
     @Timeout(value = 90)
     public void testSeekForRwServer() throws Exception {

From d4f555f45e1c123fcd9da02bcf5b2e33825aa354 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sat, 23 Aug 2025 13:58:18 +0800
Subject: [PATCH 539/591] ZOOKEEPER-4963: Add `ZooKeeper::builder` to replace
 `new ZooKeeperBuilder`

ZOOKEEPER-4963: Add `ZooKeeper::builder` to replace `new ZooKeeperBuilder`
`ZooKeeper::builder` should be better:
1. More exposure chance as a newly introduce method in class `ZooKeeper`.
2. No need to import or remember the newly introduced class as most
   `ZooKeeper` instances could be built in one chain.
`ZooKeeperBuilder` is introduced in 3.10.0 so it safe to do this.
Refs: ZOOKEEPER-4697
Reviewers: anmolnar
Author: kezhuw
Closes #2301 from kezhuw/ZOOKEEPER-4963-ZooKeeper_builder
---
 .../java/org/apache/zookeeper/ZooKeeper.java  | 61 ++++++++++++++++---
 .../zookeeper/client/ZooKeeperBuilder.java    | 19 ++----
 .../client/ZooKeeperBuilderTest.java          |  5 +-
 3 files changed, 59 insertions(+), 26 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 20421600a53..216e497ad40 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -418,6 +418,25 @@ public boolean isConnected() {
         }
     }
 
+    /**
+     * Creates a builder with given connect string and session timeout.
+     *
+     * @param connectString
+     *            comma separated host:port pairs, each corresponding to a zk
+     *            server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002"
+     *            If the optional chroot suffix is used the example would look
+     *            like: "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002/app/a"
+     *            where the client would be rooted at "/app/a" and all paths
+     *            would be relative to this root - ie getting/setting/etc...
+     *            "/foo/bar" would result in operations being run on
+     *            "/app/a/foo/bar" (from the server perspective).
+     * @param sessionTimeout
+     *            session timeout
+     */
+    public static ZooKeeperBuilder builder(String connectString, Duration sessionTimeout) {
+        return new ZooKeeperBuilder(connectString, sessionTimeout);
+    }
+
     /**
      * To create a ZooKeeper client object, the application needs to pass a
      * connection string containing a comma separated list of host:port pairs,
@@ -460,9 +479,11 @@ public boolean isConnected() {
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .toOptions());
     }
@@ -511,13 +532,15 @@ public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) thro
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
         int sessionTimeout,
         Watcher watcher,
         ZKClientConfig conf) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withClientConfig(conf)
             .toOptions());
@@ -579,6 +602,8 @@ public ZooKeeper(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -586,7 +611,7 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .withHostProvider(ignored -> aHostProvider)
@@ -651,6 +676,8 @@ public ZooKeeper(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -660,7 +687,7 @@ public ZooKeeper(
         HostProvider hostProvider,
         ZKClientConfig clientConfig
     ) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .withHostProvider(ignored -> hostProvider)
@@ -740,13 +767,15 @@ ClientCnxn createConnection(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
         int sessionTimeout,
         Watcher watcher,
         boolean canBeReadOnly) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .toOptions());
@@ -805,6 +834,8 @@ public ZooKeeper(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -812,7 +843,7 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         ZKClientConfig conf) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
             .withClientConfig(conf)
@@ -870,6 +901,8 @@ public ZooKeeper(
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
      * @throws IllegalArgumentException for an invalid list of ZooKeeper hosts
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -877,7 +910,7 @@ public ZooKeeper(
         Watcher watcher,
         long sessionId,
         byte[] sessionPasswd) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withSession(sessionId, sessionPasswd)
             .toOptions());
@@ -946,6 +979,8 @@ public ZooKeeper(
      *            use this as HostProvider to enable custom behaviour.
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -955,7 +990,7 @@ public ZooKeeper(
         byte[] sessionPasswd,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withSession(sessionId, sessionPasswd)
             .withCanBeReadOnly(canBeReadOnly)
@@ -1031,6 +1066,8 @@ public ZooKeeper(
      * @throws IllegalArgumentException if an invalid chroot path is specified
      *
      * @since 3.5.5
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1041,7 +1078,7 @@ public ZooKeeper(
         boolean canBeReadOnly,
         HostProvider hostProvider,
         ZKClientConfig clientConfig) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withSession(sessionId, sessionPasswd)
             .withDefaultWatcher(watcher)
             .withCanBeReadOnly(canBeReadOnly)
@@ -1053,6 +1090,8 @@ public ZooKeeper(
     /**
      * Create a ZooKeeper client and establish session asynchronously.
      *
+     * <p>This is private and export for internal usage.
+     *
      * <p>This constructor will initiate connection to the server and return
      * immediately - potentially (usually) before the session is fully established.
      * The watcher from options will be notified of any changes in state. This
@@ -1180,6 +1219,8 @@ public ZooKeeper(ZooKeeperOptions options) throws IOException {
      *            majority in the background.
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1188,7 +1229,7 @@ public ZooKeeper(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly) throws IOException {
-        this(new ZooKeeperBuilder(connectString, Duration.ofMillis(sessionTimeout))
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
             .withDefaultWatcher(watcher)
             .withSession(sessionId, sessionPasswd)
             .withCanBeReadOnly(canBeReadOnly)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
index 36f815ab2da..f484dcfeef5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
@@ -47,22 +47,11 @@ public class ZooKeeperBuilder {
     private ZKClientConfig clientConfig;
 
     /**
-     * Creates a builder with given connect string and session timeout.
-     *
-     * @param connectString
-     *            comma separated host:port pairs, each corresponding to a zk
-     *            server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002"
-     *            If the optional chroot suffix is used the example would look
-     *            like: "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002/app/a"
-     *            where the client would be rooted at "/app/a" and all paths
-     *            would be relative to this root - ie getting/setting/etc...
-     *            "/foo/bar" would result in operations being run on
-     *            "/app/a/foo/bar" (from the server perspective).
-     * @param sessionTimeout
-     *            session timeout
+     * This is private and export for internal usage. Use {@link ZooKeeper#builder(String, Duration)} instead.
      */
+    @InterfaceAudience.Private
     public ZooKeeperBuilder(String connectString, Duration sessionTimeout) {
-        this.connectString = connectString;
+        this.connectString = Objects.requireNonNull(connectString, "connect string must not be null");
         this.sessionTimeout = Objects.requireNonNull(sessionTimeout, "session timeout must not be null");
     }
 
@@ -145,6 +134,8 @@ public ZooKeeperBuilder withClientConfig(ZKClientConfig clientConfig) {
     /**
      * Creates a {@link ZooKeeperOptions} with configured options.
      *
+     * <p>This is private and export for internal usage.
+     *
      * @apiNote helper to delegate existing constructors to {@link ZooKeeper#ZooKeeper(ZooKeeperOptions)}
      */
     @InterfaceAudience.Private
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
index 250982e74cb..0a7b4aae50b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
@@ -29,6 +29,7 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.Test;
@@ -70,7 +71,7 @@ private void testClient(BlockingQueue<WatchedEvent> events, ZooKeeper zk) throws
     @Test
     public void testBuildClient() throws Exception {
         BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
-        ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(1000))
+        ZooKeeper zk = ZooKeeper.builder(hostPort, Duration.ofMillis(1000))
             .withDefaultWatcher(events::offer)
             .build();
         testClient(events, zk);
@@ -79,7 +80,7 @@ public void testBuildClient() throws Exception {
     @Test
     public void testBuildAdminClient() throws Exception {
         BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
-        ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(1000))
+        ZooKeeperAdmin zk = ZooKeeper.builder(hostPort, Duration.ofMillis(1000))
             .withDefaultWatcher(events::offer)
             .buildAdmin();
         testClient(events, zk);

From bbcdbab1065fd02f2516a19387b28c07dd31b4bd Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sat, 23 Aug 2025 13:59:20 +0800
Subject: [PATCH 540/591] ZOOKEEPER-842: Generate jute method `copyFrom` to
 decouple `ZooKeeper` from `DataTree`

ZOOKEEPER-842: Generate jute method `copyFrom` to decouple `ZooKeeper` from `DataTree`
Currently, `ZooKeeper` uses `DataTree::copyStat` to copy `Stat` from one
to another. This couples client side `ZooKeeper` to server side
`DataTree`.
By using generated `copyFrom`, we decouple `ZooKeeper` from server side
codes.
This is a small step towards ZOOKEEPER-233.
Refs: ZOOKEEPER-233, ZOOKEEPER-835, ZOOKEEPER-1275 and ZOOKEEPER-842.
Reviewers: tisonkun
Author: kezhuw
Closes #2305 from kezhuw/ZOOKEEPER-842-drop-client-dependency-on-DataTree
---
 .../org/apache/jute/compiler/JRecord.java     | 10 +++++++
 .../java/org/apache/zookeeper/ZooKeeper.java  | 11 ++++----
 .../zookeeper/admin/ZooKeeperAdmin.java       |  3 +-
 .../org/apache/zookeeper/server/DataTree.java | 28 +------------------
 .../zookeeper/server/ZooKeeperServer.java     |  2 +-
 5 files changed, 18 insertions(+), 36 deletions(-)

diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index 76ebc1731e4..1fb90d55a01 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -491,6 +491,16 @@ public void genJavaCode(File outputDirectory) throws IOException {
                 JField jf = i.next();
                 jj.write(jf.genJavaGetSet(fIdx));
             }
+
+            jj.write("\n");
+            jj.write("  public void copyFrom(" + getName() + " from) {\n");
+            fIdx = 0;
+            for (Iterator<JField> i = mFields.iterator(); i.hasNext(); fIdx++) {
+                JField jf = i.next();
+                jj.write("    " + jf.getName() + " = from." + jf.getName() + ";\n");
+            }
+            jj.write("  }\n");
+
             jj.write("  public void serialize(OutputArchive a_, String tag) throws java.io.IOException {\n");
             jj.write("    a_.startRecord(this,tag);\n");
             fIdx = 0;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 216e497ad40..8831c0622bb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -86,7 +86,6 @@
 import org.apache.zookeeper.proto.SyncRequest;
 import org.apache.zookeeper.proto.SyncResponse;
 import org.apache.zookeeper.proto.WhoAmIResponse;
-import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.EphemeralType;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1539,7 +1538,7 @@ public String create(
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return chroot.strip(response.getPath());
     }
@@ -2056,7 +2055,7 @@ public byte[] getData(final String path, Watcher watcher, Stat stat) throws Keep
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getData();
     }
@@ -2157,7 +2156,7 @@ public byte[] getConfig(Watcher watcher, Stat stat) throws KeeperException, Inte
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), configZnode);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getData();
     }
@@ -2319,7 +2318,7 @@ public List<ACL> getACL(final String path, Stat stat) throws KeeperException, In
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getAcl();
     }
@@ -2563,7 +2562,7 @@ public List<String> getChildren(
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getChildren();
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
index 4d5dc6fd263..75d088d4dfc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
@@ -34,7 +34,6 @@
 import org.apache.zookeeper.proto.ReconfigRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
-import org.apache.zookeeper.server.DataTree;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -252,7 +251,7 @@ public byte[] reconfigure(
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), "");
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getData();
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index d017427a422..b682ec64fb0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -342,32 +342,6 @@ boolean isSpecialPath(String path) {
                || configZookeeper.equals(path);
     }
 
-    public static void copyStatPersisted(StatPersisted from, StatPersisted to) {
-        to.setAversion(from.getAversion());
-        to.setCtime(from.getCtime());
-        to.setCversion(from.getCversion());
-        to.setCzxid(from.getCzxid());
-        to.setMtime(from.getMtime());
-        to.setMzxid(from.getMzxid());
-        to.setPzxid(from.getPzxid());
-        to.setVersion(from.getVersion());
-        to.setEphemeralOwner(from.getEphemeralOwner());
-    }
-
-    public static void copyStat(Stat from, Stat to) {
-        to.setAversion(from.getAversion());
-        to.setCtime(from.getCtime());
-        to.setCversion(from.getCversion());
-        to.setCzxid(from.getCzxid());
-        to.setMtime(from.getMtime());
-        to.setMzxid(from.getMzxid());
-        to.setPzxid(from.getPzxid());
-        to.setVersion(from.getVersion());
-        to.setEphemeralOwner(from.getEphemeralOwner());
-        to.setDataLength(from.getDataLength());
-        to.setNumChildren(from.getNumChildren());
-    }
-
     /**
      * update the count/bytes of this stat data node
      *
@@ -1305,7 +1279,7 @@ void serializeNode(OutputArchive oa, StringBuilder path) throws IOException {
         DataNode nodeCopy;
         synchronized (node) {
             StatPersisted statCopy = new StatPersisted();
-            copyStatPersisted(node.stat, statCopy);
+            statCopy.copyFrom(node.stat);
             //we do not need to make a copy of node.data because the contents
             //are never changed
             nodeCopy = new DataNode(node.data, node.acl, statCopy);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 11ec1fb7413..080f4f8638d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -1064,7 +1064,7 @@ static class ChangeRecord {
         ChangeRecord duplicate(long zxid) {
             StatPersisted stat = new StatPersisted();
             if (this.stat != null) {
-                DataTree.copyStatPersisted(this.stat, stat);
+                stat.copyFrom(this.stat);
             }
             ChangeRecord changeRecord = new ChangeRecord(zxid, path, stat, childCount,
                     acl == null ? new ArrayList<>() : new ArrayList<>(acl));

From b4443e82c61f98356079eb9b53ff85f62fbd30a1 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Wed, 27 Aug 2025 11:46:16 +0800
Subject: [PATCH 541/591] ZOOKEEPER-842: [ADDENDUM] Keep `DataTree::copyStat`
 for compatibility with Apache Curator

ZOOKEEPER-842: [ADDENDUM] Keep `DataTree::copyStat` for compatibility with Apache Curator
`DataTree` is apparently internal to zookeeper. But we don't export
public alternatives to `copyStat` and `copyStatPersisted` until now.
So, let's keep them for some releases to let downstream libraries to
migrate to `Stat::copyFrom`.
Refs: ZOOKEEPER-842, #2305.
Reviewers: tisonkun
Author: kezhuw
Closes #2310 from kezhuw/ZOOKEEPER-842-addendum-keep-DataTree_copyStat-for-compatibility
---
 .../org/apache/zookeeper/server/DataTree.java | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index b682ec64fb0..a9c69b48601 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -342,6 +342,26 @@ boolean isSpecialPath(String path) {
                || configZookeeper.equals(path);
     }
 
+    /**
+     * Use {@link StatPersisted#copyFrom(StatPersisted)} instead.
+     *
+     * <p>Apache Curator uses it, let's keep it for now to let them and their clients to react.
+     */
+    @Deprecated
+    public static void copyStatPersisted(StatPersisted from, StatPersisted to) {
+        to.copyFrom(from);
+    }
+
+    /**
+     * Use {@link Stat#copyFrom(Stat)} instead.
+     *
+     * <p> Apache Curator uses it, let's keep it for now to let them and their clients to react.
+     */
+    @Deprecated
+    public static void copyStat(Stat from, Stat to) {
+        to.copyFrom(from);
+    }
+
     /**
      * update the count/bytes of this stat data node
      *

From 45b49a5aa9d7f2f699619eb9f486e2b89bdc19d7 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Wed, 27 Aug 2025 23:51:34 +0800
Subject: [PATCH 542/591] ZOOKEEPER-4955: [ADDENDUM] Refactor Ca, Cert and etc.
 so to be reusable

Reviewers: anmolnar
Author: kezhuw
Closes #2300 from kezhuw/ZOOKEEPER-4955-addendum-refactor-test-helpers
---
 .../org/apache/zookeeper/common/ssl/Ca.java   | 193 +++++++++
 .../org/apache/zookeeper/common/ssl/Cert.java |  91 ++++
 .../zookeeper/common/ssl/CertSigner.java      | 174 ++++++++
 .../zookeeper/common/ssl/OCSPHandler.java     | 128 ++++++
 .../apache/zookeeper/common/ssl/PemFile.java  |  31 ++
 .../zookeeper/common/ssl/X509CertBuilder.java |  26 ++
 .../server/ClientSSLRevocationTest.java       | 406 ++----------------
 7 files changed, 679 insertions(+), 370 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java

diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java
new file mode 100644
index 00000000000..dfeea301243
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java
@@ -0,0 +1,193 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.FileWriter;
+import java.math.BigInteger;
+import java.net.InetSocketAddress;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.security.KeyPair;
+import java.security.cert.X509Certificate;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.atomic.AtomicLong;
+import org.apache.zookeeper.common.X509TestHelpers;
+import org.bouncycastle.asn1.ASN1GeneralizedTime;
+import org.bouncycastle.asn1.ocsp.RevokedInfo;
+import org.bouncycastle.asn1.x509.CRLNumber;
+import org.bouncycastle.asn1.x509.CRLReason;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.cert.X509CRLHolder;
+import org.bouncycastle.cert.X509v2CRLBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
+import org.bouncycastle.cert.jcajce.JcaX509v2CRLBuilder;
+import org.bouncycastle.openssl.MiscPEMGenerator;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.util.io.pem.PemWriter;
+
+public class Ca implements AutoCloseable {
+    public static class CaBuilder {
+        private final Path dir;
+        private String name = "CA";
+        private boolean ocsp = false;
+
+        CaBuilder(Path dir) {
+            this.dir = dir;
+        }
+
+        public CaBuilder withName(String name) {
+            this.name = Objects.requireNonNull(name);
+            return this;
+        }
+
+        public CaBuilder withOcsp() {
+            this.ocsp = true;
+            return this;
+        }
+
+        public Ca build() throws Exception {
+            KeyPair caKey = X509TestHelpers.generateRSAKeyPair();
+            X509Certificate caCert = X509TestHelpers.newSelfSignedCert(name, caKey);
+            if (ocsp) {
+                HttpServer ocspServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+                Ca ca = new Ca(dir, name, caKey, caCert, ocspServer);
+                ca.ocspServer.createContext("/", new OCSPHandler(ca));
+                ca.ocspServer.start();
+                return ca;
+            }
+            return new Ca(dir, name, caKey, caCert, null);
+        }
+    }
+
+    public final Path dir;
+    public final String name;
+    public final KeyPair key;
+    public final X509Certificate cert;
+    public final Map<X509Certificate, RevokedInfo> crlRevokedCerts = Collections.synchronizedMap(new HashMap<>());
+    public final Map<X509Certificate, RevokedInfo> ocspRevokedCerts = Collections.synchronizedMap(new HashMap<>());
+    public final HttpServer ocspServer;
+    public final AtomicLong crlNumber = new AtomicLong(1);
+    public final PemFile pemFile;
+
+    Ca(Path dir, String name, KeyPair key, X509Certificate cert, HttpServer ocspServer) throws Exception {
+        this.dir = dir;
+        this.name = name;
+        this.key = key;
+        this.cert = cert;
+        this.ocspServer = ocspServer;
+        this.pemFile = writePem();
+    }
+
+    private PemFile writePem() throws Exception {
+        String pem = X509TestHelpers.pemEncodeX509Certificate(cert);
+        Path file = Files.createTempFile(dir, name, ".pem");
+        Files.write(file, pem.getBytes());
+        return new PemFile(file, "");
+    }
+
+    // Check result of crldp could be cached, so use per-cert crl file.
+    public void flush_crl(Cert cert) throws Exception {
+        Objects.requireNonNull(cert.crl, "cert is signed with no crldp");
+        Instant now = Instant.now();
+
+        X509v2CRLBuilder builder = new JcaX509v2CRLBuilder(cert.cert.getIssuerX500Principal(), Date.from(now));
+        builder.setNextUpdate(Date.from(now.plusSeconds(2)));
+
+        builder.addExtension(Extension.authorityKeyIdentifier, false, new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(this.cert));
+        builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(crlNumber.getAndAdd(1L))));
+
+        for (Map.Entry<X509Certificate, RevokedInfo> entry : crlRevokedCerts.entrySet()) {
+            builder.addCRLEntry(entry.getKey().getSerialNumber(), entry.getValue().getRevocationTime().getDate(), CRLReason.cACompromise);
+        }
+
+        ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(this.key.getPrivate());
+        X509CRLHolder crlHolder = builder.build(contentSigner);
+
+        Path tmpFile = Files.createTempFile(dir, "crldp-", ".pem.tmp");
+        PemWriter pemWriter = new PemWriter(new FileWriter(tmpFile.toFile()));
+        pemWriter.writeObject(new MiscPEMGenerator(crlHolder));
+        pemWriter.flush();
+        pemWriter.close();
+
+        Files.move(tmpFile, cert.crl, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+    }
+
+    public void revoke_through_crldp(Cert cert) throws Exception {
+        Date now = new Date();
+        RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
+        this.crlRevokedCerts.put(cert.cert, revokedInfo);
+        flush_crl(cert);
+    }
+
+    public void revoke_through_ocsp(X509Certificate cert) throws Exception {
+        Date now = new Date();
+        RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
+        this.ocspRevokedCerts.put(cert, revokedInfo);
+    }
+
+    public CertSigner signer(String name) throws Exception {
+        return new CertSigner(this, name);
+    }
+
+    public Cert sign(String name) throws Exception {
+        return signer(name).sign();
+    }
+
+    public Cert sign_with_crldp(String name) throws Exception {
+        return signer(name).withCrldp().sign();
+    }
+
+    public Cert sign_with_ocsp(String name) throws Exception {
+        return signer(name).withOcsp().sign();
+    }
+
+    public static CaBuilder builder(Path dir) {
+        return new CaBuilder(dir);
+    }
+
+    public static Ca create(Path dir) throws Exception {
+        return Ca.builder(dir).build();
+    }
+
+    public static Ca create(String name, Path dir) throws Exception {
+        return Ca.builder(dir).withName(name).build();
+    }
+
+    public String getOcspAddress() {
+        if (ocspServer != null) {
+            return String.format("http://127.0.0.1:%d", ocspServer.getAddress().getPort());
+        }
+        throw new IllegalStateException("No OCSP server available");
+    }
+
+    @Override
+    public void close() throws Exception {
+        if (ocspServer != null) {
+            ocspServer.stop(0);
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java
new file mode 100644
index 00000000000..d388a7a5d6a
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyPair;
+import java.security.cert.X509Certificate;
+import java.util.Properties;
+import java.util.UUID;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.X509TestHelpers;
+
+public class Cert {
+    public final String name;
+    public final KeyPair key;
+    public final X509Certificate cert;
+    public final Path dir;
+    public final Path crl;
+
+    Cert(String name, KeyPair key, X509Certificate cert, Path dir, Path crl) {
+        this.name = name;
+        this.key = key;
+        this.cert = cert;
+        this.dir = dir;
+        this.crl = crl;
+    }
+
+    public PemFile writePem() throws Exception {
+        String password = UUID.randomUUID().toString();
+        String pem = X509TestHelpers.pemEncodeCertAndPrivateKey(cert, key.getPrivate(), password);
+        Path file = Files.createTempFile(dir, name, ".pem");
+        Files.write(file, pem.getBytes());
+        return new PemFile(file, password);
+    }
+
+    public Properties buildServerProperties(Ca ca) throws Exception {
+        final Properties config = new Properties();
+        config.put("clientPort", "0");
+        config.put("secureClientPort", "0");
+
+        // explicitly ipv4 to avoid dns lookup issue
+        config.put("clientPortAddress", "127.0.0.1");
+        config.put("secureClientPortAddress", "127.0.0.1");
+
+        config.put("admin.enableServer", "false");
+        config.put("admin.rateLimiterIntervalInMS", "0");
+
+        PemFile serverPem = writePem();
+
+        // TLS config fields
+        config.put("ssl.keyStore.location", serverPem.file.toString());
+        config.put("ssl.keyStore.password", serverPem.password);
+        config.put("ssl.trustStore.location", ca.pemFile.file.toString());
+
+        // Netty is required for TLS
+        config.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+        config.put("4lw.commands.whitelist", "*");
+        return config;
+    }
+
+    public ZKClientConfig buildClientConfig(Ca ca) throws Exception {
+        PemFile pemFile = writePem();
+
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty("zookeeper.client.secure", "true");
+        config.setProperty("zookeeper.ssl.keyStore.password", pemFile.password);
+        config.setProperty("zookeeper.ssl.keyStore.location", pemFile.file.toString());
+        config.setProperty("zookeeper.ssl.trustStore.location", ca.pemFile.file.toString());
+
+        // only netty supports TLS
+        config.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+        return config;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java
new file mode 100644
index 00000000000..28ae6d61ee6
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java
@@ -0,0 +1,174 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import java.math.BigInteger;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyPair;
+import java.security.cert.X509Certificate;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Random;
+import org.apache.zookeeper.common.X509TestHelpers;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.AuthorityInformationAccess;
+import org.bouncycastle.asn1.x509.BasicConstraints;
+import org.bouncycastle.asn1.x509.CRLDistPoint;
+import org.bouncycastle.asn1.x509.DistributionPoint;
+import org.bouncycastle.asn1.x509.DistributionPointName;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.GeneralNames;
+import org.bouncycastle.asn1.x509.KeyUsage;
+import org.bouncycastle.asn1.x509.X509ObjectIdentifiers;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+
+public class CertSigner {
+    private final Ca ca;
+    private final String name;
+
+    private Path crldp;
+    private boolean ocsp;
+
+    private final List<String> dnsNames = new ArrayList<>();
+    private final List<String> ipAddresses = new ArrayList<>();
+    private Duration expiration = Duration.ofDays(1);
+    private X509CertBuilder certBuilder;
+
+    CertSigner(Ca ca, String name) {
+        this.ca = ca;
+        this.name = name;
+    }
+
+    public CertSigner withCrldp() throws Exception {
+        this.crldp = Files.createTempFile(ca.dir, String.format("%s-crldp-", name), ".pem");
+        return this;
+    }
+
+    public CertSigner withOcsp() {
+        this.ocsp = true;
+        return this;
+    }
+
+    public CertSigner withDnsName(String name) {
+        dnsNames.add(name);
+        return this;
+    }
+
+    public CertSigner withResolvedDns(String name) throws Exception {
+        dnsNames.add(name);
+        InetAddress[] localAddresses = InetAddress.getAllByName("localhost");
+        for (InetAddress addr : localAddresses) {
+            ipAddresses.add(addr.getHostAddress());
+        }
+        return this;
+    }
+
+    public CertSigner withIpAddress(String ipAddress) {
+        ipAddresses.add(ipAddress);
+        return this;
+    }
+
+    /**
+     * Default to {@code Duration.ofDays(1)}.
+     */
+    public CertSigner withExpiration(Duration expiration) {
+        this.expiration = expiration;
+        return this;
+    }
+
+    public CertSigner withCertBuilder(X509CertBuilder certBuilder) {
+        this.certBuilder = certBuilder;
+        return this;
+    }
+
+    public Cert sign() throws Exception {
+        X509CertificateHolder holder = new JcaX509CertificateHolder(ca.cert);
+        ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(ca.key.getPrivate());
+
+        List<GeneralName> generalNames = new ArrayList<>();
+        for (String dnsName : dnsNames) {
+            generalNames.add(new GeneralName(GeneralName.dNSName, dnsName));
+        }
+        for (String ipAddress : ipAddresses) {
+            generalNames.add(new GeneralName(GeneralName.iPAddress, ipAddress));
+        }
+
+        Instant now = Instant.now();
+        KeyPair key = X509TestHelpers.generateRSAKeyPair();
+        JcaX509v3CertificateBuilder jcaX509v3CertificateBuilder = new JcaX509v3CertificateBuilder(
+                holder.getSubject(),
+                new BigInteger(128, new Random()),
+                Date.from(now.minus(Duration.ofSeconds(10))),
+                Date.from(now.plus(expiration)),
+                new X500Name(String.format("CN=%s", name)),
+                key.getPublic());
+        X509v3CertificateBuilder certificateBuilder = jcaX509v3CertificateBuilder
+                .addExtension(Extension.basicConstraints, true, new BasicConstraints(false))
+                .addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
+
+        if (!generalNames.isEmpty()) {
+            certificateBuilder.addExtension(
+                    Extension.subjectAlternativeName,
+                    true,
+                    new GeneralNames(generalNames.toArray(new GeneralName[]{})));
+        }
+
+        if (crldp != null) {
+            DistributionPointName distPointOne = new DistributionPointName(
+                    new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, "file://" + crldp.toAbsolutePath())));
+
+            certificateBuilder.addExtension(
+                    Extension.cRLDistributionPoints,
+                    false,
+                    new CRLDistPoint(new DistributionPoint[]{new DistributionPoint(distPointOne, null, null)}));
+        }
+
+        if (ocsp) {
+            certificateBuilder.addExtension(
+                    Extension.authorityInfoAccess,
+                    false,
+                    new AuthorityInformationAccess(
+                            X509ObjectIdentifiers.ocspAccessMethod,
+                            new GeneralName(GeneralName.uniformResourceIdentifier, ca.getOcspAddress())));
+        }
+
+        if (certBuilder != null) {
+            certBuilder.build(certificateBuilder);
+        }
+
+        X509Certificate certificate = new JcaX509CertificateConverter().getCertificate(certificateBuilder.build(signer));
+        Cert cert = new Cert(name, key, certificate, ca.dir, crldp);
+        if (crldp != null) {
+            ca.flush_crl(cert);
+        }
+        return cert;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java
new file mode 100644
index 00000000000..5cf37ac3802
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java
@@ -0,0 +1,128 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import com.sun.net.httpserver.Headers;
+import com.sun.net.httpserver.HttpHandler;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.URLDecoder;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Calendar;
+import java.util.Map;
+import java.util.stream.Collectors;
+import org.bouncycastle.asn1.ocsp.OCSPResponse;
+import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
+import org.bouncycastle.asn1.ocsp.RevokedInfo;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.ocsp.BasicOCSPResp;
+import org.bouncycastle.cert.ocsp.BasicOCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.CertificateID;
+import org.bouncycastle.cert.ocsp.CertificateStatus;
+import org.bouncycastle.cert.ocsp.OCSPReq;
+import org.bouncycastle.cert.ocsp.OCSPResp;
+import org.bouncycastle.cert.ocsp.OCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.Req;
+import org.bouncycastle.cert.ocsp.RevokedStatus;
+import org.bouncycastle.cert.ocsp.jcajce.JcaBasicOCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.jcajce.JcaCertificateID;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+class OCSPHandler implements HttpHandler {
+    private static final Logger LOG = LoggerFactory.getLogger(OCSPHandler.class);
+
+    private final Ca ca;
+
+    public OCSPHandler(Ca ca) {
+        this.ca = ca;
+    }
+
+    @Override
+    public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOException {
+        byte[] responseBytes;
+        try {
+            String uri = httpExchange.getRequestURI().toString();
+            LOG.info("OCSP request: {} {}", httpExchange.getRequestMethod(), uri);
+            httpExchange.getRequestHeaders().entrySet().forEach((e) -> {
+                LOG.info("OCSP request header: {} {}", e.getKey(), e.getValue());
+            });
+            InputStream request = httpExchange.getRequestBody();
+            byte[] requestBytes = new byte[10000];
+            int len = request.read(requestBytes);
+            LOG.info("OCSP request size {}", len);
+
+            if (len < 0) {
+                String removedUriEncoding = URLDecoder.decode(uri.substring(1), "utf-8");
+                LOG.info("OCSP request from URI no encoding {}", removedUriEncoding);
+                requestBytes = Base64.getDecoder().decode(removedUriEncoding);
+            }
+            OCSPReq ocspRequest = new OCSPReq(requestBytes);
+            Req[] requestList = ocspRequest.getRequestList();
+            LOG.info("requestList {}", Arrays.toString(requestList));
+
+            DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
+
+            Map<CertificateID, RevokedInfo> revokedCerts = ca.ocspRevokedCerts.entrySet().stream().collect(Collectors.toMap(entry -> {
+                try {
+                    return new JcaCertificateID(digestCalculator, ca.cert, entry.getKey().getSerialNumber());
+                } catch (Exception ex) {
+                    throw new RuntimeException(ex);
+                }
+            }, Map.Entry::getValue));
+
+            BasicOCSPRespBuilder responseBuilder = new JcaBasicOCSPRespBuilder(ca.key.getPublic(), digestCalculator);
+            for (Req req : requestList) {
+                CertificateID certId = req.getCertID();
+                CertificateStatus certificateStatus = CertificateStatus.GOOD;
+                RevokedInfo revokedInfo = revokedCerts.get(certId);
+                if (revokedInfo != null) {
+                    certificateStatus = new RevokedStatus(revokedInfo);
+                }
+                responseBuilder.addResponse(certId, certificateStatus, null);
+            }
+
+            X509CertificateHolder[] chain = new X509CertificateHolder[]{new JcaX509CertificateHolder(ca.cert)};
+            ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(ca.key.getPrivate());
+            BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
+            LOG.info("response {}", ocspResponse);
+            responseBytes = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, ocspResponse).getEncoded();
+            LOG.error("OCSP server response OK");
+        } catch (Throwable exception) {
+            LOG.error("Internal OCSP server error", exception);
+            responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
+        }
+
+        Headers rh = httpExchange.getResponseHeaders();
+        rh.set("Content-Type", "application/ocsp-response");
+        httpExchange.sendResponseHeaders(200, responseBytes.length);
+
+        OutputStream os = httpExchange.getResponseBody();
+        os.write(responseBytes);
+        os.close();
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java
new file mode 100644
index 00000000000..c7f95a9e0ea
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import java.nio.file.Path;
+
+public class PemFile {
+    public final Path file;
+    public final String password;
+
+    public PemFile(Path file, String password) {
+        this.file = file;
+        this.password = password;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java
new file mode 100644
index 00000000000..962a099fc35
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+
+@FunctionalInterface
+public interface X509CertBuilder {
+    void build(X509v3CertificateBuilder builder) throws Exception;
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
index 6e1fd2708d0..0471e79520f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
@@ -20,328 +20,34 @@
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
-import com.sun.net.httpserver.Headers;
-import com.sun.net.httpserver.HttpHandler;
-import com.sun.net.httpserver.HttpServer;
-import java.io.FileWriter;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.math.BigInteger;
-import java.net.InetSocketAddress;
-import java.net.URLDecoder;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.security.KeyPair;
 import java.security.Security;
-import java.security.cert.X509Certificate;
-import java.time.Instant;
-import java.util.Arrays;
-import java.util.Base64;
-import java.util.Calendar;
-import java.util.Collections;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.Map;
 import java.util.Properties;
-import java.util.UUID;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.stream.Collectors;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.apache.zookeeper.common.X509TestHelpers;
+import org.apache.zookeeper.common.ssl.Ca;
+import org.apache.zookeeper.common.ssl.Cert;
 import org.apache.zookeeper.server.embedded.ExitHandler;
 import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
 import org.apache.zookeeper.test.ClientBase;
-import org.bouncycastle.asn1.ASN1GeneralizedTime;
-import org.bouncycastle.asn1.ocsp.OCSPResponse;
-import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
-import org.bouncycastle.asn1.ocsp.RevokedInfo;
-import org.bouncycastle.asn1.x509.AuthorityInformationAccess;
-import org.bouncycastle.asn1.x509.CRLDistPoint;
-import org.bouncycastle.asn1.x509.CRLNumber;
-import org.bouncycastle.asn1.x509.CRLReason;
-import org.bouncycastle.asn1.x509.DistributionPoint;
-import org.bouncycastle.asn1.x509.DistributionPointName;
-import org.bouncycastle.asn1.x509.Extension;
-import org.bouncycastle.asn1.x509.GeneralName;
-import org.bouncycastle.asn1.x509.GeneralNames;
-import org.bouncycastle.asn1.x509.X509ObjectIdentifiers;
-import org.bouncycastle.cert.X509CRLHolder;
-import org.bouncycastle.cert.X509CertificateHolder;
-import org.bouncycastle.cert.X509v2CRLBuilder;
-import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
-import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
-import org.bouncycastle.cert.jcajce.JcaX509v2CRLBuilder;
-import org.bouncycastle.cert.ocsp.BasicOCSPResp;
-import org.bouncycastle.cert.ocsp.BasicOCSPRespBuilder;
-import org.bouncycastle.cert.ocsp.CertificateID;
-import org.bouncycastle.cert.ocsp.CertificateStatus;
-import org.bouncycastle.cert.ocsp.OCSPReq;
-import org.bouncycastle.cert.ocsp.OCSPResp;
-import org.bouncycastle.cert.ocsp.OCSPRespBuilder;
-import org.bouncycastle.cert.ocsp.Req;
-import org.bouncycastle.cert.ocsp.RevokedStatus;
-import org.bouncycastle.cert.ocsp.jcajce.JcaBasicOCSPRespBuilder;
-import org.bouncycastle.cert.ocsp.jcajce.JcaCertificateID;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.bouncycastle.openssl.MiscPEMGenerator;
-import org.bouncycastle.operator.ContentSigner;
-import org.bouncycastle.operator.DigestCalculator;
-import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
-import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
-import org.bouncycastle.util.io.pem.PemWriter;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 public class ClientSSLRevocationTest {
-    private static final Logger LOG = LoggerFactory.getLogger(ClientSSLRevocationTest.class);
-
-    static {
+    @BeforeEach
+    public void setup() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
     }
 
-    private static class OCSPHandler implements HttpHandler {
-        private final Ca ca;
-
-        public OCSPHandler(Ca ca) {
-            this.ca = ca;
-        }
-
-        @Override
-        public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOException {
-            byte[] responseBytes;
-            try {
-                String uri = httpExchange.getRequestURI().toString();
-                LOG.info("OCSP request: {} {}", httpExchange.getRequestMethod(), uri);
-                httpExchange.getRequestHeaders().entrySet().forEach((e) -> {
-                    LOG.info("OCSP request header: {} {}", e.getKey(), e.getValue());
-                });
-                InputStream request = httpExchange.getRequestBody();
-                byte[] requestBytes = new byte[10000];
-                int len = request.read(requestBytes);
-                LOG.info("OCSP request size {}", len);
-
-                if (len < 0) {
-                    String removedUriEncoding = URLDecoder.decode(uri.substring(1), "utf-8");
-                    LOG.info("OCSP request from URI no encoding {}", removedUriEncoding);
-                    requestBytes = Base64.getDecoder().decode(removedUriEncoding);
-                }
-                OCSPReq ocspRequest = new OCSPReq(requestBytes);
-                Req[] requestList = ocspRequest.getRequestList();
-                LOG.info("requestList {}", Arrays.toString(requestList));
-
-                DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
-
-                Map<CertificateID, RevokedInfo> revokedCerts = ca.ocspRevokedCerts.entrySet().stream().collect(Collectors.toMap(entry -> {
-                        try {
-                            return new JcaCertificateID(digestCalculator, ca.cert,  entry.getKey().getSerialNumber());
-                        } catch (Exception ex) {
-                            throw new RuntimeException(ex);
-                        }
-                    }, Map.Entry::getValue));
-
-                BasicOCSPRespBuilder responseBuilder = new JcaBasicOCSPRespBuilder(ca.key.getPublic(), digestCalculator);
-                for (Req req : requestList) {
-                    CertificateID certId = req.getCertID();
-                    CertificateStatus certificateStatus = CertificateStatus.GOOD;
-                    RevokedInfo revokedInfo = revokedCerts.get(certId);
-                    if (revokedInfo != null) {
-                        certificateStatus = new RevokedStatus(revokedInfo);
-                    }
-                    responseBuilder.addResponse(certId, certificateStatus, null);
-                }
-
-                X509CertificateHolder[] chain = new X509CertificateHolder[]{new JcaX509CertificateHolder(ca.cert)};
-                ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(ca.key.getPrivate());
-                BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
-                LOG.info("response {}", ocspResponse);
-                responseBytes = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, ocspResponse).getEncoded();
-                LOG.error("OCSP server response OK");
-            } catch (Throwable exception) {
-                LOG.error("Internal OCSP server error", exception);
-                responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
-            }
-
-            Headers rh = httpExchange.getResponseHeaders();
-            rh.set("Content-Type", "application/ocsp-response");
-            httpExchange.sendResponseHeaders(200, responseBytes.length);
-
-            OutputStream os = httpExchange.getResponseBody();
-            os.write(responseBytes);
-            os.close();
-        }
-
-    }
-
-    private static class PemFile {
-        private final Path file;
-        private final String password;
-
-        public PemFile(Path file, String password) {
-            this.file = file;
-            this.password = password;
-        }
-    }
-
-    private static class CertWithCrl extends Cert {
-        public final Path crl;
-
-        public CertWithCrl(String name, KeyPair key, X509Certificate cert, Path crl) {
-            super(name, key, cert, crl.getParent());
-            this.crl = crl;
-        }
-    }
-
-    private static class Cert {
-        public final String name;
-        public final KeyPair key;
-        public final X509Certificate cert;
-        public final Path dir;
-
-        public Cert(String name, KeyPair key, X509Certificate cert, Path dir) {
-            this.name = name;
-            this.key = key;
-            this.cert = cert;
-            this.dir = dir;
-        }
-
-        public PemFile writePem() throws Exception {
-            String password = UUID.randomUUID().toString();
-            String pem = X509TestHelpers.pemEncodeCertAndPrivateKey(cert, key.getPrivate(), password);
-            Path file = Files.createTempFile(dir, name, ".pem");
-            Files.write(file, pem.getBytes());
-            return new PemFile(file, password);
-        }
-    }
-
-    private static class Ca implements AutoCloseable {
-        private final String name;
-        private final KeyPair key;
-        private final X509Certificate cert;
-        private final Path dir;
-        private final Map<X509Certificate, RevokedInfo> crlRevokedCerts = Collections.synchronizedMap(new HashMap<>());
-        private final Map<X509Certificate, RevokedInfo> ocspRevokedCerts = Collections.synchronizedMap(new HashMap<>());
-        private final HttpServer ocspServer;
-        private final AtomicLong crlNumber = new AtomicLong(1);
-
-        private Ca(String name, KeyPair key, X509Certificate cert, Path dir, HttpServer ocspServer) throws Exception {
-            this.name = name;
-            this.key = key;
-            this.cert = cert;
-            this.dir = dir;
-            this.ocspServer = ocspServer;
-        }
-
-        public PemFile writePem() throws Exception {
-            String pem = X509TestHelpers.pemEncodeX509Certificate(cert);
-            Path file = Files.createTempFile(dir, name, ".pem");
-            Files.write(file, pem.getBytes());
-            return new PemFile(file, "");
-        }
-
-        // Check result of crldp could be cached, so use per-cert crl file.
-        public void flush_crl(Path crl) throws Exception {
-            Instant now = Instant.now();
-
-            X509v2CRLBuilder builder = new JcaX509v2CRLBuilder(cert.getIssuerX500Principal(), Date.from(now));
-            builder.setNextUpdate(Date.from(now.plusSeconds(2)));
-
-            builder.addExtension(Extension.authorityKeyIdentifier, false, new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(this.cert));
-            builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(crlNumber.getAndAdd(1L))));
-
-            for (Map.Entry<X509Certificate, RevokedInfo> entry : crlRevokedCerts.entrySet()) {
-                builder.addCRLEntry(entry.getKey().getSerialNumber(), entry.getValue().getRevocationTime().getDate(), CRLReason.cACompromise);
-            }
-
-            ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(this.key.getPrivate());
-            X509CRLHolder crlHolder = builder.build(contentSigner);
-
-            Path tmpFile = Files.createTempFile(dir, "crldp-", ".pem.tmp");
-            PemWriter pemWriter = new PemWriter(new FileWriter(tmpFile.toFile()));
-            pemWriter.writeObject(new MiscPEMGenerator(crlHolder));
-            pemWriter.flush();
-            pemWriter.close();
-
-            Files.move(tmpFile, crl, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
-        }
-
-        public void revoke_through_crldp(CertWithCrl cert) throws Exception {
-            Date now = new Date();
-            RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
-            this.crlRevokedCerts.put(cert.cert, revokedInfo);
-            flush_crl(cert.crl);
-        }
-
-        public void revoke_through_ocsp(X509Certificate cert) throws Exception {
-            Date now = new Date();
-            RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
-            this.ocspRevokedCerts.put(cert, revokedInfo);
-        }
-
-        public Cert sign(String name) throws Exception {
-            KeyPair key = X509TestHelpers.generateRSAKeyPair();
-            X509Certificate cert = X509TestHelpers.newCert(this.cert, this.key, name, key.getPublic());
-            return new Cert(name, key, cert, dir);
-        }
-
-        public CertWithCrl sign_with_crl(String name) throws Exception {
-            KeyPair key = X509TestHelpers.generateRSAKeyPair();
-            Path crl = Files.createTempFile(dir, String.format("%s-crldp-", name), ".pem");
-            X509Certificate cert = X509TestHelpers.newCert(this.cert, this.key, name, key.getPublic(), builder -> {
-                DistributionPointName distPointOne = new DistributionPointName(
-                        new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, "file://" + crl)));
-                builder.addExtension(
-                        Extension.cRLDistributionPoints,
-                        false,
-                        new CRLDistPoint(new DistributionPoint[]{new DistributionPoint(distPointOne, null, null)}));
-
-            });
-            flush_crl(crl);
-            return new CertWithCrl(name, key, cert, crl);
-        }
-
-        public Cert sign_with_ocsp(String name) throws Exception {
-            KeyPair key = X509TestHelpers.generateRSAKeyPair();
-            X509Certificate cert = X509TestHelpers.newCert(this.cert, this.key, name, key.getPublic(), builder -> {
-                String addr = "http://127.0.0.1:" + ocspServer.getAddress().getPort();
-                builder.addExtension(
-                        Extension.authorityInfoAccess,
-                        false,
-                        new AuthorityInformationAccess(
-                                X509ObjectIdentifiers.ocspAccessMethod,
-                                new GeneralName(GeneralName.uniformResourceIdentifier, addr)));
-            });
-            return new Cert(name, key, cert, dir);
-        }
-
-        public static Ca create(Path dir) throws Exception {
-            return create(dir, "CA");
-        }
-
-        public static Ca create(Path dir, String name) throws Exception {
-            KeyPair caKey = X509TestHelpers.generateRSAKeyPair();
-            X509Certificate caCert = X509TestHelpers.newSelfSignedCert(name, caKey);
-            HttpServer ocspServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
-            Ca ca = new Ca(name, caKey, caCert, dir, ocspServer);
-            ca.ocspServer.createContext("/", new OCSPHandler(ca));
-            ca.ocspServer.start();
-            return ca;
-        }
-
-        @Override
-        public void close() throws Exception {
-            ocspServer.stop(0);
-        }
-    }
-
     @AfterEach
     public void cleanup() throws Exception {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+
         Security.setProperty("ocsp.enable", "false");
         System.clearProperty("com.sun.net.ssl.checkRevocation");
         System.clearProperty("zookeeper.ssl.crl");
@@ -351,11 +57,9 @@ public void cleanup() throws Exception {
     @Test
     public void testRevocationDisabled(@TempDir Path tmpDir) throws Exception {
         // given: crl not enabled
-        try (Ca ca = Ca.create(tmpDir)) {
-            PemFile caPem = ca.writePem();
-
+        try (Ca ca = Ca.builder(tmpDir).withOcsp().build()) {
             Cert serverCert = ca.sign_with_ocsp("server");
-            final Properties config = getServerConfig(caPem, serverCert);
+            final Properties config = serverCert.buildServerProperties(ca);
             // given: revoked server cert
             ca.revoke_through_ocsp(serverCert.cert);
             try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
@@ -366,36 +70,36 @@ public void testRevocationDisabled(@TempDir Path tmpDir) throws Exception {
                     .build()) {
                 server.start();
 
-                CertWithCrl client1Cert = ca.sign_with_crl("client1");
+                Cert client1Cert = ca.sign_with_crldp("client1");
                 ca.revoke_through_crldp(client1Cert);
 
                 assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
 
                 // when: connect with revoked cert.
                 // then: connected
-                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, getZKClientConfig(caPem, client1Cert)));
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
             }
         }
     }
 
-    @ParameterizedTest
+    @ParameterizedTest(name = "clientRevoked = {0}")
     @ValueSource(booleans = {true, false})
     public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Path tmpDir) throws Exception {
         try (Ca ca = Ca.create(tmpDir)) {
-            PemFile caPem = ca.writePem();
             // given: server cert with crldp
-            CertWithCrl server1Cert = ca.sign_with_crl("server1");
+            Cert server1Cert = ca.sign_with_crldp("server1");
             try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
                     .builder()
                     .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
-                    .configuration(getServerConfig(caPem, server1Cert))
+                    .configuration(server1Cert.buildServerProperties(ca))
                     .exitHandler(ExitHandler.LOG_ONLY)
                     .build()) {
                 server.start();
 
                 assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
 
-                CertWithCrl clientCert = ca.sign_with_crl("client1");
+                Cert clientCert = ca.sign_with_crldp("client1");
                 if (clientRevoked) {
                     // crl in server side is disabled, so it does not matter whether
                     // client cert is revoked or not.
@@ -403,7 +107,7 @@ public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Pat
                 }
 
                 // then: ssl authentication succeed when crl is disabled
-                ZKClientConfig clientConfig = getZKClientConfig(caPem, clientCert);
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
                 assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
 
                 // when: valid server cert
@@ -415,19 +119,19 @@ public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Pat
             // crldp check is not realtime, so we have to start a new server with revoked cert
 
             // given: revoked server cert with crldp
-            CertWithCrl server2Cert = ca.sign_with_crl("server2");
+            Cert server2Cert = ca.sign_with_crldp("server2");
             ca.revoke_through_crldp(server2Cert);
             try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
                     .builder()
                     .baseDir(Files.createTempDirectory(tmpDir, "server2.data"))
-                    .configuration(getServerConfig(caPem, server2Cert))
+                    .configuration(server2Cert.buildServerProperties(ca))
                     .exitHandler(ExitHandler.LOG_ONLY)
                     .build()) {
                 server.start();
 
                 assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
 
-                CertWithCrl clientCert = ca.sign_with_crl("client1");
+                Cert clientCert = ca.sign_with_crldp("client1");
                 if (clientRevoked) {
                     // crl in server side is disabled, so it does not matter whether
                     // client cert is revoked or not.
@@ -435,7 +139,7 @@ public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Pat
                 }
 
                 // then: ssl authentication succeed when crl is disabled
-                ZKClientConfig clientConfig = getZKClientConfig(caPem, clientCert);
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
                 assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
 
                 // then: ssl authentication failed when crl is enabled
@@ -445,17 +149,16 @@ public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Pat
         }
     }
 
-    @ParameterizedTest
+    @ParameterizedTest(name = "clientRevoked = {0}")
     @ValueSource(booleans = {true, false})
     public void testRevocationInClientUsingOCSP(boolean clientRevoked, @TempDir Path tmpDir) throws Exception {
-        try (Ca ca = Ca.create(tmpDir)) {
-            PemFile caPem = ca.writePem();
+        try (Ca ca = Ca.builder(tmpDir).withOcsp().build()) {
             // given: server cert with ocsp
             Cert serverCert = ca.sign_with_ocsp("server1");
             try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
                     .builder()
                     .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
-                    .configuration(getServerConfig(caPem, serverCert))
+                    .configuration(serverCert.buildServerProperties(ca))
                     .exitHandler(ExitHandler.LOG_ONLY)
                     .build()) {
                 server.start();
@@ -469,7 +172,7 @@ public void testRevocationInClientUsingOCSP(boolean clientRevoked, @TempDir Path
                     ca.revoke_through_ocsp(clientCert.cert);
                 }
 
-                ZKClientConfig clientConfig = getZKClientConfig(caPem, clientCert);
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
 
                 // when: connect to serve with valid cert
                 // then: connected
@@ -493,15 +196,13 @@ public void testRevocationInClientUsingOCSP(boolean clientRevoked, @TempDir Path
         }
     }
 
-
-    @ParameterizedTest
+    @ParameterizedTest(name = "serverRevoked = {0}")
     @ValueSource(booleans = {true, false})
     public void testRevocationInServerUsingCrldp(boolean serverRevoked, @TempDir Path tmpDir) throws Exception {
         try (Ca ca = Ca.create(tmpDir)) {
-            PemFile caPem = ca.writePem();
             // given: server with crl enabled
             System.setProperty("zookeeper.ssl.crl", "true");
-            CertWithCrl serverCert = ca.sign_with_crl("server1");
+            Cert serverCert = ca.sign_with_crldp("server1");
             if (serverRevoked) {
                 // crl in client side will be disabled, so it does not matter whether
                 // server cert is revoked or not.
@@ -510,7 +211,7 @@ public void testRevocationInServerUsingCrldp(boolean serverRevoked, @TempDir Pat
             try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
                     .builder()
                     .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
-                    .configuration(getServerConfig(caPem, serverCert))
+                    .configuration(serverCert.buildServerProperties(ca))
                     .exitHandler(ExitHandler.LOG_ONLY)
                     .build()) {
                 server.start();
@@ -519,28 +220,27 @@ public void testRevocationInServerUsingCrldp(boolean serverRevoked, @TempDir Pat
 
                 // when: valid client cert with crldp
                 // then: ssl authentication failed when crl is enabled
-                Cert client1Cert = ca.sign_with_crl("client1");
-                ZKClientConfig client1Config = getZKClientConfig(caPem, client1Cert);
+                Cert client1Cert = ca.sign_with_crldp("client1");
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
                 client1Config.setProperty("zookeeper.ssl.crl", "false");
                 assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
 
-                CertWithCrl client2Cert = ca.sign_with_crl("client2");
+                Cert client2Cert = ca.sign_with_crldp("client2");
                 ca.revoke_through_crldp(client2Cert);
 
                 // when: revoked client cert with crldp
                 // then: ssl authentication failed when crl is enabled
-                ZKClientConfig client2Config = getZKClientConfig(caPem, client2Cert);
+                ZKClientConfig client2Config = client2Cert.buildClientConfig(ca);
                 client2Config.setProperty("zookeeper.ssl.crl", "false");
                 assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client2Config));
             }
         }
     }
 
-    @ParameterizedTest
+    @ParameterizedTest(name = "serverRevoked = {0}")
     @ValueSource(booleans = {true, false})
     public void testRevocationInServerUsingOCSP(boolean serverRevoked, @TempDir Path tmpDir) throws Exception {
-        try (Ca ca = Ca.create(tmpDir)) {
-            PemFile caPem = ca.writePem();
+        try (Ca ca = Ca.builder(tmpDir).withOcsp().build()) {
             // given: server with crl and ocsp enabled
             System.setProperty("com.sun.net.ssl.checkRevocation", "true");
             System.setProperty("zookeeper.ssl.ocsp", "true");
@@ -553,7 +253,7 @@ public void testRevocationInServerUsingOCSP(boolean serverRevoked, @TempDir Path
             try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
                     .builder()
                     .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
-                    .configuration(getServerConfig(caPem, serverCert))
+                    .configuration(serverCert.buildServerProperties(ca))
                     .exitHandler(ExitHandler.LOG_ONLY)
                     .build()) {
                 server.start();
@@ -563,7 +263,7 @@ public void testRevocationInServerUsingOCSP(boolean serverRevoked, @TempDir Path
                 // when: valid client cert with crldp
                 // then: ssl authentication failed when crl is enabled
                 Cert client1Cert = ca.sign_with_ocsp("client1");
-                ZKClientConfig client1Config = getZKClientConfig(caPem, client1Cert);
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
                 client1Config.setProperty("zookeeper.ssl.crl", "false");
                 assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
 
@@ -573,38 +273,4 @@ public void testRevocationInServerUsingOCSP(boolean serverRevoked, @TempDir Path
             }
         }
     }
-
-    private Properties getServerConfig(PemFile ca, Cert identity) throws Exception {
-        final Properties config = new Properties();
-        config.put("clientPort", "0");
-        config.put("secureClientPort", "0");
-        config.put("host", "localhost");
-        config.put("ticktime", "4000");
-
-        PemFile serverPem = identity.writePem();
-
-        // TLS config fields
-        //config.put("ssl.clientAuth", "need");
-        config.put("ssl.keyStore.location", serverPem.file.toString());
-        config.put("ssl.keyStore.password", serverPem.password);
-        config.put("ssl.trustStore.location", ca.file.toString());
-
-        // Netty is required for TLS
-        config.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
-        config.put("4lw.commands.whitelist", "*");
-        return config;
-    }
-
-    private ZKClientConfig getZKClientConfig(PemFile ca, Cert cert) throws Exception {
-        PemFile pemFile = cert.writePem();
-
-        ZKClientConfig config = new ZKClientConfig();
-        config.setProperty("zookeeper.client.secure", "true");
-        config.setProperty("zookeeper.ssl.keyStore.password", pemFile.password);
-        config.setProperty("zookeeper.ssl.keyStore.location", pemFile.file.toString());
-        config.setProperty("zookeeper.ssl.trustStore.location", ca.file.toString());
-        // only netty supports TLS
-        config.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
-        return config;
-    }
 }

From 9e8296f678a9de8d9c30e3bc086a79c0cd39ef65 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Wed, 27 Aug 2025 14:47:37 -0700
Subject: [PATCH 543/591] ZOOKEEPER-4952:Reduce the GC overhead of Prometheus
 reject exception handling (#2279)

Author: Li Wang <liwang@apple.com>
Reviewers: kezhuw
---
 .../prometheus/PrometheusMetricsProvider.java | 22 ++++++++++++-------
 .../apache/zookeeper/server/RateLogger.java   | 22 ++++++++++++-------
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index cae081f2697..d41b0ad5a8a 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -33,7 +33,7 @@
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.LinkedBlockingQueue;
-import java.util.concurrent.RejectedExecutionException;
+import java.util.concurrent.RejectedExecutionHandler;
 import java.util.concurrent.ThreadFactory;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
@@ -677,7 +677,9 @@ private Optional<ExecutorService> createExecutor() {
                 numWorkerThreads,
                 0L,
                 TimeUnit.MILLISECONDS,
-                queue, new PrometheusWorkerThreadFactory());
+                queue,
+                new PrometheusWorkerThreadFactory(),
+                new PrometheusRejectedExecutionHandler());
         LOG.info("Executor service was created with numWorkerThreads {} and maxQueueSize {}",
                 numWorkerThreads,
                 maxQueueSize);
@@ -714,14 +716,18 @@ public Thread newThread(final Runnable runnable) {
         }
     }
 
+    private class PrometheusRejectedExecutionHandler implements RejectedExecutionHandler {
+        private final String queueExceededMessage = "Prometheus metrics queue size exceeded the max " + maxQueueSize;
+
+        @Override
+        public void rejectedExecution(final Runnable r, final ThreadPoolExecutor e) {
+            rateLogger.rateLimitLog(queueExceededMessage);
+        }
+    }
+
     private void reportMetrics(final Runnable task) {
         if (executorOptional.isPresent()) {
-            try {
-                executorOptional.get().submit(task);
-            } catch (final RejectedExecutionException e) {
-                rateLogger.rateLimitLog("Prometheus metrics reporting task queue size exceeded the max",
-                        String.valueOf(maxQueueSize));
-            }
+            executorOptional.get().submit(task);
         } else {
             task.run();
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
index 21e41b4fbba..33908c72eef 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
@@ -46,15 +46,20 @@ public RateLogger(Logger log, long interval) {
 
     public void flush() {
         if (msg != null && count > 0) {
-            String log = "";
+            // Optimized logging using parameterized messages to reduce string concatenation overhead
             if (count > 1) {
-                log = "[" + count + " times] ";
+                if (value != null) {
+                    LOG.warn("[{} times] Message: {} Last value:{}", count, msg, value);
+                } else {
+                    LOG.warn("[{} times] Message: {}", count, msg);
+                }
+            } else {
+                if (value != null) {
+                    LOG.warn("Message: {} Value:{}", msg, value);
+                } else {
+                    LOG.warn("Message: {}", msg);
+                }
             }
-            log += "Message: " + msg;
-            if (value != null) {
-                log += " Last value:" + value;
-            }
-            LOG.warn(log);
         }
         msg = null;
         value = null;
@@ -70,7 +75,8 @@ public void rateLimitLog(String newMsg) {
      */
     public void rateLimitLog(String newMsg, String newValue) {
         long now = Time.currentElapsedTime();
-        if (Objects.equals(newMsg, msg)) {
+        // Optimized string comparison: use reference equality first for constant strings
+        if (newMsg == msg || Objects.equals(newMsg, msg)) {
             ++count;
             value = newValue;
             if (now - timestamp >= LOG_INTERVAL) {

From bb76c975ff5562e6fe640176f6fbf84d1297a657 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sat, 30 Aug 2025 21:37:53 +0800
Subject: [PATCH 544/591] ZOOKEEPER-4970: Deprecate ZKConfig methods which
 throw QuorumPeerConfig.ConfigException

ZOOKEEPER-4970: Deprecate ZKConfig methods which throw QuorumPeerConfig.ConfigException
`QuorumPeerConfig` belongs to and ties with other server code. To
separate a slimmer `zookeeper-client` jar, we have to break the
dependency from `ZKConfig` to `QuorumPeerConfig`. But this is a breaking
change, it would be good to deprecate these methods first to ease future
migration.
Refs: ZOOKEEPER-4966, ZOOKEEPER-4970, ZOOKEEPER-233.
Reviewers: tisonkun
Author: kezhuw
Closes #2309 from kezhuw/ZOOKEEPER-4970-deprecate-ConfigException-from-ZKConfig
---
 .../org/apache/zookeeper/ZooKeeperMain.java   |  7 ++-
 .../zookeeper/client/ZKClientConfig.java      | 26 +++++++-
 .../zookeeper/common/ConfigException.java     | 31 ++++++++++
 .../org/apache/zookeeper/common/ZKConfig.java | 61 ++++++++++++++++---
 .../server/quorum/QuorumPeerConfig.java       |  2 +-
 .../zookeeper/client/ZKClientConfigTest.java  |  5 +-
 6 files changed, 115 insertions(+), 17 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index f78a6d47ce8..44851df1fc6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -23,6 +23,7 @@
 import java.io.InputStreamReader;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -45,8 +46,8 @@
 import org.apache.zookeeper.cli.CommandNotFoundException;
 import org.apache.zookeeper.cli.MalformedCommandException;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.ExitCode;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -266,8 +267,8 @@ protected void connectToZK(String newHost) throws InterruptedException, IOExcept
 
         if (cl.getOption("client-configuration") != null) {
             try {
-                clientConfig = new ZKClientConfig(cl.getOption("client-configuration"));
-            } catch (QuorumPeerConfig.ConfigException e) {
+                clientConfig = new ZKClientConfig(Paths.get(cl.getOption("client-configuration")));
+            } catch (ConfigException e) {
                 e.printStackTrace();
                 ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index 7aa9c740841..f1552a688ee 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -19,9 +19,11 @@
 package org.apache.zookeeper.client;
 
 import java.io.File;
+import java.nio.file.Path;
 import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.ZKConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 
 /**
  * Handles client specific properties
@@ -64,11 +66,29 @@ public ZKClientConfig() {
         initFromJavaSystemProperties();
     }
 
-    public ZKClientConfig(File configFile) throws ConfigException {
+    /**
+     * <p><b>Use {@link ZKClientConfig#ZKClientConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
+     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     */
+    @Deprecated
+    public ZKClientConfig(File configFile) throws QuorumPeerConfig.ConfigException {
         super(configFile);
     }
 
-    public ZKClientConfig(String configPath) throws ConfigException {
+    /**
+     * <p><b>Use {@link ZKClientConfig#ZKClientConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
+     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     */
+    @Deprecated
+    public ZKClientConfig(String configPath) throws QuorumPeerConfig.ConfigException {
+        super(configPath);
+    }
+
+    public ZKClientConfig(Path configPath) throws ConfigException {
         super(configPath);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java
new file mode 100644
index 00000000000..7afedb4923e
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+/**
+ * Configuration related exception.
+ */
+public class ConfigException extends Exception {
+    public ConfigException(String msg) {
+        super(msg);
+    }
+    public ConfigException(String msg, Exception e) {
+        super(msg, e);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 846a5632e06..47fd943860c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -21,12 +21,13 @@
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
 import org.apache.zookeeper.Environment;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -62,29 +63,50 @@ public ZKConfig() {
     }
 
     /**
+     * <p><b>Use {@link ZKConfig#ZKConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
+     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     *
      * @param configPath
      *            Configuration file path
      * @throws ConfigException
      *             if failed to load configuration properties
      */
-
-    public ZKConfig(String configPath) throws ConfigException {
+    @Deprecated
+    public ZKConfig(String configPath) throws QuorumPeerConfig.ConfigException {
         this(new File(configPath));
     }
 
     /**
+     * <p><b>Use {@link ZKConfig#ZKConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
+     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
      *
      * @param configFile
      *            Configuration file
      * @throws ConfigException
      *             if failed to load configuration properties
      */
-    public ZKConfig(File configFile) throws ConfigException {
+    @Deprecated
+    public ZKConfig(File configFile) throws QuorumPeerConfig.ConfigException {
         this();
         addConfiguration(configFile);
         LOG.info("ZK Config {}", this.properties);
     }
 
+    /**
+     * Constructs a {@link ZKConfig} with properties from file.
+     *
+     * @param configPath path to configuration file
+     * @throws ConfigException
+     */
+    @SuppressWarnings("deprecation")
+    public ZKConfig(Path configPath) throws ConfigException {
+        this(configPath.toFile());
+    }
+
     private void init() {
         /**
          * backward compatibility for all currently available client properties
@@ -191,10 +213,27 @@ public void setProperty(String key, String value) {
      * Add a configuration resource. The properties form this configuration will
      * overwrite corresponding already loaded property and system property
      *
+     * @param configPath path to Configuration file.
+     */
+    @SuppressWarnings("deprecation")
+    public void addConfiguration(Path configPath) throws ConfigException {
+        addConfiguration(configPath.toFile());
+    }
+
+    /**
+     * <p><b>Use {@link #addConfiguration(Path)} instead.</b></p>
+     *
+     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
+     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     *
+     * <p>Add a configuration resource. The properties form this configuration will
+     * overwrite corresponding already loaded property and system property
+     *
      * @param configFile
      *            Configuration file.
      */
-    public void addConfiguration(File configFile) throws ConfigException {
+    @Deprecated
+    public void addConfiguration(File configFile) throws QuorumPeerConfig.ConfigException {
         LOG.info("Reading configuration from: {}", configFile.getAbsolutePath());
         try {
             configFile = (new VerifyingFileFactory.Builder(LOG).warnForRelativePath()
@@ -210,18 +249,24 @@ public void addConfiguration(File configFile) throws ConfigException {
             parseProperties(cfg);
         } catch (IOException | IllegalArgumentException e) {
             LOG.error("Error while configuration from: {}", configFile.getAbsolutePath(), e);
-            throw new ConfigException("Error while processing " + configFile.getAbsolutePath(), e);
+            throw new QuorumPeerConfig.ConfigException("Error while processing " + configFile.getAbsolutePath(), e);
         }
     }
 
     /**
-     * Add a configuration resource. The properties form this configuration will
+     * <p><b>Use {@link #addConfiguration(Path)} instead.</b></p>
+     *
+     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
+     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     *
+     * <p>Add a configuration resource. The properties form this configuration will
      * overwrite corresponding already loaded property and system property
      *
      * @param configPath
      *            Configuration file path.
      */
-    public void addConfiguration(String configPath) throws ConfigException {
+    @Deprecated
+    public void addConfiguration(String configPath) throws QuorumPeerConfig.ConfigException {
         addConfiguration(new File(configPath));
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index fe548519d1a..29083be075b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -158,7 +158,7 @@ public class QuorumPeerConfig {
     protected long jvmPauseSleepTimeMs = JvmPauseMonitor.SLEEP_TIME_MS_DEFAULT;
 
     @SuppressWarnings("serial")
-    public static class ConfigException extends Exception {
+    public static class ConfigException extends org.apache.zookeeper.common.ConfigException {
 
         public ConfigException(String msg) {
             super(msg);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
index e88be706316..95846b467a3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
@@ -33,11 +33,12 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.ZKConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
 import org.junit.jupiter.api.io.TempDir;
@@ -116,7 +117,7 @@ public void testReadConfigurationFile(@TempDir File testDataDir) throws IOExcept
         }
 
         ZKClientConfig conf = new ZKClientConfig();
-        conf.addConfiguration(file.getAbsolutePath());
+        conf.addConfiguration(Paths.get(file.getAbsolutePath()));
         assertEquals(conf.getProperty(ENABLE_CLIENT_SASL_KEY), "true");
         assertEquals(conf.getProperty(ZK_SASL_CLIENT_USERNAME), "ZK");
         assertEquals(conf.getProperty(LOGIN_CONTEXT_NAME_KEY), "MyClient");

From dd1e5dfcfbea798073ca021ed994acd686fe4dd1 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Wed, 3 Sep 2025 16:23:36 -0500
Subject: [PATCH 545/591] Fix commons-io license file

---
 ...ommons-io-2.11.0.LICENSE.txt => commons-io-2.17.0.LICENSE.txt} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{commons-io-2.11.0.LICENSE.txt => commons-io-2.17.0.LICENSE.txt} (100%)

diff --git a/zookeeper-server/src/main/resources/lib/commons-io-2.11.0.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-io-2.17.0.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/commons-io-2.11.0.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/commons-io-2.17.0.LICENSE.txt

From 7c414c12b5c59e64aa9c52277396f4c42032ca48 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Thu, 4 Sep 2025 10:52:51 -0700
Subject: [PATCH 546/591] ZOOKEEPER-4951: Optimize the default Prometheus max
 queue size (#2278)

Author: Li Wang <liwang@apple.com>

Reviewer: kezhuw <kezhuw@apache.org>
---
 .../src/main/resources/markdown/zookeeperAdmin.md           | 2 +-
 .../metrics/prometheus/PrometheusMetricsProvider.java       | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 5bac829cf25..b14cb6b86df 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2279,7 +2279,7 @@ options are used to configure the [AdminServer](#sc_adminserver).
 * *metricsProvider.maxQueueSize* :
    **New in 3.7.1:**
    The max queue size for Prometheus summary metrics reporting task.
-   Default value is 1000000.
+   Default value is 10000.
    
 * *metricsProvider.workerShutdownTimeoutMs* :
    **New in 3.7.1:**
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index d41b0ad5a8a..3745a753c4a 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -84,7 +84,7 @@ public class PrometheusMetricsProvider implements MetricsProvider {
 
     /**
      * The max queue size for Prometheus summary metrics reporting task.
-     * Default value is 1000000.
+     * Default value is 10000.
      */
     static final String MAX_QUEUE_SIZE = "maxQueueSize";
 
@@ -111,7 +111,7 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     private final MetricsServletImpl servlet = new MetricsServletImpl();
     private final Context rootContext = new Context();
     private int numWorkerThreads = 1;
-    private int maxQueueSize = 1000000;
+    private int maxQueueSize = 10000;
     private long workerShutdownTimeoutMs = 1000;
     private Optional<ExecutorService> executorOptional = Optional.empty();
 
@@ -161,7 +161,7 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
         this.numWorkerThreads = Integer.parseInt(
                 configuration.getProperty(NUM_WORKER_THREADS, "1"));
         this.maxQueueSize = Integer.parseInt(
-                configuration.getProperty(MAX_QUEUE_SIZE, "1000000"));
+                configuration.getProperty(MAX_QUEUE_SIZE, "10000"));
         this.workerShutdownTimeoutMs = Long.parseLong(
                 configuration.getProperty(WORKER_SHUTDOWN_TIMEOUT_MS, "1000"));
     }

From 63bec256238e47d688638e3a308597a24a734bf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Fri, 12 Sep 2025 15:04:13 -0500
Subject: [PATCH 547/591] ZOOKEEPER-4974: Remove enforced JDK 17 compilation
 warnings

Reviewers: ctubbsii
Author: anmolnar
Closes #2312 from anmolnar/ZOOKEEPER-4974
---
 .../org/apache/zookeeper/server/WorkerService.java | 14 +++-----------
 .../zookeeper/server/quorum/QuorumCnxManager.java  |  5 +----
 .../apache/zookeeper/common/X509TestHelpers.java   |  4 ++--
 .../zookeeper/server/quorum/QuorumSSLTest.java     |  2 +-
 .../org/apache/zookeeper/test/X509AuthTest.java    |  2 ++
 5 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
index 305d0e2ec99..7885068135a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
@@ -167,7 +167,6 @@ public void run() {
      */
     private static class DaemonThreadFactory implements ThreadFactory {
 
-        final ThreadGroup group;
         final AtomicInteger threadNumber = new AtomicInteger(1);
         final String namePrefix;
 
@@ -177,22 +176,15 @@ private static class DaemonThreadFactory implements ThreadFactory {
 
         DaemonThreadFactory(String name, int firstThreadNum) {
             threadNumber.set(firstThreadNum);
-            SecurityManager s = System.getSecurityManager();
-            group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup();
             namePrefix = name + "-";
         }
 
+        @Override
         public Thread newThread(Runnable r) {
-            Thread t = new Thread(group, r, namePrefix + threadNumber.getAndIncrement(), 0);
-            if (!t.isDaemon()) {
-                t.setDaemon(true);
-            }
-            if (t.getPriority() != Thread.NORM_PRIORITY) {
-                t.setPriority(Thread.NORM_PRIORITY);
-            }
+            Thread t = new Thread(r, namePrefix + threadNumber.getAndIncrement());
+            t.setDaemon(true);
             return t;
         }
-
     }
 
     public void start() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index db7f0090d7f..764b962ac36 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -344,10 +344,7 @@ public QuorumCnxManager(QuorumPeer self, final long mySid, Map<Long, QuorumPeer.
     // can take extra time)
     private void initializeConnectionExecutor(final long mySid, final int quorumCnxnThreadsSize) {
         final AtomicInteger threadIndex = new AtomicInteger(1);
-        SecurityManager s = System.getSecurityManager();
-        final ThreadGroup group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup();
-
-        final ThreadFactory daemonThFactory = runnable -> new Thread(group, runnable,
+        final ThreadFactory daemonThFactory = runnable -> new Thread(runnable,
             String.format("QuorumConnectionThread-[myid=%d]-%d", mySid, threadIndex.getAndIncrement()));
 
         this.connectionExecutor = new ThreadPoolExecutor(3, quorumCnxnThreadsSize, 60, TimeUnit.SECONDS,
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
index 89907e078e2..761c718b865 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
@@ -169,7 +169,7 @@ public static X509Certificate newCert(
             throw new IllegalArgumentException("CA private key does not match the public key in the CA cert");
         }
         Date now = new Date();
-        X509v3CertificateBuilder builder = initCertBuilder(new X500Name(caCert.getIssuerDN().getName()), now, new Date(
+        X509v3CertificateBuilder builder = initCertBuilder(new X500Name(caCert.getIssuerX500Principal().getName()), now, new Date(
                 now.getTime()
                         + expirationMillis), certSubject, certPublicKey);
         builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false)); // not a CA
@@ -384,7 +384,7 @@ public static byte[] certToBCFKSTrustStoreBytes(
     private static byte[] certToTrustStoreBytes(X509Certificate cert, String keyPassword, KeyStore trustStore) throws IOException, GeneralSecurityException {
         char[] keyPasswordChars = keyPassword == null ? new char[0] : keyPassword.toCharArray();
         trustStore.load(null, keyPasswordChars);
-        trustStore.setCertificateEntry(cert.getSubjectDN().toString(), cert);
+        trustStore.setCertificateEntry(cert.getSubjectX500Principal().toString(), cert);
         ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
         trustStore.store(outputStream, keyPasswordChars);
         outputStream.flush();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index c843efd0054..3ced1813f2b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -200,7 +200,7 @@ public void setup() throws Exception {
         // Write the truststore
         KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
         trustStore.load(null, PASSWORD);
-        trustStore.setCertificateEntry(rootCertificate.getSubjectDN().toString(), rootCertificate);
+        trustStore.setCertificateEntry(rootCertificate.getSubjectX500Principal().toString(), rootCertificate);
         FileOutputStream outputStream = new FileOutputStream(truststorePath);
         trustStore.store(outputStream, PASSWORD);
         outputStream.flush();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
index 65925ec8968..31477b5433b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
@@ -182,10 +182,12 @@ public BigInteger getSerialNumber() {
             return null;
         }
         @Override
+        @Deprecated
         public Principal getIssuerDN() {
             return null;
         }
         @Override
+        @Deprecated
         public Principal getSubjectDN() {
             return null;
         }

From e3abfde9ad9003fa9d126173ddb8b1f45d13930a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Wed, 17 Sep 2025 15:51:15 -0500
Subject: [PATCH 548/591] ZOOKEEPER-4871: ZooKeeper python module (zkpython) is
 incompatible with Python 3.12

Author: anmolnar
Closes #2199 from anmolnar/ZOOKEEPER-4871
---
 .../src/c/zookeeper.c                         | 21 +++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
index ee8a75a03f7..f534749ced1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
@@ -16,6 +16,7 @@
  * limitations under the License.
  */
 
+#define PY_SSIZE_T_CLEAN
 #include <Python.h>
 #include <zookeeper.h>
 #include <assert.h>
@@ -1466,6 +1467,19 @@ PyObject *pyzoo_set_debug_level(PyObject *self, PyObject *args)
 }
 
 static PyObject *log_stream = NULL;
+#if PY_MAJOR_VERSION >= 3
+static PyObject *PyIOBase_TypeObj;
+static int init_file_emulator(void)
+{
+  PyObject *io = PyImport_ImportModule("_io");
+  if (io == NULL)
+    return -1;
+  PyIOBase_TypeObj = PyObject_GetAttrString(io, "_IOBase");
+  if (PyIOBase_TypeObj == NULL)
+    return -1;
+  return 0;
+}
+#endif
 
 /* Set the output file-like object for logging output. Returns Py_None */
 PyObject *pyzoo_set_log_stream(PyObject *self, PyObject *args)
@@ -1477,8 +1491,11 @@ PyObject *pyzoo_set_log_stream(PyObject *self, PyObject *args)
   }
   
 #if PY_MAJOR_VERSION >= 3
-  extern PyTypeObject PyIOBase_Type;
-  if (!PyObject_IsInstance(pystream, (PyObject *)&PyIOBase_Type)) {
+  if (init_file_emulator() < 0) {
+    return NULL;
+  }
+
+  if (!PyObject_IsInstance(pystream, PyIOBase_TypeObj)) {
 #else
   if(!PyFile_Check(pystream)) {
 #endif

From 2b1808bec1be19a6188361c2032f3a39962a9904 Mon Sep 17 00:00:00 2001
From: Aleksandr Nikolaev <56360298+nao-it@users.noreply.github.com>
Date: Fri, 19 Sep 2025 19:08:41 +0300
Subject: [PATCH 549/591] ZOOKEEPER-4976: Update Netty to fix CVE

Reviewers: ctubbsii
Author: nao-it
Closes #2313 from nao-it/ZOOKEEPER-4976
---
 pom.xml                                                         | 2 +-
 ...Final.LICENSE.txt => netty-buffer-4.1.127.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-codec-4.1.127.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-common-4.1.127.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-handler-4.1.127.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-resolver-4.1.127.Final.LICENSE.txt} | 0
 ...al.LICENSE.txt => netty-transport-4.1.127.Final.LICENSE.txt} | 0
 ... => netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt} | 0
 ...etty-transport-native-unix-common-4.1.127.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.119.Final.LICENSE.txt => netty-buffer-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.119.Final.LICENSE.txt => netty-codec-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.119.Final.LICENSE.txt => netty-common-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.119.Final.LICENSE.txt => netty-handler-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.119.Final.LICENSE.txt => netty-resolver-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.119.Final.LICENSE.txt => netty-transport-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt => netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.119.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.127.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 94c05b66590..01633810ed3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.119.Final</netty.version>
+    <netty.version>4.1.127.Final</netty.version>
     <jetty.version>9.4.57.v20241219</jetty.version>
     <jackson.version>2.15.2</jackson.version>
     <jline.version>2.14.6</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.119.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.127.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.119.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.127.Final.LICENSE.txt

From 23c044698bc059034443ce632705a75299293fbc Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sat, 20 Sep 2025 01:08:20 +0800
Subject: [PATCH 550/591] ZOOKEEPER-4962: Export bound client port for
 ZooKeeperServerEmbedded

Reviewers: anmolnar
Author: kezhuw
Closes #2302 from kezhuw/ZOOKEEPER-4962-ZooKeeperServerEmbedded-getClientPort
---
 .../zookeeper/server/ZooKeeperServerMain.java  |  2 --
 .../embedded/ZooKeeperServerEmbedded.java      | 10 ++++++++++
 .../embedded/ZooKeeperServerEmbeddedImpl.java  | 18 ++++++++++++++----
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index 24e7f5b180e..b63280f2971 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -242,7 +242,6 @@ ServerCnxnFactory getSecureCnxnFactory() {
         return secureCnxnFactory;
     }
 
-    // VisibleForTesting
     public int getClientPort() {
         if (cnxnFactory != null) {
             return cnxnFactory.getLocalPort();
@@ -250,7 +249,6 @@ public int getClientPort() {
         return 0;
     }
 
-    // VisibleForTesting
     public int getSecureClientPort() {
         if (secureCnxnFactory != null) {
             return secureCnxnFactory.getLocalPort();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
index 6fcd7038504..f73a1ee3d99 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
@@ -116,6 +116,16 @@ static ZookKeeperServerEmbeddedBuilder builder() {
      */
     void start(long startupTimeout) throws Exception;
 
+    /**
+     * Get client port for no secure connection.
+     */
+    int getClientPort();
+
+    /**
+     * Get client port for secure connection.
+     */
+    int getSecureClientPort();
+
     /**
      * Get a connection string useful for the client.
      * @return the connection string
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
index fb9e5eb6c9f..14e7cbbb7e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -107,8 +107,8 @@ protected QuorumPeer getQuorumPeer() throws SaslException {
                         @Override
                         public void start() {
                             super.start();
-                            boundClientPort = getClientPort();
-                            boundSecureClientPort = getSecureClientPort();
+                            boundClientPort = super.getClientPort();
+                            boundSecureClientPort = super.getSecureClientPort();
                             LOG.info("ZK Server {} started", this);
                             started.complete(null);
                         }
@@ -148,8 +148,8 @@ public void run() {
                 @Override
                 public void serverStarted() {
                     LOG.info("ZK Server started");
-                    boundClientPort = getClientPort();
-                    boundSecureClientPort = getSecureClientPort();
+                    boundClientPort = super.getClientPort();
+                    boundSecureClientPort = super.getSecureClientPort();
                     started.complete(null);
                 }
             };
@@ -190,6 +190,16 @@ public void run() {
         }
     }
 
+    @Override
+    public int getClientPort() {
+        return boundClientPort;
+    }
+
+    @Override
+    public int getSecureClientPort() {
+        return boundSecureClientPort;
+    }
+
     @Override
     public String getConnectionString() {
         return prettifyConnectionString(config.getClientPortAddress(), boundClientPort);

From d8e5217729bfc7303b15bc36b1a6b7f1ecdd07d4 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sat, 20 Sep 2025 06:43:14 +0800
Subject: [PATCH 551/591] ZOOKEEPER-4972: Fix flaky tests in
 PrometheusMetricsProviderConfigTest

Reviewers: anmolnar
Author: kezhuw
Closes #2311 from kezhuw/ZOOKEEPER-4972-fix-flaky-PrometheusMetricsProviderConfigTest-tests
---
 .../zookeeper-prometheus-metrics/pom.xml      |  6 ++++
 .../prometheus/PrometheusMetricsProvider.java | 35 ++++++++++++-------
 .../PrometheusMetricsProviderConfigTest.java  |  8 ++---
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index 2d8e48656b6..4b13fa6adfb 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -69,6 +69,12 @@
       <artifactId>jetty-servlet</artifactId>
       <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
+    </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index 3745a753c4a..76739787c8b 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -23,7 +23,6 @@
 import io.prometheus.client.exporter.MetricsServlet;
 import io.prometheus.client.hotspot.DefaultExports;
 import java.io.IOException;
-import java.net.InetSocketAddress;
 import java.util.Enumeration;
 import java.util.Objects;
 import java.util.Optional;
@@ -170,28 +169,32 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
     public void start() throws MetricsProviderLifeCycleException {
         this.executorOptional = createExecutor();
         try {
-            LOG.info("Starting /metrics {} endpoint at HTTP port: {}, HTTPS port: {}, exportJvmInfo: {}",
-                    httpPort > 0 ? httpPort : "disabled",
-                    httpsPort > 0 ? httpsPort : "disabled",
+            LOG.info("Starting /metrics endpoint at HTTP port: {}, HTTPS port: {}, exportJvmInfo: {}",
+                    httpPort >= 0 ? httpPort : "disabled",
+                    httpsPort >= 0 ? httpsPort : "disabled",
                     exportJvmInfo);
             if (exportJvmInfo) {
                 DefaultExports.initialize();
             }
-            if (httpPort == -1) {
-                server = new Server();
-            } else {
-                server = new Server(new InetSocketAddress(host, httpPort));
+            server = new Server();
+            ServerConnector httpConnector = null;
+            ServerConnector httpsConnector = null;
+            if (httpPort >= 0) {
+                httpConnector = new ServerConnector(server);
+                httpConnector.setHost(host);
+                httpConnector.setPort(httpPort);
+                server.addConnector(httpConnector);
             }
-            if (httpsPort != -1) {
+            if (httpsPort >= 0) {
                 SslContextFactory sslServerContextFactory = new SslContextFactory.Server();
                 configureSslContextFactory(sslServerContextFactory);
                 KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslServerContextFactory);
                 keystoreScanner.setScanInterval(SCAN_INTERVAL);
                 server.addBean(keystoreScanner);
-                ServerConnector connector = new ServerConnector(server, sslServerContextFactory);
-                connector.setPort(httpsPort);
-                connector.setHost(host);
-                server.addConnector(connector);
+                httpsConnector = new ServerConnector(server, sslServerContextFactory);
+                httpsConnector.setHost(host);
+                httpsConnector.setPort(httpsPort);
+                server.addConnector(httpsConnector);
             }
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
@@ -199,6 +202,12 @@ public void start() throws MetricsProviderLifeCycleException {
             server.setHandler(context);
             context.addServlet(new ServletHolder(servlet), "/metrics");
             server.start();
+            if (httpPort == 0) {
+                LOG.info("Bound /metrics endpoint to HTTP port: {}", httpConnector.getLocalPort());
+            }
+            if (httpsPort == 0) {
+                LOG.info("Bound /metrics endpoint to HTTPS port: {}", httpsConnector.getLocalPort());
+            }
         } catch (Exception err) {
             LOG.error("Cannot start /metrics server", err);
             if (server != null) {
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
index 6ff0da5e204..aa9cd2c7170 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -64,7 +64,7 @@ public void testValidSslConfig() throws MetricsProviderLifeCycleException {
         Properties configuration = new Properties();
         String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
         configuration.setProperty("httpHost", "127.0.0.1");
-        configuration.setProperty("httpsPort", "50511");
+        configuration.setProperty("httpsPort", "0");
         configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
         configuration.setProperty("ssl.keyStore.password", "testpass");
         configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
@@ -78,8 +78,8 @@ public void testValidHttpsAndHttpConfig() throws MetricsProviderLifeCycleExcepti
         PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
         String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
-        configuration.setProperty("httpPort", "50512");
-        configuration.setProperty("httpsPort", "50513");
+        configuration.setProperty("httpPort", "0");
+        configuration.setProperty("httpsPort", "0");
         configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
         configuration.setProperty("ssl.keyStore.password", "testpass");
         configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
@@ -95,7 +95,7 @@ public void testInvalidSslConfig() throws MetricsProviderLifeCycleException {
             PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
             Properties configuration = new Properties();
             String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
-            configuration.setProperty("httpsPort", "50514");
+            configuration.setProperty("httpsPort", "0");
             //keystore missing
             configuration.setProperty("ssl.keyStore.password", "testpass");
             configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");

From 9dbd95836b2076023c899ffe3bef4e64881c4076 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Wed, 1 Oct 2025 01:24:50 +0200
Subject: [PATCH 552/591] ZOOKEEPER-3938: Upgrade JLine to 3.25.1

Reviewers: anmolnar, ctubbsii, kezhuw
Author: PDavid
Closes #2318 from PDavid/ZOOKEEPER-3938-jline-upgrade
---
 pom.xml                                       |  4 +-
 zookeeper-assembly/pom.xml                    |  2 +-
 .../zookeeper-contrib-fatjar/pom.xml          |  2 +-
 zookeeper-server/pom.xml                      |  2 +-
 .../apache/zookeeper/JLineZNodeCompleter.java | 46 +++++++++----------
 .../org/apache/zookeeper/ZooKeeperMain.java   | 32 ++++++++++---
 .../src/main/resources/LICENSE.txt            |  6 +--
 ...6.LICENSE.txt => jline-3.25.1.LICENSE.txt} |  7 ++-
 .../zookeeper/server/ClientSSLReloadTest.java |  3 +-
 9 files changed, 59 insertions(+), 45 deletions(-)
 rename zookeeper-server/src/main/resources/lib/{jline-2.14.6.LICENSE.txt => jline-3.25.1.LICENSE.txt} (90%)

diff --git a/pom.xml b/pom.xml
index 01633810ed3..338921bd93b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -562,7 +562,7 @@
     <netty.version>4.1.127.Final</netty.version>
     <jetty.version>9.4.57.v20241219</jetty.version>
     <jackson.version>2.15.2</jackson.version>
-    <jline.version>2.14.6</jline.version>
+    <jline.version>3.25.1</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
     <kerby.version>2.0.0</kerby.version>
     <bouncycastle.version>1.78</bouncycastle.version>
@@ -748,7 +748,7 @@
         <version>${jackson.version}</version>
       </dependency>
       <dependency>
-        <groupId>jline</groupId>
+        <groupId>org.jline</groupId>
         <artifactId>jline</artifactId>
         <version>${jline.version}</version>
       </dependency>
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
index 160f9e1b9d0..317233d6f3b 100644
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -100,7 +100,7 @@
       <artifactId>jackson-databind</artifactId>
     </dependency>
     <dependency>
-      <groupId>jline</groupId>
+      <groupId>org.jline</groupId>
       <artifactId>jline</artifactId>
     </dependency>
     <dependency>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
index f78a8fdce09..3cf8a30b607 100644
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -79,7 +79,7 @@
       <artifactId>jackson-databind</artifactId>
     </dependency>
     <dependency>
-      <groupId>jline</groupId>
+      <groupId>org.jline</groupId>
       <artifactId>jline</artifactId>
     </dependency>
     <dependency>
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index 495e4847919..b2ecf1902cd 100644
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -116,7 +116,7 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>jline</groupId>
+      <groupId>org.jline</groupId>
       <artifactId>jline</artifactId>
       <scope>provided</scope>
     </dependency>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java
index e55521400fa..67288e18070 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java
@@ -20,44 +20,41 @@
 
 import java.util.Collections;
 import java.util.List;
-import jline.console.completer.Completer;
+import org.jline.reader.Candidate;
+import org.jline.reader.Completer;
+import org.jline.reader.LineReader;
+import org.jline.reader.ParsedLine;
+import org.jline.utils.AttributedString;
 
 class JLineZNodeCompleter implements Completer {
 
-    private ZooKeeper zk;
+    private final ZooKeeper zk;
 
     public JLineZNodeCompleter(ZooKeeper zk) {
         this.zk = zk;
     }
 
-    @SuppressWarnings({"unchecked", "rawtypes"})
-    public int complete(String buffer, int cursor, List candidates) {
+    @Override
+    public void complete(LineReader lineReader, ParsedLine commandLine, List<Candidate> candidates) {
         // Guarantee that the final token is the one we're expanding
-        buffer = buffer.substring(0, cursor);
-        String token = "";
-        if (!buffer.endsWith(" ")) {
-            String[] tokens = buffer.split(" ");
-            if (tokens.length != 0) {
-                token = tokens[tokens.length - 1];
-            }
-        }
+        String token = commandLine.words().get(commandLine.words().size() - 1);
 
         if (token.startsWith("/")) {
-            return completeZNode(buffer, token, candidates);
+            completeZNode(token, candidates);
+        } else {
+            completeCommand(token, candidates);
         }
-        return completeCommand(buffer, token, candidates);
     }
 
-    private int completeCommand(String buffer, String token, List<String> candidates) {
+    private void completeCommand(String token, List<Candidate> candidates) {
         for (String cmd : ZooKeeperMain.getCommands()) {
             if (cmd.startsWith(token)) {
-                candidates.add(cmd);
+                candidates.add(createCandidate(cmd));
             }
         }
-        return buffer.lastIndexOf(" ") + 1;
     }
 
-    private int completeZNode(String buffer, String token, List<String> candidates) {
+    private void completeZNode(String token, List<Candidate> candidates) {
         String path = token;
         int idx = path.lastIndexOf("/") + 1;
         String prefix = path.substring(idx);
@@ -67,16 +64,17 @@ private int completeZNode(String buffer, String token, List<String> candidates)
             List<String> children = zk.getChildren(dir, false);
             for (String child : children) {
                 if (child.startsWith(prefix)) {
-                    candidates.add(child);
+                    String zNode = dir + (idx == 1 ? "" : "/") + child;
+                    candidates.add(createCandidate(zNode));
                 }
             }
-        } catch (InterruptedException e) {
-            return 0;
-        } catch (KeeperException e) {
-            return 0;
+        } catch (InterruptedException | KeeperException e) {
+            return;
         }
         Collections.sort(candidates);
-        return candidates.size() == 0 ? buffer.length() : buffer.lastIndexOf("/") + 1;
     }
 
+    private static Candidate createCandidate(String cmd) {
+        return new Candidate(AttributedString.stripAnsi(cmd), cmd, null, null, null, null, true);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index 44851df1fc6..ca27348e164 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -311,20 +311,18 @@ void run() throws IOException, InterruptedException {
             boolean jlinemissing = false;
             // only use jline if it's in the classpath
             try {
-                Class<?> consoleC = Class.forName("jline.console.ConsoleReader");
+                Class<?> readerC = Class.forName("org.jline.reader.LineReader");
                 Class<?> completerC = Class.forName("org.apache.zookeeper.JLineZNodeCompleter");
 
                 System.out.println("JLine support is enabled");
 
-                Object console = consoleC.getConstructor().newInstance();
-
                 Object completer = completerC.getConstructor(ZooKeeper.class).newInstance(zk);
-                Method addCompleter = consoleC.getMethod("addCompleter", Class.forName("jline.console.completer.Completer"));
-                addCompleter.invoke(console, completer);
+                Object terminal = createTerminal();
+                Object reader = createLineReader(terminal, completer);
 
                 String line;
-                Method readLine = consoleC.getMethod("readLine", String.class);
-                while ((line = (String) readLine.invoke(console, getPrompt())) != null) {
+                Method readLine = readerC.getMethod("readLine", String.class);
+                while ((line = (String) readLine.invoke(reader, getPrompt())) != null) {
                     executeLine(line);
                 }
             } catch (ClassNotFoundException
@@ -353,6 +351,26 @@ void run() throws IOException, InterruptedException {
         ServiceUtils.requestSystemExit(exitCode);
     }
 
+    private static Object createTerminal() throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        Class<?> terminalBuilderC = Class.forName("org.jline.terminal.TerminalBuilder");
+        Method terminalBuilderMethod = terminalBuilderC.getMethod("builder");
+        Object terminalBuilder = terminalBuilderMethod.invoke(null);
+        Method terminalBuildMethod = terminalBuilderC.getMethod("build");
+        return terminalBuildMethod.invoke(terminalBuilder);
+    }
+
+    private static Object createLineReader(Object terminal, Object completer) throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        Class<?> readerBuilderC = Class.forName("org.jline.reader.LineReaderBuilder");
+        Method readerBuilderMethod = readerBuilderC.getMethod("builder");
+        Object readerBuilder = readerBuilderMethod.invoke(null);
+        Method setTerminalMethod = readerBuilderC.getMethod("terminal", Class.forName("org.jline.terminal.Terminal"));
+        setTerminalMethod.invoke(readerBuilder, terminal);
+        Method setCompleterMethod = readerBuilderC.getMethod("completer", Class.forName("org.jline.reader.Completer"));
+        setCompleterMethod.invoke(readerBuilder, completer);
+        Method readerBuildMethod = readerBuilderC.getMethod("build");
+        return readerBuildMethod.invoke(readerBuilder);
+    }
+
     public void executeLine(String line) throws InterruptedException, IOException {
         if (!line.equals("")) {
             cl.parseCommand(line);
diff --git a/zookeeper-server/src/main/resources/LICENSE.txt b/zookeeper-server/src/main/resources/LICENSE.txt
index 47ddded77d5..76741750a67 100644
--- a/zookeeper-server/src/main/resources/LICENSE.txt
+++ b/zookeeper-server/src/main/resources/LICENSE.txt
@@ -206,9 +206,9 @@ This distribution bundles javacc, which is available under the
 3-clause BSD License. For details, see a copy of the license in
 lib/javacc.LICENSE.txt
 
-This distribution bundles jline 2.14.6, which is available under the
-2-clause BSD License. For details, see a copy of the license in
-lib/jline-2.14.6.LICENSE.txt
+This distribution bundles jline 3.25.1, which is available under the
+3-clause BSD License. For details, see a copy of the license in
+lib/jline-3.25.1.LICENSE.txt
 
 This distribution bundles SLF4J 2.0.13, which is available under the MIT
 License. For details, see a copy of the license in
diff --git a/zookeeper-server/src/main/resources/lib/jline-2.14.6.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jline-3.25.1.LICENSE.txt
similarity index 90%
rename from zookeeper-server/src/main/resources/lib/jline-2.14.6.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jline-3.25.1.LICENSE.txt
index 4ac9522bd8c..ed9503f23c2 100644
--- a/zookeeper-server/src/main/resources/lib/jline-2.14.6.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/jline-3.25.1.LICENSE.txt
@@ -1,7 +1,7 @@
-Copyright (c) 2002-2012, the original author or authors.
+Copyright (c) 2002-2023, the original author or authors.
 All rights reserved.
 
-http://www.opensource.org/licenses/bsd-license.php
+https://opensource.org/licenses/BSD-3-Clause
 
 Redistribution and use in source and binary forms, with or
 without modification, are permitted provided that the following
@@ -31,5 +31,4 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-OF THE POSSIBILITY OF SUCH DAMAGE.
-
+OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
index c7e3c8d22e7..3589a21a8e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
@@ -25,7 +25,6 @@
 import java.util.Properties;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import jline.internal.Log;
 import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.WatchedEvent;
@@ -144,7 +143,7 @@ public void certificateReloadTest() throws Exception {
                 assertTrue(l.await(10, TimeUnit.SECONDS));
             }
 
-            Log.info("Updating keyStore & trustStore files !!!!");
+            LOG.info("Updating keyStore & trustStore files !!!!");
             // Update the keyStoreFile1 and trustStoreFile1 files in the filesystem with keyStoreFile2 & trustStoreFile2
             FileUtils.writeStringToFile(keyStoreFile1, FileUtils.readFileToString(keyStoreFile2, StandardCharsets.US_ASCII), StandardCharsets.US_ASCII, false);
             FileUtils.writeStringToFile(trustStoreFile1, FileUtils.readFileToString(trustStoreFile2, StandardCharsets.US_ASCII), StandardCharsets.US_ASCII, false);

From 51c4f2bf1207d9eef2a67a27f6a05bdca567e90d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Mon, 6 Oct 2025 15:54:24 -0500
Subject: [PATCH 553/591] ZOOKEEPER-4984: Upgrade OWASP plugin to 12.1.6 due to
 breaking changes in the API

Reviewers: kezhuw
Author: anmolnar
Closes #2323 from anmolnar/ZOOKEEPER-4984
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 338921bd93b..cfee80f54eb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -889,7 +889,7 @@
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>12.1.3</version>
+          <version>12.1.6</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From 66c4efecdda1302d9cfb3af9eedb122b74452bf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Tue, 7 Oct 2025 07:38:42 -0500
Subject: [PATCH 554/591] ZOOKEEPER-4986: Disable reverse DNS lookup in TLS
 client and server

Reviewers: kezhuw
Author: anmolnar
Closes #2325 from anmolnar/ZOOKEEPER-4986
---
 .../main/resources/markdown/zookeeperAdmin.md |  10 ++
 .../zookeeper/common/ClientX509Util.java      |   4 +-
 .../org/apache/zookeeper/common/X509Util.java |  15 ++-
 .../org/apache/zookeeper/common/ZKConfig.java |   1 +
 .../zookeeper/common/ZKTrustManager.java      |  52 +++++++---
 .../auth/X509AuthenticationProvider.java      |   2 +
 .../apache/zookeeper/common/X509UtilTest.java |  11 ++
 .../zookeeper/common/ZKTrustManagerTest.java  |  96 ++++++++++++++----
 .../server/quorum/QuorumSSLTest.java          |  12 ++-
 .../src/test/resources/data/ssl/README.md     |  15 +++
 .../test/resources/data/ssl/testKeyStore.jks  | Bin 2250 -> 2772 bytes
 .../resources/data/ssl/testTrustStore.jks     | Bin 960 -> 1302 bytes
 12 files changed, 177 insertions(+), 41 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index b14cb6b86df..fea20e5fe8b 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1764,6 +1764,16 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     This option requires the corresponding *hostnameVerification* option to be `true`, or it will be ignored.
     Default: true for quorum, false for clients
 
+* *ssl.allowReverseDnsLookup* and *ssl.quorum.allowReverseDnsLookup* :
+    (Java system properties: **zookeeper.ssl.allowReverseDnsLookup** and **zookeeper.ssl.quorum.allowReverseDnsLookup**)
+    **New in 3.9.5:**
+    Allow reverse DNS lookup in both server- and client hostname verifications if the hostname verification is enabled in
+    `ZKTrustManager`. Supported in both quorum and client TLS protocols. Not supported in FIPS mode. Reverse DNS lookups are
+    expensive and unnecessary in most cases. Make sure that certificates are created with all required Subject Alternative
+    Names (SAN) for successful identity verification. It's recommended to add SAN:IP entries for identity verification
+    of client certificates.
+    Default: false
+
 * *ssl.crl* and *ssl.quorum.crl* :
     (Java system properties: **zookeeper.ssl.crl** and **zookeeper.ssl.quorum.crl**)
     **New in 3.5.5:**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 16d7f27a5ca..b035bbfe098 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -206,6 +206,7 @@ private TrustManager getTrustManager(ZKConfig config) throws X509Exception.Trust
         boolean sslOcspEnabled = config.getBoolean(getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
         boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
         boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
+        boolean allowReverseDnsLookup = allowReverseDnsLookup(config);
 
         if (trustStoreLocation.isEmpty()) {
             LOG.warn("{} not specified", getSslTruststoreLocationProperty());
@@ -213,7 +214,8 @@ private TrustManager getTrustManager(ZKConfig config) throws X509Exception.Trust
         } else {
             return createTrustManager(trustStoreLocation, trustStorePassword, trustStoreType,
                 sslCrlEnabled, sslOcspEnabled, sslServerHostnameVerificationEnabled,
-                sslClientHostnameVerificationEnabled, getFipsMode(config));
+                sslClientHostnameVerificationEnabled, allowReverseDnsLookup,
+                getFipsMode(config));
         }
     }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 2584fecd89d..2ac1ad9eef3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -166,6 +166,7 @@ public io.netty.handler.ssl.ClientAuth toNettyClientAuth() {
     private final String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
     private final String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
     private final String sslClientHostnameVerificationEnabledProperty = getConfigPrefix() + "clientHostnameVerification";
+    private final String sslAllowReverseDnsLookupProperty = getConfigPrefix() + "allowReverseDnsLookup";
     private final String sslCrlEnabledProperty = getConfigPrefix() + "crl";
     private final String sslOcspEnabledProperty = getConfigPrefix() + "ocsp";
     private final String sslClientAuthProperty = getConfigPrefix() + "clientAuth";
@@ -244,6 +245,10 @@ public String getSslClientHostnameVerificationEnabledProperty() {
         return sslClientHostnameVerificationEnabledProperty;
     }
 
+    public String getSslAllowReverseDnsLookupProperty() {
+        return sslAllowReverseDnsLookupProperty;
+    }
+
     public String getSslCrlEnabledProperty() {
         return sslCrlEnabledProperty;
     }
@@ -283,6 +288,10 @@ public boolean isClientHostnameVerificationEnabled(ZKConfig config) {
             && config.getBoolean(this.getSslClientHostnameVerificationEnabledProperty(), shouldVerifyClientHostname());
     }
 
+    public boolean allowReverseDnsLookup(ZKConfig config) {
+        return config.getBoolean(this.getSslAllowReverseDnsLookupProperty(), false);
+    }
+
     public SSLContext getDefaultSSLContext() throws X509Exception.SSLContextException {
         return getDefaultSSLContextAndOptions().getSSLContext();
     }
@@ -401,6 +410,7 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
 
         boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
         boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
+        boolean allowReverseDnsLookup = allowReverseDnsLookup(config);
         boolean fipsMode = getFipsMode(config);
 
         if (trustStoreLocationProp.isEmpty()) {
@@ -410,7 +420,7 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
                 trustManagers = new TrustManager[]{
                     createTrustManager(trustStoreLocationProp, trustStorePasswordProp, trustStoreTypeProp, sslCrlEnabled,
                         sslOcspEnabled, sslServerHostnameVerificationEnabled, sslClientHostnameVerificationEnabled,
-                        fipsMode)};
+                        allowReverseDnsLookup, fipsMode)};
             } catch (TrustManagerException trustManagerException) {
                 throw new SSLContextException("Failed to create TrustManager", trustManagerException);
             } catch (IllegalArgumentException e) {
@@ -546,6 +556,7 @@ public static X509TrustManager createTrustManager(
         boolean ocspEnabled,
         final boolean serverHostnameVerificationEnabled,
         final boolean clientHostnameVerificationEnabled,
+        final boolean allowReverseDnsLookup,
         final boolean fipsMode) throws TrustManagerException {
         if (trustStorePassword == null) {
             trustStorePassword = "";
@@ -604,7 +615,7 @@ public static X509TrustManager createTrustManager(
                         LOG.debug("FIPS mode is OFF: creating ZKTrustManager");
                     }
                     return new ZKTrustManager((X509ExtendedTrustManager) tm, serverHostnameVerificationEnabled,
-                        clientHostnameVerificationEnabled);
+                        clientHostnameVerificationEnabled, allowReverseDnsLookup);
                 }
             }
             throw new TrustManagerException("Couldn't find X509TrustManager");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 47fd943860c..f6221eeb7f4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -151,6 +151,7 @@ private void putSSLProperties(X509Util x509Util) {
         properties.put(x509Util.getSslContextSupplierClassProperty(), System.getProperty(x509Util.getSslContextSupplierClassProperty()));
         properties.put(x509Util.getSslClientHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslClientHostnameVerificationEnabledProperty()));
         properties.put(x509Util.getSslHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
+        properties.put(x509Util.getSslAllowReverseDnsLookupProperty(), System.getProperty(x509Util.getSslAllowReverseDnsLookupProperty()));
         properties.put(x509Util.getSslCrlEnabledProperty(), System.getProperty(x509Util.getSslCrlEnabledProperty()));
         properties.put(x509Util.getSslOcspEnabledProperty(), System.getProperty(x509Util.getSslOcspEnabledProperty()));
         properties.put(x509Util.getSslClientAuthProperty(), System.getProperty(x509Util.getSslClientAuthProperty()));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
index cbadd1e0af9..e2af9f6f077 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
@@ -42,6 +42,7 @@ public class ZKTrustManager extends X509ExtendedTrustManager {
     private final X509ExtendedTrustManager x509ExtendedTrustManager;
     private final boolean serverHostnameVerificationEnabled;
     private final boolean clientHostnameVerificationEnabled;
+    private final boolean allowReverseDnsLookup;
 
     private final ZKHostnameVerifier hostnameVerifier;
 
@@ -57,22 +58,26 @@ public class ZKTrustManager extends X509ExtendedTrustManager {
     ZKTrustManager(
         X509ExtendedTrustManager x509ExtendedTrustManager,
         boolean serverHostnameVerificationEnabled,
-        boolean clientHostnameVerificationEnabled) {
+        boolean clientHostnameVerificationEnabled,
+        boolean allowReverseDnsLookup) {
         this(x509ExtendedTrustManager,
                 serverHostnameVerificationEnabled,
                 clientHostnameVerificationEnabled,
-                new ZKHostnameVerifier());
+                new ZKHostnameVerifier(),
+                allowReverseDnsLookup);
     }
 
     ZKTrustManager(
             X509ExtendedTrustManager x509ExtendedTrustManager,
             boolean serverHostnameVerificationEnabled,
             boolean clientHostnameVerificationEnabled,
-            ZKHostnameVerifier hostnameVerifier) {
+            ZKHostnameVerifier hostnameVerifier,
+            boolean allowReverseDnsLookup) {
         this.x509ExtendedTrustManager = x509ExtendedTrustManager;
         this.serverHostnameVerificationEnabled = serverHostnameVerificationEnabled;
         this.clientHostnameVerificationEnabled = clientHostnameVerificationEnabled;
         this.hostnameVerifier = hostnameVerifier;
+        this.allowReverseDnsLookup = allowReverseDnsLookup;
     }
 
     @Override
@@ -166,31 +171,46 @@ public void checkServerTrusted(X509Certificate[] chain, String authType) throws
      * @param certificate Peer's certificate
      * @throws CertificateException Thrown if the provided certificate doesn't match the peer hostname.
      */
-    private void performHostVerification(
-        InetAddress inetAddress,
-        X509Certificate certificate
-    ) throws CertificateException {
+    private void performHostVerification(InetAddress inetAddress, X509Certificate certificate)
+        throws CertificateException {
         String hostAddress = "";
         String hostName = "";
         try {
             hostAddress = inetAddress.getHostAddress();
-            if (LOG.isDebugEnabled()) {
-                LOG.debug("Trying to verify host address first: {}", hostAddress);
-            }
             hostnameVerifier.verify(hostAddress, certificate);
         } catch (SSLException addressVerificationException) {
+            // If we fail with hostAddress, we should try the hostname.
+            // The inetAddress may have been created with a hostname, in which case getHostName() will
+            // return quickly below. If not, a reverse lookup will happen, which can be expensive.
+            // We provide the option to skip the reverse lookup if preferring to fail fast.
+
+            // Handle logging here to aid debugging. The easiest way to check for an existing
+            // hostname is through toString, see javadoc.
+            String inetAddressString = inetAddress.toString();
+            if (!inetAddressString.startsWith("/")) {
+                LOG.debug(
+                    "Failed to verify host address: {}, but inetAddress {} has a hostname, trying that",
+                    hostAddress, inetAddressString, addressVerificationException);
+            } else if (allowReverseDnsLookup) {
+                LOG.debug(
+                    "Failed to verify host address: {}, attempting to verify host name with reverse dns",
+                    hostAddress, addressVerificationException);
+            } else {
+                LOG.debug("Failed to verify host address: {}, but reverse dns lookup is disabled",
+                    hostAddress, addressVerificationException);
+                throw new CertificateException(
+                    "Failed to verify host address, and reverse lookup is disabled",
+                    addressVerificationException);
+            }
+
             try {
                 hostName = inetAddress.getHostName();
-                if (LOG.isDebugEnabled()) {
-                    LOG.debug(
-                        "Failed to verify host address: {}, trying to verify host name: {}",
-                        hostAddress, hostName);
-                }
                 hostnameVerifier.verify(hostName, certificate);
             } catch (SSLException hostnameVerificationException) {
                 LOG.error("Failed to verify host address: {}", hostAddress, addressVerificationException);
                 LOG.error("Failed to verify hostname: {}", hostName, hostnameVerificationException);
-                throw new CertificateException("Failed to verify both host address and host name", hostnameVerificationException);
+                throw new CertificateException("Failed to verify both host address and host name",
+                    hostnameVerificationException);
             }
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 8286c061c9c..befdecd1044 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -89,6 +89,7 @@ public X509AuthenticationProvider() throws X509Exception {
             boolean crlEnabled = config.getBoolean(x509Util.getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
             boolean ocspEnabled = config.getBoolean(x509Util.getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
             boolean hostnameVerificationEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
+            boolean allowReverseDnsLookup = Boolean.parseBoolean(config.getProperty(x509Util.getSslAllowReverseDnsLookupProperty()));
 
             X509KeyManager km = null;
             X509TrustManager tm = null;
@@ -121,6 +122,7 @@ public X509AuthenticationProvider() throws X509Exception {
                         ocspEnabled,
                         hostnameVerificationEnabled,
                         false,
+                        allowReverseDnsLookup,
                         fipsMode);
                 } catch (TrustManagerException e) {
                     LOG.error("Failed to create trust manager", e);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index ff054c1d634..1c5104e784b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -332,6 +332,7 @@ public void testLoadPEMTrustStore(
             false,
             true,
             true,
+            false,
             false);
     }
 
@@ -353,6 +354,7 @@ public void testLoadPEMTrustStoreNullPassword(
             false,
             true,
             true,
+            false,
             false);
 
     }
@@ -372,6 +374,7 @@ public void testLoadPEMTrustStoreAutodetectStoreFileType(
             false,
             true,
             true,
+            false,
             false);
     }
 
@@ -447,6 +450,7 @@ public void testLoadJKSTrustStore(
             true,
             true,
             true,
+            false,
             false);
     }
 
@@ -468,6 +472,7 @@ public void testLoadJKSTrustStoreNullPassword(
             false,
             true,
             true,
+            false,
             false);
     }
 
@@ -486,6 +491,7 @@ public void testLoadJKSTrustStoreAutodetectStoreFileType(
             true,
             true,
             true,
+            false,
             false);
     }
 
@@ -505,6 +511,7 @@ public void testLoadJKSTrustStoreWithWrongPassword(
                     true,
                     true,
                     true,
+                    false,
                     false);
         });
     }
@@ -580,6 +587,7 @@ public void testLoadPKCS12TrustStore(
             true,
             true,
             true,
+            false,
             false);
     }
 
@@ -601,6 +609,7 @@ public void testLoadPKCS12TrustStoreNullPassword(
             false,
             true,
             true,
+            false,
             false);
     }
 
@@ -619,6 +628,7 @@ public void testLoadPKCS12TrustStoreAutodetectStoreFileType(
             true,
             true,
             true,
+            false,
             false);
     }
 
@@ -638,6 +648,7 @@ public void testLoadPKCS12TrustStoreWithWrongPassword(
                     true,
                     true,
                     true,
+                    false,
                     false);
         });
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
index 138e45e2e1d..568f2ef502f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.common;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
@@ -27,13 +28,16 @@
 import java.math.BigInteger;
 import java.net.InetAddress;
 import java.net.Socket;
+import java.net.UnknownHostException;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.Security;
+import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Calendar;
+import java.util.Collections;
 import java.util.Date;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -61,10 +65,10 @@
 import org.burningwave.tools.net.HostResolutionRequestInterceptor;
 import org.burningwave.tools.net.MappedHostResolver;
 import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -113,16 +117,14 @@ public static void removeBouncyCastleProvider() throws Exception {
     @BeforeEach
     public void setup() throws Exception {
         mockX509ExtendedTrustManager = mock(X509ExtendedTrustManager.class);
+        mockSocket = createSocketWithHostname();
+    }
 
-        InetAddress mockInetAddress = InetAddress.getByName(HOSTNAME);
-
-        mockSocket = mock(Socket.class);
-        when(mockSocket.getInetAddress()).thenAnswer(new Answer() {
-            @Override
-            public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
-                return mockInetAddress;
-            }
-        });
+    @AfterEach
+    public void tearDown() throws Exception {
+        if (mockSocket != null) {
+            mockSocket.close();
+        }
     }
 
     private X509Certificate[] createSelfSignedCertificateChain(String ipAddress, String hostname) throws Exception {
@@ -161,7 +163,7 @@ private X509Certificate[] createSelfSignedCertificateChain(String ipAddress, Str
     public void testServerHostnameVerificationWithHostnameVerificationDisabled() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
@@ -175,7 +177,7 @@ public void testServerHostnameVerificationWithHostnameVerificationDisabled() thr
     public void testServerHostnameVerificationWithHostnameVerificationDisabledAndClientHostnameVerificationEnabled() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
@@ -190,7 +192,7 @@ public void testServerHostnameVerificationWithHostnameVerificationDisabledAndCli
     public void testServerHostnameVerificationWithIPAddress() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
@@ -205,7 +207,7 @@ public void testServerHostnameVerificationWithIPAddress() throws Exception {
     public void testServerHostnameVerificationWithHostname() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
@@ -220,7 +222,7 @@ public void testServerHostnameVerificationWithHostname() throws Exception {
     public void testClientHostnameVerificationWithHostnameVerificationDisabled() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
@@ -235,7 +237,7 @@ public void testClientHostnameVerificationWithHostnameVerificationDisabled() thr
     public void testClientHostnameVerificationWithClientHostnameVerificationDisabled() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true,
-                false, hostnameVerifier);
+                false, hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
@@ -250,7 +252,7 @@ public void testClientHostnameVerificationWithClientHostnameVerificationDisabled
     public void testClientHostnameVerificationWithIPAddress() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
@@ -265,7 +267,7 @@ public void testClientHostnameVerificationWithIPAddress() throws Exception {
     public void testClientHostnameVerificationWithHostname() throws Exception {
         VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
         ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
-                hostnameVerifier);
+                hostnameVerifier, false);
 
         X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
@@ -276,6 +278,64 @@ public void testClientHostnameVerificationWithHostname() throws Exception {
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
+    @Test
+    public void testClientHostnameVerificationWithIpAddress_CertHostnameSan_NoReverseLookup_Fail() throws Exception {
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+            hostnameVerifier, false);
+
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
+        try (Socket s = createSocketWithIpAddress()) {
+            assertThrows(CertificateException.class, () -> zkTrustManager.checkClientTrusted(certificateChain, null, s));
+            verify(s, times(1)).getInetAddress();
+            assertEquals(Collections.singletonList(IP_ADDRESS), hostnameVerifier.hosts);
+            verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, s);
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithIpAddress_CertHostnameSan_WithReverseLookup() throws Exception {
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+            hostnameVerifier, true);
+
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
+        try (Socket s = createSocketWithIpAddress()) {
+            zkTrustManager.checkClientTrusted(certificateChain, null, s);
+            verify(s, times(1)).getInetAddress();
+            assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
+            verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, s);
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithIpAddress_CertIpSan() throws Exception {
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+            hostnameVerifier, false);
+
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
+        try (Socket s = createSocketWithIpAddress()) {
+            zkTrustManager.checkClientTrusted(certificateChain, null, s);
+            verify(s, times(1)).getInetAddress();
+            assertEquals(Collections.singletonList(IP_ADDRESS), hostnameVerifier.hosts);
+            verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, s);
+        }
+    }
+
+    private Socket createSocketWithHostname() throws UnknownHostException {
+        InetAddress mockInetAddress = InetAddress.getByName(HOSTNAME);
+        Socket s = mock(Socket.class);
+        when(s.getInetAddress()).thenAnswer((Answer) invocationOnMock -> mockInetAddress);
+        return s;
+    }
+
+    private Socket createSocketWithIpAddress() throws UnknownHostException {
+        InetAddress mockInetAddress = InetAddress.getByName(IP_ADDRESS);
+        Socket s = mock(Socket.class);
+        when(s.getInetAddress()).thenAnswer((Answer) invocationOnMock -> mockInetAddress);
+        return s;
+    }
 
     static class VerifiableHostnameVerifier extends ZKHostnameVerifier {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index 3ced1813f2b..16713342412 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -142,6 +142,7 @@ public class QuorumSSLTest extends QuorumPeerTestBase {
 
     private static final char[] PASSWORD = "testpass".toCharArray();
     private static final String HOSTNAME = "localhost";
+    private static final String IPADDRESS = "127.0.0.1";
 
     private QuorumX509Util quorumX509Util;
 
@@ -487,6 +488,7 @@ private void clearSSLSystemProperties() {
         System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
         System.clearProperty(quorumX509Util.getSslTruststorePasswdPathProperty());
         System.clearProperty(quorumX509Util.getSslHostnameVerificationEnabledProperty());
+        System.clearProperty(quorumX509Util.getSslAllowReverseDnsLookupProperty());
         System.clearProperty(quorumX509Util.getSslOcspEnabledProperty());
         System.clearProperty(quorumX509Util.getSslCrlEnabledProperty());
         System.clearProperty(quorumX509Util.getCipherSuitesProperty());
@@ -700,6 +702,8 @@ public void testHostnameVerificationForInvalidMultiAddressServerConfig(boolean f
     @Timeout(value = 5, unit = TimeUnit.MINUTES)
     public void testHostnameVerificationWithInvalidIpAddressAndValidHostname(boolean fipsEnabled) throws Exception {
         System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+        // We need reverse DNS lookup to get this working, because quorum is connecting via ip addresses
+        System.setProperty(quorumX509Util.getSslAllowReverseDnsLookupProperty(), Boolean.toString(true));
 
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
@@ -805,7 +809,7 @@ public void testCertificateRevocationList(boolean fipsEnabled) throws Exception
             rootCertificate,
             rootKeyPair.getPrivate(),
             HOSTNAME,
-            null,
+            IPADDRESS,
             crlPath,
             null);
         writeKeystore(revokedInCRLCert, defaultKeyPair, revokedInCRLKeystorePath);
@@ -835,7 +839,7 @@ public void testCertificateRevocationList(boolean fipsEnabled) throws Exception
             rootCertificate,
             rootKeyPair.getPrivate(),
             HOSTNAME,
-            null,
+            IPADDRESS,
             crlPath,
             null);
         writeKeystore(validCertificate, defaultKeyPair, validKeystorePath);
@@ -874,7 +878,7 @@ public void testOCSP(boolean fipsEnabled) throws Exception {
             rootCertificate,
             rootKeyPair.getPrivate(),
             HOSTNAME,
-            null,
+            IPADDRESS,
             null,
             ocspPort);
         writeKeystore(revokedInOCSPCert, defaultKeyPair, revokedInOCSPKeystorePath);
@@ -909,7 +913,7 @@ public void testOCSP(boolean fipsEnabled) throws Exception {
                 rootCertificate,
                 rootKeyPair.getPrivate(),
                 HOSTNAME,
-                null,
+                IPADDRESS,
                 null,
                 ocspPort);
             writeKeystore(validCertificate, defaultKeyPair, validKeystorePath);
diff --git a/zookeeper-server/src/test/resources/data/ssl/README.md b/zookeeper-server/src/test/resources/data/ssl/README.md
index b8823d8a3de..26d4d0b6fff 100644
--- a/zookeeper-server/src/test/resources/data/ssl/README.md
+++ b/zookeeper-server/src/test/resources/data/ssl/README.md
@@ -1,6 +1,21 @@
 SSL test data
 ===================
 
+Create keystore with certificate
+```
+keytool -genkeypair -alias test -keyalg RSA -keysize 2048 -dname "CN=localhost,OU=ZooKeeper,O=Apache,L=Unknown,ST=Unknown,C=Unknown" -keypass testpass -keystore keystore.jks -storepass testpass -ext SAN=DNS:localhost,IP:127.0.0.1
+```
+
+Export certificate to file
+```
+keytool -exportcert -alias test -keystore keystore.jks -file test.cer -rfc
+```
+
+Create truststore
+```
+keytool -importcert -alias test -file test.cer -keystore truststore.jks -storepass testpass
+```
+
 testKeyStore.jks
 ---
 Testing keystore, password is "testpass".
diff --git a/zookeeper-server/src/test/resources/data/ssl/testKeyStore.jks b/zookeeper-server/src/test/resources/data/ssl/testKeyStore.jks
index 40a7d0b7eae24b40c42e0f0e5410ef5caed30e4e..60e5d52b656ec638e9cce0ce631b049d46f27e94 100644
GIT binary patch
literal 2772
zcma);X*d*$8pmf>mQ03G*5O397#jP&QzjW>&5-ONGcxwjkO*ZtlE|QAJs3t!_N{DX
z&C;=D3nP(TS#o;ry-(-4pYHweKJWAX{_p?&_<vqBg>?V~1fwaep|F!uu_m#596%Oe
zE``+_LSgmziCxeXXz71R&@2cAn(-5-{j5hYw*R=;S%IKj3RLGO)IhucazHuIc4(D<
zMs~C`gu62kig$?!JTrtySnDP^-VzRo@CSj;!$Ck4njLoH-xonAp#ZcX?Bw-W6QCOy
z0+fQlonBer{!V0DzMzu5sa*X;A3}i)Y%cb1o5)M!i2V-M818l%XXCck0cX?XAKq#z
z!rh)0=vfYrs;GXhq!gnYE5}n70jFI{2j@h6*_ql{s&r}mMf3YpIioQ2K5}-b(Xl9q
zzpTLvx;8V}Q!@C101&pJIkGMH>ZZM3Z&R4_%5K0f;6rCgSF|rINPPzOSkBfNl2=S|
zM@iyOUPdl^`03_J*Llte5;RjC9r;_)DMvWH@7rD6Y8GDs>kd8K7al2ff`w~E<6i>~
zu!6Z_@$+mg_5&w+h}i6-&lY~(eBX{U%^VDQD)1G^)YutA5Z~_ws$~+*T<aA!ZYP8?
zyu!~P8v2Yqb`>0Ww5^wALKFcr;TjFM3RUd<GRTPe0ksrSj7cJCWvu{zCBYKw_h60?
zBW`VGUImgNad-<kw$_KAS(<Bx+nw`_(GTiQ4Y|X6a5JxuvxVho{CCuCGKcL>u}<gn
z;Sd%YQb9&cFPp~g@cI*JR$pRAHAu`<wPvlonq?l%*`w{q8=OzOs+i!@TnKQ_C3`&<
zMZRY!JWHc>*t_(~O07kEHQ2Q7>P*}UkR2`3iRaR_za8+bpc5(Eve3VB<qFYiC*btF
z@1d6R8Ax^Vr^J#P4E?OTA12Ns+P5Xkd8;Z_D}7slrW_qIGHCLbYLOsd*RU-r`{hx=
z&@B--_=D%l-0`TbW+9#u92QoT?BE<m_>0~e#0-=j)!H_i_^@7odB5=tnzQ|0a2t!)
zF4IW0;YF)?*hYg{ZSVD%*Fp5EhpDG<Aj$Twk9oXxYVYnzxw*nw&dui`5u_fNwJ$9l
zyAvph*jaWmtEzKaDEjiPzj;WsIocJKL~Xe#Aia}0e~*8<=J-kclovEg%=<J=^gea4
z>D1umosFCf?&(`R7aq>!t8MyikQtHRk@Tb0RbG?MQasPAx*VG?OIKe`1TaDpxG%R(
zUe_sho?<-U8vSvVz*XL~vQl4etWGyjjUXDS-&HfAw~KT*{kDops>P*`L|To+b((v7
z-mM-BbRI}Do$KN9F`s8sOUJNzmfV+Vezhti*jr)mK<NiFOKS)zllYy&PJ<A0F+f>?
zx@q`z8}VI)fQ3=LcSrnKL*cc%`E$pz2`QR6d={w2UU|6+k#I!go_M0}57+OF{Z&Sc
z7+DZDQQWee_$a_ffRRc(th*FyRZYE<YU~fkCT%G>h_OQ!9ONE^jZn=JktO~7GCb!M
zIt1gCe)vEC!>7H7?GK#wuzlH?Bs-&!J$F?z(u8n#km7X|XW9+5;dAyGw~ckQ?-w20
zpQQbO4=Y>>#Co54su=Wf5EL-rt|rH>FAYPAD2!F(W(vt)g<$?2&3%B2`hzw+^3!tU
z&x;X9k<z{5J$qzfLOH2<QKRwCrOvpc@zAd3UV27-qK`w}yA$S0q%30ua5s`B<zCS+
zD~Av;kT`|3c2(P3Ih=p<97fMt=tdbqx|!i}(<C{>dAW&N9(Q(Xa<oKcA-ZxB&m=GO
z-Pjjf4t>@0dgFGR?x1b(AedtSBpbAM=7*GJMQ#!tB0Xv>R$iY~yPzc;;y9899Pbl{
zf<ya^g7&dn@QB2BY>??$2jWxo@%sZ}G-<9E?|Oa=w>Tk?Qd+8fG<9M?Hgl{JoAiA4
zaM!6uL0$vR`ztO_a?7&{od5&?+yJ)$0ceqb1Ri;A2p8VV*9|4Ftf-=-h*42dQBb~!
zra-EGEwR9IDUkf1C<g=t{A?NjD8T;}(fn52MAM<i{P{suUA5V?)5BVvG5=3Qzr~!z
zFdD`B^6}=vrzdleQ4|PjTgE_x;$bAR@DSs>@fQ5>&wfHe-0^MFJMi#+P1D@42XEmG
z_c2MldeGouaoc07>Fc*Fb6`Z0<6!=jVG49Azhgzmfu~6!5gJAv-9CKipD~rs_xyv|
z4Fx+eV+Mv_zV&444vU|b^gV63I{i;{94m7#gGVUN<Z68c*dHdgI<8Fk7`>#;GlHuR
zgM@A9DolQxZAVz+&vv>+*j{}=Y1~bRF70o3BAE|P8EjR%dv#<TOtgru`{oitBUJ9b
z!|f+&D~5wUy#JbP=$H9eP@`i(_}yk2^+Q`%K;Kcx3sc9r*4<qA{qz_vkFcwKrIx5g
zWW&YZlS>V)m?B#K6>@i+Ih*uKaup0d`<b=YdFsD)qM3iL0rPh%wbNIdSk>#jZ5oV2
z@2<TnUS&)#o(0HE_dd&|Lx*QX4*<JK#$^m#1?t@>UM1U5;cJ~^+ib4Ok{s2J1+(5;
z7+I8Roib&rb6+%Lyl2v{TGl(NU|i@cYmpQS`^+V4xAYMLQ@RS9m*QXk$z@E=<p+Dw
zWH4%Q-$>}QmjLI=s;XIo%H_aUcZl(^E|)S!pfiWZ<&(30B84=eTp^A01?K+Q$MU5(
z+Zn~cVebc8K{FDC4vXHJ$YS9fzdUbp+3}+xkk1oMZ}U$F@nLU~y19IZd@76NZVjcK
zg%6n`uK}C-p>}rDF@y53{gh&<98m$umN=<~%p(^ro$!{?U9AyV8BVY9DPB~}4vSi%
zLUj6h2wt=l2~`V^&jEaSy(mXH{<(R=W4WRfshEXuTOAiLMtq`WvVZ-neJCe#Ki`Eo
zTP<@5J)O!N?I=Q!E+ycH3d*&bYu6Zw*9;Y}Rj*~<RZ>%?DET_=zo2c|HwMz1=GixO
zE^AlB=Z%>M1yv8<iKpNvgVE9in*5DK!CGbBNRI4}O`Muzh~G+Ed?mW3ty&5N+BBk6
zPbv-LEKhB%!MHGeu0E<)V)fOt8B^Ua#>NQ2hYSyB&pun^Q1tQzZvUfYI?zN#NsypK
z?8GMfo%Z>IX!w*$+9@XcHSKz)wXh=&-bCJ$m7!+5*OlukZrGX=;;Yz+crzk7`2Z$L
zE_pG--n}5K_G#S{qbkY~SnJ&Vz7;7-N&_3RMW}`@@ydWk|1#P6La*#IP|J58f*(Sq
z@{#9ilJz7AQG*ASTTRS2aH(k2_h;va$r-y-_pL~PM(6asG6N0=*AE=FB>sG+p>z$k
z8b=C=+(I-<*O*jd4ygGDGD+&2NnAIBGu<zyrnI<$;}nJ@$A3Fd656uSxOUpds-Y~V
zRNqE2Jmj)oY|({pT+f47rZ4y|!LM$_lsb`#&0k22%FGuxx6K7%h&*N;Z@n@%Af|g8
z87erw)f}JKW8%NxO1GpYDA^hBd30r9fn8RqXe?SD&GGBg0|B7`2r6raSN~Gx%2TmV
y0Z5mY%>IcJ(F}5|#Wzlf3YRS+bs56FNXe=4VDMBmRk-lI?mGl+zSR6zMEwm4p#)d}

literal 2250
zcmchYcTm%58pqRtPy*6LN+?PVzfeUf1`w&zq=SGG0|%QR1acJR2%%VLt02-@P-)=+
ziHe~kO?qDu#6=(yiXcsnw%pF`+|Jzp_s28yyq}rpnP<LFd5>0)RzV;T<ix;#7>tY$
zC7(R3^tB$=fk1EwK!qIvd<dip0t^EyLj=HJI0#0CvB6l`29lo<I`6FAV61*iaNj+x
zs6OlmRcGbtd<1ATC4}S`uR3x|^9&@|rahn`Dtpq3&}1&UCggLtFo{n^H!S@6w-4J^
zg5R^S{I_)+H}G@%@hk6}IpnU~!N(0qK-!!Lt;4d7Nk{2C&zR-5>uCX*<@{y3*qGpy
z<c5Q<WBgpvk6VjP;RA{eNzsQlJw;OGf!BrggLC<--&#&xYc!asbu<o8FzgC^BKd-5
z<(3-0_RGb5<A}T)AvcDl2|)qkXl0G=n|q2!M&mfseOjKEcpA~iN8Y8#%!O-WY5x8N
zf>+uDRgnXo3<I)5O4z|2!#1MmL@}L?xvXl@he-;4I}DBWqWN2*vd+%-diy_DUkK^J
zyJjF>7NS(pr>m6s_Eg(Yj~&O}VTK4!bre_A;*pH(*AdNOpVYk3J!AF0vS^djK%a&^
z%{uNVzh~-polN7rjT0If5mM4y!{ez#xVQ#a*PlRRguuHl>*hPEE;~}pxvW{z<M3jh
zYqAPfE~$dY;C*66e8K$awrE)WS^njt>TI+OdGowlft>sY)L3AagmpddJW*WvdMm{d
zAqA>dba^K>_gk(UL!=faEHc1`U#vI}>AqDJNi=^DrJ%=A-_@D&wA!he??v+0>E!s#
z-pTMPO27YS7P5hz(Bw0;ZB%Mm^7nEQd{lBH1W`RR%tf@zTXDFRs05x*dO}m8yhHs<
zJ@*|`dWppZ!kwFJS&v84JB?2(jYGYDA|+69*OJ#bn8-DQdr}3cvEr@%=hhrwdItyB
zYIof4F|wPln|me_Hlvtc@*WXI$V$3Yg6K0egX~z7y)(-R^PX|A)c4saS!Lxs#yv>d
zSx5xjom7T$mMsxMg%7n<0~RknDs_e`((S~8K5LnTW^lI`fI2)>Y^Gn?E3aNKok%b;
z$#d^y+vdF*PAq@awa5yWDSG-`ZTv#O=EBQ-9tzv$TaqxZo7q%g)1F!MU~`P^w+C$R
z5d7Wm|CArbIACh!TEEu_d|fZKWc?5=u0buS+l~&s?RzCExKp8#(Py?C@l<T6;d^6!
zai3Uh!Ze07rMqpx$||pDr)$r40+ppUT)S)}Qno_*W6+r$i3{CA4{hRq3|e&`<;F#q
za9X+<`tHa1b#3Gj$Su+;l&pw|sov*GUDc`^SbRqJYYQfx@+J(KK~(6eVkAN)V96i$
z!>*VB%RE<Sda^1cGhn>c_r2a*`tz6FdUBfMRIkV9%TC+Mpd$Ry3tzTbzqq-2zD%=D
zW<Fw7Xr)GNwEleywQjBQQyuL!cU`NNd>!<wm|o7YpY@_%+Lv`oDJ^Ntmumdh&w_1!
zpM;-mVL-BioD(+oY}};nsss+_(j$nP#M?Y}6$RM}LYS0U@{z8_9L+G+)=`GYAZxTC
z?bu0|Ai6LW+`R>}lz|4zGI*vlZTCS*W>b|H%SigL^s@srrohr}z>72<TGg=~2?^14
zWD0~?gtZ(CXl`q3&P3nfJe8;ryS{n6yMUNkJ%78rc}set<Wp7KC3dO$eAFf-Y=`lt
zae?k$=Ctf--(d|;y-vZB(>89nj-;N8P3IBm+>|mgFZu9ml5G7`xoVZ%%A!6@Z>XfM
zr$M_+dfVblCB0+0@tN9LJ-=reI0movzD@N(pOJh@-6JF?$*$m!y9js1Xajm65Ht>;
zLSq0bgir{DfFTfAs1^eO@FKXB6U-BKdBI?AI0ztN`A<$J)Cq<V<ZvPe5=j)|pM>*&
z2*-a3>Lk%g6jBg@3--O~kH?+@`2P*K1-aZwBr7~V7$5Q{g9>s5k#711`IAD)fQ%?F
zRvW--0@(A~x|)Ey80y5;1~dTO|A7C0NmQ`xUu8M@HK0^53ItHWNC*`S2K|EOye@DF
zNazWQBGfP4)zzy%h%vtKkyzM~;4tyXfBtGM_GGU_?a5Q#$<7R7oM8jhOQKshCEEok
zTUkcv_6w62wni%3C#VObD1Bf`wWD-B4r*!r>{FyLVq6O8Gm@8^T?*Lqox$@tdlZWL
zAjZDypqO1(?xfA%1h1#J3bUSW#tgvMYLoHS!3H2z$K1Pt-q$Ye8=ESzOjry3{pP}#
zQTJ-pF^q!P*{Yv=_>8<{o-~_54Y!1Ksx_ML)5n@B2^*5zwWPJBQH8rP$KK9HXOwH0
zhpfbC9UUMz=QouJxq|VBhN|N^RNQ))W0#TaPss4qjDLXe_?kx$C>R7TMg!7-<VlMq
z`CuY2A^c?B=W~}ML9Xibac(~~O44rm_FqLjnXMBM!61q5K%F>AMO{znJ3F1U!shoa
zR|Y$@f+Gh5*;=$F&d97qgH_2n65^v=1&%&GEBW(Q9{ezRt;sU+&BoD|N5nLJ*VKT(
z8F?{%(mld7bFzsK*X{Quv0YK1Vp?ary0TGSM3PwKpy0kjqRZTNm$)^?``qGnn8`aD
zw^e1MNVuyCNBrD|sjw7bSYI&IU2OuvT{Oyd_gm6lJ6{R^6*k_he_fBQ?skT=VXx1l
zhp8?j9{YrWX8M%qaR%X(?Q7ak7eD;5N*G#OaR4jNOO4cNg-+kqk}tbTp&!1a@U}&^
z;CK22^2E#C1l#lI-oA@%V(SY<7C6SY{B$1eT#j?{I80l6Zu&;Il)TbXnKM_Z-|rT;
B+9Ln}

diff --git a/zookeeper-server/src/test/resources/data/ssl/testTrustStore.jks b/zookeeper-server/src/test/resources/data/ssl/testTrustStore.jks
index 33f09c11dfaa303e3054be774923b8fe8c87bdf6..bced986e430b0542d942d1d87c4b050f09cc5e91 100644
GIT binary patch
literal 1302
zcmV+x1?l=Qf&~%+0Ru3C1iS_bDuzgg_YDCD0ic2etptJusW5^Br7(g7p#}*mhDe6@
z4FLxRpn?RFFoFb*0s#Opf&_;K2`Yw2hW8Bt2LUi<1_>&LNQU<f0R;^(Sui*T2`Yw2
zhW8Bt1q?7N1Qf%fxKA_|EBz)*vhHcPGgvhx4fp~AClCSwATSID2r7n1hW8Bu2?YQ!
z9R>+thDZTr0|Wso1P}%NNY3CfLkxiim9uPXGs1v^1Q5<56WTNua7Ti>FJh=ANYk7I
zaUuq38TZOld3GWACG@{u6hukTYaYWVuX-VBkDs%QL6M=6_KucPztr3R?L&}h8N<H0
z)j1Fv({};PQC5ul%i_&)D%G;&SV->5lJyk4D2CX<t8w+A(pmo@Nwmi)mmex}i_kJt
zRNH0PkIzYMTA7o)+f0?M1<G8Cw)?d#Zv%xsjZiv`Zm6tTbwT+!&B@-tmf~|i%!75w
z*XcAg`zNq*bqkh3!AtTnoG-E52ImVjcm#-zT@i0_0dorCt2Xm-&k`*A4UQ_zsKC6+
zAogj-Ql(Bi_K}U@g4-{qa7|P|HnwCa6H=Fhj94ibsm(nJTf05?hm_3RHG#L%@)V*(
zD5<Aiw_*jiRPaFs=q{ho-1{?ICzbI)BXAuU*&<C>X=PjkWiL#~hdDjw7-+WqK#w@O
z$q{>beQs(#>Do8y>d15tQ_{m(Fr}mNb4vXs^4SQ;)Zym4T6fJRTzis3J_uCgpo4$d
z@0m3J?aia8ljclzWn>AG2Ue*6mpy*8Pv~yuJLBSx1^M_A7Ho>xNIiGm>mrWBh7&8-
zu>lw0Y7`8UuxWD9{no=8>{ZL@gU?$!v-htaC#~JYfki5bGD4H$^3V#xdJ-^n47dNf
ztYHv(FpW4rGb|UEywSo@$%?ga3cu00{{_3(6TeVG`0<k^s=Pj9z*15N(@}Zb(>Kc6
z_IV9jNjDA5SJE_W=lJ>pl}xN*j2%@cY`UUN4v)cVJN`^F_g(`blE|ogaQueP%452e
zFZvB8p!a^b^B(@~F*Nu<64*_VJw-1&tTv^vsrSD4O410E7n$DqAbGjar0;g(WxFyz
zv_K(*>DXrr14v+%F5`D{Svn?FSZB^i2RqNXJs`>o4D)9eR@TOU@bs_*=!h1Mu`!KN
z6XVLKp?gwPUK389?XKPFKV}HN=N6Aq6bowaqt1+Wqzdwq#i8Qw3~97;hXQFZ<BbUp
z>}KB)6w;6xt;d$&Ma;AqY|!fU7H_40lF#dU3kJG_46dEe)ywx-xEfZV>oYZxZ(+6K
zp>uN&U9-uq)jlow`e;WA*+9U!Boo1Lih7^p_r3@mM8vVuM4D|L4s_}qI>T~09_rVX
zAOqwy8q8q!@lCvI^j`NQs!tw^WIg-fz3^#Wj^=w;$do1+={?gqfG@!$203bgp=MCZ
z=N8#xTPG>7tkEZFEwf&(buvO_yiJCl`sDQU4NbBk(W?gXI{Y)eUx$&CukGh!x$nra
zq8{Y=Y%zsi)upSYp__|E?CKP-PmcHm?OHIpp4<CO%hIor>8@$!;j)o%9(st)G6{|+
zEQlxzE@SoKdJujnf>^Y)djBDFT%sNJV_B$uDVorG?;<cwFflL<1_@w>NC9O71OfpC
z00bZ_xcVFAaV(aVpm$VG#T{0{|L|>=(IcJ{{iLS0IAV1K6m&yFUNU_3;FAGpLlvhp
M^EMW`HUa`C5KKT|<NyEw

literal 960
zcmezO_TO6u1_mY|W(3nLC8@<FK#sSK>Fjt0)(AaQ14{-5=4OK?=6ZuBrt}5OOpHuS
zEX5{U*$jBuIJMe5+P?ELGIFyr7~~rY81S(%hqAB<vxnwo=jE5@!9+MPMA#7`{6K?%
zy10bd919YYGg1wO3<N*|+`^nu`T5?dsRgM;FfnFf&Yb+@#GH)$;t~S|ab81H14Cm2
zLkm-LV}mFOejwA-z{tQHDnNfHH8Cn72MZ%B19KB2KZ8LNBNtN>BO}8iMUFT@2ZOeg
zIo0VqU)Gsh?)+2lWOX}l!O^y$Ym+mc_-!)0u<ML?V9Blc-mtBC&31d3W2H}+_st47
zSo!8PoB3JMlBZuTtvP(H>Ca_;8-rUqM^}7kX7=(~dap{9?W!DC!lk)$X00#?<daF|
z3yWSLp1^kHlNtZ+<L<Q+o+LAVn0Qe1`OMGt=UCru>P_`2uw~E*o>P|{AL8)a$wl+I
z^Yf=?&w7Zu@^^03*V{V3@&39=C;9AS6{hcZW48MuYPP{>f7jY8`_`m?l>NFX|J}>W
zs&)1M<HPJ_v^MVk`@Frz%*>!*_CxJ!%JZ-G*y&uI-Q@V8H2Ao^QZ857+o=r<si_+$
zGchwVFfLX!kT;M8MzJg(ix`VY>h&!T)Lp9>BJ|f@<xbHp@A$szD{>$L(-trg85yKc
zWSce1YM95!*M2+JvS9zI1McUKniN!>&wgdnvX7%`#xvWuvXAoFZY!^LTzmDt?4&Pq
zS^w6&+vnB3<Kw?C(Uo`Bes{4==cuxtcs;7pW!m+9e2ynl9=9LX5L|u7?CXX#d-cU+
z^A-lFM!m^jt56svopyzHndkOW=OZoL-fQ-Xl|^W?w?6vlA}W`D(MGs9O7|KY_rlAZ
zb?-ZV9_Cvj;QlH#_Us4CSNf4M9D9DAi9WeoUqP~Q`c}o=2}>+FavZe+Hy)N+-1FmY
z`h|CIf*7@)$X(iEQhcY*L}jI4`P#pm%Xtq~9Z3ClMsTj=sz~9(bJxZvK074w;psw8
i$F1+@P2@41^Um9F1>-ph;maAXGcx@a=o~s4V+sJO#ADR}


From e8e141b21f3a07797958c74053762048c7a3a0bf Mon Sep 17 00:00:00 2001
From: lchqlchq <40992591+lchqlchq@users.noreply.github.com>
Date: Fri, 31 Oct 2025 04:21:09 +0800
Subject: [PATCH 555/591] ZOOKEEPER-4736: Fix nio socket fd leak if network
 service is down

Reviewers: kezhuw, anmolnar
Author: lchqlchq
Closes #2047 from lchqlchq/fd
---
 .../java/org/apache/zookeeper/ClientCnxn.java | 13 ++++-
 .../apache/zookeeper/ClientCnxnSocketNIO.java |  6 +++
 .../ClientCnxnSocketFragilityTest.java        | 46 ++++++++++++++++++
 .../apache/zookeeper/common/BusyServer.java   | 48 +++++++++++++++++++
 .../zookeeper/test/SessionTimeoutTest.java    | 27 +----------
 5 files changed, 113 insertions(+), 27 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index ed03359f7fe..7663e27f68a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -1289,6 +1289,17 @@ public void run() {
                 "SendThread exited loop for session: 0x" + Long.toHexString(getSessionId()));
         }
 
+        private void abortConnection() {
+            try {
+                clientCnxnSocket.testableCloseSocket();
+            } catch (IOException e) {
+                LOG.debug("Fail to close ongoing socket", e);
+            }
+        }
+
+        /**
+         * This is not thread-safe and should only be called inside {@link SendThread}.
+         */
         private void cleanAndNotifyState() {
             cleanup();
             if (state.isAlive()) {
@@ -1531,7 +1542,7 @@ public ReplyHeader submitRequest(
             }
         }
         if (r.getErr() == Code.REQUESTTIMEOUT.intValue()) {
-            sendThread.cleanAndNotifyState();
+            sendThread.abortConnection();
         }
         return r;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
index ea58b857e7d..e39bee11825 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
@@ -209,6 +209,12 @@ void cleanup() {
             } catch (IOException e) {
                 LOG.debug("Ignoring exception during channel close", e);
             }
+            try {
+                selector.wakeup();
+                selector.selectNow();
+            } catch (IOException e) {
+                LOG.debug("Ignoring exception during selecting of cancelled socket", e);
+            }
         }
         try {
             Thread.sleep(100);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 54426f0b6e2..2b70a599d6a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -18,20 +18,32 @@
 
 package org.apache.zookeeper;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.lessThanOrEqualTo;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.spy;
 import java.io.IOException;
 import java.net.InetSocketAddress;
+import java.net.SocketException;
+import java.nio.channels.Selector;
+import java.nio.channels.SocketChannel;
+import java.time.Duration;
 import java.util.Queue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
 import org.apache.zookeeper.ClientCnxn.Packet;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.BusyServer;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
@@ -75,6 +87,40 @@ private void closeZookeeper(ZooKeeper zk) {
         });
     }
 
+    @Test
+    public void testSocketClosedAfterFailure() throws Exception {
+        Duration sessionTimeout = Duration.ofMillis(1000);
+        final AtomicReference<Selector> nioSelector = new AtomicReference<>();
+        try (
+                // given: busy server
+                BusyServer server = new BusyServer();
+                ZooKeeper zk = new ZooKeeper(server.getHostPort(), (int) sessionTimeout.toMillis(), null) {
+                @Override
+                ClientCnxn createConnection(HostProvider hostProvider, int sessionTimeout, ZKClientConfig clientConfig, Watcher defaultWatcher, ClientCnxnSocket clientCnxnSocket, long sessionId, byte[] sessionPasswd, boolean canBeReadOnly) throws IOException {
+                    ClientCnxnSocketNIO socket = spy((ClientCnxnSocketNIO) clientCnxnSocket);
+
+                    doAnswer(mock -> {
+                        SocketChannel spy = spy((SocketChannel) mock.callRealMethod());
+                        // when: connect get exception
+                        //
+                        // this could happen if system's network service is unavailable,
+                        // for examples, "ifdown eth0" or "service network stop" and so on.
+                        doThrow(new SocketException("Network is unreachable")).when(spy).connect(any());
+                        return spy;
+                    }).when(socket).createSock();
+
+                    nioSelector.set(socket.getSelector());
+                    return super.createConnection(hostProvider, sessionTimeout, clientConfig, defaultWatcher, socket, sessionId, sessionPasswd, canBeReadOnly);
+                }
+            }) {
+
+            Thread.sleep(sessionTimeout.toMillis() * 5);
+
+            // then: sockets of failed connections are closed, so at most one registered socket
+            assertThat(nioSelector.get().keys().size(), lessThanOrEqualTo(1));
+        }
+    }
+
     @Test
     public void testClientCnxnSocketFragility() throws Exception {
         System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET,
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java
new file mode 100644
index 00000000000..c2eece3d242
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.Socket;
+
+public class BusyServer implements AutoCloseable {
+    private final ServerSocket server;
+    private final Socket client;
+
+    public BusyServer() throws IOException {
+        this.server = new ServerSocket(0, 1, InetAddress.getByName("127.0.0.1"));
+        this.client = new Socket("127.0.0.1", server.getLocalPort());
+    }
+
+    public int getLocalPort() {
+        return server.getLocalPort();
+    }
+
+    public String getHostPort() {
+        return String.format("127.0.0.1:%d", getLocalPort());
+    }
+
+    @Override
+    public void close() throws Exception {
+        client.close();
+        server.close();
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
index 9f5943f6821..86659ba70d7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
@@ -27,8 +27,6 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
-import java.net.ServerSocket;
-import java.net.Socket;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.CompletableFuture;
@@ -42,6 +40,7 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.BusyServer;
 import org.apache.zookeeper.common.Time;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -75,30 +74,6 @@ public synchronized void process(WatchedEvent event) {
         }
     }
 
-    private static class BusyServer implements AutoCloseable {
-        private final ServerSocket server;
-        private final Socket client;
-
-        public BusyServer() throws IOException {
-            this.server = new ServerSocket(0, 1);
-            this.client = new Socket("127.0.0.1", server.getLocalPort());
-        }
-
-        public int getLocalPort() {
-            return server.getLocalPort();
-        }
-
-        public String getHostPort() {
-            return String.format("127.0.0.1:%d", getLocalPort());
-        }
-
-        @Override
-        public void close() throws Exception {
-            client.close();
-            server.close();
-        }
-    }
-
     @Test
     public void testSessionExpiration() throws InterruptedException, KeeperException {
         final CountDownLatch expirationLatch = new CountDownLatch(1);

From fb43500ea53fa5b57b6dc549c6582ae0ac60d7bc Mon Sep 17 00:00:00 2001
From: jmalopoy <107631972+jmalopoy@users.noreply.github.com>
Date: Mon, 10 Nov 2025 14:19:53 +0100
Subject: [PATCH 556/591] ZOOKEEPER-4989: Fix c client compilation on Windows
 with MSVC

Reviewers: kezhuw
Author: jmalopoy
Closes #2335 from jmalopoy/zookeeper-4989
---
 zookeeper-client/zookeeper-client-c/src/zookeeper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 645510b14a4..cdd9d74a537 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -5131,7 +5131,11 @@ int zoo_add_auth(zhandle_t *zh,const char* scheme,const char* cert,
 
 static const char* format_endpoint_info(const struct sockaddr_storage* ep)
 {
+#if defined(_MSC_VER)
+    static __declspec(thread) char buf[134] = { 0 };
+#else
     static __thread char buf[134] = { 0 };
+#endif
     char addrstr[INET6_ADDRSTRLEN] = { 0 };
     const char *fmtstring;
     void *inaddr;

From 10835cb80665a85c6c9d1c6a085e22a32b067077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Mon, 1 Dec 2025 15:06:49 -0600
Subject: [PATCH 557/591] ZOOKEEPER-2858: Disable reverse DNS lookup for SASL
 java client

Author: anmolnar
Closes #2331 from anmolnar/ZOOKEEPER-2858
---
 .../markdown/zookeeperProgrammers.md          |  5 +++
 .../apache/zookeeper/SaslServerPrincipal.java | 13 +++++--
 .../zookeeper/client/ZKClientConfig.java      |  3 ++
 .../zookeeper/ClientCanonicalizeTest.java     | 37 +++++++++++++++++++
 4 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 92fbe40cf72..620f0f50818 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1315,6 +1315,11 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     the fully qualified domain name belonging to the address. You can disable this 'canonicalization'
     by setting: zookeeper.sasl.client.canonicalize.hostname=false
 
+* *zookeeper.sasl.client.allowReverseDnsLookup* :
+    **New in 3.9.5:**
+    Controls whether reverse DNS lookup is enabled when constructing the server principal for the SASL client.
+    Default: false
+
 * *zookeeper.server.realm* :
     Realm part of the server principal. By default it is the client principal realm.
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java b/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java
index 879955414e0..3262011ba41 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java
@@ -38,7 +38,7 @@ public class SaslServerPrincipal {
      * @return the name of the principal.
      */
     static String getServerPrincipal(InetSocketAddress addr, ZKClientConfig clientConfig) {
-        return getServerPrincipal(new WrapperInetSocketAddress(addr), clientConfig);
+        return getServerPrincipal(new WrapperInetSocketAddress(addr, clientConfig), clientConfig);
     }
 
     /**
@@ -96,13 +96,20 @@ static String getServerPrincipal(WrapperInetSocketAddress addr, ZKClientConfig c
     static class WrapperInetSocketAddress {
 
         private final InetSocketAddress addr;
+        private final ZKClientConfig clientConfig;
 
-        WrapperInetSocketAddress(InetSocketAddress addr) {
+        WrapperInetSocketAddress(InetSocketAddress addr, ZKClientConfig clientConfig) {
             this.addr = addr;
+            this.clientConfig = clientConfig;
         }
 
         public String getHostName() {
-            return addr.getHostName();
+            if (clientConfig.getBoolean(ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS,
+                                        ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS_DEFAULT)) {
+                return addr.getHostName();
+            } else {
+                return addr.getHostString();
+            }
         }
 
         public WrapperInetAddress getAddress() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index f1552a688ee..8ef00ac431d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -60,6 +60,8 @@ public class ZKClientConfig extends ZKConfig {
      * Feature is disabled by default.
      */
     public static final long ZOOKEEPER_REQUEST_TIMEOUT_DEFAULT = 0;
+    public static final String ZK_SASL_CLIENT_ALLOW_REVERSE_DNS = "zookeeper.sasl.client.allowReverseDnsLookup";
+    public static final boolean ZK_SASL_CLIENT_ALLOW_REVERSE_DNS_DEFAULT = false;
 
     public ZKClientConfig() {
         super();
@@ -120,6 +122,7 @@ protected void handleBackwardCompatibility() {
         setProperty(DISABLE_AUTO_WATCH_RESET, System.getProperty(DISABLE_AUTO_WATCH_RESET));
         setProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET, System.getProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET));
         setProperty(SECURE_CLIENT, System.getProperty(SECURE_CLIENT));
+        setProperty(ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, System.getProperty(ZK_SASL_CLIENT_ALLOW_REVERSE_DNS));
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
index cca6647b1cb..d94b7e62233 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
@@ -19,6 +19,8 @@
 package org.apache.zookeeper;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.IOException;
@@ -85,4 +87,39 @@ public void testGetServerPrincipalReturnConfiguredPrincipalName() {
         assertEquals(configuredPrincipal, serverPrincipal);
     }
 
+    @Test
+    public void testAllowReverseDnsLookupDisabled() {
+        // Arrange
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty(ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, "false");
+        InetSocketAddress addr = mock(InetSocketAddress.class);
+        SaslServerPrincipal.WrapperInetSocketAddress ia = new SaslServerPrincipal.WrapperInetSocketAddress(addr, config);
+        doReturn("this-is-the-right-hostname").when(addr).getHostString();
+        doThrow(new UnsupportedOperationException("getHostName() should not be called when reverse DNS is disabled"))
+            .when(addr).getHostName();
+
+        // Act
+        String hostname = ia.getHostName();
+
+        // Assert
+        assertEquals("this-is-the-right-hostname", hostname);
+    }
+
+    @Test
+    public void testAllowReverseDnsLookupEnabled() {
+        // Arrange
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty(ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, "true");
+        InetSocketAddress addr = mock(InetSocketAddress.class);
+        SaslServerPrincipal.WrapperInetSocketAddress ia = new SaslServerPrincipal.WrapperInetSocketAddress(addr, config);
+        doReturn("this-is-the-right-hostname").when(addr).getHostName();
+        doThrow(new UnsupportedOperationException("getHostString() should not be called when reverse DNS is enabled"))
+            .when(addr).getHostString();
+
+        // Act
+        String hostname = ia.getHostName();
+
+        // Assert
+        assertEquals("this-is-the-right-hostname", hostname);
+    }
 }

From 229721e98d562f1d3a74e9f8212155483dce269f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Wed, 3 Dec 2025 16:07:09 -0600
Subject: [PATCH 558/591] ZOOKEEPER-3100: ZooKeeper client times out due to
 random choice of resolved addresses

Reviewers: kezhuw
Author: anmolnar
Closes #2338 from anmolnar/ZOOKEEPER-3100
---
 .../markdown/zookeeperProgrammers.md          | 16 ++++++++
 .../java/org/apache/zookeeper/ZooKeeper.java  |  2 +-
 .../zookeeper/client/StaticHostProvider.java  | 32 ++++++++++++++-
 .../zookeeper/client/ZKClientConfig.java      | 15 +++++++
 .../test/StaticHostProviderTest.java          | 40 +++++++++++++++++++
 5 files changed, 103 insertions(+), 2 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 620f0f50818..59008215c57 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1381,6 +1381,22 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *zookeeper.kinit* :
     Specifies path to kinit binary. Default is "/usr/bin/kinit".
 
+* *zookeeper.shuffleDnsResponse* :
+  **New in 3.10.0:**
+  Specifies whether ZooKeeper client should randomly pick an IP address from the DNS lookup query result when resolving 
+  server addresses or not. This is a feature flag in order to keep the old behavior of the default DNS resolver in 
+  `StaticHostProvider`, because we disabled it by default. The reason behind that is shuffling the response of DNS queries 
+  shadows JVM network property `java.net.preferIPv6Addresses` (default: false). This property controls whether JVM's built-in 
+  resolver should prioritize v4 (false value) or v6 (true value) addresses when putting together the list of IP addresses 
+  in the result. In other words the above Java system property was completely ineffective in the case of ZooKeeper server host 
+  resolution protocol and this must have been fixed. In a dual stack environment one might want to prefer one stack over 
+  the other which, in case of Java processes, should be controlled by JVM network properties and ZooKeeper must honor 
+  these settings. Since the old behavior has been with us since day zero, we introduced this feature flag in case you 
+  need it. Such case could be when you have a buggy DNS server which responds IP addresses always in the same order and 
+  you want to randomize that.
+  Default: false
+
+
 <a name="C+Binding"></a>
 
 ### C Binding
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 8831c0622bb..b3b5af45472 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -1140,7 +1140,7 @@ public ZooKeeper(ZooKeeperOptions options) throws IOException {
         if (options.getHostProvider() != null) {
             hostProvider = options.getHostProvider().apply(connectStringParser.getServerAddresses());
         } else {
-            hostProvider = new StaticHostProvider(connectStringParser.getServerAddresses());
+            hostProvider = new StaticHostProvider(connectStringParser.getServerAddresses(), clientConfig);
         }
         this.hostProvider = hostProvider;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
index bfd771943e2..e07754c3558 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
@@ -50,6 +50,8 @@ public interface Resolver {
 
     private static final Logger LOG = LoggerFactory.getLogger(StaticHostProvider.class);
 
+    private ZKClientConfig clientConfig = null;
+
     private List<InetSocketAddress> serverAddresses = new ArrayList<>(5);
 
     private Random sourceOfRandomness;
@@ -90,6 +92,26 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
         });
     }
 
+    /**
+     * Constructs a SimpleHostSet with ZKClientConfig.
+     *
+     * Introduced this new overload in 3.10.0 in order to take advantage of some newly introduced feature flags. Like
+     * the shuffle (old) / not to shuffle (new) behavior of DNS resolution.
+     *
+     * @param serverAddresses
+     *            possibly unresolved ZooKeeper server addresses
+     * @param clientConfig
+     *            ZooKeeper client configuration
+     */
+    public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, ZKClientConfig clientConfig) {
+        init(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), new Resolver() {
+            @Override
+            public InetAddress[] getAllByName(String name) throws UnknownHostException {
+                return InetAddress.getAllByName(name);
+            }
+        }, clientConfig);
+    }
+
     /**
      * Constructs a SimpleHostSet.
      *
@@ -125,6 +147,12 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
     }
 
     private void init(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, Resolver resolver) {
+        init(serverAddresses, randomnessSeed, resolver, null);
+    }
+
+    private void init(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, Resolver resolver,
+                      ZKClientConfig clientConfig) {
+        this.clientConfig = clientConfig == null ? new ZKClientConfig() : clientConfig;
         this.sourceOfRandomness = new Random(randomnessSeed);
         this.resolver = resolver;
         if (serverAddresses.isEmpty()) {
@@ -142,7 +170,9 @@ private InetSocketAddress resolve(InetSocketAddress address) {
             if (resolvedAddresses.isEmpty()) {
                 return address;
             }
-            Collections.shuffle(resolvedAddresses);
+            if (clientConfig.isShuffleDnsResponseEnabled()) {
+                Collections.shuffle(resolvedAddresses);
+            }
             return new InetSocketAddress(resolvedAddresses.get(0), address.getPort());
         } catch (UnknownHostException e) {
             LOG.error("Unable to resolve address: {}", address.toString(), e);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index 8ef00ac431d..5472838bdef 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -62,6 +62,13 @@ public class ZKClientConfig extends ZKConfig {
     public static final long ZOOKEEPER_REQUEST_TIMEOUT_DEFAULT = 0;
     public static final String ZK_SASL_CLIENT_ALLOW_REVERSE_DNS = "zookeeper.sasl.client.allowReverseDnsLookup";
     public static final boolean ZK_SASL_CLIENT_ALLOW_REVERSE_DNS_DEFAULT = false;
+    /**
+     * True value preserves the old behavior is to shuffle the addresses in DNS response regardless of address type.
+     * This could help with buggy DNS servers which always return addresses in the same order, but at the same time
+     * ignores the JVM option java.net.preferIPv6Addresses.
+     */
+    public static final String ZOOKEEPER_SHUFFLE_DNS_RESPONSE = "zookeeper.shuffleDnsResponse";
+    public static final boolean ZOOKEEPER_SHUFFLE_DNS_RESPONSE_DEFAULT = false;
 
     public ZKClientConfig() {
         super();
@@ -137,6 +144,14 @@ public boolean isSaslClientEnabled() {
         return Boolean.valueOf(getProperty(ENABLE_CLIENT_SASL_KEY, ENABLE_CLIENT_SASL_DEFAULT));
     }
 
+    /**
+     * Return true if we need to use the old behavior of default DNS resolver and always shuffle the IP addresses
+     * in the DNS lookup response in order to pick a completely random IP address.
+     */
+    public boolean isShuffleDnsResponseEnabled() {
+        return getBoolean(ZOOKEEPER_SHUFFLE_DNS_RESPONSE, ZOOKEEPER_SHUFFLE_DNS_RESPONSE_DEFAULT);
+    }
+
     /**
      * Get the value of the <code>key</code> property as an <code>long</code>.
      * If property is not set, the provided <code>defaultValue</code> is
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
index 2289847d4e4..7ab20751960 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
@@ -30,9 +30,12 @@
 import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import java.net.Inet4Address;
+import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -115,6 +118,7 @@ public void testNextDoesNotSleepForZero() {
         assertTrue(5 > stop - start);
     }
 
+
     @Test
     public void testEmptyServerAddressesList() {
         assertThrows(IllegalArgumentException.class, () -> {
@@ -888,6 +892,42 @@ public void testReResolvingLocalhost() {
                         + hostProvider.size() + " (after), " + sizeBefore + " (before)");
     }
 
+    @Test
+    public void testResolverKeepsResolutionOrderPreferV6() {
+        // Arrange
+        Collection<InetSocketAddress> servers = new ArrayList<>();
+        servers.add(InetSocketAddress.createUnresolved("test-server-name", 1111));
+        InetAddress[] resolvedAddresses = new InetAddress[] {
+            mock(Inet6Address.class),
+            mock(Inet4Address.class)
+        };
+        StaticHostProvider staticHostProvider = new StaticHostProvider(servers, name -> resolvedAddresses);
+
+        // Act & Assert
+        for (int i = 0; i < 100; i++) {
+           InetSocketAddress next = staticHostProvider.next(0);
+           assertSame(next.getAddress(), resolvedAddresses[0], "Default resolver should always return the first address");
+        }
+    }
+
+    @Test
+    public void testResolverKeepsResolutionOrderPreferV4() {
+        // Arrange
+        Collection<InetSocketAddress> servers = new ArrayList<>();
+        servers.add(InetSocketAddress.createUnresolved("test-server-name", 1111));
+        InetAddress[] resolvedAddresses = new InetAddress[] {
+            mock(Inet4Address.class),
+            mock(Inet6Address.class)
+        };
+        StaticHostProvider staticHostProvider = new StaticHostProvider(servers, name -> resolvedAddresses);
+
+        // Act & Assert
+        for (int i = 0; i < 100; i++) {
+            InetSocketAddress next = staticHostProvider.next(0);
+            assertSame(next.getAddress(), resolvedAddresses[0], "Default resolver should always return the first address");
+        }
+    }
+
     private StaticHostProvider getHostProviderUnresolved(byte size) {
         return new StaticHostProvider(getUnresolvedServerAddresses(size), r.nextLong());
     }

From 3fc7ccc053b1fb21aa553d9f41f263310a86d550 Mon Sep 17 00:00:00 2001
From: Vasilii Alferov <vasilii.alferov@gmail.com>
Date: Fri, 12 Dec 2025 21:13:00 +0000
Subject: [PATCH 559/591] =?UTF-8?q?ZOOKEEPER-4741:=20Modernize=20Prometheu?=
 =?UTF-8?q?sMetricsProvider=20with=20Jetty=20and=20ne=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewers: anmolnar
Author: dukelion
Closes #2291 from dukelion/ModernPrometheusClient
---
 .../zookeeper-prometheus-metrics/pom.xml      |  49 +-
 .../prometheus/PrometheusMetricsProvider.java | 842 +++++++-----------
 .../prometheus/PrometheusRegistryDumper.java  | 160 ++++
 .../metrics/prometheus/ExportJvmInfoTest.java |   5 +-
 .../PrometheusHttpsMetricsProviderTest.java   |  98 +-
 .../PrometheusMetricsProviderConfigTest.java  |   5 +-
 .../PrometheusMetricsProviderTest.java        | 338 +++----
 .../prometheus/PrometheusMetricsTestBase.java |  31 +-
 .../resources/data/ssl/client_keystore.jks    | Bin 2246 -> 2591 bytes
 .../resources/data/ssl/client_truststore.jks  | Bin 986 -> 1218 bytes
 .../resources/data/ssl/server_keystore.jks    | Bin 2276 -> 2615 bytes
 .../resources/data/ssl/server_truststore.jks  | Bin 958 -> 1186 bytes
 12 files changed, 771 insertions(+), 757 deletions(-)
 create mode 100644 zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index 4b13fa6adfb..ddc4fe22e27 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -32,7 +32,8 @@
   <description>ZooKeeper Prometheus.io Metrics Provider implementation</description>
 
   <properties>
-      <prometheus.version>0.9.0</prometheus.version>
+      <prometheus.version>1.3.10</prometheus.version>
+      <jetty.version>9.4.57.v20241219</jetty.version>
   </properties>
   <dependencies>
     <dependency>
@@ -46,28 +47,56 @@
     </dependency>    
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>simpleclient</artifactId>
+      <artifactId>prometheus-metrics-core</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>simpleclient_hotspot</artifactId>
+      <artifactId>prometheus-metrics-instrumentation-jvm</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>simpleclient_servlet</artifactId>
+      <artifactId>prometheus-metrics-exporter-servlet-javax</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-      <scope>provided</scope>
+      <groupId>io.prometheus</groupId>
+      <artifactId>prometheus-metrics-exporter-httpserver</artifactId>
+      <version>${prometheus.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>io.prometheus</groupId>
+        <artifactId>prometheus-metrics-exposition-formats</artifactId>
+        <version>${prometheus.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>io.prometheus</groupId>
+      <artifactId>prometheus-metrics-config</artifactId>
+      <version>${prometheus.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-server</artifactId>
+        <version>${jetty.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-servlet</artifactId>
+        <version>${jetty.version}</version>
+    </dependency>
+    <!-- You likely don't need this, but if you do, here's the correct syntax -->
+    <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-util</artifactId>
+        <version>${jetty.version}</version>
+        <!-- You could add a scope here if needed, e.g., <scope>provided</scope> -->
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
-      <scope>provided</scope>
+        <groupId>javax.servlet</groupId>
+        <artifactId>javax.servlet-api</artifactId>
+        <version>3.1.0</version>
+        <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>ch.qos.logback</groupId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index 76739787c8b..1fbb34169c7 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -7,7 +7,7 @@
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -18,25 +18,16 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
-import io.prometheus.client.Collector;
-import io.prometheus.client.CollectorRegistry;
-import io.prometheus.client.exporter.MetricsServlet;
-import io.prometheus.client.hotspot.DefaultExports;
+import io.prometheus.metrics.core.metrics.GaugeWithCallback;
+import io.prometheus.metrics.exporter.servlet.javax.PrometheusMetricsServlet;
+import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
+import io.prometheus.metrics.model.registry.PrometheusRegistry;
 import java.io.IOException;
-import java.util.Enumeration;
+import java.util.Map;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.Properties;
-import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.LinkedBlockingQueue;
-import java.util.concurrent.RejectedExecutionHandler;
-import java.util.concurrent.ThreadFactory;
-import java.util.concurrent.ThreadPoolExecutor;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.BiConsumer;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -46,699 +37,494 @@
 import org.apache.zookeeper.metrics.Gauge;
 import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
+import org.apache.zookeeper.metrics.MetricsContext.DetailLevel;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
-import org.apache.zookeeper.server.RateLogger;
-import org.eclipse.jetty.security.ConstraintMapping;
-import org.eclipse.jetty.security.ConstraintSecurityHandler;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
-import org.eclipse.jetty.util.security.Constraint;
 import org.eclipse.jetty.util.ssl.KeyStoreScanner;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.eclipse.jetty.util.thread.QueuedThreadPool;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  * A Metrics Provider implementation based on https://prometheus.io.
- *
+ * This implementation uses prometheus-metrics-core interfaces and exposes metrics via an embedded Jetty server
  * @since 3.6.0
  */
 public class PrometheusMetricsProvider implements MetricsProvider {
 
     private static final Logger LOG = LoggerFactory.getLogger(PrometheusMetricsProvider.class);
     private static final String LABEL = "key";
-    private static final String[] LABELS = {LABEL};
-
-    /**
-     * Number of worker threads for reporting Prometheus summary metrics.
-     * Default value is 1.
-     * If the number is less than 1, the main thread will be used.
-     */
-    static final String NUM_WORKER_THREADS = "numWorkerThreads";
-
-    /**
-     * The max queue size for Prometheus summary metrics reporting task.
-     * Default value is 10000.
-     */
-    static final String MAX_QUEUE_SIZE = "maxQueueSize";
-
-    /**
-     * The timeout in ms for Prometheus worker threads shutdown.
-     * Default value is 1000ms.
-     */
-    static final String WORKER_SHUTDOWN_TIMEOUT_MS = "workerShutdownTimeoutMs";
 
-    /**
-     * We are using the 'defaultRegistry'.
-     * <p>
-     * When you are running ZooKeeper (server or client) together with other
-     * libraries every metrics will be expected as a single view.
-     * </p>
-     */
-    private final CollectorRegistry collectorRegistry = CollectorRegistry.defaultRegistry;
-    private final RateLogger rateLogger = new RateLogger(LOG, 60 * 1000);
-    private String host = "0.0.0.0";
+    private final PrometheusRegistry registry = PrometheusRegistry.defaultRegistry;
     private int httpPort = -1;
     private int httpsPort = -1;
     private boolean exportJvmInfo = true;
-    private Server server;
-    private final MetricsServletImpl servlet = new MetricsServletImpl();
     private final Context rootContext = new Context();
-    private int numWorkerThreads = 1;
-    private int maxQueueSize = 10000;
-    private long workerShutdownTimeoutMs = 1000;
-    private Optional<ExecutorService> executorOptional = Optional.empty();
+    private PrometheusRegistryDumper dumper;
+    private CustomPrometheusMetricsServlet servlet;
 
-    // Constants for SSL configuration
-    public static final int SCAN_INTERVAL = 60 * 10; // 10 minutes
+    private Server server;
+    private int numWorkerThreads;
+    private String host;
+
+    // SSL Configuration fields
+    private String keyStorePath;
+    private String keyStorePassword;
+    private String keyStoreType;
+    private String trustStorePath;
+    private String trustStorePassword;
+    private String trustStoreType;
+    private boolean needClientAuth = true; // Secure default
+    private boolean wantClientAuth = true; // Secure default
+
+    // Constants for configuration
+    public static final String NUM_WORKER_THREADS = "numWorkerThreads";
     public static final String SSL_KEYSTORE_LOCATION = "ssl.keyStore.location";
     public static final String SSL_KEYSTORE_PASSWORD = "ssl.keyStore.password";
     public static final String SSL_KEYSTORE_TYPE = "ssl.keyStore.type";
     public static final String SSL_TRUSTSTORE_LOCATION = "ssl.trustStore.location";
     public static final String SSL_TRUSTSTORE_PASSWORD = "ssl.trustStore.password";
     public static final String SSL_TRUSTSTORE_TYPE = "ssl.trustStore.type";
-    public static final String SSL_X509_CN = "ssl.x509.cn";
-    public static final String SSL_X509_REGEX_CN = "ssl.x509.cn.regex";
     public static final String SSL_NEED_CLIENT_AUTH = "ssl.need.client.auth";
     public static final String SSL_WANT_CLIENT_AUTH = "ssl.want.client.auth";
+    public static final int SCAN_INTERVAL = 60 * 10; // 10 minutes
 
-    private String keyStorePath;
-    private String keyStorePassword;
-    private String keyStoreType;
-    private String trustStorePath;
-    private String trustStorePassword;
-    private String trustStoreType;
-    private boolean needClientAuth = true;
-    private boolean wantClientAuth = true;
+    /**
+     * Custom servlet to disable the TRACE method for security reasons.
+     */
+    private static class CustomPrometheusMetricsServlet extends PrometheusMetricsServlet {
+        public CustomPrometheusMetricsServlet(PrometheusRegistry registry) {
+            super(registry);
+        }
+
+        @Override
+        protected void doTrace(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+            resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+        }
+    }
 
     @Override
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
-        LOG.info("Initializing metrics, configuration: {}", configuration);
+        LOG.info("Initializing Prometheus metrics with Jetty, configuration: {}", configuration);
+
         this.host = configuration.getProperty("httpHost", "0.0.0.0");
-        if (configuration.containsKey("httpsPort")) {
-            this.httpsPort = Integer.parseInt(configuration.getProperty("httpsPort"));
+        this.httpPort = Integer.parseInt(configuration.getProperty("httpPort", "-1"));
+        this.httpsPort = Integer.parseInt(configuration.getProperty("httpsPort", "-1"));
+        this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
+        this.numWorkerThreads = Integer.parseInt(configuration.getProperty(NUM_WORKER_THREADS, "10"));
+
+        // If httpsPort is specified, parse all SSL properties
+        if (this.httpsPort != -1) {
             this.keyStorePath = configuration.getProperty(SSL_KEYSTORE_LOCATION);
             this.keyStorePassword = configuration.getProperty(SSL_KEYSTORE_PASSWORD);
-            this.keyStoreType = configuration.getProperty(SSL_KEYSTORE_TYPE);
+            this.keyStoreType = configuration.getProperty(SSL_KEYSTORE_TYPE, "PKCS12");
             this.trustStorePath = configuration.getProperty(SSL_TRUSTSTORE_LOCATION);
             this.trustStorePassword = configuration.getProperty(SSL_TRUSTSTORE_PASSWORD);
-            this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE);
+            this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE, "PKCS12");
             this.needClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_NEED_CLIENT_AUTH, "true"));
             this.wantClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_WANT_CLIENT_AUTH, "true"));
-            //check if httpPort is also configured
-            this.httpPort = Integer.parseInt(configuration.getProperty("httpPort", "-1"));
-        } else {
-            // Use the default HTTP port (7000) or the configured port if HTTPS is not set.
-            this.httpPort = Integer.parseInt(configuration.getProperty("httpPort", "7000"));
         }
-        this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
-        this.numWorkerThreads = Integer.parseInt(
-                configuration.getProperty(NUM_WORKER_THREADS, "1"));
-        this.maxQueueSize = Integer.parseInt(
-                configuration.getProperty(MAX_QUEUE_SIZE, "10000"));
-        this.workerShutdownTimeoutMs = Long.parseLong(
-                configuration.getProperty(WORKER_SHUTDOWN_TIMEOUT_MS, "1000"));
+
+        // Validate that at least one port is configured.
+        if (httpPort == -1 && httpsPort == -1) {
+            throw new MetricsProviderLifeCycleException(
+                    "Either httpPort or httpsPort must be configured for Prometheus exporter.");
+        }
+
+        this.dumper = new PrometheusRegistryDumper(this.registry);
+        this.servlet = new CustomPrometheusMetricsServlet(this.registry);
     }
 
     @Override
     public void start() throws MetricsProviderLifeCycleException {
-        this.executorOptional = createExecutor();
+        // Register JVM metrics if enabled
+        if (exportJvmInfo) {
+            JvmMetrics.builder().register(this.registry);
+        }
         try {
-            LOG.info("Starting /metrics endpoint at HTTP port: {}, HTTPS port: {}, exportJvmInfo: {}",
-                    httpPort >= 0 ? httpPort : "disabled",
-                    httpsPort >= 0 ? httpsPort : "disabled",
-                    exportJvmInfo);
-            if (exportJvmInfo) {
-                DefaultExports.initialize();
-            }
-            server = new Server();
-            ServerConnector httpConnector = null;
-            ServerConnector httpsConnector = null;
-            if (httpPort >= 0) {
-                httpConnector = new ServerConnector(server);
-                httpConnector.setHost(host);
-                httpConnector.setPort(httpPort);
+            LOG.info("Starting Prometheus Jetty server...");
+
+            // QueuedThreadPool needs a minimum of 4 threads for stable operation
+            QueuedThreadPool threadPool = new QueuedThreadPool(Math.max(this.numWorkerThreads + 3, 4));
+            threadPool.setReservedThreads(0);
+            threadPool.setName("prometheus-jetty-server");
+
+            this.server = new Server(threadPool);
+
+            // Define number of acceptors and selectors for connectors
+            int acceptors = 1;
+            int selectors = 1;
+
+            // Configure HTTP connector if enabled
+            if (this.httpPort != -1) {
+                ServerConnector httpConnector = new ServerConnector(server, acceptors, selectors);
+                httpConnector.setPort(this.httpPort);
+                httpConnector.setHost(this.host);
                 server.addConnector(httpConnector);
             }
-            if (httpsPort >= 0) {
-                SslContextFactory sslServerContextFactory = new SslContextFactory.Server();
-                configureSslContextFactory(sslServerContextFactory);
-                KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslServerContextFactory);
+
+            // Configure HTTPS connector if enabled
+            if (this.httpsPort != -1) {
+                SslContextFactory.Server sslContextFactory = createSslContextFactory();
+                KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslContextFactory);
                 keystoreScanner.setScanInterval(SCAN_INTERVAL);
                 server.addBean(keystoreScanner);
-                httpsConnector = new ServerConnector(server, sslServerContextFactory);
-                httpsConnector.setHost(host);
-                httpsConnector.setPort(httpsPort);
-                server.addConnector(httpsConnector);
+                server.addConnector(createSslConnector(server, acceptors, selectors, sslContextFactory));
             }
+
+            // Set up the servlet context handler
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
-            constrainTraceMethod(context);
             server.setHandler(context);
             context.addServlet(new ServletHolder(servlet), "/metrics");
+
             server.start();
-            if (httpPort == 0) {
-                LOG.info("Bound /metrics endpoint to HTTP port: {}", httpConnector.getLocalPort());
-            }
-            if (httpsPort == 0) {
-                LOG.info("Bound /metrics endpoint to HTTPS port: {}", httpsConnector.getLocalPort());
-            }
-        } catch (Exception err) {
-            LOG.error("Cannot start /metrics server", err);
-            if (server != null) {
-                try {
-                    server.stop();
-                } catch (Exception suppressed) {
-                    err.addSuppressed(suppressed);
-                } finally {
-                    server = null;
-                }
-            }
-            throw new MetricsProviderLifeCycleException(err);
+
+            LOG.info("Prometheus metrics provider with Jetty started. HTTP port: {}, HTTPS port: {}",
+                    httpPort != -1 ? httpPort : "disabled", httpsPort != -1 ? httpsPort : "disabled");
+
+        } catch (Exception e) {
+            LOG.error("Failed to start Prometheus Jetty server", e);
+            // Ensure server is stopped on startup failure
+            stop();
+            throw new MetricsProviderLifeCycleException("Failed to start Prometheus Jetty server", e);
         }
     }
 
-    @SuppressWarnings("deprecation")
-    private void configureSslContextFactory(SslContextFactory sslServerContextFactory) {
-        if (keyStorePath != null) {
-            sslServerContextFactory.setKeyStorePath(keyStorePath);
-        } else {
-            LOG.error("KeyStore configuration is incomplete keyStorePath: {}", keyStorePath);
-            throw new IllegalStateException("KeyStore configuration is incomplete keyStorePath: " + keyStorePath);
-        }
-        if (keyStorePassword != null) {
-            sslServerContextFactory.setKeyStorePassword(keyStorePassword);
-        } else {
-            LOG.error("keyStorePassword configuration is incomplete ");
-            throw new IllegalStateException("keyStorePassword configuration is incomplete ");
-        }
-        if (keyStoreType != null) {
-            sslServerContextFactory.setKeyStoreType(keyStoreType);
+    /**
+     * Creates and configures the SslContextFactory for the server.
+     *
+     * @return A configured SslContextFactory.Server instance.
+     */
+    private SslContextFactory.Server createSslContextFactory() {
+        SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
+
+        // Validate and set KeyStore properties
+        if (this.keyStorePath == null || this.keyStorePath.isEmpty()) {
+            throw new IllegalArgumentException("SSL/TLS is enabled, but '" + SSL_KEYSTORE_LOCATION + "' is not set.");
         }
-        if (trustStorePath != null) {
-            sslServerContextFactory.setTrustStorePath(trustStorePath);
-        } else {
-            LOG.error("TrustStore configuration is incomplete trustStorePath: {}", trustStorePath);
-            throw new IllegalStateException("TrustStore configuration is incomplete trustStorePath: " + trustStorePath);
+        sslContextFactory.setKeyStorePath(this.keyStorePath);
+        sslContextFactory.setKeyStorePassword(this.keyStorePassword);
+        if (this.keyStoreType != null) {
+            sslContextFactory.setKeyStoreType(this.keyStoreType);
         }
-        if (trustStorePassword != null) {
-            sslServerContextFactory.setTrustStorePassword(trustStorePassword);
-        } else {
-            LOG.error("trustStorePassword configuration is incomplete");
-            throw new IllegalStateException("trustStorePassword configuration is incomplete");
+
+        // Validate and set TrustStore properties (often needed for client auth)
+        if (this.needClientAuth && (this.trustStorePath == null || this.trustStorePath.isEmpty())) {
+            throw new IllegalArgumentException(
+                    "'" + SSL_NEED_CLIENT_AUTH + "' is true, but '" + SSL_TRUSTSTORE_LOCATION + "' is not set.");
         }
-        if (trustStoreType != null) {
-            sslServerContextFactory.setTrustStoreType(trustStoreType);
+        if (this.trustStorePath != null) {
+            sslContextFactory.setTrustStorePath(this.trustStorePath);
+            sslContextFactory.setTrustStorePassword(this.trustStorePassword);
+            if (this.trustStoreType != null) {
+                sslContextFactory.setTrustStoreType(this.trustStoreType);
+            }
         }
-        sslServerContextFactory
-                .setNeedClientAuth(needClientAuth);
-        sslServerContextFactory
-                .setWantClientAuth(wantClientAuth);
-    }
 
-    // for tests
-    MetricsServletImpl getServlet() {
-        return servlet;
+        sslContextFactory.setNeedClientAuth(this.needClientAuth);
+        sslContextFactory.setWantClientAuth(this.wantClientAuth);
+
+        return sslContextFactory;
     }
 
-    @Override
-    public MetricsContext getRootContext() {
-        return rootContext;
+    /**
+     * Creates and configures an SSL/TLS connector for the Jetty server.
+     *
+     * @param server
+     *            The server instance.
+     * @param acceptors
+     *            The number of acceptor threads.
+     * @param selectors
+     *            The number of selector threads.
+     * @param sslContextFactory
+     *            The pre-configured SslContextFactory.
+     *
+     * @return A configured ServerConnector for HTTPS.
+     */
+    private ServerConnector createSslConnector(Server server, int acceptors, int selectors,
+            SslContextFactory.Server sslContextFactory) {
+        ServerConnector sslConnector = new ServerConnector(server, acceptors, selectors, sslContextFactory);
+        sslConnector.setPort(this.httpsPort);
+        sslConnector.setHost(this.host);
+        return sslConnector;
     }
 
     @Override
     public void stop() {
-        shutdownExecutor();
         if (server != null) {
             try {
+                LOG.info("Stopping Prometheus Jetty server.");
                 server.stop();
             } catch (Exception err) {
-                LOG.error("Cannot safely stop Jetty server", err);
+                LOG.error("Cannot safely stop Prometheus Jetty server", err);
             } finally {
                 server = null;
             }
         }
+        registry.clear();
     }
 
     /**
-     * Dump all values to the 4lw interface and to the Admin server.
-     * <p>
-     * This method is not expected to be used to serve metrics to Prometheus. We
-     * are using the MetricsServlet provided by Prometheus for that, leaving the
-     * real representation to the Prometheus Java client.
-     * </p>
-     *
-     * @param sink the receiver of data (4lw interface, Admin server or tests)
+     * Returns a Prometheus servlet for integration with existing web applications. This is primarily used for testing
+     * purposes.
      */
-    @Override
-    public void dump(BiConsumer<String, Object> sink) {
-        sampleGauges();
-        Enumeration<Collector.MetricFamilySamples> samplesFamilies = collectorRegistry.metricFamilySamples();
-        while (samplesFamilies.hasMoreElements()) {
-            Collector.MetricFamilySamples samples = samplesFamilies.nextElement();
-            samples.samples.forEach(sample -> {
-                String key = buildKeyForDump(sample);
-                sink.accept(key, sample.value);
-            });
-        }
+    public PrometheusMetricsServlet getServlet() {
+        return this.servlet;
     }
 
-    private static String buildKeyForDump(Collector.MetricFamilySamples.Sample sample) {
-        StringBuilder keyBuilder = new StringBuilder();
-        keyBuilder.append(sample.name);
-        if (sample.labelNames.size() > 0) {
-            keyBuilder.append('{');
-            for (int i = 0; i < sample.labelNames.size(); ++i) {
-                if (i > 0) {
-                    keyBuilder.append(',');
-                }
-                keyBuilder.append(sample.labelNames.get(i));
-                keyBuilder.append("=\"");
-                keyBuilder.append(sample.labelValues.get(i));
-                keyBuilder.append('"');
-            }
-            keyBuilder.append('}');
-        }
-        return keyBuilder.toString();
+    @Override
+    public MetricsContext getRootContext() {
+        return rootContext;
     }
 
-    /**
-     * Update Gauges. In ZooKeeper Metrics API Gauges are callbacks served by
-     * internal components and the value is not held by Prometheus structures.
-     */
-    private void sampleGauges() {
-        rootContext.gauges.values()
-                .forEach(PrometheusGaugeWrapper::sample);
-
-        rootContext.gaugeSets.values()
-                .forEach(PrometheusLabelledGaugeWrapper::sample);
+    @Override
+    public void dump(BiConsumer<String, Object> sink) {
+        dumper.dump().forEach(sink);
     }
 
     @Override
     public void resetAllValues() {
-        // not supported on Prometheus
+        // The new prometheus client does not support resetting metric values.
+        LOG.debug("resetAllValues is a no-op for PrometheusMetricsProvider");
     }
 
     /**
-     * Add constraint to a given context to disallow TRACE method.
-     * @param ctxHandler the context to modify
+     * Inner class implementing the MetricsContext interface. It handles the creation and registration of different
+     * metric types.
      */
-    private void constrainTraceMethod(ServletContextHandler ctxHandler) {
-        Constraint c = new Constraint();
-        c.setAuthenticate(true);
-
-        ConstraintMapping cmt = new ConstraintMapping();
-        cmt.setConstraint(c);
-        cmt.setMethod("TRACE");
-        cmt.setPathSpec("/*");
-
-        ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
-        securityHandler.setConstraintMappings(new ConstraintMapping[] {cmt});
-
-        ctxHandler.setSecurityHandler(securityHandler);
-    }
-
     private class Context implements MetricsContext {
 
-        private final ConcurrentMap<String, PrometheusGaugeWrapper> gauges = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusLabelledGaugeWrapper> gaugeSets = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusCounter> counters = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusLabelledCounter> counterSets = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusSummary> basicSummaries = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusSummary> summaries = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusLabelledSummary> basicSummarySets = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusLabelledSummary> summarySets = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusCounterWrapper> counters =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledCounterWrapper> counterSets =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, GaugeWithCallback> registeredGauges =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusSummaryWrapper> basicSummaries =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusSummaryWrapper> advancedSummaries =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledSummaryWrapper> basicSummarySets =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledSummaryWrapper> advancedSummarySets =
+            new ConcurrentHashMap<>();
 
         @Override
         public MetricsContext getContext(String name) {
-            // no hierarchy yet
+            // This provider uses a flat namespace, so sub-contexts are not needed.
             return this;
         }
 
         @Override
         public Counter getCounter(String name) {
-            return counters.computeIfAbsent(name, PrometheusCounter::new);
+            return counters.computeIfAbsent(name, key -> {
+                io.prometheus.metrics.core.metrics.Counter prometheusCounter =
+                        io.prometheus.metrics.core.metrics.Counter
+                        .builder().name(key).help(key + " counter").register(registry);
+                return new PrometheusCounterWrapper(prometheusCounter);
+            });
         }
 
         @Override
-        public CounterSet getCounterSet(final String name) {
-            Objects.requireNonNull(name, "Cannot register a CounterSet with null name");
-            return counterSets.computeIfAbsent(name, PrometheusLabelledCounter::new);
+        public CounterSet getCounterSet(String name) {
+            return counterSets.computeIfAbsent(name, key -> {
+                Objects.requireNonNull(name, "Cannot register a CounterSet with null name");
+                io.prometheus.metrics.core.metrics.Counter prometheusCounter =
+                        io.prometheus.metrics.core.metrics.Counter
+                        .builder().name(key).help(key + " counter set").labelNames(LABEL).register(registry);
+                return new PrometheusLabelledCounterWrapper(prometheusCounter);
+            });
         }
 
-        /**
-         * Gauges may go up and down, in ZooKeeper they are a way to export
-         * internal values with a callback.
-         *
-         * @param name  the name of the gauge
-         * @param gauge the callback
-         */
         @Override
-        public void registerGauge(String name, Gauge gauge) {
-            Objects.requireNonNull(name);
-            gauges.compute(name, (id, prev) ->
-                    new PrometheusGaugeWrapper(id, gauge, prev != null ? prev.inner : null));
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+            Objects.requireNonNull(name, "Cannot register a GaugeSet with null name");
+            Objects.requireNonNull(gaugeSet, "Cannot register a null GaugeSet for " + name);
+
+            GaugeWithCallback oldGauge = registeredGauges.get(name);
+            if (oldGauge != null) {
+                registry.unregister(oldGauge);
+            }
+
+            GaugeWithCallback newGauge = GaugeWithCallback.builder().name(name).help(name).labelNames(LABEL)
+                    .callback(callback -> {
+                        Map<String, Number> values = gaugeSet.values();
+                        if (values != null) {
+                            for (Map.Entry<String, Number> value : values.entrySet()) {
+                                if (value.getKey() == null) {
+                                    throw new IllegalArgumentException("GaugeSet key cannot be null.");
+                                }
+                                callback.call(value.getValue().doubleValue(), value.getKey());
+                            }
+                        }
+                    }).register(registry);
+            registeredGauges.put(name, newGauge);
         }
 
         @Override
-        public void unregisterGauge(String name) {
-            PrometheusGaugeWrapper existing = gauges.remove(name);
-            if (existing != null) {
-                existing.unregister();
+        public void registerGauge(String name, Gauge gauge) {
+            if (name == null) {
+                throw new IllegalArgumentException("Gauge name cannot be null.");
+            }
+            if (gauge == null) {
+                throw new IllegalArgumentException("Cannot register a null Gauge for " + name);
             }
+
+            GaugeWithCallback oldGauge = registeredGauges.get(name);
+            if (oldGauge != null) {
+                registry.unregister(oldGauge);
+            }
+
+            GaugeWithCallback newGauge = GaugeWithCallback.builder().name(name).help(name).callback(callback -> {
+                Number value = gauge.get();
+                if (value != null) {
+                    callback.call(value.doubleValue());
+                }
+            }).register(registry);
+            registeredGauges.put(name, newGauge);
         }
 
         @Override
-        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
-            Objects.requireNonNull(name, "Cannot register a GaugeSet with null name");
-            Objects.requireNonNull(gaugeSet, "Cannot register a null GaugeSet for " + name);
-
-            gaugeSets.compute(name, (id, prev) ->
-                new PrometheusLabelledGaugeWrapper(name, gaugeSet, prev != null ? prev.inner : null));
+        public void unregisterGauge(String name) {
+            GaugeWithCallback gauge = registeredGauges.remove(name);
+            if (gauge != null) {
+                registry.unregister(gauge);
+            }
         }
 
         @Override
         public void unregisterGaugeSet(final String name) {
             Objects.requireNonNull(name, "Cannot unregister GaugeSet with null name");
+            unregisterGauge(name);
+        }
+
+        private io.prometheus.metrics.core.metrics.Summary createPrometheusSummary(String name, DetailLevel detailLevel,
+                String... labelNames) {
+            io.prometheus.metrics.core.metrics.Summary.Builder builder = io.prometheus.metrics.core.metrics.Summary
+                    .builder().name(name).help(name + " summary").quantile(0.5, 0.05); // Median
 
-            final PrometheusLabelledGaugeWrapper existing = gaugeSets.remove(name);
-            if (existing != null) {
-                existing.unregister();
+            if (detailLevel == DetailLevel.ADVANCED) {
+                builder.quantile(0.95, 0.05)   // 95th percentile
+                        .quantile(0.99, 0.05); // 99th percentile
             }
+
+            if (labelNames.length > 0) {
+                builder.labelNames(labelNames);
+            }
+            return builder.register(registry);
         }
 
         @Override
         public Summary getSummary(String name, DetailLevel detailLevel) {
-            if (detailLevel == DetailLevel.BASIC) {
-                return basicSummaries.computeIfAbsent(name, (n) -> {
-                    if (summaries.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a non basic summary as " + n);
-                    }
-                    return new PrometheusSummary(name, detailLevel);
-                });
-            } else {
-                return summaries.computeIfAbsent(name, (n) -> {
-                    if (basicSummaries.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a basic summary as " + n);
-                    }
-                    return new PrometheusSummary(name, detailLevel);
-                });
-            }
+            ConcurrentMap<String, PrometheusSummaryWrapper> map = detailLevel == DetailLevel.BASIC ? basicSummaries
+                    : advancedSummaries;
+            return map.computeIfAbsent(name, key -> {
+                if ((detailLevel == DetailLevel.BASIC && advancedSummaries.containsKey(key))
+                        || (detailLevel == DetailLevel.ADVANCED && basicSummaries.containsKey(key))) {
+                    throw new IllegalArgumentException(
+                            "Already registered a summary as " + key + " with a different detail level");
+                }
+                io.prometheus.metrics.core.metrics.Summary prometheusSummary = createPrometheusSummary(key,
+                        detailLevel);
+                return new PrometheusSummaryWrapper(prometheusSummary);
+            });
         }
 
         @Override
         public SummarySet getSummarySet(String name, DetailLevel detailLevel) {
-            if (detailLevel == DetailLevel.BASIC) {
-                return basicSummarySets.computeIfAbsent(name, (n) -> {
-                    if (summarySets.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a non basic summary set as " + n);
-                    }
-                    return new PrometheusLabelledSummary(name, detailLevel);
-                });
-            } else {
-                return summarySets.computeIfAbsent(name, (n) -> {
-                    if (basicSummarySets.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a basic summary set as " + n);
-                    }
-                    return new PrometheusLabelledSummary(name, detailLevel);
-                });
-            }
+            ConcurrentMap<String, PrometheusLabelledSummaryWrapper> map = detailLevel == DetailLevel.BASIC
+                    ? basicSummarySets : advancedSummarySets;
+            return map.computeIfAbsent(name, key -> {
+                if ((detailLevel == DetailLevel.BASIC && advancedSummarySets.containsKey(key))
+                        || (detailLevel == DetailLevel.ADVANCED && basicSummarySets.containsKey(key))) {
+                    throw new IllegalArgumentException(
+                            "Already registered a summary set as " + key + " with a different detail level");
+                }
+                io.prometheus.metrics.core.metrics.Summary prometheusSummary = createPrometheusSummary(key, detailLevel,
+                        LABEL);
+                return new PrometheusLabelledSummaryWrapper(prometheusSummary);
+            });
         }
-
     }
 
-    private class PrometheusCounter implements Counter {
+    // --- Wrapper classes to adapt Prometheus metrics to ZooKeeper's metric interfaces ---
 
-        private final io.prometheus.client.Counter inner;
-        private final String name;
+    private static class PrometheusCounterWrapper implements Counter {
+        private final io.prometheus.metrics.core.metrics.Counter prometheusCounter;
 
-        public PrometheusCounter(String name) {
-            this.name = name;
-            this.inner = io.prometheus.client.Counter
-                    .build(name, name)
-                    .register(collectorRegistry);
+        public PrometheusCounterWrapper(io.prometheus.metrics.core.metrics.Counter prometheusCounter) {
+            this.prometheusCounter = prometheusCounter;
         }
 
         @Override
         public void add(long delta) {
             try {
-                inner.inc(delta);
-            } catch (IllegalArgumentException err) {
-                LOG.error("invalid delta {} for metric {}", delta, name, err);
+                this.prometheusCounter.inc(delta);
+            } catch (final IllegalArgumentException e) {
+                LOG.error("invalid delta {} for metric {}", delta, prometheusCounter.getPrometheusName(), e);
             }
         }
 
         @Override
         public long get() {
-            // this method is used only for tests
-            // Prometheus returns a "double"
-            // it is safe to fine to a long
-            // we are never setting non-integer values
-            return (long) inner.get();
+            return (long) this.prometheusCounter.get();
         }
-
     }
 
-    private class PrometheusLabelledCounter implements CounterSet {
-        private final String name;
-        private final io.prometheus.client.Counter inner;
+    private static class PrometheusLabelledCounterWrapper implements CounterSet {
+        private final io.prometheus.metrics.core.metrics.Counter prometheusCounter;
 
-        public PrometheusLabelledCounter(final String name) {
-            this.name = name;
-            this.inner = io.prometheus.client.Counter
-                    .build(name, name)
-                    .labelNames(LABELS)
-                    .register(collectorRegistry);
+        public PrometheusLabelledCounterWrapper(io.prometheus.metrics.core.metrics.Counter prometheusCounter) {
+            this.prometheusCounter = prometheusCounter;
         }
 
         @Override
-        public void add(final String key, final long delta) {
+        public void add(String key, long delta) {
             try {
-                inner.labels(key).inc(delta);
+                this.prometheusCounter.labelValues(key).inc(delta);
             } catch (final IllegalArgumentException e) {
-                LOG.error("invalid delta {} for metric {} with key {}", delta, name, key, e);
-            }
-        }
-    }
-
-    private class PrometheusGaugeWrapper {
-
-        private final io.prometheus.client.Gauge inner;
-        private final Gauge gauge;
-        private final String name;
-
-        public PrometheusGaugeWrapper(String name, Gauge gauge, io.prometheus.client.Gauge prev) {
-            this.name = name;
-            this.gauge = gauge;
-            this.inner = prev != null ? prev
-                    : io.prometheus.client.Gauge
-                    .build(name, name)
-                    .register(collectorRegistry);
-        }
-
-        /**
-         * Call the callback and update Prometheus Gauge. This method is called
-         * when the server is polling for a value.
-         */
-        private void sample() {
-            Number value = gauge.get();
-            this.inner.set(value != null ? value.doubleValue() : 0);
-        }
-
-        private void unregister() {
-            collectorRegistry.unregister(inner);
-        }
-    }
-
-    /**
-     * Prometheus implementation of GaugeSet interface. It wraps the GaugeSet object and
-     * uses the callback API to update the Prometheus Gauge.
-     */
-    private class PrometheusLabelledGaugeWrapper {
-        private final GaugeSet gaugeSet;
-        private final io.prometheus.client.Gauge inner;
-
-        private PrometheusLabelledGaugeWrapper(final String name,
-                                               final GaugeSet gaugeSet,
-                                               final io.prometheus.client.Gauge prev) {
-            this.gaugeSet = gaugeSet;
-            this.inner = prev != null ? prev :
-                    io.prometheus.client.Gauge
-                            .build(name, name)
-                            .labelNames(LABELS)
-                            .register(collectorRegistry);
-        }
-
-        /**
-         * Call the callback provided by the GaugeSet and update Prometheus Gauge.
-         * This method is called when the server is polling for a value.
-         */
-        private void sample() {
-            gaugeSet.values().forEach((key, value) ->
-                this.inner.labels(key).set(value != null ? value.doubleValue() : 0));
-        }
-
-        private void unregister() {
-            collectorRegistry.unregister(inner);
-        }
-    }
-
-    private class PrometheusSummary implements Summary {
-
-        private final io.prometheus.client.Summary inner;
-        private final String name;
-
-        public PrometheusSummary(String name, MetricsContext.DetailLevel level) {
-            this.name = name;
-            if (level == MetricsContext.DetailLevel.ADVANCED) {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .quantile(0.9, 0.01) // Add 90th percentile with 1% tolerated error
-                        .quantile(0.99, 0.001) // Add 99th percentile with 0.1% tolerated error
-                        .register(collectorRegistry);
-            } else {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .register(collectorRegistry);
+                LOG.error("invalid delta {} for metric {} with key {}", delta, prometheusCounter.getPrometheusName(),
+                        key, e);
             }
         }
 
         @Override
-        public void add(long delta) {
-            reportMetrics(() -> observe(delta));
-        }
-
-        private void observe(final long delta) {
-            try {
-                inner.observe(delta);
-            } catch (final IllegalArgumentException err) {
-                LOG.error("invalid delta {} for metric {}", delta, name, err);
-            }
+        public void inc(String key) {
+            add(key, 1);
         }
     }
 
-    private class PrometheusLabelledSummary implements SummarySet {
-
-        private final io.prometheus.client.Summary inner;
-        private final String name;
-
-        public PrometheusLabelledSummary(String name, MetricsContext.DetailLevel level) {
-            this.name = name;
-            if (level == MetricsContext.DetailLevel.ADVANCED) {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .labelNames(LABELS)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .quantile(0.9, 0.01) // Add 90th percentile with 1% tolerated error
-                        .quantile(0.99, 0.001) // Add 99th percentile with 0.1% tolerated error
-                        .register(collectorRegistry);
-            } else {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .labelNames(LABELS)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .register(collectorRegistry);
-            }
-        }
-
-        @Override
-        public void add(String key, long value) {
-            reportMetrics(() -> observe(key, value));
-        }
+    private static class PrometheusSummaryWrapper implements Summary {
+        private final io.prometheus.metrics.core.metrics.Summary prometheusSummary;
 
-        private void observe(final String key, final long value) {
-            try {
-                inner.labels(key).observe(value);
-            } catch (final IllegalArgumentException err) {
-                LOG.error("invalid value {} for metric {} with key {}", value, name, key, err);
-            }
+        public PrometheusSummaryWrapper(io.prometheus.metrics.core.metrics.Summary prometheusSummary) {
+            this.prometheusSummary = prometheusSummary;
         }
 
-    }
-
-    class MetricsServletImpl extends MetricsServlet {
-
         @Override
-        protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-            // little trick: update the Gauges before serving data
-            // from Prometheus CollectorRegistry
-            sampleGauges();
-            // serve data using Prometheus built in client.
-            super.doGet(req, resp);
+        public void add(long value) {
+            this.prometheusSummary.observe(value);
         }
     }
 
-    private Optional<ExecutorService> createExecutor() {
-        if (numWorkerThreads < 1) {
-            LOG.info("Executor service was not created as numWorkerThreads {} is less than 1", numWorkerThreads);
-            return Optional.empty();
-        }
-
-        final BlockingQueue<Runnable> queue = new LinkedBlockingQueue<>(maxQueueSize);
-        final ThreadPoolExecutor executor = new ThreadPoolExecutor(numWorkerThreads,
-                numWorkerThreads,
-                0L,
-                TimeUnit.MILLISECONDS,
-                queue,
-                new PrometheusWorkerThreadFactory(),
-                new PrometheusRejectedExecutionHandler());
-        LOG.info("Executor service was created with numWorkerThreads {} and maxQueueSize {}",
-                numWorkerThreads,
-                maxQueueSize);
-        return Optional.of(executor);
-    }
+    private static class PrometheusLabelledSummaryWrapper implements SummarySet {
+        private final io.prometheus.metrics.core.metrics.Summary prometheusSummary;
 
-    private void shutdownExecutor() {
-        if (executorOptional.isPresent()) {
-            LOG.info("Shutdown executor service with timeout {}", workerShutdownTimeoutMs);
-            final ExecutorService executor = executorOptional.get();
-            executor.shutdown();
-            try {
-                if (!executor.awaitTermination(workerShutdownTimeoutMs, TimeUnit.MILLISECONDS)) {
-                    LOG.error("Not all the Prometheus worker threads terminated properly after {} timeout",
-                            workerShutdownTimeoutMs);
-                    executor.shutdownNow();
-                }
-            } catch (final Exception e) {
-                LOG.error("Error occurred while terminating Prometheus worker threads", e);
-                executor.shutdownNow();
-            }
+        public PrometheusLabelledSummaryWrapper(io.prometheus.metrics.core.metrics.Summary prometheusSummary) {
+            this.prometheusSummary = prometheusSummary;
         }
-    }
-
-    private static class PrometheusWorkerThreadFactory implements ThreadFactory {
-        private static final AtomicInteger workerCounter = new AtomicInteger(1);
 
         @Override
-        public Thread newThread(final Runnable runnable) {
-            final String threadName = "PrometheusMetricsProviderWorker-" + workerCounter.getAndIncrement();
-            final Thread thread = new Thread(runnable, threadName);
-            thread.setDaemon(true);
-            return thread;
-        }
-    }
-
-    private class PrometheusRejectedExecutionHandler implements RejectedExecutionHandler {
-        private final String queueExceededMessage = "Prometheus metrics queue size exceeded the max " + maxQueueSize;
-
-        @Override
-        public void rejectedExecution(final Runnable r, final ThreadPoolExecutor e) {
-            rateLogger.rateLimitLog(queueExceededMessage);
-        }
-    }
-
-    private void reportMetrics(final Runnable task) {
-        if (executorOptional.isPresent()) {
-            executorOptional.get().submit(task);
-        } else {
-            task.run();
+        public void add(String key, long value) {
+            this.prometheusSummary.labelValues(key).observe(value);
         }
     }
 }
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java
new file mode 100644
index 00000000000..146f761595e
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import io.prometheus.metrics.model.registry.PrometheusRegistry;
+import io.prometheus.metrics.model.snapshots.CounterSnapshot;
+import io.prometheus.metrics.model.snapshots.GaugeSnapshot;
+import io.prometheus.metrics.model.snapshots.Labels;
+import io.prometheus.metrics.model.snapshots.MetricSnapshot;
+import io.prometheus.metrics.model.snapshots.MetricSnapshots;
+import io.prometheus.metrics.model.snapshots.Quantile;
+import io.prometheus.metrics.model.snapshots.SummarySnapshot;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Handles the logic of converting a PrometheusRegistry scrape result into a sequence of key-value pairs.
+ */
+public class PrometheusRegistryDumper {
+
+    private final PrometheusRegistry registry;
+
+    public PrometheusRegistryDumper(PrometheusRegistry registry) {
+        this.registry = registry;
+    }
+
+    /**
+     * Dumps all metrics from the PrometheusRegistry into a key-value map.
+     *
+     * @return a map containing all the metrics
+     */
+    public Map<String, Object> dump() {
+        Map<String, Object> allMetrics = new LinkedHashMap<>();
+        MetricSnapshots metricSnapshots = registry.scrape();
+        for (MetricSnapshot snapshot : metricSnapshots) {
+            Map<String, Object> convertedMetrics = null;
+            if (snapshot instanceof CounterSnapshot) {
+                convertedMetrics = convert((CounterSnapshot) snapshot);
+            } else if (snapshot instanceof GaugeSnapshot) {
+                convertedMetrics = convert((GaugeSnapshot) snapshot);
+            } else if (snapshot instanceof SummarySnapshot) {
+                convertedMetrics = convert((SummarySnapshot) snapshot);
+            }
+
+            if (convertedMetrics != null) {
+                allMetrics.putAll(convertedMetrics);
+            }
+        }
+        return allMetrics;
+    }
+
+    private Map<String, Object> convert(CounterSnapshot snapshot) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        String metricName = snapshot.getMetadata().getName();
+        for (CounterSnapshot.CounterDataPointSnapshot dataPoint : snapshot.getDataPoints()) {
+            result.put(buildKeyForDump(metricName, dataPoint.getLabels()), dataPoint.getValue());
+        }
+        return result;
+    }
+
+    private Map<String, Object> convert(GaugeSnapshot snapshot) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        String metricName = snapshot.getMetadata().getName();
+        for (GaugeSnapshot.GaugeDataPointSnapshot dataPoint : snapshot.getDataPoints()) {
+            result.put(buildKeyForDump(metricName, dataPoint.getLabels()), dataPoint.getValue());
+        }
+        return result;
+    }
+
+    private Map<String, Object> convert(SummarySnapshot snapshot) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        String metricName = snapshot.getMetadata().getName();
+        for (SummarySnapshot.SummaryDataPointSnapshot dataPoint : snapshot.getDataPoints()) {
+            double count = dataPoint.getCount();
+            double sum = dataPoint.getSum();
+            double avg = (count == 0) ? 0 : sum / count;
+
+            // Add metrics in the requested order with prefixes
+            result.put(buildKeyForDump(metricName + "_avg", dataPoint.getLabels()), avg);
+            // Note: Prometheus Summary does not provide min/max, so they are omitted.
+            result.put(buildKeyForDump(metricName + "_count", dataPoint.getLabels()), count);
+            result.put(buildKeyForDump(metricName + "_sum", dataPoint.getLabels()), sum);
+
+            // A summary is considered "advanced" if it has more than one quantile configured.
+            boolean isAdvanced = dataPoint.getQuantiles().size() > 1;
+
+            if (isAdvanced) {
+                List<Quantile> quantiles = new ArrayList<>();
+                dataPoint.getQuantiles().forEach(quantiles::add);
+                quantiles.sort(Comparator.comparingDouble(Quantile::getQuantile));
+
+                for (Quantile quantile : quantiles) {
+                    String quantileValue = String.valueOf(quantile.getQuantile());
+                    switch (quantileValue) {
+                    default:
+                        break;
+                    case "0.5":
+                        result.put(buildKeyForDump(metricName, dataPoint.getLabels().add("quantile", quantileValue)),
+                                quantile.getValue());
+                        break;
+                    case "0.95":
+                        result.put(buildKeyForDump(metricName, dataPoint.getLabels().add("quantile", quantileValue)),
+                                quantile.getValue());
+                        break;
+                    case "0.99":
+                        result.put(buildKeyForDump(metricName, dataPoint.getLabels().add("quantile", quantileValue)),
+                                quantile.getValue());
+                        break;
+                    }
+                }
+            }
+        }
+        return result;
+    }
+
+    /**
+     * Builds a string key for a given metric and its labels, in a format suitable for the dump output.
+     *
+     * @param metricName
+     *            the name of the metric
+     * @param labels
+     *            the labels associated with the metric
+     *
+     * @return a formatted string key
+     */
+    private String buildKeyForDump(String metricName, Labels labels) {
+        StringBuilder sb = new StringBuilder();
+        sb.append(metricName);
+        if (labels.size() > 0) {
+            sb.append("{");
+            for (int i = 0; i < labels.size(); i++) {
+                if (i > 0) {
+                    sb.append(",");
+                }
+                sb.append(labels.getName(i)).append("=\"").append(labels.getValue(i)).append("\"");
+            }
+            sb.append("}");
+        }
+        return sb.toString();
+    }
+}
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
index 5d51f9c1e54..a923348f758 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
@@ -23,8 +23,7 @@
 import org.junit.jupiter.api.Test;
 
 /**
- * Tests about Prometheus Metrics Provider. Please note that we are not testing
- * Prometheus but our integration.
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but our integration.
  */
 public class ExportJvmInfoTest extends PrometheusMetricsTestBase {
 
@@ -46,7 +45,7 @@ private void runTest(boolean exportJvmInfo) throws Exception {
             configuration.setProperty("exportJvmInfo", exportJvmInfo + "");
             provider.configure(configuration);
             provider.start();
-            boolean[] found = {false};
+            boolean[] found = { false };
             provider.dump((k, v) -> {
                 found[0] = found[0] || k.contains("heap");
             });
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
index 26cdb4c23c5..c091934709f 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
@@ -7,7 +7,7 @@
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -20,6 +20,7 @@
 
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.BufferedReader;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -37,8 +38,7 @@
 import org.junit.jupiter.api.Test;
 
 /**
- * Tests about Prometheus Metrics Provider. Please note that we are not testing
- * Prometheus but only our integration.
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but only our integration.
  */
 public class PrometheusHttpsMetricsProviderTest extends PrometheusMetricsTestBase {
 
@@ -75,7 +75,14 @@ void testHttpResponse() throws Exception {
         configuration.setProperty("httpPort", String.valueOf(httpPort));
         initializeProviderWithCustomConfig(configuration);
         simulateMetricIncrement();
-        validateMetricResponse(callHttpServlet("http://" + httpHost + ":" + httpPort + "/metrics"));
+        String metricsUrl = String.format("http://%s:%d/metrics", httpHost, httpPort);
+
+        HttpURLConnection conn = callAndGetResponse(metricsUrl, "GET");
+        validateMetricResponse(readResponse(conn));
+
+        conn = callAndGetResponse(metricsUrl, "TRACE");
+        assertEquals(HttpURLConnection.HTTP_BAD_METHOD, conn.getResponseCode());
+        conn.disconnect();
     }
 
     @Test
@@ -84,7 +91,14 @@ void testHttpsResponse() throws Exception {
         configuration.setProperty("httpsPort", String.valueOf(httpsPort));
         initializeProviderWithCustomConfig(configuration);
         simulateMetricIncrement();
-        validateMetricResponse(callHttpsServlet("https://" + httpHost + ":" + httpsPort + "/metrics"));
+        String metricsUrl = String.format("https://%s:%d/metrics", httpHost, httpsPort);
+
+        HttpURLConnection conn = callAndGetResponse(metricsUrl, "GET");
+        validateMetricResponse(readResponse(conn));
+
+        conn = callAndGetResponse(metricsUrl, "TRACE");
+        assertEquals(HttpURLConnection.HTTP_BAD_METHOD, conn.getResponseCode());
+        conn.disconnect();
     }
 
     @Test
@@ -94,44 +108,48 @@ void testHttpAndHttpsResponse() throws Exception {
         configuration.setProperty("httpPort", String.valueOf(httpPort));
         initializeProviderWithCustomConfig(configuration);
         simulateMetricIncrement();
-        validateMetricResponse(callHttpServlet("http://" + httpHost + ":" + httpPort + "/metrics"));
-        validateMetricResponse(callHttpsServlet("https://" + httpHost + ":" + httpsPort + "/metrics"));
-    }
 
-    private String callHttpsServlet(String urlString) throws Exception {
-        // Load and configure the SSL context from the keystore and truststore
-        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-        try (FileInputStream keystoreStream = new FileInputStream(testDataPath + "/ssl/client_keystore.jks")) {
-            keyStore.load(keystoreStream, "testpass".toCharArray());
-        }
+        HttpURLConnection conn = callAndGetResponse(String.format("https://%s:%d/metrics", httpHost, httpsPort), "GET");
+        validateMetricResponse(readResponse(conn));
+    }
 
-        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
-        try (FileInputStream trustStoreStream = new FileInputStream(testDataPath + "/ssl/client_truststore.jks")) {
-            trustStore.load(trustStoreStream, "testpass".toCharArray());
-        }
+    private HttpURLConnection callAndGetResponse(String urlString, String method) throws Exception {
+        URL url = new URL(urlString);
+        HttpURLConnection conn;
 
-        SSLContext sslContext = SSLContext.getInstance("TLS");
-        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
-        keyManagerFactory.init(keyStore, "testpass".toCharArray());
-        TrustManagerFactory trustManagerFactory = TrustManagerFactory
-                .getInstance(TrustManagerFactory.getDefaultAlgorithm());
-        trustManagerFactory.init(trustStore);
-        sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(),
-                new java.security.SecureRandom());
+        if (url.getProtocol().equalsIgnoreCase("https")) {
+            // Re-use the existing SSL setup logic.
+            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+            try (FileInputStream keystoreStream = new FileInputStream(testDataPath + "/ssl/client_keystore.jks")) {
+                keyStore.load(keystoreStream, "testpass".toCharArray());
+            }
 
-        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
-        URL url = new URL(urlString);
-        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
-        connection.setRequestMethod("GET");
+            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
+            try (FileInputStream trustStoreStream = new FileInputStream(testDataPath + "/ssl/client_truststore.jks")) {
+                trustStore.load(trustStoreStream, "testpass".toCharArray());
+            }
 
-        return readResponse(connection);
-    }
+            SSLContext sslContext = SSLContext.getInstance("TLS");
+            KeyManagerFactory keyManagerFactory = KeyManagerFactory
+                    .getInstance(KeyManagerFactory.getDefaultAlgorithm());
+            keyManagerFactory.init(keyStore, "testpass".toCharArray());
+            TrustManagerFactory trustManagerFactory = TrustManagerFactory
+                    .getInstance(TrustManagerFactory.getDefaultAlgorithm());
+            trustManagerFactory.init(trustStore);
+            sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(),
+                    new java.security.SecureRandom());
+
+            HttpsURLConnection httpsConn = (HttpsURLConnection) url.openConnection();
+            httpsConn.setSSLSocketFactory(sslContext.getSocketFactory());
+            httpsConn.setHostnameVerifier((hostname, session) -> true);
+            conn = httpsConn;
+        } else {
+            conn = (HttpURLConnection) url.openConnection();
+        }
 
-    private String callHttpServlet(String urlString) throws IOException {
-        URL url = new URL(urlString);
-        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
-        connection.setRequestMethod("GET");
-        return readResponse(connection);
+        conn.setRequestMethod(method);
+        conn.connect();
+        return conn;
     }
 
     private String readResponse(HttpURLConnection connection) throws IOException {
@@ -155,7 +173,7 @@ public void simulateMetricIncrement() {
     }
 
     private void validateMetricResponse(String response) throws IOException {
-        assertThat(response, containsString("# TYPE cc counter"));
-        assertThat(response, containsString("cc 10.0"));
+        assertThat(response, containsString("# TYPE cc_total counter"));
+        assertThat(response, containsString("cc_total 10.0"));
     }
-}
\ No newline at end of file
+}
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
index aa9cd2c7170..c151854b05a 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -88,15 +88,14 @@ public void testValidHttpsAndHttpConfig() throws MetricsProviderLifeCycleExcepti
         provider.start();
     }
 
-
     @Test
     public void testInvalidSslConfig() throws MetricsProviderLifeCycleException {
         assertThrows(MetricsProviderLifeCycleException.class, () -> {
             PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
             Properties configuration = new Properties();
             String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
-            configuration.setProperty("httpsPort", "0");
-            //keystore missing
+            configuration.setProperty("httpsPort", "50514");
+            // keystore missing
             configuration.setProperty("ssl.keyStore.password", "testpass");
             configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
             configuration.setProperty("ssl.trustStore.password", "testpass");
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 59115e31d90..2d36b001763 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -26,13 +26,10 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import java.lang.reflect.Field;
-import java.net.HttpURLConnection;
-import java.net.URL;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -42,6 +39,9 @@
 import java.util.Properties;
 import java.util.concurrent.atomic.AtomicInteger;
 import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
+import javax.servlet.WriteListener;
+import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.Counter;
@@ -52,16 +52,13 @@
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
 import org.apache.zookeeper.server.util.QuotaMetricsUtils;
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.server.ServerConnector;
 import org.hamcrest.CoreMatchers;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 /**
- * Tests about Prometheus Metrics Provider. Please note that we are not testing
- * Prometheus but only our integration.
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but only our integration.
  */
 public class PrometheusMetricsProviderTest extends PrometheusMetricsTestBase {
 
@@ -72,7 +69,7 @@ public class PrometheusMetricsProviderTest extends PrometheusMetricsTestBase {
     public void setup() throws Exception {
         provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
-        configuration.setProperty("numWorkerThreads", "0"); // sync behavior for test
+        configuration.setProperty("numWorkerThreads", "1"); // sync behavior for test
         configuration.setProperty("httpHost", "127.0.0.1"); // local host for test
         configuration.setProperty("httpPort", "0"); // ephemeral port
         configuration.setProperty("exportJvmInfo", "false");
@@ -91,13 +88,12 @@ public void tearDown() {
     public void testCounters() throws Exception {
         Counter counter = provider.getRootContext().getCounter("cc");
         counter.add(10);
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             assertEquals("cc", k);
             assertEquals(10, ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, count[0]);
         count[0] = 0;
 
@@ -108,16 +104,15 @@ public void testCounters() throws Exception {
             assertEquals("cc", k);
             assertEquals(10, ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, count[0]);
 
         // we always must get the same object
         assertSame(counter, provider.getRootContext().getCounter("cc"));
 
         String res = callServlet();
-        assertThat(res, CoreMatchers.containsString("# TYPE cc counter"));
-        assertThat(res, CoreMatchers.containsString("cc 10.0"));
+        assertThat(res, CoreMatchers.containsString("# TYPE cc_total counter"));
+        assertThat(res, CoreMatchers.containsString("cc_total 10.0"));
     }
 
     @Test
@@ -125,7 +120,7 @@ public void testCounterSet_single() throws Exception {
         // create and register a CounterSet
         final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
         final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
-        final String[] keys = {"ns1", "ns2"};
+        final String[] keys = { "ns1", "ns2" };
         final int count = 3;
 
         // update the CounterSet multiple times
@@ -142,10 +137,10 @@ public void testCounterSet_single() throws Exception {
         validateWithDump(expectedMetricsMap);
 
         // validate with servlet call
-        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s count", name));
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s_total counter", name));
         final List<String> expectedMetrics = new ArrayList<>();
         for (final String key : keys) {
-            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", name, key, count * 3.0));
+            expectedMetrics.add(String.format("%s_total{key=\"%s\"} %s", name, key, count * 3.0));
         }
         validateWithServletCall(expectedNames, expectedMetrics);
 
@@ -157,9 +152,9 @@ public void testCounterSet_single() throws Exception {
     public void testCounterSet_multiple() throws Exception {
         final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
 
-        final String[] names = new String[]{name + "_1", name + "_2"};
-        final String[] keys = new String[]{"ns21", "ns22"};
-        final int[] counts = new int[] {3, 5};
+        final String[] names = new String[] { name + "_1", name + "_2" };
+        final String[] keys = new String[] { "ns21", "ns22" };
+        final int[] counts = new int[] { 3, 5 };
 
         final int length = names.length;
         final CounterSet[] counterSets = new CounterSet[length];
@@ -187,16 +182,15 @@ public void testCounterSet_multiple() throws Exception {
         final List<String> expectedNames = new ArrayList<>();
         final List<String> expectedMetrics = new ArrayList<>();
         for (int i = 0; i < length; i++) {
-            expectedNames.add(String.format("# TYPE %s count", names[i]));
-            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", names[i], keys[i], counts[i]  * 1.0));
+            expectedNames.add(String.format("# TYPE %s_total counter", names[i]));
+            expectedMetrics.add(String.format("%s_total{key=\"%s\"} %s", names[i], keys[i], counts[i] * 1.0));
         }
         validateWithServletCall(expectedNames, expectedMetrics);
     }
 
     @Test
     public void testCounterSet_registerWithNullName() {
-        assertThrows(NullPointerException.class,
-                () -> provider.getRootContext().getCounterSet(null));
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().getCounterSet(null));
     }
 
     @Test
@@ -222,8 +216,8 @@ public void testCounterSet_nullKey() {
 
     @Test
     public void testGauge() throws Exception {
-        int[] values = {78, -89};
-        int[] callCounts = {0, 0};
+        int[] values = { 78, -89 };
+        int[] callCounts = { 0, 0 };
         Gauge gauge0 = () -> {
             callCounts[0]++;
             return values[0];
@@ -234,13 +228,12 @@ public void testGauge() throws Exception {
         };
         provider.getRootContext().registerGauge("gg", gauge0);
 
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             assertEquals("gg", k);
             assertEquals(values[0], ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, callCounts[0]);
         assertEquals(0, callCounts[1]);
         assertEquals(1, count[0]);
@@ -252,8 +245,7 @@ public void testGauge() throws Exception {
         provider.getRootContext().unregisterGauge("gg");
         provider.dump((k, v) -> {
             count[0]++;
-        }
-        );
+        });
         assertEquals(2, callCounts[0]);
         assertEquals(0, callCounts[1]);
         assertEquals(0, count[0]);
@@ -266,8 +258,7 @@ public void testGauge() throws Exception {
             assertEquals("gg", k);
             assertEquals(values[1], ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(2, callCounts[0]);
         assertEquals(1, callCounts[1]);
         assertEquals(1, count[0]);
@@ -285,8 +276,7 @@ public void testGauge() throws Exception {
 
         provider.dump((k, v) -> {
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, count[0]);
         assertEquals(3, callCounts[0]);
         assertEquals(2, callCounts[1]);
@@ -294,41 +284,37 @@ public void testGauge() throws Exception {
 
     @Test
     public void testBasicSummary() throws Exception {
-        Summary summary = provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.BASIC);
+        Summary summary = provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC);
         summary.add(10);
         summary.add(10);
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             count[0]++;
             int value = ((Number) v).intValue();
 
             switch (k) {
-                case "cc{quantile=\"0.5\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc_count":
-                    assertEquals(2, value);
-                    break;
-                case "cc_sum":
-                    assertEquals(20, value);
-                    break;
-                default:
-                    fail("unespected key " + k);
-                    break;
+            case "cc_avg":
+                assertEquals(10, value);
+                break;
+            case "cc_count":
+                assertEquals(2, value);
+                break;
+            case "cc_sum":
+                assertEquals(20, value);
+                break;
+            default:
+                fail("unespected key " + k);
+                break;
             }
-        }
-        );
+        });
         assertEquals(3, count[0]);
         count[0] = 0;
 
         // we always must get the same object
-        assertSame(summary, provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.BASIC));
+        assertSame(summary, provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC));
 
         try {
-            provider.getRootContext()
-                    .getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
+            provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
             fail("Can't get the same summary with a different DetailLevel");
         } catch (IllegalArgumentException err) {
             assertThat(err.getMessage(), containsString("Already registered"));
@@ -337,53 +323,55 @@ public void testBasicSummary() throws Exception {
         String res = callServlet();
         assertThat(res, containsString("# TYPE cc summary"));
         assertThat(res, CoreMatchers.containsString("cc_sum 20.0"));
-        assertThat(res, CoreMatchers.containsString("cc_count 2.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\",} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc_count 2"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\"} 10.0"));
     }
 
     @Test
     public void testAdvancedSummary() throws Exception {
-        Summary summary = provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
+        Summary summary = provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
         summary.add(10);
         summary.add(10);
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             count[0]++;
             int value = ((Number) v).intValue();
 
             switch (k) {
-                case "cc{quantile=\"0.5\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc{quantile=\"0.9\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc{quantile=\"0.99\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc_count":
-                    assertEquals(2, value);
-                    break;
-                case "cc_sum":
-                    assertEquals(20, value);
-                    break;
-                default:
-                    fail("unespected key " + k);
-                    break;
+            case "cc{quantile=\"0.5\"}":
+                assertEquals(10, value);
+                break;
+            case "cc{quantile=\"0.9\"}":
+                assertEquals(10, value);
+                break;
+            case "cc{quantile=\"0.95\"}":
+                assertEquals(10, value);
+                break;
+            case "cc{quantile=\"0.99\"}":
+                assertEquals(10, value);
+                break;
+            case "cc_count":
+                assertEquals(2, value);
+                break;
+            case "cc_sum":
+                assertEquals(20, value);
+                break;
+            case "cc_avg":
+                assertEquals(10, value);
+                break;
+            default:
+                fail("unespected key " + k);
+                break;
             }
-        }
-        );
-        assertEquals(5, count[0]);
+        });
+        assertEquals(6, count[0]);
         count[0] = 0;
 
         // we always must get the same object
-        assertSame(summary, provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.ADVANCED));
+        assertSame(summary, provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED));
 
         try {
-            provider.getRootContext()
-                    .getSummary("cc", MetricsContext.DetailLevel.BASIC);
+            provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC);
             fail("Can't get the same summary with a different DetailLevel");
         } catch (IllegalArgumentException err) {
             assertThat(err.getMessage(), containsString("Already registered"));
@@ -392,27 +380,35 @@ public void testAdvancedSummary() throws Exception {
         String res = callServlet();
         assertThat(res, containsString("# TYPE cc summary"));
         assertThat(res, CoreMatchers.containsString("cc_sum 20.0"));
-        assertThat(res, CoreMatchers.containsString("cc_count 2.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\",} 10.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.9\",} 10.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\",} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc_count 2"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\"} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.95\"} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\"} 10.0"));
     }
 
     /**
-     * Using TRACE method to visit metrics provider, the response should be 403 forbidden.
+     * Using the TRACE method to visit the metrics provider, the response should be 405 Method Not Allowed. This unit
+     * test replaces the old test which was tightly coupled to the Jetty server implementation.
      */
     @Test
-    public void testTraceCall() throws IOException, IllegalAccessException, NoSuchFieldException {
-        Field privateServerField = provider.getClass().getDeclaredField("server");
-        privateServerField.setAccessible(true);
-        Server server = (Server) privateServerField.get(provider);
-        int port = ((ServerConnector) server.getConnectors()[0]).getLocalPort();
-
-        String metricsUrl = String.format(URL_FORMAT, port);
-        HttpURLConnection conn = (HttpURLConnection) new URL(metricsUrl).openConnection();
-        conn.setRequestMethod("TRACE");
-        conn.connect();
-        assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+    public void testTraceCall() throws ServletException, IOException {
+        final HttpServlet servlet = provider.getServlet();
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+
+        // Configure the mock to return an empty enumeration for headers.
+        when(request.getHeaderNames()).thenReturn(Collections.enumeration(Collections.emptyList()));
+        when(request.getMethod()).thenReturn("TRACE");
+
+        final ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        final ServletOutputStream servletOutputStream = createMockServletOutputStream(outputStream);
+
+        when(response.getOutputStream()).thenReturn(servletOutputStream);
+
+        servlet.service(request, response);
+
+        // Verify that the servlet set the response status to 405 Method Not Allowed.
+        verify(response).sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
     }
 
     @Test
@@ -428,8 +424,8 @@ public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
             metricsProvider = new PrometheusMetricsProvider();
             metricsProvider.configure(config);
             metricsProvider.start();
-            final Summary summary =
-                    metricsProvider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
+            final Summary summary = metricsProvider.getRootContext().getSummary("cc",
+                    MetricsContext.DetailLevel.ADVANCED);
 
             // make sure no error is thrown
             for (int i = 0; i < 10; i++) {
@@ -437,7 +433,7 @@ public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
             }
         } finally {
             if (metricsProvider != null) {
-               metricsProvider.stop();
+                metricsProvider.stop();
             }
         }
     }
@@ -445,12 +441,11 @@ public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
     @Test
     public void testSummarySet() throws Exception {
         final String name = "ss";
-        final String[] keys = {"ns1", "ns2"};
+        final String[] keys = { "ns1", "ns2" };
         final double count = 3.0;
 
         // create and register a SummarySet
-        final SummarySet summarySet = provider.getRootContext()
-                .getSummarySet(name, MetricsContext.DetailLevel.BASIC);
+        final SummarySet summarySet = provider.getRootContext().getSummarySet(name, MetricsContext.DetailLevel.BASIC);
 
         // update the SummarySet multiple times
         for (int i = 0; i < count; i++) {
@@ -460,7 +455,7 @@ public void testSummarySet() throws Exception {
         // validate with dump call
         final Map<String, Number> expectedMetricsMap = new HashMap<>();
         for (final String key : keys) {
-            expectedMetricsMap.put(String.format("%s{key=\"%s\",quantile=\"0.5\"}", name, key), 1.0);
+            expectedMetricsMap.put(String.format("%s_avg{key=\"%s\"}", name, key), 1.0);
             expectedMetricsMap.put(String.format("%s_count{key=\"%s\"}", name, key), count);
             expectedMetricsMap.put(String.format("%s_sum{key=\"%s\"}", name, key), count);
         }
@@ -470,43 +465,84 @@ public void testSummarySet() throws Exception {
         final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s summary", name));
         final List<String> expectedMetrics = new ArrayList<>();
         for (final String key : keys) {
-            expectedMetrics.add(String.format("%s{key=\"%s\",quantile=\"0.5\",} %s", name, key, 1.0));
-            expectedMetrics.add(String.format("%s_count{key=\"%s\",} %s", name, key, count));
-            expectedMetrics.add(String.format("%s_sum{key=\"%s\",} %s", name, key, count));
+            expectedMetrics.add(String.format("%s{key=\"%s\",quantile=\"0.5\"} %s", name, key, 1.0));
+            expectedMetrics.add(String.format("%s_count{key=\"%s\"} %d", name, key, (int) count));
+            expectedMetrics.add(String.format("%s_sum{key=\"%s\"} %s", name, key, count));
         }
         validateWithServletCall(expectedNames, expectedMetrics);
 
         // validate registering with same name, no overwriting
-        assertSame(summarySet, provider.getRootContext()
-                .getSummarySet(name, MetricsContext.DetailLevel.BASIC));
+        assertSame(summarySet, provider.getRootContext().getSummarySet(name, MetricsContext.DetailLevel.BASIC));
 
         // validate registering with different DetailLevel, not allowed
         try {
-            provider.getRootContext()
-                    .getSummarySet(name, MetricsContext.DetailLevel.ADVANCED);
+            provider.getRootContext().getSummarySet(name, MetricsContext.DetailLevel.ADVANCED);
             fail("Can't get the same summarySet with a different DetailLevel");
         } catch (final IllegalArgumentException e) {
             assertThat(e.getMessage(), containsString("Already registered"));
         }
     }
 
+    /**
+     * Helper method to create a mock ServletOutputStream that writes to a provided ByteArrayOutputStream.
+     */
+    private ServletOutputStream createMockServletOutputStream(final ByteArrayOutputStream outputStream) {
+        return new ServletOutputStream() {
+            @Override
+            public boolean isReady() {
+                return true;
+            }
+
+            @Override
+            public void setWriteListener(WriteListener writeListener) {
+            }
+
+            @Override
+            public void write(int b) throws IOException {
+                outputStream.write(b);
+            }
+        };
+    }
+
+    /**
+     * A utility method to simulate a GET request to the PrometheusMetricsServlet and return the response body as a
+     * String using Mockito mocks for the base servlet interfaces.
+     * <p>
+     * This method demonstrates how to test a servlet by mocking the request and response objects and capturing the
+     * output.
+     * </p>
+     *
+     * @return The content of the servlet's response body.
+     *
+     * @throws ServletException
+     *             if a servlet-related error occurs.
+     * @throws IOException
+     *             if an I/O error occurs.
+     */
     private String callServlet() throws ServletException, IOException {
-        // we are not performing an HTTP request
-        // but we are calling directly the servlet
-        StringWriter writer = new StringWriter();
-        HttpServletResponse response = mock(HttpServletResponse.class);
-        when(response.getWriter()).thenReturn(new PrintWriter(writer));
-        HttpServletRequest req = mock(HttpServletRequest.class);
-        provider.getServlet().doGet(req, response);
-        String res = writer.toString();
-        return res;
+        final HttpServlet servlet = provider.getServlet();
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+
+        final ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        final ServletOutputStream servletOutputStream = createMockServletOutputStream(outputStream);
+
+        // Configure the mock response to return our custom output stream.
+        when(response.getOutputStream()).thenReturn(servletOutputStream);
+        when(request.getMethod()).thenReturn("GET");
+        servlet.service(request, response);
+
+        // Verify that the servlet set the HTTP status code to OK.
+        verify(response).setStatus(HttpServletResponse.SC_OK);
+
+        return outputStream.toString();
     }
 
     @Test
     public void testGaugeSet_singleGaugeSet() throws Exception {
         final String name = QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE;
-        final Number[] values = {10.0, 100.0};
-        final String[] keys = {"ns11", "ns12"};
+        final Number[] values = { 10.0, 100.0 };
+        final String[] keys = { "ns11", "ns12" };
         final Map<String, Number> metricsMap = new HashMap<>();
         for (int i = 0; i < values.length; i++) {
             metricsMap.put(keys[i], values[i]);
@@ -528,7 +564,7 @@ public void testGaugeSet_singleGaugeSet() throws Exception {
         final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s gauge", name));
         final List<String> expectedMetrics = new ArrayList<>();
         for (int i = 0; i < values.length; i++) {
-            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", name, keys[i], values[i]));
+            expectedMetrics.add(String.format("%s{key=\"%s\"} %s", name, keys[i], values[i]));
         }
         validateWithServletCall(expectedNames, expectedMetrics);
         assertEquals(2, callCount.get());
@@ -548,13 +584,11 @@ public void testGaugeSet_singleGaugeSet() throws Exception {
 
     @Test
     public void testGaugeSet_multipleGaugeSets() throws Exception {
-        final String[] names = new String[] {
-                QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
-                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE
-        };
+        final String[] names = new String[] { QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE };
 
-        final Number[] values = new Number[] {20.0, 200.0};
-        final String[] keys = new String[]{"ns21", "ns22"};
+        final Number[] values = new Number[] { 20.0, 200.0 };
+        final String[] keys = new String[] { "ns21", "ns22" };
         final int count = names.length;
         final AtomicInteger[] callCounts = new AtomicInteger[count];
 
@@ -581,7 +615,7 @@ public void testGaugeSet_multipleGaugeSets() throws Exception {
         final List<String> expectedMetrics = new ArrayList<>();
         for (int i = 0; i < count; i++) {
             expectedNames.add(String.format("# TYPE %s gauge", names[i]));
-            expectedMetrics.add(String.format("%s{key=\"%s\",} %s", names[i], keys[i], values[i]));
+            expectedMetrics.add(String.format("%s{key=\"%s\"} %s", names[i], keys[i], values[i]));
         }
         validateWithServletCall(expectedNames, expectedMetrics);
         for (int i = 0; i < count; i++) {
@@ -609,14 +643,12 @@ public void testGaugeSet_multipleGaugeSets() throws Exception {
 
     @Test
     public void testGaugeSet_overwriteRegister() {
-        final String[] names = new String[] {
-                QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
-                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE
-        };
+        final String[] names = new String[] { QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE };
 
         final int count = names.length;
-        final Number[] values = new Number[]{30.0, 300.0};
-        final String[] keys = new String[] {"ns31", "ns32"};
+        final Number[] values = new Number[] { 30.0, 300.0 };
+        final String[] keys = new String[] { "ns31", "ns32" };
         final AtomicInteger[] callCounts = new AtomicInteger[count];
 
         // create and register the GaugeSets
@@ -656,22 +688,18 @@ public void testGaugeSet_nullKey() {
 
     @Test
     public void testGaugeSet_registerWithNullGaugeSet() {
-        assertThrows(NullPointerException.class,
-                () -> provider.getRootContext().registerGaugeSet("name", null));
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().registerGaugeSet("name", null));
 
-        assertThrows(NullPointerException.class,
-                () -> provider.getRootContext().registerGaugeSet(null, HashMap::new));
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().registerGaugeSet(null, HashMap::new));
     }
 
     @Test
     public void testGaugeSet_unregisterNull() {
-        assertThrows(NullPointerException.class,
-                () -> provider.getRootContext().unregisterGaugeSet(null));
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().unregisterGaugeSet(null));
     }
 
-    private void createAndRegisterGaugeSet(final String name,
-                                           final Map<String, Number> metricsMap,
-                                           final AtomicInteger callCount) {
+    private void createAndRegisterGaugeSet(final String name, final Map<String, Number> metricsMap,
+            final AtomicInteger callCount) {
         final GaugeSet gaugeSet = () -> {
             callCount.addAndGet(1);
             return metricsMap;
@@ -686,8 +714,8 @@ private void validateWithDump(final Map<String, Number> expectedMetrics) {
         expectedMetrics.forEach((key, value) -> assertEquals(value, returnedMetrics.get(key)));
     }
 
-    private void validateWithServletCall(final List<String> expectedNames,
-                                         final List<String> expectedMetrics) throws Exception {
+    private void validateWithServletCall(final List<String> expectedNames, final List<String> expectedMetrics)
+            throws Exception {
         final String response = callServlet();
         if (expectedNames.isEmpty() && expectedMetrics.isEmpty()) {
             assertTrue(response.isEmpty());
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
index 9ed4995fbd0..efd8f38a8a5 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
@@ -18,32 +18,27 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
-import io.prometheus.client.CollectorRegistry;
-import io.prometheus.client.hotspot.DefaultExports;
+import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
+import io.prometheus.metrics.model.registry.PrometheusRegistry;
 import java.lang.reflect.Field;
+import java.util.Set;
 import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
 
 /**
  * The base test for prometheus metrics unit tests.
  */
 public abstract class PrometheusMetricsTestBase {
 
-    @BeforeEach
-    void setUp() throws Exception {
-        CollectorRegistry.defaultRegistry.clear();
-        resetDefaultExportsInitializedFlag();
-    }
-
     @AfterEach
     void tearDown() throws Exception {
-        CollectorRegistry.defaultRegistry.clear();
-        resetDefaultExportsInitializedFlag();
-    }
-
-    protected void resetDefaultExportsInitializedFlag() throws Exception {
-        Field initializedField = DefaultExports.class.getDeclaredField("initialized");
-        initializedField.setAccessible(true);
-        initializedField.set(null, false);
+        PrometheusRegistry.defaultRegistry.clear();
+        // JvmMetrics uses a static Set to track which registries it has been
+        // registered with. We need to clear this set via reflection to allow
+        // re-initialization in subsequent tests.
+        Field registeredField = JvmMetrics.class.getDeclaredField("REGISTERED");
+        registeredField.setAccessible(true);
+        @SuppressWarnings("unchecked")
+        Set<?> registeredSet = (Set<?>) registeredField.get(null);
+        registeredSet.clear();
     }
-}
+}
\ No newline at end of file
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks
index 8636f41dd088b564573843725f639cc0bd01e400..56c0bdb7b8b07b266530cf977716547b9aa6e6a1 100644
GIT binary patch
literal 2591
zcmY+Ec{CJ?7stmKV@&pDjIBX=_GKoCEDa&DjBSYQyBU-%lPyb;L4zmC5>u9kAtbvj
z$yOq=Gsv2Ro^@n<e!uhky?5Rp_uO+n-+S+0_k2*%PyrwVBPyC@2+SfCs~5Y+#=y)#
ziDu~lMYFV>;<u=1Cj7r5rdyzBCd*T7c3N2Qng4CELK%RRXwU&F8nlO!1VjIiPmc?L
zU?r)@pPZU^yi(<7#xw-IJ8m1;7yuao?IxgTP`9X-WKk+ucXahc@7=@&>OsOPx1*CB
zvjiB@i<wW%Pr3Dyvjf(Z9mqizY2Zs+j4fXoNC_Umgs=L;a7#&gB_<kgH^0mndtVAL
zu~<0EG7>Je2g%iQ;3$+0xKnYJ^Klcd%&4da?NL$wrbf!p0*{LwFTKG@*?G`;9A91V
zn8qJ!o?9la)lXjv`k73Dr+a>MO^?V>;~3Eqnkql}1nR<x?GD_}=Kb1k1J@Qeu3sLD
zRLE_-Ozp2FfbAFM@-X4v;^>@v><_kEH)pT&vfFDGN%moSFk&+2A>~}+scDU(kF*mT
zl>6rd<`;)$kTOU2UbbKY*X^@8jpRGbYZwKl<ois6<eRLQ=;cOL(yTQQihjQZJ(r+X
zd(?=?e=ssz|4i$f>HTXCU1N)J-x=E>!Z|yf2*qn&Q7xUE4jkHa5-TAtJ4GvayxT<K
zm()FxQVLIhd951EJf-hkiBGG4wgy=BNI&1hi!f!bP}LjRwHs9@xFUm4e{b9DJcHUl
z6Q9&Q02^2RFzT<gF?l#R&~W~1U*%Y{%oFSGq}CMyMzHV!p48&G1T-q*v9KB~DBGG*
zzd>7zH%*jCEEB6Q7fVn{NP<{NM~0}cs_%;jak30-c<J4A1jq<iwt<oj5*j(i%I*h3
zn7ih&G*1J9Qn8X_XINt`=iHC2@q-8ogqC+hxyW79EBq#+eG}4RtCLV4C>yzH`hn>B
zqKEfe$a(%FxcSpk?rnwbfgjB@tqiJ}Y>Z12FKY8QzRXH&1d}gDu-n<uRhvt-({<=k
zD623QaW2nJV~dRalgYYvUrH%5pOl^oM<-{xxfdeqB<i1!Sf0Tfep}j#oEDg64LX=S
z>T<K&%DidKkOAM^*OOw4jTeLZrHf{IyOw!+2{e=ewus505*j&TC(YF=v-GXb5q6<a
zHX&CNUHu1hVis9nGzHO5>Faa)UGR>F{4;MXy0N}Wf~gttiNuIDc9(riZ4<Z1t8ufg
zg8^2`4uNR6P8uE8EHm^9$7-f7Z_e4_kvts`ks{Nn6aAzB*=EDDkYy`KFAQ~+Aa2`V
z_4H25wvuo#;z_%>Yp`^8b=q%7IOJAPd5mSG@Op&or3X=;ZgS;<48JXsmUslE4*vMQ
zoTgR!Xzgmcx$^oQ$8>1epv8}>3q#PRSp$(}3#eiHgwwKb1X)+^CHaqE&b@qLCfv>V
z$H93wJw{D4djWChg|idsvFUsD_t@l}9D_R>>RJPzhdKWoS5*of`K5cgdQuKs+Aq$+
zlBSlPpJ8ZGJk7?%e6oGS)Wuum>cvZUdcaYXOM$e;<YoRcCVK<JkDNoS+QyKnUbJI}
z42Q%Y^9zSrCm|F=%<~nZifxXhJeDosk<opn@A~rXMu2V}541PlplZ{mhkGyURgAJ$
z0bqD88%lQ8PkT%h0t1rMEs{j4%#HUHQ?aTmk5T(X=THPD#fNW=TFx@2>usGSR@#WA
zaKD|@j3Ktl*O7O=BT*Te_Pc4et2%eFB3HuQg3j3XOy~6W*bswag=SrvmLEMGABILo
z&EK#=#$e<P#cGaT)edptuGSpYYYUM4Nv}st!-yj0l_qAN<Dy$`a$zjsUV4U#KL%Ki
zpEjd4Py&Cek_ColN3sH30NwyRzzuL45Qq}_CxoM6AZ{Gq$4wZmq<HBHT2blJWt5`w
zsXPt;9%2Tc`c(ZCT>&xxPTR$Q5{7>n7W^N>W)E4nb7+4E_i))m@Yh$=yOnhc{nxOO
z(TwzKBHOOwJe)Xse*pg%7Tx%e#|y-w=R-$Xlhd{vm2ASVWxE0oll1L<9uDbuDNO#<
zQ}}4vou863F0LBO_gmkqNtFxwu_QBj<sA3oji?t3a@`igXV<Dp>jBaQJ?yb{eE{jv
zF>X01dCgg%aK+wgJNK+Vf(|$`Ymqhvb~H2!*#Yh(tn`$hxL2}M9o&CtePhK`<IZH{
zRFEz~51zk+@X53;(@$nD9!^%J3B41l|L}7et{PC2L(;E=Y@90+V<I_7EMGN?s{{)X
z&@?+$&+(b_g1@VdI^GFYDHl)En45wwBoA@*T;GA#0Db@1q!$;5C_B*tz6V^SPGo1;
z-W5z41hl*y{!^8ATh+whS@^45)pvISP!Jqrr|$56a1_qN5RYR6u~egFiG0Y<K3~g$
z5227GeUA*{m+UPLAUk35prIN|7HZIXHg7nKpXWy@4AvDnEha#9B(d?UW@{tPw+0C%
z9eF!@O>E%ElK4o=rdr1s=D2}7C#DREpwudSLjodJIWi((i}vL<!yf#}9=xBr8_@DZ
zSWfyzq3kDV6@p-3FWWe~mbahZB#c7ROU&*!%evN=)*G5K5jjJKY*1@IC(UXF^`omC
z8dFLU)^#;~1_URSmvJ5Lc=X+%PbS6^@d(#sTA9z3=zz>rL9hbZfV^kf-6-1sZ0jve
z^DTe)@C!AUC_CsU6A}FRsVExU*0${J6qaiqfFyX}=G~^Y(u&1{y9>Ie#hhvmg#vUY
zPEwE`7%wp9Ky3!}VWJbOzGpNYkrA021%c=nJ`=w|OA8@GI4;Q-h5+-aTlQlWHo389
zLGKfzNL5xYRG|o!RZ|?=cof$!#zz^S&9x_tl{05W-21rhs7t!8U4u_pky9<kF2@n;
zgO6#r-8NM7<}foQdt!76hQL$emiIGCliuxC5SyJAmrIYpTZAq{xmE(&6BTlixdo|)
z9<keO)S~L2ljOdPIDne{?o1XxR&Q8Fb9vl#a^nl)zE;vRx~q}EErj<p@_m1TyX=w^
zm>){#o{p$d_cQps&%XMKwI#lfR;{Ld=~JFc0AlE)dipsZIakm7Rf^vGNb`YZj<W|k
zYkN%0;D?w7V1?=pSefaC-2=Pq+7enz@Yj(R>c%%;hhW)|g>^k6f9RWwiRRV2IfmS!
z&loMITui!@?B*)Uc+z3;+f=R5715`mK#s7cd4tnem?kGzyrBZ;1%A0}Pz$y(n$)|<
zhkC`oo;WyCu1$XInwES`DzY3{D}=JorQ6zi9)Aw2n=t?L5SG7FyepU@FM-MUay(Yq
zDPk3EHn!fF@OsiZ>gcP$m1*WCmngEBm<Z}BN(99MW|C%S1oAThK(NE9*UU*NyQ2bQ
pdVuRhKW%fEZ8->rxKdN+n;DE+mFcz}(`hr5_S+HxGBU(c{sJGixe@>X

literal 2246
zcmchY`8N~{7sqGDm|>7*EJ?-KnJ{BlmLxmPFk}yn8T-zYrNW@>FC|+UYnHK_>_j5j
zo+Q%9lC4KFRAdeB)Omk+{(|?1`@{X5d(OS*d++()WBM^2004j(0sIpXypJcrFNBe%
zJ<Ah0005W)C=&P=>J$WqgaE-nSr9i6$P56Jz^eh=eaZM?tLR1@vYi&FxLAuS8oA+V
zvDW@YZhTxW#c~$_^g1gQCwV9U{hBK{^cEW%m$dGfRNAbtbBZkUC{m`bDOfdrBl4YJ
zHo^lQi%}EO-U_7}1t+2{{l17dtwRUJ>h=t0l1+*ZpL<PaT)@)O`AjM%aGSMJpKb<5
z`5MJ6n?KPhNmw42+%J2v-|IZ4U1BQqEn>yV;$%*I^!t!nn_IWd(doR8WXm1H^0jFQ
z7gBf5PO<-d?J3EQ@S;%tXZ5)*T)7!MPYfiF2AsR#_3K^6$%57SMZFF(<KGQdJ{qND
z__NfR9a-k^IqwIAtMn~=gbrbzXOJ=5Al8{NrB@Hma*dZk$<vbouLE563tF@yV)2>T
z$66%_dNR~?N;;jJuK(I0@iLr_u2i<~`Y`o9bk}&;pvQ!mLsq$atGDyG!~(x_W4^_%
z3Q=w7L7B{wn3KtF2^9jWW@<`>8N<^xaqf$}8yu}Za;&Z6MQYzo8icz(Yk<B+3cW$A
z=NqwyC&(eZzzSrMx@uTFW|IrvpDu4%e5WveHlOF)2OY;y87Uop@|k9L4uVan;uenW
zQ01~;T+0f!W?^rxS#aKtpysf96=UUuU8U_w%!3@{L3R9ZS29B&TznWC7;(d7-o|@1
z`JVJu*J%~W3QjDK53~!MO<G`<aC{*yyzu!S__dm^y0VE?DUe$n`TB;gASJ6Lnevst
zv+dkx%I=<=SDThX7O|U*Q6kr2gq<l$e23e0()&ZU&pN(KNS2&cR|(tqRURv=2cfe9
z>fQp)2t$v;uZG8L$dimPKbF3(8n4VA0iSN{Lun_4cKdI-&AYNHQE8~t-s#e=*0J$f
zy@1S7F}+R>Ssp^Bw77Ot#1)vCh2wToru-sau6{CNDR;O2zAp`*qOV(agX>jRVlhax
zJT9YDA4Cos+3hS-w<OLA_gmfsU}9<<U_Y^KYt@_~>bF~lCQg+($BSG2vX(<$(4JkQ
z?6-1{^0d<Y5arg^yfpEPTiSg$4`%{wYCVIF>+Vi8)+*POP_&^xmivFIg2vlEvM0|P
zEY@`>=`h`PY);{xYG7ua*k(Ci3Y|KJhK<w*Q+A~F8x8sMC~~&6F=}?{{MP}j?Mqo3
zb2(}}c`VTbrOlgK@k6u{8%lh1=Sr=QQv+svh7ZZCm<PzJKmWuQG~{P8|2ggeZ`@ZM
ztnmV7Rn?!XZ@HJZ-HAFUs*h_63Vx#)e%RQ;R#gz2_Vkgs?mK-CLCX8%^uNrbH5Q@N
z`v+e23QF9ZaOBPW=$&<`>8?^_4y#i-IZ=;bYPu>4&D=4sj(lj1f3KV>vTUMxP4u+c
zUt^onK_n)VatkQ?`Wwr@Wf&d#rLYwoj<~+U=h12`QL(K=3wNcTIsdCdHLyuGviBlw
z?l{Sd*(|l83<lXtzzpZx1B2Tl8@+7OY!n(voyMD;?>g*VBn?t|H4@eui4!$V(SJkX
zBRYY51N1b1jta4BFNZ5v=O8f$m^~FBi{gi?vAng|1N<cwohk=4Yn+wlYCy_v!OMKE
zr5`xl!UxjGgm<Z%+@u8g+R${M)BTuM7o1A5yWGINEaIAlDo~Tnu(rH+h%DElv+nX!
z)09Y2y>Zg#+HEv*H#H+VPvG<G?bjmW#qziT5p(Z$4)#C3$ZRXGg3<s0n4(Z5rbrYC
zgfC<Q0YM;el-sQ<C=Lj#>^-A<yBt6u8^bVt(Yz=g2$MA!0%x=H4-L}u5A_QP3P<yx
zxPDU>IO}hU3vmr0pt(_;zZn$H@~6@>Bpl7fa9aj~!J)qqCdeJlhGP9q*x(>zD>Nsg
z9V20aL-hW5HA+N)Ls1!}j8a9bqcoHi?N4(mq8UI5t@J<e{~m}06#cg(jDNvI0&+4Q
z2@nP%0fB&o2;S(CfJbf3qQvv$5!zcS#p&e7k8`qYmp|bfMBWG>4tCEBdl@to#1fDy
zkz#W6;MMXdjmrIiKKZx(S=2P)s@o!(-=yf1*+g-F;U014!OEal{NO@qD(u6kMdS96
zS;e&@Ybv`R<#M2)sLG1RiSP9$!nd>>`jZC~sFI*rGSpM?#R;|NM$m{v3hUF?N&&v6
zNz*yJYw9-P+`hyA2#!QY7j(FzDougfD{Hx|G5E=$n;Epbznt&1<gGIy%)yJJn^&Qp
z4YyABb5ytpzY$C0P`KO5GZ@R)J|6uvj*Z$gX)US)bbi^<IbM7{SZZhO+|vhr?^YdJ
zic*7RKukaYumph;MxA49^4uvfKbZIEp_tm3P^l(HWo)$I!tAC0B+eB6TSUfPF+>Cc
z_^8~^cX=t*uBi)^Z{u+;4yi(VRZBR*qqsZhZ61y40VOdfcXAuP0k*Lm`15jN)KJIM
z?#cL(qA73d1n~_wO5Jh{u>)asAJ<mp@bO+!zoaeLML1}1$loR=*EG9*<;j#IHqgPE
zu6HTS3z50r?(<0@&L+Zsinc>(N2<ccMOjn8{LlFCXM?vEEyBW$29+AmG%QT(<+;3!
zk=N*=t6MBZ5FeY)6;cIy=$i@`7h8y1XQgzf?qIjJiH~P54r{rEapuF$mQZi49*)kn
zZM3gMct3kgtF%O;GfK8wy1O?EJKd3lL4MX2Lx6Cila_C0iRQDVWJtb62HE}5bYX?o
T!3(H}7J^_vU?vUBOk@8GlfT%S

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks
index 3e5893d0b6b70f14b3facfa5b2d660832b33fe8d..23fc75232fd6eeb2521d026f311b450337e3204b 100644
GIT binary patch
literal 1218
zcmV;z1U>sOf&{(-0Ru3C1a}4rDuzgg_YDCD0ic2eXas@;WH5pRU@(FNTm}g$hDe6@
z4FLxRpn?QVFoFb00s#Opf&@Ya2`Yw2hW8Bt2LUiC1_~;MNQU<f0So~KFdGCEK1>AH
z(oJg(!GJ>dbrg{f`I6<{0s{cUP=JC22(*l9k-guwP&3obJKG=afNWZF<8ZUzSF=-)
z-{vZhko7ZdO2MJzm`VWiydvcsgybY8VWQ20)NPiNKSFk<vmxEW6rWiMVADiF#AZtL
zQ{XT8UM%M_P6+bCnrkX(rD1VF(Fa~J8@6;X+}HavW?ymA@{g?3i)bchB*QiD!Gnaf
zHn0WUUKkgTwu05O8>zU%VCY~(+~pS9S5s@)@wl*xWZ@e#yj%R@F&q=28S`_LqSU*O
z+#6nQnEKA@^Ml5I8dn-2?FQ!Orbu`aHbewTq58sH78#W)+s=cUAlL>(x?2&Gmx%4%
zk)oc)o$b5bD=JA^7HEziOjlgo`tlo8)0!A~`5dzEX_gP~Ke;qPy5Ug`0vN;W%qga~
zWSWl_lY+uD5;6Pl?<HR$FP6wj+VZ#vr^uj{2S&<Qqk|lxb}_pmjFA$_X>yT8zwCaF
zcm}wgkkbH6ofl=h6gHJ3z!*GKXcp`|#aEEE<DHi9793j8lQ1$=oi-~$iQno13*2sO
zx$#0JkN9=XuJN(k+KZgltI$9C;pVlV;V`fJ3Fq;WHnd=`IRB?VAycEweMnJkdJv+M
ziv!&vRfAeT@=~3;&@E*_6}jRUwRzI(AaV-hOJKB|V|>oTMudB}6g&eJz0H7CS4I%2
zDjIU97;FhaB-!^k0e_c*`S>5LghOR2bydT_q8(nJa?ov;S5~1CrizC5At6?gvCuI7
zx4;<9OhUM}GSsa-kf5mQHt+Dvc=>;CC)<|vW5lxSmP;JNpqD^*A{tyn&kLaH8786r
zLnc~i#u{`Euy!I{rRm!snplNcPTKa44zG3*<8%nZpC@=x3oBMI;l>mB=1@;l|IzJz
zW&c&F{|VR6lm}|z-6fH%_YYl_r$U@6XwKUCTAJIzO{EdO0iNbBpO2+NS=HR~KaBL2
z^9|6S<qtd42+b=%k_=SPUh((bc_8LLqbs|PJUnw9{>{=Wdxh+BOee5;T|qK*f@^Jv
zv@t7xBuL{MBX3+y;=Q|Y+<H85l)g%%Bl=+_nE|DZpGtle4IkV+p-)tKjQzQvHS;cf
zDejRJM~0_WIct%3kXpqmN2xKH?l_Ql?`{Kvzi|sp`V6-`2JS9$R_Q;hA$35*&UV|t
zntHS+$~JwEyRO!!*zoW&Fr}`w7Wm?bE^;Fz+UDz~H!;2$S0;FGI2Es+^}bD=I7^z)
ztYF7YY_XCW(RrgsnSt=rAwi{d!UhI{qaUptw2}xB8RiEtOU_W%PDF&w!?<)5USwLl
z8SYI$pLUjwD=}~%{6j0?a?7u!aYnJ7hvzBolVJ$0oZYTG^-zRgq--k1lO_PV%OkUM
zLaCY`)!#cRjSEA5Z8KDp!7x5BAutIB1uG5%0vZJX1QfMBq}JS<ZLvIf66q_W<^0Rv
g7+eGt2Xwtb3Rc>s4BrBFh_3+*RBF9&0s{etpoC~VXaE2J

literal 986
zcmezO_TO6u1_mY|W(3o0#i>PQsYO6;-<Dad%nYm%dZq@J3=GV(4Vsvz8#FQ1FJNY3
zWMX15xR(0IfR~L^tIebBJ1-+6H!FiduAzv55F2wS3!5-^WPWLpbAD-FNl~StkbwY5
zltY*kBpO_jSdwZeXuuB=V;ANCtIRB^G!!u40|{{nvx9{Ei_#6b4LCs}+`>$rA%^@w
z>wp|)VYXnf8x0i1d5ugAObpBnEetFTO`|0EjSPVT#)igF0eU;AiBSnTNElfen41{+
z84Q{jxtN+585vH*N~^M%?llXT-CLNzom_PEw*7B@)gAI$r%r5WU=Iyj$sKIK^YrJr
z&GTxXAD<fbA}p4ztn>fB!Y@fS=5r>$+Wgr_v~2Mk75<YeEl-E*&G@nF&I7C0M@w0+
z`e!nw&2ydNEHADfx_s`tLy7zD%M0ww{9=FlsnRR9J14_lKD3KrZYfqwTyjrsfzU7c
ztmB#A+S}Tn&t9dWG~;#HNj<Ni^XYqB+*%AwZW!!2*S_)cw(}XU0_>hd&0SQ`H1|%+
ziT?>g{dMc-tUeykKJP;Hv7dKX)s)ZvzS8^bO_aL%i9NZm?^^5Mdh>mK5uf<f7`@#R
zkKT%Q1Zr%aFK#%${kQ1p#m2=ltC^S?85kGa8dw|10%KB^k420{L?q|gpA}k)2ixaG
z{omzrAnQ*3iFF22AZbAsVFSS?&Yb+@#GH)$;*xfjdSJ3d4q#xK0|qc7gA7Ma^qtH%
zMhgBHtex7vetEE)>vWS$pYOYM5p$f)5-qh)XeG{i>>BlKWjNP%g};LC+yB1V$i1?5
zcEsmR)w~a_1ON5UyqCqQVAyA`98;yL>oV`6jskD5eUIGcd9U8h4vSRnu8>&yPewPn
zX0?NCO%&Jeh_GK*PAoL$xgBTtcgnk65i5(ft(tR1+t=pIP7h5jd6}NIQ+6<z+Lm?6
zi>-Dxe|M<y@T{)11vey<T-jU8Yr2^iEizx{x@nJ___6RyCze^deY*L#;yZ80F%R1v
z;X=Ztyi;Zs=CyD9ssB8&eaAM&%6O%?mwbXQC4K#3T?<TB`j$BumU*|#@Ala6<kH)w
b_@5KLnI1p%>(Q>)os+h26m@47HFW?0s{U>i

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks
index d524c6268a563a3a371d26812554b7ecf92a3458..2cfdbfc6d15619d85f56c986621687734860eecf 100644
GIT binary patch
literal 2615
zcmY+EcQ_k*7sn+c_KJ~Qt0A~{6B6ap3fBl76d|QmqgJb^QF}C0u2ziJo(Woe)^1T-
zDQdN9^-?uT#Hv-}b>HWG?|tqczw>*Z&-a}3oWDLuBAW^jz=$NWu7O$QqHs}roB(D3
zg~&PsBC>uy!{bOIlk2}CCMyt;$>I!~p1o^e_Ww<BumOM+BIqZQ2--u+g4zC$&z1{=
z_^)JpirjQbN{@K-ggYY_N<W{KO#?DAbeMpMpx!sYBBbWc(Af_-L;4Mqp<egAn;S;6
zIS3m+q}Qt34%V;!mJa8W(`oFH`WuPsyl}M}B#>|+RFz`|URe#X*MYcdi3;3G7~>n2
za&X!-H0BORq-~CDE=?CPIbMuF$1&;!)=+e_9uHq~y6f~szDpJ{INk{_+4>G4rK88T
zqg;-<yF#}=CRSk~L%w3$uUUrkmN^axVwVL~XU(LSSEv^jx;x3di4830!xBQL#t6>2
zTNcu{V!e8i!ld2Dj>;eWxuDFSeQUx<%`x^$SXA~A`THYupFGMo$wcpJVhqk63kzpA
z84-KLRr_o(I6>W+JKFJdupsLAHGZJj^6F%x8okhpZd2#%=gpZw#@sa%Y)_M0waIz-
zjpggeay&#`)c`gXoD%o+K(sQcQF1iKOfRYGWa2^G;VYSrtgCugQuodoQP}F-E_)es
z=?1nC_#bN!>qe`H@}=gARCS2;cn7PX>C_N^0Q~r<Ny{UP4~)teAGT;AWhRp^wDX_?
z)gJDs6bux?I|8+BR9X-Av-ni~N24wMMpG-34`?zIl42U<ti4VGX@0MfBhi9)78YFP
z?1@T7NbS^oxuXROo`T4i_{<z1-ZqngclXj3FT-2eTkgFr#hTKjixWcOjoOvXH7dee
z{=6ssF0U4R6Zi3S1N2LCrqlznw@A_zHTKguf5GvQPCP9R?@hMxGQXV_PFvP+m5WAf
zjs3(;m`a(LRL~FUOf|~MZwDevv?#>t(Ruc~zM;7p=}Zy8%i}G9BXN%R=7l*ur$$TZ
z$90HbieK<>L8<3JHN}t0%yAK%bGg^~LVTXGsjd!s%OuOb8unSuhub<YXz>Cvlxfu8
zhNoxEa}`1i1rtUBk5yR<FE()5q_PNP*?ZuU`|{%ujV3mtZ%0y2tyL4Amut)#bp|Bk
z?hKUj_*8*R*@7v)BHPn~gGvMytq|CZFHbzA)mLuh&b(!DaOE!fsWTN?{>?>9#@g{Y
ziv%;CWU?vDUM8b=>>!44WHgy%-Qrsekh^4F`=wt}O|iW{`Qdwuyj}aOYh`ruymiBl
z6X$PU9&rF%HuYS)R9Xrb)+*@kb=<&cCdTd4N!QMewhGHhZ5UHovp}^SgZnT}>3im{
zo4P>Km?lN3XNzhhoDETZ%(<W<+OBc`H4cUpHOo<wXrkmhu5@x&jTTK#z2b+I;Guni
ze8)m*V2A#n6CO{{?YYy-PwXp?##FRw8DyUlZkmvu{E*aNaby$gXVjuZYa8_!tXrw1
zPe`xZzt}fR-kS?$c$rI4?*kSzKCq&xgbPJVB#vAoz7LM2`n{D6y6V&wDv%W|<#;PE
zETXY=es(UW9pDOK{36f6>k>45=M#h9bil#yfg82<pSV6d_v&@u?X4upaMwAA;Pf(j
zVti>Cs`*G*pk!XiilD{5+V6jQ<>oFZ6rn|ivw_D>OC>dpm34E`mo(n2l(`vW3x~Iy
ze{29;4Q#bDp!xd2ikhocr%C4&KRjnStRENbth*@1-&C-s1ei5vuD-FzT}Ob^MZ%0@
zDAv7L{>QtseH54^$&bo*dP3u5l7uryet40I3vE(u>iW3#D-ByEDIp;_?WE(W)@pz*
z5kg^+!hfrhl^?|=#=+pt;K<;`@bIsS6#pj_K=Feh=C1c0;iwB3v^olN0j;WnMxM#@
z&fiVU;4`1%&(L)sfZ^;j`X>SW%dp_T44WQtGiBAcA=e_-+<nsfYtrEx)0F=jHk=6J
zDQ_}U{F)WFjZrLhH^-05@2k_xbw*di1xa|dB5Jt%kf?3nJ2!B~o3J=y)}+HT%YbI-
z=Mx2_$@}`KiOQLY9sZurK6_5x0SpI&`DxGd$l-|c{!T~%R_&o#D$mVJyw3QI$h?6_
z2r9#@=o_|M_ZN*$jhLxi>oBySoHEVR#%D!fsO)-rK7v!>1Z%0(jBJG%3qJeG%;ws7
zWEJ=axZEQ;CkJ7y)gaZbC6dl^%Bkbb70j!s6CYBVONFP0Gscp1M7g0!?-tam1yb+l
z6f74aE_`ppJlcYh-aptMf3nz<swoaI@bvOF2FA63f^+<DP5E#;WPFGm5<j`peq@Ky
z&D(Z16BoA#9Adb^m?pp4-Eu1v)*g4OITj<BNUub*tO*I}B~^fz$9A_lHU_hKw2%>3
z*Q<H?1iI`F;X5Hw@<F>JOo%-9-xVeRu0f%&SCH~X$#@T;l^;Qkj3_Qb!xm=V*9NoF
z1c;s!u#7dp!CT+o1Jp?ZE#}lsI}&a$PzInDi)E#Ld+D!4wY!{W*FQSj;T8AkiRz7T
zmeXn&g}MF3_e}jRh3$fzE8~ci)Xb}Ey6hoFMtesWuytQdH@yz;KkWJ3vNlX~0a5dt
zDqN32H330cctT6)=%dL6KPc#2#jaaz(*SQ=K)G<esWy<8z$<2|G52D`C1$D~y?JOt
zFOp%KpH!0>gXjls_wcQGtic5^-Xq*=i@Uw}k&Q5erH0Zrm-lIK+-*CyN%x<2{u6oC
zrkY0dX8EnPE(Od56-&cn(fZTcit+3@rEgUW>+LASi!gqrfREpOoxJ<^Z?bFXwDeN(
z+G)q0kqmeH?x_@XqEd~y^cUdqk{B1OyQ2ln!bg34r}hLE{pvfIr~RHLGd#-gLNYMu
z6D~so>sGRxN~7d9+k}wZZ7by^r}ZDo;Ac#iQod@L$Q0+C-5A}&il(=n7x~%Id30n5
zUTQPUR5k>^#hF@C`K1*6jReKpuY?PE52Z^SoEsuYHKr!{ldr|DE|cM>5t$v#1hG&z
za=#VZlH6MT_G{UEkkKVZs}Wmq(KwUtA=#X&V{m4Dl*Dt943d4+Br8p#z#u3OCu@*w
zb>7a}HiUjzF2&%JWW`hSwh&Q=gD~~ui)dcmW1~)>l&w1u)y1p2dNR48hHFK|YcI}g
zF0`>!=g)+4w%C1!YJyX14wif7)*lr0>fjhvV=Q7;drsIs#dSfq&uhrFsl%`PqTjvb
z8s^9?cXBVSwT%AS9n4~^_>FSM*gp-=#}61B&?pHC{zEPsHq|ntJ+N%r>)C`c|Fcyz
z9<fKgx0*3Y?u5>bXCHmpfF2aKf1p-cRdYjOG;O~s4O0SARe~vAYW4ERKi(}NFCoQ|
ztY9X2E=Hgb69b5Uq%fPqg$8AoiB*$6lFo~|H(JjD;?K@4Y~8cS&wSS`_twL~Ds(!+
LDig>Eh@$)lE|<XG

literal 2276
zcmchY={wZz8^&idmcdwtq10HiZ{J~%UD?T=!K5;T6ejzUbsmu=OH>}qV6;5bSVDG5
zgs~^G6h(!?NFhW#bo^dCf5Gp?_2T?o_i^0!abEXvUVF?vCI|$A92EFZ!Gk;lLp=iz
zWct&;$Lv8M76?Fw?E&0y4tY2j29|^Hg25~x7#X&RrRO^0R<cSo@P)&(+vSM)pmC;n
zdC0h2+KB%4c;kLY`c$j-Rq3#GsZS2v)pyIxGn?#*<KDFh8wgvHsq3iu_hy2Wuf4y8
z|HG+5X7zUD<V1k5@>BjBOV!euWf-06fi<@VW;!n3%0wLLTE)O+?z*e$ZjGB*dVl-D
z#eBd-HjTh?z!$wPU=}w|vcP0VaRs?fzo?JD$Hae&d~_k0X*dZobhoEhZnS0g=TWm&
zN)(FevHh56Xl+7(pS%=&*|jzT&dYx-%f(xH@^YQ5B?4;IN{yZ~T<|mg4))ibXB~UY
z(K_hN=@OLspi~z{gnyjLSpCNq=nq!f&7=Bl8S{~&=0bZ1x@yAO7#1Gpx&-R@oG@}C
zKHXYeiHOq(-T7e4jEv7-dfxs}YMxx^^cEE*|6!{-;rvG_t`*ALcpJ9y`)$5rZ+zCC
zk4B6YWvkt%?XEV4^TCo)(6Hkb7P~5ZxEKC;e^p&Iv(tHtdbHY3JrTyL>vQFGIU|*d
zD{j>nznX&ffE@W15Jcd2IJJRu5U#70-?inGVHJcZRq8D~=QS{ieTFFu5gF2onJKVc
zsYjivJJlg@Dd+kSWn+IYO*MVxy;$8@h1oa=Pn7!YnCud#H-rwo4C-mRT5NCKa>%vv
zBt80YaaZwUszY+@XZ1O<eqq*BhqXn!`ms4J!<tSq8ry?M0A{Q^8?q#?P5o&)vX;g@
zA@Ydgl30q8GU|)(uOtn1gzW<zcG)d;TR(YEkIe+0S#Yd?{P4kyTD|t1@ZQP1l=q4C
zr|LFLb5-VcN!s>gu;ACu+ya-77MHj_w}uj&9>>fL5;moivE@E2*hTidch*k6M3D}9
z`J-@{#kH+xM$eRcuyW}A0)Ke8!xyJ!BmE!TKk=_Lca_zB1MlhAK2_lRhGRETZ~}J{
z8p=H^v!NzzrqkhdT1Tp@p9tPej-JsL{zc)8C^_9P{~W#NxQxy4%Mv@InvsT*#FLQl
zPl-dd0&*rKM6&*L9w(;A{@R`9FZUl%%?*s&ltl1x5?~3IRr{AE_uYm<To&^{Y8I6*
z71y{23HYFX%l*6@qO_M~X#vrjC#~*<hP4KZtbm)SclJ#W^dm<UanX>@C7s$hED=ZR
z$bxS6Tk6<lGNeP~dtF+7$EvTfKaqA<D|=Wap!!m_KDsC4YHSx;K3oD@?{@D}Krtxt
z<ho;`Vl6hjBE)(~T%Z_fw}0CiIiHm|HnIEFGm_#m87t%1=h~Y_KJ#<q8Y!a8KxAX1
zZnY0GSXN?*t68sDr$(JPQPZJwK`TqPn&TypkSrJ4Xt(ddwB^l6E2#ogyN1?jKJnRr
z+&-p;D_o$Ew2>CnB-|~8xtE-F+dX7NP;*d9KFU<|BWIk~6pf?t!49WFQT6mW>%X25
z4fD6APEFMJe57@IcJ!Opo9G>v+!7oxju3@AC!mB4Xt@?u$q3t7&<MTZ>ku@!H)~s&
z=}cfNCfzU+N39BWMZZpoAtYmI+8pN3ta~{qQ#L1=3*W{x*4LjmHtKwsKDjjF(4^>o
zH`VN&X2zCH^xJcq?6Fj&F737qqCAXjE*I*p6{KH#BMLTZRPlK`BU{socvOg4Xpr2(
zn;CP*veIz9yHr7NV0{ODI$F#WbmrY%2AOJ_Luosa+m2qK4iNt&Ba5?=8lVXRLGuAJ
z^d3Nl#1=y#U<d>TjCt+?TyS=|M6<+AE-)Cu0s{Q7D1Z+Rb%eqB5iX>VKtoc9e{f&~
zmJi@Lq-^}`htwgM80?AV1(1h~m7nd;NuS^dEYCsS9v}{W)<a|y=#51H?1u!w4>3QB
zMIKytAfWtkhd*fzh@!bvZ~zWa$DRZ<v1$Y%qzd)`sA5(B2map=B7?>MYstaJfRe#T
z5I_cVK*(S)h;ja?Buwp@x^4cg05^n3VCOsi9i(IfMy{9fB#zY)PeV8WoO9cQHI(Ru
z?mPG|`1A14<o&&Xb$1<&g6zebH5Gx-(&ZD#9-3yKlTz+h)6|UCQfCOu8yg>p7sWWo
z5QA2Bd{ns7PHg>v;c4|**YBGXUxZKf;J?o5xk3|y#EAFbOBM6|!d&V0`I(fMw2=Q;
zMm%>3-=kz<KjhtFWRd{jCV-Z~q^gm+q05W5dY=h})NACzsRYKp8(&6DWdXhWA}i(9
z^{(wH7Ac8=ozYwK%LHi+MvLFlw6^lw<;}`KZuA{jrDmazOo5wrGBrhLY*EsVKwqh9
zkO&<D1%tq)x_~xt>|m0|xM6}Y6v}sg_a8a27fBStev?_-m8n=p1#slB%?slPc**R(
zBoCtRWl~UZ5-j#$LI2m_gFkm*Fc>7l7IkjQXIVwm=9Tv8#EtctW{y6xNV?TZg>!+S
zI#E-eAxF&nWK5W+IdRmB{^m8U|Giv=phf39uT@{?n$@=3%lP~K6&6u!y1s;Kq@<z|
zWmrL!>z01n@fynFN<Q92GBsR?wkM+K5k)sR7DeD_cE<l2Wt6CLzPo_^owL&9Obe`g
zTretcrPJSNCM$;#Nh{B30IBJQreFl=h8ipF@f~?7Ud0o_?#8S)!lF{4RH{aWadnFc
zy36S`<DsU>kICQRn_M@$%yb)^`1nJ(a`FQFld86r7l=s>b>N7L;upSh^BM)GX9%Vg
r<7if)2G~%`grZclC!b$4$rl%iYqB47iW08)7YV`TvW{*o%WnP)0leK{

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks
index faa3228368eafcfea74aa091b4b164d26d1852a9..33d022ef0308da65d1d627b5e4ca4693028d9809 100644
GIT binary patch
literal 1186
zcmV;T1YP?uf&`ud0Ru3C1Xl(LDuzgg_YDCD0ic2eNCbieL@<H`Krn&?JO&9WhDe6@
z4FLxRpn?P~FoFar0s#Opf&?N42`Yw2hW8Bt2LUiC1_~;MNQU<f0So~KFdGCEmJYs?
z2AwJ=g;TBzbMuiv*ATTk0s{cUP=JC1=(-gB8UtpU{n&&);WkDq<gM%zi)AlPq!6ho
z8_9}?KzeLo5_wJ%vrP9coGN@yEhi;3twwmiuc%Tgt1k!tEg_(&k}osvJh44T)i#7y
zAkw5JS5||iF~jW3is;e0T$dM1rR%3j$R!cRWy3cw7kF{uv8|O?N2wkn>Tyc`wqS=+
z0tB&7YZtKRkJIxiY>YsP`)LH<#!#AbS*fxgtaq*HPPaR)`T4!ap<SMV2{kQpEQ0pZ
z4(gj|GTv262S4CN0FP+yV2tWaq=RGVa*SHpR>440ENmI+IV;83E}K%1H(>w$31df_
znXq^NhTVZB8KK+fy=r9+L==1Nb2$qdOBgMVD`G>)|B=aglak0Re-1!%%oL=0rkxH@
zTgViMtY{k$3;K>ch>62KE(o*VYD+>!lWAF_v*$XEexL^9g~6v2Nt7rsTS*?+Mf=*G
z3BMO58y@W(i}!A)nfAu>IolDhj25A4eISX8*9vs{Bopi^H0KkR@BGZO_{s{6r<bfE
zhJca#6XN?sT363H<G7gJ)zz-ugavQ#7d$lzwx>_7!<%37E%5Pdkn$=(2U@f$wb%M0
ztx@KiY$-l5umom`mpzYTxkbNn<X%JSWdl>w`M3Do#tlf$cv17CZrGt>UAm$j{A*Va
zAr<PhNVIe3mE~~3DLQDX>%wIIcbD(<TW%^aX-s~E*kdqK8TIT#O-wP>q6vfaD0W0x
zUbk+w-rQtmQoF-N=9qhFWg427_Q^I*;ND-nS^$&-Dqd6)I1Lh7IdaubqmA&3pZymN
zyo;Gph_-o@ndu~OZ_>B3%_TQ9>$@5_IML*?o*r7<MT!X*nyy!qwFpC{jYFdTA5q{`
zU~ebFhDHMqm69WV3-tt8cHD_pA+@?uDpxbk4{iu!!Myf21-($BVv%b9iFdOf!ZFZ@
za|GS)Zv$m}#hTOWOfhDy&zP*IfdFlXFtpV<y>ZY?_v%j3h3o|W2>YqkvZOr<gC;0)
zIz3MK?Dpv*Vf?=62{nK}wxqsDdKXTATi1$v8&d-TxXdyn@V9clb(=K@3ALfXN=C8B
z{4utZ*_eD&!279*uJkrI8uE^5EGC>Dap!3Fu!#zw+@j#JxD%{PRTh3uc;c@^tKqf}
z-oMk_I4~H|D<xikuq!>XiCYEWOo{Q2Nh2`|vxdTG>c!gmz^7k}jd#NKS1t7kbLx4g
z7Ie?xYrEA6Y3YlJN(1+6!wx_Y=`fb{(+6YMt0xfj`UTjj5v1M1fq^Jep4FPZUDWqx
z1VY}uF`KME^Cmfxs!wE4lLq&>QSfREy2@Lbjv|Gqn37(|tuQ_?AutIB1uG5%0vZJX
z1Qf#om0zQa%_Q~Z&Dy!@lgF0~ig^SS^+(|Y^jUq}q&`M#AH_R7WH~__0s{etpkmA?
AlmGw#

literal 958
zcmezO_TO6u1_mY|W(3o0$vK&+c_lz@-<Da`y$q}odZq@J3=GWm22IS>22D)K3z(T0
znV4AWQ_7tTc-c6$+C196^D;7WvoaXu8j2VQu`!3TunBWV=9d;Z=a=S{6jd4u83=$x
zIfOYuqQNDJC8>sj2K*o~c3}>%%FL2VLjeOmkPw$JJ4ndCDBY0TfD<IbEzIN@V#p7)
z4#;5^W^)F+(Lh0**T}@c#K6qZ!obqRC`y9g$Pg%CY-kJ>ptpmX7?qHNgprkjxrvdV
z!Jvtei>Zl`k)fkXq~T1#)ScUu(&Xlyxp{H(s@VUZKFMlvJ3L6<sBm6f@z-~$(^+mC
z=QpQnn^r69zAb*Syxwx<&w?X*7mrTc+$X=fM#1KT`rE71(^T^152(bSTv>EXjAenw
zX097&12=s+<+H-?Z|G*8yj2c`l1ipeGydm>ZB6~qH{<P`Nvqh6C4IWtGmQ@Z-+Umh
z=!|L)=h73#1-af`w`PdEvIwsf%su^F@=Qa+{N3pWE4>-*p1zvN*_eFwRMNzob${Y(
zx6gXRtmw<~=<ItJ_RNjt5=VJgB*>pv?&H<3+aYwaS#;N>hNUgsn-5$KRkCM{KfHU-
zrA1-I>fc_;E}eAb@{8#03ww(-nV1<F7#AxV$Q#H4V^WrnMT|w{?__233(`w${7o;M
zov(A(y1(<z0^~phrYm3|GBSv67Tot;WYwC)-iIqMwgx9e_ewjjejF_Mx24wbi;(4-
z<HpLd>GO6bZ{&LSr0}alXZ@+&OZQ)GJ+tt7c4&vnyOdSypERcJRt#wm-nlyZc3am`
zwFs63`J$7j^1~ZvdQac=bk6mdfWqj|x6alTS&CEM?8<qd-x6LGb^YeIRlBs!xGpJi
z_OOU;5lxmU{`@GgqSE7}@g}K_4{tfoN;ur8XSw&SMd0JAwAtSG7Hk$j@b<mF)uZic
zpJmh?uh#~A{*pHPuGMMVlnVa2Tr!I{m%sRZ_TJ8SyPj5MZ<&2_Wssra#Km8>@8AD^
z!Jc&O)RSVI+ua%DJ7aBgr!2PF^0=FAZs5du>ARj^7s^f!&z#Mr&Bpd@%h@>o^49=P
CnQXTJ


From a7fe813aa3fee50c1a653b92e7f91e4c67f977ba Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Sun, 14 Dec 2025 21:46:58 +0800
Subject: [PATCH 560/591] ZOOKEEPER-4958: Fix client hostname verification
 ignored in server if ssl.authProvider configured

Reviewers: anmolnar
Author: kezhuw
Closes #2303 from kezhuw/ZOOKEEPER-4958-client-server-hostname-verification
---
 .../auth/KeyAuthenticationProvider.java       |   2 +-
 .../auth/X509AuthenticationProvider.java      |   3 +-
 .../server/SSLHostnameVerificationTest.java   | 529 ++++++++++++++++++
 3 files changed, 532 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
index 92bb380fb46..cf252b9b08a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
@@ -37,7 +37,7 @@
  * See the "Pluggable ZooKeeper authentication" section of the
  * "Zookeeper Programmer's Guide" for general details of implementing an
  * authentication plugin. e.g.
- * http://zookeeper.apache.org/doc/trunk/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication
+ * http://zookeeper.apache.org/doc/current/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication
  *
  * This class looks for a numeric "key" under the /key node.
  * Authorization is granted if the user passes in as authorization a number
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index befdecd1044..8392db6bc51 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -89,6 +89,7 @@ public X509AuthenticationProvider() throws X509Exception {
             boolean crlEnabled = config.getBoolean(x509Util.getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
             boolean ocspEnabled = config.getBoolean(x509Util.getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
             boolean hostnameVerificationEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
+            boolean clientHostnameVerificationEnabled = x509Util.isClientHostnameVerificationEnabled(config);
             boolean allowReverseDnsLookup = Boolean.parseBoolean(config.getProperty(x509Util.getSslAllowReverseDnsLookupProperty()));
 
             X509KeyManager km = null;
@@ -121,7 +122,7 @@ public X509AuthenticationProvider() throws X509Exception {
                         crlEnabled,
                         ocspEnabled,
                         hostnameVerificationEnabled,
-                        false,
+                        clientHostnameVerificationEnabled,
                         allowReverseDnsLookup,
                         fipsMode);
                 } catch (TrustManagerException e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java
new file mode 100644
index 00000000000..bee6abb4b14
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java
@@ -0,0 +1,529 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.Security;
+import java.time.Duration;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ssl.Ca;
+import org.apache.zookeeper.common.ssl.Cert;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.apache.zookeeper.test.ClientBase;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class SSLHostnameVerificationTest {
+    @BeforeAll
+    public static void setupDNSMocks() {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+
+        // avoid resolving "localhost" to ipv6 address "::1"
+        hostAliases.put("localhost", "127.0.0.1");
+        HostResolutionRequestInterceptor.INSTANCE.install(new MappedHostResolver(hostAliases));
+        HostResolutionRequestInterceptor.INSTANCE.clearCache();
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
+    @BeforeAll
+    public static void setup() {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    @AfterAll
+    public static void cleanup() {
+        Security.removeProvider("BC");
+    }
+
+    Watcher.Event.KeeperState checkConnectState(String connectString, ZKClientConfig clientConfig) throws Exception {
+        Duration timeout = Duration.ofSeconds(1);
+        Watcher.Event.KeeperState state;
+        CompletableFuture<WatchedEvent> future = new CompletableFuture<>();
+        try (ZooKeeper zk = new ZooKeeper(connectString, (int) timeout.toMillis(), future::complete, clientConfig)) {
+            try {
+                WatchedEvent event = future.get(timeout.toMillis() * 2, TimeUnit.MILLISECONDS);
+                state = event.getState();
+            } catch (TimeoutException ignored) {
+                // See: ZOOKEEPER-4508, ZOOKEEPER-4921, ZOOKEEPER-4923
+                state = Watcher.Event.KeeperState.Expired;
+            }
+        }
+        return state;
+    }
+
+    @ParameterizedTest(name = "{0}, fips-mode: {1}")
+    @CsvSource({
+            "localhost, true",
+            "localhost, false",
+            "127.0.0.1, true",
+            "127.0.0.1, false",
+    })
+    public void testClientHostnameVerificationWithMismatchNames(String serverHost, boolean fipsEnabled, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert mismatching cn/dns/ip
+            Cert server1Cert = ca.signer("abc0").withDnsName("abc1").withIpAddress("192.168.0.10").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+            config.put("secureClientPortAddress", serverHost);
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", Boolean.toString(fipsEnabled));
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+
+                // when: connect using mismatched dns/ip
+                String connectionString =  server.getSecureConnectionString();
+                // then: connection rejected by us as no matching name
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(server.getSecureConnectionString(), clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingCnName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with cn name "localhost"
+            Cert server1Cert = ca.signer("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect using matching dns
+                String connectionString =  "localhost:" + server.getSecureClientPort();
+                // then: connected as there is no other sans
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingReversedDnsName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with cn name "localhost"
+            Cert server1Cert = ca.signer("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect using matching reversed dns
+                String connectionString =  "127.0.0.1:" + server.getSecureClientPort();
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "true");
+                // then: connected as there is no other sans
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingDisabledReversedDnsName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with cn name "localhost"
+            Cert server1Cert = ca.signer("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect using matching reversed dns
+                String connectionString =  "127.0.0.1:" + server.getSecureClientPort();
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "false");
+                // then: connected as there is no other sans
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+    @ParameterizedTest
+    @ValueSource(strings = {"localhost", "127.0.0.1"})
+    public void testClientHostnameVerificationWithMatchingCnNameButMismatchingSan(String serverHost, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert matching cn
+            Cert server1Cert = ca.signer("localhost").withDnsName("abc1").withIpAddress("192.168.0.10").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect with dns or ip resolved to cn name
+                String connectionString = String.format("%s:%d", serverHost, server.getSecureClientPort());
+
+                // then: fail to connect
+                //
+                // CN matching has been deprecated by rfc2818 and can be used
+                // as fallback only when no subjectAlts are available
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"localhost", "127.0.0.1"})
+    public void testClientHostnameVerificationWithMatchingIpAddress(String serverHost, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert mismatching ip
+            Cert server1Cert = ca.signer("abc0").withDnsName("abc1").withIpAddress("127.0.0.1").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect with matching ip or its dns
+                String connectionString = String.format("%s:%d", serverHost, server.getSecureClientPort());
+
+                // then: connected
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationFipsModeWithIpAddress(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert mismatching ip
+            Cert server1Cert = ca.signer("abc0").withDnsName("abc1").withIpAddress("127.0.0.1").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "true");
+
+                // when: connect with ip's dns
+                String connectionString = String.format("localhost:%d", server.getSecureClientPort());
+                // then: rejected as fips-mode don't do dns lookup
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+
+                // when: connect with ip address
+                connectionString = String.format("127.0.0.1:%d", server.getSecureClientPort());
+                // then: connected
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationFipsModeWithDns(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with dns "localhost"
+            Cert server1Cert = ca.signer("abc0").withDnsName("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "true");
+
+                // when: connect with ip address
+                String connectionString = String.format("127.0.0.1:%d", server.getSecureClientPort());
+                // then: fail as fips-mode won't do reverse dns lookup
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+
+                // when: connect with "localhost"
+                connectionString = String.format("localhost:%d", server.getSecureClientPort());
+                // then: succeed
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingDnsName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with dns name "localhost"
+            Cert server1Cert = ca.signer("abc0").withDnsName("localhost").withIpAddress("192.168.0.10").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "true");
+
+                // when: connect to "127.0.0.1"
+                String connectionString = String.format("127.0.0.1:%d", server.getSecureClientPort());
+                // then: connected as ZKHostnameVerifier will do reverse dns lookup
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+
+                // when: connect to "localhost"
+                connectionString = String.format("localhost:%d", server.getSecureClientPort());
+                // then: connected as dns match
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"x509", ""})
+    public void testServerHostnameVerification(String authProvider, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            Cert cert = ca.sign("server");
+
+            // given: server with client hostname verification enabled
+            Properties config = cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "true");
+            config.put("ssl.clientHostnameVerification", "true");
+            config.put("ssl.allowReverseDnsLookup", "false");
+            config.put("fips-mode", "false");
+            if (!authProvider.isEmpty()) {
+                config.put("ssl.authProvider", "x509");
+            }
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // // when: connect with matching dns name
+                Cert client1Cert = ca.signer("client1").withDnsName("localhost").sign();
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                client1Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+
+                // when: connect with matching ip address
+                Cert client2Cert = ca.signer("client2").withIpAddress("127.0.0.1").sign();
+                ZKClientConfig client2Config = client2Cert.buildClientConfig(ca);
+                client2Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client2Config));
+
+                // when: connect with matching cn name
+                Cert client3Cert = ca.signer("localhost").sign();
+                ZKClientConfig client3Config = client3Cert.buildClientConfig(ca);
+                client3Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client3Config));
+
+                // when: connect with mismatching cert name
+                Cert client4Cert = ca.signer("client4").withDnsName("abc").sign();
+                ZKClientConfig client4Config = client4Cert.buildClientConfig(ca);
+                client4Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: fail to connect
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client4Config));
+            }
+        }
+    }
+
+    /**
+     * FIPS mode disallow custom trust manager so server has no way to validate against client's endpoint.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = {"x509", ""})
+    public void testServerHostnameVerificationFipsMode(String authProvider, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            Cert cert = ca.sign("server");
+
+            Properties config = cert.buildServerProperties(ca);
+
+            // given: server in fips mode with client hostname verification enabled
+            config.put("ssl.hostnameVerification", "true");
+            config.put("ssl.clientHostnameVerification", "true");
+            config.put("fips-mode", "true");
+
+            if (!authProvider.isEmpty()) {
+                config.put("ssl.authProvider", "x509");
+            }
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // // when: connect with matching dns name
+                Cert client1Cert = ca.signer("localhost").withResolvedDns("localhost").sign();
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                client1Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: fail to connect
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+            }
+        }
+    }
+}

From 1c903df950553610b3c67f2edda61f40205c5cc7 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Tue, 16 Dec 2025 06:39:07 +0800
Subject: [PATCH 561/591] ZOOKEEPER-4923: Add timeout to control brand-new
 session establishment

Reviewers: anmolnar, cnauroth, anmolnar
Author: kezhuw
Closes #2253 from kezhuw/ZOOKEEPER-4923-brand-new-session-timeout-control
---
 .../java/org/apache/zookeeper/ClientCnxn.java | 40 +++++++++++++++-
 .../java/org/apache/zookeeper/ZooKeeper.java  |  3 ++
 .../zookeeper/client/ZooKeeperBuilder.java    | 17 +++++++
 .../zookeeper/client/ZooKeeperOptions.java    | 11 +++++
 .../ClientCnxnSocketFragilityTest.java        | 10 ++--
 .../zookeeper/ClientRequestTimeoutTest.java   |  4 ++
 .../zookeeper/test/SessionTimeoutTest.java    | 46 +++++++++++++++++++
 7 files changed, 127 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index 7663e27f68a..020f9408aab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -168,6 +168,8 @@ static class AuthData {
 
     private final int sessionTimeout;
 
+    private final long newSessionTimeout;
+
     private final ZKWatchManager watchManager;
 
     private long sessionId;
@@ -398,6 +400,36 @@ public ClientCnxn(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly
+    ) throws IOException {
+        this(hostProvider, sessionTimeout, Long.MAX_VALUE, clientConfig, defaultWatcher, clientCnxnSocket, sessionId, sessionPasswd, canBeReadOnly);
+    }
+
+    /**
+     * Creates a connection object. The actual network connect doesn't get
+     * established until needed. The start() instance method must be called
+     * after construction.
+     *
+     * @param hostProvider the list of ZooKeeper servers to connect to
+     * @param sessionTimeout the timeout for connections.
+     * @param newSessionTimeout the timeout before giving up brand-new session establishment.
+     * @param clientConfig the client configuration.
+     * @param defaultWatcher default watcher for this connection
+     * @param clientCnxnSocket the socket implementation used (e.g. NIO/Netty)
+     * @param sessionId session id if re-establishing session
+     * @param sessionPasswd session passwd if re-establishing session
+     * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
+     * @throws IOException in cases of broken network
+     */
+    public ClientCnxn(
+            HostProvider hostProvider,
+            int sessionTimeout,
+            long newSessionTimeout,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
+            ClientCnxnSocket clientCnxnSocket,
+            long sessionId,
+            byte[] sessionPasswd,
+            boolean canBeReadOnly
     ) throws IOException {
         this.hostProvider = hostProvider;
         this.sessionTimeout = sessionTimeout;
@@ -413,6 +445,7 @@ public ClientCnxn(
         this.connectTimeout = sessionTimeout / hostProvider.size();
         this.readTimeout = sessionTimeout * 2 / 3;
         this.expirationTimeout = sessionTimeout * 4 / 3;
+        this.newSessionTimeout = newSessionTimeout == 0 ? expirationTimeout : newSessionTimeout;
 
         this.sendThread = new SendThread(clientCnxnSocket);
         this.eventThread = new EventThread();
@@ -1192,7 +1225,12 @@ public void run() {
                         to = connectTimeout - clientCnxnSocket.getIdleSend();
                     }
 
-                    int expiration = sessionId == 0 ? Integer.MAX_VALUE : expirationTimeout - clientCnxnSocket.getIdleRecv();
+                    long expiration;
+                    if (sessionId == 0) {
+                        expiration = newSessionTimeout - clientCnxnSocket.getIdleRecv();
+                    } else {
+                        expiration = expirationTimeout - clientCnxnSocket.getIdleRecv();
+                    }
                     if (expiration <= 0) {
                         String warnInfo = String.format(
                             "Client session timed out, have not heard from server in %dms for session id 0x%s",
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index b3b5af45472..7533e01a9d0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -697,6 +697,7 @@ public ZooKeeper(
     ClientCnxn createConnection(
         HostProvider hostProvider,
         int sessionTimeout,
+        long newSessionTimeout,
         ZKClientConfig clientConfig,
         Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
@@ -707,6 +708,7 @@ ClientCnxn createConnection(
         return new ClientCnxn(
             hostProvider,
             sessionTimeout,
+            newSessionTimeout,
             clientConfig,
             defaultWatcher,
             clientCnxnSocket,
@@ -1148,6 +1150,7 @@ public ZooKeeper(ZooKeeperOptions options) throws IOException {
         cnxn = createConnection(
             hostProvider,
             sessionTimeout,
+            options.getNewSessionTimeoutMs(),
             this.clientConfig,
             watcher,
             getClientCnxnSocket(),
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
index f484dcfeef5..03b5f4c4ec0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
@@ -39,6 +39,7 @@
 public class ZooKeeperBuilder {
     private final String connectString;
     private final Duration sessionTimeout;
+    private Duration newSessionTimeout = Duration.ofSeconds(Long.MAX_VALUE, 999_999_999L);
     private Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
     private Watcher defaultWatcher;
     private boolean canBeReadOnly = false;
@@ -117,6 +118,21 @@ public ZooKeeperBuilder withSession(long sessionId, byte[] sessionPasswd) {
         return this;
     }
 
+    /**
+     * Specifies timeout to establish a brand-new session.
+     *
+     * @param timeout timeout to get {@link org.apache.zookeeper.Watcher.Event.KeeperState#Expired} in establishing a
+     *                brand-new session. {@code Duration.ofSeconds(Long.MAX_VALUE, 999_999_999L)}, which is the default,
+     *                means endless retry until connected. {@code Duration.ZERO} means a sensible value deduced from
+     *                specified session timeout, currently, it is approximate {@code sessionTimeout * 4 / 3}.
+     * @return this
+     * @since 3.10.0
+     */
+    public ZooKeeperBuilder withNewSessionTimeout(Duration timeout) {
+        this.newSessionTimeout = timeout;
+        return this;
+    }
+
     /**
      * Specifies the client config used to construct ZooKeeper instances.
      *
@@ -143,6 +159,7 @@ public ZooKeeperOptions toOptions() {
         return new ZooKeeperOptions(
             connectString,
             sessionTimeout,
+            newSessionTimeout,
             defaultWatcher,
             hostProvider,
             canBeReadOnly,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
index 52a173ebfff..2605cb0f8c4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
@@ -33,6 +33,7 @@
 public class ZooKeeperOptions {
     private final String connectString;
     private final Duration sessionTimeout;
+    private final Duration newSessionTimeout;
     private final Watcher defaultWatcher;
     private final Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
     private final boolean canBeReadOnly;
@@ -42,6 +43,7 @@ public class ZooKeeperOptions {
 
     ZooKeeperOptions(String connectString,
                      Duration sessionTimeout,
+                     Duration newSessionTimeout,
                      Watcher defaultWatcher,
                      Function<Collection<InetSocketAddress>, HostProvider> hostProvider,
                      boolean canBeReadOnly,
@@ -50,6 +52,7 @@ public class ZooKeeperOptions {
                      ZKClientConfig clientConfig) {
         this.connectString = connectString;
         this.sessionTimeout = sessionTimeout;
+        this.newSessionTimeout = newSessionTimeout;
         this.hostProvider = hostProvider;
         this.defaultWatcher = defaultWatcher;
         this.canBeReadOnly = canBeReadOnly;
@@ -66,6 +69,14 @@ public int getSessionTimeoutMs() {
         return (int) Long.min(Integer.MAX_VALUE, sessionTimeout.toMillis());
     }
 
+    public long getNewSessionTimeoutMs() {
+        try {
+            return newSessionTimeout.toMillis();
+        } catch (ArithmeticException ignored) {
+            return Long.MAX_VALUE;
+        }
+    }
+
     public Watcher getDefaultWatcher() {
         return defaultWatcher;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 2b70a599d6a..27c07fe905b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -96,7 +96,7 @@ public void testSocketClosedAfterFailure() throws Exception {
                 BusyServer server = new BusyServer();
                 ZooKeeper zk = new ZooKeeper(server.getHostPort(), (int) sessionTimeout.toMillis(), null) {
                 @Override
-                ClientCnxn createConnection(HostProvider hostProvider, int sessionTimeout, ZKClientConfig clientConfig, Watcher defaultWatcher, ClientCnxnSocket clientCnxnSocket, long sessionId, byte[] sessionPasswd, boolean canBeReadOnly) throws IOException {
+                ClientCnxn createConnection(HostProvider hostProvider, int sessionTimeout, long newSessionTimeout, ZKClientConfig clientConfig, Watcher defaultWatcher, ClientCnxnSocket clientCnxnSocket, long sessionId, byte[] sessionPasswd, boolean canBeReadOnly) throws IOException {
                     ClientCnxnSocketNIO socket = spy((ClientCnxnSocketNIO) clientCnxnSocket);
 
                     doAnswer(mock -> {
@@ -110,7 +110,7 @@ ClientCnxn createConnection(HostProvider hostProvider, int sessionTimeout, ZKCli
                     }).when(socket).createSock();
 
                     nioSelector.set(socket.getSelector());
-                    return super.createConnection(hostProvider, sessionTimeout, clientConfig, defaultWatcher, socket, sessionId, sessionPasswd, canBeReadOnly);
+                    return super.createConnection(hostProvider, sessionTimeout, newSessionTimeout, clientConfig, defaultWatcher, socket, sessionId, sessionPasswd, canBeReadOnly);
                 }
             }) {
 
@@ -328,6 +328,7 @@ class CustomClientCnxn extends ClientCnxn {
         public CustomClientCnxn(
             HostProvider hostProvider,
             int sessionTimeout,
+            long newSessionTimeout,
             ZKClientConfig zkClientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
@@ -338,6 +339,7 @@ public CustomClientCnxn(
             super(
                 hostProvider,
                 sessionTimeout,
+                newSessionTimeout,
                 zkClientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
@@ -403,6 +405,7 @@ public boolean isAlive() {
         ClientCnxn createConnection(
             HostProvider hostProvider,
             int sessionTimeout,
+            long newSessionTimeout,
             ZKClientConfig clientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
@@ -415,6 +418,7 @@ ClientCnxn createConnection(
             ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(
                 hostProvider,
                 sessionTimeout,
+                newSessionTimeout,
                 clientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
@@ -424,4 +428,4 @@ ClientCnxn createConnection(
             return ClientCnxnSocketFragilityTest.this.cnxn;
         }
     }
-}
\ No newline at end of file
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index 93f801cabc2..a05825ce2de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -225,6 +225,7 @@ class CustomClientCnxn extends ClientCnxn {
         CustomClientCnxn(
             HostProvider hostProvider,
             int sessionTimeout,
+            long newSessionTimeout,
             ZKClientConfig clientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
@@ -235,6 +236,7 @@ class CustomClientCnxn extends ClientCnxn {
             super(
                 hostProvider,
                 sessionTimeout,
+                newSessionTimeout,
                 clientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
@@ -286,6 +288,7 @@ public CustomZooKeeper(String connectString, int sessionTimeout, Watcher watcher
         ClientCnxn createConnection(
             HostProvider hostProvider,
             int sessionTimeout,
+            long newSessionTimeout,
             ZKClientConfig clientConfig,
             Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
@@ -296,6 +299,7 @@ ClientCnxn createConnection(
             return new CustomClientCnxn(
                 hostProvider,
                 sessionTimeout,
+                newSessionTimeout,
                 clientConfig,
                 defaultWatcher,
                 clientCnxnSocket,
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
index 86659ba70d7..5688d9f5542 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThan;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
 import static org.hamcrest.Matchers.lessThan;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -27,6 +28,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.time.Duration;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.CompletableFuture;
@@ -40,6 +42,7 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZooKeeperBuilder;
 import org.apache.zookeeper.common.BusyServer;
 import org.apache.zookeeper.common.Time;
 import org.junit.jupiter.api.BeforeEach;
@@ -176,6 +179,49 @@ public void testSessionExpirationWhenNoServerUp() throws Exception {
             assertThrows(TimeoutException.class, () -> watcher.expired.get(3 * sessionTimeout, TimeUnit.MILLISECONDS));
             assertThrows(KeeperException.ConnectionLossException.class, () -> zk.exists("/", null));
         }
+
+        // when: try to establish a brand-new session using builder with default newSessionTimeout
+        watcher.reset();
+        try (ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(sessionTimeout))
+                .withDefaultWatcher(watcher)
+                .build()) {
+            // then: never Expired
+            assertThrows(TimeoutException.class, () -> watcher.expired.get(3 * sessionTimeout, TimeUnit.MILLISECONDS));
+            assertThrows(KeeperException.ConnectionLossException.class, () -> zk.exists("/", null));
+        }
+
+        // when: try to establish a brand-new session using builder with Duration.ZERO newSessionTimeout
+        watcher.reset();
+        long start = Time.currentElapsedTime();
+        try (ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(sessionTimeout))
+                .withDefaultWatcher(watcher)
+                .withNewSessionTimeout(Duration.ZERO)
+                .build()) {
+            // then: get Expired after some delay
+            watcher.expired.join();
+            long elapsed = Time.currentElapsedTime() - start;
+            assertThat(elapsed, greaterThan((long) sessionTimeout));
+            assertThat(elapsed, lessThan(sessionTimeout * 10L));
+            // then: future request will get SessionExpiredException
+            assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+        }
+
+        // when: try to establish a brand-new session using builder with custom newSessionTimeout
+        watcher.reset();
+        start = Time.currentElapsedTime();
+        Duration newSessionTimeout = Duration.ofMillis(300);
+        try (ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(30000))
+                .withDefaultWatcher(watcher)
+                .withNewSessionTimeout(newSessionTimeout)
+                .build()) {
+            // then: get Expired after newSessionTimeout
+            watcher.expired.join();
+            long elapsed = Time.currentElapsedTime() - start;
+            assertThat(elapsed, greaterThanOrEqualTo(newSessionTimeout.toMillis()));
+            assertThat(elapsed, lessThan(newSessionTimeout.toMillis() * 10));
+            // then: future request will get SessionExpiredException
+            assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+        }
     }
 
     @Test

From 3f4c8a215cceab4b26d0dda281ce0ba5026a55dd Mon Sep 17 00:00:00 2001
From: Norbert Meszaros <meszinorbi2002@gmail.com>
Date: Tue, 16 Dec 2025 17:10:04 +0100
Subject: [PATCH 562/591] ZOOKEEPER-4918: Bump
 com.fasterxml.jackson.core:jackson-core from 2.152 to 2.18.1

Reviewers: anmolnar, PDavid, PDavid, anmolnar
Author: meszinorbi
Closes #2244 from meszinorbi/master
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index cfee80f54eb..52f02348282 100644
--- a/pom.xml
+++ b/pom.xml
@@ -561,7 +561,7 @@
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.127.Final</netty.version>
     <jetty.version>9.4.57.v20241219</jetty.version>
-    <jackson.version>2.15.2</jackson.version>
+    <jackson.version>2.18.1</jackson.version>
     <jline.version>3.25.1</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
     <kerby.version>2.0.0</kerby.version>

From f9fa0ccc6fd7b73aba44c3975804ff6429d6f5cb Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Wed, 17 Dec 2025 00:18:38 +0800
Subject: [PATCH 563/591] ZOOKEEPER-4915: Default
 znode.container.maxNeverUsedIntervalMs to 5 minutes

Author: kezhuw
Closes #2248 from kezhuw/ZOOKEEPER-4915-znode.container.maxNeverUsedIntervalMs-default-value
---
 .../main/resources/markdown/zookeeperAdmin.md |  5 ++--
 .../zookeeper/server/ContainerManager.java    | 26 +++++++++++++++++++
 .../zookeeper/server/ZooKeeperServerMain.java |  9 +------
 .../server/quorum/LeaderZooKeeperServer.java  |  9 +------
 .../zookeeper/server/CreateContainerTest.java | 21 +++++++++++++++
 5 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index fea20e5fe8b..c1e1684aea7 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2160,8 +2160,9 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
     maximum interval in milliseconds that a container that has never had
     any children is retained. Should be long enough for your client to
     create the container, do any needed work and then create children.
-    Default is "0" which is used to indicate that containers
-    that have never had any children are never deleted.
+    Default is "300000"(a.k.a. 5 minutes) since 3.10.0, for earlier versions,
+    it is "0" which is used to indicate that containers that have never had
+    any children are never deleted.
 
 <a name="sc_debug_observability_config"></a>
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 2b8371fcc78..31fd34fd602 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -50,6 +50,20 @@ public class ContainerManager {
     private final Timer timer;
     private final AtomicReference<TimerTask> task = new AtomicReference<>(null);
 
+    /**
+     * @param zkDb the ZK database
+     * @param requestProcessor request processor - used to inject delete
+     *                         container requests
+     */
+    public ContainerManager(ZKDatabase zkDb, RequestProcessor requestProcessor) {
+        this(
+            zkDb, requestProcessor,
+            Integer.getInteger("znode.container.checkIntervalMs", (int) TimeUnit.MINUTES.toMillis(1)),
+            Integer.getInteger("znode.container.maxPerMinute", 10000),
+            Long.getLong("znode.container.maxNeverUsedIntervalMs", TimeUnit.MINUTES.toMillis(5))
+        );
+    }
+
     /**
      * @param zkDb the ZK database
      * @param requestProcessor request processor - used to inject delete
@@ -155,6 +169,18 @@ protected long getMinIntervalMs() {
         return TimeUnit.MINUTES.toMillis(1) / maxPerMinute;
     }
 
+    int getMaxPerMinute() {
+        return maxPerMinute;
+    }
+
+    int getCheckIntervalMs() {
+        return checkIntervalMs;
+    }
+
+    long getMaxNeverUsedIntervalMs() {
+        return maxNeverUsedIntervalMs;
+    }
+
     // VisibleForTesting
     protected Collection<String> getCandidates() {
         Set<String> candidates = new HashSet<>();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index b63280f2971..6f15e9e6279 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -20,7 +20,6 @@
 
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
 import javax.management.JMException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.audit.ZKAuditProvider;
@@ -168,13 +167,7 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
                 secureCnxnFactory.startup(zkServer, needStartZKServer);
             }
 
-            containerManager = new ContainerManager(
-                zkServer.getZKDatabase(),
-                zkServer.firstProcessor,
-                Integer.getInteger("znode.container.checkIntervalMs", (int) TimeUnit.MINUTES.toMillis(1)),
-                Integer.getInteger("znode.container.maxPerMinute", 10000),
-                Long.getLong("znode.container.maxNeverUsedIntervalMs", 0)
-            );
+            containerManager = new ContainerManager(zkServer.getZKDatabase(), zkServer.firstProcessor);
             containerManager.start();
             ZKAuditProvider.addZKStartStopAuditLog();
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
index 799b8f96148..1a3c15aeafe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
@@ -19,7 +19,6 @@
 package org.apache.zookeeper.server.quorum;
 
 import java.io.IOException;
-import java.util.concurrent.TimeUnit;
 import java.util.function.Function;
 import javax.management.JMException;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
@@ -78,13 +77,7 @@ protected void setupRequestProcessors() {
     }
 
     private synchronized void setupContainerManager() {
-        containerManager = new ContainerManager(
-            getZKDatabase(),
-            prepRequestProcessor,
-            Integer.getInteger("znode.container.checkIntervalMs", (int) TimeUnit.MINUTES.toMillis(1)),
-            Integer.getInteger("znode.container.maxPerMinute", 10000),
-            Long.getLong("znode.container.maxNeverUsedIntervalMs", 0)
-        );
+        containerManager = new ContainerManager(getZKDatabase(), prepRequestProcessor);
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
index 0e6c1b58f92..589f61369d9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
@@ -25,6 +25,7 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.time.Duration;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
@@ -77,10 +78,30 @@ public void addCommittedProposal(Request request) {
     @AfterEach
     @Override
     public void tearDown() throws Exception {
+        System.clearProperty("znode.container.checkIntervalMs");
+        System.clearProperty("znode.container.maxPerMinute");
+        System.clearProperty("znode.container.maxNeverUsedInterval");
+
         super.tearDown();
         zk.close();
     }
 
+    @Test
+    public void testContainerManagerDefaults() {
+        ContainerManager containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor);
+        assertEquals((int) Duration.ofMinutes(1).toMillis(), containerManager.getCheckIntervalMs());
+        assertEquals(10000, containerManager.getMaxPerMinute());
+        assertEquals((int) Duration.ofMinutes(5).toMillis(), containerManager.getMaxNeverUsedIntervalMs());
+
+        System.setProperty("znode.container.checkIntervalMs", "1000");
+        System.setProperty("znode.container.maxPerMinute", "1000");
+        System.setProperty("znode.container.maxNeverUsedIntervalMs", "10000");
+        containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor);
+        assertEquals(1000, containerManager.getCheckIntervalMs());
+        assertEquals(1000, containerManager.getMaxPerMinute());
+        assertEquals(10000, containerManager.getMaxNeverUsedIntervalMs());
+    }
+
     @Test
     @Timeout(value = 30)
     public void testCreate() throws KeeperException, InterruptedException {

From c91f6111d2f4d115217ba1dc4c28fa5bd26e2c91 Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Wed, 17 Dec 2025 06:24:33 +0800
Subject: [PATCH 564/591] ZOOKEEPER-4997: Unify construction of TrustManager to
 dedicated method

Reviewers: anmolnar
Author: kezhuw
Closes #2340 from kezhuw/ZOOKEEPER-4997-refactor-x509-createTrustManager
---
 .../zookeeper/common/ClientX509Util.java      |  50 +------
 .../org/apache/zookeeper/common/X509Util.java | 131 ++++++++++++------
 .../auth/X509AuthenticationProvider.java      |  55 ++------
 .../common/X509UtilCrlPropertyTest.java       | 104 ++++++++++++++
 4 files changed, 209 insertions(+), 131 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index b035bbfe098..1e50b84257c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -63,20 +63,14 @@ public String getSslProviderProperty() {
 
     public SslContext createNettySslContextForClient(ZKConfig config)
         throws X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
-        String keyStoreLocation = config.getProperty(getSslKeystoreLocationProperty(), "");
-        String keyStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslKeystorePasswdProperty(),
-            getSslKeystorePasswdPathProperty());
-        String keyStoreType = config.getProperty(getSslKeystoreTypeProperty());
-
         SslContextBuilder sslContextBuilder = SslContextBuilder.forClient();
 
-        if (keyStoreLocation.isEmpty()) {
-            LOG.warn("{} not specified", getSslKeystoreLocationProperty());
-        } else {
-            sslContextBuilder.keyManager(createKeyManager(keyStoreLocation, keyStorePassword, keyStoreType));
+        KeyManager km = buildKeyManager(config);
+        if (km != null) {
+            sslContextBuilder.keyManager(km);
         }
 
-        TrustManager tm = getTrustManager(config);
+        TrustManager tm = buildTrustManager(config);
         if (tm != null) {
             sslContextBuilder.trustManager(tm);
         }
@@ -103,19 +97,12 @@ public SslContext createNettySslContextForClient(ZKConfig config)
 
     public SslContext createNettySslContextForServer(ZKConfig config)
         throws X509Exception.SSLContextException, X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
-        String keyStoreLocation = config.getProperty(getSslKeystoreLocationProperty(), "");
-        String keyStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslKeystorePasswdProperty(),
-            getSslKeystorePasswdPathProperty());
-        String keyStoreType = config.getProperty(getSslKeystoreTypeProperty());
-
-        if (keyStoreLocation.isEmpty()) {
+        KeyManager km = buildKeyManager(config);
+        if (km == null) {
             throw new X509Exception.SSLContextException(
                 "Keystore is required for SSL server: " + getSslKeystoreLocationProperty());
         }
-
-        KeyManager km = createKeyManager(keyStoreLocation, keyStorePassword, keyStoreType);
-
-        return createNettySslContextForServer(config, km, getTrustManager(config));
+        return createNettySslContextForServer(config, km, buildTrustManager(config));
     }
 
     public SslContext createNettySslContextForServer(ZKConfig config, KeyManager keyManager, TrustManager trustManager) throws SSLException {
@@ -195,27 +182,4 @@ private Iterable<String> getCipherSuites(final ZKConfig config) {
     public SslProvider getSslProvider(ZKConfig config) {
         return SslProvider.valueOf(config.getProperty(getSslProviderProperty(), "JDK"));
     }
-
-    private TrustManager getTrustManager(ZKConfig config) throws X509Exception.TrustManagerException {
-        String trustStoreLocation = config.getProperty(getSslTruststoreLocationProperty(), "");
-        String trustStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslTruststorePasswdProperty(),
-            getSslTruststorePasswdPathProperty());
-        String trustStoreType = config.getProperty(getSslTruststoreTypeProperty());
-
-        boolean sslCrlEnabled = config.getBoolean(getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
-        boolean sslOcspEnabled = config.getBoolean(getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
-        boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
-        boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
-        boolean allowReverseDnsLookup = allowReverseDnsLookup(config);
-
-        if (trustStoreLocation.isEmpty()) {
-            LOG.warn("{} not specified", getSslTruststoreLocationProperty());
-            return null;
-        } else {
-            return createTrustManager(trustStoreLocation, trustStorePassword, trustStoreType,
-                sslCrlEnabled, sslOcspEnabled, sslServerHostnameVerificationEnabled,
-                sslClientHostnameVerificationEnabled, allowReverseDnsLookup,
-                getFipsMode(config));
-        }
-    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 2ac1ad9eef3..fee410cf057 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -378,57 +378,37 @@ public SSLContextAndOptions createSSLContextAndOptions(ZKConfig config) throws S
     }
 
     public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config) throws SSLContextException {
-        KeyManager[] keyManagers = null;
-        TrustManager[] trustManagers = null;
-
-        String keyStoreLocationProp = config.getProperty(sslKeystoreLocationProperty, "");
-        String keyStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslKeystorePasswdProperty, sslKeystorePasswdPathProperty);
-        String keyStoreTypeProp = config.getProperty(sslKeystoreTypeProperty);
-
         // There are legal states in some use cases for null KeyManager or TrustManager.
         // But if a user wanna specify one, location is required. Password defaults to empty string if it is not
         // specified by the user.
+        KeyManager[] keyManagers = null;
+        TrustManager[] trustManagers = null;
 
-        if (keyStoreLocationProp.isEmpty()) {
-            LOG.warn("{} not specified", getSslKeystoreLocationProperty());
-        } else {
-            try {
-                keyManagers = new KeyManager[]{createKeyManager(keyStoreLocationProp, keyStorePasswordProp, keyStoreTypeProp)};
-            } catch (KeyManagerException keyManagerException) {
-                throw new SSLContextException("Failed to create KeyManager", keyManagerException);
-            } catch (IllegalArgumentException e) {
-                throw new SSLContextException("Bad value for " + sslKeystoreTypeProperty + ": " + keyStoreTypeProp, e);
+        try {
+            KeyManager km = buildKeyManager(config);
+            if (km != null) {
+                keyManagers = new KeyManager[]{km};
             }
+        } catch (KeyManagerException keyManagerException) {
+            throw new SSLContextException("Failed to create KeyManager", keyManagerException);
+        } catch (IllegalArgumentException e) {
+            String keyStoreTypeProp = config.getProperty(sslKeystoreTypeProperty);
+            throw new SSLContextException("Bad value for " + sslKeystoreTypeProperty + ": " + keyStoreTypeProp, e);
         }
 
-        String trustStoreLocationProp = config.getProperty(sslTruststoreLocationProperty, "");
-        String trustStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslTruststorePasswdProperty, sslTruststorePasswdPathProperty);
-        String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
-
-        boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty, Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
-        boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty, Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
-
-        boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
-        boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
-        boolean allowReverseDnsLookup = allowReverseDnsLookup(config);
-        boolean fipsMode = getFipsMode(config);
-
-        if (trustStoreLocationProp.isEmpty()) {
-            LOG.warn("{} not specified", getSslTruststoreLocationProperty());
-        } else {
-            try {
-                trustManagers = new TrustManager[]{
-                    createTrustManager(trustStoreLocationProp, trustStorePasswordProp, trustStoreTypeProp, sslCrlEnabled,
-                        sslOcspEnabled, sslServerHostnameVerificationEnabled, sslClientHostnameVerificationEnabled,
-                        allowReverseDnsLookup, fipsMode)};
-            } catch (TrustManagerException trustManagerException) {
-                throw new SSLContextException("Failed to create TrustManager", trustManagerException);
-            } catch (IllegalArgumentException e) {
-                throw new SSLContextException("Bad value for "
-                                              + sslTruststoreTypeProperty
-                                              + ": "
-                                              + trustStoreTypeProp, e);
+        try {
+            TrustManager tm = buildTrustManager(config);
+            if (tm != null) {
+                trustManagers = new TrustManager[]{tm};
             }
+        } catch (TrustManagerException trustManagerException) {
+            throw new SSLContextException("Failed to create TrustManager", trustManagerException);
+        } catch (IllegalArgumentException e) {
+            String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
+            throw new SSLContextException("Bad value for "
+                    + sslTruststoreTypeProperty
+                    + ": "
+                    + trustStoreTypeProp, e);
         }
 
         String protocol = config.getProperty(sslProtocolProperty, DEFAULT_PROTOCOL);
@@ -487,6 +467,18 @@ public String getPasswordFromConfigPropertyOrFile(final ZKConfig config,
         return value;
     }
 
+    public X509KeyManager buildKeyManager(ZKConfig config) throws KeyManagerException {
+        String keyStoreLocation = config.getProperty(getSslKeystoreLocationProperty(), "");
+        if (keyStoreLocation.isEmpty()) {
+            LOG.warn("{} not specified for X509KeyManager", getSslKeystoreLocationProperty());
+            return null;
+        }
+        String keyStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslKeystorePasswdProperty(),
+                getSslKeystorePasswdPathProperty());
+        String keyStoreType = config.getProperty(getSslKeystoreTypeProperty());
+        return createKeyManager(keyStoreLocation, keyStorePassword, keyStoreType);
+    }
+
     /**
      * Creates a key manager by loading the key store from the given file of
      * the given type, optionally decrypting it using the given password.
@@ -522,6 +514,59 @@ public static X509KeyManager createKeyManager(
         }
     }
 
+    public X509TrustManager buildTrustManager(ZKConfig config) throws TrustManagerException {
+        String trustStoreLocationProp = config.getProperty(sslTruststoreLocationProperty, "");
+        if (trustStoreLocationProp.isEmpty()) {
+            LOG.warn("{} not specified for X509TrustManager", sslTruststoreLocationProperty);
+            return null;
+        }
+
+        String trustStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslTruststorePasswdProperty, sslTruststorePasswdPathProperty);
+        String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
+
+        boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty, Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
+        boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty, Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
+
+        boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
+        boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
+        boolean allowReverseDnsLookup = allowReverseDnsLookup(config);
+        boolean fipsMode = getFipsMode(config);
+
+        return createTrustManagerInternal(
+                trustStoreLocationProp,
+                trustStorePasswordProp,
+                trustStoreTypeProp,
+                sslCrlEnabled,
+                sslOcspEnabled,
+                sslServerHostnameVerificationEnabled,
+                sslClientHostnameVerificationEnabled,
+                allowReverseDnsLookup,
+                fipsMode);
+    }
+
+    // @VisibleForTesting
+    protected X509TrustManager createTrustManagerInternal(
+            String trustStoreLocation,
+            String trustStorePassword,
+            String trustStoreTypeProp,
+            boolean crlEnabled,
+            boolean ocspEnabled,
+            final boolean serverHostnameVerificationEnabled,
+            final boolean clientHostnameVerificationEnabled,
+            final boolean allowReverseDnsLookup,
+            final boolean fipsMode) throws TrustManagerException {
+        return createTrustManager(
+                trustStoreLocation,
+                trustStorePassword,
+                trustStoreTypeProp,
+                crlEnabled,
+                ocspEnabled,
+                serverHostnameVerificationEnabled,
+                clientHostnameVerificationEnabled,
+                allowReverseDnsLookup,
+                fipsMode);
+    }
+
     /**
      * Creates a trust manager by loading the trust store from the given file
      * of the given type, optionally decrypting it using the given password.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 8392db6bc51..3bc4304689d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server.auth;
 
-import java.security.Security;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
@@ -80,55 +79,21 @@ public class X509AuthenticationProvider implements AuthenticationProvider {
     public X509AuthenticationProvider() throws X509Exception {
         ZKConfig config = new ZKConfig();
         try (X509Util x509Util = new ClientX509Util()) {
-            String keyStoreLocation = config.getProperty(x509Util.getSslKeystoreLocationProperty(), "");
-            String keyStorePassword = x509Util.getPasswordFromConfigPropertyOrFile(config,
-                    x509Util.getSslKeystorePasswdProperty(),
-                    x509Util.getSslKeystorePasswdPathProperty());
-            String keyStoreTypeProp = config.getProperty(x509Util.getSslKeystoreTypeProperty());
-
-            boolean crlEnabled = config.getBoolean(x509Util.getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
-            boolean ocspEnabled = config.getBoolean(x509Util.getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
-            boolean hostnameVerificationEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
-            boolean clientHostnameVerificationEnabled = x509Util.isClientHostnameVerificationEnabled(config);
-            boolean allowReverseDnsLookup = Boolean.parseBoolean(config.getProperty(x509Util.getSslAllowReverseDnsLookupProperty()));
-
             X509KeyManager km = null;
             X509TrustManager tm = null;
-            if (keyStoreLocation.isEmpty()) {
-                LOG.warn("keystore not specified for client connection");
-            } else {
-                try {
-                    km = X509Util.createKeyManager(keyStoreLocation, keyStorePassword, keyStoreTypeProp);
-                } catch (KeyManagerException e) {
-                    LOG.error("Failed to create key manager", e);
-                }
-            }
 
-            String trustStoreLocation = config.getProperty(x509Util.getSslTruststoreLocationProperty(), "");
-            String trustStorePassword = x509Util.getPasswordFromConfigPropertyOrFile(config,
-                    x509Util.getSslTruststorePasswdProperty(),
-                    x509Util.getSslTruststorePasswdPathProperty());
-            String trustStoreTypeProp = config.getProperty(x509Util.getSslTruststoreTypeProperty());
-            boolean fipsMode = X509Util.getFipsMode(config);
+            try {
+                km = x509Util.buildKeyManager(config);
+            } catch (KeyManagerException e) {
+                LOG.error("Failed to create key manager", e);
+            }
 
-            if (trustStoreLocation.isEmpty()) {
-                LOG.warn("Truststore not specified for client connection");
-            } else {
-                try {
-                    tm = X509Util.createTrustManager(
-                        trustStoreLocation,
-                        trustStorePassword,
-                        trustStoreTypeProp,
-                        crlEnabled,
-                        ocspEnabled,
-                        hostnameVerificationEnabled,
-                        clientHostnameVerificationEnabled,
-                        allowReverseDnsLookup,
-                        fipsMode);
-                } catch (TrustManagerException e) {
-                    LOG.error("Failed to create trust manager", e);
-                }
+            try {
+                tm = x509Util.buildTrustManager(config);
+            } catch (TrustManagerException e) {
+                LOG.error("Failed to create trust manager", e);
             }
+
             this.keyManager = km;
             this.trustManager = tm;
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java
new file mode 100644
index 00000000000..154e738ce9b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyBoolean;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.spy;
+import java.security.Security;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.X509TrustManager;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class X509UtilCrlPropertyTest {
+    private static class TrustManagerCrlProperties implements X509TrustManager {
+        private final boolean crlEnabled;
+        private final boolean ocspEnabled;
+
+        public TrustManagerCrlProperties(boolean crlEnabled, boolean ocspEnabled) {
+            this.crlEnabled = crlEnabled;
+            this.ocspEnabled = ocspEnabled;
+        }
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+            return new X509Certificate[0];
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(classes = {ClientX509Util.class, QuorumX509Util.class})
+    public void testCrlProperties(Class<? extends X509Util> clazz) throws Exception {
+        try {
+            X509Util util = spy(clazz.getDeclaredConstructor().newInstance());
+
+            doAnswer(mock -> new TrustManagerCrlProperties(mock.getArgument(3, Boolean.class), mock.getArgument(4, Boolean.class)))
+                .when(util)
+                .createTrustManagerInternal(any(), any(), any(), anyBoolean(), anyBoolean(), anyBoolean(), anyBoolean(), anyBoolean(), anyBoolean());
+
+            ZKConfig config = new ZKConfig();
+            config.setProperty(util.getSslTruststoreLocationProperty(), "no-empty");
+
+            TrustManagerCrlProperties properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+
+            assertFalse(properties.crlEnabled);
+            assertFalse(properties.ocspEnabled);
+
+            // given: "com.sun.net.ssl.checkRevocation"
+            System.setProperty("com.sun.net.ssl.checkRevocation", "true");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: default to "com.sun.net.ssl.checkRevocation"
+            assertTrue(properties.crlEnabled);
+
+            // given: security property "ocsp.enable"
+            Security.setProperty("ocsp.enable", "true");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: default to "ocsp.enable"
+            assertTrue(properties.ocspEnabled);
+
+            // given: both "zookeeper.ssl.crl" and "com.sun.net.ssl.checkRevocation"
+            config.setProperty(util.getSslCrlEnabledProperty(), "false");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: "zookeeper.ssl.crl" take precedence
+            assertFalse(properties.crlEnabled);
+
+            // given: both "zookeeper.ssl.ocsp" and "ocsp.enable"
+            config.setProperty(util.getSslOcspEnabledProperty(), "false");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: "zookeeper.ssl.ocsp" take precedence
+            assertFalse(properties.ocspEnabled);
+        } finally {
+            System.clearProperty("com.sun.net.ssl.checkRevocation");
+            Security.setProperty("ocsp.enable", "false");
+        }
+    }
+}

From a8631bd5bcf00189dc3d296d72959f4d2b0d2f6c Mon Sep 17 00:00:00 2001
From: Ivan Andika <ivandika@apache.org>
Date: Thu, 18 Dec 2025 15:16:00 +0800
Subject: [PATCH 565/591] ZOOKEEPER-4934: Add metrics for TTL node creation
 (#2287)

* ZOOKEEPER-4934: Add metrics for TTL node creation

* Trigger CI
---
 .../src/main/java/org/apache/zookeeper/server/DataTree.java   | 1 +
 .../main/java/org/apache/zookeeper/server/ServerMetrics.java  | 4 +++-
 .../test/java/org/apache/zookeeper/server/CreateTTLTest.java  | 3 ++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index a9c69b48601..1f93f18c778 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -486,6 +486,7 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
                 containers.add(path);
             } else if (ephemeralType == EphemeralType.TTL) {
                 ttls.add(path);
+                ServerMetrics.getMetrics().TTL_NODE_CREATED_COUNT.add(1);
             } else if (ephemeralOwner != 0) {
                 HashSet<String> list = ephemerals.computeIfAbsent(ephemeralOwner, k -> new HashSet<>());
                 synchronized (list) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index f9b56f5f084..07d2c1b904a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -271,6 +271,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         QUOTA_EXCEEDED_ERROR_PER_NAMESPACE = metricsContext.getCounterSet(QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE);
 
         TTL_NODE_DELETED_COUNT = metricsContext.getCounter("ttl_node_deleted_count");
+        TTL_NODE_CREATED_COUNT = metricsContext.getCounter("ttl_node_created_count");
     }
 
     /**
@@ -550,9 +551,10 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final CounterSet QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
 
     /**
-     * Count of deleted TTL nodes
+     * Count of created and deleted TTL nodes
      */
     public final Counter TTL_NODE_DELETED_COUNT;
+    public final Counter TTL_NODE_CREATED_COUNT;
 
     private final MetricsProvider metricsProvider;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
index 94045662681..ae37bc6a1d3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
@@ -95,8 +95,9 @@ public void testCreate() throws KeeperException, InterruptedException {
         containerManager.checkContainers();
         assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
 
-        // validate deleted TTL nodes count
+        // validate created and deleted TTL nodes count
         Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertTrue((long) metrics.get("ttl_node_created_count") >= 1);
         assertTrue((long) metrics.get("ttl_node_deleted_count") >= 1);
     }
 

From 3ae8e7750e1a474ae63f2ff06112bc426f9f7acc Mon Sep 17 00:00:00 2001
From: Kezhu Wang <kezhuw@apache.org>
Date: Fri, 19 Dec 2025 04:03:31 +0800
Subject: [PATCH 566/591] ZOOKEEPER-4966: Decouple `ZKConfig` from
 `QuorumPeerConfig.ConfigException`

Reviewers: anmolnar, cnauroth
Author: kezhuw
Closes #2306 from kezhuw/ZOOKEEPER-4966-decouple-ZKConfig-from-QuorumPeerConfig
---
 .../zookeeper/client/ZKClientConfig.java      | 13 ++-
 .../org/apache/zookeeper/common/ZKConfig.java | 85 ++++++++++---------
 .../server/NettyServerCnxnFactory.java        |  3 +-
 .../server/PrepRequestProcessor.java          |  2 +-
 .../apache/zookeeper/server/ServerConfig.java |  2 +-
 .../zookeeper/server/ZooKeeperServerMain.java |  2 +-
 .../controller/ControllerServerConfig.java    |  1 +
 .../server/controller/ControllerService.java  |  5 +-
 .../server/quorum/FastLeaderElection.java     |  2 +-
 .../server/quorum/QuorumCnxManager.java       |  2 +-
 .../zookeeper/server/quorum/QuorumPeer.java   |  2 +-
 .../server/quorum/QuorumPeerConfig.java       | 13 +--
 .../server/quorum/QuorumPeerMain.java         |  2 +-
 .../quorum/flexible/QuorumHierarchical.java   |  2 +-
 .../server/quorum/flexible/QuorumMaj.java     |  2 +-
 .../quorum/flexible/QuorumOracleMaj.java      |  4 +-
 .../zookeeper/server/util/ConfigUtils.java    |  2 +-
 .../server/ZooKeeperServerMainTest.java       |  2 +-
 .../controller/ControllerConfigTest.java      | 10 +--
 .../server/quorum/QuorumCanonicalizeTest.java |  2 +-
 .../server/quorum/QuorumPeerConfigTest.java   |  2 +-
 .../server/quorum/QuorumServerTest.java       |  2 +-
 .../quorum/auth/QuorumDigestAuthTest.java     |  2 +-
 .../server/util/ConfigUtilsTest.java          |  2 +-
 24 files changed, 82 insertions(+), 84 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index 5472838bdef..91a390dda31 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -23,7 +23,6 @@
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.ZKConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 
 /**
  * Handles client specific properties
@@ -78,22 +77,22 @@ public ZKClientConfig() {
     /**
      * <p><b>Use {@link ZKClientConfig#ZKClientConfig(Path configPath)} instead.</b>
      *
-     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
-     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      */
     @Deprecated
-    public ZKClientConfig(File configFile) throws QuorumPeerConfig.ConfigException {
+    public ZKClientConfig(File configFile) throws ConfigException {
         super(configFile);
     }
 
     /**
      * <p><b>Use {@link ZKClientConfig#ZKClientConfig(Path configPath)} instead.</b>
      *
-     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
-     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      */
     @Deprecated
-    public ZKClientConfig(String configPath) throws QuorumPeerConfig.ConfigException {
+    public ZKClientConfig(String configPath) throws ConfigException {
         super(configPath);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index f6221eeb7f4..22d5f59be67 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -21,13 +21,14 @@
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.lang.reflect.Constructor;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
 import org.apache.zookeeper.Environment;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -65,8 +66,8 @@ public ZKConfig() {
     /**
      * <p><b>Use {@link ZKConfig#ZKConfig(Path configPath)} instead.</b>
      *
-     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
-     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      *
      * @param configPath
      *            Configuration file path
@@ -74,15 +75,15 @@ public ZKConfig() {
      *             if failed to load configuration properties
      */
     @Deprecated
-    public ZKConfig(String configPath) throws QuorumPeerConfig.ConfigException {
-        this(new File(configPath));
+    public ZKConfig(String configPath) throws ConfigException {
+        this(Paths.get(configPath));
     }
 
     /**
      * <p><b>Use {@link ZKConfig#ZKConfig(Path configPath)} instead.</b>
      *
-     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
-     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      *
      * @param configFile
      *            Configuration file
@@ -90,10 +91,8 @@ public ZKConfig(String configPath) throws QuorumPeerConfig.ConfigException {
      *             if failed to load configuration properties
      */
     @Deprecated
-    public ZKConfig(File configFile) throws QuorumPeerConfig.ConfigException {
-        this();
-        addConfiguration(configFile);
-        LOG.info("ZK Config {}", this.properties);
+    public ZKConfig(File configFile) throws ConfigException {
+        this(configFile.toPath());
     }
 
     /**
@@ -102,9 +101,10 @@ public ZKConfig(File configFile) throws QuorumPeerConfig.ConfigException {
      * @param configPath path to configuration file
      * @throws ConfigException
      */
-    @SuppressWarnings("deprecation")
     public ZKConfig(Path configPath) throws ConfigException {
-        this(configPath.toFile());
+        this();
+        addConfiguration(configPath);
+        LOG.info("ZK Config {}", this.properties);
     }
 
     private void init() {
@@ -216,16 +216,39 @@ public void setProperty(String key, String value) {
      *
      * @param configPath path to Configuration file.
      */
-    @SuppressWarnings("deprecation")
     public void addConfiguration(Path configPath) throws ConfigException {
-        addConfiguration(configPath.toFile());
+        Path absoluteConfigPath = configPath.toAbsolutePath();
+        LOG.info("Reading configuration from: {}", absoluteConfigPath);
+        try {
+            File configFile = (new VerifyingFileFactory.Builder(LOG).warnForRelativePath()
+                                                               .failForNonExistingPath()
+                                                               .build()).validate(configPath.toFile());
+            Properties cfg = new Properties();
+            try (FileInputStream in = new FileInputStream(configFile)) {
+                cfg.load(in);
+            }
+            parseProperties(cfg);
+        } catch (IOException | IllegalArgumentException e) {
+            LOG.error("Error while configuration from: {}", absoluteConfigPath, e);
+            String msg = "Error while processing " + absoluteConfigPath;
+            try {
+                Class<?> clazz = Class.forName("org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException");
+                Class<? extends ConfigException> exceptionClass = clazz.asSubclass(ConfigException.class);
+                Constructor<? extends ConfigException> constructor = exceptionClass.getDeclaredConstructor(String.class, Exception.class);
+                throw constructor.newInstance(msg, e);
+            } catch (ClassNotFoundException ignored) {
+            } catch (Exception ignored) {
+                LOG.warn("Fail to construct QuorumPeerConfig.ConfigException", e);
+            }
+            throw new ConfigException(msg, e);
+        }
     }
 
     /**
      * <p><b>Use {@link #addConfiguration(Path)} instead.</b></p>
      *
-     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
-     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      *
      * <p>Add a configuration resource. The properties form this configuration will
      * overwrite corresponding already loaded property and system property
@@ -234,31 +257,15 @@ public void addConfiguration(Path configPath) throws ConfigException {
      *            Configuration file.
      */
     @Deprecated
-    public void addConfiguration(File configFile) throws QuorumPeerConfig.ConfigException {
-        LOG.info("Reading configuration from: {}", configFile.getAbsolutePath());
-        try {
-            configFile = (new VerifyingFileFactory.Builder(LOG).warnForRelativePath()
-                                                               .failForNonExistingPath()
-                                                               .build()).validate(configFile);
-            Properties cfg = new Properties();
-            FileInputStream in = new FileInputStream(configFile);
-            try {
-                cfg.load(in);
-            } finally {
-                in.close();
-            }
-            parseProperties(cfg);
-        } catch (IOException | IllegalArgumentException e) {
-            LOG.error("Error while configuration from: {}", configFile.getAbsolutePath(), e);
-            throw new QuorumPeerConfig.ConfigException("Error while processing " + configFile.getAbsolutePath(), e);
-        }
+    public void addConfiguration(File configFile) throws ConfigException {
+        addConfiguration(configFile.toPath());
     }
 
     /**
      * <p><b>Use {@link #addConfiguration(Path)} instead.</b></p>
      *
-     * <p><b>The signature of this method will be changed to throw {@link ConfigException}
-     * instead of {@link QuorumPeerConfig.ConfigException} in future release.</b>
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      *
      * <p>Add a configuration resource. The properties form this configuration will
      * overwrite corresponding already loaded property and system property
@@ -267,8 +274,8 @@ public void addConfiguration(File configFile) throws QuorumPeerConfig.ConfigExce
      *            Configuration file path.
      */
     @Deprecated
-    public void addConfiguration(String configPath) throws QuorumPeerConfig.ConfigException {
-        addConfiguration(new File(configPath));
+    public void addConfiguration(String configPath) throws ConfigException {
+        addConfiguration(Paths.get(configPath));
     }
 
     private void parseProperties(Properties cfg) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index e6b0fac2a6e..6f65787442c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -62,6 +62,7 @@
 import javax.net.ssl.SSLSession;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.NettyUtils;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
@@ -529,7 +530,7 @@ private ServerBootstrap configureBootstrapAllocator(ServerBootstrap bootstrap) {
         if (usePortUnification) {
             try {
                 QuorumPeerConfig.configureSSLAuth();
-            } catch (QuorumPeerConfig.ConfigException e) {
+            } catch (ConfigException e) {
                 LOG.error("unable to set up SslAuthProvider, turning off client port unification", e);
                 usePortUnification = false;
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 961948a9ca6..d263fd75c43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -40,6 +40,7 @@
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
@@ -60,7 +61,6 @@
 import org.apache.zookeeper.server.quorum.LeaderZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java
index 9da0e53a4b6..91cfe7c97e1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java
@@ -23,9 +23,9 @@
 import java.util.Arrays;
 import java.util.Properties;
 import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 
 /**
  * Server configuration storage.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index 6f15e9e6279..c721e685bb6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -23,6 +23,7 @@
 import javax.management.JMException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.audit.ZKAuditProvider;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.jmx.ManagedUtil;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -33,7 +34,6 @@
 import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.DatadirException;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
index bbdc14f9ac0..ff99631231a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
@@ -25,6 +25,7 @@
 import java.net.ServerSocket;
 import java.util.HashMap;
 import java.util.Map;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.ServerConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
index 8d71984f5b0..a762bc1bae3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.controller;
 
 import java.io.IOException;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
@@ -119,7 +120,7 @@ protected void cleanup() {
     /**
      * Runs the main loop for this application but does not exit the process.
      */
-    public void initializeAndRun(String[] args) throws QuorumPeerConfig.ConfigException {
+    public void initializeAndRun(String[] args) throws ConfigException {
         initConfig(args);
         run();
     }
@@ -127,7 +128,7 @@ public void initializeAndRun(String[] args) throws QuorumPeerConfig.ConfigExcept
     /**
      * Derived classes may override to do custom initialization of command line args.
      */
-    protected void initConfig(String[] args) throws QuorumPeerConfig.ConfigException {
+    protected void initConfig(String[] args) throws ConfigException {
         if (args.length == 1) {
             config.parse(args[0]);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 8bc963a383e..61c0eb60104 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -27,13 +27,13 @@
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.server.ZooKeeperThread;
 import org.apache.zookeeper.server.quorum.QuorumCnxManager.Message;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.ZxidUtils;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 764b962ac36..7a16014848e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -61,11 +61,11 @@
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import javax.net.ssl.SSLSocket;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ZooKeeperThread;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthLearner;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 286d2d320f1..cf6f2f26ce0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -57,6 +57,7 @@
 import org.apache.zookeeper.common.AtomicFileOutputStream;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.QuorumX509Util;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception;
@@ -72,7 +73,6 @@
 import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
 import org.apache.zookeeper.server.admin.AdminServerFactory;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.auth.NullQuorumAuthLearner;
 import org.apache.zookeeper.server.quorum.auth.NullQuorumAuthServer;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuth;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index 29083be075b..eb034527c2a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -42,6 +42,7 @@
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.OutputStreamStatement;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
@@ -157,18 +158,6 @@ public class QuorumPeerConfig {
      */
     protected long jvmPauseSleepTimeMs = JvmPauseMonitor.SLEEP_TIME_MS_DEFAULT;
 
-    @SuppressWarnings("serial")
-    public static class ConfigException extends org.apache.zookeeper.common.ConfigException {
-
-        public ConfigException(String msg) {
-            super(msg);
-        }
-        public ConfigException(String msg, Exception e) {
-            super(msg, e);
-        }
-
-    }
-
     /**
      * Parse a ZooKeeper configuration file
      * @param path the patch of the configuration file
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index 59b7481ad51..c126ea2e290 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -23,6 +23,7 @@
 import javax.security.sasl.SaslException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.audit.ZKAuditProvider;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.jmx.ManagedUtil;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -37,7 +38,6 @@
 import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.DatadirException;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
index d4c7b21608f..2b7c97463e3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
@@ -27,9 +27,9 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
index cc1723cf381..ab111f7f1c7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
@@ -23,9 +23,9 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
index b3e7fa24926..2622db4a0b1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
@@ -27,10 +27,10 @@
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicBoolean;
 import org.apache.commons.io.FilenameUtils;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.quorum.SyncedLearnerTracker;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -55,7 +55,7 @@ public QuorumOracleMaj(Map<Long, QuorumPeer.QuorumServer> allMembers, String ora
         setOracle(oraclePath);
     }
 
-    public QuorumOracleMaj(Properties props, String oraclePath) throws QuorumPeerConfig.ConfigException {
+    public QuorumOracleMaj(Properties props, String oraclePath) throws ConfigException {
         super(props);
         setOracle(oraclePath);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
index d6f75729798..850d432af10 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
@@ -22,8 +22,8 @@
 import java.io.StringReader;
 import java.util.Map.Entry;
 import java.util.Properties;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 
 public class ConfigUtils {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
index 5655e8b677d..e32c43b5cf9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
@@ -38,6 +38,7 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider.MetricsProviderCapturingLifecycle;
@@ -46,7 +47,6 @@
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider.MetricsProviderWithErrorInStart;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider.MetricsProviderWithErrorInStop;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.test.ClientBase;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
index 5d2c47e9d36..3a0bda686e2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
@@ -25,7 +25,7 @@
 import java.net.ServerSocket;
 import java.util.ArrayList;
 import java.util.List;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.common.ConfigException;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -113,7 +113,7 @@ public void parseFileFailsWithMissingPort() throws Exception {
         try {
             ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
             Assert.fail("Should have thrown with missing server config");
-        } catch (QuorumPeerConfig.ConfigException ex) {
+        } catch (ConfigException ex) {
         }
     }
 
@@ -121,16 +121,16 @@ public void parseFileFailsWithMissingPort() throws Exception {
         try {
             ControllerServerConfig config = new ControllerServerConfig("DontLookHere.missing");
             Assert.fail("should have thrown");
-        } catch (QuorumPeerConfig.ConfigException ex) {
+        } catch (ConfigException ex) {
         }
     }
 
     @Test
-    public void parseInvalidPortThrows()throws QuorumPeerConfig.ConfigException {
+    public void parseInvalidPortThrows()throws ConfigException {
         try {
             ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
             Assert.fail("should have thrown");
-        } catch (QuorumPeerConfig.ConfigException ex) {
+        } catch (ConfigException ex) {
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
index aec017a0833..346a2baeddc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
@@ -24,7 +24,7 @@
 import java.util.LinkedHashMap;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.apache.zookeeper.common.ConfigException;
 import org.burningwave.tools.net.DefaultHostResolver;
 import org.burningwave.tools.net.HostResolutionRequestInterceptor;
 import org.burningwave.tools.net.MappedHostResolver;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
index 6ad5a4b93e8..0f752e0221d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
@@ -28,8 +28,8 @@
 import java.net.InetSocketAddress;
 import java.util.Properties;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.junit.jupiter.api.Test;
 
 public class QuorumPeerConfigTest {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
index f8831fc84a2..df4744543da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
@@ -24,8 +24,8 @@
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
index ecc27772e3a..8630c69d655 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
@@ -27,8 +27,8 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.admin.AdminServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeerMain;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
index 937d812fee0..ecce3eaee78 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
@@ -21,7 +21,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.apache.zookeeper.common.ConfigException;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;

From 97e1789a49481f08259a7d0d15d927e545a445a6 Mon Sep 17 00:00:00 2001
From: guptas6est <sanaya.gupta@est.tech>
Date: Fri, 19 Dec 2025 22:48:50 +0530
Subject: [PATCH 567/591] Upgrade Guava to 32.1.3-jre (fix CVE-2023-2976,
 CVE-2020-8908)

Reviewers: PDavid, anmolnar
Author: guptas6est
Closes #2314 from guptas6est/fix/upgrade-guava
---
 zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
index d8f75e55129..b4185ebce44 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -35,7 +35,7 @@
 
   <properties>
     <rat.version>0.6</rat.version>
-    <guava.version>30.0-jre</guava.version>
+    <guava.version>32.1.3-jre</guava.version>
   </properties>
 
   <build>

From ac0d082bb68412e544a039a4bdc491e7da31c5d3 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Fri, 5 Dec 2025 16:16:39 -0600
Subject: [PATCH 568/591] Add log redactor method when logging ZK config
 properties

---
 .../org/apache/zookeeper/common/ZKConfig.java | 19 ++++-
 .../apache/zookeeper/common/ZKConfigTest.java | 72 ++++++++++++++++++-
 .../apache/zookeeper/test/LoggerTestTool.java | 30 +++++++-
 .../test/resources/zookeeper-client.config    |  5 ++
 4 files changed, 121 insertions(+), 5 deletions(-)
 create mode 100644 zookeeper-server/src/test/resources/zookeeper-client.config

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 22d5f59be67..8564050d624 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -25,9 +25,11 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.HashMap;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
+
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
 import org.slf4j.Logger;
@@ -104,7 +106,11 @@ public ZKConfig(File configFile) throws ConfigException {
     public ZKConfig(Path configPath) throws ConfigException {
         this();
         addConfiguration(configPath);
-        LOG.info("ZK Config {}", this.properties);
+        Map<String, String> p = new HashMap<>();
+        for (Entry<String, String> entry : properties.entrySet()) {
+            p.put(entry.getKey(), logRedactor(entry.getKey(), entry.getValue()));
+        }
+        LOG.info("ZK Config {}", p);
     }
 
     private void init() {
@@ -206,7 +212,7 @@ public void setProperty(String key, String value) {
         }
         String oldValue = properties.put(key, value);
         if (null != oldValue && !oldValue.equals(value)) {
-            LOG.debug("key {}'s value {} is replaced with new value {}", key, oldValue, value);
+            LOG.debug("key {}'s value {} is replaced with new value {}", key, logRedactor(key, oldValue), logRedactor(key, value));
         }
     }
 
@@ -337,4 +343,13 @@ public int getInt(String key, int defaultValue) {
         return defaultValue;
     }
 
+    private String logRedactor(String key, String value) {
+        if (key == null) {
+            return value;
+        }
+        if (key.toLowerCase(Locale.ROOT).endsWith("password")) {
+            return "***";
+        }
+        return value;
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
index c64d5e694e2..7b87e2e3e0d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
@@ -19,13 +19,35 @@
 package org.apache.zookeeper.common;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.apache.zookeeper.test.LoggerTestTool;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import ch.qos.logback.classic.Level;
+
+import java.io.File;
+import java.io.IOException;
 
 public class ZKConfigTest {
 
-    X509Util x509Util = new ClientX509Util();
+    private final X509Util x509Util = new ClientX509Util();
+    private static LoggerTestTool loggerTestTool;
+
+    @BeforeAll
+    public static void setUpBeforeClass() {
+        loggerTestTool = new LoggerTestTool(ZKConfig.class, Level.DEBUG);
+    }
+
+    @AfterAll
+    public static void tearDownAfterClass() throws Exception {
+        loggerTestTool.close();
+    }
 
     @AfterEach
     public void tearDown() throws Exception {
@@ -90,4 +112,52 @@ public void testBooleanRetrievalFromPropertyWithWhitespacesAtBeginningAndEnd() {
         boolean result = conf.getBoolean(x509Util.getSslProtocolProperty(), defaultValue);
         assertEquals(value, result);
     }
+
+    @Test
+    public void testLogRedactorFromConfigFile() throws ConfigException, IOException {
+        // Arrange
+        File configFile = new File("./src/test/resources/zookeeper-client.config");
+
+        // Act
+        new ZKConfig(configFile.toPath());
+
+        // Assert
+        String logLine = loggerTestTool.readLogLine("ZK Config");
+        assertNotNull(logLine, "Unable to find ZK Config line in the logs");
+        assertFalse(logLine.contains("FileSecret456!"), "Logs should not contain any secrets");
+        assertFalse(logLine.contains("AnotherFileSecret789!"), "Logs should not contain any secrets");
+        assertTrue(logLine.contains("/home/zookeeper/top_secret.txt"));      // what we shouldn't redact
+    }
+
+    @Test
+    public void testLogRedactorInDebugLogs() throws IOException {
+        // Arrange
+        ZKConfig conf = new ZKConfig();
+
+        // Act
+        conf.setProperty("zookeeper.some.secret.password", "0ldP4ssw0rd");
+        conf.setProperty("zookeeper.some.secret.password", "N3Ws3cr3t");
+
+        // Assert
+        String logLine = loggerTestTool.readLogLine("replaced with new value");
+        assertNotNull(logLine, "Unable to find relevant line in the logs");
+        assertFalse(logLine.contains("0ldP4ssw0rd"), "Logs should not contain any secrets");
+        assertFalse(logLine.contains("N3Ws3cr3t"), "Logs should not contain any secrets");
+    }
+
+    @Test
+    public void testDontRedactorInDebugLogs() throws IOException {
+        // Arrange
+        ZKConfig conf = new ZKConfig();
+
+        // Act
+        conf.setProperty("zookeeper.some.secret.passwordPath", "/home/zookeeper/old_secret.txt");  // what we shouldn't redact
+        conf.setProperty("zookeeper.some.secret.passwordPath", "/home/zookeeper/new_secret.txt");  // what we shouldn't redact
+
+        // Assert
+        String logLine = loggerTestTool.readLogLine("replaced with new value");
+        assertNotNull(logLine, "Unable to find relevant line in the logs");
+        assertTrue(logLine.contains("/home/zookeeper/new_secret.txt"));
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
index c95a0d32d5e..5f225ee1804 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
@@ -27,17 +27,27 @@
 import ch.qos.logback.core.OutputStreamAppender;
 import ch.qos.logback.core.encoder.LayoutWrappingEncoder;
 import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.LineNumberReader;
+import java.io.StringReader;
+
 import org.slf4j.LoggerFactory;
 
 public class LoggerTestTool implements AutoCloseable {
   private final ByteArrayOutputStream os;
   private Appender<ILoggingEvent> appender;
   private Logger qlogger;
+  private Level logLevel = Level.INFO;
 
   public LoggerTestTool(Class<?> cls) {
     os = createLoggingStream(cls);
   }
 
+  public LoggerTestTool(Class<?> cls, Level logLevel) {
+    this.logLevel = logLevel;
+    this.os = createLoggingStream(cls);
+  }
+
   public LoggerTestTool(String cls) {
     os = createLoggingStream(cls);
   }
@@ -51,7 +61,7 @@ private ByteArrayOutputStream createLoggingStream(Class<?> cls) {
     appender = getConsoleAppender(os);
     qlogger = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(cls);
     qlogger.addAppender(appender);
-    qlogger.setLevel(Level.INFO);
+    qlogger.setLevel(logLevel);
     appender.start();
     return os;
   }
@@ -61,7 +71,7 @@ private ByteArrayOutputStream createLoggingStream(String cls) {
     appender = getConsoleAppender(os);
     qlogger = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(cls);
     qlogger.addAppender(appender);
-    qlogger.setLevel(Level.INFO);
+    qlogger.setLevel(logLevel);
     appender.start();
     return os;
   }
@@ -69,6 +79,7 @@ private ByteArrayOutputStream createLoggingStream(String cls) {
   private OutputStreamAppender<ILoggingEvent> getConsoleAppender(ByteArrayOutputStream os) {
     Logger rootLogger =
         (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(org.slf4j.Logger.ROOT_LOGGER_NAME);
+    rootLogger.setLevel(logLevel);
     Layout<ILoggingEvent> layout = ((LayoutWrappingEncoder<ILoggingEvent>)
         ((OutputStreamAppender<ILoggingEvent>) rootLogger.getAppender("CONSOLE")).getEncoder()).getLayout();
 
@@ -80,6 +91,21 @@ private OutputStreamAppender<ILoggingEvent> getConsoleAppender(ByteArrayOutputSt
     return appender;
   }
 
+  public String readLogLine(String search) throws IOException {
+    try {
+      LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+      String line;
+      while ((line = r.readLine()) != null) {
+        if (line.contains(search)) {
+          return line;
+        }
+      }
+      return null;
+    } finally {
+      os.reset();
+    }
+  }
+
   @Override
   public void close() throws Exception {
     qlogger.detachAppender(appender);
diff --git a/zookeeper-server/src/test/resources/zookeeper-client.config b/zookeeper-server/src/test/resources/zookeeper-client.config
new file mode 100644
index 00000000000..096105ce95c
--- /dev/null
+++ b/zookeeper-server/src/test/resources/zookeeper-client.config
@@ -0,0 +1,5 @@
+# Sample secrets
+zookeeper.ssl.keyStore.password=FileSecret456!
+zookeeper.ssl.keyStore.passwordPath=/home/zookeeper/top_secret.txt
+ssl.quorum.keyStore.password=AnotherFileSecret789!
+

From 6aaffd5ee007e8b53772c02111207cdc0cc17235 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Tue, 20 Jan 2026 16:10:39 -0800
Subject: [PATCH 569/591] ZOOKEEPER-4956: Provide a HostProvider that uses DNS
 SRV record for dynamic server discovery (#2320)

Author: Li Wang <liwang@apple.com>

Co-authored-by: liwang <liwang@apple.com>
---
 pom.xml                                       |   6 +
 .../markdown/zookeeperProgrammers.md          |   5 +
 zookeeper-server/pom.xml                      |   4 +
 .../java/org/apache/zookeeper/ZooKeeper.java  |   8 +-
 .../zookeeper/client/ConnectStringParser.java |  94 +++-
 .../zookeeper/client/DnsSrvHostProvider.java  | 329 ++++++++++++++
 .../client/HostConnectionManager.java         | 413 ++++++++++++++++++
 .../apache/zookeeper/client/HostProvider.java |  10 +-
 .../zookeeper/client/HostProviderFactory.java |  66 +++
 .../zookeeper/client/StaticHostProvider.java  | 329 ++------------
 .../zookeeper/client/ZKClientConfig.java      |   8 +
 .../zookeeper/HostProviderSelectionTest.java  |  95 ++++
 .../client/DnsSrvHostProviderTest.java        | 214 +++++++++
 .../test/ConnectStringParserTest.java         |  90 ++++
 14 files changed, 1348 insertions(+), 323 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java

diff --git a/pom.xml b/pom.xml
index 52f02348282..552659bc7f5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -573,6 +573,7 @@
     <enforcer.version>3.0.0-M3</enforcer.version>
     <commons-io.version>2.17.0</commons-io.version>
     <burningwave.mockdns.version>0.25.4</burningwave.mockdns.version>
+    <dnsjava.version>3.5.1</dnsjava.version>
     <clover-maven-plugin.version>4.4.1</clover-maven-plugin.version>
     <sonar-maven-plugin.version>3.7.0.1746</sonar-maven-plugin.version>
 
@@ -774,6 +775,11 @@
         <artifactId>tools</artifactId>
         <version>${burningwave.mockdns.version}</version>
       </dependency>
+      <dependency>
+        <groupId>dnsjava</groupId>
+        <artifactId>dnsjava</artifactId>
+        <version>${dnsjava.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 59008215c57..a9b7fd711c7 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -1396,6 +1396,11 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
   you want to randomize that.
   Default: false
 
+* *zookeeper.hostProvider.dnsSrvRefreshIntervalSeconds* :
+  **New in 3.10.0:**
+  Specifies the refresh interval in seconds for DNS SRV record lookups when using DnsSrvHostProvider.
+  A value of 0 disables periodic refresh.
+  Default: 60 seconds
 
 <a name="C+Binding"></a>
 
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
index b2ecf1902cd..f4b76095d2e 100644
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -190,6 +190,10 @@
       <artifactId>commons-io</artifactId>
       <scope>compile</scope>
     </dependency>
+    <dependency>
+      <groupId>dnsjava</groupId>
+      <artifactId>dnsjava</artifactId>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index 7533e01a9d0..32893d46af4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -46,6 +46,7 @@
 import org.apache.zookeeper.client.Chroot;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.apache.zookeeper.client.HostProvider;
+import org.apache.zookeeper.client.HostProviderFactory;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.client.ZooKeeperBuilder;
@@ -1142,10 +1143,9 @@ public ZooKeeper(ZooKeeperOptions options) throws IOException {
         if (options.getHostProvider() != null) {
             hostProvider = options.getHostProvider().apply(connectStringParser.getServerAddresses());
         } else {
-            hostProvider = new StaticHostProvider(connectStringParser.getServerAddresses(), clientConfig);
+            hostProvider = HostProviderFactory.create(connectStringParser, clientConfig);
         }
         this.hostProvider = hostProvider;
-
         chroot = Chroot.ofNullable(connectStringParser.getChrootPath());
         cnxn = createConnection(
             hostProvider,
@@ -1332,6 +1332,10 @@ public synchronized void close() throws InterruptedException {
             LOG.debug("Ignoring unexpected exception during close", e);
         }
 
+        if (hostProvider != null) {
+            hostProvider.close();
+        }
+
         LOG.info("Session: 0x{} closed", Long.toHexString(getSessionId()));
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
index 5d292819622..6c2c7ec6b1b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
@@ -24,6 +24,7 @@
 import java.util.List;
 import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.common.StringUtils;
 
 /**
  * A parser for ZooKeeper Client connect strings.
@@ -38,38 +39,88 @@
 public final class ConnectStringParser {
 
     private static final int DEFAULT_PORT = 2181;
+    private static final String DNS_SRV_PREFIX = "dns-srv://";
 
-    private final String chrootPath;
+    public enum ConnectionType {
+        DNS_SRV,
+        HOST_PORT
+    }
 
+    private String chrootPath;
     private final ArrayList<InetSocketAddress> serverAddresses = new ArrayList<>();
+    private final ConnectionType connectionType;
+    private final String connectString;
 
     /**
-     * Parse host and port by splitting client connectString
-     * with support for IPv6 literals
-     * @throws IllegalArgumentException
-     *             for an invalid chroot path.
+     * Constructs a ConnectStringParser with given connect string.
+     *
+     * <p>Supports two connection string formats:</p>
+     * <ul>
+     * <li><strong>Host:Port format:</strong> "host1:2181,host2:2181/chroot"</li>
+     * <li><strong>DNS SRV format:</strong> "dns-srv://service.domain.com/chroot"</li>
+     * </ul>
+     *
+     * @param connectString the connect string to parse
+     * @throws IllegalArgumentException if connectString is null/empty or contains invalid chroot path
      */
-    public ConnectStringParser(String connectString) {
+    public ConnectStringParser(final String connectString) {
+        if (StringUtils.isBlank(connectString)) {
+            throw new IllegalArgumentException("Connect string cannot be null or empty");
+        }
+
+        if (connectString.startsWith(DNS_SRV_PREFIX)) {
+            connectionType = ConnectionType.DNS_SRV;
+            parseDnsSrvFormat(connectString);
+        } else {
+            connectionType = ConnectionType.HOST_PORT;
+            parseHostPortFormat(connectString);
+        }
+        this.connectString = connectString;
+    }
+
+    public String getChrootPath() {
+        return chrootPath;
+    }
+
+    public ArrayList<InetSocketAddress> getServerAddresses() {
+        return serverAddresses;
+    }
+
+    public ConnectionType getConnectionType() {
+        return connectionType;
+    }
+
+    public String getConnectString() {
+        return connectString;
+    }
+
+    private String[] parseConnectString(final String connectString) {
+        String serverPart = connectString;
+        String chrootPath = null;
+
         // parse out chroot, if any
-        int off = connectString.indexOf('/');
+        final int off = connectString.indexOf('/');
         if (off >= 0) {
-            String chrootPath = connectString.substring(off);
+            chrootPath = connectString.substring(off);
             // ignore "/" chroot spec, same as null
             if (chrootPath.length() == 1) {
-                this.chrootPath = null;
+                chrootPath = null;
             } else {
                 PathUtils.validatePath(chrootPath);
-                this.chrootPath = chrootPath;
             }
-            connectString = connectString.substring(0, off);
-        } else {
-            this.chrootPath = null;
+            serverPart = connectString.substring(0, off);
         }
+        return new String[]{serverPart, chrootPath};
+    }
+
+    private void parseHostPortFormat(final String connectString) {
+        final String[] parts = parseConnectString(connectString);
+        chrootPath = parts[1];
 
-        List<String> hostsList = split(connectString, ",");
+        final List<String> hostsList = split(parts[0], ",");
         for (String host : hostsList) {
             int port = DEFAULT_PORT;
-            String[] hostAndPort = NetUtils.getIPV6HostAndPort(host);
+            final String[] hostAndPort = NetUtils.getIPV6HostAndPort(host);
             if (hostAndPort.length != 0) {
                 host = hostAndPort[0];
                 if (hostAndPort.length == 2) {
@@ -89,12 +140,11 @@ public ConnectStringParser(String connectString) {
         }
     }
 
-    public String getChrootPath() {
-        return chrootPath;
+    private void parseDnsSrvFormat(final String connectString) {
+        final String[] parts = parseConnectString(connectString.substring(DNS_SRV_PREFIX.length()));
+        chrootPath = parts[1];
+        // The DNS service name is stored as a placeholder address
+        // The actual resolution will be handled by DnsSrvHostProvider
+        serverAddresses.add(InetSocketAddress.createUnresolved(parts[0], DEFAULT_PORT));
     }
-
-    public ArrayList<InetSocketAddress> getServerAddresses() {
-        return serverAddresses;
-    }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java
new file mode 100644
index 00000000000..55cdfcd8e58
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java
@@ -0,0 +1,329 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import java.util.Timer;
+import java.util.TimerTask;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.common.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.xbill.DNS.Lookup;
+import org.xbill.DNS.Record;
+import org.xbill.DNS.SRVRecord;
+import org.xbill.DNS.Type;
+
+/**
+ * DNS SRV-based HostProvider that dynamically resolves host port names from DNS SRV records.
+ *
+ * <p>This implementation periodically refreshes the server list by querying DNS SRV records
+ * and uses HostConnectionManager for all connection management and reconfiguration logic.</p>
+ *
+ * <p><strong>Two-Phase Update Strategy:</strong></p>
+ * <ul>
+ * <li><strong>Phase 1 (Background):</strong> Timer thread detects DNS changes without caching results</li>
+ * <li><strong>Phase 2 (Connection-time):</strong> Fresh DNS lookup during connect attempt if changes detected</li>
+ * </ul>
+ */
+@InterfaceAudience.Public
+public final class DnsSrvHostProvider implements HostProvider {
+    private static final Logger LOG = LoggerFactory.getLogger(DnsSrvHostProvider.class);
+
+    public interface DnsSrvResolver {
+        SRVRecord[] lookupSrvRecords(String dnsSrvName) throws IOException;
+    }
+
+    private final String dnsSrvName;
+    private final DnsSrvResolver dnsResolver;
+
+    private final HostConnectionManager connectionManager;
+    // Track the previous server list to detect changes
+    private volatile Set<InetSocketAddress> previousServerSet;
+    private Timer dnsRefreshTimer;
+
+    // Track the current connected host for accurate load balancing decisions
+    private final AtomicReference<InetSocketAddress> currentConnectedHost = new AtomicReference<>();
+    private final AtomicBoolean serverListChanged = new AtomicBoolean(false);
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName) {
+        this(dnsSrvName, null);
+    }
+
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name and ZKClientConfig
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @param clientConfig ZooKeeper client configuration
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName, final ZKClientConfig clientConfig) {
+        this(dnsSrvName, System.currentTimeMillis() ^ dnsSrvName.hashCode(), clientConfig);
+    }
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name, randomness seed and ZKClientConfig
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @param randomnessSeed seed for randomization
+     * @param clientConfig ZooKeeper client configuration
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName, final long randomnessSeed, final ZKClientConfig clientConfig) {
+        this(dnsSrvName, randomnessSeed, new DefaultDnsResolver(), clientConfig);
+    }
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name, randomization seed, DNS resolver and ZKClientConfig
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @param randomnessSeed seed for randomization
+     * @param dnsResolver custom DNS resolver
+     * @param clientConfig ZooKeeper client configuration
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName, final long randomnessSeed, final DnsSrvResolver dnsResolver, final ZKClientConfig clientConfig) {
+        if (StringUtils.isBlank(dnsSrvName)) {
+            throw new IllegalArgumentException("DNS name cannot be null or empty");
+        }
+
+        this.dnsSrvName = dnsSrvName;
+        this.dnsResolver = dnsResolver;
+        try {
+            final List<InetSocketAddress> serverAddresses = lookupDnsSrvRecords();
+            if (serverAddresses.isEmpty()) {
+                LOG.error("No SRV records found for DNS name: {}", dnsSrvName);
+                throw new IllegalArgumentException("No SRV records found for DNS name: " + dnsSrvName);
+            }
+
+            this.connectionManager = new HostConnectionManager(serverAddresses, randomnessSeed, clientConfig);
+            this.previousServerSet = new HashSet<>(serverAddresses);
+
+
+            final long refreshIntervalInSeconds = getRefreshInterval();
+            if (refreshIntervalInSeconds > 0) {
+                dnsRefreshTimer = new Timer("DnsSrvRefresh-" + dnsSrvName, true);
+                dnsRefreshTimer.scheduleAtFixedRate(new TimerTask() {
+                                                        @Override
+                                                        public void run() {
+                                                            refreshServerListInBackground();
+                                                        }
+                                                    },
+                        refreshIntervalInSeconds * 1000,
+                        refreshIntervalInSeconds * 1000);
+            }
+            LOG.info("DnsSrvHostProvider initialized with {} servers from DNS name: {} with refresh interval: {} seconds",
+                    serverAddresses.size(), dnsSrvName, refreshIntervalInSeconds);
+        } catch (final Exception e) {
+            LOG.error("Failed to initialize DnsSrvHostProvider for DNS name: {}", dnsSrvName, e);
+
+            if (dnsRefreshTimer != null) {
+                dnsRefreshTimer.cancel();
+            }
+
+            if (e instanceof IllegalArgumentException) {
+                throw e;
+            } else {
+                throw new IllegalArgumentException("Failed to initialize DnsSrvHostProvider for DNS name: " + dnsSrvName, e);
+            }
+        }
+    }
+
+    @Override
+    public int size() {
+        return connectionManager.size();
+    }
+
+    @Override
+    public InetSocketAddress next(long spinDelay) {
+        applyServerListUpdate();
+        return connectionManager.next(spinDelay);
+    }
+
+    @Override
+    public void onConnected() {
+        currentConnectedHost.set(connectionManager.getServerAtCurrentIndex());
+        connectionManager.onConnected();
+    }
+
+    @Override
+    public boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost) {
+        return connectionManager.updateServerList(serverAddresses, currentHost);
+    }
+
+    @Override
+    public void close() {
+        if (dnsRefreshTimer != null) {
+            dnsRefreshTimer.cancel();
+        }
+    }
+
+    private long getRefreshInterval() {
+        final long defaultInterval = ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS_DEFAULT;
+        final long interval = Long.getLong(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS, defaultInterval);
+        if (interval < 0) {
+            LOG.error("Invalid DNS SRV refresh interval {} seconds", interval);
+            throw new IllegalArgumentException("Invalid DNS SRV refresh interval: " + interval);
+        }
+        if (interval == 0) {
+            LOG.info("DNS SRV refresh disabled (interval = 0) for {}", dnsSrvName);
+        }
+        return interval;
+    }
+
+    private List<InetSocketAddress> lookupDnsSrvRecords() {
+        final List<InetSocketAddress> addresses = new ArrayList<>();
+
+        try {
+            final SRVRecord[] srvRecords = dnsResolver.lookupSrvRecords(dnsSrvName);
+            for (final SRVRecord srvRecord : srvRecords) {
+                final InetSocketAddress address = createAddressFromSrvRecord(srvRecord);
+                if (address != null) {
+                    addresses.add(address);
+                }
+            }
+        } catch (final Exception e) {
+            LOG.error("DNS SRV lookup failed for {}", dnsSrvName, e);
+            throw new RuntimeException("DNS SRV lookup failed for " + dnsSrvName, e);
+        }
+        return addresses;
+    }
+
+    private InetSocketAddress createAddressFromSrvRecord(final SRVRecord srvRecord) {
+        if (srvRecord == null) {
+            LOG.error("Null SRV record encountered from DnsSrvResolver implementation");
+            return null;
+        }
+
+        try {
+            final String target = srvRecord.getTarget().toString(true);
+            final int port = srvRecord.getPort();
+
+            if (port <= 0 || port > 65535) {
+                LOG.error("Invalid port {} in SRV record for target {}", port, target);
+                return null;
+            }
+
+            if (StringUtils.isBlank(target)) {
+                LOG.error("Empty or blank target in SRV record {}", srvRecord);
+                return null;
+            }
+
+            return new InetSocketAddress(target, port);
+        } catch (final Exception e) {
+            LOG.error("Failed to create InetSocketAddress from SRV record {}", srvRecord, e);
+            return null;
+        }
+    }
+
+    /**
+     * Performs background DNS refresh to detect server list changes without caching DNS responses.
+     *
+     * <p><strong>Important:</strong> This method only detects changes, the actual fresh DNS query happens
+     * in {@link #applyServerListUpdate()} when needed.</p>
+     */
+    private void refreshServerListInBackground() {
+        try {
+            // Refresh the server list
+            final List<InetSocketAddress> newAddresses = lookupDnsSrvRecords();
+            if (newAddresses.isEmpty()) {
+                LOG.warn("DNS SRV lookup returned no records for {}, will retry on next refresh", dnsSrvName);
+                return;
+            }
+
+            // Check if server list has changed
+            final Set<InetSocketAddress> newServerSet = new HashSet<>(newAddresses);
+            if (!Objects.equals(previousServerSet, newServerSet)) {
+                serverListChanged.set(true);
+                LOG.info("Server list change detected from DNS SRV: {} servers", newAddresses.size());
+            }
+        } catch (final Exception e) {
+            LOG.warn("Failed to refresh server list from DNS SRV records for {}: {}", dnsSrvName, e.getMessage());
+        }
+    }
+
+    /**
+     * Apply pending server list updates when connection is actually needed.
+     * It is called from next() to ensure server list changes are applied with proper connection context.
+     */
+    private synchronized void applyServerListUpdate() {
+        if (serverListChanged.get()) {
+            try {
+                // Query DNS to get the updated server list
+                final List<InetSocketAddress> latestServerList = lookupDnsSrvRecords();
+                if (latestServerList.isEmpty()) {
+                    LOG.warn("DNS SRV lookup returned no records for {}, will use the existing ones", dnsSrvName);
+                    return;
+                }
+
+                final boolean needReconnect = connectionManager.updateServerList(latestServerList, currentConnectedHost.get());
+                previousServerSet = new HashSet<>(latestServerList);
+                serverListChanged.set(false);
+
+                LOG.info("Applied server list update during connection attempt. servers size: {}, need reconnection: {}",
+                        latestServerList.size(), needReconnect);
+            } catch (final Exception e) {
+                LOG.warn("Failed to apply server list update", e);
+            }
+        }
+    }
+
+    private static class DefaultDnsResolver implements DnsSrvResolver {
+        @Override
+        public SRVRecord[] lookupSrvRecords(final String dnsSrvName) throws IOException {
+            final Lookup lookup = new Lookup(dnsSrvName, Type.SRV);
+            final Record[] records = lookup.run();
+            if (lookup.getResult() != Lookup.SUCCESSFUL) {
+                final String errorMsg = lookup.getErrorString();
+                throw new IOException("DNS SRV lookup failed for " + dnsSrvName + ": " + errorMsg);
+            }
+
+            if (records == null) {
+                return new SRVRecord[0];
+            }
+            return Arrays.stream(records).map(SRVRecord.class::cast).toArray(SRVRecord[]::new);
+        }
+    }
+}
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java
new file mode 100644
index 00000000000..b278014a3ce
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java
@@ -0,0 +1,413 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Random;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Manages ZooKeeper server connections with round-robin selection and load balancing during
+ * cluster reconfiguration.
+ *
+ * <p><strong>Key Features:</strong></p>
+ * <ul>
+ * <li>Round-robin server selection with IP address resolution</li>
+ * <li>Migrates clients to balance load when servers are added or removed</li>
+ * <li>Probabilistic client migration during server list updates</li>
+ * </ul>
+ *
+ * <p><strong>Reconfiguration Behavior:</strong></p>
+ * When server list changes, enters "reconfigMode" and calculates migration probabilities
+ * to balance load between old and new servers.
+ *
+ * <p>See <a href="https://issues.apache.org/jira/browse/ZOOKEEPER-1355">ZOOKEEPER-1355</a>
+ * for more details.</p>
+ */
+@InterfaceAudience.Private
+public final class HostConnectionManager {
+
+    /**
+     * Interface for address resolution to support testing and different resolution strategies.
+     */
+    public interface Resolver {
+        InetAddress[] getAllByName(String name) throws UnknownHostException;
+    }
+
+    private static final Logger LOG = LoggerFactory.getLogger(HostConnectionManager.class);
+
+    private List<InetSocketAddress> serverAddresses;
+    private final Random sourceOfRandomness;
+    private final Resolver resolver;
+    private final ZKClientConfig clientConfig;
+
+    private int lastIndex;
+    private int currentIndex;
+
+    /**
+     * The following fields are used to migrate clients during reconfiguration
+     */
+    private boolean reconfigMode = false;
+    private final List<InetSocketAddress> oldServers = new ArrayList<>(5);
+    private final List<InetSocketAddress> newServers = new ArrayList<>(5);
+    private int currentIndexOld = -1;
+    private int currentIndexNew = -1;
+    private float pOld, pNew;
+
+    /**
+     * Constructs a HostConnectionManager with default resolver.
+     *
+     * @param serverAddresses
+     *              possibly unresolved ZooKeeper server addresses
+     *  @param randomnessSeed
+     *              a seed used to initialize sourceOfRandomness
+     * @param clientConfig
+     *              ZooKeeper client configuration
+     * @throws IllegalArgumentException
+     *              if serverAddresses is empty
+     */
+    public HostConnectionManager(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, ZKClientConfig clientConfig) {
+        this(serverAddresses, randomnessSeed, null, clientConfig);
+    }
+
+    /**
+     * Constructs a HostConnectionManager with custom resolver.
+     *
+     * @param serverAddresses
+     *              possibly unresolved ZooKeeper server addresses
+     * @param randomnessSeed
+     *              a seed used to initialize sourceOfRandomness
+     * @param resolver
+     *              custom resolver implementation
+     * @param clientConfig
+     *              ZooKeeper client configuration
+     * @throws IllegalArgumentException
+     *              if serverAddresses is empty
+     */
+    public HostConnectionManager(Collection<InetSocketAddress> serverAddresses,
+                                long randomnessSeed,
+                                Resolver resolver,
+                                ZKClientConfig clientConfig) {
+        if (serverAddresses.isEmpty()) {
+            throw new IllegalArgumentException("A HostProvider may not be empty!");
+        }
+        this.sourceOfRandomness = new Random(randomnessSeed);
+        this.serverAddresses = shuffle(serverAddresses);
+        this.resolver = resolver == null ? InetAddress::getAllByName : resolver;
+        this.clientConfig = clientConfig == null ? new ZKClientConfig() : clientConfig;
+
+        currentIndex = -1;
+        lastIndex = -1;
+
+        LOG.info("HostConnectionManager initialized with {} servers", serverAddresses.size());
+    }
+
+    /**
+     * Update the list of servers. This returns true if changing connections is necessary for load-balancing, false
+     * otherwise. Changing connections is necessary if one of the following holds:
+     * a) the host to which this client is currently connected is not in serverAddresses.
+     *    Otherwise (if currentHost is in the new list serverAddresses):
+     * b) the number of servers in the cluster is increasing - in this case the load on currentHost should decrease,
+     *    which means that SOME of the clients connected to it will migrate to the new servers. The decision whether
+     *    this client migrates or not (i.e., whether true or false is returned) is probabilistic so that the expected
+     *    number of clients connected to each server is the same.
+     *
+     * If true is returned, the function sets pOld and pNew that correspond to the probability to migrate to one of the
+     * new servers in serverAddresses or one of the old servers (migrating to one of the old servers is done only
+     * if our client's currentHost is not in serverAddresses). See nextHostInReconfigMode for the selection logic.
+     *
+     * See <a href="https://issues.apache.org/jira/browse/ZOOKEEPER-1355">ZOOKEEPER-1355</a>
+     * for the protocol and its evaluation.
+     *
+     * @param serverAddresses
+     *              new host list
+     * @param currentHost
+     *              the host to which this client is currently connected
+     * @return true if changing connections is necessary for load-balancing, false otherwise
+     */
+    synchronized boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost) {
+        List<InetSocketAddress> shuffledList = shuffle(serverAddresses);
+        if (shuffledList.isEmpty()) {
+            throw new IllegalArgumentException("The server list may not be empty!");
+        }
+
+        int oldSize = this.serverAddresses.size();
+        int newSize = shuffledList.size();
+
+        // Check if client's current server is in the new list of servers
+        boolean myServerInNewConfig = false;
+        InetSocketAddress myServer = currentHost;
+
+        // choose "current" server according to the client rebalancing algorithm
+        if (reconfigMode) {
+            myServer = next(0);
+        }
+
+        // if the client is not currently connected to any server
+        if (myServer == null) {
+            // reconfigMode = false (next shouldn't return null).
+            if (lastIndex >= 0) {
+                // take the last server to which we were connected
+                myServer = this.serverAddresses.get(lastIndex);
+            } else {
+                // take the first server on the list
+                myServer = this.serverAddresses.get(0);
+            }
+        }
+
+        for (InetSocketAddress addr : shuffledList) {
+            if (addr.getPort() == myServer.getPort()
+                && ((addr.getAddress() != null
+                     && myServer.getAddress() != null
+                     && addr.getAddress().equals(myServer.getAddress()))
+                    || addr.getHostString().equals(myServer.getHostString()))) {
+                myServerInNewConfig = true;
+                break;
+            }
+        }
+
+        reconfigMode = true;
+
+        newServers.clear();
+        oldServers.clear();
+        // Divide the new servers into oldServers that were in the previous list
+        // and newServers that were not in the previous list
+        for (InetSocketAddress address : shuffledList) {
+            if (this.serverAddresses.contains(address)) {
+                oldServers.add(address);
+            } else {
+                newServers.add(address);
+            }
+        }
+
+        int numOld = oldServers.size();
+        int numNew = newServers.size();
+
+        // number of servers increased
+        if (numOld + numNew > this.serverAddresses.size()) {
+            if (myServerInNewConfig) {
+                // my server is in new config, but load should be decreased.
+                // Need to decide if this client
+                // is moving to one of the new servers
+                if (sourceOfRandomness.nextFloat() <= (1 - ((float) this.serverAddresses.size()) / (numOld + numNew))) {
+                    pNew = 1;
+                    pOld = 0;
+                } else {
+                    // do nothing special - stay with the current server
+                    reconfigMode = false;
+                }
+            } else {
+                // my server is not in new config, and load on old servers must
+                // be decreased, so connect to
+                // one of the new servers
+                pNew = 1;
+                pOld = 0;
+            }
+        } else { // number of servers stayed the same or decreased
+            if (myServerInNewConfig) {
+                // my server is in new config, and load should be increased, so
+                // stay with this server and do nothing special
+                reconfigMode = false;
+            } else {
+                pOld = ((float) (numOld * (this.serverAddresses.size() - (numOld + numNew))))
+                       / ((numOld + numNew) * (this.serverAddresses.size() - numOld));
+                pNew = 1 - pOld;
+            }
+        }
+
+        if (!reconfigMode) {
+            currentIndex = shuffledList.indexOf(getServerAtCurrentIndex());
+        } else {
+            currentIndex = -1;
+        }
+        this.serverAddresses = shuffledList;
+        currentIndexOld = -1;
+        currentIndexNew = -1;
+        lastIndex = currentIndex;
+
+        LOG.info("Server list updated: oldSize={}, newSize={}, reconfigMode={}", oldSize, newSize, reconfigMode);
+
+        return reconfigMode;
+    }
+
+    /**
+     * Get the next server to connect to.
+     *
+     * @param spinDelay milliseconds to wait if all hosts have been tried once
+     * @return the next server address to connect to
+     */
+    InetSocketAddress next(long spinDelay) {
+        boolean needToSleep = false;
+        InetSocketAddress addr;
+
+        synchronized (this) {
+            if (reconfigMode) {
+                addr = nextHostInReconfigMode();
+                if (addr != null) {
+                    currentIndex = serverAddresses.indexOf(addr);
+                    return resolve(addr);
+                }
+                //tried all servers and couldn't connect
+                reconfigMode = false;
+                needToSleep = (spinDelay > 0);
+            }
+            ++currentIndex;
+            if (currentIndex == serverAddresses.size()) {
+                currentIndex = 0;
+            }
+            addr = serverAddresses.get(currentIndex);
+            needToSleep = needToSleep || (currentIndex == lastIndex && spinDelay > 0);
+            if (lastIndex == -1) {
+                // We don't want to sleep on the first ever connect attempt.
+                lastIndex = 0;
+            }
+        }
+
+        if (needToSleep) {
+            try {
+                Thread.sleep(spinDelay);
+            } catch (InterruptedException e) {
+                LOG.warn("Unexpected exception", e);
+            }
+        }
+
+        return resolve(addr);
+    }
+
+    /**
+     * Notify that a connection has been established successfully.
+     */
+    synchronized void onConnected() {
+        lastIndex = currentIndex;
+        reconfigMode = false;
+    }
+
+    /**
+     * Get the server at the specified index.
+     *
+     * @param i the index
+     * @return the server address at the index, or null if index is out of bounds
+     */
+    synchronized InetSocketAddress getServerAtIndex(int i) {
+        if (i < 0 || i >= serverAddresses.size()) {
+            return null;
+        }
+        return serverAddresses.get(i);
+    }
+
+    /**
+     * Get the server at the current index.
+     *
+     * @return the server address at the current index
+     */
+    synchronized InetSocketAddress getServerAtCurrentIndex() {
+        return getServerAtIndex(currentIndex);
+    }
+
+    /**
+     * Get the number of servers in the list.
+     *
+     * @return the number of servers
+     */
+    synchronized int size() {
+        return serverAddresses.size();
+    }
+
+    /**
+     * Resolves an InetSocketAddress to a concrete address.
+     *
+     * @param address
+     *              the address to resolve
+     * @return resolved address or original address if resolution fails
+     */
+    private InetSocketAddress resolve(InetSocketAddress address) {
+        try {
+            String curHostString = address.getHostString();
+            List<InetAddress> resolvedAddresses = new ArrayList<>(Arrays.asList(this.resolver.getAllByName(curHostString)));
+            if (resolvedAddresses.isEmpty()) {
+                return address;
+            }
+            if (clientConfig.isShuffleDnsResponseEnabled()) {
+                Collections.shuffle(resolvedAddresses);
+            }
+            return new InetSocketAddress(resolvedAddresses.get(0), address.getPort());
+        } catch (UnknownHostException e) {
+            LOG.error("Unable to resolve address: {}", address, e);
+            return address;
+        }
+    }
+
+    /**
+     * Shuffles the server addresses using the internal random source.
+     *
+     * @param serverAddresses
+     *              collection of server addresses to shuffle
+     * @return shuffled list of server addresses
+     */
+    private List<InetSocketAddress> shuffle(Collection<InetSocketAddress> serverAddresses) {
+        List<InetSocketAddress> tmpList = new ArrayList<>(serverAddresses.size());
+        tmpList.addAll(serverAddresses);
+        Collections.shuffle(tmpList, sourceOfRandomness);
+        return tmpList;
+    }
+
+    /**
+     * Get the next server to connect to, when in "reconfigMode", which means that
+     * you've just updated the server list, and now trying to find some server to connect to.
+     * Once onConnected() is called, reconfigMode is set to false. Similarly, if we tried to connect
+     * to all servers in new config and failed, reconfigMode is set to false.
+     *
+     * While in reconfigMode, we should connect to a server in newServers with probability pNew and to servers in
+     * oldServers with probability pOld (which is just 1-pNew). If we tried out all servers in either oldServers
+     * or newServers we continue to try servers from the other set, regardless of pNew or pOld. If we tried all servers
+     * we give up and go back to the normal round robin mode
+     *
+     * When called, this should be protected by synchronized(this)
+     */
+    private InetSocketAddress nextHostInReconfigMode() {
+        boolean takeNew = (sourceOfRandomness.nextFloat() <= pNew);
+
+        // take one of the new servers if it is possible (there are still such
+        // servers we didn't try),
+        // and either the probability tells us to connect to one of the new
+        // servers or if we already
+        // tried all the old servers
+        if (((currentIndexNew + 1) < newServers.size()) && (takeNew || (currentIndexOld + 1) >= oldServers.size())) {
+            ++currentIndexNew;
+            return newServers.get(currentIndexNew);
+        }
+
+        // start taking old servers
+        if ((currentIndexOld + 1) < oldServers.size()) {
+            ++currentIndexOld;
+            return oldServers.get(currentIndexOld);
+        }
+
+        return null;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java
index 73a102f1a8c..f154f080b00 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java
@@ -43,7 +43,7 @@
  * * A HostProvider that prefers nearby hosts.
  */
 @InterfaceAudience.Public
-public interface HostProvider {
+public interface HostProvider extends AutoCloseable {
 
     int size();
 
@@ -72,4 +72,12 @@ public interface HostProvider {
      */
     boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost);
 
+    /**
+     * Close the HostProvider and release any resources.
+     *
+     * Default implementation does nothing for backward compatibility
+     */
+    @Override
+    default void close() {
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java
new file mode 100644
index 00000000000..4f3f3a3741c
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import org.apache.yetus.audience.InterfaceAudience;
+
+/**
+ * Factory for creating appropriate HostProvider instances based on connect string format.
+ * This factory enables zero-code-change migration by automatically detecting the connect
+ * string format and creating the appropriate HostProvider implementation.
+ *
+ * Supported formats:
+ * - Host:Port: "host1:port1,host2:port2,host3:port3" (StaticHostProvider)
+ * - DNS SRV: "dns-srv://service.domain.com"  (DnsSrvHostProvider)
+ *
+ * - Future formats can be easily added by extending the factory
+ */
+@InterfaceAudience.Public
+public class HostProviderFactory {
+    /**
+     * Creates a HostProvider based on the connect string format.
+     * This is a convenience method for zero-code-change migration.
+     *
+     * @param connectString the connect string
+     * @return appropriate HostProvider
+     */
+    public static HostProvider create(final String connectString) {
+        final ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
+        return create(connectStringParser, null);
+    }
+
+    /**
+     * Creates a HostProvider based on the connect string format.
+     *
+     * @param connectStringParser the connect string parser
+     * @param clientConfig ZooKeeper client configuration
+     *
+     * @return appropriate HostProvider
+     */
+    @InterfaceAudience.Private
+    public static HostProvider create(final ConnectStringParser connectStringParser, final ZKClientConfig clientConfig) {
+        switch (connectStringParser.getConnectionType()) {
+            case DNS_SRV:
+                final String dnsSrvName = connectStringParser.getServerAddresses().get(0).getHostString();
+                return new DnsSrvHostProvider(dnsSrvName, clientConfig);
+            default:
+                return new StaticHostProvider(connectStringParser.getServerAddresses(), clientConfig);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
index e07754c3558..6cc45a1a082 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
@@ -21,15 +21,8 @@
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
-import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.Random;
 import org.apache.yetus.audience.InterfaceAudience;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Most simple HostProvider, resolves on every next() call.
@@ -38,6 +31,7 @@
  * present across the stack like in JVM, OS level, hardware, etc. The best we could do here is to get the most recent
  * address from the underlying system which is considered up-to-date.
  *
+ * It uses HostConnectionManager for all connection management and reconfiguration logic.
  */
 @InterfaceAudience.Public
 public final class StaticHostProvider implements HostProvider {
@@ -48,32 +42,7 @@ public interface Resolver {
 
     }
 
-    private static final Logger LOG = LoggerFactory.getLogger(StaticHostProvider.class);
-
-    private ZKClientConfig clientConfig = null;
-
-    private List<InetSocketAddress> serverAddresses = new ArrayList<>(5);
-
-    private Random sourceOfRandomness;
-    private int lastIndex = -1;
-
-    private int currentIndex = -1;
-
-    /**
-     * The following fields are used to migrate clients during reconfiguration
-     */
-    private boolean reconfigMode = false;
-
-    private final List<InetSocketAddress> oldServers = new ArrayList<>(5);
-
-    private final List<InetSocketAddress> newServers = new ArrayList<>(5);
-
-    private int currentIndexOld = -1;
-    private int currentIndexNew = -1;
-
-    private float pOld, pNew;
-
-    private Resolver resolver;
+    private final HostConnectionManager connectionManager;
 
     /**
      * Constructs a SimpleHostSet.
@@ -84,12 +53,7 @@ public interface Resolver {
      *             if serverAddresses is empty or resolves to an empty list
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses) {
-        init(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), new Resolver() {
-            @Override
-            public InetAddress[] getAllByName(String name) throws UnknownHostException {
-                return InetAddress.getAllByName(name);
-            }
-        });
+        connectionManager = new HostConnectionManager(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), null);
     }
 
     /**
@@ -104,12 +68,10 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
      *            ZooKeeper client configuration
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, ZKClientConfig clientConfig) {
-        init(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), new Resolver() {
-            @Override
-            public InetAddress[] getAllByName(String name) throws UnknownHostException {
-                return InetAddress.getAllByName(name);
-            }
-        }, clientConfig);
+        connectionManager = new HostConnectionManager(serverAddresses,
+                                                        System.currentTimeMillis() ^ this.hashCode(),
+                                                        null,
+                                                        clientConfig);
     }
 
     /**
@@ -124,7 +86,10 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
      *              custom resolver implementation
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, Resolver resolver) {
-        init(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), resolver);
+        this.connectionManager = new HostConnectionManager(serverAddresses,
+                                                    System.currentTimeMillis() ^ this.hashCode(),
+                                                    resolver::getAllByName,
+                                                    null);
     }
 
     /**
@@ -133,274 +98,42 @@ public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, Resolve
      *
      * @param serverAddresses
      *            possibly unresolved ZooKeeper server addresses
-     * @param randomnessSeed a seed used to initialize sourceOfRandomnes
+     * @param randomnessSeed a seed used to initialize sourceOfRandomness
      * @throws IllegalArgumentException
      *             if serverAddresses is empty or resolves to an empty list
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, long randomnessSeed) {
-        init(serverAddresses, randomnessSeed, new Resolver() {
-            @Override
-            public InetAddress[] getAllByName(String name) throws UnknownHostException {
-                return InetAddress.getAllByName(name);
-            }
-        });
-    }
-
-    private void init(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, Resolver resolver) {
-        init(serverAddresses, randomnessSeed, resolver, null);
-    }
-
-    private void init(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, Resolver resolver,
-                      ZKClientConfig clientConfig) {
-        this.clientConfig = clientConfig == null ? new ZKClientConfig() : clientConfig;
-        this.sourceOfRandomness = new Random(randomnessSeed);
-        this.resolver = resolver;
-        if (serverAddresses.isEmpty()) {
-            throw new IllegalArgumentException("A HostProvider may not be empty!");
-        }
-        this.serverAddresses = shuffle(serverAddresses);
-        currentIndex = -1;
-        lastIndex = -1;
-    }
-
-    private InetSocketAddress resolve(InetSocketAddress address) {
-        try {
-            String curHostString = address.getHostString();
-            List<InetAddress> resolvedAddresses = new ArrayList<>(Arrays.asList(this.resolver.getAllByName(curHostString)));
-            if (resolvedAddresses.isEmpty()) {
-                return address;
-            }
-            if (clientConfig.isShuffleDnsResponseEnabled()) {
-                Collections.shuffle(resolvedAddresses);
-            }
-            return new InetSocketAddress(resolvedAddresses.get(0), address.getPort());
-        } catch (UnknownHostException e) {
-            LOG.error("Unable to resolve address: {}", address.toString(), e);
-            return address;
-        }
-    }
-
-    private List<InetSocketAddress> shuffle(Collection<InetSocketAddress> serverAddresses) {
-        List<InetSocketAddress> tmpList = new ArrayList<>(serverAddresses.size());
-        tmpList.addAll(serverAddresses);
-        Collections.shuffle(tmpList, sourceOfRandomness);
-        return tmpList;
+        this.connectionManager = new HostConnectionManager(serverAddresses,
+                                                            randomnessSeed,
+                                                            null,
+                                                            null);
     }
 
-    /**
-     * Update the list of servers. This returns true if changing connections is necessary for load-balancing, false
-     * otherwise. Changing connections is necessary if one of the following holds:
-     * a) the host to which this client is currently connected is not in serverAddresses.
-     *    Otherwise (if currentHost is in the new list serverAddresses):
-     * b) the number of servers in the cluster is increasing - in this case the load on currentHost should decrease,
-     *    which means that SOME of the clients connected to it will migrate to the new servers. The decision whether
-     *    this client migrates or not (i.e., whether true or false is returned) is probabilistic so that the expected
-     *    number of clients connected to each server is the same.
-     *
-     * If true is returned, the function sets pOld and pNew that correspond to the probability to migrate to ones of the
-     * new servers in serverAddresses or one of the old servers (migrating to one of the old servers is done only
-     * if our client's currentHost is not in serverAddresses). See nextHostInReconfigMode for the selection logic.
-     *
-     * See <a href="https://issues.apache.org/jira/browse/ZOOKEEPER-1355">ZOOKEEPER-1355</a>
-     * for the protocol and its evaluation, and StaticHostProviderTest for the tests that illustrate how load balancing
-     * works with this policy.
-     *
-     * @param serverAddresses new host list
-     * @param currentHost the host to which this client is currently connected
-     * @return true if changing connections is necessary for load-balancing, false otherwise
-     */
     @Override
-    public synchronized boolean updateServerList(
-        Collection<InetSocketAddress> serverAddresses,
-        InetSocketAddress currentHost) {
-        List<InetSocketAddress> shuffledList = shuffle(serverAddresses);
-        if (shuffledList.isEmpty()) {
-            throw new IllegalArgumentException("A HostProvider may not be empty!");
-        }
-        // Check if client's current server is in the new list of servers
-        boolean myServerInNewConfig = false;
-
-        InetSocketAddress myServer = currentHost;
-
-        // choose "current" server according to the client rebalancing algorithm
-        if (reconfigMode) {
-            myServer = next(0);
-        }
-
-        // if the client is not currently connected to any server
-        if (myServer == null) {
-            // reconfigMode = false (next shouldn't return null).
-            if (lastIndex >= 0) {
-                // take the last server to which we were connected
-                myServer = this.serverAddresses.get(lastIndex);
-            } else {
-                // take the first server on the list
-                myServer = this.serverAddresses.get(0);
-            }
-        }
-
-        for (InetSocketAddress addr : shuffledList) {
-            if (addr.getPort() == myServer.getPort()
-                && ((addr.getAddress() != null
-                     && myServer.getAddress() != null
-                     && addr.getAddress().equals(myServer.getAddress()))
-                    || addr.getHostString().equals(myServer.getHostString()))) {
-                myServerInNewConfig = true;
-                break;
-            }
-        }
-
-        reconfigMode = true;
-
-        newServers.clear();
-        oldServers.clear();
-        // Divide the new servers into oldServers that were in the previous list
-        // and newServers that were not in the previous list
-        for (InetSocketAddress address : shuffledList) {
-            if (this.serverAddresses.contains(address)) {
-                oldServers.add(address);
-            } else {
-                newServers.add(address);
-            }
-        }
-
-        int numOld = oldServers.size();
-        int numNew = newServers.size();
-
-        // number of servers increased
-        if (numOld + numNew > this.serverAddresses.size()) {
-            if (myServerInNewConfig) {
-                // my server is in new config, but load should be decreased.
-                // Need to decide if this client
-                // is moving to one of the new servers
-                if (sourceOfRandomness.nextFloat() <= (1 - ((float) this.serverAddresses.size()) / (numOld + numNew))) {
-                    pNew = 1;
-                    pOld = 0;
-                } else {
-                    // do nothing special - stay with the current server
-                    reconfigMode = false;
-                }
-            } else {
-                // my server is not in new config, and load on old servers must
-                // be decreased, so connect to
-                // one of the new servers
-                pNew = 1;
-                pOld = 0;
-            }
-        } else { // number of servers stayed the same or decreased
-            if (myServerInNewConfig) {
-                // my server is in new config, and load should be increased, so
-                // stay with this server and do nothing special
-                reconfigMode = false;
-            } else {
-                pOld = ((float) (numOld * (this.serverAddresses.size() - (numOld + numNew))))
-                       / ((numOld + numNew) * (this.serverAddresses.size() - numOld));
-                pNew = 1 - pOld;
-            }
-        }
-
-        if (!reconfigMode) {
-            currentIndex = shuffledList.indexOf(getServerAtCurrentIndex());
-        } else {
-            currentIndex = -1;
-        }
-        this.serverAddresses = shuffledList;
-        currentIndexOld = -1;
-        currentIndexNew = -1;
-        lastIndex = currentIndex;
-        return reconfigMode;
-    }
-
-    public synchronized InetSocketAddress getServerAtIndex(int i) {
-        if (i < 0 || i >= serverAddresses.size()) {
-            return null;
-        }
-        return serverAddresses.get(i);
+    public boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost) {
+        return connectionManager.updateServerList(serverAddresses, currentHost);
     }
 
-    public synchronized InetSocketAddress getServerAtCurrentIndex() {
-        return getServerAtIndex(currentIndex);
+    @Override
+    public int size() {
+        return connectionManager.size();
     }
 
-    public synchronized int size() {
-        return serverAddresses.size();
+    @Override
+    public InetSocketAddress next(long spinDelay) {
+        return connectionManager.next(spinDelay);
     }
 
-    /**
-     * Get the next server to connect to, when in "reconfigMode", which means that
-     * you've just updated the server list, and now trying to find some server to connect to.
-     * Once onConnected() is called, reconfigMode is set to false. Similarly, if we tried to connect
-     * to all servers in new config and failed, reconfigMode is set to false.
-     *
-     * While in reconfigMode, we should connect to a server in newServers with probability pNew and to servers in
-     * oldServers with probability pOld (which is just 1-pNew). If we tried out all servers in either oldServers
-     * or newServers we continue to try servers from the other set, regardless of pNew or pOld. If we tried all servers
-     * we give up and go back to the normal round robin mode
-     *
-     * When called, this should be protected by synchronized(this)
-     */
-    private InetSocketAddress nextHostInReconfigMode() {
-        boolean takeNew = (sourceOfRandomness.nextFloat() <= pNew);
-
-        // take one of the new servers if it is possible (there are still such
-        // servers we didn't try),
-        // and either the probability tells us to connect to one of the new
-        // servers or if we already
-        // tried all the old servers
-        if (((currentIndexNew + 1) < newServers.size()) && (takeNew || (currentIndexOld + 1) >= oldServers.size())) {
-            ++currentIndexNew;
-            return newServers.get(currentIndexNew);
-        }
-
-        // start taking old servers
-        if ((currentIndexOld + 1) < oldServers.size()) {
-            ++currentIndexOld;
-            return oldServers.get(currentIndexOld);
-        }
-
-        return null;
+    @Override
+    public void onConnected() {
+        connectionManager.onConnected();
     }
 
-    public InetSocketAddress next(long spinDelay) {
-        boolean needToSleep = false;
-        InetSocketAddress addr;
-
-        synchronized (this) {
-            if (reconfigMode) {
-                addr = nextHostInReconfigMode();
-                if (addr != null) {
-                    currentIndex = serverAddresses.indexOf(addr);
-                    return resolve(addr);
-                }
-                //tried all servers and couldn't connect
-                reconfigMode = false;
-                needToSleep = (spinDelay > 0);
-            }
-            ++currentIndex;
-            if (currentIndex == serverAddresses.size()) {
-                currentIndex = 0;
-            }
-            addr = serverAddresses.get(currentIndex);
-            needToSleep = needToSleep || (currentIndex == lastIndex && spinDelay > 0);
-            if (lastIndex == -1) {
-                // We don't want to sleep on the first ever connect attempt.
-                lastIndex = 0;
-            }
-        }
-        if (needToSleep) {
-            try {
-                Thread.sleep(spinDelay);
-            } catch (InterruptedException e) {
-                LOG.warn("Unexpected exception", e);
-            }
-        }
-
-        return resolve(addr);
+    public InetSocketAddress getServerAtIndex(int i) {
+        return connectionManager.getServerAtIndex(i);
     }
 
-    public synchronized void onConnected() {
-        lastIndex = currentIndex;
-        reconfigMode = false;
+    public InetSocketAddress getServerAtCurrentIndex() {
+        return connectionManager.getServerAtCurrentIndex();
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index 91a390dda31..a429d483834 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -69,6 +69,13 @@ public class ZKClientConfig extends ZKConfig {
     public static final String ZOOKEEPER_SHUFFLE_DNS_RESPONSE = "zookeeper.shuffleDnsResponse";
     public static final boolean ZOOKEEPER_SHUFFLE_DNS_RESPONSE_DEFAULT = false;
 
+    /**
+     * DNS SRV refresh interval in seconds for DnsSrvHostProvider.
+     * A value of 0 disables periodic refresh.
+     */
+    public static final String DNS_SRV_REFRESH_INTERVAL_SECONDS = "zookeeper.hostProvider.dnsSrvRefreshIntervalSeconds";
+    public static final long DNS_SRV_REFRESH_INTERVAL_SECONDS_DEFAULT = 60;
+
     public ZKClientConfig() {
         super();
         initFromJavaSystemProperties();
@@ -129,6 +136,7 @@ protected void handleBackwardCompatibility() {
         setProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET, System.getProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET));
         setProperty(SECURE_CLIENT, System.getProperty(SECURE_CLIENT));
         setProperty(ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, System.getProperty(ZK_SASL_CLIENT_ALLOW_REVERSE_DNS));
+        setProperty(DNS_SRV_REFRESH_INTERVAL_SECONDS, System.getProperty(DNS_SRV_REFRESH_INTERVAL_SECONDS));
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java
new file mode 100644
index 00000000000..386cb9d5a11
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class HostProviderSelectionTest extends ZKTestCase {
+    @Test
+    public void testStaticHostProviderSelection() throws Exception {
+        final String[] staticFormats = {
+                "localhost:2181",
+                "zk1:2181,zk2:2181,zk3:2181",
+                "zk1:2181,zk2:2181/myapp",
+                "[::1]:2181,[2001:db8::1]:2181"
+        };
+
+        for (final String connectString : staticFormats) {
+            // Test without config
+            try (final ZooKeeper zk = new ZooKeeper(connectString,
+                    ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE)) {
+                assertNotNull(zk);
+            }
+
+            // Test with config
+            final ZKClientConfig config = new ZKClientConfig();
+            try (final ZooKeeper zk = new ZooKeeper(connectString,
+                    ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE, config)) {
+                assertNotNull(zk);
+            }
+        }
+    }
+
+    @Test
+    public void testDnsSrvHostProviderSelection() {
+        final String[] dnsSrvFormats = {
+                "dns-srv://nonexistent.test.local",
+                "dns-srv://nonexistent.test.local/myapp"
+        };
+
+        for (final String connectString : dnsSrvFormats) {
+            // Test without config
+            final IllegalArgumentException exception1 = assertThrows(IllegalArgumentException.class, () ->
+                    new ZooKeeper(connectString, ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE));
+            validateDnsSrvError(exception1);
+
+            // Test with config
+            final ZKClientConfig config = new ZKClientConfig();
+            final IllegalArgumentException exception2 = assertThrows(IllegalArgumentException.class, () ->
+                    new ZooKeeper(connectString, ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE, config));
+            validateDnsSrvError(exception2);
+        }
+    }
+
+    @Test
+    public void testInvalidFormats() {
+        final String[] invalidFormats = {
+                "",
+                "dns-srv://"
+        };
+
+        for (final String connectString : invalidFormats) {
+            final IllegalArgumentException exception = assertThrows(IllegalArgumentException.class, () ->
+                    new ZooKeeper(connectString, ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE));
+            final String message = exception.getMessage();
+            assertTrue(message.contains("Connect string cannot be null or empty")
+                || message.contains("DNS name cannot be null or empty"));
+        }
+    }
+
+    private void validateDnsSrvError(final IllegalArgumentException exception) {
+        final String message = exception.getMessage();
+        assertTrue(message.contains("Failed to initialize DnsSrvHostProvider for DNS name:"));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java
new file mode 100644
index 00000000000..136b6e47ac4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java
@@ -0,0 +1,214 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.net.InetSocketAddress;
+import java.util.HashSet;
+import java.util.Set;
+import org.apache.zookeeper.client.DnsSrvHostProvider.DnsSrvResolver;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xbill.DNS.Name;
+import org.xbill.DNS.SRVRecord;
+
+public class DnsSrvHostProviderTest {
+
+    private static final String TEST_DNS_NAME = "_zookeeper._tcp.example.com.";
+    private static final long TEST_SEED = 12345L;
+
+    private DnsSrvResolver mockDnsSrvResolver;
+
+    @BeforeEach
+    public void setUp() {
+        mockDnsSrvResolver = mock(DnsSrvResolver.class);
+    }
+
+    @AfterEach
+    public void tearDown() {
+        System.clearProperty(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS);
+    }
+
+    @Test
+    public void testBasic() throws Exception {
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            assertEquals(3, hostProvider.size());
+            assertNotNull(hostProvider.next(0));
+        }
+    }
+
+    @Test
+    public void testServerIteration() throws Exception {
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            final InetSocketAddress addr1 = hostProvider.next(0);
+            final InetSocketAddress addr2 = hostProvider.next(0);
+            final InetSocketAddress addr3 = hostProvider.next(0);
+
+            final Set<InetSocketAddress> actualAddresses = new HashSet<>();
+            actualAddresses.add(addr1);
+            actualAddresses.add(addr2);
+            actualAddresses.add(addr3);
+
+            final Set<InetSocketAddress> expectedAddresses = new HashSet<>();
+            expectedAddresses.add(new InetSocketAddress("server1.example.com", 2181));
+            expectedAddresses.add(new InetSocketAddress("server2.example.com", 2181));
+            expectedAddresses.add(new InetSocketAddress("server3.example.com", 2181));
+
+            assertEquals(expectedAddresses, actualAddresses);
+
+            // cycle back
+            final InetSocketAddress addr4 = hostProvider.next(0);
+            assertTrue(expectedAddresses.contains(addr4));
+        }
+    }
+
+    @Test
+    public void testEmptyDnsName() {
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider("", TEST_SEED, mockDnsSrvResolver, null));
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider(null, TEST_SEED, mockDnsSrvResolver, null));
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider("   ", TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testNoSrvRecords() throws Exception {
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(new SRVRecord[0]);
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testDnsLookupFailure() throws Exception {
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME))
+                .thenThrow(new java.io.IOException("DNS lookup failed"));
+
+        assertThrows(IllegalArgumentException.class,
+                () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testInvalidPortFiltering() throws Exception {
+        // Create SRV record with invalid port (0)
+        final SRVRecord invalidPortRecord = createMockSrvRecord("server1.example.com.", 0);
+        final SRVRecord[] srvRecords = new SRVRecord[]{invalidPortRecord};
+
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testTrailingDotRemoval() throws Exception {
+        final SRVRecord recordWithDot = createMockSrvRecord("server1.example.com.", 2181);
+        final SRVRecord[] srvRecords = new SRVRecord[]{recordWithDot};
+
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            assertEquals(1, hostProvider.size());
+            final InetSocketAddress addr = hostProvider.next(0);
+
+            // validate trailing dot is removed
+            assertEquals("server1.example.com", addr.getHostString());
+        }
+    }
+
+    @Test
+    public void testRefreshIntervalZeroDisablesPeriodicRefresh() throws Exception {
+        // Set system property to disable refresh
+        System.setProperty(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS, "0");
+
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            // Verify initial setup works
+            assertEquals(3, hostProvider.size());
+
+            // Wait to ensure no background refresh occurs
+            Thread.sleep(1000);
+
+            // Verify DNS resolver was only called once during initialization (no periodic refresh)
+            verify(mockDnsSrvResolver, times(1)).lookupSrvRecords(TEST_DNS_NAME);
+
+            // Verify host provider still works normally
+            assertNotNull(hostProvider.next(0));
+
+            // Test multiple next() calls to ensure functionality is not affected
+            for (int i = 0; i < 5; i++) {
+                assertNotNull(hostProvider.next(0));
+            }
+
+            // Verify no additional DNS calls were made
+            verify(mockDnsSrvResolver, times(1)).lookupSrvRecords(TEST_DNS_NAME);
+        }
+    }
+
+    @Test
+    public void testRefreshIntervalNegative() throws Exception {
+        System.setProperty(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS, "-1");
+
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        final IllegalArgumentException exception = assertThrows(IllegalArgumentException.class,
+                () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+
+        assertEquals("Invalid DNS SRV refresh interval: -1", exception.getMessage());
+    }
+
+    private SRVRecord[] createMockSrvRecords() {
+        return new SRVRecord[]{
+            createMockSrvRecord("server1.example.com.", 2181),
+            createMockSrvRecord("server2.example.com.", 2181),
+            createMockSrvRecord("server3.example.com.", 2181)
+        };
+    }
+
+    private SRVRecord createMockSrvRecord(final String target, final int port) {
+        try {
+            final Name targetName = Name.fromString(target);
+            final Name serviceName = Name.fromString(TEST_DNS_NAME);
+            return new SRVRecord(serviceName, 1, 300, 1, 1, port, targetName);
+        } catch (final Exception e) {
+            throw new RuntimeException("Failed to create mock SRV record", e);
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
index fc30e69920f..d7d55a4b135 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
@@ -19,6 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.util.HashMap;
+import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.junit.jupiter.api.Test;
@@ -106,4 +111,89 @@ public void testParseIPV6ConnectionString() {
         assertEquals(2183, parser.getServerAddresses().get(2).getPort());
     }
 
+    @Test
+    public void testDnsSrvFormatNoChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.myapp.com", "zookeeper.myapp.com", null);
+    }
+
+    @Test
+    public void testDnsSrvFormatWithChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.myapp.com/myapp", "zookeeper.myapp.com", "/myapp");
+    }
+
+    @Test
+    public void testDnsSrvFormatWithNestedChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.shared.com/services/auth", "zookeeper.shared.com", "/services/auth");
+    }
+
+    @Test
+    public void testDnsSrvFormatWithRootChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.myapp.com/", "zookeeper.myapp.com", null);
+    }
+
+    @Test
+    public void testDnsSrvFormatWithSubdomain() {
+        testDnsSrvFormat("dns-srv://zk.prod.myapp.com/production", "zk.prod.myapp.com", "/production");
+    }
+
+    @Test
+    public void testDnsSrvFormatInvalidChroot() {
+        final String connectString = "dns-srv://zookeeper.myapp.com/invalid/";
+        assertThrows(IllegalArgumentException.class, () -> new ConnectStringParser(connectString));
+    }
+
+    @Test
+    public void testMixedFormatsComparison() {
+        final String hostPortFormat = "zk1:2181,zk2:2181/myapp";
+        final String dnsSrvFormat = "dns-srv://zookeeper.myapp.com/myapp";
+
+        final ConnectStringParser hostPortParser = new ConnectStringParser(hostPortFormat);
+        final ConnectStringParser dnsSrvParser = new ConnectStringParser(dnsSrvFormat);
+
+        // Both should have the same chroot path
+        assertEquals("/myapp", hostPortParser.getChrootPath());
+        assertEquals("/myapp", dnsSrvParser.getChrootPath());
+
+        // Host:Port format should have multiple server addresses
+        assertEquals(2, hostPortParser.getServerAddresses().size());
+        assertEquals("zk1", hostPortParser.getServerAddresses().get(0).getHostString());
+        assertEquals("zk2", hostPortParser.getServerAddresses().get(1).getHostString());
+
+        // DNS SRV format should have single DNS service name
+        assertEquals(1, dnsSrvParser.getServerAddresses().size());
+        assertEquals("zookeeper.myapp.com", dnsSrvParser.getServerAddresses().get(0).getHostString());
+    }
+
+    @Test
+    public void testBackwardCompatibility() {
+        final Map<String, Integer> testCases = new HashMap<>();
+
+        testCases.put("localhost:2181", 1);
+        testCases.put("zk1:2181,zk2:2181,zk3:2181", 3);
+        testCases.put("zk1:2181,zk2:2181/myapp", 2);
+        testCases.put("[::1]:2181", 1);
+        testCases.put("[2001:db8::1]:2181,[2001:db8::2]:2181/test", 2);
+
+        for (final Map.Entry<String, Integer> testCase : testCases.entrySet()) {
+            final String connectString = testCase.getKey();
+            final int expectedSize = testCase.getValue();
+
+            final ConnectStringParser parser = new ConnectStringParser(connectString);
+            assertNotNull(parser.getServerAddresses());
+            assertEquals(expectedSize, parser.getServerAddresses().size());
+        }
+    }
+
+    private void testDnsSrvFormat(final String connectString, final String expectedHostName, final String expectedChrootPath) {
+        final ConnectStringParser parser = new ConnectStringParser(connectString);
+
+        if (expectedChrootPath == null) {
+            assertNull(parser.getChrootPath());
+        } else {
+            assertEquals(expectedChrootPath, parser.getChrootPath());
+        }
+        assertEquals(1, parser.getServerAddresses().size());
+        assertEquals(expectedHostName, parser.getServerAddresses().get(0).getHostString());
+        assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+    }
 }

From 321f84dfcceba572fc79aff794ad196c7762ea23 Mon Sep 17 00:00:00 2001
From: Andor Molnar <andor@cloudera.com>
Date: Tue, 20 Jan 2026 18:44:47 -0600
Subject: [PATCH 570/591] Fix checkstyle and license issues

---
 dev/docker/Dockerfile                            |  2 +-
 .../org/apache/zookeeper/common/ZKConfig.java    |  1 -
 .../apache/zookeeper/common/ZKConfigTest.java    |  8 +++-----
 .../apache/zookeeper/test/LoggerTestTool.java    |  1 -
 .../src/test/resources/zookeeper-client.config   | 16 +++++++++++++++-
 5 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/dev/docker/Dockerfile b/dev/docker/Dockerfile
index a1b33569e79..4d8a5d08dd1 100644
--- a/dev/docker/Dockerfile
+++ b/dev/docker/Dockerfile
@@ -17,7 +17,7 @@
 # under the License.
 #
 
-FROM maven:3.8.4-jdk-8
+FROM maven:3.8.4-jdk-11
 
 RUN apt-get update
 RUN apt-get install -y \
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 8564050d624..2c9e63199c5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -29,7 +29,6 @@
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
-
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
 import org.slf4j.Logger;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
index 7b87e2e3e0d..31af82d34e0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
@@ -22,17 +22,15 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
-
+import ch.qos.logback.classic.Level;
+import java.io.File;
+import java.io.IOException;
 import org.apache.zookeeper.test.LoggerTestTool;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
-import ch.qos.logback.classic.Level;
-
-import java.io.File;
-import java.io.IOException;
 
 public class ZKConfigTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
index 5f225ee1804..5633c08b0e1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
@@ -30,7 +30,6 @@
 import java.io.IOException;
 import java.io.LineNumberReader;
 import java.io.StringReader;
-
 import org.slf4j.LoggerFactory;
 
 public class LoggerTestTool implements AutoCloseable {
diff --git a/zookeeper-server/src/test/resources/zookeeper-client.config b/zookeeper-server/src/test/resources/zookeeper-client.config
index 096105ce95c..4718f6d9c2c 100644
--- a/zookeeper-server/src/test/resources/zookeeper-client.config
+++ b/zookeeper-server/src/test/resources/zookeeper-client.config
@@ -1,5 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # Sample secrets
 zookeeper.ssl.keyStore.password=FileSecret456!
 zookeeper.ssl.keyStore.passwordPath=/home/zookeeper/top_secret.txt
 ssl.quorum.keyStore.password=AnotherFileSecret789!
-

From fbd87aa5becf61d173085c9c92aacbe446cf22bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Wed, 21 Jan 2026 16:34:04 -0600
Subject: [PATCH 571/591] ZOOKEEPER-5017: Upgrade Netty to 4.1.130.Final to
 address CVE-2025-67735

Reviewers: tisonkun, ctubbsii
Author: anmolnar
Closes #2348 from anmolnar/ZOOKEEPER-5017
---
 pom.xml                                                         | 2 +-
 ...Final.LICENSE.txt => netty-buffer-4.1.130.Final.LICENSE.txt} | 0
 ....Final.LICENSE.txt => netty-codec-4.1.130.Final.LICENSE.txt} | 0
 ...Final.LICENSE.txt => netty-common-4.1.130.Final.LICENSE.txt} | 0
 ...inal.LICENSE.txt => netty-handler-4.1.130.Final.LICENSE.txt} | 0
 ...nal.LICENSE.txt => netty-resolver-4.1.130.Final.LICENSE.txt} | 0
 ...al.LICENSE.txt => netty-transport-4.1.130.Final.LICENSE.txt} | 0
 ... => netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt} | 0
 ...etty-transport-native-unix-common-4.1.130.Final.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{netty-buffer-4.1.127.Final.LICENSE.txt => netty-buffer-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-codec-4.1.127.Final.LICENSE.txt => netty-codec-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-common-4.1.127.Final.LICENSE.txt => netty-common-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-handler-4.1.127.Final.LICENSE.txt => netty-handler-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-resolver-4.1.127.Final.LICENSE.txt => netty-resolver-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-4.1.127.Final.LICENSE.txt => netty-transport-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt => netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{netty-transport-native-unix-common-4.1.127.Final.LICENSE.txt => netty-transport-native-unix-common-4.1.130.Final.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 552659bc7f5..98b5b8bd2be 100644
--- a/pom.xml
+++ b/pom.xml
@@ -559,7 +559,7 @@
     <mockito.version>4.9.0</mockito.version>
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
-    <netty.version>4.1.127.Final</netty.version>
+    <netty.version>4.1.130.Final</netty.version>
     <jetty.version>9.4.57.v20241219</jetty.version>
     <jackson.version>2.18.1</jackson.version>
     <jline.version>3.25.1</jline.version>
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-common-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-handler-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-resolver-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.127.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.130.Final.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.127.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.130.Final.LICENSE.txt

From 9a90ee2decab1c20bf2558eb66eadc43f88eb7b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Wed, 28 Jan 2026 09:13:43 -0600
Subject: [PATCH 572/591] ZOOKEEPER-5018: Upgrade Jetty to 9.4.58.v20250814 in
 order to fix CVE-2025-5115

Reviewers: tisonkun, eolivelli, PDavid
Author: anmolnar
Closes #2350 from anmolnar/ZOOKEEPER-5018
---
 pom.xml                                                         | 2 +-
 ...19.LICENSE.txt => jetty-client-9.4.58.v20250814.LICENSE.txt} | 0
 ...1219.LICENSE.txt => jetty-http-9.4.58.v20250814.LICENSE.txt} | 0
 ...241219.LICENSE.txt => jetty-io-9.4.58.v20250814.LICENSE.txt} | 0
 ....LICENSE.txt => jetty-security-9.4.58.v20250814.LICENSE.txt} | 0
 ...19.LICENSE.txt => jetty-server-9.4.58.v20250814.LICENSE.txt} | 0
 ...9.LICENSE.txt => jetty-servlet-9.4.58.v20250814.LICENSE.txt} | 0
 ...1219.LICENSE.txt => jetty-util-9.4.58.v20250814.LICENSE.txt} | 0
 ...LICENSE.txt => jetty-util-ajax-9.4.58.v20250814.LICENSE.txt} | 0
 9 files changed, 1 insertion(+), 1 deletion(-)
 rename zookeeper-server/src/main/resources/lib/{jetty-client-9.4.57.v20241219.LICENSE.txt => jetty-client-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.57.v20241219.LICENSE.txt => jetty-http-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.57.v20241219.LICENSE.txt => jetty-io-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.57.v20241219.LICENSE.txt => jetty-security-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.57.v20241219.LICENSE.txt => jetty-server-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.57.v20241219.LICENSE.txt => jetty-servlet-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.57.v20241219.LICENSE.txt => jetty-util-9.4.58.v20250814.LICENSE.txt} (100%)
 rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.57.v20241219.LICENSE.txt => jetty-util-ajax-9.4.58.v20250814.LICENSE.txt} (100%)

diff --git a/pom.xml b/pom.xml
index 98b5b8bd2be..2811e0dfa06 100644
--- a/pom.xml
+++ b/pom.xml
@@ -560,7 +560,7 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.130.Final</netty.version>
-    <jetty.version>9.4.57.v20241219</jetty.version>
+    <jetty.version>9.4.58.v20250814</jetty.version>
     <jackson.version>2.18.1</jackson.version>
     <jline.version>3.25.1</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-client-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-client-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.58.v20250814.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.57.v20241219.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.58.v20250814.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.57.v20241219.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.58.v20250814.LICENSE.txt

From dc2767f1a91b78805c03b18abd333e4c1a1d46c3 Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Wed, 28 Jan 2026 09:23:14 -0800
Subject: [PATCH 573/591] ZOOKEEPER-4983: Add client-triggered operation count
 metrics (#2328)

* ZOOKEEPER-4983: Add client-triggered operation count metrics

Author: Li Wang <liwang@apple.com>

* ZOOKEEPER-4983: Add client-triggered operation count metrics

Author: Li Wang <liwang@apple.com>

---------

Co-authored-by: liwang <liwang@apple.com>
---
 .../server/FinalRequestProcessor.java         |  36 ++-
 .../zookeeper/server/ServerMetrics.java       |  53 +++++
 .../server/ServerMetricsOpCountTest.java      | 218 ++++++++++++++++++
 3 files changed, 305 insertions(+), 2 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 911583f9fc2..9861f5ffe35 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -49,6 +49,7 @@
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.metrics.Counter;
 import org.apache.zookeeper.proto.AddWatchRequest;
 import org.apache.zookeeper.proto.CheckWatchesRequest;
 import org.apache.zookeeper.proto.Create2Response;
@@ -213,6 +214,7 @@ public void processRequest(Request request) {
             switch (request.type) {
             case OpCode.ping: {
                 lastOp = "PING";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_PING);
                 updateStats(request, lastOp, lastZxid);
 
                 responseSize = cnxn.sendResponse(new ReplyHeader(ClientCnxn.PING_XID, lastZxid, 0), null, "response");
@@ -220,6 +222,7 @@ public void processRequest(Request request) {
             }
             case OpCode.createSession: {
                 lastOp = "SESS";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CREATE_SESSION);
                 updateStats(request, lastOp, lastZxid);
 
                 zks.finishSessionInit(request.cnxn, true);
@@ -227,6 +230,7 @@ public void processRequest(Request request) {
             }
             case OpCode.multi: {
                 lastOp = "MULT";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_MULTI);
                 rsp = new MultiResponse();
 
                 for (ProcessTxnResult subTxnResult : rc.multiResult) {
@@ -269,6 +273,7 @@ public void processRequest(Request request) {
             }
             case OpCode.multiRead: {
                 lastOp = "MLTR";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_MULTI_READ);
                 MultiOperationRecord multiReadRecord = request.readRequestRecord(MultiOperationRecord::new);
                 rsp = new MultiResponse();
                 OpResult subResult;
@@ -297,6 +302,7 @@ public void processRequest(Request request) {
             }
             case OpCode.create: {
                 lastOp = "CREA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CREATE);
                 rsp = new CreateResponse(rc.path);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -306,6 +312,7 @@ public void processRequest(Request request) {
             case OpCode.createTTL:
             case OpCode.createContainer: {
                 lastOp = "CREA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CREATE);
                 rsp = new Create2Response(rc.path, rc.stat);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -314,12 +321,14 @@ public void processRequest(Request request) {
             case OpCode.delete:
             case OpCode.deleteContainer: {
                 lastOp = "DELE";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_DELETE);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
                 break;
             }
             case OpCode.setData: {
                 lastOp = "SETD";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_DATA);
                 rsp = new SetDataResponse(rc.stat);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -327,14 +336,16 @@ public void processRequest(Request request) {
             }
             case OpCode.reconfig: {
                 lastOp = "RECO";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_RECONFIG);
                 rsp = new GetDataResponse(
-                    ((QuorumZooKeeperServer) zks).self.getQuorumVerifier().toString().getBytes(UTF_8),
-                    rc.stat);
+                        ((QuorumZooKeeperServer) zks).self.getQuorumVerifier().toString().getBytes(UTF_8),
+                        rc.stat);
                 err = Code.get(rc.err);
                 break;
             }
             case OpCode.setACL: {
                 lastOp = "SETA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_ACL);
                 rsp = new SetACLResponse(rc.stat);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -342,11 +353,13 @@ public void processRequest(Request request) {
             }
             case OpCode.closeSession: {
                 lastOp = "CLOS";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CLOSE_SESSION);
                 err = Code.get(rc.err);
                 break;
             }
             case OpCode.sync: {
                 lastOp = "SYNC";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SYNC);
                 SyncRequest syncRequest = request.readRequestRecord(SyncRequest::new);
                 rsp = new SyncResponse(syncRequest.getPath());
                 requestPathMetricsCollector.registerRequest(request.type, syncRequest.getPath());
@@ -354,12 +367,14 @@ public void processRequest(Request request) {
             }
             case OpCode.check: {
                 lastOp = "CHEC";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CHECK);
                 rsp = new SetDataResponse(rc.stat);
                 err = Code.get(rc.err);
                 break;
             }
             case OpCode.exists: {
                 lastOp = "EXIS";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_EXISTS);
                 ExistsRequest existsRequest = request.readRequestRecord(ExistsRequest::new);
                 path = existsRequest.getPath();
                 if (path.indexOf('\0') != -1) {
@@ -382,6 +397,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getData: {
                 lastOp = "GETD";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_DATA);
                 GetDataRequest getDataRequest = request.readRequestRecord(GetDataRequest::new);
                 path = getDataRequest.getPath();
                 rsp = handleGetDataRequest(getDataRequest, cnxn, request.authInfo);
@@ -390,6 +406,7 @@ public void processRequest(Request request) {
             }
             case OpCode.setWatches: {
                 lastOp = "SETW";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_WATCHES);
                 SetWatches setWatches = request.readRequestRecord(SetWatches::new);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase()
@@ -405,6 +422,7 @@ public void processRequest(Request request) {
             }
             case OpCode.setWatches2: {
                 lastOp = "STW2";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_WATCHES);
                 SetWatches2 setWatches = request.readRequestRecord(SetWatches2::new);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase().setWatches(relativeZxid,
@@ -418,6 +436,7 @@ public void processRequest(Request request) {
             }
             case OpCode.addWatch: {
                 lastOp = "ADDW";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_ADD_WATCH);
                 AddWatchRequest addWatcherRequest = request.readRequestRecord(AddWatchRequest::new);
                 zks.getZKDatabase().addWatch(addWatcherRequest.getPath(), cnxn, addWatcherRequest.getMode());
                 rsp = new ErrorResponse(0);
@@ -425,6 +444,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getACL: {
                 lastOp = "GETA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_ACL);
                 GetACLRequest getACLRequest = request.readRequestRecord(GetACLRequest::new);
                 path = getACLRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
@@ -467,6 +487,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getChildren: {
                 lastOp = "GETC";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_CHILDREN);
                 GetChildrenRequest getChildrenRequest = request.readRequestRecord(GetChildrenRequest::new);
                 path = getChildrenRequest.getPath();
                 rsp = handleGetChildrenRequest(getChildrenRequest, cnxn, request.authInfo);
@@ -475,6 +496,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getAllChildrenNumber: {
                 lastOp = "GETACN";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_ALL_CHILDREN_NUMBER);
                 GetAllChildrenNumberRequest getAllChildrenNumberRequest = request.readRequestRecord(GetAllChildrenNumberRequest::new);
                 path = getAllChildrenNumberRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
@@ -494,6 +516,7 @@ public void processRequest(Request request) {
             }
             case OpCode.getChildren2: {
                 lastOp = "GETC";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_CHILDREN);
                 GetChildren2Request getChildren2Request = request.readRequestRecord(GetChildren2Request::new);
                 Stat stat = new Stat();
                 path = getChildren2Request.getPath();
@@ -515,6 +538,7 @@ public void processRequest(Request request) {
             }
             case OpCode.checkWatches: {
                 lastOp = "CHKW";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CHECK_WATCHES);
                 CheckWatchesRequest checkWatches = request.readRequestRecord(CheckWatchesRequest::new);
                 WatcherType type = WatcherType.fromInt(checkWatches.getType());
                 path = checkWatches.getPath();
@@ -528,6 +552,7 @@ public void processRequest(Request request) {
             }
             case OpCode.removeWatches: {
                 lastOp = "REMW";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_REMOVE_WATCHES);
                 RemoveWatchesRequest removeWatches = request.readRequestRecord(RemoveWatchesRequest::new);
                 WatcherType type = WatcherType.fromInt(removeWatches.getType());
                 path = removeWatches.getPath();
@@ -541,11 +566,13 @@ public void processRequest(Request request) {
             }
             case OpCode.whoAmI: {
                 lastOp = "HOMI";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_WHO_AM_I);
                 rsp = new WhoAmIResponse(AuthUtil.getClientInfos(request.authInfo));
                 break;
              }
             case OpCode.getEphemerals: {
                 lastOp = "GETE";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_EPHEMERALS);
                 GetEphemeralsRequest getEphemerals = request.readRequestRecord(GetEphemeralsRequest::new);
                 String prefixPath = getEphemerals.getPrefixPath();
                 Set<String> allEphems = zks.getZKDatabase().getDataTree().getEphemerals(request.sessionId);
@@ -677,4 +704,9 @@ private void updateStats(Request request, String lastOp, long lastZxid) {
         request.cnxn.updateStatsForResponse(request.cxid, lastZxid, lastOp, request.createTime, currentTime);
     }
 
+    private void incrementOpCount(final Counter specificCounter) {
+        final ServerMetrics metrics = ServerMetrics.getMetrics();
+        specificCounter.add(1);
+        metrics.OP_COUNT_TOTAL.add(1);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index 07d2c1b904a..dab8446472e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -272,6 +272,32 @@ private ServerMetrics(MetricsProvider metricsProvider) {
 
         TTL_NODE_DELETED_COUNT = metricsContext.getCounter("ttl_node_deleted_count");
         TTL_NODE_CREATED_COUNT = metricsContext.getCounter("ttl_node_created_count");
+
+        // Operation count metrics
+        OP_COUNT_TOTAL = metricsContext.getCounter("op_count_total");
+        OP_COUNT_ADD_WATCH = metricsContext.getCounter("op_count_add_watch");
+        OP_COUNT_CHECK = metricsContext.getCounter("op_count_check");
+        OP_COUNT_CHECK_WATCHES = metricsContext.getCounter("op_count_check_watches");
+        OP_COUNT_CLOSE_SESSION = metricsContext.getCounter("op_count_close_session");
+        OP_COUNT_CREATE = metricsContext.getCounter("op_count_create");
+        OP_COUNT_CREATE_SESSION = metricsContext.getCounter("op_count_create_session");
+        OP_COUNT_DELETE = metricsContext.getCounter("op_count_delete");
+        OP_COUNT_EXISTS = metricsContext.getCounter("op_count_exists");
+        OP_COUNT_GET_ACL = metricsContext.getCounter("op_count_get_acl");
+        OP_COUNT_GET_ALL_CHILDREN_NUMBER = metricsContext.getCounter("op_count_get_all_children_number");
+        OP_COUNT_GET_CHILDREN = metricsContext.getCounter("op_count_get_children");
+        OP_COUNT_GET_DATA = metricsContext.getCounter("op_count_get_data");
+        OP_COUNT_GET_EPHEMERALS = metricsContext.getCounter("op_count_get_ephemerals");
+        OP_COUNT_MULTI = metricsContext.getCounter("op_count_multi");
+        OP_COUNT_MULTI_READ = metricsContext.getCounter("op_count_multi_read");
+        OP_COUNT_PING = metricsContext.getCounter("op_count_ping");
+        OP_COUNT_RECONFIG = metricsContext.getCounter("op_count_reconfig");
+        OP_COUNT_REMOVE_WATCHES = metricsContext.getCounter("op_count_remove_watches");
+        OP_COUNT_SET_ACL = metricsContext.getCounter("op_count_set_acl");
+        OP_COUNT_SET_DATA = metricsContext.getCounter("op_count_set_data");
+        OP_COUNT_SET_WATCHES = metricsContext.getCounter("op_count_set_watches");
+        OP_COUNT_SYNC = metricsContext.getCounter("op_count_sync");
+        OP_COUNT_WHO_AM_I = metricsContext.getCounter("op_count_who_am_i");
     }
 
     /**
@@ -556,6 +582,33 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter TTL_NODE_DELETED_COUNT;
     public final Counter TTL_NODE_CREATED_COUNT;
 
+    // Operation count metrics
+    public final Counter OP_COUNT_TOTAL;
+    public final Counter OP_COUNT_ADD_WATCH;
+    public final Counter OP_COUNT_CHECK;
+    public final Counter OP_COUNT_CHECK_WATCHES;
+    public final Counter OP_COUNT_CLOSE_SESSION;
+    public final Counter OP_COUNT_CREATE;
+    public final Counter OP_COUNT_CREATE_SESSION;
+    public final Counter OP_COUNT_DELETE;
+    public final Counter OP_COUNT_EXISTS;
+    public final Counter OP_COUNT_GET_ACL;
+    public final Counter OP_COUNT_GET_ALL_CHILDREN_NUMBER;
+    public final Counter OP_COUNT_GET_CHILDREN;
+    public final Counter OP_COUNT_GET_DATA;
+    public final Counter OP_COUNT_GET_EPHEMERALS;
+    public final Counter OP_COUNT_MULTI;
+    public final Counter OP_COUNT_MULTI_READ;
+    public final Counter OP_COUNT_PING;
+    public final Counter OP_COUNT_RECONFIG;
+    public final Counter OP_COUNT_REMOVE_WATCHES;
+    public final Counter OP_COUNT_SET_ACL;
+    public final Counter OP_COUNT_SET_DATA;
+    public final Counter OP_COUNT_SET_WATCHES;
+    public final Counter OP_COUNT_SYNC;
+    public final Counter OP_COUNT_WHO_AM_I;
+
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java
new file mode 100644
index 00000000000..e12976ab9cb
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java
@@ -0,0 +1,218 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class ServerMetricsOpCountTest extends ClientBase {
+
+    // Metric name constants
+    private static final String OP_COUNT_TOTAL_METRIC_NAME = "op_count_total";
+    private static final String OP_COUNT_CREATE_METRIC_NAME = "op_count_create";
+    private static final String OP_COUNT_EXISTS_METRIC_NAME = "op_count_exists";
+    private static final String OP_COUNT_GET_DATA_METRIC_NAME = "op_count_get_data";
+    private static final String OP_COUNT_SET_DATA_METRIC_NAME = "op_count_set_data";
+    private static final String OP_COUNT_GET_ACL_METRIC_NAME = "op_count_get_acl";
+    private static final String OP_COUNT_SET_ACL_METRIC_NAME = "op_count_set_acl";
+    private static final String OP_COUNT_GET_CHILDREN_METRIC_NAME = "op_count_get_children";
+    private static final String OP_COUNT_GET_ALL_CHILDREN_NUMBER_METRIC_NAME = "op_count_get_all_children_number";
+    private static final String OP_COUNT_ADD_WATCH_METRIC_NAME = "op_count_add_watch";
+    private static final String OP_COUNT_DELETE_METRIC_NAME = "op_count_delete";
+    private static final String OP_COUNT_MULTI_METRIC_NAME = "op_count_multi";
+    private static final String OP_COUNT_MULTI_READ_METRIC_NAME = "op_count_multi_read";
+    private static final String OP_COUNT_GET_EPHEMERALS_METRIC_NAME = "op_count_get_ephemerals";
+    private static final String OP_COUNT_WHO_AM_I_METRIC_NAME = "op_count_who_am_i";
+    private static final String OP_COUNT_CREATE_SESSION_METRIC_NAME = "op_count_create_session";
+    private static final String OP_COUNT_CLOSE_SESSION_METRIC_NAME = "op_count_close_session";
+
+    @Test
+    public void testBasicOpCounts() throws Exception {
+        final Map<String, Object> initialMetrics = MetricsUtils.currentServerMetrics();
+        final long initialTotalCount = (Long) initialMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+        final Map<String, Long> initialCounts = new HashMap<>();
+        initialCounts.put(OP_COUNT_CREATE_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_CREATE_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_EXISTS_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_EXISTS_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_DATA_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_DATA_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_SET_DATA_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_SET_DATA_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_ACL_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_ACL_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_SET_ACL_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_SET_ACL_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_CHILDREN_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_CHILDREN_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_ALL_CHILDREN_NUMBER_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_ALL_CHILDREN_NUMBER_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_ADD_WATCH_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_ADD_WATCH_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_DELETE_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_DELETE_METRIC_NAME, 0L));
+
+        try (final ZooKeeper zk = createClient()) {
+            final String path = generateUniquePath("testBasicOps");
+
+            // Create node
+            zk.create(path, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // Perform various operations
+            zk.exists(path, false);
+            zk.getData(path, false, null);
+            zk.setData(path, "updated".getBytes(), -1);
+            zk.getACL(path, null);
+
+            zk.setACL(path, Ids.READ_ACL_UNSAFE, -1);
+            zk.getChildren(path, false);
+
+            zk.getAllChildrenNumber(path);
+
+            zk.addWatch(path, event -> {}, org.apache.zookeeper.AddWatchMode.PERSISTENT);
+
+            // Delete node
+            zk.delete(path, -1);
+
+            // Verify all metrics increased
+            final Map<String, Object> finalMetrics = MetricsUtils.currentServerMetrics();
+            final long finalTotalCount = (Long) finalMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+            // Total count should have increased by at least 10 operations
+            assertTrue(finalTotalCount >= initialTotalCount + 10,
+                    "Total count should increase by at least 10 operations, initial: " + initialTotalCount
+                            + ", final: " + finalTotalCount);
+
+            // Verify each specific metric increased
+            for (final Map.Entry<String, Long> entry : initialCounts.entrySet()) {
+                final String metricName = entry.getKey();
+                final long initialCount = entry.getValue();
+                final long finalCount = (Long) finalMetrics.getOrDefault(metricName, 0L);
+
+                assertTrue(finalCount > initialCount,
+                        metricName + " should increase, initial: " + initialCount
+                                + ", final: " + finalCount);
+            }
+        }
+    }
+
+    @Test
+    public void testMultiOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_MULTI_METRIC_NAME, (zk, basePath) -> {
+            final String path1 = basePath + "_1";
+            final String path2 = basePath + "_2";
+            final List<org.apache.zookeeper.Op> ops = Arrays.asList(
+                    org.apache.zookeeper.Op.create(path1, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+                    org.apache.zookeeper.Op.create(path2, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)
+            );
+            zk.multi(ops);
+            zk.delete(path1, -1);
+            zk.delete(path2, -1);
+        });
+    }
+
+    @Test
+    public void testMultiReadOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_MULTI_READ_METRIC_NAME, (zk, basePath) -> {
+            final String path1 = basePath + "_1";
+            final String path2 = basePath + "_2";
+
+            // Create nodes first
+            zk.create(path1, "test1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create(path2, "test2".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // Perform multi-read operation
+            final List<org.apache.zookeeper.Op> readOps = Arrays.asList(
+                    org.apache.zookeeper.Op.getData(path1),
+                    org.apache.zookeeper.Op.getData(path2)
+            );
+            zk.multi(readOps);
+
+            zk.delete(path1, -1);
+            zk.delete(path2, -1);
+        });
+    }
+
+    @Test
+    public void testGetEphemeralsOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_GET_EPHEMERALS_METRIC_NAME, (zk, path) -> {
+            zk.create(path, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
+            zk.getEphemerals("/");
+        });
+    }
+
+    @Test
+    public void testWhoAmIOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_WHO_AM_I_METRIC_NAME, (zk, path) -> zk.whoAmI());
+    }
+
+    @Test
+    public void testSessionOperationCounts() throws Exception {
+        final Map<String, Object> initialMetrics = MetricsUtils.currentServerMetrics();
+        final long initialCreateCount = (Long) initialMetrics.getOrDefault(OP_COUNT_CREATE_SESSION_METRIC_NAME, 0L);
+        final long initialCloseCount = (Long) initialMetrics.getOrDefault(OP_COUNT_CLOSE_SESSION_METRIC_NAME, 0L);
+
+        // Create and close a new client to trigger session operations
+        final ZooKeeper zk = createClient();
+        zk.close();
+
+        final Map<String, Object> finalMetrics = MetricsUtils.currentServerMetrics();
+        final long finalCreateCount = (Long) finalMetrics.getOrDefault(OP_COUNT_CREATE_SESSION_METRIC_NAME, 0L);
+        final long finalCloseCount = (Long) finalMetrics.getOrDefault(OP_COUNT_CLOSE_SESSION_METRIC_NAME, 0L);
+
+        assertTrue(finalCreateCount > initialCreateCount, "Create session count should not decrease");
+        assertTrue(finalCloseCount > initialCloseCount, "Close session count should not decrease");
+    }
+
+    private void testSingleOpCount(final String metricName, final OperationExecutor executor) throws Exception {
+        final Map<String, Object> initialMetrics = MetricsUtils.currentServerMetrics();
+        final long initialOpCount = (Long) initialMetrics.getOrDefault(metricName, 0L);
+        final long initialTotalCount = (Long) initialMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+        try (final ZooKeeper zk = createClient()) {
+            final String path = generateUniquePath("test" + metricName.replace("_op_count", ""));
+
+            // Execute the operation
+            executor.execute(zk, path);
+
+            // Verify metrics increased
+            final Map<String, Object> finalMetrics = MetricsUtils.currentServerMetrics();
+            final long finalOpCount = (Long) finalMetrics.getOrDefault(metricName, 0L);
+            final long finalTotalCount = (Long) finalMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+            assertTrue(finalTotalCount > initialTotalCount,
+                    "Total count should increase after " + metricName + " operations"
+                            + " initial: " + initialTotalCount + ", final: " + finalTotalCount);
+
+            assertTrue(finalOpCount > initialOpCount,
+                    metricName + " should increase, initial: " + initialOpCount
+                            + ", final: " + finalOpCount);
+        }
+    }
+
+    @FunctionalInterface
+    private interface OperationExecutor {
+        void execute(ZooKeeper zk, String path) throws Exception;
+    }
+
+    private String generateUniquePath(final String baseName) {
+        return "/" + baseName + "_" + System.nanoTime();
+    }
+}
+

From d20061b321171231acffea4a2bc446c3f90b96f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Wed, 28 Jan 2026 12:50:12 -0600
Subject: [PATCH 574/591] ZOOKEEPER-5018: Upgrade Jetty to 9.4.58.v20250814 in
 order to fix CVE-2025-5115 (ADDENDUM)

Reviewers: tisonkun
Author: anmolnar
Closes #2351 from anmolnar/ZOOKEEPER-5018_b
---
 .../zookeeper-prometheus-metrics/pom.xml                        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
index ddc4fe22e27..9cdb235c8fd 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -33,7 +33,7 @@
 
   <properties>
       <prometheus.version>1.3.10</prometheus.version>
-      <jetty.version>9.4.57.v20241219</jetty.version>
+      <jetty.version>9.4.58.v20250814</jetty.version>
   </properties>
   <dependencies>
     <dependency>

From 2f0d22bcebf33fba9a45b15454e89f116197f918 Mon Sep 17 00:00:00 2001
From: seeksky <148623946+seekskyworld@users.noreply.github.com>
Date: Thu, 19 Feb 2026 23:47:33 +0800
Subject: [PATCH 575/591] ZOOKEEPER-5012: guard zkDb close in QuorumPeer
 shutdown

Reviewers: PDavid, anmolnar
Author: seekskyworld
Closes #2345 from seekskyworld/fix/5012-quorumpeer-shutdown-npe
---
 .../org/apache/zookeeper/server/quorum/QuorumPeer.java | 10 ++++++----
 .../apache/zookeeper/server/quorum/QuorumPeerTest.java |  7 +++++++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index cf6f2f26ce0..296ea05374b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -1705,10 +1705,12 @@ public void shutdown() {
             this.interrupt();
             getElectionAlg().shutdown();
         }
-        try {
-            zkDb.close();
-        } catch (IOException ie) {
-            LOG.warn("Error closing logs ", ie);
+        if (zkDb != null) {
+            try {
+                zkDb.close();
+            } catch (IOException ie) {
+                LOG.warn("Error closing logs ", ie);
+            }
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
index 3a7e88955b5..8c95a29fa32 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -80,6 +81,12 @@ public void testQuorumPeerListendOnSpecifiedClientIP(@TempDir File dataDir) thro
         peer2.shutdown();
     }
 
+    @Test
+    public void testShutdownWithoutZkDbDoesNotThrow() throws Exception {
+        QuorumPeer peer = new QuorumPeer();
+        assertDoesNotThrow(peer::shutdown);
+    }
+
     @Test
     public void testProcessReconfigWillRecreateSocketAddresses() throws IOException {
         QuorumPeerConfig.setReconfigEnabled(true);

From f9865650ed34749d2b6c57a71e2f961a16347eb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Fri, 13 Mar 2026 04:49:39 +0100
Subject: [PATCH 576/591] ZOOKEEPER-5027: Upgrade deprecated GitHub Actions
 versions

Author: PDavid
Closes #2361 from PDavid/ZOOKEEPER-5027-gh-actions-upgrade
---
 .github/workflows/ci.yaml      | 12 ++++++------
 .github/workflows/e2e.yaml     |  4 ++--
 .github/workflows/manual.yaml  |  8 ++++----
 .github/workflows/scripts.yaml |  4 ++--
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f0b212765f1..6f09ab5c914 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -48,9 +48,9 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Set up JDK ${{ matrix.profile.jdk }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: ${{ matrix.profile.jdk }}
         distribution: temurin
@@ -67,21 +67,21 @@ jobs:
         MAVEN_OPTS: -Djansi.force=true
     - name: Upload unit test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: surefire-reports-${{ matrix.profile.name }}
         path: ./**/target/surefire-reports/
         if-no-files-found: ignore
     - name: Upload integration test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: failsafe-reports-${{ matrix.profile.name }}
         path: ./**/target/failsafe-reports/
         if-no-files-found: ignore
     - name: Upload cppunit test logs
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: cppunit-logs-${{ matrix.profile.name }}
         path: ./zookeeper-client/zookeeper-client-c/target/c/TEST-*.txt
@@ -93,7 +93,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Check typos
         uses: crate-ci/typos@v1.22.4
         # To run the typo check locally, you can follow these steps:
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index ec3aed65ff7..d20eba55b0d 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -31,9 +31,9 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up JDK ${{ matrix.jdk }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.jdk }}
           distribution: temurin
diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml
index 898fd283b9c..8b50b8be361 100644
--- a/.github/workflows/manual.yaml
+++ b/.github/workflows/manual.yaml
@@ -43,11 +43,11 @@ jobs:
     timeout-minutes: 360
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         ref: ${{ github.event.inputs.buildRef }}
     - name: Set up JDK 11
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: 11
         distribution: temurin
@@ -64,14 +64,14 @@ jobs:
         MAVEN_OPTS: -Djansi.force=true
     - name: Upload unit test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: surefire-reports
         path: ./**/target/surefire-reports/
         if-no-files-found: ignore
     - name: Upload integration test results
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: failsafe-reports
         path: ./**/target/failsafe-reports/
diff --git a/.github/workflows/scripts.yaml b/.github/workflows/scripts.yaml
index 723aff7313c..98217b74700 100644
--- a/.github/workflows/scripts.yaml
+++ b/.github/workflows/scripts.yaml
@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 3
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Show the first log message
       run: git log -n1
     - name: Install shfmt
@@ -49,7 +49,7 @@ jobs:
     timeout-minutes: 3
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Show the first log message
       run: git log -n1
     - name: Install shfmt

From eab1659958f961bdb5b1538c91a0b4a49f69d5bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Mon, 23 Mar 2026 17:41:49 +0100
Subject: [PATCH 577/591] ZOOKEEPER-5023: Allow to set TLS version and ciphers
 for AdminServer

Reviewers: meszibalu, anmolnar
Author: PDavid
Closes #2359 from PDavid/ZOOKEEPER-5023-AdminServer-TLS-proto-ciphers
---
 .../main/resources/markdown/zookeeperAdmin.md |  33 +++++
 .../server/admin/JettyAdminServer.java        |  14 ++
 .../server/admin/JettyAdminServerTest.java    | 129 ++++++++++++++++++
 3 files changed, 176 insertions(+)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index c1e1684aea7..1486682aedf 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2188,6 +2188,18 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
 
 #### AdminServer configuration
 
+**New in 3.10.0:** [AdminServer](#sc_adminserver) will use the following existing properties:
+
+* *ssl.quorum.ciphersuites* :
+  (Java system property: **zookeeper.ssl.quorum.ciphersuites**)
+  The enabled cipher suites to be used in TLS negotiation for AdminServer.
+  Default: Jetty default.
+
+* *ssl.quorum.enabledProtocols* :
+  (Java system property: **zookeeper.ssl.quorum.enabledProtocols**)
+  The enabled protocols to be used in TLS negotiation for AdminServer.
+  Default: Jetty default.
+
 **New in 3.9.0:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
 
@@ -2674,6 +2686,27 @@ ssl.quorum.trustStore.password=password
 2019-08-03 15:44:55,403 [myid:] - INFO  [main:JettyAdminServer@170] - Started AdminServer on address 0.0.0.0, port 8080 and command URL /commands
 ```
 
+###### Restrict TLS protocols and cipher suites for SSL/TLS negotiation in AdminServer
+
+From 3.10.0 AdminServer uses the following already existing properties:
+
+* **ssl.quorum.enabledProtocols** to specify the enabled protocols,
+* **ssl.quorum.ciphersuites** to specify the enabled cipher suites.
+
+Add the following configuration settings to the `zoo.cfg` config file:
+
+```
+ssl.quorum.enabledProtocols=TLSv1.2,TLSv1.3
+ssl.quorum.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+```
+
+To verify raise the log level of JettyAdminServer to DEBUG and check that the following entries can be seen in the logs:
+
+```
+2026-03-11 11:38:01,102 [myid:] - DEBUG  [main:o.a.z.s.a.JettyAdminServer@159] - Setting enabled protocols: 'TLSv1.2,TLSv1.3'
+2026-03-11 11:38:01,102 [myid:] - DEBUG  [main:o.a.z.s.a.JettyAdminServer@166] - Setting enabled cipherSuites: 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
+```
+
 Available commands include:
 
 * *connection_stat_reset/crst*:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index a237e4c3b5f..3ec6f25b92e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -154,6 +154,20 @@ public JettyAdminServer(
                 sslContextFactory.setTrustStorePassword(certAuthPassword);
                 sslContextFactory.setNeedClientAuth(needClientAuth);
 
+                String enabledProtocols = System.getProperty(x509Util.getSslEnabledProtocolsProperty());
+                if (enabledProtocols != null) {
+                    LOG.debug("Setting enabled protocols: '{}'", enabledProtocols);
+                    String[] enabledProtocolsArray = enabledProtocols.split(",");
+                    sslContextFactory.setIncludeProtocols(enabledProtocolsArray);
+                }
+
+                String sslCipherSuites = System.getProperty(x509Util.getSslCipherSuitesProperty());
+                if (sslCipherSuites != null) {
+                    LOG.debug("Setting enabled cipherSuites: '{}'", sslCipherSuites);
+                    String[] cipherSuitesArray = sslCipherSuites.split(",");
+                    sslContextFactory.setIncludeCipherSuites(cipherSuitesArray);
+                }
+
                 if (forceHttps) {
                     connector = new ServerConnector(server,
                             new SslConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 8ef7e8b5f96..2123e515b48 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -24,6 +24,7 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedReader;
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.net.HttpURLConnection;
@@ -31,13 +32,24 @@
 import java.net.URL;
 import java.nio.file.Path;
 import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
 import java.security.Security;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLHandshakeException;
 import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
@@ -65,6 +77,9 @@ public class JettyAdminServerTest extends ZKTestCase {
     static final String URL_FORMAT = "http://localhost:%d/commands";
     static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
     private final int jettyAdminPort = PortAssignment.unique();
+    private static final String KEYSTORE_TYPE_JKS = "JKS";
+    private String keyStorePath;
+    private String trustStorePath;
 
     @BeforeEach
     public void enableServer() {
@@ -85,6 +100,8 @@ public void setupEncryption(@TempDir File tempDir) {
                                              .setTrustStorePassword("")
                                              .setTrustStoreKeyType(X509KeyType.EC)
                                              .build();
+            keyStorePath = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            trustStorePath = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
             System.setProperty(
                 "zookeeper.ssl.quorum.keyStore.location",
                 x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath());
@@ -148,6 +165,8 @@ public void cleanUp() {
         System.clearProperty("zookeeper.ssl.quorum.trustStore.password");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.passwordPath");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.type");
+        System.clearProperty("zookeeper.ssl.quorum.ciphersuites");
+        System.clearProperty("zookeeper.ssl.quorum.enabledProtocols");
         System.clearProperty("zookeeper.admin.portUnification");
         System.clearProperty("zookeeper.admin.forceHttps");
     }
@@ -306,6 +325,116 @@ private void queryAdminServer(String urlStr, boolean encrypted) throws IOExcepti
         assertTrue(line.length() > 0);
     }
 
+    @Test
+    public void testHandshakeWithSupportedProtocol() throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.ssl.quorum.enabledProtocols", "TLSv1.3");
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+
+            // Use a raw SSLSocket to verify the handshake
+            SSLContext sslContext = createSSLContext(keyStorePath, "".toCharArray(), trustStorePath, "TLSv1.3");
+            SSLSocketFactory factory = sslContext.getSocketFactory();
+
+            try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", jettyAdminPort)) {
+                socket.startHandshake();
+                String negotiatedProtocol = socket.getSession().getProtocol();
+
+                // Verify that we actually landed on the protocol we expected
+                assertEquals("TLSv1.3", negotiatedProtocol,
+                        "The negotiated protocol should be TLSv1.3.");
+            }
+        } finally {
+            server.shutdown();
+        }
+    }
+
+    @Test
+    public void testHandshakeWithUnsupportedProtocolFails() throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.ssl.quorum.enabledProtocols", "TLSv1.3");
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+
+            SSLContext sslContext = createSSLContext(keyStorePath, "".toCharArray(), trustStorePath, "TLSv1.1");
+            SSLSocketFactory factory = sslContext.getSocketFactory();
+
+            try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", jettyAdminPort)) {
+                SSLHandshakeException exception = assertThrows(SSLHandshakeException.class, socket::startHandshake);
+                assertEquals(
+                        "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)",
+                        exception.getMessage(),
+                        "The handshake should have failed due to a protocol mismatch.");
+            }
+        } finally {
+            server.shutdown();
+        }
+    }
+
+    @Test
+    public void testCipherMismatchFails() throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.ssl.quorum.ciphersuites", "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384");
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+
+            SSLContext sslContext = createSSLContext(keyStorePath, "".toCharArray(), trustStorePath, "TLSv1.2");
+            SSLSocketFactory factory = sslContext.getSocketFactory();
+
+            try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", jettyAdminPort)) {
+                // Force the client to use a cipher NOT enabled for the AdminServer
+                String[] unsupportedCiphers = new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"};
+                socket.setEnabledCipherSuites(unsupportedCiphers);
+
+                assertThrows(SSLHandshakeException.class, socket::startHandshake,
+                        "The handshake should have failed due to a cipher mismatch.");
+            }
+        } finally {
+            server.shutdown();
+        }
+    }
+
+    private SSLContext createSSLContext(String keystorePath, char[] password, String trustStorePath, String protocol)
+            throws Exception {
+        KeyManager[] keyManagers = getKeyManagers(keystorePath, password);
+        TrustManager[] trustManagers = getTrustManagers(trustStorePath, password);
+
+        SSLContext sslContext = SSLContext.getInstance(protocol);
+        sslContext.init(keyManagers, trustManagers, null);
+
+        return sslContext;
+    }
+
+    private static KeyManager[] getKeyManagers(String keystorePath, char[] password) throws KeyStoreException,
+            IOException, NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException {
+        KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE_JKS);
+        try (FileInputStream fis = new FileInputStream(keystorePath)) {
+            keyStore.load(fis, password);
+        }
+
+        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        kmf.init(keyStore, password);
+        return kmf.getKeyManagers();
+    }
+
+    public TrustManager[] getTrustManagers(String trustStorePath, char[] password) throws Exception {
+        KeyStore trustStore = KeyStore.getInstance(KEYSTORE_TYPE_JKS);
+        try (FileInputStream fis = new FileInputStream(trustStorePath)) {
+            trustStore.load(fis, password);
+        }
+
+        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        tmf.init(trustStore);
+
+        return tmf.getTrustManagers();
+    }
+
     /**
      * Using TRACE method to visit admin server
      */

From 4bbd4a840aaa0749c9564274e269f9bb6cd534bf Mon Sep 17 00:00:00 2001
From: Patrick Hunt <phunt@apache.org>
Date: Fri, 27 Mar 2026 10:59:09 -0700
Subject: [PATCH 578/591] ZOOKEEPER-5034: enable dependabot via .asf.yaml

Reviewers: PDavid, anmolnar
Author: phunt
Closes #2368 from phunt/ZOOKEEPER-5034
---
 .asf.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.asf.yaml b/.asf.yaml
index ebadb92540f..3edb5883290 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -47,6 +47,8 @@ github:
     rebase:  false
   autolink_jira:
     - ZOOKEEPER
+  dependabot_alerts:  true
+  dependabot_updates: false
 
 notifications:
   jira_options: link label worklog

From 83221ec57e71a67877c17f71dcbf2cd3546f81aa Mon Sep 17 00:00:00 2001
From: li4wang <68786536+li4wang@users.noreply.github.com>
Date: Mon, 30 Mar 2026 11:31:13 -0700
Subject: [PATCH 579/591] ZOOKEEPER-5015: Add admin server command to shed
 client connections by percentage (#2352)

Author: Li Wang<liwang@apple.com>

Co-authored-by: liwang <liwang@apple.com>
---
 .../main/resources/markdown/zookeeperAdmin.md |   5 +
 .../apache/zookeeper/server/ServerCnxn.java   |   3 +-
 .../zookeeper/server/ServerCnxnFactory.java   |  51 ++++
 .../zookeeper/server/admin/Commands.java      |  75 +++++
 .../server/ServerCnxnFactoryTest.java         | 156 +++++++++++
 .../zookeeper/server/admin/CommandsTest.java  |  10 +
 .../admin/ShedConnectionsCommandTest.java     | 265 ++++++++++++++++++
 7 files changed, 564 insertions(+), 1 deletion(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 1486682aedf..786aa17c070 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2804,6 +2804,11 @@ Available commands include:
     Server information.
     Returns multiple fields giving a brief overview of server state.
 
+* *shed_connections/shed* :
+  Attempts to shed approximately the specified percentage of connections.
+  Requires "percentage": (int)
+  Returns "connections_shed" (int) and "percentage_requested" (int)
+
 * *snapshot/snap* :
   Takes a snapshot of the current server in the datadir and stream out data.
   Optional query parameter:
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index ebfd32afa4a..eb31b5e9254 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -98,7 +98,8 @@ public enum DisconnectReason {
         AUTH_PROVIDER_NOT_FOUND("auth provider not found"),
         FAILED_HANDSHAKE("Unsuccessful handshake"),
         CLIENT_RATE_LIMIT("Client hits rate limiting threshold"),
-        CLIENT_CNX_LIMIT("Client hits connection limiting threshold");
+        CLIENT_CNX_LIMIT("Client hits connection limiting threshold"),
+        SHED_CONNECTIONS_COMMAND("shed_connections_command");
 
         String disconnectReason;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index 85ad981e6ca..f63c1eec4ba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -26,6 +26,7 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.function.Supplier;
 import javax.management.JMException;
 import javax.security.auth.callback.CallbackHandler;
@@ -160,6 +161,56 @@ public final void setZooKeeperServer(ZooKeeperServer zks) {
 
     public abstract void closeAll(ServerCnxn.DisconnectReason reason);
 
+    /**
+     * Attempts to shed approximately the specified percentage of connections.
+     *
+     * @param percentage [0-100] percentage of connections to shed
+     * @return actual number of connections successfully closed (may vary due to randomness)
+     * @throws IllegalArgumentException if percentage not in [0, 100]
+     */
+    public int shedConnections(final int percentage) {
+        if (percentage < 0 || percentage > 100) {
+            throw new IllegalArgumentException("percentage must be between 0 and 100, got: " + percentage);
+        }
+
+        final int totalConnections = cnxns.size();
+        if (percentage == 0 || totalConnections == 0) {
+            return 0;
+        }
+
+        int actualShedCount = 0;
+        // For 100%, close all connections deterministically
+        if (percentage == 100) {
+            for (final ServerCnxn cnxn : cnxns) {
+                try {
+                    cnxn.close(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND);
+                    actualShedCount++;
+                } catch (final Exception e) {
+                    LOG.warn("Failed to close connection for session 0x{}: {}",
+                            Long.toHexString(cnxn.getSessionId()), e.getMessage());
+                }
+            }
+        } else {
+            // For other percentages, use probabilistic approach
+            final ThreadLocalRandom random = ThreadLocalRandom.current();
+            final double probability = percentage / 100.0;
+
+            for (final ServerCnxn cnxn : cnxns) {
+                if (random.nextDouble() < probability) {
+                    try {
+                        cnxn.close(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND);
+                        actualShedCount++;
+                    } catch (final Exception e) {
+                        LOG.warn("Failed to close connection for session 0x{}: {}",
+                                Long.toHexString(cnxn.getSessionId()), e.getMessage());
+                    }
+                }
+            }
+        }
+        LOG.info("Shed {} out of {} connections ({}%)", actualShedCount, totalConnections, percentage);
+        return actualShedCount;
+    }
+
     public static ServerCnxnFactory createFactory() throws IOException {
         String serverCnxnFactoryName = System.getProperty(ZOOKEEPER_SERVER_CNXN_FACTORY);
         if (serverCnxnFactoryName == null) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index ae7c4369137..af69008986c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -20,9 +20,12 @@
 
 import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.IOException;
 import java.io.InputStream;
 import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
@@ -292,6 +295,7 @@ public static Command getCommand(String cmdName) {
         registerCommand(new RestoreCommand());
         registerCommand(new RuokCommand());
         registerCommand(new SetTraceMaskCommand());
+        registerCommand(new ShedConnectionsCommand());
         registerCommand(new SnapshotCommand());
         registerCommand(new SrvrCommand());
         registerCommand(new StatCommand());
@@ -863,6 +867,77 @@ public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwar
 
     }
 
+    /**
+     * Attempts to shed approximately the specified percentage of connections.
+     *
+     * Request: JSON input stream containing the following required field:
+     * - "percentage": Integer [0-100] - percentage of connections to attempt shedding
+     *                                   value must be between 0 (no connections) and 100 (all connections).
+     *
+     * Response: JSON output stream containing:
+     * - "connections_shed": Integer - actual number of connections successfully closed
+     *                                 may vary due to randomness.
+     * - "percentage_requested": Integer - the percentage that was requested
+     */
+    public static class ShedConnectionsCommand extends PostCommand {
+        private static final String FIELD_PERCENTAGE = "percentage";
+
+        public ShedConnectionsCommand() {
+            super(Arrays.asList("shed_connections", "shed"), true, new AuthRequest(ZooDefs.Perms.ALL, ROOT_PATH));
+        }
+
+        @Override
+        public CommandResponse runPost(final ZooKeeperServer zkServer, final InputStream inputStream) {
+            final CommandResponse response = initializeResponse();
+
+            if (inputStream == null) {
+                response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                response.put("error", "Request body is required");
+                return response;
+            }
+
+            try {
+                final ObjectMapper mapper = new ObjectMapper();
+                final JsonNode jsonNode = mapper.readTree(inputStream);
+
+                if (!jsonNode.has(FIELD_PERCENTAGE)) {
+                    response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                    response.put("error", "Missing required field: " + FIELD_PERCENTAGE);
+                    return response;
+                }
+
+                final int percentage = jsonNode.get(FIELD_PERCENTAGE).asInt();
+                if (percentage < 0 || percentage > 100) {
+                    response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                    response.put("error", "Percentage must be between 0 and 100");
+                    return response;
+                }
+
+                final ServerCnxnFactory factory = zkServer.getServerCnxnFactory();
+                final ServerCnxnFactory secureFactory = zkServer.getSecureServerCnxnFactory();
+
+                int connectionsShed = 0;
+                if (percentage > 0) {
+                    if (factory != null) {
+                        connectionsShed += factory.shedConnections(percentage);
+                    }
+                    if (secureFactory != null) {
+                        connectionsShed += secureFactory.shedConnections(percentage);
+                    }
+                }
+
+                response.put("connections_shed", connectionsShed);
+                response.put("percentage_requested", percentage);
+
+                LOG.info("Shed {} connections ({}%)", connectionsShed, percentage);
+            } catch (final IOException e) {
+                response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                response.put("error", "Invalid JSON or failed to read request body: " + e.getMessage());
+            }
+            return response;
+        }
+    }
+
     /**
      * Same as SrvrCommand but has extra "connections" entry.
      */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java
new file mode 100644
index 00000000000..f8fb125ca4e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java
@@ -0,0 +1,156 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockingDetails;
+import java.util.Arrays;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+
+public class ServerCnxnFactoryTest {
+    public enum FactoryType {
+        NIO, NETTY
+    }
+
+    private ServerCnxnFactory factory;
+
+    @AfterEach
+    public void tearDown() {
+        if (factory != null) {
+            try {
+                factory.shutdown();
+            } catch (Exception e) {
+                // Ignore all shutdown exceptions in tests since factory may not be fully initialized
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_InvalidPercentage(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+        assertThrows(IllegalArgumentException.class, () -> factory.shedConnections(-1));
+        assertThrows(IllegalArgumentException.class, () -> factory.shedConnections(101));
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_ValidPercentages(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        assertEquals(0, factory.shedConnections(0));
+        assertEquals(0, factory.shedConnections(50));
+        assertEquals(0, factory.shedConnections(100));
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_DeterministicBehavior(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        // Create 4 mock connections for testing deterministic edge cases
+        final ServerCnxn[] mockCnxns = new ServerCnxn[4];
+        for (int i = 0; i < 4; i++) {
+            mockCnxns[i] = mock(ServerCnxn.class);
+            factory.cnxns.add(mockCnxns[i]);
+        }
+
+        // Test 0% shedding - should shed exactly 0 connections (deterministic)
+        int shedCount = factory.shedConnections(0);
+        assertEquals(0, shedCount, "0% shedding should shed exactly 0 connections");
+
+        // Verify no connections were actually closed
+        int actualClosedCount = countConnectionsShed(mockCnxns);
+        assertEquals(0, actualClosedCount, "No connections should be closed for 0% shedding");
+
+        // Test 100% shedding - should shed exactly all connections (deterministic)
+        shedCount = factory.shedConnections(100);
+        assertEquals(4, shedCount, "100% shedding should shed exactly all 4 connections");
+
+        // Verify all connections were actually closed with correct reason
+        actualClosedCount = countConnectionsShed(mockCnxns);
+        assertEquals(4, actualClosedCount, "All 4 connections should be closed for 100% shedding");
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_SmallPercentageRoundsToZero(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        // Add single mock connection
+        final ServerCnxn mockCnxn = mock(ServerCnxn.class);
+        factory.cnxns.add(mockCnxn);
+
+        // small percentage rounds to 0
+        assertEquals(0, factory.shedConnections(1), "1% of 1 connection should round to 0");
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_ErrorHandling(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        // Create mock connections where one will fail to close
+        final ServerCnxn[] mockCnxns = new ServerCnxn[4];
+        for (int i = 0; i < 4; i++) {
+            mockCnxns[i] = mock(ServerCnxn.class);
+            factory.cnxns.add(mockCnxns[i]);
+        }
+
+        // Make the second connection throw an exception when closed
+        doThrow(new RuntimeException("Connection close failed"))
+                .when(mockCnxns[1]).close(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND);
+
+        // Test 100% shedding to ensure error handling works deterministically
+        final int shedCount = factory.shedConnections(100);
+
+        // Since one connection throws an exception, only 3 should be successfully closed
+        assertEquals(3, shedCount, "Should successfully close 3 connections, 1 should fail");
+        int actualClosedCount = countConnectionsShed(mockCnxns);
+        assertEquals(4, actualClosedCount, "All 4 connections should have close() called, even if one throws exception");
+    }
+
+    private ServerCnxnFactory createFactory(final FactoryType type) {
+        switch (type) {
+            case NIO:
+                return new NIOServerCnxnFactory();
+            case NETTY:
+                return new NettyServerCnxnFactory();
+            default:
+                throw new IllegalArgumentException("Unknown factory type: " + type);
+        }
+    }
+
+    private int countConnectionsShed(final ServerCnxn[] connections) {
+        return (int) Arrays.stream(connections)
+                .filter(cnxn -> mockingDetails(cnxn).getInvocations().stream()
+                        .anyMatch(invocation ->
+                                invocation.getMethod().getName().equals("close")
+                                        && invocation.getArguments().length == 1
+                                        && invocation.getArguments()[0].equals(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND)
+                        ))
+                .count();
+    }
+}
+
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index ef8448dd418..ef80e7778e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -359,6 +359,16 @@ public void testStatCommandSecureOnly() {
         assertThat(response.toMap().containsKey("secure_connections"), is(true));
     }
 
+    @Test
+    public void testShedConnections() throws IOException, InterruptedException {
+        final Map<String, String> kwargs = new HashMap<>();
+        final InputStream inputStream = new ByteArrayInputStream("{\"percentage\": 25}".getBytes());
+        final String authInfo = CommandAuthTest.buildAuthorizationForDigest();
+        testCommand("shed_connections", kwargs, inputStream, authInfo, new HashMap<>(), HttpServletResponse.SC_OK,
+                new Field("percentage_requested", Integer.class),
+                new Field("connections_shed", Integer.class));
+    }
+
     private void testSnapshot(final boolean streaming) throws IOException, InterruptedException {
         System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
         System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java
new file mode 100644
index 00000000000..cc02d3cf8bf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java
@@ -0,0 +1,265 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.jupiter.api.Test;
+
+public class ShedConnectionsCommandTest {
+
+    private static final String VALID_JSON_25_PERCENT = "{\"percentage\": 25}";
+    private static final String VALID_JSON_100_PERCENT = "{\"percentage\": 100}";
+    private static final String VALID_JSON_1_PERCENT = "{\"percentage\": 1}";
+    private static final String VALID_JSON_0_PERCENT = "{\"percentage\": 0}";
+
+    private static final String INVALID_JSON_OVER_100_PERCENT = "{\"percentage\": 101}";
+
+    private static final String INVALID_JSON_MISSING_FIELD = "{\"other\": 25}";
+    private static final String INVALID_JSON_MALFORMED = "{\"percentage\": }";
+    private static final String INVALID_JSON_EMPTY = "{}";
+
+    @Test
+    public void testValidPercentage25() {
+        validateSuccessfulShedCommand(25, 50, 30, VALID_JSON_25_PERCENT, true, true);
+    }
+
+    @Test
+    public void testValidPercentage100() {
+        validateSuccessfulShedCommand(100, 20, 10, VALID_JSON_100_PERCENT, true, true);
+    }
+
+    @Test
+    public void testValidPercentage1() {
+        validateSuccessfulShedCommand(1, 100, 0, VALID_JSON_1_PERCENT, true, false);
+    }
+
+    @Test
+    public void testValidPercentage0() {
+        validateSuccessfulShedCommand(0, 100, 50, VALID_JSON_0_PERCENT, false, false);
+    }
+
+    @Test
+    public void testInvalidPercentage101() {
+        validateFailedShedCommand(INVALID_JSON_OVER_100_PERCENT, "Percentage must be between 0 and 100", true);
+    }
+
+    @Test
+    public void testInvalidNullInputStream() {
+        validateFailedShedCommand(null, "Request body is required", true);
+    }
+
+    @Test
+    public void testEmptyJson() {
+        validateFailedShedCommand(INVALID_JSON_EMPTY, "Missing required field: percentage", true);
+    }
+
+    @Test
+    public void testMissingPercentageParameter() {
+        validateFailedShedCommand(INVALID_JSON_MISSING_FIELD, "Missing required field: percentage", true);
+    }
+
+    @Test
+    public void testMalformedJson() {
+        validateFailedShedCommand(INVALID_JSON_MALFORMED, "Invalid JSON or failed to read request body", false);
+    }
+
+    @Test
+    public void testOnlyInsecureConnections() {
+        validateSuccessfulShedCommand(25, 40, 0, VALID_JSON_25_PERCENT, true, false);
+    }
+
+    @Test
+    public void testOnlySecureConnections() {
+        validateSuccessfulShedCommand(25, 0, 60, VALID_JSON_25_PERCENT, false, true);
+    }
+
+    @Test
+    public void testNoConnections() {
+        validateSuccessfulShedCommand(25, 0, 0, VALID_JSON_25_PERCENT, false, false);
+    }
+
+    @Test
+    public void testMixedConnections() {
+        validateSuccessfulShedCommand(25, 30, 20, VALID_JSON_25_PERCENT, true, true);
+    }
+
+    @Test
+    public void testCommandNames() {
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        assertEquals(2, command.getNames().size());
+        assertTrue(command.getNames().contains("shed"));
+        assertTrue(command.getNames().contains("shed_connections"));
+    }
+
+    @Test
+    public void testAuthorizationRequired() {
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        final AuthRequest authRequest = command.getAuthRequest();
+
+        assertNotNull(authRequest);
+        assertEquals(org.apache.zookeeper.ZooDefs.Perms.ALL, authRequest.getPermission());
+        assertEquals(Commands.ROOT_PATH, authRequest.getPath());
+    }
+
+    private void validateSuccessfulShedCommand(
+            final int expectedPercentage,
+            final int insecureConnections,
+            final int secureConnections,
+            final String jsonInput,
+            final boolean shouldCallInsecureFactory,
+            final boolean shouldCallSecureFactory) {
+
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        final ZooKeeperServer zkServer = createMockZooKeeperServer(insecureConnections, secureConnections);
+        final InputStream inputStream = new ByteArrayInputStream(jsonInput.getBytes());
+        final int totalConnections = insecureConnections + secureConnections;
+
+        final CommandResponse response = command.runPost(zkServer, inputStream);
+        assertSuccessfulResponse(response, expectedPercentage, totalConnections);
+        assertFactoryCalls(zkServer, expectedPercentage, shouldCallInsecureFactory, shouldCallSecureFactory);
+    }
+
+    private void validateFailedShedCommand(
+            final String jsonInput,
+            final String expectedError,
+            final boolean exactMatch) {
+
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        final ZooKeeperServer zkServer = createMockZooKeeperServer(10, 10);
+        final InputStream inputStream = jsonInput != null ? new ByteArrayInputStream(jsonInput.getBytes()) : null;
+
+        final CommandResponse response = command.runPost(zkServer, inputStream);
+
+        assertNotNull(response);
+        assertEquals(HttpServletResponse.SC_BAD_REQUEST, response.getStatusCode());
+
+        final Map<String, Object> result = response.toMap();
+        final String actualError = (String) result.get("error");
+
+        if (exactMatch) {
+            assertEquals(expectedError, actualError);
+        } else {
+            assertTrue(actualError.contains(expectedError),
+                    String.format("Expected error message to contain '%s', but was '%s'", expectedError, actualError));
+        }
+    }
+
+    private void assertSuccessfulResponse(
+            final CommandResponse response,
+            final int expectedPercentage,
+            final int totalConnections) {
+
+        assertNotNull(response);
+        assertEquals(HttpServletResponse.SC_OK, response.getStatusCode());
+
+        final Map<String, Object> result = response.toMap();
+        assertEquals(expectedPercentage, result.get("percentage_requested"));
+
+        assertTrue(result.containsKey("connections_shed"));
+        final int actualShed = (Integer) result.get("connections_shed");
+        assertTrue(actualShed >= 0, "Shed count should be non-negative");
+        assertTrue(actualShed <= totalConnections, "Cannot shed more than total connections");
+
+        // For 0% and 100%, we can make exact assertions
+        if (expectedPercentage == 0) {
+            assertEquals(0, actualShed, "0% should shed exactly 0 connections");
+        } else if (expectedPercentage == 100) {
+            assertEquals(totalConnections, actualShed, "100% should shed all connections");
+        }
+    }
+
+    private void assertFactoryCalls(
+            final ZooKeeperServer zkServer,
+            final int percentage,
+            final boolean shouldCallInsecureFactory,
+            final boolean shouldCallSecureFactory) {
+
+        final ServerCnxnFactory factory = zkServer.getServerCnxnFactory();
+        final ServerCnxnFactory secureFactory = zkServer.getSecureServerCnxnFactory();
+
+        if (factory != null) {
+            if (shouldCallInsecureFactory) {
+                verify(factory, times(1)).shedConnections(percentage);
+            } else {
+                verify(factory, never()).shedConnections(anyInt());
+            }
+        }
+
+        if (secureFactory != null) {
+            if (shouldCallSecureFactory) {
+                verify(secureFactory, times(1)).shedConnections(percentage);
+            } else {
+                verify(secureFactory, never()).shedConnections(anyInt());
+            }
+        }
+    }
+
+    private ZooKeeperServer createMockZooKeeperServer(int insecureConnections, int secureConnections) {
+        final ZooKeeperServer zkServer = mock(ZooKeeperServer.class);
+        final int totalConnections = insecureConnections + secureConnections;
+
+        when(zkServer.getNumAliveConnections()).thenReturn(totalConnections);
+
+        // Mock insecure factory
+        ServerCnxnFactory factory = null;
+        if (insecureConnections > 0) {
+            factory = createMockServerCnxnFactory(insecureConnections);
+        }
+        when(zkServer.getServerCnxnFactory()).thenReturn(factory);
+
+        // Mock secure factory
+        ServerCnxnFactory secureFactory = null;
+        if (secureConnections > 0) {
+            secureFactory = createMockServerCnxnFactory(secureConnections);
+        }
+        when(zkServer.getSecureServerCnxnFactory()).thenReturn(secureFactory);
+
+        return zkServer;
+    }
+
+    private ServerCnxnFactory createMockServerCnxnFactory(int connections) {
+        final ServerCnxnFactory factory = mock(ServerCnxnFactory.class);
+        when(factory.getNumAliveConnections()).thenReturn(connections);
+        when(factory.shedConnections(anyInt())).thenAnswer(invocation -> {
+            int percentage = invocation.getArgument(0);
+            if (percentage == 0) {
+                return 0;
+            }
+            if (percentage == 100) {
+                return connections;
+            }
+            return (int) Math.ceil(connections * percentage / 100.0);
+        });
+        return factory;
+    }
+}

From 9d23039612ebb60ef49506898c3ed6e63bb55fdc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Tue, 7 Apr 2026 22:23:54 +0200
Subject: [PATCH 580/591] ZOOKEEPER-5024: Allow to set TLS version and ciphers
 for PrometheusMetricsProvider

Reviewers: meszibalu, anmolnar
Author: PDavid
Closes #2360 from PDavid/ZOOKEEPER-5024-prometheus-https-ciphers-protocols
---
 .../main/resources/markdown/zookeeperAdmin.md |  59 +++-
 .../resources/markdown/zookeeperMonitor.md    |  18 ++
 .../prometheus/PrometheusMetricsProvider.java |  31 +-
 .../PrometheusMetricsProviderConfigTest.java  | 285 +++++++++++++++---
 4 files changed, 337 insertions(+), 56 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 786aa17c070..c87ce053e71 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2286,8 +2286,17 @@ options are used to configure the [AdminServer](#sc_adminserver).
     **New in 3.8.0:** Prometheus.io exporter will start a Jetty server and listen this address, default is "0.0.0.0"
   
 * *metricsProvider.httpPort* :
-    Prometheus.io exporter will start a Jetty server and bind to this port, it defaults to 7000.
-    Prometheus end point will be http://hostname:httPort/metrics.
+    Prometheus.io exporter will start a Jetty server and bind to this port.
+    Prometheus end point will be `http://hostname:httpPort/metrics`.
+    If omitted no HTTP port will be opened.
+    * Note: Either HTTP or HTTPS port has to be specified or both.
+
+* *metricsProvider.httpsPort* :
+   **New in 3.10.0:**
+   Prometheus.io exporter will start a Jetty server and bind to this port.
+   Prometheus end point will be `https://hostname:httpsPort/metrics`.
+   If omitted no HTTPS port will be opened.
+    * Note: Either HTTP or HTTPS port has to be specified or both.
 
 * *metricsProvider.exportJvmInfo* :
     If this property is set to **true** Prometheus.io will export useful metrics about the JVM.
@@ -2308,7 +2317,51 @@ options are used to configure the [AdminServer](#sc_adminserver).
    **New in 3.7.1:**
    The timeout in ms for Prometheus worker threads shutdown.
    Default value is 1000ms.
-   
+
+* *metricsProvider.ssl.keyStore.location* and *metricsProvider.ssl.keyStore.password*:
+   **New in 3.10.0:**
+   Specifies the file path to a Java keystore containing the local
+   credentials to be used for PrometheusMetricsProvider TLS connections and the
+   password to unlock the file.
+
+*  *metricsProvider.ssl.keyStore.type*:
+   **New in 3.10.0:**
+   Specifies the file format of the PrometheusMetricsProvider keystore. Values: JKS, PEM, PKCS12 or null (detect by filename).
+   Default: null.
+
+* *metricsProvider.ssl.trustStore.location* and *metricsProvider.ssl.trustStore.password*:
+   **New in 3.10.0:**
+   Specifies the file path to a Java truststore containing the remote
+   credentials to be used for PrometheusMetricsProvider TLS connections and the
+   password to unlock the file.
+
+* *metricsProvider.ssl.trustStore.type*:
+   **New in 3.10.0:**
+   Specifies the file format of the PrometheusMetricsProvider truststore. Values: JKS, PEM, PKCS12 or null (detect by filename).
+   Default: null.
+
+* *metricsProvider.ssl.need.client.auth*:
+   **New in 3.10.0:**
+   Specifies options to authenticate SSL connections from clients.
+   When set to true, PrometheusMetricsProvider will "require" client authentication.
+   Default: true
+
+* *metricsProvider.ssl.want.client.auth*:
+   **New in 3.10.0:**
+   Specifies options to authenticate SSL connections from clients.
+   When set to true, PrometheusMetricsProvider will "request" client authentication.
+   Default: true
+
+* *metricsProvider.ssl.ciphersuites* :
+   **New in 3.10.0:**
+   The enabled cipher suites to be used in TLS negotiation for PrometheusMetricsProvider.
+   Default value is Jetty default.
+
+* *metricsProvider.ssl.enabledProtocols* :
+   **New in 3.10.0:**
+   The enabled protocols to be used in TLS negotiation for PrometheusMetricsProvider.
+   Default value is Jetty default.
+
 <a name="Communication+using+the+Netty+framework"></a>
 
 ### Communication using the Netty framework
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index 180f1273c19..705b5eb049a 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -81,6 +81,24 @@ ZooKeeper also supports SSL for Prometheus metrics, which provides secure data t
   metricsProvider.httpPort=7000
   metricsProvider.httpsPort=4443
   ```
+
+#### Configure TLS protocols and cipher suites for SSL/TLS negotiation in Prometheus Metrics:
+
+It is also possible to restrict TLS versions and cipher suites for PrometheusMetricsProvider.
+Add the following configuration settings to the `zoo.cfg` config file:
+
+```
+metricsProvider.ssl.enabledProtocols=TLSv1.2,TLSv1.3
+metricsProvider.ssl.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+```
+
+To verify raise the log level of PrometheusMetricsProvider to DEBUG and check that the following entries can be seen in the logs:
+
+```
+2026-03-11 15:46:36,997 [myid:] - INFO  [main:o.a.z.m.p.PrometheusMetricsProvider@245] - Setting enabled protocols: 'TLSv1.2,TLSv1.3'
+2026-03-11 15:46:36,997 [myid:] - INFO  [main:o.a.z.m.p.PrometheusMetricsProvider@251] - Setting enabled cipherSuites: 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
+```
+
 ### Prometheus
 - Running a [Prometheus](https://prometheus.io/) monitoring service is the easiest way to ingest and record ZooKeeper's metrics.
 
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index 1fbb34169c7..8ae6178e0f0 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -37,7 +37,6 @@
 import org.apache.zookeeper.metrics.Gauge;
 import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
-import org.apache.zookeeper.metrics.MetricsContext.DetailLevel;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
 import org.apache.zookeeper.metrics.Summary;
@@ -83,8 +82,14 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     private String trustStoreType;
     private boolean needClientAuth = true; // Secure default
     private boolean wantClientAuth = true; // Secure default
+    private String enabledProtocols;
+    private String cipherSuites;
 
     // Constants for configuration
+    public static final String HTTP_HOST = "httpHost";
+    public static final String HTTP_PORT = "httpPort";
+    public static final String EXPORT_JVM_INFO = "exportJvmInfo";
+    public static final String HTTPS_PORT = "httpsPort";
     public static final String NUM_WORKER_THREADS = "numWorkerThreads";
     public static final String SSL_KEYSTORE_LOCATION = "ssl.keyStore.location";
     public static final String SSL_KEYSTORE_PASSWORD = "ssl.keyStore.password";
@@ -94,6 +99,8 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     public static final String SSL_TRUSTSTORE_TYPE = "ssl.trustStore.type";
     public static final String SSL_NEED_CLIENT_AUTH = "ssl.need.client.auth";
     public static final String SSL_WANT_CLIENT_AUTH = "ssl.want.client.auth";
+    public static final String SSL_ENABLED_PROTOCOLS = "ssl.enabledProtocols";
+    public static final String SSL_ENABLED_CIPHERS = "ssl.ciphersuites";
     public static final int SCAN_INTERVAL = 60 * 10; // 10 minutes
 
     /**
@@ -114,10 +121,10 @@ protected void doTrace(HttpServletRequest req, HttpServletResponse resp) throws
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
         LOG.info("Initializing Prometheus metrics with Jetty, configuration: {}", configuration);
 
-        this.host = configuration.getProperty("httpHost", "0.0.0.0");
-        this.httpPort = Integer.parseInt(configuration.getProperty("httpPort", "-1"));
-        this.httpsPort = Integer.parseInt(configuration.getProperty("httpsPort", "-1"));
-        this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
+        this.host = configuration.getProperty(HTTP_HOST, "0.0.0.0");
+        this.httpPort = Integer.parseInt(configuration.getProperty(HTTP_PORT, "-1"));
+        this.httpsPort = Integer.parseInt(configuration.getProperty(HTTPS_PORT, "-1"));
+        this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty(EXPORT_JVM_INFO, "true"));
         this.numWorkerThreads = Integer.parseInt(configuration.getProperty(NUM_WORKER_THREADS, "10"));
 
         // If httpsPort is specified, parse all SSL properties
@@ -130,6 +137,8 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
             this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE, "PKCS12");
             this.needClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_NEED_CLIENT_AUTH, "true"));
             this.wantClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_WANT_CLIENT_AUTH, "true"));
+            this.enabledProtocols = configuration.getProperty(SSL_ENABLED_PROTOCOLS);
+            this.cipherSuites = configuration.getProperty(SSL_ENABLED_CIPHERS);
         }
 
         // Validate that at least one port is configured.
@@ -232,6 +241,18 @@ private SslContextFactory.Server createSslContextFactory() {
         sslContextFactory.setNeedClientAuth(this.needClientAuth);
         sslContextFactory.setWantClientAuth(this.wantClientAuth);
 
+        if (enabledProtocols != null) {
+            LOG.debug("Setting enabled protocols: '{}'", enabledProtocols);
+            String[] enabledProtocolsArray = enabledProtocols.split(",");
+            sslContextFactory.setIncludeProtocols(enabledProtocolsArray);
+        }
+
+        if (cipherSuites != null) {
+            LOG.debug("Setting enabled cipherSuites: '{}'", cipherSuites);
+            String[] cipherSuitesArray = cipherSuites.split(",");
+            sslContextFactory.setIncludeCipherSuites(cipherSuitesArray);
+        }
+
         return sslContextFactory;
     }
 
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
index c151854b05a..bb24ab75d29 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -18,89 +18,278 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
 import java.util.Properties;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLHandshakeException;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 public class PrometheusMetricsProviderConfigTest extends PrometheusMetricsTestBase {
 
+    private static final String KEYSTORE_TYPE_JKS = "JKS";
+    private static final String PASSWORD = "testpass";
+
+    private String keyStorePath;
+    private String trustStorePath;
+    private PrometheusMetricsProvider provider;
+
+    @BeforeEach
+    public void setup() {
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        keyStorePath = testDataPath + "/ssl/server_keystore.jks";
+        trustStorePath = testDataPath + "/ssl/server_truststore.jks";
+    }
+
+    @AfterEach
+    public void tearDown() {
+        if (provider != null) {
+            provider.stop();
+        }
+    }
+
     @Test
-    public void testInvalidPort() {
-        assertThrows(MetricsProviderLifeCycleException.class, () -> {
-            PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
-            Properties configuration = new Properties();
-            configuration.setProperty("httpPort", "65536");
-            configuration.setProperty("exportJvmInfo", "false");
-            provider.configure(configuration);
-            provider.start();
-        });
+    public void testInvalidPort() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "65536");
+        configuration.setProperty(PrometheusMetricsProvider.EXPORT_JVM_INFO, "false");
+        provider.configure(configuration);
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, provider::start);
+
+        assertEquals("Failed to start Prometheus Jetty server", exception.getMessage());
+        assertNotNull(exception.getCause());
+        assertEquals("port out of range:65536", exception.getCause().getMessage());
     }
 
     @Test
-    public void testInvalidAddr() {
-        assertThrows(MetricsProviderLifeCycleException.class, () -> {
-            PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
-            Properties configuration = new Properties();
-            configuration.setProperty("httpHost", "master");
-            provider.configure(configuration);
-            provider.start();
-        });
+    public void testNoPortSet() {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        // Do not set HTTP port and HTTPS port here.
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, () -> provider.configure(configuration));
+
+        assertEquals("Either httpPort or httpsPort must be configured for Prometheus exporter.",
+                exception.getMessage());
+    }
+
+    @Test
+    public void testInvalidAddr() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "master");
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "0");
+        provider.configure(configuration);
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, provider::start);
+
+        assertEquals("Failed to start Prometheus Jetty server", exception.getMessage());
+        assertNotNull(exception.getCause());
+        assertEquals("Failed to bind to master:0", exception.getCause().getMessage());
     }
 
     @Test
     public void testValidConfig() throws MetricsProviderLifeCycleException {
-        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
-        configuration.setProperty("httpHost", "0.0.0.0");
-        configuration.setProperty("httpPort", "0");
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "0.0.0.0");
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "0");
         provider.configure(configuration);
         provider.start();
     }
 
     @Test
     public void testValidSslConfig() throws MetricsProviderLifeCycleException {
-        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
-        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
-        configuration.setProperty("httpHost", "127.0.0.1");
-        configuration.setProperty("httpsPort", "0");
-        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
-        configuration.setProperty("ssl.keyStore.password", "testpass");
-        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
-        configuration.setProperty("ssl.trustStore.password", "testpass");
+
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "0");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
         provider.configure(configuration);
         provider.start();
     }
 
     @Test
     public void testValidHttpsAndHttpConfig() throws MetricsProviderLifeCycleException {
-        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
-        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
-        configuration.setProperty("httpPort", "0");
-        configuration.setProperty("httpsPort", "0");
-        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
-        configuration.setProperty("ssl.keyStore.password", "testpass");
-        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
-        configuration.setProperty("ssl.trustStore.password", "testpass");
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "0");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "0");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
         provider.configure(configuration);
         provider.start();
     }
 
     @Test
     public void testInvalidSslConfig() throws MetricsProviderLifeCycleException {
-        assertThrows(MetricsProviderLifeCycleException.class, () -> {
-            PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
-            Properties configuration = new Properties();
-            String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
-            configuration.setProperty("httpsPort", "50514");
-            // keystore missing
-            configuration.setProperty("ssl.keyStore.password", "testpass");
-            configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
-            configuration.setProperty("ssl.trustStore.password", "testpass");
-            provider.configure(configuration);
-            provider.start();
-        });
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "50514");
+        // keystore missing
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        provider.configure(configuration);
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, provider::start);
+
+        assertEquals("Failed to start Prometheus Jetty server", exception.getMessage());
+        assertNotNull(exception.getCause());
+        assertEquals(
+                "SSL/TLS is enabled, but 'ssl.keyStore.location' is not set.",
+                exception.getCause().getMessage());
+    }
+
+    @Test
+    public void testHandshakeWithSupportedProtocol() throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "7000");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_ENABLED_PROTOCOLS, "TLSv1.3");
+        provider.configure(configuration);
+        provider.start();
+
+        // Use a raw SSLSocket to verify the handshake
+        SSLContext sslContext = createSSLContext(keyStorePath, PASSWORD.toCharArray(), "TLSv1.3");
+        SSLSocketFactory factory = sslContext.getSocketFactory();
+
+        try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7000)) {
+            socket.startHandshake();
+            String negotiatedProtocol = socket.getSession().getProtocol();
+
+            // Verify that we actually landed on the protocol we expected
+            assertEquals("TLSv1.3", negotiatedProtocol,
+                    "The negotiated protocol should be TLSv1.3.");
+        }
+    }
+
+    @Test
+    public void testHandshakeWithUnsupportedProtocolFails() throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "7000");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_ENABLED_PROTOCOLS, "TLSv1.3");
+        provider.configure(configuration);
+        provider.start();
+
+        SSLContext sslContext = createSSLContext(keyStorePath, PASSWORD.toCharArray(), "TLSv1.1");
+        SSLSocketFactory factory = sslContext.getSocketFactory();
+
+        try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7000)) {
+            SSLHandshakeException exception = assertThrows(SSLHandshakeException.class, socket::startHandshake);
+            assertEquals(
+                    "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)",
+                    exception.getMessage(),
+                    "The handshake should have failed due to a protocol mismatch.");
+        }
+    }
+
+    @Test
+    public void testCipherMismatchFails() throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "7000");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        System.setProperty(PrometheusMetricsProvider.SSL_ENABLED_CIPHERS,
+                "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384");
+        provider.configure(configuration);
+        provider.start();
+
+        SSLContext sslContext = createSSLContext(keyStorePath, PASSWORD.toCharArray(), "TLSv1.2");
+        SSLSocketFactory factory = sslContext.getSocketFactory();
+
+        try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7000)) {
+            // Force the client to use a cipher NOT enabled for the AdminServer
+            String[] unsupportedCiphers = new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"};
+            socket.setEnabledCipherSuites(unsupportedCiphers);
+
+            assertThrows(SSLHandshakeException.class, socket::startHandshake,
+                    "The handshake should have failed due to a cipher mismatch.");
+        }
+    }
+
+    private SSLContext createSSLContext(String keystorePath, char[] password, String protocol)
+            throws Exception {
+        KeyManager[] keyManagers = getKeyManagers(keystorePath, password);
+        TrustManager[] trustAllCerts = getTrustAllCerts();
+
+        SSLContext sslContext = SSLContext.getInstance(protocol);
+        sslContext.init(keyManagers, trustAllCerts, null);
+
+        return sslContext;
+    }
+
+    private static KeyManager[] getKeyManagers(String keystorePath, char[] password) throws KeyStoreException,
+            IOException, NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException {
+        KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE_JKS);
+        try (FileInputStream fis = new FileInputStream(keystorePath)) {
+            keyStore.load(fis, password);
+        }
+
+        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        kmf.init(keyStore, password);
+        return kmf.getKeyManagers();
+    }
+
+    public TrustManager[] getTrustAllCerts() {
+        // This is OK for testing.
+        return new TrustManager[]{
+                new X509TrustManager() {
+                    public X509Certificate[] getAcceptedIssuers() {
+                        return null;
+                    }
+
+                    public void checkClientTrusted(X509Certificate[] certs, String authType) {
+                    }
+
+                    public void checkServerTrusted(X509Certificate[] certs, String authType) {
+                    }
+                }
+        };
     }
 }

From 6c4fabfd4726d9b576a1b8acba9b273696079339 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Thu, 9 Apr 2026 02:21:42 +0200
Subject: [PATCH 581/591] ZOOKEEPER-5021: Exit from zkCli when interrupt
 (Ctrl-C) or EOF (Ctrl-D) is pressed

Reviewers: ctubbsii, kezhuw
Author: PDavid
Closes #2369 from PDavid/ZOOKEEPER-5021-cli-fix-eof-interrupt-2
---
 .../src/main/java/org/apache/zookeeper/ZooKeeperMain.java | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index ca27348e164..d5ffc20ca59 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -308,12 +308,13 @@ void run() throws IOException, InterruptedException {
         if (cl.getCommand() == null) {
             System.out.println("Welcome to ZooKeeper!");
 
-            boolean jlinemissing = false;
+            boolean jlinemissing = true;
             // only use jline if it's in the classpath
             try {
                 Class<?> readerC = Class.forName("org.jline.reader.LineReader");
                 Class<?> completerC = Class.forName("org.apache.zookeeper.JLineZNodeCompleter");
 
+                jlinemissing = false;
                 System.out.println("JLine support is enabled");
 
                 Object completer = completerC.getConstructor(ZooKeeper.class).newInstance(zk);
@@ -331,8 +332,9 @@ void run() throws IOException, InterruptedException {
                 | IllegalAccessException
                 | InstantiationException e
             ) {
-                LOG.debug("Unable to start jline", e);
-                jlinemissing = true;
+                if (jlinemissing) {
+                    LOG.debug("Unable to start jline", e);
+                }
             }
 
             if (jlinemissing) {

From a3c478bca888cb990001ccbfdb0256f2d2243360 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Wed, 15 Apr 2026 01:47:53 +0200
Subject: [PATCH 582/591] ZOOKEEPER-5022: Added "exit" command to zkCli.sh

Reviewers: anmolnar, ctubbsii
Author: PDavid
Closes #2358 from PDavid/ZOOKEEPER-5022-cli-exit-cmd
---
 .../main/resources/markdown/zookeeperCLI.md   |  5 +--
 .../org/apache/zookeeper/ZooKeeperMain.java   | 31 ++++++++++++-------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 7096aa0cc89..aeccf1dcfce 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -45,6 +45,7 @@ ZooKeeper -server host:port cmd args
 	delete [-v version] path
 	deleteall path
 	delquota [-n|-b|-N|-B] path
+	exit
 	get [-s] [-w] path
 	getAcl [-s] path
 	getAllChildrenNumber path
@@ -345,8 +346,8 @@ A switch to turn on/off whether printing watches or not.
 	printwatches is on
 ```
 
-## quit
-Quit the CLI windows.
+## quit (or exit)
+The `quit` or `exit` command can be used to quit the CLI windows.
 
 ```bash
 [zkshell: 1] quit
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index d5ffc20ca59..6b469fec83b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -77,12 +77,21 @@ public boolean getPrintWatches() {
         return printWatches;
     }
 
+    private static final String CMD_CONNECT = "connect";
+    private static final String CMD_HISTORY = "history";
+    private static final String CMD_REDO = "redo";
+    private static final String CMD_QUIT = "quit";
+    private static final String CMD_EXIT = "exit";
+    private static final String CMD_PRINT_WATCHES = "printwatches";
+
+
     static {
-        commandMap.put("connect", "host:port");
-        commandMap.put("history", "");
-        commandMap.put("redo", "cmdno");
-        commandMap.put("printwatches", "on|off");
-        commandMap.put("quit", "");
+        commandMap.put(CMD_CONNECT, "host:port");
+        commandMap.put(CMD_HISTORY, "");
+        commandMap.put(CMD_REDO, "cmdno");
+        commandMap.put(CMD_PRINT_WATCHES, "on|off");
+        commandMap.put(CMD_QUIT, "");
+        commandMap.put(CMD_EXIT, "");
         Stream.of(CommandFactory.Command.values())
             .map(command -> CommandFactory.getInstance(command))
             // add all commands to commandMapCli and commandMap
@@ -411,34 +420,34 @@ protected boolean processZKCmd(MyCommandOptions co) throws CliException, IOExcep
 
         LOG.debug("Processing {}", cmd);
 
-        if (cmd.equals("quit")) {
+        if (cmd.equals(CMD_QUIT) || cmd.equals(CMD_EXIT)) {
             zk.close();
             ServiceUtils.requestSystemExit(exitCode);
-        } else if (cmd.equals("redo") && args.length >= 2) {
+        } else if (cmd.equals(CMD_REDO) && args.length >= 2) {
             Integer i = Integer.decode(args[1]);
             if (commandCount <= i || i < 0) { // don't allow redoing this redo
                 throw new MalformedCommandException("Command index out of range");
             }
             cl.parseCommand(history.get(i));
-            if (cl.getCommand().equals("redo")) {
+            if (cl.getCommand().equals(CMD_REDO)) {
                 throw new MalformedCommandException("No redoing redos");
             }
             history.put(commandCount, history.get(i));
             processCmd(cl);
-        } else if (cmd.equals("history")) {
+        } else if (cmd.equals(CMD_HISTORY)) {
             for (int i = commandCount - 10; i <= commandCount; ++i) {
                 if (i < 0) {
                     continue;
                 }
                 System.out.println(i + " - " + history.get(i));
             }
-        } else if (cmd.equals("printwatches")) {
+        } else if (cmd.equals(CMD_PRINT_WATCHES)) {
             if (args.length == 1) {
                 System.out.println("printwatches is " + (printWatches ? "on" : "off"));
             } else {
                 printWatches = args[1].equals("on");
             }
-        } else if (cmd.equals("connect")) {
+        } else if (cmd.equals(CMD_CONNECT)) {
             if (args.length >= 2) {
                 connectToZK(args[1]);
             } else {

From bbaaf0b17caac173c319742817a69f3242ce182a Mon Sep 17 00:00:00 2001
From: Tero Saarni <tero.saarni@est.tech>
Date: Thu, 23 Apr 2026 02:16:54 +0300
Subject: [PATCH 583/591] ZOOKEEPER-4992: Avoid overriding same-subject certs
 in PEM trust store

Reviewers: anmolnar
Author: tsaarni
Closes #2336 from tsaarni/fix-zookeeper-4992
---
 .../org/apache/zookeeper/util/PemReader.java  | 10 ++++--
 .../zookeeper/common/PEMFileLoaderTest.java   |  7 ++--
 .../zookeeper/common/X509TestContext.java     | 32 ++++++++++++-------
 .../apache/zookeeper/util/PemReaderTest.java  |  3 +-
 4 files changed, 34 insertions(+), 18 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
index dd5a1576401..20e4adc6ea2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
@@ -49,7 +49,6 @@
 import javax.crypto.SecretKey;
 import javax.crypto.SecretKeyFactory;
 import javax.crypto.spec.PBEKeySpec;
-import javax.security.auth.x500.X500Principal;
 
 /**
  * Note: this class is copied from io.airlift.security.pem.PemReader (see
@@ -93,8 +92,13 @@ public static KeyStore loadTrustStore(File certificateChainFile) throws IOExcept
 
         List<X509Certificate> certificateChain = readCertificateChain(certificateChainFile);
         for (X509Certificate certificate : certificateChain) {
-            X500Principal principal = certificate.getSubjectX500Principal();
-            keyStore.setCertificateEntry(principal.getName("RFC2253"), certificate);
+            String subject = certificate.getSubjectX500Principal().getName("RFC2253");
+            String alias = subject;
+            // Append a suffix alias-1, alias-2 ... if the same alias (subject) already exists.
+            for (int i = 1; keyStore.containsAlias(alias); i++) {
+                alias = subject + "-" + i;
+            }
+            keyStore.setCertificateEntry(alias, certificate);
         }
         return keyStore;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
index ee9a68eb7ad..8abe383a06e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
@@ -20,6 +20,7 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
@@ -108,7 +109,7 @@ public void testLoadKeyStoreWithWrongFileType(
 
     @ParameterizedTest
     @MethodSource("data")
-    public void testLoadTrustStore(
+    public void testLoadTrustStoreFromPemBundle(
             X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
             throws Exception {
         init(caKeyType, certKeyType, keyPassword, paramIndex);
@@ -118,7 +119,9 @@ public void testLoadTrustStore(
             .setTrustStorePassword(x509TestContext.getTrustStorePassword())
             .build()
             .loadTrustStore();
-        assertEquals(1, ts.size());
+        assertEquals(2, ts.size());
+        assertTrue(ts.containsAlias("cn=org.apache.zookeeper.common.x509testcontext root ca"));
+        assertTrue(ts.containsAlias("cn=org.apache.zookeeper.common.x509testcontext root ca-1"));
     }
 
     @ParameterizedTest
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
index 2bb759e639f..80632e45c01 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
@@ -29,6 +29,7 @@
 import java.security.Security;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
+import java.util.List;
 import org.apache.commons.io.FileUtils;
 import org.bouncycastle.asn1.x500.X500NameBuilder;
 import org.bouncycastle.asn1.x500.style.BCStyle;
@@ -48,7 +49,7 @@ public class X509TestContext {
     private final X509KeyType trustStoreKeyType;
     private final KeyPair trustStoreKeyPair;
     private final long trustStoreCertExpirationMillis;
-    private final X509Certificate trustStoreCertificate;
+    private final List<X509Certificate> trustStoreCertificates;
     private final String trustStorePassword;
     private File trustStoreJksFile;
     private File trustStorePemFile;
@@ -99,11 +100,18 @@ private X509TestContext(File tempDir, KeyPair trustStoreKeyPair, long trustStore
 
         X500NameBuilder caNameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         caNameBuilder.addRDN(BCStyle.CN, MethodHandles.lookup().lookupClass().getCanonicalName() + " Root CA");
-        trustStoreCertificate = X509TestHelpers.newSelfSignedCACert(caNameBuilder.build(), trustStoreKeyPair, trustStoreCertExpirationMillis);
+        // Create two CA certs to test multiple certs in PEM bundles.
+        // Use same subject name to simulate multiple CA certs from the same CA (e.g. reissued cert with different key type).
+        trustStoreCertificates = Arrays.asList(
+                X509TestHelpers.newSelfSignedCACert(caNameBuilder.build(), trustStoreKeyPair,
+                        trustStoreCertExpirationMillis),
+                X509TestHelpers.newSelfSignedCACert(caNameBuilder.build(), trustStoreKeyPair,
+                        trustStoreCertExpirationMillis)
+        );
 
         X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         nameBuilder.addRDN(BCStyle.CN, MethodHandles.lookup().lookupClass().getCanonicalName() + " Zookeeper Test");
-        keyStoreCertificate = X509TestHelpers.newCert(trustStoreCertificate, trustStoreKeyPair, nameBuilder.build(), keyStoreKeyPair.getPublic(), keyStoreCertExpirationMillis);
+        keyStoreCertificate = X509TestHelpers.newCert(trustStoreCertificates.get(0), trustStoreKeyPair, nameBuilder.build(), keyStoreKeyPair.getPublic(), keyStoreCertExpirationMillis);
         trustStorePkcs12File = trustStorePemFile = trustStoreJksFile = null;
         keyStorePkcs12File = keyStorePemFile = keyStoreJksFile = null;
 
@@ -139,8 +147,8 @@ public long getTrustStoreCertExpirationMillis() {
         return trustStoreCertExpirationMillis;
     }
 
-    public X509Certificate getTrustStoreCertificate() {
-        return trustStoreCertificate;
+    public List<X509Certificate> getTrustStoreCertificates() {
+        return trustStoreCertificates;
     }
 
     public String getTrustStorePassword() {
@@ -159,7 +167,7 @@ public File getTrustStoreFile(KeyStoreFileType storeFileType) throws IOException
         case JKS:
             return getTrustStoreJksFile();
         case PEM:
-            return getTrustStorePemFile();
+            return getTrustStorePemBundleFile();
         case PKCS12:
             return getTrustStorePkcs12File();
         case BCFKS:
@@ -177,7 +185,7 @@ private File getTrustStoreJksFile() throws IOException {
             File trustStoreJksFile = File.createTempFile(TRUST_STORE_PREFIX, KeyStoreFileType.JKS.getDefaultFileExtension(), tempDir);
             trustStoreJksFile.deleteOnExit();
             try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStoreJksFile)) {
-                byte[] bytes = X509TestHelpers.certToJavaTrustStoreBytes(trustStoreCertificate, trustStorePassword);
+                byte[] bytes = X509TestHelpers.certToJavaTrustStoreBytes(trustStoreCertificates.get(0), trustStorePassword);
                 trustStoreOutputStream.write(bytes);
                 trustStoreOutputStream.flush();
             } catch (GeneralSecurityException e) {
@@ -188,11 +196,13 @@ private File getTrustStoreJksFile() throws IOException {
         return trustStoreJksFile;
     }
 
-    private File getTrustStorePemFile() throws IOException {
+    private File getTrustStorePemBundleFile() throws IOException {
         if (trustStorePemFile == null) {
             File trustStorePemFile = File.createTempFile(TRUST_STORE_PREFIX, KeyStoreFileType.PEM.getDefaultFileExtension(), tempDir);
             trustStorePemFile.deleteOnExit();
-            FileUtils.writeStringToFile(trustStorePemFile, X509TestHelpers.pemEncodeX509Certificate(trustStoreCertificate), StandardCharsets.US_ASCII, false);
+            for (X509Certificate cert : trustStoreCertificates) {
+                FileUtils.writeStringToFile(trustStorePemFile, X509TestHelpers.pemEncodeX509Certificate(cert), StandardCharsets.US_ASCII, true);
+            }
             this.trustStorePemFile = trustStorePemFile;
         }
         return trustStorePemFile;
@@ -203,7 +213,7 @@ private File getTrustStorePkcs12File() throws IOException {
             File trustStorePkcs12File = File.createTempFile(TRUST_STORE_PREFIX, KeyStoreFileType.PKCS12.getDefaultFileExtension(), tempDir);
             trustStorePkcs12File.deleteOnExit();
             try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStorePkcs12File)) {
-                byte[] bytes = X509TestHelpers.certToPKCS12TrustStoreBytes(trustStoreCertificate, trustStorePassword);
+                byte[] bytes = X509TestHelpers.certToPKCS12TrustStoreBytes(trustStoreCertificates.get(0), trustStorePassword);
                 trustStoreOutputStream.write(bytes);
                 trustStoreOutputStream.flush();
             } catch (GeneralSecurityException e) {
@@ -220,7 +230,7 @@ private File getTrustStoreBcfksFile() throws IOException {
                 TRUST_STORE_PREFIX, KeyStoreFileType.BCFKS.getDefaultFileExtension(), tempDir);
             trustStoreBcfksFile.deleteOnExit();
             try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStoreBcfksFile)) {
-                byte[] bytes = X509TestHelpers.certToBCFKSTrustStoreBytes(trustStoreCertificate, trustStorePassword);
+                byte[] bytes = X509TestHelpers.certToBCFKSTrustStoreBytes(trustStoreCertificates.get(0), trustStorePassword);
                 trustStoreOutputStream.write(bytes);
                 trustStoreOutputStream.flush();
             } catch (GeneralSecurityException e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
index d584c28da9d..30d9241e7ac 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
@@ -135,8 +135,7 @@ public void testLoadCertificateFromTrustStore(
             throws Exception {
         init(caKeyType, certKeyType, keyPassword, paramIndex);
         List<X509Certificate> certs = PemReader.readCertificateChain(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM));
-        assertEquals(1, certs.size());
-        assertEquals(x509TestContext.getTrustStoreCertificate(), certs.get(0));
+        assertEquals(x509TestContext.getTrustStoreCertificates(), certs);
     }
 
 }

From dc3150ad6bf4fdabd65ff0cb412cd6d8db3af17b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andor=20Moln=C3=A1r?= <andor@apache.org>
Date: Thu, 23 Apr 2026 10:55:57 -0500
Subject: [PATCH 584/591] ZOOKEEPER-5035: remove loggraph from contrib

Reviewers: ctubbsii, PDavid, eolivelli
Author: anmolnar
Closes #2372 from anmolnar/ZOOKEEPER-5035
---
 NOTICE.txt                                    |   12 +-
 zookeeper-contrib/pom.xml                     |    1 -
 .../zookeeper-contrib-loggraph/README.md      |   80 -
 .../zookeeper-contrib-loggraph/pom.xml        |  127 -
 .../zookeeper/graph/FilterException.java      |   22 -
 .../org/apache/zookeeper/graph/FilterOp.java  |   76 -
 .../apache/zookeeper/graph/FilterParser.java  |  131 -
 .../apache/zookeeper/graph/JsonGenerator.java |  229 --
 .../apache/zookeeper/graph/Log4JEntry.java    |   40 -
 .../apache/zookeeper/graph/Log4JSource.java   |  391 --
 .../org/apache/zookeeper/graph/LogEntry.java  |   47 -
 .../apache/zookeeper/graph/LogIterator.java   |   26 -
 .../org/apache/zookeeper/graph/LogServer.java |   66 -
 .../apache/zookeeper/graph/LogSkipList.java   |   95 -
 .../org/apache/zookeeper/graph/LogSource.java |   33 -
 .../zookeeper/graph/MeasureThroughput.java    |  104 -
 .../zookeeper/graph/MergedLogSource.java      |  189 -
 .../graph/RandomAccessFileReader.java         |  329 --
 .../zookeeper/graph/TransactionEntry.java     |   59 -
 .../apache/zookeeper/graph/TxnLogSource.java  |  380 --
 .../zookeeper/graph/filterops/AndOp.java      |   33 -
 .../apache/zookeeper/graph/filterops/Arg.java |   36 -
 .../zookeeper/graph/filterops/EqualsOp.java   |   44 -
 .../graph/filterops/GreaterThanOp.java        |   70 -
 .../zookeeper/graph/filterops/LessThanOp.java |   69 -
 .../zookeeper/graph/filterops/NotOp.java      |   31 -
 .../zookeeper/graph/filterops/NumberArg.java  |   28 -
 .../zookeeper/graph/filterops/OrOp.java       |   33 -
 .../zookeeper/graph/filterops/StringArg.java  |   28 -
 .../zookeeper/graph/filterops/SymbolArg.java  |   27 -
 .../zookeeper/graph/filterops/XorOp.java      |   40 -
 .../zookeeper/graph/servlets/FileLoader.java  |   50 -
 .../apache/zookeeper/graph/servlets/Fs.java   |   73 -
 .../zookeeper/graph/servlets/GraphData.java   |   69 -
 .../zookeeper/graph/servlets/JsonServlet.java |   94 -
 .../zookeeper/graph/servlets/NumEvents.java   |   79 -
 .../graph/servlets/StaticContent.java         |   53 -
 .../zookeeper/graph/servlets/Throughput.java  |  123 -
 .../src/main/resources/loggraph-dev.sh        |   48 -
 .../src/main/resources/loggraph.sh            |   43 -
 .../org/apache/zookeeper/graph/logback.xml    |   38 -
 .../zookeeper/graph/resources/date.format.js  |  126 -
 .../apache/zookeeper/graph/resources/g.bar.js |  385 --
 .../apache/zookeeper/graph/resources/g.dot.js |  110 -
 .../zookeeper/graph/resources/g.line.js       |  230 --
 .../apache/zookeeper/graph/resources/g.pie.js |  205 -
 .../zookeeper/graph/resources/g.raphael.js    |  481 ---
 .../zookeeper/graph/resources/load-big.gif    |  Bin 1924 -> 0 bytes
 .../apache/zookeeper/graph/resources/load.gif |  Bin 673 -> 0 bytes
 .../zookeeper/graph/resources/loggraph.css    |   54 -
 .../zookeeper/graph/resources/loggraph.js     |  262 --
 .../zookeeper/graph/resources/loggraph.log.js |   57 -
 .../graph/resources/loggraph.server.js        |  329 --
 .../graph/resources/loggraph.session.js       |  202 -
 .../graph/resources/loggraph.stats.js         |   44 -
 .../zookeeper/graph/resources/loggraph.ui.js  |  377 --
 .../zookeeper/graph/resources/main.html       |   60 -
 .../zookeeper/graph/resources/raphael.js      | 3296 -----------------
 .../zookeeper/graph/resources/yui-min.js      |   12 -
 .../graph/servlets/FileLoaderTest.java        |  120 -
 .../zookeeper/graph/servlets/FsTest.java      |   46 -
 .../graph/servlets/ThroughputTest.java        |   88 -
 62 files changed, 1 insertion(+), 10029 deletions(-)
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/README.md
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
 delete mode 100755 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
 delete mode 100755 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load-big.gif
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load.gif
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java
 delete mode 100644 zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java

diff --git a/NOTICE.txt b/NOTICE.txt
index a4e8d36bf5e..9b3afcb4705 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2024 The Apache Software Foundation
+Copyright 2009-2026 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
@@ -18,18 +18,8 @@ These BSD licensed files:
   ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_itr.c
   ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_itr.h
   ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_private.h
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
   ./zookeeper-docs/src/main/resources/markdown/skin/prototype.js
 
-These MIT licensed files:
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
-  ./zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
-
 This Apache 2.0 licensed file:
 ./zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
 
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
index 0dc8e867da4..66d76ebba65 100644
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -43,7 +43,6 @@
       <id>full-build</id>
       <modules>
         <module>zookeeper-contrib-fatjar</module>
-        <module>zookeeper-contrib-loggraph</module>
         <module>zookeeper-contrib-rest</module>
         <module>zookeeper-contrib-zooinspector</module>
       </modules>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/README.md b/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
deleted file mode 100644
index a1b849a3349..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/README.md
+++ /dev/null
@@ -1,80 +0,0 @@
-# LogGraph README
-
-## 1 - About
-LogGraph is an application for viewing and filtering zookeeper logs. It can handle transaction logs and message logs. 
-
-## 2 - Compiling
-
-Run `mvn clean install dependency:copy-dependencies` in zookeeper-contrib/zookeeper-contrib-loggraph/.
-This will download all dependencies and compile all the loggraph code.
-
-Once compilation has finished, you can run it the the `loggraph.sh` script in zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources.
-This will start and embedded web server on your machine.
-Navigate to `http://localhost:8182/graph/main.html`
-
-## 3 - Usage
-LogGraph presents the user with 4 views, 
- 
-  a) Simple log view
-     This view simply displays the log text. This isn't very useful without filters (see "Filtering the logs").
-
-  b) Server view
-     The server view shows the interactions between the different servers in an ensemble. The X axis represents time.
-      
-    * Exceptions show up as red dots. Hovering your mouse over them will give you more details of the exception
-	* The colour of the line represents the election state of the server. 
-	   - orange means LOOKING for leader
-	   - dark green means the server is the leader
-	   - light green means the server is following a leader
-	   - yellow means there isn't enough information to determine the state of the server. 
-	* The gray arrows denote election messages between servers. Pink dashed arrows are messages that were sent but never delivered.
-
-  c) Session view
-     The session view shows the lifetime of sessions on a server. Use the time filter to narrow down the view. Any more than about 2000 events will take a long time to view in your browser. 
-     The X axis represents time. Each line is a session. The black dots represent events on the session. You can click on the black dots for more details of the event.
-
-  d) Stats view
-     There is currently only one statistics view, Transactions/minute. Suggestions for other statistic views are very welcome.
-
-## 4 - Filtering the logs
-The logs can be filtered in 2 ways, by time and by content. 
-
-To filter by time simply move the slider to the desired start time. The time window specifies how many milliseconds after and including the start time will be displayed.
-
-Content filtering uses a adhoc filtering language, using prefix notation. The language looks somewhat similar to lisp. A statement in the language takes the form (op arg arg ....). A statement resolves to a boolean value. Statements can be nested. 
-
-### 4.1 - Filter arguments
-An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpreted as hexadecimal. Otherwise it is interpreted as decimal. If the argument begins with a double-quote, (") it is interpreted as a string. Anything else is interpreted as a symbol.
-
-### 4.2 - Filter symbols
-The possible filter symbols are: 
-
-client-id : number, the session id of the client who initiated a transaction.
-
-cxid : number, the cxid of a transaction
-
-zxid : number, the zxid of a transaction
-
-operation : string, the operation being performed, for example "setData", "createSession", "closeSession", "error", "create"
-
-### 4.3 - Filter operations
-The possible filter operations are:
-
-or : logical or, takes 1 or more arguments which must be other statements.
-
-and : logical and, takes 1 or more arguments which must be other statements.
-
-not : logical not, takes 1 argument which must be another statement.
-
-xor : exclusive or, takes 1 or more arguments which must be other statements.
-
- = : equals, takes 1 or more arguments, which must all be equal to each other to return true.
-
-&gt; : greater than, takes 1 or more arguments, to return true the 1st argument must be greater than the 2nd argument which must be greater than the 3rd argument and so on... 
-
-&lt; : less than, takes 1 or more arguments, to return true the 1st argument must be less than the 2nd argument which must be less than the 3rd argument and so on... 
-
-### 4.4 - Filter examples
-Give me all the setData operations with session id 0xdeadbeef or 0xcafeb33r but not with zxid 0x12341234 ->
-
-(and (= operation "setData") (or (= client-id 0xdeadbeef) (= client-id 0xcafeb33r)) (not (= zxid 0x12341234)))
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
deleted file mode 100644
index 3e129cadf96..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ /dev/null
@@ -1,127 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-  <!--
-  /**
-   * Licensed to the Apache Software Foundation (ASF) under one
-   * or more contributor license agreements.  See the NOTICE file
-   * distributed with this work for additional information
-   * regarding copyright ownership.  The ASF licenses this file
-   * to you under the Apache License, Version 2.0 (the
-   * "License"); you may not use this file except in compliance
-   * with the License.  You may obtain a copy of the License at
-   *
-   *     http://www.apache.org/licenses/LICENSE-2.0
-   *
-   * Unless required by applicable law or agreed to in writing, software
-   * distributed under the License is distributed on an "AS IS" BASIS,
-   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   * See the License for the specific language governing permissions and
-   * limitations under the License.
-   */
-  -->
-  <modelVersion>4.0.0</modelVersion>
-  <parent>
-    <groupId>org.apache.zookeeper</groupId>
-    <artifactId>zookeeper-contrib</artifactId>
-    <version>3.10.0-SNAPSHOT</version>
-  </parent>
-
-  <artifactId>zookeeper-contrib-loggraph</artifactId>
-  <packaging>jar</packaging>
-  <name>Apache ZooKeeper - Contrib - Loggraph</name>
-  <description>
-    LogGraph is an application for viewing and filtering zookeeper logs. It can handle transaction logs and message logs.
-  </description>
-
-  <dependencies>
-    <dependency>
-      <groupId>org.apache.zookeeper</groupId>
-      <artifactId>zookeeper-jute</artifactId>
-      <version>${project.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.zookeeper</groupId>
-      <artifactId>zookeeper</artifactId>
-      <version>${project.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-api</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>ch.qos.logback</groupId>
-      <artifactId>logback-core</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.junit.jupiter</groupId>
-      <artifactId>junit-jupiter-api</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.junit.jupiter</groupId>
-      <artifactId>junit-jupiter-engine</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.mockito</groupId>
-      <artifactId>mockito-core</artifactId>
-      <scope>test</scope>
-    </dependency>
-  </dependencies>
-
-  <build>
-    <resources>
-      <resource>
-        <directory>${project.basedir}/src/main/resources/webapp</directory>
-      </resource>
-    </resources>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-dependency-plugin</artifactId>
-        <configuration>
-          <outputDirectory>
-            ${project.basedir}/lib
-          </outputDirectory>
-        </configuration>
-      </plugin>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-surefire-plugin</artifactId>
-        <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
-          <forkCount>${surefire-forkcount}</forkCount>
-          <reuseForks>false</reuseForks>
-          <argLine>-Xmx512m -Dtest.junit.threads=${surefire-forkcount} -Dzookeeper.junit.threadid=${surefire.forkNumber}</argLine>
-          <basedir>${project.basedir}</basedir>
-          <redirectTestOutputToFile>true</redirectTestOutputToFile>
-          <systemPropertyVariables>
-            <build.test.dir>${project.build.directory}/surefire</build.test.dir>
-            <zookeeper.DigestAuthenticationProvider.superDigest>super:D/InIHSb7yEEbrWz8b9l71RjZJU=</zookeeper.DigestAuthenticationProvider.superDigest>
-          </systemPropertyVariables>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
-
-</project>
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java
deleted file mode 100644
index c0912fa7dfd..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java
+++ /dev/null
@@ -1,22 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-public class FilterException extends Exception {
-    public FilterException(String s) { super(s); }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java
deleted file mode 100644
index b29c8462bf4..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.util.ArrayList;
-import java.util.List;
-import org.apache.zookeeper.graph.filterops.*;
-
-public abstract class FilterOp {
-    protected List<FilterOp> subOps;
-    protected List<Arg> args;
-
-    public enum ArgType {
-	STRING, NUMBER, SYMBOL
-    }
-
-    public FilterOp() {
-	subOps = new ArrayList<FilterOp>();
-	args = new ArrayList<Arg>();
-    }
-
-    public static FilterOp newOp(String op) throws FilterException {
-	if (op.equals("or")) 
-	    return new OrOp();
-	if (op.equals("and"))
-	    return new AndOp();
-	if (op.equals("not"))
-	    return new NotOp();
-	if (op.equals("xor"))
-	    return new XorOp();
-	if (op.equals("="))
-	    return new EqualsOp();
-	if (op.equals("<"))
-	    return new LessThanOp();
-	if (op.equals(">")) 
-	    return new GreaterThanOp();
-
-	throw new FilterException("Invalid operation '"+op+"'");
-    }
-
-    public void addSubOp(FilterOp op) {
-	subOps.add(op);
-    }
-    
-    public void addArg(Arg arg) {
-	args.add(arg); 
-    }
-
-    public abstract boolean matches(LogEntry entry) throws FilterException;
-    
-    public String toString() {
-	String op = "(" + getClass().getName();
-	for (FilterOp f :  subOps) {
-	    op += " " + f;
-	}
-	for (Arg a : args) {
-	    op += " " + a;
-	}
-	return op + ")";
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java
deleted file mode 100644
index cf12e3a5335..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java
+++ /dev/null
@@ -1,131 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.PushbackReader;
-import java.io.StringReader;
-import java.io.IOException;
-import java.util.ArrayList;
-
-import org.apache.zookeeper.graph.filterops.*;
-
-public class FilterParser {
-    private PushbackReader reader;
-
-    public FilterParser(String s) {
-	reader = new PushbackReader(new StringReader(s));
-    }
-
-    private String readUntilSpace() throws IOException {
-	StringBuffer buffer = new StringBuffer();
-
-	int c = reader.read();
-	while (!Character.isWhitespace(c) && c != ')' && c != '(') {
-	    buffer.append((char)c);
-	    c = reader.read();
-	    if (c == -1) {
-		break;
-	    }
-	}	
-	reader.unread(c);
-
-	return buffer.toString().trim();
-    }
-
-    private StringArg readStringArg() throws IOException, FilterException {
-	int c = reader.read();
-	int last = 0;
-	if (c != '"') {
-	    throw new FilterException("Check the parser, trying to read a string that doesn't begin with quotes");
-	}
-	StringBuffer buffer = new StringBuffer();
-	while (reader.ready()) {
-	    last = c;
-	    c = reader.read();
-	    if (c == -1) {
-		break;
-	    }
-	    
-	    if (c == '"' && last != '\\') {
-		return new StringArg(buffer.toString());
-	    } else {
-		buffer.append((char)c);
-	    }
-	}
-	throw new FilterException("Unterminated string");
-    }
-
-    private NumberArg readNumberArg() throws IOException, FilterException {
-	String strval = readUntilSpace();
-	
-	try {
-	    if (strval.startsWith("0x")) {
-		return new NumberArg(Long.valueOf(strval.substring(2), 16));
-	    } else {
-		return new NumberArg(Long.valueOf(strval));
-	    }
-	} catch (NumberFormatException e) {
-	    throw new FilterException("Not a number [" + strval + "]\n" + e);
-	}
-    }
-
-    private SymbolArg readSymbolArg() throws IOException, FilterException {
-	return new SymbolArg(readUntilSpace());
-    }
-
-    public FilterOp parse() throws IOException, FilterException {
-	int c = reader.read();
-	if (c != '(') {
-	    throw new FilterException("Invalid format");
-	}
-
-	String opstr = readUntilSpace();
-	FilterOp op = FilterOp.newOp(opstr);
-
-	while (reader.ready()) {
-	    c = reader.read();
-	    if (c == -1) {
-		break;
-	    }
-	    if (c == '(') {
-		reader.unread(c);
-		op.addSubOp(parse());
-	    } else if (c == ')') {
-		return op;
-	    } else if (c == '"') {
-		reader.unread(c);
-		op.addArg(readStringArg());
-	    } else if (Character.isDigit(c) || c == '-' || c == '+') {
-		reader.unread(c);
-		op.addArg(readNumberArg());
-	    } else if (Character.isJavaIdentifierStart(c)) {
-		reader.unread(c);
-		op.addArg(readSymbolArg());
-	    }
-	}
-	throw new FilterException("Incomplete filter");
-    }
-
-    public static void main(String[] args) throws IOException, FilterException {
-	if (args.length == 1) {
-	    System.out.println(new FilterParser(args[0]).parse());
-	} else {
-	    System.out.println(new FilterParser("(or (and (= session foobar) (= session barfoo)) (= session sdfs))").parse());
-	}
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
deleted file mode 100644
index 19f919e5afe..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
+++ /dev/null
@@ -1,229 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ArrayNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.Set;
-
-public class JsonGenerator {
-	private final ObjectMapper mapper = new ObjectMapper();
-	private final JsonNode root;
-    private final Set<Integer> servers;
-
-    private class Message {
-	private int from;
-	private int to;
-	private long zxid;
-
-	public Message(int from, int to, long zxid) {
-	    this.from = from;
-	    this.to = to;
-	    this.zxid = zxid;
-	}
-	
-	public boolean equals(Message m) {
-	    return (m.from == this.from 
-		    && m.to == this.to
-		    && m.zxid == this.zxid);
-	}
-    };
-
-    public JsonNode txnEntry(TransactionEntry e) {
-		JsonNode event = mapper.createObjectNode();
-
-		((ObjectNode) event).put("time", Long.toString(e.getTimestamp()));
-		((ObjectNode) event).put("client", Long.toHexString(e.getClientId()));
-		((ObjectNode) event).put("cxid", Long.toHexString(e.getCxid()));
-		((ObjectNode) event).put("zxid", Long.toHexString(e.getZxid()));
-		((ObjectNode) event).put("op", e.getOp());
-		((ObjectNode) event).put("extra", e.getExtra());
-		((ObjectNode) event).put("type", "transaction");
-
-		return event;
-    }
-
-    /**
-       Assumes entries are sorted by timestamp.
-     */
-    public JsonGenerator(LogIterator iter) {
-		servers = new HashSet<Integer>();
-
-		Pattern stateChangeP = Pattern.compile("- (LOOKING|FOLLOWING|LEADING)");
-		Pattern newElectionP = Pattern.compile("New election. My id =  (\\d+), Proposed zxid = (\\d+)");
-		Pattern receivedProposalP = Pattern.compile("Notification: (\\d+) \\(n.leader\\), (\\d+) \\(n.zxid\\), (\\d+) \\(n.round\\), .+ \\(n.state\\), (\\d+) \\(n.sid\\), .+ \\(my state\\)");
-		Pattern exceptionP = Pattern.compile("xception");
-
-		root = mapper.createObjectNode();
-		Matcher m = null;
-		ArrayNode events = mapper.createArrayNode();
-		((ObjectNode)root).set("events", events);
-
-		long starttime = Long.MAX_VALUE;
-		long endtime = 0;
-
-		int leader = 0;
-		long curEpoch = 0;
-
-		while (iter.hasNext()) {
-			LogEntry ent = iter.next();
-
-			if (ent.getTimestamp() < starttime) {
-				starttime = ent.getTimestamp();
-			}
-			if (ent.getTimestamp() > endtime) {
-				endtime = ent.getTimestamp();
-			}
-
-			if (ent.getType() == LogEntry.Type.TXN) {
-				events.add(txnEntry((TransactionEntry)ent));
-			}
-			else {
-				Log4JEntry e = (Log4JEntry)ent;
-				servers.add(e.getNode());
-
-				if ((m = stateChangeP.matcher(e.getEntry())).find()) {
-					JsonNode stateChange = add("stateChange", e.getTimestamp(), e.getNode(), m.group(1));
-					events.add(stateChange);
-
-					if (m.group(1).equals("LEADING")) {
-					leader = e.getNode();
-					}
-				}
-				else if ((m = newElectionP.matcher(e.getEntry())).find()) {
-					Iterator<Integer> iterator = servers.iterator();
-					long zxid = Long.valueOf(m.group(2));
-					int count = (int)zxid;// & 0xFFFFFFFFL;
-					int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
-
-					if (leader != 0 && epoch > curEpoch) {
-						JsonNode stateChange = add("stateChange", e.getTimestamp(), leader, "INIT");
-						events.add(stateChange);
-
-						leader = 0;
-					}
-
-					while (iterator.hasNext()) {
-						int dst = iterator.next();
-						if (dst != e.getNode()) {
-							JsonNode msg = mapper.createObjectNode();
-							((ObjectNode)msg).put("type", "postmessage");
-							((ObjectNode)msg).put("src", e.getNode());
-							((ObjectNode)msg).put("dst", dst);
-							((ObjectNode)msg).put("time", e.getTimestamp());
-							((ObjectNode)msg).put("zxid", m.group(2));
-							((ObjectNode)msg).put("count", count);
-							((ObjectNode)msg).put("epoch", epoch);
-
-							events.add(msg);
-						}
-					}
-				}
-				else if ((m = receivedProposalP.matcher(e.getEntry())).find()) {
-					// Pattern.compile("Notification: \\d+, (\\d+), (\\d+), \\d+, [^,]*, [^,]*, (\\d+)");//, LOOKING, LOOKING, 2
-					int src = Integer.valueOf(m.group(4));
-					long zxid = Long.valueOf(m.group(2));
-					int dst = e.getNode();
-					long epoch2 = Long.valueOf(m.group(3));
-
-					int count = (int)zxid;// & 0xFFFFFFFFL;
-					int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
-
-					if (leader != 0 && epoch > curEpoch) {
-						JsonNode stateChange = add("stateChange", e.getTimestamp(), leader, "INIT");
-						events.add(stateChange);
-
-						leader = 0;
-					}
-
-					if (src != dst) {
-						JsonNode msg = mapper.createObjectNode();
-						((ObjectNode)msg).put("type", "delivermessage");
-						((ObjectNode)msg).put("src", src);
-						((ObjectNode)msg).put("dst", dst);
-						((ObjectNode)msg).put("time", e.getTimestamp());
-						((ObjectNode)msg).put("zxid", zxid);
-						((ObjectNode)msg).put("count", count);
-						((ObjectNode)msg).put("epoch", epoch);
-						((ObjectNode)msg).put("epoch2", epoch2);
-
-					events.add(msg);
-					}
-				}
-				else if ((m = exceptionP.matcher(e.getEntry())).find()) {
-					JsonNode ex = mapper.createObjectNode();
-					((ObjectNode)ex).put("type", "exception");
-					((ObjectNode)ex).put("time", e.getTimestamp());
-					((ObjectNode)ex).put("server", e.getNode());
-					((ObjectNode)ex).put("text", e.getEntry());
-					events.add(ex);
-				}
-			}
-			JsonNode ex = mapper.createObjectNode();
-			((ObjectNode)ex).put("type", "text");
-			((ObjectNode)ex).put("time", ent.getTimestamp());
-			String txt = ent.toString();
-			((ObjectNode)ex).put("text", txt);
-			events.add(ex);
-		}
-		//	System.out.println("pending messages: "+pendingMessages.size());
-		((ObjectNode)root).put("starttime", starttime);
-		((ObjectNode)root).put("endtime", endtime);
-
-		ArrayNode serversarray = mapper.createArrayNode();
-		((ObjectNode)root).set("servers", serversarray);
-
-		Iterator<Integer> iterator = servers.iterator();
-		while (iterator.hasNext()) {
-			serversarray.add(iterator.next());
-		}
-    }
-
-    private JsonNode add(String type, long timestamp, int node, String entry){
-		JsonNode stateChange = mapper.createObjectNode();
-		((ObjectNode)stateChange).put("type", type);
-		((ObjectNode)stateChange).put("time", timestamp);
-		((ObjectNode)stateChange).put("server", node);
-		((ObjectNode)stateChange).put("state", entry);
-		return stateChange;
-	}
-
-    public String toString() {
-		String jsonString = null;
-		try {
-			jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(root);
-		} catch (JsonProcessingException e) {
-			jsonString = "{\"ERR\", " + e.getMessage() + "}";
-		}
-		return jsonString;
-    }
-
-    public static void main(String[] args) throws Exception {
-		MergedLogSource src = new MergedLogSource(args);
-		LogIterator iter = src.iterator();
-		System.out.println(new JsonGenerator(iter));
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java
deleted file mode 100644
index 0edc1460244..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-public class Log4JEntry extends LogEntry {
-    public Log4JEntry(long timestamp, int node, String entry) { 
-	super(timestamp);
-	setAttribute("log-text", entry);
-	setAttribute("node", new Integer(node));
-    }
-
-    public String getEntry() {
-	return (String) getAttribute("log-text");
-    }
-
-    public String toString() {
-	return "" + getTimestamp() + "::::" + getNode() + "::::"  + getEntry();
-    }
-
-    public int getNode() {
-	return (Integer) getAttribute("node");
-    }
-
-    public Type getType() { return LogEntry.Type.LOG4J; }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
deleted file mode 100644
index b0071253d50..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
+++ /dev/null
@@ -1,391 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.File;
-import java.io.InputStreamReader;
-import java.io.BufferedReader;
-import java.io.FileReader;
-import java.io.IOException;
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-import java.util.ArrayList;
-import java.util.Date;
-import java.text.SimpleDateFormat;
-import java.text.ParseException;
-import java.util.Calendar;
-import java.util.GregorianCalendar;
-
-import java.io.EOFException;
-import java.io.Closeable;
-import java.io.FileNotFoundException;
-import java.util.Iterator;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class Log4JSource implements LogSource {
-    private static final Logger LOG = LoggerFactory.getLogger(Log4JSource.class);
-    
-    private static final int skipN = 10000;
-    private static final String DATE_FORMAT = "yyyy-MM-dd HH:mm:ss,SSS";
-
-    private LogSkipList skiplist = null;
-
-    private String file = null;
-    private long starttime = 0;
-    private long endtime = 0;
-    private int serverid = 0;
-    private long size = 0;
-
-    private Pattern timep;
-
-    public boolean overlapsRange(long starttime, long endtime) {
-	return (starttime <= this.endtime && endtime >= this.starttime);
-    }
-    
-    public long size() { return size; }
-    public long getStartTime() { return starttime; }
-    public long getEndTime() { return endtime; }
-    public LogSkipList getSkipList() { return skiplist; }
-    
-    private class Log4JSourceIterator implements LogIterator {
-	private RandomAccessFileReader in;
-	private LogEntry next = null;
-	private long starttime = 0;
-	private long endtime = 0;
-	private String buf = "";	
-	private Log4JSource src = null;
-	private long skippedAtStart = 0;
-	private SimpleDateFormat dateformat = null;
-	private FilterOp filter = null;
-
-	public Log4JSourceIterator(Log4JSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-	    this(src, starttime, endtime, null);
-	}
-
-	public Log4JSourceIterator(Log4JSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-
-	    this.dateformat = new SimpleDateFormat(DATE_FORMAT);
-	    this.src = src;
-	    this.starttime = starttime;
-	    this.endtime = endtime;
-
-	    File f = new File(src.file);
-	    try {
-		in = new RandomAccessFileReader(f);
-	    } catch (FileNotFoundException e) {
-		throw new IllegalArgumentException("Bad file passed in (" + src.file +") cannot open:" + e);
-	    }
-
-	    // skip to the offset of latest skip point before starttime
-	    LogSkipList.Mark start = src.getSkipList().findMarkBefore(starttime);
-	    try {
-		in.seek(start.getBytes());
-		skippedAtStart = start.getEntriesSkipped();
-	    } catch (IOException ioe) {
-		// if we can't skip, we should just read from the start
-	    }
-
-	    LogEntry e;
-	    while ((e = readNextEntry()) != null && e.getTimestamp() < endtime) {
-		if (e.getTimestamp() >= starttime && (filter == null || filter.matches(e))) {
-		    next = e;
-		    return;
-		}
-		skippedAtStart++;
-	    }
-	    this.filter = filter;
-	}
-	
-	synchronized public long size() throws IOException {
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("size() called");
-	    }
-
-	    if (this.endtime >= src.getEndTime()) {
-		return src.size() - skippedAtStart;
-	    }
-	    
-	    long pos = in.getPosition();
-	    
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("saved pos () = " + pos);
-	    }
-	    
-	    LogEntry e;
-	  
-	    LogSkipList.Mark lastseg = src.getSkipList().findMarkBefore(this.endtime);
-	    in.seek(lastseg.getBytes());
-	    buf = "";  // clear the buf so we don't get something we read before we sought
-	    // number of entries skipped to get to the end of the iterator, less the number skipped to get to the start
-	    long count = lastseg.getEntriesSkipped() - skippedAtStart; 
-
-	    while ((e = readNextEntry()) != null) {
-		if (LOG.isTraceEnabled()) {
-		    //LOG.trace(e);
-		}
-		if (e.getTimestamp() > this.endtime) {
-		    break;
-		}
-		count++;
-	    }
-	    in.seek(pos);
-	    buf = "";
-
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("size() = " + count);
-	    }
-	    
-	    return count;
-	}
-
-	synchronized private LogEntry readNextEntry() {
-	    try {
-		try {
-		    while (true) {
-			String line = in.readLine();
-			if (line == null) {
-			    break;
-			}
-
-			Matcher m = src.timep.matcher(line);
-			if (m.lookingAt()) {
-			    if (buf.length() > 0) {
-				LogEntry e = new Log4JEntry(src.timestampFromText(dateformat, buf), src.getServerId(), buf);
-				buf = line;
-				return e;
-			    }
-			    buf = line;
-			} else if (buf.length() > 0) {
-			    buf += line + "\n";
-			}
-		    }
-		} catch (EOFException eof) {
-		    // ignore, we've simply come to the end of the file
-		}
-		if (buf.length() > 0) {
-		    LogEntry e = new Log4JEntry(src.timestampFromText(dateformat, buf), src.getServerId(), buf);
-		    buf = "";
-		    return e;
-		}
-	    } catch (Exception e) {
-		LOG.error("Error reading next entry in file (" + src.file + "): " + e);
-		return null;
-	    }
-	    return null;
-	}
-
-	public boolean hasNext() {
-	    return next != null;
-	}
-	
-	public LogEntry next() throws NoSuchElementException {
-	    LogEntry ret = next;
-	    LogEntry e = readNextEntry();
-
-	    if (filter != null) {
-		try {
-		    while (e != null && !filter.matches(e)) {
-			e = readNextEntry();
-		    }
-		} catch (FilterException fe) {
-		    throw new NoSuchElementException(e.toString());
-		}
-	    }
-
-	    if (e != null && e.getTimestamp() < endtime) {
-		next = e;
-	    } else {
-		next = null;
-	    }
-	    return ret;
-	}
-
-	public void remove() throws UnsupportedOperationException {
-	    throw new UnsupportedOperationException("remove not supported for L4J logs");
-	}
-	
-	public void close() throws IOException {
-	    in.close();
-	}
-	
-	public String toString() {
-	    String size;
-	    try {
-		size = new Long(size()).toString();
-	    } catch (IOException ioe) {
-		size = "Unable to read";
-	    }
-	    return "Log4JSourceIterator(start=" + starttime + ", end=" + endtime + ", size=" + size + ")";
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-	try {
-	    return iterator(starttime, endtime, null);
-	} catch (FilterException fe) {
-	    assert(false); //"This should never happen, you can't have a filter exception without a filter");
-	    return null;
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException{
-	// sanitise start and end times
-	if (endtime < starttime) {
-	    throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-	}
-
-	return new Log4JSourceIterator(this, starttime, endtime, filter);
-    }
-
-    public LogIterator iterator() throws IllegalArgumentException {
-	return iterator(starttime, endtime+1);
-    }
-    
-    public Log4JSource(String file) throws IOException {
-	this.file=file;
-	
-	timep = Pattern.compile("^(\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2},\\d{3})");
-	skiplist = new LogSkipList();
-	init();
-    }
-    
-    private static long timestampFromText(SimpleDateFormat format, String s) {
-	Date d = null;
-	try {
-	    d = format.parse(s);
-	} catch (ParseException e) {
-	    return 0;
-	}
-	Calendar c = new GregorianCalendar();
-	c.setTime(d);
-	return c.getTimeInMillis();
-    }
-
-    private void init() throws IOException {
-	File f = new File(file);
-	RandomAccessFileReader in = new RandomAccessFileReader(f);
-	SimpleDateFormat dateformat = new SimpleDateFormat(DATE_FORMAT);
-	Pattern idp = Pattern.compile("\\[myid:(\\d+)\\]");
-
-	long lastFp = in.getPosition();
-	String line = in.readLine();
-	Matcher m = null;
-
-	// if we have read data from the file, and it matches the timep pattern
-	if ((line != null) && (m = timep.matcher(line)).lookingAt()) {
-	    starttime = timestampFromText(dateformat, m.group(1));
-	} else {
-	    throw new IOException("Invalid log format. First line doesn't start with time");
-	}
-
-	/*
-	  Count number of log entries. Any line starting with a timestamp counts as an entry
-	*/
-	String lastentry = line;
-	try {
-	    while (line != null) {
-		m = timep.matcher(line);
-		if (m.lookingAt()) {
-		    if (size % skipN == 0) {
-			long time = timestampFromText(dateformat, m.group(1));
-			skiplist.addMark(time, lastFp, size);
-		    }
-		    size++;
-		    lastentry = line;
-		} 
-		if (serverid == 0 && (m = idp.matcher(line)).find()) {
-		    serverid = Integer.valueOf(m.group(1));
-		}
-
-		lastFp = in.getPosition();
-		line = in.readLine();
-	    }
-	} catch (EOFException eof) {
-	    // ignore, simply end of file, though really (line!=null) should have caught this
-	} finally {
-	    in.close();
-	}
-
-	m = timep.matcher(lastentry);
-	if (m.lookingAt()) {
-	    endtime = timestampFromText(dateformat, m.group(1));
-	} else {
-	    throw new IOException("Invalid log format. Last line doesn't start with time");
-	}
-    }
-    
-    public String toString() {
-	return "Log4JSource(file=" + file + ", size=" + size + ", start=" + starttime + ", end=" + endtime +", id=" + serverid +")";
-    }
-
-    public static void main(String[] args) throws IOException {
-	final Log4JSource s = new Log4JSource(args[0]);
-	System.out.println(s);
-
-	LogIterator iter;
-
-	if (args.length == 3) {
-	    final long starttime = Long.valueOf(args[1]);
-	    final long endtime = Long.valueOf(args[2]);
-	    iter = s.iterator(starttime, endtime);
-	    
-	    Thread t1 = new Thread() { public void run () { 
-		
-		LogIterator iter = s.iterator(starttime, endtime);
-		System.out.println(iter);
-		try {
-		  iter.close();
-		} catch (IOException ioe) {
-		  System.out.println(ioe.getMessage());
-		}
-	    }; };
-	    Thread t2 = new Thread() { public void run () { 
-		
-		LogIterator iter = s.iterator(starttime, endtime);
-		System.out.println(iter);
-		try {
-		  iter.close();
-		} catch (IOException ioe) {
-		  System.out.println(ioe.getMessage());
-		}
-	    }; };
-	    Thread t3 = new Thread() { public void run () { 
-		
-		LogIterator iter = s.iterator(starttime, endtime);
-		System.out.println(iter);
-	    }; };
-	    t1.start();
-	    t2.start();
-	    //	    t3.start();
-	} else {
-	    iter = s.iterator();
-	}
-
-	/*while (iter.hasNext()) {
-	    System.out.println(iter.next());
-	    }*/
-	iter.close();
-    }
-
-    public int getServerId() {
-	return serverid;
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java
deleted file mode 100644
index 27973ba91a3..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.Serializable;
-import java.util.HashMap;
-import java.util.Map;
-
-public abstract class LogEntry implements Serializable {
-    private Map attributes;
-
-    public enum Type { UNKNOWN, LOG4J, TXN };
-        
-    public LogEntry(long timestamp) {
-	attributes = new HashMap();
-	setAttribute("timestamp", new Long(timestamp));
-    }
-    
-    public long getTimestamp() {
-	return (Long)getAttribute("timestamp");
-    }    
-    
-    public abstract Type getType();
-    
-    public void setAttribute(String key, Object v) {
-	attributes.put(key, v);
-    }
-
-    public Object getAttribute(String key) {
-	return attributes.get(key);
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java
deleted file mode 100644
index 9af440ba1c9..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java
+++ /dev/null
@@ -1,26 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.Closeable;
-import java.util.Iterator;
-import java.io.IOException;
-
-public interface LogIterator extends Iterator<LogEntry>, Closeable {
-    long size() throws IOException;;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java
deleted file mode 100644
index 5cffcdd1d5f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.IOException;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.ServletException;
- 
-import java.io.IOException;
- 
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.server.handler.AbstractHandler;
-import org.eclipse.jetty.servlet.ServletContextHandler;
-import org.eclipse.jetty.servlet.ServletHolder;
-
-import org.apache.zookeeper.graph.servlets.*;
-
-public class LogServer extends ServletContextHandler {    
-    public LogServer(MergedLogSource src) throws Exception {
-	super(ServletContextHandler.SESSIONS);
-	setContextPath("/");
-
-	addServlet(new ServletHolder(new StaticContent()),"/graph/*");
-
-	addServlet(new ServletHolder(new Fs()),"/fs");
-	addServlet(new ServletHolder(new GraphData(src)), "/data");
-	addServlet(new ServletHolder(new FileLoader(src)), "/loadfile");
-	addServlet(new ServletHolder(new NumEvents(src)), "/info");
-	addServlet(new ServletHolder(new Throughput(src)), "/throughput");
-    }
-
-    public static void main(String[] args) {  
-	try {  
-	    MergedLogSource src = new MergedLogSource(args);
-	    System.out.println(src);
-
-	    Server server = new Server(8182);
-	    server.setHandler(new LogServer(src));
-	    
-	    server.start();
-	    server.join();
-
-	} catch (Exception e) {  
-	    // Something is wrong.  
-	    e.printStackTrace();  
-	}  
-    } 
-} 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java
deleted file mode 100644
index e74444291af..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java
+++ /dev/null
@@ -1,95 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.util.List;
-import java.util.LinkedList;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
-Generic skip list for holding a rough index of a log file. When the log file is loaded, this 
-index is built by adding a mark every n entries. Then when a specific time position is requested
-from the file, a point at most n-1 entries before the time position can be jumped to.
-
-*/
-public class LogSkipList {
-    private static final Logger LOG = LoggerFactory.getLogger(LogSkipList.class);
-    
-    private LinkedList<Mark> marks;
-
-    public class Mark {
-	private long time;
-	private long bytes;
-	private long skipped;
-
-	public Mark(long time, long bytes, long skipped) {
-	    this.time = time;
-	    this.bytes = bytes;
-	    this.skipped = skipped;
-	}
-
-	public long getTime() { return this.time; }
-	public long getBytes() { return this.bytes; }
-	public long getEntriesSkipped() { return this.skipped; }
-
-	public String toString() {
-	    return "Mark(time=" + time + ", bytes=" + bytes + ", skipped=" + skipped + ")";
-	}
-    };
-
-    public LogSkipList() {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("New skip list");
-	}
-	marks = new LinkedList<Mark>();
-    }
-
-    public void addMark(long time, long bytes, long skipped) {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("addMark (time:" + time + ", bytes: " + bytes + ", skipped: " + skipped + ")");
-	}
-	marks.add(new Mark(time, bytes, skipped));
-    }
-
-    /** 
-	Find the last mark in the skip list before time.
-     */
-    public Mark findMarkBefore(long time) throws NoSuchElementException {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("findMarkBefore(" + time + ")");
-	}
-		    
-	Mark last = marks.getFirst();
-	for (Mark m: marks) {
-	    if (m.getTime() > time) {
-		break;
-	    } 
-	    last = m;
-	}
-	
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("return " + last );
-	}
-	
-	return last;
-    }
-
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java
deleted file mode 100644
index 9845c7f0b32..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-import java.util.Iterator;
-
-public interface LogSource extends Iterable<LogEntry> {
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException;
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException;
-
-    public LogIterator iterator() throws IllegalArgumentException;
-
-    public boolean overlapsRange(long starttime, long endtime);
-
-    public long size();
-    public long getStartTime();
-    public long getEndTime();
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java
deleted file mode 100644
index a42354cb3fb..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java
+++ /dev/null
@@ -1,104 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.IOException;
-import java.io.BufferedOutputStream;
-import java.io.FileOutputStream;
-import java.io.DataOutputStream;
-import java.io.PrintStream;
-
-import java.util.HashSet;
-import java.util.Set;
-
-public class MeasureThroughput {
-    private static final int MS_PER_SEC = 1000;
-    private static final int MS_PER_MIN = MS_PER_SEC*60;
-    private static final int MS_PER_HOUR = MS_PER_MIN*60;
-    
-    public static void main(String[] args) throws IOException {	
-	MergedLogSource source = new MergedLogSource(args);
-
-	PrintStream ps_ms = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-ms.out")));
-	PrintStream ps_sec = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-sec.out")));
-	PrintStream ps_min = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-min.out")));
-	PrintStream ps_hour = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-hour.out")));
-	LogIterator iter;
-	
-	System.out.println(source);
-	iter = source.iterator();
-	long currentms = 0;
-	long currentsec = 0;
-	long currentmin = 0;
-	long currenthour = 0;
-	Set<Long> zxids_ms = new HashSet<Long>();
-	long zxid_sec = 0;
-	long zxid_min = 0;
-	long zxid_hour = 0;
-
-	while (iter.hasNext()) {
-	    LogEntry e = iter.next();
-	    TransactionEntry cxn = (TransactionEntry)e;
-	    
-	    long ms = cxn.getTimestamp();
-	    long sec = ms/MS_PER_SEC;
-	    long min = ms/MS_PER_MIN;
-	    long hour = ms/MS_PER_HOUR;
-
-	    if (currentms != ms && currentms != 0) {
-		ps_ms.println("" + currentms + " " + zxids_ms.size());
-
-		zxid_sec += zxids_ms.size();
-		zxid_min += zxids_ms.size();
-		zxid_hour += zxids_ms.size();
-		zxids_ms.clear();
-	    }
-
-	    if (currentsec != sec && currentsec != 0) {
-		ps_sec.println("" + currentsec*MS_PER_SEC + " " + zxid_sec);
-
-		zxid_sec = 0;
-	    }
-
-	    if (currentmin != min && currentmin != 0) {
-		ps_min.println("" + currentmin*MS_PER_MIN + " " + zxid_min);
-		
-		zxid_min = 0;
-	    }
-
-	    if (currenthour != hour && currenthour != 0) {
-		ps_hour.println("" + currenthour*MS_PER_HOUR + " " + zxid_hour);
-		
-		zxid_hour = 0;
-	    }
-
-	    currentms = ms;
-	    currentsec = sec;
-	    currentmin = min;
-	    currenthour = hour;
-
-	    zxids_ms.add(cxn.getZxid());
-	}
-
-	iter.close();
-	ps_ms.close();
-	ps_sec.close();
-	ps_min.close();
-	ps_hour.close();
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
deleted file mode 100644
index ba405ae86ce..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
+++ /dev/null
@@ -1,189 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class MergedLogSource implements LogSource {
-    private static final Logger LOG = LoggerFactory.getLogger(MergedLogSource.class);
-    protected List<LogSource> sources = new ArrayList<>();
-    private long starttime = 0;
-    private long endtime = 0;
-    private long size = 0;
-
-    public boolean overlapsRange(long starttime, long endtime) {
-	return (starttime <= this.endtime && endtime >= this.starttime);
-    }
-    
-    public long size() { return size; }
-    public long getStartTime() { return starttime; }
-    public long getEndTime() { return endtime; }
-
-    private class MergedLogSourceIterator implements LogIterator {
-		private LogEntry next = null;
-		private long start = 0;
-		private long end = 0;
-		private MergedLogSource src = null;
-		private LogIterator[] sources = null;
-		private LogEntry[] nexts = null;
-		private FilterOp filter = null;
-
-		public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-			List<LogIterator> iters = new ArrayList<>();
-			for (LogSource s : src.sources) {
-			if (s.overlapsRange(starttime, endtime)) {
-				iters.add(s.iterator(starttime, endtime, filter));
-			}
-			}
-
-			sources = new LogIterator[iters.size()];
-			sources = iters.toArray(sources);
-			nexts = new LogEntry[iters.size()];
-			for (int i = 0; i < sources.length; i++) {
-			if (sources[i].hasNext())
-				nexts[i] = sources[i].next();
-			}
-			this.filter = filter;
-		}
-
-		public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-			this(src, starttime, endtime, null);
-		}
-
-		public long size() throws IOException {
-			long size = 0;
-			for (LogIterator i : sources) {
-			size += i.size();
-			}
-			return size;
-		}
-
-		public boolean hasNext() {
-			for (LogEntry n : nexts) {
-			if (n != null) return true;
-			}
-			return false;
-		}
-
-		public LogEntry next() {
-			int min = -1;
-			for (int i = 0; i < nexts.length; i++) {
-			if (nexts[i] != null) {
-				if (min == -1) {
-				min = i;
-				} else if (nexts[i].getTimestamp() < nexts[min].getTimestamp()) {
-				min = i;
-				}
-			}
-			}
-			if (min == -1) {
-			return null;
-			} else {
-			LogEntry e =  nexts[min];
-			nexts[min] = sources[min].next();
-			return e;
-			}
-		}
-
-		public void remove() throws UnsupportedOperationException {
-			throw new UnsupportedOperationException("remove not supported for Merged logs");
-		}
-
-		public void close() throws IOException {
-			for (LogIterator i : sources) {
-			i.close();
-			}
-		}
-    }
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-		try {
-	    	return iterator(starttime, endtime, null);
-		}
-		catch (FilterException fe) {
-	    	assert(false); // shouldn't happen without filter
-	    	return null;
-		}
-    }
-
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-		// sanitise start and end times
-		if (endtime < starttime) {
-			throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-		}
-
-		return new MergedLogSourceIterator(this, starttime, endtime, filter);
-	}
-
-	public LogIterator iterator() throws IllegalArgumentException {
-		return iterator(starttime, endtime+1);
-	}
-
-	public MergedLogSource(String[] files) throws IOException {
-		sources.clear();
-		for (String f : files) {
-			addSource(f);
-		}
-    }
-    
-    public void addSource(String f) throws IOException {
-		LogSource s = null;
-		if (TxnLogSource.isTransactionFile(f)) {
-			s = new TxnLogSource(f);
-		}
-		else {
-			s = new Log4JSource(f);
-		}
-
-		size += s.size();
-		endtime = s.getEndTime() > endtime ? s.getEndTime() : endtime;
-		starttime = s.getStartTime() < starttime || starttime == 0 ? s.getStartTime() : starttime;
-		sources.add(s);
-    }
-
-    public String toString() {
-		String s = "MergedLogSource(size=" + size + ", start=" + starttime + ", end=" + endtime +")";
-		for (LogSource src : sources) {
-			s += "\n\t- " +src;
-		}
-		return s;
-    }
-
-    public static void main(String[] args) throws IOException {
-		System.out.println("Time: " + System.currentTimeMillis());
-		MergedLogSource s = new MergedLogSource(args);
-		System.out.println(s);
-
-		LogIterator iter;
-
-		iter = s.iterator();
-		System.out.println("Time: " + System.currentTimeMillis());
-		System.out.println("Iterator Size: " + iter.size());
-		System.out.println("Time: " + System.currentTimeMillis());
-		/*	while (iter.hasNext()) {
-			System.out.println(iter.next());
-			}*/
-		iter.close();
-		System.out.println("Time: " + System.currentTimeMillis());
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java
deleted file mode 100644
index 13a41a5ae3a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java
+++ /dev/null
@@ -1,329 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.File;
-import java.io.Reader;
-import java.io.IOException;
-import java.io.EOFException;
-import java.io.RandomAccessFile;
-import java.io.FileNotFoundException;
-
-import java.io.DataInputStream;
-import java.io.ByteArrayInputStream;
-import java.io.DataInput;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class RandomAccessFileReader extends Reader implements DataInput {
-    private static final Logger LOG = LoggerFactory.getLogger(RandomAccessFileReader.class);
-    private RandomAccessFile file;
-    private byte[] buffer;
-    private int buffersize;
-    private int bufferoffset;
-    private long fileoffset;
-    private long fp;
-
-    private static final int DEFAULT_BUFFER_SIZE = 512*1024; // 512k
-    private int point = 0;
-
-    public RandomAccessFileReader(File f) throws FileNotFoundException {
-	file = new RandomAccessFile(f, "r");
-	if (LOG.isDebugEnabled()) {
-	    try {
-		LOG.debug("Opened file(" + f + ") with FD (" + file.getFD() + ")");
-	    } catch (IOException ioe) { 
-		LOG.debug("Opened file(" + f + ") coulds get FD");
-	    }
-	}
-
-	buffer = new byte[DEFAULT_BUFFER_SIZE];
-	buffersize = 0;
-	bufferoffset = 0;
-	fileoffset = 0;
-	fp = 0;
-    }
-
-    /**
-       fill the buffer from the file.
-       fp keeps track of the file pointer.
-       fileoffset is the offset into the file to where the buffer came from.
-    */
-    private int fill() throws IOException {
-	fileoffset = fp;
-	int read = file.read(buffer, 0, buffer.length);
-
-	if (LOG.isDebugEnabled()) {
-	    String buf = new String(buffer, 0, 40, "UTF-8");
-	    LOG.debug("fill(buffer=" + buf + ")");
-	}
-
-	if (read == -1) { // eof reached
-	    buffersize = 0;
-	} else {
-	    buffersize = read;
-	}
-	fp += buffersize;
-	bufferoffset = 0;
-
-	return buffersize;
-    }
-
-    /**
-     * Reader interface 
-     */
-    public boolean markSupported() { return false; }
-
-    /**
-       copy what we can from buffer. if it's not enough, fill buffer again and copy again
-    */
-    synchronized public int read(char[] cbuf, int off, int len) throws IOException {
-	// This could be faster, but probably wont be used
-	byte[] b = new byte[2];
-	int bytesread = 0;
-	while (len > 0) {
-	    int read = read(b, 0, 2);
-	    bytesread += read;
-	    if (read < 2) {
-		return bytesread;
-	    }
-	    cbuf[off] = (char)((b[0] << 8) | (b[1] & 0xff));
-	    off += read;
-	    len -= read;
-	}
-
-	return bytesread;
-    }
-
-    synchronized public int read(byte[] buf, int off, int len) throws IOException {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("read(buf, off=" + off + ", len=" + len);
-	}
-
-	int read = 0;
-	while (len > 0) {
-	    if (buffersize == 0) {
-		fill();
-		if (buffersize == 0) {
-		    break;
-		}
-	    }
-
-	    int tocopy = Math.min(len, buffersize);
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("tocopy=" + tocopy);
-	    }
-
-	    System.arraycopy(buffer, bufferoffset, buf, off, tocopy);
-	    buffersize -= tocopy;
-	    bufferoffset += tocopy;
-
-	    len -= tocopy;
-	    read += tocopy;
-	    off += tocopy;
-	}
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("read=" + read);
-	}
-
-	return read;
-    }
-
-    public void close() throws IOException {
-	file.close();
-    }
-
-    /**
-     * Seek interface 
-     */
-    public long getPosition() {
-	return bufferoffset + fileoffset;
-    }
-    
-    synchronized public void seek(long pos) throws IOException {
-	if (LOG.isDebugEnabled()) {
-	    LOG.debug("seek(" + pos + ")");
-	}
-	file.seek(pos);
-	fp = pos;
-	buffersize = 0; // force a buffer fill on next read
-    }
-
-    /**
-       works like the usual readLine but disregards \r to make things easier
-    */
-    synchronized public String readLine() throws IOException {
-	StringBuffer s = null;
-	
-	// go through buffer until i find a \n, if i reach end of buffer first, put whats in buffer into string buffer,
-	// repeat
-	buffering:
-	for (;;) {
-	    if (buffersize == 0) {
-		fill();
-		if (buffersize == 0) {
-		    break;
-		}
-	    }
-
-	    for (int i = 0; i < buffersize; i++) {
-		if (buffer[bufferoffset + i] == '\n') { 
-		    if (i > 0) { // if \n is first char in buffer, leave the string buffer empty
-			if (s == null) { s = new StringBuffer(); }
-			s.append(new String(buffer, bufferoffset, i, "UTF-8"));
-		    }
-		    bufferoffset += i+1;
-		    buffersize -= i+1; 
-		    break buffering;
-		}
-	    }
-
-	    // We didn't find \n, read the whole buffer into string buffer
-	    if (s == null) { s = new StringBuffer(); }
-	    s.append(new String(buffer, bufferoffset, buffersize, "UTF-8"));
-	    buffersize = 0; 
-	}
-
-	if (s == null) {
-	    return null;
-	} else {
-	    return s.toString();
-	}	    
-    }
-
-    /**
-       DataInput interface
-    */
-    public void readFully(byte[] b) throws IOException {
-	readFully(b, 0, b.length);
-    }
-
-    public void readFully(byte[] b, int off, int len) throws IOException
-    {
-	while (len > 0) {
-	    int read = read(b, off, len);
-	    len -= read;
-	    off += read;
-
-	    if (read == 0) {
-		throw new EOFException("End of file reached");
-	    }	    
-	}
-    }
-
-    public int skipBytes(int n) throws IOException {
-	seek(getPosition() + n);
-	return n;
-    }
-
-    public boolean readBoolean() throws IOException {
-	return (readByte() != 0);	    
-    }
-
-    public byte readByte() throws IOException {
-	byte[] b = new byte[1];
-	readFully(b, 0, 1);
-	return b[0];
-    }
-
-    public int readUnsignedByte() throws IOException {
-	return (int)readByte();
-    }
-
-    public short readShort() throws IOException {
-	byte[] b = new byte[2];
-	readFully(b, 0, 2);
-	return (short)((b[0] << 8) | (b[1] & 0xff));
-    }
-    
-    public int readUnsignedShort() throws IOException {
-	byte[] b = new byte[2];
-	readFully(b, 0, 2);
-	return (((b[0] & 0xff) << 8) | (b[1] & 0xff));
-    }
-
-    public char readChar() throws IOException {
-	return (char)readShort();
-    }
-
-    public int readInt() throws IOException {
-	byte[] b = new byte[4];
-	readFully(b, 0, 4);
-	return (((b[0] & 0xff) << 24) | ((b[1] & 0xff) << 16) |  ((b[2] & 0xff) << 8) | (b[3] & 0xff));
-    }
-
-    public long readLong() throws IOException {
-	byte[] b = new byte[8];
-	readFully(b, 0, 8);
-	
-	return (((long)(b[0] & 0xff) << 56) |  ((long)(b[1] & 0xff) << 48) |
-		((long)(b[2] & 0xff) << 40) |  ((long)(b[3] & 0xff) << 32) |
-		((long)(b[4] & 0xff) << 24) |  ((long)(b[5] & 0xff) << 16) |
-		((long)(b[6] & 0xff) <<  8) |  ((long)(b[7] & 0xff)));
-    }
-
-    public float readFloat() throws IOException {
-	return Float.intBitsToFloat(readInt());
-    }
-
-    public double readDouble() throws IOException {
-	return Double.longBitsToDouble(readLong());
-    }
-
-    public String readUTF() throws IOException {
-	int len = readUnsignedShort();
-	byte[] bytes = new byte[len+2];
-	bytes[0] = (byte)((len >> 8) & 0xFF);
-	bytes[1] = (byte)(len & 0xFF);
-	readFully(bytes, 2, len);
-	DataInputStream dis = new DataInputStream(new ByteArrayInputStream(bytes));
-	return dis.readUTF();
-    }
-
-    public static void main(String[] args) throws IOException {
-	RandomAccessFileReader f = new RandomAccessFileReader(new File(args[0]));
-	
-	long pos0 = f.getPosition();
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	System.out.println("=============");
-	long pos1 = f.getPosition();
-	System.out.println("pos: " + pos1);
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	System.out.println("=============");
-	f.seek(pos1);
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	System.out.println("=============");
-	f.seek(pos0);
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	long pos2 = f.getPosition();
-	System.out.println("=============");
-	System.out.println(f.readLine());
-	f.seek(pos2);
-	System.out.println(f.readLine());
-	f.close();
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java
deleted file mode 100644
index 33c7189c172..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-public class TransactionEntry extends LogEntry {
-    public TransactionEntry(long timestamp, long clientId, long Cxid, long Zxid, String op) {
-	this(timestamp, clientId, Cxid, Zxid, op, "");
-    }
-
-    public TransactionEntry(long timestamp, long clientId, long Cxid, long Zxid, String op, String extra) {
-	super(timestamp);
-	setAttribute("client-id", new Long(clientId));
-	setAttribute("cxid", new Long(Cxid));
-	setAttribute("zxid", new Long(Zxid));
-	setAttribute("operation", op);
-	setAttribute("extra", extra);
-    }
-
-    public long getClientId() {
-	return (Long)getAttribute("client-id");
-    }
-
-    public long getCxid() {
-	return (Long)getAttribute("cxid");
-    }
-
-    public long getZxid() {
-	return (Long)getAttribute("zxid");
-    }
-
-    public String getOp() {
-	return (String)getAttribute("operation");
-    }
-
-    public String getExtra() {
-	return (String)getAttribute("extra");
-    }
-
-    public String toString() {
-	return getTimestamp() + ":::session(0x" + Long.toHexString(getClientId()) + ") cxid(0x" + Long.toHexString(getCxid()) + ") zxid(0x" + Long.toHexString(getZxid()) + ") op(" + getOp() + ") extra(" + getExtra() +")";
-    }
-
-    public Type getType() { return LogEntry.Type.TXN; }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java
deleted file mode 100644
index ad2e2589376..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java
+++ /dev/null
@@ -1,380 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.ByteArrayInputStream;
-import java.io.EOFException;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.text.DateFormat;
-import java.util.Date;
-import java.util.zip.Adler32;
-import java.util.zip.Checksum;
-import java.util.HashMap;
-
-import org.apache.jute.BinaryInputArchive;
-import org.apache.jute.InputArchive;
-import org.apache.jute.Record;
-import org.apache.zookeeper.server.TraceFormatter;
-import org.apache.zookeeper.server.TxnLogEntry;
-import org.apache.zookeeper.server.persistence.FileHeader;
-import org.apache.zookeeper.server.persistence.FileTxnLog;
-import org.apache.zookeeper.server.util.SerializeUtils;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import org.apache.zookeeper.ZooDefs.OpCode;
-
-import org.apache.zookeeper.txn.CreateSessionTxn;
-import org.apache.zookeeper.txn.CreateTxn;
-import org.apache.zookeeper.txn.DeleteTxn;
-import org.apache.zookeeper.txn.ErrorTxn;
-import org.apache.zookeeper.txn.SetACLTxn;
-import org.apache.zookeeper.txn.SetDataTxn;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import java.io.File;
-import java.io.Closeable;
-import java.io.FileNotFoundException;
-import java.util.Iterator;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class TxnLogSource implements LogSource {
-    private static final Logger LOG = LoggerFactory.getLogger(TxnLogSource.class);
-
-    private LogSkipList skiplist = null;
-    private static final int skipN = 10000;
-
-    private String file = null;
-    private long starttime = 0;
-    private long endtime = 0;
-    private long size = 0;
-
-    public boolean overlapsRange(long starttime, long endtime) {
-	return (starttime <= this.endtime && endtime >= this.starttime);
-    }
-
-    public long size() { return size; }
-    public long getStartTime() { return starttime; }
-    public long getEndTime() { return endtime; }
-    public LogSkipList getSkipList() { return skiplist; }
-
-    public static boolean isTransactionFile(String file) throws IOException {
-        RandomAccessFileReader reader = new RandomAccessFileReader(new File(file));
-        BinaryInputArchive logStream = new BinaryInputArchive(reader);
-        FileHeader fhdr = new FileHeader();
-        fhdr.deserialize(logStream, "fileheader");
-	reader.close();
-
-        return fhdr.getMagic() == FileTxnLog.TXNLOG_MAGIC;
-    }
-
-    private class TxnLogSourceIterator implements LogIterator {
-	private LogEntry next = null;
-	private long starttime = 0;
-	private long endtime = 0;
-	private TxnLogSource src = null;
-	private RandomAccessFileReader reader = null;
-	private BinaryInputArchive logStream = null;
-	private long skippedAtStart = 0;
-	private FilterOp filter = null;
-
-	public TxnLogSourceIterator(TxnLogSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-	    this(src,starttime,endtime,null);
-	}
-	
-	public TxnLogSourceIterator(TxnLogSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	    try {
-		this.src = src;
-		this.starttime = starttime;
-		this.endtime = endtime;
-		reader = new RandomAccessFileReader(new File(src.file));
-		logStream = new BinaryInputArchive(reader);
-		FileHeader fhdr = new FileHeader();
-		fhdr.deserialize(logStream, "fileheader");
-	    } catch (Exception e) {
-		throw new IllegalArgumentException("Cannot open transaction log ("+src.file+") :" + e);
-	    }
-	    
-	    LogSkipList.Mark start = src.getSkipList().findMarkBefore(starttime);
-	    try {
-		reader.seek(start.getBytes());
-		skippedAtStart = start.getEntriesSkipped();
-	    } catch (IOException ioe) {
-		// if we can't skip, we should just read from the start
-	    }
-
-	    this.filter = filter;
-
-	    LogEntry e;
-	    while ((e = readNextEntry()) != null && e.getTimestamp() < endtime) {
-		if (e.getTimestamp() >= starttime && (filter == null || filter.matches(e))  ) {
-		    next = e;
-		    return;
-		}
-		skippedAtStart++;
-	    }
-
-
-	}
-	
-	public long size() throws IOException {
-	    if (this.endtime >= src.getEndTime()) {
-		return src.size() - skippedAtStart;
-	    }
-	    
-	    long pos = reader.getPosition();
-	    LogEntry e;
-
-	    LogSkipList.Mark lastseg = src.getSkipList().findMarkBefore(this.endtime);
-	    reader.seek(lastseg.getBytes());
-	    // number of entries skipped to get to the end of the iterator, less the number skipped to get to the start
-	    long count = lastseg.getEntriesSkipped() - skippedAtStart; 
-
-	    while ((e = readNextEntry()) != null) {
-		if (e.getTimestamp() > this.endtime) {
-		    break;
-		}
-		count++;
-	    }
-	    reader.seek(pos);;
-
-	    return count;
-	}
-	
-	private LogEntry readNextEntry() {
-	    LogEntry e = null;
-	    try {
-		long crcValue;
-		byte[] bytes;
-		try {
-		    crcValue = logStream.readLong("crcvalue");
-		    
-		    bytes = logStream.readBuffer("txnEntry");
-		} catch (EOFException ex) {
-		    return null;
-		}
-		
-		if (bytes.length == 0) {
-		    return null;
-		}
-		Checksum crc = new Adler32();
-		crc.update(bytes, 0, bytes.length);
-		if (crcValue != crc.getValue()) {
-		    throw new IOException("CRC doesn't match " + crcValue +
-					  " vs " + crc.getValue());
-		}
-    
-		TxnLogEntry logEntry = SerializeUtils.deserializeTxn(bytes);
-		TxnHeader hdr = logEntry.getHeader();
-		Record r = logEntry.getTxn();
-
-		switch (hdr.getType()) {
-		case OpCode.createSession: {
-		    e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "createSession");
-		}
-		    break;
-		case OpCode.closeSession: {
-		    e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "closeSession");
-		}
-		    break;
-		case OpCode.create:
-		    if (r != null) {
-			CreateTxn create = (CreateTxn)r;
-			String path = create.getPath();
-			e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "create", path);
-		    }
-		    break;
-		case OpCode.setData:
-		    if (r != null) {
-			SetDataTxn set = (SetDataTxn)r;
-			String path = set.getPath();
-			e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "setData", path);
-		    }
-		    break;
-		case OpCode.setACL:
-		    if (r != null) {
-			SetACLTxn setacl = (SetACLTxn)r;
-			String path = setacl.getPath();
-		    e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "setACL", path);
-		    }
-		    break;
-		case OpCode.error:
-		    if (r != null)  {
-			ErrorTxn error = (ErrorTxn)r;
-			
-			e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "error", "Error: " + error.getErr());
-		    }
-		    break;
-		default:
-		    LOG.info("Unknown op: " + hdr.getType());
-		    break;
-		}
-		
-		if (logStream.readByte("EOR") != 'B') {
-		    throw new EOFException("Last transaction was partial.");
-		}
-	    } catch (Exception ex) {
-		LOG.error("Error reading transaction from (" + src.file + ") :" + e);
-		return null;
-	    }
-	    return e;
-	}
-
-	public boolean hasNext() {
-	    return next != null;
-	}
-	
-	public LogEntry next() throws NoSuchElementException {
-	    LogEntry ret = next;
-	    LogEntry e = readNextEntry();
-
-	    if (filter != null) {
-		try {
-		    while (e != null && !filter.matches(e)) {
-			e = readNextEntry();
-		    }
-		} catch (FilterException fe) {
-		    throw new NoSuchElementException(fe.toString());
-		}
-	    }
-	    if (e != null && e.getTimestamp() < endtime) {
-		next = e;
-	    } else {
-		next = null;
-	    }
-	    return ret;
-	}
-
-	public void remove() throws UnsupportedOperationException {
-	    throw new UnsupportedOperationException("remove not supported for Txn logs");
-	}
-	
-	public void close() throws IOException {
-	    reader.close();
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-	try {
-	    return iterator(starttime, endtime, null);
-	} catch (FilterException fe) {
-	    assert(false); // should never ever happen
-	    return null;
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	// sanitise start and end times
-	if (endtime < starttime) {
-	    throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-	}
-
-	return new TxnLogSourceIterator(this, starttime, endtime, filter);
-    }
-
-    public LogIterator iterator() throws IllegalArgumentException {
-	return iterator(starttime, endtime+1);
-    }
-    
-    public TxnLogSource(String file) throws IOException {
-	this.file = file;
-
-	skiplist = new LogSkipList();
-
-	RandomAccessFileReader reader = new RandomAccessFileReader(new File(file));
-	try {
-	    BinaryInputArchive logStream = new BinaryInputArchive(reader);
-	    FileHeader fhdr = new FileHeader();
-	    fhdr.deserialize(logStream, "fileheader");
-	    
-	    byte[] bytes = null;
-	    while (true) {
-		long lastFp = reader.getPosition();
-
-		long crcValue;
-
-		try {
-		    crcValue = logStream.readLong("crcvalue");
-		    bytes = logStream.readBuffer("txnEntry");
-		} catch (EOFException e) {
-		    break;
-		}
-		
-		if (bytes.length == 0) {
-		    break;
-		}
-		Checksum crc = new Adler32();
-		crc.update(bytes, 0, bytes.length);
-		if (crcValue != crc.getValue()) {
-		    throw new IOException("CRC doesn't match " + crcValue +
-					  " vs " + crc.getValue());
-		}
-		if (logStream.readByte("EOR") != 'B') {
-		    throw new EOFException("Last transaction was partial.");
-		}
-		TxnLogEntry logEntry = SerializeUtils.deserializeTxn(bytes);
-		TxnHeader hdr = logEntry.getHeader();
-		Record r = logEntry.getTxn();
-		
-		if (starttime == 0) {
-		    starttime = hdr.getTime();
-		}
-		endtime = hdr.getTime();
-
-		if (size % skipN == 0) {
-		    skiplist.addMark(hdr.getTime(), lastFp, size);
-		}
-		size++;
-	    }
-	    if (bytes == null) {
-		throw new IOException("Nothing read from ("+file+")");
-	    }
-	} finally {
-	    reader.close();
-	}
-    }
-
-    public String toString() {
-	return "TxnLogSource(file=" + file + ", size=" + size + ", start=" + starttime + ", end=" + endtime +")";
-    }
-
-    public static void main(String[] args) throws IOException, FilterException {
-	TxnLogSource s = new TxnLogSource(args[0]);
-	System.out.println(s);
-
-	LogIterator iter;
-
-	if (args.length == 3) {
-	    long starttime = Long.valueOf(args[1]);
-	    long endtime = Long.valueOf(args[2]);
-	    FilterOp fo = new FilterParser("(or (and (> zxid 0x2f0bd6f5e0) (< zxid 0x2f0bd6f5e9)) (= operation \"error\"))").parse();
-	    System.out.println("fo: " + fo);
-	    iter = s.iterator(starttime, endtime, fo);
-	} else {
-	    iter = s.iterator();
-	}
-	System.out.println(iter);
-	while (iter.hasNext()) {
-	    	    System.out.println(iter.next());
-	}
-	iter.close();
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java
deleted file mode 100644
index 581bdaacc0a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class AndOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	for (FilterOp f : subOps) {
-	    if (!f.matches(entry)) {
-		return false;
-	    }
-	}
-	return true;
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java
deleted file mode 100644
index 4fda3cf7d66..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.FilterOp.*;
-
-public class Arg<T> {
-    private ArgType type;
-    protected T value;
-    
-    protected Arg(ArgType type) {
-	this.type = type;
-    }
-    
-    public ArgType getType() { return type; }
-    public T getValue() { return value; }
-
-    public String toString() {
-	return "[" + type + ":" + value + "]";
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java
deleted file mode 100644
index 409815af212..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class EqualsOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-
-	Object last = null;
-	for (Arg a : args) {
-	    Object v = a.getValue();
-	    if (a.getType() == FilterOp.ArgType.SYMBOL) {
-		String key = (String)a.getValue();
-		v = entry.getAttribute(key);
-	    }
-
-	    if (last != null
-		&& !last.equals(v)) {
-		return false;
-	    }
-	    last = v;
-	}
-
-	return true;
-    }
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java
deleted file mode 100644
index 244dd3dabdb..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class GreaterThanOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	Arg first = args.get(0);
-	
-	if (first != null) {
-	    FilterOp.ArgType type = first.getType();
-	    if (type == FilterOp.ArgType.SYMBOL) {
-		String key = (String)first.getValue();
-		Object v = entry.getAttribute(key);
-		if (v instanceof String) {
-		    type = FilterOp.ArgType.STRING;
-		} else if (v instanceof Double || v instanceof Long || v instanceof Integer || v instanceof Short) {
-		    type = FilterOp.ArgType.NUMBER;
-		} else {
-		    throw new FilterException("LessThanOp: Invalid argument, first argument resolves to neither a String nor a Number");
-		}
-	    }
-	    
-	    Object last = null;
-	    for (Arg a : args) {
-		Object v = a.getValue();
-		if (a.getType() == FilterOp.ArgType.SYMBOL) {
-		    String key = (String)a.getValue();
-		    v = entry.getAttribute(key);
-		}
-
-		if (last != null) {
-		    if (type == FilterOp.ArgType.STRING) {
-			if (((String)last).compareTo((String)v) <= 0) {
-			    return false;
-			}
-		    } else if (type == FilterOp.ArgType.NUMBER) {
-			//			System.out.println("last[" + ((Number)last).longValue() + "] v["+ ((Number)v).longValue() + "]");
-			if (((Number)last).longValue() <= ((Number)v).longValue()) {
-			    return false;
-			}
-		    }
-		}
-		last = v;
-	    }
-	    return true;
-	} else { 
-	    return true; 
-	}
-    }
-	
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java
deleted file mode 100644
index b7d9e09ac89..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class LessThanOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	Arg first = args.get(0);
-	
-	if (first != null) {
-	    FilterOp.ArgType type = first.getType();
-	    if (type == FilterOp.ArgType.SYMBOL) {
-		String key = (String)first.getValue();
-		Object v = entry.getAttribute(key);
-		if (v instanceof String) {
-		    type = FilterOp.ArgType.STRING;
-		} else if (v instanceof Double || v instanceof Long || v instanceof Integer || v instanceof Short) {
-		    type = FilterOp.ArgType.NUMBER;
-		} else {
-		    throw new FilterException("LessThanOp: Invalid argument, first argument resolves to neither a String nor a Number");
-		}
-	    }
-	    
-	    Object last = null;
-	    for (Arg a : args) {
-		Object v = a.getValue();
-		if (a.getType() == FilterOp.ArgType.SYMBOL) {
-		    String key = (String)a.getValue();
-		    v = entry.getAttribute(key);
-		}
-
-		if (last != null) {
-		    if (type == FilterOp.ArgType.STRING) {
-			if (((String)last).compareTo((String)v) >= 0) {
-			    return false;
-			}
-		    } else if (type == FilterOp.ArgType.NUMBER) {
-			if (((Number)last).doubleValue() >= ((Number)v).doubleValue()) {
-			    return false;
-			}
-		    }
-		}
-		last = v;
-	    }
-	    return true;
-	} else { 
-	    return true; 
-	}
-    }
-	
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java
deleted file mode 100644
index d8ed7573faf..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class NotOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	if (subOps.size() != 1) {
-	    throw new FilterException("Not operation can only take one argument");
-	}
-	return !subOps.get(0).matches(entry);
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java
deleted file mode 100644
index d6b584d855f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.FilterOp.*;
-
-public class NumberArg extends Arg<Long> {
-    public NumberArg(Long value) {
-	super(ArgType.NUMBER);
-	this.value = value;
-    }
-};
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java
deleted file mode 100644
index d6815894a9a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class OrOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	for (FilterOp f : subOps) {
-	    if (f.matches(entry)) {
-		return true;
-	    }
-	}
-	return false;
-    }
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java
deleted file mode 100644
index 7345d3cc09a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.FilterOp.*;
-
-public class StringArg extends Arg<String> {
-    public StringArg(String value) {
-	super(ArgType.STRING);
-	    this.value = value;
-    }
-};
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java
deleted file mode 100644
index 077553b1f05..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java
+++ /dev/null
@@ -1,27 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.FilterOp.*;
-
-public class SymbolArg extends Arg<String> {
-    public SymbolArg(String value) {
-	super(ArgType.SYMBOL);
-	this.value = value;
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java
deleted file mode 100644
index 9e778b199d5..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class XorOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	int count = 0;
-	for (FilterOp f : subOps) {
-	    if (f.matches(entry)) {
-		count++;
-		if (count > 1) {
-		    return false;
-		}
-	    }
-	}
-	if (count == 1) {
-	    return true;
-	}
-	return false;
-    }
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
deleted file mode 100644
index 8717239011d..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-
-import org.apache.zookeeper.graph.*;
-
-public class FileLoader extends JsonServlet
-{
-    private MergedLogSource source = null;
-    
-    public FileLoader(MergedLogSource src) throws Exception {
-		source = src;
-    }
-
-    String handleRequest(JsonRequest request) throws Exception {
-		String file = request.getString("path", "/");
-		ObjectMapper mapper = new ObjectMapper();
-		JsonNode rootNode = mapper.createObjectNode();
-		try {
-	    	this.source.addSource(file);
-			((ObjectNode) rootNode).put("status", "OK");
-		}
-		catch (Exception e) {
-			((ObjectNode) rootNode).put("status", "ERR");
-			((ObjectNode) rootNode).put("error", e.toString());
-		}
-		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(rootNode);
-		return jsonString;
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
deleted file mode 100644
index 1e0139e2ba5..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
+++ /dev/null
@@ -1,73 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.File;
-import java.io.FileNotFoundException;
-
-import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ArrayNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.Comparator;
-
-public class Fs extends JsonServlet
-{
-    String handleRequest(JsonRequest request) throws Exception {
-		File base = new File(request.getString("path", "/"));
-		if (!base.exists() || !base.isDirectory()) {
-			throw new FileNotFoundException("Couldn't find [" + request + "]");
-		}
-		File[] files = base.listFiles();
-		Arrays.sort(files, new Comparator<File>() {
-			public int compare(File o1, File o2) {
-				if (o1.isDirectory() != o2.isDirectory()) {
-				if (o1.isDirectory()) {
-					return -1;
-				} else {
-					return 1;
-				}
-				}
-				return o1.getName().compareToIgnoreCase(o2.getName());
-			}
-			});
-
-		String jsonString = generateJSON(files);
-		return jsonString;
-    }
-
-    protected static String generateJSON(File[] files) throws IOException {
-		ObjectMapper mapper = new ObjectMapper();
-		ArrayNode fileList = mapper.createArrayNode();
-
-		for (File f : files) {
-			JsonNode node = mapper.createObjectNode().objectNode();
-			((ObjectNode) node).put("file", f.getName());
-			((ObjectNode) node).put("type", f.isDirectory() ? "D" : "F");
-			((ObjectNode) node).put("path", f.getCanonicalPath());
-			fileList.add(node);
-		}
-
-		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(fileList);
-		return jsonString;
-	}
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
deleted file mode 100644
index 7fb313561d5..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import org.apache.zookeeper.graph.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class GraphData extends JsonServlet
-{
-    private static final Logger LOG = LoggerFactory.getLogger(GraphData.class);
-    private static final int DEFAULT_PERIOD = 1000;
-
-    private LogSource source = null;
-
-    public GraphData(LogSource src) throws Exception {
-	this.source = src; 
-    }
-
-    String handleRequest(JsonRequest request) throws Exception {
-	
-
-	long starttime = 0;
-	long endtime = 0;
-	long period = 0;
-	FilterOp fo = null;
-
-	starttime = request.getNumber("start", 0);
-	endtime = request.getNumber("end", 0);
-	period = request.getNumber("period", 0);
-	String filterstr = request.getString("filter", "");
-
-	if (filterstr.length() > 0) {
-	    fo = new FilterParser(filterstr).parse();
-	}
-	
-	if (starttime == 0) { starttime = source.getStartTime(); }
-	if (endtime == 0) { 
-	    if (period > 0) {
-		endtime = starttime + period;
-	    } else {
-		endtime = starttime + DEFAULT_PERIOD; 
-	    }
-	}
-
-	if (LOG.isDebugEnabled()) {
-	    LOG.debug("handle(start= " + starttime + ", end=" + endtime + ", period=" + period + ")");
-	}
-	
-	LogIterator iterator = (fo != null) ? 
-	    source.iterator(starttime, endtime, fo) : source.iterator(starttime, endtime);
-	return new JsonGenerator(iterator).toString();
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
deleted file mode 100644
index 4b3d63ce864..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import java.util.Map;
-
-abstract public class JsonServlet extends HttpServlet {
-    abstract String handleRequest(JsonRequest request) throws Exception;
-
-    protected class JsonRequest {
-		private Map map;
-
-		public JsonRequest(ServletRequest request) {
-			map = request.getParameterMap();
-		}
-
-		public long getNumber(String name, long defaultnum) {
-			String[] vals = (String[])map.get(name);
-			if (vals == null || vals.length == 0) {
-			return defaultnum;
-			}
-
-			try {
-				return Long.valueOf(vals[0]);
-			}
-			catch (NumberFormatException e) {
-				return defaultnum;
-			}
-		}
-
-		public String getString(String name, String defaultstr) {
-			String[] vals = (String[])map.get(name);
-			if (vals == null || vals.length == 0) {
-			return defaultstr;
-			}
-			else {
-				return vals[0];
-			}
-		}
-    }
-
-    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-        response.setContentType("text/plain;charset=utf-8");
-        response.setStatus(HttpServletResponse.SC_OK);
-
-		try {
-			String req = request.getRequestURI().substring(request.getServletPath().length());
-
-			response.getWriter().println(handleRequest(new JsonRequest(request)));
-		}
-		catch (Exception e) {
-			ObjectMapper mapper = new ObjectMapper();
-			JsonNode rootNode = mapper.createObjectNode();
-			((ObjectNode) rootNode).put("error", e.toString());
-			String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(rootNode);
-
-			response.getWriter().println(jsonString);
-		}
-		catch (java.lang.OutOfMemoryError oom) {
-			ObjectMapper mapper = new ObjectMapper();
-			JsonNode rootNode = mapper.createObjectNode();
-			((ObjectNode) rootNode).put("error", "Out of memory. Perhaps you've requested too many logs. Try narrowing you're filter criteria.");
-			String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(rootNode);
-
-			response.getWriter().println(jsonString);
-		}
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
deleted file mode 100644
index 564f11a18be..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import org.apache.zookeeper.graph.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class NumEvents extends JsonServlet
-{
-    private static final Logger LOG = LoggerFactory.getLogger(NumEvents.class);
-    private static final int DEFAULT_PERIOD = 1000;
-
-    private LogSource source = null;
-
-    public NumEvents(LogSource src) throws Exception {
-		this.source = src;
-    }
-
-    String handleRequest(JsonRequest request) throws Exception {
-		String output = "";
-
-		long starttime = 0;
-		long endtime = 0;
-		long period = 0;
-
-		starttime = request.getNumber("start", 0);
-		endtime = request.getNumber("end", 0);
-		period = request.getNumber("period", 0);
-
-		if (starttime == 0) { starttime = source.getStartTime(); }
-		if (endtime == 0) {
-	 	   if (period > 0) {
-				endtime = starttime + period;
-	 	   }
-	 	   else {
-				endtime = source.getEndTime();
-	 	   }
-		}
-
-		long size = 0;
-		LogIterator iter = source.iterator(starttime, endtime);
-		size = iter.size();
-
-		ObjectMapper mapper = new ObjectMapper();
-		JsonNode data = mapper.createObjectNode();
-		((ObjectNode) data).put("startTime", starttime);
-		((ObjectNode) data).put("endTime", endtime);
-		((ObjectNode) data).put("numEntries",  iter.size());
-
-		if (LOG.isDebugEnabled()) {
-		    LOG.debug("handle(start= " + starttime + ", end=" + endtime + ", numEntries=" + size +")");
-		}
-		iter.close();
-
-		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(data);
-		return jsonString;
-    }
-}
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java
deleted file mode 100644
index d91acb60096..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.BufferedReader;
-
-import java.io.IOException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-public class StaticContent extends HttpServlet {
-    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
-    {
-	String path = request.getRequestURI().substring(request.getServletPath().length());
-
-	InputStream resource = ClassLoader.getSystemResourceAsStream("org/apache/zookeeper/graph/resources" + path);	  
-	if (resource == null) {
-	    response.getWriter().println(path + " not found!");
-	    response.setStatus(HttpServletResponse.SC_NOT_FOUND);
-	    return;
-	}
-	try {
-	  while (resource.available() > 0) {
-	    response.getWriter().write(resource.read());
-	  }
-	} finally {
-	  resource.close();
-	}
-	//        response.setContentType("text/plain;charset=utf-8");
-        response.setStatus(HttpServletResponse.SC_OK);
-    }
-
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
deleted file mode 100644
index 022c68e0432..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.IOException;
-import java.util.HashSet;
-import java.util.Set;
-import com.fasterxml.jackson.core.util.MinimalPrettyPrinter;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ArrayNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import org.apache.zookeeper.graph.*;
-
-public class Throughput extends JsonServlet
-{
-    private static final int MS_PER_SEC = 1000;
-    private static final int MS_PER_MIN = MS_PER_SEC*60;
-    private static final int MS_PER_HOUR = MS_PER_MIN*60;
-
-    private LogSource source = null;
-
-    public Throughput(LogSource src) throws Exception {
-		this.source = src;
-    }
-
-    public String handleRequest(JsonRequest request) throws Exception {
-		long startTime = 0;
-		long endTime = 0;
-		long period = 0;
-		long scale = 0;
-
-		startTime = request.getNumber("start", 0);
-		endTime = request.getNumber("end", 0);
-		period = request.getNumber("period", 0);
-
-
-		if (startTime == 0) { startTime = source.getStartTime(); }
-		if (endTime == 0) {
-			if (period > 0) {
-			endTime = startTime + period;
-			} else {
-			endTime = source.getEndTime();
-			}
-		}
-
-		String scalestr = request.getString("scale", "minutes");
-		if (scalestr.equals("seconds")) {
-			scale = MS_PER_SEC;
-		} else if (scalestr.equals("hours")) {
-			scale = MS_PER_HOUR;
-		} else {
-			scale = MS_PER_MIN;
-		}
-
-		LogIterator iter = source.iterator(startTime, endTime);
-		String jsonString = getJSON(iter, scale);
-		iter.close();
-		return jsonString;
-	}
-
-	protected String getJSON(final LogIterator iter, final long scale) throws IOException {
-		long current = 0;
-		long currentms = 0;
-		Set<Long> zxids_ms = new HashSet<Long>();
-		long zxidCount = 0;
-
-		ObjectMapper mapper = new ObjectMapper();
-		ArrayNode events = mapper.createArrayNode();
-
-		while (iter.hasNext()) {
-			LogEntry e = iter.next();
-			if (e.getType() != LogEntry.Type.TXN) {
-			continue;
-			}
-
-			TransactionEntry cxn = (TransactionEntry)e;
-
-			long ms = cxn.getTimestamp();
-			long inscale = ms/ scale;
-
-			if (currentms != ms && currentms != 0) {
-				zxidCount += zxids_ms.size();
-				zxids_ms.clear();
-			}
-
-			if (inscale != current && current != 0) {
-				JsonNode node = mapper.createObjectNode();
-				((ObjectNode) node).put("time", current * scale);
-				((ObjectNode) node).put("count", zxidCount);
-				events.add(node);
-				zxidCount = 0;
-			}
-			current = inscale;
-			currentms = ms;
-
-			zxids_ms.add(cxn.getZxid());
-		}
-
-		JsonNode node = mapper.createObjectNode();
-		((ObjectNode) node).put("time", current * scale);
-		((ObjectNode) node).put("count", zxidCount);
-		events.add(node);
-
-		String jsonString = mapper.writer(new MinimalPrettyPrinter()).writeValueAsString(events);
-		return jsonString;
-	}
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
deleted file mode 100755
index de5b8770987..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
+++ /dev/null
@@ -1,48 +0,0 @@
-#! /usr/bin/env bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-make_canonical() {
-  cd "$1" && pwd
-}
-
-SCRIPTDIR=$(dirname "$0")
-BUILDDIR=$(make_canonical "$SCRIPTDIR"/../../../target/)
-LIBDIR=$(make_canonical "$BUILDDIR"/../lib)
-WEBDIR=$(make_canonical "$SCRIPTDIR"/../web)
-
-if [[ ! -x $BUILDDIR ]]; then
-  echo
-  echo
-  echo "*** You need to build loggraph before running it ***"
-  echo
-  echo
-  exit
-fi
-
-for i in "$LIBDIR"/*; do
-  CLASSPATH=$i:$CLASSPATH
-done
-
-CLASSPATH=$BUILDDIR/classes:$WEBDIR:$CLASSPATH
-export CLASSPATH
-
-java -Dlogback.configurationFile=org/apache/zookeeper/graph/logback.xml \
-  -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n \
-  org.apache.zookeeper.graph.LogServer "$@"
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
deleted file mode 100755
index 868fb7cc30e..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#! /usr/bin/env bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-make_canonical() {
-  cd "$1" && pwd
-}
-
-SCRIPTDIR=$(dirname "$0")
-BUILDDIR=$(make_canonical "$SCRIPTDIR"/../../../target/)
-LIBDIR=$(make_canonical "$BUILDDIR"/../lib)
-
-if [[ ! -x $BUILDDIR ]]; then
-  echo
-  echo
-  echo "*** You need to build loggraph before running it ***"
-  echo
-  echo
-  exit
-fi
-
-for i in "$LIBDIR"/* "$BUILDDIR"/*.jar; do
-  CLASSPATH=$i:$CLASSPATH
-done
-export CLASSPATH
-
-java org.apache.zookeeper.graph.LogServer "$@"
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml
deleted file mode 100644
index b28b897dc04..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/logback.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<!--
- Copyright 2022 The Apache Software Foundation
-
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements.  See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership.  The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License.  You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-
- Define some default values that can be overridden by system properties
--->
-<configuration>
-  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
-    <encoder>
-      <pattern>%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n</pattern>
-    </encoder>
-    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
-      <level>TRACE</level>
-    </filter>
-  </appender>
-
-  <logger name="org.apache.zookeeper.graph.LogSkipList" level="off"/>
-  <logger name="org.apache.zookeeper.graph.RandomAccessFileReader" level="off"/>
-
-  <root level="TRACE">
-    <appender-ref ref="CONSOLE"/>
-  </root>
-</configuration>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
deleted file mode 100644
index 55150099217..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Date Format 1.2.3
- * (c) 2007-2009 Steven Levithan <stevenlevithan.com>
- * MIT license
- *
- * Includes enhancements by Scott Trenda <scott.trenda.net>
- * and Kris Kowal <cixar.com/~kris.kowal/>
- *
- * Accepts a date, a mask, or a date and a mask.
- * Returns a formatted version of the given date.
- * The date defaults to the current date/time.
- * The mask defaults to dateFormat.masks.default.
- */
-
-var dateFormat = function () {
-	var	token = /d{1,4}|m{1,4}|yy(?:yy)?|([HhMsTt])\1?|[LloSZ]|"[^"]*"|'[^']*'/g,
-		timezone = /\b(?:[PMCEA][SDP]T|(?:Pacific|Mountain|Central|Eastern|Atlantic) (?:Standard|Daylight|Prevailing) Time|(?:GMT|UTC)(?:[-+]\d{4})?)\b/g,
-		timezoneClip = /[^-+\dA-Z]/g,
-		pad = function (val, len) {
-			val = String(val);
-			len = len || 2;
-			while (val.length < len) val = "0" + val;
-			return val;
-		};
-
-	// Regexes and supporting functions are cached through closure
-	return function (date, mask, utc) {
-		var dF = dateFormat;
-
-		// You can't provide utc if you skip other args (use the "UTC:" mask prefix)
-		if (arguments.length == 1 && Object.prototype.toString.call(date) == "[object String]" && !/\d/.test(date)) {
-			mask = date;
-			date = undefined;
-		}
-
-		// Passing date through Date applies Date.parse, if necessary
-		date = date ? new Date(date) : new Date;
-		if (isNaN(date)) throw SyntaxError("invalid date");
-
-		mask = String(dF.masks[mask] || mask || dF.masks["default"]);
-
-		// Allow setting the utc argument via the mask
-		if (mask.slice(0, 4) == "UTC:") {
-			mask = mask.slice(4);
-			utc = true;
-		}
-
-		var	_ = utc ? "getUTC" : "get",
-			d = date[_ + "Date"](),
-			D = date[_ + "Day"](),
-			m = date[_ + "Month"](),
-			y = date[_ + "FullYear"](),
-			H = date[_ + "Hours"](),
-			M = date[_ + "Minutes"](),
-			s = date[_ + "Seconds"](),
-			L = date[_ + "Milliseconds"](),
-			o = utc ? 0 : date.getTimezoneOffset(),
-			flags = {
-				d:    d,
-				dd:   pad(d),
-				ddd:  dF.i18n.dayNames[D],
-				dddd: dF.i18n.dayNames[D + 7],
-				m:    m + 1,
-				mm:   pad(m + 1),
-				mmm:  dF.i18n.monthNames[m],
-				mmmm: dF.i18n.monthNames[m + 12],
-				yy:   String(y).slice(2),
-				yyyy: y,
-				h:    H % 12 || 12,
-				hh:   pad(H % 12 || 12),
-				H:    H,
-				HH:   pad(H),
-				M:    M,
-				MM:   pad(M),
-				s:    s,
-				ss:   pad(s),
-				l:    pad(L, 3),
-				L:    pad(L > 99 ? Math.round(L / 10) : L),
-				t:    H < 12 ? "a"  : "p",
-				tt:   H < 12 ? "am" : "pm",
-				T:    H < 12 ? "A"  : "P",
-				TT:   H < 12 ? "AM" : "PM",
-				Z:    utc ? "UTC" : (String(date).match(timezone) || [""]).pop().replace(timezoneClip, ""),
-				o:    (o > 0 ? "-" : "+") + pad(Math.floor(Math.abs(o) / 60) * 100 + Math.abs(o) % 60, 4),
-				S:    ["th", "st", "nd", "rd"][d % 10 > 3 ? 0 : (d % 100 - d % 10 != 10) * d % 10]
-			};
-
-		return mask.replace(token, function ($0) {
-			return $0 in flags ? flags[$0] : $0.slice(1, $0.length - 1);
-		});
-	};
-}();
-
-// Some common format strings
-dateFormat.masks = {
-	"default":      "ddd mmm dd yyyy HH:MM:ss",
-	shortDate:      "m/d/yy",
-	mediumDate:     "mmm d, yyyy",
-	longDate:       "mmmm d, yyyy",
-	fullDate:       "dddd, mmmm d, yyyy",
-	shortTime:      "h:MM TT",
-	mediumTime:     "h:MM:ss TT",
-	longTime:       "h:MM:ss TT Z",
-	isoDate:        "yyyy-mm-dd",
-	isoTime:        "HH:MM:ss",
-	isoDateTime:    "yyyy-mm-dd'T'HH:MM:ss",
-	isoUtcDateTime: "UTC:yyyy-mm-dd'T'HH:MM:ss'Z'"
-};
-
-// Internationalization strings
-dateFormat.i18n = {
-	dayNames: [
-		"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat",
-		"Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"
-	],
-	monthNames: [
-		"Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
-		"January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"
-	]
-};
-
-// For convenience...
-Date.prototype.format = function (mask, utc) {
-	return dateFormat(this, mask, utc);
-};
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
deleted file mode 100644
index 2f7212ad61b..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.barchart = function (x, y, width, height, values, opts) {
-    opts = opts || {};
-    var type = {round: "round", sharp: "sharp", soft: "soft"}[opts.type] || "square",
-        gutter = parseFloat(opts.gutter || "20%"),
-        chart = this.set(),
-        bars = this.set(),
-        covers = this.set(),
-        covers2 = this.set(),
-        total = Math.max.apply(Math, values),
-        stacktotal = [],
-        paper = this,
-        multi = 0,
-        colors = opts.colors || this.g.colors,
-        len = values.length;
-    if (this.raphael.is(values[0], "array")) {
-        total = [];
-        multi = len;
-        len = 0;
-        for (var i = values.length; i--;) {
-            bars.push(this.set());
-            total.push(Math.max.apply(Math, values[i]));
-            len = Math.max(len, values[i].length);
-        }
-        if (opts.stacked) {
-            for (var i = len; i--;) {
-                var tot = 0;
-                for (var j = values.length; j--;) {
-                    tot +=+ values[j][i] || 0;
-                }
-                stacktotal.push(tot);
-            }
-        }
-        for (var i = values.length; i--;) {
-            if (values[i].length < len) {
-                for (var j = len; j--;) {
-                    values[i].push(0);
-                }
-            }
-        }
-        total = Math.max.apply(Math, opts.stacked ? stacktotal : total);
-    }
-    
-    total = (opts.to) || total;
-    var barwidth = width / (len * (100 + gutter) + gutter) * 100,
-        barhgutter = barwidth * gutter / 100,
-        barvgutter = opts.vgutter == null ? 20 : opts.vgutter,
-        stack = [],
-        X = x + barhgutter,
-        Y = (height - 2 * barvgutter) / total;
-    if (!opts.stretch) {
-        barhgutter = Math.round(barhgutter);
-        barwidth = Math.floor(barwidth);
-    }
-    !opts.stacked && (barwidth /= multi || 1);
-    for (var i = 0; i < len; i++) {
-        stack = [];
-        for (var j = 0; j < (multi || 1); j++) {
-            var h = Math.round((multi ? values[j][i] : values[i]) * Y),
-                top = y + height - barvgutter - h,
-                bar = this.g.finger(Math.round(X + barwidth / 2), top + h, barwidth, h, true, type).attr({stroke: colors[multi ? j : i], fill: colors[multi ? j : i]});
-            if (multi) {
-                bars[j].push(bar);
-            } else {
-                bars.push(bar);
-            }
-            bar.y = top;
-            bar.x = Math.round(X + barwidth / 2);
-            bar.w = barwidth;
-            bar.h = h;
-            bar.value = multi ? values[j][i] : values[i];
-            if (!opts.stacked) {
-                X += barwidth;
-            } else {
-                stack.push(bar);
-            }
-        }
-        if (opts.stacked) {
-            var cvr;
-            covers2.push(cvr = this.rect(stack[0].x - stack[0].w / 2, y, barwidth, height).attr(this.g.shim));
-            cvr.bars = this.set();
-            var size = 0;
-            for (var s = stack.length; s--;) {
-                stack[s].toFront();
-            }
-            for (var s = 0, ss = stack.length; s < ss; s++) {
-                var bar = stack[s],
-                    cover,
-                    h = (size + bar.value) * Y,
-                    path = this.g.finger(bar.x, y + height - barvgutter - !!size * .5, barwidth, h, true, type, 1);
-                cvr.bars.push(bar);
-                size && bar.attr({path: path});
-                bar.h = h;
-                bar.y = y + height - barvgutter - !!size * .5 - h;
-                covers.push(cover = this.rect(bar.x - bar.w / 2, bar.y, barwidth, bar.value * Y).attr(this.g.shim));
-                cover.bar = bar;
-                cover.value = bar.value;
-                size += bar.value;
-            }
-            X += barwidth;
-        }
-        X += barhgutter;
-    }
-    covers2.toFront();
-    X = x + barhgutter;
-    if (!opts.stacked) {
-        for (var i = 0; i < len; i++) {
-            for (var j = 0; j < (multi || 1); j++) {
-                var cover;
-                covers.push(cover = this.rect(Math.round(X), y + barvgutter, barwidth, height - barvgutter).attr(this.g.shim));
-                cover.bar = multi ? bars[j][i] : bars[i];
-                cover.value = cover.bar.value;
-                X += barwidth;
-            }
-            X += barhgutter;
-        }
-    }
-    chart.label = function (labels, isBottom) {
-        labels = labels || [];
-        this.labels = paper.set();
-        var L, l = -Infinity;
-        if (opts.stacked) {
-            for (var i = 0; i < len; i++) {
-                var tot = 0;
-                for (var j = 0; j < (multi || 1); j++) {
-                    tot += multi ? values[j][i] : values[i];
-                    if (j == multi - 1) {
-                        var label = paper.g.labelise(labels[i], tot, total);
-                        L = paper.g.text(bars[i * (multi || 1) + j].x, y + height - barvgutter / 2, label).insertBefore(covers[i * (multi || 1) + j]);
-                        var bb = L.getBBox();
-                        if (bb.x - 7 < l) {
-                            L.remove();
-                        } else {
-                            this.labels.push(L);
-                            l = bb.x + bb.width;
-                        }
-                    }
-                }
-            }
-        } else {
-            for (var i = 0; i < len; i++) {
-                for (var j = 0; j < (multi || 1); j++) {
-                    var label = paper.g.labelise(multi ? labels[j] && labels[j][i] : labels[i], multi ? values[j][i] : values[i], total);
-                    L = paper.g.text(bars[i * (multi || 1) + j].x, isBottom ? y + height - barvgutter / 2 : bars[i * (multi || 1) + j].y - 10, label).insertBefore(covers[i * (multi || 1) + j]);
-                    var bb = L.getBBox();
-                    if (bb.x - 7 < l) {
-                        L.remove();
-                    } else {
-                        this.labels.push(L);
-                        l = bb.x + bb.width;
-                    }
-                }
-            }
-        }
-        return this;
-    };
-    chart.hover = function (fin, fout) {
-        covers2.hide();
-        covers.show();
-        covers.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.hoverColumn = function (fin, fout) {
-        covers.hide();
-        covers2.show();
-        fout = fout || function () {};
-        covers2.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.click = function (f) {
-        covers2.hide();
-        covers.show();
-        covers.click(f);
-        return this;
-    };
-    chart.each = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers.length; i--;) {
-            f.call(covers[i]);
-        }
-        return this;
-    };
-    chart.eachColumn = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers2.length; i--;) {
-            f.call(covers2[i]);
-        }
-        return this;
-    };
-    chart.clickColumn = function (f) {
-        covers.hide();
-        covers2.show();
-        covers2.click(f);
-        return this;
-    };
-    chart.push(bars, covers, covers2);
-    chart.bars = bars;
-    chart.covers = covers;
-    return chart;
-};
-Raphael.fn.g.hbarchart = function (x, y, width, height, values, opts) {
-    opts = opts || {};
-    var type = {round: "round", sharp: "sharp", soft: "soft"}[opts.type] || "square",
-        gutter = parseFloat(opts.gutter || "20%"),
-        chart = this.set(),
-        bars = this.set(),
-        covers = this.set(),
-        covers2 = this.set(),
-        total = Math.max.apply(Math, values),
-        stacktotal = [],
-        paper = this,
-        multi = 0,
-        colors = opts.colors || this.g.colors,
-        len = values.length;
-    if (this.raphael.is(values[0], "array")) {
-        total = [];
-        multi = len;
-        len = 0;
-        for (var i = values.length; i--;) {
-            bars.push(this.set());
-            total.push(Math.max.apply(Math, values[i]));
-            len = Math.max(len, values[i].length);
-        }
-        if (opts.stacked) {
-            for (var i = len; i--;) {
-                var tot = 0;
-                for (var j = values.length; j--;) {
-                    tot +=+ values[j][i] || 0;
-                }
-                stacktotal.push(tot);
-            }
-        }
-        for (var i = values.length; i--;) {
-            if (values[i].length < len) {
-                for (var j = len; j--;) {
-                    values[i].push(0);
-                }
-            }
-        }
-        total = Math.max.apply(Math, opts.stacked ? stacktotal : total);
-    }
-    
-    total = (opts.to) || total;
-    var barheight = Math.floor(height / (len * (100 + gutter) + gutter) * 100),
-        bargutter = Math.floor(barheight * gutter / 100),
-        stack = [],
-        Y = y + bargutter,
-        X = (width - 1) / total;
-    !opts.stacked && (barheight /= multi || 1);
-    for (var i = 0; i < len; i++) {
-        stack = [];
-        for (var j = 0; j < (multi || 1); j++) {
-            var val = multi ? values[j][i] : values[i],
-                bar = this.g.finger(x, Y + barheight / 2, Math.round(val * X), barheight - 1, false, type).attr({stroke: colors[multi ? j : i], fill: colors[multi ? j : i]});
-            if (multi) {
-                bars[j].push(bar);
-            } else {
-                bars.push(bar);
-            }
-            bar.x = x + Math.round(val * X);
-            bar.y = Y + barheight / 2;
-            bar.w = Math.round(val * X);
-            bar.h = barheight;
-            bar.value = +val;
-            if (!opts.stacked) {
-                Y += barheight;
-            } else {
-                stack.push(bar);
-            }
-        }
-        if (opts.stacked) {
-            var cvr = this.rect(x, stack[0].y - stack[0].h / 2, width, barheight).attr(this.g.shim);
-            covers2.push(cvr);
-            cvr.bars = this.set();
-            var size = 0;
-            for (var s = stack.length; s--;) {
-                stack[s].toFront();
-            }
-            for (var s = 0, ss = stack.length; s < ss; s++) {
-                var bar = stack[s],
-                    cover,
-                    val = Math.round((size + bar.value) * X),
-                    path = this.g.finger(x, bar.y, val, barheight - 1, false, type, 1);
-                cvr.bars.push(bar);
-                size && bar.attr({path: path});
-                bar.w = val;
-                bar.x = x + val;
-                covers.push(cover = this.rect(x + size * X, bar.y - bar.h / 2, bar.value * X, barheight).attr(this.g.shim));
-                cover.bar = bar;
-                size += bar.value;
-            }
-            Y += barheight;
-        }
-        Y += bargutter;
-    }
-    covers2.toFront();
-    Y = y + bargutter;
-    if (!opts.stacked) {
-        for (var i = 0; i < len; i++) {
-            for (var j = 0; j < multi; j++) {
-                var cover = this.rect(x, Y, width, barheight).attr(this.g.shim);
-                covers.push(cover);
-                cover.bar = bars[j][i];
-                Y += barheight;
-            }
-            Y += bargutter;
-        }
-    }
-    chart.label = function (labels, isRight) {
-        labels = labels || [];
-        this.labels = paper.set();
-        for (var i = 0; i < len; i++) {
-            for (var j = 0; j < multi; j++) {
-                var  label = paper.g.labelise(multi ? labels[j] && labels[j][i] : labels[i], multi ? values[j][i] : values[i], total);
-                var X = isRight ? bars[i * (multi || 1) + j].x - barheight / 2 + 3 : x + 5,
-                    A = isRight ? "end" : "start",
-                    L;
-                this.labels.push(L = paper.g.text(X, bars[i * (multi || 1) + j].y, label).attr({"text-anchor": A}).insertBefore(covers[0]));
-                if (L.getBBox().x < x + 5) {
-                    L.attr({x: x + 5, "text-anchor": "start"});
-                } else {
-                    bars[i * (multi || 1) + j].label = L;
-                }
-            }
-        }
-        return this;
-    };
-    chart.hover = function (fin, fout) {
-        covers2.hide();
-        covers.show();
-        fout = fout || function () {};
-        covers.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.hoverColumn = function (fin, fout) {
-        covers.hide();
-        covers2.show();
-        fout = fout || function () {};
-        covers2.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.each = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers.length; i--;) {
-            f.call(covers[i]);
-        }
-        return this;
-    };
-    chart.eachColumn = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers2.length; i--;) {
-            f.call(covers2[i]);
-        }
-        return this;
-    };
-    chart.click = function (f) {
-        covers2.hide();
-        covers.show();
-        covers.click(f);
-        return this;
-    };
-    chart.clickColumn = function (f) {
-        covers.hide();
-        covers2.show();
-        covers2.click(f);
-        return this;
-    };
-    chart.push(bars, covers, covers2);
-    chart.bars = bars;
-    chart.covers = covers;
-    return chart;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
deleted file mode 100644
index 2821e62c730..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.dotchart = function (x, y, width, height, valuesx, valuesy, size, opts) {
-    function drawAxis(ax) {
-        +ax[0] && (ax[0] = paper.g.axis(x + gutter, y + gutter, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 2, opts.axisxlabels || null, opts.axisxtype || "t"));
-        +ax[1] && (ax[1] = paper.g.axis(x + width - gutter, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 3, opts.axisylabels || null, opts.axisytype || "t"));
-        +ax[2] && (ax[2] = paper.g.axis(x + gutter, y + height - gutter + maxR, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 0, opts.axisxlabels || null, opts.axisxtype || "t"));
-        +ax[3] && (ax[3] = paper.g.axis(x + gutter - maxR, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 1, opts.axisylabels || null, opts.axisytype || "t"));
-    }
-    opts = opts || {};
-    var xdim = this.g.snapEnds(Math.min.apply(Math, valuesx), Math.max.apply(Math, valuesx), valuesx.length - 1),
-        minx = xdim.from,
-        maxx = xdim.to,
-        gutter = opts.gutter || 10,
-        ydim = this.g.snapEnds(Math.min.apply(Math, valuesy), Math.max.apply(Math, valuesy), valuesy.length - 1),
-        miny = ydim.from,
-        maxy = ydim.to,
-        len = Math.max(valuesx.length, valuesy.length, size.length),
-        symbol = this.g.markers[opts.symbol] || "disc",
-        res = this.set(),
-        series = this.set(),
-        max = opts.max || 100,
-        top = Math.max.apply(Math, size),
-        R = [],
-        paper = this,
-        k = Math.sqrt(top / Math.PI) * 2 / max;
-
-    for (var i = 0; i < len; i++) {
-        R[i] = Math.min(Math.sqrt(size[i] / Math.PI) * 2 / k, max);
-    }
-    gutter = Math.max.apply(Math, R.concat(gutter));
-    var axis = this.set(),
-        maxR = Math.max.apply(Math, R);
-    if (opts.axis) {
-        var ax = (opts.axis + "").split(/[,\s]+/);
-        drawAxis(ax);
-        var g = [], b = [];
-        for (var i = 0, ii = ax.length; i < ii; i++) {
-            var bb = ax[i].all ? ax[i].all.getBBox()[["height", "width"][i % 2]] : 0;
-            g[i] = bb + gutter;
-            b[i] = bb;
-        }
-        gutter = Math.max.apply(Math, g.concat(gutter));
-        for (var i = 0, ii = ax.length; i < ii; i++) if (ax[i].all) {
-            ax[i].remove();
-            ax[i] = 1;
-        }
-        drawAxis(ax);
-        for (var i = 0, ii = ax.length; i < ii; i++) if (ax[i].all) {
-            axis.push(ax[i].all);
-        }
-        res.axis = axis;
-    }
-    var kx = (width - gutter * 2) / ((maxx - minx) || 1),
-        ky = (height - gutter * 2) / ((maxy - miny) || 1);
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        var sym = this.raphael.is(symbol, "array") ? symbol[i] : symbol,
-            X = x + gutter + (valuesx[i] - minx) * kx,
-            Y = y + height - gutter - (valuesy[i] - miny) * ky;
-        sym && R[i] && series.push(this.g[sym](X, Y, R[i]).attr({fill: opts.heat ? this.g.colorValue(R[i], maxR) : Raphael.fn.g.colors[0], "fill-opacity": opts.opacity ? R[i] / max : 1, stroke: "none"}));
-    }
-    var covers = this.set();
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        var X = x + gutter + (valuesx[i] - minx) * kx,
-            Y = y + height - gutter - (valuesy[i] - miny) * ky;
-        covers.push(this.circle(X, Y, maxR).attr(this.g.shim));
-        opts.href && opts.href[i] && covers[i].attr({href: opts.href[i]});
-        covers[i].r = +R[i].toFixed(3);
-        covers[i].x = +X.toFixed(3);
-        covers[i].y = +Y.toFixed(3);
-        covers[i].X = valuesx[i];
-        covers[i].Y = valuesy[i];
-        covers[i].value = size[i] || 0;
-        covers[i].dot = series[i];
-    }
-    res.covers = covers;
-    res.series = series;
-    res.push(series, axis, covers);
-    res.hover = function (fin, fout) {
-        covers.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    res.click = function (f) {
-        covers.click(f);
-        return this;
-    };
-    res.each = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers.length; i--;) {
-            f.call(covers[i]);
-        }
-        return this;
-    };
-    res.href = function (map) {
-        var cover;
-        for (var i = covers.length; i--;) {
-            cover = covers[i];
-            if (cover.X == map.x && cover.Y == map.y && cover.value == map.value) {
-                cover.attr({href: map.href});
-            }
-        }
-    };
-    return res;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
deleted file mode 100644
index eb56e5916dc..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.linechart = function (x, y, width, height, valuesx, valuesy, opts) {
-    function shrink(values, dim) {
-        var k = values.length / dim,
-            j = 0,
-            l = k,
-            sum = 0,
-            res = [];
-        while (j < values.length) {
-            l--;
-            if (l < 0) {
-                sum += values[j] * (1 + l);
-                res.push(sum / k);
-                sum = values[j++] * -l;
-                l += k;
-            } else {
-                sum += values[j++];
-            }
-        }
-        return res;
-    }
-    opts = opts || {};
-    if (!this.raphael.is(valuesx[0], "array")) {
-        valuesx = [valuesx];
-    }
-    if (!this.raphael.is(valuesy[0], "array")) {
-        valuesy = [valuesy];
-    }
-    var allx = Array.prototype.concat.apply([], valuesx),
-        ally = Array.prototype.concat.apply([], valuesy),
-        xdim = this.g.snapEnds(Math.min.apply(Math, allx), Math.max.apply(Math, allx), valuesx[0].length - 1),
-        minx = xdim.from,
-        maxx = xdim.to,
-        gutter = opts.gutter || 10,
-        kx = (width - gutter * 2) / (maxx - minx),
-        ydim = this.g.snapEnds(Math.min.apply(Math, ally), Math.max.apply(Math, ally), valuesy[0].length - 1),
-        miny = ydim.from,
-        maxy = ydim.to,
-        ky = (height - gutter * 2) / (maxy - miny),
-        len = Math.max(valuesx[0].length, valuesy[0].length),
-        symbol = opts.symbol || "",
-        colors = opts.colors || Raphael.fn.g.colors,
-        that = this,
-        columns = null,
-        dots = null,
-        chart = this.set(),
-        path = [];
-
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        len = Math.max(len, valuesy[i].length);
-    }
-    var shades = this.set();
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        if (opts.shade) {
-            shades.push(this.path().attr({stroke: "none", fill: colors[i], opacity: opts.nostroke ? 1 : .3}));
-        }
-        if (valuesy[i].length > width - 2 * gutter) {
-            valuesy[i] = shrink(valuesy[i], width - 2 * gutter);
-            len = width - 2 * gutter;
-        }
-        if (valuesx[i] && valuesx[i].length > width - 2 * gutter) {
-            valuesx[i] = shrink(valuesx[i], width - 2 * gutter);
-        }
-    }
-    var axis = this.set();
-    if (opts.axis) {
-        var ax = (opts.axis + "").split(/[,\s]+/);
-        +ax[0] && axis.push(this.g.axis(x + gutter, y + gutter, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 2, opts.northlabels));
-        +ax[1] && axis.push(this.g.axis(x + width - gutter, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 3, opts.eastlabels));
-        +ax[2] && axis.push(this.g.axis(x + gutter, y + height - gutter, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 0, opts.southlabels));
-        +ax[3] && axis.push(this.g.axis(x + gutter, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 1, opts.westlabels));
-    }
-    if (opts.northAxisLabel) {
-	this.g.text(x + gutter + width/2, gutter, opts.northAxisLabel);
-    }
-    if (opts.southAxisLabel) {
-	this.g.text(x + gutter + width/2, y + height + 20, opts.southAxisLabel);
-    }
-    if (opts.westAxisLabel) {
-	this.g.text(gutter, y + gutter + height/2, opts.westAxisLabel).attr({rotation: -90});
-    }
-    if (opts.eastAxisLabel) {
-	this.g.text(x + gutter + width + 20, y + gutter + height/2, opts.eastAxisLabel).attr({rotation: 90});
-    }
-
-    var lines = this.set(),
-        symbols = this.set(),
-        line;
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        if (!opts.nostroke) {
-            lines.push(line = this.path().attr({
-                stroke: colors[i],
-                "stroke-width": opts.width || 2,
-                "stroke-linejoin": "round",
-                "stroke-linecap": "round",
-                "stroke-dasharray": opts.dash || ""
-            }));
-        }
-        var sym = this.raphael.is(symbol, "array") ? symbol[i] : symbol,
-            symset = this.set();
-        path = [];
-        for (var j = 0, jj = valuesy[i].length; j < jj; j++) {
-            var X = x + gutter + ((valuesx[i] || valuesx[0])[j] - minx) * kx;
-            var Y = y + height - gutter - (valuesy[i][j] - miny) * ky;
-            (Raphael.is(sym, "array") ? sym[j] : sym) && symset.push(this.g[Raphael.fn.g.markers[this.raphael.is(sym, "array") ? sym[j] : sym]](X, Y, (opts.width || 2) * 3).attr({fill: colors[i], stroke: "none"}));
-            path = path.concat([j ? "L" : "M", X, Y]);
-        }
-        symbols.push(symset);
-        if (opts.shade) {
-            shades[i].attr({path: path.concat(["L", X, y + height - gutter, "L",  x + gutter + ((valuesx[i] || valuesx[0])[0] - minx) * kx, y + height - gutter, "z"]).join(",")});
-        }
-        !opts.nostroke && line.attr({path: path.join(",")});
-    }
-    function createColumns(f) {
-        // unite Xs together
-        var Xs = [];
-        for (var i = 0, ii = valuesx.length; i < ii; i++) {
-            Xs = Xs.concat(valuesx[i]);
-        }
-        Xs.sort();
-        // remove duplicates
-        var Xs2 = [],
-            xs = [];
-        for (var i = 0, ii = Xs.length; i < ii; i++) {
-            Xs[i] != Xs[i - 1] && Xs2.push(Xs[i]) && xs.push(x + gutter + (Xs[i] - minx) * kx);
-        }
-        Xs = Xs2;
-        ii = Xs.length;
-        var cvrs = f || that.set();
-        for (var i = 0; i < ii; i++) {
-            var X = xs[i] - (xs[i] - (xs[i - 1] || x)) / 2,
-                w = ((xs[i + 1] || x + width) - xs[i]) / 2 + (xs[i] - (xs[i - 1] || x)) / 2,
-                C;
-            f ? (C = {}) : cvrs.push(C = that.rect(X - 1, y, Math.max(w + 1, 1), height).attr({stroke: "none", fill: "#000", opacity: 0}));
-            C.values = [];
-            C.symbols = that.set();
-            C.y = [];
-            C.x = xs[i];
-            C.axis = Xs[i];
-            for (var j = 0, jj = valuesy.length; j < jj; j++) {
-                Xs2 = valuesx[j] || valuesx[0];
-                for (var k = 0, kk = Xs2.length; k < kk; k++) {
-                    if (Xs2[k] == Xs[i]) {
-                        C.values.push(valuesy[j][k]);
-                        C.y.push(y + height - gutter - (valuesy[j][k] - miny) * ky);
-                        C.symbols.push(chart.symbols[j][k]);
-                    }
-                }
-            }
-            f && f.call(C);
-        }
-        !f && (columns = cvrs);
-    }
-    function createDots(f) {
-        var cvrs = f || that.set(),
-            C;
-        for (var i = 0, ii = valuesy.length; i < ii; i++) {
-            for (var j = 0, jj = valuesy[i].length; j < jj; j++) {
-                var X = x + gutter + ((valuesx[i] || valuesx[0])[j] - minx) * kx,
-                    nearX = x + gutter + ((valuesx[i] || valuesx[0])[j ? j - 1 : 1] - minx) * kx,
-                    Y = y + height - gutter - (valuesy[i][j] - miny) * ky;
-                f ? (C = {}) : cvrs.push(C = that.circle(X, Y, Math.abs(nearX - X) / 2).attr({stroke: "none", fill: "#000", opacity: 0}));
-                C.x = X;
-                C.y = Y;
-                C.value = valuesy[i][j];
-                C.line = chart.lines[i];
-                C.shade = chart.shades[i];
-                C.symbol = chart.symbols[i][j];
-                C.symbols = chart.symbols[i];
-                C.axis = (valuesx[i] || valuesx[0])[j];
-                f && f.call(C);
-            }
-        }
-        !f && (dots = cvrs);
-    }
-    chart.push(lines, shades, symbols, axis, columns, dots);
-    chart.lines = lines;
-    chart.shades = shades;
-    chart.symbols = symbols;
-    chart.axis = axis;
-    chart.hoverColumn = function (fin, fout) {
-        !columns && createColumns();
-        columns.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.clickColumn = function (f) {
-        !columns && createColumns();
-        columns.click(f);
-        return this;
-    };
-    chart.hrefColumn = function (cols) {
-        var hrefs = that.raphael.is(arguments[0], "array") ? arguments[0] : arguments;
-        if (!(arguments.length - 1) && typeof cols == "object") {
-            for (var x in cols) {
-                for (var i = 0, ii = columns.length; i < ii; i++) if (columns[i].axis == x) {
-                    columns[i].attr("href", cols[x]);
-                }
-            }
-        }
-        !columns && createColumns();
-        for (var i = 0, ii = hrefs.length; i < ii; i++) {
-            columns[i] && columns[i].attr("href", hrefs[i]);
-        }
-        return this;
-    };
-    chart.hover = function (fin, fout) {
-        !dots && createDots();
-        dots.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.click = function (f) {
-        !dots && createDots();
-        dots.click(f);
-        return this;
-    };
-    chart.each = function (f) {
-        createDots(f);
-        return this;
-    };
-    chart.eachColumn = function (f) {
-        createColumns(f);
-        return this;
-    };
-    return chart;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
deleted file mode 100644
index 8d203745528..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.piechart = function (cx, cy, r, values, opts) {
-    opts = opts || {};
-    var paper = this,
-        sectors = [],
-        covers = this.set(),
-        chart = this.set(),
-        series = this.set(),
-        order = [],
-        len = values.length,
-        angle = 0,
-        total = 0,
-        others = 0,
-        cut = 9,
-        defcut = true;
-    chart.covers = covers;
-    if (len == 1) {
-        series.push(this.circle(cx, cy, r).attr({fill: this.g.colors[0], stroke: opt.stroke || "#fff", "stroke-width": opts.strokewidth == null ? 1 : opts.strokewidth}));
-        covers.push(this.circle(cx, cy, r).attr(this.g.shim));
-        total = values[0];
-        values[0] = {value: values[0], order: 0, valueOf: function () { return this.value; }};
-        series[0].middle = {x: cx, y: cy};
-        series[0].mangle = 180;
-    } else {
-        function sector(cx, cy, r, startAngle, endAngle, fill) {
-            var rad = Math.PI / 180,
-                x1 = cx + r * Math.cos(-startAngle * rad),
-                x2 = cx + r * Math.cos(-endAngle * rad),
-                xm = cx + r / 2 * Math.cos(-(startAngle + (endAngle - startAngle) / 2) * rad),
-                y1 = cy + r * Math.sin(-startAngle * rad),
-                y2 = cy + r * Math.sin(-endAngle * rad),
-                ym = cy + r / 2 * Math.sin(-(startAngle + (endAngle - startAngle) / 2) * rad),
-                res = ["M", cx, cy, "L", x1, y1, "A", r, r, 0, +(Math.abs(endAngle - startAngle) > 180), 1, x2, y2, "z"];
-            res.middle = {x: xm, y: ym};
-            return res;
-        }
-        for (var i = 0; i < len; i++) {
-            total += values[i];
-            values[i] = {value: values[i], order: i, valueOf: function () { return this.value; }};
-        }
-        values.sort(function (a, b) {
-            return b.value - a.value;
-        });
-        for (var i = 0; i < len; i++) {
-            if (defcut && values[i] * 360 / total <= 1.5) {
-                cut = i;
-                defcut = false;
-            }
-            if (i > cut) {
-                defcut = false;
-                values[cut].value += values[i];
-                values[cut].others = true;
-                others = values[cut].value;
-            }
-        }
-        len = Math.min(cut + 1, values.length);
-        others && values.splice(len) && (values[cut].others = true);
-        for (var i = 0; i < len; i++) {
-            var mangle = angle - 360 * values[i] / total / 2;
-            if (!i) {
-                angle = 90 - mangle;
-                mangle = angle - 360 * values[i] / total / 2;
-            }
-            if (opts.init) {
-                var ipath = sector(cx, cy, 1, angle, angle - 360 * values[i] / total).join(",");
-            }
-            var path = sector(cx, cy, r, angle, angle -= 360 * values[i] / total);
-            var p = this.path(opts.init ? ipath : path).attr({fill: opts.colors && opts.colors[i] || this.g.colors[i] || "#666", stroke: opts.stroke || "#fff", "stroke-width": (opts.strokewidth == null ? 1 : opts.strokewidth), "stroke-linejoin": "round"});
-            p.value = values[i];
-            p.middle = path.middle;
-            p.mangle = mangle;
-            sectors.push(p);
-            series.push(p);
-            opts.init && p.animate({path: path.join(",")}, (+opts.init - 1) || 1000, ">");
-        }
-        for (var i = 0; i < len; i++) {
-            var p = paper.path(sectors[i].attr("path")).attr(this.g.shim);
-            opts.href && opts.href[i] && p.attr({href: opts.href[i]});
-            p.attr = function () {};
-            covers.push(p);
-            series.push(p);
-        }
-    }
-
-    chart.hover = function (fin, fout) {
-        fout = fout || function () {};
-        var that = this;
-        for (var i = 0; i < len; i++) {
-            (function (sector, cover, j) {
-                var o = {
-                    sector: sector,
-                    cover: cover,
-                    cx: cx,
-                    cy: cy,
-                    mx: sector.middle.x,
-                    my: sector.middle.y,
-                    mangle: sector.mangle,
-                    r: r,
-                    value: values[j],
-                    total: total,
-                    label: that.labels && that.labels[j]
-                };
-                cover.mouseover(function () {
-                    fin.call(o);
-                }).mouseout(function () {
-                    fout.call(o);
-                });
-            })(series[i], covers[i], i);
-        }
-        return this;
-    };
-    // x: where label could be put
-    // y: where label could be put
-    // value: value to show
-    // total: total number to count %
-    chart.each = function (f) {
-        var that = this;
-        for (var i = 0; i < len; i++) {
-            (function (sector, cover, j) {
-                var o = {
-                    sector: sector,
-                    cover: cover,
-                    cx: cx,
-                    cy: cy,
-                    x: sector.middle.x,
-                    y: sector.middle.y,
-                    mangle: sector.mangle,
-                    r: r,
-                    value: values[j],
-                    total: total,
-                    label: that.labels && that.labels[j]
-                };
-                f.call(o);
-            })(series[i], covers[i], i);
-        }
-        return this;
-    };
-    chart.click = function (f) {
-        var that = this;
-        for (var i = 0; i < len; i++) {
-            (function (sector, cover, j) {
-                var o = {
-                    sector: sector,
-                    cover: cover,
-                    cx: cx,
-                    cy: cy,
-                    mx: sector.middle.x,
-                    my: sector.middle.y,
-                    mangle: sector.mangle,
-                    r: r,
-                    value: values[j],
-                    total: total,
-                    label: that.labels && that.labels[j]
-                };
-                cover.click(function () { f.call(o); });
-            })(series[i], covers[i], i);
-        }
-        return this;
-    };
-    chart.inject = function (element) {
-        element.insertBefore(covers[0]);
-    };
-    var legend = function (labels, otherslabel, mark, dir) {
-        var x = cx + r + r / 5,
-            y = cy,
-            h = y + 10;
-        labels = labels || [];
-        dir = (dir && dir.toLowerCase && dir.toLowerCase()) || "east";
-        mark = paper.g.markers[mark && mark.toLowerCase()] || "disc";
-        chart.labels = paper.set();
-        for (var i = 0; i < len; i++) {
-            var clr = series[i].attr("fill"),
-                j = values[i].order,
-                txt;
-            values[i].others && (labels[j] = otherslabel || "Others");
-            labels[j] = paper.g.labelise(labels[j], values[i], total);
-            chart.labels.push(paper.set());
-            chart.labels[i].push(paper.g[mark](x + 5, h, 5).attr({fill: clr, stroke: "none"}));
-            chart.labels[i].push(txt = paper.text(x + 20, h, labels[j] || values[j]).attr(paper.g.txtattr).attr({fill: opts.legendcolor || "#000", "text-anchor": "start"}));
-            covers[i].label = chart.labels[i];
-            h += txt.getBBox().height * 1.2;
-        }
-        var bb = chart.labels.getBBox(),
-            tr = {
-                east: [0, -bb.height / 2],
-                west: [-bb.width - 2 * r - 20, -bb.height / 2],
-                north: [-r - bb.width / 2, -r - bb.height - 10],
-                south: [-r - bb.width / 2, r + 10]
-            }[dir];
-        chart.labels.translate.apply(chart.labels, tr);
-        chart.push(chart.labels);
-    };
-    if (opts.legend) {
-        legend(opts.legend, opts.legendothers, opts.legendmark, opts.legendpos);
-    }
-    chart.push(series, covers);
-    chart.series = series;
-    chart.covers = covers;
-    return chart;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
deleted file mode 100644
index 6957da63053..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
+++ /dev/null
@@ -1,481 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
- 
- 
-(function () {
-    Raphael.fn.g = Raphael.fn.g || {};
-    Raphael.fn.g.markers = {
-        disc: "disc",
-        o: "disc",
-        flower: "flower",
-        f: "flower",
-        diamond: "diamond",
-        d: "diamond",
-        square: "square",
-        s: "square",
-        triangle: "triangle",
-        t: "triangle",
-        star: "star",
-        "*": "star",
-        cross: "cross",
-        x: "cross",
-        plus: "plus",
-        "+": "plus",
-        arrow: "arrow",
-        "->": "arrow"
-    };
-    Raphael.fn.g.shim = {stroke: "none", fill: "#000", "fill-opacity": 0};
-    Raphael.fn.g.txtattr = {font: "12px Arial, sans-serif"};
-    Raphael.fn.g.colors = [];
-    var hues = [.6, .2, .05, .1333, .75, 0];
-    for (var i = 0; i < 10; i++) {
-        if (i < hues.length) {
-            Raphael.fn.g.colors.push("hsb(" + hues[i] + ", .75, .75)");
-        } else {
-            Raphael.fn.g.colors.push("hsb(" + hues[i - hues.length] + ", 1, .5)");
-        }
-    }
-    Raphael.fn.g.text = function (x, y, text) {
-        return this.text(x, y, text).attr(this.g.txtattr);
-    };
-    Raphael.fn.g.labelise = function (label, val, total) {
-        if (label) {
-            return (label + "").replace(/(##+(?:\.#+)?)|(%%+(?:\.%+)?)/g, function (all, value, percent) {
-                if (value) {
-                    return (+val).toFixed(value.replace(/^#+\.?/g, "").length);
-                }
-                if (percent) {
-                    return (val * 100 / total).toFixed(percent.replace(/^%+\.?/g, "").length) + "%";
-                }
-            });
-        } else {
-            return (+val).toFixed(0);
-        }
-    };
-
-    Raphael.fn.g.finger = function (x, y, width, height, dir, ending, isPath) {
-        // dir 0 for horizontal and 1 for vertical
-        if ((dir && !height) || (!dir && !width)) {
-            return isPath ? "" : this.path();
-        }
-        ending = {square: "square", sharp: "sharp", soft: "soft"}[ending] || "round";
-        var path;
-        height = Math.round(height);
-        width = Math.round(width);
-        x = Math.round(x);
-        y = Math.round(y);
-        switch (ending) {
-            case "round":
-            if (!dir) {
-                var r = Math.floor(height / 2);
-                if (width < r) {
-                    r = width;
-                    path = ["M", x + .5, y + .5 - Math.floor(height / 2), "l", 0, 0, "a", r, Math.floor(height / 2), 0, 0, 1, 0, height, "l", 0, 0, "z"];
-                } else {
-                    path = ["M", x + .5, y + .5 - r, "l", width - r, 0, "a", r, r, 0, 1, 1, 0, height, "l", r - width, 0, "z"];
-                }
-            } else {
-                var r = Math.floor(width / 2);
-                if (height < r) {
-                    r = height;
-                    path = ["M", x - Math.floor(width / 2), y, "l", 0, 0, "a", Math.floor(width / 2), r, 0, 0, 1, width, 0, "l", 0, 0, "z"];
-                } else {
-                    path = ["M", x - r, y, "l", 0, r - height, "a", r, r, 0, 1, 1, width, 0, "l", 0, height - r, "z"];
-                }
-            }
-            break;
-            case "sharp":
-            if (!dir) {
-                var half = Math.floor(height / 2);
-                path = ["M", x, y + half, "l", 0, -height, Math.max(width - half, 0), 0, Math.min(half, width), half, -Math.min(half, width), half + (half * 2 < height), "z"];
-            } else {
-                var half = Math.floor(width / 2);
-                path = ["M", x + half, y, "l", -width, 0, 0, -Math.max(height - half, 0), half, -Math.min(half, height), half, Math.min(half, height), half, "z"];
-            }
-            break;
-            case "square":
-            if (!dir) {
-                path = ["M", x, y + Math.floor(height / 2), "l", 0, -height, width, 0, 0, height, "z"];
-            } else {
-                path = ["M", x + Math.floor(width / 2), y, "l", 1 - width, 0, 0, -height, width - 1, 0, "z"];
-            }
-            break;
-            case "soft":
-            var r;
-            if (!dir) {
-                r = Math.min(width, Math.round(height / 5));
-                path = ["M", x + .5, y + .5 - Math.floor(height / 2), "l", width - r, 0, "a", r, r, 0, 0, 1, r, r, "l", 0, height - r * 2, "a", r, r, 0, 0, 1, -r, r, "l", r - width, 0, "z"];
-            } else {
-                r = Math.min(Math.round(width / 5), height);
-                path = ["M", x - Math.floor(width / 2), y, "l", 0, r - height, "a", r, r, 0, 0, 1, r, -r, "l", width - 2 * r, 0, "a", r, r, 0, 0, 1, r, r, "l", 0, height - r, "z"];
-            }
-        }
-        if (isPath) {
-            return path.join(",");
-        } else {
-            return this.path(path);
-        }
-    };
-
-    // Symbols
-    Raphael.fn.g.disc = function (cx, cy, r) {
-        return this.circle(cx, cy, r);
-    };
-    Raphael.fn.g.line = function (cx, cy, r) {
-        return this.rect(cx - r, cy - r / 5, 2 * r, 2 * r / 5);
-    };
-    Raphael.fn.g.square = function (cx, cy, r) {
-        r = r * .7;
-        return this.rect(cx - r, cy - r, 2 * r, 2 * r);
-    };
-    Raphael.fn.g.triangle = function (cx, cy, r) {
-        r *= 1.75;
-        return this.path("M".concat(cx, ",", cy, "m0-", r * .58, "l", r * .5, ",", r * .87, "-", r, ",0z"));
-    };
-    Raphael.fn.g.diamond = function (cx, cy, r) {
-        return this.path(["M", cx, cy - r, "l", r, r, -r, r, -r, -r, r, -r, "z"]);
-    };
-    Raphael.fn.g.flower = function (cx, cy, r, n) {
-        r = r * 1.25;
-        var rout = r,
-            rin = rout * .5;
-        n = +n < 3 || !n ? 5 : n;
-        var points = ["M", cx, cy + rin, "Q"],
-            R;
-        for (var i = 1; i < n * 2 + 1; i++) {
-            R = i % 2 ? rout : rin;
-            points = points.concat([+(cx + R * Math.sin(i * Math.PI / n)).toFixed(3), +(cy + R * Math.cos(i * Math.PI / n)).toFixed(3)]);
-        }
-        points.push("z");
-        return this.path(points.join(","));
-    };
-    Raphael.fn.g.star = function (cx, cy, r, r2) {
-        r2 = r2 || r * .5;
-        var points = ["M", cx, cy + r2, "L"],
-            R;
-        for (var i = 1; i < 10; i++) {
-            R = i % 2 ? r : r2;
-            points = points.concat([(cx + R * Math.sin(i * Math.PI * .2)).toFixed(3), (cy + R * Math.cos(i * Math.PI * .2)).toFixed(3)]);
-        }
-        points.push("z");
-        return this.path(points.join(","));
-    };
-    Raphael.fn.g.cross = function (cx, cy, r) {
-        r = r / 2.5;
-        return this.path("M".concat(cx - r, ",", cy, "l", [-r, -r, r, -r, r, r, r, -r, r, r, -r, r, r, r, -r, r, -r, -r, -r, r, -r, -r, "z"]));
-    };
-    Raphael.fn.g.plus = function (cx, cy, r) {
-        r = r / 2;
-        return this.path("M".concat(cx - r / 2, ",", cy - r / 2, "l", [0, -r, r, 0, 0, r, r, 0, 0, r, -r, 0, 0, r, -r, 0, 0, -r, -r, 0, 0, -r, "z"]));
-    };
-    Raphael.fn.g.arrow = function (cx, cy, r) {
-        return this.path("M".concat(cx - r * .7, ",", cy - r * .4, "l", [r * .6, 0, 0, -r * .4, r, r * .8, -r, r * .8, 0, -r * .4, -r * .6, 0], "z"));
-    };
-
-    // Tooltips
-    Raphael.fn.g.tag = function (x, y, text, angle, r) {
-        angle = angle || 0;
-        r = r == null ? 5 : r;
-        text = text == null ? "$9.99" : text;
-        var R = .5522 * r,
-            res = this.set(),
-            d = 3;
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function () {
-            this.rotate(0, x, y);
-            var bb = this[1].getBBox();
-            if (bb.height >= r * 2) {
-                this[0].attr({path: ["M", x, y + r, "a", r, r, 0, 1, 1, 0, -r * 2, r, r, 0, 1, 1, 0, r * 2, "m", 0, -r * 2 -d, "a", r + d, r + d, 0, 1, 0, 0, (r + d) * 2, "L", x + r + d, y + bb.height / 2 + d, "l", bb.width + 2 * d, 0, 0, -bb.height - 2 * d, -bb.width - 2 * d, 0, "L", x, y - r - d].join(",")});
-            } else {
-                var dx = Math.sqrt(Math.pow(r + d, 2) - Math.pow(bb.height / 2 + d, 2));
-                // ["c", -R, 0, -r, R - r, -r, -r, 0, -R, r - R, -r, r, -r, R, 0, r, r - R, r, r, 0, R, R - r, r, -r, r]
-                // "a", r, r, 0, 1, 1, 0, -r * 2, r, r, 0, 1, 1, 0, r * 2,
-                this[0].attr({path: ["M", x, y + r, "c", -R, 0, -r, R - r, -r, -r, 0, -R, r - R, -r, r, -r, R, 0, r, r - R, r, r, 0, R, R - r, r, -r, r, "M", x + dx, y - bb.height / 2 - d, "a", r + d, r + d, 0, 1, 0, 0, bb.height + 2 * d, "l", r + d - dx + bb.width + 2 * d, 0, 0, -bb.height - 2 * d, "L", x + dx, y - bb.height / 2 - d].join(",")});
-            }
-            this[1].attr({x: x + r + d + bb.width / 2, y: y});
-            angle = (360 - angle) % 360;
-            this.rotate(angle, x, y);
-            angle > 90 && angle < 270 && this[1].attr({x: x - r - d - bb.width / 2, y: y, rotation: [180 + angle, x, y]});
-            return this;
-        };
-        res.update();
-        return res;
-    };
-    Raphael.fn.g.popupit = function (x, y, set, dir, size) {
-        dir = dir == null ? 2 : dir;
-        size = size || 5;
-        x = Math.round(x) + .5;
-        y = Math.round(y) + .5;
-        var bb = set.getBBox(),
-            w = Math.round(bb.width / 2),
-            h = Math.round(bb.height / 2),
-            dx = [0, w + size * 2, 0, -w - size * 2],
-            dy = [-h * 2 - size * 3, -h - size, 0, -h - size],
-            p = ["M", x - dx[dir], y - dy[dir], "l", -size, (dir == 2) * -size, -Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, -size, -size,
-                "l", 0, -Math.max(h - size, 0), (dir == 3) * -size, -size, (dir == 3) * size, -size, 0, -Math.max(h - size, 0), "a", size, size, 0, 0, 1, size, -size,
-                "l", Math.max(w - size, 0), 0, size, !dir * -size, size, !dir * size, Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, size, size,
-                "l", 0, Math.max(h - size, 0), (dir == 1) * size, size, (dir == 1) * -size, size, 0, Math.max(h - size, 0), "a", size, size, 0, 0, 1, -size, size,
-                "l", -Math.max(w - size, 0), 0, "z"].join(","),
-            xy = [{x: x, y: y + size * 2 + h}, {x: x - size * 2 - w, y: y}, {x: x, y: y - size * 2 - h}, {x: x + size * 2 + w, y: y}][dir];
-        set.translate(xy.x - w - bb.x, xy.y - h - bb.y);
-        return this.path(p).attr({fill: "#000", stroke: "none"}).insertBefore(set.node ? set : set[0]);
-    };
-    Raphael.fn.g.popup = function (x, y, text, dir, size) {
-        dir = dir == null ? 2 : dir;
-        size = size || 5;
-        text = text || "$9.99";
-        var res = this.set(),
-            d = 3;
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function (X, Y, withAnimation) {
-            X = X || x;
-            Y = Y || y;
-            var bb = this[1].getBBox(),
-                w = bb.width / 2,
-                h = bb.height / 2,
-                dx = [0, w + size * 2, 0, -w - size * 2],
-                dy = [-h * 2 - size * 3, -h - size, 0, -h - size],
-                p = ["M", X - dx[dir], Y - dy[dir], "l", -size, (dir == 2) * -size, -Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, -size, -size,
-                    "l", 0, -Math.max(h - size, 0), (dir == 3) * -size, -size, (dir == 3) * size, -size, 0, -Math.max(h - size, 0), "a", size, size, 0, 0, 1, size, -size,
-                    "l", Math.max(w - size, 0), 0, size, !dir * -size, size, !dir * size, Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, size, size,
-                    "l", 0, Math.max(h - size, 0), (dir == 1) * size, size, (dir == 1) * -size, size, 0, Math.max(h - size, 0), "a", size, size, 0, 0, 1, -size, size,
-                    "l", -Math.max(w - size, 0), 0, "z"].join(","),
-                xy = [{x: X, y: Y + size * 2 + h}, {x: X - size * 2 - w, y: Y}, {x: X, y: Y - size * 2 - h}, {x: X + size * 2 + w, y: Y}][dir];
-            if (withAnimation) {
-                this[0].animate({path: p}, 500, ">");
-                this[1].animate(xy, 500, ">");
-            } else {
-                this[0].attr({path: p});
-                this[1].attr(xy);
-            }
-            return this;
-        };
-        return res.update(x, y);
-    };
-    Raphael.fn.g.flag = function (x, y, text, angle) {
-        angle = angle || 0;
-        text = text || "$9.99";
-        var res = this.set(),
-            d = 3;
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function (x, y) {
-            this.rotate(0, x, y);
-            var bb = this[1].getBBox(),
-                h = bb.height / 2;
-            this[0].attr({path: ["M", x, y, "l", h + d, -h - d, bb.width + 2 * d, 0, 0, bb.height + 2 * d, -bb.width - 2 * d, 0, "z"].join(",")});
-            this[1].attr({x: x + h + d + bb.width / 2, y: y});
-            angle = 360 - angle;
-            this.rotate(angle, x, y);
-            angle > 90 && angle < 270 && this[1].attr({x: x - r - d - bb.width / 2, y: y, rotation: [180 + angle, x, y]});
-            return this;
-        };
-        return res.update(x, y);
-    };
-    Raphael.fn.g.label = function (x, y, text) {
-        var res = this.set();
-        res.push(this.rect(x, y, 10, 10).attr({stroke: "none", fill: "#000"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function () {
-            var bb = this[1].getBBox(),
-                r = Math.min(bb.width + 10, bb.height + 10) / 2;
-            this[0].attr({x: bb.x - r / 2, y: bb.y - r / 2, width: bb.width + r, height: bb.height + r, r: r});
-        };
-        res.update();
-        return res;
-    };
-    Raphael.fn.g.labelit = function (set) {
-        var bb = set.getBBox(),
-            r = Math.min(20, bb.width + 10, bb.height + 10) / 2;
-        return this.rect(bb.x - r / 2, bb.y - r / 2, bb.width + r, bb.height + r, r).attr({stroke: "none", fill: "#000"}).insertBefore(set[0]);
-    };
-    Raphael.fn.g.drop = function (x, y, text, size, angle) {
-        size = size || 30;
-        angle = angle || 0;
-        var res = this.set();
-        res.push(this.path(["M", x, y, "l", size, 0, "A", size * .4, size * .4, 0, 1, 0, x + size * .7, y - size * .7, "z"]).attr({fill: "#000", stroke: "none", rotation: [22.5 - angle, x, y]}));
-        angle = (angle + 90) * Math.PI / 180;
-        res.push(this.text(x + size * Math.sin(angle), y + size * Math.cos(angle), text).attr(this.g.txtattr).attr({"font-size": size * 12 / 30, fill: "#fff"}));
-        res.drop = res[0];
-        res.text = res[1];
-        return res;
-    };
-    Raphael.fn.g.blob = function (x, y, text, angle, size) {
-        angle = (+angle + 1 ? angle : 45) + 90;
-        size = size || 12;
-        var rad = Math.PI / 180,
-            fontSize = size * 12 / 12;
-        var res = this.set();
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x + size * Math.sin((angle) * rad), y + size * Math.cos((angle) * rad) - fontSize / 2, text).attr(this.g.txtattr).attr({"font-size": fontSize, fill: "#fff"}));
-        res.update = function (X, Y, withAnimation) {
-            X = X || x;
-            Y = Y || y;
-            var bb = this[1].getBBox(),
-                w = Math.max(bb.width + fontSize, size * 25 / 12),
-                h = Math.max(bb.height + fontSize, size * 25 / 12),
-                x2 = X + size * Math.sin((angle - 22.5) * rad),
-                y2 = Y + size * Math.cos((angle - 22.5) * rad),
-                x1 = X + size * Math.sin((angle + 22.5) * rad),
-                y1 = Y + size * Math.cos((angle + 22.5) * rad),
-                dx = (x1 - x2) / 2,
-                dy = (y1 - y2) / 2,
-                rx = w / 2,
-                ry = h / 2,
-                k = -Math.sqrt(Math.abs(rx * rx * ry * ry - rx * rx * dy * dy - ry * ry * dx * dx) / (rx * rx * dy * dy + ry * ry * dx * dx)),
-                cx = k * rx * dy / ry + (x1 + x2) / 2,
-                cy = k * -ry * dx / rx + (y1 + y2) / 2;
-            if (withAnimation) {
-                this.animate({x: cx, y: cy, path: ["M", x, y, "L", x1, y1, "A", rx, ry, 0, 1, 1, x2, y2, "z"].join(",")}, 500, ">");
-            } else {
-                this.attr({x: cx, y: cy, path: ["M", x, y, "L", x1, y1, "A", rx, ry, 0, 1, 1, x2, y2, "z"].join(",")});
-            }
-            return this;
-        };
-        res.update(x, y);
-        return res;
-    };
-
-    Raphael.fn.g.colorValue = function (value, total, s, b) {
-        return "hsb(" + [Math.min((1 - value / total) * .4, 1), s || .75, b || .75] + ")";
-    };
-
-    Raphael.fn.g.snapEnds = function (from, to, steps) {
-        var f = from,
-            t = to;
-        if (f == t) {
-            return {from: f, to: t, power: 0};
-        }
-        function round(a) {
-            return Math.abs(a - .5) < .25 ? Math.floor(a) + .5 : Math.round(a);
-        }
-        var d = (t - f) / steps,
-            r = Math.floor(d),
-            R = r,
-            i = 0;
-        if (r) {
-            while (R) {
-                i--;
-                R = Math.floor(d * Math.pow(10, i)) / Math.pow(10, i);
-            }
-            i ++;
-        } else {
-            while (!r) {
-                i = i || 1;
-                r = Math.floor(d * Math.pow(10, i)) / Math.pow(10, i);
-                i++;
-            }
-            i && i--;
-        }
-        var t = round(to * Math.pow(10, i)) / Math.pow(10, i);
-        if (t < to) {
-            t = round((to + .5) * Math.pow(10, i)) / Math.pow(10, i);
-        }
-        var f = round((from - (i > 0 ? 0 : .5)) * Math.pow(10, i)) / Math.pow(10, i);
-        return {from: f, to: t, power: i};
-    };
-    Raphael.fn.g.axis = function (x, y, length, from, to, steps, orientation, labels, type, dashsize) {
-        dashsize = dashsize == null ? 3 : dashsize;
-        type = type || "t";
-        steps = steps || 10;
-        var path = type == "|" || type == " " ? ["M", x + .5, y, "l", 0, .001] : orientation == 1 || orientation == 3 ? ["M", x + .5, y, "l", 0, -length] : ["M", x, y + .5, "l", length, 0],
-            ends = this.g.snapEnds(from, to, steps),
-            f = ends.from,
-            t = ends.to,
-            i = ends.power,
-            j = 0,
-            text = this.set();
-        d = (t - f) / steps;
-        var label = f,
-            rnd = i > 0 ? i : 0;
-            dx = length / steps;
-        if (+orientation == 1 || +orientation == 3) {
-            var Y = y,
-                addon = (orientation - 1 ? 1 : -1) * (dashsize + 3 + !!(orientation - 1));
-            while (Y >= y - length) {
-                type != "-" && type != " " && (path = path.concat(["M", x - (type == "+" || type == "|" ? dashsize : !(orientation - 1) * dashsize * 2), Y + .5, "l", dashsize * 2 + 1, 0]));
-                text.push(this.text(x + addon, Y, (labels && labels[j++]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr).attr({"text-anchor": orientation - 1 ? "start" : "end"}));
-                label += d;
-                Y -= dx;
-            }
-            if (Math.round(Y + dx - (y - length))) {
-                type != "-" && type != " " && (path = path.concat(["M", x - (type == "+" || type == "|" ? dashsize : !(orientation - 1) * dashsize * 2), y - length + .5, "l", dashsize * 2 + 1, 0]));
-                text.push(this.text(x + addon, y - length, (labels && labels[j]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr).attr({"text-anchor": orientation - 1 ? "start" : "end"}));
-            }
-        } else {
-            var X = x,
-                label = f,
-                rnd = i > 0 ? i : 0,
-                addon = (orientation ? -1 : 1) * (dashsize + 9 + !orientation),
-                dx = length / steps,
-                txt = 0,
-                prev = 0;
-            while (X <= x + length) {
-
-                text.push(txt = this.text(X, y + addon, (labels && labels[j++]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr));
-		var bb = txt.getBBox();
-		var ds = dashsize;
-                if (prev >= bb.x - 5) {
-		    text.pop(text.length - 1).remove();
-		    ds = 1;
-                } else {
-                    prev = bb.x + bb.width;
-                }
-
-		type != "-" && type != " " && (path = path.concat(["M", X + .5, y - (type == "+" ? ds : !!orientation * ds * 2), "l", 0, ds * 2 + 1]));
-                
-                label += d;
-                X += dx;
-            }
-            if (Math.round(X - dx - x - length)) {
-                type != "-" && type != " " && (path = path.concat(["M", x + length + .5, y - (type == "+" ? dashsize : !!orientation * dashsize * 2), "l", 0, dashsize * 2 + 1]));
-                text.push(this.text(x + length, y + addon, (labels && labels[j]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr));
-            }
-        }
-        var res = this.path(path);
-        res.text = text;
-        res.all = this.set([res, text]);
-        res.remove = function () {
-            this.text.remove();
-            this.constructor.prototype.remove.call(this);
-        };
-        return res;
-    };
-
-    Raphael.el.lighter = function (times) {
-        times = times || 2;
-        var fs = [this.attrs.fill, this.attrs.stroke];
-        this.fs = this.fs || [fs[0], fs[1]];
-        fs[0] = Raphael.rgb2hsb(Raphael.getRGB(fs[0]).hex);
-        fs[1] = Raphael.rgb2hsb(Raphael.getRGB(fs[1]).hex);
-        fs[0].b = Math.min(fs[0].b * times, 1);
-        fs[0].s = fs[0].s / times;
-        fs[1].b = Math.min(fs[1].b * times, 1);
-        fs[1].s = fs[1].s / times;
-        this.attr({fill: "hsb(" + [fs[0].h, fs[0].s, fs[0].b] + ")", stroke: "hsb(" + [fs[1].h, fs[1].s, fs[1].b] + ")"});
-    };
-    Raphael.el.darker = function (times) {
-        times = times || 2;
-        var fs = [this.attrs.fill, this.attrs.stroke];
-        this.fs = this.fs || [fs[0], fs[1]];
-        fs[0] = Raphael.rgb2hsb(Raphael.getRGB(fs[0]).hex);
-        fs[1] = Raphael.rgb2hsb(Raphael.getRGB(fs[1]).hex);
-        fs[0].s = Math.min(fs[0].s * times, 1);
-        fs[0].b = fs[0].b / times;
-        fs[1].s = Math.min(fs[1].s * times, 1);
-        fs[1].b = fs[1].b / times;
-        this.attr({fill: "hsb(" + [fs[0].h, fs[0].s, fs[0].b] + ")", stroke: "hsb(" + [fs[1].h, fs[1].s, fs[1].b] + ")"});
-    };
-    Raphael.el.original = function () {
-        if (this.fs) {
-            this.attr({fill: this.fs[0], stroke: this.fs[1]});
-            delete this.fs;
-        }
-    };
-})();
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load-big.gif b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load-big.gif
deleted file mode 100644
index ddb7ff1aac1b2fc825667c157873c2c55bbe8db8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1924
zcmciDX;70#00!U)Urs41ND>$<IY<H(l!}Qm1Op~uXvG6!aqxgpG!PI(p%Rco<Ol(R
zi8;U+z{nkl5+FiB%aI^QK+z%yD8(W&*cobVXWBodA^z!9I(4Sg?%&<nZ=d&_Z+Bl{
zz-})#1+)wF76e*ZSpk7SDJdzAj*iyW){~QyEEa2KW=5~qGnq_*Kwz5v^T4jGKj6;_
zq5B>3-?7cZa-C@o`?~}E+$na_sVK~an51Y7o6Am#OJGNBi-|v-0K)zTz!9cZZmYYj
zeiQ^4Hx2}<@9us*(zz1hB8-YDCx|yPvMXzQM{_K$!h*iJ(7x2j*bY>E<Y##L=B*_{
zt~@Tf;D$b$XAw}-;=bN;$~WyWxE|RPfkB^0hFr~hLPQ45J@u973;h#zCKAqjCS#yH
zH%lmq8|Ms7fD|8+$xF+wDXuHa9ZT|MHym=^RQqaxy3GP0O{Tex(#qS=4UIk>)v;gG
zt15c?^oIWX1BxEuJ?E}-N%%X2$C&X)nYafzWBB27BZK9$hH1k@-(v5=%efcJKAYA8
zj{X%G-GGGnp>xBKmtR{qyXkbXi>i|w&^A+i%*o~apB=fnp1EvhyA8i)zT0!ZJK|=f
zGujFu=8Q?f@YHB=vJ&Q(Q2ooMB$CxnsQ@;Cl88SakbL=c9-bR}Cd`4o_e-(kkx-G`
z1gxmM5nm)f#c{~lR_t33s5hr)1~uEaw)kjKO}BP*)>VmXx>RQ1;1H?TbtLMnaSW#;
zj9+XgO*q{nKEpjQb`O`&-Jk8B)-S0R`xoZlkUo^CY4otNIEG*Z>9xBj^;cd~XE!if
z=JK3SR%Kh!+&qgwp0nLox=TA*jYs?se%u2xUeoK&1u^$dFrFz~jrhLs@UeBBdpx|M
zY)D3CZeBjWKwtxdli{#JJ47_Xo<)bn10rN1&s7)?M_u%xDH4!1ac=bhs)DA9u4+yx
zQz*rfNSWBSxTLdtwZlQ%QWxV{Y9-?#zL7M}ttCzze@xWkN1wM3@#hRCqG74qOeC&J
z9C^RRzb6jvbS)W0Nd^=G0Xde#v6Z!xx5H+<MTWs8cpBa(WVz<zfm_qdzjif5)Y&5(
z5@}#g7Ah{xHJu7T&>VUZrNmDp2GD$ZAyrrw%!G2FskYEUNL97Eu}MQR$IyrnBk<XH
zm>g(h1rW4yIQEM3J@S3&;1KqjvtHc)u##|B-p#vH)WPhuYi^mQjj0C~N7S!=n7H-h
z)-{F0|AmmcM>roo8TLt*J%^c#&ZiY1FVl<B88lI<M7sJT?gvB25O91j3CyX)mf)49
z0DMmn)f5f;b~6ylB{Wc*LRI!=G0GGJ9np;FZ-5NaU^>9S>(#+iza>x4q)s+Z@gD1*
z@P^eR(w@FoxHWz6T{O`R|GvS0@PW)Hmm#QRgaoFdRCosCuGa!^PcBA73HQUcl65Dr
zO|`e<wN5pf`gk?&hN=o>PK2pY_S=Cuk0cLN5NYeIMmj@%E-?ilgU&#f%3S_8AdaDu
z`F^)`6_9BI%cf+|5|L?q0A9#NmQZLMl$0#@LkamJueh-M5`ik%{!(^MZk{k*qitzz
zdsl7?nA3Imb6iI@<iJ&olvs)#3RhzF)PBzaCle^P9uL(+rgU41v^QIg+C|Mm>->x5
zwXc~EZZLz-aKH4hJ%XN<9U8*$f;BXGrEQ^o=8paJ`*iQfV=)}tj7M$B9-E(t0}WI5
ziiH<<@gb})LXWcd=N1SGi;6?d9SD)&II^XLelX2e#DZKujgFz0`cy~Oo<~(uRW#l%
zG_=kVdRXZIt%P()d)_@2TRL5aa4qGGD&I4tJNR+p1a_1(jW-f!2MXqTpXs0WExsHx
Pn1F;$An(;T&^-PCGf5vc

diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load.gif b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load.gif
deleted file mode 100644
index d0bce1542342e912da81a2c260562df172f30d73..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 673
zcmZ?wbhEHb6krfw_{6~Q|Nnmm28Kh24mmkF0U1e2Nli^nlO|14{Lk&@8WQa67~pE8
zXTZz|lvDgC<y@4SSdyBeP@Y+mp^%uBSdo*Tn4*`NmzK|<_>+Z`3#dv5h=E26FfcG1
zbL_hF&)}42ws10s6^G;;cE1^EoUR)U5A70}d2pLv!jVIT7j&Z~EblI3x0K*v_sV|m
z0kj3v921Z^em#l`(k(o@H$3ZdDRc@9NidXDNbqrumReCGv$gd8+e8WW28HVqkJ_9i
zH>s*<31KtHjANIPvi2#*6BEu%3Dak5O_t&NBI)<h(<yPr>H?V$TxT}#l{vOTn<?_G
z_#ejR!~8}oQ>5naXTfF^&~Hhq+NX@#Ccc>y7T?;vjI&jdhsDsPJyAw*m0Qz>i}K7#
zL9w50<qa%!r20=RDYEpz>Ng{fT}A5JUe8lRK1h7_Y2;BWJDd=c6f&i?Wv5(5q?6|P
zQw{>maxZP<537OA37Uk}7@%_$4o$EWe_Zl>&#id|lE-BpDC#+Fn|msJ%_2h{Hg1vP
z#N8WAzfWasG}yq|xqE)DrWaOofX=z|?*pgc%{ig5vl!pqDlC|q&~Z0$&Rvsft&VO-
z4MZj+%-+Vx%W}v;V76hyp=;+R;x+~t^Q%*xuFTQAF2})fSfTHDAs>sO!OBw`)&)o$
c0!CNZt))x~rAZP^^P&YOFfdqy5)K#u0POD40{{R3

diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css
deleted file mode 100644
index a84d90e07c4..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-body { font-family: sans-serif; }
-
-div.fileSelector { border: solid 3px black; position: absolute; background: white; 
-		   -moz-border-radius: 10px; border-radius: 10px; 
-		   padding: 5px; font-family: sans-serif;
-		   right: 10px; top: 10px;
-		 }
-div.fileSelector a { cursor: pointer; }
-.fileSelector li.selectedFile { background: lightgreen; }
-
-div.selector { border: solid 3px black; position: absolute; background: white; 
-		   -moz-border-radius: 10px; border-radius: 10px; 
-		   padding: 5px; 
-		   right: 10px; top: 10px; background: #aaaaaa; opacity: 0.7;
-		 }
-div.selector a { cursor: pointer; }
-.fileSelector li.selectedFile { background: lightgreen; }
-
-#fileLoader  { -moz-border-radius: 10px; border-radius: 10px; background: #aaaaaa; opacity: 0.7; position: absolute; left: 20px; top: 20px; }
-#loadingScreen { position: absolute; top: 100px; margin-left: 40%; margin-right: 40%; width: 500px; background: #aaaaaa; opacity: 0.7; -moz-border-radius: 10px; border-radius: 10px; text-align: center }
-#filterinput { width: 500px; height: 100px; }
-/* main interface */
-#actions { float: right; }
-#views { float: left; }
-
-.closebutton { position: absolute; right: 5px; float: right; display: block; cursor: pointer; }
-
-.actionbutton { color: blue; text-decoration: none; padding: 3px; cursor: pointer; }
-span:hover.actionbutton { background: lightblue;  }
-
-#status { text-align: center; }
-
-#canvas { width: 100%; height: 1000px; }
-
-#logtable { width: 100%; }
-.popUp { border: 3px solid black; -moz-border-radius: 10px; border-radius: 10px; position: absolute; background: white; padding: 10px; min-width: 300px; }
-
-.errorpage { position: absolute; top: 100px; margin-left: 40%; margin-right: 40%; width: 500px; background: #aaaaaa; opacity: 0.7; -moz-border-radius: 10px; border-radius: 10px; padding: 10px; }
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
deleted file mode 100644
index 51d47795a8a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
+++ /dev/null
@@ -1,262 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph = function(canvas, status) {
-    this.canvas = document.getElementById(canvas);
-    this.status = document.getElementById(status);
-    this.starttime = 0;
-    this.endtime = 0;
-    this.period = 0;
-    this.numEntries = 0;
-    this.currentRender = 0;
-    this.filter = "";
-
-    this.saveFilters = function () {
-	localStorage.starttime = this.starttime;
-	localStorage.endtime = this.endtime;
-	localStorage.period = this.period;
-	localStorage.filter = this.filter;
-	
-    };
-    this.loadFilters = function () {
-	if (localStorage.starttime) { this.starttime = parseInt(localStorage.starttime); }
-	if (localStorage.endtime) { this.endtime = parseInt(localStorage.endtime); }
-	if (localStorage.period) { this.period = parseInt(localStorage.period); }
-	if (localStorage.filter) { this.filter = localStorage.filter; }
-    };
-    this.loadFilters();
-    var self = this;
-
-    var updateStatus = function (starttime, period, filter, numEntries) {
-	self.starttime = starttime;
-	self.endtime = starttime + period;
-	self.period = period;
-	self.filter = filter;
-	self.saveFilters(); 
-       
-	self.status.innerHTML = dateFormat(starttime, "HH:MM:ss,l") + " &rArr; " + dateFormat(self.endtime, "HH:MM:ss,l") + " &nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp; " + numEntries + " entries  &nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp; " +  (filter ? filter : "No filter");
-	
-	if (self.currentRender) {
-	    self.currentRender();
-	}
-    };
-	
-    YUI().use("io-base", function(Y) {
-	    var uri = "/info";
-	    if (self.starttime) {
-		var uri = "/info?start=" + self.starttime + "&period=" + self.period + "&filter=" + self.filter;
-	    }
-	    
-	    function complete(id, o, args) {
-		var data = eval("(" + o.responseText + ")"); // Response data.
-		var period = data.endTime - data.startTime;
-		updateStatus(data.startTime, period, self.filter, data.numEntries);
-	    };
-	    
-	    Y.on('io:complete', complete, Y, []);
-	    var request = Y.io(uri);
-	});
-    
-    this.addLogs = function() {
-	new LogGraph.fileSelector(function (files) { new LogGraph.fileLoader(files); });
-    };
-
-    this.editFilters = function() {
-	new LogGraph.filterSelector(this.starttime, this.period, this.filter, updateStatus);
-    };	
-	
-    this.getCleanCanvas = function () {
-	this.canvas.innerHTML = "";
-	return this.canvas;
-    };
-
-    this.showLoadingScreen = function () {
-	this.loadingScreen = document.createElement("div");
-	this.loadingScreen.id = "loadingScreen";
-	this.loadingScreen.innerHTML = "<img src=\"load-big.gif\" /> <p>Loading...</p>";
-	document.body.appendChild(this.loadingScreen);
-    };
-
-    this.hideLoadingScreen = function () {
-	document.body.removeChild(this.loadingScreen);
-	this.loadingScreen.style.visibility = "hidden";
-    };
-
-
-    /***
-     * TODO: refactor these to load the data first, before handing to a draw function.
-     *       We shouldn't pass the async q into the drawing function
-     */
-    this.showLogs = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var loggraph = new LogGraph.LogTable(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.showLogs;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-
-    this.serverGraph = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var servergraph = new LogGraph.ServerGraph(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.showLogs;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-    
-    this.sessionGraph = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var sessiongraph = new LogGraph.SessionGraph(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.sessionGraph;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-    
-    this.showStats = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var statgraph = new LogGraph.StatsGraph(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.showStats;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-};
-
-LogGraph.error = function(description) {
-    var errorPage = document.createElement("div");
-    errorPage.className = "errorpage";
-    var p = document.createElement("p");
-    p.innerHTML = description;
-    errorPage.appendChild(p);
-    
-    var span = document.createElement("span");
-    p = document.createElement("p");
-    span.className = "actionButton";
-    span.innerHTML = "OK";
-    span.onclick = function (evt) {
-	document.body.removeChild(errorPage);
-	delete errorPage;
-    }
-    p.appendChild(span);
-    errorPage.appendChild(p);
-
-    document.body.appendChild(errorPage);
-};
-
-LogGraph.ticker =function(allow_dups) {
-    this.ticks = new Array();
-    this.current_tick = 0;
-    this.allow_dups = allow_dups;;
-    
-    this.tick = function(time) {
-	if (time == this.ticks[this.ticks.length - 1] && this.allow_dups == true) 
-	    return this.current_tick;
-	
-	this.ticks.push(time);
-	return this.current_tick++;
-    };
-    
-    this.current = function() {
-	return this.current_tick;
-    };
-    
-    this.reset = function() {
-	while (this.ticks.length) {
-	    this.ticks.pop();
-	}
-	this.current_tick = 0;
-    };
-};
-
-
-LogGraph.timescale = function(starttime, endtime) {
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.millis = endtime - starttime;
-    
-    this.draw = function(paper) {
-	var scale = paper.set();
-	scale.push(paper.path("M0 0 L" + paper.width + " 0"));
-	
-	for (var i = 0; i < paper.width; i += 100) {
-	    scale.push(paper.path("M" + i + " 0 L" + i + " 5"));
-	    //		var time = dateFormat((this.starttime + (i*ms_per_pixel)), "h:MM:ss,l");
-		//	paper.text(i + 5, 10, time);
-	}
-	
-	scale.attr({"stroke-width": 2});
-    };
-};
-
-/*
-  Fetch data from an uri and process it, the process data func returns true if any of the data is useful  
-*/
-LogGraph.loadData = function (asyncq, uri, processdata) {
-    YUI().use("io-base", function(Y) {
-	    function success(id, o, args) {
-		var data = eval("(" + o.responseText + ")"); // Response data.
-		if (data.error) {
-		    LogGraph.error(data.error);
-		} else {
-		    if (!processdata(data)) {
-			LogGraph.error("No data. Perhaps you should loosen your filter criteria.");
-		    }
-		}
-		asyncq.run();
-	    };
-	    function failure(id, o, args) {
-		LogGraph.error("Error contacting server: (" + o.status + ") " + o.statusText);
-		asyncq.run();
-	    };
-
-	    Y.on('io:success', success, Y, []);
-	    Y.on('io:failure', failure, Y, []);
-	    
-	    var request = Y.io(uri);
-	});
-}
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js
deleted file mode 100644
index 551ea4b2373..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.LogTable = function (asyncq, canvas, starttime, endtime, filter) {
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.filter = filter;
-
-    var table = document.createElement("table");
-    table.id = "logtable";
-    canvas.appendChild(table);
-
-    this.addLogLine = function(time, text) {
-	var tr = document.createElement("tr");
-	table.appendChild(tr);
-	
-	var td = document.createElement("td");
-	td.innerHTML = dateFormat(time, "h:MM:ss,l");
-	tr.appendChild(td);
-
-	td = document.createElement("td");
-	td.innerHTML = text;
-	tr.appendChild(td);
-    }
-
-    var self = this;
-    var processdata = function(data) {
-	var events = data["events"];
-	var count = 0;
-	for (var i in events) {
-	    var e = events[i];
-	    if (e.type == "text") {
-		self.addLogLine(e.time, e.text);
-		count++;
-	    }
-	}
-	return count != 0;
-    };
-
-    var uri = "/data?start=" + self.starttime + "&end=" + self.endtime + "&filter=" + self.filter; 
-    LogGraph.loadData(asyncq, uri, processdata);
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
deleted file mode 100644
index 0b63be7ac48..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
+++ /dev/null
@@ -1,329 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.ServerGraph = function(asyncq, canvas, starttime, endtime, filter) {
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.millis = endtime - starttime;
-    this.nextserverid = 0;
-    this.serveroffset = 100;
-    this.filter = filter;
-    
-    this.pixels_per_tick =  20;
-    this.ticker = new LogGraph.ticker();
-
-    
-    var paper = Raphael(canvas, 1, 1);
-
-    var self = this;
-
-    this.timescale = new LogGraph.timescale(starttime, endtime);
-    this.objects = new Array();
-    
-    this.add = function(obj) {
-	this.objects.push(obj);
-    }
-    
-    this.tick_to_x = function (timestamp) {
-	var x = timestamp * this.pixels_per_tick; 
-	return x;
-    }; 
-    
-    this._drawTime  = function(paper, x, time) {
-	var p = paper.path("M" + x + " 0 L" + x + " " + paper.height);
-	var t = paper.text(x, 10, dateFormat(time, "h:MM:ss,l"));
-	
-	t.hide();
-	p.mouseover(function(evt) {
-		t.show();
-		p.attr({stroke: "red"});
-	    });
-	p.mouseout(function(evt) {
-		t.hide();
-		p.attr({stroke: "lightgray"});
-	    });
-	
-	return p;
-    };
-    
-    this.draw = function(paper) {
-	var grid = paper.set();
-	for (var i = 0; i < paper.height; i += 20) {
-	    grid.push(paper.path("M0 " + i + " L" + paper.width + " " + i));
-	}
-	var lasttick = this.starttime;
-	var scale = 500; // 500 ms
-	
-	var y = 0;
-	
-	for (var t = 0, len = this.ticker.ticks.length; t < len; t++) {
-	    var basex = t * this.pixels_per_tick;
-	    var thistick = this.ticker.ticks[t];
-	    var nexttick = t + 1 == this.ticker.ticks.length ? this.endtime : this.ticker.ticks[t+1];
-	    if (nexttick == thistick) {
-		continue;
-	    }
-	    var time = thistick - lasttick;
-	    var first = scale - (lasttick % scale);
-	    
-	    /*		for (var i = 0; (first+scale*i) < time; i++) {
-			
-			var toffset = first+scale*i;
-			var x = basex + LogGraph._pixels_per_tick * toffset/time;
-			grid.push(this._drawTime(paper, x, lasttick + toffset, grid));
-			
-			}*/
-	    
-	    
-	    //grid.push(paper.path("M" + i + " 0 L" + i + " " + paper.height));
-	    lasttick = thistick;
-	}
-	grid.attr({stroke: "lightgray"});
-	this.timescale.draw(paper);
-	
-	for (o in this.objects) {
-	    this.objects[o].draw(paper);
-	}
-    };
-
-
-    var processdata = function(data) {
-	var servermap = {};
-	var servers = data.servers;
-	var count = 0;
-	for (s in servers) {
-	    var server = new LogGraph.ServerGraph.server(self, "Server " + servers[s]);
-	    servermap[servers[s]] = server;
-	    self.add(server);
-	    count++;
-	}
-	
-	var messages = {};
-	var events = data.events;
-	for (var i in events) {
-	    var e = events[i];
-	    var t = e.time;
-	    if (e.type == "stateChange") {
-		servermap[e.server].addState(e.state, self.ticker.tick(e.time));
-	    }
-	    if (e.type == "postmessage") {
-		src = servermap[e.src];
-		dst = servermap[e.dst];
-		var key = "key:s" + e.src + ",d" + e.dst + ",z" + e.zxid;
-		    
-		var m = new LogGraph.ServerGraph.message(self, src, self.ticker.tick(e.time), dst, e.zxid);
-		messages[key] = m;
-	    } 
-	    if (e.type == "delivermessage") {
-		var key = "key:s" + e.src + ",d" + e.dst + ",z" + e.zxid;
-		
-		var m = messages[key];
-		if (m) {
-		    m.dsttime = self.ticker.tick(e.time);
-		    m.name = "Propose";
-		    self.add(m);
-		    delete messages[key];
-		}
-	    } 
-	    if (e.type == "exception") {
-		servermap[e.server].addException(self.ticker.tick(e.time), e.text, e.time);
-	    }
-	    count++;
-	}
-	
-	for (var i in messages) {
-	    var m = messages[i];
-	    m.markIncomplete();
-	    self.add(m);
-	    count++;
-	}
-
-	if (count != 0) {
-	    paper.setSize(self.tick_to_x(self.ticker.current()), 1000);	    
-	    
-	    var line = paper.path("M0 0 L0 1000");	    
-	    line.attr({"stroke": "red", "stroke-dasharray": "- "});
-	    var base = canvas.offsetLeft;// + ((canvas.offsetWidth - paper.width)/2);
-	    canvas.onmousemove = function (evt) {
-		var x = evt.screenX - base;
-		
-		line.attr({"path": "M" + x + " 0 L"+ x +" 1000"});
-		
-	    };
-
-	    self.draw(paper);
-	    return true;
-	} else {
-	    return false;
-	}
-    };
-		
-    var uri = "/data?start=" + self.starttime + "&end=" + self.endtime + "&filter=" + filter;
-
-    LogGraph.loadData(asyncq, uri, processdata);    
-};
-
-LogGraph.ServerGraph.server = function (graph, name) {
-    this.graph = graph;
-    this.serverid = graph.nextserverid++;
-    this.name = name;
-    this.y = (this.serverid * 300 + graph.serveroffset);
-    this.states = new Array();
-    this.exception = new Array();
-    
-    this.addState = function(state, time) {
-	this.states.push([state, time]);
-    }
-    
-    this.addException = function(tick, exception, time) {
-	this.exception.push(new LogGraph.ServerGraph.exception(this.graph, tick, exception, time));
-    }
-    
-    this.draw = function(paper) {
-	var st = paper.set();
-	st.push(paper.path("M0 " + this.y + " L" + paper.width + " " + this.y));
-	st.push(paper.text(20, this.y - 10, this.name));
-	st.attr({stroke: "gray"});
-	
-	var numstates = this.states.length;
-	
-	for (s = 0; s < numstates; s++) {
-	    var style = {};
-	    switch (this.states[s][0]) {
-	    case "INIT": style = {stroke: "yellow", "stroke-width":3}; break;
-	    case "FOLLOWING": style = {stroke: "lightgreen", "stroke-width":7}; break;
-	    case "LEADING": style = {stroke: "green", "stroke-width":10}; break;
-	    case "LOOKING": style = {stroke: "orange", "stroke-width":5}; break;
-	    }
-	    var startx = this.graph.tick_to_x(this.states[s][1]);
-	    var endx = s + 1 < numstates ? this.graph.tick_to_x(this.states[(s+1)][1]) : paper.width;
-	    var p = paper.path("M" + startx + " " + this.y + " L" + endx + " " + this.y);
-	    p.attr(style);
-	}
-	
-	for (e in this.exception) {
-	    this.exception[e].draw(paper, this);
-	}
-    }
-};    
-    
-LogGraph.ServerGraph.message = function(graph, src, srctime, dst, zxid) {
-    this.graph = graph;
-    this.src = src;
-    this.srctime = srctime;
-    this.dst = dst;
-    this.dsttime = 0; //dsttime;
-    this.name = "Unknown";
-    this.zxid = zxid;
-    this.moreinfo = "No extra information";
-    this.incomplete = false;
-    
-    this.markIncomplete = function() {
-	this.incomplete = true;
-	this.dsttime = this.srctime;
-    }
-
-    this.draw = function(paper) {
-	var srcx = this.graph.tick_to_x(this.srctime);
-	var dstx = this.graph.tick_to_x(this.dsttime);
-	
-	var arrow = paper.set();
-	var p = paper.path("M" + srcx + " " + this.src.y + " L" + dstx + " " + this.dst.y);
-	arrow.push(p);
-	
-	var tx = (srcx + dstx)/2;
-	var ty = (this.src.y + this.dst.y)/2;
-	var t = paper.text(tx, ty, this.name);
-	
-	var gradient = (this.dst.y - this.src.y)/(dstx - srcx);
-	var angle = Math.atan(gradient) * 57.2958;
-	t.rotate(angle, true);
-	
-	var arrowl = paper.path("M" + dstx + " " + this.dst.y + " L" + (dstx - 10) +" " + this.dst.y);
-	arrowl.rotate(angle + 20, dstx, this.dst.y);
-	arrow.push(arrowl);
-	var arrowr = paper.path("M" + dstx + " " + this.dst.y + " L" + (dstx - 10) +" " + this.dst.y);
-	arrowr.rotate(angle - 20, dstx, this.dst.y);
-	arrow.push(arrowr);
-	
-	arrow.attr({"stroke-width": 2, stroke: "gray"});
-	if (this.incomplete) {
-	    arrow.attr({"stroke-dasharray": "- .", stroke: "pink", "stroke-width": 2});
-	}
-	arrow.mouseover(function(evt) {
-		t.attr({"font-size": 20});
-		arrow.attr({stroke: "red", "stroke-width": 3});
-	    });
-	arrow.mouseout(function(evt) {
-		t.attr({"font-size": 10});
-		
-		if (this.incomplete) {
-		    arrow.attr({stroke: "pink", "stroke-width": 2});
-		} else {
-		    arrow.attr({stroke: "gray", "stroke-width": 2});
-		}
-	    });
-	
-	
-
-	arrow.click(function(evt) { 
-		var popup = document.createElement("div");
-		popup.className = "popUp";
-		popup.innerHTML = "zxid: " + parseInt(this.zxid).toString(16);
-
-		popup.style.top = evt.clientY;
-		popup.style.left = evt.clientX;
-		document.body.appendChild(popup);
-
-		popup.onclick = function(evt) { 
-		    document.body.removeChild(popup);
-		};
-	    });
-    }
-};
-    
-LogGraph.ServerGraph.exception = function(graph, tick, exceptiontext, time) {
-    this.graph = graph;
-    this.time = time;
-    this.text = exceptiontext;
-    this.tick = tick;
-    
-    var self = this;
-
-    this.draw = function(paper, server) {
-	var center = this.graph.tick_to_x(this.tick);
-	var p = paper.circle(center, server.y, 5);
-	p.attr({stroke: "orange", fill: "red"});
-	
-	p.mouseover(function(evt) {
-		p.popup = document.createElement("div");
-		p.popup.className = "popUp";
-		p.popup.innerHTML = self.text.replace("\n", "<br/>");;
-		p.popup.style.top = server.y + 50;
-		p.popup.style.left = center + 25;
-		document.body.appendChild(p.popup);
-
-		p.animate({r: 10}, 500, "elastic");
-	    });
-	p.mouseout(function(evt) {
-		document.body.removeChild(p.popup);
-		p.animate({r: 5}, 100);
-	    });
-    }
-};
-    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js
deleted file mode 100644
index 5a314d8a120..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js
+++ /dev/null
@@ -1,202 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.SessionGraph = function (asyncq, canvas, starttime, endtime, filter) {
-    this.sessions = new Array();
-    this.counter = 0;
-    this.exceptions = new Array();
-    
-    this.pix_per_ticks = 4;
-    this.pix_per_session = 7;
-
-    var paper = Raphael(canvas, 1, 1);
-    this.ticker = new LogGraph.ticker();
-    var self = this;
-
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.filter = filter;
-
-    this.findOrCreateSession = function(id) {
-	if (this.sessions[id] == undefined) {
-	    this.sessions[id] = new LogGraph.SessionGraph.session(this, ++this.counter, id);
-	}
-	return this.sessions[id];
-    }
-    
-    this.height = function () { return this.counter * this.pix_per_session + 10; };
-    this.width = function () { return (self.ticker.current() * this.pix_per_ticks); };
-
-    this.draw = function(paper) {
-	
-
-	var line = paper.path("M0 0 L0 " + this.height());	    
-	line.attr({"stroke": "red", "stroke-dasharray": "- "});
-	var base = canvas.offsetLeft;
-	var width = this.width();
-	canvas.onmousemove = function (evt) {
-	    var x = evt.clientX - base;
-
-	    line.attr({"path": "M" + x + " 0 L" + x + " " + self.height() });
-	};	
-	
-	for (var i in this.sessions) {
-	    var s = this.sessions[i];
-	    s.draw(paper);
-	}
-    };
-
-    var processdata = function(data) {
-	var count = 0;
-	for (var i in data.events) {
-	    var e = data.events[i];
-	    if (e.type == "transaction") {
-		e.tick = self.ticker.tick(e.time, true);
-		var session = self.findOrCreateSession(e.client);
-		session.addEvent(e);
-		count++;
-	    }
-	}
-	paper.setSize(self.width(), self.height());
-	
-	if (count != 0) {
-	    self.draw(paper);
-	    return true;
-	} else {
-	    return false;
-	}
-    };
-    
-    var uri = "/data?start=" + self.starttime + "&end=" + self.endtime + "&filter=" + filter;
-
-    LogGraph.loadData(asyncq, uri, processdata);    
-};
-
-LogGraph.SessionGraph.sessionevent = function () {
-    this.time = time;
-    this.type = type;
-    this.client = client;
-    this.cxid = cxid;
-    this.zxid = zxid;
-    this.op = op;
-    this.extra = extra;
-};
-
-LogGraph.SessionGraph.sessionEventPopup = function (obj, e, x, y) {
-    obj.click(function(evt) {
-	    var popup = document.createElement("div");
-	    popup.className = "popUp";
-
-	    var closebutton = document.createElement("div");
-	    closebutton.className = "closebutton";
-	    closebutton.title = "Close popup";
-	    closebutton.innerHTML = "&times;";
-	    popup.appendChild(closebutton);
-	    closebutton.onclick= function(evt) { popup.style.visibility = "hidden"; document.body.removeChild(popup) };
-	    var txt = document.createElement("span");
-	    txt.innerHTML = "session: " + e.client + "<br/>op: " + e.op + "<br/>zxid: " + e.zxid + "<br/>time: " + e.time + "<br/>extra: " + e.extra;
-	    popup.appendChild(txt);
-	    
-	    popup.style.top = y;
-	    popup.style.left = x;
-	    document.body.appendChild(popup);
-	    
-	    YUI().use('dd-drag', function(Y) {
-		    //Selector of the node to make draggable
-		    var dd = new Y.DD.Drag({
-			    node: popup
-			});   
-		});
-	});
-};
-    
-LogGraph.SessionGraph.session = function (graph, index, id) {
-    this.index = index;
-    this.id = id;
-    this.graph = graph;
-    
-    this.events = new Array();
-    this.starttick = 0;
-    this.endtick = undefined;
-    
-    this.addEvent = function(e) {
-	this.events.push(e);
-	
-	if (e.op == "createSession") {
-	    //		document.write("createSession for " + id.toString(16));
-	    this.starttick = e.tick;
-	} else if (e.op == "closeSession") {
-	    this.endtick = e.tick;
-	}
-    },
-    
-    this._attach_action = function (sess, label) {
-	sess.mouseover(function(evt) {
-		label.show();
-		sess.attr({stroke: "gray"});
-	    });
-	
-	sess.mouseout(function(evt) {
-		label.hide();
-		sess.attr({stroke: "black"});
-	    });
-    },
-    
-    this.drawEvent = function (paper, y, e) {
-	var x = e.tick * this.graph.pix_per_ticks;;
-	var s = paper.path("M" + x + " " + (y - 3) + " L" + x + " " + (y + 3));
-	s.attr({"stroke-width": 2});
-	if (e.op == "error") {
-	    s.attr({"stroke": "red"});
-	} 
-	s.mouseover(function(evt) {
-		s.attr({"stroke-width": 5});
-	    });
-	
-	s.mouseout(function(evt) {
-		s.attr({"stroke-width": 2});
-	    });
-	
-	LogGraph.SessionGraph.sessionEventPopup(s, e, x, y);
-    },
-    
-    this.draw = function(paper) {
-	var y = this.index*this.graph.pix_per_session;;
-	var start = this.starttick * this.graph.pix_per_ticks;
-	var end = this.endtick * this.graph.pix_per_ticks;
-	
-	var sess = paper.set();
-	
-	if (this.endtick == undefined) {
-	    end = this.graph.width();
-	} 
-
-	sess.push(paper.path("M" + start + " " + y + " L" + end + " " + y));
-	for (var i in this.events) {
-	    var e = this.events[i];
-	    this.drawEvent(paper, y, e);
-	}
-	
-	//sess.attr({"stroke-width": 3});
-	label = paper.text(start + 100, y, this.id);
-	label.attr({"font-size": "14px"});
-	label.hide();
-	this._attach_action(sess, label);
-    }
-};
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js
deleted file mode 100644
index 0a8ac4fcce0..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.StatsGraph = function (asyncq, canvas, starttime, endtime, filter) {
-    var processdata = function(data) {
-	var r = Raphael(canvas);
-	var x = data.map(function (x) { return x.time; });
-	var y = data.map(function (x) { return x.count; });
-	var xlabels = data.map(function (x) { return dateFormat(x.time, "HH:MM:ss,l"); } );
-	var h1 = function () {
-	    this.tags = r.set();
-	    for (var i = 0, ii = this.y.length; i < ii; i++) {
-		this.tags.push(r.g.tag(this.x, this.y[i], this.values[i], 160, 10).insertBefore(this).attr([{fill: "#fff"}, {fill: this.symbols[i].attr("fill")}]));
-	    }
-	};
-	var h2 = function () {
-	    this.tags && this.tags.remove();
-	};
-	r.g.linechart(40, 40, 1000, 500,  x, y, {shade: true, axis: "0 0 1 1", symbol: "x", southlabels: xlabels, axisxstep: xlabels.length - 1 , westAxisLabel: "Write requests", southAxisLabel: "Time (min)"}).hoverColumn(h1, h2);
-
-	return true;
-	//r.g.barchart(0, 0, 1000, 100,  y, {shade: true, symbol: "x"}).hoverColumn(h1, h2);
-    };
-    
-    var uri = "/throughput?scale=minutes";
-    LogGraph.loadData(asyncq, uri, processdata);    
-};
-
-    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js
deleted file mode 100644
index 819765a3e4b..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js
+++ /dev/null
@@ -1,377 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// Opens a window to load files into the engine
-LogGraph.fileSelector = function(callback) {
-    var self = this;	
-    this.callback = callback;
-    this.selectedFiles = new Array();
-    
-    var divTag = document.createElement("div");
-    divTag.id = "fileSelector" + Math.round(Math.random()*100000);
-    //	divTag.className = "popUp";
-    divTag.className = "selector fileSelector";
-    document.body.appendChild(divTag);
-    
-    YUI().use('dd-drag', function(Y) {
-	    //Selector of the node to make draggable
-	    var dd = new Y.DD.Drag({
-			node: '#' + divTag.id
-		});   
-	});
-    
-    var list = document.createElement("ul");
-    divTag.appendChild(list);
-    var selectedList = document.createElement("selectedlist");
-    divTag.appendChild(selectedList);
-    
-    var clearanchor = document.createElement("span");
-    clearanchor.innerHTML = "Remove All";
-    clearanchor.className = "actionbutton";
-    clearanchor.style.cssFloat = "right";
-    clearanchor.onclick = function () {
-	self.selectedFiles = new Array();
-	self.updateSelectedList();
-    };
-    divTag.appendChild(clearanchor);
-    
-    var doneanchor = document.createElement("span");
-    doneanchor.innerHTML = "Process Files";
-    doneanchor.className = "actionbutton";
-    doneanchor.style.cssFloat = "left";
-    doneanchor.onclick = function () {
-	self.callback(self.selectedFiles);
-	document.body.removeChild(divTag);
-	delete divTag;
-    };
-    divTag.appendChild(doneanchor);
-    
-    var cancelanchor = document.createElement("span");
-    cancelanchor.innerHTML = "Cancel";
-    cancelanchor.className = "actionbutton";
-    cancelanchor.style.cssFloat = "left";
-    cancelanchor.onclick = function () {
-	document.body.removeChild(divTag);
-	delete divTag;
-    };
-    divTag.appendChild(cancelanchor);
-    
-    this.createFileListItem = function (file) {
-	var li = document.createElement("li");
-	var a = document.createElement("a");
-	if (file.type == "D") {
-	    a.innerHTML = file.file + "/";
-	    a.onclick = function () { self.updateList(file.path); };
-	} else {
-	    a.innerHTML = file.file;
-	    a.onclick = function () { self.addSelectedFile(file.path); };
-	}
-	
-	a.fullpath = file.path;;
-	li.appendChild(a);
-	return li;
-    };
-    
-    this.addSelectedFile = function (file) {
-	if (this.selectedFiles.indexOf(file) == -1) {
-	    this.selectedFiles.push(file);
-	    this.updateSelectedList();
-	}
-    };
-    
-    this.removeSelectedFile = function (file) {
-	this.selectedFiles = this.selectedFiles.filter(function(f) { return !(file == f); });
-	this.updateSelectedList();
-    };
-    
-    this.createSelectedListItem = function (file) {
-	var li = document.createElement("li");
-	var a = document.createElement("a");
-	li.className = "selectedFile";
-	a.onclick = function () { self.removeSelectedFile(file); };
-	a.innerHTML = file;
-	li.appendChild(a);
-	return li;
-    };
-    
-    this.updateSelectedList = function () {
-	while (selectedList.firstChild) { selectedList.removeChild(selectedList.firstChild); }
-	
-	for (var i in this.selectedFiles) {
-	    var f = this.selectedFiles[i];
-	    selectedList.appendChild(this.createSelectedListItem(f));
-	}
-    };
-    
-    this.updateList = function (base) {
-	while (list.firstChild) list.removeChild(list.firstChild);
-	
-	// Create a YUI instance using io-base module.
-	YUI().use("io-base", function(Y) {
-		var uri = "/fs?path=" + base;
-		
-		// Define a function to handle the response data.
-		function complete(id, o, args) {
-		    var id = id; // Transaction ID.
-		    var data = eval("(" + o.responseText + ")"); // Response data.
-		    var parts = base.split("/").slice(0,-1);
-		    var parent = ""
-			if (parts.length < 2) {
-			    parent = "/";
-			} else {
-			    parent = parts.join("/");
-			}
-		    if (base != "/") {
-			var li = self.createFileListItem({"file": "..", type: "D", path: parent});
-			list.appendChild(li);
-		    }
-		    for (var i in data) {
-			var f = data[i];
-			if (f.file[0] != '.') {
-			    var li = self.createFileListItem(f);
-			    list.appendChild(li);
-			}
-		    }
-		};
-		
-		Y.on('io:complete', complete, Y, []);
-		var request = Y.io(uri);
-	    });
-    };
-    
-    this.updateList("/");
-};
-
-// Open a window which loads files into the engine
-LogGraph.fileLoader = function(files) {
-    var div = document.createElement("div");
-    div.id = "fileLoader";
-    
-    var imgArray = new Array();
-    var pArray = new Array();
-    for (var index in files) {
-	var f = files[index];
-	var p = document.createElement("p");
-	var i = document.createElement("img");
-	i.src = "load.gif";
-	i.style.visibility = "hidden";
-	imgArray.push(i);
-	pArray.push(p);
-	var span = document.createElement("span");
-	span.innerHTML = f;
-	
-	p.appendChild(span);
-	p.appendChild(i);
-	
-	div.appendChild(p);
-    }
-    
-    var loadFile = function (index) {
-	// Create a YUI instance using io-base module.
-	YUI().use("io-base", function(Y) {
-		var file = files[index];
-		    var uri = "/loadfile?path=" + file;
-		imgArray[index].style.visibility = "visible";
-		
-		// Define a function to handle the response data.
-		function complete(id, o, args) {
-		    var id = id; // Transaction ID.
-			var data = eval("(" + o.responseText + ")"); // Response data.
-			if (data.status == "ERR") {
-			    var err = document.createElement("div");
-			    err.innerHTML = data.error;
-			    pArray[index].appendChild(err);
-			} else if (data.status == "OK") {
-			    var ok = document.createElement("div");
-			    ok.innerHTML = "OK";
-			    pArray[index].appendChild(ok);
-			}
-			
-			imgArray[index].style.visibility = "hidden";
-			if (index + 1 < files.length) {
-			    loadFile(index + 1);
-			} else {
-			    //alert("DONE");
-			}
-		};
-		
-		Y.on('io:complete', complete, Y, []);
-		var request = Y.io(uri);
-	    });
-    };
-	
-    var doneanchor = document.createElement("a");
-    doneanchor.className = "actionbutton";
-    doneanchor.innerHTML = "Done";
-    doneanchor.onclick = function () {
-	document.body.removeChild(div);
-	delete div;
-    };
-    
-    document.body.appendChild(div);
-    if (files.length > 0) {
-	loadFile(0);
-    } else {
-	div.innerHTML ="No files to load";
-    }
-    div.appendChild(doneanchor);
-}
-
-// select a time period
-LogGraph.filterSelector = function(starttime, period, filter, callback) {
-    var self = this;	
-    this.callback = callback;
-    
-    // Container other widgets will be in
-    var container = document.createElement("div");
-    container.id = "filterSelector" + Math.round(Math.random()*100000);
-    container.className = "selector filterSelector";
-    document.body.appendChild(container);
-    
-    YUI().use('dd-drag', function(Y) {
-	    //Selector of the node to make draggable
-	    var dd = new Y.DD.Drag({
-		    node: '#' + container.id
-		});   
-	});
-    
-    // Temporary loading screen
-    var loadingp = document.createElement("p");
-    loadingp.innerHTML = "Loading...";
-    var loadimg = document.createElement("img");
-    loadimg.src = "load.gif";
-    loadingp.appendChild(loadimg);
-    container.appendChild(loadingp);
-    
-    var addWithLabel = function (container, labeltxt, object) {
-	var p = document.createElement("p");
-	var label = document.createElement("label");
-	label.innerHTML = labeltxt + ":";
-	p.appendChild(label);
-	p.appendChild(object);
-	container.appendChild(p);
-    };
-    var draw = function(minstart, maxstart, entries) { 
-	container.removeChild(loadingp);
-	var inittime = minstart > starttime ? minstart : starttime;
-	
-	var numEntries = 0;
-	var startspan = document.createElement("span");
-	addWithLabel(container, "Start time", startspan);
-	var startinput = document.createElement("input");
-	startinput.type = "hidden";
-	startinput.value = inittime;
-	container.appendChild(startinput);
-	var sliderspan = document.createElement("span");
-	container.appendChild(sliderspan);
-	
-	var countspan = document.createElement("p");
-	countspan.innerHTML = entries + " entries";;
-	container.appendChild(countspan);
-	
-	var windowinput = document.createElement("input");
-	windowinput.type = "text";
-	windowinput.value = period;
-	addWithLabel(container, "Time window (ms)", windowinput);
-	
-	var filterinput = document.createElement("textarea");
-	filterinput.id = "filterinput";
-	filterinput.value = filter;
-	addWithLabel(container, "Filter", filterinput);
-
-	/* done link, when clicked time is updated, */
-	var doneanchor = document.createElement("a");
-	doneanchor.className = "actionbutton";
-	doneanchor.innerHTML = "Done";
-	doneanchor.onclick = function () {
-	    var start = parseInt(startinput.value);
-	    var period = parseInt(windowinput.value);
-	    var filter = filterinput.value;
-	    document.body.removeChild(container);
-	    delete container;
-	    
-	    update(start, period, filter, function() {
-		    callback(start, period, filter, numEntries);
-		});
-	};
-	container.appendChild(doneanchor);
-	
-	var update = function(start, period, filter, thenrun) {
-	    startspan.innerHTML = dateFormat(start, "HH:MM:ss,l");
-	    // get the min and max start time
-	    YUI().use("io-base", function(Y) {
-		    var uri = "/info?start=" + start + "&period=" + period + "&filter=" + filter;
-		    function complete(id, o, args) {
-			var data = eval("(" + o.responseText + ")"); 
-			countspan.innerHTML = data.numEntries + " entries";
-			numEntries = data.numEntries;
-			if (thenrun) {
-			    thenrun();
-			}
-		    };
-		    
-		    Y.on('io:complete', complete, Y, []);
-		    var request = Y.io(uri);
-		});
-	};
-	
-	var updatewindow = function(evt) {		
-	    var start = parseInt(startinput.value);
-	    var period = parseInt(windowinput.value);
-	    var filter = filterinput.value;
-	    update(start, period, filter);
-	};
-	windowinput.onkeyup = updatewindow;
-
-	
-	YUI().use("slider", function (Y) {
-		var input, slider; 
-		
-		function updateInput( e ) {
-		    this.set( "value", e.newVal );
-		    
-		    update(parseInt(startinput.value), parseInt(windowinput.value), filterinput.value);
-		}
-		
-		xSlider = new Y.Slider({min: minstart, max: maxstart, value: inittime, length: "1000px" });
-		
-		// Link the input value to the Slider
-		xInput = Y.one( startinput );
-		xInput.setData( { slider: xSlider } );
-		
-		// Pass the input as the 'this' object inside updateInput
-		xSlider.after( "valueChange", updateInput, xInput );
-		
-		// Render the Slider next to the input
-		xSlider.render(sliderspan);
-	    });
-	update(inittime, windowinput.value, filterinput);
-    };
-    
-    // get the min and max start time
-    YUI().use("io-base", function(Y) {
-	    var uri = "/info";
-	    function complete(id, o, args) {
-		var data = eval("(" + o.responseText + ")"); 
-		draw(data.startTime, data.endTime, data.numEntries);
-	    };
-	    
-	    Y.on('io:complete', complete, Y, []);
-	    var request = Y.io(uri);
-	});
-}
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html
deleted file mode 100644
index b9affe66585..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html
+++ /dev/null
@@ -1,60 +0,0 @@
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-<html>
-<head>
-<script src="raphael.js"></script>
-<script src="date.format.js"></script>
-<script src="loggraph.js"></script>
-<script src="loggraph.ui.js"></script>
-<script src="loggraph.log.js"></script>
-<script src="loggraph.server.js"></script>
-<script src="loggraph.stats.js"></script>
-<script src="loggraph.session.js"></script>
-
-<script src="g.raphael.js"></script>
-<script src="g.line.js"></script>
-<script src="g.pie.js"></script>
-<script src="g.bar.js"></script>
-
-<script type="text/javascript" src="yui-min.js"></script>
-
-<link rel="stylesheet" type="text/css" href="loggraph.css">
-<script>
-var g;
-function init() {
-     g = new LogGraph("canvas", "status");
-}
-</script>
-</head>
-<body onLoad="init()" class="yui3-skin-sam  yui-skin-sam">
-
-<div id="actions" class="maininterface">
-  <span onclick="javascript:g.editFilters()" class="actionbutton">Edit Filters</span> 
-  <span onclick="g.addLogs()" class="actionbutton">Add logs</span>
-</div>
-<div id="views" class="maininterface">
-  <span onclick="g.showLogs()" class="actionbutton">Log view</span>
-  <span onclick="g.serverGraph()" class="actionbutton">Servers view</span>
-  <span onclick="g.sessionGraph()" class="actionbutton">Sessions view</span> 
-  <span onclick="g.showStats()" class="actionbutton">Statistics</span>
-</div>
-  <div id="status"></div>
-<div id="outercontainer">
-<div id="canvas"></div>
-</div>
-</body>
-</html>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
deleted file mode 100644
index 1c5c48050b1..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
+++ /dev/null
@@ -1,3296 +0,0 @@
-/*!
- * Raphael 1.3.2 - JavaScript Vector Library
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
- 
-Raphael = (function () {
-    var separator = /[, ]+/,
-        elements = /^(circle|rect|path|ellipse|text|image)$/,
-        proto = "prototype",
-        has = "hasOwnProperty",
-        doc = document,
-        win = window,
-        oldRaphael = {
-            was: Object[proto][has].call(win, "Raphael"),
-            is: win.Raphael
-        },
-        R = function () {
-            if (R.is(arguments[0], "array")) {
-                var a = arguments[0],
-                    cnv = create[apply](R, a.splice(0, 3 + R.is(a[0], nu))),
-                    res = cnv.set();
-                for (var i = 0, ii = a[length]; i < ii; i++) {
-                    var j = a[i] || {};
-                    elements.test(j.type) && res[push](cnv[j.type]().attr(j));
-                }
-                return res;
-            }
-            return create[apply](R, arguments);
-        },
-        Paper = function () {},
-        appendChild = "appendChild",
-        apply = "apply",
-        concat = "concat",
-        E = "",
-        S = " ",
-        split = "split",
-        events = "click dblclick mousedown mousemove mouseout mouseover mouseup"[split](S),
-        join = "join",
-        length = "length",
-        lowerCase = String[proto].toLowerCase,
-        math = Math,
-        mmax = math.max,
-        mmin = math.min,
-        nu = "number",
-        toString = "toString",
-        objectToString = Object[proto][toString],
-        paper = {},
-        pow = math.pow,
-        push = "push",
-        rg = /^(?=[\da-f]$)/,
-        ISURL = /^url\(['"]?([^\)]+?)['"]?\)$/i, //"
-        colourRegExp = /^\s*((#[a-f\d]{6})|(#[a-f\d]{3})|rgb\(\s*([\d\.]+\s*,\s*[\d\.]+\s*,\s*[\d\.]+)\s*\)|rgb\(\s*([\d\.]+%\s*,\s*[\d\.]+%\s*,\s*[\d\.]+%)\s*\)|hs[bl]\(\s*([\d\.]+\s*,\s*[\d\.]+\s*,\s*[\d\.]+)\s*\)|hs[bl]\(\s*([\d\.]+%\s*,\s*[\d\.]+%\s*,\s*[\d\.]+%)\s*\))\s*$/i,
-        round = math.round,
-        setAttribute = "setAttribute",
-        toFloat = parseFloat,
-        toInt = parseInt,
-        upperCase = String[proto].toUpperCase,
-        availableAttrs = {blur: 0, "clip-rect": "0 0 1e9 1e9", cursor: "default", cx: 0, cy: 0, fill: "#fff", "fill-opacity": 1, font: '10px "Arial"', "font-family": '"Arial"', "font-size": "10", "font-style": "normal", "font-weight": 400, gradient: 0, height: 0, href: "http://raphaeljs.com/", opacity: 1, path: "M0,0", r: 0, rotation: 0, rx: 0, ry: 0, scale: "1 1", src: "", stroke: "#000", "stroke-dasharray": "", "stroke-linecap": "butt", "stroke-linejoin": "butt", "stroke-miterlimit": 0, "stroke-opacity": 1, "stroke-width": 1, target: "_blank", "text-anchor": "middle", title: "Raphael", translation: "0 0", width: 0, x: 0, y: 0},
-        availableAnimAttrs = {along: "along", blur: nu, "clip-rect": "csv", cx: nu, cy: nu, fill: "colour", "fill-opacity": nu, "font-size": nu, height: nu, opacity: nu, path: "path", r: nu, rotation: "csv", rx: nu, ry: nu, scale: "csv", stroke: "colour", "stroke-opacity": nu, "stroke-width": nu, translation: "csv", width: nu, x: nu, y: nu},
-        rp = "replace";
-    R.version = "1.3.2";
-    R.type = (win.SVGAngle || doc.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#BasicStructure", "1.1") ? "SVG" : "VML");
-    if (R.type == "VML") {
-        var d = doc.createElement("div");
-        d.innerHTML = '<!--[if vml]><br><br><![endif]-->';
-        if (d.childNodes[length] != 2) {
-            return R.type = null;
-        }
-        d = null;
-    }
-    R.svg = !(R.vml = R.type == "VML");
-    Paper[proto] = R[proto];
-    R._id = 0;
-    R._oid = 0;
-    R.fn = {};
-    R.is = function (o, type) {
-        type = lowerCase.call(type);
-        return ((type == "object" || type == "undefined") && typeof o == type) || (o == null && type == "null") || lowerCase.call(objectToString.call(o).slice(8, -1)) == type;
-    };
-    R.setWindow = function (newwin) {
-        win = newwin;
-        doc = win.document;
-    };
-    // colour utilities
-    var toHex = function (color) {
-        if (R.vml) {
-            // http://dean.edwards.name/weblog/2009/10/convert-any-colour-value-to-hex-in-msie/
-            var trim = /^\s+|\s+$/g;
-            toHex = cacher(function (color) {
-                var bod;
-                color = (color + E)[rp](trim, E);
-                try {
-                    var docum = new win.ActiveXObject("htmlfile");
-                    docum.write("<body>");
-                    docum.close();
-                    bod = docum.body;
-                } catch(e) {
-                    bod = win.createPopup().document.body;
-                }
-                var range = bod.createTextRange();
-                try {
-                    bod.style.color = color;
-                    var value = range.queryCommandValue("ForeColor");
-                    value = ((value & 255) << 16) | (value & 65280) | ((value & 16711680) >>> 16);
-                    return "#" + ("000000" + value[toString](16)).slice(-6);
-                } catch(e) {
-                    return "none";
-                }
-            });
-        } else {
-            var i = doc.createElement("i");
-            i.title = "Rapha\xebl Colour Picker";
-            i.style.display = "none";
-            doc.body[appendChild](i);
-            toHex = cacher(function (color) {
-                i.style.color = color;
-                return doc.defaultView.getComputedStyle(i, E).getPropertyValue("color");
-            });
-        }
-        return toHex(color);
-    };
-    var hsbtoString = function () {
-        return "hsb(" + [this.h, this.s, this.b] + ")";
-    },
-    rgbtoString = function () {
-        return this.hex;
-    };
-    R.hsb2rgb = cacher(function (hue, saturation, brightness) {
-        if (R.is(hue, "object") && "h" in hue && "s" in hue && "b" in hue) {
-            brightness = hue.b;
-            saturation = hue.s;
-            hue = hue.h;
-        }
-        var red,
-            green,
-            blue;
-        if (brightness == 0) {
-            return {r: 0, g: 0, b: 0, hex: "#000"};
-        }
-        if (hue > 1 || saturation > 1 || brightness > 1) {
-            hue /= 255;
-            saturation /= 255;
-            brightness /= 255;
-        }
-        var i = ~~(hue * 6),
-            f = (hue * 6) - i,
-            p = brightness * (1 - saturation),
-            q = brightness * (1 - (saturation * f)),
-            t = brightness * (1 - (saturation * (1 - f)));
-        red = [brightness, q, p, p, t, brightness, brightness][i];
-        green = [t, brightness, brightness, q, p, p, t][i];
-        blue = [p, p, t, brightness, brightness, q, p][i];
-        red *= 255;
-        green *= 255;
-        blue *= 255;
-        var rgb = {r: red, g: green, b: blue, toString: rgbtoString},
-            r = (~~red)[toString](16),
-            g = (~~green)[toString](16),
-            b = (~~blue)[toString](16);
-        r = r[rp](rg, "0");
-        g = g[rp](rg, "0");
-        b = b[rp](rg, "0");
-        rgb.hex = "#" + r + g + b;
-        return rgb;
-    }, R);
-    R.rgb2hsb = cacher(function (red, green, blue) {
-        if (R.is(red, "object") && "r" in red && "g" in red && "b" in red) {
-            blue = red.b;
-            green = red.g;
-            red = red.r;
-        }
-        if (R.is(red, "string")) {
-            var clr = R.getRGB(red);
-            red = clr.r;
-            green = clr.g;
-            blue = clr.b;
-        }
-        if (red > 1 || green > 1 || blue > 1) {
-            red /= 255;
-            green /= 255;
-            blue /= 255;
-        }
-        var max = mmax(red, green, blue),
-            min = mmin(red, green, blue),
-            hue,
-            saturation,
-            brightness = max;
-        if (min == max) {
-            return {h: 0, s: 0, b: max};
-        } else {
-            var delta = (max - min);
-            saturation = delta / max;
-            if (red == max) {
-                hue = (green - blue) / delta;
-            } else if (green == max) {
-                hue = 2 + ((blue - red) / delta);
-            } else {
-                hue = 4 + ((red - green) / delta);
-            }
-            hue /= 6;
-            hue < 0 && hue++;
-            hue > 1 && hue--;
-        }
-        return {h: hue, s: saturation, b: brightness, toString: hsbtoString};
-    }, R);
-    var p2s = /,?([achlmqrstvxz]),?/gi;
-    R._path2string = function () {
-        return this.join(",")[rp](p2s, "$1");
-    };
-    function cacher(f, scope, postprocessor) {
-        function newf() {
-            var arg = Array[proto].slice.call(arguments, 0),
-                args = arg[join]("\u25ba"),
-                cache = newf.cache = newf.cache || {},
-                count = newf.count = newf.count || [];
-            if (cache[has](args)) {
-                return postprocessor ? postprocessor(cache[args]) : cache[args];
-            }
-            count[length] >= 1e3 && delete cache[count.shift()];
-            count[push](args);
-            cache[args] = f[apply](scope, arg);
-            return postprocessor ? postprocessor(cache[args]) : cache[args];
-        }
-        return newf;
-    }
- 
-    R.getRGB = cacher(function (colour) {
-        if (!colour || !!((colour = colour + E).indexOf("-") + 1)) {
-            return {r: -1, g: -1, b: -1, hex: "none", error: 1};
-        }
-        if (colour == "none") {
-            return {r: -1, g: -1, b: -1, hex: "none"};
-        }
-        !(({hs: 1, rg: 1})[has](colour.substring(0, 2)) || colour.charAt() == "#") && (colour = toHex(colour));
-        var res,
-            red,
-            green,
-            blue,
-            t,
-            rgb = colour.match(colourRegExp);
-        if (rgb) {
-            if (rgb[2]) {
-                blue = toInt(rgb[2].substring(5), 16);
-                green = toInt(rgb[2].substring(3, 5), 16);
-                red = toInt(rgb[2].substring(1, 3), 16);
-            }
-            if (rgb[3]) {
-                blue = toInt((t = rgb[3].charAt(3)) + t, 16);
-                green = toInt((t = rgb[3].charAt(2)) + t, 16);
-                red = toInt((t = rgb[3].charAt(1)) + t, 16);
-            }
-            if (rgb[4]) {
-                rgb = rgb[4][split](/\s*,\s*/);
-                red = toFloat(rgb[0]);
-                green = toFloat(rgb[1]);
-                blue = toFloat(rgb[2]);
-            }
-            if (rgb[5]) {
-                rgb = rgb[5][split](/\s*,\s*/);
-                red = toFloat(rgb[0]) * 2.55;
-                green = toFloat(rgb[1]) * 2.55;
-                blue = toFloat(rgb[2]) * 2.55;
-            }
-            if (rgb[6]) {
-                rgb = rgb[6][split](/\s*,\s*/);
-                red = toFloat(rgb[0]);
-                green = toFloat(rgb[1]);
-                blue = toFloat(rgb[2]);
-                return R.hsb2rgb(red, green, blue);
-            }
-            if (rgb[7]) {
-                rgb = rgb[7][split](/\s*,\s*/);
-                red = toFloat(rgb[0]) * 2.55;
-                green = toFloat(rgb[1]) * 2.55;
-                blue = toFloat(rgb[2]) * 2.55;
-                return R.hsb2rgb(red, green, blue);
-            }
-            rgb = {r: red, g: green, b: blue};
-            var r = (~~red)[toString](16),
-                g = (~~green)[toString](16),
-                b = (~~blue)[toString](16);
-            r = r[rp](rg, "0");
-            g = g[rp](rg, "0");
-            b = b[rp](rg, "0");
-            rgb.hex = "#" + r + g + b;
-            return rgb;
-        }
-        return {r: -1, g: -1, b: -1, hex: "none", error: 1};
-    }, R);
-    R.getColor = function (value) {
-        var start = this.getColor.start = this.getColor.start || {h: 0, s: 1, b: value || .75},
-            rgb = this.hsb2rgb(start.h, start.s, start.b);
-        start.h += .075;
-        if (start.h > 1) {
-            start.h = 0;
-            start.s -= .2;
-            start.s <= 0 && (this.getColor.start = {h: 0, s: 1, b: start.b});
-        }
-        return rgb.hex;
-    };
-    R.getColor.reset = function () {
-        delete this.start;
-    };
-    // path utilities
-    var pathCommand = /([achlmqstvz])[\s,]*((-?\d*\.?\d*(?:e[-+]?\d+)?\s*,?\s*)+)/ig,
-        pathValues = /(-?\d*\.?\d*(?:e[-+]?\d+)?)\s*,?\s*/ig;
-    R.parsePathString = cacher(function (pathString) {
-        if (!pathString) {
-            return null;
-        }
-        var paramCounts = {a: 7, c: 6, h: 1, l: 2, m: 2, q: 4, s: 4, t: 2, v: 1, z: 0},
-            data = [];
-        if (R.is(pathString, "array") && R.is(pathString[0], "array")) { // rough assumption
-            data = pathClone(pathString);
-        }
-        if (!data[length]) {
-            (pathString + E)[rp](pathCommand, function (a, b, c) {
-                var params = [],
-                    name = lowerCase.call(b);
-                c[rp](pathValues, function (a, b) {
-                    b && params[push](+b);
-                });
-                if (name == "m" && params[length] > 2) {
-                    data[push]([b][concat](params.splice(0, 2)));
-                    name = "l";
-                    b = b == "m" ? "l" : "L";
-                }
-                while (params[length] >= paramCounts[name]) {
-                    data[push]([b][concat](params.splice(0, paramCounts[name])));
-                    if (!paramCounts[name]) {
-                        break;
-                    }
-                }
-            });
-        }
-        data[toString] = R._path2string;
-        return data;
-    });
-    R.findDotsAtSegment = function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t) {
-        var t1 = 1 - t,
-            x = pow(t1, 3) * p1x + pow(t1, 2) * 3 * t * c1x + t1 * 3 * t * t * c2x + pow(t, 3) * p2x,
-            y = pow(t1, 3) * p1y + pow(t1, 2) * 3 * t * c1y + t1 * 3 * t * t * c2y + pow(t, 3) * p2y,
-            mx = p1x + 2 * t * (c1x - p1x) + t * t * (c2x - 2 * c1x + p1x),
-            my = p1y + 2 * t * (c1y - p1y) + t * t * (c2y - 2 * c1y + p1y),
-            nx = c1x + 2 * t * (c2x - c1x) + t * t * (p2x - 2 * c2x + c1x),
-            ny = c1y + 2 * t * (c2y - c1y) + t * t * (p2y - 2 * c2y + c1y),
-            ax = (1 - t) * p1x + t * c1x,
-            ay = (1 - t) * p1y + t * c1y,
-            cx = (1 - t) * c2x + t * p2x,
-            cy = (1 - t) * c2y + t * p2y,
-            alpha = (90 - math.atan((mx - nx) / (my - ny)) * 180 / math.PI);
-        (mx > nx || my < ny) && (alpha += 180);
-        return {x: x, y: y, m: {x: mx, y: my}, n: {x: nx, y: ny}, start: {x: ax, y: ay}, end: {x: cx, y: cy}, alpha: alpha};
-    };
-    var pathDimensions = cacher(function (path) {
-        if (!path) {
-            return {x: 0, y: 0, width: 0, height: 0};
-        }
-        path = path2curve(path);
-        var x = 0, 
-            y = 0,
-            X = [],
-            Y = [],
-            p;
-        for (var i = 0, ii = path[length]; i < ii; i++) {
-            p = path[i];
-            if (p[0] == "M") {
-                x = p[1];
-                y = p[2];
-                X[push](x);
-                Y[push](y);
-            } else {
-                var dim = curveDim(x, y, p[1], p[2], p[3], p[4], p[5], p[6]);
-                X = X[concat](dim.min.x, dim.max.x);
-                Y = Y[concat](dim.min.y, dim.max.y);
-                x = p[5];
-                y = p[6];
-            }
-        }
-        var xmin = mmin[apply](0, X),
-            ymin = mmin[apply](0, Y);
-        return {
-            x: xmin,
-            y: ymin,
-            width: mmax[apply](0, X) - xmin,
-            height: mmax[apply](0, Y) - ymin
-        };
-    }),
-        pathClone = function (pathArray) {
-            var res = [];
-            if (!R.is(pathArray, "array") || !R.is(pathArray && pathArray[0], "array")) { // rough assumption
-                pathArray = R.parsePathString(pathArray);
-            }
-            for (var i = 0, ii = pathArray[length]; i < ii; i++) {
-                res[i] = [];
-                for (var j = 0, jj = pathArray[i][length]; j < jj; j++) {
-                    res[i][j] = pathArray[i][j];
-                }
-            }
-            res[toString] = R._path2string;
-            return res;
-        },
-        pathToRelative = cacher(function (pathArray) {
-            if (!R.is(pathArray, "array") || !R.is(pathArray && pathArray[0], "array")) { // rough assumption
-                pathArray = R.parsePathString(pathArray);
-            }
-            var res = [],
-                x = 0,
-                y = 0,
-                mx = 0,
-                my = 0,
-                start = 0;
-            if (pathArray[0][0] == "M") {
-                x = pathArray[0][1];
-                y = pathArray[0][2];
-                mx = x;
-                my = y;
-                start++;
-                res[push](["M", x, y]);
-            }
-            for (var i = start, ii = pathArray[length]; i < ii; i++) {
-                var r = res[i] = [],
-                    pa = pathArray[i];
-                if (pa[0] != lowerCase.call(pa[0])) {
-                    r[0] = lowerCase.call(pa[0]);
-                    switch (r[0]) {
-                        case "a":
-                            r[1] = pa[1];
-                            r[2] = pa[2];
-                            r[3] = pa[3];
-                            r[4] = pa[4];
-                            r[5] = pa[5];
-                            r[6] = +(pa[6] - x).toFixed(3);
-                            r[7] = +(pa[7] - y).toFixed(3);
-                            break;
-                        case "v":
-                            r[1] = +(pa[1] - y).toFixed(3);
-                            break;
-                        case "m":
-                            mx = pa[1];
-                            my = pa[2];
-                        default:
-                            for (var j = 1, jj = pa[length]; j < jj; j++) {
-                                r[j] = +(pa[j] - ((j % 2) ? x : y)).toFixed(3);
-                            }
-                    }
-                } else {
-                    r = res[i] = [];
-                    if (pa[0] == "m") {
-                        mx = pa[1] + x;
-                        my = pa[2] + y;
-                    }
-                    for (var k = 0, kk = pa[length]; k < kk; k++) {
-                        res[i][k] = pa[k];
-                    }
-                }
-                var len = res[i][length];
-                switch (res[i][0]) {
-                    case "z":
-                        x = mx;
-                        y = my;
-                        break;
-                    case "h":
-                        x += +res[i][len - 1];
-                        break;
-                    case "v":
-                        y += +res[i][len - 1];
-                        break;
-                    default:
-                        x += +res[i][len - 2];
-                        y += +res[i][len - 1];
-                }
-            }
-            res[toString] = R._path2string;
-            return res;
-        }, 0, pathClone),
-        pathToAbsolute = cacher(function (pathArray) {
-            if (!R.is(pathArray, "array") || !R.is(pathArray && pathArray[0], "array")) { // rough assumption
-                pathArray = R.parsePathString(pathArray);
-            }
-            var res = [],
-                x = 0,
-                y = 0,
-                mx = 0,
-                my = 0,
-                start = 0;
-            if (pathArray[0][0] == "M") {
-                x = +pathArray[0][1];
-                y = +pathArray[0][2];
-                mx = x;
-                my = y;
-                start++;
-                res[0] = ["M", x, y];
-            }
-            for (var i = start, ii = pathArray[length]; i < ii; i++) {
-                var r = res[i] = [],
-                    pa = pathArray[i];
-                if (pa[0] != upperCase.call(pa[0])) {
-                    r[0] = upperCase.call(pa[0]);
-                    switch (r[0]) {
-                        case "A":
-                            r[1] = pa[1];
-                            r[2] = pa[2];
-                            r[3] = pa[3];
-                            r[4] = pa[4];
-                            r[5] = pa[5];
-                            r[6] = +(pa[6] + x);
-                            r[7] = +(pa[7] + y);
-                            break;
-                        case "V":
-                            r[1] = +pa[1] + y;
-                            break;
-                        case "H":
-                            r[1] = +pa[1] + x;
-                            break;
-                        case "M":
-                            mx = +pa[1] + x;
-                            my = +pa[2] + y;
-                        default:
-                            for (var j = 1, jj = pa[length]; j < jj; j++) {
-                                r[j] = +pa[j] + ((j % 2) ? x : y);
-                            }
-                    }
-                } else {
-                    for (var k = 0, kk = pa[length]; k < kk; k++) {
-                        res[i][k] = pa[k];
-                    }
-                }
-                switch (r[0]) {
-                    case "Z":
-                        x = mx;
-                        y = my;
-                        break;
-                    case "H":
-                        x = r[1];
-                        break;
-                    case "V":
-                        y = r[1];
-                        break;
-                    default:
-                        x = res[i][res[i][length] - 2];
-                        y = res[i][res[i][length] - 1];
-                }
-            }
-            res[toString] = R._path2string;
-            return res;
-        }, null, pathClone),
-        l2c = function (x1, y1, x2, y2) {
-            return [x1, y1, x2, y2, x2, y2];
-        },
-        q2c = function (x1, y1, ax, ay, x2, y2) {
-            var _13 = 1 / 3,
-                _23 = 2 / 3;
-            return [
-                    _13 * x1 + _23 * ax,
-                    _13 * y1 + _23 * ay,
-                    _13 * x2 + _23 * ax,
-                    _13 * y2 + _23 * ay,
-                    x2,
-                    y2
-                ];
-        },
-        a2c = function (x1, y1, rx, ry, angle, large_arc_flag, sweep_flag, x2, y2, recursive) {
-            // for more information of where this math came from visit:
-            // http://www.w3.org/TR/SVG11/implnote.html#ArcImplementationNotes
-            var PI = math.PI,
-                _120 = PI * 120 / 180,
-                rad = PI / 180 * (+angle || 0),
-                res = [],
-                xy,
-                rotate = cacher(function (x, y, rad) {
-                    var X = x * math.cos(rad) - y * math.sin(rad),
-                        Y = x * math.sin(rad) + y * math.cos(rad);
-                    return {x: X, y: Y};
-                });
-            if (!recursive) {
-                xy = rotate(x1, y1, -rad);
-                x1 = xy.x;
-                y1 = xy.y;
-                xy = rotate(x2, y2, -rad);
-                x2 = xy.x;
-                y2 = xy.y;
-                var cos = math.cos(PI / 180 * angle),
-                    sin = math.sin(PI / 180 * angle),
-                    x = (x1 - x2) / 2,
-                    y = (y1 - y2) / 2;
-                // rx = mmax(rx, math.abs(x));
-                // ry = mmax(ry, math.abs(y));
-                var h = (x * x) / (rx * rx) + (y * y) / (ry * ry);
-                if (h > 1) {
-                    h = math.sqrt(h);
-                    rx = h * rx;
-                    ry = h * ry;
-                }
-                var rx2 = rx * rx,
-                    ry2 = ry * ry,
-                    k = (large_arc_flag == sweep_flag ? -1 : 1) *
-                        math.sqrt(math.abs((rx2 * ry2 - rx2 * y * y - ry2 * x * x) / (rx2 * y * y + ry2 * x * x))),
-                    cx = k * rx * y / ry + (x1 + x2) / 2,
-                    cy = k * -ry * x / rx + (y1 + y2) / 2,
-                    f1 = math.asin(((y1 - cy) / ry).toFixed(7)),
-                    f2 = math.asin(((y2 - cy) / ry).toFixed(7));
-
-                f1 = x1 < cx ? PI - f1 : f1;
-                f2 = x2 < cx ? PI - f2 : f2;
-                f1 < 0 && (f1 = PI * 2 + f1);
-                f2 < 0 && (f2 = PI * 2 + f2);
-                if (sweep_flag && f1 > f2) {
-                    f1 = f1 - PI * 2;
-                }
-                if (!sweep_flag && f2 > f1) {
-                    f2 = f2 - PI * 2;
-                }
-            } else {
-                f1 = recursive[0];
-                f2 = recursive[1];
-                cx = recursive[2];
-                cy = recursive[3];
-            }
-            var df = f2 - f1;
-            if (math.abs(df) > _120) {
-                var f2old = f2,
-                    x2old = x2,
-                    y2old = y2;
-                f2 = f1 + _120 * (sweep_flag && f2 > f1 ? 1 : -1);
-                x2 = cx + rx * math.cos(f2);
-                y2 = cy + ry * math.sin(f2);
-                res = a2c(x2, y2, rx, ry, angle, 0, sweep_flag, x2old, y2old, [f2, f2old, cx, cy]);
-            }
-            df = f2 - f1;
-            var c1 = math.cos(f1),
-                s1 = math.sin(f1),
-                c2 = math.cos(f2),
-                s2 = math.sin(f2),
-                t = math.tan(df / 4),
-                hx = 4 / 3 * rx * t,
-                hy = 4 / 3 * ry * t,
-                m1 = [x1, y1],
-                m2 = [x1 + hx * s1, y1 - hy * c1],
-                m3 = [x2 + hx * s2, y2 - hy * c2],
-                m4 = [x2, y2];
-            m2[0] = 2 * m1[0] - m2[0];
-            m2[1] = 2 * m1[1] - m2[1];
-            if (recursive) {
-                return [m2, m3, m4][concat](res);
-            } else {
-                res = [m2, m3, m4][concat](res)[join]()[split](",");
-                var newres = [];
-                for (var i = 0, ii = res[length]; i < ii; i++) {
-                    newres[i] = i % 2 ? rotate(res[i - 1], res[i], rad).y : rotate(res[i], res[i + 1], rad).x;
-                }
-                // alert(newres);
-                return newres;
-            }
-        },
-        findDotAtSegment = function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t) {
-            var t1 = 1 - t;
-            return {
-                x: pow(t1, 3) * p1x + pow(t1, 2) * 3 * t * c1x + t1 * 3 * t * t * c2x + pow(t, 3) * p2x,
-                y: pow(t1, 3) * p1y + pow(t1, 2) * 3 * t * c1y + t1 * 3 * t * t * c2y + pow(t, 3) * p2y
-            };
-        },
-        curveDim = cacher(function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y) {
-            var a = (c2x - 2 * c1x + p1x) - (p2x - 2 * c2x + c1x),
-                b = 2 * (c1x - p1x) - 2 * (c2x - c1x),
-                c = p1x - c1x,
-                t1 = (-b + math.sqrt(b * b - 4 * a * c)) / 2 / a,
-                t2 = (-b - math.sqrt(b * b - 4 * a * c)) / 2 / a,
-                y = [p1y, p2y],
-                x = [p1x, p2x],
-                dot;
-            math.abs(t1) > 1e12 && (t1 = .5);
-            math.abs(t2) > 1e12 && (t2 = .5);
-            if (t1 > 0 && t1 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t1);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            if (t2 > 0 && t2 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t2);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            a = (c2y - 2 * c1y + p1y) - (p2y - 2 * c2y + c1y);
-            b = 2 * (c1y - p1y) - 2 * (c2y - c1y);
-            c = p1y - c1y;
-            t1 = (-b + math.sqrt(b * b - 4 * a * c)) / 2 / a;
-            t2 = (-b - math.sqrt(b * b - 4 * a * c)) / 2 / a;
-            math.abs(t1) > 1e12 && (t1 = .5);
-            math.abs(t2) > 1e12 && (t2 = .5);
-            if (t1 > 0 && t1 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t1);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            if (t2 > 0 && t2 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t2);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            return {
-                min: {x: mmin[apply](0, x), y: mmin[apply](0, y)},
-                max: {x: mmax[apply](0, x), y: mmax[apply](0, y)}
-            };
-        }),
-        path2curve = cacher(function (path, path2) {
-            var p = pathToAbsolute(path),
-                p2 = path2 && pathToAbsolute(path2),
-                attrs = {x: 0, y: 0, bx: 0, by: 0, X: 0, Y: 0, qx: null, qy: null},
-                attrs2 = {x: 0, y: 0, bx: 0, by: 0, X: 0, Y: 0, qx: null, qy: null},
-                processPath = function (path, d) {
-                    var nx, ny;
-                    if (!path) {
-                        return ["C", d.x, d.y, d.x, d.y, d.x, d.y];
-                    }
-                    !(path[0] in {T:1, Q:1}) && (d.qx = d.qy = null);
-                    switch (path[0]) {
-                        case "M":
-                            d.X = path[1];
-                            d.Y = path[2];
-                            break;
-                        case "A":
-                            path = ["C"][concat](a2c[apply](0, [d.x, d.y][concat](path.slice(1))));
-                            break;
-                        case "S":
-                            nx = d.x + (d.x - (d.bx || d.x));
-                            ny = d.y + (d.y - (d.by || d.y));
-                            path = ["C", nx, ny][concat](path.slice(1));
-                            break;
-                        case "T":
-                            d.qx = d.x + (d.x - (d.qx || d.x));
-                            d.qy = d.y + (d.y - (d.qy || d.y));
-                            path = ["C"][concat](q2c(d.x, d.y, d.qx, d.qy, path[1], path[2]));
-                            break;
-                        case "Q":
-                            d.qx = path[1];
-                            d.qy = path[2];
-                            path = ["C"][concat](q2c(d.x, d.y, path[1], path[2], path[3], path[4]));
-                            break;
-                        case "L":
-                            path = ["C"][concat](l2c(d.x, d.y, path[1], path[2]));
-                            break;
-                        case "H":
-                            path = ["C"][concat](l2c(d.x, d.y, path[1], d.y));
-                            break;
-                        case "V":
-                            path = ["C"][concat](l2c(d.x, d.y, d.x, path[1]));
-                            break;
-                        case "Z":
-                            path = ["C"][concat](l2c(d.x, d.y, d.X, d.Y));
-                            break;
-                    }
-                    return path;
-                },
-                fixArc = function (pp, i) {
-                    if (pp[i][length] > 7) {
-                        pp[i].shift();
-                        var pi = pp[i];
-                        while (pi[length]) {
-                            pp.splice(i++, 0, ["C"][concat](pi.splice(0, 6)));
-                        }
-                        pp.splice(i, 1);
-                        ii = mmax(p[length], p2 && p2[length] || 0);
-                    }
-                },
-                fixM = function (path1, path2, a1, a2, i) {
-                    if (path1 && path2 && path1[i][0] == "M" && path2[i][0] != "M") {
-                        path2.splice(i, 0, ["M", a2.x, a2.y]);
-                        a1.bx = 0;
-                        a1.by = 0;
-                        a1.x = path1[i][1];
-                        a1.y = path1[i][2];
-                        ii = mmax(p[length], p2 && p2[length] || 0);
-                    }
-                };
-            for (var i = 0, ii = mmax(p[length], p2 && p2[length] || 0); i < ii; i++) {
-                p[i] = processPath(p[i], attrs);
-                fixArc(p, i);
-                p2 && (p2[i] = processPath(p2[i], attrs2));
-                p2 && fixArc(p2, i);
-                fixM(p, p2, attrs, attrs2, i);
-                fixM(p2, p, attrs2, attrs, i);
-                var seg = p[i],
-                    seg2 = p2 && p2[i],
-                    seglen = seg[length],
-                    seg2len = p2 && seg2[length];
-                attrs.x = seg[seglen - 2];
-                attrs.y = seg[seglen - 1];
-                attrs.bx = toFloat(seg[seglen - 4]) || attrs.x;
-                attrs.by = toFloat(seg[seglen - 3]) || attrs.y;
-                attrs2.bx = p2 && (toFloat(seg2[seg2len - 4]) || attrs2.x);
-                attrs2.by = p2 && (toFloat(seg2[seg2len - 3]) || attrs2.y);
-                attrs2.x = p2 && seg2[seg2len - 2];
-                attrs2.y = p2 && seg2[seg2len - 1];
-            }
-            return p2 ? [p, p2] : p;
-        }, null, pathClone),
-        parseDots = cacher(function (gradient) {
-            var dots = [];
-            for (var i = 0, ii = gradient[length]; i < ii; i++) {
-                var dot = {},
-                    par = gradient[i].match(/^([^:]*):?([\d\.]*)/);
-                dot.color = R.getRGB(par[1]);
-                if (dot.color.error) {
-                    return null;
-                }
-                dot.color = dot.color.hex;
-                par[2] && (dot.offset = par[2] + "%");
-                dots[push](dot);
-            }
-            for (i = 1, ii = dots[length] - 1; i < ii; i++) {
-                if (!dots[i].offset) {
-                    var start = toFloat(dots[i - 1].offset || 0),
-                        end = 0;
-                    for (var j = i + 1; j < ii; j++) {
-                        if (dots[j].offset) {
-                            end = dots[j].offset;
-                            break;
-                        }
-                    }
-                    if (!end) {
-                        end = 100;
-                        j = ii;
-                    }
-                    end = toFloat(end);
-                    var d = (end - start) / (j - i + 1);
-                    for (; i < j; i++) {
-                        start += d;
-                        dots[i].offset = start + "%";
-                    }
-                }
-            }
-            return dots;
-        }),
-        getContainer = function (x, y, w, h) {
-            var container;
-            if (R.is(x, "string") || R.is(x, "object")) {
-                container = R.is(x, "string") ? doc.getElementById(x) : x;
-                if (container.tagName) {
-                    if (y == null) {
-                        return {
-                            container: container,
-                            width: container.style.pixelWidth || container.offsetWidth,
-                            height: container.style.pixelHeight || container.offsetHeight
-                        };
-                    } else {
-                        return {container: container, width: y, height: w};
-                    }
-                }
-            } else if (R.is(x, nu) && h != null) {
-                return {container: 1, x: x, y: y, width: w, height: h};
-            }
-        },
-        plugins = function (con, add) {
-            var that = this;
-            for (var prop in add) {
-                if (add[has](prop) && !(prop in con)) {
-                    switch (typeof add[prop]) {
-                        case "function":
-                            (function (f) {
-                                con[prop] = con === that ? f : function () { return f[apply](that, arguments); };
-                            })(add[prop]);
-                        break;
-                        case "object":
-                            con[prop] = con[prop] || {};
-                            plugins.call(this, con[prop], add[prop]);
-                        break;
-                        default:
-                            con[prop] = add[prop];
-                        break;
-                    }
-                }
-            }
-        },
-        tear = function (el, paper) {
-            el == paper.top && (paper.top = el.prev);
-            el == paper.bottom && (paper.bottom = el.next);
-            el.next && (el.next.prev = el.prev);
-            el.prev && (el.prev.next = el.next);
-        },
-        tofront = function (el, paper) {
-            if (paper.top === el) {
-                return;
-            }
-            tear(el, paper);
-            el.next = null;
-            el.prev = paper.top;
-            paper.top.next = el;
-            paper.top = el;
-        },
-        toback = function (el, paper) {
-            if (paper.bottom === el) {
-                return;
-            }
-            tear(el, paper);
-            el.next = paper.bottom;
-            el.prev = null;
-            paper.bottom.prev = el;
-            paper.bottom = el;
-        },
-        insertafter = function (el, el2, paper) {
-            tear(el, paper);
-            el2 == paper.top && (paper.top = el);
-            el2.next && (el2.next.prev = el);
-            el.next = el2.next;
-            el.prev = el2;
-            el2.next = el;
-        },
-        insertbefore = function (el, el2, paper) {
-            tear(el, paper);
-            el2 == paper.bottom && (paper.bottom = el);
-            el2.prev && (el2.prev.next = el);
-            el.prev = el2.prev;
-            el2.prev = el;
-            el.next = el2;
-        },
-        removed = function (methodname) {
-            return function () {
-                throw new Error("Rapha\xebl: you are calling to method \u201c" + methodname + "\u201d of removed object");
-            };
-        },
-        radial_gradient = /^r(?:\(([^,]+?)\s*,\s*([^\)]+?)\))?/;
- 
-    // SVG
-    if (R.svg) {
-        Paper[proto].svgns = "http://www.w3.org/2000/svg";
-        Paper[proto].xlink = "http://www.w3.org/1999/xlink";
-        round = function (num) {
-            return +num + (~~num === num) * .5;
-        };
-        var roundPath = function (path) {
-            for (var i = 0, ii = path[length]; i < ii; i++) {
-                if (lowerCase.call(path[i][0]) != "a") {
-                    for (var j = 1, jj = path[i][length]; j < jj; j++) {
-                        path[i][j] = round(path[i][j]);
-                    }
-                } else {
-                    path[i][6] = round(path[i][6]);
-                    path[i][7] = round(path[i][7]);
-                }
-            }
-            return path;
-        },
-        $ = function (el, attr) {
-            if (attr) {
-                for (var key in attr) {
-                    if (attr[has](key)) {
-                        el[setAttribute](key, attr[key] + E);
-                    }
-                }
-            } else {
-                return doc.createElementNS(Paper[proto].svgns, el);
-            }
-        };
-        R[toString] = function () {
-            return  "Your browser supports SVG.\nYou are running Rapha\xebl " + this.version;
-        };
-        var thePath = function (pathString, SVG) {
-            var el = $("path");
-            SVG.canvas && SVG.canvas[appendChild](el);
-            var p = new Element(el, SVG);
-            p.type = "path";
-            setFillAndStroke(p, {fill: "none", stroke: "#000", path: pathString});
-            return p;
-        };
-        var addGradientFill = function (o, gradient, SVG) {
-            var type = "linear",
-                fx = .5, fy = .5,
-                s = o.style;
-            gradient = (gradient + E)[rp](radial_gradient, function (all, _fx, _fy) {
-                type = "radial";
-                if (_fx && _fy) {
-                    fx = toFloat(_fx);
-                    fy = toFloat(_fy);
-                    var dir = ((fy > .5) * 2 - 1);
-                    pow(fx - .5, 2) + pow(fy - .5, 2) > .25 &&
-                        (fy = math.sqrt(.25 - pow(fx - .5, 2)) * dir + .5) &&
-                        fy != .5 &&
-                        (fy = fy.toFixed(5) - 1e-5 * dir);
-                }
-                return E;
-            });
-            gradient = gradient[split](/\s*\-\s*/);
-            if (type == "linear") {
-                var angle = gradient.shift();
-                angle = -toFloat(angle);
-                if (isNaN(angle)) {
-                    return null;
-                }
-                var vector = [0, 0, math.cos(angle * math.PI / 180), math.sin(angle * math.PI / 180)],
-                    max = 1 / (mmax(math.abs(vector[2]), math.abs(vector[3])) || 1);
-                vector[2] *= max;
-                vector[3] *= max;
-                if (vector[2] < 0) {
-                    vector[0] = -vector[2];
-                    vector[2] = 0;
-                }
-                if (vector[3] < 0) {
-                    vector[1] = -vector[3];
-                    vector[3] = 0;
-                }
-            }
-            var dots = parseDots(gradient);
-            if (!dots) {
-                return null;
-            }
-            var id = o.getAttribute("fill");
-            id = id.match(/^url\(#(.*)\)$/);
-            id && SVG.defs.removeChild(doc.getElementById(id[1]));
-            
-            var el = $(type + "Gradient");
-            el.id = "r" + (R._id++)[toString](36);
-            $(el, type == "radial" ? {fx: fx, fy: fy} : {x1: vector[0], y1: vector[1], x2: vector[2], y2: vector[3]});
-            SVG.defs[appendChild](el);
-            for (var i = 0, ii = dots[length]; i < ii; i++) {
-                var stop = $("stop");
-                $(stop, {
-                    offset: dots[i].offset ? dots[i].offset : !i ? "0%" : "100%",
-                    "stop-color": dots[i].color || "#fff"
-                });
-                el[appendChild](stop);
-            }
-            $(o, {
-                fill: "url(#" + el.id + ")",
-                opacity: 1,
-                "fill-opacity": 1
-            });
-            s.fill = E;
-            s.opacity = 1;
-            s.fillOpacity = 1;
-            return 1;
-        };
-        var updatePosition = function (o) {
-            var bbox = o.getBBox();
-            $(o.pattern, {patternTransform: R.format("translate({0},{1})", bbox.x, bbox.y)});
-        };
-        var setFillAndStroke = function (o, params) {
-            var dasharray = {
-                    "": [0],
-                    "none": [0],
-                    "-": [3, 1],
-                    ".": [1, 1],
-                    "-.": [3, 1, 1, 1],
-                    "-..": [3, 1, 1, 1, 1, 1],
-                    ". ": [1, 3],
-                    "- ": [4, 3],
-                    "--": [8, 3],
-                    "- .": [4, 3, 1, 3],
-                    "--.": [8, 3, 1, 3],
-                    "--..": [8, 3, 1, 3, 1, 3]
-                },
-                node = o.node,
-                attrs = o.attrs,
-                rot = o.rotate(),
-                addDashes = function (o, value) {
-                    value = dasharray[lowerCase.call(value)];
-                    if (value) {
-                        var width = o.attrs["stroke-width"] || "1",
-                            butt = {round: width, square: width, butt: 0}[o.attrs["stroke-linecap"] || params["stroke-linecap"]] || 0,
-                            dashes = [];
-                        var i = value[length];
-                        while (i--) {
-                            dashes[i] = value[i] * width + ((i % 2) ? 1 : -1) * butt;
-                        }
-                        $(node, {"stroke-dasharray": dashes[join](",")});
-                    }
-                };
-            params[has]("rotation") && (rot = params.rotation);
-            var rotxy = (rot + E)[split](separator);
-            if (!(rotxy.length - 1)) {
-                rotxy = null;
-            } else {
-                rotxy[1] = +rotxy[1];
-                rotxy[2] = +rotxy[2];
-            }
-            toFloat(rot) && o.rotate(0, true);
-            for (var att in params) {
-                if (params[has](att)) {
-                    if (!availableAttrs[has](att)) {
-                        continue;
-                    }
-                    var value = params[att];
-                    attrs[att] = value;
-                    switch (att) {
-                        case "blur":
-                            o.blur(value);
-                            break;
-                        case "rotation":
-                            o.rotate(value, true);
-                            break;
-                        // Hyperlink
-                        case "href":
-                        case "title":
-                        case "target":
-                            var pn = node.parentNode;
-                            if (lowerCase.call(pn.tagName) != "a") {
-                                var hl = $("a");
-                                pn.insertBefore(hl, node);
-                                hl[appendChild](node);
-                                pn = hl;
-                            }
-                            pn.setAttributeNS(o.paper.xlink, att, value);
-                            break;
-                        case "cursor":
-                            node.style.cursor = value;
-                            break;
-                        case "clip-rect":
-                            var rect = (value + E)[split](separator);
-                            if (rect[length] == 4) {
-                                o.clip && o.clip.parentNode.parentNode.removeChild(o.clip.parentNode);
-                                var el = $("clipPath"),
-                                    rc = $("rect");
-                                el.id = "r" + (R._id++)[toString](36);
-                                $(rc, {
-                                    x: rect[0],
-                                    y: rect[1],
-                                    width: rect[2],
-                                    height: rect[3]
-                                });
-                                el[appendChild](rc);
-                                o.paper.defs[appendChild](el);
-                                $(node, {"clip-path": "url(#" + el.id + ")"});
-                                o.clip = rc;
-                            }
-                            if (!value) {
-                                var clip = doc.getElementById(node.getAttribute("clip-path")[rp](/(^url\(#|\)$)/g, E));
-                                clip && clip.parentNode.removeChild(clip);
-                                $(node, {"clip-path": E});
-                                delete o.clip;
-                            }
-                        break;
-                        case "path":
-                            if (o.type == "path") {
-                                $(node, {d: value ? attrs.path = roundPath(pathToAbsolute(value)) : "M0,0"});
-                            }
-                            break;
-                        case "width":
-                            node[setAttribute](att, value);
-                            if (attrs.fx) {
-                                att = "x";
-                                value = attrs.x;
-                            } else {
-                                break;
-                            }
-                        case "x":
-                            if (attrs.fx) {
-                                value = -attrs.x - (attrs.width || 0);
-                            }
-                        case "rx":
-                            if (att == "rx" && o.type == "rect") {
-                                break;
-                            }
-                        case "cx":
-                            rotxy && (att == "x" || att == "cx") && (rotxy[1] += value - attrs[att]);
-                            node[setAttribute](att, round(value));
-                            o.pattern && updatePosition(o);
-                            break;
-                        case "height":
-                            node[setAttribute](att, value);
-                            if (attrs.fy) {
-                                att = "y";
-                                value = attrs.y;
-                            } else {
-                                break;
-                            }
-                        case "y":
-                            if (attrs.fy) {
-                                value = -attrs.y - (attrs.height || 0);
-                            }
-                        case "ry":
-                            if (att == "ry" && o.type == "rect") {
-                                break;
-                            }
-                        case "cy":
-                            rotxy && (att == "y" || att == "cy") && (rotxy[2] += value - attrs[att]);
-                            node[setAttribute](att, round(value));
-                            o.pattern && updatePosition(o);
-                            break;
-                        case "r":
-                            if (o.type == "rect") {
-                                $(node, {rx: value, ry: value});
-                            } else {
-                                node[setAttribute](att, value);
-                            }
-                            break;
-                        case "src":
-                            if (o.type == "image") {
-                                node.setAttributeNS(o.paper.xlink, "href", value);
-                            }
-                            break;
-                        case "stroke-width":
-                            node.style.strokeWidth = value;
-                            // Need following line for Firefox
-                            node[setAttribute](att, value);
-                            if (attrs["stroke-dasharray"]) {
-                                addDashes(o, attrs["stroke-dasharray"]);
-                            }
-                            break;
-                        case "stroke-dasharray":
-                            addDashes(o, value);
-                            break;
-                        case "translation":
-                            var xy = (value + E)[split](separator);
-                            xy[0] = +xy[0] || 0;
-                            xy[1] = +xy[1] || 0;
-                            if (rotxy) {
-                                rotxy[1] += xy[0];
-                                rotxy[2] += xy[1];
-                            }
-                            translate.call(o, xy[0], xy[1]);
-                            break;
-                        case "scale":
-                            xy = (value + E)[split](separator);
-                            o.scale(+xy[0] || 1, +xy[1] || +xy[0] || 1, isNaN(toFloat(xy[2])) ? null : +xy[2], isNaN(toFloat(xy[3])) ? null : +xy[3]);
-                            break;
-                        case "fill":
-                            var isURL = (value + E).match(ISURL);
-                            if (isURL) {
-                                el = $("pattern");
-                                var ig = $("image");
-                                el.id = "r" + (R._id++)[toString](36);
-                                $(el, {x: 0, y: 0, patternUnits: "userSpaceOnUse", height: 1, width: 1});
-                                $(ig, {x: 0, y: 0});
-                                ig.setAttributeNS(o.paper.xlink, "href", isURL[1]);
-                                el[appendChild](ig);
- 
-                                var img = doc.createElement("img");
-                                img.style.cssText = "position:absolute;left:-9999em;top-9999em";
-                                img.onload = function () {
-                                    $(el, {width: this.offsetWidth, height: this.offsetHeight});
-                                    $(ig, {width: this.offsetWidth, height: this.offsetHeight});
-                                    doc.body.removeChild(this);
-                                    o.paper.safari();
-                                };
-                                doc.body[appendChild](img);
-                                img.src = isURL[1];
-                                o.paper.defs[appendChild](el);
-                                node.style.fill = "url(#" + el.id + ")";
-                                $(node, {fill: "url(#" + el.id + ")"});
-                                o.pattern = el;
-                                o.pattern && updatePosition(o);
-                                break;
-                            }
-                            if (!R.getRGB(value).error) {
-                                delete params.gradient;
-                                delete attrs.gradient;
-                                !R.is(attrs.opacity, "undefined") &&
-                                    R.is(params.opacity, "undefined") &&
-                                    $(node, {opacity: attrs.opacity});
-                                !R.is(attrs["fill-opacity"], "undefined") &&
-                                    R.is(params["fill-opacity"], "undefined") &&
-                                    $(node, {"fill-opacity": attrs["fill-opacity"]});
-                            } else if ((({circle: 1, ellipse: 1})[has](o.type) || (value + E).charAt() != "r") && addGradientFill(node, value, o.paper)) {
-                                attrs.gradient = value;
-                                attrs.fill = "none";
-                                break;
-                            }
-                        case "stroke":
-                            node[setAttribute](att, R.getRGB(value).hex);
-                            break;
-                        case "gradient":
-                            (({circle: 1, ellipse: 1})[has](o.type) || (value + E).charAt() != "r") && addGradientFill(node, value, o.paper);
-                            break;
-                        case "opacity":
-                        case "fill-opacity":
-                            if (attrs.gradient) {
-                                var gradient = doc.getElementById(node.getAttribute("fill")[rp](/^url\(#|\)$/g, E));
-                                if (gradient) {
-                                    var stops = gradient.getElementsByTagName("stop");
-                                    stops[stops[length] - 1][setAttribute]("stop-opacity", value);
-                                }
-                                break;
-                            }
-                        default:
-                            att == "font-size" && (value = toInt(value, 10) + "px");
-                            var cssrule = att[rp](/(\-.)/g, function (w) {
-                                return upperCase.call(w.substring(1));
-                            });
-                            node.style[cssrule] = value;
-                            // Need following line for Firefox
-                            node[setAttribute](att, value);
-                            break;
-                    }
-                }
-            }
-            
-            tuneText(o, params);
-            if (rotxy) {
-                o.rotate(rotxy.join(S));
-            } else {
-                toFloat(rot) && o.rotate(rot, true);
-            }
-        };
-        var leading = 1.2,
-        tuneText = function (el, params) {
-            if (el.type != "text" || !(params[has]("text") || params[has]("font") || params[has]("font-size") || params[has]("x") || params[has]("y"))) {
-                return;
-            }
-            var a = el.attrs,
-                node = el.node,
-                fontSize = node.firstChild ? toInt(doc.defaultView.getComputedStyle(node.firstChild, E).getPropertyValue("font-size"), 10) : 10;
- 
-            if (params[has]("text")) {
-                a.text = params.text;
-                while (node.firstChild) {
-                    node.removeChild(node.firstChild);
-                }
-                var texts = (params.text + E)[split]("\n");
-                for (var i = 0, ii = texts[length]; i < ii; i++) if (texts[i]) {
-                    var tspan = $("tspan");
-                    i && $(tspan, {dy: fontSize * leading, x: a.x});
-                    tspan[appendChild](doc.createTextNode(texts[i]));
-                    node[appendChild](tspan);
-                }
-            } else {
-                texts = node.getElementsByTagName("tspan");
-                for (i = 0, ii = texts[length]; i < ii; i++) {
-                    i && $(texts[i], {dy: fontSize * leading, x: a.x});
-                }
-            }
-            $(node, {y: a.y});
-            var bb = el.getBBox(),
-                dif = a.y - (bb.y + bb.height / 2);
-            dif && isFinite(dif) && $(node, {y: a.y + dif});
-        },
-        Element = function (node, svg) {
-            var X = 0,
-                Y = 0;
-            this[0] = node;
-            this.id = R._oid++;
-            this.node = node;
-            node.raphael = this;
-            this.paper = svg;
-            this.attrs = this.attrs || {};
-            this.transformations = []; // rotate, translate, scale
-            this._ = {
-                tx: 0,
-                ty: 0,
-                rt: {deg: 0, cx: 0, cy: 0},
-                sx: 1,
-                sy: 1
-            };
-            !svg.bottom && (svg.bottom = this);
-            this.prev = svg.top;
-            svg.top && (svg.top.next = this);
-            svg.top = this;
-            this.next = null;
-        };
-        Element[proto].rotate = function (deg, cx, cy) {
-            if (this.removed) {
-                return this;
-            }
-            if (deg == null) {
-                if (this._.rt.cx) {
-                    return [this._.rt.deg, this._.rt.cx, this._.rt.cy][join](S);
-                }
-                return this._.rt.deg;
-            }
-            var bbox = this.getBBox();
-            deg = (deg + E)[split](separator);
-            if (deg[length] - 1) {
-                cx = toFloat(deg[1]);
-                cy = toFloat(deg[2]);
-            }
-            deg = toFloat(deg[0]);
-            if (cx != null) {
-                this._.rt.deg = deg;
-            } else {
-                this._.rt.deg += deg;
-            }
-            (cy == null) && (cx = null);
-            this._.rt.cx = cx;
-            this._.rt.cy = cy;
-            cx = cx == null ? bbox.x + bbox.width / 2 : cx;
-            cy = cy == null ? bbox.y + bbox.height / 2 : cy;
-            if (this._.rt.deg) {
-                this.transformations[0] = R.format("rotate({0} {1} {2})", this._.rt.deg, cx, cy);
-                this.clip && $(this.clip, {transform: R.format("rotate({0} {1} {2})", -this._.rt.deg, cx, cy)});
-            } else {
-                this.transformations[0] = E;
-                this.clip && $(this.clip, {transform: E});
-            }
-            $(this.node, {transform: this.transformations[join](S)});
-            return this;
-        };
-        Element[proto].hide = function () {
-            !this.removed && (this.node.style.display = "none");
-            return this;
-        };
-        Element[proto].show = function () {
-            !this.removed && (this.node.style.display = "");
-            return this;
-        };
-        Element[proto].remove = function () {
-            if (this.removed) {
-                return;
-            }
-            tear(this, this.paper);
-            this.node.parentNode.removeChild(this.node);
-            for (var i in this) {
-                delete this[i];
-            }
-            this.removed = true;
-        };
-        Element[proto].getBBox = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.type == "path") {
-                return pathDimensions(this.attrs.path);
-            }
-            if (this.node.style.display == "none") {
-                this.show();
-                var hide = true;
-            }
-            var bbox = {};
-            try {
-                bbox = this.node.getBBox();
-            } catch(e) {
-                // Firefox 3.0.x plays badly here
-            } finally {
-                bbox = bbox || {};
-            }
-            if (this.type == "text") {
-                bbox = {x: bbox.x, y: Infinity, width: 0, height: 0};
-                for (var i = 0, ii = this.node.getNumberOfChars(); i < ii; i++) {
-                    var bb = this.node.getExtentOfChar(i);
-                    (bb.y < bbox.y) && (bbox.y = bb.y);
-                    (bb.y + bb.height - bbox.y > bbox.height) && (bbox.height = bb.y + bb.height - bbox.y);
-                    (bb.x + bb.width - bbox.x > bbox.width) && (bbox.width = bb.x + bb.width - bbox.x);
-                }
-            }
-            hide && this.hide();
-            return bbox;
-        };
-        Element[proto].attr = function (name, value) {
-            if (this.removed) {
-                return this;
-            }
-            if (name == null) {
-                var res = {};
-                for (var i in this.attrs) if (this.attrs[has](i)) {
-                    res[i] = this.attrs[i];
-                }
-                this._.rt.deg && (res.rotation = this.rotate());
-                (this._.sx != 1 || this._.sy != 1) && (res.scale = this.scale());
-                res.gradient && res.fill == "none" && (res.fill = res.gradient) && delete res.gradient;
-                return res;
-            }
-            if (value == null && R.is(name, "string")) {
-                if (name == "translation") {
-                    return translate.call(this);
-                }
-                if (name == "rotation") {
-                    return this.rotate();
-                }
-                if (name == "scale") {
-                    return this.scale();
-                }
-                if (name == "fill" && this.attrs.fill == "none" && this.attrs.gradient) {
-                    return this.attrs.gradient;
-                }
-                return this.attrs[name];
-            }
-            if (value == null && R.is(name, "array")) {
-                var values = {};
-                for (var j = 0, jj = name.length; j < jj; j++) {
-                    values[name[j]] = this.attr(name[j]);
-                }
-                return values;
-            }
-            if (value != null) {
-                var params = {};
-                params[name] = value;
-                setFillAndStroke(this, params);
-            } else if (name != null && R.is(name, "object")) {
-                setFillAndStroke(this, name);
-            }
-            return this;
-        };
-        Element[proto].toFront = function () {
-            if (this.removed) {
-                return this;
-            }
-            this.node.parentNode[appendChild](this.node);
-            var svg = this.paper;
-            svg.top != this && tofront(this, svg);
-            return this;
-        };
-        Element[proto].toBack = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.node.parentNode.firstChild != this.node) {
-                this.node.parentNode.insertBefore(this.node, this.node.parentNode.firstChild);
-                toback(this, this.paper);
-                var svg = this.paper;
-            }
-            return this;
-        };
-        Element[proto].insertAfter = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            var node = element.node;
-            if (node.nextSibling) {
-                node.parentNode.insertBefore(this.node, node.nextSibling);
-            } else {
-                node.parentNode[appendChild](this.node);
-            }
-            insertafter(this, element, this.paper);
-            return this;
-        };
-        Element[proto].insertBefore = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            var node = element.node;
-            node.parentNode.insertBefore(this.node, node);
-            insertbefore(this, element, this.paper);
-            return this;
-        };
-        Element[proto].blur = function (size) {
-            // Experimental. No Safari support. Use it on your own risk.
-            var t = this;
-            if (+size !== 0) {
-                var fltr = $("filter"),
-                    blur = $("feGaussianBlur");
-                t.attrs.blur = size;
-                fltr.id = "r" + (R._id++)[toString](36);
-                $(blur, {stdDeviation: +size || 1.5});
-                fltr.appendChild(blur);
-                t.paper.defs.appendChild(fltr);
-                t._blur = fltr;
-                $(t.node, {filter: "url(#" + fltr.id + ")"});
-            } else {
-                if (t._blur) {
-                    t._blur.parentNode.removeChild(t._blur);
-                    delete t._blur;
-                    delete t.attrs.blur;
-                }
-                t.node.removeAttribute("filter");
-            }
-        };
-        var theCircle = function (svg, x, y, r) {
-            x = round(x);
-            y = round(y);
-            var el = $("circle");
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {cx: x, cy: y, r: r, fill: "none", stroke: "#000"};
-            res.type = "circle";
-            $(el, res.attrs);
-            return res;
-        };
-        var theRect = function (svg, x, y, w, h, r) {
-            x = round(x);
-            y = round(y);
-            var el = $("rect");
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {x: x, y: y, width: w, height: h, r: r || 0, rx: r || 0, ry: r || 0, fill: "none", stroke: "#000"};
-            res.type = "rect";
-            $(el, res.attrs);
-            return res;
-        };
-        var theEllipse = function (svg, x, y, rx, ry) {
-            x = round(x);
-            y = round(y);
-            var el = $("ellipse");
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {cx: x, cy: y, rx: rx, ry: ry, fill: "none", stroke: "#000"};
-            res.type = "ellipse";
-            $(el, res.attrs);
-            return res;
-        };
-        var theImage = function (svg, src, x, y, w, h) {
-            var el = $("image");
-            $(el, {x: x, y: y, width: w, height: h, preserveAspectRatio: "none"});
-            el.setAttributeNS(svg.xlink, "href", src);
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {x: x, y: y, width: w, height: h, src: src};
-            res.type = "image";
-            return res;
-        };
-        var theText = function (svg, x, y, text) {
-            var el = $("text");
-            $(el, {x: x, y: y, "text-anchor": "middle"});
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {x: x, y: y, "text-anchor": "middle", text: text, font: availableAttrs.font, stroke: "none", fill: "#000"};
-            res.type = "text";
-            setFillAndStroke(res, res.attrs);
-            return res;
-        };
-        var setSize = function (width, height) {
-            this.width = width || this.width;
-            this.height = height || this.height;
-            this.canvas[setAttribute]("width", this.width);
-            this.canvas[setAttribute]("height", this.height);
-            return this;
-        };
-        var create = function () {
-            var con = getContainer[apply](0, arguments),
-                container = con && con.container,
-                x = con.x,
-                y = con.y,
-                width = con.width,
-                height = con.height;
-            if (!container) {
-                throw new Error("SVG container not found.");
-            }
-            var cnvs = $("svg");
-            width = width || 512;
-            height = height || 342;
-            $(cnvs, {
-                xmlns: "http://www.w3.org/2000/svg",
-                version: 1.1,
-                width: width,
-                height: height
-            });
-            if (container == 1) {
-                cnvs.style.cssText = "position:absolute;left:" + x + "px;top:" + y + "px";
-                doc.body[appendChild](cnvs);
-            } else {
-                if (container.firstChild) {
-                    container.insertBefore(cnvs, container.firstChild);
-                } else {
-                    container[appendChild](cnvs);
-                }
-            }
-            container = new Paper;
-            container.width = width;
-            container.height = height;
-            container.canvas = cnvs;
-            plugins.call(container, container, R.fn);
-            container.clear();
-            return container;
-        };
-        Paper[proto].clear = function () {
-            var c = this.canvas;
-            while (c.firstChild) {
-                c.removeChild(c.firstChild);
-            }
-            this.bottom = this.top = null;
-            (this.desc = $("desc"))[appendChild](doc.createTextNode("Created with Rapha\xebl"));
-            c[appendChild](this.desc);
-            c[appendChild](this.defs = $("defs"));
-        };
-        Paper[proto].remove = function () {
-            this.canvas.parentNode && this.canvas.parentNode.removeChild(this.canvas);
-            for (var i in this) {
-                this[i] = removed(i);
-            }
-        };
-    }
-
-    // VML
-    if (R.vml) {
-        var map = {M: "m", L: "l", C: "c", Z: "x", m: "t", l: "r", c: "v", z: "x"},
-            bites = /([clmz]),?([^clmz]*)/gi,
-            val = /-?[^,\s-]+/g,
-            coordsize = 1e3 + S + 1e3,
-            zoom = 10,
-            path2vml = function (path) {
-                var total =  /[ahqstv]/ig,
-                    command = pathToAbsolute;
-                (path + E).match(total) && (command = path2curve);
-                total = /[clmz]/g;
-                if (command == pathToAbsolute && !(path + E).match(total)) {
-                    var res = (path + E)[rp](bites, function (all, command, args) {
-                        var vals = [],
-                            isMove = lowerCase.call(command) == "m",
-                            res = map[command];
-                        args[rp](val, function (value) {
-                            if (isMove && vals[length] == 2) {
-                                res += vals + map[command == "m" ? "l" : "L"];
-                                vals = [];
-                            }
-                            vals[push](round(value * zoom));
-                        });
-                        return res + vals;
-                    });
-                    return res;
-                }
-                var pa = command(path), p, r;
-                res = [];
-                for (var i = 0, ii = pa[length]; i < ii; i++) {
-                    p = pa[i];
-                    r = lowerCase.call(pa[i][0]);
-                    r == "z" && (r = "x");
-                    for (var j = 1, jj = p[length]; j < jj; j++) {
-                        r += round(p[j] * zoom) + (j != jj - 1 ? "," : E);
-                    }
-                    res[push](r);
-                }
-                return res[join](S);
-            };
-        
-        R[toString] = function () {
-            return  "Your browser doesn\u2019t support SVG. Falling down to VML.\nYou are running Rapha\xebl " + this.version;
-        };
-        thePath = function (pathString, vml) {
-            var g = createNode("group");
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = vml.coordsize;
-            g.coordorigin = vml.coordorigin;
-            var el = createNode("shape"), ol = el.style;
-            ol.width = vml.width + "px";
-            ol.height = vml.height + "px";
-            el.coordsize = coordsize;
-            el.coordorigin = vml.coordorigin;
-            g[appendChild](el);
-            var p = new Element(el, g, vml),
-                attr = {fill: "none", stroke: "#000"};
-            pathString && (attr.path = pathString);
-            p.isAbsolute = true;
-            p.type = "path";
-            p.path = [];
-            p.Path = E;
-            setFillAndStroke(p, attr);
-            vml.canvas[appendChild](g);
-            return p;
-        };
-        setFillAndStroke = function (o, params) {
-            o.attrs = o.attrs || {};
-            var node = o.node,
-                a = o.attrs,
-                s = node.style,
-                xy,
-                res = o;
-            for (var par in params) if (params[has](par)) {
-                a[par] = params[par];
-            }
-            params.href && (node.href = params.href);
-            params.title && (node.title = params.title);
-            params.target && (node.target = params.target);
-            params.cursor && (s.cursor = params.cursor);
-            "blur" in params && o.blur(params.blur);
-            if (params.path && o.type == "path") {
-                a.path = params.path;
-                node.path = path2vml(a.path);
-            }
-            if (params.rotation != null) {
-                o.rotate(params.rotation, true);
-            }
-            if (params.translation) {
-                xy = (params.translation + E)[split](separator);
-                translate.call(o, xy[0], xy[1]);
-                if (o._.rt.cx != null) {
-                    o._.rt.cx +=+ xy[0];
-                    o._.rt.cy +=+ xy[1];
-                    o.setBox(o.attrs, xy[0], xy[1]);
-                }
-            }
-            if (params.scale) {
-                xy = (params.scale + E)[split](separator);
-                o.scale(+xy[0] || 1, +xy[1] || +xy[0] || 1, +xy[2] || null, +xy[3] || null);
-            }
-            if ("clip-rect" in params) {
-                var rect = (params["clip-rect"] + E)[split](separator);
-                if (rect[length] == 4) {
-                    rect[2] = +rect[2] + (+rect[0]);
-                    rect[3] = +rect[3] + (+rect[1]);
-                    var div = node.clipRect || doc.createElement("div"),
-                        dstyle = div.style,
-                        group = node.parentNode;
-                    dstyle.clip = R.format("rect({1}px {2}px {3}px {0}px)", rect);
-                    if (!node.clipRect) {
-                        dstyle.position = "absolute";
-                        dstyle.top = 0;
-                        dstyle.left = 0;
-                        dstyle.width = o.paper.width + "px";
-                        dstyle.height = o.paper.height + "px";
-                        group.parentNode.insertBefore(div, group);
-                        div[appendChild](group);
-                        node.clipRect = div;
-                    }
-                }
-                if (!params["clip-rect"]) {
-                    node.clipRect && (node.clipRect.style.clip = E);
-                }
-            }
-            if (o.type == "image" && params.src) {
-                node.src = params.src;
-            }
-            if (o.type == "image" && params.opacity) {
-                node.filterOpacity = " progid:DXImageTransform.Microsoft.Alpha(opacity=" + (params.opacity * 100) + ")";
-                s.filter = (node.filterMatrix || E) + (node.filterOpacity || E);
-            }
-            params.font && (s.font = params.font);
-            params["font-family"] && (s.fontFamily = '"' + params["font-family"][split](",")[0][rp](/^['"]+|['"]+$/g, E) + '"'); //'
-            params["font-size"] && (s.fontSize = params["font-size"]);
-            params["font-weight"] && (s.fontWeight = params["font-weight"]);
-            params["font-style"] && (s.fontStyle = params["font-style"]);
-            if (params.opacity != null || 
-                params["stroke-width"] != null ||
-                params.fill != null ||
-                params.stroke != null ||
-                params["stroke-width"] != null ||
-                params["stroke-opacity"] != null ||
-                params["fill-opacity"] != null ||
-                params["stroke-dasharray"] != null ||
-                params["stroke-miterlimit"] != null ||
-                params["stroke-linejoin"] != null ||
-                params["stroke-linecap"] != null) {
-                node = o.shape || node;
-                var fill = (node.getElementsByTagName("fill") && node.getElementsByTagName("fill")[0]),
-                    newfill = false;
-                !fill && (newfill = fill = createNode("fill"));
-                if ("fill-opacity" in params || "opacity" in params) {
-                    var opacity = ((+a["fill-opacity"] + 1 || 2) - 1) * ((+a.opacity + 1 || 2) - 1);
-                    opacity < 0 && (opacity = 0);
-                    opacity > 1 && (opacity = 1);
-                    fill.opacity = opacity;
-                }
-                params.fill && (fill.on = true);
-                if (fill.on == null || params.fill == "none") {
-                    fill.on = false;
-                }
-                if (fill.on && params.fill) {
-                    var isURL = params.fill.match(ISURL);
-                    if (isURL) {
-                        fill.src = isURL[1];
-                        fill.type = "tile";
-                    } else {
-                        fill.color = R.getRGB(params.fill).hex;
-                        fill.src = E;
-                        fill.type = "solid";
-                        if (R.getRGB(params.fill).error && (res.type in {circle: 1, ellipse: 1} || (params.fill + E).charAt() != "r") && addGradientFill(res, params.fill)) {
-                            a.fill = "none";
-                            a.gradient = params.fill;
-                        }
-                    }
-                }
-                newfill && node[appendChild](fill);
-                var stroke = (node.getElementsByTagName("stroke") && node.getElementsByTagName("stroke")[0]),
-                newstroke = false;
-                !stroke && (newstroke = stroke = createNode("stroke"));
-                if ((params.stroke && params.stroke != "none") ||
-                    params["stroke-width"] ||
-                    params["stroke-opacity"] != null ||
-                    params["stroke-dasharray"] ||
-                    params["stroke-miterlimit"] ||
-                    params["stroke-linejoin"] ||
-                    params["stroke-linecap"]) {
-                    stroke.on = true;
-                }
-                (params.stroke == "none" || stroke.on == null || params.stroke == 0 || params["stroke-width"] == 0) && (stroke.on = false);
-                stroke.on && params.stroke && (stroke.color = R.getRGB(params.stroke).hex);
-                opacity = ((+a["stroke-opacity"] + 1 || 2) - 1) * ((+a.opacity + 1 || 2) - 1);
-                var width = (toFloat(params["stroke-width"]) || 1) * .75;
-                opacity < 0 && (opacity = 0);
-                opacity > 1 && (opacity = 1);
-                params["stroke-width"] == null && (width = a["stroke-width"]);
-                params["stroke-width"] && (stroke.weight = width);
-                width && width < 1 && (opacity *= width) && (stroke.weight = 1);
-                stroke.opacity = opacity;
-                
-                params["stroke-linejoin"] && (stroke.joinstyle = params["stroke-linejoin"] || "miter");
-                stroke.miterlimit = params["stroke-miterlimit"] || 8;
-                params["stroke-linecap"] && (stroke.endcap = params["stroke-linecap"] == "butt" ? "flat" : params["stroke-linecap"] == "square" ? "square" : "round");
-                if (params["stroke-dasharray"]) {
-                    var dasharray = {
-                        "-": "shortdash",
-                        ".": "shortdot",
-                        "-.": "shortdashdot",
-                        "-..": "shortdashdotdot",
-                        ". ": "dot",
-                        "- ": "dash",
-                        "--": "longdash",
-                        "- .": "dashdot",
-                        "--.": "longdashdot",
-                        "--..": "longdashdotdot"
-                    };
-                    stroke.dashstyle = dasharray[has](params["stroke-dasharray"]) ? dasharray[params["stroke-dasharray"]] : E;
-                }
-                newstroke && node[appendChild](stroke);
-            }
-            if (res.type == "text") {
-                s = res.paper.span.style;
-                a.font && (s.font = a.font);
-                a["font-family"] && (s.fontFamily = a["font-family"]);
-                a["font-size"] && (s.fontSize = a["font-size"]);
-                a["font-weight"] && (s.fontWeight = a["font-weight"]);
-                a["font-style"] && (s.fontStyle = a["font-style"]);
-                res.node.string && (res.paper.span.innerHTML = (res.node.string + E)[rp](/</g, "&#60;")[rp](/&/g, "&#38;")[rp](/\n/g, "<br>"));
-                res.W = a.w = res.paper.span.offsetWidth;
-                res.H = a.h = res.paper.span.offsetHeight;
-                res.X = a.x;
-                res.Y = a.y + round(res.H / 2);
- 
-                // text-anchor emulationm
-                switch (a["text-anchor"]) {
-                    case "start":
-                        res.node.style["v-text-align"] = "left";
-                        res.bbx = round(res.W / 2);
-                    break;
-                    case "end":
-                        res.node.style["v-text-align"] = "right";
-                        res.bbx = -round(res.W / 2);
-                    break;
-                    default:
-                        res.node.style["v-text-align"] = "center";
-                    break;
-                }
-            }
-        };
-        addGradientFill = function (o, gradient) {
-            o.attrs = o.attrs || {};
-            var attrs = o.attrs,
-                fill = o.node.getElementsByTagName("fill"),
-                type = "linear",
-                fxfy = ".5 .5";
-            o.attrs.gradient = gradient;
-            gradient = (gradient + E)[rp](radial_gradient, function (all, fx, fy) {
-                type = "radial";
-                if (fx && fy) {
-                    fx = toFloat(fx);
-                    fy = toFloat(fy);
-                    pow(fx - .5, 2) + pow(fy - .5, 2) > .25 && (fy = math.sqrt(.25 - pow(fx - .5, 2)) * ((fy > .5) * 2 - 1) + .5);
-                    fxfy = fx + S + fy;
-                }
-                return E;
-            });
-            gradient = gradient[split](/\s*\-\s*/);
-            if (type == "linear") {
-                var angle = gradient.shift();
-                angle = -toFloat(angle);
-                if (isNaN(angle)) {
-                    return null;
-                }
-            }
-            var dots = parseDots(gradient);
-            if (!dots) {
-                return null;
-            }
-            o = o.shape || o.node;
-            fill = fill[0] || createNode("fill");
-            if (dots[length]) {
-                fill.on = true;
-                fill.method = "none";
-                fill.type = (type == "radial") ? "gradientradial" : "gradient";
-                fill.color = dots[0].color;
-                fill.color2 = dots[dots[length] - 1].color;
-                var clrs = [];
-                for (var i = 0, ii = dots[length]; i < ii; i++) {
-                    dots[i].offset && clrs[push](dots[i].offset + S + dots[i].color);
-                }
-                fill.colors && (fill.colors.value = clrs[length] ? clrs[join](",") : "0% " + fill.color);
-                if (type == "radial") {
-                    fill.focus = "100%";
-                    fill.focussize = fxfy;
-                    fill.focusposition = fxfy;
-                } else {
-                    fill.angle = (270 - angle) % 360;
-                }
-            }
-            return 1;
-        };
-        Element = function (node, group, vml) {
-            var Rotation = 0,
-                RotX = 0,
-                RotY = 0,
-                Scale = 1;
-            this[0] = node;
-            this.id = R._oid++;
-            this.node = node;
-            node.raphael = this;
-            this.X = 0;
-            this.Y = 0;
-            this.attrs = {};
-            this.Group = group;
-            this.paper = vml;
-            this._ = {
-                tx: 0,
-                ty: 0,
-                rt: {deg:0},
-                sx: 1,
-                sy: 1
-            };
-            !vml.bottom && (vml.bottom = this);
-            this.prev = vml.top;
-            vml.top && (vml.top.next = this);
-            vml.top = this;
-            this.next = null;
-        };
-        Element[proto].rotate = function (deg, cx, cy) {
-            if (this.removed) {
-                return this;
-            }
-            if (deg == null) {
-                if (this._.rt.cx) {
-                    return [this._.rt.deg, this._.rt.cx, this._.rt.cy][join](S);
-                }
-                return this._.rt.deg;
-            }
-            deg = (deg + E)[split](separator);
-            if (deg[length] - 1) {
-                cx = toFloat(deg[1]);
-                cy = toFloat(deg[2]);
-            }
-            deg = toFloat(deg[0]);
-            if (cx != null) {
-                this._.rt.deg = deg;
-            } else {
-                this._.rt.deg += deg;
-            }
-            cy == null && (cx = null);
-            this._.rt.cx = cx;
-            this._.rt.cy = cy;
-            this.setBox(this.attrs, cx, cy);
-            this.Group.style.rotation = this._.rt.deg;
-            // gradient fix for rotation. TODO
-            // var fill = (this.shape || this.node).getElementsByTagName("fill");
-            // fill = fill[0] || {};
-            // var b = ((360 - this._.rt.deg) - 270) % 360;
-            // !R.is(fill.angle, "undefined") && (fill.angle = b);
-            return this;
-        };
-        Element[proto].setBox = function (params, cx, cy) {
-            if (this.removed) {
-                return this;
-            }
-            var gs = this.Group.style,
-                os = (this.shape && this.shape.style) || this.node.style;
-            params = params || {};
-            for (var i in params) if (params[has](i)) {
-                this.attrs[i] = params[i];
-            }
-            cx = cx || this._.rt.cx;
-            cy = cy || this._.rt.cy;
-            var attr = this.attrs,
-                x,
-                y,
-                w,
-                h;
-            switch (this.type) {
-                case "circle":
-                    x = attr.cx - attr.r;
-                    y = attr.cy - attr.r;
-                    w = h = attr.r * 2;
-                    break;
-                case "ellipse":
-                    x = attr.cx - attr.rx;
-                    y = attr.cy - attr.ry;
-                    w = attr.rx * 2;
-                    h = attr.ry * 2;
-                    break;
-                case "rect":
-                case "image":
-                    x = +attr.x;
-                    y = +attr.y;
-                    w = attr.width || 0;
-                    h = attr.height || 0;
-                    break;
-                case "text":
-                    this.textpath.v = ["m", round(attr.x), ", ", round(attr.y - 2), "l", round(attr.x) + 1, ", ", round(attr.y - 2)][join](E);
-                    x = attr.x - round(this.W / 2);
-                    y = attr.y - this.H / 2;
-                    w = this.W;
-                    h = this.H;
-                    break;
-                case "path":
-                    if (!this.attrs.path) {
-                        x = 0;
-                        y = 0;
-                        w = this.paper.width;
-                        h = this.paper.height;
-                    } else {
-                        var dim = pathDimensions(this.attrs.path);
-                        x = dim.x;
-                        y = dim.y;
-                        w = dim.width;
-                        h = dim.height;
-                    }
-                    break;
-                default:
-                    x = 0;
-                    y = 0;
-                    w = this.paper.width;
-                    h = this.paper.height;
-                    break;
-            }
-            cx = (cx == null) ? x + w / 2 : cx;
-            cy = (cy == null) ? y + h / 2 : cy;
-            var left = cx - this.paper.width / 2,
-                top = cy - this.paper.height / 2, t;
-            gs.left != (t = left + "px") && (gs.left = t);
-            gs.top != (t = top + "px") && (gs.top = t);
-            this.X = this.type == "path" ? -left : x;
-            this.Y = this.type == "path" ? -top : y;
-            this.W = w;
-            this.H = h;
-            if (this.type == "path") {
-                os.left != (t = -left * zoom + "px") && (os.left = t);
-                os.top != (t = -top * zoom + "px") && (os.top = t);
-            } else if (this.type == "text") {
-                os.left != (t = -left + "px") && (os.left = t);
-                os.top != (t = -top + "px") && (os.top = t);
-            } else {
-                gs.width != (t = this.paper.width + "px") && (gs.width = t);
-                gs.height != (t = this.paper.height + "px") && (gs.height = t);
-                os.left != (t = x - left + "px") && (os.left = t);
-                os.top != (t = y - top + "px") && (os.top = t);
-                os.width != (t = w + "px") && (os.width = t);
-                os.height != (t = h + "px") && (os.height = t);
-                var arcsize = (+params.r || 0) / mmin(w, h);
-                if (this.type == "rect" && this.arcsize.toFixed(4) != arcsize.toFixed(4) && (arcsize || this.arcsize)) {
-                    // We should replace element with the new one
-                    var o = createNode("roundrect"),
-                        a = {},
-                        ii = this.events && this.events[length];
-                    i = 0;
-                    o.arcsize = arcsize;
-                    o.raphael = this;
-                    this.Group[appendChild](o);
-                    this.Group.removeChild(this.node);
-                    this[0] = this.node = o;
-                    this.arcsize = arcsize;
-                    for (i in attr) {
-                        a[i] = attr[i];
-                    }
-                    delete a.scale;
-                    this.attr(a);
-                    if (this.events) for (; i < ii; i++) {
-                        this.events[i].unbind = addEvent(this.node, this.events[i].name, this.events[i].f, this);
-                    }
-                }
-            }
-        };
-        Element[proto].hide = function () {
-            !this.removed && (this.Group.style.display = "none");
-            return this;
-        };
-        Element[proto].show = function () {
-            !this.removed && (this.Group.style.display = "block");
-            return this;
-        };
-        Element[proto].getBBox = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.type == "path") {
-                return pathDimensions(this.attrs.path);
-            }
-            return {
-                x: this.X + (this.bbx || 0),
-                y: this.Y,
-                width: this.W,
-                height: this.H
-            };
-        };
-        Element[proto].remove = function () {
-            if (this.removed) {
-                return;
-            }
-            tear(this, this.paper);
-            this.node.parentNode.removeChild(this.node);
-            this.Group.parentNode.removeChild(this.Group);
-            this.shape && this.shape.parentNode.removeChild(this.shape);
-            for (var i in this) {
-                delete this[i];
-            }
-            this.removed = true;
-        };
-        Element[proto].attr = function (name, value) {
-            if (this.removed) {
-                return this;
-            }
-            if (name == null) {
-                var res = {};
-                for (var i in this.attrs) if (this.attrs[has](i)) {
-                    res[i] = this.attrs[i];
-                }
-                this._.rt.deg && (res.rotation = this.rotate());
-                (this._.sx != 1 || this._.sy != 1) && (res.scale = this.scale());
-                res.gradient && res.fill == "none" && (res.fill = res.gradient) && delete res.gradient;
-                return res;
-            }
-            if (value == null && R.is(name, "string")) {
-                if (name == "translation") {
-                    return translate.call(this);
-                }
-                if (name == "rotation") {
-                    return this.rotate();
-                }
-                if (name == "scale") {
-                    return this.scale();
-                }
-                if (name == "fill" && this.attrs.fill == "none" && this.attrs.gradient) {
-                    return this.attrs.gradient;
-                }
-                return this.attrs[name];
-            }
-            if (this.attrs && value == null && R.is(name, "array")) {
-                var ii, values = {};
-                for (i = 0, ii = name[length]; i < ii; i++) {
-                    values[name[i]] = this.attr(name[i]);
-                }
-                return values;
-            }
-            var params;
-            if (value != null) {
-                params = {};
-                params[name] = value;
-            }
-            value == null && R.is(name, "object") && (params = name);
-            if (params) {
-                if (params.text && this.type == "text") {
-                    this.node.string = params.text;
-                }
-                setFillAndStroke(this, params);
-                if (params.gradient && (({circle: 1, ellipse: 1})[has](this.type) || (params.gradient + E).charAt() != "r")) {
-                    addGradientFill(this, params.gradient);
-                }
-                (this.type != "path" || this._.rt.deg) && this.setBox(this.attrs);
-            }
-            return this;
-        };
-        Element[proto].toFront = function () {
-            !this.removed && this.Group.parentNode[appendChild](this.Group);
-            this.paper.top != this && tofront(this, this.paper);
-            return this;
-        };
-        Element[proto].toBack = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.Group.parentNode.firstChild != this.Group) {
-                this.Group.parentNode.insertBefore(this.Group, this.Group.parentNode.firstChild);
-                toback(this, this.paper);
-            }
-            return this;
-        };
-        Element[proto].insertAfter = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            if (element.Group.nextSibling) {
-                element.Group.parentNode.insertBefore(this.Group, element.Group.nextSibling);
-            } else {
-                element.Group.parentNode[appendChild](this.Group);
-            }
-            insertafter(this, element, this.paper);
-            return this;
-        };
-        Element[proto].insertBefore = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            element.Group.parentNode.insertBefore(this.Group, element.Group);
-            insertbefore(this, element, this.paper);
-            return this;
-        };
-        var blurregexp = / progid:\S+Blur\([^\)]+\)/g;
-        Element[proto].blur = function (size) {
-            var s = this.node.style,
-                f = s.filter;
-            f = f.replace(blurregexp, "");
-            if (+size !== 0) {
-                this.attrs.blur = size;
-                s.filter = f + " progid:DXImageTransform.Microsoft.Blur(pixelradius=" + (+size || 1.5) + ")";
-                s.margin = Raphael.format("-{0}px 0 0 -{0}px", Math.round(+size || 1.5));
-            } else {
-                s.filter = f;
-                s.margin = 0;
-                delete this.attrs.blur;
-            }
-        };
- 
-        theCircle = function (vml, x, y, r) {
-            var g = createNode("group"),
-                o = createNode("oval"),
-                ol = o.style;
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            g[appendChild](o);
-            var res = new Element(o, g, vml);
-            res.type = "circle";
-            setFillAndStroke(res, {stroke: "#000", fill: "none"});
-            res.attrs.cx = x;
-            res.attrs.cy = y;
-            res.attrs.r = r;
-            res.setBox({x: x - r, y: y - r, width: r * 2, height: r * 2});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theRect = function (vml, x, y, w, h, r) {
-            var g = createNode("group"),
-                o = createNode("roundrect"),
-                arcsize = (+r || 0) / (mmin(w, h));
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            g[appendChild](o);
-            o.arcsize = arcsize;
-            var res = new Element(o, g, vml);
-            res.type = "rect";
-            setFillAndStroke(res, {stroke: "#000"});
-            res.arcsize = arcsize;
-            res.setBox({x: x, y: y, width: w, height: h, r: r});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theEllipse = function (vml, x, y, rx, ry) {
-            var g = createNode("group"),
-                o = createNode("oval"),
-                ol = o.style;
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            g[appendChild](o);
-            var res = new Element(o, g, vml);
-            res.type = "ellipse";
-            setFillAndStroke(res, {stroke: "#000"});
-            res.attrs.cx = x;
-            res.attrs.cy = y;
-            res.attrs.rx = rx;
-            res.attrs.ry = ry;
-            res.setBox({x: x - rx, y: y - ry, width: rx * 2, height: ry * 2});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theImage = function (vml, src, x, y, w, h) {
-            var g = createNode("group"),
-                o = createNode("image"),
-                ol = o.style;
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            o.src = src;
-            g[appendChild](o);
-            var res = new Element(o, g, vml);
-            res.type = "image";
-            res.attrs.src = src;
-            res.attrs.x = x;
-            res.attrs.y = y;
-            res.attrs.w = w;
-            res.attrs.h = h;
-            res.setBox({x: x, y: y, width: w, height: h});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theText = function (vml, x, y, text) {
-            var g = createNode("group"),
-                el = createNode("shape"),
-                ol = el.style,
-                path = createNode("path"),
-                ps = path.style,
-                o = createNode("textpath");
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            path.v = R.format("m{0},{1}l{2},{1}", round(x * 10), round(y * 10), round(x * 10) + 1);
-            path.textpathok = true;
-            ol.width = vml.width;
-            ol.height = vml.height;
-            o.string = text + E;
-            o.on = true;
-            el[appendChild](o);
-            el[appendChild](path);
-            g[appendChild](el);
-            var res = new Element(o, g, vml);
-            res.shape = el;
-            res.textpath = path;
-            res.type = "text";
-            res.attrs.text = text;
-            res.attrs.x = x;
-            res.attrs.y = y;
-            res.attrs.w = 1;
-            res.attrs.h = 1;
-            setFillAndStroke(res, {font: availableAttrs.font, stroke: "none", fill: "#000"});
-            res.setBox();
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        setSize = function (width, height) {
-            var cs = this.canvas.style;
-            width == +width && (width += "px");
-            height == +height && (height += "px");
-            cs.width = width;
-            cs.height = height;
-            cs.clip = "rect(0 " + width + " " + height + " 0)";
-            return this;
-        };
-        var createNode;
-        doc.createStyleSheet().addRule(".rvml", "behavior:url(#default#VML)");
-        try {
-            !doc.namespaces.rvml && doc.namespaces.add("rvml", "urn:schemas-microsoft-com:vml");
-            createNode = function (tagName) {
-                return doc.createElement('<rvml:' + tagName + ' class="rvml">');
-            };
-        } catch (e) {
-            createNode = function (tagName) {
-                return doc.createElement('<' + tagName + ' xmlns="urn:schemas-microsoft.com:vml" class="rvml">');
-            };
-        }
-        create = function () {
-            var con = getContainer[apply](0, arguments),
-                container = con.container,
-                height = con.height,
-                s,
-                width = con.width,
-                x = con.x,
-                y = con.y;
-            if (!container) {
-                throw new Error("VML container not found.");
-            }
-            var res = new Paper,
-                c = res.canvas = doc.createElement("div"),
-                cs = c.style;
-            width = width || 512;
-            height = height || 342;
-            width == +width && (width += "px");
-            height == +height && (height += "px");
-            res.width = 1e3;
-            res.height = 1e3;
-            res.coordsize = zoom * 1e3 + S + zoom * 1e3;
-            res.coordorigin = "0 0";
-            res.span = doc.createElement("span");
-            res.span.style.cssText = "position:absolute;left:-9999em;top:-9999em;padding:0;margin:0;line-height:1;display:inline;";
-            c[appendChild](res.span);
-            cs.cssText = R.format("width:{0};height:{1};position:absolute;clip:rect(0 {0} {1} 0);overflow:hidden", width, height);
-            if (container == 1) {
-                doc.body[appendChild](c);
-                cs.left = x + "px";
-                cs.top = y + "px";
-            } else {
-                container.style.width = width;
-                container.style.height = height;
-                if (container.firstChild) {
-                    container.insertBefore(c, container.firstChild);
-                } else {
-                    container[appendChild](c);
-                }
-            }
-            plugins.call(res, res, R.fn);
-            return res;
-        };
-        Paper[proto].clear = function () {
-            this.canvas.innerHTML = E;
-            this.span = doc.createElement("span");
-            this.span.style.cssText = "position:absolute;left:-9999em;top:-9999em;padding:0;margin:0;line-height:1;display:inline;";
-            this.canvas[appendChild](this.span);
-            this.bottom = this.top = null;
-        };
-        Paper[proto].remove = function () {
-            this.canvas.parentNode.removeChild(this.canvas);
-            for (var i in this) {
-                this[i] = removed(i);
-            }
-            return true;
-        };
-    }
- 
-    // rest
-    // Safari or Chrome (WebKit) rendering bug workaround method
-    if ((/^Apple|^Google/).test(win.navigator.vendor) && !(win.navigator.userAgent.indexOf("Version/4.0") + 1)) {
-        Paper[proto].safari = function () {
-            var rect = this.rect(-99, -99, this.width + 99, this.height + 99);
-            win.setTimeout(function () {rect.remove();});
-        };
-    } else {
-        Paper[proto].safari = function () {};
-    }
- 
-    // Events
-    var addEvent = (function () {
-        if (doc.addEventListener) {
-            return function (obj, type, fn, element) {
-                var f = function (e) {
-                    return fn.call(element, e);
-                };
-                obj.addEventListener(type, f, false);
-                return function () {
-                    obj.removeEventListener(type, f, false);
-                    return true;
-                };
-            };
-        } else if (doc.attachEvent) {
-            return function (obj, type, fn, element) {
-                var f = function (e) {
-                    return fn.call(element, e || win.event);
-                };
-                obj.attachEvent("on" + type, f);
-                var detacher = function () {
-                    obj.detachEvent("on" + type, f);
-                    return true;
-                };
-                return detacher;
-            };
-        }
-    })();
-    for (var i = events[length]; i--;) {
-        (function (eventName) {
-            Element[proto][eventName] = function (fn) {
-                if (R.is(fn, "function")) {
-                    this.events = this.events || [];
-                    this.events.push({name: eventName, f: fn, unbind: addEvent(this.shape || this.node, eventName, fn, this)});
-                }
-                return this;
-            };
-            Element[proto]["un" + eventName] = function (fn) {
-                var events = this.events,
-                    l = events[length];
-                while (l--) if (events[l].name == eventName && events[l].f == fn) {
-                    events[l].unbind();
-                    events.splice(l, 1);
-                    !events.length && delete this.events;
-                    return this;
-                }
-                return this;
-            };
-        })(events[i]);
-    }
-    Element[proto].hover = function (f_in, f_out) {
-        return this.mouseover(f_in).mouseout(f_out);
-    };
-    Element[proto].unhover = function (f_in, f_out) {
-        return this.unmouseover(f_in).unmouseout(f_out);
-    };
-    Paper[proto].circle = function (x, y, r) {
-        return theCircle(this, x || 0, y || 0, r || 0);
-    };
-    Paper[proto].rect = function (x, y, w, h, r) {
-        return theRect(this, x || 0, y || 0, w || 0, h || 0, r || 0);
-    };
-    Paper[proto].ellipse = function (x, y, rx, ry) {
-        return theEllipse(this, x || 0, y || 0, rx || 0, ry || 0);
-    };
-    Paper[proto].path = function (pathString) {
-        pathString && !R.is(pathString, "string") && !R.is(pathString[0], "array") && (pathString += E);
-        return thePath(R.format[apply](R, arguments), this);
-    };
-    Paper[proto].image = function (src, x, y, w, h) {
-        return theImage(this, src || "about:blank", x || 0, y || 0, w || 0, h || 0);
-    };
-    Paper[proto].text = function (x, y, text) {
-        return theText(this, x || 0, y || 0, text || E);
-    };
-    Paper[proto].set = function (itemsArray) {
-        arguments[length] > 1 && (itemsArray = Array[proto].splice.call(arguments, 0, arguments[length]));
-        return new Set(itemsArray);
-    };
-    Paper[proto].setSize = setSize;
-    Paper[proto].top = Paper[proto].bottom = null;
-    Paper[proto].raphael = R;
-    function x_y() {
-        return this.x + S + this.y;
-    }
-    Element[proto].scale = function (x, y, cx, cy) {
-        if (x == null && y == null) {
-            return {
-                x: this._.sx,
-                y: this._.sy,
-                toString: x_y
-            };
-        }
-        y = y || x;
-        !+y && (y = x);
-        var dx,
-            dy,
-            dcx,
-            dcy,
-            a = this.attrs;
-        if (x != 0) {
-            var bb = this.getBBox(),
-                rcx = bb.x + bb.width / 2,
-                rcy = bb.y + bb.height / 2,
-                kx = x / this._.sx,
-                ky = y / this._.sy;
-            cx = (+cx || cx == 0) ? cx : rcx;
-            cy = (+cy || cy == 0) ? cy : rcy;
-            var dirx = ~~(x / math.abs(x)),
-                diry = ~~(y / math.abs(y)),
-                s = this.node.style,
-                ncx = cx + (rcx - cx) * kx,
-                ncy = cy + (rcy - cy) * ky;
-            switch (this.type) {
-                case "rect":
-                case "image":
-                    var neww = a.width * dirx * kx,
-                        newh = a.height * diry * ky;
-                    this.attr({
-                        height: newh,
-                        r: a.r * mmin(dirx * kx, diry * ky),
-                        width: neww,
-                        x: ncx - neww / 2,
-                        y: ncy - newh / 2
-                    });
-                    break;
-                case "circle":
-                case "ellipse":
-                    this.attr({
-                        rx: a.rx * dirx * kx,
-                        ry: a.ry * diry * ky,
-                        r: a.r * mmin(dirx * kx, diry * ky),
-                        cx: ncx,
-                        cy: ncy
-                    });
-                    break;
-                case "path":
-                    var path = pathToRelative(a.path),
-                        skip = true;
-                    for (var i = 0, ii = path[length]; i < ii; i++) {
-                        var p = path[i],
-                            P0 = upperCase.call(p[0]);
-                        if (P0 == "M" && skip) {
-                            continue;
-                        } else {
-                            skip = false;
-                        }
-                        if (P0 == "A") {
-                            p[path[i][length] - 2] *= kx;
-                            p[path[i][length] - 1] *= ky;
-                            p[1] *= dirx * kx;
-                            p[2] *= diry * ky;
-                            p[5] = +!(dirx + diry ? !+p[5] : +p[5]);
-                        } else if (P0 == "H") {
-                            for (var j = 1, jj = p[length]; j < jj; j++) {
-                                p[j] *= kx;
-                            }
-                        } else if (P0 == "V") {
-                            for (j = 1, jj = p[length]; j < jj; j++) {
-                                p[j] *= ky;
-                            }
-                         } else {
-                            for (j = 1, jj = p[length]; j < jj; j++) {
-                                p[j] *= (j % 2) ? kx : ky;
-                            }
-                        }
-                    }
-                    var dim2 = pathDimensions(path);
-                    dx = ncx - dim2.x - dim2.width / 2;
-                    dy = ncy - dim2.y - dim2.height / 2;
-                    path[0][1] += dx;
-                    path[0][2] += dy;
-                    this.attr({path: path});
-                break;
-            }
-            if (this.type in {text: 1, image:1} && (dirx != 1 || diry != 1)) {
-                if (this.transformations) {
-                    this.transformations[2] = "scale("[concat](dirx, ",", diry, ")");
-                    this.node[setAttribute]("transform", this.transformations[join](S));
-                    dx = (dirx == -1) ? -a.x - (neww || 0) : a.x;
-                    dy = (diry == -1) ? -a.y - (newh || 0) : a.y;
-                    this.attr({x: dx, y: dy});
-                    a.fx = dirx - 1;
-                    a.fy = diry - 1;
-                } else {
-                    this.node.filterMatrix = " progid:DXImageTransform.Microsoft.Matrix(M11="[concat](dirx,
-                        ", M12=0, M21=0, M22=", diry,
-                        ", Dx=0, Dy=0, sizingmethod='auto expand', filtertype='bilinear')");
-                    s.filter = (this.node.filterMatrix || E) + (this.node.filterOpacity || E);
-                }
-            } else {
-                if (this.transformations) {
-                    this.transformations[2] = E;
-                    this.node[setAttribute]("transform", this.transformations[join](S));
-                    a.fx = 0;
-                    a.fy = 0;
-                } else {
-                    this.node.filterMatrix = E;
-                    s.filter = (this.node.filterMatrix || E) + (this.node.filterOpacity || E);
-                }
-            }
-            a.scale = [x, y, cx, cy][join](S);
-            this._.sx = x;
-            this._.sy = y;
-        }
-        return this;
-    };
-    Element[proto].clone = function () {
-        var attr = this.attr();
-        delete attr.scale;
-        delete attr.translation;
-        return this.paper[this.type]().attr(attr);
-    };
-    var getPointAtSegmentLength = cacher(function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, length) {
-        var len = 0,
-            old;
-        for (var i = 0; i < 1.001; i+=.001) {
-            var dot = R.findDotsAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, i);
-            i && (len += pow(pow(old.x - dot.x, 2) + pow(old.y - dot.y, 2), .5));
-            if (len >= length) {
-                return dot;
-            }
-            old = dot;
-        }
-    }),
-    getLengthFactory = function (istotal, subpath) {
-        return function (path, length, onlystart) {
-            path = path2curve(path);
-            var x, y, p, l, sp = "", subpaths = {}, point,
-                len = 0;
-            for (var i = 0, ii = path.length; i < ii; i++) {
-                p = path[i];
-                if (p[0] == "M") {
-                    x = +p[1];
-                    y = +p[2];
-                } else {
-                    l = segmentLength(x, y, p[1], p[2], p[3], p[4], p[5], p[6]);
-                    if (len + l > length) {
-                        if (subpath && !subpaths.start) {
-                            point = getPointAtSegmentLength(x, y, p[1], p[2], p[3], p[4], p[5], p[6], length - len);
-                            sp += ["C", point.start.x, point.start.y, point.m.x, point.m.y, point.x, point.y];
-                            if (onlystart) {return sp;}
-                            subpaths.start = sp;
-                            sp = ["M", point.x, point.y + "C", point.n.x, point.n.y, point.end.x, point.end.y, p[5], p[6]][join]();
-                            len += l;
-                            x = +p[5];
-                            y = +p[6];
-                            continue;
-                        }
-                        if (!istotal && !subpath) {
-                            point = getPointAtSegmentLength(x, y, p[1], p[2], p[3], p[4], p[5], p[6], length - len);
-                            return {x: point.x, y: point.y, alpha: point.alpha};
-                        }
-                    }
-                    len += l;
-                    x = +p[5];
-                    y = +p[6];
-                }
-                sp += p;
-            }
-            subpaths.end = sp;
-            point = istotal ? len : subpath ? subpaths : R.findDotsAtSegment(x, y, p[1], p[2], p[3], p[4], p[5], p[6], 1);
-            point.alpha && (point = {x: point.x, y: point.y, alpha: point.alpha});
-            return point;
-        };
-    },
-    segmentLength = cacher(function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y) {
-        var old = {x: 0, y: 0},
-            len = 0;
-        for (var i = 0; i < 1.01; i+=.01) {
-            var dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, i);
-            i && (len += pow(pow(old.x - dot.x, 2) + pow(old.y - dot.y, 2), .5));
-            old = dot;
-        }
-        return len;
-    });
-    var getTotalLength = getLengthFactory(1),
-        getPointAtLength = getLengthFactory(),
-        getSubpathsAtLength = getLengthFactory(0, 1);
-    Element[proto].getTotalLength = function () {
-        if (this.type != "path") {return;}
-        return getTotalLength(this.attrs.path);
-    };
-    Element[proto].getPointAtLength = function (length) {
-        if (this.type != "path") {return;}
-        return getPointAtLength(this.attrs.path, length);
-    };
-    Element[proto].getSubpath = function (from, to) {
-        if (this.type != "path") {return;}
-        if (math.abs(this.getTotalLength() - to) < 1e-6) {
-            return getSubpathsAtLength(this.attrs.path, from).end;
-        }
-        var a = getSubpathsAtLength(this.attrs.path, to, 1);
-        return from ? getSubpathsAtLength(a, from).end : a;
-    };
-
-    // animation easing formulas
-    R.easing_formulas = {
-        linear: function (n) {
-            return n;
-        },
-        "<": function (n) {
-            return pow(n, 3);
-        },
-        ">": function (n) {
-            return pow(n - 1, 3) + 1;
-        },
-        "<>": function (n) {
-            n = n * 2;
-            if (n < 1) {
-                return pow(n, 3) / 2;
-            }
-            n -= 2;
-            return (pow(n, 3) + 2) / 2;
-        },
-        backIn: function (n) {
-            var s = 1.70158;
-            return n * n * ((s + 1) * n - s);
-        },
-        backOut: function (n) {
-            n = n - 1;
-            var s = 1.70158;
-            return n * n * ((s + 1) * n + s) + 1;
-        },
-        elastic: function (n) {
-            if (n == 0 || n == 1) {
-                return n;
-            }
-            var p = .3,
-                s = p / 4;
-            return pow(2, -10 * n) * math.sin((n - s) * (2 * math.PI) / p) + 1;
-        },
-        bounce: function (n) {
-            var s = 7.5625,
-                p = 2.75,
-                l;
-            if (n < (1 / p)) {
-                l = s * n * n;
-            } else {
-                if (n < (2 / p)) {
-                    n -= (1.5 / p);
-                    l = s * n * n + .75;
-                } else {
-                    if (n < (2.5 / p)) {
-                        n -= (2.25 / p);
-                        l = s * n * n + .9375;
-                    } else {
-                        n -= (2.625 / p);
-                        l = s * n * n + .984375;
-                    }
-                }
-            }
-            return l;
-        }
-    };
- 
-    var animationElements = {length : 0},
-        animation = function () {
-            var Now = +new Date;
-            for (var l in animationElements) if (l != "length" && animationElements[has](l)) {
-                var e = animationElements[l];
-                if (e.stop || e.el.removed) {
-                    delete animationElements[l];
-                    animationElements[length]--;
-                    continue;
-                }
-                var time = Now - e.start,
-                    ms = e.ms,
-                    easing = e.easing,
-                    from = e.from,
-                    diff = e.diff,
-                    to = e.to,
-                    t = e.t,
-                    prev = e.prev || 0,
-                    that = e.el,
-                    callback = e.callback,
-                    set = {},
-                    now;
-                if (time < ms) {
-                    var pos = R.easing_formulas[easing] ? R.easing_formulas[easing](time / ms) : time / ms;
-                    for (var attr in from) if (from[has](attr)) {
-                        switch (availableAnimAttrs[attr]) {
-                            case "along":
-                                now = pos * ms * diff[attr];
-                                to.back && (now = to.len - now);
-                                var point = getPointAtLength(to[attr], now);
-                                that.translate(diff.sx - diff.x || 0, diff.sy - diff.y || 0);
-                                diff.x = point.x;
-                                diff.y = point.y;
-                                that.translate(point.x - diff.sx, point.y - diff.sy);
-                                to.rot && that.rotate(diff.r + point.alpha, point.x, point.y);
-                                break;
-                            case "number":
-                                now = +from[attr] + pos * ms * diff[attr];
-                                break;
-                            case "colour":
-                                now = "rgb(" + [
-                                    upto255(round(from[attr].r + pos * ms * diff[attr].r)),
-                                    upto255(round(from[attr].g + pos * ms * diff[attr].g)),
-                                    upto255(round(from[attr].b + pos * ms * diff[attr].b))
-                                ][join](",") + ")";
-                                break;
-                            case "path":
-                                now = [];
-                                for (var i = 0, ii = from[attr][length]; i < ii; i++) {
-                                    now[i] = [from[attr][i][0]];
-                                    for (var j = 1, jj = from[attr][i][length]; j < jj; j++) {
-                                        now[i][j] = +from[attr][i][j] + pos * ms * diff[attr][i][j];
-                                    }
-                                    now[i] = now[i][join](S);
-                                }
-                                now = now[join](S);
-                                break;
-                            case "csv":
-                                switch (attr) {
-                                    case "translation":
-                                        var x = diff[attr][0] * (time - prev),
-                                            y = diff[attr][1] * (time - prev);
-                                        t.x += x;
-                                        t.y += y;
-                                        now = x + S + y;
-                                    break;
-                                    case "rotation":
-                                        now = +from[attr][0] + pos * ms * diff[attr][0];
-                                        from[attr][1] && (now += "," + from[attr][1] + "," + from[attr][2]);
-                                    break;
-                                    case "scale":
-                                        now = [+from[attr][0] + pos * ms * diff[attr][0], +from[attr][1] + pos * ms * diff[attr][1], (2 in to[attr] ? to[attr][2] : E), (3 in to[attr] ? to[attr][3] : E)][join](S);
-                                    break;
-                                    case "clip-rect":
-                                        now = [];
-                                        i = 4;
-                                        while (i--) {
-                                            now[i] = +from[attr][i] + pos * ms * diff[attr][i];
-                                        }
-                                    break;
-                                }
-                                break;
-                        }
-                        set[attr] = now;
-                    }
-                    that.attr(set);
-                    that._run && that._run.call(that);
-                } else {
-                    if (to.along) {
-                        point = getPointAtLength(to.along, to.len * !to.back);
-                        that.translate(diff.sx - (diff.x || 0) + point.x - diff.sx, diff.sy - (diff.y || 0) + point.y - diff.sy);
-                        to.rot && that.rotate(diff.r + point.alpha, point.x, point.y);
-                    }
-                    (t.x || t.y) && that.translate(-t.x, -t.y);
-                    to.scale && (to.scale = to.scale + E);
-                    that.attr(to);
-                    delete animationElements[l];
-                    animationElements[length]--;
-                    that.in_animation = null;
-                    R.is(callback, "function") && callback.call(that);
-                }
-                e.prev = time;
-            }
-            R.svg && that && that.paper.safari();
-            animationElements[length] && win.setTimeout(animation);
-        },
-        upto255 = function (color) {
-            return color > 255 ? 255 : (color < 0 ? 0 : color);
-        },
-        translate = function (x, y) {
-            if (x == null) {
-                return {x: this._.tx, y: this._.ty, toString: x_y};
-            }
-            this._.tx += +x;
-            this._.ty += +y;
-            switch (this.type) {
-                case "circle":
-                case "ellipse":
-                    this.attr({cx: +x + this.attrs.cx, cy: +y + this.attrs.cy});
-                    break;
-                case "rect":
-                case "image":
-                case "text":
-                    this.attr({x: +x + this.attrs.x, y: +y + this.attrs.y});
-                    break;
-                case "path":
-                    var path = pathToRelative(this.attrs.path);
-                    path[0][1] += +x;
-                    path[0][2] += +y;
-                    this.attr({path: path});
-                break;
-            }
-            return this;
-        };
-    Element[proto].animateWith = function (element, params, ms, easing, callback) {
-        animationElements[element.id] && (params.start = animationElements[element.id].start);
-        return this.animate(params, ms, easing, callback);
-    };
-    Element[proto].animateAlong = along();
-    Element[proto].animateAlongBack = along(1);
-    function along(isBack) {
-        return function (path, ms, rotate, callback) {
-            var params = {back: isBack};
-            R.is(rotate, "function") ? (callback = rotate) : (params.rot = rotate);
-            path && path.constructor == Element && (path = path.attrs.path);
-            path && (params.along = path);
-            return this.animate(params, ms, callback);
-        };
-    }
-    Element[proto].onAnimation = function (f) {
-        this._run = f || 0;
-        return this;
-    };
-    Element[proto].animate = function (params, ms, easing, callback) {
-        if (R.is(easing, "function") || !easing) {
-            callback = easing || null;
-        }
-        var from = {},
-            to = {},
-            diff = {};
-        for (var attr in params) if (params[has](attr)) {
-            if (availableAnimAttrs[has](attr)) {
-                from[attr] = this.attr(attr);
-                (from[attr] == null) && (from[attr] = availableAttrs[attr]);
-                to[attr] = params[attr];
-                switch (availableAnimAttrs[attr]) {
-                    case "along":
-                        var len = getTotalLength(params[attr]),
-                            point = getPointAtLength(params[attr], len * !!params.back),
-                            bb = this.getBBox();
-                        diff[attr] = len / ms;
-                        diff.tx = bb.x;
-                        diff.ty = bb.y;
-                        diff.sx = point.x;
-                        diff.sy = point.y;
-                        to.rot = params.rot;
-                        to.back = params.back;
-                        to.len = len;
-                        params.rot && (diff.r = toFloat(this.rotate()) || 0);
-                        break;
-                    case "number":
-                        diff[attr] = (to[attr] - from[attr]) / ms;
-                        break;
-                    case "colour":
-                        from[attr] = R.getRGB(from[attr]);
-                        var toColour = R.getRGB(to[attr]);
-                        diff[attr] = {
-                            r: (toColour.r - from[attr].r) / ms,
-                            g: (toColour.g - from[attr].g) / ms,
-                            b: (toColour.b - from[attr].b) / ms
-                        };
-                        break;
-                    case "path":
-                        var paths = path2curve(from[attr], to[attr]);
-                        from[attr] = paths[0];
-                        var toPath = paths[1];
-                        diff[attr] = [];
-                        for (var i = 0, ii = from[attr][length]; i < ii; i++) {
-                            diff[attr][i] = [0];
-                            for (var j = 1, jj = from[attr][i][length]; j < jj; j++) {
-                                diff[attr][i][j] = (toPath[i][j] - from[attr][i][j]) / ms;
-                            }
-                        }
-                        break;
-                    case "csv":
-                        var values = (params[attr] + E)[split](separator),
-                            from2 = (from[attr] + E)[split](separator);
-                        switch (attr) {
-                            case "translation":
-                                from[attr] = [0, 0];
-                                diff[attr] = [values[0] / ms, values[1] / ms];
-                            break;
-                            case "rotation":
-                                from[attr] = (from2[1] == values[1] && from2[2] == values[2]) ? from2 : [0, values[1], values[2]];
-                                diff[attr] = [(values[0] - from[attr][0]) / ms, 0, 0];
-                            break;
-                            case "scale":
-                                params[attr] = values;
-                                from[attr] = (from[attr] + E)[split](separator);
-                                diff[attr] = [(values[0] - from[attr][0]) / ms, (values[1] - from[attr][1]) / ms, 0, 0];
-                            break;
-                            case "clip-rect":
-                                from[attr] = (from[attr] + E)[split](separator);
-                                diff[attr] = [];
-                                i = 4;
-                                while (i--) {
-                                    diff[attr][i] = (values[i] - from[attr][i]) / ms;
-                                }
-                            break;
-                        }
-                        to[attr] = values;
-                }
-            }
-        }
-        this.stop();
-        this.in_animation = 1;
-        animationElements[this.id] = {
-            start: params.start || +new Date,
-            ms: ms,
-            easing: easing,
-            from: from,
-            diff: diff,
-            to: to,
-            el: this,
-            callback: callback,
-            t: {x: 0, y: 0}
-        };
-        ++animationElements[length] == 1 && animation();
-        return this;
-    };
-    Element[proto].stop = function () {
-        animationElements[this.id] && animationElements[length]--;
-        delete animationElements[this.id];
-        return this;
-    };
-    Element[proto].translate = function (x, y) {
-        return this.attr({translation: x + " " + y});
-    };
-    Element[proto][toString] = function () {
-        return "Rapha\xebl\u2019s object";
-    };
-    R.ae = animationElements;
- 
-    // Set
-    var Set = function (items) {
-        this.items = [];
-        this[length] = 0;
-        if (items) {
-            for (var i = 0, ii = items[length]; i < ii; i++) {
-                if (items[i] && (items[i].constructor == Element || items[i].constructor == Set)) {
-                    this[this.items[length]] = this.items[this.items[length]] = items[i];
-                    this[length]++;
-                }
-            }
-        }
-    };
-    Set[proto][push] = function () {
-        var item,
-            len;
-        for (var i = 0, ii = arguments[length]; i < ii; i++) {
-            item = arguments[i];
-            if (item && (item.constructor == Element || item.constructor == Set)) {
-                len = this.items[length];
-                this[len] = this.items[len] = item;
-                this[length]++;
-            }
-        }
-        return this;
-    };
-    Set[proto].pop = function () {
-        delete this[this[length]--];
-        return this.items.pop();
-    };
-    for (var method in Element[proto]) if (Element[proto][has](method)) {
-        Set[proto][method] = (function (methodname) {
-            return function () {
-                for (var i = 0, ii = this.items[length]; i < ii; i++) {
-                    this.items[i][methodname][apply](this.items[i], arguments);
-                }
-                return this;
-            };
-        })(method);
-    }
-    Set[proto].attr = function (name, value) {
-        if (name && R.is(name, "array") && R.is(name[0], "object")) {
-            for (var j = 0, jj = name[length]; j < jj; j++) {
-                this.items[j].attr(name[j]);
-            }
-        } else {
-            for (var i = 0, ii = this.items[length]; i < ii; i++) {
-                this.items[i].attr(name, value);
-            }
-        }
-        return this;
-    };
-    Set[proto].animate = function (params, ms, easing, callback) {
-        (R.is(easing, "function") || !easing) && (callback = easing || null);
-        var len = this.items[length],
-            i = len,
-            set = this,
-            collector;
-        callback && (collector = function () {
-            !--len && callback.call(set);
-        });
-        this.items[--i].animate(params, ms, easing || collector, collector);
-        while (i--) {
-            this.items[i].animateWith(this.items[len - 1], params, ms, easing || collector, collector);
-        }
-        return this;
-    };
-    Set[proto].insertAfter = function (el) {
-        var i = this.items[length];
-        while (i--) {
-            this.items[i].insertAfter(el);
-        }
-        return this;
-    };
-    Set[proto].getBBox = function () {
-        var x = [],
-            y = [],
-            w = [],
-            h = [];
-        for (var i = this.items[length]; i--;) {
-            var box = this.items[i].getBBox();
-            x[push](box.x);
-            y[push](box.y);
-            w[push](box.x + box.width);
-            h[push](box.y + box.height);
-        }
-        x = mmin[apply](0, x);
-        y = mmin[apply](0, y);
-        return {
-            x: x,
-            y: y,
-            width: mmax[apply](0, w) - x,
-            height: mmax[apply](0, h) - y
-        };
-    };
-    Set[proto].clone = function (s) {
-        s = new Set;
-        for (var i = 0, ii = this.items[length]; i < ii; i++) {
-            s[push](this.items[i].clone());
-        }
-        return s;
-    };
-
-    R.registerFont = function (font) {
-        if (!font.face) {
-            return font;
-        }
-        this.fonts = this.fonts || {};
-        var fontcopy = {
-                w: font.w,
-                face: {},
-                glyphs: {}
-            },
-            family = font.face["font-family"];
-        for (var prop in font.face) if (font.face[has](prop)) {
-            fontcopy.face[prop] = font.face[prop];
-        }
-        if (this.fonts[family]) {
-            this.fonts[family][push](fontcopy);
-        } else {
-            this.fonts[family] = [fontcopy];
-        }
-        if (!font.svg) {
-            fontcopy.face["units-per-em"] = toInt(font.face["units-per-em"], 10);
-            for (var glyph in font.glyphs) if (font.glyphs[has](glyph)) {
-                var path = font.glyphs[glyph];
-                fontcopy.glyphs[glyph] = {
-                    w: path.w,
-                    k: {},
-                    d: path.d && "M" + path.d[rp](/[mlcxtrv]/g, function (command) {
-                            return {l: "L", c: "C", x: "z", t: "m", r: "l", v: "c"}[command] || "M";
-                        }) + "z"
-                };
-                if (path.k) {
-                    for (var k in path.k) if (path[has](k)) {
-                        fontcopy.glyphs[glyph].k[k] = path.k[k];
-                    }
-                }
-            }
-        }
-        return font;
-    };
-    Paper[proto].getFont = function (family, weight, style, stretch) {
-        stretch = stretch || "normal";
-        style = style || "normal";
-        weight = +weight || {normal: 400, bold: 700, lighter: 300, bolder: 800}[weight] || 400;
-        var font = R.fonts[family];
-        if (!font) {
-            var name = new RegExp("(^|\\s)" + family[rp](/[^\w\d\s+!~.:_-]/g, E) + "(\\s|$)", "i");
-            for (var fontName in R.fonts) if (R.fonts[has](fontName)) {
-                if (name.test(fontName)) {
-                    font = R.fonts[fontName];
-                    break;
-                }
-            }
-        }
-        var thefont;
-        if (font) {
-            for (var i = 0, ii = font[length]; i < ii; i++) {
-                thefont = font[i];
-                if (thefont.face["font-weight"] == weight && (thefont.face["font-style"] == style || !thefont.face["font-style"]) && thefont.face["font-stretch"] == stretch) {
-                    break;
-                }
-            }
-        }
-        return thefont;
-    };
-    Paper[proto].print = function (x, y, string, font, size, origin) {
-        origin = origin || "middle"; // baseline|middle
-        var out = this.set(),
-            letters = (string + E)[split](E),
-            shift = 0,
-            path = E,
-            scale;
-        R.is(font, "string") && (font = this.getFont(font));
-        if (font) {
-            scale = (size || 16) / font.face["units-per-em"];
-            var bb = font.face.bbox.split(separator),
-                top = +bb[0],
-                height = +bb[1] + (origin == "baseline" ? bb[3] - bb[1] + (+font.face.descent) : (bb[3] - bb[1]) / 2);
-            for (var i = 0, ii = letters[length]; i < ii; i++) {
-                var prev = i && font.glyphs[letters[i - 1]] || {},
-                    curr = font.glyphs[letters[i]];
-                shift += i ? (prev.w || font.w) + (prev.k && prev.k[letters[i]] || 0) : 0;
-                curr && curr.d && out[push](this.path(curr.d).attr({fill: "#000", stroke: "none", translation: [shift, 0]}));
-            }
-            out.scale(scale, scale, top, height).translate(x - top, y - height);
-        }
-        return out;
-    };
-
-    var formatrg = /\{(\d+)\}/g;
-    R.format = function (token, array) {
-        var args = R.is(array, "array") ? [0][concat](array) : arguments;
-        token && R.is(token, "string") && args[length] - 1 && (token = token[rp](formatrg, function (str, i) {
-            return args[++i] == null ? E : args[i];
-        }));
-        return token || E;
-    };
-    R.ninja = function () {
-        oldRaphael.was ? (Raphael = oldRaphael.is) : delete Raphael;
-        return R;
-    };
-    R.el = Element[proto];
-    return R;
-})();
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
deleted file mode 100644
index 55f017d9b7f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
-Copyright (c) 2010, Yahoo! Inc. All rights reserved.
-Code licensed under the BSD License:
-http://developer.yahoo.com/yui/license.html
-version: 3.1.0
-build: 2026
-*/
-if(typeof YUI==="undefined"){var YUI=function(F,E,D,C,A){var B=this,J=arguments,I,G=J.length,H=(typeof YUI_config!=="undefined")&&YUI_config;if(!(B instanceof YUI)){return new YUI(F,E,D,C,A);}else{B._init();if(H){B._config(H);}for(I=0;I<G;I++){B._config(J[I]);}B._setup();return B;}};}(function(){var L,B,M="3.1.0",K="http://yui.yahooapis.com/",P="yui3-js-enabled",I=function(){},G=Array.prototype.slice,N={"io.xdrReady":1,"io.xdrResponse":1,"SWF.eventHandler":1},F=(typeof window!="undefined"),E=(F)?window:null,R=(F)?E.document:null,D=R&&R.documentElement,A=D&&D.className,C={},H=new Date().getTime(),J=function(V,U,T,S){if(V&&V.addEventListener){V.addEventListener(U,T,S);}else{if(V&&V.attachEvent){V.attachEvent("on"+U,T);}}},Q=function(V,U,T,S){if(V&&V.removeEventListener){V.removeEventListener(U,T,S);}else{if(V&&V.detachEvent){V.detachEvent("on"+U,T);}}},O=function(){YUI.Env.windowLoaded=true;YUI.Env.DOMReady=true;if(F){Q(window,"load",O);}};if(D&&A.indexOf(P)==-1){if(A){A+=" ";}A+=P;D.className=A;}if(M.indexOf("@")>-1){M="3.0.0";}YUI.prototype={_config:function(Y){Y=Y||{};var T,V,W,U=this.config,X=U.modules,S=U.groups;for(V in Y){T=Y[V];if(X&&V=="modules"){for(W in T){X[W]=T[W];}}else{if(S&&V=="groups"){for(W in T){S[W]=T[W];}}else{if(V=="win"){U[V]=T.contentWindow||T;U.doc=U[V].document;}else{U[V]=T;}}}}},_init:function(){var U,V=this,S=YUI.Env,T=V.Env;V.version=M;if(!T){V.Env={mods:{},base:K,cdn:K+M+"/build/",bootstrapped:false,_idx:0,_used:{},_attached:{},_yidx:0,_uidx:0,_guidp:"y",_loaded:{},getBase:function(c,a){var W,X,Z,d,Y;X=(R&&R.getElementsByTagName("script"))||[];for(Z=0;Z<X.length;Z=Z+1){d=X[Z].src;if(d){Y=d.match(c);W=Y&&Y[1];if(W){U=Y[2];Y=d.match(a);if(Y&&Y[3]){W=Y[1]+Y[3];}break;}}}return W||T.cdn;}};T=V.Env;T._loaded[M]={};if(S&&V!==YUI){T._yidx=++S._yidx;T._guidp=("yui_"+M+"_"+T._yidx+"_"+H).replace(/\./g,"_");}V.id=V.stamp(V);C[V.id]=V;}V.constructor=YUI;V.config=V.config||{win:E,doc:R,debug:true,useBrowserConsole:true,throwFail:true,bootstrap:true,fetchCSS:true};V.config.base=YUI.config.base||V.Env.getBase(/^(.*)yui\/yui([\.\-].*)js(\?.*)?$/,/^(.*\?)(.*\&)(.*)yui\/yui[\.\-].*js(\?.*)?$/);V.config.loaderPath=YUI.config.loaderPath||"loader/loader"+(U||"-min.")+"js";},_setup:function(X){var T,W=this,S=[],V=YUI.Env.mods,U=W.config.core||["get","intl-base","loader","yui-log","yui-later","yui-throttle"];for(T=0;T<U.length;T++){if(V[U[T]]){S.push(U[T]);}}W.use("yui-base");W.use.apply(W,S);},applyTo:function(Y,X,U){if(!(X in N)){this.log(X+": applyTo not allowed","warn","yui");return null;}var T=C[Y],W,S,V;if(T){W=X.split(".");S=T;for(V=0;V<W.length;V=V+1){S=S[W[V]];if(!S){this.log("applyTo not found: "+X,"warn","yui");}}return S.apply(T,U);}return null;},add:function(T,V,S,U){U=U||{};YUI.Env.mods[T]={name:T,fn:V,version:S,details:U};return this;},_attach:function(S,W){var Y,V,b,T,a,U,c=YUI.Env.mods,X=this.Env._attached,Z=S.length;for(Y=0;Y<Z;Y++){V=S[Y];b=c[V];if(!X[V]&&b){X[V]=true;T=b.details;a=T.requires;U=T.use;if(a){this._attach(this.Array(a));}if(b.fn){b.fn(this,V);}if(U){this._attach(this.Array(U));}}}},use:function(){if(!this.Array){this._attach(["yui-base"]);}var i,c,j,T=this,k=YUI.Env,U=G.call(arguments,0),V=k.mods,S=T.Env,Z=S._used,g=k._loaderQueue,m=U[0],W=U[U.length-1],b=T.Array,l=T.config,a=l.bootstrap,h=[],e=[],X=l.fetchCSS,f=function(o){e.push(o);if(Z[o]){return;}var Y=V[o],p,n;if(Y){Z[o]=true;p=Y.details.requires;n=Y.details.use;}else{if(!k._loaded[M][o]){h.push(o);}else{Z[o]=true;}}if(p){b.each(b(p),f);}if(n){b.each(b(n),f);}},d=function(q){var o=q||{success:true,msg:"not dynamic"},p,n,Y,r=o.data;T._loading=false;if(r){Y=h.concat();h=[];T.Array.each(r,f);n=h.length;if(n){if(h.sort().join()==Y.sort().join()){n=false;}}}if(n&&r){p=r.concat();p.push(function(){T._attach(r);if(W){W(T,o);}});T._loading=false;T.use.apply(T,p);}else{if(r){T._attach(r);}if(W){W(T,o);}}if(T._useQueue&&T._useQueue.size()&&!T._loading){T.use.apply(T,T._useQueue.next());}};if(T._loading){T._useQueue=T._useQueue||new T.Queue();T._useQueue.add(U);return T;}if(typeof W==="function"){U.pop();}else{W=null;}if(m==="*"){U=T.Object.keys(V);}if(T.Loader){c=new T.Loader(l);c.require(U);c.ignoreRegistered=true;c.calculate(null,(X)?null:"js");U=c.sorted;}b.each(U,f);i=h.length;if(i){h=T.Object.keys(b.hash(h));i=h.length;}if(a&&i&&T.Loader){T._loading=true;c=new T.Loader(l);c.onEnd=d;c.context=T;c.attaching=U;c.data=U;c.require((X)?h:U);c.insert(null,(X)?null:"js");}else{if(a&&i&&T.Get&&!S.bootstrapped){T._loading=true;U=b(arguments,0,true);j=function(){T._loading=false;g.running=false;S.bootstrapped=true;T._attach(["loader"]);T.use.apply(T,U);};if(k._bootstrapping){g.add(j);}else{k._bootstrapping=true;T.Get.script(l.base+l.loaderPath,{onEnd:j});}}else{if(i){T.message("Requirement NOT loaded: "+h,"warn","yui");}T._attach(e);d();}}return T;},namespace:function(){var S=arguments,W=null,U,T,V;for(U=0;U<S.length;U=U+1){V=(""+S[U]).split(".");W=this;for(T=(V[0]=="YAHOO")?1:0;T<V.length;T=T+1){W[V[T]]=W[V[T]]||{};W=W[V[T]];}}return W;},log:I,message:I,error:function(T,S){if(this.config.throwFail){throw (S||new Error(T));}else{this.message(T,"error");}return this;},guid:function(S){var T=this.Env._guidp+(++this.Env._uidx);return(S)?(S+T):T;},stamp:function(U,V){if(!U){return U;}var S=(typeof U==="string")?U:U._yuid;if(!S){S=this.guid();if(!V){try{U._yuid=S;}catch(T){S=null;}}}return S;}};L=YUI.prototype;for(B in L){YUI[B]=L[B];}YUI._init();if(F){J(window,"load",O);}else{O();}YUI.Env.add=J;YUI.Env.remove=Q;if(typeof exports=="object"){exports.YUI=YUI;}})();YUI.add("yui-base",function(B){(function(){B.Lang=B.Lang||{};var R=B.Lang,G="array",I="boolean",D="date",M="error",S="function",H="number",K="null",F="object",O="regexp",N="string",C=Object.prototype.toString,P="undefined",E={"undefined":P,"number":H,"boolean":I,"string":N,"[object Function]":S,"[object RegExp]":O,"[object Array]":G,"[object Date]":D,"[object Error]":M},J=/^\s+|\s+$/g,Q="";R.isArray=function(L){return R.type(L)===G;};R.isBoolean=function(L){return typeof L===I;
-};R.isFunction=function(L){return R.type(L)===S;};R.isDate=function(L){return R.type(L)===D&&L.toString()!=="Invalid Date"&&!isNaN(L);};R.isNull=function(L){return L===null;};R.isNumber=function(L){return typeof L===H&&isFinite(L);};R.isObject=function(U,T){var L=typeof U;return(U&&(L===F||(!T&&(L===S||R.isFunction(U)))))||false;};R.isString=function(L){return typeof L===N;};R.isUndefined=function(L){return typeof L===P;};R.trim=function(L){try{return L.replace(J,Q);}catch(T){return L;}};R.isValue=function(T){var L=R.type(T);switch(L){case H:return isFinite(T);case K:case P:return false;default:return !!(L);}};R.type=function(L){return E[typeof L]||E[C.call(L)]||(L?F:K);};})();(function(){var C=B.Lang,D=Array.prototype,E="length",F=function(M,K,I){var J=(I)?2:F.test(M),H,G,N=K||0;if(J){try{return D.slice.call(M,N);}catch(L){G=[];H=M.length;for(;N<H;N++){G.push(M[N]);}return G;}}else{return[M];}};B.Array=F;F.test=function(I){var G=0;if(C.isObject(I)){if(C.isArray(I)){G=1;}else{try{if((E in I)&&!I.tagName&&!I.alert&&!I.apply){G=2;}}catch(H){}}}return G;};F.each=(D.forEach)?function(G,H,I){D.forEach.call(G||[],H,I||B);return B;}:function(H,J,K){var G=(H&&H.length)||0,I;for(I=0;I<G;I=I+1){J.call(K||B,H[I],I,H);}return B;};F.hash=function(I,H){var L={},G=I.length,K=H&&H.length,J;for(J=0;J<G;J=J+1){if(I[J]){L[I[J]]=(K&&K>J)?H[J]:true;}}return L;};F.indexOf=(D.indexOf)?function(G,H){return D.indexOf.call(G,H);}:function(G,I){for(var H=0;H<G.length;H=H+1){if(G[H]===I){return H;}}return -1;};F.numericSort=function(H,G){return(H-G);};F.some=(D.some)?function(G,H,I){return D.some.call(G,H,I);}:function(H,J,K){var G=H.length,I;for(I=0;I<G;I=I+1){if(J.call(K,H[I],I,H)){return true;}}return false;};})();function A(){this._init();this.add.apply(this,arguments);}A.prototype={_init:function(){this._q=[];},next:function(){return this._q.shift();},last:function(){return this._q.pop();},add:function(){B.Array.each(B.Array(arguments,0,true),function(C){this._q.push(C);},this);return this;},size:function(){return this._q.length;}};B.Queue=A;YUI.Env._loaderQueue=YUI.Env._loaderQueue||new A();(function(){var D=B.Lang,C="__",E=function(H,G){var F=G.toString;if(D.isFunction(F)&&F!=Object.prototype.toString){H.toString=F;}};B.merge=function(){var G=arguments,I={},H,F=G.length;for(H=0;H<F;H=H+1){B.mix(I,G[H],true);}return I;};B.mix=function(F,O,H,N,L,M){if(!O||!F){return F||B;}if(L){switch(L){case 1:return B.mix(F.prototype,O.prototype,H,N,0,M);case 2:B.mix(F.prototype,O.prototype,H,N,0,M);break;case 3:return B.mix(F,O.prototype,H,N,0,M);case 4:return B.mix(F.prototype,O,H,N,0,M);default:}}var K=M&&D.isArray(F),J,I,G;if(N&&N.length){for(J=0,I=N.length;J<I;++J){G=N[J];if(O.hasOwnProperty(G)){if(M&&D.isObject(F[G],true)){B.mix(F[G],O[G]);}else{if(!K&&(H||!(G in F))){F[G]=O[G];}else{if(K){F.push(O[G]);}}}}}}else{for(J in O){if(O.hasOwnProperty(J)){if(M&&D.isObject(F[J],true)){B.mix(F[J],O[J],H,N,0,true);}else{if(!K&&(H||!(J in F))){F[J]=O[J];}else{if(K){F.push(O[J]);}}}}}if(B.UA.ie){E(F,O);}}return F;};B.cached=function(H,F,G){F=F||{};return function(K,J){var I=(J)?Array.prototype.join.call(arguments,C):K;if(!(I in F)||(G&&F[I]==G)){F[I]=H.apply(H,arguments);}return F[I];};};})();(function(){B.Object=function(H){var G=function(){};G.prototype=H;return new G();};var E=B.Object,F=function(H,G){return H&&H.hasOwnProperty&&H.hasOwnProperty(G);},D=undefined,C=function(K,J){var I=(J===2),G=(I)?0:[],H;for(H in K){if(F(K,H)){if(I){G++;}else{G.push((J)?K[H]:H);}}}return G;};E.keys=function(G){return C(G);};E.values=function(G){return C(G,1);};E.size=function(G){return C(G,2);};E.hasKey=F;E.hasValue=function(H,G){return(B.Array.indexOf(E.values(H),G)>-1);};E.owns=F;E.each=function(K,J,L,I){var H=L||B,G;for(G in K){if(I||F(K,G)){J.call(H,K[G],G,K);}}return B;};E.some=function(K,J,L,I){var H=L||B,G;for(G in K){if(I||F(K,G)){if(J.call(H,K[G],G,K)){return true;}}}return false;};E.getValue=function(K,J){if(!B.Lang.isObject(K)){return D;}var H,I=B.Array(J),G=I.length;for(H=0;K!==D&&H<G;H++){K=K[I[H]];}return K;};E.setValue=function(M,K,L){var G,J=B.Array(K),I=J.length-1,H=M;if(I>=0){for(G=0;H!==D&&G<I;G++){H=H[J[G]];}if(H!==D){H[J[G]]=L;}else{return D;}}return M;};})();B.UA=function(){var F=function(K){var L=0;return parseFloat(K.replace(/\./g,function(){return(L++==1)?"":".";}));},G=B.config.win,J=G&&G.navigator,I={ie:0,opera:0,gecko:0,webkit:0,chrome:0,mobile:null,air:0,caja:J&&J.cajaVersion,secure:false,os:null},E=J&&J.userAgent,H=G&&G.location,D=H&&H.href,C;I.secure=D&&(D.toLowerCase().indexOf("https")===0);if(E){if((/windows|win32/i).test(E)){I.os="windows";}else{if((/macintosh/i).test(E)){I.os="macintosh";}else{if((/rhino/i).test(E)){I.os="rhino";}}}if((/KHTML/).test(E)){I.webkit=1;}C=E.match(/AppleWebKit\/([^\s]*)/);if(C&&C[1]){I.webkit=F(C[1]);if(/ Mobile\//.test(E)){I.mobile="Apple";}else{C=E.match(/NokiaN[^\/]*|Android \d\.\d|webOS\/\d\.\d/);if(C){I.mobile=C[0];}}C=E.match(/Chrome\/([^\s]*)/);if(C&&C[1]){I.chrome=F(C[1]);}else{C=E.match(/AdobeAIR\/([^\s]*)/);if(C){I.air=C[0];}}}if(!I.webkit){C=E.match(/Opera[\s\/]([^\s]*)/);if(C&&C[1]){I.opera=F(C[1]);C=E.match(/Opera Mini[^;]*/);if(C){I.mobile=C[0];}}else{C=E.match(/MSIE\s([^;]*)/);if(C&&C[1]){I.ie=F(C[1]);}else{C=E.match(/Gecko\/([^\s]*)/);if(C){I.gecko=1;C=E.match(/rv:([^\s\)]*)/);if(C&&C[1]){I.gecko=F(C[1]);}}}}}}return I;}();},"3.1.0");YUI.add("get",function(A){(function(){var C=A.UA,B=A.Lang,E="text/javascript",F="text/css",D="stylesheet";A.Get=function(){var M,N,J,L={},K=0,U,W=function(a,X,b){var Y=b||A.config.win,c=Y.document,e=c.createElement(a),Z;for(Z in X){if(X[Z]&&X.hasOwnProperty(Z)){e.setAttribute(Z,X[Z]);}}return e;},T=function(Y,Z,X){var a={id:A.guid(),type:F,rel:D,href:Y};if(X){A.mix(a,X);}return W("link",a,Z);},S=function(Y,Z,X){var a={id:A.guid(),type:E};if(X){A.mix(a,X);}a.src=Y;return W("script",a,Z);},P=function(Y,Z,X){return{tId:Y.tId,win:Y.win,data:Y.data,nodes:Y.nodes,msg:Z,statusText:X,purge:function(){N(this.tId);}};},O=function(b,a,X){var Y=L[b],Z;
-if(Y&&Y.onEnd){Z=Y.context||Y;Y.onEnd.call(Z,P(Y,a,X));}},V=function(a,Z){var X=L[a],Y;if(X.timer){clearTimeout(X.timer);}if(X.onFailure){Y=X.context||X;X.onFailure.call(Y,P(X,Z));}O(a,Z,"failure");},I=function(a){var X=L[a],Z,Y;if(X.timer){clearTimeout(X.timer);}X.finished=true;if(X.aborted){Z="transaction "+a+" was aborted";V(a,Z);return;}if(X.onSuccess){Y=X.context||X;X.onSuccess.call(Y,P(X));}O(a,Z,"OK");},Q=function(Z){var X=L[Z],Y;if(X.onTimeout){Y=X.context||X;X.onTimeout.call(Y,P(X));}O(Z,"timeout","timeout");},H=function(Z,c){var Y=L[Z],b,g,f,e,a,X,i;if(Y.timer){clearTimeout(Y.timer);}if(Y.aborted){b="transaction "+Z+" was aborted";V(Z,b);return;}if(c){Y.url.shift();if(Y.varName){Y.varName.shift();}}else{Y.url=(B.isString(Y.url))?[Y.url]:Y.url;if(Y.varName){Y.varName=(B.isString(Y.varName))?[Y.varName]:Y.varName;}}g=Y.win;f=g.document;e=f.getElementsByTagName("head")[0];if(Y.url.length===0){I(Z);return;}X=Y.url[0];if(!X){Y.url.shift();return H(Z);}if(Y.timeout){Y.timer=setTimeout(function(){Q(Z);},Y.timeout);}if(Y.type==="script"){a=S(X,g,Y.attributes);}else{a=T(X,g,Y.attributes);}J(Y.type,a,Z,X,g,Y.url.length);Y.nodes.push(a);if(Y.insertBefore){i=M(Y.insertBefore,Z);if(i){i.parentNode.insertBefore(a,i);}}else{e.appendChild(a);}if((C.webkit||C.gecko)&&Y.type==="css"){H(Z,X);}},G=function(){if(U){return;}U=true;var X,Y;for(X in L){if(L.hasOwnProperty(X)){Y=L[X];if(Y.autopurge&&Y.finished){N(Y.tId);delete L[X];}}}U=false;},R=function(Y,X,Z){Z=Z||{};var d="q"+(K++),a,c=Z.purgethreshold||A.Get.PURGE_THRESH;if(K%c===0){G();}L[d]=A.merge(Z,{tId:d,type:Y,url:X,finished:false,nodes:[]});a=L[d];a.win=a.win||A.config.win;a.context=a.context||a;a.autopurge=("autopurge" in a)?a.autopurge:(Y==="script")?true:false;a.attributes=a.attributes||{};var b=Z.charset||a.attributes.charset;if(b){a.attributes.charset=b;}setTimeout(function(){H(d);},0);return{tId:d};};J=function(Z,e,d,Y,c,b,X){var a=X||H;if(C.ie){e.onreadystatechange=function(){var f=this.readyState;if("loaded"===f||"complete"===f){e.onreadystatechange=null;a(d,Y);}};}else{if(C.webkit){if(Z==="script"){e.addEventListener("load",function(){a(d,Y);});}}else{e.onload=function(){a(d,Y);};e.onerror=function(f){V(d,f+": "+Y);};}}};M=function(X,a){var Y=L[a],Z=(B.isString(X))?Y.win.document.getElementById(X):X;if(!Z){V(a,"target node not found: "+X);}return Z;};N=function(c){var Y,a,g,e,j,b,Z,f,X=L[c];if(X){Y=X.nodes;a=Y.length;g=X.win.document;e=g.getElementsByTagName("head")[0];if(X.insertBefore){j=M(X.insertBefore,c);if(j){e=j.parentNode;}}for(b=0;b<a;b=b+1){Z=Y[b];if(Z.clearAttributes){Z.clearAttributes();}else{for(f in Z){if(Z.hasOwnProperty(f)){delete Z[f];}}}e.removeChild(Z);}}X.nodes=[];};return{PURGE_THRESH:20,_finalize:function(X){setTimeout(function(){I(X);},0);},abort:function(Y){var Z=(B.isString(Y))?Y:Y.tId,X=L[Z];if(X){X.aborted=true;}},script:function(X,Y){return R("script",X,Y);},css:function(X,Y){return R("css",X,Y);}};}();})();},"3.1.0");YUI.add("intl-base",function(B){var A=/[, ]/;B.mix(B.namespace("Intl"),{lookupBestLang:function(G,H){var F,I,C,E;function D(K){var J;for(J=0;J<H.length;J+=1){if(K.toLowerCase()===H[J].toLowerCase()){return H[J];}}}if(B.Lang.isString(G)){G=G.split(A);}for(F=0;F<G.length;F+=1){I=G[F];if(!I||I==="*"){continue;}while(I.length>0){C=D(I);if(C){return C;}else{E=I.lastIndexOf("-");if(E>=0){I=I.substring(0,E);if(E>=2&&I.charAt(E-2)==="-"){I=I.substring(0,E-2);}}else{break;}}}}return"";}});},"3.1.0",{requires:["yui-base"]});YUI.add("yui-log",function(A){(function(){var E,D=A,F="yui:log",B="undefined",C={debug:1,info:1,warn:1,error:1};D.log=function(I,Q,G,O){var K,N,L,J,M,H=D,P=H.config;if(P.debug){if(G){N=P.logExclude;L=P.logInclude;if(L&&!(G in L)){K=1;}else{if(N&&(G in N)){K=1;}}}if(!K){if(P.useBrowserConsole){J=(G)?G+": "+I:I;if(H.Lang.isFunction(P.logFn)){P.logFn(I,Q,G);}else{if(typeof console!=B&&console.log){M=(Q&&console[Q]&&(Q in C))?Q:"log";console[M](J);}else{if(typeof opera!=B){opera.postError(J);}}}}if(H.fire&&!O){if(!E){H.publish(F,{broadcast:2});E=1;}H.fire(F,{msg:I,cat:Q,src:G});}}}return H;};D.message=function(){return D.log.apply(D,arguments);};})();},"3.1.0",{requires:["yui-base"]});YUI.add("yui-later",function(A){(function(){var B=A.Lang,C=function(K,E,L,G,H){K=K||0;E=E||{};var F=L,J=A.Array(G),I,D;if(B.isString(L)){F=E[L];}if(!F){}I=function(){F.apply(E,J);};D=(H)?setInterval(I,K):setTimeout(I,K);return{id:D,interval:H,cancel:function(){if(this.interval){clearInterval(D);}else{clearTimeout(D);}}};};A.later=C;B.later=C;})();},"3.1.0",{requires:["yui-base"]});YUI.add("yui-throttle",function(Y){
-/* Based on work by Simon Willison: http://gist.github.com/292562 */
-var throttle=function(fn,ms){ms=(ms)?ms:(Y.config.throttleTime||150);if(ms===-1){return(function(){fn.apply(null,arguments);});}var last=(new Date()).getTime();return(function(){var now=(new Date()).getTime();if(now-last>ms){last=now;fn.apply(null,arguments);}});};Y.throttle=throttle;},"3.1.0",{requires:["yui-base"]});YUI.add("yui",function(A){},"3.1.0",{use:["yui-base","get","intl-base","yui-log","yui-later","yui-throttle"]});
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java
deleted file mode 100644
index 0eb688c11dd..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FileLoaderTest.java
+++ /dev/null
@@ -1,120 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-import org.apache.zookeeper.graph.FilterException;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.LogIterator;
-import org.apache.zookeeper.graph.LogSource;
-import org.apache.zookeeper.graph.MergedLogSource;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.Assertions;
-import java.io.IOException;
-import java.util.List;
-
-public class FileLoaderTest {
-
-    @Test
-    public void testHandleRequestOK() throws Exception {
-        String[] files = {""};
-        MyMergedLogSource mls = new MyMergedLogSource(files);
-        final JsonServlet.JsonRequest jsonRequest = mock(JsonServlet.JsonRequest.class);
-        when(jsonRequest.getString("path", "/")).thenReturn("/tmp");
-        FileLoader fl = new FileLoader(mls);
-        String s = fl.handleRequest(jsonRequest);
-        Assertions.assertEquals("{\"status\":\"OK\"}", s);
-        Assertions.assertTrue(mls.getSources().contains(new MySource("/tmp")));
-        Assertions.assertFalse(mls.getSources().contains(new MySource("/tmp2")));
-    }
-
-    @Test
-    public void testHandleRequestERR() throws Exception {
-        String[] files = {""};
-        MyMergedLogSource mls = new MyMergedLogSource(files);
-        final JsonServlet.JsonRequest jsonRequest = mock(JsonServlet.JsonRequest.class);
-        when(jsonRequest.getString("path", "/")).thenReturn("/tmp3");
-        FileLoader fl = new FileLoader(mls);
-        String s = fl.handleRequest(jsonRequest);
-        Assertions.assertEquals("{\"status\":\"ERR\",\"error\":\"java.io.IOException: Message\"}", s);
-        Assertions.assertFalse(mls.getSources().contains(new MySource("/tmp")));
-        Assertions.assertFalse(mls.getSources().contains(new MySource("/tmp2")));
-    }
-
-    private class MyMergedLogSource extends MergedLogSource {
-        public MyMergedLogSource(String[] files) throws IOException {
-            super(files);
-        }
-        public void addSource(String f) throws IOException {
-            if ("/tmp3".equals(f)) throw new IOException("Message");
-            sources.add(new MySource(f));
-        }
-        public List<LogSource> getSources(){
-            return sources;
-        }
-    }
-
-    private class MySource implements LogSource{
-        private String file = null;
-        public MySource(String file) throws IOException {
-            this.file=file;
-        }
-
-        public boolean equals(Object o){
-            if(!(o instanceof MySource)) return false;
-            if(((MySource)o).file == null) return this.file==null;
-            return ((MySource)o).file.equals(this.file);
-        }
-
-        @Override
-        public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-            return null;
-        }
-
-        @Override
-        public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-            return null;
-        }
-
-        @Override
-        public LogIterator iterator() throws IllegalArgumentException {
-            return null;
-        }
-
-        @Override
-        public boolean overlapsRange(long starttime, long endtime) {
-            return false;
-        }
-
-        @Override
-        public long size() {
-            return 0;
-        }
-
-        @Override
-        public long getStartTime() {
-            return 0;
-        }
-
-        @Override
-        public long getEndTime() {
-            return 0;
-        }
-    }
-}
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java
deleted file mode 100644
index 007c2915fbb..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/FsTest.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.Test;
-import java.io.File;
-import java.io.IOException;
-
-public class FsTest {
-    @Test
-    public void testGenerateJSON() throws IOException {
-        File[] files = new File[2];
-        final File file1 = mock(File.class);
-        when(file1.getName()).thenReturn("testDir");
-        when(file1.isDirectory()).thenReturn(true);
-        when(file1.getCanonicalPath()).thenReturn("/tmp/testDir");
-        final File file2 = mock(File.class);
-        when(file2.getName()).thenReturn("test");
-        when(file2.isDirectory()).thenReturn(false);
-        when(file2.getCanonicalPath()).thenReturn("/tmp/test");
-        files[0]=file1;
-        files[1]=file2;
-        String output = Fs.generateJSON(files);
-        String expectedOutput = "[{\"file\":\"testDir\",\"type\":\"D\",\"path\":\"/tmp/testDir\"}," +
-                "{\"file\":\"test\",\"type\":\"F\",\"path\":\"/tmp/test\"}]";
-        Assertions.assertEquals(expectedOutput, output);
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java
deleted file mode 100644
index f496868f730..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/test/java/org/apache/zookeeper/graph/servlets/ThroughputTest.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import static org.mockito.Mockito.mock;
-import org.apache.zookeeper.graph.FilterException;
-import org.apache.zookeeper.graph.Log4JEntry;
-import org.apache.zookeeper.graph.Log4JSource;
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.LogIterator;
-import org.apache.zookeeper.graph.TransactionEntry;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.Test;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.NoSuchElementException;
-
-public class ThroughputTest {
-
-    @Test
-    public void testGetJSON() throws Exception {
-        long scale = 1;
-        Log4JSource source = mock(Log4JSource.class);
-        Throughput tp = new Throughput(source);
-        LogIterator iter = new MyIterator();
-        String jsonString = tp.getJSON(iter, scale);
-        String expected = "[{\"time\":3,\"count\":1},{\"time\":4,\"count\":1},{\"time\":5,\"count\":0}]";
-        Assertions.assertEquals(expected, jsonString);
-    }
-
-    private class MyIterator implements LogIterator {
-        int index = 0;
-        List<LogEntry> list = new ArrayList<>();
-
-        public MyIterator() throws IllegalArgumentException, FilterException {
-            for(int i=1; i<3; i++){
-                long timestamp = i;
-                int node = i;
-                String entry = Integer.toString(i);
-                Log4JEntry le = new Log4JEntry(timestamp, node, entry);
-                list.add(le);
-            }
-            for(int i=3; i<7; i++){
-                long timestamp = i;
-                long clientId = i;
-                long Cxid = i;
-                long Zxid = i;
-                String op = Integer.toString(i);
-                TransactionEntry te = new TransactionEntry(timestamp, clientId, Cxid, Zxid, op);
-                list.add(te);
-            }
-        }
-
-        synchronized public long size() throws IOException {
-            return list.size();
-        }
-
-        public boolean hasNext() {
-            return index<list.size()-1;
-        }
-
-        public LogEntry next() throws NoSuchElementException {
-            return list.get(index++);
-        }
-
-        public void remove() throws UnsupportedOperationException {
-            throw new UnsupportedOperationException("remove not supported for L4J logs");
-        }
-
-        public void close(){}
-    }
-}

From afe8f08b6d369a4670a794443d5efcbfbb79ddc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Tue, 28 Apr 2026 17:31:56 +0200
Subject: [PATCH 585/591] ZOOKEEPER-5029: Port unification for
 PrometheusMetricsProvider

Reviewers: meszibalu, anmolnar
Author: PDavid
Closes #2362 from PDavid/ZOOKEEPER-5029-PrometheusMetricsProvider-portUnification
---
 .../prometheus/PrometheusMetricsProvider.java | 72 +++++++++++++++----
 .../PrometheusHttpsMetricsProviderTest.java   |  8 +--
 .../PrometheusMetricsProviderConfigTest.java  | 16 +++++
 3 files changed, 79 insertions(+), 17 deletions(-)

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index 8ae6178e0f0..dc7828ddb35 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -41,6 +41,11 @@
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.admin.UnifiedConnectionFactory;
+import org.eclipse.jetty.http.HttpVersion;
+import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.HttpConnectionFactory;
+import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.servlet.ServletContextHandler;
@@ -84,6 +89,7 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     private boolean wantClientAuth = true; // Secure default
     private String enabledProtocols;
     private String cipherSuites;
+    private int httpVersion;
 
     // Constants for configuration
     public static final String HTTP_HOST = "httpHost";
@@ -101,7 +107,14 @@ public class PrometheusMetricsProvider implements MetricsProvider {
     public static final String SSL_WANT_CLIENT_AUTH = "ssl.want.client.auth";
     public static final String SSL_ENABLED_PROTOCOLS = "ssl.enabledProtocols";
     public static final String SSL_ENABLED_CIPHERS = "ssl.ciphersuites";
+    public static final String HTTP_VERSION = "httpVersion";
     public static final int SCAN_INTERVAL = 60 * 10; // 10 minutes
+    public static final int DEFAULT_HTTP_VERSION = 11;  // based on HttpVersion.java in jetty
+    /**
+     * The time, in seconds, that the browser should remember that a host is only to be accessed using HTTPS.
+     * Seconds in a day.
+     */
+    public static final int DEFAULT_STS_MAX_AGE = 1 * 24 * 60 * 60;
 
     /**
      * Custom servlet to disable the TRACE method for security reasons.
@@ -139,6 +152,7 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
             this.wantClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_WANT_CLIENT_AUTH, "true"));
             this.enabledProtocols = configuration.getProperty(SSL_ENABLED_PROTOCOLS);
             this.cipherSuites = configuration.getProperty(SSL_ENABLED_CIPHERS);
+            this.httpVersion = Integer.getInteger(HTTP_VERSION, DEFAULT_HTTP_VERSION);
         }
 
         // Validate that at least one port is configured.
@@ -171,23 +185,49 @@ public void start() throws MetricsProviderLifeCycleException {
             int acceptors = 1;
             int selectors = 1;
 
-            // Configure HTTP connector if enabled
-            if (this.httpPort != -1) {
-                ServerConnector httpConnector = new ServerConnector(server, acceptors, selectors);
-                httpConnector.setPort(this.httpPort);
-                httpConnector.setHost(this.host);
-                server.addConnector(httpConnector);
-            }
+            ServerConnector connector = null;
+
+            if (this.httpPort != -1 && this.httpsPort != -1 && this.httpPort == this.httpsPort) {
+                // Set Strict-Transport-Security HTTP response header.
+                SecureRequestCustomizer customizer = new SecureRequestCustomizer();
+                customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
+                // Strict-Transport-Security HTTP header should apply to all subdomains of the host's domain as well.
+                customizer.setStsIncludeSubDomains(true);
+
+                HttpConfiguration config = new HttpConfiguration();
+                config.setSecureScheme("https");
+                config.addCustomizer(customizer);
 
-            // Configure HTTPS connector if enabled
-            if (this.httpsPort != -1) {
                 SslContextFactory.Server sslContextFactory = createSslContextFactory();
-                KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslContextFactory);
-                keystoreScanner.setScanInterval(SCAN_INTERVAL);
-                server.addBean(keystoreScanner);
-                server.addConnector(createSslConnector(server, acceptors, selectors, sslContextFactory));
+                setKeyStoreScanner(sslContextFactory);
+
+                String nextProtocol = HttpVersion.fromVersion(httpVersion).asString();
+                connector = new ServerConnector(server,
+                        new UnifiedConnectionFactory(sslContextFactory, nextProtocol),
+                        new HttpConnectionFactory(config));
+                connector.setPort(this.httpPort);
+                connector.setHost(this.host);
+                LOG.info("Created unified ServerConnector for host: {}, httpPort: {}", host, httpPort);
+            } else {
+                // Configure HTTP connector if enabled
+                if (this.httpPort != -1) {
+                    connector = new ServerConnector(server, acceptors, selectors);
+                    connector.setPort(this.httpPort);
+                    connector.setHost(this.host);
+                    LOG.info("Created HTTP ServerConnector for host: {}, httpPort: {}", host, httpPort);
+                }
+
+                // Configure HTTPS connector if enabled
+                if (this.httpsPort != -1) {
+                    SslContextFactory.Server sslContextFactory = createSslContextFactory();
+                    setKeyStoreScanner(sslContextFactory);
+                    connector = createSslConnector(server, acceptors, selectors, sslContextFactory);
+                    LOG.info("Created HTTPS ServerConnector for host: {}, httpsPort: {}", host, httpsPort);
+                }
             }
 
+            server.addConnector(connector);
+
             // Set up the servlet context handler
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
@@ -207,6 +247,12 @@ public void start() throws MetricsProviderLifeCycleException {
         }
     }
 
+    private void setKeyStoreScanner(SslContextFactory.Server sslContextFactory) {
+        KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslContextFactory);
+        keystoreScanner.setScanInterval(SCAN_INTERVAL);
+        server.addBean(keystoreScanner);
+    }
+
     /**
      * Creates and configures the SslContextFactory for the server.
      *
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
index c091934709f..f730b4dbe00 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
@@ -43,10 +43,10 @@
 public class PrometheusHttpsMetricsProviderTest extends PrometheusMetricsTestBase {
 
     private PrometheusMetricsProvider provider;
-    private String httpHost = "127.0.0.1";
-    private int httpsPort = 4443;
-    private int httpPort = 4000;
-    private String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+    private final String httpHost = "127.0.0.1";
+    private final int httpsPort = 4443;
+    private final int httpPort = 4000;
+    private final String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
 
     public void initializeProviderWithCustomConfig(Properties inputConfiguration) throws Exception {
         provider = new PrometheusMetricsProvider();
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
index bb24ab75d29..66a01fb95e7 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -292,4 +292,20 @@ public void checkServerTrusted(X509Certificate[] certs, String authType) {
                 }
         };
     }
+
+    @Test
+    public void testPortUnification() throws Exception {
+        int unifiedPort = 5400;
+        Properties configuration = new Properties();
+        configuration.setProperty("httpsPort", String.valueOf(unifiedPort));
+        configuration.setProperty("httpPort", String.valueOf(unifiedPort));
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+        configuration.setProperty("ssl.keyStore.password", "testpass");
+        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+        configuration.setProperty("ssl.trustStore.password", "testpass");
+        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        provider.configure(configuration);
+        provider.start();
+    }
 }

From 8184fd1c6f9ca1cdad949ac2b6bb9249c17eb55f Mon Sep 17 00:00:00 2001
From: Nihir Agarwal <122777244+nihiragarwal24@users.noreply.github.com>
Date: Fri, 1 May 2026 00:17:46 +0530
Subject: [PATCH 586/591] ZOOKEEPER-5009: Memory Leak in zoo_sasl_client_create

Reviewers: kezhuw
Author: nihiragarwal24
Closes #2341 from nihiragarwal24/ZOOKEEPER-5009
---
 zookeeper-client/zookeeper-client-c/src/zk_sasl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
index 587b93b511b..c741a88943a 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
+++ b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
@@ -104,6 +104,7 @@ zoo_sasl_client_t *zoo_sasl_client_create(zoo_sasl_params_t *sasl_params)
 
     if (rc != ZOK) {
         zoo_sasl_client_destroy(sc);
+        free(sc);
         return NULL;
     }
 

From 972e71cbd2eebd4f7bcf9193c6b09d8d4ce181a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Wed, 6 May 2026 19:40:18 +0200
Subject: [PATCH 587/591] ZOOKEEPER-5043: Disable fallback to DIGEST-MD5 in
 SaslServer when FIPS mode is set

Reviewers: anmolnar, meszibalu
Author: PDavid
Closes #2381 from PDavid/ZOOKEEPER-5043-disable-DIGEST-MD5
---
 .../zookeeper-client-c/tests/zkServer.sh      |  3 +-
 .../zookeeper/server/ZooKeeperSaslServer.java | 11 ++-
 .../quorum/auth/SaslQuorumAuthServer.java     |  8 ++-
 .../apache/zookeeper/util/SecurityUtils.java  |  7 ++
 .../test/SaslAuthFailFipsModeTest.java        | 72 +++++++++++++++++++
 5 files changed, 97 insertions(+), 4 deletions(-)
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java

diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index e1b850dd194..244eefc9b0c 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -113,7 +113,8 @@ read_only=
 PROPERTIES=($EXTRA_JVM_ARGS "-Dzookeeper.extendedTypesEnabled=true" "-Dznode.container.checkIntervalMs=100")
 if [[ $1 == "startRequireSASLAuth" ]]; then
   PROPERTIES=("-Dzookeeper.sessionRequireClientSASLAuth=true" "${PROPERTIES[@]}"
-    "-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider")
+    "-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
+    "-Dzookeeper.fips-mode=false")
   if [[ -n $2 ]]; then
     PROPERTIES=("${PROPERTIES[@]}" "-Djava.security.auth.login.config=$2")
   fi
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
index bf5089d792b..98c8d0e6bb5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
@@ -22,6 +22,7 @@
 import javax.security.sasl.SaslException;
 import javax.security.sasl.SaslServer;
 import org.apache.zookeeper.Login;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.util.SecurityUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -32,20 +33,26 @@ public class ZooKeeperSaslServer {
     public static final String DEFAULT_LOGIN_CONTEXT_NAME = "Server";
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperSaslServer.class);
-    private SaslServer saslServer;
+    private final SaslServer saslServer;
+    private final ZKConfig config;
 
     ZooKeeperSaslServer(final Login login) {
+        config = new ZKConfig();
         saslServer = createSaslServer(login);
     }
 
     private SaslServer createSaslServer(final Login login) {
         synchronized (login) {
             Subject subject = login.getSubject();
-            return SecurityUtils.createSaslServer(subject, "zookeeper", "zk-sasl-md5", login.newCallbackHandler(), LOG);
+            return SecurityUtils.createSaslServer(config, subject, "zookeeper", "zk-sasl-md5", login.newCallbackHandler(), LOG);
         }
     }
 
     public byte[] evaluateResponse(byte[] response) throws SaslException {
+        if (saslServer == null) {
+            LOG.error("SaslServer failed to initialize (FIPS mode may have blocked DIGEST-MD5). Cannot authenticate client.");
+            throw new SaslException("SaslServer is null, cannot evaluate client SASL response.");
+        }
         return saslServer.evaluateResponse(response);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
index a1425833b7f..ca651115d0a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
@@ -47,6 +47,7 @@ public class SaslQuorumAuthServer implements QuorumAuthServer {
     private static final int MAX_RETRIES = 5;
     private final Login serverLogin;
     private final boolean quorumRequireSasl;
+    private final ZKConfig zkConfig;
 
     public SaslQuorumAuthServer(boolean quorumRequireSasl, String loginContext, Set<String> authzHosts) throws SaslException {
         this.quorumRequireSasl = quorumRequireSasl;
@@ -60,7 +61,8 @@ public SaslQuorumAuthServer(boolean quorumRequireSasl, String loginContext, Set<
             Supplier<CallbackHandler> callbackSupplier = () -> {
                 return new SaslQuorumServerCallbackHandler(entries, authzHosts);
             };
-            serverLogin = new Login(loginContext, callbackSupplier, new ZKConfig());
+            zkConfig = new ZKConfig();
+            serverLogin = new Login(loginContext, callbackSupplier, zkConfig);
             serverLogin.startThreadIfNeeded();
         } catch (Throwable e) {
             throw new SaslException("Failed to initialize authentication mechanism using SASL", e);
@@ -86,11 +88,15 @@ public void authenticate(Socket sock, DataInputStream din) throws SaslException
             dout = new DataOutputStream(sock.getOutputStream());
             byte[] challenge = null;
             ss = SecurityUtils.createSaslServer(
+                zkConfig,
                 serverLogin.getSubject(),
                 QuorumAuth.QUORUM_SERVER_PROTOCOL_NAME,
                 QuorumAuth.QUORUM_SERVER_SASL_DIGEST,
                 serverLogin.newCallbackHandler(),
                 LOG);
+            if (ss == null) {
+                throw new SaslException("Failed to create SaslServer (FIPS mode may be blocking DIGEST-MD5)");
+            }
             while (!ss.isComplete()) {
                 challenge = ss.evaluateResponse(token);
                 if (!ss.isComplete()) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
index 5c44f21161f..e29dabcf01a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
@@ -153,6 +153,7 @@ public SaslClient run() throws SaslException {
     /**
      * Create an instance of a SaslServer. It will return null if there is an exception.
      *
+     * @param config to check whether FIPS mode is enabled.
      * @param subject subject
      * @param protocol protocol
      * @param serverName server name
@@ -161,6 +162,7 @@ public SaslClient run() throws SaslException {
      * @return sasl server object
      */
     public static SaslServer createSaslServer(
+        final ZKConfig config,
         final Subject subject,
         final String protocol,
         final String serverName,
@@ -251,6 +253,11 @@ public SaslServer run() {
                 // JAAS non-GSSAPI authentication: assuming and supporting only
                 // DIGEST-MD5 mechanism for now.
                 // TODO: use 'authMech=' value in zoo.cfg.
+                // FIPS-mode: don't try DIGEST-MD5, just return error
+                if (X509Util.getFipsMode(config)) {
+                    LOG.warn("SaslServer will not use DIGEST-MD5 as SASL mechanism, because FIPS mode is enabled.");
+                    return null;
+                }
                 try {
                     SaslServer saslServer = Sasl.createSaslServer("DIGEST-MD5", protocol, serverName, null, callbackHandler);
                     return saslServer;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java
new file mode 100644
index 00000000000..6bb09a14efe
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.X509Util;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests that DIGEST-MD5 SASL authentication is rejected when FIPS mode is enabled.
+ * Does NOT extend SaslAuthDigestTestBase because that base class disables FIPS mode.
+ */
+public class SaslAuthFailFipsModeTest extends ClientBase {
+
+    @BeforeAll
+    public static void setUpBeforeClass() {
+        System.setProperty(X509Util.FIPS_MODE_PROPERTY, "true");
+        System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
+        System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
+        System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas_fips.conf", "test"));
+    }
+
+    @AfterAll
+    public static void tearDownAfterClass() {
+        System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+        System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
+        System.clearProperty(SaslTestUtil.authProviderProperty);
+        System.clearProperty(SaslTestUtil.jaasConfig);
+    }
+
+    @Test
+    public void testDigestMd5RejectedInFipsMode() throws Exception {
+        ZooKeeper zk = null;
+        CountdownWatcher watcher = new CountdownWatcher();
+        try {
+            zk = createClient(watcher);
+            zk.create("/fips-test", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            fail("DIGEST-MD5 SASL authentication should be rejected when FIPS mode is enabled.");
+        } catch (KeeperException e) {
+            assertEquals(KeeperException.Code.AUTHFAILED, e.code());
+            watcher.waitForDisconnected(SaslTestUtil.CLIENT_DISCONNECT_TIMEOUT);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+}

From d4e15d325cb2e50cd948c27bb535746b42845793 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Thu, 7 May 2026 15:56:37 +0200
Subject: [PATCH 588/591] ZOOKEEPER-5045: Fall back to TLSv1.2 default in FIPS
 mode

Reviewers: meszibalu
Author: PDavid
Closes #2380 from PDavid/ZOOKEEPER-5045
---
 .../org/apache/zookeeper/common/X509Util.java | 38 ++++++++++++-------
 .../apache/zookeeper/common/X509UtilTest.java | 33 ++++++++++++----
 .../server/admin/CommandAuthTest.java         |  5 ++-
 3 files changed, 54 insertions(+), 22 deletions(-)

diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index fee410cf057..460a6f3ac55 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -35,7 +35,6 @@
 import java.security.cert.PKIXBuilderParameters;
 import java.security.cert.PKIXRevocationChecker;
 import java.security.cert.X509CertSelector;
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
@@ -87,27 +86,38 @@ public abstract class X509Util implements Closeable, AutoCloseable {
         }
     }
 
-    public static final String DEFAULT_PROTOCOL = defaultTlsProtocol();
+    private static final AtomicReference<String> defaultProtocol = new AtomicReference<>();
 
     /**
-     * Return TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
+     * Return TLSv1.2 when FIPS mode is enabled.
+     * Otherwise, returns TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
      * TLSv1.3 was first introduced in JDK11 and back-ported to OpenJDK 8u272.
      */
-    private static String defaultTlsProtocol() {
-        String defaultProtocol = TLS_1_2;
-        List<String> supported = new ArrayList<>();
+    public static String defaultTlsProtocol(ZKConfig config) {
+        if (getFipsMode(config)) {
+            return TLS_1_2;
+        }
+
+        String proto = defaultProtocol.get();
+        if (proto != null) {
+            return proto;
+        }
+
+        proto = TLS_1_2;
         try {
-            supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
-            // We cannot use the default protocols directly, because the SSLContext factory methods
-            // only accept a single protocol
+            List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
             if (supported.contains(TLS_1_3)) {
-                defaultProtocol = TLS_1_3;
+                proto = TLS_1_3;
+            }
+            if (defaultProtocol.compareAndSet(null, proto)) {
+                LOG.info("Supported TLS protocols are {}, default TLS protocol is {}", supported, proto);
+            } else {
+                proto = defaultProtocol.get();
             }
         } catch (NoSuchAlgorithmException e) {
             // Ignore.
         }
-        LOG.info("Default TLS protocol is {}, supported TLS protocols are {}", defaultProtocol, supported);
-        return defaultProtocol;
+        return proto;
     }
 
     public static final int DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS = 5000;
@@ -410,8 +420,8 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
                     + ": "
                     + trustStoreTypeProp, e);
         }
-
-        String protocol = config.getProperty(sslProtocolProperty, DEFAULT_PROTOCOL);
+        String defaultTlsProtocol = defaultTlsProtocol(config);
+        String protocol = config.getProperty(sslProtocolProperty, defaultTlsProtocol);
         try {
             SSLContext sslContext = SSLContext.getInstance(protocol);
             sslContext.init(keyManagers, trustManagers, null);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index 1c5104e784b..660ca64bfdb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper.common;
 
+import static org.apache.zookeeper.common.X509Util.FIPS_MODE_PROPERTY;
+import static org.apache.zookeeper.common.X509Util.TLS_1_2;
+import static org.apache.zookeeper.common.X509Util.TLS_1_3;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -90,6 +93,7 @@ public void cleanUp() {
         System.clearProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty());
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        System.clearProperty(FIPS_MODE_PROPERTY);
         x509Util.close();
     }
 
@@ -100,24 +104,39 @@ public void testCreateSSLContextWithoutCustomProtocol(
             X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
             throws Exception {
         init(caKeyType, certKeyType, keyPassword, paramIndex);
+        System.setProperty(FIPS_MODE_PROPERTY, Boolean.FALSE.toString());
         SSLContext sslContext = x509Util.getDefaultSSLContext();
-        assertEquals(X509Util.DEFAULT_PROTOCOL, sslContext.getProtocol());
+        String defaultTlsProtocol = X509Util.defaultTlsProtocol(new ZKConfig());
+        assertEquals(defaultTlsProtocol, sslContext.getProtocol());
 
         // Check that TLSv1.3 is selected in JDKs that support it (OpenJDK 8u272 and later).
         List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
-        if (supported.contains(X509Util.TLS_1_3)) {
+        if (supported.contains(TLS_1_3)) {
             // SSLContext protocol.
-            assertEquals(X509Util.TLS_1_3, sslContext.getProtocol());
+            assertEquals(TLS_1_3, sslContext.getProtocol());
             // Enabled protocols.
             List<String> protos = Arrays.asList(sslContext.getDefaultSSLParameters().getProtocols());
-            assertTrue(protos.contains(X509Util.TLS_1_2));
-            assertTrue(protos.contains(X509Util.TLS_1_3));
+            assertTrue(protos.contains(TLS_1_2));
+            assertTrue(protos.contains(TLS_1_3));
         } else {
-            assertEquals(X509Util.TLS_1_2, sslContext.getProtocol());
-            assertArrayEquals(new String[]{X509Util.TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
+            assertEquals(TLS_1_2, sslContext.getProtocol());
+            assertArrayEquals(new String[]{TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
         }
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextFIPSModeEnabled(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        System.setProperty(FIPS_MODE_PROPERTY, Boolean.TRUE.toString());
+        SSLContext sslContext = x509Util.getDefaultSSLContext();
+        assertEquals(TLS_1_2, sslContext.getProtocol());
+        assertArrayEquals(new String[]{TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
+    }
+
     @ParameterizedTest
     @MethodSource("data")
     @Timeout(value = 5)
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
index ed5dea56cf2..f576ad81b12 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
@@ -48,6 +48,8 @@
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.QuorumX509Util;
 import org.apache.zookeeper.common.X509Exception;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
@@ -281,7 +283,8 @@ private void setupTLS() throws Exception {
         System.setProperty("zookeeper.admin.needClientAuth", "true");
 
         // create SSLContext
-        final SSLContext sslContext = SSLContext.getInstance(ClientX509Util.DEFAULT_PROTOCOL);
+        String defaultTlsProtocol = X509Util.defaultTlsProtocol(new ZKConfig());
+        final SSLContext sslContext = SSLContext.getInstance(defaultTlsProtocol);
         final X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider("x509");
         if (authProvider == null) {
             throw new X509Exception.SSLContextException("Could not create SSLContext with x509 auth provider");

From ed28ce78ba36dffc4fe634862418d80895bfc242 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Wed, 13 May 2026 19:30:47 +0200
Subject: [PATCH 589/591] ZOOKEEPER-5047: Make PrometheusMetricsProvider
 KeyStore type detection consistent

Reviewers: meszibalu, anmolnar
Author: PDavid
Closes #2385 from PDavid/ZOOKEEPER-5047-PrometheusMetricsProvider-KeyStore-type
---
 .../main/resources/markdown/zookeeperAdmin.md |  4 +--
 .../prometheus/PrometheusMetricsProvider.java | 30 ++++++++++++-------
 2 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index c87ce053e71..1889faee341 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -2326,7 +2326,7 @@ options are used to configure the [AdminServer](#sc_adminserver).
 
 *  *metricsProvider.ssl.keyStore.type*:
    **New in 3.10.0:**
-   Specifies the file format of the PrometheusMetricsProvider keystore. Values: JKS, PEM, PKCS12 or null (detect by filename).
+   Specifies the file format of the PrometheusMetricsProvider keystore. Values: JKS, PEM, PKCS12, BCFKS or null (detect by filename).
    Default: null.
 
 * *metricsProvider.ssl.trustStore.location* and *metricsProvider.ssl.trustStore.password*:
@@ -2337,7 +2337,7 @@ options are used to configure the [AdminServer](#sc_adminserver).
 
 * *metricsProvider.ssl.trustStore.type*:
    **New in 3.10.0:**
-   Specifies the file format of the PrometheusMetricsProvider truststore. Values: JKS, PEM, PKCS12 or null (detect by filename).
+   Specifies the file format of the PrometheusMetricsProvider truststore. Values: JKS, PEM, PKCS12, BCFKS or null (detect by filename).
    Default: null.
 
 * *metricsProvider.ssl.need.client.auth*:
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index dc7828ddb35..85cacb686f9 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -23,6 +23,8 @@
 import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
 import io.prometheus.metrics.model.registry.PrometheusRegistry;
 import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Properties;
@@ -32,6 +34,7 @@
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.metrics.Counter;
 import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
@@ -50,6 +53,7 @@
 import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.resource.Resource;
 import org.eclipse.jetty.util.ssl.KeyStoreScanner;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.eclipse.jetty.util.thread.QueuedThreadPool;
@@ -144,10 +148,10 @@ public void configure(Properties configuration) throws MetricsProviderLifeCycleE
         if (this.httpsPort != -1) {
             this.keyStorePath = configuration.getProperty(SSL_KEYSTORE_LOCATION);
             this.keyStorePassword = configuration.getProperty(SSL_KEYSTORE_PASSWORD);
-            this.keyStoreType = configuration.getProperty(SSL_KEYSTORE_TYPE, "PKCS12");
+            this.keyStoreType = configuration.getProperty(SSL_KEYSTORE_TYPE);
             this.trustStorePath = configuration.getProperty(SSL_TRUSTSTORE_LOCATION);
             this.trustStorePassword = configuration.getProperty(SSL_TRUSTSTORE_PASSWORD);
-            this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE, "PKCS12");
+            this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE);
             this.needClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_NEED_CLIENT_AUTH, "true"));
             this.wantClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_WANT_CLIENT_AUTH, "true"));
             this.enabledProtocols = configuration.getProperty(SSL_ENABLED_PROTOCOLS);
@@ -258,18 +262,21 @@ private void setKeyStoreScanner(SslContextFactory.Server sslContextFactory) {
      *
      * @return A configured SslContextFactory.Server instance.
      */
-    private SslContextFactory.Server createSslContextFactory() {
+    private SslContextFactory.Server createSslContextFactory() throws GeneralSecurityException, IOException {
         SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
 
         // Validate and set KeyStore properties
         if (this.keyStorePath == null || this.keyStorePath.isEmpty()) {
             throw new IllegalArgumentException("SSL/TLS is enabled, but '" + SSL_KEYSTORE_LOCATION + "' is not set.");
         }
-        sslContextFactory.setKeyStorePath(this.keyStorePath);
+        KeyStore keyStore = X509Util.loadKeyStore(this.keyStorePath, this.keyStorePassword, this.keyStoreType);
+        LOG.debug("Successfully loaded private key from {}", this.keyStorePath);
+
+        sslContextFactory.setKeyStore(keyStore);
         sslContextFactory.setKeyStorePassword(this.keyStorePassword);
-        if (this.keyStoreType != null) {
-            sslContextFactory.setKeyStoreType(this.keyStoreType);
-        }
+
+        // This is needed for KeyStoreScanner to work.
+        sslContextFactory.setKeyStoreResource(Resource.newResource(this.keyStorePath));
 
         // Validate and set TrustStore properties (often needed for client auth)
         if (this.needClientAuth && (this.trustStorePath == null || this.trustStorePath.isEmpty())) {
@@ -277,11 +284,12 @@ private SslContextFactory.Server createSslContextFactory() {
                     "'" + SSL_NEED_CLIENT_AUTH + "' is true, but '" + SSL_TRUSTSTORE_LOCATION + "' is not set.");
         }
         if (this.trustStorePath != null) {
-            sslContextFactory.setTrustStorePath(this.trustStorePath);
+            KeyStore trustStore = X509Util.loadTrustStore(this.trustStorePath, this.trustStorePassword,
+                    this.trustStoreType);
+            LOG.debug("Successfully loaded certificate authority from {}", this.trustStorePath);
+
+            sslContextFactory.setTrustStore(trustStore);
             sslContextFactory.setTrustStorePassword(this.trustStorePassword);
-            if (this.trustStoreType != null) {
-                sslContextFactory.setTrustStoreType(this.trustStoreType);
-            }
         }
 
         sslContextFactory.setNeedClientAuth(this.needClientAuth);

From f94cdd572eb3f04f6ba87df843b90999e896eaba Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Fri, 15 May 2026 02:31:40 +0200
Subject: [PATCH 590/591] ZOOKEEPER-4985: Fix zkCleanup.sh script to not fail
 on non-standard config directories (#2324)

Co-authored-by: Christopher Tubbs <ctubbsii@apache.org>
---
 bin/zkCleanup.sh | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/bin/zkCleanup.sh b/bin/zkCleanup.sh
index f3e54de03d8..2b8b87371cb 100755
--- a/bin/zkCleanup.sh
+++ b/bin/zkCleanup.sh
@@ -31,27 +31,34 @@
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
 ZOOBIN="$(dirname "$ZOOBIN")"
-ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)" || exit
 
 if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
   # shellcheck source=bin/zkEnv.sh
-  . "$ZOOBINDIR"/../libexec/zkEnv.sh
+  . "$ZOOBINDIR"/../libexec/zkEnv.sh "$@"
 else
   # shellcheck source=bin/zkEnv.sh
-  . "$ZOOBINDIR"/zkEnv.sh
+  . "$ZOOBINDIR"/zkEnv.sh "$@"
 fi
 
-ZOODATADIR="$(grep "^[[:space:]]*dataDir=" "$ZOOCFG" | sed -e 's/.*=//')"
-ZOODATALOGDIR="$(grep "^[[:space:]]*dataLogDir=" "$ZOOCFG" | sed -e 's/.*=//')"
+ZOODATADIR=""
+ZOODATALOGDIR=""
+
+# Only try to read config if ZOOCFG exists
+if [[ -f $ZOOCFG ]]; then
+  re='^[^=]*=[[:space:]]*(.*)[[:space:]]*$'
+  ZOODATADIR="$(grep "^[[:space:]]*dataDir=" "$ZOOCFG" 2>/dev/null)"
+  [[ $ZOODATADIR =~ $re ]] && ZOODATADIR="${BASH_REMATCH[1]}"
+  ZOODATALOGDIR="$(grep "^[[:space:]]*dataLogDir=" "$ZOOCFG" 2>/dev/null)"
+  [[ $ZOODATALOGDIR =~ $re ]] && ZOODATALOGDIR="${BASH_REMATCH[1]}"
+fi
 
 ZOO_LOG_FILE=zookeeper-$USER-cleanup-$HOSTNAME.log
 
 # shellcheck disable=SC2206
-flags=($JVMFLAGS)
-if [[ -z $ZOODATALOGDIR ]]; then
-  "$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" "${flags[@]}" \
-    org.apache.zookeeper.server.PurgeTxnLog "$ZOODATADIR" "$@"
-else
-  "$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" "${flags[@]}" \
-    org.apache.zookeeper.server.PurgeTxnLog "$ZOODATALOGDIR" "$ZOODATADIR" "$@"
-fi
+flags=("-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" $JVMFLAGS)
+
+directories=()
+[[ -n $ZOODATADIR ]] && directories=("$ZOODATADIR")
+[[ -n $ZOODATALOGDIR ]] && directories=("$ZOODATALOGDIR" "${directories[@]}")
+"$JAVA" "${flags[@]}" org.apache.zookeeper.server.PurgeTxnLog "${directories[@]}" "$@"

From 34a9492085b3ecc18c9eb83414ebe5e17ede287a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Paksy?= <paksydavid@gmail.com>
Date: Tue, 19 May 2026 16:40:51 +0200
Subject: [PATCH 591/591] ZOOKEEPER-5049: Redact passwords from
 PrometheusMetricsProvider configuration logging

Reviewers: anmolnar, meszibalu
Author: PDavid
Closes #2387 from PDavid/ZOOKEEPER-5049-PrometheusMetricsProvider-log-redact
---
 .../prometheus/PrometheusMetricsProvider.java |   3 +-
 .../PrometheusHttpsMetricsProviderTest.java   |  41 +++++++
 .../apache/zookeeper/common/LogRedactor.java  |  62 +++++++++++
 .../org/apache/zookeeper/common/ZKConfig.java |  21 +---
 .../zookeeper/common/LogRedactorTest.java     | 100 ++++++++++++++++++
 5 files changed, 209 insertions(+), 18 deletions(-)
 create mode 100644 zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java
 create mode 100644 zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java

diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index 85cacb686f9..001b7f25dcd 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
+import static org.apache.zookeeper.common.LogRedactor.redactSensitiveValues;
 import io.prometheus.metrics.core.metrics.GaugeWithCallback;
 import io.prometheus.metrics.exporter.servlet.javax.PrometheusMetricsServlet;
 import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
@@ -136,7 +137,7 @@ protected void doTrace(HttpServletRequest req, HttpServletResponse resp) throws
 
     @Override
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
-        LOG.info("Initializing Prometheus metrics with Jetty, configuration: {}", configuration);
+        LOG.info("Initializing Prometheus metrics with Jetty, configuration: {}", redactSensitiveValues(configuration));
 
         this.host = configuration.getProperty(HTTP_HOST, "0.0.0.0");
         this.httpPort = Integer.parseInt(configuration.getProperty(HTTP_PORT, "-1"));
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
index f730b4dbe00..53332e24f8d 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
@@ -21,6 +21,11 @@
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import java.io.BufferedReader;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -36,6 +41,7 @@
 import org.apache.zookeeper.metrics.Counter;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 /**
  * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but only our integration.
@@ -176,4 +182,39 @@ private void validateMetricResponse(String response) throws IOException {
         assertThat(response, containsString("# TYPE cc_total counter"));
         assertThat(response, containsString("cc_total 10.0"));
     }
+
+    @Test
+    void testLogRedactorRedactsPasswords() throws Exception {
+        Logger logger = (Logger) LoggerFactory.getLogger(PrometheusMetricsProvider.class);
+        ListAppender<ILoggingEvent> listAppender = new ListAppender<>();
+        listAppender.start();
+        logger.addAppender(listAppender);
+
+        try {
+            provider = new PrometheusMetricsProvider();
+            Properties configuration = new Properties();
+            configuration.setProperty("httpPort", String.valueOf(httpPort));
+            configuration.setProperty("httpsPort", String.valueOf(httpsPort));
+            configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+            configuration.setProperty("ssl.keyStore.password", "SuperSecret123!");
+            configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+            configuration.setProperty("ssl.trustStore.password", "AnotherSecret456!");
+            provider.configure(configuration);
+
+            String logOutput = listAppender.list.stream()
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .filter(msg -> msg.contains("configuration"))
+                    .findFirst()
+                    .orElse("");
+
+            assertFalse(logOutput.contains("SuperSecret123!"),
+                    "Logs should not contain keyStore password");
+            assertFalse(logOutput.contains("AnotherSecret456!"),
+                    "Logs should not contain trustStore password");
+            assertTrue(logOutput.contains(testDataPath + "/ssl/server_keystore.jks"),
+                    "Logs should still contain non-sensitive config like keyStore location");
+        } finally {
+            logger.detachAppender(listAppender);
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java
new file mode 100644
index 00000000000..7a9cf1a85d3
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.util.Locale;
+import java.util.Map;
+import java.util.Properties;
+
+public class LogRedactor {
+
+    private LogRedactor() {}
+
+    /**
+     * Redacts all values which ends with "password" from the given properties / map.
+     * Other values are not changed.
+     *
+     * @param properties the properties in which all passwords should be redacted.
+     * @return new Properties object containing all values, passwords redacted.
+     */
+    public static Properties redactSensitiveValues(Map<?, ?> properties) {
+        Properties redactedConfig = new Properties();
+        properties.forEach((k, v) -> {
+            if (k != null && v != null) {
+                redactedConfig.put(k, redactValue((String) k, (String) v));
+            }
+        });
+        return redactedConfig;
+    }
+
+    /**
+     * Returns redacted value when the key ends with "password".
+     * Otherwise, just returns the value.
+     *
+     * @param key the key to check if it ends with "password".
+     * @return redacted value when the key ends with "password". Otherwise, the value.
+     */
+    public static String redactValue(String key, String value) {
+        if (key == null) {
+            return value;
+        }
+        if (key.toLowerCase(Locale.ROOT).endsWith("password")) {
+            return "***";
+        }
+        return value;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 2c9e63199c5..442d8e7221d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.common;
 
+import static org.apache.zookeeper.common.LogRedactor.redactSensitiveValues;
+import static org.apache.zookeeper.common.LogRedactor.redactValue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -25,7 +27,6 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.HashMap;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
@@ -105,11 +106,7 @@ public ZKConfig(File configFile) throws ConfigException {
     public ZKConfig(Path configPath) throws ConfigException {
         this();
         addConfiguration(configPath);
-        Map<String, String> p = new HashMap<>();
-        for (Entry<String, String> entry : properties.entrySet()) {
-            p.put(entry.getKey(), logRedactor(entry.getKey(), entry.getValue()));
-        }
-        LOG.info("ZK Config {}", p);
+        LOG.info("ZK Config {}", redactSensitiveValues(properties));
     }
 
     private void init() {
@@ -211,7 +208,7 @@ public void setProperty(String key, String value) {
         }
         String oldValue = properties.put(key, value);
         if (null != oldValue && !oldValue.equals(value)) {
-            LOG.debug("key {}'s value {} is replaced with new value {}", key, logRedactor(key, oldValue), logRedactor(key, value));
+            LOG.debug("key {}'s value {} is replaced with new value {}", key, redactValue(key, oldValue), redactValue(key, value));
         }
     }
 
@@ -341,14 +338,4 @@ public int getInt(String key, int defaultValue) {
         }
         return defaultValue;
     }
-
-    private String logRedactor(String key, String value) {
-        if (key == null) {
-            return value;
-        }
-        if (key.toLowerCase(Locale.ROOT).endsWith("password")) {
-            return "***";
-        }
-        return value;
-    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java
new file mode 100644
index 00000000000..a15696f0275
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java
@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+import org.junit.jupiter.api.Test;
+
+class LogRedactorTest {
+
+    @Test
+    void testRedactValueWithPasswordKey() {
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.password", "secret"));
+        assertEquals("***", LogRedactor.redactValue("ssl.trustStore.password", "secret"));
+        assertEquals("***", LogRedactor.redactValue("somePassword", "secret"));
+    }
+
+    @Test
+    void testRedactValueCaseInsensitive() {
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.PASSWORD", "secret"));
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.Password", "secret"));
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.passWORD", "secret"));
+    }
+
+    @Test
+    void testRedactValueNonSensitiveKey() {
+        assertEquals("localhost", LogRedactor.redactValue("server.host", "localhost"));
+        assertEquals("8080", LogRedactor.redactValue("httpPort", "8080"));
+        assertEquals("/path/to/keystore", LogRedactor.redactValue("ssl.keyStore.location", "/path/to/keystore"));
+    }
+
+    @Test
+    void testRedactValueNullKey() {
+        assertEquals("someValue", LogRedactor.redactValue(null, "someValue"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesWithStringMap() {
+        Map<String, String> config = new HashMap<>();
+        config.put("ssl.keyStore.location", "/path/to/keystore.jks");
+        config.put("ssl.keyStore.password", "SuperSecret");
+        config.put("httpPort", "9141");
+
+        Properties redacted = LogRedactor.redactSensitiveValues(config);
+
+        assertEquals("/path/to/keystore.jks", redacted.get("ssl.keyStore.location"));
+        assertEquals("***", redacted.get("ssl.keyStore.password"));
+        assertEquals("9141", redacted.get("httpPort"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesWithProperties() {
+        Properties config = new Properties();
+        config.setProperty("ssl.trustStore.password", "TrustSecret");
+        config.setProperty("ssl.trustStore.location", "/path/to/truststore.jks");
+
+        Properties redacted = LogRedactor.redactSensitiveValues(config);
+
+        assertEquals("***", redacted.get("ssl.trustStore.password"));
+        assertEquals("/path/to/truststore.jks", redacted.get("ssl.trustStore.location"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesSkipsNullValues() {
+        Map<String, String> config = new HashMap<>();
+        config.put("ssl.keyStore.location", null);
+        config.put("httpPort", "9141");
+
+        Properties redacted = LogRedactor.redactSensitiveValues(config);
+
+        assertFalse(redacted.containsKey("ssl.keyStore.location"));
+        assertEquals("9141", redacted.get("httpPort"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesEmptyMap() {
+        Properties redacted = LogRedactor.redactSensitiveValues(new HashMap<>());
+        assertTrue(redacted.isEmpty());
+    }
+}